@wrongstack/cli 1.0.24 → 1.0.27

package/data/providers.json

@@ -26,6 +26,50 @@
           "output": 128000
         }
       },
+      "gpt-6-sol": {
+        "id": "gpt-6-sol",
+        "name": "GPT-6 Sol",
+        "description": "Built to power complex coding and agentic workflows.",
+        "reasoning": true,
+        "reasoningConfig": {
+          "default": "enabled",
+          "disableSupported": false,
+          "effortSupported": true,
+          "effortLevels": ["low", "medium", "high", "xhigh", "max"],
+          "preserveThinking": "unsupported"
+        },
+        "tool_call": true,
+        "modalities": {
+          "input": ["text", "image"],
+          "output": ["text"]
+        },
+        "limit": {
+          "context": 872000,
+          "output": 128000
+        }
+      },
+      "gpt-6-luna": {
+        "id": "gpt-6-luna",
+        "name": "GPT-6 Luna",
+        "description": "Most efficient model for focused, high-volume tasks.",
+        "reasoning": true,
+        "reasoningConfig": {
+          "default": "enabled",
+          "disableSupported": false,
+          "effortSupported": true,
+          "effortLevels": ["low", "medium", "high", "xhigh", "max"],
+          "preserveThinking": "unsupported"
+        },
+        "tool_call": true,
+        "modalities": {
+          "input": ["text", "image"],
+          "output": ["text"]
+        },
+        "limit": {
+          "context": 872000,
+          "output": 128000
+        }
+      },
       "gpt-5.6-sol": {
         "id": "gpt-5.6-sol",
         "name": "GPT-5.6 Sol",

package/dist/{acp-AJWSKWE5.js → acp-M4565YUW.js}

@@ -4,22 +4,22 @@ import {
   loadCachedAcpRegistry,
   refreshAcpRegistry,
   setupProvider
-} from "./chunk-5SEYGOCH.js";
+} from "./chunk-RDGGWMTI.js";
 import {
   createHqCommandDispatcher
-} from "./chunk-2EBVTYJR.js";
+} from "./chunk-NRXWOMK7.js";
 import {
   startCliHqConnection
-} from "./chunk-BLD5DSVA.js";
-import "./chunk-S4FFHDJG.js";
+} from "./chunk-RGFWGUAB.js";
+import "./chunk-SDJCLEK6.js";
+import "./chunk-F5DCFAKI.js";
 import "./chunk-SIGUWXAA.js";
-import "./chunk-DAKVBMD4.js";
 import "./chunk-LUMETJFO.js";
-import "./chunk-YBUCXXYZ.js";
+import "./chunk-DAKVBMD4.js";
 
 // src/subcommands/handlers/acp.ts
 import { randomBytes } from "node:crypto";
-import * as path from "node:path";
+import * as path2 from "node:path";
 import {
   defaultPermissionPolicy,
   EnsembleRegistry,
@@ -41,6 +41,7 @@ import { leaderDeliveryHub } from "@wrongstack/core/coordination";
 import { WebSocketServer } from "ws";
 
 // src/acp-hq-telemetry.ts
+import * as path from "node:path";
 import { AgentStatusTracker } from "@wrongstack/core/coordination";
 import {
   createApprovalRegistry,
@@ -60,6 +61,15 @@ function startAcpHqTelemetry(options) {
     }
     return false;
   };
+  const resolveUserInput = (requestId, response, sessionId) => {
+    if (sessionId !== void 0) {
+      return entries.get(sessionId)?.approvals?.resolveUserInput?.(requestId, response, sessionId) ?? false;
+    }
+    for (const entry of entries.values()) {
+      if (entry.approvals?.resolveUserInput?.(requestId, response) === true) return true;
+    }
+    return false;
+  };
   const connection = startCliHqConnection({
     clientKind: "acp",
     projectRoot: options.projectRoot,
@@ -70,11 +80,11 @@ function startAcpHqTelemetry(options) {
       "mailbox.summary",
       "fleet.summary",
       "session.summary",
-      // Approvals are the ONLY control this host accepts. `control.receive` is
-      // the server's gate for any command at all, so it has to be declared;
-      // everything except `approve` falls through the dispatcher and is
-      // refused, because an ACP session has no mailbox to steer and no leader
-      // to abort.
+      // Approvals and answers to ask_user are the ONLY control this host
+      // accepts. `control.receive` is the server's gate for any command at
+      // all, so it has to be declared; everything except `approve` and
+      // `answer-input` falls through the dispatcher and is refused, because
+      // an ACP session has no mailbox to steer and no leader to abort.
       "control.receive",
       "control.approve"
     ],
@@ -83,7 +93,8 @@ function startAcpHqTelemetry(options) {
       sessionTag: () => "acp",
       ownsSession: (sessionId) => entries.has(sessionId),
       allowRunCommand: () => false,
-      resolveApproval
+      resolveApproval,
+      resolveUserInput
     })
   });
   const attach = (sessionId, agent, cwd) => {
@@ -103,7 +114,9 @@ function startAcpHqTelemetry(options) {
         // An ACP session works in the directory the client opened, which is
         // not necessarily where the server booted.
         projectRoot: cwd,
-        projectName: options.projectName ?? options.projectRoot,
+        // A NAME, not a path: the full root is an absolute path (it carries
+        // the OS account name) and `projectName` is not a redacted key.
+        projectName: options.projectName ?? path.basename(cwd),
         initialAgents: tracker.getAgents(),
         startedAt: (/* @__PURE__ */ new Date()).toISOString()
       });
@@ -592,7 +605,7 @@ var acpCmd = async (args, deps) => {
   const sub = args[0];
   const loginIndex = sub === "auth" ? 0 : (sub === "server" || sub === "serve") && args[1] === "auth" ? 1 : -1;
   if (loginIndex >= 0) {
-    const { authCmd } = await import("./auth-GRBZ7Y3D.js");
+    const { authCmd } = await import("./auth-TE55JF4Z.js");
     return authCmd(args.slice(loginIndex + 1), deps);
   }
   if (!sub || sub === "server" || sub === "serve") {
@@ -709,13 +722,13 @@ async function runACPWebSocketServer(deps, port) {
     }
     hqTelemetry = startAcpHqTelemetry({
       projectRoot: deps.cwd ?? process.cwd(),
-      projectName: path.basename(deps.cwd ?? process.cwd()),
+      projectName: path2.basename(deps.cwd ?? process.cwd()),
       appConfig: deps.config
     });
     const tracked = hqTelemetry.wrapAgentFactory(agentFor);
     wsAgentFactory = agentFor;
     turnFactory = () => makeACPServerAgentTurn({ agentFor: tracked, pendingDeliveries: pendingLeaderDeliveries });
-    store = deps.paths?.projectDir ? new ACPSessionStore({ dir: path.join(deps.paths.projectDir, "acp-sessions") }) : void 0;
+    store = deps.paths?.projectDir ? new ACPSessionStore({ dir: path2.join(deps.paths.projectDir, "acp-sessions") }) : void 0;
   }
   const acpToken = process.env["WRONGSTACK_ACP_TOKEN"]?.trim() || randomBytes(32).toString("hex");
   const gate = createAcpConnectionGate({ host, port, token: acpToken });
@@ -830,7 +843,7 @@ async function runACPServer(deps) {
       }
       stdioHqTelemetry = startAcpHqTelemetry({
         projectRoot: deps.cwd ?? process.cwd(),
-        projectName: path.basename(deps.cwd ?? process.cwd()),
+        projectName: path2.basename(deps.cwd ?? process.cwd()),
         appConfig: deps.config
       });
       const stdioAgentFactory = agentFor;
@@ -838,7 +851,7 @@ async function runACPServer(deps) {
         agentFor: stdioHqTelemetry.wrapAgentFactory(agentFor),
         pendingDeliveries: pendingLeaderDeliveries
       });
-      const store = deps.paths?.projectDir ? new ACPSessionStore({ dir: path.join(deps.paths.projectDir, "acp-sessions") }) : void 0;
+      const store = deps.paths?.projectDir ? new ACPSessionStore({ dir: path2.join(deps.paths.projectDir, "acp-sessions") }) : void 0;
       return {
         runTurn: turn,
         replayFor: turn.replay,
@@ -1179,4 +1192,4 @@ ${renderAcpBenchText(result)}
 export {
   acpCmd
 };
-//# sourceMappingURL=acp-AJWSKWE5.js.map
+//# sourceMappingURL=acp-M4565YUW.js.map

package/dist/ascii-mode-SG4PRNLP.js

@@ -0,0 +1,7 @@
+import {
+  applyAsciiMode
+} from "./chunk-PZQBGUVZ.js";
+export {
+  applyAsciiMode
+};
+//# sourceMappingURL=ascii-mode-SG4PRNLP.js.map

package/dist/{auth-GRBZ7Y3D.js → auth-TE55JF4Z.js}

@@ -16,24 +16,13 @@ import {
   runOAuthLoginKind,
   runOAuthLoginMenu,
   validateFamily
-} from "./chunk-LFMVHT3R.js";
+} from "./chunk-2ERX3RPN.js";
 import {
   renderAuthLocalHelpToString,
   wantsLocalHelp
 } from "./chunk-YTEOAWOJ.js";
-import "./chunk-3VXYY5JC.js";
-import {
-  activeProfileConfigPath
-} from "./chunk-YMXXOOFN.js";
-import "./chunk-WSTVGC2C.js";
-import {
-  restoreFlags
-} from "./chunk-CSAPOCBP.js";
-import {
-  parseAuthFlags
-} from "./chunk-MHEBWVXL.js";
+import "./chunk-5UZBUV2H.js";
 import "./chunk-SIGUWXAA.js";
-import "./chunk-DAKVBMD4.js";
 import {
   loadConfigProviders,
   maskedKey,
@@ -42,6 +31,17 @@ import {
   nowIso,
   writeKeysBack
 } from "./chunk-LUMETJFO.js";
+import "./chunk-DAKVBMD4.js";
+import {
+  activeProfileConfigPath
+} from "./chunk-YMXXOOFN.js";
+import {
+  restoreFlags
+} from "./chunk-CSAPOCBP.js";
+import "./chunk-WSTVGC2C.js";
+import {
+  parseAuthFlags
+} from "./chunk-Q4INH2DG.js";
 
 // src/subcommands/handlers/auth.ts
 import { color as color5 } from "@wrongstack/core/utils";
@@ -671,4 +671,4 @@ async function runAuthRemove(deps, providerId) {
 export {
   authCmd
 };
-//# sourceMappingURL=auth-GRBZ7Y3D.js.map
+//# sourceMappingURL=auth-TE55JF4Z.js.map

package/dist/{bench-N5K7Z5O3.js → bench-GTLPM22B.js}

@@ -1,6 +1,6 @@
 import {
   CLI_VERSION
-} from "./chunk-YBUCXXYZ.js";
+} from "./chunk-F5DCFAKI.js";
 
 // src/subcommands/handlers/bench.ts
 import * as fs from "node:fs/promises";
@@ -414,4 +414,4 @@ async function benchList(_args, deps) {
 export {
   benchCmd
 };
-//# sourceMappingURL=bench-N5K7Z5O3.js.map
+//# sourceMappingURL=bench-GTLPM22B.js.map

package/dist/boot/append-system-prompt.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Resolve `--append-system-prompt <text>` and `--append-system-prompt-file
+ * <path>` into the text appended to the host system prompt. Both may be given;
+ * the inline text comes first. Returns `undefined` when neither carries text.
+ *
+ * An unreadable file throws: silently dropping instructions the operator asked
+ * for would run the session under a prompt they did not intend.
+ */
+export declare function resolveAppendedSystemPrompt(flags: Readonly<Record<string, string | boolean>>, cwd: string): Promise<string | undefined>;
+//# sourceMappingURL=append-system-prompt.d.ts.map

package/dist/boot/ascii-mode.d.ts

@@ -0,0 +1,12 @@
+/**
+ * `--ascii` (or `WRONGSTACK_TUI_ICON_STYLE=ascii`): plain-ASCII output for
+ * terminals and fonts without box drawing, emoji or Nerd Font glyphs.
+ *
+ * The flag sets the env var so the lazily loaded TUI (its glyph set and Ink
+ * wrapper read it at module load) and child `wstack` processes see the same
+ * choice. stdout/stderr are wrapped so the plain REPL, one-shot output and
+ * anything the TUI did not route through its `Text` wrapper come out ASCII too.
+ * Runs before any surface is loaded.
+ */
+export declare function applyAsciiMode(flags: Record<string, unknown>, env?: NodeJS.ProcessEnv, streams?: readonly NodeJS.WriteStream[]): boolean;
+//# sourceMappingURL=ascii-mode.d.ts.map

package/dist/boot/container-wiring.d.ts

@@ -3,16 +3,18 @@ import type { EventBus } from '@wrongstack/core/kernel';
 import type { Config, Logger, ModelsRegistry, Renderer } from '@wrongstack/core/types';
 import type { WstackPaths } from '@wrongstack/core/utils';
 import { createDefaultContainer } from '@wrongstack/runtime';
-import { makePromptDelegate } from '../permission-prompt.js';
+import { makeStdinPromptDelegate } from '../permission-prompt.js';
 import { type ApprovalMirrorRef } from '../permission-prompt-mirror.js';
 interface WireContainerDeps {
     config: Config;
     wpaths: WstackPaths;
     cwd: string;
     logger: Logger;
-    reader: Parameters<typeof makePromptDelegate>[0];
+    reader: Parameters<typeof makeStdinPromptDelegate>[0];
     renderer: Renderer;
     modelsRegistry: ModelsRegistry;
+    /** `--allowed-tools`, already validated at boot. */
+    launchAllowedTools?: readonly string[] | undefined;
 }
 /**
  * Build the PathResolver, create the EventBus, call

package/dist/boot/dispatch-singleshot.d.ts

@@ -12,6 +12,7 @@
  * closure mutation.
  */
 import type { Agent } from '@wrongstack/core/agent';
+import type { EventBus } from '@wrongstack/core/kernel';
 import type { TokenCounter } from '@wrongstack/core/types';
 import type { TerminalRenderer } from '../renderer.js';
 interface SingleShotDispatchContext {
@@ -19,12 +20,22 @@ interface SingleShotDispatchContext {
     agent: Agent;
     /** Joined positional args forming the query string. */
     query: string;
-    /** Parsed top-level CLI flags (e.g. `--output-json`). */
+    /** Parsed top-level CLI flags (e.g. `--output-json`, `--output-format`). */
     flags: Record<string, string | boolean>;
     /** Token counter for usage delta computation. */
     tokenCounter: TokenCounter;
     /** Terminal renderer for output. */
     renderer: TerminalRenderer;
+    /** Host event bus; required for `--max-budget-usd` to see spend as it lands. */
+    events?: Pick<EventBus, 'on'> | undefined;
+    /**
+     * The host's interrupt seam. HQ's "abort leader" and every other remote stop
+     * call `abortLeader()`; a one-shot turn has no TUI to rebind it, so this run
+     * binds it to its own controller for the duration of the turn.
+     */
+    interruptController?: {
+        abortLeader: () => boolean;
+    } | undefined;
 }
 /**
  * Run a single `agent.run()` turn and render the result.

package/dist/boot/dispatch-webui.d.ts

@@ -110,6 +110,8 @@ export interface WebUIDispatchContext {
     /** Live fleet budget for WebUI concurrency/spawn gauges (issue #323). */
     getFleetBudget?: CliWebUIOptions['getFleetBudget'];
     stopSessionFleet?: CliWebUIOptions['stopSessionFleet'];
+    interruptController?: CliWebUIOptions['interruptController'];
+    hqFleetControl?: CliWebUIOptions['hqFleetControl'];
     onSessionRetired?: CliWebUIOptions['onSessionRetired'];
     /** The process's single background-delegation auto-wake controller. */
     leaderAutoWake?: CliWebUIOptions['leaderAutoWake'];

package/dist/boot/goal-tui-default.d.ts

@@ -0,0 +1,10 @@
+/**
+ * `--goal` / `--ask` without a prompt run in the TUI (`--no-tui` still wins).
+ *
+ * Decided in `boot`, before the composition root reads `flags.tui`: this used
+ * to happen in execution.ts, after cli-main had already derived screen
+ * ownership and the HQ client kind from it — a goal run painted the TUI but
+ * announced itself to HQ as `cli`, with non-TUI stderr behaviour.
+ */
+export declare function applyGoalTuiDefault(flags: Record<string, string | boolean>, positional: readonly string[]): void;
+//# sourceMappingURL=goal-tui-default.d.ts.map

package/dist/boot/mcp-config-flag.d.ts

@@ -0,0 +1,22 @@
+import type { MCPServerConfig } from '@wrongstack/core/types';
+export type LaunchMcpServers = Record<string, Partial<MCPServerConfig>>;
+/**
+ * Normalize one server entry (Claude Code `type` or WrongStack `transport`
+ * form). Throws with the server name on anything unusable. The result carries
+ * no `enabled` decision — callers own that.
+ */
+export declare function normalizeMcpServerEntry(name: string, raw: unknown): Partial<MCPServerConfig>;
+/** Parse a document already read from disk or given inline. */
+export declare function parseLaunchMcpServers(text: string, source: string): LaunchMcpServers;
+/**
+ * Resolve the flag: inline JSON when the value starts with `{`, otherwise a
+ * path relative to `cwd`. `undefined` when the flag is absent.
+ */
+export declare function resolveLaunchMcpServers(flags: Readonly<Record<string, string | boolean>>, cwd: string): Promise<LaunchMcpServers | undefined>;
+/**
+ * The server set this process starts: config servers (unless strict) with the
+ * launch servers layered on top — a launch entry replaces a config entry of the
+ * same name rather than merging into it.
+ */
+export declare function effectiveMcpServers(configured: Readonly<Record<string, Partial<MCPServerConfig>>> | undefined, launch: LaunchMcpServers | undefined, strict: boolean): Record<string, Partial<MCPServerConfig>>;
+//# sourceMappingURL=mcp-config-flag.d.ts.map

package/dist/boot/piped-stdin.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Piped-stdin context for single-shot runs: `git diff | wstack "review this"`.
+ *
+ * The prompt still comes from argv; whatever was piped in is appended to it as
+ * context. Only single-shot mode reads it — the REPL and TUI own stdin.
+ *
+ * A parent process can hand us an open pipe it never writes to (a harness
+ * spawning `wstack` with default stdio), which would block forever waiting for
+ * EOF. So the read gives up if no first byte arrives within
+ * `firstByteTimeoutMs`; once data starts flowing it reads to EOF, capped at
+ * `maxBytes` so a runaway producer cannot blow the context window.
+ */
+import type { Readable } from 'node:stream';
+/** `process.stdin` in production; any readable in tests. */
+export type PipedStdinSource = Readable & {
+    readonly isTTY?: boolean | undefined;
+    unref?: (() => unknown) | undefined;
+};
+export interface PipedStdinResult {
+    /** Piped text, trimmed of trailing whitespace. Empty when nothing arrived. */
+    text: string;
+    /** True when the input exceeded `maxBytes` and was cut. */
+    truncated: boolean;
+    /** True when no first byte arrived in time and the read was abandoned. */
+    timedOut: boolean;
+}
+export interface ReadPipedStdinOptions {
+    firstByteTimeoutMs?: number | undefined;
+    maxBytes?: number | undefined;
+}
+export declare const PIPED_STDIN_FIRST_BYTE_TIMEOUT_MS = 3000;
+export declare const PIPED_STDIN_MAX_BYTES: number;
+/**
+ * Read piped stdin. Resolves `EMPTY` immediately for a TTY — an interactive
+ * terminal is never "piped input".
+ */
+export declare function readPipedStdin(source: PipedStdinSource, opts?: ReadPipedStdinOptions): Promise<PipedStdinResult>;
+/** Join the argv prompt with piped context. The prompt stays first: it is the instruction. */
+export declare function appendPipedStdin(query: string, piped: string): string;
+//# sourceMappingURL=piped-stdin.d.ts.map

package/dist/boot/restricted-mode.d.ts

@@ -0,0 +1,15 @@
+import type { ToolRestriction } from './tool-restriction-flags.js';
+export declare const RESTRICTED_ENV = "WRONGSTACK_RESTRICTED";
+export declare const RESTRICTED_DENY_CAPABILITIES: readonly string[];
+export declare function isRestrictedMode(flags: Readonly<Record<string, unknown>>): boolean;
+/** Throws on a conflicting flag. Returns whether restricted mode is on. */
+export declare function validateRestrictedMode(flags: Readonly<Record<string, unknown>>): boolean;
+/** Fold `--restricted` into the launch tool restriction (if any). */
+export declare function withRestrictedTools(restriction: ToolRestriction | undefined, restricted: boolean): ToolRestriction | undefined;
+export declare const RESTRICTED_NOTICE = "Restricted mode: no shell, network, installs or MCP tools; files stay inside the project; YOLO is off.";
+/**
+ * Validate, engage the process-wide locks, export the env switch and — once
+ * per process — tell the user. Throws on a conflicting flag.
+ */
+export declare function activateRestrictedMode(flags: Readonly<Record<string, unknown>>, write: (line: string) => void): boolean;
+//# sourceMappingURL=restricted-mode.d.ts.map

package/dist/boot/safe-mode.d.ts

@@ -0,0 +1,30 @@
+/**
+ * `--safe-mode`: start with the user's and the project's customizations off,
+ * to tell a broken setup apart from a broken WrongStack.
+ *
+ * Off: third-party plugins, hooks (policy hooks stay, as with `--no-hooks` —
+ * they are enforcement, not customization), configured MCP servers, skills,
+ * and instruction override files (`instructions/` under the profile and the
+ * project). Unchanged: config itself, auth, model selection, permissions,
+ * built-in tools and built-in plugins. Servers named with `--mcp-config` still
+ * start: the flag is an explicit request for them.
+ *
+ * Every decision is read at its consumption point instead of being patched
+ * into config: a patched config can be saved back by any settings write, and
+ * one troubleshooting launch would then silently disable plugins for good.
+ *
+ * `WRONGSTACK_SAFE_MODE=1` is equivalent and is exported to child processes
+ * (WebUI session children, spawned tools) so they start the same way.
+ */
+export declare const SAFE_MODE_ENV = "WRONGSTACK_SAFE_MODE";
+export declare function isSafeMode(flags: Readonly<Record<string, unknown>>): boolean;
+/** Called once at boot: makes `--safe-mode` visible to child processes. */
+export declare function propagateSafeMode(flags: Readonly<Record<string, unknown>>): boolean;
+export declare const SAFE_MODE_NOTICE = "Safe mode: third-party plugins, hooks, configured MCP servers, skills and instruction overrides are off.";
+/**
+ * Propagate and, once per process, tell the user. Without the guard a real
+ * `--safe-mode` launch printed the notice twice, which reads like a second
+ * mode switch.
+ */
+export declare function announceSafeMode(flags: Readonly<Record<string, unknown>>, write: (line: string) => void): boolean;
+//# sourceMappingURL=safe-mode.d.ts.map

package/dist/boot/single-shot-budget.d.ts

@@ -0,0 +1,30 @@
+/**
+ * `--max-budget-usd` for single-shot runs.
+ *
+ * Spend is the leader's cost delta since the run started plus every subagent's
+ * cumulative cost. Subagents run on their own token counters, so the leader's
+ * counter alone would let a delegating run blow straight past the cap.
+ *
+ * The check fires after each accounted request; the request that crosses the
+ * line has already been paid for, so the cap bounds the overshoot to one
+ * request rather than preventing it.
+ */
+import type { EventBus } from '@wrongstack/core/kernel';
+import type { TokenCounter } from '@wrongstack/core/types';
+/** Parse the flag. `undefined` = not set; throws on a value that is set but unusable. */
+export declare function parseMaxBudgetUsd(value: string | boolean | undefined): number | undefined;
+export interface SingleShotBudget {
+    /** Spend so far, in USD. */
+    spent(): number;
+    /** True once the limit was crossed and `onExceeded` fired. */
+    readonly exceeded: boolean;
+    /** Detach the event listeners. */
+    dispose(): void;
+}
+export declare function watchSingleShotBudget(opts: {
+    limitUsd: number;
+    tokenCounter: Pick<TokenCounter, 'estimateCost'>;
+    events: Pick<EventBus, 'on'>;
+    onExceeded: () => void;
+}): SingleShotBudget;
+//# sourceMappingURL=single-shot-budget.d.ts.map

package/dist/boot/stream-json.d.ts

@@ -0,0 +1,36 @@
+/**
+ * `--output-format stream-json`: single-shot progress as JSON Lines on stdout.
+ *
+ * One object per line, each with a `type`:
+ *   init         session id, provider/model, cwd, tool names — first line
+ *   text_delta   streamed answer text (only with --include-partial-messages)
+ *   assistant    one model response: text and tool_use blocks, stop reason, usage
+ *   tool_result  one finished tool call: id, name, ok, duration, output preview
+ *   result       the `--output-json` payload — always the last line
+ *
+ * Only the leader's own activity is streamed. Subagents report through their
+ * `subagent.*` events; the ones that reach the host bus under the plain names
+ * carry a non-leader `agentId` and are dropped, so a delegating run does not
+ * interleave several conversations on one stream.
+ */
+import type { EventBus } from '@wrongstack/core/kernel';
+export type OutputFormat = 'text' | 'json' | 'stream-json';
+/** `undefined` when the flag is absent. Throws on an unknown format. */
+export declare function parseOutputFormat(value: string | boolean | undefined): OutputFormat | undefined;
+export interface StreamJsonOptions {
+    events: Pick<EventBus, 'on'>;
+    /** Writes one line (the caller adds nothing; this function appends `\n`). */
+    write: (line: string) => void;
+    includePartialMessages: boolean;
+}
+/** Subscribe and start writing. Returns the unsubscribe function. */
+export declare function startStreamJson(opts: StreamJsonOptions): () => void;
+/** The first line of the stream. */
+export declare function streamJsonInit(info: {
+    sessionId: string | null;
+    provider: string | null;
+    model: string | null;
+    cwd: string;
+    tools: readonly string[];
+}): string;
+//# sourceMappingURL=stream-json.d.ts.map

package/dist/boot/structured-output.d.ts

@@ -0,0 +1,16 @@
+import type { JSONSchema } from '@wrongstack/core/types';
+/** Inline JSON when the value starts with `{`, otherwise a path relative to `cwd`. */
+export declare function resolveJsonSchemaFlag(value: string | boolean | undefined, cwd: string): Promise<JSONSchema | undefined>;
+/** Appended to the user's task. The task stays first: it is the instruction. */
+export declare function withSchemaInstruction(query: string, schema: JSONSchema): string;
+export type StructuredCheck = {
+    ok: true;
+    value: unknown;
+} | {
+    ok: false;
+    errors: string[];
+};
+/** Parse and validate a final answer. */
+export declare function checkStructuredAnswer(text: string | undefined, schema: JSONSchema): StructuredCheck;
+export declare function repairPrompt(errors: readonly string[]): string;
+//# sourceMappingURL=structured-output.d.ts.map

package/dist/boot/system-prompt-builder.d.ts

@@ -86,6 +86,8 @@ interface BindSystemPromptBuilderDeps {
     tokenSavingMode?: TokenSavingTier | boolean | undefined;
     /** `config.systemPrompt.variant` — selects system.md, system-lite.md, or system-pro.md. */
     systemPromptVariant?: SystemInstructionVariant | undefined;
+    /** `--append-system-prompt[-file]` text; appended to the host prompt only. */
+    appendedInstructions?: string | undefined;
     paths: SystemPromptBuilderPaths;
     /** Project root, for the Atlas brief. Omit to leave the brief out entirely. */
     projectRoot?: string | undefined;

package/dist/boot/tool-restriction-flags.d.ts

@@ -0,0 +1,36 @@
+/**
+ * `--only-tools <names>` and `--disallowed-tools <names>`: a launch-time tool
+ * restriction applied to the tool registry (see `ToolRegistry.setSessionRestriction`).
+ *
+ * `--only-tools` rather than Claude Code's `--tools`: `--tools` is already a
+ * boolean of `wstack models add` and the CSV of `wstack mcp serve`, so a value
+ * form here would swallow the prompt in `wstack --tools read "task"`.
+ *
+ * Names are comma- or space-separated; a trailing `*` matches a prefix
+ * (`mcp__github__*`). Claude Code's scoped rules (`Bash(git *)`) are refused
+ * instead of ignored: dropping a deny rule silently would leave the operator
+ * believing a command is blocked when it is not.
+ */
+export interface ToolRestriction {
+    only?: string[] | undefined;
+    deny: string[];
+    /** Set by `--restricted` only (see restricted-mode.ts). */
+    denyCapabilities?: readonly string[] | undefined;
+    requireDeclaredCapabilities?: boolean | undefined;
+}
+/**
+ * `--allowed-tools <names>`: pre-approve tools (no permission prompt) for this
+ * process. Same list syntax and the same refusal of scoped rules — a scoped
+ * allow like `Bash(git *)` widened to all of `bash` would approve far more
+ * than the operator asked for.
+ */
+export declare function resolveLaunchAllowedTools(flags: Readonly<Record<string, string | boolean>>): string[] | undefined;
+/** `undefined` when neither flag is set. Throws on an unusable value. */
+export declare function resolveToolRestriction(flags: Readonly<Record<string, string | boolean>>): ToolRestriction | undefined;
+/**
+ * Names in the restriction that match no registered tool — most likely typos.
+ * Globs and MCP-style names (`server__tool`) are skipped: MCP servers
+ * register after boot, so their absence here proves nothing.
+ */
+export declare function unknownRestrictedToolNames(restriction: ToolRestriction, isRegistered: (name: string) => boolean): string[];
+//# sourceMappingURL=tool-restriction-flags.d.ts.map

package/dist/boot/worktree-sessions.d.ts

@@ -0,0 +1,21 @@
+import type { SessionSummary } from '@wrongstack/core/types';
+import type { GitWorktreeEntry } from '@wrongstack/core/worktree';
+export interface WorktreeRef {
+    root: string;
+    name: string;
+    branch?: string | undefined;
+}
+/**
+ * The other worktree a session belongs to, or undefined when it ran in the
+ * current checkout, in a checkout git no longer lists (resuming it here is
+ * the only option left), or before checkouts were recorded.
+ */
+export declare function worktreeOfSession(summary: Pick<SessionSummary, 'checkout'>, worktrees: readonly GitWorktreeEntry[]): WorktreeRef | undefined;
+/**
+ * Wrap the resume callback: a session that belongs to another worktree
+ * (per `lookup`, filled from the last listing) first switches the TUI to that
+ * worktree, then resumes there. A failed switch rejects, which the picker
+ * shows, and leaves the current project untouched.
+ */
+export declare function withWorktreeSwitch<A extends unknown[], R>(resume: (sessionId: string, ...rest: A) => Promise<R>, lookup: (sessionId: string) => WorktreeRef | undefined, switchProject: (root: string, name: string) => Promise<string | null>): (sessionId: string, ...rest: A) => Promise<R>;
+//# sourceMappingURL=worktree-sessions.d.ts.map