@wrongstack/cli 1.0.3 → 1.0.6

package/dist/chunk-Q7E3BPDU.js

@@ -0,0 +1,62 @@
+
+// src/hq-server/ip-allowlist.ts
+import { BlockList, isIP } from "node:net";
+function normalizeAddress(value) {
+  return value.trim().replace(/^\[(.*)\]$/, "$1").replace(/^::ffff:/i, "");
+}
+function addRule(blockList, rawRule) {
+  const rule = rawRule.trim();
+  if (!rule) throw new TypeError("HQ IP allowlist contains an empty entry.");
+  const slash = rule.lastIndexOf("/");
+  if (slash === -1) {
+    const address2 = normalizeAddress(rule);
+    const family2 = isIP(address2);
+    if (family2 === 0) {
+      throw new TypeError(`Invalid HQ allowlist address: ${rule}`);
+    }
+    blockList.addAddress(address2, family2 === 4 ? "ipv4" : "ipv6");
+    return address2;
+  }
+  const address = normalizeAddress(rule.slice(0, slash));
+  const prefixText = rule.slice(slash + 1);
+  const family = isIP(address);
+  if (family === 0 || !/^\d+$/.test(prefixText)) {
+    throw new TypeError(`Invalid HQ allowlist network: ${rule}`);
+  }
+  const prefix = Number(prefixText);
+  const maximum = family === 4 ? 32 : 128;
+  if (!Number.isSafeInteger(prefix) || prefix < 0 || prefix > maximum) {
+    throw new TypeError(`Invalid HQ allowlist prefix: ${rule}`);
+  }
+  blockList.addSubnet(address, prefix, family === 4 ? "ipv4" : "ipv6");
+  return `${address}/${prefix}`;
+}
+function createHqIpAllowlist(rules) {
+  if (rules === void 0 || rules.length === 0) return void 0;
+  const blockList = new BlockList();
+  blockList.addSubnet("127.0.0.0", 8, "ipv4");
+  blockList.addAddress("::1", "ipv6");
+  const entries = [...new Set(rules.map((rule) => addRule(blockList, rule)))];
+  return {
+    entries,
+    allows(address) {
+      if (!address) return false;
+      const normalized = normalizeAddress(address);
+      const family = isIP(normalized);
+      if (family === 0) return false;
+      return blockList.check(normalized, family === 4 ? "ipv4" : "ipv6");
+    }
+  };
+}
+function parseHqIpAllowlist(value) {
+  if (value === void 0 || value.trim() === "") return void 0;
+  const rules = value.split(",").map((entry) => entry.trim());
+  createHqIpAllowlist(rules);
+  return rules;
+}
+
+export {
+  createHqIpAllowlist,
+  parseHqIpAllowlist
+};
+//# sourceMappingURL=chunk-Q7E3BPDU.js.map

package/dist/{chunk-IUEKNHPT.js → chunk-QDQPF4PB.js}

@@ -1,9 +1,9 @@
 
 // src/subcommands/index.ts
 var loaders = {
-  acp: async () => (await import("./acp-JK4ZQO3R.js")).acpCmd,
+  acp: async () => (await import("./acp-GOQURNC2.js")).acpCmd,
   init: async () => (await import("./init-DRMMFG2G.js")).initCmd,
-  auth: async () => (await import("./auth-XD3GN5RJ.js")).authCmd,
+  auth: async () => (await import("./auth-WBXXIQUO.js")).authCmd,
   update: async () => (await import("./update-5DPB4YD4.js")).updateCmd,
   sessions: async () => (await import("./sessions-config-UL45XKX7.js")).sessionsCmd,
   config: async () => (await import("./sessions-config-UL45XKX7.js")).configCmd,
@@ -16,22 +16,22 @@ var loaders = {
   skills: async () => (await import("./tools-skills-GH24UCBY.js")).skillsCmd,
   providers: async () => (await import("./providers-models-6MOGAOVK.js")).providersCmd,
   models: async () => (await import("./providers-models-6MOGAOVK.js")).modelsCmd,
-  mcp: async () => (await import("./mcp-HOMLC4WE.js")).mcpCmd,
+  mcp: async () => (await import("./mcp-FX7TKPTV.js")).mcpCmd,
   plugin: async () => (await import("./plugin-usage-M6KET4OZ.js")).pluginCmd,
   plugins: async () => (await import("./plugin-usage-M6KET4OZ.js")).pluginCmd,
-  diag: async () => (await import("./diag-doctor-7LYUYU35.js")).diagCmd,
-  doctor: async () => (await import("./diag-doctor-7LYUYU35.js")).doctorCmd,
-  "proxy-status": async () => (await import("./diag-doctor-7LYUYU35.js")).proxyCmd,
+  diag: async () => (await import("./diag-doctor-PCER6KHH.js")).diagCmd,
+  doctor: async () => (await import("./diag-doctor-PCER6KHH.js")).doctorCmd,
+  "proxy-status": async () => (await import("./diag-doctor-PCER6KHH.js")).proxyCmd,
   export: async () => (await import("./export-VVRIOWFV.js")).exportCmd,
   usage: async () => (await import("./plugin-usage-M6KET4OZ.js")).usageCmd,
-  version: async () => (await import("./version-help-MYKF724O.js")).versionCmd,
-  help: async () => (await import("./version-help-MYKF724O.js")).helpCmd,
-  projects: async () => (await import("./projects-L6C6XLDY.js")).projectsCmd,
+  version: async () => (await import("./version-help-WXI42PZ3.js")).versionCmd,
+  help: async () => (await import("./version-help-WXI42PZ3.js")).helpCmd,
+  projects: async () => (await import("./projects-LMNAGGEU.js")).projectsCmd,
   modeldiag: async () => (await import("./modeldiag-46CMWUNM.js")).modeldiagCmd,
   quick: async () => (await import("./quick-CNB4Z3HS.js")).quickCmd,
   bench: async () => (await import("./bench-YBU6BVQP.js")).benchCmd,
   chronicle: async () => (await import("./chronicle-UTFETHP6.js")).chronicleCmd,
-  hq: async () => (await import("./hq-IG3YRGCO.js")).hqCmd,
+  hq: async () => (await import("./hq-V4PHEETW.js")).hqCmd,
   mailbox: async () => (await import("./mailbox-serve-X3CR6VFW.js")).mailboxServeCmd,
   permissions: async () => (await import("./permissions-CFDLXETM.js")).permissionsCmd,
   project: async () => (await import("./project-AOQI5XTK.js")).projectCmd,
@@ -51,4 +51,4 @@ export {
   subcommands,
   subcommandNames
 };
-//# sourceMappingURL=chunk-IUEKNHPT.js.map
+//# sourceMappingURL=chunk-QDQPF4PB.js.map

package/dist/{chunk-VFCJOWJB.js → chunk-VPS2SJW4.js}

@@ -74,15 +74,14 @@ function stringifyInput(input) {
 var PREVIEW_MAX_LINES = 40;
 var PREVIEW_MAX_CHARS = 8e3;
 function clipPreview(body, decorate = (l) => l) {
-  const safe = sanitizeTerminalText2(body);
-  const { text, truncated } = sanitizeTerminalPreview(body, {
+  const { text, truncated, sanitizedLength, sanitizedLines } = sanitizeTerminalPreview(body, {
     maxLines: PREVIEW_MAX_LINES,
     maxChars: PREVIEW_MAX_CHARS
   });
   const rendered = text.split("\n").map(decorate).join("\n");
   if (!truncated) return rendered;
-  const hiddenLines = safe.split("\n").length - text.split("\n").length;
-  const detail = hiddenLines > 0 ? `${hiddenLines} more line${hiddenLines === 1 ? "" : "s"} not shown` : `${safe.length - text.length} more characters not shown`;
+  const hiddenLines = sanitizedLines - text.split("\n").length;
+  const detail = hiddenLines > 0 ? `${hiddenLines} more line${hiddenLines === 1 ? "" : "s"} not shown` : `${sanitizedLength - text.length} more characters not shown`;
   return `${rendered}
 ${color2.dim(`\u2026 ${detail} \u2014 review the file before approving`)}`;
 }
@@ -481,4 +480,4 @@ export {
   detectProjectFacts,
   renderAgentsTemplate
 };
-//# sourceMappingURL=chunk-VFCJOWJB.js.map
+//# sourceMappingURL=chunk-VPS2SJW4.js.map

package/dist/{chunk-U6KCWRMC.js → chunk-XJ7K67PP.js}

@@ -80,6 +80,10 @@ var BUILTIN_PLUGIN_FACTORIES = [
     const { createAutoReviewPlugin } = await import("@wrongstack/core/plugin");
     return createAutoReviewPlugin();
   },
+  async () => {
+    const { createSpecialistTriggerPlugin } = await import("@wrongstack/core/plugin");
+    return createSpecialistTriggerPlugin();
+  },
   async () => {
     const { createSkillsPlugin } = await import("@wrongstack/core/plugin");
     return createSkillsPlugin();
@@ -263,4 +267,4 @@ export {
   BUILTIN_PLUGIN_FACTORIES,
   setupPlugins
 };
-//# sourceMappingURL=chunk-U6KCWRMC.js.map
+//# sourceMappingURL=chunk-XJ7K67PP.js.map

package/dist/{cli-context-Q6QP534K.js → cli-context-BYKJDAFF.js}

@@ -5,33 +5,41 @@ import {
   makePromptDelegate,
   renderAgentsTemplate,
   renderDiff
-} from "./chunk-VFCJOWJB.js";
+} from "./chunk-VPS2SJW4.js";
 import {
   theme as theme2
 } from "./chunk-QD544J2B.js";
-import {
-  parseWebuiSessionChildOptions,
-  writeWebuiSessionChildError
-} from "./chunk-GPPRNAKW.js";
 import {
   fmtTok,
   patchConfig
 } from "./chunk-EWKESL4L.js";
+import {
+  parseWebuiSessionChildOptions,
+  writeWebuiSessionChildError
+} from "./chunk-GPPRNAKW.js";
 import {
   subcommands
-} from "./chunk-IUEKNHPT.js";
+} from "./chunk-QDQPF4PB.js";
 import {
   renderDeepHelp,
   renderFocusedHelp
-} from "./chunk-MXEJEYT7.js";
+} from "./chunk-JX6KL7OF.js";
 import {
   handleHelpVersionShortCircuit
-} from "./chunk-4NHD5OXJ.js";
+} from "./chunk-NR7BD73C.js";
 import {
   DEFAULT_PORT
-} from "./chunk-C2E24IXZ.js";
+} from "./chunk-PQZPHGGD.js";
 import "./chunk-HXJYHAR4.js";
-import "./chunk-Q5GTM25S.js";
+import {
+  resolveHqPasswordInput
+} from "./chunk-AUQDGU5D.js";
+import {
+  normalizeHqPublicOrigin
+} from "./chunk-5EA6OTLJ.js";
+import {
+  parseHqIpAllowlist
+} from "./chunk-Q7E3BPDU.js";
 import {
   discoverAndMergeProviders
 } from "./chunk-D5GB5MHA.js";
@@ -39,8 +47,8 @@ import {
   applyNodeEnvDefault,
   applySessionShellDefault,
   runPreflight
-} from "./chunk-O4A3HHKD.js";
-import "./chunk-FPIWTJ2G.js";
+} from "./chunk-672UXYL3.js";
+import "./chunk-6WRKAACA.js";
 import {
   CLI_VERSION
 } from "./chunk-XJXDOF63.js";
@@ -55,7 +63,7 @@ import {
   runPicker,
   saveToGlobalConfig,
   theme
-} from "./chunk-ONOT5OJ2.js";
+} from "./chunk-5A5GCSJC.js";
 import "./chunk-2VMJ3E5Z.js";
 import "./chunk-B4JLSXZB.js";
 import {
@@ -67,7 +75,7 @@ import {
 } from "./chunk-YMXXOOFN.js";
 import {
   parseArgs
-} from "./chunk-E6RFXHWD.js";
+} from "./chunk-EK2P53GL.js";
 import "./chunk-DAKVBMD4.js";
 import {
   mutateConfigProviders,
@@ -706,6 +714,10 @@ function stripDesktopLauncherArgs(argv) {
   }
   return out;
 }
+function selectDesktopLauncherExecutable(execPath, runningUnderBun, nodeOverride) {
+  if (!runningUnderBun) return execPath;
+  return nodeOverride?.trim() || "node";
+}
 async function handleDesktopShortCircuit(flags, argv) {
   if (flags["desktop"] !== true) return null;
   return launchDesktop(stripDesktopLauncherArgs(argv));
@@ -732,7 +744,12 @@ async function launchDesktop(args) {
     return 1;
   }
   return await new Promise((resolve2) => {
-    const child = spawn(process.execPath, [launcherPath, ...args], {
+    const executable = selectDesktopLauncherExecutable(
+      process.execPath,
+      typeof globalThis.Bun !== "undefined",
+      process.env["NODE"]
+    );
+    const child = spawn(executable, [launcherPath, ...args], {
       stdio: "inherit",
       env: process.env,
       windowsHide: false
@@ -760,9 +777,13 @@ import {
   resolveHqDataDir
 } from "@wrongstack/core/hq";
 import { color as color3, isPidAlive } from "@wrongstack/core/utils";
+function isReusedContainerPid(markerPid, containerMode, currentPid = process.pid) {
+  return containerMode === "1" && markerPid === currentPid;
+}
 async function isHqAlreadyRunning(dataDir) {
   const marker = readHqRuntimeFileSync(dataDir);
   if (!marker) return null;
+  if (isReusedContainerPid(marker.pid, process.env.WRONGSTACK_HQ_CONTAINER)) return null;
   if (marker.pid && isPidAlive(marker.pid)) return marker;
   return null;
 }
@@ -784,12 +805,31 @@ async function isPortInUse(host, port) {
 }
 async function handleHqShortCircuit(flags) {
   if (flags["hq"] !== true) return null;
-  const { startHqServer } = await import("./hq-server-OILU3NPI.js");
+  const { startHqServer } = await import("./hq-server-MZ7DV6X7.js");
   const tunnelRequested = flags["tunnel"] === true;
-  const host = typeof flags["host"] === "string" ? flags["host"] : tunnelRequested ? "127.0.0.1" : HQ_CLI_DEFAULT_HOST2;
-  if (tunnelRequested && !isLoopbackHost(host)) {
+  const rawPublicUrl = typeof flags["hq-public-url"] === "string" ? flags["hq-public-url"] : process.env.WRONGSTACK_HQ_PUBLIC_URL;
+  let publicOrigin;
+  if (rawPublicUrl !== void 0 && rawPublicUrl.trim() !== "") {
+    try {
+      publicOrigin = normalizeHqPublicOrigin(rawPublicUrl);
+    } catch (cause) {
+      process.stderr.write(
+        `${color3.red("\u2717")} ${cause instanceof Error ? cause.message : String(cause)}
+`
+      );
+      return 1;
+    }
+  }
+  if (tunnelRequested && publicOrigin !== void 0) {
+    process.stderr.write(`${color3.red("\u2717")} Use either --tunnel or --hq-public-url, not both.
+`);
+    return 1;
+  }
+  const externallyPublished = tunnelRequested || publicOrigin !== void 0;
+  const host = typeof flags["host"] === "string" ? flags["host"] : externallyPublished ? "127.0.0.1" : HQ_CLI_DEFAULT_HOST2;
+  if (externallyPublished && !isLoopbackHost(host)) {
     process.stderr.write(
-      `${color3.red("\u2717")} --tunnel requires a loopback origin. Remove --host or use --host 127.0.0.1.
+      `${color3.red("\u2717")} Public HQ publishing requires a loopback bind. Remove --host or use --host 127.0.0.1.
 `
     );
     return 1;
@@ -806,12 +846,51 @@ async function handleHqShortCircuit(flags) {
     }
   } else port = DEFAULT_PORT;
   const dataDir = typeof flags["data-dir"] === "string" ? flags["data-dir"] : void 0;
-  const password = typeof flags["password"] === "string" ? flags["password"] : process.env.WRONGSTACK_HQ_PASSWORD;
+  let password;
+  try {
+    password = await resolveHqPasswordInput({
+      ...typeof flags["password"] === "string" ? { explicitPassword: flags["password"] } : {}
+    });
+  } catch (cause) {
+    process.stderr.write(
+      `${color3.red("\u2717")} ${cause instanceof Error ? cause.message : String(cause)}
+`
+    );
+    return 1;
+  }
+  const bootstrapPasswordOnly = /^(?:1|true)$/i.test(
+    process.env.WRONGSTACK_HQ_BOOTSTRAP_PASSWORD_ONLY?.trim() ?? ""
+  );
+  let ipAllowlist;
+  try {
+    ipAllowlist = parseHqIpAllowlist(
+      typeof flags["hq-allowlist"] === "string" ? flags["hq-allowlist"] : process.env.WRONGSTACK_HQ_ALLOWLIST
+    );
+  } catch (cause) {
+    process.stderr.write(
+      `${color3.red("\u2717")} ${cause instanceof Error ? cause.message : String(cause)}
+`
+    );
+    return 1;
+  }
   if (password !== void 0 && password.length < 8) {
     process.stderr.write(`${color3.red("\u2717")} HQ password must be at least 8 characters.
 `);
     return 1;
   }
+  const rawTrustedProxyHops = typeof flags["hq-trusted-proxy-hops"] === "string" ? flags["hq-trusted-proxy-hops"] : process.env.WRONGSTACK_HQ_TRUSTED_PROXY_HOPS;
+  let trustedProxyHops;
+  if (rawTrustedProxyHops !== void 0 && rawTrustedProxyHops.trim() !== "") {
+    const parsed = Number.parseInt(rawTrustedProxyHops, 10);
+    if (!Number.isFinite(parsed) || parsed < 0 || String(parsed) !== rawTrustedProxyHops.trim()) {
+      process.stderr.write(
+        `${color3.red("\u2717")} --hq-trusted-proxy-hops must be a non-negative integer.
+`
+      );
+      return 1;
+    }
+    trustedProxyHops = parsed;
+  }
   const userProvidedPort = typeof flags["port"] === "string" && flags["port"].trim() !== "" || port !== DEFAULT_PORT;
   const resolvedDataDir = dataDir ?? resolveHqDataDir();
   const existing = await isHqAlreadyRunning(resolvedDataDir);
@@ -849,11 +928,14 @@ async function handleHqShortCircuit(flags) {
       strictPort: flags["strict-port"] === true,
       exactPort: userProvidedPort,
       allowInsecureOpen: flags["insecure-open"] === true,
-      secureCookies: tunnelRequested,
-      requireBrowserAuth: tunnelRequested,
+      secureCookies: externallyPublished,
+      requireBrowserAuth: externallyPublished,
       ...dataDir !== void 0 ? { dataDir } : {},
       ...password !== void 0 ? { password } : {},
-      ...tokenTtlMs !== void 0 ? { tokenTtlMs } : {}
+      ...bootstrapPasswordOnly ? { bootstrapPasswordOnly: true } : {},
+      ...tokenTtlMs !== void 0 ? { tokenTtlMs } : {},
+      ...trustedProxyHops !== void 0 ? { trustedProxyHops } : {},
+      ...ipAllowlist !== void 0 ? { ipAllowlist } : {}
     });
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
@@ -868,8 +950,24 @@ async function handleHqShortCircuit(flags) {
     }
     return 1;
   }
+  if (publicOrigin !== void 0) {
+    if (handle.firstRunSetup?.passwordMode !== true) {
+      await handle.close();
+      process.stderr.write(
+        `${color3.red("\u2717")} Persistent public HQ requires password mode. Set WRONGSTACK_HQ_PASSWORD and retry.
+`
+      );
+      return 1;
+    }
+    handle.trustPublicOrigin(publicOrigin);
+    process.stdout.write(`
+${color3.green("Persistent HQ origin ready:")} ${publicOrigin}/
+`);
+    process.stdout.write(`${color3.green("Mobile:")} ${publicOrigin}/mobile
+`);
+  }
   let tunnel;
-  let browserUrl = handle.firstRunSetup?.browserUrl ?? `http://${handle.host}:${handle.port}`;
+  let browserUrl = publicOrigin ?? handle.firstRunSetup?.browserUrl ?? `http://${handle.host}:${handle.port}`;
   if (tunnelRequested) {
     if (handle.firstRunSetup !== void 0 && !handle.firstRunSetup.browserTokenMode && !handle.firstRunSetup.passwordMode) {
       await handle.close();
@@ -894,6 +992,12 @@ async function handleHqShortCircuit(flags) {
       );
       process.stdout.write(`
 ${color3.green("Cloudflare Quick Tunnel ready:")} ${browserUrl}
+`);
+      const tunnelMobileUrl = new URL(tunnel.url);
+      tunnelMobileUrl.pathname = "/mobile";
+      tunnelMobileUrl.search = "";
+      tunnelMobileUrl.hash = "";
+      process.stdout.write(`${color3.green("Mobile:")} ${tunnelMobileUrl.toString()}
 `);
       process.stdout.write(
         `${color3.dim("Temporary development URL; DNS may need a few seconds, it changes on restart and ends when HQ stops.")}
@@ -3128,4 +3232,4 @@ async function initializeCli(argv) {
 export {
   initializeCli
 };
-//# sourceMappingURL=cli-context-Q6QP534K.js.map
+//# sourceMappingURL=cli-context-BYKJDAFF.js.map