@wrongstack/cli 1.0.13 → 1.0.14

package/dist/{chunk-TNZBQG45.js → chunk-DUF5FEWD.js}

@@ -22,7 +22,7 @@ async function handleHelpVersionShortCircuit(argv) {
   }
   if (earlyFlags["help"] === true) {
     if (positional.length > 0) {
-      const { subcommandNames } = await import("./subcommands-EJI7DBQS.js");
+      const { subcommandNames } = await import("./subcommands-3ILCNR2T.js");
       if (subcommandNames.includes(positional[0])) {
         const first = positional[0];
         const deep = positional[1];
@@ -43,4 +43,4 @@ async function handleHelpVersionShortCircuit(argv) {
 export {
   handleHelpVersionShortCircuit
 };
-//# sourceMappingURL=chunk-TNZBQG45.js.map
+//# sourceMappingURL=chunk-DUF5FEWD.js.map

package/dist/{chunk-YRC3I3LE.js → chunk-MZY6UDWC.js}

@@ -231,7 +231,7 @@ function hqAuthRequired(mutableAuth, requireBrowserAuth) {
   return (requireBrowserAuth ?? mutableAuth.requireBrowserAuth) === true || mutableAuth.requireAuthFloor === true || mutableAuth.browserTokens.size > 0 || mutableAuth.passwordHash !== void 0;
 }
 function hqClientAuthRequired(mutableAuth) {
-  return mutableAuth.requireAuthFloor === true || mutableAuth.clientTokens.size > 0;
+  return mutableAuth.clientTokens.size > 0 || hqAuthRequired(mutableAuth);
 }
 function extractBrowserToken(req, url) {
   const queryToken = url.searchParams.get("token");
@@ -4880,8 +4880,19 @@ async function startHqServerWithAuth(options, host, port, dataDir, firstRunAuth)
       bootstrapStore
     };
     const handleRequest = createHqRouter(routerDeps);
+    const closeSocketsOfRemovedSessions = (before) => {
+      for (const [browser, sessionId] of browserSocketSessions) {
+        if (!before.has(sessionId) || sessions.has(sessionId)) continue;
+        if (browser.readyState === WebSocket3.OPEN) {
+          browser.close(1008, "Browser session revoked");
+        }
+      }
+    };
     const httpServer = http.createServer((req, res) => {
-      void handleRequest(req, res);
+      const sessionsBefore = sessions.size > 0 ? new Set(sessions.keys()) : void 0;
+      void handleRequest(req, res).finally(() => {
+        if (sessionsBefore !== void 0) closeSocketsOfRemovedSessions(sessionsBefore);
+      });
     });
     const wss = new WebSocketServer({ noServer: true, maxPayload: 1 * 1024 * 1024 });
     const browserHeartbeatTimer = setInterval(() => {
@@ -5089,4 +5100,4 @@ export {
   startHqServer,
   HqInsecureExposureError2 as HqInsecureExposureError
 };
-//# sourceMappingURL=chunk-YRC3I3LE.js.map
+//# sourceMappingURL=chunk-MZY6UDWC.js.map

package/dist/{chunk-OJR7K3OI.js → chunk-U3PDQOYU.js}

@@ -31,7 +31,7 @@ var loaders = {
   quick: async () => (await import("./quick-CNB4Z3HS.js")).quickCmd,
   bench: async () => (await import("./bench-YBU6BVQP.js")).benchCmd,
   chronicle: async () => (await import("./chronicle-UTFETHP6.js")).chronicleCmd,
-  hq: async () => (await import("./hq-NO2NWGU4.js")).hqCmd,
+  hq: async () => (await import("./hq-O5BOP6UY.js")).hqCmd,
   mailbox: async () => (await import("./mailbox-serve-X3CR6VFW.js")).mailboxServeCmd,
   permissions: async () => (await import("./permissions-CFDLXETM.js")).permissionsCmd,
   project: async () => (await import("./project-AOQI5XTK.js")).projectCmd,
@@ -51,4 +51,4 @@ export {
   subcommands,
   subcommandNames
 };
-//# sourceMappingURL=chunk-OJR7K3OI.js.map
+//# sourceMappingURL=chunk-U3PDQOYU.js.map

package/dist/{cli-context-5IF7ZYEY.js → cli-context-6MTVFJPO.js}

@@ -19,17 +19,17 @@ import {
 } from "./chunk-GPPRNAKW.js";
 import {
   subcommands
-} from "./chunk-OJR7K3OI.js";
+} from "./chunk-U3PDQOYU.js";
 import {
   renderDeepHelp,
   renderFocusedHelp
 } from "./chunk-JX6KL7OF.js";
 import {
   handleHelpVersionShortCircuit
-} from "./chunk-TNZBQG45.js";
+} from "./chunk-DUF5FEWD.js";
 import {
   DEFAULT_PORT
-} from "./chunk-YRC3I3LE.js";
+} from "./chunk-MZY6UDWC.js";
 import "./chunk-HXJYHAR4.js";
 import {
   resolveHqPasswordInput
@@ -866,7 +866,7 @@ async function isPortInUse(host, port) {
 }
 async function handleHqShortCircuit(flags) {
   if (flags["hq"] !== true) return null;
-  const { startHqServer } = await import("./hq-server-KE5YDNGG.js");
+  const { startHqServer } = await import("./hq-server-YW4MJCKH.js");
   const tunnelRequested = flags["tunnel"] === true;
   const rawPublicUrl = typeof flags["hq-public-url"] === "string" ? flags["hq-public-url"] : process.env.WRONGSTACK_HQ_PUBLIC_URL;
   let publicOrigin;
@@ -3303,4 +3303,4 @@ async function initializeCli(argv) {
 export {
   initializeCli
 };
-//# sourceMappingURL=cli-context-5IF7ZYEY.js.map
+//# sourceMappingURL=cli-context-6MTVFJPO.js.map

package/dist/{hq-NO2NWGU4.js → hq-O5BOP6UY.js}

@@ -68,7 +68,7 @@ var hqCmd = async (args, deps) => {
   return 1;
 };
 async function startServer(deps) {
-  const { startHqServer } = await import("./hq-server-KE5YDNGG.js");
+  const { startHqServer } = await import("./hq-server-YW4MJCKH.js");
   const dataDir = resolveDataDir(deps);
   const flags = deps.flags ?? {};
   const rawPublicUrl = typeof flags["hq-public-url"] === "string" ? flags["hq-public-url"] : process.env.WRONGSTACK_HQ_PUBLIC_URL;
@@ -538,6 +538,16 @@ async function tokenList(args, deps) {
   });
   const tokens = authFile[tokenField] ?? [];
   if (tokens.length === 0) {
+    const browserCredential = authFile.passwordHash !== void 0 || (authFile.browserTokens ?? []).length > 0;
+    if (scope === "client" && browserCredential) {
+      deps.renderer.write(
+        "No client tokens issued. HQ has a browser credential, so /ws/client REJECTS every publisher.\n"
+      );
+      deps.renderer.write(
+        "Run `wstack hq token create --client [label]` to let publishers connect.\n"
+      );
+      return 0;
+    }
     deps.renderer.write(
       `No ${scope} tokens issued. ${scope === "browser" ? "Browsers" : "Clients"} are in OPEN MODE.
 `
@@ -977,4 +987,4 @@ export {
   hqCmd,
   resolveAuditActor
 };
-//# sourceMappingURL=hq-NO2NWGU4.js.map
+//# sourceMappingURL=hq-O5BOP6UY.js.map

package/dist/hq-server/auth.d.ts

@@ -91,6 +91,16 @@ export declare function hqAuthRequired(mutableAuth: HqRouterMutableAuth, require
  * which are a separate set from the browser tokens, but the same fail-closed
  * floor applies: an all-expired client-token file must not mean "no auth
  * configured, let anyone register as a session".
+ *
+ * WS-2026-09-15-01: this used to be `requireAuthFloor || clientTokens.size > 0`.
+ * The floor only latches in true open mode (no password, no browser token), so
+ * a password-protected HQ on a network bind whose client tokens had all expired
+ * or been revoked accepted a tokenless `/ws/client` — and `client.hello` then
+ * granted every capability the socket declared, `control.approve` included.
+ * OPEN MODE is "no credential of any kind" (SECURITY.md); once HQ holds ANY
+ * browser credential, the publisher channel must present a client token too.
+ * A loopback exemption is deliberately absent: `--tunnel` and reverse proxies
+ * deliver remote traffic from 127.0.0.1.
  */
 export declare function hqClientAuthRequired(mutableAuth: HqRouterMutableAuth): boolean;
 /**

package/dist/{hq-server-KE5YDNGG.js → hq-server-YW4MJCKH.js}

@@ -10,7 +10,7 @@ import {
   readLocalSubagentTranscript,
   sanitizeApiError,
   startHqServer
-} from "./chunk-YRC3I3LE.js";
+} from "./chunk-MZY6UDWC.js";
 import "./chunk-HXJYHAR4.js";
 import "./chunk-5EA6OTLJ.js";
 import "./chunk-Q7E3BPDU.js";
@@ -27,4 +27,4 @@ export {
   sanitizeApiError,
   startHqServer
 };
-//# sourceMappingURL=hq-server-KE5YDNGG.js.map
+//# sourceMappingURL=hq-server-YW4MJCKH.js.map

package/dist/index.js

@@ -16,11 +16,11 @@ async function main(argv) {
   applySessionShellDefault();
   const earlyFlags = parseArgs(argv).flags;
   if (earlyFlags["help"] === true || earlyFlags["version"] === true) {
-    const { handleHelpVersionShortCircuit } = await import("./short-circuit-flags-72E77TJI.js");
+    const { handleHelpVersionShortCircuit } = await import("./short-circuit-flags-T6EFG3W6.js");
     const earlyExit = await handleHelpVersionShortCircuit(argv);
     if (earlyExit !== null) return earlyExit;
   }
-  const { initializeCli } = await import("./cli-context-5IF7ZYEY.js");
+  const { initializeCli } = await import("./cli-context-6MTVFJPO.js");
   const cliCtx = await initializeCli(argv);
   if (typeof cliCtx === "number") return cliCtx;
   const { runInteractive } = await import("./cli-main-6JWASRH2.js");
@@ -31,7 +31,12 @@ async function main(argv) {
 import { resolve } from "node:path";
 import { pathToFileURL } from "node:url";
 import { scrubErrorText } from "@wrongstack/core/security";
-import { installCrashShield, runFatalSalvageSync, writeErr } from "@wrongstack/core/utils";
+import {
+  hardenWin32ExecutableSearch,
+  installCrashShield,
+  runFatalSalvageSync,
+  writeErr
+} from "@wrongstack/core/utils";
 var SQLITE_WARNING_RE = /sqlite is an experimental feature/i;
 function installSqliteWarningFilter() {
   const originalEmit = process.emitWarning.bind(process);
@@ -119,6 +124,7 @@ function runAsMain(mainFn) {
   if (!isMain) return;
   installBrokenPipeHandlers();
   installCrashShield();
+  hardenWin32ExecutableSearch();
   process.on("exit", () => {
     runFatalSalvageSync();
   });

package/dist/{short-circuit-flags-72E77TJI.js → short-circuit-flags-T6EFG3W6.js}

@@ -1,10 +1,10 @@
 import {
   handleHelpVersionShortCircuit
-} from "./chunk-TNZBQG45.js";
+} from "./chunk-DUF5FEWD.js";
 import "./chunk-6WRKAACA.js";
 import "./chunk-XJXDOF63.js";
 import "./chunk-C3Z4N6A6.js";
 export {
   handleHelpVersionShortCircuit
 };
-//# sourceMappingURL=short-circuit-flags-72E77TJI.js.map
+//# sourceMappingURL=short-circuit-flags-T6EFG3W6.js.map

package/dist/{subcommands-EJI7DBQS.js → subcommands-3ILCNR2T.js}

@@ -1,9 +1,9 @@
 import {
   subcommandNames,
   subcommands
-} from "./chunk-OJR7K3OI.js";
+} from "./chunk-U3PDQOYU.js";
 export {
   subcommandNames,
   subcommands
 };
-//# sourceMappingURL=subcommands-EJI7DBQS.js.map
+//# sourceMappingURL=subcommands-3ILCNR2T.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrongstack/cli",
-  "version": "1.0.13",
+  "version": "1.0.14",
   "license": "MIT",
   "description": "WrongStack CLI — terminal AI coding agent with provider catalog from models.dev. Provides `wrongstack` and `wstack` binaries.",
   "keywords": [
@@ -41,36 +41,36 @@
     "data"
   ],
   "dependencies": {
-    "@wrongstack/acp": "1.0.13",
-    "@wrongstack/bench": "1.0.13",
-    "@wrongstack/core": "1.0.13",
-    "@wrongstack/kanban": "1.0.13",
-    "@wrongstack/mcp": "1.0.13",
-    "@wrongstack/persistence": "1.0.13",
-    "@wrongstack/plug-lsp": "1.0.13",
-    "@wrongstack/plugins": "1.0.13",
-    "@wrongstack/primitives": "1.0.13",
-    "@wrongstack/providers": "1.0.13",
-    "@wrongstack/requirement-intake": "1.0.13",
-    "@wrongstack/runtime": "1.0.13",
-    "@wrongstack/sage": "1.0.13",
-    "@wrongstack/sdd": "1.0.13",
-    "@wrongstack/security-scanner": "1.0.13",
-    "@wrongstack/simpleui": "1.0.13",
-    "@wrongstack/techstack": "1.0.13",
-    "@wrongstack/telegram": "1.0.13",
-    "@wrongstack/tools": "1.0.13",
-    "@wrongstack/tui": "1.0.13",
-    "@wrongstack/vector-memory": "1.0.13",
-    "@wrongstack/webui": "1.0.13",
-    "@wrongstack/webui-hq": "1.0.13",
-    "@wrongstack/webui-protocol": "1.0.13",
-    "@wrongstack/webui-server": "1.0.13",
-    "@wrongstack/wrongtrace": "1.0.13",
+    "@wrongstack/acp": "1.0.14",
+    "@wrongstack/bench": "1.0.14",
+    "@wrongstack/core": "1.0.14",
+    "@wrongstack/kanban": "1.0.14",
+    "@wrongstack/mcp": "1.0.14",
+    "@wrongstack/persistence": "1.0.14",
+    "@wrongstack/plug-lsp": "1.0.14",
+    "@wrongstack/plugins": "1.0.14",
+    "@wrongstack/primitives": "1.0.14",
+    "@wrongstack/providers": "1.0.14",
+    "@wrongstack/requirement-intake": "1.0.14",
+    "@wrongstack/runtime": "1.0.14",
+    "@wrongstack/sage": "1.0.14",
+    "@wrongstack/sdd": "1.0.14",
+    "@wrongstack/security-scanner": "1.0.14",
+    "@wrongstack/simpleui": "1.0.14",
+    "@wrongstack/techstack": "1.0.14",
+    "@wrongstack/telegram": "1.0.14",
+    "@wrongstack/tools": "1.0.14",
+    "@wrongstack/tui": "1.0.14",
+    "@wrongstack/vector-memory": "1.0.14",
+    "@wrongstack/webui": "1.0.14",
+    "@wrongstack/webui-hq": "1.0.14",
+    "@wrongstack/webui-protocol": "1.0.14",
+    "@wrongstack/webui-server": "1.0.14",
+    "@wrongstack/wrongtrace": "1.0.14",
     "ws": "^8.21.3"
   },
   "optionalDependencies": {
-    "@wrongstack/desktop": "1.0.13"
+    "@wrongstack/desktop": "1.0.14"
   },
   "devDependencies": {
     "@types/node": "^26.5.1",