wholestack 0.6.0 → 0.6.1

package/dist/{chunk-C56OI76J.js → chunk-KJ5INI3M.js}

@@ -142,7 +142,7 @@ function fmtTokens(n) {
 }
 function scrubVendor(s) {
   return (s || "").replace(
-    /[\w./-]*(?:anthropic|claude|sonnet|opus|cerebras|openrouter|gpt-?oss|gpt-?\d|glm|kimi|qwen|llama|mistral|deepseek|zai|openai|google\/|meta-?llama)[\w./-]*/gi,
+    /[\w./-]*(?:anthropic|claude|sonnet|opus|cerebras|openrouter|gpt-?oss|gpt-?\d|glm|kimi|qwen|llama|mistral|deepseek|zai|openai|google\/(?:gemini|gemma)|meta-?llama)[\w./-]*/gi,
     "Zeta"
   );
 }
@@ -929,13 +929,15 @@ async function readSse(resp, onEvent) {
   }
 }
 async function demoBootBuild(zetaApiUrl, body, onPhase) {
+  const apiKey = process.env.ZETA_API_KEY?.trim();
+  const authHeaders8 = apiKey ? { authorization: `Bearer ${apiKey}` } : {};
   let spec2 = "";
   let draftErr = "";
   let draftResp = null;
   try {
     draftResp = await fetch(`${zetaApiUrl}/api/zeta/build`, {
       method: "POST",
-      headers: { "content-type": "application/json" },
+      headers: { "content-type": "application/json", ...authHeaders8 },
       body: JSON.stringify({ idea: body.idea, mode: "draft", buildModel: body.buildModel })
     });
   } catch (e) {
@@ -958,7 +960,7 @@ async function demoBootBuild(zetaApiUrl, body, onPhase) {
   try {
     bootResp = await fetch(`${zetaApiUrl}/api/zeta/demo/boot`, {
       method: "POST",
-      headers: { "content-type": "application/json" },
+      headers: { "content-type": "application/json", ...authHeaders8 },
       body: JSON.stringify({
         spec: spec2,
         idea: body.idea,
@@ -4285,6 +4287,13 @@ var ROLE_NZT_48 = [
   "   control, overflow, oracle/price manipulation, unchecked calls, value",
   "   extraction, proxy traps). Report severity + location + exploit path + fix.",
   "   Hunt weaknesses to CLOSE them; never weaponize.",
+  "   The prover now carries dedicated property kinds you can discharge",
+  "   mechanically on the same harness: oracle-manipulation-resistance (proves the",
+  "   contract survives an adversarial on-chain price; does NOT vouch for off-chain",
+  "   oracle honesty), governance safety (timelock-enforcement, flash-loan-",
+  "   resistant snapshot-voting-safety, quorum-enforcement), and MEV defenses",
+  "   (slippage-bound \u2014 the user's slippage bound is honored; deadline-enforcement).",
+  "   Treat these as provable mechanical properties, not heuristics.",
   "3. BUILD & SHIP \u2014 idea \u2192 ISL \u2192 Solidity \u2192 proven \u2192 deploy-ready, inside the",
   "   deterministic provable fragment. Run forge build/test, Slither, Halmos.",
   "   Never weaken a gate to force green \u2014 self-heal the spec instead.",
@@ -4299,9 +4308,13 @@ var ROLE_NZT_48 = [
   "   then the recommendation. Never fabricate a result \u2014 relay a down feed.",
   "",
   "RULES OF ENGAGEMENT: truth over optics (a refuted invariant honestly reported",
-  "is a win; fake-success is the one unforgivable error). One contract per proof",
-  "file; honor non-vacuity. Defensive only \u2014 refuse mass targeting, live attacks,",
-  "or anything outside an authorized engagement."
+  "is a win; fake-success is the one unforgivable error). Economic soundness",
+  "(incentives, peg, liquidation cascades) is SIMULATED under bounded scenarios",
+  "and reported as TESTED, NEVER proven, and never emits a certificate; MEV that",
+  "lives in cross-transaction ORDERING is out of scope \u2014 only contract-level",
+  "defenses are proven. One contract per proof file; honor non-vacuity. Defensive",
+  "only \u2014 refuse mass targeting, live attacks, or anything outside an authorized",
+  "engagement."
 ].join("\n");
 var DEFAULT_REGISTRY = (() => {
   const r = new PromptRegistry();

package/dist/cli.js

@@ -75,7 +75,7 @@ import {
   webBaseUrl,
   writeProjectLink,
   writeWorkingTree
-} from "./chunk-C56OI76J.js";
+} from "./chunk-KJ5INI3M.js";
 
 // src/cli.ts
 import { createInterface } from "readline/promises";

package/dist/index.js

@@ -49,7 +49,7 @@ import {
   resolveModelKey,
   severityRank,
   supportsThinking
-} from "./chunk-C56OI76J.js";
+} from "./chunk-KJ5INI3M.js";
 
 // src/prompts/template.ts
 var PLACEHOLDER = /\{\{([A-Za-z0-9_.]+)\}\}/g;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wholestack",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "description": "Wholestack — a pro-grade conversational terminal agent for the Wholestack codegen engine. Talk to it in plain language: it writes ISL, generates full-stack or Solidity apps, and proves them with ShipGate. Browser login, membership-gated builds, slash commands, sessions, plan mode, diffs, MCP, plugins.",
   "type": "module",
   "main": "./dist/index.js",