@wrongstack/cli 1.0.24 → 1.0.27

package/dist/standalone-auto-update.d.ts

@@ -0,0 +1,65 @@
+import type { Config } from '@wrongstack/core/types';
+import { type StagedStandaloneUpdate } from './standalone-update.js';
+import { type UpdateInfo } from './update-check.js';
+/** A verified build waiting to be swapped in. */
+export interface PendingUpdate extends StagedStandaloneUpdate {
+    /** `bun build --target` it was built for. */
+    target: string;
+    /** Real path of the executable it replaces. */
+    executable: string;
+    stagedAt: string;
+}
+/** `update.autoDownload` (default on) and the `WRONGSTACK_NO_AUTO_UPDATE` switch. */
+export declare function autoUpdateEnabled(config: Config | undefined, env?: NodeJS.ProcessEnv): boolean;
+/** The swap a previous session made, reported once. */
+export declare function takeAppliedUpdate(dir?: string): {
+    from: string;
+    to: string;
+} | undefined;
+/** The updates of one install of the executable. */
+export interface StandaloneUpdater {
+    /** Its verified build waiting to be swapped in, if any. */
+    pending(): PendingUpdate | undefined;
+    /**
+     * Download, verify and stage the latest release when it is newer. Returns
+     * the pending update (possibly one staged earlier), or undefined when there
+     * is nothing newer or another session is downloading.
+     */
+    stage(signal?: AbortSignal): Promise<PendingUpdate | undefined>;
+    /**
+     * Swap the pending build in over the executable. Synchronous (it runs from
+     * the process `exit` handler); returns the installed version, or undefined
+     * when there was nothing to install. A pending build that is not newer, or
+     * whose file no longer matches its digest, is thrown away.
+     */
+    apply(platform?: NodeJS.Platform): string | undefined;
+    /**
+     * Drop the pending build after `wstack update` brought the executable to
+     * the latest release: it is either the build just installed or an older one.
+     */
+    clear(): void;
+}
+export declare function standaloneUpdater(install: {
+    executable: string;
+    target: string;
+    current: string;
+    dir?: string | undefined;
+}): StandaloneUpdater;
+/** What an interactive session sees of the background update. */
+export interface StandaloneAutoUpdate {
+    /** Called once the update is ready (immediately, when it already is). */
+    subscribe(listener: (version: string) => void): () => void;
+    /** Stop a download in progress. The exit swap stays armed. */
+    dispose(): void;
+}
+/**
+ * Start the background update for an interactive session: arm the exit swap,
+ * and download the latest release when `updateInfo` says one is newer.
+ * Undefined for the npm install or when switched off.
+ */
+export declare function startStandaloneAutoUpdate(options: {
+    getConfig: () => Config | undefined;
+    updateInfo: UpdateInfo | undefined;
+    onError?: ((message: string) => void) | undefined;
+}): StandaloneAutoUpdate | undefined;
+//# sourceMappingURL=standalone-auto-update.d.ts.map

package/dist/standalone-update-LZO3MNLH.js

@@ -0,0 +1,24 @@
+import {
+  MAX_BINARY_BYTES,
+  fetchLatestStandaloneVersion,
+  findStandaloneRelease,
+  installExecutableFrom,
+  parseSha256Sums,
+  replaceExecutable,
+  standaloneAssetName,
+  updateStandaloneBinary,
+  verifyStandaloneDigest
+} from "./chunk-X756ZS72.js";
+import "./chunk-F5DCFAKI.js";
+export {
+  MAX_BINARY_BYTES,
+  fetchLatestStandaloneVersion,
+  findStandaloneRelease,
+  installExecutableFrom,
+  parseSha256Sums,
+  replaceExecutable,
+  standaloneAssetName,
+  updateStandaloneBinary,
+  verifyStandaloneDigest
+};
+//# sourceMappingURL=standalone-update-LZO3MNLH.js.map

package/dist/standalone-update.d.ts

@@ -1,7 +1,28 @@
 import type { TerminalRenderer } from './renderer.js';
-export declare const RELEASES_REPO = "WrongStack/WrongStack";
+export declare const MAX_BINARY_BYTES: number;
+interface ReleaseAsset {
+    name: string;
+    browser_download_url: string;
+    /** `sha256:<hex>`, computed by GitHub when the asset was uploaded. */
+    digest?: string | null | undefined;
+}
 /** Asset name a build target publishes under (mirrors build-binaries.mjs `outputName`). */
 export declare function standaloneAssetName(target: string): string;
+/** The latest release's executable for `target`, with its SHA256SUMS. */
+export interface StandaloneRelease {
+    version: string;
+    assetName: string;
+    asset: ReleaseAsset;
+    sums: ReleaseAsset;
+}
+/** Throws when the latest release has no build for `target`. */
+export declare function findStandaloneRelease(target: string, signal?: AbortSignal): Promise<StandaloneRelease>;
+/**
+ * Throws unless `sha256` is the release's own build of the asset: listed in
+ * its SHA256SUMS, equal to the digest GitHub computed at upload, and vouched
+ * for by the release workflow's build attestation.
+ */
+export declare function verifyStandaloneDigest(release: StandaloneRelease, sha256: string, signal?: AbortSignal): Promise<void>;
 /** Latest released version, for the update check. */
 export declare function fetchLatestStandaloneVersion(timeoutMs?: number, signal?: AbortSignal): Promise<string>;
 /** `<sha256>  <name>` lines → map. */
@@ -11,9 +32,24 @@ export declare function parseSha256Sums(text: string): Map<string, string>;
  * is a same-filesystem rename.
  */
 export declare function replaceExecutable(target: string, bytes: Buffer, platform?: NodeJS.Platform): void;
+/**
+ * Replace `target` with the file at `source` (a downloaded update), refusing
+ * unless the copy that is about to become the executable hashes to `sha256`.
+ * Synchronous: it runs from the process `exit` handler.
+ */
+export declare function installExecutableFrom(target: string, source: string, sha256: string, platform?: NodeJS.Platform): void;
+/** A verified download the background updater left waiting (standalone-auto-update.ts). */
+export interface StagedStandaloneUpdate {
+    version: string;
+    file: string;
+    sha256: string;
+}
 /** `wstack update` for the standalone binary. Returns the process exit code. */
 export declare function updateStandaloneBinary(options: {
     current: string;
     renderer: Pick<TerminalRenderer, 'write'>;
+    /** Installed instead of downloading again when it is the latest release. */
+    staged?: StagedStandaloneUpdate | undefined;
 }): Promise<number>;
+export {};
 //# sourceMappingURL=standalone-update.d.ts.map

package/dist/subcommands/handlers/import-claude-code.d.ts

@@ -0,0 +1,52 @@
+import type { MCPServerConfig } from '@wrongstack/core/types';
+import type { SubcommandHandler } from '../contracts.js';
+export type McpImportSource = 'claude-user' | 'claude-project-local' | 'repository';
+export interface McpImportCandidate {
+    name: string;
+    source: McpImportSource;
+    config: Partial<MCPServerConfig>;
+    action: 'add' | 'overwrite' | 'skip-exists' | 'skip-invalid';
+    enabled: boolean;
+    note?: string | undefined;
+}
+export interface ClaudeCodeImportPlan {
+    mcp: McpImportCandidate[];
+    notes: string[];
+}
+export interface ClaudeCodeSources {
+    /** Parsed `~/.claude.json`, or undefined when absent. */
+    userState?: Record<string, unknown> | undefined;
+    /** Parsed `<project>/.mcp.json`, or undefined when absent. */
+    projectMcp?: Record<string, unknown> | undefined;
+    /** Settings files that exist, with their parsed content. */
+    settings: Array<{
+        file: string;
+        content: Record<string, unknown>;
+    }>;
+    /** CLAUDE.md files that exist. */
+    instructionFiles: string[];
+    /** Skill directories that exist. */
+    skillDirs: string[];
+}
+/**
+ * Fields a repository entry may not carry into the user's profile. Each one
+ * widens what the server gets on enable beyond "run this command / reach this
+ * URL": `permission` pre-approves every tool it exposes, `bearerTokenEnv` and
+ * `passthroughEnv` send the named environment variables to it, and
+ * `allowPrivateNetworks` lifts the internal-network guard. The repository
+ * chooses the command and URL, so it must not also choose those
+ * (WS-2026-09-26-05). The user can still set them after reviewing.
+ */
+export declare const REPOSITORY_STRIPPED_MCP_FIELDS: readonly ['permission', 'bearerTokenEnv', 'passthroughEnv', 'allowPrivateNetworks'];
+/** Decide what an import would do. Pure: no reads, no writes. */
+export declare function planClaudeCodeImport(opts: {
+    sources: ClaudeCodeSources;
+    projectRoot: string;
+    existingServers: Readonly<Record<string, unknown>>;
+    overwrite: boolean;
+    enableProjectServers: boolean;
+}): ClaudeCodeImportPlan;
+/** Read everything the importer looks at. Missing files are simply absent. */
+export declare function readClaudeCodeSources(projectRoot: string, userHome?: string): Promise<ClaudeCodeSources>;
+export declare const importClaudeCodeCmd: SubcommandHandler;
+//# sourceMappingURL=import-claude-code.d.ts.map

package/dist/subcommands/handlers/permissions.d.ts

@@ -1,10 +1,16 @@
 import type { SubcommandHandler } from '../contracts.js';
 /**
+ * `wstack permissions rules [--json]`
  * `wstack permissions explain <tool> --input '<json>' [--json]`
  *
- * Side-effect-free permission decision explainer. Evaluates the same
- * rules as `DefaultPermissionPolicy.evaluate()` without prompting the
- * user, writing to trust files, or mutating session state.
+ * Side-effect-free views of the permission policy. Both build the policy the
+ * agent itself runs under (`createProjectPermissionPolicy`: directory rules,
+ * trust file, YOLO and `autonomy.yoloConfirm` from the config) for a fresh
+ * session, without prompting the user, writing to trust files, or mutating
+ * session state. `rules` lists every rule in the order they are checked;
+ * `explain` traces one call and names the rule that decided it. Inside a
+ * session, `/permissions` shows the same with that session's YOLO, answers
+ * and session rules.
  */
 export declare const permissionsCmd: SubcommandHandler;
 //# sourceMappingURL=permissions.d.ts.map

package/dist/subcommands/handlers/remote.d.ts

@@ -0,0 +1,6 @@
+import type { TerminalRenderer } from '../../renderer.js';
+import type { SubcommandHandler } from '../contracts.js';
+export declare function runRemoteCommand(args: string[], flags: Record<string, string | boolean>, renderer: Pick<TerminalRenderer, 'writeLine'>): Promise<number>;
+/** Registry entry; `boot()` normally dispatches `remote` before loading any config. */
+export declare const remoteCmd: SubcommandHandler;
+//# sourceMappingURL=remote.d.ts.map

package/dist/subcommands/handlers/sessions-fleet.d.ts

@@ -1,15 +1,3 @@
 import type { SubcommandHandler } from '../contracts.js';
-/**
- * `wrongstack sessions fleet [runId]`
- *
- * Lists fleet run artifacts under `projectSessions/<runId>/`.
- * When runId is omitted, lists all fleet runs discovered under projectSessions.
- *
- * Artifacts shown:
- *   - fleet.json         (manifest)
- *   - checkpoint.json    (state snapshot, if present)
- *   - shared/            (scratchpad directory)
- *   - subagents/         (per-subagent JSONL transcripts)
- */
 export declare const sessionsFleetCmd: SubcommandHandler;
 //# sourceMappingURL=sessions-fleet.d.ts.map

package/dist/subcommands/handlers/version-help.d.ts

@@ -1,4 +1,9 @@
 import type { SubcommandHandler } from '../contracts.js';
 export declare const versionCmd: SubcommandHandler;
+/**
+ * Global help. Every row here must name something the CLI actually reads —
+ * `wstack <command> --help` carries the per-command detail, so this page
+ * groups by what the user is trying to do rather than listing everything.
+ */
 export declare const helpCmd: SubcommandHandler;
 //# sourceMappingURL=version-help.d.ts.map

package/dist/{subcommands-ZTSIN7LG.js → subcommands-BHQYLDSD.js}

@@ -1,9 +1,9 @@
 import {
   subcommandNames,
   subcommands
-} from "./chunk-424ORSE7.js";
+} from "./chunk-N57IU5FG.js";
 export {
   subcommandNames,
   subcommands
 };
-//# sourceMappingURL=subcommands-ZTSIN7LG.js.map
+//# sourceMappingURL=subcommands-BHQYLDSD.js.map

package/dist/tui-resume-callback.d.ts

@@ -0,0 +1,18 @@
+import type { SessionLoadProgress } from '@wrongstack/core/types';
+export declare function createTuiResumeCallback({ state, agent, tokenCounter, switchProviderAndModel, events, }: {
+    state: import('./boot/tui-runtime-state.js').TuiRuntimeState;
+    agent: import('@wrongstack/core/agent').Agent;
+    tokenCounter: import('@wrongstack/core/types').TokenCounter;
+    switchProviderAndModel: (providerId: string, modelId: string) => string | Promise<string | null> | null;
+    events: import('@wrongstack/core/kernel').EventBus;
+}): (sessionId: string, onLoadProgress?: (progress: SessionLoadProgress) => void, onStage?: (stage: string) => void) => Promise<{
+    entries: unknown[];
+    nextId: number;
+    sessionId: string;
+    attached: boolean;
+    warnings: string[];
+    contextSnapshot?: import("@wrongstack/core/types").ContextSnapshot | undefined;
+    lastAssistantText?: string | undefined;
+    nextSteps: string[];
+}>;
+//# sourceMappingURL=tui-resume-callback.d.ts.map

package/dist/{typesafe-HVEVPA6R.js → typesafe-U7YB2RRV.js}

@@ -1,10 +1,10 @@
-import {
-  activeProfileConfigPath
-} from "./chunk-YMXXOOFN.js";
 import {
   maskedKey,
   mutateConfigProviders
 } from "./chunk-LUMETJFO.js";
+import {
+  activeProfileConfigPath
+} from "./chunk-YMXXOOFN.js";
 
 // src/subcommands/handlers/typesafe.ts
 import { execFile } from "node:child_process";
@@ -67,7 +67,7 @@ var typesafeCmd = async (args, deps) => {
     case "lint-conventions":
       return await lintConventions(deps, write);
     case "replay-topic-shift":
-      return await (await import("./typesafe-topic-replay-4W73BOLV.js")).replayTopicShift(deps, write);
+      return await (await import("./typesafe-topic-replay-ZILIU3WS.js")).replayTopicShift(deps, write);
     case "replay-memory-triage":
       return await (await import("./typesafe-triage-replay-FGAW7QM7.js")).replayMemoryTriage(deps, write);
     case "replay-brain-ledger":
@@ -313,4 +313,4 @@ async function lintConventions(deps, write) {
 export {
   typesafeCmd
 };
-//# sourceMappingURL=typesafe-HVEVPA6R.js.map
+//# sourceMappingURL=typesafe-U7YB2RRV.js.map

package/dist/{typesafe-topic-replay-4W73BOLV.js → typesafe-topic-replay-ZILIU3WS.js}

@@ -1,3 +1,6 @@
+import {
+  resolveRuntimeMaxContext
+} from "./chunk-CZTXF6HY.js";
 import {
   createProviderForId
 } from "./chunk-BBHWW6LR.js";
@@ -85,10 +88,23 @@ async function replayTopicShift(deps, write) {
     return 2;
   }
   const limit = Math.max(1, Number(flags["limit"]) || 40);
-  const maxContext = Math.max(1, Number(flags["max-context"]) || 2e5);
   const sessionsRoot = typeof flags["sessions"] === "string" ? path.resolve(flags["sessions"]) : path.join(deps.paths.projectDir, "sessions");
   const providerId = typeof flags["provider"] === "string" ? flags["provider"] : deps.config.provider;
   const model = typeof flags["model"] === "string" ? flags["model"] : deps.config.model;
+  const flagMaxContext = Number(flags["max-context"]);
+  const maxContext = Number.isFinite(flagMaxContext) && flagMaxContext > 0 ? Math.floor(flagMaxContext) : await resolveRuntimeMaxContext({
+    modelsRegistry: deps.modelsRegistry,
+    config: deps.config,
+    provider: { capabilities: { maxContext: 0 } },
+    providerId,
+    modelId: model
+  }).catch(() => 0);
+  if (maxContext <= 0) {
+    write(
+      `${color.red("\u2717")} Context window of ${providerId}/${model} is unknown. Pass --max-context <tokens>.`
+    );
+    return 2;
+  }
   const provider = flags["no-llm"] === true ? void 0 : createProviderForId(providerId, deps.config);
   const judge = { client: account.client, model: account.model, feature: "topicShift" };
   const reached = [];
@@ -215,4 +231,4 @@ async function replayTopicShift(deps, write) {
 export {
   replayTopicShift
 };
-//# sourceMappingURL=typesafe-topic-replay-4W73BOLV.js.map
+//# sourceMappingURL=typesafe-topic-replay-ZILIU3WS.js.map

package/dist/{update-7XIOEXTD.js → update-TDZX4IL2.js}

@@ -3,14 +3,14 @@ import {
   detectUpdatePackageName,
   runUpdateCommand,
   updateCmd
-} from "./chunk-QFPQXKCG.js";
+} from "./chunk-KOEO4CJG.js";
 import "./chunk-U3SS4NRH.js";
-import "./chunk-ZZRSG7VK.js";
-import "./chunk-YBUCXXYZ.js";
+import "./chunk-RZ4ZDRYA.js";
+import "./chunk-F5DCFAKI.js";
 export {
   detectUpdatePackageManager,
   detectUpdatePackageName,
   runUpdateCommand,
   updateCmd
 };
-//# sourceMappingURL=update-7XIOEXTD.js.map
+//# sourceMappingURL=update-TDZX4IL2.js.map

package/dist/{update-check-2POMBHFB.js → update-check-J5ZVKS73.js}

@@ -5,8 +5,8 @@ import {
   fetchLatestFromNpm,
   getUpdateNotification,
   isNewer
-} from "./chunk-ZZRSG7VK.js";
-import "./chunk-YBUCXXYZ.js";
+} from "./chunk-RZ4ZDRYA.js";
+import "./chunk-F5DCFAKI.js";
 export {
   cachePath,
   checkForUpdate,
@@ -15,4 +15,4 @@ export {
   getUpdateNotification,
   isNewer
 };
-//# sourceMappingURL=update-check-2POMBHFB.js.map
+//# sourceMappingURL=update-check-J5ZVKS73.js.map

package/dist/version-JB2UAV2A.js

@@ -0,0 +1,11 @@
+import {
+  API_VERSION,
+  CLI_VERSION,
+  STANDALONE_TARGET
+} from "./chunk-F5DCFAKI.js";
+export {
+  API_VERSION,
+  CLI_VERSION,
+  STANDALONE_TARGET
+};
+//# sourceMappingURL=version-JB2UAV2A.js.map

package/dist/version-help-XJJQ7YSH.js

@@ -0,0 +1,10 @@
+import {
+  helpCmd,
+  versionCmd
+} from "./chunk-5JYDKG5B.js";
+import "./chunk-F5DCFAKI.js";
+export {
+  helpCmd,
+  versionCmd
+};
+//# sourceMappingURL=version-help-XJJQ7YSH.js.map

package/dist/webui-server/route-contexts.d.ts

@@ -4,7 +4,7 @@
  * @module webui-server/route-contexts
  */
 import type { Agent } from '@wrongstack/core/agent';
-import type { SessionWriter } from '@wrongstack/core/types';
+import { type SessionWriter } from '@wrongstack/core/types';
 import { type BrainHandlerContext, type CustomModeStore, type DesignContext, type EmbeddedAgentConfigContext, type EmbeddedConversationContext, type EmbeddedProjectContext, type EmbeddedSessionContext, type IntrospectionRouteContext, type PendingConfirm, type PrefsHandlerContext, type PromptsContext, type SkillsContext } from '@wrongstack/webui-server';
 import type { WebSocket } from 'ws';
 import type { CliWebUIOptions } from '../webui-server-options.js';

package/dist/webui-server/session-start-payload.d.ts

@@ -1,5 +1,5 @@
 import type { Context } from '@wrongstack/core/agent';
-import type { ModelsRegistry } from '@wrongstack/core/types';
+import type { Config, ModelsRegistry } from '@wrongstack/core/types';
 import type { UpdateInfo } from '../update-check.js';
 /** @see UpdateInfo in ../update-check.ts for the canonical shape. */
 export type BootUpdateInfo = UpdateInfo;
@@ -25,6 +25,10 @@ export interface SessionStartPayloadDeps {
      */
     getSessionContext?: ((sessionId: string) => Context | undefined) | undefined;
     modelsRegistry?: ModelsRegistry | undefined;
+    /** Saved providers, to find an alias's catalog entry (`work` → `anthropic`). */
+    appConfig?: {
+        providers?: Config['providers'];
+    } | undefined;
     statusTracker?: import('@wrongstack/core/coordination').ProviderModelStatusTracker | undefined;
     modeId?: string | undefined;
     projectRoot?: string | undefined;