@wrongstack/core 0.282.2 → 0.283.1

package/dist/{worktree-manager-BrtjUFYk.d.ts → worktree-manager-BjyAW30D.d.ts}

@@ -1,4 +1,4 @@
-import { E as EventBus } from './events-BOv8h6I1.js';
+import { E as EventBus } from './events-KmxSmvho.js';
 
 /**
  * Lifecycle of a single worktree handle.

package/instructions/modes/audit-lite.md

@@ -0,0 +1,13 @@
+## Audit Lite Mode
+
+Token-saving security sweep. Use for quick risk triage on a small diff or named file.
+
+Scope:
+- Check trust boundaries, auth/authz, secrets, injection, unsafe file/network/process use.
+- Prefer grep/read over broad scans; do not enumerate every clean category.
+- Treat unproven paths as NEEDS-CONTEXT instead of expanding scope automatically.
+
+Output:
+- Confirmed or likely exploitable findings only.
+- Each finding: `file:line — risk — exploit sketch — fix`.
+- If no issue: one sentence naming the checked surfaces.

package/instructions/modes/debug-lite.md

@@ -0,0 +1,13 @@
+## Debug Lite Mode
+
+Token-saving debugging mode. Use for fast root-cause triage before deep tracing.
+
+Scope:
+- Start from the exact error, failing test, or symptom.
+- Inspect the nearest stack frame / call site / config first.
+- Form one leading hypothesis, then test it with the narrowest command or read.
+
+Output:
+- Hypothesis, evidence, next check.
+- If fixed, state root cause and verification.
+- If not fixed after two checks, recommend switching to `debugger` for full tracing.

package/instructions/modes/plan-lite.md

@@ -0,0 +1,14 @@
+## Plan Lite Mode
+
+Token-saving planning mode. Use for quick implementation direction without a full design doc.
+
+Scope:
+- Read only enough code to identify entry points, constraints, and likely files.
+- Produce the smallest safe plan that can start work now.
+- Avoid multi-option architecture analysis unless the decision is blocking.
+
+Output:
+- Assumption line if any.
+- 3-6 ordered steps.
+- Verification target.
+- One risk or unknown max.

package/instructions/modes/refactor-lite.md

@@ -0,0 +1,13 @@
+## Refactor Lite Mode
+
+Token-saving refactor mode. Use for small cleanup while preserving behavior.
+
+Scope:
+- Touch only the requested symbol/file unless required by compile errors.
+- Avoid opportunistic rewrites, format churn, and API changes.
+- Keep changes mechanically reviewable.
+
+Output:
+- State behavior-preservation assumption.
+- Summarize the minimal transformation.
+- Verify with the narrowest test/typecheck/lint target.

package/instructions/modes/research-lite.md

@@ -0,0 +1,13 @@
+## Research Lite Mode
+
+Token-saving current-data research. Use when a quick freshness check is enough.
+
+Scope:
+- Search once with 3-5 results.
+- Fetch at most one authoritative source unless it conflicts with another result.
+- Do not build a full literature review.
+
+Output:
+- Short answer first.
+- 1-3 bullets with source domain and date/version if visible.
+- Say what remains uncertain instead of continuing to search.

package/instructions/modes/review-lite.md

@@ -0,0 +1,14 @@
+## Review Lite Mode
+
+Token-saving review pass. Use this when the user wants a quick sanity check, not a full audit.
+
+Scope:
+- Inspect only the changed or explicitly named files unless the user asks broader.
+- Report only correctness bugs, obvious regressions, and high-impact security issues.
+- Skip style nits, broad architecture commentary, and speculative edge cases.
+
+Output:
+- Max 5 findings, ordered by severity.
+- Each finding: `file:line — issue — minimal fix`.
+- If clean, say what you checked in one sentence.
+- End with at most one follow-up question or verification command.

package/instructions/modes/test-lite.md

@@ -0,0 +1,13 @@
+## Test Lite Mode
+
+Token-saving test mode. Use to add or select the narrowest useful regression coverage.
+
+Scope:
+- Prefer one focused regression over broad suite expansion.
+- Target the changed behavior, boundary input, or prior failure.
+- Reuse existing test style and helpers; do not redesign the test harness.
+
+Output:
+- Name the behavior under test.
+- Add/run the smallest relevant test command.
+- Report pass/fail and one untested risk if relevant.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrongstack/core",
-  "version": "0.282.2",
+  "version": "0.283.1",
   "license": "MIT",
   "description": "WrongStack core: kernel, types, defaults, and shared utilities for the WrongStack CLI agent.",
   "repository": {

package/skills/mailbox-bridge/SKILL.md

@@ -161,6 +161,39 @@ Every error response follows the WrongStack API convention:
 - No rate limiting at the bridge layer — assume the bearer token is the
   only credential and trust the loopback network.
 
+## The HQ dashboard writes to the same mailbox
+
+The HQ command center (`wstack --hq`) shares this exact `GlobalMailbox`.
+When an operator sends a prompt from the HQ screen, it lands in the same
+`_mailbox.jsonl` an external agent reads through `/mailbox/query` — so an
+external agent participating via this bridge sees HQ prompts too.
+
+HQ delivers a prompt one of two ways:
+
+- **`POST /api/command`** on the HQ server — routes to a *connected*
+  client, which then calls `GlobalMailbox.send`.
+- **`POST /api/mailbox-send`** on the HQ server — writes to the project
+  mailbox **directly**, so the prompt is delivered even when no agent is
+  connected. The HQ server resolves the target `projectRoot` from its
+  `SessionRegistry` (never a browser-supplied path).
+
+Either way, the resulting mailbox message carries one of the HQ **send
+types**, which map onto the mailbox `type` field an external agent will
+observe:
+
+| HQ send type | Mailbox `type` | Intent for the receiver |
+|--------------|----------------|-------------------------|
+| `steer`      | `steer`        | Change course now.       |
+| `btw`        | `btw`          | FYI / context — no course change demanded. |
+| `queue`      | `note`         | A queued prompt; handle before the next step. |
+| `broadcast`  | `broadcast`    | Sent to all agents on the project (`to: all`). |
+
+An external agent does not need to distinguish HQ-originated messages —
+they arrive with `from` set to `hq@<tag>` and are read, acked, and
+completed through the same `/mailbox/query` + `/mailbox/ack` routes as
+any other message. Filter on `from` if you want to treat HQ prompts
+specially.
+
 ## Pairing with the external-facing skill
 
 This internal skill describes how to run the server. The