@wrongstack/cli 1.0.10 → 1.0.12

package/dist/hq-server/routes/system-handlers.d.ts

@@ -7,9 +7,36 @@
 import type * as http from 'node:http';
 import type { HqAlertEngine, HqCommandAuditLog, HqEventEnvelope, HqPersistence } from '@wrongstack/core/hq';
 import type { WebSocket } from 'ws';
+import type { HqMailboxGatewayHealth } from '../mailbox-gateway-health.js';
 import type { ConnectedClient } from '../types.js';
 export declare function handleApiSystemUpdate(res: http.ServerResponse): Promise<void>;
 export declare function handleApiSystemHealth(res: http.ServerResponse, clients: Map<WebSocket, ConnectedClient>, persistence: HqPersistence, eventLog: HqEventEnvelope[]): Promise<void>;
 export declare function handleApiCommandsAudit(req: http.IncomingMessage, res: http.ServerResponse, auditLog: HqCommandAuditLog): Promise<void>;
 export declare function handleApiAlerts(req: http.IncomingMessage, res: http.ServerResponse, alertEngine: HqAlertEngine): Promise<void>;
+/**
+ * Structural view of the gateway manager this handler needs. Typing the
+ * parameter structurally — rather than importing `MailboxGatewayManager` —
+ * keeps this module out of the type-inclusive cycle
+ * `mailbox-gateway-manager → routes → system-handlers`, which
+ * `check:architecture` reports as unexcepted. The real manager satisfies this
+ * shape, so callers and the wire contract are unaffected.
+ */
+interface MailboxHealthSource {
+    getHealth(): HqMailboxGatewayHealth;
+}
+/**
+ * W2 #14 (RFC hq-improvements-2026-09.md): GET /api/health/mailbox —
+ * mailbox gateway health snapshot for the cockpit's "Mailbox gateway" card.
+ *
+ * Surfaces {@link MailboxHealthSource.getHealth} verbatim. The contract
+ * (basename as `projectId`, full path as `projectRoot`, `actorAttached: false`
+ * on the HQ mount, sorted gateways) is locked by the focused test in
+ * `packages/cli/tests/hq-mailbox-gateway-health.test.ts`.
+ *
+ * No query parameters. No mutation. Same auth contract as
+ * `/api/system/health` — gated by `requireBrowserAuth` upstream in the
+ * router, not duplicated here.
+ */
+export declare function handleApiMailboxHealth(res: http.ServerResponse, mailboxManager: MailboxHealthSource): void;
+export {};
 //# sourceMappingURL=system-handlers.d.ts.map

package/dist/hq-server/routes.d.ts

@@ -13,6 +13,7 @@ import type { createHqPersistence, HqAlertEngine, HqCommandAuditLog, HqEventEnve
 import type { TrustBoundary } from '@wrongstack/core/security';
 import type { WebSocket } from 'ws';
 import * as HqServerAuth from './auth.js';
+import type { HqMailboxGatewayHealth } from './mailbox-gateway-health.js';
 import { type ApplyHqAuthFile } from './routes/auth-handlers.js';
 import * as HqServerUtils from './utils.js';
 export declare const setHqSecurityHeaders: typeof HqServerAuth.setHqSecurityHeaders;
@@ -73,6 +74,16 @@ export interface HqRouterDeps {
     agentMessages: Map<string, HqTranscriptEntry[]>;
     mailboxGateways: Map<string, HqRouterMailboxGateway>;
     mailboxGatewayRateLimiter: MailboxHttpRateLimiter;
+    /**
+     * W2 #14 (RFC hq-improvements-2026-09.md): mailbox gateway manager used
+     * by `/api/health/mailbox` to surface the cockpit "Mailbox gateway"
+     * card. Same manager that owns `mailboxGateways` and
+     * `mailboxGatewayRateLimiter` — passed explicitly so the handler can
+     * call `getHealth()` without reaching into a closure.
+     */
+    mailboxManager: {
+        getHealth(): HqMailboxGatewayHealth;
+    };
     alertEngine: HqAlertEngine;
     auditLog: HqCommandAuditLog;
     persistence: ReturnType<typeof createHqPersistence>;

package/dist/hq-server/snapshot.d.ts

@@ -53,8 +53,21 @@ export declare const HQ_STALE_SNAPSHOT_MS: number;
 export declare function reapStaleClientState(clients: Map<WebSocket, ConnectedClient>, nowMs?: number): void;
 export declare function buildSnapshot(clients: Map<WebSocket, ConnectedClient>, options?: {
     tokenStats?: HqSnapshot['totals']['tokenStats'];
+    /**
+     * Recent command-audit entries (W4 #7). The caller owns the audit ring, so
+     * it hands over the window rather than the builder reaching for a global.
+     */
+    commandAudit?: readonly HqCommandAuditEntry[];
 }): HqSnapshot;
-export declare function createSnapshotBroadcaster(clients: Map<WebSocket, ConnectedClient>, browsers: Set<WebSocket>, persistence?: HqPersistence): HqSnapshotBroadcaster;
+export declare function createSnapshotBroadcaster(clients: Map<WebSocket, ConnectedClient>, browsers: Set<WebSocket>, persistence?: HqPersistence, options?: {
+    /**
+     * W4 #7: command-audit window for the latency roll-up. Passed as a
+     * provider rather than an array because the broadcaster caches its
+     * serialized frame and only rebuilds when marked dirty — reading the ring
+     * at serialize time is what keeps the cached frame current.
+     */
+    commandAudit?: () => readonly HqCommandAuditEntry[];
+}): HqSnapshotBroadcaster;
 export declare function buildProjectDetail(clients: Map<WebSocket, ConnectedClient>, projectId: string): ProjectDetail | null;
 export declare function broadcastEvent(event: HqEventEnvelope, browsers: Set<WebSocket>): void;
 /** Push one control command's lifecycle to every authenticated HQ browser. */

package/dist/hq-server/upgrade-handler.d.ts

@@ -21,6 +21,13 @@ interface HqUpgradeHandlerDeps {
     sessions: Map<string, HqSessionEntry>;
     clients: Map<WebSocket, ConnectedClient>;
     clientSocketTokens: Map<WebSocket, HqToken | undefined>;
+    /**
+     * Session id that authorized each open browser socket, so token revocation
+     * can close only the affected browsers. Absent for a socket that
+     * authenticated with a bare loopback `?token=` rather than a cookie session;
+     * the revocation path treats that absence as "affected" (fail closed).
+     */
+    browserSocketSessions: Map<WebSocket, string>;
     browsers: Set<WebSocket>;
     eventLog: import('@wrongstack/core/hq').HqEventEnvelope[];
     transcripts: Map<string, TranscriptRing>;

package/dist/{hq-server-JJFGFWI5.js → hq-server-KE5YDNGG.js}

@@ -10,7 +10,7 @@ import {
   readLocalSubagentTranscript,
   sanitizeApiError,
   startHqServer
-} from "./chunk-7FPN3QTH.js";
+} from "./chunk-YRC3I3LE.js";
 import "./chunk-HXJYHAR4.js";
 import "./chunk-5EA6OTLJ.js";
 import "./chunk-Q7E3BPDU.js";
@@ -27,4 +27,4 @@ export {
   sanitizeApiError,
   startHqServer
 };
-//# sourceMappingURL=hq-server-JJFGFWI5.js.map
+//# sourceMappingURL=hq-server-KE5YDNGG.js.map

package/dist/index.js

@@ -8,7 +8,7 @@ import {
 } from "./chunk-XJXDOF63.js";
 import {
   parseArgs
-} from "./chunk-EK2P53GL.js";
+} from "./chunk-C3Z4N6A6.js";
 
 // src/cli-entry-main.ts
 async function main(argv) {
@@ -16,14 +16,14 @@ async function main(argv) {
   applySessionShellDefault();
   const earlyFlags = parseArgs(argv).flags;
   if (earlyFlags["help"] === true || earlyFlags["version"] === true) {
-    const { handleHelpVersionShortCircuit } = await import("./short-circuit-flags-LHUNLCZY.js");
+    const { handleHelpVersionShortCircuit } = await import("./short-circuit-flags-72E77TJI.js");
     const earlyExit = await handleHelpVersionShortCircuit(argv);
     if (earlyExit !== null) return earlyExit;
   }
-  const { initializeCli } = await import("./cli-context-6GMXUOXD.js");
+  const { initializeCli } = await import("./cli-context-5IF7ZYEY.js");
   const cliCtx = await initializeCli(argv);
   if (typeof cliCtx === "number") return cliCtx;
-  const { runInteractive } = await import("./cli-main-BU5DEHDO.js");
+  const { runInteractive } = await import("./cli-main-6LMQSS66.js");
   return runInteractive(cliCtx);
 }
 

package/dist/{mcp-FX7TKPTV.js → mcp-DC5WSBOO.js}

@@ -6,7 +6,7 @@ import {
 } from "./chunk-YMXXOOFN.js";
 
 // src/subcommands/handlers/mcp.ts
-import { allServers } from "@wrongstack/core/infrastructure";
+import { allServers, resolveMcpServerConfig } from "@wrongstack/core/infrastructure";
 import {
   expectDefined,
   jsonObjectFileExists,
@@ -49,6 +49,15 @@ function parseToolsFlag(flags, positional) {
   );
   return set.size > 0 ? set : null;
 }
+function resolveServeHttpPort(flags) {
+  const raw = typeof flags["port"] === "string" ? flags["port"] : typeof flags["http"] === "string" ? flags["http"] : void 0;
+  if (raw === void 0 || raw.trim() === "") return 0;
+  const port = Number(raw);
+  if (!Number.isInteger(port) || port < 0 || port > 65535) {
+    throw new Error(`invalid --port "${raw}" \u2014 expected an integer between 0 and 65535`);
+  }
+  return port;
+}
 async function loadSelectedMcpServeContent(flags, cwd) {
   const resources = [];
   const prompts = [];
@@ -287,7 +296,13 @@ async function serveMcpStdio(deps, positional) {
   });
   const mode = yolo ? "yolo: all tools" : "safe: read-only tools";
   if (flags["http"] === true || typeof flags["http"] === "string" || flags["port"] || flags["host"]) {
-    const port = Number(flags["port"] ?? flags["http"] ?? 0) || 0;
+    let port;
+    try {
+      port = resolveServeHttpPort(flags);
+    } catch (err) {
+      log(`wrongstack MCP server: ${err instanceof Error ? err.message : String(err)}`);
+      return 1;
+    }
     const httpHost = typeof flags["host"] === "string" ? flags["host"] : "127.0.0.1";
     const tokenFromArg = typeof flags["token"] === "string" ? flags["token"] : void 0;
     const token = tokenFromArg ?? process.env.WRONGSTACK_MCP_TOKEN?.trim() ?? void 0;
@@ -344,10 +359,13 @@ var mcpCmd = async (args, deps) => {
       deps.renderer.write("Use `wstack mcp add <name>` or set mcpServers in your config.\n");
       return 0;
     }
-    for (const [name, cfg] of Object.entries(servers)) {
-      const status = cfg.enabled === false ? "disabled" : "enabled";
-      const desc = cfg.description ? `  # ${cfg.description}` : "";
-      deps.renderer.write(`  ${name.padEnd(20)} ${cfg.transport.padEnd(16)} ${status}${desc}
+    for (const [name, entry] of Object.entries(servers)) {
+      const cfg = resolveMcpServerConfig(name, entry);
+      const status = entry?.enabled === false ? "disabled" : "enabled";
+      const description = cfg?.description ?? entry?.description;
+      const desc = description ? `  # ${description}` : "";
+      const transport = cfg?.transport ?? "invalid (no transport)";
+      deps.renderer.write(`  ${name.padEnd(20)} ${transport.padEnd(16)} ${status}${desc}
 `);
     }
     return 0;
@@ -391,7 +409,7 @@ async function addMcpServer(args, deps) {
     deps.renderer.write("\nRun `wstack mcp add <name> --enable` to enable immediately.\n");
     return 1;
   }
-  const factory = BUILT_IN_MCP[name];
+  const factory = Object.hasOwn(BUILT_IN_MCP, name) ? BUILT_IN_MCP[name] : void 0;
   if (!factory) {
     deps.renderer.writeError(
       `Unknown server "${name}". Run \`wstack mcp add\` without args to see available servers.
@@ -403,7 +421,7 @@ async function addMcpServer(args, deps) {
   serverCfg.enabled = enable;
   const existing = await readJsonObjectFile(configPath);
   const mcpServers = isRecord(existing.mcpServers) ? existing.mcpServers : {};
-  if (mcpServers[name])
+  if (Object.hasOwn(mcpServers, name))
     deps.renderer.writeWarning(`Server "${name}" already in config. Updating.
 `);
   await updateJsonObjectFile(configPath, (config) => {
@@ -424,7 +442,7 @@ async function removeMcpServer(name, deps) {
   }
   const existing = await readJsonObjectFile(configPath);
   const mcpServers = isRecord(existing.mcpServers) ? existing.mcpServers : {};
-  if (!mcpServers[name]) {
+  if (!Object.hasOwn(mcpServers, name)) {
     deps.renderer.writeError(`Server "${name}" not in config.
 `);
     return 1;
@@ -442,4 +460,4 @@ function isRecord(value) {
 export {
   mcpCmd
 };
-//# sourceMappingURL=mcp-FX7TKPTV.js.map
+//# sourceMappingURL=mcp-DC5WSBOO.js.map

package/dist/mcp-serve.d.ts

@@ -45,6 +45,15 @@ export declare function yoloServePolicy(): AutoApprovePermissionPolicy;
  * "flag present but no list" as an error, never as "no whitelist".
  */
 export declare function parseToolsFlag(flags: Record<string, string | boolean>, positional?: readonly string[]): Set<string> | null;
+/**
+ * Resolve the TCP port for `mcp serve --http`.
+ *
+ * `--http` is also a boolean flag, and the old `Number(flags.port ?? flags.http)`
+ * turned a bare `--http` into `Number(true) === 1` — the server tried to bind
+ * privileged port 1 instead of an ephemeral one. A bare flag now means "pick a
+ * free port" (0); an explicit value must be an integer in 0–65535.
+ */
+export declare function resolveServeHttpPort(flags: Record<string, string | boolean>): number;
 interface SelectedMcpServeContent {
     resources: MCPServerResource[];
     prompts: MCPServerPrompt[];

package/dist/services/mcp-management.d.ts

@@ -1,9 +1,3 @@
-/**
- * Shared MCP management service.
- * Contains the argument parser and the actual management logic shared between
- * the CLI subcommand handler (packages/cli/src/subcommands/handlers/mcp.ts)
- * and the slash-command wiring in index.ts.
- */
 import type { Config, MCPServerConfig } from '@wrongstack/core/types';
 import type { MCPRegistry } from '@wrongstack/mcp';
 export interface McpParsedArgs {

package/dist/{short-circuit-flags-LHUNLCZY.js → short-circuit-flags-72E77TJI.js}

@@ -1,10 +1,10 @@
 import {
   handleHelpVersionShortCircuit
-} from "./chunk-5VPDKQDH.js";
+} from "./chunk-TNZBQG45.js";
 import "./chunk-6WRKAACA.js";
 import "./chunk-XJXDOF63.js";
-import "./chunk-EK2P53GL.js";
+import "./chunk-C3Z4N6A6.js";
 export {
   handleHelpVersionShortCircuit
 };
-//# sourceMappingURL=short-circuit-flags-LHUNLCZY.js.map
+//# sourceMappingURL=short-circuit-flags-72E77TJI.js.map

package/dist/{subcommands-UXWY3OPC.js → subcommands-EJI7DBQS.js}

@@ -1,9 +1,9 @@
 import {
   subcommandNames,
   subcommands
-} from "./chunk-7K3IJGWC.js";
+} from "./chunk-OJR7K3OI.js";
 export {
   subcommandNames,
   subcommands
 };
-//# sourceMappingURL=subcommands-UXWY3OPC.js.map
+//# sourceMappingURL=subcommands-EJI7DBQS.js.map

package/dist/wiring/codebase-index.d.ts

@@ -17,6 +17,14 @@
  */
 import type { AgentPipelines, Context } from '@wrongstack/core/agent';
 import type { IndexingConfig, Logger } from '@wrongstack/core/types';
+/**
+ * Project files a successful file-changing tool call wrote, resolved against
+ * `cwd`. Only `write`/`edit` were handled, so `codebase-ast-replace`, `patch`
+ * and `format` left the index describing the pre-edit code until a restart
+ * (external watching is off by default) — incoming calls and impact analysis
+ * then answered for a function body that no longer existed.
+ */
+export declare function editedFilePaths(toolName: string, input: unknown, cwd: string): string[];
 interface CodebaseIndexingDeps {
     config: {
         indexing?: IndexingConfig | undefined;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrongstack/cli",
-  "version": "1.0.10",
+  "version": "1.0.12",
   "license": "MIT",
   "description": "WrongStack CLI — terminal AI coding agent with provider catalog from models.dev. Provides `wrongstack` and `wstack` binaries.",
   "keywords": [
@@ -41,36 +41,36 @@
     "data"
   ],
   "dependencies": {
-    "@wrongstack/acp": "1.0.10",
-    "@wrongstack/bench": "1.0.10",
-    "@wrongstack/core": "1.0.10",
-    "@wrongstack/kanban": "1.0.10",
-    "@wrongstack/mcp": "1.0.10",
-    "@wrongstack/persistence": "1.0.10",
-    "@wrongstack/plug-lsp": "1.0.10",
-    "@wrongstack/plugins": "1.0.10",
-    "@wrongstack/primitives": "1.0.10",
-    "@wrongstack/providers": "1.0.10",
-    "@wrongstack/requirement-intake": "1.0.10",
-    "@wrongstack/runtime": "1.0.10",
-    "@wrongstack/sage": "1.0.10",
-    "@wrongstack/sdd": "1.0.10",
-    "@wrongstack/security-scanner": "1.0.10",
-    "@wrongstack/simpleui": "1.0.10",
-    "@wrongstack/techstack": "1.0.10",
-    "@wrongstack/telegram": "1.0.10",
-    "@wrongstack/tools": "1.0.10",
-    "@wrongstack/tui": "1.0.10",
-    "@wrongstack/vector-memory": "1.0.10",
-    "@wrongstack/webui": "1.0.10",
-    "@wrongstack/webui-hq": "1.0.10",
-    "@wrongstack/webui-protocol": "1.0.10",
-    "@wrongstack/webui-server": "1.0.10",
-    "@wrongstack/wrongtrace": "1.0.10",
+    "@wrongstack/acp": "1.0.12",
+    "@wrongstack/bench": "1.0.12",
+    "@wrongstack/core": "1.0.12",
+    "@wrongstack/kanban": "1.0.12",
+    "@wrongstack/mcp": "1.0.12",
+    "@wrongstack/persistence": "1.0.12",
+    "@wrongstack/plug-lsp": "1.0.12",
+    "@wrongstack/plugins": "1.0.12",
+    "@wrongstack/primitives": "1.0.12",
+    "@wrongstack/providers": "1.0.12",
+    "@wrongstack/requirement-intake": "1.0.12",
+    "@wrongstack/runtime": "1.0.12",
+    "@wrongstack/sage": "1.0.12",
+    "@wrongstack/sdd": "1.0.12",
+    "@wrongstack/security-scanner": "1.0.12",
+    "@wrongstack/simpleui": "1.0.12",
+    "@wrongstack/techstack": "1.0.12",
+    "@wrongstack/telegram": "1.0.12",
+    "@wrongstack/tools": "1.0.12",
+    "@wrongstack/tui": "1.0.12",
+    "@wrongstack/vector-memory": "1.0.12",
+    "@wrongstack/webui": "1.0.12",
+    "@wrongstack/webui-hq": "1.0.12",
+    "@wrongstack/webui-protocol": "1.0.12",
+    "@wrongstack/webui-server": "1.0.12",
+    "@wrongstack/wrongtrace": "1.0.12",
     "ws": "^8.21.3"
   },
   "optionalDependencies": {
-    "@wrongstack/desktop": "1.0.10"
+    "@wrongstack/desktop": "1.0.12"
   },
   "devDependencies": {
     "@types/node": "^26.5.1",