@wrongstack/cli 1.0.3 → 1.0.4

package/dist/{chunk-JHPXJRRI.js → chunk-4XCBEUBX.js}

@@ -129,11 +129,21 @@ function scheduleImmediateProbe(runner) {
   void runner.poke();
 }
 function buildHealthUrl(rawBase) {
-  const trimmed = rawBase.trim().replace(/\/+$/, "");
-  return `${trimmed}${HEALTH_PATH}`;
+  const trimmed = rawBase.trim();
+  try {
+    const base = new URL(trimmed);
+    base.search = "";
+    base.hash = "";
+    base.pathname = `${base.pathname.replace(/\/+$/, "")}${HEALTH_PATH}`;
+    return base.toString();
+  } catch {
+    const boundary = trimmed.search(/[?#]/);
+    const pathBase = boundary === -1 ? trimmed : trimmed.slice(0, boundary);
+    return `${pathBase.replace(/\/+$/, "")}${HEALTH_PATH}`;
+  }
 }
 
 export {
   startProxyProbe
 };
-//# sourceMappingURL=chunk-JHPXJRRI.js.map
+//# sourceMappingURL=chunk-4XCBEUBX.js.map

package/dist/{chunk-FPIWTJ2G.js → chunk-6WRKAACA.js}

@@ -67,12 +67,12 @@ var helpCmd = async (_args, deps) => {
     color.bold("Common flags"),
     "  --yolo / --no-yolo           Force auto-approval on or off at startup",
     "  --confirm-destructive         Deprecated \u2014 YOLO no longer prompts by destructiveness",
-    "  --yolo-destructive            Deprecated compatibility flag; YOLO no longer prompts by destructiveness",
+    "  --yolo-destructive           Let YOLO run every destructive kind it is allowed to (see /yolo confirm)",
     "  --tui / --no-tui             Force or disable TUI mode",
     "  --mouse                      Full mouse mode in the TUI (in-app scroll + clickable UI)",
     "  --desktop                    Open WrongStack Desktop (requires @wrongstack/desktop)",
-    "  --hq [--host <h>] [--port <n>] [--password <secret>] [--tunnel] [--open]",
-    "                               Start HQ; --tunnel publishes a temporary HTTPS URL",
+    "  --hq [--host <h>] [--port <n>] [--password <secret>] [--hq-allowlist <ip,cidr,...>] [--tunnel] [--hq-public-url <https-origin>] [--open]",
+    "                               Start HQ; publish through a temporary tunnel or persistent TLS proxy",
     "  --webui [--host <h>] [--port <n>] [--webui-token <t>] [--open]",
     "          [--webui-public-url <url>] [--webui-public-ws-url <url>] [--webui-require-token]",
     "                               Serve the browser UI + WS bridge (prints a token URL,",
@@ -93,4 +93,4 @@ export {
   versionCmd,
   helpCmd
 };
-//# sourceMappingURL=chunk-FPIWTJ2G.js.map
+//# sourceMappingURL=chunk-6WRKAACA.js.map

package/dist/chunk-AUQDGU5D.js

@@ -0,0 +1,32 @@
+
+// src/hq-server/secret-input.ts
+import * as fs from "node:fs/promises";
+import * as path from "node:path";
+var MAX_PASSWORD_FILE_BYTES = 4096;
+async function resolveHqPasswordInput(options = {}) {
+  const environment = options.environment ?? process.env;
+  const direct = options.explicitPassword ?? environment.WRONGSTACK_HQ_PASSWORD;
+  const file = environment.WRONGSTACK_HQ_PASSWORD_FILE;
+  if (direct !== void 0 && file !== void 0) {
+    throw new Error(
+      "Set only one of --password/WRONGSTACK_HQ_PASSWORD or WRONGSTACK_HQ_PASSWORD_FILE."
+    );
+  }
+  if (file === void 0) return direct;
+  if (!path.isAbsolute(file)) {
+    throw new Error("WRONGSTACK_HQ_PASSWORD_FILE must be an absolute path.");
+  }
+  const stat2 = await fs.stat(file);
+  if (!stat2.isFile()) throw new Error("WRONGSTACK_HQ_PASSWORD_FILE must point to a regular file.");
+  if (stat2.size > MAX_PASSWORD_FILE_BYTES) {
+    throw new Error(`WRONGSTACK_HQ_PASSWORD_FILE exceeds ${MAX_PASSWORD_FILE_BYTES} bytes.`);
+  }
+  const raw = await fs.readFile(file, "utf8");
+  if (raw.includes("\0")) throw new Error("WRONGSTACK_HQ_PASSWORD_FILE contains a NUL byte.");
+  return raw.replace(/\r?\n$/, "");
+}
+
+export {
+  resolveHqPasswordInput
+};
+//# sourceMappingURL=chunk-AUQDGU5D.js.map

package/dist/{chunk-IUEKNHPT.js → chunk-BIWE22O5.js}

@@ -1,9 +1,9 @@
 
 // src/subcommands/index.ts
 var loaders = {
-  acp: async () => (await import("./acp-JK4ZQO3R.js")).acpCmd,
+  acp: async () => (await import("./acp-AB54FWM2.js")).acpCmd,
   init: async () => (await import("./init-DRMMFG2G.js")).initCmd,
-  auth: async () => (await import("./auth-XD3GN5RJ.js")).authCmd,
+  auth: async () => (await import("./auth-WDMSNZ3S.js")).authCmd,
   update: async () => (await import("./update-5DPB4YD4.js")).updateCmd,
   sessions: async () => (await import("./sessions-config-UL45XKX7.js")).sessionsCmd,
   config: async () => (await import("./sessions-config-UL45XKX7.js")).configCmd,
@@ -19,19 +19,19 @@ var loaders = {
   mcp: async () => (await import("./mcp-HOMLC4WE.js")).mcpCmd,
   plugin: async () => (await import("./plugin-usage-M6KET4OZ.js")).pluginCmd,
   plugins: async () => (await import("./plugin-usage-M6KET4OZ.js")).pluginCmd,
-  diag: async () => (await import("./diag-doctor-7LYUYU35.js")).diagCmd,
-  doctor: async () => (await import("./diag-doctor-7LYUYU35.js")).doctorCmd,
-  "proxy-status": async () => (await import("./diag-doctor-7LYUYU35.js")).proxyCmd,
+  diag: async () => (await import("./diag-doctor-PCER6KHH.js")).diagCmd,
+  doctor: async () => (await import("./diag-doctor-PCER6KHH.js")).doctorCmd,
+  "proxy-status": async () => (await import("./diag-doctor-PCER6KHH.js")).proxyCmd,
   export: async () => (await import("./export-VVRIOWFV.js")).exportCmd,
   usage: async () => (await import("./plugin-usage-M6KET4OZ.js")).usageCmd,
-  version: async () => (await import("./version-help-MYKF724O.js")).versionCmd,
-  help: async () => (await import("./version-help-MYKF724O.js")).helpCmd,
-  projects: async () => (await import("./projects-L6C6XLDY.js")).projectsCmd,
+  version: async () => (await import("./version-help-WXI42PZ3.js")).versionCmd,
+  help: async () => (await import("./version-help-WXI42PZ3.js")).helpCmd,
+  projects: async () => (await import("./projects-LMNAGGEU.js")).projectsCmd,
   modeldiag: async () => (await import("./modeldiag-46CMWUNM.js")).modeldiagCmd,
   quick: async () => (await import("./quick-CNB4Z3HS.js")).quickCmd,
   bench: async () => (await import("./bench-YBU6BVQP.js")).benchCmd,
   chronicle: async () => (await import("./chronicle-UTFETHP6.js")).chronicleCmd,
-  hq: async () => (await import("./hq-IG3YRGCO.js")).hqCmd,
+  hq: async () => (await import("./hq-5XHEIIH6.js")).hqCmd,
   mailbox: async () => (await import("./mailbox-serve-X3CR6VFW.js")).mailboxServeCmd,
   permissions: async () => (await import("./permissions-CFDLXETM.js")).permissionsCmd,
   project: async () => (await import("./project-AOQI5XTK.js")).projectCmd,
@@ -51,4 +51,4 @@ export {
   subcommands,
   subcommandNames
 };
-//# sourceMappingURL=chunk-IUEKNHPT.js.map
+//# sourceMappingURL=chunk-BIWE22O5.js.map

package/dist/{chunk-VOTTENR5.js → chunk-CDY4D5QK.js}

@@ -1,6 +1,6 @@
 import {
   startProxyProbe
-} from "./chunk-JHPXJRRI.js";
+} from "./chunk-4XCBEUBX.js";
 
 // src/wiring/proxy-wiring.ts
 import { applyProxyConfig } from "@wrongstack/core/wiring/proxy-rewrite";
@@ -53,4 +53,4 @@ export {
   bootstrapWrongProxy,
   shutdownWrongProxy
 };
-//# sourceMappingURL=chunk-VOTTENR5.js.map
+//# sourceMappingURL=chunk-CDY4D5QK.js.map

package/dist/{chunk-E6RFXHWD.js → chunk-EK2P53GL.js}

@@ -12,7 +12,6 @@ var BOOLEAN_FLAGS = /* @__PURE__ */ new Set([
   "version",
   "yes",
   "no-banner",
-  "no-features",
   "tui",
   "no-tui",
   // Recovery switches. `--recover` reopens the most recent session with no
@@ -64,6 +63,8 @@ var BOOLEAN_FLAGS = /* @__PURE__ */ new Set([
   "pnpm",
   "yarn",
   "bun",
+  // `wstack hq service install` toggles.
+  "no-auto-update",
   // `wstack acp` booleans. Without these, parseArgs treats the value after
   // `--fs`/`--echo` as the flag's value and eats a following positional
   // (e.g. the agent list in `acp bench --fs gemini-cli,codex-cli`).
@@ -237,4 +238,4 @@ export {
   parseAuthFlags,
   parseSpawnFlags
 };
-//# sourceMappingURL=chunk-E6RFXHWD.js.map
+//# sourceMappingURL=chunk-EK2P53GL.js.map

package/dist/chunk-I7V2OYVH.js

@@ -0,0 +1,242 @@
+
+// src/hq-server/audit-actor.ts
+import * as os from "node:os";
+function resolveAuditActor() {
+  const user = (process.env.USERNAME ?? process.env.USER ?? "").toString();
+  try {
+    const host = os.hostname();
+    return user ? `${user}@${host}` : `cli@${host}`;
+  } catch {
+    return user ? `${user}@unknown` : "cli";
+  }
+}
+
+// src/hq-server/utils.ts
+import * as fs from "node:fs/promises";
+import * as os2 from "node:os";
+import * as path from "node:path";
+import { resolveHqDataDir } from "@wrongstack/core/hq";
+import { sanitizeApiError, scrubErrorDetail } from "@wrongstack/core/security";
+var TRANSCRIPT_RING_MAX = 4e3;
+var MAX_TRANSCRIPT_SESSIONS = 400;
+var MAX_AGENT_RINGS = 800;
+function evictOldest(map, max) {
+  while (map.size > max) {
+    const oldest = map.keys().next().value;
+    if (oldest === void 0) break;
+    map.delete(oldest);
+  }
+}
+function agentRingKey(sessionId, subId) {
+  return sessionId ? `${sessionId}::${subId}` : subId;
+}
+function agentMessageToEntry(p) {
+  const kind = typeof p["kind"] === "string" ? p["kind"] : "text";
+  const role = kind === "thinking" ? "thinking" : kind === "tool_use" || kind === "tool_result" ? "tool" : kind === "error" ? "error" : kind === "status" || kind === "system" ? "system" : "assistant";
+  return {
+    ts: typeof p["ts"] === "string" ? p["ts"] : (/* @__PURE__ */ new Date()).toISOString(),
+    role,
+    text: typeof p["content"] === "string" ? p["content"] : "",
+    ...typeof p["toolName"] === "string" ? { tool: p["toolName"] } : {},
+    ...kind === "error" ? { isError: true } : {}
+  };
+}
+async function readLocalSubagentTranscript(sessionId, subagentId) {
+  try {
+    const { getSessionRegistry } = await import("@wrongstack/core/storage");
+    const { resolveWstackPaths, sessionScopedPath } = await import("@wrongstack/core/utils");
+    const globalRoot = path.dirname(resolveHqDataDir());
+    const registry = getSessionRegistry(globalRoot);
+    const entry = await registry.get(sessionId).catch(() => null);
+    if (!entry) return null;
+    const paths = resolveWstackPaths({ projectRoot: entry.projectRoot, globalRoot });
+    const sessionDir = sessionScopedPath(paths.projectSessions, sessionId, "");
+    if (!isSafePathSegment(subagentId)) return null;
+    const transcriptsRoot = path.resolve(sessionDir, "subagents", "transcripts");
+    const file = path.resolve(transcriptsRoot, subagentId, "transcript.jsonl");
+    if (!file.startsWith(transcriptsRoot + path.sep)) return null;
+    const raw = await fs.readFile(file, "utf8").catch(() => null);
+    if (raw === null) return null;
+    const out = [];
+    for (const line of raw.split("\n")) {
+      const trimmed = line.trim();
+      if (trimmed.length === 0) continue;
+      try {
+        out.push(agentMessageToEntry(JSON.parse(trimmed)));
+      } catch {
+      }
+    }
+    return out;
+  } catch {
+    return null;
+  }
+}
+function decodePathSegment(value) {
+  let decoded;
+  try {
+    decoded = decodeURIComponent(value);
+  } catch {
+    return null;
+  }
+  return isSafePathSegment(decoded) ? decoded : null;
+}
+function decodeSessionId(value) {
+  let decoded;
+  try {
+    decoded = decodeURIComponent(value);
+  } catch {
+    return null;
+  }
+  return isSafeSessionId(decoded) ? decoded : null;
+}
+var MAX_PATH_SEGMENT_LENGTH = 256;
+function isSafePathSegment(value) {
+  if (value.length === 0 || value.length > MAX_PATH_SEGMENT_LENGTH) return false;
+  if (value === "." || value === "..") return false;
+  if (value.includes("/") || value.includes("\\")) return false;
+  if (value.includes("\0")) return false;
+  if (value.includes(":")) return false;
+  return true;
+}
+function isSafeSessionId(value) {
+  if (value.length === 0 || value.length > MAX_PATH_SEGMENT_LENGTH) return false;
+  if (value.includes("\\") || value.includes("\0") || value.includes(":")) return false;
+  const parts = value.split("/");
+  if (parts.length > 2) return false;
+  return parts.every((p) => p.length > 0 && p !== "." && p !== "..");
+}
+function displayHost(host) {
+  return host === "0.0.0.0" ? "127.0.0.1" : host;
+}
+var RequestBodyTooLargeError = class extends Error {
+};
+function readRequestBody(req, maxBytes = 1e6) {
+  return new Promise((resolve2, reject) => {
+    const chunks = [];
+    let size = 0;
+    let settled = false;
+    req.on("data", (chunk) => {
+      if (settled) return;
+      size += chunk.length;
+      if (size > maxBytes) {
+        settled = true;
+        chunks.length = 0;
+        reject(new RequestBodyTooLargeError("request body too large"));
+        return;
+      }
+      chunks.push(chunk);
+    });
+    req.on("end", () => {
+      if (!settled) resolve2(Buffer.concat(chunks).toString("utf8"));
+    });
+    req.on("error", (error) => {
+      if (!settled) reject(error);
+    });
+  });
+}
+function writeInvalidBody(res, error) {
+  const tooLarge = error instanceof RequestBodyTooLargeError;
+  res.writeHead(tooLarge ? 413 : 400, { "Content-Type": "application/json" });
+  res.end(JSON.stringify({ error: tooLarge ? "request body too large" : "invalid json body" }));
+}
+function buildHttpUrl(host, port, token) {
+  const url = new URL(`http://${displayHost(host)}:${port}/`);
+  if (token) url.searchParams.set("token", token);
+  return url.toString();
+}
+function buildBootstrapHttpUrl(host, port, bootstrapCode) {
+  const url = new URL(`http://${displayHost(host)}:${port}/`);
+  url.hash = `bootstrap=${bootstrapCode}`;
+  return url.toString();
+}
+function buildClientWsUrl(host, port, token) {
+  const url = new URL(`ws://${displayHost(host)}:${port}/ws/client`);
+  if (token) url.searchParams.set("token", token);
+  return url.toString();
+}
+function normalizeHqPublicOrigin(value) {
+  const parsed = new URL(value.trim());
+  if (parsed.protocol !== "https:" || parsed.username !== "" || parsed.password !== "" || parsed.pathname !== "" && parsed.pathname !== "/" || parsed.search !== "" || parsed.hash !== "") {
+    throw new TypeError(
+      "HQ public URL must be an exact HTTPS origin without a path or credentials."
+    );
+  }
+  return parsed.origin;
+}
+function hqRuntimeMarkerPath(dataDir) {
+  return path.join(dataDir, "runtime.json");
+}
+function lanIPv4Addresses() {
+  const out = [];
+  try {
+    const ifaces = os2.networkInterfaces();
+    for (const name of Object.keys(ifaces)) {
+      for (const ni of ifaces[name] ?? []) {
+        if (ni.family === "IPv4" && !ni.internal) out.push(ni.address);
+      }
+    }
+  } catch {
+  }
+  return out;
+}
+function truncateHqSummary(value, maxLength) {
+  if (typeof value !== "string" || value.length === 0) return void 0;
+  if (value.length <= maxLength) return value;
+  const suffix = `\u2026[truncated:${value.length - maxLength}]`;
+  if (maxLength <= suffix.length) return "\u2026";
+  const prefixLen = maxLength - suffix.length;
+  return `${value.slice(0, prefixLen)}${suffix}`;
+}
+function hqMachineKey(hostname2, machineId) {
+  const hn = hostname2?.trim();
+  return hn ? `host:${hn.toLowerCase()}` : `mid:${machineId || "local"}`;
+}
+function recordTimeseriesSignal(persistence, event) {
+  try {
+    if (event.type === "session.usage") {
+      const p = event.payload;
+      persistence.timeseries.record({
+        ts: Date.parse(event.timestamp) || Date.now(),
+        ...typeof p.costUsd === "number" ? { costUsd: p.costUsd } : {},
+        ...typeof p.inputTokens === "number" ? { inputTokens: p.inputTokens } : {},
+        ...typeof p.outputTokens === "number" ? { outputTokens: p.outputTokens } : {},
+        ...typeof p.model === "string" && p.model.length > 0 ? { model: p.model } : {},
+        ...typeof p.provider === "string" && p.provider.length > 0 ? { provider: p.provider } : {},
+        ...typeof p.cacheRead === "number" ? { cacheRead: p.cacheRead } : {},
+        ...typeof p.cacheWrite === "number" ? { cacheWrite: p.cacheWrite } : {}
+      });
+    } else if (event.type === "tool.completed") {
+      persistence.timeseries.record({
+        ts: Date.parse(event.timestamp) || Date.now(),
+        toolCalls: 1
+      });
+    }
+  } catch {
+  }
+}
+
+export {
+  resolveAuditActor,
+  TRANSCRIPT_RING_MAX,
+  MAX_TRANSCRIPT_SESSIONS,
+  MAX_AGENT_RINGS,
+  evictOldest,
+  agentRingKey,
+  agentMessageToEntry,
+  readLocalSubagentTranscript,
+  decodePathSegment,
+  decodeSessionId,
+  readRequestBody,
+  writeInvalidBody,
+  buildHttpUrl,
+  buildBootstrapHttpUrl,
+  buildClientWsUrl,
+  normalizeHqPublicOrigin,
+  hqRuntimeMarkerPath,
+  lanIPv4Addresses,
+  truncateHqSummary,
+  hqMachineKey,
+  recordTimeseriesSignal,
+  sanitizeApiError
+};
+//# sourceMappingURL=chunk-I7V2OYVH.js.map

package/dist/{chunk-MXEJEYT7.js → chunk-JX6KL7OF.js}

@@ -1043,9 +1043,9 @@ var helpTable = {
   // -- HQ (dashboard server) ──────────────────────────────────────────
   hq: {
     name: "hq",
-    title: "wstack hq \u2014 start HQ command center or manage tokens",
-    description: "Start the HQ server \u2014 a web dashboard for monitoring sessions, fleet status, and agent activity across projects \u2014 or manage browser and client authentication tokens.",
-    usage: "wstack hq [serve] [--port <n>] [--password <secret>] [--tunnel] [--open] | wstack hq token [create|list|revoke]",
+    title: "wstack hq \u2014 serve HQ, manage authentication, or install its system service",
+    description: "Start the HQ server \u2014 a web dashboard for monitoring sessions, fleet status, and agent activity across projects; manage browser/client authentication, or install the persistent Ubuntu systemd service.",
+    usage: "wstack hq [serve] [...] | wstack hq token [create|list|revoke] | wstack hq service [install|status|update|uninstall]",
     subcommands: [
       { name: "serve", description: "Start the HQ dashboard server (default)." },
       {
@@ -1053,7 +1053,17 @@ var helpTable = {
         description: "Mint a browser or client authentication token."
       },
       { name: "token list", description: "List active HQ authentication tokens." },
-      { name: "token revoke <id>", description: "Revoke an issued HQ authentication token." }
+      { name: "token revoke <id>", description: "Revoke an issued HQ authentication token." },
+      {
+        name: "service install",
+        description: "Install an always-on systemd service and guarded automatic updater."
+      },
+      { name: "service status", description: "Inspect the HQ service and update timer." },
+      { name: "service update", description: "Run the guarded update job immediately." },
+      {
+        name: "service uninstall",
+        description: "Remove systemd units while preserving HQ data and secrets."
+      }
     ],
     seeAlso: "wstack sessions fleet (CLI equivalent for fleet status)"
   },
@@ -1202,4 +1212,4 @@ export {
   subcommandsWithFocusedHelp,
   renderGenericHelp
 };
-//# sourceMappingURL=chunk-MXEJEYT7.js.map
+//# sourceMappingURL=chunk-JX6KL7OF.js.map

package/dist/{chunk-GMY45LO6.js → chunk-KEPABQYT.js}

@@ -4,6 +4,104 @@ import {
   isCodexCatalogModel
 } from "./chunk-SIGUWXAA.js";
 
+// src/acp-agent-list.ts
+import { REGISTRY_ID_ALIASES } from "@wrongstack/acp";
+function reverseAliases(aliases = REGISTRY_ID_ALIASES) {
+  const out = {};
+  for (const [ours, theirs] of Object.entries(aliases)) {
+    if (ours !== theirs) out[theirs] = ours;
+  }
+  return out;
+}
+function distKind(command) {
+  if (command === "npx") return "npx";
+  if (command === "uvx") return "uvx";
+  return "local";
+}
+function localProbe(registryId, alias, detectedById) {
+  return detectedById.get(registryId) ?? (alias ? detectedById.get(alias) : void 0);
+}
+function formatRegistryRow(agent, alias, local, idWidth) {
+  const kind = distKind(agent.acp.command);
+  const aliasBit = alias ? `  (also ${alias})` : "";
+  if (kind === "local") {
+    if (local?.installed) {
+      const ver = local.version?.split("\n")[0]?.trim();
+      const note2 = ver ? `  ${ver}` : "  on PATH";
+      return `  \u2713 ${agent.id.padEnd(idWidth)}  ${agent.displayName}${aliasBit}${note2}`;
+    }
+    const reason = local?.reason ?? "not on PATH";
+    return `  \u2717 ${agent.id.padEnd(idWidth)}  ${agent.displayName}${aliasBit}  (${reason})`;
+  }
+  const pkg = (agent.acp.args ?? []).find((a) => a !== "-y" && !a.startsWith("--"));
+  const note = pkg ? `${kind} ${pkg}` : kind;
+  return `  \u25B8 ${agent.id.padEnd(idWidth)}  ${agent.displayName}${aliasBit}  ${note}`;
+}
+function formatAcpAgentList(opts) {
+  const { live, detected } = opts;
+  const detectedById = new Map(detected.map((d) => [d.id, d]));
+  if (live && live.agents.length > 0) {
+    const aliasOf = reverseAliases();
+    const when = live.fetchedAt ? live.fetchedAt.slice(0, 19).replace("T", " ") : "locally";
+    const rows = [...live.agents].sort((a, b) => {
+      const rank = (command) => {
+        const k = distKind(command);
+        return k === "local" ? 0 : k === "uvx" ? 1 : 2;
+      };
+      const r = rank(a.acp.command) - rank(b.acp.command);
+      return r !== 0 ? r : a.id.localeCompare(b.id);
+    });
+    const idWidth = Math.max(16, ...rows.map((a) => a.id.length));
+    const lines2 = [
+      `Official ACP registry \u2014 ${live.agents.length} agents (synced ${when}).`,
+      "Spawn ids below are what `/acp <id> <task>` and `/acp <id> --bg` accept.",
+      ""
+    ];
+    for (const agent of rows) {
+      const alias = aliasOf[agent.id];
+      lines2.push(
+        formatRegistryRow(agent, alias, localProbe(agent.id, alias, detectedById), idWidth)
+      );
+    }
+    const leftover = detected.filter((d) => {
+      if (live.byId[d.id]) return false;
+      const mapped = REGISTRY_ID_ALIASES[d.id];
+      return !(mapped && live.byId[mapped]);
+    });
+    if (leftover.length > 0) {
+      lines2.push("");
+      lines2.push("Bundled extras (not in the official registry \u2014 experimental):");
+      for (const d of leftover) {
+        const mark = d.installed ? "\u2713" : "\u2717";
+        const extra = d.installed ? d.version?.split("\n")[0] ?? "" : d.reason ?? "not installed";
+        lines2.push(`  ${mark} ${d.id.padEnd(16)}  ${d.displayName}  (${extra})`);
+      }
+    }
+    lines2.push("");
+    lines2.push(
+      "Spawn: /acp <id> <task>   Background: /acp <id> --bg <task>   Probe: /acp probe <id>"
+    );
+    return lines2.join("\n");
+  }
+  const installed = detected.filter((a) => a.installed);
+  const missing = detected.filter((a) => !a.installed);
+  const lines = [
+    "Bundled offline catalog (not the official registry).",
+    "Run `/acp sync` to replace this list with agentclientprotocol/registry.",
+    ""
+  ];
+  for (const a of installed) {
+    const ver = a.version ? `  (${a.version.split("\n")[0]})` : "";
+    lines.push(`  \u2713 ${a.id.padEnd(16)} ${a.displayName}${ver}`);
+  }
+  for (const a of missing) {
+    lines.push(`  \u2717 ${a.id.padEnd(16)} ${a.displayName}  (${a.reason ?? "not installed"})`);
+  }
+  lines.push("");
+  lines.push(`${installed.length} of ${detected.length} bundled agents installed locally.`);
+  return lines.join("\n");
+}
+
 // src/acp-registry-cache.ts
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
@@ -261,7 +359,7 @@ async function setupProvider(params) {
     } catch (err) {
       throw new ConfigError({
         message: `Failed to load models.dev registry: ${err instanceof Error ? err.message : err}
-Try \`wstack models refresh\` once you have network access, or run with --no-features.`,
+Try \`wstack models refresh\` once you have network access.`,
         code: "CONFIG_INVALID",
         context: { phase: "registry-build", provider: config.provider },
         cause: err
@@ -304,6 +402,7 @@ Try \`wstack models refresh\` once you have network access, or run with --no-fea
 }
 
 export {
+  formatAcpAgentList,
   loadCachedAcpRegistry,
   refreshAcpRegistry,
   resolveProviderCfg,
@@ -311,4 +410,4 @@ export {
   setupProvider,
   createGracefulShutdown
 };
-//# sourceMappingURL=chunk-GMY45LO6.js.map
+//# sourceMappingURL=chunk-KEPABQYT.js.map

package/dist/{chunk-IMWXXF4J.js → chunk-KNMIBKLV.js}

@@ -1,5 +1,42 @@
 
 // src/hq-command-controller.ts
+function createProjectKanbanTransitionHandler(projectRoot) {
+  return async (input) => {
+    const { transitionTask } = await import("@wrongstack/kanban");
+    const result = await transitionTask(projectRoot, input.boardId, input.taskId, {
+      to: input.to,
+      actor: "hq-operator",
+      comment: input.comment,
+      sessionId: input.sessionId ?? "hq-mobile"
+    });
+    if (result === null) throw new Error(`kanban task not found: ${input.taskId}`);
+    return `task ${input.taskId} transitioned to ${input.to}`;
+  };
+}
+function createProjectKanbanAssignHandler(projectRoot) {
+  return async (input) => {
+    const { assignTask } = await import("@wrongstack/kanban");
+    const result = await assignTask(
+      projectRoot,
+      input.boardId,
+      input.taskId,
+      {
+        agentId: input.agentId,
+        name: input.assignee,
+        assignee: input.assignee,
+        status: "assigned",
+        protectActiveAssignment: true
+      },
+      {
+        actor: "hq-operator",
+        note: input.comment,
+        sessionId: input.sessionId ?? "hq-mobile"
+      }
+    );
+    if (result === null) throw new Error(`kanban task not found: ${input.taskId}`);
+    return `task ${input.taskId} assigned to ${input.assignee}`;
+  };
+}
 function createHqCommandDispatcher(controller) {
   return async (command) => {
     const cmd = command;
@@ -159,6 +196,45 @@ async function dispatch(controller, commandId, type, payload) {
       const subagentId = await controller.spawnAgent(role, task, maxIterations, sessionId);
       return { commandId, status: "completed", message: `spawned ${subagentId}` };
     }
+    case "kanban-transition": {
+      if (controller.kanbanTransition === void 0) {
+        return { commandId, status: "rejected", message: "kanban control is unavailable" };
+      }
+      const message = await controller.kanbanTransition({
+        boardId: payload["boardId"],
+        taskId: payload["taskId"],
+        to: payload["to"],
+        comment: payload["comment"],
+        ...sessionId !== void 0 ? { sessionId } : {}
+      });
+      return { commandId, status: "completed", message };
+    }
+    case "kanban-assign": {
+      if (controller.kanbanAssign === void 0) {
+        return { commandId, status: "rejected", message: "kanban assignment is unavailable" };
+      }
+      const message = await controller.kanbanAssign({
+        boardId: payload["boardId"],
+        taskId: payload["taskId"],
+        agentId: payload["agentId"],
+        assignee: payload["assignee"],
+        comment: payload["comment"],
+        ...sessionId !== void 0 ? { sessionId } : {}
+      });
+      return { commandId, status: "completed", message };
+    }
+    case "kanban-dispatch": {
+      if (controller.kanbanDispatch === void 0) {
+        return { commandId, status: "rejected", message: "kanban dispatch is unavailable" };
+      }
+      const message = await controller.kanbanDispatch({
+        boardId: payload["boardId"],
+        taskId: payload["taskId"],
+        comment: payload["comment"],
+        ...sessionId !== void 0 ? { sessionId } : {}
+      });
+      return { commandId, status: "completed", message };
+    }
     case "run-command": {
       if (!controller.allowRunCommand()) {
         return {
@@ -194,6 +270,8 @@ ${command}
 }
 
 export {
+  createProjectKanbanTransitionHandler,
+  createProjectKanbanAssignHandler,
   createHqCommandDispatcher
 };
-//# sourceMappingURL=chunk-IMWXXF4J.js.map
+//# sourceMappingURL=chunk-KNMIBKLV.js.map