@wrongstack/cli 1.0.4 → 1.0.7

package/dist/{mcp-HOMLC4WE.js → mcp-FX7TKPTV.js}

@@ -23,7 +23,11 @@ import { pathToFileURL } from "node:url";
 import { Context } from "@wrongstack/core/agent";
 import { ToolExecutor } from "@wrongstack/core/execution";
 import { ToolRegistry } from "@wrongstack/core/registry";
-import { AutoApprovePermissionPolicy, DefaultSecretScrubber } from "@wrongstack/core/security";
+import {
+  AutoApprovePermissionPolicy,
+  DefaultSecretScrubber,
+  ToolCapabilities
+} from "@wrongstack/core/security";
 import { normalizeTokenSavingTier } from "@wrongstack/core/types";
 import {
   DEFAULT_MCP_INSERTION_MAX_BYTES,
@@ -33,11 +37,9 @@ import {
 } from "@wrongstack/mcp";
 import { registerBuiltinToolTier } from "@wrongstack/tools/tool-tier";
 import { wireKanbanPorts } from "@wrongstack/runtime";
-var AllowAllPermissionPolicy = class extends AutoApprovePermissionPolicy {
-  async evaluate() {
-    return { permission: "auto", source: "default" };
-  }
-};
+function yoloServePolicy() {
+  return new AutoApprovePermissionPolicy(Object.values(ToolCapabilities));
+}
 function parseToolsFlag(flags, positional) {
   const raw = flags["tools"];
   const csv = typeof raw === "string" ? raw : raw === true ? positional?.[0] ?? "" : "";
@@ -226,7 +228,7 @@ async function serveMcpStdio(deps, positional) {
     controller.signal,
     resolveServeFsRestriction(deps.config)
   );
-  const permissionPolicy = yolo ? new AllowAllPermissionPolicy() : new AutoApprovePermissionPolicy();
+  const permissionPolicy = yolo ? yoloServePolicy() : new AutoApprovePermissionPolicy();
   const executor = new ToolExecutor(registry, {
     permissionPolicy,
     secretScrubber: new DefaultSecretScrubber(),
@@ -440,4 +442,4 @@ function isRecord(value) {
 export {
   mcpCmd
 };
-//# sourceMappingURL=mcp-HOMLC4WE.js.map
+//# sourceMappingURL=mcp-FX7TKPTV.js.map

package/dist/mcp-serve.d.ts

@@ -1,8 +1,39 @@
 import { Context } from '@wrongstack/core/agent';
 import { ToolRegistry } from '@wrongstack/core/registry';
+import { AutoApprovePermissionPolicy } from '@wrongstack/core/security';
 import type { PermissionPolicy, Tool } from '@wrongstack/core/types';
 import { type MCPServerPrompt, type MCPServerResource } from '@wrongstack/mcp';
 import type { SubcommandDeps } from './subcommands/contracts.js';
+/**
+ * `--yolo` for `mcp serve`: widen the CAPABILITY allowlist, keep every guard.
+ *
+ * This replaced an `AllowAllPermissionPolicy extends AutoApprovePermissionPolicy`
+ * whose `evaluate()` returned `{ permission: 'auto' }` unconditionally. That
+ * override skipped the whole base implementation — the sensitive-read denial,
+ * the leader deny rules, the destructive-command classifier, the agent-state
+ * write guard, and `LOCKED_DESTRUCTIVE_KINDS`. It was the only place in the
+ * codebase where `agent-state` and `credential-bind` could be un-gated, so a
+ * third-party MCP client could have written `hooks` into config.json (boot-time
+ * RCE) or `auto: true` into trust.json.
+ *
+ * It did not actually get there — but only by accident, and the accident is the
+ * reason this is a rewrite rather than a patch. The override returned
+ * `source: 'default'` where the base class returns `source: 'yolo'`, so
+ * `ToolExecutor.capabilityDowngraded` re-armed and forced `confirm`; `mcp serve`
+ * has no confirmAwaiter, so the call hard-errored. Changing that one string
+ * literal to `'yolo'` — which reads as a trivial consistency cleanup — would
+ * have made the bypass live. Safety must not rest on a string nobody knows is
+ * load-bearing.
+ *
+ * Granting every capability is what `--yolo` actually means, and it is what
+ * lets `ToolExecutor` trust an `auto` instead of downgrading it (see the
+ * `dangerousNotAllowed` reasoning in `auto-approve-policy.ts`). The destructive
+ * classifier is deliberately NOT relaxed: `yoloConfirmKinds` is left at its
+ * default, which gates every destructive kind. Destructive calls therefore
+ * still require a confirmation this surface cannot answer, exactly as before —
+ * this change removes a latent bypass without widening anything.
+ */
+export declare function yoloServePolicy(): AutoApprovePermissionPolicy;
 /**
  * Resolve the `--tools` whitelist for `mcp serve`.
  *

package/dist/{modeldiag-46CMWUNM.js → modeldiag-CJSFHZ3J.js}

@@ -52,6 +52,17 @@ var MODEL_PROFILES = [
     costTier: "premium",
     speedTier: "normal"
   },
+  {
+    provider: "openai",
+    // Must precede /gpt-4/ — every gpt-4o-mini id also contains gpt-4.
+    pattern: /gpt-4o-mini/i,
+    family: "GPT-4o Mini",
+    strengths: ["speed"],
+    bestFor: ["lightweight", "docs"],
+    avoidFor: ["planning"],
+    costTier: "budget",
+    speedTier: "fast"
+  },
   {
     provider: "openai",
     pattern: /gpt-4/i,
@@ -62,9 +73,11 @@ var MODEL_PROFILES = [
     speedTier: "fast"
   },
   {
-    provider: "openai",
-    pattern: /gpt-4o-mini/i,
-    family: "GPT-4o Mini",
+    provider: "google",
+    // Must precede /gemini-(?:2\.5|3)/ — flash variants (gemini-2.5-flash,
+    // gemini-3-flash, …) are budget/fast models and need this profile.
+    pattern: /gemini.*flash/i,
+    family: "Gemini Flash",
     strengths: ["speed"],
     bestFor: ["lightweight", "docs"],
     avoidFor: ["planning"],
@@ -80,16 +93,6 @@ var MODEL_PROFILES = [
     costTier: "standard",
     speedTier: "normal"
   },
-  {
-    provider: "google",
-    pattern: /gemini.*flash/i,
-    family: "Gemini Flash",
-    strengths: ["speed"],
-    bestFor: ["lightweight", "docs"],
-    avoidFor: ["planning"],
-    costTier: "budget",
-    speedTier: "fast"
-  },
   {
     provider: "deepseek",
     pattern: /deepseek/i,
@@ -685,7 +688,11 @@ async function runModeldiagBench(args, deps, providers, config, hasKey) {
 
 // src/subcommands/handlers/modeldiag-test.ts
 import { color as color4, toErrorMessage as toErrorMessage3 } from "@wrongstack/core/utils";
-import { makeProviderFromConfig as makeProviderFromConfig2, setOAuthTokenPersister } from "@wrongstack/providers";
+import {
+  buildProviderFactoriesFromRegistry,
+  makeProviderFromConfig as makeProviderFromConfig2,
+  setOAuthTokenPersister
+} from "@wrongstack/providers";
 
 // src/subcommands/handlers/model-smoke-test.ts
 import { ProviderError } from "@wrongstack/core/types";
@@ -876,6 +883,28 @@ async function runModelSmokeTests(params) {
 }
 
 // src/subcommands/handlers/modeldiag-test.ts
+async function createModelDiagSmokeProvider(params) {
+  const { providerId, config, modelsRegistry, providerFactories } = params;
+  const saved = config.providers?.[providerId];
+  const factoryType = saved?.type ?? providerId;
+  const resolved = await modelsRegistry.getProvider(providerId).catch(() => void 0) ?? (factoryType !== providerId ? await modelsRegistry.getProvider(factoryType).catch(() => void 0) : void 0);
+  const providerConfig = {
+    ...providerId === config.provider ? {
+      ...config.apiKey ? { apiKey: config.apiKey } : {},
+      ...config.baseUrl ? { baseUrl: config.baseUrl } : {}
+    } : {},
+    ...saved,
+    // Keep the user-visible alias on the factory input. The selected factory
+    // already captures the canonical models.dev provider and its per-model
+    // wire metadata.
+    type: providerId,
+    ...saved?.family ?? resolved?.family ? { family: saved?.family ?? resolved?.family } : {},
+    ...saved?.baseUrl ?? resolved?.apiBase ? { baseUrl: saved?.baseUrl ?? resolved?.apiBase } : {},
+    ...saved?.envVars ?? resolved?.envVars ? { envVars: saved?.envVars ?? resolved?.envVars } : {}
+  };
+  const factory = providerFactories.get(factoryType);
+  return factory ? factory.create(providerConfig) : makeProviderFromConfig2(providerId, providerConfig);
+}
 async function runModeldiagTest(args, deps, config) {
   const writeLine = (line = "") => {
     deps.renderer.write(`${line}
@@ -1010,25 +1039,20 @@ async function runModeldiagTest(args, deps, config) {
   });
   let results;
   try {
+    const providerFactories = new Map(
+      (await buildProviderFactoriesFromRegistry({ registry: deps.modelsRegistry })).map(
+        (factory) => [factory.type, factory]
+      )
+    );
     results = await runModelSmokeTests({
       targets,
       options: smokeOptions,
-      createProvider: async (providerId) => {
-        const saved = config.providers?.[providerId];
-        const resolved = await deps.modelsRegistry.getProvider(providerId).catch(() => void 0) ?? (saved?.type && saved.type !== providerId ? await deps.modelsRegistry.getProvider(saved.type).catch(() => void 0) : void 0);
-        const providerConfig = {
-          ...providerId === config.provider ? {
-            ...config.apiKey ? { apiKey: config.apiKey } : {},
-            ...config.baseUrl ? { baseUrl: config.baseUrl } : {}
-          } : {},
-          ...saved,
-          type: providerId,
-          ...saved?.family ?? resolved?.family ? { family: saved?.family ?? resolved?.family } : {},
-          ...saved?.baseUrl ?? resolved?.apiBase ? { baseUrl: saved?.baseUrl ?? resolved?.apiBase } : {},
-          ...saved?.envVars ?? resolved?.envVars ? { envVars: saved?.envVars ?? resolved?.envVars } : {}
-        };
-        return makeProviderFromConfig2(providerId, providerConfig);
-      },
+      createProvider: (providerId) => createModelDiagSmokeProvider({
+        providerId,
+        config,
+        modelsRegistry: deps.modelsRegistry,
+        providerFactories
+      }),
       onTargetComplete: resultLines
     });
   } finally {
@@ -1329,4 +1353,4 @@ var modeldiagCmd = async (args, deps) => {
 export {
   modeldiagCmd
 };
-//# sourceMappingURL=modeldiag-46CMWUNM.js.map
+//# sourceMappingURL=modeldiag-CJSFHZ3J.js.map

package/dist/permission-prompt-mirror.d.ts

@@ -0,0 +1,70 @@
+/**
+ * Mirror the plain REPL's permission prompt to HQ.
+ *
+ * Every other surface converges on the executor's confirm path, so one
+ * listener on the EventBus mirrors them all. The REPL does not: its prompt is
+ * asked by the permission policy's own `promptDelegate` inside `evaluate()`,
+ * which never reaches that path and raises no event. Without this wrapper the
+ * REPL is the one surface whose approvals are invisible from HQ — a partial
+ * guarantee that is worse than either a whole one or none, because an operator
+ * cannot tell which kind of session they are looking at.
+ *
+ * Two things make this honest rather than a hack:
+ *
+ *  - **The terminal read is cancellable.** When HQ answers first, the pending
+ *    `readKey` is aborted so stdin comes out of raw mode and the user's next
+ *    keystroke is not eaten by a question nobody is asking.
+ *  - **The mirrored card has a heartbeat, not a fake deadline.** A terminal
+ *    prompt waits for a keypress however long that takes, so it has no natural
+ *    deadline to publish — but a card with no deadline breaks the single
+ *    invariant the dashboard relies on ("pending cannot outlive its
+ *    deadline"), and a card with a fake one vanishes while the question is
+ *    still on screen. Renewing a short window on a timer keeps both true.
+ *
+ * The terminal prompt's own behaviour is deliberately unchanged: it still
+ * blocks until answered, with no timeout of its own.
+ *
+ * @module permission-prompt-mirror
+ */
+import type { ApprovalRegistry } from '@wrongstack/core/hq';
+import type { Tool } from '@wrongstack/core/types';
+type PromptDecision = 'yes' | 'no' | 'always' | 'deny';
+type PromptDelegate = (tool: Tool, input: unknown, suggestedPattern: string) => Promise<PromptDecision>;
+type AbortablePromptDelegate = (tool: Tool, input: unknown, suggestedPattern: string, signal: AbortSignal) => Promise<PromptDecision>;
+/**
+ * How long a mirrored REPL card stays pending without a renewal, and how often
+ * it is renewed. The gap between them is the worst-case time a card outlives
+ * the process that raised it — a laptop that sleeps mid-prompt should not park
+ * a permanent card on someone's dashboard.
+ */
+export declare const REPL_MIRROR_TTL_MS = 60000;
+export declare const REPL_MIRROR_HEARTBEAT_MS = 20000;
+export interface MirroredPromptDelegateDeps {
+    /** The real terminal prompt. Must honour the abort signal it is handed. */
+    inner: AbortablePromptDelegate;
+    /**
+     * Looked up per call, not captured: the registry is created during boot and
+     * this delegate is built before it exists. Returning undefined simply means
+     * no mirroring — the terminal prompt still works.
+     */
+    getRegistry: () => ApprovalRegistry | undefined;
+    /** The session the prompt belongs to, so an HQ answer lands on it. */
+    getSessionId?: (() => string | undefined) | undefined;
+    now?: (() => number) | undefined;
+}
+export declare function makeMirroredPromptDelegate(deps: MirroredPromptDelegateDeps): PromptDelegate;
+/**
+ * Late-bound handle to the approval registry.
+ *
+ * The prompt delegate is built during container wiring; the registry is
+ * created later, once the HQ telemetry layer comes up. Rather than reorder
+ * boot for a feature that is optional by nature, the delegate reads through
+ * this holder at call time — a prompt only ever fires long after both exist.
+ * Empty simply means no mirroring.
+ */
+export interface ApprovalMirrorRef {
+    current?: ApprovalRegistry | undefined;
+    sessionId?: (() => string | undefined) | undefined;
+}
+export {};
+//# sourceMappingURL=permission-prompt-mirror.d.ts.map

package/dist/permission-prompt.d.ts

@@ -2,7 +2,16 @@ import type { InputReader, Tool } from '@wrongstack/core/types';
 type PromptDecision = 'yes' | 'no' | 'always' | 'deny';
 /** Signature the Agent expects for confirming tool calls. */
 export type ConfirmAwaiter = (tool: Tool, input: unknown, toolUseId: string, suggestedPattern: string) => Promise<'yes' | 'no' | 'always' | 'deny'>;
-export declare function makePromptDelegate(reader: InputReader): (tool: Tool, input: unknown, suggestedPattern: string) => Promise<PromptDecision>;
+/**
+ * The terminal approval prompt.
+ *
+ * `signal` exists because the same question can now be answered somewhere else
+ * — from the HQ dashboard — while this prompt is on screen. Aborting takes it
+ * down and, crucially, gets stdin back out of raw mode; see
+ * `permission-prompt-mirror.ts`. Absent, behaviour is exactly as before: the
+ * prompt blocks until a key is pressed.
+ */
+export declare function makePromptDelegate(reader: InputReader): (tool: Tool, input: unknown, suggestedPattern: string, signal?: AbortSignal) => Promise<PromptDecision>;
 /**
  * Create a ConfirmAwaiter for the CLI path. Wraps makePromptDelegate
  * with the ConfirmAwaiter type signature expected by the Agent.

package/dist/{providers-models-6MOGAOVK.js → providers-models-LFNZ5WI7.js}

@@ -1,6 +1,6 @@
 import {
   visibleModelIds
-} from "./chunk-VUVOMXWP.js";
+} from "./chunk-3VXYY5JC.js";
 import {
   activeProfileConfigPath
 } from "./chunk-YMXXOOFN.js";
@@ -660,4 +660,4 @@ export {
   modelsCmd,
   providersCmd
 };
-//# sourceMappingURL=providers-models-6MOGAOVK.js.map
+//# sourceMappingURL=providers-models-LFNZ5WI7.js.map

package/dist/{short-circuit-flags-YDMLAQ5R.js → short-circuit-flags-RAT6UZVI.js}

@@ -1,10 +1,10 @@
 import {
   handleHelpVersionShortCircuit
-} from "./chunk-U6PGWDMZ.js";
+} from "./chunk-4OLAZIIN.js";
 import "./chunk-6WRKAACA.js";
 import "./chunk-XJXDOF63.js";
 import "./chunk-EK2P53GL.js";
 export {
   handleHelpVersionShortCircuit
 };
-//# sourceMappingURL=short-circuit-flags-YDMLAQ5R.js.map
+//# sourceMappingURL=short-circuit-flags-RAT6UZVI.js.map

package/dist/slash-commands/subagent-models.d.ts

@@ -0,0 +1,4 @@
+import type { SlashCommand } from '@wrongstack/core/types';
+import type { SlashCommandContext } from './command-context.js';
+export declare function buildSubagentModelsCommand(opts: SlashCommandContext): SlashCommand;
+//# sourceMappingURL=subagent-models.d.ts.map

package/dist/subagent-models/panel-service.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Host bridge for the TUI `/subagent-models` panel.
+ *
+ * The panel is presentational; the session-scoped plan lives in core and is
+ * journaled through the session writer, which only the CLI has. Mutations
+ * return an error STRING rather than throwing so a rejected write lands as a
+ * panel hint instead of unmounting the TUI.
+ */
+import { setSessionSubagentModelPlan } from '@wrongstack/core/coordination';
+import type { SubagentModelsPanelHost } from '@wrongstack/tui';
+/** The slice of the agent context the plan writer needs. */
+type PlanWriteContext = Parameters<typeof setSessionSubagentModelPlan>[0];
+export interface SubagentModelsPanelServiceDeps {
+    /** The session's own provider/model — the target of "use session model". */
+    getSessionTarget?: (() => {
+        provider?: string;
+        model?: string;
+    }) | undefined;
+    /**
+     * Live agent context — re-read on every call so a session swap (F1/F10,
+     * /resume) is picked up. Typed off the core writer contract rather than the
+     * full AgentContext so this bridge only depends on what it actually uses.
+     */
+    getContext: () => PlanWriteContext | undefined;
+}
+export declare function createSubagentModelsPanelHost(deps: SubagentModelsPanelServiceDeps): SubagentModelsPanelHost;
+export {};
+//# sourceMappingURL=panel-service.d.ts.map

package/dist/subcommands/handlers/modeldiag-test.d.ts

@@ -3,6 +3,13 @@
  *
  * @module subcommands/handlers/modeldiag-test
  */
+import type { Config, ModelsRegistry, Provider, ProviderFactory } from '@wrongstack/core/types';
 import type { SubcommandDeps } from '../contracts.js';
+export declare function createModelDiagSmokeProvider(params: {
+    providerId: string;
+    config: Config;
+    modelsRegistry: ModelsRegistry;
+    providerFactories: ReadonlyMap<string, ProviderFactory>;
+}): Promise<Provider>;
 export declare function runModeldiagTest(args: string[], deps: SubcommandDeps, config: Record<string, unknown>): Promise<number>;
 //# sourceMappingURL=modeldiag-test.d.ts.map

package/dist/{subcommands-7N4RIK6H.js → subcommands-VFVUTYAV.js}

@@ -1,9 +1,9 @@
 import {
   subcommandNames,
   subcommands
-} from "./chunk-BIWE22O5.js";
+} from "./chunk-RLCKKLJA.js";
 export {
   subcommandNames,
   subcommands
 };
-//# sourceMappingURL=subcommands-7N4RIK6H.js.map
+//# sourceMappingURL=subcommands-VFVUTYAV.js.map

package/dist/webui-server/prefs-seeding.d.ts

@@ -10,9 +10,17 @@ interface CliWebUIOptions {
     globalConfigPath?: string | undefined;
     profileConfigPath: string;
     appConfig?: {
+        /**
+         * The live default selection. Carried here so a model switch can move
+         * it in-process, not just in config.json — `session.new` reads the
+         * live object to stamp a new tab.
+         */
+        provider?: string | undefined;
+        model?: string | undefined;
         fallbackModels?: string[] | undefined;
         fallbackProfiles?: Record<string, string[]> | undefined;
         favoriteModels?: string[] | undefined;
+        disabledModels?: string[] | undefined;
         favoriteModelsOnly?: boolean | undefined;
         modelAvailabilitySchedule?: ModelBlackoutRule[] | undefined;
         fallbackAuto?: boolean | undefined;

package/dist/{webui-server-OBV5JYJV.js → webui-server-3NYXBZHX.js}

@@ -1,14 +1,14 @@
-import {
-  createHqCommandDispatcher,
-  createProjectKanbanAssignHandler,
-  createProjectKanbanTransitionHandler
-} from "./chunk-KNMIBKLV.js";
 import {
   createKanbanRunMirror
 } from "./chunk-VCYZ3WZV.js";
 import {
   WEBUI_SESSION_CHILD_CAPABILITIES
 } from "./chunk-GPPRNAKW.js";
+import {
+  createHqCommandDispatcher,
+  createProjectKanbanAssignHandler,
+  createProjectKanbanTransitionHandler
+} from "./chunk-JY52HWL6.js";
 import {
   startCliHqConnection
 } from "./chunk-TE3Q32JP.js";
@@ -37,6 +37,7 @@ import {
   envFlag,
   findFreePort,
   findInstalledPackageJson,
+  integrationConnectSources,
   isStrictPort,
   resolveAuthToken,
   resolvePendingConfirmsForSession,
@@ -47,8 +48,8 @@ import {
   startWebUILiveStatusLogger,
   toSessionHistoryEntries
 } from "@wrongstack/webui-server";
-import { WebSocketServer } from "ws";
 import { verifyClient as verifyWsClient2 } from "@wrongstack/webui-server/server/ws-auth";
+import { WebSocketServer } from "ws";
 
 // src/webui-server/client-registration.ts
 import { mailboxSessionTag } from "@wrongstack/core/coordination";
@@ -69,10 +70,13 @@ function createWebuiClientRegistration(deps) {
       capabilities: options.capabilities
     }),
     ...control ? {
-      createCommandHandler: (mailbox) => createHqCommandDispatcher({
+      createCommandHandler: (mailbox, approvals) => createHqCommandDispatcher({
         steerMailbox: mailbox,
         interruptLeader: control.interruptLeader,
         allowRunCommand: control.allowRunCommand,
+        // Same registry the approval bridge publishes from, so every
+        // prompt HQ shows is one this handler can actually answer.
+        resolveApproval: (toolUseId, decision, sessionId) => approvals.resolve(toolUseId, decision, sessionId),
         ...deps.projectRoot ? {
           kanbanTransition: createProjectKanbanTransitionHandler(deps.projectRoot),
           kanbanAssign: createProjectKanbanAssignHandler(deps.projectRoot)
@@ -294,7 +298,7 @@ function startWebuiCredentialWatcher({
         }
       } catch {
       }
-      const routingChanged = snapshot.fallbackModels !== void 0 || snapshot.fallbackBridge !== void 0 || hadFallbackBridge || snapshot.fallbackProfiles !== void 0 || snapshot.favoriteModels !== void 0 || snapshot.favoriteModelsOnly !== void 0 || snapshot.modelMatrix !== void 0 || snapshot.fallbackAuto !== void 0;
+      const routingChanged = snapshot.fallbackModels !== void 0 || snapshot.fallbackBridge !== void 0 || hadFallbackBridge || snapshot.fallbackProfiles !== void 0 || snapshot.favoriteModels !== void 0 || snapshot.disabledModels !== void 0 || snapshot.favoriteModelsOnly !== void 0 || snapshot.modelMatrix !== void 0 || snapshot.fallbackAuto !== void 0;
       if (routingChanged) {
         const configStore = opts.agent.container?.safeResolve?.(TOKENS.ConfigStore);
         configStore?.update({
@@ -302,6 +306,7 @@ function startWebuiCredentialWatcher({
           fallbackBridge: snapshot.fallbackBridge ?? "",
           ...snapshot.fallbackProfiles !== void 0 ? { fallbackProfiles: snapshot.fallbackProfiles } : {},
           ...snapshot.favoriteModels !== void 0 ? { favoriteModels: snapshot.favoriteModels } : {},
+          ...snapshot.disabledModels !== void 0 ? { disabledModels: snapshot.disabledModels } : {},
           ...snapshot.favoriteModelsOnly !== void 0 ? { favoriteModelsOnly: snapshot.favoriteModelsOnly } : {},
           ...snapshot.modelMatrix !== void 0 ? { modelMatrix: snapshot.modelMatrix } : {},
           ...snapshot.fallbackAuto !== void 0 ? { fallbackAuto: snapshot.fallbackAuto } : {}
@@ -782,6 +787,12 @@ function createPrefsSeeding(opts) {
     opts.appConfig = { ...opts.appConfig, ...patch };
   };
   const persistPrefs = async (payload) => {
+    if (typeof payload["provider"] === "string") {
+      patchLiveAppConfig({ provider: payload["provider"] });
+    }
+    if (typeof payload["model"] === "string") {
+      patchLiveAppConfig({ model: payload["model"] });
+    }
     if (Array.isArray(payload["fallbackModels"])) {
       patchLiveAppConfig({ fallbackModels: payload["fallbackModels"] });
     }
@@ -793,6 +804,9 @@ function createPrefsSeeding(opts) {
     if (Array.isArray(payload["favoriteModels"])) {
       patchLiveAppConfig({ favoriteModels: payload["favoriteModels"] });
     }
+    if (Array.isArray(payload["disabledModels"])) {
+      patchLiveAppConfig({ disabledModels: payload["disabledModels"] });
+    }
     if (typeof payload["favoriteModelsOnly"] === "boolean") {
       patchLiveAppConfig({ favoriteModelsOnly: payload["favoriteModelsOnly"] });
     }
@@ -852,7 +866,9 @@ function createPrefsSeeding(opts) {
 // src/webui-server/route-contexts.ts
 import * as path5 from "node:path";
 import {
+  normalizeSubagentModelPlan,
   seedSessionSubagentPolicy,
+  setSessionSubagentModelPlan,
   setSessionSubagentsAllowed
 } from "@wrongstack/core/coordination";
 import { TOKENS as TOKENS2 } from "@wrongstack/core/kernel";
@@ -980,6 +996,10 @@ function createWebuiRouteContexts({
       sessionId ? getSessionAgent(sessionId).ctx : opts.agent.ctx,
       allowed
     ),
+    setSubagentModelPlan: (plan, sessionId) => setSessionSubagentModelPlan(
+      sessionId ? getSessionAgent(sessionId).ctx : opts.agent.ctx,
+      normalizeSubagentModelPlan(plan)
+    ),
     persist: persistPrefs,
     setYolo: opts.onYoloSwitch,
     setAutonomy: opts.onAutonomySwitch,
@@ -1101,6 +1121,7 @@ function createWebuiRouteContexts({
   };
   const connectionCtx = {
     agent: opts.agent,
+    events: opts.events,
     getAgent: getSessionAgent,
     // Non-creating peek for the hasSession ownership gate (background-tab
     // requests are legitimate; arbitrary strings are not).
@@ -1499,6 +1520,10 @@ async function runWebUI(opts) {
     requireToken,
     deferListen: surface === "simpleui",
     strictPort,
+    // HQ / WrongProxy status chips fetch those endpoints straight from the
+    // browser; without their origins in `connect-src` the page's own CSP
+    // blocks the probe and both chips report a healthy server as down.
+    getExtraConnectSrc: () => integrationConnectSources(opts.appConfig),
     ...opts.getVectorMemoryStore ? { getVectorMemoryStore: opts.getVectorMemoryStore } : {},
     ...opts.vectorMemoryModelCacheDir ? { vectorMemoryModelCacheDir: opts.vectorMemoryModelCacheDir } : {}
   });
@@ -1511,9 +1536,7 @@ async function runWebUI(opts) {
     wsHost: host,
     expectedToken: wsToken,
     requireToken,
-    allowedHostnames: [publicUrl, publicWsUrl].filter(
-      (value) => Boolean(value)
-    ),
+    allowedHostnames: [publicUrl, publicWsUrl].filter((value) => Boolean(value)),
     allowBrowserUrlToken: Boolean(publicWsUrl),
     allowCrossPortLoopbackCookie: process.env["WRONGSTACK_WEBUI_DEV_CROSS_PORT_WS"] === "1"
   });
@@ -1648,6 +1671,7 @@ async function runWebUI(opts) {
     ),
     modelsRegistry: opts.modelsRegistry,
     providerAuthRegistry: opts.providerAuthRegistry,
+    getDisabledModels: () => opts.appConfig?.disabledModels ?? [],
     send,
     broadcast,
     log: (m) => console.log(m)
@@ -1974,4 +1998,4 @@ async function runWebUI(opts) {
 export {
   runWebUI
 };
-//# sourceMappingURL=webui-server-OBV5JYJV.js.map
+//# sourceMappingURL=webui-server-3NYXBZHX.js.map

package/dist/wiring/hq-telemetry.d.ts

@@ -5,6 +5,7 @@ import type { Config, SessionWriter } from '@wrongstack/core/types';
 import type { MCPRegistry } from '@wrongstack/mcp';
 import { createHqCommandDispatcher, type HqCommandController } from '../hq-command-controller.js';
 import type { KanbanHqSyncStats } from '../kanban-hq-sync.js';
+import type { ApprovalMirrorRef } from '../permission-prompt-mirror.js';
 /**
  * Mutable holder for the HQ publisher reference. The ref is created in
  * cli-main.ts before `brainMailbox` (which captures it via closure) and
@@ -28,6 +29,12 @@ interface SetupHqTelemetryDeps {
     teardownHandlers: (() => void)[];
     mailboxSessionTag: (sessionId: string) => string;
     hqPublisherRef: HqPublisherRef;
+    /**
+     * Late-bound handle the plain REPL's prompt delegate reads through. Populated
+     * here because this is where the registry is created; until then the REPL
+     * prompt simply runs unmirrored.
+     */
+    approvalMirror?: ApprovalMirrorRef | undefined;
     mcpRegistry: Pick<MCPRegistry, 'onOperation' | 'operationalHealth'>;
 }
 interface HqTelemetryResult {