@wrongstack/cli 0.284.0 → 0.285.0

package/dist/tuneup.d.ts

@@ -0,0 +1,162 @@
+/**
+ * Tune-up engine — deterministic health, context-cost, and performance checks
+ * for a WrongStack session, mapping the "clean up + speed up your setup" idea
+ * onto WrongStack's own config knobs and subsystems.
+ *
+ * Pure module: none of these functions touch the filesystem, the network, or
+ * live registries. The `/tuneup` slash command owns all IO (reading config,
+ * skills, memory files, the trust file, the update check, disk sizes) and
+ * applies the writes; this engine only turns already-loaded data into findings.
+ * That keeps it trivially unit-testable, exactly like `config-doctor.ts`.
+ *
+ * Every finding may carry:
+ *   - `action`  — a structured, deterministic fix the command applies on
+ *                 `/tuneup fix`. Actions gated by `input.power` are only
+ *                 emitted for the explicit `/tuneup fix --power` profile so a
+ *                 plain tune-up never silently makes the agent autonomous.
+ *   - `handoff` — a line folded into an agent follow-up turn for the fuzzy,
+ *                 judgement-heavy items (instruction-file dedup / split).
+ */
+import type { Config } from '@wrongstack/core';
+import type { UpdateInfo } from './update-check.js';
+export type TuneupSeverity = 'error' | 'warning' | 'info' | 'ok';
+/** Stable check-group ids — one section per group in the rendered report. */
+export type TuneupCategory = 'version' | 'autonomy' | 'skills' | 'mcp' | 'plugins' | 'memory' | 'hooks' | 'permissions' | 'performance' | 'reliability' | 'config';
+/**
+ * A structured, deterministic repair the command knows how to apply.
+ * `set-config` is the generic one — a dot-path into the global config plus the
+ * value to set — so most knobs need no bespoke apply logic.
+ */
+export type TuneupAction = {
+    kind: 'set-config';
+    path: string[];
+    value: unknown;
+    label: string;
+} | {
+    kind: 'add-exec-allow';
+    commands: string[];
+} | {
+    kind: 'normalize-hook-timeout';
+    event: string;
+    index: number;
+    timeoutMs: number;
+};
+export interface TuneupFinding {
+    category: TuneupCategory;
+    severity: TuneupSeverity;
+    /** One-line problem statement. */
+    problem: string;
+    /** Optional human hint about the recommended action. */
+    suggestion?: string | undefined;
+    /** Present when a deterministic auto-fix exists; short description shown in the report. */
+    fix?: string | undefined;
+    /** Machine-readable descriptor the command applies on `/tuneup fix`. */
+    action?: TuneupAction | undefined;
+    /** A line folded into the agent follow-up turn (fuzzy items with no mechanical fix). */
+    handoff?: string | undefined;
+}
+/** A discovered skill, reduced to what the checks need. */
+export interface TuneupSkill {
+    name: string;
+    source: string;
+    /** Body length in chars, when the command could read it (best-effort). */
+    bodyChars?: number | undefined;
+}
+/** Live MCP server status, reduced from `mcpRegistry.describe()`. */
+export interface TuneupMcpServer {
+    name: string;
+    state: string;
+    enabled: boolean;
+    toolCount: number;
+}
+/** An instruction/memory file layer to compare + size-check. */
+export interface TuneupMemoryFile {
+    /** Human label, e.g. "user memory" or "project AGENTS.md". */
+    label: string;
+    path: string;
+    content: string;
+    /** True for committed/shared layers (project AGENTS.md, root CLAUDE.md). */
+    committed: boolean;
+}
+/** The persistent permission trust file, `~/.wrongstack/projects/<hash>/trust.json`. */
+export type TuneupTrustPolicy = Record<string, {
+    allow?: string[] | undefined;
+    deny?: string[] | undefined;
+    auto?: boolean | undefined;
+}>;
+/** Ambient facts the command precomputes (host / disk / env) for the checks. */
+export interface TuneupEnv {
+    /** Logical CPU count, for the maxConcurrent sanity check. */
+    cpuCount?: number | undefined;
+    /** Number of configured providers, for the fallback-chain check. */
+    providerCount?: number | undefined;
+    /** Whether the secret vault is passphrase-hardened at rest. */
+    vaultHardened?: boolean | undefined;
+    /** Total bytes of on-disk session logs for this project (disk-hygiene check). */
+    sessionBytes?: number | undefined;
+}
+export interface TuneupInput {
+    config: Config;
+    skills: TuneupSkill[];
+    /** `config.skills.eagerMaxChars` or its default. */
+    eagerMaxChars: number;
+    skillMode: 'eager' | 'progressive';
+    /** Live MCP status when the host wired `mcpStatus`; undefined → skip live MCP checks. */
+    mcp?: TuneupMcpServer[] | undefined;
+    /** Instruction-file layers (user memory, project AGENTS.md, root CLAUDE.md/AGENTS.md). */
+    memoryFiles: TuneupMemoryFile[];
+    /** Self-update info (from `checkForUpdate`), when the version check ran. */
+    update?: UpdateInfo | undefined;
+    /** Parsed trust file, when present. */
+    trust?: TuneupTrustPolicy | undefined;
+    /**
+     * Denied read-only commands mined from session history (optional richer
+     * signal). Each entry is a command line and how many times it was denied.
+     */
+    deniedFromHistory?: Array<{
+        command: string;
+        count: number;
+    }> | undefined;
+    /** Ambient host/disk facts. */
+    env?: TuneupEnv | undefined;
+    /** Count of `/doctor`-style config issues (from `diagnoseConfig`). */
+    configIssues?: number | undefined;
+    /**
+     * Power profile: `/tuneup fix --power`. Gates the autonomy/yolo/director
+     * actions so a plain tune-up never flips them (respects the user-owned
+     * autonomy invariant).
+     */
+    power?: boolean | undefined;
+}
+export interface TuneupReport {
+    findings: TuneupFinding[];
+    /** Composed agent follow-up prompt for fuzzy items; empty when none. */
+    agentHandoff: string;
+}
+/** Default eager skill-body budget (mirrors `SkillsConfig.eagerMaxChars`). */
+export declare const DEFAULT_EAGER_MAX_CHARS = 24000;
+/** True when `command` is safely read-only by our conservative heuristic. */
+export declare function isReadOnlyCommand(command: string): boolean;
+export declare function checkSkills(input: TuneupInput): TuneupFinding[];
+export declare function checkMcp(input: TuneupInput): TuneupFinding[];
+export declare function checkPlugins(input: TuneupInput): TuneupFinding[];
+export declare function checkMemoryDedup(input: TuneupInput): TuneupFinding[];
+export declare function checkMemorySize(input: TuneupInput): TuneupFinding[];
+export declare function checkHooks(input: TuneupInput): TuneupFinding[];
+export declare function checkVersion(input: TuneupInput): TuneupFinding[];
+export declare function checkAutonomy(input: TuneupInput): TuneupFinding[];
+/** Power-only: yolo + director launch defaults (explicit `--power` opt-in). */
+export declare function checkPowerProfile(input: TuneupInput): TuneupFinding[];
+export declare function checkPermissions(input: TuneupInput): TuneupFinding[];
+export declare function checkPerformance(input: TuneupInput): TuneupFinding[];
+export declare function checkReliability(input: TuneupInput): TuneupFinding[];
+export declare function checkConfigDoctor(input: TuneupInput): TuneupFinding[];
+/** Run every check and compose the report + agent hand-off text. */
+export declare function runTuneup(input: TuneupInput): TuneupReport;
+/**
+ * Build the rich follow-up prompt for `/tuneup deep` — hands the agent the live
+ * findings and asks for a project-specific optimization plan (the non-mechanical
+ * tier). Kept here so it is unit-testable alongside the checks.
+ */
+export declare function buildDeepPrompt(report: TuneupReport): string;
+//# sourceMappingURL=tuneup.d.ts.map

package/dist/tuneup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tuneup.d.ts","sourceRoot":"","sources":["../src/tuneup.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAEpD,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAAC;AAEjE,6EAA6E;AAC7E,MAAM,MAAM,cAAc,GACtB,SAAS,GACT,UAAU,GACV,QAAQ,GACR,KAAK,GACL,SAAS,GACT,QAAQ,GACR,OAAO,GACP,aAAa,GACb,aAAa,GACb,aAAa,GACb,QAAQ,CAAC;AAEb;;;;GAIG;AACH,MAAM,MAAM,YAAY,GACpB;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACrE;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,GAC9C;IAAE,IAAI,EAAE,wBAAwB,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC;AAExF,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,cAAc,CAAC;IACzB,QAAQ,EAAE,cAAc,CAAC;IACzB,kCAAkC;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,wDAAwD;IACxD,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,2FAA2F;IAC3F,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,wEAAwE;IACxE,MAAM,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;IAClC,wFAAwF;IACxF,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC9B;AAED,2DAA2D;AAC3D,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,0EAA0E;IAC1E,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAChC;AAED,qEAAqE;AACrE,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,gEAAgE;AAChE,MAAM,WAAW,gBAAgB;IAC/B,8DAA8D;IAC9D,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,4EAA4E;IAC5E,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,wFAAwF;AACxF,MAAM,MAAM,iBAAiB,GAAG,MAAM,CACpC,MAAM,EACN;IAAE,KAAK,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;CAAE,CAC1F,CAAC;AAEF,gFAAgF;AAChF,MAAM,WAAW,SAAS;IACxB,6DAA6D;IAC7D,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,oEAAoE;IACpE,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,+DAA+D;IAC/D,aAAa,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACpC,iFAAiF;IACjF,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,WAAW,EAAE,CAAC;IACtB,oDAAoD;IACpD,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,OAAO,GAAG,aAAa,CAAC;IACnC,yFAAyF;IACzF,GAAG,CAAC,EAAE,eAAe,EAAE,GAAG,SAAS,CAAC;IACpC,0FAA0F;IAC1F,WAAW,EAAE,gBAAgB,EAAE,CAAC;IAChC,4EAA4E;IAC5E,MAAM,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;IAChC,uCAAuC;IACvC,KAAK,CAAC,EAAE,iBAAiB,GAAG,SAAS,CAAC;IACtC;;;OAGG;IACH,iBAAiB,CAAC,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,SAAS,CAAC;IAC1E,+BAA+B;IAC/B,GAAG,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;IAC5B,sEAAsE;IACtE,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC;;;;OAIG;IACH,KAAK,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CAC7B;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,wEAAwE;IACxE,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,8EAA8E;AAC9E,eAAO,MAAM,uBAAuB,QAAS,CAAC;AAwD9C,6EAA6E;AAC7E,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAc1D;AAID,wBAAgB,WAAW,CAAC,KAAK,EAAE,WAAW,GAAG,aAAa,EAAE,CAsC/D;AAED,wBAAgB,QAAQ,CAAC,KAAK,EAAE,WAAW,GAAG,aAAa,EAAE,CA2B5D;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,WAAW,GAAG,aAAa,EAAE,CAehE;AAeD,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,WAAW,GAAG,aAAa,EAAE,CAoCpE;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,WAAW,GAAG,aAAa,EAAE,CAiBnE;AAID,wBAAgB,UAAU,CAAC,KAAK,EAAE,WAAW,GAAG,aAAa,EAAE,CAmC9D;AASD,wBAAgB,YAAY,CAAC,KAAK,EAAE,WAAW,GAAG,aAAa,EAAE,CAehE;AAID,wBAAgB,aAAa,CAAC,KAAK,EAAE,WAAW,GAAG,aAAa,EAAE,CAwBjE;AAED,+EAA+E;AAC/E,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,WAAW,GAAG,aAAa,EAAE,CAgCrE;AAID,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,WAAW,GAAG,aAAa,EAAE,CA0CpE;AAID,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,WAAW,GAAG,aAAa,EAAE,CA0EpE;AAID,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,WAAW,GAAG,aAAa,EAAE,CAkCpE;AAID,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,WAAW,GAAG,aAAa,EAAE,CAWrE;AAID,oEAAoE;AACpE,wBAAgB,SAAS,CAAC,KAAK,EAAE,WAAW,GAAG,YAAY,CAwB1D;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,CAiB5D"}

package/dist/update-check.d.ts

@@ -0,0 +1,22 @@
+export interface UpdateInfo {
+    current: string;
+    latest: string;
+    outdated: boolean;
+    checkFailed: boolean;
+}
+type HomeDirFn = () => string;
+/** Cache file path — homeFn is injectable for testing */
+export declare function cachePath(homeFn?: HomeDirFn): string;
+/** Read the current CLI version from package.json */
+export declare function currentVersion(): string;
+/** Fetch latest version from npm registry. Exported for testability and for
+ *  callers that want to do their own version checks. Throws a structured
+ *  `FetchError(status, context: { op: 'checkForUpdate', registry: 'npmjs', url })`
+ *  on non-2xx responses so consumers can branch on the structured shape. */
+export declare function fetchLatestFromNpm(timeoutMs?: number): Promise<string>;
+/** Return update info — cache-first, network fallback */
+export declare function checkForUpdate(signal?: AbortSignal | undefined, homeFn?: HomeDirFn | undefined): Promise<UpdateInfo>;
+/** Return update notification string if available, null otherwise */
+export declare function getUpdateNotification(signal?: AbortSignal | undefined, homeFn?: HomeDirFn | undefined): Promise<string | null>;
+export {};
+//# sourceMappingURL=update-check.d.ts.map

package/dist/update-check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"update-check.d.ts","sourceRoot":"","sources":["../src/update-check.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,OAAO,CAAC;IAClB,WAAW,EAAE,OAAO,CAAC;CACtB;AAED,KAAK,SAAS,GAAG,MAAM,MAAM,CAAC;AAM9B,yDAAyD;AACzD,wBAAgB,SAAS,CAAC,MAAM,GAAE,SAA0B,GAAG,MAAM,CAEpE;AAWD,qDAAqD;AACrD,wBAAgB,cAAc,IAAI,MAAM,CAYvC;AA0CD;;;4EAG4E;AAC5E,wBAAsB,kBAAkB,CAAC,SAAS,SAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAwB1E;AAED,yDAAyD;AACzD,wBAAsB,cAAc,CAClC,MAAM,CAAC,EAAE,WAAW,GAAG,SAAS,EAChC,MAAM,CAAC,EAAE,SAAS,GAAG,SAAS,GAC7B,OAAO,CAAC,UAAU,CAAC,CAkDrB;AAED,qEAAqE;AACrE,wBAAsB,qBAAqB,CACzC,MAAM,CAAC,EAAE,WAAW,GAAG,SAAS,EAChC,MAAM,CAAC,EAAE,SAAS,GAAG,SAAS,GAC7B,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAMxB"}

package/dist/utils/delay-format.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Format a millisecond delay as a human-readable string (e.g. "30s", "2m", "disabled").
+ */
+export declare function formatDelay(ms: number): string;
+//# sourceMappingURL=delay-format.d.ts.map

package/dist/utils/delay-format.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delay-format.d.ts","sourceRoot":"","sources":["../../src/utils/delay-format.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,wBAAgB,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAI9C"}

package/dist/utils/win32-cmd.d.ts

@@ -0,0 +1,7 @@
+export interface Win32CmdShimInvocation {
+    command: string;
+    args: string[];
+    windowsVerbatimArguments: true;
+}
+export declare function buildWin32CmdShimInvocation(command: string, args?: readonly string[]): Win32CmdShimInvocation;
+//# sourceMappingURL=win32-cmd.d.ts.map

package/dist/utils/win32-cmd.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"win32-cmd.d.ts","sourceRoot":"","sources":["../../src/utils/win32-cmd.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,wBAAwB,EAAE,IAAI,CAAC;CAChC;AAED,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,MAAM,EACf,IAAI,GAAE,SAAS,MAAM,EAAO,GAC3B,sBAAsB,CAQxB"}

package/dist/utils.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Format a token count for human-readable display.
+ *   999 → "999"
+ *   1_200 → "1.2k"
+ *   12_000 → "12k"
+ *   1_500_000 → "1.5M"
+ */
+export declare function fmtTok(n: number): string;
+/**
+ * Return a new frozen config object with the given patch applied.
+ * Config objects are frozen by the config loader — direct mutation
+ * silently fails at runtime. This helper spreads + re-freezes safely.
+ */
+export declare function patchConfig<T extends object>(base: T, patch: Partial<T>): T;
+/**
+ * Human-readable duration: 999 → "999ms", 12_500 → "12.5s",
+ * 160_016 → "2m40s", 7_200_000 → "2h0m". Used by `/agents` and
+ * `/fleet status` so users don't have to read "160016ms" and do the
+ * conversion in their head.
+ */
+export declare function fmtDuration(ms: number): string;
+/**
+ * Render a completed TaskResult into a single line for `/agents` and
+ * `/fleet status`. Distinguishes all four terminal statuses with
+ * separate icons + colors so users can tell a timeout from a real
+ * failure at a glance, and surfaces both the failure kind (e.g.
+ * `provider_rate_limit`, `tool_failed`) and a truncated error tail
+ * (previously dropped on the floor).
+ *
+ * Accepts either the structured `SubagentError` envelope (current) or
+ * a legacy string error — the field shape is widened to keep older
+ * callers compiling while migrations roll through.
+ *
+ * The caller passes the color helper (it lives in @wrongstack/core)
+ * to avoid a circular import from this utility module.
+ */
+export declare function fmtTaskResultLine(r: {
+    status: 'success' | 'failed' | 'timeout' | 'stopped';
+    error?: string | {
+        kind?: string | undefined;
+        message?: string | undefined;
+        retryable?: boolean | undefined;
+        backoffMs?: number | undefined;
+    } | undefined;
+    iterations: number;
+    toolCalls: number;
+    durationMs: number;
+}, color: {
+    green(s: string): string;
+    red(s: string): string;
+    yellow(s: string): string;
+    dim(s: string): string;
+}): {
+    mark: string;
+    stats: string;
+    tail: string;
+};
+//# sourceMappingURL=utils.d.ts.map

package/dist/utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,wBAAgB,MAAM,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAIxC;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,CAAC,SAAS,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAE3E;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAU9C;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAC/B,CAAC,EAAE;IACD,MAAM,EAAE,SAAS,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAC;IACrD,KAAK,CAAC,EACF,MAAM,GACN;QACE,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC1B,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC7B,SAAS,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;QAChC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;KAChC,GACD,SAAS,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACpB,EACD,KAAK,EAAE;IACL,KAAK,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACzB,GAAG,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACvB,MAAM,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC1B,GAAG,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;CACxB,GACA;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CA4B/C"}

package/dist/version.d.ts

@@ -0,0 +1,4 @@
+export declare const CLI_VERSION: string;
+declare let API_VERSION: string;
+export { API_VERSION };
+//# sourceMappingURL=version.d.ts.map

package/dist/version.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"version.d.ts","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAiBA,eAAO,MAAM,WAAW,QAAmB,CAAC;AAE5C,QAAA,IAAI,WAAW,QAAU,CAAC;AAU1B,OAAO,EAAE,WAAW,EAAE,CAAC"}

package/dist/webui-server/client-registration.d.ts

@@ -0,0 +1,41 @@
+import type { Config, EventBus } from '@wrongstack/core';
+import { type HqCommandController } from '../hq-command-controller.js';
+/**
+ * The control hooks the WebUI can offer HQ. When present, the WebUI client
+ * advertises `control.receive` and dispatches HQ commands (steer/btw/queue/
+ * broadcast via its mailbox, abort via the run controller) exactly like the
+ * CLI/TUI — so two-way control works for the WebUI client too, not just
+ * terminal surfaces. Omitted → telemetry-only (the previous behaviour).
+ */
+export interface WebuiHqControlHooks {
+    /** Abort the WebUI's active agent run. Returns true if a run was aborted. */
+    interruptLeader: () => boolean;
+    /** Whether raw shell execution is explicitly opted-in by the operator. */
+    allowRunCommand: () => boolean;
+    /** Optional: spawn a role subagent. */
+    spawnAgent?: HqCommandController['spawnAgent'];
+    /** Optional: stop the entire fleet. */
+    killFleet?: HqCommandController['killFleet'];
+    /** Optional: terminate one subagent by id. */
+    terminateAgent?: HqCommandController['terminateAgent'];
+}
+export interface WebuiClientRegistrationDeps {
+    projectRoot: string | undefined;
+    /** Full app config, used for HQ client publishing settings. */
+    appConfig: Config | undefined;
+    events: EventBus;
+    /** Stable session id recorded in HQ telemetry (the writer at startup). */
+    hqSessionId: string;
+    /** Live session id — session.resume swaps it, so it is read per heartbeat. */
+    getSessionId: () => string;
+    /** When provided, the WebUI becomes HQ-controllable (two-way control). */
+    hqControl?: WebuiHqControlHooks | undefined;
+}
+export interface WebuiClientRegistration {
+    /** Fire-and-forget registration; resolves to the client id (or null). */
+    register(): Promise<string | null>;
+    /** Stop heartbeats and tear down the HQ connection/telemetry bridge. */
+    unregister(): void;
+}
+export declare function createWebuiClientRegistration(deps: WebuiClientRegistrationDeps): WebuiClientRegistration;
+//# sourceMappingURL=client-registration.d.ts.map

package/dist/webui-server/client-registration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-registration.d.ts","sourceRoot":"","sources":["../../src/webui-server/client-registration.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAsB,MAAM,kBAAkB,CAAC;AAE7E,OAAO,EAA6B,KAAK,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAKlG;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAClC,6EAA6E;IAC7E,eAAe,EAAE,MAAM,OAAO,CAAC;IAC/B,0EAA0E;IAC1E,eAAe,EAAE,MAAM,OAAO,CAAC;IAC/B,uCAAuC;IACvC,UAAU,CAAC,EAAE,mBAAmB,CAAC,YAAY,CAAC,CAAC;IAC/C,uCAAuC;IACvC,SAAS,CAAC,EAAE,mBAAmB,CAAC,WAAW,CAAC,CAAC;IAC7C,8CAA8C;IAC9C,cAAc,CAAC,EAAE,mBAAmB,CAAC,gBAAgB,CAAC,CAAC;CACxD;AAED,MAAM,WAAW,2BAA2B;IAC1C,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,+DAA+D;IAC/D,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,MAAM,EAAE,QAAQ,CAAC;IACjB,0EAA0E;IAC1E,WAAW,EAAE,MAAM,CAAC;IACpB,8EAA8E;IAC9E,YAAY,EAAE,MAAM,MAAM,CAAC;IAC3B,0EAA0E;IAC1E,SAAS,CAAC,EAAE,mBAAmB,GAAG,SAAS,CAAC;CAC7C;AAED,MAAM,WAAW,uBAAuB;IACtC,yEAAyE;IACzE,QAAQ,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACnC,wEAAwE;IACxE,UAAU,IAAI,IAAI,CAAC;CACpB;AAED,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,2BAA2B,GAChC,uBAAuB,CAqHzB"}

package/dist/webui-server/connection-handler.d.ts

@@ -0,0 +1,59 @@
+/**
+ * WebSocket connection handler for the CLI WebUI bridge.
+ *
+ * One `wss.on('connection', ...)` per browser tab: per-socket error
+ * handling (attached first, before any awaited work — an oversized inbound
+ * frame or other socket-level error must never crash the process), auth via
+ * the shared `verifyClient` policy, client registration (map entry + the
+ * per-panel WS handlers), per-connection rate limiting, message dispatch,
+ * close cleanup, and the initial `session.start` push.
+ *
+ * PR 14 of Issue #30: extracted from `webui-server.ts`.
+ */
+import type { IncomingMessage } from 'node:http';
+import type { Message, Usage } from '@wrongstack/core';
+import type { AutoPhaseWebSocketHandler, SddBoardWebSocketHandler, SddWizardWebSocketHandler, SpecsWebSocketHandler, TerminalWebSocketHandler, WorktreeWebSocketHandler } from '@wrongstack/webui/server';
+import type { WebSocket } from 'ws';
+import { type PendingConfirm } from './ws-handlers/index.js';
+import type { WSClientMessage, WSServerMessage } from '../webui-server.js';
+export interface ConnectedClient {
+    ws: WebSocket;
+    sessionId: string | null;
+}
+export interface ConnectionHandlerDeps {
+    host: string;
+    wsToken: string;
+    requireToken: boolean;
+    publicHostnames: string[];
+    publicWsUrl: string | undefined;
+    clients: Map<WebSocket, ConnectedClient>;
+    currentSessionId: () => string;
+    autoPhaseHandler: AutoPhaseWebSocketHandler;
+    specsHandler: SpecsWebSocketHandler;
+    sddBoardHandler: SddBoardWebSocketHandler;
+    sddWizardHandler: SddWizardWebSocketHandler | null;
+    worktreeHandler: WorktreeWebSocketHandler;
+    terminalHandler: TerminalWebSocketHandler;
+    /** 0 = disabled (default; this is a local, single-user tool). */
+    rateLimitMax: number;
+    send: (ws: WebSocket, msg: WSServerMessage) => void;
+    sessionPayload: <T extends Record<string, unknown>>(payload: T) => T & {
+        sessionId: string;
+    };
+    handleMessage: (ws: WebSocket, client: ConnectedClient, msg: WSClientMessage) => Promise<void>;
+    abortControllers: Map<WebSocket, AbortController>;
+    pendingConfirms: Map<string, PendingConfirm>;
+    buildSessionStartPayload: (overrides?: Record<string, unknown>, needsSetup?: boolean) => Promise<Record<string, unknown>>;
+    /**
+     * Load the visible chat transcript for a reconnecting browser tab. This
+     * should read the session log when available; `context.messages` is only a
+     * fallback because it is the model working set and can be compacted.
+     */
+    loadReplay?: (() => Promise<{
+        messages: Message[];
+        usage?: Usage | undefined;
+    } | null>) | undefined;
+    needsSetup: boolean;
+}
+export declare function createConnectionHandler(deps: ConnectionHandlerDeps): (ws: WebSocket, req: IncomingMessage) => Promise<void>;
+//# sourceMappingURL=connection-handler.d.ts.map

package/dist/webui-server/connection-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection-handler.d.ts","sourceRoot":"","sources":["../../src/webui-server/connection-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,KAAK,EACV,yBAAyB,EACzB,wBAAwB,EACxB,yBAAyB,EACzB,qBAAqB,EACrB,wBAAwB,EACxB,wBAAwB,EACzB,MAAM,0BAA0B,CAAC;AAElC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AACpC,OAAO,EAA6B,KAAK,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxF,OAAO,KAAK,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAE3E,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,SAAS,CAAC;IACd,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAYD,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,OAAO,CAAC;IACtB,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,OAAO,EAAE,GAAG,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;IACzC,gBAAgB,EAAE,MAAM,MAAM,CAAC;IAC/B,gBAAgB,EAAE,yBAAyB,CAAC;IAC5C,YAAY,EAAE,qBAAqB,CAAC;IACpC,eAAe,EAAE,wBAAwB,CAAC;IAC1C,gBAAgB,EAAE,yBAAyB,GAAG,IAAI,CAAC;IACnD,eAAe,EAAE,wBAAwB,CAAC;IAC1C,eAAe,EAAE,wBAAwB,CAAC;IAC1C,iEAAiE;IACjE,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,eAAe,KAAK,IAAI,CAAC;IACpD,cAAc,EAAE,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7F,aAAa,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,eAAe,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/F,gBAAgB,EAAE,GAAG,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;IAClD,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC7C,wBAAwB,EAAE,CACxB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACnC,UAAU,CAAC,EAAE,OAAO,KACjB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACtC;;;;OAIG;IACH,UAAU,CAAC,EAAE,CAAC,MAAM,OAAO,CAAC;QAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;QAAC,KAAK,CAAC,EAAE,KAAK,GAAG,SAAS,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC,GAAG,SAAS,CAAC;IACpG,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,qBAAqB,GAC1B,CAAC,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,eAAe,KAAK,OAAO,CAAC,IAAI,CAAC,CAwKxD"}

package/dist/webui-server/context-breakdown.d.ts

@@ -0,0 +1,57 @@
+interface PromptBlock {
+    text?: string | undefined;
+}
+interface ToolLike {
+    name: string;
+    inputSchema?: unknown;
+    description?: string;
+}
+interface MessageLike {
+    role: string;
+    content: unknown;
+}
+export type { PromptBlock, ToolLike, MessageLike };
+/**
+ * Compute the per-section token breakdown for a session.
+ *
+ * The shape is preserved exactly as the pre-refactor inline
+ * code produced it: `total` is the sum across sections;
+ * `systemPrompt` is its own total (no breakdown — the
+ * system prompt is opaque); `tools` carries the count and
+ * a per-tool token count; `messages` carries the count, the
+ * total, and a per-message `{ index, role, tokens, preview }`
+ * row.
+ *
+ * Empty inputs are valid: the totals come out to 0 and the
+ * `breakdown` arrays are empty. The pre-refactor code
+ * handled this implicitly (the `.reduce` over an empty
+ * array returns 0); the extracted helper pins that
+ * behavior with explicit tests.
+ */
+export declare function estimateContextBreakdown(input: {
+    systemPrompt: ReadonlyArray<PromptBlock>;
+    tools: ReadonlyArray<ToolLike>;
+    messages: ReadonlyArray<MessageLike>;
+}): {
+    total: number;
+    systemPrompt: number;
+    tools: {
+        total: number;
+        count: number;
+        breakdown: Array<{
+            name: string;
+            tokens: number;
+        }>;
+    };
+    messages: {
+        total: number;
+        count: number;
+        breakdown: Array<{
+            index: number;
+            role: string;
+            tokens: number;
+            preview: string;
+        }>;
+    };
+};
+//# sourceMappingURL=context-breakdown.d.ts.map

package/dist/webui-server/context-breakdown.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"context-breakdown.d.ts","sourceRoot":"","sources":["../../src/webui-server/context-breakdown.ts"],"names":[],"mappings":"AA6CA,UAAU,WAAW;IACnB,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3B;AAED,UAAU,QAAQ;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,UAAU,WAAW;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;CAClB;AAQD,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;AAEnD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE;IAC9C,YAAY,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC;IACzC,KAAK,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;IAC/B,QAAQ,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC;CACtC,GAAG;IACF,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KAAE,CAAC;IAC5F,QAAQ,EAAE;QACR,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,CAAC;QACd,SAAS,EAAE,KAAK,CAAC;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KACpF,CAAC;CACH,CAyBA"}

package/dist/webui-server/cost-helpers.d.ts

@@ -0,0 +1,29 @@
+/** Per-1,000,000-token pricing, normalized to numbers (0 when unpriced). */
+export interface CostRates {
+    input: number;
+    output: number;
+    cacheRead: number;
+}
+/** Token counts for a turn/session. */
+export interface TokenUsage {
+    input: number;
+    output: number;
+    cacheRead?: number | undefined;
+}
+/**
+ * Extract per-million-token pricing from a model record. Returns
+ * zeros when the model is null/undefined, has no `cost` field, or
+ * is missing individual rate fields. The `cache_read` snake_case
+ * is preserved as-is from the upstream schema — renaming to
+ * `cacheRead` happens at the boundary.
+ */
+export declare function getCostRates(model: unknown): CostRates;
+/**
+ * Compute the per-turn cost in USD for the given token usage
+ * and per-million rates. The cache-read branch is optional:
+ * when `usage.cacheRead` is undefined it contributes 0 to the
+ * total. The final value is the per-million-scaled sum, not
+ * the per-token cost.
+ */
+export declare function computeUsageCost(usage: TokenUsage, rates: CostRates): number;
+//# sourceMappingURL=cost-helpers.d.ts.map

package/dist/webui-server/cost-helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cost-helpers.d.ts","sourceRoot":"","sources":["../../src/webui-server/cost-helpers.ts"],"names":[],"mappings":"AA8CA,4EAA4E;AAC5E,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,uCAAuC;AACvC,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAChC;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,SAAS,CAkBtD;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,GAAG,MAAM,CAO5E"}

package/dist/webui-server/lifecycle.d.ts

@@ -0,0 +1,108 @@
+import { type WebUIInstanceRecord } from '@wrongstack/webui/server';
+/**
+ * PR 7 of Issue #30 (webui-server 8-PR refactor): process lifecycle.
+ *
+ * Three concerns pulled out of the ~3000-line `runWebUI` body:
+ *
+ *   - `registerWebuiInstance` — record this embedded WebUI in the shared
+ *     running-instance registry (so `wstackui --list` sees it).
+ *   - `announceWebuiReady` — log the ready banner and pop the browser
+ *     once the HTTP server is listening.
+ *   - `createWebuiShutdown` + `registerWebuiSignalHandlers` — the
+ *     SIGINT/SIGTERM teardown sequence.
+ *
+ * Each external dependency (registry IO, browser launch) is an
+ * injectable seam so the orchestration can be unit-tested without
+ * touching disk or spawning a browser. Run-loop state (abort
+ * controllers, client map, the run promise's `resolve`) stays in
+ * `webui-server.ts` and is threaded in as callbacks — the module never
+ * captures it.
+ */
+export interface RegisterWebuiInstanceParams {
+    pid: number;
+    host: string;
+    httpPort: number;
+    wsPort: number;
+    /** Browser-facing public URL when served through a tunnel/proxy. */
+    publicUrl?: string | undefined;
+    projectRoot: string;
+    /** ISO timestamp when the instance registered. */
+    startedAt: string;
+    /** Registry base dir (dirname of globalConfigPath); undefined ⇒ registry default. */
+    registryBaseDir: string | undefined;
+}
+export interface RegisterWebuiInstanceDeps {
+    registerFn?: (record: WebUIInstanceRecord, baseDir?: string) => Promise<void>;
+}
+/**
+ * Fire-and-forget registration of this WebUI in the running-instance
+ * registry. Best-effort: a registry write error never blocks startup and
+ * is swallowed (the registry is a convenience index, not a source of
+ * truth). Caller guards on `projectRoot` being known.
+ */
+export declare function registerWebuiInstance(p: RegisterWebuiInstanceParams, deps?: RegisterWebuiInstanceDeps): void;
+export interface AnnounceWebuiReadyParams {
+    /** The HTTP server (StaticServeHandle.server). */
+    server: {
+        on: (event: 'listening', cb: () => void) => void;
+    };
+    host: string;
+    httpPort: number;
+    wsPort: number;
+    open: boolean;
+    /** Auth token for WS connections. Included in the URL so the frontend can exchange it for an HttpOnly cookie via /ws-auth. */
+    wsToken?: string;
+    /** Browser-facing public URL when served through a tunnel/proxy. */
+    publicUrl?: string | undefined;
+    log?: (msg: string) => void;
+    openBrowserFn?: (url: string) => void;
+}
+/**
+ * Once the HTTP server is listening, print the ready banner and (if
+ * `open`) launch the browser at the served URL.
+ */
+export declare function announceWebuiReady(p: AnnounceWebuiReadyParams): void;
+export interface WebuiShutdownResources {
+    /** Abort every in-flight run (legacy single slot + per-socket controllers) and clear them. */
+    abortInFlight: () => void;
+    /** Run and drop every event-bus unsubscriber. */
+    unsubscribeEvents: () => void;
+    /** Close every connected socket and clear the client map. */
+    closeClients: () => void;
+    /** Close the static HTTP server (no-op when WS-only). */
+    closeHttpServer: () => void;
+    /** The WebSocket server to stop (its close callback resolves the run promise). */
+    wss: {
+        close: (cb?: () => void) => void;
+    };
+    /** This process's pid — the registry liveness key. */
+    pid: number;
+    /** Registry base dir (undefined ⇒ registry default). */
+    registryBaseDir: string | undefined;
+    /** Called once teardown settles — wired to the run promise's `resolve`. */
+    onStopped: () => void;
+    log?: (msg: string) => void;
+    debug?: (msg: string) => void;
+    /** Injectable for tests; defaults to the real registry unregister. */
+    unregisterFn?: (pid: number, baseDir?: string) => Promise<void>;
+}
+/**
+ * Build the SIGINT/SIGTERM teardown handler. The returned function is
+ * idempotent: the first call runs the teardown, later calls (e.g. a
+ * second Ctrl+C, or a signal after another server in the same process
+ * already stopped) return immediately.
+ *
+ * Order matches the original inline handler: abort runs → unsubscribe
+ * events → close clients → unregister from the instance registry (async,
+ * awaited inside the wss.close callback) → close HTTP → close WS → on
+ * close, once the unregister settles, `onStopped()`.
+ */
+export declare function createWebuiShutdown(res: WebuiShutdownResources): () => void;
+/**
+ * Register `shutdown` on SIGINT and SIGTERM. The wrapper self-detaches
+ * both listeners on first fire (so a server that has already shut down
+ * can't re-trigger teardown). Returns an unregister function for tests
+ * and clean restarts.
+ */
+export declare function registerWebuiSignalHandlers(shutdown: () => void): () => void;
+//# sourceMappingURL=lifecycle.d.ts.map

package/dist/webui-server/lifecycle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lifecycle.d.ts","sourceRoot":"","sources":["../../src/webui-server/lifecycle.ts"],"names":[],"mappings":"AACA,OAAO,EAKL,KAAK,mBAAmB,EACzB,MAAM,0BAA0B,CAAC;AAElC;;;;;;;;;;;;;;;;;;GAkBG;AAIH,MAAM,WAAW,2BAA2B;IAC1C,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,oEAAoE;IACpE,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,kDAAkD;IAClD,SAAS,EAAE,MAAM,CAAC;IAClB,qFAAqF;IACrF,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;CACrC;AAED,MAAM,WAAW,yBAAyB;IACxC,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,mBAAmB,EAAE,OAAO,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/E;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,CAAC,EAAE,2BAA2B,EAC9B,IAAI,GAAE,yBAA8B,GACnC,IAAI,CAmBN;AAID,MAAM,WAAW,wBAAwB;IACvC,kDAAkD;IAClD,MAAM,EAAE;QAAE,EAAE,EAAE,CAAC,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,IAAI,KAAK,IAAI,CAAA;KAAE,CAAC;IAC7D,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,OAAO,CAAC;IACd,8HAA8H;IAC9H,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oEAAoE;IACpE,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CACvC;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,wBAAwB,GAAG,IAAI,CAmBpE;AAID,MAAM,WAAW,sBAAsB;IACrC,8FAA8F;IAC9F,aAAa,EAAE,MAAM,IAAI,CAAC;IAC1B,iDAAiD;IACjD,iBAAiB,EAAE,MAAM,IAAI,CAAC;IAC9B,6DAA6D;IAC7D,YAAY,EAAE,MAAM,IAAI,CAAC;IACzB,yDAAyD;IACzD,eAAe,EAAE,MAAM,IAAI,CAAC;IAC5B,kFAAkF;IAClF,GAAG,EAAE;QAAE,KAAK,EAAE,CAAC,EAAE,CAAC,EAAE,MAAM,IAAI,KAAK,IAAI,CAAA;KAAE,CAAC;IAC1C,sDAAsD;IACtD,GAAG,EAAE,MAAM,CAAC;IACZ,wDAAwD;IACxD,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,2EAA2E;IAC3E,SAAS,EAAE,MAAM,IAAI,CAAC;IACtB,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC9B,sEAAsE;IACtE,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACjE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,sBAAsB,GAAG,MAAM,IAAI,CA2B3E;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI,CAY5E"}

package/dist/webui-server/logger-shim.d.ts

@@ -0,0 +1,10 @@
+import type { Logger } from '@wrongstack/core';
+/**
+ * Console-backed `Logger` adapter for the CLI. Routes each
+ * level to the matching `console.*` method and wraps the
+ * message in a structured JSON line. The `child()` method
+ * returns the same logger — the CLI shim does not maintain
+ * a binding chain.
+ */
+export declare const consoleLogger: Logger;
+//# sourceMappingURL=logger-shim.d.ts.map

package/dist/webui-server/logger-shim.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger-shim.d.ts","sourceRoot":"","sources":["../../src/webui-server/logger-shim.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAiB/C;;;;;;GAMG;AACH,eAAO,MAAM,aAAa,EAAE,MAoB3B,CAAC"}