@wrongstack/cli 1.1.2 → 1.1.5

package/dist/{chunk-AWRZWPJ3.js → chunk-JFYQGMMM.js}

@@ -24,7 +24,7 @@ import {
   sanitizeApiError,
   truncateHqSummary,
   writeInvalidBody
-} from "./chunk-3EXRPTAU.js";
+} from "./chunk-5TQ65PXQ.js";
 import {
   createHqIpAllowlist
 } from "./chunk-OGVSKS4Q.js";
@@ -3839,9 +3839,6 @@ function createHqSocketCredentialEnforcer(state) {
   };
 }
 
-// src/hq-server/upgrade-handler.ts
-import { hqTokenVerifier as hqTokenVerifier2, isLoopbackHost as isLoopbackHost3, isTokenExpired as isTokenExpired5 } from "@wrongstack/core/hq";
-
 // src/hq-server/ws.ts
 import { randomUUID as randomUUID5 } from "node:crypto";
 import {
@@ -4706,7 +4703,91 @@ function handleClient(ws, clients, browsers, eventLog, auth, snapshotBroadcaster
   });
 }
 
+// src/hq-server/sweeps.ts
+var HQ_SESSION_MAX_AGE_MS2 = 7 * 24 * 60 * 60 * 1e3;
+var HQ_SESSION_IDLE_TIMEOUT_MS2 = 30 * 6e4;
+var PENDING_2FA_TTL_MS2 = 5 * 6e4;
+var HQ_SESSION_CLEANUP_INTERVAL_MS = 6e4;
+function sweepHqBrowserSessions(sessions, loginAttempts, socketCredentials) {
+  const now = Date.now();
+  const maxAgeCutoff = now - HQ_SESSION_MAX_AGE_MS2;
+  const idleCutoff = now - HQ_SESSION_IDLE_TIMEOUT_MS2;
+  const pending2faCutoff = now - PENDING_2FA_TTL_MS2;
+  for (const [id, session] of sessions) {
+    if (session.createdAt < maxAgeCutoff) {
+      sessions.delete(id);
+      socketCredentials.closeSessionSockets(id, "Browser session expired");
+      continue;
+    }
+    if (session.pending2fa) {
+      if (session.createdAt < pending2faCutoff) sessions.delete(id);
+      continue;
+    }
+    if (session.lastSeenAt < idleCutoff) {
+      sessions.delete(id);
+    }
+  }
+  for (const [ip, entry] of loginAttempts.entries()) {
+    if (now - entry.lastAttempt > 15 * 6e4) loginAttempts.delete(ip);
+  }
+}
+function sweepStaleHqClients({
+  clients,
+  browsers,
+  auditLog,
+  eventLog,
+  persistence,
+  clientTtlMs,
+  sessionSnapshotTtlMs
+}) {
+  const cutoff = Date.now() - clientTtlMs;
+  const sessionCutoff = Date.now() - sessionSnapshotTtlMs;
+  let changed = false;
+  for (const [ws, client] of clients.entries()) {
+    if (new Date(client.lastSeenAt).getTime() < cutoff) {
+      const lostClient = client;
+      ws.terminate();
+      clients.delete(ws);
+      failUndeliveredCommands(lostClient, browsers, auditLog);
+      detectLeaderLoss(lostClient, clients, browsers, "heartbeat-timeout", {
+        eventLog,
+        persistence
+      });
+      changed = true;
+      continue;
+    }
+    const expiredSessions = /* @__PURE__ */ new Set();
+    for (const [sessionId, tracked] of client.sessions.entries()) {
+      if (tracked.receivedAt < sessionCutoff) {
+        client.sessions.delete(sessionId);
+        client.mcpSnapshots.delete(sessionId);
+        expiredSessions.add(sessionId);
+        changed = true;
+      }
+    }
+    for (const [runId, fleet] of client.fleets) {
+      if (fleet.sessionId !== void 0 && expiredSessions.has(fleet.sessionId)) {
+        client.fleets.delete(runId);
+        changed = true;
+      }
+    }
+    if (client.capabilities.includes("session.summary") && client.sessions.size === 0 && Date.now() - Date.parse(client.connectedAt) > sessionSnapshotTtlMs) {
+      const lostClient = client;
+      ws.terminate();
+      clients.delete(ws);
+      failUndeliveredCommands(lostClient, browsers, auditLog);
+      detectLeaderLoss(lostClient, clients, browsers, "crash", {
+        eventLog,
+        persistence
+      });
+      changed = true;
+    }
+  }
+  return changed;
+}
+
 // src/hq-server/upgrade-handler.ts
+import { hqTokenVerifier as hqTokenVerifier2, isLoopbackHost as isLoopbackHost3, isTokenExpired as isTokenExpired5 } from "@wrongstack/core/hq";
 function handleHqUpgrade(req, socket, head, deps) {
   const url = new URL(req.url ?? "/", `http://${deps.host}:${deps.port}`);
   const pathname = url.pathname;
@@ -4964,33 +5045,10 @@ async function startHqServerWithAuth(options, host, port, dataDir, firstRunAuth)
       mutableAuth,
       sessions
     });
-    const HQ_SESSION_MAX_AGE_MS2 = 7 * 24 * 60 * 60 * 1e3;
-    const HQ_SESSION_IDLE_TIMEOUT_MS2 = 30 * 6e4;
-    const SESSION_CLEANUP_INTERVAL_MS = 6e4;
-    const PENDING_2FA_TTL_MS2 = 5 * 6e4;
-    const sessionCleanupTimer = setInterval(() => {
-      const now = Date.now();
-      const maxAgeCutoff = now - HQ_SESSION_MAX_AGE_MS2;
-      const idleCutoff = now - HQ_SESSION_IDLE_TIMEOUT_MS2;
-      const pending2faCutoff = now - PENDING_2FA_TTL_MS2;
-      for (const [id, session] of sessions) {
-        if (session.createdAt < maxAgeCutoff) {
-          sessions.delete(id);
-          socketCredentials.closeSessionSockets(id, "Browser session expired");
-          continue;
-        }
-        if (session.pending2fa) {
-          if (session.createdAt < pending2faCutoff) sessions.delete(id);
-          continue;
-        }
-        if (session.lastSeenAt < idleCutoff) {
-          sessions.delete(id);
-        }
-      }
-      for (const [ip, entry] of loginAttempts.entries()) {
-        if (now - entry.lastAttempt > 15 * 6e4) loginAttempts.delete(ip);
-      }
-    }, SESSION_CLEANUP_INTERVAL_MS);
+    const sessionCleanupTimer = setInterval(
+      () => sweepHqBrowserSessions(sessions, loginAttempts, socketCredentials),
+      HQ_SESSION_CLEANUP_INTERVAL_MS
+    );
     sessionCleanupTimer.unref?.();
     const persistence = createHqPersistence(dataDir);
     const auditLog = new HqCommandAuditLog(1e3, (entry) => persistence.commandLog.append(entry));
@@ -5065,49 +5123,15 @@ async function startHqServerWithAuth(options, host, port, dataDir, firstRunAuth)
     const sessionSnapshotTtlMs = options.sessionSnapshotTtlMs ?? SESSION_SNAPSHOT_TTL_MS;
     const cleanupTimer = setInterval(() => {
       socketCredentials.sweepExpiredSocketCredentials();
-      const cutoff = Date.now() - clientTtlMs;
-      const sessionCutoff = Date.now() - sessionSnapshotTtlMs;
-      let changed = false;
-      for (const [ws, client] of clients.entries()) {
-        if (new Date(client.lastSeenAt).getTime() < cutoff) {
-          const lostClient = client;
-          ws.terminate();
-          clients.delete(ws);
-          failUndeliveredCommands(lostClient, browsers, auditLog);
-          detectLeaderLoss(lostClient, clients, browsers, "heartbeat-timeout", {
-            eventLog,
-            persistence
-          });
-          changed = true;
-          continue;
-        }
-        const expiredSessions = /* @__PURE__ */ new Set();
-        for (const [sessionId, tracked] of client.sessions.entries()) {
-          if (tracked.receivedAt < sessionCutoff) {
-            client.sessions.delete(sessionId);
-            client.mcpSnapshots.delete(sessionId);
-            expiredSessions.add(sessionId);
-            changed = true;
-          }
-        }
-        for (const [runId, fleet] of client.fleets) {
-          if (fleet.sessionId !== void 0 && expiredSessions.has(fleet.sessionId)) {
-            client.fleets.delete(runId);
-            changed = true;
-          }
-        }
-        if (client.capabilities.includes("session.summary") && client.sessions.size === 0 && Date.now() - Date.parse(client.connectedAt) > sessionSnapshotTtlMs) {
-          const lostClient = client;
-          ws.terminate();
-          clients.delete(ws);
-          failUndeliveredCommands(lostClient, browsers, auditLog);
-          detectLeaderLoss(lostClient, clients, browsers, "crash", {
-            eventLog,
-            persistence
-          });
-          changed = true;
-        }
-      }
+      const changed = sweepStaleHqClients({
+        clients,
+        browsers,
+        auditLog,
+        eventLog,
+        persistence,
+        clientTtlMs,
+        sessionSnapshotTtlMs
+      });
       if (changed) snapshotBroadcaster.broadcast();
     }, options.clientCleanupIntervalMs ?? CLIENT_CLEANUP_INTERVAL_MS);
     cleanupTimer.unref?.();
@@ -5361,4 +5385,4 @@ export {
   startHqServer,
   HqInsecureExposureError2 as HqInsecureExposureError
 };
-//# sourceMappingURL=chunk-AWRZWPJ3.js.map
+//# sourceMappingURL=chunk-JFYQGMMM.js.map

package/dist/{chunk-BIGSVBPI.js → chunk-KNYIEQAY.js}

@@ -1,18 +1,19 @@
 
 // src/config-history.ts
 import { randomUUID } from "node:crypto";
+import * as fs2 from "node:fs/promises";
+import * as path2 from "node:path";
+import { isSecretField as isSecretField2 } from "@wrongstack/core/security";
+import { ERROR_CODES as ERROR_CODES2, FsError as FsError2 } from "@wrongstack/core/types";
+import { atomicWrite, toErrorMessage, withFileLock, writeErr } from "@wrongstack/core/utils";
+
+// src/config-history-support.ts
 import * as fs from "node:fs/promises";
 import os from "node:os";
 import * as path from "node:path";
 import { isSecretField } from "@wrongstack/core/security";
 import { ERROR_CODES, FsError } from "@wrongstack/core/types";
-import {
-  atomicWrite,
-  resolveWstackPaths,
-  toErrorMessage,
-  withFileLock,
-  writeErr
-} from "@wrongstack/core/utils";
+import { resolveWstackPaths } from "@wrongstack/core/utils";
 var defaultUidFn = () => os.userInfo().uid;
 async function getFileUid(filePath) {
   try {
@@ -32,8 +33,6 @@ async function checkConfigOwnership(homeFn, uidFn = defaultUidFn, targetConfigPa
   return fileUid === callerUid;
 }
 var PROTECTED_BASENAMES = /* @__PURE__ */ new Set(["config.json", ".key", "index.json"]);
-var MAX_CONFIG_BACKUPS = 10;
-var MAX_CONFIG_HISTORY_ENTRIES = 50;
 function assertSafeToDelete(filename, parentDir) {
   if (PROTECTED_BASENAMES.has(filename)) {
     throw new FsError({
@@ -72,19 +71,6 @@ function assertSafeToDelete(filename, parentDir) {
     });
   }
 }
-async function safeDelete(filePath) {
-  const dir = path.dirname(filePath);
-  const filename = path.basename(filePath);
-  try {
-    assertSafeToDelete(filename, dir);
-    await fs.unlink(filePath);
-  } catch (err) {
-    if (err instanceof Error && err.message.startsWith("Refusing")) {
-      writeErr(`[config-history] SAFETY: ${err.message}
-`);
-    }
-  }
-}
 var REDACTED = "[REDACTED]";
 function maskValue(v) {
   if (Array.isArray(v)) return v.map(maskValue);
@@ -130,6 +116,31 @@ function reviveSecrets(masked, current) {
   }
   return out;
 }
+var defaultHomeDir = () => os.homedir();
+function activeProfileConfigPath(homeFn) {
+  const paths = homeFn === defaultHomeDir ? resolveWstackPaths({ projectRoot: process.cwd() }) : resolveWstackPaths({ projectRoot: process.cwd(), userHome: homeFn() });
+  return paths.profileConfig(paths.profileName);
+}
+function configPath(homeFn = defaultHomeDir, targetConfigPath) {
+  return targetConfigPath ?? activeProfileConfigPath(homeFn);
+}
+
+// src/config-history.ts
+var MAX_CONFIG_BACKUPS = 10;
+var MAX_CONFIG_HISTORY_ENTRIES = 50;
+async function safeDelete(filePath) {
+  const dir = path2.dirname(filePath);
+  const filename = path2.basename(filePath);
+  try {
+    assertSafeToDelete(filename, dir);
+    await fs2.unlink(filePath);
+  } catch (err) {
+    if (err instanceof Error && err.message.startsWith("Refusing")) {
+      writeErr(`[config-history] SAFETY: ${err.message}
+`);
+    }
+  }
+}
 function diffSummary(oldCfg, newCfg) {
   const changes = [];
   const allKeys = /* @__PURE__ */ new Set([...Object.keys(oldCfg), ...Object.keys(newCfg)]);
@@ -137,7 +148,7 @@ function diffSummary(oldCfg, newCfg) {
     const o = JSON.stringify(oldCfg[k]);
     const n = JSON.stringify(newCfg[k]);
     if (o !== n) {
-      if (isSecretField(k)) {
+      if (isSecretField2(k)) {
         changes.push(`${k}: [CHANGED]`);
       } else if (typeof newCfg[k] !== "object") {
         changes.push(`${k}: ${oldCfg[k] ?? "(unset)"} \u2192 ${newCfg[k]}`);
@@ -148,24 +159,16 @@ function diffSummary(oldCfg, newCfg) {
   }
   return changes.length > 0 ? changes.slice(0, 5).join(", ") : "no changes";
 }
-var defaultHomeDir = () => os.homedir();
-function activeProfileConfigPath(homeFn) {
-  const paths = homeFn === defaultHomeDir ? resolveWstackPaths({ projectRoot: process.cwd() }) : resolveWstackPaths({ projectRoot: process.cwd(), userHome: homeFn() });
-  return paths.profileConfig(paths.profileName);
-}
 function historyDir(homeFn = defaultHomeDir, targetConfigPath) {
-  return path.join(path.dirname(configPath(homeFn, targetConfigPath)), "config.history", "entries");
+  return path2.join(path2.dirname(configPath(homeFn, targetConfigPath)), "config.history", "entries");
 }
 function historyIndexPath(homeFn = defaultHomeDir, targetConfigPath) {
-  return path.join(
-    path.dirname(configPath(homeFn, targetConfigPath)),
+  return path2.join(
+    path2.dirname(configPath(homeFn, targetConfigPath)),
     "config.history",
     "index.json"
   );
 }
-function configPath(homeFn = defaultHomeDir, targetConfigPath) {
-  return targetConfigPath ?? activeProfileConfigPath(homeFn);
-}
 function backupLastPath(homeFn = defaultHomeDir, targetConfigPath) {
   return `${configPath(homeFn, targetConfigPath)}.last`;
 }
@@ -174,11 +177,11 @@ function entryId(ts) {
 }
 async function ensureHistoryDir(homeFn = defaultHomeDir, targetConfigPath) {
   try {
-    await fs.mkdir(historyDir(homeFn, targetConfigPath), { recursive: true });
+    await fs2.mkdir(historyDir(homeFn, targetConfigPath), { recursive: true });
   } catch (err) {
-    throw new FsError({
+    throw new FsError2({
       message: toErrorMessage(err),
-      code: ERROR_CODES.FS_MKDIR_FAILED,
+      code: ERROR_CODES2.FS_MKDIR_FAILED,
       path: historyDir(homeFn, targetConfigPath),
       cause: err
     });
@@ -187,7 +190,7 @@ async function ensureHistoryDir(homeFn = defaultHomeDir, targetConfigPath) {
 async function readIndex(homeFn = defaultHomeDir, targetConfigPath) {
   let raw;
   try {
-    raw = await fs.readFile(historyIndexPath(homeFn, targetConfigPath), "utf8");
+    raw = await fs2.readFile(historyIndexPath(homeFn, targetConfigPath), "utf8");
   } catch (err) {
     if (err.code !== "ENOENT") throw err;
     return rebuildIndexFromEntries(homeFn, targetConfigPath);
@@ -208,7 +211,7 @@ async function rebuildIndexFromEntries(homeFn = defaultHomeDir, targetConfigPath
   const dir = historyDir(homeFn, targetConfigPath);
   let files;
   try {
-    files = (await fs.readdir(dir)).filter((file) => file.endsWith(".json"));
+    files = (await fs2.readdir(dir)).filter((file) => file.endsWith(".json"));
   } catch (err) {
     if (err.code === "ENOENT") return { version: 1, entries: [] };
     throw err;
@@ -218,7 +221,7 @@ async function rebuildIndexFromEntries(homeFn = defaultHomeDir, targetConfigPath
     const id = file.slice(0, -".json".length);
     let raw;
     try {
-      raw = await fs.readFile(path.join(dir, file), "utf8");
+      raw = await fs2.readFile(path2.join(dir, file), "utf8");
     } catch (err) {
       if (err.code === "ENOENT") continue;
       entries.push({ id, timestamp: "", description: "" });
@@ -244,9 +247,9 @@ async function writeIndex(idx, homeFn = defaultHomeDir, targetConfigPath) {
   try {
     await atomicWrite(historyIndexPath(homeFn, targetConfigPath), JSON.stringify(idx, null, 2));
   } catch (err) {
-    throw new FsError({
+    throw new FsError2({
       message: toErrorMessage(err),
-      code: ERROR_CODES.FS_ATOMIC_WRITE_FAILED,
+      code: ERROR_CODES2.FS_ATOMIC_WRITE_FAILED,
       path: historyIndexPath(homeFn, targetConfigPath),
       cause: err
     });
@@ -258,16 +261,16 @@ async function pruneHistoryEntries(idx, homeFn = defaultHomeDir, targetConfigPat
   const dir = historyDir(homeFn, targetConfigPath);
   for (const entry of removed) {
     try {
-      await fs.unlink(path.join(dir, `${entry.id}.json`));
+      await fs2.unlink(path2.join(dir, `${entry.id}.json`));
     } catch {
     }
   }
   try {
-    const files = await fs.readdir(dir);
+    const files = await fs2.readdir(dir);
     await Promise.all(
       files.filter((file) => file.endsWith(".json") && !keep.has(file)).map(async (file) => {
         try {
-          await fs.unlink(path.join(dir, file));
+          await fs2.unlink(path2.join(dir, file));
         } catch {
         }
       })
@@ -281,7 +284,7 @@ async function backupCurrent(homeFn = defaultHomeDir, targetConfigPath) {
   const ts = Date.now();
   let content;
   try {
-    content = await fs.readFile(cfg, "utf8");
+    content = await fs2.readFile(cfg, "utf8");
   } catch {
   }
   if (content !== void 0) {
@@ -300,11 +303,11 @@ async function backupCurrent(homeFn = defaultHomeDir, targetConfigPath) {
     }
   }
   try {
-    const dir = path.dirname(cfg);
-    const files = await fs.readdir(dir);
+    const dir = path2.dirname(cfg);
+    const files = await fs2.readdir(dir);
     const baks = files.filter((f) => f.startsWith("config.json.") && f.endsWith(".bak")).sort().reverse();
     for (const f of baks.slice(MAX_CONFIG_BACKUPS)) {
-      await safeDelete(path.join(dir, f));
+      await safeDelete(path2.join(dir, f));
     }
   } catch (err) {
     writeErr(`[config-history] backup prune failed: ${toErrorMessage(err)}`);
@@ -322,16 +325,16 @@ async function appendHistory(oldCfg, newCfg, description, homeFn = defaultHomeDi
     diffSummary: diffSummary(oldCfg, newCfg)
   };
   try {
-    await fs.writeFile(
-      path.join(historyDir(homeFn, targetConfigPath), `${id}.json`),
+    await fs2.writeFile(
+      path2.join(historyDir(homeFn, targetConfigPath), `${id}.json`),
       JSON.stringify(entry, null, 2),
       { encoding: "utf8", mode: 384 }
     );
   } catch (err) {
-    throw new FsError({
+    throw new FsError2({
       message: toErrorMessage(err),
-      code: ERROR_CODES.FS_WRITE_FAILED,
-      path: path.join(historyDir(homeFn, targetConfigPath), `${id}.json`),
+      code: ERROR_CODES2.FS_WRITE_FAILED,
+      path: path2.join(historyDir(homeFn, targetConfigPath), `${id}.json`),
       cause: err
     });
   }
@@ -350,10 +353,10 @@ async function listHistory(homeFn = defaultHomeDir, targetConfigPath) {
 }
 async function getHistoryEntry(id, homeFn = defaultHomeDir, targetConfigPath) {
   const dir = historyDir(homeFn, targetConfigPath);
-  const filePath = path.join(dir, `${id}.json`);
-  if (path.dirname(path.resolve(filePath)) !== path.resolve(dir)) return null;
+  const filePath = path2.join(dir, `${id}.json`);
+  if (path2.dirname(path2.resolve(filePath)) !== path2.resolve(dir)) return null;
   try {
-    const raw = await fs.readFile(filePath, "utf8");
+    const raw = await fs2.readFile(filePath, "utf8");
     return JSON.parse(raw);
   } catch {
     return null;
@@ -374,7 +377,7 @@ async function restoreFromHistory(id, homeFn = defaultHomeDir, targetConfigPath)
     await backupCurrent(homeFn, targetConfigPath);
     let oldCfg = {};
     try {
-      const raw = await fs.readFile(cfg, "utf8");
+      const raw = await fs2.readFile(cfg, "utf8");
       oldCfg = JSON.parse(raw);
     } catch {
     }
@@ -399,7 +402,7 @@ async function restoreLast(homeFn = defaultHomeDir, targetConfigPath) {
   const cfg = configPath(homeFn, targetConfigPath);
   let lastCfg = {};
   try {
-    const raw = await fs.readFile(last, "utf8");
+    const raw = await fs2.readFile(last, "utf8");
     lastCfg = JSON.parse(raw);
   } catch {
     return { ok: false, error: "No prior backup found" };
@@ -410,7 +413,7 @@ async function restoreLast(homeFn = defaultHomeDir, targetConfigPath) {
   return withFileLock(cfg, async () => {
     let oldCfg = {};
     try {
-      const raw = await fs.readFile(cfg, "utf8");
+      const raw = await fs2.readFile(cfg, "utf8");
       oldCfg = JSON.parse(raw);
     } catch {
     }
@@ -439,4 +442,4 @@ export {
   restoreFromHistory,
   restoreLast
 };
-//# sourceMappingURL=chunk-BIGSVBPI.js.map
+//# sourceMappingURL=chunk-KNYIEQAY.js.map

package/dist/chunk-LUEO5HLZ.js

@@ -0,0 +1,50 @@
+
+// src/acp-leader/acp-leader-host.ts
+var ACP_LEADER_PROVIDER_ID = "acp";
+var bound;
+var sessionAgents;
+function setAcpLeaderSessionAgents(resolve) {
+  sessionAgents = resolve;
+}
+function acpLeaderSessionAgent(sessionId) {
+  return sessionAgents?.(sessionId);
+}
+function bindAcpLeaderHost(host) {
+  bound = host;
+}
+function acpLeaderHost() {
+  return bound;
+}
+function confirmAcpLeaderThroughEvents() {
+  if (bound) bound = { ...bound, confirmAwaiter: void 0, confirmThroughEvents: true };
+}
+var liveLeaders = /* @__PURE__ */ new Set();
+function trackAcpLeader(leader) {
+  liveLeaders.add(leader);
+}
+async function closeAcpLeaderSessions(timeoutMs = 1500) {
+  if (liveLeaders.size === 0) return;
+  const all = [...liveLeaders];
+  liveLeaders.clear();
+  let timer;
+  await Promise.race([
+    Promise.all(all.map((leader) => leader.closeAll().catch(() => void 0))),
+    new Promise((resolve) => {
+      timer = setTimeout(resolve, timeoutMs);
+      timer.unref?.();
+    })
+  ]);
+  if (timer) clearTimeout(timer);
+}
+
+export {
+  ACP_LEADER_PROVIDER_ID,
+  setAcpLeaderSessionAgents,
+  acpLeaderSessionAgent,
+  bindAcpLeaderHost,
+  acpLeaderHost,
+  confirmAcpLeaderThroughEvents,
+  trackAcpLeader,
+  closeAcpLeaderSessions
+};
+//# sourceMappingURL=chunk-LUEO5HLZ.js.map