@wrongstack/cli 1.0.4 → 1.0.7

package/dist/config-doctor.d.ts

@@ -47,7 +47,7 @@ export interface PluginSchemaInfo {
  *  every theme change), and a phantom `agents` entry (that field is nested
  *  under `acp`, never top-level) waved a stray top-level `agents` block
  *  through. Add a field to `Config` and `tsc` now names it here. */
-declare const KNOWN_TOP_LEVEL_KEYS: readonly ['version', 'activeProfile', 'provider', 'model', 'apiKey', 'baseUrl', 'maxConcurrent', 'uiLocale', 'themePreset', 'providers', 'models', 'modelMatrix', 'modelTiers', 'favoriteModels', 'favoriteModelsOnly', 'modelAvailabilitySchedule', 'context', 'tools', 'mcpServers', 'acp', 'fallbackModels', 'fallbackBridge', 'fallbackProfiles', 'fallbackProfile', 'fallbackAuto', 'fallbackMaxLastResortCandidates', 'fallbackStickiness', 'fallbackGateSeconds', 'hooks', 'plugins', 'pluginManager', 'log', 'features', 'Sage', 'skills', 'yolo', 'nextPrediction', 'cwd', 'autonomy', 'hints', 'debugStream', 'configScope', 'indexing', 'circuitBreaker', 'adaptiveConcurrency', 'launch', 'session', 'chronicle', 'modelRuntime', 'systemPrompt', 'hq', 'fleet', 'brain', 'sync', 'cloudSync', 'git', 'extensions'];
+declare const KNOWN_TOP_LEVEL_KEYS: readonly ['version', 'activeProfile', 'provider', 'model', 'apiKey', 'baseUrl', 'maxConcurrent', 'uiLocale', 'themePreset', 'providers', 'models', 'modelMatrix', 'modelTiers', 'favoriteModels', 'disabledModels', 'favoriteModelsOnly', 'modelAvailabilitySchedule', 'context', 'tools', 'mcpServers', 'acp', 'fallbackModels', 'fallbackBridge', 'fallbackProfiles', 'fallbackProfile', 'fallbackAuto', 'fallbackMaxLastResortCandidates', 'fallbackStickiness', 'fallbackGateSeconds', 'hooks', 'plugins', 'pluginManager', 'log', 'features', 'Sage', 'skills', 'yolo', 'nextPrediction', 'cwd', 'autonomy', 'hints', 'debugStream', 'configScope', 'indexing', 'circuitBreaker', 'adaptiveConcurrency', 'launch', 'session', 'chronicle', 'modelRuntime', 'systemPrompt', 'hq', 'fleet', 'brain', 'sync', 'cloudSync', 'git', 'extensions'];
 /** Compile-time `never` assertion: instantiating it with a non-empty union
  *  fails and the TS error text spells out the offending key names. */
 type AssertNever<T extends never> = T;

package/dist/execute-deps.d.ts

@@ -14,6 +14,7 @@ import type { BrainAutoRisk } from '@wrongstack/core/execution';
 import type { JournalEntry } from '@wrongstack/core/goal';
 import type { EventBus } from '@wrongstack/core/kernel';
 import type { SlashCommandRegistry } from '@wrongstack/core/registry';
+import type { StatuslineDensities, StatuslineLines } from '@wrongstack/core/statusline';
 import type { QueueStore } from '@wrongstack/core/storage';
 import type { AttachmentStore, AutonomyStage, Config, ConfigStore, MemoryPort, Message, ModelsRegistry, ModeStore, PromptLoader, ProviderConfig, ResolvedProvider, SessionEvent, SessionStore, SessionWriter, SkillLoader, TokenCounter } from '@wrongstack/core/types';
 import type { WstackPaths } from '@wrongstack/core/utils';
@@ -25,7 +26,6 @@ import type { ReadlineInputReader } from './input-reader.js';
 import type { LiveSettingsInput } from './live-settings-input.js';
 import type { TerminalRenderer } from './renderer.js';
 import type { AutonomyMode } from './services/autonomy-mode.js';
-import type { StatuslineDensities, StatuslineLines } from '@wrongstack/core/statusline';
 import type { StatuslineConfigKey } from './services/statusline-config.js';
 import type { SessionStats } from './session-stats.js';
 import type { UpdateInfo } from './update-check.js';
@@ -163,6 +163,8 @@ interface ProviderDeps {
             tools?: boolean | undefined;
             vision?: boolean | undefined;
             reasoning?: boolean | undefined;
+            /** Documented reasoning-effort levels (drives the picker strip). */
+            effortLevels?: readonly string[] | undefined;
             maxContext?: number | undefined;
             maxOutput?: number | undefined;
             inputCost?: number | undefined;

package/dist/{execution-RAZDDQFC.js → execution-FJE27VQ6.js}

@@ -212,7 +212,7 @@ async function runWebUIDispatch(ctx) {
   const isSimpleUi = !isSessionChild && flags["simpleui"] === true;
   agent.disableInteractiveConfirmation();
   renderer.setSilent(true);
-  const { runWebUI } = await import("./webui-server-OBV5JYJV.js");
+  const { runWebUI } = await import("./webui-server-3NYXBZHX.js");
   const flagValue = (names) => {
     for (const name of names) {
       if (!Object.hasOwn(flags, name)) continue;
@@ -1255,10 +1255,13 @@ async function onSDDOutput(output) {
 
 // src/boot/tui-session-resume.ts
 import * as path7 from "node:path";
-import { restoreSessionSubagentPolicy } from "@wrongstack/core/coordination";
+import {
+  restoreSessionSubagentModelPlan,
+  restoreSessionSubagentPolicy
+} from "@wrongstack/core/coordination";
 import { attachTodosCheckpoint, loadTodosCheckpoint } from "@wrongstack/core/storage";
 import { projectLastRequestTokens } from "@wrongstack/core/types/session-timeline";
-import { sessionScopedPath as sessionScopedPath2 } from "@wrongstack/core/utils";
+import { sessionScopedPath as sessionScopedPath2, toErrorMessage } from "@wrongstack/core/utils";
 var RESERVATION_WINDOW_MS = 6e4;
 var RESERVATION_RENEW_MS = 2e4;
 function messageText(content) {
@@ -1288,7 +1291,7 @@ async function resumeSession(ctx, sessionId) {
   };
   const warnings = [];
   const warn = (label, err) => {
-    warnings.push(`${label}: ${err instanceof Error ? err.message : String(err)}`);
+    warnings.push(`${label}: ${toErrorMessage(err)}`);
   };
   let stage = "start";
   const setStage = (next) => {
@@ -1309,7 +1312,7 @@ async function resumeSession(ctx, sessionId) {
       throw new TypeError("@wrongstack/tui does not export replaySessionMessages");
     }
   } catch (err) {
-    return fail(stage, err instanceof Error ? err.message : String(err));
+    return fail(stage, toErrorMessage(err));
   }
   setStage("resolve_id");
   let canonicalSessionId = sessionId;
@@ -1323,11 +1326,11 @@ async function resumeSession(ctx, sessionId) {
         level: "error",
         event: "execution.resume_id_resolve_failed",
         sessionId,
-        message: err instanceof Error ? err.message : String(err),
+        message: toErrorMessage(err),
         timestamp: (/* @__PURE__ */ new Date()).toISOString()
       })
     );
-    return fail(stage, err instanceof Error ? err.message : String(err));
+    return fail(stage, toErrorMessage(err));
   }
   const previousSessionId = agent.ctx.session?.id;
   let hydrated;
@@ -1369,7 +1372,7 @@ async function resumeSession(ctx, sessionId) {
             level: "warn",
             event: "execution.resume_reservation_renew_failed",
             sessionId: canonicalSessionId,
-            message: err instanceof Error ? err.message : String(err),
+            message: toErrorMessage(err),
             timestamp: (/* @__PURE__ */ new Date()).toISOString()
           })
         );
@@ -1425,6 +1428,7 @@ async function resumeSession(ctx, sessionId) {
     try {
       agent.ctx.state.replaceMessages(resumed.data.messages);
       restoreSessionSubagentPolicy(agent.ctx, resumed.data.events, resumed.data.subagentsAllowed);
+      restoreSessionSubagentModelPlan(agent.ctx, resumed.data.events);
     } catch (err) {
       agent.ctx.session = oldWriter;
       agent.ctx.state.replaceMessages(oldMessages);
@@ -1441,7 +1445,7 @@ async function resumeSession(ctx, sessionId) {
         JSON.stringify({
           level: "error",
           event: "execution.resume_journal_flush_failed",
-          message: err instanceof Error ? err.message : String(err),
+          message: toErrorMessage(err),
           timestamp: (/* @__PURE__ */ new Date()).toISOString()
         })
       );
@@ -1498,7 +1502,7 @@ async function resumeSession(ctx, sessionId) {
             event: "execution.resume_model_restore_failed",
             provider: targetProviderId,
             model: targetModel,
-            message: err instanceof Error ? err.message : String(err),
+            message: toErrorMessage(err),
             timestamp: (/* @__PURE__ */ new Date()).toISOString()
           })
         );
@@ -1526,7 +1530,7 @@ async function resumeSession(ctx, sessionId) {
             JSON.stringify({
               level: "error",
               event: "execution.session_end_append_failed",
-              message: err instanceof Error ? err.message : String(err),
+              message: toErrorMessage(err),
               timestamp: (/* @__PURE__ */ new Date()).toISOString()
             })
           );
@@ -1539,7 +1543,7 @@ async function resumeSession(ctx, sessionId) {
               JSON.stringify({
                 level: "error",
                 event: "execution.session_close_failed",
-                message: err instanceof Error ? err.message : String(err),
+                message: toErrorMessage(err),
                 timestamp: (/* @__PURE__ */ new Date()).toISOString()
               })
             );
@@ -1580,7 +1584,7 @@ async function resumeSession(ctx, sessionId) {
             level: "error",
             event: "execution.resume_identity_rollback_failed",
             sessionId: previousSessionId,
-            message: rollbackErr instanceof Error ? rollbackErr.message : String(rollbackErr),
+            message: toErrorMessage(rollbackErr),
             timestamp: (/* @__PURE__ */ new Date()).toISOString()
           })
         );
@@ -1602,7 +1606,7 @@ async function resumeSession(ctx, sessionId) {
           JSON.stringify({
             level: "error",
             event: "execution.resume_post_swap_rollback_failed",
-            message: rollbackErr instanceof Error ? rollbackErr.message : String(rollbackErr),
+            message: toErrorMessage(rollbackErr),
             timestamp: (/* @__PURE__ */ new Date()).toISOString()
           })
         );
@@ -1613,7 +1617,7 @@ async function resumeSession(ctx, sessionId) {
             JSON.stringify({
               level: "error",
               event: "execution.resume_opened_writer_close_failed",
-              message: closeErr instanceof Error ? closeErr.message : String(closeErr),
+              message: toErrorMessage(closeErr),
               timestamp: (/* @__PURE__ */ new Date()).toISOString()
             })
           );
@@ -1631,7 +1635,7 @@ async function resumeSession(ctx, sessionId) {
         timestamp: (/* @__PURE__ */ new Date()).toISOString()
       })
     );
-    const message = err instanceof Error ? err.message : String(err);
+    const message = toErrorMessage(err);
     if (err instanceof Error && err.name === "SessionOwnershipConflictError") {
       return fail(stage, message);
     }
@@ -1670,7 +1674,7 @@ async function resumeSession(ctx, sessionId) {
             level: "error",
             event: "execution.resume_readonly_render_failed",
             sessionId: canonicalSessionId,
-            message: renderErr instanceof Error ? renderErr.message : String(renderErr),
+            message: toErrorMessage(renderErr),
             timestamp: (/* @__PURE__ */ new Date()).toISOString()
           })
         );
@@ -3203,6 +3207,75 @@ var FleetStatusLine = class {
   }
 };
 
+// src/subagent-models/panel-service.ts
+import {
+  emptySubagentModelPlan,
+  formatSubagentSlot,
+  getSessionSubagentModelPlan,
+  setSessionSubagentModelPlan,
+  subagentSlotOccupancy
+} from "@wrongstack/core/coordination";
+function currentPlan(sessionId) {
+  return getSessionSubagentModelPlan(sessionId) ?? emptySubagentModelPlan();
+}
+function createSubagentModelsPanelHost(deps) {
+  const write = async (mutate) => {
+    const ctx = deps.getContext();
+    if (!ctx?.session) return "No active session \u2014 the plan cannot be saved.";
+    const plan = structuredClone(currentPlan(ctx.session.id));
+    mutate(plan);
+    try {
+      await setSessionSubagentModelPlan(ctx, plan);
+      return null;
+    } catch (err) {
+      return err instanceof Error ? err.message : String(err);
+    }
+  };
+  return {
+    snapshot() {
+      const sessionId = deps.getContext()?.session?.id;
+      const plan = currentPlan(sessionId);
+      const occupancy = subagentSlotOccupancy(sessionId);
+      const session = deps.getSessionTarget?.();
+      return {
+        enabled: plan.enabled,
+        lock: plan.lock,
+        followSessionModel: plan.followSessionModel === true,
+        sessionTarget: session?.provider ? `${session.provider}/${session.model ?? "?"}` : session?.model ?? "",
+        lanes: plan.slots.map((slot, i) => ({
+          target: formatSubagentSlot(slot),
+          busy: occupancy[i]?.subagentIds.length ?? 0,
+          ...slot.label ? { label: slot.label } : {}
+        })),
+        roles: Object.entries(plan.roles ?? {}).map(([role, slot]) => ({ role, target: formatSubagentSlot(slot) })).sort((a, b) => a.role.localeCompare(b.role))
+      };
+    },
+    setLane(index, target) {
+      return write((plan) => {
+        if (index < 0 || index >= plan.slots.length) return;
+        const slot = {};
+        if (target.provider) slot.provider = target.provider;
+        if (target.model) slot.model = target.model;
+        if (target.tier) slot.tier = target.tier;
+        if (target.fallbackProfile) slot.fallbackProfile = target.fallbackProfile;
+        if (target.label) slot.label = target.label;
+        plan.slots[index] = slot;
+      });
+    },
+    clearLane(index) {
+      return write((plan) => {
+        if (index < 0 || index >= plan.slots.length) return;
+        plan.slots[index] = {};
+      });
+    },
+    toggle(field) {
+      return write((plan) => {
+        plan[field] = plan[field] !== true;
+      });
+    }
+  };
+}
+
 // src/chimera-work-registry.ts
 function createChimeraWorkRegistry() {
   const pending = /* @__PURE__ */ new Set();
@@ -4592,7 +4665,7 @@ import {
   color as color11,
   estimateRequestTokensCalibrated as estimateRequestTokensCalibrated2,
   hasOpenTodos as hasOpenTodos2,
-  toErrorMessage as toErrorMessage3
+  toErrorMessage as toErrorMessage4
 } from "@wrongstack/core/utils";
 import { readClipboardImage, routeImagesForModel } from "@wrongstack/runtime";
 import { createAutoProceedLoopGuard } from "@wrongstack/tools/auto-proceed-loop-guard";
@@ -4820,11 +4893,11 @@ function registerReplClient(opts) {
 
 // src/repl-eternal-loop.ts
 import { goalFilePath as goalFilePath2, summarizeUsage } from "@wrongstack/core/goal";
-import { color as color8, toErrorMessage as toErrorMessage2 } from "@wrongstack/core/utils";
+import { color as color8, toErrorMessage as toErrorMessage3 } from "@wrongstack/core/utils";
 
 // src/repl-goal-banner.ts
 import { goalFilePath, loadGoal } from "@wrongstack/core/goal";
-import { color as color7, expectDefined, toErrorMessage } from "@wrongstack/core/utils";
+import { color as color7, expectDefined, toErrorMessage as toErrorMessage2 } from "@wrongstack/core/utils";
 async function loadGoalSafe(opts) {
   if (!opts.projectRoot) return null;
   try {
@@ -4858,7 +4931,7 @@ async function renderGoalBanner(opts) {
         try {
           await opts.slashRegistry.dispatch("/autonomy eternal", opts.agent.ctx);
         } catch (err) {
-          opts.renderer.writeError(`Auto-resume failed: ${toErrorMessage(err)}`);
+          opts.renderer.writeError(`Auto-resume failed: ${toErrorMessage2(err)}`);
         }
       } else {
         opts.renderer.write(
@@ -4934,7 +5007,7 @@ async function runReplEternalLoop(opts, onInterruptsReset) {
         return true;
       }
     } catch (err) {
-      opts.renderer.writeError(`[eternal] ${toErrorMessage2(err)}`);
+      opts.renderer.writeError(`[eternal] ${toErrorMessage3(err)}`);
     }
     await new Promise((resolve4) => setTimeout(resolve4, 250));
     return true;
@@ -5005,7 +5078,7 @@ async function runReplEternalLoop(opts, onInterruptsReset) {
         return true;
       }
     } catch (err) {
-      opts.renderer.writeError(`[parallel] ${toErrorMessage2(err)}`);
+      opts.renderer.writeError(`[parallel] ${toErrorMessage3(err)}`);
     }
     await new Promise((resolve4) => setTimeout(resolve4, 250));
     return true;
@@ -5245,7 +5318,7 @@ ${lines.join("\n")}
           if (res?.message) opts.renderer.write(`${res.message}
 `);
         } catch (err) {
-          opts.renderer.writeError(toErrorMessage3(err));
+          opts.renderer.writeError(toErrorMessage4(err));
         }
         continue;
       }
@@ -5337,7 +5410,7 @@ ${color11.dim(taskList2)}
             }
           }
         } catch (err) {
-          opts.renderer.writeError(toErrorMessage3(err));
+          opts.renderer.writeError(toErrorMessage4(err));
         }
         continue;
       }
@@ -5616,7 +5689,7 @@ ${color11.dim(lines)}
           }
         }
       } catch (err) {
-        opts.renderer.writeError(toErrorMessage3(err));
+        opts.renderer.writeError(toErrorMessage4(err));
       } finally {
         activeCtrl = void 0;
       }
@@ -5642,7 +5715,7 @@ async function pasteClipboardImage(builder, opts) {
     opts.renderer.write(color11.dim(`  \u21B3 ${placeholder} (PNG ${kb}KB)
 `));
   } catch (err) {
-    opts.renderer.writeError(`Clipboard image error: ${toErrorMessage3(err)}`);
+    opts.renderer.writeError(`Clipboard image error: ${toErrorMessage4(err)}`);
   }
 }
 
@@ -6554,6 +6627,10 @@ async function execute(deps) {
           getBrainData,
           onBrainRiskLevel,
           brainPanelHost: brainRuntime ? createBrainPanelHost({ brainRuntime }) : void 0,
+          subagentModelsHost: createSubagentModelsPanelHost({
+            getContext: () => agent.ctx,
+            getSessionTarget: () => ({ provider: config.provider, model: config.model })
+          }),
           getShadowData,
           onShadowStart,
           onShadowStop,
@@ -6840,4 +6917,4 @@ export {
   execute,
   resolveReviewerFallbackModels
 };
-//# sourceMappingURL=execution-RAZDDQFC.js.map
+//# sourceMappingURL=execution-FJE27VQ6.js.map

package/dist/{hq-5XHEIIH6.js → hq-G5PCP325.js}

@@ -7,7 +7,7 @@ import {
 import {
   normalizeHqPublicOrigin,
   resolveAuditActor
-} from "./chunk-I7V2OYVH.js";
+} from "./chunk-5EA6OTLJ.js";
 import {
   parseHqIpAllowlist
 } from "./chunk-Q7E3BPDU.js";
@@ -62,7 +62,7 @@ var hqCmd = async (args, deps) => {
   return 1;
 };
 async function startServer(deps) {
-  const { startHqServer } = await import("./hq-server-CNUTBWTK.js");
+  const { startHqServer } = await import("./hq-server-G3VVVMIG.js");
   const dataDir = resolveDataDir(deps);
   const flags = deps.flags ?? {};
   const rawPublicUrl = typeof flags["hq-public-url"] === "string" ? flags["hq-public-url"] : process.env.WRONGSTACK_HQ_PUBLIC_URL;
@@ -357,7 +357,9 @@ async function computeAuditHashField(dataDir, warn) {
   return hash !== void 0 ? { contentHash: hash } : {};
 }
 var TOKEN_CAPABILITIES = {
-  browser: ["control.enqueue"],
+  // `control.approve` is grantable but never default — see
+  // DEFAULT_TOKEN_CAPABILITIES below.
+  browser: ["control.enqueue", "control.approve"],
   client: ["telemetry.publish", "control.execute"]
 };
 var DEFAULT_TOKEN_CAPABILITIES = {
@@ -727,7 +729,7 @@ function printHelp(deps) {
 `
   );
   deps.renderer.write(
-    `  --capabilities <csv>  Token grants (browser: control.enqueue; client: telemetry.publish,control.execute).
+    `  --capabilities <csv>  Token grants (browser: control.enqueue,control.approve; client: telemetry.publish,control.execute).
 `
   );
   deps.renderer.write(
@@ -785,7 +787,7 @@ function printTokenHelp(deps) {
 `
   );
   deps.renderer.write(
-    `  --capabilities <csv>  Comma-separated capability grants (browser: control.enqueue; client: telemetry.publish,control.execute).
+    `  --capabilities <csv>  Comma-separated capability grants (browser: control.enqueue,control.approve; client: telemetry.publish,control.execute).
 `
   );
   deps.renderer.write(
@@ -827,4 +829,4 @@ export {
   hqCmd,
   resolveAuditActor
 };
-//# sourceMappingURL=hq-5XHEIIH6.js.map
+//# sourceMappingURL=hq-G5PCP325.js.map

package/dist/hq-command-controller.d.ts

@@ -17,6 +17,7 @@
  */
 import type { RemoteMailbox } from '@wrongstack/core/coordination';
 import type { HqPublisherCommandResult } from '@wrongstack/core/hq';
+import type { UserInputResponse } from '@wrongstack/core/types';
 /**
  * Mutable holder for the command dispatch targets. Each field is populated
  * lazily as the corresponding subsystem comes online (director on
@@ -68,6 +69,20 @@ export interface HqCommandController {
     ownsSession?: ((sessionId: string) => boolean) | undefined;
     /** Whether raw shell execution is explicitly opted-in by the operator. */
     allowRunCommand: () => boolean;
+    /**
+     * Answer a permission prompt that is live on this host.
+     *
+     * Returns false when the prompt is no longer pending — it was answered at
+     * the keyboard, aborted, or timed out. HQ mirrors prompts rather than owning
+     * them, so losing the race is the normal case and must be reported back
+     * instead of silently swallowed.
+     *
+     * Bound to the process-wide approval registry
+     * (`createApprovalRegistry` in `@wrongstack/core/hq`), which is the only
+     * holder of the resolver closures.
+     */
+    resolveApproval?: ((toolUseId: string, decision: 'yes' | 'no' | 'always' | 'deny', sessionId?: string | undefined) => boolean) | undefined;
+    resolveUserInput?: ((requestId: string, response: UserInputResponse, sessionId?: string | undefined) => boolean) | undefined;
     /** Apply a lifecycle transition through the project's Kanban IPC client. */
     kanbanTransition?: ((input: {
         boardId: string;

package/dist/hq-server/auth-state.d.ts

@@ -6,6 +6,12 @@ export interface HqAuthState {
     tokenStats(): NonNullable<HqSnapshot['totals']['tokenStats']>;
 }
 interface HqAuthStateOptions {
+    /**
+     * The server's `requireBrowserAuth` option, stamped onto the state so every
+     * `hqAuthRequired(mutableAuth)` gate observes it without having to be handed
+     * it separately. See the field's doc on `HqRouterMutableAuth`.
+     */
+    requireBrowserAuth?: boolean | undefined;
     /**
      * Invoked after every {@link HqAuthState.apply}, with the freshly projected
      * `mutableAuth`. The server wires this to the WS-010 exposure re-assessment

package/dist/hq-server/auth.d.ts

@@ -38,7 +38,16 @@ export type HqBrowserAuthResult = HqBrowserAuthContext | HqCookieAuthContext | u
  * inline style is not script execution.
  */
 export declare function setHqSecurityHeaders(res: http.ServerResponse): void;
-export declare function hasTrustedBrowserOrigin(req: http.IncomingMessage, boundHost?: string, boundPort?: number, trustedPublicOrigins?: ReadonlySet<string>, allowFileOrigin?: boolean): boolean;
+export declare function hasTrustedBrowserOrigin(req: http.IncomingMessage, boundHost?: string, boundPort?: number, trustedPublicOrigins?: ReadonlySet<string>, allowFileOrigin?: boolean, 
+/**
+ * Whether this surface has any credential configured — pass
+ * `hqAuthRequired(mutableAuth, requireBrowserAuth)`.
+ *
+ * Defaults to `false`, the STRICT side, deliberately: a caller that forgets
+ * to wire it gets the tighter rule rather than the looser one. That is the
+ * opposite of how the WS-077 gates drifted.
+ */
+credentialedSurface?: boolean): boolean;
 export declare function serializeHqSessionCookie(sessionId: string, secret: string): string;
 export declare function parseHqSessionCookie(value: string, secret: string): string | undefined;
 export declare function parseCookieHeader(cookieHeader: string | undefined): Record<string, string>;

package/dist/hq-server/routes/auth/common.d.ts

@@ -1,7 +1,41 @@
 import type * as http from 'node:http';
 import { type HqAuthFile } from '@wrongstack/core/hq';
 import { type HqBrowserAuthResult } from '../../auth.js';
+import type { LoginAttemptStore } from '../../login-attempt-store.js';
 import type { HqRouterMutableAuth, HqSessionEntry } from '../../types.js';
+/**
+ * Record a failed second-factor confirmation and return the new failure count.
+ *
+ * Shared by every route that verifies a factor outside `/api/login`
+ * (totp/disable, password change). Kept here rather than copied per route: the
+ * whole point is that each of those routes feeds the SAME per-IP counter, so a
+ * attacker cannot get a fresh budget by switching endpoints.
+ */
+export declare function recordVerifyFailure(loginAttempts: LoginAttemptStore, clientIp: string): number;
+/** Outcome of {@link consumeTotpCode}. */
+export type TotpConsumeResult = 'ok' | 'invalid' | 'replayed';
+/**
+ * Verify a TOTP code AND burn it, so it cannot be presented a second time.
+ *
+ * A TOTP code stays valid for its whole time step plus the verification
+ * window — roughly 90 seconds. Without a single-use record, one observed code
+ * can be replayed at a *different* endpoint for as long as that window lasts.
+ * That is not theoretical here: `/api/login/verify` advanced
+ * `totpLastUsedCounter` and the other two verification sites
+ * (`totp/disable`, `auth/password`) called the counter-less `verifyTotp`, so a
+ * code already spent on a login replayed into removing 2FA outright or
+ * rotating the password and cookie secret.
+ *
+ * Kept in this module for the same reason as {@link recordVerifyFailure}: the
+ * property only holds if EVERY site that verifies a code shares one counter.
+ * A route that verifies a TOTP code by any other means is a bug —
+ * `hq-totp-single-use.test.ts` enumerates the call sites to keep it that way.
+ *
+ * The counter is advanced in memory first and persisted best-effort, matching
+ * the pre-existing behaviour at `/api/login/verify`: a failed write must not
+ * turn a consumed code back into an unconsumed one for this process.
+ */
+export declare function consumeTotpCode(code: string, mutableAuth: HqRouterMutableAuth, dataDir: string, applyAuthFile: ApplyHqAuthFile): Promise<TotpConsumeResult>;
 export declare function isLoopbackRequest(req: http.IncomingMessage): boolean;
 export declare const HQ_AUTH_ADMIN_CAPABILITY = "auth.admin";
 export declare function callerCanAdministerAuth(auth: HqBrowserAuthResult): boolean;

package/dist/hq-server/routes/auth/password-routes.d.ts

@@ -3,7 +3,9 @@ import type { LoginAttemptStore } from '../../login-attempt-store.js';
 import type { HqRouterMutableAuth, HqSessionEntry } from '../../types.js';
 import { type ApplyHqAuthFile } from './common.js';
 export declare function handleApiAuthStatus(req: http.IncomingMessage, res: http.ServerResponse, url: URL, mutableAuth: HqRouterMutableAuth, sessions: Map<string, HqSessionEntry>, requireBrowserAuth: boolean | undefined, trustedPublicOrigins: Set<string>, secureCookies: boolean | undefined): Promise<void>;
-export declare function handleApiLogin(req: http.IncomingMessage, res: http.ServerResponse, mutableAuth: HqRouterMutableAuth, sessions: Map<string, HqSessionEntry>, loginAttempts: LoginAttemptStore, secureCookies: boolean | undefined, trustedProxyHops: number, sessionCapabilities?: string[]): Promise<void>;
+export declare function handleApiLogin(req: http.IncomingMessage, res: http.ServerResponse, mutableAuth: HqRouterMutableAuth, sessions: Map<string, HqSessionEntry>, loginAttempts: LoginAttemptStore, secureCookies: boolean | undefined, trustedProxyHops: number, 
+/** Where `auth.json` lives — needed to persist a transparent KDF upgrade. */
+dataDir: string, sessionCapabilities?: string[]): Promise<void>;
 export declare function handleApiLogout(req: http.IncomingMessage, res: http.ServerResponse, mutableAuth: HqRouterMutableAuth, sessions: Map<string, HqSessionEntry>, secureCookies: boolean | undefined): Promise<void>;
-export declare function handleApiPassword(req: http.IncomingMessage, res: http.ServerResponse, mutableAuth: HqRouterMutableAuth, sessions: Map<string, HqSessionEntry>, dataDir: string, secureCookies: boolean | undefined, requireBrowserAuth: boolean | undefined, applyAuthFile: ApplyHqAuthFile): Promise<void>;
+export declare function handleApiPassword(req: http.IncomingMessage, res: http.ServerResponse, mutableAuth: HqRouterMutableAuth, sessions: Map<string, HqSessionEntry>, dataDir: string, secureCookies: boolean | undefined, requireBrowserAuth: boolean | undefined, applyAuthFile: ApplyHqAuthFile, loginAttempts: LoginAttemptStore, trustedProxyHops: number): Promise<void>;
 //# sourceMappingURL=password-routes.d.ts.map

package/dist/hq-server/types.d.ts

@@ -103,6 +103,24 @@ export interface HqRouterMutableAuth {
      * the surface fails closed instead of opening up.
      */
     requireAuthFloor?: boolean | undefined;
+    /**
+     * The server's `requireBrowserAuth` option, carried on the state rather than
+     * passed to every gate.
+     *
+     * `hqAuthRequired` takes it as an optional second argument, and five gates
+     * called it with one — `command-handlers`, three in `mailbox-handlers`, and
+     * `mailbox-gateway-manager` — so a public relay did not raise the auth
+     * requirement on those routes. That is the WS-077 drift class the helper's
+     * own docstring warns about, recurring on the same routes. Holding the value
+     * on the state makes the one-argument call correct instead of incomplete.
+     *
+     * Required, not optional, and deliberately so. Optional would mean a second
+     * construction site could omit it and every one-argument gate would silently
+     * read `undefined` — the same drift this field exists to end, one level down.
+     * With `exactOptionalPropertyTypes` the compiler now makes every builder say
+     * what it means, including `undefined`.
+     */
+    requireBrowserAuth: boolean | undefined;
 }
 /**
  * Session record stored in the server-side `sessions` Map.

package/dist/{hq-server-CNUTBWTK.js → hq-server-G3VVVMIG.js}

@@ -10,9 +10,9 @@ import {
   readLocalSubagentTranscript,
   sanitizeApiError,
   startHqServer
-} from "./chunk-3I5ZJXM5.js";
+} from "./chunk-XIZZ2EXG.js";
 import "./chunk-HXJYHAR4.js";
-import "./chunk-I7V2OYVH.js";
+import "./chunk-5EA6OTLJ.js";
 import "./chunk-Q7E3BPDU.js";
 export {
   DEFAULT_HOST,
@@ -27,4 +27,4 @@ export {
   sanitizeApiError,
   startHqServer
 };
-//# sourceMappingURL=hq-server-CNUTBWTK.js.map
+//# sourceMappingURL=hq-server-G3VVVMIG.js.map

package/dist/index.js

@@ -2,7 +2,7 @@
 import {
   applyNodeEnvDefault,
   applySessionShellDefault
-} from "./chunk-O4A3HHKD.js";
+} from "./chunk-672UXYL3.js";
 import {
   CLI_VERSION
 } from "./chunk-XJXDOF63.js";
@@ -16,20 +16,21 @@ async function main(argv) {
   applySessionShellDefault();
   const earlyFlags = parseArgs(argv).flags;
   if (earlyFlags["help"] === true || earlyFlags["version"] === true) {
-    const { handleHelpVersionShortCircuit } = await import("./short-circuit-flags-YDMLAQ5R.js");
+    const { handleHelpVersionShortCircuit } = await import("./short-circuit-flags-RAT6UZVI.js");
     const earlyExit = await handleHelpVersionShortCircuit(argv);
     if (earlyExit !== null) return earlyExit;
   }
-  const { initializeCli } = await import("./cli-context-WFC3BNGM.js");
+  const { initializeCli } = await import("./cli-context-TIAP6YQK.js");
   const cliCtx = await initializeCli(argv);
   if (typeof cliCtx === "number") return cliCtx;
-  const { runInteractive } = await import("./cli-main-GU3YZLMO.js");
+  const { runInteractive } = await import("./cli-main-AKJHDSHX.js");
   return runInteractive(cliCtx);
 }
 
 // src/cli-entry-point.ts
 import { resolve } from "node:path";
 import { pathToFileURL } from "node:url";
+import { scrubErrorText } from "@wrongstack/core/security";
 import { installCrashShield, runFatalSalvageSync, writeErr } from "@wrongstack/core/utils";
 var SQLITE_WARNING_RE = /sqlite is an experimental feature/i;
 function installSqliteWarningFilter() {
@@ -128,7 +129,9 @@ function runAsMain(mainFn) {
     },
     (err) => {
       runFatalSalvageSync();
-      writeErr((err instanceof Error ? err.stack : String(err)) + "\n");
+      writeErr(
+        scrubErrorText(err instanceof Error ? err.stack ?? err.message : String(err)) + "\n"
+      );
       process.exitCode = 1;
       scheduleForcedExit(1);
     }

package/dist/input-reader.d.ts

@@ -1,4 +1,4 @@
-import type { InputReader, PromptOption } from '@wrongstack/core/types';
+import type { InputReader, PromptOption, ReadKeyOptions } from '@wrongstack/core/types';
 interface ReadlineInputReaderOptions {
     historyFile?: string | undefined;
     prompt?: string | undefined;
@@ -30,7 +30,7 @@ export declare class ReadlineInputReader implements InputReader {
      * protect and the ANSI clear/repaint would be noise in a file.
      */
     private installPromptGuard;
-    readKey(prompt: string, options: PromptOption[]): Promise<string>;
+    readKey(prompt: string, options: PromptOption[], opts?: ReadKeyOptions): Promise<string>;
     /**
      * Read a line of input while masking each character with a bullet so the
      * user gets visual confirmation that bytes are arriving (especially on