@wrongstack/cli 0.300.0 → 0.301.0

package/dist/{chunk-YWUPHRGB.js → chunk-263G3FMB.js}

@@ -80,20 +80,40 @@ async function safeDelete(filePath) {
     }
   }
 }
+var REDACTED = "[REDACTED]";
+function maskValue(v) {
+  if (Array.isArray(v)) return v.map(maskValue);
+  if (typeof v === "object" && v !== null) return maskConfigSecrets(v);
+  return v;
+}
 function maskConfigSecrets(cfg) {
   if (typeof cfg !== "object" || cfg === null) return {};
   const out = {};
   for (const [k, v] of Object.entries(cfg)) {
     if (isSecretField(k)) {
-      out[k] = "[REDACTED]";
-    } else if (typeof v === "object" && v !== null && !Array.isArray(v)) {
-      out[k] = maskConfigSecrets(v);
+      out[k] = REDACTED;
     } else {
-      out[k] = v;
+      out[k] = maskValue(v);
     }
   }
   return out;
 }
+function reviveSecrets(masked, current) {
+  if (masked === REDACTED) return current;
+  if (Array.isArray(masked)) {
+    const cur = Array.isArray(current) ? current : [];
+    return masked.map((item, i) => reviveSecrets(item, cur[i]));
+  }
+  if (typeof masked !== "object" || masked === null) return masked;
+  const curObj = typeof current === "object" && current !== null && !Array.isArray(current) ? current : {};
+  const out = {};
+  for (const [k, v] of Object.entries(masked)) {
+    const revived = reviveSecrets(v, curObj[k]);
+    if (revived === void 0) continue;
+    out[k] = revived;
+  }
+  return out;
+}
 function diffSummary(oldCfg, newCfg) {
   const changes = [];
   const allKeys = /* @__PURE__ */ new Set([...Object.keys(oldCfg), ...Object.keys(newCfg)]);
@@ -199,7 +219,7 @@ async function backupCurrent(homeFn = defaultHomeDir, targetConfigPath) {
   }
   if (content !== void 0) {
     try {
-      await atomicWrite(last, content);
+      await atomicWrite(last, content, { mode: 384 });
     } catch (err) {
       writeErr(
         `[config-history] .last backup failed: ${toErrorMessage(err)}`
@@ -209,7 +229,7 @@ async function backupCurrent(homeFn = defaultHomeDir, targetConfigPath) {
   if (content !== void 0) {
     try {
       const bakPath = `${cfg}.${ts}.bak`;
-      await atomicWrite(bakPath, content);
+      await atomicWrite(bakPath, content, { mode: 384 });
     } catch (err) {
       writeErr(
         `[config-history] timestamped backup failed: ${toErrorMessage(err)}`
@@ -244,7 +264,7 @@ async function appendHistory(oldCfg, newCfg, description, homeFn = defaultHomeDi
     await fs.writeFile(
       path.join(historyDir(homeFn, targetConfigPath), `${id}.json`),
       JSON.stringify(entry, null, 2),
-      "utf8"
+      { encoding: "utf8", mode: 384 }
     );
   } catch (err) {
     throw new FsError({
@@ -292,14 +312,17 @@ async function restoreFromHistory(id, homeFn = defaultHomeDir, targetConfigPath)
     oldCfg = JSON.parse(raw);
   } catch {
   }
+  const restored = reviveSecrets(entry.snapshotMasked, oldCfg);
   try {
-    await atomicWrite(configPath(homeFn, targetConfigPath), JSON.stringify(entry.snapshotMasked, null, 2));
+    await atomicWrite(configPath(homeFn, targetConfigPath), JSON.stringify(restored, null, 2), {
+      mode: 384
+    });
   } catch (err) {
     return { ok: false, backupId: null, error: String(err) };
   }
   const backupId = await appendHistory(
     oldCfg,
-    entry.snapshotMasked,
+    restored,
     `Restored from history ${id}`,
     homeFn,
     targetConfigPath
@@ -343,4 +366,4 @@ export {
   restoreFromHistory,
   restoreLast
 };
-//# sourceMappingURL=chunk-YWUPHRGB.js.map
+//# sourceMappingURL=chunk-263G3FMB.js.map

package/dist/{chunk-GYDQABMA.js → chunk-2KDOFTTM.js}

@@ -1,3 +1,7 @@
+import {
+  terminalLink,
+  terminalText
+} from "./chunk-KE7E7DPX.js";
 import {
   resolveAuditActor
 } from "./chunk-Q5GTM25S.js";
@@ -2539,12 +2543,12 @@ function createHqRouter(deps) {
   } = deps;
   return async (req, res) => {
     try {
-      const url = new URL(req.url ?? "/", `http://${host}:${listeningPort}`);
+      const url = new URL(req.url ?? "/", `http://${host}:${listeningPort()}`);
       setHqSecurityHeaders2(res);
       if (!hasTrustedBrowserOrigin2(
         req,
         host,
-        listeningPort,
+        listeningPort(),
         trustedPublicOrigins,
         allowFileOrigin
       )) {
@@ -3163,17 +3167,11 @@ async function handleMailboxAction(_req, res, match, mutableAuth, sessions, data
 // src/hq-server/startup.ts
 import * as fs4 from "node:fs/promises";
 import * as path6 from "node:path";
+import { writeHqRuntimeFile } from "@wrongstack/core/hq";
 var hqRuntimeMarkerPath2 = hqRuntimeMarkerPath;
 async function writeHqRuntimeMarker(dataDir, url) {
-  const file = hqRuntimeMarkerPath2(dataDir);
-  const payload = JSON.stringify(
-    { url, pid: process.pid, updatedAt: (/* @__PURE__ */ new Date()).toISOString() },
-    null,
-    2
-  );
-  await fs4.mkdir(path6.dirname(file), { recursive: true });
-  await fs4.writeFile(file, `${payload}
-`, { encoding: "utf8", mode: 384 });
+  await fs4.mkdir(dataDir, { recursive: true });
+  await writeHqRuntimeFile(dataDir, { url, pid: process.pid });
 }
 async function clearHqRuntimeMarker(dataDir, url) {
   const file = hqRuntimeMarkerPath2(dataDir);
@@ -3188,19 +3186,23 @@ async function clearHqRuntimeMarker(dataDir, url) {
 }
 function writeHqStartupInfo(write, handle) {
   const startup = handle.firstRunSetup;
-  write(`WrongStack HQ listening on http://${handle.host}:${handle.port}
-`);
+  const browserUrl = buildHttpUrl(handle.host, handle.port);
+  const clientUrl = buildClientWsUrl(handle.host, handle.port);
+  write(
+    `${terminalText("WrongStack HQ", "magenta")} ${terminalText("listening on", "green")} ${terminalLink(browserUrl)}
+`
+  );
   if (!startup) {
-    write(`Browser endpoint: ${buildHttpUrl(handle.host, handle.port)}
+    write(`${terminalText("Browser endpoint:", "blue")} ${terminalLink(browserUrl)}
 `);
-    write(`Client endpoint:  ${buildClientWsUrl(handle.host, handle.port)}
+    write(`${terminalText("Client endpoint:", "blue")}  ${terminalLink(clientUrl)}
 `);
     writeHqLanEndpoints(write, handle, void 0);
     return;
   }
-  write(`Browser endpoint: ${startup.browserUrl}
+  write(`${terminalText("Browser endpoint:", "blue")} ${terminalLink(startup.browserUrl)}
 `);
-  write(`Client endpoint:  ${startup.clientUrl}
+  write(`${terminalText("Client endpoint:", "blue")}  ${terminalLink(startup.clientUrl)}
 `);
   if (startup.createdAuth) {
     write(`
@@ -3226,13 +3228,23 @@ function writeHqLanEndpoints(write, handle, browserToken) {
   if (handle.host !== "0.0.0.0" && handle.host !== "::") return;
   const ips = lanIPv4Addresses();
   if (ips.length === 0) return;
-  write("\nReachable from other machines on your network:\n");
+  write(
+    `
+${terminalText("Reachable from other machines on your network:", "blue", { bold: true })}
+`
+  );
   for (const ip of ips) {
-    write(`  ${buildHttpUrl(ip, handle.port, browserToken)}
+    const url = buildHttpUrl(ip, handle.port, browserToken);
+    write(`  ${terminalLink(url)}
 `);
   }
-  write(`  On another machine, set WRONGSTACK_HQ_URL=http://${ips[0]}:${handle.port}
-`);
+  const firstIp = ips[0];
+  if (firstIp === void 0) return;
+  const clientUrl = buildHttpUrl(firstIp, handle.port);
+  write(
+    `  ${terminalText("On another machine, set", "muted")} WRONGSTACK_HQ_URL=${terminalLink(clientUrl)}
+`
+  );
 }
 
 // src/hq-server/ws.ts
@@ -3363,7 +3375,7 @@ function nextPeerEventSeq(eventLog) {
   peerEventSeq += 1;
   return peerEventSeq;
 }
-function fanoutKanbanDelta(message, clients, browsers, projectId) {
+function fanoutKanbanDelta(message, clients, _browsers, projectId) {
   let clientsNotified = 0;
   for (const peer of clients.values()) {
     if (peer.projectId === projectId) {
@@ -3371,12 +3383,7 @@ function fanoutKanbanDelta(message, clients, browsers, projectId) {
       clientsNotified++;
     }
   }
-  let browsersNotified = 0;
-  for (const browserWs of browsers) {
-    sendGuarded(browserWs, message);
-    browsersNotified++;
-  }
-  return { clientsNotified, browsersNotified };
+  return { clientsNotified, browsersNotified: 0 };
 }
 function handleClientResume(ws, clients, eventLog, frame, snapshotBroadcaster) {
   const client = clients.get(ws);
@@ -4275,7 +4282,7 @@ async function startHqServerWithAuth(options, host, port, dataDir, firstRunAuth)
     const routerDeps = {
       trustBoundary,
       host,
-      listeningPort,
+      listeningPort: () => listeningPort,
       trustedPublicOrigins,
       allowFileOrigin: options.allowFileOrigin,
       mutableAuth,
@@ -4545,8 +4552,13 @@ async function startHqServerWithAuth(options, host, port, dataDir, firstRunAuth)
             snapshotBroadcaster.close();
             bootstrapStore.clear();
             persistence.timeseries.flush();
-            for (const ws of browsers) ws.close(1001, "HQ shutting down");
-            for (const ws of clients.keys()) ws.close(1001, "HQ shutting down");
+            for (const ws of [...browsers, ...clients.keys()]) {
+              try {
+                ws.close(1001, "HQ shutting down");
+                ws.terminate();
+              } catch {
+              }
+            }
             wss.close();
             for (const { router } of mailboxGateways.values()) router.close();
             httpServer.close(() => {
@@ -4594,4 +4606,4 @@ export {
   startHqServer,
   HqInsecureExposureError2 as HqInsecureExposureError
 };
-//# sourceMappingURL=chunk-GYDQABMA.js.map
+//# sourceMappingURL=chunk-2KDOFTTM.js.map

package/dist/chunk-CSAPOCBP.js

@@ -0,0 +1,24 @@
+
+// src/subcommands/flags.ts
+function restoreFlags(args, deps, names) {
+  const flags = deps.flags;
+  if (!flags) return args;
+  const alreadyPresent = new Set(
+    args.filter((a) => a.startsWith("-")).map((a) => a.replace(/^-+/, "").split("=")[0]).filter((a) => a !== void 0 && a.length > 0)
+  );
+  const restored = [];
+  for (const name of names) {
+    if (alreadyPresent.has(name)) continue;
+    const value = flags[name];
+    if (value === void 0 || value === false) continue;
+    const token = name.length === 1 ? `-${name}` : `--${name}`;
+    if (value === true) restored.push(token);
+    else restored.push(token, value);
+  }
+  return restored.length > 0 ? [...args, ...restored] : args;
+}
+
+export {
+  restoreFlags
+};
+//# sourceMappingURL=chunk-CSAPOCBP.js.map

package/dist/{chunk-N7ULWBO5.js → chunk-ETOEGL3V.js}

@@ -1,5 +1,6 @@
 
 // src/provider-helpers.ts
+import { hasProviderCredential } from "@wrongstack/core/models";
 import { catalogProviderIdFor } from "@wrongstack/providers";
 function uniqueModelIds(primary, fallback) {
   const seen = /* @__PURE__ */ new Set();
@@ -34,12 +35,7 @@ function isKeylessLocalProvider(provider) {
   return isLoopbackUrl(provider.apiBase);
 }
 function hasApiKey(provider, config) {
-  if (provider.envVars.some((v) => !!process.env[v])) return true;
-  const entry = config?.providers?.[provider.id];
-  if (!entry) return false;
-  if (typeof entry.apiKey === "string" && entry.apiKey.length > 0) return true;
-  if (Array.isArray(entry.apiKeys) && entry.apiKeys.some((k) => k?.apiKey)) return true;
-  return false;
+  return hasProviderCredential(provider, config);
 }
 async function buildPickableProviders(modelsRegistry, config) {
   const overlay = config.providers ?? {};
@@ -88,4 +84,4 @@ export {
   hasApiKey,
   buildPickableProviders
 };
-//# sourceMappingURL=chunk-N7ULWBO5.js.map
+//# sourceMappingURL=chunk-ETOEGL3V.js.map

package/dist/{chunk-3MWUZMOL.js → chunk-GUHQQG63.js}

@@ -394,7 +394,12 @@ function auditEntryFor(spec) {
 function officialPluginState(config, spec) {
   const match = (config.plugins ?? []).find((p) => pluginName(p) === spec);
   if (!match) return "not configured";
-  return typeof match === "object" && match.enabled === false ? "disabled" : "enabled";
+  const { enabled } = resolvePluginEnablement({
+    name: spec,
+    config,
+    matches: (candidate) => pluginMatchesToggleSpec(candidate, spec)
+  });
+  return enabled ? "enabled" : "disabled";
 }
 async function togglePlugin(spec, deps) {
   const auditEntry = auditEntryFor(spec);
@@ -405,7 +410,13 @@ async function togglePlugin(spec, deps) {
   const plugins = Array.isArray(existing.plugins) ? existing.plugins : [];
   const idx = plugins.findIndex((p) => pluginMatchesToggleSpec(p, spec));
   const configured = idx >= 0 ? plugins[idx] : void 0;
-  const enabled = configured ? !(typeof configured === "object" && configured.enabled === false) : auditEntry?.defaultState === "active";
+  const effectiveConfig = { ...deps.config, ...existing };
+  const { enabled } = resolvePluginEnablement({
+    name: spec,
+    defaultState: auditEntry?.defaultState,
+    config: effectiveConfig,
+    matches: (candidate) => pluginMatchesToggleSpec(candidate, spec)
+  });
   if (!configured && !auditEntry) {
     return errorResult(
       `Plugin "${spec}" is not configured. Use "wstack plugin add ${spec}" first.`
@@ -497,4 +508,4 @@ export {
   PLUGIN_AUDIT_ENTRIES,
   runPluginManagementCommand
 };
-//# sourceMappingURL=chunk-3MWUZMOL.js.map
+//# sourceMappingURL=chunk-GUHQQG63.js.map

package/dist/chunk-KE7E7DPX.js

@@ -0,0 +1,38 @@
+
+// src/terminal-format.ts
+var ANSI = {
+  blue: "\x1B[34m",
+  cyan: "\x1B[36m",
+  green: "\x1B[32m",
+  magenta: "\x1B[35m",
+  muted: "\x1B[90m",
+  success: "\x1B[32m",
+  yellow: "\x1B[33m"
+};
+var BOLD = "\x1B[1m";
+var RESET = "\x1B[0m";
+function terminalFormattingEnabled(env = process.env, isTty = Boolean(process.stdout.isTTY)) {
+  if (env["NO_COLOR"] !== void 0) return false;
+  if (env["FORCE_COLOR"] !== void 0) return true;
+  return isTty;
+}
+function terminalText(text, tone, options = {}) {
+  const enabled = options.enabled ?? terminalFormattingEnabled();
+  if (!enabled) return text;
+  return `${options.bold ? BOLD : ""}${ANSI[tone]}${text}${RESET}`;
+}
+function terminalLink(url, options = {}) {
+  const enabled = options.enabled ?? terminalFormattingEnabled();
+  if (!enabled) return url;
+  const visible = terminalText(url, options.tone ?? "cyan", {
+    ...options.bold === void 0 ? {} : { bold: options.bold },
+    enabled: true
+  });
+  return `\x1B]8;;${url}\x1B\\${visible}\x1B]8;;\x1B\\`;
+}
+
+export {
+  terminalText,
+  terminalLink
+};
+//# sourceMappingURL=chunk-KE7E7DPX.js.map

package/dist/{chunk-PEMN4T5O.js → chunk-MHF2IJDE.js}

@@ -2,11 +2,11 @@ import {
   hasApiKey,
   isKeylessLocalProvider,
   visibleModelIds
-} from "./chunk-N7ULWBO5.js";
+} from "./chunk-ETOEGL3V.js";
 import {
   appendHistory,
   backupCurrent
-} from "./chunk-YWUPHRGB.js";
+} from "./chunk-263G3FMB.js";
 
 // src/arg-parser.ts
 var BOOLEAN_FLAGS = /* @__PURE__ */ new Set([
@@ -79,7 +79,24 @@ var BOOLEAN_FLAGS = /* @__PURE__ */ new Set([
   // being consumed as the value of one of these switches.
   "all-models",
   "plan",
-  "json"
+  "json",
+  // Destructive-preview switch (`wstack chronicle prune --dry-run`). It is
+  // boolean at every call site, and leaving it out let it consume the next
+  // positional — on a command whose whole purpose is to NOT delete.
+  "dry-run",
+  // Subcommand booleans. A boolean flag missing from this set makes `parseArgs`
+  // swallow the FOLLOWING positional as its value (`rewind --all sess123` lost
+  // the session id, `export --no-tools out.md` lost the output path), on top of
+  // the handler never seeing the flag at all.
+  "all",
+  "list",
+  "latest",
+  "disabled",
+  "enable",
+  "no-tools",
+  "no-diagnostics",
+  "unsupported",
+  "ws"
 ]);
 function parseArgs(argv) {
   const flags = {};
@@ -1020,4 +1037,4 @@ export {
   runLiveProviderPicker,
   runPicker
 };
-//# sourceMappingURL=chunk-PEMN4T5O.js.map
+//# sourceMappingURL=chunk-MHF2IJDE.js.map