@wrongstack/cli 0.300.0 → 0.302.0

package/dist/{chronicle-QQEQFSSE.js → chronicle-63MFCZN6.js}

@@ -2,8 +2,12 @@ import "./chunk-7OCVIDC7.js";
 
 // src/subcommands/handlers/chronicle.ts
 import { statSync } from "node:fs";
+import path from "node:path";
 import {
-  createChronicleProjectAccess
+  chronicleProjectServerMetadataPath,
+  compactChronicleSqlite,
+  createChronicleProjectAccess,
+  resolveChronicleProjectServerOptions
 } from "@wrongstack/core/chronicle";
 var facets = /* @__PURE__ */ new Set([
   "eventType",
@@ -26,6 +30,22 @@ var chronicleCmd = async (args, deps) => {
   }
   let access;
   try {
+    if (operation === "compact") {
+      if (args.length !== 1) {
+        throw new Error("Usage: wstack chronicle compact (stop the Chronicle daemon first)");
+      }
+      const resolved = resolveChronicleProjectServerOptions({
+        projectRoot: deps.projectRoot,
+        userHome: deps.userHome
+      });
+      const result2 = compactChronicleSqlite({
+        dbPath: path.join(resolved.projectDir, "chronicle", "chronicle.sqlite"),
+        endpointMetadataPath: chronicleProjectServerMetadataPath(resolved.projectDir)
+      });
+      deps.renderer.write(`${JSON.stringify(result2, null, 2)}
+`);
+      return 0;
+    }
     access = createChronicleProjectAccess({
       projectRoot: deps.projectRoot,
       userHome: deps.userHome
@@ -60,9 +80,10 @@ var chronicleCmd = async (args, deps) => {
       return 0;
     }
     if (operation === "prune") {
-      const dryRun = args.includes("--dry-run") || args.includes("-n");
+      const flags = deps.flags ?? {};
+      const dryRun = args.includes("--dry-run") || args.includes("-n") || flags["dry-run"] === true || flags["dry-run"] === "true" || flags["n"] === true;
       const daysIndex = args.indexOf("--days");
-      const rawDays = daysIndex >= 0 && daysIndex + 1 < args.length ? args[daysIndex + 1] : void 0;
+      const rawDays = daysIndex >= 0 && daysIndex + 1 < args.length ? args[daysIndex + 1] : typeof flags["days"] === "string" ? flags["days"] : void 0;
       const days = rawDays ? parseInt(rawDays, 10) : 30;
       if (!Number.isFinite(days) || days < 1) {
         deps.renderer.writeError(
@@ -235,7 +256,7 @@ function parseValue(value) {
   }
 }
 function usage() {
-  return "Usage:\n  wstack chronicle query [field=value ...]\n  wstack chronicle status\n  wstack chronicle facet <field> [field=value ...]\n  wstack chronicle metrics [providers|tasks|files|summary] [field=value ...]\n  wstack chronicle prune [--days N] [--dry-run]\n\nExamples:\n  wstack chronicle status\n  wstack chronicle query path=src/app.ts line=42\n  wstack chronicle query providerId=openai outcome=failure\n  wstack chronicle query eventType=tool.executed sessionId=<id> limit=50\n  wstack chronicle query attr.tool.name=read\n  wstack chronicle facet modelId from=2026-07-01T00:00:00Z\n  wstack chronicle metrics providers from=2026-07-01\n  wstack chronicle metrics files path=src/app.ts\n  wstack chronicle metrics tasks limit=20\n  wstack chronicle prune --days 7 --dry-run\n  wstack chronicle prune --days 30\n";
+  return "Usage:\n  wstack chronicle query [field=value ...]\n  wstack chronicle status\n  wstack chronicle facet <field> [field=value ...]\n  wstack chronicle metrics [providers|tasks|files|summary] [field=value ...]\n  wstack chronicle prune [--days N] [--dry-run]\n  wstack chronicle compact\n\nExamples:\n  wstack chronicle status\n  wstack chronicle query path=src/app.ts line=42\n  wstack chronicle query providerId=openai outcome=failure\n  wstack chronicle query eventType=tool.executed sessionId=<id> limit=50\n  wstack chronicle query attr.tool.name=read\n  wstack chronicle facet modelId from=2026-07-01T00:00:00Z\n  wstack chronicle metrics providers from=2026-07-01\n  wstack chronicle metrics files path=src/app.ts\n  wstack chronicle metrics tasks limit=20\n  wstack chronicle prune --days 7 --dry-run\n  wstack chronicle prune --days 30\n  wstack chronicle compact\n";
 }
 function formatBytes(bytes) {
   if (bytes < 1024) return `${bytes} B`;
@@ -253,4 +274,4 @@ function tryStat(file) {
 export {
   chronicleCmd
 };
-//# sourceMappingURL=chronicle-QQEQFSSE.js.map
+//# sourceMappingURL=chronicle-63MFCZN6.js.map

package/dist/{chunk-YWUPHRGB.js → chunk-263G3FMB.js}

@@ -80,20 +80,40 @@ async function safeDelete(filePath) {
     }
   }
 }
+var REDACTED = "[REDACTED]";
+function maskValue(v) {
+  if (Array.isArray(v)) return v.map(maskValue);
+  if (typeof v === "object" && v !== null) return maskConfigSecrets(v);
+  return v;
+}
 function maskConfigSecrets(cfg) {
   if (typeof cfg !== "object" || cfg === null) return {};
   const out = {};
   for (const [k, v] of Object.entries(cfg)) {
     if (isSecretField(k)) {
-      out[k] = "[REDACTED]";
-    } else if (typeof v === "object" && v !== null && !Array.isArray(v)) {
-      out[k] = maskConfigSecrets(v);
+      out[k] = REDACTED;
     } else {
-      out[k] = v;
+      out[k] = maskValue(v);
     }
   }
   return out;
 }
+function reviveSecrets(masked, current) {
+  if (masked === REDACTED) return current;
+  if (Array.isArray(masked)) {
+    const cur = Array.isArray(current) ? current : [];
+    return masked.map((item, i) => reviveSecrets(item, cur[i]));
+  }
+  if (typeof masked !== "object" || masked === null) return masked;
+  const curObj = typeof current === "object" && current !== null && !Array.isArray(current) ? current : {};
+  const out = {};
+  for (const [k, v] of Object.entries(masked)) {
+    const revived = reviveSecrets(v, curObj[k]);
+    if (revived === void 0) continue;
+    out[k] = revived;
+  }
+  return out;
+}
 function diffSummary(oldCfg, newCfg) {
   const changes = [];
   const allKeys = /* @__PURE__ */ new Set([...Object.keys(oldCfg), ...Object.keys(newCfg)]);
@@ -199,7 +219,7 @@ async function backupCurrent(homeFn = defaultHomeDir, targetConfigPath) {
   }
   if (content !== void 0) {
     try {
-      await atomicWrite(last, content);
+      await atomicWrite(last, content, { mode: 384 });
     } catch (err) {
       writeErr(
         `[config-history] .last backup failed: ${toErrorMessage(err)}`
@@ -209,7 +229,7 @@ async function backupCurrent(homeFn = defaultHomeDir, targetConfigPath) {
   if (content !== void 0) {
     try {
       const bakPath = `${cfg}.${ts}.bak`;
-      await atomicWrite(bakPath, content);
+      await atomicWrite(bakPath, content, { mode: 384 });
     } catch (err) {
       writeErr(
         `[config-history] timestamped backup failed: ${toErrorMessage(err)}`
@@ -244,7 +264,7 @@ async function appendHistory(oldCfg, newCfg, description, homeFn = defaultHomeDi
     await fs.writeFile(
       path.join(historyDir(homeFn, targetConfigPath), `${id}.json`),
       JSON.stringify(entry, null, 2),
-      "utf8"
+      { encoding: "utf8", mode: 384 }
     );
   } catch (err) {
     throw new FsError({
@@ -292,14 +312,17 @@ async function restoreFromHistory(id, homeFn = defaultHomeDir, targetConfigPath)
     oldCfg = JSON.parse(raw);
   } catch {
   }
+  const restored = reviveSecrets(entry.snapshotMasked, oldCfg);
   try {
-    await atomicWrite(configPath(homeFn, targetConfigPath), JSON.stringify(entry.snapshotMasked, null, 2));
+    await atomicWrite(configPath(homeFn, targetConfigPath), JSON.stringify(restored, null, 2), {
+      mode: 384
+    });
   } catch (err) {
     return { ok: false, backupId: null, error: String(err) };
   }
   const backupId = await appendHistory(
     oldCfg,
-    entry.snapshotMasked,
+    restored,
     `Restored from history ${id}`,
     homeFn,
     targetConfigPath
@@ -343,4 +366,4 @@ export {
   restoreFromHistory,
   restoreLast
 };
-//# sourceMappingURL=chunk-YWUPHRGB.js.map
+//# sourceMappingURL=chunk-263G3FMB.js.map

package/dist/{chunk-GYDQABMA.js → chunk-2KDOFTTM.js}

@@ -1,3 +1,7 @@
+import {
+  terminalLink,
+  terminalText
+} from "./chunk-KE7E7DPX.js";
 import {
   resolveAuditActor
 } from "./chunk-Q5GTM25S.js";
@@ -2539,12 +2543,12 @@ function createHqRouter(deps) {
   } = deps;
   return async (req, res) => {
     try {
-      const url = new URL(req.url ?? "/", `http://${host}:${listeningPort}`);
+      const url = new URL(req.url ?? "/", `http://${host}:${listeningPort()}`);
       setHqSecurityHeaders2(res);
       if (!hasTrustedBrowserOrigin2(
         req,
         host,
-        listeningPort,
+        listeningPort(),
         trustedPublicOrigins,
         allowFileOrigin
       )) {
@@ -3163,17 +3167,11 @@ async function handleMailboxAction(_req, res, match, mutableAuth, sessions, data
 // src/hq-server/startup.ts
 import * as fs4 from "node:fs/promises";
 import * as path6 from "node:path";
+import { writeHqRuntimeFile } from "@wrongstack/core/hq";
 var hqRuntimeMarkerPath2 = hqRuntimeMarkerPath;
 async function writeHqRuntimeMarker(dataDir, url) {
-  const file = hqRuntimeMarkerPath2(dataDir);
-  const payload = JSON.stringify(
-    { url, pid: process.pid, updatedAt: (/* @__PURE__ */ new Date()).toISOString() },
-    null,
-    2
-  );
-  await fs4.mkdir(path6.dirname(file), { recursive: true });
-  await fs4.writeFile(file, `${payload}
-`, { encoding: "utf8", mode: 384 });
+  await fs4.mkdir(dataDir, { recursive: true });
+  await writeHqRuntimeFile(dataDir, { url, pid: process.pid });
 }
 async function clearHqRuntimeMarker(dataDir, url) {
   const file = hqRuntimeMarkerPath2(dataDir);
@@ -3188,19 +3186,23 @@ async function clearHqRuntimeMarker(dataDir, url) {
 }
 function writeHqStartupInfo(write, handle) {
   const startup = handle.firstRunSetup;
-  write(`WrongStack HQ listening on http://${handle.host}:${handle.port}
-`);
+  const browserUrl = buildHttpUrl(handle.host, handle.port);
+  const clientUrl = buildClientWsUrl(handle.host, handle.port);
+  write(
+    `${terminalText("WrongStack HQ", "magenta")} ${terminalText("listening on", "green")} ${terminalLink(browserUrl)}
+`
+  );
   if (!startup) {
-    write(`Browser endpoint: ${buildHttpUrl(handle.host, handle.port)}
+    write(`${terminalText("Browser endpoint:", "blue")} ${terminalLink(browserUrl)}
 `);
-    write(`Client endpoint:  ${buildClientWsUrl(handle.host, handle.port)}
+    write(`${terminalText("Client endpoint:", "blue")}  ${terminalLink(clientUrl)}
 `);
     writeHqLanEndpoints(write, handle, void 0);
     return;
   }
-  write(`Browser endpoint: ${startup.browserUrl}
+  write(`${terminalText("Browser endpoint:", "blue")} ${terminalLink(startup.browserUrl)}
 `);
-  write(`Client endpoint:  ${startup.clientUrl}
+  write(`${terminalText("Client endpoint:", "blue")}  ${terminalLink(startup.clientUrl)}
 `);
   if (startup.createdAuth) {
     write(`
@@ -3226,13 +3228,23 @@ function writeHqLanEndpoints(write, handle, browserToken) {
   if (handle.host !== "0.0.0.0" && handle.host !== "::") return;
   const ips = lanIPv4Addresses();
   if (ips.length === 0) return;
-  write("\nReachable from other machines on your network:\n");
+  write(
+    `
+${terminalText("Reachable from other machines on your network:", "blue", { bold: true })}
+`
+  );
   for (const ip of ips) {
-    write(`  ${buildHttpUrl(ip, handle.port, browserToken)}
+    const url = buildHttpUrl(ip, handle.port, browserToken);
+    write(`  ${terminalLink(url)}
 `);
   }
-  write(`  On another machine, set WRONGSTACK_HQ_URL=http://${ips[0]}:${handle.port}
-`);
+  const firstIp = ips[0];
+  if (firstIp === void 0) return;
+  const clientUrl = buildHttpUrl(firstIp, handle.port);
+  write(
+    `  ${terminalText("On another machine, set", "muted")} WRONGSTACK_HQ_URL=${terminalLink(clientUrl)}
+`
+  );
 }
 
 // src/hq-server/ws.ts
@@ -3363,7 +3375,7 @@ function nextPeerEventSeq(eventLog) {
   peerEventSeq += 1;
   return peerEventSeq;
 }
-function fanoutKanbanDelta(message, clients, browsers, projectId) {
+function fanoutKanbanDelta(message, clients, _browsers, projectId) {
   let clientsNotified = 0;
   for (const peer of clients.values()) {
     if (peer.projectId === projectId) {
@@ -3371,12 +3383,7 @@ function fanoutKanbanDelta(message, clients, browsers, projectId) {
       clientsNotified++;
     }
   }
-  let browsersNotified = 0;
-  for (const browserWs of browsers) {
-    sendGuarded(browserWs, message);
-    browsersNotified++;
-  }
-  return { clientsNotified, browsersNotified };
+  return { clientsNotified, browsersNotified: 0 };
 }
 function handleClientResume(ws, clients, eventLog, frame, snapshotBroadcaster) {
   const client = clients.get(ws);
@@ -4275,7 +4282,7 @@ async function startHqServerWithAuth(options, host, port, dataDir, firstRunAuth)
     const routerDeps = {
       trustBoundary,
       host,
-      listeningPort,
+      listeningPort: () => listeningPort,
       trustedPublicOrigins,
       allowFileOrigin: options.allowFileOrigin,
       mutableAuth,
@@ -4545,8 +4552,13 @@ async function startHqServerWithAuth(options, host, port, dataDir, firstRunAuth)
             snapshotBroadcaster.close();
             bootstrapStore.clear();
             persistence.timeseries.flush();
-            for (const ws of browsers) ws.close(1001, "HQ shutting down");
-            for (const ws of clients.keys()) ws.close(1001, "HQ shutting down");
+            for (const ws of [...browsers, ...clients.keys()]) {
+              try {
+                ws.close(1001, "HQ shutting down");
+                ws.terminate();
+              } catch {
+              }
+            }
             wss.close();
             for (const { router } of mailboxGateways.values()) router.close();
             httpServer.close(() => {
@@ -4594,4 +4606,4 @@ export {
   startHqServer,
   HqInsecureExposureError2 as HqInsecureExposureError
 };
-//# sourceMappingURL=chunk-GYDQABMA.js.map
+//# sourceMappingURL=chunk-2KDOFTTM.js.map