@wrongstack/cli 1.0.4 → 1.0.6

package/dist/{acp-AB54FWM2.js → acp-GOQURNC2.js}

@@ -649,13 +649,16 @@ async function runACPWebSocketServer(deps, port) {
   const acpToken = process.env["WRONGSTACK_ACP_TOKEN"]?.trim() || randomBytes(32).toString("hex");
   const gate = createAcpConnectionGate({ host, port, token: acpToken });
   let liveConnections = 0;
-  const wss = new WebSocketServer({ host, port, maxPayload: 20 * 1024 * 1024 });
-  wss.on("connection", (socket, req) => {
-    const verdict = gate.check(req, liveConnections);
-    if (!verdict.ok) {
-      socket.close(verdict.code ?? 1008, verdict.reason ?? "forbidden");
+  const verifyClient = (info, cb) => {
+    const verdict = gate.check(info.req, liveConnections);
+    if (verdict.ok) {
+      cb(true);
       return;
     }
+    cb(false, 403, verdict.reason ?? "forbidden");
+  };
+  const wss = new WebSocketServer({ host, port, maxPayload: 20 * 1024 * 1024, verifyClient });
+  wss.on("connection", (socket) => {
     liveConnections++;
     socket.once("close", () => {
       liveConnections--;
@@ -1099,4 +1102,4 @@ ${renderAcpBenchText(result)}
 export {
   acpCmd
 };
-//# sourceMappingURL=acp-AB54FWM2.js.map
+//# sourceMappingURL=acp-GOQURNC2.js.map

package/dist/{auth-WDMSNZ3S.js → auth-WBXXIQUO.js}

@@ -14,7 +14,7 @@ import {
   runOAuthLoginKind,
   runOAuthLoginMenu,
   validateFamily
-} from "./chunk-ONOT5OJ2.js";
+} from "./chunk-5A5GCSJC.js";
 import {
   renderAuthLocalHelpToString,
   wantsLocalHelp
@@ -619,4 +619,4 @@ async function runAuthRemove(deps, providerId) {
 export {
   authCmd
 };
-//# sourceMappingURL=auth-WDMSNZ3S.js.map
+//# sourceMappingURL=auth-WBXXIQUO.js.map

package/dist/boot/short-circuit-desktop.d.ts

@@ -1,3 +1,4 @@
 export declare function stripDesktopLauncherArgs(argv: string[]): string[];
+export declare function selectDesktopLauncherExecutable(execPath: string, runningUnderBun: boolean, nodeOverride?: string): string;
 export declare function handleDesktopShortCircuit(flags: Record<string, string | boolean>, argv: string[]): Promise<number | null>;
 //# sourceMappingURL=short-circuit-desktop.d.ts.map

package/dist/{chunk-ONOT5OJ2.js → chunk-5A5GCSJC.js}

@@ -1813,4 +1813,4 @@ export {
   addCustomProvider,
   addKeyForProvider
 };
-//# sourceMappingURL=chunk-ONOT5OJ2.js.map
+//# sourceMappingURL=chunk-5A5GCSJC.js.map

package/dist/{chunk-I7V2OYVH.js → chunk-5EA6OTLJ.js}

@@ -16,6 +16,7 @@ import * as fs from "node:fs/promises";
 import * as os2 from "node:os";
 import * as path from "node:path";
 import { resolveHqDataDir } from "@wrongstack/core/hq";
+import { isSafeSessionId as coreIsSafeSessionId } from "@wrongstack/core/utils";
 import { sanitizeApiError, scrubErrorDetail } from "@wrongstack/core/security";
 var TRANSCRIPT_RING_MAX = 4e3;
 var MAX_TRANSCRIPT_SESSIONS = 400;
@@ -99,11 +100,7 @@ function isSafePathSegment(value) {
   return true;
 }
 function isSafeSessionId(value) {
-  if (value.length === 0 || value.length > MAX_PATH_SEGMENT_LENGTH) return false;
-  if (value.includes("\\") || value.includes("\0") || value.includes(":")) return false;
-  const parts = value.split("/");
-  if (parts.length > 2) return false;
-  return parts.every((p) => p.length > 0 && p !== "." && p !== "..");
+  return coreIsSafeSessionId(value);
 }
 function displayHost(host) {
   return host === "0.0.0.0" ? "127.0.0.1" : host;
@@ -239,4 +236,4 @@ export {
   recordTimeseriesSignal,
   sanitizeApiError
 };
-//# sourceMappingURL=chunk-I7V2OYVH.js.map
+//# sourceMappingURL=chunk-5EA6OTLJ.js.map

package/dist/{chunk-O4A3HHKD.js → chunk-672UXYL3.js}

@@ -1,6 +1,6 @@
 
 // src/preflight.ts
-import { ensureSessionShell } from "@wrongstack/tools";
+import { ensureSessionShell } from "@wrongstack/tools/session-shell";
 
 // src/cli-update-notice.ts
 import { writeErr } from "@wrongstack/core/utils";
@@ -62,4 +62,4 @@ export {
   applySessionShellDefault,
   runPreflight
 };
-//# sourceMappingURL=chunk-O4A3HHKD.js.map
+//# sourceMappingURL=chunk-672UXYL3.js.map

package/dist/{chunk-U6PGWDMZ.js → chunk-NR7BD73C.js}

@@ -22,7 +22,7 @@ async function handleHelpVersionShortCircuit(argv) {
   }
   if (earlyFlags["help"] === true) {
     if (positional.length > 0) {
-      const { subcommandNames } = await import("./subcommands-7N4RIK6H.js");
+      const { subcommandNames } = await import("./subcommands-DEYSYHIM.js");
       if (subcommandNames.includes(positional[0])) {
         const first = positional[0];
         const deep = positional[1];
@@ -43,4 +43,4 @@ async function handleHelpVersionShortCircuit(argv) {
 export {
   handleHelpVersionShortCircuit
 };
-//# sourceMappingURL=chunk-U6PGWDMZ.js.map
+//# sourceMappingURL=chunk-NR7BD73C.js.map

package/dist/{chunk-3I5ZJXM5.js → chunk-PQZPHGGD.js}

@@ -24,7 +24,7 @@ import {
   sanitizeApiError,
   truncateHqSummary,
   writeInvalidBody
-} from "./chunk-I7V2OYVH.js";
+} from "./chunk-5EA6OTLJ.js";
 import {
   createHqIpAllowlist
 } from "./chunk-Q7E3BPDU.js";
@@ -44,7 +44,7 @@ import {
   hqTokenKey as hqTokenKey2,
   isTokenExpired as isTokenExpired4,
   mintHqCookieSecret as mintHqCookieSecret2,
-  mutateHqAuthFile as mutateHqAuthFile3,
+  mutateHqAuthFile as mutateHqAuthFile4,
   toAlertMessage,
   watchHqAuthFile
 } from "@wrongstack/core/hq";
@@ -135,10 +135,15 @@ function hasTrustedRequestAuthority(req, boundHost, boundPort, trustedPublicOrig
     return false;
   }
 }
-function hasTrustedBrowserOrigin(req, boundHost, boundPort, trustedPublicOrigins = /* @__PURE__ */ new Set(), allowFileOrigin = false) {
+function hasTrustedBrowserOrigin(req, boundHost, boundPort, trustedPublicOrigins = /* @__PURE__ */ new Set(), allowFileOrigin = false, credentialedSurface = false) {
   if (!hasTrustedRequestAuthority(req, boundHost, boundPort, trustedPublicOrigins)) return false;
   const origin = req.headers.origin;
-  if (origin === void 0) return true;
+  if (origin === void 0) {
+    if (!credentialedSurface) {
+      return boundHost !== void 0 && isLoopbackHost(boundHost);
+    }
+    return true;
+  }
   try {
     const parsed = new URL(origin);
     if (parsed.protocol === "file:") return allowFileOrigin;
@@ -222,7 +227,7 @@ function isCookieAuth(auth) {
   return auth !== void 0 && auth.kind === "cookie";
 }
 function hqAuthRequired(mutableAuth, requireBrowserAuth) {
-  return requireBrowserAuth === true || mutableAuth.requireAuthFloor === true || mutableAuth.browserTokens.size > 0 || mutableAuth.passwordHash !== void 0;
+  return (requireBrowserAuth ?? mutableAuth.requireBrowserAuth) === true || mutableAuth.requireAuthFloor === true || mutableAuth.browserTokens.size > 0 || mutableAuth.passwordHash !== void 0;
 }
 function hqClientAuthRequired(mutableAuth) {
   return mutableAuth.requireAuthFloor === true || mutableAuth.clientTokens.size > 0;
@@ -364,7 +369,8 @@ function createHqAuthState(authFile, dataDir, opts = {}) {
     clientTokens: /* @__PURE__ */ new Set(),
     browserTokenObjs: /* @__PURE__ */ new Map(),
     clientTokenObjs: /* @__PURE__ */ new Map(),
-    alertRules: void 0
+    alertRules: void 0,
+    requireBrowserAuth: opts.requireBrowserAuth
   };
   projectAuthFile(mutableAuth, authFile);
   return {
@@ -727,7 +733,32 @@ async function serveHqStatic(_req, res, urlPath, distDir) {
 }
 
 // src/hq-server/routes/auth/common.ts
-import { isLoopbackHost as isLoopbackHost2 } from "@wrongstack/core/hq";
+import { isLoopbackHost as isLoopbackHost2, mutateHqAuthFile } from "@wrongstack/core/hq";
+import { verifyTotpCounter } from "@wrongstack/core/security";
+function recordVerifyFailure(loginAttempts, clientIp) {
+  const prev = loginAttempts.get(clientIp);
+  const count = (prev?.count ?? 0) + 1;
+  loginAttempts.recordFailure(clientIp);
+  return count;
+}
+async function consumeTotpCode(code, mutableAuth, dataDir, applyAuthFile) {
+  if (!mutableAuth.totpSecret) return "invalid";
+  const matchedCounter = verifyTotpCounter(code, mutableAuth.totpSecret);
+  if (matchedCounter === void 0) return "invalid";
+  if (mutableAuth.totpLastUsedCounter !== void 0 && matchedCounter <= mutableAuth.totpLastUsedCounter) {
+    return "replayed";
+  }
+  mutableAuth.totpLastUsedCounter = matchedCounter;
+  try {
+    const next = await mutateHqAuthFile(dataDir, (current) => ({
+      ...current,
+      totpLastUsedCounter: matchedCounter
+    }));
+    applyAuthFile(next);
+  } catch {
+  }
+  return "ok";
+}
 function isLoopbackRequest(req) {
   const address = req.socket.remoteAddress?.replace(/^::ffff:/, "");
   return address !== void 0 && isLoopbackHost2(address);
@@ -775,7 +806,8 @@ import { randomUUID } from "node:crypto";
 import {
   hashHqPassword,
   mintHqCookieSecret,
-  mutateHqAuthFile,
+  mutateHqAuthFile as mutateHqAuthFile2,
+  hqPasswordNeedsUpgrade,
   verifyHqPassword
 } from "@wrongstack/core/hq";
 
@@ -844,7 +876,7 @@ async function handleApiAuthStatus(req, res, url, mutableAuth, sessions, require
     })
   );
 }
-async function handleApiLogin(req, res, mutableAuth, sessions, loginAttempts, secureCookies, trustedProxyHops, sessionCapabilities) {
+async function handleApiLogin(req, res, mutableAuth, sessions, loginAttempts, secureCookies, trustedProxyHops, dataDir, sessionCapabilities) {
   if (!mutableAuth.passwordHash) {
     res.writeHead(403, { "Content-Type": "application/json" });
     res.end(
@@ -895,6 +927,14 @@ async function handleApiLogin(req, res, mutableAuth, sessions, loginAttempts, se
     return;
   }
   const ok = await verifyHqPassword(body.password, mutableAuth.passwordHash);
+  if (ok && hqPasswordNeedsUpgrade(mutableAuth.passwordHash)) {
+    try {
+      const upgraded = await hashHqPassword(body.password);
+      await mutateHqAuthFile2(dataDir, (current) => ({ ...current, passwordHash: upgraded }));
+      mutableAuth.passwordHash = upgraded;
+    } catch {
+    }
+  }
   if (!ok || !mutableAuth.cookieSecret) {
     loginAttempts.recordFailure(clientIp, body.password);
     res.writeHead(401, { "Content-Type": "application/json" });
@@ -953,7 +993,7 @@ async function handleApiLogout(req, res, mutableAuth, sessions, secureCookies) {
   res.writeHead(200, { "Content-Type": "application/json" });
   res.end(JSON.stringify({ loggedIn: false }));
 }
-async function handleApiPassword(req, res, mutableAuth, sessions, dataDir, secureCookies, requireBrowserAuth, applyAuthFile) {
+async function handleApiPassword(req, res, mutableAuth, sessions, dataDir, secureCookies, requireBrowserAuth, applyAuthFile, loginAttempts, trustedProxyHops) {
   const auth = authenticateBrowserRequest(
     req,
     new URL(req.url ?? "/", "http://localhost"),
@@ -993,21 +1033,43 @@ async function handleApiPassword(req, res, mutableAuth, sessions, dataDir, secur
     res.end(JSON.stringify({ error: { code: "BAD_REQUEST", message: "Invalid JSON body." } }));
     return;
   }
-  const hasAdminCapability = auth !== void 0 && "capabilities" in auth && auth.capabilities?.includes("auth.admin");
-  if (!localOpenBootstrap && mutableAuth.passwordHash !== void 0 && !hasAdminCapability) {
+  if (!localOpenBootstrap && mutableAuth.passwordHash !== void 0) {
+    const clientIp = resolveClientAddress(req, trustedProxyHops);
+    const { blocked, retryAfter } = loginAttempts.checkBlocked(clientIp);
+    if (blocked) {
+      res.writeHead(429, {
+        "Content-Type": "application/json",
+        "Retry-After": String(retryAfter)
+      });
+      res.end(
+        JSON.stringify({
+          error: { code: "RATE_LIMITED", message: "Too many attempts. Try again later." }
+        })
+      );
+      return;
+    }
     const currentPassword = typeof body.currentPassword === "string" ? body.currentPassword : "";
-    if (!currentPassword || !await verifyHqPassword(currentPassword, mutableAuth.passwordHash)) {
+    let confirmed = currentPassword.length > 0 && await verifyHqPassword(currentPassword, mutableAuth.passwordHash);
+    let replayed = false;
+    if (!confirmed && typeof body.code === "string" && mutableAuth.totpSecret) {
+      const outcome = await consumeTotpCode(body.code, mutableAuth, dataDir, applyAuthFile);
+      confirmed = outcome === "ok";
+      replayed = outcome === "replayed";
+    }
+    if (!confirmed) {
+      recordVerifyFailure(loginAttempts, clientIp);
       res.writeHead(403, { "Content-Type": "application/json" });
       res.end(
         JSON.stringify({
           error: {
-            code: "INVALID_CURRENT_PASSWORD",
-            message: "Current password is required to change or remove it."
+            code: replayed ? "TOTP_ALREADY_USED" : "INVALID_CURRENT_PASSWORD",
+            message: replayed ? "That authenticator code has already been used. Wait for the next one." : "Current password or a TOTP code is required to change or remove it."
           }
         })
       );
       return;
     }
+    loginAttempts.delete(clientIp);
   }
   if (req.method === "DELETE") {
     if (requireBrowserAuth && mutableAuth.browserTokens.size === 0) {
@@ -1022,7 +1084,7 @@ async function handleApiPassword(req, res, mutableAuth, sessions, dataDir, secur
       );
       return;
     }
-    const next2 = await mutateHqAuthFile(dataDir, (current) => {
+    const next2 = await mutateHqAuthFile2(dataDir, (current) => {
       const updated = { ...current };
       delete updated.passwordHash;
       delete updated.cookieSecret;
@@ -1059,7 +1121,7 @@ async function handleApiPassword(req, res, mutableAuth, sessions, dataDir, secur
   }
   const passwordHash = await hashHqPassword(newPassword);
   const cookieSecret = mintHqCookieSecret();
-  const next = await mutateHqAuthFile(dataDir, (current) => ({
+  const next = await mutateHqAuthFile2(dataDir, (current) => ({
     ...current,
     passwordHash,
     cookieSecret
@@ -1083,25 +1145,18 @@ async function handleApiPassword(req, res, mutableAuth, sessions, dataDir, secur
 
 // src/hq-server/routes/auth/totp-routes.ts
 import { randomUUID as randomUUID2 } from "node:crypto";
-import { mutateHqAuthFile as mutateHqAuthFile2, verifyHqPassword as verifyHqPassword2 } from "@wrongstack/core/hq";
+import { mutateHqAuthFile as mutateHqAuthFile3, verifyHqPassword as verifyHqPassword2 } from "@wrongstack/core/hq";
 import {
   buildOtpAuthUri,
   generateRecoveryCodes,
   generateTotpSecret,
   hashRecoveryCode,
   verifyRecoveryCode,
-  verifyTotp,
-  verifyTotpCounter
+  verifyTotp
 } from "@wrongstack/core/security";
 var PENDING_2FA_TTL_MS = 5 * 6e4;
 var recoveryCodeLock = Promise.resolve();
 var MAX_2FA_VERIFY_FAILURES = 5;
-function recordVerifyFailure(loginAttempts, clientIp) {
-  const prev = loginAttempts.get(clientIp);
-  const count = (prev?.count ?? 0) + 1;
-  loginAttempts.recordFailure(clientIp);
-  return count;
-}
 async function handleApiLoginVerify(req, res, _url, mutableAuth, sessions, loginAttempts, dataDir, secureCookies, applyAuthFile, trustedProxyHops) {
   if (!mutableAuth.cookieSecret) {
     res.writeHead(503, { "Content-Type": "application/json" });
@@ -1164,9 +1219,9 @@ async function handleApiLoginVerify(req, res, _url, mutableAuth, sessions, login
       );
       return;
     }
-    const matchedCounter = verifyTotpCounter(body.code, mutableAuth.totpSecret);
-    const replayed = matchedCounter !== void 0 && mutableAuth.totpLastUsedCounter !== void 0 && matchedCounter <= mutableAuth.totpLastUsedCounter;
-    if (matchedCounter === void 0 || replayed) {
+    const outcome = await consumeTotpCode(body.code, mutableAuth, dataDir, applyAuthFile);
+    const replayed = outcome === "replayed";
+    if (outcome !== "ok") {
       if (recordVerifyFailure(loginAttempts, clientIp) >= MAX_2FA_VERIFY_FAILURES) {
         sessions.delete(sessionId);
       }
@@ -1181,15 +1236,6 @@ async function handleApiLoginVerify(req, res, _url, mutableAuth, sessions, login
       );
       return;
     }
-    mutableAuth.totpLastUsedCounter = matchedCounter;
-    try {
-      const next = await mutateHqAuthFile2(dataDir, (current) => ({
-        ...current,
-        totpLastUsedCounter: matchedCounter
-      }));
-      applyAuthFile(next);
-    } catch {
-    }
     loginAttempts.clearOnSuccess(clientIp);
     sessions.delete(sessionId);
     const fullSessionId = randomUUID2();
@@ -1241,7 +1287,7 @@ async function handleApiLoginVerify(req, res, _url, mutableAuth, sessions, login
       releaseLock = resolve;
     });
     try {
-      const next = await mutateHqAuthFile2(dataDir, (current) => {
+      const next = await mutateHqAuthFile3(dataDir, (current) => {
         const diskHashes = current.totpRecoveryCodes ?? [];
         const idx = diskHashes.indexOf(usedHash);
         if (idx === -1) {
@@ -1311,7 +1357,7 @@ async function handleApiTotpSetup(req, res, mutableAuth, sessions, dataDir, appl
   }
   const secret = generateTotpSecret();
   const uri = buildOtpAuthUri(secret, "HQ");
-  const next = await mutateHqAuthFile2(dataDir, (current) => ({
+  const next = await mutateHqAuthFile3(dataDir, (current) => ({
     ...current,
     totpPendingSecret: secret
   }));
@@ -1362,7 +1408,7 @@ async function handleApiTotpEnable(req, res, mutableAuth, sessions, dataDir, app
   }
   const recoveryCodes = generateRecoveryCodes();
   const recoveryHashes = recoveryCodes.map(hashRecoveryCode);
-  const next = await mutateHqAuthFile2(dataDir, (current) => {
+  const next = await mutateHqAuthFile3(dataDir, (current) => {
     const updated = { ...current };
     updated.totpSecret = pendingSecret;
     delete updated.totpPendingSecret;
@@ -1399,8 +1445,11 @@ async function handleApiTotpDisable(req, res, mutableAuth, sessions, loginAttemp
   if (typeof body.password === "string" && body.password.length > 0 && mutableAuth.passwordHash) {
     confirmed = await verifyHqPassword2(body.password, mutableAuth.passwordHash);
   }
+  let replayed = false;
   if (!confirmed && typeof body.code === "string" && mutableAuth.totpSecret) {
-    confirmed = verifyTotp(body.code, mutableAuth.totpSecret);
+    const outcome = await consumeTotpCode(body.code, mutableAuth, dataDir, applyAuthFile);
+    confirmed = outcome === "ok";
+    replayed = outcome === "replayed";
   }
   if (!confirmed) {
     recordVerifyFailure(loginAttempts, clientIp);
@@ -1408,15 +1457,15 @@ async function handleApiTotpDisable(req, res, mutableAuth, sessions, loginAttemp
     res.end(
       JSON.stringify({
         error: {
-          code: "CONFIRMATION_REQUIRED",
-          message: "Provide the current password or a TOTP code."
+          code: replayed ? "TOTP_ALREADY_USED" : "CONFIRMATION_REQUIRED",
+          message: replayed ? "That authenticator code has already been used. Wait for the next one." : "Provide the current password or a TOTP code."
         }
       })
     );
     return;
   }
   loginAttempts.delete(clientIp);
-  const next = await mutateHqAuthFile2(dataDir, (current) => {
+  const next = await mutateHqAuthFile3(dataDir, (current) => {
     const updated = { ...current };
     delete updated.totpSecret;
     delete updated.totpPendingSecret;
@@ -2830,7 +2879,11 @@ function createHqRouter(deps) {
         host,
         listeningPort(),
         trustedPublicOrigins,
-        allowFileOrigin
+        allowFileOrigin,
+        // WS-SEC-06: tells the guard whether anything else can authenticate
+        // this request. In open mode a missing Origin is only acceptable on
+        // a loopback bind.
+        hqAuthRequired(mutableAuth, requireBrowserAuth)
       )) {
         res.writeHead(403, { "Content-Type": "application/json" });
         res.end(JSON.stringify({ error: "forbidden: untrusted request origin" }));
@@ -2912,6 +2965,7 @@ function createHqRouter(deps) {
           loginAttempts,
           secureCookies,
           trustedProxyHops,
+          dataDir,
           url.pathname === "/api/mobile/login" ? ["control.enqueue"] : void 0
         );
         return;
@@ -2985,7 +3039,9 @@ function createHqRouter(deps) {
           dataDir,
           secureCookies,
           requireBrowserAuth,
-          applyAuthFile
+          applyAuthFile,
+          loginAttempts,
+          trustedProxyHops
         );
         return;
       }
@@ -3466,6 +3522,7 @@ import { randomUUID as randomUUID5 } from "node:crypto";
 import {
   HQ_PROTOCOL_VERSION as HQ_PROTOCOL_VERSION2,
   parseHqFrame,
+  redactHqEvent as redactHqEvent2,
   resolveHqRedactionPolicy,
   tightenHqRedactionPolicy as tightenHqRedactionPolicy2,
   tokenHasCapability as tokenHasCapability3
@@ -4128,16 +4185,22 @@ function handleClient(ws, clients, browsers, eventLog, auth, snapshotBroadcaster
           sendGuarded(ws, JSON.stringify({ type: "hq.kanban_snapshot", payload: p }));
         }).catch(() => void 0);
       }
-      const event = {
-        id: randomUUID5(),
-        type: "client.hello",
-        schemaVersion: HQ_PROTOCOL_VERSION2,
-        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-        clientId: payload.client.clientId,
-        projectId: payload.project.projectId,
-        seq: 0,
-        payload: { client: payload.client, project: payload.project }
-      };
+      const event = redactHqEvent2(
+        {
+          id: randomUUID5(),
+          type: "client.hello",
+          schemaVersion: HQ_PROTOCOL_VERSION2,
+          timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+          clientId: payload.client.clientId,
+          projectId: payload.project.projectId,
+          seq: 0,
+          payload: { client: payload.client, project: payload.project }
+        },
+        {
+          policy: tightenHqRedactionPolicy2(declaredRedactionPolicy, auth.getOperatorPolicy()),
+          ...payload.project.projectRoot ? { projectRoot: payload.project.projectRoot } : {}
+        }
+      ).value;
       persistEvent(event);
       snapshotBroadcaster.broadcast();
       broadcastEvent(event, browsers);
@@ -4251,7 +4314,10 @@ function handleHqUpgrade(req, socket, head, deps) {
     deps.host,
     deps.listeningPort(),
     deps.trustedPublicOrigins,
-    deps.allowFileOrigin
+    deps.allowFileOrigin,
+    // WS-SEC-06 — see the guard. `/ws/browser` and `/ws/client` are the two
+    // surfaces this branch left uncontrolled in open mode.
+    hqAuthRequired(deps.mutableAuth, deps.requireBrowserAuth)
   )) {
     socket.write(
       "HTTP/1.1 403 Forbidden\r\nContent-Type: application/json\r\nConnection: close\r\n\r\n" + JSON.stringify({
@@ -4396,14 +4462,15 @@ async function startHqServerWithAuth(options, host, port, dataDir, firstRunAuth)
     }
   };
   const authState = createHqAuthState(authFile, dataDir, {
-    onApplied: (live) => reassessExposureFloor(live)
+    onApplied: (live) => reassessExposureFloor(live),
+    requireBrowserAuth: options.requireBrowserAuth
   });
   const { mutableAuth } = authState;
   const loginAttempts = new LoginAttemptStore(dataDir);
   await loginAttempts.load();
   if (!mutableAuth.cookieSecret && mutableAuth.browserTokens.size > 0) {
     const secret = mintHqCookieSecret2();
-    const next = await mutateHqAuthFile3(dataDir, (current) => ({
+    const next = await mutateHqAuthFile4(dataDir, (current) => ({
       ...current,
       cookieSecret: secret
     }));
@@ -4832,4 +4899,4 @@ export {
   startHqServer,
   HqInsecureExposureError2 as HqInsecureExposureError
 };
-//# sourceMappingURL=chunk-3I5ZJXM5.js.map
+//# sourceMappingURL=chunk-PQZPHGGD.js.map

package/dist/{chunk-BIWE22O5.js → chunk-QDQPF4PB.js}

@@ -1,9 +1,9 @@
 
 // src/subcommands/index.ts
 var loaders = {
-  acp: async () => (await import("./acp-AB54FWM2.js")).acpCmd,
+  acp: async () => (await import("./acp-GOQURNC2.js")).acpCmd,
   init: async () => (await import("./init-DRMMFG2G.js")).initCmd,
-  auth: async () => (await import("./auth-WDMSNZ3S.js")).authCmd,
+  auth: async () => (await import("./auth-WBXXIQUO.js")).authCmd,
   update: async () => (await import("./update-5DPB4YD4.js")).updateCmd,
   sessions: async () => (await import("./sessions-config-UL45XKX7.js")).sessionsCmd,
   config: async () => (await import("./sessions-config-UL45XKX7.js")).configCmd,
@@ -16,7 +16,7 @@ var loaders = {
   skills: async () => (await import("./tools-skills-GH24UCBY.js")).skillsCmd,
   providers: async () => (await import("./providers-models-6MOGAOVK.js")).providersCmd,
   models: async () => (await import("./providers-models-6MOGAOVK.js")).modelsCmd,
-  mcp: async () => (await import("./mcp-HOMLC4WE.js")).mcpCmd,
+  mcp: async () => (await import("./mcp-FX7TKPTV.js")).mcpCmd,
   plugin: async () => (await import("./plugin-usage-M6KET4OZ.js")).pluginCmd,
   plugins: async () => (await import("./plugin-usage-M6KET4OZ.js")).pluginCmd,
   diag: async () => (await import("./diag-doctor-PCER6KHH.js")).diagCmd,
@@ -31,7 +31,7 @@ var loaders = {
   quick: async () => (await import("./quick-CNB4Z3HS.js")).quickCmd,
   bench: async () => (await import("./bench-YBU6BVQP.js")).benchCmd,
   chronicle: async () => (await import("./chronicle-UTFETHP6.js")).chronicleCmd,
-  hq: async () => (await import("./hq-5XHEIIH6.js")).hqCmd,
+  hq: async () => (await import("./hq-V4PHEETW.js")).hqCmd,
   mailbox: async () => (await import("./mailbox-serve-X3CR6VFW.js")).mailboxServeCmd,
   permissions: async () => (await import("./permissions-CFDLXETM.js")).permissionsCmd,
   project: async () => (await import("./project-AOQI5XTK.js")).projectCmd,
@@ -51,4 +51,4 @@ export {
   subcommands,
   subcommandNames
 };
-//# sourceMappingURL=chunk-BIWE22O5.js.map
+//# sourceMappingURL=chunk-QDQPF4PB.js.map

package/dist/{chunk-VFCJOWJB.js → chunk-VPS2SJW4.js}

@@ -74,15 +74,14 @@ function stringifyInput(input) {
 var PREVIEW_MAX_LINES = 40;
 var PREVIEW_MAX_CHARS = 8e3;
 function clipPreview(body, decorate = (l) => l) {
-  const safe = sanitizeTerminalText2(body);
-  const { text, truncated } = sanitizeTerminalPreview(body, {
+  const { text, truncated, sanitizedLength, sanitizedLines } = sanitizeTerminalPreview(body, {
     maxLines: PREVIEW_MAX_LINES,
     maxChars: PREVIEW_MAX_CHARS
   });
   const rendered = text.split("\n").map(decorate).join("\n");
   if (!truncated) return rendered;
-  const hiddenLines = safe.split("\n").length - text.split("\n").length;
-  const detail = hiddenLines > 0 ? `${hiddenLines} more line${hiddenLines === 1 ? "" : "s"} not shown` : `${safe.length - text.length} more characters not shown`;
+  const hiddenLines = sanitizedLines - text.split("\n").length;
+  const detail = hiddenLines > 0 ? `${hiddenLines} more line${hiddenLines === 1 ? "" : "s"} not shown` : `${sanitizedLength - text.length} more characters not shown`;
   return `${rendered}
 ${color2.dim(`\u2026 ${detail} \u2014 review the file before approving`)}`;
 }
@@ -481,4 +480,4 @@ export {
   detectProjectFacts,
   renderAgentsTemplate
 };
-//# sourceMappingURL=chunk-VFCJOWJB.js.map
+//# sourceMappingURL=chunk-VPS2SJW4.js.map