wholestack 0.6.1 → 0.7.0

package/dist/{chunk-KJ5INI3M.js → chunk-NHABZZTE.js}

@@ -590,6 +590,424 @@ async function collectLocalFiles(dir) {
   return { files, skipped };
 }
 
+// src/config.ts
+import { readFileSync as readFileSync2, writeFileSync as writeFileSync2, mkdirSync as mkdirSync2, existsSync as existsSync2, chmodSync, renameSync } from "fs";
+import { homedir } from "os";
+import { join as join2 } from "path";
+var LEGACY_DIR = join2(homedir(), ".zeta-g");
+var STATE_DIR = join2(homedir(), ".wholestack");
+try {
+  if (existsSync2(LEGACY_DIR) && !existsSync2(STATE_DIR)) renameSync(LEGACY_DIR, STATE_DIR);
+} catch {
+}
+function stateDir() {
+  return STATE_DIR;
+}
+function webBaseUrl() {
+  return process.env.ZETA_WEB_URL?.trim() || process.env.ZETA_API_URL?.trim() || "https://wholestack.ai";
+}
+function projectDirs(cwd2) {
+  return [join2(cwd2, ".wholestack"), join2(cwd2, ".zeta-g")];
+}
+var CONFIG_DIR = STATE_DIR;
+var CONFIG_PATH = join2(CONFIG_DIR, "config.json");
+function parseDotenv(text) {
+  const out = {};
+  for (const raw of text.split("\n")) {
+    const l = raw.trim();
+    if (!l || l.startsWith("#")) continue;
+    const eq = l.indexOf("=");
+    if (eq < 0) continue;
+    const k = l.slice(0, eq).trim();
+    let v = l.slice(eq + 1).trim();
+    if (v.startsWith('"') && v.endsWith('"') || v.startsWith("'") && v.endsWith("'")) {
+      v = v.slice(1, -1);
+    }
+    if (k) out[k] = v;
+  }
+  return out;
+}
+function fill(src) {
+  for (const [k, v] of Object.entries(src)) {
+    if (v && process.env[k] === void 0) process.env[k] = v;
+  }
+}
+function loadStoredEnv() {
+  const localEnv = join2(process.cwd(), ".env");
+  if (existsSync2(localEnv)) {
+    try {
+      fill(parseDotenv(readFileSync2(localEnv, "utf8")));
+    } catch {
+    }
+  }
+  if (existsSync2(CONFIG_PATH)) {
+    try {
+      const json = JSON.parse(readFileSync2(CONFIG_PATH, "utf8"));
+      const flat = {};
+      for (const [k, v] of Object.entries(json)) if (typeof v === "string") flat[k] = v;
+      fill(flat);
+    } catch {
+    }
+  }
+}
+function saveKey(name, value) {
+  mkdirSync2(CONFIG_DIR, { recursive: true });
+  let current = {};
+  if (existsSync2(CONFIG_PATH)) {
+    try {
+      current = JSON.parse(readFileSync2(CONFIG_PATH, "utf8"));
+    } catch {
+      current = {};
+    }
+  }
+  current[name] = value;
+  writeFileSync2(CONFIG_PATH, JSON.stringify(current, null, 2) + "\n", { mode: 384 });
+  chmodSync(CONFIG_PATH, 384);
+  return CONFIG_PATH;
+}
+
+// src/volition.ts
+import { cwd, stdout } from "process";
+function apiBase() {
+  return webBaseUrl().replace(/\/$/, "");
+}
+function jsonOut(obj) {
+  stdout.write(JSON.stringify(obj) + "\n");
+}
+async function resolveVolitionProject(nameOrId) {
+  const r = await apiJson(`${apiBase()}/api/projects`);
+  if (!r.ok) return { ok: false, error: r.error };
+  const projects = r.data.projects ?? [];
+  const byId = projects.find((p) => p.id === nameOrId);
+  if (byId) return { ok: true, project: byId };
+  const needle = nameOrId.trim().toLowerCase();
+  const byName = projects.find((p) => p.name?.trim().toLowerCase() === needle);
+  if (byName) return { ok: true, project: byName };
+  return { ok: false, error: `no project matches "${nameOrId}"` };
+}
+async function createVolitionProject(name, description) {
+  const r = await apiJson(
+    `${apiBase()}/api/projects`,
+    {
+      method: "POST",
+      body: JSON.stringify({
+        name,
+        description: description?.trim() || "Business handed to the Volition crew from the terminal"
+      })
+    }
+  );
+  if (!r.ok) return { ok: false, error: r.error };
+  const id = r.data.project?.id;
+  if (!id) return { ok: false, error: r.data.error ?? "project create returned no id" };
+  return { ok: true, id };
+}
+async function activateVolition(projectId, opts = {}) {
+  return apiJson(
+    `${apiBase()}/api/projects/${encodeURIComponent(projectId)}/volition/activate`,
+    { method: "POST", body: JSON.stringify({ live: opts.live === true }) }
+  );
+}
+async function volitionStatus(projectId) {
+  return apiJson(
+    `${apiBase()}/api/projects/${encodeURIComponent(projectId)}/volition`
+  );
+}
+async function volitionActions(projectId, limit = 20) {
+  const r = await apiJson(
+    `${apiBase()}/api/projects/${encodeURIComponent(projectId)}/volition/actions?limit=${limit}`
+  );
+  if (!r.ok) return { ok: false, error: r.error, status: r.status };
+  return { ok: true, actions: r.data.actions ?? [] };
+}
+async function volitionRunNow(projectId) {
+  return apiJson(
+    `${apiBase()}/api/projects/${encodeURIComponent(projectId)}/volition/run`,
+    { method: "POST", body: JSON.stringify({}) }
+  );
+}
+async function launchVolition(input2) {
+  const step = input2.onStep ?? (() => {
+  });
+  let projectId;
+  let created = false;
+  const target = input2.target?.trim();
+  if (target) {
+    const found = await resolveVolitionProject(target);
+    if (found.ok) {
+      projectId = found.project.id;
+      step(`project: ${found.project.name ?? projectId}`);
+    } else {
+      step(`creating project "${target}"`);
+      const made = await createVolitionProject(target, input2.description);
+      if (!made.ok) return { ok: false, error: made.error };
+      projectId = made.id;
+      created = true;
+    }
+  } else {
+    projectId = readProjectLink(input2.cwd ?? cwd())?.projectId;
+    if (!projectId) {
+      return {
+        ok: false,
+        error: 'no target \u2014 pass a business name or project id (wholestack volition "my business"), or run inside a linked project directory.'
+      };
+    }
+    step(`linked project: ${projectId}`);
+  }
+  step(input2.live ? "activating crew (LIVE \u2014 real external actions)" : "activating crew (sandbox)");
+  const r = await activateVolition(projectId, { live: input2.live });
+  const consoleUrl = `${apiBase()}/volition/${projectId}`;
+  if (!r.ok) {
+    return { ok: false, projectId, consoleUrl, status: r.status, activation: r.data, error: r.error };
+  }
+  if (created && input2.cwd) {
+    try {
+      writeProjectLink(input2.cwd, { projectId });
+    } catch {
+    }
+  }
+  return { ok: true, projectId, consoleUrl, activation: r.data };
+}
+function renderVerdictHelp(status, a) {
+  const out = [];
+  if (status === 401) {
+    out.push(c.red("  \u2717 sign in first \u2014 run `wholestack login`."));
+  } else if (status === 402) {
+    const price = a?.priceUsdCents ? `$${(a.priceUsdCents / 100).toFixed(0)}/mo` : "$99/mo";
+    out.push(c.red(`  \u2717 Operation Volition is a ${price} add-on.`));
+    out.push(c.dim(`    subscribe: ${apiBase()}${a?.checkoutPath ?? "/api/billing/addons/volition/checkout"}`));
+  } else if (status === 503) {
+    out.push(c.red("  \u2717 Volition inference is not configured."));
+    out.push(c.dim("    add an OpenRouter key in account secrets (web \u2192 Account \u2192 Secrets)."));
+  }
+  return out;
+}
+function renderActivation(projectId, consoleUrl, a) {
+  const out = [];
+  out.push(c.green("  \u2713 Volition crew activated") + (a.live ? c.red("  LIVE") : c.dim("  sandbox")));
+  if (a.firstRun?.runId) {
+    out.push(c.dim(`  first cycle: ${a.firstRun.runId}`));
+    if (a.firstRun.summary) out.push(c.dim(`  ${a.firstRun.summary}`));
+  } else {
+    out.push(c.dim("  first cycle queued \u2014 the crew runs on the hourly heartbeat."));
+  }
+  out.push(c.cyan(`  console: ${consoleUrl}`));
+  if (!a.live) {
+    out.push(c.dim("  sandbox = external actions are simulated. Re-run with --live to go real."));
+  }
+  return out;
+}
+var VERBS = /* @__PURE__ */ new Set(["status", "actions", "run", "launch", "activate", "start"]);
+async function runVolitionSubcommand(raw) {
+  if (raw[0] !== "volition") return null;
+  const rest = raw.slice(1);
+  const wantsJson = rest.includes("--json");
+  const live = rest.includes("--live");
+  const descIdx = rest.indexOf("--desc");
+  const description = descIdx >= 0 ? rest[descIdx + 1] : void 0;
+  const limitIdx = rest.indexOf("--limit");
+  const limit = limitIdx >= 0 ? Math.max(1, Number(rest[limitIdx + 1]) || 20) : 20;
+  const flagValueIdx = new Set(
+    [descIdx >= 0 ? descIdx + 1 : -1, limitIdx >= 0 ? limitIdx + 1 : -1].filter((i) => i >= 0)
+  );
+  const positional = rest.filter((a, i) => !a.startsWith("-") && !flagValueIdx.has(i));
+  if (!process.env.ZETA_API_KEY?.trim()) {
+    line(c.red("  login required \u2014 run `wholestack login` first."));
+    return 1;
+  }
+  const verb = VERBS.has(positional[0] ?? "") ? positional[0] : "launch";
+  const target = verb === "launch" && !VERBS.has(positional[0] ?? "") ? positional.join(" ") || void 0 : positional.slice(1).join(" ") || void 0;
+  const projectIdOr = async () => {
+    if (target) {
+      const found = await resolveVolitionProject(target);
+      if (found.ok) return found.project.id;
+      line(c.red(`  \u2717 ${found.error}`));
+      return null;
+    }
+    const linked = readProjectLink(cwd())?.projectId;
+    if (!linked) {
+      line(c.red("  no project \u2014 pass an id/name or run inside a linked project."));
+      return null;
+    }
+    return linked;
+  };
+  if (verb === "status") {
+    const id = await projectIdOr();
+    if (!id) return 1;
+    const r = await volitionStatus(id);
+    if (wantsJson) {
+      jsonOut(r.ok ? { ok: true, ...r.data } : { ok: false, error: r.error });
+      return r.ok ? 0 : 1;
+    }
+    line("");
+    if (!r.ok) {
+      line(c.red(`  \u2717 ${r.error}`));
+      return 1;
+    }
+    const op = r.data.operator ?? {};
+    const on = op.enabled === true;
+    line(
+      "  " + (on ? c.green("\u25CF operating") : c.dim("\u25CB idle")) + (op.sandbox === false ? c.red("  LIVE") : c.dim("  sandbox"))
+    );
+    const counts = r.data.actionCounts ?? {};
+    const countStr = Object.entries(counts).map(([k, v]) => `${k} ${v}`).join(" \xB7 ");
+    if (countStr) line(c.dim(`  actions: ${countStr}`));
+    for (const run of (r.data.recentRuns ?? []).slice(0, 5)) {
+      line(
+        c.dim(
+          `  ${run.status === "completed" ? "\u2713" : "\u2022"} ${run.runId ?? "run"}  ${run.trigger ?? ""}  ${run.summary ?? ""}`.trimEnd()
+        )
+      );
+    }
+    line(c.cyan(`  console: ${apiBase()}/volition/${id}`));
+    return 0;
+  }
+  if (verb === "actions") {
+    const id = await projectIdOr();
+    if (!id) return 1;
+    const r = await volitionActions(id, limit);
+    if (wantsJson) {
+      jsonOut(r.ok ? { ok: true, actions: r.actions } : { ok: false, error: r.error });
+      return r.ok ? 0 : 1;
+    }
+    line("");
+    if (!r.ok) {
+      line(c.red(`  \u2717 ${r.error}`));
+      return 1;
+    }
+    if (r.actions.length === 0) {
+      line(c.dim("  no actions yet \u2014 run a cycle (`wholestack volition run`)."));
+      return 0;
+    }
+    for (const a of r.actions) {
+      const mark = a.status === "executed" ? c.green("\u2713") : a.status === "blocked" ? c.red("\u2717") : c.cyan("\u2022");
+      line(
+        `  ${mark} ${c.bold(a.agent ?? "agent")} ${c.dim(a.kind ?? "")} ${a.summary ?? ""}`.trimEnd()
+      );
+      const proof = a.proofHash ? `  proof ${a.proofHash.slice(0, 12)}\u2026` : "";
+      line(c.dim(`     ${a.status ?? ""}${a.verdict ? ` \xB7 ${a.verdict}` : ""}${proof}`));
+    }
+    return 0;
+  }
+  if (verb === "run") {
+    const id = await projectIdOr();
+    if (!id) return 1;
+    line(c.dim("  running one cycle\u2026"));
+    const r = await volitionRunNow(id);
+    if (wantsJson) {
+      jsonOut(r.ok ? { ok: true, ...r.data } : { ok: false, error: r.error });
+      return r.ok ? 0 : 1;
+    }
+    if (!r.ok) {
+      line(c.red(`  \u2717 ${r.error}`));
+      return 1;
+    }
+    line(c.green(`  \u2713 cycle ${r.data.runId ?? "done"}`));
+    if (r.data.summary) line(c.dim(`  ${r.data.summary}`));
+    return 0;
+  }
+  const result = await launchVolition({
+    target,
+    live,
+    description,
+    cwd: cwd(),
+    onStep: (s) => line(c.dim(`  ${s}`))
+  });
+  if (wantsJson) {
+    jsonOut(
+      result.ok ? { ok: true, projectId: result.projectId, consoleUrl: result.consoleUrl, ...result.activation } : { ok: false, error: result.error, status: result.status, ...result.activation }
+    );
+    return result.ok ? 0 : 1;
+  }
+  line("");
+  if (!result.ok) {
+    const help = renderVerdictHelp(result.status, result.activation);
+    if (help.length > 0) for (const h of help) line(h);
+    else line(c.red(`  \u2717 ${result.error}`));
+    return 1;
+  }
+  for (const l of renderActivation(result.projectId, result.consoleUrl, result.activation ?? {}))
+    line(l);
+  return 0;
+}
+var volitionCommands = [
+  {
+    name: "volition",
+    aliases: ["crew"],
+    summary: "hand this business to the autonomous Volition crew",
+    source: "builtin",
+    run: async (ctx) => {
+      const arg = ctx.args.trim();
+      const live = /(^|\s)--live(\s|$)/.test(arg);
+      const target = arg.replace(/(^|\s)--live(\s|$)/g, " ").trim() || void 0;
+      const result = await launchVolition({
+        target,
+        live,
+        cwd: ctx.cwd,
+        onStep: (s) => ctx.print("  " + c.dim(s))
+      });
+      ctx.print();
+      if (!result.ok) {
+        const help = renderVerdictHelp(result.status, result.activation);
+        if (help.length > 0) for (const h of help) ctx.print(h);
+        else ctx.print("  " + c.red(`\u2717 ${result.error}`));
+        return { type: "handled" };
+      }
+      for (const l of renderActivation(
+        result.projectId,
+        result.consoleUrl,
+        result.activation ?? {}
+      ))
+        ctx.print(l);
+      return { type: "handled" };
+    }
+  },
+  {
+    name: "volition-status",
+    aliases: ["crew-status"],
+    summary: "operator state + recent runs of the Volition crew",
+    source: "builtin",
+    run: async (ctx) => {
+      const target = ctx.args.trim() || void 0;
+      let id = target;
+      if (id) {
+        const found = await resolveVolitionProject(id);
+        if (!found.ok) {
+          ctx.print("  " + c.red(`\u2717 ${found.error}`));
+          return { type: "handled" };
+        }
+        id = found.project.id;
+      } else {
+        id = readProjectLink(ctx.cwd)?.projectId;
+      }
+      if (!id) {
+        ctx.print("  " + c.red("no project \u2014 pass an id/name or run inside a linked project."));
+        return { type: "handled" };
+      }
+      const r = await volitionStatus(id);
+      ctx.print();
+      if (!r.ok) {
+        ctx.print("  " + c.red(`\u2717 ${r.error}`));
+        return { type: "handled" };
+      }
+      const op = r.data.operator ?? {};
+      ctx.print(
+        "  " + (op.enabled === true ? c.green("\u25CF operating") : c.dim("\u25CB idle")) + (op.sandbox === false ? c.red("  LIVE") : c.dim("  sandbox"))
+      );
+      const counts = Object.entries(r.data.actionCounts ?? {}).map(([k, v]) => `${k} ${v}`).join(" \xB7 ");
+      if (counts) ctx.print("  " + c.dim(`actions: ${counts}`));
+      for (const run of (r.data.recentRuns ?? []).slice(0, 5)) {
+        ctx.print(
+          "  " + c.dim(
+            `${run.status === "completed" ? "\u2713" : "\u2022"} ${run.runId ?? "run"}  ${run.summary ?? ""}`.trimEnd()
+          )
+        );
+      }
+      ctx.print("  " + c.cyan(`console: ${apiBase()}/volition/${id}`));
+      return { type: "handled" };
+    }
+  }
+];
+
 // src/launch.ts
 function deployError(d, fallback) {
   return {
@@ -816,24 +1234,28 @@ async function patchBusiness(apiUrl, body) {
 
 // src/prover.ts
 import { spawn as spawn2 } from "child_process";
-import { join as join3 } from "path";
-import { existsSync as existsSync3 } from "fs";
+import { join as join4 } from "path";
+import { existsSync as existsSync4 } from "fs";
 
 // src/zeta-engine.ts
 import { spawn } from "child_process";
 import { tmpdir } from "os";
-import { join as join2, dirname as dirname2, normalize as pathNormalize2, resolve as resolve2, sep as sep2 } from "path";
-import { existsSync as existsSync2, mkdirSync as mkdirSync2, writeFileSync as writeFileSync2 } from "fs";
+import { join as join3, dirname as dirname2, normalize as pathNormalize2, resolve as resolve2, sep as sep2 } from "path";
+import { existsSync as existsSync3, mkdirSync as mkdirSync3, writeFileSync as writeFileSync3 } from "fs";
 import { fileURLToPath } from "url";
 function normalize(result) {
   const files = Array.isArray(result.files) ? result.files : [];
   const verify = result.verify ?? {};
   const proofVerdict = result.proof?.verdict;
   const shipped = proofVerdict ? proofVerdict === "SHIP" : !!verify.ok;
+  const pending = result.proof?.proofStatus === "pending" && shipped;
+  const unverified = result.proof?.proofStatus === "unverified";
   return {
     ok: true,
     buildId: result.buildId ?? null,
     verdict: shipped ? "SHIP" : "NO_SHIP",
+    proofPending: pending,
+    unverified,
     themeId: result.themeId ?? null,
     fileCount: files.length,
     spec: typeof result.spec === "string" ? result.spec : null,
@@ -869,17 +1291,48 @@ function makeConsumer(onPhase) {
     }
   };
 }
+async function pollProofStatus(zetaApiUrl, buildId, authHeaders8, opts = {}) {
+  const interval = opts.intervalMs ?? 5e3;
+  const timeout = opts.timeoutMs ?? 10 * 60 * 1e3;
+  const started = Date.now();
+  let last = { proofStatus: "pending", verdict: null, dirty: false };
+  while (Date.now() - started < timeout) {
+    try {
+      const resp = await fetch(
+        `${zetaApiUrl}/api/zeta/build/${encodeURIComponent(buildId)}/proof-status`,
+        { headers: { ...authHeaders8 } }
+      );
+      if (resp.ok) {
+        const j = await resp.json();
+        last = {
+          proofStatus: j.proofStatus ?? null,
+          verdict: j.verdict ?? null,
+          dirty: j.dirty === true
+        };
+        if (last.proofStatus && last.proofStatus !== "pending") return last;
+      }
+    } catch {
+    }
+    opts.onTick?.(Date.now() - started);
+    await new Promise((r) => setTimeout(r, interval));
+  }
+  return last;
+}
 async function httpBuild(zetaApiUrl, body, onPhase) {
   let resp;
   try {
     const apiKey = process.env.ZETA_API_KEY?.trim();
+    const byokKey = process.env.ZETA_BYOK_KEY?.trim();
+    const byokProvider = process.env.ZETA_BYOK_PROVIDER?.trim();
     resp = await fetch(`${zetaApiUrl}/api/zeta/build`, {
       method: "POST",
       headers: {
         "content-type": "application/json",
         // Membership: lets the engine verify the subscription and return the code
         // (and charge one credit per app). Without it, only the preview comes back.
-        ...apiKey ? { authorization: `Bearer ${apiKey}` } : {}
+        ...apiKey ? { authorization: `Bearer ${apiKey}` } : {},
+        ...byokKey ? { "x-zeta-byok-key": byokKey } : {},
+        ...byokKey && byokProvider ? { "x-zeta-byok-provider": byokProvider } : {}
       },
       body: JSON.stringify({ ...body, mode: "idea" })
     });
@@ -1038,8 +1491,8 @@ async function deliverBuild(zetaApiUrl, buildId, destDir, onPhase) {
     const rel = pathNormalize2(f.path).replace(/^(\.\.(\/|\\|$))+/, "");
     const full = resolve2(root, rel);
     if (full !== root && !full.startsWith(root + sep2)) continue;
-    mkdirSync2(dirname2(full), { recursive: true });
-    writeFileSync2(full, f.content);
+    mkdirSync3(dirname2(full), { recursive: true });
+    writeFileSync3(full, f.content);
     written += 1;
     onPhase?.(`wrote ${rel}`);
   }
@@ -1049,7 +1502,7 @@ async function deliverBuild(zetaApiUrl, buildId, destDir, onPhase) {
 function findRepoRoot(start) {
   let dir = start ?? dirname2(fileURLToPath(import.meta.url));
   for (let i = 0; i < 12; i++) {
-    if (existsSync2(join2(dir, "scripts", "zeta-build-worker.mts"))) return dir;
+    if (existsSync3(join3(dir, "scripts", "zeta-build-worker.mts"))) return dir;
     const up = dirname2(dir);
     if (up === dir) break;
     dir = up;
@@ -1070,9 +1523,9 @@ async function localBuild(body, onPhase, repoRoot) {
       error: "local build needs the ZETA monorepo (scripts/zeta-build-worker.mts not found). Run from inside the repo, or use the http engine (--zeta-url)."
     };
   }
-  const worker = join2(root, "scripts", "zeta-build-worker.mts");
+  const worker = join3(root, "scripts", "zeta-build-worker.mts");
   const buildId = `zeta-build-${Date.now().toString(36)}-${Math.floor(performance.now())}`;
-  const projectDir = join2(tmpdir(), buildId);
+  const projectDir = join3(tmpdir(), buildId);
   const ideaB64 = Buffer.from(body.idea, "utf8").toString("base64");
   const args = [
     "--import",
@@ -1097,8 +1550,17 @@ async function localBuild(body, onPhase, repoRoot) {
         ...process.env,
         ...body.styleId ? { ZETA_COMPOSE_STYLE: body.styleId } : {},
         ...body.colorScheme ? { ZETA_BUILD_COLOR_SCHEME: body.colorScheme } : {},
+        // App-sizing override → the worker parses it (parseScopeOverride) into opts.appScope.
+        ...body.appScope ? { ZETA_BUILD_SCOPE: JSON.stringify(body.appScope) } : {},
         // SNIPER / lean → worker skips the Launch Kit + Brand Studio campaign.
-        ...body.lean ? { ZETA_LEAN: "1" } : {}
+        ...body.lean ? { ZETA_LEAN: "1" } : {},
+        // UNHINGED → worker skips ALL proofs/gates (fastest bootable, UNVERIFIED ship).
+        // BYOK keys ride the inherited ...process.env above (set by the /build command).
+        ...body.unhinged ? { ZETA_UNHINGED: "1" } : {},
+        // Studio parity pins — same worker envs the web route forwards.
+        ...body.platform === "mobile" ? { ZETA_BUILD_PLATFORM: "mobile" } : {},
+        ...body.archetype ? { ZETA_BUILD_ARCHETYPE: body.archetype } : {},
+        ...body.styleVibe ? { ZETA_STYLE_VIBE: body.styleVibe } : {}
       },
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -1143,11 +1605,11 @@ var PROPERTY_KINDS = [
 function resolveProver(repoRoot) {
   const root = repoRoot ?? findRepoRoot();
   if (!root) return null;
-  const base = join3(root, "packages", "shipgate-contract-prover");
-  const dist = join3(base, "dist", "cli.js");
-  if (existsSync3(dist)) return { nodeArgs: [dist] };
-  const src = join3(base, "src", "cli.ts");
-  if (existsSync3(src)) return { nodeArgs: ["--import", "tsx", src] };
+  const base = join4(root, "packages", "shipgate-contract-prover");
+  const dist = join4(base, "dist", "cli.js");
+  if (existsSync4(dist)) return { nodeArgs: [dist] };
+  const src = join4(base, "src", "cli.ts");
+  if (existsSync4(src)) return { nodeArgs: ["--import", "tsx", src] };
   return null;
 }
 function runProver(proverArgs, opts) {
@@ -1192,8 +1654,8 @@ ${e.message}` });
 // src/app-runner.ts
 import { spawn as spawn3, spawnSync } from "child_process";
 import { readFile } from "fs/promises";
-import { existsSync as existsSync4, readFileSync as readFileSync2, writeFileSync as writeFileSync3 } from "fs";
-import { join as join4, dirname as dirname3 } from "path";
+import { existsSync as existsSync5, readFileSync as readFileSync3, writeFileSync as writeFileSync4 } from "fs";
+import { join as join5, dirname as dirname3 } from "path";
 var running = [];
 function killRunningApps() {
   for (const a of running.splice(0)) {
@@ -1209,8 +1671,8 @@ function listRunningApps() {
 var URL_RE = /(https?:\/\/(?:localhost|127\.0\.0\.1|0\.0\.0\.0)(?::\d+)?[^\s)]*)/i;
 var FATAL_RE = /(Error:|error TS\d+|Cannot find module|EADDRINUSE|Failed to compile|SyntaxError|Module not found|exited with)/i;
 async function detectRun(dir) {
-  const pkgPath = join4(dir, "package.json");
-  if (!existsSync4(pkgPath)) {
+  const pkgPath = join5(dir, "package.json");
+  if (!existsSync5(pkgPath)) {
     return { error: `no package.json in ${dir} \u2014 not a runnable app directory` };
   }
   let scripts = {};
@@ -1220,7 +1682,7 @@ async function detectRun(dir) {
   } catch (e) {
     return { error: `unreadable package.json: ${e.message}` };
   }
-  const pm = existsSync4(join4(dir, "pnpm-lock.yaml")) ? "pnpm" : existsSync4(join4(dir, "yarn.lock")) ? "yarn" : "npm";
+  const pm = existsSync5(join5(dir, "pnpm-lock.yaml")) ? "pnpm" : existsSync5(join5(dir, "yarn.lock")) ? "yarn" : "npm";
   for (const s of ["dev", "start", "serve"]) {
     if (scripts[s]) return { command: pm, args: ["run", s], reason: `${pm} run ${s}` };
   }
@@ -1237,27 +1699,27 @@ function pnpmAvailable() {
   return _pnpmOnPath;
 }
 function installPmFor(dir) {
-  if (existsSync4(join4(dir, "yarn.lock"))) return "yarn";
-  if (existsSync4(join4(dir, "pnpm-lock.yaml"))) return "pnpm";
+  if (existsSync5(join5(dir, "yarn.lock"))) return "yarn";
+  if (existsSync5(join5(dir, "pnpm-lock.yaml"))) return "pnpm";
   return pnpmAvailable() ? "pnpm" : "npm";
 }
 function ensureNpmrc(dir, lines) {
   try {
-    const npmrc = join4(dir, ".npmrc");
-    const prev = existsSync4(npmrc) ? readFileSync2(npmrc, "utf8") : "";
+    const npmrc = join5(dir, ".npmrc");
+    const prev = existsSync5(npmrc) ? readFileSync3(npmrc, "utf8") : "";
     const missing = lines.filter((l) => !prev.includes(l.split("=")[0]));
     if (missing.length === 0) return;
     const sep5 = prev && !prev.endsWith("\n") ? "\n" : "";
-    writeFileSync3(npmrc, prev + sep5 + missing.join("\n") + "\n");
+    writeFileSync4(npmrc, prev + sep5 + missing.join("\n") + "\n");
   } catch {
   }
 }
 function isolateFromWorkspace(dir) {
-  if (existsSync4(join4(dir, "pnpm-workspace.yaml"))) return;
+  if (existsSync5(join5(dir, "pnpm-workspace.yaml"))) return;
   let cur = dirname3(dir);
   let nested = false;
   for (let i = 0; i < 12; i++) {
-    if (existsSync4(join4(cur, "pnpm-workspace.yaml"))) {
+    if (existsSync5(join5(cur, "pnpm-workspace.yaml"))) {
       nested = true;
       break;
     }
@@ -1267,14 +1729,14 @@ function isolateFromWorkspace(dir) {
   }
   if (!nested) return;
   try {
-    writeFileSync3(join4(dir, "pnpm-workspace.yaml"), "packages:\n  - .\n");
+    writeFileSync4(join5(dir, "pnpm-workspace.yaml"), "packages:\n  - .\n");
     ensureNpmrc(dir, ["ignore-workspace-root-check=true"]);
   } catch {
   }
 }
 function installDeps(dir, onLog, signal) {
   const pm = installPmFor(dir);
-  if (pm === "pnpm" && !existsSync4(join4(dir, "pnpm-lock.yaml"))) {
+  if (pm === "pnpm" && !existsSync5(join5(dir, "pnpm-lock.yaml"))) {
     ensureNpmrc(dir, ["shamefully-hoist=true", "prefer-offline=true"]);
   }
   const args = pm === "pnpm" ? (
@@ -1314,7 +1776,7 @@ ${e.message}` });
   });
 }
 async function runApp(dir, opts = {}) {
-  if (!existsSync4(join4(dir, "node_modules"))) {
+  if (!existsSync5(join5(dir, "node_modules"))) {
     isolateFromWorkspace(dir);
     const inst = await installDeps(dir, void 0, opts.signal);
     if (!inst.ok) {
@@ -1328,7 +1790,7 @@ async function runApp(dir, opts = {}) {
   let command;
   let cmdArgs;
   if (opts.script) {
-    const pm = existsSync4(join4(dir, "pnpm-lock.yaml")) ? "pnpm" : "npm";
+    const pm = existsSync5(join5(dir, "pnpm-lock.yaml")) ? "pnpm" : "npm";
     command = pm;
     cmdArgs = ["run", opts.script];
   } else {
@@ -1432,7 +1894,7 @@ async function fetchGithubRepos(webBase, installationId) {
 }
 
 // src/repo-audit.ts
-import { readFileSync as readFileSync3 } from "fs";
+import { readFileSync as readFileSync4 } from "fs";
 import { createInterface } from "readline/promises";
 import { stdin as input, stdout as output } from "process";
 
@@ -1598,7 +2060,7 @@ async function pickGithubRepoInteractive(webBase) {
 }
 function readSourceFile(path) {
   try {
-    const source = readFileSync3(path, "utf8");
+    const source = readFileSync4(path, "utf8");
     if (source.trim().length < 20) return { ok: false, error: "source file is too short" };
     return { ok: true, source };
   } catch (e) {
@@ -1613,11 +2075,11 @@ var TaskManager = class {
   seq = 0;
   map = /* @__PURE__ */ new Map();
   /** Start a detached-from-the-REPL background command. Returns the task id. */
-  start(command, args, cwd) {
+  start(command, args, cwd2) {
     const id = `t${++this.seq}`;
     const display = [command, ...args].join(" ");
     const child = spawn4(command, args, {
-      cwd,
+      cwd: cwd2,
       stdio: ["ignore", "pipe", "pipe"],
       // Own process group so we can signal the whole tree on kill.
       detached: false
@@ -1712,7 +2174,7 @@ import { tool as tool6 } from "ai";
 import { z as z6 } from "zod";
 import { spawn as spawn5 } from "child_process";
 import { readFile as readFile2, writeFile, mkdir, readdir, stat } from "fs/promises";
-import { resolve as resolve3, dirname as dirname4, relative, join as join5, sep as sep3 } from "path";
+import { resolve as resolve3, dirname as dirname4, relative, join as join6, sep as sep3 } from "path";
 import fg2 from "fast-glob";
 
 // src/crypto-tools.ts
@@ -2400,8 +2862,11 @@ function buildTools(ctx) {
   const { permissions } = ctx;
   async function runGenerate(opts) {
     const { idea, scope, buildModel, install, keep, themeId, styleId, colorScheme } = opts;
+    const { platform, archetype, styleVibe } = opts;
     const lean = opts.lean ?? true;
-    const preferBoot = opts.preferBoot ?? true;
+    const unhinged = opts.unhinged ?? false;
+    const byokActive = Boolean(process.env.ZETA_BYOK_KEY?.trim());
+    const preferBoot = (opts.preferBoot ?? true) && !unhinged && !byokActive;
     if (permissions.guardMutation() === "deny") {
       return { ok: false, error: permissions.planRefusal() };
     }
@@ -2427,7 +2892,13 @@ function buildTools(ctx) {
       ...styleId ? { styleId } : {},
       ...colorScheme ? { colorScheme } : {},
       // SNIPER: app surfaces only, no marketing campaign. On by default for the CLI.
-      ...lean ? { lean: true } : {}
+      ...lean ? { lean: true } : {},
+      // UNHINGED: skip ALL proofs/gates → fastest bootable app, shipped UNVERIFIED.
+      ...unhinged ? { unhinged: true } : {},
+      // Studio parity pins — mobile shell, interior archetype, look vibe.
+      ...platform === "mobile" ? { platform } : {},
+      ...archetype ? { archetype } : {},
+      ...styleVibe ? { styleVibe } : {}
     };
     const onPhase = (msg) => line(c.dim(`    \u21B3 ${scrubVendor(msg)}`));
     try {
@@ -2470,8 +2941,38 @@ function buildTools(ctx) {
           viaHosted = true;
         }
       }
+      if (viaHosted && result.ok && result.proofPending && result.buildId) {
+        const bid = String(result.buildId);
+        line(c.dim("    \u21B3 shipped fast \u2014 runtime proofs running in the background\u2026"));
+        const final = await pollProofStatus(ctx.zetaApiUrl, bid, {}, {
+          timeoutMs: 6 * 60 * 1e3,
+          onTick: (ms) => line(c.dim(`      proving\u2026 (${Math.round(ms / 1e3)}s)`))
+        });
+        if (final.proofStatus === "proven") {
+          line(c.green(`    \u2713 proven \u2014 ${final.verdict ?? "SHIP"}`));
+          result = { ...result, verdict: final.verdict ?? result.verdict, proofPending: false };
+        } else if (final.proofStatus === "failed") {
+          line(c.red(`    \u2717 proof FAILED after ship \u2014 your app is live but UNPROVEN (${final.verdict ?? "NO_SHIP"}).`));
+          line(c.red(`      Roll it back: zeta rollback ${bid}`));
+          result = { ...result, verdict: "NO_SHIP", proofPending: false };
+        } else {
+          line(c.dim(`      still proving \u2014 check later: zeta proof ${bid}`));
+        }
+      }
+      if (result.ok && result.unverified) {
+        line(
+          c.yellow(
+            "    \u26A0 UNHINGED build \u2014 ALL ShipGate proofs/gates were skipped. It boots, but auth / tenant isolation / data rules are UNVERIFIED. Verify before any real use."
+          )
+        );
+      }
+      if (viaHosted && result.ok && result.buildId) {
+        const passportUrl = `${ctx.zetaApiUrl.replace(/\/$/, "")}/proof/build/${encodeURIComponent(String(result.buildId))}`;
+        line(c.dim(`    \u21B3 build passport: ${passportUrl}`));
+        result = { ...result, passportUrl };
+      }
       if (keep !== false && viaHosted && result.ok && result.buildId && !result.paywalled) {
-        const dest = opts.destDir ? join5(ctx.cwd, opts.destDir) : join5(ctx.cwd, `zeta-${String(result.buildId).slice(-8)}`);
+        const dest = opts.destDir ? join6(ctx.cwd, opts.destDir) : join6(ctx.cwd, `zeta-${String(result.buildId).slice(-8)}`);
         line(c.dim("    \u21B3 saving your code\u2026"));
         const delivered = await deliverBuild(
           ctx.zetaApiUrl,
@@ -2557,9 +3058,65 @@ function buildTools(ctx) {
         ),
         lean: z6.boolean().default(true).describe(
           "SNIPER mode (default true). Build ONLY the product surfaces \u2014 landing \xB7 login \xB7 app \xB7 dashboard \u2014 and SKIP the build-time go-to-market campaign (Launch Kit: pricing/social/email/pitch/checklist, and Brand Studio: DNA + visual campaigns). Faster and focused on the app. Set false ONLY when the user explicitly asks for the full marketing/launch kit."
+        ),
+        unhinged: z6.boolean().default(false).describe(
+          "UNHINGED mode \u2014 build as fast as possible: SKIP ALL ShipGate proofs and gates (RLS/RBAC/authz/client-contract/truth-gate + the ~30 runtime proofs). Keeps the compile check so the app still boots, but ships UNVERIFIED \u2014 no security proofs run. Set true ONLY when the user explicitly asks for a fast / raw / unhinged / no-checks build. Default false (the normal proven-before-ship path)."
+        ),
+        platform: z6.enum(["web", "mobile"]).optional().describe(
+          '"mobile" adds a Capacitor store-shippable iOS/Android shell after the web app is emitted. Use ONLY when the user asks for a mobile/phone app. OMIT for normal web apps.'
+        ),
+        archetype: z6.enum([
+          "analytics",
+          "document-editor",
+          "collaboration",
+          "kanban",
+          "calendar",
+          "marketplace",
+          "studio"
+        ]).optional().describe(
+          "Pin the app's interior layout archetype. 'studio' = the two-plane generator/maker product class. OMIT to let the engine detect it from the idea (the default)."
+        ),
+        styleVibe: z6.enum([
+          "cinematic-dark",
+          "editorial-luxe",
+          "warm-minimal",
+          "bold-brutalist",
+          "glass-futuristic",
+          "vibrant-playful",
+          "corporate-clean"
+        ]).optional().describe(
+          "Restrict the look to one vibe bucket when the user names a mood but not an exact style. A styleId pin still wins. OMIT for full-auto."
         )
       }),
-      execute: async ({ idea, scope, buildModel, install, keep, themeId, styleId, colorScheme, lean }) => runGenerate({ idea, scope, buildModel, install, keep, themeId, styleId, colorScheme, lean })
+      execute: async ({
+        idea,
+        scope,
+        buildModel,
+        install,
+        keep,
+        themeId,
+        styleId,
+        colorScheme,
+        lean,
+        unhinged,
+        platform,
+        archetype,
+        styleVibe
+      }) => runGenerate({
+        idea,
+        scope,
+        buildModel,
+        install,
+        keep,
+        themeId,
+        styleId,
+        colorScheme,
+        lean,
+        unhinged,
+        platform,
+        archetype,
+        styleVibe
+      })
     }),
     deploy_app: tool6({
       description: "Deploy a BUILT app to a live preview URL (the studio's one-click Deploy \u2192 Vercel). Use AFTER generate_app has produced a build. Charges one build credit, paid once per build (re-deploying the same build is free); provisions a database + applies the schema when the app needs one. Polls until the deployment is live and returns its URL. This is an ephemeral PREVIEW \u2014 use promote_app to ship a durable production deployment.",
@@ -2647,6 +3204,79 @@ function buildTools(ctx) {
         };
       }
     }),
+    launch_volition: tool6({
+      description: "Hand a business to OPERATION VOLITION \u2014 the autonomous operate-plane crew (strategy, social, outreach, support, ads, finance agents) that RUNS the business 24/7 on the platform. Use when the user wants the business operated/marketed for them, not just built. Pass a project id or name for an existing business, or a new business name to create one; omit target to use the project linked in this directory. Starts in SANDBOX (external actions simulated, every action proof-gated + certificate-hashed); live:true goes real. The $99/mo add-on is enforced server-side \u2014 a 402 returns the checkout path, never fake an activation.",
+      inputSchema: z6.object({
+        target: z6.string().max(200).optional().describe(
+          "Project id, existing project name, or a NEW business name to create. Omit to use the linked project."
+        ),
+        live: z6.boolean().optional().describe(
+          "true = real external actions (posts, emails). Default false = sandbox simulation. Only set true when the user explicitly asks to go live."
+        ),
+        description: z6.string().max(500).optional().describe("One-line description of the business (used when creating a new project).")
+      }),
+      execute: async ({ target, live, description }) => {
+        if (permissions.guardMutation() === "deny")
+          return { ok: false, error: permissions.planRefusal() };
+        if (!process.env.ZETA_API_KEY?.trim()) {
+          return {
+            ok: false,
+            error: "Login required \u2014 run `wholestack login` (Volition runs on your account)."
+          };
+        }
+        const result = await launchVolition({
+          target,
+          live,
+          description,
+          cwd: ctx.cwd,
+          onStep: (s) => toolLine("launch_volition", c.dim(s))
+        });
+        if (!result.ok) {
+          return {
+            ok: false,
+            error: result.error,
+            status: result.status,
+            // 402 carries the checkout path; 503 carries readiness — surface them
+            // so the agent can tell the user exactly what to do next.
+            ...result.activation
+          };
+        }
+        return {
+          ok: true,
+          projectId: result.projectId,
+          consoleUrl: result.consoleUrl,
+          ...result.activation
+        };
+      }
+    }),
+    volition_status: tool6({
+      description: "Read the Volition crew's state for a project: operator on/off, sandbox vs live, action counts by status, recent shift summaries. Use to answer 'what has the crew done?' or before launching (to avoid double-activation). Pass a project id or name; omit to use the linked project.",
+      inputSchema: z6.object({
+        target: z6.string().max(200).optional().describe("Project id or name. Omit to use the project linked in this directory.")
+      }),
+      execute: async ({ target }) => {
+        if (!process.env.ZETA_API_KEY?.trim()) {
+          return { ok: false, error: "Login required \u2014 run `wholestack login` first." };
+        }
+        let id = target?.trim();
+        if (id) {
+          const found = await resolveVolitionProject(id);
+          if (!found.ok) return { ok: false, error: found.error };
+          id = found.project.id;
+        } else {
+          id = readProjectLink(ctx.cwd)?.projectId;
+        }
+        if (!id) {
+          return {
+            ok: false,
+            error: "No project \u2014 pass a target or run inside a linked project directory."
+          };
+        }
+        const r = await volitionStatus(id);
+        if (!r.ok) return { ok: false, error: r.error, status: r.status };
+        return { ok: true, projectId: id, ...r.data };
+      }
+    }),
     promote_app: tool6({
       description: "Promote a BUILT app to a DURABLE PRODUCTION deployment \u2014 a real (non-ephemeral) database and production env with dev-auth OFF, optionally bound to a custom domain. This is the 'make it a real product' step (stronger than deploy_app's ephemeral preview). Requires the platform to have a database provider configured. Charges/credits follow the same rules as deploy.",
       inputSchema: z6.object({
@@ -3077,7 +3707,7 @@ function buildTools(ctx) {
           const themeId = themes[i % themes.length];
           line(c.bold(`
   [${i + 1}/${picks.length}] ${p.name}  \xB7  ${themeId}`));
-          const destDir = join5("zeta-batch", `${String(i + 1).padStart(2, "0")}-${slugify(p.name)}`);
+          const destDir = join6("zeta-batch", `${String(i + 1).padStart(2, "0")}-${slugify(p.name)}`);
           let r;
           try {
             r = await runGenerate({
@@ -3357,7 +3987,7 @@ function buildTools(ctx) {
           const names = await readdir(abs);
           const entries = await Promise.all(
             names.map(async (n) => {
-              const s = await stat(join5(abs, n)).catch(() => null);
+              const s = await stat(join6(abs, n)).catch(() => null);
               return { name: n, dir: s?.isDirectory() ?? false };
             })
           );
@@ -3548,102 +4178,26 @@ function buildTools(ctx) {
   };
 }
 
-// src/config.ts
-import { readFileSync as readFileSync4, writeFileSync as writeFileSync4, mkdirSync as mkdirSync3, existsSync as existsSync5, chmodSync, renameSync } from "fs";
-import { homedir } from "os";
-import { join as join6 } from "path";
-var LEGACY_DIR = join6(homedir(), ".zeta-g");
-var STATE_DIR = join6(homedir(), ".wholestack");
-try {
-  if (existsSync5(LEGACY_DIR) && !existsSync5(STATE_DIR)) renameSync(LEGACY_DIR, STATE_DIR);
-} catch {
-}
-function stateDir() {
-  return STATE_DIR;
-}
-function webBaseUrl() {
-  return process.env.ZETA_WEB_URL?.trim() || process.env.ZETA_API_URL?.trim() || "https://wholestack.ai";
-}
-function projectDirs(cwd) {
-  return [join6(cwd, ".wholestack"), join6(cwd, ".zeta-g")];
-}
-var CONFIG_DIR = STATE_DIR;
-var CONFIG_PATH = join6(CONFIG_DIR, "config.json");
-function parseDotenv(text) {
-  const out = {};
-  for (const raw of text.split("\n")) {
-    const l = raw.trim();
-    if (!l || l.startsWith("#")) continue;
-    const eq = l.indexOf("=");
-    if (eq < 0) continue;
-    const k = l.slice(0, eq).trim();
-    let v = l.slice(eq + 1).trim();
-    if (v.startsWith('"') && v.endsWith('"') || v.startsWith("'") && v.endsWith("'")) {
-      v = v.slice(1, -1);
-    }
-    if (k) out[k] = v;
-  }
-  return out;
-}
-function fill(src) {
-  for (const [k, v] of Object.entries(src)) {
-    if (v && process.env[k] === void 0) process.env[k] = v;
-  }
-}
-function loadStoredEnv() {
-  const localEnv = join6(process.cwd(), ".env");
-  if (existsSync5(localEnv)) {
-    try {
-      fill(parseDotenv(readFileSync4(localEnv, "utf8")));
-    } catch {
-    }
-  }
-  if (existsSync5(CONFIG_PATH)) {
-    try {
-      const json = JSON.parse(readFileSync4(CONFIG_PATH, "utf8"));
-      const flat = {};
-      for (const [k, v] of Object.entries(json)) if (typeof v === "string") flat[k] = v;
-      fill(flat);
-    } catch {
-    }
-  }
-}
-function saveKey(name, value) {
-  mkdirSync3(CONFIG_DIR, { recursive: true });
-  let current = {};
-  if (existsSync5(CONFIG_PATH)) {
-    try {
-      current = JSON.parse(readFileSync4(CONFIG_PATH, "utf8"));
-    } catch {
-      current = {};
-    }
-  }
-  current[name] = value;
-  writeFileSync4(CONFIG_PATH, JSON.stringify(current, null, 2) + "\n", { mode: 384 });
-  chmodSync(CONFIG_PATH, 384);
-  return CONFIG_PATH;
-}
-
 // src/hooks.ts
 import { spawn as spawn6 } from "child_process";
 import { readFileSync as readFileSync5, existsSync as existsSync6 } from "fs";
 import { join as join7 } from "path";
 var HOOK_TIMEOUT_MS = 15e3;
-function runOne(def, event, payload, cwd) {
+function runOne(def, event, payload, cwd2) {
   return new Promise((res) => {
-    const child = spawn6("sh", ["-c", def.command], { cwd });
-    let stdout2 = "";
+    const child = spawn6("sh", ["-c", def.command], { cwd: cwd2 });
+    let stdout3 = "";
     let stderr = "";
     const timer = setTimeout(() => child.kill("SIGKILL"), HOOK_TIMEOUT_MS);
-    child.stdout.on("data", (b) => stdout2 += b.toString());
+    child.stdout.on("data", (b) => stdout3 += b.toString());
     child.stderr.on("data", (b) => stderr += b.toString());
     child.on("error", (e) => {
       clearTimeout(timer);
-      res({ code: 1, stdout: stdout2, stderr: stderr + e.message });
+      res({ code: 1, stdout: stdout3, stderr: stderr + e.message });
     });
     child.on("close", (code) => {
       clearTimeout(timer);
-      res({ code: code ?? 0, stdout: stdout2, stderr });
+      res({ code: code ?? 0, stdout: stdout3, stderr });
     });
     try {
       child.stdin.write(JSON.stringify({ event, ...payload }));
@@ -3653,9 +4207,9 @@ function runOne(def, event, payload, cwd) {
   });
 }
 var HookRunner = class {
-  constructor(hooks, cwd) {
+  constructor(hooks, cwd2) {
     this.hooks = hooks;
-    this.cwd = cwd;
+    this.cwd = cwd2;
   }
   hooks;
   cwd;
@@ -3672,22 +4226,22 @@ var HookRunner = class {
     for (const def of defs) {
       if (def.matcher && payload.toolName && !new RegExp(def.matcher).test(payload.toolName))
         continue;
-      const { code, stdout: stdout2, stderr } = await runOne(def, event, payload, this.cwd);
-      const parsed = tryJson(stdout2);
+      const { code, stdout: stdout3, stderr } = await runOne(def, event, payload, this.cwd);
+      const parsed = tryJson(stdout3);
       if (parsed && (parsed.decision === "block" || parsed.block)) {
         outcome.block = String(parsed.reason ?? parsed.message ?? "blocked by hook");
         return outcome;
       }
       if (canBlock && code !== 0) {
         const reason = parsed ? String(parsed.reason ?? parsed.message ?? "") : "";
-        outcome.block = (stderr || reason || stdout2 || `hook exited ${code}`).trim();
+        outcome.block = (stderr || reason || stdout3 || `hook exited ${code}`).trim();
         return outcome;
       }
       if (parsed) {
         const extra = parsed.additionalContext ?? parsed.hookSpecificOutput?.additionalContext;
         if (extra) outcome.context.push(String(extra));
       } else {
-        const text = stdout2.trim();
+        const text = stdout3.trim();
         if (text) outcome.context.push(text);
       }
     }
@@ -3713,10 +4267,10 @@ function mergeHookSets(...sets) {
   }
   return out;
 }
-function loadHookFiles(cwd) {
+function loadHookFiles(cwd2) {
   const files = [
     join7(stateDir(), "hooks.json"),
-    ...projectDirs(cwd).map((d) => join7(d, "hooks.json"))
+    ...projectDirs(cwd2).map((d) => join7(d, "hooks.json"))
   ];
   const sets = [];
   for (const f of files) {
@@ -3878,7 +4432,9 @@ var MODEL_IDS = {
   /** BRAIN lane — frontend swarm, decisions, debugging, editing, planning. Cerebras. The 20%. */
   glm: readEnv("ZETA_GLM_MODEL") || "zai-glm-4.7",
   /** VISION lane — accepts image input. OpenRouter (Cerebras text lanes can't see). */
-  vision: readEnv("ZETA_VISION_MODEL") || "anthropic/claude-sonnet-4.6"
+  vision: readEnv("ZETA_VISION_MODEL") || "anthropic/claude-sonnet-4.6",
+  /** SONNET lane — Claude Sonnet 5 via OpenRouter. Premium reasoning + design brain (CLI + studio design pass). */
+  sonnet: readEnv("ZETA_SONNET_MODEL") || "anthropic/claude-sonnet-5"
 };
 var ZETA_AGENT_PIPELINE = Object.freeze({
   /** THINK lane — ISL spec authoring BASE. gpt-oss-120b ($0.35/$0.75 per 1M) so a build
@@ -3903,6 +4459,7 @@ var CEREBRAS_KEY = PROVIDERS.cerebras.keyEnv;
 var KEY_ENV = PROVIDERS.openrouter.keyEnv;
 var DEFAULT_CUSTOM_MODEL = MODEL_IDS.vision;
 var VISION_MODEL = MODEL_IDS.vision;
+var SONNET_MODEL = MODEL_IDS.sonnet;
 var MODELS = /* @__PURE__ */ new Map([
   [
     "zeta-g1-lite",
@@ -3949,6 +4506,19 @@ var MODELS = /* @__PURE__ */ new Map([
       contextWindow: 2e5,
       thinking: null
     }
+  ],
+  // The Sonnet tier — Claude Sonnet 5 via OpenRouter: the premium reasoning + design
+  // brain, and vision-capable. BYOK OpenRouter like the vision tier (set OPENROUTER_API_KEY).
+  [
+    "zeta-g1-sonnet",
+    {
+      modelId: SONNET_MODEL,
+      label: "Zeta-G1.0 Sonnet",
+      keyEnv: KEY_ENV,
+      baseURL: OPENROUTER_URL,
+      contextWindow: 2e5,
+      thinking: null
+    }
   ]
 ]);
 var MODEL_KEYS = [...MODELS.keys()];
@@ -3990,9 +4560,9 @@ function resolveModelKey(raw) {
     image: "zeta-g1-vision",
     // legacy convenience — resolve silently, but only the Zeta label is shown
     opus: "zeta-g1-max",
-    sonnet: "zeta-g1",
+    sonnet: "zeta-g1-sonnet",
     haiku: "zeta-g1-lite",
-    claude: "zeta-g1"
+    claude: "zeta-g1-sonnet"
   };
   if (ALIASES[lower]) return ALIASES[lower];
   throw new Error(`Unknown model "${raw}". Try: ${MODEL_KEYS.join(", ")}.`);
@@ -4010,7 +4580,7 @@ function modelId(key) {
   return spec(key).modelId;
 }
 function visionCapable(key) {
-  return key === "zeta-g1-vision" || key.startsWith("custom:");
+  return key === "zeta-g1-vision" || key === "zeta-g1-sonnet" || key.startsWith("custom:");
 }
 function modelContextWindow(key) {
   return spec(key).contextWindow;
@@ -5047,11 +5617,11 @@ function readScripts(dir) {
     return {};
   }
 }
-function runScript(pm, script, cwd, timeoutMs) {
+function runScript(pm, script, cwd2, timeoutMs) {
   const shell = process.env.SHELL || "/bin/bash";
   const line2 = `${pm} run ${script}`;
   return new Promise((res) => {
-    const child = spawn7(shell, ["-lc", line2], { cwd, shell: false });
+    const child = spawn7(shell, ["-lc", line2], { cwd: cwd2, shell: false });
     let out = "";
     const timer = setTimeout(() => child.kill("SIGKILL"), timeoutMs);
     const sink = (b) => {
@@ -6745,13 +7315,13 @@ async function readBounded(path, limit) {
     return null;
   }
 }
-async function loadProjectMemory(cwd) {
+async function loadProjectMemory(cwd2) {
   const candidates = [];
   const globalFile = join9(stateDir(), "ZETA.md");
   if (existsSync9(globalFile)) candidates.push(globalFile);
-  const root = repoRootFrom(cwd);
+  const root = repoRootFrom(cwd2);
   const chain = [];
-  let dir = cwd;
+  let dir = cwd2;
   for (let i = 0; i < 24; i++) {
     chain.unshift(dir);
     if (dir === root) break;
@@ -6943,10 +7513,10 @@ var Session = class _Session {
   meta;
   path;
   /** Start a fresh session and write its meta header. */
-  static create(cwd, model) {
+  static create(cwd2, model) {
     ensureDir();
     const id = `${Date.now().toString(36)}-${randomUUID().slice(0, 8)}`;
-    const meta = { id, cwd, model, startedAt: (/* @__PURE__ */ new Date()).toISOString() };
+    const meta = { id, cwd: cwd2, model, startedAt: (/* @__PURE__ */ new Date()).toISOString() };
     const path = fileFor(id);
     appendFileSync(path, JSON.stringify({ kind: "meta", ...meta }) + "\n", "utf8");
     return new _Session(meta, path);
@@ -6973,12 +7543,12 @@ var Session = class _Session {
     return { session: new _Session(meta, path), messages };
   }
   /** The most recent session (optionally scoped to a working directory). */
-  static latestId(cwd) {
-    const all = _Session.list(1, cwd);
+  static latestId(cwd2) {
+    const all = _Session.list(1, cwd2);
     return all.length ? all[0].id : null;
   }
   /** List sessions newest-first, with a preview of the first user message. */
-  static list(limit = 30, cwd) {
+  static list(limit = 30, cwd2) {
     if (!existsSync10(SESSIONS_DIR)) return [];
     const out = [];
     for (const name of readdirSync2(SESSIONS_DIR)) {
@@ -7004,7 +7574,7 @@ var Session = class _Session {
         continue;
       }
       if (!meta) continue;
-      if (cwd && meta.cwd !== cwd) continue;
+      if (cwd2 && meta.cwd !== cwd2) continue;
       const updatedAt = statSync2(path).mtimeMs;
       out.push({ ...meta, preview: preview.slice(0, 70), turns, updatedAt });
     }
@@ -7035,9 +7605,9 @@ async function loadChromium() {
     return null;
   }
 }
-function insideCwd(cwd, p) {
-  const abs = resolve5(cwd, p);
-  const rel = relative3(cwd, abs);
+function insideCwd(cwd2, p) {
+  const abs = resolve5(cwd2, p);
+  const rel = relative3(cwd2, abs);
   if (rel === ".." || rel.startsWith(".." + sep4)) {
     throw new Error(`path "${p}" escapes the workspace root`);
   }
@@ -7788,7 +8358,7 @@ function shippedSkillsDir() {
   for (const dir of candidates) if (existsSync12(dir)) return dir;
   return "";
 }
-function loadAllSkills(cwd) {
+function loadAllSkills(cwd2) {
   const byName = /* @__PURE__ */ new Map();
   const add = (skills) => {
     for (const s of skills) byName.set(s.name, s);
@@ -7796,7 +8366,7 @@ function loadAllSkills(cwd) {
   const shipped = shippedSkillsDir();
   if (shipped) add(loadSkillsFromDir(shipped, "shipped"));
   add(loadSkillsFromDir(join13(stateDir(), "skills"), "user"));
-  for (const d of projectDirs(cwd)) add(loadSkillsFromDir(join13(d, "skills"), "project"));
+  for (const d of projectDirs(cwd2)) add(loadSkillsFromDir(join13(d, "skills"), "project"));
   return [...byName.values()].sort((a, b) => a.name.localeCompare(b.name));
 }
 var SkillRegistry = class _SkillRegistry {
@@ -7806,8 +8376,8 @@ var SkillRegistry = class _SkillRegistry {
     this.skills = skills;
     this.index = new Map(skills.map((s) => [s.name, s]));
   }
-  static load(cwd) {
-    return new _SkillRegistry(loadAllSkills(cwd));
+  static load(cwd2) {
+    return new _SkillRegistry(loadAllSkills(cwd2));
   }
   list() {
     return this.skills;
@@ -7893,23 +8463,23 @@ import { join as join14 } from "path";
 
 // src/git.ts
 import { execFileSync } from "child_process";
-function git(args, cwd) {
+function git(args, cwd2) {
   return execFileSync("git", args, {
-    cwd,
+    cwd: cwd2,
     encoding: "utf8",
     maxBuffer: 32 * 1024 * 1024,
     stdio: ["ignore", "pipe", "pipe"]
   }).trim();
 }
-function gitSafe(args, cwd) {
+function gitSafe(args, cwd2) {
   try {
-    return git(args, cwd);
+    return git(args, cwd2);
   } catch {
     return null;
   }
 }
-function isRepo(cwd) {
-  return gitSafe(["rev-parse", "--is-inside-work-tree"], cwd) === "true";
+function isRepo(cwd2) {
+  return gitSafe(["rev-parse", "--is-inside-work-tree"], cwd2) === "true";
 }
 var SECRET_HINTS = [
   { re: /\bAKIA[0-9A-Z]{16}\b/, label: "AWS access key id" },
@@ -8072,7 +8642,7 @@ var eyesCommands = [
 ];
 
 // src/ops-commands.ts
-function apiBase() {
+function apiBase2() {
   return (process.env.ZETA_WEB_URL?.trim() || process.env.ZETA_API_URL?.trim() || "https://wholestack.ai").replace(/\/$/, "");
 }
 async function probe2(url, timeoutMs) {
@@ -8144,7 +8714,7 @@ var opsCommands = [
         return { type: "handled" };
       }
       const r = await apiJson(
-        `${apiBase()}/api/zeta/build/${encodeURIComponent(buildId)}/deploy?deploymentId=${encodeURIComponent(deploymentId)}`
+        `${apiBase2()}/api/zeta/build/${encodeURIComponent(buildId)}/deploy?deploymentId=${encodeURIComponent(deploymentId)}`
       );
       ctx.print();
       if (!r.ok) {
@@ -8163,7 +8733,7 @@ var opsCommands = [
     summary: "read live traffic + revenue (PostHog/Stripe)",
     source: "builtin",
     run: async (ctx) => {
-      const r = await readMetrics(apiBase());
+      const r = await readMetrics(apiBase2());
       ctx.print();
       if (!r.ok || !r.metrics) {
         ctx.print("  " + c.red(`\u2717 ${r.error ?? "no metrics"}`));
@@ -8196,7 +8766,7 @@ var opsCommands = [
     summary: "read recent production errors (Sentry/PostHog)",
     source: "builtin",
     run: async (ctx) => {
-      const r = await readMetrics(apiBase());
+      const r = await readMetrics(apiBase2());
       ctx.print();
       if (!r.ok || !r.metrics) {
         ctx.print("  " + c.red(`\u2717 ${r.error ?? "no metrics"}`));
@@ -8467,7 +9037,7 @@ var BUILTINS = [
   },
   {
     name: "build",
-    summary: "scaffold a full-stack app \u2014 sniper by default: landing \xB7 login \xB7 app \xB7 dashboard, no marketing campaign (/build <idea> [--style <id>] [--color dark|light] [--campaign] [--deploy])",
+    summary: "scaffold a full-stack app \u2014 sniper by default: landing \xB7 login \xB7 app \xB7 dashboard, no marketing campaign (/build <idea> [--style <id>] [--color dark|light] [--campaign] [--deploy] [--unhinged] [--key <k> --provider <p>])",
     source: "builtin",
     run: (ctx) => {
       if (!ctx.args) {
@@ -8505,6 +9075,29 @@ var BUILTINS = [
         campaign = true;
         rest = rest.replace(/(^|\s)--(campaign|full-kit)(\s|$)/, " ");
       }
+      let unhinged = false;
+      if (/(^|\s)--unhinged(\s|$)/.test(rest)) {
+        unhinged = true;
+        rest = rest.replace(/(^|\s)--unhinged(\s|$)/, " ");
+      }
+      const provM = rest.match(/--provider[=\s]+(openrouter|cerebras|anthropic|openai|google)/i);
+      if (provM) {
+        process.env.ZETA_BYOK_PROVIDER = provM[1].toLowerCase();
+        rest = rest.replace(provM[0], " ");
+      }
+      const keyM = rest.match(/--key[=\s]+(\S+)/i);
+      if (keyM) {
+        process.env.ZETA_BYOK_KEY = keyM[1];
+        if (!process.env.ZETA_BYOK_PROVIDER) process.env.ZETA_BYOK_PROVIDER = "openrouter";
+        rest = rest.replace(keyM[0], " ");
+        const k = keyM[1];
+        const masked = k.length > 8 ? `${k.slice(0, 4)}\u2026${k.slice(-2)}` : "\u2026";
+        ctx.print(
+          "  " + c.dim(
+            `BYOK key set for this session (provider: ${process.env.ZETA_BYOK_PROVIDER}, key: ${masked}). It is never logged or sent to the model.`
+          )
+        );
+      }
       const idea = rest.trim();
       if (!idea) {
         ctx.print(
@@ -8516,6 +9109,8 @@ var BUILTINS = [
         'scope: "full"',
         // Sniper by default (lean:true) — skip the marketing campaign. --campaign opts in.
         `lean: ${campaign ? "false" : "true"}`,
+        // UNHINGED (--unhinged): skip ALL proofs/gates → fastest bootable app, UNVERIFIED ship.
+        unhinged ? "unhinged: true" : null,
         styleId ? `styleId: "${styleId}"` : null,
         colorScheme ? `colorScheme: "${colorScheme}"` : null
       ].filter(Boolean).join(", ");
@@ -9047,6 +9642,7 @@ var BUILTINS = [
   ...gitCommands,
   ...eyesCommands,
   ...opsCommands,
+  ...volitionCommands,
   ...learnedCommands,
   ...autoRouteCommands,
   ...skillsCommands,
@@ -9149,8 +9745,8 @@ var CommandRegistry = class {
     return this.ordered.flatMap((c2) => [c2.name, ...c2.aliases ?? []]);
   }
   /** Load *.md commands from ~/.wholestack/commands and <cwd>/.wholestack/commands (or legacy .zeta-g/). */
-  loadCustom(cwd) {
-    const dirs = [join14(stateDir(), "commands"), ...projectDirs(cwd).map((d) => join14(d, "commands"))];
+  loadCustom(cwd2) {
+    const dirs = [join14(stateDir(), "commands"), ...projectDirs(cwd2).map((d) => join14(d, "commands"))];
     for (const dir of dirs) {
       for (const cmd of loadMdCommands(dir, "custom")) this.register(cmd);
     }
@@ -9172,8 +9768,8 @@ var CommandRegistry = class {
 // src/plugins.ts
 import { readFileSync as readFileSync12, existsSync as existsSync14, readdirSync as readdirSync6, statSync as statSync4 } from "fs";
 import { join as join15 } from "path";
-function pluginRoots(cwd) {
-  return [join15(stateDir(), "plugins"), ...projectDirs(cwd).map((d) => join15(d, "plugins"))];
+function pluginRoots(cwd2) {
+  return [join15(stateDir(), "plugins"), ...projectDirs(cwd2).map((d) => join15(d, "plugins"))];
 }
 function resolveSystemPrompt(dir, value) {
   const asFile = join15(dir, value);
@@ -9186,7 +9782,7 @@ function resolveSystemPrompt(dir, value) {
   }
   return value.trim();
 }
-function loadPlugins(cwd) {
+function loadPlugins(cwd2) {
   const result = {
     plugins: [],
     systemText: "",
@@ -9197,7 +9793,7 @@ function loadPlugins(cwd) {
   };
   const systemBlocks = [];
   const hookSets = [];
-  for (const root of pluginRoots(cwd)) {
+  for (const root of pluginRoots(cwd2)) {
     if (!existsSync14(root)) continue;
     for (const entry of readdirSync6(root)) {
       const dir = join15(root, entry);
@@ -9265,11 +9861,11 @@ function readConfigFile(path) {
     return {};
   }
 }
-function discoverConfigs(cwd) {
+function discoverConfigs(cwd2) {
   const merged = {};
   const global = join16(stateDir(), "mcp.json");
   if (existsSync15(global)) Object.assign(merged, readConfigFile(global));
-  let dir = cwd;
+  let dir = cwd2;
   for (let i = 0; i < 24; i++) {
     const p = join16(dir, ".mcp.json");
     if (existsSync15(p)) {
@@ -9537,7 +10133,7 @@ function buildWebTools() {
 // src/input.ts
 import { createInterface as createInterface2 } from "readline/promises";
 import { emitKeypressEvents } from "readline";
-import { stdin, stdout } from "process";
+import { stdin, stdout as stdout2 } from "process";
 import { readFileSync as readFileSync14, appendFileSync as appendFileSync2, mkdirSync as mkdirSync6, existsSync as existsSync16, readdirSync as readdirSync7 } from "fs";
 import { join as join17, dirname as dirname10, basename as basename2 } from "path";
 var HISTORY_FILE = join17(stateDir(), "history");
@@ -9554,7 +10150,7 @@ var InputController = class {
     this.opts = opts;
     this.rl = createInterface2({
       input: stdin,
-      output: stdout,
+      output: stdout2,
       terminal: stdin.isTTY ?? false,
       historySize: HISTORY_MAX,
       completer: (line2) => this.complete(line2)
@@ -9685,7 +10281,7 @@ var InputController = class {
       });
       out += "\r  " + c.dim("\u2570" + "\u2500".repeat(W) + "\u256F");
       out += up(contentRows - caret.r) + "\r" + right(4 + caret.c);
-      stdout.write(out);
+      stdout2.write(out);
       prevRows = contentRows;
       prevCaretR = caret.r;
     };
@@ -9697,7 +10293,7 @@ var InputController = class {
       this.rl.pause();
       if (stdin.isTTY) stdin.setRawMode(true);
       stdin.resume();
-      stdout.write("\x1B[?2004h");
+      stdout2.write("\x1B[?2004h");
       const onResize = () => {
         F = Math.max(8, boxInnerWidth() - 2);
         W = F + 2;
@@ -9708,10 +10304,10 @@ var InputController = class {
       const finish = (val) => {
         stdin.off("keypress", onKey);
         process.stdout.off("resize", onResize);
-        stdout.write("\x1B[?2004l");
+        stdout2.write("\x1B[?2004l");
         if (stdin.isTTY) stdin.setRawMode(false);
         const down = prevRows - prevCaretR;
-        stdout.write("\x1B[" + Math.max(1, down) + "B\r\n");
+        stdout2.write("\x1B[" + Math.max(1, down) + "B\r\n");
         this.rl.resume();
         if (watching) this.startWatch(watching);
         resolve6(val);
@@ -9723,7 +10319,7 @@ var InputController = class {
       const onKey = (s, key) => {
         const name = key?.name;
         if (key?.ctrl && name === "c") {
-          stdout.write("\n");
+          stdout2.write("\n");
           this.opts.onExit();
           return;
         }
@@ -9839,7 +10435,7 @@ var InputController = class {
         }
       };
       const bar = this.opts.contextBar?.();
-      if (bar) stdout.write("  " + bar + "\n");
+      if (bar) stdout2.write("  " + bar + "\n");
       stdin.on("keypress", onKey);
       render();
     });
@@ -9946,6 +10542,14 @@ export {
   writeProjectLink,
   writeWorkingTree,
   collectLocalFiles,
+  httpBuild,
+  demoBootBuild,
+  deliverBuild,
+  stateDir,
+  webBaseUrl,
+  loadStoredEnv,
+  saveKey,
+  runVolitionSubcommand,
   deployBuild,
   promoteBuild,
   rollbackDeployment,
@@ -9959,6 +10563,8 @@ export {
   PROPERTY_KINDS,
   runProver,
   killRunningApps,
+  isolateFromWorkspace,
+  installDeps,
   fetchGithubInstallations,
   fetchGithubRepos,
   runRepoAuditStream,
@@ -9966,10 +10572,6 @@ export {
   readSourceFile,
   tasks,
   buildTools,
-  stateDir,
-  webBaseUrl,
-  loadStoredEnv,
-  saveKey,
   HookRunner,
   mergeHookSets,
   loadHookFiles,