@wrongstack/cli 0.297.0 → 0.298.0

package/dist/{chunk-TADVX644.js → chunk-GO3TJICK.js}

@@ -59,10 +59,18 @@ function startLoopbackServer(expectedState, ports, signal, callbackPath = "/auth
     if (url.pathname !== callbackPath) {
       res.statusCode = 404;
       res.setHeader("content-type", "text/html; charset=utf-8");
+      res.setHeader("content-security-policy", "default-src 'none'; style-src 'unsafe-inline'");
+      res.setHeader("x-frame-options", "DENY");
+      res.setHeader("x-content-type-options", "nosniff");
+      res.setHeader("referrer-policy", "no-referrer");
       res.end(callbackHtml(false, "Callback route not found."));
       return;
     }
     res.setHeader("content-type", "text/html; charset=utf-8");
+    res.setHeader("content-security-policy", "default-src 'none'; style-src 'unsafe-inline'");
+    res.setHeader("x-frame-options", "DENY");
+    res.setHeader("x-content-type-options", "nosniff");
+    res.setHeader("referrer-policy", "no-referrer");
     const err = url.searchParams.get("error");
     if (err) {
       res.statusCode = 400;
@@ -343,9 +351,10 @@ async function runCodexOAuthLogin(deps, opts = {}) {
     }
   };
   const external = opts.signal;
+  const onExternalAbort = () => ac.abort();
   if (external) {
     if (external.aborted) ac.abort();
-    else external.addEventListener("abort", () => ac.abort(), { once: true });
+    else external.addEventListener("abort", onExternalAbort, { once: true });
   } else {
     process.on("SIGINT", onSig);
   }
@@ -477,4 +486,4 @@ export {
   isCodexCatalogModel,
   runCodexOAuthLogin
 };
-//# sourceMappingURL=chunk-TADVX644.js.map
+//# sourceMappingURL=chunk-GO3TJICK.js.map

package/dist/{chunk-JBTFWWKV.js → chunk-I2BM6FK6.js}

@@ -6,7 +6,7 @@ import {
   openBrowser,
   runCodexOAuthLogin,
   startLoopbackServer
-} from "./chunk-TADVX644.js";
+} from "./chunk-GO3TJICK.js";
 import {
   activeLabel,
   loadConfigProviders,
@@ -408,10 +408,11 @@ async function runCopilotOAuthLogin(deps, opts = {}) {
   const providerId = opts.providerId ?? COPILOT_PROVIDER_ID;
   const ac = new AbortController();
   const onSig = () => ac.abort();
+  const onExternalAbort = () => ac.abort();
   const external = opts.signal;
   if (external) {
     if (external.aborted) ac.abort();
-    else external.addEventListener("abort", () => ac.abort(), { once: true });
+    else external.addEventListener("abort", onExternalAbort, { once: true });
   } else {
     process.on("SIGINT", onSig);
   }
@@ -457,7 +458,11 @@ async function runCopilotOAuthLogin(deps, opts = {}) {
     deps.renderer.writeError(`  Login failed: ${msg}`);
     return 1;
   } finally {
-    if (!external) process.off("SIGINT", onSig);
+    if (external) {
+      external.removeEventListener("abort", onExternalAbort);
+    } else {
+      process.off("SIGINT", onSig);
+    }
   }
 }
 async function saveCopilotTokens(deps, providerId, copilotToken, githubToken, expires, models) {
@@ -1322,4 +1327,4 @@ export {
   addKeyForProvider,
   runAuthLocal
 };
-//# sourceMappingURL=chunk-JBTFWWKV.js.map
+//# sourceMappingURL=chunk-I2BM6FK6.js.map

package/dist/{chunk-AXVZMEWG.js → chunk-I5MEUFDI.js}

@@ -1,6 +1,6 @@
 import {
   buildWin32CmdShimInvocation
-} from "./chunk-VJUEZZYB.js";
+} from "./chunk-U3SS4NRH.js";
 import {
   checkForUpdate
 } from "./chunk-F4PEGAJZ.js";
@@ -303,4 +303,4 @@ export {
   detectUpdatePackageManager,
   detectUpdatePackageName
 };
-//# sourceMappingURL=chunk-AXVZMEWG.js.map
+//# sourceMappingURL=chunk-I5MEUFDI.js.map

package/dist/chunk-U3SS4NRH.js

@@ -0,0 +1,10 @@
+
+// src/utils/win32-cmd.ts
+import {
+  buildWin32CmdShimInvocation
+} from "@wrongstack/core/utils";
+
+export {
+  buildWin32CmdShimInvocation
+};
+//# sourceMappingURL=chunk-U3SS4NRH.js.map

package/dist/{chunk-QZKWRNIP.js → chunk-V3XH6XBJ.js}

@@ -2,9 +2,9 @@
 // src/settings-menu.ts
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
-import { atomicWrite, deepMerge } from "@wrongstack/core/utils";
-import { ConfigError, ERROR_CODES, FsError } from "@wrongstack/core/types";
 import { decryptConfigSecrets, encryptConfigSecrets } from "@wrongstack/core/security";
+import { ConfigError, ERROR_CODES, FsError } from "@wrongstack/core/types";
+import { atomicWrite, deepMerge } from "@wrongstack/core/utils";
 function resolvePersistPath(deps) {
   if (deps.forceGlobal) return deps.profileConfigPath;
   const scope = deps.configStore.get().configScope;
@@ -50,12 +50,14 @@ async function mergeWithDestinationIfExists(destPath, source, vault) {
   try {
     destParsed = JSON.parse(destRaw);
   } catch (err) {
-    process.stderr.write(JSON.stringify({
-      level: "warn",
-      event: "settings_menu_merge_skipped",
-      message: `Skipping merge into corrupt destination file: ${destPath}`,
-      timestamp: (/* @__PURE__ */ new Date()).toISOString()
-    }) + "\n");
+    process.stderr.write(
+      JSON.stringify({
+        level: "warn",
+        event: "settings_menu_merge_skipped",
+        message: `Skipping merge into corrupt destination file: ${destPath}`,
+        timestamp: (/* @__PURE__ */ new Date()).toISOString()
+      }) + "\n"
+    );
     void err;
     return source;
   }
@@ -66,6 +68,7 @@ var PROJECT_SAFE_FIELDS = /* @__PURE__ */ new Set([
   "provider",
   "model",
   "fallbackModels",
+  "fallbackBridge",
   // Kept in sync with core's IN_PROJECT_ALLOWED_KEYS (config-loader.ts): these
   // model-routing prefs are explicitly safe to READ from a per-project config,
   // so the writer must not strip them — otherwise a scope=project /fallback
@@ -311,4 +314,4 @@ export {
   MAX_TUI_THINKING_WORD_LENGTH,
   normalizeTuiThinkingWord
 };
-//# sourceMappingURL=chunk-QZKWRNIP.js.map
+//# sourceMappingURL=chunk-V3XH6XBJ.js.map