@wenrwa/marketplace-cli 0.5.24 → 0.6.2

package/dist/bridge/apiClient.d.ts

@@ -30,19 +30,44 @@ export interface PairingCodeResponse {
     pollToken: string;
     expiresAt: string;
 }
+/**
+ * wha-08: `purpose` is optional and omitted by every bridge caller (pair.ts
+ * never passes it), so the request body stays byte-for-byte
+ * `{ deviceLabel }` for the bridge — JSON.stringify drops an undefined-
+ * valued key. Only `auth/login.ts` (cli_login) passes it explicitly.
+ */
 export declare function requestPairingCode(opts: {
     apiUrl: string;
     deviceLabel: string;
+    purpose?: 'bridge' | 'cli_login';
     fetchImpl?: FetchImpl;
 }): Promise<PairingCodeResponse>;
+/**
+ * wha-08: widened (additively) to cover the cli_login purpose — a 'denied'
+ * status (the human declined in the browser — bridge pairing's poll loop
+ * never reaches this branch, see auth/login.ts's header comment) and an
+ * 'approved' response that carries a fresh API key instead of a connect
+ * token + device id. `purpose` is optional/untyped-through on the bridge
+ * variant since the real server has always sent it, but the bridge's own
+ * tests stub responses without it — this stays backward compatible.
+ */
 export type PairingPollResponse = {
     success: true;
     status: 'pending';
 } | {
     success: true;
     status: 'approved';
+    purpose?: 'bridge';
     connectToken: string;
     deviceId: string;
+} | {
+    success: true;
+    status: 'approved';
+    purpose: 'cli_login';
+    apiKey: string;
+} | {
+    success: true;
+    status: 'denied';
 } | {
     success: true;
     status: 'expired';

package/dist/bridge/apiClient.js

@@ -69,8 +69,14 @@ async function pairingRequest(apiUrl, path, body, fetchImpl) {
     }
     return json;
 }
+/**
+ * wha-08: `purpose` is optional and omitted by every bridge caller (pair.ts
+ * never passes it), so the request body stays byte-for-byte
+ * `{ deviceLabel }` for the bridge — JSON.stringify drops an undefined-
+ * valued key. Only `auth/login.ts` (cli_login) passes it explicitly.
+ */
 function requestPairingCode(opts) {
-    return pairingRequest(opts.apiUrl, '/pairing/codes', { deviceLabel: opts.deviceLabel }, opts.fetchImpl);
+    return pairingRequest(opts.apiUrl, '/pairing/codes', { deviceLabel: opts.deviceLabel, purpose: opts.purpose }, opts.fetchImpl);
 }
 function pollPairingCode(opts) {
     return pairingRequest(opts.apiUrl, '/pairing/poll', { pollToken: opts.pollToken }, opts.fetchImpl);

package/dist/bridge/bundleInstaller.d.ts

@@ -17,6 +17,15 @@ export interface BundleInstallerDeps {
     mkdirp: (dir: string) => void;
     /** Write (overwrite) a file. */
     writeFile: (filePath: string, content: string) => void;
+    /**
+     * The three deps a crew SWAP needs. All optional together: absent (any older
+     * caller, or a half-wired dep set) → nothing is ever pruned and this module
+     * behaves exactly as it did before. Pruning deletes files inside a real
+     * checkout, so "not wired" must mean "do nothing", never "guess".
+     */
+    listDir?: (dir: string) => string[];
+    readFile?: (filePath: string) => string;
+    remove?: (filePath: string) => void;
 }
 export type SkipReason = 'unsafe' | 'unmanaged';
 export interface InstallBundleResult {
@@ -29,6 +38,11 @@ export interface InstallBundleResult {
         path: string;
         reason: SkipReason;
     }>;
+    /**
+     * Crew members removed because this bundle replaced them (relative paths).
+     * Reported so an install is auditable rather than silently destructive.
+     */
+    pruned: string[];
 }
 /**
  * A workspaceId is the sole dir segment under reposBaseDir — it must be a plain

package/dist/bridge/bundleInstaller.js

@@ -65,6 +65,15 @@ exports.installBundle = installBundle;
  *     the crew files.
  */
 const path = __importStar(require("path"));
+/**
+ * The marker every forged crew member carries. Its presence is what
+ * distinguishes a file this installer put there from one the pilot wrote by
+ * hand in the same directory — and the pilot's own subagent must survive a
+ * crew swap. If Forge ever stops emitting it, the failure direction is a
+ * stale file left behind, never a deleted one.
+ */
+const CREW_FILE_MARKER = '## Prompt Defense Baseline';
+const AGENTS_DIR_REL = '.claude/agents';
 /**
  * A workspaceId is the sole dir segment under reposBaseDir — it must be a plain
  * id, never a path fragment. Reject anything that could climb out of / redirect
@@ -87,11 +96,12 @@ function isManaged(normalizedRel) {
 function installBundle(bundle, deps) {
     const written = [];
     const skipped = [];
+    const pruned = [];
     // fcct-27: the id is a path segment ONLY when we join it ourselves. An
     // explicit workspaceRoot never puts it on the path, so there is nothing for
     // it to climb out of — but the guard stays for the joining case.
     if (!deps.workspaceRoot && !isSafeWorkspaceId(bundle.workspaceId)) {
-        return { workspaceRoot: null, written, skipped };
+        return { workspaceRoot: null, written, skipped, pruned };
     }
     const workspaceRoot = deps.workspaceRoot
         ? path.posix.resolve(deps.workspaceRoot)
@@ -128,5 +138,49 @@ function installBundle(bundle, deps) {
         deps.writeFile(target, content);
         written.push(normalized);
     }
-    return { workspaceRoot, written, skipped };
+    /*
+      A crew SWAP must replace its members, not pile a new crew on top of the old
+      one. Before this, installBundle only ever wrote: a live container was found
+      holding eight `.claude/agents/*.md` for a five-member crew (and another
+      checkout ten), so subagents from a crew the pilot had detached stayed
+      callable indefinitely.
+  
+      Every condition below exists to make the failure direction "left a stale
+      file" rather than "deleted something of yours":
+        - only inside `.claude/agents`, so CLAUDE.md and the rest of `.claude/`
+          are untouchable here;
+        - only when this bundle installs at least one agent, so a CLAUDE.md-only
+          or skills-only bundle can never empty the crew;
+        - only files carrying CREW_FILE_MARKER, so a hand-written subagent living
+          in the same directory survives;
+        - only when the caller wired listDir/readFile/remove;
+        - and any error reading the directory abandons pruning entirely — an
+          install that wrote its files must not fail because cleanup could not.
+    */
+    const installedAgents = new Set(written.filter((rel) => rel.startsWith(`${AGENTS_DIR_REL}/`)));
+    if (installedAgents.size > 0 && deps.listDir && deps.readFile && deps.remove) {
+        const agentsDir = path.posix.resolve(workspaceRoot, AGENTS_DIR_REL);
+        try {
+            for (const name of deps.listDir(agentsDir)) {
+                if (!name.endsWith('.md'))
+                    continue;
+                const rel = `${AGENTS_DIR_REL}/${name}`;
+                if (installedAgents.has(rel))
+                    continue;
+                const full = path.posix.resolve(agentsDir, name);
+                // Containment, same discipline as the write path above: a listing that
+                // somehow yields a climbing name must not delete outside the directory.
+                if (!full.startsWith(agentsDir + '/'))
+                    continue;
+                if (!deps.readFile(full).includes(CREW_FILE_MARKER))
+                    continue;
+                deps.remove(full);
+                pruned.push(rel);
+            }
+        }
+        catch {
+            // Cleanup is best-effort by design; the bundle is already installed.
+        }
+    }
+    return { workspaceRoot, written, skipped, pruned };
 }

package/dist/bridge/contextWriter.d.ts

@@ -1,5 +1,7 @@
 export declare const CONTEXT_START_MARKER = "<!-- HIVEOP:CONTEXT:START -->";
 export declare const CONTEXT_END_MARKER = "<!-- HIVEOP:CONTEXT:END -->";
+export declare const POINTERS_START_MARKER = "<!-- HIVEOP:POINTERS:START -->";
+export declare const POINTERS_END_MARKER = "<!-- HIVEOP:POINTERS:END -->";
 export interface ContextWriterDeps {
     /** Root holding every workspace's checkout, e.g. `/data/repos`. */
     reposBaseDir: string;
@@ -27,7 +29,8 @@ export interface ContextWriteResult {
  */
 export declare function writeContext(input: {
     workspaceId: string;
-    content: string;
+    /** Absent only for a pointers-only refresh (wmr-07). */
+    content?: string;
     workGraphAvailable?: boolean;
     /**
      * wmr-01 — whether to carry the workspace-memory guidance. Decided by the
@@ -42,4 +45,11 @@ export declare function writeContext(input: {
      * brief renders the standing instruction alone.
      */
     memoryBrief?: string | null;
+    /**
+     * wmr-07 — refresh ONLY the standing pointers, keeping whatever file
+     * content the region already holds. Used by the bridge when a session
+     * opens, which is the trigger that does not depend on the pilot having
+     * selected files or on a browser being connected at all.
+     */
+    pointersOnly?: boolean;
 }, deps: ContextWriterDeps): ContextWriteResult;

package/dist/bridge/contextWriter.js

@@ -33,7 +33,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CONTEXT_END_MARKER = exports.CONTEXT_START_MARKER = void 0;
+exports.POINTERS_END_MARKER = exports.POINTERS_START_MARKER = exports.CONTEXT_END_MARKER = exports.CONTEXT_START_MARKER = void 0;
 exports.writeContext = writeContext;
 /**
  * pucc-int-01 (ADR-0032 / ADR-0028) — container context writer.
@@ -71,6 +71,37 @@ const workGraphPointer_1 = require("./workGraphPointer");
 const memoryPointer_1 = require("./memoryPointer");
 exports.CONTEXT_START_MARKER = '<!-- HIVEOP:CONTEXT:START -->';
 exports.CONTEXT_END_MARKER = '<!-- HIVEOP:CONTEXT:END -->';
+/*
+  wmr-07 — an inner fence around the standing pointers (work graph, workspace
+  memory), INSIDE the managed region.
+
+  The bridge refreshes those pointers when a session opens, because arena only
+  pushes a context-manifest when the pilot has files selected — so waiting for a
+  push meant the pointers never arrived at all for most workspaces. But the
+  region also holds that pushed file content, and a refresh that rewrote the
+  whole region would eat it. This fence is what lets the two be updated
+  independently: pointers replaced in place, file content left exactly as it is.
+
+  A region written before this fence existed has no markers; it is then treated
+  as file content and the pointer block is inserted above it, which is the
+  correct reading of what it contained.
+*/
+exports.POINTERS_START_MARKER = '<!-- HIVEOP:POINTERS:START -->';
+exports.POINTERS_END_MARKER = '<!-- HIVEOP:POINTERS:END -->';
+/** Split a region body into its pointer block and everything else. */
+function splitRegion(body) {
+    const start = body.indexOf(exports.POINTERS_START_MARKER);
+    const end = body.indexOf(exports.POINTERS_END_MARKER);
+    if (start === -1 || end === -1 || end < start)
+        return { pointers: '', rest: body.trim() };
+    const rest = (body.slice(0, start) + body.slice(end + exports.POINTERS_END_MARKER.length)).trim();
+    return { pointers: body.slice(start, end + exports.POINTERS_END_MARKER.length), rest };
+}
+function pointerBlock(sections) {
+    if (sections.length === 0)
+        return '';
+    return `${exports.POINTERS_START_MARKER}\n${sections.join('\n\n')}\n${exports.POINTERS_END_MARKER}`;
+}
 /** Build the fenced region block for a non-empty body. */
 function regionBlock(content) {
     // Normalize only the region's own trailing newlines so the END marker sits on
@@ -107,15 +138,28 @@ function writeContext(input, deps) {
     // shape once — two independent flags would otherwise need four branches to
     // get the blank lines right, and the empty-content case is the one that
     // decides whether the region survives at all.
-    const hasFileContent = input.content.trim().length > 0;
-    const sections = [];
+    const existingRegion = (() => {
+        if (!existing)
+            return '';
+        const s0 = existing.indexOf(exports.CONTEXT_START_MARKER);
+        const e0 = existing.indexOf(exports.CONTEXT_END_MARKER);
+        if (s0 === -1 || e0 === -1 || e0 < s0)
+            return '';
+        return existing.slice(s0 + exports.CONTEXT_START_MARKER.length, e0).trim();
+    })();
+    const pointers = [];
     if (input.workGraphAvailable)
-        sections.push(workGraphPointer_1.WORK_GRAPH_POINTER);
+        pointers.push(workGraphPointer_1.WORK_GRAPH_POINTER);
     if (input.memoryAvailable)
-        sections.push((0, memoryPointer_1.memorySection)(input.memoryBrief));
-    if (hasFileContent)
-        sections.push(input.content);
-    const content = sections.length > 0 ? sections.join('\n\n') : input.content;
+        pointers.push((0, memoryPointer_1.memorySection)(input.memoryBrief));
+    // wmr-07: a pointers-only refresh keeps the region's existing file content
+    // rather than replacing it with the (absent) `content` argument.
+    const fileContent = input.pointersOnly
+        ? splitRegion(existingRegion).rest
+        : (input.content ?? '').trim();
+    const block = pointerBlock(pointers);
+    const parts = [block, fileContent].filter((part) => part.length > 0);
+    const content = parts.join('\n\n');
     const isEmpty = content.trim().length === 0;
     // Locate any existing managed region.
     const startIdx = existing ? existing.indexOf(exports.CONTEXT_START_MARKER) : -1;

package/dist/bridge/localContextWriter.d.ts

@@ -26,7 +26,8 @@ export interface LocalContextWriteResult {
  */
 export declare function writeLocalContext(input: {
     projectRoot: string;
-    content: string;
+    /** Absent only for a pointers-only refresh (wmr-07). */
+    content?: string;
     workGraphAvailable?: boolean;
     /** wmr-04 — two-lane parity with contextWriter.ts. Gated by the caller on
      *  the local lane's own honest signal (did THIS bridge run register the
@@ -35,4 +36,8 @@ export declare function writeLocalContext(input: {
     /** wmr-04 — this workspace's composed brief, or null when the fetch failed
      *  or there is nothing yet. Never blocks the write (PRD D2). */
     memoryBrief?: string | null;
+    /** wmr-07 — refresh only the standing pointers, keeping the pushed file
+     *  content. The local twin of contextWriter's flag; same reason (the
+     *  manifest frame only arrives when the pilot has files selected). */
+    pointersOnly?: boolean;
 }, deps: LocalContextWriterDeps): LocalContextWriteResult;

package/dist/bridge/localContextWriter.js

@@ -56,6 +56,15 @@ exports.writeLocalContext = writeLocalContext;
 const path = __importStar(require("path"));
 const workGraphPointer_1 = require("./workGraphPointer");
 const memoryPointer_1 = require("./memoryPointer");
+const contextWriter_1 = require("./contextWriter");
+/** Split a bridge-owned context file into its pointer block and the rest. */
+function splitPointers(body) {
+    const start = body.indexOf(contextWriter_1.POINTERS_START_MARKER);
+    const end = body.indexOf(contextWriter_1.POINTERS_END_MARKER);
+    if (start === -1 || end === -1 || end < start)
+        return { rest: body.trim() };
+    return { rest: (body.slice(0, start) + body.slice(end + contextWriter_1.POINTERS_END_MARKER.length)).trim() };
+}
 exports.LOCAL_CONTEXT_DIR = '.hiveop';
 exports.LOCAL_CONTEXT_FILENAME = 'context.md';
 exports.LOCAL_CONTEXT_RELATIVE_PATH = `${exports.LOCAL_CONTEXT_DIR}/${exports.LOCAL_CONTEXT_FILENAME}`;
@@ -79,15 +88,21 @@ function writeLocalContext(input, deps) {
     // the same shape contextWriter.ts uses, because the two lanes diverging on
     // this would be a two-lane bug nobody would notice until a local pilot
     // reported missing memory.
-    const hasFileContent = input.content.trim().length > 0;
-    const sections = [];
+    const pointers = [];
     if (input.workGraphAvailable)
-        sections.push(workGraphPointer_1.WORK_GRAPH_POINTER);
+        pointers.push(workGraphPointer_1.WORK_GRAPH_POINTER);
     if (input.memoryAvailable)
-        sections.push((0, memoryPointer_1.memorySection)(input.memoryBrief));
-    if (hasFileContent)
-        sections.push(input.content);
-    const content = sections.length > 0 ? sections.join('\n\n') : input.content;
+        pointers.push((0, memoryPointer_1.memorySection)(input.memoryBrief));
+    // wmr-07 — the whole local file is bridge-owned, so "preserve the pushed
+    // content" means keeping what is already on disk below the pointer fence.
+    const existingBody = existed ? deps.readFile(contextPath) : '';
+    const fileContent = input.pointersOnly
+        ? splitPointers(existingBody).rest
+        : (input.content ?? '').trim();
+    const block = pointers.length > 0
+        ? `${contextWriter_1.POINTERS_START_MARKER}\n${pointers.join('\n\n')}\n${contextWriter_1.POINTERS_END_MARKER}`
+        : '';
+    const content = [block, fileContent].filter((part) => part.length > 0).join('\n\n');
     const isEmpty = content.trim().length === 0;
     if (isEmpty) {
         if (!existed)

package/dist/bridge/pairing.js

@@ -18,7 +18,13 @@ async function runPairingPoll(deps) {
         const result = await deps.poll();
         if (deps.isCancelled())
             return { outcome: 'cancelled' };
-        if (result.status === 'approved') {
+        // wha-08: PairingPollResponse's 'approved' status now also covers
+        // cli_login (auth/login.ts), which carries an apiKey instead of a
+        // connectToken/deviceId — `purpose !== 'cli_login'` is a type-only
+        // narrowing, never a behavior change: a bridge pollToken never yields a
+        // cli_login-shaped response, so this condition is always true for any
+        // real bridge poll.
+        if (result.status === 'approved' && result.purpose !== 'cli_login') {
             return { outcome: 'approved', connectToken: result.connectToken, deviceId: result.deviceId };
         }
         if (result.status === 'expired') {

package/dist/bridge/relayClient.d.ts

@@ -221,6 +221,15 @@ export interface RelayClientOpts {
      * error (legacy / local bridge has no workspace checkouts). This opens NO PTY
      * and does NOT feed Claude Code via keystrokes — the context arrives as a FILE.
      */
+    /**
+     * wmr-07 — refresh this workspace's standing pointers (work graph, memory
+     * brief) without touching its pushed file content. Called when a session
+     * opens, because the context-manifest frame only arrives when the pilot has
+     * files selected. Absent → nothing happens, exactly as before.
+     */
+    refreshContextPointers?: (args: {
+        workspaceId: string;
+    }) => void | Promise<void>;
     writeContext?: (manifest: {
         workspaceId: string;
         content: string;

package/dist/bridge/relayClient.js

@@ -1009,6 +1009,31 @@ function startRelayClient(opts) {
                             relayOwned.set(sessionId, { workspaceId });
                             // tchp-21 — best-effort, fire-and-forget: never blocks `opened`.
                             maybeCreateSessionAnchor(sessionId, cwd);
+                            /*
+                              wmr-07 — refresh the standing pointers (work graph, workspace
+                              memory + its brief) for this workspace now that a session
+                              exists.
+              
+                              This is the trigger the whole delivery was missing. wmr-01..04
+                              rode the context-manifest frame on the assumption it fires when
+                              a terminal attaches; it does not — arena only pushes one when
+                              the pilot has FILES SELECTED, so for an ordinary workspace the
+                              region was never written and neither the memory brief nor the
+                              work-graph pointer (shipped months earlier) ever arrived.
+                              Confirmed on a live container: CLAUDE.md untouched for 20 hours
+                              with neither present.
+              
+                              Doing it here needs no browser, no selection, and no arena at
+                              all — only a session opening, which is exactly when an agent is
+                              about to read the file. Pointers-only, so the pilot's pushed
+                              file content is preserved. Fire-and-forget: this must never
+                              delay or fail an `opened`.
+                            */
+                            if (workspaceId && opts.refreshContextPointers) {
+                                void Promise.resolve(opts.refreshContextPointers({ workspaceId })).catch((err) => {
+                                    console.error('[bridge] context pointer refresh failed (non-fatal):', err);
+                                });
+                            }
                             attachTo(sessionId)
                                 .then(() => {
                                 send(socket, {

package/dist/bridge/server.d.ts

@@ -200,6 +200,12 @@ export interface BridgeServerOpts {
     /** wmr-04 — may be async: the implementation fetches this workspace's memory
      *  brief before writing. The frame handler resolves it rather than becoming
      *  async itself, so no other frame type's ordering changes. */
+    /** wmr-07 — the local twin of the hosted refreshContextPointers: write this
+     *  workspace's standing pointers when a session opens, without waiting for a
+     *  context-manifest that only arrives when files are selected. */
+    refreshLocalContextPointers?: (args: {
+        workspaceId: string;
+    }) => void | Promise<void>;
     writeLocalContext?: (params: {
         workspaceId: string;
         content: string;

package/dist/bridge/server.js

@@ -766,6 +766,14 @@ function startBridgeServer(opts) {
                                 send(ws, { t: 'error', message });
                                 break;
                             }
+                            // wmr-07 — same trigger as the hosted lane: the pointers are
+                            // refreshed when a session opens, not when a manifest happens to
+                            // be pushed. Fire-and-forget; never delays or fails `opened`.
+                            if (frame.workspaceId && opts.refreshLocalContextPointers) {
+                                void Promise.resolve(opts.refreshLocalContextPointers({ workspaceId: frame.workspaceId })).catch((err) => {
+                                    console.error('[bridge] local context pointer refresh failed (non-fatal):', err);
+                                });
+                            }
                             attachTo(sessionId).then(() => {
                                 send(ws, {
                                     t: 'opened',

package/dist/commands/auth.d.ts

@@ -1,2 +1,19 @@
+/**
+ * wha-08 (docs/prd/retire-wallet-header-auth.md, docs/CONTEXT-identity.md) —
+ * `wen-market auth login` / `auth logout` / `auth whoami`.
+ *
+ * `login` runs the device-code flow (lws-14's mechanism, purpose=cli_login —
+ * see auth/login.ts): a code is minted and printed with the approval URL
+ * (https://marketplace.wenrwa.com/settings/cli-login?code=<CODE>), the
+ * browser is opened as best-effort convenience, and the CLI polls until a
+ * human approves or denies it there. `--api-key` skips all of that for CI:
+ * an existing key is verified with one authenticated call and saved
+ * directly. Either way the CLI authenticates as an API key (X-API-Key) —
+ * never the retired X-Wallet-Pubkey header (see utils/client.ts).
+ *
+ * `logout` revokes the stored key server-side (DELETE /keys/:id — see
+ * ApiKeyController#revoke's wha-08 self-revoke-only guard) before deleting
+ * it locally, so a copied config file stops working too.
+ */
 import { Command } from 'commander';
 export declare const authCommand: Command;