@wrongstack/cli 0.299.0 → 0.301.0

package/dist/{acp-S4LZQB66.js → acp-DATHHPNT.js}

@@ -3,8 +3,8 @@ import {
   loadCachedAcpRegistry,
   refreshAcpRegistry,
   setupProvider
-} from "./chunk-4HH3YGG4.js";
-import "./chunk-GO3TJICK.js";
+} from "./chunk-MRLYDHQ7.js";
+import "./chunk-PYTFS4MC.js";
 import "./chunk-PJHET45A.js";
 import "./chunk-7OCVIDC7.js";
 
@@ -32,13 +32,14 @@ import { WebSocketServer } from "ws";
 
 // src/acp-server-agent.ts
 import { Agent, Context, createDefaultPipelines } from "@wrongstack/core/agent";
-import { AutoApprovePermissionPolicy, ToolCapabilities } from "@wrongstack/core/security";
-import { DefaultLogger } from "@wrongstack/core/infrastructure";
+import { ToolExecutor } from "@wrongstack/core/execution";
+import { DefaultLogger, DefaultTokenCounter } from "@wrongstack/core/infrastructure";
 import { EventBus, TOKENS } from "@wrongstack/core/kernel";
-import { ToolValidationError } from "@wrongstack/core/types";
 import { ToolRegistry } from "@wrongstack/core/registry";
-import { DefaultTokenCounter } from "@wrongstack/core/infrastructure";
-import { ToolExecutor } from "@wrongstack/core/execution";
+import { AutoApprovePermissionPolicy, ToolCapabilities } from "@wrongstack/core/security";
+import {
+  ToolValidationError
+} from "@wrongstack/core/types";
 import { createDefaultContainer } from "@wrongstack/runtime";
 var AcpServerConfigError = class extends Error {
   constructor(message) {
@@ -123,7 +124,8 @@ function makeAcpRead(base, api) {
     mutating: false,
     execute: async (input) => {
       const i = input ?? {};
-      if (!i.path) throw new ToolValidationError({ message: "read: path is required", field: "path" });
+      if (!i.path)
+        throw new ToolValidationError({ message: "read: path is required", field: "path" });
       const content = await api.readTextFile({
         path: i.path,
         ...typeof i.offset === "number" ? { line: i.offset } : {},
@@ -142,7 +144,8 @@ function makeAcpWrite(base, api) {
     ...base,
     execute: async (input) => {
       const i = input ?? {};
-      if (!i.path) throw new ToolValidationError({ message: "write: path is required", field: "path" });
+      if (!i.path)
+        throw new ToolValidationError({ message: "write: path is required", field: "path" });
       await api.writeTextFile({ path: i.path, content: i.content ?? "" });
       return { path: i.path, ok: true };
     }
@@ -153,8 +156,13 @@ function makeAcpEdit(base, api) {
     ...base,
     execute: async (input) => {
       const i = input ?? {};
-      if (!i.path) throw new ToolValidationError({ message: "edit: path is required", field: "path" });
-      if (!i.old_string) throw new ToolValidationError({ message: "edit: old_string is required", field: "old_string" });
+      if (!i.path)
+        throw new ToolValidationError({ message: "edit: path is required", field: "path" });
+      if (!i.old_string)
+        throw new ToolValidationError({
+          message: "edit: old_string is required",
+          field: "old_string"
+        });
       const before = await api.readTextFile({ path: i.path });
       const occurrences = before.split(i.old_string).length - 1;
       if (occurrences === 0) {
@@ -182,7 +190,8 @@ function makeAcpBash(base, api) {
     ...base,
     execute: async (input) => {
       const i = input ?? {};
-      if (!i.command) throw new ToolValidationError({ message: "bash: command is required", field: "command" });
+      if (!i.command)
+        throw new ToolValidationError({ message: "bash: command is required", field: "command" });
       const { output, exitCode } = await api.runTerminal({
         command: "sh",
         args: ["-c", i.command],
@@ -219,8 +228,7 @@ function buildAcpServerAgentFactory(deps, options = {}) {
     const { provider, providerRegistry } = await bootProvider();
     const events = new EventBus();
     const source = deps.toolRegistry ?? new ToolRegistry();
-    const tools = new ToolRegistry();
-    for (const t of source.list()) tools.register(t);
+    const tools = source.clone();
     if (api) {
       wireClientBackedTools(tools, api);
     }
@@ -242,7 +250,7 @@ function buildAcpServerAgentFactory(deps, options = {}) {
       projectRoot: cwd,
       allowOutsideProjectRoot: config.features?.allowOutsideProjectRoot ?? false,
       model: config.model,
-      tools: [...tools.list()],
+      tools: [...tools.listForProvider()],
       agentId: "acp-server",
       agentName: "wrongstack-acp"
     });
@@ -481,7 +489,12 @@ async function runACPWebSocketServer(deps, port) {
         return;
       }
       transport.receive(msg);
-      void handler.handleMessage(msg);
+      void handler.handleMessage(msg).catch((err) => {
+        deps.renderer.writeWarning(
+          `ACP: failed to handle message: ${err instanceof Error ? err.message : String(err)}
+`
+        );
+      });
     });
     const teardown = () => {
       handler.close();
@@ -499,6 +512,12 @@ async function runACPWebSocketServer(deps, port) {
   await new Promise((resolve) => {
     const shutdown = () => {
       deps.renderer.writeWarning("\nShutting down ACP WebSocket server...");
+      for (const client of wss.clients) {
+        try {
+          client.terminate();
+        } catch {
+        }
+      }
       wss.close();
       resolve();
     };
@@ -889,4 +908,4 @@ ${renderAcpBenchText(result)}
 export {
   acpCmd
 };
-//# sourceMappingURL=acp-S4LZQB66.js.map
+//# sourceMappingURL=acp-DATHHPNT.js.map

package/dist/acp-server-agent.d.ts

@@ -13,9 +13,9 @@
  * belong in the interactive host. The ACP server is a headless single-turn
  * surface; a future PR can layer richer session behaviour if needed.
  */
+import type { RunTurnApi } from '@wrongstack/acp/agent';
 import { Agent } from '@wrongstack/core/agent';
 import { type Logger, type PermissionDecision, type PermissionPolicy, type Tool } from '@wrongstack/core/types';
-import type { RunTurnApi } from '@wrongstack/acp/agent';
 import type { SubcommandDeps } from './subcommands/index.js';
 /**
  * Error thrown when the server cannot start because no model provider is

package/dist/{audit-2ZSFGNIF.js → audit-QRCLEHHW.js}

@@ -1,9 +1,13 @@
+import {
+  restoreFlags
+} from "./chunk-CSAPOCBP.js";
 import "./chunk-7OCVIDC7.js";
 
 // src/subcommands/handlers/audit.ts
 import { color, resolveWstackPaths } from "@wrongstack/core/utils";
 import { ToolAuditLog } from "@wrongstack/core/storage";
 var auditCmd = async (args, deps) => {
+  args = restoreFlags(args, deps, ["list", "l"]);
   const wpaths = resolveWstackPaths({
     projectRoot: deps.projectRoot,
     userHome: deps.userHome
@@ -99,4 +103,4 @@ async function listAudits(log, dir, deps) {
 export {
   auditCmd
 };
-//# sourceMappingURL=audit-2ZSFGNIF.js.map
+//# sourceMappingURL=audit-QRCLEHHW.js.map

package/dist/{auth-G5YKKSRH.js → auth-JASC4K3F.js}

@@ -13,12 +13,12 @@ import {
   runOAuthLoginKind,
   runOAuthLoginMenu,
   validateFamily
-} from "./chunk-L5CE52XW.js";
+} from "./chunk-O7XNGCRT.js";
 import {
   parseAuthFlags
-} from "./chunk-ZNZJ34RF.js";
-import "./chunk-66T43Q4Y.js";
-import "./chunk-GO3TJICK.js";
+} from "./chunk-MHF2IJDE.js";
+import "./chunk-ETOEGL3V.js";
+import "./chunk-PYTFS4MC.js";
 import {
   loadConfigProviders,
   maskedKey,
@@ -27,14 +27,17 @@ import {
   nowIso,
   writeKeysBack
 } from "./chunk-PJHET45A.js";
-import "./chunk-YWUPHRGB.js";
+import {
+  restoreFlags
+} from "./chunk-CSAPOCBP.js";
+import "./chunk-263G3FMB.js";
 import {
   activeProfileConfigPath
-} from "./chunk-DPJZQCVP.js";
+} from "./chunk-YMXXOOFN.js";
 import "./chunk-7OCVIDC7.js";
 
 // src/subcommands/handlers/auth.ts
-import { color as color3 } from "@wrongstack/core/utils";
+import { color as color4 } from "@wrongstack/core/utils";
 
 // src/auth-menu/direct.ts
 async function runAuthDirect(deps, opts) {
@@ -311,8 +314,94 @@ ${color2.amber("?")} Pick: `)).trim().toLowerCase();
   }
 }
 
+// src/subcommands/handlers/auth-local-help.ts
+import { color as color3 } from "@wrongstack/core/utils";
+var LOCAL_AUTH_FLAGS = [
+  {
+    flag: "--name <ollama|vllm|lmstudio>",
+    description: "Pick a preset (skip the interactive picker). Defaults to the first run; set this for scripting."
+  },
+  {
+    flag: "--base-url <url>",
+    description: "Override the preset default (e.g. `http://gpu-host:8000/v1` for a remote vLLM). Empty falls back to the preset."
+  },
+  {
+    flag: "--no-key / --skip-key",
+    description: "Skip the API-key prompt even for presets that accept one. Use for non-TTY scripted setups."
+  },
+  {
+    flag: "--no-probe / --skip-probe",
+    description: "Skip the health probe. Use when the local server is not running yet but the config must be persisted."
+  },
+  {
+    flag: "--probe-only",
+    description: "Run the probe and report, do not save. Use to re-check a previously-saved provider."
+  },
+  {
+    flag: "--model <spec> / -m <spec>",
+    description: "Pre-populate the saved `models` allowlist. `--model first` / `<N>` consume the probe; `<csv>` is a literal list; bare `--model` clears the allowlist."
+  },
+  {
+    flag: "--audit [target]",
+    description: "Emit JSONL audit events for the save lifecycle. Bare / `stdout` \u2192 stdout; `stderr` \u2192 stderr; `<path>` \u2192 file. Default is silent."
+  }
+];
+var LOCAL_FLAG_COLUMN_WIDTH = 38;
+var LOCAL_AUTH_HELP_USAGE = "wstack auth local [--name <id>] [--base-url <url>] [--no-key] [--no-probe|--probe-only] [--model <spec>] [--audit [target]]";
+function wantsLocalHelp(args) {
+  return args.includes("--help") || args.includes("-h");
+}
+function renderAuthLocalHelpToString() {
+  const lines = [
+    color3.bold("wstack auth local \u2014 quick-add Ollama / vLLM / LM Studio"),
+    color3.dim("  Pre-fills the base URL, runs a health probe (`GET /v1/models`),"),
+    color3.dim("  and persists the allowlist so you can `wstack --provider <id>`"),
+    color3.dim("  right away. Use `--no-probe` to skip when the local server is not"),
+    color3.dim("  running yet; use `--audit <file>` to capture the save lifecycle."),
+    "",
+    color3.bold("Usage"),
+    `  ${LOCAL_AUTH_HELP_USAGE}`,
+    "",
+    color3.bold("Flags")
+  ];
+  for (const { flag, description } of LOCAL_AUTH_FLAGS) {
+    const padded = flag.padEnd(LOCAL_FLAG_COLUMN_WIDTH, " ");
+    lines.push(`  ${color3.cyan(padded)}${description}`);
+  }
+  lines.push("");
+  lines.push(color3.dim("  See also: `wstack --help` for the top-level command list."));
+  lines.push(
+    color3.dim(
+      "  Examples: `wstack auth local --name ollama --no-probe --model 'llama3.1:8b'`"
+    )
+  );
+  lines.push(
+    color3.dim(
+      "            `wstack auth local --name ollama --audit /var/log/wstack-auth.jsonl`"
+    )
+  );
+  return lines.join("\n") + "\n";
+}
+
 // src/subcommands/handlers/auth.ts
 var authCmd = async (args, deps) => {
+  args = restoreFlags(args, deps, [
+    "label",
+    "family",
+    "base-url",
+    "env",
+    // `auth local` flags — see the `local` branch below.
+    "name",
+    "no-key",
+    "skip-key",
+    "no-probe",
+    "skip-probe",
+    "probe-only",
+    "model",
+    "m",
+    "help",
+    "h"
+  ]);
   const flags = parseAuthFlags(args);
   const profileConfigPath = activeProfileConfigPath(deps.paths, deps.config);
   const menuDeps = {
@@ -329,6 +418,30 @@ var authCmd = async (args, deps) => {
   if (first === "list" || first === "ls") {
     return runAuthList(menuDeps);
   }
+  if (first === "local") {
+    if (wantsLocalHelp(args)) {
+      deps.renderer.write(`${renderAuthLocalHelpToString()}
+`);
+      return 0;
+    }
+    const value = (name) => {
+      const i = args.indexOf(`--${name}`);
+      return i >= 0 ? args[i + 1] : void 0;
+    };
+    const has = (...names) => names.some((n) => args.includes(`--${n}`));
+    const modelIdx = args.indexOf("--model") >= 0 ? args.indexOf("--model") : args.indexOf("-m");
+    return runAuthLocal(menuDeps, {
+      name: flags.positional[1] ?? value("name"),
+      baseUrl: flags.baseUrl ?? value("base-url"),
+      label: flags.label,
+      skipKey: has("no-key", "skip-key"),
+      noProbe: has("no-probe", "skip-probe"),
+      probeOnly: has("probe-only"),
+      // Bare `--model` (no value, or followed by another flag) clears the
+      // allowlist, which is why an empty string is meaningful here.
+      ...modelIdx >= 0 ? { models: args[modelIdx + 1]?.startsWith("-") ? "" : args[modelIdx + 1] ?? "" } : {}
+    });
+  }
   if (first === "status") {
     const pid = flags.positional[1];
     if (!pid) {
@@ -352,7 +465,7 @@ var authCmd = async (args, deps) => {
     if (kind) return runOAuthLoginKind(menuDeps, kind);
     deps.renderer.writeError("OAuth login is only supported for ChatGPT, Claude, and GitHub Copilot.");
     deps.renderer.write(
-      color3.dim("  Sign in with ChatGPT: ") + color3.bold("wstack auth login chatgpt") + "\n" + color3.dim("  Sign in with Claude:  ") + color3.bold("wstack auth login claude") + "\n" + color3.dim("  Sign in with Copilot: ") + color3.bold("wstack auth login copilot") + "\n" + color3.dim("  For an API key instead: ") + color3.bold(`wstack auth ${pid}`) + "\n"
+      color4.dim("  Sign in with ChatGPT: ") + color4.bold("wstack auth login chatgpt") + "\n" + color4.dim("  Sign in with Claude:  ") + color4.bold("wstack auth login claude") + "\n" + color4.dim("  Sign in with Copilot: ") + color4.bold("wstack auth login copilot") + "\n" + color4.dim("  For an API key instead: ") + color4.bold(`wstack auth ${pid}`) + "\n"
     );
     return 1;
   }
@@ -375,14 +488,14 @@ async function runAuthList(deps) {
   const ids = Object.keys(providers).sort();
   if (ids.length === 0) {
     deps.renderer.write(
-      `${color3.dim("No providers configured.")}
-${color3.dim("Run")} ${color3.bold("wstack auth")} ${color3.dim("to add one.")}
+      `${color4.dim("No providers configured.")}
+${color4.dim("Run")} ${color4.bold("wstack auth")} ${color4.dim("to add one.")}
 `
     );
     return 0;
   }
   deps.renderer.write(`
-${color3.bold("Saved providers")} ${color3.dim(`(${ids.length})`)}
+${color4.bold("Saved providers")} ${color4.dim(`(${ids.length})`)}
 
 `);
   for (const id of ids) {
@@ -390,34 +503,34 @@ ${color3.bold("Saved providers")} ${color3.dim(`(${ids.length})`)}
     if (!cfg) continue;
     const keys = normalizeKeys(cfg);
     const active = cfg.activeKey ?? keys[0]?.label;
-    const famTag = cfg.family ? `${cfg.family}` : color3.amber("no-family");
-    const aliasHint = cfg.type && cfg.type !== id ? color3.dim(` (\u2192 ${cfg.type})`) : "";
-    const modelHint = cfg.models && cfg.models.length > 0 ? color3.dim(` [${cfg.models.length} models]`) : "";
-    deps.renderer.write(`  ${color3.bold(id)}${aliasHint}
+    const famTag = cfg.family ? `${cfg.family}` : color4.amber("no-family");
+    const aliasHint = cfg.type && cfg.type !== id ? color4.dim(` (\u2192 ${cfg.type})`) : "";
+    const modelHint = cfg.models && cfg.models.length > 0 ? color4.dim(` [${cfg.models.length} models]`) : "";
+    deps.renderer.write(`  ${color4.bold(id)}${aliasHint}
 `);
     deps.renderer.write(
-      `    family:  ${famTag}  baseUrl: ${cfg.baseUrl ?? color3.dim("unset")}${modelHint}
+      `    family:  ${famTag}  baseUrl: ${cfg.baseUrl ?? color4.dim("unset")}${modelHint}
 `
     );
     if (keys.length === 0) {
-      deps.renderer.write(`    ${color3.amber("no keys")}
+      deps.renderer.write(`    ${color4.amber("no keys")}
 `);
     } else {
       deps.renderer.write(
-        `    ${color3.dim(`${keys.length} key${keys.length === 1 ? "" : "s"}:`)}
+        `    ${color4.dim(`${keys.length} key${keys.length === 1 ? "" : "s"}:`)}
 `
       );
       for (const k of keys) {
-        const marker = k.label === active ? color3.green("\u25CF") : color3.dim("\u25CB");
+        const marker = k.label === active ? color4.green("\u25CF") : color4.dim("\u25CB");
         deps.renderer.write(
-          `      ${marker} ${k.label.padEnd(18)} ${maskedKey(k.apiKey)}  ${color3.dim(k.createdAt)}
+          `      ${marker} ${k.label.padEnd(18)} ${maskedKey(k.apiKey)}  ${color4.dim(k.createdAt)}
 `
         );
       }
     }
     deps.renderer.write("\n");
   }
-  deps.renderer.write(color3.dim(`Manage: wstack auth   Add key: wstack auth <provider>
+  deps.renderer.write(color4.dim(`Manage: wstack auth   Add key: wstack auth <provider>
 `));
   return 0;
 }
@@ -433,7 +546,7 @@ async function runAuthStatus(deps, providerId) {
   if (!cfg) {
     deps.renderer.writeError(`Provider "${providerId}" not found in config.`);
     deps.renderer.write(
-      color3.dim(`Run ${color3.bold("wstack auth list")} to see saved providers.
+      color4.dim(`Run ${color4.bold("wstack auth list")} to see saved providers.
 `)
     );
     return 1;
@@ -442,32 +555,32 @@ async function runAuthStatus(deps, providerId) {
   const active = cfg.activeKey ?? keys[0]?.label;
   const lines = [
     `
-${color3.bold(providerId)} ${cfg.family ? color3.dim(`[${cfg.family}]`) : color3.amber("[no family]")}`,
+${color4.bold(providerId)} ${cfg.family ? color4.dim(`[${cfg.family}]`) : color4.amber("[no family]")}`,
     "",
-    `  type:    ${color3.cyan(cfg.type ?? providerId)}`,
-    `  family:  ${cfg.family ? color3.cyan(cfg.family) : color3.dim("unset")}`,
-    `  baseUrl: ${cfg.baseUrl ? color3.cyan(cfg.baseUrl) : color3.dim("unset")}`
+    `  type:    ${color4.cyan(cfg.type ?? providerId)}`,
+    `  family:  ${cfg.family ? color4.cyan(cfg.family) : color4.dim("unset")}`,
+    `  baseUrl: ${cfg.baseUrl ? color4.cyan(cfg.baseUrl) : color4.dim("unset")}`
   ];
   if (cfg.models?.length) {
-    lines.push(`  models:  ${color3.cyan(cfg.models.join(", "))}`);
+    lines.push(`  models:  ${color4.cyan(cfg.models.join(", "))}`);
   }
   if (cfg.envVars?.length) {
-    lines.push(`  envVars: ${color3.cyan(cfg.envVars.join(", "))}`);
+    lines.push(`  envVars: ${color4.cyan(cfg.envVars.join(", "))}`);
   }
   lines.push("");
   if (keys.length === 0) {
-    lines.push(color3.amber("  (no keys saved)"));
+    lines.push(color4.amber("  (no keys saved)"));
   } else {
-    lines.push(`  ${color3.dim("Keys:")}`);
+    lines.push(`  ${color4.dim("Keys:")}`);
     for (const k of keys) {
-      const marker = k.label === active ? color3.green("\u25CF") : color3.dim("\u25CB");
+      const marker = k.label === active ? color4.green("\u25CF") : color4.dim("\u25CB");
       lines.push(
-        `    ${marker} ${color3.bold(k.label.padEnd(18))} ${maskedKey(k.apiKey)}  ${color3.dim(k.createdAt)}`
+        `    ${marker} ${color4.bold(k.label.padEnd(18))} ${maskedKey(k.apiKey)}  ${color4.dim(k.createdAt)}`
       );
     }
   }
   lines.push("");
-  lines.push(color3.dim(`Manage: wstack auth \u2192 pick ${providerId}`));
+  lines.push(color4.dim(`Manage: wstack auth \u2192 pick ${providerId}`));
   deps.renderer.write(lines.join("\n") + "\n");
   return 0;
 }
@@ -478,19 +591,19 @@ async function runAuthRemove(deps, providerId) {
     return 1;
   }
   deps.renderer.write(
-    `${color3.amber("!")} This will remove "${providerId}" and all its saved keys.
+    `${color4.amber("!")} This will remove "${providerId}" and all its saved keys.
 `
   );
-  const answer = (await deps.reader.readLine(`  ${color3.amber("?")} Confirm removal? ${color3.dim("[y/N]")} `)).trim().toLowerCase();
+  const answer = (await deps.reader.readLine(`  ${color4.amber("?")} Confirm removal? ${color4.dim("[y/N]")} `)).trim().toLowerCase();
   if (answer !== "y" && answer !== "yes") {
-    deps.renderer.write(color3.dim("Cancelled.\n"));
+    deps.renderer.write(color4.dim("Cancelled.\n"));
     return 0;
   }
   try {
     await mutateConfigProviders(deps.profileConfigPath, deps.vault, (all) => {
       delete all[providerId];
     });
-    deps.renderer.write(`  ${color3.green("\u2713")} Removed ${color3.bold(providerId)}.
+    deps.renderer.write(`  ${color4.green("\u2713")} Removed ${color4.bold(providerId)}.
 `);
     return 0;
   } catch (err) {
@@ -501,4 +614,4 @@ async function runAuthRemove(deps, providerId) {
 export {
   authCmd
 };
-//# sourceMappingURL=auth-G5YKKSRH.js.map
+//# sourceMappingURL=auth-JASC4K3F.js.map

package/dist/auth-menu/loopback-server.d.ts

@@ -1,40 +1,29 @@
 /**
- * Shared loopback OAuth server — HTTP callback listener for OAuth flows.
+ * Terminal-side adapter for the OAuth loopback callback server.
  *
- * Both the Codex ("Sign in with ChatGPT") and Anthropic ("Sign in with Claude")
- * OAuth flows start a local HTTP server on a loopback port to receive the
- * authorization code redirect from the provider's browser flow. Before this
- * module existed, each flow duplicated:
+ * The server itself — HTTP listener, port fallback, `state` validation, the
+ * static callback page and its CSP/anti-framing headers, abort handling — lives
+ * in `@wrongstack/providers/oauth`. This file used to carry a second, complete
+ * implementation of all of it.
  *
- *   - `escapeHtml` / `callbackHtml` — render success/error HTML pages
- *   - `openBrowser` — best-effort platform browser opener
- *   - `startLoopbackServer` — HTTP server with port fallback, abort handling,
- *     state validation, and callback URL parsing
+ * The copies were not identical, and the difference mattered: this one
+ * registered its abort listener with `{ once: true }` and never removed it, so
+ * every completed login leaked a listener on the caller's long-lived
+ * AbortSignal (the TUI hands the same signal to each attempt). The providers
+ * copy had the `detachAbort` cleanup. Neither file had any way to notice the
+ * other had drifted.
  *
- * Usage:
- * ```ts
- * import { startLoopbackServer, callbackHtml, openBrowser } from './loopback-server.js';
+ * What legitimately stays here is {@link openBrowser}: spawning the platform
+ * browser is terminal-only behaviour, and the headless WebUI flows deliberately
+ * hand the authorize URL to the client instead of opening anything.
  *
- * const server = await startLoopbackServer(state, [1455, 1457], signal);
- * const code = await server.waitForCode();
- * ```
+ * The positional signature below is preserved so the three CLI OAuth flows and
+ * their tests keep working unchanged.
  *
  * @module auth-menu/loopback-server
  */
-/**
- * Render a simple dark-themed HTML response for the browser callback page.
- * Shared by all loopback-based OAuth flows so the success/error page styling
- * is consistent and the HTML generation isn't duplicated.
- */
-export declare function callbackHtml(ok: boolean, message: string): string;
-/**
- * Open a URL in the user's default browser. Best-effort — never throws.
- *
- * - Windows: `cmd /c start "" <url>`
- * - macOS: `open <url>`
- * - Linux: `xdg-open <url>`
- */
-export declare function openBrowser(url: string): void;
+import { type LoopbackServer } from '@wrongstack/providers/oauth';
+export { callbackHtml, type LoopbackServer } from '@wrongstack/providers/oauth';
 /** Result of waiting for the OAuth callback. */
 export interface LoopbackCallback {
     /** The authorization code from the provider. */
@@ -42,35 +31,32 @@ export interface LoopbackCallback {
     /** The OAuth state parameter from the callback (validated against expected). */
     state: string;
 }
-export interface LoopbackServer {
-    /**
-     * Wait for the browser to redirect back with the authorization code.
-     * Resolves with the code and state, or `null` if cancelled/failed.
-     */
-    waitForCode(): Promise<LoopbackCallback | null>;
-    /** Close the HTTP server and release the port. */
-    close(): void;
-    /** True when the server bound to a registered callback port. */
-    readonly bound: boolean;
-    /** The actual port the server is listening on (matches the authorize URL redirect_uri). */
-    readonly port: number;
-}
 /**
- * Start a loopback HTTP server for OAuth authorization code callback.
- *
- * The server listens on the first available port from `ports`. If all ports
- * are busy, `bound` is `false` and the caller should fall back to a manual
- * paste prompt.
+ * Open a URL in the user's default browser. Best-effort — never throws.
  *
- * When `signal` aborts (user pressed Ctrl+C or TUI Esc), the pending
- * `waitForCode()` promise resolves to `null` and the server is torn down
- * so the login flow can return promptly.
+ * - Windows: `cmd /c start "" <url>`
+ * - macOS: `open <url>`
+ * - Linux: `xdg-open <url>`
  *
- * @param expectedState - The OAuth `state` value to validate against the callback
- * @param ports - Ordered list of TCP ports to try (first available wins)
- * @param signal - Optional external cancellation signal
- * @param callbackPath - The URL path the provider redirects to (default `/auth/callback`)
- * @param redirectHost - The hostname to listen on (default `127.0.0.1`)
+ * Not `detached`: the CLI flows wait on the loopback callback in the
+ * foreground, so the opener is a short-lived handoff. (The WebUI server's
+ * `openBrowser` is deliberately different — it detaches and registers the pid
+ * as protected because it launches a browser the session must outlive.)
+ */
+export declare function openBrowser(url: string): void;
+/**
+ * Start a loopback HTTP server for the OAuth authorization-code callback.
+ *
+ * Binds the first available port from `ports`. If all are busy, `bound` is
+ * `false` and the caller falls back to a manual paste prompt. When `signal`
+ * aborts (Ctrl+C, TUI Esc), the pending `waitForCode()` resolves to `null` and
+ * the server is torn down.
+ *
+ * @param expectedState - the OAuth `state` to validate the callback against
+ * @param ports - ordered ports to try; first available wins
+ * @param signal - optional external cancellation
+ * @param callbackPath - path the provider redirects to (default `/auth/callback`)
+ * @param redirectHost - hostname to listen on (default `127.0.0.1`)
  */
 export declare function startLoopbackServer(expectedState: string, ports: readonly number[], signal?: AbortSignal, callbackPath?: string, redirectHost?: string): Promise<LoopbackServer>;
 //# sourceMappingURL=loopback-server.d.ts.map