@wrongstack/cli 1.0.3 → 1.0.6

package/dist/{chunk-C2E24IXZ.js → chunk-PQZPHGGD.js}

@@ -3,14 +3,37 @@ import {
   terminalText
 } from "./chunk-HXJYHAR4.js";
 import {
-  resolveAuditActor
-} from "./chunk-Q5GTM25S.js";
+  MAX_AGENT_RINGS,
+  MAX_TRANSCRIPT_SESSIONS,
+  TRANSCRIPT_RING_MAX,
+  agentMessageToEntry,
+  agentRingKey,
+  buildBootstrapHttpUrl,
+  buildClientWsUrl,
+  buildHttpUrl,
+  decodePathSegment,
+  decodeSessionId,
+  evictOldest,
+  hqMachineKey,
+  hqRuntimeMarkerPath,
+  lanIPv4Addresses,
+  readLocalSubagentTranscript,
+  readRequestBody,
+  recordTimeseriesSignal,
+  resolveAuditActor,
+  sanitizeApiError,
+  truncateHqSummary,
+  writeInvalidBody
+} from "./chunk-5EA6OTLJ.js";
+import {
+  createHqIpAllowlist
+} from "./chunk-Q7E3BPDU.js";
 
 // src/hq-server.ts
 import { randomUUID as randomUUID6 } from "node:crypto";
-import * as fs5 from "node:fs/promises";
+import * as fs4 from "node:fs/promises";
 import * as http from "node:http";
-import * as path7 from "node:path";
+import * as path6 from "node:path";
 import { getSharedProjectMailbox } from "@wrongstack/core/coordination";
 import {
   assessHqExposure as assessHqExposure2,
@@ -21,7 +44,7 @@ import {
   hqTokenKey as hqTokenKey2,
   isTokenExpired as isTokenExpired4,
   mintHqCookieSecret as mintHqCookieSecret2,
-  mutateHqAuthFile as mutateHqAuthFile3,
+  mutateHqAuthFile as mutateHqAuthFile4,
   toAlertMessage,
   watchHqAuthFile
 } from "@wrongstack/core/hq";
@@ -112,10 +135,15 @@ function hasTrustedRequestAuthority(req, boundHost, boundPort, trustedPublicOrig
     return false;
   }
 }
-function hasTrustedBrowserOrigin(req, boundHost, boundPort, trustedPublicOrigins = /* @__PURE__ */ new Set(), allowFileOrigin = false) {
+function hasTrustedBrowserOrigin(req, boundHost, boundPort, trustedPublicOrigins = /* @__PURE__ */ new Set(), allowFileOrigin = false, credentialedSurface = false) {
   if (!hasTrustedRequestAuthority(req, boundHost, boundPort, trustedPublicOrigins)) return false;
   const origin = req.headers.origin;
-  if (origin === void 0) return true;
+  if (origin === void 0) {
+    if (!credentialedSurface) {
+      return boundHost !== void 0 && isLoopbackHost(boundHost);
+    }
+    return true;
+  }
   try {
     const parsed = new URL(origin);
     if (parsed.protocol === "file:") return allowFileOrigin;
@@ -199,7 +227,7 @@ function isCookieAuth(auth) {
   return auth !== void 0 && auth.kind === "cookie";
 }
 function hqAuthRequired(mutableAuth, requireBrowserAuth) {
-  return requireBrowserAuth === true || mutableAuth.requireAuthFloor === true || mutableAuth.browserTokens.size > 0 || mutableAuth.passwordHash !== void 0;
+  return (requireBrowserAuth ?? mutableAuth.requireBrowserAuth) === true || mutableAuth.requireAuthFloor === true || mutableAuth.browserTokens.size > 0 || mutableAuth.passwordHash !== void 0;
 }
 function hqClientAuthRequired(mutableAuth) {
   return mutableAuth.requireAuthFloor === true || mutableAuth.clientTokens.size > 0;
@@ -290,7 +318,7 @@ function authenticateBrowserRequest(req, url, mutableAuth, sessions) {
             if (liveToken.capabilities !== void 0) ctx.capabilities = liveToken.capabilities;
             return ctx;
           }
-          return { kind: "cookie" };
+          return session.capabilities === void 0 ? { kind: "cookie" } : { kind: "cookie", capabilities: session.capabilities };
         }
         if (session) sessions.delete(sessionId);
       }
@@ -341,7 +369,8 @@ function createHqAuthState(authFile, dataDir, opts = {}) {
     clientTokens: /* @__PURE__ */ new Set(),
     browserTokenObjs: /* @__PURE__ */ new Map(),
     clientTokenObjs: /* @__PURE__ */ new Map(),
-    alertRules: void 0
+    alertRules: void 0,
+    requireBrowserAuth: opts.requireBrowserAuth
   };
   projectAuthFile(mutableAuth, authFile);
   return {
@@ -609,6 +638,7 @@ var MIME = {
   ".mjs": "application/javascript; charset=utf-8",
   ".css": "text/css; charset=utf-8",
   ".json": "application/json; charset=utf-8",
+  ".webmanifest": "application/manifest+json; charset=utf-8",
   ".svg": "image/svg+xml",
   ".png": "image/png",
   ".jpg": "image/jpeg",
@@ -703,7 +733,32 @@ async function serveHqStatic(_req, res, urlPath, distDir) {
 }
 
 // src/hq-server/routes/auth/common.ts
-import { isLoopbackHost as isLoopbackHost2 } from "@wrongstack/core/hq";
+import { isLoopbackHost as isLoopbackHost2, mutateHqAuthFile } from "@wrongstack/core/hq";
+import { verifyTotpCounter } from "@wrongstack/core/security";
+function recordVerifyFailure(loginAttempts, clientIp) {
+  const prev = loginAttempts.get(clientIp);
+  const count = (prev?.count ?? 0) + 1;
+  loginAttempts.recordFailure(clientIp);
+  return count;
+}
+async function consumeTotpCode(code, mutableAuth, dataDir, applyAuthFile) {
+  if (!mutableAuth.totpSecret) return "invalid";
+  const matchedCounter = verifyTotpCounter(code, mutableAuth.totpSecret);
+  if (matchedCounter === void 0) return "invalid";
+  if (mutableAuth.totpLastUsedCounter !== void 0 && matchedCounter <= mutableAuth.totpLastUsedCounter) {
+    return "replayed";
+  }
+  mutableAuth.totpLastUsedCounter = matchedCounter;
+  try {
+    const next = await mutateHqAuthFile(dataDir, (current) => ({
+      ...current,
+      totpLastUsedCounter: matchedCounter
+    }));
+    applyAuthFile(next);
+  } catch {
+  }
+  return "ok";
+}
 function isLoopbackRequest(req) {
   const address = req.socket.remoteAddress?.replace(/^::ffff:/, "");
   return address !== void 0 && isLoopbackHost2(address);
@@ -711,7 +766,6 @@ function isLoopbackRequest(req) {
 var HQ_AUTH_ADMIN_CAPABILITY = "auth.admin";
 function callerCanAdministerAuth(auth) {
   if (auth === void 0) return false;
-  if (auth.kind === "cookie" && auth.tokenId === void 0) return true;
   if (auth.capabilities === void 0) return true;
   return auth.capabilities.includes(HQ_AUTH_ADMIN_CAPABILITY);
 }
@@ -752,7 +806,8 @@ import { randomUUID } from "node:crypto";
 import {
   hashHqPassword,
   mintHqCookieSecret,
-  mutateHqAuthFile,
+  mutateHqAuthFile as mutateHqAuthFile2,
+  hqPasswordNeedsUpgrade,
   verifyHqPassword
 } from "@wrongstack/core/hq";
 
@@ -762,6 +817,9 @@ function normalizeAddress(raw) {
   const trimmed = raw.trim().replace(/^\[(.*)\]$/, "$1");
   return trimmed.replace(/^::ffff:/i, "");
 }
+function resolveSocketAddress(req) {
+  return req.socket.remoteAddress ? normalizeAddress(req.socket.remoteAddress) : void 0;
+}
 function parseForwardedEntry(entry) {
   const value = entry.trim();
   if (!value) return void 0;
@@ -786,7 +844,7 @@ function forwardedChain(req) {
   return raw.split(",").map((entry) => parseForwardedEntry(entry)).filter((entry) => entry !== void 0);
 }
 function resolveClientAddress(req, trustedProxyHops = 0) {
-  const socketAddress = req.socket.remoteAddress ? normalizeAddress(req.socket.remoteAddress) : void 0;
+  const socketAddress = resolveSocketAddress(req);
   const hops = Number.isFinite(trustedProxyHops) ? Math.max(0, Math.trunc(trustedProxyHops)) : 0;
   if (hops === 0) return socketAddress ?? "unknown";
   const chain = [
@@ -797,201 +855,6 @@ function resolveClientAddress(req, trustedProxyHops = 0) {
   return chain[hops] ?? socketAddress ?? "unknown";
 }
 
-// src/hq-server/utils.ts
-import * as fs3 from "node:fs/promises";
-import * as os from "node:os";
-import * as path3 from "node:path";
-import { resolveHqDataDir } from "@wrongstack/core/hq";
-import { sanitizeApiError, scrubErrorDetail } from "@wrongstack/core/security";
-var TRANSCRIPT_RING_MAX = 4e3;
-var MAX_TRANSCRIPT_SESSIONS = 400;
-var MAX_AGENT_RINGS = 800;
-function evictOldest(map, max) {
-  while (map.size > max) {
-    const oldest = map.keys().next().value;
-    if (oldest === void 0) break;
-    map.delete(oldest);
-  }
-}
-function agentRingKey(sessionId, subId) {
-  return sessionId ? `${sessionId}::${subId}` : subId;
-}
-function agentMessageToEntry(p) {
-  const kind = typeof p["kind"] === "string" ? p["kind"] : "text";
-  const role = kind === "thinking" ? "thinking" : kind === "tool_use" || kind === "tool_result" ? "tool" : kind === "error" ? "error" : kind === "status" || kind === "system" ? "system" : "assistant";
-  return {
-    ts: typeof p["ts"] === "string" ? p["ts"] : (/* @__PURE__ */ new Date()).toISOString(),
-    role,
-    text: typeof p["content"] === "string" ? p["content"] : "",
-    ...typeof p["toolName"] === "string" ? { tool: p["toolName"] } : {},
-    ...kind === "error" ? { isError: true } : {}
-  };
-}
-async function readLocalSubagentTranscript(sessionId, subagentId) {
-  try {
-    const { getSessionRegistry } = await import("@wrongstack/core/storage");
-    const { resolveWstackPaths, sessionScopedPath } = await import("@wrongstack/core/utils");
-    const globalRoot = path3.dirname(resolveHqDataDir());
-    const registry = getSessionRegistry(globalRoot);
-    const entry = await registry.get(sessionId).catch(() => null);
-    if (!entry) return null;
-    const paths = resolveWstackPaths({ projectRoot: entry.projectRoot, globalRoot });
-    const sessionDir = sessionScopedPath(paths.projectSessions, sessionId, "");
-    if (!isSafePathSegment(subagentId)) return null;
-    const transcriptsRoot = path3.resolve(sessionDir, "subagents", "transcripts");
-    const file = path3.resolve(transcriptsRoot, subagentId, "transcript.jsonl");
-    if (!file.startsWith(transcriptsRoot + path3.sep)) return null;
-    const raw = await fs3.readFile(file, "utf8").catch(() => null);
-    if (raw === null) return null;
-    const out = [];
-    for (const line of raw.split("\n")) {
-      const trimmed = line.trim();
-      if (trimmed.length === 0) continue;
-      try {
-        out.push(agentMessageToEntry(JSON.parse(trimmed)));
-      } catch {
-      }
-    }
-    return out;
-  } catch {
-    return null;
-  }
-}
-function decodePathSegment(value) {
-  let decoded;
-  try {
-    decoded = decodeURIComponent(value);
-  } catch {
-    return null;
-  }
-  return isSafePathSegment(decoded) ? decoded : null;
-}
-function decodeSessionId(value) {
-  let decoded;
-  try {
-    decoded = decodeURIComponent(value);
-  } catch {
-    return null;
-  }
-  return isSafeSessionId(decoded) ? decoded : null;
-}
-var MAX_PATH_SEGMENT_LENGTH = 256;
-function isSafePathSegment(value) {
-  if (value.length === 0 || value.length > MAX_PATH_SEGMENT_LENGTH) return false;
-  if (value === "." || value === "..") return false;
-  if (value.includes("/") || value.includes("\\")) return false;
-  if (value.includes("\0")) return false;
-  if (value.includes(":")) return false;
-  return true;
-}
-function isSafeSessionId(value) {
-  if (value.length === 0 || value.length > MAX_PATH_SEGMENT_LENGTH) return false;
-  if (value.includes("\\") || value.includes("\0") || value.includes(":")) return false;
-  const parts = value.split("/");
-  if (parts.length > 2) return false;
-  return parts.every((p) => p.length > 0 && p !== "." && p !== "..");
-}
-function displayHost(host) {
-  return host === "0.0.0.0" ? "127.0.0.1" : host;
-}
-var RequestBodyTooLargeError = class extends Error {
-};
-function readRequestBody(req, maxBytes = 1e6) {
-  return new Promise((resolve2, reject) => {
-    const chunks = [];
-    let size = 0;
-    let settled = false;
-    req.on("data", (chunk) => {
-      if (settled) return;
-      size += chunk.length;
-      if (size > maxBytes) {
-        settled = true;
-        chunks.length = 0;
-        reject(new RequestBodyTooLargeError("request body too large"));
-        return;
-      }
-      chunks.push(chunk);
-    });
-    req.on("end", () => {
-      if (!settled) resolve2(Buffer.concat(chunks).toString("utf8"));
-    });
-    req.on("error", (error) => {
-      if (!settled) reject(error);
-    });
-  });
-}
-function writeInvalidBody(res, error) {
-  const tooLarge = error instanceof RequestBodyTooLargeError;
-  res.writeHead(tooLarge ? 413 : 400, { "Content-Type": "application/json" });
-  res.end(JSON.stringify({ error: tooLarge ? "request body too large" : "invalid json body" }));
-}
-function buildHttpUrl(host, port, token) {
-  const url = new URL(`http://${displayHost(host)}:${port}/`);
-  if (token) url.searchParams.set("token", token);
-  return url.toString();
-}
-function buildBootstrapHttpUrl(host, port, bootstrapCode) {
-  const url = new URL(`http://${displayHost(host)}:${port}/`);
-  url.hash = `bootstrap=${bootstrapCode}`;
-  return url.toString();
-}
-function buildClientWsUrl(host, port, token) {
-  const url = new URL(`ws://${displayHost(host)}:${port}/ws/client`);
-  if (token) url.searchParams.set("token", token);
-  return url.toString();
-}
-function hqRuntimeMarkerPath(dataDir) {
-  return path3.join(dataDir, "runtime.json");
-}
-function lanIPv4Addresses() {
-  const out = [];
-  try {
-    const ifaces = os.networkInterfaces();
-    for (const name of Object.keys(ifaces)) {
-      for (const ni of ifaces[name] ?? []) {
-        if (ni.family === "IPv4" && !ni.internal) out.push(ni.address);
-      }
-    }
-  } catch {
-  }
-  return out;
-}
-function truncateHqSummary(value, maxLength) {
-  if (typeof value !== "string" || value.length === 0) return void 0;
-  if (value.length <= maxLength) return value;
-  const suffix = `\u2026[truncated:${value.length - maxLength}]`;
-  if (maxLength <= suffix.length) return "\u2026";
-  const prefixLen = maxLength - suffix.length;
-  return `${value.slice(0, prefixLen)}${suffix}`;
-}
-function hqMachineKey(hostname, machineId) {
-  const hn = hostname?.trim();
-  return hn ? `host:${hn.toLowerCase()}` : `mid:${machineId || "local"}`;
-}
-function recordTimeseriesSignal(persistence, event) {
-  try {
-    if (event.type === "session.usage") {
-      const p = event.payload;
-      persistence.timeseries.record({
-        ts: Date.parse(event.timestamp) || Date.now(),
-        ...typeof p.costUsd === "number" ? { costUsd: p.costUsd } : {},
-        ...typeof p.inputTokens === "number" ? { inputTokens: p.inputTokens } : {},
-        ...typeof p.outputTokens === "number" ? { outputTokens: p.outputTokens } : {},
-        ...typeof p.model === "string" && p.model.length > 0 ? { model: p.model } : {},
-        ...typeof p.provider === "string" && p.provider.length > 0 ? { provider: p.provider } : {},
-        ...typeof p.cacheRead === "number" ? { cacheRead: p.cacheRead } : {},
-        ...typeof p.cacheWrite === "number" ? { cacheWrite: p.cacheWrite } : {}
-      });
-    } else if (event.type === "tool.completed") {
-      persistence.timeseries.record({
-        ts: Date.parse(event.timestamp) || Date.now(),
-        toolCalls: 1
-      });
-    }
-  } catch {
-  }
-}
-
 // src/hq-server/routes/auth/password-routes.ts
 async function handleApiAuthStatus(req, res, url, mutableAuth, sessions, requireBrowserAuth, trustedPublicOrigins, secureCookies) {
   const auth = authenticateBrowserRequest(req, url, mutableAuth, sessions);
@@ -1013,7 +876,7 @@ async function handleApiAuthStatus(req, res, url, mutableAuth, sessions, require
     })
   );
 }
-async function handleApiLogin(req, res, mutableAuth, sessions, loginAttempts, secureCookies, trustedProxyHops) {
+async function handleApiLogin(req, res, mutableAuth, sessions, loginAttempts, secureCookies, trustedProxyHops, dataDir, sessionCapabilities) {
   if (!mutableAuth.passwordHash) {
     res.writeHead(403, { "Content-Type": "application/json" });
     res.end(
@@ -1064,6 +927,14 @@ async function handleApiLogin(req, res, mutableAuth, sessions, loginAttempts, se
     return;
   }
   const ok = await verifyHqPassword(body.password, mutableAuth.passwordHash);
+  if (ok && hqPasswordNeedsUpgrade(mutableAuth.passwordHash)) {
+    try {
+      const upgraded = await hashHqPassword(body.password);
+      await mutateHqAuthFile2(dataDir, (current) => ({ ...current, passwordHash: upgraded }));
+      mutableAuth.passwordHash = upgraded;
+    } catch {
+    }
+  }
   if (!ok || !mutableAuth.cookieSecret) {
     loginAttempts.recordFailure(clientIp, body.password);
     res.writeHead(401, { "Content-Type": "application/json" });
@@ -1076,7 +947,8 @@ async function handleApiLogin(req, res, mutableAuth, sessions, loginAttempts, se
       createdAt: Date.now(),
       kind: "password",
       pending2fa: true,
-      lastSeenAt: Date.now()
+      lastSeenAt: Date.now(),
+      ...sessionCapabilities !== void 0 ? { capabilities: sessionCapabilities } : {}
     });
     setHqSessionCookie(
       res,
@@ -1089,7 +961,12 @@ async function handleApiLogin(req, res, mutableAuth, sessions, loginAttempts, se
   }
   loginAttempts.clearOnSuccess(clientIp, body.password);
   const sessionId = randomUUID();
-  sessions.set(sessionId, { createdAt: Date.now(), kind: "password", lastSeenAt: Date.now() });
+  sessions.set(sessionId, {
+    createdAt: Date.now(),
+    kind: "password",
+    lastSeenAt: Date.now(),
+    ...sessionCapabilities !== void 0 ? { capabilities: sessionCapabilities } : {}
+  });
   setHqSessionCookie(
     res,
     serializeHqSessionCookie(sessionId, mutableAuth.cookieSecret),
@@ -1116,7 +993,7 @@ async function handleApiLogout(req, res, mutableAuth, sessions, secureCookies) {
   res.writeHead(200, { "Content-Type": "application/json" });
   res.end(JSON.stringify({ loggedIn: false }));
 }
-async function handleApiPassword(req, res, mutableAuth, sessions, dataDir, secureCookies, requireBrowserAuth, applyAuthFile) {
+async function handleApiPassword(req, res, mutableAuth, sessions, dataDir, secureCookies, requireBrowserAuth, applyAuthFile, loginAttempts, trustedProxyHops) {
   const auth = authenticateBrowserRequest(
     req,
     new URL(req.url ?? "/", "http://localhost"),
@@ -1156,21 +1033,43 @@ async function handleApiPassword(req, res, mutableAuth, sessions, dataDir, secur
     res.end(JSON.stringify({ error: { code: "BAD_REQUEST", message: "Invalid JSON body." } }));
     return;
   }
-  const hasAdminCapability = auth !== void 0 && "capabilities" in auth && auth.capabilities?.includes("auth.admin");
-  if (!localOpenBootstrap && mutableAuth.passwordHash !== void 0 && !hasAdminCapability) {
+  if (!localOpenBootstrap && mutableAuth.passwordHash !== void 0) {
+    const clientIp = resolveClientAddress(req, trustedProxyHops);
+    const { blocked, retryAfter } = loginAttempts.checkBlocked(clientIp);
+    if (blocked) {
+      res.writeHead(429, {
+        "Content-Type": "application/json",
+        "Retry-After": String(retryAfter)
+      });
+      res.end(
+        JSON.stringify({
+          error: { code: "RATE_LIMITED", message: "Too many attempts. Try again later." }
+        })
+      );
+      return;
+    }
     const currentPassword = typeof body.currentPassword === "string" ? body.currentPassword : "";
-    if (!currentPassword || !await verifyHqPassword(currentPassword, mutableAuth.passwordHash)) {
+    let confirmed = currentPassword.length > 0 && await verifyHqPassword(currentPassword, mutableAuth.passwordHash);
+    let replayed = false;
+    if (!confirmed && typeof body.code === "string" && mutableAuth.totpSecret) {
+      const outcome = await consumeTotpCode(body.code, mutableAuth, dataDir, applyAuthFile);
+      confirmed = outcome === "ok";
+      replayed = outcome === "replayed";
+    }
+    if (!confirmed) {
+      recordVerifyFailure(loginAttempts, clientIp);
       res.writeHead(403, { "Content-Type": "application/json" });
       res.end(
         JSON.stringify({
           error: {
-            code: "INVALID_CURRENT_PASSWORD",
-            message: "Current password is required to change or remove it."
+            code: replayed ? "TOTP_ALREADY_USED" : "INVALID_CURRENT_PASSWORD",
+            message: replayed ? "That authenticator code has already been used. Wait for the next one." : "Current password or a TOTP code is required to change or remove it."
           }
         })
       );
       return;
     }
+    loginAttempts.delete(clientIp);
   }
   if (req.method === "DELETE") {
     if (requireBrowserAuth && mutableAuth.browserTokens.size === 0) {
@@ -1185,7 +1084,7 @@ async function handleApiPassword(req, res, mutableAuth, sessions, dataDir, secur
       );
       return;
     }
-    const next2 = await mutateHqAuthFile(dataDir, (current) => {
+    const next2 = await mutateHqAuthFile2(dataDir, (current) => {
       const updated = { ...current };
       delete updated.passwordHash;
       delete updated.cookieSecret;
@@ -1222,7 +1121,7 @@ async function handleApiPassword(req, res, mutableAuth, sessions, dataDir, secur
   }
   const passwordHash = await hashHqPassword(newPassword);
   const cookieSecret = mintHqCookieSecret();
-  const next = await mutateHqAuthFile(dataDir, (current) => ({
+  const next = await mutateHqAuthFile2(dataDir, (current) => ({
     ...current,
     passwordHash,
     cookieSecret
@@ -1246,25 +1145,18 @@ async function handleApiPassword(req, res, mutableAuth, sessions, dataDir, secur
 
 // src/hq-server/routes/auth/totp-routes.ts
 import { randomUUID as randomUUID2 } from "node:crypto";
-import { mutateHqAuthFile as mutateHqAuthFile2, verifyHqPassword as verifyHqPassword2 } from "@wrongstack/core/hq";
+import { mutateHqAuthFile as mutateHqAuthFile3, verifyHqPassword as verifyHqPassword2 } from "@wrongstack/core/hq";
 import {
   buildOtpAuthUri,
   generateRecoveryCodes,
   generateTotpSecret,
   hashRecoveryCode,
   verifyRecoveryCode,
-  verifyTotp,
-  verifyTotpCounter
+  verifyTotp
 } from "@wrongstack/core/security";
 var PENDING_2FA_TTL_MS = 5 * 6e4;
 var recoveryCodeLock = Promise.resolve();
 var MAX_2FA_VERIFY_FAILURES = 5;
-function recordVerifyFailure(loginAttempts, clientIp) {
-  const prev = loginAttempts.get(clientIp);
-  const count = (prev?.count ?? 0) + 1;
-  loginAttempts.recordFailure(clientIp);
-  return count;
-}
 async function handleApiLoginVerify(req, res, _url, mutableAuth, sessions, loginAttempts, dataDir, secureCookies, applyAuthFile, trustedProxyHops) {
   if (!mutableAuth.cookieSecret) {
     res.writeHead(503, { "Content-Type": "application/json" });
@@ -1327,9 +1219,9 @@ async function handleApiLoginVerify(req, res, _url, mutableAuth, sessions, login
       );
       return;
     }
-    const matchedCounter = verifyTotpCounter(body.code, mutableAuth.totpSecret);
-    const replayed = matchedCounter !== void 0 && mutableAuth.totpLastUsedCounter !== void 0 && matchedCounter <= mutableAuth.totpLastUsedCounter;
-    if (matchedCounter === void 0 || replayed) {
+    const outcome = await consumeTotpCode(body.code, mutableAuth, dataDir, applyAuthFile);
+    const replayed = outcome === "replayed";
+    if (outcome !== "ok") {
       if (recordVerifyFailure(loginAttempts, clientIp) >= MAX_2FA_VERIFY_FAILURES) {
         sessions.delete(sessionId);
       }
@@ -1344,22 +1236,14 @@ async function handleApiLoginVerify(req, res, _url, mutableAuth, sessions, login
       );
       return;
     }
-    mutableAuth.totpLastUsedCounter = matchedCounter;
-    try {
-      const next = await mutateHqAuthFile2(dataDir, (current) => ({
-        ...current,
-        totpLastUsedCounter: matchedCounter
-      }));
-      applyAuthFile(next);
-    } catch {
-    }
     loginAttempts.clearOnSuccess(clientIp);
     sessions.delete(sessionId);
     const fullSessionId = randomUUID2();
     sessions.set(fullSessionId, {
       createdAt: Date.now(),
       kind: "password",
-      lastSeenAt: Date.now()
+      lastSeenAt: Date.now(),
+      ...session.capabilities !== void 0 ? { capabilities: session.capabilities } : {}
     });
     setHqSessionCookie(
       res,
@@ -1399,11 +1283,11 @@ async function handleApiLoginVerify(req, res, _url, mutableAuth, sessions, login
     await recoveryCodeLock;
     let releaseLock = () => {
     };
-    recoveryCodeLock = new Promise((resolve2) => {
-      releaseLock = resolve2;
+    recoveryCodeLock = new Promise((resolve) => {
+      releaseLock = resolve;
     });
     try {
-      const next = await mutateHqAuthFile2(dataDir, (current) => {
+      const next = await mutateHqAuthFile3(dataDir, (current) => {
         const diskHashes = current.totpRecoveryCodes ?? [];
         const idx = diskHashes.indexOf(usedHash);
         if (idx === -1) {
@@ -1438,7 +1322,8 @@ async function handleApiLoginVerify(req, res, _url, mutableAuth, sessions, login
     sessions.set(fullSessionId, {
       createdAt: Date.now(),
       kind: "password",
-      lastSeenAt: Date.now()
+      lastSeenAt: Date.now(),
+      ...session.capabilities !== void 0 ? { capabilities: session.capabilities } : {}
     });
     setHqSessionCookie(
       res,
@@ -1472,7 +1357,7 @@ async function handleApiTotpSetup(req, res, mutableAuth, sessions, dataDir, appl
   }
   const secret = generateTotpSecret();
   const uri = buildOtpAuthUri(secret, "HQ");
-  const next = await mutateHqAuthFile2(dataDir, (current) => ({
+  const next = await mutateHqAuthFile3(dataDir, (current) => ({
     ...current,
     totpPendingSecret: secret
   }));
@@ -1523,7 +1408,7 @@ async function handleApiTotpEnable(req, res, mutableAuth, sessions, dataDir, app
   }
   const recoveryCodes = generateRecoveryCodes();
   const recoveryHashes = recoveryCodes.map(hashRecoveryCode);
-  const next = await mutateHqAuthFile2(dataDir, (current) => {
+  const next = await mutateHqAuthFile3(dataDir, (current) => {
     const updated = { ...current };
     updated.totpSecret = pendingSecret;
     delete updated.totpPendingSecret;
@@ -1560,8 +1445,11 @@ async function handleApiTotpDisable(req, res, mutableAuth, sessions, loginAttemp
   if (typeof body.password === "string" && body.password.length > 0 && mutableAuth.passwordHash) {
     confirmed = await verifyHqPassword2(body.password, mutableAuth.passwordHash);
   }
+  let replayed = false;
   if (!confirmed && typeof body.code === "string" && mutableAuth.totpSecret) {
-    confirmed = verifyTotp(body.code, mutableAuth.totpSecret);
+    const outcome = await consumeTotpCode(body.code, mutableAuth, dataDir, applyAuthFile);
+    confirmed = outcome === "ok";
+    replayed = outcome === "replayed";
   }
   if (!confirmed) {
     recordVerifyFailure(loginAttempts, clientIp);
@@ -1569,15 +1457,15 @@ async function handleApiTotpDisable(req, res, mutableAuth, sessions, loginAttemp
     res.end(
       JSON.stringify({
         error: {
-          code: "CONFIRMATION_REQUIRED",
-          message: "Provide the current password or a TOTP code."
+          code: replayed ? "TOTP_ALREADY_USED" : "CONFIRMATION_REQUIRED",
+          message: replayed ? "That authenticator code has already been used. Wait for the next one." : "Provide the current password or a TOTP code."
         }
       })
     );
     return;
   }
   loginAttempts.delete(clientIp);
-  const next = await mutateHqAuthFile2(dataDir, (current) => {
+  const next = await mutateHqAuthFile3(dataDir, (current) => {
     const updated = { ...current };
     delete updated.totpSecret;
     delete updated.totpPendingSecret;
@@ -2255,7 +2143,7 @@ async function authorizeHqCommand(input) {
 }
 
 // src/hq-server/routes/mailbox-handlers.ts
-import * as path4 from "node:path";
+import * as path3 from "node:path";
 import { resolveProjectDir } from "@wrongstack/core/coordination";
 
 // src/hq-server/project-root.ts
@@ -2311,7 +2199,7 @@ async function handleMailboxGateway(_req, res, match, authorizeMailboxGateway, g
     );
     return;
   }
-  const gatewayGlobalRoot = path4.dirname(dataDir);
+  const gatewayGlobalRoot = path3.dirname(dataDir);
   const preliminaryAccess = authorizeMailboxGateway(_req, `project:${projectId}`);
   if (!preliminaryAccess.allowed) {
     res.writeHead(preliminaryAccess.status ?? 401, {
@@ -2377,7 +2265,7 @@ async function handleApiMailboxSend(_req, res, mutableAuth, sessions, dataDir, g
     res.end(JSON.stringify({ error: "audience must be all or leaders" }));
     return;
   }
-  const mbGlobalRoot = path4.dirname(dataDir);
+  const mbGlobalRoot = path3.dirname(dataDir);
   const projectRoot = await resolveHqProjectRoot(mbGlobalRoot, {
     sessionId: mbody.sessionId,
     projectId: mbody.projectId
@@ -2497,7 +2385,7 @@ async function handleMailboxAction(_req, res, match, mutableAuth, sessions, data
     res.end(JSON.stringify({ error: "missing sessionId or projectId" }));
     return;
   }
-  const actGlobalRoot = path4.dirname(dataDir);
+  const actGlobalRoot = path3.dirname(dataDir);
   const projectRoot = await resolveHqProjectRoot(actGlobalRoot, {
     sessionId: abody.sessionId,
     projectId: abody.projectId
@@ -2593,6 +2481,15 @@ async function handleApiCommand(req, res, url, mutableAuth, sessions, clients, b
     res.end(JSON.stringify({ error: "unrecognized or malformed command", type: body.type }));
     return;
   }
+  if (validated.type === "run-command" && isCookieAuth(auth) && auth.capabilities !== void 0 && !auth.capabilities.includes("control.execute")) {
+    res.writeHead(403, { "Content-Type": "application/json" });
+    res.end(
+      JSON.stringify({
+        error: "forbidden: browser session lacks control.execute capability"
+      })
+    );
+    return;
+  }
   if (validated.type === "run-command" && !tokenHasCapability(target.authToken, "control.execute")) {
     res.writeHead(403, { "Content-Type": "application/json" });
     res.end(
@@ -2678,14 +2575,14 @@ async function handleApiTrendsCost(req, res, persistence) {
 }
 
 // src/hq-server/routes/session-handlers.ts
-import * as path5 from "node:path";
+import * as path4 from "node:path";
 import {
   buildTranscriptFromEvents,
-  resolveHqDataDir as resolveHqDataDir2
+  resolveHqDataDir
 } from "@wrongstack/core/hq";
 async function handleApiSessions(res) {
   const { getSessionRegistry } = await import("@wrongstack/core/storage");
-  const globalRoot = path5.dirname(resolveHqDataDir2());
+  const globalRoot = path4.dirname(resolveHqDataDir());
   try {
     const registry = getSessionRegistry(globalRoot);
     const sessions = await registry.list();
@@ -2730,7 +2627,7 @@ async function handleApiSessionEvents(req, res, match, transcripts) {
     res.end(JSON.stringify({ error: "invalid sessionId encoding" }));
     return;
   }
-  const globalRoot = path5.dirname(resolveHqDataDir2());
+  const globalRoot = path4.dirname(resolveHqDataDir());
   try {
     const registry = getSessionRegistry(globalRoot);
     const entry = await registry.get(sessionId).catch(() => null);
@@ -2957,24 +2854,42 @@ function createHqRouter(deps) {
     trustBoundary,
     bootstrapStore,
     applyAuthFile,
-    trustedProxyHops = 0
+    trustedProxyHops = 0,
+    ipAllowlist
   } = deps;
   return async (req, res) => {
     try {
       const url = new URL(req.url ?? "/", `http://${host}:${listeningPort()}`);
       setHqSecurityHeaders(res);
+      if (ipAllowlist && !ipAllowlist.allows(resolveSocketAddress(req))) {
+        res.writeHead(403, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ error: "forbidden: source IP is not allowed" }));
+        return;
+      }
+      if (url.pathname === "/healthz" && req.method === "GET") {
+        res.writeHead(200, {
+          "Content-Type": "application/json",
+          "Cache-Control": "no-store"
+        });
+        res.end(JSON.stringify({ status: "ok" }));
+        return;
+      }
       if (!hasTrustedBrowserOrigin(
         req,
         host,
         listeningPort(),
         trustedPublicOrigins,
-        allowFileOrigin
+        allowFileOrigin,
+        // WS-SEC-06: tells the guard whether anything else can authenticate
+        // this request. In open mode a missing Origin is only acceptable on
+        // a loopback bind.
+        hqAuthRequired(mutableAuth, requireBrowserAuth)
       )) {
         res.writeHead(403, { "Content-Type": "application/json" });
         res.end(JSON.stringify({ error: "forbidden: untrusted request origin" }));
         return;
       }
-      if (url.pathname.startsWith("/api/") && url.pathname !== "/api/auth/status" && url.pathname !== "/api/login" && url.pathname !== "/api/login/verify" && url.pathname !== "/api/auth/bootstrap" && hqAuthRequired(mutableAuth, requireBrowserAuth)) {
+      if (url.pathname.startsWith("/api/") && url.pathname !== "/api/auth/status" && url.pathname !== "/api/login" && url.pathname !== "/api/login/verify" && url.pathname !== "/api/mobile/login" && url.pathname !== "/api/mobile/login/verify" && url.pathname !== "/api/auth/bootstrap" && hqAuthRequired(mutableAuth, requireBrowserAuth)) {
         const auth = authenticateBrowserRequest(req, url, mutableAuth, sessions);
         if (!auth) {
           const tokenOnly = mutableAuth.browserTokens.size > 0 && !mutableAuth.passwordHash;
@@ -3041,7 +2956,7 @@ function createHqRouter(deps) {
         await handleApiAuthSessionsRevoke(req, res, url, sessions);
         return;
       }
-      if (url.pathname === "/api/login" && req.method === "POST") {
+      if ((url.pathname === "/api/login" || url.pathname === "/api/mobile/login") && req.method === "POST") {
         await handleApiLogin(
           req,
           res,
@@ -3049,7 +2964,9 @@ function createHqRouter(deps) {
           sessions,
           loginAttempts,
           secureCookies,
-          trustedProxyHops
+          trustedProxyHops,
+          dataDir,
+          url.pathname === "/api/mobile/login" ? ["control.enqueue"] : void 0
         );
         return;
       }
@@ -3077,7 +2994,7 @@ function createHqRouter(deps) {
         await handleApiLogout(req, res, mutableAuth, sessions, secureCookies);
         return;
       }
-      if (url.pathname === "/api/login/verify" && req.method === "POST") {
+      if ((url.pathname === "/api/login/verify" || url.pathname === "/api/mobile/login/verify") && req.method === "POST") {
         await handleApiLoginVerify(
           req,
           res,
@@ -3122,7 +3039,9 @@ function createHqRouter(deps) {
           dataDir,
           secureCookies,
           requireBrowserAuth,
-          applyAuthFile
+          applyAuthFile,
+          loginAttempts,
+          trustedProxyHops
         );
         return;
       }
@@ -3380,12 +3299,12 @@ import {
   ensureHqFirstRunAuthFile,
   HqInsecureExposureError,
   isTokenExpired as isTokenExpired3,
-  resolveHqDataDir as resolveHqDataDir3
+  resolveHqDataDir as resolveHqDataDir2
 } from "@wrongstack/core/hq";
 async function prepareHqServerStart(options, defaults) {
   const host = options.host ?? defaults.host;
   const port = options.port ?? defaults.port;
-  const dataDir = resolveHqDataDir3(options.dataDir);
+  const dataDir = resolveHqDataDir2(options.dataDir);
   const firstRunAuth = await ensureHqFirstRunAuthFile(dataDir, {
     warn: (message) => console.warn(
       JSON.stringify({
@@ -3397,6 +3316,7 @@ async function prepareHqServerStart(options, defaults) {
     ),
     actor: resolveAuditActor(),
     ...options.password !== void 0 ? { password: options.password } : {},
+    ...options.bootstrapPasswordOnly !== void 0 ? { bootstrapPasswordOnly: options.bootstrapPasswordOnly } : {},
     ...options.tokenTtlMs !== void 0 ? { tokenTtlMs: options.tokenTtlMs } : {}
   });
   const { authFile } = firstRunAuth;
@@ -3435,21 +3355,21 @@ async function prepareHqServerStart(options, defaults) {
 }
 
 // src/hq-server/startup.ts
-import * as fs4 from "node:fs/promises";
-import * as path6 from "node:path";
+import * as fs3 from "node:fs/promises";
+import * as path5 from "node:path";
 import { writeHqRuntimeFile } from "@wrongstack/core/hq";
 var hqRuntimeMarkerPath2 = hqRuntimeMarkerPath;
 async function writeHqRuntimeMarker(dataDir, url) {
-  await fs4.mkdir(dataDir, { recursive: true });
+  await fs3.mkdir(dataDir, { recursive: true });
   await writeHqRuntimeFile(dataDir, { url, pid: process.pid });
 }
 async function clearHqRuntimeMarker(dataDir, url) {
   const file = hqRuntimeMarkerPath2(dataDir);
   try {
-    const raw = await fs4.readFile(file, "utf8");
+    const raw = await fs3.readFile(file, "utf8");
     const parsed = JSON.parse(raw);
     if (parsed.url === url && parsed.pid === process.pid) {
-      await fs4.rm(file, { force: true });
+      await fs3.rm(file, { force: true });
     }
   } catch {
   }
@@ -3458,6 +3378,8 @@ function writeHqStartupInfo(write, handle) {
   const startup = handle.firstRunSetup;
   const browserUrl = buildHttpUrl(handle.host, handle.port);
   const clientUrl = buildClientWsUrl(handle.host, handle.port);
+  const mobileUrl = new URL(browserUrl);
+  mobileUrl.pathname = "/mobile";
   write(
     `${terminalText("WrongStack HQ", "magenta")} ${terminalText("listening on", "green")} ${terminalLink(browserUrl)}
 `
@@ -3465,13 +3387,39 @@ function writeHqStartupInfo(write, handle) {
   if (!startup) {
     write(`${terminalText("Browser endpoint:", "blue")} ${terminalLink(browserUrl)}
 `);
+    write(
+      `${terminalText("Mobile endpoint:", "blue")}  ${terminalLink(mobileUrl.toString())} (password required)
+`
+    );
     write(`${terminalText("Client endpoint:", "blue")}  ${terminalLink(clientUrl)}
 `);
     writeHqLanEndpoints(write, handle, void 0);
     return;
   }
+  if (process.env.WRONGSTACK_HQ_SUPPRESS_STARTUP_SECRETS === "1") {
+    write(`${terminalText("Browser endpoint:", "blue")} ${terminalLink(browserUrl)}
+`);
+    write(
+      `${terminalText("Mobile endpoint:", "blue")}  ${terminalLink(mobileUrl.toString())} (password required)
+`
+    );
+    write(`${terminalText("Client endpoint:", "blue")}  ${terminalLink(clientUrl)}
+`);
+    write(`Startup credentials suppressed; auth state is stored in ${startup.dataDir}.
+`);
+    writeHqLanEndpoints(write, handle, void 0);
+    return;
+  }
+  const firstRunMobileUrl = new URL(startup.browserUrl);
+  firstRunMobileUrl.pathname = "/mobile";
+  firstRunMobileUrl.search = "";
+  firstRunMobileUrl.hash = "";
   write(`${terminalText("Browser endpoint:", "blue")} ${terminalLink(startup.browserUrl)}
 `);
+  write(
+    `${terminalText("Mobile endpoint:", "blue")}  ${terminalLink(firstRunMobileUrl.toString())} (password required)
+`
+  );
   write(`${terminalText("Client endpoint:", "blue")}  ${terminalLink(startup.clientUrl)}
 `);
   if (startup.createdAuth) {
@@ -3489,7 +3437,7 @@ HQ auth loaded from ${startup.dataDir}
   if (startup.clientEnv.WRONGSTACK_HQ_TOKEN) {
     write(`  WRONGSTACK_HQ_TOKEN=${startup.clientEnv.WRONGSTACK_HQ_TOKEN}
 `);
-    write(`Credentials are stored in ${path6.join(startup.dataDir, "auth.json")}
+    write(`Credentials are stored in ${path5.join(startup.dataDir, "auth.json")}
 `);
   }
   writeHqLanEndpoints(write, handle, void 0);
@@ -3567,13 +3515,14 @@ function createHqServerShutdown(params) {
 }
 
 // src/hq-server/upgrade-handler.ts
-import { isLoopbackHost as isLoopbackHost3, hqTokenVerifier as hqTokenVerifier2 } from "@wrongstack/core/hq";
+import { hqTokenVerifier as hqTokenVerifier2, isLoopbackHost as isLoopbackHost3 } from "@wrongstack/core/hq";
 
 // src/hq-server/ws.ts
 import { randomUUID as randomUUID5 } from "node:crypto";
 import {
   HQ_PROTOCOL_VERSION as HQ_PROTOCOL_VERSION2,
   parseHqFrame,
+  redactHqEvent as redactHqEvent2,
   resolveHqRedactionPolicy,
   tightenHqRedactionPolicy as tightenHqRedactionPolicy2,
   tokenHasCapability as tokenHasCapability3
@@ -4236,16 +4185,22 @@ function handleClient(ws, clients, browsers, eventLog, auth, snapshotBroadcaster
           sendGuarded(ws, JSON.stringify({ type: "hq.kanban_snapshot", payload: p }));
         }).catch(() => void 0);
       }
-      const event = {
-        id: randomUUID5(),
-        type: "client.hello",
-        schemaVersion: HQ_PROTOCOL_VERSION2,
-        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-        clientId: payload.client.clientId,
-        projectId: payload.project.projectId,
-        seq: 0,
-        payload: { client: payload.client, project: payload.project }
-      };
+      const event = redactHqEvent2(
+        {
+          id: randomUUID5(),
+          type: "client.hello",
+          schemaVersion: HQ_PROTOCOL_VERSION2,
+          timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+          clientId: payload.client.clientId,
+          projectId: payload.project.projectId,
+          seq: 0,
+          payload: { client: payload.client, project: payload.project }
+        },
+        {
+          policy: tightenHqRedactionPolicy2(declaredRedactionPolicy, auth.getOperatorPolicy()),
+          ...payload.project.projectRoot ? { projectRoot: payload.project.projectRoot } : {}
+        }
+      ).value;
       persistEvent(event);
       snapshotBroadcaster.broadcast();
       broadcastEvent(event, browsers);
@@ -4345,12 +4300,24 @@ function handleHqUpgrade(req, socket, head, deps) {
     socket.destroy();
     return;
   }
+  if (deps.ipAllowlist && !deps.ipAllowlist.allows(resolveSocketAddress(req))) {
+    socket.write(
+      "HTTP/1.1 403 Forbidden\r\nContent-Type: application/json\r\nConnection: close\r\n\r\n" + JSON.stringify({
+        error: { code: "IP_NOT_ALLOWED", message: "Source IP is not allowed." }
+      })
+    );
+    socket.destroy();
+    return;
+  }
   if (!hasTrustedBrowserOrigin2(
     req,
     deps.host,
     deps.listeningPort(),
     deps.trustedPublicOrigins,
-    deps.allowFileOrigin
+    deps.allowFileOrigin,
+    // WS-SEC-06 — see the guard. `/ws/browser` and `/ws/client` are the two
+    // surfaces this branch left uncontrolled in open mode.
+    hqAuthRequired(deps.mutableAuth, deps.requireBrowserAuth)
   )) {
     socket.write(
       "HTTP/1.1 403 Forbidden\r\nContent-Type: application/json\r\nConnection: close\r\n\r\n" + JSON.stringify({
@@ -4471,6 +4438,7 @@ async function startHqServer(options = {}) {
 }
 async function startHqServerWithAuth(options, host, port, dataDir, firstRunAuth) {
   const trustBoundary = options.trustBoundary ?? createCompatibilityTrustBoundary({ policyId: "hq-trusted-host-compat-v1" });
+  const ipAllowlist = createHqIpAllowlist(options.ipAllowlist);
   const authFile = firstRunAuth.authFile;
   const reassessExposureFloor = (live) => {
     const exposure = assessHqExposure2({
@@ -4494,14 +4462,15 @@ async function startHqServerWithAuth(options, host, port, dataDir, firstRunAuth)
     }
   };
   const authState = createHqAuthState(authFile, dataDir, {
-    onApplied: (live) => reassessExposureFloor(live)
+    onApplied: (live) => reassessExposureFloor(live),
+    requireBrowserAuth: options.requireBrowserAuth
   });
   const { mutableAuth } = authState;
   const loginAttempts = new LoginAttemptStore(dataDir);
   await loginAttempts.load();
   if (!mutableAuth.cookieSecret && mutableAuth.browserTokens.size > 0) {
     const secret = mintHqCookieSecret2();
-    const next = await mutateHqAuthFile3(dataDir, (current) => ({
+    const next = await mutateHqAuthFile4(dataDir, (current) => ({
       ...current,
       cookieSecret: secret
     }));
@@ -4528,10 +4497,12 @@ async function startHqServerWithAuth(options, host, port, dataDir, firstRunAuth)
       browserTokenMode: mutableAuth.browserTokens.size > 0,
       clientTokenMode: mutableAuth.clientTokens.size > 0,
       passwordMode: mutableAuth.passwordHash !== void 0,
+      ipAllowlistActive: ipAllowlist !== void 0,
+      ipAllowlistRules: ipAllowlist?.entries.length ?? 0,
       timestamp: (/* @__PURE__ */ new Date()).toISOString()
     })
   );
-  return new Promise((resolve2, reject) => {
+  return new Promise((resolve, reject) => {
     const trustedPublicOrigins = /* @__PURE__ */ new Set();
     let listeningPort = port;
     const clients = /* @__PURE__ */ new Map();
@@ -4577,13 +4548,13 @@ async function startHqServerWithAuth(options, host, port, dataDir, firstRunAuth)
     const persistence = createHqPersistence(dataDir);
     const auditLog = new HqCommandAuditLog(1e3, (entry) => persistence.commandLog.append(entry));
     void (async () => {
-      const projectsDir = path7.join(path7.dirname(dataDir), "projects");
-      const entries = await fs5.readdir(projectsDir, { withFileTypes: true }).catch(() => []);
+      const projectsDir = path6.join(path6.dirname(dataDir), "projects");
+      const entries = await fs4.readdir(projectsDir, { withFileTypes: true }).catch(() => []);
       await Promise.all(
         entries.filter((entry) => entry.isDirectory()).map(async (entry) => {
-          const projectDir = path7.join(projectsDir, entry.name);
-          const metadataPath = path7.join(projectDir, ".mailbox-server.json");
-          const ownerPid = await fs5.readFile(metadataPath, "utf8").then((raw) => JSON.parse(raw).pid).catch(() => void 0);
+          const projectDir = path6.join(projectsDir, entry.name);
+          const metadataPath = path6.join(projectDir, ".mailbox-server.json");
+          const ownerPid = await fs4.readFile(metadataPath, "utf8").then((raw) => JSON.parse(raw).pid).catch(() => void 0);
           if (ownerPid === void 0) return;
           let ownerAlive = false;
           try {
@@ -4593,7 +4564,7 @@ async function startHqServerWithAuth(options, host, port, dataDir, firstRunAuth)
             ownerAlive = false;
           }
           if (!ownerAlive) {
-            await fs5.rm(metadataPath, { force: true }).catch(() => {
+            await fs4.rm(metadataPath, { force: true }).catch(() => {
             });
             return;
           }
@@ -4722,6 +4693,7 @@ async function startHqServerWithAuth(options, host, port, dataDir, firstRunAuth)
       getTokenStats: () => authState.tokenStats(),
       applyAuthFile: (next) => authState.apply(next),
       trustedProxyHops: options.trustedProxyHops ?? 0,
+      ipAllowlist,
       bootstrapStore
     };
     const handleRequest = createHqRouter(routerDeps);
@@ -4757,7 +4729,8 @@ async function startHqServerWithAuth(options, host, port, dataDir, firstRunAuth)
       persistence,
       auditLog,
       snapshotBroadcaster,
-      wss
+      wss,
+      ipAllowlist
     };
     httpServer.on("upgrade", (req, socket, head) => {
       handleHqUpgrade(req, socket, head, upgradeDeps);
@@ -4907,7 +4880,7 @@ async function startHqServerWithAuth(options, host, port, dataDir, firstRunAuth)
           port: actualPort,
           firstRunSetup: startupInfo
         });
-        resolve2(handle);
+        resolve(handle);
       })();
     });
   });
@@ -4926,4 +4899,4 @@ export {
   startHqServer,
   HqInsecureExposureError2 as HqInsecureExposureError
 };
-//# sourceMappingURL=chunk-C2E24IXZ.js.map
+//# sourceMappingURL=chunk-PQZPHGGD.js.map