@wrongstack/cli 0.309.1 → 0.310.0

package/dist/{acp-7NWCC2GO.js → acp-EA57GUFB.js}

@@ -3,9 +3,9 @@ import {
   loadCachedAcpRegistry,
   refreshAcpRegistry,
   setupProvider
-} from "./chunk-UINEP3E7.js";
-import "./chunk-XQ6FI2K6.js";
-import "./chunk-SZ42FYPT.js";
+} from "./chunk-CHZZEEIP.js";
+import "./chunk-QYIIOMLE.js";
+import "./chunk-BXFYBQKR.js";
 import "./chunk-7OCVIDC7.js";
 
 // src/subcommands/handlers/acp.ts
@@ -33,6 +33,7 @@ import { WebSocketServer } from "ws";
 // src/acp-server-agent.ts
 import { Agent, Context, createDefaultPipelines } from "@wrongstack/core/agent";
 import { ToolExecutor } from "@wrongstack/core/execution";
+import { wireKanbanPorts } from "@wrongstack/runtime";
 import { DefaultLogger, DefaultTokenCounter } from "@wrongstack/core/infrastructure";
 import { EventBus, TOKENS } from "@wrongstack/core/kernel";
 import { ToolRegistry } from "@wrongstack/core/registry";
@@ -227,6 +228,7 @@ function buildAcpServerAgentFactory(deps, options = {}) {
     await container.resolve(TOKENS.MemoryStore).initialize();
     const { provider, providerRegistry } = await bootProvider();
     const events = new EventBus();
+    wireKanbanPorts();
     const source = deps.toolRegistry ?? new ToolRegistry();
     const tools = source.clone();
     if (api) {
@@ -911,4 +913,4 @@ ${renderAcpBenchText(result)}
 export {
   acpCmd
 };
-//# sourceMappingURL=acp-7NWCC2GO.js.map
+//# sourceMappingURL=acp-EA57GUFB.js.map

package/dist/acp-server-agent.d.ts

@@ -16,7 +16,7 @@
 import type { RunTurnApi } from '@wrongstack/acp/agent';
 import { Agent } from '@wrongstack/core/agent';
 import { type Logger, type PermissionDecision, type PermissionPolicy, type Tool } from '@wrongstack/core/types';
-import type { SubcommandDeps } from './subcommands/index.js';
+import type { SubcommandDeps } from './subcommands/contracts.js';
 /**
  * Error thrown when the server cannot start because no model provider is
  * configured. The CLI handler catches this and prints a actionable message

package/dist/{audit-BBR22QH3.js → audit-ZPCLCC3C.js}

@@ -103,4 +103,4 @@ async function listAudits(log, dir, deps) {
 export {
   auditCmd
 };
-//# sourceMappingURL=audit-BBR22QH3.js.map
+//# sourceMappingURL=audit-ZPCLCC3C.js.map

package/dist/{auth-GZ2FK5KR.js → auth-VQMSZGKE.js}

@@ -13,7 +13,7 @@ import {
   runOAuthLoginKind,
   runOAuthLoginMenu,
   validateFamily
-} from "./chunk-ZRZ54GVL.js";
+} from "./chunk-USYOJIV2.js";
 import {
   restoreFlags
 } from "./chunk-CSAPOCBP.js";
@@ -29,7 +29,7 @@ import "./chunk-VUVOMXWP.js";
 import {
   activeProfileConfigPath
 } from "./chunk-YMXXOOFN.js";
-import "./chunk-XQ6FI2K6.js";
+import "./chunk-QYIIOMLE.js";
 import {
   loadConfigProviders,
   maskedKey,
@@ -37,7 +37,7 @@ import {
   normalizeKeys,
   nowIso,
   writeKeysBack
-} from "./chunk-SZ42FYPT.js";
+} from "./chunk-BXFYBQKR.js";
 import "./chunk-7OCVIDC7.js";
 
 // src/subcommands/handlers/auth.ts
@@ -596,4 +596,4 @@ async function runAuthRemove(deps, providerId) {
 export {
   authCmd
 };
-//# sourceMappingURL=auth-GZ2FK5KR.js.map
+//# sourceMappingURL=auth-VQMSZGKE.js.map

package/dist/{bench-XNDUJOSZ.js → bench-XYG56AMO.js}

@@ -274,4 +274,4 @@ async function benchList(_args, deps) {
 export {
   benchCmd
 };
-//# sourceMappingURL=bench-XNDUJOSZ.js.map
+//# sourceMappingURL=bench-XYG56AMO.js.map

package/dist/boot/tui-session-stub-enrich.d.ts

@@ -0,0 +1,20 @@
+import type { SessionSummary } from '@wrongstack/core/types';
+/** Resolve `<sessionsDir>/<id>.jsonl`, rejecting ids that escape the store
+ * directory (path traversal via crafted shard-relative session ids). Returns
+ * undefined instead of throwing so callers treat it as "not enrichable". */
+export declare function containedJsonlPath(sessionsDir: string, id: string): string | undefined;
+/**
+ * Build the /resume picker list from an over-fetched store pool.
+ *
+ * Enrichment can *raise* a stub's lastActivityAt to its real kill time, so
+ * ordering must happen after enrichment — otherwise stale-ordered stubs crowd
+ * richer sessions out of the top-N window. Fetch a pool ~3x the requested
+ * limit, enrich, re-sort most-recent-first (store COALESCE order), slice.
+ */
+export declare function selectPickerSessions(storeList: (limit: number) => Promise<SessionSummary[]>, sessionsDir: string, limit: number): Promise<SessionSummary[]>;
+/**
+ * Return picker-ready copies of `summaries`, with stub entries enriched from
+ * their JSONL transcripts. Non-stub entries pass through untouched.
+ */
+export declare function enrichStubSummaries(summaries: SessionSummary[], sessionsDir: string): Promise<SessionSummary[]>;
+//# sourceMappingURL=tui-session-stub-enrich.d.ts.map

package/dist/{chronicle-63MFCZN6.js → chronicle-6EPPMUC5.js}

@@ -274,4 +274,4 @@ function tryStat(file) {
 export {
   chronicleCmd
 };
-//# sourceMappingURL=chronicle-63MFCZN6.js.map
+//# sourceMappingURL=chronicle-6EPPMUC5.js.map

package/dist/{chunk-53STH6CX.js → chunk-63GFD62R.js}

@@ -348,7 +348,8 @@ function environmentValue(env, key) {
 }
 function isPathInsideWin32(candidate, parent) {
   const normalizedCandidate = path.win32.resolve(candidate).toLowerCase();
-  const relative = path.win32.relative(parent, normalizedCandidate);
+  const normalizedParent = path.win32.resolve(parent).toLowerCase();
+  const relative = path.win32.relative(normalizedParent, normalizedCandidate);
   return relative === "" || !relative.startsWith("..\\") && relative !== ".." && !path.win32.isAbsolute(relative);
 }
 function otherManagerCommands(selected, packageName, version, opts = { allowScripts: false }) {
@@ -382,4 +383,4 @@ export {
   detectUpdatePackageManager,
   detectUpdatePackageName
 };
-//# sourceMappingURL=chunk-53STH6CX.js.map
+//# sourceMappingURL=chunk-63GFD62R.js.map

package/dist/{chunk-SZ42FYPT.js → chunk-BXFYBQKR.js}

@@ -5,6 +5,7 @@ import { expectDefined } from "@wrongstack/core/utils";
 import * as fs from "node:fs/promises";
 import { decryptConfigSecrets, encryptConfigSecrets } from "@wrongstack/core/security";
 import { atomicWrite, color } from "@wrongstack/core/utils";
+import { nowIso } from "@wrongstack/primitives";
 function normalizeKeys(cfg) {
   if (Array.isArray(cfg.apiKeys) && cfg.apiKeys.length > 0) {
     return cfg.apiKeys.map((k) => ({ ...k }));
@@ -77,9 +78,6 @@ function maskedKey(key) {
   const tail = key.slice(-4);
   return `${color.dim(head + "\u2026")}${tail}`;
 }
-function nowIso() {
-  return (/* @__PURE__ */ new Date()).toISOString();
-}
 async function loadConfigProviders(configPath, vault, opts) {
   const warn = opts?.warn;
   const targetPath = opts?.profileConfigPath ?? configPath;
@@ -151,8 +149,8 @@ export {
   resolveActiveApiKey,
   activeLabel,
   maskedKey,
-  nowIso,
   loadConfigProviders,
-  mutateConfigProviders
+  mutateConfigProviders,
+  nowIso
 };
-//# sourceMappingURL=chunk-SZ42FYPT.js.map
+//# sourceMappingURL=chunk-BXFYBQKR.js.map

package/dist/{chunk-UINEP3E7.js → chunk-CHZZEEIP.js}

@@ -2,7 +2,7 @@ import {
   fallbackCodexProviderModels,
   filterCurrentCodexModelIds,
   isCodexCatalogModel
-} from "./chunk-XQ6FI2K6.js";
+} from "./chunk-QYIIOMLE.js";
 
 // src/acp-registry-cache.ts
 import * as fs from "node:fs/promises";
@@ -214,4 +214,4 @@ export {
   setupProvider,
   createGracefulShutdown
 };
-//# sourceMappingURL=chunk-UINEP3E7.js.map
+//# sourceMappingURL=chunk-CHZZEEIP.js.map

package/dist/{chunk-CB35UVXO.js → chunk-KQNYSZG2.js}

@@ -11,9 +11,7 @@ import { randomUUID as randomUUID6 } from "node:crypto";
 import * as fs5 from "node:fs/promises";
 import * as http from "node:http";
 import * as path7 from "node:path";
-import {
-  getSharedProjectMailbox
-} from "@wrongstack/core/coordination";
+import { getSharedProjectMailbox } from "@wrongstack/core/coordination";
 import {
   assessHqExposure as assessHqExposure2,
   createHqPersistence,
@@ -330,6 +328,7 @@ function projectAuthFile(mutableAuth, next) {
   mutableAuth.totpSecret = next.totpSecret;
   mutableAuth.totpPendingSecret = next.totpPendingSecret;
   mutableAuth.totpRecoveryCodes = next.totpRecoveryCodes;
+  mutableAuth.totpLastUsedCounter = next.totpLastUsedCounter;
   mutableAuth.alertRules = next.alertRules;
 }
 function createHqAuthState(authFile, dataDir, opts = {}) {
@@ -425,19 +424,31 @@ var LoginAttemptStore = class _LoginAttemptStore {
   /**
    * Load persisted state from disk and prune stale entries.
    * Safe to call once at startup; subsequent calls reload from disk.
+   *
+   * SEC-001: legacy `cred:` entries (per-password hashes persisted by the
+   * pre-fix version) are skipped here, not just on write — re-seeding them
+   * would keep the hashes in memory and on disk. When any are found, a
+   * debounced rewrite scrubs them from the file.
    */
   async load() {
+    let legacyCredEntries = 0;
     try {
       const raw = await fs.readFile(this.filePath, "utf8");
       const parsed = JSON.parse(raw);
       const cutoff = Date.now() - this.retentionMs;
       for (const [key, entry] of Object.entries(parsed)) {
+        if (key.startsWith("cred:")) {
+          legacyCredEntries++;
+          continue;
+        }
         if (entry && typeof entry.lastAttempt === "number" && entry.lastAttempt > cutoff) {
           this.store.set(key, entry);
         }
       }
     } catch {
+      return;
     }
+    if (legacyCredEntries > 0) this.scheduleWrite();
   }
   get(key) {
     return this.store.get(key);
@@ -559,7 +570,9 @@ var LoginAttemptStore = class _LoginAttemptStore {
     const obj = {};
     for (const [key, entry] of this.store) {
       if (entry.lastAttempt > cutoff) {
-        obj[key] = entry;
+        if (!key.startsWith("cred:")) {
+          obj[key] = entry;
+        }
       } else {
         this.store.delete(key);
       }
@@ -1329,6 +1342,14 @@ async function handleApiLoginVerify(req, res, _url, mutableAuth, sessions, login
       return;
     }
     mutableAuth.totpLastUsedCounter = matchedCounter;
+    try {
+      const next = await mutateHqAuthFile2(dataDir, (current) => ({
+        ...current,
+        totpLastUsedCounter: matchedCounter
+      }));
+      applyAuthFile(next);
+    } catch {
+    }
     loginAttempts.clearOnSuccess(clientIp);
     sessions.delete(sessionId);
     const fullSessionId = randomUUID2();
@@ -2820,7 +2841,7 @@ async function handleApiAgentMessages(req, res, match, agentMessages) {
 async function handleApiSystemUpdate(res) {
   const [{ checkForUpdate }, { detectUpdatePackageName }] = await Promise.all([
     import("./update-check-WARHSVZA.js"),
-    import("./update-VZSOZGYC.js")
+    import("./update-RATFF63M.js")
   ]);
   const packageName = detectUpdatePackageName();
   const info = await checkForUpdate({ packageName });
@@ -3512,7 +3533,6 @@ function createHqServerShutdown(params) {
     clearInterval(params.browserHeartbeatTimer);
     clearInterval(params.timeseriesFlushTimer);
     clearInterval(params.sessionCleanupTimer);
-    void params.loginAttempts.flush();
     params.stopAlertEngine();
     params.authWatcher.close();
     params.snapshotBroadcaster.close();
@@ -3535,6 +3555,11 @@ function createHqServerShutdown(params) {
       params.mailboxManager.mailboxGatewayLastUsed.clear();
       void Promise.all([
         ...mailboxCloses,
+        // Chimera/race: flush the login-attempt store INSIDE the awaited
+        // shutdown set — the old fire-and-forget `void flush()` let close()
+        // resolve before the debounced write landed, so persistence tests
+        // had to sleep past it (and restarts could miss lockout state).
+        params.loginAttempts.flush(),
         params.persistence.eventLog.drain(),
         params.persistence.snapshotStore.drain(),
         params.persistence.timeseries.drain(),
@@ -4457,6 +4482,8 @@ async function startHqServerWithAuth(options, host, port, dataDir, firstRunAuth)
     onApplied: (live) => reassessExposureFloor(live)
   });
   const { mutableAuth } = authState;
+  const loginAttempts = new LoginAttemptStore(dataDir);
+  await loginAttempts.load();
   if (!mutableAuth.cookieSecret && mutableAuth.browserTokens.size > 0) {
     const secret = mintHqCookieSecret2();
     const next = await mutateHqAuthFile3(dataDir, (current) => ({
@@ -4505,8 +4532,6 @@ async function startHqServerWithAuth(options, host, port, dataDir, firstRunAuth)
       mutableAuth,
       sessions
     });
-    const loginAttempts = new LoginAttemptStore(dataDir);
-    void loginAttempts.load();
     const HQ_SESSION_MAX_AGE_MS2 = 7 * 24 * 60 * 60 * 1e3;
     const HQ_SESSION_IDLE_TIMEOUT_MS2 = 30 * 6e4;
     const SESSION_CLEANUP_INTERVAL_MS = 6e4;
@@ -4891,4 +4916,4 @@ export {
   startHqServer,
   HqInsecureExposureError2 as HqInsecureExposureError
 };
-//# sourceMappingURL=chunk-CB35UVXO.js.map
+//# sourceMappingURL=chunk-KQNYSZG2.js.map

package/dist/{chunk-XSG33WHN.js → chunk-QAC263FZ.js}

@@ -7,8 +7,10 @@ import {
 import * as os from "node:os";
 import { color } from "@wrongstack/core/utils";
 var versionCmd = async (_args, deps) => {
+  const bunVersion = globalThis.Bun?.version;
+  const runtime = bunVersion ? `bun v${bunVersion}` : `node ${process.version}`;
   deps.renderer.write(
-    `WrongStack ${CLI_VERSION} (apiVersion ${API_VERSION}, node ${process.version}, ${os.platform()})
+    `WrongStack ${CLI_VERSION} (apiVersion ${API_VERSION}, ${runtime}, ${os.platform()})
 `
   );
   return 0;
@@ -92,4 +94,4 @@ export {
   versionCmd,
   helpCmd
 };
-//# sourceMappingURL=chunk-XSG33WHN.js.map
+//# sourceMappingURL=chunk-QAC263FZ.js.map

package/dist/{chunk-XQ6FI2K6.js → chunk-QYIIOMLE.js}

@@ -3,7 +3,7 @@ import {
   normalizeKeys,
   nowIso,
   writeKeysBack
-} from "./chunk-SZ42FYPT.js";
+} from "./chunk-BXFYBQKR.js";
 
 // src/auth-menu/openai-codex-oauth.ts
 import { color } from "@wrongstack/core/utils";
@@ -259,4 +259,4 @@ export {
   filterCurrentCodexModelIds,
   isCodexCatalogModel
 };
-//# sourceMappingURL=chunk-XQ6FI2K6.js.map
+//# sourceMappingURL=chunk-QYIIOMLE.js.map

package/dist/{chunk-ZRZ54GVL.js → chunk-USYOJIV2.js}

@@ -6,7 +6,7 @@ import {
   openBrowser,
   runCodexOAuthLogin,
   startLoopbackServer
-} from "./chunk-XQ6FI2K6.js";
+} from "./chunk-QYIIOMLE.js";
 import {
   activeLabel,
   loadConfigProviders,
@@ -15,7 +15,7 @@ import {
   normalizeKeys,
   nowIso,
   writeKeysBack
-} from "./chunk-SZ42FYPT.js";
+} from "./chunk-BXFYBQKR.js";
 
 // src/auth-menu/local.ts
 import { DefaultSecretScrubber as DefaultSecretScrubber2 } from "@wrongstack/core/security";
@@ -1374,4 +1374,4 @@ export {
   addCustomProvider,
   addKeyForProvider
 };
-//# sourceMappingURL=chunk-ZRZ54GVL.js.map
+//# sourceMappingURL=chunk-USYOJIV2.js.map

package/dist/{chunk-T6YAVFXA.js → chunk-X3N5TS2S.js}

@@ -246,6 +246,7 @@ async function persistTelegramConfig(deps, mutator) {
   decrypted.extensions = extensions;
   const encrypted = encryptConfigSecrets(decrypted, deps.vault);
   await atomicWrite(targetPath, JSON.stringify(encrypted, null, 2), { mode: 384 });
+  await deps.vault.flushHardening?.();
   deps.configStore.update({
     extensions
   });
@@ -345,4 +346,4 @@ export {
   normalizeTuiThinkingWord,
   runGit
 };
-//# sourceMappingURL=chunk-T6YAVFXA.js.map
+//# sourceMappingURL=chunk-X3N5TS2S.js.map