@wrongstack/cli 1.1.4 → 1.1.6

package/dist/{chunk-JKTJSLUT.js → chunk-QRWXHGLB.js}

@@ -1,3 +1,7 @@
+import {
+  resolveWrongForgeEndpoint,
+  wrongForgeCall
+} from "./chunk-PGC44T7N.js";
 
 // src/fleet/acp-wrongstack-bridge.ts
 import { statSync } from "node:fs";
@@ -17,6 +21,43 @@ function wstackLaunch(args, entry = process.argv[1]) {
   }
   return { command: "wstack", args };
 }
+function wstackToolsCommand(entry = process.argv[1], platform = process.platform) {
+  const launch = wstackLaunch(["tools"], entry);
+  return [launch.command, ...launch.args].map((word) => shellWord(word, platform)).join(" ");
+}
+function shellWord(word, platform) {
+  const w = platform === "win32" ? word.replace(/\\/g, "/") : word;
+  return /^[A-Za-z0-9_./:@=+-]+$/.test(w) ? w : `"${w.replace(/(["\\$`])/g, "\\$1")}"`;
+}
+function cliIndexNote(cmd) {
+  return [
+    `- \`${cmd} run <tool> -- --<field> <value>\` (run through your shell): a prebuilt, ranked`,
+    "  symbol index of this repository, caught up with the disk on every call. Prefer it over",
+    '  grep/glob and whole-file reads for code navigation: codebase-context --query "<task>"',
+    "  (files relevant to a task), codebase-search --query <name> (where something is defined),",
+    "  codebase-incoming-calls / codebase-outgoing-calls --symbol <name> (callers, callees),",
+    "  codebase-read-symbol --file <path> --symbol <name> (one symbol's source),",
+    "  codebase-skeleton --path <file-or-dir> (an outline), codebase-impact-analysis --symbol",
+    `  <name> (what a change affects). \`${cmd} describe <tool>\` lists a tool's fields;`,
+    `  \`${cmd} batch\` runs several JSONL calls ({"tool":\u2026,"input":\u2026}) in one process.`,
+    "  Use grep for literal text such as strings, comments and config values."
+  ];
+}
+function serviceNotes(servers, delegated, indexCli) {
+  const viaCli = indexCli !== void 0 && servers.includes("codebase-index");
+  const mcp = viaCli ? servers.filter((s) => s !== "codebase-index") : servers;
+  return [
+    ...mcp.length > 0 ? [
+      "WrongStack's project services are available as MCP servers:",
+      ...mcp.map((s) => SERVER_NOTES[s](delegated))
+    ] : [],
+    ...viaCli ? [
+      ...mcp.length > 0 ? [""] : [],
+      "WrongStack's codebase index is available through its CLI:",
+      ...cliIndexNote(indexCli)
+    ] : []
+  ];
+}
 var SERVER_NAMES = {
   sage: "wrongstack-sage",
   mailbox: "wrongstack-mailbox",
@@ -31,9 +72,15 @@ var SERVER_NOTES = {
   "codebase-index": () => "- wrongstack-index: a prebuilt, ranked symbol index of this repository, kept fresh by WrongStack. Prefer it over grep/glob and whole-file reads for code navigation: codebase_search (where something is defined), codebase_incoming_calls / codebase_outgoing_calls (callers, callees), codebase_read_symbol (one symbol's source), codebase_skeleton (a file or folder outline), codebase_impact_analysis (what a change affects), codebase_context (files relevant to a task), codebase_repo_map (overview). Use grep for literal text such as strings, comments and config values.",
   "requirement-intake": () => "- wrongstack-intake: the project's requirements intake. List open requests; file a new one when you are handed an unrecorded software request."
 };
-function serviceWorkflow(servers) {
+function serviceWorkflow(servers, indexCli) {
   return [
-    ...servers.includes("codebase-index") ? [
+    ...servers.includes("codebase-index") ? indexCli !== void 0 ? [
+      "Use the WrongStack index first for code navigation; use your file tools for edits,",
+      "exact literal searches, and verification. Start a code task with",
+      `${indexCli} run codebase-context -- --query "<the task in a few words>"; for a named`,
+      `symbol use ${indexCli} run codebase-search -- --query <name>. If the index lacks a`,
+      "result, fall back to your tools."
+    ] : [
       "Use wrongstack-index first for code navigation; use your file tools for edits, exact",
       "literal searches, and verification. Start a code task with",
       "mcp__wrongstack-index__codebase_context (task description); for a named symbol use",
@@ -57,10 +104,12 @@ function serviceWorkflow(servers) {
     "If a project service is unavailable, continue with available tools and report the gap."
   ];
 }
-function bridgeTaskKickoff(servers) {
+function bridgeTaskKickoff(servers, indexCli) {
   return [
     "Project-service kickoff for this task:",
-    ...servers.includes("codebase-index") ? ["First use mcp__wrongstack-index__codebase_context to locate relevant code."] : [],
+    ...servers.includes("codebase-index") ? [
+      indexCli !== void 0 ? `First run ${indexCli} run codebase-context -- --query "<the task>" to locate relevant code.` : "First use mcp__wrongstack-index__codebase_context to locate relevant code."
+    ] : [],
     ...servers.includes("sage") ? ["Use mcp__wrongstack-sage__memory_search for prior project guidance."] : [],
     ...servers.includes("mailbox") ? ['Check mcp__wrongstack-mailbox__mailbox_read with action "inbox".'] : [],
     ...servers.includes("kanban") ? ["If the task names a board card, inspect it with mcp__wrongstack-kanban__kanban_read."] : [],
@@ -93,7 +142,7 @@ function serverArgs(server, projectRoot, ctx) {
       return [...base, "--writable"];
   }
 }
-function bridgeNote(servers, delegated = true) {
+function bridgeNote(servers, delegated = true, indexCli) {
   return [
     "You are working as a delegated worker inside a WrongStack project.",
     "WrongStack is the orchestrator the user runs: it sent you this task and receives your",
@@ -104,10 +153,9 @@ function bridgeNote(servers, delegated = true) {
       "from the user who delegated the task, and answer what it asks."
     ] : [],
     "",
-    "WrongStack's project services are available as MCP servers:",
-    ...servers.map((s) => SERVER_NOTES[s](delegated)),
+    ...serviceNotes(servers, delegated, indexCli),
     "",
-    ...serviceWorkflow(servers),
+    ...serviceWorkflow(servers, indexCli),
     "",
     "WrongStack applies the user's rules to your edits and commands. A refused permission",
     "comes from them (a deny rule the user wrote, a history-rewriting git command, a",
@@ -115,15 +163,14 @@ function bridgeNote(servers, delegated = true) {
     "was refused in your final reply."
   ].join("\n");
 }
-function leaderBridgeNote(servers) {
+function leaderBridgeNote(servers, indexCli) {
   return [
     "You are the leader of a WrongStack session. The user talks to you through WrongStack",
     "(its terminal UI or web UI), which shows your replies, your tool calls and their results.",
     "",
-    "WrongStack's project services are available as MCP servers:",
-    ...servers.map((s) => SERVER_NOTES[s](false)),
+    ...serviceNotes(servers, false, indexCli),
     "",
-    ...serviceWorkflow(servers),
+    ...serviceWorkflow(servers, indexCli),
     "",
     "WrongStack applies the user's rules to your edits and commands and asks the user when one",
     "needs approval. A refused permission is the user's decision or rule: do not retry it or",
@@ -167,21 +214,24 @@ function installedBridgeAgents(acp, isOnPath = (c) => onPath(c)) {
 }
 function wrongstackBridgeSetup(agentId, projectRoot, config, role = "worker") {
   const agents = config?.agents ?? DEFAULT_BRIDGE_AGENTS;
-  if (!agents.some((a) => a === agentId || REGISTRY_ID_ALIASES[a] === agentId)) return void 0;
+  const listed = (a) => a === agentId || REGISTRY_ID_ALIASES[a] === agentId || REGISTRY_ID_ALIASES[agentId] === a;
+  if (!agents.some(listed)) return void 0;
   const servers = [...new Set(config?.servers ?? DEFAULT_BRIDGE_SERVERS)].filter(
     (s) => Object.hasOwn(SERVER_NAMES, s)
   );
   if (servers.length === 0) return void 0;
+  const indexCli = config?.indexSurface === "cli" && servers.includes("codebase-index") ? wstackToolsCommand() : void 0;
+  const attached = indexCli ? servers.filter((s) => s !== "codebase-index") : servers;
   return (_task, ctx) => ({
-    promptPrefix: bridgeTaskKickoff(servers),
-    mcpServers: servers.map((server) => {
+    promptPrefix: bridgeTaskKickoff(servers, indexCli),
+    mcpServers: attached.map((server) => {
       const launch = wstackLaunch(serverArgs(server, projectRoot, ctx));
       return { name: SERVER_NAMES[server], ...launch, env: [] };
     }),
     meta: {
       systemPrompt: {
         // `@session` only reaches someone when a WrongStack session delegated the task.
-        append: role === "leader" ? leaderBridgeNote(servers) : bridgeNote(servers, ctx.sessionId !== void 0)
+        append: role === "leader" ? leaderBridgeNote(servers, indexCli) : bridgeNote(servers, ctx.sessionId !== void 0, indexCli)
       }
     }
   });
@@ -517,12 +567,186 @@ ${command}
   }
 }
 
+// src/fleet/wrongforge-info.ts
+import { mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import path from "node:path";
+import { wstackGlobalRoot } from "@wrongstack/core/utils";
+function wrongForgeInfoCacheFile() {
+  return path.join(wstackGlobalRoot(), "cache", "wrongforge-info.json");
+}
+function parseWrongForgeInfo(body) {
+  const o = body && typeof body === "object" ? body : {};
+  const strings = (v) => Array.isArray(v) ? v.filter((x) => typeof x === "string" && x.length > 0) : [];
+  const def = o["default_model"] ?? o["defaultModel"];
+  const details = o["model_details"] ?? o["modelDetails"];
+  const effort = o["effort"];
+  const levels = effort?.levels ?? o["effortLevels"];
+  return {
+    models: strings(o["models"]),
+    ...typeof def === "string" && def ? { defaultModel: def } : {},
+    features: strings(o["features"]),
+    ...Array.isArray(levels) ? { effortLevels: strings(levels) } : {},
+    ...Array.isArray(details) ? {
+      modelDetails: details.flatMap((value) => {
+        if (!value || typeof value !== "object") return [];
+        const d = value;
+        if (typeof d["id"] !== "string" || !d["id"]) return [];
+        return [
+          {
+            id: d["id"],
+            description: typeof d["description"] === "string" ? d["description"] : "",
+            effortLevels: strings(d["effort_levels"] ?? d["effortLevels"])
+          }
+        ];
+      })
+    } : {}
+  };
+}
+function readCachedWrongForgeInfo(file = wrongForgeInfoCacheFile()) {
+  try {
+    const info = parseWrongForgeInfo(JSON.parse(readFileSync(file, "utf8").replace(/^\uFEFF/, "")));
+    return info.models.length > 0 ? info : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function writeWrongForgeInfoCache(info, file = wrongForgeInfoCacheFile()) {
+  if (info.models.length === 0) return;
+  try {
+    mkdirSync(path.dirname(file), { recursive: true });
+    const tmp = `${file}.${process.pid}.tmp`;
+    writeFileSync(tmp, `${JSON.stringify(info)}
+`);
+    renameSync(tmp, file);
+  } catch {
+  }
+}
+async function fetchWrongForgeInfo(ep, opts = {}) {
+  const res = await (opts.fetchImpl ?? fetch)(`${ep.url}/v1/info`, {
+    headers: { authorization: `Bearer ${ep.apiKey}` },
+    ...opts.signal ? { signal: opts.signal } : {}
+  });
+  if (!res.ok) throw new Error(`WrongForge /v1/info answered ${res.status}`);
+  return parseWrongForgeInfo(await res.json());
+}
+function refreshWrongForgeInfoCache(ep) {
+  if (!ep) return;
+  void fetchWrongForgeInfo(ep, { signal: AbortSignal.timeout(3e3) }).then((info) => writeWrongForgeInfoCache(info)).catch(() => void 0);
+}
+
+// src/fleet/wrongforge-quota.ts
+import {
+  DEFAULT_QUOTA_METER,
+  recordProviderQuota
+} from "@wrongstack/core/quota";
+var reads = /* @__PURE__ */ new Map();
+var REFRESH_MS = 2e4;
+function object(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value) ? value : {};
+}
+function percent(value) {
+  return typeof value === "number" && Number.isFinite(value) && value >= 0 && value <= 100;
+}
+async function reportWrongForgeQuota(opts = {}) {
+  const endpoint = opts.endpoint ?? resolveWrongForgeEndpoint();
+  if (!endpoint) return false;
+  const providerId = opts.providerId ?? "wrongforge";
+  const key = `${providerId}\0${endpoint.url}\0${endpoint.apiKey}`;
+  const prior = reads.get(key);
+  if (prior?.pending) {
+    if (opts.force && !prior.forced) {
+      await prior.pending;
+      return reportWrongForgeQuota(opts);
+    }
+    return prior.pending;
+  }
+  if (!opts.force && prior && Date.now() - prior.at < REFRESH_MS) return prior.ok;
+  const state = { at: Date.now(), ok: false, forced: opts.force === true };
+  reads.set(key, state);
+  if (reads.size > 128)
+    for (const [id, entry] of reads) {
+      if (!entry.pending && id !== key) {
+        reads.delete(id);
+        break;
+      }
+    }
+  state.pending = (async () => {
+    try {
+      const signal = AbortSignal.timeout(opts.timeoutMs ?? 1e4);
+      const body = object(
+        await wrongForgeCall(endpoint, opts.fetchImpl)(
+          "GET",
+          `/v1/usage${opts.force ? "?force=1" : ""}`,
+          void 0,
+          signal
+        )
+      );
+      if (signal.aborted) return false;
+      const windows = [];
+      for (const spec of [
+        { key: "five_hour", id: "primary", label: "5h", windowMinutes: 300 },
+        { key: "weekly", id: "secondary", label: "weekly", windowMinutes: 10080 }
+      ]) {
+        const raw = object(body[spec.key]);
+        if (!percent(raw.percent)) continue;
+        const reset = typeof raw.resetsAt === "string" ? Date.parse(raw.resetsAt) : Number.NaN;
+        windows.push({
+          id: spec.id,
+          label: spec.label,
+          windowMinutes: spec.windowMinutes,
+          usedPercent: raw.percent,
+          ...Number.isFinite(reset) ? { resetsAt: Math.floor(reset / 1e3) } : {}
+        });
+      }
+      if (windows.length === 0) return false;
+      const extra = object(body.extra_usage);
+      const snapshot = {
+        providerId,
+        meterId: DEFAULT_QUOTA_METER,
+        meterLabel: "WrongForge \xB7 Claude subscription",
+        windows,
+        capturedAt: Date.now()
+      };
+      if (extra.enabled === false) snapshot.credits = { hasCredits: false, unlimited: false };
+      if (extra.enabled === true) {
+        snapshot.note = percent(extra.utilization) ? `Extra usage enabled \xB7 ${extra.utilization}% used` : "Extra usage enabled";
+        if (typeof extra.usedCredits === "number" && Number.isFinite(extra.usedCredits) && extra.usedCredits >= 0 && typeof extra.monthlyLimit === "number" && Number.isFinite(extra.monthlyLimit) && extra.monthlyLimit >= 0) {
+          const remaining = Math.max(0, extra.monthlyLimit - extra.usedCredits);
+          snapshot.credits = {
+            hasCredits: remaining > 0,
+            unlimited: false,
+            balance: `${remaining} credits remaining (${extra.usedCredits}/${extra.monthlyLimit})`
+          };
+        }
+      } else if (extra.enabled === false) snapshot.note = "Extra usage disabled";
+      const exhausted = windows.filter(
+        (window) => window.usedPercent >= 100 && (window.resetsAt === void 0 || window.resetsAt * 1e3 > snapshot.capturedAt)
+      );
+      exhausted.sort((a, b) => (b.resetsAt ?? Infinity) - (a.resetsAt ?? Infinity));
+      if (exhausted[0]) snapshot.reachedWindowId = exhausted[0].id;
+      recordProviderQuota(providerId, [snapshot]);
+      state.ok = true;
+      return true;
+    } catch {
+      return false;
+    } finally {
+      delete state.pending;
+    }
+  })();
+  return state.pending;
+}
+
 export {
   DEFAULT_BRIDGE_SERVERS,
   installedBridgeAgents,
   wrongstackBridgeSetup,
   createProjectKanbanTransitionHandler,
   createProjectKanbanAssignHandler,
-  createHqCommandDispatcher
+  createHqCommandDispatcher,
+  parseWrongForgeInfo,
+  readCachedWrongForgeInfo,
+  writeWrongForgeInfoCache,
+  refreshWrongForgeInfoCache,
+  reportWrongForgeQuota
 };
-//# sourceMappingURL=chunk-JKTJSLUT.js.map
+//# sourceMappingURL=chunk-QRWXHGLB.js.map

package/dist/chunk-RN5CFAVQ.js

@@ -0,0 +1,292 @@
+import {
+  withheldReason
+} from "./chunk-LYWOV4OX.js";
+
+// src/tool-gateway-http.ts
+import { randomUUID } from "node:crypto";
+import { realpath } from "node:fs/promises";
+import { createServer } from "node:http";
+import * as path from "node:path";
+import { toErrorMessage } from "@wrongstack/core/utils";
+import {
+  bearerTokenMatches,
+  hostHeaderIsAcceptable,
+  isJsonContentType,
+  isLoopbackHost,
+  originIsAcceptable
+} from "@wrongstack/mcp";
+var BODY_CAP_BYTES = 4 * 1024 * 1024;
+var DEFAULT_MAX_CONCURRENT_CALLS = 16;
+var CALLBACK_TIMEOUT_MS = 3e4;
+function serveToolGatewayHttp(opts) {
+  const host = opts.host ?? "127.0.0.1";
+  if (!opts.token || opts.token.length < 16) {
+    return Promise.reject(
+      new Error("tools serve: a bearer token of at least 16 characters is required")
+    );
+  }
+  const maxConcurrent = opts.maxConcurrentCalls ?? DEFAULT_MAX_CONCURRENT_CALLS;
+  const pending = /* @__PURE__ */ new Set();
+  let inFlight = 0;
+  const server = createServer((req, res) => {
+    void handle(req, res).catch((err) => {
+      opts.log?.(`tools serve: request failed: ${toErrorMessage(err)}`);
+      if (!res.headersSent) send(res, 500, { ok: false, error: "internal_error" });
+    });
+  });
+  async function handle(req, res) {
+    if (!originIsAcceptable(req, host))
+      return send(res, 403, { ok: false, error: "cross_origin_forbidden" });
+    if (!hostHeaderIsAcceptable(req, host))
+      return send(res, 403, { ok: false, error: "untrusted_host_header" });
+    const url = new URL(req.url ?? "/", "http://local");
+    if (req.method === "GET" && url.pathname === "/health") return send(res, 200, { ok: true });
+    if (!bearerTokenMatches(req.headers.authorization, opts.token)) {
+      return send(res, 401, { ok: false, error: "unauthorized" });
+    }
+    let parts;
+    try {
+      parts = url.pathname.split("/").filter(Boolean).map(decodeURIComponent);
+    } catch {
+      return send(res, 400, { ok: false, error: "invalid_path_encoding" });
+    }
+    if (parts[0] !== "v1" || parts[1] !== "tools")
+      return send(res, 404, { ok: false, error: "not_found" });
+    const name = parts[2];
+    if (req.method === "GET" && parts.length === 2) {
+      return send(res, 200, {
+        mode: opts.gateway.mode,
+        capabilities: opts.gateway.capabilities,
+        tools: opts.gateway.tools.map(describe)
+      });
+    }
+    if (req.method === "GET" && name && parts.length === 3) {
+      const tool = opts.gateway.get(name);
+      if (!tool) return send(res, 404, notExposedBody(name));
+      return send(res, 200, describe(tool));
+    }
+    if (req.method === "POST" && name && parts.length === 4 && parts[3] === "call") {
+      return call(req, res, name);
+    }
+    return send(res, req.method === "GET" || req.method === "POST" ? 404 : 405, {
+      ok: false,
+      error: req.method === "GET" || req.method === "POST" ? "not_found" : "method_not_allowed"
+    });
+  }
+  async function call(req, res, name) {
+    if (!isJsonContentType(req.headers["content-type"])) {
+      return send(res, 415, { ok: false, error: "content_type_must_be_json" });
+    }
+    const body = await readBody(req);
+    if (body === "too_large") return send(res, 413, { ok: false, error: "payload_too_large" });
+    let parsed;
+    try {
+      parsed = parseCallRequest(body, opts.allowRemoteCallbacks === true);
+    } catch (err) {
+      return send(res, 400, { ok: false, error: "bad_request", message: toErrorMessage(err) });
+    }
+    if (!opts.gateway.get(name)) {
+      return send(res, 404, { call_id: parsed.callId, ...notExposedBody(name) });
+    }
+    let cwd;
+    if (parsed.workdir !== void 0) {
+      const resolved = await resolveWorkdir(parsed.workdir, opts.gateway.projectRoot);
+      if ("error" in resolved) {
+        return send(res, 400, {
+          call_id: parsed.callId,
+          ok: false,
+          tool: name,
+          error: "bad_workdir",
+          message: resolved.error
+        });
+      }
+      cwd = resolved.cwd;
+    }
+    if (inFlight >= maxConcurrent) {
+      return send(res, 429, { call_id: parsed.callId, ok: false, error: "too_many_calls" });
+    }
+    inFlight++;
+    const settle = run(name, parsed, cwd).finally(() => {
+      inFlight--;
+    });
+    if (!parsed.callback) {
+      return send(res, 200, await settle);
+    }
+    send(res, 202, { call_id: parsed.callId, status: "accepted" });
+    const delivery = settle.then((result) => deliverCallback(parsed.callback, result)).catch(
+      (err) => opts.log?.(`tools serve: callback for ${parsed.callId} failed: ${toErrorMessage(err)}`)
+    );
+    pending.add(delivery);
+    void delivery.finally(() => pending.delete(delivery));
+  }
+  async function run(name, req, cwd) {
+    const base = { call_id: req.callId, tool: name };
+    try {
+      const outcome = await opts.gateway.call(name, req.input, { cwd });
+      if (outcome.kind === "not_exposed") return { ...base, ...notExposedBody(name) };
+      if (outcome.kind === "confirm_required") {
+        return {
+          ...base,
+          ok: false,
+          error: "confirm_required",
+          message: `Tool "${name}" needs an interactive confirmation for this input, which this server cannot give.`
+        };
+      }
+      return {
+        ...base,
+        ok: !outcome.isError && outcome.settlement === "completed",
+        settlement: outcome.settlement,
+        duration_ms: outcome.durationMs,
+        content: outcome.content
+      };
+    } catch (err) {
+      return { ...base, ok: false, error: "tool_threw", message: toErrorMessage(err) };
+    }
+  }
+  async function deliverCallback(callback, result) {
+    const doFetch = opts.fetchImpl ?? fetch;
+    const res = await doFetch(callback.url, {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        ...callback.token ? { authorization: `Bearer ${callback.token}` } : {}
+      },
+      body: JSON.stringify(result),
+      signal: AbortSignal.timeout(CALLBACK_TIMEOUT_MS),
+      redirect: "error"
+    });
+    if (!res.ok) throw new Error(`callback answered HTTP ${res.status}`);
+  }
+  function notExposedBody(name) {
+    return {
+      ok: false,
+      tool: name,
+      error: "not_exposed",
+      message: withheldReason(opts.gateway, opts.registry, name)
+    };
+  }
+  return new Promise((resolve2, reject) => {
+    server.once("error", reject);
+    server.listen(opts.port ?? 0, host, () => {
+      server.removeListener("error", reject);
+      if (opts.unref) server.unref();
+      const port = server.address().port;
+      const shown = host === "::1" ? "[::1]" : host;
+      resolve2({
+        url: `http://${shown}:${port}/`,
+        port,
+        host,
+        close: async () => {
+          await new Promise((done) => server.close(() => done()));
+          await Promise.allSettled([...pending]);
+        }
+      });
+    });
+  });
+}
+function describe(tool) {
+  return {
+    name: tool.name,
+    description: tool.description,
+    input_schema: tool.inputSchema ?? { type: "object" },
+    capabilities: tool.capabilities ?? [],
+    mutating: tool.mutating
+  };
+}
+function parseCallRequest(body, allowRemoteCallbacks) {
+  const text = body.trim();
+  const raw = text === "" ? {} : JSON.parse(text);
+  if (!isRecord(raw)) throw new Error("the body must be a JSON object");
+  const input = raw["input"] ?? {};
+  if (!isRecord(input)) throw new Error(`"input" must be a JSON object (the tool's input)`);
+  const callId = raw["call_id"] ?? randomUUID();
+  if (typeof callId !== "string" || callId.length === 0 || callId.length > 200) {
+    throw new Error('"call_id" must be a non-empty string of at most 200 characters');
+  }
+  const cb = raw["callback"];
+  const workdir = raw["workdir"];
+  if (workdir !== void 0 && workdir !== null && (typeof workdir !== "string" || workdir === "")) {
+    throw new Error('"workdir" must be a non-empty path');
+  }
+  const base = { input, callId, ...typeof workdir === "string" ? { workdir } : {} };
+  if (cb === void 0) return base;
+  if (!isRecord(cb) || typeof cb["url"] !== "string") {
+    throw new Error('"callback" must be { "url": string, "token"?: string }');
+  }
+  let target;
+  try {
+    target = new URL(cb["url"]);
+  } catch {
+    throw new Error('"callback.url" is not a valid URL');
+  }
+  if (target.protocol !== "http:" && target.protocol !== "https:") {
+    throw new Error('"callback.url" must be http(s)');
+  }
+  if (!allowRemoteCallbacks && !isLoopbackHost(target.hostname.replace(/^\[(.*)\]$/, "$1"))) {
+    throw new Error(
+      '"callback.url" must be a loopback address (start the server with --allow-remote-callbacks)'
+    );
+  }
+  const token = cb["token"];
+  if (token !== void 0 && typeof token !== "string")
+    throw new Error('"callback.token" must be a string');
+  return { ...base, callback: { url: target.toString(), token } };
+}
+async function resolveWorkdir(workdir, projectRoot) {
+  let root;
+  let target;
+  try {
+    root = await realpath(projectRoot);
+    target = await realpath(path.resolve(projectRoot, workdir));
+  } catch {
+    return { error: `workdir "${workdir}" does not exist on the WrongStack side` };
+  }
+  const fold = (p) => process.platform === "win32" ? p.toLowerCase() : p;
+  const rel = path.relative(fold(root), fold(target));
+  if (rel.startsWith("..") || path.isAbsolute(rel)) {
+    return {
+      error: `workdir "${workdir}" is outside the project this server serves (${root}); start \`wstack tools serve\` in the task's directory`
+    };
+  }
+  return { cwd: target };
+}
+function readBody(req) {
+  return new Promise((resolve2, reject) => {
+    const chunks = [];
+    let size = 0;
+    let tooLarge = false;
+    req.on("data", (chunk) => {
+      if (tooLarge) return;
+      size += chunk.byteLength;
+      if (size > BODY_CAP_BYTES) {
+        tooLarge = true;
+        resolve2("too_large");
+        return;
+      }
+      chunks.push(chunk);
+    });
+    req.on("end", () => {
+      if (!tooLarge) resolve2(Buffer.concat(chunks).toString("utf8"));
+    });
+    req.on("error", reject);
+  });
+}
+function send(res, status, body) {
+  res.writeHead(status, {
+    "content-type": "application/json",
+    // This endpoint executes tools: nothing about it should be embedded,
+    // sniffed into another type, or leak its URL onward. No CORS headers.
+    "x-content-type-options": "nosniff",
+    "x-frame-options": "DENY",
+    "referrer-policy": "no-referrer"
+  });
+  res.end(JSON.stringify(body));
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+export {
+  serveToolGatewayHttp
+};
+//# sourceMappingURL=chunk-RN5CFAVQ.js.map

package/dist/{chunk-WDXNBYGD.js → chunk-TDP7CZGE.js}

@@ -61,6 +61,11 @@ var SDDState = class {
     if (this.versioning === null) this.versioning = new SpecVersioning();
     return this.versioning;
   }
+  /** Drain fire-and-forget tracker writes before deleting or replacing the store. */
+  async flushTaskWrites() {
+    await this.taskTracker?.flushPersistence();
+    await this.taskStore?.flush?.();
+  }
   clearTaskState() {
     this.taskStore = null;
     this.taskTracker = null;
@@ -406,4 +411,4 @@ export {
   getTaskGraphId,
   getTaskTrackerExport
 };
-//# sourceMappingURL=chunk-WDXNBYGD.js.map
+//# sourceMappingURL=chunk-TDP7CZGE.js.map

package/dist/{chunk-6VPWQ4TG.js → chunk-UROB7MK5.js}

@@ -63,6 +63,7 @@ var helpCmd = async (_args, deps) => {
       ["wstack sage sync", "Keep project SAGE memory synchronized through HQ"],
       ["wstack plugin", "Plugins: list, install, enable, disable, remove"],
       ["wstack tools | skills", "List registered tools / discovered skills"],
+      ["wstack tools run <tool>", "Call a built-in tool from a script or external agent"],
       ["wstack typesafe", "TypeSafe account: status, login, test"],
       ["wstack update", "Self-update (--check-only)"]
     ]),
@@ -157,4 +158,4 @@ export {
   versionCmd,
   helpCmd
 };
-//# sourceMappingURL=chunk-6VPWQ4TG.js.map
+//# sourceMappingURL=chunk-UROB7MK5.js.map