@wrongstack/cli 1.0.24 → 1.0.27

package/dist/execution-chimera-review.d.ts

@@ -19,6 +19,18 @@ type Config = ExecuteDeps['core']['config'];
  * direct test.
  */
 export declare function normalizeFileKeyForCitation(raw: string, cwd: string): string;
+/**
+ * Operator-facing store-maintenance knobs, read live from `config` so a hot
+ * config edit is picked up on the next review completion. Deliberately narrower
+ * than core's `ReviewStoreMaintenanceOptions`: the CLI owns *reading config*,
+ * core owns *interpreting it* (day→ms, `0` = disabled, garbage = default).
+ */
+type ChimeraStoreMaintenanceOptions = {
+    /** Cap for non-terminal (`open`/`actioned`) review rows, in days. */
+    openRetentionDays?: number | undefined;
+    /** Cap for non-terminal (`active`/`triaged`/`in_progress`) findings, in days. */
+    activeRetentionDays?: number | undefined;
+};
 type InstallChimeraReviewHandlerOptions = {
     events: Events;
     director: Director | null | undefined;
@@ -36,7 +48,12 @@ type InstallChimeraReviewHandlerOptions = {
      * `packages/core/src/coordination/provider-status-tracker.ts`.
      */
     statusTracker?: ProviderModelStatusTracker | undefined;
-    persistReview?: ((payload: ChimeraReviewCompletePayload, projectDir: string) => Promise<void>) | undefined;
+    /**
+     * Persistence seam, injectable for tests. The third argument carries the
+     * operator's store-maintenance knobs resolved from `config` at call time, so
+     * a hot config edit applies to the next completion. Test doubles may ignore it.
+     */
+    persistReview?: ((payload: ChimeraReviewCompletePayload, projectDir: string, maintenance?: ChimeraStoreMaintenanceOptions) => Promise<void>) | undefined;
     trackWork: (work: Promise<void>) => void;
     /** Optional session-teardown chain — the wildcard listener disposer is
      *  pushed here so the registration is released when the session ends. */

package/dist/fleet/host-types.d.ts

@@ -3,7 +3,7 @@ import type { BrainArbiter, ProviderModelStatusTracker } from '@wrongstack/core/
 import type { HookRunner } from '@wrongstack/core/hooks';
 import type { Container, EventBus } from '@wrongstack/core/kernel';
 import type { ProviderRegistry, ToolRegistry } from '@wrongstack/core/registry';
-import type { ConfigStore, ModelsRegistry, Renderer, SecretScrubber, SessionWriter, SkillLoader, SystemPromptBuilder, TokenCounter } from '@wrongstack/core/types';
+import type { ConfigStore, ModelsRegistry, Renderer, SecretScrubber, SessionWriter, SkillLoader, SystemPromptBuilder, TokenCounter, Tracer } from '@wrongstack/core/types';
 export interface MultiAgentDeps {
     container: Container;
     toolRegistry: ToolRegistry;
@@ -23,6 +23,8 @@ export interface MultiAgentDeps {
     projectRoot: string;
     cwd: string;
     secretScrubber: SecretScrubber;
+    /** OTLP tracer shared with the leader, so worker runs join its traces. */
+    tracer?: Tracer | undefined;
     /** Loader used to resolve the roster's per-role skill names. */
     skillLoader?: SkillLoader | undefined;
     renderer?: Renderer | undefined;

package/dist/goal-commands.d.ts

@@ -0,0 +1,47 @@
+/** Async `fs.access`-style existence check — never throws. */
+export declare function pathExists(p: string): Promise<boolean>;
+/**
+ * Cap on captured command output. Verification commands (`pnpm test` across
+ * a large monorepo) can emit tens of MB on a verbose run — accumulating the
+ * full transcript spikes the host heap for output nothing ever reads in
+ * full. runCmd keeps the TAIL (the failure summary lives at the end of a
+ * test run); gitText keeps the head (its commands are tiny).
+ */
+export declare const MAX_CMD_OUTPUT = 200000;
+/** Run a git command, returning trimmed stdout (empty string on failure). */
+export declare function gitText(args: string[], cwd: string): Promise<{
+    code: number;
+    out: string;
+}>;
+export declare function isGitRepo(cwd: string): Promise<boolean>;
+export declare const GOAL_BASE_SAFE_CMDS: ReadonlySet<string>;
+export declare let goalAllowed: Set<string>;
+/**
+ * Extend/trim the autonomous goal command allowlist from the user's exec
+ * policy. Mirrors `configureExecPolicy` but keeps goal's narrower base.
+ * Idempotent (always rebuilt from the base).
+ */
+export declare function configureGoalPolicy(opts?: {
+    allow?: readonly string[] | undefined;
+    deny?: readonly string[] | undefined;
+}): void;
+/** Reset the goal allowlist to its built-in base (tests / re-init). */
+export declare function resetGoalPolicy(): void;
+/** Whether `cmd` may run in autonomous goal verification. */
+export declare function isGoalCommandAllowed(cmd: string): boolean;
+export declare const DESTRUCTIVE_PATTERNS: readonly RegExp[];
+/** Run an arbitrary command, capturing combined stdout+stderr. */
+export declare function runCmd(cmd: string, args: string[], cwd: string, shell?: boolean): Promise<{
+    code: number;
+    out: string;
+}>;
+/**
+ * Detect the project's package manager from lockfiles at the repo root.
+ * Async so the verify-step boot path doesn't block the event loop on `stat`
+ * for missing files in CWD or in monorepo setups where the lockfile lives
+ * several levels up.
+ */
+export declare function detectPackageManager(root: string): Promise<string>;
+/** Read package.json scripts for a directory (empty on any failure). */
+export declare function readScripts(cwd: string): Promise<Record<string, string>>;
+//# sourceMappingURL=goal-commands.d.ts.map

package/dist/goal-host.d.ts

@@ -1,3 +1,4 @@
+export { configureGoalPolicy, isGoalCommandAllowed, resetGoalPolicy } from './goal-commands.js';
 /**
  * Goal host wiring for the CLI.
  *
@@ -20,19 +21,6 @@ import { type PhaseGraph, type PhaseProgress } from '@wrongstack/core/goal';
 import type { EventBus } from '@wrongstack/core/kernel';
 import type { Config, TaskNode } from '@wrongstack/core/types';
 import type { MultiAgentHost } from './multi-agent.js';
-/**
- * Extend/trim the autonomous goal command allowlist from the user's exec
- * policy. Mirrors `configureExecPolicy` but keeps goal's narrower base.
- * Idempotent (always rebuilt from the base).
- */
-export declare function configureGoalPolicy(opts?: {
-    allow?: readonly string[] | undefined;
-    deny?: readonly string[] | undefined;
-}): void;
-/** Reset the goal allowlist to its built-in base (tests / re-init). */
-export declare function resetGoalPolicy(): void;
-/** Whether `cmd` may run in autonomous goal verification. */
-export declare function isGoalCommandAllowed(cmd: string): boolean;
 export interface GoalHostDeps {
     multiAgentHost: MultiAgentHost;
     /** Read the *current* Config lazily (it may be patched, e.g. YOLO toggles). */
@@ -103,5 +91,4 @@ export interface GoalHostHooks {
     onWorktree: (action: 'list' | 'merge' | 'prune' | 'clean', target?: string) => Promise<string>;
 }
 export declare function createGoalHost(deps: GoalHostDeps): GoalHostHooks;
-export {};
 //# sourceMappingURL=goal-host.d.ts.map

package/dist/{hq-JTUTFI4L.js → hq-44F4OQH2.js}

@@ -1,6 +1,3 @@
-import {
-  parseTokenTtlValue
-} from "./chunk-UZ2TMHNH.js";
 import {
   resolveHqPasswordInput
 } from "./chunk-AUQDGU5D.js";
@@ -11,6 +8,9 @@ import {
 import {
   parseHqIpAllowlist
 } from "./chunk-Q7E3BPDU.js";
+import {
+  parseTokenTtlValue
+} from "./chunk-UZ2TMHNH.js";
 
 // src/subcommands/handlers/hq.ts
 import {
@@ -316,7 +316,7 @@ var hqCmd = async (args, deps) => {
     return hqAlertsCmd(args.slice(1), deps);
   }
   if (sub === "service") {
-    const { hqServiceCmd } = await import("./hq-service-NW56MUP2.js");
+    const { hqServiceCmd } = await import("./hq-service-BMMJAHRT.js");
     return hqServiceCmd(args.slice(1), deps);
   }
   if (sub === "help" || sub === "--help") {
@@ -329,7 +329,7 @@ var hqCmd = async (args, deps) => {
   return 1;
 };
 async function startServer(deps) {
-  const { startHqServer } = await import("./hq-server-PC7GZMPT.js");
+  const { startHqServer } = await import("./hq-server-UIB24LU6.js");
   const dataDir = resolveDataDir(deps);
   const flags = deps.flags ?? {};
   const rawPublicUrl = typeof flags["hq-public-url"] === "string" ? flags["hq-public-url"] : process.env.WRONGSTACK_HQ_PUBLIC_URL;
@@ -549,8 +549,9 @@ async function hqTokenCmd(args, deps) {
 }
 var TOKEN_CAPABILITIES = {
   // `control.approve` is grantable but never default — see
-  // DEFAULT_TOKEN_CAPABILITIES below.
-  browser: ["control.enqueue", "control.approve"],
+  // DEFAULT_TOKEN_CAPABILITIES below. `control.approve.once` is the narrower
+  // grant: yes/no on a single prompt, no persistent `always`/`deny` policy.
+  browser: ["control.enqueue", "control.approve", "control.approve.once"],
   client: ["telemetry.publish", "control.execute"]
 };
 var DEFAULT_TOKEN_CAPABILITIES = {
@@ -1003,4 +1004,4 @@ export {
   hqCmd,
   resolveAuditActor
 };
-//# sourceMappingURL=hq-JTUTFI4L.js.map
+//# sourceMappingURL=hq-44F4OQH2.js.map

package/dist/hq-fleet-control.d.ts

@@ -0,0 +1,36 @@
+/**
+ * HQ's fleet commands (`abort fleet`, `abort <agent>`) against a Director.
+ *
+ * Shared by the CLI host's own HQ connection and the embedded WebUI's per-tab
+ * presence, so both apply the same scoping rule.
+ *
+ * @module hq-fleet-control
+ */
+import { type Director } from '@wrongstack/core/coordination';
+export interface HqFleetScope {
+    /**
+     * `true` when several conversations share this Director (the WebUI host,
+     * one per tab). Then `abort fleet` may only ever reach the named session's
+     * workers — stopping another tab's fleet is worse than stopping nothing.
+     *
+     * A single-conversation host (TUI, REPL, one-shot) keeps the process-wide
+     * sweep as its fallback: after an in-place `/resume` the leader's older
+     * workers still carry the boot session as their origin, so a strictly
+     * scoped sweep would find none and silently leave them running.
+     */
+    multiConversation: boolean;
+}
+/** Stop the named session's workers; returns how many were stopped. */
+export declare function killHqSessionFleet(director: Director | null, sessionId: string | undefined, scope: HqFleetScope): Promise<number>;
+/** Terminate one subagent by id. Ids are process-unique, so no session check. */
+export declare function terminateHqAgent(director: Director | null, subagentId: string): Promise<boolean>;
+/** Spawn a roster (or ad-hoc) subagent owned by `sessionId`. */
+export declare function spawnHqAgent(director: Director | null, sessionId: string, role: string, task?: string, maxIterations?: number): Promise<string>;
+/** The three HQ fleet hooks, bound to a Director that may appear later. */
+export interface HqFleetControl {
+    killFleet(sessionId?: string): Promise<number>;
+    terminateAgent(subagentId: string): Promise<boolean>;
+    spawnAgent(role: string, task?: string, maxIterations?: number, sessionId?: string): Promise<string>;
+}
+export declare function createHqFleetControl(getDirector: () => Director | null, defaultSessionId: () => string, scope: HqFleetScope): HqFleetControl;
+//# sourceMappingURL=hq-fleet-control.d.ts.map

package/dist/hq-live-status.d.ts

@@ -0,0 +1,22 @@
+/**
+ * What THIS process's HQ connection is doing right now.
+ *
+ * `/hq status` used to describe only the configuration, which answers "where
+ * would a new session connect", not "is this terminal on HQ". The CLI host's
+ * telemetry registers a probe here; one host per process, so a module slot is
+ * the honest shape.
+ *
+ * @module hq-live-status
+ */
+export interface HqLiveConnectionStatus {
+    clientId: string;
+    projectId: string;
+    connected: boolean;
+    queuedFrames: number;
+    sessionId?: string | undefined;
+}
+/** Install the probe; returns an uninstall that only removes THIS probe. */
+export declare function setHqLiveStatusProbe(next: () => HqLiveConnectionStatus | undefined): () => void;
+/** `undefined` when no host registered, or HQ is off for this process. */
+export declare function readHqLiveStatus(): HqLiveConnectionStatus | undefined;
+//# sourceMappingURL=hq-live-status.d.ts.map

package/dist/hq-publisher.d.ts

@@ -10,7 +10,25 @@ export interface CliHqConnection {
 }
 interface CliHqConnectionOptions extends CliHqPublisherOptions {
     onConnect?: ((publisher: HqPublisher) => void) | undefined;
+    /**
+     * Called when a publisher is retired without an immediate replacement —
+     * HQ was turned off (or its endpoint removed) in the live config. Hosts
+     * stop the bridges they bound in `onConnect`.
+     */
+    onDisconnect?: (() => void) | undefined;
     retryIntervalMs?: number | undefined;
+    /**
+     * The LIVE app config. `appConfig` is a snapshot taken at boot; with this
+     * set, `/hq set|token|on|off|clear` take effect on the running connection
+     * within one retry interval instead of at the next session start.
+     */
+    getAppConfig?: (() => CliHqPublisherOptions['appConfig']) | undefined;
+    /**
+     * `false` for an AUXILIARY connection in a process whose host connection
+     * already syncs the project's Kanban boards. Two syncs in one process are
+     * two writers applying the same remote snapshots to the same board files.
+     */
+    ownKanbanSync?: boolean | undefined;
 }
 export declare function createCliHqPublisher(options: CliHqPublisherOptions): HqPublisher | undefined;
 export declare function startCliHqConnection(options: CliHqConnectionOptions): CliHqConnection;

package/dist/hq-server/routes/command-handlers.d.ts

@@ -1,7 +1,18 @@
 import type * as http from 'node:http';
-import type { HqCommandAuditLog } from '@wrongstack/core/hq';
+import type { HqCommand, HqCommandAuditLog } from '@wrongstack/core/hq';
 import type { TrustBoundary } from '@wrongstack/core/security';
 import type { WebSocket } from 'ws';
 import type { ConnectedClient, HqRouterMutableAuth, HqSessionEntry } from '../types.js';
 export declare function handleApiCommand(req: http.IncomingMessage, res: http.ServerResponse, url: URL, mutableAuth: HqRouterMutableAuth, sessions: Map<string, HqSessionEntry>, clients: Map<WebSocket, ConnectedClient>, browsers: Set<WebSocket>, auditLog: HqCommandAuditLog, trustBoundary: TrustBoundary): Promise<void>;
+/**
+ * Whether a credential may answer a prompt.
+ *
+ * `control.approve` answers anything. `control.approve.once` — what the mobile
+ * login carries — may release or refuse THIS call, or answer an ask_user
+ * question, but never send `always`/`deny`, which write persistent policy onto
+ * the machine: that is not a decision to hand to a phone's cookie. Before this
+ * the mobile session had no answer rights at all while its Attention view
+ * offered Allow/Deny buttons, so every tap came back 403.
+ */
+export declare function credentialMayAnswer(capabilities: readonly string[] | undefined, command: HqCommand): boolean;
 //# sourceMappingURL=command-handlers.d.ts.map

package/dist/hq-server/routes/data-handlers.d.ts

@@ -3,6 +3,6 @@ import type { createHqPersistence } from '@wrongstack/core/hq';
 import type { WebSocket } from 'ws';
 import type { ConnectedClient } from '../types.js';
 export declare function handleApiProjectDetail(_req: http.IncomingMessage, res: http.ServerResponse, url: URL, clients: Map<WebSocket, ConnectedClient>): Promise<void>;
-export declare function handleApiEvents(req: http.IncomingMessage, res: http.ServerResponse, persistence: ReturnType<typeof createHqPersistence>): Promise<void>;
+export declare function handleApiEvents(req: http.IncomingMessage, res: http.ServerResponse, persistence: ReturnType<typeof createHqPersistence>, resolveMachineClientIds?: (machineId: string) => ReadonlySet<string>): Promise<void>;
 export declare function handleApiTrendsCost(req: http.IncomingMessage, res: http.ServerResponse, persistence: ReturnType<typeof createHqPersistence>): Promise<void>;
 //# sourceMappingURL=data-handlers.d.ts.map

package/dist/hq-server/socket-credentials.d.ts

@@ -0,0 +1,63 @@
+/**
+ * Credential enforcement for HQ sockets that are ALREADY open.
+ *
+ * Neither side of a WebSocket re-presents its credential after the upgrade,
+ * so every rule here is the only enforcement that credential gets once the
+ * socket is live: revocation notices, expiry that happens with the clock
+ * rather than with an auth.json write, and client tokens that stopped being
+ * live.
+ *
+ * @module hq-server/socket-credentials
+ */
+import { type HqToken } from '@wrongstack/core/hq';
+import { WebSocket } from 'ws';
+import type { HqRouterMutableAuth, HqSessionEntry } from './types.js';
+export interface HqSocketCredentialState {
+    mutableAuth: HqRouterMutableAuth;
+    sessions: Map<string, HqSessionEntry>;
+    browsers: Set<WebSocket>;
+    /** Session that authorized each cookie-authenticated browser socket. */
+    browserSocketSessions: Map<WebSocket, string>;
+    /** Token each `/ws/client` socket authenticated with (absent in open mode). */
+    clientSocketTokens: Map<WebSocket, HqToken | undefined>;
+    /**
+     * Browser-token verifier each bare loopback `?token=` `/ws/browser` socket
+     * authenticated with. Those sockets have no session, so the session sweep
+     * never saw them: one kept streaming after its token expired by the clock
+     * (H-3, security-check 2026-09-26). Optional for callers that predate it.
+     */
+    browserSocketTokenKeys?: Map<WebSocket, string> | undefined;
+}
+export interface HqSocketCredentialEnforcer {
+    /**
+     * Tell the browsers a token revocation can concern.
+     *
+     * This ONLY announces; it deliberately does not close. The auth.json
+     * watcher owns eviction and does it precisely (it deletes the sessions
+     * whose `tokenId` is no longer live, and distinguishes a password change
+     * from a token change). Because the revocation hook fires from
+     * `authState.apply`, which the watcher calls before its close loop, the
+     * browser still learns why it is about to be disconnected.
+     *
+     * A socket bound to a password (or mobile) session, or to a session minted
+     * from a DIFFERENT token, is untouched by the revocation — telling it anyway
+     * made every password-signed dashboard re-validate and, having no stored
+     * token to re-mint, sign itself out. A socket with no recorded session
+     * authenticated with a bare `?token=` the server cannot attribute, so it is
+     * told and re-validates on its own (fail closed).
+     */
+    announceRevokedTokens(keys: readonly string[], ids: readonly string[]): void;
+    /** Close every `/ws/client` socket whose credential is no longer live. */
+    closeUnauthorizedClientSockets(): void;
+    /**
+     * Credentials also die with the clock. The watcher reacts to file changes
+     * only, so before this a client token or a token-backed browser session
+     * that reached its `expiresAt` kept its open socket (telemetry in, commands
+     * out) until the process restarted.
+     */
+    sweepExpiredSocketCredentials(now?: number): void;
+    /** Close the browser sockets bound to a session that was just removed. */
+    closeSessionSockets(sessionId: string, reason: string): void;
+}
+export declare function createHqSocketCredentialEnforcer(state: HqSocketCredentialState): HqSocketCredentialEnforcer;
+//# sourceMappingURL=socket-credentials.d.ts.map

package/dist/hq-server/upgrade-handler.d.ts

@@ -28,6 +28,8 @@ interface HqUpgradeHandlerDeps {
      * the revocation path treats that absence as "affected" (fail closed).
      */
     browserSocketSessions: Map<WebSocket, string>;
+    /** Browser-token verifier behind each bare `?token=` browser socket (H-3). */
+    browserSocketTokenKeys?: Map<WebSocket, string> | undefined;
     browsers: Set<WebSocket>;
     eventLog: import('@wrongstack/core/hq').HqEventEnvelope[];
     transcripts: Map<string, TranscriptRing>;

package/dist/hq-server/ws.d.ts

@@ -10,6 +10,30 @@ export { fanoutKanbanDelta } from './ws-client-events.js';
 export { detectLeaderLoss } from './ws-leader.js';
 export { handleClientResume } from './ws-resume.js';
 export declare function handleBrowser(ws: WebSocket, snapshotBroadcaster: HqSnapshotBroadcaster, browsers: Set<WebSocket>, eventLog: HqEventEnvelope[]): void;
+/**
+ * Resolve every command the disconnecting client never picked up.
+ *
+ * The queue lives on the per-socket `ConnectedClient`, so it dies with the
+ * socket: a command enqueued in the window between the operator's dispatch and
+ * the next 500 ms `command_poll` is simply gone, and nothing re-queues it on
+ * the replacement connection. Left alone, its audit row stayed `queued`
+ * forever — the Control rail showed a command as pending that will never run,
+ * which is the one thing an operator must not have to guess about.
+ *
+ * `status: 'queued'` in the audit log is the exact undelivered set: the poll
+ * handler flips a command to `delivered` the moment it is put on the wire, so
+ * anything still `queued` never reached the client. Delivered-but-unacked
+ * commands are deliberately left alone — those DID run, and the ack may simply
+ * have been in flight when the socket closed.
+ *
+ * EVERY path that removes a client from `clients` must call this. The socket's
+ * own `close` handler finds the client through `clients.get(ws)`, so a path
+ * that deletes the entry first — the heartbeat-timeout eviction, the
+ * sessionless-surface eviction, the supersede loop — leaves that handler with
+ * nothing to resolve, and the rows it owned stayed `queued` forever. Those are
+ * exactly the cases (a hung client, a zombie socket) where commands strand.
+ */
+export declare function failUndeliveredCommands(lostClient: ConnectedClient, browsers: Set<WebSocket>, auditLog: HqCommandAuditLog | undefined): void;
 export declare function handleClient(ws: WebSocket, clients: Map<WebSocket, ConnectedClient>, browsers: Set<WebSocket>, eventLog: HqEventEnvelope[], auth: {
     token?: HqToken | undefined;
     getOperatorPolicy: () => Partial<HqRedactionPolicy> | undefined;

package/dist/{hq-server-PC7GZMPT.js → hq-server-UIB24LU6.js}

@@ -10,7 +10,7 @@ import {
   readLocalSubagentTranscript,
   sanitizeApiError,
   startHqServer
-} from "./chunk-DRM7PSW7.js";
+} from "./chunk-ENRYW73H.js";
 import "./chunk-HXJYHAR4.js";
 import "./chunk-5EA6OTLJ.js";
 import "./chunk-Q7E3BPDU.js";
@@ -27,4 +27,4 @@ export {
   sanitizeApiError,
   startHqServer
 };
-//# sourceMappingURL=hq-server-PC7GZMPT.js.map
+//# sourceMappingURL=hq-server-UIB24LU6.js.map

package/dist/{hq-service-NW56MUP2.js → hq-service-BMMJAHRT.js}

@@ -4,10 +4,10 @@ import {
 import {
   detectUpdatePackageManager,
   detectUpdatePackageName
-} from "./chunk-QFPQXKCG.js";
+} from "./chunk-KOEO4CJG.js";
 import "./chunk-U3SS4NRH.js";
-import "./chunk-ZZRSG7VK.js";
-import "./chunk-YBUCXXYZ.js";
+import "./chunk-RZ4ZDRYA.js";
+import "./chunk-F5DCFAKI.js";
 
 // src/hq-service.ts
 import { spawn } from "node:child_process";
@@ -511,4 +511,4 @@ export {
   hqServiceCmd,
   renderHqServiceAssets
 };
-//# sourceMappingURL=hq-service-NW56MUP2.js.map
+//# sourceMappingURL=hq-service-BMMJAHRT.js.map