@wrongstack/cli 1.0.29 → 1.0.33

package/dist/{providers-models-5Z2PJTEW.js → providers-models-O75MKLN2.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-5UZBUV2H.js";
 import {
   mutateConfigProviders
-} from "./chunk-LUMETJFO.js";
+} from "./chunk-ZYACRPLN.js";
 import {
   activeProfileConfigPath
 } from "./chunk-YMXXOOFN.js";
@@ -243,12 +243,13 @@ ${navLines.join(" \xB7 ")}
 function aliasProviderId(configProviderId, cfg) {
   return cfg?.type && cfg.type !== configProviderId ? cfg.type : configProviderId;
 }
-async function discoverProviderModels(deps, ids) {
+async function discoverProviderModels(deps, ids, onlyProviderId) {
   if (!("mergeOverlay" in deps.modelsRegistry)) return void 0;
   try {
-    const { discoverAndMergeProviders } = await import("./auto-discover-providers-DXR25GTG.js");
+    const { discoverAndMergeProviders } = await import("./auto-discover-providers-JX346GOM.js");
+    const only = onlyProviderId ? deps.config.providers?.[onlyProviderId] : void 0;
     await discoverAndMergeProviders({
-      config: deps.config,
+      config: only ? { ...deps.config, providers: { [onlyProviderId]: only } } : deps.config,
       registry: deps.modelsRegistry,
       cacheDir: deps.paths.cacheDir
     });
@@ -263,6 +264,10 @@ async function discoverProviderModels(deps, ids) {
 }
 async function getCatalogProviderForConfigProvider(providerId, deps) {
   const cfg = deps.config.providers?.[providerId];
+  if (usesAccountCatalog(cfg)) {
+    const found = await discoverProviderModels(deps, [providerId], providerId);
+    if (found) return { providerId, provider: found };
+  }
   const lookupId = aliasProviderId(providerId, cfg);
   const provider = await deps.modelsRegistry.getProvider(lookupId);
   if (provider) return { providerId: lookupId, provider };
@@ -271,6 +276,10 @@ async function getCatalogProviderForConfigProvider(providerId, deps) {
     provider: await discoverProviderModels(deps, [lookupId, providerId])
   };
 }
+function usesAccountCatalog(cfg) {
+  const active = cfg?.apiKeys?.find((key) => key.label === cfg.activeKey) ?? cfg?.apiKeys?.[0];
+  return active?.authMethod === "oauth";
+}
 function uniqueStrings(values) {
   return [...new Set(values.map((v) => v.trim()).filter(Boolean))];
 }
@@ -312,10 +321,7 @@ async function modelsHide(args, deps) {
       p.models = nextVisible;
     }
   );
-  deps.config.providers = {
-    ...deps.config.providers ?? {},
-    [providerId]: { ...saved, models: nextVisible }
-  };
+  publishProviderConfig(deps, providerId, { ...saved, models: nextVisible });
   deps.renderer.writeInfo(
     `Hidden ${providerId}/${modelId}. Visible: ${nextVisible.length}, hidden: ${Math.max(0, knownIds.length - nextVisible.length)}.`
   );
@@ -365,10 +371,7 @@ async function modelsShow(args, deps) {
       p.models = nextVisible;
     }
   );
-  deps.config.providers = {
-    ...deps.config.providers ?? {},
-    [providerId]: { ...saved, models: nextVisible }
-  };
+  publishProviderConfig(deps, providerId, { ...saved, models: nextVisible });
   const isKnown = knownIds.includes(modelId);
   deps.renderer.writeInfo(
     `Visible ${providerId}/${modelId}${isKnown ? "" : " (not in current catalog)"}. Visible: ${nextVisible.length}.`
@@ -414,10 +417,40 @@ Restore: wstack models show ${providerId} <model> \xB7 reset ${providerId}
   );
   return 0;
 }
+function publishProviderConfig(deps, providerId, next) {
+  deps.config = {
+    ...deps.config,
+    providers: { ...deps.config.providers ?? {}, [providerId]: next }
+  };
+}
+async function modelsResetCustomModel(providerId, modelId, saved, deps) {
+  if (!saved.customModels || !Object.hasOwn(saved.customModels, modelId)) {
+    deps.renderer.writeInfo(`${providerId}/${modelId} has no custom definition; nothing to reset.`);
+    return 0;
+  }
+  await mutateConfigProviders(
+    activeProfileConfigPath(deps.paths, deps.config),
+    deps.vault,
+    (providers) => {
+      const p = providers[providerId];
+      if (!p?.customModels) return;
+      delete p.customModels[modelId];
+      if (Object.keys(p.customModels).length === 0) delete p.customModels;
+    }
+  );
+  const { [modelId]: _dropped, ...rest } = saved.customModels;
+  const next = { ...saved };
+  if (Object.keys(rest).length > 0) next.customModels = rest;
+  else delete next.customModels;
+  publishProviderConfig(deps, providerId, next);
+  deps.renderer.writeInfo(`Reset ${providerId}/${modelId} to the catalog definition.`);
+  return 0;
+}
 async function modelsReset(args, deps) {
   const providerId = args[0];
+  const modelId = args[1];
   if (!providerId) {
-    deps.renderer.writeError("Usage: wstack models reset <provider>");
+    deps.renderer.writeError("Usage: wstack models reset <provider> [model]");
     return 1;
   }
   const saved = deps.config.providers?.[providerId];
@@ -425,6 +458,7 @@ async function modelsReset(args, deps) {
     deps.renderer.writeError(`Provider "${providerId}" is not configured.`);
     return 1;
   }
+  if (modelId) return modelsResetCustomModel(providerId, modelId, saved, deps);
   if (saved.models === void 0) {
     deps.renderer.writeInfo(`${providerId} already shows the full catalog model list.`);
     return 0;
@@ -440,10 +474,7 @@ async function modelsReset(args, deps) {
   );
   const nextProvider = { ...saved };
   delete nextProvider.models;
-  deps.config.providers = {
-    ...deps.config.providers ?? {},
-    [providerId]: nextProvider
-  };
+  publishProviderConfig(deps, providerId, nextProvider);
   deps.renderer.writeInfo(
     `Reset visible model list for ${providerId} to the full catalog default.`
   );
@@ -457,6 +488,9 @@ async function modelsCaps(args, deps) {
     deps.renderer.write(color.dim("Defaults to current configured provider/model when omitted.\n"));
     return 1;
   }
+  if (usesAccountCatalog(deps.config.providers?.[providerId])) {
+    await discoverProviderModels(deps, [providerId], providerId);
+  }
   const resolved = await deps.modelsRegistry.getModel(providerId, modelId);
   if (!resolved) {
     deps.renderer.writeError("Model not found in catalog: " + providerId + "/" + modelId);
@@ -670,4 +704,4 @@ export {
   modelsCmd,
   providersCmd
 };
-//# sourceMappingURL=providers-models-5Z2PJTEW.js.map
+//# sourceMappingURL=providers-models-O75MKLN2.js.map

package/dist/{remote-GB5VXCCT.js → remote-C74BCNND.js}

@@ -1,16 +1,16 @@
+import {
+  openBrowser
+} from "./chunk-DAKVBMD4.js";
 import {
   MAX_BINARY_BYTES,
   downloadReleaseAssetToFile,
   findStandaloneRelease,
   verifyStandaloneDigest
-} from "./chunk-X756ZS72.js";
+} from "./chunk-SUDNPYWD.js";
 import {
   CLI_VERSION,
   STANDALONE_TARGET
 } from "./chunk-F5DCFAKI.js";
-import {
-  openBrowser
-} from "./chunk-DAKVBMD4.js";
 
 // src/subcommands/handlers/remote.ts
 import * as fsp2 from "node:fs/promises";
@@ -573,4 +573,4 @@ export {
   remoteCmd,
   runRemoteCommand
 };
-//# sourceMappingURL=remote-GB5VXCCT.js.map
+//# sourceMappingURL=remote-C74BCNND.js.map

package/dist/{rewind-JA3ZLCNM.js → rewind-7AULJS7F.js}

@@ -94,8 +94,9 @@ var rewindCmd = async (args, deps) => {
       deps.renderer.write("Rewinding to session start...\n");
       result = await rewind.rewindToStart(targetSessionId);
     } else if (flags.last) {
-      const n = Number.parseInt(flags.last, 10);
-      if (Number.isNaN(n) || n < 1) {
+      const raw = flags.last.trim();
+      const n = /^\d+$/.test(raw) ? Number(raw) : Number.NaN;
+      if (!Number.isSafeInteger(n) || n < 1) {
         deps.renderer.writeError("--last requires a positive number");
         return 1;
       }
@@ -104,8 +105,9 @@ var rewindCmd = async (args, deps) => {
 `);
       result = await rewind.rewindLastN(targetSessionId, n);
     } else if (flags.to) {
-      const idx = Number.parseInt(flags.to, 10);
-      if (Number.isNaN(idx) || idx < 0) {
+      const raw = flags.to.trim();
+      const idx = /^\d+$/.test(raw) ? Number(raw) : Number.NaN;
+      if (!Number.isSafeInteger(idx) || idx < 0) {
         deps.renderer.writeError("--to requires a non-negative number");
         return 1;
       }
@@ -185,4 +187,4 @@ ${result.errors.length} error(s):
 export {
   rewindCmd
 };
-//# sourceMappingURL=rewind-JA3ZLCNM.js.map
+//# sourceMappingURL=rewind-7AULJS7F.js.map

package/dist/sandbox-TYGD6FI2.js

@@ -0,0 +1,131 @@
+
+// src/subcommands/handlers/sandbox.ts
+import { mkdir } from "node:fs/promises";
+import * as path from "node:path";
+import { atomicWrite, toErrorMessage } from "@wrongstack/core/utils";
+import { createHeadlessLaunchPlan, runDockerWorkspace } from "@wrongstack/runtime";
+var sandboxCmd = (args, deps) => runSandboxCommand(args, deps.flags ?? {}, deps.renderer);
+var USAGE = `Usage: wstack sandbox docker --image <trusted-image> --prompt <task> [options]
+
+Runs the entire WrongStack agent in a copied Docker workspace. Your local project
+and home are not mounted. Returns a patch against the imported snapshot; nothing
+is automatically applied to your working tree.
+
+Build the supplied runtime image from a published version:
+  docker build --build-arg WRONGSTACK_VERSION=<version> -t wrongstack-sandbox containers/sandbox
+
+Options:
+  --image <image>        Required image with wstack, git and sh installed
+  --prompt <task>        Required task for the isolated agent
+  --provider <id>        Provider to use inside the container
+  --model <id>           Model to use inside the container
+  --env <NAME,...>       Explicit host env names to forward (no values on argv)
+  --network <bridge|none> Docker networking (default bridge)
+  --timeout <seconds>    Entire agent command limit (default 600)
+  --out <directory>      Patch and run metadata directory
+  --yolo                Enable YOLO inside this container only
+  --max-iterations <n>  Agent iteration limit (default 40, maximum 1000)
+  --dry-run             Validate and print a plan without starting Docker
+  --help                Show this help
+
+Binary/image previews and OAuth credential-file import are not part of this
+launcher. Use API credentials forwarded explicitly, or a separately configured
+trusted image. The default image and packages are never silently selected.
+`;
+async function runSandboxCommand(args, flags, renderer) {
+  if (flags["help"] || args[0] === "help") {
+    renderer.write(USAGE);
+    return 0;
+  }
+  const image = typeof flags["image"] === "string" ? flags["image"] : "";
+  const prompt = typeof flags["prompt"] === "string" ? flags["prompt"] : "";
+  if (args[0] !== "docker" || !image || !prompt) {
+    renderer.write(USAGE);
+    return 2;
+  }
+  const network = flags["network"] ?? "bridge";
+  if (network !== "bridge" && network !== "none") {
+    renderer.write("sandbox: network must be bridge or none\n");
+    return 2;
+  }
+  const timeoutMs = Number(flags["timeout"] ?? 600) * 1e3;
+  if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1e3 || timeoutMs > 864e5) {
+    renderer.write("sandbox: timeout must be 1 to 86400 seconds\n");
+    return 2;
+  }
+  const envNames = typeof flags["env"] === "string" ? flags["env"].split(",").map((name) => name.trim()).filter(Boolean) : [];
+  const abort = new AbortController();
+  const cancel = () => abort.abort();
+  process.once("SIGINT", cancel);
+  process.once("SIGTERM", cancel);
+  try {
+    const plan = createHeadlessLaunchPlan({
+      name: "sandbox",
+      projectRoot: process.cwd(),
+      image,
+      prompt,
+      provider: typeof flags["provider"] === "string" ? flags["provider"] : void 0,
+      model: typeof flags["model"] === "string" ? flags["model"] : void 0,
+      envNames,
+      yolo: flags["yolo"] === true,
+      enabled: true,
+      timeoutMs,
+      maxIterations: flags["max-iterations"] === void 0 ? 40 : Number(flags["max-iterations"])
+    });
+    if (flags["dry-run"] === true) {
+      renderer.write(
+        `${JSON.stringify({ ...plan, network, missingEnvironment: envNames.filter((name) => !process.env[name]) }, null, 2)}
+`
+      );
+      return 0;
+    }
+    const result = await runDockerWorkspace({
+      projectRoot: process.cwd(),
+      image,
+      command: "wstack",
+      args: plan.args,
+      envNames,
+      network,
+      timeoutMs,
+      signal: abort.signal,
+      onOutput: (text) => renderer.write(text)
+    });
+    const out = path.resolve(
+      typeof flags["out"] === "string" ? flags["out"] : path.join(process.cwd(), ".wrongstack", "sandbox-runs", result.id)
+    );
+    await mkdir(out, { recursive: true });
+    if (result.patch !== null) await atomicWrite(path.join(out, "changes.patch"), result.patch);
+    const { patch: _patch, output: _output, ...metadata } = result;
+    await atomicWrite(
+      path.join(out, "run.json"),
+      `${JSON.stringify({ ...metadata, image, projectRoot: process.cwd(), network }, null, 2)}
+`
+    );
+    renderer.write(
+      `
+Sandbox exit: ${result.exitCode}
+${result.patch !== null ? `Patch: ${path.join(out, "changes.patch")}
+` : `Partial workspace: wrongstack-${result.id}
+`}Metadata: ${path.join(out, "run.json")}
+`
+    );
+    if (result.cleanup === "retained")
+      renderer.write("Stopped container retained for recovery; no patch was claimed.\n");
+    if (result.cleanup === "unverified")
+      renderer.write(`Container cleanup could not be verified: wrongstack-${result.id}
+`);
+    return result.exitCode;
+  } catch (error) {
+    renderer.write(`sandbox: ${toErrorMessage(error)}
+`);
+    return abort.signal.aborted ? 130 : 1;
+  } finally {
+    process.removeListener("SIGINT", cancel);
+    process.removeListener("SIGTERM", cancel);
+  }
+}
+export {
+  runSandboxCommand,
+  sandboxCmd
+};
+//# sourceMappingURL=sandbox-TYGD6FI2.js.map

package/dist/services/sdd/project-context.d.ts

@@ -3,5 +3,5 @@ export { gatherProjectContext } from '@wrongstack/sdd';
 export declare function getActiveBuilder(): AISpecBuilder | null;
 export declare function getActiveSDDContext(): string | null;
 export declare function getActiveSDDPhase(): AISpecPhase | null;
-export declare function findSpec(store: SpecStore, idOrTitle: string): Promise<import("@wrongstack/core").Specification | null>;
+export declare function findSpec(store: SpecStore, idOrTitle: string): Promise<import("@wrongstack/core/types").Specification | null>;
 //# sourceMappingURL=project-context.d.ts.map

package/dist/{sessions-config-JGIZRNT6.js → sessions-config-VE26SB56.js}

@@ -1,16 +1,16 @@
 import {
   activeProfileConfigPath
 } from "./chunk-YMXXOOFN.js";
-import {
-  restoreFlags
-} from "./chunk-CSAPOCBP.js";
 import {
   backupCurrent,
   getHistoryEntry,
   listHistory,
   restoreFromHistory,
   restoreLast
-} from "./chunk-WSTVGC2C.js";
+} from "./chunk-4BX2YDTQ.js";
+import {
+  restoreFlags
+} from "./chunk-CSAPOCBP.js";
 
 // src/subcommands/handlers/sessions-config.ts
 import * as path2 from "node:path";
@@ -536,4 +536,4 @@ export {
   configCmd,
   sessionsCmd
 };
-//# sourceMappingURL=sessions-config-JGIZRNT6.js.map
+//# sourceMappingURL=sessions-config-VE26SB56.js.map

package/dist/short-circuit-flags-D6VAG47Y.js

@@ -0,0 +1,10 @@
+import {
+  handleHelpVersionShortCircuit
+} from "./chunk-SWOPJHXI.js";
+import "./chunk-MPQCHBDJ.js";
+import "./chunk-WHEYHDIE.js";
+import "./chunk-F5DCFAKI.js";
+export {
+  handleHelpVersionShortCircuit
+};
+//# sourceMappingURL=short-circuit-flags-D6VAG47Y.js.map

package/dist/slash-commands/openai-quota.d.ts

@@ -13,21 +13,27 @@
  * below reads only the neutral shape. A second metered provider needs a
  * reporter and a one-line command, not a second copy of this file.
  *
- * The reading is observational: it appears after the first request of the
- * session, not before, and it is never fetched on its own — spending a request
- * to ask "how much have I spent" is exactly the wrong trade on a metered plan.
+ * Two sources feed it. The headers keep it current as turns run; before any
+ * turn, the command asks the account usage endpoint (`/wham/usage`, the read
+ * behind the official client's `/status`) through the active ChatGPT
+ * transport. That read is a status call, not a model call — it spends none of
+ * the plan it reports.
  *
  * Usage:
  *   /openai-quota     Show the latest reading for every metered window
  */
 import { type ProviderQuotaSnapshot } from '@wrongstack/core/quota';
-import type { SlashCommand } from '@wrongstack/core/types';
+import type { ProviderConfig, SlashCommand } from '@wrongstack/core/types';
+/** Where the saved providers come from — the live config in a session. */
+export interface QuotaCommandDeps {
+    providers?: () => Readonly<Record<string, ProviderConfig>> | undefined;
+}
 /**
  * Render one meter. Provider-neutral by construction — everything it reads is
  * on the shared snapshot shape.
  */
 export declare function renderQuotaSnapshot(snapshot: ProviderQuotaSnapshot): string[];
-export declare function buildOpenAIQuotaCommand(): SlashCommand;
+export declare function buildOpenAIQuotaCommand(deps?: QuotaCommandDeps): SlashCommand;
 /**
  * `/provider-quota` — every metered subscription this session has heard from.
  *
@@ -42,5 +48,5 @@ export declare function buildOpenAIQuotaCommand(): SlashCommand;
  * and would occupy the name if one is ever built. What this shows is exactly
  * the provider plane's readings, so that is what it is called.
  */
-export declare function buildProviderQuotaCommand(): SlashCommand;
+export declare function buildProviderQuotaCommand(deps?: QuotaCommandDeps): SlashCommand;
 //# sourceMappingURL=openai-quota.d.ts.map

package/dist/slash-commands/sandbox.d.ts

@@ -0,0 +1,5 @@
+import type { SlashCommand } from '@wrongstack/core/types';
+import type { SlashCommandContext } from './command-context.js';
+/** CLI active-tier indicator (plan 28 T3; TUI/WebUI panels remain T9). */
+export declare function buildSandboxCommand(_opts: SlashCommandContext): SlashCommand;
+//# sourceMappingURL=sandbox.d.ts.map

package/dist/slash-commands/scout-stats.d.ts

@@ -0,0 +1,46 @@
+import type { SessionEvent, SlashCommand } from '@wrongstack/core/types';
+import type { SlashCommandContext } from './command-context.js';
+/**
+ * `/scout-stats` — does the Scout identity behave the way its prompt asks?
+ *
+ * Measured from session journals at read time (nothing is recorded for it):
+ * every `llm_request` carries the identity variant it ran under, and tool
+ * calls are journaled as `tool_call_start` events. Two behaviours are the
+ * point of Scout, so they lead the report next to the other variants:
+ *
+ * - discovery — how often `tool_search` comes back empty, and how often a tool
+ *   it surfaced is then called through `tool_use`;
+ * - delegation — the share of runs that hand work to a subagent, against runs
+ *   that did a lot of tool work alone.
+ */
+/** Tool calls in one run, without a delegation, that count as "worked alone". */
+export declare const SOLO_HEAVY_TOOL_CALLS = 8;
+export interface VariantUsage {
+    variant: string;
+    sessions: number;
+    runs: number;
+    requests: number;
+    inputTokens: number;
+    outputTokens: number;
+    toolCalls: number;
+    /** Calls routed through the `tool_use` gateway (schema was not direct). */
+    lazyCalls: number;
+    searches: number;
+    emptySearches: number;
+    /** `tool_use` calls whose target an earlier search in the run returned. */
+    searchedThenUsed: number;
+    delegations: number;
+    runsWithDelegation: number;
+    /** Runs with at least {@link SOLO_HEAVY_TOOL_CALLS} tool calls and no delegation. */
+    soloHeavyRuns: number;
+}
+/**
+ * Aggregate journals per identity variant. A run starts at each `user_input`
+ * and belongs to the variant of its first `llm_request`; a journal written
+ * before requests recorded their variant is reported as `unrecorded`.
+ */
+export declare function summarizeVariantUsage(sessions: readonly (readonly SessionEvent[])[]): VariantUsage[];
+/** One block per variant; Scout first, since the command exists to judge it. */
+export declare function formatVariantUsage(usage: readonly VariantUsage[], sessionCount: number): string;
+export declare function buildScoutStatsCommand(opts: SlashCommandContext): SlashCommand;
+//# sourceMappingURL=scout-stats.d.ts.map

package/dist/slash-commands/sdd-inspect-commands.d.ts

@@ -0,0 +1,9 @@
+import type { SlashCommand } from '@wrongstack/core/types';
+export declare function runSddInspectCommand(inputs: {
+    cmd: string;
+    opts: import('./command-context.js').SlashCommandContext;
+    specStore: import('@wrongstack/sdd').SpecStore;
+    restJoined: string;
+    versioning: import('@wrongstack/sdd').SpecVersioning;
+}): ReturnType<SlashCommand['run']>;
+//# sourceMappingURL=sdd-inspect-commands.d.ts.map

package/dist/slash-commands/sdd-session-commands.d.ts

@@ -0,0 +1,19 @@
+import type { SlashCommand } from '@wrongstack/core/types';
+export declare function runSddSessionCommand(inputs: {
+    cmd: string;
+    restArgs: string[];
+    sessionState: import('../services/sdd/state.js').SDDState;
+    projectRoot: string;
+    specStore: import('@wrongstack/sdd').SpecStore;
+    sessionPersistenceOptions: {
+        sessionPersistence: import('@wrongstack/sdd').AISpecSessionPersistence;
+        sessionPath?: never;
+    } | {
+        sessionPath: string;
+        sessionPersistence?: never;
+    };
+    opts: import('./command-context.js').SlashCommandContext;
+    versioning: import('@wrongstack/sdd').SpecVersioning;
+    sessionPersistence: import('@wrongstack/sdd').AISpecSessionPersistence | undefined;
+}): ReturnType<SlashCommand['run']>;
+//# sourceMappingURL=sdd-session-commands.d.ts.map

package/dist/slash-commands/sdd.d.ts

@@ -1,5 +1,5 @@
 import type { SlashCommand } from '@wrongstack/core/types';
-import { renderProgress, TaskTracker } from '@wrongstack/sdd';
+import { renderProgress, type TaskTracker } from '@wrongstack/sdd';
 import type { SlashCommandContext } from './command-context.js';
 export type { TaskProgress } from '@wrongstack/core/types';
 export { findSpec, gatherProjectContext, getActiveBuilder, getActiveSDDContext, getActiveSDDPhase, } from '../services/sdd/project-context.js';

package/dist/slash-commands/zai-plan.d.ts

@@ -0,0 +1,26 @@
+/**
+ * `/zai-plan` — the Z.AI / BigModel GLM Coding Plan, the way the official
+ * ZCode client's usage panel shows it: the subscription in force, the 5-hour
+ * and weekly model windows, the monthly MCP tool-call pool, the last days'
+ * token usage per model with the cache-hit rate, and the platform's own
+ * service health.
+ *
+ * Unlike `/provider-quota`, which only replays what turns already observed,
+ * this asks: every section is an account read on the monitor API. None of
+ * them is a model call, so the plan it describes is not spent by looking.
+ *
+ * It reports on the Z.AI / BigModel providers built in this session (the key
+ * lives with the transport, not here). Team plans need organization/project
+ * scoping that only ZCode's OAuth login carries; this reads the personal plan
+ * the API key belongs to.
+ *
+ * Usage:
+ *   /zai-plan          Plan, quota and the last 7 days
+ *   /zai-plan <days>   Same, with a 1–30 day usage window
+ */
+import type { SlashCommand } from '@wrongstack/core/types';
+import { type ZaiAccountHandle } from '@wrongstack/providers';
+export declare function buildZaiPlanCommand(deps?: {
+    accounts?: () => readonly ZaiAccountHandle[];
+}): SlashCommand;
+//# sourceMappingURL=zai-plan.d.ts.map

package/dist/{standalone-auto-update-TOTRGCSA.js → standalone-auto-update-VQC4GYCM.js}

@@ -4,10 +4,10 @@ import {
   findStandaloneRelease,
   installExecutableFrom,
   verifyStandaloneDigest
-} from "./chunk-X756ZS72.js";
+} from "./chunk-SUDNPYWD.js";
 import {
   isNewer
-} from "./chunk-RZ4ZDRYA.js";
+} from "./chunk-DIOODAYM.js";
 import {
   CLI_VERSION,
   STANDALONE_TARGET
@@ -246,4 +246,4 @@ export {
   startStandaloneAutoUpdate,
   takeAppliedUpdate
 };
-//# sourceMappingURL=standalone-auto-update-TOTRGCSA.js.map
+//# sourceMappingURL=standalone-auto-update-VQC4GYCM.js.map

package/dist/{standalone-update-LZO3MNLH.js → standalone-update-HZHDZZOR.js}

@@ -8,7 +8,7 @@ import {
   standaloneAssetName,
   updateStandaloneBinary,
   verifyStandaloneDigest
-} from "./chunk-X756ZS72.js";
+} from "./chunk-SUDNPYWD.js";
 import "./chunk-F5DCFAKI.js";
 export {
   MAX_BINARY_BYTES,
@@ -21,4 +21,4 @@ export {
   updateStandaloneBinary,
   verifyStandaloneDigest
 };
-//# sourceMappingURL=standalone-update-LZO3MNLH.js.map
+//# sourceMappingURL=standalone-update-HZHDZZOR.js.map

package/dist/subcommands/handlers/automation-credentials.d.ts

@@ -0,0 +1,8 @@
+import type { SecretVault } from '@wrongstack/core/types';
+import type { WstackPaths } from '@wrongstack/core/utils';
+import { type CredentialReference, type ResolvedCredentialBundle } from '@wrongstack/runtime';
+/** Read the existing machine profile at use time, so ordinary key rotation is visible. */
+export declare function resolveAutomationCredentials(refs: readonly CredentialReference[], paths: Pick<WstackPaths, 'profileConfig'>, vault: SecretVault): Promise<Readonly<Record<string, string>>>;
+/** Endpoint and key are read from the same atomic profile snapshot. */
+export declare function resolveAutomationCredentialBundle(refs: readonly CredentialReference[], paths: Pick<WstackPaths, 'profileConfig'>, vault: SecretVault): Promise<ResolvedCredentialBundle>;
+//# sourceMappingURL=automation-credentials.d.ts.map

package/dist/subcommands/handlers/automation.d.ts

@@ -0,0 +1,3 @@
+import type { SubcommandHandler } from '../contracts.js';
+export declare const automationCmd: SubcommandHandler;
+//# sourceMappingURL=automation.d.ts.map

package/dist/subcommands/handlers/bench-experiments.d.ts

@@ -0,0 +1,5 @@
+import { type QualityReviewPolicy } from '@wrongstack/bench';
+import type { SubcommandDeps } from '../contracts.js';
+export declare function benchExperimentCommand(action: string, args: string[], deps: SubcommandDeps): Promise<number>;
+export declare function readBenchReviewPolicy(file: string): Promise<QualityReviewPolicy>;
+//# sourceMappingURL=bench-experiments.d.ts.map

package/dist/subcommands/handlers/sandbox.d.ts

@@ -0,0 +1,5 @@
+import type { TerminalRenderer } from '../../renderer.js';
+import type { SubcommandHandler } from '../contracts.js';
+export declare const sandboxCmd: SubcommandHandler;
+export declare function runSandboxCommand(args: string[], flags: Record<string, string | boolean>, renderer: TerminalRenderer): Promise<number>;
+//# sourceMappingURL=sandbox.d.ts.map

package/dist/{subcommands-WX4GDMWB.js → subcommands-CLI6QTLU.js}

@@ -1,9 +1,9 @@
 import {
   subcommandNames,
   subcommands
-} from "./chunk-KT34LWIS.js";
+} from "./chunk-24C6VVLM.js";
 export {
   subcommandNames,
   subcommands
 };
-//# sourceMappingURL=subcommands-WX4GDMWB.js.map
+//# sourceMappingURL=subcommands-CLI6QTLU.js.map

package/dist/{tools-skills-GH24UCBY.js → tools-skills-33AI6K6S.js}

@@ -6,7 +6,7 @@ var toolsCmd = async (_args, deps) => {
   if (!reg) return 0;
   for (const { tool, owner } of reg.listWithOwner())
     deps.renderer.write(
-      `  ${tool.name.padEnd(28)} ${color.dim(`[${owner}]`)} ${tool.permission}
+      `  ${(tool.name === "tool_script" ? "tool_script / ToolFlow" : tool.name).padEnd(28)} ${color.dim(`[${owner}]`)} ${tool.permission}
 `
     );
   return 0;
@@ -25,4 +25,4 @@ export {
   skillsCmd,
   toolsCmd
 };
-//# sourceMappingURL=tools-skills-GH24UCBY.js.map
+//# sourceMappingURL=tools-skills-33AI6K6S.js.map

package/dist/tui-provider-quota-menu.d.ts

@@ -0,0 +1,5 @@
+import type { ProviderConfig } from '@wrongstack/core/types';
+import type { ResourceMenuSnapshot } from '@wrongstack/tui';
+/** One provider per row, with all its meters in the detail pane. */
+export declare function providerQuotaMenu(providers: Readonly<Record<string, ProviderConfig>> | undefined): ResourceMenuSnapshot;
+//# sourceMappingURL=tui-provider-quota-menu.d.ts.map