@wrongstack/cli 1.0.3 → 1.0.4

package/dist/chunk-Q7E3BPDU.js

@@ -0,0 +1,62 @@
+
+// src/hq-server/ip-allowlist.ts
+import { BlockList, isIP } from "node:net";
+function normalizeAddress(value) {
+  return value.trim().replace(/^\[(.*)\]$/, "$1").replace(/^::ffff:/i, "");
+}
+function addRule(blockList, rawRule) {
+  const rule = rawRule.trim();
+  if (!rule) throw new TypeError("HQ IP allowlist contains an empty entry.");
+  const slash = rule.lastIndexOf("/");
+  if (slash === -1) {
+    const address2 = normalizeAddress(rule);
+    const family2 = isIP(address2);
+    if (family2 === 0) {
+      throw new TypeError(`Invalid HQ allowlist address: ${rule}`);
+    }
+    blockList.addAddress(address2, family2 === 4 ? "ipv4" : "ipv6");
+    return address2;
+  }
+  const address = normalizeAddress(rule.slice(0, slash));
+  const prefixText = rule.slice(slash + 1);
+  const family = isIP(address);
+  if (family === 0 || !/^\d+$/.test(prefixText)) {
+    throw new TypeError(`Invalid HQ allowlist network: ${rule}`);
+  }
+  const prefix = Number(prefixText);
+  const maximum = family === 4 ? 32 : 128;
+  if (!Number.isSafeInteger(prefix) || prefix < 0 || prefix > maximum) {
+    throw new TypeError(`Invalid HQ allowlist prefix: ${rule}`);
+  }
+  blockList.addSubnet(address, prefix, family === 4 ? "ipv4" : "ipv6");
+  return `${address}/${prefix}`;
+}
+function createHqIpAllowlist(rules) {
+  if (rules === void 0 || rules.length === 0) return void 0;
+  const blockList = new BlockList();
+  blockList.addSubnet("127.0.0.0", 8, "ipv4");
+  blockList.addAddress("::1", "ipv6");
+  const entries = [...new Set(rules.map((rule) => addRule(blockList, rule)))];
+  return {
+    entries,
+    allows(address) {
+      if (!address) return false;
+      const normalized = normalizeAddress(address);
+      const family = isIP(normalized);
+      if (family === 0) return false;
+      return blockList.check(normalized, family === 4 ? "ipv4" : "ipv6");
+    }
+  };
+}
+function parseHqIpAllowlist(value) {
+  if (value === void 0 || value.trim() === "") return void 0;
+  const rules = value.split(",").map((entry) => entry.trim());
+  createHqIpAllowlist(rules);
+  return rules;
+}
+
+export {
+  createHqIpAllowlist,
+  parseHqIpAllowlist
+};
+//# sourceMappingURL=chunk-Q7E3BPDU.js.map

package/dist/{chunk-4NHD5OXJ.js → chunk-U6PGWDMZ.js}

@@ -1,10 +1,10 @@
 import {
   helpCmd,
   versionCmd
-} from "./chunk-FPIWTJ2G.js";
+} from "./chunk-6WRKAACA.js";
 import {
   parseArgs
-} from "./chunk-E6RFXHWD.js";
+} from "./chunk-EK2P53GL.js";
 
 // src/boot/short-circuit-flags.ts
 async function handleHelpVersionShortCircuit(argv) {
@@ -22,11 +22,11 @@ async function handleHelpVersionShortCircuit(argv) {
   }
   if (earlyFlags["help"] === true) {
     if (positional.length > 0) {
-      const { subcommandNames } = await import("./subcommands-CUTGBDKP.js");
+      const { subcommandNames } = await import("./subcommands-7N4RIK6H.js");
       if (subcommandNames.includes(positional[0])) {
         const first = positional[0];
         const deep = positional[1];
-        const { renderDeepHelp, renderFocusedHelp } = await import("./per-subcommand-help-BWBHYVJO.js");
+        const { renderDeepHelp, renderFocusedHelp } = await import("./per-subcommand-help-DHTYU524.js");
         if (deep && renderDeepHelp(`${first}:${deep}`, stubRenderer)) {
           return 0;
         }
@@ -43,4 +43,4 @@ async function handleHelpVersionShortCircuit(argv) {
 export {
   handleHelpVersionShortCircuit
 };
-//# sourceMappingURL=chunk-4NHD5OXJ.js.map
+//# sourceMappingURL=chunk-U6PGWDMZ.js.map

package/dist/{chunk-U6KCWRMC.js → chunk-XJ7K67PP.js}

@@ -80,6 +80,10 @@ var BUILTIN_PLUGIN_FACTORIES = [
     const { createAutoReviewPlugin } = await import("@wrongstack/core/plugin");
     return createAutoReviewPlugin();
   },
+  async () => {
+    const { createSpecialistTriggerPlugin } = await import("@wrongstack/core/plugin");
+    return createSpecialistTriggerPlugin();
+  },
   async () => {
     const { createSkillsPlugin } = await import("@wrongstack/core/plugin");
     return createSkillsPlugin();
@@ -263,4 +267,4 @@ export {
   BUILTIN_PLUGIN_FACTORIES,
   setupPlugins
 };
-//# sourceMappingURL=chunk-U6KCWRMC.js.map
+//# sourceMappingURL=chunk-XJ7K67PP.js.map

package/dist/{cli-context-Q6QP534K.js → cli-context-WFC3BNGM.js}

@@ -9,29 +9,37 @@ import {
 import {
   theme as theme2
 } from "./chunk-QD544J2B.js";
-import {
-  parseWebuiSessionChildOptions,
-  writeWebuiSessionChildError
-} from "./chunk-GPPRNAKW.js";
 import {
   fmtTok,
   patchConfig
 } from "./chunk-EWKESL4L.js";
+import {
+  parseWebuiSessionChildOptions,
+  writeWebuiSessionChildError
+} from "./chunk-GPPRNAKW.js";
 import {
   subcommands
-} from "./chunk-IUEKNHPT.js";
+} from "./chunk-BIWE22O5.js";
 import {
   renderDeepHelp,
   renderFocusedHelp
-} from "./chunk-MXEJEYT7.js";
+} from "./chunk-JX6KL7OF.js";
 import {
   handleHelpVersionShortCircuit
-} from "./chunk-4NHD5OXJ.js";
+} from "./chunk-U6PGWDMZ.js";
 import {
   DEFAULT_PORT
-} from "./chunk-C2E24IXZ.js";
+} from "./chunk-3I5ZJXM5.js";
 import "./chunk-HXJYHAR4.js";
-import "./chunk-Q5GTM25S.js";
+import {
+  resolveHqPasswordInput
+} from "./chunk-AUQDGU5D.js";
+import {
+  normalizeHqPublicOrigin
+} from "./chunk-I7V2OYVH.js";
+import {
+  parseHqIpAllowlist
+} from "./chunk-Q7E3BPDU.js";
 import {
   discoverAndMergeProviders
 } from "./chunk-D5GB5MHA.js";
@@ -40,7 +48,7 @@ import {
   applySessionShellDefault,
   runPreflight
 } from "./chunk-O4A3HHKD.js";
-import "./chunk-FPIWTJ2G.js";
+import "./chunk-6WRKAACA.js";
 import {
   CLI_VERSION
 } from "./chunk-XJXDOF63.js";
@@ -67,7 +75,7 @@ import {
 } from "./chunk-YMXXOOFN.js";
 import {
   parseArgs
-} from "./chunk-E6RFXHWD.js";
+} from "./chunk-EK2P53GL.js";
 import "./chunk-DAKVBMD4.js";
 import {
   mutateConfigProviders,
@@ -760,9 +768,13 @@ import {
   resolveHqDataDir
 } from "@wrongstack/core/hq";
 import { color as color3, isPidAlive } from "@wrongstack/core/utils";
+function isReusedContainerPid(markerPid, containerMode, currentPid = process.pid) {
+  return containerMode === "1" && markerPid === currentPid;
+}
 async function isHqAlreadyRunning(dataDir) {
   const marker = readHqRuntimeFileSync(dataDir);
   if (!marker) return null;
+  if (isReusedContainerPid(marker.pid, process.env.WRONGSTACK_HQ_CONTAINER)) return null;
   if (marker.pid && isPidAlive(marker.pid)) return marker;
   return null;
 }
@@ -784,12 +796,31 @@ async function isPortInUse(host, port) {
 }
 async function handleHqShortCircuit(flags) {
   if (flags["hq"] !== true) return null;
-  const { startHqServer } = await import("./hq-server-OILU3NPI.js");
+  const { startHqServer } = await import("./hq-server-CNUTBWTK.js");
   const tunnelRequested = flags["tunnel"] === true;
-  const host = typeof flags["host"] === "string" ? flags["host"] : tunnelRequested ? "127.0.0.1" : HQ_CLI_DEFAULT_HOST2;
-  if (tunnelRequested && !isLoopbackHost(host)) {
+  const rawPublicUrl = typeof flags["hq-public-url"] === "string" ? flags["hq-public-url"] : process.env.WRONGSTACK_HQ_PUBLIC_URL;
+  let publicOrigin;
+  if (rawPublicUrl !== void 0 && rawPublicUrl.trim() !== "") {
+    try {
+      publicOrigin = normalizeHqPublicOrigin(rawPublicUrl);
+    } catch (cause) {
+      process.stderr.write(
+        `${color3.red("\u2717")} ${cause instanceof Error ? cause.message : String(cause)}
+`
+      );
+      return 1;
+    }
+  }
+  if (tunnelRequested && publicOrigin !== void 0) {
+    process.stderr.write(`${color3.red("\u2717")} Use either --tunnel or --hq-public-url, not both.
+`);
+    return 1;
+  }
+  const externallyPublished = tunnelRequested || publicOrigin !== void 0;
+  const host = typeof flags["host"] === "string" ? flags["host"] : externallyPublished ? "127.0.0.1" : HQ_CLI_DEFAULT_HOST2;
+  if (externallyPublished && !isLoopbackHost(host)) {
     process.stderr.write(
-      `${color3.red("\u2717")} --tunnel requires a loopback origin. Remove --host or use --host 127.0.0.1.
+      `${color3.red("\u2717")} Public HQ publishing requires a loopback bind. Remove --host or use --host 127.0.0.1.
 `
     );
     return 1;
@@ -806,12 +837,51 @@ async function handleHqShortCircuit(flags) {
     }
   } else port = DEFAULT_PORT;
   const dataDir = typeof flags["data-dir"] === "string" ? flags["data-dir"] : void 0;
-  const password = typeof flags["password"] === "string" ? flags["password"] : process.env.WRONGSTACK_HQ_PASSWORD;
+  let password;
+  try {
+    password = await resolveHqPasswordInput({
+      ...typeof flags["password"] === "string" ? { explicitPassword: flags["password"] } : {}
+    });
+  } catch (cause) {
+    process.stderr.write(
+      `${color3.red("\u2717")} ${cause instanceof Error ? cause.message : String(cause)}
+`
+    );
+    return 1;
+  }
+  const bootstrapPasswordOnly = /^(?:1|true)$/i.test(
+    process.env.WRONGSTACK_HQ_BOOTSTRAP_PASSWORD_ONLY?.trim() ?? ""
+  );
+  let ipAllowlist;
+  try {
+    ipAllowlist = parseHqIpAllowlist(
+      typeof flags["hq-allowlist"] === "string" ? flags["hq-allowlist"] : process.env.WRONGSTACK_HQ_ALLOWLIST
+    );
+  } catch (cause) {
+    process.stderr.write(
+      `${color3.red("\u2717")} ${cause instanceof Error ? cause.message : String(cause)}
+`
+    );
+    return 1;
+  }
   if (password !== void 0 && password.length < 8) {
     process.stderr.write(`${color3.red("\u2717")} HQ password must be at least 8 characters.
 `);
     return 1;
   }
+  const rawTrustedProxyHops = typeof flags["hq-trusted-proxy-hops"] === "string" ? flags["hq-trusted-proxy-hops"] : process.env.WRONGSTACK_HQ_TRUSTED_PROXY_HOPS;
+  let trustedProxyHops;
+  if (rawTrustedProxyHops !== void 0 && rawTrustedProxyHops.trim() !== "") {
+    const parsed = Number.parseInt(rawTrustedProxyHops, 10);
+    if (!Number.isFinite(parsed) || parsed < 0 || String(parsed) !== rawTrustedProxyHops.trim()) {
+      process.stderr.write(
+        `${color3.red("\u2717")} --hq-trusted-proxy-hops must be a non-negative integer.
+`
+      );
+      return 1;
+    }
+    trustedProxyHops = parsed;
+  }
   const userProvidedPort = typeof flags["port"] === "string" && flags["port"].trim() !== "" || port !== DEFAULT_PORT;
   const resolvedDataDir = dataDir ?? resolveHqDataDir();
   const existing = await isHqAlreadyRunning(resolvedDataDir);
@@ -849,11 +919,14 @@ async function handleHqShortCircuit(flags) {
       strictPort: flags["strict-port"] === true,
       exactPort: userProvidedPort,
       allowInsecureOpen: flags["insecure-open"] === true,
-      secureCookies: tunnelRequested,
-      requireBrowserAuth: tunnelRequested,
+      secureCookies: externallyPublished,
+      requireBrowserAuth: externallyPublished,
       ...dataDir !== void 0 ? { dataDir } : {},
       ...password !== void 0 ? { password } : {},
-      ...tokenTtlMs !== void 0 ? { tokenTtlMs } : {}
+      ...bootstrapPasswordOnly ? { bootstrapPasswordOnly: true } : {},
+      ...tokenTtlMs !== void 0 ? { tokenTtlMs } : {},
+      ...trustedProxyHops !== void 0 ? { trustedProxyHops } : {},
+      ...ipAllowlist !== void 0 ? { ipAllowlist } : {}
     });
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
@@ -868,8 +941,24 @@ async function handleHqShortCircuit(flags) {
     }
     return 1;
   }
+  if (publicOrigin !== void 0) {
+    if (handle.firstRunSetup?.passwordMode !== true) {
+      await handle.close();
+      process.stderr.write(
+        `${color3.red("\u2717")} Persistent public HQ requires password mode. Set WRONGSTACK_HQ_PASSWORD and retry.
+`
+      );
+      return 1;
+    }
+    handle.trustPublicOrigin(publicOrigin);
+    process.stdout.write(`
+${color3.green("Persistent HQ origin ready:")} ${publicOrigin}/
+`);
+    process.stdout.write(`${color3.green("Mobile:")} ${publicOrigin}/mobile
+`);
+  }
   let tunnel;
-  let browserUrl = handle.firstRunSetup?.browserUrl ?? `http://${handle.host}:${handle.port}`;
+  let browserUrl = publicOrigin ?? handle.firstRunSetup?.browserUrl ?? `http://${handle.host}:${handle.port}`;
   if (tunnelRequested) {
     if (handle.firstRunSetup !== void 0 && !handle.firstRunSetup.browserTokenMode && !handle.firstRunSetup.passwordMode) {
       await handle.close();
@@ -894,6 +983,12 @@ async function handleHqShortCircuit(flags) {
       );
       process.stdout.write(`
 ${color3.green("Cloudflare Quick Tunnel ready:")} ${browserUrl}
+`);
+      const tunnelMobileUrl = new URL(tunnel.url);
+      tunnelMobileUrl.pathname = "/mobile";
+      tunnelMobileUrl.search = "";
+      tunnelMobileUrl.hash = "";
+      process.stdout.write(`${color3.green("Mobile:")} ${tunnelMobileUrl.toString()}
 `);
       process.stdout.write(
         `${color3.dim("Temporary development URL; DNS may need a few seconds, it changes on restart and ends when HQ stops.")}
@@ -3128,4 +3223,4 @@ async function initializeCli(argv) {
 export {
   initializeCli
 };
-//# sourceMappingURL=cli-context-Q6QP534K.js.map
+//# sourceMappingURL=cli-context-WFC3BNGM.js.map