@wrongstack/cli 1.1.1 → 1.1.4

package/dist/{execution-BAP566QC.js → execution-OK34CJKJ.js}

@@ -61,6 +61,9 @@ import {
   startCliHqConnection
 } from "./chunk-76JE54WD.js";
 import "./chunk-OZCYZYN2.js";
+import {
+  confirmAcpLeaderThroughEvents
+} from "./chunk-GKGWPFW2.js";
 import {
   CLI_VERSION
 } from "./chunk-HKMOIIPQ.js";
@@ -5266,8 +5269,9 @@ async function runWebUIDispatch(ctx) {
   const isSessionChild = Boolean(webuiSessionChild);
   const isSimpleUi = !isSessionChild && flags["simpleui"] === true;
   agent.disableInteractiveConfirmation();
+  confirmAcpLeaderThroughEvents();
   renderer.setSilent(true);
-  const { runWebUI } = await import("./webui-server-HIUY3RHD.js");
+  const { runWebUI } = await import("./webui-server-CB64CFDG.js");
   const flagValue = (names) => {
     for (const name of names) {
       if (!Object.hasOwn(flags, name)) continue;
@@ -7192,6 +7196,7 @@ async function execute(deps) {
       });
     } else if (executionMode === "tui") {
       agent.disableInteractiveConfirmation();
+      confirmAcpLeaderThroughEvents();
       const state = {
         projectRoot,
         wpaths,
@@ -7579,4 +7584,4 @@ export {
   execute,
   resolveReviewerFallbackModels
 };
-//# sourceMappingURL=execution-BAP566QC.js.map
+//# sourceMappingURL=execution-OK34CJKJ.js.map

package/dist/fleet/acp-live-steer.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Live notes to a running external ACP worker.
+ *
+ * A WrongStack agent registers in the session note hub and folds notes in at
+ * its next iteration. An external agent (Claude Code over ACP) has no such
+ * loop, so while its turn runs this registers an inbox for it that injects
+ * each note into the turn through the agent's steering extension. The leader
+ * then reaches the worker with `session_note`, as it reaches its own workers.
+ */
+import type { AcpSteerOutcome } from '@wrongstack/acp';
+import { type SessionNoteHub } from '@wrongstack/core/coordination';
+import type { SubagentRunContext, TaskSpec } from '@wrongstack/core/types';
+interface Note {
+    from: string;
+    kind: string;
+    body: string;
+    subject?: string | undefined;
+}
+/** The note as the worker reads it: who sent it, as what, then the text. */
+export declare function steerMessage(note: Note): string;
+/**
+ * Register `ctx.subagentId` (and its display name) as a live agent of the
+ * delegating session for the length of the turn. Returns the unregister, or
+ * undefined when no WrongStack session delegated the task.
+ */
+export declare function registerAcpSteerInbox(ctx: SubagentRunContext, _task: TaskSpec, steer: (text: string) => Promise<AcpSteerOutcome>, hub?: Pick<SessionNoteHub, 'register'>, onUndelivered?: (outcome: string) => void): (() => void) | undefined;
+export {};
+//# sourceMappingURL=acp-live-steer.d.ts.map

package/dist/fleet/acp-permission-bridge.d.ts

@@ -0,0 +1,49 @@
+/**
+ * WrongStack's permission rules for an external ACP worker.
+ *
+ * A delegated agent must not be a one-hop bypass of the user's approval
+ * system. WrongStack's own subagents run every tool call through
+ * `AutoApprovePermissionPolicy`: the user's deny rules bind them, destructive
+ * commands and credential reads are refused (a worker cannot ask), and the
+ * user's YOLO+ lifts those refusals. An ACP worker gets the same treatment:
+ * the host starts it in a mode where it asks before edits, commands and
+ * fetches, and each `session/request_permission` is translated into the
+ * matching WrongStack tool call and decided by that policy. A request it
+ * cannot evaluate — an unknown kind, a call naming no target, a tool the run
+ * does not have — is refused, never waved through.
+ */
+import type { PermissionPolicy as AcpPermissionPolicy } from '@wrongstack/acp';
+import type { PermissionDecision, Tool } from '@wrongstack/core/types';
+/** The WrongStack tool call an ACP permission request stands for. */
+export interface WrongStackCall {
+    tool: string;
+    input: Record<string, unknown>;
+}
+export interface AcpPermissionBridgeOptions {
+    /** WrongStack's subagent policy (an `AutoApprovePermissionPolicy`). */
+    evaluate: (tool: Tool, input: unknown, ctx: {
+        projectRoot: string;
+        cwd: string;
+    }) => Promise<PermissionDecision>;
+    /** Resolve a WrongStack tool by name (the host's tool registry). */
+    getTool: (name: string) => Tool | undefined;
+    projectRoot: string;
+    /**
+     * Whether MCP tools may run at all. False under `--restricted`, which keeps
+     * MCP tools out of the registry and so out of a worker's reach too.
+     */
+    allowMcp?: boolean | undefined;
+    /**
+     * Ask the user when the policy wants a question (`confirm`). A worker has
+     * no one to ask, so without this a `confirm` is refused; a leader runs in
+     * front of the user and passes the session's own confirmation prompt.
+     */
+    confirm?: ((tool: Tool, call: WrongStackCall, request: {
+        toolCallId: string | undefined;
+        signal: AbortSignal;
+    }) => Promise<boolean>) | undefined;
+    /** Told about every refusal, for the host's log. */
+    onRefused?: ((call: WrongStackCall, reason: string) => void) | undefined;
+}
+export declare function wrongstackAcpPermissionPolicy(opts: AcpPermissionBridgeOptions): AcpPermissionPolicy;
+//# sourceMappingURL=acp-permission-bridge.d.ts.map

package/dist/fleet/acp-quota-hold.d.ts

@@ -0,0 +1,3 @@
+/** Run `start` unless `agentId` is held; record a hold when it fails on quota. */
+export declare function runWithQuotaHold<T>(agentId: string, start: () => Promise<T>, now?: () => number): Promise<T>;
+//# sourceMappingURL=acp-quota-hold.d.ts.map

package/dist/fleet/acp-quota-reading.d.ts

@@ -0,0 +1,3 @@
+/** Record one rate-limit reading from `agentId`; ignores readings it cannot read. */
+export declare function recordAcpRateLimit(agentId: string, info: Record<string, unknown>, now?: number): void;
+//# sourceMappingURL=acp-quota-reading.d.ts.map

package/dist/fleet/acp-turn-reminders.d.ts

@@ -0,0 +1,15 @@
+/** Remind an active ACP turn about local /btw notes and newly waiting mail. */
+import { type Context } from '@wrongstack/core/agent';
+type Steer = (text: string) => Promise<'injected' | 'promptRequired' | 'startedNewTurn' | 'unsupported'>;
+export interface AcpTurnRemindersOptions {
+    steer: Steer;
+    context?: Context | undefined;
+    unreadCount?: (() => Promise<number>) | undefined;
+    btwPollMs?: number | undefined;
+    mailPollMs?: number | undefined;
+}
+/** Mailbox awareness embeds message bodies; ask ACP to read inbox instead. */
+export declare function acpBtwBlock(notes: readonly string[]): string;
+export declare function startAcpTurnReminders(options: AcpTurnRemindersOptions): () => void;
+export {};
+//# sourceMappingURL=acp-turn-reminders.d.ts.map

package/dist/fleet/acp-wrongstack-bridge.d.ts

@@ -0,0 +1,42 @@
+import { type AcpSessionSetup } from '@wrongstack/acp';
+import type { Config, SubagentRunContext, TaskSpec } from '@wrongstack/core/types';
+export type BridgeServer = 'sage' | 'mailbox' | 'kanban' | 'codebase-index' | 'requirement-intake';
+export declare const DEFAULT_BRIDGE_AGENTS: readonly string[];
+export declare const DEFAULT_BRIDGE_SERVERS: readonly BridgeServer[];
+type BridgeConfig = NonNullable<NonNullable<Config['acp']>['bridge']>;
+/** How to start this same `wstack`: the binary itself, or node/bun + the CLI entry. */
+export declare function wstackLaunch(args: string[], entry?: string | undefined): {
+    command: string;
+    args: string[];
+};
+/** A short task-local cue: the Claude adapter gives user-turn text more immediate weight. */
+export declare function bridgeTaskKickoff(servers: readonly BridgeServer[]): string;
+/**
+ * The note appended to the worker's system prompt. It must not vary per task
+ * or per worker: the system prompt is the head of the agent's prompt cache, so
+ * a task id or worker id in it made every worker rewrite ~25k cached tokens
+ * (measured: $0.21 per one-line task, against $0.008 with a stable prompt).
+ * Per-worker identity lives in the MCP servers' arguments instead.
+ */
+export declare function bridgeNote(servers: readonly BridgeServer[], delegated?: boolean): string;
+/**
+ * The note for an agent running as the session's LEADER: the user talks to it
+ * through WrongStack, so it answers them directly and ends a turn the way
+ * WrongStack's own leader does, with next steps the user can send back.
+ */
+export declare function leaderBridgeNote(servers: readonly BridgeServer[]): string;
+/** True when `command` resolves to a file on PATH (PATHEXT-aware on Windows). */
+export declare function onPath(command: string, env?: NodeJS.ProcessEnv, platform?: NodeJS.Platform): boolean;
+/**
+ * Bridged agents the leader can hand a task to on this machine: listed in
+ * `acp.bridge.agents` (by catalog or registry id) and either configured by
+ * the user in `acp.agents` or with their CLI on PATH. Catalog ids, in order.
+ */
+export declare function installedBridgeAgents(acp: Config['acp'] | undefined, isOnPath?: (command: string) => boolean): string[];
+/**
+ * The per-session setup for `agentId`, or undefined when the bridge does not
+ * apply to it (not listed, turned off, or no servers).
+ */
+export declare function wrongstackBridgeSetup(agentId: string, projectRoot: string, config: BridgeConfig | undefined, role?: 'worker' | 'leader'): ((task: TaskSpec, ctx: SubagentRunContext) => AcpSessionSetup) | undefined;
+export {};
+//# sourceMappingURL=acp-wrongstack-bridge.d.ts.map

package/dist/fleet/host-acp.d.ts

@@ -1,10 +1,28 @@
-import { type ACPProgressEvent, type AcpAgentCommandOverrides, type AcpLiveCatalog } from '@wrongstack/acp';
-import type { SubagentRunContext, SubagentRunner, TaskSpec } from '@wrongstack/core/types';
+import { type ACPProgressEvent, type AcpAgentCommandOverrides, type AcpLiveCatalog, type PermissionPolicy as AcpPermissionPolicy } from '@wrongstack/acp';
+import type { Config, SubagentRunContext, SubagentRunner, TaskSpec } from '@wrongstack/core/types';
 export type AcpLivePublisher = (ctx: SubagentRunContext, task: TaskSpec, event: ACPProgressEvent) => void;
 export interface BuildAcpSubagentRunnerOptions {
+    /**
+     * The project the worker works in: its cwd and file-access root. Without it
+     * the worker ran in the host process's cwd — a subdirectory, or another
+     * repository than the session's.
+     */
+    projectRoot?: string | undefined;
     overrides?: AcpAgentCommandOverrides | undefined;
     live?: AcpLiveCatalog | undefined;
     publishLive?: AcpLivePublisher | undefined;
+    /** Project the worker runs in, plus `acp.bridge` config: see acp-wrongstack-bridge.ts. */
+    bridge?: {
+        projectRoot: string;
+        config?: NonNullable<Config['acp']>['bridge'] | undefined;
+    } | undefined;
+    /**
+     * WrongStack's permission rules for the worker's session (see
+     * acp-permission-bridge.ts). When set, the worker is also started in its
+     * `default` mode so it asks before edits and commands, whatever mode the
+     * user runs the agent in on their own.
+     */
+    permissions?: ((ctx: SubagentRunContext) => AcpPermissionPolicy) | undefined;
 }
 /**
  * Same command resolution as `wstack acp spawn` / `/acp` — user override,

package/dist/index.js

@@ -6,6 +6,9 @@ import {
 import {
   parseArgs
 } from "./chunk-75OLD563.js";
+import {
+  closeAcpLeaderSessions
+} from "./chunk-GKGWPFW2.js";
 import {
   CLI_VERSION
 } from "./chunk-HKMOIIPQ.js";
@@ -122,7 +125,7 @@ async function main(argv) {
     applyAsciiMode(earlyFlags);
   }
   if (earlyFlags["help"] === true || earlyFlags["version"] === true) {
-    const { handleHelpVersionShortCircuit } = await import("./short-circuit-flags-CPCT5MWB.js");
+    const { handleHelpVersionShortCircuit } = await import("./short-circuit-flags-QEXUS3BY.js");
     const earlyExit = await handleHelpVersionShortCircuit(argv);
     if (earlyExit !== null) return earlyExit;
   }
@@ -131,7 +134,7 @@ async function main(argv) {
     shouldCaptureTuiStartup(parsed.flags, parsed.positional)
   );
   try {
-    const { initializeCli } = await import("./cli-context-A6XDEXN5.js");
+    const { initializeCli } = await import("./cli-context-E44HQ4ZO.js");
     const cliCtx = await initializeCli(argv, {
       onNonTuiLaunch: () => startupOutput.stop()
     });
@@ -141,7 +144,7 @@ async function main(argv) {
     } else {
       startupOutput.stop();
     }
-    const { runInteractive } = await import("./cli-main-5UGSW4TO.js");
+    const { runInteractive } = await import("./cli-main-OT63I2FX.js");
     return await runInteractive(cliCtx);
   } finally {
     startupOutput.stop();
@@ -252,7 +255,7 @@ function runCliProcess(mainFn) {
   mainFn(process.argv.slice(2)).then(
     (c) => {
       process.exitCode = c;
-      scheduleForcedExit(c);
+      void closeAcpLeaderSessions().finally(() => scheduleForcedExit(c));
     },
     (err) => {
       runFatalSalvageSync();

package/dist/{mcp-2XWBJEQN.js → mcp-W7A5HUXV.js}

@@ -345,12 +345,108 @@ async function serveMcpStdio(deps, positional) {
   return 0;
 }
 
+// src/mcp-serve-project.ts
+var PROJECT_MCP_SERVERS = [
+  "mailbox",
+  "kanban",
+  "codebase-index",
+  "requirement-intake",
+  "sage"
+];
+function isProjectMcpServer(value) {
+  return PROJECT_MCP_SERVERS.includes(value);
+}
+var SERVER_FLAGS = [
+  "project-root",
+  "actor",
+  "session-id",
+  "name",
+  "role",
+  "writable",
+  "admin",
+  "destructive",
+  "http",
+  "stdio",
+  "port",
+  "host",
+  "token",
+  "index-dir",
+  "origin",
+  "watch"
+];
+var SWITCHES = /* @__PURE__ */ new Set([
+  "--writable",
+  "--admin",
+  "--destructive",
+  "--http",
+  "--stdio",
+  "--watch"
+]);
+function normalizeSwitches(args) {
+  const out = [];
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i];
+    const eq = arg.indexOf("=");
+    const flag = eq === -1 ? arg : arg.slice(0, eq);
+    if (!SWITCHES.has(flag)) {
+      out.push(arg);
+      continue;
+    }
+    const value = eq === -1 ? void 0 : arg.slice(eq + 1);
+    if (value === "false") continue;
+    out.push(flag);
+    if (eq === -1 && args[i + 1] === "true") i++;
+  }
+  return out;
+}
+function optionValue(args, name) {
+  const flag = `--${name}`;
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i];
+    if (arg === flag) {
+      const next = args[i + 1];
+      return next !== void 0 && !next.startsWith("--") ? next : void 0;
+    }
+    if (arg.startsWith(`${flag}=`)) return arg.slice(flag.length + 1);
+  }
+  return void 0;
+}
+async function serveProjectMcp(server, rawArgs, deps) {
+  const args = normalizeSwitches(restoreFlags(rawArgs, deps, SERVER_FLAGS));
+  if (server === "sage") {
+    const { serveAttachedSageMcpStdio } = await import("@wrongstack/sage-mcp");
+    await serveAttachedSageMcpStdio({
+      // A client may start this server from any directory; an explicit root wins.
+      projectRoot: optionValue(args, "project-root") ?? deps.projectRoot,
+      directory: deps.config.Sage?.storage?.directory,
+      origin: optionValue(args, "origin")?.trim() || "mcp-client"
+    });
+    return 0;
+  }
+  const argv = optionValue(args, "project-root") === void 0 ? [...args, "--project-root", deps.projectRoot] : args;
+  if (server === "mailbox") {
+    const { runMailboxMcpServer } = await import("@wrongstack/mailbox-mcp");
+    return runMailboxMcpServer(argv);
+  }
+  if (server === "kanban") {
+    const { runKanbanMcpServer } = await import("@wrongstack/kanban-mcp");
+    return runKanbanMcpServer(argv);
+  }
+  if (server === "requirement-intake") {
+    const { runRequirementIntakeMcpServer } = await import("@wrongstack/requirement-intake-mcp");
+    return runRequirementIntakeMcpServer(argv);
+  }
+  const { runCodebaseIndexMcpServer } = await import("@wrongstack/codebase-index-mcp");
+  return runCodebaseIndexMcpServer(argv);
+}
+
 // src/subcommands/handlers/mcp.ts
 var BUILT_IN_MCP = allServers();
 var mcpCmd = async (args, deps) => {
   args = restoreFlags(args, deps, ["enable", "e", "transport", "url", "command"]);
   const sub = args[0];
   if (sub === "serve") {
+    if (isProjectMcpServer(args[1])) return serveProjectMcp(args[1], args.slice(2), deps);
     return serveMcpStdio(deps, args.slice(1));
   }
   if (!sub || sub === "list") {
@@ -461,4 +557,4 @@ function isRecord(value) {
 export {
   mcpCmd
 };
-//# sourceMappingURL=mcp-2XWBJEQN.js.map
+//# sourceMappingURL=mcp-W7A5HUXV.js.map

package/dist/mcp-serve-project.d.ts

@@ -0,0 +1,18 @@
+/**
+ * `wstack mcp serve <mailbox|kanban|codebase-index|requirement-intake|sage>` — run one of
+ * WrongStack's project MCP servers from inside `wstack` itself.
+ *
+ * Mailbox, Kanban, Codebase Index and Requirements Intake also ship as their own npm bins
+ * (`wstack-mailbox-mcp`, …), but the standalone binary carries none of them,
+ * so this is the launch path that works in every install. Each server is bound
+ * to one project: `--project-root` defaults to the project this command runs
+ * in, and every server only attaches to that project's running owner.
+ *
+ * stdout is the JSON-RPC channel; everything else goes to stderr.
+ */
+import type { SubcommandDeps } from './subcommands/contracts.js';
+export declare const PROJECT_MCP_SERVERS: readonly ['mailbox', 'kanban', 'codebase-index', 'requirement-intake', 'sage'];
+export type ProjectMcpServer = (typeof PROJECT_MCP_SERVERS)[number];
+export declare function isProjectMcpServer(value: string | undefined): value is ProjectMcpServer;
+export declare function serveProjectMcp(server: ProjectMcpServer, rawArgs: string[], deps: SubcommandDeps): Promise<number>;
+//# sourceMappingURL=mcp-serve-project.d.ts.map

package/dist/{per-subcommand-help-D6J4ZXW2.js → per-subcommand-help-4GYSCMLU.js}

@@ -7,7 +7,7 @@ import {
   renderFocusedHelpToString,
   renderGenericHelp,
   subcommandsWithFocusedHelp
-} from "./chunk-3R3OADC5.js";
+} from "./chunk-ZF4HRR5F.js";
 import "./chunk-ZXX3MJRL.js";
 import "./chunk-W23PY4IJ.js";
 export {
@@ -20,4 +20,4 @@ export {
   renderGenericHelp,
   subcommandsWithFocusedHelp
 };
-//# sourceMappingURL=per-subcommand-help-D6J4ZXW2.js.map
+//# sourceMappingURL=per-subcommand-help-4GYSCMLU.js.map

package/dist/{short-circuit-flags-CPCT5MWB.js → short-circuit-flags-QEXUS3BY.js}

@@ -1,6 +1,6 @@
 import {
   handleHelpVersionShortCircuit
-} from "./chunk-NMXQFQ26.js";
+} from "./chunk-TAE3EGBM.js";
 import "./chunk-75OLD563.js";
 import "./chunk-6VPWQ4TG.js";
 import "./chunk-HKMOIIPQ.js";
@@ -8,4 +8,4 @@ import "./chunk-W23PY4IJ.js";
 export {
   handleHelpVersionShortCircuit
 };
-//# sourceMappingURL=short-circuit-flags-CPCT5MWB.js.map
+//# sourceMappingURL=short-circuit-flags-QEXUS3BY.js.map

package/dist/{subcommands-VTMIZQBP.js → subcommands-YADUV7IJ.js}

@@ -1,10 +1,10 @@
 import {
   subcommandNames,
   subcommands
-} from "./chunk-GRAGMA4B.js";
+} from "./chunk-2LTHDKZX.js";
 import "./chunk-W23PY4IJ.js";
 export {
   subcommandNames,
   subcommands
 };
-//# sourceMappingURL=subcommands-VTMIZQBP.js.map
+//# sourceMappingURL=subcommands-YADUV7IJ.js.map

package/dist/{webui-server-HIUY3RHD.js → webui-server-CB64CFDG.js}

@@ -14,14 +14,19 @@ import {
 import {
   createHqCommandDispatcher,
   createProjectKanbanAssignHandler,
-  createProjectKanbanTransitionHandler
-} from "./chunk-XT3NAHRX.js";
+  createProjectKanbanTransitionHandler,
+  installedBridgeAgents
+} from "./chunk-JKTJSLUT.js";
 import {
   startCliHqConnection
 } from "./chunk-76JE54WD.js";
 import {
   WebSocketServer
 } from "./chunk-OZCYZYN2.js";
+import {
+  ACP_LEADER_PROVIDER_ID,
+  setAcpLeaderSessionAgents
+} from "./chunk-GKGWPFW2.js";
 import {
   CLI_VERSION
 } from "./chunk-HKMOIIPQ.js";
@@ -1092,6 +1097,33 @@ import {
   createEmbeddedProviderOperations
 } from "@wrongstack/webui-server";
 
+// src/acp-leader/acp-leader-picker.ts
+import { findAgentDescriptor } from "@wrongstack/acp";
+function acpLeaderPickable(config) {
+  const agents = installedBridgeAgents(config?.acp);
+  if (agents.length === 0) return [];
+  return [
+    {
+      id: ACP_LEADER_PROVIDER_ID,
+      type: ACP_LEADER_PROVIDER_ID,
+      models: agents.map((id) => {
+        const descriptor = findAgentDescriptor(id);
+        return {
+          id,
+          name: descriptor?.displayName ?? id,
+          description: "ACP agent leading the session",
+          ...descriptor?.contextWindow ? { contextWindow: descriptor.contextWindow } : {}
+        };
+      })
+    }
+  ];
+}
+function buildAcpLeaderProvider(registry, providerId, config) {
+  const type = config.type ?? providerId;
+  if (type !== ACP_LEADER_PROVIDER_ID || !registry?.has(type)) return void 0;
+  return registry.create({ ...config, type: providerId }, type);
+}
+
 // src/webui-server/credential-watcher.ts
 import { TOKENS } from "@wrongstack/core/kernel";
 import { watchProviderConfig } from "@wrongstack/core/storage";
@@ -1175,6 +1207,9 @@ function createEmbeddedProviderPlane(input) {
     providerAuthRegistry: opts.providerAuthRegistry,
     getDisabledModels: () => opts.appConfig?.disabledModels ?? [],
     getDisabledProviders: () => opts.appConfig?.disabledProviders ?? [],
+    // `acp` with the installed ACP agents: an agent such as Claude Code can
+    // lead a tab like a model (see docs/slash/acp.md).
+    hostProviders: () => acpLeaderPickable(opts.appConfig),
     send,
     broadcast,
     log: (m) => console.log(m)
@@ -1308,6 +1343,8 @@ function createWebuiRouteContexts({
     getConfig: () => opts.appConfig,
     onMaxContextResolved: opts.onModelContextResolved,
     persistPrefs,
+    // The ACP leader's factory lives in the CLI's provider registry.
+    buildProvider: (providerId, config) => buildAcpLeaderProvider(opts.agent.providers, providerId, config),
     send,
     broadcast,
     log: (m) => console.log(m)
@@ -2302,6 +2339,7 @@ async function runWebUI(opts) {
     abortControllers
   );
   sessionAgentsRef = sessionAgents;
+  setAcpLeaderSessionAgents((sessionId) => sessionAgents.peek(sessionId));
   const autoWakeHost = opts.leaderAutoWake ? createWebuiLeaderAutoWakeHost({
     controller: opts.leaderAutoWake,
     events: opts.events,
@@ -2458,4 +2496,4 @@ async function runWebUI(opts) {
 export {
   runWebUI
 };
-//# sourceMappingURL=webui-server-HIUY3RHD.js.map
+//# sourceMappingURL=webui-server-CB64CFDG.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrongstack/cli",
-  "version": "1.1.1",
+  "version": "1.1.4",
   "license": "MIT",
   "description": "WrongStack CLI — terminal AI coding agent with provider catalog from models.dev. Provides `wrongstack` and `wstack` binaries.",
   "keywords": [
@@ -48,42 +48,46 @@
     "clean": "bun -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\""
   },
   "dependencies": {
-    "@wrongstack/acp": "1.1.0",
-    "@wrongstack/bench": "1.1.0",
-    "@wrongstack/core": "1.1.0",
-    "@wrongstack/kanban": "1.1.0",
-    "@wrongstack/mcp": "1.1.0",
-    "@wrongstack/persistence": "1.1.0",
-    "@wrongstack/plug-lsp": "1.1.0",
-    "@wrongstack/plugins": "1.1.0",
-    "@wrongstack/primitives": "1.1.0",
-    "@wrongstack/providers": "1.1.0",
-    "@wrongstack/requirement-intake": "1.1.0",
-    "@wrongstack/runtime": "1.1.0",
-    "@wrongstack/sage": "1.1.0",
-    "@wrongstack/sage-mcp": "1.1.0",
-    "@wrongstack/sdd": "1.1.0",
-    "@wrongstack/security-scanner": "1.1.0",
-    "@wrongstack/simpleui": "1.1.0",
-    "@wrongstack/techstack": "1.1.0",
-    "@wrongstack/telegram": "1.1.0",
-    "@wrongstack/tools": "1.1.0",
-    "@wrongstack/tui": "1.1.0",
-    "@wrongstack/vector-memory": "1.1.0",
-    "@wrongstack/webui": "1.1.0",
-    "@wrongstack/webui-hq": "1.1.0",
-    "@wrongstack/webui-protocol": "1.1.0",
-    "@wrongstack/webui-server": "1.1.0",
-    "@wrongstack/wrongtrace": "1.1.0",
+    "@wrongstack/acp": "1.1.2",
+    "@wrongstack/bench": "1.1.2",
+    "@wrongstack/codebase-index-mcp": "1.1.2",
+    "@wrongstack/core": "1.1.2",
+    "@wrongstack/kanban": "1.1.2",
+    "@wrongstack/kanban-mcp": "1.1.2",
+    "@wrongstack/mailbox-mcp": "1.1.2",
+    "@wrongstack/mcp": "1.1.2",
+    "@wrongstack/persistence": "1.1.2",
+    "@wrongstack/plug-lsp": "1.1.2",
+    "@wrongstack/plugins": "1.1.2",
+    "@wrongstack/primitives": "1.1.2",
+    "@wrongstack/providers": "1.1.2",
+    "@wrongstack/requirement-intake": "1.1.2",
+    "@wrongstack/requirement-intake-mcp": "1.1.2",
+    "@wrongstack/runtime": "1.1.2",
+    "@wrongstack/sage": "1.1.2",
+    "@wrongstack/sage-mcp": "1.1.2",
+    "@wrongstack/sdd": "1.1.2",
+    "@wrongstack/security-scanner": "1.1.2",
+    "@wrongstack/simpleui": "1.1.2",
+    "@wrongstack/techstack": "1.1.2",
+    "@wrongstack/telegram": "1.1.2",
+    "@wrongstack/tools": "1.1.2",
+    "@wrongstack/tui": "1.1.2",
+    "@wrongstack/vector-memory": "1.1.2",
+    "@wrongstack/webui": "1.1.2",
+    "@wrongstack/webui-hq": "1.1.2",
+    "@wrongstack/webui-protocol": "1.1.2",
+    "@wrongstack/webui-server": "1.1.2",
+    "@wrongstack/wrongtrace": "1.1.2",
     "ws": "^8.22.0"
   },
   "optionalDependencies": {
-    "@wrongstack/desktop": "1.1.0"
+    "@wrongstack/desktop": "1.1.2"
   },
   "devDependencies": {
     "@types/node": "^26.5.1",
     "@types/ws": "^8.18.1",
-    "@wrongstack/governance": "1.1.0",
+    "@wrongstack/governance": "1.1.2",
     "jsdom": "^30.0.1",
     "typescript": "^7.0.2"
   },

package/dist/auth-menu/anthropic-oauth.d.ts

@@ -1,43 +0,0 @@
-/**
- * Anthropic "Sign in with Claude" OAuth (Authorization Code + PKCE) — Claude
- * Pro/Max subscription login. Parallel to the Codex flow but with Anthropic's
- * endpoints and quirks:
- *   - authorize at claude.ai/oauth/authorize (params include `code=true`),
- *   - the OAuth `state` is the PKCE verifier (Anthropic's convention),
- *   - JSON (not form) token exchange at platform.claude.com/v1/oauth/token,
- *   - loopback callback on http://localhost:53692/callback.
- *
- * Stored under the canonical `anthropic-oauth` provider (family `anthropic-oauth`)
- * so it never clobbers an API-key `anthropic` provider. The provider adapter
- * adds the Bearer + beta headers and the required Claude Code system block.
- */
-import type { AuthMenuDeps } from './types.js';
-export declare const CLAUDE_PROVIDER_ID = "anthropic-oauth";
-export interface ClaudeTokens {
-    access: string;
-    refresh: string;
-    expires: number;
-}
-export declare function generatePkce(): {
-    verifier: string;
-    challenge: string;
-};
-/** Build the Claude authorize URL. Anthropic uses the PKCE verifier as `state`. */
-export declare function buildAuthorizeUrl(challenge: string, verifier: string): string;
-export declare function parseAuthorizationInput(input: string): {
-    code?: string | undefined;
-    state?: string | undefined;
-};
-/** Exchange an authorization code (+ verifier, reused as state) for tokens. */
-export declare function exchangeAuthorizationCode(code: string, state: string, verifier: string, signal?: AbortSignal): Promise<ClaudeTokens>;
-export interface ClaudeLoginOptions {
-    providerId?: string;
-    /**
-     * External cancellation signal (e.g. the TUI auth panel's Esc). When
-     * provided, the flow does NOT install its own SIGINT handler — the
-     * caller owns cancellation.
-     */
-    signal?: AbortSignal | undefined;
-}
-export declare function runClaudeOAuthLogin(deps: AuthMenuDeps, opts?: ClaudeLoginOptions): Promise<number>;
-//# sourceMappingURL=anthropic-oauth.d.ts.map