@wrongstack/cli 1.0.9 → 1.0.11

package/dist/{acp-CXLANMEZ.js → acp-IJ55NBMJ.js}

@@ -231,7 +231,8 @@ async function connectAcpSessionMcpServers(opts) {
     // this call. A lazily registered tool would exist in the registry but be
     // absent from the very first turn's provider payload.
     lazyMode: false,
-    ...opts.cacheDir ? { cacheDir: opts.cacheDir } : {}
+    ...opts.cacheDir ? { cacheDir: opts.cacheDir } : {},
+    ...opts.cwd ? { cwd: opts.cwd } : {}
   });
   for (const server of opts.servers) {
     try {
@@ -446,7 +447,8 @@ function buildAcpServerAgentFactory(deps, options = {}) {
         toolRegistry: tools,
         events,
         logger,
-        ...wpaths.cacheDir ? { cacheDir: wpaths.cacheDir } : {}
+        ...wpaths.cacheDir ? { cacheDir: wpaths.cacheDir } : {},
+        cwd
       });
       if (mcp) sessionMcp.set(sessionId, mcp);
     }
@@ -1165,4 +1167,4 @@ ${renderAcpBenchText(result)}
 export {
   acpCmd
 };
-//# sourceMappingURL=acp-CXLANMEZ.js.map
+//# sourceMappingURL=acp-IJ55NBMJ.js.map

package/dist/acp-mcp-servers.d.ts

@@ -36,6 +36,8 @@ export interface AcpSessionMcpOptions {
     events: EventBus;
     logger: Logger;
     cacheDir?: string | undefined;
+    /** The ACP session's cwd — each session names its own, unrelated to the process cwd. */
+    cwd?: string | undefined;
 }
 /**
  * Connect the session's MCP servers and register their tools.

package/dist/arg-parser.d.ts

@@ -16,6 +16,12 @@ export interface AuthFlags {
     family?: import('@wrongstack/core/types').WireFamily | undefined;
     baseUrl?: string | undefined;
     envVars?: string[] | undefined;
+    /**
+     * `--audit [target]` — `true` for a bare flag (stdout), otherwise the
+     * target: `'stdout'`, `'stderr'`, or a file path. Consumed by
+     * `resolveAuditSink` in `auth-menu/auth-menu-audit.ts`.
+     */
+    audit?: boolean | string | undefined;
 }
 /** Parse `wstack auth <provider> [--label ...] [--family ...] [...]` flags. */
 export declare function parseAuthFlags(args: string[]): AuthFlags;

package/dist/{auth-3K6EN5JP.js → auth-YXK3EDUL.js}

@@ -3,18 +3,20 @@ import {
   addFromCatalog,
   addKeyForProvider,
   confirm,
+  createAuthAuditLogger,
   loadProviders,
   providerAuthStrategiesFor,
   readKeyInput,
   renderActions,
   renderProviderHeader,
   renderTopMenu,
+  resolveAuditSink,
   resolveOAuthKind,
   runAuthLocal,
   runOAuthLoginKind,
   runOAuthLoginMenu,
   validateFamily
-} from "./chunk-FSZ5QU3M.js";
+} from "./chunk-RDHFXOJM.js";
 import {
   renderAuthLocalHelpToString,
   wantsLocalHelp
@@ -29,7 +31,7 @@ import {
 } from "./chunk-YMXXOOFN.js";
 import {
   parseAuthFlags
-} from "./chunk-EK2P53GL.js";
+} from "./chunk-C3Z4N6A6.js";
 import "./chunk-SIGUWXAA.js";
 import "./chunk-DAKVBMD4.js";
 import {
@@ -398,6 +400,7 @@ var authCmd = async (args, deps) => {
     "probe-only",
     "model",
     "m",
+    "audit",
     "help",
     "h"
   ]);
@@ -436,6 +439,9 @@ var authCmd = async (args, deps) => {
       skipKey: has("no-key", "skip-key"),
       noProbe: has("no-probe", "skip-probe"),
       probeOnly: has("probe-only"),
+      // `--audit [target]` → the documented JSONL sink (stdout / stderr /
+      // file). Absent → the no-op logger, so the default stays silent.
+      audit: createAuthAuditLogger(resolveAuditSink(flags.audit)),
       // Bare `--model` (no value, or followed by another flag) clears the
       // allowlist, which is why an empty string is meaningful here.
       ...modelIdx >= 0 ? { models: args[modelIdx + 1]?.startsWith("-") ? "" : args[modelIdx + 1] ?? "" } : {}
@@ -619,4 +625,4 @@ async function runAuthRemove(deps, providerId) {
 export {
   authCmd
 };
-//# sourceMappingURL=auth-3K6EN5JP.js.map
+//# sourceMappingURL=auth-YXK3EDUL.js.map

package/dist/{chunk-EK2P53GL.js → chunk-C3Z4N6A6.js}

@@ -140,7 +140,12 @@ function parseArgs(argv) {
     } else if (a.startsWith("-") && a.length === 2) {
       const short = a.slice(1);
       const expand = { v: "verbose", y: "yes", h: "help" };
-      flags[expand[short] ?? short] = true;
+      const name = expand[short] ?? short;
+      if (!BOOLEAN_FLAGS.has(name) && i + 1 < argv.length && !(argv[i + 1] ?? "").startsWith("-")) {
+        flags[name] = argv[++i] ?? "";
+      } else {
+        flags[name] = true;
+      }
     } else {
       positional.push(a);
     }
@@ -193,7 +198,22 @@ function parseAuthFlags(args) {
       const v = inlineVal !== void 0 ? inlineVal : args[++i];
       if (v)
         out.envVars = v.split(",").map((s) => s.trim()).filter(Boolean);
-    } else if (!a.startsWith("--")) {
+    } else if (key === "--audit") {
+      const next = args[i + 1];
+      if (inlineVal !== void 0) {
+        if (inlineVal) out.audit = inlineVal;
+      } else if (next === void 0 || next.startsWith("-")) {
+        out.audit = true;
+      } else {
+        out.audit = args[++i] ?? "";
+      }
+    } else if (a.startsWith("-")) {
+      const name = a.replace(/^-+/, "").split("=")[0] ?? "";
+      const isBoolean = name === "" || BOOLEAN_FLAGS.has(name);
+      if (!isBoolean && inlineVal === void 0 && i + 1 < args.length && !(args[i + 1] ?? "").startsWith("-")) {
+        i++;
+      }
+    } else {
       out.positional.push(a);
     }
   }
@@ -238,4 +258,4 @@ export {
   parseAuthFlags,
   parseSpawnFlags
 };
-//# sourceMappingURL=chunk-EK2P53GL.js.map
+//# sourceMappingURL=chunk-C3Z4N6A6.js.map

package/dist/{chunk-7K3IJGWC.js → chunk-OJR7K3OI.js}

@@ -1,9 +1,9 @@
 
 // src/subcommands/index.ts
 var loaders = {
-  acp: async () => (await import("./acp-CXLANMEZ.js")).acpCmd,
+  acp: async () => (await import("./acp-IJ55NBMJ.js")).acpCmd,
   init: async () => (await import("./init-DRMMFG2G.js")).initCmd,
-  auth: async () => (await import("./auth-3K6EN5JP.js")).authCmd,
+  auth: async () => (await import("./auth-YXK3EDUL.js")).authCmd,
   update: async () => (await import("./update-5DPB4YD4.js")).updateCmd,
   sessions: async () => (await import("./sessions-config-UL45XKX7.js")).sessionsCmd,
   config: async () => (await import("./sessions-config-UL45XKX7.js")).configCmd,
@@ -16,12 +16,12 @@ var loaders = {
   skills: async () => (await import("./tools-skills-GH24UCBY.js")).skillsCmd,
   providers: async () => (await import("./providers-models-LFNZ5WI7.js")).providersCmd,
   models: async () => (await import("./providers-models-LFNZ5WI7.js")).modelsCmd,
-  mcp: async () => (await import("./mcp-FX7TKPTV.js")).mcpCmd,
+  mcp: async () => (await import("./mcp-DC5WSBOO.js")).mcpCmd,
   plugin: async () => (await import("./plugin-usage-M6KET4OZ.js")).pluginCmd,
   plugins: async () => (await import("./plugin-usage-M6KET4OZ.js")).pluginCmd,
-  diag: async () => (await import("./diag-doctor-PCER6KHH.js")).diagCmd,
-  doctor: async () => (await import("./diag-doctor-PCER6KHH.js")).doctorCmd,
-  "proxy-status": async () => (await import("./diag-doctor-PCER6KHH.js")).proxyCmd,
+  diag: async () => (await import("./diag-doctor-ANPRUYFM.js")).diagCmd,
+  doctor: async () => (await import("./diag-doctor-ANPRUYFM.js")).doctorCmd,
+  "proxy-status": async () => (await import("./diag-doctor-ANPRUYFM.js")).proxyCmd,
   export: async () => (await import("./export-VVRIOWFV.js")).exportCmd,
   usage: async () => (await import("./plugin-usage-M6KET4OZ.js")).usageCmd,
   version: async () => (await import("./version-help-WXI42PZ3.js")).versionCmd,
@@ -31,7 +31,7 @@ var loaders = {
   quick: async () => (await import("./quick-CNB4Z3HS.js")).quickCmd,
   bench: async () => (await import("./bench-YBU6BVQP.js")).benchCmd,
   chronicle: async () => (await import("./chronicle-UTFETHP6.js")).chronicleCmd,
-  hq: async () => (await import("./hq-DQTUE7RC.js")).hqCmd,
+  hq: async () => (await import("./hq-NO2NWGU4.js")).hqCmd,
   mailbox: async () => (await import("./mailbox-serve-X3CR6VFW.js")).mailboxServeCmd,
   permissions: async () => (await import("./permissions-CFDLXETM.js")).permissionsCmd,
   project: async () => (await import("./project-AOQI5XTK.js")).projectCmd,
@@ -51,4 +51,4 @@ export {
   subcommands,
   subcommandNames
 };
-//# sourceMappingURL=chunk-7K3IJGWC.js.map
+//# sourceMappingURL=chunk-OJR7K3OI.js.map

package/dist/{chunk-SXJTVNWF.js → chunk-OWNC7LMD.js}

@@ -58,7 +58,7 @@ async function runGit(args, cwd) {
       child.on("error", (err) => {
         reject(new Error(`Failed to run git: ${err.message}`));
       });
-      child.on("close", (code) => resolve({ stdout, stderr, code: code ?? 0 }));
+      child.on("close", (code) => resolve({ stdout, stderr, code: code ?? 1 }));
     });
   } catch (err) {
     throw new Error(toErrorMessage(err));
@@ -75,4 +75,4 @@ export {
   normalizeTuiThinkingWord,
   runGit
 };
-//# sourceMappingURL=chunk-SXJTVNWF.js.map
+//# sourceMappingURL=chunk-OWNC7LMD.js.map

package/dist/{chunk-FSZ5QU3M.js → chunk-RDHFXOJM.js}

@@ -20,6 +20,156 @@ import {
   writeKeysBack
 } from "./chunk-DR2OXU46.js";
 
+// src/auth-menu/auth-menu-audit.ts
+import { appendFileSync } from "node:fs";
+import { DefaultSecretScrubber } from "@wrongstack/core/security";
+function defaultStdoutSink() {
+  return {
+    write(line) {
+      process.stdout.write(`${line}
+`);
+    }
+  };
+}
+function defaultStderrSink() {
+  return {
+    write(line) {
+      process.stderr.write(`${line}
+`);
+    }
+  };
+}
+function fileAuditSink(path) {
+  return {
+    write(line) {
+      appendFileSync(path, `${line}
+`, { encoding: "utf8", mode: 384 });
+    }
+  };
+}
+function resolveAuditSink(flag) {
+  if (flag === void 0) return void 0;
+  if (flag === true || flag === "stdout") return defaultStdoutSink();
+  if (flag === "stderr") return defaultStderrSink();
+  if (typeof flag !== "string") return void 0;
+  return fileAuditSink(flag);
+}
+var NOOP_AUDIT_LOGGER = {
+  emit: () => {
+  }
+};
+function createAuthAuditLogger(sink, scrubber = new DefaultSecretScrubber()) {
+  if (!sink) return NOOP_AUDIT_LOGGER;
+  return {
+    emit(event) {
+      const scrubbed = scrubEvent(event, scrubber);
+      sink.write(JSON.stringify(scrubbed));
+    }
+  };
+}
+function scrubEvent(event, scrubber) {
+  switch (event.type) {
+    case "auth.local.add":
+      return {
+        type: "auth.local.add",
+        providerId: scrubber.scrub(event.providerId),
+        baseUrl: scrubber.scrub(event.baseUrl),
+        models: event.models.map((m) => scrubber.scrub(m)),
+        ...event.keyLabel !== void 0 ? { keyLabel: scrubber.scrub(event.keyLabel) } : {}
+      };
+    case "auth.local.clear":
+      return {
+        type: "auth.local.clear",
+        providerId: scrubber.scrub(event.providerId),
+        baseUrl: scrubber.scrub(event.baseUrl),
+        previousModels: event.previousModels.map((m) => scrubber.scrub(m))
+      };
+    case "auth.local.undo":
+      return {
+        type: "auth.local.undo",
+        providerId: scrubber.scrub(event.providerId),
+        baseUrl: scrubber.scrub(event.baseUrl),
+        restoredModels: event.restoredModels.map((m) => scrubber.scrub(m))
+      };
+    case "auth.local.probe_skip":
+      return {
+        type: "auth.local.probe_skip",
+        providerId: scrubber.scrub(event.providerId),
+        baseUrl: scrubber.scrub(event.baseUrl),
+        requestedShape: scrubber.scrub(event.requestedShape)
+      };
+    case "auth.local.probe_failed_save":
+      return {
+        type: "auth.local.probe_failed_save",
+        providerId: scrubber.scrub(event.providerId),
+        baseUrl: scrubber.scrub(event.baseUrl),
+        probeStatus: scrubber.scrub(event.probeStatus),
+        ...event.probeDetail !== void 0 ? { probeDetail: scrubber.scrub(event.probeDetail) } : {}
+      };
+  }
+}
+function decideAuthLocalEvents(opts) {
+  const events = [];
+  if (opts.probeSkip) {
+    events.push({
+      type: "auth.local.probe_skip",
+      providerId: opts.providerId,
+      baseUrl: opts.baseUrl,
+      requestedShape: opts.probeSkip.shape
+    });
+  }
+  if (opts.probeFailedSave) {
+    events.push({
+      type: "auth.local.probe_failed_save",
+      providerId: opts.providerId,
+      baseUrl: opts.baseUrl,
+      probeStatus: opts.probeFailedSave.status,
+      ...opts.probeFailedSave.detail !== void 0 ? { probeDetail: opts.probeFailedSave.detail } : {}
+    });
+  }
+  if (opts.newModels === null) return events;
+  const hadPriorAllowlist = opts.previousModels !== void 0 && opts.previousModels.length > 0;
+  if (hadPriorAllowlist && opts.newModels.length === 0) {
+    events.push({
+      type: "auth.local.clear",
+      providerId: opts.providerId,
+      baseUrl: opts.baseUrl,
+      previousModels: opts.previousModels
+    });
+    return events;
+  }
+  if (!hadPriorAllowlist && opts.newModels.length > 0) {
+    if (opts.previousModels !== void 0) {
+      events.push({
+        type: "auth.local.undo",
+        providerId: opts.providerId,
+        baseUrl: opts.baseUrl,
+        restoredModels: [...opts.newModels]
+      });
+    } else {
+      events.push({
+        type: "auth.local.add",
+        providerId: opts.providerId,
+        baseUrl: opts.baseUrl,
+        models: [...opts.newModels],
+        ...opts.keyLabel !== void 0 ? { keyLabel: opts.keyLabel } : {}
+      });
+    }
+    return events;
+  }
+  if (hadPriorAllowlist && opts.newModels.length > 0) {
+    events.push({
+      type: "auth.local.add",
+      providerId: opts.providerId,
+      baseUrl: opts.baseUrl,
+      models: [...opts.newModels],
+      ...opts.keyLabel !== void 0 ? { keyLabel: opts.keyLabel } : {}
+    });
+    return events;
+  }
+  return events;
+}
+
 // src/auth-menu/provider-auth-login.ts
 import { color } from "@wrongstack/core/utils";
 import {
@@ -139,74 +289,6 @@ import { DefaultSecretScrubber as DefaultSecretScrubber2 } from "@wrongstack/cor
 import { color as color3 } from "@wrongstack/core/utils";
 import { probeLocalLlm } from "@wrongstack/runtime/probe";
 
-// src/auth-menu/auth-menu-audit.ts
-import { DefaultSecretScrubber } from "@wrongstack/core/security";
-var NOOP_AUDIT_LOGGER = {
-  emit: () => {
-  }
-};
-function decideAuthLocalEvents(opts) {
-  const events = [];
-  if (opts.probeSkip) {
-    events.push({
-      type: "auth.local.probe_skip",
-      providerId: opts.providerId,
-      baseUrl: opts.baseUrl,
-      requestedShape: opts.probeSkip.shape
-    });
-  }
-  if (opts.probeFailedSave) {
-    events.push({
-      type: "auth.local.probe_failed_save",
-      providerId: opts.providerId,
-      baseUrl: opts.baseUrl,
-      probeStatus: opts.probeFailedSave.status,
-      ...opts.probeFailedSave.detail !== void 0 ? { probeDetail: opts.probeFailedSave.detail } : {}
-    });
-  }
-  if (opts.newModels === null) return events;
-  const hadPriorAllowlist = opts.previousModels !== void 0 && opts.previousModels.length > 0;
-  if (hadPriorAllowlist && opts.newModels.length === 0) {
-    events.push({
-      type: "auth.local.clear",
-      providerId: opts.providerId,
-      baseUrl: opts.baseUrl,
-      previousModels: opts.previousModels
-    });
-    return events;
-  }
-  if (!hadPriorAllowlist && opts.newModels.length > 0) {
-    if (opts.previousModels !== void 0) {
-      events.push({
-        type: "auth.local.undo",
-        providerId: opts.providerId,
-        baseUrl: opts.baseUrl,
-        restoredModels: [...opts.newModels]
-      });
-    } else {
-      events.push({
-        type: "auth.local.add",
-        providerId: opts.providerId,
-        baseUrl: opts.baseUrl,
-        models: [...opts.newModels],
-        ...opts.keyLabel !== void 0 ? { keyLabel: opts.keyLabel } : {}
-      });
-    }
-    return events;
-  }
-  if (hadPriorAllowlist && opts.newModels.length > 0) {
-    events.push({
-      type: "auth.local.add",
-      providerId: opts.providerId,
-      baseUrl: opts.baseUrl,
-      models: [...opts.newModels],
-      ...opts.keyLabel !== void 0 ? { keyLabel: opts.keyLabel } : {}
-    });
-    return events;
-  }
-  return events;
-}
-
 // src/auth-menu/helpers.ts
 async function loadProviders(deps) {
   return loadConfigProviders(deps.profileConfigPath, deps.vault, {
@@ -1785,6 +1867,8 @@ async function promptForLabel(deps, usedLabels) {
 }
 
 export {
+  resolveAuditSink,
+  createAuthAuditLogger,
   loadProviders,
   renderProviderHeader,
   renderActions,
@@ -1813,4 +1897,4 @@ export {
   addCustomProvider,
   addKeyForProvider
 };
-//# sourceMappingURL=chunk-FSZ5QU3M.js.map
+//# sourceMappingURL=chunk-RDHFXOJM.js.map

package/dist/{chunk-5VPDKQDH.js → chunk-TNZBQG45.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-6WRKAACA.js";
 import {
   parseArgs
-} from "./chunk-EK2P53GL.js";
+} from "./chunk-C3Z4N6A6.js";
 
 // src/boot/short-circuit-flags.ts
 async function handleHelpVersionShortCircuit(argv) {
@@ -22,7 +22,7 @@ async function handleHelpVersionShortCircuit(argv) {
   }
   if (earlyFlags["help"] === true) {
     if (positional.length > 0) {
-      const { subcommandNames } = await import("./subcommands-UXWY3OPC.js");
+      const { subcommandNames } = await import("./subcommands-EJI7DBQS.js");
       if (subcommandNames.includes(positional[0])) {
         const first = positional[0];
         const deep = positional[1];
@@ -43,4 +43,4 @@ async function handleHelpVersionShortCircuit(argv) {
 export {
   handleHelpVersionShortCircuit
 };
-//# sourceMappingURL=chunk-5VPDKQDH.js.map
+//# sourceMappingURL=chunk-TNZBQG45.js.map