@wrongstack/cli 0.299.0 → 0.301.0

package/dist/{chunk-2SLSUDYS.js → chunk-2KDOFTTM.js}

@@ -1,3 +1,7 @@
+import {
+  terminalLink,
+  terminalText
+} from "./chunk-KE7E7DPX.js";
 import {
   resolveAuditActor
 } from "./chunk-Q5GTM25S.js";
@@ -21,7 +25,7 @@ import {
   HqAlertEngine,
   HqBootstrapCodeStore,
   HqCommandAuditLog,
-  hqTokenKey as hqTokenKey3,
+  hqTokenKey as hqTokenKey2,
   hqTokenVerifier as hqTokenVerifier2,
   mintHqCookieSecret as mintHqCookieSecret2,
   mutateHqAuthFile as mutateHqAuthFile2,
@@ -174,6 +178,10 @@ function parseCookieHeader(cookieHeader) {
   }
   return out;
 }
+function readHqSessionCookie(cookieHeader) {
+  const cookies = parseCookieHeader(cookieHeader);
+  return cookies[HQ_SESSION_COOKIE_SECURE] ?? cookies[HQ_SESSION_COOKIE];
+}
 function setHqSessionCookie(res, value, secure) {
   const name = cookieName(secure);
   const parts = [
@@ -265,8 +273,7 @@ function authenticateBrowserRequest(req, url, mutableAuth, sessions) {
     }
   }
   if (mutableAuth.cookieSecret) {
-    const cookies = parseCookieHeader(req.headers.cookie);
-    const raw = cookies[HQ_SESSION_COOKIE] ?? cookies["__Host-hq.session"];
+    const raw = readHqSessionCookie(req.headers.cookie);
     if (raw) {
       const sessionId = parseHqSessionCookie(raw, mutableAuth.cookieSecret);
       if (sessionId) {
@@ -312,25 +319,38 @@ var TOKEN_EXPIRY_WARNING_MS = 24 * 60 * 60 * 1e3;
 function liveTokens(list) {
   return (list ?? []).filter((token) => !isTokenExpired2(token));
 }
-function createHqAuthState(authFile, dataDir) {
+function projectAuthFile(mutableAuth, next) {
+  mutableAuth.operatorPolicy = {
+    ...DEFAULT_HQ_REDACTION_POLICY,
+    ...next.redactionPolicy ?? {}
+  };
+  mutableAuth.operatorPolicyOverride = next.redactionPolicy;
+  mutableAuth.browserTokens = new Set(liveTokens(next.browserTokens).map(hqTokenKey));
+  mutableAuth.clientTokens = new Set(liveTokens(next.clientTokens).map(hqTokenKey));
+  mutableAuth.browserTokenObjs = browserTokenMap(next.browserTokens);
+  mutableAuth.clientTokenObjs = new Map(
+    liveTokens(next.clientTokens).map((token) => [hqTokenKey(token), token])
+  );
+  mutableAuth.passwordHash = next.passwordHash;
+  mutableAuth.cookieSecret = next.cookieSecret;
+  mutableAuth.totpSecret = next.totpSecret;
+  mutableAuth.totpPendingSecret = next.totpPendingSecret;
+  mutableAuth.totpRecoveryCodes = next.totpRecoveryCodes;
+  mutableAuth.alertRules = next.alertRules;
+}
+function createHqAuthState(authFile, dataDir, opts = {}) {
   let rawBrowserTokens = authFile.browserTokens ?? [];
   let rawClientTokens = authFile.clientTokens ?? [];
   const mutableAuth = {
-    operatorPolicy: { ...DEFAULT_HQ_REDACTION_POLICY, ...authFile.redactionPolicy ?? {} },
-    operatorPolicyOverride: authFile.redactionPolicy,
-    browserTokens: new Set(liveTokens(authFile.browserTokens).map(hqTokenKey)),
-    clientTokens: new Set(liveTokens(authFile.clientTokens).map(hqTokenKey)),
-    browserTokenObjs: browserTokenMap(authFile.browserTokens),
-    clientTokenObjs: new Map(
-      liveTokens(authFile.clientTokens).map((token) => [hqTokenKey(token), token])
-    ),
-    passwordHash: authFile.passwordHash,
-    cookieSecret: authFile.cookieSecret,
-    totpSecret: authFile.totpSecret,
-    totpPendingSecret: authFile.totpPendingSecret,
-    totpRecoveryCodes: authFile.totpRecoveryCodes,
-    alertRules: authFile.alertRules
+    operatorPolicy: { ...DEFAULT_HQ_REDACTION_POLICY },
+    operatorPolicyOverride: void 0,
+    browserTokens: /* @__PURE__ */ new Set(),
+    clientTokens: /* @__PURE__ */ new Set(),
+    browserTokenObjs: /* @__PURE__ */ new Map(),
+    clientTokenObjs: /* @__PURE__ */ new Map(),
+    alertRules: void 0
   };
+  projectAuthFile(mutableAuth, authFile);
   return {
     mutableAuth,
     tokenStats: () => {
@@ -355,23 +375,8 @@ function createHqAuthState(authFile, dataDir) {
       auditPrunedTokens("client", rawClientTokens, newClient, next, dataDir);
       rawBrowserTokens = newBrowser;
       rawClientTokens = newClient;
-      mutableAuth.operatorPolicy = {
-        ...DEFAULT_HQ_REDACTION_POLICY,
-        ...next.redactionPolicy ?? {}
-      };
-      mutableAuth.operatorPolicyOverride = next.redactionPolicy;
-      mutableAuth.browserTokens = new Set(liveTokens(next.browserTokens).map(hqTokenKey));
-      mutableAuth.clientTokens = new Set(liveTokens(next.clientTokens).map(hqTokenKey));
-      mutableAuth.browserTokenObjs = browserTokenMap(next.browserTokens);
-      mutableAuth.clientTokenObjs = new Map(
-        liveTokens(next.clientTokens).map((token) => [hqTokenKey(token), token])
-      );
-      mutableAuth.passwordHash = next.passwordHash;
-      mutableAuth.cookieSecret = next.cookieSecret;
-      mutableAuth.totpSecret = next.totpSecret;
-      mutableAuth.totpPendingSecret = next.totpPendingSecret;
-      mutableAuth.totpRecoveryCodes = next.totpRecoveryCodes;
-      mutableAuth.alertRules = next.alertRules;
+      projectAuthFile(mutableAuth, next);
+      opts.onApplied?.(mutableAuth);
     }
   };
 }
@@ -453,24 +458,41 @@ var LoginAttemptStore = class _LoginAttemptStore {
     }
   }
   /**
-   * Compound rate-limit key for public-relay mode: IP + SHA-256(password).
-   * Limits how often the SAME password can be tried from different IPs,
-   * so a rotating-IP attacker can't bypass per-IP backoff.
+   * Rate-limit key for a *candidate password*, independent of source IP.
+   *
+   * WS-104: this used to be `cred:${ip}:${hash}`. Embedding the IP made the
+   * documented purpose — "limit how often the SAME password can be tried from
+   * different IPs" — structurally impossible, because a rotating-IP attacker
+   * got a fresh counter with every hop, exactly the case the key exists for.
+   * The IP-scoped counter is already kept separately under the bare `ip` key.
+   *
+   * Backoff caps at 16s (see {@link recordFailure}), so a global per-password
+   * counter throttles guessing without becoming a lockout an attacker could
+   * aim at the operator.
    */
-  static credentialKey(ip, password) {
+  static credentialKey(password) {
     const hash = createHash("sha256").update(password, "utf8").digest("hex").slice(0, 16);
-    return `cred:${ip}:${hash}`;
+    return `cred:${hash}`;
   }
   /**
-   * Check both IP and credential keys; return the stricter (later blockedUntil).
+   * Check the IP key and — when a candidate password is supplied — the
+   * credential key too, returning the stricter (later `blockedUntil`).
+   *
+   * WS-104: `handleApiLogin` called this with `''` before parsing the request
+   * body ("we don't have the password yet") and never called it again, so the
+   * credential entries {@link recordFailure} wrote were only ever *written*.
+   * Callers now re-check once the password is known; passing no password (or
+   * an empty one) means "IP scope only".
    */
   checkBlocked(ip, password) {
-    const ipEntry = this.store.get(ip);
-    const credKey = _LoginAttemptStore.credentialKey(ip, password);
-    const credEntry = this.store.get(credKey);
     const now = Date.now();
+    const ipEntry = this.store.get(ip);
     const ipBlocked = ipEntry && ipEntry.blockedUntil > now ? ipEntry.blockedUntil : 0;
-    const credBlocked = credEntry && credEntry.blockedUntil > now ? credEntry.blockedUntil : 0;
+    let credBlocked = 0;
+    if (password !== void 0 && password.length > 0) {
+      const credEntry = this.store.get(_LoginAttemptStore.credentialKey(password));
+      credBlocked = credEntry && credEntry.blockedUntil > now ? credEntry.blockedUntil : 0;
+    }
     const blockedUntil = Math.max(ipBlocked, credBlocked);
     if (blockedUntil > now) {
       return { blocked: true, retryAfter: Math.ceil((blockedUntil - now) / 1e3) };
@@ -478,7 +500,11 @@ var LoginAttemptStore = class _LoginAttemptStore {
     return { blocked: false, retryAfter: 0 };
   }
   /**
-   * Record a failed attempt on both IP and credential keys.
+   * Record a failed attempt on the IP key, and on the credential key when a
+   * candidate password is supplied. Omit the password for flows that have no
+   * one (2FA verification, TOTP disable) so they do not accumulate a
+   * meaningless `cred:sha256("")` counter shared by every such flow.
+   *
    * Returns the updated IP entry (for the response Retry-After header).
    */
   recordFailure(ip, password, maxBackoffMs = 16e3) {
@@ -491,16 +517,21 @@ var LoginAttemptStore = class _LoginAttemptStore {
       };
     };
     this.set(ip, backoff(this.store.get(ip)));
-    const credKey = _LoginAttemptStore.credentialKey(ip, password);
-    this.set(credKey, backoff(this.store.get(credKey)));
+    if (password !== void 0 && password.length > 0) {
+      const credKey = _LoginAttemptStore.credentialKey(password);
+      this.set(credKey, backoff(this.store.get(credKey)));
+    }
     return this.store.get(ip);
   }
   /**
-   * Clear both IP and credential entries on successful login.
+   * Clear the IP entry — and the credential entry when a password is given —
+   * on successful login.
    */
   clearOnSuccess(ip, password) {
     this.delete(ip);
-    this.delete(_LoginAttemptStore.credentialKey(ip, password));
+    if (password !== void 0 && password.length > 0) {
+      this.delete(_LoginAttemptStore.credentialKey(password));
+    }
   }
   /** Number of tracked entries (for diagnostics). */
   get size() {
@@ -1180,7 +1211,14 @@ function buildSnapshot(clients, options) {
     completedTasks: f.payload.completedTasks,
     failedTasks: f.payload.failedTasks,
     ...f.payload.totalCostUsd !== void 0 ? { totalCostUsd: f.payload.totalCostUsd } : {},
-    lastActivityAt: f.lastActivityAt
+    lastActivityAt: f.lastActivityAt,
+    ...f.payload.maxConcurrent !== void 0 ? { maxConcurrent: f.payload.maxConcurrent } : {},
+    ...f.payload.maxSpawns !== void 0 ? { maxSpawns: f.payload.maxSpawns } : {},
+    ...f.payload.usedSpawns !== void 0 ? { usedSpawns: f.payload.usedSpawns } : {},
+    ...f.payload.remainingSpawns !== void 0 ? { remainingSpawns: f.payload.remainingSpawns } : {},
+    ...f.payload.effectiveSource !== void 0 ? { effectiveSource: f.payload.effectiveSource } : {},
+    ...f.payload.checkpointMaxSpawns !== void 0 ? { checkpointMaxSpawns: f.payload.checkpointMaxSpawns } : {},
+    ...f.payload.ceilingMismatch ? { ceilingMismatch: true } : {}
   }));
   const mcpServers = [];
   const seenMcp = /* @__PURE__ */ new Set();
@@ -1398,11 +1436,8 @@ async function authorizeHqCommand(input) {
 // src/hq-server/routes/auth-handlers.ts
 import { randomUUID } from "node:crypto";
 import {
-  DEFAULT_HQ_REDACTION_POLICY as DEFAULT_HQ_REDACTION_POLICY2,
   hashHqPassword,
-  hqTokenKey as hqTokenKey2,
   isLoopbackHost as isLoopbackHost2,
-  isTokenExpired as isTokenExpired4,
   mintHqCookieSecret,
   mutateHqAuthFile,
   verifyHqPassword
@@ -1413,13 +1448,92 @@ import {
   generateTotpSecret,
   hashRecoveryCode,
   verifyRecoveryCode,
-  verifyTotp
+  verifyTotp,
+  verifyTotpCounter
 } from "@wrongstack/core/security";
+
+// src/hq-server/client-address.ts
+import { isIP as isIP2 } from "node:net";
+function normalizeAddress(raw) {
+  const trimmed = raw.trim().replace(/^\[(.*)\]$/, "$1");
+  return trimmed.replace(/^::ffff:/i, "");
+}
+function parseForwardedEntry(entry) {
+  const value = entry.trim();
+  if (!value) return void 0;
+  const bracketed = /^\[([^\]]+)\](?::\d+)?$/.exec(value);
+  if (bracketed?.[1] !== void 0) {
+    const inner = normalizeAddress(bracketed[1]);
+    return isIP2(inner) !== 0 ? inner : void 0;
+  }
+  const normalized = normalizeAddress(value);
+  if (isIP2(normalized) !== 0) return normalized;
+  const lastColon = normalized.lastIndexOf(":");
+  if (lastColon > 0 && normalized.indexOf(":") === lastColon) {
+    const host = normalized.slice(0, lastColon);
+    if (isIP2(host) === 4) return host;
+  }
+  return void 0;
+}
+function forwardedChain(req) {
+  const header = req.headers["x-forwarded-for"];
+  if (header === void 0) return [];
+  const raw = Array.isArray(header) ? header.join(",") : header;
+  return raw.split(",").map((entry) => parseForwardedEntry(entry)).filter((entry) => entry !== void 0);
+}
+function resolveClientAddress(req, trustedProxyHops = 0) {
+  const socketAddress = req.socket.remoteAddress ? normalizeAddress(req.socket.remoteAddress) : void 0;
+  const hops = Number.isFinite(trustedProxyHops) ? Math.max(0, Math.trunc(trustedProxyHops)) : 0;
+  if (hops === 0) return socketAddress ?? "unknown";
+  const chain = [...socketAddress !== void 0 ? [socketAddress] : [], ...forwardedChain(req).reverse()];
+  if (hops >= chain.length) return socketAddress ?? "unknown";
+  return chain[hops] ?? socketAddress ?? "unknown";
+}
+
+// src/hq-server/routes/auth-handlers.ts
 import { readHqAuthAuditTail } from "@wrongstack/core/hq";
 function isLoopbackRequest(req) {
   const address = req.socket.remoteAddress?.replace(/^::ffff:/, "");
   return address !== void 0 && isLoopbackHost2(address);
 }
+var HQ_AUTH_ADMIN_CAPABILITY = "auth.admin";
+function callerCanAdministerAuth(auth) {
+  if (auth === void 0) return false;
+  if (auth.kind === "cookie" && auth.tokenId === void 0) return true;
+  if (auth.capabilities === void 0) return true;
+  return auth.capabilities.includes(HQ_AUTH_ADMIN_CAPABILITY);
+}
+function writeAuthAdminRequired(res) {
+  res.writeHead(403, { "Content-Type": "application/json" });
+  res.end(
+    JSON.stringify({
+      error: {
+        code: "AUTH_ADMIN_REQUIRED",
+        message: `This endpoint requires the '${HQ_AUTH_ADMIN_CAPABILITY}' capability.`
+      }
+    })
+  );
+}
+function authorizeAuthAdmin(req, res, mutableAuth, sessions) {
+  const auth = authenticateBrowserRequest(
+    req,
+    new URL(req.url ?? "/", "http://localhost"),
+    mutableAuth,
+    sessions
+  );
+  if (!auth) {
+    res.writeHead(401, { "Content-Type": "application/json" });
+    res.end(
+      JSON.stringify({ error: { code: "UNAUTHORIZED", message: "Authentication required." } })
+    );
+    return void 0;
+  }
+  if (!callerCanAdministerAuth(auth)) {
+    writeAuthAdminRequired(res);
+    return void 0;
+  }
+  return auth;
+}
 async function handleApiAuthStatus(req, res, url, mutableAuth, sessions, requireBrowserAuth, trustedPublicOrigins, secureCookies) {
   const auth = authenticateBrowserRequest(req, url, mutableAuth, sessions);
   const openMode = mutableAuth.browserTokens.size === 0 && mutableAuth.passwordHash === void 0 && mutableAuth.requireAuthFloor !== true;
@@ -1440,7 +1554,7 @@ async function handleApiAuthStatus(req, res, url, mutableAuth, sessions, require
     })
   );
 }
-async function handleApiLogin(req, res, mutableAuth, sessions, loginAttempts, secureCookies) {
+async function handleApiLogin(req, res, mutableAuth, sessions, loginAttempts, secureCookies, trustedProxyHops) {
   if (!mutableAuth.passwordHash) {
     res.writeHead(403, { "Content-Type": "application/json" });
     res.end(
@@ -1453,9 +1567,8 @@ async function handleApiLogin(req, res, mutableAuth, sessions, loginAttempts, se
     );
     return;
   }
-  const clientIp = req.socket.remoteAddress ?? "unknown";
-  const { blocked, retryAfter } = loginAttempts.checkBlocked(clientIp, "");
-  if (blocked) {
+  const clientIp = resolveClientAddress(req, trustedProxyHops);
+  const writeRateLimited = (retryAfter) => {
     res.writeHead(429, {
       "Content-Type": "application/json",
       "Retry-After": String(retryAfter)
@@ -1468,6 +1581,10 @@ async function handleApiLogin(req, res, mutableAuth, sessions, loginAttempts, se
         }
       })
     );
+  };
+  const ipCheck = loginAttempts.checkBlocked(clientIp);
+  if (ipCheck.blocked) {
+    writeRateLimited(ipCheck.retryAfter);
     return;
   }
   let body;
@@ -1482,6 +1599,11 @@ async function handleApiLogin(req, res, mutableAuth, sessions, loginAttempts, se
     res.end(JSON.stringify({ error: { code: "BAD_REQUEST", message: "password is required" } }));
     return;
   }
+  const credCheck = loginAttempts.checkBlocked(clientIp, body.password);
+  if (credCheck.blocked) {
+    writeRateLimited(credCheck.retryAfter);
+    return;
+  }
   const ok = await verifyHqPassword(body.password, mutableAuth.passwordHash);
   if (!ok || !mutableAuth.cookieSecret) {
     loginAttempts.recordFailure(clientIp, body.password);
@@ -1525,8 +1647,7 @@ async function handleApiLogout(req, res, mutableAuth, sessions, secureCookies) {
     sessions
   );
   if (isCookieAuth(auth)) {
-    const cookies = parseCookieHeader(req.headers.cookie);
-    const raw = cookies[HQ_SESSION_COOKIE] ?? cookies["__Host-hq.session"];
+    const raw = readHqSessionCookie(req.headers.cookie);
     if (raw) {
       const sessionId = parseHqSessionCookie(raw, mutableAuth.cookieSecret ?? "");
       if (sessionId) sessions.delete(sessionId);
@@ -1536,7 +1657,7 @@ async function handleApiLogout(req, res, mutableAuth, sessions, secureCookies) {
   res.writeHead(200, { "Content-Type": "application/json" });
   res.end(JSON.stringify({ loggedIn: false }));
 }
-async function handleApiPassword(req, res, mutableAuth, sessions, dataDir, secureCookies, requireBrowserAuth) {
+async function handleApiPassword(req, res, mutableAuth, sessions, dataDir, secureCookies, requireBrowserAuth, applyAuthFile) {
   const auth = authenticateBrowserRequest(
     req,
     new URL(req.url ?? "/", "http://localhost"),
@@ -1611,7 +1732,7 @@ async function handleApiPassword(req, res, mutableAuth, sessions, dataDir, secur
       delete updated.totpRecoveryCodes;
       return updated;
     });
-    applyAuthFile(mutableAuth, next2);
+    applyAuthFile(next2);
     sessions.clear();
     clearHqSessionCookie(res, secureCookies);
     res.writeHead(200, { "Content-Type": "application/json" });
@@ -1644,7 +1765,7 @@ async function handleApiPassword(req, res, mutableAuth, sessions, dataDir, secur
     passwordHash,
     cookieSecret
   }));
-  applyAuthFile(mutableAuth, next);
+  applyAuthFile(next);
   sessions.clear();
   if (isCookieAuth(auth) || localOpenBootstrap) {
     const sessionId = randomUUID();
@@ -1660,35 +1781,6 @@ async function handleApiPassword(req, res, mutableAuth, sessions, dataDir, secur
     })
   );
 }
-function applyAuthFile(mutableAuth, next) {
-  mutableAuth.operatorPolicy = {
-    ...DEFAULT_HQ_REDACTION_POLICY2,
-    ...next.redactionPolicy ?? {}
-  };
-  mutableAuth.operatorPolicyOverride = next.redactionPolicy;
-  const liveBrowserTokens = (next.browserTokens ?? []).filter((t) => !isTokenExpired4(t));
-  mutableAuth.browserTokens = new Set(liveBrowserTokens.map(hqTokenKey2));
-  mutableAuth.clientTokens = new Set((next.clientTokens ?? []).map(hqTokenKey2));
-  mutableAuth.browserTokenObjs = new Map(
-    liveBrowserTokens.map((t) => [
-      hqTokenKey2(t),
-      {
-        id: t.id,
-        ...t.capabilities !== void 0 ? { capabilities: t.capabilities } : {},
-        ...t.expiresAt !== void 0 ? { expiresAt: t.expiresAt } : {}
-      }
-    ])
-  );
-  mutableAuth.clientTokenObjs = new Map(
-    (next.clientTokens ?? []).map((token) => [hqTokenKey2(token), token])
-  );
-  mutableAuth.passwordHash = next.passwordHash;
-  mutableAuth.cookieSecret = next.cookieSecret;
-  mutableAuth.alertRules = next.alertRules;
-  mutableAuth.totpSecret = next.totpSecret;
-  mutableAuth.totpPendingSecret = next.totpPendingSecret;
-  mutableAuth.totpRecoveryCodes = next.totpRecoveryCodes;
-}
 async function handleApiBootstrap(req, res, mutableAuth, sessions, secureCookies, bootstrapStore) {
   if (!mutableAuth.cookieSecret) {
     res.writeHead(503, { "Content-Type": "application/json" });
@@ -1821,24 +1913,23 @@ var MAX_2FA_VERIFY_FAILURES = 5;
 function recordVerifyFailure(loginAttempts, clientIp) {
   const prev = loginAttempts.get(clientIp);
   const count = (prev?.count ?? 0) + 1;
-  loginAttempts.recordFailure(clientIp, "");
+  loginAttempts.recordFailure(clientIp);
   return count;
 }
-async function handleApiLoginVerify(req, res, _url, mutableAuth, sessions, loginAttempts, dataDir, secureCookies) {
+async function handleApiLoginVerify(req, res, _url, mutableAuth, sessions, loginAttempts, dataDir, secureCookies, applyAuthFile, trustedProxyHops) {
   if (!mutableAuth.cookieSecret) {
     res.writeHead(503, { "Content-Type": "application/json" });
     res.end(JSON.stringify({ error: { code: "NO_COOKIE_SECRET" } }));
     return;
   }
-  const clientIp = req.socket.remoteAddress ?? "unknown";
-  const { blocked, retryAfter } = loginAttempts.checkBlocked(clientIp, "");
+  const clientIp = resolveClientAddress(req, trustedProxyHops);
+  const { blocked, retryAfter } = loginAttempts.checkBlocked(clientIp);
   if (blocked) {
     res.writeHead(429, { "Content-Type": "application/json", "Retry-After": String(retryAfter) });
     res.end(JSON.stringify({ error: { code: "RATE_LIMITED", message: "Too many attempts. Try again later." } }));
     return;
   }
-  const cookies = parseCookieHeader(req.headers.cookie);
-  const raw = cookies[HQ_SESSION_COOKIE] ?? cookies["__Host-hq.session"];
+  const raw = readHqSessionCookie(req.headers.cookie);
   const sessionId = raw ? parseHqSessionCookie(raw, mutableAuth.cookieSecret) : void 0;
   if (!sessionId) {
     res.writeHead(401, { "Content-Type": "application/json" });
@@ -1871,15 +1962,25 @@ async function handleApiLoginVerify(req, res, _url, mutableAuth, sessions, login
       res.end(JSON.stringify({ error: { code: "TOTP_NOT_ENABLED", message: "2FA is not configured." } }));
       return;
     }
-    if (!verifyTotp(body.code, mutableAuth.totpSecret)) {
+    const matchedCounter = verifyTotpCounter(body.code, mutableAuth.totpSecret);
+    const replayed = matchedCounter !== void 0 && mutableAuth.totpLastUsedCounter !== void 0 && matchedCounter <= mutableAuth.totpLastUsedCounter;
+    if (matchedCounter === void 0 || replayed) {
       if (recordVerifyFailure(loginAttempts, clientIp) >= MAX_2FA_VERIFY_FAILURES) {
         sessions.delete(sessionId);
       }
       res.writeHead(401, { "Content-Type": "application/json" });
-      res.end(JSON.stringify({ error: { code: "INVALID_TOTP", message: "Invalid authenticator code." } }));
+      res.end(
+        JSON.stringify({
+          error: {
+            code: replayed ? "TOTP_ALREADY_USED" : "INVALID_TOTP",
+            message: replayed ? "That authenticator code has already been used. Wait for the next one." : "Invalid authenticator code."
+          }
+        })
+      );
       return;
     }
-    loginAttempts.clearOnSuccess(clientIp, "");
+    mutableAuth.totpLastUsedCounter = matchedCounter;
+    loginAttempts.clearOnSuccess(clientIp);
     sessions.delete(sessionId);
     const fullSessionId = randomUUID();
     sessions.set(fullSessionId, { createdAt: Date.now(), kind: "password", lastSeenAt: Date.now() });
@@ -1935,11 +2036,11 @@ async function handleApiLoginVerify(req, res, _url, mutableAuth, sessions, login
         res.end(JSON.stringify({ error: { code: "RECOVERY_CODE_ALREADY_USED", message: "This recovery code has already been used." } }));
         return;
       }
-      applyAuthFile(mutableAuth, next);
+      applyAuthFile(next);
     } finally {
       releaseLock();
     }
-    loginAttempts.clearOnSuccess(clientIp, "");
+    loginAttempts.clearOnSuccess(clientIp);
     sessions.delete(sessionId);
     const fullSessionId = randomUUID();
     sessions.set(fullSessionId, { createdAt: Date.now(), kind: "password", lastSeenAt: Date.now() });
@@ -1957,18 +2058,8 @@ async function handleApiLoginVerify(req, res, _url, mutableAuth, sessions, login
     JSON.stringify({ error: { code: "BAD_REQUEST", message: "Provide a `code` or `recoveryCode`." } })
   );
 }
-async function handleApiTotpSetup(req, res, mutableAuth, sessions, dataDir) {
-  const auth = authenticateBrowserRequest(
-    req,
-    new URL(req.url ?? "/", "http://localhost"),
-    mutableAuth,
-    sessions
-  );
-  if (!auth) {
-    res.writeHead(401, { "Content-Type": "application/json" });
-    res.end(JSON.stringify({ error: { code: "UNAUTHORIZED", message: "Authentication required." } }));
-    return;
-  }
+async function handleApiTotpSetup(req, res, mutableAuth, sessions, dataDir, applyAuthFile) {
+  if (!authorizeAuthAdmin(req, res, mutableAuth, sessions)) return;
   if (mutableAuth.totpSecret) {
     res.writeHead(409, { "Content-Type": "application/json" });
     res.end(
@@ -1982,22 +2073,12 @@ async function handleApiTotpSetup(req, res, mutableAuth, sessions, dataDir) {
     ...current,
     totpPendingSecret: secret
   }));
-  applyAuthFile(mutableAuth, next);
+  applyAuthFile(next);
   res.writeHead(200, { "Content-Type": "application/json" });
   res.end(JSON.stringify({ secret, uri, enabled: false }));
 }
-async function handleApiTotpEnable(req, res, mutableAuth, sessions, dataDir) {
-  const auth = authenticateBrowserRequest(
-    req,
-    new URL(req.url ?? "/", "http://localhost"),
-    mutableAuth,
-    sessions
-  );
-  if (!auth) {
-    res.writeHead(401, { "Content-Type": "application/json" });
-    res.end(JSON.stringify({ error: { code: "UNAUTHORIZED", message: "Authentication required." } }));
-    return;
-  }
+async function handleApiTotpEnable(req, res, mutableAuth, sessions, dataDir, applyAuthFile) {
+  if (!authorizeAuthAdmin(req, res, mutableAuth, sessions)) return;
   if (mutableAuth.totpSecret) {
     res.writeHead(409, { "Content-Type": "application/json" });
     res.end(
@@ -2040,25 +2121,15 @@ async function handleApiTotpEnable(req, res, mutableAuth, sessions, dataDir) {
     updated.totpRecoveryCodes = recoveryHashes;
     return updated;
   });
-  applyAuthFile(mutableAuth, next);
+  applyAuthFile(next);
   sessions.clear();
   res.writeHead(200, { "Content-Type": "application/json" });
   res.end(JSON.stringify({ enabled: true, recoveryCodes }));
 }
-async function handleApiTotpDisable(req, res, mutableAuth, sessions, loginAttempts, dataDir) {
-  const auth = authenticateBrowserRequest(
-    req,
-    new URL(req.url ?? "/", "http://localhost"),
-    mutableAuth,
-    sessions
-  );
-  if (!auth) {
-    res.writeHead(401, { "Content-Type": "application/json" });
-    res.end(JSON.stringify({ error: { code: "UNAUTHORIZED", message: "Authentication required." } }));
-    return;
-  }
-  const clientIp = req.socket.remoteAddress ?? "unknown";
-  const { blocked, retryAfter } = loginAttempts.checkBlocked(clientIp, "");
+async function handleApiTotpDisable(req, res, mutableAuth, sessions, loginAttempts, dataDir, applyAuthFile, trustedProxyHops) {
+  if (!authorizeAuthAdmin(req, res, mutableAuth, sessions)) return;
+  const clientIp = resolveClientAddress(req, trustedProxyHops);
+  const { blocked, retryAfter } = loginAttempts.checkBlocked(clientIp);
   if (blocked) {
     res.writeHead(429, { "Content-Type": "application/json", "Retry-After": String(retryAfter) });
     res.end(JSON.stringify({ error: { code: "RATE_LIMITED", message: "Too many attempts. Try again later." } }));
@@ -2095,7 +2166,7 @@ async function handleApiTotpDisable(req, res, mutableAuth, sessions, loginAttemp
     delete updated.totpRecoveryCodes;
     return updated;
   });
-  applyAuthFile(mutableAuth, next);
+  applyAuthFile(next);
   res.writeHead(200, { "Content-Type": "application/json" });
   res.end(JSON.stringify({ enabled: false }));
 }
@@ -2105,7 +2176,7 @@ function handleApiAuthSessions(_req, res, mutableAuth, sessions) {
   for (const [id, session] of sessions) {
     if (session.pending2fa) continue;
     list.push({
-      // Truncated for display only — the client sends the full ID to revoke.
+      // The client sends the full ID back to revoke; `shortId` is for display.
       id,
       shortId: id.slice(0, 8),
       kind: session.kind,
@@ -2431,8 +2502,6 @@ var isTokenAuth2 = isTokenAuth;
 var isCookieAuth2 = isCookieAuth;
 var hqAuthRequired2 = hqAuthRequired;
 var parseHqSessionCookie2 = parseHqSessionCookie;
-var parseCookieHeader2 = parseCookieHeader;
-var HQ_SESSION_COOKIE2 = HQ_SESSION_COOKIE;
 var decodePathSegment2 = decodePathSegment;
 var readRequestBody2 = readRequestBody;
 var writeInvalidBody2 = writeInvalidBody;
@@ -2468,16 +2537,18 @@ function createHqRouter(deps) {
     getMailboxGateway,
     getTokenStats,
     trustBoundary,
-    bootstrapStore
+    bootstrapStore,
+    applyAuthFile,
+    trustedProxyHops = 0
   } = deps;
   return async (req, res) => {
     try {
-      const url = new URL(req.url ?? "/", `http://${host}:${listeningPort}`);
+      const url = new URL(req.url ?? "/", `http://${host}:${listeningPort()}`);
       setHqSecurityHeaders2(res);
       if (!hasTrustedBrowserOrigin2(
         req,
         host,
-        listeningPort,
+        listeningPort(),
         trustedPublicOrigins,
         allowFileOrigin
       )) {
@@ -2516,6 +2587,21 @@ function createHqRouter(deps) {
         await handleApiAuthStatus(req, res, url, mutableAuth, sessions, requireBrowserAuth, trustedPublicOrigins, secureCookies);
         return;
       }
+      if (url.pathname === "/api/auth/audit" && req.method === "GET" || url.pathname.startsWith("/api/auth/sessions") && (req.method === "GET" || req.method === "DELETE") || url.pathname.startsWith("/api/auth/totp/") && req.method === "POST") {
+        const auth = authenticateBrowserRequest2(req, url, mutableAuth, sessions);
+        if (auth !== void 0 && !callerCanAdministerAuth(auth)) {
+          res.writeHead(403, { "Content-Type": "application/json" });
+          res.end(
+            JSON.stringify({
+              error: {
+                code: "AUTH_ADMIN_REQUIRED",
+                message: "This endpoint requires the 'auth.admin' capability."
+              }
+            })
+          );
+          return;
+        }
+      }
       if (url.pathname === "/api/auth/audit" && req.method === "GET") {
         handleApiAuthAudit(req, res, dataDir);
         return;
@@ -2529,7 +2615,7 @@ function createHqRouter(deps) {
         return;
       }
       if (url.pathname === "/api/login" && req.method === "POST") {
-        await handleApiLogin(req, res, mutableAuth, sessions, loginAttempts, secureCookies);
+        await handleApiLogin(req, res, mutableAuth, sessions, loginAttempts, secureCookies, trustedProxyHops);
         return;
       }
       if (url.pathname === "/api/auth/bootstrap" && req.method === "POST") {
@@ -2557,23 +2643,23 @@ function createHqRouter(deps) {
         return;
       }
       if (url.pathname === "/api/login/verify" && req.method === "POST") {
-        await handleApiLoginVerify(req, res, url, mutableAuth, sessions, loginAttempts, dataDir, secureCookies);
+        await handleApiLoginVerify(req, res, url, mutableAuth, sessions, loginAttempts, dataDir, secureCookies, applyAuthFile, trustedProxyHops);
         return;
       }
       if (url.pathname === "/api/auth/totp/setup" && req.method === "POST") {
-        await handleApiTotpSetup(req, res, mutableAuth, sessions, dataDir);
+        await handleApiTotpSetup(req, res, mutableAuth, sessions, dataDir, applyAuthFile);
         return;
       }
       if (url.pathname === "/api/auth/totp/enable" && req.method === "POST") {
-        await handleApiTotpEnable(req, res, mutableAuth, sessions, dataDir);
+        await handleApiTotpEnable(req, res, mutableAuth, sessions, dataDir, applyAuthFile);
         return;
       }
       if (url.pathname === "/api/auth/totp/disable" && req.method === "POST") {
-        await handleApiTotpDisable(req, res, mutableAuth, sessions, loginAttempts, dataDir);
+        await handleApiTotpDisable(req, res, mutableAuth, sessions, loginAttempts, dataDir, applyAuthFile, trustedProxyHops);
         return;
       }
       if (url.pathname === "/api/auth/password" && (req.method === "POST" || req.method === "DELETE")) {
-        await handleApiPassword(req, res, mutableAuth, sessions, dataDir, secureCookies, requireBrowserAuth);
+        await handleApiPassword(req, res, mutableAuth, sessions, dataDir, secureCookies, requireBrowserAuth, applyAuthFile);
         return;
       }
       if (url.pathname === "/api/snapshot" && req.method === "GET") {
@@ -3081,17 +3167,11 @@ async function handleMailboxAction(_req, res, match, mutableAuth, sessions, data
 // src/hq-server/startup.ts
 import * as fs4 from "node:fs/promises";
 import * as path6 from "node:path";
+import { writeHqRuntimeFile } from "@wrongstack/core/hq";
 var hqRuntimeMarkerPath2 = hqRuntimeMarkerPath;
 async function writeHqRuntimeMarker(dataDir, url) {
-  const file = hqRuntimeMarkerPath2(dataDir);
-  const payload = JSON.stringify(
-    { url, pid: process.pid, updatedAt: (/* @__PURE__ */ new Date()).toISOString() },
-    null,
-    2
-  );
-  await fs4.mkdir(path6.dirname(file), { recursive: true });
-  await fs4.writeFile(file, `${payload}
-`, { encoding: "utf8", mode: 384 });
+  await fs4.mkdir(dataDir, { recursive: true });
+  await writeHqRuntimeFile(dataDir, { url, pid: process.pid });
 }
 async function clearHqRuntimeMarker(dataDir, url) {
   const file = hqRuntimeMarkerPath2(dataDir);
@@ -3106,19 +3186,23 @@ async function clearHqRuntimeMarker(dataDir, url) {
 }
 function writeHqStartupInfo(write, handle) {
   const startup = handle.firstRunSetup;
-  write(`WrongStack HQ listening on http://${handle.host}:${handle.port}
-`);
+  const browserUrl = buildHttpUrl(handle.host, handle.port);
+  const clientUrl = buildClientWsUrl(handle.host, handle.port);
+  write(
+    `${terminalText("WrongStack HQ", "magenta")} ${terminalText("listening on", "green")} ${terminalLink(browserUrl)}
+`
+  );
   if (!startup) {
-    write(`Browser endpoint: ${buildHttpUrl(handle.host, handle.port)}
+    write(`${terminalText("Browser endpoint:", "blue")} ${terminalLink(browserUrl)}
 `);
-    write(`Client endpoint:  ${buildClientWsUrl(handle.host, handle.port)}
+    write(`${terminalText("Client endpoint:", "blue")}  ${terminalLink(clientUrl)}
 `);
     writeHqLanEndpoints(write, handle, void 0);
     return;
   }
-  write(`Browser endpoint: ${startup.browserUrl}
+  write(`${terminalText("Browser endpoint:", "blue")} ${terminalLink(startup.browserUrl)}
 `);
-  write(`Client endpoint:  ${startup.clientUrl}
+  write(`${terminalText("Client endpoint:", "blue")}  ${terminalLink(startup.clientUrl)}
 `);
   if (startup.createdAuth) {
     write(`
@@ -3144,13 +3228,23 @@ function writeHqLanEndpoints(write, handle, browserToken) {
   if (handle.host !== "0.0.0.0" && handle.host !== "::") return;
   const ips = lanIPv4Addresses();
   if (ips.length === 0) return;
-  write("\nReachable from other machines on your network:\n");
+  write(
+    `
+${terminalText("Reachable from other machines on your network:", "blue", { bold: true })}
+`
+  );
   for (const ip of ips) {
-    write(`  ${buildHttpUrl(ip, handle.port, browserToken)}
+    const url = buildHttpUrl(ip, handle.port, browserToken);
+    write(`  ${terminalLink(url)}
 `);
   }
-  write(`  On another machine, set WRONGSTACK_HQ_URL=http://${ips[0]}:${handle.port}
-`);
+  const firstIp = ips[0];
+  if (firstIp === void 0) return;
+  const clientUrl = buildHttpUrl(firstIp, handle.port);
+  write(
+    `  ${terminalText("On another machine, set", "muted")} WRONGSTACK_HQ_URL=${terminalLink(clientUrl)}
+`
+  );
 }
 
 // src/hq-server/ws.ts
@@ -3281,7 +3375,7 @@ function nextPeerEventSeq(eventLog) {
   peerEventSeq += 1;
   return peerEventSeq;
 }
-function fanoutKanbanDelta(message, clients, browsers, projectId) {
+function fanoutKanbanDelta(message, clients, _browsers, projectId) {
   let clientsNotified = 0;
   for (const peer of clients.values()) {
     if (peer.projectId === projectId) {
@@ -3289,12 +3383,7 @@ function fanoutKanbanDelta(message, clients, browsers, projectId) {
       clientsNotified++;
     }
   }
-  let browsersNotified = 0;
-  for (const browserWs of browsers) {
-    sendGuarded(browserWs, message);
-    browsersNotified++;
-  }
-  return { clientsNotified, browsersNotified };
+  return { clientsNotified, browsersNotified: 0 };
 }
 function handleClientResume(ws, clients, eventLog, frame, snapshotBroadcaster) {
   const client = clients.get(ws);
@@ -3896,7 +3985,30 @@ async function startHqServer(options = {}) {
 async function startHqServerWithAuth(options, host, port, dataDir, firstRunAuth) {
   const trustBoundary = options.trustBoundary ?? createCompatibilityTrustBoundary({ policyId: "hq-trusted-host-compat-v1" });
   const authFile = firstRunAuth.authFile;
-  const authState = createHqAuthState(authFile, dataDir);
+  const reassessExposureFloor = (live) => {
+    const exposure = assessHqExposure2({
+      host,
+      hasBrowserTokens: live.browserTokens.size > 0,
+      hasPassword: live.passwordHash !== void 0,
+      allowInsecure: options.allowInsecureOpen
+    });
+    const previousFloor = live.requireAuthFloor === true;
+    live.requireAuthFloor = exposure.kind === "refuse";
+    if (live.requireAuthFloor && !previousFloor) {
+      console.error(
+        JSON.stringify({
+          level: "error",
+          event: "hq.auth.open_mode_refused",
+          message: "Last HQ credential removed while bound to a non-loopback address. Refusing to serve unauthenticated: requests will return 401 until a token or password is configured, or HQ is restarted with --host 127.0.0.1.",
+          host,
+          timestamp: (/* @__PURE__ */ new Date()).toISOString()
+        })
+      );
+    }
+  };
+  const authState = createHqAuthState(authFile, dataDir, {
+    onApplied: (live) => reassessExposureFloor(live)
+  });
   const { mutableAuth } = authState;
   if (!mutableAuth.cookieSecret && mutableAuth.browserTokens.size > 0) {
     const secret = mintHqCookieSecret2();
@@ -3904,7 +4016,7 @@ async function startHqServerWithAuth(options, host, port, dataDir, firstRunAuth)
       ...current,
       cookieSecret: secret
     }));
-    mutableAuth.cookieSecret = next.cookieSecret;
+    authState.apply(next);
     console.warn(
       JSON.stringify({
         level: "info",
@@ -4170,7 +4282,7 @@ async function startHqServerWithAuth(options, host, port, dataDir, firstRunAuth)
     const routerDeps = {
       trustBoundary,
       host,
-      listeningPort,
+      listeningPort: () => listeningPort,
       trustedPublicOrigins,
       allowFileOrigin: options.allowFileOrigin,
       mutableAuth,
@@ -4193,6 +4305,10 @@ async function startHqServerWithAuth(options, host, port, dataDir, firstRunAuth)
       authorizeMailboxGateway,
       getMailboxGateway,
       getTokenStats: () => authState.tokenStats(),
+      // Single projection + single floor evaluation, shared with the reload
+      // watcher below. See `createHqAuthState`'s `onApplied` hook.
+      applyAuthFile: (next) => authState.apply(next),
+      trustedProxyHops: options.trustedProxyHops ?? 0,
       bootstrapStore
     };
     const handleRequest = createHqRouter(routerDeps);
@@ -4260,8 +4376,7 @@ async function startHqServerWithAuth(options, host, port, dataDir, firstRunAuth)
         }
         const tokenValid = timingSafeTokenMatch(tokenSet, supplied) !== void 0;
         const cookieValid = pathname === "/ws/browser" && mutableAuth.cookieSecret !== void 0 && (() => {
-          const cookies = parseCookieHeader2(req.headers.cookie);
-          const raw = cookies[HQ_SESSION_COOKIE2] ?? cookies["__Host-hq.session"];
+          const raw = readHqSessionCookie(req.headers.cookie);
           if (!raw) return false;
           const sessionId = parseHqSessionCookie2(raw, mutableAuth.cookieSecret);
           if (sessionId === void 0) return false;
@@ -4327,25 +4442,6 @@ async function startHqServerWithAuth(options, host, port, dataDir, firstRunAuth)
       dataDir,
       (next) => {
         authState.apply(next);
-        const exposure = assessHqExposure2({
-          host,
-          hasBrowserTokens: mutableAuth.browserTokens.size > 0,
-          hasPassword: mutableAuth.passwordHash !== void 0,
-          allowInsecure: options.allowInsecureOpen
-        });
-        const previousFloor = mutableAuth.requireAuthFloor === true;
-        mutableAuth.requireAuthFloor = exposure.kind === "refuse";
-        if (mutableAuth.requireAuthFloor && !previousFloor) {
-          console.error(
-            JSON.stringify({
-              level: "error",
-              event: "hq.auth.open_mode_refused",
-              message: "Last HQ credential removed while bound to a non-loopback address. Refusing to serve unauthenticated: requests will return 401 until a token or password is configured, or HQ is restarted with --host 127.0.0.1.",
-              host,
-              timestamp: (/* @__PURE__ */ new Date()).toISOString()
-            })
-          );
-        }
         if ((options.requireBrowserAuth || mutableAuth.requireAuthFloor) && mutableAuth.browserTokens.size === 0 && mutableAuth.passwordHash === void 0) {
           sessions.clear();
           for (const browser of browsers) browser.close(1008, "Browser authentication removed");
@@ -4401,7 +4497,7 @@ async function startHqServerWithAuth(options, host, port, dataDir, firstRunAuth)
         const hqUrl = `http://${host === "0.0.0.0" ? "127.0.0.1" : host}:${actualPort}`;
         await writeHqRuntimeMarker(dataDir, hqUrl).catch(() => {
         });
-        const browserTokenObj = (firstRunAuth.browserToken !== void 0 ? mutableAuth.browserTokenObjs.get(hqTokenKey3(firstRunAuth.browserToken)) : void 0) ?? mutableAuth.browserTokenObjs.values().next().value;
+        const browserTokenObj = (firstRunAuth.browserToken !== void 0 ? mutableAuth.browserTokenObjs.get(hqTokenKey2(firstRunAuth.browserToken)) : void 0) ?? mutableAuth.browserTokenObjs.values().next().value;
         let browserUrl;
         if (browserTokenObj) {
           const code = bootstrapStore.issue({
@@ -4456,8 +4552,13 @@ async function startHqServerWithAuth(options, host, port, dataDir, firstRunAuth)
             snapshotBroadcaster.close();
             bootstrapStore.clear();
             persistence.timeseries.flush();
-            for (const ws of browsers) ws.close(1001, "HQ shutting down");
-            for (const ws of clients.keys()) ws.close(1001, "HQ shutting down");
+            for (const ws of [...browsers, ...clients.keys()]) {
+              try {
+                ws.close(1001, "HQ shutting down");
+                ws.terminate();
+              } catch {
+              }
+            }
             wss.close();
             for (const { router } of mailboxGateways.values()) router.close();
             httpServer.close(() => {
@@ -4505,4 +4606,4 @@ export {
   startHqServer,
   HqInsecureExposureError2 as HqInsecureExposureError
 };
-//# sourceMappingURL=chunk-2SLSUDYS.js.map
+//# sourceMappingURL=chunk-2KDOFTTM.js.map