@wrongstack/cli 1.0.19 → 1.0.26

package/dist/chunk-4TVYGG6G.js

@@ -0,0 +1,62 @@
+
+// src/permission-rules-view.ts
+import {
+  compilePermissionRules,
+  matchedPermissionRule,
+  withExecutorGate
+} from "@wrongstack/core/security";
+async function explainCall(policy, tool, input, ctx, yolo) {
+  if (!policy.explain) throw new Error("This permission policy cannot explain its decisions.");
+  const trace = withExecutorGate(await policy.explain(tool, input, ctx), tool, yolo);
+  const rules = await compilePermissionRules(policy, ctx, { yolo });
+  return { trace, rules, rule: matchedPermissionRule(rules, trace) };
+}
+function actionText(rule) {
+  return rule.action === "*" ? "any tool" : rule.action;
+}
+function resourceText(rule) {
+  return rule.resource === "*" ? "any input" : rule.resource;
+}
+function describePermissionRule(rule) {
+  return `#${rule.n} ${rule.effect} ${actionText(rule)} \u2192 ${resourceText(rule)} (${rule.source})`;
+}
+function formatPermissionRules(rules) {
+  const width = String(rules.length).length;
+  const lines = ["Permission rules, in the order they are checked; the first match decides:", ""];
+  for (const rule of rules) {
+    lines.push(
+      `  ${String(rule.n).padStart(width)}. ${rule.effect.padEnd(5)} ${rule.source.padEnd(15)} ${actionText(rule)} \u2192 ${resourceText(rule)}`
+    );
+    if (rule.note) lines.push(`  ${" ".repeat(width)}  ${" ".repeat(22)}${rule.note}`);
+  }
+  return lines.join("\n");
+}
+function formatExplainedCall({ trace, rule }) {
+  const lines = [];
+  lines.push(`Permission trace for "${trace.toolName}"`);
+  lines.push(`Subject: ${trace.subject ?? "(none)"}`);
+  lines.push("");
+  for (let i = 0; i < trace.steps.length; i++) {
+    const step = trace.steps[i];
+    if (!step) continue;
+    const winner = i === trace.winnerIndex ? " \u2190 WINNER" : "";
+    const matched = step.matched ? "\u2713" : " ";
+    lines.push(`  ${matched} [${i}] ${step.rule}${winner}`);
+    lines.push(`        decision: ${step.decision}  source: ${step.source}`);
+    lines.push(`        ${step.detail}`);
+    if (i < trace.steps.length - 1) lines.push("");
+  }
+  lines.push("");
+  lines.push(`Effective: ${trace.decision.permission} (source: ${trace.decision.source})`);
+  if (rule) lines.push(`Rule: ${describePermissionRule(rule)}`);
+  if (trace.decision.reason) lines.push(`Reason: ${trace.decision.reason}`);
+  if (trace.decision.riskTier) lines.push(`Risk tier: ${trace.decision.riskTier}`);
+  return lines.join("\n");
+}
+
+export {
+  explainCall,
+  formatPermissionRules,
+  formatExplainedCall
+};
+//# sourceMappingURL=chunk-4TVYGG6G.js.map

package/dist/chunk-5JYDKG5B.js

@@ -0,0 +1,154 @@
+import {
+  API_VERSION,
+  CLI_VERSION
+} from "./chunk-F5DCFAKI.js";
+
+// src/subcommands/handlers/version-help.ts
+import * as os from "node:os";
+import { color } from "@wrongstack/core/utils";
+var versionCmd = async (_args, deps) => {
+  const bunVersion = globalThis.Bun?.version;
+  const runtime = bunVersion ? `bun v${bunVersion}` : `node ${process.version}`;
+  deps.renderer.write(
+    `WrongStack ${CLI_VERSION} (apiVersion ${API_VERSION}, ${runtime}, ${os.platform()})
+`
+  );
+  return 0;
+};
+function row(left, description) {
+  const pad = 31;
+  return left.length < pad - 2 ? `  ${left.padEnd(pad - 2)}${description}` : `  ${left}
+${" ".repeat(pad)}${description}`;
+}
+function section(title, rows) {
+  return ["", color.bold(title), ...rows.map(([left, description]) => row(left, description))];
+}
+var helpCmd = async (_args, deps) => {
+  const lines = [
+    color.bold("WrongStack \u2014 usage"),
+    "",
+    '  wstack [flags] ["<task>"]    With a task: run it and exit. Without: start a session.',
+    "  wstack <command> --help      Details for one command",
+    ...section("Start", [
+      ["wstack", "Interactive session (REPL or TUI, picked at launch)"],
+      ['wstack "<task>"', 'Run one task and exit (also: --prompt "<task>")'],
+      ["wstack quick", "Straight into the TUI with saved defaults"],
+      ["wstack webui | simpleui", "Browser UI / minimal chat UI for this project"],
+      ["wstack desktop", "WrongStack Desktop (requires @wrongstack/desktop)"],
+      ["wstack hq", "HQ command center across projects and machines"],
+      ["wstack remote <user@host:/path>", "Run on a remote machine over SSH; WebUI tunneled here"],
+      ['wstack --eternal "<mission>"', "Eternal-autonomy loop against a goal (Ctrl+C stops)"],
+      ["wstack acp [serve]", "Agent Client Protocol server for editors"]
+    ]),
+    ...section("Sessions", [
+      ["wstack sessions", "List recent sessions (also: fork, doctor, fleet)"],
+      ["wstack resume [<id>]", "Resume a session (same as -r)"],
+      ["wstack rewind [<id>]", "Rewind a session to an earlier point"],
+      ["wstack export <id>", "Render a session as markdown, JSON or text"],
+      ["wstack audit | replay [<id>]", "Tamper-evident audit log / recorded provider responses"],
+      ["wstack chronicle", "Cross-session timeline and metrics"],
+      ["wstack usage", "Token and cost summary"]
+    ]),
+    ...section("Setup", [
+      ["wstack auth", "Provider keys: add/edit/remove, list, status, local"],
+      ["wstack providers | models", "Browse providers and models; models add|remove|refresh"],
+      ["wstack config", "Show, edit, back up or restore the active profile config"],
+      ["wstack config-export | config-import", "Move behaviour settings via ./wstack-config.json"],
+      ["wstack mcp", "MCP servers: list, add, remove, serve"],
+      ["wstack import-claude-code", "Import MCP servers from Claude Code (preview; --apply)"],
+      ["wstack plugin", "Plugins: list, install, enable, disable, remove"],
+      ["wstack tools | skills", "List registered tools / discovered skills"],
+      ["wstack typesafe", "TypeSafe account: status, login, test"],
+      ["wstack update", "Self-update (--check-only)"]
+    ]),
+    ...section("Project & diagnostics", [
+      ["wstack project | projects", "Committed project identity / tracked projects"],
+      ["wstack permissions explain", "Why a tool call is allowed, asked or denied"],
+      ["wstack doctor | diag", "Health checks / full diagnostic dump"],
+      ["wstack governance status", "Project-daemon health"],
+      ["wstack modeldiag | bench", "Model capability diagnostics / agentic benchmarks"],
+      ["wstack mailbox serve", "HTTP bridge for external agents"],
+      ["wstack version", "Print version"]
+    ]),
+    ...section("Session flags", [
+      ["-c, --continue", "Resume the most recent session"],
+      ["-r, --resume [<id>]", "Resume a session (latest when no id)"],
+      ["--recover", "Reopen the last session that never closed (crash, kill)"],
+      ["--fork-session", "With -c/-r/--recover: continue a copy, keep the original"],
+      ["--provider <id> --model <id>", "Provider and model for this run"],
+      ["--fallback-model <a,b,...>", "Models to fall back to when the primary is unavailable"],
+      ["--effort <level>", "Reasoning effort: none|minimal|low|medium|high|xhigh|max"],
+      ["--system-prompt lite|pro|default", "Bundled system-prompt variant"],
+      [
+        "--append-system-prompt <text> | --append-system-prompt-file <path>",
+        "Add instructions to the host agent prompt for this run"
+      ],
+      ['--goal "<goal>" | --ask "<q>"', "Open the TUI with a goal or a question queued"]
+    ]),
+    ...section("Tools & permissions", [
+      ["--yolo | --no-yolo", "Auto-approve on or off (gated destructive kinds still ask)"],
+      ["--yolo-destructive", "Let YOLO run every destructive kind you may un-gate"],
+      ["--restricted", "Untrusted repo: no shell/network/MCP tools, stay in project, no YOLO"],
+      ["--safe-mode", "Troubleshoot: no 3rd-party plugins, hooks, MCP, skills, overrides"],
+      ["--only-tools <a,b,...>", "Expose only these tools (trailing * = prefix: mcp__gh__*)"],
+      ["--disallowed-tools <a,b,...>", "Hide these tools, subagents included"],
+      ["--allowed-tools <a,b,...>", "Run these without a prompt (destructive calls still ask)"],
+      ["--mcp-config <file|json>", "Extra MCP servers for this run (.mcp.json accepted)"],
+      ["--strict-mcp-config", "Start only the --mcp-config servers"],
+      ["--no-hooks", "Skip user and plugin hooks (policy hooks still run)"]
+    ]),
+    ...section("Scripting (with a task)", [
+      ["<stdin>", 'Piped input becomes context: git diff | wstack "review this"'],
+      ["--output-json", "One JSON result line: status, finalText, sessionId, usage"],
+      [
+        "--output-format text|json|stream-json",
+        "stream-json: init, assistant, tool_result, result lines"
+      ],
+      ["--include-partial-messages", "stream-json: add text_delta lines"],
+      ["--json-schema <file|json>", "Answer must be JSON matching the schema (structuredOutput)"],
+      ["--max-budget-usd <amount>", "Stop once spend (leader + subagents) passes the amount"],
+      ["", "Exit: 0 done, 1 failed/limit/budget/schema, 130 aborted, 2 usage"]
+    ]),
+    ...section("Interfaces", [
+      ["--tui | --no-tui", "Force or disable the TUI"],
+      ["--mouse", "Full mouse mode in the TUI"],
+      ["--ascii", "Plain-ASCII symbols, borders and spinners (no emoji or box drawing)"],
+      ["--desktop", "Same as wstack desktop"],
+      [
+        "--webui [--host <h>] [--port <n>] [--open]",
+        "Browser UI (+ --webui-token, --webui-public-url, ...)"
+      ],
+      [
+        "--simpleui [same flags] [--full-auto]",
+        "Minimal chat UI; --full-auto = YOLO + autonomy for this run only"
+      ],
+      [
+        "--hq [--host <h>] [--port <n>] [--password <p>] [--tunnel] [--open]",
+        "HQ server (+ --hq-allowlist, --hq-public-url)"
+      ]
+    ]),
+    ...section("Startup & tuning", [
+      ["--skip", "Skip every startup prompt; use saved choices"],
+      ["--skip-index", "Skip codebase indexing at startup"],
+      ["--no-models-refresh", "Use the cached model catalog"],
+      ["--token-saving-tier <tier>", "auto|off|minimal|light|medium|aggressive"],
+      ["--max-concurrent <n> | --max-spawns <n>", "Fleet concurrency / lifetime subagent spawns"],
+      ["--chimera-auto-fix off|ask|auto", "How to handle Chimera review findings"],
+      ["--cwd <dir>", "Run as if started in <dir>"],
+      ["--verbose | --trace | --log-level <l>", "Log verbosity"],
+      ["--metrics [--metrics-port <n>]", "Metrics and health; Prometheus endpoint on the port"],
+      [
+        "--record | --replay <session-id>",
+        "Record provider responses / serve them back (test harnesses; a changed prompt misses)"
+      ]
+    ])
+  ];
+  deps.renderer.write(lines.join("\n") + "\n");
+  return 0;
+};
+
+export {
+  versionCmd,
+  helpCmd
+};
+//# sourceMappingURL=chunk-5JYDKG5B.js.map

package/dist/{chunk-KEPABQYT.js → chunk-5SEYGOCH.js}

@@ -1,3 +1,6 @@
+import {
+  resolveProviderCfgWithProxy
+} from "./chunk-S4FFHDJG.js";
 import {
   fallbackCodexProviderModels,
   filterCurrentCodexModelIds,
@@ -140,83 +143,6 @@ async function refreshAcpRegistry(paths, opts) {
   return { count: result.agents.length, location, fetchedAt: result.fetchedAt };
 }
 
-// src/wiring/provider-runtime.ts
-import { makeProviderFromConfig } from "@wrongstack/providers";
-import {
-  getProxyConfig,
-  isProxyEligible,
-  rewriteBaseUrl,
-  sanitizeUrlForLog,
-  shouldRewriteFor
-} from "@wrongstack/core/wiring/proxy-rewrite";
-function resolveProviderCfg(config, providerId, opts) {
-  const savedCfg = config.providers?.[providerId];
-  const rawBaseUrl = savedCfg?.baseUrl ?? config.baseUrl;
-  let rewriteReason = "no-base-url";
-  let baseUrl = rawBaseUrl;
-  if (rawBaseUrl && shouldRewriteFor(providerId)) {
-    const rewritten = rewriteBaseUrl(rawBaseUrl, currentProxyBaseUrl());
-    if (rewritten !== rawBaseUrl) {
-      rewriteReason = "applied";
-      baseUrl = rewritten;
-    } else {
-      rewriteReason = passthroughReason(rawBaseUrl);
-    }
-  } else if (rawBaseUrl) {
-    rewriteReason = proxySkipReason(providerId);
-  }
-  opts?.logger?.info(
-    `WrongProxy rewrite ${rewriteReason} for provider '${providerId}': ${sanitizeUrlForLog(rawBaseUrl) || "<none>"} -> ${sanitizeUrlForLog(baseUrl) || "<none>"}`
-  );
-  const cfg = {
-    ...savedCfg,
-    apiKey: savedCfg?.apiKey ?? config.apiKey,
-    baseUrl,
-    type: providerId
-  };
-  const factoryType = savedCfg?.type ?? providerId;
-  return { cfg, factoryType };
-}
-function passthroughReason(rawBaseUrl) {
-  if (!rawBaseUrl.includes("://")) return "no-scheme";
-  const proxyRoot = currentProxyBaseUrl().replace(/\/+$/, "");
-  if (proxyRoot && rawBaseUrl.startsWith(`${proxyRoot}/proxy/`)) {
-    return "already-rewritten";
-  }
-  try {
-    const parsed = new URL(rawBaseUrl);
-    const host = parsed.hostname;
-    const isLoopback = host === "localhost" || host === "127.0.0.1" || host === "[::1]";
-    if (isLoopback && parsed.port !== "") return "loopback";
-  } catch {
-  }
-  return "ineligible";
-}
-function proxySkipReason(providerId) {
-  const cfg = getProxyConfig();
-  if (!cfg.enabled) return "disabled";
-  if (!cfg.url) return "no-proxy-url";
-  if (!cfg.active) return "inactive";
-  if (!isProxyEligible(providerId)) return "excluded";
-  return "unknown";
-}
-function currentProxyBaseUrl() {
-  return getProxyConfig().url;
-}
-function resolveProviderCfgWithProxy(config, providerId, opts) {
-  return resolveProviderCfg(config, providerId, opts);
-}
-function buildProviderForId(args, providerId) {
-  const { cfg, factoryType } = resolveProviderCfg(args.config, providerId, {
-    logger: args.logger
-  });
-  const useRegistry = !!args.config.features.modelsRegistry && args.providerRegistry.has(factoryType);
-  return useRegistry ? args.providerRegistry.create(cfg, factoryType) : makeProviderFromConfig(
-    providerId,
-    factoryType === "ai-gateway" ? { ...cfg, type: factoryType } : cfg
-  );
-}
-
 // src/shutdown-cleanup.ts
 function createGracefulShutdown(cleanup) {
   const exitCode = cleanup.exitCode ?? 0;
@@ -269,7 +195,8 @@ import {
   createSetupProviderFactory,
   installCatalogModelOutputLimits,
   isSetupProvider,
-  makeProviderFromConfig as makeProviderFromConfig2,
+  makeProviderFromConfig,
+  setStreamTimeoutDefaults,
   setupProviderResolved,
   withCatalogCapabilities
 } from "@wrongstack/providers";
@@ -339,6 +266,7 @@ async function setupProvider(params) {
       context: { provider: config.provider, family: resolvedProvider.npm, kind: "unsupported" }
     });
   }
+  setStreamTimeoutDefaults(config.modelRuntime?.streaming);
   if (config.features.modelsRegistry) {
     await installCatalogModelOutputLimits({
       registry: modelsRegistry,
@@ -379,7 +307,7 @@ Try \`wstack models refresh\` once you have network access.`,
     if (providerRegistry.has(factoryType)) {
       provider = providerRegistry.create(cfgWithType, factoryType);
     } else {
-      provider = makeProviderFromConfig2(config.provider, { ...cfgWithType, type: factoryType });
+      provider = makeProviderFromConfig(config.provider, { ...cfgWithType, type: factoryType });
     }
   } catch (err) {
     throw new ConfigError({
@@ -405,9 +333,7 @@ export {
   formatAcpAgentList,
   loadCachedAcpRegistry,
   refreshAcpRegistry,
-  resolveProviderCfg,
-  buildProviderForId,
   setupProvider,
   createGracefulShutdown
 };
-//# sourceMappingURL=chunk-KEPABQYT.js.map
+//# sourceMappingURL=chunk-5SEYGOCH.js.map

package/dist/{chunk-3VXYY5JC.js → chunk-5UZBUV2H.js}

@@ -1,6 +1,6 @@
 
 // src/provider-helpers.ts
-import { hasProviderCredential } from "@wrongstack/core/models";
+import { hasProviderCredential, isKeylessLocalProvider } from "@wrongstack/core/models";
 import { catalogProviderIdFor } from "@wrongstack/providers";
 function uniqueModelIds(primary, fallback) {
   const seen = /* @__PURE__ */ new Set();
@@ -18,22 +18,6 @@ function visibleModelIds(providerId, config, catalogModelIds, cfg) {
   if (entry?.models === void 0) return [...catalogModelIds];
   return uniqueModelIds(entry.models, catalogModelIds);
 }
-function isLoopbackUrl(apiBase) {
-  if (!apiBase) return false;
-  let host;
-  try {
-    host = new URL(apiBase).hostname.toLowerCase();
-  } catch {
-    return false;
-  }
-  host = host.replace(/^\[|\]$/g, "");
-  if (host === "localhost" || host === "::1" || host === "0.0.0.0") return true;
-  return /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(host);
-}
-function isKeylessLocalProvider(provider) {
-  if (provider.envVars && provider.envVars.length > 0) return false;
-  return isLoopbackUrl(provider.apiBase);
-}
 function hasApiKey(provider, config) {
   return hasProviderCredential(provider, config);
 }
@@ -122,9 +106,9 @@ function modelDetails(models) {
 }
 
 export {
-  visibleModelIds,
   isKeylessLocalProvider,
+  visibleModelIds,
   hasApiKey,
   buildPickableProviders
 };
-//# sourceMappingURL=chunk-3VXYY5JC.js.map
+//# sourceMappingURL=chunk-5UZBUV2H.js.map