@wrongstack/cli 0.287.0 → 0.291.0

package/dist/hq-server/ws.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ws.d.ts","sourceRoot":"","sources":["../../src/hq-server/ws.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AAC/B,OAAO,EASL,KAAK,iBAAiB,EACtB,KAAK,eAAe,EAKpB,KAAK,aAAa,EAElB,KAAK,iBAAiB,EAGtB,KAAK,OAAO,EAEZ,KAAK,iBAAiB,EAEvB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,eAAe,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAmBzF,wBAAgB,aAAa,CAC3B,EAAE,EAAE,SAAS,EACb,mBAAmB,EAAE,qBAAqB,EAC1C,QAAQ,EAAE,GAAG,CAAC,SAAS,CAAC,GACvB,IAAI,CAsBN;AAID,wBAAgB,YAAY,CAC1B,EAAE,EAAE,SAAS,EACb,OAAO,EAAE,GAAG,CAAC,SAAS,EAAE,eAAe,CAAC,EACxC,QAAQ,EAAE,GAAG,CAAC,SAAS,CAAC,EACxB,QAAQ,EAAE,eAAe,EAAE,EAC3B,IAAI,EAAE;IACJ,KAAK,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC5B,iBAAiB,EAAE,MAAM,OAAO,CAAC,iBAAiB,CAAC,GAAG,SAAS,CAAC;CACjE,EACD,mBAAmB,EAAE,qBAAqB,EAC1C,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,EACxC,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,iBAAiB,EAAE,CAAC,EAC/C,WAAW,CAAC,EAAE,aAAa,EAC3B,QAAQ,CAAC,EAAE,iBAAiB,GAC3B,IAAI,CA+ZN"}
+{"version":3,"file":"ws.d.ts","sourceRoot":"","sources":["../../src/hq-server/ws.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AAC/B,OAAO,EASL,KAAK,iBAAiB,EACtB,KAAK,eAAe,EAKpB,KAAK,aAAa,EAElB,KAAK,iBAAiB,EAGtB,KAAK,OAAO,EAEZ,KAAK,iBAAiB,EAEvB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,eAAe,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAmBzF,wBAAgB,aAAa,CAC3B,EAAE,EAAE,SAAS,EACb,mBAAmB,EAAE,qBAAqB,EAC1C,QAAQ,EAAE,GAAG,CAAC,SAAS,CAAC,GACvB,IAAI,CAsBN;AAID,wBAAgB,YAAY,CAC1B,EAAE,EAAE,SAAS,EACb,OAAO,EAAE,GAAG,CAAC,SAAS,EAAE,eAAe,CAAC,EACxC,QAAQ,EAAE,GAAG,CAAC,SAAS,CAAC,EACxB,QAAQ,EAAE,eAAe,EAAE,EAC3B,IAAI,EAAE;IACJ,KAAK,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC5B,iBAAiB,EAAE,MAAM,OAAO,CAAC,iBAAiB,CAAC,GAAG,SAAS,CAAC;CACjE,EACD,mBAAmB,EAAE,qBAAqB,EAC1C,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,EACxC,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,iBAAiB,EAAE,CAAC,EAC/C,WAAW,CAAC,EAAE,aAAa,EAC3B,QAAQ,CAAC,EAAE,iBAAiB,GAC3B,IAAI,CAqaN"}

package/dist/hq-server.d.ts

@@ -25,9 +25,29 @@ export interface HqServerOptions {
     clientCleanupIntervalMs?: number;
     /** Session-snapshot freshness timeout. Primarily exposed for deterministic integration tests. */
     sessionSnapshotTtlMs?: number;
-    /** Optional browser password login. When provided on first-run, the auth file stores a scrypt hash. */
+    /** Optional browser password login. Sets or rotates the scrypt hash in auth.json. */
     password?: string;
+    /**
+     * Allow a non-loopback bind while HQ is in open mode (no tokens, no
+     * password). Off by default: that pairing serves POST /api/command
+     * unauthenticated to the whole network. See assessHqExposure.
+     */
+    allowInsecureOpen?: boolean;
+    /**
+     * Set `Secure` flag on session cookies. Enable this when HQ is behind a
+     * TLS-terminating reverse proxy. Defaults to `false` because HQ speaks
+     * plain HTTP; setting `Secure` on an HTTP cookie makes it invisible to
+     * the browser.
+     */
+    secureCookies?: boolean;
+    /**
+     * Keep browser authentication enabled for the full server lifetime. Used
+     * by public relays such as --tunnel so an auth.json reload cannot silently
+     * turn an authenticated public endpoint into open mode.
+     */
+    requireBrowserAuth?: boolean;
 }
+export { HqInsecureExposureError } from '@wrongstack/core';
 export interface HqStartupConnectionInfo {
     dataDir: string;
     browserUrl: string;
@@ -37,12 +57,16 @@ export interface HqStartupConnectionInfo {
         WRONGSTACK_HQ_TOKEN?: string;
     };
     createdAuth: boolean;
+    browserTokenMode: boolean;
+    passwordMode: boolean;
 }
 export type HqFirstRunSetup = HqStartupConnectionInfo;
 export interface HqServerHandle {
     host: string;
     port: number;
     firstRunSetup?: HqFirstRunSetup;
+    /** Authorize an exact browser-facing HTTPS origin established by trusted server code. */
+    trustPublicOrigin(origin: string): void;
     close(): Promise<void>;
 }
 /**
@@ -54,6 +78,18 @@ export interface HqServerHandle {
  * or the file is absent (caller falls back to the ring).
  */
 export declare function readLocalSubagentTranscript(sessionId: string, subagentId: string): Promise<HqTranscriptEntry[] | null>;
+/**
+ * Library default: loopback. `startHqServer` is called programmatically
+ * (tests, embedders) as well as from the CLI, and a caller that never
+ * mentions a host has not asked to be reachable from the network.
+ *
+ * HQ is still the deliberate cross-machine surface — the CLI entry points
+ * (`wstack hq`, the launch menu) pass HQ_CLI_DEFAULT_HOST explicitly, so
+ * `wstack hq` binds every interface with no extra flag. Keeping the wide
+ * bind at the CLI edge rather than in this default is what stops an
+ * unrelated embedder from silently publishing HQ to its whole network.
+ */
+export declare const DEFAULT_HOST = "127.0.0.1";
 export declare const DEFAULT_PORT = 3499;
 export { HQ_HTML };
 export declare function startHqServer(options?: HqServerOptions): Promise<HqServerHandle>;

package/dist/hq-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hq-server.d.ts","sourceRoot":"","sources":["../src/hq-server.ts"],"names":[],"mappings":"AAsBA,OAAO,EAYL,KAAK,iBAAiB,EAiBvB,MAAM,kBAAkB,CAAC;AAY1B,OAAO,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;AAGjD,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;;OAIG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,8FAA8F;IAC9F,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,kGAAkG;IAClG,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,yFAAyF;IACzF,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,iGAAiG;IACjG,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,uGAAuG;IACvG,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE;QACT,iBAAiB,EAAE,MAAM,CAAC;QAC1B,mBAAmB,CAAC,EAAE,MAAM,CAAC;KAC9B,CAAC;IACF,WAAW,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,MAAM,eAAe,GAAG,uBAAuB,CAAC;AAEtD,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,CAAC,EAAE,eAAe,CAAC;IAChC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAoHD;;;;;;;GAOG;AACH,wBAAsB,2BAA2B,CAC/C,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,iBAAiB,EAAE,GAAG,IAAI,CAAC,CA4BrC;AAGD,eAAO,MAAM,YAAY,OAAO,CAAC;AAsHjC,OAAO,EAAE,OAAO,EAAE,CAAC;AAwJnB,wBAAsB,aAAa,CAAC,OAAO,GAAE,eAAoB,GAAG,OAAO,CAAC,cAAc,CAAC,CAa1F"}
+{"version":3,"file":"hq-server.d.ts","sourceRoot":"","sources":["../src/hq-server.ts"],"names":[],"mappings":"AAsBA,OAAO,EA0BL,KAAK,iBAAiB,EAevB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;AAUjD,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;;OAIG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,8FAA8F;IAC9F,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,kGAAkG;IAClG,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,yFAAyF;IACzF,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,iGAAiG;IACjG,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,qFAAqF;IACrF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;;OAKG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAE3D,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE;QACT,iBAAiB,EAAE,MAAM,CAAC;QAC1B,mBAAmB,CAAC,EAAE,MAAM,CAAC;KAC9B,CAAC;IACF,WAAW,EAAE,OAAO,CAAC;IACrB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,YAAY,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,MAAM,eAAe,GAAG,uBAAuB,CAAC;AAEtD,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,CAAC,EAAE,eAAe,CAAC;IAChC,yFAAyF;IACzF,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAkHD;;;;;;;GAOG;AACH,wBAAsB,2BAA2B,CAC/C,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,iBAAiB,EAAE,GAAG,IAAI,CAAC,CA4BrC;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,YAAY,cAAc,CAAC;AACxC,eAAO,MAAM,YAAY,OAAO,CAAC;AA8HjC,OAAO,EAAE,OAAO,EAAE,CAAC;AAgLnB,wBAAsB,aAAa,CAAC,OAAO,GAAE,eAAoB,GAAG,OAAO,CAAC,cAAc,CAAC,CAwD1F"}

package/dist/hq-tunnel.d.ts

@@ -0,0 +1,16 @@
+export interface HqQuickTunnelHandle {
+    url: string;
+    close(): Promise<void>;
+}
+export interface HqQuickTunnelOptions {
+    executable?: string | undefined;
+    timeoutMs?: number | undefined;
+    onUnexpectedExit?: ((message: string) => void) | undefined;
+}
+export declare function extractQuickTunnelUrl(output: string): string | undefined;
+/** cloudflared prints the public URL before its edge connection is usable. */
+export declare function hasRegisteredQuickTunnelConnection(output: string): boolean;
+/** Start an anonymous TryCloudflare tunnel and tie it to the HQ process lifecycle. */
+export declare function startHqQuickTunnel(originUrl: string, options?: HqQuickTunnelOptions): Promise<HqQuickTunnelHandle>;
+export declare function buildPublicHqUrl(tunnelUrl: string, localBrowserUrl: string | undefined, includeToken: boolean): string;
+//# sourceMappingURL=hq-tunnel.d.ts.map

package/dist/hq-tunnel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hq-tunnel.d.ts","sourceRoot":"","sources":["../src/hq-tunnel.ts"],"names":[],"mappings":"AAQA,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,MAAM,WAAW,oBAAoB;IACnC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,gBAAgB,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;CAC5D;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAExE;AAED,8EAA8E;AAC9E,wBAAgB,kCAAkC,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAE1E;AAMD,sFAAsF;AACtF,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,mBAAmB,CAAC,CAyF9B;AAED,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,MAAM,EACjB,eAAe,EAAE,MAAM,GAAG,SAAS,EACnC,YAAY,EAAE,OAAO,GACpB,MAAM,CAOR"}