@worca/ui 0.32.0 → 0.34.0

package/app/styles.css

@@ -5651,6 +5651,36 @@ sl-tooltip.bead-tooltip::part(body) {
   gap: 4px;
 }
 
+/* Workspace plan upload (existing mode) */
+.workspace-plan-upload {
+  display: flex;
+  flex-direction: column;
+  gap: 8px;
+}
+.workspace-plan-advanced {
+  font-size: 13px;
+}
+.workspace-plan-advanced sl-input {
+  margin-top: 4px;
+}
+
+/* Per-project plan rows (per-repo mode) */
+.per-project-plans {
+  display: flex;
+  flex-direction: column;
+  gap: 6px;
+}
+.per-project-plan-row {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+}
+.per-project-plan-name {
+  min-width: 100px;
+  font-size: 13px;
+  font-weight: 500;
+}
+
 /* Base-branch validation states */
 .base-branch-validating {
   display: flex;
@@ -6288,6 +6318,9 @@ sl-dialog.markdown-dialog::part(body) {
   font-size: 12px;
   max-height: 200px;
   overflow-y: auto;
+  /* Inherit the tooltip's (light) text color instead of --fg, which is the
+     main-panel foreground and renders dark-on-dark inside the tooltip. */
+  color: inherit;
 }
 .bead-tooltip-excerpt.markdown-body p {
   margin: 0.3em 0;
@@ -6297,6 +6330,18 @@ sl-dialog.markdown-dialog::part(body) {
   max-height: 120px;
   overflow: auto;
 }
+/* The base markdown code/blockquote/link colors assume the light main panel;
+   re-tint them for the dark tooltip surface so they stay legible. */
+.bead-tooltip-excerpt.markdown-body code,
+.bead-tooltip-excerpt.markdown-body pre {
+  background: rgba(255, 255, 255, 0.1);
+  border-color: rgba(255, 255, 255, 0.15);
+}
+.bead-tooltip-excerpt.markdown-body blockquote {
+  color: inherit;
+  opacity: 0.8;
+  border-left-color: rgba(255, 255, 255, 0.3);
+}
 
 .workspace-run-card .workspace-card-root,
 .workspace-run-card .workspace-card-name {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@worca/ui",
-  "version": "0.32.0",
+  "version": "0.34.0",
   "description": "Pipeline monitoring UI for worca-cc",
   "license": "MIT",
   "author": "Sinisha Djukic",

package/server/app.js

@@ -65,6 +65,39 @@ function runWorcaCleanupSubprocess(flag, id) {
   });
 }
 
+export function buildWorkspaceArgs(workspace_root, workspace_id, manifest) {
+  const args = [
+    '-m',
+    'worca.scripts.run_workspace',
+    workspace_root,
+    '--workspace-id',
+    workspace_id,
+  ];
+  if (manifest.work_request?.source) {
+    args.push('--source', manifest.work_request.source);
+  } else {
+    args.push('--prompt', manifest.work_request?.description ?? '');
+  }
+  if (manifest.branch_template) {
+    args.push('--branch', manifest.branch_template);
+  }
+  if (manifest.skip_integration) args.push('--skip-integration');
+  if (manifest.skip_planning) args.push('--skip-planning');
+  if (manifest.max_parallel) {
+    args.push('--max-parallel', String(manifest.max_parallel));
+  }
+  for (const p of manifest.guide?.paths || []) {
+    args.push('--guide', p);
+  }
+  if (manifest.workspace_plan_path) {
+    args.push('--workspace-plan', manifest.workspace_plan_path);
+  }
+  for (const [name, path] of Object.entries(manifest.project_plans || {})) {
+    args.push('--project-plan', `${name}=${path}`);
+  }
+  return args;
+}
+
 export function createApp(options = {}) {
   const app = express();
   const appDir = join(dirname(fileURLToPath(import.meta.url)), '..', 'app');
@@ -733,29 +766,7 @@ export function createApp(options = {}) {
           child.unref();
           return;
         }
-        const args = [
-          '-m',
-          'worca.scripts.run_workspace',
-          workspace_root,
-          '--workspace-id',
-          workspace_id,
-        ];
-        if (manifest.work_request?.source) {
-          args.push('--source', manifest.work_request.source);
-        } else {
-          args.push('--prompt', manifest.work_request?.description ?? '');
-        }
-        if (manifest.branch_template) {
-          args.push('--branch', manifest.branch_template);
-        }
-        if (manifest.skip_integration) args.push('--skip-integration');
-        if (manifest.skip_planning) args.push('--skip-planning');
-        if (manifest.max_parallel) {
-          args.push('--max-parallel', String(manifest.max_parallel));
-        }
-        for (const p of manifest.guide?.paths || []) {
-          args.push('--guide', p);
-        }
+        const args = buildWorkspaceArgs(workspace_root, workspace_id, manifest);
         const child = spawn('python3', args, {
           detached: true,
           stdio: 'ignore',

package/server/dispatch-defaults.js

@@ -64,8 +64,12 @@ export const DISPATCH_DEFAULTS = {
     },
   },
   subagents: {
-    always_disallowed: ['general-purpose'],
-    default_denied: [],
+    always_disallowed: [],
+    // general-purpose spawns an unconstrained full-tool Claude session, so it
+    // stays denied under the '*' wildcard — but as default_denied (not
+    // always_disallowed) a project can re-allow it per agent by naming it in
+    // per_agent_allow.
+    default_denied: ['general-purpose'],
     per_agent_allow: { _defaults: ['*'] },
   },
 };

package/server/dispatch-migration.js

@@ -60,7 +60,10 @@ function _absorbFlatDispatchKeys(dispatch) {
 // Mirror of normalize_dispatch_defaults() in src/worca/hooks/tracking.py.
 // Bumped when a new one-time normalization is added; stamped onto
 // governance.dispatch_migration_version so it runs exactly once per config.
-export const DISPATCH_MIGRATION_VERSION = 1;
+//   v1: collapse stale Explore-only subagent default; narrow worca-* skills glob.
+//   v2: move general-purpose from subagents.always_disallowed to default_denied
+//       (still denied by default, but allowable per-agent).
+export const DISPATCH_MIGRATION_VERSION = 2;
 
 // Pre-W-054 (W-038-era) shipped subagent default: every pipeline agent capped
 // to Explore-only. coordinator:[] / empty lists fall through to _defaults and
@@ -151,6 +154,36 @@ export function adoptNarrowedSkillsDenylist(skillsCfg) {
   return true;
 }
 
+/**
+ * Move general-purpose from subagents.always_disallowed to default_denied so
+ * it is allowable per-agent (still denied under the '*' wildcard). Only fires
+ * on an untouched denylist (exactly `['general-purpose']`); a customized list
+ * is left alone. Preserves existing default_denied entries. Returns true if
+ * changed. Mirror of adopt_general_purpose_allowable() in tracking.py.
+ *
+ * @param {object} subagentsCfg
+ * @returns {boolean}
+ */
+export function adoptGeneralPurposeAllowable(subagentsCfg) {
+  if (!subagentsCfg || typeof subagentsCfg !== 'object') return false;
+  const current = subagentsCfg.always_disallowed;
+  if (
+    !Array.isArray(current) ||
+    current.length !== 1 ||
+    current[0] !== 'general-purpose'
+  ) {
+    return false;
+  }
+  const denied = Array.isArray(subagentsCfg.default_denied)
+    ? subagentsCfg.default_denied
+    : [];
+  subagentsCfg.always_disallowed = [];
+  subagentsCfg.default_denied = denied.includes('general-purpose')
+    ? denied
+    : [...denied, 'general-purpose'];
+  return true;
+}
+
 /**
  * Apply one-time dispatch-default normalizations, gated by a version stamp.
  * Brings an *untouched* config up to current shipped defaults for the two
@@ -177,6 +210,11 @@ export function normalizeDispatchDefaults(governanceCfg) {
       'governance.dispatch.skills.always_disallowed: narrowed legacy "worca-*" glob to the current must-disallow set',
     );
   }
+  if (adoptGeneralPurposeAllowable(dispatch.subagents)) {
+    changes.push(
+      'governance.dispatch.subagents: moved general-purpose from always_disallowed to default_denied (now allowable per-agent)',
+    );
+  }
   governanceCfg.dispatch_migration_version = DISPATCH_MIGRATION_VERSION;
   return changes;
 }

package/server/integrations/renderers.js

@@ -453,6 +453,32 @@ function renderWorkspacePlanFailed(envelope) {
   return mdMsg(parts.join('\n'), 'error');
 }
 
+function renderWorkspacePlanLoaded(envelope) {
+  const p = envelope.payload ?? {};
+  const parts = [`📋 **Workspace plan loaded:** ${workspaceTitle(envelope)}`];
+  parts.push(
+    `   **Mode:** ${p.mode ?? '?'} (${p.project_count ?? '?'} project${p.project_count === 1 ? '' : 's'})`,
+  );
+  return mdMsg(parts.join('\n'), 'info');
+}
+
+function renderWorkspacePlanPartial(envelope) {
+  const p = envelope.payload ?? {};
+  const uncovered = Array.isArray(p.uncovered_projects)
+    ? p.uncovered_projects
+    : [];
+  const parts = [
+    `⚠ **Workspace plan partial coverage:** ${workspaceTitle(envelope)}`,
+  ];
+  parts.push(
+    `   **Mode:** ${p.mode ?? '?'} — ${uncovered.length} uncovered project${uncovered.length === 1 ? '' : 's'}`,
+  );
+  if (uncovered.length > 0) {
+    parts.push(`   **Uncovered:** ${uncovered.join(', ')}`);
+  }
+  return mdMsg(parts.join('\n'), 'warning');
+}
+
 function renderWorkspaceTierStarted(envelope) {
   const p = envelope.payload ?? {};
   const projects = Array.isArray(p.projects) ? p.projects : [];
@@ -570,6 +596,8 @@ export const OPT_IN_RENDERERS = {
   'workspace.plan.started': renderWorkspacePlanStarted,
   'workspace.plan.completed': renderWorkspacePlanCompleted,
   'workspace.plan.failed': renderWorkspacePlanFailed,
+  'workspace.plan.loaded': renderWorkspacePlanLoaded,
+  'workspace.plan.partial': renderWorkspacePlanPartial,
   'workspace.tier.started': renderWorkspaceTierStarted,
   'workspace.tier.completed': renderWorkspaceTierCompleted,
   'workspace.integration_test.started': renderWorkspaceIntegrationStarted,

package/server/project-routes.js

@@ -1587,9 +1587,9 @@ export function createProjectScopedRoutes({
   router.get('/templates', (req, res) => {
     const root = req.project.projectRoot;
     const tiers = [
-      { tier: 'worca', dir: join(root, '.claude', 'worca', 'templates') },
-      { tier: 'project', dir: join(root, '.claude', 'templates') },
       { tier: 'user', dir: templatesDir() },
+      { tier: 'project', dir: join(root, '.claude', 'templates') },
+      { tier: 'worca', dir: join(root, '.claude', 'worca', 'templates') },
     ];
 
     const templates = [];

package/server/safe-watch.js

@@ -0,0 +1,11 @@
+import { watch } from 'node:fs';
+
+export function safeWatch(...args) {
+  const w = watch(...args);
+  w.on('error', (err) => {
+    if (err && err.code !== 'EPERM' && err.code !== 'ENOENT') {
+      console.error('[safeWatch] watcher error:', err);
+    }
+  });
+  return w;
+}

package/server/watcher.js

@@ -1,11 +1,12 @@
 import { createHash } from 'node:crypto';
-import { existsSync, readdirSync, readFileSync, watch } from 'node:fs';
+import { existsSync, readdirSync, readFileSync } from 'node:fs';
 import { readdir, readFile } from 'node:fs/promises';
 import { join } from 'node:path';
 import {
   assignEventsToIterations,
   readDispatchEventsFromJsonl,
 } from './dispatch-events-aggregator.js';
+import { safeWatch } from './safe-watch.js';
 
 /**
  * Enrich a status object with dispatch events read from events.jsonl in the
@@ -366,7 +367,7 @@ export function watchEvents(runDir, callback) {
   function startFileWatcher() {
     if (closed || fileWatcher) return;
     try {
-      fileWatcher = watch(eventsPath, (eventType) => {
+      fileWatcher = safeWatch(eventsPath, (eventType) => {
         if (eventType === 'change') {
           processNewContent();
         } else if (eventType === 'rename') {
@@ -405,7 +406,7 @@ export function watchEvents(runDir, callback) {
   // Watch the run directory so we detect events.jsonl being created
   if (existsSync(runDir)) {
     try {
-      dirWatcher = watch(
+      dirWatcher = safeWatch(
         runDir,
         { recursive: false },
         (_eventType, filename) => {

package/server/workspace-routes.js

@@ -29,6 +29,8 @@ import {
 } from './paths.js';
 
 const GUIDE_CAP_BYTES_DEFAULT = 64 * 1024;
+const PROJECT_PLAN_CAP_BYTES = 256 * 1024;
+const WORKSPACE_PLAN_CAP_BYTES = 256 * 1024;
 
 const WS_ID_RE = /^ws_\d{12}_[0-9a-f]{1,32}$/;
 
@@ -557,6 +559,105 @@ function parseMultipart(body, contentType) {
   return parts;
 }
 
+// ─── plan strategy resolution ─────────────────────────────────────────────
+
+/**
+ * Map a plan_mode to the manifest fields it implies and validate
+ * mode-specific preconditions.
+ *
+ * @param {string} plan_mode - 'master' | 'existing' | 'per-repo' | 'independent'
+ * @param {string|null} workspace_plan_path
+ * @param {Object|null} project_plans - { projectName: filePath, ... }
+ * @param {Object} ws - parsed workspace.json (needs ws.projects)
+ * @returns {{ ok: true, fields: object } | { ok: false, status: number, error: string }}
+ */
+export function _resolvePlanStrategy(
+  plan_mode,
+  workspace_plan_path,
+  project_plans,
+  ws,
+) {
+  const mode = plan_mode || 'master';
+  const projectNames = new Set((ws.projects ?? []).map((p) => p.name));
+
+  if (mode === 'existing') {
+    if (!workspace_plan_path) {
+      return {
+        ok: false,
+        status: 400,
+        error:
+          'existing mode requires a workspace plan (upload or server-side path)',
+      };
+    }
+    return {
+      ok: true,
+      fields: {
+        plan_mode: 'existing',
+        workspace_plan_path,
+        project_plans: null,
+        skip_planning: false,
+      },
+    };
+  }
+
+  if (mode === 'per-repo') {
+    const plans = project_plans ?? {};
+    const planKeys = Object.keys(plans);
+    if (planKeys.length === 0) {
+      return {
+        ok: false,
+        status: 400,
+        error: 'per-repo mode requires at least one project plan',
+      };
+    }
+    const unknown = planKeys.filter((name) => !projectNames.has(name));
+    if (unknown.length > 0) {
+      return {
+        ok: false,
+        status: 422,
+        error: `Unknown project(s) in per-repo plans: ${unknown.join(', ')}`,
+      };
+    }
+    return {
+      ok: true,
+      fields: {
+        plan_mode: 'per-repo',
+        workspace_plan_path: null,
+        project_plans: plans,
+        skip_planning: false,
+      },
+    };
+  }
+
+  if (mode === 'independent') {
+    return {
+      ok: true,
+      fields: {
+        plan_mode: 'independent',
+        workspace_plan_path: null,
+        project_plans: null,
+        skip_planning: true,
+      },
+    };
+  }
+
+  // master (default) — ignore any stray plan inputs. master mode always runs
+  // the master planner; the Python CLI infers its mode from which flags are
+  // present, so passing --workspace-plan/--project-plan through here would
+  // silently run the job as existing/per-repo while the manifest (and badge)
+  // still claimed "master". Null them out to keep declared mode and actual
+  // behavior in lockstep.
+  return {
+    ok: true,
+    fields: {
+      plan_mode: 'master',
+      workspace_plan_path: null,
+      project_plans: null,
+      skip_planning: false,
+    },
+  };
+}
+
 // ─── default injectables ──────────────────────────────────────────────────
 
 function defaultValidateBaseBranch(repoPath, branch) {
@@ -929,6 +1030,8 @@ export function createWorkspaceRouter({
 
       let fields = {};
       const guideFiles = [];
+      let workspacePlanFileData = null;
+      const projectPlanFiles = {};
 
       if (isMultipart) {
         const rawBody = await readRawBody(req);
@@ -939,7 +1042,21 @@ export function createWorkspaceRouter({
             .json({ ok: false, error: 'Failed to parse multipart body' });
         }
         for (const part of parts) {
-          if (part.filename != null) {
+          if (part.name === 'workspace_plan_file' && part.filename != null) {
+            workspacePlanFileData = {
+              filename: part.filename,
+              content: part.content,
+            };
+          } else if (
+            part.name?.startsWith('project_plan_') &&
+            part.filename != null
+          ) {
+            const projectName = part.name.slice('project_plan_'.length);
+            projectPlanFiles[projectName] = {
+              filename: part.filename,
+              content: part.content,
+            };
+          } else if (part.filename != null) {
             guideFiles.push({ filename: part.filename, content: part.content });
           } else if (part.name) {
             fields[part.name] = part.content.toString('utf8');
@@ -1035,6 +1152,57 @@ export function createWorkspaceRouter({
         guideEntry = { paths, bytes: totalBytes, filenames, uploaded: true };
       }
 
+      // ── workspace plan file upload / server-side path ──────────────
+      let workspacePlanPath = null;
+      if (workspacePlanFileData) {
+        if (workspacePlanFileData.content.length > WORKSPACE_PLAN_CAP_BYTES) {
+          return res.status(400).json({
+            ok: false,
+            error: 'Workspace plan exceeds 256 KB limit',
+          });
+        }
+        workspacePlanPath = join(wsRunDir, 'workspace-plan.json');
+        writeFileSync(workspacePlanPath, workspacePlanFileData.content);
+      } else if (fields.workspace_plan) {
+        if (!existsSync(fields.workspace_plan)) {
+          return res.status(400).json({
+            ok: false,
+            error: `workspace_plan path not found: ${fields.workspace_plan}`,
+          });
+        }
+        workspacePlanPath = fields.workspace_plan;
+      }
+
+      // ── per-project plan file uploads ──────────────────────────────
+      const projectPlans = {};
+      for (const [name, file] of Object.entries(projectPlanFiles)) {
+        if (file.content.length > PROJECT_PLAN_CAP_BYTES) {
+          return res.status(400).json({
+            ok: false,
+            error: `Project plan for "${name}" exceeds 256 KB limit`,
+          });
+        }
+        const safeName = sanitizeFilename(name);
+        const plansDir = join(wsRunDir, 'plans');
+        mkdirSync(plansDir, { recursive: true });
+        const planPath = join(plansDir, `${safeName}.md`);
+        writeFileSync(planPath, file.content);
+        projectPlans[name] = planPath;
+      }
+
+      // ── resolve plan strategy + validate ──────────────────────────
+      const planResult = _resolvePlanStrategy(
+        plan_mode,
+        workspacePlanPath,
+        Object.keys(projectPlans).length > 0 ? projectPlans : null,
+        ws,
+      );
+      if (!planResult.ok) {
+        return res
+          .status(planResult.status)
+          .json({ ok: false, error: planResult.error });
+      }
+
       const tiers = computeTiers(ws.projects);
       const dagTiers = tiers.map((projects, i) => ({
         tier: i,
@@ -1054,10 +1222,10 @@ export function createWorkspaceRouter({
           source: source ?? null,
         },
         guide: guideEntry,
+        ...planResult.fields,
         branch_template: branch_template ?? 'workspace/{slug}/{project}',
         max_parallel: Number(max_parallel) || 5,
         skip_integration: false,
-        skip_planning: plan_mode === 'skip',
         status: 'planning',
         halt_reason: null,
         dag: { tiers: dagTiers },

package/server/ws-beads-watcher.js

@@ -4,13 +4,14 @@
  * because fs.watch on macOS misses SQLite WAL writes done via mmap.
  */
 
-import { existsSync, statSync, unwatchFile, watch, watchFile } from 'node:fs';
+import { existsSync, statSync, unwatchFile, watchFile } from 'node:fs';
 import { join, resolve } from 'node:path';
 import {
   countIssuesByRunLabel,
   enrichIssuesWithDeps,
   listIssuesShallow,
 } from './beads-reader.js';
+import { safeWatch } from './safe-watch.js';
 
 const BEADS_DEBOUNCE_MS = 500;
 const BEADS_POLL_MS = 2000;
@@ -132,7 +133,7 @@ export function createBeadsWatcher({ worcaDir, broadcaster, projectId }) {
   if (existsSync(beadsDir)) {
     // fs.watch for directory-level events (checkpoint writes to main db)
     try {
-      fsWatcher = watch(beadsDir, (_event, filename) => {
+      fsWatcher = safeWatch(beadsDir, (_event, filename) => {
         if (filename?.startsWith('beads.db')) scheduleBeadsRefresh();
       });
     } catch {

package/server/ws-fleet-manifest-watcher.js

@@ -3,10 +3,11 @@
  * Emits fleet-update WS events when a fleet manifest is written (§13.5).
  */
 
-import { existsSync, readFileSync, watch } from 'node:fs';
+import { existsSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { effectiveFleetStatus } from './fleet-routes.js';
 import { fleetRunsDir as resolveFleetRunsDir } from './paths.js';
+import { safeWatch } from './safe-watch.js';
 
 const FLEET_DEBOUNCE_MS = 200;
 
@@ -100,7 +101,7 @@ export function createFleetManifestWatcher({
 
   try {
     if (existsSync(fleetRunsDir)) {
-      fsWatcher = watch(
+      fsWatcher = safeWatch(
         fleetRunsDir,
         { persistent: false },
         (_event, filename) => {

package/server/ws-log-watcher.js

@@ -3,7 +3,7 @@
  * Owns logWatchers map and logLineCounts tracking.
  */
 
-import { existsSync, readdirSync, statSync, watch } from 'node:fs';
+import { existsSync, readdirSync, statSync } from 'node:fs';
 import { join } from 'node:path';
 import {
   fileByteLength,
@@ -13,6 +13,7 @@ import {
   readNewLines,
   resolveLogPath,
 } from './log-tailer.js';
+import { safeWatch } from './safe-watch.js';
 
 /**
  * @param {{
@@ -69,7 +70,7 @@ export function createLogWatcher({
       if (!existsSync(filePath)) return;
       logByteOffsets.set(key, fileByteLength(filePath));
       const watcherRunId = explicitRunId || currentActiveRunId();
-      const watcher = watch(filePath, (eventType) => {
+      const watcher = safeWatch(filePath, (eventType) => {
         if (eventType === 'change') {
           try {
             const prevOffset = logByteOffsets.get(key) || 0;
@@ -109,7 +110,7 @@ export function createLogWatcher({
     const dirKey = _watcherKey(explicitRunId, stage, null, '__dir');
     if (logWatchers.has(dirKey)) return;
     try {
-      const dirWatcher = watch(stageDir, (_eventType, filename) => {
+      const dirWatcher = safeWatch(stageDir, (_eventType, filename) => {
         if (filename && /^iter-\d+\.log$/.test(filename)) {
           const iterNum = parseInt(filename.match(/\d+/)[0], 10);
           const iterPath = join(stageDir, filename);
@@ -167,7 +168,7 @@ export function createLogWatcher({
     if (logWatchers.has(dirKey)) return;
     if (!existsSync(logsDir)) return;
     try {
-      const dirWatcher = watch(logsDir, (_eventType, filename) => {
+      const dirWatcher = safeWatch(logsDir, (_eventType, filename) => {
         if (!filename) return;
         if (filename.endsWith('.log')) {
           const stage = filename.replace('.log', '');

package/server/ws-modular.js

@@ -6,11 +6,12 @@
  * Supports dynamic project add/remove via fs.watch on projects.d/.
  */
 
-import { existsSync, watch } from 'node:fs';
+import { existsSync } from 'node:fs';
 import { join } from 'node:path';
 import { WebSocketServer } from 'ws';
 import { fleetRunsDir, workspaceRunsDir } from './paths.js';
 import { readProjects, synthesizeDefaultProject } from './project-registry.js';
+import { safeWatch } from './safe-watch.js';
 import { TIER_FULL, TIER_POLLING, WatcherSet } from './watcher-set.js';
 import { readProjectWorcaVersion } from './worca-setup.js';
 import { peekBeadsCounts } from './ws-beads-watcher.js';
@@ -40,6 +41,10 @@ export function attachWsServer(httpServer, config) {
   } = config;
   const wss = new WebSocketServer({ server: httpServer, path: '/ws' });
 
+  // WSS created with an external server does not auto-close when the server
+  // closes — explicitly bridge the lifecycle so watchers are torn down.
+  httpServer.on('close', () => wss.close());
+
   // 1. Client manager — owns subs WeakMap and heartbeat
   const clientManager = createClientManager({ wss });
 
@@ -115,7 +120,7 @@ export function attachWsServer(httpServer, config) {
     const projectsDir = join(prefsDir, 'projects.d');
     try {
       if (existsSync(projectsDir)) {
-        dirWatcher = watch(projectsDir, { persistent: false }, () => {
+        dirWatcher = safeWatch(projectsDir, { persistent: false }, () => {
           if (debounceTimer) clearTimeout(debounceTimer);
           debounceTimer = setTimeout(() => {
             debounceTimer = null;