@wrongstack/cli 1.1.2 → 1.1.4

package/dist/{chunk-5TRZZHMN.js → chunk-JCZ2D3VV.js}

@@ -147,64 +147,6 @@ function renderPayloadPreview(input) {
   return typeof diff === "string" && diff ? clipPreview(diff, diffLineStyle) : "";
 }
 
-// src/boot/restricted-mode.ts
-import { lockToProjectRoot, lockYoloOff, ToolCapabilities } from "@wrongstack/core/security";
-var RESTRICTED_ENV = "WRONGSTACK_RESTRICTED";
-var RESTRICTED_DENY_CAPABILITIES = [
-  ToolCapabilities.SHELL_ARBITRARY,
-  ToolCapabilities.SHELL_RESTRICTED,
-  ToolCapabilities.SHELL_EXEC,
-  ToolCapabilities.NET_OUTBOUND,
-  ToolCapabilities.PACKAGE_INSTALL,
-  ToolCapabilities.CONFIG_MUTATE,
-  ToolCapabilities.FS_WRITE_OUTSIDE_PROJECT,
-  ToolCapabilities.TOOL_MUTATE_ANY,
-  ToolCapabilities.MCP_PROXY
-];
-var CONFLICTING_FLAGS = [
-  "yolo",
-  "yolo-plus",
-  "yolo-destructive",
-  "full-auto",
-  "mcp-config",
-  // Pre-approving a tool would let writes skip the prompt this mode promises.
-  "allowed-tools"
-];
-function isRestrictedMode(flags) {
-  return flags["restricted"] === true || process.env[RESTRICTED_ENV] === "1";
-}
-function validateRestrictedMode(flags) {
-  if (!isRestrictedMode(flags)) return false;
-  const conflict = CONFLICTING_FLAGS.find(
-    (name) => flags[name] !== void 0 && flags[name] !== false
-  );
-  if (conflict) throw new Error(`--${conflict} cannot be combined with --restricted`);
-  return true;
-}
-function withRestrictedTools(restriction, restricted) {
-  if (!restricted) return restriction;
-  return {
-    ...restriction?.only ? { only: restriction.only } : {},
-    deny: [...restriction?.deny ?? [], "mcp__*"],
-    denyCapabilities: RESTRICTED_DENY_CAPABILITIES,
-    requireDeclaredCapabilities: true
-  };
-}
-var RESTRICTED_NOTICE = "Restricted mode: no shell, network, installs or MCP tools; files stay inside the project; YOLO is off.";
-var announced = false;
-function activateRestrictedMode(flags, write) {
-  if (!validateRestrictedMode(flags)) return false;
-  lockToProjectRoot();
-  lockYoloOff();
-  process.env[RESTRICTED_ENV] = "1";
-  if (!announced) {
-    announced = true;
-    write(`${RESTRICTED_NOTICE}
-`);
-  }
-  return true;
-}
-
 // src/boot/safe-mode.ts
 var SAFE_MODE_ENV = "WRONGSTACK_SAFE_MODE";
 function isSafeMode(flags) {
@@ -216,11 +158,11 @@ function propagateSafeMode(flags) {
   return on;
 }
 var SAFE_MODE_NOTICE = "Safe mode: third-party plugins, hooks, configured MCP servers, skills and instruction overrides are off.";
-var announced2 = false;
+var announced = false;
 function announceSafeMode(flags, write) {
   const on = propagateSafeMode(flags);
-  if (on && !announced2) {
-    announced2 = true;
+  if (on && !announced) {
+    announced = true;
     write(`${SAFE_MODE_NOTICE}
 `);
   }
@@ -597,9 +539,6 @@ export {
   resolveLaunchAllowedTools,
   resolveToolRestriction,
   unknownRestrictedToolNames,
-  isRestrictedMode,
-  withRestrictedTools,
-  activateRestrictedMode,
   isSafeMode,
   announceSafeMode,
   isSimpleUiFullAuto,
@@ -608,4 +547,4 @@ export {
   detectProjectFacts,
   renderAgentsTemplate
 };
-//# sourceMappingURL=chunk-5TRZZHMN.js.map
+//# sourceMappingURL=chunk-JCZ2D3VV.js.map

package/dist/{chunk-XT3NAHRX.js → chunk-JKTJSLUT.js}

@@ -1,4 +1,192 @@
 
+// src/fleet/acp-wrongstack-bridge.ts
+import { statSync } from "node:fs";
+import { join } from "node:path";
+import { findAgentDescriptor, REGISTRY_ID_ALIASES } from "@wrongstack/acp";
+import { cliSpawnArgs, isStandaloneBinary } from "@wrongstack/core/utils";
+var DEFAULT_BRIDGE_AGENTS = ["claude-code"];
+var DEFAULT_BRIDGE_SERVERS = [
+  "codebase-index",
+  "sage",
+  "mailbox",
+  "kanban"
+];
+function wstackLaunch(args, entry = process.argv[1]) {
+  if (isStandaloneBinary() || entry && /wstack|wrongstack|index\.(js|ts|mjs|cjs)$/.test(entry)) {
+    return { command: process.execPath, args: cliSpawnArgs(entry ?? "", args) };
+  }
+  return { command: "wstack", args };
+}
+var SERVER_NAMES = {
+  sage: "wrongstack-sage",
+  mailbox: "wrongstack-mailbox",
+  kanban: "wrongstack-kanban",
+  "codebase-index": "wrongstack-index",
+  "requirement-intake": "wrongstack-intake"
+};
+var SERVER_NOTES = {
+  sage: () => "- wrongstack-sage: the project's shared memory. Recall what is relevant before you start; when you learn something durable (a decision, a gotcha, a convention), propose it with memory_candidates (WrongStack reviews proposals).",
+  mailbox: (delegated) => "- wrongstack-mailbox: the project's agent mailbox, already signed in as you. Send progress, blockers and questions to " + (delegated ? '"@session" (the WrongStack session that delegated this task), ' : '"all" (the agents working in this project), ') + '(a send needs a type, e.g. "note"), check unread mail during long work, and acknowledge what you handle.',
+  kanban: () => "- wrongstack-kanban: the project's board. If the task names a card, keep its status current. Lists return only the most recently updated (pass limit for more); use the stats action for totals and workbench for what is in flight.",
+  "codebase-index": () => "- wrongstack-index: a prebuilt, ranked symbol index of this repository, kept fresh by WrongStack. Prefer it over grep/glob and whole-file reads for code navigation: codebase_search (where something is defined), codebase_incoming_calls / codebase_outgoing_calls (callers, callees), codebase_read_symbol (one symbol's source), codebase_skeleton (a file or folder outline), codebase_impact_analysis (what a change affects), codebase_context (files relevant to a task), codebase_repo_map (overview). Use grep for literal text such as strings, comments and config values.",
+  "requirement-intake": () => "- wrongstack-intake: the project's requirements intake. List open requests; file a new one when you are handed an unrecorded software request."
+};
+function serviceWorkflow(servers) {
+  return [
+    ...servers.includes("codebase-index") ? [
+      "Use wrongstack-index first for code navigation; use your file tools for edits, exact",
+      "literal searches, and verification. Start a code task with",
+      "mcp__wrongstack-index__codebase_context (task description); for a named symbol use",
+      "mcp__wrongstack-index__codebase_search. If the index lacks a result, fall back to your tools."
+    ] : [],
+    ...servers.includes("sage") ? [
+      "Recall relevant decisions from wrongstack-sage before substantial work; propose durable",
+      "findings to memory_candidates after verification. Start with",
+      "mcp__wrongstack-sage__memory_search using the task topic."
+    ] : [],
+    ...servers.includes("mailbox") ? [
+      "Check wrongstack-mailbox for unread messages when starting and during long work;",
+      'use mcp__wrongstack-mailbox__mailbox_read with action "inbox" to read your',
+      "messages. Send meaningful",
+      "progress or blockers and acknowledge messages you handle."
+    ] : [],
+    ...servers.includes("kanban") ? [
+      "Use wrongstack-kanban when work is tied to a board task; inspect its current state",
+      "with mcp__wrongstack-kanban__kanban_read and update it as work progresses."
+    ] : [],
+    "If a project service is unavailable, continue with available tools and report the gap."
+  ];
+}
+function bridgeTaskKickoff(servers) {
+  return [
+    "Project-service kickoff for this task:",
+    ...servers.includes("codebase-index") ? ["First use mcp__wrongstack-index__codebase_context to locate relevant code."] : [],
+    ...servers.includes("sage") ? ["Use mcp__wrongstack-sage__memory_search for prior project guidance."] : [],
+    ...servers.includes("mailbox") ? ['Check mcp__wrongstack-mailbox__mailbox_read with action "inbox".'] : [],
+    ...servers.includes("kanban") ? ["If the task names a board card, inspect it with mcp__wrongstack-kanban__kanban_read."] : [],
+    "Then use file and other tools as the task requires."
+  ].join("\n");
+}
+function serverArgs(server, projectRoot, ctx) {
+  const actor = ctx.subagentId;
+  const base = ["mcp", "serve", server, `--project-root=${projectRoot}`];
+  switch (server) {
+    case "sage":
+      return [...base, `--origin=${actor}`];
+    case "mailbox": {
+      const name = ctx.config.name ?? actor;
+      return [
+        ...base,
+        `--actor=${actor}`,
+        `--name=${name}`,
+        ...ctx.config.role ? [`--role=${ctx.config.role}`] : [],
+        ...ctx.sessionId ? [`--session-id=${ctx.sessionId}`] : [],
+        // Switch last: the global parser would read a following word as its value.
+        "--writable"
+      ];
+    }
+    case "kanban":
+      return [...base, `--actor=${actor}`, "--writable"];
+    case "codebase-index":
+      return [...base, "--watch"];
+    case "requirement-intake":
+      return [...base, "--writable"];
+  }
+}
+function bridgeNote(servers, delegated = true) {
+  return [
+    "You are working as a delegated worker inside a WrongStack project.",
+    "WrongStack is the orchestrator the user runs: it sent you this task and receives your",
+    "final reply, so end with a clear summary of what you did and what is left.",
+    ...delegated ? [
+      "While you work, the WrongStack session can steer you: such a message arrives as a",
+      'user message starting with "[WrongStack <kind> from <agent>]". Treat it as coming',
+      "from the user who delegated the task, and answer what it asks."
+    ] : [],
+    "",
+    "WrongStack's project services are available as MCP servers:",
+    ...servers.map((s) => SERVER_NOTES[s](delegated)),
+    "",
+    ...serviceWorkflow(servers),
+    "",
+    "WrongStack applies the user's rules to your edits and commands. A refused permission",
+    "comes from them (a deny rule the user wrote, a history-rewriting git command, a",
+    "credential read): do not retry it or work around it; finish what you can and name what",
+    "was refused in your final reply."
+  ].join("\n");
+}
+function leaderBridgeNote(servers) {
+  return [
+    "You are the leader of a WrongStack session. The user talks to you through WrongStack",
+    "(its terminal UI or web UI), which shows your replies, your tool calls and their results.",
+    "",
+    "WrongStack's project services are available as MCP servers:",
+    ...servers.map((s) => SERVER_NOTES[s](false)),
+    "",
+    ...serviceWorkflow(servers),
+    "",
+    "WrongStack applies the user's rules to your edits and commands and asks the user when one",
+    "needs approval. A refused permission is the user's decision or rule: do not retry it or",
+    "work around it.",
+    "",
+    "When you finish a turn and a concrete follow-on action exists, end your reply with a",
+    "<nextsteps> block of 1-4 exact prompts the user can send back to you, one per numbered",
+    "line, for example:",
+    "<nextsteps>",
+    "1. Run the package tests and fix any failure",
+    "</nextsteps>",
+    "When the work is done, end with <nextsteps-complete/> instead."
+  ].join("\n");
+}
+function onPath(command, env = process.env, platform = process.platform) {
+  const pathVar = env.PATH ?? env.Path ?? "";
+  const exts = platform === "win32" ? ["", ...(env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";")] : [""];
+  const sep = platform === "win32" ? ";" : ":";
+  for (const dir of pathVar.split(sep)) {
+    if (!dir) continue;
+    for (const ext of exts) {
+      try {
+        if (statSync(join(dir, command + ext)).isFile()) return true;
+      } catch {
+      }
+    }
+  }
+  return false;
+}
+function installedBridgeAgents(acp, isOnPath = (c) => onPath(c)) {
+  if ((acp?.bridge?.servers ?? DEFAULT_BRIDGE_SERVERS).length === 0) return [];
+  const toCatalogId = new Map(Object.entries(REGISTRY_ID_ALIASES).map(([c, r]) => [r, c]));
+  const out = [];
+  for (const listed of acp?.bridge?.agents ?? DEFAULT_BRIDGE_AGENTS) {
+    const id = findAgentDescriptor(listed) ? listed : toCatalogId.get(listed) ?? listed;
+    if (out.includes(id)) continue;
+    const probe = findAgentDescriptor(id)?.probe.command;
+    if (acp?.agents?.[id] || acp?.agents?.[listed] || probe && isOnPath(probe)) out.push(id);
+  }
+  return out;
+}
+function wrongstackBridgeSetup(agentId, projectRoot, config, role = "worker") {
+  const agents = config?.agents ?? DEFAULT_BRIDGE_AGENTS;
+  if (!agents.some((a) => a === agentId || REGISTRY_ID_ALIASES[a] === agentId)) return void 0;
+  const servers = [...new Set(config?.servers ?? DEFAULT_BRIDGE_SERVERS)].filter(
+    (s) => Object.hasOwn(SERVER_NAMES, s)
+  );
+  if (servers.length === 0) return void 0;
+  return (_task, ctx) => ({
+    promptPrefix: bridgeTaskKickoff(servers),
+    mcpServers: servers.map((server) => {
+      const launch = wstackLaunch(serverArgs(server, projectRoot, ctx));
+      return { name: SERVER_NAMES[server], ...launch, env: [] };
+    }),
+    meta: {
+      systemPrompt: {
+        // `@session` only reaches someone when a WrongStack session delegated the task.
+        append: role === "leader" ? leaderBridgeNote(servers) : bridgeNote(servers, ctx.sessionId !== void 0)
+      }
+    }
+  });
+}
+
 // src/hq-command-controller.ts
 function createProjectKanbanTransitionHandler(projectRoot) {
   return async (input) => {
@@ -330,8 +518,11 @@ ${command}
 }
 
 export {
+  DEFAULT_BRIDGE_SERVERS,
+  installedBridgeAgents,
+  wrongstackBridgeSetup,
   createProjectKanbanTransitionHandler,
   createProjectKanbanAssignHandler,
   createHqCommandDispatcher
 };
-//# sourceMappingURL=chunk-XT3NAHRX.js.map
+//# sourceMappingURL=chunk-JKTJSLUT.js.map

package/dist/{chunk-NMXQFQ26.js → chunk-TAE3EGBM.js}

@@ -22,11 +22,11 @@ async function handleHelpVersionShortCircuit(argv) {
   }
   if (earlyFlags["help"] === true) {
     if (positional.length > 0) {
-      const { subcommandNames } = await import("./subcommands-VTMIZQBP.js");
+      const { subcommandNames } = await import("./subcommands-YADUV7IJ.js");
       if (subcommandNames.includes(positional[0])) {
         const first = positional[0];
         const deep = positional[1];
-        const { renderDeepHelp, renderFocusedHelp } = await import("./per-subcommand-help-D6J4ZXW2.js");
+        const { renderDeepHelp, renderFocusedHelp } = await import("./per-subcommand-help-4GYSCMLU.js");
         if (deep && renderDeepHelp(`${first}:${deep}`, stubRenderer)) {
           return 0;
         }
@@ -43,4 +43,4 @@ async function handleHelpVersionShortCircuit(argv) {
 export {
   handleHelpVersionShortCircuit
 };
-//# sourceMappingURL=chunk-NMXQFQ26.js.map
+//# sourceMappingURL=chunk-TAE3EGBM.js.map

package/dist/{chunk-3R3OADC5.js → chunk-ZF4HRR5F.js}

@@ -746,6 +746,10 @@ var helpTable = {
       {
         name: "serve",
         description: "Run the wstack MCP server; --resources/--prompts explicitly expose selected files."
+      },
+      {
+        name: "serve <mailbox|kanban|codebase-index|requirement-intake|sage>",
+        description: "Run one of this project's MCP servers over stdio (works in the standalone binary). --project-root defaults to the current project; other flags pass through."
       }
     ],
     seeAlso: "wstack plugin (manage tool plugins similarly)"
@@ -824,8 +828,8 @@ var helpTable = {
         description: "Pre-fill Ollama / vLLM / LM Studio (--name, --base-url, --no-probe, --model, --audit \u2026)."
       },
       {
-        name: "login <chatgpt|claude|copilot>",
-        description: "Subscription OAuth login: chatgpt (\u2192 openai-codex), claude (\u2192 anthropic-oauth), or copilot (\u2192 github-copilot). Opens browser; no API key. \u26A0 Using subscriptions outside official clients may violate provider ToS (account ban risk); an API key is the sanctioned path."
+        name: "login <chatgpt|copilot>",
+        description: "Subscription OAuth login: chatgpt (\u2192 openai-codex) or copilot (\u2192 github-copilot). Claude has no third-party sign-in: use `wstack auth anthropic` with an API key (Max/Team plans include monthly API credits). Opens browser; no API key. \u26A0 Using subscriptions outside official clients may violate provider ToS (account ban risk); an API key is the sanctioned path."
       }
     ],
     seeAlso: "wstack auth local (pre-fill Ollama / vLLM / LM Studio)"
@@ -1296,4 +1300,4 @@ export {
   subcommandsWithFocusedHelp,
   renderGenericHelp
 };
-//# sourceMappingURL=chunk-3R3OADC5.js.map
+//# sourceMappingURL=chunk-ZF4HRR5F.js.map

package/dist/{cli-context-YIT4FEDM.js → cli-context-E44HQ4ZO.js}

@@ -7,7 +7,6 @@ import {
   writeWebuiSessionChildError
 } from "./chunk-FUJHWQV4.js";
 import {
-  activateRestrictedMode,
   announceSafeMode,
   applySimpleUiFullAutoProfile,
   detectProjectFacts,
@@ -17,7 +16,7 @@ import {
   renderDiff,
   resolveLaunchAllowedTools,
   resolveToolRestriction
-} from "./chunk-5TRZZHMN.js";
+} from "./chunk-JCZ2D3VV.js";
 import {
   theme as theme2
 } from "./chunk-JTTV2EVA.js";
@@ -30,14 +29,14 @@ import {
 } from "./chunk-NL2ABOAS.js";
 import {
   subcommands
-} from "./chunk-GRAGMA4B.js";
+} from "./chunk-2LTHDKZX.js";
 import {
   renderDeepHelp,
   renderFocusedHelp
-} from "./chunk-3R3OADC5.js";
+} from "./chunk-ZF4HRR5F.js";
 import {
   handleHelpVersionShortCircuit
-} from "./chunk-NMXQFQ26.js";
+} from "./chunk-TAE3EGBM.js";
 import {
   DEFAULT_PORT
 } from "./chunk-AWRZWPJ3.js";
@@ -69,7 +68,7 @@ import {
   runPicker,
   saveToGlobalConfig,
   theme
-} from "./chunk-RAWHRRUJ.js";
+} from "./chunk-I5LJLKA3.js";
 import "./chunk-ZXX3MJRL.js";
 import {
   isKeylessLocalProvider,
@@ -82,6 +81,9 @@ import {
   activeProfileConfigPath
 } from "./chunk-SPSHEZ46.js";
 import "./chunk-BIGSVBPI.js";
+import {
+  activateRestrictedMode
+} from "./chunk-3LEIFO5D.js";
 import "./chunk-OZCYZYN2.js";
 import {
   runUpdateCommand
@@ -96,6 +98,9 @@ import {
 import {
   parseArgs
 } from "./chunk-75OLD563.js";
+import {
+  ACP_LEADER_PROVIDER_ID
+} from "./chunk-GKGWPFW2.js";
 import "./chunk-H53EXXAU.js";
 import {
   applyAsciiMode
@@ -1907,6 +1912,7 @@ async function validateSavedProviderModel(config, modelsRegistry) {
   const modelId = config.model;
   if (!providerId || !modelId) return { ok: false, reason: "missing provider/model" };
   if (isSetupProvider(providerId)) return { ok: true };
+  if (providerId === ACP_LEADER_PROVIDER_ID) return { ok: true };
   const saved = config.providers?.[providerId];
   const lookupId = saved?.type && saved.type !== providerId ? saved.type : providerId;
   const catalogProvider = await modelsRegistry.getProvider(lookupId).catch(() => void 0);
@@ -3622,4 +3628,4 @@ async function initializeCli(argv, options = {}) {
 export {
   initializeCli
 };
-//# sourceMappingURL=cli-context-YIT4FEDM.js.map
+//# sourceMappingURL=cli-context-E44HQ4ZO.js.map