@wrongstack/cli 1.0.28 → 1.0.32

package/dist/{chunk-2ERX3RPN.js → chunk-P3GRLV47.js}

@@ -12,14 +12,14 @@ import {
   nowIso,
   resolveActiveApiKey,
   writeKeysBack
-} from "./chunk-LUMETJFO.js";
-import {
-  openBrowser
-} from "./chunk-DAKVBMD4.js";
+} from "./chunk-ZYACRPLN.js";
 import {
   appendHistory,
   backupCurrent
-} from "./chunk-WSTVGC2C.js";
+} from "./chunk-4BX2YDTQ.js";
+import {
+  openBrowser
+} from "./chunk-DAKVBMD4.js";
 
 // src/auth-menu/auth-menu-audit.ts
 import { appendFileSync } from "node:fs";
@@ -177,6 +177,16 @@ import {
   applyProviderAuthOutcome,
   createBuiltinProviderAuthRegistry
 } from "@wrongstack/providers/oauth";
+
+// src/auth-menu/helpers.ts
+async function loadProviders(deps) {
+  return loadConfigProviders(deps.profileConfigPath, deps.vault, {
+    warn: (msg) => deps.renderer.writeWarning(msg),
+    profileConfigPath: deps.profileConfigPath
+  });
+}
+
+// src/auth-menu/provider-auth-login.ts
 var defaultRegistry;
 function providerAuthRegistryFor(deps) {
   if (deps.providerAuthRegistry) return deps.providerAuthRegistry;
@@ -223,9 +233,11 @@ async function runProviderAuthLogin(deps, strategyId, opts = {}) {
   Sign in with ${strategy.label}`) + color.dim(` \u2192 ${opts.providerId ?? strategy.providerId}
 `)
     );
+    const saved = strategy.id === "chatgpt-api" ? (await loadProviders(deps))[opts.providerId ?? strategy.providerId] : void 0;
+    const credential = saved?.apiKeys?.find((key) => key.label === saved.activeKey) ?? saved?.apiKeys?.[0];
     session = await registry.begin(
       strategy.id,
-      { modelsRegistry: deps.modelsRegistry },
+      { modelsRegistry: deps.modelsRegistry, ...credential ? { credential } : {} },
       controller.signal
     );
     let outcome;
@@ -293,18 +305,18 @@ import { color as color3 } from "@wrongstack/core/utils";
 import { authProfileAliasError } from "@wrongstack/providers";
 import { probeLocalLlm } from "@wrongstack/runtime/probe";
 
-// src/auth-menu/helpers.ts
-async function loadProviders(deps) {
-  return loadConfigProviders(deps.profileConfigPath, deps.vault, {
-    warn: (msg) => deps.renderer.writeWarning(msg),
-    profileConfigPath: deps.profileConfigPath
-  });
-}
-
 // src/auth-menu/local-presets.ts
 import { projectLocalProviderPresets } from "@wrongstack/providers/definitions";
 var LOCAL_LLM_PRESETS = projectLocalProviderPresets();
 
+// src/auth-menu/index-input.ts
+function parseAuthMenuIndex(raw) {
+  const value = raw.trim();
+  if (!/^\d+$/.test(value)) return void 0;
+  const index = Number(value);
+  return Number.isSafeInteger(index) && index > 0 ? index : void 0;
+}
+
 // src/auth-menu/shared.ts
 import { color as color2 } from "@wrongstack/core/utils";
 function renderProviderLine(renderer, id, cfg, idx) {
@@ -726,8 +738,8 @@ ${color3.bold("Local LLM servers")} ${color3.dim("\u2014 pick one to pre-fill th
 ${color3.amber("?")} Pick ${color3.dim(`(1-${LOCAL_LLM_PRESETS.length}, q to quit)`)}: `
   )).trim().toLowerCase();
   if (!answer || answer === "q" || answer === "quit") return void 0;
-  const num = Number.parseInt(answer, 10);
-  if (!Number.isNaN(num) && num >= 1 && num <= LOCAL_LLM_PRESETS.length) {
+  const num = parseAuthMenuIndex(answer);
+  if (num !== void 0 && num <= LOCAL_LLM_PRESETS.length) {
     return LOCAL_LLM_PRESETS[num - 1];
   }
   const byId = LOCAL_LLM_PRESETS.find((p) => p.id === answer);
@@ -1926,6 +1938,7 @@ export {
   providerAuthStrategiesFor,
   runProviderAuthLogin,
   LOCAL_LLM_PRESETS,
+  parseAuthMenuIndex,
   runAuthLocal,
   resolveOAuthKind,
   runOAuthLoginKind,
@@ -1944,4 +1957,4 @@ export {
   addCustomProvider,
   addKeyForProvider
 };
-//# sourceMappingURL=chunk-2ERX3RPN.js.map
+//# sourceMappingURL=chunk-P3GRLV47.js.map

package/dist/{chunk-ZMX5HRLI.js → chunk-P3Q3KMFH.js}

@@ -33,14 +33,16 @@ function boolFlag(flags, names) {
 }
 function parsePositiveInteger(value, label) {
   if (value === void 0) throw new Error(`${label} is required`);
-  const parsed = Number.parseInt(value, 10);
-  if (!Number.isInteger(parsed) || parsed <= 0)
+  const trimmed = value.trim();
+  const parsed = /^\d+$/.test(trimmed) ? Number(trimmed) : Number.NaN;
+  if (!Number.isSafeInteger(parsed) || parsed <= 0)
     throw new Error(`${label} must be a positive integer`);
   return parsed;
 }
 function parsePort(value) {
   if (value === void 0) return void 0;
-  const parsed = Number.parseInt(value, 10);
+  const trimmed = value.trim();
+  const parsed = /^\d+$/.test(trimmed) ? Number(trimmed) : Number.NaN;
   if (!Number.isInteger(parsed) || parsed <= 0 || parsed > 65535) {
     throw new Error("--port must be a port between 1 and 65535");
   }
@@ -125,4 +127,4 @@ export {
   writeWebuiSessionChildReady,
   writeWebuiSessionChildError
 };
-//# sourceMappingURL=chunk-ZMX5HRLI.js.map
+//# sourceMappingURL=chunk-P3Q3KMFH.js.map

package/dist/{chunk-KOEO4CJG.js → chunk-PGNERAZL.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-U3SS4NRH.js";
 import {
   checkForUpdate
-} from "./chunk-RZ4ZDRYA.js";
+} from "./chunk-DIOODAYM.js";
 
 // src/subcommands/handlers/update.ts
 import { spawn } from "node:child_process";
@@ -80,8 +80,8 @@ async function runUpdateCommand(args, deps) {
   }
   if (isStandaloneBinary()) {
     const [{ updateStandaloneBinary }, { standaloneUpdater }, { STANDALONE_TARGET }] = await Promise.all([
-      import("./standalone-update-LZO3MNLH.js"),
-      import("./standalone-auto-update-TOTRGCSA.js"),
+      import("./standalone-update-HZHDZZOR.js"),
+      import("./standalone-auto-update-VQC4GYCM.js"),
       import("./version-JB2UAV2A.js")
     ]);
     const updater = standaloneUpdater({
@@ -406,4 +406,4 @@ export {
   detectUpdatePackageManager,
   detectUpdatePackageName
 };
-//# sourceMappingURL=chunk-KOEO4CJG.js.map
+//# sourceMappingURL=chunk-PGNERAZL.js.map

package/dist/{chunk-ENRYW73H.js → chunk-RQ4UBKYH.js}

@@ -1689,7 +1689,7 @@ import { WebSocket } from "ws";
 var HQ_SNAPSHOT_BROADCAST_DEBOUNCE_MS = 100;
 var HQ_SNAPSHOT_PERSIST_MIN_INTERVAL_MS = 3e3;
 var HQ_BROWSER_MAX_BUFFERED_BYTES = 32 * 1024 * 1024;
-function sendGuarded(ws, data) {
+function sendGuarded(ws, data, callback) {
   if (ws.readyState !== WebSocket.OPEN) return false;
   const buffered = Number.isFinite(ws.bufferedAmount) ? ws.bufferedAmount : 0;
   if (buffered + Buffer.byteLength(data, "utf8") > HQ_BROWSER_MAX_BUFFERED_BYTES) {
@@ -1704,7 +1704,8 @@ function sendGuarded(ws, data) {
     return false;
   }
   try {
-    ws.send(data);
+    if (callback) ws.send(data, callback);
+    else ws.send(data);
     return true;
   } catch {
     return false;
@@ -2888,8 +2889,8 @@ async function handleApiAgentMessages(req, res, match, agentMessages) {
 // src/hq-server/routes/system-handlers.ts
 async function handleApiSystemUpdate(res) {
   const [{ checkForUpdate }, { detectUpdatePackageName }] = await Promise.all([
-    import("./update-check-J5ZVKS73.js"),
-    import("./update-TDZX4IL2.js")
+    import("./update-check-VLVT4IV2.js"),
+    import("./update-J5WHAFPE.js")
   ]);
   const packageName = detectUpdatePackageName();
   const info = await checkForUpdate({ packageName });
@@ -3770,7 +3771,8 @@ function createHqServerShutdown(params) {
         params.persistence.eventLog.drain(),
         params.persistence.snapshotStore.drain(),
         params.persistence.timeseries.drain(),
-        params.persistence.kanban.drain()
+        params.persistence.kanban.drain(),
+        params.persistence.sage?.drain()
       ]).then(() => clearHqRuntimeMarker(params.dataDir, params.hqUrl)).catch(() => void 0).finally(() => res());
     });
   });
@@ -3849,16 +3851,56 @@ import {
   tightenHqRedactionPolicy as tightenHqRedactionPolicy2,
   tokenHasCapability as tokenHasCapability3
 } from "@wrongstack/core/hq";
+import { toErrorMessage as toErrorMessage2 } from "@wrongstack/core/utils";
 import { WebSocket as WebSocket3 } from "ws";
 
+// src/hq-server/sage-sync-send.ts
+import { chunkHqSageRecords } from "@wrongstack/core/hq";
+async function sendSageSnapshot(ws, snapshot) {
+  for (const part of chunkHqSageRecords(snapshot.projectId, snapshot.records)) {
+    const delivered = await new Promise((resolve) => {
+      let settled = false;
+      const finish = (ok) => {
+        if (settled) return;
+        settled = true;
+        clearTimeout(timer);
+        ws.removeListener("close", onClose);
+        resolve(ok);
+      };
+      const onClose = () => finish(false);
+      const timer = setTimeout(() => {
+        finish(false);
+        try {
+          ws.terminate();
+        } catch {
+        }
+      }, 1e4);
+      timer.unref?.();
+      ws.once("close", onClose);
+      const accepted = sendGuarded(
+        ws,
+        JSON.stringify({ type: "hq.sage_snapshot", payload: part }),
+        (error) => finish(!error)
+      );
+      if (!accepted) finish(false);
+    });
+    if (!delivered) return false;
+  }
+  return true;
+}
+
 // src/hq-server/ws-client-events.ts
 import {
+  chunkHqSageRecords as chunkHqSageRecords2,
   HQ_TRANSCRIPT_TEXT_CAP,
+  isHqSageSnapshotPayload,
+  MAX_HQ_SAGE_RECORD_BYTES,
   parseHqEventPayload,
   redactHqEvent,
   tightenHqRedactionPolicy,
   tokenHasCapability as tokenHasCapability2
 } from "@wrongstack/core/hq";
+import { toErrorMessage } from "@wrongstack/core/utils";
 function fanoutKanbanDelta(message, clients, _browsers, projectId) {
   let clientsNotified = 0;
   for (const peer of clients.values()) {
@@ -3908,12 +3950,33 @@ function handleIncomingClientEvent(ws, incomingEvent, clients, browsers, auth, s
       // Chat-transcript events carry full turns — the generic 500-char
       // summary cap would truncate them a second time after the
       // publisher already applied the transcript cap.
-      ...incomingEvent.type === "session.transcript" || incomingEvent.type === "agent.message" ? { maxSummaryLength: HQ_TRANSCRIPT_TEXT_CAP } : {}
+      ...incomingEvent.type === "sage.snapshot" ? { maxSummaryLength: MAX_HQ_SAGE_RECORD_BYTES } : incomingEvent.type === "session.transcript" || incomingEvent.type === "agent.message" ? { maxSummaryLength: HQ_TRANSCRIPT_TEXT_CAP } : {}
     }
   ).value;
   if (event.type === "client.heartbeat") {
     return;
   }
+  if (event.type === "sage.snapshot") {
+    const payload = event.payload;
+    if (!isHqSageSnapshotPayload(payload) || payload.projectId !== client.projectId || !persistence?.sage)
+      return;
+    void persistence.sage.merge(payload).then((merged) => {
+      for (const part of chunkHqSageRecords2(client.projectId, merged.records)) {
+        fanoutKanbanDelta(
+          JSON.stringify({ type: "hq.sage_snapshot", payload: part }),
+          clients,
+          browsers,
+          client.projectId
+        );
+      }
+    }).catch(
+      (error) => process.stderr.write(
+        `${JSON.stringify({ level: "warn", event: "hq.sage_sync_failed", projectId: client.projectId, message: toErrorMessage(error) })}
+`
+      )
+    );
+    return;
+  }
   if (event.type === "kanban.snapshot") {
     const payload = event.payload;
     if (payload.projectId !== client.projectId || persistence === void 0) return;
@@ -3934,7 +3997,7 @@ function handleIncomingClientEvent(ws, incomingEvent, clients, browsers, auth, s
         JSON.stringify({
           level: "warn",
           event: "hq.kanban_merge_failed",
-          message: error instanceof Error ? error.message : String(error),
+          message: toErrorMessage(error),
           timestamp: (/* @__PURE__ */ new Date()).toISOString()
         })
       );
@@ -4343,7 +4406,7 @@ function handleBrowser(ws, snapshotBroadcaster, browsers, eventLog) {
       JSON.stringify({
         level: "warn",
         event: "hq.browser_socket_error",
-        message: err instanceof Error ? err.message : String(err),
+        message: toErrorMessage2(err),
         timestamp: (/* @__PURE__ */ new Date()).toISOString()
       })
     );
@@ -4424,7 +4487,7 @@ function handleClient(ws, clients, browsers, eventLog, auth, snapshotBroadcaster
       JSON.stringify({
         level: "warn",
         event: "hq.client_socket_error",
-        message: err instanceof Error ? err.message : String(err),
+        message: toErrorMessage2(err),
         timestamp: (/* @__PURE__ */ new Date()).toISOString()
       })
     );
@@ -4525,6 +4588,14 @@ function handleClient(ws, clients, browsers, eventLog, auth, snapshotBroadcaster
           sendGuarded(ws, JSON.stringify({ type: "hq.kanban_snapshot", payload: p }));
         }).catch(() => void 0);
       }
+      if (persistence?.sage !== void 0) {
+        void persistence.sage.load(client.projectId).then((snapshot) => sendSageSnapshot(ws, snapshot)).catch(
+          (error) => process.stderr.write(
+            `${JSON.stringify({ level: "warn", event: "hq.sage_restore_failed", projectId: client.projectId, message: toErrorMessage2(error) })}
+`
+          )
+        );
+      }
       const event = redactHqEvent2(
         {
           id: randomUUID5(),
@@ -5296,4 +5367,4 @@ export {
   startHqServer,
   HqInsecureExposureError2 as HqInsecureExposureError
 };
-//# sourceMappingURL=chunk-ENRYW73H.js.map
+//# sourceMappingURL=chunk-RQ4UBKYH.js.map

package/dist/{chunk-X756ZS72.js → chunk-SUDNPYWD.js}

@@ -66,7 +66,7 @@ async function downloadReleaseAssetToFile(url, file, options) {
             throw new Error(`download ${url} is too large`);
           }
           hash.update(value);
-          await out.write(value);
+          await out.writeFile(value);
         }
       } finally {
         reader.releaseLock();
@@ -326,4 +326,4 @@ export {
   installExecutableFrom,
   updateStandaloneBinary
 };
-//# sourceMappingURL=chunk-X756ZS72.js.map
+//# sourceMappingURL=chunk-SUDNPYWD.js.map

package/dist/{chunk-LDCGZJTC.js → chunk-TWSQTQKR.js}

@@ -1,6 +1,6 @@
 import {
   mutateConfigProviders
-} from "./chunk-LUMETJFO.js";
+} from "./chunk-ZYACRPLN.js";
 import {
   activeProfileConfigPath
 } from "./chunk-YMXXOOFN.js";
@@ -8,13 +8,22 @@ import {
 // src/wiring/provider-persisters.ts
 import {
   applyProviderOAuthRefresh,
+  createSubscriptionRefreshTransaction,
   matchesActiveProviderCredential,
+  setAccountQuotaReporting,
   setOAuthTokenPersister,
-  setProviderModelPersister
+  setProviderModelPersister,
+  setSubscriptionRefreshTransaction
 } from "@wrongstack/providers";
 import { applyProviderOAuthRefresh as applyProviderOAuthRefresh2 } from "@wrongstack/providers";
 function installProviderPersisters(args) {
   const profileConfigPath = activeProfileConfigPath(args.paths, args.config);
+  setAccountQuotaReporting(true);
+  setSubscriptionRefreshTransaction(
+    createSubscriptionRefreshTransaction(
+      (mutator) => mutateConfigProviders(profileConfigPath, args.vault, mutator)
+    )
+  );
   setOAuthTokenPersister((providerId, creds, source) => {
     void mutateConfigProviders(profileConfigPath, args.vault, (all) => {
       const p = all[providerId];
@@ -27,7 +36,6 @@ function installProviderPersisters(args) {
     );
   });
   setProviderModelPersister((providerId, models, source) => {
-    if (models.length === 0) return;
     void mutateConfigProviders(profileConfigPath, args.vault, (all) => {
       const p = all[providerId];
       if (!p) return;
@@ -43,4 +51,4 @@ export {
   installProviderPersisters,
   applyProviderOAuthRefresh2 as applyProviderOAuthRefresh
 };
-//# sourceMappingURL=chunk-LDCGZJTC.js.map
+//# sourceMappingURL=chunk-TWSQTQKR.js.map

package/dist/chunk-TXAFIERF.js

@@ -0,0 +1,37 @@
+import {
+  loadConfigProviders,
+  mutateConfigProviders
+} from "./chunk-ZYACRPLN.js";
+
+// src/provider-cloud-config.ts
+import {
+  cloudFieldsForProvider,
+  parseNativeCloudSettings
+} from "@wrongstack/core/cloud-provider";
+async function providerCloudConfig(id, updates, configPath, vault) {
+  if (!/^[\w.-]{1,128}$/.test(id) || ["__proto__", "constructor", "prototype"].includes(id))
+    throw new Error("Invalid provider id");
+  if (updates === void 0) {
+    const providers = await loadConfigProviders(configPath, vault);
+    if (!Object.hasOwn(providers, id)) throw new Error("Saved provider not found");
+    return parseNativeCloudSettings(providers[id]?.cloud ?? {});
+  }
+  let saved = {};
+  await mutateConfigProviders(configPath, vault, (providers) => {
+    if (!Object.hasOwn(providers, id)) throw new Error("Saved provider not found");
+    const provider = providers[id];
+    const fields = cloudFieldsForProvider(provider.type || id);
+    if (!fields.length) throw new Error("This provider has no native cloud routing settings");
+    const parsed = updates === null ? {} : parseNativeCloudSettings(updates);
+    if (Object.keys(parsed).some((field) => !fields.includes(field)))
+      throw new Error("Cloud setting does not apply to this provider");
+    saved = updates === null ? {} : parseNativeCloudSettings({ ...provider.cloud, ...updates });
+    provider.cloud = saved;
+  });
+  return saved;
+}
+
+export {
+  providerCloudConfig
+};
+//# sourceMappingURL=chunk-TXAFIERF.js.map

package/dist/{chunk-UZ2TMHNH.js → chunk-UKP7H2U4.js}

@@ -8,6 +8,7 @@ var TTL_UNIT_MS = {
   d: 864e5,
   w: 6048e5
 };
+var MAX_SAFE_TTL_MS = 864e13;
 function parseTokenTtlValue(raw) {
   const trimmed = raw.trim();
   if (trimmed.length === 0) {
@@ -18,6 +19,9 @@ function parseTokenTtlValue(raw) {
     if (!Number.isFinite(ms) || ms <= 0) {
       return { error: `TTL value must be positive (got ${raw})` };
     }
+    if (!Number.isSafeInteger(ms) || ms > MAX_SAFE_TTL_MS) {
+      return { error: `TTL value exceeds maximum safe duration (got ${raw})` };
+    }
     return { value: ms };
   }
   const match = /^(?<value>\d+)(?<unit>ms|s|m|h|d|w)$/i.exec(trimmed);
@@ -28,7 +32,11 @@ function parseTokenTtlValue(raw) {
     if (!Number.isFinite(value) || value <= 0 || multiplier === void 0) {
       return { error: `TTL value must be positive with a valid unit (got ${raw})` };
     }
-    return { value: value * multiplier };
+    const totalMs = value * multiplier;
+    if (!Number.isSafeInteger(value) || !Number.isSafeInteger(totalMs) || totalMs > MAX_SAFE_TTL_MS) {
+      return { error: `TTL value exceeds maximum safe duration (got ${raw})` };
+    }
+    return { value: totalMs };
   }
   return {
     error: `TTL must be a positive integer (milliseconds) or <number><unit> where unit is one of ms, s, m, h, d, w (got ${raw})`
@@ -38,4 +46,4 @@ function parseTokenTtlValue(raw) {
 export {
   parseTokenTtlValue
 };
-//# sourceMappingURL=chunk-UZ2TMHNH.js.map
+//# sourceMappingURL=chunk-UKP7H2U4.js.map

package/dist/{chunk-5JYDKG5B.js → chunk-WHEYHDIE.js}

@@ -56,6 +56,11 @@ var helpCmd = async (_args, deps) => {
       ["wstack config-export | config-import", "Move behaviour settings via ./wstack-config.json"],
       ["wstack mcp", "MCP servers: list, add, remove, serve"],
       ["wstack import-claude-code", "Import MCP servers from Claude Code (preview; --apply)"],
+      [
+        "wstack sage connect",
+        "SAGE memory in Claude Code, Codex, Cursor, Antigravity (MCP + skill)"
+      ],
+      ["wstack sage sync", "Keep project SAGE memory synchronized through HQ"],
       ["wstack plugin", "Plugins: list, install, enable, disable, remove"],
       ["wstack tools | skills", "List registered tools / discovered skills"],
       ["wstack typesafe", "TypeSafe account: status, login, test"],
@@ -78,7 +83,7 @@ var helpCmd = async (_args, deps) => {
       ["--provider <id> --model <id>", "Provider and model for this run"],
       ["--fallback-model <a,b,...>", "Models to fall back to when the primary is unavailable"],
       ["--effort <level>", "Reasoning effort: none|minimal|low|medium|high|xhigh|max"],
-      ["--system-prompt lite|pro|default", "Bundled system-prompt variant"],
+      ["--system-prompt lite|pro|scout|default", "Bundled system-prompt variant"],
       [
         "--append-system-prompt <text> | --append-system-prompt-file <path>",
         "Add instructions to the host agent prompt for this run"
@@ -151,4 +156,4 @@ export {
   versionCmd,
   helpCmd
 };
-//# sourceMappingURL=chunk-5JYDKG5B.js.map
+//# sourceMappingURL=chunk-WHEYHDIE.js.map

package/dist/{chunk-LBPLTTZ6.js → chunk-WTJDSTYD.js}

@@ -23,8 +23,8 @@ var APPLIED_FMT = `
 `;
 async function printStandaloneUpdateNotice(info, config) {
   const [{ autoUpdateEnabled, standaloneUpdater, takeAppliedUpdate }, { isNewer }, version] = await Promise.all([
-    import("./standalone-auto-update-TOTRGCSA.js"),
-    import("./update-check-J5ZVKS73.js"),
+    import("./standalone-auto-update-VQC4GYCM.js"),
+    import("./update-check-VLVT4IV2.js"),
     import("./version-JB2UAV2A.js")
   ]);
   const applied = takeAppliedUpdate();
@@ -47,7 +47,7 @@ async function printUpdateNotice(initialUpdateInfo, config) {
     const ac = new AbortController();
     const timer = setTimeout(() => ac.abort(), 2e3);
     try {
-      const { checkForUpdate } = await import("./update-check-J5ZVKS73.js");
+      const { checkForUpdate } = await import("./update-check-VLVT4IV2.js");
       info = await checkForUpdate(ac.signal);
     } catch {
     } finally {
@@ -102,4 +102,4 @@ export {
   applySessionShellDefault,
   runPreflight
 };
-//# sourceMappingURL=chunk-LBPLTTZ6.js.map
+//# sourceMappingURL=chunk-WTJDSTYD.js.map

package/dist/{chunk-L5TD7UIG.js → chunk-WXJH4F6K.js}

@@ -1,10 +1,10 @@
+import {
+  parseArgs
+} from "./chunk-MPQCHBDJ.js";
 import {
   helpCmd,
   versionCmd
-} from "./chunk-5JYDKG5B.js";
-import {
-  parseArgs
-} from "./chunk-Q4INH2DG.js";
+} from "./chunk-WHEYHDIE.js";
 
 // src/boot/short-circuit-flags.ts
 async function handleHelpVersionShortCircuit(argv) {
@@ -22,11 +22,11 @@ async function handleHelpVersionShortCircuit(argv) {
   }
   if (earlyFlags["help"] === true) {
     if (positional.length > 0) {
-      const { subcommandNames } = await import("./subcommands-SRRB3RAS.js");
+      const { subcommandNames } = await import("./subcommands-QO7VYTSS.js");
       if (subcommandNames.includes(positional[0])) {
         const first = positional[0];
         const deep = positional[1];
-        const { renderDeepHelp, renderFocusedHelp } = await import("./per-subcommand-help-QDAQASPZ.js");
+        const { renderDeepHelp, renderFocusedHelp } = await import("./per-subcommand-help-VKPV3OEY.js");
         if (deep && renderDeepHelp(`${first}:${deep}`, stubRenderer)) {
           return 0;
         }
@@ -43,4 +43,4 @@ async function handleHelpVersionShortCircuit(argv) {
 export {
   handleHelpVersionShortCircuit
 };
-//# sourceMappingURL=chunk-L5TD7UIG.js.map
+//# sourceMappingURL=chunk-WXJH4F6K.js.map

package/dist/{chunk-IS2PPBQV.js → chunk-X4LW5CZM.js}

@@ -4,7 +4,12 @@ import { createHash } from "node:crypto";
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
 import { ConfigError } from "@wrongstack/core/types";
-import { readProjectIdentity, withFileLock, wstackGlobalRoot } from "@wrongstack/core/utils";
+import {
+  atomicWrite,
+  readProjectIdentity,
+  withFileLock,
+  wstackGlobalRoot
+} from "@wrongstack/core/utils";
 function projectsJsonPath(globalConfigPath) {
   const base = globalConfigPath ? path.dirname(globalConfigPath) : wstackGlobalRoot();
   return path.join(base, "projects.json");
@@ -44,8 +49,7 @@ async function loadManifest(globalConfigPath) {
 }
 async function saveManifest(manifest, globalConfigPath) {
   const file = projectsJsonPath(globalConfigPath);
-  await fs.mkdir(path.dirname(file), { recursive: true });
-  await fs.writeFile(file, JSON.stringify(manifest, null, 2), "utf8");
+  await atomicWrite(file, JSON.stringify(manifest, null, 2), { encoding: "utf8" });
 }
 function generateSlug(root) {
   const base = path.basename(root).toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 40) || "project";
@@ -116,4 +120,4 @@ export {
   ensureProjectDataDir,
   touchProjectInManifest
 };
-//# sourceMappingURL=chunk-IS2PPBQV.js.map
+//# sourceMappingURL=chunk-X4LW5CZM.js.map

package/dist/{chunk-BBHWW6LR.js → chunk-YL4KCHZG.js}

@@ -83,7 +83,10 @@ var MODEL_PROFILES = [
 ];
 function fmtTokens(n) {
   if (n >= 1e6) return `${(n / 1e6).toFixed(1)}M`;
-  if (n >= 1e3) return `${(n / 1e3).toFixed(1)}k`;
+  if (n >= 1e3) {
+    const k = (n / 1e3).toFixed(1);
+    return Number(k) < 1e3 ? `${k}k` : `${(n / 1e6).toFixed(1)}M`;
+  }
   return String(n);
 }
 function fmtMs(ms) {
@@ -322,7 +325,16 @@ async function runModeldiagEval(args, deps, providers, config, hasKey) {
   const providerFilter = providersValue ? providersValue.split(",").map((s) => s.trim()).filter(Boolean) : void 0;
   const maxEq = evalArgs.find((a) => a.startsWith("--max="));
   const maxValue = maxEq?.replace("--max=", "") ?? (typeof deps.flags?.["max"] === "string" ? deps.flags["max"] : void 0);
-  const maxModels = maxValue ? Math.max(1, parseInt(maxValue, 10) || 2) : 2;
+  let maxModels = 2;
+  if (maxValue !== void 0) {
+    const rawMax = maxValue.trim();
+    const parsedMax = /^\d+$/.test(rawMax) ? Number(rawMax) : Number.NaN;
+    if (!Number.isSafeInteger(parsedMax) || parsedMax < 1) {
+      writeLine(`${color2.amber(`Invalid --max value "${maxValue}". Use a positive integer.`)}`);
+      return 1;
+    }
+    maxModels = parsedMax;
+  }
   const quick = evalArgs.includes("--quick") || deps.flags?.["quick"] === true || deps.flags?.["quick"] === "true";
   const modelsPerCat = quick ? 1 : maxModels;
   const roleFilter = evalArgs.find((a) => !a.startsWith("--"));
@@ -369,9 +381,9 @@ ${color2.dim('Enter numbers or provider IDs (comma-separated, or "all"):')}
     } else {
       targetProviderIds = [];
       for (const part of selected.split(",").map((s) => s.trim())) {
-        const idx = parseInt(part, 10);
-        if (idx >= 1 && idx <= keyedProviderIds.length) {
-          const pid = keyedProviderIds[idx - 1];
+        const index = /^\d+$/.test(part) ? Number(part) : Number.NaN;
+        if (Number.isSafeInteger(index) && index >= 1 && index <= keyedProviderIds.length) {
+          const pid = keyedProviderIds[index - 1];
           if (!targetProviderIds.includes(pid)) targetProviderIds.push(pid);
         } else if (keyedProviderIds.includes(part)) {
           if (!targetProviderIds.includes(part)) targetProviderIds.push(part);
@@ -546,4 +558,4 @@ export {
   createProviderForId,
   runModeldiagEval
 };
-//# sourceMappingURL=chunk-BBHWW6LR.js.map
+//# sourceMappingURL=chunk-YL4KCHZG.js.map

package/dist/{chunk-LUMETJFO.js → chunk-ZYACRPLN.js}

@@ -140,7 +140,7 @@ async function mutateConfigProviders(configPath, vault, mutator, profileConfigPa
         decrypted["model"],
         typeof decrypted["provider"] === "string" ? providers[decrypted["provider"]] : void 0
       ]);
-      mutator(providers, decrypted);
+      await mutator(providers, decrypted);
       for (const id of previousProviderIds) {
         if (!Object.hasOwn(providers, id)) removeProviderFallbackReferences(decrypted, id);
       }
@@ -168,4 +168,4 @@ export {
   mutateConfigProviders,
   nowIso
 };
-//# sourceMappingURL=chunk-LUMETJFO.js.map
+//# sourceMappingURL=chunk-ZYACRPLN.js.map