@wrongstack/cli 1.0.9 → 1.0.11

package/dist/{cli-main-4E4YMCNS.js → cli-main-WC5JNIWY.js}

@@ -6,7 +6,7 @@ import {
   removeSuggestions,
   runGit,
   setSuggestions
-} from "./chunk-SXJTVNWF.js";
+} from "./chunk-OWNC7LMD.js";
 import {
   setupPlugins
 } from "./chunk-XJ7K67PP.js";
@@ -102,7 +102,7 @@ import {
   runAuthLocal,
   runProviderAuthLogin,
   validateFamily
-} from "./chunk-FSZ5QU3M.js";
+} from "./chunk-RDHFXOJM.js";
 import "./chunk-2VMJ3E5Z.js";
 import {
   appendHistory
@@ -116,7 +116,7 @@ import {
 } from "./chunk-YMXXOOFN.js";
 import {
   parseSpawnFlags
-} from "./chunk-EK2P53GL.js";
+} from "./chunk-C3Z4N6A6.js";
 import "./chunk-SIGUWXAA.js";
 import "./chunk-DAKVBMD4.js";
 import {
@@ -6231,7 +6231,7 @@ async function runCliExecution(params) {
     governanceHandle,
     setConfig
   } = params;
-  const { execute } = await import("./execution-4RXQLDAF.js");
+  const { execute } = await import("./execution-EXDRBS4F.js");
   return execute(
     toExecuteDeps({
       core: {
@@ -8419,6 +8419,7 @@ ${diff}`;
 }
 
 // src/services/mcp-management.ts
+import { resolveMcpServerConfig } from "@wrongstack/core/infrastructure";
 import {
   color as color7,
   expectDefined as expectDefined4,
@@ -8534,7 +8535,7 @@ async function runAdd(name, enable, configured, configPath, mcpRegistry, all) {
   }
   try {
     if (mcpRegistry.list().some((server) => server.name === name)) {
-      await mcpRegistry.restart(name);
+      await mcpRegistry.restart(name, { ...nextCfg, name });
     } else {
       await mcpRegistry.start(nextCfg);
     }
@@ -8572,24 +8573,21 @@ async function runRemove(name, configured, configPath, mcpRegistry) {
 async function runEnable(name, configured, configPath, mcpRegistry) {
   const cfg = configured[name];
   if (!cfg) return `Server "${name}" is not in config. Run \`/mcp add ${name} --enable\` first.`;
+  const resolved = resolveMcpServerConfig(name, cfg);
+  if (!resolved) return `Server "${name}" has no transport and matches no preset.`;
+  const startCfg = { ...resolved, enabled: true };
+  const registered = mcpRegistry.list().some((server) => server.name === name);
   if (cfg.enabled !== false) {
-    try {
-      await mcpRegistry.restart(name);
-      return `${color7.green("\u25CF")} "${name}" is already enabled and running.`;
-    } catch {
-      await mcpRegistry.start({ ...cfg, enabled: true });
-      return `${color7.green("Enabled")} "${name}" and started.`;
-    }
+    if (registered) await mcpRegistry.restart(name, startCfg);
+    else await mcpRegistry.start(startCfg);
+    return `${color7.green("\u25CF")} "${name}" is already enabled and running.`;
   }
   await updateJsonObjectFile(configPath, (full) => {
     const current = isMcpServerRecord(full.mcpServers) ? full.mcpServers : {};
     setJsonPath(full, ["mcpServers", name], { ...cfg, ...current[name], enabled: true });
   });
-  try {
-    await mcpRegistry.restart(name);
-  } catch {
-    await mcpRegistry.start({ ...cfg, enabled: true });
-  }
+  if (registered) await mcpRegistry.restart(name, startCfg);
+  else await mcpRegistry.start(startCfg);
   return `${color7.green("Enabled")} "${name}" and started.`;
 }
 async function runDisable(name, configured, configPath, mcpRegistry) {
@@ -8642,6 +8640,8 @@ function stateBadge(state) {
       return color7.dim("\u25CB disconnected");
     case "failed":
       return color7.red("\u2717 failed");
+    case "dormant":
+      return color7.dim("\u25CC dormant (spawns on first call)");
     default:
       return color7.dim(state);
   }
@@ -8781,7 +8781,7 @@ async function checkUncommittedChanges(projectRoot) {
       stdout += data;
     });
     child.on("error", reject);
-    child.on("close", (code) => resolve9({ stdout, code: code ?? 0 }));
+    child.on("close", (code) => resolve9({ stdout, code: code ?? 1 }));
   });
   if (!result.stdout.trim()) return void 0;
   const count = result.stdout.split("\n").filter(Boolean).length;
@@ -17897,7 +17897,6 @@ function parseTaskEvidenceFlags(tokens) {
       }
       if (!inline && value.startsWith("-")) {
         warnings.push(`${key} expects a URL but none was provided`);
-        i++;
         continue;
       }
       if (!inline) i++;
@@ -17913,7 +17912,6 @@ function parseTaskEvidenceFlags(tokens) {
       }
       if (!inline && raw.startsWith("-")) {
         warnings.push(`${key} expects <checkId>=<status> but none was provided`);
-        i++;
         continue;
       }
       const sep2 = raw.lastIndexOf("=");
@@ -18148,10 +18146,16 @@ async function handleTaskSubcommand(opts, projectRoot, args, showHelp) {
     }
     if (board.lifecycle?.mode === "managed") {
       const stageToColumn = board.lifecycle?.columns ?? {};
-      const currentColumnId = board.tasks.find((t) => t.id === taskId)?.columnId;
+      const currentTask = board.tasks.find((t) => t.id === taskId);
+      if (!currentTask) {
+        return { message: color36.red("Task not found") };
+      }
       const currentStage = Object.entries(stageToColumn).find(
-        ([, columnId]) => columnId === currentColumnId
+        ([, columnId]) => columnId === currentTask.columnId
       )?.[0];
+      if (currentStage === "done") {
+        return { message: color36.yellow("Task is already in Done \u2014 nothing to do.") };
+      }
       const path35 = currentStage === "backlog" ? ["todo", "running", "review", "done"] : currentStage === "todo" ? ["running", "review", "done"] : currentStage === "running" ? ["review", "done"] : currentStage === "review" ? ["done"] : null;
       if (path35 === null) {
         return {
@@ -18160,10 +18164,6 @@ async function handleTaskSubcommand(opts, projectRoot, args, showHelp) {
           )
         };
       }
-      const currentTask = board.tasks.find((t) => t.id === taskId);
-      if (!currentTask) {
-        return { message: color36.red("Task not found") };
-      }
       const preflightIssues = [];
       if (!note?.trim()) {
         return {
@@ -19920,7 +19920,7 @@ async function runAudienceMemory(store, rest) {
     let imported = 0;
     let skipped = 0;
     for (const entry of entries) {
-      if (typeof entry.text !== "string" || !entry.text.trim()) {
+      if (!entry || typeof entry !== "object" || typeof entry.text !== "string" || !entry.text.trim()) {
         skipped++;
         continue;
       }
@@ -20234,6 +20234,8 @@ var MEMORY_KINDS = [
   "summary"
 ];
 var MEMORY_SCOPES = ["project", "user", "session", "file", "symbol"];
+var DECIMAL_RE = /^(?:\d+(?:\.\d*)?|\.\d+)$/;
+var INTEGER_RE = /^\d+$/;
 var MEMORY_STATUSES = [
   "active",
   "stale",
@@ -20258,7 +20260,7 @@ function parseMemoryFlags(tokens) {
       errors.push(`${name} needs a value between 0 and 1.`);
       return void 0;
     }
-    const parsed = Number.parseFloat(value);
+    const parsed = DECIMAL_RE.test(value) ? Number.parseFloat(value) : Number.NaN;
     if (!Number.isFinite(parsed) || parsed < 0 || parsed > 1) {
       errors.push(`${name} must be a number between 0 and 1 (got "${value}").`);
       return void 0;
@@ -20368,7 +20370,7 @@ function parseForFileFlags(tokens) {
         out.errors.push("--line needs a 1-indexed line number.");
         continue;
       }
-      const parsed = Number.parseInt(next, 10);
+      const parsed = INTEGER_RE.test(next) ? Number.parseInt(next, 10) : Number.NaN;
       if (!Number.isFinite(parsed) || parsed < 1) {
         out.errors.push(`--line must be a positive integer (got "${next}").`);
         continue;
@@ -20380,7 +20382,7 @@ function parseForFileFlags(tokens) {
         out.errors.push("--limit needs a value between 1 and 200.");
         continue;
       }
-      const parsed = Number.parseInt(next, 10);
+      const parsed = INTEGER_RE.test(next) ? Number.parseInt(next, 10) : Number.NaN;
       if (!Number.isFinite(parsed) || parsed < 1 || parsed > 200) {
         out.errors.push(`--limit must be between 1 and 200 (got "${next}").`);
         continue;
@@ -20880,7 +20882,8 @@ async function runStats(opts) {
       "anti_pattern",
       "untyped"
     ];
-    for (const t of typeOrder) {
+    const extraTypes = [...byType.keys()].filter((t) => !typeOrder.includes(t)).sort();
+    for (const t of [...typeOrder.slice(0, -1), ...extraTypes, "untyped"]) {
       const count = byType.get(t);
       if (count) {
         const bar2 = "\u2588".repeat(Math.min(count, 20));
@@ -26831,6 +26834,11 @@ import { leaderTierPolicy, listTierIds, resolveTier } from "@wrongstack/core/coo
 import { ConfigError as ConfigError6 } from "@wrongstack/core/types";
 import { atomicWrite as atomicWrite10, color as color54, toErrorMessage as toErrorMessage25 } from "@wrongstack/core/utils";
 var LEADER_MODES = ["off", "propose", "auto"];
+var DECIMAL_RE2 = /^(?:\d+(?:\.\d*)?|\.\d+)$/;
+var INTEGER_RE2 = /^\d+$/;
+function strictNumber(raw, pattern) {
+  return pattern.test(raw) ? Number(raw) : Number.NaN;
+}
 async function patchGlobalConfig3(globalConfigPath, mutate) {
   let raw = "{}";
   let fileExists2 = true;
@@ -27019,15 +27027,15 @@ function buildTierCommand(opts) {
               message: `${color54.amber("Usage:")} /tier budget <tier> <maxCostUsd> [maxIterations] [maxToolCalls]`
             };
           }
-          const usd = Number.parseFloat(parts[2] ?? "");
+          const usd = strictNumber(parts[2] ?? "", DECIMAL_RE2);
           if (!Number.isFinite(usd) || usd < 0) {
             return { message: `${color54.red("Invalid")} maxCostUsd: "${parts[2] ?? ""}"` };
           }
-          const iters = parts[3] !== void 0 ? Number.parseInt(parts[3], 10) : void 0;
+          const iters = parts[3] !== void 0 ? strictNumber(parts[3], INTEGER_RE2) : void 0;
           if (iters !== void 0 && (!Number.isFinite(iters) || iters < 0)) {
             return { message: `${color54.red("Invalid")} maxIterations: "${parts[3]}"` };
           }
-          const tools = parts[4] !== void 0 ? Number.parseInt(parts[4], 10) : void 0;
+          const tools = parts[4] !== void 0 ? strictNumber(parts[4], INTEGER_RE2) : void 0;
           if (tools !== void 0 && (!Number.isFinite(tools) || tools < 0)) {
             return { message: `${color54.red("Invalid")} maxToolCalls: "${parts[4]}"` };
           }
@@ -27057,6 +27065,12 @@ function buildTierCommand(opts) {
             for (const [key, value] of Object.entries(routing)) {
               if (value === tier) delete routing[key];
             }
+            if (tiers["default"] === tier) delete tiers["default"];
+            const leader = tiers["leader"];
+            if (leader && typeof leader === "object") {
+              const leaderRecord = leader;
+              if (leaderRecord["maxTier"] === tier) delete leaderRecord["maxTier"];
+            }
           });
           return { message: `${color54.green("\u2713")} tier ${color54.cyan(tier)} removed` };
         }
@@ -27117,7 +27131,7 @@ function buildTierCommand(opts) {
             };
           }
           if (action === "dwell") {
-            const turns = Number.parseInt(parts[2] ?? "", 10);
+            const turns = strictNumber(parts[2] ?? "", INTEGER_RE2);
             if (!Number.isFinite(turns) || turns < 0) {
               return { message: `${color54.amber("Usage:")} /tier leader dwell <turns>` };
             }
@@ -27180,7 +27194,7 @@ function buildAgentsCommand(opts) {
   return {
     name: "agents",
     category: "Agent",
-    description: "Monitor subagent activity: /agents [chat off|compact|full | stream on|off|status | list | show <id>]",
+    description: "Monitor subagent activity: /agents [chat off|full|status | stream on|off|status | list | show <id>]",
     async run(args) {
       if ((!args.trim() || args.trim() === "list") && opts.onPanelOpen?.current) {
         const opened = opts.onPanelOpen.current("toggleAgentsMonitor");
@@ -28217,7 +28231,7 @@ async function runGit2(args, cwd) {
       stdout += d;
     });
     child.on("error", () => resolve9({ stdout, code: 1 }));
-    child.on("close", (code) => resolve9({ stdout, code: code ?? 0 }));
+    child.on("close", (code) => resolve9({ stdout, code: code ?? 1 }));
   });
 }
 async function getChangedFiles(cwd) {
@@ -31323,8 +31337,8 @@ function buildTelegramSettingsCommand(opts) {
               message: `${color65.green("\u2713")} long-tool \u2192 ${color65.dim("off")}`
             };
           }
-          const ms = Number.parseInt(raw, 10);
-          if (Number.isNaN(ms) || ms < 0) {
+          const ms = /^\d+$/.test(raw) ? Number(raw) : Number.NaN;
+          if (!Number.isSafeInteger(ms)) {
             return {
               message: `${color65.red("Invalid number")}: "${raw}". Enter milliseconds, e.g. /telegram-settings long-tool 15000`
             };
@@ -31343,7 +31357,7 @@ function buildTelegramSettingsCommand(opts) {
               message: `${color65.amber("Usage:")} /telegram-settings poll <seconds>   ${color65.dim("(1\u201360)")}`
             };
           }
-          const sec = Number.parseInt(raw, 10);
+          const sec = /^\d+$/.test(raw) ? Number(raw) : Number.NaN;
           if (Number.isNaN(sec) || sec < 1 || sec > 60) {
             return {
               message: `${color65.red("Invalid value")}: "${raw}". Enter seconds between 1 and 60.`
@@ -34697,7 +34711,7 @@ import * as path29 from "node:path";
 import { getSharedProjectMailbox as getSharedProjectMailbox10 } from "@wrongstack/core/coordination";
 import { CouncilOrchestrator, OneShotOrchestrator as OneShotOrchestrator3 } from "@wrongstack/core/execution";
 import { countShellHooks, HookRegistry as HookRegistry2, HookRunner as HookRunner2, shellHooksEqual } from "@wrongstack/core/hooks";
-import { allServers as allServers3 } from "@wrongstack/core/infrastructure";
+import { resolveMcpServerConfig as resolveMcpServerConfig2 } from "@wrongstack/core/infrastructure";
 import { TOKENS as TOKENS11 } from "@wrongstack/core/kernel";
 import { NotifierImpl } from "@wrongstack/core/notifications";
 import {
@@ -35767,18 +35781,23 @@ async function setupLifecycleAndPlugins(deps) {
     log: logger,
     lazyMode: normalizeTokenSavingTier5(config.features.tokenSavingMode) !== "off",
     cacheDir: wpaths.cacheDir,
+    // Presets say `--project-root .`; resolve it against the project, not
+    // wherever this process happens to be running.
+    cwd: wpaths.projectRoot,
     authorizationProviderFactory: createVaultBackedMcpAuthorizationProviderFactory({
       store: mcpTokenStore
     }),
     authorizationManager: mcpAuthorizationManager
   });
   if (config.features.mcp) {
-    const presets = allServers3();
-    for (const cfg of Object.values(config.mcpServers ?? {})) {
-      const preset = presets[cfg.name];
-      const merged = preset ? { ...preset, ...cfg } : cfg;
-      void mcpRegistry.start(merged).catch((err) => {
-        logger.warn(`MCP server "${cfg.name}" failed to start`, err);
+    for (const [name, entry] of Object.entries(config.mcpServers ?? {})) {
+      const resolved = resolveMcpServerConfig2(name, entry);
+      if (!resolved) {
+        logger.warn(`MCP server "${name}" has no transport and matches no preset \u2014 skipped`);
+        continue;
+      }
+      void mcpRegistry.start(resolved).catch((err) => {
+        logger.warn(`MCP server "${name}" failed to start`, err);
       });
     }
   }
@@ -38936,4 +38955,4 @@ export {
   CLI_VERSION,
   runInteractive
 };
-//# sourceMappingURL=cli-main-4E4YMCNS.js.map
+//# sourceMappingURL=cli-main-WC5JNIWY.js.map

package/dist/{diag-doctor-PCER6KHH.js → diag-doctor-ANPRUYFM.js}

@@ -13,6 +13,7 @@ import {
 import * as fs2 from "node:fs/promises";
 import * as os from "node:os";
 import * as path2 from "node:path";
+import { resolveMcpServerConfig } from "@wrongstack/core/infrastructure";
 import { color, toErrorMessage } from "@wrongstack/core/utils";
 import {
   applyProxyConfig,
@@ -328,8 +329,17 @@ var doctorCmd = async (args, deps) => {
     });
   }
   const mcpEntries = Object.entries(cfg.mcpServers ?? {});
-  for (const [name, srv] of mcpEntries) {
-    if (!srv.enabled) continue;
+  for (const [name, entry] of mcpEntries) {
+    if (entry.enabled === false) continue;
+    const srv = resolveMcpServerConfig(name, entry);
+    if (!srv) {
+      checks.push({
+        name: `mcp:${name}`,
+        status: "fail",
+        detail: "no transport and no built-in preset of this name"
+      });
+      continue;
+    }
     if ((srv.transport === "sse" || srv.transport === "streamable-http") && !srv.url)
       checks.push({ name: `mcp:${name}`, status: "fail", detail: "transport requires url" });
     else if (srv.transport === "stdio" && !srv.command)
@@ -382,4 +392,4 @@ export {
   doctorCmd,
   proxyCmd
 };
-//# sourceMappingURL=diag-doctor-PCER6KHH.js.map
+//# sourceMappingURL=diag-doctor-ANPRUYFM.js.map

package/dist/{execution-4RXQLDAF.js → execution-EXDRBS4F.js}

@@ -4,7 +4,7 @@ import {
   runGit,
   setAutoSuggestions,
   setSuggestions
-} from "./chunk-SXJTVNWF.js";
+} from "./chunk-OWNC7LMD.js";
 import {
   deriveFsAccessPair,
   filterSafeForProject,
@@ -6953,4 +6953,4 @@ export {
   execute,
   resolveReviewerFallbackModels
 };
-//# sourceMappingURL=execution-4RXQLDAF.js.map
+//# sourceMappingURL=execution-EXDRBS4F.js.map

package/dist/{hq-DQTUE7RC.js → hq-NO2NWGU4.js}

@@ -14,9 +14,11 @@ import {
 
 // src/subcommands/handlers/hq.ts
 import * as fs from "node:fs/promises";
+import * as path from "node:path";
 import {
   HQ_AUTH_FILE_VERSION,
   HQ_CLI_DEFAULT_HOST,
+  HqAlertEngine,
   HqInsecureExposureError,
   hqAuthAuditPath,
   hqAuthContentHash,
@@ -25,6 +27,7 @@ import {
   logHqAuthAudit,
   mintHqToken,
   mutateHqAuthFile,
+  readHqAlertsConfig,
   readHqAuthFile,
   resolveHqDataDir
 } from "@wrongstack/core/hq";
@@ -48,6 +51,9 @@ var hqCmd = async (args, deps) => {
   if (sub === "audit") {
     return hqAuditCmd(args.slice(1), deps);
   }
+  if (sub === "alerts") {
+    return hqAlertsCmd(args.slice(1), deps);
+  }
   if (sub === "service") {
     const { hqServiceCmd } = await import("./hq-service-L5INQFM4.js");
     return hqServiceCmd(args.slice(1), deps);
@@ -62,7 +68,7 @@ var hqCmd = async (args, deps) => {
   return 1;
 };
 async function startServer(deps) {
-  const { startHqServer } = await import("./hq-server-JJFGFWI5.js");
+  const { startHqServer } = await import("./hq-server-KE5YDNGG.js");
   const dataDir = resolveDataDir(deps);
   const flags = deps.flags ?? {};
   const rawPublicUrl = typeof flags["hq-public-url"] === "string" ? flags["hq-public-url"] : process.env.WRONGSTACK_HQ_PUBLIC_URL;
@@ -188,7 +194,7 @@ async function startServer(deps) {
     ipAllowlist === void 0 ? "Network allowlist: disabled (authentication remains required when configured).\n" : `Network allowlist: active (${ipAllowlist.length} configured rule${ipAllowlist.length === 1 ? "" : "s"} + loopback).
 `
   );
-  await new Promise((resolve) => {
+  await new Promise((resolve2) => {
     const shutdown = async () => {
       try {
         await handle.close();
@@ -196,7 +202,7 @@ async function startServer(deps) {
         deps.renderer.write(`HQ server close error: ${String(err)}
 `);
       }
-      resolve();
+      resolve2();
     };
     process.on("SIGINT", shutdown);
     process.on("SIGTERM", shutdown);
@@ -807,7 +813,7 @@ function printAuditHelp(deps) {
 `
   );
   deps.renderer.write(
-    `                           auth.json and print it so an operator can compare
+    `                           on-disk auth.json and print it so an operator can compare
 `
   );
   deps.renderer.write(
@@ -825,8 +831,150 @@ function printAuditHelp(deps) {
   deps.renderer.write(`Run \`wstack hq --help\` for the full HQ command list.
 `);
 }
+async function hqAlertsCmd(args, deps) {
+  const action = args[0];
+  if (deps.flags?.["help"] === true || action === "help" || action === "--help") {
+    printAlertsHelp(deps);
+    return 0;
+  }
+  if (action === "eval" || action === void 0) {
+    return hqAlertsEval(args.slice(1), deps);
+  }
+  deps.renderer.writeError(`Unknown hq alerts subcommand: ${action ?? "(none)"}
+`);
+  printAlertsHelp(deps);
+  return 1;
+}
+async function hqAlertsEval(_args, deps) {
+  const flags = deps.flags ?? {};
+  const snapshotArg = typeof flags["snapshot"] === "string" ? flags["snapshot"] : void 0;
+  let snapshotPath;
+  try {
+    if (snapshotArg !== void 0) {
+      snapshotPath = path.resolve(snapshotArg);
+    } else {
+      const dataDir2 = resolveDataDir(deps);
+      snapshotPath = path.join(dataDir2, "snapshot.json");
+    }
+  } catch (err) {
+    deps.renderer.writeError(`Failed to resolve snapshot path: ${err.message}
+`);
+    return 2;
+  }
+  let raw;
+  try {
+    raw = await fs.readFile(snapshotPath, "utf8");
+  } catch (err) {
+    deps.renderer.writeError(
+      `Cannot read snapshot at ${snapshotPath}: ${err.message}
+Pass --snapshot <path> to evaluate against a specific file.
+`
+    );
+    return 2;
+  }
+  let snapshot;
+  try {
+    snapshot = JSON.parse(raw);
+  } catch (err) {
+    deps.renderer.writeError(
+      `Snapshot at ${snapshotPath} is not valid JSON: ${err.message}
+`
+    );
+    return 2;
+  }
+  const dataDir = resolveDataDir(deps);
+  let thresholds;
+  try {
+    const config = await readHqAlertsConfig(dataDir);
+    thresholds = config.thresholds;
+  } catch {
+  }
+  const engine = new HqAlertEngine({
+    onAlert: () => {
+    }
+  });
+  let fired;
+  try {
+    fired = engine.evaluate(snapshot, thresholds);
+  } catch (err) {
+    deps.renderer.writeError(`Alert evaluation failed: ${err.message}
+`);
+    return 2;
+  }
+  if (fired.length === 0) {
+    deps.renderer.write(`No alert rules fired against ${snapshotPath}.
+`);
+    if (thresholds === void 0) {
+      deps.renderer.write(
+        "(No persisted thresholds; using built-in defaults. Run `wstack hq alerts` with a populated alerts-config.json to override.)\n"
+      );
+    }
+    return 0;
+  }
+  deps.renderer.write(`${fired.length} alert rule(s) fired against ${snapshotPath}:
+`);
+  for (const alert of fired) {
+    deps.renderer.write(`  [${alert.severity}] ${alert.ruleId}: ${alert.message}
+`);
+  }
+  return 1;
+}
+function printAlertsHelp(deps) {
+  deps.renderer.write(`Usage: wstack hq alerts <eval>
+`);
+  deps.renderer.write("\n");
+  deps.renderer.write(
+    `  wstack hq alerts eval [--snapshot <path>]   Run HqAlertEngine.evaluate() against a
+`
+  );
+  deps.renderer.write(
+    `                                            snapshot file (or the live <dataDir>/
+`
+  );
+  deps.renderer.write(
+    `                                            snapshot.json). Pure-function dry run;
+`
+  );
+  deps.renderer.write(
+    `                                            no server required. Exits 0 when no
+`
+  );
+  deps.renderer.write(
+    `                                            rules fire, 1 when rules fire, 2 on errors.
+`
+  );
+  deps.renderer.write("\n");
+  deps.renderer.write(
+    `Persisted thresholds (<dataDir>/alerts-config.json) are loaded automatically when
+`
+  );
+  deps.renderer.write(
+    `present; otherwise the engine's built-in defaults apply. Snoozes are NOT honored
+`
+  );
+  deps.renderer.write(
+    `by this command \u2014 eval is a "what would fire RIGHT NOW if there were no snoozes"
+`
+  );
+  deps.renderer.write(`probe.
+`);
+  deps.renderer.write("\n");
+  deps.renderer.write(`Flags:
+`);
+  deps.renderer.write(
+    `  --snapshot <path>   Evaluate against this snapshot file instead of the live one.
+`
+  );
+  deps.renderer.write(
+    `  --data-dir <path>   Override HQ data directory (default ~/.wrongstack/hq).
+`
+  );
+  deps.renderer.write("\n");
+  deps.renderer.write(`Run \`wstack hq --help\` for the full HQ command list.
+`);
+}
 export {
   hqCmd,
   resolveAuditActor
 };
-//# sourceMappingURL=hq-DQTUE7RC.js.map
+//# sourceMappingURL=hq-NO2NWGU4.js.map

package/dist/hq-server/auth-state.d.ts

@@ -26,6 +26,17 @@ interface HqAuthStateOptions {
      * makes the latch unconditional.
      */
     onApplied?: ((mutableAuth: HqRouterMutableAuth) => void) | undefined;
+    /**
+     * Invoked when browser tokens stopped being live — revoked by hand, or aged
+     * out — during an {@link HqAuthState.apply}. `keys` are the stored verifiers,
+     * `ids` the token ids of those that had one.
+     *
+     * W4 #15: an open WebSocket never re-presents its credential, so before this
+     * a revoked operator kept a working dashboard until the idle-eviction pass
+     * happened to catch them. Reporting the change at the single projection
+     * choke point is what lets the server close those sockets immediately.
+     */
+    onTokensRevoked?: ((keys: readonly string[], ids: readonly string[]) => void) | undefined;
 }
 /**
  * Project an `auth.json` document onto the live `mutableAuth` used by every