@wrongstack/cli 1.0.24 → 1.0.26

package/dist/{chunk-LFMVHT3R.js → chunk-2ERX3RPN.js}

@@ -2,14 +2,7 @@ import {
   hasApiKey,
   isKeylessLocalProvider,
   visibleModelIds
-} from "./chunk-3VXYY5JC.js";
-import {
-  appendHistory,
-  backupCurrent
-} from "./chunk-WSTVGC2C.js";
-import {
-  openBrowser
-} from "./chunk-DAKVBMD4.js";
+} from "./chunk-5UZBUV2H.js";
 import {
   activeLabel,
   loadConfigProviders,
@@ -20,6 +13,13 @@ import {
   resolveActiveApiKey,
   writeKeysBack
 } from "./chunk-LUMETJFO.js";
+import {
+  openBrowser
+} from "./chunk-DAKVBMD4.js";
+import {
+  appendHistory,
+  backupCurrent
+} from "./chunk-WSTVGC2C.js";
 
 // src/auth-menu/auth-menu-audit.ts
 import { appendFileSync } from "node:fs";
@@ -427,10 +427,8 @@ ${color2.bold("WrongStack")} ${color2.dim("\u2014 API key manager")}
   );
   renderer.write(`    ${color2.bold("c")}  Add a custom provider
 `);
-  renderer.write(
-    `    ${color2.bold("s")}  Login with provider OAuth
-`
-  );
+  renderer.write(`    ${color2.bold("s")}  Login with provider OAuth
+`);
   if (ids.length > 0) {
     renderer.write(
       `    ${color2.dim("1-")}${color2.dim(String(ids.length))}  ${color2.bold("Manage a provider")}
@@ -1946,4 +1944,4 @@ export {
   addCustomProvider,
   addKeyForProvider
 };
-//# sourceMappingURL=chunk-LFMVHT3R.js.map
+//# sourceMappingURL=chunk-2ERX3RPN.js.map

package/dist/chunk-4TVYGG6G.js

@@ -0,0 +1,62 @@
+
+// src/permission-rules-view.ts
+import {
+  compilePermissionRules,
+  matchedPermissionRule,
+  withExecutorGate
+} from "@wrongstack/core/security";
+async function explainCall(policy, tool, input, ctx, yolo) {
+  if (!policy.explain) throw new Error("This permission policy cannot explain its decisions.");
+  const trace = withExecutorGate(await policy.explain(tool, input, ctx), tool, yolo);
+  const rules = await compilePermissionRules(policy, ctx, { yolo });
+  return { trace, rules, rule: matchedPermissionRule(rules, trace) };
+}
+function actionText(rule) {
+  return rule.action === "*" ? "any tool" : rule.action;
+}
+function resourceText(rule) {
+  return rule.resource === "*" ? "any input" : rule.resource;
+}
+function describePermissionRule(rule) {
+  return `#${rule.n} ${rule.effect} ${actionText(rule)} \u2192 ${resourceText(rule)} (${rule.source})`;
+}
+function formatPermissionRules(rules) {
+  const width = String(rules.length).length;
+  const lines = ["Permission rules, in the order they are checked; the first match decides:", ""];
+  for (const rule of rules) {
+    lines.push(
+      `  ${String(rule.n).padStart(width)}. ${rule.effect.padEnd(5)} ${rule.source.padEnd(15)} ${actionText(rule)} \u2192 ${resourceText(rule)}`
+    );
+    if (rule.note) lines.push(`  ${" ".repeat(width)}  ${" ".repeat(22)}${rule.note}`);
+  }
+  return lines.join("\n");
+}
+function formatExplainedCall({ trace, rule }) {
+  const lines = [];
+  lines.push(`Permission trace for "${trace.toolName}"`);
+  lines.push(`Subject: ${trace.subject ?? "(none)"}`);
+  lines.push("");
+  for (let i = 0; i < trace.steps.length; i++) {
+    const step = trace.steps[i];
+    if (!step) continue;
+    const winner = i === trace.winnerIndex ? " \u2190 WINNER" : "";
+    const matched = step.matched ? "\u2713" : " ";
+    lines.push(`  ${matched} [${i}] ${step.rule}${winner}`);
+    lines.push(`        decision: ${step.decision}  source: ${step.source}`);
+    lines.push(`        ${step.detail}`);
+    if (i < trace.steps.length - 1) lines.push("");
+  }
+  lines.push("");
+  lines.push(`Effective: ${trace.decision.permission} (source: ${trace.decision.source})`);
+  if (rule) lines.push(`Rule: ${describePermissionRule(rule)}`);
+  if (trace.decision.reason) lines.push(`Reason: ${trace.decision.reason}`);
+  if (trace.decision.riskTier) lines.push(`Risk tier: ${trace.decision.riskTier}`);
+  return lines.join("\n");
+}
+
+export {
+  explainCall,
+  formatPermissionRules,
+  formatExplainedCall
+};
+//# sourceMappingURL=chunk-4TVYGG6G.js.map

package/dist/chunk-5JYDKG5B.js

@@ -0,0 +1,154 @@
+import {
+  API_VERSION,
+  CLI_VERSION
+} from "./chunk-F5DCFAKI.js";
+
+// src/subcommands/handlers/version-help.ts
+import * as os from "node:os";
+import { color } from "@wrongstack/core/utils";
+var versionCmd = async (_args, deps) => {
+  const bunVersion = globalThis.Bun?.version;
+  const runtime = bunVersion ? `bun v${bunVersion}` : `node ${process.version}`;
+  deps.renderer.write(
+    `WrongStack ${CLI_VERSION} (apiVersion ${API_VERSION}, ${runtime}, ${os.platform()})
+`
+  );
+  return 0;
+};
+function row(left, description) {
+  const pad = 31;
+  return left.length < pad - 2 ? `  ${left.padEnd(pad - 2)}${description}` : `  ${left}
+${" ".repeat(pad)}${description}`;
+}
+function section(title, rows) {
+  return ["", color.bold(title), ...rows.map(([left, description]) => row(left, description))];
+}
+var helpCmd = async (_args, deps) => {
+  const lines = [
+    color.bold("WrongStack \u2014 usage"),
+    "",
+    '  wstack [flags] ["<task>"]    With a task: run it and exit. Without: start a session.',
+    "  wstack <command> --help      Details for one command",
+    ...section("Start", [
+      ["wstack", "Interactive session (REPL or TUI, picked at launch)"],
+      ['wstack "<task>"', 'Run one task and exit (also: --prompt "<task>")'],
+      ["wstack quick", "Straight into the TUI with saved defaults"],
+      ["wstack webui | simpleui", "Browser UI / minimal chat UI for this project"],
+      ["wstack desktop", "WrongStack Desktop (requires @wrongstack/desktop)"],
+      ["wstack hq", "HQ command center across projects and machines"],
+      ["wstack remote <user@host:/path>", "Run on a remote machine over SSH; WebUI tunneled here"],
+      ['wstack --eternal "<mission>"', "Eternal-autonomy loop against a goal (Ctrl+C stops)"],
+      ["wstack acp [serve]", "Agent Client Protocol server for editors"]
+    ]),
+    ...section("Sessions", [
+      ["wstack sessions", "List recent sessions (also: fork, doctor, fleet)"],
+      ["wstack resume [<id>]", "Resume a session (same as -r)"],
+      ["wstack rewind [<id>]", "Rewind a session to an earlier point"],
+      ["wstack export <id>", "Render a session as markdown, JSON or text"],
+      ["wstack audit | replay [<id>]", "Tamper-evident audit log / recorded provider responses"],
+      ["wstack chronicle", "Cross-session timeline and metrics"],
+      ["wstack usage", "Token and cost summary"]
+    ]),
+    ...section("Setup", [
+      ["wstack auth", "Provider keys: add/edit/remove, list, status, local"],
+      ["wstack providers | models", "Browse providers and models; models add|remove|refresh"],
+      ["wstack config", "Show, edit, back up or restore the active profile config"],
+      ["wstack config-export | config-import", "Move behaviour settings via ./wstack-config.json"],
+      ["wstack mcp", "MCP servers: list, add, remove, serve"],
+      ["wstack import-claude-code", "Import MCP servers from Claude Code (preview; --apply)"],
+      ["wstack plugin", "Plugins: list, install, enable, disable, remove"],
+      ["wstack tools | skills", "List registered tools / discovered skills"],
+      ["wstack typesafe", "TypeSafe account: status, login, test"],
+      ["wstack update", "Self-update (--check-only)"]
+    ]),
+    ...section("Project & diagnostics", [
+      ["wstack project | projects", "Committed project identity / tracked projects"],
+      ["wstack permissions explain", "Why a tool call is allowed, asked or denied"],
+      ["wstack doctor | diag", "Health checks / full diagnostic dump"],
+      ["wstack governance status", "Project-daemon health"],
+      ["wstack modeldiag | bench", "Model capability diagnostics / agentic benchmarks"],
+      ["wstack mailbox serve", "HTTP bridge for external agents"],
+      ["wstack version", "Print version"]
+    ]),
+    ...section("Session flags", [
+      ["-c, --continue", "Resume the most recent session"],
+      ["-r, --resume [<id>]", "Resume a session (latest when no id)"],
+      ["--recover", "Reopen the last session that never closed (crash, kill)"],
+      ["--fork-session", "With -c/-r/--recover: continue a copy, keep the original"],
+      ["--provider <id> --model <id>", "Provider and model for this run"],
+      ["--fallback-model <a,b,...>", "Models to fall back to when the primary is unavailable"],
+      ["--effort <level>", "Reasoning effort: none|minimal|low|medium|high|xhigh|max"],
+      ["--system-prompt lite|pro|default", "Bundled system-prompt variant"],
+      [
+        "--append-system-prompt <text> | --append-system-prompt-file <path>",
+        "Add instructions to the host agent prompt for this run"
+      ],
+      ['--goal "<goal>" | --ask "<q>"', "Open the TUI with a goal or a question queued"]
+    ]),
+    ...section("Tools & permissions", [
+      ["--yolo | --no-yolo", "Auto-approve on or off (gated destructive kinds still ask)"],
+      ["--yolo-destructive", "Let YOLO run every destructive kind you may un-gate"],
+      ["--restricted", "Untrusted repo: no shell/network/MCP tools, stay in project, no YOLO"],
+      ["--safe-mode", "Troubleshoot: no 3rd-party plugins, hooks, MCP, skills, overrides"],
+      ["--only-tools <a,b,...>", "Expose only these tools (trailing * = prefix: mcp__gh__*)"],
+      ["--disallowed-tools <a,b,...>", "Hide these tools, subagents included"],
+      ["--allowed-tools <a,b,...>", "Run these without a prompt (destructive calls still ask)"],
+      ["--mcp-config <file|json>", "Extra MCP servers for this run (.mcp.json accepted)"],
+      ["--strict-mcp-config", "Start only the --mcp-config servers"],
+      ["--no-hooks", "Skip user and plugin hooks (policy hooks still run)"]
+    ]),
+    ...section("Scripting (with a task)", [
+      ["<stdin>", 'Piped input becomes context: git diff | wstack "review this"'],
+      ["--output-json", "One JSON result line: status, finalText, sessionId, usage"],
+      [
+        "--output-format text|json|stream-json",
+        "stream-json: init, assistant, tool_result, result lines"
+      ],
+      ["--include-partial-messages", "stream-json: add text_delta lines"],
+      ["--json-schema <file|json>", "Answer must be JSON matching the schema (structuredOutput)"],
+      ["--max-budget-usd <amount>", "Stop once spend (leader + subagents) passes the amount"],
+      ["", "Exit: 0 done, 1 failed/limit/budget/schema, 130 aborted, 2 usage"]
+    ]),
+    ...section("Interfaces", [
+      ["--tui | --no-tui", "Force or disable the TUI"],
+      ["--mouse", "Full mouse mode in the TUI"],
+      ["--ascii", "Plain-ASCII symbols, borders and spinners (no emoji or box drawing)"],
+      ["--desktop", "Same as wstack desktop"],
+      [
+        "--webui [--host <h>] [--port <n>] [--open]",
+        "Browser UI (+ --webui-token, --webui-public-url, ...)"
+      ],
+      [
+        "--simpleui [same flags] [--full-auto]",
+        "Minimal chat UI; --full-auto = YOLO + autonomy for this run only"
+      ],
+      [
+        "--hq [--host <h>] [--port <n>] [--password <p>] [--tunnel] [--open]",
+        "HQ server (+ --hq-allowlist, --hq-public-url)"
+      ]
+    ]),
+    ...section("Startup & tuning", [
+      ["--skip", "Skip every startup prompt; use saved choices"],
+      ["--skip-index", "Skip codebase indexing at startup"],
+      ["--no-models-refresh", "Use the cached model catalog"],
+      ["--token-saving-tier <tier>", "auto|off|minimal|light|medium|aggressive"],
+      ["--max-concurrent <n> | --max-spawns <n>", "Fleet concurrency / lifetime subagent spawns"],
+      ["--chimera-auto-fix off|ask|auto", "How to handle Chimera review findings"],
+      ["--cwd <dir>", "Run as if started in <dir>"],
+      ["--verbose | --trace | --log-level <l>", "Log verbosity"],
+      ["--metrics [--metrics-port <n>]", "Metrics and health; Prometheus endpoint on the port"],
+      [
+        "--record | --replay <session-id>",
+        "Record provider responses / serve them back (test harnesses; a changed prompt misses)"
+      ]
+    ])
+  ];
+  deps.renderer.write(lines.join("\n") + "\n");
+  return 0;
+};
+
+export {
+  versionCmd,
+  helpCmd
+};
+//# sourceMappingURL=chunk-5JYDKG5B.js.map

package/dist/{chunk-3VXYY5JC.js → chunk-5UZBUV2H.js}

@@ -1,6 +1,6 @@
 
 // src/provider-helpers.ts
-import { hasProviderCredential } from "@wrongstack/core/models";
+import { hasProviderCredential, isKeylessLocalProvider } from "@wrongstack/core/models";
 import { catalogProviderIdFor } from "@wrongstack/providers";
 function uniqueModelIds(primary, fallback) {
   const seen = /* @__PURE__ */ new Set();
@@ -18,22 +18,6 @@ function visibleModelIds(providerId, config, catalogModelIds, cfg) {
   if (entry?.models === void 0) return [...catalogModelIds];
   return uniqueModelIds(entry.models, catalogModelIds);
 }
-function isLoopbackUrl(apiBase) {
-  if (!apiBase) return false;
-  let host;
-  try {
-    host = new URL(apiBase).hostname.toLowerCase();
-  } catch {
-    return false;
-  }
-  host = host.replace(/^\[|\]$/g, "");
-  if (host === "localhost" || host === "::1" || host === "0.0.0.0") return true;
-  return /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(host);
-}
-function isKeylessLocalProvider(provider) {
-  if (provider.envVars && provider.envVars.length > 0) return false;
-  return isLoopbackUrl(provider.apiBase);
-}
 function hasApiKey(provider, config) {
   return hasProviderCredential(provider, config);
 }
@@ -122,9 +106,9 @@ function modelDetails(models) {
 }
 
 export {
-  visibleModelIds,
   isKeylessLocalProvider,
+  visibleModelIds,
   hasApiKey,
   buildPickableProviders
 };
-//# sourceMappingURL=chunk-3VXYY5JC.js.map
+//# sourceMappingURL=chunk-5UZBUV2H.js.map

package/dist/chunk-BEHGRNOQ.js

@@ -0,0 +1,58 @@
+
+// src/subcommands/index.ts
+var loaders = {
+  acp: async () => (await import("./acp-LI665LO2.js")).acpCmd,
+  init: async () => (await import("./init-DRMMFG2G.js")).initCmd,
+  auth: async () => (await import("./auth-TE55JF4Z.js")).authCmd,
+  update: async () => (await import("./update-TDZX4IL2.js")).updateCmd,
+  remote: async () => (await import("./remote-O5WXHLWV.js")).remoteCmd,
+  sessions: async () => (await import("./sessions-config-SXTTLNXA.js")).sessionsCmd,
+  config: async () => (await import("./sessions-config-SXTTLNXA.js")).configCmd,
+  "config-export": async () => (await import("./config-transfer-RUWLDCNK.js")).configExportCmd,
+  "config-import": async () => (await import("./config-transfer-RUWLDCNK.js")).configImportCmd,
+  rewind: async () => (await import("./rewind-JA3ZLCNM.js")).rewindCmd,
+  replay: async () => (await import("./replay-JJ2NOWD6.js")).replayCmd,
+  audit: async () => (await import("./audit-46YK5DSC.js")).auditCmd,
+  tools: async () => (await import("./tools-skills-GH24UCBY.js")).toolsCmd,
+  skills: async () => (await import("./tools-skills-GH24UCBY.js")).skillsCmd,
+  "skill-suggest": async () => (await import("./skill-suggest-L2EVWB6R.js")).skillSuggestCmd,
+  typesafe: async () => (await import("./typesafe-U7YB2RRV.js")).typesafeCmd,
+  providers: async () => (await import("./providers-models-5Z2PJTEW.js")).providersCmd,
+  models: async () => (await import("./providers-models-5Z2PJTEW.js")).modelsCmd,
+  mcp: async () => (await import("./mcp-LBS45HWZ.js")).mcpCmd,
+  plugin: async () => (await import("./plugin-usage-CIGOOTX3.js")).pluginCmd,
+  plugins: async () => (await import("./plugin-usage-CIGOOTX3.js")).pluginCmd,
+  diag: async () => (await import("./diag-doctor-BIZAFIAT.js")).diagCmd,
+  doctor: async () => (await import("./diag-doctor-BIZAFIAT.js")).doctorCmd,
+  "proxy-status": async () => (await import("./diag-doctor-BIZAFIAT.js")).proxyCmd,
+  export: async () => (await import("./export-VVRIOWFV.js")).exportCmd,
+  usage: async () => (await import("./plugin-usage-CIGOOTX3.js")).usageCmd,
+  version: async () => (await import("./version-help-XJJQ7YSH.js")).versionCmd,
+  help: async () => (await import("./version-help-XJJQ7YSH.js")).helpCmd,
+  projects: async () => (await import("./projects-T4CZCA25.js")).projectsCmd,
+  modeldiag: async () => (await import("./modeldiag-36VODVIH.js")).modeldiagCmd,
+  quick: async () => (await import("./quick-CNB4Z3HS.js")).quickCmd,
+  bench: async () => (await import("./bench-GTLPM22B.js")).benchCmd,
+  chronicle: async () => (await import("./chronicle-UTFETHP6.js")).chronicleCmd,
+  hq: async () => (await import("./hq-GLZ7QESM.js")).hqCmd,
+  mailbox: async () => (await import("./mailbox-serve-NW5VZG7R.js")).mailboxServeCmd,
+  permissions: async () => (await import("./permissions-PL27UHYD.js")).permissionsCmd,
+  project: async () => (await import("./project-AOQI5XTK.js")).projectCmd,
+  governance: async () => (await import("./governance-RYSHV675.js")).governanceCmd,
+  "import-claude-code": async () => (await import("./import-claude-code-32PCSIQI.js")).importClaudeCodeCmd
+};
+var subcommands = Object.fromEntries(
+  Object.entries(loaders).map(
+    ([name, load]) => [
+      name,
+      async (args, deps) => (await load())(args, deps)
+    ]
+  )
+);
+var subcommandNames = Object.keys(loaders);
+
+export {
+  subcommands,
+  subcommandNames
+};
+//# sourceMappingURL=chunk-BEHGRNOQ.js.map

package/dist/chunk-CZTXF6HY.js

@@ -0,0 +1,140 @@
+
+// src/context-limit.ts
+import { refreshCatalogIfStale } from "@wrongstack/core/models";
+import { mergeCustomModelDefs, toErrorMessage } from "@wrongstack/core/utils";
+import { capabilitiesFor } from "@wrongstack/providers";
+var SIBLING_CATALOG = {
+  "anthropic-oauth": "anthropic",
+  "openai-codex": "openai",
+  "github-copilot": "openai",
+  "google-antigravity": "google"
+};
+async function resolveRuntimeMaxContextDetailed(input) {
+  const providerConfig = input.runtimeProviderConfig ?? input.config.providers?.[input.providerId];
+  const providerOverride = positiveNumber(readConfiguredMaxContext(providerConfig));
+  if (providerOverride) return { maxContext: providerOverride, branch: "provider-override" };
+  const catalogId = providerConfig?.type && providerConfig.type !== input.providerId ? providerConfig.type : input.providerId;
+  const sibling = providerConfig?.family ? SIBLING_CATALOG[providerConfig.family] : void 0;
+  if (sibling && input.modelsRegistry) {
+    const mergedModels = mergeCustomModelDefs(providerConfig?.customModels, input.config.models);
+    const ownModel = await input.modelsRegistry.getModel(catalogId, input.modelId).catch(() => void 0);
+    if (ownModel) {
+      const ownCaps = await capabilitiesFor(
+        input.modelsRegistry,
+        catalogId,
+        input.modelId,
+        mergedModels
+      ).catch(() => void 0);
+      const ownMax = positiveNumber(ownCaps?.maxContext) ?? positiveNumber(ownModel.capabilities.maxContext);
+      if (ownMax) return { maxContext: ownMax, branch: "catalog-capabilities" };
+    }
+    const caps = await capabilitiesFor(
+      input.modelsRegistry,
+      sibling,
+      input.modelId,
+      mergedModels
+    ).catch(() => void 0);
+    const siblingMax = positiveNumber(caps?.maxContext);
+    if (siblingMax) return { maxContext: siblingMax, branch: "sibling-capabilities" };
+    const directModel = await input.modelsRegistry.getModel(sibling, input.modelId).catch(() => void 0);
+    const directMax = positiveNumber(directModel?.capabilities.maxContext);
+    if (directMax) return { maxContext: directMax, branch: "sibling-direct-model" };
+  }
+  let divergedFromCatalog = false;
+  if (input.modelsRegistry) {
+    const topLevelBaseUrlApplies = input.providerId === input.config.provider;
+    const configuredBaseUrl = providerConfig?.baseUrl ?? (topLevelBaseUrlApplies ? input.config.baseUrl : void 0);
+    let divergesFromCatalog = false;
+    if (configuredBaseUrl) {
+      const resolved = await safeGetProvider(input.modelsRegistry, catalogId);
+      divergesFromCatalog = normalizeBaseUrl(configuredBaseUrl) !== normalizeBaseUrl(resolved?.apiBase);
+    }
+    divergedFromCatalog = divergesFromCatalog;
+    if (!divergesFromCatalog) {
+      const mergedModels = mergeCustomModelDefs(providerConfig?.customModels, input.config.models);
+      const caps = await capabilitiesFor(
+        input.modelsRegistry,
+        catalogId,
+        input.modelId,
+        mergedModels
+      ).catch(() => void 0);
+      const catalogMax = positiveNumber(caps?.maxContext);
+      if (catalogMax) return { maxContext: catalogMax, branch: "catalog-capabilities" };
+      const directModel = await input.modelsRegistry.getModel(catalogId, input.modelId).catch(() => void 0);
+      const directMax = positiveNumber(directModel?.capabilities.maxContext);
+      if (directMax) return { maxContext: directMax, branch: "catalog-direct-model" };
+    }
+  }
+  const explicitContext = positiveNumber(input.config.context?.effectiveMaxContext);
+  if (explicitContext) {
+    return { maxContext: explicitContext, branch: "explicit-config-fallback" };
+  }
+  const familyDefault = positiveNumber(input.provider.capabilities.maxContext) ?? 0;
+  const branch = familyDefault === 0 ? "unknown" : divergedFromCatalog ? "diverging-baseurl-family-default" : "family-default";
+  return { maxContext: familyDefault, branch };
+}
+async function resolveRuntimeMaxContext(input) {
+  const { maxContext } = await resolveRuntimeMaxContextDetailed(input);
+  return maxContext;
+}
+var SUSPICIOUS_SHRINK_BRANCHES = /* @__PURE__ */ new Set([
+  "family-default",
+  "diverging-baseurl-family-default"
+]);
+function describeMaxContextChange(params) {
+  const { previous, current, providerId, modelId } = params;
+  if (current === previous) return void 0;
+  const branch = params.branch ?? "unknown";
+  const shrank = previous > 0 && current > 0 && current < previous;
+  const suspicious = SUSPICIOUS_SHRINK_BRANCHES.has(branch);
+  const detail = `max-context ${previous} \u2192 ${current} for ${providerId}/${modelId} (branch=${branch}${shrank ? ", DECREASED" : ""})`;
+  return shrank && suspicious ? {
+    level: "warn",
+    message: `Context window shrank via a non-catalog branch: ${detail}`,
+    shrank,
+    branch
+  } : { level: "debug", message: detail, shrank, branch };
+}
+async function refreshRuntimeModelCatalog(input) {
+  if (!input.modelsRegistry) return false;
+  try {
+    if (await refreshCatalogIfStale(input.modelsRegistry) === "recent") return false;
+    input.logger?.debug?.(
+      `models.dev catalog refreshed${input.reason ? ` (${input.reason})` : ""}`
+    );
+    return true;
+  } catch (err) {
+    input.logger?.warn?.(
+      `models.dev refresh failed${input.reason ? ` (${input.reason})` : ""}: ${toErrorMessage(err)}; using cached catalog`
+    );
+    return false;
+  }
+}
+async function safeGetProvider(registry, id) {
+  try {
+    return await registry.getProvider(id);
+  } catch {
+    return void 0;
+  }
+}
+function normalizeBaseUrl(url) {
+  if (!url) return "";
+  return url.trim().toLowerCase().replace(/\/+$/, "");
+}
+function readConfiguredMaxContext(providerConfig) {
+  if (!providerConfig || typeof providerConfig !== "object") return void 0;
+  const capabilities = providerConfig.capabilities;
+  if (!capabilities || typeof capabilities !== "object") return void 0;
+  return capabilities.maxContext;
+}
+function positiveNumber(value) {
+  return typeof value === "number" && Number.isFinite(value) && value > 0 ? value : void 0;
+}
+
+export {
+  resolveRuntimeMaxContextDetailed,
+  resolveRuntimeMaxContext,
+  describeMaxContextChange,
+  refreshRuntimeModelCatalog
+};
+//# sourceMappingURL=chunk-CZTXF6HY.js.map

package/dist/{chunk-SKPDE62W.js → chunk-EPR42SWM.js}

@@ -817,7 +817,7 @@ var helpTable = {
     name: "sessions",
     title: "wstack sessions \u2014 list and resume recent sessions",
     description: "List recent sessions, show one session in detail, resume a session, or inspect a session's audit log. The audit log is stored as JSONL next to each session's recording.",
-    usage: "wstack sessions [list|show|resume|fork|doctor|config|fleet] [...]",
+    usage: "wstack sessions [list|show|resume|fork|move|doctor|config|fleet] [...]",
     subcommands: [
       { name: "list", description: "List the most recent sessions." },
       {
@@ -830,6 +830,10 @@ var helpTable = {
         name: "fork [<id>] [--to N]",
         description: "Create an isolated child journal at a persisted boundary."
       },
+      {
+        name: "move <id> --to <path>",
+        description: "Move a closed session to another git worktree of this repository, or to another project (its journal moves to that project)."
+      },
       { name: "config", description: "Show or edit session-specific config." },
       { name: "fleet", description: "List the active fleet of sessions." }
     ],
@@ -959,6 +963,13 @@ var helpTable = {
     usage: "wstack update [--check-only] [--pm <manager>] [--allow-scripts (alias: --lifecycle-scripts)]",
     seeAlso: "wstack version (read-only version info)"
   },
+  remote: {
+    name: "remote",
+    title: "wstack remote \u2014 run WrongStack on another machine over SSH",
+    description: "Runs WrongStack on the remote machine, in the given project directory, and opens its WebUI here through an SSH tunnel; the agent, its tools and its daemons run remotely. The system ssh is used, so ~/.ssh/config, your agent and known_hosts apply. The matching build is uploaded once per version to ~/.wrongstack/remote and checked by SHA-256. A dropped connection is reopened; the remote host keeps running meanwhile. Nothing from your local configuration is copied: set up a provider in the remote WebUI the first time.",
+    usage: "wstack remote <user@host:/path | ssh://user@host:port/path> [--port <n>] [--open] [--keep] [--ssh-config <file>] [--remote-binary <file>]",
+    seeAlso: "wstack --remote <target> (same command)"
+  },
   // -- ACP (Agent Client Protocol) --------------------------------------
   acp: {
     name: "acp",
@@ -1080,13 +1091,17 @@ var helpTable = {
   // -- Permissions ────────────────────────────────────────────────────
   permissions: {
     name: "permissions",
-    title: "wstack permissions \u2014 explain tool permission decisions",
-    description: "Side-effect-free permission decision explainer. Evaluates the effective permission rules for a tool and input arguments without prompting, modifying trust files, or mutating state.",
-    usage: "wstack permissions explain <tool> [--input '<json>'] [--json]",
+    title: "wstack permissions \u2014 list and explain the permission rules",
+    description: "Side-effect-free views of the permission policy the agent runs under: every rule in the order it is checked, and how one tool call is decided, without prompting, modifying trust files, or mutating state. Inside a session, /permissions also sets allow/deny rules for that session only.",
+    usage: "wstack permissions [rules|explain <tool> [--input '<json>']] [--json]",
     subcommands: [
+      {
+        name: "rules",
+        description: "List every permission rule, in the order they are checked (first match decides)."
+      },
       {
         name: "explain <tool>",
-        description: "Explain how the permission policy evaluates a tool call."
+        description: "Explain how the permission policy decides a tool call, and name the rule."
       }
     ],
     seeAlso: "wstack tools (list available tools)"
@@ -1112,6 +1127,21 @@ var helpTable = {
     subcommands: [{ name: "status", description: "Show daemon and attachment-broker health." }],
     seeAlso: "wstack doctor (broader environment diagnostics)"
   },
+  "import-claude-code": {
+    name: "import-claude-code",
+    title: "wstack import-claude-code \u2014 bring a Claude Code setup across",
+    description: "Import MCP servers from ~/.claude.json (user + this project) and the repository's .mcp.json into the active profile. Previews by default. Repository servers arrive disabled unless --enable-project-servers. Skills are read in place; hooks, permission rules and CLAUDE.md are reported with next steps, not translated.",
+    usage: "wstack import-claude-code [--apply] [--overwrite] [--enable-project-servers]",
+    subcommands: [
+      { name: "--apply", description: "Write the plan (default: preview only)." },
+      { name: "--overwrite", description: "Replace servers that already exist by name." },
+      {
+        name: "--enable-project-servers",
+        description: "Enable the repository's .mcp.json servers on import."
+      }
+    ],
+    seeAlso: "wstack mcp list; --mcp-config (one-off servers without importing)"
+  },
   // -- Chronicle ──────────────────────────────────────────────────────
   chronicle: {
     name: "chronicle",
@@ -1213,4 +1243,4 @@ export {
   subcommandsWithFocusedHelp,
   renderGenericHelp
 };
-//# sourceMappingURL=chunk-SKPDE62W.js.map
+//# sourceMappingURL=chunk-EPR42SWM.js.map

package/dist/{chunk-YBUCXXYZ.js → chunk-F5DCFAKI.js}

@@ -33,4 +33,4 @@ export {
   API_VERSION,
   STANDALONE_TARGET
 };
-//# sourceMappingURL=chunk-YBUCXXYZ.js.map
+//# sourceMappingURL=chunk-F5DCFAKI.js.map