@wrongstack/cli 1.1.4 → 1.1.6

package/dist/{chunk-COGI7EQU.js → chunk-EAATL6FL.js}

@@ -1,9 +1,27 @@
 import {
+  parseWrongForgeInfo,
+  reportWrongForgeQuota,
+  writeWrongForgeInfoCache,
   wrongstackBridgeSetup
-} from "./chunk-JKTJSLUT.js";
+} from "./chunk-QRWXHGLB.js";
 import {
   isRestrictedMode
 } from "./chunk-3LEIFO5D.js";
+import {
+  WRONGFORGE_AGENT_ID,
+  WRONGFORGE_READ_SIDE_TOOLS,
+  WfAborted,
+  WfHttpError,
+  cancelTask,
+  chooseModel,
+  followTask,
+  resolveWrongForgeEndpoint,
+  safeWfId,
+  terminalTaskRecord,
+  toProgress,
+  wfTokens,
+  wrongForgeCall
+} from "./chunk-PGC44T7N.js";
 import {
   buildProviderForId,
   resolveProviderCfgWithProxy
@@ -12,7 +30,7 @@ import {
   ACP_LEADER_PROVIDER_ID,
   acpLeaderHost,
   trackAcpLeader
-} from "./chunk-GKGWPFW2.js";
+} from "./chunk-X4DEQLAZ.js";
 
 // src/acp-agent-list.ts
 import { REGISTRY_ID_ALIASES } from "@wrongstack/acp";
@@ -449,6 +467,7 @@ function startAcpTurnReminders(options) {
 
 // src/acp-leader/acp-leader-confirm.ts
 import { confirmObserverCount } from "@wrongstack/core/agent";
+import { DEFAULT_ALWAYS_TRUST_TTL_MS, scopedApprovalPattern } from "@wrongstack/core/security";
 var ACP_CONFIRM_TIMEOUT_MS = 12e4;
 async function confirmThroughEvents(req) {
   if (req.events.listenerCount("tool.confirm_needed") - confirmObserverCount() <= 0) return false;
@@ -489,10 +508,22 @@ async function confirmThroughEvents(req) {
     });
   });
   if (answer === "abort" || answer === "no") return false;
-  const rule = { tool: req.tool.name, pattern: req.suggestedPattern };
   try {
-    if (answer === "deny") await req.permission?.deny(rule);
-    else if (answer !== "yes") await req.permission?.trust(rule);
+    if (answer === "deny") {
+      await req.permission?.deny({ tool: req.tool.name, pattern: req.suggestedPattern });
+    } else if (answer !== "yes") {
+      await req.permission?.trust({
+        tool: req.tool.name,
+        pattern: scopedApprovalPattern(
+          answer,
+          req.tool,
+          req.input,
+          req.context,
+          req.suggestedPattern
+        ),
+        ttlMs: DEFAULT_ALWAYS_TRUST_TTL_MS
+      });
+    }
   } catch {
   }
   return answer !== "deny";
@@ -538,6 +569,7 @@ function publishLeaderContext(events, sessionId, reading, fallbackMaxContext) {
 
 // src/acp-leader/acp-leader-fleet.ts
 import { randomBytes } from "node:crypto";
+import { toErrorMessage as toErrorMessage2 } from "@wrongstack/core/utils";
 import { MCPServer, serveHttp } from "@wrongstack/mcp";
 var FLEET_SERVER_NAME = "wrongstack-fleet";
 var FLEET_TOOLS = [
@@ -548,7 +580,10 @@ var FLEET_TOOLS = [
   "roll_up",
   "fleet_status",
   "session_note",
-  "terminate_subagent"
+  "terminate_subagent",
+  // Not a fleet tool, but it too must run in this process: WrongStack's
+  // skills (a /bughunt playbook) reach the agent only through it.
+  "skill"
 ];
 var MCP_PREFIX = `mcp__${FLEET_SERVER_NAME}__`;
 function fleetToolName(mcpName) {
@@ -574,7 +609,11 @@ async function startFleetEndpoint(host, run) {
         if (!offered.has(name)) {
           return { content: `Tool "${name}" is not offered here`, isError: true };
         }
-        return run ? host.runTool(name, args, run) : host.runTool(name, args);
+        try {
+          return await (run ? host.runTool(name, args, run) : host.runTool(name, args));
+        } catch (err) {
+          return { content: `Failed to execute ${name}: ${toErrorMessage2(err)}`, isError: true };
+        }
       }
     }
   });
@@ -600,7 +639,11 @@ function fleetNote(tools) {
     ...has("fleet_status") ? ["- fleet_status: what is running and its progress."] : [],
     ...has("roll_up") ? ["- roll_up: the full result of finished tasks."] : [],
     ...has("session_note") ? ["- session_note: steer a running worker."] : [],
-    ...has("terminate_subagent") ? ["- terminate_subagent: stop a worker."] : []
+    ...has("terminate_subagent") ? ["- terminate_subagent: stop a worker."] : [],
+    ...has("skill") ? [
+      "- skill: load one of WrongStack's skills by name (follow nextOffset to the last page);",
+      "  a task that names WrongStack skills means these."
+    ] : []
   ].join("\n");
 }
 
@@ -643,9 +686,28 @@ function writeLeaderSession(stateDir, sessionId, record) {
   return writing.catch(() => void 0);
 }
 
+// src/acp-leader/acp-leader-skills.ts
+import { parseRequiredSkillsMarker } from "@wrongstack/core/skills";
+var MARKERS = /<!--\s*wrongstack:required-skills\s+[\s\S]*?-->/g;
+function externalSkillLoader(offered, prefix) {
+  return offered?.includes("skill") ? `${prefix}skill` : void 0;
+}
+function externalSkillDirective(text, loader) {
+  const skills = parseRequiredSkillsMarker(text);
+  if (!skills) return text;
+  const list = skills.join(", ");
+  const line = loader ? `[WrongStack] This task's playbook skills: ${list}. They are WrongStack skills: load each with the \`${loader}\` tool, following nextOffset to the last page, before changing code. Where the text below names the \`skill\` tool or a $name, it means that tool and these skills.` : `[WrongStack] This task's playbook skills: ${list}. This route offers no WrongStack skill tool: load them with your own skill tool if you have them, otherwise follow the protocol below without them.`;
+  let first = true;
+  return text.replace(MARKERS, () => {
+    if (!first) return "";
+    first = false;
+    return line;
+  });
+}
+
 // src/acp-leader/acp-leader-stream.ts
 import { ProviderError } from "@wrongstack/core/types";
-import { toErrorMessage as toErrorMessage2 } from "@wrongstack/core/utils";
+import { toErrorMessage as toErrorMessage3 } from "@wrongstack/core/utils";
 var StreamQueue = class {
   items = [];
   wake;
@@ -711,10 +773,7 @@ function clip(text, max) {
   if (last >= 55296 && last <= 56319) end -= 1;
   return `${text.slice(0, end)}\u2026`;
 }
-function cardOutput(call) {
-  const raw = call.rawOutput;
-  const text = call.output ?? (raw ? typeof raw.output === "string" ? raw.output : JSON.stringify(raw) : void 0);
-  if (text === void 0) return void 0;
+function cardOutputForText(text) {
   const output = clip(text, OUTPUT_PREVIEW_CHARS);
   return {
     output,
@@ -723,6 +782,12 @@ function cardOutput(call) {
     outputBytes: Buffer.byteLength(text)
   };
 }
+function cardOutput(call) {
+  const raw = call.rawOutput;
+  const text = call.output ?? (raw ? typeof raw.output === "string" ? raw.output : JSON.stringify(raw) : void 0);
+  if (text === void 0) return void 0;
+  return cardOutputForText(text);
+}
 var ToolCardRelay = class {
   constructor(events, meta) {
     this.events = events;
@@ -744,7 +809,7 @@ var ToolCardRelay = class {
         name,
         id,
         input: call.rawInput,
-        provider: "acp",
+        provider: this.meta.provider ?? "acp",
         model: this.meta.model
       });
     }
@@ -855,7 +920,7 @@ function agentTurnError(err, agentId, classify) {
     };
   }
   const kind = err?.kind;
-  const message = `${agentId}: ${toErrorMessage2(err)}`;
+  const message = `${agentId}: ${toErrorMessage3(err)}`;
   if (kind === "stalled") {
     return {
       error: new ProviderError(message, 408, false, "acp", { kind: "timeout", cause: err }),
@@ -910,8 +975,11 @@ function parseSideModel(ref) {
   if (provider === ACP_LEADER_PROVIDER_ID) return void 0;
   return { provider, model: ref.slice(slash + 1) };
 }
+function explicitLeaderSideModel(config) {
+  return parseSideModel(config.acp?.leader?.sideModel);
+}
 function leaderSideModel(config) {
-  return parseSideModel(config.acp?.leader?.sideModel) ?? parseSideModel(config.fallbackBridge) ?? parseSideModel(config.fallbackModels?.[0]);
+  return explicitLeaderSideModel(config) ?? parseSideModel(config.fallbackBridge) ?? parseSideModel(config.fallbackModels?.[0]);
 }
 function isLeaderTurn(req) {
   const { sessionId, threadId } = req.cache ?? {};
@@ -1029,7 +1097,10 @@ var AcpLeaderProvider = class {
   }
   /** The turn's prompt; an agent joining a conversation under way gets the turns before it. */
   promptText(leader, req) {
-    const latest = latestUserText(req.messages);
+    const latest = externalSkillDirective(
+      latestUserText(req.messages),
+      externalSkillLoader(leader.fleet?.tools, `mcp__${FLEET_SERVER_NAME}__`)
+    );
     const earlier = leader.joined ? void 0 : earlierConversation(req.messages);
     leader.joined = true;
     const prompt = earlier ? `${earlier}
@@ -1105,8 +1176,20 @@ ${withNotes}` : withNotes;
     this.acp ??= await import("@wrongstack/acp");
     return this.acp;
   }
+  dropFleetGrants(sessionId) {
+    for (const grantKey of this.fleetGrants.keys()) {
+      try {
+        const parsed = JSON.parse(grantKey);
+        if (Array.isArray(parsed) && parsed[0] === sessionId) {
+          this.fleetGrants.delete(grantKey);
+        }
+      } catch {
+      }
+    }
+  }
   drop(key, leader) {
     this.sessions.delete(key);
+    this.dropFleetGrants(key);
     void leader.session.close().catch(() => {
     });
     void leader.fleet?.close().catch(() => {
@@ -1176,7 +1259,8 @@ ${withNotes}` : withNotes;
       toolUseId,
       suggestedPattern,
       signal: request.signal,
-      permission: host.permission(sessionId)
+      permission: host.permission(sessionId),
+      context: host.context(sessionId)
     });
   }
   async startSession(key, agentId) {
@@ -1280,6 +1364,7 @@ ${fleetNote(fleet.tools)}` : "")
   async closeAll() {
     const all = [...this.sessions.values()];
     this.sessions.clear();
+    this.fleetGrants.clear();
     await Promise.all(
       all.map(
         (p) => p.then((leader) => {
@@ -1302,6 +1387,24 @@ function createAcpLeaderProviderFactory(opts) {
   };
 }
 
+// src/fleet/wrongforge-runtime.ts
+var WRONGFORGE_REASONING = {
+  default: "adaptive",
+  disableSupported: true,
+  effortSupported: true,
+  effortLevels: ["none", "minimal", "low", "medium", "high", "xhigh", "max"],
+  preserveThinking: "unsupported"
+};
+function wrongForgeRuntime(reasoning, cache, info) {
+  const effort = reasoning?.effort;
+  return {
+    ...reasoning?.enabled === false || effort === "none" ? { effort: "off" } : effort ? {
+      effort: effort === "minimal" ? "low" : (effort === "xhigh" || effort === "max") && !info?.effortLevels?.includes(effort) ? "high" : effort
+    } : {},
+    ...cache?.ttl ? { cache: cache.ttl } : {}
+  };
+}
+
 // src/wiring/provider.ts
 import { ProviderAuthRegistry, ProviderRegistry } from "@wrongstack/core/registry";
 import { ConfigError } from "@wrongstack/core/types";
@@ -1317,6 +1420,577 @@ import {
   withCatalogCapabilities
 } from "@wrongstack/providers";
 import { registerBuiltinProviderAuthStrategies } from "@wrongstack/providers/oauth";
+
+// src/wrongforge-leader/wrongforge-leader-provider.ts
+import { consumeBtwNotes as consumeBtwNotes3 } from "@wrongstack/core/agent";
+import { ProviderError as ProviderError3 } from "@wrongstack/core/types";
+import { toErrorMessage as toErrorMessage5 } from "@wrongstack/core/utils";
+
+// src/wrongforge-leader/wrongforge-leader-gateway.ts
+import { randomBytes as randomBytes2 } from "node:crypto";
+import http from "node:http";
+import {
+  compactToolDefinitionForWire,
+  subjectForToolInput as subjectForToolInput2,
+  toErrorMessage as toErrorMessage4
+} from "@wrongstack/core/utils";
+import { timingSafeTokenEqual } from "@wrongstack/primitives";
+var NOT_OFFERED = /* @__PURE__ */ new Set([
+  "read",
+  "glob",
+  "grep",
+  "fetch",
+  "read_url_content",
+  "tree",
+  "clarify",
+  "tool_use",
+  "tool_script",
+  "tool_search"
+]);
+var MAX_BODY = 4 * 1024 * 1024;
+async function askUser(host, sessionId, tool, input) {
+  const suggestedPattern = subjectForToolInput2(tool.name, input, tool.subjectKey, tool.subjectFields) ?? tool.name;
+  const toolUseId = `wrongforge-${randomBytes2(6).toString("hex")}`;
+  if (host.confirmAwaiter) {
+    const answer = await host.confirmAwaiter(tool, input, toolUseId, suggestedPattern);
+    return answer !== "no" && answer !== "deny";
+  }
+  if (!host.confirmThroughEvents) return false;
+  return confirmThroughEvents({
+    events: host.events,
+    sessionId,
+    tool,
+    input,
+    toolUseId,
+    suggestedPattern,
+    signal: new AbortController().signal,
+    permission: host.permission(sessionId),
+    context: host.context(sessionId)
+  });
+}
+async function startLeaderGateway(host, sessionId) {
+  const tools = (host.listTools?.() ?? []).filter((t) => !NOT_OFFERED.has(t.name));
+  if (tools.length === 0) return void 0;
+  const byName = new Map(tools.map((t) => [t.name, t]));
+  const wireTools = tools.map(
+    (t) => compactToolDefinitionForWire({
+      name: t.name,
+      description: t.description,
+      inputSchema: t.inputSchema ?? { type: "object" }
+    })
+  );
+  const token = randomBytes2(24).toString("hex");
+  const expected = `Bearer ${token}`;
+  const authorized = (req) => timingSafeTokenEqual(req.headers.authorization, expected);
+  const send = (res, status, body) => {
+    const text = JSON.stringify(body);
+    res.writeHead(status, {
+      "content-type": "application/json; charset=utf-8",
+      "content-length": Buffer.byteLength(text)
+    });
+    res.end(text);
+  };
+  const server = http.createServer((req, res) => {
+    if (!authorized(req)) return send(res, 401, { ok: false, error: "unauthorized" });
+    const url = new URL(req.url ?? "/", "http://localhost");
+    if (req.method === "GET" && url.pathname === "/v1/tools") {
+      return send(res, 200, {
+        tools: wireTools.map(({ name: name2, description, inputSchema }) => ({
+          name: name2,
+          description,
+          input_schema: inputSchema
+        }))
+      });
+    }
+    const m = /^\/v1\/tools\/([^/]+)\/call$/.exec(url.pathname);
+    if (req.method !== "POST" || !m) return send(res, 404, { ok: false, error: "not_found" });
+    const name = decodeURIComponent(m[1] ?? "");
+    const tool = byName.get(name);
+    if (!tool) {
+      return send(res, 404, { ok: false, tool: name, error: "not_offered" });
+    }
+    const chunks = [];
+    let size = 0;
+    req.on("data", (c) => {
+      size += c.length;
+      if (size > MAX_BODY) req.destroy();
+      else chunks.push(c);
+    });
+    req.on("end", () => {
+      let input = {};
+      try {
+        const body = JSON.parse(Buffer.concat(chunks).toString("utf8") || "{}");
+        if (body.input && typeof body.input === "object" && !Array.isArray(body.input)) {
+          input = body.input;
+        }
+      } catch {
+        return send(res, 400, { ok: false, tool: name, error: "invalid_json" });
+      }
+      host.runTool(name, input, {
+        sessionId,
+        approve: (t, i) => askUser(host, sessionId, t, i),
+        // The provider draws no card for a `wstack_*` call (its events are
+        // marked external), so the session's card is settled here.
+        announce: true
+      }).then(
+        (r) => send(res, 200, { ok: !r.isError, tool: name, content: r.content }),
+        (err) => send(res, 200, {
+          ok: false,
+          tool: name,
+          error: "tool_failed",
+          message: toErrorMessage4(err)
+        })
+      );
+    });
+  });
+  await new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(0, "127.0.0.1", () => {
+      server.removeListener("error", reject);
+      resolve();
+    });
+  });
+  server.unref();
+  const port = server.address().port;
+  return {
+    spec: {
+      url: `http://127.0.0.1:${port}`,
+      token,
+      list_path: "/v1/tools",
+      call_path: "/v1/tools/{name}/call",
+      name_prefix: "wstack_"
+    },
+    tools: [...byName.keys()],
+    close: () => new Promise((resolve) => server.close(() => resolve()))
+  };
+}
+
+// src/wrongforge-leader/wrongforge-leader-provider.ts
+var WRONGFORGE_LEADER_PROVIDER_ID = WRONGFORGE_AGENT_ID;
+var LEADER_MAX_STEPS = 150;
+var LEADER_TURN_TIMEOUT_MS = 2 * 60 * 6e4;
+var CAPABILITIES2 = {
+  tools: true,
+  parallelTools: false,
+  vision: false,
+  streaming: true,
+  promptCache: true,
+  systemPrompt: true,
+  jsonMode: false,
+  reasoning: true,
+  // Learned from WrongForge's first task result (its model's window).
+  maxContext: 0,
+  maxOutput: 32e3,
+  cacheControl: "native",
+  topK: false,
+  frequencyPenalty: false,
+  presencePenalty: false,
+  seed: false,
+  structuredOutput: false,
+  logprobs: false,
+  audio: false,
+  multipleCompletions: false,
+  // WrongForge keeps the conversation (its session) and compacts it itself.
+  keepsOwnContext: true
+};
+function leaderAppend(routed, tools) {
+  const has = (n) => tools.includes(n);
+  return [
+    "In this task you LEAD a WrongStack session: a human user talks to you through",
+    "WrongStack, and your reply goes to them, not to an orchestrator. Answer them directly,",
+    "ask when something is truly ambiguous, and end a turn when the work or the answer is done.",
+    "The worker-only rules of the WrongStack guide (no human watching, reply = report to a",
+    "leader) do not apply to you; the rest (stay in the workdir, no git history rewrites, no",
+    "commit or push unless asked) does.",
+    ...routed ? [
+      "Your own write/edit/shell tools are off: change files with WrongStack's `wstack_edit` /",
+      "`wstack_write` / `wstack_patch` and run commands with `wstack_bash` (or `wstack_test`,",
+      "`wstack_lint`, `wstack_typecheck`). They run in the user's session, under their rules."
+    ] : [],
+    ...has("delegate") ? [
+      "`wstack_delegate` hands work to WrongStack workers (scope and outOfScope required); the",
+      "result arrives later as a [DELEGATION RESULT] message, so end your turn or keep working."
+    ] : [],
+    ...has("remember") || has("memory_search") ? ["`wstack_memory_search` / `wstack_remember` are the project memory: check it, add to it."] : []
+  ].join(" ");
+}
+function flatten(req) {
+  const text = (m) => typeof m.content === "string" ? m.content : m.content.map((b) => "text" in b && typeof b.text === "string" ? b.text : "").filter(Boolean).join("\n");
+  const system = (req.system ?? []).map((b) => b.text).join("\n\n");
+  const turns = req.messages.map((m) => `[${m.role}]
+${text(m)}`).join("\n\n");
+  return [
+    system ? `<instructions>
+${system}
+</instructions>` : "",
+    turns,
+    "Reply to the last message, following the instructions above. Use no tools."
+  ].filter(Boolean).join("\n\n");
+}
+function providerError(err, id) {
+  if (err instanceof ProviderError3) return err;
+  const make = (message, status, retryable, kind) => new ProviderError3(`WrongForge: ${message}`, status, retryable, id, { kind });
+  if (err instanceof WfAborted) return make("the turn was cancelled", 499, false, "unknown");
+  if (err instanceof WfHttpError) {
+    if (err.status === 401 || err.status === 403 || err.code === "not_signed_in")
+      return make(err.message, 401, false, "auth");
+    if (err.status === 0) return make(err.message, 0, true, "network");
+    if (err.status >= 500) return make(err.message, err.status, true, "server");
+    return make(`${err.code}: ${err.message}`, err.status, false, "invalid_request");
+  }
+  return make(toErrorMessage5(err), 0, false, "unknown");
+}
+function taskError(record, id) {
+  const make = (message, status, retryable, kind) => new ProviderError3(`WrongForge: ${message}`, status, retryable, id, { kind });
+  switch (record.status) {
+    case "completed":
+      return void 0;
+    case "cancelled":
+      return make(
+        `the turn was cancelled${record.cancel_reason ? ` (${record.cancel_reason})` : ""}`,
+        499,
+        false,
+        "unknown"
+      );
+    case "timed_out":
+      return make("the turn hit its timeout", 408, false, "timeout");
+    default: {
+      const code = record.error?.code ?? "internal_error";
+      const message = `${code}: ${record.error?.message ?? "no detail"}`;
+      if (code === "context_overflow") return make(message, 413, false, "context_overflow");
+      if (/rate.?limit|429/i.test(message)) return make(message, 429, true, "rate_limit");
+      if (/quota|usage limit|extra usage/i.test(message))
+        return make(message, 402, false, "quota_exhausted");
+      return make(message, 500, code === "server_restarted", "server");
+    }
+  }
+}
+var WrongForgeLeaderProvider = class {
+  constructor(opts) {
+    this.opts = opts;
+    this.id = opts.id ?? WRONGFORGE_LEADER_PROVIDER_ID;
+    trackAcpLeader(this);
+  }
+  opts;
+  id;
+  capabilities = { ...CAPABILITIES2 };
+  sessions = /* @__PURE__ */ new Map();
+  sideProviders = /* @__PURE__ */ new Map();
+  config() {
+    return acpLeaderHost()?.getConfig() ?? this.opts.bootConfig;
+  }
+  client() {
+    const ep = resolveWrongForgeEndpoint();
+    if (!ep) {
+      throw new ProviderError3(
+        "WrongForge: no API key found. Start it once with `npm run serve` (it saves ~/.wrongforge/api-key) or set WRONGFORGE_API_KEY.",
+        401,
+        false,
+        this.id,
+        { kind: "auth" }
+      );
+    }
+    void reportWrongForgeQuota({
+      endpoint: ep,
+      providerId: this.id,
+      fetchImpl: this.opts.fetchImpl
+    });
+    return wrongForgeCall(ep, this.opts.fetchImpl);
+  }
+  async info(call, signal) {
+    try {
+      const info = parseWrongForgeInfo(await call("GET", "/v1/info", void 0, signal));
+      writeWrongForgeInfoCache(info);
+      return info;
+    } catch {
+      return void 0;
+    }
+  }
+  model(requested, info) {
+    const choice = chooseModel(requested, void 0, info);
+    if (choice.error) {
+      throw new ProviderError3(choice.error, 400, false, this.id, { kind: "invalid_request" });
+    }
+    return choice.id;
+  }
+  /**
+   * A side model for a turn WrongForge does not lead. `explicitOnly` (a side
+   * request through `complete()`) takes only the model the user named in
+   * `acp.leader.sideModel`: WrongForge answers those itself (`oneShot`), and
+   * handing them to `fallbackModels[0]` let that model take over the session.
+   * A worker's turn may still fall back to the fallback chain, since `oneShot`
+   * would leave it without tools.
+   */
+  sideProvider(explicitOnly = false) {
+    const config = this.config();
+    const ref = explicitOnly ? explicitLeaderSideModel(config) : leaderSideModel(config);
+    if (!ref || ref.provider === this.id) return void 0;
+    let provider = this.sideProviders.get(ref.provider);
+    if (!provider) {
+      provider = this.opts.buildProvider(ref.provider, config);
+      if (provider) this.sideProviders.set(ref.provider, provider);
+    }
+    return provider ? { provider, model: ref.model } : void 0;
+  }
+  async complete(req, opts) {
+    const side = this.sideProvider(true);
+    if (side) return side.provider.complete({ ...req, model: side.model }, opts);
+    return this.oneShot(req, opts.signal);
+  }
+  /** WrongForge as a plain model: one step, no tools, its own throwaway session. */
+  async oneShot(req, signal) {
+    const call = this.client();
+    try {
+      const info = await this.info(call, signal);
+      const model = this.model(req.model, info);
+      const host = acpLeaderHost();
+      const { task } = await call(
+        "POST",
+        "/v1/tasks",
+        {
+          prompt: flatten(req),
+          workdir: host?.projectRoot ?? process.cwd(),
+          ...model ? { model } : {},
+          max_steps: 1,
+          builtin_tools: [],
+          ...wrongForgeRuntime(req.reasoning, req.cache, info),
+          wait: true,
+          cancel_on_disconnect: true
+        },
+        signal
+      );
+      const failure = taskError(task, this.id);
+      if (failure) throw failure;
+      const usage = wfTokens(task.result?.usage);
+      return {
+        model: model ?? req.model,
+        content: [{ type: "text", text: task.result?.text ?? "" }],
+        stopReason: "end_turn",
+        usage
+      };
+    } catch (err) {
+      throw providerError(err, this.id);
+    } finally {
+      void reportWrongForgeQuota({ providerId: this.id, fetchImpl: this.opts.fetchImpl });
+    }
+  }
+  async *stream(req, opts) {
+    if (!isLeaderTurn(req)) {
+      const side = this.sideProvider();
+      if (side) {
+        yield* side.provider.stream({ ...req, model: side.model }, opts);
+        return;
+      }
+      const res = await this.complete(req, opts);
+      yield { type: "message_start", model: res.model };
+      const text = res.content.map((b) => "text" in b ? b.text : "").join("");
+      if (text) {
+        yield { type: "content_block_start", kind: "text" };
+        yield { type: "text_delta", text };
+        yield { type: "content_block_stop", index: 0 };
+      }
+      yield { type: "message_stop", stopReason: "end_turn", usage: res.usage };
+      return;
+    }
+    const call = this.client();
+    const host = acpLeaderHost();
+    const key = req.cache?.sessionId ?? "default";
+    const leader = this.sessionFor(key);
+    let info;
+    let model;
+    let gateway;
+    let joinedBefore;
+    try {
+      info = await this.info(call, opts.signal);
+      model = this.model(req.model, info);
+      if (host && !leader.gateway) {
+        leader.gateway = startLeaderGateway(host, key).catch(() => {
+          leader.gateway = void 0;
+          return void 0;
+        });
+      }
+      gateway = await leader.gateway;
+      if (!gateway) {
+        leader.gateway = void 0;
+      }
+      joinedBefore = leader.joined ?? await this.wfSessionExists(call, leader, opts.signal);
+    } catch (err) {
+      throw providerError(err, this.id);
+    }
+    const routed = gateway !== void 0 && (info?.features.includes("builtin_tools") ?? false);
+    const queue = new StreamQueue();
+    const blocks = new TextBlocks(queue);
+    const cards = new ToolCardRelay(host?.events, {
+      sessionId: req.cache?.sessionId,
+      model: model ?? req.model,
+      provider: this.id
+    });
+    yield { type: "message_start", model: model ?? req.model };
+    let taskId;
+    const onAbort = () => {
+      if (taskId) cancelTask(call, taskId, "interrupted in WrongStack");
+    };
+    opts.signal.addEventListener("abort", onAbort, { once: true });
+    const run = (async () => {
+      const { task } = await call(
+        "POST",
+        "/v1/tasks",
+        {
+          prompt: this.promptText(req, joinedBefore, gateway),
+          session_id: leader.wfSessionId,
+          workdir: host?.projectRoot ?? process.cwd(),
+          ...model ? { model } : {},
+          max_steps: LEADER_MAX_STEPS,
+          timeout_ms: LEADER_TURN_TIMEOUT_MS,
+          ...wrongForgeRuntime(req.reasoning, req.cache, info),
+          system_append: leaderAppend(routed, gateway?.tools ?? []),
+          context: { wrongstack: { sessionId: key, role: "leader" } },
+          ...gateway ? { gateway: { ...gateway.spec, optional: !routed } } : {},
+          ...routed ? { builtin_tools: WRONGFORGE_READ_SIDE_TOOLS } : {}
+        },
+        opts.signal
+      );
+      taskId = task.id;
+      leader.joined = true;
+      if (opts.signal.aborted) {
+        cancelTask(call, taskId, "interrupted in WrongStack");
+        throw new WfAborted();
+      }
+      for await (const ev of followTask(call, task.id, opts.signal)) {
+        if (ev.type === "task.heartbeat" || ev.type === "step.finished") {
+          void reportWrongForgeQuota({ providerId: this.id, fetchImpl: this.opts.fetchImpl });
+        }
+        const external = ev.data["external"] === true;
+        for (const p of toProgress(ev)) {
+          if (p.type === "message") blocks.text(p.text);
+          else if (p.type === "tool_call") {
+            blocks.close();
+            if (!external) cards.update(p.toolCall);
+          } else if (p.type === "tool_call_update" && !external) cards.update(p.toolCall);
+        }
+        if (ev.type === "step.finished" && typeof ev.data["context_tokens"] === "number") {
+          this.observeContext(leader, req.cache?.sessionId, {
+            used: ev.data["context_tokens"],
+            size: this.capabilities.maxContext
+          });
+        }
+      }
+      const done = await terminalTaskRecord(call, task.id, opts.signal);
+      blocks.close();
+      const failure = taskError(done, this.id);
+      if (failure) throw failure;
+      const window = done.result?.context_window ?? 0;
+      if (window > 0) this.capabilities.maxContext = window;
+      if (typeof done.result?.context_tokens === "number") {
+        this.observeContext(leader, req.cache?.sessionId, {
+          used: done.result.context_tokens,
+          size: window
+        });
+      }
+      queue.push({
+        type: "message_stop",
+        stopReason: done.result?.finish_reason === "length" ? "max_tokens" : "end_turn",
+        usage: wfTokens(done.result?.usage),
+        ...leader.context ? { agentContext: leader.context } : {}
+      });
+      queue.end();
+    })().catch((err) => {
+      blocks.close();
+      queue.fail(providerError(err, this.id));
+    });
+    try {
+      yield* queue.drain();
+    } finally {
+      opts.signal.removeEventListener("abort", onAbort);
+      await run;
+      void reportWrongForgeQuota({ providerId: this.id, fetchImpl: this.opts.fetchImpl });
+    }
+  }
+  /** The turn's prompt; WrongForge joining a conversation under way gets the turns before it. */
+  promptText(req, joined, gateway) {
+    const latest = externalSkillDirective(
+      latestUserText(req.messages),
+      gateway ? externalSkillLoader(gateway.tools, gateway.spec.name_prefix ?? "") : void 0
+    );
+    const earlier = joined ? void 0 : earlierConversation(req.messages);
+    const prompt = earlier ? `${earlier}
+
+${latest}` : latest;
+    const context = acpLeaderHost()?.context(req.cache?.sessionId);
+    const notes = context?.meta ? consumeBtwNotes3(context) : [];
+    return notes.length > 0 ? `${prompt}
+
+${acpBtwBlock(notes)}` : prompt;
+  }
+  async wfSessionExists(call, leader, signal) {
+    try {
+      await call(
+        "GET",
+        `/v1/sessions/${encodeURIComponent(leader.wfSessionId)}`,
+        void 0,
+        signal
+      );
+      return true;
+    } catch (err) {
+      if (err instanceof WfHttpError && err.status === 404) return false;
+      throw err;
+    }
+  }
+  sessionFor(key) {
+    let leader = this.sessions.get(key);
+    if (!leader) {
+      leader = { wfSessionId: `wsl-${safeWfId(key)}` };
+      this.sessions.set(key, leader);
+    }
+    return leader;
+  }
+  observeContext(leader, sessionId, reading) {
+    leader.context = { used: reading.used, size: reading.size || this.capabilities.maxContext };
+    publishLeaderContext(
+      acpLeaderHost()?.events,
+      sessionId,
+      leader.context,
+      this.capabilities.maxContext
+    );
+  }
+  /** `/compact` on this route: WrongForge compacts its own session. */
+  async compactOwnContext(opts) {
+    const leader = this.sessions.get(opts.sessionId);
+    if (!leader) return void 0;
+    const call = this.client();
+    try {
+      await call(
+        "POST",
+        `/v1/sessions/${encodeURIComponent(leader.wfSessionId)}/compact`,
+        {},
+        opts.signal
+      );
+    } catch (err) {
+      throw providerError(err, this.id);
+    }
+    leader.context = void 0;
+    return void 0;
+  }
+  /** Close every session gateway (process shutdown). */
+  async closeAll() {
+    const all = [...this.sessions.values()];
+    this.sessions.clear();
+    await Promise.all(all.map((s) => s.gateway?.then((g) => g?.close()).catch(() => void 0)));
+  }
+};
+function createWrongForgeLeaderProviderFactory(opts) {
+  return {
+    type: WRONGFORGE_LEADER_PROVIDER_ID,
+    // Routing metadata only: the provider does no wire conversion.
+    family: "openai-compatible",
+    create: (cfg) => new WrongForgeLeaderProvider({
+      ...opts,
+      id: cfg.type || WRONGFORGE_LEADER_PROVIDER_ID
+    })
+  };
+}
+
+// src/wiring/provider.ts
 async function setupProvider(params) {
   const { config, modelsRegistry, logger } = params;
   const providerAuthRegistry = new ProviderAuthRegistry();
@@ -1333,7 +2007,16 @@ async function setupProvider(params) {
   }
   const savedProviderCfg = config.providers?.[config.provider];
   const acpLeader = config.provider === ACP_LEADER_PROVIDER_ID;
-  let resolvedProvider = acpLeader ? {
+  const wrongForgeLeader = config.provider === WRONGFORGE_LEADER_PROVIDER_ID;
+  let resolvedProvider = wrongForgeLeader ? {
+    id: WRONGFORGE_LEADER_PROVIDER_ID,
+    name: "WrongForge",
+    family: "openai-compatible",
+    apiBase: void 0,
+    envVars: [],
+    models: [{ id: config.model, name: config.model }],
+    npm: void 0
+  } : acpLeader ? {
     id: ACP_LEADER_PROVIDER_ID,
     name: "ACP agent",
     family: "openai-compatible",
@@ -1393,6 +2076,12 @@ async function setupProvider(params) {
       buildProvider: (providerId, live) => buildProviderForId({ config: live, providerRegistry, logger }, providerId)
     })
   );
+  providerRegistry.register(
+    createWrongForgeLeaderProviderFactory({
+      bootConfig: config,
+      buildProvider: (providerId, live) => buildProviderForId({ config: live, providerRegistry, logger }, providerId)
+    })
+  );
   if (config.features.modelsRegistry) {
     try {
       const factories = await buildProviderFactoriesFromRegistry({
@@ -1433,7 +2122,7 @@ Try \`wstack models refresh\` once you have network access.`,
       cause: err
     });
   }
-  if (config.features.modelsRegistry && !acpLeader) {
+  if (config.features.modelsRegistry && !acpLeader && !wrongForgeLeader) {
     provider = await withCatalogCapabilities(
       modelsRegistry,
       config.provider,
@@ -1452,7 +2141,10 @@ export {
   wrongstackAcpPermissionPolicy,
   recordAcpRateLimit,
   startAcpTurnReminders,
+  cardOutputForText,
+  WRONGFORGE_REASONING,
+  wrongForgeRuntime,
   setupProvider,
   createGracefulShutdown
 };
-//# sourceMappingURL=chunk-COGI7EQU.js.map
+//# sourceMappingURL=chunk-EAATL6FL.js.map