@wrongstack/cli 1.1.4 → 1.1.5

package/dist/{chunk-VAQXOZKP.js → chunk-AJM4EFCM.js}

@@ -1,6 +1,6 @@
 import {
   backupCurrent
-} from "./chunk-BIGSVBPI.js";
+} from "./chunk-KNYIEQAY.js";
 
 // src/wiring/external-plugins.ts
 import { isAbsolute, join, resolve } from "node:path";
@@ -345,7 +345,7 @@ import {
   resolvePluginTarget as resolvePluginTarget2,
   unpinPluginTrust
 } from "@wrongstack/core/plugin";
-import { atomicWrite } from "@wrongstack/core/utils";
+import { atomicWrite as atomicWrite2 } from "@wrongstack/core/utils";
 import {
   PLUGIN_AUDIT_ENTRIES
 } from "@wrongstack/plugins/plugin-audit-catalog";
@@ -420,6 +420,139 @@ function isRecord(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
 
+// src/plugin-llm-command.ts
+import { atomicWrite } from "@wrongstack/core/utils";
+var PLUGIN_LLM_USAGE = [
+  "Usage:",
+  "  wstack plugin llm                               List every per-plugin LLM override.",
+  "  wstack plugin llm <plugin>                      Show one plugin's LLM override.",
+  "  wstack plugin llm <plugin> <provider> [model]   Route this plugin through a provider (and model).",
+  "  wstack plugin llm <plugin> - <model>            Keep the session provider, override only the model.",
+  "  wstack plugin llm <plugin> --clear              Remove the override (back to the session default).",
+  "",
+  "The override is stored as config.extensions.<plugin>.llm and is used by",
+  "every api.llm call the plugin makes. Without an override, plugins follow",
+  "the active session provider/model (the chat leader)."
+].join("\n");
+function renderPluginLlmOverviews(config, sessionDefault) {
+  const rows = [];
+  for (const [pluginName2, ext] of Object.entries(config.extensions ?? {})) {
+    const llm = ext?.["llm"];
+    if (llm && typeof llm === "object") {
+      const o = llm;
+      rows.push({
+        name: pluginName2,
+        provider: o.provider ?? "(session)",
+        model: o.model ?? "(session)"
+      });
+    }
+  }
+  const lines = [`Per-plugin LLM routing (session default: ${sessionDefault}):`];
+  if (rows.length === 0) {
+    lines.push(
+      "  No plugin overrides \u2014 every plugin follows the session default.",
+      "  Set one with: wstack plugin llm <plugin> <provider> [model]"
+    );
+  } else {
+    rows.sort((a, b) => a.name.localeCompare(b.name));
+    for (const r of rows) {
+      lines.push(`  ${r.name.padEnd(24)} provider=${r.provider.padEnd(16)} model=${r.model}`);
+    }
+    lines.push("", "Clear one with: wstack plugin llm <plugin> --clear");
+  }
+  return lines.join("\n");
+}
+async function runPluginLlmCommand(args, deps) {
+  const sessionDefault = `${deps.config.provider ?? "?"} / ${deps.config.model ?? "?"}`;
+  if (args.length === 0 || args[0] === "list") {
+    return {
+      code: 0,
+      level: "output",
+      message: renderPluginLlmOverviews(deps.config, sessionDefault)
+    };
+  }
+  const name = args[0];
+  if (!name || name.startsWith("-")) return errorResult(PLUGIN_LLM_USAGE);
+  const currentOverride = deps.config.extensions?.[name]?.["llm"];
+  if (args.length === 1) {
+    const lines = [`LLM routing for plugin "${name}":`];
+    if (currentOverride && typeof currentOverride === "object") {
+      const o = currentOverride;
+      lines.push(
+        `  override: provider=${o.provider ?? "(session)"} model=${o.model ?? "(session)"}`,
+        `  session default: ${sessionDefault}`
+      );
+    } else {
+      lines.push(
+        `  no override \u2014 follows the session default (${sessionDefault}).`,
+        `  Set one with: wstack plugin llm ${name} <provider> [model]`
+      );
+    }
+    return { code: 0, level: "output", message: lines.join("\n") };
+  }
+  const existing = await readConfig(deps.configPath);
+  const fileExtensions = isRecord(existing.extensions) ? existing.extensions : {};
+  const pluginExt = isRecord(fileExtensions[name]) ? { ...fileExtensions[name] } : {};
+  if (args[1] === "--clear" || args[1] === "clear") {
+    if (!("llm" in pluginExt) && !currentOverride) {
+      return { code: 0, level: "info", message: `Plugin "${name}" has no LLM override.` };
+    }
+    delete pluginExt["llm"];
+    if (Object.keys(pluginExt).length === 0) delete fileExtensions[name];
+    else fileExtensions[name] = pluginExt;
+    existing.extensions = fileExtensions;
+    await atomicWrite(deps.configPath, JSON.stringify(existing, null, 2), { mode: 384 });
+    const merged2 = mergeExtensionsForPatch(deps.config, fileExtensions);
+    const mergedEntry = merged2[name];
+    if (mergedEntry) {
+      delete mergedEntry["llm"];
+      if (Object.keys(mergedEntry).length === 0) delete merged2[name];
+    }
+    return {
+      code: 0,
+      level: "info",
+      message: `Cleared LLM override for "${name}" \u2014 it now follows the session default (${sessionDefault}). Takes effect immediately for api.llm calls.`,
+      patch: { extensions: merged2 }
+    };
+  }
+  const providerArg = args[1];
+  const modelArg = args[2];
+  if (!providerArg || providerArg.startsWith("--")) return errorResult(PLUGIN_LLM_USAGE);
+  const provider = providerArg === "-" ? void 0 : providerArg;
+  const model = modelArg && modelArg !== "-" ? modelArg : void 0;
+  if (!provider && !model) return errorResult(PLUGIN_LLM_USAGE);
+  const llm = {};
+  if (provider) llm["provider"] = provider;
+  if (model) llm["model"] = model;
+  pluginExt["llm"] = llm;
+  fileExtensions[name] = pluginExt;
+  existing.extensions = fileExtensions;
+  await atomicWrite(deps.configPath, JSON.stringify(existing, null, 2), { mode: 384 });
+  const configured = Object.keys(deps.config.providers ?? {});
+  const note = provider && configured.length > 0 && !configured.includes(provider) ? `
+Note: "${provider}" is not in config.providers (configured: ${configured.join(", ")}). Catalog providers (anthropic, openai, \u2026) still resolve if credentials are available.` : "";
+  const merged = mergeExtensionsForPatch(deps.config, fileExtensions);
+  return {
+    code: 0,
+    level: "info",
+    message: `Plugin "${name}" now routes api.llm calls via provider=${provider ?? "(session)"} model=${model ?? "(session)"}. Session default stays ${sessionDefault}. Takes effect immediately for api.llm calls.${note}`,
+    patch: { extensions: merged }
+  };
+}
+function mergeExtensionsForPatch(config, fileExtensions) {
+  const merged = {};
+  for (const [k, v] of Object.entries(config.extensions ?? {})) {
+    merged[k] = { ...v };
+  }
+  for (const [k, v] of Object.entries(fileExtensions)) {
+    if (isRecord(v)) merged[k] = { ...merged[k] ?? {}, ...v };
+  }
+  for (const k of Object.keys(merged)) {
+    if (!(k in fileExtensions) && !(k in (config.extensions ?? {}))) delete merged[k];
+  }
+  return merged;
+}
+
 // src/plugin-package-install.ts
 import { execFile } from "node:child_process";
 import * as fs2 from "node:fs/promises";
@@ -710,7 +843,7 @@ ${locked.map((name2) => `  ${name2}`).join("\n")}`
   const next = action === "lock" ? current.some((entry) => canonicalPolicyName(entry) === canonical) ? current : [...current, name] : current.filter((entry) => canonicalPolicyName(entry) !== canonical);
   const pluginManager = { locked: next };
   existing.pluginManager = { ...filePolicy ?? {}, ...pluginManager };
-  await atomicWrite(deps.configPath, JSON.stringify(existing, null, 2), { mode: 384 });
+  await atomicWrite2(deps.configPath, JSON.stringify(existing, null, 2), { mode: 384 });
   return {
     code: 0,
     level: "info",
@@ -722,136 +855,6 @@ function canonicalPolicyName(name) {
   if (name === "*") return name;
   return resolvePluginToggleSpecifier(name).trim().toLowerCase();
 }
-var PLUGIN_LLM_USAGE = [
-  "Usage:",
-  "  wstack plugin llm                               List every per-plugin LLM override.",
-  "  wstack plugin llm <plugin>                      Show one plugin's LLM override.",
-  "  wstack plugin llm <plugin> <provider> [model]   Route this plugin through a provider (and model).",
-  "  wstack plugin llm <plugin> - <model>            Keep the session provider, override only the model.",
-  "  wstack plugin llm <plugin> --clear              Remove the override (back to the session default).",
-  "",
-  "The override is stored as config.extensions.<plugin>.llm and is used by",
-  "every api.llm call the plugin makes. Without an override, plugins follow",
-  "the active session provider/model (the chat leader)."
-].join("\n");
-function renderPluginLlmOverviews(config, sessionDefault) {
-  const rows = [];
-  for (const [pluginName2, ext] of Object.entries(config.extensions ?? {})) {
-    const llm = ext?.["llm"];
-    if (llm && typeof llm === "object") {
-      const o = llm;
-      rows.push({
-        name: pluginName2,
-        provider: o.provider ?? "(session)",
-        model: o.model ?? "(session)"
-      });
-    }
-  }
-  const lines = [`Per-plugin LLM routing (session default: ${sessionDefault}):`];
-  if (rows.length === 0) {
-    lines.push(
-      "  No plugin overrides \u2014 every plugin follows the session default.",
-      "  Set one with: wstack plugin llm <plugin> <provider> [model]"
-    );
-  } else {
-    rows.sort((a, b) => a.name.localeCompare(b.name));
-    for (const r of rows) {
-      lines.push(`  ${r.name.padEnd(24)} provider=${r.provider.padEnd(16)} model=${r.model}`);
-    }
-    lines.push("", "Clear one with: wstack plugin llm <plugin> --clear");
-  }
-  return lines.join("\n");
-}
-async function runPluginLlmCommand(args, deps) {
-  const sessionDefault = `${deps.config.provider ?? "?"} / ${deps.config.model ?? "?"}`;
-  if (args.length === 0 || args[0] === "list") {
-    return {
-      code: 0,
-      level: "output",
-      message: renderPluginLlmOverviews(deps.config, sessionDefault)
-    };
-  }
-  const name = args[0];
-  if (!name || name.startsWith("-")) return errorResult(PLUGIN_LLM_USAGE);
-  const currentOverride = deps.config.extensions?.[name]?.["llm"];
-  if (args.length === 1) {
-    const lines = [`LLM routing for plugin "${name}":`];
-    if (currentOverride && typeof currentOverride === "object") {
-      const o = currentOverride;
-      lines.push(
-        `  override: provider=${o.provider ?? "(session)"} model=${o.model ?? "(session)"}`,
-        `  session default: ${sessionDefault}`
-      );
-    } else {
-      lines.push(
-        `  no override \u2014 follows the session default (${sessionDefault}).`,
-        `  Set one with: wstack plugin llm ${name} <provider> [model]`
-      );
-    }
-    return { code: 0, level: "output", message: lines.join("\n") };
-  }
-  const existing = await readConfig(deps.configPath);
-  const fileExtensions = isRecord(existing.extensions) ? existing.extensions : {};
-  const pluginExt = isRecord(fileExtensions[name]) ? { ...fileExtensions[name] } : {};
-  if (args[1] === "--clear" || args[1] === "clear") {
-    if (!("llm" in pluginExt) && !currentOverride) {
-      return { code: 0, level: "info", message: `Plugin "${name}" has no LLM override.` };
-    }
-    delete pluginExt["llm"];
-    if (Object.keys(pluginExt).length === 0) delete fileExtensions[name];
-    else fileExtensions[name] = pluginExt;
-    existing.extensions = fileExtensions;
-    await atomicWrite(deps.configPath, JSON.stringify(existing, null, 2), { mode: 384 });
-    const merged2 = mergeExtensionsForPatch(deps.config, fileExtensions);
-    const mergedEntry = merged2[name];
-    if (mergedEntry) {
-      delete mergedEntry["llm"];
-      if (Object.keys(mergedEntry).length === 0) delete merged2[name];
-    }
-    return {
-      code: 0,
-      level: "info",
-      message: `Cleared LLM override for "${name}" \u2014 it now follows the session default (${sessionDefault}). Takes effect immediately for api.llm calls.`,
-      patch: { extensions: merged2 }
-    };
-  }
-  const providerArg = args[1];
-  const modelArg = args[2];
-  if (!providerArg || providerArg.startsWith("--")) return errorResult(PLUGIN_LLM_USAGE);
-  const provider = providerArg === "-" ? void 0 : providerArg;
-  const model = modelArg && modelArg !== "-" ? modelArg : void 0;
-  if (!provider && !model) return errorResult(PLUGIN_LLM_USAGE);
-  const llm = {};
-  if (provider) llm["provider"] = provider;
-  if (model) llm["model"] = model;
-  pluginExt["llm"] = llm;
-  fileExtensions[name] = pluginExt;
-  existing.extensions = fileExtensions;
-  await atomicWrite(deps.configPath, JSON.stringify(existing, null, 2), { mode: 384 });
-  const configured = Object.keys(deps.config.providers ?? {});
-  const note = provider && configured.length > 0 && !configured.includes(provider) ? `
-Note: "${provider}" is not in config.providers (configured: ${configured.join(", ")}). Catalog providers (anthropic, openai, \u2026) still resolve if credentials are available.` : "";
-  const merged = mergeExtensionsForPatch(deps.config, fileExtensions);
-  return {
-    code: 0,
-    level: "info",
-    message: `Plugin "${name}" now routes api.llm calls via provider=${provider ?? "(session)"} model=${model ?? "(session)"}. Session default stays ${sessionDefault}. Takes effect immediately for api.llm calls.${note}`,
-    patch: { extensions: merged }
-  };
-}
-function mergeExtensionsForPatch(config, fileExtensions) {
-  const merged = {};
-  for (const [k, v] of Object.entries(config.extensions ?? {})) {
-    merged[k] = { ...v };
-  }
-  for (const [k, v] of Object.entries(fileExtensions)) {
-    if (isRecord(v)) merged[k] = { ...merged[k] ?? {}, ...v };
-  }
-  for (const k of Object.keys(merged)) {
-    if (!(k in fileExtensions) && !(k in (config.extensions ?? {}))) delete merged[k];
-  }
-  return merged;
-}
 function resolvePluginSpecifier(input) {
   return OFFICIAL_ALIASES.get(input.toLowerCase()) ?? input;
 }
@@ -1014,7 +1017,7 @@ async function togglePlugin(spec, deps) {
   };
   existing.plugins = nextPlugins;
   existing.features = features;
-  await atomicWrite(deps.configPath, JSON.stringify(existing, null, 2), { mode: 384 });
+  await atomicWrite2(deps.configPath, JSON.stringify(existing, null, 2), { mode: 384 });
   const restartRequired = spec === "branch-guard" && !nextEnabled ? void 0 : true;
   return {
     code: 0,
@@ -1032,7 +1035,7 @@ async function removePlugin(spec, deps) {
     return errorResult(`Plugin "${spec}" not in config.`);
   }
   existing.plugins = next;
-  await atomicWrite(deps.configPath, JSON.stringify(existing, null, 2), { mode: 384 });
+  await atomicWrite2(deps.configPath, JSON.stringify(existing, null, 2), { mode: 384 });
   return {
     code: 0,
     level: "info",
@@ -1136,4 +1139,4 @@ export {
   PLUGIN_AUDIT_ENTRIES,
   runPluginManagementCommand
 };
-//# sourceMappingURL=chunk-VAQXOZKP.js.map
+//# sourceMappingURL=chunk-AJM4EFCM.js.map

package/dist/{chunk-C2BBH4S4.js → chunk-E3MJFAFR.js}

@@ -1,7 +1,7 @@
 import {
   appendHistory,
   backupCurrent
-} from "./chunk-BIGSVBPI.js";
+} from "./chunk-KNYIEQAY.js";
 
 // src/settings-menu.ts
 import * as fs from "node:fs/promises";
@@ -246,4 +246,4 @@ export {
   persistTelegramConfig,
   deriveFsAccessPair
 };
-//# sourceMappingURL=chunk-C2BBH4S4.js.map
+//# sourceMappingURL=chunk-E3MJFAFR.js.map

package/dist/{chunk-AWRZWPJ3.js → chunk-JFYQGMMM.js}

@@ -24,7 +24,7 @@ import {
   sanitizeApiError,
   truncateHqSummary,
   writeInvalidBody
-} from "./chunk-3EXRPTAU.js";
+} from "./chunk-5TQ65PXQ.js";
 import {
   createHqIpAllowlist
 } from "./chunk-OGVSKS4Q.js";
@@ -3839,9 +3839,6 @@ function createHqSocketCredentialEnforcer(state) {
   };
 }
 
-// src/hq-server/upgrade-handler.ts
-import { hqTokenVerifier as hqTokenVerifier2, isLoopbackHost as isLoopbackHost3, isTokenExpired as isTokenExpired5 } from "@wrongstack/core/hq";
-
 // src/hq-server/ws.ts
 import { randomUUID as randomUUID5 } from "node:crypto";
 import {
@@ -4706,7 +4703,91 @@ function handleClient(ws, clients, browsers, eventLog, auth, snapshotBroadcaster
   });
 }
 
+// src/hq-server/sweeps.ts
+var HQ_SESSION_MAX_AGE_MS2 = 7 * 24 * 60 * 60 * 1e3;
+var HQ_SESSION_IDLE_TIMEOUT_MS2 = 30 * 6e4;
+var PENDING_2FA_TTL_MS2 = 5 * 6e4;
+var HQ_SESSION_CLEANUP_INTERVAL_MS = 6e4;
+function sweepHqBrowserSessions(sessions, loginAttempts, socketCredentials) {
+  const now = Date.now();
+  const maxAgeCutoff = now - HQ_SESSION_MAX_AGE_MS2;
+  const idleCutoff = now - HQ_SESSION_IDLE_TIMEOUT_MS2;
+  const pending2faCutoff = now - PENDING_2FA_TTL_MS2;
+  for (const [id, session] of sessions) {
+    if (session.createdAt < maxAgeCutoff) {
+      sessions.delete(id);
+      socketCredentials.closeSessionSockets(id, "Browser session expired");
+      continue;
+    }
+    if (session.pending2fa) {
+      if (session.createdAt < pending2faCutoff) sessions.delete(id);
+      continue;
+    }
+    if (session.lastSeenAt < idleCutoff) {
+      sessions.delete(id);
+    }
+  }
+  for (const [ip, entry] of loginAttempts.entries()) {
+    if (now - entry.lastAttempt > 15 * 6e4) loginAttempts.delete(ip);
+  }
+}
+function sweepStaleHqClients({
+  clients,
+  browsers,
+  auditLog,
+  eventLog,
+  persistence,
+  clientTtlMs,
+  sessionSnapshotTtlMs
+}) {
+  const cutoff = Date.now() - clientTtlMs;
+  const sessionCutoff = Date.now() - sessionSnapshotTtlMs;
+  let changed = false;
+  for (const [ws, client] of clients.entries()) {
+    if (new Date(client.lastSeenAt).getTime() < cutoff) {
+      const lostClient = client;
+      ws.terminate();
+      clients.delete(ws);
+      failUndeliveredCommands(lostClient, browsers, auditLog);
+      detectLeaderLoss(lostClient, clients, browsers, "heartbeat-timeout", {
+        eventLog,
+        persistence
+      });
+      changed = true;
+      continue;
+    }
+    const expiredSessions = /* @__PURE__ */ new Set();
+    for (const [sessionId, tracked] of client.sessions.entries()) {
+      if (tracked.receivedAt < sessionCutoff) {
+        client.sessions.delete(sessionId);
+        client.mcpSnapshots.delete(sessionId);
+        expiredSessions.add(sessionId);
+        changed = true;
+      }
+    }
+    for (const [runId, fleet] of client.fleets) {
+      if (fleet.sessionId !== void 0 && expiredSessions.has(fleet.sessionId)) {
+        client.fleets.delete(runId);
+        changed = true;
+      }
+    }
+    if (client.capabilities.includes("session.summary") && client.sessions.size === 0 && Date.now() - Date.parse(client.connectedAt) > sessionSnapshotTtlMs) {
+      const lostClient = client;
+      ws.terminate();
+      clients.delete(ws);
+      failUndeliveredCommands(lostClient, browsers, auditLog);
+      detectLeaderLoss(lostClient, clients, browsers, "crash", {
+        eventLog,
+        persistence
+      });
+      changed = true;
+    }
+  }
+  return changed;
+}
+
 // src/hq-server/upgrade-handler.ts
+import { hqTokenVerifier as hqTokenVerifier2, isLoopbackHost as isLoopbackHost3, isTokenExpired as isTokenExpired5 } from "@wrongstack/core/hq";
 function handleHqUpgrade(req, socket, head, deps) {
   const url = new URL(req.url ?? "/", `http://${deps.host}:${deps.port}`);
   const pathname = url.pathname;
@@ -4964,33 +5045,10 @@ async function startHqServerWithAuth(options, host, port, dataDir, firstRunAuth)
       mutableAuth,
       sessions
     });
-    const HQ_SESSION_MAX_AGE_MS2 = 7 * 24 * 60 * 60 * 1e3;
-    const HQ_SESSION_IDLE_TIMEOUT_MS2 = 30 * 6e4;
-    const SESSION_CLEANUP_INTERVAL_MS = 6e4;
-    const PENDING_2FA_TTL_MS2 = 5 * 6e4;
-    const sessionCleanupTimer = setInterval(() => {
-      const now = Date.now();
-      const maxAgeCutoff = now - HQ_SESSION_MAX_AGE_MS2;
-      const idleCutoff = now - HQ_SESSION_IDLE_TIMEOUT_MS2;
-      const pending2faCutoff = now - PENDING_2FA_TTL_MS2;
-      for (const [id, session] of sessions) {
-        if (session.createdAt < maxAgeCutoff) {
-          sessions.delete(id);
-          socketCredentials.closeSessionSockets(id, "Browser session expired");
-          continue;
-        }
-        if (session.pending2fa) {
-          if (session.createdAt < pending2faCutoff) sessions.delete(id);
-          continue;
-        }
-        if (session.lastSeenAt < idleCutoff) {
-          sessions.delete(id);
-        }
-      }
-      for (const [ip, entry] of loginAttempts.entries()) {
-        if (now - entry.lastAttempt > 15 * 6e4) loginAttempts.delete(ip);
-      }
-    }, SESSION_CLEANUP_INTERVAL_MS);
+    const sessionCleanupTimer = setInterval(
+      () => sweepHqBrowserSessions(sessions, loginAttempts, socketCredentials),
+      HQ_SESSION_CLEANUP_INTERVAL_MS
+    );
     sessionCleanupTimer.unref?.();
     const persistence = createHqPersistence(dataDir);
     const auditLog = new HqCommandAuditLog(1e3, (entry) => persistence.commandLog.append(entry));
@@ -5065,49 +5123,15 @@ async function startHqServerWithAuth(options, host, port, dataDir, firstRunAuth)
     const sessionSnapshotTtlMs = options.sessionSnapshotTtlMs ?? SESSION_SNAPSHOT_TTL_MS;
     const cleanupTimer = setInterval(() => {
       socketCredentials.sweepExpiredSocketCredentials();
-      const cutoff = Date.now() - clientTtlMs;
-      const sessionCutoff = Date.now() - sessionSnapshotTtlMs;
-      let changed = false;
-      for (const [ws, client] of clients.entries()) {
-        if (new Date(client.lastSeenAt).getTime() < cutoff) {
-          const lostClient = client;
-          ws.terminate();
-          clients.delete(ws);
-          failUndeliveredCommands(lostClient, browsers, auditLog);
-          detectLeaderLoss(lostClient, clients, browsers, "heartbeat-timeout", {
-            eventLog,
-            persistence
-          });
-          changed = true;
-          continue;
-        }
-        const expiredSessions = /* @__PURE__ */ new Set();
-        for (const [sessionId, tracked] of client.sessions.entries()) {
-          if (tracked.receivedAt < sessionCutoff) {
-            client.sessions.delete(sessionId);
-            client.mcpSnapshots.delete(sessionId);
-            expiredSessions.add(sessionId);
-            changed = true;
-          }
-        }
-        for (const [runId, fleet] of client.fleets) {
-          if (fleet.sessionId !== void 0 && expiredSessions.has(fleet.sessionId)) {
-            client.fleets.delete(runId);
-            changed = true;
-          }
-        }
-        if (client.capabilities.includes("session.summary") && client.sessions.size === 0 && Date.now() - Date.parse(client.connectedAt) > sessionSnapshotTtlMs) {
-          const lostClient = client;
-          ws.terminate();
-          clients.delete(ws);
-          failUndeliveredCommands(lostClient, browsers, auditLog);
-          detectLeaderLoss(lostClient, clients, browsers, "crash", {
-            eventLog,
-            persistence
-          });
-          changed = true;
-        }
-      }
+      const changed = sweepStaleHqClients({
+        clients,
+        browsers,
+        auditLog,
+        eventLog,
+        persistence,
+        clientTtlMs,
+        sessionSnapshotTtlMs
+      });
       if (changed) snapshotBroadcaster.broadcast();
     }, options.clientCleanupIntervalMs ?? CLIENT_CLEANUP_INTERVAL_MS);
     cleanupTimer.unref?.();
@@ -5361,4 +5385,4 @@ export {
   startHqServer,
   HqInsecureExposureError2 as HqInsecureExposureError
 };
-//# sourceMappingURL=chunk-AWRZWPJ3.js.map
+//# sourceMappingURL=chunk-JFYQGMMM.js.map