@wrongstack/cli 1.0.26 → 1.0.28

package/dist/hq-server/socket-credentials.d.ts

@@ -0,0 +1,63 @@
+/**
+ * Credential enforcement for HQ sockets that are ALREADY open.
+ *
+ * Neither side of a WebSocket re-presents its credential after the upgrade,
+ * so every rule here is the only enforcement that credential gets once the
+ * socket is live: revocation notices, expiry that happens with the clock
+ * rather than with an auth.json write, and client tokens that stopped being
+ * live.
+ *
+ * @module hq-server/socket-credentials
+ */
+import { type HqToken } from '@wrongstack/core/hq';
+import { WebSocket } from 'ws';
+import type { HqRouterMutableAuth, HqSessionEntry } from './types.js';
+export interface HqSocketCredentialState {
+    mutableAuth: HqRouterMutableAuth;
+    sessions: Map<string, HqSessionEntry>;
+    browsers: Set<WebSocket>;
+    /** Session that authorized each cookie-authenticated browser socket. */
+    browserSocketSessions: Map<WebSocket, string>;
+    /** Token each `/ws/client` socket authenticated with (absent in open mode). */
+    clientSocketTokens: Map<WebSocket, HqToken | undefined>;
+    /**
+     * Browser-token verifier each bare loopback `?token=` `/ws/browser` socket
+     * authenticated with. Those sockets have no session, so the session sweep
+     * never saw them: one kept streaming after its token expired by the clock
+     * (H-3, security-check 2026-09-26). Optional for callers that predate it.
+     */
+    browserSocketTokenKeys?: Map<WebSocket, string> | undefined;
+}
+export interface HqSocketCredentialEnforcer {
+    /**
+     * Tell the browsers a token revocation can concern.
+     *
+     * This ONLY announces; it deliberately does not close. The auth.json
+     * watcher owns eviction and does it precisely (it deletes the sessions
+     * whose `tokenId` is no longer live, and distinguishes a password change
+     * from a token change). Because the revocation hook fires from
+     * `authState.apply`, which the watcher calls before its close loop, the
+     * browser still learns why it is about to be disconnected.
+     *
+     * A socket bound to a password (or mobile) session, or to a session minted
+     * from a DIFFERENT token, is untouched by the revocation — telling it anyway
+     * made every password-signed dashboard re-validate and, having no stored
+     * token to re-mint, sign itself out. A socket with no recorded session
+     * authenticated with a bare `?token=` the server cannot attribute, so it is
+     * told and re-validates on its own (fail closed).
+     */
+    announceRevokedTokens(keys: readonly string[], ids: readonly string[]): void;
+    /** Close every `/ws/client` socket whose credential is no longer live. */
+    closeUnauthorizedClientSockets(): void;
+    /**
+     * Credentials also die with the clock. The watcher reacts to file changes
+     * only, so before this a client token or a token-backed browser session
+     * that reached its `expiresAt` kept its open socket (telemetry in, commands
+     * out) until the process restarted.
+     */
+    sweepExpiredSocketCredentials(now?: number): void;
+    /** Close the browser sockets bound to a session that was just removed. */
+    closeSessionSockets(sessionId: string, reason: string): void;
+}
+export declare function createHqSocketCredentialEnforcer(state: HqSocketCredentialState): HqSocketCredentialEnforcer;
+//# sourceMappingURL=socket-credentials.d.ts.map

package/dist/hq-server/upgrade-handler.d.ts

@@ -28,6 +28,8 @@ interface HqUpgradeHandlerDeps {
      * the revocation path treats that absence as "affected" (fail closed).
      */
     browserSocketSessions: Map<WebSocket, string>;
+    /** Browser-token verifier behind each bare `?token=` browser socket (H-3). */
+    browserSocketTokenKeys?: Map<WebSocket, string> | undefined;
     browsers: Set<WebSocket>;
     eventLog: import('@wrongstack/core/hq').HqEventEnvelope[];
     transcripts: Map<string, TranscriptRing>;

package/dist/hq-server/ws.d.ts

@@ -10,6 +10,30 @@ export { fanoutKanbanDelta } from './ws-client-events.js';
 export { detectLeaderLoss } from './ws-leader.js';
 export { handleClientResume } from './ws-resume.js';
 export declare function handleBrowser(ws: WebSocket, snapshotBroadcaster: HqSnapshotBroadcaster, browsers: Set<WebSocket>, eventLog: HqEventEnvelope[]): void;
+/**
+ * Resolve every command the disconnecting client never picked up.
+ *
+ * The queue lives on the per-socket `ConnectedClient`, so it dies with the
+ * socket: a command enqueued in the window between the operator's dispatch and
+ * the next 500 ms `command_poll` is simply gone, and nothing re-queues it on
+ * the replacement connection. Left alone, its audit row stayed `queued`
+ * forever — the Control rail showed a command as pending that will never run,
+ * which is the one thing an operator must not have to guess about.
+ *
+ * `status: 'queued'` in the audit log is the exact undelivered set: the poll
+ * handler flips a command to `delivered` the moment it is put on the wire, so
+ * anything still `queued` never reached the client. Delivered-but-unacked
+ * commands are deliberately left alone — those DID run, and the ack may simply
+ * have been in flight when the socket closed.
+ *
+ * EVERY path that removes a client from `clients` must call this. The socket's
+ * own `close` handler finds the client through `clients.get(ws)`, so a path
+ * that deletes the entry first — the heartbeat-timeout eviction, the
+ * sessionless-surface eviction, the supersede loop — leaves that handler with
+ * nothing to resolve, and the rows it owned stayed `queued` forever. Those are
+ * exactly the cases (a hung client, a zombie socket) where commands strand.
+ */
+export declare function failUndeliveredCommands(lostClient: ConnectedClient, browsers: Set<WebSocket>, auditLog: HqCommandAuditLog | undefined): void;
 export declare function handleClient(ws: WebSocket, clients: Map<WebSocket, ConnectedClient>, browsers: Set<WebSocket>, eventLog: HqEventEnvelope[], auth: {
     token?: HqToken | undefined;
     getOperatorPolicy: () => Partial<HqRedactionPolicy> | undefined;

package/dist/{hq-server-YTKDVQPY.js → hq-server-UIB24LU6.js}

@@ -10,7 +10,7 @@ import {
   readLocalSubagentTranscript,
   sanitizeApiError,
   startHqServer
-} from "./chunk-OAVBM55Q.js";
+} from "./chunk-ENRYW73H.js";
 import "./chunk-HXJYHAR4.js";
 import "./chunk-5EA6OTLJ.js";
 import "./chunk-Q7E3BPDU.js";
@@ -27,4 +27,4 @@ export {
   sanitizeApiError,
   startHqServer
 };
-//# sourceMappingURL=hq-server-YTKDVQPY.js.map
+//# sourceMappingURL=hq-server-UIB24LU6.js.map

package/dist/{import-claude-code-32PCSIQI.js → import-claude-code-AYG24RG2.js}

@@ -17,6 +17,25 @@ import { mcpEnvPlaceholders } from "@wrongstack/mcp";
 function isRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
+var REPOSITORY_STRIPPED_MCP_FIELDS = [
+  "permission",
+  "bearerTokenEnv",
+  "passthroughEnv",
+  "allowPrivateNetworks"
+];
+function envReads(config) {
+  const reads = new Set(mcpEnvPlaceholders(config));
+  if (config.bearerTokenEnv) reads.add(config.bearerTokenEnv);
+  for (const name of config.passthroughEnv ?? []) reads.add(name);
+  return [...reads];
+}
+function describeTarget(config) {
+  if (typeof config.command === "string") {
+    return `runs: ${[config.command, ...config.args ?? []].join(" ")}`;
+  }
+  if (typeof config.url === "string") return `connects to: ${config.url}`;
+  return void 0;
+}
 function samePath(a, b) {
   const norm = (p) => {
     const resolved = path.resolve(p).replace(/[\\/]+$/, "");
@@ -58,10 +77,22 @@ function planClaudeCodeImport(opts) {
       const exists2 = Object.hasOwn(opts.existingServers, name);
       const repository = source === "repository";
       const enabled = !repository || opts.enableProjectServers;
-      const reads = mcpEnvPlaceholders(config);
+      const stripped = [];
+      if (repository) {
+        for (const field of REPOSITORY_STRIPPED_MCP_FIELDS) {
+          if (config[field] === void 0) continue;
+          delete config[field];
+          stripped.push(field);
+        }
+        config.origin = "repository";
+      }
+      const reads = envReads(config);
+      const target = describeTarget(config);
       const notes2 = [
+        target,
         repository && !enabled ? "from the repository \u2014 imported disabled; review, then `/mcp enable`" : void 0,
-        reads.length > 0 ? `reads environment: ${reads.join(", ")}` : void 0
+        reads.length > 0 ? `reads environment: ${reads.join(", ")}` : void 0,
+        stripped.length > 0 ? `not imported from the repository: ${stripped.join(", ")} (set them yourself after review)` : void 0
       ].filter((note) => note !== void 0);
       mcp.push({
         name,
@@ -77,8 +108,8 @@ function planClaudeCodeImport(opts) {
     projectEntry(sources.userState, opts.projectRoot)?.["mcpServers"],
     "claude-project-local"
   );
-  collect(sources.projectMcp?.["mcpServers"] ?? sources.projectMcp, "repository");
   collect(sources.userState?.["mcpServers"], "claude-user");
+  collect(sources.projectMcp?.["mcpServers"] ?? sources.projectMcp, "repository");
   const notes = [];
   if (sources.skillDirs.length > 0) {
     notes.push(
@@ -229,8 +260,9 @@ Wrote ${writes.length} server(s) to ${configPath}.`);
   return 0;
 };
 export {
+  REPOSITORY_STRIPPED_MCP_FIELDS,
   importClaudeCodeCmd,
   planClaudeCodeImport,
   readClaudeCodeSources
 };
-//# sourceMappingURL=import-claude-code-32PCSIQI.js.map
+//# sourceMappingURL=import-claude-code-AYG24RG2.js.map

package/dist/index.js

@@ -20,14 +20,14 @@ async function main(argv) {
     applyAsciiMode(earlyFlags);
   }
   if (earlyFlags["help"] === true || earlyFlags["version"] === true) {
-    const { handleHelpVersionShortCircuit } = await import("./short-circuit-flags-74Y5N6CF.js");
+    const { handleHelpVersionShortCircuit } = await import("./short-circuit-flags-BSIPTAPD.js");
     const earlyExit = await handleHelpVersionShortCircuit(argv);
     if (earlyExit !== null) return earlyExit;
   }
-  const { initializeCli } = await import("./cli-context-UVGAN3NO.js");
+  const { initializeCli } = await import("./cli-context-O2SHBDFH.js");
   const cliCtx = await initializeCli(argv);
   if (typeof cliCtx === "number") return cliCtx;
-  const { runInteractive } = await import("./cli-main-TN3KZ2P6.js");
+  const { runInteractive } = await import("./cli-main-BKG4ZVLN.js");
   return runInteractive(cliCtx);
 }
 

package/dist/live-settings-input.d.ts

@@ -19,6 +19,7 @@ export interface LiveSettingsInput {
     featureMemory?: boolean | undefined;
     featureSkills?: boolean | undefined;
     featureModelsRegistry?: boolean | undefined;
+    featureToolCoach?: boolean | undefined;
     featureTokenSaving?: TokenSavingTier | undefined;
     allowOutsideProjectRoot?: boolean | undefined;
     contextAutoCompact?: boolean | undefined;

package/dist/{mailbox-serve-NW5VZG7R.js → mailbox-serve-GNGXEQ2R.js}

@@ -1,6 +1,6 @@
 import {
   startCliHqConnection
-} from "./chunk-KJS5543T.js";
+} from "./chunk-RGFWGUAB.js";
 import "./chunk-F5DCFAKI.js";
 
 // src/subcommands/handlers/mailbox-serve.ts
@@ -361,4 +361,4 @@ function printHelp(deps) {
 export {
   mailboxServeCmd
 };
-//# sourceMappingURL=mailbox-serve-NW5VZG7R.js.map
+//# sourceMappingURL=mailbox-serve-GNGXEQ2R.js.map

package/dist/{modeldiag-36VODVIH.js → modeldiag-W7XAE625.js}

@@ -20,7 +20,7 @@ import {
 } from "./chunk-BBHWW6LR.js";
 import {
   resolveRawProviderConnection
-} from "./chunk-S4FFHDJG.js";
+} from "./chunk-SDJCLEK6.js";
 import {
   mutateConfigProviders
 } from "./chunk-LUMETJFO.js";
@@ -825,4 +825,4 @@ var modeldiagCmd = async (args, deps) => {
 export {
   modeldiagCmd
 };
-//# sourceMappingURL=modeldiag-36VODVIH.js.map
+//# sourceMappingURL=modeldiag-W7XAE625.js.map

package/dist/{remote-O5WXHLWV.js → remote-GB5VXCCT.js}

@@ -28,6 +28,13 @@ import { buildChildEnv, toErrorMessage } from "@wrongstack/core/utils";
 
 // src/remote/remote-target.ts
 function parseRemoteTarget(input) {
+  const target = parseRemoteTargetText(input);
+  if (target.destination.startsWith("-")) {
+    throw new Error(`A remote host cannot start with "-" (got ${target.destination})`);
+  }
+  return target;
+}
+function parseRemoteTargetText(input) {
   const text = input.trim();
   if (text.startsWith("ssh://")) {
     let url;
@@ -73,22 +80,30 @@ function buildTargetFor(os, arch, musl) {
   throw new Error(`Remote machines running ${os} are not supported (Linux and macOS are).`);
 }
 var REMOTE_BIN_DIR = '"$HOME"/.wrongstack/remote';
+function stateScript(path3) {
+  return `dir=${shPath(path3)}
+abs=$(cd "$dir" 2>/dev/null && pwd -P) || abs=
+key=$(printf '%s' "$abs" | cksum | tr ' ' '-')
+state_dir=${REMOTE_BIN_DIR}/servers
+state="$state_dir/$key.json"
+token_file="$state_dir/$key.token"
+log="$state_dir/$key.log"`;
+}
 function probeScript(path3) {
   return `set -u
 printf 'os=%s\\n' "$(uname -s 2>/dev/null)"
 printf 'arch=%s\\n' "$(uname -m 2>/dev/null)"
 if ls /lib/ld-musl-* >/dev/null 2>&1; then echo musl=1; else echo musl=0; fi
-dir=${shPath(path3)}
+${stateScript(path3)}
 if [ -d "$dir" ]; then echo path=1; else echo path=0; fi
 for f in ${REMOTE_BIN_DIR}/wstack-*; do
   [ -x "$f" ] && printf 'version=%s\\n' "\${f##*/wstack-}"
 done
-state="$dir/.wrongstack/remote-webui.json"
-if [ -f "$state" ] && [ -f "$dir/.wrongstack/remote-webui.token" ]; then
+if [ -n "$abs" ] && [ -f "$state" ] && [ -f "$token_file" ]; then
   pid=$(sed -n 's/.*"pid":\\([0-9]*\\).*/\\1/p' "$state")
   if [ -n "$pid" ] && kill -0 "$pid" 2>/dev/null; then
     printf 'server=%s\\n' "$(tr -d '\\n' < "$state")"
-    printf 'token=%s\\n' "$(cat "$dir/.wrongstack/remote-webui.token")"
+    printf 'token=%s\\n' "$(cat "$token_file")"
   fi
 fi
 `;
@@ -141,12 +156,12 @@ var NO_PROVIDER = ["No provider or model configured", "Saved provider/model is n
 function startScript(options) {
   const bin = remoteBinaryPath(options.version);
   return `set -u
-dir=${shPath(options.path)}
-cd "$dir" || { echo error=path; exit 3; }
 umask 077
-mkdir -p .wrongstack
-printf '%s' ${shQuote(options.token)} > .wrongstack/remote-webui.token
-log=.wrongstack/remote-webui.log
+${stateScript(options.path)}
+cd "$dir" || { echo error=path; exit 3; }
+mkdir -p "$state_dir"
+chmod 700 "$state_dir"
+printf '%s' ${shQuote(options.token)} > "$token_file"
 export WEBUI_TOKEN=${shQuote(options.token)}
 launch() {
   : > "$log"
@@ -171,21 +186,21 @@ await_port() {
 }
 launch
 await_port
-state=$?
-if [ "$state" -eq 1 ] && grep -q ${NO_PROVIDER.map((line) => `-e ${shQuote(line)}`).join(" ")} "$log"; then
+status=$?
+if [ "$status" -eq 1 ] && grep -q ${NO_PROVIDER.map((line) => `-e ${shQuote(line)}`).join(" ")} "$log"; then
   echo setup=1
   launch --provider wrongstack-setup --model no-api-key
   await_port
-  state=$?
+  status=$?
 fi
-if [ "$state" -eq 0 ]; then
-  printf '{"pid":%s,"port":%s,"version":"%s"}\\n' "$pid" "$port" ${shQuote(options.version)} > .wrongstack/remote-webui.json
+if [ "$status" -eq 0 ]; then
+  printf '{"pid":%s,"port":%s,"version":"%s"}\\n' "$pid" "$port" ${shQuote(options.version)} > "$state"
   echo "port=$port"
   echo "pid=$pid"
   exit 0
 fi
-rm -f .wrongstack/remote-webui.token
-if [ "$state" -eq 1 ]; then
+rm -f "$token_file"
+if [ "$status" -eq 1 ]; then
   echo error=exited
   tail -n 30 "$log" | sed 's/^/log=/'
   exit 4
@@ -197,12 +212,11 @@ exit 5
 }
 function stopScript(path3) {
   return `set -u
-dir=${shPath(path3)}
-state="$dir/.wrongstack/remote-webui.json"
-[ -f "$state" ] || exit 0
+${stateScript(path3)}
+[ -n "$abs" ] && [ -f "$state" ] || exit 0
 pid=$(sed -n 's/.*"pid":\\([0-9]*\\).*/\\1/p' "$state")
 [ -n "$pid" ] && kill "$pid" 2>/dev/null
-rm -f "$state" "$dir/.wrongstack/remote-webui.token"
+rm -f "$state" "$token_file"
 echo stopped=1
 `;
 }
@@ -333,7 +347,7 @@ async function runRemoteSession(opts) {
           await exited(tunnel);
           opts.signal.removeEventListener("abort", stopTunnel);
           throw new Error(
-            `The WebUI on ${opts.target.destination} did not answer through the SSH tunnel. Check that its sshd allows port forwarding (AllowTcpForwarding) and see ${opts.target.path}/.wrongstack/remote-webui.log there.`
+            `The WebUI on ${opts.target.destination} did not answer through the SSH tunnel. Check that its sshd allows port forwarding (AllowTcpForwarding) and see the host log under ~/.wrongstack/remote/servers/ there.`
           );
         }
       }
@@ -406,7 +420,7 @@ function sshCommandLine(target, options) {
 function systemSsh(target, options) {
   const base = sshCommandLine(target, options);
   const run = (remoteCommand, input) => new Promise((resolve2) => {
-    const child = spawn("ssh", [...base, target.destination, remoteCommand], {
+    const child = spawn("ssh", [...base, "--", target.destination, remoteCommand], {
       stdio: ["pipe", "pipe", "inherit"],
       env: { ...buildChildEnv(), ...sshAgentEnv() },
       windowsHide: true
@@ -431,6 +445,7 @@ function systemSsh(target, options) {
       "ExitOnForwardFailure=yes",
       "-L",
       `127.0.0.1:${localPort}:127.0.0.1:${remotePort}`,
+      "--",
       target.destination
     ],
     {
@@ -558,4 +573,4 @@ export {
   remoteCmd,
   runRemoteCommand
 };
-//# sourceMappingURL=remote-O5WXHLWV.js.map
+//# sourceMappingURL=remote-GB5VXCCT.js.map

package/dist/services/run-git.d.ts

@@ -10,7 +10,9 @@
  * Never rejects on a non-zero exit — the caller inspects `code`. It rejects
  * only when git could not be spawned at all, or when the 30s timeout fires.
  */
-export declare function runGit(args: string[], cwd: string): Promise<{
+export declare function runGit(args: string[], cwd: string, 
+/** Extra environment (e.g. `GIT_INDEX_FILE`), merged over this process's. */
+env?: NodeJS.ProcessEnv): Promise<{
     stdout: string;
     stderr: string;
     code: number;

package/dist/{sessions-config-SXTTLNXA.js → sessions-config-XHLXJ5C3.js}

@@ -33,6 +33,40 @@ function redactKeys(obj) {
 import * as fsp from "node:fs/promises";
 import * as path from "node:path";
 import { color } from "@wrongstack/core/utils";
+var STORE_SIDECAR_JSONL_NAMES = /* @__PURE__ */ new Set(["_index.jsonl", "_mailbox.jsonl"]);
+var SESSION_SIDECAR_JSONL_SUFFIXES = [".replay.jsonl", ".audit.jsonl", ".annotations.jsonl"];
+function isSubagentTranscriptFile(name) {
+  const lower = name.toLowerCase();
+  if (!lower.endsWith(".jsonl")) return false;
+  if (STORE_SIDECAR_JSONL_NAMES.has(lower)) return false;
+  return !SESSION_SIDECAR_JSONL_SUFFIXES.some((suffix) => lower.endsWith(suffix));
+}
+async function collectSubagentTranscripts(subagentsDir) {
+  let entries;
+  try {
+    entries = await fsp.readdir(subagentsDir, { withFileTypes: true });
+  } catch {
+    return [];
+  }
+  const out = [];
+  for (const entry of entries) {
+    if (entry.isFile()) {
+      if (isSubagentTranscriptFile(entry.name)) out.push(entry.name);
+      continue;
+    }
+    if (!entry.isDirectory() || entry.name === "transcripts" || entry.name === "shared") continue;
+    let nested;
+    try {
+      nested = await fsp.readdir(path.join(subagentsDir, entry.name));
+    } catch {
+      continue;
+    }
+    for (const name of nested) {
+      if (isSubagentTranscriptFile(name)) out.push(`${entry.name}/${name}`);
+    }
+  }
+  return out;
+}
 var sessionsFleetCmd = async (args, deps) => {
   const runId = args.find((a) => !a.startsWith("-"));
   if (runId) {
@@ -40,10 +74,46 @@ var sessionsFleetCmd = async (args, deps) => {
   }
   return listFleetRuns(deps);
 };
+async function hasFleetRunArtifacts(dir) {
+  const markers = await Promise.all(
+    ["fleet.json", "checkpoint.json", "subagents"].map(
+      (name) => fsp.access(path.join(dir, name)).then(
+        () => true,
+        () => false
+      )
+    )
+  );
+  return markers.some((found) => found);
+}
+async function discoverFleetRunIds(projectSessions) {
+  const entries = await fsp.readdir(projectSessions, { withFileTypes: true });
+  const ids = [];
+  for (const entry of entries) {
+    if (!entry.isDirectory()) continue;
+    const dir = path.join(projectSessions, entry.name);
+    if (await hasFleetRunArtifacts(dir)) {
+      ids.push(entry.name);
+      continue;
+    }
+    let children;
+    try {
+      children = await fsp.readdir(dir, { withFileTypes: true });
+    } catch {
+      continue;
+    }
+    for (const child of children) {
+      if (!child.isDirectory()) continue;
+      if (await hasFleetRunArtifacts(path.join(dir, child.name))) {
+        ids.push(`${entry.name}/${child.name}`);
+      }
+    }
+  }
+  return ids;
+}
 async function listFleetRuns(deps) {
   let entries = [];
   try {
-    entries = await fsp.readdir(deps.paths.projectSessions);
+    entries = await discoverFleetRunIds(deps.paths.projectSessions);
   } catch {
     deps.renderer.writeError(`Cannot read projectSessions: ${deps.paths.projectSessions}
 `);
@@ -69,8 +139,8 @@ async function listFleetRuns(deps) {
             () => true,
             () => false
           ),
-          fsp.readdir(path.join(runDir, "subagents")).then(
-            (files) => files.filter((f) => f.endsWith(".jsonl")).length,
+          collectSubagentTranscripts(path.join(runDir, "subagents")).then(
+            (files) => files.length,
             () => 0
           )
         ]);
@@ -189,8 +259,7 @@ Fleet Run: ${runId}
   const subagentsDir = path.join(runDir, "subagents");
   let subagentFiles = [];
   try {
-    subagentFiles = await fsp.readdir(subagentsDir);
-    subagentFiles = subagentFiles.filter((f) => f.endsWith(".jsonl"));
+    subagentFiles = await collectSubagentTranscripts(subagentsDir);
   } catch {
   }
   if (subagentFiles.length > 0) {
@@ -456,4 +525,4 @@ export {
   configCmd,
   sessionsCmd
 };
-//# sourceMappingURL=sessions-config-SXTTLNXA.js.map
+//# sourceMappingURL=sessions-config-XHLXJ5C3.js.map

package/dist/{short-circuit-flags-74Y5N6CF.js → short-circuit-flags-BSIPTAPD.js}

@@ -1,10 +1,10 @@
 import {
   handleHelpVersionShortCircuit
-} from "./chunk-WQV2NP57.js";
+} from "./chunk-L5TD7UIG.js";
 import "./chunk-5JYDKG5B.js";
 import "./chunk-F5DCFAKI.js";
 import "./chunk-Q4INH2DG.js";
 export {
   handleHelpVersionShortCircuit
 };
-//# sourceMappingURL=short-circuit-flags-74Y5N6CF.js.map
+//# sourceMappingURL=short-circuit-flags-BSIPTAPD.js.map

package/dist/slash-commands/theme.d.ts

@@ -1,5 +1,18 @@
-import type { InputReader, SlashCommand } from '@wrongstack/core/types';
+import type { InputReader, SlashCommand, ThemePresetId } from '@wrongstack/core/types';
 import type { SlashCommandContext } from './command-context.js';
+interface ThemeOption {
+    id: ThemePresetId;
+    name: string;
+    desc: string;
+}
+/**
+ * The CLI's picker rows, exported for the TUI↔CLI agreement test
+ * (`packages/cli/tests/theme-metadata-agreement.test.ts`). The TUI derives its
+ * own rows from the same `THEME_PRESET_META` record, so this export is the
+ * second side of that comparison — it must stay in step with `THEME_OPTIONS`
+ * above.
+ */
+export declare const cliThemePickerOptions: readonly ThemeOption[];
 /**
  * Windowed slice of the theme list for the raw-terminal picker — mirrors the
  * math in the TUI's `useWindowedPicker` (same centering + marker rules) so
@@ -35,4 +48,5 @@ export declare function truncateDesc(desc: string, columns: number, active: bool
 export declare function buildThemeCommand(opts: SlashCommandContext & {
     inputReader?: InputReader | undefined;
 }): SlashCommand;
+export {};
 //# sourceMappingURL=theme.d.ts.map

package/dist/subcommands/handlers/import-claude-code.d.ts

@@ -28,6 +28,16 @@ export interface ClaudeCodeSources {
     /** Skill directories that exist. */
     skillDirs: string[];
 }
+/**
+ * Fields a repository entry may not carry into the user's profile. Each one
+ * widens what the server gets on enable beyond "run this command / reach this
+ * URL": `permission` pre-approves every tool it exposes, `bearerTokenEnv` and
+ * `passthroughEnv` send the named environment variables to it, and
+ * `allowPrivateNetworks` lifts the internal-network guard. The repository
+ * chooses the command and URL, so it must not also choose those
+ * (WS-2026-09-26-05). The user can still set them after reviewing.
+ */
+export declare const REPOSITORY_STRIPPED_MCP_FIELDS: readonly ['permission', 'bearerTokenEnv', 'passthroughEnv', 'allowPrivateNetworks'];
 /** Decide what an import would do. Pure: no reads, no writes. */
 export declare function planClaudeCodeImport(opts: {
     sources: ClaudeCodeSources;

package/dist/subcommands/handlers/sessions-fleet.d.ts

@@ -1,15 +1,3 @@
 import type { SubcommandHandler } from '../contracts.js';
-/**
- * `wrongstack sessions fleet [runId]`
- *
- * Lists fleet run artifacts under `projectSessions/<runId>/`.
- * When runId is omitted, lists all fleet runs discovered under projectSessions.
- *
- * Artifacts shown:
- *   - fleet.json         (manifest)
- *   - checkpoint.json    (state snapshot, if present)
- *   - shared/            (scratchpad directory)
- *   - subagents/         (per-subagent JSONL transcripts)
- */
 export declare const sessionsFleetCmd: SubcommandHandler;
 //# sourceMappingURL=sessions-fleet.d.ts.map

package/dist/{subcommands-Q6ORSB2E.js → subcommands-SRRB3RAS.js}

@@ -1,9 +1,9 @@
 import {
   subcommandNames,
   subcommands
-} from "./chunk-BEHGRNOQ.js";
+} from "./chunk-3ZTLPNEQ.js";
 export {
   subcommandNames,
   subcommands
 };
-//# sourceMappingURL=subcommands-Q6ORSB2E.js.map
+//# sourceMappingURL=subcommands-SRRB3RAS.js.map

package/dist/{typesafe-U7YB2RRV.js → typesafe-WA5O3KVS.js}

@@ -278,7 +278,15 @@ async function lintConventions(deps, write) {
     }
   }
   const base = typeof flags["base"] === "string" ? flags["base"] : void 0;
-  const diffArgs = ["diff", "--no-color", "--no-ext-diff", "-U24"];
+  const diffArgs = [
+    "diff",
+    "--no-color",
+    "--no-ext-diff",
+    "--no-textconv",
+    "--src-prefix=a/",
+    "--dst-prefix=b/",
+    "-U24"
+  ];
   if (flags["staged"] === true) diffArgs.push("--cached");
   else if (base) diffArgs.push(`${base}...HEAD`);
   let diff;
@@ -313,4 +321,4 @@ async function lintConventions(deps, write) {
 export {
   typesafeCmd
 };
-//# sourceMappingURL=typesafe-U7YB2RRV.js.map
+//# sourceMappingURL=typesafe-WA5O3KVS.js.map