@wrongstack/cli 0.296.4 → 0.298.0

package/dist/{chunk-TADVX644.js → chunk-GO3TJICK.js}

@@ -59,10 +59,18 @@ function startLoopbackServer(expectedState, ports, signal, callbackPath = "/auth
     if (url.pathname !== callbackPath) {
       res.statusCode = 404;
       res.setHeader("content-type", "text/html; charset=utf-8");
+      res.setHeader("content-security-policy", "default-src 'none'; style-src 'unsafe-inline'");
+      res.setHeader("x-frame-options", "DENY");
+      res.setHeader("x-content-type-options", "nosniff");
+      res.setHeader("referrer-policy", "no-referrer");
       res.end(callbackHtml(false, "Callback route not found."));
       return;
     }
     res.setHeader("content-type", "text/html; charset=utf-8");
+    res.setHeader("content-security-policy", "default-src 'none'; style-src 'unsafe-inline'");
+    res.setHeader("x-frame-options", "DENY");
+    res.setHeader("x-content-type-options", "nosniff");
+    res.setHeader("referrer-policy", "no-referrer");
     const err = url.searchParams.get("error");
     if (err) {
       res.statusCode = 400;
@@ -343,9 +351,10 @@ async function runCodexOAuthLogin(deps, opts = {}) {
     }
   };
   const external = opts.signal;
+  const onExternalAbort = () => ac.abort();
   if (external) {
     if (external.aborted) ac.abort();
-    else external.addEventListener("abort", () => ac.abort(), { once: true });
+    else external.addEventListener("abort", onExternalAbort, { once: true });
   } else {
     process.on("SIGINT", onSig);
   }
@@ -477,4 +486,4 @@ export {
   isCodexCatalogModel,
   runCodexOAuthLogin
 };
-//# sourceMappingURL=chunk-TADVX644.js.map
+//# sourceMappingURL=chunk-GO3TJICK.js.map

package/dist/{chunk-JBTFWWKV.js → chunk-I2BM6FK6.js}

@@ -6,7 +6,7 @@ import {
   openBrowser,
   runCodexOAuthLogin,
   startLoopbackServer
-} from "./chunk-TADVX644.js";
+} from "./chunk-GO3TJICK.js";
 import {
   activeLabel,
   loadConfigProviders,
@@ -408,10 +408,11 @@ async function runCopilotOAuthLogin(deps, opts = {}) {
   const providerId = opts.providerId ?? COPILOT_PROVIDER_ID;
   const ac = new AbortController();
   const onSig = () => ac.abort();
+  const onExternalAbort = () => ac.abort();
   const external = opts.signal;
   if (external) {
     if (external.aborted) ac.abort();
-    else external.addEventListener("abort", () => ac.abort(), { once: true });
+    else external.addEventListener("abort", onExternalAbort, { once: true });
   } else {
     process.on("SIGINT", onSig);
   }
@@ -457,7 +458,11 @@ async function runCopilotOAuthLogin(deps, opts = {}) {
     deps.renderer.writeError(`  Login failed: ${msg}`);
     return 1;
   } finally {
-    if (!external) process.off("SIGINT", onSig);
+    if (external) {
+      external.removeEventListener("abort", onExternalAbort);
+    } else {
+      process.off("SIGINT", onSig);
+    }
   }
 }
 async function saveCopilotTokens(deps, providerId, copilotToken, githubToken, expires, models) {
@@ -1322,4 +1327,4 @@ export {
   addKeyForProvider,
   runAuthLocal
 };
-//# sourceMappingURL=chunk-JBTFWWKV.js.map
+//# sourceMappingURL=chunk-I2BM6FK6.js.map

package/dist/{chunk-AXVZMEWG.js → chunk-I5MEUFDI.js}

@@ -1,6 +1,6 @@
 import {
   buildWin32CmdShimInvocation
-} from "./chunk-VJUEZZYB.js";
+} from "./chunk-U3SS4NRH.js";
 import {
   checkForUpdate
 } from "./chunk-F4PEGAJZ.js";
@@ -303,4 +303,4 @@ export {
   detectUpdatePackageManager,
   detectUpdatePackageName
 };
-//# sourceMappingURL=chunk-AXVZMEWG.js.map
+//# sourceMappingURL=chunk-I5MEUFDI.js.map

package/dist/{chunk-WY7KKOUK.js → chunk-JW75HY4F.js}

@@ -24,7 +24,7 @@ function warnSyncFailure(error) {
     { code: "WRONGSTACK_HQ_KANBAN_SYNC_FAILED" }
   );
 }
-function createKanbanHqSync(projectRoot, projectId = deriveHqProjectId(projectRoot)) {
+function createKanbanHqSync(projectRoot, projectId = deriveHqProjectId(projectRoot), testHooks = {}) {
   let publisher;
   let unsubscribeDaemon;
   let daemonConnectionCount = 0;
@@ -34,6 +34,9 @@ function createKanbanHqSync(projectRoot, projectId = deriveHqProjectId(projectRo
   let applyingRemote = false;
   let stopped = false;
   let operationChain = Promise.resolve();
+  let localPublishActive = false;
+  let localPublishRuns = 0;
+  let coalescedLocalRefreshes = 0;
   let pendingRemote = null;
   let remoteApplyQueued = false;
   const runExclusive = (operation) => {
@@ -53,16 +56,23 @@ function createKanbanHqSync(projectRoot, projectId = deriveHqProjectId(projectRo
     return result;
   };
   const scheduleNext = () => {
-    if (stopped || timer !== void 0 || applyingRemote) return;
+    if (stopped || timer !== void 0 || localPublishActive || applyingRemote) return;
     timer = setTimeout(() => {
       timer = void 0;
-      const rescan = fullRescanPending;
-      const dirtyBoardIds = [...pendingBoardIds];
-      fullRescanPending = false;
-      pendingBoardIds.clear();
-      runExclusive(() => publishLocal(false, rescan ? void 0 : dirtyBoardIds)).catch(
-        warnSyncFailure
-      );
+      if (stopped || localPublishActive) return;
+      localPublishActive = true;
+      void runExclusive(async () => {
+        const rescan = fullRescanPending;
+        const dirtyBoardIds = [...pendingBoardIds];
+        fullRescanPending = false;
+        pendingBoardIds.clear();
+        localPublishRuns++;
+        await testHooks.beforeLocalPublish?.();
+        await publishLocal(false, rescan ? void 0 : dirtyBoardIds);
+      }).catch(warnSyncFailure).finally(() => {
+        localPublishActive = false;
+        if (!stopped && (fullRescanPending || pendingBoardIds.size > 0)) scheduleNext();
+      });
     }, 100);
     timer.unref?.();
   };
@@ -70,6 +80,7 @@ function createKanbanHqSync(projectRoot, projectId = deriveHqProjectId(projectRo
     if (stopped || applyingRemote || publisher === void 0) return;
     if (boardId === null) fullRescanPending = true;
     else pendingBoardIds.add(boardId);
+    if (timer !== void 0 || localPublishActive) coalescedLocalRefreshes++;
     if (timer !== void 0) clearTimeout(timer);
     timer = void 0;
     scheduleNext();
@@ -238,6 +249,15 @@ function createKanbanHqSync(projectRoot, projectId = deriveHqProjectId(projectRo
     attachPublisher,
     handleRemote,
     refresh: (boardId) => schedulePublish(boardId ?? null),
+    getStats: () => ({
+      localPublishActive,
+      pendingBoardIds: pendingBoardIds.size,
+      fullRescanPending,
+      remoteApplyQueued,
+      pendingRemoteBoards: pendingRemote?.boards.length ?? 0,
+      localPublishRuns,
+      coalescedLocalRefreshes
+    }),
     stop: () => {
       stopped = true;
       if (timer !== void 0) clearTimeout(timer);
@@ -441,6 +461,7 @@ function startCliHqConnection(options) {
   }
   return {
     getPublisher: () => publisher,
+    getKanbanSyncStats: () => kanbanSync?.getStats(),
     stop: () => {
       if (timer !== void 0) {
         clearInterval(timer);
@@ -457,4 +478,4 @@ function startCliHqConnection(options) {
 export {
   startCliHqConnection
 };
-//# sourceMappingURL=chunk-WY7KKOUK.js.map
+//# sourceMappingURL=chunk-JW75HY4F.js.map

package/dist/chunk-U3SS4NRH.js

@@ -0,0 +1,10 @@
+
+// src/utils/win32-cmd.ts
+import {
+  buildWin32CmdShimInvocation
+} from "@wrongstack/core/utils";
+
+export {
+  buildWin32CmdShimInvocation
+};
+//# sourceMappingURL=chunk-U3SS4NRH.js.map

package/dist/{chunk-Z7YGASQP.js → chunk-V3XH6XBJ.js}

@@ -1,23 +1,10 @@
 
-// src/tui-thinking-word.ts
-var DEFAULT_TUI_THINKING_WORD = "thinking";
-var MAX_TUI_THINKING_WORD_LENGTH = 16;
-function normalizeTuiThinkingWord(value) {
-  if (typeof value !== "string") return DEFAULT_TUI_THINKING_WORD;
-  const word = value.trim();
-  if (word.length === 0 || word.length > MAX_TUI_THINKING_WORD_LENGTH) {
-    return DEFAULT_TUI_THINKING_WORD;
-  }
-  if (!/^[\p{L}\p{N}_-]+$/u.test(word)) return DEFAULT_TUI_THINKING_WORD;
-  return word;
-}
-
 // src/settings-menu.ts
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
-import { atomicWrite, deepMerge } from "@wrongstack/core/utils";
-import { ConfigError, ERROR_CODES, FsError } from "@wrongstack/core/types";
 import { decryptConfigSecrets, encryptConfigSecrets } from "@wrongstack/core/security";
+import { ConfigError, ERROR_CODES, FsError } from "@wrongstack/core/types";
+import { atomicWrite, deepMerge } from "@wrongstack/core/utils";
 function resolvePersistPath(deps) {
   if (deps.forceGlobal) return deps.profileConfigPath;
   const scope = deps.configStore.get().configScope;
@@ -63,12 +50,14 @@ async function mergeWithDestinationIfExists(destPath, source, vault) {
   try {
     destParsed = JSON.parse(destRaw);
   } catch (err) {
-    process.stderr.write(JSON.stringify({
-      level: "warn",
-      event: "settings_menu_merge_skipped",
-      message: `Skipping merge into corrupt destination file: ${destPath}`,
-      timestamp: (/* @__PURE__ */ new Date()).toISOString()
-    }) + "\n");
+    process.stderr.write(
+      JSON.stringify({
+        level: "warn",
+        event: "settings_menu_merge_skipped",
+        message: `Skipping merge into corrupt destination file: ${destPath}`,
+        timestamp: (/* @__PURE__ */ new Date()).toISOString()
+      }) + "\n"
+    );
     void err;
     return source;
   }
@@ -79,6 +68,7 @@ var PROJECT_SAFE_FIELDS = /* @__PURE__ */ new Set([
   "provider",
   "model",
   "fallbackModels",
+  "fallbackBridge",
   // Kept in sync with core's IN_PROJECT_ALLOWED_KEYS (config-loader.ts): these
   // model-routing prefs are explicitly safe to READ from a per-project config,
   // so the writer must not strip them — otherwise a scope=project /fallback
@@ -107,7 +97,8 @@ var PROJECT_SAFE_FIELDS = /* @__PURE__ */ new Set([
   "launch",
   "circuitBreaker",
   "adaptiveConcurrency",
-  "modelRuntime"
+  "modelRuntime",
+  "Sage"
 ]);
 function filterSafeForProject(cfg) {
   const out = {};
@@ -294,9 +285,20 @@ function clearSuggestions() {
   sharedAutoSuggestions = [];
 }
 
+// src/tui-thinking-word.ts
+var DEFAULT_TUI_THINKING_WORD = "thinking";
+var MAX_TUI_THINKING_WORD_LENGTH = 16;
+function normalizeTuiThinkingWord(value) {
+  if (typeof value !== "string") return DEFAULT_TUI_THINKING_WORD;
+  const word = value.trim();
+  if (word.length === 0 || word.length > MAX_TUI_THINKING_WORD_LENGTH) {
+    return DEFAULT_TUI_THINKING_WORD;
+  }
+  if (!/^[\p{L}\p{N}_-]+$/u.test(word)) return DEFAULT_TUI_THINKING_WORD;
+  return word;
+}
+
 export {
-  MAX_TUI_THINKING_WORD_LENGTH,
-  normalizeTuiThinkingWord,
   resolvePersistPath,
   resolveActualTarget,
   filterSafeForProject,
@@ -308,6 +310,8 @@ export {
   setAutoSuggestions,
   getSuggestions,
   removeSuggestions,
-  clearSuggestions
+  clearSuggestions,
+  MAX_TUI_THINKING_WORD_LENGTH,
+  normalizeTuiThinkingWord
 };
-//# sourceMappingURL=chunk-Z7YGASQP.js.map
+//# sourceMappingURL=chunk-V3XH6XBJ.js.map

package/dist/{chunk-BQCAJ7FI.js → chunk-XTIXVJXP.js}

@@ -257,9 +257,22 @@ async function trySaveTasksFromAIOutput(aiOutput) {
     for (const task of validTasks) addTaskToTracker(existingTracker, task);
     return true;
   }
-  const store = new DefaultTaskStore();
+  const store = sddState.getTaskStore() ?? new DefaultTaskStore();
   const tracker = new TaskTracker({ store });
-  const graph = await tracker.createGraph(session.spec.id, session.spec.title);
+  let graph;
+  try {
+    graph = await tracker.createGraph(session.spec.id, session.spec.title);
+  } catch (error) {
+    console.warn(
+      JSON.stringify({
+        level: "warn",
+        event: "sdd.task_graph_create_failed",
+        message: error instanceof Error ? error.message : String(error),
+        timestamp: (/* @__PURE__ */ new Date()).toISOString()
+      })
+    );
+    return false;
+  }
   for (const task of validTasks) addTaskToTracker(tracker, task);
   sddState.setTaskStore(store);
   sddState.setTaskTracker(tracker);
@@ -422,4 +435,4 @@ export {
   getTaskGraphId,
   getTaskTrackerExport
 };
-//# sourceMappingURL=chunk-BQCAJ7FI.js.map
+//# sourceMappingURL=chunk-XTIXVJXP.js.map