@wrongstack/cli 0.298.3 → 0.300.0

package/dist/hq-server/routes.d.ts

@@ -16,6 +16,7 @@ import type { createMailboxHttpRouter } from '@wrongstack/core/coordination';
 import { type Mailbox, type MailboxHttpAccessDecision, type MailboxHttpRateLimiter } from '@wrongstack/core/coordination';
 import * as HqServerAuth from './auth.js';
 import * as HqServerUtils from './utils.js';
+import { type ApplyHqAuthFile } from './routes/auth-handlers.js';
 export declare const setHqSecurityHeaders: typeof HqServerAuth.setHqSecurityHeaders;
 export declare const hasTrustedBrowserOrigin: typeof HqServerAuth.hasTrustedBrowserOrigin;
 export declare const authenticateBrowserRequest: typeof HqServerAuth.authenticateBrowserRequest;
@@ -77,6 +78,18 @@ export interface HqRouterDeps {
     getTokenStats?: (() => HqSnapshot['totals']['tokenStats'] | undefined) | undefined;
     /** One-time bootstrap code store for token-to-cookie exchange. */
     bootstrapStore?: import('@wrongstack/core/hq').HqBootstrapCodeStore | undefined;
+    /**
+     * Applies a freshly-persisted `auth.json` to live server state. Bound to
+     * `HqAuthState.apply` so the in-process mutation routes share one projection
+     * — and one WS-010 exposure re-assessment — with the reload watcher.
+     */
+    applyAuthFile: ApplyHqAuthFile;
+    /**
+     * How many trusted reverse proxies sit in front of this server. Only used to
+     * resolve the address the login backoff keys on — see `client-address.ts`.
+     * Defaults to 0, which ignores `X-Forwarded-For` entirely.
+     */
+    trustedProxyHops?: number | undefined;
 }
 /**
  * Create the HTTP request listener that handles all `/api/*` routes as well

package/dist/hq-server/types.d.ts

@@ -83,6 +83,16 @@ export interface HqRouterMutableAuth {
     totpPendingSecret?: string | undefined;
     /** SHA-256 hashes of single-use recovery codes (live-reloaded from auth.json). */
     totpRecoveryCodes?: string[] | undefined;
+    /**
+     * Highest TOTP time-step counter already spent on a successful login
+     * (RFC 6238 §5.2 single-use). The ±1-step validation window keeps a code
+     * arithmetically valid for ~90s, so without this a code captured in transit
+     * — shoulder-surfed, read off a notification, replayed from a proxy log —
+     * authenticates a second time. Deliberately process-local and NOT persisted
+     * to auth.json: a code cannot outlive its own window, so a restart losing
+     * the marker costs at most the tail of one step.
+     */
+    totpLastUsedCounter?: number | undefined;
     alertRules: HqAlertRuleConfig | undefined;
     /**
      * WS-010: set when the live bind would become unauthenticated and

package/dist/{hq-server-6TSAORAC.js → hq-server-DQHLNHDL.js}

@@ -15,7 +15,7 @@ import {
   readLocalSubagentTranscript,
   sanitizeApiError,
   startHqServer
-} from "./chunk-C5GH4YBL.js";
+} from "./chunk-GYDQABMA.js";
 import "./chunk-Q5GTM25S.js";
 import "./chunk-7OCVIDC7.js";
 export {
@@ -36,4 +36,4 @@ export {
   sanitizeApiError,
   startHqServer
 };
-//# sourceMappingURL=hq-server-6TSAORAC.js.map
+//# sourceMappingURL=hq-server-DQHLNHDL.js.map

package/dist/hq-server.d.ts

@@ -60,6 +60,25 @@ export interface HqServerOptions {
      * `--hq-token-ttl-ms` CLI flag.
      */
     tokenTtlMs?: number;
+    /**
+     * How many trusted reverse proxies sit between a browser and this server.
+     * Controls which address the login backoff keys on (WS-106).
+     *
+     * Default `0`: `X-Forwarded-For` is ignored entirely and the socket peer is
+     * used — correct for a direct bind, and the only safe default, because the
+     * header is client-supplied and honouring it unasked would let an attacker
+     * mint a fresh rate-limit identity per request.
+     *
+     * Set it to the real hop count when HQ runs behind a tunnel or relay
+     * (`--hq-public-url`, `--hq-require-browser-auth`). Without it every request
+     * arrives from the tunnel's own address, so all users share one backoff
+     * bucket: one attacker locks out everyone, and a distributed attacker is not
+     * limited per-source at all. `1` covers the common single-tunnel case.
+     *
+     * Only the rightmost `n` forwarded entries are ever read — see
+     * `hq-server/client-address.ts`. Set via `--hq-trusted-proxy-hops`.
+     */
+    trustedProxyHops?: number;
 }
 export interface HqStartupConnectionInfo {
     dataDir: string;

package/dist/index.js

@@ -13,20 +13,20 @@ import {
 import {
   patchConfig
 } from "./chunk-TYO2OVAD.js";
+import {
+  DEFAULT_PORT
+} from "./chunk-GYDQABMA.js";
+import "./chunk-Q5GTM25S.js";
 import {
   helpCmd,
   versionCmd
 } from "./chunk-ARWGQUB3.js";
-import {
-  discoverAndMergeProviders
-} from "./chunk-TGDHN4LM.js";
-import {
-  DEFAULT_PORT
-} from "./chunk-C5GH4YBL.js";
-import "./chunk-Q5GTM25S.js";
 import {
   CLI_VERSION
 } from "./chunk-XJXDOF63.js";
+import {
+  discoverAndMergeProviders
+} from "./chunk-4GVH7V3S.js";
 import {
   runUpdateCommand
 } from "./chunk-I5MEUFDI.js";
@@ -36,11 +36,11 @@ import {
   parseArgs,
   runPicker,
   saveToGlobalConfig
-} from "./chunk-ZNZJ34RF.js";
+} from "./chunk-PEMN4T5O.js";
 import {
   isKeylessLocalProvider,
   visibleModelIds
-} from "./chunk-66T43Q4Y.js";
+} from "./chunk-N7ULWBO5.js";
 import {
   mutateConfigProviders,
   normalizeKeys,
@@ -1495,9 +1495,9 @@ function compactSingleLine(text) {
 
 // src/subcommands/index.ts
 var loaders = {
-  acp: async () => (await import("./acp-S4LZQB66.js")).acpCmd,
+  acp: async () => (await import("./acp-IDNS2YVE.js")).acpCmd,
   init: async () => (await import("./init-E2NDDOHI.js")).initCmd,
-  auth: async () => (await import("./auth-G5YKKSRH.js")).authCmd,
+  auth: async () => (await import("./auth-6T6ZOT2R.js")).authCmd,
   update: async () => (await import("./update-MV6TUACD.js")).updateCmd,
   sessions: async () => (await import("./sessions-config-NLCMK3BY.js")).sessionsCmd,
   config: async () => (await import("./sessions-config-NLCMK3BY.js")).configCmd,
@@ -1506,23 +1506,23 @@ var loaders = {
   audit: async () => (await import("./audit-2ZSFGNIF.js")).auditCmd,
   tools: async () => (await import("./tools-skills-UNKLOB7M.js")).toolsCmd,
   skills: async () => (await import("./tools-skills-UNKLOB7M.js")).skillsCmd,
-  providers: async () => (await import("./providers-models-GDELBHZK.js")).providersCmd,
-  models: async () => (await import("./providers-models-GDELBHZK.js")).modelsCmd,
+  providers: async () => (await import("./providers-models-K6RT7ABI.js")).providersCmd,
+  models: async () => (await import("./providers-models-K6RT7ABI.js")).modelsCmd,
   mcp: async () => (await import("./mcp-CYLPUEHC.js")).mcpCmd,
-  plugin: async () => (await import("./plugin-usage-VTL7ZTVC.js")).pluginCmd,
-  plugins: async () => (await import("./plugin-usage-VTL7ZTVC.js")).pluginCmd,
+  plugin: async () => (await import("./plugin-usage-EOG4ET4S.js")).pluginCmd,
+  plugins: async () => (await import("./plugin-usage-EOG4ET4S.js")).pluginCmd,
   diag: async () => (await import("./diag-doctor-OQ3AA63O.js")).diagCmd,
   doctor: async () => (await import("./diag-doctor-OQ3AA63O.js")).doctorCmd,
   export: async () => (await import("./export-TPORYVRZ.js")).exportCmd,
-  usage: async () => (await import("./plugin-usage-VTL7ZTVC.js")).usageCmd,
+  usage: async () => (await import("./plugin-usage-EOG4ET4S.js")).usageCmd,
   version: async () => (await import("./version-help-ASKQYXDJ.js")).versionCmd,
   help: async () => (await import("./version-help-ASKQYXDJ.js")).helpCmd,
   projects: async () => (await import("./projects-XE76NFNZ.js")).projectsCmd,
-  modeldiag: async () => (await import("./modeldiag-HENYJ4N7.js")).modeldiagCmd,
+  modeldiag: async () => (await import("./modeldiag-YOQZHBQV.js")).modeldiagCmd,
   quick: async () => (await import("./quick-VIO2BEHS.js")).quickCmd,
   bench: async () => (await import("./bench-7ZDWSNEF.js")).benchCmd,
   chronicle: async () => (await import("./chronicle-QQEQFSSE.js")).chronicleCmd,
-  hq: async () => (await import("./hq-WO6CLUSI.js")).hqCmd,
+  hq: async () => (await import("./hq-DVDD4XPV.js")).hqCmd,
   mailbox: async () => (await import("./mailbox-serve-DBOOOOWZ.js")).mailboxServeCmd,
   permissions: async () => (await import("./permissions-FNYLZIL4.js")).permissionsCmd,
   project: async () => (await import("./project-BLQ3ALVL.js")).projectCmd,
@@ -2159,7 +2159,7 @@ async function isPortInUse(host, port) {
 }
 async function handleHqShortCircuit(flags) {
   if (flags["hq"] !== true) return null;
-  const { startHqServer } = await import("./hq-server-6TSAORAC.js");
+  const { startHqServer } = await import("./hq-server-DQHLNHDL.js");
   const tunnelRequested = flags["tunnel"] === true;
   const host = typeof flags["host"] === "string" ? flags["host"] : tunnelRequested ? "127.0.0.1" : HQ_CLI_DEFAULT_HOST;
   if (tunnelRequested && !isLoopbackHost(host)) {
@@ -3149,7 +3149,7 @@ async function initializeCli(argv) {
 async function main(argv) {
   const cliCtx = await initializeCli(argv);
   if (typeof cliCtx === "number") return cliCtx;
-  const { runInteractive } = await import("./cli-main-ZDZMCVLM.js");
+  const { runInteractive } = await import("./cli-main-7B3G2YSG.js");
   return runInteractive(cliCtx);
 }
 

package/dist/{modeldiag-HENYJ4N7.js → modeldiag-YOQZHBQV.js}

@@ -1,6 +1,6 @@
 import {
   discoverAndMergeProviders
-} from "./chunk-TGDHN4LM.js";
+} from "./chunk-4GVH7V3S.js";
 import {
   mutateConfigProviders,
   normalizeKeys,
@@ -1287,4 +1287,4 @@ ${color2.dim('Enter numbers or provider IDs (comma-separated, or "all"):')}
 export {
   modeldiagCmd
 };
-//# sourceMappingURL=modeldiag-HENYJ4N7.js.map
+//# sourceMappingURL=modeldiag-YOQZHBQV.js.map

package/dist/{plugin-usage-VTL7ZTVC.js → plugin-usage-EOG4ET4S.js}

@@ -1,6 +1,6 @@
 import {
   runPluginManagementCommand
-} from "./chunk-PEKUKUCH.js";
+} from "./chunk-3MWUZMOL.js";
 import {
   activeProfileConfigPath
 } from "./chunk-DPJZQCVP.js";
@@ -37,4 +37,4 @@ export {
   pluginCmd,
   usageCmd
 };
-//# sourceMappingURL=plugin-usage-VTL7ZTVC.js.map
+//# sourceMappingURL=plugin-usage-EOG4ET4S.js.map

package/dist/{plugins-ETY6W3DC.js → plugins-56CMWMPR.js}

@@ -7,8 +7,8 @@ import {
   pluginNameFromSpec,
   setupPlugins,
   warnIfDeprecatedPluginName
-} from "./chunk-4U3DMA2Y.js";
-import "./chunk-PEKUKUCH.js";
+} from "./chunk-4WJKVQJY.js";
+import "./chunk-3MWUZMOL.js";
 import "./chunk-TYO2OVAD.js";
 import "./chunk-7OCVIDC7.js";
 export {
@@ -21,4 +21,4 @@ export {
   setupPlugins,
   warnIfDeprecatedPluginName
 };
-//# sourceMappingURL=plugins-ETY6W3DC.js.map
+//# sourceMappingURL=plugins-56CMWMPR.js.map

package/dist/{providers-models-GDELBHZK.js → providers-models-K6RT7ABI.js}

@@ -1,6 +1,6 @@
 import {
   visibleModelIds
-} from "./chunk-66T43Q4Y.js";
+} from "./chunk-N7ULWBO5.js";
 import {
   mutateConfigProviders
 } from "./chunk-PJHET45A.js";
@@ -127,7 +127,7 @@ var modelsCmd = async (args, deps) => {
       return 1;
     }
   }
-  const flags = parseFlags(args);
+  const flags = subcommandFlags(args, deps);
   const search = typeof flags["search"] === "string" ? flags["search"].toLowerCase() : "";
   const perPage = Number(flags["per-page"]) > 0 ? Number(flags["per-page"]) : DEFAULT_PER_PAGE;
   const page = Math.max(1, Number(flags["page"]) || 1);
@@ -138,10 +138,10 @@ var modelsCmd = async (args, deps) => {
     );
     return 1;
   }
-  let lookupId = providerId;
-  const savedAlias = deps.config.providers?.[providerId];
-  if (savedAlias?.type && savedAlias.type !== providerId) lookupId = savedAlias.type;
-  const provider = await deps.modelsRegistry.getProvider(lookupId);
+  const { providerId: lookupId, provider } = await getCatalogProviderForConfigProvider(
+    providerId,
+    deps
+  );
   if (!provider) {
     deps.renderer.writeError(
       lookupId !== providerId ? `Alias "${providerId}" points at catalog id "${lookupId}" which is not in the cache.` : `Provider "${providerId}" not in catalog.`
@@ -234,11 +234,33 @@ ${navLines.join(" \xB7 ")}
 function aliasProviderId(configProviderId, cfg) {
   return cfg?.type && cfg.type !== configProviderId ? cfg.type : configProviderId;
 }
+async function discoverProviderModels(deps, ids) {
+  if (!("mergeOverlay" in deps.modelsRegistry)) return void 0;
+  try {
+    const { discoverAndMergeProviders } = await import("./auto-discover-providers-DRW4OZHG.js");
+    await discoverAndMergeProviders({
+      config: deps.config,
+      registry: deps.modelsRegistry,
+      cacheDir: deps.paths.cacheDir
+    });
+  } catch {
+    return void 0;
+  }
+  for (const id of ids) {
+    const found = await deps.modelsRegistry.getProvider(id);
+    if (found) return found;
+  }
+  return void 0;
+}
 async function getCatalogProviderForConfigProvider(providerId, deps) {
   const cfg = deps.config.providers?.[providerId];
   const lookupId = aliasProviderId(providerId, cfg);
   const provider = await deps.modelsRegistry.getProvider(lookupId);
-  return { providerId: lookupId, provider };
+  if (provider) return { providerId: lookupId, provider };
+  return {
+    providerId: lookupId,
+    provider: await discoverProviderModels(deps, [lookupId, providerId])
+  };
 }
 function uniqueStrings(values) {
   return [...new Set(values.map((v) => v.trim()).filter(Boolean))];
@@ -478,13 +500,16 @@ function parseSizeFlag(raw) {
   if (unit === "k") return Math.round(num * 1e3);
   return Math.round(num);
 }
+function subcommandFlags(args, deps) {
+  return { ...deps.flags ?? {}, ...parseFlags(args) };
+}
 function parseBoolFlag(flags, key) {
   if (flags[key] === true || flags[key] === "true") return true;
   if (flags[`no-${key}`] !== void 0) return false;
   return void 0;
 }
 async function modelsAdd(args, deps) {
-  const flags = parseFlags(args);
+  const flags = subcommandFlags(args, deps);
   const pos = positionals(args);
   const modelId = pos[0];
   if (!modelId) {
@@ -586,4 +611,4 @@ export {
   modelsCmd,
   providersCmd
 };
-//# sourceMappingURL=providers-models-GDELBHZK.js.map
+//# sourceMappingURL=providers-models-K6RT7ABI.js.map

package/dist/slash-commands/command-context.d.ts

@@ -130,6 +130,25 @@ export interface SlashCommandContext {
      * Get live coordinator status for /fleet. Returns null when no fleet is active.
      */
     onFleetStatus?: (() => import('@wrongstack/core/types').CoordinatorStatus | null) | undefined;
+    /**
+     * Read-only concurrency + lifetime spawn budget for `/fleet status`.
+     * Returns null when no fleet host is available.
+     */
+    onFleetBudget?: (() => {
+        maxConcurrent: number;
+        activeAgents: number;
+        maxSpawns: number;
+        usedSpawns: number;
+        remainingSpawns: number;
+        maxTokens?: number | undefined;
+        usedTokens?: number | undefined;
+        remainingTokens?: number | undefined;
+        maxCostUsd?: number | undefined;
+        usedCostUsd?: number | undefined;
+        remainingCostUsd?: number | undefined;
+        checkpointMaxSpawns?: number | undefined;
+        ceilingMismatch?: boolean | undefined;
+    } | null) | undefined;
     /**
      * Get fleet usage summary for /fleet usage.
      */

package/dist/slash-commands/intake.d.ts

@@ -0,0 +1,4 @@
+import type { SlashCommand } from '@wrongstack/core/types';
+import type { SlashCommandContext } from './command-context.js';
+export declare function buildIntakeCommand(opts: SlashCommandContext): SlashCommand;
+//# sourceMappingURL=intake.d.ts.map

package/dist/slash-commands/memory-triage.d.ts

@@ -0,0 +1,47 @@
+/**
+ * `/memory triage` slash command.
+ *
+ * Runs the SAGE Memory Triage pipeline (Phase 1 → 2 → 3 → 4 → 5):
+ *   1. preFilter     → keep / discard / uncertain
+ *   2. valueScore    → 0-100 numeric score
+ *   3. LLM triage    → gray-zone evaluation (1-5)
+ *   4. merge detect  → cluster + pair LLM comparison
+ *   5. dispatch      → auto-apply updates + proposals
+ *
+ * Flags:
+ *   --dry-run  (default)  Print what would happen. No state changes.
+ *   --apply                Execute auto-apply updates and file proposals.
+ *   --limit N              Max memories to process (default: all active).
+ *   --max-phase3 N         Max LLM calls for Phase 3 (default: 1000).
+ *   --max-phase4-pairs N   Max pairs for Phase 4 (default: 50).
+ *
+ * Transport: `opts.llmProvider` (Provider.complete) — same pattern as
+ * `/memory compact`. Falls back to a no-op LLM if the provider is absent
+ * (Phase 3 and 4 will degrade to skip-only; report is still useful).
+ */
+import type { SageSurface, CreateCandidateInput } from '@wrongstack/sage';
+import { type TriageReport } from '@wrongstack/sage';
+import type { SlashCommandContext } from './command-context.js';
+export declare function runTriageCommand(opts: SlashCommandContext, args: string[]): Promise<{
+    message: string;
+}>;
+export interface ProposalFileResult {
+    filed: number;
+    failed: number;
+    total: number;
+    failures: Array<{
+        memoryId: string;
+        error: string;
+    }>;
+    /** All inputs that were submitted to Sage.createCandidate, for test verification. */
+    inputs: CreateCandidateInput[];
+}
+/**
+ * File triage proposals as MemoryCandidates via the Sage surface.
+ *
+ * Exported for unit testing — the round-trip path through
+ * Sage.createCandidate is the key contract: every proposal must
+ * surface in `/memory candidates` for human review.
+ */
+export declare function fileProposals(Sage: SageSurface, proposals: TriageReport['dispatch']['proposals']): Promise<ProposalFileResult>;
+//# sourceMappingURL=memory-triage.d.ts.map

package/dist/webui-server/setup-events.d.ts

@@ -29,6 +29,23 @@ export interface SetupEventsDeps {
     eventUnsubscribers: Array<() => void>;
     globalConfigPath?: string | undefined;
     onFleetBroadcaster?: ((fn: () => Promise<void>) => void) | undefined;
+    /**
+     * Live fleet budget snapshot (issue #323). Merged into
+     * `fleet.concurrency_update` so the WebUI can show used/remaining spawns
+     * without a probe spawn.
+     */
+    getFleetBudget?: (() => {
+        maxSpawns?: number | undefined;
+        usedSpawns?: number | undefined;
+        remainingSpawns?: number | undefined;
+        maxConcurrent?: number | undefined;
+        activeAgents?: number | undefined;
+        maxSpawnsSource?: string | undefined;
+        maxConcurrentSource?: string | undefined;
+        effectiveSource?: string | undefined;
+        checkpointMaxSpawns?: number | undefined;
+        ceilingMismatch?: boolean | undefined;
+    } | null) | undefined;
 }
 /** CLI adapter around the canonical EventBus→WebSocket subscription graph. */
 export declare function createSetupEvents(deps: SetupEventsDeps): () => void;

package/dist/webui-server/terminal-log-view.d.ts

@@ -6,25 +6,42 @@ interface ConsoleTarget {
     error: ConsoleMethod;
     debug: ConsoleMethod;
 }
-export interface BoundedTerminalLogViewOptions {
-    maxLines?: number | undefined;
-    refreshMs?: number | undefined;
+export interface QuietSurfaceConsoleOptions {
     isTTY?: boolean | undefined;
+    /** Pass everything through untouched (the `WEBUI_VERBOSE=1` escape hatch). */
+    verbose?: boolean | undefined;
     consoleTarget?: ConsoleTarget | undefined;
-    write?: ((chunk: string) => void) | undefined;
-    setIntervalFn?: ((callback: () => void, delay: number) => NodeJS.Timeout) | undefined;
-    clearIntervalFn?: ((timer: NodeJS.Timeout) => void) | undefined;
+    /** Ring-buffer size for {@link QuietSurfaceConsole.recent}. */
+    bufferLines?: number | undefined;
 }
-export interface BoundedTerminalLogView {
+export interface QuietSurfaceConsole {
+    /** `false` when the console was left untouched (non-TTY or verbose). */
     readonly enabled: boolean;
-    redraw(): void;
+    /** Chatter lines dropped from the terminal so far. */
+    readonly mutedCount: number;
+    /** Newest muted lines, oldest first — for a diagnostic dump on failure. */
+    recent(): readonly string[];
     stop(): void;
 }
 /**
- * Periodically redraw an interactive WebUI/SimpleUI terminal with only its
- * newest physical log lines. Non-TTY output is deliberately untouched so
- * redirected output and log collectors retain the complete append-only log.
+ * Keep an interactive WebUI/SimpleUI terminal quiet while the browser owns
+ * the output surface.
+ *
+ * Two things fill that terminal, and this handles both:
+ *
+ *   - **Chatter.** Every `console.log`/`info`/`debug` from the server is
+ *     progress the browser already shows. Those are dropped from the
+ *     terminal (still counted, and the newest are kept in memory for a
+ *     failure dump); `console.warn`/`error` are forwarded untouched.
+ *
+ *   - **Repetition.** A warning that fires on a timer used to append an
+ *     identical line every tick until the terminal was pages deep in the
+ *     same text. Consecutive identical lines now collapse into a single
+ *     `↑ previous line repeated N×` notice emitted when the streak ends.
+ *
+ * Non-TTY output is deliberately untouched so redirected output and log
+ * collectors retain the complete append-only log, as is `WEBUI_VERBOSE=1`.
  */
-export declare function startBoundedTerminalLogView(options?: BoundedTerminalLogViewOptions): BoundedTerminalLogView;
+export declare function startQuietSurfaceConsole(options?: QuietSurfaceConsoleOptions): QuietSurfaceConsole;
 export {};
 //# sourceMappingURL=terminal-log-view.d.ts.map