@wrongstack/cli 1.0.24 → 1.0.27

package/dist/{projects-LMNAGGEU.js → projects-T4CZCA25.js}

@@ -1,8 +1,8 @@
 
 // src/subcommands/handlers/projects.ts
+import { color } from "@wrongstack/core/utils";
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
-import { color } from "@wrongstack/core/utils";
 var projectsCmd = async (_args, deps) => {
   const manifestPath = path.join(deps.paths.globalRoot, "projects.json");
   let entries;
@@ -18,10 +18,7 @@ var projectsCmd = async (_args, deps) => {
     return 0;
   }
   const sorted = [...entries].sort((a, b) => (b.lastSeen ?? "").localeCompare(a.lastSeen ?? ""));
-  const slugWidth = Math.min(
-    Math.max(...sorted.map((entry) => (entry.slug ?? "").length), 4),
-    40
-  );
+  const slugWidth = Math.min(Math.max(...sorted.map((entry) => (entry.slug ?? "").length), 4), 40);
   for (const entry of sorted) {
     const slug = (entry.slug ?? "?").padEnd(slugWidth);
     const seen = entry.lastSeen ?? "";
@@ -33,4 +30,4 @@ var projectsCmd = async (_args, deps) => {
 export {
   projectsCmd
 };
-//# sourceMappingURL=projects-LMNAGGEU.js.map
+//# sourceMappingURL=projects-T4CZCA25.js.map

package/dist/provider-helpers.d.ts

@@ -1,4 +1,11 @@
+/**
+ * Shared provider-config helpers used by the picker, main boot sequence,
+ * and subcommands. Keeps provider key detection and alias resolution in
+ * one place so the logic doesn't drift between call sites.
+ */
+import { isKeylessLocalProvider } from '@wrongstack/core/models';
 import type { Config, ModelsRegistry, ProviderConfig, ResolvedProvider } from '@wrongstack/core/types';
+export { isKeylessLocalProvider };
 /** Return the provider's visible model ids: models.dev plus anything the saved
  * config names that the catalog does not carry.
  *
@@ -23,17 +30,6 @@ import type { Config, ModelsRegistry, ProviderConfig, ResolvedProvider } from '@
  * request time rather than being silently unselectable, which is the better
  * failure: visible and actionable. */
 export declare function visibleModelIds(providerId: string, config: Config, catalogModelIds: string[], cfg?: ProviderConfig | undefined): string[];
-/**
- * Is this a keyless local gateway — a server on a loopback address that
- * declares no API-key env vars (omniroute, LiteLLM/vLLM/LM Studio/Ollama
- * running locally, …)? These need no credential, so they belong in the
- * picker even though `hasApiKey` returns false for them. Accepts the
- * minimal shape both call sites can supply.
- */
-export declare function isKeylessLocalProvider(provider: {
-    apiBase?: string | undefined;
-    envVars?: string[] | undefined;
-}): boolean;
 /**
  * Does this provider have an API key available — either in the
  * environment (via one of its known env vars) or stored in config

package/dist/{providers-models-2CFG46RD.js → providers-models-5Z2PJTEW.js}

@@ -1,12 +1,12 @@
 import {
   visibleModelIds
-} from "./chunk-3VXYY5JC.js";
-import {
-  activeProfileConfigPath
-} from "./chunk-YMXXOOFN.js";
+} from "./chunk-5UZBUV2H.js";
 import {
   mutateConfigProviders
 } from "./chunk-LUMETJFO.js";
+import {
+  activeProfileConfigPath
+} from "./chunk-YMXXOOFN.js";
 
 // src/subcommands/handlers/providers-models.ts
 import * as fs from "node:fs/promises";
@@ -670,4 +670,4 @@ export {
   modelsCmd,
   providersCmd
 };
-//# sourceMappingURL=providers-models-2CFG46RD.js.map
+//# sourceMappingURL=providers-models-5Z2PJTEW.js.map

package/dist/release-asset-download.d.ts

@@ -1,3 +1,13 @@
 /** Download one release asset without buffering beyond its configured ceiling. */
 export declare function downloadReleaseAsset(url: string, timeoutMs: number, maxBytes: number): Promise<Buffer>;
+/**
+ * Stream one release asset into `file` (created exclusively) and return its
+ * SHA-256. The background self-update uses this so a 100+ MB executable never
+ * sits in the session's heap. `file` is removed when the download fails.
+ */
+export declare function downloadReleaseAssetToFile(url: string, file: string, options: {
+    timeoutMs: number;
+    maxBytes: number;
+    signal?: AbortSignal | undefined;
+}): Promise<string>;
 //# sourceMappingURL=release-asset-download.d.ts.map

package/dist/release-attestation.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Build-provenance check for a downloaded standalone executable.
+ *
+ * SHA256SUMS comes from the same release as the binary, so it catches a
+ * corrupted download but not a forged one: whoever can upload the binary can
+ * upload a matching SHA256SUMS. The release workflow also attests every
+ * binary (`actions/attest-build-provenance`), and GitHub serves those
+ * attestations by digest. A binary is accepted only if one of them says this
+ * exact digest was built by `binaries.yml`, called from `release.yml`, for the
+ * push of the tag `v<version>` in this repository, on a GitHub-hosted runner.
+ * A build from a branch or a manual run is not a release and does not count.
+ *
+ * The Sigstore signature over the statement is not verified here: the
+ * statement is trusted as served by GitHub's API over TLS.
+ */
+/** GitHub repository the standalone executables are released from. */
+export declare const RELEASES_REPO = "WrongStack/WrongStack";
+export interface AttestationSubject {
+    /** Release asset name, e.g. `wstack-windows-x64.exe`. */
+    assetName: string;
+    /** Lowercase hex SHA-256 of the downloaded bytes. */
+    sha256: string;
+    /** Release version without the `v`, e.g. `1.0.25`. */
+    version: string;
+}
+/** Throws unless GitHub holds a release attestation for `subject`. */
+export declare function verifyReleaseAttestation(subject: AttestationSubject, signal?: AbortSignal): Promise<void>;
+//# sourceMappingURL=release-attestation.d.ts.map

package/dist/remote/remote-session.d.ts

@@ -0,0 +1,64 @@
+/**
+ * `wstack remote user@host:/path`: the agent, its tools and its project
+ * daemons run on the remote machine; the WebUI is opened locally through an
+ * SSH tunnel. WrongStack's own build is uploaded to the remote on first use
+ * (per version, next to nothing the user installed), the WebUI host is started
+ * detached so a dropped connection does not end it, and the tunnel is reopened
+ * when it drops.
+ *
+ * SSH is the system `ssh`, so the user's `~/.ssh/config`, agent and known
+ * hosts apply. Credentials are not copied: the remote WrongStack uses its own
+ * configuration, which the remote WebUI sets up like a local first run.
+ *
+ * @module remote/remote-session
+ */
+import { type ChildProcess } from 'node:child_process';
+import type { Readable } from 'node:stream';
+import { type RemoteTarget } from './remote-target.js';
+export interface SshResult {
+    code: number;
+    stdout: string;
+}
+/** Runs one command on the remote host; `input` is its stdin. */
+export type SshRunner = (remoteCommand: string, input: string | Readable) => Promise<SshResult>;
+/** Opens the tunnel; the returned process lives as long as the tunnel does. */
+export type TunnelOpener = (localPort: number, remotePort: number) => ChildProcess;
+export interface RemoteBinary {
+    file: string;
+    /** Names the build on the remote machine. */
+    version: string;
+}
+export interface RemoteSessionOptions {
+    target: RemoteTarget;
+    /** Preferred local port for the WebUI (the next free one is used). */
+    localPort: number;
+    /** Leave the remote WebUI running after this command ends. */
+    keep: boolean;
+    open: boolean;
+    signal: AbortSignal;
+    log: (line: string) => void;
+    ssh: SshRunner;
+    tunnel: TunnelOpener;
+    /** The build for a remote `buildTarget` (`bun-linux-x64`, …); may download it. */
+    resolveBinary: (buildTarget: string, installed: readonly string[]) => Promise<RemoteBinary>;
+    openUrl?: ((url: string) => void) | undefined;
+    /** Waits before a reconnect attempt; injected in tests. */
+    sleep?: ((ms: number) => Promise<void>) | undefined;
+    /** How long the WebUI gets to answer through a new tunnel. */
+    readyTimeoutMs?: number | undefined;
+}
+export declare function sha256File(file: string): Promise<string>;
+/** The first free port at or above `start` on the local loopback. */
+export declare function freeLocalPort(start: number): Promise<number>;
+export declare function runRemoteSession(opts: RemoteSessionOptions): Promise<number>;
+export declare function systemSsh(target: RemoteTarget, options: {
+    sshConfig?: string | undefined;
+    batch: boolean;
+}): {
+    run: SshRunner;
+    tunnel: TunnelOpener;
+};
+/** Cached download location for release builds. */
+export declare function releaseCacheFile(root: string, version: string, assetName: string): string;
+export declare function cachedFile(file: string): Promise<string | undefined>;
+//# sourceMappingURL=remote-session.d.ts.map

package/dist/remote/remote-target.d.ts

@@ -0,0 +1,69 @@
+/**
+ * The pure half of `wstack remote`: where to connect, which build the remote
+ * machine needs, and the POSIX sh scripts run there. No process is started
+ * here, so all of it is testable without an SSH server.
+ *
+ * @module remote/remote-target
+ */
+export interface RemoteTarget {
+    /** What `ssh` connects to: `user@host`, `host`, or a `~/.ssh/config` alias. */
+    destination: string;
+    port?: number | undefined;
+    /** Project directory on the remote machine. */
+    path: string;
+}
+/**
+ * `user@host:/path`, `host:~/path`, or `ssh://user@host:2222/path`. The path
+ * is required: it is the remote project the agent works in.
+ */
+export declare function parseRemoteTarget(input: string): RemoteTarget;
+/** One argument for a POSIX shell, single-quoted. */
+export declare function shQuote(value: string): string;
+/**
+ * The build for a machine, from `uname -s`, `uname -m` and whether its libc is
+ * musl. Windows hosts are not supported: the remote scripts are POSIX sh.
+ */
+export declare function buildTargetFor(os: string, arch: string, musl: boolean): string;
+export interface ProbeResult {
+    os: string;
+    arch: string;
+    musl: boolean;
+    pathExists: boolean;
+    /** Versions already installed under `~/.wrongstack/remote`. */
+    versions: string[];
+    /** A server a previous run left running for this path. */
+    server?: {
+        pid: number;
+        port: number;
+        version: string;
+        token: string;
+    } | undefined;
+}
+/** Reports the machine, the project path, the builds present and a running server. */
+export declare function probeScript(path: string): string;
+export declare function parseProbe(output: string): ProbeResult;
+/** The remote file a version's build lives in. */
+export declare function remoteBinaryPath(version: string): string;
+/**
+ * Receives a build on stdin, makes it executable, and prints its SHA-256 so
+ * the caller can compare it with what it sent. Run with `sh -c`.
+ */
+export declare function installScript(version: string): string;
+/**
+ * Starts the WebUI host for `path` detached from the SSH session (a dropped
+ * connection must not end it), bound to the remote loopback only, and waits
+ * for it to report its port. The token travels inside this script, which is
+ * sent on stdin: it never appears on a command line another user can see.
+ *
+ * A remote machine WrongStack has not been set up on has no provider it can
+ * use; the host is then started in setup mode, and one is chosen in the WebUI.
+ */
+export declare function startScript(options: {
+    path: string;
+    version: string;
+    token: string;
+    preferredPort: number;
+}): string;
+/** Stops the server a start left for `path`, if it is still running. */
+export declare function stopScript(path: string): string;
+//# sourceMappingURL=remote-target.d.ts.map