@wrongstack/cli 1.0.29 → 1.0.33

package/dist/{chunk-6A7URMWN.js → chunk-RQ4UBKYH.js}

@@ -2889,8 +2889,8 @@ async function handleApiAgentMessages(req, res, match, agentMessages) {
 // src/hq-server/routes/system-handlers.ts
 async function handleApiSystemUpdate(res) {
   const [{ checkForUpdate }, { detectUpdatePackageName }] = await Promise.all([
-    import("./update-check-J5ZVKS73.js"),
-    import("./update-TDZX4IL2.js")
+    import("./update-check-VLVT4IV2.js"),
+    import("./update-J5WHAFPE.js")
   ]);
   const packageName = detectUpdatePackageName();
   const info = await checkForUpdate({ packageName });
@@ -5367,4 +5367,4 @@ export {
   startHqServer,
   HqInsecureExposureError2 as HqInsecureExposureError
 };
-//# sourceMappingURL=chunk-6A7URMWN.js.map
+//# sourceMappingURL=chunk-RQ4UBKYH.js.map

package/dist/{chunk-X756ZS72.js → chunk-SUDNPYWD.js}

@@ -66,7 +66,7 @@ async function downloadReleaseAssetToFile(url, file, options) {
             throw new Error(`download ${url} is too large`);
           }
           hash.update(value);
-          await out.write(value);
+          await out.writeFile(value);
         }
       } finally {
         reader.releaseLock();
@@ -326,4 +326,4 @@ export {
   installExecutableFrom,
   updateStandaloneBinary
 };
-//# sourceMappingURL=chunk-X756ZS72.js.map
+//# sourceMappingURL=chunk-SUDNPYWD.js.map

package/dist/{chunk-IFQ6NQPL.js → chunk-SWOPJHXI.js}

@@ -1,10 +1,10 @@
+import {
+  parseArgs
+} from "./chunk-MPQCHBDJ.js";
 import {
   helpCmd,
   versionCmd
-} from "./chunk-BZHT5GPF.js";
-import {
-  parseArgs
-} from "./chunk-Q4INH2DG.js";
+} from "./chunk-WHEYHDIE.js";
 
 // src/boot/short-circuit-flags.ts
 async function handleHelpVersionShortCircuit(argv) {
@@ -22,11 +22,11 @@ async function handleHelpVersionShortCircuit(argv) {
   }
   if (earlyFlags["help"] === true) {
     if (positional.length > 0) {
-      const { subcommandNames } = await import("./subcommands-WX4GDMWB.js");
+      const { subcommandNames } = await import("./subcommands-CLI6QTLU.js");
       if (subcommandNames.includes(positional[0])) {
         const first = positional[0];
         const deep = positional[1];
-        const { renderDeepHelp, renderFocusedHelp } = await import("./per-subcommand-help-MWQWFIAV.js");
+        const { renderDeepHelp, renderFocusedHelp } = await import("./per-subcommand-help-VKPV3OEY.js");
         if (deep && renderDeepHelp(`${first}:${deep}`, stubRenderer)) {
           return 0;
         }
@@ -43,4 +43,4 @@ async function handleHelpVersionShortCircuit(argv) {
 export {
   handleHelpVersionShortCircuit
 };
-//# sourceMappingURL=chunk-IFQ6NQPL.js.map
+//# sourceMappingURL=chunk-SWOPJHXI.js.map

package/dist/{chunk-LDCGZJTC.js → chunk-TWSQTQKR.js}

@@ -1,6 +1,6 @@
 import {
   mutateConfigProviders
-} from "./chunk-LUMETJFO.js";
+} from "./chunk-ZYACRPLN.js";
 import {
   activeProfileConfigPath
 } from "./chunk-YMXXOOFN.js";
@@ -8,13 +8,22 @@ import {
 // src/wiring/provider-persisters.ts
 import {
   applyProviderOAuthRefresh,
+  createSubscriptionRefreshTransaction,
   matchesActiveProviderCredential,
+  setAccountQuotaReporting,
   setOAuthTokenPersister,
-  setProviderModelPersister
+  setProviderModelPersister,
+  setSubscriptionRefreshTransaction
 } from "@wrongstack/providers";
 import { applyProviderOAuthRefresh as applyProviderOAuthRefresh2 } from "@wrongstack/providers";
 function installProviderPersisters(args) {
   const profileConfigPath = activeProfileConfigPath(args.paths, args.config);
+  setAccountQuotaReporting(true);
+  setSubscriptionRefreshTransaction(
+    createSubscriptionRefreshTransaction(
+      (mutator) => mutateConfigProviders(profileConfigPath, args.vault, mutator)
+    )
+  );
   setOAuthTokenPersister((providerId, creds, source) => {
     void mutateConfigProviders(profileConfigPath, args.vault, (all) => {
       const p = all[providerId];
@@ -27,7 +36,6 @@ function installProviderPersisters(args) {
     );
   });
   setProviderModelPersister((providerId, models, source) => {
-    if (models.length === 0) return;
     void mutateConfigProviders(profileConfigPath, args.vault, (all) => {
       const p = all[providerId];
       if (!p) return;
@@ -43,4 +51,4 @@ export {
   installProviderPersisters,
   applyProviderOAuthRefresh2 as applyProviderOAuthRefresh
 };
-//# sourceMappingURL=chunk-LDCGZJTC.js.map
+//# sourceMappingURL=chunk-TWSQTQKR.js.map

package/dist/chunk-TXAFIERF.js

@@ -0,0 +1,37 @@
+import {
+  loadConfigProviders,
+  mutateConfigProviders
+} from "./chunk-ZYACRPLN.js";
+
+// src/provider-cloud-config.ts
+import {
+  cloudFieldsForProvider,
+  parseNativeCloudSettings
+} from "@wrongstack/core/cloud-provider";
+async function providerCloudConfig(id, updates, configPath, vault) {
+  if (!/^[\w.-]{1,128}$/.test(id) || ["__proto__", "constructor", "prototype"].includes(id))
+    throw new Error("Invalid provider id");
+  if (updates === void 0) {
+    const providers = await loadConfigProviders(configPath, vault);
+    if (!Object.hasOwn(providers, id)) throw new Error("Saved provider not found");
+    return parseNativeCloudSettings(providers[id]?.cloud ?? {});
+  }
+  let saved = {};
+  await mutateConfigProviders(configPath, vault, (providers) => {
+    if (!Object.hasOwn(providers, id)) throw new Error("Saved provider not found");
+    const provider = providers[id];
+    const fields = cloudFieldsForProvider(provider.type || id);
+    if (!fields.length) throw new Error("This provider has no native cloud routing settings");
+    const parsed = updates === null ? {} : parseNativeCloudSettings(updates);
+    if (Object.keys(parsed).some((field) => !fields.includes(field)))
+      throw new Error("Cloud setting does not apply to this provider");
+    saved = updates === null ? {} : parseNativeCloudSettings({ ...provider.cloud, ...updates });
+    provider.cloud = saved;
+  });
+  return saved;
+}
+
+export {
+  providerCloudConfig
+};
+//# sourceMappingURL=chunk-TXAFIERF.js.map

package/dist/{chunk-BZHT5GPF.js → chunk-WHEYHDIE.js}

@@ -83,7 +83,7 @@ var helpCmd = async (_args, deps) => {
       ["--provider <id> --model <id>", "Provider and model for this run"],
       ["--fallback-model <a,b,...>", "Models to fall back to when the primary is unavailable"],
       ["--effort <level>", "Reasoning effort: none|minimal|low|medium|high|xhigh|max"],
-      ["--system-prompt lite|pro|default", "Bundled system-prompt variant"],
+      ["--system-prompt lite|pro|scout|default", "Bundled system-prompt variant"],
       [
         "--append-system-prompt <text> | --append-system-prompt-file <path>",
         "Add instructions to the host agent prompt for this run"
@@ -156,4 +156,4 @@ export {
   versionCmd,
   helpCmd
 };
-//# sourceMappingURL=chunk-BZHT5GPF.js.map
+//# sourceMappingURL=chunk-WHEYHDIE.js.map

package/dist/{chunk-LBPLTTZ6.js → chunk-WTJDSTYD.js}

@@ -23,8 +23,8 @@ var APPLIED_FMT = `
 `;
 async function printStandaloneUpdateNotice(info, config) {
   const [{ autoUpdateEnabled, standaloneUpdater, takeAppliedUpdate }, { isNewer }, version] = await Promise.all([
-    import("./standalone-auto-update-TOTRGCSA.js"),
-    import("./update-check-J5ZVKS73.js"),
+    import("./standalone-auto-update-VQC4GYCM.js"),
+    import("./update-check-VLVT4IV2.js"),
     import("./version-JB2UAV2A.js")
   ]);
   const applied = takeAppliedUpdate();
@@ -47,7 +47,7 @@ async function printUpdateNotice(initialUpdateInfo, config) {
     const ac = new AbortController();
     const timer = setTimeout(() => ac.abort(), 2e3);
     try {
-      const { checkForUpdate } = await import("./update-check-J5ZVKS73.js");
+      const { checkForUpdate } = await import("./update-check-VLVT4IV2.js");
       info = await checkForUpdate(ac.signal);
     } catch {
     } finally {
@@ -102,4 +102,4 @@ export {
   applySessionShellDefault,
   runPreflight
 };
-//# sourceMappingURL=chunk-LBPLTTZ6.js.map
+//# sourceMappingURL=chunk-WTJDSTYD.js.map

package/dist/{chunk-IS2PPBQV.js → chunk-X4LW5CZM.js}

@@ -4,7 +4,12 @@ import { createHash } from "node:crypto";
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
 import { ConfigError } from "@wrongstack/core/types";
-import { readProjectIdentity, withFileLock, wstackGlobalRoot } from "@wrongstack/core/utils";
+import {
+  atomicWrite,
+  readProjectIdentity,
+  withFileLock,
+  wstackGlobalRoot
+} from "@wrongstack/core/utils";
 function projectsJsonPath(globalConfigPath) {
   const base = globalConfigPath ? path.dirname(globalConfigPath) : wstackGlobalRoot();
   return path.join(base, "projects.json");
@@ -44,8 +49,7 @@ async function loadManifest(globalConfigPath) {
 }
 async function saveManifest(manifest, globalConfigPath) {
   const file = projectsJsonPath(globalConfigPath);
-  await fs.mkdir(path.dirname(file), { recursive: true });
-  await fs.writeFile(file, JSON.stringify(manifest, null, 2), "utf8");
+  await atomicWrite(file, JSON.stringify(manifest, null, 2), { encoding: "utf8" });
 }
 function generateSlug(root) {
   const base = path.basename(root).toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 40) || "project";
@@ -116,4 +120,4 @@ export {
   ensureProjectDataDir,
   touchProjectInManifest
 };
-//# sourceMappingURL=chunk-IS2PPBQV.js.map
+//# sourceMappingURL=chunk-X4LW5CZM.js.map

package/dist/{chunk-BBHWW6LR.js → chunk-YL4KCHZG.js}

@@ -83,7 +83,10 @@ var MODEL_PROFILES = [
 ];
 function fmtTokens(n) {
   if (n >= 1e6) return `${(n / 1e6).toFixed(1)}M`;
-  if (n >= 1e3) return `${(n / 1e3).toFixed(1)}k`;
+  if (n >= 1e3) {
+    const k = (n / 1e3).toFixed(1);
+    return Number(k) < 1e3 ? `${k}k` : `${(n / 1e6).toFixed(1)}M`;
+  }
   return String(n);
 }
 function fmtMs(ms) {
@@ -322,7 +325,16 @@ async function runModeldiagEval(args, deps, providers, config, hasKey) {
   const providerFilter = providersValue ? providersValue.split(",").map((s) => s.trim()).filter(Boolean) : void 0;
   const maxEq = evalArgs.find((a) => a.startsWith("--max="));
   const maxValue = maxEq?.replace("--max=", "") ?? (typeof deps.flags?.["max"] === "string" ? deps.flags["max"] : void 0);
-  const maxModels = maxValue ? Math.max(1, parseInt(maxValue, 10) || 2) : 2;
+  let maxModels = 2;
+  if (maxValue !== void 0) {
+    const rawMax = maxValue.trim();
+    const parsedMax = /^\d+$/.test(rawMax) ? Number(rawMax) : Number.NaN;
+    if (!Number.isSafeInteger(parsedMax) || parsedMax < 1) {
+      writeLine(`${color2.amber(`Invalid --max value "${maxValue}". Use a positive integer.`)}`);
+      return 1;
+    }
+    maxModels = parsedMax;
+  }
   const quick = evalArgs.includes("--quick") || deps.flags?.["quick"] === true || deps.flags?.["quick"] === "true";
   const modelsPerCat = quick ? 1 : maxModels;
   const roleFilter = evalArgs.find((a) => !a.startsWith("--"));
@@ -369,9 +381,9 @@ ${color2.dim('Enter numbers or provider IDs (comma-separated, or "all"):')}
     } else {
       targetProviderIds = [];
       for (const part of selected.split(",").map((s) => s.trim())) {
-        const idx = parseInt(part, 10);
-        if (idx >= 1 && idx <= keyedProviderIds.length) {
-          const pid = keyedProviderIds[idx - 1];
+        const index = /^\d+$/.test(part) ? Number(part) : Number.NaN;
+        if (Number.isSafeInteger(index) && index >= 1 && index <= keyedProviderIds.length) {
+          const pid = keyedProviderIds[index - 1];
           if (!targetProviderIds.includes(pid)) targetProviderIds.push(pid);
         } else if (keyedProviderIds.includes(part)) {
           if (!targetProviderIds.includes(part)) targetProviderIds.push(part);
@@ -546,4 +558,4 @@ export {
   createProviderForId,
   runModeldiagEval
 };
-//# sourceMappingURL=chunk-BBHWW6LR.js.map
+//# sourceMappingURL=chunk-YL4KCHZG.js.map

package/dist/{chunk-LUMETJFO.js → chunk-ZYACRPLN.js}

@@ -140,7 +140,7 @@ async function mutateConfigProviders(configPath, vault, mutator, profileConfigPa
         decrypted["model"],
         typeof decrypted["provider"] === "string" ? providers[decrypted["provider"]] : void 0
       ]);
-      mutator(providers, decrypted);
+      await mutator(providers, decrypted);
       for (const id of previousProviderIds) {
         if (!Object.hasOwn(providers, id)) removeProviderFallbackReferences(decrypted, id);
       }
@@ -168,4 +168,4 @@ export {
   mutateConfigProviders,
   nowIso
 };
-//# sourceMappingURL=chunk-LUMETJFO.js.map
+//# sourceMappingURL=chunk-ZYACRPLN.js.map

package/dist/{cli-context-6RONY47P.js → cli-context-7HK67B2Z.js}

@@ -2,6 +2,10 @@ import {
   parseOutputFormat,
   resolveJsonSchemaFlag
 } from "./chunk-LKPEBZBE.js";
+import {
+  parseWebuiSessionChildOptions,
+  writeWebuiSessionChildError
+} from "./chunk-P3Q3KMFH.js";
 import {
   activateRestrictedMode,
   announceSafeMode,
@@ -21,26 +25,22 @@ import {
   fmtTok,
   patchConfig
 } from "./chunk-EWKESL4L.js";
-import {
-  parseWebuiSessionChildOptions,
-  writeWebuiSessionChildError
-} from "./chunk-ZMX5HRLI.js";
 import {
   resolveLaunchMcpServers
 } from "./chunk-HLSHFXTO.js";
 import {
   subcommands
-} from "./chunk-KT34LWIS.js";
+} from "./chunk-24C6VVLM.js";
 import {
   renderDeepHelp,
   renderFocusedHelp
-} from "./chunk-WRYZLEXP.js";
+} from "./chunk-2EZ2DHOW.js";
 import {
   handleHelpVersionShortCircuit
-} from "./chunk-IFQ6NQPL.js";
+} from "./chunk-SWOPJHXI.js";
 import {
   DEFAULT_PORT
-} from "./chunk-6A7URMWN.js";
+} from "./chunk-RQ4UBKYH.js";
 import "./chunk-HXJYHAR4.js";
 import {
   resolveHqPasswordInput
@@ -48,44 +48,28 @@ import {
 import {
   normalizeHqPublicOrigin
 } from "./chunk-5EA6OTLJ.js";
-import {
-  installProviderPersisters
-} from "./chunk-LDCGZJTC.js";
 import {
   parseHqIpAllowlist
 } from "./chunk-Q7E3BPDU.js";
 import {
-  discoverAndMergeProviders
-} from "./chunk-D5GB5MHA.js";
-import {
-  runUpdateCommand
-} from "./chunk-KOEO4CJG.js";
-import "./chunk-U3SS4NRH.js";
-import {
-  applyNodeEnvDefault,
-  applySessionShellDefault,
-  runPreflight
-} from "./chunk-LBPLTTZ6.js";
-import "./chunk-RZ4ZDRYA.js";
-import {
-  applyAsciiMode
-} from "./chunk-PZQBGUVZ.js";
-import "./chunk-BZHT5GPF.js";
+  installProviderPersisters
+} from "./chunk-TWSQTQKR.js";
 import {
-  CLI_VERSION
-} from "./chunk-F5DCFAKI.js";
+  discoverAndMergeProviders
+} from "./chunk-PA4VBCXS.js";
 import {
   addFromCatalog,
   boxBottom,
   boxDivider,
   boxRow,
   boxTop,
+  parseAuthMenuIndex,
   runAuthLocal,
   runOAuthLoginMenu,
   runPicker,
   saveToGlobalConfig,
   theme
-} from "./chunk-2ERX3RPN.js";
+} from "./chunk-P3GRLV47.js";
 import "./chunk-YTEOAWOJ.js";
 import {
   isKeylessLocalProvider,
@@ -93,15 +77,32 @@ import {
 } from "./chunk-5UZBUV2H.js";
 import {
   resolveActiveApiKey
-} from "./chunk-LUMETJFO.js";
-import "./chunk-DAKVBMD4.js";
+} from "./chunk-ZYACRPLN.js";
 import {
   activeProfileConfigPath
 } from "./chunk-YMXXOOFN.js";
-import "./chunk-WSTVGC2C.js";
+import "./chunk-4BX2YDTQ.js";
+import {
+  runUpdateCommand
+} from "./chunk-PGNERAZL.js";
+import "./chunk-U3SS4NRH.js";
+import "./chunk-DAKVBMD4.js";
+import {
+  applyNodeEnvDefault,
+  applySessionShellDefault,
+  runPreflight
+} from "./chunk-WTJDSTYD.js";
 import {
   parseArgs
-} from "./chunk-Q4INH2DG.js";
+} from "./chunk-MPQCHBDJ.js";
+import "./chunk-DIOODAYM.js";
+import {
+  applyAsciiMode
+} from "./chunk-PZQBGUVZ.js";
+import "./chunk-WHEYHDIE.js";
+import {
+  CLI_VERSION
+} from "./chunk-F5DCFAKI.js";
 
 // src/cli-context.ts
 import { TOKENS as TOKENS3 } from "@wrongstack/core/kernel";
@@ -657,7 +658,7 @@ async function promptPort(deps, defaultPort) {
     )).trim();
     if (answer === "" || answer === "\n") return defaultPort;
     if (answer === "q" || answer === "quit") return defaultPort;
-    const parsed = Number.parseInt(answer, 10);
+    const parsed = /^\d+$/.test(answer) ? Number(answer) : Number.NaN;
     if (Number.isFinite(parsed) && parsed > 0 && parsed < 65536) {
       return parsed;
     }
@@ -928,7 +929,7 @@ async function isPortInUse(host, port) {
 }
 async function handleHqShortCircuit(flags) {
   if (flags["hq"] !== true) return null;
-  const { startHqServer } = await import("./hq-server-PCQACV7Y.js");
+  const { startHqServer } = await import("./hq-server-AVNKZ2PV.js");
   const tunnelRequested = flags["tunnel"] === true;
   const rawPublicUrl = typeof flags["hq-public-url"] === "string" ? flags["hq-public-url"] : process.env.WRONGSTACK_HQ_PUBLIC_URL;
   let publicOrigin;
@@ -959,7 +960,8 @@ async function handleHqShortCircuit(flags) {
   }
   let port;
   if (typeof flags["port"] === "string" && flags["port"].trim() !== "") {
-    const parsed = Number.parseInt(flags["port"], 10);
+    const rawPort = flags["port"].trim();
+    const parsed = /^\d+$/.test(rawPort) ? Number(rawPort) : Number.NaN;
     if (Number.isFinite(parsed) && parsed > 0 && parsed < 65536) {
       port = parsed;
     } else {
@@ -1759,34 +1761,12 @@ async function persistLaunchChoices(configPath, choices) {
 // src/pre-launch/project-check.ts
 import * as fs6 from "node:fs/promises";
 import * as path7 from "node:path";
-import { color as color8, toErrorMessage as toErrorMessage4 } from "@wrongstack/core/utils";
-var MANIFESTS = [
-  "package.json",
-  "pyproject.toml",
-  "Cargo.toml",
-  "go.mod",
-  "Makefile",
-  "pom.xml",
-  "build.gradle",
-  "build.gradle.kts",
-  "composer.json",
-  "Gemfile"
-];
-async function detectProjectKind(projectRoot) {
-  try {
-    await fs6.access(path7.join(projectRoot, ".wrongstack", "AGENTS.md"));
-    return "initialized";
-  } catch {
-  }
-  for (const m of MANIFESTS) {
-    try {
-      await fs6.access(path7.join(projectRoot, m));
-      return "project";
-    } catch {
-    }
-  }
-  return "empty";
-}
+import {
+  color as color8,
+  detectProjectKind,
+  isOutsideProject,
+  toErrorMessage as toErrorMessage4
+} from "@wrongstack/core/utils";
 async function scaffoldAgentsMd(projectRoot) {
   const dir = path7.join(projectRoot, ".wrongstack");
   const file = path7.join(dir, "AGENTS.md");
@@ -1898,7 +1878,7 @@ function flagOn(value) {
   return normalized === "true" || normalized === "1" || normalized === "yes" || normalized === "on";
 }
 function isSystemPromptPinned(flags) {
-  return flagOn(flags["system-pro"]) || flagOn(flags["system-lite"]) || typeof flags["system-prompt"] === "string";
+  return flagOn(flags["system-pro"]) || flagOn(flags["system-lite"]) || flagOn(flags["system-scout"]) || typeof flags["system-prompt"] === "string";
 }
 function shouldSkipSystemPromptMenu(flags) {
   if (isSystemPromptPinned(flags)) return true;
@@ -1912,10 +1892,17 @@ function labelFor(variant) {
   return SYSTEM_PROMPT_OPTIONS.find((o) => o.variant === variant)?.label ?? variant;
 }
 async function runSystemPromptMenu(deps) {
-  const { renderer, reader, paths, lastVariant } = deps;
+  const { renderer, reader, paths, lastVariant, suggestScout } = deps;
   const tokens = await countSystemPromptTokens(paths);
-  const defaultVariant = lastVariant ?? "default";
+  const defaultVariant = suggestScout ? "scout" : lastVariant ?? "default";
   if (lastVariant) {
+    if (suggestScout && lastVariant !== "scout") {
+      renderer.write(
+        `
+  ${color9.dim("\u25CB")} ${color9.dim(`Not a project folder \u2014 ${labelFor("scout")} (general-purpose) may fit better; answer n to choose it.`)}
+`
+      );
+    }
     const answer2 = (await reader.readLine(
       `  ${color9.amber("?")} Continue with ${color9.bold(labelFor(lastVariant))} system prompt ${color9.dim(`(~${fmtTok(tokens[lastVariant])} tokens)`)}? ${color9.dim("[Y/n/q]")} ${color9.dim("(auto Y in 5s)")} `,
       { timeoutMs: SUMMARY_TIMEOUT_MS2, defaultAnswer: "y" }
@@ -1926,6 +1913,12 @@ async function runSystemPromptMenu(deps) {
   renderer.write(`
   ${color9.amber("?")} System prompt:
 `);
+  if (suggestScout) {
+    renderer.write(
+      `  ${color9.dim(`Not a project folder \u2014 ${labelFor("scout")} is preselected.`)}
+`
+    );
+  }
   for (const [index, opt] of SYSTEM_PROMPT_OPTIONS.entries()) {
     const num2 = index + 1;
     const isDefault = opt.variant === defaultVariant;
@@ -1942,8 +1935,8 @@ async function runSystemPromptMenu(deps) {
   )).trim().toLowerCase();
   if (answer === "q" || answer === "quit") throw new LaunchAbortedError();
   if (!answer) return defaultVariant;
-  const num = Number.parseInt(answer, 10);
-  if (!Number.isNaN(num) && num >= 1 && num <= SYSTEM_PROMPT_OPTIONS.length) {
+  const num = parseAuthMenuIndex(answer);
+  if (num !== void 0 && num <= SYSTEM_PROMPT_OPTIONS.length) {
     return SYSTEM_PROMPT_OPTIONS[num - 1].variant;
   }
   const byName = SYSTEM_PROMPT_OPTIONS.find(
@@ -1962,9 +1955,17 @@ async function maybeRunSystemPromptMenu(opts) {
       renderer: opts.renderer,
       reader: opts.reader,
       lastVariant: savedVariant,
-      paths: opts.paths
+      paths: opts.paths,
+      suggestScout: opts.outsideProject
     });
     if (chosen === savedVariant) return { variant: chosen, aborted: false, changed: false };
+    if (opts.outsideProject && chosen === "scout") {
+      opts.renderer.write(
+        `  ${color9.dim(`${labelFor("scout")} for this launch only; the saved default stays ${labelFor(savedVariant ?? "default")}.`)}
+`
+      );
+      return { variant: chosen, aborted: false, changed: true };
+    }
     try {
       await (opts.persist ?? persistSystemPromptVariant)(opts.profileConfigPath, chosen);
     } catch (err) {
@@ -2787,6 +2788,10 @@ function compactSingleLine(text) {
 var GITHUB_PROVIDERS_OVERLAY_URL = "https://raw.githubusercontent.com/WrongStack/WrongStack/main/packages/cli/data/providers.json";
 async function boot(argv) {
   const { flags, positional } = parseArgs(argv);
+  if (positional[0] === "sandbox") {
+    const { runSandboxCommand } = await import("./sandbox-TYGD6FI2.js");
+    return runSandboxCommand(positional.slice(1), flags, new TerminalRenderer());
+  }
   if (positional[0] === "update") {
     const renderer2 = new TerminalRenderer();
     return runUpdateCommand(positional.slice(1), {
@@ -2797,7 +2802,7 @@ async function boot(argv) {
     });
   }
   if (positional[0] === "remote" || typeof flags["remote"] === "string") {
-    const { runRemoteCommand } = await import("./remote-GB5VXCCT.js");
+    const { runRemoteCommand } = await import("./remote-C74BCNND.js");
     return runRemoteCommand(
       positional[0] === "remote" ? positional.slice(1) : positional,
       flags,
@@ -2906,9 +2911,9 @@ async function boot(argv) {
     overlayFile: resolveBundledOverlayFile(),
     overlayCacheFile: wpaths.modelsOverlayCache
   });
+  installProviderPersisters({ config, paths: wpaths, vault, logger });
   const subcommandHandler = first ? subcommands[first] : void 0;
   if (first && subcommandHandler) {
-    installProviderPersisters({ config, paths: wpaths, vault, logger });
     if (flags["help"] === true || flags["h"] === true) {
       const deepSub = positional[1];
       if (deepSub && renderDeepHelp(`${first}:${deepSub}`, renderer)) {
@@ -3162,7 +3167,8 @@ To start the app with no model connected, pass --provider ${SETUP_PROVIDER_ID} -
       paths: {
         globalDir: wpaths.globalInstructions,
         projectDir: wpaths.inProjectInstructions
-      }
+      },
+      outsideProject: await isOutsideProject(projectRoot)
     });
     if (promptMenu.aborted) {
       await reader.close();
@@ -3280,7 +3286,7 @@ To start the app with no model connected, pass --provider ${SETUP_PROVIDER_ID} -
 }
 
 // src/cli-context.ts
-async function initializeCli(argv) {
+async function initializeCli(argv, options = {}) {
   applyNodeEnvDefault();
   applySessionShellDefault();
   const earlyFlags = parseArgs(argv).flags;
@@ -3339,6 +3345,7 @@ async function initializeCli(argv) {
       return 0;
     }
     effectiveArgv = applyLaunchMenuToArgv(argv, menuResult);
+    if (menuResult.mode !== "tui-repl") options.onNonTuiLaunch?.();
     const augmentedFlags = parseArgs(effectiveArgv).flags;
     if (menuResult.mode === "hq") {
       const hqAfterMenu = await handleHqShortCircuit(augmentedFlags);
@@ -3442,4 +3449,4 @@ async function initializeCli(argv) {
 export {
   initializeCli
 };
-//# sourceMappingURL=cli-context-6RONY47P.js.map
+//# sourceMappingURL=cli-context-7HK67B2Z.js.map

package/dist/cli-context.d.ts

@@ -32,5 +32,7 @@ export interface CliContext extends BootContext {
  * or a numeric exit code when a short-circuit flag (--help, --desktop, --hq)
  * fires. When the return is a number the caller must return it immediately.
  */
-export declare function initializeCli(argv: string[]): Promise<CliContext | number>;
+export declare function initializeCli(argv: string[], options?: {
+    onNonTuiLaunch?: () => void;
+}): Promise<CliContext | number>;
 //# sourceMappingURL=cli-context.d.ts.map

package/dist/cli-infrastructure.d.ts

@@ -0,0 +1,33 @@
+import type { SystemPromptBuilder } from '@wrongstack/core/types';
+export declare function setupCliInfrastructure(inputs: {
+    flags: Record<string, string | boolean>;
+    wpaths: import('@wrongstack/core/utils').WstackPaths;
+    events: import('@wrongstack/core/kernel').EventBus;
+    logger: import('@wrongstack/core/infrastructure').DefaultLogger;
+    getConfig: () => import('@wrongstack/core/types').Config;
+    teardownHandlers: (() => void)[];
+    vectorMemoryStore: import('@wrongstack/vector-memory').VectorMemoryStore | undefined;
+    renderer: import('./renderer.js').TerminalRenderer;
+    sessionRef: {
+        current: import('@wrongstack/core/types').SessionWriter | undefined;
+    };
+    activeMode: import('@wrongstack/core/types').Mode | null;
+    toolRegistry: import('@wrongstack/core/registry').ToolRegistry;
+    configStore: import('@wrongstack/core/types').ConfigStore;
+    container: import('@wrongstack/core/kernel').Container;
+    cwd: string;
+    projectRoot: string;
+    provider: import('@wrongstack/core/types').Provider;
+}): Promise<{
+    metricsSink: import("@wrongstack/core/types").MetricsSink | undefined;
+    healthRegistry: import("@wrongstack/core/types").HealthRegistry | undefined;
+    metricsStatus: import("@wrongstack/core/types").MetricsRuntimeStatus;
+    tracer: import("@wrongstack/core/types").Tracer | undefined;
+    tuiOwnsScreen: boolean;
+    evOn: (event: string, handler: (...args: unknown[]) => void) => void;
+    eventWiring: import("./boot/event-wiring.js").EventWiring;
+    promptBuilder: SystemPromptBuilder;
+    onlineAgents: import("@wrongstack/core/coordination").MailboxAgentStatus[];
+    systemPrompt: import("@wrongstack/core/types").TextBlock[];
+}>;
+//# sourceMappingURL=cli-infrastructure.d.ts.map