@wrongstack/cli 1.0.10 → 1.0.12

package/dist/{chunk-7FPN3QTH.js → chunk-YRC3I3LE.js}

@@ -33,7 +33,7 @@ import {
 import { randomUUID as randomUUID6 } from "node:crypto";
 import * as fs4 from "node:fs/promises";
 import * as http from "node:http";
-import * as path6 from "node:path";
+import * as path7 from "node:path";
 import { getSharedProjectMailbox } from "@wrongstack/core/coordination";
 import {
   assessHqExposure as assessHqExposure2,
@@ -45,6 +45,7 @@ import {
   isTokenExpired as isTokenExpired4,
   mintHqCookieSecret as mintHqCookieSecret2,
   mutateHqAuthFile as mutateHqAuthFile4,
+  shouldCloseBrowserSocket,
   toAlertMessage,
   watchHqAuthFile
 } from "@wrongstack/core/hq";
@@ -330,6 +331,7 @@ function authenticateBrowserRequest(req, url, mutableAuth, sessions) {
 // src/hq-server/auth-state.ts
 import {
   DEFAULT_HQ_REDACTION_POLICY,
+  findRevokedTokenKeys,
   hqAuthContentHash,
   hqTokenKey,
   isTokenExpired as isTokenExpired2,
@@ -395,10 +397,16 @@ function createHqAuthState(authFile, dataDir, opts = {}) {
       const newClient = next.clientTokens ?? [];
       auditPrunedTokens("browser", rawBrowserTokens, newBrowser, next, dataDir);
       auditPrunedTokens("client", rawClientTokens, newClient, next, dataDir);
+      const revokedKeys = findRevokedTokenKeys(
+        mutableAuth.browserTokens,
+        new Set(liveTokens(newBrowser).map(hqTokenKey))
+      );
+      const revokedIds = revokedKeys.length === 0 ? [] : revokedKeys.map((key) => mutableAuth.browserTokenObjs.get(key)?.id).filter((id) => id !== void 0 && id.length > 0);
       rawBrowserTokens = newBrowser;
       rawClientTokens = newClient;
       projectAuthFile(mutableAuth, next);
       opts.onApplied?.(mutableAuth);
+      if (revokedKeys.length > 0) opts.onTokensRevoked?.(revokedKeys, revokedIds);
     }
   };
 }
@@ -627,6 +635,7 @@ import {
   MailboxEventEmitter,
   MailboxHttpRateLimiter
 } from "@wrongstack/core/coordination";
+import * as path5 from "node:path";
 
 // src/hq-static-serve.ts
 import * as fs2 from "node:fs";
@@ -1667,6 +1676,7 @@ import { randomUUID as randomUUID4 } from "node:crypto";
 import { tokenHasCapability, validateHqCommand } from "@wrongstack/core/hq";
 
 // src/hq-server/snapshot.ts
+import { summarizeCommandLatency } from "@wrongstack/core/hq";
 import { WebSocket } from "ws";
 var HQ_SNAPSHOT_BROADCAST_DEBOUNCE_MS = 100;
 var HQ_SNAPSHOT_PERSIST_MIN_INTERVAL_MS = 3e3;
@@ -1942,6 +1952,7 @@ function buildSnapshot(clients, options) {
       }
     }
   }
+  const commandLatency = summarizeCommandLatency(options?.commandAudit ?? []);
   return {
     generatedAt: now,
     clients: clientRecords,
@@ -1952,6 +1963,7 @@ function buildSnapshot(clients, options) {
     machines,
     liveSessions,
     mcpServers,
+    ...commandLatency.sampleCount > 0 ? { commandLatency } : {},
     totals: {
       activeProjects: projects.length,
       activeClients: new Set(clientRecords.map(processKeyOf)).size,
@@ -1966,7 +1978,7 @@ function buildSnapshot(clients, options) {
     }
   };
 }
-function createSnapshotBroadcaster(clients, browsers, persistence) {
+function createSnapshotBroadcaster(clients, browsers, persistence, options) {
   let cached = "";
   let dirty = true;
   let timer = null;
@@ -1981,7 +1993,8 @@ function createSnapshotBroadcaster(clients, browsers, persistence) {
   };
   const serialize = () => {
     if (!dirty && cached.length > 0) return cached;
-    const snapshot = buildSnapshot(clients);
+    const commandAudit = options?.commandAudit?.();
+    const snapshot = buildSnapshot(clients, commandAudit !== void 0 ? { commandAudit } : {});
     const msg = { type: "hq.snapshot", snapshot };
     cached = JSON.stringify(msg);
     dirty = false;
@@ -2594,9 +2607,31 @@ async function handleApiEvents(req, res, persistence) {
   const rawLimit = Number.parseInt(url.searchParams.get("limit") ?? "200", 10);
   const limit = Math.min(5e3, Math.max(1, Number.isFinite(rawLimit) ? rawLimit : 200));
   const typeFilter = url.searchParams.get("type") ?? void 0;
+  const clientIdFilter = url.searchParams.get("clientId") ?? void 0;
+  const machineIdFilter = url.searchParams.get("machineId") ?? void 0;
+  const sinceMsRaw = url.searchParams.get("since");
+  const untilMsRaw = url.searchParams.get("until");
+  const sinceMs = sinceMsRaw !== null && sinceMsRaw.length > 0 && Number.isFinite(Number(sinceMsRaw)) ? Number(sinceMsRaw) : void 0;
+  const untilMs = untilMsRaw !== null && untilMsRaw.length > 0 && Number.isFinite(Number(untilMsRaw)) ? Number(untilMsRaw) : void 0;
   const events = await persistence.eventLog.recent(limit, typeFilter);
+  const filtered = events.filter((event) => {
+    const payload = event.payload;
+    if (clientIdFilter !== void 0 && payload?.clientId !== clientIdFilter) {
+      return false;
+    }
+    if (machineIdFilter !== void 0 && payload?.machineId !== machineIdFilter) {
+      return false;
+    }
+    if (sinceMs !== void 0 || untilMs !== void 0) {
+      const ts = event.timestamp !== void 0 ? Date.parse(event.timestamp) : Number.NaN;
+      if (!Number.isFinite(ts)) return true;
+      if (sinceMs !== void 0 && ts < sinceMs) return false;
+      if (untilMs !== void 0 && ts > untilMs) return false;
+    }
+    return true;
+  });
   res.writeHead(200, { "Content-Type": "application/json" });
-  res.end(JSON.stringify({ events, total: events.length }));
+  res.end(JSON.stringify({ events: filtered, total: filtered.length }));
 }
 async function handleApiTrendsCost(req, res, persistence) {
   const url = new URL(req.url ?? "/", "http://localhost");
@@ -2802,6 +2837,20 @@ async function handleApiSystemHealth(res, clients, persistence, eventLog) {
   const connectedClients = [...clients.values()].filter(
     (c) => Date.now() - new Date(c.lastSeenAt).getTime() < 6e4
   ).length;
+  const clientHealth = [...clients.values()].map((c) => {
+    const lastSeenMs = new Date(c.lastSeenAt).getTime();
+    const ageMs = Number.isFinite(lastSeenMs) ? now - lastSeenMs : Number.POSITIVE_INFINITY;
+    return {
+      clientId: c.clientId,
+      hostname: c.hostname ?? null,
+      machineId: c.machineId ?? null,
+      lastSeenAt: c.lastSeenAt,
+      ageMs,
+      // Bucket the staleness the same way the cockpit tile renders it: fresh
+      // (<5s), quiet (<60s), stale (>60s).
+      staleness: ageMs < 5e3 ? "fresh" : ageMs < 6e4 ? "quiet" : "stale"
+    };
+  });
   res.writeHead(200, {
     "Content-Type": "application/json",
     "Cache-Control": "no-store"
@@ -2822,7 +2871,9 @@ async function handleApiSystemHealth(res, clients, persistence, eventLog) {
         total: clientCount,
         active: connectedClients,
         stale: clientCount - connectedClients
-      }
+      },
+      // New: per-client publisher health (W1 #18).
+      publisherHealth: clientHealth
     })
   );
 }
@@ -2845,6 +2896,14 @@ async function handleApiAlerts(req, res, alertEngine) {
     })
   );
 }
+function handleApiMailboxHealth(res, mailboxManager) {
+  const health = mailboxManager.getHealth();
+  res.writeHead(200, {
+    "Content-Type": "application/json",
+    "Cache-Control": "no-store"
+  });
+  res.end(JSON.stringify(health));
+}
 
 // src/hq-server/routes.ts
 var hasTrustedBrowserOrigin2 = hasTrustedBrowserOrigin;
@@ -2883,6 +2942,7 @@ function createHqRouter(deps) {
     secureCookies,
     authorizeMailboxGateway,
     getMailboxGateway,
+    mailboxManager,
     getTokenStats,
     trustBoundary,
     bootstrapStore,
@@ -3095,6 +3155,10 @@ function createHqRouter(deps) {
         await handleApiSystemHealth(res, clients, persistence, eventLog);
         return;
       }
+      if (url.pathname === "/api/health/mailbox" && req.method === "GET") {
+        handleApiMailboxHealth(res, mailboxManager);
+        return;
+      }
       const mailboxGatewayMatch = url.pathname.match(
         /^\/api\/projects\/([^/]+)\/mailbox(?:\/(.*))?$/
       );
@@ -3319,6 +3383,69 @@ var MailboxGatewayManager = class {
       void gateway.mailbox.close().catch(() => void 0);
     }
   }
+  /**
+   * W2 #14 (RFC hq-improvements-2026-09.md): health snapshot for the cockpit
+   * "Mailbox gateway" card.
+   *
+   * Per-gateway entry surfaces the three diagnostic facts an operator
+   * needs:
+   *
+   *   - `projectId`: the **basename** of the project directory, matching
+   *     the credential contract used by `mailbox-serve.ts:192` (where
+   *     `path.basename(projectDir)` is the `projectId` key for mailbox
+   *     data). HQ binds the gateway with the full filesystem path
+   *     (`resolveHqProjectRoot(...)` from `mailbox-handlers.ts:90`), so
+   *     reporting the basename here means the dashboard's projectId
+   *     matches what other mailbox surfaces see.
+   *   - `projectRoot`: the full filesystem path the manager actually
+   *     binds against. Surfaced separately so operators can debug
+   *     path-mismatch issues without grepping the source.
+   *   - `hasActiveStreams`: whether the gateway has any open HTTP streams
+   *     right now. A gateway with `false` is a candidate for the next
+   *     idle eviction; one with `true` is being watched.
+   *   - `lastUsedAt`: epoch ms of the most recent `getMailboxGateway()`
+   *     call (or the last `authorizeMailboxGateway` hit that resolved to
+   *     this gateway). Surfaced so the dashboard can render the same
+   *     "fresh / quiet / stale" staleness buckets the publisher health
+   *     tile uses.
+   *   - `idleForMs`: convenience — `Date.now() - lastUsedAt`. `Infinity`
+   *     when the gateway was never used (shouldn't happen, since
+   *     `getMailboxGateway` always stamps `mailboxGatewayLastUsed`).
+   *
+   * The aggregate `actor` field is **explicitly absent** on the HQ mount:
+   * `authorizeMailboxGateway` (L57-96) never attaches a `MailboxActorContext`
+   * to its decision, because HQ is a read-mostly operator dashboard, not
+   * a producer-side mailbox client. We surface this truth with a stable
+   * `actorAttached: false` so the dashboard can render "no actor
+   * context" honestly rather than papering over it.
+   */
+  getHealth() {
+    const now = Date.now();
+    const gateways = [];
+    for (const [projectDir, gateway] of this.mailboxGateways) {
+      const lastUsed = this.mailboxGatewayLastUsed.get(projectDir);
+      gateways.push({
+        // projectId = basename(projectDir) — matches the credential contract.
+        projectId: path5.basename(projectDir),
+        projectRoot: projectDir,
+        hasActiveStreams: gateway.router.hasActiveStreams(),
+        lastUsedAt: typeof lastUsed === "number" ? lastUsed : null,
+        idleForMs: typeof lastUsed === "number" ? Math.max(0, now - lastUsed) : null
+      });
+    }
+    gateways.sort((a, b) => a.projectId.localeCompare(b.projectId));
+    return {
+      gatewayCount: gateways.length,
+      rateLimiterConfigured: true,
+      // HQ's gateway manager never attaches a MailboxActorContext (see
+      // authorizeMailboxGateway above). The dashboard renders this as
+      // "no actor context" — that is the truthful HQ state, not a bug.
+      actorAttached: false,
+      gateways,
+      sweepIntervalMs: this.MAILBOX_GATEWAY_SWEEP_INTERVAL_MS,
+      idleTtlMs: this.MAILBOX_GATEWAY_IDLE_TTL_MS
+    };
+  }
   close() {
     clearInterval(this.rateLimitCleanupTimer);
     clearInterval(this.sweepTimer);
@@ -3389,7 +3516,7 @@ async function prepareHqServerStart(options, defaults) {
 
 // src/hq-server/startup.ts
 import * as fs3 from "node:fs/promises";
-import * as path5 from "node:path";
+import * as path6 from "node:path";
 import { writeHqRuntimeFile } from "@wrongstack/core/hq";
 var hqRuntimeMarkerPath2 = hqRuntimeMarkerPath;
 async function writeHqRuntimeMarker(dataDir, url) {
@@ -3470,7 +3597,7 @@ HQ auth loaded from ${startup.dataDir}
   if (startup.clientEnv.WRONGSTACK_HQ_TOKEN) {
     write(`  WRONGSTACK_HQ_TOKEN=${startup.clientEnv.WRONGSTACK_HQ_TOKEN}
 `);
-    write(`Credentials are stored in ${path5.join(startup.dataDir, "auth.json")}
+    write(`Credentials are stored in ${path6.join(startup.dataDir, "auth.json")}
 `);
   }
   writeHqLanEndpoints(write, handle, void 0);
@@ -4263,8 +4390,9 @@ function handleClient(ws, clients, browsers, eventLog, auth, snapshotBroadcaster
         if (toSend.length > 0) {
           const batch = JSON.stringify({ type: "hq.command_batch", commands: toSend });
           if (ws.readyState === WebSocket2.OPEN) ws.send(batch);
+          const dispatchedAt = Date.now();
           for (const cmd of toSend) {
-            auditLog?.update(cmd.commandId, { status: "delivered" });
+            auditLog?.update(cmd.commandId, { status: "delivered", dispatchedAt });
             const updated = auditLog?.get(cmd.commandId);
             if (updated !== void 0) broadcastCommandStatus(updated, browsers);
           }
@@ -4284,6 +4412,7 @@ function handleClient(ws, clients, browsers, eventLog, auth, snapshotBroadcaster
       if (client) {
         const updated = auditLog?.updateForClient(frame.commandId, client.clientId, {
           status: "acked",
+          acknowledgedAt: Date.now(),
           ackStatus: frame.status,
           ...frame.message !== void 0 ? { ackMessage: frame.message } : {},
           ackedAt: (/* @__PURE__ */ new Date()).toISOString()
@@ -4401,10 +4530,12 @@ function handleHqUpgrade(req, socket, head, deps) {
       session.lastSeenAt = now2;
       if (session.pending2fa) return false;
       if (session.kind === "token" && session.tokenId !== void 0) {
-        return [...deps.mutableAuth.browserTokenObjs.values()].some(
+        const stillAuthorized = [...deps.mutableAuth.browserTokenObjs.values()].some(
           (obj) => obj.id === session.tokenId
         );
+        if (!stillAuthorized) return false;
       }
+      req.hqBrowserSessionId = sessionId;
       return true;
     })();
     if (!tokenValid && !cookieValid) {
@@ -4426,6 +4557,11 @@ function handleHqUpgrade(req, socket, head, deps) {
 }
 function handleHqConnection(ws, req, pathname, deps) {
   if (pathname === "/ws/browser") {
+    const sessionId = req.hqBrowserSessionId;
+    if (sessionId !== void 0) {
+      deps.browserSocketSessions.set(ws, sessionId);
+      ws.once("close", () => deps.browserSocketSessions.delete(ws));
+    }
     handleBrowser(ws, deps.snapshotBroadcaster, deps.browsers, deps.eventLog);
   } else {
     const token = new URL(req.url ?? "/", `http://${deps.host}:${deps.port}`).searchParams.get(
@@ -4494,8 +4630,10 @@ async function startHqServerWithAuth(options, host, port, dataDir, firstRunAuth)
       );
     }
   };
+  let revokeBrowserSessions;
   const authState = createHqAuthState(authFile, dataDir, {
     onApplied: (live) => reassessExposureFloor(live),
+    onTokensRevoked: (keys) => revokeBrowserSessions?.(keys),
     requireBrowserAuth: options.requireBrowserAuth
   });
   const { mutableAuth } = authState;
@@ -4540,8 +4678,16 @@ async function startHqServerWithAuth(options, host, port, dataDir, firstRunAuth)
     let listeningPort = port;
     const clients = /* @__PURE__ */ new Map();
     const clientSocketTokens = /* @__PURE__ */ new Map();
+    const browserSocketSessions = /* @__PURE__ */ new Map();
     const browsers = /* @__PURE__ */ new Set();
     const sessions = /* @__PURE__ */ new Map();
+    revokeBrowserSessions = (keys) => {
+      const frame = JSON.stringify({ type: "hq.auth_revoked", revokedTokenKeys: keys });
+      for (const ws of browsers) {
+        if (ws.readyState !== WebSocket3.OPEN) continue;
+        ws.send(frame);
+      }
+    };
     const eventLog = [];
     const transcripts = /* @__PURE__ */ new Map();
     const agentMessages = /* @__PURE__ */ new Map();
@@ -4581,12 +4727,12 @@ async function startHqServerWithAuth(options, host, port, dataDir, firstRunAuth)
     const persistence = createHqPersistence(dataDir);
     const auditLog = new HqCommandAuditLog(1e3, (entry) => persistence.commandLog.append(entry));
     void (async () => {
-      const projectsDir = path6.join(path6.dirname(dataDir), "projects");
+      const projectsDir = path7.join(path7.dirname(dataDir), "projects");
       const entries = await fs4.readdir(projectsDir, { withFileTypes: true }).catch(() => []);
       await Promise.all(
         entries.filter((entry) => entry.isDirectory()).map(async (entry) => {
-          const projectDir = path6.join(projectsDir, entry.name);
-          const metadataPath = path6.join(projectDir, ".mailbox-server.json");
+          const projectDir = path7.join(projectsDir, entry.name);
+          const metadataPath = path7.join(projectDir, ".mailbox-server.json");
           const ownerPid = await fs4.readFile(metadataPath, "utf8").then((raw) => JSON.parse(raw).pid).catch(() => void 0);
           if (ownerPid === void 0) return;
           let ownerAlive = false;
@@ -4644,7 +4790,10 @@ async function startHqServerWithAuth(options, host, port, dataDir, firstRunAuth)
     const snapshotBroadcaster = createSnapshotBroadcaster(
       clients,
       browsers,
-      persistence
+      persistence,
+      // W4 #7: the ring is the read path for `/api/commands`, so the browser
+      // snapshot's latency roll-up is computed from the same window.
+      { commandAudit: () => auditLog.recent(200) }
     );
     snapshotBroadcaster.currentSerialized();
     const stopAlertEngine = alertEngine.startPeriodic(
@@ -4714,6 +4863,7 @@ async function startHqServerWithAuth(options, host, port, dataDir, firstRunAuth)
       agentMessages,
       mailboxGateways: mailboxManager.mailboxGateways,
       mailboxGatewayRateLimiter: mailboxManager.mailboxGatewayRateLimiter,
+      mailboxManager,
       alertEngine,
       auditLog,
       persistence,
@@ -4755,6 +4905,7 @@ async function startHqServerWithAuth(options, host, port, dataDir, firstRunAuth)
       sessions,
       clients,
       clientSocketTokens,
+      browserSocketSessions,
       browsers,
       eventLog,
       transcripts,
@@ -4785,12 +4936,18 @@ async function startHqServerWithAuth(options, host, port, dataDir, firstRunAuth)
           const liveBrowserTokenIds = new Set(
             [...mutableAuth.browserTokenObjs.values()].map((token) => token.id)
           );
+          const revokedSessionIds = /* @__PURE__ */ new Set();
           for (const [sessionId, session] of sessions) {
             if (passwordChanged || cookieSecretChanged || session.kind === "token" && (session.tokenId === void 0 || !liveBrowserTokenIds.has(session.tokenId))) {
               sessions.delete(sessionId);
+              revokedSessionIds.add(sessionId);
+            }
+          }
+          for (const browser of browsers) {
+            if (shouldCloseBrowserSocket(browserSocketSessions.get(browser), revokedSessionIds)) {
+              browser.close(1008, "Browser authentication changed");
             }
           }
-          for (const browser of browsers) browser.close(1008, "Browser authentication changed");
         }
         const clientAuthRequired = hqClientAuthRequired(mutableAuth);
         for (const [clientSocket, authToken] of clientSocketTokens) {
@@ -4932,4 +5089,4 @@ export {
   startHqServer,
   HqInsecureExposureError2 as HqInsecureExposureError
 };
-//# sourceMappingURL=chunk-7FPN3QTH.js.map
+//# sourceMappingURL=chunk-YRC3I3LE.js.map

package/dist/{cli-context-6GMXUOXD.js → cli-context-5IF7ZYEY.js}

@@ -19,17 +19,17 @@ import {
 } from "./chunk-GPPRNAKW.js";
 import {
   subcommands
-} from "./chunk-7K3IJGWC.js";
+} from "./chunk-OJR7K3OI.js";
 import {
   renderDeepHelp,
   renderFocusedHelp
 } from "./chunk-JX6KL7OF.js";
 import {
   handleHelpVersionShortCircuit
-} from "./chunk-5VPDKQDH.js";
+} from "./chunk-TNZBQG45.js";
 import {
   DEFAULT_PORT
-} from "./chunk-7FPN3QTH.js";
+} from "./chunk-YRC3I3LE.js";
 import "./chunk-HXJYHAR4.js";
 import {
   resolveHqPasswordInput
@@ -63,7 +63,7 @@ import {
   runPicker,
   saveToGlobalConfig,
   theme
-} from "./chunk-FSZ5QU3M.js";
+} from "./chunk-RDHFXOJM.js";
 import "./chunk-2VMJ3E5Z.js";
 import "./chunk-B4JLSXZB.js";
 import {
@@ -75,7 +75,7 @@ import {
 } from "./chunk-YMXXOOFN.js";
 import {
   parseArgs
-} from "./chunk-EK2P53GL.js";
+} from "./chunk-C3Z4N6A6.js";
 import "./chunk-DAKVBMD4.js";
 import {
   mutateConfigProviders,
@@ -866,7 +866,7 @@ async function isPortInUse(host, port) {
 }
 async function handleHqShortCircuit(flags) {
   if (flags["hq"] !== true) return null;
-  const { startHqServer } = await import("./hq-server-JJFGFWI5.js");
+  const { startHqServer } = await import("./hq-server-KE5YDNGG.js");
   const tunnelRequested = flags["tunnel"] === true;
   const rawPublicUrl = typeof flags["hq-public-url"] === "string" ? flags["hq-public-url"] : process.env.WRONGSTACK_HQ_PUBLIC_URL;
   let publicOrigin;
@@ -3303,4 +3303,4 @@ async function initializeCli(argv) {
 export {
   initializeCli
 };
-//# sourceMappingURL=cli-context-6GMXUOXD.js.map
+//# sourceMappingURL=cli-context-5IF7ZYEY.js.map