@wrongstack/cli 1.0.17 → 1.0.24

package/dist/{chunk-K5PAL6KR.js → chunk-DRM7PSW7.js}

@@ -33,7 +33,7 @@ import {
 import { randomUUID as randomUUID6 } from "node:crypto";
 import * as fs4 from "node:fs/promises";
 import * as http from "node:http";
-import * as path7 from "node:path";
+import * as path8 from "node:path";
 import { getSharedProjectMailbox } from "@wrongstack/core/coordination";
 import {
   assessHqExposure as assessHqExposure2,
@@ -635,12 +635,13 @@ import {
   MailboxEventEmitter,
   MailboxHttpRateLimiter
 } from "@wrongstack/core/coordination";
-import * as path5 from "node:path";
+import * as path6 from "node:path";
 
 // src/hq-static-serve.ts
 import * as fs2 from "node:fs";
 import { createRequire } from "node:module";
 import * as path2 from "node:path";
+import { wrongstackPackageJsonPath } from "@wrongstack/core/utils";
 var requireFromHere = createRequire(import.meta.url);
 var MIME = {
   ".html": "text/html; charset=utf-8",
@@ -660,7 +661,10 @@ var cachedDistDir;
 function resolveHqDistDir() {
   if (cachedDistDir !== void 0) return cachedDistDir;
   try {
-    const pkgJson = requireFromHere.resolve("@wrongstack/webui-hq/package.json");
+    const pkgJson = wrongstackPackageJsonPath(
+      "@wrongstack/webui-hq",
+      (id) => requireFromHere.resolve(id)
+    );
     const dist = path2.join(path2.dirname(pkgJson), "dist");
     if (fs2.existsSync(path2.join(dist, "index.html"))) {
       cachedDistDir = dist;
@@ -687,7 +691,7 @@ function resolveHqDistDir() {
 }
 function isInsideDist(filePath, distDir) {
   const rel = path2.relative(distDir, filePath);
-  return rel !== "" && !rel.startsWith("..") && !path2.isAbsolute(rel);
+  return rel !== "" && rel !== ".." && !rel.startsWith(`..${path2.sep}`) && !path2.isAbsolute(rel);
 }
 function isMissingPath(error) {
   const code = error.code;
@@ -2165,11 +2169,24 @@ async function authorizeHqCommand(input) {
 }
 
 // src/hq-server/routes/mailbox-handlers.ts
-import * as path3 from "node:path";
+import * as path4 from "node:path";
 import { resolveProjectDir } from "@wrongstack/core/coordination";
 
 // src/hq-server/project-root.ts
+import * as fsp from "node:fs/promises";
+import * as path3 from "node:path";
 import { deriveHqProjectId } from "@wrongstack/core/hq";
+function isPlainSegment(value) {
+  return value.length > 0 && value !== "." && value !== ".." && !value.includes("/") && !value.includes("\\") && !path3.isAbsolute(value);
+}
+async function projectDirectoryExists(globalRoot, projectId) {
+  if (!isPlainSegment(projectId)) return false;
+  try {
+    return (await fsp.stat(path3.join(globalRoot, "projects", projectId))).isDirectory();
+  } catch {
+    return false;
+  }
+}
 function resolveHqProjectRoot(globalRoot, ids) {
   const fn = async () => {
     const { getSessionRegistry } = await import("@wrongstack/core/storage");
@@ -2177,7 +2194,7 @@ function resolveHqProjectRoot(globalRoot, ids) {
       const registry = getSessionRegistry(globalRoot);
       if (typeof ids.sessionId === "string") {
         const entry = await registry.get(ids.sessionId).catch(() => null);
-        if (entry?.projectRoot) return entry.projectRoot;
+        if (entry?.projectRoot) return { status: "found", projectRoot: entry.projectRoot };
       }
       if (typeof ids.projectId === "string") {
         const { createHash: createHash2 } = await import("node:crypto");
@@ -2193,11 +2210,15 @@ function resolveHqProjectRoot(globalRoot, ids) {
         const match = all.find(
           (e) => e.projectSlug === ids.projectId || projectIdForRoot(e.projectRoot) === ids.projectId || createHash2("sha256").update(e.projectRoot).digest("hex").slice(0, 12) === ids.projectId
         );
-        if (match) return match.projectRoot;
+        if (match) return { status: "found", projectRoot: match.projectRoot };
+        if (await projectDirectoryExists(globalRoot, ids.projectId)) {
+          return { status: "unavailable" };
+        }
       }
     } catch {
+      return { status: "unavailable" };
     }
-    return void 0;
+    return { status: "unknown" };
   };
   return fn();
 }
@@ -2221,7 +2242,7 @@ async function handleMailboxGateway(_req, res, match, authorizeMailboxGateway, g
     );
     return;
   }
-  const gatewayGlobalRoot = path3.dirname(dataDir);
+  const gatewayGlobalRoot = path4.dirname(dataDir);
   const preliminaryAccess = authorizeMailboxGateway(_req, `project:${projectId}`);
   if (!preliminaryAccess.allowed) {
     res.writeHead(preliminaryAccess.status ?? 401, {
@@ -2231,14 +2252,27 @@ async function handleMailboxGateway(_req, res, match, authorizeMailboxGateway, g
     res.end(JSON.stringify(preliminaryAccess.body));
     return;
   }
-  const projectRoot = await resolveHqProjectRoot(gatewayGlobalRoot, { projectId });
-  if (!projectRoot) {
+  const resolution = await resolveHqProjectRoot(gatewayGlobalRoot, { projectId });
+  if (resolution.status === "unavailable") {
+    res.writeHead(503, { "Content-Type": "application/json", "Retry-After": "1" });
+    res.end(
+      JSON.stringify({
+        error: {
+          code: "UNAVAILABLE",
+          message: `Project ${projectId} is not reachable right now; retry shortly.`
+        }
+      })
+    );
+    return;
+  }
+  if (resolution.status !== "found") {
     res.writeHead(404, { "Content-Type": "application/json" });
     res.end(
       JSON.stringify({ error: { code: "NOT_FOUND", message: `Unknown project: ${projectId}` } })
     );
     return;
   }
+  const projectRoot = resolution.projectRoot;
   const suffix = match[2];
   const rawUrl = _req.url ?? "";
   const queryIndex = rawUrl.indexOf("?");
@@ -2287,16 +2321,22 @@ async function handleApiMailboxSend(_req, res, mutableAuth, sessions, dataDir, g
     res.end(JSON.stringify({ error: "audience must be all or leaders" }));
     return;
   }
-  const mbGlobalRoot = path3.dirname(dataDir);
-  const projectRoot = await resolveHqProjectRoot(mbGlobalRoot, {
+  const mbGlobalRoot = path4.dirname(dataDir);
+  const mbResolution = await resolveHqProjectRoot(mbGlobalRoot, {
     sessionId: mbody.sessionId,
     projectId: mbody.projectId
   });
-  if (typeof projectRoot !== "string" || projectRoot.length === 0) {
+  if (mbResolution.status === "unavailable") {
+    res.writeHead(503, { "Content-Type": "application/json", "Retry-After": "1" });
+    res.end(JSON.stringify({ error: "target project mailbox is not reachable right now" }));
+    return;
+  }
+  if (mbResolution.status !== "found" || mbResolution.projectRoot.length === 0) {
     res.writeHead(404, { "Content-Type": "application/json" });
     res.end(JSON.stringify({ error: "could not resolve target project mailbox" }));
     return;
   }
+  const projectRoot = mbResolution.projectRoot;
   const to = typeof mbody.to === "string" ? mbody.to : "leader";
   const subject = typeof mbody.subject === "string" ? mbody.subject : "HQ prompt";
   const priority = mbody.priority === "high" ? "high" : mbody.priority === "low" ? "low" : "normal";
@@ -2407,16 +2447,22 @@ async function handleMailboxAction(_req, res, match, mutableAuth, sessions, data
     res.end(JSON.stringify({ error: "missing sessionId or projectId" }));
     return;
   }
-  const actGlobalRoot = path3.dirname(dataDir);
-  const projectRoot = await resolveHqProjectRoot(actGlobalRoot, {
+  const actGlobalRoot = path4.dirname(dataDir);
+  const actResolution = await resolveHqProjectRoot(actGlobalRoot, {
     sessionId: abody.sessionId,
     projectId: abody.projectId
   });
-  if (typeof projectRoot !== "string" || projectRoot.length === 0) {
+  if (actResolution.status === "unavailable") {
+    res.writeHead(503, { "Content-Type": "application/json", "Retry-After": "1" });
+    res.end(JSON.stringify({ error: "target project mailbox is not reachable right now" }));
+    return;
+  }
+  if (actResolution.status !== "found" || actResolution.projectRoot.length === 0) {
     res.writeHead(404, { "Content-Type": "application/json" });
     res.end(JSON.stringify({ error: "could not resolve target project mailbox" }));
     return;
   }
+  const projectRoot = actResolution.projectRoot;
   try {
     const { actionToAckInput } = await import("@wrongstack/core/coordination");
     const projectDir = resolveProjectDir(projectRoot, actGlobalRoot);
@@ -2647,14 +2693,14 @@ async function handleApiTrendsCost(req, res, persistence) {
 }
 
 // src/hq-server/routes/session-handlers.ts
-import * as path4 from "node:path";
+import * as path5 from "node:path";
 import {
   buildTranscriptFromEvents,
   resolveHqDataDir
 } from "@wrongstack/core/hq";
 async function handleApiSessions(res) {
   const { getSessionRegistry } = await import("@wrongstack/core/storage");
-  const globalRoot = path4.dirname(resolveHqDataDir());
+  const globalRoot = path5.dirname(resolveHqDataDir());
   try {
     const registry = getSessionRegistry(globalRoot);
     const sessions = await registry.list();
@@ -2699,7 +2745,7 @@ async function handleApiSessionEvents(req, res, match, transcripts) {
     res.end(JSON.stringify({ error: "invalid sessionId encoding" }));
     return;
   }
-  const globalRoot = path4.dirname(resolveHqDataDir());
+  const globalRoot = path5.dirname(resolveHqDataDir());
   try {
     const registry = getSessionRegistry(globalRoot);
     const entry = await registry.get(sessionId).catch(() => null);
@@ -2801,8 +2847,8 @@ async function handleApiAgentMessages(req, res, match, agentMessages) {
 // src/hq-server/routes/system-handlers.ts
 async function handleApiSystemUpdate(res) {
   const [{ checkForUpdate }, { detectUpdatePackageName }] = await Promise.all([
-    import("./update-check-BS3DHTSI.js"),
-    import("./update-5DPB4YD4.js")
+    import("./update-check-2POMBHFB.js"),
+    import("./update-7XIOEXTD.js")
   ]);
   const packageName = detectUpdatePackageName();
   const info = await checkForUpdate({ packageName });
@@ -3430,7 +3476,7 @@ var MailboxGatewayManager = class {
       const lastUsed = this.mailboxGatewayLastUsed.get(projectDir);
       gateways.push({
         // projectId = basename(projectDir) — matches the credential contract.
-        projectId: path5.basename(projectDir),
+        projectId: path6.basename(projectDir),
         projectRoot: projectDir,
         hasActiveStreams: gateway.router.hasActiveStreams(),
         lastUsedAt: typeof lastUsed === "number" ? lastUsed : null,
@@ -3520,7 +3566,7 @@ async function prepareHqServerStart(options, defaults) {
 
 // src/hq-server/startup.ts
 import * as fs3 from "node:fs/promises";
-import * as path6 from "node:path";
+import * as path7 from "node:path";
 import { writeHqRuntimeFile } from "@wrongstack/core/hq";
 var hqRuntimeMarkerPath2 = hqRuntimeMarkerPath;
 async function writeHqRuntimeMarker(dataDir, url) {
@@ -3601,7 +3647,7 @@ HQ auth loaded from ${startup.dataDir}
   if (startup.clientEnv.WRONGSTACK_HQ_TOKEN) {
     write(`  WRONGSTACK_HQ_TOKEN=${startup.clientEnv.WRONGSTACK_HQ_TOKEN}
 `);
-    write(`Credentials are stored in ${path6.join(startup.dataDir, "auth.json")}
+    write(`Credentials are stored in ${path7.join(startup.dataDir, "auth.json")}
 `);
   }
   writeHqLanEndpoints(write, handle, void 0);
@@ -4731,12 +4777,12 @@ async function startHqServerWithAuth(options, host, port, dataDir, firstRunAuth)
     const persistence = createHqPersistence(dataDir);
     const auditLog = new HqCommandAuditLog(1e3, (entry) => persistence.commandLog.append(entry));
     void (async () => {
-      const projectsDir = path7.join(path7.dirname(dataDir), "projects");
+      const projectsDir = path8.join(path8.dirname(dataDir), "projects");
       const entries = await fs4.readdir(projectsDir, { withFileTypes: true }).catch(() => []);
       await Promise.all(
         entries.filter((entry) => entry.isDirectory()).map(async (entry) => {
-          const projectDir = path7.join(projectsDir, entry.name);
-          const metadataPath = path7.join(projectDir, ".mailbox-server.json");
+          const projectDir = path8.join(projectsDir, entry.name);
+          const metadataPath = path8.join(projectDir, ".mailbox-server.json");
           const ownerPid = await fs4.readFile(metadataPath, "utf8").then((raw) => JSON.parse(raw).pid).catch(() => void 0);
           if (ownerPid === void 0) return;
           let ownerAlive = false;
@@ -5104,4 +5150,4 @@ export {
   startHqServer,
   HqInsecureExposureError2 as HqInsecureExposureError
 };
-//# sourceMappingURL=chunk-K5PAL6KR.js.map
+//# sourceMappingURL=chunk-DRM7PSW7.js.map

package/dist/{chunk-XJ7K67PP.js → chunk-JF2MULWF.js}

@@ -4,7 +4,7 @@ import {
 import {
   PLUGIN_AUDIT_ENTRIES,
   loadExternalPlugins
-} from "./chunk-SIS37L3W.js";
+} from "./chunk-L2RVEQWO.js";
 
 // src/wiring/plugins.ts
 import { join } from "node:path";
@@ -20,7 +20,21 @@ function createApi(ownerName, base) {
 // src/wiring/plugins.ts
 var DEPRECATED_PLUGIN_NAMES = {
   "web-search": "use the built-in `search` and `fetch` tools",
-  "json-path": "use the built-in `json` tool with action: query | validate | transform | merge"
+  "json-path": "use the built-in `json` tool with action: query | validate | transform | merge",
+  // Deleted in the 2026-09-17 catalog review. The first four produced
+  // findings that were noise by construction (each was run against this
+  // repo and mis-reported); the rest duplicated infrastructure the host
+  // already ships. Kept here so an existing config that still lists one
+  // warns and skips instead of failing to resolve the import.
+  "interface-contract-guard": "removed \u2014 it reported plain data interfaces as unimplemented",
+  "refactor-suggester": "removed \u2014 use `lint-gate` plus the built-in `grep` and `read` tools",
+  "feature-flag-tracker": "removed \u2014 use the built-in `grep` tool with your own flag pattern",
+  "dead-code-detector": "removed \u2014 use your linter / `tsc` and `duplicate-code-detector`",
+  "semantic-search-indexer": "use the built-in `grep` tool or the codebase-index MCP server",
+  "knowledge-graph": "use the built-in `remember` / `search_memory` / `find_related_memories`",
+  "todo-tracker": "use the built-in `todo` tool and the Kanban board",
+  "smart-rename": "use the built-in `replace` tool",
+  "code-metrics": "removed \u2014 it reported numbers nothing acted on"
 };
 var deprecatedWarningsEmitted = /* @__PURE__ */ new Set();
 var BUILTIN_PLUGIN_CONFIG_ALIASES = {
@@ -171,13 +185,6 @@ async function setupPlugins(params) {
   if (allPlugins.length === 0) return;
   const pluginOptions = buildPluginOptions(config, allPlugins);
   if (paths?.projectDir) {
-    if (pluginOptions["todo-tracker"] === void 0) {
-      pluginOptions["todo-tracker"] = {};
-    }
-    const todoTrackerOpts = pluginOptions["todo-tracker"];
-    if (typeof todoTrackerOpts["filePath"] !== "string" || todoTrackerOpts["filePath"] === "") {
-      todoTrackerOpts["filePath"] = join(paths.projectDir, "todo-tracker.json");
-    }
     const contextPinsOpts = pluginOptions["context-pins"] ?? {};
     pluginOptions["context-pins"] = contextPinsOpts;
     if (typeof contextPinsOpts["filePath"] !== "string" || contextPinsOpts["filePath"] === "") {
@@ -267,4 +274,4 @@ export {
   BUILTIN_PLUGIN_FACTORIES,
   setupPlugins
 };
-//# sourceMappingURL=chunk-XJ7K67PP.js.map
+//# sourceMappingURL=chunk-JF2MULWF.js.map