@wrongstack/cli 1.1.4 → 1.1.6

package/dist/{chunk-AWRZWPJ3.js → chunk-FWUIKCCO.js}

@@ -24,7 +24,7 @@ import {
   sanitizeApiError,
   truncateHqSummary,
   writeInvalidBody
-} from "./chunk-3EXRPTAU.js";
+} from "./chunk-5TQ65PXQ.js";
 import {
   createHqIpAllowlist
 } from "./chunk-OGVSKS4Q.js";
@@ -201,6 +201,7 @@ var LoginAttemptStore = class _LoginAttemptStore {
   store = /* @__PURE__ */ new Map();
   writeTimer;
   dirty = false;
+  writeTail = Promise.resolve();
   filePath;
   debounceMs;
   retentionMs;
@@ -339,9 +340,7 @@ var LoginAttemptStore = class _LoginAttemptStore {
       clearTimeout(this.writeTimer);
       this.writeTimer = void 0;
     }
-    if (this.dirty) {
-      await this.writeToDisk();
-    }
+    await this.writeToDisk();
   }
   scheduleWrite() {
     this.dirty = true;
@@ -352,7 +351,14 @@ var LoginAttemptStore = class _LoginAttemptStore {
     }, this.debounceMs);
     this.writeTimer.unref?.();
   }
-  async writeToDisk() {
+  writeToDisk() {
+    const pending = this.writeTail.then(() => {
+      return this.dirty ? this.writeSnapshotToDisk() : void 0;
+    });
+    this.writeTail = pending.catch(() => void 0);
+    return pending;
+  }
+  async writeSnapshotToDisk() {
     this.dirty = false;
     const now = Date.now();
     const cutoff = now - this.retentionMs;
@@ -3733,52 +3739,51 @@ ${terminalText("Reachable from other machines on your network:", "blue", { bold:
 
 // src/hq-server/server-lifecycle.ts
 function createHqServerShutdown(params) {
-  let closed = false;
-  return () => new Promise((res) => {
-    if (closed) {
-      res();
-      return;
-    }
-    closed = true;
-    clearInterval(params.cleanupTimer);
-    clearInterval(params.browserHeartbeatTimer);
-    clearInterval(params.timeseriesFlushTimer);
-    clearInterval(params.sessionCleanupTimer);
-    params.stopAlertEngine();
-    params.authWatcher.close();
-    params.snapshotBroadcaster.close();
-    params.bootstrapStore.clear();
-    params.persistence.timeseries.flush();
-    for (const ws of [...params.browsers, ...params.clients.keys()]) {
-      try {
-        ws.close(1001, "HQ shutting down");
-        ws.terminate();
-      } catch {
+  let closing;
+  return () => {
+    if (closing) return closing;
+    closing = new Promise((res) => {
+      clearInterval(params.cleanupTimer);
+      clearInterval(params.browserHeartbeatTimer);
+      clearInterval(params.timeseriesFlushTimer);
+      clearInterval(params.sessionCleanupTimer);
+      params.stopAlertEngine();
+      params.authWatcher.close();
+      params.snapshotBroadcaster.close();
+      params.bootstrapStore.clear();
+      params.persistence.timeseries.flush();
+      for (const ws of [...params.browsers, ...params.clients.keys()]) {
+        try {
+          ws.close(1001, "HQ shutting down");
+          ws.terminate();
+        } catch {
+        }
       }
-    }
-    params.wss.close();
-    params.mailboxManager.close();
-    params.httpServer.close(() => {
-      const mailboxCloses = [...params.mailboxManager.mailboxGateways.values()].map(
-        ({ mailbox }) => mailbox.close().catch(() => void 0)
-      );
-      params.mailboxManager.mailboxGateways.clear();
-      params.mailboxManager.mailboxGatewayLastUsed.clear();
-      void Promise.all([
-        ...mailboxCloses,
-        // Chimera/race: flush the login-attempt store INSIDE the awaited
-        // shutdown set — the old fire-and-forget `void flush()` let close()
-        // resolve before the debounced write landed, so persistence tests
-        // had to sleep past it (and restarts could miss lockout state).
-        params.loginAttempts.flush(),
-        params.persistence.eventLog.drain(),
-        params.persistence.snapshotStore.drain(),
-        params.persistence.timeseries.drain(),
-        params.persistence.kanban.drain(),
-        params.persistence.sage?.drain()
-      ]).then(() => clearHqRuntimeMarker(params.dataDir, params.hqUrl)).catch(() => void 0).finally(() => res());
+      params.wss.close();
+      params.mailboxManager.close();
+      params.httpServer.close(() => {
+        const mailboxCloses = [...params.mailboxManager.mailboxGateways.values()].map(
+          ({ mailbox }) => mailbox.close().catch(() => void 0)
+        );
+        params.mailboxManager.mailboxGateways.clear();
+        params.mailboxManager.mailboxGatewayLastUsed.clear();
+        void Promise.allSettled([
+          ...mailboxCloses,
+          // Chimera/race: flush the login-attempt store INSIDE the awaited
+          // shutdown set — the old fire-and-forget `void flush()` let close()
+          // resolve before the debounced write landed, so persistence tests
+          // had to sleep past it (and restarts could miss lockout state).
+          params.loginAttempts.flush(),
+          params.persistence.eventLog.drain(),
+          params.persistence.snapshotStore.drain(),
+          params.persistence.timeseries.drain(),
+          params.persistence.kanban.drain(),
+          params.persistence.sage?.drain()
+        ]).then(() => clearHqRuntimeMarker(params.dataDir, params.hqUrl)).catch(() => void 0).finally(() => res());
+      });
     });
-  });
+    return closing;
+  };
 }
 
 // src/hq-server/socket-credentials.ts
@@ -3839,9 +3844,6 @@ function createHqSocketCredentialEnforcer(state) {
   };
 }
 
-// src/hq-server/upgrade-handler.ts
-import { hqTokenVerifier as hqTokenVerifier2, isLoopbackHost as isLoopbackHost3, isTokenExpired as isTokenExpired5 } from "@wrongstack/core/hq";
-
 // src/hq-server/ws.ts
 import { randomUUID as randomUUID5 } from "node:crypto";
 import {
@@ -4706,7 +4708,91 @@ function handleClient(ws, clients, browsers, eventLog, auth, snapshotBroadcaster
   });
 }
 
+// src/hq-server/sweeps.ts
+var HQ_SESSION_MAX_AGE_MS2 = 7 * 24 * 60 * 60 * 1e3;
+var HQ_SESSION_IDLE_TIMEOUT_MS2 = 30 * 6e4;
+var PENDING_2FA_TTL_MS2 = 5 * 6e4;
+var HQ_SESSION_CLEANUP_INTERVAL_MS = 6e4;
+function sweepHqBrowserSessions(sessions, loginAttempts, socketCredentials) {
+  const now = Date.now();
+  const maxAgeCutoff = now - HQ_SESSION_MAX_AGE_MS2;
+  const idleCutoff = now - HQ_SESSION_IDLE_TIMEOUT_MS2;
+  const pending2faCutoff = now - PENDING_2FA_TTL_MS2;
+  for (const [id, session] of sessions) {
+    if (session.createdAt < maxAgeCutoff) {
+      sessions.delete(id);
+      socketCredentials.closeSessionSockets(id, "Browser session expired");
+      continue;
+    }
+    if (session.pending2fa) {
+      if (session.createdAt < pending2faCutoff) sessions.delete(id);
+      continue;
+    }
+    if (session.lastSeenAt < idleCutoff) {
+      sessions.delete(id);
+    }
+  }
+  for (const [ip, entry] of loginAttempts.entries()) {
+    if (now - entry.lastAttempt > 15 * 6e4) loginAttempts.delete(ip);
+  }
+}
+function sweepStaleHqClients({
+  clients,
+  browsers,
+  auditLog,
+  eventLog,
+  persistence,
+  clientTtlMs,
+  sessionSnapshotTtlMs
+}) {
+  const cutoff = Date.now() - clientTtlMs;
+  const sessionCutoff = Date.now() - sessionSnapshotTtlMs;
+  let changed = false;
+  for (const [ws, client] of clients.entries()) {
+    if (new Date(client.lastSeenAt).getTime() < cutoff) {
+      const lostClient = client;
+      ws.terminate();
+      clients.delete(ws);
+      failUndeliveredCommands(lostClient, browsers, auditLog);
+      detectLeaderLoss(lostClient, clients, browsers, "heartbeat-timeout", {
+        eventLog,
+        persistence
+      });
+      changed = true;
+      continue;
+    }
+    const expiredSessions = /* @__PURE__ */ new Set();
+    for (const [sessionId, tracked] of client.sessions.entries()) {
+      if (tracked.receivedAt < sessionCutoff) {
+        client.sessions.delete(sessionId);
+        client.mcpSnapshots.delete(sessionId);
+        expiredSessions.add(sessionId);
+        changed = true;
+      }
+    }
+    for (const [runId, fleet] of client.fleets) {
+      if (fleet.sessionId !== void 0 && expiredSessions.has(fleet.sessionId)) {
+        client.fleets.delete(runId);
+        changed = true;
+      }
+    }
+    if (client.capabilities.includes("session.summary") && client.sessions.size === 0 && Date.now() - Date.parse(client.connectedAt) > sessionSnapshotTtlMs) {
+      const lostClient = client;
+      ws.terminate();
+      clients.delete(ws);
+      failUndeliveredCommands(lostClient, browsers, auditLog);
+      detectLeaderLoss(lostClient, clients, browsers, "crash", {
+        eventLog,
+        persistence
+      });
+      changed = true;
+    }
+  }
+  return changed;
+}
+
 // src/hq-server/upgrade-handler.ts
+import { hqTokenVerifier as hqTokenVerifier2, isLoopbackHost as isLoopbackHost3, isTokenExpired as isTokenExpired5 } from "@wrongstack/core/hq";
 function handleHqUpgrade(req, socket, head, deps) {
   const url = new URL(req.url ?? "/", `http://${deps.host}:${deps.port}`);
   const pathname = url.pathname;
@@ -4964,33 +5050,10 @@ async function startHqServerWithAuth(options, host, port, dataDir, firstRunAuth)
       mutableAuth,
       sessions
     });
-    const HQ_SESSION_MAX_AGE_MS2 = 7 * 24 * 60 * 60 * 1e3;
-    const HQ_SESSION_IDLE_TIMEOUT_MS2 = 30 * 6e4;
-    const SESSION_CLEANUP_INTERVAL_MS = 6e4;
-    const PENDING_2FA_TTL_MS2 = 5 * 6e4;
-    const sessionCleanupTimer = setInterval(() => {
-      const now = Date.now();
-      const maxAgeCutoff = now - HQ_SESSION_MAX_AGE_MS2;
-      const idleCutoff = now - HQ_SESSION_IDLE_TIMEOUT_MS2;
-      const pending2faCutoff = now - PENDING_2FA_TTL_MS2;
-      for (const [id, session] of sessions) {
-        if (session.createdAt < maxAgeCutoff) {
-          sessions.delete(id);
-          socketCredentials.closeSessionSockets(id, "Browser session expired");
-          continue;
-        }
-        if (session.pending2fa) {
-          if (session.createdAt < pending2faCutoff) sessions.delete(id);
-          continue;
-        }
-        if (session.lastSeenAt < idleCutoff) {
-          sessions.delete(id);
-        }
-      }
-      for (const [ip, entry] of loginAttempts.entries()) {
-        if (now - entry.lastAttempt > 15 * 6e4) loginAttempts.delete(ip);
-      }
-    }, SESSION_CLEANUP_INTERVAL_MS);
+    const sessionCleanupTimer = setInterval(
+      () => sweepHqBrowserSessions(sessions, loginAttempts, socketCredentials),
+      HQ_SESSION_CLEANUP_INTERVAL_MS
+    );
     sessionCleanupTimer.unref?.();
     const persistence = createHqPersistence(dataDir);
     const auditLog = new HqCommandAuditLog(1e3, (entry) => persistence.commandLog.append(entry));
@@ -5065,49 +5128,15 @@ async function startHqServerWithAuth(options, host, port, dataDir, firstRunAuth)
     const sessionSnapshotTtlMs = options.sessionSnapshotTtlMs ?? SESSION_SNAPSHOT_TTL_MS;
     const cleanupTimer = setInterval(() => {
       socketCredentials.sweepExpiredSocketCredentials();
-      const cutoff = Date.now() - clientTtlMs;
-      const sessionCutoff = Date.now() - sessionSnapshotTtlMs;
-      let changed = false;
-      for (const [ws, client] of clients.entries()) {
-        if (new Date(client.lastSeenAt).getTime() < cutoff) {
-          const lostClient = client;
-          ws.terminate();
-          clients.delete(ws);
-          failUndeliveredCommands(lostClient, browsers, auditLog);
-          detectLeaderLoss(lostClient, clients, browsers, "heartbeat-timeout", {
-            eventLog,
-            persistence
-          });
-          changed = true;
-          continue;
-        }
-        const expiredSessions = /* @__PURE__ */ new Set();
-        for (const [sessionId, tracked] of client.sessions.entries()) {
-          if (tracked.receivedAt < sessionCutoff) {
-            client.sessions.delete(sessionId);
-            client.mcpSnapshots.delete(sessionId);
-            expiredSessions.add(sessionId);
-            changed = true;
-          }
-        }
-        for (const [runId, fleet] of client.fleets) {
-          if (fleet.sessionId !== void 0 && expiredSessions.has(fleet.sessionId)) {
-            client.fleets.delete(runId);
-            changed = true;
-          }
-        }
-        if (client.capabilities.includes("session.summary") && client.sessions.size === 0 && Date.now() - Date.parse(client.connectedAt) > sessionSnapshotTtlMs) {
-          const lostClient = client;
-          ws.terminate();
-          clients.delete(ws);
-          failUndeliveredCommands(lostClient, browsers, auditLog);
-          detectLeaderLoss(lostClient, clients, browsers, "crash", {
-            eventLog,
-            persistence
-          });
-          changed = true;
-        }
-      }
+      const changed = sweepStaleHqClients({
+        clients,
+        browsers,
+        auditLog,
+        eventLog,
+        persistence,
+        clientTtlMs,
+        sessionSnapshotTtlMs
+      });
       if (changed) snapshotBroadcaster.broadcast();
     }, options.clientCleanupIntervalMs ?? CLIENT_CLEANUP_INTERVAL_MS);
     cleanupTimer.unref?.();
@@ -5361,4 +5390,4 @@ export {
   startHqServer,
   HqInsecureExposureError2 as HqInsecureExposureError
 };
-//# sourceMappingURL=chunk-AWRZWPJ3.js.map
+//# sourceMappingURL=chunk-FWUIKCCO.js.map

package/dist/{chunk-TAE3EGBM.js → chunk-H5DCQFUI.js}

@@ -1,10 +1,10 @@
 import {
   parseArgs
-} from "./chunk-75OLD563.js";
+} from "./chunk-M7PSENGF.js";
 import {
   helpCmd,
   versionCmd
-} from "./chunk-6VPWQ4TG.js";
+} from "./chunk-UROB7MK5.js";
 
 // src/boot/short-circuit-flags.ts
 async function handleHelpVersionShortCircuit(argv) {
@@ -22,11 +22,11 @@ async function handleHelpVersionShortCircuit(argv) {
   }
   if (earlyFlags["help"] === true) {
     if (positional.length > 0) {
-      const { subcommandNames } = await import("./subcommands-YADUV7IJ.js");
+      const { subcommandNames } = await import("./subcommands-SKJPUJ7N.js");
       if (subcommandNames.includes(positional[0])) {
         const first = positional[0];
         const deep = positional[1];
-        const { renderDeepHelp, renderFocusedHelp } = await import("./per-subcommand-help-4GYSCMLU.js");
+        const { renderDeepHelp, renderFocusedHelp } = await import("./per-subcommand-help-MQGERD4E.js");
         if (deep && renderDeepHelp(`${first}:${deep}`, stubRenderer)) {
           return 0;
         }
@@ -43,4 +43,4 @@ async function handleHelpVersionShortCircuit(argv) {
 export {
   handleHelpVersionShortCircuit
 };
-//# sourceMappingURL=chunk-TAE3EGBM.js.map
+//# sourceMappingURL=chunk-H5DCQFUI.js.map

package/dist/{chunk-BIGSVBPI.js → chunk-KNYIEQAY.js}

@@ -1,18 +1,19 @@
 
 // src/config-history.ts
 import { randomUUID } from "node:crypto";
+import * as fs2 from "node:fs/promises";
+import * as path2 from "node:path";
+import { isSecretField as isSecretField2 } from "@wrongstack/core/security";
+import { ERROR_CODES as ERROR_CODES2, FsError as FsError2 } from "@wrongstack/core/types";
+import { atomicWrite, toErrorMessage, withFileLock, writeErr } from "@wrongstack/core/utils";
+
+// src/config-history-support.ts
 import * as fs from "node:fs/promises";
 import os from "node:os";
 import * as path from "node:path";
 import { isSecretField } from "@wrongstack/core/security";
 import { ERROR_CODES, FsError } from "@wrongstack/core/types";
-import {
-  atomicWrite,
-  resolveWstackPaths,
-  toErrorMessage,
-  withFileLock,
-  writeErr
-} from "@wrongstack/core/utils";
+import { resolveWstackPaths } from "@wrongstack/core/utils";
 var defaultUidFn = () => os.userInfo().uid;
 async function getFileUid(filePath) {
   try {
@@ -32,8 +33,6 @@ async function checkConfigOwnership(homeFn, uidFn = defaultUidFn, targetConfigPa
   return fileUid === callerUid;
 }
 var PROTECTED_BASENAMES = /* @__PURE__ */ new Set(["config.json", ".key", "index.json"]);
-var MAX_CONFIG_BACKUPS = 10;
-var MAX_CONFIG_HISTORY_ENTRIES = 50;
 function assertSafeToDelete(filename, parentDir) {
   if (PROTECTED_BASENAMES.has(filename)) {
     throw new FsError({
@@ -72,19 +71,6 @@ function assertSafeToDelete(filename, parentDir) {
     });
   }
 }
-async function safeDelete(filePath) {
-  const dir = path.dirname(filePath);
-  const filename = path.basename(filePath);
-  try {
-    assertSafeToDelete(filename, dir);
-    await fs.unlink(filePath);
-  } catch (err) {
-    if (err instanceof Error && err.message.startsWith("Refusing")) {
-      writeErr(`[config-history] SAFETY: ${err.message}
-`);
-    }
-  }
-}
 var REDACTED = "[REDACTED]";
 function maskValue(v) {
   if (Array.isArray(v)) return v.map(maskValue);
@@ -130,6 +116,31 @@ function reviveSecrets(masked, current) {
   }
   return out;
 }
+var defaultHomeDir = () => os.homedir();
+function activeProfileConfigPath(homeFn) {
+  const paths = homeFn === defaultHomeDir ? resolveWstackPaths({ projectRoot: process.cwd() }) : resolveWstackPaths({ projectRoot: process.cwd(), userHome: homeFn() });
+  return paths.profileConfig(paths.profileName);
+}
+function configPath(homeFn = defaultHomeDir, targetConfigPath) {
+  return targetConfigPath ?? activeProfileConfigPath(homeFn);
+}
+
+// src/config-history.ts
+var MAX_CONFIG_BACKUPS = 10;
+var MAX_CONFIG_HISTORY_ENTRIES = 50;
+async function safeDelete(filePath) {
+  const dir = path2.dirname(filePath);
+  const filename = path2.basename(filePath);
+  try {
+    assertSafeToDelete(filename, dir);
+    await fs2.unlink(filePath);
+  } catch (err) {
+    if (err instanceof Error && err.message.startsWith("Refusing")) {
+      writeErr(`[config-history] SAFETY: ${err.message}
+`);
+    }
+  }
+}
 function diffSummary(oldCfg, newCfg) {
   const changes = [];
   const allKeys = /* @__PURE__ */ new Set([...Object.keys(oldCfg), ...Object.keys(newCfg)]);
@@ -137,7 +148,7 @@ function diffSummary(oldCfg, newCfg) {
     const o = JSON.stringify(oldCfg[k]);
     const n = JSON.stringify(newCfg[k]);
     if (o !== n) {
-      if (isSecretField(k)) {
+      if (isSecretField2(k)) {
         changes.push(`${k}: [CHANGED]`);
       } else if (typeof newCfg[k] !== "object") {
         changes.push(`${k}: ${oldCfg[k] ?? "(unset)"} \u2192 ${newCfg[k]}`);
@@ -148,24 +159,16 @@ function diffSummary(oldCfg, newCfg) {
   }
   return changes.length > 0 ? changes.slice(0, 5).join(", ") : "no changes";
 }
-var defaultHomeDir = () => os.homedir();
-function activeProfileConfigPath(homeFn) {
-  const paths = homeFn === defaultHomeDir ? resolveWstackPaths({ projectRoot: process.cwd() }) : resolveWstackPaths({ projectRoot: process.cwd(), userHome: homeFn() });
-  return paths.profileConfig(paths.profileName);
-}
 function historyDir(homeFn = defaultHomeDir, targetConfigPath) {
-  return path.join(path.dirname(configPath(homeFn, targetConfigPath)), "config.history", "entries");
+  return path2.join(path2.dirname(configPath(homeFn, targetConfigPath)), "config.history", "entries");
 }
 function historyIndexPath(homeFn = defaultHomeDir, targetConfigPath) {
-  return path.join(
-    path.dirname(configPath(homeFn, targetConfigPath)),
+  return path2.join(
+    path2.dirname(configPath(homeFn, targetConfigPath)),
     "config.history",
     "index.json"
   );
 }
-function configPath(homeFn = defaultHomeDir, targetConfigPath) {
-  return targetConfigPath ?? activeProfileConfigPath(homeFn);
-}
 function backupLastPath(homeFn = defaultHomeDir, targetConfigPath) {
   return `${configPath(homeFn, targetConfigPath)}.last`;
 }
@@ -174,11 +177,11 @@ function entryId(ts) {
 }
 async function ensureHistoryDir(homeFn = defaultHomeDir, targetConfigPath) {
   try {
-    await fs.mkdir(historyDir(homeFn, targetConfigPath), { recursive: true });
+    await fs2.mkdir(historyDir(homeFn, targetConfigPath), { recursive: true });
   } catch (err) {
-    throw new FsError({
+    throw new FsError2({
       message: toErrorMessage(err),
-      code: ERROR_CODES.FS_MKDIR_FAILED,
+      code: ERROR_CODES2.FS_MKDIR_FAILED,
       path: historyDir(homeFn, targetConfigPath),
       cause: err
     });
@@ -187,7 +190,7 @@ async function ensureHistoryDir(homeFn = defaultHomeDir, targetConfigPath) {
 async function readIndex(homeFn = defaultHomeDir, targetConfigPath) {
   let raw;
   try {
-    raw = await fs.readFile(historyIndexPath(homeFn, targetConfigPath), "utf8");
+    raw = await fs2.readFile(historyIndexPath(homeFn, targetConfigPath), "utf8");
   } catch (err) {
     if (err.code !== "ENOENT") throw err;
     return rebuildIndexFromEntries(homeFn, targetConfigPath);
@@ -208,7 +211,7 @@ async function rebuildIndexFromEntries(homeFn = defaultHomeDir, targetConfigPath
   const dir = historyDir(homeFn, targetConfigPath);
   let files;
   try {
-    files = (await fs.readdir(dir)).filter((file) => file.endsWith(".json"));
+    files = (await fs2.readdir(dir)).filter((file) => file.endsWith(".json"));
   } catch (err) {
     if (err.code === "ENOENT") return { version: 1, entries: [] };
     throw err;
@@ -218,7 +221,7 @@ async function rebuildIndexFromEntries(homeFn = defaultHomeDir, targetConfigPath
     const id = file.slice(0, -".json".length);
     let raw;
     try {
-      raw = await fs.readFile(path.join(dir, file), "utf8");
+      raw = await fs2.readFile(path2.join(dir, file), "utf8");
     } catch (err) {
       if (err.code === "ENOENT") continue;
       entries.push({ id, timestamp: "", description: "" });
@@ -244,9 +247,9 @@ async function writeIndex(idx, homeFn = defaultHomeDir, targetConfigPath) {
   try {
     await atomicWrite(historyIndexPath(homeFn, targetConfigPath), JSON.stringify(idx, null, 2));
   } catch (err) {
-    throw new FsError({
+    throw new FsError2({
       message: toErrorMessage(err),
-      code: ERROR_CODES.FS_ATOMIC_WRITE_FAILED,
+      code: ERROR_CODES2.FS_ATOMIC_WRITE_FAILED,
       path: historyIndexPath(homeFn, targetConfigPath),
       cause: err
     });
@@ -258,16 +261,16 @@ async function pruneHistoryEntries(idx, homeFn = defaultHomeDir, targetConfigPat
   const dir = historyDir(homeFn, targetConfigPath);
   for (const entry of removed) {
     try {
-      await fs.unlink(path.join(dir, `${entry.id}.json`));
+      await fs2.unlink(path2.join(dir, `${entry.id}.json`));
     } catch {
     }
   }
   try {
-    const files = await fs.readdir(dir);
+    const files = await fs2.readdir(dir);
     await Promise.all(
       files.filter((file) => file.endsWith(".json") && !keep.has(file)).map(async (file) => {
         try {
-          await fs.unlink(path.join(dir, file));
+          await fs2.unlink(path2.join(dir, file));
         } catch {
         }
       })
@@ -281,7 +284,7 @@ async function backupCurrent(homeFn = defaultHomeDir, targetConfigPath) {
   const ts = Date.now();
   let content;
   try {
-    content = await fs.readFile(cfg, "utf8");
+    content = await fs2.readFile(cfg, "utf8");
   } catch {
   }
   if (content !== void 0) {
@@ -300,11 +303,11 @@ async function backupCurrent(homeFn = defaultHomeDir, targetConfigPath) {
     }
   }
   try {
-    const dir = path.dirname(cfg);
-    const files = await fs.readdir(dir);
+    const dir = path2.dirname(cfg);
+    const files = await fs2.readdir(dir);
     const baks = files.filter((f) => f.startsWith("config.json.") && f.endsWith(".bak")).sort().reverse();
     for (const f of baks.slice(MAX_CONFIG_BACKUPS)) {
-      await safeDelete(path.join(dir, f));
+      await safeDelete(path2.join(dir, f));
     }
   } catch (err) {
     writeErr(`[config-history] backup prune failed: ${toErrorMessage(err)}`);
@@ -322,16 +325,16 @@ async function appendHistory(oldCfg, newCfg, description, homeFn = defaultHomeDi
     diffSummary: diffSummary(oldCfg, newCfg)
   };
   try {
-    await fs.writeFile(
-      path.join(historyDir(homeFn, targetConfigPath), `${id}.json`),
+    await fs2.writeFile(
+      path2.join(historyDir(homeFn, targetConfigPath), `${id}.json`),
       JSON.stringify(entry, null, 2),
       { encoding: "utf8", mode: 384 }
     );
   } catch (err) {
-    throw new FsError({
+    throw new FsError2({
       message: toErrorMessage(err),
-      code: ERROR_CODES.FS_WRITE_FAILED,
-      path: path.join(historyDir(homeFn, targetConfigPath), `${id}.json`),
+      code: ERROR_CODES2.FS_WRITE_FAILED,
+      path: path2.join(historyDir(homeFn, targetConfigPath), `${id}.json`),
       cause: err
     });
   }
@@ -350,10 +353,10 @@ async function listHistory(homeFn = defaultHomeDir, targetConfigPath) {
 }
 async function getHistoryEntry(id, homeFn = defaultHomeDir, targetConfigPath) {
   const dir = historyDir(homeFn, targetConfigPath);
-  const filePath = path.join(dir, `${id}.json`);
-  if (path.dirname(path.resolve(filePath)) !== path.resolve(dir)) return null;
+  const filePath = path2.join(dir, `${id}.json`);
+  if (path2.dirname(path2.resolve(filePath)) !== path2.resolve(dir)) return null;
   try {
-    const raw = await fs.readFile(filePath, "utf8");
+    const raw = await fs2.readFile(filePath, "utf8");
     return JSON.parse(raw);
   } catch {
     return null;
@@ -374,7 +377,7 @@ async function restoreFromHistory(id, homeFn = defaultHomeDir, targetConfigPath)
     await backupCurrent(homeFn, targetConfigPath);
     let oldCfg = {};
     try {
-      const raw = await fs.readFile(cfg, "utf8");
+      const raw = await fs2.readFile(cfg, "utf8");
       oldCfg = JSON.parse(raw);
     } catch {
     }
@@ -399,7 +402,7 @@ async function restoreLast(homeFn = defaultHomeDir, targetConfigPath) {
   const cfg = configPath(homeFn, targetConfigPath);
   let lastCfg = {};
   try {
-    const raw = await fs.readFile(last, "utf8");
+    const raw = await fs2.readFile(last, "utf8");
     lastCfg = JSON.parse(raw);
   } catch {
     return { ok: false, error: "No prior backup found" };
@@ -410,7 +413,7 @@ async function restoreLast(homeFn = defaultHomeDir, targetConfigPath) {
   return withFileLock(cfg, async () => {
     let oldCfg = {};
     try {
-      const raw = await fs.readFile(cfg, "utf8");
+      const raw = await fs2.readFile(cfg, "utf8");
       oldCfg = JSON.parse(raw);
     } catch {
     }
@@ -439,4 +442,4 @@ export {
   restoreFromHistory,
   restoreLast
 };
-//# sourceMappingURL=chunk-BIGSVBPI.js.map
+//# sourceMappingURL=chunk-KNYIEQAY.js.map