@wrongstack/core 0.299.0 → 0.301.0

package/dist/infrastructure/index.js

@@ -35,27 +35,81 @@ var init_pid = __esm({
 // src/session-registry-atomic-file.ts
 import { randomUUID } from "node:crypto";
 import * as fs6 from "node:fs/promises";
+import { hostname } from "node:os";
 import * as path8 from "node:path";
+function lockOwnerStamp() {
+  return `${HOST_NAME}:${process.pid}`;
+}
+async function maybeUnlinkOwnedLock(lockPath) {
+  const owner = await fs6.readFile(lockPath, "utf8").catch(() => null);
+  if (owner === null || owner.trim() !== lockOwnerStamp()) return;
+  for (let attempt = 0; attempt < 3; attempt++) {
+    try {
+      await fs6.unlink(lockPath);
+      return;
+    } catch {
+      if (attempt < 2) await new Promise((resolve5) => setTimeout(resolve5, 5));
+    }
+  }
+}
 async function breakStaleLock(lockPath) {
   try {
-    const [stat5, content] = await Promise.all([
-      fs6.stat(lockPath),
-      /* v8 ignore start -- best-effort lock-content read; .catch only fires if the lock vanished */
-      fs6.readFile(lockPath, "utf8").catch(() => "")
-      /* v8 ignore stop */
-    ]);
-    const ageMs = Date.now() - stat5.mtimeMs;
-    const ownerPid = Number.parseInt(content.trim(), 10);
-    const ownerDead = Number.isInteger(ownerPid) && ownerPid > 0 && ownerPid !== process.pid && !isPidAlive(ownerPid);
-    if (ownerDead || ageMs > STALE_LOCK_MS) {
-      await fs6.unlink(lockPath).catch(() => void 0);
-      return true;
+    const content = await fs6.readFile(lockPath, "utf8").catch(() => "");
+    const trimmed = content.trim();
+    const colonIdx = trimmed.indexOf(":");
+    if (colonIdx === -1) {
+      const barePid = Number.parseInt(trimmed, 10);
+      if (Number.isInteger(barePid) && barePid > 0 && !isPidAlive(barePid)) {
+        return await breakStaleLockVerified(lockPath, async () => {
+          const reread = await fs6.readFile(lockPath, "utf8").catch(() => "");
+          return reread.trim() === trimmed;
+        });
+      }
+      return await breakStaleLockVerified(lockPath, async () => {
+        const st = await fs6.stat(lockPath);
+        return Date.now() - st.mtimeMs > STALE_LOCK_MS;
+      });
     }
-    return false;
+    const ownerHost = trimmed.slice(0, colonIdx);
+    const ownerPid = Number.parseInt(trimmed.slice(colonIdx + 1), 10);
+    if (ownerHost === HOST_NAME && Number.isInteger(ownerPid) && ownerPid > 0) {
+      if (isPidAlive(ownerPid)) {
+        const stat5 = await fs6.stat(lockPath);
+        if (Date.now() - stat5.mtimeMs > SAME_HOST_STALE_MS) {
+          return await breakStaleLockVerified(lockPath, async () => {
+            const st = await fs6.stat(lockPath);
+            return Date.now() - st.mtimeMs > SAME_HOST_STALE_MS;
+          });
+        }
+        return false;
+      }
+      return await breakStaleLockVerified(lockPath, async () => {
+        const reread = await fs6.readFile(lockPath, "utf8").catch(() => "");
+        return reread.trim() === trimmed;
+      });
+    }
+    return await breakStaleLockVerified(lockPath, async () => {
+      const st = await fs6.stat(lockPath);
+      return Date.now() - st.mtimeMs > STALE_LOCK_MS;
+    });
   } catch {
     return true;
   }
 }
+async function breakStaleLockVerified(lockPath, verify) {
+  if (!await verify()) return false;
+  return await breakLockAtomically(lockPath) === true;
+}
+async function breakLockAtomically(lockPath) {
+  const tombstone = `${lockPath}.stale-${randomUUID()}.tmp`;
+  try {
+    await fs6.rename(lockPath, tombstone);
+  } catch {
+    return false;
+  }
+  void fs6.unlink(tombstone).catch(() => void 0);
+  return true;
+}
 async function writeAtomicFile(filePath, registry) {
   const tmp = path8.join(
     path8.dirname(filePath),
@@ -120,14 +174,16 @@ async function pruneStaleTempFiles(filePath) {
   } catch {
   }
 }
-var STALE_LOCK_MS, STALE_TMP_MS, MAX_STALE_TMP_FILES;
+var STALE_LOCK_MS, SAME_HOST_STALE_MS, STALE_TMP_MS, MAX_STALE_TMP_FILES, HOST_NAME;
 var init_session_registry_atomic_file = __esm({
   "src/session-registry-atomic-file.ts"() {
     "use strict";
     init_pid();
     STALE_LOCK_MS = 1e4;
+    SAME_HOST_STALE_MS = 2 * STALE_LOCK_MS;
     STALE_TMP_MS = 6e4;
     MAX_STALE_TMP_FILES = 20;
+    HOST_NAME = hostname();
   }
 });
 
@@ -552,16 +608,33 @@ var init_session_registry = __esm({
                 continue;
               }
             }
+            let stampFailed = false;
             try {
-              await lockHandle.writeFile(String(process.pid)).catch(() => void 0);
+              let stamped = false;
+              for (let stampAttempt = 0; stampAttempt < 3 && !stamped; stampAttempt++) {
+                try {
+                  await lockHandle.writeFile(lockOwnerStamp());
+                  stamped = true;
+                } catch {
+                  if (stampAttempt < 2) await new Promise((resolve5) => setTimeout(resolve5, 5));
+                }
+              }
+              if (!stamped) {
+                stampFailed = true;
+                throw new Error("failed to stamp session-registry lock owner");
+              }
               const raw = await fs7.readFile(this.filePath, "utf8").catch(() => "{}");
               const registry = parseRegistry(raw);
               fn(registry);
               await this.writeAtomicWithRetry(registry);
               return;
             } finally {
-              await lockHandle.close();
-              await fs7.unlink(lockPath).catch(() => void 0);
+              await lockHandle.close().catch(() => void 0);
+              if (stampFailed) {
+                await fs7.unlink(lockPath).catch(() => void 0);
+              } else {
+                await maybeUnlinkOwnedLock(lockPath);
+              }
             }
           } catch (err) {
             if (err instanceof SessionOwnershipConflictError) throw err;
@@ -2911,6 +2984,9 @@ function canonicalProjectRoot(absRoot) {
     const commonDirFile = path5.join(gitDir, "commondir");
     if (!fs4.statSync(commonDirFile).isFile()) return checkoutRoot;
     const commonDir = path5.resolve(gitDir, fs4.readFileSync(commonDirFile, "utf8").trim());
+    const worktreesDir = path5.dirname(gitDir);
+    if (path5.basename(worktreesDir).toLowerCase() !== "worktrees") return checkoutRoot;
+    if (path5.resolve(worktreesDir, "..") !== commonDir) return checkoutRoot;
     if (path5.basename(commonDir).toLowerCase() !== ".git") return checkoutRoot;
     return path5.dirname(commonDir);
   } catch {
@@ -2933,7 +3009,7 @@ function safeProfileName(name) {
   const safe = (name ?? "").replace(/[/\\:]/g, "_").replace(/\.\./g, "_").trim();
   return safe || "default";
 }
-function activeProfileName(globalRoot) {
+function bootstrapProfileName(globalRoot) {
   try {
     const parsed = JSON.parse(fs4.readFileSync(path5.join(globalRoot, "config.json"), "utf8"));
     return safeProfileName(
@@ -2951,7 +3027,7 @@ function wstackGlobalRoot() {
 function resolveWstackPaths(opts) {
   const globalRoot = opts.globalRoot ?? (opts.userHome ? path5.join(opts.userHome, ".wrongstack") : wstackGlobalRoot());
   const homeDir = opts.userHome ?? os2.homedir();
-  const profileName = safeProfileName(opts.profileName ?? activeProfileName(globalRoot));
+  const profileName = safeProfileName(opts.profileName ?? bootstrapProfileName(globalRoot));
   const profileDir = path5.join(globalRoot, "profiles", profileName);
   const hash = projectHash(opts.projectRoot);
   const slug = projectSlug(opts.projectRoot);
@@ -3021,7 +3097,12 @@ function resolveWstackPaths(opts) {
     projectRequirementIntakes: path5.join(projectDir, "requirement-intakes"),
     syncConfig: path5.join(profileDir, "sync.json"),
     configHistoryDir: path5.join(globalRoot, "config-history"),
-    projectStatus: (projectHash2) => path5.join(globalRoot, "projects", projectHash2, "status.json")
+    projectStatus: (statusProjectSlug) => {
+      if (!/^[a-z0-9](?:[a-z0-9-]{0,39})-[a-f0-9]{6}$/.test(statusProjectSlug)) {
+        throw new Error(`Invalid project slug: ${statusProjectSlug}`);
+      }
+      return path5.join(globalRoot, "projects", statusProjectSlug, "status.json");
+    }
   };
 }
 
@@ -3035,6 +3116,7 @@ function isBootstrapOnly(config) {
 function normalizeTokenSavingTier(val) {
   if (val === void 0) return "off";
   if (typeof val === "boolean") return val ? "medium" : "off";
+  if (val === "auto") return "medium";
   const validTiers = /* @__PURE__ */ new Set([
     "off",
     "minimal",
@@ -3176,7 +3258,7 @@ var CONFIG_BEHAVIOR_DEFAULTS = {
       enabled: false
     }
   },
-  skills: { readClaudeSkills: true },
+  skills: { readClaudeSkills: true, mode: "progressive" },
   mcpServers: {},
   fallbackAuto: true,
   maxConcurrent: 4,
@@ -3378,6 +3460,10 @@ var KNOWN_DENIED_IN_PROJECT = [
     reason: "Controls which plugin boot states the LLM may mutate; user-owned trust policy."
   },
   { key: "sync", reason: "Carries githubToken credential and target repo." },
+  {
+    key: "cloudSync",
+    reason: "Carries the my.wrongstack.com machine token credential and endpoint URL."
+  },
   { key: "yolo", reason: "Disables all permission confirmation prompts." },
   { key: "extensions", reason: "Per-plugin config can carry command/credential fields." },
   { key: "hq", reason: "Carries HQ client token credential and endpoint URL." },
@@ -3440,6 +3526,7 @@ var KNOWN_CONFIG_TOP_LEVEL_KEYS = /* @__PURE__ */ new Set([
   "modelRuntime",
   "hq",
   "sync",
+  "cloudSync",
   "extensions",
   "acp",
   "fleet",

package/dist/kernel/events/brain-events.d.ts

@@ -264,6 +264,15 @@ export interface BrainEventMap {
         completed: number;
         /** Optional fleet-wide cost total (USD) — set by the host bridge when known. */
         totalCostUsd?: number | undefined;
+        /** Concurrent-subagent ceiling (issue #323). */
+        maxConcurrent?: number | undefined;
+        /** Lifetime spawn budget snapshot (issue #323). */
+        maxSpawns?: number | undefined;
+        usedSpawns?: number | undefined;
+        remainingSpawns?: number | undefined;
+        effectiveSource?: string | undefined;
+        checkpointMaxSpawns?: number | undefined;
+        ceilingMismatch?: boolean | undefined;
         subagentStatuses: {
             subagentId: string;
             taskId: string;

package/dist/kernel/events/provider-events.d.ts

@@ -160,6 +160,8 @@ export interface ProviderEventMap {
         };
         status: number;
         providerSwitched: boolean;
+        /** Gate correlation id — set when a fallback gate mediated the switch. */
+        requestId?: string | undefined;
         contextWindowWarning?: {
             fromMaxContext: number;
             toMaxContext: number;
@@ -167,7 +169,33 @@ export interface ProviderEventMap {
         } | undefined;
     };
     /**
-     * Fired whenever a (providerId, model) pair transitions between
+     * Fired by the fallback gate function (supplied to the fallback-model
+     * extension via `FallbackModelDeps.fallbackGate`) when the chain is about
+     * to engage, BEFORE attempting any fallback entry. Carries the full
+     * candidate list so the UI can show a modal with a countdown and manual
+     * pick. The gate waits for a `provider.fallback_choice` event bus emission
+     * (or the countdown timer) before proceeding with the chosen model or
+     * auto-switching to the next candidate.
+     */
+    'provider.fallback_pending': {
+        sessionId?: string | undefined;
+        from: {
+            providerId: string;
+            model: string;
+        };
+        status: number;
+        candidates: Array<{
+            providerId: string;
+            model: string;
+        }>;
+        /** Seconds the UI should count down before auto-switching to the next model. */
+        autoSwitchSeconds: number;
+        /** Unique request id — the UI echoes this back in the choice message. */
+        requestId: string;
+        timestamp: number;
+    };
+    /**
+     * Fired when a (providerId, model) pair transitions between
      * healthy/degraded/blocked states. The tracker emits this so the
      * CLI/TUI/WebUI can render a live status indicator.
      */
@@ -180,6 +208,19 @@ export interface ProviderEventMap {
         timestamp: number;
         stateExpiresAt?: number | undefined;
     };
+    /**
+     * Fired by the UI when the user manually picks a model from the
+     * fallback modal. The fallback gate listens for this event (matched
+     * by `requestId`) to resolve with the chosen model instead of waiting
+     * for the countdown.
+     */
+    'provider.fallback_choice': {
+        requestId: string;
+        providerId?: string | undefined;
+        model?: string | undefined;
+        /** When true, auto-switch to the next candidate (countdown expired or Esc). */
+        autoSwitch?: boolean | undefined;
+    };
     /**
      * Fired when the agent's actively selected (primary, not fallback)
      * provider/model is blocked and will be skipped. The CLI/TUI should

package/dist/kernel/events/session-events.d.ts

@@ -11,6 +11,13 @@ export interface SessionEventMap {
         id: string;
         sessionId?: string | undefined;
         usage: Usage;
+        /**
+         * Register asynchronous session-end producer work during the synchronous
+         * `session.ended` callback. Cleanup waits for every registered promise to
+         * settle (fulfilled or rejected) before draining review work and closing.
+         * Calls made after the callback returns are outside the join contract.
+         */
+        waitUntil?: ((work: Promise<void>) => void) | undefined;
     };
     'session.damaged': {
         sessionId: string;
@@ -72,6 +79,12 @@ export interface SessionEventMap {
         providerId: string;
         modelId: string;
         maxContext: number;
+        /** Previous positive limit when this event represents a live change. */
+        previousMaxContext?: number | undefined;
+        /** Whether the value came from static resolution or a live provider probe. */
+        source?: 'configured' | 'provider' | 'provider_overflow' | undefined;
+        /** True when the positive limit decreased and UI should surface a warning. */
+        decreased?: boolean | undefined;
     };
     'context.repaired': {
         sessionId?: string | undefined;

package/dist/kernel/events/tool-events.d.ts

@@ -202,9 +202,9 @@ export interface ToolEventMap {
         input?: unknown | undefined;
         output?: string | undefined;
         /**
-         * The `--- SAGE: … (Memory Injector) ---` block the SAGE middleware
-         * appended to the result, split off `output` BEFORE the preview cap and
-         * carried as whole lines (header first). Absent when nothing was injected.
+         * Legacy inline `--- SAGE: … (Memory Injector) ---` content split off
+         * `output` before the preview cap. Current retrievals travel through
+         * `memory.injector_run` and provider memory-evidence blocks instead.
          *
          * Surfaces render it as a memory card, never as tool output: sharing the
          * `output` budget used to cut a memory line mid-fence on short tool

package/dist/models/index.d.ts

@@ -8,4 +8,5 @@ export { ALIBABA_TOKEN_PLAN_MODELS, alibabaTokenPlanModelMeta, type AlibabaToken
 export { MODELS_DEV_MODALITY_VALUES, modelsDevCostSchema, modelsDevLimitSchema, modelsDevModalitiesSchema, modelsDevModelSchema, modelsDevPayloadSchema, modelsDevProviderSchema, type ModelsDevModelParsed, type ModelsDevPayloadParsed, type ModelsDevProviderParsed, type ModelsDevSchemaSyncProof, } from './models-dev-schema.js';
 export { MODEL_PROFILES, TASK_TO_ROLE, inferTaskType, findModelProfile, scoreModelForTask, type ModelProfile, type TaskType, } from './model-intelligence.js';
 export { ModelRouter, type RouterConfig, type ModelPick, type RouterCosts, type ModelIntelligenceEntry, } from './model-router.js';
+export { hasProviderCredential, hasProviderKeyInConfig, hasProviderKeyInEnv, type ProviderCredentialConfig, type ProviderCredentialSubject, } from './provider-credentials.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/models/index.js

@@ -584,7 +584,7 @@ var DefaultModelsRegistry = class {
   async load(opts = {}) {
     if (this.payload && !opts.force) return this.payload;
     if (this.seed) {
-      this.payload = this.seed;
+      this.payload = this.withExtraOverlay(this.seed);
       this.fetchedAt = /* @__PURE__ */ new Date();
       return this.payload;
     }
@@ -2391,6 +2391,20 @@ var ModelRouter = class {
     return matrix;
   }
 };
+
+// src/models/provider-credentials.ts
+function hasProviderKeyInEnv(provider, env = process.env) {
+  return (provider.envVars ?? []).some((name) => !!env[name]);
+}
+function hasProviderKeyInConfig(providerId, config) {
+  const entry = config?.providers?.[providerId];
+  if (!entry) return false;
+  if (typeof entry.apiKey === "string" && entry.apiKey.length > 0) return true;
+  return Array.isArray(entry.apiKeys) && entry.apiKeys.some((k) => !!k?.apiKey);
+}
+function hasProviderCredential(provider, config, env = process.env) {
+  return hasProviderKeyInEnv(provider, env) || hasProviderKeyInConfig(provider.id, config);
+}
 export {
   ALIBABA_TOKEN_PLAN_MODELS,
   CODEX_MODELS,
@@ -2406,6 +2420,9 @@ export {
   codexModelMeta,
   describeCatalogModel,
   findModelProfile,
+  hasProviderCredential,
+  hasProviderKeyInConfig,
+  hasProviderKeyInEnv,
   inferTaskType,
   loadProjectModes,
   loadUserModes,

package/dist/models/provider-credentials.d.ts

@@ -0,0 +1,54 @@
+/**
+ * "Does this provider have a usable credential?" — one answer.
+ *
+ * There were three, and they disagreed:
+ *
+ *  - `cli/src/provider-helpers.ts` — env var OR `config.providers[id].apiKey`
+ *    OR any entry in `apiKeys[]`. The complete rule.
+ *  - `cli/src/slash-commands/modelcaps.ts` — config only. `/modelcaps` printed
+ *    a hollow `○` next to every provider keyed purely through
+ *    `ANTHROPIC_API_KEY`, which is the most common way to key one.
+ *  - `webui-server/src/server/provider-handlers.ts` — `savedIds.has(id) || env`.
+ *    `savedIds` means "appears in the saved config at all", so a provider saved
+ *    with a `baseUrl` and no key reported `hasApiKey: true` and the WebUI
+ *    offered it as ready to use.
+ *
+ * The rule itself is small; that it lives in three places is the defect. This
+ * module is in core because the CLI and the WebUI server both need it and
+ * neither may import the other.
+ */
+/** The provider fields the check reads. Both call sites can supply these. */
+export interface ProviderCredentialSubject {
+    readonly id: string;
+    /** Environment variables that carry this provider's key, if any. */
+    readonly envVars?: readonly string[] | undefined;
+}
+/** The saved-config shape the check reads. */
+export interface ProviderCredentialConfig {
+    readonly providers?: Readonly<Record<string, {
+        readonly apiKey?: string | undefined;
+        readonly apiKeys?: readonly ({
+            readonly apiKey?: string | undefined;
+        } | undefined)[] | undefined;
+    } | undefined>> | undefined;
+}
+/**
+ * Is a key present in the environment for this provider?
+ *
+ * Split out because the WebUI reports the two sources separately in places, and
+ * because a caller with no config still has a meaningful answer.
+ */
+export declare function hasProviderKeyInEnv(provider: ProviderCredentialSubject, env?: Readonly<Record<string, string | undefined>>): boolean;
+/** Is a non-empty key stored in the saved config for this provider? */
+export declare function hasProviderKeyInConfig(providerId: string, config: ProviderCredentialConfig | undefined): boolean;
+/**
+ * Can the user call this provider right now?
+ *
+ * Deliberately does NOT cover keyless local gateways (loopback servers that
+ * declare no env vars). They need no credential at all, which is a different
+ * question with a different answer — see `isKeylessLocalProvider`. Folding the
+ * two together here would make "has a key" mean "is usable" and quietly lose
+ * the distinction the picker needs.
+ */
+export declare function hasProviderCredential(provider: ProviderCredentialSubject, config: ProviderCredentialConfig | undefined, env?: Readonly<Record<string, string | undefined>>): boolean;
+//# sourceMappingURL=provider-credentials.d.ts.map

package/dist/plugin/api.d.ts

@@ -7,9 +7,11 @@ import type { ProviderRegistry } from '../registry/provider-registry.js';
 import type { SlashCommandRegistry } from '../registry/slash-command-registry.js';
 import type { ToolRegistry } from '../registry/tool-registry.js';
 import type { Config } from '../types/config.js';
+import type { CouncilQuestion, CouncilResult } from '../types/council.js';
 import type { HookEvent, HookMatcher, InProcessHook } from '../types/hooks.js';
 import type { Logger } from '../types/logger.js';
 import type { ModelsRegistry } from '../types/models-registry.js';
+import type { OneShotLLMInput, OneShotLLMResult } from '../types/one-shot-llm.js';
 import type { MCPRegistryView, MetricsSinkView, Notifier, PluginAPI, PluginCapabilities, PluginDependency, PluginLLM, PluginPipelines, ProviderRegistryView, SessionWriterView, SlashCommandRegistryView, ToolRegistryView } from '../types/plugin.js';
 import type { Provider } from '../types/provider.js';
 import type { SystemPromptContributor } from '../types/system-prompt-contributor.js';
@@ -91,6 +93,10 @@ export interface PluginAPIInit {
         getProvider?: (() => Provider) | undefined;
         getModel?: (() => string) | undefined;
         createProvider?: ((name: string, model?: string) => Provider) | undefined;
+        /** Preferred production path: shared One Shot runtime with fallbacks. */
+        oneShot?: ((input: OneShotLLMInput) => Promise<OneShotLLMResult>) | undefined;
+        /** Optional shared multi-model Council runtime. */
+        council?: ((question: CouncilQuestion) => Promise<CouncilResult>) | undefined;
     } | undefined;
     config: Config;
     /**

package/dist/plugin/config.d.ts

@@ -28,6 +28,61 @@ export interface PluginConfigChange {
  * beat aliases, making migrations deterministic regardless of object order.
  */
 export declare function resolvePluginConfig(input: ResolvePluginConfigInput): ResolvedPluginConfig;
+/**
+ * Default `config.plugins` name matcher: the canonical name, a declared
+ * alias, or the `@wrongstack/plugins/<name>` subpath spelling of either.
+ *
+ * Surfaces that know more pass their own `matches` — the loader has an alias
+ * table (`lsp` → `@wrongstack/plug-lsp`), the CLI folds `telegram` and
+ * `@wrongstack/telegram` into one row. This is the floor, not the ceiling.
+ */
+export declare function pluginEntryMatchesName(configuredName: string, name: string, aliases?: readonly string[]): boolean;
+export type PluginEnablementSource = 'feature-flag' | 'plugin-entry' | 'extension' | 'default';
+export interface ResolvedPluginEnablement {
+    enabled: boolean;
+    source: PluginEnablementSource;
+}
+export interface ResolvePluginEnablementInput {
+    name: string;
+    aliases?: readonly string[] | undefined;
+    /**
+     * `'active'` — runs unless something turns it off.
+     * `'inactive'` — runs only when something explicitly turns it on.
+     * Omitted behaves like `'inactive'`.
+     */
+    defaultState?: 'active' | 'inactive' | undefined;
+    config?: (Partial<Pick<Config, 'plugins' | 'extensions'>> & {
+        features?: Partial<Config['features']> | undefined;
+    }) | undefined;
+    /**
+     * Overrides how a `config.plugins` entry name is matched against this
+     * plugin. Surfaces normalize specs differently (the loader maps
+     * `@wrongstack/plugins/foo` → `foo`, the CLI treats `telegram` and
+     * `@wrongstack/telegram` as one row), so matching is per-surface —
+     * only the PRECEDENCE below is shared. Defaults to name/alias equality.
+     */
+    matches?: ((configuredName: string) => boolean) | undefined;
+}
+/**
+ * Resolve whether a plugin boots, under ONE precedence shared by every
+ * surface that reports or acts on plugin state:
+ *
+ *   1. `features.plugins === false` — kills every plugin.
+ *   2. a matching `config.plugins` entry — `{ enabled: false }` is off,
+ *      anything else is on. This is what `wstack plugin enable|disable`
+ *      writes, so it stays the highest per-plugin authority.
+ *   3. `config.extensions[name].enabled`, when it is a boolean — the
+ *      plugin's own master switch.
+ *   4. the catalog `defaultState`.
+ *
+ * Rule 3 used to be read only by the loader, and only in its `=== true`
+ * direction: a plugin switched on via `extensions` ran while every
+ * reporting surface — which looked at `config.plugins` alone — called it
+ * disabled, and `extensions[name].enabled = false` turned nothing off.
+ * Both directions now resolve here, so "what runs" and "what the report
+ * says" cannot drift apart again.
+ */
+export declare function resolvePluginEnablement(input: ResolvePluginEnablementInput): ResolvedPluginEnablement;
 export declare function resolvePluginManifestConfig(plugin: Pick<Plugin, 'name' | 'configAliases' | 'defaultConfig'>, config?: ResolvePluginConfigInput['config'], explicitOptions?: Readonly<Record<string, unknown>>): ResolvedPluginConfig;
 /** Unknown fields are immutable by default so a new option cannot silently hot-reload. */
 export declare function diffPluginConfig(previous: Readonly<Record<string, unknown>>, next: Readonly<Record<string, unknown>>, fields: Readonly<Record<string, PluginConfigFieldMetadata>>): PluginConfigChange[];

package/dist/plugin/index.d.ts

@@ -1,5 +1,5 @@
 export { DefaultPluginAPI, definePlugin, type PluginAPIInit } from './api.js';
-export { diffPluginConfig, type PluginConfigChange, type PluginConfigSource, type ResolvePluginConfigInput, type ResolvedPluginConfig, redactPluginConfig, resolvePluginConfig, resolvePluginManifestConfig, validatePluginConfigMetadata, } from './config.js';
+export { diffPluginConfig, type PluginConfigChange, type PluginConfigSource, type PluginEnablementSource, pluginEntryMatchesName, type ResolvePluginConfigInput, type ResolvePluginEnablementInput, type ResolvedPluginConfig, type ResolvedPluginEnablement, redactPluginConfig, resolvePluginConfig, resolvePluginEnablement, resolvePluginManifestConfig, validatePluginConfigMetadata, } from './config.js';
 export { KERNEL_API_VERSION, loadPlugins, type LoadPluginsOptions, type PluginHostHandle, type PluginLoadFailure, unloadPlugins, } from './loader.js';
 export type { PluginAPI } from '../types/plugin.js';
 export { buildReviewerModelPool, createAutoReviewPlugin, parseReviewSeverity, type ReviewerModelAssignment, selectRoundRobinReviewerAssignment, } from '../plugins/auto-review-plugin.js';
@@ -12,4 +12,5 @@ export { persistReviewReport, type ReportIntegrationResult, } from '../plugins/r
 export { maybeCompactReviewStores, type ReviewStoreMaintenanceResult, } from '../plugins/review-store-maintenance.js';
 export { createSkillsPlugin } from '../plugins/skills-plugin.js';
 export { createSyncPlugin } from '../plugins/sync-plugin.js';
+export { createCloudConfigSyncPlugin } from '../plugins/cloud-config-sync-plugin.js';
 //# sourceMappingURL=index.d.ts.map