@wrongstack/cli 1.0.3 → 1.0.6

package/dist/hq-service-L5INQFM4.js

@@ -0,0 +1,507 @@
+import {
+  resolveHqPasswordInput
+} from "./chunk-AUQDGU5D.js";
+import {
+  detectUpdatePackageManager,
+  detectUpdatePackageName
+} from "./chunk-DE7BZDNK.js";
+import "./chunk-U3SS4NRH.js";
+import "./chunk-YLQEGYV4.js";
+
+// src/hq-service.ts
+import { spawn } from "node:child_process";
+import { constants as fsConstants } from "node:fs";
+import * as fs from "node:fs/promises";
+import * as path from "node:path";
+import { buildChildEnv } from "@wrongstack/core/utils";
+var SERVICE_NAME = "wrongstack-hq.service";
+var UPDATE_SERVICE_NAME = "wrongstack-hq-update.service";
+var UPDATE_TIMER_NAME = "wrongstack-hq-update.timer";
+var SYSTEMD_DIR = "/etc/systemd/system";
+var ENV_DIR = "/etc/wrongstack";
+var ENV_FILE = `${ENV_DIR}/hq.env`;
+var UPDATE_SCRIPT = "/usr/local/libexec/wrongstack-hq-update";
+var MANAGED_MARKER = "Managed by WrongStack HQ service installer";
+function unitQuote(value) {
+  if (/[\r\n\0]/.test(value)) throw new Error("systemd values cannot contain line breaks or NUL");
+  return `"${value.replaceAll("%", "%%").replaceAll("\\", "\\\\").replaceAll('"', '\\"')}"`;
+}
+function envQuote(value) {
+  if (/[\r\n\0]/.test(value))
+    throw new Error("HQ service secrets cannot contain line breaks or NUL");
+  return `"${value.replaceAll("\\", "\\\\").replaceAll('"', '\\"')}"`;
+}
+function shellQuote(value) {
+  if (/\0/.test(value)) throw new Error("shell values cannot contain NUL");
+  return `'${value.replaceAll("'", `'"'"'`)}'`;
+}
+function renderHqServiceAssets(options) {
+  const bindHost = options.publicOrigin ? "127.0.0.1" : "0.0.0.0";
+  const execStart = [
+    unitQuote(options.wstackBin),
+    "hq",
+    "serve",
+    "--host",
+    bindHost,
+    "--port",
+    String(options.port),
+    "--strict-port"
+  ].join(" ");
+  const service = `# ${MANAGED_MARKER}
+[Unit]
+Description=WrongStack HQ command center
+Documentation=https://github.com/WrongStack/WrongStack
+Wants=network-online.target
+After=network-online.target
+StartLimitIntervalSec=0
+
+[Service]
+Type=simple
+DynamicUser=yes
+StateDirectory=wrongstack-hq
+StateDirectoryMode=0700
+WorkingDirectory=/var/lib/wrongstack-hq
+Environment=NODE_ENV=production
+Environment=HOME=/var/lib/wrongstack-hq
+Environment=WRONGSTACK_HOME=/var/lib/wrongstack-hq
+Environment=WRONGSTACK_HQ_DATA_DIR=/var/lib/wrongstack-hq/hq
+Environment=WRONGSTACK_HQ_SUPPRESS_STARTUP_SECRETS=1
+EnvironmentFile=${ENV_FILE}
+ExecStartPre=/usr/bin/test -x ${unitQuote(options.wstackBin)}
+ExecStart=${execStart}
+Restart=always
+RestartSec=5s
+TimeoutStopSec=30s
+KillSignal=SIGTERM
+StandardOutput=journal
+StandardError=journal
+SyslogIdentifier=wrongstack-hq
+UMask=0077
+NoNewPrivileges=yes
+PrivateTmp=yes
+PrivateDevices=yes
+ProtectSystem=strict
+ProtectHome=yes
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectControlGroups=yes
+RestrictSUIDSGID=yes
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+
+[Install]
+WantedBy=multi-user.target
+`;
+  const updateService = `# ${MANAGED_MARKER}
+[Unit]
+Description=Safely update WrongStack HQ
+Documentation=https://github.com/WrongStack/WrongStack
+Wants=network-online.target
+After=network-online.target
+
+[Service]
+Type=oneshot
+User=root
+CacheDirectory=wrongstack-hq-update
+Environment=HOME=/var/cache/wrongstack-hq-update
+ExecStart=${UPDATE_SCRIPT}
+Nice=10
+IOSchedulingClass=best-effort
+IOSchedulingPriority=7
+NoNewPrivileges=yes
+PrivateTmp=yes
+PrivateDevices=yes
+ProtectHome=yes
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectControlGroups=yes
+RestrictSUIDSGID=yes
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+`;
+  const updateTimer = `# ${MANAGED_MARKER}
+[Unit]
+Description=Daily WrongStack HQ self-update check
+
+[Timer]
+OnBootSec=15min
+OnCalendar=*-*-* 04:17:00
+RandomizedDelaySec=1h
+Persistent=true
+Unit=${UPDATE_SERVICE_NAME}
+
+[Install]
+WantedBy=timers.target
+`;
+  const rollback = options.packageManager === "pnpm" ? `${shellQuote(options.packageManager)} add -g --ignore-scripts "${options.packageName}@$PREVIOUS_VERSION"` : `${shellQuote(options.packageManager)} install -g --ignore-scripts "${options.packageName}@$PREVIOUS_VERSION"`;
+  const packageManagerEnvironment = options.packageManager === "pnpm" ? `export PNPM_HOME=${shellQuote(path.dirname(options.wstackBin))}
+` : "";
+  const updateScript = `#!/bin/sh
+# ${MANAGED_MARKER}
+set -eu
+
+WSTACK_BIN=${shellQuote(options.wstackBin)}
+PACKAGE_MANAGER=${shellQuote(options.packageManager)}
+SERVICE=${shellQuote(SERVICE_NAME)}
+export PATH=${shellQuote(`${path.dirname(options.wstackBin)}:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin`)}
+${packageManagerEnvironment}
+
+version_of() {
+  "$WSTACK_BIN" --version 2>/dev/null | sed -n 's/^WrongStack \\([^ ]*\\).*/\\1/p' | head -n 1
+}
+
+CHECK_OUTPUT=$("$WSTACK_BIN" update --check-only --pm "$PACKAGE_MANAGER") || {
+  printf '%s\\n' "$CHECK_OUTPUT" >&2
+  exit 1
+}
+printf '%s\\n' "$CHECK_OUTPUT"
+if ! printf '%s\\n' "$CHECK_OUTPUT" | grep -q '^Update available:'; then
+  exit 0
+fi
+
+PREVIOUS_VERSION=$(version_of)
+if [ -z "$PREVIOUS_VERSION" ] || [ "$PREVIOUS_VERSION" = "dev" ]; then
+  echo "Cannot determine an installed release version; refusing unattended update." >&2
+  exit 1
+fi
+
+SERVICE_STOPPED=0
+ensure_started() {
+  if [ "$SERVICE_STOPPED" -eq 1 ]; then
+    systemctl start "$SERVICE" || true
+  fi
+}
+trap ensure_started EXIT INT TERM
+
+systemctl stop "$SERVICE"
+SERVICE_STOPPED=1
+if ! "$WSTACK_BIN" update --pm "$PACKAGE_MANAGER"; then
+  echo "Update failed; reinstalling WrongStack $PREVIOUS_VERSION." >&2
+  ${rollback}
+  exit 1
+fi
+
+UPDATED_VERSION=$(version_of)
+if [ -z "$UPDATED_VERSION" ] || [ "$UPDATED_VERSION" = "$PREVIOUS_VERSION" ]; then
+  echo "Updated binary did not report a new release; rolling back." >&2
+  ${rollback}
+  exit 1
+fi
+
+systemctl start "$SERVICE"
+SERVICE_STOPPED=0
+sleep 10
+if ! systemctl is-active --quiet "$SERVICE"; then
+  echo "Updated HQ did not stay active; rolling back to $PREVIOUS_VERSION." >&2
+  systemctl stop "$SERVICE" || true
+  SERVICE_STOPPED=1
+  ${rollback}
+  systemctl start "$SERVICE"
+  SERVICE_STOPPED=0
+  sleep 5
+  systemctl is-active --quiet "$SERVICE"
+  exit 1
+fi
+
+echo "WrongStack HQ updated: $PREVIOUS_VERSION -> $UPDATED_VERSION"
+`;
+  const environment = [
+    `# ${MANAGED_MARKER}`,
+    `WRONGSTACK_HQ_PASSWORD=${envQuote(options.password)}`,
+    "WRONGSTACK_HQ_BOOTSTRAP_PASSWORD_ONLY=1",
+    ...options.publicOrigin ? [`WRONGSTACK_HQ_PUBLIC_URL=${envQuote(options.publicOrigin)}`] : [],
+    ...options.ipAllowlist ? [`WRONGSTACK_HQ_ALLOWLIST=${envQuote(options.ipAllowlist)}`] : []
+  ].join("\n");
+  return { service, updateService, updateTimer, updateScript, environment: `${environment}
+` };
+}
+async function runCommand(command, args) {
+  return await new Promise((resolve2, reject) => {
+    const child = spawn(command, args, {
+      stdio: "pipe",
+      windowsHide: true,
+      env: buildChildEnv()
+    });
+    let stdout = "";
+    let stderr = "";
+    child.stdout?.on("data", (chunk) => {
+      stdout += String(chunk);
+    });
+    child.stderr?.on("data", (chunk) => {
+      stderr += String(chunk);
+    });
+    child.on("error", reject);
+    child.on("close", (code) => resolve2({ code, stdout, stderr }));
+  });
+}
+async function systemctl(args, allowFailure = false) {
+  const result = await runCommand("systemctl", args);
+  if (!allowFailure && result.code !== 0) {
+    throw new Error(result.stderr.trim() || `systemctl ${args.join(" ")} failed`);
+  }
+  return result;
+}
+async function writeManagedFile(file, content, mode) {
+  const temporary = `${file}.tmp-${process.pid}`;
+  await fs.writeFile(temporary, content, { encoding: "utf8", mode });
+  await fs.chmod(temporary, mode);
+  await fs.rename(temporary, file);
+}
+async function hasForeignManagedTarget(file) {
+  try {
+    const content = await fs.readFile(file, "utf8");
+    return !content.includes(MANAGED_MARKER);
+  } catch (cause) {
+    return cause.code !== "ENOENT";
+  }
+}
+async function findExecutable(name) {
+  for (const directory of (process.env.PATH ?? "").split(path.delimiter)) {
+    if (!directory || !path.isAbsolute(directory)) continue;
+    const candidate = path.join(directory, name);
+    try {
+      await fs.access(candidate, fsConstants.X_OK);
+      return candidate;
+    } catch {
+    }
+  }
+  return void 0;
+}
+async function findSystemExecutable(name) {
+  for (const directory of ["/usr/local/bin", "/usr/bin", "/bin"]) {
+    const candidate = path.join(directory, name);
+    try {
+      await fs.access(candidate, fsConstants.X_OK);
+      return candidate;
+    } catch {
+    }
+  }
+  return void 0;
+}
+function requireLinuxRoot(deps) {
+  if (process.platform !== "linux") {
+    deps.renderer.writeError("HQ system service management is supported only on Linux/systemd.\n");
+    return false;
+  }
+  if (process.getuid?.() !== 0) {
+    deps.renderer.writeError("Run this command as root (for example with sudo).\n");
+    return false;
+  }
+  return true;
+}
+function serviceHelp(deps) {
+  deps.renderer.write(
+    "Usage:\n  sudo -E wstack hq service install [--port 3499] [--pm npm|pnpm] [--no-auto-update]\n  wstack hq service status\n  sudo wstack hq service update\n  sudo wstack hq service uninstall\n\nInstall requires WRONGSTACK_HQ_PASSWORD (minimum 8 characters).\nOptions: --port <n>, --hq-allowlist <ip,cidr,...>, --pm npm|pnpm, --wstack-bin <path>, --no-auto-update, --force.\n"
+  );
+}
+async function installService(deps) {
+  if (!requireLinuxRoot(deps)) return 1;
+  let password;
+  try {
+    password = await resolveHqPasswordInput();
+  } catch (cause) {
+    deps.renderer.writeError(`${cause instanceof Error ? cause.message : String(cause)}
+`);
+    return 1;
+  }
+  if (!password || password.length < 8) {
+    deps.renderer.writeError(
+      "Set WRONGSTACK_HQ_PASSWORD to at least 8 characters; it will be stored root-only.\n"
+    );
+    return 1;
+  }
+  const portValue = deps.flags?.["port"];
+  const port = typeof portValue === "string" ? Number(portValue) : 3499;
+  if (!Number.isSafeInteger(port) || port < 1 || port > 65535) {
+    deps.renderer.writeError("--port must be an integer between 1 and 65535.\n");
+    return 1;
+  }
+  const requestedManager = deps.flags?.["pm"] ?? deps.flags?.["package-manager"];
+  const detectedManager = typeof requestedManager === "string" ? requestedManager : detectUpdatePackageManager();
+  if (detectedManager !== "npm" && detectedManager !== "pnpm") {
+    deps.renderer.writeError("HQ unattended updates support --pm npm or --pm pnpm.\n");
+    return 1;
+  }
+  if (!await findSystemExecutable(detectedManager)) {
+    deps.renderer.writeError(
+      `Could not find system-wide ${detectedManager}; unattended root updates cannot use a home-directory shim.
+`
+    );
+    return 1;
+  }
+  const explicitBin = deps.flags?.["wstack-bin"];
+  const wstackBin = typeof explicitBin === "string" ? path.resolve(explicitBin) : await findExecutable("wstack");
+  if (!wstackBin) {
+    deps.renderer.writeError("Could not find a global wstack executable in PATH.\n");
+    return 1;
+  }
+  const resolvedWstackBin = await fs.realpath(wstackBin).catch(() => wstackBin);
+  if (resolvedWstackBin === "/root" || resolvedWstackBin.startsWith("/root/") || resolvedWstackBin.startsWith("/home/")) {
+    deps.renderer.writeError(
+      "The HQ system service requires a system-wide wstack executable outside /root and /home. Install with `sudo npm install -g wrongstack` and retry.\n"
+    );
+    return 1;
+  }
+  const publicOriginValue = typeof deps.flags?.["hq-public-url"] === "string" ? deps.flags["hq-public-url"] : process.env.WRONGSTACK_HQ_PUBLIC_URL;
+  let publicOrigin;
+  if (publicOriginValue) {
+    try {
+      const parsed = new URL(publicOriginValue);
+      if (parsed.protocol !== "https:" || parsed.origin !== publicOriginValue.replace(/\/$/, "")) {
+        throw new Error("not an exact HTTPS origin");
+      }
+      publicOrigin = parsed.origin;
+    } catch {
+      deps.renderer.writeError("--hq-public-url must be an exact HTTPS origin.\n");
+      return 1;
+    }
+  }
+  const allowlistValue = typeof deps.flags?.["hq-allowlist"] === "string" ? deps.flags["hq-allowlist"] : process.env.WRONGSTACK_HQ_ALLOWLIST;
+  let ipAllowlist;
+  if (allowlistValue !== void 0 && allowlistValue.trim() !== "") {
+    try {
+      const { parseHqIpAllowlist } = await import("./ip-allowlist-NHXO6AKJ.js");
+      ipAllowlist = parseHqIpAllowlist(allowlistValue)?.join(",");
+    } catch (cause) {
+      deps.renderer.writeError(`${cause instanceof Error ? cause.message : String(cause)}
+`);
+      return 1;
+    }
+  }
+  const assets = renderHqServiceAssets({
+    wstackBin,
+    packageManager: detectedManager,
+    packageName: detectUpdatePackageName(),
+    password,
+    port,
+    ...publicOrigin ? { publicOrigin } : {},
+    ...ipAllowlist ? { ipAllowlist } : {}
+  });
+  try {
+    await fs.access("/run/systemd/system");
+    const systemd = await systemctl(["--version"], true);
+    if (systemd.code !== 0) throw new Error("systemctl is not operational");
+  } catch {
+    deps.renderer.writeError("This host is not running systemd; no service files were written.\n");
+    return 1;
+  }
+  const managedTargets = [
+    `${SYSTEMD_DIR}/${SERVICE_NAME}`,
+    `${SYSTEMD_DIR}/${UPDATE_SERVICE_NAME}`,
+    `${SYSTEMD_DIR}/${UPDATE_TIMER_NAME}`,
+    UPDATE_SCRIPT,
+    ENV_FILE
+  ];
+  if (deps.flags?.["force"] !== true) {
+    const foreign = [];
+    for (const file of managedTargets) {
+      if (await hasForeignManagedTarget(file)) foreign.push(file);
+    }
+    if (foreign.length > 0) {
+      deps.renderer.writeError(
+        `Refusing to overwrite files not managed by WrongStack:
+${foreign.map((file) => `  ${file}`).join("\n")}
+Use --force only after reviewing them.
+`
+      );
+      return 1;
+    }
+  }
+  await fs.mkdir(ENV_DIR, { recursive: true, mode: 448 });
+  await fs.mkdir(path.dirname(UPDATE_SCRIPT), { recursive: true, mode: 493 });
+  await writeManagedFile(ENV_FILE, assets.environment, 384);
+  await writeManagedFile(`${SYSTEMD_DIR}/${SERVICE_NAME}`, assets.service, 420);
+  await writeManagedFile(`${SYSTEMD_DIR}/${UPDATE_SERVICE_NAME}`, assets.updateService, 420);
+  await writeManagedFile(`${SYSTEMD_DIR}/${UPDATE_TIMER_NAME}`, assets.updateTimer, 420);
+  await writeManagedFile(UPDATE_SCRIPT, assets.updateScript, 493);
+  await systemctl(["daemon-reload"]);
+  await systemctl(["enable", SERVICE_NAME]);
+  await systemctl(["restart", SERVICE_NAME]);
+  if (deps.flags?.["no-auto-update"] === true) {
+    await systemctl(["disable", "--now", UPDATE_TIMER_NAME], true);
+  } else {
+    await systemctl(["enable", "--now", UPDATE_TIMER_NAME]);
+  }
+  deps.renderer.write(
+    `Installed ${SERVICE_NAME}; listening on ${publicOrigin ? "127.0.0.1" : "0.0.0.0"}:${port}, boot persistence and automatic restart are active.
+` + (ipAllowlist ? `Network allowlist is active (${ipAllowlist.split(",").length} configured rules + loopback).
+` : "Network allowlist is disabled; password authentication remains active.\n") + (deps.flags?.["no-auto-update"] === true ? "Automatic updates are disabled.\n" : `Automatic updates are scheduled by ${UPDATE_TIMER_NAME}.
+`)
+  );
+  return 0;
+}
+async function uninstallService(deps) {
+  if (!requireLinuxRoot(deps)) return 1;
+  const targets = [
+    `${SYSTEMD_DIR}/${SERVICE_NAME}`,
+    `${SYSTEMD_DIR}/${UPDATE_SERVICE_NAME}`,
+    `${SYSTEMD_DIR}/${UPDATE_TIMER_NAME}`,
+    UPDATE_SCRIPT
+  ];
+  const timerIsForeign = await hasForeignManagedTarget(`${SYSTEMD_DIR}/${UPDATE_TIMER_NAME}`);
+  const serviceIsForeign = await hasForeignManagedTarget(`${SYSTEMD_DIR}/${SERVICE_NAME}`);
+  if (!timerIsForeign) await systemctl(["disable", "--now", UPDATE_TIMER_NAME], true);
+  if (!serviceIsForeign) await systemctl(["disable", "--now", SERVICE_NAME], true);
+  const preserved = [];
+  for (const file of targets) {
+    if (await hasForeignManagedTarget(file)) {
+      preserved.push(file);
+      continue;
+    }
+    await fs.rm(file, { force: true });
+  }
+  await systemctl(["daemon-reload"]);
+  deps.renderer.write(
+    `Removed WrongStack-managed HQ systemd files. Data and ${ENV_FILE} were preserved.
+`
+  );
+  if (preserved.length > 0) {
+    deps.renderer.write(
+      `Preserved files not managed by WrongStack:
+${preserved.map((file) => `  ${file}`).join("\n")}
+`
+    );
+  }
+  return 0;
+}
+var hqServiceCmd = async (args, deps) => {
+  const action = args[0];
+  if (deps.flags?.["help"] === true || action === "help" || !action) {
+    serviceHelp(deps);
+    return 0;
+  }
+  try {
+    if (action === "install") return await installService(deps);
+    if (action === "uninstall") return await uninstallService(deps);
+    if (action === "update") {
+      if (!requireLinuxRoot(deps)) return 1;
+      const result = await systemctl(["start", UPDATE_SERVICE_NAME]);
+      if (result.stdout) deps.renderer.write(result.stdout);
+      deps.renderer.write("HQ update check completed.\n");
+      return 0;
+    }
+    if (action === "status") {
+      if (process.platform !== "linux") {
+        deps.renderer.writeError("HQ system service status is supported only on Linux/systemd.\n");
+        return 1;
+      }
+      const result = await systemctl(
+        ["status", SERVICE_NAME, UPDATE_TIMER_NAME, "--no-pager"],
+        true
+      );
+      deps.renderer.write(result.stdout || result.stderr);
+      return result.code ?? 1;
+    }
+  } catch (cause) {
+    deps.renderer.writeError(`${cause instanceof Error ? cause.message : String(cause)}
+`);
+    return 1;
+  }
+  deps.renderer.writeError(`Unknown HQ service action: ${action}
+`);
+  serviceHelp(deps);
+  return 1;
+};
+export {
+  hqServiceCmd,
+  renderHqServiceAssets
+};
+//# sourceMappingURL=hq-service-L5INQFM4.js.map

package/dist/hq-service.d.ts

@@ -0,0 +1,22 @@
+import type { SubcommandHandler } from './subcommands/contracts.js';
+type ServerPackageManager = 'npm' | 'pnpm';
+export interface HqServiceAssets {
+    service: string;
+    updateService: string;
+    updateTimer: string;
+    updateScript: string;
+    environment: string;
+}
+export interface HqServiceAssetOptions {
+    wstackBin: string;
+    packageManager: ServerPackageManager;
+    packageName: 'wrongstack' | '@wrongstack/cli';
+    password: string;
+    port: number;
+    publicOrigin?: string | undefined;
+    ipAllowlist?: string | undefined;
+}
+export declare function renderHqServiceAssets(options: HqServiceAssetOptions): HqServiceAssets;
+export declare const hqServiceCmd: SubcommandHandler;
+export {};
+//# sourceMappingURL=hq-service.d.ts.map

package/dist/index.js

@@ -2,13 +2,13 @@
 import {
   applyNodeEnvDefault,
   applySessionShellDefault
-} from "./chunk-O4A3HHKD.js";
+} from "./chunk-672UXYL3.js";
 import {
   CLI_VERSION
 } from "./chunk-XJXDOF63.js";
 import {
   parseArgs
-} from "./chunk-E6RFXHWD.js";
+} from "./chunk-EK2P53GL.js";
 
 // src/cli-entry-main.ts
 async function main(argv) {
@@ -16,20 +16,21 @@ async function main(argv) {
   applySessionShellDefault();
   const earlyFlags = parseArgs(argv).flags;
   if (earlyFlags["help"] === true || earlyFlags["version"] === true) {
-    const { handleHelpVersionShortCircuit } = await import("./short-circuit-flags-ZNZX44MC.js");
+    const { handleHelpVersionShortCircuit } = await import("./short-circuit-flags-KBTYSJTW.js");
     const earlyExit = await handleHelpVersionShortCircuit(argv);
     if (earlyExit !== null) return earlyExit;
   }
-  const { initializeCli } = await import("./cli-context-Q6QP534K.js");
+  const { initializeCli } = await import("./cli-context-BYKJDAFF.js");
   const cliCtx = await initializeCli(argv);
   if (typeof cliCtx === "number") return cliCtx;
-  const { runInteractive } = await import("./cli-main-JQXCDZEA.js");
+  const { runInteractive } = await import("./cli-main-5WZBH3WA.js");
   return runInteractive(cliCtx);
 }
 
 // src/cli-entry-point.ts
 import { resolve } from "node:path";
 import { pathToFileURL } from "node:url";
+import { scrubErrorText } from "@wrongstack/core/security";
 import { installCrashShield, runFatalSalvageSync, writeErr } from "@wrongstack/core/utils";
 var SQLITE_WARNING_RE = /sqlite is an experimental feature/i;
 function installSqliteWarningFilter() {
@@ -128,7 +129,9 @@ function runAsMain(mainFn) {
     },
     (err) => {
       runFatalSalvageSync();
-      writeErr((err instanceof Error ? err.stack : String(err)) + "\n");
+      writeErr(
+        scrubErrorText(err instanceof Error ? err.stack ?? err.message : String(err)) + "\n"
+      );
       process.exitCode = 1;
       scheduleForcedExit(1);
     }

package/dist/ip-allowlist-NHXO6AKJ.js

@@ -0,0 +1,9 @@
+import {
+  createHqIpAllowlist,
+  parseHqIpAllowlist
+} from "./chunk-Q7E3BPDU.js";
+export {
+  createHqIpAllowlist,
+  parseHqIpAllowlist
+};
+//# sourceMappingURL=ip-allowlist-NHXO6AKJ.js.map

package/dist/live-settings-input.d.ts

@@ -67,6 +67,8 @@ export interface LiveSettingsInput {
     cacheTtl?: 'default' | '5m' | '1h' | undefined;
     /** Show "Model Reasoning" blocks in chat history. Default: true. */
     showModelReasoning?: boolean | undefined;
+    /** Default presentation density for committed TUI tool results. */
+    toolResultViewMode?: 'minimal' | 'normal' | 'full' | undefined;
     /** Agent swarm panel placement: 'bottom' (lower region), 'sidebar' (right sidebar), or 'off' (hidden).
      * Backward-compat: legacy boolean values are coerced by the TUI settings adapter. Default: 'bottom'. */
     showAgentSwarmPanel?: 'bottom' | 'sidebar' | 'off' | boolean | undefined;

package/dist/{mcp-HOMLC4WE.js → mcp-FX7TKPTV.js}

@@ -23,7 +23,11 @@ import { pathToFileURL } from "node:url";
 import { Context } from "@wrongstack/core/agent";
 import { ToolExecutor } from "@wrongstack/core/execution";
 import { ToolRegistry } from "@wrongstack/core/registry";
-import { AutoApprovePermissionPolicy, DefaultSecretScrubber } from "@wrongstack/core/security";
+import {
+  AutoApprovePermissionPolicy,
+  DefaultSecretScrubber,
+  ToolCapabilities
+} from "@wrongstack/core/security";
 import { normalizeTokenSavingTier } from "@wrongstack/core/types";
 import {
   DEFAULT_MCP_INSERTION_MAX_BYTES,
@@ -33,11 +37,9 @@ import {
 } from "@wrongstack/mcp";
 import { registerBuiltinToolTier } from "@wrongstack/tools/tool-tier";
 import { wireKanbanPorts } from "@wrongstack/runtime";
-var AllowAllPermissionPolicy = class extends AutoApprovePermissionPolicy {
-  async evaluate() {
-    return { permission: "auto", source: "default" };
-  }
-};
+function yoloServePolicy() {
+  return new AutoApprovePermissionPolicy(Object.values(ToolCapabilities));
+}
 function parseToolsFlag(flags, positional) {
   const raw = flags["tools"];
   const csv = typeof raw === "string" ? raw : raw === true ? positional?.[0] ?? "" : "";
@@ -226,7 +228,7 @@ async function serveMcpStdio(deps, positional) {
     controller.signal,
     resolveServeFsRestriction(deps.config)
   );
-  const permissionPolicy = yolo ? new AllowAllPermissionPolicy() : new AutoApprovePermissionPolicy();
+  const permissionPolicy = yolo ? yoloServePolicy() : new AutoApprovePermissionPolicy();
   const executor = new ToolExecutor(registry, {
     permissionPolicy,
     secretScrubber: new DefaultSecretScrubber(),
@@ -440,4 +442,4 @@ function isRecord(value) {
 export {
   mcpCmd
 };
-//# sourceMappingURL=mcp-HOMLC4WE.js.map
+//# sourceMappingURL=mcp-FX7TKPTV.js.map

package/dist/mcp-serve.d.ts

@@ -1,8 +1,39 @@
 import { Context } from '@wrongstack/core/agent';
 import { ToolRegistry } from '@wrongstack/core/registry';
+import { AutoApprovePermissionPolicy } from '@wrongstack/core/security';
 import type { PermissionPolicy, Tool } from '@wrongstack/core/types';
 import { type MCPServerPrompt, type MCPServerResource } from '@wrongstack/mcp';
 import type { SubcommandDeps } from './subcommands/contracts.js';
+/**
+ * `--yolo` for `mcp serve`: widen the CAPABILITY allowlist, keep every guard.
+ *
+ * This replaced an `AllowAllPermissionPolicy extends AutoApprovePermissionPolicy`
+ * whose `evaluate()` returned `{ permission: 'auto' }` unconditionally. That
+ * override skipped the whole base implementation — the sensitive-read denial,
+ * the leader deny rules, the destructive-command classifier, the agent-state
+ * write guard, and `LOCKED_DESTRUCTIVE_KINDS`. It was the only place in the
+ * codebase where `agent-state` and `credential-bind` could be un-gated, so a
+ * third-party MCP client could have written `hooks` into config.json (boot-time
+ * RCE) or `auto: true` into trust.json.
+ *
+ * It did not actually get there — but only by accident, and the accident is the
+ * reason this is a rewrite rather than a patch. The override returned
+ * `source: 'default'` where the base class returns `source: 'yolo'`, so
+ * `ToolExecutor.capabilityDowngraded` re-armed and forced `confirm`; `mcp serve`
+ * has no confirmAwaiter, so the call hard-errored. Changing that one string
+ * literal to `'yolo'` — which reads as a trivial consistency cleanup — would
+ * have made the bypass live. Safety must not rest on a string nobody knows is
+ * load-bearing.
+ *
+ * Granting every capability is what `--yolo` actually means, and it is what
+ * lets `ToolExecutor` trust an `auto` instead of downgrading it (see the
+ * `dangerousNotAllowed` reasoning in `auto-approve-policy.ts`). The destructive
+ * classifier is deliberately NOT relaxed: `yoloConfirmKinds` is left at its
+ * default, which gates every destructive kind. Destructive calls therefore
+ * still require a confirmation this surface cannot answer, exactly as before —
+ * this change removes a latent bypass without widening anything.
+ */
+export declare function yoloServePolicy(): AutoApprovePermissionPolicy;
 /**
  * Resolve the `--tools` whitelist for `mcp serve`.
  *