@nanobpm/nano-workforce 0.186.2 → 0.186.4

package/CHANGELOG.md

@@ -1,3 +1,15 @@
+## [0.186.4](https://github.com/nanobpm/nano-workforce/compare/v0.186.3...v0.186.4) (2026-09-12)
+
+### Bug Fixes
+
+* **agentic:** allow c8ctl GitHub auth for repository provisioning ([#784](https://github.com/nanobpm/nano-workforce/issues/784)) ([323bb05](https://github.com/nanobpm/nano-workforce/commit/323bb05060e63ca57082d42e3bf9c91f63abaa0a)), closes [#770](https://github.com/nanobpm/nano-workforce/issues/770) [#770](https://github.com/nanobpm/nano-workforce/issues/770) [#770](https://github.com/nanobpm/nano-workforce/issues/770)
+
+## [0.186.3](https://github.com/nanobpm/nano-workforce/compare/v0.186.2...v0.186.3) (2026-09-12)
+
+### Bug Fixes
+
+* **app:** redirect standalone /console routes to the engine console ([#780](https://github.com/nanobpm/nano-workforce/issues/780)) ([103e967](https://github.com/nanobpm/nano-workforce/commit/103e967b95191bb04239b5c6a2195913e50b8b9b)), closes [#771](https://github.com/nanobpm/nano-workforce/issues/771)
+
 ## [0.186.2](https://github.com/nanobpm/nano-workforce/compare/v0.186.1...v0.186.2) (2026-09-11)
 
 ### Bug Fixes

package/app/consoleRedirect.test.ts

@@ -0,0 +1,127 @@
+// Tests for app/consoleRedirect.ts — the standalone `/console` → engine-console redirect (issue
+// #771). Covers the pure match/target derivation, origin resolution from NANOBPMN_BASE_URL, and the
+// live listener-rewiring mount over a real node:http server (redirect fires for `/console/*`,
+// passthrough for everything else, teardown restores the original handler).
+import { createServer, type Server } from "node:http";
+import type { AddressInfo } from "node:net";
+import { test } from "node:test";
+import { assert, assertEquals } from "#test-assert";
+import {
+  consoleRedirectLocation,
+  mountConsoleRedirect,
+  resolveConsoleOrigin,
+} from "./consoleRedirect.ts";
+
+test("redirects a bare /console path to the console origin", () => {
+  assertEquals(consoleRedirectLocation("/console", "http://localhost:8080"), "http://localhost:8080/console");
+});
+
+test("preserves the full path and query under /console/", () => {
+  assertEquals(
+    consoleRedirectLocation("/console/app-view/Foo?tab=bar&x=1", "http://localhost:8080"),
+    "http://localhost:8080/console/app-view/Foo?tab=bar&x=1",
+  );
+});
+
+test("leaves /app/* and root routes unchanged (null)", () => {
+  assertEquals(consoleRedirectLocation("/app/api/agent", "http://localhost:8080"), null);
+  assertEquals(consoleRedirectLocation("/", "http://localhost:8080"), null);
+  assertEquals(consoleRedirectLocation("/agentic", "http://localhost:8080"), null);
+});
+
+test("does not match a sibling route that merely starts with 'console'", () => {
+  assertEquals(consoleRedirectLocation("/console-x", "http://localhost:8080"), null);
+  assertEquals(consoleRedirectLocation("/consolexyz/app", "http://localhost:8080"), null);
+});
+
+test("matches /console immediately followed by a query", () => {
+  assertEquals(consoleRedirectLocation("/console?next=1", "http://localhost:8080"), "http://localhost:8080/console?next=1");
+});
+
+test("normalises a trailing slash on the console origin", () => {
+  assertEquals(consoleRedirectLocation("/console/x", "http://localhost:8080/"), "http://localhost:8080/console/x");
+});
+
+test("handles an absent url", () => {
+  assertEquals(consoleRedirectLocation(undefined, "http://localhost:8080"), null);
+});
+
+test("resolveConsoleOrigin gives CAMUNDA_REST_ADDRESS precedence over NANOBPMN_BASE_URL", () => {
+  const read = (name: string): string | null =>
+    name === "CAMUNDA_REST_ADDRESS"
+      ? "http://engine.example:8080/v2"
+      : name === "NANOBPMN_BASE_URL"
+        ? "http://localhost:9999"
+        : null;
+  assertEquals(resolveConsoleOrigin(read), "http://engine.example:8080");
+});
+
+test("resolveConsoleOrigin uses NANOBPMN_BASE_URL when CAMUNDA_REST_ADDRESS is unset", () => {
+  const read = (name: string): string | null =>
+    name === "NANOBPMN_BASE_URL" ? "https://engine.example.com:9000" : null;
+  assertEquals(resolveConsoleOrigin(read), "https://engine.example.com:9000");
+});
+
+test("resolveConsoleOrigin derives the origin from NANOBPMN_BASE_URL", () => {
+  const read = (name: string): string | null =>
+    name === "NANOBPMN_BASE_URL" ? "https://engine.example.com:9000" : null;
+  assertEquals(resolveConsoleOrigin(read), "https://engine.example.com:9000");
+});
+
+test("resolveConsoleOrigin strips any path from the base", () => {
+  assertEquals(resolveConsoleOrigin(() => "https://engine.example.com/v2/"), "https://engine.example.com");
+});
+
+test("resolveConsoleOrigin defaults to localhost:8080 when unset", () => {
+  assertEquals(resolveConsoleOrigin(() => null), "http://localhost:8080");
+});
+
+test("resolveConsoleOrigin falls back to the default on an unparseable value", () => {
+  assertEquals(resolveConsoleOrigin(() => "not a url"), "http://localhost:8080");
+});
+
+/** Spin up a real server with an app handler, mount the redirect, and return a fetch helper. */
+async function withServer(
+  run: (base: string, teardown: () => void) => Promise<void>,
+): Promise<void> {
+  const server: Server = createServer((_req, res) => {
+    res.statusCode = 200;
+    res.setHeader("content-type", "text/plain");
+    res.end("app-handled");
+  });
+  await new Promise<void>((resolve) => server.listen(0, "127.0.0.1", resolve));
+  const teardown = mountConsoleRedirect(server, "http://console.example:8080");
+  const { port } = server.address() as AddressInfo;
+  try {
+    await run(`http://127.0.0.1:${port}`, teardown);
+  } finally {
+    await new Promise<void>((resolve) => server.close(() => resolve()));
+  }
+}
+
+test("mount: /console/* is answered with a 302 to the console origin, not the app handler", async () => {
+  await withServer(async (base) => {
+    const res = await fetch(`${base}/console/app-view/Workforce?tab=x`, { redirect: "manual" });
+    assertEquals(res.status, 302);
+    assertEquals(res.headers.get("location"), "http://console.example:8080/console/app-view/Workforce?tab=x");
+    // 302 body is empty — the app handler must not have run.
+    assertEquals(await res.text(), "");
+  });
+});
+
+test("mount: a non-console request is delegated to the app handler unchanged", async () => {
+  await withServer(async (base) => {
+    const res = await fetch(`${base}/app/api/agent`, { redirect: "manual" });
+    assertEquals(res.status, 200);
+    assertEquals(await res.text(), "app-handled");
+  });
+});
+
+test("mount: teardown restores the original app handler for /console too", async () => {
+  await withServer(async (base, teardown) => {
+    teardown();
+    const res = await fetch(`${base}/console/x`, { redirect: "manual" });
+    assertEquals(res.status, 200);
+    assert((await res.text()) === "app-handled");
+  });
+});

package/app/consoleRedirect.ts

@@ -0,0 +1,122 @@
+// Standalone `/console` → engine-console redirect (issue #771).
+//
+// When Nano Workforce runs **embedded** behind the nano console, the console origin serves
+// `/console/*` (its app-view host, `/console/app-view/Workforce/…`) and the reverse proxy strips the
+// `/console/app-view/Workforce` prefix before the app's own HTTP server ever sees the request — so
+// the app only ever handles `/app/*`, `/agentic`, and its page routes at the root.
+//
+// Run **standalone** (the default `npm start` on a bare port, no console proxy in front), links the
+// UI emits under `/console` — the engine console's own origin — hit this app's port instead, where
+// nothing serves them: the runtime answers a bare 503 because `/console/*` is not a registered
+// app-view route. This is a narrow Node request redirect that rewrites those `/console/*` requests to
+// the engine console origin, preserving the full path + query, and leaves every other route
+// (`/app/*`, `/agentic`, the Workforce page routes at the root) untouched — it only ever fires for a
+// path that is exactly `/console` or under `/console/`.
+//
+// The redirect is derived, not configured twice: the engine console shares the engine's origin, so
+// the target origin comes from the CANONICAL engine-address resolution (`resolveEngineAddress`,
+// `app/enginePreflight.ts`) — an explicit `CAMUNDA_REST_ADDRESS` wins over `NANOBPMN_BASE_URL`
+// (default `http://localhost:8080`), the same precedence and single source of truth the engine
+// client uses, so the redirect target can never drift from the engine the app actually talks to.
+// Mounting it when embedded is harmless: the proxy owns `/console` there, so the app's server never
+// sees such a path.
+
+import type { IncomingMessage, RequestListener, Server, ServerResponse } from "node:http";
+import { resolveEngineAddress } from "./enginePreflight.ts";
+import { envVar } from "./version.ts";
+
+/** A minimal logging surface (structurally a subset of `Logger`) the mount uses at boot. */
+export interface ConsoleRedirectLog {
+  info(msg: string): void;
+}
+
+/**
+ * The `Location` a `/console`-prefixed request should be redirected to, or `null` when the request
+ * is NOT a console route (and so must be left for the app's own handlers).
+ *
+ * Matches ONLY a path that is exactly `/console` or begins with `/console/` — a sibling route such
+ * as `/console-x` or `/app/console` is deliberately NOT matched, keeping the redirect narrow. The
+ * full original request target (path + query) is preserved by appending it verbatim to the console
+ * origin: because the request path already carries the `/console` prefix, the result is
+ * `<consoleOrigin>/console/<rest>?<query>`.
+ *
+ * @param url          the raw request target (`req.url`), e.g. `/console/app-view/Foo?tab=bar`.
+ * @param consoleOrigin the engine console origin (scheme + authority, no trailing slash), e.g.
+ *                      `http://localhost:8080`.
+ */
+export function consoleRedirectLocation(
+  url: string | undefined,
+  consoleOrigin: string,
+): string | null {
+  if (!url) return null;
+  const queryAt = url.indexOf("?");
+  const path = queryAt === -1 ? url : url.slice(0, queryAt);
+  if (path === "/console" || path.startsWith("/console/")) {
+    return `${consoleOrigin.replace(/\/+$/, "")}${url}`;
+  }
+  return null;
+}
+
+/**
+ * Resolve the engine console origin (scheme + authority) from the CANONICAL engine-address
+ * resolution (`resolveEngineAddress`, `app/enginePreflight.ts`). The engine console is served on the
+ * engine's own origin, so this reuses the single engine-base source of truth — including its
+ * precedence — rather than reading one input directly. That means an explicit `CAMUNDA_REST_ADDRESS`
+ * (already the `/v2` REST address) wins over `NANOBPMN_BASE_URL`, exactly as the engine client
+ * resolves it; the redirect target can never drift from the engine the app actually talks to. Only
+ * the origin is meaningful for the redirect, so any path/query on the resolved address (e.g. the
+ * `/v2` suffix) is discarded. Falls back to the localhost default when the resolved value is
+ * unparseable.
+ *
+ * `read` is injectable so resolution is testable without mutating `process.env`.
+ */
+export function resolveConsoleOrigin(read: (name: string) => string | null = envVar): string {
+  const { restAddress } = resolveEngineAddress(read);
+  try {
+    return new URL(restAddress).origin;
+  } catch {
+    return "http://localhost:8080";
+  }
+}
+
+/**
+ * Prepend a `/console` → engine-console redirect in front of `server`'s existing request handling.
+ *
+ * The runtime has already attached the app's own `request` listener(s) by the time this runs, so we
+ * capture them, remove them, and install a single wrapper that either answers a `/console/*` request
+ * with a `302` (preserving path + query) or delegates to every captured listener unchanged. This
+ * keeps the app's own routing (control API, pages, agentic upgrade) intact for every non-console
+ * request while giving the redirect first refusal on the console prefix.
+ *
+ * Returns a teardown that restores the original listener set.
+ */
+export function mountConsoleRedirect(
+  server: Server,
+  consoleOrigin: string,
+  log?: ConsoleRedirectLog,
+): () => void {
+  // `Server#listeners` is typed `Function[]` by Node; narrow to the request-listener signature so we
+  // can re-invoke and later restore them.
+  // biome-ignore lint/plugin: runtime/framework contract boundary for Node's untyped listeners()
+  const existing = server.listeners("request") as RequestListener[];
+  server.removeAllListeners("request");
+
+  const handler = (req: IncomingMessage, res: ServerResponse): void => {
+    const location = consoleRedirectLocation(req.url, consoleOrigin);
+    if (location !== null) {
+      res.statusCode = 302;
+      res.setHeader("Location", location);
+      res.end();
+      return;
+    }
+    for (const listener of existing) listener.call(server, req, res);
+  };
+
+  server.on("request", handler);
+  log?.info(`console redirect mounted: /console/* → ${consoleOrigin}/console/* (standalone links)`);
+
+  return () => {
+    server.removeListener("request", handler);
+    for (const listener of existing) server.on("request", listener);
+  };
+}

package/app/contracts.ts

@@ -399,9 +399,9 @@ export const WIRE_CONTRACTS = {
     name: "io.nanobpm.agentTask.repository",
     owner: "app/repoEnvelope.ts",
     semantics:
-      "Repo-provisioning envelope the app emits as a `createInstance` process variable (`repoEnvelopeVars`, app/repoEnvelope.ts) and the c8ctl worker harness consumes to provision an isolated clone — instead of the agent inheriting the worker's launch dir (issue #684). `ref` is the branch checked out: the PR HEAD branch on the PR-based paths (review-round / fix-ci / rebase), or — on the PRE-PR implementation path (feature.bpmn / plan-fanout's `implement-cell`, issue #684; the delivery-graph runner's agent cells, issue #686) — the BASE branch, off which the harness cuts a new feature branch named by the optional `branch.create` (the deterministic `feat/<task.id>`, emitted only for a single-task feature run; the epic seed AND the delivery-graph run-root seed omit it so each fan-out slice's agent branches per node/MI child). Beyond `{provider,url,ref}`, it carries clone-shaping fields for large monorepos (issue #287): `singleBranch:true` + `filter:\"blob:none\"` (a branch-scoped, blobless partial clone — trees fetched up-front, blobs lazily, no `--depth 1` so the merge-base/3-dot diff stays valid) and an optional `baseRef` (the PR base branch, emitted only when resolvable, so the harness fetches its tip and keeps `origin/<base>` reachable) and a `cloneTimeoutMs` (from `NANO_PR_CLONE_TIMEOUT_MS`, default 600000 = 10 min) that raises the harness's 120s default so a large monorepo's blobless single-branch clone provisions instead of dying at 120s (issue #694). World-restore (issue #324, ADR 0062 Slice 4/5): an optional `sha` — the last durable push-checkpoint — is emitted so a REPLACEMENT activation on a fresh worktree reconstructs the tree to the EXACT pushed SHA (inverting the round's `git push` into `git fetch && git checkout <sha>`), omitted when the PR has no checkpoint yet. The field is named `sha` because that is the field the c8ctl harness's `provisionRepo` reads to drive the checkout — an earlier `commitSha` key was a silent no-op (issue #695). Gated on c8ctl provisioner support (jwulf/c8ctl-plugin-nano#91).",
+      "Repo-provisioning envelope the app emits as a `createInstance` process variable (`repoEnvelopeVars`, app/repoEnvelope.ts) and the c8ctl worker harness consumes to provision an isolated clone — instead of the agent inheriting the worker's launch dir (issue #684). `ref` is the branch checked out: the PR HEAD branch on the PR-based paths (review-round / fix-ci / rebase), or — on the PRE-PR implementation path (feature.bpmn / plan-fanout's `implement-cell`, issue #684; the delivery-graph runner's agent cells, issue #686) — the BASE branch, off which the harness cuts a new feature branch named by the optional `branch.create` (the deterministic `feat/<task.id>`, emitted only for a single-task feature run; the epic seed AND the delivery-graph run-root seed omit it so each fan-out slice's agent branches per node/MI child). Beyond `{provider,url,ref}`, it carries clone-shaping fields for large monorepos (issue #287): `singleBranch:true` + `filter:\"blob:none\"` (a branch-scoped, blobless partial clone — trees fetched up-front, blobs lazily, no `--depth 1` so the merge-base/3-dot diff stays valid) and an optional `baseRef` (the PR base branch, emitted only when resolvable, so the harness fetches its tip and keeps `origin/<base>` reachable) and a `cloneTimeoutMs` (from `NANO_PR_CLONE_TIMEOUT_MS`, default 600000 = 10 min) that raises the harness's 120s default so a large monorepo's blobless single-branch clone provisions instead of dying at 120s (issue #694). World-restore (issue #324, ADR 0062 Slice 4/5): an optional `sha` — the last durable push-checkpoint — is emitted so a REPLACEMENT activation on a fresh worktree reconstructs the tree to the EXACT pushed SHA (inverting the round's `git push` into `git fetch && git checkout <sha>`), omitted when the PR has no checkpoint yet. The field is named `sha` because that is the field the c8ctl harness's `provisionRepo` reads to drive the checkout — an earlier `commitSha` key was a silent no-op (issue #695). Alongside the `repository` slice the envelope carries a sibling `task.allowPr: true` (issue #770): c8ctl-plugin-nano (≥1.60.2) only resolves the git credential (GITHUB_TOKEN, or the `gh` default) for repo provisioning behind that flag, so every repo-backed envelope sets it or the clone dies with `unable to get password from user`; the repoless path emits no envelope and so no `task`. Gated on c8ctl provisioner support (jwulf/c8ctl-plugin-nano#91).",
     shape:
-      '{ provider: "github", url: string, ref: string, singleBranch: true, filter: "blob:none", cloneTimeoutMs: number, baseRef?: string, sha?: string, branch?: { create: string } }',
+      'io.nanobpm.agentTask: { repository: { provider: "github", url: string, ref?: string, singleBranch: true, filter: "blob:none", cloneTimeoutMs: number, baseRef?: string, sha?: string, branch?: { create: string } }, task: { allowPr: true } }',
   },
   "epicSet.submit": {
     category: "wire",

package/app/deliveryRunner.test.ts

@@ -485,6 +485,9 @@ test("prepareDeliveryGraph injects the repository envelope PER agent cell from t
   assert(headers.some((h) => h.includes('repository.provider" value="github"')), "provider header");
   assert(headers.some((h) => h.includes('repository.singleBranch" value="true"')), "branch-scoped blobless clone (#287)");
   assert(headers.some((h) => h.includes('repository.filter" value="blob:none"')), "blobless filter");
+  // Repo-provisioning auth gate (issue #770): the per-cell envelope carries `task.allowPr:true` so the
+  // c8ctl harness resolves the git credential for the clone instead of failing on password prompt.
+  assert(headers.some((h) => h.includes('task.allowPr" value="true"')), `expected a task.allowPr header, got ${JSON.stringify(headers)}`);
   // No `__repoSpec` marker survives injection — it is the compiler's digest-stable anchor only.
   assert(!p.bpmn.includes("__repoSpec"), "the __repoSpec marker is fully replaced");
   // No run-root `io.nanobpm.agentTask` variable — the envelope rides headers now, not a run variable.

package/app/repoEnvelope.ts

@@ -191,6 +191,14 @@ export function repoEnvelopeVars(
           ? { branch: { create: branchCreate.trim() } }
           : {}),
       },
+      // Repo-provisioning auth gate (issue #770): c8ctl-plugin-nano (≥1.60.2) only resolves the
+      // git credential (GITHUB_TOKEN, or the `gh` default when it's absent) for repository
+      // provisioning when `task.allowPr` is truthy — `resolveJobSecrets` pulls the token behind that
+      // flag. Without it, a repo-backed clone dies with `unable to get password from user` before the
+      // agent even starts. So EVERY repo-backed envelope (this builder only runs past the `owner/repo`
+      // guard above) opts the harness into auth-resolved provisioning. The repoless path emits `{}`
+      // (no envelope, no `task`), so its behaviour — and its auth posture — is unchanged.
+      task: { allowPr: true },
     },
   };
 }
@@ -222,6 +230,11 @@ export function agentNodeRepoEnvelope(repo: string, base: string | null): Record
         // `feat/<node.id>` off. Omitted when unknown so the harness clones the repo's default branch.
         ...(ref ? { ref, baseRef: ref } : {}),
       },
+      // Repo-provisioning auth gate (issue #770): as in `repoEnvelopeVars`, a repo-backed cell must
+      // opt the harness into git-credential resolution (`task.allowPr`) or the clone fails with
+      // `unable to get password from user`. Emitted on every resolved cell (past the `owner/repo`
+      // guard above); an unresolved/`repoless` cell returns `{}` and carries no `task`.
+      task: { allowPr: true },
     },
   };
 }

package/app/service.test.ts

@@ -487,6 +487,24 @@ test("repoEnvelopeVars emits the repository envelope keyed on the PR head branch
   assertEquals(env.repository.cloneTimeoutMs, 600000);
 });
 
+// Repo-provisioning auth gate (issue #770): c8ctl-plugin-nano (≥1.60.2) only resolves the git
+// credential (GITHUB_TOKEN, or the `gh` default when it's absent) for repository provisioning when
+// `task.allowPr` is truthy. Without it a repo-backed clone dies with `unable to get password from
+// user` before the agent starts. Every repo-backed envelope must therefore carry `task.allowPr:
+// true`; the repoless (unresolved) path emits nothing, so it carries no `task` and is unchanged.
+test("repoEnvelopeVars emits task.allowPr:true on every repo-backed envelope (#770)", () => {
+  // PR-based path (review-round / fix-ci / rebase).
+  const pr = (repoEnvelopeVars("owner/repo", "feat/issue-12", "main") as any)["io.nanobpm.agentTask"];
+  assertEquals(pr.task.allowPr, true, "the PR-based envelope opts the harness into auth-resolved provisioning");
+  // Pre-PR implementation path (feature.bpmn / plan-fanout's implement-cell, #684).
+  const prePr = (repoEnvelopeVars("owner/repo", "main", null, null, "feat/issue-7") as any)["io.nanobpm.agentTask"];
+  assertEquals(prePr.task.allowPr, true, "the pre-PR envelope opts in too");
+  // A repoless / unresolved input emits NOTHING — no envelope, and so no `task` (auth posture
+  // unchanged: the launch-dir fallback needs no repo credential).
+  assertEquals(Object.keys(repoEnvelopeVars("owner/repo", null)).length, 0, "unresolved head → no envelope, no task");
+  assertEquals(Object.keys(repoEnvelopeVars("not-owner-repo", "feat/x")).length, 0, "malformed repo → no envelope, no task");
+});
+
 test("repoEnvelopeVars emits cloneTimeoutMs from NANO_PR_CLONE_TIMEOUT_MS, default 600000 (#694)", () => {
   // Default (knob unset): 600000ms = 10 min, raising the harness's 120000ms default so a
   // branch-scoped blobless clone of a large monorepo provisions instead of dying at 120s.

package/main.ts

@@ -21,6 +21,7 @@ import { Server } from "node:http";
 import { createNanoSdkEngineClient, runFromEnv, selectHost } from "@nanobpm/urban";
 import { type AgenticChannelHandle, mountAgenticChannel } from "./app/agentic/channel.ts";
 import { makeElementInstanceResolver } from "./app/agentic/element-instance.ts";
+import { mountConsoleRedirect, resolveConsoleOrigin } from "./app/consoleRedirect.ts";
 import { announceEngine, resolveEngineAddress } from "./app/enginePreflight.ts";
 import { runEngineReconcile } from "./app/reconcile.ts";
 import { MAX_ROUNDS, pollOnce } from "./app/service.ts";
@@ -103,6 +104,20 @@ if (httpServer instanceof Server) {
   app.log.warn("agentic channel not mounted: app.httpServer is not a node:http Server on this host");
 }
 
+// Standalone `/console` redirect (issue #771). Running behind the nano console, the console origin
+// serves `/console/*` and the reverse proxy strips its app-view prefix before the app ever sees a
+// request — but STANDALONE, the UI's `/console` links land on this app's own port, where nothing
+// serves them, so the runtime answers a bare 503. Mount a narrow request redirect that rewrites
+// `/console/*` to the engine console origin (derived from the CANONICAL engine-address resolution,
+// `resolveEngineAddress`, so an explicit `CAMUNDA_REST_ADDRESS` wins over `NANOBPMN_BASE_URL`),
+// preserving path + query, and leaves `/app/*`, `/agentic`, and the Workforce page routes untouched.
+// Mounted last so it captures every request listener the runtime + agentic channel attached, and
+// delegates each non-console request to them unchanged.
+let consoleRedirectTeardown: (() => void) | undefined;
+if (httpServer instanceof Server) {
+  consoleRedirectTeardown = mountConsoleRedirect(httpServer, resolveConsoleOrigin(), app.log);
+}
+
 // Engine-reset reconciliation (issues #622, #630). On boot, compare the engine's incarnation epoch
 // against the last-seen value; on a REGRESSION (the engine was reset/restored/rewound and re-minted
 // its keys, Magikcraft/nano-bpm#1065) drive every dangling engine-backed inflight row to the defined
@@ -153,6 +168,12 @@ async function drainAndExit(): Promise<void> {
   if (shuttingDown) return;
   shuttingDown = true;
   if (pollTimer) clearTimeout(pollTimer);
+  // Restore the original request listener set (drops the /console redirect wrapper).
+  if (consoleRedirectTeardown) {
+    try {
+      consoleRedirectTeardown();
+    } catch { /* best-effort redirect teardown */ }
+  }
   // Tear the agentic families + hub down (releases the WS clients) before the app stops its HTTP
   // server, which the channel shares.
   if (agentic) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nanobpm/nano-workforce",
-  "version": "0.186.2",
+  "version": "0.186.4",
   "description": "Nano Workforce — an Agent Graph Orchestration application for Agentic SDLC: durable BPMN processes that coordinate a graph of AI agents across the software delivery lifecycle.",
   "type": "module",
   "main": "main.ts",