@wrongstack/cli 0.301.0 → 0.302.2

package/dist/{export-DOBGPY23.js → export-CCUXRJOU.js}

@@ -7,17 +7,9 @@ import "./chunk-7OCVIDC7.js";
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
 import { DefaultSessionReader } from "@wrongstack/core/storage";
-import { expectDefined } from "@wrongstack/core/utils";
-import { toErrorMessage } from "@wrongstack/core/utils";
+import { expectDefined, toErrorMessage } from "@wrongstack/core/utils";
 var exportCmd = async (args, deps) => {
-  args = restoreFlags(args, deps, [
-    "format",
-    "f",
-    "out",
-    "o",
-    "no-tools",
-    "no-diagnostics"
-  ]);
+  args = restoreFlags(args, deps, ["format", "f", "out", "o", "no-tools", "no-diagnostics"]);
   if (!deps.sessionStore) {
     deps.renderer.writeError("No session store configured.");
     return 1;
@@ -72,4 +64,4 @@ var exportCmd = async (args, deps) => {
 export {
   exportCmd
 };
-//# sourceMappingURL=export-DOBGPY23.js.map
+//# sourceMappingURL=export-CCUXRJOU.js.map

package/dist/fleet/host-supervisor.d.ts

@@ -1,4 +1,4 @@
-import { FleetSupervisor, type Director } from '@wrongstack/core/coordination';
+import { type Director, FleetSupervisor } from '@wrongstack/core/coordination';
 import type { EventBus } from '@wrongstack/core/kernel';
 import type { Config, SubagentConfig } from '@wrongstack/core/types';
 import type { MultiAgentHostOptions } from './host-types.js';

package/dist/fleet/host.d.ts

@@ -1,8 +1,8 @@
 import { type AgentFactory, Director } from '@wrongstack/core/coordination';
 import type { SubagentRunner } from '@wrongstack/core/types';
 import { type Config, type SubagentConfig, type TaskResult } from '@wrongstack/core/types';
-import { type FleetHostStatus, type FleetHostUsage } from './host-status.js';
 import type { HostSpawnAndWaitOptions, HostSpawnOptions } from './host-spawn-types.js';
+import { type FleetHostStatus, type FleetHostUsage } from './host-status.js';
 import type { MultiAgentDeps, MultiAgentHostOptions } from './host-types.js';
 export type { MultiAgentDeps, MultiAgentHostOptions } from './host-types.js';
 /**

package/dist/fleet/routing.d.ts

@@ -1,5 +1,4 @@
-import type { SubagentRunner } from '@wrongstack/core/types';
-import type { Config } from '@wrongstack/core/types';
+import type { Config, SubagentRunner } from '@wrongstack/core/types';
 import type { MultiAgentHost } from './host.js';
 /**
  * Routing runner — dispatches tasks to standard or ACP runner based on provider.

package/dist/goal-host.d.ts

@@ -15,10 +15,10 @@
  * driven by the autonomous orchestrator + concurrent subagents rather than
  * single-thread turn injection.
  */
-import { type PhaseGraph, type PhaseProgress } from '@wrongstack/core/goal';
 import { type BrainArbiter } from '@wrongstack/core/coordination';
-import type { Config, TaskNode } from '@wrongstack/core/types';
+import { type PhaseGraph, type PhaseProgress } from '@wrongstack/core/goal';
 import type { EventBus } from '@wrongstack/core/kernel';
+import type { Config, TaskNode } from '@wrongstack/core/types';
 import type { MultiAgentHost } from './multi-agent.js';
 /**
  * Extend/trim the autonomous goal command allowlist from the user's exec

package/dist/hooks-wiring.d.ts

@@ -1,6 +1,6 @@
+import type { UserInputPayload } from '@wrongstack/core/agent';
 import type { AgentExtension } from '@wrongstack/core/extension';
 import type { HookRunner } from '@wrongstack/core/hooks';
-import type { UserInputPayload } from '@wrongstack/core/agent';
 /** Raised by the UserPromptSubmit middleware to block a turn before it runs. */
 export declare class HookBlockedError extends Error {
     constructor(reason: string);

package/dist/{hq-LN5CJHCM.js → hq-AHPAE7EN.js}

@@ -1,16 +1,27 @@
-import {
-  parseTokenTtlValue
-} from "./chunk-BGFM3PD7.js";
 import {
   resolveAuditActor
 } from "./chunk-Q5GTM25S.js";
+import {
+  parseTokenTtlValue
+} from "./chunk-BGFM3PD7.js";
 import "./chunk-7OCVIDC7.js";
 
 // src/subcommands/handlers/hq.ts
-import { HQ_AUTH_FILE_VERSION, HQ_CLI_DEFAULT_HOST, mutateHqAuthFile, mintHqToken, readHqAuthFile, resolveHqDataDir, logHqAuthAudit, hqAuthContentHash, hqAuthAuditPath, hqAuthFilePath } from "@wrongstack/core/hq";
-import { HqInsecureExposureError } from "@wrongstack/core/hq";
-import { expectDefined } from "@wrongstack/core/utils";
 import * as fs from "node:fs/promises";
+import {
+  HQ_AUTH_FILE_VERSION,
+  HQ_CLI_DEFAULT_HOST,
+  HqInsecureExposureError,
+  hqAuthAuditPath,
+  hqAuthContentHash,
+  hqAuthFilePath,
+  logHqAuthAudit,
+  mintHqToken,
+  mutateHqAuthFile,
+  readHqAuthFile,
+  resolveHqDataDir
+} from "@wrongstack/core/hq";
+import { expectDefined } from "@wrongstack/core/utils";
 function resolveDataDir(deps) {
   const override = typeof deps.flags?.["data-dir"] === "string" ? deps.flags["data-dir"] : void 0;
   return resolveHqDataDir(override);
@@ -36,7 +47,7 @@ var hqCmd = async (args, deps) => {
   return 1;
 };
 async function startServer(deps) {
-  const { startHqServer } = await import("./hq-server-S7HZG3PA.js");
+  const { startHqServer } = await import("./hq-server-KU2Z54QU.js");
   const dataDir = resolveDataDir(deps);
   const flags = deps.flags ?? {};
   const host = typeof flags["host"] === "string" ? flags["host"] : HQ_CLI_DEFAULT_HOST;
@@ -183,10 +194,8 @@ async function hqAuditVerify(deps) {
 `);
   const fileExists = await fileExistsQuiet(authPath);
   if (!fileExists) {
-    deps.renderer.write(
-      `contentHash: (unavailable \u2014 auth.json does not exist)
-`
-    );
+    deps.renderer.write(`contentHash: (unavailable \u2014 auth.json does not exist)
+`);
     deps.renderer.write(
       `Compare historical entries in the audit log above against a known-good hash.
 `
@@ -199,10 +208,8 @@ async function hqAuditVerify(deps) {
   });
   const hash = hqAuthContentHash(authFile);
   if (hash === void 0) {
-    deps.renderer.write(
-      `contentHash: (unavailable \u2014 auth.json is unreadable or malformed)
-`
-    );
+    deps.renderer.write(`contentHash: (unavailable \u2014 auth.json is unreadable or malformed)
+`);
     deps.renderer.write(
       `Compare historical entries in the audit log above against a known-good hash.
 `
@@ -283,7 +290,11 @@ function resolveTokenCapabilities(scope, args, deps) {
   if (typeof raw !== "string") {
     return { error: "--capabilities requires a comma-separated value." };
   }
-  const capabilities = [...new Set(raw.split(",").map((item) => item.trim()).filter(Boolean))];
+  const capabilities = [
+    ...new Set(
+      raw.split(",").map((item) => item.trim()).filter(Boolean)
+    )
+  ];
   const allowed = new Set(TOKEN_CAPABILITIES[scope]);
   const invalid = capabilities.filter((capability) => !allowed.has(capability));
   if (invalid.length > 0) {
@@ -409,25 +420,35 @@ async function tokenList(args, deps) {
   });
   const tokens = authFile[tokenField] ?? [];
   if (tokens.length === 0) {
-    deps.renderer.write(`No ${scope} tokens issued. ${scope === "browser" ? "Browsers" : "Clients"} are in OPEN MODE.
-`);
-    deps.renderer.write(`Run \`wstack hq token create ${scope === "client" ? "--client " : ""}[label]\` to enter TOKEN MODE.
-`);
+    deps.renderer.write(
+      `No ${scope} tokens issued. ${scope === "browser" ? "Browsers" : "Clients"} are in OPEN MODE.
+`
+    );
+    deps.renderer.write(
+      `Run \`wstack hq token create ${scope === "client" ? "--client " : ""}[label]\` to enter TOKEN MODE.
+`
+    );
     return 0;
   }
-  deps.renderer.write(`${scope === "client" ? "Client" : "Browser"} tokens (${tokens.length}) \u2014 TOKEN MODE:
-`);
+  deps.renderer.write(
+    `${scope === "client" ? "Client" : "Browser"} tokens (${tokens.length}) \u2014 TOKEN MODE:
+`
+  );
   deps.renderer.write("\n");
   for (const t of tokens) {
     const masked = `${t.token.slice(0, 6)}\u2026${t.token.slice(-4)} (${t.token.length} chars)`;
     const capabilities = t.capabilities === void 0 ? "legacy-unscoped" : t.capabilities.join(",") || "none";
     const expires = t.expiresAt ?? "(never)";
-    deps.renderer.write(`  ${t.id}  ${masked}  ${t.createdAt}  expires ${expires}${t.label ? `  "${t.label}"` : ""}  [${capabilities}]${t.lastUsedAt ? `  lastUsed ${t.lastUsedAt}` : ""}
-`);
+    deps.renderer.write(
+      `  ${t.id}  ${masked}  ${t.createdAt}  expires ${expires}${t.label ? `  "${t.label}"` : ""}  [${capabilities}]${t.lastUsedAt ? `  lastUsed ${t.lastUsedAt}` : ""}
+`
+    );
   }
   deps.renderer.write("\n");
-  deps.renderer.write(`${scope === "client" ? "Clients" : "Browsers"} must append ?token=<full-token> to /ws/${scope}.
-`);
+  deps.renderer.write(
+    `${scope === "client" ? "Clients" : "Browsers"} must append ?token=<full-token> to /ws/${scope}.
+`
+  );
   return 0;
 }
 async function tokenRevoke(args, deps) {
@@ -435,8 +456,10 @@ async function tokenRevoke(args, deps) {
   const pos = tokenPositionals(args);
   const idPrefix = pos[0];
   if (!idPrefix) {
-    deps.renderer.writeError(`Usage: wstack hq token revoke ${scope === "client" ? "--client " : ""}<id-prefix>
-`);
+    deps.renderer.writeError(
+      `Usage: wstack hq token revoke ${scope === "client" ? "--client " : ""}<id-prefix>
+`
+    );
     return 1;
   }
   const dataDir = resolveDataDir(deps);
@@ -475,8 +498,10 @@ async function tokenRevoke(args, deps) {
 `);
     return 1;
   }
-  deps.renderer.write(`Revoked ${scope} token ${revoked.id}${revoked.label ? ` ("${revoked.label}")` : ""}.
-`);
+  deps.renderer.write(
+    `Revoked ${scope} token ${revoked.id}${revoked.label ? ` ("${revoked.label}")` : ""}.
+`
+  );
   const hashField = await computeAuditHashField(
     dataDir,
     (msg) => deps.renderer.writeWarning(`${msg}
@@ -508,39 +533,57 @@ function printHelp(deps) {
 `);
   deps.renderer.write(`  wstack hq serve                Same as above (explicit form).
 `);
-  deps.renderer.write(`  wstack hq token create [label] [--ttl <dur>] Mint a browser token, enter token mode.
-`);
-  deps.renderer.write(`  wstack hq token create --client [label] [--ttl <dur>]  Mint a client token (/ws/client).
-`);
+  deps.renderer.write(
+    `  wstack hq token create [label] [--ttl <dur>] Mint a browser token, enter token mode.
+`
+  );
+  deps.renderer.write(
+    `  wstack hq token create --client [label] [--ttl <dur>]  Mint a client token (/ws/client).
+`
+  );
   deps.renderer.write(`  wstack hq token list           List issued browser tokens.
 `);
   deps.renderer.write(`  wstack hq token list --client   List issued client tokens.
 `);
-  deps.renderer.write(`  wstack hq token revoke <id>    Revoke a browser token (id prefix match).
-`);
+  deps.renderer.write(
+    `  wstack hq token revoke <id>    Revoke a browser token (id prefix match).
+`
+  );
   deps.renderer.write(`  wstack hq token revoke --client <id>  Revoke a client token.
 `);
-  deps.renderer.write(`  wstack hq audit verify         Re-derive auth.json contentHash for forensic comparison.
-`);
+  deps.renderer.write(
+    `  wstack hq audit verify         Re-derive auth.json contentHash for forensic comparison.
+`
+  );
   deps.renderer.write("\n");
   deps.renderer.write(`Flags (apply to all subcommands):
 `);
-  deps.renderer.write(`  --data-dir <path>   Override HQ data directory (default ~/.wrongstack/hq).
-`);
-  deps.renderer.write(`  --host <ip>         Bind host (default 0.0.0.0; use 127.0.0.1 for local-only).
-`);
-  deps.renderer.write(`  --tunnel            Publish a temporary *.trycloudflare.com URL (requires cloudflared).
-`);
+  deps.renderer.write(
+    `  --data-dir <path>   Override HQ data directory (default ~/.wrongstack/hq).
+`
+  );
+  deps.renderer.write(
+    `  --host <ip>         Bind host (default 0.0.0.0; use 127.0.0.1 for local-only).
+`
+  );
+  deps.renderer.write(
+    `  --tunnel            Publish a temporary *.trycloudflare.com URL (requires cloudflared).
+`
+  );
   deps.renderer.write(`  --password <value>  Set or rotate the browser login password.
 `);
-  deps.renderer.write(`  --insecure-open     Allow a non-loopback bind with no token/password set.
-`);
+  deps.renderer.write(
+    `  --insecure-open     Allow a non-loopback bind with no token/password set.
+`
+  );
   deps.renderer.write(`  --port <n>          Bind port (default 3499).
 `);
   deps.renderer.write(`  --strict-port       Fail if port is in use.
 `);
-  deps.renderer.write(`  --hq-token-ttl <dur>  Stamp an expiresAt on first-run tokens (e.g. 1h, 7d, 3600s).
-`);
+  deps.renderer.write(
+    `  --hq-token-ttl <dur>  Stamp an expiresAt on first-run tokens (e.g. 1h, 7d, 3600s).
+`
+  );
   deps.renderer.write(
     `  --hq-trusted-proxy-hops <n>  Trust the rightmost n X-Forwarded-For entries when rate-limiting logins.
                         Default 0 (ignore the header). Set to the real hop count behind a tunnel,
@@ -549,12 +592,18 @@ function printHelp(deps) {
   );
   deps.renderer.write(`  --open              Open the dashboard in the default browser.
 `);
-  deps.renderer.write(`  --client, -c        Operate on client tokens instead of browser tokens.
-`);
-  deps.renderer.write(`  --capabilities <csv>  Token grants (browser: control.enqueue; client: telemetry.publish,control.execute).
-`);
-  deps.renderer.write(`  --ttl <duration>    Stamp an expiresAt on the token (e.g. --ttl 1h, --ttl 7d, --ttl 3600s).
-`);
+  deps.renderer.write(
+    `  --client, -c        Operate on client tokens instead of browser tokens.
+`
+  );
+  deps.renderer.write(
+    `  --capabilities <csv>  Token grants (browser: control.enqueue; client: telemetry.publish,control.execute).
+`
+  );
+  deps.renderer.write(
+    `  --ttl <duration>    Stamp an expiresAt on the token (e.g. --ttl 1h, --ttl 7d, --ttl 3600s).
+`
+  );
   deps.renderer.write("\n");
   deps.renderer.write(`auth.json schema version: ${HQ_AUTH_FILE_VERSION}.
 `);
@@ -563,4 +612,4 @@ export {
   hqCmd,
   resolveAuditActor
 };
-//# sourceMappingURL=hq-LN5CJHCM.js.map
+//# sourceMappingURL=hq-AHPAE7EN.js.map

package/dist/hq-command-controller.d.ts

@@ -14,8 +14,8 @@
  *
  * @module hq-command-controller
  */
-import type { HqPublisherCommandResult } from '@wrongstack/core/hq';
 import type { RemoteMailbox } from '@wrongstack/core/coordination';
+import type { HqPublisherCommandResult } from '@wrongstack/core/hq';
 /**
  * Mutable holder for the command dispatch targets. Each field is populated
  * lazily as the corresponding subsystem comes online (director on

package/dist/hq-server/routes/system-handlers.d.ts

@@ -5,9 +5,8 @@
  * Covers: system update check, system health, command audit log, alerts.
  */
 import type * as http from 'node:http';
+import type { HqAlertEngine, HqCommandAuditLog, HqEventEnvelope, HqPersistence } from '@wrongstack/core/hq';
 import type { WebSocket } from 'ws';
-import type { HqCommandAuditLog, HqEventEnvelope, HqPersistence } from '@wrongstack/core/hq';
-import type { HqAlertEngine } from '@wrongstack/core/hq';
 import type { ConnectedClient } from '../types.js';
 export declare function handleApiSystemUpdate(res: http.ServerResponse): Promise<void>;
 export declare function handleApiSystemHealth(res: http.ServerResponse, clients: Map<WebSocket, ConnectedClient>, persistence: HqPersistence, eventLog: HqEventEnvelope[]): Promise<void>;

package/dist/hq-server/routes.d.ts

@@ -8,15 +8,15 @@
  * @module hq-server/routes
  */
 import type * as http from 'node:http';
-import type { WebSocket } from 'ws';
-import type { TrustBoundary } from '@wrongstack/core/security';
-import { type createHqPersistence } from '@wrongstack/core/hq';
-import type { HqSnapshot, HqAlertEngine, HqCommandAuditLog, HqEventEnvelope, HqTranscriptEntry } from '@wrongstack/core/hq';
 import type { createMailboxHttpRouter } from '@wrongstack/core/coordination';
 import { type Mailbox, type MailboxHttpAccessDecision, type MailboxHttpRateLimiter } from '@wrongstack/core/coordination';
+import type { HqAlertEngine, HqCommandAuditLog, HqEventEnvelope, HqSnapshot, HqTranscriptEntry } from '@wrongstack/core/hq';
+import { type createHqPersistence } from '@wrongstack/core/hq';
+import type { TrustBoundary } from '@wrongstack/core/security';
+import type { WebSocket } from 'ws';
 import * as HqServerAuth from './auth.js';
-import * as HqServerUtils from './utils.js';
 import { type ApplyHqAuthFile } from './routes/auth-handlers.js';
+import * as HqServerUtils from './utils.js';
 export declare const setHqSecurityHeaders: typeof HqServerAuth.setHqSecurityHeaders;
 export declare const hasTrustedBrowserOrigin: typeof HqServerAuth.hasTrustedBrowserOrigin;
 export declare const authenticateBrowserRequest: typeof HqServerAuth.authenticateBrowserRequest;
@@ -41,9 +41,9 @@ export declare const agentMessageToEntry: typeof HqServerUtils.agentMessageToEnt
 export declare const readLocalSubagentTranscript: typeof HqServerUtils.readLocalSubagentTranscript;
 export declare const lanIPv4Addresses: typeof HqServerUtils.lanIPv4Addresses;
 export declare const hqRuntimeMarkerPath: typeof HqServerUtils.hqRuntimeMarkerPath;
-import type { ConnectedClient, HqRouterMutableAuth, HqSessionEntry, HqSnapshotBroadcaster, ProjectDetail, TranscriptRing } from './types.js';
 import type { LoginAttemptStore } from './login-attempt-store.js';
-export type { ConnectedClient, HqSnapshotBroadcaster, ProjectDetail, TranscriptRing, };
+import type { ConnectedClient, HqRouterMutableAuth, HqSessionEntry, HqSnapshotBroadcaster, ProjectDetail, TranscriptRing } from './types.js';
+export type { ConnectedClient, HqSnapshotBroadcaster, ProjectDetail, TranscriptRing };
 export interface HqRouterMailboxGateway {
     mailbox: Mailbox;
     router: ReturnType<typeof createMailboxHttpRouter>;

package/dist/{hq-server-S7HZG3PA.js → hq-server-KU2Z54QU.js}

@@ -15,7 +15,7 @@ import {
   readLocalSubagentTranscript,
   sanitizeApiError,
   startHqServer
-} from "./chunk-2KDOFTTM.js";
+} from "./chunk-WOXUE2CN.js";
 import "./chunk-KE7E7DPX.js";
 import "./chunk-Q5GTM25S.js";
 import "./chunk-7OCVIDC7.js";
@@ -37,4 +37,4 @@ export {
   sanitizeApiError,
   startHqServer
 };
-//# sourceMappingURL=hq-server-S7HZG3PA.js.map
+//# sourceMappingURL=hq-server-KU2Z54QU.js.map

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-export { installBrokenPipeHandlers } from './cli-entry-point.js';
 export { main } from './cli-entry-main.js';
+export { installBrokenPipeHandlers } from './cli-entry-point.js';
 export { CLI_VERSION } from './version.js';
 //# sourceMappingURL=index.d.ts.map