@wrongstack/cli 1.0.19 → 1.0.26

package/dist/chunk-X756ZS72.js

@@ -0,0 +1,329 @@
+import {
+  STANDALONE_TARGET
+} from "./chunk-F5DCFAKI.js";
+
+// src/standalone-update.ts
+import { createHash as createHash2, randomBytes } from "node:crypto";
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { FetchError } from "@wrongstack/core/types";
+
+// src/release-asset-download.ts
+import { createHash } from "node:crypto";
+import * as fsp from "node:fs/promises";
+async function downloadReleaseAsset(url, timeoutMs, maxBytes) {
+  const res = await fetch(url, {
+    signal: AbortSignal.timeout(timeoutMs),
+    headers: { "User-Agent": "wrongstack-cli" },
+    redirect: "follow"
+  });
+  if (!res.ok) throw new Error(`download ${url} responded ${res.status}`);
+  const declared = Number(res.headers.get("content-length") ?? "0");
+  if (declared > maxBytes) throw new Error(`download ${url} is too large`);
+  if (!res.body) return Buffer.alloc(0);
+  const chunks = [];
+  let received = 0;
+  const reader = res.body.getReader();
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      received += value.byteLength;
+      if (received > maxBytes) {
+        await reader.cancel();
+        throw new Error(`download ${url} is too large`);
+      }
+      chunks.push(Buffer.from(value.buffer, value.byteOffset, value.byteLength));
+    }
+  } finally {
+    reader.releaseLock();
+  }
+  return Buffer.concat(chunks, received);
+}
+async function downloadReleaseAssetToFile(url, file, options) {
+  const timeout = AbortSignal.timeout(options.timeoutMs);
+  const res = await fetch(url, {
+    signal: options.signal ? AbortSignal.any([options.signal, timeout]) : timeout,
+    headers: { "User-Agent": "wrongstack-cli" },
+    redirect: "follow"
+  });
+  if (!res.ok) throw new Error(`download ${url} responded ${res.status}`);
+  const declared = Number(res.headers.get("content-length") ?? "0");
+  if (declared > options.maxBytes) throw new Error(`download ${url} is too large`);
+  const hash = createHash("sha256");
+  const out = await fsp.open(file, "wx", 384);
+  let received = 0;
+  try {
+    if (res.body) {
+      const reader = res.body.getReader();
+      try {
+        while (true) {
+          const { done, value } = await reader.read();
+          if (done) break;
+          received += value.byteLength;
+          if (received > options.maxBytes) {
+            await reader.cancel();
+            throw new Error(`download ${url} is too large`);
+          }
+          hash.update(value);
+          await out.write(value);
+        }
+      } finally {
+        reader.releaseLock();
+      }
+    }
+    await out.sync();
+  } catch (err) {
+    await out.close().catch(() => void 0);
+    await fsp.rm(file, { force: true });
+    throw err;
+  }
+  await out.close();
+  return hash.digest("hex");
+}
+
+// src/release-attestation.ts
+var RELEASES_REPO = "WrongStack/WrongStack";
+var RELEASES_REPO_ID = 1237163046;
+var REPO_URL = `https://github.com/${RELEASES_REPO}`;
+var IN_TOTO_PAYLOAD = "application/vnd.in-toto+json";
+var IN_TOTO_STATEMENT = "https://in-toto.io/Statement/v1";
+var SLSA_PROVENANCE = "https://slsa.dev/provenance/v1";
+var obj = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+function statementOf(attestation) {
+  const envelope = obj(obj(attestation["bundle"])?.["dsseEnvelope"]);
+  if (envelope?.["payloadType"] !== IN_TOTO_PAYLOAD) return void 0;
+  const payload = envelope["payload"];
+  if (typeof payload !== "string") return void 0;
+  try {
+    return obj(JSON.parse(Buffer.from(payload, "base64").toString("utf8")));
+  } catch {
+    return void 0;
+  }
+}
+function vouches(attestation, subject) {
+  if (attestation["repository_id"] !== RELEASES_REPO_ID) return false;
+  const statement = statementOf(attestation);
+  if (statement?.["_type"] !== IN_TOTO_STATEMENT) return false;
+  if (statement["predicateType"] !== SLSA_PROVENANCE) return false;
+  const subjects = Array.isArray(statement["subject"]) ? statement["subject"] : [];
+  const named = subjects.some((entry) => {
+    const s = obj(entry);
+    return s?.["name"] === subject.assetName && obj(s["digest"])?.["sha256"] === subject.sha256;
+  });
+  if (!named) return false;
+  const tag = `refs/tags/v${subject.version}`;
+  const predicate = obj(statement["predicate"]);
+  const build = obj(predicate?.["buildDefinition"]);
+  const workflow = obj(obj(build?.["externalParameters"])?.["workflow"]);
+  const github = obj(obj(build?.["internalParameters"])?.["github"]);
+  const builder = obj(obj(predicate?.["runDetails"])?.["builder"]);
+  return workflow?.["repository"] === REPO_URL && workflow["path"] === ".github/workflows/release.yml" && workflow["ref"] === tag && builder?.["id"] === `${REPO_URL}/.github/workflows/binaries.yml@${tag}` && github?.["event_name"] === "push" && github["runner_environment"] === "github-hosted";
+}
+function attestationsVouchFor(response, subject) {
+  const list = obj(response)?.["attestations"];
+  if (!Array.isArray(list)) return false;
+  return list.some((entry) => {
+    const attestation = obj(entry);
+    return attestation !== void 0 && vouches(attestation, subject);
+  });
+}
+async function verifyReleaseAttestation(subject, signal) {
+  const url = `https://api.github.com/repos/${RELEASES_REPO}/attestations/sha256:${subject.sha256}`;
+  const timeout = AbortSignal.timeout(3e4);
+  const res = await fetch(url, {
+    signal: signal ? AbortSignal.any([signal, timeout]) : timeout,
+    headers: { Accept: "application/vnd.github+json", "User-Agent": "wrongstack-cli" }
+  });
+  if (res.status === 404) {
+    throw new Error(`no build attestation exists for ${subject.assetName}`);
+  }
+  if (!res.ok) {
+    const limited = res.status === 403 || res.status === 429;
+    throw new Error(
+      limited ? "GitHub API rate limit reached while checking the build attestation; try again later" : `GitHub attestations API responded ${res.status}`
+    );
+  }
+  if (!attestationsVouchFor(await res.json(), subject)) {
+    throw new Error(
+      `${subject.assetName} has no attestation from the v${subject.version} release workflow`
+    );
+  }
+}
+
+// src/standalone-update.ts
+var API_LATEST = `https://api.github.com/repos/${RELEASES_REPO}/releases/latest`;
+var MAX_BINARY_BYTES = 512 * 1024 * 1024;
+var MAX_CHECKSUM_BYTES = 1024 * 1024;
+function standaloneAssetName(target) {
+  const name = `wstack-${target.replace(/^bun-/, "")}`;
+  return target.startsWith("bun-windows") ? `${name}.exe` : name;
+}
+async function fetchLatestRelease(timeoutMs, signal) {
+  const timeoutSignal = AbortSignal.timeout(timeoutMs);
+  const res = await fetch(API_LATEST, {
+    signal: signal ? AbortSignal.any([signal, timeoutSignal]) : timeoutSignal,
+    headers: { Accept: "application/vnd.github+json", "User-Agent": "wrongstack-cli" }
+  });
+  if (!res.ok) {
+    throw new FetchError({
+      message: `GitHub releases responded ${res.status}`,
+      status: res.status,
+      context: { op: "checkForUpdate", registry: "github-releases", url: API_LATEST }
+    });
+  }
+  const data = await res.json();
+  if (typeof data.tag_name !== "string") throw new Error("Latest release has no tag");
+  const assets = Array.isArray(data.assets) ? data.assets.filter(
+    (a) => typeof a?.name === "string" && typeof a?.browser_download_url === "string" && (a.digest === void 0 || a.digest === null || typeof a.digest === "string")
+  ) : [];
+  return { version: data.tag_name.replace(/^v/, ""), assets };
+}
+async function findStandaloneRelease(target, signal) {
+  const release = await fetchLatestRelease(15e3, signal);
+  const assetName = standaloneAssetName(target);
+  const asset = release.assets.find((a) => a.name === assetName);
+  const sums = release.assets.find((a) => a.name === "SHA256SUMS");
+  if (!asset || !sums) throw new Error(`release v${release.version} has no ${assetName} build`);
+  return { version: release.version, assetName, asset, sums };
+}
+async function verifyStandaloneDigest(release, sha256, signal) {
+  const sumsText = (await downloadReleaseAsset(release.sums.browser_download_url, 3e4, MAX_CHECKSUM_BYTES)).toString("utf8");
+  if (parseSha256Sums(sumsText).get(release.assetName) !== sha256) {
+    throw new Error("checksum does not match the release SHA256SUMS");
+  }
+  const digest = release.asset.digest;
+  if (typeof digest === "string" && digest !== `sha256:${sha256}`) {
+    throw new Error("checksum does not match the digest GitHub recorded for the asset");
+  }
+  await verifyReleaseAttestation(
+    { assetName: release.assetName, sha256, version: release.version },
+    signal
+  );
+}
+async function fetchLatestStandaloneVersion(timeoutMs = 3e3, signal) {
+  return (await fetchLatestRelease(timeoutMs, signal)).version;
+}
+function parseSha256Sums(text) {
+  const sums = /* @__PURE__ */ new Map();
+  for (const line of text.split(/\r?\n/)) {
+    const match = line.trim().match(/^([0-9a-f]{64})\s+\*?(.+)$/i);
+    if (match?.[1] && match[2]) {
+      const name = match[2].trim();
+      if (sums.has(name)) throw new Error(`Duplicate SHA256SUMS entry: ${name}`);
+      sums.set(name, match[1].toLowerCase());
+    }
+  }
+  return sums;
+}
+function replaceExecutable(target, bytes, platform = process.platform) {
+  const staged = stagingPath(target);
+  fs.writeFileSync(staged, bytes, { mode: 493, flag: "wx" });
+  swapIntoPlace(target, staged, platform);
+}
+function installExecutableFrom(target, source, sha256, platform = process.platform) {
+  const staged = stagingPath(target);
+  fs.copyFileSync(source, staged, fs.constants.COPYFILE_EXCL);
+  try {
+    if (sha256File(staged) !== sha256) throw new Error("staged update does not match its digest");
+    fs.chmodSync(staged, 493);
+  } catch (error) {
+    fs.rmSync(staged, { force: true });
+    throw error;
+  }
+  swapIntoPlace(target, staged, platform);
+}
+function stagingPath(target) {
+  return `${target}.new-${randomBytes(9).toString("hex")}`;
+}
+function sha256File(file) {
+  const hash = createHash2("sha256");
+  const fd = fs.openSync(file, "r");
+  try {
+    const chunk = Buffer.allocUnsafe(1024 * 1024);
+    let read = fs.readSync(fd, chunk);
+    while (read > 0) {
+      hash.update(chunk.subarray(0, read));
+      read = fs.readSync(fd, chunk);
+    }
+  } finally {
+    fs.closeSync(fd);
+  }
+  return hash.digest("hex");
+}
+function swapIntoPlace(target, staged, platform) {
+  try {
+    if (platform === "win32") {
+      const aside = `${target}.old`;
+      fs.rmSync(aside, { force: true });
+      fs.renameSync(target, aside);
+      try {
+        fs.renameSync(staged, target);
+      } catch (error) {
+        fs.renameSync(aside, target);
+        throw error;
+      }
+    } else {
+      fs.renameSync(staged, target);
+    }
+  } finally {
+    fs.rmSync(staged, { force: true });
+  }
+}
+async function updateStandaloneBinary(options) {
+  const { renderer } = options;
+  if (!STANDALONE_TARGET) {
+    renderer.write("Update failed: this executable does not record its build target.\n");
+    return 1;
+  }
+  try {
+    const release = await findStandaloneRelease(STANDALONE_TARGET);
+    renderer.write(`Updating wrongstack from v${options.current} to v${release.version}...
+`);
+    const executable = fs.realpathSync(process.execPath);
+    const staged = options.staged;
+    if (staged && staged.version === release.version) {
+      renderer.write(`Installing the v${staged.version} build already downloaded
+`);
+      installExecutableFrom(executable, staged.file, staged.sha256);
+    } else {
+      renderer.write(`Downloading ${release.assetName}
+`);
+      const bytes = await downloadReleaseAsset(
+        release.asset.browser_download_url,
+        6e5,
+        MAX_BINARY_BYTES
+      );
+      renderer.write("Verifying the checksum and the build attestation\n");
+      await verifyStandaloneDigest(release, createHash2("sha256").update(bytes).digest("hex"));
+      replaceExecutable(executable, bytes);
+    }
+    renderer.write(
+      `
+Updated ${path.basename(executable)} to v${release.version}. Restart wrongstack to use it.
+`
+    );
+    return 0;
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    const permission = /EACCES|EPERM/.test(msg) ? "\nThe executable is not writable by this user; rerun with the permissions it was installed with." : "";
+    renderer.write(`
+Update failed: ${msg}${permission}
+`);
+    return 1;
+  }
+}
+
+export {
+  downloadReleaseAssetToFile,
+  MAX_BINARY_BYTES,
+  standaloneAssetName,
+  findStandaloneRelease,
+  verifyStandaloneDigest,
+  fetchLatestStandaloneVersion,
+  parseSha256Sums,
+  replaceExecutable,
+  installExecutableFrom,
+  updateStandaloneBinary
+};
+//# sourceMappingURL=chunk-X756ZS72.js.map

package/dist/{chunk-XJ7K67PP.js → chunk-YHYINL47.js}

@@ -4,12 +4,15 @@ import {
 import {
   PLUGIN_AUDIT_ENTRIES,
   loadExternalPlugins
-} from "./chunk-SIS37L3W.js";
+} from "./chunk-L2RVEQWO.js";
 
 // src/wiring/plugins.ts
 import { join } from "node:path";
 import { loadPlugins, resolvePluginConfig, resolvePluginEnablement } from "@wrongstack/core/plugin";
-import { OFFICIAL_PLUGIN_FACTORIES } from "@wrongstack/plugins/factories";
+import {
+  OFFICIAL_PLUGIN_FACTORIES,
+  OFFICIAL_PLUGIN_SPECIFIERS
+} from "@wrongstack/plugins/factories";
 
 // src/plugin-api-factory.ts
 import { DefaultPluginAPI } from "@wrongstack/core/plugin";
@@ -20,7 +23,21 @@ function createApi(ownerName, base) {
 // src/wiring/plugins.ts
 var DEPRECATED_PLUGIN_NAMES = {
   "web-search": "use the built-in `search` and `fetch` tools",
-  "json-path": "use the built-in `json` tool with action: query | validate | transform | merge"
+  "json-path": "use the built-in `json` tool with action: query | validate | transform | merge",
+  // Deleted in the 2026-09-17 catalog review. The first four produced
+  // findings that were noise by construction (each was run against this
+  // repo and mis-reported); the rest duplicated infrastructure the host
+  // already ships. Kept here so an existing config that still lists one
+  // warns and skips instead of failing to resolve the import.
+  "interface-contract-guard": "removed \u2014 it reported plain data interfaces as unimplemented",
+  "refactor-suggester": "removed \u2014 use `lint-gate` plus the built-in `grep` and `read` tools",
+  "feature-flag-tracker": "removed \u2014 use the built-in `grep` tool with your own flag pattern",
+  "dead-code-detector": "removed \u2014 use your linter / `tsc` and `duplicate-code-detector`",
+  "semantic-search-indexer": "use the built-in `grep` tool or the codebase-index MCP server",
+  "knowledge-graph": "use the built-in `remember` / `search_memory` / `find_related_memories`",
+  "todo-tracker": "use the built-in `todo` tool and the Kanban board",
+  "smart-rename": "use the built-in `replace` tool",
+  "code-metrics": "removed \u2014 it reported numbers nothing acted on"
 };
 var deprecatedWarningsEmitted = /* @__PURE__ */ new Set();
 var BUILTIN_PLUGIN_CONFIG_ALIASES = {
@@ -95,6 +112,28 @@ var BUILTIN_PLUGIN_FACTORIES = [
   // ── Telegram plugin ─────────────────────────────────────────────────
   async () => (await import("@wrongstack/telegram")).default
 ];
+var BUILTIN_PLUGIN_NAME_HINTS = [
+  "wstack-prompts",
+  "wstack-sync",
+  "wstack-cloud-config-sync",
+  "wstack-chimera",
+  "wstack-auto-review",
+  "wstack-specialist-triggers",
+  "wstack-skills",
+  ...OFFICIAL_PLUGIN_SPECIFIERS.map((specifier) => specifier.slice("@wrongstack/plugins/".length)),
+  "@wrongstack/plug-lsp",
+  "telegram"
+];
+function builtinEnablement(name, config, aliases) {
+  const auditEntry = PLUGIN_AUDIT_ENTRIES.find((entry) => entry.name === name);
+  return resolvePluginEnablement({
+    name,
+    aliases,
+    defaultState: auditEntry?.defaultState ?? "active",
+    config,
+    matches: (spec) => (builtinPluginNameFromSpec(spec) ?? spec) === name
+  });
+}
 async function setupPlugins(params) {
   const {
     config,
@@ -119,24 +158,30 @@ async function setupPlugins(params) {
     vault,
     pipelines,
     paths,
-    hookRegistry
+    hookRegistry,
+    safeMode
   } = params;
   const builtinPlugins = [];
   if (paths && config.features?.plugins !== false) {
-    for (const factory of BUILTIN_PLUGIN_FACTORIES) {
+    for (const [index, factory] of BUILTIN_PLUGIN_FACTORIES.entries()) {
+      const nameHint = BUILTIN_PLUGIN_NAME_HINTS[index];
+      if (nameHint && BUILTIN_PLUGIN_NAME_HINTS.length === BUILTIN_PLUGIN_FACTORIES.length) {
+        const { enabled, source } = builtinEnablement(
+          nameHint,
+          config,
+          nameHint === "telegram" ? ["@wrongstack/telegram"] : void 0
+        );
+        if (!enabled) {
+          if (source !== "default") {
+            log.info(`[setupPlugins] built-in plugin "${nameHint}" disabled by ${source}`);
+          }
+          continue;
+        }
+      }
       try {
         const plugin = await factory();
         if (!plugin) continue;
-        const auditEntry = PLUGIN_AUDIT_ENTRIES.find((entry) => entry.name === plugin.name);
-        const { enabled, source } = resolvePluginEnablement({
-          name: plugin.name,
-          aliases: plugin.configAliases,
-          // Built-ins outside the audit catalog (prompts, sync, skills, …)
-          // are infrastructure — they run unless explicitly turned off.
-          defaultState: auditEntry?.defaultState ?? "active",
-          config,
-          matches: (spec) => (builtinPluginNameFromSpec(spec) ?? spec) === plugin.name
-        });
+        const { enabled, source } = builtinEnablement(plugin.name, config, plugin.configAliases);
         if (!enabled) {
           if (source !== "default") {
             log.info(`[setupPlugins] built-in plugin "${plugin.name}" disabled by ${source}`);
@@ -150,7 +195,7 @@ async function setupPlugins(params) {
       }
     }
   }
-  const userPlugins = config.features?.plugins === false ? [] : await loadExternalPlugins(
+  const userPlugins = config.features?.plugins === false || safeMode === true ? [] : await loadExternalPlugins(
     {
       config,
       log,
@@ -171,13 +216,6 @@ async function setupPlugins(params) {
   if (allPlugins.length === 0) return;
   const pluginOptions = buildPluginOptions(config, allPlugins);
   if (paths?.projectDir) {
-    if (pluginOptions["todo-tracker"] === void 0) {
-      pluginOptions["todo-tracker"] = {};
-    }
-    const todoTrackerOpts = pluginOptions["todo-tracker"];
-    if (typeof todoTrackerOpts["filePath"] !== "string" || todoTrackerOpts["filePath"] === "") {
-      todoTrackerOpts["filePath"] = join(paths.projectDir, "todo-tracker.json");
-    }
     const contextPinsOpts = pluginOptions["context-pins"] ?? {};
     pluginOptions["context-pins"] = contextPinsOpts;
     if (typeof contextPinsOpts["filePath"] !== "string" || contextPinsOpts["filePath"] === "") {
@@ -265,6 +303,7 @@ export {
   pluginNameFromSpec,
   builtinPluginNameFromSpec,
   BUILTIN_PLUGIN_FACTORIES,
+  BUILTIN_PLUGIN_NAME_HINTS,
   setupPlugins
 };
-//# sourceMappingURL=chunk-XJ7K67PP.js.map
+//# sourceMappingURL=chunk-YHYINL47.js.map

package/dist/{chunk-2VMJ3E5Z.js → chunk-YTEOAWOJ.js}

@@ -2,6 +2,10 @@
 // src/subcommands/handlers/auth-local-help.ts
 import { color } from "@wrongstack/core/utils";
 var LOCAL_AUTH_FLAGS = [
+  {
+    flag: "--alias <account>",
+    description: "Create a separate auth profile for this preset; the alias selects the endpoint, credential, and models in fallback references."
+  },
   {
     flag: "--name <ollama|vllm|lmstudio>",
     description: "Pick a preset (skip the interactive picker). Defaults to the first run; set this for scripting."
@@ -32,7 +36,7 @@ var LOCAL_AUTH_FLAGS = [
   }
 ];
 var LOCAL_FLAG_COLUMN_WIDTH = 38;
-var LOCAL_AUTH_HELP_USAGE = "wstack auth local [--name <id>] [--base-url <url>] [--no-key] [--no-probe|--probe-only] [--model <spec>] [--audit [target]]";
+var LOCAL_AUTH_HELP_USAGE = "wstack auth local [--name <id>] [--alias <account>] [--base-url <url>] [--no-key] [--no-probe|--probe-only] [--model <spec>] [--audit [target]]";
 function wantsLocalHelp(args) {
   return args.includes("--help") || args.includes("-h");
 }
@@ -68,4 +72,4 @@ export {
   wantsLocalHelp,
   renderAuthLocalHelpToString
 };
-//# sourceMappingURL=chunk-2VMJ3E5Z.js.map
+//# sourceMappingURL=chunk-YTEOAWOJ.js.map

package/dist/{chunk-GPPRNAKW.js → chunk-ZMX5HRLI.js}

@@ -60,7 +60,7 @@ function parseWebuiSessionChildOptions(flags) {
   const projectRoot = requireAbsolutePath(flagValue(flags, ["project-root"]), "--project-root");
   const workingDir = requireAbsolutePath(flagValue(flags, ["working-dir"]), "--working-dir");
   const relativeWorkingDir = path.relative(projectRoot, workingDir);
-  if (relativeWorkingDir.startsWith("..") || path.isAbsolute(relativeWorkingDir)) {
+  if (relativeWorkingDir === ".." || relativeWorkingDir.startsWith(`..${path.sep}`) || path.isAbsolute(relativeWorkingDir)) {
     throw new Error("--working-dir must be inside --project-root");
   }
   const sessionId = flagValue(flags, ["session-id"]);
@@ -125,4 +125,4 @@ export {
   writeWebuiSessionChildReady,
   writeWebuiSessionChildError
 };
-//# sourceMappingURL=chunk-GPPRNAKW.js.map
+//# sourceMappingURL=chunk-ZMX5HRLI.js.map