@wrongstack/cli 1.0.28 → 1.0.32

package/dist/sage-sync-ZMTHB477.js

@@ -0,0 +1,69 @@
+import {
+  startCliHqConnection
+} from "./chunk-4UWCMBPG.js";
+import "./chunk-F5DCFAKI.js";
+
+// src/subcommands/handlers/sage-sync.ts
+import { resolveHqConfig } from "@wrongstack/core/hq";
+import { SageProjectServerConnection } from "@wrongstack/sage";
+async function runSageHqSyncCommand(deps, restartService, signal) {
+  if (signal?.aborted) return 0;
+  if (!resolveHqConfig({ config: deps.config.hq })?.enabled) {
+    deps.renderer.writeError("HQ is disabled. Enable HQ before starting SAGE synchronization.\n");
+    return 1;
+  }
+  if (restartService) {
+    const control = new SageProjectServerConnection(
+      deps.projectRoot,
+      deps.config.Sage?.storage?.directory,
+      { spawnIfMissing: false }
+    );
+    try {
+      const result = await control.shutdown("operator-requested SAGE sync upgrade");
+      if (!result.stopped && result.reason !== "not-running") {
+        deps.renderer.writeError(`SAGE restart failed: ${result.reason ?? "unknown error"}
+`);
+        return 1;
+      }
+    } finally {
+      control.close();
+    }
+  }
+  if (signal?.aborted) return 0;
+  const connection = startCliHqConnection({
+    clientKind: "cli",
+    projectRoot: deps.projectRoot,
+    appConfig: deps.config,
+    capabilities: ["telemetry.publish"],
+    ownKanbanSync: false,
+    ownSageSync: true
+  });
+  deps.renderer.write(
+    `SAGE HQ sync running for ${connection.getPublisher()?.project.projectId ?? deps.projectRoot}. Reconnect is automatic; Ctrl+C stops this bridge.
+`
+  );
+  try {
+    await new Promise((resolve) => {
+      const keepAlive = setInterval(() => {
+      }, 6e4);
+      const stop = () => {
+        clearInterval(keepAlive);
+        process.removeListener("SIGINT", stop);
+        process.removeListener("SIGTERM", stop);
+        signal?.removeEventListener("abort", stop);
+        resolve();
+      };
+      process.once("SIGINT", stop);
+      process.once("SIGTERM", stop);
+      signal?.addEventListener("abort", stop, { once: true });
+      if (signal?.aborted) stop();
+    });
+    return 0;
+  } finally {
+    connection.stop();
+  }
+}
+export {
+  runSageHqSyncCommand
+};
+//# sourceMappingURL=sage-sync-ZMTHB477.js.map

package/dist/sandbox-TYGD6FI2.js

@@ -0,0 +1,131 @@
+
+// src/subcommands/handlers/sandbox.ts
+import { mkdir } from "node:fs/promises";
+import * as path from "node:path";
+import { atomicWrite, toErrorMessage } from "@wrongstack/core/utils";
+import { createHeadlessLaunchPlan, runDockerWorkspace } from "@wrongstack/runtime";
+var sandboxCmd = (args, deps) => runSandboxCommand(args, deps.flags ?? {}, deps.renderer);
+var USAGE = `Usage: wstack sandbox docker --image <trusted-image> --prompt <task> [options]
+
+Runs the entire WrongStack agent in a copied Docker workspace. Your local project
+and home are not mounted. Returns a patch against the imported snapshot; nothing
+is automatically applied to your working tree.
+
+Build the supplied runtime image from a published version:
+  docker build --build-arg WRONGSTACK_VERSION=<version> -t wrongstack-sandbox containers/sandbox
+
+Options:
+  --image <image>        Required image with wstack, git and sh installed
+  --prompt <task>        Required task for the isolated agent
+  --provider <id>        Provider to use inside the container
+  --model <id>           Model to use inside the container
+  --env <NAME,...>       Explicit host env names to forward (no values on argv)
+  --network <bridge|none> Docker networking (default bridge)
+  --timeout <seconds>    Entire agent command limit (default 600)
+  --out <directory>      Patch and run metadata directory
+  --yolo                Enable YOLO inside this container only
+  --max-iterations <n>  Agent iteration limit (default 40, maximum 1000)
+  --dry-run             Validate and print a plan without starting Docker
+  --help                Show this help
+
+Binary/image previews and OAuth credential-file import are not part of this
+launcher. Use API credentials forwarded explicitly, or a separately configured
+trusted image. The default image and packages are never silently selected.
+`;
+async function runSandboxCommand(args, flags, renderer) {
+  if (flags["help"] || args[0] === "help") {
+    renderer.write(USAGE);
+    return 0;
+  }
+  const image = typeof flags["image"] === "string" ? flags["image"] : "";
+  const prompt = typeof flags["prompt"] === "string" ? flags["prompt"] : "";
+  if (args[0] !== "docker" || !image || !prompt) {
+    renderer.write(USAGE);
+    return 2;
+  }
+  const network = flags["network"] ?? "bridge";
+  if (network !== "bridge" && network !== "none") {
+    renderer.write("sandbox: network must be bridge or none\n");
+    return 2;
+  }
+  const timeoutMs = Number(flags["timeout"] ?? 600) * 1e3;
+  if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1e3 || timeoutMs > 864e5) {
+    renderer.write("sandbox: timeout must be 1 to 86400 seconds\n");
+    return 2;
+  }
+  const envNames = typeof flags["env"] === "string" ? flags["env"].split(",").map((name) => name.trim()).filter(Boolean) : [];
+  const abort = new AbortController();
+  const cancel = () => abort.abort();
+  process.once("SIGINT", cancel);
+  process.once("SIGTERM", cancel);
+  try {
+    const plan = createHeadlessLaunchPlan({
+      name: "sandbox",
+      projectRoot: process.cwd(),
+      image,
+      prompt,
+      provider: typeof flags["provider"] === "string" ? flags["provider"] : void 0,
+      model: typeof flags["model"] === "string" ? flags["model"] : void 0,
+      envNames,
+      yolo: flags["yolo"] === true,
+      enabled: true,
+      timeoutMs,
+      maxIterations: flags["max-iterations"] === void 0 ? 40 : Number(flags["max-iterations"])
+    });
+    if (flags["dry-run"] === true) {
+      renderer.write(
+        `${JSON.stringify({ ...plan, network, missingEnvironment: envNames.filter((name) => !process.env[name]) }, null, 2)}
+`
+      );
+      return 0;
+    }
+    const result = await runDockerWorkspace({
+      projectRoot: process.cwd(),
+      image,
+      command: "wstack",
+      args: plan.args,
+      envNames,
+      network,
+      timeoutMs,
+      signal: abort.signal,
+      onOutput: (text) => renderer.write(text)
+    });
+    const out = path.resolve(
+      typeof flags["out"] === "string" ? flags["out"] : path.join(process.cwd(), ".wrongstack", "sandbox-runs", result.id)
+    );
+    await mkdir(out, { recursive: true });
+    if (result.patch !== null) await atomicWrite(path.join(out, "changes.patch"), result.patch);
+    const { patch: _patch, output: _output, ...metadata } = result;
+    await atomicWrite(
+      path.join(out, "run.json"),
+      `${JSON.stringify({ ...metadata, image, projectRoot: process.cwd(), network }, null, 2)}
+`
+    );
+    renderer.write(
+      `
+Sandbox exit: ${result.exitCode}
+${result.patch !== null ? `Patch: ${path.join(out, "changes.patch")}
+` : `Partial workspace: wrongstack-${result.id}
+`}Metadata: ${path.join(out, "run.json")}
+`
+    );
+    if (result.cleanup === "retained")
+      renderer.write("Stopped container retained for recovery; no patch was claimed.\n");
+    if (result.cleanup === "unverified")
+      renderer.write(`Container cleanup could not be verified: wrongstack-${result.id}
+`);
+    return result.exitCode;
+  } catch (error) {
+    renderer.write(`sandbox: ${toErrorMessage(error)}
+`);
+    return abort.signal.aborted ? 130 : 1;
+  } finally {
+    process.removeListener("SIGINT", cancel);
+    process.removeListener("SIGTERM", cancel);
+  }
+}
+export {
+  runSandboxCommand,
+  sandboxCmd
+};
+//# sourceMappingURL=sandbox-TYGD6FI2.js.map

package/dist/services/sdd/project-context.d.ts

@@ -3,5 +3,5 @@ export { gatherProjectContext } from '@wrongstack/sdd';
 export declare function getActiveBuilder(): AISpecBuilder | null;
 export declare function getActiveSDDContext(): string | null;
 export declare function getActiveSDDPhase(): AISpecPhase | null;
-export declare function findSpec(store: SpecStore, idOrTitle: string): Promise<import("@wrongstack/core").Specification | null>;
+export declare function findSpec(store: SpecStore, idOrTitle: string): Promise<import("@wrongstack/core/types").Specification | null>;
 //# sourceMappingURL=project-context.d.ts.map

package/dist/{sessions-config-XHLXJ5C3.js → sessions-config-VE26SB56.js}

@@ -1,16 +1,16 @@
 import {
   activeProfileConfigPath
 } from "./chunk-YMXXOOFN.js";
-import {
-  restoreFlags
-} from "./chunk-CSAPOCBP.js";
 import {
   backupCurrent,
   getHistoryEntry,
   listHistory,
   restoreFromHistory,
   restoreLast
-} from "./chunk-WSTVGC2C.js";
+} from "./chunk-4BX2YDTQ.js";
+import {
+  restoreFlags
+} from "./chunk-CSAPOCBP.js";
 
 // src/subcommands/handlers/sessions-config.ts
 import * as path2 from "node:path";
@@ -18,13 +18,24 @@ import { color as color2, expectDefined } from "@wrongstack/core/utils";
 
 // src/subcommands/handlers/helpers.ts
 import { isSecretField } from "@wrongstack/core/security";
-function redactKeys(obj) {
+function redactKeys(obj, seen = /* @__PURE__ */ new WeakSet()) {
   if (!obj || typeof obj !== "object") return obj;
-  if (Array.isArray(obj)) return obj.map(redactKeys);
+  if (seen.has(obj)) return "[Circular]";
+  seen.add(obj);
+  if (Array.isArray(obj)) return obj.map((item) => redactKeys(item, seen));
   const out = {};
   for (const [k, v] of Object.entries(obj)) {
+    if (k === "__proto__") {
+      Object.defineProperty(out, k, {
+        value: redactKeys(v, seen),
+        writable: true,
+        enumerable: true,
+        configurable: true
+      });
+      continue;
+    }
     if (isSecretField(k) && typeof v === "string" && v.length > 0) out[k] = "[REDACTED]";
-    else out[k] = redactKeys(v);
+    else out[k] = redactKeys(v, seen);
   }
   return out;
 }
@@ -525,4 +536,4 @@ export {
   configCmd,
   sessionsCmd
 };
-//# sourceMappingURL=sessions-config-XHLXJ5C3.js.map
+//# sourceMappingURL=sessions-config-VE26SB56.js.map

package/dist/short-circuit-flags-6LB3EGF7.js

@@ -0,0 +1,10 @@
+import {
+  handleHelpVersionShortCircuit
+} from "./chunk-WXJH4F6K.js";
+import "./chunk-MPQCHBDJ.js";
+import "./chunk-WHEYHDIE.js";
+import "./chunk-F5DCFAKI.js";
+export {
+  handleHelpVersionShortCircuit
+};
+//# sourceMappingURL=short-circuit-flags-6LB3EGF7.js.map

package/dist/slash-commands/openai-quota.d.ts

@@ -13,21 +13,27 @@
  * below reads only the neutral shape. A second metered provider needs a
  * reporter and a one-line command, not a second copy of this file.
  *
- * The reading is observational: it appears after the first request of the
- * session, not before, and it is never fetched on its own — spending a request
- * to ask "how much have I spent" is exactly the wrong trade on a metered plan.
+ * Two sources feed it. The headers keep it current as turns run; before any
+ * turn, the command asks the account usage endpoint (`/wham/usage`, the read
+ * behind the official client's `/status`) through the active ChatGPT
+ * transport. That read is a status call, not a model call — it spends none of
+ * the plan it reports.
  *
  * Usage:
  *   /openai-quota     Show the latest reading for every metered window
  */
 import { type ProviderQuotaSnapshot } from '@wrongstack/core/quota';
-import type { SlashCommand } from '@wrongstack/core/types';
+import type { ProviderConfig, SlashCommand } from '@wrongstack/core/types';
+/** Where the saved providers come from — the live config in a session. */
+export interface QuotaCommandDeps {
+    providers?: () => Readonly<Record<string, ProviderConfig>> | undefined;
+}
 /**
  * Render one meter. Provider-neutral by construction — everything it reads is
  * on the shared snapshot shape.
  */
 export declare function renderQuotaSnapshot(snapshot: ProviderQuotaSnapshot): string[];
-export declare function buildOpenAIQuotaCommand(): SlashCommand;
+export declare function buildOpenAIQuotaCommand(deps?: QuotaCommandDeps): SlashCommand;
 /**
  * `/provider-quota` — every metered subscription this session has heard from.
  *
@@ -42,5 +48,5 @@ export declare function buildOpenAIQuotaCommand(): SlashCommand;
  * and would occupy the name if one is ever built. What this shows is exactly
  * the provider plane's readings, so that is what it is called.
  */
-export declare function buildProviderQuotaCommand(): SlashCommand;
+export declare function buildProviderQuotaCommand(deps?: QuotaCommandDeps): SlashCommand;
 //# sourceMappingURL=openai-quota.d.ts.map

package/dist/slash-commands/sandbox.d.ts

@@ -0,0 +1,5 @@
+import type { SlashCommand } from '@wrongstack/core/types';
+import type { SlashCommandContext } from './command-context.js';
+/** CLI active-tier indicator (plan 28 T3; TUI/WebUI panels remain T9). */
+export declare function buildSandboxCommand(_opts: SlashCommandContext): SlashCommand;
+//# sourceMappingURL=sandbox.d.ts.map

package/dist/slash-commands/scout-stats.d.ts

@@ -0,0 +1,46 @@
+import type { SessionEvent, SlashCommand } from '@wrongstack/core/types';
+import type { SlashCommandContext } from './command-context.js';
+/**
+ * `/scout-stats` — does the Scout identity behave the way its prompt asks?
+ *
+ * Measured from session journals at read time (nothing is recorded for it):
+ * every `llm_request` carries the identity variant it ran under, and tool
+ * calls are journaled as `tool_call_start` events. Two behaviours are the
+ * point of Scout, so they lead the report next to the other variants:
+ *
+ * - discovery — how often `tool_search` comes back empty, and how often a tool
+ *   it surfaced is then called through `tool_use`;
+ * - delegation — the share of runs that hand work to a subagent, against runs
+ *   that did a lot of tool work alone.
+ */
+/** Tool calls in one run, without a delegation, that count as "worked alone". */
+export declare const SOLO_HEAVY_TOOL_CALLS = 8;
+export interface VariantUsage {
+    variant: string;
+    sessions: number;
+    runs: number;
+    requests: number;
+    inputTokens: number;
+    outputTokens: number;
+    toolCalls: number;
+    /** Calls routed through the `tool_use` gateway (schema was not direct). */
+    lazyCalls: number;
+    searches: number;
+    emptySearches: number;
+    /** `tool_use` calls whose target an earlier search in the run returned. */
+    searchedThenUsed: number;
+    delegations: number;
+    runsWithDelegation: number;
+    /** Runs with at least {@link SOLO_HEAVY_TOOL_CALLS} tool calls and no delegation. */
+    soloHeavyRuns: number;
+}
+/**
+ * Aggregate journals per identity variant. A run starts at each `user_input`
+ * and belongs to the variant of its first `llm_request`; a journal written
+ * before requests recorded their variant is reported as `unrecorded`.
+ */
+export declare function summarizeVariantUsage(sessions: readonly (readonly SessionEvent[])[]): VariantUsage[];
+/** One block per variant; Scout first, since the command exists to judge it. */
+export declare function formatVariantUsage(usage: readonly VariantUsage[], sessionCount: number): string;
+export declare function buildScoutStatsCommand(opts: SlashCommandContext): SlashCommand;
+//# sourceMappingURL=scout-stats.d.ts.map

package/dist/slash-commands/sdd-inspect-commands.d.ts

@@ -0,0 +1,9 @@
+import type { SlashCommand } from '@wrongstack/core/types';
+export declare function runSddInspectCommand(inputs: {
+    cmd: string;
+    opts: import('./command-context.js').SlashCommandContext;
+    specStore: import('@wrongstack/sdd').SpecStore;
+    restJoined: string;
+    versioning: import('@wrongstack/sdd').SpecVersioning;
+}): ReturnType<SlashCommand['run']>;
+//# sourceMappingURL=sdd-inspect-commands.d.ts.map

package/dist/slash-commands/sdd-session-commands.d.ts

@@ -0,0 +1,19 @@
+import type { SlashCommand } from '@wrongstack/core/types';
+export declare function runSddSessionCommand(inputs: {
+    cmd: string;
+    restArgs: string[];
+    sessionState: import('../services/sdd/state.js').SDDState;
+    projectRoot: string;
+    specStore: import('@wrongstack/sdd').SpecStore;
+    sessionPersistenceOptions: {
+        sessionPersistence: import('@wrongstack/sdd').AISpecSessionPersistence;
+        sessionPath?: never;
+    } | {
+        sessionPath: string;
+        sessionPersistence?: never;
+    };
+    opts: import('./command-context.js').SlashCommandContext;
+    versioning: import('@wrongstack/sdd').SpecVersioning;
+    sessionPersistence: import('@wrongstack/sdd').AISpecSessionPersistence | undefined;
+}): ReturnType<SlashCommand['run']>;
+//# sourceMappingURL=sdd-session-commands.d.ts.map

package/dist/slash-commands/sdd.d.ts

@@ -1,5 +1,5 @@
 import type { SlashCommand } from '@wrongstack/core/types';
-import { renderProgress, TaskTracker } from '@wrongstack/sdd';
+import { renderProgress, type TaskTracker } from '@wrongstack/sdd';
 import type { SlashCommandContext } from './command-context.js';
 export type { TaskProgress } from '@wrongstack/core/types';
 export { findSpec, gatherProjectContext, getActiveBuilder, getActiveSDDContext, getActiveSDDPhase, } from '../services/sdd/project-context.js';

package/dist/slash-commands/zai-plan.d.ts

@@ -0,0 +1,26 @@
+/**
+ * `/zai-plan` — the Z.AI / BigModel GLM Coding Plan, the way the official
+ * ZCode client's usage panel shows it: the subscription in force, the 5-hour
+ * and weekly model windows, the monthly MCP tool-call pool, the last days'
+ * token usage per model with the cache-hit rate, and the platform's own
+ * service health.
+ *
+ * Unlike `/provider-quota`, which only replays what turns already observed,
+ * this asks: every section is an account read on the monitor API. None of
+ * them is a model call, so the plan it describes is not spent by looking.
+ *
+ * It reports on the Z.AI / BigModel providers built in this session (the key
+ * lives with the transport, not here). Team plans need organization/project
+ * scoping that only ZCode's OAuth login carries; this reads the personal plan
+ * the API key belongs to.
+ *
+ * Usage:
+ *   /zai-plan          Plan, quota and the last 7 days
+ *   /zai-plan <days>   Same, with a 1–30 day usage window
+ */
+import type { SlashCommand } from '@wrongstack/core/types';
+import { type ZaiAccountHandle } from '@wrongstack/providers';
+export declare function buildZaiPlanCommand(deps?: {
+    accounts?: () => readonly ZaiAccountHandle[];
+}): SlashCommand;
+//# sourceMappingURL=zai-plan.d.ts.map

package/dist/{standalone-auto-update-TOTRGCSA.js → standalone-auto-update-VQC4GYCM.js}

@@ -4,10 +4,10 @@ import {
   findStandaloneRelease,
   installExecutableFrom,
   verifyStandaloneDigest
-} from "./chunk-X756ZS72.js";
+} from "./chunk-SUDNPYWD.js";
 import {
   isNewer
-} from "./chunk-RZ4ZDRYA.js";
+} from "./chunk-DIOODAYM.js";
 import {
   CLI_VERSION,
   STANDALONE_TARGET
@@ -246,4 +246,4 @@ export {
   startStandaloneAutoUpdate,
   takeAppliedUpdate
 };
-//# sourceMappingURL=standalone-auto-update-TOTRGCSA.js.map
+//# sourceMappingURL=standalone-auto-update-VQC4GYCM.js.map

package/dist/{standalone-update-LZO3MNLH.js → standalone-update-HZHDZZOR.js}

@@ -8,7 +8,7 @@ import {
   standaloneAssetName,
   updateStandaloneBinary,
   verifyStandaloneDigest
-} from "./chunk-X756ZS72.js";
+} from "./chunk-SUDNPYWD.js";
 import "./chunk-F5DCFAKI.js";
 export {
   MAX_BINARY_BYTES,
@@ -21,4 +21,4 @@ export {
   updateStandaloneBinary,
   verifyStandaloneDigest
 };
-//# sourceMappingURL=standalone-update-LZO3MNLH.js.map
+//# sourceMappingURL=standalone-update-HZHDZZOR.js.map

package/dist/subcommands/handlers/automation-credentials.d.ts

@@ -0,0 +1,8 @@
+import type { SecretVault } from '@wrongstack/core/types';
+import type { WstackPaths } from '@wrongstack/core/utils';
+import { type CredentialReference, type ResolvedCredentialBundle } from '@wrongstack/runtime';
+/** Read the existing machine profile at use time, so ordinary key rotation is visible. */
+export declare function resolveAutomationCredentials(refs: readonly CredentialReference[], paths: Pick<WstackPaths, 'profileConfig'>, vault: SecretVault): Promise<Readonly<Record<string, string>>>;
+/** Endpoint and key are read from the same atomic profile snapshot. */
+export declare function resolveAutomationCredentialBundle(refs: readonly CredentialReference[], paths: Pick<WstackPaths, 'profileConfig'>, vault: SecretVault): Promise<ResolvedCredentialBundle>;
+//# sourceMappingURL=automation-credentials.d.ts.map

package/dist/subcommands/handlers/automation.d.ts

@@ -0,0 +1,3 @@
+import type { SubcommandHandler } from '../contracts.js';
+export declare const automationCmd: SubcommandHandler;
+//# sourceMappingURL=automation.d.ts.map

package/dist/subcommands/handlers/bench-experiments.d.ts

@@ -0,0 +1,5 @@
+import { type QualityReviewPolicy } from '@wrongstack/bench';
+import type { SubcommandDeps } from '../contracts.js';
+export declare function benchExperimentCommand(action: string, args: string[], deps: SubcommandDeps): Promise<number>;
+export declare function readBenchReviewPolicy(file: string): Promise<QualityReviewPolicy>;
+//# sourceMappingURL=bench-experiments.d.ts.map

package/dist/subcommands/handlers/helpers.d.ts

@@ -1,2 +1,2 @@
-export declare function redactKeys(obj: unknown): unknown;
+export declare function redactKeys(obj: unknown, seen?: WeakSet<object>): unknown;
 //# sourceMappingURL=helpers.d.ts.map

package/dist/subcommands/handlers/sage-sync.d.ts

@@ -0,0 +1,4 @@
+import type { SubcommandDeps } from '../contracts.js';
+/** A memory-only HQ connection for headless hosts and upgrading active sessions. */
+export declare function runSageHqSyncCommand(deps: SubcommandDeps, restartService: boolean, signal?: AbortSignal): Promise<number>;
+//# sourceMappingURL=sage-sync.d.ts.map

package/dist/subcommands/handlers/sage.d.ts

@@ -0,0 +1,5 @@
+import type { SubcommandHandler } from '../contracts.js';
+/** PATH lookup with PATHEXT on Windows; an explicit path is checked as written. */
+export declare function findExecutableOnPath(cmd: string): string | null;
+export declare const sageCmd: SubcommandHandler;
+//# sourceMappingURL=sage.d.ts.map

package/dist/subcommands/handlers/sandbox.d.ts

@@ -0,0 +1,5 @@
+import type { TerminalRenderer } from '../../renderer.js';
+import type { SubcommandHandler } from '../contracts.js';
+export declare const sandboxCmd: SubcommandHandler;
+export declare function runSandboxCommand(args: string[], flags: Record<string, string | boolean>, renderer: TerminalRenderer): Promise<number>;
+//# sourceMappingURL=sandbox.d.ts.map

package/dist/{subcommands-SRRB3RAS.js → subcommands-QO7VYTSS.js}

@@ -1,9 +1,9 @@
 import {
   subcommandNames,
   subcommands
-} from "./chunk-3ZTLPNEQ.js";
+} from "./chunk-LIZXJHZQ.js";
 export {
   subcommandNames,
   subcommands
 };
-//# sourceMappingURL=subcommands-SRRB3RAS.js.map
+//# sourceMappingURL=subcommands-QO7VYTSS.js.map

package/dist/{tools-skills-GH24UCBY.js → tools-skills-33AI6K6S.js}

@@ -6,7 +6,7 @@ var toolsCmd = async (_args, deps) => {
   if (!reg) return 0;
   for (const { tool, owner } of reg.listWithOwner())
     deps.renderer.write(
-      `  ${tool.name.padEnd(28)} ${color.dim(`[${owner}]`)} ${tool.permission}
+      `  ${(tool.name === "tool_script" ? "tool_script / ToolFlow" : tool.name).padEnd(28)} ${color.dim(`[${owner}]`)} ${tool.permission}
 `
     );
   return 0;
@@ -25,4 +25,4 @@ export {
   skillsCmd,
   toolsCmd
 };
-//# sourceMappingURL=tools-skills-GH24UCBY.js.map
+//# sourceMappingURL=tools-skills-33AI6K6S.js.map

package/dist/tui-provider-quota-menu.d.ts

@@ -0,0 +1,5 @@
+import type { ProviderConfig } from '@wrongstack/core/types';
+import type { ResourceMenuSnapshot } from '@wrongstack/tui';
+/** One provider per row, with all its meters in the detail pane. */
+export declare function providerQuotaMenu(providers: Readonly<Record<string, ProviderConfig>> | undefined): ResourceMenuSnapshot;
+//# sourceMappingURL=tui-provider-quota-menu.d.ts.map

package/dist/{typesafe-WA5O3KVS.js → typesafe-NHC322W5.js}

@@ -1,7 +1,7 @@
 import {
   maskedKey,
   mutateConfigProviders
-} from "./chunk-LUMETJFO.js";
+} from "./chunk-ZYACRPLN.js";
 import {
   activeProfileConfigPath
 } from "./chunk-YMXXOOFN.js";
@@ -29,6 +29,7 @@ import { buildChildEnv, color } from "@wrongstack/core/utils";
 var USAGE = [
   "Usage:",
   "  wstack typesafe [status]                 show account and feature configuration",
+  "  wstack typesafe on|off                   enable/disable all Jev requests (keeps key)",
   "  wstack typesafe login [--route <id>]     store an API key in the active profile",
   "      [--endpoint <url>] [--model <id>]    configure a proxy or pin a model",
   "  wstack typesafe test                     send one question and report the answer",
@@ -58,6 +59,18 @@ var typesafeCmd = async (args, deps) => {
   }
   const sub = (args[0] ?? "status").toLowerCase();
   switch (sub) {
+    case "on":
+    case "off": {
+      const configPath = activeProfileConfigPath(deps.paths, deps.config);
+      await mutateConfigProviders(configPath, deps.vault, (_providers, config) => {
+        config["typesafe"] = {
+          ...config["typesafe"],
+          enabled: sub === "on"
+        };
+      });
+      write(`Jev ${sub === "on" ? "enabled" : "disabled"}. Saved in ${configPath}.`);
+      return 0;
+    }
     case "status":
       return showStatus(deps, write);
     case "login":
@@ -67,9 +80,9 @@ var typesafeCmd = async (args, deps) => {
     case "lint-conventions":
       return await lintConventions(deps, write);
     case "replay-topic-shift":
-      return await (await import("./typesafe-topic-replay-ZILIU3WS.js")).replayTopicShift(deps, write);
+      return await (await import("./typesafe-topic-replay-DB2AYL7V.js")).replayTopicShift(deps, write);
     case "replay-memory-triage":
-      return await (await import("./typesafe-triage-replay-FGAW7QM7.js")).replayMemoryTriage(deps, write);
+      return await (await import("./typesafe-triage-replay-27NDAZ3V.js")).replayMemoryTriage(deps, write);
     case "replay-brain-ledger":
       return await (await import("./typesafe-brain-replay-C5276FVR.js")).replayBrainLedger(deps, write);
     case "check-judgments":
@@ -108,7 +121,9 @@ function showStatus(deps, write) {
   }
   write("");
   write(
-    color.bold("Judgments") + color.dim("  (on with an account; typesafe.judgments.<id>: false turns one off)")
+    color.bold("Judgments") + color.dim(
+      "  (requires typesafe.enabled: true; typesafe.judgments.<id>: false turns one off)"
+    )
   );
   for (const feature of TYPESAFE_JUDGMENT_FEATURES) {
     const on = isTypeSafeJudgmentEnabled(deps.config, feature);
@@ -127,7 +142,7 @@ function showStatus(deps, write) {
       );
     }
   }
-  if (account.status !== "ready" && features.length > 0) {
+  if (account.status !== "ready" && account.status !== "disabled" && features.length > 0) {
     write("");
     write(`  ${color.amber("Run `wstack typesafe login` \u2014 these switches do nothing today.")}`);
     return 1;
@@ -167,7 +182,10 @@ async function login(deps, write) {
     return next;
   };
   const settings = update(deps.config.typesafe ?? {});
-  const preview = resolveTypeSafeAccount({ config: { typesafe: settings }, env: {} });
+  const preview = resolveTypeSafeAccount({
+    config: { typesafe: { ...settings, enabled: true } },
+    env: {}
+  });
   if (preview.status === "unusable") {
     write(`${preview.reason}. For a custom route, pass --endpoint <url>.`);
     return 1;
@@ -186,6 +204,7 @@ async function login(deps, write) {
     config["typesafe"] = { ...update(existing), apiKey: key.trim() };
   });
   write(`${color.green("\u2713")} Key stored in ${configPath}`);
+  write("  Storing a key does not enable Jev. Use `wstack typesafe on` when you want it.");
   if (route) write(`  route set to ${route}`);
   write(`  Verify it with ${color.bold("wstack typesafe test")}.`);
   return 0;
@@ -194,7 +213,7 @@ async function test(deps, write) {
   const account = resolveTypeSafeAccount({ config: deps.config, restGate: null });
   if (account.status !== "ready") {
     write(`${color.red("\u2717")} ${account.reason}`);
-    write("  Run `wstack typesafe login`.");
+    if (account.status !== "disabled") write("  Run `wstack typesafe login`.");
     return 1;
   }
   write(`Asking ${account.endpoint} (${account.model})\u2026`);
@@ -321,4 +340,4 @@ async function lintConventions(deps, write) {
 export {
   typesafeCmd
 };
-//# sourceMappingURL=typesafe-WA5O3KVS.js.map
+//# sourceMappingURL=typesafe-NHC322W5.js.map