@wrongstack/cli 1.0.12 → 1.0.14

package/dist/{chunk-TNZBQG45.js → chunk-DUF5FEWD.js}

@@ -22,7 +22,7 @@ async function handleHelpVersionShortCircuit(argv) {
   }
   if (earlyFlags["help"] === true) {
     if (positional.length > 0) {
-      const { subcommandNames } = await import("./subcommands-EJI7DBQS.js");
+      const { subcommandNames } = await import("./subcommands-3ILCNR2T.js");
       if (subcommandNames.includes(positional[0])) {
         const first = positional[0];
         const deep = positional[1];
@@ -43,4 +43,4 @@ async function handleHelpVersionShortCircuit(argv) {
 export {
   handleHelpVersionShortCircuit
 };
-//# sourceMappingURL=chunk-TNZBQG45.js.map
+//# sourceMappingURL=chunk-DUF5FEWD.js.map

package/dist/{chunk-YRC3I3LE.js → chunk-MZY6UDWC.js}

@@ -231,7 +231,7 @@ function hqAuthRequired(mutableAuth, requireBrowserAuth) {
   return (requireBrowserAuth ?? mutableAuth.requireBrowserAuth) === true || mutableAuth.requireAuthFloor === true || mutableAuth.browserTokens.size > 0 || mutableAuth.passwordHash !== void 0;
 }
 function hqClientAuthRequired(mutableAuth) {
-  return mutableAuth.requireAuthFloor === true || mutableAuth.clientTokens.size > 0;
+  return mutableAuth.clientTokens.size > 0 || hqAuthRequired(mutableAuth);
 }
 function extractBrowserToken(req, url) {
   const queryToken = url.searchParams.get("token");
@@ -4880,8 +4880,19 @@ async function startHqServerWithAuth(options, host, port, dataDir, firstRunAuth)
       bootstrapStore
     };
     const handleRequest = createHqRouter(routerDeps);
+    const closeSocketsOfRemovedSessions = (before) => {
+      for (const [browser, sessionId] of browserSocketSessions) {
+        if (!before.has(sessionId) || sessions.has(sessionId)) continue;
+        if (browser.readyState === WebSocket3.OPEN) {
+          browser.close(1008, "Browser session revoked");
+        }
+      }
+    };
     const httpServer = http.createServer((req, res) => {
-      void handleRequest(req, res);
+      const sessionsBefore = sessions.size > 0 ? new Set(sessions.keys()) : void 0;
+      void handleRequest(req, res).finally(() => {
+        if (sessionsBefore !== void 0) closeSocketsOfRemovedSessions(sessionsBefore);
+      });
     });
     const wss = new WebSocketServer({ noServer: true, maxPayload: 1 * 1024 * 1024 });
     const browserHeartbeatTimer = setInterval(() => {
@@ -5089,4 +5100,4 @@ export {
   startHqServer,
   HqInsecureExposureError2 as HqInsecureExposureError
 };
-//# sourceMappingURL=chunk-YRC3I3LE.js.map
+//# sourceMappingURL=chunk-MZY6UDWC.js.map

package/dist/{chunk-OJR7K3OI.js → chunk-U3PDQOYU.js}

@@ -31,7 +31,7 @@ var loaders = {
   quick: async () => (await import("./quick-CNB4Z3HS.js")).quickCmd,
   bench: async () => (await import("./bench-YBU6BVQP.js")).benchCmd,
   chronicle: async () => (await import("./chronicle-UTFETHP6.js")).chronicleCmd,
-  hq: async () => (await import("./hq-NO2NWGU4.js")).hqCmd,
+  hq: async () => (await import("./hq-O5BOP6UY.js")).hqCmd,
   mailbox: async () => (await import("./mailbox-serve-X3CR6VFW.js")).mailboxServeCmd,
   permissions: async () => (await import("./permissions-CFDLXETM.js")).permissionsCmd,
   project: async () => (await import("./project-AOQI5XTK.js")).projectCmd,
@@ -51,4 +51,4 @@ export {
   subcommands,
   subcommandNames
 };
-//# sourceMappingURL=chunk-OJR7K3OI.js.map
+//# sourceMappingURL=chunk-U3PDQOYU.js.map

package/dist/{cli-context-5IF7ZYEY.js → cli-context-6MTVFJPO.js}

@@ -19,17 +19,17 @@ import {
 } from "./chunk-GPPRNAKW.js";
 import {
   subcommands
-} from "./chunk-OJR7K3OI.js";
+} from "./chunk-U3PDQOYU.js";
 import {
   renderDeepHelp,
   renderFocusedHelp
 } from "./chunk-JX6KL7OF.js";
 import {
   handleHelpVersionShortCircuit
-} from "./chunk-TNZBQG45.js";
+} from "./chunk-DUF5FEWD.js";
 import {
   DEFAULT_PORT
-} from "./chunk-YRC3I3LE.js";
+} from "./chunk-MZY6UDWC.js";
 import "./chunk-HXJYHAR4.js";
 import {
   resolveHqPasswordInput
@@ -866,7 +866,7 @@ async function isPortInUse(host, port) {
 }
 async function handleHqShortCircuit(flags) {
   if (flags["hq"] !== true) return null;
-  const { startHqServer } = await import("./hq-server-KE5YDNGG.js");
+  const { startHqServer } = await import("./hq-server-YW4MJCKH.js");
   const tunnelRequested = flags["tunnel"] === true;
   const rawPublicUrl = typeof flags["hq-public-url"] === "string" ? flags["hq-public-url"] : process.env.WRONGSTACK_HQ_PUBLIC_URL;
   let publicOrigin;
@@ -3303,4 +3303,4 @@ async function initializeCli(argv) {
 export {
   initializeCli
 };
-//# sourceMappingURL=cli-context-5IF7ZYEY.js.map
+//# sourceMappingURL=cli-context-6MTVFJPO.js.map

package/dist/{cli-main-6LMQSS66.js → cli-main-6JWASRH2.js}

@@ -3228,8 +3228,8 @@ import {
   runtimeToolReferencesFromText
 } from "@wrongstack/core/agent-catalog";
 import { TOKENS as TOKENS3 } from "@wrongstack/core/kernel";
-import { formatProjectSuppliedBlock } from "@wrongstack/core/utils";
-import { getSageRetrieval } from "@wrongstack/sage";
+import { formatMemoryEvidenceBlock, formatProjectSuppliedBlock } from "@wrongstack/core/utils";
+import { formatMemoryHintsDetailed, getSageRetrieval } from "@wrongstack/sage";
 var EAGER_SKILL_LIMIT = DEFAULT_EAGER_SKILL_LIMIT;
 var MIN_TRIMMED_BODY_CHARS = 800;
 async function resolveHostSubagentSkillResolution(deps, roster, subCfg, availableToolNames = []) {
@@ -3344,8 +3344,9 @@ _(body trimmed)_` : body,
 async function retrieveHostSubagentMemory(deps, getLeaderMode, subCfg, taskContext, owningSessionId) {
   const memoryPort = deps.container.safeResolve(TOKENS3.MemoryStore);
   const memory = memoryPort ? getSageRetrieval(memoryPort) : void 0;
-  if (!memory?.retrieveForAudience) return [];
+  if (!memory?.retrieveForAudience) return void 0;
   const contextualTaskType = typeof taskContext?.["taskType"] === "string" ? taskContext["taskType"] : void 0;
+  const sessionId = owningSessionId ?? deps.session.id;
   try {
     const taskType = subCfg.memoryContext?.taskType ?? contextualTaskType;
     const mode = subCfg.memoryContext?.mode ?? getLeaderMode?.();
@@ -3355,18 +3356,30 @@ async function retrieveHostSubagentMemory(deps, getLeaderMode, subCfg, taskConte
         ...taskType !== void 0 ? { taskType } : {},
         ...mode !== void 0 ? { mode } : {}
       },
-      20
+      20,
+      void 0,
+      // The owning conversation's own session-scoped audience memories are
+      // visible to its workers; other sessions' stay hidden.
+      sessionId
     );
-    await memory.recordInjection?.(
-      matches.map((item) => item.id),
-      "subagent_audience",
-      owningSessionId ?? deps.session.id
+    const eligible = matches.filter(
+      (item) => item.status === "active" && item.contextPolicy !== "never"
     );
-    return matches.map((item) => item.text);
+    const rendered = formatMemoryHintsDetailed(eligible, {
+      heading: "SAGE: project memory for this agent role",
+      maxChars: SUBAGENT_AUDIENCE_MEMORY_CHARS
+    });
+    if (!rendered.text || rendered.memoryIds.length === 0) return void 0;
+    try {
+      await memory.recordInjection?.(rendered.memoryIds, "subagent_audience", sessionId);
+    } catch {
+    }
+    return formatMemoryEvidenceBlock("sage.subagent-audience", rendered.text);
   } catch {
-    return [];
+    return void 0;
   }
 }
+var SUBAGENT_AUDIENCE_MEMORY_CHARS = 4e3;
 
 // src/fleet/host-session-writer.ts
 import { stampAgentId } from "@wrongstack/core/storage";
@@ -3592,13 +3605,7 @@ ${message} Falling back to the assigned checkout.` : `${message} Falling back to
       task?.context,
       owningSessionId
     );
-    if (audienceMemory.length > 0) {
-      baseSystem.push({
-        type: "text",
-        text: `Project memory for this agent role:
-${audienceMemory.map((text) => `- ${text}`).join("\n")}`
-      });
-    }
+    if (audienceMemory) baseSystem.push({ type: "text", text: audienceMemory });
     const skillResolution = await resolveHostSubagentSkillResolution(
       host.deps,
       host.roster,
@@ -21164,8 +21171,17 @@ async function applyDispatch(Sage, report) {
   let mergeFail = 0;
   for (const merge of report.merges.merges) {
     try {
-      await Sage.updateSage(merge.supersededId, { status: "superseded" });
-      await Sage.updateSage(merge.keeperId, { supersedes: [merge.supersededId] });
+      const keeper = await Sage.getSage(merge.keeperId);
+      if (!keeper || keeper.status !== "active" && keeper.status !== "stale") {
+        throw new Error(`keeper ${merge.keeperId} is no longer active`);
+      }
+      await Sage.updateSage(merge.supersededId, {
+        status: "superseded",
+        supersededBy: merge.keeperId
+      });
+      await Sage.updateSage(merge.keeperId, {
+        supersedes: [.../* @__PURE__ */ new Set([...keeper.supersedes ?? [], merge.supersededId])]
+      });
       mergeOk++;
     } catch (err) {
       mergeFail++;
@@ -21444,12 +21460,58 @@ function buildMemoryCommand(opts) {
         case "candidates": {
           if (!Sage) return requiresSage("candidates");
           const action = rest[0]?.toLowerCase() ?? "list";
+          if (action === "resolve") {
+            const decision = rest[2]?.toLowerCase();
+            if (!rest[1] || decision !== "delete" && decision !== "archive" && decision !== "keep") {
+              return {
+                message: "Usage: /memory candidates resolve <candidate-id> delete|archive|keep [reason]"
+              };
+            }
+            try {
+              const resolution = await Sage.resolveCandidate(
+                rest[1],
+                decision,
+                rest.slice(3).join(" ") || void 0
+              );
+              if (!resolution) return { message: `Candidate ${rest[1]} was not found.` };
+              if (resolution.error) {
+                return { message: `Could not resolve ${rest[1]}: ${resolution.error}` };
+              }
+              return {
+                message: `Resolved ${rest[1]}: ${decision}${resolution.applied ? "" : " (target memory unchanged)"}.`
+              };
+            } catch (error) {
+              return {
+                message: `Could not resolve ${rest[1]}: ${error instanceof Error ? error.message : String(error)}`
+              };
+            }
+          }
           if (action === "accept") {
             if (!rest[1]) return { message: "Usage: /memory candidates accept <candidate-id>" };
-            const accepted = await Sage.acceptCandidate(rest[1]);
-            return {
-              message: accepted ? `Accepted ${rest[1]} as ${accepted.id}.` : `Candidate ${rest[1]} was not found.`
-            };
+            try {
+              const review = (await Sage.listCandidates(false)).find(
+                (c) => c.id === rest[1] && c.kind === "memory_review"
+              );
+              if (review) {
+                const decision = review.suggestedAction === "archive" ? "archive" : "delete";
+                const resolution = await Sage.resolveCandidate(rest[1], decision);
+                if (!resolution) return { message: `Candidate ${rest[1]} was not found.` };
+                if (resolution.error) {
+                  return { message: `Could not accept ${rest[1]}: ${resolution.error}` };
+                }
+                return {
+                  message: `Accepted review ${rest[1]}: ${decision}${resolution.applied ? "" : " (target memory unchanged)"}.`
+                };
+              }
+              const accepted = await Sage.acceptCandidate(rest[1]);
+              return {
+                message: accepted ? `Accepted ${rest[1]} as ${accepted.id}.` : `Candidate ${rest[1]} was not found.`
+              };
+            } catch (error) {
+              return {
+                message: `Could not accept ${rest[1]}: ${error instanceof Error ? error.message : String(error)}`
+              };
+            }
           }
           if (action === "reject") {
             if (!rest[1])
@@ -31525,7 +31587,8 @@ function buildTodosCommand(opts) {
             ];
             const result = await updateTodos(nextTodos);
             const projected = ctx.todos.find((todo) => todo.id === doneItem.id);
-            if (isManagedProjection(doneItem) && projected?.status !== "completed") {
+            const completedAndCleared = ctx.todos.length === 0 && !result.kanban_warnings?.length;
+            if (isManagedProjection(doneItem) && projected?.status !== "completed" && !completedAndCleared) {
               return {
                 message: result.kanban_warnings?.[0] ?? `Kanban kept ${doneItem.content} at ${projected?.status ?? "its current state"}.`
               };
@@ -38992,4 +39055,4 @@ export {
   CLI_VERSION,
   runInteractive
 };
-//# sourceMappingURL=cli-main-6LMQSS66.js.map
+//# sourceMappingURL=cli-main-6JWASRH2.js.map

package/dist/fleet/host-context.d.ts

@@ -19,5 +19,5 @@ export declare function retrieveHostSubagentMemory(deps: MultiAgentDeps, getLead
  * without it every background tab's memory reads were recorded against a
  * conversation that never made them.
  */
-owningSessionId?: string): Promise<string[]>;
+owningSessionId?: string): Promise<string | undefined>;
 //# sourceMappingURL=host-context.d.ts.map

package/dist/{hq-NO2NWGU4.js → hq-O5BOP6UY.js}

@@ -68,7 +68,7 @@ var hqCmd = async (args, deps) => {
   return 1;
 };
 async function startServer(deps) {
-  const { startHqServer } = await import("./hq-server-KE5YDNGG.js");
+  const { startHqServer } = await import("./hq-server-YW4MJCKH.js");
   const dataDir = resolveDataDir(deps);
   const flags = deps.flags ?? {};
   const rawPublicUrl = typeof flags["hq-public-url"] === "string" ? flags["hq-public-url"] : process.env.WRONGSTACK_HQ_PUBLIC_URL;
@@ -538,6 +538,16 @@ async function tokenList(args, deps) {
   });
   const tokens = authFile[tokenField] ?? [];
   if (tokens.length === 0) {
+    const browserCredential = authFile.passwordHash !== void 0 || (authFile.browserTokens ?? []).length > 0;
+    if (scope === "client" && browserCredential) {
+      deps.renderer.write(
+        "No client tokens issued. HQ has a browser credential, so /ws/client REJECTS every publisher.\n"
+      );
+      deps.renderer.write(
+        "Run `wstack hq token create --client [label]` to let publishers connect.\n"
+      );
+      return 0;
+    }
     deps.renderer.write(
       `No ${scope} tokens issued. ${scope === "browser" ? "Browsers" : "Clients"} are in OPEN MODE.
 `
@@ -977,4 +987,4 @@ export {
   hqCmd,
   resolveAuditActor
 };
-//# sourceMappingURL=hq-NO2NWGU4.js.map
+//# sourceMappingURL=hq-O5BOP6UY.js.map

package/dist/hq-server/auth.d.ts

@@ -91,6 +91,16 @@ export declare function hqAuthRequired(mutableAuth: HqRouterMutableAuth, require
  * which are a separate set from the browser tokens, but the same fail-closed
  * floor applies: an all-expired client-token file must not mean "no auth
  * configured, let anyone register as a session".
+ *
+ * WS-2026-09-15-01: this used to be `requireAuthFloor || clientTokens.size > 0`.
+ * The floor only latches in true open mode (no password, no browser token), so
+ * a password-protected HQ on a network bind whose client tokens had all expired
+ * or been revoked accepted a tokenless `/ws/client` — and `client.hello` then
+ * granted every capability the socket declared, `control.approve` included.
+ * OPEN MODE is "no credential of any kind" (SECURITY.md); once HQ holds ANY
+ * browser credential, the publisher channel must present a client token too.
+ * A loopback exemption is deliberately absent: `--tunnel` and reverse proxies
+ * deliver remote traffic from 127.0.0.1.
  */
 export declare function hqClientAuthRequired(mutableAuth: HqRouterMutableAuth): boolean;
 /**

package/dist/{hq-server-KE5YDNGG.js → hq-server-YW4MJCKH.js}

@@ -10,7 +10,7 @@ import {
   readLocalSubagentTranscript,
   sanitizeApiError,
   startHqServer
-} from "./chunk-YRC3I3LE.js";
+} from "./chunk-MZY6UDWC.js";
 import "./chunk-HXJYHAR4.js";
 import "./chunk-5EA6OTLJ.js";
 import "./chunk-Q7E3BPDU.js";
@@ -27,4 +27,4 @@ export {
   sanitizeApiError,
   startHqServer
 };
-//# sourceMappingURL=hq-server-KE5YDNGG.js.map
+//# sourceMappingURL=hq-server-YW4MJCKH.js.map

package/dist/index.js

@@ -16,14 +16,14 @@ async function main(argv) {
   applySessionShellDefault();
   const earlyFlags = parseArgs(argv).flags;
   if (earlyFlags["help"] === true || earlyFlags["version"] === true) {
-    const { handleHelpVersionShortCircuit } = await import("./short-circuit-flags-72E77TJI.js");
+    const { handleHelpVersionShortCircuit } = await import("./short-circuit-flags-T6EFG3W6.js");
     const earlyExit = await handleHelpVersionShortCircuit(argv);
     if (earlyExit !== null) return earlyExit;
   }
-  const { initializeCli } = await import("./cli-context-5IF7ZYEY.js");
+  const { initializeCli } = await import("./cli-context-6MTVFJPO.js");
   const cliCtx = await initializeCli(argv);
   if (typeof cliCtx === "number") return cliCtx;
-  const { runInteractive } = await import("./cli-main-6LMQSS66.js");
+  const { runInteractive } = await import("./cli-main-6JWASRH2.js");
   return runInteractive(cliCtx);
 }
 
@@ -31,7 +31,12 @@ async function main(argv) {
 import { resolve } from "node:path";
 import { pathToFileURL } from "node:url";
 import { scrubErrorText } from "@wrongstack/core/security";
-import { installCrashShield, runFatalSalvageSync, writeErr } from "@wrongstack/core/utils";
+import {
+  hardenWin32ExecutableSearch,
+  installCrashShield,
+  runFatalSalvageSync,
+  writeErr
+} from "@wrongstack/core/utils";
 var SQLITE_WARNING_RE = /sqlite is an experimental feature/i;
 function installSqliteWarningFilter() {
   const originalEmit = process.emitWarning.bind(process);
@@ -119,6 +124,7 @@ function runAsMain(mainFn) {
   if (!isMain) return;
   installBrokenPipeHandlers();
   installCrashShield();
+  hardenWin32ExecutableSearch();
   process.on("exit", () => {
     runFatalSalvageSync();
   });

package/dist/{short-circuit-flags-72E77TJI.js → short-circuit-flags-T6EFG3W6.js}

@@ -1,10 +1,10 @@
 import {
   handleHelpVersionShortCircuit
-} from "./chunk-TNZBQG45.js";
+} from "./chunk-DUF5FEWD.js";
 import "./chunk-6WRKAACA.js";
 import "./chunk-XJXDOF63.js";
 import "./chunk-C3Z4N6A6.js";
 export {
   handleHelpVersionShortCircuit
 };
-//# sourceMappingURL=short-circuit-flags-72E77TJI.js.map
+//# sourceMappingURL=short-circuit-flags-T6EFG3W6.js.map

package/dist/{subcommands-EJI7DBQS.js → subcommands-3ILCNR2T.js}

@@ -1,9 +1,9 @@
 import {
   subcommandNames,
   subcommands
-} from "./chunk-OJR7K3OI.js";
+} from "./chunk-U3PDQOYU.js";
 export {
   subcommandNames,
   subcommands
 };
-//# sourceMappingURL=subcommands-EJI7DBQS.js.map
+//# sourceMappingURL=subcommands-3ILCNR2T.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrongstack/cli",
-  "version": "1.0.12",
+  "version": "1.0.14",
   "license": "MIT",
   "description": "WrongStack CLI — terminal AI coding agent with provider catalog from models.dev. Provides `wrongstack` and `wstack` binaries.",
   "keywords": [
@@ -41,36 +41,36 @@
     "data"
   ],
   "dependencies": {
-    "@wrongstack/acp": "1.0.12",
-    "@wrongstack/bench": "1.0.12",
-    "@wrongstack/core": "1.0.12",
-    "@wrongstack/kanban": "1.0.12",
-    "@wrongstack/mcp": "1.0.12",
-    "@wrongstack/persistence": "1.0.12",
-    "@wrongstack/plug-lsp": "1.0.12",
-    "@wrongstack/plugins": "1.0.12",
-    "@wrongstack/primitives": "1.0.12",
-    "@wrongstack/providers": "1.0.12",
-    "@wrongstack/requirement-intake": "1.0.12",
-    "@wrongstack/runtime": "1.0.12",
-    "@wrongstack/sage": "1.0.12",
-    "@wrongstack/sdd": "1.0.12",
-    "@wrongstack/security-scanner": "1.0.12",
-    "@wrongstack/simpleui": "1.0.12",
-    "@wrongstack/techstack": "1.0.12",
-    "@wrongstack/telegram": "1.0.12",
-    "@wrongstack/tools": "1.0.12",
-    "@wrongstack/tui": "1.0.12",
-    "@wrongstack/vector-memory": "1.0.12",
-    "@wrongstack/webui": "1.0.12",
-    "@wrongstack/webui-hq": "1.0.12",
-    "@wrongstack/webui-protocol": "1.0.12",
-    "@wrongstack/webui-server": "1.0.12",
-    "@wrongstack/wrongtrace": "1.0.12",
+    "@wrongstack/acp": "1.0.14",
+    "@wrongstack/bench": "1.0.14",
+    "@wrongstack/core": "1.0.14",
+    "@wrongstack/kanban": "1.0.14",
+    "@wrongstack/mcp": "1.0.14",
+    "@wrongstack/persistence": "1.0.14",
+    "@wrongstack/plug-lsp": "1.0.14",
+    "@wrongstack/plugins": "1.0.14",
+    "@wrongstack/primitives": "1.0.14",
+    "@wrongstack/providers": "1.0.14",
+    "@wrongstack/requirement-intake": "1.0.14",
+    "@wrongstack/runtime": "1.0.14",
+    "@wrongstack/sage": "1.0.14",
+    "@wrongstack/sdd": "1.0.14",
+    "@wrongstack/security-scanner": "1.0.14",
+    "@wrongstack/simpleui": "1.0.14",
+    "@wrongstack/techstack": "1.0.14",
+    "@wrongstack/telegram": "1.0.14",
+    "@wrongstack/tools": "1.0.14",
+    "@wrongstack/tui": "1.0.14",
+    "@wrongstack/vector-memory": "1.0.14",
+    "@wrongstack/webui": "1.0.14",
+    "@wrongstack/webui-hq": "1.0.14",
+    "@wrongstack/webui-protocol": "1.0.14",
+    "@wrongstack/webui-server": "1.0.14",
+    "@wrongstack/wrongtrace": "1.0.14",
     "ws": "^8.21.3"
   },
   "optionalDependencies": {
-    "@wrongstack/desktop": "1.0.12"
+    "@wrongstack/desktop": "1.0.14"
   },
   "devDependencies": {
     "@types/node": "^26.5.1",