@wrongstack/cli 0.309.1 → 0.310.1

package/dist/{hq-PA6RH2UW.js → hq-3BEUEXJQ.js}

@@ -51,7 +51,7 @@ var hqCmd = async (args, deps) => {
   return 1;
 };
 async function startServer(deps) {
-  const { startHqServer } = await import("./hq-server-PBRU275L.js");
+  const { startHqServer } = await import("./hq-server-4MIW3S4J.js");
   const dataDir = resolveDataDir(deps);
   const flags = deps.flags ?? {};
   const host = typeof flags["host"] === "string" ? flags["host"] : HQ_CLI_DEFAULT_HOST;
@@ -632,16 +632,22 @@ function printTokenHelp(deps) {
     `  wstack hq token create --client [label] [--ttl <dur>] Mint a client token (/ws/client).
 `
   );
-  deps.renderer.write(`  wstack hq token list                                 List issued browser tokens (alias: ls).
-`);
-  deps.renderer.write(`  wstack hq token list --client                         List issued client tokens.
-`);
+  deps.renderer.write(
+    `  wstack hq token list                                 List issued browser tokens (alias: ls).
+`
+  );
+  deps.renderer.write(
+    `  wstack hq token list --client                         List issued client tokens.
+`
+  );
   deps.renderer.write(
     `  wstack hq token revoke <id>                           Revoke a browser token (id prefix match).
 `
   );
-  deps.renderer.write(`  wstack hq token revoke --client <id>                  Revoke a client token.
-`);
+  deps.renderer.write(
+    `  wstack hq token revoke --client <id>                  Revoke a client token.
+`
+  );
   deps.renderer.write("\n");
   deps.renderer.write(`The token secret is printed once at create time and cannot be recovered
 `);
@@ -656,8 +662,10 @@ function printTokenHelp(deps) {
     `  --data-dir <path>   Override HQ data directory (default ~/.wrongstack/hq).
 `
   );
-  deps.renderer.write(`  --client, -c        Operate on client tokens instead of browser tokens.
-`);
+  deps.renderer.write(
+    `  --client, -c        Operate on client tokens instead of browser tokens.
+`
+  );
   deps.renderer.write(
     `  --capabilities <csv>  Comma-separated capability grants (browser: control.enqueue; client: telemetry.publish,control.execute).
 `
@@ -701,4 +709,4 @@ export {
   hqCmd,
   resolveAuditActor
 };
-//# sourceMappingURL=hq-PA6RH2UW.js.map
+//# sourceMappingURL=hq-3BEUEXJQ.js.map

package/dist/hq-server/handle-types.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Type-only leaf for the public HQ server handle.
+ *
+ * Lives separately from `hq-server.ts` so callers (notably
+ * `subcommands/handlers/hq.ts`) can depend on the public types without
+ * pulling in the HQ server implementation. Breaks a long-standing type-only
+ * import edge `handlers/hq.ts → hq-server.ts` that participated in the
+ * 33-member CLI SCC (see docs/reports/modularity-assessment-2026-08-22.md).
+ *
+ * This module MUST contain no runtime imports.
+ */
+export interface HqStartupConnectionInfo {
+    dataDir: string;
+    browserUrl: string;
+    clientUrl: string;
+    clientEnv: {
+        WRONGSTACK_HQ_URL: string;
+        WRONGSTACK_HQ_TOKEN?: string;
+    };
+    createdAuth: boolean;
+    browserTokenMode: boolean;
+    passwordMode: boolean;
+}
+export type HqFirstRunSetup = HqStartupConnectionInfo;
+export interface HqServerHandle {
+    host: string;
+    port: number;
+    firstRunSetup?: HqFirstRunSetup;
+    trustPublicOrigin(origin: string): void;
+    close(): Promise<void>;
+}
+//# sourceMappingURL=handle-types.d.ts.map

package/dist/hq-server/login-attempt-store.d.ts

@@ -32,6 +32,11 @@ export declare class LoginAttemptStore {
     /**
      * Load persisted state from disk and prune stale entries.
      * Safe to call once at startup; subsequent calls reload from disk.
+     *
+     * SEC-001: legacy `cred:` entries (per-password hashes persisted by the
+     * pre-fix version) are skipped here, not just on write — re-seeding them
+     * would keep the hashes in memory and on disk. When any are found, a
+     * debounced rewrite scrubs them from the file.
      */
     load(): Promise<void>;
     get(key: string): LoginAttemptEntry | undefined;

package/dist/{hq-server-PBRU275L.js → hq-server-4MIW3S4J.js}

@@ -15,7 +15,7 @@ import {
   readLocalSubagentTranscript,
   sanitizeApiError,
   startHqServer
-} from "./chunk-CB35UVXO.js";
+} from "./chunk-J3XBHGEO.js";
 import "./chunk-KE7E7DPX.js";
 import "./chunk-Q5GTM25S.js";
 import "./chunk-7OCVIDC7.js";
@@ -37,4 +37,4 @@ export {
   sanitizeApiError,
   startHqServer
 };
-//# sourceMappingURL=hq-server-PBRU275L.js.map
+//# sourceMappingURL=hq-server-4MIW3S4J.js.map

package/dist/hq-server.d.ts

@@ -42,25 +42,7 @@ export interface HqServerOptions {
     tokenTtlMs?: number;
     trustedProxyHops?: number;
 }
-export interface HqStartupConnectionInfo {
-    dataDir: string;
-    browserUrl: string;
-    clientUrl: string;
-    clientEnv: {
-        WRONGSTACK_HQ_URL: string;
-        WRONGSTACK_HQ_TOKEN?: string;
-    };
-    createdAuth: boolean;
-    browserTokenMode: boolean;
-    passwordMode: boolean;
-}
-export type HqFirstRunSetup = HqStartupConnectionInfo;
-export interface HqServerHandle {
-    host: string;
-    port: number;
-    firstRunSetup?: HqFirstRunSetup;
-    trustPublicOrigin(origin: string): void;
-    close(): Promise<void>;
-}
+import type { HqServerHandle } from './hq-server/handle-types.js';
+export type { HqFirstRunSetup, HqServerHandle, HqStartupConnectionInfo, } from './hq-server/handle-types.js';
 export declare function startHqServer(options?: HqServerOptions): Promise<HqServerHandle>;
 //# sourceMappingURL=hq-server.d.ts.map

package/dist/index.js

@@ -23,18 +23,18 @@ import {
 } from "./chunk-52C7PD2H.js";
 import {
   runUpdateCommand
-} from "./chunk-53STH6CX.js";
+} from "./chunk-4S52MIIM.js";
 import "./chunk-U3SS4NRH.js";
 import "./chunk-NUIHRGPY.js";
 import {
   DEFAULT_PORT
-} from "./chunk-CB35UVXO.js";
+} from "./chunk-J3XBHGEO.js";
 import "./chunk-KE7E7DPX.js";
 import "./chunk-Q5GTM25S.js";
 import {
   helpCmd,
   versionCmd
-} from "./chunk-XSG33WHN.js";
+} from "./chunk-QAC263FZ.js";
 import {
   CLI_VERSION
 } from "./chunk-XJXDOF63.js";
@@ -59,7 +59,7 @@ import {
   normalizeKeys,
   resolveActiveApiKey,
   writeKeysBack
-} from "./chunk-SZ42FYPT.js";
+} from "./chunk-BXFYBQKR.js";
 import "./chunk-7OCVIDC7.js";
 
 // src/cli-context.ts
@@ -386,7 +386,7 @@ async function promptModeArrow(deps) {
   const { renderer } = deps;
   const stdin = process.stdin;
   const out = (s) => renderer.write(s);
-  return await new Promise((resolve2) => {
+  return await new Promise((resolve3) => {
     let index = 0;
     let drawn = 0;
     let remaining = Math.round(MENU_TIMEOUT_MS / 1e3);
@@ -441,7 +441,7 @@ async function promptModeArrow(deps) {
       out("\x1B[0J");
       out(finalLine);
       out("\x1B[?25h");
-      resolve2(result);
+      resolve3(result);
     };
     const pick = () => {
       const opt = MODE_OPTIONS[index];
@@ -500,7 +500,7 @@ async function promptModeArrow(deps) {
       setRawMode(stdin, true);
       stdin.resume();
     } catch {
-      resolve2(null);
+      resolve3(null);
       return;
     }
     out("\x1B[?25l");
@@ -712,7 +712,7 @@ async function launchDesktop(args) {
     );
     return 1;
   }
-  return await new Promise((resolve2) => {
+  return await new Promise((resolve3) => {
     const child = spawn(process.execPath, [launcherPath, ...args], {
       stdio: "inherit",
       env: process.env,
@@ -723,11 +723,11 @@ async function launchDesktop(args) {
         `${color2.red("\u2717 Failed to start WrongStack Desktop:")} ${err.message}
 `
       );
-      resolve2(1);
+      resolve3(1);
     });
     child.once("exit", (code, signal) => {
-      if (typeof code === "number") resolve2(code);
-      else resolve2(signal ? 1 : 0);
+      if (typeof code === "number") resolve3(code);
+      else resolve3(signal ? 1 : 0);
     });
   });
 }
@@ -1645,8 +1645,8 @@ var helpTable = {
   update: {
     name: "update",
     title: "wstack update \u2014 self-update the CLI",
-    description: "Check the latest npm version and update the globally-installed `wrongstack` package. Use `--check-only` to just print the current/latest without installing. The update is global; run from any project root.",
-    usage: "wstack update [--check-only]",
+    description: "Check the latest npm version and update the globally-installed `wrongstack` package. Use `--check-only` to just print the current/latest without installing. Pass `--pm <manager>` (or its shorthand `--npm`, `--pnpm`, `--yarn`, `--bun`) to force a specific package manager; pass `--allow-scripts` (alias `--lifecycle-scripts`) to opt into package lifecycle scripts during the update (off by default). The update is global; run from any project root.",
+    usage: "wstack update [--check-only] [--pm <manager>] [--allow-scripts (alias: --lifecycle-scripts)]",
     seeAlso: "wstack version (read-only version info)"
   },
   // -- ACP (Agent Client Protocol) --------------------------------------
@@ -1660,7 +1660,10 @@ var helpTable = {
       { name: "list", description: "List available ACP agents from the cache." },
       { name: "sync", description: "Sync the official ACP agent registry into local cache." },
       { name: "spawn <id> <task>", description: "Spawn an ACP agent and wait for results." },
-      { name: "parallel <csv> <task>", description: "Fan a task out to multiple ACP agents in parallel." },
+      {
+        name: "parallel <csv> <task>",
+        description: "Fan a task out to multiple ACP agents in parallel."
+      },
       { name: "probe [csv]", description: "Handshake-test installed ACP agents." },
       { name: "bench [csv] [--fs]", description: "End-to-end benchmark and grade ACP agents." }
     ],
@@ -1732,7 +1735,10 @@ var helpTable = {
     usage: "wstack hq [serve] [--port <n>] [--password <secret>] [--tunnel] [--open] | wstack hq token [create|list|revoke]",
     subcommands: [
       { name: "serve", description: "Start the HQ dashboard server (default)." },
-      { name: "token create [label]", description: "Mint a browser or client authentication token." },
+      {
+        name: "token create [label]",
+        description: "Mint a browser or client authentication token."
+      },
       { name: "token list", description: "List active HQ authentication tokens." },
       { name: "token revoke <id>", description: "Revoke an issued HQ authentication token." }
     ],
@@ -1792,8 +1798,14 @@ var helpTable = {
       { name: "query [field=value ...]", description: "Query recorded provenance events." },
       { name: "status", description: "Check the Chronicle daemon and pipeline status." },
       { name: "facet <field>", description: "Group and count events across a facet." },
-      { name: "metrics [providers|tasks|files|summary]", description: "Query aggregated metrics from metrics.db." },
-      { name: "prune [--days N] [--dry-run]", description: "Purge journal entries older than N days." },
+      {
+        name: "metrics [providers|tasks|files|summary]",
+        description: "Query aggregated metrics from metrics.db."
+      },
+      {
+        name: "prune [--days N] [--dry-run]",
+        description: "Purge journal entries older than N days."
+      },
       { name: "compact", description: "Defragment and compact SQLite ledger." }
     ],
     seeAlso: "wstack audit (per-session audit log); wstack usage (cost summary)"
@@ -1849,44 +1861,47 @@ var subcommandsWithFocusedHelp = Object.keys(helpTable);
 
 // src/subcommands/index.ts
 var loaders = {
-  acp: async () => (await import("./acp-7NWCC2GO.js")).acpCmd,
-  init: async () => (await import("./init-E2NDDOHI.js")).initCmd,
-  auth: async () => (await import("./auth-GZ2FK5KR.js")).authCmd,
-  update: async () => (await import("./update-VZSOZGYC.js")).updateCmd,
-  sessions: async () => (await import("./sessions-config-YX2ZPAFM.js")).sessionsCmd,
-  config: async () => (await import("./sessions-config-YX2ZPAFM.js")).configCmd,
-  rewind: async () => (await import("./rewind-7RE6ONIC.js")).rewindCmd,
-  replay: async () => (await import("./replay-WBRMEWQ5.js")).replayCmd,
-  audit: async () => (await import("./audit-BBR22QH3.js")).auditCmd,
-  tools: async () => (await import("./tools-skills-UNKLOB7M.js")).toolsCmd,
-  skills: async () => (await import("./tools-skills-UNKLOB7M.js")).skillsCmd,
-  providers: async () => (await import("./providers-models-D23WUD74.js")).providersCmd,
-  models: async () => (await import("./providers-models-D23WUD74.js")).modelsCmd,
-  mcp: async () => (await import("./mcp-CMLFHRG2.js")).mcpCmd,
-  plugin: async () => (await import("./plugin-usage-26LIIW3P.js")).pluginCmd,
-  plugins: async () => (await import("./plugin-usage-26LIIW3P.js")).pluginCmd,
-  diag: async () => (await import("./diag-doctor-WTBHPOMB.js")).diagCmd,
-  doctor: async () => (await import("./diag-doctor-WTBHPOMB.js")).doctorCmd,
-  export: async () => (await import("./export-CCUXRJOU.js")).exportCmd,
-  usage: async () => (await import("./plugin-usage-26LIIW3P.js")).usageCmd,
-  version: async () => (await import("./version-help-TFD6VPF3.js")).versionCmd,
-  help: async () => (await import("./version-help-TFD6VPF3.js")).helpCmd,
-  projects: async () => (await import("./projects-XE76NFNZ.js")).projectsCmd,
-  modeldiag: async () => (await import("./modeldiag-ICMPHT5L.js")).modeldiagCmd,
-  quick: async () => (await import("./quick-VIO2BEHS.js")).quickCmd,
-  bench: async () => (await import("./bench-XNDUJOSZ.js")).benchCmd,
-  chronicle: async () => (await import("./chronicle-63MFCZN6.js")).chronicleCmd,
-  hq: async () => (await import("./hq-PA6RH2UW.js")).hqCmd,
-  mailbox: async () => (await import("./mailbox-serve-V3QIJBDH.js")).mailboxServeCmd,
+  acp: async () => (await import("./acp-GZIASCLH.js")).acpCmd,
+  init: async () => (await import("./init-4JQSG66Q.js")).initCmd,
+  auth: async () => (await import("./auth-VQMSZGKE.js")).authCmd,
+  update: async () => (await import("./update-ZXNC6I6G.js")).updateCmd,
+  sessions: async () => (await import("./sessions-config-7Q7QJBKJ.js")).sessionsCmd,
+  config: async () => (await import("./sessions-config-7Q7QJBKJ.js")).configCmd,
+  rewind: async () => (await import("./rewind-2FFNOOKS.js")).rewindCmd,
+  replay: async () => (await import("./replay-RZXZKP2U.js")).replayCmd,
+  audit: async () => (await import("./audit-ZPCLCC3C.js")).auditCmd,
+  tools: async () => (await import("./tools-skills-Q4P27URS.js")).toolsCmd,
+  skills: async () => (await import("./tools-skills-Q4P27URS.js")).skillsCmd,
+  providers: async () => (await import("./providers-models-663NDPRQ.js")).providersCmd,
+  models: async () => (await import("./providers-models-663NDPRQ.js")).modelsCmd,
+  mcp: async () => (await import("./mcp-RRPKNRSN.js")).mcpCmd,
+  plugin: async () => (await import("./plugin-usage-GCTYOZPH.js")).pluginCmd,
+  plugins: async () => (await import("./plugin-usage-GCTYOZPH.js")).pluginCmd,
+  diag: async () => (await import("./diag-doctor-Z6JDXBVX.js")).diagCmd,
+  doctor: async () => (await import("./diag-doctor-Z6JDXBVX.js")).doctorCmd,
+  "proxy-status": async () => (await import("./diag-doctor-Z6JDXBVX.js")).proxyCmd,
+  export: async () => (await import("./export-ROG3DKTZ.js")).exportCmd,
+  usage: async () => (await import("./plugin-usage-GCTYOZPH.js")).usageCmd,
+  version: async () => (await import("./version-help-WMPSEL4U.js")).versionCmd,
+  help: async () => (await import("./version-help-WMPSEL4U.js")).helpCmd,
+  projects: async () => (await import("./projects-5J727S4L.js")).projectsCmd,
+  modeldiag: async () => (await import("./modeldiag-H6DKWJ2N.js")).modeldiagCmd,
+  quick: async () => (await import("./quick-XLYLZX4B.js")).quickCmd,
+  bench: async () => (await import("./bench-XYG56AMO.js")).benchCmd,
+  chronicle: async () => (await import("./chronicle-6EPPMUC5.js")).chronicleCmd,
+  hq: async () => (await import("./hq-3BEUEXJQ.js")).hqCmd,
+  mailbox: async () => (await import("./mailbox-serve-5S3PHG5D.js")).mailboxServeCmd,
   permissions: async () => (await import("./permissions-2PWBL4YU.js")).permissionsCmd,
   project: async () => (await import("./project-BLQ3ALVL.js")).projectCmd,
   governance: async () => (await import("./governance-V2Z42RBE.js")).governanceCmd
 };
 var subcommands = Object.fromEntries(
-  Object.entries(loaders).map(([name, load]) => [
-    name,
-    async (args, deps) => (await load())(args, deps)
-  ])
+  Object.entries(loaders).map(
+    ([name, load]) => [
+      name,
+      async (args, deps) => (await load())(args, deps)
+    ]
+  )
 );
 var subcommandNames = Object.keys(loaders);
 
@@ -1936,24 +1951,24 @@ async function isHqAlreadyRunning(dataDir) {
   return null;
 }
 async function isPortInUse(host, port) {
-  return new Promise((resolve2) => {
+  return new Promise((resolve3) => {
     const server = net.createServer();
     server.once("error", (err) => {
       if (err.code === "EADDRINUSE") {
-        resolve2(true);
+        resolve3(true);
       } else {
-        resolve2(false);
+        resolve3(false);
       }
     });
     server.once("listening", () => {
-      server.close(() => resolve2(false));
+      server.close(() => resolve3(false));
     });
     server.listen(port, host);
   });
 }
 async function handleHqShortCircuit(flags) {
   if (flags["hq"] !== true) return null;
-  const { startHqServer } = await import("./hq-server-PBRU275L.js");
+  const { startHqServer } = await import("./hq-server-4MIW3S4J.js");
   const tunnelRequested = flags["tunnel"] === true;
   const host = typeof flags["host"] === "string" ? flags["host"] : tunnelRequested ? "127.0.0.1" : HQ_CLI_DEFAULT_HOST2;
   if (tunnelRequested && !isLoopbackHost(host)) {
@@ -2084,7 +2099,7 @@ ${color6.green("Cloudflare Quick Tunnel ready:")} ${browserUrl}
     } catch {
     }
   }
-  await new Promise((resolve2) => {
+  await new Promise((resolve3) => {
     const shutdown = async () => {
       const results = await Promise.allSettled([
         ...tunnel ? [tunnel.close()] : [],
@@ -2103,7 +2118,7 @@ ${color6.green("Cloudflare Quick Tunnel ready:")} ${browserUrl}
           })
         );
       }
-      resolve2();
+      resolve3();
     };
     process.on("SIGINT", shutdown);
     process.on("SIGTERM", shutdown);
@@ -2491,7 +2506,7 @@ async function runProjectCheck(opts) {
     if (answer2 === "y" || answer2 === "yes") {
       try {
         const { spawn: spawn2 } = await import("node:child_process");
-        await new Promise((resolve2, reject) => {
+        await new Promise((resolve3, reject) => {
           const child = spawn2("git", ["init"], {
             cwd,
             signal: AbortSignal.timeout(1e4),
@@ -2500,7 +2515,7 @@ async function runProjectCheck(opts) {
           child.on("error", reject);
           child.on(
             "close",
-            (code) => code === 0 ? resolve2() : reject(new Error(`git init failed with ${code}`))
+            (code) => code === 0 ? resolve3() : reject(new Error(`git init failed with ${code}`))
           );
         });
         renderer.write(`  ${color9.green("\u2713")} Git repository initialized
@@ -2744,25 +2759,25 @@ var ReadlineInputReader = class {
   async readLine(prompt, timeoutOpts) {
     if (this.history.length === 0) await this.loadHistory();
     while (this.pending) {
-      await new Promise((resolve2) => setTimeout(resolve2, 50));
+      await new Promise((resolve3) => setTimeout(resolve3, 50));
     }
     this.pending = true;
     try {
       if (this.rl) {
         const old = this.rl;
         this.rl = void 0;
-        await new Promise((resolve2) => {
+        await new Promise((resolve3) => {
           if (old.closed) {
-            resolve2();
+            resolve3();
           } else {
-            old.once("close", resolve2);
+            old.once("close", resolve3);
             old.close();
           }
         });
       }
       const fresh = this.ensure();
       this.installPromptGuard(fresh);
-      const line = await new Promise((resolve2) => {
+      const line = await new Promise((resolve3) => {
         let settled = false;
         let timeoutHandle;
         const settle = (line2) => {
@@ -2770,7 +2785,7 @@ var ReadlineInputReader = class {
           settled = true;
           if (timeoutHandle) clearTimeout(timeoutHandle);
           setOutputLineGuard(null);
-          resolve2(line2);
+          resolve3(line2);
         };
         if (timeoutOpts) {
           timeoutHandle = setTimeout(() => {
@@ -2835,7 +2850,7 @@ var ReadlineInputReader = class {
   async readKey(prompt, options) {
     setOutputLineGuard(null);
     writeOut(prompt);
-    return new Promise((resolve2) => {
+    return new Promise((resolve3) => {
       const stdin = process.stdin;
       const wasRaw = stdin.isRaw;
       const wasPaused = stdin.isPaused();
@@ -2846,7 +2861,7 @@ var ReadlineInputReader = class {
         if (key === "") {
           cleanup();
           writeOut("\n");
-          resolve2("");
+          resolve3("");
           return;
         }
         const opt = options.find(
@@ -2856,12 +2871,12 @@ var ReadlineInputReader = class {
           cleanup();
           writeOut(`${opt.key}
 `);
-          resolve2(opt.value);
+          resolve3(opt.value);
         }
       };
       const onClose = () => {
         cleanup();
-        resolve2("");
+        resolve3("");
       };
       const cleanup = () => {
         stdin.off("data", onData);
@@ -2893,7 +2908,7 @@ var ReadlineInputReader = class {
     this.rl?.close();
     this.rl = void 0;
     writeOut(prompt);
-    return new Promise((resolve2) => {
+    return new Promise((resolve3) => {
       let buf = "";
       const wasRaw = stdin.isRaw;
       const cleanup = () => {
@@ -2922,13 +2937,13 @@ var ReadlineInputReader = class {
             cleanup();
             writeOut(`  ${dim(`[${buf.length} chars]`)}
 `);
-            resolve2(buf);
+            resolve3(buf);
             return;
           }
           if (ch === "") {
             cleanup();
             writeOut("\n");
-            resolve2("");
+            resolve3("");
             return;
           }
           if (ch === "") {
@@ -4197,7 +4212,7 @@ async function checkGitInCwd(opts) {
     if (answer === "y" || answer === "yes") {
       try {
         const { spawn: spawn2 } = await import("node:child_process");
-        await new Promise((resolve2, reject) => {
+        await new Promise((resolve3, reject) => {
           const child = spawn2("git", ["init"], {
             cwd,
             signal: AbortSignal.timeout(1e4),
@@ -4206,7 +4221,7 @@ async function checkGitInCwd(opts) {
           child.on("error", reject);
           child.on(
             "close",
-            (code) => code === 0 ? resolve2() : reject(new Error(`git init failed with ${code}`))
+            (code) => code === 0 ? resolve3() : reject(new Error(`git init failed with ${code}`))
           );
         });
         renderer.write(`  ${color13.green("\u2713")} Git repository initialized
@@ -4466,12 +4481,14 @@ async function initializeCli(argv) {
 async function main(argv) {
   const cliCtx = await initializeCli(argv);
   if (typeof cliCtx === "number") return cliCtx;
-  const { runInteractive } = await import("./cli-main-XGDOIPN5.js");
+  const { runInteractive } = await import("./cli-main-UDWMWX55.js");
   return runInteractive(cliCtx);
 }
 
 // src/cli-entry-point.ts
-import { installCrashShield, writeErr as writeErr4 } from "@wrongstack/core/utils";
+import { resolve as resolve2 } from "node:path";
+import { pathToFileURL } from "node:url";
+import { installCrashShield, runFatalSalvageSync, writeErr as writeErr4 } from "@wrongstack/core/utils";
 var SQLITE_WARNING_RE = /sqlite is an experimental feature/i;
 function installSqliteWarningFilter() {
   const originalEmit = process.emitWarning.bind(process);
@@ -4485,7 +4502,15 @@ function installSqliteWarningFilter() {
   });
 }
 installSqliteWarningFilter();
-var isMain = import.meta.url === `file://${process.argv[1]?.replace(/\\/g, "/")}` || process.argv[1]?.endsWith("/cli/dist/index.js") || process.argv[1]?.endsWith("\\cli\\dist\\index.js");
+function isCliMain(moduleUrl, argvEntry = process.argv[1]) {
+  if (!argvEntry) return false;
+  try {
+    if (moduleUrl === pathToFileURL(resolve2(argvEntry)).href) return true;
+  } catch {
+  }
+  return argvEntry.endsWith("/cli/dist/index.js") || argvEntry.endsWith("\\cli\\dist\\index.js");
+}
+var isMain = isCliMain(import.meta.url);
 function isBrokenOutputConsumer(error) {
   if (typeof error !== "object" || error === null || !("code" in error)) return false;
   return error.code === "EPIPE" || error.code === "ECONNRESET" || error.code === "ECONNABORTED";
@@ -4498,6 +4523,7 @@ function installBrokenPipeHandlers(options = {}) {
     if (!isBrokenOutputConsumer(error)) throw error;
     if (handled) return;
     handled = true;
+    runFatalSalvageSync();
     exit(0);
   };
   for (const stream of streams) stream.on("error", onError);
@@ -4509,12 +4535,16 @@ function runAsMain(mainFn) {
   if (!isMain) return;
   installBrokenPipeHandlers();
   installCrashShield();
+  process.on("exit", () => {
+    runFatalSalvageSync();
+  });
   mainFn(process.argv.slice(2)).then(
     (c) => {
       process.exitCode = c;
       setTimeout(() => process.exit(c), 500).unref();
     },
     (err) => {
+      runFatalSalvageSync();
       writeErr4((err instanceof Error ? err.stack : String(err)) + "\n");
       process.exitCode = 1;
       setTimeout(() => process.exit(1), 500).unref();

package/dist/{init-E2NDDOHI.js → init-4JQSG66Q.js}

@@ -24,4 +24,4 @@ var initCmd = async (_args, deps) => {
 export {
   initCmd
 };
-//# sourceMappingURL=init-E2NDDOHI.js.map
+//# sourceMappingURL=init-4JQSG66Q.js.map

package/dist/live-settings-input.d.ts

@@ -88,5 +88,19 @@ export interface LiveSettingsInput {
     nextStepsTool?: boolean | undefined;
     /** Minimum relation strength for SAGE memory injection. Default: 0.85. */
     sageMemoryInjectThreshold?: number | undefined;
+    /**
+     * WrongProxy / WrongTrace: master switch. When true AND the daemon at
+     * `wrongProxyUrl` is reachable, every provider's base URL is rewritten
+     * through `${wrongProxyUrl}/proxy/<host><path>`. openai-codex is
+     * excluded by spec. Persisted to `tools.wrongProxy.enabled` (read at
+     * boot, applied mid-session by `applyLiveSettings`).
+     */
+    wrongProxyEnabled?: boolean | undefined;
+    /**
+     * WrongProxy / WrongTrace URL. Default `http://localhost:8000`. The
+     * CLI's periodic probe targets `<wrongProxyUrl>/api/health`; a 2xx
+     * response flips the runtime's `active` flag.
+     */
+    wrongProxyUrl?: string | undefined;
 }
 //# sourceMappingURL=live-settings-input.d.ts.map

package/dist/{mailbox-serve-V3QIJBDH.js → mailbox-serve-5S3PHG5D.js}

@@ -341,4 +341,4 @@ function printHelp(deps) {
 export {
   mailboxServeCmd
 };
-//# sourceMappingURL=mailbox-serve-V3QIJBDH.js.map
+//# sourceMappingURL=mailbox-serve-5S3PHG5D.js.map

package/dist/{mcp-CMLFHRG2.js → mcp-RRPKNRSN.js}

@@ -33,6 +33,7 @@ import {
   serveStdio
 } from "@wrongstack/mcp";
 import { registerBuiltinToolTier } from "@wrongstack/tools/tool-tier";
+import { wireKanbanPorts } from "@wrongstack/runtime";
 var AllowAllPermissionPolicy = class extends AutoApprovePermissionPolicy {
   async evaluate() {
     return { permission: "auto", source: "default" };
@@ -210,6 +211,7 @@ async function serveMcpStdio(deps, positional) {
     log(`wrongstack MCP server: ${err instanceof Error ? err.message : String(err)}`);
     return 1;
   }
+  wireKanbanPorts();
   let registry = deps.toolRegistry;
   if (!registry) {
     registry = new ToolRegistry();
@@ -439,4 +441,4 @@ function isRecord(value) {
 export {
   mcpCmd
 };
-//# sourceMappingURL=mcp-CMLFHRG2.js.map
+//# sourceMappingURL=mcp-RRPKNRSN.js.map

package/dist/mcp-serve.d.ts

@@ -2,7 +2,7 @@ import { Context } from '@wrongstack/core/agent';
 import { ToolRegistry } from '@wrongstack/core/registry';
 import type { PermissionPolicy, Tool } from '@wrongstack/core/types';
 import { type MCPServerPrompt, type MCPServerResource } from '@wrongstack/mcp';
-import type { SubcommandDeps } from './subcommands/index.js';
+import type { SubcommandDeps } from './subcommands/contracts.js';
 /**
  * Resolve the `--tools` whitelist for `mcp serve`.
  *