@wrongstack/cli 1.0.19 → 1.0.26

package/dist/fleet/host-types.d.ts

@@ -3,7 +3,7 @@ import type { BrainArbiter, ProviderModelStatusTracker } from '@wrongstack/core/
 import type { HookRunner } from '@wrongstack/core/hooks';
 import type { Container, EventBus } from '@wrongstack/core/kernel';
 import type { ProviderRegistry, ToolRegistry } from '@wrongstack/core/registry';
-import type { ConfigStore, ModelsRegistry, Renderer, SecretScrubber, SessionWriter, SkillLoader, SystemPromptBuilder, TokenCounter } from '@wrongstack/core/types';
+import type { ConfigStore, ModelsRegistry, Renderer, SecretScrubber, SessionWriter, SkillLoader, SystemPromptBuilder, TokenCounter, Tracer } from '@wrongstack/core/types';
 export interface MultiAgentDeps {
     container: Container;
     toolRegistry: ToolRegistry;
@@ -23,6 +23,8 @@ export interface MultiAgentDeps {
     projectRoot: string;
     cwd: string;
     secretScrubber: SecretScrubber;
+    /** OTLP tracer shared with the leader, so worker runs join its traces. */
+    tracer?: Tracer | undefined;
     /** Loader used to resolve the roster's per-role skill names. */
     skillLoader?: SkillLoader | undefined;
     renderer?: Renderer | undefined;

package/dist/goal-commands.d.ts

@@ -0,0 +1,47 @@
+/** Async `fs.access`-style existence check — never throws. */
+export declare function pathExists(p: string): Promise<boolean>;
+/**
+ * Cap on captured command output. Verification commands (`pnpm test` across
+ * a large monorepo) can emit tens of MB on a verbose run — accumulating the
+ * full transcript spikes the host heap for output nothing ever reads in
+ * full. runCmd keeps the TAIL (the failure summary lives at the end of a
+ * test run); gitText keeps the head (its commands are tiny).
+ */
+export declare const MAX_CMD_OUTPUT = 200000;
+/** Run a git command, returning trimmed stdout (empty string on failure). */
+export declare function gitText(args: string[], cwd: string): Promise<{
+    code: number;
+    out: string;
+}>;
+export declare function isGitRepo(cwd: string): Promise<boolean>;
+export declare const GOAL_BASE_SAFE_CMDS: ReadonlySet<string>;
+export declare let goalAllowed: Set<string>;
+/**
+ * Extend/trim the autonomous goal command allowlist from the user's exec
+ * policy. Mirrors `configureExecPolicy` but keeps goal's narrower base.
+ * Idempotent (always rebuilt from the base).
+ */
+export declare function configureGoalPolicy(opts?: {
+    allow?: readonly string[] | undefined;
+    deny?: readonly string[] | undefined;
+}): void;
+/** Reset the goal allowlist to its built-in base (tests / re-init). */
+export declare function resetGoalPolicy(): void;
+/** Whether `cmd` may run in autonomous goal verification. */
+export declare function isGoalCommandAllowed(cmd: string): boolean;
+export declare const DESTRUCTIVE_PATTERNS: readonly RegExp[];
+/** Run an arbitrary command, capturing combined stdout+stderr. */
+export declare function runCmd(cmd: string, args: string[], cwd: string, shell?: boolean): Promise<{
+    code: number;
+    out: string;
+}>;
+/**
+ * Detect the project's package manager from lockfiles at the repo root.
+ * Async so the verify-step boot path doesn't block the event loop on `stat`
+ * for missing files in CWD or in monorepo setups where the lockfile lives
+ * several levels up.
+ */
+export declare function detectPackageManager(root: string): Promise<string>;
+/** Read package.json scripts for a directory (empty on any failure). */
+export declare function readScripts(cwd: string): Promise<Record<string, string>>;
+//# sourceMappingURL=goal-commands.d.ts.map

package/dist/goal-host.d.ts

@@ -1,3 +1,4 @@
+export { configureGoalPolicy, isGoalCommandAllowed, resetGoalPolicy } from './goal-commands.js';
 /**
  * Goal host wiring for the CLI.
  *
@@ -20,19 +21,6 @@ import { type PhaseGraph, type PhaseProgress } from '@wrongstack/core/goal';
 import type { EventBus } from '@wrongstack/core/kernel';
 import type { Config, TaskNode } from '@wrongstack/core/types';
 import type { MultiAgentHost } from './multi-agent.js';
-/**
- * Extend/trim the autonomous goal command allowlist from the user's exec
- * policy. Mirrors `configureExecPolicy` but keeps goal's narrower base.
- * Idempotent (always rebuilt from the base).
- */
-export declare function configureGoalPolicy(opts?: {
-    allow?: readonly string[] | undefined;
-    deny?: readonly string[] | undefined;
-}): void;
-/** Reset the goal allowlist to its built-in base (tests / re-init). */
-export declare function resetGoalPolicy(): void;
-/** Whether `cmd` may run in autonomous goal verification. */
-export declare function isGoalCommandAllowed(cmd: string): boolean;
 export interface GoalHostDeps {
     multiAgentHost: MultiAgentHost;
     /** Read the *current* Config lazily (it may be patched, e.g. YOLO toggles). */
@@ -103,5 +91,4 @@ export interface GoalHostHooks {
     onWorktree: (action: 'list' | 'merge' | 'prune' | 'clean', target?: string) => Promise<string>;
 }
 export declare function createGoalHost(deps: GoalHostDeps): GoalHostHooks;
-export {};
 //# sourceMappingURL=goal-host.d.ts.map

package/dist/{hq-XQWQTRDA.js → hq-GLZ7QESM.js}

@@ -1,6 +1,3 @@
-import {
-  parseTokenTtlValue
-} from "./chunk-UZ2TMHNH.js";
 import {
   resolveHqPasswordInput
 } from "./chunk-AUQDGU5D.js";
@@ -11,31 +8,295 @@ import {
 import {
   parseHqIpAllowlist
 } from "./chunk-Q7E3BPDU.js";
+import {
+  parseTokenTtlValue
+} from "./chunk-UZ2TMHNH.js";
 
 // src/subcommands/handlers/hq.ts
-import * as fs from "node:fs/promises";
-import * as path from "node:path";
 import {
   HQ_AUTH_FILE_VERSION,
   HQ_CLI_DEFAULT_HOST,
-  HqAlertEngine,
   HqInsecureExposureError,
-  hqAuthAuditPath,
-  hqAuthContentHash,
-  hqAuthFilePath,
   isLoopbackHost,
   logHqAuthAudit,
   mintHqToken,
   mutateHqAuthFile,
-  readHqAlertsConfig,
-  readHqAuthFile,
-  resolveHqDataDir
+  readHqAuthFile as readHqAuthFile2
 } from "@wrongstack/core/hq";
 import { expectDefined } from "@wrongstack/core/utils";
+
+// src/subcommands/handlers/hq-alerts.ts
+import * as fs from "node:fs/promises";
+import * as path from "node:path";
+import {
+  HqAlertEngine,
+  readHqAlertsConfig
+} from "@wrongstack/core/hq";
+
+// src/subcommands/handlers/hq-data-dir.ts
+import { resolveHqDataDir } from "@wrongstack/core/hq";
 function resolveDataDir(deps) {
   const override = typeof deps.flags?.["data-dir"] === "string" ? deps.flags["data-dir"] : void 0;
   return resolveHqDataDir(override);
 }
+
+// src/subcommands/handlers/hq-alerts.ts
+async function hqAlertsCmd(args, deps) {
+  const action = args[0];
+  if (deps.flags?.["help"] === true || action === "help" || action === "--help") {
+    printAlertsHelp(deps);
+    return 0;
+  }
+  if (action === "eval" || action === void 0) {
+    return hqAlertsEval(args.slice(1), deps);
+  }
+  deps.renderer.writeError(`Unknown hq alerts subcommand: ${action ?? "(none)"}
+`);
+  printAlertsHelp(deps);
+  return 1;
+}
+async function hqAlertsEval(_args, deps) {
+  const flags = deps.flags ?? {};
+  const snapshotArg = typeof flags["snapshot"] === "string" ? flags["snapshot"] : void 0;
+  let snapshotPath;
+  try {
+    if (snapshotArg !== void 0) {
+      snapshotPath = path.resolve(snapshotArg);
+    } else {
+      const dataDir2 = resolveDataDir(deps);
+      snapshotPath = path.join(dataDir2, "snapshot.json");
+    }
+  } catch (err) {
+    deps.renderer.writeError(`Failed to resolve snapshot path: ${err.message}
+`);
+    return 2;
+  }
+  let raw;
+  try {
+    raw = await fs.readFile(snapshotPath, "utf8");
+  } catch (err) {
+    deps.renderer.writeError(
+      `Cannot read snapshot at ${snapshotPath}: ${err.message}
+Pass --snapshot <path> to evaluate against a specific file.
+`
+    );
+    return 2;
+  }
+  let snapshot;
+  try {
+    snapshot = JSON.parse(raw);
+  } catch (err) {
+    deps.renderer.writeError(
+      `Snapshot at ${snapshotPath} is not valid JSON: ${err.message}
+`
+    );
+    return 2;
+  }
+  const dataDir = resolveDataDir(deps);
+  let thresholds;
+  try {
+    const config = await readHqAlertsConfig(dataDir);
+    thresholds = config.thresholds;
+  } catch {
+  }
+  const engine = new HqAlertEngine({
+    onAlert: () => {
+    }
+  });
+  let fired;
+  try {
+    fired = engine.evaluate(snapshot, thresholds);
+  } catch (err) {
+    deps.renderer.writeError(`Alert evaluation failed: ${err.message}
+`);
+    return 2;
+  }
+  if (fired.length === 0) {
+    deps.renderer.write(`No alert rules fired against ${snapshotPath}.
+`);
+    if (thresholds === void 0) {
+      deps.renderer.write(
+        "(No persisted thresholds; using built-in defaults. Run `wstack hq alerts` with a populated alerts-config.json to override.)\n"
+      );
+    }
+    return 0;
+  }
+  deps.renderer.write(`${fired.length} alert rule(s) fired against ${snapshotPath}:
+`);
+  for (const alert of fired) {
+    deps.renderer.write(`  [${alert.severity}] ${alert.ruleId}: ${alert.message}
+`);
+  }
+  return 1;
+}
+function printAlertsHelp(deps) {
+  deps.renderer.write(`Usage: wstack hq alerts <eval>
+`);
+  deps.renderer.write("\n");
+  deps.renderer.write(
+    `  wstack hq alerts eval [--snapshot <path>]   Run HqAlertEngine.evaluate() against a
+`
+  );
+  deps.renderer.write(
+    `                                            snapshot file (or the live <dataDir>/
+`
+  );
+  deps.renderer.write(
+    `                                            snapshot.json). Pure-function dry run;
+`
+  );
+  deps.renderer.write(
+    `                                            no server required. Exits 0 when no
+`
+  );
+  deps.renderer.write(
+    `                                            rules fire, 1 when rules fire, 2 on errors.
+`
+  );
+  deps.renderer.write("\n");
+  deps.renderer.write(
+    `Persisted thresholds (<dataDir>/alerts-config.json) are loaded automatically when
+`
+  );
+  deps.renderer.write(
+    `present; otherwise the engine's built-in defaults apply. Snoozes are NOT honored
+`
+  );
+  deps.renderer.write(
+    `by this command \u2014 eval is a "what would fire RIGHT NOW if there were no snoozes"
+`
+  );
+  deps.renderer.write(`probe.
+`);
+  deps.renderer.write("\n");
+  deps.renderer.write(`Flags:
+`);
+  deps.renderer.write(
+    `  --snapshot <path>   Evaluate against this snapshot file instead of the live one.
+`
+  );
+  deps.renderer.write(
+    `  --data-dir <path>   Override HQ data directory (default ~/.wrongstack/hq).
+`
+  );
+  deps.renderer.write("\n");
+  deps.renderer.write(`Run \`wstack hq --help\` for the full HQ command list.
+`);
+}
+
+// src/subcommands/handlers/hq-audit.ts
+import * as fs2 from "node:fs/promises";
+import {
+  hqAuthAuditPath,
+  hqAuthContentHash,
+  hqAuthFilePath,
+  readHqAuthFile
+} from "@wrongstack/core/hq";
+async function hqAuditCmd(args, deps) {
+  const action = args[0];
+  if (deps.flags?.["help"] === true || action === "help" || action === "--help") {
+    printAuditHelp(deps);
+    return 0;
+  }
+  if (action === "verify" || action === void 0) {
+    return hqAuditVerify(deps);
+  }
+  deps.renderer.writeError(`Unknown hq audit subcommand: ${action ?? "(none)"}
+`);
+  printAuditHelp(deps);
+  return 1;
+}
+async function hqAuditVerify(deps) {
+  const dataDir = resolveDataDir(deps);
+  const authPath = hqAuthFilePath(dataDir);
+  const auditPath = hqAuthAuditPath(dataDir);
+  deps.renderer.write(`auth file:   ${authPath}
+`);
+  deps.renderer.write(`audit log:   ${auditPath}
+`);
+  const fileExists = await fileExistsQuiet(authPath);
+  if (!fileExists) {
+    deps.renderer.write(`contentHash: (unavailable \u2014 auth.json does not exist)
+`);
+    deps.renderer.write(
+      `Compare historical entries in the audit log above against a known-good hash.
+`
+    );
+    return 1;
+  }
+  const authFile = await readHqAuthFile(dataDir, {
+    warn: (msg) => deps.renderer.writeWarning(`${msg}
+`)
+  });
+  const hash = hqAuthContentHash(authFile);
+  if (hash === void 0) {
+    deps.renderer.write(`contentHash: (unavailable \u2014 auth.json is unreadable or malformed)
+`);
+    deps.renderer.write(
+      `Compare historical entries in the audit log above against a known-good hash.
+`
+    );
+    return 1;
+  }
+  deps.renderer.write(`contentHash: ${hash}
+`);
+  deps.renderer.write("\n");
+  deps.renderer.write(
+    `Compare this value against the 'contentHash' field of entries in the audit log.
+`
+  );
+  deps.renderer.write(
+    `A match means the redacted projection of auth.json is identical to when that
+`
+  );
+  deps.renderer.write(
+    `entry was emitted (secrets may differ \u2014 only the non-secret shape is hashed).
+`
+  );
+  return 0;
+}
+async function fileExistsQuiet(filePath) {
+  try {
+    await fs2.access(filePath);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function computeAuditHashField(dataDir, warn) {
+  const persisted = await readHqAuthFile(dataDir, { warn });
+  const hash = hqAuthContentHash(persisted);
+  return hash !== void 0 ? { contentHash: hash } : {};
+}
+function printAuditHelp(deps) {
+  deps.renderer.write(`Usage: wstack hq audit <verify>
+`);
+  deps.renderer.write("\n");
+  deps.renderer.write(
+    `  wstack hq audit verify   Re-derive the SHA-256 contentHash from the current
+`
+  );
+  deps.renderer.write(
+    `                           on-disk auth.json and print it so an operator can compare
+`
+  );
+  deps.renderer.write(
+    `                           it against a contentHash field in an audit-log entry.
+`
+  );
+  deps.renderer.write("\n");
+  deps.renderer.write(`Flags:
+`);
+  deps.renderer.write(
+    `  --data-dir <path>   Override HQ data directory (default ~/.wrongstack/hq).
+`
+  );
+  deps.renderer.write("\n");
+  deps.renderer.write(`Run \`wstack hq --help\` for the full HQ command list.
+`);
+}
+
+// src/subcommands/handlers/hq.ts
 var hqCmd = async (args, deps) => {
   const sub = args[0];
   if (deps.flags?.["help"] === true && (!sub || sub === "serve")) {
@@ -55,7 +316,7 @@ var hqCmd = async (args, deps) => {
     return hqAlertsCmd(args.slice(1), deps);
   }
   if (sub === "service") {
-    const { hqServiceCmd } = await import("./hq-service-L5INQFM4.js");
+    const { hqServiceCmd } = await import("./hq-service-BMMJAHRT.js");
     return hqServiceCmd(args.slice(1), deps);
   }
   if (sub === "help" || sub === "--help") {
@@ -68,7 +329,7 @@ var hqCmd = async (args, deps) => {
   return 1;
 };
 async function startServer(deps) {
-  const { startHqServer } = await import("./hq-server-IIBZQZU4.js");
+  const { startHqServer } = await import("./hq-server-YTKDVQPY.js");
   const dataDir = resolveDataDir(deps);
   const flags = deps.flags ?? {};
   const rawPublicUrl = typeof flags["hq-public-url"] === "string" ? flags["hq-public-url"] : process.env.WRONGSTACK_HQ_PUBLIC_URL;
@@ -286,82 +547,6 @@ async function hqTokenCmd(args, deps) {
   printTokenHelp(deps);
   return 1;
 }
-async function hqAuditCmd(args, deps) {
-  const action = args[0];
-  if (deps.flags?.["help"] === true || action === "help" || action === "--help") {
-    printAuditHelp(deps);
-    return 0;
-  }
-  if (action === "verify" || action === void 0) {
-    return hqAuditVerify(deps);
-  }
-  deps.renderer.writeError(`Unknown hq audit subcommand: ${action ?? "(none)"}
-`);
-  printAuditHelp(deps);
-  return 1;
-}
-async function hqAuditVerify(deps) {
-  const dataDir = resolveDataDir(deps);
-  const authPath = hqAuthFilePath(dataDir);
-  const auditPath = hqAuthAuditPath(dataDir);
-  deps.renderer.write(`auth file:   ${authPath}
-`);
-  deps.renderer.write(`audit log:   ${auditPath}
-`);
-  const fileExists = await fileExistsQuiet(authPath);
-  if (!fileExists) {
-    deps.renderer.write(`contentHash: (unavailable \u2014 auth.json does not exist)
-`);
-    deps.renderer.write(
-      `Compare historical entries in the audit log above against a known-good hash.
-`
-    );
-    return 1;
-  }
-  const authFile = await readHqAuthFile(dataDir, {
-    warn: (msg) => deps.renderer.writeWarning(`${msg}
-`)
-  });
-  const hash = hqAuthContentHash(authFile);
-  if (hash === void 0) {
-    deps.renderer.write(`contentHash: (unavailable \u2014 auth.json is unreadable or malformed)
-`);
-    deps.renderer.write(
-      `Compare historical entries in the audit log above against a known-good hash.
-`
-    );
-    return 1;
-  }
-  deps.renderer.write(`contentHash: ${hash}
-`);
-  deps.renderer.write("\n");
-  deps.renderer.write(
-    `Compare this value against the 'contentHash' field of entries in the audit log.
-`
-  );
-  deps.renderer.write(
-    `A match means the redacted projection of auth.json is identical to when that
-`
-  );
-  deps.renderer.write(
-    `entry was emitted (secrets may differ \u2014 only the non-secret shape is hashed).
-`
-  );
-  return 0;
-}
-async function fileExistsQuiet(filePath) {
-  try {
-    await fs.access(filePath);
-    return true;
-  } catch {
-    return false;
-  }
-}
-async function computeAuditHashField(dataDir, warn) {
-  const persisted = await readHqAuthFile(dataDir, { warn });
-  const hash = hqAuthContentHash(persisted);
-  return hash !== void 0 ? { contentHash: hash } : {};
-}
 var TOKEN_CAPABILITIES = {
   // `control.approve` is grantable but never default — see
   // DEFAULT_TOKEN_CAPABILITIES below.
@@ -532,7 +717,7 @@ async function tokenList(args, deps) {
   const scope = resolveTokenScope(args, deps);
   const dataDir = resolveDataDir(deps);
   const tokenField = scope === "client" ? "clientTokens" : "browserTokens";
-  const authFile = await readHqAuthFile(dataDir, {
+  const authFile = await readHqAuthFile2(dataDir, {
     warn: (msg) => deps.renderer.writeWarning(`${msg}
 `)
   });
@@ -814,177 +999,8 @@ function printTokenHelp(deps) {
   deps.renderer.write(`Run \`wstack hq --help\` for the full HQ command list.
 `);
 }
-function printAuditHelp(deps) {
-  deps.renderer.write(`Usage: wstack hq audit <verify>
-`);
-  deps.renderer.write("\n");
-  deps.renderer.write(
-    `  wstack hq audit verify   Re-derive the SHA-256 contentHash from the current
-`
-  );
-  deps.renderer.write(
-    `                           on-disk auth.json and print it so an operator can compare
-`
-  );
-  deps.renderer.write(
-    `                           it against a contentHash field in an audit-log entry.
-`
-  );
-  deps.renderer.write("\n");
-  deps.renderer.write(`Flags:
-`);
-  deps.renderer.write(
-    `  --data-dir <path>   Override HQ data directory (default ~/.wrongstack/hq).
-`
-  );
-  deps.renderer.write("\n");
-  deps.renderer.write(`Run \`wstack hq --help\` for the full HQ command list.
-`);
-}
-async function hqAlertsCmd(args, deps) {
-  const action = args[0];
-  if (deps.flags?.["help"] === true || action === "help" || action === "--help") {
-    printAlertsHelp(deps);
-    return 0;
-  }
-  if (action === "eval" || action === void 0) {
-    return hqAlertsEval(args.slice(1), deps);
-  }
-  deps.renderer.writeError(`Unknown hq alerts subcommand: ${action ?? "(none)"}
-`);
-  printAlertsHelp(deps);
-  return 1;
-}
-async function hqAlertsEval(_args, deps) {
-  const flags = deps.flags ?? {};
-  const snapshotArg = typeof flags["snapshot"] === "string" ? flags["snapshot"] : void 0;
-  let snapshotPath;
-  try {
-    if (snapshotArg !== void 0) {
-      snapshotPath = path.resolve(snapshotArg);
-    } else {
-      const dataDir2 = resolveDataDir(deps);
-      snapshotPath = path.join(dataDir2, "snapshot.json");
-    }
-  } catch (err) {
-    deps.renderer.writeError(`Failed to resolve snapshot path: ${err.message}
-`);
-    return 2;
-  }
-  let raw;
-  try {
-    raw = await fs.readFile(snapshotPath, "utf8");
-  } catch (err) {
-    deps.renderer.writeError(
-      `Cannot read snapshot at ${snapshotPath}: ${err.message}
-Pass --snapshot <path> to evaluate against a specific file.
-`
-    );
-    return 2;
-  }
-  let snapshot;
-  try {
-    snapshot = JSON.parse(raw);
-  } catch (err) {
-    deps.renderer.writeError(
-      `Snapshot at ${snapshotPath} is not valid JSON: ${err.message}
-`
-    );
-    return 2;
-  }
-  const dataDir = resolveDataDir(deps);
-  let thresholds;
-  try {
-    const config = await readHqAlertsConfig(dataDir);
-    thresholds = config.thresholds;
-  } catch {
-  }
-  const engine = new HqAlertEngine({
-    onAlert: () => {
-    }
-  });
-  let fired;
-  try {
-    fired = engine.evaluate(snapshot, thresholds);
-  } catch (err) {
-    deps.renderer.writeError(`Alert evaluation failed: ${err.message}
-`);
-    return 2;
-  }
-  if (fired.length === 0) {
-    deps.renderer.write(`No alert rules fired against ${snapshotPath}.
-`);
-    if (thresholds === void 0) {
-      deps.renderer.write(
-        "(No persisted thresholds; using built-in defaults. Run `wstack hq alerts` with a populated alerts-config.json to override.)\n"
-      );
-    }
-    return 0;
-  }
-  deps.renderer.write(`${fired.length} alert rule(s) fired against ${snapshotPath}:
-`);
-  for (const alert of fired) {
-    deps.renderer.write(`  [${alert.severity}] ${alert.ruleId}: ${alert.message}
-`);
-  }
-  return 1;
-}
-function printAlertsHelp(deps) {
-  deps.renderer.write(`Usage: wstack hq alerts <eval>
-`);
-  deps.renderer.write("\n");
-  deps.renderer.write(
-    `  wstack hq alerts eval [--snapshot <path>]   Run HqAlertEngine.evaluate() against a
-`
-  );
-  deps.renderer.write(
-    `                                            snapshot file (or the live <dataDir>/
-`
-  );
-  deps.renderer.write(
-    `                                            snapshot.json). Pure-function dry run;
-`
-  );
-  deps.renderer.write(
-    `                                            no server required. Exits 0 when no
-`
-  );
-  deps.renderer.write(
-    `                                            rules fire, 1 when rules fire, 2 on errors.
-`
-  );
-  deps.renderer.write("\n");
-  deps.renderer.write(
-    `Persisted thresholds (<dataDir>/alerts-config.json) are loaded automatically when
-`
-  );
-  deps.renderer.write(
-    `present; otherwise the engine's built-in defaults apply. Snoozes are NOT honored
-`
-  );
-  deps.renderer.write(
-    `by this command \u2014 eval is a "what would fire RIGHT NOW if there were no snoozes"
-`
-  );
-  deps.renderer.write(`probe.
-`);
-  deps.renderer.write("\n");
-  deps.renderer.write(`Flags:
-`);
-  deps.renderer.write(
-    `  --snapshot <path>   Evaluate against this snapshot file instead of the live one.
-`
-  );
-  deps.renderer.write(
-    `  --data-dir <path>   Override HQ data directory (default ~/.wrongstack/hq).
-`
-  );
-  deps.renderer.write("\n");
-  deps.renderer.write(`Run \`wstack hq --help\` for the full HQ command list.
-`);
-}
 export {
   hqCmd,
   resolveAuditActor
 };
-//# sourceMappingURL=hq-XQWQTRDA.js.map
+//# sourceMappingURL=hq-GLZ7QESM.js.map

package/dist/hq-command-controller.d.ts

@@ -81,7 +81,7 @@ export interface HqCommandController {
      * (`createApprovalRegistry` in `@wrongstack/core/hq`), which is the only
      * holder of the resolver closures.
      */
-    resolveApproval?: ((toolUseId: string, decision: 'yes' | 'no' | 'always' | 'deny', sessionId?: string | undefined) => boolean) | undefined;
+    resolveApproval?: ((toolUseId: string, decision: 'yes' | 'no' | 'always' | 'always-exact' | 'always-command' | 'always-tool' | 'deny', sessionId?: string | undefined) => boolean) | undefined;
     resolveUserInput?: ((requestId: string, response: UserInputResponse, sessionId?: string | undefined) => boolean) | undefined;
     /** Apply a lifecycle transition through the project's Kanban IPC client. */
     kanbanTransition?: ((input: {