@wrongstack/cli 1.0.19 → 1.0.24

package/dist/{hq-XQWQTRDA.js → hq-JTUTFI4L.js}

@@ -13,29 +13,290 @@ import {
 } from "./chunk-Q7E3BPDU.js";
 
 // src/subcommands/handlers/hq.ts
-import * as fs from "node:fs/promises";
-import * as path from "node:path";
 import {
   HQ_AUTH_FILE_VERSION,
   HQ_CLI_DEFAULT_HOST,
-  HqAlertEngine,
   HqInsecureExposureError,
-  hqAuthAuditPath,
-  hqAuthContentHash,
-  hqAuthFilePath,
   isLoopbackHost,
   logHqAuthAudit,
   mintHqToken,
   mutateHqAuthFile,
-  readHqAlertsConfig,
-  readHqAuthFile,
-  resolveHqDataDir
+  readHqAuthFile as readHqAuthFile2
 } from "@wrongstack/core/hq";
 import { expectDefined } from "@wrongstack/core/utils";
+
+// src/subcommands/handlers/hq-alerts.ts
+import * as fs from "node:fs/promises";
+import * as path from "node:path";
+import {
+  HqAlertEngine,
+  readHqAlertsConfig
+} from "@wrongstack/core/hq";
+
+// src/subcommands/handlers/hq-data-dir.ts
+import { resolveHqDataDir } from "@wrongstack/core/hq";
 function resolveDataDir(deps) {
   const override = typeof deps.flags?.["data-dir"] === "string" ? deps.flags["data-dir"] : void 0;
   return resolveHqDataDir(override);
 }
+
+// src/subcommands/handlers/hq-alerts.ts
+async function hqAlertsCmd(args, deps) {
+  const action = args[0];
+  if (deps.flags?.["help"] === true || action === "help" || action === "--help") {
+    printAlertsHelp(deps);
+    return 0;
+  }
+  if (action === "eval" || action === void 0) {
+    return hqAlertsEval(args.slice(1), deps);
+  }
+  deps.renderer.writeError(`Unknown hq alerts subcommand: ${action ?? "(none)"}
+`);
+  printAlertsHelp(deps);
+  return 1;
+}
+async function hqAlertsEval(_args, deps) {
+  const flags = deps.flags ?? {};
+  const snapshotArg = typeof flags["snapshot"] === "string" ? flags["snapshot"] : void 0;
+  let snapshotPath;
+  try {
+    if (snapshotArg !== void 0) {
+      snapshotPath = path.resolve(snapshotArg);
+    } else {
+      const dataDir2 = resolveDataDir(deps);
+      snapshotPath = path.join(dataDir2, "snapshot.json");
+    }
+  } catch (err) {
+    deps.renderer.writeError(`Failed to resolve snapshot path: ${err.message}
+`);
+    return 2;
+  }
+  let raw;
+  try {
+    raw = await fs.readFile(snapshotPath, "utf8");
+  } catch (err) {
+    deps.renderer.writeError(
+      `Cannot read snapshot at ${snapshotPath}: ${err.message}
+Pass --snapshot <path> to evaluate against a specific file.
+`
+    );
+    return 2;
+  }
+  let snapshot;
+  try {
+    snapshot = JSON.parse(raw);
+  } catch (err) {
+    deps.renderer.writeError(
+      `Snapshot at ${snapshotPath} is not valid JSON: ${err.message}
+`
+    );
+    return 2;
+  }
+  const dataDir = resolveDataDir(deps);
+  let thresholds;
+  try {
+    const config = await readHqAlertsConfig(dataDir);
+    thresholds = config.thresholds;
+  } catch {
+  }
+  const engine = new HqAlertEngine({
+    onAlert: () => {
+    }
+  });
+  let fired;
+  try {
+    fired = engine.evaluate(snapshot, thresholds);
+  } catch (err) {
+    deps.renderer.writeError(`Alert evaluation failed: ${err.message}
+`);
+    return 2;
+  }
+  if (fired.length === 0) {
+    deps.renderer.write(`No alert rules fired against ${snapshotPath}.
+`);
+    if (thresholds === void 0) {
+      deps.renderer.write(
+        "(No persisted thresholds; using built-in defaults. Run `wstack hq alerts` with a populated alerts-config.json to override.)\n"
+      );
+    }
+    return 0;
+  }
+  deps.renderer.write(`${fired.length} alert rule(s) fired against ${snapshotPath}:
+`);
+  for (const alert of fired) {
+    deps.renderer.write(`  [${alert.severity}] ${alert.ruleId}: ${alert.message}
+`);
+  }
+  return 1;
+}
+function printAlertsHelp(deps) {
+  deps.renderer.write(`Usage: wstack hq alerts <eval>
+`);
+  deps.renderer.write("\n");
+  deps.renderer.write(
+    `  wstack hq alerts eval [--snapshot <path>]   Run HqAlertEngine.evaluate() against a
+`
+  );
+  deps.renderer.write(
+    `                                            snapshot file (or the live <dataDir>/
+`
+  );
+  deps.renderer.write(
+    `                                            snapshot.json). Pure-function dry run;
+`
+  );
+  deps.renderer.write(
+    `                                            no server required. Exits 0 when no
+`
+  );
+  deps.renderer.write(
+    `                                            rules fire, 1 when rules fire, 2 on errors.
+`
+  );
+  deps.renderer.write("\n");
+  deps.renderer.write(
+    `Persisted thresholds (<dataDir>/alerts-config.json) are loaded automatically when
+`
+  );
+  deps.renderer.write(
+    `present; otherwise the engine's built-in defaults apply. Snoozes are NOT honored
+`
+  );
+  deps.renderer.write(
+    `by this command \u2014 eval is a "what would fire RIGHT NOW if there were no snoozes"
+`
+  );
+  deps.renderer.write(`probe.
+`);
+  deps.renderer.write("\n");
+  deps.renderer.write(`Flags:
+`);
+  deps.renderer.write(
+    `  --snapshot <path>   Evaluate against this snapshot file instead of the live one.
+`
+  );
+  deps.renderer.write(
+    `  --data-dir <path>   Override HQ data directory (default ~/.wrongstack/hq).
+`
+  );
+  deps.renderer.write("\n");
+  deps.renderer.write(`Run \`wstack hq --help\` for the full HQ command list.
+`);
+}
+
+// src/subcommands/handlers/hq-audit.ts
+import * as fs2 from "node:fs/promises";
+import {
+  hqAuthAuditPath,
+  hqAuthContentHash,
+  hqAuthFilePath,
+  readHqAuthFile
+} from "@wrongstack/core/hq";
+async function hqAuditCmd(args, deps) {
+  const action = args[0];
+  if (deps.flags?.["help"] === true || action === "help" || action === "--help") {
+    printAuditHelp(deps);
+    return 0;
+  }
+  if (action === "verify" || action === void 0) {
+    return hqAuditVerify(deps);
+  }
+  deps.renderer.writeError(`Unknown hq audit subcommand: ${action ?? "(none)"}
+`);
+  printAuditHelp(deps);
+  return 1;
+}
+async function hqAuditVerify(deps) {
+  const dataDir = resolveDataDir(deps);
+  const authPath = hqAuthFilePath(dataDir);
+  const auditPath = hqAuthAuditPath(dataDir);
+  deps.renderer.write(`auth file:   ${authPath}
+`);
+  deps.renderer.write(`audit log:   ${auditPath}
+`);
+  const fileExists = await fileExistsQuiet(authPath);
+  if (!fileExists) {
+    deps.renderer.write(`contentHash: (unavailable \u2014 auth.json does not exist)
+`);
+    deps.renderer.write(
+      `Compare historical entries in the audit log above against a known-good hash.
+`
+    );
+    return 1;
+  }
+  const authFile = await readHqAuthFile(dataDir, {
+    warn: (msg) => deps.renderer.writeWarning(`${msg}
+`)
+  });
+  const hash = hqAuthContentHash(authFile);
+  if (hash === void 0) {
+    deps.renderer.write(`contentHash: (unavailable \u2014 auth.json is unreadable or malformed)
+`);
+    deps.renderer.write(
+      `Compare historical entries in the audit log above against a known-good hash.
+`
+    );
+    return 1;
+  }
+  deps.renderer.write(`contentHash: ${hash}
+`);
+  deps.renderer.write("\n");
+  deps.renderer.write(
+    `Compare this value against the 'contentHash' field of entries in the audit log.
+`
+  );
+  deps.renderer.write(
+    `A match means the redacted projection of auth.json is identical to when that
+`
+  );
+  deps.renderer.write(
+    `entry was emitted (secrets may differ \u2014 only the non-secret shape is hashed).
+`
+  );
+  return 0;
+}
+async function fileExistsQuiet(filePath) {
+  try {
+    await fs2.access(filePath);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function computeAuditHashField(dataDir, warn) {
+  const persisted = await readHqAuthFile(dataDir, { warn });
+  const hash = hqAuthContentHash(persisted);
+  return hash !== void 0 ? { contentHash: hash } : {};
+}
+function printAuditHelp(deps) {
+  deps.renderer.write(`Usage: wstack hq audit <verify>
+`);
+  deps.renderer.write("\n");
+  deps.renderer.write(
+    `  wstack hq audit verify   Re-derive the SHA-256 contentHash from the current
+`
+  );
+  deps.renderer.write(
+    `                           on-disk auth.json and print it so an operator can compare
+`
+  );
+  deps.renderer.write(
+    `                           it against a contentHash field in an audit-log entry.
+`
+  );
+  deps.renderer.write("\n");
+  deps.renderer.write(`Flags:
+`);
+  deps.renderer.write(
+    `  --data-dir <path>   Override HQ data directory (default ~/.wrongstack/hq).
+`
+  );
+  deps.renderer.write("\n");
+  deps.renderer.write(`Run \`wstack hq --help\` for the full HQ command list.
+`);
+}
+
+// src/subcommands/handlers/hq.ts
 var hqCmd = async (args, deps) => {
   const sub = args[0];
   if (deps.flags?.["help"] === true && (!sub || sub === "serve")) {
@@ -55,7 +316,7 @@ var hqCmd = async (args, deps) => {
     return hqAlertsCmd(args.slice(1), deps);
   }
   if (sub === "service") {
-    const { hqServiceCmd } = await import("./hq-service-L5INQFM4.js");
+    const { hqServiceCmd } = await import("./hq-service-NW56MUP2.js");
     return hqServiceCmd(args.slice(1), deps);
   }
   if (sub === "help" || sub === "--help") {
@@ -68,7 +329,7 @@ var hqCmd = async (args, deps) => {
   return 1;
 };
 async function startServer(deps) {
-  const { startHqServer } = await import("./hq-server-IIBZQZU4.js");
+  const { startHqServer } = await import("./hq-server-PC7GZMPT.js");
   const dataDir = resolveDataDir(deps);
   const flags = deps.flags ?? {};
   const rawPublicUrl = typeof flags["hq-public-url"] === "string" ? flags["hq-public-url"] : process.env.WRONGSTACK_HQ_PUBLIC_URL;
@@ -286,82 +547,6 @@ async function hqTokenCmd(args, deps) {
   printTokenHelp(deps);
   return 1;
 }
-async function hqAuditCmd(args, deps) {
-  const action = args[0];
-  if (deps.flags?.["help"] === true || action === "help" || action === "--help") {
-    printAuditHelp(deps);
-    return 0;
-  }
-  if (action === "verify" || action === void 0) {
-    return hqAuditVerify(deps);
-  }
-  deps.renderer.writeError(`Unknown hq audit subcommand: ${action ?? "(none)"}
-`);
-  printAuditHelp(deps);
-  return 1;
-}
-async function hqAuditVerify(deps) {
-  const dataDir = resolveDataDir(deps);
-  const authPath = hqAuthFilePath(dataDir);
-  const auditPath = hqAuthAuditPath(dataDir);
-  deps.renderer.write(`auth file:   ${authPath}
-`);
-  deps.renderer.write(`audit log:   ${auditPath}
-`);
-  const fileExists = await fileExistsQuiet(authPath);
-  if (!fileExists) {
-    deps.renderer.write(`contentHash: (unavailable \u2014 auth.json does not exist)
-`);
-    deps.renderer.write(
-      `Compare historical entries in the audit log above against a known-good hash.
-`
-    );
-    return 1;
-  }
-  const authFile = await readHqAuthFile(dataDir, {
-    warn: (msg) => deps.renderer.writeWarning(`${msg}
-`)
-  });
-  const hash = hqAuthContentHash(authFile);
-  if (hash === void 0) {
-    deps.renderer.write(`contentHash: (unavailable \u2014 auth.json is unreadable or malformed)
-`);
-    deps.renderer.write(
-      `Compare historical entries in the audit log above against a known-good hash.
-`
-    );
-    return 1;
-  }
-  deps.renderer.write(`contentHash: ${hash}
-`);
-  deps.renderer.write("\n");
-  deps.renderer.write(
-    `Compare this value against the 'contentHash' field of entries in the audit log.
-`
-  );
-  deps.renderer.write(
-    `A match means the redacted projection of auth.json is identical to when that
-`
-  );
-  deps.renderer.write(
-    `entry was emitted (secrets may differ \u2014 only the non-secret shape is hashed).
-`
-  );
-  return 0;
-}
-async function fileExistsQuiet(filePath) {
-  try {
-    await fs.access(filePath);
-    return true;
-  } catch {
-    return false;
-  }
-}
-async function computeAuditHashField(dataDir, warn) {
-  const persisted = await readHqAuthFile(dataDir, { warn });
-  const hash = hqAuthContentHash(persisted);
-  return hash !== void 0 ? { contentHash: hash } : {};
-}
 var TOKEN_CAPABILITIES = {
   // `control.approve` is grantable but never default — see
   // DEFAULT_TOKEN_CAPABILITIES below.
@@ -532,7 +717,7 @@ async function tokenList(args, deps) {
   const scope = resolveTokenScope(args, deps);
   const dataDir = resolveDataDir(deps);
   const tokenField = scope === "client" ? "clientTokens" : "browserTokens";
-  const authFile = await readHqAuthFile(dataDir, {
+  const authFile = await readHqAuthFile2(dataDir, {
     warn: (msg) => deps.renderer.writeWarning(`${msg}
 `)
   });
@@ -814,177 +999,8 @@ function printTokenHelp(deps) {
   deps.renderer.write(`Run \`wstack hq --help\` for the full HQ command list.
 `);
 }
-function printAuditHelp(deps) {
-  deps.renderer.write(`Usage: wstack hq audit <verify>
-`);
-  deps.renderer.write("\n");
-  deps.renderer.write(
-    `  wstack hq audit verify   Re-derive the SHA-256 contentHash from the current
-`
-  );
-  deps.renderer.write(
-    `                           on-disk auth.json and print it so an operator can compare
-`
-  );
-  deps.renderer.write(
-    `                           it against a contentHash field in an audit-log entry.
-`
-  );
-  deps.renderer.write("\n");
-  deps.renderer.write(`Flags:
-`);
-  deps.renderer.write(
-    `  --data-dir <path>   Override HQ data directory (default ~/.wrongstack/hq).
-`
-  );
-  deps.renderer.write("\n");
-  deps.renderer.write(`Run \`wstack hq --help\` for the full HQ command list.
-`);
-}
-async function hqAlertsCmd(args, deps) {
-  const action = args[0];
-  if (deps.flags?.["help"] === true || action === "help" || action === "--help") {
-    printAlertsHelp(deps);
-    return 0;
-  }
-  if (action === "eval" || action === void 0) {
-    return hqAlertsEval(args.slice(1), deps);
-  }
-  deps.renderer.writeError(`Unknown hq alerts subcommand: ${action ?? "(none)"}
-`);
-  printAlertsHelp(deps);
-  return 1;
-}
-async function hqAlertsEval(_args, deps) {
-  const flags = deps.flags ?? {};
-  const snapshotArg = typeof flags["snapshot"] === "string" ? flags["snapshot"] : void 0;
-  let snapshotPath;
-  try {
-    if (snapshotArg !== void 0) {
-      snapshotPath = path.resolve(snapshotArg);
-    } else {
-      const dataDir2 = resolveDataDir(deps);
-      snapshotPath = path.join(dataDir2, "snapshot.json");
-    }
-  } catch (err) {
-    deps.renderer.writeError(`Failed to resolve snapshot path: ${err.message}
-`);
-    return 2;
-  }
-  let raw;
-  try {
-    raw = await fs.readFile(snapshotPath, "utf8");
-  } catch (err) {
-    deps.renderer.writeError(
-      `Cannot read snapshot at ${snapshotPath}: ${err.message}
-Pass --snapshot <path> to evaluate against a specific file.
-`
-    );
-    return 2;
-  }
-  let snapshot;
-  try {
-    snapshot = JSON.parse(raw);
-  } catch (err) {
-    deps.renderer.writeError(
-      `Snapshot at ${snapshotPath} is not valid JSON: ${err.message}
-`
-    );
-    return 2;
-  }
-  const dataDir = resolveDataDir(deps);
-  let thresholds;
-  try {
-    const config = await readHqAlertsConfig(dataDir);
-    thresholds = config.thresholds;
-  } catch {
-  }
-  const engine = new HqAlertEngine({
-    onAlert: () => {
-    }
-  });
-  let fired;
-  try {
-    fired = engine.evaluate(snapshot, thresholds);
-  } catch (err) {
-    deps.renderer.writeError(`Alert evaluation failed: ${err.message}
-`);
-    return 2;
-  }
-  if (fired.length === 0) {
-    deps.renderer.write(`No alert rules fired against ${snapshotPath}.
-`);
-    if (thresholds === void 0) {
-      deps.renderer.write(
-        "(No persisted thresholds; using built-in defaults. Run `wstack hq alerts` with a populated alerts-config.json to override.)\n"
-      );
-    }
-    return 0;
-  }
-  deps.renderer.write(`${fired.length} alert rule(s) fired against ${snapshotPath}:
-`);
-  for (const alert of fired) {
-    deps.renderer.write(`  [${alert.severity}] ${alert.ruleId}: ${alert.message}
-`);
-  }
-  return 1;
-}
-function printAlertsHelp(deps) {
-  deps.renderer.write(`Usage: wstack hq alerts <eval>
-`);
-  deps.renderer.write("\n");
-  deps.renderer.write(
-    `  wstack hq alerts eval [--snapshot <path>]   Run HqAlertEngine.evaluate() against a
-`
-  );
-  deps.renderer.write(
-    `                                            snapshot file (or the live <dataDir>/
-`
-  );
-  deps.renderer.write(
-    `                                            snapshot.json). Pure-function dry run;
-`
-  );
-  deps.renderer.write(
-    `                                            no server required. Exits 0 when no
-`
-  );
-  deps.renderer.write(
-    `                                            rules fire, 1 when rules fire, 2 on errors.
-`
-  );
-  deps.renderer.write("\n");
-  deps.renderer.write(
-    `Persisted thresholds (<dataDir>/alerts-config.json) are loaded automatically when
-`
-  );
-  deps.renderer.write(
-    `present; otherwise the engine's built-in defaults apply. Snoozes are NOT honored
-`
-  );
-  deps.renderer.write(
-    `by this command \u2014 eval is a "what would fire RIGHT NOW if there were no snoozes"
-`
-  );
-  deps.renderer.write(`probe.
-`);
-  deps.renderer.write("\n");
-  deps.renderer.write(`Flags:
-`);
-  deps.renderer.write(
-    `  --snapshot <path>   Evaluate against this snapshot file instead of the live one.
-`
-  );
-  deps.renderer.write(
-    `  --data-dir <path>   Override HQ data directory (default ~/.wrongstack/hq).
-`
-  );
-  deps.renderer.write("\n");
-  deps.renderer.write(`Run \`wstack hq --help\` for the full HQ command list.
-`);
-}
 export {
   hqCmd,
   resolveAuditActor
 };
-//# sourceMappingURL=hq-XQWQTRDA.js.map
+//# sourceMappingURL=hq-JTUTFI4L.js.map

package/dist/hq-command-controller.d.ts

@@ -81,7 +81,7 @@ export interface HqCommandController {
      * (`createApprovalRegistry` in `@wrongstack/core/hq`), which is the only
      * holder of the resolver closures.
      */
-    resolveApproval?: ((toolUseId: string, decision: 'yes' | 'no' | 'always' | 'deny', sessionId?: string | undefined) => boolean) | undefined;
+    resolveApproval?: ((toolUseId: string, decision: 'yes' | 'no' | 'always' | 'always-exact' | 'always-command' | 'always-tool' | 'deny', sessionId?: string | undefined) => boolean) | undefined;
     resolveUserInput?: ((requestId: string, response: UserInputResponse, sessionId?: string | undefined) => boolean) | undefined;
     /** Apply a lifecycle transition through the project's Kanban IPC client. */
     kanbanTransition?: ((input: {

package/dist/{hq-server-IIBZQZU4.js → hq-server-PC7GZMPT.js}

@@ -10,7 +10,7 @@ import {
   readLocalSubagentTranscript,
   sanitizeApiError,
   startHqServer
-} from "./chunk-KK2LB3ZS.js";
+} from "./chunk-DRM7PSW7.js";
 import "./chunk-HXJYHAR4.js";
 import "./chunk-5EA6OTLJ.js";
 import "./chunk-Q7E3BPDU.js";
@@ -27,4 +27,4 @@ export {
   sanitizeApiError,
   startHqServer
 };
-//# sourceMappingURL=hq-server-IIBZQZU4.js.map
+//# sourceMappingURL=hq-server-PC7GZMPT.js.map

package/dist/{hq-service-L5INQFM4.js → hq-service-NW56MUP2.js}

@@ -4,16 +4,17 @@ import {
 import {
   detectUpdatePackageManager,
   detectUpdatePackageName
-} from "./chunk-DE7BZDNK.js";
+} from "./chunk-QFPQXKCG.js";
 import "./chunk-U3SS4NRH.js";
-import "./chunk-YLQEGYV4.js";
+import "./chunk-ZZRSG7VK.js";
+import "./chunk-YBUCXXYZ.js";
 
 // src/hq-service.ts
 import { spawn } from "node:child_process";
 import { constants as fsConstants } from "node:fs";
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
-import { buildChildEnv } from "@wrongstack/core/utils";
+import { buildChildEnv, isStandaloneBinary } from "@wrongstack/core/utils";
 var SERVICE_NAME = "wrongstack-hq.service";
 var UPDATE_SERVICE_NAME = "wrongstack-hq-update.service";
 var UPDATE_TIMER_NAME = "wrongstack-hq-update.timer";
@@ -314,6 +315,12 @@ async function installService(deps) {
     deps.renderer.writeError("--port must be an integer between 1 and 65535.\n");
     return 1;
   }
+  if (isStandaloneBinary()) {
+    deps.renderer.writeError(
+      "The HQ system service installer manages an npm install. With the standalone binary, run `wstack hq` under your own service manager and update it with `wstack update`.\n"
+    );
+    return 1;
+  }
   const requestedManager = deps.flags?.["pm"] ?? deps.flags?.["package-manager"];
   const detectedManager = typeof requestedManager === "string" ? requestedManager : detectUpdatePackageManager();
   if (detectedManager !== "npm" && detectedManager !== "pnpm") {
@@ -504,4 +511,4 @@ export {
   hqServiceCmd,
   renderHqServiceAssets
 };
-//# sourceMappingURL=hq-service-L5INQFM4.js.map
+//# sourceMappingURL=hq-service-NW56MUP2.js.map

package/dist/index.d.ts

@@ -1,4 +1,4 @@
 export { main } from './cli-entry-main.js';
-export { installBrokenPipeHandlers } from './cli-entry-point.js';
+export { installBrokenPipeHandlers, runCliProcess } from './cli-entry-point.js';
 export { CLI_VERSION } from './version.js';
 //# sourceMappingURL=index.d.ts.map