@wrongstack/cli 0.309.0 → 0.310.0

package/dist/{diag-doctor-WTBHPOMB.js → diag-doctor-HJKFUY6B.js}

@@ -326,4 +326,4 @@ export {
   diagCmd,
   doctorCmd
 };
-//# sourceMappingURL=diag-doctor-WTBHPOMB.js.map
+//# sourceMappingURL=diag-doctor-HJKFUY6B.js.map

package/dist/diff-renderer.d.ts

@@ -1,2 +1,19 @@
+/**
+ * Colorize a single already-sanitized diff line.
+ *
+ * Exported so callers that must sanitize untrusted text themselves can apply
+ * the styling AFTER sanitizing — sanitizing colorized text would strip the
+ * colors, and colorizing before sanitizing would leave the untrusted escape
+ * sequences in place. See `permission-prompt.ts`.
+ */
+export declare function diffLineStyle(line: string): string;
+/**
+ * Render a diff for terminal display.
+ *
+ * The diff body can carry model-supplied or file-supplied text, so it is
+ * sanitized before styling: a raw `\x1b[2J\x1b[H` in a diff line clears the
+ * screen and lets a payload repaint the surrounding UI — including an approval
+ * prompt's header.
+ */
 export declare function renderDiff(diff: string): string;
 //# sourceMappingURL=diff-renderer.d.ts.map

package/dist/{execution-TYUXABWI.js → execution-WA2UCXNM.js}

@@ -8,7 +8,7 @@ import {
   runGit,
   setAutoSuggestions,
   setSuggestions
-} from "./chunk-T6YAVFXA.js";
+} from "./chunk-X3N5TS2S.js";
 import {
   startCliHqConnection
 } from "./chunk-FKWHSFX4.js";
@@ -49,11 +49,11 @@ import {
 } from "./chunk-YMXXOOFN.js";
 import {
   resolveActiveApiKey
-} from "./chunk-SZ42FYPT.js";
+} from "./chunk-BXFYBQKR.js";
 import "./chunk-7OCVIDC7.js";
 
 // src/execution.ts
-import * as path13 from "node:path";
+import * as path14 from "node:path";
 import { effectiveFallbackChain as effectiveFallbackChain2, setQueuedMessagesSnapshot as setQueuedMessagesSnapshot2 } from "@wrongstack/core/agent";
 import { updateReviewReportEvidence } from "@wrongstack/core/plugin";
 import { attachTodosCheckpoint as attachTodosCheckpoint2 } from "@wrongstack/core/storage";
@@ -207,7 +207,7 @@ async function runWebUIDispatch(ctx) {
   const isSimpleUi = !isSessionChild && flags["simpleui"] === true;
   agent.disableInteractiveConfirmation();
   renderer.setSilent(true);
-  const { runWebUI } = await import("./webui-server-JXJ4CGIX.js");
+  const { runWebUI } = await import("./webui-server-3DU6BVTB.js");
   const flagValue = (names) => {
     for (const name of names) {
       if (!Object.hasOwn(flags, name)) continue;
@@ -406,14 +406,14 @@ async function runWebUIDispatch(ctx) {
       applyLiveSettings?.({ yolo: enabled });
     }
   });
-  const webuiExit = new Promise((resolve3) => {
+  const webuiExit = new Promise((resolve4) => {
     webuiPromise.then(() => {
       renderer.setSilent(false);
       renderer.write("\n");
       renderer.writeInfo(
         color2.yellow(`  Shutting down ${isSimpleUi ? "SimpleUI" : "WebUI"} server\u2026`)
       );
-      resolve3(0);
+      resolve4(0);
     }).catch((err) => {
       if (webuiSessionChild) {
         void writeWebuiSessionChildError(webuiSessionChild.readyFile, {
@@ -431,7 +431,7 @@ async function runWebUIDispatch(ctx) {
           `  \u2717 ${isSimpleUi ? "SimpleUI" : "WebUI"} failed to start: ${err instanceof Error ? err.message : String(err)}`
         )
       );
-      resolve3(1);
+      resolve4(1);
     });
   });
   return webuiExit;
@@ -1013,8 +1013,8 @@ async function switchProjectInPlace(ctx, targetRoot, displayName) {
     attachTodosCheckpoint: attachTodosCheckpoint3
   } = ctx;
   const resolved = path6.resolve(targetRoot);
-  const stat2 = await fs2.stat(resolved).catch(() => null);
-  if (!stat2?.isDirectory()) return `Cannot switch: not a directory: ${resolved}`;
+  const stat3 = await fs2.stat(resolved).catch(() => null);
+  if (!stat3?.isDirectory()) return `Cannot switch: not a directory: ${resolved}`;
   const oldWriter = context.session;
   const oldSessionStore = state.activeSessionStore;
   const oldUsage = tokenCounter.total();
@@ -1136,12 +1136,12 @@ async function switchProjectInPlace(ctx, targetRoot, displayName) {
       modeStore,
       modeId: modeId ?? "default",
       modePrompt: switchMode?.prompt ?? "",
-      tokenSavingMode: config.features.tokenSavingMode,
+      tokenSavingMode: config.features?.tokenSavingMode,
       modelCapabilities: {
-        maxContextTokens: context.provider.capabilities.maxContext,
-        supportsTools: !!context.provider.capabilities.tools,
-        supportsVision: !!context.provider.capabilities.vision,
-        supportsReasoning: !!context.provider.capabilities.reasoning
+        maxContextTokens: context.provider?.capabilities?.maxContext,
+        supportsTools: !!context.provider?.capabilities?.tools,
+        supportsVision: !!context.provider?.capabilities?.vision,
+        supportsReasoning: !!context.provider?.capabilities?.reasoning
       },
       instructionPaths: {
         globalDir: nextWpaths.globalInstructions,
@@ -1152,12 +1152,12 @@ async function switchProjectInPlace(ctx, targetRoot, displayName) {
     context.systemPrompt = await switchBuilder.build({
       cwd: resolved,
       projectRoot: resolved,
-      tools: agent.tools.listForProvider(),
-      catalogTools: agent.tools.list(),
+      tools: typeof agent.tools?.listForProvider === "function" ? agent.tools.listForProvider() : typeof agent.tools?.list === "function" ? agent.tools.list() : [],
+      catalogTools: typeof agent.tools?.list === "function" ? agent.tools.list() : [],
       provider: context.provider.id,
       model: context.model
     });
-    if (agent.container.has(TOKENS.SystemPromptBuilder)) {
+    if (agent.container?.has?.(TOKENS.SystemPromptBuilder)) {
       agent.container.override(TOKENS.SystemPromptBuilder, () => switchBuilder, {
         owner: "tui-project-switch"
       });
@@ -1482,9 +1482,124 @@ async function resumeSession(ctx, sessionId) {
   }
 }
 
-// src/boot/tui-settings-adapter.ts
+// src/boot/tui-session-stub-enrich.ts
 import * as fs3 from "node:fs/promises";
 import * as path8 from "node:path";
+var SLICE_BYTES = 256 * 1024;
+var MAX_TITLE_CHARS = 80;
+function isStubSummary(s) {
+  return !s.title && !s.endedAt;
+}
+function containedJsonlPath(sessionsDir, id) {
+  const root = path8.resolve(sessionsDir);
+  const file = path8.resolve(root, `${id}.jsonl`);
+  if (file !== root && !file.startsWith(root + path8.sep)) return void 0;
+  return file;
+}
+function stripControlChars(text) {
+  return text.replaceAll(/\x1b\[[0-9;?]*[A-Za-z]|\x1b\][^\x07]*(?:\x07|\x1b\\)|[\u0000-\u001f\u007f-\u009f]/g, "");
+}
+function truncate(text) {
+  const oneLine = stripControlChars(text).replaceAll(/\s+/g, " ").trim();
+  return oneLine.length > MAX_TITLE_CHARS ? `${oneLine.slice(0, MAX_TITLE_CHARS - 1)}\u2026` : oneLine;
+}
+function contentToText(content) {
+  if (typeof content === "string") return content;
+  if (Array.isArray(content)) {
+    return content.map(
+      (block) => block && typeof block === "object" && "text" in block && typeof block.text === "string" ? block.text : ""
+    ).filter(Boolean).join(" ");
+  }
+  return "";
+}
+function scanUserInputs(chunk) {
+  let first;
+  let last;
+  for (const line of chunk.split("\n")) {
+    const trimmed = line.trim();
+    if (!trimmed.includes('"user_input"')) continue;
+    try {
+      const event = JSON.parse(trimmed);
+      if (event.type !== "user_input" || typeof event.ts !== "string") continue;
+      const text = contentToText(event.content).trim();
+      if (!text) continue;
+      const hit = { ts: event.ts, text };
+      if (!first) first = hit;
+      last = hit;
+    } catch {
+    }
+  }
+  return { first, last };
+}
+async function firstUserInput(file) {
+  let handle;
+  try {
+    handle = await fs3.open(file, "r");
+    const { size } = await handle.stat();
+    const length = Math.min(SLICE_BYTES, size);
+    const buffer = Buffer.alloc(length);
+    await handle.read(buffer, 0, length, 0);
+    const text = buffer.toString("utf8");
+    const cutoff = text.lastIndexOf("\n");
+    return scanUserInputs(cutoff > 0 ? text.slice(0, cutoff) : text).first;
+  } catch {
+    return void 0;
+  } finally {
+    await handle?.close().catch(() => void 0);
+  }
+}
+async function lastUserInput(file) {
+  let handle;
+  try {
+    handle = await fs3.open(file, "r");
+    const { size } = await handle.stat();
+    const start = Math.max(0, size - SLICE_BYTES);
+    const length = size - start;
+    const buffer = Buffer.alloc(length);
+    await handle.read(buffer, 0, length, start);
+    const text = buffer.toString("utf8");
+    const from = text.indexOf("\n");
+    return scanUserInputs(from >= 0 ? text.slice(from + 1) : text).last;
+  } catch {
+    return void 0;
+  } finally {
+    await handle?.close().catch(() => void 0);
+  }
+}
+function effectiveLastActivity(s) {
+  return s.lastActivityAt ?? s.endedAt ?? s.startedAt ?? "";
+}
+async function selectPickerSessions(storeList, sessionsDir, limit) {
+  const poolSize = Math.min(200, Math.max(limit, limit * 3));
+  const enriched = await enrichStubSummaries(await storeList(poolSize), sessionsDir);
+  return enriched.sort((a, b) => effectiveLastActivity(b).localeCompare(effectiveLastActivity(a))).slice(0, limit);
+}
+async function enrichStubSummaries(summaries, sessionsDir) {
+  return Promise.all(
+    summaries.map(async (s) => {
+      if (!isStubSummary(s)) return s;
+      const file = containedJsonlPath(sessionsDir, s.id);
+      if (!file) return s;
+      try {
+        const stat3 = await fs3.stat(file);
+        const [first, last] = await Promise.all([firstUserInput(file), lastUserInput(file)]);
+        const title = truncate(first?.text ?? "");
+        return {
+          ...s,
+          ...title ? { title } : {},
+          ...last ? { lastUserMessage: truncate(last.text) } : {},
+          lastActivityAt: stat3.mtime.toISOString()
+        };
+      } catch {
+        return s;
+      }
+    })
+  );
+}
+
+// src/boot/tui-settings-adapter.ts
+import * as fs4 from "node:fs/promises";
+import * as path9 from "node:path";
 import { decryptConfigSecrets, encryptConfigSecrets, noOpVault } from "@wrongstack/core/security";
 import { normalizeTokenSavingTier, resolveFleetChatVerbosity } from "@wrongstack/core/types";
 import { atomicWrite, deepMerge } from "@wrongstack/core/utils";
@@ -1622,7 +1737,7 @@ function createSettingsAdapter(ctx) {
         const targetPath = resolvePersistPath(persistDeps);
         let raw;
         try {
-          raw = await fs3.readFile(targetPath, "utf8");
+          raw = await fs4.readFile(targetPath, "utf8");
         } catch (err) {
           if (err.code !== "ENOENT") {
             throw new Error(
@@ -1759,7 +1874,7 @@ function createSettingsAdapter(ctx) {
         let mergedToWrite = decrypted;
         if (actualTarget !== targetPath) {
           try {
-            const destRaw = await fs3.readFile(actualTarget, "utf8");
+            const destRaw = await fs4.readFile(actualTarget, "utf8");
             const destParsed = JSON.parse(destRaw);
             const destDecrypted = decryptConfigSecrets(destParsed, noOpVault);
             mergedToWrite = deepMerge(destDecrypted, decrypted);
@@ -1775,7 +1890,7 @@ function createSettingsAdapter(ctx) {
         const isProjectTarget = actualTarget === wpaths.inProjectConfig;
         const toWrite = isProjectTarget ? filterSafeForProject(mergedToWrite) : mergedToWrite;
         const encrypted = encryptConfigSecrets(toWrite, noOpVault);
-        await fs3.mkdir(path8.dirname(actualTarget), { recursive: true });
+        await fs4.mkdir(path9.dirname(actualTarget), { recursive: true });
         await atomicWrite(actualTarget, JSON.stringify(encrypted, null, 2), { mode: 384 });
         const currentConfig = configStore.get();
         const nextModelRuntime = {
@@ -1881,8 +1996,8 @@ function createSettingsAdapter(ctx) {
 }
 
 // src/boot/tui-theme-adapter.ts
-import * as fs4 from "node:fs/promises";
-import * as path9 from "node:path";
+import * as fs5 from "node:fs/promises";
+import * as path10 from "node:path";
 import { THEME_PRESET_IDS } from "@wrongstack/core/types";
 import { atomicWrite as atomicWrite2 } from "@wrongstack/core/utils";
 var VALID_PRESETS = new Set(THEME_PRESET_IDS);
@@ -1901,7 +2016,7 @@ function createThemeAdapter({ configStore, wpaths }) {
       const configPath = activeProfileConfigPath(wpaths, configStore.get());
       let parsed = {};
       try {
-        const raw = await fs4.readFile(configPath, "utf8");
+        const raw = await fs5.readFile(configPath, "utf8");
         parsed = JSON.parse(raw);
       } catch (err) {
         const e = err;
@@ -1910,7 +2025,7 @@ function createThemeAdapter({ configStore, wpaths }) {
         }
       }
       parsed.themePreset = preset;
-      await fs4.mkdir(path9.dirname(configPath), { recursive: true });
+      await fs5.mkdir(path10.dirname(configPath), { recursive: true });
       await atomicWrite2(configPath, JSON.stringify(parsed, null, 2), { mode: 384 });
     }
   };
@@ -2797,7 +2912,7 @@ function createChimeraWorkRegistry() {
 
 // src/execution-chimera-cascade.ts
 import * as fsp from "node:fs/promises";
-import * as path10 from "node:path";
+import * as path11 from "node:path";
 import { emitReviewIfChanged } from "@wrongstack/core/plugin";
 
 // src/chimera-cascade-evidence.ts
@@ -2891,7 +3006,7 @@ var runCascadeVerificationCommand = (command, cwd, timeoutMs) => {
   const tokens = command.trim().split(/\s+/);
   const executable = tokens[0];
   const args = tokens.slice(1);
-  return new Promise((resolve3) => {
+  return new Promise((resolve4) => {
     let child;
     try {
       child = spawn2(executable, args, {
@@ -2901,11 +3016,11 @@ var runCascadeVerificationCommand = (command, cwd, timeoutMs) => {
         signal: AbortSignal.timeout(timeoutMs)
       });
     } catch {
-      resolve3({ exitCode: CASCADE_EVIDENCE_RUN_ERROR_EXIT });
+      resolve4({ exitCode: CASCADE_EVIDENCE_RUN_ERROR_EXIT });
       return;
     }
-    child.on("error", () => resolve3({ exitCode: CASCADE_EVIDENCE_RUN_ERROR_EXIT }));
-    child.on("close", (code) => resolve3({ exitCode: code ?? CASCADE_EVIDENCE_RUN_ERROR_EXIT }));
+    child.on("error", () => resolve4({ exitCode: CASCADE_EVIDENCE_RUN_ERROR_EXIT }));
+    child.on("close", (code) => resolve4({ exitCode: code ?? CASCADE_EVIDENCE_RUN_ERROR_EXIT }));
   });
 };
 async function verifyCascadeEvidence(evidence, cwd, runCommand = runCascadeVerificationCommand, timeoutMs = CASCADE_EVIDENCE_COMMAND_TIMEOUT_MS) {
@@ -3405,7 +3520,7 @@ async function maybeReReviewCascade({
       const reReadFiles = [];
       for (const f of evidenceBundle.files) {
         try {
-          const absPath = path10.join(evidenceBundle.cwd, f.path);
+          const absPath = path11.join(evidenceBundle.cwd, f.path);
           const content = await fsp.readFile(absPath, "utf8");
           reReadFiles.push({ path: f.path, status: "modified", content });
         } catch {
@@ -3482,7 +3597,7 @@ function errorText2(error) {
 
 // src/execution-chimera-review.ts
 import { randomUUID as randomUUID3 } from "node:crypto";
-import path11 from "node:path";
+import path12 from "node:path";
 import { effectiveFallbackChain, fallbackProfileChain as fallbackProfileChain2 } from "@wrongstack/core/agent";
 import {
   CHIMERA_REVIEW_PROMPT,
@@ -3497,7 +3612,7 @@ import {
 function normalizeFileKeyForCitation(raw, cwd) {
   const forward = raw.replace(/\\/g, "/").replace(/^\.\//, "");
   const isAbsolute = forward.startsWith("/") || /^[a-zA-Z]:\//.test(forward);
-  const pathMod = process.platform === "win32" ? path11.win32 : path11;
+  const pathMod = process.platform === "win32" ? path12.win32 : path12;
   const relative = isAbsolute ? pathMod.relative(cwd, forward).replace(/\\/g, "/").replace(/^\.\//, "") : forward;
   return process.platform === "win32" ? relative.toLowerCase() : relative;
 }
@@ -3717,7 +3832,7 @@ function installChimeraReviewHandler({
             const changedBasenameIndex = /* @__PURE__ */ new Map();
             for (const file of p.files) {
               const normalized = normalizeFileKeyForCitation(file.path, p.cwd);
-              const basename7 = path11.basename(file.path).toLowerCase();
+              const basename7 = path12.basename(file.path).toLowerCase();
               const bucket = changedBasenameIndex.get(basename7);
               if (bucket) bucket.push(normalized);
               else changedBasenameIndex.set(basename7, [normalized]);
@@ -3729,7 +3844,7 @@ function installChimeraReviewHandler({
                 (cp) => cp.endsWith(`/${citedKey}`) || cp === citedKey
               );
               if (suffixMatches.length === 1) return true;
-              const basename7 = path11.basename(finding.location.file).toLowerCase();
+              const basename7 = path12.basename(finding.location.file).toLowerCase();
               const bucket = changedBasenameIndex.get(basename7);
               return !!(bucket && bucket.length === 1);
             });
@@ -4159,12 +4274,12 @@ ${color6.cyan("\u23F3 Auto")}  ${color6.dim("(Ctrl+C to cancel)")}
   let interval;
   let lastTickedSecond = sec + 1;
   let onAbort;
-  return new Promise((resolve3) => {
-    onAbort = () => resolve3(false);
+  return new Promise((resolve4) => {
+    onAbort = () => resolve4(false);
     signal.addEventListener("abort", onAbort, { once: true });
     interval = setInterval(() => {
       if (signal.aborted) {
-        resolve3(false);
+        resolve4(false);
         return;
       }
       const elapsed = Date.now() - start;
@@ -4172,7 +4287,7 @@ ${color6.cyan("\u23F3 Auto")}  ${color6.dim("(Ctrl+C to cancel)")}
       if (remaining <= 0) {
         opts.renderer.write(color6.dim(`  \u21B3 ${truncated}
 `));
-        resolve3(true);
+        resolve4(true);
         return;
       }
       if (opts.onCountdownTick && remaining !== lastTickedSecond) {
@@ -4183,7 +4298,7 @@ ${color6.cyan("\u23F3 Auto")}  ${color6.dim("(Ctrl+C to cancel)")}
             opts.renderer.write(
               color6.yellow("  \u21B3 Countdown cancelled \u2014 switching to manual mode\n")
             );
-            resolve3(false);
+            resolve4(false);
             return;
           }
         } catch {
@@ -4215,7 +4330,7 @@ async function runContextCompaction(opts, _signal) {
 
 // src/repl-client-registration.ts
 import * as crypto from "node:crypto";
-import * as path12 from "node:path";
+import * as path13 from "node:path";
 import { getSharedProjectMailbox, resolveProjectDir } from "@wrongstack/core/coordination";
 import { wstackGlobalRoot } from "@wrongstack/core/utils";
 function registerReplClient(opts) {
@@ -4225,7 +4340,7 @@ function registerReplClient(opts) {
   const hqConnection = startCliHqConnection({
     clientKind: "repl",
     projectRoot: replProjectRoot,
-    projectName: path12.basename(replProjectRoot),
+    projectName: path13.basename(replProjectRoot),
     appConfig: opts.appConfig,
     capabilities: ["telemetry.publish", "mailbox.summary"]
   });
@@ -4239,7 +4354,7 @@ function registerReplClient(opts) {
   clientMailbox.registerClient({
     clientId,
     sessionId: opts.getSessionId?.() ?? replProjectRoot,
-    name: `REPL [${path12.basename(replProjectRoot)}]`,
+    name: `REPL [${path13.basename(replProjectRoot)}]`,
     source: "repl",
     pid: process.pid
   }).then(() => {
@@ -4379,7 +4494,7 @@ async function runReplEternalLoop(opts, onInterruptsReset) {
     } catch (err) {
       opts.renderer.writeError(`[eternal] ${toErrorMessage2(err)}`);
     }
-    await new Promise((resolve3) => setTimeout(resolve3, 250));
+    await new Promise((resolve4) => setTimeout(resolve4, 250));
     return true;
   }
   if (autonomy === "eternal-parallel") {
@@ -4454,7 +4569,7 @@ async function runReplEternalLoop(opts, onInterruptsReset) {
     } catch (err) {
       opts.renderer.writeError(`[parallel] ${toErrorMessage2(err)}`);
     }
-    await new Promise((resolve3) => setTimeout(resolve3, 250));
+    await new Promise((resolve4) => setTimeout(resolve4, 250));
     return true;
   }
   return false;
@@ -5236,8 +5351,8 @@ async function profileMenu(store, paths) {
   }
   const items = await Promise.all(
     names.map(async (name) => {
-      const path14 = paths.profileConfig(name);
-      const data = await readJsonObjectFile(path14);
+      const path15 = paths.profileConfig(name);
+      const data = await readJsonObjectFile(path15);
       const provider = typeof data["provider"] === "string" ? data["provider"] : "unset";
       const model = typeof data["model"] === "string" ? data["model"] : "unset";
       const fallbackCount = Array.isArray(data["fallbackModels"]) ? data["fallbackModels"].length : 0;
@@ -5258,7 +5373,7 @@ async function profileMenu(store, paths) {
           },
           { label: "fallbacks", value: String(fallbackCount) },
           { label: "fallback profiles", value: String(profileCount) },
-          { label: "config", value: path14 }
+          { label: "config", value: path15 }
         ],
         body: isActive ? "This profile owns the current session configuration." : "Switching profiles closes this session so every service restarts with the selected configuration.",
         actions: isActive ? [] : [{ key: "s", label: "switch", command: `/profile switch ${name}`, confirm: true }]
@@ -5333,7 +5448,7 @@ async function memoryMenu(store) {
     emptyText: "No memories found.",
     items: entries.map((entry, index) => ({
       id: `${entry.ts}:${index}`,
-      label: truncate(entry.text.replace(/\s+/g, " "), 52),
+      label: truncate2(entry.text.replace(/\s+/g, " "), 52),
       status: entry.priority === "critical" || entry.priority === "high" ? "warn" : "muted",
       summary: `${entry.scope} \xB7 ${entry.type ?? "fact"}`,
       details: [
@@ -5388,19 +5503,19 @@ async function gitMenu(projectRoot) {
     },
     ...lines.map((line, index) => {
       const code = line.slice(0, 2);
-      const path14 = line.slice(3);
+      const path15 = line.slice(3);
       const staged = code[0] !== " " && code[0] !== "?";
       const unstaged = code[1] !== " " || code === "??";
       return {
-        id: `change:${index}:${path14}`,
-        label: path14,
+        id: `change:${index}:${path15}`,
+        label: path15,
         status: staged ? "good" : "warn",
         summary: `${code} \xB7 ${staged ? "staged" : "not staged"}${unstaged ? " \xB7 working tree" : ""}`,
         details: [
           { label: "status", value: code },
           { label: "staged", value: staged ? "yes" : "no" },
           { label: "unstaged", value: unstaged ? "yes" : "no" },
-          { label: "path", value: path14 }
+          { label: "path", value: path15 }
         ],
         actions: [
           { key: "d", label: "diff summary", command: staged ? "/git diff --staged" : "/git diff" }
@@ -5429,20 +5544,20 @@ async function worktreeMenu(projectRoot) {
           return split < 0 ? [line, "yes"] : [line.slice(0, split), line.slice(split + 1)];
         })
       );
-      const path14 = fields["worktree"] ?? "(unknown path)";
+      const path15 = fields["worktree"] ?? "(unknown path)";
       const branchRef = fields["branch"];
       const branch = branchRef?.replace(/^refs\/heads\//, "") ?? (fields["detached"] ? "(detached)" : "(bare)");
-      const status = path14 === "(unknown path)" || fields["prunable"] ? null : await runGit(["status", "--porcelain=v1"], path14);
+      const status = path15 === "(unknown path)" || fields["prunable"] ? null : await runGit(["status", "--porcelain=v1"], path15);
       const changes = status?.code === 0 ? status.stdout.split(/\r?\n/).filter(Boolean) : [];
       const dirty = changes.length > 0;
       const isMain = index === 0;
       return {
-        id: path14,
+        id: path15,
         label: branch,
         status: fields["prunable"] ? "bad" : dirty ? "warn" : "good",
         summary: `${isMain ? "main" : "linked"} \xB7 ${dirty ? `${changes.length} changes` : "clean"}`,
         details: [
-          { label: "path", value: path14 },
+          { label: "path", value: path15 },
           { label: "branch", value: branch },
           { label: "HEAD", value: fields["HEAD"]?.slice(0, 12) ?? "unknown" },
           { label: "working tree", value: dirty ? `${changes.length} changed paths` : "clean" },
@@ -5480,7 +5595,7 @@ async function worktreeMenu(projectRoot) {
 function isRecord(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
-function truncate(value, max) {
+function truncate2(value, max) {
   return value.length <= max ? value : `${value.slice(0, max - 1)}\u2026`;
 }
 
@@ -5915,7 +6030,11 @@ async function execute(deps) {
           restoredEvents,
           listSessions: async (limit = 20) => {
             if (!activeSessionStore) return [];
-            const summaries = await activeSessionStore.list(limit);
+            const summaries = await selectPickerSessions(
+              (poolLimit) => activeSessionStore.list(poolLimit),
+              wpaths.projectSessions,
+              limit
+            );
             const currentId = agent.ctx.session?.id ?? session.id;
             return summaries.map((s) => ({
               id: s.id,
@@ -6035,7 +6154,7 @@ async function execute(deps) {
           attachments,
           effectiveMaxContext,
           getEffectiveMaxContext,
-          projectName: path13.basename(projectRoot) || void 0,
+          projectName: path14.basename(projectRoot) || void 0,
           projectRoot,
           appConfig: config,
           getSessionId: () => agent.ctx.session?.id ?? session.id,
@@ -6094,4 +6213,4 @@ export {
   execute,
   resolveReviewerFallbackModels
 };
-//# sourceMappingURL=execution-TYUXABWI.js.map
+//# sourceMappingURL=execution-WA2UCXNM.js.map

package/dist/{export-CCUXRJOU.js → export-ROG3DKTZ.js}

@@ -64,4 +64,4 @@ var exportCmd = async (args, deps) => {
 export {
   exportCmd
 };
-//# sourceMappingURL=export-CCUXRJOU.js.map
+//# sourceMappingURL=export-ROG3DKTZ.js.map

package/dist/{hq-PA6RH2UW.js → hq-AG4VW4XO.js}

@@ -51,7 +51,7 @@ var hqCmd = async (args, deps) => {
   return 1;
 };
 async function startServer(deps) {
-  const { startHqServer } = await import("./hq-server-PBRU275L.js");
+  const { startHqServer } = await import("./hq-server-GZGM4BHA.js");
   const dataDir = resolveDataDir(deps);
   const flags = deps.flags ?? {};
   const host = typeof flags["host"] === "string" ? flags["host"] : HQ_CLI_DEFAULT_HOST;
@@ -632,16 +632,22 @@ function printTokenHelp(deps) {
     `  wstack hq token create --client [label] [--ttl <dur>] Mint a client token (/ws/client).
 `
   );
-  deps.renderer.write(`  wstack hq token list                                 List issued browser tokens (alias: ls).
-`);
-  deps.renderer.write(`  wstack hq token list --client                         List issued client tokens.
-`);
+  deps.renderer.write(
+    `  wstack hq token list                                 List issued browser tokens (alias: ls).
+`
+  );
+  deps.renderer.write(
+    `  wstack hq token list --client                         List issued client tokens.
+`
+  );
   deps.renderer.write(
     `  wstack hq token revoke <id>                           Revoke a browser token (id prefix match).
 `
   );
-  deps.renderer.write(`  wstack hq token revoke --client <id>                  Revoke a client token.
-`);
+  deps.renderer.write(
+    `  wstack hq token revoke --client <id>                  Revoke a client token.
+`
+  );
   deps.renderer.write("\n");
   deps.renderer.write(`The token secret is printed once at create time and cannot be recovered
 `);
@@ -656,8 +662,10 @@ function printTokenHelp(deps) {
     `  --data-dir <path>   Override HQ data directory (default ~/.wrongstack/hq).
 `
   );
-  deps.renderer.write(`  --client, -c        Operate on client tokens instead of browser tokens.
-`);
+  deps.renderer.write(
+    `  --client, -c        Operate on client tokens instead of browser tokens.
+`
+  );
   deps.renderer.write(
     `  --capabilities <csv>  Comma-separated capability grants (browser: control.enqueue; client: telemetry.publish,control.execute).
 `
@@ -701,4 +709,4 @@ export {
   hqCmd,
   resolveAuditActor
 };
-//# sourceMappingURL=hq-PA6RH2UW.js.map
+//# sourceMappingURL=hq-AG4VW4XO.js.map

package/dist/hq-server/handle-types.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Type-only leaf for the public HQ server handle.
+ *
+ * Lives separately from `hq-server.ts` so callers (notably
+ * `subcommands/handlers/hq.ts`) can depend on the public types without
+ * pulling in the HQ server implementation. Breaks a long-standing type-only
+ * import edge `handlers/hq.ts → hq-server.ts` that participated in the
+ * 33-member CLI SCC (see docs/reports/modularity-assessment-2026-08-22.md).
+ *
+ * This module MUST contain no runtime imports.
+ */
+export interface HqStartupConnectionInfo {
+    dataDir: string;
+    browserUrl: string;
+    clientUrl: string;
+    clientEnv: {
+        WRONGSTACK_HQ_URL: string;
+        WRONGSTACK_HQ_TOKEN?: string;
+    };
+    createdAuth: boolean;
+    browserTokenMode: boolean;
+    passwordMode: boolean;
+}
+export type HqFirstRunSetup = HqStartupConnectionInfo;
+export interface HqServerHandle {
+    host: string;
+    port: number;
+    firstRunSetup?: HqFirstRunSetup;
+    trustPublicOrigin(origin: string): void;
+    close(): Promise<void>;
+}
+//# sourceMappingURL=handle-types.d.ts.map