@wrongstack/cli 1.0.1 → 1.0.4

package/dist/{chunk-C2E24IXZ.js → chunk-3I5ZJXM5.js}

@@ -3,14 +3,37 @@ import {
   terminalText
 } from "./chunk-HXJYHAR4.js";
 import {
-  resolveAuditActor
-} from "./chunk-Q5GTM25S.js";
+  MAX_AGENT_RINGS,
+  MAX_TRANSCRIPT_SESSIONS,
+  TRANSCRIPT_RING_MAX,
+  agentMessageToEntry,
+  agentRingKey,
+  buildBootstrapHttpUrl,
+  buildClientWsUrl,
+  buildHttpUrl,
+  decodePathSegment,
+  decodeSessionId,
+  evictOldest,
+  hqMachineKey,
+  hqRuntimeMarkerPath,
+  lanIPv4Addresses,
+  readLocalSubagentTranscript,
+  readRequestBody,
+  recordTimeseriesSignal,
+  resolveAuditActor,
+  sanitizeApiError,
+  truncateHqSummary,
+  writeInvalidBody
+} from "./chunk-I7V2OYVH.js";
+import {
+  createHqIpAllowlist
+} from "./chunk-Q7E3BPDU.js";
 
 // src/hq-server.ts
 import { randomUUID as randomUUID6 } from "node:crypto";
-import * as fs5 from "node:fs/promises";
+import * as fs4 from "node:fs/promises";
 import * as http from "node:http";
-import * as path7 from "node:path";
+import * as path6 from "node:path";
 import { getSharedProjectMailbox } from "@wrongstack/core/coordination";
 import {
   assessHqExposure as assessHqExposure2,
@@ -290,7 +313,7 @@ function authenticateBrowserRequest(req, url, mutableAuth, sessions) {
             if (liveToken.capabilities !== void 0) ctx.capabilities = liveToken.capabilities;
             return ctx;
           }
-          return { kind: "cookie" };
+          return session.capabilities === void 0 ? { kind: "cookie" } : { kind: "cookie", capabilities: session.capabilities };
         }
         if (session) sessions.delete(sessionId);
       }
@@ -609,6 +632,7 @@ var MIME = {
   ".mjs": "application/javascript; charset=utf-8",
   ".css": "text/css; charset=utf-8",
   ".json": "application/json; charset=utf-8",
+  ".webmanifest": "application/manifest+json; charset=utf-8",
   ".svg": "image/svg+xml",
   ".png": "image/png",
   ".jpg": "image/jpeg",
@@ -711,7 +735,6 @@ function isLoopbackRequest(req) {
 var HQ_AUTH_ADMIN_CAPABILITY = "auth.admin";
 function callerCanAdministerAuth(auth) {
   if (auth === void 0) return false;
-  if (auth.kind === "cookie" && auth.tokenId === void 0) return true;
   if (auth.capabilities === void 0) return true;
   return auth.capabilities.includes(HQ_AUTH_ADMIN_CAPABILITY);
 }
@@ -762,6 +785,9 @@ function normalizeAddress(raw) {
   const trimmed = raw.trim().replace(/^\[(.*)\]$/, "$1");
   return trimmed.replace(/^::ffff:/i, "");
 }
+function resolveSocketAddress(req) {
+  return req.socket.remoteAddress ? normalizeAddress(req.socket.remoteAddress) : void 0;
+}
 function parseForwardedEntry(entry) {
   const value = entry.trim();
   if (!value) return void 0;
@@ -786,7 +812,7 @@ function forwardedChain(req) {
   return raw.split(",").map((entry) => parseForwardedEntry(entry)).filter((entry) => entry !== void 0);
 }
 function resolveClientAddress(req, trustedProxyHops = 0) {
-  const socketAddress = req.socket.remoteAddress ? normalizeAddress(req.socket.remoteAddress) : void 0;
+  const socketAddress = resolveSocketAddress(req);
   const hops = Number.isFinite(trustedProxyHops) ? Math.max(0, Math.trunc(trustedProxyHops)) : 0;
   if (hops === 0) return socketAddress ?? "unknown";
   const chain = [
@@ -797,201 +823,6 @@ function resolveClientAddress(req, trustedProxyHops = 0) {
   return chain[hops] ?? socketAddress ?? "unknown";
 }
 
-// src/hq-server/utils.ts
-import * as fs3 from "node:fs/promises";
-import * as os from "node:os";
-import * as path3 from "node:path";
-import { resolveHqDataDir } from "@wrongstack/core/hq";
-import { sanitizeApiError, scrubErrorDetail } from "@wrongstack/core/security";
-var TRANSCRIPT_RING_MAX = 4e3;
-var MAX_TRANSCRIPT_SESSIONS = 400;
-var MAX_AGENT_RINGS = 800;
-function evictOldest(map, max) {
-  while (map.size > max) {
-    const oldest = map.keys().next().value;
-    if (oldest === void 0) break;
-    map.delete(oldest);
-  }
-}
-function agentRingKey(sessionId, subId) {
-  return sessionId ? `${sessionId}::${subId}` : subId;
-}
-function agentMessageToEntry(p) {
-  const kind = typeof p["kind"] === "string" ? p["kind"] : "text";
-  const role = kind === "thinking" ? "thinking" : kind === "tool_use" || kind === "tool_result" ? "tool" : kind === "error" ? "error" : kind === "status" || kind === "system" ? "system" : "assistant";
-  return {
-    ts: typeof p["ts"] === "string" ? p["ts"] : (/* @__PURE__ */ new Date()).toISOString(),
-    role,
-    text: typeof p["content"] === "string" ? p["content"] : "",
-    ...typeof p["toolName"] === "string" ? { tool: p["toolName"] } : {},
-    ...kind === "error" ? { isError: true } : {}
-  };
-}
-async function readLocalSubagentTranscript(sessionId, subagentId) {
-  try {
-    const { getSessionRegistry } = await import("@wrongstack/core/storage");
-    const { resolveWstackPaths, sessionScopedPath } = await import("@wrongstack/core/utils");
-    const globalRoot = path3.dirname(resolveHqDataDir());
-    const registry = getSessionRegistry(globalRoot);
-    const entry = await registry.get(sessionId).catch(() => null);
-    if (!entry) return null;
-    const paths = resolveWstackPaths({ projectRoot: entry.projectRoot, globalRoot });
-    const sessionDir = sessionScopedPath(paths.projectSessions, sessionId, "");
-    if (!isSafePathSegment(subagentId)) return null;
-    const transcriptsRoot = path3.resolve(sessionDir, "subagents", "transcripts");
-    const file = path3.resolve(transcriptsRoot, subagentId, "transcript.jsonl");
-    if (!file.startsWith(transcriptsRoot + path3.sep)) return null;
-    const raw = await fs3.readFile(file, "utf8").catch(() => null);
-    if (raw === null) return null;
-    const out = [];
-    for (const line of raw.split("\n")) {
-      const trimmed = line.trim();
-      if (trimmed.length === 0) continue;
-      try {
-        out.push(agentMessageToEntry(JSON.parse(trimmed)));
-      } catch {
-      }
-    }
-    return out;
-  } catch {
-    return null;
-  }
-}
-function decodePathSegment(value) {
-  let decoded;
-  try {
-    decoded = decodeURIComponent(value);
-  } catch {
-    return null;
-  }
-  return isSafePathSegment(decoded) ? decoded : null;
-}
-function decodeSessionId(value) {
-  let decoded;
-  try {
-    decoded = decodeURIComponent(value);
-  } catch {
-    return null;
-  }
-  return isSafeSessionId(decoded) ? decoded : null;
-}
-var MAX_PATH_SEGMENT_LENGTH = 256;
-function isSafePathSegment(value) {
-  if (value.length === 0 || value.length > MAX_PATH_SEGMENT_LENGTH) return false;
-  if (value === "." || value === "..") return false;
-  if (value.includes("/") || value.includes("\\")) return false;
-  if (value.includes("\0")) return false;
-  if (value.includes(":")) return false;
-  return true;
-}
-function isSafeSessionId(value) {
-  if (value.length === 0 || value.length > MAX_PATH_SEGMENT_LENGTH) return false;
-  if (value.includes("\\") || value.includes("\0") || value.includes(":")) return false;
-  const parts = value.split("/");
-  if (parts.length > 2) return false;
-  return parts.every((p) => p.length > 0 && p !== "." && p !== "..");
-}
-function displayHost(host) {
-  return host === "0.0.0.0" ? "127.0.0.1" : host;
-}
-var RequestBodyTooLargeError = class extends Error {
-};
-function readRequestBody(req, maxBytes = 1e6) {
-  return new Promise((resolve2, reject) => {
-    const chunks = [];
-    let size = 0;
-    let settled = false;
-    req.on("data", (chunk) => {
-      if (settled) return;
-      size += chunk.length;
-      if (size > maxBytes) {
-        settled = true;
-        chunks.length = 0;
-        reject(new RequestBodyTooLargeError("request body too large"));
-        return;
-      }
-      chunks.push(chunk);
-    });
-    req.on("end", () => {
-      if (!settled) resolve2(Buffer.concat(chunks).toString("utf8"));
-    });
-    req.on("error", (error) => {
-      if (!settled) reject(error);
-    });
-  });
-}
-function writeInvalidBody(res, error) {
-  const tooLarge = error instanceof RequestBodyTooLargeError;
-  res.writeHead(tooLarge ? 413 : 400, { "Content-Type": "application/json" });
-  res.end(JSON.stringify({ error: tooLarge ? "request body too large" : "invalid json body" }));
-}
-function buildHttpUrl(host, port, token) {
-  const url = new URL(`http://${displayHost(host)}:${port}/`);
-  if (token) url.searchParams.set("token", token);
-  return url.toString();
-}
-function buildBootstrapHttpUrl(host, port, bootstrapCode) {
-  const url = new URL(`http://${displayHost(host)}:${port}/`);
-  url.hash = `bootstrap=${bootstrapCode}`;
-  return url.toString();
-}
-function buildClientWsUrl(host, port, token) {
-  const url = new URL(`ws://${displayHost(host)}:${port}/ws/client`);
-  if (token) url.searchParams.set("token", token);
-  return url.toString();
-}
-function hqRuntimeMarkerPath(dataDir) {
-  return path3.join(dataDir, "runtime.json");
-}
-function lanIPv4Addresses() {
-  const out = [];
-  try {
-    const ifaces = os.networkInterfaces();
-    for (const name of Object.keys(ifaces)) {
-      for (const ni of ifaces[name] ?? []) {
-        if (ni.family === "IPv4" && !ni.internal) out.push(ni.address);
-      }
-    }
-  } catch {
-  }
-  return out;
-}
-function truncateHqSummary(value, maxLength) {
-  if (typeof value !== "string" || value.length === 0) return void 0;
-  if (value.length <= maxLength) return value;
-  const suffix = `\u2026[truncated:${value.length - maxLength}]`;
-  if (maxLength <= suffix.length) return "\u2026";
-  const prefixLen = maxLength - suffix.length;
-  return `${value.slice(0, prefixLen)}${suffix}`;
-}
-function hqMachineKey(hostname, machineId) {
-  const hn = hostname?.trim();
-  return hn ? `host:${hn.toLowerCase()}` : `mid:${machineId || "local"}`;
-}
-function recordTimeseriesSignal(persistence, event) {
-  try {
-    if (event.type === "session.usage") {
-      const p = event.payload;
-      persistence.timeseries.record({
-        ts: Date.parse(event.timestamp) || Date.now(),
-        ...typeof p.costUsd === "number" ? { costUsd: p.costUsd } : {},
-        ...typeof p.inputTokens === "number" ? { inputTokens: p.inputTokens } : {},
-        ...typeof p.outputTokens === "number" ? { outputTokens: p.outputTokens } : {},
-        ...typeof p.model === "string" && p.model.length > 0 ? { model: p.model } : {},
-        ...typeof p.provider === "string" && p.provider.length > 0 ? { provider: p.provider } : {},
-        ...typeof p.cacheRead === "number" ? { cacheRead: p.cacheRead } : {},
-        ...typeof p.cacheWrite === "number" ? { cacheWrite: p.cacheWrite } : {}
-      });
-    } else if (event.type === "tool.completed") {
-      persistence.timeseries.record({
-        ts: Date.parse(event.timestamp) || Date.now(),
-        toolCalls: 1
-      });
-    }
-  } catch {
-  }
-}
-
 // src/hq-server/routes/auth/password-routes.ts
 async function handleApiAuthStatus(req, res, url, mutableAuth, sessions, requireBrowserAuth, trustedPublicOrigins, secureCookies) {
   const auth = authenticateBrowserRequest(req, url, mutableAuth, sessions);
@@ -1013,7 +844,7 @@ async function handleApiAuthStatus(req, res, url, mutableAuth, sessions, require
     })
   );
 }
-async function handleApiLogin(req, res, mutableAuth, sessions, loginAttempts, secureCookies, trustedProxyHops) {
+async function handleApiLogin(req, res, mutableAuth, sessions, loginAttempts, secureCookies, trustedProxyHops, sessionCapabilities) {
   if (!mutableAuth.passwordHash) {
     res.writeHead(403, { "Content-Type": "application/json" });
     res.end(
@@ -1076,7 +907,8 @@ async function handleApiLogin(req, res, mutableAuth, sessions, loginAttempts, se
       createdAt: Date.now(),
       kind: "password",
       pending2fa: true,
-      lastSeenAt: Date.now()
+      lastSeenAt: Date.now(),
+      ...sessionCapabilities !== void 0 ? { capabilities: sessionCapabilities } : {}
     });
     setHqSessionCookie(
       res,
@@ -1089,7 +921,12 @@ async function handleApiLogin(req, res, mutableAuth, sessions, loginAttempts, se
   }
   loginAttempts.clearOnSuccess(clientIp, body.password);
   const sessionId = randomUUID();
-  sessions.set(sessionId, { createdAt: Date.now(), kind: "password", lastSeenAt: Date.now() });
+  sessions.set(sessionId, {
+    createdAt: Date.now(),
+    kind: "password",
+    lastSeenAt: Date.now(),
+    ...sessionCapabilities !== void 0 ? { capabilities: sessionCapabilities } : {}
+  });
   setHqSessionCookie(
     res,
     serializeHqSessionCookie(sessionId, mutableAuth.cookieSecret),
@@ -1359,7 +1196,8 @@ async function handleApiLoginVerify(req, res, _url, mutableAuth, sessions, login
     sessions.set(fullSessionId, {
       createdAt: Date.now(),
       kind: "password",
-      lastSeenAt: Date.now()
+      lastSeenAt: Date.now(),
+      ...session.capabilities !== void 0 ? { capabilities: session.capabilities } : {}
     });
     setHqSessionCookie(
       res,
@@ -1399,8 +1237,8 @@ async function handleApiLoginVerify(req, res, _url, mutableAuth, sessions, login
     await recoveryCodeLock;
     let releaseLock = () => {
     };
-    recoveryCodeLock = new Promise((resolve2) => {
-      releaseLock = resolve2;
+    recoveryCodeLock = new Promise((resolve) => {
+      releaseLock = resolve;
     });
     try {
       const next = await mutateHqAuthFile2(dataDir, (current) => {
@@ -1438,7 +1276,8 @@ async function handleApiLoginVerify(req, res, _url, mutableAuth, sessions, login
     sessions.set(fullSessionId, {
       createdAt: Date.now(),
       kind: "password",
-      lastSeenAt: Date.now()
+      lastSeenAt: Date.now(),
+      ...session.capabilities !== void 0 ? { capabilities: session.capabilities } : {}
     });
     setHqSessionCookie(
       res,
@@ -2255,7 +2094,7 @@ async function authorizeHqCommand(input) {
 }
 
 // src/hq-server/routes/mailbox-handlers.ts
-import * as path4 from "node:path";
+import * as path3 from "node:path";
 import { resolveProjectDir } from "@wrongstack/core/coordination";
 
 // src/hq-server/project-root.ts
@@ -2311,7 +2150,7 @@ async function handleMailboxGateway(_req, res, match, authorizeMailboxGateway, g
     );
     return;
   }
-  const gatewayGlobalRoot = path4.dirname(dataDir);
+  const gatewayGlobalRoot = path3.dirname(dataDir);
   const preliminaryAccess = authorizeMailboxGateway(_req, `project:${projectId}`);
   if (!preliminaryAccess.allowed) {
     res.writeHead(preliminaryAccess.status ?? 401, {
@@ -2377,7 +2216,7 @@ async function handleApiMailboxSend(_req, res, mutableAuth, sessions, dataDir, g
     res.end(JSON.stringify({ error: "audience must be all or leaders" }));
     return;
   }
-  const mbGlobalRoot = path4.dirname(dataDir);
+  const mbGlobalRoot = path3.dirname(dataDir);
   const projectRoot = await resolveHqProjectRoot(mbGlobalRoot, {
     sessionId: mbody.sessionId,
     projectId: mbody.projectId
@@ -2497,7 +2336,7 @@ async function handleMailboxAction(_req, res, match, mutableAuth, sessions, data
     res.end(JSON.stringify({ error: "missing sessionId or projectId" }));
     return;
   }
-  const actGlobalRoot = path4.dirname(dataDir);
+  const actGlobalRoot = path3.dirname(dataDir);
   const projectRoot = await resolveHqProjectRoot(actGlobalRoot, {
     sessionId: abody.sessionId,
     projectId: abody.projectId
@@ -2593,6 +2432,15 @@ async function handleApiCommand(req, res, url, mutableAuth, sessions, clients, b
     res.end(JSON.stringify({ error: "unrecognized or malformed command", type: body.type }));
     return;
   }
+  if (validated.type === "run-command" && isCookieAuth(auth) && auth.capabilities !== void 0 && !auth.capabilities.includes("control.execute")) {
+    res.writeHead(403, { "Content-Type": "application/json" });
+    res.end(
+      JSON.stringify({
+        error: "forbidden: browser session lacks control.execute capability"
+      })
+    );
+    return;
+  }
   if (validated.type === "run-command" && !tokenHasCapability(target.authToken, "control.execute")) {
     res.writeHead(403, { "Content-Type": "application/json" });
     res.end(
@@ -2678,14 +2526,14 @@ async function handleApiTrendsCost(req, res, persistence) {
 }
 
 // src/hq-server/routes/session-handlers.ts
-import * as path5 from "node:path";
+import * as path4 from "node:path";
 import {
   buildTranscriptFromEvents,
-  resolveHqDataDir as resolveHqDataDir2
+  resolveHqDataDir
 } from "@wrongstack/core/hq";
 async function handleApiSessions(res) {
   const { getSessionRegistry } = await import("@wrongstack/core/storage");
-  const globalRoot = path5.dirname(resolveHqDataDir2());
+  const globalRoot = path4.dirname(resolveHqDataDir());
   try {
     const registry = getSessionRegistry(globalRoot);
     const sessions = await registry.list();
@@ -2730,7 +2578,7 @@ async function handleApiSessionEvents(req, res, match, transcripts) {
     res.end(JSON.stringify({ error: "invalid sessionId encoding" }));
     return;
   }
-  const globalRoot = path5.dirname(resolveHqDataDir2());
+  const globalRoot = path4.dirname(resolveHqDataDir());
   try {
     const registry = getSessionRegistry(globalRoot);
     const entry = await registry.get(sessionId).catch(() => null);
@@ -2957,12 +2805,26 @@ function createHqRouter(deps) {
     trustBoundary,
     bootstrapStore,
     applyAuthFile,
-    trustedProxyHops = 0
+    trustedProxyHops = 0,
+    ipAllowlist
   } = deps;
   return async (req, res) => {
     try {
       const url = new URL(req.url ?? "/", `http://${host}:${listeningPort()}`);
       setHqSecurityHeaders(res);
+      if (ipAllowlist && !ipAllowlist.allows(resolveSocketAddress(req))) {
+        res.writeHead(403, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ error: "forbidden: source IP is not allowed" }));
+        return;
+      }
+      if (url.pathname === "/healthz" && req.method === "GET") {
+        res.writeHead(200, {
+          "Content-Type": "application/json",
+          "Cache-Control": "no-store"
+        });
+        res.end(JSON.stringify({ status: "ok" }));
+        return;
+      }
       if (!hasTrustedBrowserOrigin(
         req,
         host,
@@ -2974,7 +2836,7 @@ function createHqRouter(deps) {
         res.end(JSON.stringify({ error: "forbidden: untrusted request origin" }));
         return;
       }
-      if (url.pathname.startsWith("/api/") && url.pathname !== "/api/auth/status" && url.pathname !== "/api/login" && url.pathname !== "/api/login/verify" && url.pathname !== "/api/auth/bootstrap" && hqAuthRequired(mutableAuth, requireBrowserAuth)) {
+      if (url.pathname.startsWith("/api/") && url.pathname !== "/api/auth/status" && url.pathname !== "/api/login" && url.pathname !== "/api/login/verify" && url.pathname !== "/api/mobile/login" && url.pathname !== "/api/mobile/login/verify" && url.pathname !== "/api/auth/bootstrap" && hqAuthRequired(mutableAuth, requireBrowserAuth)) {
         const auth = authenticateBrowserRequest(req, url, mutableAuth, sessions);
         if (!auth) {
           const tokenOnly = mutableAuth.browserTokens.size > 0 && !mutableAuth.passwordHash;
@@ -3041,7 +2903,7 @@ function createHqRouter(deps) {
         await handleApiAuthSessionsRevoke(req, res, url, sessions);
         return;
       }
-      if (url.pathname === "/api/login" && req.method === "POST") {
+      if ((url.pathname === "/api/login" || url.pathname === "/api/mobile/login") && req.method === "POST") {
         await handleApiLogin(
           req,
           res,
@@ -3049,7 +2911,8 @@ function createHqRouter(deps) {
           sessions,
           loginAttempts,
           secureCookies,
-          trustedProxyHops
+          trustedProxyHops,
+          url.pathname === "/api/mobile/login" ? ["control.enqueue"] : void 0
         );
         return;
       }
@@ -3077,7 +2940,7 @@ function createHqRouter(deps) {
         await handleApiLogout(req, res, mutableAuth, sessions, secureCookies);
         return;
       }
-      if (url.pathname === "/api/login/verify" && req.method === "POST") {
+      if ((url.pathname === "/api/login/verify" || url.pathname === "/api/mobile/login/verify") && req.method === "POST") {
         await handleApiLoginVerify(
           req,
           res,
@@ -3380,12 +3243,12 @@ import {
   ensureHqFirstRunAuthFile,
   HqInsecureExposureError,
   isTokenExpired as isTokenExpired3,
-  resolveHqDataDir as resolveHqDataDir3
+  resolveHqDataDir as resolveHqDataDir2
 } from "@wrongstack/core/hq";
 async function prepareHqServerStart(options, defaults) {
   const host = options.host ?? defaults.host;
   const port = options.port ?? defaults.port;
-  const dataDir = resolveHqDataDir3(options.dataDir);
+  const dataDir = resolveHqDataDir2(options.dataDir);
   const firstRunAuth = await ensureHqFirstRunAuthFile(dataDir, {
     warn: (message) => console.warn(
       JSON.stringify({
@@ -3397,6 +3260,7 @@ async function prepareHqServerStart(options, defaults) {
     ),
     actor: resolveAuditActor(),
     ...options.password !== void 0 ? { password: options.password } : {},
+    ...options.bootstrapPasswordOnly !== void 0 ? { bootstrapPasswordOnly: options.bootstrapPasswordOnly } : {},
     ...options.tokenTtlMs !== void 0 ? { tokenTtlMs: options.tokenTtlMs } : {}
   });
   const { authFile } = firstRunAuth;
@@ -3435,21 +3299,21 @@ async function prepareHqServerStart(options, defaults) {
 }
 
 // src/hq-server/startup.ts
-import * as fs4 from "node:fs/promises";
-import * as path6 from "node:path";
+import * as fs3 from "node:fs/promises";
+import * as path5 from "node:path";
 import { writeHqRuntimeFile } from "@wrongstack/core/hq";
 var hqRuntimeMarkerPath2 = hqRuntimeMarkerPath;
 async function writeHqRuntimeMarker(dataDir, url) {
-  await fs4.mkdir(dataDir, { recursive: true });
+  await fs3.mkdir(dataDir, { recursive: true });
   await writeHqRuntimeFile(dataDir, { url, pid: process.pid });
 }
 async function clearHqRuntimeMarker(dataDir, url) {
   const file = hqRuntimeMarkerPath2(dataDir);
   try {
-    const raw = await fs4.readFile(file, "utf8");
+    const raw = await fs3.readFile(file, "utf8");
     const parsed = JSON.parse(raw);
     if (parsed.url === url && parsed.pid === process.pid) {
-      await fs4.rm(file, { force: true });
+      await fs3.rm(file, { force: true });
     }
   } catch {
   }
@@ -3458,6 +3322,8 @@ function writeHqStartupInfo(write, handle) {
   const startup = handle.firstRunSetup;
   const browserUrl = buildHttpUrl(handle.host, handle.port);
   const clientUrl = buildClientWsUrl(handle.host, handle.port);
+  const mobileUrl = new URL(browserUrl);
+  mobileUrl.pathname = "/mobile";
   write(
     `${terminalText("WrongStack HQ", "magenta")} ${terminalText("listening on", "green")} ${terminalLink(browserUrl)}
 `
@@ -3465,13 +3331,39 @@ function writeHqStartupInfo(write, handle) {
   if (!startup) {
     write(`${terminalText("Browser endpoint:", "blue")} ${terminalLink(browserUrl)}
 `);
+    write(
+      `${terminalText("Mobile endpoint:", "blue")}  ${terminalLink(mobileUrl.toString())} (password required)
+`
+    );
+    write(`${terminalText("Client endpoint:", "blue")}  ${terminalLink(clientUrl)}
+`);
+    writeHqLanEndpoints(write, handle, void 0);
+    return;
+  }
+  if (process.env.WRONGSTACK_HQ_SUPPRESS_STARTUP_SECRETS === "1") {
+    write(`${terminalText("Browser endpoint:", "blue")} ${terminalLink(browserUrl)}
+`);
+    write(
+      `${terminalText("Mobile endpoint:", "blue")}  ${terminalLink(mobileUrl.toString())} (password required)
+`
+    );
     write(`${terminalText("Client endpoint:", "blue")}  ${terminalLink(clientUrl)}
+`);
+    write(`Startup credentials suppressed; auth state is stored in ${startup.dataDir}.
 `);
     writeHqLanEndpoints(write, handle, void 0);
     return;
   }
+  const firstRunMobileUrl = new URL(startup.browserUrl);
+  firstRunMobileUrl.pathname = "/mobile";
+  firstRunMobileUrl.search = "";
+  firstRunMobileUrl.hash = "";
   write(`${terminalText("Browser endpoint:", "blue")} ${terminalLink(startup.browserUrl)}
 `);
+  write(
+    `${terminalText("Mobile endpoint:", "blue")}  ${terminalLink(firstRunMobileUrl.toString())} (password required)
+`
+  );
   write(`${terminalText("Client endpoint:", "blue")}  ${terminalLink(startup.clientUrl)}
 `);
   if (startup.createdAuth) {
@@ -3489,7 +3381,7 @@ HQ auth loaded from ${startup.dataDir}
   if (startup.clientEnv.WRONGSTACK_HQ_TOKEN) {
     write(`  WRONGSTACK_HQ_TOKEN=${startup.clientEnv.WRONGSTACK_HQ_TOKEN}
 `);
-    write(`Credentials are stored in ${path6.join(startup.dataDir, "auth.json")}
+    write(`Credentials are stored in ${path5.join(startup.dataDir, "auth.json")}
 `);
   }
   writeHqLanEndpoints(write, handle, void 0);
@@ -3567,7 +3459,7 @@ function createHqServerShutdown(params) {
 }
 
 // src/hq-server/upgrade-handler.ts
-import { isLoopbackHost as isLoopbackHost3, hqTokenVerifier as hqTokenVerifier2 } from "@wrongstack/core/hq";
+import { hqTokenVerifier as hqTokenVerifier2, isLoopbackHost as isLoopbackHost3 } from "@wrongstack/core/hq";
 
 // src/hq-server/ws.ts
 import { randomUUID as randomUUID5 } from "node:crypto";
@@ -4345,6 +4237,15 @@ function handleHqUpgrade(req, socket, head, deps) {
     socket.destroy();
     return;
   }
+  if (deps.ipAllowlist && !deps.ipAllowlist.allows(resolveSocketAddress(req))) {
+    socket.write(
+      "HTTP/1.1 403 Forbidden\r\nContent-Type: application/json\r\nConnection: close\r\n\r\n" + JSON.stringify({
+        error: { code: "IP_NOT_ALLOWED", message: "Source IP is not allowed." }
+      })
+    );
+    socket.destroy();
+    return;
+  }
   if (!hasTrustedBrowserOrigin2(
     req,
     deps.host,
@@ -4471,6 +4372,7 @@ async function startHqServer(options = {}) {
 }
 async function startHqServerWithAuth(options, host, port, dataDir, firstRunAuth) {
   const trustBoundary = options.trustBoundary ?? createCompatibilityTrustBoundary({ policyId: "hq-trusted-host-compat-v1" });
+  const ipAllowlist = createHqIpAllowlist(options.ipAllowlist);
   const authFile = firstRunAuth.authFile;
   const reassessExposureFloor = (live) => {
     const exposure = assessHqExposure2({
@@ -4528,10 +4430,12 @@ async function startHqServerWithAuth(options, host, port, dataDir, firstRunAuth)
       browserTokenMode: mutableAuth.browserTokens.size > 0,
       clientTokenMode: mutableAuth.clientTokens.size > 0,
       passwordMode: mutableAuth.passwordHash !== void 0,
+      ipAllowlistActive: ipAllowlist !== void 0,
+      ipAllowlistRules: ipAllowlist?.entries.length ?? 0,
       timestamp: (/* @__PURE__ */ new Date()).toISOString()
     })
   );
-  return new Promise((resolve2, reject) => {
+  return new Promise((resolve, reject) => {
     const trustedPublicOrigins = /* @__PURE__ */ new Set();
     let listeningPort = port;
     const clients = /* @__PURE__ */ new Map();
@@ -4577,13 +4481,13 @@ async function startHqServerWithAuth(options, host, port, dataDir, firstRunAuth)
     const persistence = createHqPersistence(dataDir);
     const auditLog = new HqCommandAuditLog(1e3, (entry) => persistence.commandLog.append(entry));
     void (async () => {
-      const projectsDir = path7.join(path7.dirname(dataDir), "projects");
-      const entries = await fs5.readdir(projectsDir, { withFileTypes: true }).catch(() => []);
+      const projectsDir = path6.join(path6.dirname(dataDir), "projects");
+      const entries = await fs4.readdir(projectsDir, { withFileTypes: true }).catch(() => []);
       await Promise.all(
         entries.filter((entry) => entry.isDirectory()).map(async (entry) => {
-          const projectDir = path7.join(projectsDir, entry.name);
-          const metadataPath = path7.join(projectDir, ".mailbox-server.json");
-          const ownerPid = await fs5.readFile(metadataPath, "utf8").then((raw) => JSON.parse(raw).pid).catch(() => void 0);
+          const projectDir = path6.join(projectsDir, entry.name);
+          const metadataPath = path6.join(projectDir, ".mailbox-server.json");
+          const ownerPid = await fs4.readFile(metadataPath, "utf8").then((raw) => JSON.parse(raw).pid).catch(() => void 0);
           if (ownerPid === void 0) return;
           let ownerAlive = false;
           try {
@@ -4593,7 +4497,7 @@ async function startHqServerWithAuth(options, host, port, dataDir, firstRunAuth)
             ownerAlive = false;
           }
           if (!ownerAlive) {
-            await fs5.rm(metadataPath, { force: true }).catch(() => {
+            await fs4.rm(metadataPath, { force: true }).catch(() => {
             });
             return;
           }
@@ -4722,6 +4626,7 @@ async function startHqServerWithAuth(options, host, port, dataDir, firstRunAuth)
       getTokenStats: () => authState.tokenStats(),
       applyAuthFile: (next) => authState.apply(next),
       trustedProxyHops: options.trustedProxyHops ?? 0,
+      ipAllowlist,
       bootstrapStore
     };
     const handleRequest = createHqRouter(routerDeps);
@@ -4757,7 +4662,8 @@ async function startHqServerWithAuth(options, host, port, dataDir, firstRunAuth)
       persistence,
       auditLog,
       snapshotBroadcaster,
-      wss
+      wss,
+      ipAllowlist
     };
     httpServer.on("upgrade", (req, socket, head) => {
       handleHqUpgrade(req, socket, head, upgradeDeps);
@@ -4907,7 +4813,7 @@ async function startHqServerWithAuth(options, host, port, dataDir, firstRunAuth)
           port: actualPort,
           firstRunSetup: startupInfo
         });
-        resolve2(handle);
+        resolve(handle);
       })();
     });
   });
@@ -4926,4 +4832,4 @@ export {
   startHqServer,
   HqInsecureExposureError2 as HqInsecureExposureError
 };
-//# sourceMappingURL=chunk-C2E24IXZ.js.map
+//# sourceMappingURL=chunk-3I5ZJXM5.js.map