@wrongstack/cli 0.302.2 → 0.305.0

package/dist/{acp-XCE4JJF3.js → acp-5ZLGFHWP.js}

@@ -263,7 +263,10 @@ function buildAcpServerAgentFactory(deps, options = {}) {
       iterationTimeoutMs: config.tools?.iterationTimeoutMs ?? 12e4,
       maxToolTimeoutMs: config.tools?.maxToolTimeoutMs ?? 3e5,
       perIterationOutputCapBytes: config.tools?.perIterationOutputCapBytes ?? 1e5,
-      tracer: void 0
+      tracer: void 0,
+      // Kanban tracks work; it does not gate it. Off unless the operator opts
+      // in. See wiring/pipeline.ts for why all four hosts must agree.
+      requireKanbanGovernance: config.tools?.kanbanGovernance ?? false
     });
     return new Agent({
       container,
@@ -908,4 +911,4 @@ ${renderAcpBenchText(result)}
 export {
   acpCmd
 };
-//# sourceMappingURL=acp-XCE4JJF3.js.map
+//# sourceMappingURL=acp-5ZLGFHWP.js.map

package/dist/boot/system-prompt-builder.d.ts

@@ -23,6 +23,19 @@ export interface SystemPromptBuilderPaths {
 interface PathJoiner {
     join(a: string, b: string): string;
 }
+/**
+ * Narrow adapter for the `[Project Jargon Dictionary]` block.
+ *
+ * Re-exported from `../wiring/domain-glossary.ts` so the helper keeps
+ * its zero-coupling contract (no direct import of core's
+ * `MemoryStore` / `MemoryEntry` types). The CLI provides a closure
+ * over the resolved SAGE `memoryStore` that calls
+ * `searchSage('domain-term', { limit })` and maps the result to the
+ * canonical `MemoryEntry` shape that `renderDomainGlossary` in core
+ * is typed against.
+ */
+import type { DomainGlossaryListProvider as DomainGlossaryAdapter } from '../wiring/domain-glossary.js';
+export type { DomainGlossaryListProvider } from '../wiring/domain-glossary.js';
 interface BindSystemPromptBuilderDeps {
     /**
      * The `container` from main(). The helper only calls
@@ -74,6 +87,17 @@ interface BindSystemPromptBuilderDeps {
     /** `config.systemPrompt.variant` — selects system.md, system-lite.md, or system-pro.md. */
     systemPromptVariant?: SystemInstructionVariant | undefined;
     paths: SystemPromptBuilderPaths;
+    /**
+     * Optional narrow `domain-term` adapter for the prompt glossary block.
+     * The CLI provides a closure over the resolved SAGE `memoryStore` that
+     * calls `search({ query: 'domain-term', scope: 'project-memory', limit })`
+     * and returns only the tagged subset, then forwards the result through the
+     * `DomainGlossary.list` shape consumed by
+     * `packages/core/src/core/system-prompt-glossary.ts`.
+     *
+     * Omit → no `[Project Jargon Dictionary]` block in the prompt.
+     */
+    domainGlossary?: DomainGlossaryAdapter | undefined;
     /** `path.join`-shaped helper from the runtime. */
     pathJoiner: PathJoiner;
     /** The `TOKENS.SystemPromptBuilder` token, opaque to the
@@ -91,5 +115,4 @@ interface BindSystemPromptBuilderDeps {
  * matches the pre-refactor inline behavior exactly.
  */
 export declare function bindSystemPromptBuilder(deps: BindSystemPromptBuilderDeps): void;
-export {};
 //# sourceMappingURL=system-prompt-builder.d.ts.map

package/dist/boot/tui-project-switch.d.ts

@@ -1,5 +1,5 @@
 import { type Agent, type Context } from '@wrongstack/core/agent';
-import type { EventBus } from '@wrongstack/core/kernel';
+import { type EventBus } from '@wrongstack/core/kernel';
 import type { Config, MemoryPort, ModeStore, SkillLoader } from '@wrongstack/core/types';
 import type { TuiRuntimeState } from './tui-runtime-state.js';
 export interface ProjectSwitchContext {

package/dist/boot/tui-runtime-state.d.ts

@@ -73,6 +73,20 @@ export interface TuiRuntimeState {
     activateSessionIdentity?: ((sessionId: string, target?: SessionIdentityTarget) => Promise<void>) | undefined;
     /** Todos checkpoint detach function. Mutated by switchProjectInPlace. */
     detachActiveTodosCheckpoint: (() => void | Promise<void>) | undefined;
+    /**
+     * Forward-declared session ref that lives on the cli-main scope. Mutated by
+     * `resumeSession()` when an in-process `/resume` swaps the active writer so
+     * provider-side `getSessionId: () => sessionRef.current?.id` callbacks and
+     * record-mode bindings follow the resumed session instead of staying pinned
+     * to the boot session.
+     *
+     * Optional: tests/hosts that predate the resume refactor can omit it. The
+     * resume handler is then a no-op for the ref, leaving provider calls pinned
+     * to the boot session — same behavior as before this field existed.
+     */
+    sessionRef?: {
+        current: import('@wrongstack/core/types').SessionWriter | undefined;
+    } | undefined;
     /** Pending project switch (F1 picker / F10 sessions). Set by onProjectSelect/onSwitchToSession. */
     pendingProjectSwitch: PendingProjectSwitch | null;
     /** Lazy AutonomousCoordinator. Set by ensureAutonomousCoordinator. */

package/dist/boot/tui-theme-adapter.d.ts

@@ -0,0 +1,33 @@
+/**
+ * TUI Theme adapter — extracts the getThemePreset/saveThemePreset pair from
+ * the runTui() options literal.
+ *
+ * Mirrors the `createSettingsAdapter` shape (see `./tui-settings-adapter.ts`)
+ * but is much narrower: theme is a single enum-valued key, so there's no
+ * section merge, no schema fan-out, and no encrypted-secret dance (the
+ * value is a plain preset name, not a credential).
+ *
+ * The disk write goes to the active profile's config file (same target
+ * `createSettingsAdapter` writes) so both layers share the same source of
+ * truth: future TUI boots read `themePreset` from the same JSON file the
+ * CLI writes via `/theme` and the WebUI flips via Settings.
+ */
+import type { ConfigStore, ThemePresetId } from '@wrongstack/core/types';
+import { type WstackPaths } from '@wrongstack/core/utils';
+export interface ThemeAdapterDeps {
+    configStore: ConfigStore;
+    wpaths: Pick<WstackPaths, 'profileConfig'>;
+}
+export interface ThemeAdapter {
+    /** Read the live preset (memory-backed). Returns undefined when unset. */
+    getThemePreset: () => ThemePresetId | undefined;
+    /**
+     * Persist a new preset to BOTH the in-memory configStore (so the running
+     * session sees it immediately) and the active profile's config file on
+     * disk (so the next boot starts with this preset applied). Unknown ids
+     * are rejected without writing.
+     */
+    saveThemePreset: (preset: ThemePresetId) => Promise<void>;
+}
+export declare function createThemeAdapter({ configStore, wpaths }: ThemeAdapterDeps): ThemeAdapter;
+//# sourceMappingURL=tui-theme-adapter.d.ts.map

package/dist/{chunk-BXQG3H2Y.js → chunk-53STH6CX.js}

@@ -8,6 +8,7 @@ import {
 // src/subcommands/handlers/update.ts
 import { spawn } from "node:child_process";
 import { existsSync, realpathSync } from "node:fs";
+import * as path from "node:path";
 var MAX_UPDATE_OUTPUT_CHARS = 256 * 1024;
 async function runUpdateCommand(args, deps) {
   const cwd = deps.cwd;
@@ -75,9 +76,20 @@ async function runUpdateCommand(args, deps) {
     return 0;
   }
   const packageManager = parsed.packageManager ?? detectUpdatePackageManager();
-  const updateCommand = buildUpdateCommand(packageManager, packageName, info.latest, {
-    allowScripts: parsed.allowScripts
-  });
+  let updateCommand;
+  try {
+    updateCommand = buildUpdateCommand(packageManager, packageName, info.latest, {
+      allowScripts: parsed.allowScripts,
+      cwd,
+      env: deps.environment
+    });
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    deps.renderer.write(`
+Update failed: ${msg}
+`);
+    return 1;
+  }
   deps.renderer.write(`Updating wrongstack from v${info.current} to v${info.latest}...
 `);
   deps.renderer.write(`Running: ${updateCommand.display}
@@ -122,6 +134,10 @@ Update ${termination}.
 ${result.stdout}`.trim();
       if (detail) deps.renderer.write(`
 ${detail}
+`);
+      const lockedFilesGuidance = windowsLockedFilesGuidance(detail);
+      if (lockedFilesGuidance) deps.renderer.write(`
+${lockedFilesGuidance}
 `);
       deps.renderer.write(
         `
@@ -247,36 +263,53 @@ function detectUpdatePackageName(argv = process.argv) {
   const entry = (argv[1] ?? "").replace(/\\/g, "/").toLowerCase();
   return entry.includes("/node_modules/@wrongstack/cli/") || entry.includes("/packages/cli/dist/") ? "@wrongstack/cli" : "wrongstack";
 }
-function buildUpdateCommand(packageManager, packageName, version, opts = { allowScripts: false }) {
+function buildUpdateCommand(packageManager, packageName, version, opts = {
+  allowScripts: false
+}) {
   const ignoreScripts = !opts.allowScripts;
   const target = `${packageName}@${version}`;
   switch (packageManager) {
     case "pnpm":
       return command(
         packageManager,
-        ignoreScripts ? ["add", "-g", "--ignore-scripts", target] : ["add", "-g", target]
+        ignoreScripts ? ["add", "-g", "--ignore-scripts", target] : ["add", "-g", target],
+        opts.cwd,
+        opts.env
       );
     case "yarn":
       return command(
         packageManager,
-        ignoreScripts ? ["global", "add", "--ignore-scripts", target] : ["global", "add", target]
+        ignoreScripts ? ["global", "add", "--ignore-scripts", target] : ["global", "add", target],
+        opts.cwd,
+        opts.env
       );
     case "bun":
       return command(
         packageManager,
-        ignoreScripts ? ["add", "-g", "--ignore-scripts", target] : ["add", "-g", target]
+        ignoreScripts ? ["add", "-g", "--ignore-scripts", target] : ["add", "-g", target],
+        opts.cwd,
+        opts.env
       );
     case "npm":
       return command(
         packageManager,
-        ignoreScripts ? ["install", "-g", "--ignore-scripts", target] : ["install", "-g", target]
+        ignoreScripts ? ["install", "-g", "--ignore-scripts", target] : ["install", "-g", target],
+        opts.cwd,
+        opts.env
       );
   }
 }
-function command(pm, args) {
+function command(pm, args, cwd, env = process.env) {
   const display = `${pm} ${args.join(" ")}`;
-  if (process.platform === "win32" && pm !== "bun") {
-    const shim = buildWin32CmdShimInvocation(pm, args);
+  const resolvedExecutable = cwd ? resolveWin32PackageManagerPath(pm, cwd, env) : void 0;
+  if (process.platform === "win32" && cwd && !resolvedExecutable) {
+    throw new Error(
+      `Could not find ${pm} outside the current project directory. Install ${pm} globally or put its global executable directory on PATH.`
+    );
+  }
+  const executable = resolvedExecutable ?? pm;
+  if (process.platform === "win32" && (pm !== "bun" || /\.(?:cmd|bat)$/i.test(executable))) {
+    const shim = buildWin32CmdShimInvocation(executable, args);
     return {
       executable: shim.command,
       args: shim.args,
@@ -284,7 +317,39 @@ function command(pm, args) {
       windowsVerbatimArguments: shim.windowsVerbatimArguments
     };
   }
-  return { executable: pm, args, display };
+  return { executable, args, display };
+}
+function resolveWin32PackageManagerPath(packageManager, cwd, env = process.env, pathExists = existsSync) {
+  if (process.platform !== "win32") return void 0;
+  const pathValue = environmentValue(env, "PATH");
+  if (!pathValue) return void 0;
+  const cwdPath = path.win32.resolve(cwd).toLowerCase();
+  const extensions = packageManager.includes(".") ? [""] : environmentValue(env, "PATHEXT")?.split(";").filter(Boolean) ?? [
+    ".COM",
+    ".EXE",
+    ".BAT",
+    ".CMD"
+  ];
+  for (const rawEntry of pathValue.split(";")) {
+    const entry = rawEntry.trim().replace(/^"|"$/g, "");
+    if (!entry || !path.win32.isAbsolute(entry)) continue;
+    const directory = path.win32.resolve(entry);
+    if (isPathInsideWin32(directory, cwdPath)) continue;
+    for (const extension of extensions) {
+      const candidate = path.win32.join(directory, `${packageManager}${extension}`);
+      if (pathExists(candidate)) return candidate;
+    }
+  }
+  return void 0;
+}
+function environmentValue(env, key) {
+  const match = Object.entries(env).find(([name]) => name.toUpperCase() === key);
+  return typeof match?.[1] === "string" ? match[1] : void 0;
+}
+function isPathInsideWin32(candidate, parent) {
+  const normalizedCandidate = path.win32.resolve(candidate).toLowerCase();
+  const relative = path.win32.relative(parent, normalizedCandidate);
+  return relative === "" || !relative.startsWith("..\\") && relative !== ".." && !path.win32.isAbsolute(relative);
 }
 function otherManagerCommands(selected, packageName, version, opts = { allowScripts: false }) {
   const commands = ["npm", "pnpm", "yarn", "bun"].filter((pm) => pm !== selected).map((pm) => `  ${buildUpdateCommand(pm, packageName, version, opts).display}`);
@@ -301,6 +366,15 @@ function installWarningSummary(output) {
   if (!/allow-scripts|allowScripts/i.test(output)) return null;
   return "Install completed, but npm reported blocked lifecycle scripts. If a native optional feature is missing, rerun the update with npm script approval for the named package.";
 }
+function windowsLockedFilesGuidance(output) {
+  if (process.platform !== "win32") return null;
+  const hasLockError = /\b(?:EBUSY|EPERM|EACCES|ENOTEMPTY)\b/i.test(output);
+  const isWrongStackNativeFile = /(?:\.wrongstack-|wrongstack[\\/]node_modules|electron\.exe|dd_pprof\.node|node-pty)/i.test(
+    output
+  );
+  if (!hasLockError || !isWrongStackNativeFile) return null;
+  return "Windows could not replace a native file held by a running WrongStack process. Stop any WrongStack WebUI, Desktop, or background process, then rerun the same update command. Do not remove npm\u2019s .wrongstack-* staging directory until those processes have stopped.";
+}
 
 export {
   runUpdateCommand,
@@ -308,4 +382,4 @@ export {
   detectUpdatePackageManager,
   detectUpdatePackageName
 };
-//# sourceMappingURL=chunk-BXQG3H2Y.js.map
+//# sourceMappingURL=chunk-53STH6CX.js.map

package/dist/{chunk-JW75HY4F.js → chunk-FKWHSFX4.js}

@@ -4,7 +4,11 @@ import { createHqPublisherFromEnv, resolveHqConfig } from "@wrongstack/core/hq";
 import { WebSocket } from "ws";
 
 // src/kanban-hq-sync.ts
-import { deriveHqProjectId } from "@wrongstack/core/hq";
+import {
+  deriveHqProjectId,
+  MAX_HQ_KANBAN_BOARD_BYTES,
+  redactHqEventPayload
+} from "@wrongstack/core/hq";
 import {
   bridgeKanbanSupervisor,
   deleteBoard,
@@ -18,6 +22,7 @@ var SYNC_STATE_KEY = "hq-sync-state-v1";
 var MAX_KANBAN_SNAPSHOT_PAYLOAD_BYTES = 512 * 1024;
 var KANBAN_TOMBSTONE_RETENTION_MS = 30 * 24 * 60 * 60 * 1e3;
 var MAX_BOARDS_PER_PUBLISH = 50;
+var KANBAN_SNAPSHOT_SUMMARY_CAP = 1e5;
 function warnSyncFailure(error) {
   process.emitWarning(
     `WrongStack kanban HQ sync failed (best-effort, will retry on next change): ${error instanceof Error ? error.message : String(error)}`,
@@ -123,6 +128,14 @@ function createKanbanHqSync(projectRoot, projectId = deriveHqProjectId(projectRo
       }
       present.add(boardId);
       const record = boardRecord(board);
+      const wireBytes = hqWireBoardBytes(record.board, target.redactionPolicy);
+      if (wireBytes > MAX_HQ_KANBAN_BOARD_BYTES) {
+        process.emitWarning(
+          `Kanban board "${boardId}" serializes to ${wireBytes} bytes for HQ, over the ${MAX_HQ_KANBAN_BOARD_BYTES}-byte per-board limit. It will not appear in HQ until it shrinks; archive completed cards.`,
+          { code: "WRONGSTACK_HQ_KANBAN_BOARD_DROPPED" }
+        );
+        continue;
+      }
       const known = state.boards[boardId];
       const hadTombstone = state.tombstones[boardId] !== void 0;
       if (fullSnapshot || hadTombstone || known === void 0 || compareVersions(known.revision, known.updatedAt, record.revision, record.updatedAt) !== 0) {
@@ -160,7 +173,7 @@ function createKanbanHqSync(projectRoot, projectId = deriveHqProjectId(projectRo
       target.publishEvent({
         type: "kanban.snapshot",
         payload,
-        maxSummaryLength: 1e5
+        maxSummaryLength: KANBAN_SNAPSHOT_SUMMARY_CAP
       });
     }
   };
@@ -270,6 +283,15 @@ function createKanbanHqSync(projectRoot, projectId = deriveHqProjectId(projectRo
     }
   };
 }
+function hqWireBoardBytes(board, policy) {
+  const raw = Buffer.byteLength(JSON.stringify(board), "utf8");
+  if (raw <= MAX_HQ_KANBAN_BOARD_BYTES) return raw;
+  const redacted = redactHqEventPayload("kanban.snapshot", board, {
+    policy,
+    maxSummaryLength: KANBAN_SNAPSHOT_SUMMARY_CAP
+  }).value;
+  return Buffer.byteLength(JSON.stringify(redacted), "utf8");
+}
 function boardRecord(board) {
   return {
     boardId: board.id,
@@ -325,7 +347,14 @@ function chunkSnapshotPayload(projectId, generatedAt, boards, tombstones) {
   for (const board of boards) append("boards", board);
   for (const tombstone of tombstones) append("tombstones", tombstone);
   pushCurrent();
-  return chunks.length > 0 ? chunks : [emptyPayload()];
+  const result = chunks.length > 0 ? chunks : [emptyPayload()];
+  if (result.length > 1) {
+    result.forEach((payload, index) => {
+      payload.chunkIndex = index;
+      payload.chunkCount = result.length;
+    });
+  }
+  return result;
 }
 function coalesceRemoteSnapshots(older, newer) {
   const byBoardId = /* @__PURE__ */ new Map();
@@ -478,4 +507,4 @@ function startCliHqConnection(options) {
 export {
   startCliHqConnection
 };
-//# sourceMappingURL=chunk-JW75HY4F.js.map
+//# sourceMappingURL=chunk-FKWHSFX4.js.map

package/dist/{chunk-WOXUE2CN.js → chunk-RHLQT3EV.js}

@@ -1998,7 +1998,7 @@ async function handleApiAgentMessages(req, res, match, agentMessages) {
 async function handleApiSystemUpdate(res) {
   const [{ checkForUpdate }, { detectUpdatePackageName }] = await Promise.all([
     import("./update-check-WARHSVZA.js"),
-    import("./update-LTDJGAFU.js")
+    import("./update-VZSOZGYC.js")
   ]);
   const packageName = detectUpdatePackageName();
   const info = await checkForUpdate({ packageName });
@@ -3921,6 +3921,16 @@ function handleClient(ws, clients, browsers, eventLog, auth, snapshotBroadcaster
       }
       const parsedPayload = parseHqEventPayload(incomingEvent.type, incomingEvent.payload);
       if (!parsedPayload.ok) {
+        console.warn(
+          JSON.stringify({
+            level: "warn",
+            event: "hq.event_payload_rejected",
+            eventType: incomingEvent.type,
+            clientId: client.clientId,
+            projectId: client.projectId,
+            timestamp: (/* @__PURE__ */ new Date()).toISOString()
+          })
+        );
         return;
       }
       client.lastEventSeq = incomingEvent.seq;
@@ -4773,4 +4783,4 @@ export {
   startHqServer,
   HqInsecureExposureError2 as HqInsecureExposureError
 };
-//# sourceMappingURL=chunk-WOXUE2CN.js.map
+//# sourceMappingURL=chunk-RHLQT3EV.js.map