@wrongstack/cli 1.0.33 → 1.0.36

package/dist/{chunk-4BX2YDTQ.js → chunk-4JMAWKLA.js}

@@ -185,8 +185,14 @@ async function ensureHistoryDir(homeFn = defaultHomeDir, targetConfigPath) {
   }
 }
 async function readIndex(homeFn = defaultHomeDir, targetConfigPath) {
+  let raw;
+  try {
+    raw = await fs.readFile(historyIndexPath(homeFn, targetConfigPath), "utf8");
+  } catch (err) {
+    if (err.code !== "ENOENT") throw err;
+    return rebuildIndexFromEntries(homeFn, targetConfigPath);
+  }
   try {
-    const raw = await fs.readFile(historyIndexPath(homeFn, targetConfigPath), "utf8");
     const parsed = JSON.parse(raw);
     if (parsed && typeof parsed === "object" && Array.isArray(parsed.entries)) {
       const entries = parsed.entries.filter(
@@ -194,10 +200,44 @@ async function readIndex(homeFn = defaultHomeDir, targetConfigPath) {
       );
       return { version: 1, entries };
     }
-    return { version: 1, entries: [] };
   } catch {
-    return { version: 1, entries: [] };
   }
+  return rebuildIndexFromEntries(homeFn, targetConfigPath);
+}
+async function rebuildIndexFromEntries(homeFn = defaultHomeDir, targetConfigPath) {
+  const dir = historyDir(homeFn, targetConfigPath);
+  let files;
+  try {
+    files = (await fs.readdir(dir)).filter((file) => file.endsWith(".json"));
+  } catch (err) {
+    if (err.code === "ENOENT") return { version: 1, entries: [] };
+    throw err;
+  }
+  const entries = [];
+  for (const file of files) {
+    const id = file.slice(0, -".json".length);
+    let raw;
+    try {
+      raw = await fs.readFile(path.join(dir, file), "utf8");
+    } catch (err) {
+      if (err.code === "ENOENT") continue;
+      entries.push({ id, timestamp: "", description: "" });
+      continue;
+    }
+    try {
+      const entry = JSON.parse(raw);
+      if (entry.id === id && typeof entry.timestamp === "string") {
+        entries.push({
+          id,
+          timestamp: entry.timestamp,
+          description: typeof entry.description === "string" ? entry.description : ""
+        });
+      }
+    } catch {
+    }
+  }
+  entries.sort((a, b) => b.timestamp.localeCompare(a.timestamp));
+  return { version: 1, entries };
 }
 async function writeIndex(idx, homeFn = defaultHomeDir, targetConfigPath) {
   await ensureHistoryDir(homeFn, targetConfigPath);
@@ -297,6 +337,7 @@ async function appendHistory(oldCfg, newCfg, description, homeFn = defaultHomeDi
   }
   await withFileLock(historyIndexPath(homeFn, targetConfigPath), async () => {
     const idx = await readIndex(homeFn, targetConfigPath);
+    idx.entries = idx.entries.filter((e) => e.id !== id);
     idx.entries.unshift({ id, timestamp, description });
     await pruneHistoryEntries(idx, homeFn, targetConfigPath);
     await writeIndex(idx, homeFn, targetConfigPath);
@@ -398,4 +439,4 @@ export {
   restoreFromHistory,
   restoreLast
 };
-//# sourceMappingURL=chunk-4BX2YDTQ.js.map
+//# sourceMappingURL=chunk-4JMAWKLA.js.map

package/dist/{chunk-TWSQTQKR.js → chunk-4R6TVMYA.js}

@@ -1,6 +1,6 @@
 import {
   mutateConfigProviders
-} from "./chunk-ZYACRPLN.js";
+} from "./chunk-ULYAI7CP.js";
 import {
   activeProfileConfigPath
 } from "./chunk-YMXXOOFN.js";
@@ -51,4 +51,4 @@ export {
   installProviderPersisters,
   applyProviderOAuthRefresh2 as applyProviderOAuthRefresh
 };
-//# sourceMappingURL=chunk-TWSQTQKR.js.map
+//# sourceMappingURL=chunk-4R6TVMYA.js.map

package/dist/{chunk-HHRYIDOW.js → chunk-ACW64W4M.js}

@@ -1,6 +1,6 @@
 import {
   backupCurrent
-} from "./chunk-4BX2YDTQ.js";
+} from "./chunk-4JMAWKLA.js";
 
 // src/wiring/external-plugins.ts
 import { isAbsolute, join, resolve } from "node:path";
@@ -356,11 +356,25 @@ import { homedir } from "node:os";
 import { join as join2 } from "node:path";
 import { updateJsonObjectFile } from "@wrongstack/core/utils";
 async function readConfig(file) {
+  let raw;
   try {
-    return JSON.parse(await fs.readFile(file, "utf8"));
+    raw = await fs.readFile(file, "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT") return {};
+    throw error;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw.replace(/^\uFEFF/, ""));
   } catch {
-    return {};
+    throw new Error(
+      `Profile config "${file}" is not valid JSON \u2014 fix or remove it before changing plugins`
+    );
   }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error(`Profile config "${file}" must contain a JSON object`);
+  }
+  return parsed;
 }
 function pluginName(p) {
   return typeof p === "string" ? p : p.name;
@@ -411,6 +425,7 @@ import { execFile } from "node:child_process";
 import * as fs2 from "node:fs/promises";
 import { join as join3 } from "node:path";
 import { buildChildEnv } from "@wrongstack/core/utils";
+import { treeKill } from "@wrongstack/core/utils/tree-kill";
 import { resolveExecInvocation } from "@wrongstack/plugins/runtime";
 function detectPackageManager(args) {
   const override = args.find((a) => a.startsWith("--pm="));
@@ -467,7 +482,10 @@ function runPackageManagerInstall(pm, args, cwd) {
       });
       return;
     }
-    execFile(
+    let settled = false;
+    let timedOut = false;
+    let timer;
+    const child = execFile(
       invocation.cmd,
       invocation.args,
       {
@@ -476,20 +494,29 @@ function runPackageManagerInstall(pm, args, cwd) {
         // untrusted package lifecycle scripts — with the full inherited
         // environment. Strip credentials via the shared child env.
         env: buildChildEnv(),
-        timeout: 3e5,
         maxBuffer: 16 * 1024 * 1024,
         windowsHide: true,
         ...invocation.windowsVerbatimArguments ? { windowsVerbatimArguments: true } : {}
       },
       (err, stdout, stderr) => {
+        settled = true;
+        clearTimeout(timer);
         const code = err ? err.code ?? 1 : 0;
         resolvePromise({
-          code: typeof code === "number" ? code : 1,
+          code: typeof code === "number" && !timedOut ? code : 1,
           stdout: typeof stdout === "string" ? stdout : "",
           stderr: typeof stderr === "string" ? stderr : ""
         });
       }
     );
+    if (!settled) {
+      timer = setTimeout(() => {
+        timedOut = true;
+        treeKill(child);
+        child.stdout?.destroy();
+        child.stderr?.destroy();
+      }, 3e5);
+    }
   });
 }
 async function installPluginPackage(spec, args, deps) {
@@ -1109,4 +1136,4 @@ export {
   PLUGIN_AUDIT_ENTRIES,
   runPluginManagementCommand
 };
-//# sourceMappingURL=chunk-HHRYIDOW.js.map
+//# sourceMappingURL=chunk-ACW64W4M.js.map

package/dist/{chunk-5EA6OTLJ.js → chunk-AFOH6CHO.js}

@@ -17,7 +17,7 @@ import * as os2 from "node:os";
 import * as path from "node:path";
 import { resolveHqDataDir } from "@wrongstack/core/hq";
 import { isSafeSessionId as coreIsSafeSessionId } from "@wrongstack/core/utils";
-import { sanitizeApiError, scrubErrorDetail } from "@wrongstack/core/security";
+import { sanitizeApiError } from "@wrongstack/core/security";
 var TRANSCRIPT_RING_MAX = 4e3;
 var MAX_TRANSCRIPT_SESSIONS = 400;
 var MAX_AGENT_RINGS = 800;
@@ -236,4 +236,4 @@ export {
   recordTimeseriesSignal,
   sanitizeApiError
 };
-//# sourceMappingURL=chunk-5EA6OTLJ.js.map
+//# sourceMappingURL=chunk-AFOH6CHO.js.map

package/dist/{chunk-WHEYHDIE.js → chunk-AKESWZH5.js}

@@ -93,6 +93,7 @@ var helpCmd = async (_args, deps) => {
     ...section("Tools & permissions", [
       ["--yolo | --no-yolo", "Auto-approve on or off (gated destructive kinds still ask)"],
       ["--yolo-destructive", "Let YOLO run every destructive kind you may un-gate"],
+      ["--yolo-plus", "YOLO+: never ask for anything (explicit deny rules still refuse)"],
       ["--restricted", "Untrusted repo: no shell/network/MCP tools, stay in project, no YOLO"],
       ["--safe-mode", "Troubleshoot: no 3rd-party plugins, hooks, MCP, skills, overrides"],
       ["--only-tools <a,b,...>", "Expose only these tools (trailing * = prefix: mcp__gh__*)"],
@@ -156,4 +157,4 @@ export {
   versionCmd,
   helpCmd
 };
-//# sourceMappingURL=chunk-WHEYHDIE.js.map
+//# sourceMappingURL=chunk-AKESWZH5.js.map

package/dist/{chunk-JHUJUIOH.js → chunk-AT2A7RJZ.js}

@@ -1,4 +1,7 @@
 
+// src/services/sdd/project-context.ts
+import { gatherProjectContext } from "@wrongstack/sdd";
+
 // src/services/sdd/state.ts
 import {
   SpecVersioning
@@ -85,7 +88,6 @@ function getSessionState(ctx) {
 }
 
 // src/services/sdd/project-context.ts
-import { gatherProjectContext } from "@wrongstack/sdd";
 function getActiveBuilder() {
   return sddState.getBuilder();
 }
@@ -375,17 +377,6 @@ function matchTaskNode(nodes, query) {
   const q = trimmed.toLowerCase();
   return nodes.find((n) => n.title.toLowerCase().includes(q) || q.includes(n.title.toLowerCase())) ?? null;
 }
-function markTaskCompleted(taskTitle) {
-  const tracker = sddState.getTaskTracker();
-  if (!tracker) return false;
-  const nodes = tracker.getAllNodes({ status: ["pending", "in_progress"] });
-  const match = nodes.find(
-    (n) => n.title.toLowerCase().includes(taskTitle.toLowerCase()) || taskTitle.toLowerCase().includes(n.title.toLowerCase())
-  );
-  if (!match) return false;
-  tracker.updateNodeStatus(match.id, "completed");
-  return true;
-}
 function getTaskGraphId() {
   return sddState.getTaskGraphId();
 }
@@ -394,7 +385,6 @@ function getTaskTrackerExport() {
 }
 
 export {
-  SDDState,
   sddState,
   getSessionState,
   getActiveBuilder,
@@ -402,7 +392,6 @@ export {
   getActiveSDDPhase,
   findSpec,
   gatherProjectContext,
-  isExplanatoryText,
   trySaveSpecFromAIOutput,
   trySaveImplementationPlan,
   autoDetectTaskCompletion,
@@ -414,8 +403,7 @@ export {
   renderTaskListWithProgress,
   getCurrentExecutingContext,
   matchTaskNode,
-  markTaskCompleted,
   getTaskGraphId,
   getTaskTrackerExport
 };
-//# sourceMappingURL=chunk-JHUJUIOH.js.map
+//# sourceMappingURL=chunk-AT2A7RJZ.js.map

package/dist/{chunk-LKFKO4JW.js → chunk-B6EHK772.js}

@@ -4,7 +4,7 @@ import {
 import {
   PLUGIN_AUDIT_ENTRIES,
   loadExternalPlugins
-} from "./chunk-HHRYIDOW.js";
+} from "./chunk-ACW64W4M.js";
 
 // src/wiring/plugins.ts
 import { join } from "node:path";
@@ -306,4 +306,4 @@ export {
   BUILTIN_PLUGIN_NAME_HINTS,
   setupPlugins
 };
-//# sourceMappingURL=chunk-LKFKO4JW.js.map
+//# sourceMappingURL=chunk-B6EHK772.js.map

package/dist/{chunk-U3SS4NRH.js → chunk-BHXAKTBE.js}

@@ -7,4 +7,4 @@ import {
 export {
   buildWin32CmdShimInvocation
 };
-//# sourceMappingURL=chunk-U3SS4NRH.js.map
+//# sourceMappingURL=chunk-BHXAKTBE.js.map

package/dist/{chunk-4UWCMBPG.js → chunk-BJH44J7G.js}

@@ -413,9 +413,9 @@ function pruneExpiredTombstones(state, now) {
   return changed;
 }
 async function readState(projectRoot) {
+  const raw = await readKanbanMetadata(projectRoot, SYNC_STATE_KEY);
+  if (raw === null) return { boards: {}, tombstones: {} };
   try {
-    const raw = await readKanbanMetadata(projectRoot, SYNC_STATE_KEY);
-    if (raw === null) return { boards: {}, tombstones: {} };
     const parsed = JSON.parse(raw);
     return { boards: parsed.boards ?? {}, tombstones: parsed.tombstones ?? {} };
   } catch {
@@ -686,4 +686,4 @@ function startCliHqConnection(options) {
 export {
   startCliHqConnection
 };
-//# sourceMappingURL=chunk-4UWCMBPG.js.map
+//# sourceMappingURL=chunk-BJH44J7G.js.map

package/dist/{chunk-MPQCHBDJ.js → chunk-CJSHS2K7.js}

@@ -3,6 +3,7 @@
 var BOOLEAN_FLAGS = /* @__PURE__ */ new Set([
   "yolo",
   "no-yolo",
+  "yolo-plus",
   "yolo-destructive",
   "confirm-destructive",
   "force-all-yolo",
@@ -107,6 +108,9 @@ var BOOLEAN_FLAGS = /* @__PURE__ */ new Set([
   "all-models",
   "plan",
   "json",
+  // `wstack modeldiag eval [role] --quick`: as a value flag it swallowed the
+  // role (`eval --quick coder` ran a full all-category eval, not a quick one).
+  "quick",
   // Destructive-preview switch (`wstack chronicle prune --dry-run`). It is
   // boolean at every call site, and leaving it out let it consume the next
   // positional — on a command whose whole purpose is to NOT delete.
@@ -307,4 +311,4 @@ export {
   parseAuthFlags,
   parseSpawnFlags
 };
-//# sourceMappingURL=chunk-MPQCHBDJ.js.map
+//# sourceMappingURL=chunk-CJSHS2K7.js.map

package/dist/{chunk-RQ4UBKYH.js → chunk-GF7LUWQS.js}

@@ -24,7 +24,7 @@ import {
   sanitizeApiError,
   truncateHqSummary,
   writeInvalidBody
-} from "./chunk-5EA6OTLJ.js";
+} from "./chunk-AFOH6CHO.js";
 import {
   createHqIpAllowlist
 } from "./chunk-Q7E3BPDU.js";
@@ -49,6 +49,7 @@ import {
   watchHqAuthFile
 } from "@wrongstack/core/hq";
 import { createCompatibilityTrustBoundary } from "@wrongstack/core/security";
+import { isPidAlive } from "@wrongstack/core/utils";
 import { WebSocket as WebSocket4, WebSocketServer } from "ws";
 
 // src/hq-recovery-html.ts
@@ -2890,7 +2891,7 @@ async function handleApiAgentMessages(req, res, match, agentMessages) {
 async function handleApiSystemUpdate(res) {
   const [{ checkForUpdate }, { detectUpdatePackageName }] = await Promise.all([
     import("./update-check-VLVT4IV2.js"),
-    import("./update-J5WHAFPE.js")
+    import("./update-LHCWAWEZ.js")
   ]);
   const packageName = detectUpdatePackageName();
   const info = await checkForUpdate({ packageName });
@@ -5002,14 +5003,7 @@ async function startHqServerWithAuth(options, host, port, dataDir, firstRunAuth)
           const metadataPath = path8.join(projectDir, ".mailbox-server.json");
           const ownerPid = await fs4.readFile(metadataPath, "utf8").then((raw) => JSON.parse(raw).pid).catch(() => void 0);
           if (ownerPid === void 0) return;
-          let ownerAlive = false;
-          try {
-            process.kill(ownerPid, 0);
-            ownerAlive = true;
-          } catch {
-            ownerAlive = false;
-          }
-          if (!ownerAlive) {
+          if (!isPidAlive(ownerPid)) {
             await fs4.rm(metadataPath, { force: true }).catch(() => {
             });
             return;
@@ -5367,4 +5361,4 @@ export {
   startHqServer,
   HqInsecureExposureError2 as HqInsecureExposureError
 };
-//# sourceMappingURL=chunk-RQ4UBKYH.js.map
+//# sourceMappingURL=chunk-GF7LUWQS.js.map

package/dist/{chunk-TXAFIERF.js → chunk-L5NWFP5R.js}

@@ -1,7 +1,7 @@
 import {
   loadConfigProviders,
   mutateConfigProviders
-} from "./chunk-ZYACRPLN.js";
+} from "./chunk-ULYAI7CP.js";
 
 // src/provider-cloud-config.ts
 import {
@@ -34,4 +34,4 @@ async function providerCloudConfig(id, updates, configPath, vault) {
 export {
   providerCloudConfig
 };
-//# sourceMappingURL=chunk-TXAFIERF.js.map
+//# sourceMappingURL=chunk-L5NWFP5R.js.map

package/dist/{chunk-24C6VVLM.js → chunk-LPGZ3NUF.js}

@@ -1,48 +1,48 @@
 
 // src/subcommands/index.ts
 var loaders = {
-  automation: async () => (await import("./automation-MCDFCIMV.js")).automationCmd,
+  automation: async () => (await import("./automation-3E3AUPBF.js")).automationCmd,
   sandbox: async () => (await import("./sandbox-TYGD6FI2.js")).sandboxCmd,
-  acp: async () => (await import("./acp-EDGUWU7N.js")).acpCmd,
+  acp: async () => (await import("./acp-QLU7T5WX.js")).acpCmd,
   init: async () => (await import("./init-DRMMFG2G.js")).initCmd,
-  auth: async () => (await import("./auth-SUHKFFO4.js")).authCmd,
-  update: async () => (await import("./update-J5WHAFPE.js")).updateCmd,
+  auth: async () => (await import("./auth-AED7RW7D.js")).authCmd,
+  update: async () => (await import("./update-LHCWAWEZ.js")).updateCmd,
   remote: async () => (await import("./remote-C74BCNND.js")).remoteCmd,
-  sessions: async () => (await import("./sessions-config-VE26SB56.js")).sessionsCmd,
-  config: async () => (await import("./sessions-config-VE26SB56.js")).configCmd,
-  "config-export": async () => (await import("./config-transfer-UE37X4B5.js")).configExportCmd,
-  "config-import": async () => (await import("./config-transfer-UE37X4B5.js")).configImportCmd,
+  sessions: async () => (await import("./sessions-config-RQRQDW5Q.js")).sessionsCmd,
+  config: async () => (await import("./sessions-config-RQRQDW5Q.js")).configCmd,
+  "config-export": async () => (await import("./config-transfer-YPD7HYXH.js")).configExportCmd,
+  "config-import": async () => (await import("./config-transfer-YPD7HYXH.js")).configImportCmd,
   rewind: async () => (await import("./rewind-7AULJS7F.js")).rewindCmd,
   replay: async () => (await import("./replay-JJ2NOWD6.js")).replayCmd,
   audit: async () => (await import("./audit-KCBTHUQI.js")).auditCmd,
   tools: async () => (await import("./tools-skills-33AI6K6S.js")).toolsCmd,
   skills: async () => (await import("./tools-skills-33AI6K6S.js")).skillsCmd,
-  "skill-suggest": async () => (await import("./skill-suggest-L2EVWB6R.js")).skillSuggestCmd,
-  typesafe: async () => (await import("./typesafe-NHC322W5.js")).typesafeCmd,
-  providers: async () => (await import("./providers-models-O75MKLN2.js")).providersCmd,
-  models: async () => (await import("./providers-models-O75MKLN2.js")).modelsCmd,
+  "skill-suggest": async () => (await import("./skill-suggest-THANK3LV.js")).skillSuggestCmd,
+  typesafe: async () => (await import("./typesafe-KW2XHOG3.js")).typesafeCmd,
+  providers: async () => (await import("./providers-models-S3S6VXME.js")).providersCmd,
+  models: async () => (await import("./providers-models-S3S6VXME.js")).modelsCmd,
   mcp: async () => (await import("./mcp-LBS45HWZ.js")).mcpCmd,
-  plugin: async () => (await import("./plugin-usage-3TZGROK7.js")).pluginCmd,
-  plugins: async () => (await import("./plugin-usage-3TZGROK7.js")).pluginCmd,
+  plugin: async () => (await import("./plugin-usage-EM752WHG.js")).pluginCmd,
+  plugins: async () => (await import("./plugin-usage-EM752WHG.js")).pluginCmd,
   diag: async () => (await import("./diag-doctor-BIZAFIAT.js")).diagCmd,
   doctor: async () => (await import("./diag-doctor-BIZAFIAT.js")).doctorCmd,
   "proxy-status": async () => (await import("./diag-doctor-BIZAFIAT.js")).proxyCmd,
   export: async () => (await import("./export-VVRIOWFV.js")).exportCmd,
-  usage: async () => (await import("./plugin-usage-3TZGROK7.js")).usageCmd,
-  version: async () => (await import("./version-help-ATOKGMTK.js")).versionCmd,
-  help: async () => (await import("./version-help-ATOKGMTK.js")).helpCmd,
+  usage: async () => (await import("./plugin-usage-EM752WHG.js")).usageCmd,
+  version: async () => (await import("./version-help-JQGRPDJW.js")).versionCmd,
+  help: async () => (await import("./version-help-JQGRPDJW.js")).helpCmd,
   projects: async () => (await import("./projects-T4CZCA25.js")).projectsCmd,
-  modeldiag: async () => (await import("./modeldiag-NEPTLFZW.js")).modeldiagCmd,
+  modeldiag: async () => (await import("./modeldiag-F3LUF4VJ.js")).modeldiagCmd,
   quick: async () => (await import("./quick-CNB4Z3HS.js")).quickCmd,
   bench: async () => (await import("./bench-MMZHFHDL.js")).benchCmd,
   chronicle: async () => (await import("./chronicle-PBJS7BN6.js")).chronicleCmd,
-  hq: async () => (await import("./hq-KBFDKTDD.js")).hqCmd,
-  mailbox: async () => (await import("./mailbox-serve-S536N66F.js")).mailboxServeCmd,
+  hq: async () => (await import("./hq-BBLGEEUH.js")).hqCmd,
+  mailbox: async () => (await import("./mailbox-serve-DRWJVMYU.js")).mailboxServeCmd,
   permissions: async () => (await import("./permissions-PL27UHYD.js")).permissionsCmd,
   project: async () => (await import("./project-AOQI5XTK.js")).projectCmd,
-  sage: async () => (await import("./sage-FFKUOCQL.js")).sageCmd,
+  sage: async () => (await import("./sage-BMRDJCDI.js")).sageCmd,
   governance: async () => (await import("./governance-RYSHV675.js")).governanceCmd,
-  "import-claude-code": async () => (await import("./import-claude-code-AYG24RG2.js")).importClaudeCodeCmd
+  "import-claude-code": async () => (await import("./import-claude-code-GHIS2F7Y.js")).importClaudeCodeCmd
 };
 var subcommands = Object.fromEntries(
   Object.entries(loaders).map(
@@ -58,4 +58,4 @@ export {
   subcommands,
   subcommandNames
 };
-//# sourceMappingURL=chunk-24C6VVLM.js.map
+//# sourceMappingURL=chunk-LPGZ3NUF.js.map

package/dist/{chunk-UQUYBDMG.js → chunk-M4G5FO7F.js}

@@ -48,4 +48,4 @@ export {
   extractBehaviorSettings,
   mergeBehaviorSettings
 };
-//# sourceMappingURL=chunk-UQUYBDMG.js.map
+//# sourceMappingURL=chunk-M4G5FO7F.js.map