@wrongstack/cli 1.0.4 → 1.0.7

package/dist/{acp-AB54FWM2.js → acp-A5EQEXQO.js}

@@ -5,6 +5,9 @@ import {
   refreshAcpRegistry,
   setupProvider
 } from "./chunk-KEPABQYT.js";
+import {
+  createHqCommandDispatcher
+} from "./chunk-JY52HWL6.js";
 import {
   startCliHqConnection
 } from "./chunk-TE3Q32JP.js";
@@ -36,18 +39,50 @@ import { WebSocketServer } from "ws";
 
 // src/acp-hq-telemetry.ts
 import { AgentStatusTracker } from "@wrongstack/core/coordination";
-import { startSessionTelemetryBridge } from "@wrongstack/core/hq";
+import {
+  createApprovalRegistry,
+  startApprovalTelemetryBridge,
+  startSessionTelemetryBridge
+} from "@wrongstack/core/hq";
 var NO_REGISTRY = { updateAgents: async () => void 0 };
 function startAcpHqTelemetry(options) {
+  const entries = /* @__PURE__ */ new Map();
+  let stopped = false;
+  const resolveApproval = (toolUseId, decision, sessionId) => {
+    if (sessionId !== void 0) {
+      return entries.get(sessionId)?.approvals?.resolve(toolUseId, decision, sessionId) ?? false;
+    }
+    for (const entry of entries.values()) {
+      if (entry.approvals?.resolve(toolUseId, decision) === true) return true;
+    }
+    return false;
+  };
   const connection = startCliHqConnection({
     clientKind: "acp",
     projectRoot: options.projectRoot,
     ...options.projectName !== void 0 ? { projectName: options.projectName } : {},
     ...options.appConfig !== void 0 ? { appConfig: options.appConfig } : {},
-    capabilities: ["telemetry.publish", "mailbox.summary", "fleet.summary", "session.summary"]
+    capabilities: [
+      "telemetry.publish",
+      "mailbox.summary",
+      "fleet.summary",
+      "session.summary",
+      // Approvals are the ONLY control this host accepts. `control.receive` is
+      // the server's gate for any command at all, so it has to be declared;
+      // everything except `approve` falls through the dispatcher and is
+      // refused, because an ACP session has no mailbox to steer and no leader
+      // to abort.
+      "control.receive",
+      "control.approve"
+    ],
+    onCommand: createHqCommandDispatcher({
+      interruptLeader: () => false,
+      sessionTag: () => "acp",
+      ownsSession: (sessionId) => entries.has(sessionId),
+      allowRunCommand: () => false,
+      resolveApproval
+    })
   });
-  const entries = /* @__PURE__ */ new Map();
-  let stopped = false;
   const attach = (sessionId, agent, cwd) => {
     if (stopped || entries.has(sessionId)) return;
     const publisher = connection.getPublisher();
@@ -73,7 +108,19 @@ function startAcpHqTelemetry(options) {
       tracker.stop();
       return;
     }
-    entries.set(sessionId, { tracker, stopBridge });
+    const entry = { tracker, stopBridge };
+    try {
+      const approvals = createApprovalRegistry(events);
+      entry.approvals = approvals;
+      entry.stopApprovalBridge = startApprovalTelemetryBridge({
+        registry: approvals,
+        publisher,
+        projectRoot: cwd,
+        sessionId
+      });
+    } catch {
+    }
+    entries.set(sessionId, entry);
   };
   const detach = (sessionId) => {
     const entry = entries.get(sessionId);
@@ -83,6 +130,14 @@ function startAcpHqTelemetry(options) {
       entry.stopBridge();
     } catch {
     }
+    try {
+      entry.stopApprovalBridge?.();
+    } catch {
+    }
+    try {
+      entry.approvals?.dispose();
+    } catch {
+    }
     try {
       entry.tracker.stop();
     } catch {
@@ -649,13 +704,16 @@ async function runACPWebSocketServer(deps, port) {
   const acpToken = process.env["WRONGSTACK_ACP_TOKEN"]?.trim() || randomBytes(32).toString("hex");
   const gate = createAcpConnectionGate({ host, port, token: acpToken });
   let liveConnections = 0;
-  const wss = new WebSocketServer({ host, port, maxPayload: 20 * 1024 * 1024 });
-  wss.on("connection", (socket, req) => {
-    const verdict = gate.check(req, liveConnections);
-    if (!verdict.ok) {
-      socket.close(verdict.code ?? 1008, verdict.reason ?? "forbidden");
+  const verifyClient = (info, cb) => {
+    const verdict = gate.check(info.req, liveConnections);
+    if (verdict.ok) {
+      cb(true);
       return;
     }
+    cb(false, 403, verdict.reason ?? "forbidden");
+  };
+  const wss = new WebSocketServer({ host, port, maxPayload: 20 * 1024 * 1024, verifyClient });
+  wss.on("connection", (socket) => {
     liveConnections++;
     socket.once("close", () => {
       liveConnections--;
@@ -1099,4 +1157,4 @@ ${renderAcpBenchText(result)}
 export {
   acpCmd
 };
-//# sourceMappingURL=acp-AB54FWM2.js.map
+//# sourceMappingURL=acp-A5EQEXQO.js.map

package/dist/{auth-WDMSNZ3S.js → auth-3K6EN5JP.js}

@@ -14,7 +14,7 @@ import {
   runOAuthLoginKind,
   runOAuthLoginMenu,
   validateFamily
-} from "./chunk-ONOT5OJ2.js";
+} from "./chunk-FSZ5QU3M.js";
 import {
   renderAuthLocalHelpToString,
   wantsLocalHelp
@@ -23,7 +23,7 @@ import "./chunk-B4JLSXZB.js";
 import {
   restoreFlags
 } from "./chunk-CSAPOCBP.js";
-import "./chunk-VUVOMXWP.js";
+import "./chunk-3VXYY5JC.js";
 import {
   activeProfileConfigPath
 } from "./chunk-YMXXOOFN.js";
@@ -619,4 +619,4 @@ async function runAuthRemove(deps, providerId) {
 export {
   authCmd
 };
-//# sourceMappingURL=auth-WDMSNZ3S.js.map
+//# sourceMappingURL=auth-3K6EN5JP.js.map

package/dist/boot/container-wiring.d.ts

@@ -4,6 +4,7 @@ import type { Config, Logger, ModelsRegistry, Renderer } from '@wrongstack/core/
 import type { WstackPaths } from '@wrongstack/core/utils';
 import { createDefaultContainer } from '@wrongstack/runtime';
 import { makePromptDelegate } from '../permission-prompt.js';
+import { type ApprovalMirrorRef } from '../permission-prompt-mirror.js';
 interface WireContainerDeps {
     config: Config;
     wpaths: WstackPaths;
@@ -30,6 +31,7 @@ export declare function wireContainer(deps: WireContainerDeps): {
     pathResolver: InstanceType<typeof DefaultPathResolver>;
     events: EventBus;
     container: ReturnType<typeof createDefaultContainer>;
+    approvalMirror: ApprovalMirrorRef;
 };
 export {};
 //# sourceMappingURL=container-wiring.d.ts.map

package/dist/boot/short-circuit-desktop.d.ts

@@ -1,3 +1,4 @@
 export declare function stripDesktopLauncherArgs(argv: string[]): string[];
+export declare function selectDesktopLauncherExecutable(execPath: string, runningUnderBun: boolean, nodeOverride?: string): string;
 export declare function handleDesktopShortCircuit(flags: Record<string, string | boolean>, argv: string[]): Promise<number | null>;
 //# sourceMappingURL=short-circuit-desktop.d.ts.map

package/dist/{chunk-VUVOMXWP.js → chunk-3VXYY5JC.js}

@@ -102,6 +102,13 @@ function modelDetails(models) {
         tools: model.tool_call,
         vision: model.modalities?.input?.includes("image"),
         reasoning: model.reasoning ?? model.reasoningConfig !== void 0,
+        // Documented effort vocabulary, mirroring the gate
+        // `getActiveModelReasoningEffortLevels` applies for the settings
+        // panel: `effortSupported === false` is a documented "no effort
+        // control", and the picker must not offer a strip for it. An absent
+        // field stays absent, which the strip reads as "undocumented →
+        // canonical set".
+        ...model.reasoningConfig?.effortSupported && model.reasoningConfig.effortLevels?.length ? { effortLevels: [...model.reasoningConfig.effortLevels] } : {},
         maxContext: model.limit?.context,
         maxOutput: model.limit?.output,
         inputCost: model.cost?.input,
@@ -120,4 +127,4 @@ export {
   hasApiKey,
   buildPickableProviders
 };
-//# sourceMappingURL=chunk-VUVOMXWP.js.map
+//# sourceMappingURL=chunk-3VXYY5JC.js.map

package/dist/{chunk-U6PGWDMZ.js → chunk-4OLAZIIN.js}

@@ -22,7 +22,7 @@ async function handleHelpVersionShortCircuit(argv) {
   }
   if (earlyFlags["help"] === true) {
     if (positional.length > 0) {
-      const { subcommandNames } = await import("./subcommands-7N4RIK6H.js");
+      const { subcommandNames } = await import("./subcommands-VFVUTYAV.js");
       if (subcommandNames.includes(positional[0])) {
         const first = positional[0];
         const deep = positional[1];
@@ -43,4 +43,4 @@ async function handleHelpVersionShortCircuit(argv) {
 export {
   handleHelpVersionShortCircuit
 };
-//# sourceMappingURL=chunk-U6PGWDMZ.js.map
+//# sourceMappingURL=chunk-4OLAZIIN.js.map

package/dist/{chunk-I7V2OYVH.js → chunk-5EA6OTLJ.js}

@@ -16,6 +16,7 @@ import * as fs from "node:fs/promises";
 import * as os2 from "node:os";
 import * as path from "node:path";
 import { resolveHqDataDir } from "@wrongstack/core/hq";
+import { isSafeSessionId as coreIsSafeSessionId } from "@wrongstack/core/utils";
 import { sanitizeApiError, scrubErrorDetail } from "@wrongstack/core/security";
 var TRANSCRIPT_RING_MAX = 4e3;
 var MAX_TRANSCRIPT_SESSIONS = 400;
@@ -99,11 +100,7 @@ function isSafePathSegment(value) {
   return true;
 }
 function isSafeSessionId(value) {
-  if (value.length === 0 || value.length > MAX_PATH_SEGMENT_LENGTH) return false;
-  if (value.includes("\\") || value.includes("\0") || value.includes(":")) return false;
-  const parts = value.split("/");
-  if (parts.length > 2) return false;
-  return parts.every((p) => p.length > 0 && p !== "." && p !== "..");
+  return coreIsSafeSessionId(value);
 }
 function displayHost(host) {
   return host === "0.0.0.0" ? "127.0.0.1" : host;
@@ -239,4 +236,4 @@ export {
   recordTimeseriesSignal,
   sanitizeApiError
 };
-//# sourceMappingURL=chunk-I7V2OYVH.js.map
+//# sourceMappingURL=chunk-5EA6OTLJ.js.map

package/dist/{chunk-O4A3HHKD.js → chunk-672UXYL3.js}

@@ -1,6 +1,6 @@
 
 // src/preflight.ts
-import { ensureSessionShell } from "@wrongstack/tools";
+import { ensureSessionShell } from "@wrongstack/tools/session-shell";
 
 // src/cli-update-notice.ts
 import { writeErr } from "@wrongstack/core/utils";
@@ -62,4 +62,4 @@ export {
   applySessionShellDefault,
   runPreflight
 };
-//# sourceMappingURL=chunk-O4A3HHKD.js.map
+//# sourceMappingURL=chunk-672UXYL3.js.map

package/dist/{chunk-ONOT5OJ2.js → chunk-FSZ5QU3M.js}

@@ -6,7 +6,7 @@ import {
   hasApiKey,
   isKeylessLocalProvider,
   visibleModelIds
-} from "./chunk-VUVOMXWP.js";
+} from "./chunk-3VXYY5JC.js";
 import {
   openBrowser
 } from "./chunk-DAKVBMD4.js";
@@ -1813,4 +1813,4 @@ export {
   addCustomProvider,
   addKeyForProvider
 };
-//# sourceMappingURL=chunk-ONOT5OJ2.js.map
+//# sourceMappingURL=chunk-FSZ5QU3M.js.map

package/dist/{chunk-KNMIBKLV.js → chunk-JY52HWL6.js}

@@ -235,6 +235,52 @@ async function dispatch(controller, commandId, type, payload) {
       });
       return { commandId, status: "completed", message };
     }
+    case "approve": {
+      const resolveApproval = controller.resolveApproval;
+      if (resolveApproval === void 0) {
+        return {
+          commandId,
+          status: "rejected",
+          message: "this client does not mirror approvals"
+        };
+      }
+      const toolUseId = typeof payload["toolUseId"] === "string" ? payload["toolUseId"] : "";
+      const decision = payload["decision"];
+      if (toolUseId.length === 0 || decision !== "yes" && decision !== "no" && decision !== "always" && decision !== "deny") {
+        return { commandId, status: "rejected", message: "malformed approve command" };
+      }
+      const applied = resolveApproval(toolUseId, decision, sessionId);
+      if (!applied) {
+        return {
+          commandId,
+          status: "rejected",
+          // Says WHY, because "rejected" alone reads as a failure the operator
+          // should retry — and retrying a settled prompt does nothing.
+          message: `approval ${toolUseId} is no longer pending (already answered, aborted or timed out)`
+        };
+      }
+      return { commandId, status: "completed", message: `approval ${decision}` };
+    }
+    case "answer-input": {
+      const resolver = controller.resolveUserInput;
+      if (!resolver)
+        return {
+          commandId,
+          status: "rejected",
+          message: "this client does not mirror user input forms"
+        };
+      const requestId = typeof payload["requestId"] === "string" ? payload["requestId"] : "";
+      const response = payload["response"];
+      if (!requestId || !response || !Array.isArray(response.answers))
+        return { commandId, status: "rejected", message: "malformed answer-input command" };
+      if (!resolver(requestId, response, sessionId))
+        return {
+          commandId,
+          status: "rejected",
+          message: `user input ${requestId} is no longer pending`
+        };
+      return { commandId, status: "completed", message: "user input submitted" };
+    }
     case "run-command": {
       if (!controller.allowRunCommand()) {
         return {
@@ -274,4 +320,4 @@ export {
   createProjectKanbanAssignHandler,
   createHqCommandDispatcher
 };
-//# sourceMappingURL=chunk-KNMIBKLV.js.map
+//# sourceMappingURL=chunk-JY52HWL6.js.map

package/dist/{chunk-BIWE22O5.js → chunk-RLCKKLJA.js}

@@ -1,9 +1,9 @@
 
 // src/subcommands/index.ts
 var loaders = {
-  acp: async () => (await import("./acp-AB54FWM2.js")).acpCmd,
+  acp: async () => (await import("./acp-A5EQEXQO.js")).acpCmd,
   init: async () => (await import("./init-DRMMFG2G.js")).initCmd,
-  auth: async () => (await import("./auth-WDMSNZ3S.js")).authCmd,
+  auth: async () => (await import("./auth-3K6EN5JP.js")).authCmd,
   update: async () => (await import("./update-5DPB4YD4.js")).updateCmd,
   sessions: async () => (await import("./sessions-config-UL45XKX7.js")).sessionsCmd,
   config: async () => (await import("./sessions-config-UL45XKX7.js")).configCmd,
@@ -14,9 +14,9 @@ var loaders = {
   audit: async () => (await import("./audit-46YK5DSC.js")).auditCmd,
   tools: async () => (await import("./tools-skills-GH24UCBY.js")).toolsCmd,
   skills: async () => (await import("./tools-skills-GH24UCBY.js")).skillsCmd,
-  providers: async () => (await import("./providers-models-6MOGAOVK.js")).providersCmd,
-  models: async () => (await import("./providers-models-6MOGAOVK.js")).modelsCmd,
-  mcp: async () => (await import("./mcp-HOMLC4WE.js")).mcpCmd,
+  providers: async () => (await import("./providers-models-LFNZ5WI7.js")).providersCmd,
+  models: async () => (await import("./providers-models-LFNZ5WI7.js")).modelsCmd,
+  mcp: async () => (await import("./mcp-FX7TKPTV.js")).mcpCmd,
   plugin: async () => (await import("./plugin-usage-M6KET4OZ.js")).pluginCmd,
   plugins: async () => (await import("./plugin-usage-M6KET4OZ.js")).pluginCmd,
   diag: async () => (await import("./diag-doctor-PCER6KHH.js")).diagCmd,
@@ -27,11 +27,11 @@ var loaders = {
   version: async () => (await import("./version-help-WXI42PZ3.js")).versionCmd,
   help: async () => (await import("./version-help-WXI42PZ3.js")).helpCmd,
   projects: async () => (await import("./projects-LMNAGGEU.js")).projectsCmd,
-  modeldiag: async () => (await import("./modeldiag-46CMWUNM.js")).modeldiagCmd,
+  modeldiag: async () => (await import("./modeldiag-CJSFHZ3J.js")).modeldiagCmd,
   quick: async () => (await import("./quick-CNB4Z3HS.js")).quickCmd,
   bench: async () => (await import("./bench-YBU6BVQP.js")).benchCmd,
   chronicle: async () => (await import("./chronicle-UTFETHP6.js")).chronicleCmd,
-  hq: async () => (await import("./hq-5XHEIIH6.js")).hqCmd,
+  hq: async () => (await import("./hq-G5PCP325.js")).hqCmd,
   mailbox: async () => (await import("./mailbox-serve-X3CR6VFW.js")).mailboxServeCmd,
   permissions: async () => (await import("./permissions-CFDLXETM.js")).permissionsCmd,
   project: async () => (await import("./project-AOQI5XTK.js")).projectCmd,
@@ -51,4 +51,4 @@ export {
   subcommands,
   subcommandNames
 };
-//# sourceMappingURL=chunk-BIWE22O5.js.map
+//# sourceMappingURL=chunk-RLCKKLJA.js.map

package/dist/{chunk-VFCJOWJB.js → chunk-RMQNCHGO.js}

@@ -27,7 +27,8 @@ import {
   writeOut
 } from "@wrongstack/core/utils";
 function makePromptDelegate(reader) {
-  return async (tool, input, suggestedPattern) => {
+  return async (tool, input, suggestedPattern, signal) => {
+    if (signal?.aborted) return "no";
     writeOut("\x07");
     writeOut(
       `
@@ -54,7 +55,8 @@ ${theme.warn("\u26A0 APPROVAL REQUIRED")} ${theme.primary("\u2502")} ${theme.bol
     const alwaysHint = noAlwaysReason ? "" : `  ${theme.bold("[a]")}lways allow (${sanitizeTerminalText2(suggestedPattern)})`;
     const answer = await reader.readKey(
       `${theme.bold("[y]")}es  ${theme.bold("[n]")}o${alwaysHint}  ${theme.bold("[d]")}eny: `,
-      options
+      options,
+      ...signal ? [{ signal }] : []
     );
     return answer;
   };
@@ -74,15 +76,14 @@ function stringifyInput(input) {
 var PREVIEW_MAX_LINES = 40;
 var PREVIEW_MAX_CHARS = 8e3;
 function clipPreview(body, decorate = (l) => l) {
-  const safe = sanitizeTerminalText2(body);
-  const { text, truncated } = sanitizeTerminalPreview(body, {
+  const { text, truncated, sanitizedLength, sanitizedLines } = sanitizeTerminalPreview(body, {
     maxLines: PREVIEW_MAX_LINES,
     maxChars: PREVIEW_MAX_CHARS
   });
   const rendered = text.split("\n").map(decorate).join("\n");
   if (!truncated) return rendered;
-  const hiddenLines = safe.split("\n").length - text.split("\n").length;
-  const detail = hiddenLines > 0 ? `${hiddenLines} more line${hiddenLines === 1 ? "" : "s"} not shown` : `${safe.length - text.length} more characters not shown`;
+  const hiddenLines = sanitizedLines - text.split("\n").length;
+  const detail = hiddenLines > 0 ? `${hiddenLines} more line${hiddenLines === 1 ? "" : "s"} not shown` : `${sanitizedLength - text.length} more characters not shown`;
   return `${rendered}
 ${color2.dim(`\u2026 ${detail} \u2014 review the file before approving`)}`;
 }
@@ -481,4 +482,4 @@ export {
   detectProjectFacts,
   renderAgentsTemplate
 };
-//# sourceMappingURL=chunk-VFCJOWJB.js.map
+//# sourceMappingURL=chunk-RMQNCHGO.js.map