@wrongstack/cli 1.0.1 → 1.0.4

package/dist/{chunk-JHPXJRRI.js → chunk-4XCBEUBX.js}

@@ -129,11 +129,21 @@ function scheduleImmediateProbe(runner) {
   void runner.poke();
 }
 function buildHealthUrl(rawBase) {
-  const trimmed = rawBase.trim().replace(/\/+$/, "");
-  return `${trimmed}${HEALTH_PATH}`;
+  const trimmed = rawBase.trim();
+  try {
+    const base = new URL(trimmed);
+    base.search = "";
+    base.hash = "";
+    base.pathname = `${base.pathname.replace(/\/+$/, "")}${HEALTH_PATH}`;
+    return base.toString();
+  } catch {
+    const boundary = trimmed.search(/[?#]/);
+    const pathBase = boundary === -1 ? trimmed : trimmed.slice(0, boundary);
+    return `${pathBase.replace(/\/+$/, "")}${HEALTH_PATH}`;
+  }
 }
 
 export {
   startProxyProbe
 };
-//# sourceMappingURL=chunk-JHPXJRRI.js.map
+//# sourceMappingURL=chunk-4XCBEUBX.js.map

package/dist/{chunk-FPIWTJ2G.js → chunk-6WRKAACA.js}

@@ -67,12 +67,12 @@ var helpCmd = async (_args, deps) => {
     color.bold("Common flags"),
     "  --yolo / --no-yolo           Force auto-approval on or off at startup",
     "  --confirm-destructive         Deprecated \u2014 YOLO no longer prompts by destructiveness",
-    "  --yolo-destructive            Deprecated compatibility flag; YOLO no longer prompts by destructiveness",
+    "  --yolo-destructive           Let YOLO run every destructive kind it is allowed to (see /yolo confirm)",
     "  --tui / --no-tui             Force or disable TUI mode",
     "  --mouse                      Full mouse mode in the TUI (in-app scroll + clickable UI)",
     "  --desktop                    Open WrongStack Desktop (requires @wrongstack/desktop)",
-    "  --hq [--host <h>] [--port <n>] [--password <secret>] [--tunnel] [--open]",
-    "                               Start HQ; --tunnel publishes a temporary HTTPS URL",
+    "  --hq [--host <h>] [--port <n>] [--password <secret>] [--hq-allowlist <ip,cidr,...>] [--tunnel] [--hq-public-url <https-origin>] [--open]",
+    "                               Start HQ; publish through a temporary tunnel or persistent TLS proxy",
     "  --webui [--host <h>] [--port <n>] [--webui-token <t>] [--open]",
     "          [--webui-public-url <url>] [--webui-public-ws-url <url>] [--webui-require-token]",
     "                               Serve the browser UI + WS bridge (prints a token URL,",
@@ -93,4 +93,4 @@ export {
   versionCmd,
   helpCmd
 };
-//# sourceMappingURL=chunk-FPIWTJ2G.js.map
+//# sourceMappingURL=chunk-6WRKAACA.js.map

package/dist/chunk-AUQDGU5D.js

@@ -0,0 +1,32 @@
+
+// src/hq-server/secret-input.ts
+import * as fs from "node:fs/promises";
+import * as path from "node:path";
+var MAX_PASSWORD_FILE_BYTES = 4096;
+async function resolveHqPasswordInput(options = {}) {
+  const environment = options.environment ?? process.env;
+  const direct = options.explicitPassword ?? environment.WRONGSTACK_HQ_PASSWORD;
+  const file = environment.WRONGSTACK_HQ_PASSWORD_FILE;
+  if (direct !== void 0 && file !== void 0) {
+    throw new Error(
+      "Set only one of --password/WRONGSTACK_HQ_PASSWORD or WRONGSTACK_HQ_PASSWORD_FILE."
+    );
+  }
+  if (file === void 0) return direct;
+  if (!path.isAbsolute(file)) {
+    throw new Error("WRONGSTACK_HQ_PASSWORD_FILE must be an absolute path.");
+  }
+  const stat2 = await fs.stat(file);
+  if (!stat2.isFile()) throw new Error("WRONGSTACK_HQ_PASSWORD_FILE must point to a regular file.");
+  if (stat2.size > MAX_PASSWORD_FILE_BYTES) {
+    throw new Error(`WRONGSTACK_HQ_PASSWORD_FILE exceeds ${MAX_PASSWORD_FILE_BYTES} bytes.`);
+  }
+  const raw = await fs.readFile(file, "utf8");
+  if (raw.includes("\0")) throw new Error("WRONGSTACK_HQ_PASSWORD_FILE contains a NUL byte.");
+  return raw.replace(/\r?\n$/, "");
+}
+
+export {
+  resolveHqPasswordInput
+};
+//# sourceMappingURL=chunk-AUQDGU5D.js.map

package/dist/{chunk-D2VCUN7M.js → chunk-BIWE22O5.js}

@@ -1,9 +1,9 @@
 
 // src/subcommands/index.ts
 var loaders = {
-  acp: async () => (await import("./acp-3LARESEO.js")).acpCmd,
+  acp: async () => (await import("./acp-AB54FWM2.js")).acpCmd,
   init: async () => (await import("./init-DRMMFG2G.js")).initCmd,
-  auth: async () => (await import("./auth-ZUMCDNE5.js")).authCmd,
+  auth: async () => (await import("./auth-WDMSNZ3S.js")).authCmd,
   update: async () => (await import("./update-5DPB4YD4.js")).updateCmd,
   sessions: async () => (await import("./sessions-config-UL45XKX7.js")).sessionsCmd,
   config: async () => (await import("./sessions-config-UL45XKX7.js")).configCmd,
@@ -14,25 +14,25 @@ var loaders = {
   audit: async () => (await import("./audit-46YK5DSC.js")).auditCmd,
   tools: async () => (await import("./tools-skills-GH24UCBY.js")).toolsCmd,
   skills: async () => (await import("./tools-skills-GH24UCBY.js")).skillsCmd,
-  providers: async () => (await import("./providers-models-YVMVYWRS.js")).providersCmd,
-  models: async () => (await import("./providers-models-YVMVYWRS.js")).modelsCmd,
+  providers: async () => (await import("./providers-models-6MOGAOVK.js")).providersCmd,
+  models: async () => (await import("./providers-models-6MOGAOVK.js")).modelsCmd,
   mcp: async () => (await import("./mcp-HOMLC4WE.js")).mcpCmd,
-  plugin: async () => (await import("./plugin-usage-HFBI3TFT.js")).pluginCmd,
-  plugins: async () => (await import("./plugin-usage-HFBI3TFT.js")).pluginCmd,
-  diag: async () => (await import("./diag-doctor-7LYUYU35.js")).diagCmd,
-  doctor: async () => (await import("./diag-doctor-7LYUYU35.js")).doctorCmd,
-  "proxy-status": async () => (await import("./diag-doctor-7LYUYU35.js")).proxyCmd,
+  plugin: async () => (await import("./plugin-usage-M6KET4OZ.js")).pluginCmd,
+  plugins: async () => (await import("./plugin-usage-M6KET4OZ.js")).pluginCmd,
+  diag: async () => (await import("./diag-doctor-PCER6KHH.js")).diagCmd,
+  doctor: async () => (await import("./diag-doctor-PCER6KHH.js")).doctorCmd,
+  "proxy-status": async () => (await import("./diag-doctor-PCER6KHH.js")).proxyCmd,
   export: async () => (await import("./export-VVRIOWFV.js")).exportCmd,
-  usage: async () => (await import("./plugin-usage-HFBI3TFT.js")).usageCmd,
-  version: async () => (await import("./version-help-MYKF724O.js")).versionCmd,
-  help: async () => (await import("./version-help-MYKF724O.js")).helpCmd,
-  projects: async () => (await import("./projects-L6C6XLDY.js")).projectsCmd,
-  modeldiag: async () => (await import("./modeldiag-FMJT37SN.js")).modeldiagCmd,
+  usage: async () => (await import("./plugin-usage-M6KET4OZ.js")).usageCmd,
+  version: async () => (await import("./version-help-WXI42PZ3.js")).versionCmd,
+  help: async () => (await import("./version-help-WXI42PZ3.js")).helpCmd,
+  projects: async () => (await import("./projects-LMNAGGEU.js")).projectsCmd,
+  modeldiag: async () => (await import("./modeldiag-46CMWUNM.js")).modeldiagCmd,
   quick: async () => (await import("./quick-CNB4Z3HS.js")).quickCmd,
   bench: async () => (await import("./bench-YBU6BVQP.js")).benchCmd,
   chronicle: async () => (await import("./chronicle-UTFETHP6.js")).chronicleCmd,
-  hq: async () => (await import("./hq-IG3YRGCO.js")).hqCmd,
-  mailbox: async () => (await import("./mailbox-serve-VUCWZ2SJ.js")).mailboxServeCmd,
+  hq: async () => (await import("./hq-5XHEIIH6.js")).hqCmd,
+  mailbox: async () => (await import("./mailbox-serve-X3CR6VFW.js")).mailboxServeCmd,
   permissions: async () => (await import("./permissions-CFDLXETM.js")).permissionsCmd,
   project: async () => (await import("./project-AOQI5XTK.js")).projectCmd,
   governance: async () => (await import("./governance-RYSHV675.js")).governanceCmd
@@ -51,4 +51,4 @@ export {
   subcommands,
   subcommandNames
 };
-//# sourceMappingURL=chunk-D2VCUN7M.js.map
+//# sourceMappingURL=chunk-BIWE22O5.js.map

package/dist/{chunk-VOTTENR5.js → chunk-CDY4D5QK.js}

@@ -1,6 +1,6 @@
 import {
   startProxyProbe
-} from "./chunk-JHPXJRRI.js";
+} from "./chunk-4XCBEUBX.js";
 
 // src/wiring/proxy-wiring.ts
 import { applyProxyConfig } from "@wrongstack/core/wiring/proxy-rewrite";
@@ -53,4 +53,4 @@ export {
   bootstrapWrongProxy,
   shutdownWrongProxy
 };
-//# sourceMappingURL=chunk-VOTTENR5.js.map
+//# sourceMappingURL=chunk-CDY4D5QK.js.map

package/dist/chunk-D5GB5MHA.js

@@ -0,0 +1,87 @@
+
+// src/boot/auto-discover-providers.ts
+import * as fs from "node:fs/promises";
+import * as path from "node:path";
+import { discoverOpenAICompatibleModels, resolveDiscoveryTargets } from "@wrongstack/providers";
+async function readCache(file) {
+  try {
+    return JSON.parse(await fs.readFile(file, "utf8"));
+  } catch {
+    return {};
+  }
+}
+async function discoverAndMergeProviders(opts) {
+  const targets = resolveDiscoveryTargets(opts.config);
+  if (targets.length === 0) return;
+  const cacheFile = path.join(opts.cacheDir, "discovered-models-cache.json");
+  const cache = await readCache(cacheFile);
+  let cacheDirty = false;
+  await Promise.all(
+    targets.map(
+      async ({
+        id,
+        cfg,
+        baseUrl,
+        apiKey,
+        cacheKey,
+        modelDiscoveryPath,
+        modelDiscoveryAuthoritative
+      }) => {
+        const provider = await discoverOpenAICompatibleModels(id, {
+          baseUrl,
+          apiKey,
+          headers: cfg.headers,
+          providerName: id,
+          modelDiscoveryPath,
+          fetchImpl: opts.fetchImpl
+        });
+        if (provider) {
+          const fetchedAt = (/* @__PURE__ */ new Date()).toISOString();
+          cache[cacheKey] = { fetchedAt, provider };
+          cacheDirty = true;
+          if (modelDiscoveryAuthoritative) {
+            opts.registry.mergeOverlay(
+              { [id]: provider },
+              { observedAt: fetchedAt, authoritativeProviderIds: [id] }
+            );
+          } else {
+            opts.registry.mergeOverlay({ [id]: provider });
+          }
+          opts.logger?.info(
+            `auto-discovered ${Object.keys(provider.models).length} models for "${id}" from ${baseUrl}`
+          );
+          return;
+        }
+        const cached = cache[cacheKey];
+        if (cached) {
+          if (modelDiscoveryAuthoritative) {
+            opts.registry.mergeOverlay(
+              { [id]: cached.provider },
+              { observedAt: cached.fetchedAt, authoritativeProviderIds: [id] }
+            );
+          } else {
+            opts.registry.mergeOverlay({ [id]: cached.provider });
+          }
+          opts.logger?.warn(
+            `auto-discovery for "${id}" failed; using ${Object.keys(cached.provider.models).length} cached models from ${cached.fetchedAt}`
+          );
+        } else {
+          opts.logger?.warn(
+            `auto-discovery for "${id}" failed and no cache available (server at ${baseUrl} unreachable?)`
+          );
+        }
+      }
+    )
+  );
+  if (cacheDirty) {
+    try {
+      await fs.writeFile(cacheFile, JSON.stringify(cache), "utf8");
+    } catch {
+    }
+  }
+}
+
+export {
+  discoverAndMergeProviders
+};
+//# sourceMappingURL=chunk-D5GB5MHA.js.map

package/dist/chunk-DAKVBMD4.js

@@ -0,0 +1,36 @@
+
+// src/auth-menu/loopback-server.ts
+import { spawn } from "node:child_process";
+import {
+  startLoopbackServer as startSharedLoopbackServer
+} from "@wrongstack/providers/oauth";
+import { callbackHtml } from "@wrongstack/providers/oauth";
+var URL_METACHAR_REGEX = /[&|;<>(){}^"'`%\n\r\0]/;
+function isSafeBrowserUrl(url) {
+  if (URL_METACHAR_REGEX.test(url)) return false;
+  try {
+    const parsed = new URL(url);
+    return parsed.protocol === "http:" || parsed.protocol === "https:";
+  } catch {
+    return false;
+  }
+}
+function openBrowser(url) {
+  if (!isSafeBrowserUrl(url)) {
+    return;
+  }
+  try {
+    const platform = process.platform;
+    const { command, args } = platform === "win32" ? { command: "cmd", args: ["/c", "start", "", url] } : platform === "darwin" ? { command: "open", args: [url] } : { command: "xdg-open", args: [url] };
+    const child = spawn(command, args, { stdio: "ignore", windowsHide: true });
+    child.on("error", () => {
+    });
+    child.unref();
+  } catch {
+  }
+}
+
+export {
+  openBrowser
+};
+//# sourceMappingURL=chunk-DAKVBMD4.js.map

package/dist/{chunk-E6RFXHWD.js → chunk-EK2P53GL.js}

@@ -12,7 +12,6 @@ var BOOLEAN_FLAGS = /* @__PURE__ */ new Set([
   "version",
   "yes",
   "no-banner",
-  "no-features",
   "tui",
   "no-tui",
   // Recovery switches. `--recover` reopens the most recent session with no
@@ -64,6 +63,8 @@ var BOOLEAN_FLAGS = /* @__PURE__ */ new Set([
   "pnpm",
   "yarn",
   "bun",
+  // `wstack hq service install` toggles.
+  "no-auto-update",
   // `wstack acp` booleans. Without these, parseArgs treats the value after
   // `--fs`/`--echo` as the flag's value and eats a following positional
   // (e.g. the agent list in `acp bench --fs gemini-cli,codex-cli`).
@@ -237,4 +238,4 @@ export {
   parseAuthFlags,
   parseSpawnFlags
 };
-//# sourceMappingURL=chunk-E6RFXHWD.js.map
+//# sourceMappingURL=chunk-EK2P53GL.js.map

package/dist/chunk-I7V2OYVH.js

@@ -0,0 +1,242 @@
+
+// src/hq-server/audit-actor.ts
+import * as os from "node:os";
+function resolveAuditActor() {
+  const user = (process.env.USERNAME ?? process.env.USER ?? "").toString();
+  try {
+    const host = os.hostname();
+    return user ? `${user}@${host}` : `cli@${host}`;
+  } catch {
+    return user ? `${user}@unknown` : "cli";
+  }
+}
+
+// src/hq-server/utils.ts
+import * as fs from "node:fs/promises";
+import * as os2 from "node:os";
+import * as path from "node:path";
+import { resolveHqDataDir } from "@wrongstack/core/hq";
+import { sanitizeApiError, scrubErrorDetail } from "@wrongstack/core/security";
+var TRANSCRIPT_RING_MAX = 4e3;
+var MAX_TRANSCRIPT_SESSIONS = 400;
+var MAX_AGENT_RINGS = 800;
+function evictOldest(map, max) {
+  while (map.size > max) {
+    const oldest = map.keys().next().value;
+    if (oldest === void 0) break;
+    map.delete(oldest);
+  }
+}
+function agentRingKey(sessionId, subId) {
+  return sessionId ? `${sessionId}::${subId}` : subId;
+}
+function agentMessageToEntry(p) {
+  const kind = typeof p["kind"] === "string" ? p["kind"] : "text";
+  const role = kind === "thinking" ? "thinking" : kind === "tool_use" || kind === "tool_result" ? "tool" : kind === "error" ? "error" : kind === "status" || kind === "system" ? "system" : "assistant";
+  return {
+    ts: typeof p["ts"] === "string" ? p["ts"] : (/* @__PURE__ */ new Date()).toISOString(),
+    role,
+    text: typeof p["content"] === "string" ? p["content"] : "",
+    ...typeof p["toolName"] === "string" ? { tool: p["toolName"] } : {},
+    ...kind === "error" ? { isError: true } : {}
+  };
+}
+async function readLocalSubagentTranscript(sessionId, subagentId) {
+  try {
+    const { getSessionRegistry } = await import("@wrongstack/core/storage");
+    const { resolveWstackPaths, sessionScopedPath } = await import("@wrongstack/core/utils");
+    const globalRoot = path.dirname(resolveHqDataDir());
+    const registry = getSessionRegistry(globalRoot);
+    const entry = await registry.get(sessionId).catch(() => null);
+    if (!entry) return null;
+    const paths = resolveWstackPaths({ projectRoot: entry.projectRoot, globalRoot });
+    const sessionDir = sessionScopedPath(paths.projectSessions, sessionId, "");
+    if (!isSafePathSegment(subagentId)) return null;
+    const transcriptsRoot = path.resolve(sessionDir, "subagents", "transcripts");
+    const file = path.resolve(transcriptsRoot, subagentId, "transcript.jsonl");
+    if (!file.startsWith(transcriptsRoot + path.sep)) return null;
+    const raw = await fs.readFile(file, "utf8").catch(() => null);
+    if (raw === null) return null;
+    const out = [];
+    for (const line of raw.split("\n")) {
+      const trimmed = line.trim();
+      if (trimmed.length === 0) continue;
+      try {
+        out.push(agentMessageToEntry(JSON.parse(trimmed)));
+      } catch {
+      }
+    }
+    return out;
+  } catch {
+    return null;
+  }
+}
+function decodePathSegment(value) {
+  let decoded;
+  try {
+    decoded = decodeURIComponent(value);
+  } catch {
+    return null;
+  }
+  return isSafePathSegment(decoded) ? decoded : null;
+}
+function decodeSessionId(value) {
+  let decoded;
+  try {
+    decoded = decodeURIComponent(value);
+  } catch {
+    return null;
+  }
+  return isSafeSessionId(decoded) ? decoded : null;
+}
+var MAX_PATH_SEGMENT_LENGTH = 256;
+function isSafePathSegment(value) {
+  if (value.length === 0 || value.length > MAX_PATH_SEGMENT_LENGTH) return false;
+  if (value === "." || value === "..") return false;
+  if (value.includes("/") || value.includes("\\")) return false;
+  if (value.includes("\0")) return false;
+  if (value.includes(":")) return false;
+  return true;
+}
+function isSafeSessionId(value) {
+  if (value.length === 0 || value.length > MAX_PATH_SEGMENT_LENGTH) return false;
+  if (value.includes("\\") || value.includes("\0") || value.includes(":")) return false;
+  const parts = value.split("/");
+  if (parts.length > 2) return false;
+  return parts.every((p) => p.length > 0 && p !== "." && p !== "..");
+}
+function displayHost(host) {
+  return host === "0.0.0.0" ? "127.0.0.1" : host;
+}
+var RequestBodyTooLargeError = class extends Error {
+};
+function readRequestBody(req, maxBytes = 1e6) {
+  return new Promise((resolve2, reject) => {
+    const chunks = [];
+    let size = 0;
+    let settled = false;
+    req.on("data", (chunk) => {
+      if (settled) return;
+      size += chunk.length;
+      if (size > maxBytes) {
+        settled = true;
+        chunks.length = 0;
+        reject(new RequestBodyTooLargeError("request body too large"));
+        return;
+      }
+      chunks.push(chunk);
+    });
+    req.on("end", () => {
+      if (!settled) resolve2(Buffer.concat(chunks).toString("utf8"));
+    });
+    req.on("error", (error) => {
+      if (!settled) reject(error);
+    });
+  });
+}
+function writeInvalidBody(res, error) {
+  const tooLarge = error instanceof RequestBodyTooLargeError;
+  res.writeHead(tooLarge ? 413 : 400, { "Content-Type": "application/json" });
+  res.end(JSON.stringify({ error: tooLarge ? "request body too large" : "invalid json body" }));
+}
+function buildHttpUrl(host, port, token) {
+  const url = new URL(`http://${displayHost(host)}:${port}/`);
+  if (token) url.searchParams.set("token", token);
+  return url.toString();
+}
+function buildBootstrapHttpUrl(host, port, bootstrapCode) {
+  const url = new URL(`http://${displayHost(host)}:${port}/`);
+  url.hash = `bootstrap=${bootstrapCode}`;
+  return url.toString();
+}
+function buildClientWsUrl(host, port, token) {
+  const url = new URL(`ws://${displayHost(host)}:${port}/ws/client`);
+  if (token) url.searchParams.set("token", token);
+  return url.toString();
+}
+function normalizeHqPublicOrigin(value) {
+  const parsed = new URL(value.trim());
+  if (parsed.protocol !== "https:" || parsed.username !== "" || parsed.password !== "" || parsed.pathname !== "" && parsed.pathname !== "/" || parsed.search !== "" || parsed.hash !== "") {
+    throw new TypeError(
+      "HQ public URL must be an exact HTTPS origin without a path or credentials."
+    );
+  }
+  return parsed.origin;
+}
+function hqRuntimeMarkerPath(dataDir) {
+  return path.join(dataDir, "runtime.json");
+}
+function lanIPv4Addresses() {
+  const out = [];
+  try {
+    const ifaces = os2.networkInterfaces();
+    for (const name of Object.keys(ifaces)) {
+      for (const ni of ifaces[name] ?? []) {
+        if (ni.family === "IPv4" && !ni.internal) out.push(ni.address);
+      }
+    }
+  } catch {
+  }
+  return out;
+}
+function truncateHqSummary(value, maxLength) {
+  if (typeof value !== "string" || value.length === 0) return void 0;
+  if (value.length <= maxLength) return value;
+  const suffix = `\u2026[truncated:${value.length - maxLength}]`;
+  if (maxLength <= suffix.length) return "\u2026";
+  const prefixLen = maxLength - suffix.length;
+  return `${value.slice(0, prefixLen)}${suffix}`;
+}
+function hqMachineKey(hostname2, machineId) {
+  const hn = hostname2?.trim();
+  return hn ? `host:${hn.toLowerCase()}` : `mid:${machineId || "local"}`;
+}
+function recordTimeseriesSignal(persistence, event) {
+  try {
+    if (event.type === "session.usage") {
+      const p = event.payload;
+      persistence.timeseries.record({
+        ts: Date.parse(event.timestamp) || Date.now(),
+        ...typeof p.costUsd === "number" ? { costUsd: p.costUsd } : {},
+        ...typeof p.inputTokens === "number" ? { inputTokens: p.inputTokens } : {},
+        ...typeof p.outputTokens === "number" ? { outputTokens: p.outputTokens } : {},
+        ...typeof p.model === "string" && p.model.length > 0 ? { model: p.model } : {},
+        ...typeof p.provider === "string" && p.provider.length > 0 ? { provider: p.provider } : {},
+        ...typeof p.cacheRead === "number" ? { cacheRead: p.cacheRead } : {},
+        ...typeof p.cacheWrite === "number" ? { cacheWrite: p.cacheWrite } : {}
+      });
+    } else if (event.type === "tool.completed") {
+      persistence.timeseries.record({
+        ts: Date.parse(event.timestamp) || Date.now(),
+        toolCalls: 1
+      });
+    }
+  } catch {
+  }
+}
+
+export {
+  resolveAuditActor,
+  TRANSCRIPT_RING_MAX,
+  MAX_TRANSCRIPT_SESSIONS,
+  MAX_AGENT_RINGS,
+  evictOldest,
+  agentRingKey,
+  agentMessageToEntry,
+  readLocalSubagentTranscript,
+  decodePathSegment,
+  decodeSessionId,
+  readRequestBody,
+  writeInvalidBody,
+  buildHttpUrl,
+  buildBootstrapHttpUrl,
+  buildClientWsUrl,
+  normalizeHqPublicOrigin,
+  hqRuntimeMarkerPath,
+  lanIPv4Addresses,
+  truncateHqSummary,
+  hqMachineKey,
+  recordTimeseriesSignal,
+  sanitizeApiError
+};
+//# sourceMappingURL=chunk-I7V2OYVH.js.map

package/dist/{chunk-MXEJEYT7.js → chunk-JX6KL7OF.js}

@@ -1043,9 +1043,9 @@ var helpTable = {
   // -- HQ (dashboard server) ──────────────────────────────────────────
   hq: {
     name: "hq",
-    title: "wstack hq \u2014 start HQ command center or manage tokens",
-    description: "Start the HQ server \u2014 a web dashboard for monitoring sessions, fleet status, and agent activity across projects \u2014 or manage browser and client authentication tokens.",
-    usage: "wstack hq [serve] [--port <n>] [--password <secret>] [--tunnel] [--open] | wstack hq token [create|list|revoke]",
+    title: "wstack hq \u2014 serve HQ, manage authentication, or install its system service",
+    description: "Start the HQ server \u2014 a web dashboard for monitoring sessions, fleet status, and agent activity across projects; manage browser/client authentication, or install the persistent Ubuntu systemd service.",
+    usage: "wstack hq [serve] [...] | wstack hq token [create|list|revoke] | wstack hq service [install|status|update|uninstall]",
     subcommands: [
       { name: "serve", description: "Start the HQ dashboard server (default)." },
       {
@@ -1053,7 +1053,17 @@ var helpTable = {
         description: "Mint a browser or client authentication token."
       },
       { name: "token list", description: "List active HQ authentication tokens." },
-      { name: "token revoke <id>", description: "Revoke an issued HQ authentication token." }
+      { name: "token revoke <id>", description: "Revoke an issued HQ authentication token." },
+      {
+        name: "service install",
+        description: "Install an always-on systemd service and guarded automatic updater."
+      },
+      { name: "service status", description: "Inspect the HQ service and update timer." },
+      { name: "service update", description: "Run the guarded update job immediately." },
+      {
+        name: "service uninstall",
+        description: "Remove systemd units while preserving HQ data and secrets."
+      }
     ],
     seeAlso: "wstack sessions fleet (CLI equivalent for fleet status)"
   },
@@ -1202,4 +1212,4 @@ export {
   subcommandsWithFocusedHelp,
   renderGenericHelp
 };
-//# sourceMappingURL=chunk-MXEJEYT7.js.map
+//# sourceMappingURL=chunk-JX6KL7OF.js.map