@wrongstack/cli 1.0.26 → 1.0.27

package/dist/{execution-7QIP6GRY.js → execution-3STBD2U7.js}

@@ -1,10 +1,12 @@
 import {
+  createHqFleetControl,
   getSuggestions,
   normalizeTuiThinkingWord,
+  resolveExecutionMode,
   runGit,
   setAutoSuggestions,
   setSuggestions
-} from "./chunk-OWNC7LMD.js";
+} from "./chunk-HDMFKTT3.js";
 import {
   deriveFsAccessPair,
   persistConfigSetting
@@ -48,7 +50,7 @@ import {
 } from "./chunk-HXJYHAR4.js";
 import {
   startCliHqConnection
-} from "./chunk-KJS5543T.js";
+} from "./chunk-RGFWGUAB.js";
 import {
   CLI_VERSION
 } from "./chunk-F5DCFAKI.js";
@@ -155,6 +157,15 @@ async function runSingleShotDispatch(ctx) {
   const ctrl = new AbortController();
   const onSigint = () => ctrl.abort();
   process.on("SIGINT", onSigint);
+  const interrupt = ctx.interruptController;
+  const previousAbortLeader = interrupt?.abortLeader;
+  if (interrupt !== void 0) {
+    interrupt.abortLeader = () => {
+      if (ctrl.signal.aborted) return false;
+      ctrl.abort();
+      return true;
+    };
+  }
   let budget;
   if (limitUsd !== void 0 && ctx.events) {
     budget = watchSingleShotBudget({
@@ -207,6 +218,9 @@ async function runSingleShotDispatch(ctx) {
     stopStream?.();
     budget?.dispose();
     process.off("SIGINT", onSigint);
+    if (interrupt !== void 0 && previousAbortLeader !== void 0) {
+      interrupt.abortLeader = previousAbortLeader;
+    }
     const { getProcessRegistry: getProcessRegistry2 } = await import("@wrongstack/tools");
     getProcessRegistry2().killAll({ preserveBackground: true });
   }
@@ -330,6 +344,8 @@ async function runWebUIDispatch(ctx) {
     onKanbanDispatch,
     getFleetBudget,
     stopSessionFleet,
+    interruptController,
+    hqFleetControl,
     onSessionRetired,
     leaderAutoWake,
     webuiSessionChild
@@ -338,7 +354,7 @@ async function runWebUIDispatch(ctx) {
   const isSimpleUi = !isSessionChild && flags["simpleui"] === true;
   agent.disableInteractiveConfirmation();
   renderer.setSilent(true);
-  const { runWebUI } = await import("./webui-server-YTHLRFD2.js");
+  const { runWebUI } = await import("./webui-server-GCXIO3JY.js");
   const flagValue = (names) => {
     for (const name of names) {
       if (!Object.hasOwn(flags, name)) continue;
@@ -440,6 +456,8 @@ async function runWebUIDispatch(ctx) {
     sessionStore,
     ...getFleetBudget ? { getFleetBudget } : {},
     ...stopSessionFleet ? { stopSessionFleet } : {},
+    ...interruptController ? { interruptController } : {},
+    ...hqFleetControl ? { hqFleetControl } : {},
     ...onSessionRetired ? { onSessionRetired } : {},
     ...leaderAutoWake ? { leaderAutoWake } : {},
     sessionsDir: projectSessionsDir,
@@ -579,16 +597,6 @@ async function runWebUIDispatch(ctx) {
   return webuiExit;
 }
 
-// src/boot/execution-mode.ts
-function resolveExecutionMode(positional, flags) {
-  const prompt = typeof flags["prompt"] === "string" ? flags["prompt"] : "";
-  if (positional.length > 0 || prompt.length > 0) return "single-shot";
-  if (flags.tui && flags["no-tui"] !== true && !flags.webui && !flags["webui-session-child"])
-    return "tui";
-  if (flags.webui || flags["webui-session-child"]) return "webui";
-  return "repl";
-}
-
 // src/boot/piped-stdin.ts
 var PIPED_STDIN_FIRST_BYTE_TIMEOUT_MS = 3e3;
 var PIPED_STDIN_MAX_BYTES = 2 * 1024 * 1024;
@@ -1206,6 +1214,7 @@ import {
 import { resetSessionSubagentPolicy } from "@wrongstack/core/coordination";
 import { TOKENS } from "@wrongstack/core/kernel";
 import { restoreSessionPermissionOverrides } from "@wrongstack/core/security";
+import { restoreRequiredSkillsFromEvents } from "@wrongstack/core/skills";
 import { DefaultSessionStore } from "@wrongstack/core/storage";
 import {
   activateProjectStateGuard,
@@ -1315,9 +1324,11 @@ async function switchProjectInPlace(ctx, targetRoot, displayName) {
   context.projectRoot = resolved;
   context.workingDir = resolved;
   context.session = nextWriter;
+  if (state.sessionRef) state.sessionRef.current = nextWriter;
   context.state.replaceMessages([]);
   resetSessionSubagentPolicy(context);
   restoreSessionPermissionOverrides(context.meta, {});
+  restoreRequiredSkillsFromEvents(context, []);
   context.state.replaceTodos([]);
   context.clearFileTracking();
   context.clearMemoryEvidence?.();
@@ -1663,6 +1674,7 @@ function createSettingsAdapter(ctx) {
       featureMemory: cfg.features?.memory !== false,
       featureSkills: cfg.features?.skills !== false,
       featureModelsRegistry: cfg.features?.modelsRegistry !== false,
+      featureToolCoach: cfg.features?.toolCoach !== false,
       // Preserve the 'auto' sentinel for the picker DISPLAY (normalize would
       // collapse it to 'off', which would then overwrite 'auto' on save);
       // everything else normalizes to a concrete tier.
@@ -1733,7 +1745,7 @@ function createSettingsAdapter(ctx) {
   }
   async function saveSettings(s) {
     try {
-      if (s.mode !== void 0 || s.delayMs !== void 0 || s.titleAnimation !== void 0 || s.yolo !== void 0 || s.fleetChatVerbosity !== void 0 || s.chime !== void 0 || s.confirmExit !== void 0 || s.mouseMode !== void 0 || s.featureMcp !== void 0 || s.featurePlugins !== void 0 || s.featureMemory !== void 0 || s.featureSkills !== void 0 || s.featureModelsRegistry !== void 0 || s.featureTokenSaving !== void 0 || s.allowOutsideProjectRoot !== void 0 || s.contextAutoCompact !== void 0 || s.contextStrategy !== void 0 || s.contextMode !== void 0 || s.maxConcurrent !== void 0 || s.logLevel !== void 0 || s.auditLevel !== void 0 || s.indexOnStart !== void 0 || s.maxIterations !== void 0 || s.multiDiffSummaryThreshold !== void 0 || s.nextStepsTool !== void 0 || s.restrictFsToRoot !== void 0 || s.nextPrediction !== void 0 || s.debugStream !== void 0 || s.shellBangWarningDontShowAgain !== void 0 || s.configScope !== void 0 || s.enhanceDelayMs !== void 0 || s.enhanceEnabled !== void 0 || s.preRefineSeconds !== void 0 || s.enhanceLanguage !== void 0 || s.midRunSendPicker !== void 0 || s.statuslineMode !== void 0 || s.thinkingWord !== void 0 || s.animationStyle !== void 0 || s.autonomyNextPrompt !== void 0 || s.autoProceedMaxIterations !== void 0 || s.reasoningMode !== void 0 || s.reasoningEffort !== void 0 || s.reasoningPreserve !== void 0 || s.cacheTtl !== void 0 || s.breakerEnabled !== void 0 || s.breakerAutoKillResetMs !== void 0 || s.showModelReasoning !== void 0 || s.toolResultViewMode !== void 0 || s.showAgentSwarmPanel !== void 0 || s.showSidebar !== void 0 || s.panelPositions !== void 0 || s.lastSettingsField !== void 0 || s.showSageMemoryInject !== void 0 || s.sageMemoryInjectThreshold !== void 0 || s.readSymbols !== void 0 || // WrongProxy / WrongTrace: gate the persisted-section write on
+      if (s.mode !== void 0 || s.delayMs !== void 0 || s.titleAnimation !== void 0 || s.yolo !== void 0 || s.fleetChatVerbosity !== void 0 || s.chime !== void 0 || s.confirmExit !== void 0 || s.mouseMode !== void 0 || s.featureMcp !== void 0 || s.featurePlugins !== void 0 || s.featureMemory !== void 0 || s.featureSkills !== void 0 || s.featureModelsRegistry !== void 0 || s.featureToolCoach !== void 0 || s.featureTokenSaving !== void 0 || s.allowOutsideProjectRoot !== void 0 || s.contextAutoCompact !== void 0 || s.contextStrategy !== void 0 || s.contextMode !== void 0 || s.maxConcurrent !== void 0 || s.logLevel !== void 0 || s.auditLevel !== void 0 || s.indexOnStart !== void 0 || s.maxIterations !== void 0 || s.multiDiffSummaryThreshold !== void 0 || s.nextStepsTool !== void 0 || s.restrictFsToRoot !== void 0 || s.nextPrediction !== void 0 || s.debugStream !== void 0 || s.shellBangWarningDontShowAgain !== void 0 || s.configScope !== void 0 || s.enhanceDelayMs !== void 0 || s.enhanceEnabled !== void 0 || s.preRefineSeconds !== void 0 || s.enhanceLanguage !== void 0 || s.midRunSendPicker !== void 0 || s.statuslineMode !== void 0 || s.thinkingWord !== void 0 || s.animationStyle !== void 0 || s.autonomyNextPrompt !== void 0 || s.autoProceedMaxIterations !== void 0 || s.reasoningMode !== void 0 || s.reasoningEffort !== void 0 || s.reasoningPreserve !== void 0 || s.cacheTtl !== void 0 || s.breakerEnabled !== void 0 || s.breakerAutoKillResetMs !== void 0 || s.showModelReasoning !== void 0 || s.toolResultViewMode !== void 0 || s.showAgentSwarmPanel !== void 0 || s.showSidebar !== void 0 || s.panelPositions !== void 0 || s.lastSettingsField !== void 0 || s.showSageMemoryInject !== void 0 || s.sageMemoryInjectThreshold !== void 0 || s.readSymbols !== void 0 || // WrongProxy / WrongTrace: gate the persisted-section write on
       // either key being present in the live patch. Without this, a
       // picker toggle round-trip would silently no-op the persistence
       // layer (the runtime probe would never read the change).
@@ -1796,7 +1808,7 @@ function createSettingsAdapter(ctx) {
           if (s.nextPrediction !== void 0) decrypted.nextPrediction = s.nextPrediction;
           if (s.yolo !== void 0) decrypted.yolo = s.yolo;
           fsAccess = deriveFsAccess(s);
-          if (s.featureMcp !== void 0 || s.featurePlugins !== void 0 || s.featureMemory !== void 0 || s.featureSkills !== void 0 || s.featureModelsRegistry !== void 0 || s.featureTokenSaving !== void 0 || fsAccess !== void 0) {
+          if (s.featureMcp !== void 0 || s.featurePlugins !== void 0 || s.featureMemory !== void 0 || s.featureSkills !== void 0 || s.featureModelsRegistry !== void 0 || s.featureToolCoach !== void 0 || s.featureTokenSaving !== void 0 || fsAccess !== void 0) {
             const feats = decrypted.features ?? {};
             if (s.featureMcp !== void 0) feats.mcp = s.featureMcp;
             if (s.featurePlugins !== void 0) feats.plugins = s.featurePlugins;
@@ -1804,6 +1816,7 @@ function createSettingsAdapter(ctx) {
             if (s.featureSkills !== void 0) feats.skills = s.featureSkills;
             if (s.featureModelsRegistry !== void 0)
               feats.modelsRegistry = s.featureModelsRegistry;
+            if (s.featureToolCoach !== void 0) feats.toolCoach = s.featureToolCoach;
             if (s.featureTokenSaving !== void 0) feats.tokenSavingMode = s.featureTokenSaving;
             if (fsAccess !== void 0)
               feats.allowOutsideProjectRoot = fsAccess.allowOutsideProjectRoot;
@@ -1942,7 +1955,7 @@ function createSettingsAdapter(ctx) {
         configStore.update({
           ...s.nextPrediction !== void 0 ? { nextPrediction: s.nextPrediction } : {},
           ...s.yolo !== void 0 ? { yolo: s.yolo } : {},
-          ...s.featureMcp !== void 0 || s.featurePlugins !== void 0 || s.featureMemory !== void 0 || s.featureSkills !== void 0 || s.featureModelsRegistry !== void 0 || s.featureTokenSaving !== void 0 || fsAccess !== void 0 ? {
+          ...s.featureMcp !== void 0 || s.featurePlugins !== void 0 || s.featureMemory !== void 0 || s.featureSkills !== void 0 || s.featureModelsRegistry !== void 0 || s.featureToolCoach !== void 0 || s.featureTokenSaving !== void 0 || fsAccess !== void 0 ? {
             features: {
               ...currentConfig.features,
               ...decrypted.features ?? {}
@@ -2044,15 +2057,18 @@ import * as path8 from "node:path";
 import { THEME_PRESET_IDS } from "@wrongstack/core/types";
 import { updateJsonObjectFile } from "@wrongstack/core/utils";
 var VALID_PRESETS = new Set(THEME_PRESET_IDS);
+function isThemePresetId(candidate) {
+  return VALID_PRESETS.has(candidate);
+}
 function createThemeAdapter({ configStore, wpaths }) {
   return {
     getThemePreset: () => {
       const live = configStore.get();
       const candidate = live.themePreset;
-      return candidate && VALID_PRESETS.has(candidate) ? candidate : void 0;
+      return candidate && isThemePresetId(candidate) ? candidate : void 0;
     },
     saveThemePreset: async (preset) => {
-      if (!VALID_PRESETS.has(preset)) {
+      if (!isThemePresetId(preset)) {
         throw new Error(`Unknown theme preset: ${preset}`);
       }
       const configPath = activeProfileConfigPath(wpaths, configStore.get());
@@ -3094,6 +3110,7 @@ import {
 } from "@wrongstack/core/coordination";
 import { TOKENS as TOKENS2 } from "@wrongstack/core/kernel";
 import { restoreSessionPermissionOverrides as restoreSessionPermissionOverrides2 } from "@wrongstack/core/security";
+import { restoreRequiredSkillsFromEvents as restoreRequiredSkillsFromEvents2 } from "@wrongstack/core/skills";
 import { attachTodosCheckpoint, loadTodosCheckpoint } from "@wrongstack/core/storage";
 import { projectLastRequestTokens } from "@wrongstack/core/types/session-timeline";
 import { sessionScopedPath as sessionScopedPath2, toErrorMessage } from "@wrongstack/core/utils";
@@ -3270,6 +3287,7 @@ async function resumeSession(ctx, sessionId) {
       restoreSessionSubagentPolicy(agent.ctx, resumed.data.events, resumed.data.subagentsAllowed);
       restoreSessionSubagentModelPlan(agent.ctx, resumed.data.events);
       restoreSessionPermissionOverrides2(agent.ctx.meta, resumed.data);
+      restoreRequiredSkillsFromEvents2(agent.ctx, resumed.data.events);
     } catch (err) {
       agent.ctx.session = oldWriter;
       agent.ctx.state.replaceMessages(oldMessages);
@@ -3610,6 +3628,11 @@ import { emitReviewIfChanged } from "@wrongstack/core/plugin";
 
 // src/chimera-cascade-evidence.ts
 import { spawn as spawn2 } from "node:child_process";
+import {
+  buildWin32CmdShimInvocation,
+  isWinCmdShim,
+  resolveWin32Command
+} from "@wrongstack/tools/win32";
 var JSON_BLOCK_RE = /```(?:json)?\s*([\s\S]*?)```/gi;
 function tryParseJson(raw) {
   try {
@@ -3692,8 +3715,23 @@ var runCascadeVerificationCommand = (command, cwd, timeoutMs) => {
     return Promise.resolve({ exitCode: CASCADE_EVIDENCE_UNSAFE_EXIT });
   }
   const tokens = command.trim().split(/\s+/);
-  const executable = tokens[0];
-  const args = tokens.slice(1);
+  let executable = tokens[0];
+  let args = tokens.slice(1);
+  let windowsVerbatimArguments = false;
+  if (process.platform === "win32") {
+    const resolved = resolveWin32Command(executable);
+    if (isWinCmdShim(resolved)) {
+      let shim;
+      try {
+        shim = buildWin32CmdShimInvocation(resolved, args);
+      } catch {
+        return Promise.resolve({ exitCode: CASCADE_EVIDENCE_RUN_ERROR_EXIT });
+      }
+      executable = shim.command;
+      args = shim.args;
+      windowsVerbatimArguments = true;
+    }
+  }
   return new Promise((resolve5) => {
     let child;
     try {
@@ -3701,7 +3739,8 @@ var runCascadeVerificationCommand = (command, cwd, timeoutMs) => {
         cwd,
         stdio: "ignore",
         windowsHide: true,
-        signal: AbortSignal.timeout(timeoutMs)
+        signal: AbortSignal.timeout(timeoutMs),
+        ...windowsVerbatimArguments ? { windowsVerbatimArguments } : {}
       });
     } catch {
       resolve5({ exitCode: CASCADE_EVIDENCE_RUN_ERROR_EXIT });
@@ -4325,6 +4364,10 @@ function normalizeFileKeyForCitation(raw, cwd) {
   const relative = isAbsolute ? pathMod.relative(cwd, forward).replace(/\\/g, "/").replace(/^\.\//, "") : forward;
   return process.platform === "win32" ? relative.toLowerCase() : relative;
 }
+function readPositiveNumber(config, key) {
+  const raw = config.extensions?.["wstack-chimera"]?.[key];
+  return typeof raw === "number" && Number.isFinite(raw) && raw >= 0 ? raw : void 0;
+}
 function installChimeraReviewHandler({
   events,
   director,
@@ -4374,7 +4417,12 @@ function installChimeraReviewHandler({
       };
       const persistAndEmitCompletion = async (completion) => {
         try {
-          await persistReview(completion, projectDir);
+          await persistReview(completion, projectDir, {
+            // Read per completion, not once at install time, so an operator
+            // editing either key takes effect without a restart.
+            openRetentionDays: readPositiveNumber(config, "openRetentionDays"),
+            activeRetentionDays: readPositiveNumber(config, "activeRetentionDays")
+          });
           events.emitCustom("chimera.review_persisted", {
             reportId: completion.reportId,
             sessionId: completion.sessionId,
@@ -4710,13 +4758,13 @@ ${reviewBody}`;
   );
   if (off) teardownHandlers?.push(off);
 }
-async function persistChimeraReview(payload, projectDir) {
+async function persistChimeraReview(payload, projectDir, maintenance = {}) {
   const reportId = payload.reportId;
   if (!reportId) throw new Error("Chimera completion is missing reportId");
   await persistReviewReport(payload, reportId, projectDir);
   await integrateFindings(payload, projectDir, reportId);
   try {
-    await maybeCompactReviewStores(projectDir);
+    await maybeCompactReviewStores(projectDir, maintenance);
   } catch (error) {
     console.error(
       JSON.stringify({
@@ -5133,7 +5181,9 @@ function registerReplClient(opts) {
     projectRoot: replProjectRoot,
     projectName: path13.basename(replProjectRoot),
     appConfig: opts.appConfig,
-    capabilities: ["telemetry.publish", "mailbox.summary"]
+    capabilities: ["telemetry.publish", "mailbox.summary"],
+    // The CLI host's own connection in this process syncs the boards.
+    ownKanbanSync: false
   });
   const clientMailbox = getSharedProjectMailbox(
     projectDir,
@@ -5157,6 +5207,7 @@ function registerReplClient(opts) {
       clientMailbox.clientHeartbeat({ clientId, sessionId: opts.getSessionId?.() ?? replProjectRoot }).catch(() => {
       });
     }, 15e3);
+    clientHeartbeat.unref?.();
   }).catch(() => {
   });
   return {
@@ -6711,9 +6762,6 @@ async function execute(deps) {
     }
     const goalFlag = typeof flags["goal"] === "string" ? flags["goal"] : void 0;
     const askFlag = typeof flags["ask"] === "string" ? flags["ask"] : void 0;
-    if ((goalFlag || askFlag) && positional.length === 0 && !promptFlag) {
-      flags.tui = true;
-    }
     const executionMode = resolveExecutionMode(positional, flags);
     if (projectRoot && executionMode !== "webui") {
       backgroundKanbanSupervisor = (await import("./kanban-supervisor-67ECABTD.js")).createKanbanSupervisor({
@@ -6756,7 +6804,8 @@ async function execute(deps) {
         flags,
         tokenCounter,
         renderer,
-        events
+        events,
+        interruptController
       });
     } else if (executionMode === "tui") {
       agent.disableInteractiveConfirmation();
@@ -7126,6 +7175,7 @@ async function execute(deps) {
       try {
         code = await runWebUIDispatch({
           leaderAutoWake: webuiLeaderAutoWake,
+          interruptController,
           agent,
           events,
           session,
@@ -7168,9 +7218,13 @@ async function execute(deps) {
           // workers it is BLOCKED on; anything started with `spawn_subagent` +
           // `assign_task` keeps going unless asked to stop. Scoped to the
           // session so one tab's Stop never reaches another tab's fleet.
-          stopSessionFleet: async (sessionId) => {
-            await getDirector?.()?.terminateSession(sessionId);
-          },
+          stopSessionFleet: (sessionId) => getDirector?.()?.terminateSession(sessionId),
+          // HQ's per-tab abort fleet / abort agent / spawn, same scoping.
+          hqFleetControl: createHqFleetControl(
+            () => getDirector?.() ?? null,
+            () => "",
+            { multiConversation: true }
+          ),
           // Closing a tab is not stopping it. The run keeps going and keeps its
           // fleet; what goes is the background help pinned to that conversation
           // — the explore companion's poll timer and the shadow reviewer's
@@ -7288,4 +7342,4 @@ export {
   execute,
   resolveReviewerFallbackModels
 };
-//# sourceMappingURL=execution-7QIP6GRY.js.map
+//# sourceMappingURL=execution-3STBD2U7.js.map

package/dist/execution-chimera-review.d.ts

@@ -19,6 +19,18 @@ type Config = ExecuteDeps['core']['config'];
  * direct test.
  */
 export declare function normalizeFileKeyForCitation(raw: string, cwd: string): string;
+/**
+ * Operator-facing store-maintenance knobs, read live from `config` so a hot
+ * config edit is picked up on the next review completion. Deliberately narrower
+ * than core's `ReviewStoreMaintenanceOptions`: the CLI owns *reading config*,
+ * core owns *interpreting it* (day→ms, `0` = disabled, garbage = default).
+ */
+type ChimeraStoreMaintenanceOptions = {
+    /** Cap for non-terminal (`open`/`actioned`) review rows, in days. */
+    openRetentionDays?: number | undefined;
+    /** Cap for non-terminal (`active`/`triaged`/`in_progress`) findings, in days. */
+    activeRetentionDays?: number | undefined;
+};
 type InstallChimeraReviewHandlerOptions = {
     events: Events;
     director: Director | null | undefined;
@@ -36,7 +48,12 @@ type InstallChimeraReviewHandlerOptions = {
      * `packages/core/src/coordination/provider-status-tracker.ts`.
      */
     statusTracker?: ProviderModelStatusTracker | undefined;
-    persistReview?: ((payload: ChimeraReviewCompletePayload, projectDir: string) => Promise<void>) | undefined;
+    /**
+     * Persistence seam, injectable for tests. The third argument carries the
+     * operator's store-maintenance knobs resolved from `config` at call time, so
+     * a hot config edit applies to the next completion. Test doubles may ignore it.
+     */
+    persistReview?: ((payload: ChimeraReviewCompletePayload, projectDir: string, maintenance?: ChimeraStoreMaintenanceOptions) => Promise<void>) | undefined;
     trackWork: (work: Promise<void>) => void;
     /** Optional session-teardown chain — the wildcard listener disposer is
      *  pushed here so the registration is released when the session ends. */

package/dist/{hq-GLZ7QESM.js → hq-44F4OQH2.js}

@@ -329,7 +329,7 @@ var hqCmd = async (args, deps) => {
   return 1;
 };
 async function startServer(deps) {
-  const { startHqServer } = await import("./hq-server-YTKDVQPY.js");
+  const { startHqServer } = await import("./hq-server-UIB24LU6.js");
   const dataDir = resolveDataDir(deps);
   const flags = deps.flags ?? {};
   const rawPublicUrl = typeof flags["hq-public-url"] === "string" ? flags["hq-public-url"] : process.env.WRONGSTACK_HQ_PUBLIC_URL;
@@ -549,8 +549,9 @@ async function hqTokenCmd(args, deps) {
 }
 var TOKEN_CAPABILITIES = {
   // `control.approve` is grantable but never default — see
-  // DEFAULT_TOKEN_CAPABILITIES below.
-  browser: ["control.enqueue", "control.approve"],
+  // DEFAULT_TOKEN_CAPABILITIES below. `control.approve.once` is the narrower
+  // grant: yes/no on a single prompt, no persistent `always`/`deny` policy.
+  browser: ["control.enqueue", "control.approve", "control.approve.once"],
   client: ["telemetry.publish", "control.execute"]
 };
 var DEFAULT_TOKEN_CAPABILITIES = {
@@ -1003,4 +1004,4 @@ export {
   hqCmd,
   resolveAuditActor
 };
-//# sourceMappingURL=hq-GLZ7QESM.js.map
+//# sourceMappingURL=hq-44F4OQH2.js.map

package/dist/hq-fleet-control.d.ts

@@ -0,0 +1,36 @@
+/**
+ * HQ's fleet commands (`abort fleet`, `abort <agent>`) against a Director.
+ *
+ * Shared by the CLI host's own HQ connection and the embedded WebUI's per-tab
+ * presence, so both apply the same scoping rule.
+ *
+ * @module hq-fleet-control
+ */
+import { type Director } from '@wrongstack/core/coordination';
+export interface HqFleetScope {
+    /**
+     * `true` when several conversations share this Director (the WebUI host,
+     * one per tab). Then `abort fleet` may only ever reach the named session's
+     * workers — stopping another tab's fleet is worse than stopping nothing.
+     *
+     * A single-conversation host (TUI, REPL, one-shot) keeps the process-wide
+     * sweep as its fallback: after an in-place `/resume` the leader's older
+     * workers still carry the boot session as their origin, so a strictly
+     * scoped sweep would find none and silently leave them running.
+     */
+    multiConversation: boolean;
+}
+/** Stop the named session's workers; returns how many were stopped. */
+export declare function killHqSessionFleet(director: Director | null, sessionId: string | undefined, scope: HqFleetScope): Promise<number>;
+/** Terminate one subagent by id. Ids are process-unique, so no session check. */
+export declare function terminateHqAgent(director: Director | null, subagentId: string): Promise<boolean>;
+/** Spawn a roster (or ad-hoc) subagent owned by `sessionId`. */
+export declare function spawnHqAgent(director: Director | null, sessionId: string, role: string, task?: string, maxIterations?: number): Promise<string>;
+/** The three HQ fleet hooks, bound to a Director that may appear later. */
+export interface HqFleetControl {
+    killFleet(sessionId?: string): Promise<number>;
+    terminateAgent(subagentId: string): Promise<boolean>;
+    spawnAgent(role: string, task?: string, maxIterations?: number, sessionId?: string): Promise<string>;
+}
+export declare function createHqFleetControl(getDirector: () => Director | null, defaultSessionId: () => string, scope: HqFleetScope): HqFleetControl;
+//# sourceMappingURL=hq-fleet-control.d.ts.map

package/dist/hq-live-status.d.ts

@@ -0,0 +1,22 @@
+/**
+ * What THIS process's HQ connection is doing right now.
+ *
+ * `/hq status` used to describe only the configuration, which answers "where
+ * would a new session connect", not "is this terminal on HQ". The CLI host's
+ * telemetry registers a probe here; one host per process, so a module slot is
+ * the honest shape.
+ *
+ * @module hq-live-status
+ */
+export interface HqLiveConnectionStatus {
+    clientId: string;
+    projectId: string;
+    connected: boolean;
+    queuedFrames: number;
+    sessionId?: string | undefined;
+}
+/** Install the probe; returns an uninstall that only removes THIS probe. */
+export declare function setHqLiveStatusProbe(next: () => HqLiveConnectionStatus | undefined): () => void;
+/** `undefined` when no host registered, or HQ is off for this process. */
+export declare function readHqLiveStatus(): HqLiveConnectionStatus | undefined;
+//# sourceMappingURL=hq-live-status.d.ts.map

package/dist/hq-publisher.d.ts

@@ -10,7 +10,25 @@ export interface CliHqConnection {
 }
 interface CliHqConnectionOptions extends CliHqPublisherOptions {
     onConnect?: ((publisher: HqPublisher) => void) | undefined;
+    /**
+     * Called when a publisher is retired without an immediate replacement —
+     * HQ was turned off (or its endpoint removed) in the live config. Hosts
+     * stop the bridges they bound in `onConnect`.
+     */
+    onDisconnect?: (() => void) | undefined;
     retryIntervalMs?: number | undefined;
+    /**
+     * The LIVE app config. `appConfig` is a snapshot taken at boot; with this
+     * set, `/hq set|token|on|off|clear` take effect on the running connection
+     * within one retry interval instead of at the next session start.
+     */
+    getAppConfig?: (() => CliHqPublisherOptions['appConfig']) | undefined;
+    /**
+     * `false` for an AUXILIARY connection in a process whose host connection
+     * already syncs the project's Kanban boards. Two syncs in one process are
+     * two writers applying the same remote snapshots to the same board files.
+     */
+    ownKanbanSync?: boolean | undefined;
 }
 export declare function createCliHqPublisher(options: CliHqPublisherOptions): HqPublisher | undefined;
 export declare function startCliHqConnection(options: CliHqConnectionOptions): CliHqConnection;

package/dist/hq-server/routes/command-handlers.d.ts

@@ -1,7 +1,18 @@
 import type * as http from 'node:http';
-import type { HqCommandAuditLog } from '@wrongstack/core/hq';
+import type { HqCommand, HqCommandAuditLog } from '@wrongstack/core/hq';
 import type { TrustBoundary } from '@wrongstack/core/security';
 import type { WebSocket } from 'ws';
 import type { ConnectedClient, HqRouterMutableAuth, HqSessionEntry } from '../types.js';
 export declare function handleApiCommand(req: http.IncomingMessage, res: http.ServerResponse, url: URL, mutableAuth: HqRouterMutableAuth, sessions: Map<string, HqSessionEntry>, clients: Map<WebSocket, ConnectedClient>, browsers: Set<WebSocket>, auditLog: HqCommandAuditLog, trustBoundary: TrustBoundary): Promise<void>;
+/**
+ * Whether a credential may answer a prompt.
+ *
+ * `control.approve` answers anything. `control.approve.once` — what the mobile
+ * login carries — may release or refuse THIS call, or answer an ask_user
+ * question, but never send `always`/`deny`, which write persistent policy onto
+ * the machine: that is not a decision to hand to a phone's cookie. Before this
+ * the mobile session had no answer rights at all while its Attention view
+ * offered Allow/Deny buttons, so every tap came back 403.
+ */
+export declare function credentialMayAnswer(capabilities: readonly string[] | undefined, command: HqCommand): boolean;
 //# sourceMappingURL=command-handlers.d.ts.map

package/dist/hq-server/routes/data-handlers.d.ts

@@ -3,6 +3,6 @@ import type { createHqPersistence } from '@wrongstack/core/hq';
 import type { WebSocket } from 'ws';
 import type { ConnectedClient } from '../types.js';
 export declare function handleApiProjectDetail(_req: http.IncomingMessage, res: http.ServerResponse, url: URL, clients: Map<WebSocket, ConnectedClient>): Promise<void>;
-export declare function handleApiEvents(req: http.IncomingMessage, res: http.ServerResponse, persistence: ReturnType<typeof createHqPersistence>): Promise<void>;
+export declare function handleApiEvents(req: http.IncomingMessage, res: http.ServerResponse, persistence: ReturnType<typeof createHqPersistence>, resolveMachineClientIds?: (machineId: string) => ReadonlySet<string>): Promise<void>;
 export declare function handleApiTrendsCost(req: http.IncomingMessage, res: http.ServerResponse, persistence: ReturnType<typeof createHqPersistence>): Promise<void>;
 //# sourceMappingURL=data-handlers.d.ts.map

package/dist/hq-server/socket-credentials.d.ts

@@ -0,0 +1,63 @@
+/**
+ * Credential enforcement for HQ sockets that are ALREADY open.
+ *
+ * Neither side of a WebSocket re-presents its credential after the upgrade,
+ * so every rule here is the only enforcement that credential gets once the
+ * socket is live: revocation notices, expiry that happens with the clock
+ * rather than with an auth.json write, and client tokens that stopped being
+ * live.
+ *
+ * @module hq-server/socket-credentials
+ */
+import { type HqToken } from '@wrongstack/core/hq';
+import { WebSocket } from 'ws';
+import type { HqRouterMutableAuth, HqSessionEntry } from './types.js';
+export interface HqSocketCredentialState {
+    mutableAuth: HqRouterMutableAuth;
+    sessions: Map<string, HqSessionEntry>;
+    browsers: Set<WebSocket>;
+    /** Session that authorized each cookie-authenticated browser socket. */
+    browserSocketSessions: Map<WebSocket, string>;
+    /** Token each `/ws/client` socket authenticated with (absent in open mode). */
+    clientSocketTokens: Map<WebSocket, HqToken | undefined>;
+    /**
+     * Browser-token verifier each bare loopback `?token=` `/ws/browser` socket
+     * authenticated with. Those sockets have no session, so the session sweep
+     * never saw them: one kept streaming after its token expired by the clock
+     * (H-3, security-check 2026-09-26). Optional for callers that predate it.
+     */
+    browserSocketTokenKeys?: Map<WebSocket, string> | undefined;
+}
+export interface HqSocketCredentialEnforcer {
+    /**
+     * Tell the browsers a token revocation can concern.
+     *
+     * This ONLY announces; it deliberately does not close. The auth.json
+     * watcher owns eviction and does it precisely (it deletes the sessions
+     * whose `tokenId` is no longer live, and distinguishes a password change
+     * from a token change). Because the revocation hook fires from
+     * `authState.apply`, which the watcher calls before its close loop, the
+     * browser still learns why it is about to be disconnected.
+     *
+     * A socket bound to a password (or mobile) session, or to a session minted
+     * from a DIFFERENT token, is untouched by the revocation — telling it anyway
+     * made every password-signed dashboard re-validate and, having no stored
+     * token to re-mint, sign itself out. A socket with no recorded session
+     * authenticated with a bare `?token=` the server cannot attribute, so it is
+     * told and re-validates on its own (fail closed).
+     */
+    announceRevokedTokens(keys: readonly string[], ids: readonly string[]): void;
+    /** Close every `/ws/client` socket whose credential is no longer live. */
+    closeUnauthorizedClientSockets(): void;
+    /**
+     * Credentials also die with the clock. The watcher reacts to file changes
+     * only, so before this a client token or a token-backed browser session
+     * that reached its `expiresAt` kept its open socket (telemetry in, commands
+     * out) until the process restarted.
+     */
+    sweepExpiredSocketCredentials(now?: number): void;
+    /** Close the browser sockets bound to a session that was just removed. */
+    closeSessionSockets(sessionId: string, reason: string): void;
+}
+export declare function createHqSocketCredentialEnforcer(state: HqSocketCredentialState): HqSocketCredentialEnforcer;
+//# sourceMappingURL=socket-credentials.d.ts.map

package/dist/hq-server/upgrade-handler.d.ts

@@ -28,6 +28,8 @@ interface HqUpgradeHandlerDeps {
      * the revocation path treats that absence as "affected" (fail closed).
      */
     browserSocketSessions: Map<WebSocket, string>;
+    /** Browser-token verifier behind each bare `?token=` browser socket (H-3). */
+    browserSocketTokenKeys?: Map<WebSocket, string> | undefined;
     browsers: Set<WebSocket>;
     eventLog: import('@wrongstack/core/hq').HqEventEnvelope[];
     transcripts: Map<string, TranscriptRing>;

package/dist/hq-server/ws.d.ts

@@ -10,6 +10,30 @@ export { fanoutKanbanDelta } from './ws-client-events.js';
 export { detectLeaderLoss } from './ws-leader.js';
 export { handleClientResume } from './ws-resume.js';
 export declare function handleBrowser(ws: WebSocket, snapshotBroadcaster: HqSnapshotBroadcaster, browsers: Set<WebSocket>, eventLog: HqEventEnvelope[]): void;
+/**
+ * Resolve every command the disconnecting client never picked up.
+ *
+ * The queue lives on the per-socket `ConnectedClient`, so it dies with the
+ * socket: a command enqueued in the window between the operator's dispatch and
+ * the next 500 ms `command_poll` is simply gone, and nothing re-queues it on
+ * the replacement connection. Left alone, its audit row stayed `queued`
+ * forever — the Control rail showed a command as pending that will never run,
+ * which is the one thing an operator must not have to guess about.
+ *
+ * `status: 'queued'` in the audit log is the exact undelivered set: the poll
+ * handler flips a command to `delivered` the moment it is put on the wire, so
+ * anything still `queued` never reached the client. Delivered-but-unacked
+ * commands are deliberately left alone — those DID run, and the ack may simply
+ * have been in flight when the socket closed.
+ *
+ * EVERY path that removes a client from `clients` must call this. The socket's
+ * own `close` handler finds the client through `clients.get(ws)`, so a path
+ * that deletes the entry first — the heartbeat-timeout eviction, the
+ * sessionless-surface eviction, the supersede loop — leaves that handler with
+ * nothing to resolve, and the rows it owned stayed `queued` forever. Those are
+ * exactly the cases (a hung client, a zombie socket) where commands strand.
+ */
+export declare function failUndeliveredCommands(lostClient: ConnectedClient, browsers: Set<WebSocket>, auditLog: HqCommandAuditLog | undefined): void;
 export declare function handleClient(ws: WebSocket, clients: Map<WebSocket, ConnectedClient>, browsers: Set<WebSocket>, eventLog: HqEventEnvelope[], auth: {
     token?: HqToken | undefined;
     getOperatorPolicy: () => Partial<HqRedactionPolicy> | undefined;

package/dist/{hq-server-YTKDVQPY.js → hq-server-UIB24LU6.js}

@@ -10,7 +10,7 @@ import {
   readLocalSubagentTranscript,
   sanitizeApiError,
   startHqServer
-} from "./chunk-OAVBM55Q.js";
+} from "./chunk-ENRYW73H.js";
 import "./chunk-HXJYHAR4.js";
 import "./chunk-5EA6OTLJ.js";
 import "./chunk-Q7E3BPDU.js";
@@ -27,4 +27,4 @@ export {
   sanitizeApiError,
   startHqServer
 };
-//# sourceMappingURL=hq-server-YTKDVQPY.js.map
+//# sourceMappingURL=hq-server-UIB24LU6.js.map