@wrongstack/cli 1.0.24 → 1.0.26

package/dist/{permissions-CFDLXETM.js → permissions-PL27UHYD.js}

@@ -1,23 +1,45 @@
+import {
+  explainCall,
+  formatExplainedCall,
+  formatPermissionRules
+} from "./chunk-4TVYGG6G.js";
 
 // src/subcommands/handlers/permissions.ts
-import { DefaultPermissionPolicy } from "@wrongstack/core/security";
+import { compilePermissionRules } from "@wrongstack/core/security";
 import { resolveWstackPaths } from "@wrongstack/core/utils";
+import { createProjectPermissionPolicy } from "@wrongstack/runtime";
 var permissionsCmd = async (args, deps) => {
   const subCmd = args[0];
   if (subCmd === "help" || subCmd === "--help" || subCmd === "-h" || !subCmd || subCmd === "explain" && !args[1]) {
-    if (subCmd !== "explain" && subCmd !== "help" && subCmd !== void 0) {
-      deps.renderer.writeError(`Unknown permissions subcommand: ${subCmd}
-`);
-    }
     deps.renderer.write(usage());
-    return subCmd && subCmd !== "explain" && subCmd !== "help" && subCmd !== void 0 ? 1 : 0;
+    return 0;
   }
-  if (subCmd !== "explain") {
+  if (subCmd !== "explain" && subCmd !== "rules") {
     deps.renderer.writeError(`Unknown permissions subcommand: ${subCmd}
 `);
     deps.renderer.write(usage());
     return 1;
   }
+  const jsonOutput = deps.flags?.["json"] === true || args.includes("--json");
+  const built = buildPolicy(deps);
+  if (typeof built === "string") {
+    deps.renderer.writeError(`${built}
+`);
+    return 1;
+  }
+  const { policy, ctx, yolo, yoloSource } = built;
+  if (subCmd === "rules") {
+    const rules = await compilePermissionRules(policy, ctx, { yolo });
+    if (jsonOutput) deps.renderer.write(`${JSON.stringify(rules, null, 2)}
+`);
+    else
+      deps.renderer.writeLine(
+        `YOLO: ${yolo ? "on" : "off"} (${yoloSource})
+
+${formatPermissionRules(rules)}`
+      );
+    return 0;
+  }
   const toolName = args[1];
   if (!toolName) {
     deps.renderer.writeError("Missing tool name.\n");
@@ -27,7 +49,6 @@ var permissionsCmd = async (args, deps) => {
   const inputIdx = args.indexOf("--input");
   const flagInput = deps.flags?.["input"];
   const rawInput = typeof flagInput === "string" ? flagInput : inputIdx >= 0 && inputIdx + 1 < args.length ? args[inputIdx + 1] : void 0;
-  const jsonOutput = deps.flags?.["json"] === true || args.includes("--json");
   let input = {};
   if (rawInput) {
     try {
@@ -50,67 +71,68 @@ var permissionsCmd = async (args, deps) => {
     );
     return 1;
   }
+  const explained = await explainCall(policy, tool, input, ctx, yolo);
+  if (jsonOutput) {
+    deps.renderer.write(
+      `${JSON.stringify({ ...explained.trace, rule: explained.rule }, null, 2)}
+`
+    );
+  } else {
+    deps.renderer.writeLine(
+      `YOLO: ${yolo ? "on" : "off"} (${yoloSource})
+
+${formatExplainedCall(explained)}`
+    );
+  }
+  return 0;
+};
+function buildPolicy(deps) {
   const paths = resolveWstackPaths({ projectRoot: deps.projectRoot, userHome: deps.userHome });
-  const trustFile = paths.projectTrust;
   const readSubjects = /* @__PURE__ */ new Set();
   const ctx = {
     projectRoot: deps.projectRoot,
     cwd: deps.cwd,
+    workingDir: deps.cwd,
+    meta: {},
+    provider: { id: deps.config.provider },
     hasRead(subject) {
       return readSubjects.has(subject);
     }
   };
-  const policy = new DefaultPermissionPolicy({
-    trustFile,
-    yolo: deps.flags?.["yolo"] ?? false
-  });
-  await policy.reload();
-  const trace = await policy.explain(tool, input, ctx);
-  if (jsonOutput) {
-    deps.renderer.write(JSON.stringify(trace, null, 2) + "\n");
-  } else {
-    deps.renderer.write(formatTrace(trace) + "\n");
+  const yoloFlag = deps.flags?.["yolo"];
+  const yolo = typeof yoloFlag === "boolean" ? yoloFlag : deps.config.yolo === true;
+  try {
+    const policy = createProjectPermissionPolicy({
+      projectRoot: deps.projectRoot,
+      trustFile: paths.projectTrust,
+      config: deps.config,
+      permission: { yolo }
+    })();
+    return { policy, ctx, yolo, yoloSource: typeof yoloFlag === "boolean" ? "--yolo" : "config" };
+  } catch (error) {
+    return error instanceof Error ? error.message : String(error);
   }
-  return 0;
-};
-function formatTrace(trace) {
-  const lines = [];
-  lines.push(`Permission trace for "${trace.toolName}"`);
-  lines.push(`Subject: ${trace.subject ?? "(none)"}`);
-  lines.push("");
-  for (let i = 0; i < trace.steps.length; i++) {
-    const step = trace.steps[i];
-    const winner = i === trace.winnerIndex ? " \u2190 WINNER" : "";
-    const matched = step.matched ? "\u2713" : " ";
-    lines.push(`  ${matched} [${i}] ${step.rule}${winner}`);
-    lines.push(`        decision: ${step.decision}  source: ${step.source}`);
-    lines.push(`        ${step.detail}`);
-    if (i < trace.steps.length - 1) lines.push("");
-  }
-  lines.push("");
-  lines.push(`Effective: ${trace.decision.permission} (source: ${trace.decision.source})`);
-  if (trace.decision.reason) {
-    lines.push(`Reason: ${trace.decision.reason}`);
-  }
-  if (trace.decision.riskTier) {
-    lines.push(`Risk tier: ${trace.decision.riskTier}`);
-  }
-  return lines.join("\n");
 }
 function usage() {
   return `Usage:
+  wstack permissions rules [--json]
   wstack permissions explain <tool> --input '<json>' [--json]
 
 Examples:
+  wstack permissions rules
   wstack permissions explain bash --input '{"command":"rm -rf /"}'
   wstack permissions explain read --input '{"path":".env"}' --json
 
 Flags:
   --input <json>   Tool input arguments as a JSON object
   --json           Output as structured JSON instead of human-readable text
+  --yolo           Show the rules as they apply with YOLO on
+
+Inside a session, /permissions shows the same with that session\u2019s YOLO,
+answers and /permissions allow|deny rules.
 `;
 }
 export {
   permissionsCmd
 };
-//# sourceMappingURL=permissions-CFDLXETM.js.map
+//# sourceMappingURL=permissions-PL27UHYD.js.map

package/dist/{plugin-usage-S5LVGMBW.js → plugin-usage-CIGOOTX3.js}

@@ -4,10 +4,10 @@ import {
 import {
   activeProfileConfigPath
 } from "./chunk-YMXXOOFN.js";
-import "./chunk-WSTVGC2C.js";
 import {
   restoreFlags
 } from "./chunk-CSAPOCBP.js";
+import "./chunk-WSTVGC2C.js";
 
 // src/subcommands/handlers/plugin-usage.ts
 var pluginCmd = async (args, deps) => {
@@ -41,4 +41,4 @@ export {
   pluginCmd,
   usageCmd
 };
-//# sourceMappingURL=plugin-usage-S5LVGMBW.js.map
+//# sourceMappingURL=plugin-usage-CIGOOTX3.js.map

package/dist/{plugins-RHBIVLI7.js → plugins-HQTXUD6A.js}

@@ -1,17 +1,19 @@
 import {
   BUILTIN_PLUGIN_FACTORIES,
+  BUILTIN_PLUGIN_NAME_HINTS,
   DEPRECATED_PLUGIN_NAMES,
   _resetDeprecatedWarningsForTests,
   builtinPluginNameFromSpec,
   pluginNameFromSpec,
   setupPlugins,
   warnIfDeprecatedPluginName
-} from "./chunk-JF2MULWF.js";
+} from "./chunk-YHYINL47.js";
 import "./chunk-EWKESL4L.js";
 import "./chunk-L2RVEQWO.js";
 import "./chunk-WSTVGC2C.js";
 export {
   BUILTIN_PLUGIN_FACTORIES,
+  BUILTIN_PLUGIN_NAME_HINTS,
   DEPRECATED_PLUGIN_NAMES,
   _resetDeprecatedWarningsForTests,
   builtinPluginNameFromSpec,
@@ -19,4 +21,4 @@ export {
   setupPlugins,
   warnIfDeprecatedPluginName
 };
-//# sourceMappingURL=plugins-RHBIVLI7.js.map
+//# sourceMappingURL=plugins-HQTXUD6A.js.map

package/dist/preflight.d.ts

@@ -39,7 +39,7 @@ export declare function applySessionShellDefault(): void;
  * callers get back the (possibly refreshed) `UpdateInfo`
  * so version-aware UI can render without re-fetching.
  */
-export declare function applyPrintUpdateNotice(initialUpdateInfo: UpdateInfo | undefined): Promise<UpdateInfo | undefined>;
+export declare function applyPrintUpdateNotice(initialUpdateInfo: UpdateInfo | undefined, config?: Config | undefined): Promise<UpdateInfo | undefined>;
 /**
  * Seed the stream-debug singleton from persisted config so
  * `WireAdapter` picks it up on construction. Runtime toggles

package/dist/{projects-LMNAGGEU.js → projects-T4CZCA25.js}

@@ -1,8 +1,8 @@
 
 // src/subcommands/handlers/projects.ts
+import { color } from "@wrongstack/core/utils";
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
-import { color } from "@wrongstack/core/utils";
 var projectsCmd = async (_args, deps) => {
   const manifestPath = path.join(deps.paths.globalRoot, "projects.json");
   let entries;
@@ -18,10 +18,7 @@ var projectsCmd = async (_args, deps) => {
     return 0;
   }
   const sorted = [...entries].sort((a, b) => (b.lastSeen ?? "").localeCompare(a.lastSeen ?? ""));
-  const slugWidth = Math.min(
-    Math.max(...sorted.map((entry) => (entry.slug ?? "").length), 4),
-    40
-  );
+  const slugWidth = Math.min(Math.max(...sorted.map((entry) => (entry.slug ?? "").length), 4), 40);
   for (const entry of sorted) {
     const slug = (entry.slug ?? "?").padEnd(slugWidth);
     const seen = entry.lastSeen ?? "";
@@ -33,4 +30,4 @@ var projectsCmd = async (_args, deps) => {
 export {
   projectsCmd
 };
-//# sourceMappingURL=projects-LMNAGGEU.js.map
+//# sourceMappingURL=projects-T4CZCA25.js.map

package/dist/provider-helpers.d.ts

@@ -1,4 +1,11 @@
+/**
+ * Shared provider-config helpers used by the picker, main boot sequence,
+ * and subcommands. Keeps provider key detection and alias resolution in
+ * one place so the logic doesn't drift between call sites.
+ */
+import { isKeylessLocalProvider } from '@wrongstack/core/models';
 import type { Config, ModelsRegistry, ProviderConfig, ResolvedProvider } from '@wrongstack/core/types';
+export { isKeylessLocalProvider };
 /** Return the provider's visible model ids: models.dev plus anything the saved
  * config names that the catalog does not carry.
  *
@@ -23,17 +30,6 @@ import type { Config, ModelsRegistry, ProviderConfig, ResolvedProvider } from '@
  * request time rather than being silently unselectable, which is the better
  * failure: visible and actionable. */
 export declare function visibleModelIds(providerId: string, config: Config, catalogModelIds: string[], cfg?: ProviderConfig | undefined): string[];
-/**
- * Is this a keyless local gateway — a server on a loopback address that
- * declares no API-key env vars (omniroute, LiteLLM/vLLM/LM Studio/Ollama
- * running locally, …)? These need no credential, so they belong in the
- * picker even though `hasApiKey` returns false for them. Accepts the
- * minimal shape both call sites can supply.
- */
-export declare function isKeylessLocalProvider(provider: {
-    apiBase?: string | undefined;
-    envVars?: string[] | undefined;
-}): boolean;
 /**
  * Does this provider have an API key available — either in the
  * environment (via one of its known env vars) or stored in config

package/dist/{providers-models-2CFG46RD.js → providers-models-5Z2PJTEW.js}

@@ -1,12 +1,12 @@
 import {
   visibleModelIds
-} from "./chunk-3VXYY5JC.js";
-import {
-  activeProfileConfigPath
-} from "./chunk-YMXXOOFN.js";
+} from "./chunk-5UZBUV2H.js";
 import {
   mutateConfigProviders
 } from "./chunk-LUMETJFO.js";
+import {
+  activeProfileConfigPath
+} from "./chunk-YMXXOOFN.js";
 
 // src/subcommands/handlers/providers-models.ts
 import * as fs from "node:fs/promises";
@@ -670,4 +670,4 @@ export {
   modelsCmd,
   providersCmd
 };
-//# sourceMappingURL=providers-models-2CFG46RD.js.map
+//# sourceMappingURL=providers-models-5Z2PJTEW.js.map

package/dist/release-asset-download.d.ts

@@ -1,3 +1,13 @@
 /** Download one release asset without buffering beyond its configured ceiling. */
 export declare function downloadReleaseAsset(url: string, timeoutMs: number, maxBytes: number): Promise<Buffer>;
+/**
+ * Stream one release asset into `file` (created exclusively) and return its
+ * SHA-256. The background self-update uses this so a 100+ MB executable never
+ * sits in the session's heap. `file` is removed when the download fails.
+ */
+export declare function downloadReleaseAssetToFile(url: string, file: string, options: {
+    timeoutMs: number;
+    maxBytes: number;
+    signal?: AbortSignal | undefined;
+}): Promise<string>;
 //# sourceMappingURL=release-asset-download.d.ts.map

package/dist/release-attestation.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Build-provenance check for a downloaded standalone executable.
+ *
+ * SHA256SUMS comes from the same release as the binary, so it catches a
+ * corrupted download but not a forged one: whoever can upload the binary can
+ * upload a matching SHA256SUMS. The release workflow also attests every
+ * binary (`actions/attest-build-provenance`), and GitHub serves those
+ * attestations by digest. A binary is accepted only if one of them says this
+ * exact digest was built by `binaries.yml`, called from `release.yml`, for the
+ * push of the tag `v<version>` in this repository, on a GitHub-hosted runner.
+ * A build from a branch or a manual run is not a release and does not count.
+ *
+ * The Sigstore signature over the statement is not verified here: the
+ * statement is trusted as served by GitHub's API over TLS.
+ */
+/** GitHub repository the standalone executables are released from. */
+export declare const RELEASES_REPO = "WrongStack/WrongStack";
+export interface AttestationSubject {
+    /** Release asset name, e.g. `wstack-windows-x64.exe`. */
+    assetName: string;
+    /** Lowercase hex SHA-256 of the downloaded bytes. */
+    sha256: string;
+    /** Release version without the `v`, e.g. `1.0.25`. */
+    version: string;
+}
+/** Throws unless GitHub holds a release attestation for `subject`. */
+export declare function verifyReleaseAttestation(subject: AttestationSubject, signal?: AbortSignal): Promise<void>;
+//# sourceMappingURL=release-attestation.d.ts.map

package/dist/remote/remote-session.d.ts

@@ -0,0 +1,64 @@
+/**
+ * `wstack remote user@host:/path`: the agent, its tools and its project
+ * daemons run on the remote machine; the WebUI is opened locally through an
+ * SSH tunnel. WrongStack's own build is uploaded to the remote on first use
+ * (per version, next to nothing the user installed), the WebUI host is started
+ * detached so a dropped connection does not end it, and the tunnel is reopened
+ * when it drops.
+ *
+ * SSH is the system `ssh`, so the user's `~/.ssh/config`, agent and known
+ * hosts apply. Credentials are not copied: the remote WrongStack uses its own
+ * configuration, which the remote WebUI sets up like a local first run.
+ *
+ * @module remote/remote-session
+ */
+import { type ChildProcess } from 'node:child_process';
+import type { Readable } from 'node:stream';
+import { type RemoteTarget } from './remote-target.js';
+export interface SshResult {
+    code: number;
+    stdout: string;
+}
+/** Runs one command on the remote host; `input` is its stdin. */
+export type SshRunner = (remoteCommand: string, input: string | Readable) => Promise<SshResult>;
+/** Opens the tunnel; the returned process lives as long as the tunnel does. */
+export type TunnelOpener = (localPort: number, remotePort: number) => ChildProcess;
+export interface RemoteBinary {
+    file: string;
+    /** Names the build on the remote machine. */
+    version: string;
+}
+export interface RemoteSessionOptions {
+    target: RemoteTarget;
+    /** Preferred local port for the WebUI (the next free one is used). */
+    localPort: number;
+    /** Leave the remote WebUI running after this command ends. */
+    keep: boolean;
+    open: boolean;
+    signal: AbortSignal;
+    log: (line: string) => void;
+    ssh: SshRunner;
+    tunnel: TunnelOpener;
+    /** The build for a remote `buildTarget` (`bun-linux-x64`, …); may download it. */
+    resolveBinary: (buildTarget: string, installed: readonly string[]) => Promise<RemoteBinary>;
+    openUrl?: ((url: string) => void) | undefined;
+    /** Waits before a reconnect attempt; injected in tests. */
+    sleep?: ((ms: number) => Promise<void>) | undefined;
+    /** How long the WebUI gets to answer through a new tunnel. */
+    readyTimeoutMs?: number | undefined;
+}
+export declare function sha256File(file: string): Promise<string>;
+/** The first free port at or above `start` on the local loopback. */
+export declare function freeLocalPort(start: number): Promise<number>;
+export declare function runRemoteSession(opts: RemoteSessionOptions): Promise<number>;
+export declare function systemSsh(target: RemoteTarget, options: {
+    sshConfig?: string | undefined;
+    batch: boolean;
+}): {
+    run: SshRunner;
+    tunnel: TunnelOpener;
+};
+/** Cached download location for release builds. */
+export declare function releaseCacheFile(root: string, version: string, assetName: string): string;
+export declare function cachedFile(file: string): Promise<string | undefined>;
+//# sourceMappingURL=remote-session.d.ts.map

package/dist/remote/remote-target.d.ts

@@ -0,0 +1,69 @@
+/**
+ * The pure half of `wstack remote`: where to connect, which build the remote
+ * machine needs, and the POSIX sh scripts run there. No process is started
+ * here, so all of it is testable without an SSH server.
+ *
+ * @module remote/remote-target
+ */
+export interface RemoteTarget {
+    /** What `ssh` connects to: `user@host`, `host`, or a `~/.ssh/config` alias. */
+    destination: string;
+    port?: number | undefined;
+    /** Project directory on the remote machine. */
+    path: string;
+}
+/**
+ * `user@host:/path`, `host:~/path`, or `ssh://user@host:2222/path`. The path
+ * is required: it is the remote project the agent works in.
+ */
+export declare function parseRemoteTarget(input: string): RemoteTarget;
+/** One argument for a POSIX shell, single-quoted. */
+export declare function shQuote(value: string): string;
+/**
+ * The build for a machine, from `uname -s`, `uname -m` and whether its libc is
+ * musl. Windows hosts are not supported: the remote scripts are POSIX sh.
+ */
+export declare function buildTargetFor(os: string, arch: string, musl: boolean): string;
+export interface ProbeResult {
+    os: string;
+    arch: string;
+    musl: boolean;
+    pathExists: boolean;
+    /** Versions already installed under `~/.wrongstack/remote`. */
+    versions: string[];
+    /** A server a previous run left running for this path. */
+    server?: {
+        pid: number;
+        port: number;
+        version: string;
+        token: string;
+    } | undefined;
+}
+/** Reports the machine, the project path, the builds present and a running server. */
+export declare function probeScript(path: string): string;
+export declare function parseProbe(output: string): ProbeResult;
+/** The remote file a version's build lives in. */
+export declare function remoteBinaryPath(version: string): string;
+/**
+ * Receives a build on stdin, makes it executable, and prints its SHA-256 so
+ * the caller can compare it with what it sent. Run with `sh -c`.
+ */
+export declare function installScript(version: string): string;
+/**
+ * Starts the WebUI host for `path` detached from the SSH session (a dropped
+ * connection must not end it), bound to the remote loopback only, and waits
+ * for it to report its port. The token travels inside this script, which is
+ * sent on stdin: it never appears on a command line another user can see.
+ *
+ * A remote machine WrongStack has not been set up on has no provider it can
+ * use; the host is then started in setup mode, and one is chosen in the WebUI.
+ */
+export declare function startScript(options: {
+    path: string;
+    version: string;
+    token: string;
+    preferredPort: number;
+}): string;
+/** Stops the server a start left for `path`, if it is still running. */
+export declare function stopScript(path: string): string;
+//# sourceMappingURL=remote-target.d.ts.map