@wrongstack/cli 0.296.4 → 0.298.0

package/dist/execution-chimera-cascade.d.ts

@@ -1,3 +1,4 @@
+import type { ReviewerAttempt } from './chimera-reviewer-policy.js';
 import type { ExecuteDeps } from './execute-deps.js';
 type Director = NonNullable<ExecuteDeps['fleet']['director']>;
 type Events = ExecuteDeps['core']['events'];
@@ -9,7 +10,12 @@ export type InstallChimeraCascadeHandlerOptions = {
     session: Session;
     getPendingWork: () => PendingChimeraWork;
     setPendingWork: (work: PendingChimeraWork) => void;
+    /**
+     * Model ladder for cascade spawns. Supplied by the caller because only it
+     * holds the live config. Omit to keep the single unpinned spawn.
+     */
+    buildLadder?: (() => ReviewerAttempt[]) | undefined;
 };
-export declare function installChimeraCascadeHandler({ events, director, session, getPendingWork, setPendingWork, }: InstallChimeraCascadeHandlerOptions): void;
+export declare function installChimeraCascadeHandler({ events, director, session, getPendingWork, setPendingWork, buildLadder, }: InstallChimeraCascadeHandlerOptions): void;
 export {};
 //# sourceMappingURL=execution-chimera-cascade.d.ts.map

package/dist/execution-chimera-review.d.ts

@@ -0,0 +1,35 @@
+import { type ChimeraReviewCompletePayload } from '@wrongstack/core/plugin';
+import type { ExecuteDeps } from './execute-deps.js';
+type Director = NonNullable<ExecuteDeps['fleet']['director']>;
+type Events = ExecuteDeps['core']['events'];
+type Session = ExecuteDeps['session']['session'];
+type Mailbox = ExecuteDeps['session']['mailbox'];
+type Agent = ExecuteDeps['core']['agent'];
+type Config = ExecuteDeps['core']['config'];
+type PendingChimeraWork = Promise<void> | undefined;
+/**
+ * Canonicalize a file path for citation gating. The reviewer can cite
+ * absolute Windows paths (`D:\Codebox\...`) or mix casing on a
+ * case-insensitive filesystem; without this normalization, every citation
+ * counts as "out of scope" and the auto-fix eligibility guard silently
+ * suppresses the fix while the mailbox directive still claims findings.
+ *
+ * Exported for unit testing — the citation-gating pipeline is otherwise
+ * locked inside an event-handler closure and is not reachable from a
+ * direct test.
+ */
+export declare function normalizeFileKeyForCitation(raw: string, cwd: string): string;
+export type InstallChimeraReviewHandlerOptions = {
+    events: Events;
+    director: Director | null | undefined;
+    session: Session;
+    mailbox: Mailbox;
+    agent: Agent;
+    config: Config;
+    projectDir: string;
+    persistReview?: ((payload: ChimeraReviewCompletePayload, projectDir: string) => Promise<void>) | undefined;
+    setPendingWork: (work: PendingChimeraWork) => void;
+};
+export declare function installChimeraReviewHandler({ events, director, session, mailbox, agent, config, projectDir, persistReview, setPendingWork, }: InstallChimeraReviewHandlerOptions): void;
+export {};
+//# sourceMappingURL=execution-chimera-review.d.ts.map

package/dist/fleet/host-types.d.ts

@@ -1,4 +1,4 @@
-import type { FallbackProfileManager } from '@wrongstack/core/agent';
+import type { AgentPipelines, FallbackProfileManager } from '@wrongstack/core/agent';
 import type { BrainArbiter, ProviderModelStatusTracker } from '@wrongstack/core/coordination';
 import type { Container, EventBus } from '@wrongstack/core/kernel';
 import type { ProviderRegistry, ToolRegistry } from '@wrongstack/core/registry';
@@ -27,6 +27,11 @@ export interface MultiAgentDeps {
     renderer?: Renderer | undefined;
     /** Shared live fallback profile manager from the runtime container. */
     fallbackProfileManager: FallbackProfileManager;
+    /**
+     * Optional trusted control-plane hook installed on every in-process
+     * subagent pipeline. This is host wiring, never a model-visible capability.
+     */
+    installToolBoundary?: ((pipelines: AgentPipelines) => void) | undefined;
 }
 /**
  * Per-session options for the multi-agent host. Director Mode is always

package/dist/fleet-statusline.d.ts

@@ -54,6 +54,7 @@ export declare class FleetStatusLine {
     private rows;
     private repaintTimer;
     private tickTimer;
+    private deactivateTimer;
     private resizeCleanup;
     private lastPaint;
     private readonly onResize;

package/dist/goal-host.d.ts

@@ -41,7 +41,7 @@ export interface GoalHostDeps {
     events: EventBus;
     /** Current parent session id for worktree lifecycle events. */
     getSessionId?: (() => string | undefined) | undefined;
-    /** Directory for per-project phase-graph JSON (wpaths.projectGoal). */
+    /** Directory for per-project phase-graph engine checkpoints. */
     storeDir: string;
     /** Project root — base for git-worktree isolation. */
     projectRoot: string;

package/dist/governance-V2Z42RBE.js

@@ -0,0 +1,65 @@
+import "./chunk-7OCVIDC7.js";
+
+// src/subcommands/handlers/governance.ts
+var DEFAULT_DEPENDENCIES = {
+  readStatus: async (projectRoot) => {
+    const runtime = await import("@wrongstack/runtime/governance-bootstrap");
+    return runtime.readGovernanceDaemonOperatorStatus(projectRoot);
+  }
+};
+function usage() {
+  return "Usage:\n  wstack governance status [--json]\n\nReads the project daemon through its local read-only status capability.\nWarnings are advisory and do not stop active tasks or model execution.\n";
+}
+function jsonRequested(args, deps) {
+  return args.includes("--json") || deps.flags?.["json"] === true;
+}
+async function runGovernanceStatusCommand(args, deps, dependencies = DEFAULT_DEPENDENCIES) {
+  const json = jsonRequested(args, deps);
+  const result = await dependencies.readStatus(deps.projectRoot);
+  if (json) {
+    deps.renderer.write(`${JSON.stringify(result, null, 2)}
+`);
+    return result.available ? 0 : 1;
+  }
+  if (!result.available) {
+    deps.renderer.writeError(`Governance status unavailable (${result.code}): ${result.message}
+`);
+    return 1;
+  }
+  const { status } = result;
+  const broker = status.attachmentBroker;
+  const lines = [
+    `Governance daemon: running (pid ${status.pid}, instance ${status.instanceId})`,
+    `Attachment broker: ${broker?.health ?? "unavailable"}`,
+    `Operator signal: ${status.signal.level} (${status.signal.code})`,
+    `Operator action: ${status.signal.operatorAction}`,
+    "Execution: continue (advisory only; no automatic task or model stop)"
+  ];
+  if (broker) {
+    lines.push(`Consecutive failures: ${broker.consecutiveFailures}`);
+    lines.push(`Pending revocations: ${broker.pendingRevocations}`);
+    lines.push(`Audit persistence: ${broker.auditHealthy ? "healthy" : "unhealthy"}`);
+  }
+  deps.renderer.write(`${lines.join("\n")}
+`);
+  return 0;
+}
+var governanceCmd = async (args, deps) => {
+  const subcommand = args[0];
+  if (!subcommand || subcommand === "status") {
+    return runGovernanceStatusCommand(subcommand ? args.slice(1) : args, deps);
+  }
+  if (subcommand === "help" || subcommand === "--help" || subcommand === "-h") {
+    deps.renderer.write(usage());
+    return 0;
+  }
+  deps.renderer.writeError(`Unknown governance subcommand: ${subcommand}
+`);
+  deps.renderer.write(usage());
+  return 1;
+};
+export {
+  governanceCmd,
+  runGovernanceStatusCommand
+};
+//# sourceMappingURL=governance-V2Z42RBE.js.map

package/dist/governance-hq-telemetry.d.ts

@@ -0,0 +1,17 @@
+import type { HqGovernanceSnapshotPayload, HqPublisher } from '@wrongstack/core/hq';
+import { type GovernanceDaemonOperatorStatusReadResult } from '@wrongstack/runtime/governance-bootstrap';
+export declare const GOVERNANCE_HQ_SNAPSHOT_INTERVAL_MS = 15000;
+export interface GovernanceHqTelemetryOptions {
+    readonly publisher: Pick<HqPublisher, 'project' | 'publishEvent'>;
+    readonly projectRoot: string;
+    readonly intervalMs?: number;
+    readonly now?: () => string;
+    readonly readStatus?: (projectRoot: string) => Promise<GovernanceDaemonOperatorStatusReadResult>;
+}
+export declare function projectGovernanceHqSnapshot(projectId: string, observedAt: string, result: GovernanceDaemonOperatorStatusReadResult): HqGovernanceSnapshotPayload;
+/**
+ * Publish a compact project-owner governance observation to HQ. Failures are
+ * represented as advisory snapshots and never stop task or model execution.
+ */
+export declare function startGovernanceHqTelemetry(options: GovernanceHqTelemetryOptions): () => void;
+//# sourceMappingURL=governance-hq-telemetry.d.ts.map

package/dist/{hq-JUYKUNJX.js → hq-WO6CLUSI.js}

@@ -36,7 +36,7 @@ var hqCmd = async (args, deps) => {
   return 1;
 };
 async function startServer(deps) {
-  const { startHqServer } = await import("./hq-server-6AQ3BXZA.js");
+  const { startHqServer } = await import("./hq-server-6TSAORAC.js");
   const dataDir = resolveDataDir(deps);
   const flags = deps.flags ?? {};
   const host = typeof flags["host"] === "string" ? flags["host"] : HQ_CLI_DEFAULT_HOST;
@@ -544,4 +544,4 @@ export {
   hqCmd,
   resolveAuditActor
 };
-//# sourceMappingURL=hq-JUYKUNJX.js.map
+//# sourceMappingURL=hq-WO6CLUSI.js.map

package/dist/hq-publisher.d.ts

@@ -1,10 +1,11 @@
-import type { CreateHqPublisherOptions } from '@wrongstack/core/hq';
-import type { HqPublisher } from '@wrongstack/core/hq';
+import type { CreateHqPublisherOptions, HqPublisher } from '@wrongstack/core/hq';
+import { type KanbanHqSyncStats } from './kanban-hq-sync.js';
 type CliHqPublisherOptions = Omit<CreateHqPublisherOptions, 'socketFactory'> & {
     socketFactory?: CreateHqPublisherOptions['socketFactory'];
 };
 export interface CliHqConnection {
     getPublisher(): HqPublisher | undefined;
+    getKanbanSyncStats(): KanbanHqSyncStats | undefined;
     stop(): void;
 }
 export interface CliHqConnectionOptions extends CliHqPublisherOptions {

package/dist/hq-server/auth.d.ts

@@ -4,9 +4,11 @@
  * @module hq-server/auth
  */
 import type * as http from 'node:http';
-import type { HqSessionEntry } from './types.js';
+import type { HqRouterMutableAuth, HqSessionEntry } from './types.js';
 export declare const HQ_SESSION_COOKIE = "hq.session";
 export declare const HQ_SESSION_MAX_AGE_MS: number;
+/** Idle timeout: sessions unused for this long are rejected and evicted. */
+export declare const HQ_SESSION_IDLE_TIMEOUT_MS: number;
 export interface HqBrowserAuthContext {
     kind: 'token';
     token: string;
@@ -28,9 +30,15 @@ export type HqBrowserAuthResult = HqBrowserAuthContext | HqCookieAuthContext | u
 /**
  * The only featureful frontend is the packaged, same-origin React SPA.
  * The missing-assets recovery document contains inline CSS but no script.
+ *
+ * WS-061: `script-src` carried `'unsafe-inline'` despite that sentence above
+ * already stating nothing here needs it — verified against the built HTML,
+ * which has zero inline `<script>` elements without `src`. `style-src` keeps
+ * `'unsafe-inline'` because the recovery document's inline CSS is real, and
+ * inline style is not script execution.
  */
 export declare function setHqSecurityHeaders(res: http.ServerResponse): void;
-export declare function hasTrustedBrowserOrigin(req: http.IncomingMessage, boundHost?: string, boundPort?: number, trustedPublicOrigins?: ReadonlySet<string>): boolean;
+export declare function hasTrustedBrowserOrigin(req: http.IncomingMessage, boundHost?: string, boundPort?: number, trustedPublicOrigins?: ReadonlySet<string>, allowFileOrigin?: boolean): boolean;
 export declare function serializeHqSessionCookie(sessionId: string, secret: string): string;
 export declare function parseHqSessionCookie(value: string, secret: string): string | undefined;
 export declare function parseCookieHeader(cookieHeader: string | undefined): Record<string, string>;
@@ -38,6 +46,28 @@ export declare function setHqSessionCookie(res: http.ServerResponse, value: stri
 export declare function clearHqSessionCookie(res: http.ServerResponse, secure?: boolean): void;
 export declare function isTokenAuth(auth: HqBrowserAuthResult): auth is HqBrowserAuthContext;
 export declare function isCookieAuth(auth: HqBrowserAuthResult): auth is HqCookieAuthContext;
+/**
+ * Single source of truth for "must this HQ surface see a credential?".
+ *
+ * WS-010 introduced `requireAuthFloor` so that revoking the last credential on
+ * a running, network-reachable `wstack hq` could not silently drop it into open
+ * mode. That latch was then honoured at only three of the seven decision
+ * points. The four that open-coded their own `browserTokens.size > 0 ||
+ * passwordHash` test stayed open: the main `/api/*` gate, the mailbox gateway,
+ * the WebSocket upgrade, and `callerCanEnqueue` — which backs `/api/mailbox-send`,
+ * i.e. message injection into live agents.
+ *
+ * Any new gate MUST call this rather than re-deriving the condition; the bug
+ * was not a wrong condition but seven independent copies of it (WS-077).
+ */
+export declare function hqAuthRequired(mutableAuth: HqRouterMutableAuth, requireBrowserAuth?: boolean | undefined): boolean;
+/**
+ * The `/ws/client` counterpart. Fleet clients authenticate with `clientTokens`,
+ * which are a separate set from the browser tokens, but the same fail-closed
+ * floor applies: an all-expired client-token file must not mean "no auth
+ * configured, let anyone register as a session".
+ */
+export declare function hqClientAuthRequired(mutableAuth: HqRouterMutableAuth): boolean;
 /**
  * Constant-time membership test for a token set. Returns the matching stored
  * token (so callers can look up its metadata) or undefined. Iterates and
@@ -51,6 +81,7 @@ export declare function authenticateBrowserRequest(req: http.IncomingMessage, ur
     browserTokenObjs: Map<string, {
         id: string;
         capabilities?: string[];
+        expiresAt?: string;
     }>;
     passwordHash?: string | undefined;
     cookieSecret?: string | undefined;

package/dist/hq-server/login-attempt-store.d.ts

@@ -0,0 +1,73 @@
+/**
+ * Persistent login attempt tracker with debounced disk write-through.
+ *
+ * Replaces the in-memory `Map<string, { count, blockedUntil, lastAttempt }>`
+ * that reset on every server restart. Now an attacker who crashes or waits
+ * out the server cannot reset their lockout counter — the state survives
+ * across restarts.
+ *
+ * Storage: `~/.wrongstack/hq/login-attempts.json` (owner-only, 0o600 + icacls).
+ * The file is pruned on load (entries older than the retention window are
+ * dropped) and written back with a 500ms debounce so a burst of failed
+ * logins doesn't hammer the disk.
+ *
+ * @module hq-server/login-attempt-store
+ */
+export interface LoginAttemptEntry {
+    count: number;
+    blockedUntil: number;
+    lastAttempt: number;
+}
+export declare class LoginAttemptStore {
+    private store;
+    private writeTimer;
+    private dirty;
+    private readonly filePath;
+    private readonly debounceMs;
+    private readonly retentionMs;
+    constructor(dataDir: string, opts?: {
+        debounceMs?: number;
+        retentionMs?: number;
+    });
+    /**
+     * Load persisted state from disk and prune stale entries.
+     * Safe to call once at startup; subsequent calls reload from disk.
+     */
+    load(): Promise<void>;
+    get(key: string): LoginAttemptEntry | undefined;
+    set(key: string, entry: LoginAttemptEntry): void;
+    delete(key: string): void;
+    /**
+     * Compound rate-limit key for public-relay mode: IP + SHA-256(password).
+     * Limits how often the SAME password can be tried from different IPs,
+     * so a rotating-IP attacker can't bypass per-IP backoff.
+     */
+    static credentialKey(ip: string, password: string): string;
+    /**
+     * Check both IP and credential keys; return the stricter (later blockedUntil).
+     */
+    checkBlocked(ip: string, password: string): {
+        blocked: boolean;
+        retryAfter: number;
+    };
+    /**
+     * Record a failed attempt on both IP and credential keys.
+     * Returns the updated IP entry (for the response Retry-After header).
+     */
+    recordFailure(ip: string, password: string, maxBackoffMs?: number): LoginAttemptEntry;
+    /**
+     * Clear both IP and credential entries on successful login.
+     */
+    clearOnSuccess(ip: string, password: string): void;
+    /** Number of tracked entries (for diagnostics). */
+    get size(): number;
+    /**
+     * Flush pending writes immediately. Called on server shutdown.
+     */
+    flush(): Promise<void>;
+    private scheduleWrite;
+    private writeToDisk;
+    /** Iterate entries (for cleanup timers). */
+    entries(): IterableIterator<[string, LoginAttemptEntry]>;
+}
+//# sourceMappingURL=login-attempt-store.d.ts.map

package/dist/hq-server/routes/auth-handlers.d.ts

@@ -1,12 +1,9 @@
 import type * as http from 'node:http';
 import { type HqAlertRuleConfig, type HqRedactionPolicy, type HqToken } from '@wrongstack/core/hq';
+import type { LoginAttemptStore } from '../login-attempt-store.js';
 import type { HqRouterMutableAuth, HqSessionEntry } from '../types.js';
 export declare function handleApiAuthStatus(req: http.IncomingMessage, res: http.ServerResponse, url: URL, mutableAuth: HqRouterMutableAuth, sessions: Map<string, HqSessionEntry>, requireBrowserAuth: boolean | undefined, trustedPublicOrigins: Set<string>, secureCookies: boolean | undefined): Promise<void>;
-export declare function handleApiLogin(req: http.IncomingMessage, res: http.ServerResponse, mutableAuth: HqRouterMutableAuth, sessions: Map<string, HqSessionEntry>, loginAttempts: Map<string, {
-    count: number;
-    blockedUntil: number;
-    lastAttempt: number;
-}>, secureCookies: boolean | undefined): Promise<void>;
+export declare function handleApiLogin(req: http.IncomingMessage, res: http.ServerResponse, mutableAuth: HqRouterMutableAuth, sessions: Map<string, HqSessionEntry>, loginAttempts: LoginAttemptStore, secureCookies: boolean | undefined): Promise<void>;
 export declare function handleApiLogout(req: http.IncomingMessage, res: http.ServerResponse, mutableAuth: HqRouterMutableAuth, sessions: Map<string, HqSessionEntry>, secureCookies: boolean | undefined): Promise<void>;
 export declare function handleApiPassword(req: http.IncomingMessage, res: http.ServerResponse, mutableAuth: HqRouterMutableAuth, sessions: Map<string, HqSessionEntry>, dataDir: string, secureCookies: boolean | undefined, requireBrowserAuth: boolean | undefined): Promise<void>;
 export declare function applyAuthFile(mutableAuth: HqRouterMutableAuth, next: {
@@ -14,12 +11,83 @@ export declare function applyAuthFile(mutableAuth: HqRouterMutableAuth, next: {
         token: string;
         id: string;
         capabilities?: string[];
+        expiresAt?: string;
     }>;
     clientTokens?: Array<HqToken>;
     redactionPolicy?: Partial<HqRedactionPolicy>;
     passwordHash?: string;
     cookieSecret?: string;
     alertRules?: HqAlertRuleConfig;
+    totpSecret?: string;
+    totpPendingSecret?: string;
+    totpRecoveryCodes?: string[];
 }): void;
 export declare function handleApiBootstrap(req: http.IncomingMessage, res: http.ServerResponse, mutableAuth: HqRouterMutableAuth, sessions: Map<string, HqSessionEntry>, secureCookies: boolean | undefined, bootstrapStore: import('@wrongstack/core/hq').HqBootstrapCodeStore): Promise<void>;
+/**
+ * WS-065 — exchange a live browser token for an HttpOnly session cookie.
+ *
+ * The bootstrap flow above already gives fresh startup URLs a cookie and never
+ * persists a client-side credential. What it does not cover is the *legacy*
+ * paths: an older `?token=` startup URL, and manual token entry in the token
+ * gate. Both leave the raw token in `sessionStorage`, where any script on the
+ * origin can read it. This endpoint lets the SPA complete that migration on
+ * its own — authenticate once with the token it already holds, receive a
+ * cookie, and delete the stored copy.
+ *
+ * The minted session is exactly the one `handleApiBootstrap` mints: `kind:
+ * 'token'` carrying the source token's id. That matters because
+ * `authenticateBrowserRequest` re-resolves a token-origin session's
+ * capabilities from the LIVE token record on every request, so upgrading
+ * grants nothing the token did not already grant and dies the moment the token
+ * is revoked. No privilege boundary is crossed: the caller proved possession
+ * of the token, and the cookie is strictly weaker (HttpOnly, same-origin,
+ * server-expiring).
+ */
+export declare function handleApiTokenUpgrade(req: http.IncomingMessage, res: http.ServerResponse, url: URL, mutableAuth: HqRouterMutableAuth, sessions: Map<string, HqSessionEntry>, secureCookies: boolean | undefined): Promise<void>;
+/**
+ * POST `/api/login/verify` — complete 2FA for a pending-2FA session.
+ * Accepts either a TOTP `code` or a `recoveryCode`. On success, the pending
+ * session is upgraded to a full session (pending2fa cleared). Recovery codes
+ * are single-use: the matched hash is removed from `auth.json` on success.
+ */
+export declare function handleApiLoginVerify(req: http.IncomingMessage, res: http.ServerResponse, _url: URL, mutableAuth: HqRouterMutableAuth, sessions: Map<string, HqSessionEntry>, loginAttempts: LoginAttemptStore, dataDir: string, secureCookies: boolean | undefined): Promise<void>;
+/**
+ * POST `/api/auth/totp/setup` — generate a new TOTP secret (not yet active).
+ * Returns the base32 secret + otpauth URI for QR display. The secret is
+ * persisted as `totpPendingSecret` — login does NOT check this field, so
+ * an unconfirmed setup cannot lock the operator out. 2FA becomes active
+ * only after `/api/auth/totp/enable` verifies a code.
+ *
+ * Requires existing auth (cookie or token) — only the operator can set up 2FA.
+ */
+export declare function handleApiTotpSetup(req: http.IncomingMessage, res: http.ServerResponse, mutableAuth: HqRouterMutableAuth, sessions: Map<string, HqSessionEntry>, dataDir: string): Promise<void>;
+/**
+ * POST `/api/auth/totp/enable` — confirm 2FA enrollment by providing a valid
+ * TOTP code. Promotes `totpPendingSecret` → `totpSecret` (active), generates
+ * and returns recovery codes (shown once). After this, 2FA is required for
+ * password login.
+ */
+export declare function handleApiTotpEnable(req: http.IncomingMessage, res: http.ServerResponse, mutableAuth: HqRouterMutableAuth, sessions: Map<string, HqSessionEntry>, dataDir: string): Promise<void>;
+/**
+ * POST `/api/auth/totp/disable` — remove TOTP 2FA entirely. Requires the
+ * current password (or a valid TOTP code) as confirmation.
+ */
+export declare function handleApiTotpDisable(req: http.IncomingMessage, res: http.ServerResponse, mutableAuth: HqRouterMutableAuth, sessions: Map<string, HqSessionEntry>, loginAttempts: LoginAttemptStore, dataDir: string): Promise<void>;
+/**
+ * GET `/api/auth/sessions` — list all active browser sessions for the
+ * session-management UI. Returns each session's kind, creation time,
+ * last-seen time, and a truncated ID (never the full session ID — that
+ * would allow cookie forgery since the session ID IS the cookie value).
+ */
+export declare function handleApiAuthSessions(_req: http.IncomingMessage, res: http.ServerResponse, mutableAuth: HqRouterMutableAuth, sessions: Map<string, HqSessionEntry>): void;
+/**
+ * DELETE `/api/auth/sessions/:id` — revoke a single session by ID.
+ * DELETE `/api/auth/sessions` — revoke ALL sessions (force logout everyone).
+ */
+export declare function handleApiAuthSessionsRevoke(_req: http.IncomingMessage, res: http.ServerResponse, url: URL, sessions: Map<string, HqSessionEntry>): Promise<void>;
+/**
+ * GET `/api/auth/audit` — recent auth events for the audit panel.
+ * Returns the last 50 entries from auth-audit.jsonl, newest first.
+ */
+export declare function handleApiAuthAudit(_req: http.IncomingMessage, res: http.ServerResponse, dataDir: string): void;
 //# sourceMappingURL=auth-handlers.d.ts.map

package/dist/hq-server/routes.d.ts

@@ -21,6 +21,7 @@ export declare const hasTrustedBrowserOrigin: typeof HqServerAuth.hasTrustedBrow
 export declare const authenticateBrowserRequest: typeof HqServerAuth.authenticateBrowserRequest;
 export declare const isTokenAuth: typeof HqServerAuth.isTokenAuth;
 export declare const isCookieAuth: typeof HqServerAuth.isCookieAuth;
+export declare const hqAuthRequired: typeof HqServerAuth.hqAuthRequired;
 export declare const setHqSessionCookie: typeof HqServerAuth.setHqSessionCookie;
 export declare const clearHqSessionCookie: typeof HqServerAuth.clearHqSessionCookie;
 export declare const serializeHqSessionCookie: typeof HqServerAuth.serializeHqSessionCookie;
@@ -40,6 +41,7 @@ export declare const readLocalSubagentTranscript: typeof HqServerUtils.readLocal
 export declare const lanIPv4Addresses: typeof HqServerUtils.lanIPv4Addresses;
 export declare const hqRuntimeMarkerPath: typeof HqServerUtils.hqRuntimeMarkerPath;
 import type { ConnectedClient, HqRouterMutableAuth, HqSessionEntry, HqSnapshotBroadcaster, ProjectDetail, TranscriptRing } from './types.js';
+import type { LoginAttemptStore } from './login-attempt-store.js';
 export type { ConnectedClient, HqSnapshotBroadcaster, ProjectDetail, TranscriptRing, };
 export interface HqRouterMailboxGateway {
     mailbox: Mailbox;
@@ -50,13 +52,11 @@ export interface HqRouterDeps {
     host: string;
     listeningPort: number;
     trustedPublicOrigins: Set<string>;
+    /** Trust `Origin: file://`. Off by default — see StartHqServerOptions (WS-081). */
+    allowFileOrigin?: boolean | undefined;
     mutableAuth: HqRouterMutableAuth;
     sessions: Map<string, HqSessionEntry>;
-    loginAttempts: Map<string, {
-        count: number;
-        blockedUntil: number;
-        lastAttempt: number;
-    }>;
+    loginAttempts: LoginAttemptStore;
     clients: Map<WebSocket, ConnectedClient>;
     browsers: Set<WebSocket>;
     eventLog: HqEventEnvelope[];

package/dist/hq-server/types.d.ts

@@ -3,9 +3,9 @@
  *
  * @module hq-server/types
  */
-import type { HqAlertRuleConfig, HqBrowserMessage, HqClientCapability, HqClientRecord, HqEventEnvelope, HqFleetSnapshotPayload, HqMailboxSnapshotPayload, HqMcpServerHealth, HqPersistence, HqProjectIdentity, HqProjectRecord, HqQueuedCommand, HqRedactionPolicy, HqSessionSnapshotPayload, HqToken, HqTranscriptEntry } from '@wrongstack/core/hq';
+import type { HqAlertRuleConfig, HqBrowserMessage, HqClientCapability, HqClientRecord, HqEventEnvelope, HqFleetSnapshotPayload, HqGovernanceSnapshotPayload, HqMailboxSnapshotPayload, HqMcpServerHealth, HqPersistence, HqProjectIdentity, HqProjectRecord, HqQueuedCommand, HqRedactionPolicy, HqSessionSnapshotPayload, HqToken, HqTranscriptEntry } from '@wrongstack/core/hq';
 import type { WebSocket } from 'ws';
-export type { HqBrowserMessage, HqClientCapability, HqClientRecord, HqEventEnvelope, HqFleetSnapshotPayload, HqMailboxSnapshotPayload, HqMcpServerHealth, HqPersistence, HqProjectIdentity, HqProjectRecord, HqQueuedCommand, HqRedactionPolicy, HqSessionSnapshotPayload, HqToken, HqTranscriptEntry, };
+export type { HqBrowserMessage, HqClientCapability, HqClientRecord, HqEventEnvelope, HqFleetSnapshotPayload, HqGovernanceSnapshotPayload, HqMailboxSnapshotPayload, HqMcpServerHealth, HqPersistence, HqProjectIdentity, HqProjectRecord, HqQueuedCommand, HqRedactionPolicy, HqSessionSnapshotPayload, HqToken, HqTranscriptEntry, };
 export interface TrackedSessionSnapshot {
     payload: HqSessionSnapshotPayload;
     /** Epoch ms of the last `session.snapshot` refresh — freshness authority for the cleanup timer. */
@@ -48,8 +48,21 @@ export interface ConnectedClient {
         servers: HqMcpServerHealth[];
         receivedAt: number;
     }>;
+    /** Latest read-only governance advisory accepted from this project's leader. */
+    governanceSnapshot?: {
+        payload: HqGovernanceSnapshotPayload;
+        receivedAt: number;
+    };
     /** Pending outbound commands (Phase 3 — control plane). */
     commandQueue: HqQueuedCommand[];
+    /**
+     * Whether this client is the project's leader (the client with
+     * `control.receive` capability that other clients coordinate with).
+     * Live tracking lives in `HqServer`; this field is the snapshot.
+     * Used by the leader-deposed detector in `peer.rehydrate` emission.
+     * Defaults to `false` for clients without `control.receive`.
+     */
+    isLeader: boolean;
 }
 export interface HqRouterMutableAuth {
     operatorPolicy: HqRedactionPolicy;
@@ -59,11 +72,27 @@ export interface HqRouterMutableAuth {
     browserTokenObjs: Map<string, {
         id: string;
         capabilities?: string[];
+        expiresAt?: string;
     }>;
     clientTokenObjs: Map<string, HqToken>;
     passwordHash?: string | undefined;
     cookieSecret?: string | undefined;
+    /** Base32-encoded TOTP secret for HQ 2FA (live-reloaded from auth.json). */
+    totpSecret?: string | undefined;
+    /** Pending TOTP secret (setup but not yet confirmed by enable). */
+    totpPendingSecret?: string | undefined;
+    /** SHA-256 hashes of single-use recovery codes (live-reloaded from auth.json). */
+    totpRecoveryCodes?: string[] | undefined;
     alertRules: HqAlertRuleConfig | undefined;
+    /**
+     * WS-010: set when the live bind would become unauthenticated and
+     * network-reachable. `assessHqExposure` runs at startup only, so revoking the
+     * last credential on a running `wstack hq` (default bind 0.0.0.0) silently
+     * dropped it into open mode — the kill switch acted as an unlock. When this
+     * is true, routes keep demanding auth even though no credential remains, so
+     * the surface fails closed instead of opening up.
+     */
+    requireAuthFloor?: boolean | undefined;
 }
 /**
  * Session record stored in the server-side `sessions` Map.
@@ -80,6 +109,19 @@ export interface HqSessionEntry {
     readonly tokenId?: string | undefined;
     /** For token sessions: capabilities inherited from the source token. */
     readonly capabilities?: string[] | undefined;
+    /**
+     * Set when a password login passed but 2FA verification is still pending.
+     * The session is valid but must NOT be treated as fully authenticated —
+     * only `/api/login/verify` may consume it. Other routes should reject it.
+     * Short-lived: `PENDING_2FA_TTL_MS` bounds it (5 min).
+     */
+    readonly pending2fa?: boolean | undefined;
+    /**
+     * Last time this session was used (epoch ms). Bumped on every authenticated
+     * request to implement idle-timeout (sliding expiration). Sessions idle for
+     * longer than `HQ_SESSION_IDLE_TIMEOUT_MS` are rejected and evicted.
+     */
+    lastSeenAt: number;
 }
 export interface TranscriptRing {
     entries: HqTranscriptEntry[];

package/dist/hq-server/utils.d.ts

@@ -35,8 +35,51 @@ export declare function agentMessageToEntry(p: Record<string, unknown>): HqTrans
  * or the file is absent (caller falls back to the ring).
  */
 export declare function readLocalSubagentTranscript(sessionId: string, subagentId: string): Promise<HqTranscriptEntry[] | null>;
-/** Safe URL-decoding — returns null on malformed input. */
+/**
+ * Percent-decode ONE URL path segment and reject anything that is not a safe
+ * single path component.
+ *
+ * WS-019: this used to be `decodeURIComponent` and nothing else, and its
+ * output is joined straight onto a filesystem path in
+ * {@link readLocalSubagentTranscript}. `%2e%2e%2f` decodes to `../`, so a
+ * request could walk out of the session's transcript directory and read any
+ * `transcript.jsonl` on the machine — other projects' sessions included.
+ * Percent-decoding is the step that CREATES the traversal, so validating
+ * before decoding would have checked the wrong string.
+ *
+ * The rule is a whole path component or nothing: no separators, no `.`/`..`,
+ * no NUL, no drive-letter colon, non-empty, and length-bounded. Real ids are
+ * generated tokens, so nothing legitimate is excluded.
+ */
 export declare function decodePathSegment(value: string): string | null;
+/**
+ * Percent-decode a session id that may contain a date-shard separator.
+ *
+ * Session ids are `YYYY-MM-DD/sess_<ULID>` (see `generateSessionId`), so a
+ * literal `/` is legitimate. This decoder allows that one shape while still
+ * blocking traversal (`..`, backslash, NUL, drive-relative forms). The
+ * resolved-path containment check in {@link readLocalSubagentTranscript}
+ * is the second lock.
+ */
+export declare function decodeSessionId(value: string): string | null;
+/**
+ * True when `value` is usable as exactly one filesystem path component.
+ *
+ * Exported so the traversal rule has one definition — a second copy is how a
+ * guard and its callers drift apart, which is the shape of several findings in
+ * this audit.
+ */
+export declare function isSafePathSegment(value: string): boolean;
+/**
+ * Session IDs are `YYYY-MM-DD/sess_<ULID>` — one forward slash is the
+ * date-shard separator. Legacy flat ids (no slash) remain readable too
+ * (`generateSessionId` in core/storage/session-id.ts), so accept one OR two
+ * components while blocking everything that {@link isSafePathSegment} blocks:
+ * no backslash, NUL, or drive-relative colon; no `.`/`..`; no empty component;
+ * no deeper nesting (three or more components). The resolved-path containment
+ * check in `sessionScopedPath` (core/utils) is the second lock.
+ */
+export declare function isSafeSessionId(value: string): boolean;
 /** Normalize display host — "0.0.0.0" prints as "127.0.0.1" for user-facing URLs. */
 export declare function displayHost(host: string): string;
 /** Read the full body of an HTTP request as a UTF-8 string (capped at 1 MB). */
@@ -69,10 +112,12 @@ export declare function hqMachineKey(hostname: string | undefined, machineId: st
  */
 export declare function recordTimeseriesSignal(persistence: HqPersistence, event: HqEventEnvelope): void;
 /**
- * Coerce a thrown error into a safe, opaque message for HTTP/JSON API
- * responses. Raw error strings (file paths, environment details, stack
- * fragments) are never forwarded to the browser — only a stable category.
- * The original error is logged server-side by the caller.
+ * Re-exported from `@wrongstack/core/security`.
+ *
+ * WS-066: this used to be an HQ-local implementation, which is why the WebUI
+ * and SimpleUI servers — which have the same JSON-API surface — never adopted
+ * it and forwarded `String(err)` verbatim instead. One implementation now
+ * serves every server surface.
  */
-export declare function sanitizeApiError(err: unknown): string;
+export { sanitizeApiError, scrubErrorDetail } from '@wrongstack/core/security';
 //# sourceMappingURL=utils.d.ts.map