@wrongstack/cli 0.309.0 → 0.310.0

package/dist/{acp-5ZLGFHWP.js → acp-EA57GUFB.js}

@@ -3,9 +3,9 @@ import {
   loadCachedAcpRegistry,
   refreshAcpRegistry,
   setupProvider
-} from "./chunk-JQURRYU4.js";
-import "./chunk-SSSJQVUY.js";
-import "./chunk-SZ42FYPT.js";
+} from "./chunk-CHZZEEIP.js";
+import "./chunk-QYIIOMLE.js";
+import "./chunk-BXFYBQKR.js";
 import "./chunk-7OCVIDC7.js";
 
 // src/subcommands/handlers/acp.ts
@@ -33,6 +33,7 @@ import { WebSocketServer } from "ws";
 // src/acp-server-agent.ts
 import { Agent, Context, createDefaultPipelines } from "@wrongstack/core/agent";
 import { ToolExecutor } from "@wrongstack/core/execution";
+import { wireKanbanPorts } from "@wrongstack/runtime";
 import { DefaultLogger, DefaultTokenCounter } from "@wrongstack/core/infrastructure";
 import { EventBus, TOKENS } from "@wrongstack/core/kernel";
 import { ToolRegistry } from "@wrongstack/core/registry";
@@ -227,6 +228,7 @@ function buildAcpServerAgentFactory(deps, options = {}) {
     await container.resolve(TOKENS.MemoryStore).initialize();
     const { provider, providerRegistry } = await bootProvider();
     const events = new EventBus();
+    wireKanbanPorts();
     const source = deps.toolRegistry ?? new ToolRegistry();
     const tools = source.clone();
     if (api) {
@@ -911,4 +913,4 @@ ${renderAcpBenchText(result)}
 export {
   acpCmd
 };
-//# sourceMappingURL=acp-5ZLGFHWP.js.map
+//# sourceMappingURL=acp-EA57GUFB.js.map

package/dist/acp-server-agent.d.ts

@@ -16,7 +16,7 @@
 import type { RunTurnApi } from '@wrongstack/acp/agent';
 import { Agent } from '@wrongstack/core/agent';
 import { type Logger, type PermissionDecision, type PermissionPolicy, type Tool } from '@wrongstack/core/types';
-import type { SubcommandDeps } from './subcommands/index.js';
+import type { SubcommandDeps } from './subcommands/contracts.js';
 /**
  * Error thrown when the server cannot start because no model provider is
  * configured. The CLI handler catches this and prints a actionable message

package/dist/{audit-BBR22QH3.js → audit-ZPCLCC3C.js}

@@ -103,4 +103,4 @@ async function listAudits(log, dir, deps) {
 export {
   auditCmd
 };
-//# sourceMappingURL=audit-BBR22QH3.js.map
+//# sourceMappingURL=audit-ZPCLCC3C.js.map

package/dist/{auth-WOKC2RVG.js → auth-VQMSZGKE.js}

@@ -13,7 +13,7 @@ import {
   runOAuthLoginKind,
   runOAuthLoginMenu,
   validateFamily
-} from "./chunk-7JOMY3HO.js";
+} from "./chunk-USYOJIV2.js";
 import {
   restoreFlags
 } from "./chunk-CSAPOCBP.js";
@@ -29,7 +29,7 @@ import "./chunk-VUVOMXWP.js";
 import {
   activeProfileConfigPath
 } from "./chunk-YMXXOOFN.js";
-import "./chunk-SSSJQVUY.js";
+import "./chunk-QYIIOMLE.js";
 import {
   loadConfigProviders,
   maskedKey,
@@ -37,7 +37,7 @@ import {
   normalizeKeys,
   nowIso,
   writeKeysBack
-} from "./chunk-SZ42FYPT.js";
+} from "./chunk-BXFYBQKR.js";
 import "./chunk-7OCVIDC7.js";
 
 // src/subcommands/handlers/auth.ts
@@ -596,4 +596,4 @@ async function runAuthRemove(deps, providerId) {
 export {
   authCmd
 };
-//# sourceMappingURL=auth-WOKC2RVG.js.map
+//# sourceMappingURL=auth-VQMSZGKE.js.map

package/dist/auth-menu/loopback-server.d.ts

@@ -31,18 +31,6 @@ export interface LoopbackCallback {
     /** The OAuth state parameter from the callback (validated against expected). */
     state: string;
 }
-/**
- * Open a URL in the user's default browser. Best-effort — never throws.
- *
- * - Windows: `cmd /c start "" <url>`
- * - macOS: `open <url>`
- * - Linux: `xdg-open <url>`
- *
- * Not `detached`: the CLI flows wait on the loopback callback in the
- * foreground, so the opener is a short-lived handoff. (The WebUI server's
- * `openBrowser` is deliberately different — it detaches and registers the pid
- * as protected because it launches a browser the session must outlive.)
- */
 export declare function openBrowser(url: string): void;
 /**
  * Start a loopback HTTP server for the OAuth authorization-code callback.

package/dist/{bench-XNDUJOSZ.js → bench-XYG56AMO.js}

@@ -274,4 +274,4 @@ async function benchList(_args, deps) {
 export {
   benchCmd
 };
-//# sourceMappingURL=bench-XNDUJOSZ.js.map
+//# sourceMappingURL=bench-XYG56AMO.js.map

package/dist/boot/tui-session-stub-enrich.d.ts

@@ -0,0 +1,20 @@
+import type { SessionSummary } from '@wrongstack/core/types';
+/** Resolve `<sessionsDir>/<id>.jsonl`, rejecting ids that escape the store
+ * directory (path traversal via crafted shard-relative session ids). Returns
+ * undefined instead of throwing so callers treat it as "not enrichable". */
+export declare function containedJsonlPath(sessionsDir: string, id: string): string | undefined;
+/**
+ * Build the /resume picker list from an over-fetched store pool.
+ *
+ * Enrichment can *raise* a stub's lastActivityAt to its real kill time, so
+ * ordering must happen after enrichment — otherwise stale-ordered stubs crowd
+ * richer sessions out of the top-N window. Fetch a pool ~3x the requested
+ * limit, enrich, re-sort most-recent-first (store COALESCE order), slice.
+ */
+export declare function selectPickerSessions(storeList: (limit: number) => Promise<SessionSummary[]>, sessionsDir: string, limit: number): Promise<SessionSummary[]>;
+/**
+ * Return picker-ready copies of `summaries`, with stub entries enriched from
+ * their JSONL transcripts. Non-stub entries pass through untouched.
+ */
+export declare function enrichStubSummaries(summaries: SessionSummary[], sessionsDir: string): Promise<SessionSummary[]>;
+//# sourceMappingURL=tui-session-stub-enrich.d.ts.map

package/dist/{chronicle-63MFCZN6.js → chronicle-6EPPMUC5.js}

@@ -274,4 +274,4 @@ function tryStat(file) {
 export {
   chronicleCmd
 };
-//# sourceMappingURL=chronicle-63MFCZN6.js.map
+//# sourceMappingURL=chronicle-6EPPMUC5.js.map

package/dist/{chunk-53STH6CX.js → chunk-63GFD62R.js}

@@ -348,7 +348,8 @@ function environmentValue(env, key) {
 }
 function isPathInsideWin32(candidate, parent) {
   const normalizedCandidate = path.win32.resolve(candidate).toLowerCase();
-  const relative = path.win32.relative(parent, normalizedCandidate);
+  const normalizedParent = path.win32.resolve(parent).toLowerCase();
+  const relative = path.win32.relative(normalizedParent, normalizedCandidate);
   return relative === "" || !relative.startsWith("..\\") && relative !== ".." && !path.win32.isAbsolute(relative);
 }
 function otherManagerCommands(selected, packageName, version, opts = { allowScripts: false }) {
@@ -382,4 +383,4 @@ export {
   detectUpdatePackageManager,
   detectUpdatePackageName
 };
-//# sourceMappingURL=chunk-53STH6CX.js.map
+//# sourceMappingURL=chunk-63GFD62R.js.map

package/dist/{chunk-SZ42FYPT.js → chunk-BXFYBQKR.js}

@@ -5,6 +5,7 @@ import { expectDefined } from "@wrongstack/core/utils";
 import * as fs from "node:fs/promises";
 import { decryptConfigSecrets, encryptConfigSecrets } from "@wrongstack/core/security";
 import { atomicWrite, color } from "@wrongstack/core/utils";
+import { nowIso } from "@wrongstack/primitives";
 function normalizeKeys(cfg) {
   if (Array.isArray(cfg.apiKeys) && cfg.apiKeys.length > 0) {
     return cfg.apiKeys.map((k) => ({ ...k }));
@@ -77,9 +78,6 @@ function maskedKey(key) {
   const tail = key.slice(-4);
   return `${color.dim(head + "\u2026")}${tail}`;
 }
-function nowIso() {
-  return (/* @__PURE__ */ new Date()).toISOString();
-}
 async function loadConfigProviders(configPath, vault, opts) {
   const warn = opts?.warn;
   const targetPath = opts?.profileConfigPath ?? configPath;
@@ -151,8 +149,8 @@ export {
   resolveActiveApiKey,
   activeLabel,
   maskedKey,
-  nowIso,
   loadConfigProviders,
-  mutateConfigProviders
+  mutateConfigProviders,
+  nowIso
 };
-//# sourceMappingURL=chunk-SZ42FYPT.js.map
+//# sourceMappingURL=chunk-BXFYBQKR.js.map

package/dist/{chunk-JQURRYU4.js → chunk-CHZZEEIP.js}

@@ -2,7 +2,7 @@ import {
   fallbackCodexProviderModels,
   filterCurrentCodexModelIds,
   isCodexCatalogModel
-} from "./chunk-SSSJQVUY.js";
+} from "./chunk-QYIIOMLE.js";
 
 // src/acp-registry-cache.ts
 import * as fs from "node:fs/promises";
@@ -214,4 +214,4 @@ export {
   setupProvider,
   createGracefulShutdown
 };
-//# sourceMappingURL=chunk-JQURRYU4.js.map
+//# sourceMappingURL=chunk-CHZZEEIP.js.map

package/dist/{chunk-CB35UVXO.js → chunk-KQNYSZG2.js}

@@ -11,9 +11,7 @@ import { randomUUID as randomUUID6 } from "node:crypto";
 import * as fs5 from "node:fs/promises";
 import * as http from "node:http";
 import * as path7 from "node:path";
-import {
-  getSharedProjectMailbox
-} from "@wrongstack/core/coordination";
+import { getSharedProjectMailbox } from "@wrongstack/core/coordination";
 import {
   assessHqExposure as assessHqExposure2,
   createHqPersistence,
@@ -330,6 +328,7 @@ function projectAuthFile(mutableAuth, next) {
   mutableAuth.totpSecret = next.totpSecret;
   mutableAuth.totpPendingSecret = next.totpPendingSecret;
   mutableAuth.totpRecoveryCodes = next.totpRecoveryCodes;
+  mutableAuth.totpLastUsedCounter = next.totpLastUsedCounter;
   mutableAuth.alertRules = next.alertRules;
 }
 function createHqAuthState(authFile, dataDir, opts = {}) {
@@ -425,19 +424,31 @@ var LoginAttemptStore = class _LoginAttemptStore {
   /**
    * Load persisted state from disk and prune stale entries.
    * Safe to call once at startup; subsequent calls reload from disk.
+   *
+   * SEC-001: legacy `cred:` entries (per-password hashes persisted by the
+   * pre-fix version) are skipped here, not just on write — re-seeding them
+   * would keep the hashes in memory and on disk. When any are found, a
+   * debounced rewrite scrubs them from the file.
    */
   async load() {
+    let legacyCredEntries = 0;
     try {
       const raw = await fs.readFile(this.filePath, "utf8");
       const parsed = JSON.parse(raw);
       const cutoff = Date.now() - this.retentionMs;
       for (const [key, entry] of Object.entries(parsed)) {
+        if (key.startsWith("cred:")) {
+          legacyCredEntries++;
+          continue;
+        }
         if (entry && typeof entry.lastAttempt === "number" && entry.lastAttempt > cutoff) {
           this.store.set(key, entry);
         }
       }
     } catch {
+      return;
     }
+    if (legacyCredEntries > 0) this.scheduleWrite();
   }
   get(key) {
     return this.store.get(key);
@@ -559,7 +570,9 @@ var LoginAttemptStore = class _LoginAttemptStore {
     const obj = {};
     for (const [key, entry] of this.store) {
       if (entry.lastAttempt > cutoff) {
-        obj[key] = entry;
+        if (!key.startsWith("cred:")) {
+          obj[key] = entry;
+        }
       } else {
         this.store.delete(key);
       }
@@ -1329,6 +1342,14 @@ async function handleApiLoginVerify(req, res, _url, mutableAuth, sessions, login
       return;
     }
     mutableAuth.totpLastUsedCounter = matchedCounter;
+    try {
+      const next = await mutateHqAuthFile2(dataDir, (current) => ({
+        ...current,
+        totpLastUsedCounter: matchedCounter
+      }));
+      applyAuthFile(next);
+    } catch {
+    }
     loginAttempts.clearOnSuccess(clientIp);
     sessions.delete(sessionId);
     const fullSessionId = randomUUID2();
@@ -2820,7 +2841,7 @@ async function handleApiAgentMessages(req, res, match, agentMessages) {
 async function handleApiSystemUpdate(res) {
   const [{ checkForUpdate }, { detectUpdatePackageName }] = await Promise.all([
     import("./update-check-WARHSVZA.js"),
-    import("./update-VZSOZGYC.js")
+    import("./update-RATFF63M.js")
   ]);
   const packageName = detectUpdatePackageName();
   const info = await checkForUpdate({ packageName });
@@ -3512,7 +3533,6 @@ function createHqServerShutdown(params) {
     clearInterval(params.browserHeartbeatTimer);
     clearInterval(params.timeseriesFlushTimer);
     clearInterval(params.sessionCleanupTimer);
-    void params.loginAttempts.flush();
     params.stopAlertEngine();
     params.authWatcher.close();
     params.snapshotBroadcaster.close();
@@ -3535,6 +3555,11 @@ function createHqServerShutdown(params) {
       params.mailboxManager.mailboxGatewayLastUsed.clear();
       void Promise.all([
         ...mailboxCloses,
+        // Chimera/race: flush the login-attempt store INSIDE the awaited
+        // shutdown set — the old fire-and-forget `void flush()` let close()
+        // resolve before the debounced write landed, so persistence tests
+        // had to sleep past it (and restarts could miss lockout state).
+        params.loginAttempts.flush(),
         params.persistence.eventLog.drain(),
         params.persistence.snapshotStore.drain(),
         params.persistence.timeseries.drain(),
@@ -4457,6 +4482,8 @@ async function startHqServerWithAuth(options, host, port, dataDir, firstRunAuth)
     onApplied: (live) => reassessExposureFloor(live)
   });
   const { mutableAuth } = authState;
+  const loginAttempts = new LoginAttemptStore(dataDir);
+  await loginAttempts.load();
   if (!mutableAuth.cookieSecret && mutableAuth.browserTokens.size > 0) {
     const secret = mintHqCookieSecret2();
     const next = await mutateHqAuthFile3(dataDir, (current) => ({
@@ -4505,8 +4532,6 @@ async function startHqServerWithAuth(options, host, port, dataDir, firstRunAuth)
       mutableAuth,
       sessions
     });
-    const loginAttempts = new LoginAttemptStore(dataDir);
-    void loginAttempts.load();
     const HQ_SESSION_MAX_AGE_MS2 = 7 * 24 * 60 * 60 * 1e3;
     const HQ_SESSION_IDLE_TIMEOUT_MS2 = 30 * 6e4;
     const SESSION_CLEANUP_INTERVAL_MS = 6e4;
@@ -4891,4 +4916,4 @@ export {
   startHqServer,
   HqInsecureExposureError2 as HqInsecureExposureError
 };
-//# sourceMappingURL=chunk-CB35UVXO.js.map
+//# sourceMappingURL=chunk-KQNYSZG2.js.map

package/dist/{chunk-XSG33WHN.js → chunk-QAC263FZ.js}

@@ -7,8 +7,10 @@ import {
 import * as os from "node:os";
 import { color } from "@wrongstack/core/utils";
 var versionCmd = async (_args, deps) => {
+  const bunVersion = globalThis.Bun?.version;
+  const runtime = bunVersion ? `bun v${bunVersion}` : `node ${process.version}`;
   deps.renderer.write(
-    `WrongStack ${CLI_VERSION} (apiVersion ${API_VERSION}, node ${process.version}, ${os.platform()})
+    `WrongStack ${CLI_VERSION} (apiVersion ${API_VERSION}, ${runtime}, ${os.platform()})
 `
   );
   return 0;
@@ -92,4 +94,4 @@ export {
   versionCmd,
   helpCmd
 };
-//# sourceMappingURL=chunk-XSG33WHN.js.map
+//# sourceMappingURL=chunk-QAC263FZ.js.map

package/dist/{chunk-SSSJQVUY.js → chunk-QYIIOMLE.js}

@@ -3,7 +3,7 @@ import {
   normalizeKeys,
   nowIso,
   writeKeysBack
-} from "./chunk-SZ42FYPT.js";
+} from "./chunk-BXFYBQKR.js";
 
 // src/auth-menu/openai-codex-oauth.ts
 import { color } from "@wrongstack/core/utils";
@@ -32,7 +32,20 @@ import {
   startLoopbackServer as startSharedLoopbackServer
 } from "@wrongstack/providers/oauth";
 import { callbackHtml } from "@wrongstack/providers/oauth";
+var URL_METACHAR_REGEX = /[&|;<>(){}^"'`%\n\r\0]/;
+function isSafeBrowserUrl(url) {
+  if (URL_METACHAR_REGEX.test(url)) return false;
+  try {
+    const parsed = new URL(url);
+    return parsed.protocol === "http:" || parsed.protocol === "https:";
+  } catch {
+    return false;
+  }
+}
 function openBrowser(url) {
+  if (!isSafeBrowserUrl(url)) {
+    return;
+  }
   try {
     const platform = process.platform;
     const { command, args } = platform === "win32" ? { command: "cmd", args: ["/c", "start", "", url] } : platform === "darwin" ? { command: "open", args: [url] } : { command: "xdg-open", args: [url] };
@@ -246,4 +259,4 @@ export {
   filterCurrentCodexModelIds,
   isCodexCatalogModel
 };
-//# sourceMappingURL=chunk-SSSJQVUY.js.map
+//# sourceMappingURL=chunk-QYIIOMLE.js.map

package/dist/{chunk-7JOMY3HO.js → chunk-USYOJIV2.js}

@@ -6,7 +6,7 @@ import {
   openBrowser,
   runCodexOAuthLogin,
   startLoopbackServer
-} from "./chunk-SSSJQVUY.js";
+} from "./chunk-QYIIOMLE.js";
 import {
   activeLabel,
   loadConfigProviders,
@@ -15,7 +15,7 @@ import {
   normalizeKeys,
   nowIso,
   writeKeysBack
-} from "./chunk-SZ42FYPT.js";
+} from "./chunk-BXFYBQKR.js";
 
 // src/auth-menu/local.ts
 import { DefaultSecretScrubber as DefaultSecretScrubber2 } from "@wrongstack/core/security";
@@ -1374,4 +1374,4 @@ export {
   addCustomProvider,
   addKeyForProvider
 };
-//# sourceMappingURL=chunk-7JOMY3HO.js.map
+//# sourceMappingURL=chunk-USYOJIV2.js.map

package/dist/{chunk-DOJLAULS.js → chunk-WOTGMHAH.js}

@@ -4,20 +4,27 @@ import {
 
 // src/permission-prompt.ts
 import { alwaysAllowUnavailableReason } from "@wrongstack/core/security";
-import { color as color2, truncate, unifiedDiff, writeOut } from "@wrongstack/core/utils";
+import {
+  color as color2,
+  sanitizeTerminalPreview,
+  sanitizeTerminalText as sanitizeTerminalText2,
+  truncate,
+  unifiedDiff,
+  writeOut
+} from "@wrongstack/core/utils";
 
 // src/diff-renderer.ts
-import { color } from "@wrongstack/core/utils";
+import { color, sanitizeTerminalText } from "@wrongstack/core/utils";
+function diffLineStyle(line) {
+  if (line.startsWith("+++") || line.startsWith("---")) return color.bold(line);
+  if (line.startsWith("@@")) return color.cyan(line);
+  if (line.startsWith("+")) return color.green(line);
+  if (line.startsWith("-")) return color.red(line);
+  return color.dim(line);
+}
 function renderDiff(diff) {
   if (!diff) return "";
-  const lines = diff.split("\n");
-  return lines.map((line) => {
-    if (line.startsWith("+++") || line.startsWith("---")) return color.bold(line);
-    if (line.startsWith("@@")) return color.cyan(line);
-    if (line.startsWith("+")) return color.green(line);
-    if (line.startsWith("-")) return color.red(line);
-    return color.dim(line);
-  }).join("\n");
+  return sanitizeTerminalText(diff).split("\n").map(diffLineStyle).join("\n");
 }
 
 // src/permission-prompt.ts
@@ -46,7 +53,7 @@ ${theme.warn("\u26A0 APPROVAL REQUIRED")} ${theme.primary("\u2502")} ${theme.bol
       ...noAlwaysReason ? [] : [{ key: "a", label: "always", value: "always" }],
       { key: "d", label: "deny", value: "deny" }
     ];
-    const alwaysHint = noAlwaysReason ? "" : `  ${theme.bold("[a]")}lways allow (${suggestedPattern})`;
+    const alwaysHint = noAlwaysReason ? "" : `  ${theme.bold("[a]")}lways allow (${sanitizeTerminalText2(suggestedPattern)})`;
     const answer = await reader.readKey(
       `${theme.bold("[y]")}es  ${theme.bold("[n]")}o${alwaysHint}  ${theme.bold("[d]")}eny: `,
       options
@@ -64,17 +71,22 @@ function makeConfirmAwaiter(reader) {
 function stringifyInput(input) {
   if (!input || typeof input !== "object") return "";
   const obj = input;
-  return Object.entries(obj).filter(([k]) => k !== "content" && k !== "new_string").map(([k, v]) => `${k}: ${truncate(JSON.stringify(v), 80)}`).join("  ");
+  return Object.entries(obj).filter(([k]) => k !== "content" && k !== "new_string").map(([k, v]) => `${k}: ${truncate(sanitizeTerminalText2(JSON.stringify(v)), 80)}`).join("  ");
 }
 var PREVIEW_MAX_LINES = 40;
-function clipPreview(body) {
-  const lines = body.split("\n");
-  if (lines.length <= PREVIEW_MAX_LINES) return body;
-  const hidden = lines.length - PREVIEW_MAX_LINES;
-  return `${lines.slice(0, PREVIEW_MAX_LINES).join("\n")}
-${color2.dim(
-    `\u2026 ${hidden} more line${hidden === 1 ? "" : "s"} not shown \u2014 review the file before approving`
-  )}`;
+var PREVIEW_MAX_CHARS = 8e3;
+function clipPreview(body, decorate = (l) => l) {
+  const safe = sanitizeTerminalText2(body);
+  const { text, truncated } = sanitizeTerminalPreview(body, {
+    maxLines: PREVIEW_MAX_LINES,
+    maxChars: PREVIEW_MAX_CHARS
+  });
+  const rendered = text.split("\n").map(decorate).join("\n");
+  if (!truncated) return rendered;
+  const hiddenLines = safe.split("\n").length - text.split("\n").length;
+  const detail = hiddenLines > 0 ? `${hiddenLines} more line${hiddenLines === 1 ? "" : "s"} not shown` : `${safe.length - text.length} more characters not shown`;
+  return `${rendered}
+${color2.dim(`\u2026 ${detail} \u2014 review the file before approving`)}`;
 }
 function renderPayloadPreview(input) {
   if (!input || typeof input !== "object") return "";
@@ -87,17 +99,15 @@ function renderPayloadPreview(input) {
       toFile: "after",
       context: 2
     });
-    return diff2 ? clipPreview(renderDiff(diff2)) : color2.dim("(replacement is identical)");
+    return diff2 ? clipPreview(diff2, diffLineStyle) : color2.dim("(replacement is identical)");
   }
   const content = obj["content"];
   if (typeof content === "string") {
     if (content === "") return color2.dim("(writes an empty file)");
-    return clipPreview(
-      content.split("\n").map((line) => color2.dim("\u2502 ") + line).join("\n")
-    );
+    return clipPreview(content, (line) => color2.dim("\u2502 ") + line);
   }
   const diff = obj["diff"];
-  return typeof diff === "string" && diff ? clipPreview(renderDiff(diff)) : "";
+  return typeof diff === "string" && diff ? clipPreview(diff, diffLineStyle) : "";
 }
 
 // src/boot/simpleui-full-auto.ts
@@ -473,4 +483,4 @@ export {
   detectProjectFacts,
   renderAgentsTemplate
 };
-//# sourceMappingURL=chunk-DOJLAULS.js.map
+//# sourceMappingURL=chunk-WOTGMHAH.js.map

package/dist/{chunk-T6YAVFXA.js → chunk-X3N5TS2S.js}

@@ -246,6 +246,7 @@ async function persistTelegramConfig(deps, mutator) {
   decrypted.extensions = extensions;
   const encrypted = encryptConfigSecrets(decrypted, deps.vault);
   await atomicWrite(targetPath, JSON.stringify(encrypted, null, 2), { mode: 384 });
+  await deps.vault.flushHardening?.();
   deps.configStore.update({
     extensions
   });
@@ -345,4 +346,4 @@ export {
   normalizeTuiThinkingWord,
   runGit
 };
-//# sourceMappingURL=chunk-T6YAVFXA.js.map
+//# sourceMappingURL=chunk-X3N5TS2S.js.map