@wrongstack/cli 1.0.1 → 1.0.4

package/dist/hq-server/preflight.d.ts

@@ -4,6 +4,7 @@ interface HqPreflightOptions {
     port?: number;
     dataDir?: string;
     password?: string;
+    bootstrapPasswordOnly?: boolean;
     tokenTtlMs?: number;
     requireBrowserAuth?: boolean;
     allowInsecureOpen?: boolean;

package/dist/hq-server/routes/auth/password-routes.d.ts

@@ -3,7 +3,7 @@ import type { LoginAttemptStore } from '../../login-attempt-store.js';
 import type { HqRouterMutableAuth, HqSessionEntry } from '../../types.js';
 import { type ApplyHqAuthFile } from './common.js';
 export declare function handleApiAuthStatus(req: http.IncomingMessage, res: http.ServerResponse, url: URL, mutableAuth: HqRouterMutableAuth, sessions: Map<string, HqSessionEntry>, requireBrowserAuth: boolean | undefined, trustedPublicOrigins: Set<string>, secureCookies: boolean | undefined): Promise<void>;
-export declare function handleApiLogin(req: http.IncomingMessage, res: http.ServerResponse, mutableAuth: HqRouterMutableAuth, sessions: Map<string, HqSessionEntry>, loginAttempts: LoginAttemptStore, secureCookies: boolean | undefined, trustedProxyHops: number): Promise<void>;
+export declare function handleApiLogin(req: http.IncomingMessage, res: http.ServerResponse, mutableAuth: HqRouterMutableAuth, sessions: Map<string, HqSessionEntry>, loginAttempts: LoginAttemptStore, secureCookies: boolean | undefined, trustedProxyHops: number, sessionCapabilities?: string[]): Promise<void>;
 export declare function handleApiLogout(req: http.IncomingMessage, res: http.ServerResponse, mutableAuth: HqRouterMutableAuth, sessions: Map<string, HqSessionEntry>, secureCookies: boolean | undefined): Promise<void>;
 export declare function handleApiPassword(req: http.IncomingMessage, res: http.ServerResponse, mutableAuth: HqRouterMutableAuth, sessions: Map<string, HqSessionEntry>, dataDir: string, secureCookies: boolean | undefined, requireBrowserAuth: boolean | undefined, applyAuthFile: ApplyHqAuthFile): Promise<void>;
 //# sourceMappingURL=password-routes.d.ts.map

package/dist/hq-server/routes.d.ts

@@ -8,10 +8,8 @@
  * @module hq-server/routes
  */
 import type * as http from 'node:http';
-import type { createMailboxHttpRouter } from '@wrongstack/core/coordination';
-import type { Mailbox, MailboxHttpAccessDecision, MailboxHttpRateLimiter } from '@wrongstack/core/coordination';
-import type { HqAlertEngine, HqCommandAuditLog, HqEventEnvelope, HqSnapshot, HqTranscriptEntry } from '@wrongstack/core/hq';
-import type { createHqPersistence } from '@wrongstack/core/hq';
+import type { createMailboxHttpRouter, Mailbox, MailboxHttpAccessDecision, MailboxHttpRateLimiter } from '@wrongstack/core/coordination';
+import type { createHqPersistence, HqAlertEngine, HqCommandAuditLog, HqEventEnvelope, HqSnapshot, HqTranscriptEntry } from '@wrongstack/core/hq';
 import type { TrustBoundary } from '@wrongstack/core/security';
 import type { WebSocket } from 'ws';
 import * as HqServerAuth from './auth.js';
@@ -41,6 +39,7 @@ export declare const agentMessageToEntry: typeof HqServerUtils.agentMessageToEnt
 export declare const readLocalSubagentTranscript: typeof HqServerUtils.readLocalSubagentTranscript;
 export declare const lanIPv4Addresses: typeof HqServerUtils.lanIPv4Addresses;
 export declare const hqRuntimeMarkerPath: typeof HqServerUtils.hqRuntimeMarkerPath;
+import type { HqIpAllowlist } from './ip-allowlist.js';
 import type { LoginAttemptStore } from './login-attempt-store.js';
 import type { ConnectedClient, HqRouterMutableAuth, HqSessionEntry, HqSnapshotBroadcaster, ProjectDetail, TranscriptRing } from './types.js';
 export type { ConnectedClient, HqSnapshotBroadcaster, ProjectDetail, TranscriptRing };
@@ -99,6 +98,8 @@ export interface HqRouterDeps {
      * Defaults to 0, which ignores `X-Forwarded-For` entirely.
      */
     trustedProxyHops?: number | undefined;
+    /** TCP-peer allowlist shared by HTTP and WebSocket admission. */
+    ipAllowlist?: HqIpAllowlist | undefined;
 }
 /**
  * Create the HTTP request listener that handles all `/api/*` routes as well

package/dist/hq-server/secret-input.d.ts

@@ -0,0 +1,7 @@
+export interface ResolveHqPasswordOptions {
+    explicitPassword?: string | undefined;
+    environment?: NodeJS.ProcessEnv | undefined;
+}
+/** Resolve HQ password input without putting Docker/Kubernetes secrets in argv or env values. */
+export declare function resolveHqPasswordInput(options?: ResolveHqPasswordOptions): Promise<string | undefined>;
+//# sourceMappingURL=secret-input.d.ts.map

package/dist/hq-server/types.d.ts

@@ -107,7 +107,8 @@ export interface HqRouterMutableAuth {
 /**
  * Session record stored in the server-side `sessions` Map.
  *
- * - `kind: 'password'` — created by `/api/login`; full browser access.
+ * - `kind: 'password'` — created by `/api/login`; full browser access unless
+ *   the dedicated mobile endpoint stamped a least-privilege capability set.
  * - `kind: 'token'` — created by `/api/auth/bootstrap`; scoped to the
  *   originating browser token's ID and capabilities so revocation/expiry
  *   of that token invalidates the session too.
@@ -117,7 +118,7 @@ export interface HqSessionEntry {
     readonly kind: 'password' | 'token';
     /** For token sessions: the browser-token ID this session was minted from. */
     readonly tokenId?: string | undefined;
-    /** For token sessions: capabilities inherited from the source token. */
+    /** Token capabilities, or a server-stamped scope for a mobile password session. */
     readonly capabilities?: string[] | undefined;
     /**
      * Set when a password login passed but 2FA verification is still pending.

package/dist/hq-server/upgrade-handler.d.ts

@@ -8,6 +8,7 @@ import type { Duplex } from 'node:stream';
 import { type HqToken } from '@wrongstack/core/hq';
 import type { WebSocket, WebSocketServer } from 'ws';
 import type { HqAuthState } from './auth-state.js';
+import type { HqIpAllowlist } from './ip-allowlist.js';
 import type { ConnectedClient, HqSessionEntry, TranscriptRing } from './types.js';
 interface HqUpgradeHandlerDeps {
     host: string;
@@ -28,6 +29,7 @@ interface HqUpgradeHandlerDeps {
     auditLog: import('@wrongstack/core/hq').HqCommandAuditLog;
     snapshotBroadcaster: ReturnType<typeof import('./snapshot.js').createSnapshotBroadcaster>;
     wss: WebSocketServer;
+    ipAllowlist?: HqIpAllowlist | undefined;
 }
 export declare function handleHqUpgrade(req: IncomingMessage, socket: Duplex, head: Buffer, deps: HqUpgradeHandlerDeps): void;
 export declare function handleHqConnection(ws: WebSocket, req: IncomingMessage, pathname: string, deps: HqUpgradeHandlerDeps): void;

package/dist/hq-server/utils.d.ts

@@ -95,6 +95,12 @@ export declare function buildHttpUrl(host: string, port: number, token?: string)
  */
 export declare function buildBootstrapHttpUrl(host: string, port: number, bootstrapCode: string): string;
 export declare function buildClientWsUrl(host: string, port: number, token?: string): string;
+/**
+ * Validate and normalize a browser-facing HQ origin supplied for a persistent
+ * HTTPS reverse proxy. Paths, credentials, query strings and fragments are
+ * refused because the value becomes a Host/Origin trust-boundary entry.
+ */
+export declare function normalizeHqPublicOrigin(value: string): string;
 export declare function hqRuntimeMarkerPath(dataDir: string): string;
 /** Non-internal IPv4 addresses, so we can print URLs reachable from other machines. */
 export declare function lanIPv4Addresses(): string[];

package/dist/{hq-server-OILU3NPI.js → hq-server-CNUTBWTK.js}

@@ -10,9 +10,10 @@ import {
   readLocalSubagentTranscript,
   sanitizeApiError,
   startHqServer
-} from "./chunk-C2E24IXZ.js";
+} from "./chunk-3I5ZJXM5.js";
 import "./chunk-HXJYHAR4.js";
-import "./chunk-Q5GTM25S.js";
+import "./chunk-I7V2OYVH.js";
+import "./chunk-Q7E3BPDU.js";
 export {
   DEFAULT_HOST,
   DEFAULT_PORT,
@@ -26,4 +27,4 @@ export {
   sanitizeApiError,
   startHqServer
 };
-//# sourceMappingURL=hq-server-OILU3NPI.js.map
+//# sourceMappingURL=hq-server-CNUTBWTK.js.map

package/dist/hq-server.d.ts

@@ -30,12 +30,16 @@ interface HqServerOptions {
     clientCleanupIntervalMs?: number;
     sessionSnapshotTtlMs?: number;
     password?: string;
+    /** Keep an existing Settings-managed password instead of reapplying the startup secret. */
+    bootstrapPasswordOnly?: boolean;
     allowInsecureOpen?: boolean;
     secureCookies?: boolean;
     requireBrowserAuth?: boolean;
     allowFileOrigin?: boolean;
     tokenTtlMs?: number;
     trustedProxyHops?: number;
+    /** Optional exact-IP/CIDR admission list. Empty/absent means unrestricted. */
+    ipAllowlist?: readonly string[];
 }
 import type { HqServerHandle } from './hq-server/handle-types.js';
 export type { HqFirstRunSetup, HqServerHandle, HqStartupConnectionInfo, } from './hq-server/handle-types.js';

package/dist/hq-service-L5INQFM4.js

@@ -0,0 +1,507 @@
+import {
+  resolveHqPasswordInput
+} from "./chunk-AUQDGU5D.js";
+import {
+  detectUpdatePackageManager,
+  detectUpdatePackageName
+} from "./chunk-DE7BZDNK.js";
+import "./chunk-U3SS4NRH.js";
+import "./chunk-YLQEGYV4.js";
+
+// src/hq-service.ts
+import { spawn } from "node:child_process";
+import { constants as fsConstants } from "node:fs";
+import * as fs from "node:fs/promises";
+import * as path from "node:path";
+import { buildChildEnv } from "@wrongstack/core/utils";
+var SERVICE_NAME = "wrongstack-hq.service";
+var UPDATE_SERVICE_NAME = "wrongstack-hq-update.service";
+var UPDATE_TIMER_NAME = "wrongstack-hq-update.timer";
+var SYSTEMD_DIR = "/etc/systemd/system";
+var ENV_DIR = "/etc/wrongstack";
+var ENV_FILE = `${ENV_DIR}/hq.env`;
+var UPDATE_SCRIPT = "/usr/local/libexec/wrongstack-hq-update";
+var MANAGED_MARKER = "Managed by WrongStack HQ service installer";
+function unitQuote(value) {
+  if (/[\r\n\0]/.test(value)) throw new Error("systemd values cannot contain line breaks or NUL");
+  return `"${value.replaceAll("%", "%%").replaceAll("\\", "\\\\").replaceAll('"', '\\"')}"`;
+}
+function envQuote(value) {
+  if (/[\r\n\0]/.test(value))
+    throw new Error("HQ service secrets cannot contain line breaks or NUL");
+  return `"${value.replaceAll("\\", "\\\\").replaceAll('"', '\\"')}"`;
+}
+function shellQuote(value) {
+  if (/\0/.test(value)) throw new Error("shell values cannot contain NUL");
+  return `'${value.replaceAll("'", `'"'"'`)}'`;
+}
+function renderHqServiceAssets(options) {
+  const bindHost = options.publicOrigin ? "127.0.0.1" : "0.0.0.0";
+  const execStart = [
+    unitQuote(options.wstackBin),
+    "hq",
+    "serve",
+    "--host",
+    bindHost,
+    "--port",
+    String(options.port),
+    "--strict-port"
+  ].join(" ");
+  const service = `# ${MANAGED_MARKER}
+[Unit]
+Description=WrongStack HQ command center
+Documentation=https://github.com/WrongStack/WrongStack
+Wants=network-online.target
+After=network-online.target
+StartLimitIntervalSec=0
+
+[Service]
+Type=simple
+DynamicUser=yes
+StateDirectory=wrongstack-hq
+StateDirectoryMode=0700
+WorkingDirectory=/var/lib/wrongstack-hq
+Environment=NODE_ENV=production
+Environment=HOME=/var/lib/wrongstack-hq
+Environment=WRONGSTACK_HOME=/var/lib/wrongstack-hq
+Environment=WRONGSTACK_HQ_DATA_DIR=/var/lib/wrongstack-hq/hq
+Environment=WRONGSTACK_HQ_SUPPRESS_STARTUP_SECRETS=1
+EnvironmentFile=${ENV_FILE}
+ExecStartPre=/usr/bin/test -x ${unitQuote(options.wstackBin)}
+ExecStart=${execStart}
+Restart=always
+RestartSec=5s
+TimeoutStopSec=30s
+KillSignal=SIGTERM
+StandardOutput=journal
+StandardError=journal
+SyslogIdentifier=wrongstack-hq
+UMask=0077
+NoNewPrivileges=yes
+PrivateTmp=yes
+PrivateDevices=yes
+ProtectSystem=strict
+ProtectHome=yes
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectControlGroups=yes
+RestrictSUIDSGID=yes
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+
+[Install]
+WantedBy=multi-user.target
+`;
+  const updateService = `# ${MANAGED_MARKER}
+[Unit]
+Description=Safely update WrongStack HQ
+Documentation=https://github.com/WrongStack/WrongStack
+Wants=network-online.target
+After=network-online.target
+
+[Service]
+Type=oneshot
+User=root
+CacheDirectory=wrongstack-hq-update
+Environment=HOME=/var/cache/wrongstack-hq-update
+ExecStart=${UPDATE_SCRIPT}
+Nice=10
+IOSchedulingClass=best-effort
+IOSchedulingPriority=7
+NoNewPrivileges=yes
+PrivateTmp=yes
+PrivateDevices=yes
+ProtectHome=yes
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectControlGroups=yes
+RestrictSUIDSGID=yes
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+`;
+  const updateTimer = `# ${MANAGED_MARKER}
+[Unit]
+Description=Daily WrongStack HQ self-update check
+
+[Timer]
+OnBootSec=15min
+OnCalendar=*-*-* 04:17:00
+RandomizedDelaySec=1h
+Persistent=true
+Unit=${UPDATE_SERVICE_NAME}
+
+[Install]
+WantedBy=timers.target
+`;
+  const rollback = options.packageManager === "pnpm" ? `${shellQuote(options.packageManager)} add -g --ignore-scripts "${options.packageName}@$PREVIOUS_VERSION"` : `${shellQuote(options.packageManager)} install -g --ignore-scripts "${options.packageName}@$PREVIOUS_VERSION"`;
+  const packageManagerEnvironment = options.packageManager === "pnpm" ? `export PNPM_HOME=${shellQuote(path.dirname(options.wstackBin))}
+` : "";
+  const updateScript = `#!/bin/sh
+# ${MANAGED_MARKER}
+set -eu
+
+WSTACK_BIN=${shellQuote(options.wstackBin)}
+PACKAGE_MANAGER=${shellQuote(options.packageManager)}
+SERVICE=${shellQuote(SERVICE_NAME)}
+export PATH=${shellQuote(`${path.dirname(options.wstackBin)}:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin`)}
+${packageManagerEnvironment}
+
+version_of() {
+  "$WSTACK_BIN" --version 2>/dev/null | sed -n 's/^WrongStack \\([^ ]*\\).*/\\1/p' | head -n 1
+}
+
+CHECK_OUTPUT=$("$WSTACK_BIN" update --check-only --pm "$PACKAGE_MANAGER") || {
+  printf '%s\\n' "$CHECK_OUTPUT" >&2
+  exit 1
+}
+printf '%s\\n' "$CHECK_OUTPUT"
+if ! printf '%s\\n' "$CHECK_OUTPUT" | grep -q '^Update available:'; then
+  exit 0
+fi
+
+PREVIOUS_VERSION=$(version_of)
+if [ -z "$PREVIOUS_VERSION" ] || [ "$PREVIOUS_VERSION" = "dev" ]; then
+  echo "Cannot determine an installed release version; refusing unattended update." >&2
+  exit 1
+fi
+
+SERVICE_STOPPED=0
+ensure_started() {
+  if [ "$SERVICE_STOPPED" -eq 1 ]; then
+    systemctl start "$SERVICE" || true
+  fi
+}
+trap ensure_started EXIT INT TERM
+
+systemctl stop "$SERVICE"
+SERVICE_STOPPED=1
+if ! "$WSTACK_BIN" update --pm "$PACKAGE_MANAGER"; then
+  echo "Update failed; reinstalling WrongStack $PREVIOUS_VERSION." >&2
+  ${rollback}
+  exit 1
+fi
+
+UPDATED_VERSION=$(version_of)
+if [ -z "$UPDATED_VERSION" ] || [ "$UPDATED_VERSION" = "$PREVIOUS_VERSION" ]; then
+  echo "Updated binary did not report a new release; rolling back." >&2
+  ${rollback}
+  exit 1
+fi
+
+systemctl start "$SERVICE"
+SERVICE_STOPPED=0
+sleep 10
+if ! systemctl is-active --quiet "$SERVICE"; then
+  echo "Updated HQ did not stay active; rolling back to $PREVIOUS_VERSION." >&2
+  systemctl stop "$SERVICE" || true
+  SERVICE_STOPPED=1
+  ${rollback}
+  systemctl start "$SERVICE"
+  SERVICE_STOPPED=0
+  sleep 5
+  systemctl is-active --quiet "$SERVICE"
+  exit 1
+fi
+
+echo "WrongStack HQ updated: $PREVIOUS_VERSION -> $UPDATED_VERSION"
+`;
+  const environment = [
+    `# ${MANAGED_MARKER}`,
+    `WRONGSTACK_HQ_PASSWORD=${envQuote(options.password)}`,
+    "WRONGSTACK_HQ_BOOTSTRAP_PASSWORD_ONLY=1",
+    ...options.publicOrigin ? [`WRONGSTACK_HQ_PUBLIC_URL=${envQuote(options.publicOrigin)}`] : [],
+    ...options.ipAllowlist ? [`WRONGSTACK_HQ_ALLOWLIST=${envQuote(options.ipAllowlist)}`] : []
+  ].join("\n");
+  return { service, updateService, updateTimer, updateScript, environment: `${environment}
+` };
+}
+async function runCommand(command, args) {
+  return await new Promise((resolve2, reject) => {
+    const child = spawn(command, args, {
+      stdio: "pipe",
+      windowsHide: true,
+      env: buildChildEnv()
+    });
+    let stdout = "";
+    let stderr = "";
+    child.stdout?.on("data", (chunk) => {
+      stdout += String(chunk);
+    });
+    child.stderr?.on("data", (chunk) => {
+      stderr += String(chunk);
+    });
+    child.on("error", reject);
+    child.on("close", (code) => resolve2({ code, stdout, stderr }));
+  });
+}
+async function systemctl(args, allowFailure = false) {
+  const result = await runCommand("systemctl", args);
+  if (!allowFailure && result.code !== 0) {
+    throw new Error(result.stderr.trim() || `systemctl ${args.join(" ")} failed`);
+  }
+  return result;
+}
+async function writeManagedFile(file, content, mode) {
+  const temporary = `${file}.tmp-${process.pid}`;
+  await fs.writeFile(temporary, content, { encoding: "utf8", mode });
+  await fs.chmod(temporary, mode);
+  await fs.rename(temporary, file);
+}
+async function hasForeignManagedTarget(file) {
+  try {
+    const content = await fs.readFile(file, "utf8");
+    return !content.includes(MANAGED_MARKER);
+  } catch (cause) {
+    return cause.code !== "ENOENT";
+  }
+}
+async function findExecutable(name) {
+  for (const directory of (process.env.PATH ?? "").split(path.delimiter)) {
+    if (!directory || !path.isAbsolute(directory)) continue;
+    const candidate = path.join(directory, name);
+    try {
+      await fs.access(candidate, fsConstants.X_OK);
+      return candidate;
+    } catch {
+    }
+  }
+  return void 0;
+}
+async function findSystemExecutable(name) {
+  for (const directory of ["/usr/local/bin", "/usr/bin", "/bin"]) {
+    const candidate = path.join(directory, name);
+    try {
+      await fs.access(candidate, fsConstants.X_OK);
+      return candidate;
+    } catch {
+    }
+  }
+  return void 0;
+}
+function requireLinuxRoot(deps) {
+  if (process.platform !== "linux") {
+    deps.renderer.writeError("HQ system service management is supported only on Linux/systemd.\n");
+    return false;
+  }
+  if (process.getuid?.() !== 0) {
+    deps.renderer.writeError("Run this command as root (for example with sudo).\n");
+    return false;
+  }
+  return true;
+}
+function serviceHelp(deps) {
+  deps.renderer.write(
+    "Usage:\n  sudo -E wstack hq service install [--port 3499] [--pm npm|pnpm] [--no-auto-update]\n  wstack hq service status\n  sudo wstack hq service update\n  sudo wstack hq service uninstall\n\nInstall requires WRONGSTACK_HQ_PASSWORD (minimum 8 characters).\nOptions: --port <n>, --hq-allowlist <ip,cidr,...>, --pm npm|pnpm, --wstack-bin <path>, --no-auto-update, --force.\n"
+  );
+}
+async function installService(deps) {
+  if (!requireLinuxRoot(deps)) return 1;
+  let password;
+  try {
+    password = await resolveHqPasswordInput();
+  } catch (cause) {
+    deps.renderer.writeError(`${cause instanceof Error ? cause.message : String(cause)}
+`);
+    return 1;
+  }
+  if (!password || password.length < 8) {
+    deps.renderer.writeError(
+      "Set WRONGSTACK_HQ_PASSWORD to at least 8 characters; it will be stored root-only.\n"
+    );
+    return 1;
+  }
+  const portValue = deps.flags?.["port"];
+  const port = typeof portValue === "string" ? Number(portValue) : 3499;
+  if (!Number.isSafeInteger(port) || port < 1 || port > 65535) {
+    deps.renderer.writeError("--port must be an integer between 1 and 65535.\n");
+    return 1;
+  }
+  const requestedManager = deps.flags?.["pm"] ?? deps.flags?.["package-manager"];
+  const detectedManager = typeof requestedManager === "string" ? requestedManager : detectUpdatePackageManager();
+  if (detectedManager !== "npm" && detectedManager !== "pnpm") {
+    deps.renderer.writeError("HQ unattended updates support --pm npm or --pm pnpm.\n");
+    return 1;
+  }
+  if (!await findSystemExecutable(detectedManager)) {
+    deps.renderer.writeError(
+      `Could not find system-wide ${detectedManager}; unattended root updates cannot use a home-directory shim.
+`
+    );
+    return 1;
+  }
+  const explicitBin = deps.flags?.["wstack-bin"];
+  const wstackBin = typeof explicitBin === "string" ? path.resolve(explicitBin) : await findExecutable("wstack");
+  if (!wstackBin) {
+    deps.renderer.writeError("Could not find a global wstack executable in PATH.\n");
+    return 1;
+  }
+  const resolvedWstackBin = await fs.realpath(wstackBin).catch(() => wstackBin);
+  if (resolvedWstackBin === "/root" || resolvedWstackBin.startsWith("/root/") || resolvedWstackBin.startsWith("/home/")) {
+    deps.renderer.writeError(
+      "The HQ system service requires a system-wide wstack executable outside /root and /home. Install with `sudo npm install -g wrongstack` and retry.\n"
+    );
+    return 1;
+  }
+  const publicOriginValue = typeof deps.flags?.["hq-public-url"] === "string" ? deps.flags["hq-public-url"] : process.env.WRONGSTACK_HQ_PUBLIC_URL;
+  let publicOrigin;
+  if (publicOriginValue) {
+    try {
+      const parsed = new URL(publicOriginValue);
+      if (parsed.protocol !== "https:" || parsed.origin !== publicOriginValue.replace(/\/$/, "")) {
+        throw new Error("not an exact HTTPS origin");
+      }
+      publicOrigin = parsed.origin;
+    } catch {
+      deps.renderer.writeError("--hq-public-url must be an exact HTTPS origin.\n");
+      return 1;
+    }
+  }
+  const allowlistValue = typeof deps.flags?.["hq-allowlist"] === "string" ? deps.flags["hq-allowlist"] : process.env.WRONGSTACK_HQ_ALLOWLIST;
+  let ipAllowlist;
+  if (allowlistValue !== void 0 && allowlistValue.trim() !== "") {
+    try {
+      const { parseHqIpAllowlist } = await import("./ip-allowlist-NHXO6AKJ.js");
+      ipAllowlist = parseHqIpAllowlist(allowlistValue)?.join(",");
+    } catch (cause) {
+      deps.renderer.writeError(`${cause instanceof Error ? cause.message : String(cause)}
+`);
+      return 1;
+    }
+  }
+  const assets = renderHqServiceAssets({
+    wstackBin,
+    packageManager: detectedManager,
+    packageName: detectUpdatePackageName(),
+    password,
+    port,
+    ...publicOrigin ? { publicOrigin } : {},
+    ...ipAllowlist ? { ipAllowlist } : {}
+  });
+  try {
+    await fs.access("/run/systemd/system");
+    const systemd = await systemctl(["--version"], true);
+    if (systemd.code !== 0) throw new Error("systemctl is not operational");
+  } catch {
+    deps.renderer.writeError("This host is not running systemd; no service files were written.\n");
+    return 1;
+  }
+  const managedTargets = [
+    `${SYSTEMD_DIR}/${SERVICE_NAME}`,
+    `${SYSTEMD_DIR}/${UPDATE_SERVICE_NAME}`,
+    `${SYSTEMD_DIR}/${UPDATE_TIMER_NAME}`,
+    UPDATE_SCRIPT,
+    ENV_FILE
+  ];
+  if (deps.flags?.["force"] !== true) {
+    const foreign = [];
+    for (const file of managedTargets) {
+      if (await hasForeignManagedTarget(file)) foreign.push(file);
+    }
+    if (foreign.length > 0) {
+      deps.renderer.writeError(
+        `Refusing to overwrite files not managed by WrongStack:
+${foreign.map((file) => `  ${file}`).join("\n")}
+Use --force only after reviewing them.
+`
+      );
+      return 1;
+    }
+  }
+  await fs.mkdir(ENV_DIR, { recursive: true, mode: 448 });
+  await fs.mkdir(path.dirname(UPDATE_SCRIPT), { recursive: true, mode: 493 });
+  await writeManagedFile(ENV_FILE, assets.environment, 384);
+  await writeManagedFile(`${SYSTEMD_DIR}/${SERVICE_NAME}`, assets.service, 420);
+  await writeManagedFile(`${SYSTEMD_DIR}/${UPDATE_SERVICE_NAME}`, assets.updateService, 420);
+  await writeManagedFile(`${SYSTEMD_DIR}/${UPDATE_TIMER_NAME}`, assets.updateTimer, 420);
+  await writeManagedFile(UPDATE_SCRIPT, assets.updateScript, 493);
+  await systemctl(["daemon-reload"]);
+  await systemctl(["enable", SERVICE_NAME]);
+  await systemctl(["restart", SERVICE_NAME]);
+  if (deps.flags?.["no-auto-update"] === true) {
+    await systemctl(["disable", "--now", UPDATE_TIMER_NAME], true);
+  } else {
+    await systemctl(["enable", "--now", UPDATE_TIMER_NAME]);
+  }
+  deps.renderer.write(
+    `Installed ${SERVICE_NAME}; listening on ${publicOrigin ? "127.0.0.1" : "0.0.0.0"}:${port}, boot persistence and automatic restart are active.
+` + (ipAllowlist ? `Network allowlist is active (${ipAllowlist.split(",").length} configured rules + loopback).
+` : "Network allowlist is disabled; password authentication remains active.\n") + (deps.flags?.["no-auto-update"] === true ? "Automatic updates are disabled.\n" : `Automatic updates are scheduled by ${UPDATE_TIMER_NAME}.
+`)
+  );
+  return 0;
+}
+async function uninstallService(deps) {
+  if (!requireLinuxRoot(deps)) return 1;
+  const targets = [
+    `${SYSTEMD_DIR}/${SERVICE_NAME}`,
+    `${SYSTEMD_DIR}/${UPDATE_SERVICE_NAME}`,
+    `${SYSTEMD_DIR}/${UPDATE_TIMER_NAME}`,
+    UPDATE_SCRIPT
+  ];
+  const timerIsForeign = await hasForeignManagedTarget(`${SYSTEMD_DIR}/${UPDATE_TIMER_NAME}`);
+  const serviceIsForeign = await hasForeignManagedTarget(`${SYSTEMD_DIR}/${SERVICE_NAME}`);
+  if (!timerIsForeign) await systemctl(["disable", "--now", UPDATE_TIMER_NAME], true);
+  if (!serviceIsForeign) await systemctl(["disable", "--now", SERVICE_NAME], true);
+  const preserved = [];
+  for (const file of targets) {
+    if (await hasForeignManagedTarget(file)) {
+      preserved.push(file);
+      continue;
+    }
+    await fs.rm(file, { force: true });
+  }
+  await systemctl(["daemon-reload"]);
+  deps.renderer.write(
+    `Removed WrongStack-managed HQ systemd files. Data and ${ENV_FILE} were preserved.
+`
+  );
+  if (preserved.length > 0) {
+    deps.renderer.write(
+      `Preserved files not managed by WrongStack:
+${preserved.map((file) => `  ${file}`).join("\n")}
+`
+    );
+  }
+  return 0;
+}
+var hqServiceCmd = async (args, deps) => {
+  const action = args[0];
+  if (deps.flags?.["help"] === true || action === "help" || !action) {
+    serviceHelp(deps);
+    return 0;
+  }
+  try {
+    if (action === "install") return await installService(deps);
+    if (action === "uninstall") return await uninstallService(deps);
+    if (action === "update") {
+      if (!requireLinuxRoot(deps)) return 1;
+      const result = await systemctl(["start", UPDATE_SERVICE_NAME]);
+      if (result.stdout) deps.renderer.write(result.stdout);
+      deps.renderer.write("HQ update check completed.\n");
+      return 0;
+    }
+    if (action === "status") {
+      if (process.platform !== "linux") {
+        deps.renderer.writeError("HQ system service status is supported only on Linux/systemd.\n");
+        return 1;
+      }
+      const result = await systemctl(
+        ["status", SERVICE_NAME, UPDATE_TIMER_NAME, "--no-pager"],
+        true
+      );
+      deps.renderer.write(result.stdout || result.stderr);
+      return result.code ?? 1;
+    }
+  } catch (cause) {
+    deps.renderer.writeError(`${cause instanceof Error ? cause.message : String(cause)}
+`);
+    return 1;
+  }
+  deps.renderer.writeError(`Unknown HQ service action: ${action}
+`);
+  serviceHelp(deps);
+  return 1;
+};
+export {
+  hqServiceCmd,
+  renderHqServiceAssets
+};
+//# sourceMappingURL=hq-service-L5INQFM4.js.map

package/dist/hq-service.d.ts

@@ -0,0 +1,22 @@
+import type { SubcommandHandler } from './subcommands/contracts.js';
+type ServerPackageManager = 'npm' | 'pnpm';
+export interface HqServiceAssets {
+    service: string;
+    updateService: string;
+    updateTimer: string;
+    updateScript: string;
+    environment: string;
+}
+export interface HqServiceAssetOptions {
+    wstackBin: string;
+    packageManager: ServerPackageManager;
+    packageName: 'wrongstack' | '@wrongstack/cli';
+    password: string;
+    port: number;
+    publicOrigin?: string | undefined;
+    ipAllowlist?: string | undefined;
+}
+export declare function renderHqServiceAssets(options: HqServiceAssetOptions): HqServiceAssets;
+export declare const hqServiceCmd: SubcommandHandler;
+export {};
+//# sourceMappingURL=hq-service.d.ts.map