@wrongstack/cli 1.1.4 → 1.1.6

package/dist/{chunk-ZF4HRR5F.js → chunk-P7MEEUGT.js}

@@ -704,6 +704,254 @@ var deepHelpTable = {
   }
 };
 
+// src/subcommands/handlers/per-subcommand-help-operations.ts
+var OPERATIONS_HELP_ENTRIES = {
+  // -- Lifecycle ---------------------------------------------------------
+  update: {
+    name: "update",
+    title: "wstack update \u2014 self-update the CLI",
+    description: "Check the latest npm version and update the globally-installed `wrongstack` package. Use `--check-only` to just print the current/latest without installing. Pass `--pm <manager>` (or its shorthand `--npm`, `--pnpm`, `--yarn`, `--bun`) to force a specific package manager; pass `--allow-scripts` (alias `--lifecycle-scripts`) to opt into package lifecycle scripts during the update (off by default). The update is global; run from any project root.",
+    usage: "wstack update [--check-only] [--pm <manager>] [--allow-scripts (alias: --lifecycle-scripts)]",
+    seeAlso: "wstack version (read-only version info)"
+  },
+  remote: {
+    name: "remote",
+    title: "wstack remote \u2014 run WrongStack on another machine over SSH",
+    description: "Runs WrongStack on the remote machine, in the given project directory, and opens its WebUI here through an SSH tunnel; the agent, its tools and its daemons run remotely. The system ssh is used, so ~/.ssh/config, your agent and known_hosts apply. The matching build is uploaded once per version to ~/.wrongstack/remote and checked by SHA-256. A dropped connection is reopened; the remote host keeps running meanwhile. Nothing from your local configuration is copied: set up a provider in the remote WebUI the first time.",
+    usage: "wstack remote <user@host:/path | ssh://user@host:port/path> [--port <n>] [--open] [--keep] [--ssh-config <file>] [--remote-binary <file>]",
+    seeAlso: "wstack --remote <target> (same command)"
+  },
+  // -- ACP (Agent Client Protocol) --------------------------------------
+  acp: {
+    name: "acp",
+    title: "wstack acp \u2014 Agent Client Protocol (ACP) integration",
+    description: "Run WrongStack as an ACP server (stdio) for editor clients (Zed, JetBrains, VS Code ACP), or orchestrate external ACP agents through spawn, probe, bench, and parallel fan-out.",
+    usage: "wstack acp [server|list|sync|spawn|parallel|probe|bench] [...]",
+    subcommands: [
+      { name: "server / serve", description: "Start WrongStack as an ACP stdio server (default)." },
+      { name: "list", description: "List available ACP agents from the cache." },
+      { name: "sync", description: "Sync the official ACP agent registry into local cache." },
+      { name: "spawn <id> <task>", description: "Spawn an ACP agent and wait for results." },
+      {
+        name: "parallel <csv> <task>",
+        description: "Fan a task out to multiple ACP agents in parallel."
+      },
+      { name: "probe [csv]", description: "Handshake-test installed ACP agents." },
+      { name: "bench [csv] [--fs]", description: "End-to-end benchmark and grade ACP agents." }
+    ],
+    seeAlso: "wstack mcp serve (the MCP equivalent; pick the protocol your client speaks)"
+  },
+  // -- Model diagnostics (read-only) -----------------------------------
+  modeldiag: {
+    name: "modeldiag",
+    title: "wstack modeldiag \u2014 model benchmarks + heuristic diagnostics",
+    description: "Read-only diagnostics for the configured model: key check, capability scan (vision / tools / context window), heuristic strengths/weaknesses (bestFor / avoidFor), sequential live provider/model smoke tests, and real benchmarks against a small prompt suite. Smoke tests use tiny prompts and never print credentials.",
+    usage: "wstack modeldiag [preflight|test|eval] [...]",
+    subcommands: [
+      {
+        name: "preflight [provider-profile]",
+        description: "Check native cloud provider setup without model requests or exposing credential values."
+      },
+      {
+        name: "<no subcommand>",
+        description: "Print configured model capabilities, context limits, and recommendations."
+      },
+      {
+        name: "test [--plan|--all-models|--json]",
+        description: "Run live sequential smoke tests across configured models."
+      },
+      {
+        name: "eval [--providers <csv>]",
+        description: "Run model competency matrix evaluation across tasks."
+      }
+    ],
+    seeAlso: "wstack modeldiag test --plan; wstack modeldiag test; wstack modeldiag test --all-models"
+  },
+  // -- Bench (developer / CI only) -------------------------------------
+  bench: {
+    name: "bench",
+    title: "wstack bench \u2014 run model-independent agentic benchmarks",
+    description: "Run WrongStack against the bundled smoke suite, a local manifest, Aider polyglot, or SWE-bench Verified with deterministic graders. Default `bench run` is the bundled core edit-eval; pass --cell provider/model (or a saved model).",
+    usage: "wstack bench [run|compare|report|list|mine|review|route|experiment] [...]",
+    subcommands: [
+      { name: "run", description: "Run a suite. Default: bundled smoke + --cell or saved model." },
+      {
+        name: "compare <a> <b>",
+        description: "Diff two finished run directories (fingerprint-aware)."
+      },
+      { name: "report <dir>", description: "Render the Markdown report for a prior run." },
+      {
+        name: "review --transcript <file>",
+        description: "Read-only transcript behavior/compaction evidence; optional --policy."
+      },
+      {
+        name: "route <dir> --policy <file>",
+        description: "Shadow routing recommendations from graded model-matrix evidence."
+      },
+      {
+        name: "experiment <a> <b> --dimension compaction|behavior",
+        description: "Compare paired task/model/attempt runs with explicit experiment provenance."
+      },
+      { name: "list", description: "List available suites and the model configs in the catalog." }
+    ],
+    seeAlso: "wstack modeldiag (read-only diagnostics; bench actually runs the model)"
+  },
+  // -- Quick launch ------------------------------------------------------
+  quick: {
+    name: "quick",
+    title: "wstack quick \u2014 launch the TUI with sensible defaults",
+    description: "Accept every default, list installed plugins, and open the TUI with the agents-monitor panel pre-shown. Equivalent to `wstack --tui --quick`; the dedicated subcommand is for discoverability and tab-completion. The actual TUI launch is intercepted in `boot()` before this handler runs.",
+    usage: "wstack quick",
+    seeAlso: "wstack --tui (the underlying flag; quick is just a shortcut)"
+  },
+  // -- Aliases and meta commands ───────────────────────────────────────
+  plugins: {
+    name: "plugins",
+    title: "wstack plugins \u2014 alias for wstack plugin",
+    description: "Alias for `wstack plugin`. See `wstack plugin --help` for the full set of subcommands.",
+    usage: "wstack plugins (alias for wstack plugin)",
+    seeAlso: "wstack plugin (the canonical command)"
+  },
+  help: {
+    name: "help",
+    title: "wstack help \u2014 print top-level help",
+    description: "Print the top-level help text listing every subcommand with a one-line summary. Equivalent to `wstack --help`.",
+    usage: "wstack help",
+    seeAlso: "wstack --help"
+  },
+  // -- HQ (dashboard server) ──────────────────────────────────────────
+  hq: {
+    name: "hq",
+    title: "wstack hq \u2014 serve HQ, manage authentication, or install its system service",
+    description: "Start the HQ server \u2014 a web dashboard for monitoring sessions, fleet status, and agent activity across projects; manage browser/client authentication, or install the persistent Ubuntu systemd service.",
+    usage: "wstack hq [serve] [...] | wstack hq token [create|list|revoke] | wstack hq service [install|status|update|uninstall]",
+    subcommands: [
+      { name: "serve", description: "Start the HQ dashboard server (default)." },
+      {
+        name: "token create [label]",
+        description: "Mint a browser or client authentication token."
+      },
+      { name: "token list", description: "List active HQ authentication tokens." },
+      { name: "token revoke <id>", description: "Revoke an issued HQ authentication token." },
+      {
+        name: "service install",
+        description: "Install an always-on systemd service and guarded automatic updater."
+      },
+      { name: "service status", description: "Inspect the HQ service and update timer." },
+      { name: "service update", description: "Run the guarded update job immediately." },
+      {
+        name: "service uninstall",
+        description: "Remove systemd units while preserving HQ data and secrets."
+      }
+    ],
+    seeAlso: "wstack sessions fleet (CLI equivalent for fleet status)"
+  },
+  // -- Mailbox (external agent bridge) ────────────────────────────────
+  mailbox: {
+    name: "mailbox",
+    title: "wstack mailbox \u2014 serve the external-agent mailbox HTTP bridge",
+    description: "Start the mailbox HTTP bridge that lets external coding agents (Claude Code, Aider, custom scripts) communicate with the shared project mailbox. The server exposes a REST + SSE API for sending, checking, and acknowledging messages. Use `wstack mailbox serve` to start the listener.",
+    usage: "wstack mailbox serve [--port <n>]",
+    subcommands: [{ name: "serve", description: "Start the mailbox HTTP bridge listener." }],
+    seeAlso: "wstack hq (the HQ server includes mailbox routing)"
+  },
+  // -- Permissions ────────────────────────────────────────────────────
+  permissions: {
+    name: "permissions",
+    title: "wstack permissions \u2014 list and explain the permission rules",
+    description: "Side-effect-free views of the permission policy the agent runs under: every rule in the order it is checked, and how one tool call is decided, without prompting, modifying trust files, or mutating state. Inside a session, /permissions also sets allow/deny rules for that session only.",
+    usage: "wstack permissions [rules|explain <tool> [--input '<json>']] [--json]",
+    subcommands: [
+      {
+        name: "rules",
+        description: "List every permission rule, in the order they are checked (first match decides)."
+      },
+      {
+        name: "explain <tool>",
+        description: "Explain how the permission policy decides a tool call, and name the rule."
+      }
+    ],
+    seeAlso: "wstack tools (list available tools)"
+  },
+  // -- Project management ─────────────────────────────────────────────
+  project: {
+    name: "project",
+    title: "wstack project \u2014 manage committed repository identity",
+    description: "Manage the committed repository identity (project.json) used to scope HQ dashboards, Kanban state, and multi-agent coordination. Commit the generated ID file so every clone shares the same project.",
+    usage: "wstack project [id|init|rekey] [--yes]",
+    subcommands: [
+      { name: "id", description: "Show the current project ID and config path (default)." },
+      { name: "init", description: "Initialize a project ID if not already present." },
+      { name: "rekey", description: "Generate a new project ID for a fork (requires --yes)." }
+    ],
+    seeAlso: "wstack projects (list all tracked projects)"
+  },
+  governance: {
+    name: "governance",
+    title: "wstack governance \u2014 inspect deterministic project-daemon health",
+    description: "Read token-free attachment-broker health from the current project daemon. Warnings are advisory: they surface deterministic operator escalation signals without stopping active tasks or model execution.",
+    usage: "wstack governance status [--json]",
+    subcommands: [{ name: "status", description: "Show daemon and attachment-broker health." }],
+    seeAlso: "wstack doctor (broader environment diagnostics)"
+  },
+  "import-claude-code": {
+    name: "import-claude-code",
+    title: "wstack import-claude-code \u2014 bring a Claude Code setup across",
+    description: "Import MCP servers from ~/.claude.json (user + this project) and the repository's .mcp.json into the active profile. Previews by default. Repository servers arrive disabled unless --enable-project-servers. Skills are read in place; hooks, permission rules and CLAUDE.md are reported with next steps, not translated.",
+    usage: "wstack import-claude-code [--apply] [--overwrite] [--enable-project-servers]",
+    subcommands: [
+      { name: "--apply", description: "Write the plan (default: preview only)." },
+      { name: "--overwrite", description: "Replace servers that already exist by name." },
+      {
+        name: "--enable-project-servers",
+        description: "Enable the repository's .mcp.json servers on import."
+      }
+    ],
+    seeAlso: "wstack mcp list; --mcp-config (one-off servers without importing)"
+  },
+  sage: {
+    name: "sage",
+    title: "wstack sage \u2014 this project's SAGE memory in other coding agents",
+    description: "Wire SAGE memory into Claude Code, Codex, Cursor or Antigravity over MCP: writes the MCP server entry plus a skill/rule telling the agent when to recall and how to propose. The server attaches to the SAGE daemon while wstack is open in this project and never starts one. Tools are read-only plus memory_candidates (list/propose); a proposal becomes memory only through WrongStack review. Search is lexical: semantic recall runs inside a WrongStack host.",
+    usage: "wstack sage connect <claude-code|codex|cursor|antigravity|all|print> [--dry-run]",
+    subcommands: [
+      { name: "connect <client|all>", description: "Write the MCP entry and skill for a client." },
+      { name: "connect print", description: "Print JSON/TOML config for any other MCP client." },
+      { name: "disconnect <client|all>", description: "Remove what connect wrote." },
+      { name: "mcp [--origin <name>]", description: "The stdio MCP server clients run." },
+      {
+        name: "sync [--restart-service]",
+        description: "Run project memory sync with HQ; optionally restart this project\u2019s SAGE owner."
+      },
+      { name: "--dry-run", description: "Show the file changes without writing." },
+      { name: "--command <path>", description: "Executable to launch instead of wstack." }
+    ],
+    seeAlso: "wstack mcp serve (all WrongStack tools over MCP)"
+  },
+  // -- Chronicle ──────────────────────────────────────────────────────
+  chronicle: {
+    name: "chronicle",
+    title: "wstack chronicle \u2014 query cross-session provenance ledger",
+    description: "Query the cross-session event ledger, inspect daemon status, compute facet aggregations, view token/cost metrics, or purge old retention entries.",
+    usage: "wstack chronicle [query|status|facet|metrics|prune|compact] [...]",
+    subcommands: [
+      { name: "query [field=value ...]", description: "Query recorded provenance events." },
+      { name: "status", description: "Check the Chronicle daemon and pipeline status." },
+      { name: "facet <field>", description: "Group and count events across a facet." },
+      {
+        name: "metrics [providers|tasks|files|summary]",
+        description: "Query aggregated metrics from metrics.db."
+      },
+      {
+        name: "prune [--days N] [--dry-run]",
+        description: "Purge journal entries older than N days."
+      },
+      { name: "compact", description: "Defragment and compact SQLite ledger." }
+    ],
+    seeAlso: "wstack audit (per-session audit log); wstack usage (cost summary)"
+  }
+};
+
 // src/subcommands/handlers/per-subcommand-help-table.ts
 var helpTable = {
   automation: {
@@ -745,7 +993,7 @@ var helpTable = {
       { name: "restart <id>", description: "Restart a running MCP server." },
       {
         name: "serve",
-        description: "Run the wstack MCP server; --resources/--prompts explicitly expose selected files."
+        description: "Run the wstack MCP server (read-only; --allow <caps> or --yolo widens); --resources/--prompts expose selected files."
       },
       {
         name: "serve <mailbox|kanban|codebase-index|requirement-intake|sage>",
@@ -959,10 +1207,30 @@ var helpTable = {
   },
   tools: {
     name: "tools",
-    title: "wstack tools \u2014 list registered tools",
-    description: "List every tool the agent can invoke, with its owner (built-in / plugin) and permission level. Useful for auditing what a session can do, especially after installing a new plugin.",
-    usage: "wstack tools",
-    seeAlso: "wstack skills (list skills; tools + skills are the two extension surfaces)"
+    title: "wstack tools \u2014 list registered tools, or call one from outside a session",
+    description: "Bare: list every registered tool with owner and permission. list/describe/run/batch: call built-in tools from any script or external agent. Read-only unless --allow <caps> (e.g. fs.write) or --yolo. Exit: 0 ok, 1 failed, 2 bad input, 3 not exposed/denied, 4 needs confirmation.",
+    usage: "wstack tools [list|describe <tool>|run <tool> [--input <json|@file|stdin>] [-- --<field> <value>]|batch|agent-guide] [--json] [--allow <caps>|--yolo]",
+    subcommands: [
+      { name: "list", description: "Tools callable from outside a session, one line each." },
+      { name: "describe <tool>", description: "Description, capabilities and input JSON schema." },
+      {
+        name: "run <tool>",
+        description: "--input <json>|@file.json|bare (stdin); schema fields after --: -- --path a.ts --limit 5."
+      },
+      {
+        name: "batch",
+        description: 'JSONL calls ({"tool","input","id"}) on stdin or --input @f; one result line each.'
+      },
+      {
+        name: "agent-guide",
+        description: "A short Markdown guide for an agent's instruction file (AGENTS.md, CLAUDE.md)."
+      },
+      {
+        name: "serve",
+        description: "REST for an external agent: GET /v1/tools, POST /v1/tools/<name>/call; --port 0, token required."
+      }
+    ],
+    seeAlso: "wstack mcp serve (the same tools over MCP), wstack skills"
   },
   skills: {
     name: "skills",
@@ -977,250 +1245,7 @@ var helpTable = {
     description: "List every project WrongStack has seen (tracked by a hashed root). Each entry shows the project root and the last-seen timestamp. Useful for cleaning up the global projects dir after a workspace migration.",
     usage: "wstack projects"
   },
-  // -- Lifecycle ---------------------------------------------------------
-  update: {
-    name: "update",
-    title: "wstack update \u2014 self-update the CLI",
-    description: "Check the latest npm version and update the globally-installed `wrongstack` package. Use `--check-only` to just print the current/latest without installing. Pass `--pm <manager>` (or its shorthand `--npm`, `--pnpm`, `--yarn`, `--bun`) to force a specific package manager; pass `--allow-scripts` (alias `--lifecycle-scripts`) to opt into package lifecycle scripts during the update (off by default). The update is global; run from any project root.",
-    usage: "wstack update [--check-only] [--pm <manager>] [--allow-scripts (alias: --lifecycle-scripts)]",
-    seeAlso: "wstack version (read-only version info)"
-  },
-  remote: {
-    name: "remote",
-    title: "wstack remote \u2014 run WrongStack on another machine over SSH",
-    description: "Runs WrongStack on the remote machine, in the given project directory, and opens its WebUI here through an SSH tunnel; the agent, its tools and its daemons run remotely. The system ssh is used, so ~/.ssh/config, your agent and known_hosts apply. The matching build is uploaded once per version to ~/.wrongstack/remote and checked by SHA-256. A dropped connection is reopened; the remote host keeps running meanwhile. Nothing from your local configuration is copied: set up a provider in the remote WebUI the first time.",
-    usage: "wstack remote <user@host:/path | ssh://user@host:port/path> [--port <n>] [--open] [--keep] [--ssh-config <file>] [--remote-binary <file>]",
-    seeAlso: "wstack --remote <target> (same command)"
-  },
-  // -- ACP (Agent Client Protocol) --------------------------------------
-  acp: {
-    name: "acp",
-    title: "wstack acp \u2014 Agent Client Protocol (ACP) integration",
-    description: "Run WrongStack as an ACP server (stdio) for editor clients (Zed, JetBrains, VS Code ACP), or orchestrate external ACP agents through spawn, probe, bench, and parallel fan-out.",
-    usage: "wstack acp [server|list|sync|spawn|parallel|probe|bench] [...]",
-    subcommands: [
-      { name: "server / serve", description: "Start WrongStack as an ACP stdio server (default)." },
-      { name: "list", description: "List available ACP agents from the cache." },
-      { name: "sync", description: "Sync the official ACP agent registry into local cache." },
-      { name: "spawn <id> <task>", description: "Spawn an ACP agent and wait for results." },
-      {
-        name: "parallel <csv> <task>",
-        description: "Fan a task out to multiple ACP agents in parallel."
-      },
-      { name: "probe [csv]", description: "Handshake-test installed ACP agents." },
-      { name: "bench [csv] [--fs]", description: "End-to-end benchmark and grade ACP agents." }
-    ],
-    seeAlso: "wstack mcp serve (the MCP equivalent; pick the protocol your client speaks)"
-  },
-  // -- Model diagnostics (read-only) -----------------------------------
-  modeldiag: {
-    name: "modeldiag",
-    title: "wstack modeldiag \u2014 model benchmarks + heuristic diagnostics",
-    description: "Read-only diagnostics for the configured model: key check, capability scan (vision / tools / context window), heuristic strengths/weaknesses (bestFor / avoidFor), sequential live provider/model smoke tests, and real benchmarks against a small prompt suite. Smoke tests use tiny prompts and never print credentials.",
-    usage: "wstack modeldiag [preflight|test|eval] [...]",
-    subcommands: [
-      {
-        name: "preflight [provider-profile]",
-        description: "Check native cloud provider setup without model requests or exposing credential values."
-      },
-      {
-        name: "<no subcommand>",
-        description: "Print configured model capabilities, context limits, and recommendations."
-      },
-      {
-        name: "test [--plan|--all-models|--json]",
-        description: "Run live sequential smoke tests across configured models."
-      },
-      {
-        name: "eval [--providers <csv>]",
-        description: "Run model competency matrix evaluation across tasks."
-      }
-    ],
-    seeAlso: "wstack modeldiag test --plan; wstack modeldiag test; wstack modeldiag test --all-models"
-  },
-  // -- Bench (developer / CI only) -------------------------------------
-  bench: {
-    name: "bench",
-    title: "wstack bench \u2014 run model-independent agentic benchmarks",
-    description: "Run WrongStack against the bundled smoke suite, a local manifest, Aider polyglot, or SWE-bench Verified with deterministic graders. Default `bench run` is the bundled core edit-eval; pass --cell provider/model (or a saved model).",
-    usage: "wstack bench [run|compare|report|list|mine|review|route|experiment] [...]",
-    subcommands: [
-      { name: "run", description: "Run a suite. Default: bundled smoke + --cell or saved model." },
-      {
-        name: "compare <a> <b>",
-        description: "Diff two finished run directories (fingerprint-aware)."
-      },
-      { name: "report <dir>", description: "Render the Markdown report for a prior run." },
-      {
-        name: "review --transcript <file>",
-        description: "Read-only transcript behavior/compaction evidence; optional --policy."
-      },
-      {
-        name: "route <dir> --policy <file>",
-        description: "Shadow routing recommendations from graded model-matrix evidence."
-      },
-      {
-        name: "experiment <a> <b> --dimension compaction|behavior",
-        description: "Compare paired task/model/attempt runs with explicit experiment provenance."
-      },
-      { name: "list", description: "List available suites and the model configs in the catalog." }
-    ],
-    seeAlso: "wstack modeldiag (read-only diagnostics; bench actually runs the model)"
-  },
-  // -- Quick launch ------------------------------------------------------
-  quick: {
-    name: "quick",
-    title: "wstack quick \u2014 launch the TUI with sensible defaults",
-    description: "Accept every default, list installed plugins, and open the TUI with the agents-monitor panel pre-shown. Equivalent to `wstack --tui --quick`; the dedicated subcommand is for discoverability and tab-completion. The actual TUI launch is intercepted in `boot()` before this handler runs.",
-    usage: "wstack quick",
-    seeAlso: "wstack --tui (the underlying flag; quick is just a shortcut)"
-  },
-  // -- Aliases and meta commands ───────────────────────────────────────
-  plugins: {
-    name: "plugins",
-    title: "wstack plugins \u2014 alias for wstack plugin",
-    description: "Alias for `wstack plugin`. See `wstack plugin --help` for the full set of subcommands.",
-    usage: "wstack plugins (alias for wstack plugin)",
-    seeAlso: "wstack plugin (the canonical command)"
-  },
-  help: {
-    name: "help",
-    title: "wstack help \u2014 print top-level help",
-    description: "Print the top-level help text listing every subcommand with a one-line summary. Equivalent to `wstack --help`.",
-    usage: "wstack help",
-    seeAlso: "wstack --help"
-  },
-  // -- HQ (dashboard server) ──────────────────────────────────────────
-  hq: {
-    name: "hq",
-    title: "wstack hq \u2014 serve HQ, manage authentication, or install its system service",
-    description: "Start the HQ server \u2014 a web dashboard for monitoring sessions, fleet status, and agent activity across projects; manage browser/client authentication, or install the persistent Ubuntu systemd service.",
-    usage: "wstack hq [serve] [...] | wstack hq token [create|list|revoke] | wstack hq service [install|status|update|uninstall]",
-    subcommands: [
-      { name: "serve", description: "Start the HQ dashboard server (default)." },
-      {
-        name: "token create [label]",
-        description: "Mint a browser or client authentication token."
-      },
-      { name: "token list", description: "List active HQ authentication tokens." },
-      { name: "token revoke <id>", description: "Revoke an issued HQ authentication token." },
-      {
-        name: "service install",
-        description: "Install an always-on systemd service and guarded automatic updater."
-      },
-      { name: "service status", description: "Inspect the HQ service and update timer." },
-      { name: "service update", description: "Run the guarded update job immediately." },
-      {
-        name: "service uninstall",
-        description: "Remove systemd units while preserving HQ data and secrets."
-      }
-    ],
-    seeAlso: "wstack sessions fleet (CLI equivalent for fleet status)"
-  },
-  // -- Mailbox (external agent bridge) ────────────────────────────────
-  mailbox: {
-    name: "mailbox",
-    title: "wstack mailbox \u2014 serve the external-agent mailbox HTTP bridge",
-    description: "Start the mailbox HTTP bridge that lets external coding agents (Claude Code, Aider, custom scripts) communicate with the shared project mailbox. The server exposes a REST + SSE API for sending, checking, and acknowledging messages. Use `wstack mailbox serve` to start the listener.",
-    usage: "wstack mailbox serve [--port <n>]",
-    subcommands: [{ name: "serve", description: "Start the mailbox HTTP bridge listener." }],
-    seeAlso: "wstack hq (the HQ server includes mailbox routing)"
-  },
-  // -- Permissions ────────────────────────────────────────────────────
-  permissions: {
-    name: "permissions",
-    title: "wstack permissions \u2014 list and explain the permission rules",
-    description: "Side-effect-free views of the permission policy the agent runs under: every rule in the order it is checked, and how one tool call is decided, without prompting, modifying trust files, or mutating state. Inside a session, /permissions also sets allow/deny rules for that session only.",
-    usage: "wstack permissions [rules|explain <tool> [--input '<json>']] [--json]",
-    subcommands: [
-      {
-        name: "rules",
-        description: "List every permission rule, in the order they are checked (first match decides)."
-      },
-      {
-        name: "explain <tool>",
-        description: "Explain how the permission policy decides a tool call, and name the rule."
-      }
-    ],
-    seeAlso: "wstack tools (list available tools)"
-  },
-  // -- Project management ─────────────────────────────────────────────
-  project: {
-    name: "project",
-    title: "wstack project \u2014 manage committed repository identity",
-    description: "Manage the committed repository identity (project.json) used to scope HQ dashboards, Kanban state, and multi-agent coordination. Commit the generated ID file so every clone shares the same project.",
-    usage: "wstack project [id|init|rekey] [--yes]",
-    subcommands: [
-      { name: "id", description: "Show the current project ID and config path (default)." },
-      { name: "init", description: "Initialize a project ID if not already present." },
-      { name: "rekey", description: "Generate a new project ID for a fork (requires --yes)." }
-    ],
-    seeAlso: "wstack projects (list all tracked projects)"
-  },
-  governance: {
-    name: "governance",
-    title: "wstack governance \u2014 inspect deterministic project-daemon health",
-    description: "Read token-free attachment-broker health from the current project daemon. Warnings are advisory: they surface deterministic operator escalation signals without stopping active tasks or model execution.",
-    usage: "wstack governance status [--json]",
-    subcommands: [{ name: "status", description: "Show daemon and attachment-broker health." }],
-    seeAlso: "wstack doctor (broader environment diagnostics)"
-  },
-  "import-claude-code": {
-    name: "import-claude-code",
-    title: "wstack import-claude-code \u2014 bring a Claude Code setup across",
-    description: "Import MCP servers from ~/.claude.json (user + this project) and the repository's .mcp.json into the active profile. Previews by default. Repository servers arrive disabled unless --enable-project-servers. Skills are read in place; hooks, permission rules and CLAUDE.md are reported with next steps, not translated.",
-    usage: "wstack import-claude-code [--apply] [--overwrite] [--enable-project-servers]",
-    subcommands: [
-      { name: "--apply", description: "Write the plan (default: preview only)." },
-      { name: "--overwrite", description: "Replace servers that already exist by name." },
-      {
-        name: "--enable-project-servers",
-        description: "Enable the repository's .mcp.json servers on import."
-      }
-    ],
-    seeAlso: "wstack mcp list; --mcp-config (one-off servers without importing)"
-  },
-  sage: {
-    name: "sage",
-    title: "wstack sage \u2014 this project's SAGE memory in other coding agents",
-    description: "Wire SAGE memory into Claude Code, Codex, Cursor or Antigravity over MCP: writes the MCP server entry plus a skill/rule telling the agent when to recall and how to propose. The server attaches to the SAGE daemon while wstack is open in this project and never starts one. Tools are read-only plus memory_candidates (list/propose); a proposal becomes memory only through WrongStack review. Search is lexical: semantic recall runs inside a WrongStack host.",
-    usage: "wstack sage connect <claude-code|codex|cursor|antigravity|all|print> [--dry-run]",
-    subcommands: [
-      { name: "connect <client|all>", description: "Write the MCP entry and skill for a client." },
-      { name: "connect print", description: "Print JSON/TOML config for any other MCP client." },
-      { name: "disconnect <client|all>", description: "Remove what connect wrote." },
-      { name: "mcp [--origin <name>]", description: "The stdio MCP server clients run." },
-      {
-        name: "sync [--restart-service]",
-        description: "Run project memory sync with HQ; optionally restart this project\u2019s SAGE owner."
-      },
-      { name: "--dry-run", description: "Show the file changes without writing." },
-      { name: "--command <path>", description: "Executable to launch instead of wstack." }
-    ],
-    seeAlso: "wstack mcp serve (all WrongStack tools over MCP)"
-  },
-  // -- Chronicle ──────────────────────────────────────────────────────
-  chronicle: {
-    name: "chronicle",
-    title: "wstack chronicle \u2014 query cross-session provenance ledger",
-    description: "Query the cross-session event ledger, inspect daemon status, compute facet aggregations, view token/cost metrics, or purge old retention entries.",
-    usage: "wstack chronicle [query|status|facet|metrics|prune|compact] [...]",
-    subcommands: [
-      { name: "query [field=value ...]", description: "Query recorded provenance events." },
-      { name: "status", description: "Check the Chronicle daemon and pipeline status." },
-      { name: "facet <field>", description: "Group and count events across a facet." },
-      {
-        name: "metrics [providers|tasks|files|summary]",
-        description: "Query aggregated metrics from metrics.db."
-      },
-      {
-        name: "prune [--days N] [--dry-run]",
-        description: "Purge journal entries older than N days."
-      },
-      { name: "compact", description: "Defragment and compact SQLite ledger." }
-    ],
-    seeAlso: "wstack audit (per-session audit log); wstack usage (cost summary)"
-  }
+  ...OPERATIONS_HELP_ENTRIES
 };
 
 // src/subcommands/handlers/per-subcommand-help.ts
@@ -1300,4 +1325,4 @@ export {
   subcommandsWithFocusedHelp,
   renderGenericHelp
 };
-//# sourceMappingURL=chunk-ZF4HRR5F.js.map
+//# sourceMappingURL=chunk-P7MEEUGT.js.map