@wrongstack/cli 1.1.2 → 1.1.4

package/dist/{cli-main-JIADJ5OL.js → cli-main-OT63I2FX.js}

@@ -18,14 +18,12 @@ import {
 import {
   configureSimpleUiRuntimeContext,
   detectProjectFacts,
-  isRestrictedMode,
   isSafeMode,
   makeConfirmAwaiter,
   renderAgentsTemplate,
   resolveToolRestriction,
-  unknownRestrictedToolNames,
-  withRestrictedTools
-} from "./chunk-5TRZZHMN.js";
+  unknownRestrictedToolNames
+} from "./chunk-JCZ2D3VV.js";
 import "./chunk-JTTV2EVA.js";
 import {
   awaitFirstWrongProxyProbe,
@@ -73,7 +71,7 @@ import {
 import {
   renderDeepHelpToString,
   renderFocusedHelpToString
-} from "./chunk-3R3OADC5.js";
+} from "./chunk-ZF4HRR5F.js";
 import {
   explainCall,
   formatExplainedCall,
@@ -111,7 +109,7 @@ import {
   runAuthLocal,
   runProviderAuthLogin,
   validateFamily
-} from "./chunk-RAWHRRUJ.js";
+} from "./chunk-I5LJLKA3.js";
 import "./chunk-ZXX3MJRL.js";
 import {
   buildPickableProviders,
@@ -136,14 +134,24 @@ import {
   createGracefulShutdown,
   formatAcpAgentList,
   loadCachedAcpRegistry,
+  recordAcpRateLimit,
   refreshAcpRegistry,
-  setupProvider
-} from "./chunk-ZNNFEKDZ.js";
+  setupProvider,
+  startAcpTurnReminders,
+  wrongstackAcpPermissionPolicy
+} from "./chunk-COGI7EQU.js";
 import {
+  DEFAULT_BRIDGE_SERVERS,
   createHqCommandDispatcher,
   createProjectKanbanAssignHandler,
-  createProjectKanbanTransitionHandler
-} from "./chunk-XT3NAHRX.js";
+  createProjectKanbanTransitionHandler,
+  installedBridgeAgents,
+  wrongstackBridgeSetup
+} from "./chunk-JKTJSLUT.js";
+import {
+  isRestrictedMode,
+  withRestrictedTools
+} from "./chunk-3LEIFO5D.js";
 import {
   startCliHqConnection
 } from "./chunk-76JE54WD.js";
@@ -162,6 +170,11 @@ import {
 import {
   parseSpawnFlags
 } from "./chunk-75OLD563.js";
+import {
+  ACP_LEADER_PROVIDER_ID,
+  acpLeaderSessionAgent,
+  bindAcpLeaderHost
+} from "./chunk-GKGWPFW2.js";
 import {
   checkForUpdate
 } from "./chunk-H53EXXAU.js";
@@ -1008,7 +1021,18 @@ function createPickableProvidersLoader(args) {
       logger,
       reason: "model-picker"
     });
-    return buildPickableProviders(modelsRegistry, getConfig());
+    const config = getConfig();
+    const providers = await buildPickableProviders(modelsRegistry, config);
+    const agents = installedBridgeAgents(config.acp);
+    return agents.length > 0 && !providers.some((p) => p.id === ACP_LEADER_PROVIDER_ID) ? [
+      ...providers,
+      {
+        id: ACP_LEADER_PROVIDER_ID,
+        family: "acp",
+        models: agents,
+        modelsLabel: "ACP agent as leader"
+      }
+    ] : providers;
   };
 }
 
@@ -2962,6 +2986,44 @@ import {
   MCPVaultTokenStore
 } from "@wrongstack/mcp";
 
+// src/acp-leader/acp-leader-host-binding.ts
+import { randomUUID } from "node:crypto";
+function createAcpLeaderHost(opts) {
+  const agentFor = (sessionId) => (sessionId ? acpLeaderSessionAgent(sessionId) : void 0) ?? opts.agent;
+  return {
+    events: opts.events,
+    projectRoot: opts.projectRoot,
+    stateDir: opts.stateDir,
+    getConfig: opts.getConfig,
+    permission: (sessionId) => agentFor(sessionId).permission,
+    context: (sessionId) => agentFor(sessionId).ctx,
+    getTool: opts.getTool,
+    runTool: async (name, input, run = {}) => {
+      const agent = agentFor(run.sessionId);
+      const use = { type: "tool_use", id: `acp_fleet_${randomUUID()}`, name, input };
+      const batch = await agent.toolExecutor.executeBatch([use], agent.ctx, "sequential");
+      let result = batch.outputs[0]?.result;
+      if (result?.type === "tool_confirm_pending") {
+        const tool = opts.getTool(name);
+        const approved = { ...use, input: result.input };
+        if (!tool || !await run.approve?.(tool, approved.input)) {
+          return { content: `${name} was not approved by the user.`, isError: true };
+        }
+        result = (await agent.toolExecutor.executeTool(
+          tool,
+          approved,
+          agent.ctx,
+          agent.perIterationOutputCapBytes
+        )).block;
+      }
+      if (!result) return { content: `${name} returned no result.`, isError: true };
+      const content = typeof result.content === "string" ? result.content : JSON.stringify(result.content);
+      return { content, isError: Boolean(result.is_error) };
+    },
+    confirmAwaiter: opts.confirmAwaiter
+  };
+}
+
 // src/hooks-wiring.ts
 var HookBlockedError = class extends Error {
   constructor(reason) {
@@ -3790,6 +3852,7 @@ async function setupLifecycleAndPlugins(deps) {
       logger.debug(`max-context re-resolve after catalog change failed: ${toErrorMessage3(err)}`);
     });
   });
+  const confirmAwaiter = makeConfirmAwaiter(reader);
   const agent = createAgent({
     container,
     tools: toolRegistry,
@@ -3798,13 +3861,24 @@ async function setupLifecycleAndPlugins(deps) {
     pipelines,
     context,
     config,
-    confirmAwaiter: makeConfirmAwaiter(reader),
+    confirmAwaiter,
     hookRunner,
     tracer: deps.tracer,
     fullConfig: config,
     source: "cli"
   });
   agent.extensions.register(createLifecycleHooksExtension(hookRunner));
+  bindAcpLeaderHost(
+    createAcpLeaderHost({
+      agent,
+      events,
+      projectRoot: wpaths.projectRoot,
+      stateDir: wpaths.projectDir,
+      getConfig: () => configStore.get(),
+      getTool: (name) => toolRegistry.get(name),
+      confirmAwaiter
+    })
+  );
   const mcpTokenStore = new MCPVaultTokenStore(
     path6.join(wpaths.projectDir, "mcp-auth.json"),
     vault
@@ -4071,7 +4145,7 @@ function setupProviderRuntime(deps) {
   const buildProviderForId2 = (providerId) => buildProviderForIdRuntime({ config: cfg, providerRegistry, logger }, providerId);
   const buildProviderForModel = async (providerId, modelId) => {
     const provider = buildProviderForId2(providerId);
-    if (!cfg.features.modelsRegistry) return provider;
+    if (!cfg.features.modelsRegistry || providerId === ACP_LEADER_PROVIDER_ID) return provider;
     const { cfg: resolvedCfg } = resolveProviderCfg2(providerId);
     return withCatalogCapabilities(
       modelsRegistry,
@@ -6424,7 +6498,7 @@ async function bootCliRuntime(cliCtx, state) {
 
 // src/cli-main-orchestration.ts
 import { mailboxSessionTag as mailboxSessionTag8 } from "@wrongstack/core/coordination";
-import { TOKENS as TOKENS16 } from "@wrongstack/core/kernel";
+import { TOKENS as TOKENS17 } from "@wrongstack/core/kernel";
 import { createPolicySandboxApprover, setSandboxExpansionApprover } from "@wrongstack/core/sandbox";
 
 // src/cli-eternal-flag.ts
@@ -6494,7 +6568,7 @@ import {
   createBrainRuntime,
   resolveBrainConfigDefaults
 } from "@wrongstack/core/execution";
-import { TOKENS as TOKENS14 } from "@wrongstack/core/kernel";
+import { TOKENS as TOKENS15 } from "@wrongstack/core/kernel";
 import {
   createMcpControlTool,
   createMcpUseTool,
@@ -6610,21 +6684,27 @@ function createSubagentWrongTraceHookRunner(sessionId, emit) {
 }
 
 // src/fleet/host.ts
-import { randomUUID as randomUUID8 } from "node:crypto";
+import { randomUUID as randomUUID9 } from "node:crypto";
 import { createProjectAgentRoster } from "@wrongstack/core/agent-catalog";
 import {
   areSubagentsAllowedForSession as areSubagentsAllowedForSession2,
   FLEET_ROSTER as FLEET_ROSTER2,
-  resolveProjectDir as resolveProjectDir2
+  resolveProjectDir as resolveProjectDir3
 } from "@wrongstack/core/coordination";
 import { ToolRegistry as ToolRegistry3 } from "@wrongstack/core/registry";
 import {
   AgentError
 } from "@wrongstack/core/types";
-import { wstackGlobalRoot as wstackGlobalRoot2 } from "@wrongstack/core/utils";
+import { wstackGlobalRoot as wstackGlobalRoot3 } from "@wrongstack/core/utils";
 
 // src/fleet/host-acp-runner.ts
-import { randomUUID } from "node:crypto";
+import { randomUUID as randomUUID2 } from "node:crypto";
+import { TOKENS as TOKENS9 } from "@wrongstack/core/kernel";
+import {
+  AutoApprovePermissionPolicy,
+  subagentYoloPlus,
+  ToolCapabilities
+} from "@wrongstack/core/security";
 
 // src/fleet/host-event-bridge.ts
 import * as path11 from "node:path";
@@ -6977,6 +7057,26 @@ function publishAcpLiveProgress(opts) {
       });
       return;
     }
+    case "turn_usage": {
+      const t = event.tokens;
+      fleet?.emit({
+        subagentId,
+        taskId,
+        ts,
+        type: "provider.response",
+        payload: {
+          provider: "acp",
+          usage: {
+            input: t?.input ?? 0,
+            output: t?.output ?? 0,
+            cacheRead: t?.cacheRead ?? 0,
+            cacheWrite: t?.cacheWrite ?? 0
+          },
+          costUsd: event.costUsd
+        }
+      });
+      return;
+    }
     default:
       return;
   }
@@ -6992,15 +7092,42 @@ function safeJson(value) {
 
 // src/fleet/host-acp-runner.ts
 function acpCommandOpts() {
-  let overrides;
+  let acp;
   try {
-    overrides = this.deps.configStore.get()?.acp?.agents;
+    acp = this.deps.configStore.get()?.acp;
   } catch {
-    overrides = void 0;
+    acp = void 0;
   }
+  const overrides = acp?.agents;
   return {
     ...overrides ? { overrides } : {},
+    projectRoot: this.deps.projectRoot,
+    bridge: { projectRoot: this.deps.projectRoot, config: acp?.bridge },
+    // The worker answers to the same rules as WrongStack's own subagents:
+    // the user's deny rules, the destructive and credential guards, YOLO+.
+    // Every capability is granted; the guards, not an allowlist, gate it.
+    permissions: (ctx) => {
+      const leaderPolicy = this.deps.container.safeResolve(TOKENS9.PermissionPolicy);
+      const policy = new AutoApprovePermissionPolicy(Object.values(ToolCapabilities), {
+        yoloPlus: () => subagentYoloPlus({
+          sessionId: ctx.sessionId,
+          leaderPolicy,
+          fallback: () => this.deps.configStore.get().autonomy?.yoloPlus === true
+        })
+      });
+      return wrongstackAcpPermissionPolicy({
+        evaluate: (tool, input, scope) => policy.evaluate(tool, input, scope),
+        getTool: (name) => this.deps.toolRegistry.get(name),
+        projectRoot: this.deps.projectRoot,
+        allowMcp: !isRestrictedMode({}),
+        onRefused: (call, reason) => this.deps.container.safeResolve(TOKENS9.Logger)?.info(`acp worker ${ctx.subagentId}: refused ${call.tool} \u2014 ${reason}`)
+      });
+    },
     publishLive: (ctx, task, event) => {
+      if (event.type === "rate_limit") {
+        recordAcpRateLimit(ctx.config.role ?? ctx.config.name ?? ctx.subagentId, event.info);
+        return;
+      }
       publishAcpLiveProgress({
         event,
         subagentId: ctx.subagentId,
@@ -7014,7 +7141,7 @@ function acpCommandOpts() {
   };
 }
 async function spawnACP(subagentId, task, config) {
-  const taskId = randomUUID();
+  const taskId = randomUUID2();
   await this.ensureCoordinator(config);
   const coordinator = this.getCoordinator();
   const acpRunner = await this.buildACPRunner(subagentId);
@@ -7052,7 +7179,41 @@ import {
   makeACPSubagentRunner,
   resolveAcpAgentCommand
 } from "@wrongstack/acp";
+import { getSharedProjectMailbox as getSharedProjectMailbox4, resolveProjectDir as resolveProjectDir2 } from "@wrongstack/core/coordination";
 import { ToolValidationError } from "@wrongstack/core/types";
+import { wstackGlobalRoot as wstackGlobalRoot2 } from "@wrongstack/core/utils";
+
+// src/fleet/acp-live-steer.ts
+import { sessionNoteHub } from "@wrongstack/core/coordination";
+import { toErrorMessage as toErrorMessage7 } from "@wrongstack/core/utils";
+function steerMessage(note) {
+  const head = `[WrongStack ${note.kind} from ${note.from}${note.subject ? ` \u2014 ${note.subject}` : ""}]`;
+  return `${head}
+${note.body}`;
+}
+function registerAcpSteerInbox(ctx, _task, steer, hub = sessionNoteHub, onUndelivered = () => {
+}) {
+  const sessionId = ctx.sessionId;
+  if (!sessionId) return void 0;
+  const name = ctx.config.name;
+  return hub.register({
+    sessionId,
+    agentId: ctx.subagentId,
+    ...name && name !== ctx.subagentId ? { aliases: [name] } : {},
+    // A steer interrupts the worker's generation; peer chatter must not.
+    ignorePeerBroadcasts: true,
+    deliver: (note) => {
+      steer(steerMessage(note)).then(
+        (outcome) => {
+          if (outcome !== "injected") onUndelivered(outcome);
+        },
+        (err) => onUndelivered(toErrorMessage7(err))
+      );
+    }
+  });
+}
+
+// src/fleet/host-acp.ts
 function buildAcpSubagentRunner(subagentId, options) {
   const cmd = resolveAcpAgentCommand(subagentId, options?.overrides, options?.live);
   if (!cmd) {
@@ -7062,10 +7223,39 @@ function buildAcpSubagentRunner(subagentId, options) {
       context: { requested: subagentId }
     });
   }
+  const bridgeSetup = options?.bridge ? wrongstackBridgeSetup(subagentId, options.bridge.projectRoot, options.bridge.config) : void 0;
+  const mailboxProjectRoot = options?.bridge?.projectRoot;
+  const mailboxEnabled = bridgeSetup !== void 0 && (options?.bridge?.config?.servers ?? DEFAULT_BRIDGE_SERVERS).includes("mailbox");
+  const permissions = options?.permissions;
+  const sessionSetup = bridgeSetup || permissions ? (task, ctx) => ({
+    ...bridgeSetup?.(task, ctx),
+    ...permissions ? { permissionPolicy: permissions(ctx) } : {}
+  }) : void 0;
+  const projectRoot = options?.projectRoot;
   return makeACPSubagentRunner({
     ...cmd,
+    ...projectRoot ? { cwd: projectRoot, projectRoot } : {},
     permissionPolicy: defaultPermissionPolicy,
-    ...options?.publishLive ? { publishLive: options.publishLive } : {}
+    // Claude asks before edits and commands only in `default`; left in the
+    // user's own mode (often `auto`) it would never consult the policy.
+    ...permissions ? { initialModeId: "default" } : {},
+    ...permissions && subagentId === "claude-code" ? { requireInitialMode: true } : {},
+    ...options?.publishLive ? { publishLive: options.publishLive } : {},
+    ...sessionSetup ? { sessionSetup } : {},
+    // The leader's `session_note` to a running worker joins its turn.
+    onTurnLive: (ctx, task, steer) => {
+      const stopNotes = registerAcpSteerInbox(ctx, task, steer);
+      const stopMail = mailboxEnabled && mailboxProjectRoot ? startAcpTurnReminders({
+        steer,
+        unreadCount: () => getSharedProjectMailbox4(
+          resolveProjectDir2(mailboxProjectRoot, wstackGlobalRoot2())
+        ).unreadCount(ctx.subagentId, ctx.sessionId)
+      }) : void 0;
+      return () => {
+        stopNotes?.();
+        stopMail?.();
+      };
+    }
   });
 }
 
@@ -7077,7 +7267,7 @@ import {
 } from "@wrongstack/core/coordination";
 import {
   clampSubagentCapabilities,
-  ToolCapabilities,
+  ToolCapabilities as ToolCapabilities2,
   WIDE_SUBAGENT_CAPABILITIES
 } from "@wrongstack/core/security";
 import { makePreferSideConflictResolver } from "@wrongstack/sdd";
@@ -7191,12 +7381,12 @@ function resolveSubagentCapabilities(subCfg, toolsForAllow) {
   if (subCfg.allowedCapabilities) {
     return clampSubagentCapabilities([
       ...subCfg.allowedCapabilities,
-      ToolCapabilities.COORDINATION_RESULT_SUBMIT
+      ToolCapabilities2.COORDINATION_RESULT_SUBMIT
     ]).granted;
   }
   const allow = subCfg.tools;
   if (allow && allow.length === 0) {
-    return clampSubagentCapabilities([ToolCapabilities.COORDINATION_RESULT_SUBMIT]).granted;
+    return clampSubagentCapabilities([ToolCapabilities2.COORDINATION_RESULT_SUBMIT]).granted;
   }
   if (!allow) return WIDE_SUBAGENT_CAPABILITIES;
   const caps = new Set(WIDE_SUBAGENT_CAPABILITIES);
@@ -7433,12 +7623,12 @@ import {
   makeFleetEmitTool,
   postSessionNote as postSessionNote2
 } from "@wrongstack/core/coordination";
-import { TOKENS as TOKENS9 } from "@wrongstack/core/kernel";
+import { TOKENS as TOKENS10 } from "@wrongstack/core/kernel";
 import { formatMemoryEvidenceBlock } from "@wrongstack/core/utils";
 import { getSageSurface } from "@wrongstack/sage";
 
 // src/fleet/host-director-builder.ts
-import { randomUUID as randomUUID2 } from "node:crypto";
+import { randomUUID as randomUUID3 } from "node:crypto";
 import * as path13 from "node:path";
 import {
   DEFAULT_MAX_FLEET_SPAWNS,
@@ -7464,7 +7654,7 @@ function createHostFleetManager(opts) {
 function prepareHostDirectorRuntime(input) {
   const { config, deps, opts } = input;
   const coordinatorConfig = {
-    coordinatorId: randomUUID2(),
+    coordinatorId: randomUUID3(),
     doneCondition: { type: "all_tasks_done" },
     maxConcurrent: opts.maxConcurrent ?? 4
   };
@@ -7662,7 +7852,7 @@ function registerCoordinatorLifecycleHandlers(input) {
 
 // src/fleet/host-director-services.ts
 import {
-  getSharedProjectMailbox as getSharedProjectMailbox4,
+  getSharedProjectMailbox as getSharedProjectMailbox5,
   mailboxSessionTag as mailboxSessionTag2
 } from "@wrongstack/core/coordination";
 
@@ -7850,7 +8040,7 @@ function createHostStatusBroadcaster(input) {
   const { events, sessionId, mailboxProjectDir, subagentName, config } = input;
   return createFleetStatusBroadcaster({
     events,
-    mailboxFactory: () => getSharedProjectMailbox4(mailboxProjectDir(), events),
+    mailboxFactory: () => getSharedProjectMailbox5(mailboxProjectDir(), events),
     sessionTag: () => mailboxSessionTag2(sessionId),
     subagentName,
     config
@@ -7858,13 +8048,13 @@ function createHostStatusBroadcaster(input) {
 }
 
 // src/fleet/host-explore-companion.ts
-import { randomUUID as randomUUID3 } from "node:crypto";
+import { randomUUID as randomUUID4 } from "node:crypto";
 import {
   buildProbeTaskText,
   DEFAULT_EXPLORE_COMPANION_AGENT_ID,
   ExploreCompanion,
   formatSubagentStructuredReport,
-  getSharedProjectMailbox as getSharedProjectMailbox5,
+  getSharedProjectMailbox as getSharedProjectMailbox6,
   mailboxSessionTag as mailboxSessionTag3,
   postSessionNote
 } from "@wrongstack/core/coordination";
@@ -7875,7 +8065,7 @@ function createHostExploreCompanion(input) {
   const { director, events, sessionId, mailboxProjectDir, roster, config } = input;
   if (config?.enabled === false) return null;
   const sessionTag = mailboxSessionTag3(sessionId);
-  const mailbox = () => getSharedProjectMailbox5(mailboxProjectDir, events);
+  const mailbox = () => getSharedProjectMailbox6(mailboxProjectDir, events);
   const template = roster[DEFAULT_EXPLORE_COMPANION_AGENT_ID];
   let residentId;
   let active2;
@@ -7917,7 +8107,7 @@ function createHostExploreCompanion(input) {
       ...template,
       // Unique incarnation: late removal of an old resident cannot remove
       // its replacement, including after a registry eviction/recreation.
-      id: `explore-companion-${sessionTag}-${randomUUID3().slice(0, 8)}`,
+      id: `explore-companion-${sessionTag}-${randomUUID4().slice(0, 8)}`,
       name: "Explore Companion",
       // The resident belongs to the conversation it explores for. Without the
       // stamp the coordinator files it under the host's own session, and every
@@ -7940,7 +8130,7 @@ function createHostExploreCompanion(input) {
     leaderSessionId: sessionId,
     leaderAgentId: "leader",
     onProbe: async (probe2) => {
-      const taskId = randomUUID3();
+      const taskId = randomUUID4();
       let resolve11;
       const done = new Promise((finish) => {
         resolve11 = finish;
@@ -8104,7 +8294,7 @@ function createExploreCompanionRegistry(input) {
 }
 
 // src/fleet/host-memory-companion.ts
-import { randomUUID as randomUUID4 } from "node:crypto";
+import { randomUUID as randomUUID5 } from "node:crypto";
 import { memoryReviewReason } from "@wrongstack/sage";
 
 // src/fleet/memory-companion-evidence.ts
@@ -8330,7 +8520,7 @@ var HostMemoryCompanion = class {
       const resident = await this.spawnBounded(
         constrainMemoryCompanion({
           ...template,
-          id: `memory-companion-${randomUUID4()}`,
+          id: `memory-companion-${randomUUID5()}`,
           name: "Memory Companion",
           role: "memory-curator",
           originSessionId: sessionId,
@@ -8347,7 +8537,7 @@ var HostMemoryCompanion = class {
     }
     session.probes++;
     const agentId = session.resident;
-    const taskId = randomUUID4();
+    const taskId = randomUUID5();
     this.send(
       sessionId,
       "[memory:checking]",
@@ -8513,7 +8703,7 @@ ${JSON.stringify({
 };
 
 // src/fleet/host-skill-companion.ts
-import { createHash as createHash2, randomUUID as randomUUID5 } from "node:crypto";
+import { createHash as createHash2, randomUUID as randomUUID6 } from "node:crypto";
 import {
   extractSkillMentions,
   isSkillRecommendable,
@@ -8526,7 +8716,7 @@ import {
 
 // src/fleet/skill-companion-policy.ts
 import { makeSubagentResultTool as makeSubagentResultTool3 } from "@wrongstack/core/coordination";
-import { ToolCapabilities as ToolCapabilities2 } from "@wrongstack/core/security";
+import { ToolCapabilities as ToolCapabilities3 } from "@wrongstack/core/security";
 import { skillPromptExclusionReasons } from "@wrongstack/core/skills";
 var SKILL_COMPANION_ROLE = "skill-companion";
 var SKILL_COMPANION_ID_PREFIX = "skill-companion-";
@@ -8558,7 +8748,7 @@ function constrainSkillCompanion(config) {
     tools: [],
     disabledTools: void 0,
     capabilities: [],
-    allowedCapabilities: [ToolCapabilities2.COORDINATION_RESULT_SUBMIT],
+    allowedCapabilities: [ToolCapabilities3.COORDINATION_RESULT_SUBMIT],
     skillNames: [],
     skillPool: [],
     skillContent: void 0,
@@ -8846,7 +9036,7 @@ var HostSkillCompanion = class {
     const agentId = await this.resident(sessionId, session);
     if (!agentId || !this.current(sessionId, session)) return;
     session.probes++;
-    const taskId = randomUUID5();
+    const taskId = randomUUID6();
     let timeout;
     const completed = new Promise((resolve11) => {
       this.active = { taskId, agentId, settle: resolve11 };
@@ -8918,7 +9108,7 @@ ${JSON.stringify({
       session.resident = void 0;
     if (session.resident) return session.resident;
     const config = constrainSkillCompanion({
-      id: `${SKILL_COMPANION_ID_PREFIX}${randomUUID5()}`,
+      id: `${SKILL_COMPANION_ID_PREFIX}${randomUUID6()}`,
       name: "Skill Companion",
       role: SKILL_COMPANION_ROLE,
       originSessionId: sessionId,
@@ -9076,7 +9266,7 @@ async function buildDirector(host) {
     projectRoot: host.deps.projectRoot,
     roster: host.roster,
     memory: () => {
-      const port = host.deps.container.safeResolve(TOKENS9.MemoryStore);
+      const port = host.deps.container.safeResolve(TOKENS10.MemoryStore);
       return port ? getSageSurface(port) : void 0;
     },
     enabled: (sessionId) => {
@@ -9164,7 +9354,7 @@ async function buildDirector(host) {
       (n) => coordinator.setMaxConcurrent(n),
       { maxConcurrent: host.getMaxConcurrent(), ...adaptiveConfig },
       void 0,
-      host.deps.container.safeResolve(TOKENS9.Logger)
+      host.deps.container.safeResolve(TOKENS10.Logger)
     );
   }
   const runner = await host.buildSubagentRunner(config);
@@ -9412,11 +9602,11 @@ import {
   recordDirectiveOutcomes,
   recordSkillOutcome
 } from "@wrongstack/core/agent-catalog";
-import { TOKENS as TOKENS10 } from "@wrongstack/core/kernel";
+import { TOKENS as TOKENS11 } from "@wrongstack/core/kernel";
 function captureCompletedTaskLearningForHost(result, deps, subjects, onCaptured) {
   const subject = subjects.get(result.subagentId);
   if (!subject) return;
-  const logger = deps.container.safeResolve(TOKENS10.Logger);
+  const logger = deps.container.safeResolve(TOKENS11.Logger);
   const graded = result.status !== "stopped";
   const succeeded = result.status === "success";
   if (graded && subject.skills.length > 0) {
@@ -9886,7 +10076,7 @@ var HostShadowManager = class {
 };
 
 // src/fleet/host-subagent-factory.ts
-import { randomUUID as randomUUID6 } from "node:crypto";
+import { randomUUID as randomUUID7 } from "node:crypto";
 import { existsSync, statSync } from "node:fs";
 import * as path15 from "node:path";
 import {
@@ -9905,7 +10095,7 @@ import {
 import {
   DEFAULT_SUBAGENT_BASELINE,
   FLEET_ROSTER,
-  getSharedProjectMailbox as getSharedProjectMailbox6,
+  getSharedProjectMailbox as getSharedProjectMailbox7,
   resolveSubagentModelTarget as resolveSubagentModelTarget2
 } from "@wrongstack/core/coordination";
 import { installDesignStudioMiddleware as installDesignStudioMiddleware2 } from "@wrongstack/core/design";
@@ -9916,9 +10106,9 @@ import {
   ToolExecutor as ToolExecutor2
 } from "@wrongstack/core/execution";
 import { DefaultTokenCounter } from "@wrongstack/core/infrastructure";
-import { EventBus, TOKENS as TOKENS12 } from "@wrongstack/core/kernel";
+import { EventBus, TOKENS as TOKENS13 } from "@wrongstack/core/kernel";
 import { ToolRegistry as ToolRegistry2 } from "@wrongstack/core/registry";
-import { AutoApprovePermissionPolicy, subagentYoloPlus } from "@wrongstack/core/security";
+import { AutoApprovePermissionPolicy as AutoApprovePermissionPolicy2, subagentYoloPlus as subagentYoloPlus2 } from "@wrongstack/core/security";
 import { createSessionEventBridge as createSessionEventBridge3, resolveSessionLoggingConfig as resolveSessionLoggingConfig2 } from "@wrongstack/core/storage";
 
 // src/fleet/host-context.ts
@@ -9935,7 +10125,7 @@ import {
   resolveRoleSkillCandidates,
   runtimeToolReferencesFromText
 } from "@wrongstack/core/agent-catalog";
-import { TOKENS as TOKENS11 } from "@wrongstack/core/kernel";
+import { TOKENS as TOKENS12 } from "@wrongstack/core/kernel";
 import { activeLimits, positiveLimit } from "@wrongstack/core/types";
 import { formatMemoryEvidenceBlock as formatMemoryEvidenceBlock2, formatProjectSuppliedBlock } from "@wrongstack/core/utils";
 import { formatMemoryHintsDetailed, getSageRetrieval } from "@wrongstack/sage";
@@ -10120,7 +10310,7 @@ function composeAddendumOnly(role, skillName, augmentation) {
   ].join("\n");
 }
 async function retrieveHostSubagentMemory(deps, getLeaderMode, subCfg, taskContext, owningSessionId) {
-  const memoryPort = deps.container.safeResolve(TOKENS11.MemoryStore);
+  const memoryPort = deps.container.safeResolve(TOKENS12.MemoryStore);
   const memory = memoryPort ? getSageRetrieval(memoryPort) : void 0;
   if (!memory?.retrieveForAudience) return void 0;
   const contextualTaskType = typeof taskContext?.["taskType"] === "string" ? taskContext["taskType"] : void 0;
@@ -10355,7 +10545,7 @@ ${message} Falling back to the assigned checkout.` : `${message} Falling back to
     }
     let onlineAgents = [];
     try {
-      const subagentMailbox = getSharedProjectMailbox6(host.mailboxProjectDir());
+      const subagentMailbox = getSharedProjectMailbox7(host.mailboxProjectDir());
       onlineAgents = await subagentMailbox.getAgentStatuses();
     } catch {
     }
@@ -10418,7 +10608,7 @@ ${message} Falling back to the assigned checkout.` : `${message} Falling back to
     if (rolePrompt) {
       baseSystem.push({ type: "text", text: rolePrompt });
     }
-    const subagentName = effectiveCfg.id ?? effectiveCfg.name ?? `sub_${randomUUID6().slice(0, 8)}`;
+    const subagentName = effectiveCfg.id ?? effectiveCfg.name ?? `sub_${randomUUID7().slice(0, 8)}`;
     if (effectiveCfg.role) {
       host.recordLearningRole(subagentName, effectiveCfg.role, skillResolution.selected);
     }
@@ -10493,16 +10683,16 @@ ${message} Falling back to the assigned checkout.` : `${message} Falling back to
       effectiveCfg,
       (allow) => host.filterTools([...allow])
     );
-    const leaderPolicy = host.deps.container.safeResolve(TOKENS12.PermissionPolicy);
+    const leaderPolicy = host.deps.container.safeResolve(TOKENS13.PermissionPolicy);
     const subagentPolicyOptions = {
-      yoloPlus: () => subagentYoloPlus({
+      yoloPlus: () => subagentYoloPlus2({
         sessionId: owningSessionId,
         leaderPolicy,
         fallback: () => host.deps.configStore.get().autonomy?.yoloPlus === true
       })
     };
     const toolExecutor = new ToolExecutor2(baseRegistry, {
-      permissionPolicy: new AutoApprovePermissionPolicy(subAllowedCaps, subagentPolicyOptions),
+      permissionPolicy: new AutoApprovePermissionPolicy2(subAllowedCaps, subagentPolicyOptions),
       secretScrubber: host.deps.secretScrubber,
       renderer: host.deps.renderer,
       events,
@@ -10540,7 +10730,7 @@ ${message} Falling back to the assigned checkout.` : `${message} Falling back to
       events,
       pipelines,
       context: ctx,
-      permissionPolicy: new AutoApprovePermissionPolicy(subAllowedCaps, subagentPolicyOptions),
+      permissionPolicy: new AutoApprovePermissionPolicy2(subAllowedCaps, subagentPolicyOptions),
       toolExecutor,
       tracer: host.deps.tracer,
       loopDetection: config.tools?.loopDetection,
@@ -10621,14 +10811,14 @@ ${message} Falling back to the assigned checkout.` : `${message} Falling back to
 }
 
 // src/fleet/host-supervisor.ts
-import { randomUUID as randomUUID7 } from "node:crypto";
+import { randomUUID as randomUUID8 } from "node:crypto";
 import {
   dispatchAgent,
   FleetSupervisor,
   mailboxSessionTag as mailboxSessionTag4,
   postSessionNote as postSessionNote3
 } from "@wrongstack/core/coordination";
-import { toErrorMessage as toErrorMessage7 } from "@wrongstack/core/utils/error";
+import { toErrorMessage as toErrorMessage8 } from "@wrongstack/core/utils/error";
 
 // src/fleet/supervisor-registry.ts
 var active = null;
@@ -10674,7 +10864,7 @@ function createHostFleetSupervisor(input) {
           ].filter((part) => typeof part === "string" && part.trim().length > 0).join("\n\n");
           const subagentId = await director.spawn({
             ...template ?? { name: "fleet helper", role: "executor" },
-            id: `helper-${randomUUID7().slice(0, 8)}`,
+            id: `helper-${randomUUID8().slice(0, 8)}`,
             name: `fleet helper (${routed.role})`,
             role: routed.role,
             systemPromptOverride: helperPrompt,
@@ -10684,7 +10874,7 @@ function createHostFleetSupervisor(input) {
           });
           return { subagentId };
         } catch (err) {
-          return { error: toErrorMessage7(err) };
+          return { error: toErrorMessage8(err) };
         }
       },
       steerAgent: async (subagentId, subject, body) => {
@@ -10722,7 +10912,7 @@ function createHostFleetSupervisor(input) {
 // src/fleet/host-task-result-report.ts
 import {
   formatSubagentStructuredReport as formatSubagentStructuredReport2,
-  getSharedProjectMailbox as getSharedProjectMailbox7,
+  getSharedProjectMailbox as getSharedProjectMailbox8,
   mailboxSessionTag as mailboxSessionTag5
 } from "@wrongstack/core/coordination";
 async function reportTaskResultToLeader({
@@ -10734,7 +10924,7 @@ async function reportTaskResultToLeader({
 }) {
   try {
     const leaderId2 = getLeaderMailboxId?.() ?? `leader@${mailboxSessionTag5(sessionId)}`;
-    const mailbox = getSharedProjectMailbox7(mailboxProjectDir, events);
+    const mailbox = getSharedProjectMailbox8(mailboxProjectDir, events);
     const ok = n.status === "success";
     const MAX_BODY = 700;
     const failureText = [
@@ -10762,8 +10952,43 @@ ${n.partialText}` : ""
 
 // src/fleet/routing.ts
 import { makeAgentSubagentRunner, NULL_FLEET_BUS } from "@wrongstack/core/coordination";
-import { TOKENS as TOKENS13 } from "@wrongstack/core/kernel";
+import { TOKENS as TOKENS14 } from "@wrongstack/core/kernel";
 import { expectDefined as expectDefined2 } from "@wrongstack/core/utils";
+
+// src/fleet/acp-quota-hold.ts
+var DEFAULT_HOLD_MS = 15 * 6e4;
+var holds = /* @__PURE__ */ new Map();
+function isQuotaError(err) {
+  return !!err && typeof err === "object" && err.kind === "provider_quota";
+}
+async function runWithQuotaHold(agentId, start, now = Date.now) {
+  const hold = holds.get(agentId);
+  if (hold) {
+    const left = hold.until - now();
+    if (left > 0) {
+      const at = new Date(hold.until).toLocaleTimeString([], {
+        hour: "2-digit",
+        minute: "2-digit"
+      });
+      throw {
+        ...hold.error,
+        message: `${hold.error.message} \u2014 not started: ${agentId} is held until ${at}`,
+        backoffMs: left
+      };
+    }
+    holds.delete(agentId);
+  }
+  try {
+    return await start();
+  } catch (err) {
+    if (isQuotaError(err)) {
+      holds.set(agentId, { until: now() + (err.backoffMs ?? DEFAULT_HOLD_MS), error: err });
+    }
+    throw err;
+  }
+}
+
+// src/fleet/routing.ts
 function buildRoutingRunner(config, host) {
   const standardRunner = makeAgentSubagentRunner({
     factory: host.makeSubagentFactory(config),
@@ -10773,8 +10998,10 @@ function buildRoutingRunner(config, host) {
     const subCfg = ctx.config;
     if (subCfg.provider === "acp") {
       const cacheKey = subCfg.role ?? subCfg.name ?? expectDefined2(subCfg.id);
-      const runner = await host.buildACPRunner(cacheKey);
-      return runner(task, ctx);
+      return runWithQuotaHold(cacheKey, async () => {
+        const runner = await host.buildACPRunner(cacheKey);
+        return runner(task, ctx);
+      });
     }
     return standardRunner(task, ctx);
   };
@@ -10956,7 +11183,7 @@ var MultiAgentHost = class {
     return selectSubagentTools(this.deps.toolRegistry.list(), this.directorToolsByName, allow);
   }
   mailboxProjectDir() {
-    return this.opts.mailboxProjectDir ?? resolveProjectDir2(this.deps.projectRoot, wstackGlobalRoot2());
+    return this.opts.mailboxProjectDir ?? resolveProjectDir3(this.deps.projectRoot, wstackGlobalRoot3());
   }
   buildFleetSupervisor(config) {
     this.fleetSupervisor = createHostFleetSupervisor({
@@ -11067,7 +11294,7 @@ var MultiAgentHost = class {
         context: { sessionId: originSessionId, phase: "subagentPolicy" }
       });
     }
-    const taskId = randomUUID8();
+    const taskId = randomUUID9();
     if (!this.director)
       throw new AgentError({
         message: "Director is not initialized",
@@ -11396,7 +11623,7 @@ function setupBrainAndOrchestration(deps) {
     getSystemOneJudge: () => resolveTypeSafeJudge({
       config: configStore.get?.() ?? config,
       feature: "brain",
-      logger: container.safeResolve(TOKENS14.Logger)
+      logger: container.safeResolve(TOKENS15.Logger)
     }),
     ledger: {
       getPath: () => ledgerEnabled ? ledgerPath : void 0,
@@ -11468,7 +11695,7 @@ function setupBrainAndOrchestration(deps) {
     ),
     events
   );
-  container.bind(TOKENS14.BrainArbiter, () => brain);
+  container.bind(TOKENS15.BrainArbiter, () => brain);
   const {
     brainLog,
     getTierStats: brainTierStats,
@@ -11538,7 +11765,7 @@ function setupBrainAndOrchestration(deps) {
       providerRegistry,
       configStore,
       modelsRegistry,
-      fallbackProfileManager: container.resolve(TOKENS14.FallbackProfileManager),
+      fallbackProfileManager: container.resolve(TOKENS15.FallbackProfileManager),
       events,
       systemPromptBuilder: promptBuilder,
       session,
@@ -11547,7 +11774,7 @@ function setupBrainAndOrchestration(deps) {
       cwd,
       skillLoader,
       tracer: deps.tracer,
-      secretScrubber: container.resolve(TOKENS14.SecretScrubber),
+      secretScrubber: container.resolve(TOKENS15.SecretScrubber),
       // WrongTrace lock gate for every spawned worker — same fail-open
       // coordination the leader's executor enforces (lifecycle-plugins).
       // Registered unconditionally to mirror the leader registration.
@@ -11596,7 +11823,7 @@ function setupBrainAndOrchestration(deps) {
     }
   );
   const delegationTracker = new DelegationTracker({ events });
-  container.bind(TOKENS14.DelegationTracker, () => delegationTracker);
+  container.bind(TOKENS15.DelegationTracker, () => delegationTracker);
   teardownHandlers.push(() => delegationTracker.dispose());
   try {
     const restoredEvents = sessResult.restoredEvents;
@@ -11630,9 +11857,10 @@ function setupBrainAndOrchestration(deps) {
         getJudge: () => resolveTypeSafeJudge({
           config: configStore.get?.() ?? config,
           feature: "modelTier",
-          logger: container.safeResolve(TOKENS14.Logger)
+          logger: container.safeResolve(TOKENS15.Logger)
         })
-      })
+      }),
+      externalAgents: installedBridgeAgents(config.acp)
     })
   );
   toolRegistry.exposeToProvider("delegate");
@@ -11658,7 +11886,7 @@ function setupBrainAndOrchestration(deps) {
   }
   toolRegistry.register(
     createSessionRenameTool({
-      rename: (sessionId, name) => container.resolve(TOKENS14.SessionStore).rename(sessionId, name),
+      rename: (sessionId, name) => container.resolve(TOKENS15.SessionStore).rename(sessionId, name),
       events
     })
   );
@@ -11679,7 +11907,7 @@ function setupBrainAndOrchestration(deps) {
 }
 
 // src/wiring/cli-slash-commands-setup.ts
-import { TOKENS as TOKENS15 } from "@wrongstack/core/kernel";
+import { TOKENS as TOKENS16 } from "@wrongstack/core/kernel";
 
 // src/wiring/command-host-adapters.ts
 import { color as color5, isStdinTTY } from "@wrongstack/core/utils";
@@ -13070,7 +13298,7 @@ import {
   STATUSLINE_ITEMS
 } from "@wrongstack/core/statusline";
 import { ERROR_CODES, FsError } from "@wrongstack/core/types";
-import { atomicWrite as atomicWrite2, resolveWstackPaths, toErrorMessage as toErrorMessage8 } from "@wrongstack/core/utils";
+import { atomicWrite as atomicWrite2, resolveWstackPaths, toErrorMessage as toErrorMessage9 } from "@wrongstack/core/utils";
 var CONFIG_ENV = "WRONGSTACK_STATUSLINE_CONFIG";
 var STATUSLINE_CONFIG_VERSION = 4;
 var STATUSLINE_CONFIG_KEYS = STATUSLINE_ITEMS;
@@ -13227,7 +13455,7 @@ async function saveStatuslineConfig(config) {
     );
   } catch (error) {
     throw new FsError({
-      message: toErrorMessage8(error),
+      message: toErrorMessage9(error),
       code: error instanceof Error && error.message.includes("mkdir") ? ERROR_CODES.FS_MKDIR_FAILED : ERROR_CODES.FS_ATOMIC_WRITE_FAILED,
       path: configPath,
       cause: error
@@ -13311,8 +13539,8 @@ function estimateTokens(messages) {
 
 // src/slash-commands/acp.ts
 import {
-  EnsembleRegistry,
   defaultPermissionPolicy as defaultPermissionPolicy2,
+  EnsembleRegistry,
   probeAcpAgents,
   renderAcpBenchText,
   renderEnsembleText,
@@ -13321,7 +13549,7 @@ import {
   runEnsemble,
   runOneAcpTask
 } from "@wrongstack/acp";
-import { toErrorMessage as toErrorMessage9 } from "@wrongstack/core/utils";
+import { toErrorMessage as toErrorMessage10 } from "@wrongstack/core/utils";
 function buildAcpCommand(opts) {
   return {
     name: "acp",
@@ -13374,6 +13602,13 @@ function buildAcpCommand(opts) {
     }
   };
 }
+function readBridgeConfig(opts) {
+  try {
+    return opts.configStore?.get()?.acp?.bridge;
+  } catch {
+    return void 0;
+  }
+}
 function readOverrides(opts) {
   try {
     return opts.configStore?.get()?.acp?.agents;
@@ -13394,7 +13629,7 @@ Run \`/acp\` to see them, or \`/acp probe <id>\` to test one.`
     };
   } catch (err) {
     return {
-      message: `ACP registry sync failed: ${toErrorMessage9(err)}
+      message: `ACP registry sync failed: ${toErrorMessage10(err)}
 The bundled offline catalog is still available via \`/acp\`.`
     };
   }
@@ -13517,7 +13752,7 @@ async function parallelAgents(rest, overrides, live, opts) {
         const summary = await opts.onSpawn(task, { provider: "acp", name: id });
         dispatched.push(`  \u2022 ${id}: ${summary}`);
       } catch (err) {
-        skipped.push({ id, reason: toErrorMessage9(err) });
+        skipped.push({ id, reason: toErrorMessage10(err) });
       }
     }
     const lines = [
@@ -13542,7 +13777,7 @@ async function parallelAgents(rest, overrides, live, opts) {
     });
     return { message: renderEnsembleText(result) };
   } catch (err) {
-    return { message: `Ensemble failed: ${toErrorMessage9(err)}` };
+    return { message: `Ensemble failed: ${toErrorMessage10(err)}` };
   }
 }
 async function runSingle(agentId, rest, overrides, live, opts) {
@@ -13575,7 +13810,7 @@ Run \`/acp\` to see available agents.`
       return { message: `Dispatched '${agentId}' as a background ACP subagent.
 ${summary}` };
     } catch (err) {
-      return { message: `Background spawn failed: ${toErrorMessage9(err)}` };
+      return { message: `Background spawn failed: ${toErrorMessage10(err)}` };
     }
   }
   opts.renderer.writeInfo(`Running task on '${agentId}'\u2026
@@ -13591,6 +13826,7 @@ ${summary}` };
       projectRoot: opts.projectRoot,
       sessionId: opts.context?.eventSessionId(),
       permissionPolicy: defaultPermissionPolicy2,
+      sessionSetup: wrongstackBridgeSetup(agentId, opts.projectRoot, readBridgeConfig(opts)),
       onProgress: (event) => {
         const line = formatProgress(event);
         if (line) opts.renderer.writeInfo(`  ${line}
@@ -13607,7 +13843,7 @@ ${body}
   } catch (err) {
     const e = err;
     const detail = e.kind ? `[${e.kind}] ` : "";
-    const message = e.message ?? toErrorMessage9(err);
+    const message = e.message ?? toErrorMessage10(err);
     return { message: `ACP agent '${agentId}' failed: ${detail}${message}` };
   }
 }
@@ -14007,7 +14243,6 @@ function buildAuthCommand(opts) {
             `${color12.bold("OAuth sign-in")}`,
             "",
             `  Run ${color12.cyan("wstack auth login chatgpt")} \u2014 ChatGPT Plus/Pro (\u2192 openai-codex)`,
-            `  Run ${color12.cyan("wstack auth login claude")}  \u2014 Claude Pro/Max (\u2192 anthropic-oauth)`,
             `  Run ${color12.cyan("wstack auth login copilot")} \u2014 GitHub Copilot (\u2192 github-copilot)`,
             `  Run ${color12.cyan("wstack auth login openrouter")} \u2014 OpenRouter API key (\u2192 openrouter)`
           ].join("\n")
@@ -14353,7 +14588,7 @@ ${color13.dim("YOLO enabled; tool calls run without approval unless an explicit
 }
 
 // src/slash-commands/brain.ts
-import { randomUUID as randomUUID9 } from "node:crypto";
+import { randomUUID as randomUUID10 } from "node:crypto";
 import { color as color16 } from "@wrongstack/core/utils";
 
 // src/slash-commands/brain-council.ts
@@ -14966,7 +15201,7 @@ function buildBrainCommand(opts) {
         }
         try {
           const decision = await opts.brain.decide({
-            id: `brain-ask-${randomUUID9()}`,
+            id: `brain-ask-${randomUUID10()}`,
             sessionId: opts.context?.session.id,
             source: "user",
             question,
@@ -15514,7 +15749,7 @@ function buildClearCommand(opts) {
 // src/slash-commands/codebase-map.ts
 import * as fs6 from "node:fs/promises";
 import * as path18 from "node:path";
-import { color as color18, toErrorMessage as toErrorMessage10 } from "@wrongstack/core/utils";
+import { color as color18, toErrorMessage as toErrorMessage11 } from "@wrongstack/core/utils";
 import {
   ATLAS_DIR,
   checkProjectAtlasFreshness,
@@ -15671,7 +15906,7 @@ function buildCodebaseMapCommand(opts) {
           )
         };
       } catch (err) {
-        return { message: `${color18.red("codebase-map failed:")} ${toErrorMessage10(err)}` };
+        return { message: `${color18.red("codebase-map failed:")} ${toErrorMessage11(err)}` };
       }
     }
   };
@@ -15744,7 +15979,7 @@ function renderFreshness(report) {
 }
 
 // src/slash-commands/codebase-reindex.ts
-import { color as color19, toErrorMessage as toErrorMessage11 } from "@wrongstack/core/utils";
+import { color as color19, toErrorMessage as toErrorMessage12 } from "@wrongstack/core/utils";
 import { resetIndexCircuitBreaker, runStartupIndex } from "@wrongstack/tools";
 function buildCodebaseReindexCommand(opts) {
   return {
@@ -15776,7 +16011,7 @@ ${color19.yellow("  corrupt index detected \u2014 rebuilt from scratch")}` : "")
 ${color19.yellow(`  ${r.errors.length} error(s) reported`)}` : "");
         return { message: summary };
       } catch (err) {
-        const msg = `${color19.red("Codebase reindex failed:")} ${toErrorMessage11(err)}`;
+        const msg = `${color19.red("Codebase reindex failed:")} ${toErrorMessage12(err)}`;
         return { message: msg };
       }
     }
@@ -15784,7 +16019,7 @@ ${color19.yellow(`  ${r.errors.length} error(s) reported`)}` : "");
 }
 
 // src/slash-commands/collab.ts
-import { color as color20, toErrorMessage as toErrorMessage12, truncate } from "@wrongstack/core/utils";
+import { color as color20, toErrorMessage as toErrorMessage13, truncate } from "@wrongstack/core/utils";
 function buildCollabCommand(opts) {
   return {
     name: "collab",
@@ -15862,7 +16097,7 @@ async function historyCommand(opts, sessionId, args) {
     }
   } catch (err) {
     return {
-      message: color20.yellow(`Failed to read session: ${toErrorMessage12(err)}`)
+      message: color20.yellow(`Failed to read session: ${toErrorMessage13(err)}`)
     };
   }
   const tail = events.slice(-limit);
@@ -16780,7 +17015,7 @@ ${description}`
 // src/slash-commands/delegate.ts
 import { AGENT_CATALOG, AGENTS_BY_PHASE } from "@wrongstack/core/agent-catalog";
 import { dispatchAgent as dispatchAgent2 } from "@wrongstack/core/coordination";
-import { color as color23, toErrorMessage as toErrorMessage13 } from "@wrongstack/core/utils";
+import { color as color23, toErrorMessage as toErrorMessage14 } from "@wrongstack/core/utils";
 function buildDelegateCommand(opts) {
   return {
     name: "delegate",
@@ -16899,7 +17134,7 @@ async function spawnAgent(opts, role, _task, _name, header) {
     opts.renderer.write(msg);
     return { message: msg };
   } catch (err) {
-    const msg = `${color23.red("\u2717 Spawn failed")}: ${toErrorMessage13(err)}`;
+    const msg = `${color23.red("\u2717 Spawn failed")}: ${toErrorMessage14(err)}`;
     opts.renderer.writeWarning(msg);
     return { message: msg };
   }
@@ -17406,7 +17641,7 @@ function buildStatsCommand(opts) {
 // src/slash-commands/doctor.ts
 import * as fs8 from "node:fs/promises";
 import * as path20 from "node:path";
-import { atomicWrite as atomicWrite3, color as color26, toErrorMessage as toErrorMessage14, withFileLock as withFileLock2 } from "@wrongstack/core/utils";
+import { atomicWrite as atomicWrite3, color as color26, toErrorMessage as toErrorMessage15, withFileLock as withFileLock2 } from "@wrongstack/core/utils";
 
 // src/config-doctor.ts
 import { isSecretField } from "@wrongstack/core/security";
@@ -17999,7 +18234,7 @@ async function runSessionsDoctor(opts, rest) {
   try {
     report = await diagnoseSessions({ sessionsDir });
   } catch (err) {
-    return { message: `${color26.red("Session scan failed")} ${toErrorMessage14(err)}` };
+    return { message: `${color26.red("Session scan failed")} ${toErrorMessage15(err)}` };
   }
   const lines = [`${color26.bold("WrongStack")} ${color26.dim("\u2014 Session Doctor")}`, ""];
   const gb = (bytes) => bytes >= 1e9 ? `${(bytes / 1e9).toFixed(2)} GB` : `${(bytes / 1e6).toFixed(1)} MB`;
@@ -18050,7 +18285,7 @@ async function runSessionsDoctor(opts, rest) {
     try {
       lines.push(`  ${color26.green("\u2713")} re-indexed ${await store.rebuildIndex()} session(s)`);
     } catch (err) {
-      lines.push(`  ${color26.red("\u2717")} catalog rebuild failed: ${toErrorMessage14(err)}`);
+      lines.push(`  ${color26.red("\u2717")} catalog rebuild failed: ${toErrorMessage15(err)}`);
     }
   }
   for (const failure of repair.failed) {
@@ -18204,7 +18439,7 @@ function buildDoctorCommand(opts) {
             parsed = JSON.parse(stripBom(raw));
           } catch (err) {
             errorCount++;
-            const msg = toErrorMessage14(err);
+            const msg = toErrorMessage15(err);
             lines.push(`  ${color26.red("\u2717")} invalid JSON \u2014 ${msg}`);
             if (!applyFixes) {
               fixableCount++;
@@ -18574,7 +18809,7 @@ import {
   resolveAcpAgentCommand as resolveAcpAgentCommand3,
   runEnsemble as runEnsemble2
 } from "@wrongstack/acp";
-import { toErrorMessage as toErrorMessage15 } from "@wrongstack/core/utils";
+import { toErrorMessage as toErrorMessage16 } from "@wrongstack/core/utils";
 function buildEnsembleCommand(opts) {
   return {
     name: "ensemble",
@@ -18664,7 +18899,7 @@ function buildEnsembleCommand(opts) {
         });
         return { message: renderEnsembleText2(result) };
       } catch (err) {
-        return { message: `Ensemble failed: ${toErrorMessage15(err)}` };
+        return { message: `Ensemble failed: ${toErrorMessage16(err)}` };
       }
     }
   };
@@ -18756,7 +18991,7 @@ import {
   parseModelRef as parseModelRef3,
   simulateFallbackFailover
 } from "@wrongstack/core/agent";
-import { color as color30, toErrorMessage as toErrorMessage16, updateJsonObjectFile as updateJsonObjectFile4 } from "@wrongstack/core/utils";
+import { color as color30, toErrorMessage as toErrorMessage17, updateJsonObjectFile as updateJsonObjectFile4 } from "@wrongstack/core/utils";
 
 // src/slash-commands/fallback-chain-view.ts
 import { runtimeFallbackChain, smartDefaultFallbackChain } from "@wrongstack/core/agent";
@@ -19338,7 +19573,7 @@ ${color30.dim("Add favorites first: /fallback fav add <ref>, or fix provider mod
         };
       } catch (err) {
         return {
-          message: `${color30.red("fallback error")}: ${toErrorMessage16(err)}`
+          message: `${color30.red("fallback error")}: ${toErrorMessage17(err)}`
         };
       }
     }
@@ -20285,7 +20520,7 @@ When the error confidence is low (< 0.85) or the problem spans multiple files,
 import { AGENTS_BY_PHASE as AGENTS_BY_PHASE2, summarizeDispatchLog } from "@wrongstack/core/agent-catalog";
 import { dispatchAgent as dispatchAgent3 } from "@wrongstack/core/coordination";
 import { sandboxTierForAgent } from "@wrongstack/core/sandbox";
-import { color as color32, toErrorMessage as toErrorMessage17 } from "@wrongstack/core/utils";
+import { color as color32, toErrorMessage as toErrorMessage18 } from "@wrongstack/core/utils";
 var PHASE_ORDER = [
   { phase: "discovery", label: "1 \xB7 Discovery" },
   { phase: "planning", label: "2 \xB7 Planning" },
@@ -20601,7 +20836,7 @@ async function handleSpawn(opts, subargs) {
       const id = await opts.onFleetSpawn(role);
       spawned.push(id);
     } catch (err) {
-      const warnMsg = `${color32.red("\u2717 Spawn failed")} for slot ${i + 1}: ${toErrorMessage17(err)}`;
+      const warnMsg = `${color32.red("\u2717 Spawn failed")} for slot ${i + 1}: ${toErrorMessage18(err)}`;
       opts.renderer.writeWarning(warnMsg);
     }
   }
@@ -20711,7 +20946,7 @@ ${msg2}` };
       const id = await opts.onFleetSpawn(decision.role);
       lines.push(`  ${color32.green("\u2713 spawned")} ${color32.bold(decision.role)} as ${color32.dim(id)}`);
     } catch (err) {
-      lines.push(`  ${color32.amber("\u26A0 spawn failed:")} ${toErrorMessage17(err)}`);
+      lines.push(`  ${color32.amber("\u26A0 spawn failed:")} ${toErrorMessage18(err)}`);
     }
   } else {
     lines.push(`  ${color32.dim("(no fleet active \u2014 try spawning a task)")}`);
@@ -21076,7 +21311,7 @@ import {
   color as color34,
   configureChildEnvGitIdentity as configureChildEnvGitIdentity2,
   getChildEnvGitIdentity,
-  toErrorMessage as toErrorMessage18,
+  toErrorMessage as toErrorMessage19,
   updateJsonObjectFile as updateJsonObjectFile5
 } from "@wrongstack/core/utils";
 function looksLikeEmail(s) {
@@ -21191,7 +21426,7 @@ function buildGitIdCommand(opts) {
           message: `${color34.red("Unknown subcommand")} "${sub}". Try ${color34.dim("/gitid")}, ${color34.dim("/gitid set <name...> <email>")}, or ${color34.dim("/gitid help")}.`
         };
       } catch (err) {
-        return { message: `${color34.red("gitid error")}: ${toErrorMessage18(err)}` };
+        return { message: `${color34.red("gitid error")}: ${toErrorMessage19(err)}` };
       }
     }
   };
@@ -23786,16 +24021,16 @@ function buildKanbanCommand(opts) {
 
 // src/slash-commands/mailbox.ts
 import {
-  getSharedProjectMailbox as getSharedProjectMailbox8,
+  getSharedProjectMailbox as getSharedProjectMailbox9,
   mailboxSessionTag as mailboxSessionTag6,
   resolveMailboxIdentity,
-  resolveProjectDir as resolveProjectDir3
+  resolveProjectDir as resolveProjectDir4
 } from "@wrongstack/core/coordination";
-import { color as color42, wstackGlobalRoot as wstackGlobalRoot3 } from "@wrongstack/core/utils";
+import { color as color42, wstackGlobalRoot as wstackGlobalRoot4 } from "@wrongstack/core/utils";
 function buildMailbox(opts) {
-  const projectDir = opts.paths?.projectDir ?? resolveProjectDir3(opts.projectRoot, wstackGlobalRoot3());
+  const projectDir = opts.paths?.projectDir ?? resolveProjectDir4(opts.projectRoot, wstackGlobalRoot4());
   try {
-    return getSharedProjectMailbox8(projectDir);
+    return getSharedProjectMailbox9(projectDir);
   } catch {
     return null;
   }
@@ -24117,15 +24352,15 @@ function buildMailboxCommand(opts) {
 
 // src/slash-commands/mailbox-demo.ts
 import {
-  getSharedProjectMailbox as getSharedProjectMailbox9,
-  resolveProjectDir as resolveProjectDir4
+  getSharedProjectMailbox as getSharedProjectMailbox10,
+  resolveProjectDir as resolveProjectDir5
 } from "@wrongstack/core/coordination";
-import { wstackGlobalRoot as wstackGlobalRoot4 } from "@wrongstack/core/utils";
+import { wstackGlobalRoot as wstackGlobalRoot5 } from "@wrongstack/core/utils";
 var DEMO_AGENT_ID = "mailbox-demo";
 function buildMailbox2(opts) {
-  const projectDir = opts.paths?.projectDir ?? resolveProjectDir4(opts.projectRoot, wstackGlobalRoot4());
+  const projectDir = opts.paths?.projectDir ?? resolveProjectDir5(opts.projectRoot, wstackGlobalRoot5());
   try {
-    return getSharedProjectMailbox9(projectDir);
+    return getSharedProjectMailbox10(projectDir);
   } catch {
     return null;
   }
@@ -24315,8 +24550,8 @@ import * as fs11 from "node:fs/promises";
 import * as os3 from "node:os";
 import * as path24 from "node:path";
 import { cliSpawnArgs as cliSpawnArgs2 } from "@wrongstack/core/utils";
-import { resolveProjectDir as resolveProjectDir5 } from "@wrongstack/core/coordination";
-import { wstackGlobalRoot as wstackGlobalRoot5 } from "@wrongstack/core/utils";
+import { resolveProjectDir as resolveProjectDir6 } from "@wrongstack/core/coordination";
+import { wstackGlobalRoot as wstackGlobalRoot6 } from "@wrongstack/core/utils";
 function buildMailboxServeCommand(opts) {
   return {
     name: "mailbox-serve",
@@ -24355,7 +24590,7 @@ function buildMailboxServeCommand(opts) {
         else if (tok === "--host" || tok === "--port") flags.push(tok);
       }
       const cwd = opts.paths?.projectDir ?? opts.cwd;
-      const projectDir = resolveProjectDir5(cwd, wstackGlobalRoot5());
+      const projectDir = resolveProjectDir6(cwd, wstackGlobalRoot6());
       const tokenPath = path24.join(projectDir, ".mailbox.token");
       const pidFile = path24.join(
         os3.tmpdir(),
@@ -24738,12 +24973,12 @@ function errorMessage(err) {
 }
 
 // src/slash-commands/memory.ts
-import { toErrorMessage as toErrorMessage24 } from "@wrongstack/core/utils";
+import { toErrorMessage as toErrorMessage25 } from "@wrongstack/core/utils";
 import { getSageSurface as getSageSurface5 } from "@wrongstack/sage";
 import { runSearchRace } from "@wrongstack/vector-memory";
 
 // src/slash-commands/memory-audience.ts
-import { toErrorMessage as toErrorMessage19 } from "@wrongstack/core/utils";
+import { toErrorMessage as toErrorMessage20 } from "@wrongstack/core/utils";
 function parseAudienceFlags(tokens) {
   const out = { errors: [] };
   for (let i = 0; i < tokens.length; i++) {
@@ -24872,7 +25107,7 @@ async function runAudienceMemory(store, rest) {
         message: `Remembered \`${memory.id}\` for ${formatAudienceSelector(memory.audience)}: ${memory.text}`
       };
     } catch (err) {
-      return { message: `Could not remember: ${toErrorMessage19(err)}` };
+      return { message: `Could not remember: ${toErrorMessage20(err)}` };
     }
   }
   if (sub === "clear") {
@@ -24884,7 +25119,7 @@ async function runAudienceMemory(store, rest) {
         message: `Cleared audience scope from \`${id}\` \u2014 it is now general project memory.`
       };
     } catch (err) {
-      return { message: `Could not clear audience: ${toErrorMessage19(err)}` };
+      return { message: `Could not clear audience: ${toErrorMessage20(err)}` };
     }
   }
   if (sub === "search" || sub === "find") {
@@ -25042,7 +25277,7 @@ async function runAudienceMemory(store, rest) {
 }
 
 // src/slash-commands/memory-compact.ts
-import { toErrorMessage as toErrorMessage20 } from "@wrongstack/core/utils";
+import { toErrorMessage as toErrorMessage21 } from "@wrongstack/core/utils";
 import { getSageSurface as getSageSurface2 } from "@wrongstack/sage";
 var COMPACT_SYSTEM_PROMPT = `You are a memory curator. Your task is to review, deduplicate, and improve a set of long-term memory entries.
 
@@ -25154,7 +25389,7 @@ async function runCompact(opts) {
     responseText = response.content.filter((b) => b.type === "text").map((b) => b.text).join("").trim();
   } catch (err) {
     return {
-      message: `LLM call failed: ${toErrorMessage20(err)}`
+      message: `LLM call failed: ${toErrorMessage21(err)}`
     };
   }
   if (!responseText) {
@@ -25170,7 +25405,7 @@ ${responseText.slice(0, 500)}` };
     parsed = JSON.parse(jsonMatch[0]);
   } catch (err) {
     return {
-      message: `Failed to parse LLM response: ${toErrorMessage20(err)}
+      message: `Failed to parse LLM response: ${toErrorMessage21(err)}
 
 Raw response:
 ${responseText.slice(0, 500)}`
@@ -25243,7 +25478,7 @@ ${responseText.slice(0, 500)}`
         }
       }
     } catch (err) {
-      errors.push(`${op.action} failed for ${op.targets.join(", ")}: ${toErrorMessage20(err)}`);
+      errors.push(`${op.action} failed for ${op.targets.join(", ")}: ${toErrorMessage21(err)}`);
     }
   }
   const lines = ["## Memory Compact \u2014 Complete"];
@@ -25744,7 +25979,7 @@ function formatSearchRace(race) {
 }
 
 // src/slash-commands/memory-gather.ts
-import { toErrorMessage as toErrorMessage21 } from "@wrongstack/core/utils";
+import { toErrorMessage as toErrorMessage22 } from "@wrongstack/core/utils";
 import { getSageSurface as getSageSurface3, SAGE_KINDS } from "@wrongstack/sage";
 async function runPathMemory(store, targetPath, includeAncestors) {
   const Sage = getSageSurface3(store);
@@ -25915,12 +26150,12 @@ async function runGatherCommand(Sage, rest) {
     }
     return { message: lines.join("\n") };
   } catch (err) {
-    return { message: `gather failed: ${toErrorMessage21(err)}` };
+    return { message: `gather failed: ${toErrorMessage22(err)}` };
   }
 }
 
 // src/slash-commands/memory-purge-domain-terms.ts
-import { toErrorMessage as toErrorMessage22 } from "@wrongstack/core/utils";
+import { toErrorMessage as toErrorMessage23 } from "@wrongstack/core/utils";
 var DOMAIN_TERM_TAG2 = "domain-term";
 async function runPurgeDomainTerms(Sage, rest) {
   if (!Sage) return requiresSage("purge-domain-terms");
@@ -25974,7 +26209,7 @@ This is a one-off migration that permanently removes every SAGE memory tagged \`
         });
         deleted++;
       } catch (err) {
-        failures.push(`${t.id}: ${toErrorMessage22(err)}`);
+        failures.push(`${t.id}: ${toErrorMessage23(err)}`);
       }
     }
     const tagSummary = /* @__PURE__ */ new Map();
@@ -26000,7 +26235,7 @@ The \`${DOMAIN_TERM_TAG2}\` tag is now absent from the live corpus. Run \`/memor
     };
   } catch (err) {
     return {
-      message: `purge-domain-terms failed: ${toErrorMessage22(err)}`
+      message: `purge-domain-terms failed: ${toErrorMessage23(err)}`
     };
   }
 }
@@ -26134,7 +26369,7 @@ async function runStats(opts) {
 
 // src/slash-commands/memory-triage.ts
 import { resolveTypeSafeJudge as resolveTypeSafeJudge2 } from "@wrongstack/core/typesafe";
-import { toErrorMessage as toErrorMessage23 } from "@wrongstack/core/utils";
+import { toErrorMessage as toErrorMessage24 } from "@wrongstack/core/utils";
 import {
   createSystemOneTriage,
   fileTriageProposals,
@@ -26258,7 +26493,7 @@ Usage: /memory triage [--dry-run|--apply] [--limit N] [--max-phase3 N] [--max-ph
       systemOne
     });
   } catch (err) {
-    return { message: `Triage failed: ${toErrorMessage23(err)}` };
+    return { message: `Triage failed: ${toErrorMessage24(err)}` };
   }
   if (!dryRun) {
     const applyReport = await applyDispatch(Sage, report);
@@ -26318,7 +26553,7 @@ async function applyDispatch(Sage, report) {
       autoOk++;
     } catch (err) {
       autoFail++;
-      lines.push(`  \u2717 Failed to update ${action.memoryId}: ${toErrorMessage23(err)}`);
+      lines.push(`  \u2717 Failed to update ${action.memoryId}: ${toErrorMessage24(err)}`);
     }
   }
   lines.push(`**Auto-apply:** ${autoOk} succeeded, ${autoFail} failed`);
@@ -26342,7 +26577,7 @@ async function applyDispatch(Sage, report) {
     } catch (err) {
       mergeFail++;
       lines.push(
-        `  \u2717 Failed to merge ${merge.supersededId} \u2192 ${merge.keeperId}: ${toErrorMessage23(err)}`
+        `  \u2717 Failed to merge ${merge.supersededId} \u2192 ${merge.keeperId}: ${toErrorMessage24(err)}`
       );
     }
   }
@@ -26428,7 +26663,7 @@ function buildMemoryCommand(opts) {
               message: `Remembered \`${memory.id}\` [${memory.kind}] ${memory.text}${tags}`
             };
           } catch (err) {
-            return { message: `Could not remember: ${toErrorMessage24(err)}` };
+            return { message: `Could not remember: ${toErrorMessage25(err)}` };
           }
         }
         case "update":
@@ -26466,7 +26701,7 @@ function buildMemoryCommand(opts) {
               message: `Updated \`${memory.id}\` [${memory.kind}|${memory.status}] ${memory.text}`
             };
           } catch (err) {
-            return { message: `Could not update: ${toErrorMessage24(err)}` };
+            return { message: `Could not update: ${toErrorMessage25(err)}` };
           }
         }
         case "delete":
@@ -26481,7 +26716,7 @@ function buildMemoryCommand(opts) {
             await Sage.deleteSage(id, reason, { force: true });
             return { message: `Deleted \`${id}\`.` };
           } catch (err) {
-            return { message: `Could not delete: ${toErrorMessage24(err)}` };
+            return { message: `Could not delete: ${toErrorMessage25(err)}` };
           }
         }
         case "forget":
@@ -26745,7 +26980,7 @@ function buildMemoryCommand(opts) {
 File size reduced. Audit-logged as \`memory.log_compacted\`.`
             };
           } catch (err) {
-            return { message: `Compaction failed: ${toErrorMessage24(err)}` };
+            return { message: `Compaction failed: ${toErrorMessage25(err)}` };
           }
         }
         case "stats": {
@@ -27228,7 +27463,7 @@ function buildModelCapsCommand(opts) {
 import {
   ToolValidationError as ToolValidationError3
 } from "@wrongstack/core/types";
-import { color as color46, toErrorMessage as toErrorMessage25, updateJsonObjectFile as updateJsonObjectFile6 } from "@wrongstack/core/utils";
+import { color as color46, toErrorMessage as toErrorMessage26, updateJsonObjectFile as updateJsonObjectFile6 } from "@wrongstack/core/utils";
 async function patchProfileConfig(mutate, profileConfigPath) {
   return updateJsonObjectFile6(profileConfigPath, async (config) => {
     await backupCurrent(void 0, profileConfigPath);
@@ -27437,7 +27672,7 @@ function buildModelsCommand(opts) {
         };
       } catch (err) {
         return {
-          message: `${color46.red("models error")}: ${toErrorMessage25(err)}`
+          message: `${color46.red("models error")}: ${toErrorMessage26(err)}`
         };
       }
     }
@@ -27593,7 +27828,7 @@ function handleList2(opts) {
 // src/slash-commands/nextsteps-mode.ts
 import { noOpVault as noOpVault3 } from "@wrongstack/core/security";
 import { NEXT_STEPS_MODES as NEXT_STEPS_MODES2, resolveNextStepsMode } from "@wrongstack/core/types";
-import { color as color48, toErrorMessage as toErrorMessage26 } from "@wrongstack/core/utils";
+import { color as color48, toErrorMessage as toErrorMessage27 } from "@wrongstack/core/utils";
 var NEXT_STEPS_LIMIT_PRESETS = [5, 10, 20, 50, 100, 0];
 var UNLIMITED_WORDS = /* @__PURE__ */ new Set(["unlimited", "inf", "infinite", "\u221E", "sonsuz", "0"]);
 function parseNextStepsLimit(raw) {
@@ -27682,7 +27917,7 @@ function buildNextStepsModeCommand(opts) {
           (target) => apply(target)
         );
       } catch (err) {
-        return { message: `${color48.red("Failed to save")}: ${toErrorMessage26(err)}` };
+        return { message: `${color48.red("Failed to save")}: ${toErrorMessage27(err)}` };
       }
       const liveAutonomy = { ...opts.configStore.get().autonomy ?? {} };
       apply(liveAutonomy);
@@ -27937,7 +28172,7 @@ import {
   readSessionPermissionOverrides,
   setSessionPermissionOverrides
 } from "@wrongstack/core/security";
-import { color as color50, toErrorMessage as toErrorMessage27 } from "@wrongstack/core/utils";
+import { color as color50, toErrorMessage as toErrorMessage28 } from "@wrongstack/core/utils";
 var HELP2 = [
   "Usage:",
   "  /permissions                       List this session\u2019s allow/deny rules",
@@ -28023,7 +28258,7 @@ ${formatPermissionRules(rules)}` };
 
 ${formatExplainedCall(explained)}` };
         } catch (err) {
-          return { message: color50.red(`Explain failed: ${toErrorMessage27(err)}`) };
+          return { message: color50.red(`Explain failed: ${toErrorMessage28(err)}`) };
         }
       }
       let next;
@@ -28078,7 +28313,7 @@ ${HELP2}`) };
       try {
         await setSessionPermissionOverrides(ctx, next);
       } catch (err) {
-        return { message: color50.red(`Could not save the session rule: ${toErrorMessage27(err)}`) };
+        return { message: color50.red(`Could not save the session rule: ${toErrorMessage28(err)}`) };
       }
       return { message: color50.green(done) };
     }
@@ -28942,7 +29177,7 @@ function buildPruneCommand(opts) {
 
 // src/slash-commands/refiner.ts
 import { noOpVault as noOpVault4 } from "@wrongstack/core/security";
-import { color as color54, toErrorMessage as toErrorMessage28 } from "@wrongstack/core/utils";
+import { color as color54, toErrorMessage as toErrorMessage29 } from "@wrongstack/core/utils";
 function buildRefinerCommand(opts) {
   const help = [
     "Usage:",
@@ -29042,7 +29277,7 @@ function buildRefinerCommand(opts) {
           };
         } catch (err) {
           return {
-            message: `${color54.red("refiner error")}: ${toErrorMessage28(err)}`
+            message: `${color54.red("refiner error")}: ${toErrorMessage29(err)}`
           };
         }
       }
@@ -29064,7 +29299,7 @@ function buildRefinerCommand(opts) {
           };
         } catch (err) {
           return {
-            message: `${color54.red("refiner error")}: ${toErrorMessage28(err)}`
+            message: `${color54.red("refiner error")}: ${toErrorMessage29(err)}`
           };
         }
       }
@@ -30531,11 +30766,11 @@ ${sddHelp()}`
 // src/slash-commands/session.ts
 import * as path26 from "node:path";
 import { extractInterruptedTools, SessionRecovery as SessionRecovery2 } from "@wrongstack/core/storage";
-import { color as color57, toErrorMessage as toErrorMessage30 } from "@wrongstack/core/utils";
+import { color as color57, toErrorMessage as toErrorMessage31 } from "@wrongstack/core/utils";
 
 // src/slash-commands/session-live-status.ts
 import { getSessionRegistry as getSessionRegistry3 } from "@wrongstack/core/storage";
-import { color as color56, isPidAlive as isPidAlive2, toErrorMessage as toErrorMessage29 } from "@wrongstack/core/utils";
+import { color as color56, isPidAlive as isPidAlive2, toErrorMessage as toErrorMessage30 } from "@wrongstack/core/utils";
 function statusIcon2(status) {
   switch (status) {
     case "active":
@@ -30830,7 +31065,7 @@ async function killSession(sessionId, confirm) {
     };
   } catch (err) {
     return {
-      message: color56.red(`Failed to kill session: ${toErrorMessage29(err)}`)
+      message: color56.red(`Failed to kill session: ${toErrorMessage30(err)}`)
     };
   }
 }
@@ -30901,7 +31136,7 @@ function buildLoadCommand(opts) {
             message: name ? color57.green(`Renamed ${targetId} \u2192 "${name}"`) : color57.green(`Cleared name on ${targetId} (title: "${summary.title}")`)
           };
         } catch (err) {
-          return { message: color57.red(`Rename failed: ${toErrorMessage30(err)}`) };
+          return { message: color57.red(`Rename failed: ${toErrorMessage31(err)}`) };
         }
       }
       if (first === "move") {
@@ -30931,7 +31166,7 @@ function buildLoadCommand(opts) {
           });
           return { message: color57.green(describeSessionMove(result)) };
         } catch (err) {
-          return { message: color57.red(`Move failed: ${toErrorMessage30(err)}`) };
+          return { message: color57.red(`Move failed: ${toErrorMessage31(err)}`) };
         }
       }
       if (first === "archive") {
@@ -30951,7 +31186,7 @@ function buildLoadCommand(opts) {
               )
             };
           } catch (err) {
-            return { message: color57.red(`Archive failed: ${toErrorMessage30(err)}`) };
+            return { message: color57.red(`Archive failed: ${toErrorMessage31(err)}`) };
           }
         }
         if (!apply) {
@@ -30991,7 +31226,7 @@ function buildLoadCommand(opts) {
             message: result.action === "rehydrated" ? color57.green(`Rehydrated ${targetId}`) : color57.dim(`Rehydrate ${result.action}: ${targetId}`)
           };
         } catch (err) {
-          return { message: color57.red(`Rehydrate failed: ${toErrorMessage30(err)}`) };
+          return { message: color57.red(`Rehydrate failed: ${toErrorMessage31(err)}`) };
         }
       }
       if (first === "delete") {
@@ -31022,7 +31257,7 @@ function buildLoadCommand(opts) {
           await opts.sessionStore.delete(targetId);
           return { message: color57.green(`Deleted session ${targetId}`) };
         } catch (err) {
-          return { message: color57.red(`Delete failed: ${toErrorMessage30(err)}`) };
+          return { message: color57.red(`Delete failed: ${toErrorMessage31(err)}`) };
         }
       }
       const showIncomplete = parts.includes("--incomplete") || parts.includes("-i");
@@ -31184,7 +31419,7 @@ import {
   isReasoningEffort as isReasoningEffort2,
   REASONING_EFFORT_LEVELS as REASONING_EFFORT_LEVELS2
 } from "@wrongstack/core/types";
-import { color as color58, expectDefined as expectDefined9, toErrorMessage as toErrorMessage31, updateJsonObjectFile as updateJsonObjectFile7 } from "@wrongstack/core/utils";
+import { color as color58, expectDefined as expectDefined9, toErrorMessage as toErrorMessage32, updateJsonObjectFile as updateJsonObjectFile7 } from "@wrongstack/core/utils";
 import { catalogProviderIdFor as catalogProviderIdFor5 } from "@wrongstack/providers";
 async function resolveCatalogModelIds(registry, config, providerIds) {
   const out = /* @__PURE__ */ new Map();
@@ -31724,7 +31959,7 @@ function buildSetModelCommand(opts) {
         };
       } catch (err) {
         return {
-          message: `${color58.red("setmodel error")}: ${toErrorMessage31(err)}`
+          message: `${color58.red("setmodel error")}: ${toErrorMessage32(err)}`
         };
       }
     }
@@ -32057,7 +32292,7 @@ ${help}`) };
 import { execFile as execFile2 } from "node:child_process";
 import { access as access3 } from "node:fs/promises";
 import * as path27 from "node:path";
-import { color as color60, toErrorMessage as toErrorMessage32 } from "@wrongstack/core/utils";
+import { color as color60, toErrorMessage as toErrorMessage33 } from "@wrongstack/core/utils";
 import { parseNextSteps } from "@wrongstack/tools/next-steps";
 function readGitStatus(projectRoot, includeBranch) {
   const args = ["status", "--short"];
@@ -32198,7 +32433,7 @@ function buildSuggestCommand(opts) {
         return { message: formatSuggestions(suggestions) };
       } catch (err) {
         if (!isCurrent()) return superseded();
-        const msg = `Suggestion generation failed: ${toErrorMessage32(err)}`;
+        const msg = `Suggestion generation failed: ${toErrorMessage33(err)}`;
         opts.renderer.writeWarning(msg);
         return { message: msg };
       }
@@ -32507,7 +32742,7 @@ function buildThemeCommand(opts) {
 
 // src/slash-commands/tier.ts
 import { leaderTierPolicy, listTierIds, resolveTier } from "@wrongstack/core/coordination";
-import { color as color62, toErrorMessage as toErrorMessage33, updateJsonObjectFile as updateJsonObjectFile8 } from "@wrongstack/core/utils";
+import { color as color62, toErrorMessage as toErrorMessage34, updateJsonObjectFile as updateJsonObjectFile8 } from "@wrongstack/core/utils";
 var LEADER_MODES = ["off", "propose", "auto"];
 var DECIMAL_RE2 = /^(?:\d+(?:\.\d*)?|\.\d+)$/;
 var INTEGER_RE2 = /^\d+$/;
@@ -32824,7 +33059,7 @@ function buildTierCommand(opts) {
           message: `${color62.red("Unknown subcommand")} "${sub}". Try ${color62.dim("/tier")} or ${color62.dim("/tier help")}.`
         };
       } catch (err) {
-        return { message: `${color62.red("tier error")}: ${toErrorMessage33(err)}` };
+        return { message: `${color62.red("tier error")}: ${toErrorMessage34(err)}` };
       }
     }
   };
@@ -34316,7 +34551,7 @@ function buildSecurityCommand(opts) {
 import { color as color74 } from "@wrongstack/core/utils";
 
 // src/slash-commands/settings-mutations.ts
-import { color as color72, toErrorMessage as toErrorMessage34 } from "@wrongstack/core/utils";
+import { color as color72, toErrorMessage as toErrorMessage35 } from "@wrongstack/core/utils";
 
 // src/slash-commands/settings-context-mutations.ts
 import { color as color66 } from "@wrongstack/core/utils";
@@ -35480,7 +35715,7 @@ async function executeSettingsSubcommand(sub, rest, opts) {
     };
   } catch (err) {
     return {
-      message: `${color72.red("Settings error")}: ${toErrorMessage34(err)}`
+      message: `${color72.red("Settings error")}: ${toErrorMessage35(err)}`
     };
   }
 }
@@ -36048,7 +36283,7 @@ function buildSidebarCommand(opts) {
 }
 
 // src/slash-commands/spawn-agents.ts
-import { toErrorMessage as toErrorMessage35 } from "@wrongstack/core/utils";
+import { toErrorMessage as toErrorMessage36 } from "@wrongstack/core/utils";
 function buildSpawnCommand(opts) {
   return {
     name: "spawn",
@@ -36085,7 +36320,7 @@ function buildSpawnCommand(opts) {
         const summary = Object.keys(parsed).length > 0 ? await opts.onSpawn(description, parsed) : await opts.onSpawn(description);
         return { message: summary };
       } catch (err) {
-        return { message: `Spawn failed: ${toErrorMessage35(err)}` };
+        return { message: `Spawn failed: ${toErrorMessage36(err)}` };
       }
     }
   };
@@ -36370,7 +36605,7 @@ function buildSupervisorCommand(opts) {
 }
 
 // src/slash-commands/tasks.ts
-import { randomUUID as randomUUID10 } from "node:crypto";
+import { randomUUID as randomUUID11 } from "node:crypto";
 import {
   addPlanItem as addPlanItem2,
   formatPlan as formatPlan2,
@@ -36535,7 +36770,7 @@ ${formatPlan2(updated)}`;
             const title = parts.join(" ");
             const now = (/* @__PURE__ */ new Date()).toISOString();
             file.tasks.push({
-              id: `task_${randomUUID10()}`,
+              id: `task_${randomUUID11()}`,
               title,
               type,
               priority,
@@ -36705,7 +36940,7 @@ ${formatTaskProgress(file.tasks)}`;
             ];
             if (found.item.description) {
               todos.push({
-                id: `todo_${randomUUID10()}`,
+                id: `todo_${randomUUID11()}`,
                 content: found.item.description.slice(0, 200),
                 status: "pending",
                 promotedFromTask: found.item.id
@@ -36791,7 +37026,7 @@ ${formatTaskProgress(file.tasks)}`;
 // src/slash-commands/techstack.ts
 import * as fs15 from "node:fs/promises";
 import * as path30 from "node:path";
-import { color as color78, toErrorMessage as toErrorMessage36 } from "@wrongstack/core/utils";
+import { color as color78, toErrorMessage as toErrorMessage37 } from "@wrongstack/core/utils";
 async function discoverPackageFiles(projectRoot) {
   const files = [];
   const rootPkg = path30.join(projectRoot, "package.json");
@@ -36999,7 +37234,7 @@ function buildTechStackCommand(opts) {
             message: `TechStack remediation finished: ${applied} applied, ${failed} failed, ${skipped} skipped.`
           };
         } catch (err) {
-          const msg = `TechStack remediation failed: ${toErrorMessage36(err)}`;
+          const msg = `TechStack remediation failed: ${toErrorMessage37(err)}`;
           opts.renderer.writeWarning(msg);
           return { message: msg };
         } finally {
@@ -37018,7 +37253,7 @@ function buildTechStackCommand(opts) {
             message: `TechStack inventory complete: ${snapshot.workspaces.length} workspaces, ${snapshot.dependencies.length} dependencies (fingerprint: ${snapshot.fingerprint})`
           };
         } catch (err) {
-          const msg = `TechStack inventory failed: ${toErrorMessage36(err)}`;
+          const msg = `TechStack inventory failed: ${toErrorMessage37(err)}`;
           opts.renderer.writeWarning(msg);
           return { message: msg };
         }
@@ -37033,7 +37268,7 @@ function buildTechStackCommand(opts) {
           );
         }
       } catch (err) {
-        discoveryNote = color78.red(`Could not scan for package files: ${toErrorMessage36(err)}`);
+        discoveryNote = color78.red(`Could not scan for package files: ${toErrorMessage37(err)}`);
       }
       const task = buildTechStackTask({
         projectRoot: opts.projectRoot,
@@ -37073,7 +37308,7 @@ function buildTechStackCommand(opts) {
         });
         return { message: summary };
       } catch (err) {
-        const msg = `Tech stack scan failed: ${toErrorMessage36(err)}`;
+        const msg = `Tech stack scan failed: ${toErrorMessage37(err)}`;
         opts.renderer.writeWarning(msg);
         return { message: msg };
       }
@@ -37082,7 +37317,7 @@ function buildTechStackCommand(opts) {
 }
 
 // src/slash-commands/telegram-settings.ts
-import { color as color80, toErrorMessage as toErrorMessage37 } from "@wrongstack/core/utils";
+import { color as color80, toErrorMessage as toErrorMessage38 } from "@wrongstack/core/utils";
 
 // src/slash-commands/telegram-setup.ts
 import { color as color79 } from "@wrongstack/core/utils";
@@ -37580,7 +37815,7 @@ function buildTelegramSettingsCommand(opts) {
         };
       } catch (err) {
         return {
-          message: `${color80.red("Settings error")}: ${toErrorMessage37(err)}`
+          message: `${color80.red("Settings error")}: ${toErrorMessage38(err)}`
         };
       }
     }
@@ -37588,7 +37823,7 @@ function buildTelegramSettingsCommand(opts) {
 }
 
 // src/slash-commands/todos.ts
-import { randomUUID as randomUUID11 } from "node:crypto";
+import { randomUUID as randomUUID12 } from "node:crypto";
 import { formatTodosList as formatTodosList2 } from "@wrongstack/core/utils";
 import { todoTool as todoTool3 } from "@wrongstack/tools";
 function findTodo(todos, query) {
@@ -37648,7 +37883,7 @@ function buildTodosCommand(opts) {
               return { message: "This Todo list is a Kanban projection. Add the task in Kanban." };
             }
             const item = {
-              id: `todo_${Date.now()}_${randomUUID11().slice(0, 7)}`,
+              id: `todo_${Date.now()}_${randomUUID12().slice(0, 7)}`,
               content: restJoined,
               status: "pending"
             };
@@ -37753,7 +37988,7 @@ import {
   normalizeToolDescriptionMode,
   normalizeToolResultRenderMode,
   setToolResultRenderMode,
-  toErrorMessage as toErrorMessage38
+  toErrorMessage as toErrorMessage39
 } from "@wrongstack/core/utils";
 
 // src/slash-commands/tool-auto-thin-commands.ts
@@ -38278,7 +38513,7 @@ function buildToolCommand(opts) {
         try {
           return { message: await cmdEnableAll() };
         } catch (err) {
-          return { message: `${color82.red("Error")}: ${toErrorMessage38(err)}` };
+          return { message: `${color82.red("Error")}: ${toErrorMessage39(err)}` };
         }
       }
       if (sub === "autothin" || sub === "auto-thin") {
@@ -38306,7 +38541,7 @@ function buildToolCommand(opts) {
               };
           }
         } catch (err) {
-          return { message: `${color82.red("Error")}: ${toErrorMessage38(err)}` };
+          return { message: `${color82.red("Error")}: ${toErrorMessage39(err)}` };
         }
       }
       const name = parts[0] ?? "";
@@ -38320,7 +38555,7 @@ function buildToolCommand(opts) {
           for (const t of targets) results.push(await cmdDisable(t));
           return { message: results.join("\n") };
         } catch (err) {
-          return { message: `${color82.red("Error")}: ${toErrorMessage38(err)}` };
+          return { message: `${color82.red("Error")}: ${toErrorMessage39(err)}` };
         }
       }
       if (sub === "enable") {
@@ -38332,7 +38567,7 @@ function buildToolCommand(opts) {
           for (const t of targets) results.push(await cmdEnable(t));
           return { message: results.join("\n") };
         } catch (err) {
-          return { message: `${color82.red("Error")}: ${toErrorMessage38(err)}` };
+          return { message: `${color82.red("Error")}: ${toErrorMessage39(err)}` };
         }
       }
       const action = parts[1]?.toLowerCase();
@@ -38345,7 +38580,7 @@ function buildToolCommand(opts) {
         try {
           return { message: action === "disable" ? await cmdDisable(name) : await cmdEnable(name) };
         } catch (err) {
-          return { message: `${color82.red("Error")}: ${toErrorMessage38(err)}` };
+          return { message: `${color82.red("Error")}: ${toErrorMessage39(err)}` };
         }
       }
       if (!opts.toolRegistry.get(name) && !opts.toolRegistry.isDisabled(name)) {
@@ -38385,7 +38620,7 @@ function buildToolCommand(opts) {
           };
         } catch (err) {
           return {
-            message: `${color82.red("Could not save tool setting")}: ${toErrorMessage38(err)}`
+            message: `${color82.red("Could not save tool setting")}: ${toErrorMessage39(err)}`
           };
         }
       }
@@ -38405,7 +38640,7 @@ function buildToolCommand(opts) {
         };
       } catch (err) {
         return {
-          message: `${color82.red("Could not save tool setting")}: ${toErrorMessage38(err)}`
+          message: `${color82.red("Could not save tool setting")}: ${toErrorMessage39(err)}`
         };
       }
     }
@@ -39333,7 +39568,7 @@ function summaryLine(findings, fixable, handoffs, power) {
 // src/slash-commands/working-dir.ts
 import * as fs17 from "node:fs/promises";
 import * as path32 from "node:path";
-import { color as color85, toErrorMessage as toErrorMessage39 } from "@wrongstack/core/utils";
+import { color as color85, toErrorMessage as toErrorMessage40 } from "@wrongstack/core/utils";
 function buildWorkingDirCommand(_opts) {
   return {
     name: "working_dir",
@@ -39390,7 +39625,7 @@ function buildWorkingDirCommand(_opts) {
         ctx.setWorkingDir(resolved);
       } catch (err) {
         return {
-          message: color85.red(toErrorMessage39(err))
+          message: color85.red(toErrorMessage40(err))
         };
       }
       const prevRel = path32.relative(ctx.projectRoot, previous) || ".";
@@ -39833,15 +40068,15 @@ function setupCliSlashCommands(params) {
       return built;
     },
     getConfig: () => config,
-    fallbackProfileManager: container.resolve(TOKENS15.FallbackProfileManager)
+    fallbackProfileManager: container.resolve(TOKENS16.FallbackProfileManager)
   }) : void 0;
   const slashCmds = buildCommandHostSlashCommands({
     registry: slashRegistry,
     toolRegistry,
     ...createCommandHostAdapters({ agent, toolRegistry, interruptController, reader }),
     paths: wpaths,
-    compactor: container.resolve(TOKENS15.Compactor),
-    permissionPolicy: container.resolve(TOKENS15.PermissionPolicy),
+    compactor: container.resolve(TOKENS16.Compactor),
+    permissionPolicy: container.resolve(TOKENS16.PermissionPolicy),
     sessionStore,
     sessionRef,
     skillLoader,
@@ -39931,7 +40166,7 @@ function setupCliSlashCommands(params) {
     ...createEternalCommandHandlers({
       agent,
       projectRoot,
-      compactor: container.resolve(TOKENS15.Compactor),
+      compactor: container.resolve(TOKENS16.Compactor),
       effectiveMaxContext: effectiveMaxContextRef,
       onIteration: broadcastEternalIteration,
       onStage: broadcastAutonomyStage,
@@ -40271,7 +40506,7 @@ async function setupCommandHostState(input) {
 // src/wiring/dep-watcher.ts
 import * as path33 from "node:path";
 import {
-  getSharedProjectMailbox as getSharedProjectMailbox10,
+  getSharedProjectMailbox as getSharedProjectMailbox11,
   startPackageOutdatedWatcher,
   startTechStackConsumer
 } from "@wrongstack/core/coordination";
@@ -40320,7 +40555,7 @@ function setupDepWatcherConsumers(deps) {
     let offSessionEnded;
     try {
       const projectDir = path33.join(globalRoot, "projects", projectSlug);
-      const tsMailbox = getSharedProjectMailbox10(projectDir, events);
+      const tsMailbox = getSharedProjectMailbox11(projectDir, events);
       const fileAuthorOpts = {
         storageDir: projectDir,
         projectRoot
@@ -40426,7 +40661,7 @@ function setupDepWatcherConsumers(deps) {
   if (depWatcherEnabled) {
     try {
       const projectDir = path33.join(globalRoot, "projects", projectSlug);
-      const pkgMailbox = getSharedProjectMailbox10(projectDir, events);
+      const pkgMailbox = getSharedProjectMailbox11(projectDir, events);
       const pkgTrackerOpts = {
         storageDir: projectDir,
         projectRoot
@@ -41537,13 +41772,13 @@ async function wireCliOrchestration(cliCtx, state, boot) {
     brain,
     renderer,
     reader,
-    permissionPolicy: container.resolve(TOKENS16.PermissionPolicy),
+    permissionPolicy: container.resolve(TOKENS17.PermissionPolicy),
     contextMeta: agent.ctx.meta,
     configStore
   });
   if (state.config.autonomy?.yoloPlus === true) setYoloPlusMode(true);
   setSandboxExpansionApprover(
-    createPolicySandboxApprover(() => container.resolve(TOKENS16.PermissionPolicy))
+    createPolicySandboxApprover(() => container.resolve(TOKENS17.PermissionPolicy))
   );
   setupCliSlashCommands({
     slashRegistry,
@@ -41747,13 +41982,13 @@ async function wireCliOrchestration(cliCtx, state, boot) {
 // src/wiring/cli-execute-builder.ts
 import { FLEET_ROSTER as FLEET_ROSTER5 } from "@wrongstack/core/coordination";
 import { gatedEnhancerReasoning } from "@wrongstack/core/execution";
-import { TOKENS as TOKENS17 } from "@wrongstack/core/kernel";
+import { TOKENS as TOKENS18 } from "@wrongstack/core/kernel";
 
 // src/auth-menu/panel-service.ts
-import { toErrorMessage as toErrorMessage41 } from "@wrongstack/core/utils";
+import { toErrorMessage as toErrorMessage42 } from "@wrongstack/core/utils";
 
 // src/auth-menu/panel-flow-bridge.ts
-import { toErrorMessage as toErrorMessage40 } from "@wrongstack/core/utils";
+import { toErrorMessage as toErrorMessage41 } from "@wrongstack/core/utils";
 var ANSI_RE = /\u001b\[[0-9;]*m/g;
 function stripAnsi(text) {
   return text.replace(ANSI_RE, "");
@@ -41796,7 +42031,7 @@ async function runFlow(run, onSuccess) {
     return { ok };
   } catch (err) {
     if (isCancel(err)) return { ok: false, message: "Cancelled." };
-    return { ok: false, message: toErrorMessage40(err) };
+    return { ok: false, message: toErrorMessage41(err) };
   }
 }
 function plainMaskedKey(key) {
@@ -41976,13 +42211,13 @@ function createAuthPanelHost(deps) {
         deps.profileConfigPath
       );
     } catch (err) {
-      return toErrorMessage41(err);
+      return toErrorMessage42(err);
     }
     if (result === null && deps.onProvidersChanged) {
       try {
         await deps.onProvidersChanged();
       } catch (err) {
-        return `Saved, but live config reload failed: ${toErrorMessage41(err)}`;
+        return `Saved, but live config reload failed: ${toErrorMessage42(err)}`;
       }
     }
     return result;
@@ -42927,7 +43162,7 @@ async function runCliExecution(params) {
     governanceHandle,
     setConfig
   } = params;
-  const { execute } = await import("./execution-BAP566QC.js");
+  const { execute } = await import("./execution-OK34CJKJ.js");
   return execute(
     toExecuteDeps({
       core: {
@@ -43062,11 +43297,11 @@ async function runCliExecution(params) {
         },
         agent,
         setPermissionYolo: (enabled) => {
-          container.resolve(TOKENS17.PermissionPolicy).setYolo?.(enabled);
+          container.resolve(TOKENS18.PermissionPolicy).setYolo?.(enabled);
           agent.ctx.meta["yolo"] = enabled;
         },
         setLogLevel: (level) => {
-          container.resolve(TOKENS17.Logger).level = level;
+          container.resolve(TOKENS18.Logger).level = level;
         },
         sessionBridge,
         autoCompactor,
@@ -43345,4 +43580,4 @@ export {
   CLI_VERSION,
   runInteractive
 };
-//# sourceMappingURL=cli-main-JIADJ5OL.js.map
+//# sourceMappingURL=cli-main-OT63I2FX.js.map