@wrongstack/cli 1.0.1 → 1.0.4

package/dist/chunk-Q7E3BPDU.js

@@ -0,0 +1,62 @@
+
+// src/hq-server/ip-allowlist.ts
+import { BlockList, isIP } from "node:net";
+function normalizeAddress(value) {
+  return value.trim().replace(/^\[(.*)\]$/, "$1").replace(/^::ffff:/i, "");
+}
+function addRule(blockList, rawRule) {
+  const rule = rawRule.trim();
+  if (!rule) throw new TypeError("HQ IP allowlist contains an empty entry.");
+  const slash = rule.lastIndexOf("/");
+  if (slash === -1) {
+    const address2 = normalizeAddress(rule);
+    const family2 = isIP(address2);
+    if (family2 === 0) {
+      throw new TypeError(`Invalid HQ allowlist address: ${rule}`);
+    }
+    blockList.addAddress(address2, family2 === 4 ? "ipv4" : "ipv6");
+    return address2;
+  }
+  const address = normalizeAddress(rule.slice(0, slash));
+  const prefixText = rule.slice(slash + 1);
+  const family = isIP(address);
+  if (family === 0 || !/^\d+$/.test(prefixText)) {
+    throw new TypeError(`Invalid HQ allowlist network: ${rule}`);
+  }
+  const prefix = Number(prefixText);
+  const maximum = family === 4 ? 32 : 128;
+  if (!Number.isSafeInteger(prefix) || prefix < 0 || prefix > maximum) {
+    throw new TypeError(`Invalid HQ allowlist prefix: ${rule}`);
+  }
+  blockList.addSubnet(address, prefix, family === 4 ? "ipv4" : "ipv6");
+  return `${address}/${prefix}`;
+}
+function createHqIpAllowlist(rules) {
+  if (rules === void 0 || rules.length === 0) return void 0;
+  const blockList = new BlockList();
+  blockList.addSubnet("127.0.0.0", 8, "ipv4");
+  blockList.addAddress("::1", "ipv6");
+  const entries = [...new Set(rules.map((rule) => addRule(blockList, rule)))];
+  return {
+    entries,
+    allows(address) {
+      if (!address) return false;
+      const normalized = normalizeAddress(address);
+      const family = isIP(normalized);
+      if (family === 0) return false;
+      return blockList.check(normalized, family === 4 ? "ipv4" : "ipv6");
+    }
+  };
+}
+function parseHqIpAllowlist(value) {
+  if (value === void 0 || value.trim() === "") return void 0;
+  const rules = value.split(",").map((entry) => entry.trim());
+  createHqIpAllowlist(rules);
+  return rules;
+}
+
+export {
+  createHqIpAllowlist,
+  parseHqIpAllowlist
+};
+//# sourceMappingURL=chunk-Q7E3BPDU.js.map

package/dist/chunk-SIGUWXAA.js

@@ -0,0 +1,43 @@
+
+// src/auth-menu/openai-codex-oauth.ts
+import { color } from "@wrongstack/core/utils";
+import {
+  buildCodexAuthorizeUrl,
+  CODEX_BASE_URL,
+  CODEX_FALLBACK_REDIRECT_PORT,
+  CODEX_PROVIDER_ID,
+  CODEX_REDIRECT_HOST,
+  CODEX_REDIRECT_PATH,
+  CODEX_REDIRECT_PORT,
+  CODEX_SCOPE,
+  codexRedirectUri,
+  createState,
+  exchangeCodexAuthorizationCode,
+  extractAccountId,
+  generatePkce,
+  parseAuthorizationInput,
+  refreshCodexTokens,
+  resolveCodexModels
+} from "@wrongstack/providers/oauth";
+import {
+  CODEX_BASE_URL as CODEX_BASE_URL2,
+  CODEX_CATALOG_FAMILIES,
+  CODEX_PROVIDER_ID as CODEX_PROVIDER_ID2,
+  extractAccountId as extractAccountId2,
+  FALLBACK_CODEX_MODELS,
+  fallbackCodexModelIds,
+  fallbackCodexProviderModels,
+  fetchCodexModels,
+  filterCurrentCodexModelIds,
+  generatePkce as generatePkce2,
+  isCodexCatalogModel,
+  parseAuthorizationInput as parseAuthorizationInput2,
+  resolveCodexModels as resolveCodexModels2
+} from "@wrongstack/providers/oauth";
+
+export {
+  fallbackCodexProviderModels,
+  filterCurrentCodexModelIds,
+  isCodexCatalogModel
+};
+//# sourceMappingURL=chunk-SIGUWXAA.js.map

package/dist/{chunk-TEBMCYZN.js → chunk-SIS37L3W.js}

@@ -13,6 +13,10 @@ import {
   resolvePluginTarget,
   verifyPluginTrust
 } from "@wrongstack/core/plugin";
+import { createHash } from "node:crypto";
+import { readdir, stat } from "node:fs/promises";
+import { basename, dirname, relative, sep } from "node:path";
+import { readFile } from "node:fs/promises";
 function resolveExternalPluginTrustMode(raw) {
   if (raw === false) return "off";
   if (raw === "required") return "required";
@@ -228,7 +232,7 @@ async function gateExternalPluginTrust(args) {
   if (!store) return { ok: true, pinned: false };
   let integrity;
   try {
-    integrity = await hashFileContents(entryPath);
+    integrity = await hashPluginClosure(entryPath);
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
     if (mode === "required") {
@@ -271,6 +275,58 @@ async function gateExternalPluginTrust(args) {
   log.error(`[plugins] REFUSING external plugin "${label}" \u2014 ${changedMessage}`);
   return { ok: false, pinned: false };
 }
+var CLOSURE_HASH_LIMIT = 2e3;
+var CLOSURE_FILE_LIMIT = 16 * 1024 * 1024;
+async function hashPluginClosure(entryPath) {
+  const dir = dirname(entryPath);
+  let dirStat;
+  try {
+    dirStat = await stat(dir);
+  } catch {
+    return hashFileContents(entryPath);
+  }
+  if (!dirStat.isDirectory()) return hashFileContents(entryPath);
+  const entryBase = basename(entryPath);
+  const files = [];
+  async function walk(d) {
+    if (files.length > CLOSURE_HASH_LIMIT) return;
+    const entries = await readdir(d, { withFileTypes: true }).catch(() => []);
+    for (const e of entries) {
+      const full = d + sep + e.name;
+      if (e.isDirectory()) {
+        if (e.name === "node_modules" || e.name.startsWith(".")) continue;
+        await walk(full);
+      } else if (e.isFile()) {
+        files.push(full);
+      }
+    }
+  }
+  await walk(dir);
+  files.sort();
+  const manifest = [];
+  for (const full of files) {
+    const rel = relative(dir, full).split(sep).join("/");
+    let bytes;
+    try {
+      const st = await stat(full);
+      if (!st.isFile() || st.size > CLOSURE_FILE_LIMIT) continue;
+      bytes = await readFile(full);
+    } catch {
+      continue;
+    }
+    const sha = createHash("sha256").update(bytes).digest("hex");
+    manifest.push(`${rel}\0${bytes.length}\0${sha}`);
+  }
+  if (!manifest.some((line) => line.startsWith(`${entryBase}\0`))) {
+    const entryBytes = await readFile(entryPath);
+    const entrySha = createHash("sha256").update(entryBytes).digest("hex");
+    manifest.push(`${entryBase}\0${entryBytes.length}\0${entrySha}`);
+  }
+  manifest.sort();
+  const outer = createHash("sha256");
+  outer.update(manifest.join("\n"));
+  return outer.digest("hex");
+}
 
 // src/plugin-management.ts
 import { execFile } from "node:child_process";
@@ -1035,4 +1091,4 @@ export {
   PLUGIN_AUDIT_ENTRIES,
   runPluginManagementCommand
 };
-//# sourceMappingURL=chunk-TEBMCYZN.js.map
+//# sourceMappingURL=chunk-SIS37L3W.js.map

package/dist/{chunk-KHWDTNBZ.js → chunk-U6PGWDMZ.js}

@@ -1,10 +1,10 @@
 import {
   helpCmd,
   versionCmd
-} from "./chunk-FPIWTJ2G.js";
+} from "./chunk-6WRKAACA.js";
 import {
   parseArgs
-} from "./chunk-E6RFXHWD.js";
+} from "./chunk-EK2P53GL.js";
 
 // src/boot/short-circuit-flags.ts
 async function handleHelpVersionShortCircuit(argv) {
@@ -22,11 +22,11 @@ async function handleHelpVersionShortCircuit(argv) {
   }
   if (earlyFlags["help"] === true) {
     if (positional.length > 0) {
-      const { subcommandNames } = await import("./subcommands-WJLBHVKC.js");
+      const { subcommandNames } = await import("./subcommands-7N4RIK6H.js");
       if (subcommandNames.includes(positional[0])) {
         const first = positional[0];
         const deep = positional[1];
-        const { renderDeepHelp, renderFocusedHelp } = await import("./per-subcommand-help-BWBHYVJO.js");
+        const { renderDeepHelp, renderFocusedHelp } = await import("./per-subcommand-help-DHTYU524.js");
         if (deep && renderDeepHelp(`${first}:${deep}`, stubRenderer)) {
           return 0;
         }
@@ -43,4 +43,4 @@ async function handleHelpVersionShortCircuit(argv) {
 export {
   handleHelpVersionShortCircuit
 };
-//# sourceMappingURL=chunk-KHWDTNBZ.js.map
+//# sourceMappingURL=chunk-U6PGWDMZ.js.map

package/dist/{chunk-5IA5337I.js → chunk-XJ7K67PP.js}

@@ -4,7 +4,7 @@ import {
 import {
   PLUGIN_AUDIT_ENTRIES,
   loadExternalPlugins
-} from "./chunk-TEBMCYZN.js";
+} from "./chunk-SIS37L3W.js";
 
 // src/wiring/plugins.ts
 import { join } from "node:path";
@@ -80,6 +80,10 @@ var BUILTIN_PLUGIN_FACTORIES = [
     const { createAutoReviewPlugin } = await import("@wrongstack/core/plugin");
     return createAutoReviewPlugin();
   },
+  async () => {
+    const { createSpecialistTriggerPlugin } = await import("@wrongstack/core/plugin");
+    return createSpecialistTriggerPlugin();
+  },
   async () => {
     const { createSkillsPlugin } = await import("@wrongstack/core/plugin");
     return createSkillsPlugin();
@@ -98,6 +102,7 @@ async function setupPlugins(params) {
     events,
     toolRegistry,
     providerRegistry,
+    providerAuthRegistry,
     slashCommandRegistry,
     mcpRegistry,
     log,
@@ -207,6 +212,7 @@ async function setupPlugins(params) {
       pipelines,
       toolRegistry,
       providerRegistry,
+      providerAuthRegistry,
       slashCommandRegistry,
       mcpRegistry,
       config: pluginConfig,
@@ -261,4 +267,4 @@ export {
   BUILTIN_PLUGIN_FACTORIES,
   setupPlugins
 };
-//# sourceMappingURL=chunk-5IA5337I.js.map
+//# sourceMappingURL=chunk-XJ7K67PP.js.map

package/dist/{cli-context-7X3M6U73.js → cli-context-WFC3BNGM.js}

@@ -9,38 +9,46 @@ import {
 import {
   theme as theme2
 } from "./chunk-QD544J2B.js";
-import {
-  parseWebuiSessionChildOptions,
-  writeWebuiSessionChildError
-} from "./chunk-GPPRNAKW.js";
 import {
   fmtTok,
   patchConfig
 } from "./chunk-EWKESL4L.js";
+import {
+  parseWebuiSessionChildOptions,
+  writeWebuiSessionChildError
+} from "./chunk-GPPRNAKW.js";
 import {
   subcommands
-} from "./chunk-D2VCUN7M.js";
+} from "./chunk-BIWE22O5.js";
 import {
   renderDeepHelp,
   renderFocusedHelp
-} from "./chunk-MXEJEYT7.js";
+} from "./chunk-JX6KL7OF.js";
 import {
   handleHelpVersionShortCircuit
-} from "./chunk-KHWDTNBZ.js";
+} from "./chunk-U6PGWDMZ.js";
 import {
   DEFAULT_PORT
-} from "./chunk-C2E24IXZ.js";
+} from "./chunk-3I5ZJXM5.js";
 import "./chunk-HXJYHAR4.js";
-import "./chunk-Q5GTM25S.js";
+import {
+  resolveHqPasswordInput
+} from "./chunk-AUQDGU5D.js";
+import {
+  normalizeHqPublicOrigin
+} from "./chunk-I7V2OYVH.js";
+import {
+  parseHqIpAllowlist
+} from "./chunk-Q7E3BPDU.js";
 import {
   discoverAndMergeProviders
-} from "./chunk-52C7PD2H.js";
+} from "./chunk-D5GB5MHA.js";
 import {
   applyNodeEnvDefault,
   applySessionShellDefault,
   runPreflight
 } from "./chunk-O4A3HHKD.js";
-import "./chunk-FPIWTJ2G.js";
+import "./chunk-6WRKAACA.js";
 import {
   CLI_VERSION
 } from "./chunk-XJXDOF63.js";
@@ -55,7 +63,7 @@ import {
   runPicker,
   saveToGlobalConfig,
   theme
-} from "./chunk-MNQQ4ZNF.js";
+} from "./chunk-ONOT5OJ2.js";
 import "./chunk-2VMJ3E5Z.js";
 import "./chunk-B4JLSXZB.js";
 import {
@@ -67,8 +75,8 @@ import {
 } from "./chunk-YMXXOOFN.js";
 import {
   parseArgs
-} from "./chunk-E6RFXHWD.js";
-import "./chunk-TNK6237M.js";
+} from "./chunk-EK2P53GL.js";
+import "./chunk-DAKVBMD4.js";
 import {
   mutateConfigProviders,
   normalizeKeys,
@@ -84,7 +92,7 @@ import "./chunk-YLQEGYV4.js";
 // src/cli-context.ts
 import { TOKENS as TOKENS3 } from "@wrongstack/core/kernel";
 import { writeErr as writeErr2 } from "@wrongstack/core/utils";
-import { setOAuthTokenPersister } from "@wrongstack/providers";
+import { setOAuthTokenPersister, setProviderModelPersister } from "@wrongstack/providers";
 
 // src/boot/container-wiring.ts
 import { DefaultPathResolver } from "@wrongstack/core/infrastructure";
@@ -760,9 +768,13 @@ import {
   resolveHqDataDir
 } from "@wrongstack/core/hq";
 import { color as color3, isPidAlive } from "@wrongstack/core/utils";
+function isReusedContainerPid(markerPid, containerMode, currentPid = process.pid) {
+  return containerMode === "1" && markerPid === currentPid;
+}
 async function isHqAlreadyRunning(dataDir) {
   const marker = readHqRuntimeFileSync(dataDir);
   if (!marker) return null;
+  if (isReusedContainerPid(marker.pid, process.env.WRONGSTACK_HQ_CONTAINER)) return null;
   if (marker.pid && isPidAlive(marker.pid)) return marker;
   return null;
 }
@@ -784,12 +796,31 @@ async function isPortInUse(host, port) {
 }
 async function handleHqShortCircuit(flags) {
   if (flags["hq"] !== true) return null;
-  const { startHqServer } = await import("./hq-server-OILU3NPI.js");
+  const { startHqServer } = await import("./hq-server-CNUTBWTK.js");
   const tunnelRequested = flags["tunnel"] === true;
-  const host = typeof flags["host"] === "string" ? flags["host"] : tunnelRequested ? "127.0.0.1" : HQ_CLI_DEFAULT_HOST2;
-  if (tunnelRequested && !isLoopbackHost(host)) {
+  const rawPublicUrl = typeof flags["hq-public-url"] === "string" ? flags["hq-public-url"] : process.env.WRONGSTACK_HQ_PUBLIC_URL;
+  let publicOrigin;
+  if (rawPublicUrl !== void 0 && rawPublicUrl.trim() !== "") {
+    try {
+      publicOrigin = normalizeHqPublicOrigin(rawPublicUrl);
+    } catch (cause) {
+      process.stderr.write(
+        `${color3.red("\u2717")} ${cause instanceof Error ? cause.message : String(cause)}
+`
+      );
+      return 1;
+    }
+  }
+  if (tunnelRequested && publicOrigin !== void 0) {
+    process.stderr.write(`${color3.red("\u2717")} Use either --tunnel or --hq-public-url, not both.
+`);
+    return 1;
+  }
+  const externallyPublished = tunnelRequested || publicOrigin !== void 0;
+  const host = typeof flags["host"] === "string" ? flags["host"] : externallyPublished ? "127.0.0.1" : HQ_CLI_DEFAULT_HOST2;
+  if (externallyPublished && !isLoopbackHost(host)) {
     process.stderr.write(
-      `${color3.red("\u2717")} --tunnel requires a loopback origin. Remove --host or use --host 127.0.0.1.
+      `${color3.red("\u2717")} Public HQ publishing requires a loopback bind. Remove --host or use --host 127.0.0.1.
 `
     );
     return 1;
@@ -806,12 +837,51 @@ async function handleHqShortCircuit(flags) {
     }
   } else port = DEFAULT_PORT;
   const dataDir = typeof flags["data-dir"] === "string" ? flags["data-dir"] : void 0;
-  const password = typeof flags["password"] === "string" ? flags["password"] : process.env.WRONGSTACK_HQ_PASSWORD;
+  let password;
+  try {
+    password = await resolveHqPasswordInput({
+      ...typeof flags["password"] === "string" ? { explicitPassword: flags["password"] } : {}
+    });
+  } catch (cause) {
+    process.stderr.write(
+      `${color3.red("\u2717")} ${cause instanceof Error ? cause.message : String(cause)}
+`
+    );
+    return 1;
+  }
+  const bootstrapPasswordOnly = /^(?:1|true)$/i.test(
+    process.env.WRONGSTACK_HQ_BOOTSTRAP_PASSWORD_ONLY?.trim() ?? ""
+  );
+  let ipAllowlist;
+  try {
+    ipAllowlist = parseHqIpAllowlist(
+      typeof flags["hq-allowlist"] === "string" ? flags["hq-allowlist"] : process.env.WRONGSTACK_HQ_ALLOWLIST
+    );
+  } catch (cause) {
+    process.stderr.write(
+      `${color3.red("\u2717")} ${cause instanceof Error ? cause.message : String(cause)}
+`
+    );
+    return 1;
+  }
   if (password !== void 0 && password.length < 8) {
     process.stderr.write(`${color3.red("\u2717")} HQ password must be at least 8 characters.
 `);
     return 1;
   }
+  const rawTrustedProxyHops = typeof flags["hq-trusted-proxy-hops"] === "string" ? flags["hq-trusted-proxy-hops"] : process.env.WRONGSTACK_HQ_TRUSTED_PROXY_HOPS;
+  let trustedProxyHops;
+  if (rawTrustedProxyHops !== void 0 && rawTrustedProxyHops.trim() !== "") {
+    const parsed = Number.parseInt(rawTrustedProxyHops, 10);
+    if (!Number.isFinite(parsed) || parsed < 0 || String(parsed) !== rawTrustedProxyHops.trim()) {
+      process.stderr.write(
+        `${color3.red("\u2717")} --hq-trusted-proxy-hops must be a non-negative integer.
+`
+      );
+      return 1;
+    }
+    trustedProxyHops = parsed;
+  }
   const userProvidedPort = typeof flags["port"] === "string" && flags["port"].trim() !== "" || port !== DEFAULT_PORT;
   const resolvedDataDir = dataDir ?? resolveHqDataDir();
   const existing = await isHqAlreadyRunning(resolvedDataDir);
@@ -849,11 +919,14 @@ async function handleHqShortCircuit(flags) {
       strictPort: flags["strict-port"] === true,
       exactPort: userProvidedPort,
       allowInsecureOpen: flags["insecure-open"] === true,
-      secureCookies: tunnelRequested,
-      requireBrowserAuth: tunnelRequested,
+      secureCookies: externallyPublished,
+      requireBrowserAuth: externallyPublished,
       ...dataDir !== void 0 ? { dataDir } : {},
       ...password !== void 0 ? { password } : {},
-      ...tokenTtlMs !== void 0 ? { tokenTtlMs } : {}
+      ...bootstrapPasswordOnly ? { bootstrapPasswordOnly: true } : {},
+      ...tokenTtlMs !== void 0 ? { tokenTtlMs } : {},
+      ...trustedProxyHops !== void 0 ? { trustedProxyHops } : {},
+      ...ipAllowlist !== void 0 ? { ipAllowlist } : {}
     });
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
@@ -868,8 +941,24 @@ async function handleHqShortCircuit(flags) {
     }
     return 1;
   }
+  if (publicOrigin !== void 0) {
+    if (handle.firstRunSetup?.passwordMode !== true) {
+      await handle.close();
+      process.stderr.write(
+        `${color3.red("\u2717")} Persistent public HQ requires password mode. Set WRONGSTACK_HQ_PASSWORD and retry.
+`
+      );
+      return 1;
+    }
+    handle.trustPublicOrigin(publicOrigin);
+    process.stdout.write(`
+${color3.green("Persistent HQ origin ready:")} ${publicOrigin}/
+`);
+    process.stdout.write(`${color3.green("Mobile:")} ${publicOrigin}/mobile
+`);
+  }
   let tunnel;
-  let browserUrl = handle.firstRunSetup?.browserUrl ?? `http://${handle.host}:${handle.port}`;
+  let browserUrl = publicOrigin ?? handle.firstRunSetup?.browserUrl ?? `http://${handle.host}:${handle.port}`;
   if (tunnelRequested) {
     if (handle.firstRunSetup !== void 0 && !handle.firstRunSetup.browserTokenMode && !handle.firstRunSetup.passwordMode) {
       await handle.close();
@@ -894,6 +983,12 @@ async function handleHqShortCircuit(flags) {
       );
       process.stdout.write(`
 ${color3.green("Cloudflare Quick Tunnel ready:")} ${browserUrl}
+`);
+      const tunnelMobileUrl = new URL(tunnel.url);
+      tunnelMobileUrl.pathname = "/mobile";
+      tunnelMobileUrl.search = "";
+      tunnelMobileUrl.hash = "";
+      process.stdout.write(`${color3.green("Mobile:")} ${tunnelMobileUrl.toString()}
 `);
       process.stdout.write(
         `${color3.dim("Temporary development URL; DNS may need a few seconds, it changes on restart and ends when HQ stops.")}
@@ -3095,6 +3190,17 @@ async function initializeCli(argv) {
     }).catch(() => {
     });
   });
+  setProviderModelPersister((providerId, models) => {
+    if (models.length === 0) return;
+    void mutateConfigProviders(profileConfigPath, vault, (all) => {
+      const p = all[providerId];
+      if (!p) return;
+      const live = models.map((m) => m.id);
+      if (p.models?.length === live.length && p.models.every((id, i) => id === live[i])) return;
+      p.models = live;
+    }).catch(() => {
+    });
+  });
   const { events, container } = wireContainer({
     config,
     wpaths,
@@ -3117,4 +3223,4 @@ async function initializeCli(argv) {
 export {
   initializeCli
 };
-//# sourceMappingURL=cli-context-7X3M6U73.js.map
+//# sourceMappingURL=cli-context-WFC3BNGM.js.map