@wrongstack/cli 0.267.0 → 0.268.0

package/dist/index.js

@@ -1,24 +1,26 @@
 #!/usr/bin/env node
-import { color, writeErr, loadPlugins, renderProgress, SpecStore, TaskGraphStore, analyzeCriticalPath, getTemplate, listTemplates, templateToMarkdown, SpecParser, renderSpecAnalysis, AISpecBuilder, expectDefined, DefaultTaskStore, TaskTracker, renderTaskGraph, withFileLock, DefaultSecretScrubber, projectHash, wstackGlobalRoot, resolveProjectDir, GlobalMailbox, TOKENS, ToolRegistry, resolveSessionLoggingConfig, createSessionEventBridge, HookRegistry, HookRunner, normalizeTokenSavingTier, SlashCommandRegistry, attachDepWatcherBridge, SessionMemoryConsolidator, BrainDecisionQueue, ObservableBrainArbiter, HumanEscalatingBrainArbiter, createTieredBrainArbiter, DefaultBrainArbiter, BrainMonitor, mailboxSessionTag, createDelegateTool, FLEET_ROSTER, createMcpControlTool, startTechStackConsumer, startPackageOutdatedWatcher, recordFileAction, createAutonomyBrain, DefaultPluginAPI, SpecVersioning, DEFAULT_CONTEXT_WINDOW_MODE_ID, recentTextTurns, enhanceUserPrompt, projectSlug, DefaultSystemPromptBuilder, mutateTasks, loadTasks, resolveContextWindowPolicy, repairToolUseAdjacency, mutatePlan, setPlanItemStatus, getPlanTemplate, loadPlan, emptyPlan, addPlanItem, savePlan, resolveProviderModelList, DefaultLogger, DefaultModelsRegistry, isStdinTTY, atomicWrite, DefaultPathResolver, EventBus, runProviderWithRetry, ReplayLogStore, ReplayProviderRunner, mergeCustomModelDefs, makeAutonomyPromptContributor, createContextManagerTool, makeMailboxTool, makeMailSendTool, makeMailInboxTool, InMemoryMetricsSink, wireMetricsToEvents, DefaultHealthRegistry, startMetricsServer, DEFAULT_SESSION_PRUNE_DAYS, RecoveryLock, DefaultAttachmentStore, Context, QueueStore, loadTodosCheckpoint, attachTodosCheckpoint, loadDirectorState, createDefaultPipelines, resolveAuditLevel, AutoCompactionMiddleware, estimateRequestTokensCalibrated, Agent, FleetManager, makeDirectorSessionFactory, Director, makeFleetEmitTool, makeFleetStatusTool, resolveModelMatrix, DEFAULT_SUBAGENT_BASELINE, AutoApprovePermissionPolicy, WIDE_SUBAGENT_CAPABILITIES, PhaseStore, AutoPhasePlanner, PhaseGraphBuilder, WorktreeManager, PhaseOrchestrator, makeLLMClassifier, writeOut, ParallelEternalEngine, EternalAutonomyEngine, allServers as allServers$1, CHIMERA_REVIEW_PROMPT, AutonomousCoordinator, noOpVault, decryptConfigSecrets as decryptConfigSecrets$1, encryptConfigSecrets as encryptConfigSecrets$1, setQueuedMessagesSnapshot, DefaultSessionRewinder, bootConfig as bootConfig$1, setOutputLineGuard, setRawMode, DefaultSessionReader, resolveWstackPaths, ToolAuditLog, DefaultSessionStore as DefaultSessionStore$1, ProviderRegistry, StreamHangError, ProviderError, makeAgentSubagentRunner, NULL_FLEET_BUS, buildChildEnv, formatContextWindowModeList, getContextWindowMode, AGENT_CATALOG, dispatchAgent, formatTodosList, formatTaskList, formatTaskProgress, formatPlan, SessionRecovery, loadGoal, goalFilePath, summarizeUsage, saveGoal, formatGoal, emptyGoal, buildGoalPreamble, pendingBtwCount, setBtwNote, MATRIX_PHASE_KEYS, matrixKeyKind, phaseForRole, onResize, ERROR_CODES, FsError, ConfigError, InputBuilder, truncate, estimateMessageTokens, AGENTS_BY_PHASE, validateAgainstSchema, resolveMailboxIdentity, isSecretField as isSecretField$1 } from '@wrongstack/core';
+import { color, writeErr, loadPlugins, renderProgress, SpecStore, TaskGraphStore, analyzeCriticalPath, getTemplate, listTemplates, templateToMarkdown, SpecParser, renderSpecAnalysis, AISpecBuilder, expectDefined, DefaultTaskStore, TaskTracker, renderTaskGraph, withFileLock, resolveHqDataDir, ensureHqFirstRunAuthFile, DEFAULT_HQ_REDACTION_POLICY, watchHqAuthFile, parseHqFrame, HQ_PROTOCOL_VERSION, parseHqEventPayload, scrubAndTruncateHqPreview, DefaultSecretScrubber, projectHash, wstackGlobalRoot, TOKENS, ToolRegistry, createHqPublisherFromEnv, GlobalMailbox, resolveSessionLoggingConfig, createSessionEventBridge, HookRegistry, HookRunner, normalizeTokenSavingTier, SlashCommandRegistry, attachDepWatcherBridge, SessionMemoryConsolidator, BrainDecisionQueue, ObservableBrainArbiter, HumanEscalatingBrainArbiter, createTieredBrainArbiter, DefaultBrainArbiter, BrainMonitor, mailboxSessionTag, createDelegateTool, FLEET_ROSTER, createMcpControlTool, startTechStackConsumer, startPackageOutdatedWatcher, recordFileAction, createAutonomyBrain, DefaultPluginAPI, SpecVersioning, DEFAULT_CONTEXT_WINDOW_MODE_ID, resolveProjectDir, recentTextTurns, enhanceUserPrompt, projectSlug, DefaultSystemPromptBuilder, mutateTasks, loadTasks, resolveContextWindowPolicy, repairToolUseAdjacency, mutatePlan, setPlanItemStatus, getPlanTemplate, loadPlan, emptyPlan, addPlanItem, savePlan, resolveProviderModelList, DefaultLogger, DefaultModelsRegistry, isStdinTTY, atomicWrite, DefaultPathResolver, EventBus, runProviderWithRetry, ReplayLogStore, ReplayProviderRunner, mergeCustomModelDefs, makeAutonomyPromptContributor, createContextManagerTool, makeMailboxTool, makeMailSendTool, makeMailInboxTool, InMemoryMetricsSink, wireMetricsToEvents, DefaultHealthRegistry, startMetricsServer, DEFAULT_SESSION_PRUNE_DAYS, RecoveryLock, DefaultAttachmentStore, Context, QueueStore, loadTodosCheckpoint, attachTodosCheckpoint, loadDirectorState, createDefaultPipelines, applyModelRuntime, resolveAuditLevel, AutoCompactionMiddleware, estimateRequestTokensCalibrated, Agent, FleetManager, makeDirectorSessionFactory, Director, makeFleetEmitTool, makeFleetStatusTool, resolveModelMatrix, DEFAULT_SUBAGENT_BASELINE, AutoApprovePermissionPolicy, WIDE_SUBAGENT_CAPABILITIES, PhaseStore, AutoPhasePlanner, PhaseGraphBuilder, WorktreeManager, PhaseOrchestrator, makeLLMClassifier, writeOut, ParallelEternalEngine, EternalAutonomyEngine, allServers as allServers$1, CHIMERA_REVIEW_PROMPT, AutonomousCoordinator, resolveWstackPaths, setQueuedMessagesSnapshot, noOpVault, decryptConfigSecrets as decryptConfigSecrets$1, encryptConfigSecrets as encryptConfigSecrets$1, DefaultSessionRewinder, bootConfig as bootConfig$1, setOutputLineGuard, setRawMode, DefaultSessionReader, ToolAuditLog, DefaultSessionStore as DefaultSessionStore$1, ProviderRegistry, StreamHangError, ProviderError, makeAgentSubagentRunner, NULL_FLEET_BUS, buildChildEnv, formatContextWindowModeList, getContextWindowMode, AGENT_CATALOG, dispatchAgent, formatTodosList, formatTaskList, formatTaskProgress, formatPlan, SessionRecovery, loadGoal, goalFilePath, summarizeUsage, saveGoal, formatGoal, emptyGoal, buildGoalPreamble, pendingBtwCount, setBtwNote, MATRIX_PHASE_KEYS, matrixKeyKind, phaseForRole, onResize, ERROR_CODES, FsError, ConfigError, InputBuilder, HQ_AUTH_FILE_VERSION, truncate, estimateMessageTokens, AGENTS_BY_PHASE, validateAgainstSchema, resolveMailboxIdentity, mutateHqAuthFile, mintHqToken, readHqAuthFile, isSecretField as isSecretField$1 } from '@wrongstack/core';
 import * as fsp5 from 'fs/promises';
 import { decryptConfigSecrets, encryptConfigSecrets, DefaultSecretVault, isSecretField } from '@wrongstack/core/security';
 import * as path4 from 'path';
 import { join } from 'path';
 import * as crypto3 from 'crypto';
-import { createHash, randomBytes, randomUUID } from 'crypto';
+import { createHash, randomUUID, randomBytes } from 'crypto';
+import * as http from 'http';
+import { createServer } from 'http';
+import { WebSocketServer, WebSocket } from 'ws';
 import { createRequire } from 'module';
 import * as os from 'os';
 import os__default from 'os';
 import { findFreePort, AutoPhaseWebSocketHandler, generateAuthToken, verifyClient, handleGitInfo, handleShellOpen, handleGitDiff, handleGitChanges, handleSkillsExport, handleSkillsEdit, handleSkillsCreate, handleSkillsUpdate, handleSkillsUninstall, handleSkillsInstall, handleSkillsContent, handleMcpRestart, handleMcpDisable, handleMcpEnable, handleMcpDiscover, handleMcpSleep, handleMcpWake, handleMcpUpdate, handleMcpRemove, handleMcpAdd, handleMcpList, handleMemoryForget, handleMemoryRemember, handleMemoryList, handleFilesWrite, handleFilesRead, handleFilesTree, handleFilesList, createEternalSubscription, createHttpServer, registerInstance, openBrowser as openBrowser$1, unregisterInstance, estimateTokens as estimateTokens$1, stringifyContent, messagePreview, messageTokens, createCustomModeStore } from '@wrongstack/webui/server';
 import { setOAuthTokenPersister, makeProviderFromConfig, capabilitiesFor, buildProviderFactoriesFromRegistry, refreshCopilotToken, copilotBaseUrlFromToken } from '@wrongstack/providers';
-import { toErrorMessage } from '@wrongstack/core/utils';
+import { toErrorMessage, readJsonObjectFile, updateJsonObjectFile, setJsonPath, jsonObjectFileExists, removeJsonPath } from '@wrongstack/core/utils';
 import { getProcessRegistry, builtinToolsPack, rememberTool, forgetTool, searchMemoryTool, relatedMemoryTool, runStartupIndex, isIndexableFile, enqueueReindex, cancelPendingReindexes, shutdownCodebaseIndexHost, TIER2_TOOLS, TIER3_TOOLS, TIER1_TOOLS, resetIndexCircuitBreaker } from '@wrongstack/tools';
 import { DefaultSessionStore } from '@wrongstack/core/storage';
 import { probeLocalLlm } from '@wrongstack/runtime/probe';
 import * as fs3 from 'fs';
 import { watch, writeFileSync, existsSync, readFileSync } from 'fs';
 import { SkillInstaller } from '@wrongstack/core/skills';
-import { WebSocketServer, WebSocket } from 'ws';
 import { spawn, execFile, execFileSync } from 'child_process';
 import { MCPRegistry, MCPServer, serveHttp, serveStdio } from '@wrongstack/mcp';
 import { fileURLToPath } from 'url';
@@ -28,7 +30,6 @@ import { ACP_AGENT_COMMANDS, makeACPSubagentRunner, runEnsemble, renderEnsembleT
 import { parseNextSteps } from '@wrongstack/tui';
 import { WrongStackACPServer } from '@wrongstack/acp/agent';
 import { SubagentBudget } from '@wrongstack/core/coordination';
-import { createServer } from 'http';
 import { loadBenchConfig, reportHeaderLine, readSummary, renderMarkdownReport, createPolyglotSuite, createSwebenchSuite, runBenchmark, writeJsonArtifacts, collectCellPredictions, writePredictionsJsonl, gradePolyglot, gradeSwebench } from '@wrongstack/bench';
 import { allServers } from '@wrongstack/core/infrastructure';
 import { ToolExecutor } from '@wrongstack/core/execution';
@@ -655,26 +656,26 @@ function fmtDuration(ms) {
   const remMin = m - h * 60;
   return `${h}h${remMin}m`;
 }
-function fmtTaskResultLine(r, color77) {
+function fmtTaskResultLine(r, color78) {
   const stats = `${r.iterations}it ${r.toolCalls}tc ${fmtDuration(r.durationMs)}`;
   const errMsg = typeof r.error === "string" ? r.error : r.error?.message;
   const errKind = typeof r.error === "object" ? r.error?.kind : void 0;
   const errTail = errMsg ? ` \u2014 ${errMsg.replace(/\s+/g, " ").slice(0, 80)}${errMsg.length > 80 ? "\u2026" : ""}` : "";
-  const errKindChip = errKind ? color77.dim(` [${errKind}]`) : "";
-  const errSnip = errMsg || errKind ? `${errKindChip}${color77.dim(errTail)}` : "";
+  const errKindChip = errKind ? color78.dim(` [${errKind}]`) : "";
+  const errSnip = errMsg || errKind ? `${errKindChip}${color78.dim(errTail)}` : "";
   switch (r.status) {
     case "success":
-      return { mark: color77.green("\u2713"), stats, tail: "" };
+      return { mark: color78.green("\u2713"), stats, tail: "" };
     case "timeout":
       return {
-        mark: color77.yellow("\u23F1"),
-        stats: `${color77.yellow("timeout")} ${stats}`,
+        mark: color78.yellow("\u23F1"),
+        stats: `${color78.yellow("timeout")} ${stats}`,
         tail: errSnip
       };
     case "stopped":
-      return { mark: color77.dim("\u2298"), stats: `${color77.dim("stopped")} ${stats}`, tail: errSnip };
+      return { mark: color78.dim("\u2298"), stats: `${color78.dim("stopped")} ${stats}`, tail: errSnip };
     case "failed":
-      return { mark: color77.red("\u2717"), stats: `${color77.red("failed")} ${stats}`, tail: errSnip };
+      return { mark: color78.red("\u2717"), stats: `${color78.red("failed")} ${stats}`, tail: errSnip };
   }
 }
 var init_utils = __esm({
@@ -2663,7 +2664,7 @@ async function runProjectPicker(opts) {
   const reservedBottom = 3;
   const headerHeight = reservedTop + reservedBottom;
   const baseVisibleHeight = Math.max(5, terminalHeight() - headerHeight);
-  return new Promise((resolve11) => {
+  return new Promise((resolve12) => {
     const wasRaw = stdin.isRaw;
     const wasPaused = stdin.isPaused();
     let filter = "";
@@ -2787,7 +2788,7 @@ async function runProjectPicker(opts) {
           cleanup();
           out.write(CURSOR_SHOW);
           out.write("\n");
-          resolve11(void 0);
+          resolve12(void 0);
           return;
         }
         if (ch === ESC) {
@@ -2800,7 +2801,7 @@ async function runProjectPicker(opts) {
           cleanup();
           out.write(CURSOR_SHOW);
           out.write("\n");
-          resolve11(void 0);
+          resolve12(void 0);
           return;
         }
         if (ch === BS || ch === "\b") {
@@ -2817,22 +2818,22 @@ async function runProjectPicker(opts) {
           out.write(CURSOR_SHOW);
           out.write("\n");
           if (!item || item.key === "__divider__") {
-            resolve11(void 0);
+            resolve12(void 0);
             return;
           }
           if (item.key === "quit") {
-            resolve11(void 0);
+            resolve12(void 0);
             return;
           }
           if (item.key === "new-session") {
-            resolve11({ kind: "action", key: "new-session", action: "new-session" });
+            resolve12({ kind: "action", key: "new-session", action: "new-session" });
             return;
           }
           if (item.key === "prev-sessions") {
-            resolve11({ kind: "action", key: "prev-sessions", action: "prev-sessions" });
+            resolve12({ kind: "action", key: "prev-sessions", action: "prev-sessions" });
             return;
           }
-          resolve11({ kind: "project", key: item.key });
+          resolve12({ kind: "project", key: item.key });
           return;
         }
         if (filter.length === 0) {
@@ -2840,7 +2841,7 @@ async function runProjectPicker(opts) {
             cleanup();
             out.write(CURSOR_SHOW);
             out.write("\n");
-            resolve11(void 0);
+            resolve12(void 0);
             return;
           }
           if (ch === "j") {
@@ -2869,7 +2870,7 @@ async function runProjectPicker(opts) {
     try {
       stdin.setRawMode(true);
     } catch {
-      resolve11(void 0);
+      resolve12(void 0);
       return;
     }
     stdin.resume();
@@ -2880,7 +2881,7 @@ async function runProjectPicker(opts) {
     stdin.once("close", () => {
       cleanup();
       out.write(CURSOR_SHOW);
-      resolve11(void 0);
+      resolve12(void 0);
     });
   });
 }
@@ -2906,6 +2907,1108 @@ var init_project_picker = __esm({
   }
 });
 
+// src/hq-server.ts
+var hq_server_exports = {};
+__export(hq_server_exports, {
+  startHqServer: () => startHqServer
+});
+function displayHost(host) {
+  return host === "0.0.0.0" ? "127.0.0.1" : host;
+}
+function buildHttpUrl(host, port, token) {
+  const url = new URL(`http://${displayHost(host)}:${port}/`);
+  if (token) url.searchParams.set("token", token);
+  return url.toString();
+}
+function buildClientWsUrl(host, port, token) {
+  const url = new URL(`ws://${displayHost(host)}:${port}/ws/client`);
+  if (token) url.searchParams.set("token", token);
+  return url.toString();
+}
+function writeHqStartupInfo(write, handle) {
+  const firstRun = handle.firstRunSetup;
+  write(`WrongStack HQ listening on http://${handle.host}:${handle.port}
+`);
+  if (firstRun) {
+    write(`Browser endpoint: ${firstRun.browserUrl}
+`);
+    write(`Client endpoint:  ${buildClientWsUrl(handle.host, handle.port, firstRun.clientEnv.WRONGSTACK_HQ_TOKEN)}
+`);
+    write(`
+First-run HQ auth created in ${firstRun.dataDir}
+`);
+    write(`Start clients with:
+`);
+    write(`  WRONGSTACK_HQ_URL=${firstRun.clientEnv.WRONGSTACK_HQ_URL}
+`);
+    write(`  WRONGSTACK_HQ_TOKEN=${firstRun.clientEnv.WRONGSTACK_HQ_TOKEN}
+`);
+  } else {
+    write(`Client endpoint:  ws://${handle.host}:${handle.port}/ws/client
+`);
+    write(`Browser endpoint: http://${handle.host}:${handle.port}
+`);
+  }
+}
+async function startHqServer(options = {}) {
+  const host = options.host ?? DEFAULT_HOST;
+  const port = options.port ?? DEFAULT_PORT;
+  const dataDir = resolveHqDataDir(options.dataDir);
+  const firstRunAuth = await ensureHqFirstRunAuthFile(dataDir, {
+    warn: (msg) => console.warn(JSON.stringify({ level: "warn", event: "hq.auth_load_failed", message: msg, timestamp: (/* @__PURE__ */ new Date()).toISOString() }))
+  });
+  return startHqServerWithAuth(options, host, port, dataDir, firstRunAuth);
+}
+function extractBrowserToken(req2, url) {
+  const queryToken = url.searchParams.get("token");
+  if (queryToken) return queryToken;
+  const auth = req2.headers.authorization;
+  if (typeof auth === "string" && auth.toLowerCase().startsWith("bearer ")) {
+    return auth.slice(7).trim();
+  }
+  return void 0;
+}
+function startHqServerWithAuth(options, host, port, dataDir, firstRunAuth) {
+  const authFile = firstRunAuth.authFile;
+  const mutableAuth = {
+    operatorPolicy: {
+      ...DEFAULT_HQ_REDACTION_POLICY,
+      ...authFile.redactionPolicy ?? {}
+    },
+    browserTokens: new Set((authFile.browserTokens ?? []).map((t) => t.token)),
+    clientTokens: new Set((authFile.clientTokens ?? []).map((t) => t.token))
+  };
+  console.warn(JSON.stringify({
+    level: "info",
+    event: "hq.startup",
+    message: "WrongStack HQ starting",
+    dataDir,
+    host,
+    port,
+    operatorPolicyActive: authFile.redactionPolicy !== void 0,
+    browserTokenMode: mutableAuth.browserTokens.size > 0,
+    clientTokenMode: mutableAuth.clientTokens.size > 0,
+    timestamp: (/* @__PURE__ */ new Date()).toISOString()
+  }));
+  return new Promise((resolve12, reject) => {
+    const clients = /* @__PURE__ */ new Map();
+    const browsers = /* @__PURE__ */ new Set();
+    const eventLog = [];
+    const httpServer = http.createServer((req2, res) => {
+      const url = new URL(req2.url ?? "/", `http://${host}:${port}`);
+      if (mutableAuth.browserTokens.size > 0) {
+        const supplied = extractBrowserToken(req2, url);
+        if (!supplied || !mutableAuth.browserTokens.has(supplied)) {
+          res.writeHead(401, { "Content-Type": "application/json" });
+          res.end(
+            JSON.stringify({
+              error: {
+                code: "INVALID_TOKEN",
+                message: "A valid ?token= or Authorization: Bearer is required for HTTP access in browser token mode."
+              }
+            })
+          );
+          return;
+        }
+      }
+      if (url.pathname === "/" || url.pathname === "/index.html") {
+        res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+        res.end(HQ_HTML);
+        return;
+      }
+      if (url.pathname === "/api/snapshot") {
+        res.writeHead(200, { "Content-Type": "application/json" });
+        res.end(JSON.stringify(buildSnapshot(clients)));
+        return;
+      }
+      if (url.pathname.startsWith("/api/projects/")) {
+        const projectId = decodeURIComponent(url.pathname.slice("/api/projects/".length));
+        if (!projectId) {
+          res.writeHead(400, { "Content-Type": "application/json" });
+          res.end(
+            JSON.stringify({ error: { code: "BAD_REQUEST", message: "projectId is required" } })
+          );
+          return;
+        }
+        const detail = buildProjectDetail(clients, projectId);
+        if (!detail) {
+          res.writeHead(404, { "Content-Type": "application/json" });
+          res.end(
+            JSON.stringify({
+              error: { code: "NOT_FOUND", message: `Unknown project: ${projectId}` }
+            })
+          );
+          return;
+        }
+        res.writeHead(200, { "Content-Type": "application/json" });
+        res.end(JSON.stringify(detail));
+        return;
+      }
+      res.writeHead(404, { "Content-Type": "text/plain" });
+      res.end("Not found");
+    });
+    const wss = new WebSocketServer({ noServer: true, maxPayload: 1 * 1024 * 1024 });
+    httpServer.on("upgrade", (req2, socket, head) => {
+      const url = new URL(req2.url ?? "/", `http://${host}:${port}`);
+      const pathname = url.pathname;
+      if (pathname !== "/ws/client" && pathname !== "/ws/browser") {
+        socket.destroy();
+        return;
+      }
+      const tokenSet = pathname === "/ws/browser" ? mutableAuth.browserTokens : mutableAuth.clientTokens;
+      if (tokenSet.size > 0) {
+        const supplied = url.searchParams.get("token") ?? "";
+        if (!supplied || !tokenSet.has(supplied)) {
+          socket.write(
+            "HTTP/1.1 401 Unauthorized\r\nContent-Type: application/json\r\nConnection: close\r\n\r\n" + JSON.stringify({
+              error: {
+                code: "INVALID_TOKEN",
+                message: `A valid ?token= is required for ${pathname} connections in token mode.`
+              }
+            })
+          );
+          socket.destroy();
+          return;
+        }
+      }
+      wss.handleUpgrade(req2, socket, head, (ws) => {
+        wss.emit("connection", ws, req2, pathname);
+      });
+    });
+    wss.on("connection", (ws, _req, pathname) => {
+      if (pathname === "/ws/browser") {
+        handleBrowser(ws, clients, browsers);
+      } else {
+        handleClient(ws, clients, browsers, eventLog, mutableAuth.operatorPolicy);
+      }
+    });
+    const authWatcher = watchHqAuthFile(
+      dataDir,
+      (next) => {
+        mutableAuth.operatorPolicy = {
+          ...DEFAULT_HQ_REDACTION_POLICY,
+          ...next.redactionPolicy ?? {}
+        };
+        mutableAuth.browserTokens = new Set((next.browserTokens ?? []).map((t) => t.token));
+        mutableAuth.clientTokens = new Set((next.clientTokens ?? []).map((t) => t.token));
+        console.warn(JSON.stringify({
+          level: "info",
+          event: "hq.auth.reloaded",
+          message: "HQ auth.json reloaded",
+          browserTokenCount: mutableAuth.browserTokens.size,
+          clientTokenCount: mutableAuth.clientTokens.size,
+          timestamp: (/* @__PURE__ */ new Date()).toISOString()
+        }));
+      },
+      {
+        warn: (msg) => console.warn(JSON.stringify({
+          level: "warn",
+          event: "hq.auth.reload_failed",
+          message: msg,
+          timestamp: (/* @__PURE__ */ new Date()).toISOString()
+        }))
+      }
+    );
+    const onError = (err) => {
+      if (err.code === "EADDRINUSE" && !options.strictPort) {
+        httpServer.listen(port + 1, host);
+      } else {
+        reject(err);
+      }
+    };
+    httpServer.once("error", onError);
+    httpServer.listen(port, host, () => {
+      httpServer.removeListener("error", onError);
+      const addr = httpServer.address();
+      const actualPort = typeof addr === "object" && addr ? addr.port : port;
+      const firstRunSetup = firstRunAuth.created && firstRunAuth.browserToken && firstRunAuth.clientToken ? {
+        dataDir,
+        browserUrl: buildHttpUrl(host, actualPort, firstRunAuth.browserToken.token),
+        clientEnv: {
+          WRONGSTACK_HQ_URL: `http://${displayHost(host)}:${actualPort}`,
+          WRONGSTACK_HQ_TOKEN: firstRunAuth.clientToken.token
+        }
+      } : void 0;
+      const handle = {
+        host,
+        port: actualPort,
+        ...firstRunSetup ? { firstRunSetup } : {},
+        close: () => new Promise((res) => {
+          authWatcher.close();
+          for (const ws of browsers) ws.close(1001, "HQ shutting down");
+          for (const ws of clients.keys()) ws.close(1001, "HQ shutting down");
+          wss.close();
+          httpServer.close(() => res());
+        })
+      };
+      writeHqStartupInfo((line) => console.log(line.trimEnd()), handle);
+      resolve12(handle);
+    });
+  });
+}
+function handleBrowser(ws, clients, browsers) {
+  browsers.add(ws);
+  const snapshotMsg = { type: "hq.snapshot", snapshot: buildSnapshot(clients) };
+  ws.send(JSON.stringify(snapshotMsg));
+  ws.on("close", () => {
+    browsers.delete(ws);
+  });
+}
+function handleClient(ws, clients, browsers, eventLog, operatorPolicy) {
+  let registered = false;
+  ws.on("message", (data) => {
+    const raw = typeof data === "string" ? data : Buffer.isBuffer(data) ? data : new TextDecoder().decode(data);
+    const parsed = parseHqFrame(raw);
+    if (!parsed.ok) {
+      const code = parsed.reason === "invalid-json" ? 1003 : 1008;
+      ws.close(code, `invalid frame: ${parsed.reason}`);
+      return;
+    }
+    const frame = parsed.frame;
+    if (frame.type === "client.hello") {
+      const payload = frame.payload;
+      if (payload.protocolVersion !== HQ_PROTOCOL_VERSION) {
+        ws.close(1008, "protocol version mismatch");
+        return;
+      }
+      const client = {
+        ws,
+        clientId: payload.client.clientId,
+        projectId: payload.project.projectId,
+        kind: payload.client.kind,
+        connectedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        lastSeenAt: (/* @__PURE__ */ new Date()).toISOString(),
+        ...payload.client.hostname ? { hostname: payload.client.hostname } : {},
+        ...payload.client.pid ? { pid: payload.client.pid } : {},
+        ...payload.client.version ? { version: payload.client.version } : {},
+        capabilities: payload.capabilities,
+        mailboxes: /* @__PURE__ */ new Map()
+      };
+      clients.set(ws, client);
+      registered = true;
+      const welcome = {
+        type: "hq.welcome",
+        protocolVersion: HQ_PROTOCOL_VERSION,
+        serverTime: (/* @__PURE__ */ new Date()).toISOString(),
+        acceptedCapabilities: payload.capabilities,
+        // The operator-configured override (from <dataDir>/auth.json) wins
+        // over the default. The client learns the *effective* policy.
+        redactionPolicy: operatorPolicy
+      };
+      ws.send(JSON.stringify(welcome));
+      const event = {
+        id: randomUUID(),
+        type: "client.hello",
+        schemaVersion: HQ_PROTOCOL_VERSION,
+        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+        clientId: payload.client.clientId,
+        projectId: payload.project.projectId,
+        seq: 0,
+        payload: { client: payload.client, project: payload.project }
+      };
+      eventLog.push(event);
+      if (eventLog.length > MAX_EVENT_LOG) eventLog.splice(0, eventLog.length - MAX_EVENT_LOG);
+      broadcastSnapshot(clients, browsers);
+      broadcastEvent(event, browsers);
+      return;
+    }
+    if (!registered) return;
+    if (frame.type === "client.event") {
+      const event = frame.event;
+      const client = clients.get(ws);
+      if (client) client.lastSeenAt = (/* @__PURE__ */ new Date()).toISOString();
+      if (event.type === "mailbox.snapshot" && client !== void 0) {
+        const payloadResult = parseHqEventPayload(event.type, event.payload);
+        if (payloadResult.ok) {
+          const payload = payloadResult.payload;
+          client.mailboxes.set(payload.mailboxId, payload);
+          eventLog.push(event);
+          if (eventLog.length > MAX_EVENT_LOG) eventLog.splice(0, eventLog.length - MAX_EVENT_LOG);
+          broadcastSnapshot(clients, browsers);
+          broadcastEvent(event, browsers);
+          return;
+        }
+        return;
+      }
+      if (event.type === "mailbox.event") {
+        const payloadResult = parseHqEventPayload(event.type, event.payload);
+        if (!payloadResult.ok) {
+          return;
+        }
+        const payload = payloadResult.payload;
+        const sanitizedSummary = scrubAndTruncateHqPreview(payload.summary, 280);
+        const sanitizedEvent = sanitizedSummary === void 0 ? event : { ...event, payload: { ...payload, summary: sanitizedSummary } };
+        eventLog.push(sanitizedEvent);
+        if (eventLog.length > MAX_EVENT_LOG) eventLog.splice(0, eventLog.length - MAX_EVENT_LOG);
+        broadcastEvent(sanitizedEvent, browsers);
+        return;
+      }
+      eventLog.push(event);
+      if (eventLog.length > MAX_EVENT_LOG) eventLog.splice(0, eventLog.length - MAX_EVENT_LOG);
+      broadcastEvent(event, browsers);
+    }
+  });
+  ws.on("close", () => {
+    clients.delete(ws);
+    broadcastSnapshot(clients, browsers);
+  });
+}
+function buildSnapshot(clients) {
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const clientRecords = [];
+  const projectMap = /* @__PURE__ */ new Map();
+  const mailboxSummaries = [];
+  for (const client of clients.values()) {
+    clientRecords.push({
+      clientId: client.clientId,
+      kind: client.kind,
+      machineId: "",
+      ...client.hostname ? { hostname: client.hostname } : {},
+      ...client.pid ? { pid: client.pid } : {},
+      ...client.version ? { version: client.version } : {},
+      connected: true,
+      connectedAt: client.connectedAt,
+      lastSeenAt: client.lastSeenAt,
+      projectId: client.projectId,
+      capabilities: client.capabilities
+    });
+    let project = projectMap.get(client.projectId);
+    if (!project) {
+      project = {
+        projectId: client.projectId,
+        projectName: client.projectId,
+        projectRootDisplay: "",
+        machineIds: [],
+        activeClients: 0,
+        activeSessions: 0,
+        activeSubagents: 0,
+        totalCostUsd: 0,
+        lastActivityAt: now,
+        status: "active"
+      };
+      projectMap.set(client.projectId, project);
+    }
+    project.activeClients++;
+    for (const snapshot of client.mailboxes.values()) {
+      mailboxSummaries.push({
+        mailboxId: snapshot.mailboxId,
+        projectId: client.projectId,
+        scope: snapshot.scope,
+        messageCount: snapshot.totals.messages,
+        unreadCount: snapshot.totals.unread,
+        incompleteCount: snapshot.totals.incomplete,
+        highPriorityCount: snapshot.totals.highPriority,
+        onlineAgentCount: snapshot.totals.onlineAgents,
+        lastActivityAt: now
+      });
+    }
+  }
+  const projects = Array.from(projectMap.values());
+  const totals = computeTotals({
+    projects: projects.length,
+    clients: clientRecords.length,
+    mailboxes: mailboxSummaries
+  });
+  return {
+    generatedAt: now,
+    clients: clientRecords,
+    projects,
+    sessions: [],
+    fleets: [],
+    mailboxes: mailboxSummaries,
+    totals
+  };
+}
+function computeTotals(input) {
+  let unread = 0;
+  let incomplete = 0;
+  for (const m of input.mailboxes) {
+    unread += m.unreadCount;
+    incomplete += m.incompleteCount;
+  }
+  return {
+    activeProjects: input.projects,
+    activeClients: input.clients,
+    activeSessions: 0,
+    activeSubagents: 0,
+    unreadMailboxMessages: unread,
+    incompleteMailboxMessages: incomplete,
+    totalCostUsd: 0
+  };
+}
+function buildProjectDetail(clients, projectId) {
+  const projectClients = [];
+  for (const c of clients.values()) {
+    if (c.projectId === projectId) projectClients.push(c);
+  }
+  if (projectClients.length === 0) return null;
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const clientRecords = projectClients.map((c) => ({
+    clientId: c.clientId,
+    kind: c.kind,
+    machineId: "",
+    ...c.hostname ? { hostname: c.hostname } : {},
+    ...c.pid ? { pid: c.pid } : {},
+    ...c.version ? { version: c.version } : {},
+    connected: true,
+    connectedAt: c.connectedAt,
+    lastSeenAt: c.lastSeenAt,
+    projectId: c.projectId,
+    capabilities: c.capabilities
+  }));
+  const mailboxPayloads = [];
+  let latestActivity = now;
+  for (const c of projectClients) {
+    for (const snap of c.mailboxes.values()) {
+      mailboxPayloads.push(snap);
+      if (snap.totals.messages > 0) latestActivity = now;
+    }
+  }
+  const project = {
+    projectId,
+    projectName: projectId,
+    projectRootDisplay: "",
+    machineIds: [],
+    activeClients: projectClients.length,
+    activeSessions: 0,
+    activeSubagents: 0,
+    totalCostUsd: 0,
+    lastActivityAt: latestActivity,
+    status: "active"
+  };
+  return {
+    generatedAt: now,
+    project,
+    clients: clientRecords,
+    mailboxes: mailboxPayloads
+  };
+}
+function broadcastSnapshot(clients, browsers) {
+  const snapshot = buildSnapshot(clients);
+  const msg = { type: "hq.snapshot", snapshot };
+  const data = JSON.stringify(msg);
+  for (const ws of browsers) {
+    if (ws.readyState === WebSocket.OPEN) ws.send(data);
+  }
+}
+function broadcastEvent(event, browsers) {
+  const msg = { type: "hq.event", event };
+  const data = JSON.stringify(msg);
+  for (const ws of browsers) {
+    if (ws.readyState === WebSocket.OPEN) ws.send(data);
+  }
+}
+var DEFAULT_HOST, DEFAULT_PORT, MAX_EVENT_LOG, HQ_HTML;
+var init_hq_server = __esm({
+  "src/hq-server.ts"() {
+    DEFAULT_HOST = "127.0.0.1";
+    DEFAULT_PORT = 3499;
+    MAX_EVENT_LOG = 500;
+    HQ_HTML = `<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="UTF-8" />
+<meta name="viewport" content="width=device-width, initial-scale=1.0" />
+<title>WrongStack HQ</title>
+<style>
+  :root {
+    --bg: #0d1117;
+    --panel: #161b22;
+    --border: #30363d;
+    --text: #c9d1d9;
+    --muted: #8b949e;
+    --dim: #6e7681;
+    --accent: #58a6ff;
+    --live: #3fb950;
+    --warn: #d29922;
+    --high: #f85149;
+  }
+  * { box-sizing: border-box; }
+  body { font-family: system-ui, -apple-system, sans-serif; background: var(--bg); color: var(--text); margin: 0; padding: 24px; }
+  h1 { margin: 0 0 4px; color: var(--accent); font-size: 22px; }
+  .hq-sub { color: var(--muted); font-size: 13px; margin-bottom: 24px; display: flex; align-items: center; gap: 8px; }
+  .hq-led { display: inline-block; width: 8px; height: 8px; border-radius: 50%; }
+  .hq-led.live { background: var(--live); box-shadow: 0 0 6px var(--live); }
+  .hq-led.dead { background: var(--dim); }
+  .hq-grid { display: grid; grid-template-columns: repeat(auto-fit, minmax(160px, 1fr)); gap: 12px; margin-bottom: 24px; }
+  .hq-stat { background: var(--panel); border: 1px solid var(--border); border-radius: 8px; padding: 14px 16px; }
+  .hq-stat .num { font-size: 26px; font-weight: 700; color: #f0f6fc; line-height: 1.1; }
+  .hq-stat .label { font-size: 11px; text-transform: uppercase; letter-spacing: 0.5px; color: var(--dim); margin-top: 4px; }
+  .hq-stat.warn .num { color: var(--warn); }
+  .hq-stat.high .num { color: var(--high); }
+  section { background: var(--panel); border: 1px solid var(--border); border-radius: 8px; padding: 16px; margin-bottom: 16px; }
+  section h2 { margin: 0 0 12px; font-size: 14px; text-transform: uppercase; letter-spacing: 0.6px; color: var(--muted); font-weight: 600; }
+  table { width: 100%; border-collapse: collapse; font-size: 13px; }
+  th { text-align: left; font-weight: 600; color: var(--dim); font-size: 11px; text-transform: uppercase; letter-spacing: 0.5px; padding: 8px 10px; border-bottom: 1px solid var(--border); }
+  td { padding: 10px; border-bottom: 1px solid #21262d; }
+  tr:last-child td { border-bottom: none; }
+  td.num { text-align: right; font-variant-numeric: tabular-nums; }
+  td .pill { display: inline-block; padding: 2px 8px; border-radius: 999px; font-size: 11px; background: #21262d; color: var(--muted); }
+  td .pill.project { background: rgba(88,166,255,0.15); color: var(--accent); }
+  td .pill.global { background: rgba(63,185,80,0.15); color: var(--live); }
+  .empty { color: var(--dim); font-style: italic; padding: 12px 0; font-size: 13px; }
+  .badge { display: inline-block; padding: 1px 6px; border-radius: 4px; font-size: 11px; background: #21262d; color: var(--muted); margin-right: 4px; }
+  .project-link { color: var(--accent); cursor: pointer; text-decoration: none; }
+  .project-link:hover { text-decoration: underline; }
+  .drawer-backdrop { position: fixed; inset: 0; background: rgba(0,0,0,0.6); display: none; z-index: 50; }
+  .drawer-backdrop.open { display: block; }
+  .drawer { position: fixed; top: 0; right: 0; bottom: 0; width: min(720px, 90vw); background: var(--panel); border-left: 1px solid var(--border); box-shadow: -8px 0 24px rgba(0,0,0,0.5); transform: translateX(100%); transition: transform 0.18s ease; overflow-y: auto; z-index: 51; padding: 24px; }
+  .drawer.open { transform: translateX(0); }
+  .drawer h2 { margin: 0 0 4px; color: var(--accent); font-size: 18px; }
+  .drawer .drawer-meta { color: var(--muted); font-size: 12px; margin-bottom: 20px; }
+  .drawer .drawer-close { float: right; background: transparent; border: 1px solid var(--border); color: var(--text); padding: 4px 10px; border-radius: 6px; cursor: pointer; font-size: 12px; }
+  .drawer .drawer-close:hover { background: #21262d; }
+  .msg-row { padding: 10px; border-bottom: 1px solid #21262d; font-size: 13px; }
+  .msg-row:last-child { border-bottom: none; }
+  .msg-row .msg-subject { font-weight: 600; color: #f0f6fc; }
+  .msg-row .msg-meta { color: var(--dim); font-size: 11px; margin-top: 2px; }
+  .msg-row .msg-preview { color: var(--muted); font-size: 12px; margin-top: 4px; font-style: italic; }
+  .pill.priority-high { background: rgba(248,81,73,0.18); color: var(--high); }
+  .pill.priority-normal { background: rgba(88,166,255,0.15); color: var(--accent); }
+  .pill.priority-low { background: #21262d; color: var(--dim); }
+  .hq-toolbar { display: flex; align-items: center; gap: 8px; margin: 12px 0 16px; padding: 8px 12px; background: var(--panel); border: 1px solid var(--border); border-radius: 8px; }
+  .hq-toolbar label { font-size: 12px; text-transform: uppercase; letter-spacing: 0.5px; color: var(--dim); }
+  .hq-toolbar select { background: #0d1117; color: var(--text); border: 1px solid var(--border); border-radius: 6px; padding: 6px 10px; font-size: 13px; min-width: 280px; }
+  .hq-toolbar select:focus { outline: none; border-color: var(--accent); }
+  .feed-status { float: right; font-size: 10px; text-transform: none; letter-spacing: 0; color: var(--dim); }
+  .feed-status.live { color: var(--live); }
+  .feed-row { padding: 8px 10px; border-bottom: 1px solid #21262d; font-size: 12px; animation: feed-flash 0.6s ease-out; }
+  .feed-row:last-child { border-bottom: none; }
+  .feed-row .feed-action { display: inline-block; padding: 1px 6px; border-radius: 3px; font-size: 10px; margin-right: 6px; background: #21262d; color: var(--muted); font-family: ui-monospace, monospace; }
+  .feed-row .feed-action.message-sent { background: rgba(88,166,255,0.18); color: var(--accent); }
+  .feed-row .feed-action.message-completed { background: rgba(63,185,80,0.18); color: var(--live); }
+  .feed-row .feed-action.message-read { background: rgba(139,148,158,0.18); color: var(--muted); }
+  .feed-row .feed-action.agent-offline { background: rgba(248,81,73,0.18); color: var(--high); }
+  .feed-row .feed-action.agent-registered { background: rgba(63,185,80,0.18); color: var(--live); }
+  .feed-row .feed-meta { color: var(--dim); font-size: 10px; margin-top: 2px; }
+  @keyframes feed-flash { 0% { background: rgba(88,166,255,0.25); } 100% { background: transparent; } }
+</style>
+</head>
+<body>
+<h1>\u{1F4CB} WrongStack HQ</h1>
+<p class="hq-sub" id="hq-conn"><span class="hq-led dead" id="hq-led"></span>Connecting\u2026</p>
+<div class="hq-toolbar">
+  <label for="project-picker">Project:</label>
+  <select id="project-picker" aria-label="Select project">
+    <option value="">\u2014 Select project \u2014</option>
+  </select>
+</div>
+
+<div class="hq-grid">
+  <div class="hq-stat"><span class="num" id="stat-clients">0</span><div class="label">Active clients</div></div>
+  <div class="hq-stat"><span class="num" id="stat-projects">0</span><div class="label">Projects</div></div>
+  <div class="hq-stat warn"><span class="num" id="stat-mailboxes">0</span><div class="label">Mailboxes</div></div>
+  <div class="hq-stat warn"><span class="num" id="stat-unread">0</span><div class="label">Unread messages</div></div>
+  <div class="hq-stat warn"><span class="num" id="stat-incomplete">0</span><div class="label">Open messages</div></div>
+  <div class="hq-stat high"><span class="num" id="stat-high">0</span><div class="label">High priority</div></div>
+  <div class="hq-stat"><span class="num" id="stat-agents">0</span><div class="label">Online agents</div></div>
+</div>
+
+<section>
+  <h2>\u{1F4EC} Mailboxes</h2>
+  <table>
+    <thead>
+      <tr>
+        <th>Mailbox</th>
+        <th>Scope</th>
+        <th>Project</th>
+        <th class="num">Messages</th>
+        <th class="num">Unread</th>
+        <th class="num">Open</th>
+        <th class="num">High</th>
+        <th class="num">Agents</th>
+      </tr>
+    </thead>
+    <tbody id="tbody-mailboxes">
+      <tr><td colspan="8" class="empty">No mailboxes yet. Connect a TUI/REPL/WebUI client with WRONGSTACK_HQ_URL set.</td></tr>
+    </tbody>
+  </table>
+</section>
+
+<section>
+  <h2>\u{1F465} Clients</h2>
+  <table>
+    <thead>
+      <tr>
+        <th>Client ID</th>
+        <th>Kind</th>
+        <th>Project</th>
+        <th>Capabilities</th>
+        <th>Last seen</th>
+      </tr>
+    </thead>
+    <tbody id="tbody-clients">
+      <tr><td colspan="5" class="empty">No clients connected yet.</td></tr>
+    </tbody>
+  </table>
+</section>
+
+<div class="drawer-backdrop" id="drawer-backdrop"></div>
+<aside class="drawer" id="drawer" aria-hidden="true">
+  <button class="drawer-close" id="drawer-close">Close</button>
+  <h2 id="drawer-title">Project</h2>
+  <p class="drawer-meta" id="drawer-meta"></p>
+  <section>
+    <h2>\u{1F4EC} Mailboxes</h2>
+    <table>
+      <thead>
+        <tr>
+          <th>Mailbox</th>
+          <th>Scope</th>
+          <th class="num">Messages</th>
+          <th class="num">Unread</th>
+          <th class="num">Agents</th>
+        </tr>
+      </thead>
+      <tbody id="drawer-mailboxes">
+        <tr><td colspan="5" class="empty">Loading\u2026</td></tr>
+      </tbody>
+    </table>
+  </section>
+  <section>
+    <h2>\u{1F4E8} Recent messages</h2>
+    <div id="drawer-messages">
+      <p class="empty">Loading\u2026</p>
+    </div>
+  </section>
+  <section>
+    <h2>\u{1F4E1} Live mailbox events
+      <span class="feed-status" id="feed-status">(idle)</span>
+    </h2>
+    <div id="drawer-event-feed">
+      <p class="empty">No mailbox events yet for this project.</p>
+    </div>
+  </section>
+  <section>
+    <h2>\u{1F465} Clients</h2>
+    <table>
+      <thead>
+        <tr>
+          <th>Client ID</th>
+          <th>Kind</th>
+          <th>Last seen</th>
+        </tr>
+      </thead>
+      <tbody id="drawer-clients">
+        <tr><td colspan="3" class="empty">Loading\u2026</td></tr>
+      </tbody>
+    </table>
+  </section>
+</aside>
+
+<script>
+  const led = document.getElementById('hq-led');
+  const connText = document.getElementById('hq-conn');
+
+  function el(id) { return document.getElementById(id); }
+
+  function fmtTime(iso) {
+    if (!iso) return '\u2014';
+    const d = new Date(iso);
+    if (isNaN(d.getTime())) return '\u2014';
+    return d.toLocaleTimeString();
+  }
+
+  function shortId(s) {
+    if (!s) return '\u2014';
+    return s.length > 12 ? s.slice(0, 6) + '\u2026' + s.slice(-4) : s;
+  }
+
+  function renderMailboxes(mailboxes) {
+    const tbody = el('tbody-mailboxes');
+    if (!mailboxes || mailboxes.length === 0) {
+      tbody.innerHTML = '<tr><td colspan="8" class="empty">No mailboxes yet. Connect a TUI/REPL/WebUI client with WRONGSTACK_HQ_URL set.</td></tr>';
+      return;
+    }
+    tbody.innerHTML = mailboxes.map((m) => {
+      const scopeClass = m.scope === 'global' ? 'global' : 'project';
+      const projectCell = '<a href="#' + encodeURIComponent(m.projectId) + '" class="project-link" data-project="' + escapeHtml(m.projectId) + '">' + escapeHtml(shortId(m.projectId)) + '</a>';
+      return '<tr>' +
+        '<td><code>' + escapeHtml(shortId(m.mailboxId)) + '</code></td>' +
+        '<td><span class="pill ' + scopeClass + '">' + escapeHtml(m.scope) + '</span></td>' +
+        '<td>' + projectCell + '</td>' +
+        '<td class="num">' + m.messageCount + '</td>' +
+        '<td class="num">' + (m.unreadCount > 0 ? '<strong>' + m.unreadCount + '</strong>' : '0') + '</td>' +
+        '<td class="num">' + m.incompleteCount + '</td>' +
+        '<td class="num">' + (m.highPriorityCount > 0 ? '<strong style="color:var(--high)">' + m.highPriorityCount + '</strong>' : '0') + '</td>' +
+        '<td class="num">' + m.onlineAgentCount + '</td>' +
+      '</tr>';
+    }).join('');
+    wireProjectLinks();
+  }
+
+  function renderClients(clients) {
+    const tbody = el('tbody-clients');
+    if (!clients || clients.length === 0) {
+      tbody.innerHTML = '<tr><td colspan="5" class="empty">No clients connected yet.</td></tr>';
+      return;
+    }
+    tbody.innerHTML = clients.map((c) => {
+      const caps = (c.capabilities || []).map((cap) => '<span class="badge">' + escapeHtml(cap) + '</span>').join('');
+      return '<tr>' +
+        '<td><code>' + escapeHtml(shortId(c.clientId)) + '</code></td>' +
+        '<td>' + escapeHtml(c.kind) + '</td>' +
+        '<td>' + escapeHtml(shortId(c.projectId)) + '</td>' +
+        '<td>' + caps + '</td>' +
+        '<td>' + fmtTime(c.lastSeenAt) + '</td>' +
+      '</tr>';
+    }).join('');
+  }
+
+  function escapeHtml(s) {
+    if (s === null || s === undefined) return '';
+    return String(s).replace(/[&<>"']/g, function (c) {
+      return { '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c];
+    });
+  }
+
+  function applySnapshot(s) {
+    el('stat-clients').textContent = s.totals.activeClients;
+    el('stat-projects').textContent = s.totals.activeProjects;
+    el('stat-unread').textContent = s.totals.unreadMailboxMessages;
+    el('stat-incomplete').textContent = s.totals.incompleteMailboxMessages;
+
+    let totalMessages = 0;
+    let highPriority = 0;
+    let onlineAgents = 0;
+    for (const m of (s.mailboxes || [])) {
+      totalMessages += m.messageCount;
+      highPriority += m.highPriorityCount;
+      onlineAgents += m.onlineAgentCount;
+    }
+    el('stat-mailboxes').textContent = (s.mailboxes || []).length;
+    el('stat-high').textContent = highPriority;
+    el('stat-agents').textContent = onlineAgents;
+
+    renderMailboxes(s.mailboxes || []);
+    renderClients(s.clients || []);
+    renderProjectPicker(s.projects || []);
+
+    // Auto-refresh the open drawer if the open project is still active in
+    // the live snapshot. Debounced so rapid burst updates trigger one fetch.
+    if (currentDetailProjectId) {
+      const stillActive = (s.projects || []).some((p) => p.projectId === currentDetailProjectId);
+      if (stillActive) scheduleAutoRefresh();
+    }
+  }
+
+  // ---------- Project drilldown drawer ----------
+
+  // Current detail request token; if the URL changes (e.g. user picks a
+  // different project) we discard stale responses.
+  let currentDetailToken = 0;
+  let currentDetailProjectId = null;
+  let autoRefreshTimer = null;
+  let lastAutoRefreshAt = null;
+  // Per-project live event feed (ring buffer per project). Keyed by
+  // projectId so switching drawers keeps each project's history.
+  const eventFeeds = new Map();
+  const FEED_MAX = 50;
+  let feedIdleTimer = null;
+
+  function parseInitialProject() {
+    // Prefer ?project=ID over #ID so URL copy/paste stays predictable even
+    // when fragments would otherwise be lost on server round-trips.
+    const url = new URL(location.href);
+    const fromQuery = url.searchParams.get('project');
+    if (fromQuery) return fromQuery;
+    if (location.hash.length > 1) {
+      try { return decodeURIComponent(location.hash.slice(1)); } catch { return null; }
+    }
+    return null;
+  }
+
+  function pushProjectUrl(projectId) {
+    const url = new URL(location.href);
+    url.searchParams.set('project', projectId);
+    url.hash = '';
+    history.replaceState(null, '', url.pathname + url.search);
+  }
+
+  function clearProjectUrl() {
+    const url = new URL(location.href);
+    url.searchParams.delete('project');
+    url.hash = '';
+    history.replaceState(null, '', url.pathname + (url.searchParams.toString() ? '?' + url.searchParams.toString() : ''));
+  }
+
+  function renderProjectPicker(projects) {
+    const sel = el('project-picker');
+    if (!sel) return;
+    const current = currentDetailProjectId || '';
+    sel.innerHTML =
+      '<option value="">\u2014 Select project \u2014</option>' +
+      (projects || []).map((p) =>
+        '<option value="' + escapeHtml(p.projectId) + '"' +
+          (p.projectId === current ? ' selected' : '') +
+        '>' + escapeHtml(p.projectName || p.projectId) + ' (' + (p.activeClients || 0) + ')</option>'
+      ).join('');
+    sel.onchange = () => {
+      const v = sel.value;
+      if (v) openProject(v);
+      else closeProject();
+    };
+  }
+
+  function setDrawerMeta(detail) {
+    if (!detail || !detail.project) return;
+    const p = detail.project;
+    const refreshed = lastAutoRefreshAt ? ' \xB7 Last refreshed ' + fmtTime(lastAutoRefreshAt) : '';
+    el('drawer-meta').textContent =
+      'Active clients: ' + (p.activeClients || 0) +
+      ' \xB7 Generated: ' + fmtTime(detail.generatedAt) +
+      refreshed;
+  }
+
+  function fetchProjectDetail(projectId, opts) {
+    const token = ++currentDetailToken;
+    const silent = opts && opts.silent;
+    if (!silent) {
+      el('drawer-meta').textContent = 'Refreshing\u2026';
+    }
+    fetch('/api/projects/' + encodeURIComponent(projectId))
+      .then((r) => {
+        if (!r.ok) throw new Error('HTTP ' + r.status);
+        return r.json();
+      })
+      .then((d) => {
+        if (token !== currentDetailToken) return; // stale
+        renderProjectDetail(d);
+        lastAutoRefreshAt = new Date();
+        setDrawerMeta(d);
+      })
+      .catch((err) => {
+        if (token !== currentDetailToken) return;
+        if (!silent) {
+          el('drawer-meta').textContent = 'Failed to load: ' + escapeHtml(String(err.message || err));
+        }
+      });
+  }
+
+  function scheduleAutoRefresh() {
+    if (autoRefreshTimer) clearTimeout(autoRefreshTimer);
+    autoRefreshTimer = setTimeout(() => {
+      autoRefreshTimer = null;
+      if (currentDetailProjectId) fetchProjectDetail(currentDetailProjectId, { silent: true });
+    }, 250);
+  }
+
+  function openProject(projectId) {
+    if (!projectId) return;
+    const drawer = el('drawer');
+    const backdrop = el('drawer-backdrop');
+    el('drawer-title').textContent = projectId;
+    el('drawer-meta').textContent = 'Loading\u2026';
+    el('drawer-mailboxes').innerHTML = '<tr><td colspan="5" class="empty">Loading\u2026</td></tr>';
+    el('drawer-messages').innerHTML = '<p class="empty">Loading\u2026</p>';
+    el('drawer-clients').innerHTML = '<tr><td colspan="3" class="empty">Loading\u2026</td></tr>';
+    drawer.classList.add('open');
+    backdrop.classList.add('open');
+    drawer.setAttribute('aria-hidden', 'false');
+    pushProjectUrl(projectId);
+    currentDetailProjectId = projectId;
+    lastAutoRefreshAt = null;
+    // Render any mailbox events the project received while the drawer was
+    // closed so the live feed ring buffer is visible immediately on open.
+    const existingFeed = eventFeeds.get(projectId);
+    if (existingFeed) renderEventFeed(existingFeed);
+    fetchProjectDetail(projectId, { silent: false });
+  }
+
+  function closeProject() {
+    const drawer = el('drawer');
+    const backdrop = el('drawer-backdrop');
+    drawer.classList.remove('open');
+    backdrop.classList.remove('open');
+    drawer.setAttribute('aria-hidden', 'true');
+    currentDetailProjectId = null;
+    currentDetailToken++;
+    if (autoRefreshTimer) {
+      clearTimeout(autoRefreshTimer);
+      autoRefreshTimer = null;
+    }
+    lastAutoRefreshAt = null;
+    clearProjectUrl();
+    const sel = el('project-picker');
+    if (sel) sel.value = '';
+  }
+
+  function renderProjectDetail(detail) {
+    if (!detail || !detail.project) {
+      el('drawer-meta').textContent = 'No data.';
+      return;
+    }
+    setDrawerMeta(detail);
+
+    // Mailboxes
+    const mbs = detail.mailboxes || [];
+    el('drawer-mailboxes').innerHTML = mbs.length === 0
+      ? '<tr><td colspan="5" class="empty">No mailboxes reported for this project yet.</td></tr>'
+      : mbs.map((m) => {
+          const scopeClass = m.scope === 'global' ? 'global' : 'project';
+          return '<tr>' +
+            '<td><code>' + escapeHtml(shortId(m.mailboxId)) + '</code></td>' +
+            '<td><span class="pill ' + scopeClass + '">' + escapeHtml(m.scope) + '</span></td>' +
+            '<td class="num">' + m.totals.messages + '</td>' +
+            '<td class="num">' + (m.totals.unread > 0 ? '<strong>' + m.totals.unread + '</strong>' : '0') + '</td>' +
+            '<td class="num">' + m.totals.onlineAgents + '</td>' +
+          '</tr>';
+        }).join('');
+
+    // Recent messages \u2014 flatten + sort by timestamp desc, take 20
+    const allMessages = [];
+    for (const m of mbs) {
+      for (const msg of (m.messages || [])) allMessages.push(msg);
+    }
+    allMessages.sort((a, b) => (b.timestamp || '').localeCompare(a.timestamp || ''));
+    const recent = allMessages.slice(0, 20);
+    el('drawer-messages').innerHTML = recent.length === 0
+      ? '<p class="empty">No messages in any mailbox snapshot yet.</p>'
+      : recent.map((m) => {
+          const priorityClass = 'priority-' + (m.priority || 'normal');
+          const preview = m.bodyPreview ? '<div class="msg-preview">' + escapeHtml(m.bodyPreview) + '</div>' : '';
+          const task = m.task ? ' \xB7 task: ' + escapeHtml(m.task.status || '?') : '';
+          return '<div class="msg-row">' +
+            '<span class="pill ' + priorityClass + '">' + escapeHtml(m.priority || 'normal') + '</span>' +
+            '<span class="pill">' + escapeHtml(m.type || '?') + '</span>' +
+            '<span class="msg-subject"> ' + escapeHtml(m.subject || '(no subject)') + '</span>' +
+            '<div class="msg-meta">' + escapeHtml(m.from || '?') + ' \u2192 ' + escapeHtml(m.to || '?') + ' \xB7 ' + fmtTime(m.timestamp) + (m.completed ? ' \xB7 \u2713 completed' : '') + task + '</div>' +
+            preview +
+          '</div>';
+        }).join('');
+
+    // Clients
+    const cs = detail.clients || [];
+    el('drawer-clients').innerHTML = cs.length === 0
+      ? '<tr><td colspan="3" class="empty">No clients for this project.</td></tr>'
+      : cs.map((c) =>
+          '<tr>' +
+            '<td><code>' + escapeHtml(shortId(c.clientId)) + '</code></td>' +
+            '<td>' + escapeHtml(c.kind) + '</td>' +
+            '<td>' + fmtTime(c.lastSeenAt) + '</td>' +
+          '</tr>'
+        ).join('');
+  }
+
+  function wireProjectLinks() {
+    const links = document.querySelectorAll('a.project-link');
+    links.forEach((a) => {
+      a.onclick = (ev) => {
+        ev.preventDefault();
+        const pid = a.getAttribute('data-project') || '';
+        openProject(pid);
+      };
+    });
+  }
+
+  el('drawer-close').onclick = closeProject;
+  el('drawer-backdrop').onclick = closeProject;
+  document.addEventListener('keydown', (ev) => {
+    if (ev.key === 'Escape') closeProject();
+  });
+
+  // Respond to browser back/forward to switch projects.
+  window.addEventListener('popstate', () => {
+    const pid = parseInitialProject();
+    if (pid) {
+      if (pid !== currentDetailProjectId) openProject(pid);
+    } else if (currentDetailProjectId) {
+      closeProject();
+    }
+  });
+
+  // Open drawer automatically if URL has ?project=ID or #projectId.
+  const initialProject = parseInitialProject();
+  if (initialProject) openProject(initialProject);
+
+  function connect() {
+    const proto = location.protocol === 'https:' ? 'wss:' : 'ws:';
+    const ws = new WebSocket(proto + '//' + location.host + '/ws/browser');
+    ws.onopen = () => {
+      led.className = 'hq-led live';
+      connText.innerHTML = '<span class="hq-led live"></span>Connected to HQ';
+    };
+    ws.onmessage = (ev) => {
+      try {
+        const msg = JSON.parse(ev.data);
+        if (msg.type === 'hq.snapshot') applySnapshot(msg.snapshot);
+        else if (msg.type === 'hq.event') handleHqEvent(msg.event);
+      } catch {}
+    };
+    ws.onclose = () => {
+      led.className = 'hq-led dead';
+      connText.innerHTML = '<span class="hq-led dead"></span>Disconnected \u2014 reconnecting\u2026';
+      setTimeout(connect, 2000);
+    };
+    ws.onerror = () => ws.close();
+  }
+
+  // ---------- Live mailbox event feed ----------
+
+  function handleHqEvent(event) {
+    if (!event || event.type !== 'mailbox.event') return;
+    const projectId = event.projectId;
+    if (!projectId) return;
+    const list = eventFeeds.get(projectId) || [];
+    list.unshift(event); // newest first
+    if (list.length > FEED_MAX) list.length = FEED_MAX;
+    eventFeeds.set(projectId, list);
+
+    // Only re-render if the open drawer matches this project's id.
+    if (projectId === currentDetailProjectId) {
+      renderEventFeed(list);
+      flashFeedStatus();
+    }
+  }
+
+  function renderEventFeed(list) {
+    const elFeed = el('drawer-event-feed');
+    if (!elFeed) return;
+    if (!list || list.length === 0) {
+      elFeed.innerHTML = '<p class="empty">No mailbox events yet for this project.</p>';
+      return;
+    }
+    elFeed.innerHTML = list.map((evt) => {
+      const p = evt.payload || {};
+      const action = escapeHtml(p.action || '?');
+      let detail = '';
+      if (p.summary) detail = escapeHtml(p.summary);
+      else if (p.message) detail = escapeHtml((p.message.subject || '(no subject)') + ' \xB7 ' + (p.message.from || '?') + ' \u2192 ' + (p.message.to || '?'));
+      else if (p.agent) detail = escapeHtml((p.agent.name || p.agent.agentId || '?') + ' (' + (p.agent.status || '?') + ')');
+      else detail = '<em>no detail</em>';
+      const mailboxShort = p.mailboxId ? ' \xB7 ' + escapeHtml(shortId(p.mailboxId)) : '';
+      return '<div class="feed-row">' +
+        '<span class="feed-action ' + action + '">' + action + '</span>' +
+        '<span>' + detail + '</span>' +
+        '<div class="feed-meta">' + fmtTime(evt.timestamp) + mailboxShort + '</div>' +
+      '</div>';
+    }).join('');
+  }
+
+  function clearEventFeed(projectId) {
+    eventFeeds.delete(projectId);
+  }
+
+  function flashFeedStatus() {
+    const status = el('feed-status');
+    if (!status) return;
+    status.textContent = '(live)';
+    status.className = 'feed-status live';
+    if (feedIdleTimer) clearTimeout(feedIdleTimer);
+    feedIdleTimer = setTimeout(() => {
+      status.textContent = '(idle)';
+      status.className = 'feed-status';
+      feedIdleTimer = null;
+    }, 1500);
+  }
+
+  connect();
+</script>
+</body>
+</html>`;
+  }
+});
+
 // src/update-check.ts
 var update_check_exports = {};
 __export(update_check_exports, {
@@ -3457,10 +4560,10 @@ function handlePing(ctx, ws) {
   ctx.send(ws, { type: "pong", payload: {} });
 }
 function handleToolConfirmResult(ctx, id, decision) {
-  const resolve11 = ctx.pendingConfirms.get(id);
-  if (resolve11) {
+  const resolve12 = ctx.pendingConfirms.get(id);
+  if (resolve12) {
     ctx.pendingConfirms.delete(id);
-    resolve11(decision);
+    resolve12(decision);
   }
 }
 var init_connection = __esm({
@@ -3872,8 +4975,8 @@ async function handleProjectsSelect(ctx, ws, payload) {
   const { root, name: projectName } = payload;
   try {
     const resolved = path4.resolve(root);
-    const stat7 = await fsp5.stat(resolved).catch(() => null);
-    if (!stat7?.isDirectory()) {
+    const stat8 = await fsp5.stat(resolved).catch(() => null);
+    if (!stat8?.isDirectory()) {
       ctx.send(ws, {
         type: "projects.selected",
         payload: {
@@ -3964,8 +5067,8 @@ async function handleProjectsAdd(ctx, ws, payload) {
   const { root: addRoot, name: addName } = payload;
   try {
     const resolved = path4.resolve(addRoot);
-    const stat7 = await fsp5.stat(resolved).catch(() => null);
-    if (!stat7?.isDirectory()) throw new Error(`Not a directory: ${resolved}`);
+    const stat8 = await fsp5.stat(resolved).catch(() => null);
+    if (!stat8?.isDirectory()) throw new Error(`Not a directory: ${resolved}`);
     const manifest = await loadManifest(ctx.opts.globalConfigPath);
     const existing = manifest.projects.find((p) => path4.resolve(p.root) === resolved);
     if (existing) {
@@ -4010,8 +5113,8 @@ async function handleWorkingDirSet(ctx, ws, newPath) {
       sendResult6(ctx, ws, false, `Path must stay inside the project root: ${wdRoot}`);
       return;
     }
-    const stat7 = await fsp5.stat(resolved).catch(() => null);
-    if (!stat7?.isDirectory()) {
+    const stat8 = await fsp5.stat(resolved).catch(() => null);
+    if (!stat8?.isDirectory()) {
       sendResult6(ctx, ws, false, `Directory not found or not accessible: ${resolved}`);
       return;
     }
@@ -4750,6 +5853,10 @@ async function runWebUI(opts) {
     "contextStrategy",
     "logLevel",
     "auditLevel",
+    "hqEnabled",
+    "hqUrl",
+    "hqToken",
+    "hqRawContent",
     // Telegram plugin notification settings (parity with the standalone server).
     "tgConfigured",
     "tgSessionEnd",
@@ -4793,6 +5900,11 @@ async function runWebUI(opts) {
       meta["logLevel"] = cfg.log?.["level"] ?? "info";
       meta["auditLevel"] = cfg.session?.["auditLevel"] ?? "standard";
       meta["maxIterations"] = cfg.tools?.["maxIterations"] ?? 500;
+      const hqCfg = cfg.hq ?? {};
+      meta["hqEnabled"] = hqCfg["enabled"] === true;
+      meta["hqUrl"] = typeof hqCfg["url"] === "string" ? hqCfg["url"] : "";
+      meta["hqToken"] = typeof hqCfg["token"] === "string" ? hqCfg["token"] : "";
+      meta["hqRawContent"] = hqCfg["rawContent"] === true;
       const tgExt = cfg.extensions?.["telegram"];
       meta["tgConfigured"] = typeof tgExt?.["botToken"] === "string" && tgExt["botToken"].length > 0;
       meta["tgSessionEnd"] = tgExt?.["notifyOnSessionEnd"] === true;
@@ -4893,6 +6005,15 @@ async function runWebUI(opts) {
         toolsCfg.maxIterations = payload["maxIterations"];
         decrypted.tools = toolsCfg;
       }
+      const hqTouched = typeof payload["hqEnabled"] === "boolean" || typeof payload["hqUrl"] === "string" || typeof payload["hqToken"] === "string" || typeof payload["hqRawContent"] === "boolean";
+      if (hqTouched) {
+        const hqCfg = decrypted.hq ?? {};
+        if (typeof payload["hqEnabled"] === "boolean") hqCfg.enabled = payload["hqEnabled"];
+        if (typeof payload["hqUrl"] === "string") hqCfg.url = payload["hqUrl"];
+        if (typeof payload["hqToken"] === "string") hqCfg.token = payload["hqToken"];
+        if (typeof payload["hqRawContent"] === "boolean") hqCfg.rawContent = payload["hqRawContent"];
+        decrypted.hq = hqCfg;
+      }
       const tgTouched = typeof payload["tgSessionEnd"] === "boolean" || typeof payload["tgDelegate"] === "boolean" || typeof payload["tgLongToolMs"] === "number";
       if (tgTouched) {
         const ext = decrypted.extensions ?? {};
@@ -4979,7 +6100,9 @@ async function runWebUI(opts) {
     if (!opts.projectRoot) return null;
     try {
       const projectDir = resolveProjectDir(opts.projectRoot, wstackGlobalRoot());
-      const mailbox = new GlobalMailbox(projectDir, opts.events);
+      const hqPublisher = createHqPublisherFromEnv({ clientKind: "webui", projectRoot: opts.projectRoot, projectName: path4.basename(opts.projectRoot), appConfig: opts.appConfig });
+      hqPublisher?.connect();
+      const mailbox = new GlobalMailbox(projectDir, opts.events, hqPublisher);
       webuiClientId = `webui@${crypto3.randomUUID().slice(0, 8)}`;
       const projectName = opts.projectRoot ? path4.basename(opts.projectRoot) : "unknown";
       await mailbox.registerClient({
@@ -5053,6 +6176,113 @@ async function runWebUI(opts) {
     type: "fleet.concurrency_update",
     payload: { fleetConcurrency, fleetConcurrencyMax: FLEET_CONCURRENCY_MAX }
   });
+  const STREAM_COALESCE_MS = 16;
+  const STREAM_COALESCE_MAX_CHARS = 8 * 1024;
+  let textDeltaBuffer = "";
+  let textDeltaTimer = null;
+  let thinkingDeltaBuffer = "";
+  let thinkingDeltaTimer = null;
+  const toolProgressBuffers = /* @__PURE__ */ new Map();
+  const flushTextDelta = () => {
+    if (textDeltaTimer) {
+      clearTimeout(textDeltaTimer);
+      textDeltaTimer = null;
+    }
+    if (!textDeltaBuffer) return;
+    const text = textDeltaBuffer;
+    textDeltaBuffer = "";
+    broadcast({
+      type: "provider.text_delta",
+      payload: { text, messageId: "current" }
+    });
+  };
+  const flushThinkingDelta = () => {
+    if (thinkingDeltaTimer) {
+      clearTimeout(thinkingDeltaTimer);
+      thinkingDeltaTimer = null;
+    }
+    if (!thinkingDeltaBuffer) return;
+    const text = thinkingDeltaBuffer;
+    thinkingDeltaBuffer = "";
+    broadcast({
+      type: "provider.thinking_delta",
+      payload: { text }
+    });
+  };
+  const queueTextDelta = (text) => {
+    if (!text) return;
+    textDeltaBuffer += text;
+    if (textDeltaBuffer.length >= STREAM_COALESCE_MAX_CHARS) {
+      flushTextDelta();
+      return;
+    }
+    if (!textDeltaTimer) {
+      textDeltaTimer = setTimeout(flushTextDelta, STREAM_COALESCE_MS);
+      textDeltaTimer.unref?.();
+    }
+  };
+  const queueThinkingDelta = (text) => {
+    if (!text) return;
+    thinkingDeltaBuffer += text;
+    if (thinkingDeltaBuffer.length >= STREAM_COALESCE_MAX_CHARS) {
+      flushThinkingDelta();
+      return;
+    }
+    if (!thinkingDeltaTimer) {
+      thinkingDeltaTimer = setTimeout(flushThinkingDelta, STREAM_COALESCE_MS);
+      thinkingDeltaTimer.unref?.();
+    }
+  };
+  const flushToolProgress = (id) => {
+    const buffered = toolProgressBuffers.get(id);
+    if (!buffered) return;
+    if (buffered.timer) clearTimeout(buffered.timer);
+    toolProgressBuffers.delete(id);
+    if (!buffered.text) return;
+    broadcast({
+      type: "tool.progress",
+      payload: {
+        name: buffered.name,
+        id: buffered.id,
+        event: { type: buffered.eventType, text: buffered.text }
+      }
+    });
+  };
+  const flushAllStreamBuffers = () => {
+    flushTextDelta();
+    flushThinkingDelta();
+    for (const id of [...toolProgressBuffers.keys()]) flushToolProgress(id);
+  };
+  const queueToolProgress = (payload) => {
+    const text = payload.event.text;
+    if (!text) {
+      flushToolProgress(payload.id);
+      broadcast({ type: "tool.progress", payload });
+      return;
+    }
+    const eventType = payload.event.type ?? "progress";
+    const existing = toolProgressBuffers.get(payload.id);
+    if (existing && existing.eventType !== eventType) flushToolProgress(payload.id);
+    const buffered = toolProgressBuffers.get(payload.id) ?? {
+      id: payload.id,
+      name: payload.name,
+      eventType,
+      text: "",
+      timer: null
+    };
+    buffered.name = payload.name;
+    buffered.text += buffered.text ? `
+${text}` : text;
+    toolProgressBuffers.set(payload.id, buffered);
+    if (buffered.text.length >= STREAM_COALESCE_MAX_CHARS) {
+      flushToolProgress(payload.id);
+      return;
+    }
+    if (!buffered.timer) {
+      buffered.timer = setTimeout(() => flushToolProgress(payload.id), STREAM_COALESCE_MS);
+      buffered.timer.unref?.();
+    }
+  };
   function setupEvents() {
     for (const unsub of eventUnsubscribers) unsub();
     eventUnsubscribers.length = 0;
@@ -5081,22 +6311,18 @@ async function runWebUI(opts) {
     );
     eventUnsubscribers.push(
       opts.events.on("provider.text_delta", (e) => {
-        broadcast({
-          type: "provider.text_delta",
-          payload: { text: e.text, messageId: "current" }
-        });
+        flushThinkingDelta();
+        queueTextDelta(e.text);
       })
     );
     eventUnsubscribers.push(
       opts.events.on("provider.thinking_delta", (e) => {
-        broadcast({
-          type: "provider.thinking_delta",
-          payload: { text: e.text }
-        });
+        queueThinkingDelta(e.text);
       })
     );
     eventUnsubscribers.push(
       opts.events.on("tool.started", (e) => {
+        flushAllStreamBuffers();
         broadcast({
           type: "tool.started",
           payload: {
@@ -5110,18 +6336,16 @@ async function runWebUI(opts) {
     );
     eventUnsubscribers.push(
       opts.events.on("tool.progress", (e) => {
-        broadcast({
-          type: "tool.progress",
-          payload: {
-            name: e.name,
-            id: e.id,
-            event: e.event
-          }
+        queueToolProgress({
+          name: e.name,
+          id: e.id,
+          event: e.event
         });
       })
     );
     eventUnsubscribers.push(
       opts.events.on("tool.executed", (e) => {
+        flushAllStreamBuffers();
         broadcast({
           type: "tool.executed",
           payload: {
@@ -5178,6 +6402,7 @@ async function runWebUI(opts) {
     );
     eventUnsubscribers.push(
       opts.events.on("provider.response", (e) => {
+        flushAllStreamBuffers();
         broadcast({
           type: "provider.response",
           payload: {
@@ -5392,6 +6617,19 @@ async function runWebUI(opts) {
     log: (m) => console.log(m)
   };
   const wsCommon = { send, broadcast, log: (m) => console.log(m) };
+  const mailboxCache = /* @__PURE__ */ new Map();
+  const getWebuiMailbox = () => {
+    const projectRoot = opts.projectRoot ?? opts.agent.ctx.projectRoot ?? "";
+    const globalRoot = opts.globalConfigPath ? path4.dirname(opts.globalConfigPath) : "";
+    if (!projectRoot || !globalRoot) return null;
+    const mbDir = resolveProjectDir(projectRoot, globalRoot);
+    let mailbox = mailboxCache.get(mbDir);
+    if (!mailbox) {
+      mailbox = new GlobalMailbox(mbDir, opts.events);
+      mailboxCache.set(mbDir, mailbox);
+    }
+    return mailbox;
+  };
   const sessionsCtx = {
     opts,
     buildSessionStart: (overrides) => buildSessionStartPayload(overrides),
@@ -5407,7 +6645,7 @@ async function runWebUI(opts) {
     broadcast,
     log: (m) => console.log(m)
   };
-  return new Promise((resolve11) => {
+  return new Promise((resolve12) => {
     wss.on("listening", () => {
       console.log(`[WebUI] WebSocket server running on ws://${host}:${port}`);
       setupEvents();
@@ -5525,8 +6763,8 @@ async function runWebUI(opts) {
         clients.delete(ws);
         abortControllers.delete(ws);
         if (clients.size === 0 && pendingConfirms.size > 0) {
-          for (const [id, resolve12] of pendingConfirms) {
-            resolve12("no");
+          for (const [id, resolve13] of pendingConfirms) {
+            resolve13("no");
             pendingConfirms.delete(id);
           }
         }
@@ -5553,6 +6791,7 @@ async function runWebUI(opts) {
         abortControllers.clear();
       },
       unsubscribeEvents: () => {
+        flushAllStreamBuffers();
         for (const unsub of eventUnsubscribers) unsub();
       },
       closeClients: () => {
@@ -5565,7 +6804,7 @@ async function runWebUI(opts) {
       wss,
       pid: process.pid,
       registryBaseDir,
-      onStopped: resolve11
+      onStopped: resolve12
     });
     registerWebuiSignalHandlers(signalShutdown);
   });
@@ -6005,6 +7244,16 @@ async function runWebUI(opts) {
       case "collab.request_pause":
       case "collab.resume":
         break;
+      // Integrated terminal — the CLI embedded server doesn't run a pty
+      // transport (it already has its own terminal); silently acknowledge
+      // and ignore so the browser client's terminal panel doesn't trip the
+      // "Unhandled message type" warning. The standalone webui server wires
+      // the real TerminalWebSocketHandler.
+      case "terminal.create":
+      case "terminal.input":
+      case "terminal.resize":
+      case "terminal.close":
+        break;
       case "projects.list": {
         await handleProjectsList(projectsCtx, ws);
         break;
@@ -6066,9 +7315,8 @@ async function runWebUI(opts) {
         break;
       // ── Mailbox operations — project-level inter-agent messaging ────
       case "mailbox.messages": {
-        const projectRoot = opts.projectRoot ?? opts.agent.ctx.projectRoot ?? "";
-        const globalRoot = opts.globalConfigPath ? path4.dirname(opts.globalConfigPath) : "";
-        if (!projectRoot || !globalRoot) {
+        const mb = getWebuiMailbox();
+        if (!mb) {
           send(ws, {
             type: "mailbox.messages",
             payload: { messages: [], error: "No project root available" }
@@ -6076,13 +7324,12 @@ async function runWebUI(opts) {
           break;
         }
         try {
-          const mbDir = resolveProjectDir(projectRoot, globalRoot);
-          const mb = new GlobalMailbox(mbDir);
           const payload = msg.payload;
           const messages = await mb.query({
             limit: payload?.limit ?? 30,
             to: payload?.agentId,
-            unreadBy: payload?.unreadOnly ? payload.agentId : void 0
+            unreadBy: payload?.unreadOnly ? payload.agentId : void 0,
+            incompleteOnly: payload?.incompleteOnly
           });
           send(ws, {
             type: "mailbox.messages",
@@ -6115,9 +7362,8 @@ async function runWebUI(opts) {
         break;
       }
       case "mailbox.agents": {
-        const projectRoot = opts.projectRoot ?? opts.agent.ctx.projectRoot ?? "";
-        const globalRoot = opts.globalConfigPath ? path4.dirname(opts.globalConfigPath) : "";
-        if (!projectRoot || !globalRoot) {
+        const mb = getWebuiMailbox();
+        if (!mb) {
           send(ws, {
             type: "mailbox.agents",
             payload: { agents: [], error: "No project root available" }
@@ -6125,8 +7371,6 @@ async function runWebUI(opts) {
           break;
         }
         try {
-          const mbDir = resolveProjectDir(projectRoot, globalRoot);
-          const mb = new GlobalMailbox(mbDir);
           const payload = msg.payload;
           const agents = payload?.onlineOnly ? await mb.getOnlineAgents() : await mb.getAgentStatuses();
           send(ws, {
@@ -6158,15 +7402,12 @@ async function runWebUI(opts) {
         break;
       }
       case "mailbox.clear": {
-        const projectRoot = opts.projectRoot ?? opts.agent.ctx.projectRoot ?? "";
-        const globalRoot = opts.globalConfigPath ? path4.dirname(opts.globalConfigPath) : "";
-        if (!projectRoot || !globalRoot) {
+        const mb = getWebuiMailbox();
+        if (!mb) {
           send(ws, { type: "mailbox.cleared", payload: { error: "No project root available" } });
           break;
         }
         try {
-          const mbDir = resolveProjectDir(projectRoot, globalRoot);
-          const mb = new GlobalMailbox(mbDir);
           await mb.clearAll();
           send(ws, { type: "mailbox.cleared", payload: {} });
         } catch (err) {
@@ -6178,15 +7419,12 @@ async function runWebUI(opts) {
         break;
       }
       case "mailbox.purge": {
-        const projectRoot = opts.projectRoot ?? opts.agent.ctx.projectRoot ?? "";
-        const globalRoot = opts.globalConfigPath ? path4.dirname(opts.globalConfigPath) : "";
-        if (!projectRoot || !globalRoot) {
+        const mb = getWebuiMailbox();
+        if (!mb) {
           send(ws, { type: "mailbox.purged", payload: { error: "No project root available" } });
           break;
         }
         try {
-          const mbDir = resolveProjectDir(projectRoot, globalRoot);
-          const mb = new GlobalMailbox(mbDir);
           const payload = msg;
           const result = await mb.purgeStale(payload.payload);
           send(ws, { type: "mailbox.purged", payload: result });
@@ -6223,6 +7461,7 @@ async function runWebUI(opts) {
   }
   function shutdown() {
     console.log("[WebUI] Shutting down...");
+    flushAllStreamBuffers();
     unregisterWebuiClient();
     httpServer?.server.close();
     opts.onExit?.();
@@ -6258,7 +7497,7 @@ init_provider_config_utils();
 var WORKTREE_PHASE_CONCURRENCY = 4;
 var MAX_CMD_OUTPUT = 2e5;
 function gitText(args, cwd) {
-  return new Promise((resolve11, reject) => {
+  return new Promise((resolve12, reject) => {
     let child;
     try {
       child = spawn("git", args, {
@@ -6278,8 +7517,8 @@ function gitText(args, cwd) {
     };
     child.stdout?.on("data", emit);
     child.stderr?.on("data", emit);
-    child.on("error", () => resolve11({ code: 1, out: chunks.join("") }));
-    child.on("close", (code) => resolve11({ code: code ?? 1, out: chunks.join("").trim() }));
+    child.on("error", () => resolve12({ code: 1, out: chunks.join("") }));
+    child.on("close", (code) => resolve12({ code: code ?? 1, out: chunks.join("").trim() }));
   });
 }
 async function isGitRepo(cwd) {
@@ -6315,7 +7554,7 @@ function runCmd(cmd, args, cwd, shell = false) {
       });
     }
   }
-  return new Promise((resolve11, reject) => {
+  return new Promise((resolve12, reject) => {
     const chunks = [];
     let child;
     try {
@@ -6338,11 +7577,11 @@ function runCmd(cmd, args, cwd, shell = false) {
     };
     child.stdout?.on("data", append);
     child.stderr?.on("data", append);
-    child.on("error", (e) => resolve11({ code: 1, out: `${chunks.join("")}${String(e)}` }));
+    child.on("error", (e) => resolve12({ code: 1, out: `${chunks.join("")}${String(e)}` }));
     child.on("close", (code) => {
       let out = chunks.join("");
       if (out.length > MAX_CMD_OUTPUT) out = out.slice(-MAX_CMD_OUTPUT);
-      resolve11({ code: code ?? 1, out: out.trim() });
+      resolve12({ code: code ?? 1, out: out.trim() });
     });
   });
 }
@@ -6698,7 +7937,8 @@ var BOOLEAN_FLAGS = /* @__PURE__ */ new Set([
   "skip-index",
   "mouse",
   "no-interactive",
-  "token-saving-mode"
+  "token-saving-mode",
+  "hq"
 ]);
 function parseArgs(argv) {
   const flags = {};
@@ -6849,31 +8089,31 @@ var ReadlineInputReader = class {
   async readLine(prompt) {
     if (this.history.length === 0) await this.loadHistory();
     while (this.pending) {
-      await new Promise((resolve11) => setTimeout(resolve11, 50));
+      await new Promise((resolve12) => setTimeout(resolve12, 50));
     }
     this.pending = true;
     try {
       if (this.rl) {
         const old = this.rl;
         this.rl = void 0;
-        await new Promise((resolve11) => {
+        await new Promise((resolve12) => {
           if (old.closed) {
-            resolve11();
+            resolve12();
           } else {
-            old.once("close", resolve11);
+            old.once("close", resolve12);
             old.close();
           }
         });
       }
       const fresh = this.ensure();
       this.installPromptGuard(fresh);
-      return new Promise((resolve11) => {
+      return new Promise((resolve12) => {
         let settled = false;
         const settle = (line) => {
           if (settled) return;
           settled = true;
           setOutputLineGuard(null);
-          resolve11(line);
+          resolve12(line);
         };
         fresh.question(prompt ?? "> ", (line) => {
           if (line.trim()) {
@@ -6926,7 +8166,7 @@ var ReadlineInputReader = class {
   async readKey(prompt, options) {
     setOutputLineGuard(null);
     writeOut(prompt);
-    return new Promise((resolve11) => {
+    return new Promise((resolve12) => {
       const stdin = process.stdin;
       const wasRaw = stdin.isRaw;
       const wasPaused = stdin.isPaused();
@@ -6937,7 +8177,7 @@ var ReadlineInputReader = class {
         if (key === "") {
           cleanup();
           writeOut("\n");
-          resolve11("");
+          resolve12("");
           return;
         }
         const opt = options.find(
@@ -6947,12 +8187,12 @@ var ReadlineInputReader = class {
           cleanup();
           writeOut(`${opt.key}
 `);
-          resolve11(opt.value);
+          resolve12(opt.value);
         }
       };
       const onClose = () => {
         cleanup();
-        resolve11("");
+        resolve12("");
       };
       const cleanup = () => {
         stdin.off("data", onData);
@@ -6981,7 +8221,7 @@ var ReadlineInputReader = class {
     this.rl?.close();
     this.rl = void 0;
     writeOut(prompt);
-    return new Promise((resolve11) => {
+    return new Promise((resolve12) => {
       let buf = "";
       const wasRaw = stdin.isRaw;
       setRawMode(stdin, true);
@@ -6999,7 +8239,7 @@ var ReadlineInputReader = class {
             cleanup();
             writeOut(`  ${dim(`[${buf.length} chars]`)}
 `);
-            resolve11(buf);
+            resolve12(buf);
             return;
           }
           if (ch === "") {
@@ -7194,8 +8434,8 @@ function printLaunchHints(renderer, flags, opts = {}) {
 var defaultUidFn = () => os__default.userInfo().uid;
 async function getFileUid(filePath) {
   try {
-    const stat7 = await fsp5.stat(filePath);
-    return stat7.uid;
+    const stat8 = await fsp5.stat(filePath);
+    return stat8.uid;
   } catch {
     return void 0;
   }
@@ -7530,11 +8770,11 @@ async function buildPickableProviders(modelsRegistry, config) {
 var theme = { primary: color.amber };
 async function saveToGlobalConfig(configPath2, provider, model, homeFn = () => process.env.HOME ?? os__default.homedir()) {
   try {
-    const { atomicWrite: atomicWrite16 } = await import('@wrongstack/core');
-    const fs38 = await import('fs/promises');
+    const { atomicWrite: atomicWrite15 } = await import('@wrongstack/core');
+    const fs36 = await import('fs/promises');
     let existing = {};
     try {
-      const raw = await fs38.readFile(configPath2, "utf8");
+      const raw = await fs36.readFile(configPath2, "utf8");
       existing = JSON.parse(raw);
     } catch {
     }
@@ -7553,7 +8793,7 @@ async function saveToGlobalConfig(configPath2, provider, model, homeFn = () => p
         })
       );
     }
-    await atomicWrite16(configPath2, JSON.stringify(existing, null, 2), { mode: 384 });
+    await atomicWrite15(configPath2, JSON.stringify(existing, null, 2), { mode: 384 });
     try {
       await appendHistory(
         oldCfg,
@@ -9220,7 +10460,7 @@ The following characters are not allowed: ; & | < > ^ $ , ( ) { } [ ] ! # % ' "
   }
 }
 function runCommand(cmd, cwd, timeout) {
-  return new Promise((resolve11) => {
+  return new Promise((resolve12) => {
     validateCommand(cmd);
     const opts = {
       cwd,
@@ -9233,7 +10473,7 @@ function runCommand(cmd, cwd, timeout) {
       shell: process.platform === "win32" ? true : false
     };
     execFile(cmd, [], opts, (error, stdout, stderr) => {
-      resolve11({
+      resolve12({
         stdout,
         stderr,
         exitCode: typeof error?.code === "number" ? error.code : 0,
@@ -9679,6 +10919,7 @@ function formatDelay(ms) {
 
 // src/settings-menu.ts
 function resolvePersistPath(deps) {
+  if (deps.forceGlobal) return deps.globalConfigPath;
   const scope = deps.configStore.get().configScope;
   if (scope === "project" && deps.inProjectConfigPath) {
     return deps.inProjectConfigPath;
@@ -12770,7 +14011,7 @@ function parseMcpArgs(args) {
 }
 async function runMcpManagementCommand(parsed, deps) {
   const { config, configPath: configPath2, mcpRegistry, allServerPresets } = deps;
-  const diskConfig = await readConfig(configPath2);
+  const diskConfig = await readJsonObjectFile(configPath2);
   const configured = isMcpServerRecord(diskConfig.mcpServers) ? diskConfig.mcpServers : config.mcpServers ?? {};
   switch (parsed.action) {
     case "list":
@@ -12835,13 +14076,10 @@ async function runAdd(name, enable, configured, configPath2, mcpRegistry, all) {
   }
   const existing = configured[name];
   const nextCfg = existing ? { ...preset, ...existing, enabled: enable } : { ...preset, enabled: enable };
-  const full = await readConfig(configPath2);
-  const mcpServers = {
-    ...isMcpServerRecord(full.mcpServers) ? full.mcpServers : {},
-    [name]: nextCfg
-  };
-  full.mcpServers = mcpServers;
-  await writeConfig(configPath2, full);
+  await updateJsonObjectFile(configPath2, (full) => {
+    const current = isMcpServerRecord(full.mcpServers) ? full.mcpServers : {};
+    setJsonPath(full, ["mcpServers", name], { ...current[name], ...nextCfg });
+  });
   if (!enable) {
     const verb = existing ? "Updated" : "Added (disabled \u2014 /mcp enable to start)";
     return `${color.green(verb)} "${name}" (${nextCfg.transport}). Config written to ${configPath2}.`;
@@ -12875,13 +14113,11 @@ async function runRemove(name, configured, configPath2, mcpRegistry) {
       })
     );
   }
-  const full = await readConfig(configPath2);
-  const mcpServers = {
-    ...full.mcpServers ?? {}
-  };
-  delete mcpServers[name];
-  full.mcpServers = mcpServers;
-  await writeConfig(configPath2, full);
+  await updateJsonObjectFile(configPath2, (full) => {
+    const current = isMcpServerRecord(full.mcpServers) ? full.mcpServers : configured;
+    setJsonPath(full, ["mcpServers"], { ...current });
+    removeJsonPath(full, ["mcpServers", name]);
+  });
   return `${color.yellow("Removed")} "${name}" from config.`;
 }
 async function runEnable(name, configured, configPath2, mcpRegistry) {
@@ -12896,13 +14132,10 @@ async function runEnable(name, configured, configPath2, mcpRegistry) {
       return `${color.green("Enabled")} "${name}" and started.`;
     }
   }
-  const full = await readConfig(configPath2);
-  const mcpServers = {
-    ...full.mcpServers ?? {}
-  };
-  mcpServers[name] = { ...cfg, ...mcpServers[name] ?? {}, enabled: true };
-  full.mcpServers = mcpServers;
-  await writeConfig(configPath2, full);
+  await updateJsonObjectFile(configPath2, (full) => {
+    const current = isMcpServerRecord(full.mcpServers) ? full.mcpServers : {};
+    setJsonPath(full, ["mcpServers", name], { ...cfg, ...current[name], enabled: true });
+  });
   try {
     await mcpRegistry.restart(name);
   } catch {
@@ -12927,13 +14160,10 @@ async function runDisable(name, configured, configPath2, mcpRegistry) {
       })
     );
   }
-  const full = await readConfig(configPath2);
-  const mcpServers = {
-    ...full.mcpServers ?? {}
-  };
-  mcpServers[name] = { ...cfg, ...mcpServers[name] ?? {}, enabled: false };
-  full.mcpServers = mcpServers;
-  await writeConfig(configPath2, full);
+  await updateJsonObjectFile(configPath2, (full) => {
+    const current = isMcpServerRecord(full.mcpServers) ? full.mcpServers : {};
+    setJsonPath(full, ["mcpServers", name], { ...cfg, ...current[name], enabled: false });
+  });
   return `${color.yellow("Disabled")} "${name}" and stopped.`;
 }
 async function runRestart(name, mcpRegistry) {
@@ -12964,22 +14194,9 @@ function stateBadge(state) {
       return color.dim(state);
   }
 }
-async function readConfig(path39) {
-  try {
-    return JSON.parse(await fsp5.readFile(path39, "utf8"));
-  } catch {
-    return {};
-  }
-}
 function isMcpServerRecord(value) {
   return !!value && typeof value === "object" && !Array.isArray(value);
 }
-async function writeConfig(path39, cfg) {
-  const raw = JSON.stringify(cfg, null, 2);
-  const tmp = path39 + ".tmp";
-  await fsp5.writeFile(tmp, raw, "utf8");
-  await fsp5.rename(tmp, path39);
-}
 
 // src/slash-commands/mcp.ts
 function buildMcpSlashCommand(opts) {
@@ -14335,12 +15552,12 @@ function buildLoadCommand(opts) {
           const badge = s.outcome === "completed" ? color.green("\u2713") : s.outcome === "aborted" ? color.yellow("\u26A0") : s.outcome === "error" ? color.red("\u2717") : color.dim("?");
           parts2.push(badge);
         }
-        const stat7 = parts2.join(" ");
+        const stat8 = parts2.join(" ");
         const date = color.dim(s.startedAt.slice(0, 16).replace("T", " "));
         const isCurrent = s.id === currentId;
         const marker = isCurrent ? color.cyan(" (current)") : "";
         return `  ${color.bold(s.id)}${marker}
-    ${date}  ${stat7}
+    ${date}  ${stat8}
     ${color.dim(s.title)}`;
       });
       const msg = [
@@ -15099,15 +16316,26 @@ function formatSuggestions(suggestions) {
 
 // src/slash-commands/coordinator.ts
 function buildCoordinatorCommand(opts) {
+  const getStart = () => opts.onCoordinatorStart ?? opts.coordinatorController?.onCoordinatorStart;
+  const getStop = () => opts.onCoordinatorStop ?? opts.coordinatorController?.onCoordinatorStop;
+  const getTasks = () => opts.onCoordinatorTasks ?? opts.coordinatorController?.onCoordinatorTasks;
+  const getClaim = () => opts.onCoordinatorClaim ?? opts.coordinatorController?.onCoordinatorClaim;
+  const getComplete = () => opts.onCoordinatorComplete ?? opts.coordinatorController?.onCoordinatorComplete;
+  const getFail = () => opts.onCoordinatorFail ?? opts.coordinatorController?.onCoordinatorFail;
+  const getStatus = () => opts.onCoordinatorStatus ?? opts.coordinatorController?.onCoordinatorStatus;
   return {
     name: "coordinator",
     category: "Agent",
     description: "Start, stop, or inspect the AutonomousCoordinator \u2014 the fleet brain that auctions tasks and consults Brain for risky decisions.",
     help: [
       "Usage:",
-      "  /coordinator start <goal>   Start the coordinator with a goal",
-      "  /coordinator stop           Stop the running coordinator",
-      "  /coordinator status         Show current coordinator status",
+      "  /coordinator start <goal>       Start the coordinator with a goal",
+      "  /coordinator stop               Stop the running coordinator",
+      "  /coordinator status             Show current coordinator status",
+      "  /coordinator tasks              List available tasks the current terminal can claim",
+      "  /coordinator claim <id>         Claim a task and inject its description as the next prompt",
+      "  /coordinator done <id> [note]   Mark a claimed task as completed",
+      "  /coordinator fail <id> <reason> Mark a claimed task as failed",
       "",
       "The AutonomousCoordinator runs alongside the agent loop and:",
       "  \u2022 Maintains a shared knowledge graph of facts and decisions",
@@ -15115,7 +16343,10 @@ function buildCoordinatorCommand(opts) {
       "  \u2022 Consults the Brain for risky decisions",
       "  \u2022 Uses ConsensusProtocol to vote on multi-agent changes",
       "",
-      "It is separate from /autonomy eternal \u2014 both can run concurrently."
+      "It is separate from /autonomy eternal \u2014 both can run concurrently.",
+      "",
+      "Terminals are eligible workers: an open terminal can discover and claim",
+      "pending tasks without spawning a subagent."
     ].join("\n"),
     async run(args) {
       const trimmed = args.trim();
@@ -15126,19 +16357,108 @@ function buildCoordinatorCommand(opts) {
         if (!goal) {
           return { message: "Usage: /coordinator start <goal>\nA goal is required to start the coordinator." };
         }
-        opts.onCoordinatorStart?.(goal);
+        getStart()?.(goal);
         return {
           message: `AutonomousCoordinator started with goal: "${goal}"
 Use /coordinator status to monitor progress.`
         };
       }
       if (verb === "stop") {
-        opts.onCoordinatorStop?.();
+        getStop()?.();
         return { message: "AutonomousCoordinator stop signal sent." };
       }
+      if (verb === "tasks") {
+        const tasksFn = getTasks();
+        if (!tasksFn) {
+          return { message: "Coordinator task listing is not wired in this surface." };
+        }
+        const tasks = await tasksFn();
+        if (!tasks) {
+          return { message: "No coordinator is active. Start one with /coordinator start <goal>." };
+        }
+        if (tasks.length === 0) {
+          return { message: "No pending coordinator tasks. Use /coordinator status for overall progress." };
+        }
+        const lines = ["Pending coordinator tasks available to claim:"];
+        for (const task of tasks) {
+          lines.push(`  ${task.id}  [${task.priority}] ${task.title}${task.tags.length > 0 ? `  \xB7 ${task.tags.join(", ")}` : ""}`);
+        }
+        lines.push("", "Claim one with /coordinator claim <id> (id prefix allowed).");
+        return { message: lines.join("\n") };
+      }
+      if (verb === "claim") {
+        const target = rest.join(" ").trim();
+        if (!target) {
+          return { message: "Usage: /coordinator claim <taskId>" };
+        }
+        const claimFn = getClaim();
+        if (!claimFn) {
+          return { message: "Coordinator task claiming is not wired in this surface." };
+        }
+        const tasks = await getTasks()?.();
+        const matched = tasks?.find((task) => task.id === target || task.id.startsWith(target));
+        if (!matched) {
+          return { message: `No pending coordinator task matched "${target}".` };
+        }
+        const result = await claimFn(matched.id);
+        if (typeof result === "string") return { message: result };
+        if (result === null) return { message: "No coordinator is active." };
+        const description = result.description ?? matched.title;
+        return {
+          message: `Claimed task ${matched.id.slice(0, 8)}: ${matched.title}`,
+          runText: `Work on this coordinator task (id: ${matched.id}):
+
+${description}`
+        };
+      }
+      if (verb === "done" || verb === "complete") {
+        const taskId = rest[0]?.trim() ?? "";
+        if (!taskId) {
+          return { message: "Usage: /coordinator done <taskId> [note]" };
+        }
+        const completeFn = getComplete();
+        if (!completeFn) {
+          return { message: "Coordinator task completion is not wired in this surface." };
+        }
+        const note = rest.slice(1).join(" ").trim();
+        const err = await completeFn(taskId, note || void 0);
+        if (err) return { message: err };
+        return { message: `Task ${taskId.slice(0, 8)} marked completed.` };
+      }
+      if (verb === "fail") {
+        const taskId = rest[0]?.trim() ?? "";
+        if (!taskId) {
+          return { message: "Usage: /coordinator fail <taskId> <reason>" };
+        }
+        const failFn = getFail();
+        if (!failFn) {
+          return { message: "Coordinator task failure reporting is not wired in this surface." };
+        }
+        const reason = rest.slice(1).join(" ").trim() || "Terminal worker reported failure";
+        const err = await failFn(taskId, reason);
+        if (err) return { message: err };
+        return { message: `Task ${taskId.slice(0, 8)} marked failed: ${reason}` };
+      }
       if (verb === "status") {
-        const canStart = opts.onCoordinatorStart != null;
-        const canStop = opts.onCoordinatorStop != null;
+        const statusFn = getStatus();
+        if (statusFn) {
+          const stats = await statusFn();
+          if (!stats) {
+            return { message: "No coordinator is active. Start one with /coordinator start <goal>." };
+          }
+          const lines = [
+            "Coordinator Status:",
+            `  Goals: ${stats.goals.total} total \xB7 ${stats.goals.done} done \xB7 ${stats.goals.pending} pending \xB7 ${stats.goals.failed} failed`,
+            `  DAG:   ${stats.dag.running} running \xB7 ${stats.dag.ready} ready \xB7 ${stats.dag.done} done \xB7 ${stats.dag.failed} failed`,
+            `  Auction: ${stats.auction.pending} pending \xB7 ${stats.auction.inProgress} in progress`
+          ];
+          if (stats.goals.pending > 0 || stats.auction.pending > 0) {
+            lines.push("", "Use /coordinator tasks to list claimable work.");
+          }
+          return { message: lines.join("\n") };
+        }
+        const canStart = getStart() != null;
+        const canStop = getStop() != null;
         return {
           message: [
             `Coordinator wired: start=${canStart ? "yes" : "no"}, stop=${canStop ? "yes" : "no"}`,
@@ -15149,9 +16469,13 @@ Use /coordinator status to monitor progress.`
       return {
         message: [
           "Usage:",
-          "  /coordinator start <goal>   Start with a goal",
-          "  /coordinator stop            Stop the coordinator",
-          "  /coordinator status          Show status",
+          "  /coordinator start <goal>       Start with a goal",
+          "  /coordinator stop               Stop the coordinator",
+          "  /coordinator status             Show status",
+          "  /coordinator tasks              List tasks this terminal can claim",
+          "  /coordinator claim <id>         Claim a task and inject its description",
+          "  /coordinator done <id> [note]   Mark a claimed task as completed",
+          "  /coordinator fail <id> <reason> Mark a claimed task as failed",
           "",
           "The coordinator is a fleet brain that:",
           "  \u2022 Auctions tasks to subagents via TaskAuctioneer",
@@ -15350,8 +16674,8 @@ async function addProjectCommand(opts, ctx, targetPath, displayName) {
   } catch {
     return { message: color.red(`Directory not found: ${resolved}`) };
   }
-  const stat7 = await fsp5.stat(resolved);
-  if (!stat7.isDirectory()) {
+  const stat8 = await fsp5.stat(resolved);
+  if (!stat8.isDirectory()) {
     return { message: color.red(`Not a directory: ${resolved}`) };
   }
   const manifest = await loadManifest(opts.paths?.globalConfig);
@@ -15420,8 +16744,8 @@ async function switchProjectCommand(opts, ctx, target, displayName) {
   } catch {
     return { message: color.red(`Directory not found: ${resolved}`) };
   }
-  const stat7 = await fsp5.stat(resolved);
-  if (!stat7.isDirectory()) {
+  const stat8 = await fsp5.stat(resolved);
+  if (!stat8.isDirectory()) {
     return { message: color.red(`Not a directory: ${resolved}`) };
   }
   let cliPath;
@@ -15677,7 +17001,7 @@ async function handlePrevSessions(opts, _ctx) {
   return { message: lines.join("\n") };
 }
 async function runGit(args, cwd) {
-  return new Promise((resolve11) => {
+  return new Promise((resolve12) => {
     const child = spawn("git", args, {
       cwd,
       stdio: ["ignore", "pipe", "pipe"],
@@ -15688,8 +17012,8 @@ async function runGit(args, cwd) {
     child.stdout?.on("data", (d) => {
       stdout += d;
     });
-    child.on("error", () => resolve11({ stdout, code: 1 }));
-    child.on("close", (code) => resolve11({ stdout, code: code ?? 0 }));
+    child.on("error", () => resolve12({ stdout, code: 1 }));
+    child.on("close", (code) => resolve12({ stdout, code: code ?? 0 }));
   });
 }
 async function getChangedFiles(cwd) {
@@ -15788,6 +17112,14 @@ function buildSettingsCommand(opts) {
     "  /settings token-saving off|minimal|light|medium|aggressive   Token-saving mode",
     "  /settings max-concurrent <n>   Max concurrent subagents (0 = unlimited)",
     "  /settings title-animation on|off   Terminal title animation",
+    "  /settings reasoning auto|on|off   Reasoning mode (auto = provider default)",
+    "  /settings reasoning-effort none|minimal|low|medium|high|xhigh|max   Reasoning effort",
+    "  /settings reasoning-preserve on|off   Preserve thinking across turns",
+    "  /settings cache-ttl 5m|1h   Prompt cache TTL (Anthropic)",
+    "  /settings hq on|off           Enable/disable HQ client publishing",
+    "  /settings hq-url <url>        HQ URL for remote clients (http://host:3499)",
+    "  /settings hq-token <token>    HQ client token for remote clients",
+    "  /settings hq-raw on|off       Send raw content previews to HQ",
     "  /settings defaults            Show built-in default values",
     "",
     "Settings are persisted to ~/.wrongstack/config.json."
@@ -15814,6 +17146,15 @@ function buildSettingsCommand(opts) {
     const features = opts.configStore.get().features;
     const tokenSavingTier = features?.tokenSavingMode ?? "off";
     const maxConcurrent = opts.configStore.get().maxConcurrent ?? 0;
+    const modelRuntime = opts.configStore.get().modelRuntime;
+    const reasoningMode = modelRuntime?.reasoning?.mode ?? "auto";
+    const reasoningEffort = modelRuntime?.reasoning?.effort ?? "(unset)";
+    const reasoningPreserve = modelRuntime?.reasoning?.preserve === true;
+    const cacheTtl = modelRuntime?.cache?.ttl ?? "default";
+    const hq = opts.configStore.get().hq;
+    const hqEnabled = hq?.enabled === true;
+    const hqUrl = hq?.url ?? "(auto/local)";
+    const hqToken = hq?.token ? `${hq.token.slice(0, 6)}\u2026${hq.token.slice(-4)} (${hq.token.length} chars)` : "(auto/local)";
     return [
       `${color.bold("WrongStack")} ${color.dim("\u2014 Settings")}`,
       "",
@@ -15833,6 +17174,14 @@ function buildSettingsCommand(opts) {
       `  context auto-compact: ${contextAutoCompact ? color.cyan("on") : color.dim("off")}   ${color.dim("change: /settings context-auto-compact on|off")}`,
       `  token-saving:       ${color.cyan(tokenSavingTier)}   ${color.dim("change: /settings token-saving off|minimal|light|medium|aggressive")}`,
       `  max-concurrent:     ${color.cyan(maxConcurrent === 0 ? "unlimited" : String(maxConcurrent))}   ${color.dim("change: /settings max-concurrent <n>")}`,
+      `  reasoning mode:     ${color.cyan(reasoningMode)}   ${color.dim("change: /settings reasoning auto|on|off")}`,
+      `  reasoning effort:   ${color.cyan(reasoningEffort)}   ${color.dim("change: /settings reasoning-effort <level>")}`,
+      `  reasoning preserve: ${reasoningPreserve ? color.cyan("on") : color.dim("off")}   ${color.dim("change: /settings reasoning-preserve on|off")}`,
+      `  cache TTL:          ${color.cyan(cacheTtl)}   ${color.dim("change: /settings cache-ttl 5m|1h")}`,
+      `  HQ publishing:     ${hqEnabled ? color.cyan("on") : color.dim("off")}   ${color.dim("change: /settings hq on|off")}`,
+      `  HQ URL:            ${color.cyan(hqUrl)}   ${color.dim("change: /settings hq-url <url>")}`,
+      `  HQ token:          ${color.cyan(hqToken)}   ${color.dim("change: /settings hq-token <token>")}`,
+      `  HQ raw content:    ${hq?.rawContent === true ? color.cyan("on") : color.dim("off")}   ${color.dim("change: /settings hq-raw on|off")}`,
       "",
       color.dim("  Persisted to ~/.wrongstack/config.json \xB7 /settings help for more")
     ].join("\n");
@@ -15876,6 +17225,60 @@ function buildSettingsCommand(opts) {
         vault: noOpVault
       };
       try {
+        if (sub === "hq") {
+          const raw = (rest[0] ?? "").toLowerCase();
+          if (!["on", "off"].includes(raw)) {
+            return { message: `${color.amber("Usage:")} /settings hq on|off` };
+          }
+          const on = raw === "on";
+          await persistConfigSetting({ ...persistDeps, forceGlobal: true }, (cfg) => {
+            const hq = cfg.hq ?? {};
+            hq.enabled = on;
+            cfg.hq = hq;
+          });
+          return { message: `${color.green("\u2713")} HQ publishing \u2192 ${on ? color.cyan("on") : color.dim("off")}` };
+        }
+        if (sub === "hq-url") {
+          const raw = rest.join(" ").trim();
+          if (!raw) return { message: `${color.amber("Usage:")} /settings hq-url <http://host:3499>` };
+          try {
+            const url = new URL(raw);
+            if (url.protocol !== "http:" && url.protocol !== "https:") throw new Error("bad protocol");
+          } catch {
+            return { message: `${color.red("Invalid URL")}: ${raw}` };
+          }
+          await persistConfigSetting({ ...persistDeps, forceGlobal: true }, (cfg) => {
+            const hq = cfg.hq ?? {};
+            hq.url = raw;
+            hq.enabled = true;
+            cfg.hq = hq;
+          });
+          return { message: `${color.green("\u2713")} HQ URL \u2192 ${color.cyan(raw)}` };
+        }
+        if (sub === "hq-token") {
+          const token = rest.join(" ").trim();
+          if (!token) return { message: `${color.amber("Usage:")} /settings hq-token <client-token>` };
+          await persistConfigSetting({ ...persistDeps, forceGlobal: true }, (cfg) => {
+            const hq = cfg.hq ?? {};
+            hq.token = token;
+            hq.enabled = true;
+            cfg.hq = hq;
+          });
+          return { message: `${color.green("\u2713")} HQ token saved ${color.dim("(global config)")}` };
+        }
+        if (sub === "hq-raw") {
+          const raw = (rest[0] ?? "").toLowerCase();
+          if (!["on", "off"].includes(raw)) {
+            return { message: `${color.amber("Usage:")} /settings hq-raw on|off` };
+          }
+          const on = raw === "on";
+          await persistConfigSetting({ ...persistDeps, forceGlobal: true }, (cfg) => {
+            const hq = cfg.hq ?? {};
+            hq.rawContent = on;
+            cfg.hq = hq;
+          });
+          return { message: `${color.green("\u2713")} HQ raw content \u2192 ${on ? color.cyan("on") : color.dim("off")}` };
+        }
         if (sub === "delay") {
           const raw = rest[0];
           if (raw === void 0) {
@@ -16155,8 +17558,65 @@ function buildSettingsCommand(opts) {
             message: `${color.green("\u2713")} title animation \u2192 ${on ? color.cyan("on") : color.dim("off")}   ${color.dim("terminal title animation")}`
           };
         }
+        if (sub === "reasoning") {
+          const raw = (rest[0] ?? "").toLowerCase();
+          const modes = ["auto", "on", "off"];
+          if (!modes.includes(raw)) {
+            return { message: `${color.amber("Usage:")} /settings reasoning auto|on|off` };
+          }
+          await persistConfigSetting(persistDeps, (cfg) => {
+            const mr = cfg.modelRuntime;
+            const reasoning = mr?.reasoning ?? {};
+            reasoning.mode = raw;
+            cfg.modelRuntime = { ...mr, reasoning };
+          });
+          return { message: `${color.green("\u2713")} reasoning mode \u2192 ${color.bold(raw)}` };
+        }
+        if (sub === "reasoning-effort") {
+          const raw = (rest[0] ?? "").toLowerCase();
+          const efforts = ["none", "minimal", "low", "medium", "high", "xhigh", "max"];
+          if (!efforts.includes(raw)) {
+            return {
+              message: `${color.amber("Usage:")} /settings reasoning-effort none|minimal|low|medium|high|xhigh|max`
+            };
+          }
+          await persistConfigSetting(persistDeps, (cfg) => {
+            const mr = cfg.modelRuntime;
+            const reasoning = mr?.reasoning ?? {};
+            reasoning.effort = raw;
+            cfg.modelRuntime = { ...mr, reasoning };
+          });
+          return { message: `${color.green("\u2713")} reasoning effort \u2192 ${color.bold(raw)}` };
+        }
+        if (sub === "reasoning-preserve") {
+          const raw = (rest[0] ?? "").toLowerCase();
+          if (!["on", "off"].includes(raw)) {
+            return { message: `${color.amber("Usage:")} /settings reasoning-preserve on|off` };
+          }
+          const on = raw === "on";
+          await persistConfigSetting(persistDeps, (cfg) => {
+            const mr = cfg.modelRuntime;
+            const reasoning = mr?.reasoning ?? {};
+            reasoning.preserve = on;
+            cfg.modelRuntime = { ...mr, reasoning };
+          });
+          return {
+            message: `${color.green("\u2713")} reasoning preserve \u2192 ${on ? color.cyan("on") : color.dim("off")}`
+          };
+        }
+        if (sub === "cache-ttl") {
+          const raw = (rest[0] ?? "").toLowerCase();
+          if (!["5m", "1h"].includes(raw)) {
+            return { message: `${color.amber("Usage:")} /settings cache-ttl 5m|1h` };
+          }
+          await persistConfigSetting(persistDeps, (cfg) => {
+            const mr = cfg.modelRuntime;
+            cfg.modelRuntime = { ...mr, cache: { ttl: raw } };
+          });
+          return { message: `${color.green("\u2713")} cache TTL \u2192 ${color.bold(raw)}` };
+        }
         return {
-          message: `${color.red("Unknown setting")} "${sub}". ${unknownSubcommand(sub, ["delay", "mode", "hints", "debug-stream", "config-scope", "fs-access", "refine", "refine-delay", "refine-language", "semver-part", "breaker", "breaker-timeout", "context-mode", "context-strategy", "context-auto-compact", "token-saving", "max-concurrent", "title-animation", "defaults"], "settings")}`
+          message: `${color.red("Unknown setting")} "${sub}". ${unknownSubcommand(sub, ["delay", "mode", "hints", "debug-stream", "config-scope", "fs-access", "refine", "refine-delay", "refine-language", "semver-part", "breaker", "breaker-timeout", "context-mode", "context-strategy", "context-auto-compact", "token-saving", "max-concurrent", "title-animation", "reasoning", "reasoning-effort", "reasoning-preserve", "cache-ttl", "defaults"], "settings")}`
         };
       } catch (err) {
         return {
@@ -17392,8 +18852,8 @@ function buildWorkingDirCommand(_opts) {
         };
       }
       try {
-        const stat7 = await fsp5.stat(resolved);
-        if (!stat7.isDirectory()) {
+        const stat8 = await fsp5.stat(resolved);
+        if (!stat8.isDirectory()) {
           return { message: color.red(`Not a directory: ${resolved}`) };
         }
       } catch {
@@ -17695,7 +19155,7 @@ async function runProjectCheck(opts) {
     if (answer2 === "y" || answer2 === "yes") {
       try {
         const { spawn: spawn9 } = await import('child_process');
-        await new Promise((resolve11, reject) => {
+        await new Promise((resolve12, reject) => {
           const child = spawn9("git", ["init"], {
             cwd,
             signal: AbortSignal.timeout(1e4),
@@ -17704,7 +19164,7 @@ async function runProjectCheck(opts) {
           child.on("error", reject);
           child.on(
             "close",
-            (code) => code === 0 ? resolve11() : reject(new Error(`git init failed with ${code}`))
+            (code) => code === 0 ? resolve12() : reject(new Error(`git init failed with ${code}`))
           );
         });
         renderer.write(`  ${color.green("\u2713")} Git repository initialized
@@ -18596,14 +20056,14 @@ var auditCmd = async (args, deps) => {
   return verify.ok ? 0 : 1;
 };
 async function listAudits(log, dir, deps) {
-  const fs38 = await import('fs/promises');
+  const fs36 = await import('fs/promises');
   const path39 = await import('path');
   const out = [];
   let foundRoot = true;
   const scan = async (scanDir, prefix, depth) => {
     let entries;
     try {
-      entries = await fs38.readdir(scanDir, { withFileTypes: true });
+      entries = await fs36.readdir(scanDir, { withFileTypes: true });
     } catch {
       if (depth === 0) foundRoot = false;
       return;
@@ -18769,7 +20229,7 @@ ${color.bold("WrongStack")} ${color.dim("\u2014 API key manager")}
   renderer.write(`    ${color.bold("c")}  Add a custom provider
 `);
   renderer.write(
-    `    ${color.bold("s")}  Sign in with a subscription ${color.dim("(ChatGPT / Claude / Copilot)")}
+    `    ${color.bold("s")}  Login with OAuth ${color.dim("(ChatGPT / Claude / Copilot)")}
 `
   );
   if (ids.length > 0) {
@@ -18865,341 +20325,78 @@ async function runAuthDirect(deps, opts) {
 
 // src/auth-menu/add-provider.ts
 init_provider_config_utils();
-async function addFromCatalog(deps) {
-  let catalog = [];
+
+// src/auth-menu/anthropic-oauth.ts
+init_provider_config_utils();
+var CLIENT_ID = "9d1c250a-e61b-44d9-88ed-5944d1962f5e";
+var AUTHORIZE_URL = "https://claude.ai/oauth/authorize";
+var TOKEN_URL = "https://platform.claude.com/v1/oauth/token";
+var REDIRECT_PORT = 53692;
+var REDIRECT_HOST = "127.0.0.1";
+var REDIRECT_PATH = "/callback";
+var REDIRECT_URI = `http://localhost:${REDIRECT_PORT}${REDIRECT_PATH}`;
+var SCOPES = "org:create_api_key user:profile user:inference user:sessions:claude_code user:mcp_servers user:file_upload";
+var CLAUDE_PROVIDER_ID = "anthropic-oauth";
+var CLAUDE_BASE_URL = "https://api.anthropic.com";
+function base64url(buf) {
+  return buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function generatePkce() {
+  const verifier = base64url(randomBytes(32));
+  const challenge = base64url(createHash("sha256").update(verifier).digest());
+  return { verifier, challenge };
+}
+function buildAuthorizeUrl(challenge, verifier) {
+  const params = new URLSearchParams({
+    code: "true",
+    client_id: CLIENT_ID,
+    response_type: "code",
+    redirect_uri: REDIRECT_URI,
+    scope: SCOPES,
+    code_challenge: challenge,
+    code_challenge_method: "S256",
+    state: verifier
+  });
+  return `${AUTHORIZE_URL}?${params.toString()}`;
+}
+function parseAuthorizationInput(input) {
+  const value = input.trim();
+  if (!value) return {};
   try {
-    catalog = (await deps.modelsRegistry.listProviders()).filter((p) => p.family !== "unsupported");
+    const url = new URL(value);
+    return {
+      code: url.searchParams.get("code") ?? void 0,
+      state: url.searchParams.get("state") ?? void 0
+    };
   } catch {
-    deps.renderer.writeWarning("Catalog unavailable \u2014 falling back to manual entry.\n");
-  }
-  if (catalog.length === 0) {
-    return addManualEntry(deps);
-  }
-  const saved = new Set(Object.keys(await loadProviders(deps)));
-  deps.renderer.write(
-    color.dim(
-      `  Catalog: ${catalog.length} providers. Filter to narrow, "s" for unsaved-only, or enter to show all.
-`
-    )
-  );
-  const filterRaw = (await deps.reader.readLine(
-    `  ${color.amber("?")} Filter ${color.dim('(substring / "s" / q to quit)')}: `
-  )).trim();
-  if (filterRaw === "q") return false;
-  const filterLc = filterRaw.toLowerCase();
-  const showUnsavedOnly = filterLc === "s" || filterLc === "unsaved";
-  function matches(p) {
-    if (showUnsavedOnly) return !saved.has(p.id);
-    if (!filterLc) return true;
-    return p.id.toLowerCase().includes(filterLc) || p.name.toLowerCase().includes(filterLc);
-  }
-  const byFamily = /* @__PURE__ */ new Map();
-  let filteredCount = 0;
-  for (const p of catalog) {
-    if (!matches(p)) continue;
-    filteredCount++;
-    const list = byFamily.get(p.family) ?? [];
-    list.push(p);
-    byFamily.set(p.family, list);
-  }
-  if (filteredCount === 0) {
-    deps.renderer.writeError(
-      `No providers match "${filterRaw}". Try a shorter substring or check \`wstack providers\`.`
-    );
-    return false;
   }
-  if (filterRaw && !showUnsavedOnly) {
-    deps.renderer.write(
-      color.dim(`  ${filteredCount} match${filteredCount === 1 ? "" : "es"} for "${filterRaw}".
-`)
-    );
+  if (value.includes("#")) {
+    const [code, state] = value.split("#", 2);
+    return { code, state };
   }
-  const ordered = [];
-  const familyOrder = ["anthropic", "openai", "google", "openai-compatible"];
-  let idx = 1;
-  deps.renderer.write("\n");
-  for (const fam of familyOrder) {
-    const list = byFamily.get(fam);
-    if (!list || list.length === 0) continue;
-    deps.renderer.write(`  ${color.bold(fam)}
-`);
-    for (const p of list) {
-      const savedMark = saved.has(p.id) ? color.cyan("\u25C9") : color.dim("\u25CB");
-      const env = p.envVars[0] ? color.dim(`[${p.envVars[0]}]`) : "";
-      deps.renderer.write(
-        `    ${color.dim(`${idx}.`.padStart(4))} ${savedMark} ${p.id.padEnd(22)} ${color.dim(p.name)} ${env}
-`
-      );
-      ordered.push(p);
-      idx++;
-    }
+  if (value.includes("code=")) {
+    const params = new URLSearchParams(value);
+    return {
+      code: params.get("code") ?? void 0,
+      state: params.get("state") ?? void 0
+    };
   }
-  deps.renderer.write(`
-  ${color.dim("\u25C9 already saved   \u25CB no key yet")}
-`);
-  const answer = (await deps.reader.readLine(
-    `
-${color.amber("?")} Pick (1-${ordered.length}) or type provider id ${color.dim("[q to quit]")}: `
-  )).trim();
-  if (!answer || answer === "q") return false;
-  let chosen;
-  const num = Number.parseInt(answer, 10);
-  if (!Number.isNaN(num) && num >= 1 && num <= ordered.length) {
-    chosen = ordered[num - 1];
-  } else {
-    chosen = ordered.find((p) => p.id.toLowerCase() === answer.toLowerCase()) ?? catalog.find((p) => p.id.toLowerCase() === answer.toLowerCase());
+  return { code: value };
+}
+async function readTokens(res, op) {
+  if (!res.ok) {
+    const text = await res.text().catch(() => "");
+    throw new Error(`Claude token ${op} failed (${res.status}): ${text || res.statusText}`);
   }
-  if (!chosen) {
-    deps.renderer.writeError(`No such provider: "${answer}"`);
-    return false;
+  const json = await res.json();
+  if (!json?.access_token || !json.refresh_token || typeof json.expires_in !== "number") {
+    throw new Error(`Claude token ${op} response missing fields`);
   }
-  return addKeyForCatalogProvider(deps, chosen);
-}
-async function addKeyForCatalogProvider(deps, chosen) {
-  deps.renderer.write(
-    color.dim(`
-  Defaults from models.dev \u2014 press Enter to keep, or type overrides.
-`)
-  );
-  const famRaw = (await deps.reader.readLine(
-    `  ${color.amber("?")} Family ${color.dim(`[${chosen.family}]`)} ${color.dim("(q to quit)")}: `
-  )).trim();
-  if (famRaw === "q") return false;
-  let family = chosen.family;
-  if (famRaw) {
-    const validated = validateFamily(famRaw);
-    if (!validated) {
-      deps.renderer.writeError(
-        `Invalid family: "${famRaw}" (must be: anthropic, openai, openai-compatible, google).`
-      );
-      return false;
-    }
-    family = validated;
-  }
-  const baseRaw = (await deps.reader.readLine(
-    `  ${color.amber("?")} Base URL ${color.dim(`[${chosen.apiBase ?? "unset"}]`)} ${color.dim("(q to quit)")}: `
-  )).trim();
-  if (baseRaw === "q") return false;
-  const baseUrl = baseRaw || chosen.apiBase;
-  const providersNow = await loadProviders(deps);
-  let suggestedAlias = chosen.id;
-  if (family !== chosen.family) {
-    let candidate = `${chosen.id}-${family}`;
-    let n = 2;
-    while (providersNow[candidate]) {
-      candidate = `${chosen.id}-${family}-${n}`;
-      n++;
-    }
-    suggestedAlias = candidate;
-  }
-  const aliasRaw = (await deps.reader.readLine(
-    `  ${color.amber("?")} Save as alias ${color.dim(`[${suggestedAlias}]`)} ${color.dim("(used with --provider <alias>)")}: `
-  )).trim();
-  const alias = aliasRaw || suggestedAlias;
-  const existing = providersNow[alias];
-  if (existing) {
-    const sameFamily = (existing.family ?? chosen.family) === family;
-    const sameBase = (existing.baseUrl ?? chosen.apiBase) === baseUrl;
-    if (!sameFamily || !sameBase) {
-      deps.renderer.writeError(
-        `Alias "${alias}" already exists with different family/baseUrl.
-  Existing: family=${existing.family ?? "(unset)"}, baseUrl=${existing.baseUrl ?? "(unset)"}
-  New:      family=${family}, baseUrl=${baseUrl ?? "(unset)"}
-  Pick a different alias to keep them separate.`
-      );
-      return false;
-    }
-  }
-  return addKeyForProvider(alias, deps, {
-    type: chosen.id,
-    family,
-    baseUrl,
-    envVars: chosen.envVars
-  });
-}
-async function addCustomProvider(deps) {
-  deps.renderer.write(
-    `
-${color.bold("Custom provider")} ${color.dim("\u2014 for local models or proxies not in the catalog.")}
-`
-  );
-  const type = (await deps.reader.readLine(
-    `  ${color.amber("?")} Provider id ${color.dim('(e.g. "local-llama", "my-proxy", q to quit)')}: `
-  )).trim();
-  if (!type || type === "q") return false;
-  const existing = (await loadProviders(deps))[type];
-  if (existing) {
-    deps.renderer.writeWarning(`"${type}" already exists. Pick it from the main menu to edit.`);
-    return false;
-  }
-  const familyRaw = (await deps.reader.readLine(
-    `  ${color.amber("?")} Wire family ${color.dim("(anthropic | openai | openai-compatible | google)")} ${color.dim("(q to quit)")}: `
-  )).trim();
-  if (familyRaw === "q") return false;
-  const family = validateFamily(familyRaw);
-  if (!family) {
-    deps.renderer.writeError(`Invalid family: "${familyRaw}"`);
-    return false;
-  }
-  const baseUrl = (await deps.reader.readLine(
-    `  ${color.amber("?")} Base URL ${color.dim("(e.g. http://localhost:11434/v1, optional)")}: `
-  )).trim();
-  const modelsRaw = (await deps.reader.readLine(
-    `  ${color.amber("?")} Model ids ${color.dim("(comma-separated, optional)")}: `
-  )).trim();
-  const models = modelsRaw ? modelsRaw.split(",").map((s) => s.trim()).filter(Boolean) : void 0;
-  const envVarsRaw = (await deps.reader.readLine(
-    `  ${color.amber("?")} Env var names ${color.dim("(comma-separated, optional)")}: `
-  )).trim();
-  const envVars = envVarsRaw ? envVarsRaw.split(",").map((s) => s.trim()).filter(Boolean) : void 0;
-  return addKeyForProvider(type, deps, {
-    type,
-    family,
-    ...baseUrl ? { baseUrl } : {},
-    ...models ? { models } : {},
-    ...envVars ? { envVars } : {}
-  });
-}
-async function addManualEntry(deps) {
-  const pid = (await deps.reader.readLine(`  ${color.amber("?")} Provider id ${color.dim("[q to quit]")}: `)).trim();
-  if (!pid || pid === "q") return false;
-  const famRaw = (await deps.reader.readLine(
-    `  ${color.amber("?")} Family ${color.dim("(anthropic/openai/openai-compatible/google)")}: `
-  )).trim();
-  const family = validateFamily(famRaw);
-  if (!family) {
-    deps.renderer.writeError(`Invalid family: "${famRaw}"`);
-    return false;
-  }
-  const baseUrl = (await deps.reader.readLine(`  ${color.amber("?")} Base URL ${color.dim("(optional)")}: `)).trim();
-  return addKeyForProvider(pid, deps, {
-    type: pid,
-    family,
-    ...baseUrl ? { baseUrl } : {}
-  });
-}
-async function addKeyForProvider(providerId, deps, template) {
-  const providers = await loadProviders(deps);
-  const existing = providers[providerId];
-  const existingKeys = existing ? normalizeKeys(existing) : [];
-  const usedLabels = new Set(existingKeys.map((k) => k.label));
-  const label = await promptForLabel(deps, usedLabels);
-  if (!label) return false;
-  const apiKey = await readKeyInput(deps, `API key for ${providerId}/${label}`);
-  if (!apiKey) return false;
-  await mutateConfigProviders(deps.globalConfigPath, deps.vault, (all) => {
-    const existingProv = all[providerId] ?? {
-      type: providerId,
-      ...template
-    };
-    if (!existingProv.type) existingProv.type = providerId;
-    if (!existingProv.family && template.family) {
-      existingProv.family = template.family;
-    }
-    if (!existingProv.baseUrl && template.baseUrl) {
-      existingProv.baseUrl = template.baseUrl;
-    }
-    if (!existingProv.envVars && template.envVars) {
-      existingProv.envVars = template.envVars;
-    }
-    const list = normalizeKeys(existingProv);
-    list.push({ label, apiKey, createdAt: nowIso() });
-    writeKeysBack(existingProv, list);
-    if (!existingProv.activeKey) existingProv.activeKey = label;
-    all[providerId] = existingProv;
-  });
-  deps.renderer.write(
-    `  ${color.green("\u2713")} Saved ${color.bold(providerId)}/${color.bold(label)}.
-`
-  );
-  deps.renderer.write(color.dim(`  Launch: wstack --provider ${providerId} "<task>"
-`));
-  return true;
-}
-async function promptForLabel(deps, usedLabels) {
-  const defaultLabel = suggestLabel(usedLabels);
-  const labelRaw = (await deps.reader.readLine(
-    `  ${color.amber("?")} Label for this key ${color.dim(`[${defaultLabel}]`)}: `
-  )).trim();
-  const label = labelRaw || defaultLabel;
-  if (usedLabels.has(label)) {
-    deps.renderer.writeError(`Label "${label}" is already used. Use update (u) instead.`);
-    return null;
-  }
-  return label;
-}
-
-// src/auth-menu/anthropic-oauth.ts
-init_provider_config_utils();
-var CLIENT_ID = "9d1c250a-e61b-44d9-88ed-5944d1962f5e";
-var AUTHORIZE_URL = "https://claude.ai/oauth/authorize";
-var TOKEN_URL = "https://platform.claude.com/v1/oauth/token";
-var REDIRECT_PORT = 53692;
-var REDIRECT_HOST = "127.0.0.1";
-var REDIRECT_PATH = "/callback";
-var REDIRECT_URI = `http://localhost:${REDIRECT_PORT}${REDIRECT_PATH}`;
-var SCOPES = "org:create_api_key user:profile user:inference user:sessions:claude_code user:mcp_servers user:file_upload";
-var CLAUDE_PROVIDER_ID = "anthropic-oauth";
-var CLAUDE_BASE_URL = "https://api.anthropic.com";
-function base64url(buf) {
-  return buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-}
-function generatePkce() {
-  const verifier = base64url(randomBytes(32));
-  const challenge = base64url(createHash("sha256").update(verifier).digest());
-  return { verifier, challenge };
-}
-function buildAuthorizeUrl(challenge, verifier) {
-  const params = new URLSearchParams({
-    code: "true",
-    client_id: CLIENT_ID,
-    response_type: "code",
-    redirect_uri: REDIRECT_URI,
-    scope: SCOPES,
-    code_challenge: challenge,
-    code_challenge_method: "S256",
-    state: verifier
-  });
-  return `${AUTHORIZE_URL}?${params.toString()}`;
-}
-function parseAuthorizationInput(input) {
-  const value = input.trim();
-  if (!value) return {};
-  try {
-    const url = new URL(value);
-    return {
-      code: url.searchParams.get("code") ?? void 0,
-      state: url.searchParams.get("state") ?? void 0
-    };
-  } catch {
-  }
-  if (value.includes("#")) {
-    const [code, state] = value.split("#", 2);
-    return { code, state };
-  }
-  if (value.includes("code=")) {
-    const params = new URLSearchParams(value);
-    return {
-      code: params.get("code") ?? void 0,
-      state: params.get("state") ?? void 0
-    };
-  }
-  return { code: value };
-}
-async function readTokens(res, op) {
-  if (!res.ok) {
-    const text = await res.text().catch(() => "");
-    throw new Error(`Claude token ${op} failed (${res.status}): ${text || res.statusText}`);
-  }
-  const json = await res.json();
-  if (!json?.access_token || !json.refresh_token || typeof json.expires_in !== "number") {
-    throw new Error(`Claude token ${op} response missing fields`);
-  }
-  return {
-    access: json.access_token,
-    refresh: json.refresh_token,
-    expires: Date.now() + json.expires_in * 1e3
-  };
+  return {
+    access: json.access_token,
+    refresh: json.refresh_token,
+    expires: Date.now() + json.expires_in * 1e3
+  };
 }
 async function exchangeAuthorizationCode(code, state, verifier, signal) {
   const res = await fetch(TOKEN_URL, {
@@ -19243,12 +20440,12 @@ function callbackHtml(ok, message) {
 function startLoopbackServer(expectedState) {
   let resolveCode = () => {
   };
-  const codePromise = new Promise((resolve11) => {
+  const codePromise = new Promise((resolve12) => {
     let settled = false;
     resolveCode = (v) => {
       if (settled) return;
       settled = true;
-      resolve11(v);
+      resolve12(v);
     };
   });
   const server = createServer((req2, res) => {
@@ -19291,10 +20488,10 @@ function startLoopbackServer(expectedState) {
     res.end(callbackHtml(true, "You can close this window and return to the terminal."));
     resolveCode({ code, state });
   });
-  return new Promise((resolve11) => {
+  return new Promise((resolve12) => {
     server.on("error", () => {
       resolveCode(null);
-      resolve11({
+      resolve12({
         bound: false,
         waitForCode: () => Promise.resolve(null),
         close: () => {
@@ -19306,7 +20503,7 @@ function startLoopbackServer(expectedState) {
       });
     });
     server.listen(REDIRECT_PORT, REDIRECT_HOST, () => {
-      resolve11({
+      resolve12({
         bound: true,
         waitForCode: () => codePromise,
         close: () => {
@@ -19465,9 +20662,9 @@ function openBrowser2(url) {
   }
 }
 function sleep(ms, signal) {
-  return new Promise((resolve11, reject) => {
+  return new Promise((resolve12, reject) => {
     if (signal.aborted) return reject(new DOMException("Aborted", "AbortError"));
-    const t = setTimeout(resolve11, ms);
+    const t = setTimeout(resolve12, ms);
     signal.addEventListener(
       "abort",
       () => {
@@ -19745,12 +20942,12 @@ function callbackHtml2(ok, message) {
 function startLoopbackServer2(state) {
   let resolveCode = () => {
   };
-  const codePromise = new Promise((resolve11) => {
+  const codePromise = new Promise((resolve12) => {
     let settled = false;
     resolveCode = (v) => {
       if (settled) return;
       settled = true;
-      resolve11(v);
+      resolve12(v);
     };
   });
   const server = createServer((req2, res) => {
@@ -19792,10 +20989,10 @@ function startLoopbackServer2(state) {
     res.end(callbackHtml2(true, "You can close this window and return to the terminal."));
     resolveCode(code);
   });
-  return new Promise((resolve11) => {
+  return new Promise((resolve12) => {
     server.on("error", () => {
       resolveCode(null);
-      resolve11({
+      resolve12({
         bound: false,
         waitForCode: () => Promise.resolve(null),
         close: () => {
@@ -19807,7 +21004,7 @@ function startLoopbackServer2(state) {
       });
     });
     server.listen(REDIRECT_PORT2, REDIRECT_HOST2, () => {
-      resolve11({
+      resolve12({
         bound: true,
         waitForCode: () => codePromise,
         close: () => {
@@ -19967,6 +21164,316 @@ async function saveCodexTokens(deps, providerId, tokens, accountId) {
   }
 }
 
+// src/auth-menu/oauth-menu.ts
+function renderOAuthLoginOptions(deps, indent = "    ") {
+  deps.renderer.write(
+    `${indent}${color.bold("OAuth login options")} ${color.dim("(subscription sign-in)")}
+${indent}${color.bold("chatgpt")}  ChatGPT Plus/Pro  ${color.dim("(\u2192 openai-codex)")}
+${indent}${color.bold("claude")}   Claude Pro/Max    ${color.dim("(\u2192 anthropic-oauth)")}
+${indent}${color.bold("copilot")}  GitHub Copilot    ${color.dim("(\u2192 github-copilot)")}
+`
+  );
+}
+async function runOAuthLoginChoice(deps, choice, opts = {}) {
+  const pick = choice.trim().toLowerCase();
+  const allowNumeric = opts.allowNumeric ?? true;
+  if (allowNumeric && pick === "1" || pick === "chatgpt" || pick === "openai" || pick === "codex") {
+    await runCodexOAuthLogin(deps);
+    return true;
+  }
+  if (allowNumeric && pick === "2" || pick === "claude" || pick === "anthropic") {
+    await runClaudeOAuthLogin(deps);
+    return true;
+  }
+  if (allowNumeric && pick === "3" || pick === "copilot" || pick === "github" || pick === "github-copilot") {
+    await runCopilotOAuthLogin(deps);
+    return true;
+  }
+  return false;
+}
+async function runOAuthLoginMenu(deps) {
+  deps.renderer.write(
+    `
+  ${color.bold("Login with OAuth:")}
+` + color.amber("  \u26A0 Subscription tokens used outside official clients may violate provider\n") + color.amber("    Terms \u2014 your account could be rate-limited or banned. An API key is the\n") + color.dim("    sanctioned path for programmatic use.\n") + `    ${color.bold("1")}  ChatGPT Plus/Pro  ${color.dim("(\u2192 openai-codex)")}
+    ${color.bold("2")}  Claude Pro/Max    ${color.dim("(\u2192 anthropic-oauth)")}
+    ${color.bold("3")}  GitHub Copilot    ${color.dim("(\u2192 github-copilot)")}
+`
+  );
+  const pick = await deps.reader.readLine(`  ${color.amber("?")} Pick ${color.dim("(or b to go back)")}: `);
+  await runOAuthLoginChoice(deps, pick);
+}
+
+// src/auth-menu/add-provider.ts
+async function addFromCatalog(deps) {
+  let catalog = [];
+  try {
+    catalog = (await deps.modelsRegistry.listProviders()).filter((p) => p.family !== "unsupported");
+  } catch {
+    deps.renderer.writeWarning("Catalog unavailable \u2014 falling back to manual entry.\n");
+  }
+  if (catalog.length === 0) {
+    return addManualEntry(deps);
+  }
+  const saved = new Set(Object.keys(await loadProviders(deps)));
+  deps.renderer.write(
+    color.dim(
+      `  Catalog: ${catalog.length} providers. Filter to narrow, "s" for unsaved-only, or enter to show all.
+`
+    )
+  );
+  const filterRaw = (await deps.reader.readLine(
+    `  ${color.amber("?")} Filter ${color.dim('(substring / "s" / q to quit)')}: `
+  )).trim();
+  if (filterRaw === "q") return false;
+  const filterLc = filterRaw.toLowerCase();
+  const showUnsavedOnly = filterLc === "s" || filterLc === "unsaved";
+  function matches(p) {
+    if (showUnsavedOnly) return !saved.has(p.id);
+    if (!filterLc) return true;
+    return p.id.toLowerCase().includes(filterLc) || p.name.toLowerCase().includes(filterLc);
+  }
+  const byFamily = /* @__PURE__ */ new Map();
+  let filteredCount = 0;
+  for (const p of catalog) {
+    if (!matches(p)) continue;
+    filteredCount++;
+    const list = byFamily.get(p.family) ?? [];
+    list.push(p);
+    byFamily.set(p.family, list);
+  }
+  if (filteredCount === 0) {
+    deps.renderer.writeError(
+      `No providers match "${filterRaw}". Try a shorter substring or check \`wstack providers\`.`
+    );
+    return false;
+  }
+  if (filterRaw && !showUnsavedOnly) {
+    deps.renderer.write(
+      color.dim(`  ${filteredCount} match${filteredCount === 1 ? "" : "es"} for "${filterRaw}".
+`)
+    );
+  }
+  renderOAuthLoginOptions(deps);
+  deps.renderer.write("\n");
+  const ordered = [];
+  const familyOrder = ["anthropic", "openai", "google", "openai-compatible"];
+  let idx = 1;
+  deps.renderer.write("\n");
+  for (const fam of familyOrder) {
+    const list = byFamily.get(fam);
+    if (!list || list.length === 0) continue;
+    deps.renderer.write(`  ${color.bold(fam)}
+`);
+    for (const p of list) {
+      const savedMark = saved.has(p.id) ? color.cyan("\u25C9") : color.dim("\u25CB");
+      const env = p.envVars[0] ? color.dim(`[${p.envVars[0]}]`) : "";
+      deps.renderer.write(
+        `    ${color.dim(`${idx}.`.padStart(4))} ${savedMark} ${p.id.padEnd(22)} ${color.dim(p.name)} ${env}
+`
+      );
+      ordered.push(p);
+      idx++;
+    }
+  }
+  deps.renderer.write(`
+  ${color.dim("\u25C9 already saved   \u25CB no key yet")}
+`);
+  const answer = (await deps.reader.readLine(
+    `
+${color.amber("?")} Pick (1-${ordered.length}), type provider id, or OAuth option ${color.dim("[chatgpt/claude/copilot, q to quit]")}: `
+  )).trim();
+  if (!answer || answer === "q") return false;
+  if (await runOAuthLoginChoice(deps, answer, { allowNumeric: false })) {
+    return true;
+  }
+  let chosen;
+  const num = Number.parseInt(answer, 10);
+  if (!Number.isNaN(num) && num >= 1 && num <= ordered.length) {
+    chosen = ordered[num - 1];
+  } else {
+    chosen = ordered.find((p) => p.id.toLowerCase() === answer.toLowerCase()) ?? catalog.find((p) => p.id.toLowerCase() === answer.toLowerCase());
+  }
+  if (!chosen) {
+    deps.renderer.writeError(`No such provider: "${answer}"`);
+    return false;
+  }
+  return addKeyForCatalogProvider(deps, chosen);
+}
+async function addKeyForCatalogProvider(deps, chosen) {
+  deps.renderer.write(
+    color.dim(`
+  Defaults from models.dev \u2014 press Enter to keep, or type overrides.
+`)
+  );
+  const famRaw = (await deps.reader.readLine(
+    `  ${color.amber("?")} Family ${color.dim(`[${chosen.family}]`)} ${color.dim("(q to quit)")}: `
+  )).trim();
+  if (famRaw === "q") return false;
+  let family = chosen.family;
+  if (famRaw) {
+    const validated = validateFamily(famRaw);
+    if (!validated) {
+      deps.renderer.writeError(
+        `Invalid family: "${famRaw}" (must be: anthropic, openai, openai-compatible, google).`
+      );
+      return false;
+    }
+    family = validated;
+  }
+  const baseRaw = (await deps.reader.readLine(
+    `  ${color.amber("?")} Base URL ${color.dim(`[${chosen.apiBase ?? "unset"}]`)} ${color.dim("(q to quit)")}: `
+  )).trim();
+  if (baseRaw === "q") return false;
+  const baseUrl = baseRaw || chosen.apiBase;
+  const providersNow = await loadProviders(deps);
+  let suggestedAlias = chosen.id;
+  if (family !== chosen.family) {
+    let candidate = `${chosen.id}-${family}`;
+    let n = 2;
+    while (providersNow[candidate]) {
+      candidate = `${chosen.id}-${family}-${n}`;
+      n++;
+    }
+    suggestedAlias = candidate;
+  }
+  const aliasRaw = (await deps.reader.readLine(
+    `  ${color.amber("?")} Save as alias ${color.dim(`[${suggestedAlias}]`)} ${color.dim("(used with --provider <alias>)")}: `
+  )).trim();
+  const alias = aliasRaw || suggestedAlias;
+  const existing = providersNow[alias];
+  if (existing) {
+    const sameFamily = (existing.family ?? chosen.family) === family;
+    const sameBase = (existing.baseUrl ?? chosen.apiBase) === baseUrl;
+    if (!sameFamily || !sameBase) {
+      deps.renderer.writeError(
+        `Alias "${alias}" already exists with different family/baseUrl.
+  Existing: family=${existing.family ?? "(unset)"}, baseUrl=${existing.baseUrl ?? "(unset)"}
+  New:      family=${family}, baseUrl=${baseUrl ?? "(unset)"}
+  Pick a different alias to keep them separate.`
+      );
+      return false;
+    }
+  }
+  return addKeyForProvider(alias, deps, {
+    type: chosen.id,
+    family,
+    baseUrl,
+    envVars: chosen.envVars
+  });
+}
+async function addCustomProvider(deps) {
+  deps.renderer.write(
+    `
+${color.bold("Custom provider")} ${color.dim("\u2014 for local models or proxies not in the catalog.")}
+`
+  );
+  const type = (await deps.reader.readLine(
+    `  ${color.amber("?")} Provider id ${color.dim('(e.g. "local-llama", "my-proxy", q to quit)')}: `
+  )).trim();
+  if (!type || type === "q") return false;
+  const existing = (await loadProviders(deps))[type];
+  if (existing) {
+    deps.renderer.writeWarning(`"${type}" already exists. Pick it from the main menu to edit.`);
+    return false;
+  }
+  const familyRaw = (await deps.reader.readLine(
+    `  ${color.amber("?")} Wire family ${color.dim("(anthropic | openai | openai-compatible | google)")} ${color.dim("(q to quit)")}: `
+  )).trim();
+  if (familyRaw === "q") return false;
+  const family = validateFamily(familyRaw);
+  if (!family) {
+    deps.renderer.writeError(`Invalid family: "${familyRaw}"`);
+    return false;
+  }
+  const baseUrl = (await deps.reader.readLine(
+    `  ${color.amber("?")} Base URL ${color.dim("(e.g. http://localhost:11434/v1, optional)")}: `
+  )).trim();
+  const modelsRaw = (await deps.reader.readLine(
+    `  ${color.amber("?")} Model ids ${color.dim("(comma-separated, optional)")}: `
+  )).trim();
+  const models = modelsRaw ? modelsRaw.split(",").map((s) => s.trim()).filter(Boolean) : void 0;
+  const envVarsRaw = (await deps.reader.readLine(
+    `  ${color.amber("?")} Env var names ${color.dim("(comma-separated, optional)")}: `
+  )).trim();
+  const envVars = envVarsRaw ? envVarsRaw.split(",").map((s) => s.trim()).filter(Boolean) : void 0;
+  return addKeyForProvider(type, deps, {
+    type,
+    family,
+    ...baseUrl ? { baseUrl } : {},
+    ...models ? { models } : {},
+    ...envVars ? { envVars } : {}
+  });
+}
+async function addManualEntry(deps) {
+  const pid = (await deps.reader.readLine(`  ${color.amber("?")} Provider id ${color.dim("[q to quit]")}: `)).trim();
+  if (!pid || pid === "q") return false;
+  const famRaw = (await deps.reader.readLine(
+    `  ${color.amber("?")} Family ${color.dim("(anthropic/openai/openai-compatible/google)")}: `
+  )).trim();
+  const family = validateFamily(famRaw);
+  if (!family) {
+    deps.renderer.writeError(`Invalid family: "${famRaw}"`);
+    return false;
+  }
+  const baseUrl = (await deps.reader.readLine(`  ${color.amber("?")} Base URL ${color.dim("(optional)")}: `)).trim();
+  return addKeyForProvider(pid, deps, {
+    type: pid,
+    family,
+    ...baseUrl ? { baseUrl } : {}
+  });
+}
+async function addKeyForProvider(providerId, deps, template) {
+  const providers = await loadProviders(deps);
+  const existing = providers[providerId];
+  const existingKeys = existing ? normalizeKeys(existing) : [];
+  const usedLabels = new Set(existingKeys.map((k) => k.label));
+  const label = await promptForLabel(deps, usedLabels);
+  if (!label) return false;
+  const apiKey = await readKeyInput(deps, `API key for ${providerId}/${label}`);
+  if (!apiKey) return false;
+  await mutateConfigProviders(deps.globalConfigPath, deps.vault, (all) => {
+    const existingProv = all[providerId] ?? {
+      type: providerId,
+      ...template
+    };
+    if (!existingProv.type) existingProv.type = providerId;
+    if (!existingProv.family && template.family) {
+      existingProv.family = template.family;
+    }
+    if (!existingProv.baseUrl && template.baseUrl) {
+      existingProv.baseUrl = template.baseUrl;
+    }
+    if (!existingProv.envVars && template.envVars) {
+      existingProv.envVars = template.envVars;
+    }
+    const list = normalizeKeys(existingProv);
+    list.push({ label, apiKey, createdAt: nowIso() });
+    writeKeysBack(existingProv, list);
+    if (!existingProv.activeKey) existingProv.activeKey = label;
+    all[providerId] = existingProv;
+  });
+  deps.renderer.write(
+    `  ${color.green("\u2713")} Saved ${color.bold(providerId)}/${color.bold(label)}.
+`
+  );
+  deps.renderer.write(color.dim(`  Launch: wstack --provider ${providerId} "<task>"
+`));
+  return true;
+}
+async function promptForLabel(deps, usedLabels) {
+  const defaultLabel = suggestLabel(usedLabels);
+  const labelRaw = (await deps.reader.readLine(
+    `  ${color.amber("?")} Label for this key ${color.dim(`[${defaultLabel}]`)}: `
+  )).trim();
+  const label = labelRaw || defaultLabel;
+  if (usedLabels.has(label)) {
+    deps.renderer.writeError(`Label "${label}" is already used. Use update (u) instead.`);
+    return null;
+  }
+  return label;
+}
+
 // src/auth-menu/provider-menu.ts
 init_provider_config_utils();
 async function manageProvider(providerId, deps) {
@@ -20142,24 +21649,6 @@ function validKeyIndex(arg, max, deps, verb) {
 }
 
 // src/auth-menu/top-menu.ts
-async function runSignInMenu(deps) {
-  deps.renderer.write(
-    `
-  ${color.bold("Sign in with a subscription:")}
-` + color.amber("  \u26A0 Subscription tokens used outside official clients may violate provider\n") + color.amber("    Terms \u2014 your account could be rate-limited or banned. An API key is the\n") + color.dim("    sanctioned path for programmatic use.\n") + `    ${color.bold("1")}  ChatGPT Plus/Pro  ${color.dim("(\u2192 openai-codex)")}
-    ${color.bold("2")}  Claude Pro/Max    ${color.dim("(\u2192 anthropic-oauth)")}
-    ${color.bold("3")}  GitHub Copilot    ${color.dim("(\u2192 github-copilot)")}
-`
-  );
-  const pick = (await deps.reader.readLine(`  ${color.amber("?")} Pick ${color.dim("(or b to go back)")}: `)).trim().toLowerCase();
-  if (pick === "1" || pick === "chatgpt" || pick === "openai" || pick === "codex") {
-    await runCodexOAuthLogin(deps);
-  } else if (pick === "2" || pick === "claude" || pick === "anthropic") {
-    await runClaudeOAuthLogin(deps);
-  } else if (pick === "3" || pick === "copilot" || pick === "github") {
-    await runCopilotOAuthLogin(deps);
-  }
-}
 async function runTopMenu(deps) {
   for (; ; ) {
     const providers = await loadProviders(deps);
@@ -20179,8 +21668,8 @@ ${color.amber("?")} Pick: `)).trim().toLowerCase();
       await addCustomProvider(deps);
       continue;
     }
-    if (choice === "s" || choice === "signin" || choice === "login") {
-      await runSignInMenu(deps);
+    if (choice === "s" || choice === "signin" || choice === "login" || choice === "oauth") {
+      await runOAuthLoginMenu(deps);
       continue;
     }
     const idx = Number.parseInt(choice, 10);
@@ -20843,6 +22332,262 @@ var exportCmd = async (args, deps) => {
   }
   return 0;
 };
+function resolveDataDir(deps) {
+  const override = typeof deps.flags?.["data-dir"] === "string" ? deps.flags["data-dir"] : void 0;
+  return resolveHqDataDir(override);
+}
+var hqCmd = async (args, deps) => {
+  const sub = args[0];
+  if (!sub || sub === "serve") {
+    return startServer(deps);
+  }
+  if (sub === "token") {
+    return hqTokenCmd(args.slice(1), deps);
+  }
+  if (sub === "help" || sub === "--help") {
+    printHelp(deps);
+    return 0;
+  }
+  deps.renderer.writeError(`Unknown hq subcommand: ${sub}
+`);
+  printHelp(deps);
+  return 1;
+};
+async function startServer(deps) {
+  const { startHqServer: startHqServer2 } = await Promise.resolve().then(() => (init_hq_server(), hq_server_exports));
+  const dataDir = resolveDataDir(deps);
+  const flags = deps.flags ?? {};
+  const host = typeof flags["host"] === "string" ? flags["host"] : "127.0.0.1";
+  const port = typeof flags["port"] === "string" ? Number.parseInt(flags["port"], 10) : 3499;
+  const strictPort = flags["strict-port"] === true;
+  const open = flags["open"] === true;
+  const handle = await startHqServer2({ host, port, strictPort, dataDir });
+  if (open) {
+    try {
+      const { openBrowser: openBrowser5 } = await import('@wrongstack/webui/server');
+      openBrowser5(handle.firstRunSetup?.browserUrl ?? `http://${handle.host}:${handle.port}`);
+    } catch {
+    }
+  }
+  writeStartupInfo(deps, handle);
+  await new Promise((resolve12) => {
+    const shutdown = () => {
+      void handle.close().then(() => resolve12());
+    };
+    process.on("SIGINT", shutdown);
+    process.on("SIGTERM", shutdown);
+  });
+  return 0;
+}
+function writeStartupInfo(deps, handle) {
+  deps.renderer.write(`WrongStack HQ listening on http://${handle.host}:${handle.port}
+`);
+  if (!handle.firstRunSetup) {
+    deps.renderer.write(`Client endpoint:  ws://${handle.host}:${handle.port}/ws/client
+`);
+    deps.renderer.write(`Browser endpoint: http://${handle.host}:${handle.port}
+`);
+    return;
+  }
+  deps.renderer.write(`Browser endpoint: ${handle.firstRunSetup.browserUrl}
+`);
+  deps.renderer.write(`Client endpoint:  ws://${handle.host}:${handle.port}/ws/client?token=${handle.firstRunSetup.clientEnv.WRONGSTACK_HQ_TOKEN}
+`);
+  deps.renderer.write(`
+First-run HQ auth created in ${handle.firstRunSetup.dataDir}
+`);
+  deps.renderer.write(`Start clients with:
+`);
+  deps.renderer.write(`  WRONGSTACK_HQ_URL=${handle.firstRunSetup.clientEnv.WRONGSTACK_HQ_URL}
+`);
+  deps.renderer.write(`  WRONGSTACK_HQ_TOKEN=${handle.firstRunSetup.clientEnv.WRONGSTACK_HQ_TOKEN}
+`);
+}
+async function hqTokenCmd(args, deps) {
+  const action = args[0];
+  if (action === "create") {
+    return tokenCreate(args.slice(1), deps);
+  }
+  if (action === "list" || action === "ls" || !action) {
+    return tokenList(args.slice(1), deps);
+  }
+  if (action === "revoke" || action === "rm" || action === "remove") {
+    return tokenRevoke(args.slice(1), deps);
+  }
+  deps.renderer.writeError(`Unknown hq token subcommand: ${action ?? "(none)"}
+`);
+  deps.renderer.write("Usage: wstack hq token <create|list|revoke>\n");
+  return 1;
+}
+function resolveTokenScope(args) {
+  return args.some((a) => a === "--client" || a === "-c") ? "client" : "browser";
+}
+function positionals(args) {
+  return args.filter((a) => !a.startsWith("-"));
+}
+async function tokenCreate(args, deps) {
+  const scope = resolveTokenScope(args);
+  const pos = positionals(args);
+  const label = pos[0];
+  const dataDir = resolveDataDir(deps);
+  const tokenField = scope === "client" ? "clientTokens" : "browserTokens";
+  try {
+    const next = await mutateHqAuthFile(
+      dataDir,
+      (current) => {
+        const tokens = current[tokenField] ?? [];
+        const newToken = mintHqToken(label);
+        return {
+          ...current,
+          [tokenField]: [...tokens, newToken]
+        };
+      },
+      { warn: (msg) => deps.renderer.writeWarning(`${msg}
+`) }
+    );
+    const list = next[tokenField] ?? [];
+    const token = expectDefined(list[list.length - 1]);
+    const endpoint = scope === "client" ? "/ws/client" : "/ws/browser";
+    deps.renderer.write(`Created ${scope} token.
+`);
+    deps.renderer.write(`  id:         ${token.id}
+`);
+    if (token.label) deps.renderer.write(`  label:      ${token.label}
+`);
+    deps.renderer.write(`  token:      ${token.token}
+`);
+    deps.renderer.write(`  createdAt:  ${token.createdAt}
+`);
+    deps.renderer.write(`
+`);
+    deps.renderer.write(`Connect with: ws://localhost:3499${endpoint}?token=${token.token}
+`);
+    deps.renderer.write(`(Copy the token now \u2014 it will not be shown again in full.)
+`);
+    return 0;
+  } catch (err) {
+    deps.renderer.writeError(`Failed to write auth.json: ${err.message}
+`);
+    return 1;
+  }
+}
+async function tokenList(args, deps) {
+  const scope = resolveTokenScope(args);
+  const dataDir = resolveDataDir(deps);
+  const tokenField = scope === "client" ? "clientTokens" : "browserTokens";
+  const authFile = await readHqAuthFile(dataDir, {
+    warn: (msg) => deps.renderer.writeWarning(`${msg}
+`)
+  });
+  const tokens = authFile[tokenField] ?? [];
+  if (tokens.length === 0) {
+    deps.renderer.write(`No ${scope} tokens issued. ${scope === "browser" ? "Browsers" : "Clients"} are in OPEN MODE.
+`);
+    deps.renderer.write(`Run \`wstack hq token create ${scope === "client" ? "--client " : ""}[label]\` to enter TOKEN MODE.
+`);
+    return 0;
+  }
+  deps.renderer.write(`${scope === "client" ? "Client" : "Browser"} tokens (${tokens.length}) \u2014 TOKEN MODE:
+`);
+  deps.renderer.write("\n");
+  for (const t of tokens) {
+    const masked = `${t.token.slice(0, 6)}\u2026${t.token.slice(-4)} (${t.token.length} chars)`;
+    deps.renderer.write(`  ${t.id}  ${masked}  ${t.createdAt}${t.label ? `  "${t.label}"` : ""}${t.lastUsedAt ? `  lastUsed ${t.lastUsedAt}` : ""}
+`);
+  }
+  deps.renderer.write("\n");
+  deps.renderer.write(`${scope === "client" ? "Clients" : "Browsers"} must append ?token=<full-token> to /ws/${scope}.
+`);
+  return 0;
+}
+async function tokenRevoke(args, deps) {
+  const scope = resolveTokenScope(args);
+  const pos = positionals(args);
+  const idPrefix = pos[0];
+  if (!idPrefix) {
+    deps.renderer.writeError(`Usage: wstack hq token revoke ${scope === "client" ? "--client " : ""}<id-prefix>
+`);
+    return 1;
+  }
+  const dataDir = resolveDataDir(deps);
+  const tokenField = scope === "client" ? "clientTokens" : "browserTokens";
+  let revoked;
+  try {
+    await mutateHqAuthFile(
+      dataDir,
+      (current) => {
+        const tokens = current[tokenField] ?? [];
+        const matches = tokens.filter((t) => t.id.startsWith(idPrefix));
+        if (matches.length === 0) {
+          revoked = void 0;
+          return current;
+        }
+        if (matches.length > 1) {
+          revoked = matches[0];
+          return current;
+        }
+        revoked = matches[0];
+        return {
+          ...current,
+          [tokenField]: tokens.filter((t) => t.id !== revoked.id)
+        };
+      },
+      { warn: (msg) => deps.renderer.writeWarning(`${msg}
+`) }
+    );
+  } catch (err) {
+    deps.renderer.writeError(`Failed to write auth.json: ${err.message}
+`);
+    return 1;
+  }
+  if (!revoked) {
+    deps.renderer.writeError(`No ${scope} token found matching id-prefix "${idPrefix}".
+`);
+    return 1;
+  }
+  deps.renderer.write(`Revoked ${scope} token ${revoked.id}${revoked.label ? ` ("${revoked.label}")` : ""}.
+`);
+  return 0;
+}
+function printHelp(deps) {
+  deps.renderer.write(`Usage: wstack hq <serve | token>
+`);
+  deps.renderer.write("\n");
+  deps.renderer.write(`  wstack hq                      Start the HQ command center server.
+`);
+  deps.renderer.write(`  wstack hq serve                Same as above (explicit form).
+`);
+  deps.renderer.write(`  wstack hq token create [label] Mint a browser token, enter token mode.
+`);
+  deps.renderer.write(`  wstack hq token create --client [label]  Mint a client token (/ws/client).
+`);
+  deps.renderer.write(`  wstack hq token list           List issued browser tokens.
+`);
+  deps.renderer.write(`  wstack hq token list --client   List issued client tokens.
+`);
+  deps.renderer.write(`  wstack hq token revoke <id>    Revoke a browser token (id prefix match).
+`);
+  deps.renderer.write(`  wstack hq token revoke --client <id>  Revoke a client token.
+`);
+  deps.renderer.write("\n");
+  deps.renderer.write(`Flags (apply to all subcommands):
+`);
+  deps.renderer.write(`  --data-dir <path>   Override HQ data directory (default ~/.wrongstack/hq).
+`);
+  deps.renderer.write(`  --host <ip>         Bind host (default 127.0.0.1).
+`);
+  deps.renderer.write(`  --port <n>          Bind port (default 3499).
+`);
+  deps.renderer.write(`  --strict-port       Fail if port is in use.
+`);
+  deps.renderer.write(`  --open              Open the dashboard in the default browser.
+`);
+  deps.renderer.write(`  --client, -c        Operate on client tokens instead of browser tokens.
+`);
+  deps.renderer.write("\n");
+  deps.renderer.write(`auth.json schema version: ${HQ_AUTH_FILE_VERSION}.
+`);
+}
 var initCmd = async (_args, deps) => {
   deps.renderer.write(color.bold("WrongStack init (deprecated)\n"));
   deps.renderer.write(
@@ -20999,8 +22744,8 @@ async function serveMcpStdio(deps) {
     log(
       `wrongstack MCP server ready at ${handle2.url} \u2014 exposing ${allowed.length} tool(s) (${mode})${token ? " [token auth]" : ""}.`
     );
-    await new Promise((resolve11) => {
-      const stop = () => resolve11();
+    await new Promise((resolve12) => {
+      const stop = () => resolve12();
       process.once("SIGINT", stop);
       process.once("SIGTERM", stop);
     });
@@ -21085,18 +22830,14 @@ async function addMcpServer(args, deps) {
   }
   const serverCfg = { ...factory };
   serverCfg.enabled = enable;
-  let existing = {};
-  try {
-    existing = JSON.parse(await fsp5.readFile(deps.paths.globalConfig, "utf8"));
-  } catch {
-  }
-  const mcpServers = existing.mcpServers ?? {};
+  const existing = await readJsonObjectFile(deps.paths.globalConfig);
+  const mcpServers = isRecord(existing.mcpServers) ? existing.mcpServers : {};
   if (mcpServers[name])
     deps.renderer.writeWarning(`Server "${name}" already in config. Updating.
 `);
-  mcpServers[name] = serverCfg;
-  existing.mcpServers = mcpServers;
-  await atomicWrite(deps.paths.globalConfig, JSON.stringify(existing, null, 2), { mode: 384 });
+  await updateJsonObjectFile(deps.paths.globalConfig, (config) => {
+    setJsonPath(config, ["mcpServers", name], serverCfg);
+  });
   const verb = enable ? "Enabled" : "Added (disabled \u2014 set enabled:true to activate)";
   deps.renderer.writeInfo(
     `${verb} "${name}" (${serverCfg.transport}). Config written to ${deps.paths.globalConfig}.
@@ -21105,26 +22846,27 @@ async function addMcpServer(args, deps) {
   return 0;
 }
 async function removeMcpServer(name, deps) {
-  let existing = {};
-  try {
-    existing = JSON.parse(await fsp5.readFile(deps.paths.globalConfig, "utf8"));
-  } catch {
+  if (!await jsonObjectFileExists(deps.paths.globalConfig)) {
     deps.renderer.writeError("No config file found.\n");
     return 1;
   }
-  const mcpServers = existing.mcpServers ?? {};
+  const existing = await readJsonObjectFile(deps.paths.globalConfig);
+  const mcpServers = isRecord(existing.mcpServers) ? existing.mcpServers : {};
   if (!mcpServers[name]) {
     deps.renderer.writeError(`Server "${name}" not in config.
 `);
     return 1;
   }
-  delete mcpServers[name];
-  existing.mcpServers = mcpServers;
-  await atomicWrite(deps.paths.globalConfig, JSON.stringify(existing, null, 2), { mode: 384 });
+  await updateJsonObjectFile(deps.paths.globalConfig, (config) => {
+    removeJsonPath(config, ["mcpServers", name]);
+  });
   deps.renderer.writeInfo(`Removed "${name}" from config.
 `);
   return 0;
 }
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
 var MODEL_PROFILES = [
   {
     provider: "anthropic",
@@ -22130,7 +23872,7 @@ function renderConfiguredPlugins(config) {
     return `  ${`${name}${suffix}`.padEnd(44)} ${enabled}`;
   }).join("\n");
 }
-async function readConfig2(file) {
+async function readConfig(file) {
   try {
     return JSON.parse(await fsp5.readFile(file, "utf8"));
   } catch {
@@ -22149,15 +23891,15 @@ function officialPluginState(config, spec) {
   return typeof match === "object" && match.enabled === false ? "disabled" : "enabled";
 }
 async function upsertPlugin(spec, opts, deps, verb) {
-  const existing = await readConfig2(deps.configPath);
+  const existing = await readConfig(deps.configPath);
   const plugins = Array.isArray(existing.plugins) ? existing.plugins : [];
   const idx = plugins.findIndex((p) => pluginName(p) === spec);
   const nextEntry = pluginEntry(spec, opts.enabled);
   if (idx >= 0) plugins[idx] = nextEntry;
   else plugins.push(nextEntry);
   const features = {
-    ...isRecord(deps.config.features) ? deps.config.features : {},
-    ...isRecord(existing.features) ? existing.features : {},
+    ...isRecord2(deps.config.features) ? deps.config.features : {},
+    ...isRecord2(existing.features) ? existing.features : {},
     plugins: true
   };
   existing.plugins = plugins;
@@ -22172,7 +23914,7 @@ async function upsertPlugin(spec, opts, deps, verb) {
   };
 }
 async function removePlugin(spec, deps) {
-  const existing = await readConfig2(deps.configPath);
+  const existing = await readConfig(deps.configPath);
   const plugins = Array.isArray(existing.plugins) ? existing.plugins : [];
   const next = plugins.filter((p) => pluginName(p) !== spec);
   if (next.length === plugins.length) {
@@ -22191,7 +23933,7 @@ async function removePlugin(spec, deps) {
 function errorResult(message) {
   return { code: 1, level: "error", message };
 }
-function isRecord(value) {
+function isRecord2(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
 
@@ -22317,7 +24059,7 @@ function parseFlags2(args) {
   }
   return flags;
 }
-function positionals(args) {
+function positionals2(args) {
   const out = [];
   for (let i = 0; i < args.length; i++) {
     const a = expectDefined(args[i]);
@@ -22335,11 +24077,17 @@ function positionals(args) {
   return out;
 }
 var DEFAULT_PER_PAGE = 15;
+function fmtPrice3(usdPer1M) {
+  if (usdPer1M === void 0) return color.dim("?");
+  const value = usdPer1M >= 10 ? usdPer1M.toFixed(1) : usdPer1M.toFixed(2);
+  return "$" + value;
+}
 var modelsCmd = async (args, deps) => {
   const sub = args[0];
   if (sub === "add") return modelsAdd(args.slice(1), deps);
   if (sub === "remove") return modelsRemove(args.slice(1), deps);
   if (sub === "list") return modelsList(args.slice(1), deps);
+  if (sub === "caps" || sub === "capabilities") return modelsCaps(args.slice(1), deps);
   if (sub === "refresh") {
     deps.renderer.writeInfo("Refreshing models.dev cache\u2026");
     try {
@@ -22442,6 +24190,51 @@ ${navLines.join(" \xB7 ")}
   );
   return 0;
 };
+async function modelsCaps(args, deps) {
+  const providerId = args[0] ?? deps.config.provider;
+  const modelId = args[1] ?? deps.config.model;
+  if (!providerId || !modelId) {
+    deps.renderer.writeError("Usage: wstack models caps [provider] [model]");
+    deps.renderer.write(color.dim("Defaults to current configured provider/model when omitted.\n"));
+    return 1;
+  }
+  const resolved = await deps.modelsRegistry.getModel(providerId, modelId);
+  if (!resolved) {
+    deps.renderer.writeError("Model not found in catalog: " + providerId + "/" + modelId);
+    deps.renderer.write(color.dim("Run `wstack models refresh` or add a custom model if this is expected.\n"));
+    return 1;
+  }
+  const caps = resolved.capabilities;
+  const flags = [
+    caps.tools ? "tools" : void 0,
+    caps.vision ? "vision" : void 0,
+    caps.reasoning ? "reasoning" : void 0
+  ].filter((v) => v !== void 0);
+  const rc = caps.reasoningConfig;
+  const cost = resolved.cost;
+  deps.renderer.write(color.bold("Model capabilities") + " " + color.dim(providerId + "/" + modelId) + "\n");
+  deps.renderer.write("  context:      " + (caps.maxContext ? color.yellow(String(caps.maxContext)) : color.dim("?")) + "\n");
+  if (caps.maxOutput !== void 0) {
+    deps.renderer.write("  max output:   " + color.yellow(String(caps.maxOutput)) + "\n");
+  }
+  if (caps.knowledge) deps.renderer.write("  knowledge:    " + caps.knowledge + "\n");
+  deps.renderer.write("  flags:        " + (flags.length > 0 ? flags.join(", ") : color.dim("(none)")) + "\n");
+  deps.renderer.write("  pricing/1M:   input " + fmtPrice3(cost?.input) + "  output " + fmtPrice3(cost?.output) + "  cacheR " + fmtPrice3(cost?.cache_read) + "\n");
+  if (cost?.cache_write !== void 0 || cost?.cache_write_5m !== void 0 || cost?.cache_write_1h !== void 0) {
+    const cacheWrite1h = cost.cache_write_1h ?? (cost.input !== void 0 ? cost.input * 2 : void 0);
+    deps.renderer.write("  cache write:  default " + fmtPrice3(cost.cache_write) + "  5m " + fmtPrice3(cost.cache_write_5m ?? cost.cache_write) + "  1h " + fmtPrice3(cacheWrite1h) + "\n");
+  }
+  if (rc) {
+    deps.renderer.write("  reasoning:\n");
+    deps.renderer.write("    default:    " + rc.default + "\n");
+    deps.renderer.write("    disable:    " + (rc.disableSupported ? "supported" : "unsupported") + "\n");
+    deps.renderer.write("    effort:     " + (rc.effortSupported ? rc.effortLevels.join(", ") : "unsupported") + "\n");
+    deps.renderer.write("    preserve:   " + rc.preserveThinking + "\n");
+  } else if (caps.reasoning) {
+    deps.renderer.write(color.dim("  reasoning:    supported, but no detailed config in catalog\n"));
+  }
+  return 0;
+}
 async function mutateModelsConfig(deps, mutator) {
   const vault = deps.vault;
   const configPath2 = deps.paths.globalConfig;
@@ -22491,7 +24284,7 @@ function parseBoolFlag(flags, key) {
 }
 async function modelsAdd(args, deps) {
   const flags = parseFlags2(args);
-  const pos = positionals(args);
+  const pos = positionals2(args);
   const modelId = pos[0];
   if (!modelId) {
     deps.renderer.writeError(
@@ -22831,13 +24624,13 @@ async function listFleetRuns(deps) {
   const runs = [];
   for (const id of entries) {
     const runDir = path4.join(deps.paths.projectSessions, id);
-    let stat7;
+    let stat8;
     try {
-      stat7 = await fsp5.stat(runDir);
+      stat8 = await fsp5.stat(runDir);
     } catch {
       continue;
     }
-    if (!stat7.isDirectory()) continue;
+    if (!stat8.isDirectory()) continue;
     let manifest = false;
     let checkpoint = false;
     let subagentCount = 0;
@@ -22881,15 +24674,15 @@ async function listFleetRuns(deps) {
 }
 async function showFleetRun(runId, deps) {
   const runDir = path4.join(deps.paths.projectSessions, runId);
-  let stat7;
+  let stat8;
   try {
-    stat7 = await fsp5.stat(runDir);
+    stat8 = await fsp5.stat(runDir);
   } catch {
     deps.renderer.writeError(`Fleet run not found: ${runId}
 `);
     return 1;
   }
-  if (!stat7.isDirectory()) {
+  if (!stat8.isDirectory()) {
     deps.renderer.writeError(`Not a directory: ${runId}
 `);
     return 1;
@@ -23175,7 +24968,7 @@ var updateCmd = async (args, deps) => {
   deps.renderer.write(`Updating wrongstack from v${info.current} to v${info.latest}...
 `);
   try {
-    const result = await new Promise((resolve11, reject) => {
+    const result = await new Promise((resolve12, reject) => {
       const npmCommand = process.platform === "win32" ? "npm.cmd" : "npm";
       const child = spawn(npmCommand, ["install", "-g", "wrongstack@latest"], {
         cwd,
@@ -23188,7 +24981,7 @@ var updateCmd = async (args, deps) => {
         _stderr += d;
       });
       child.on("error", reject);
-      child.on("close", (code) => resolve11({ code: code ?? 0 }));
+      child.on("close", (code) => resolve12({ code: code ?? 0 }));
     });
     if (result.code === 0) {
       deps.renderer.write(
@@ -23300,7 +25093,8 @@ var subcommands = {
   projects: projectsCmd,
   modeldiag: modeldiagCmd,
   quick: quickCmd,
-  bench: benchCmd
+  bench: benchCmd,
+  hq: hqCmd
 };
 
 // src/boot.ts
@@ -23674,7 +25468,7 @@ async function checkGitInCwd(opts) {
     if (answer === "y" || answer === "yes") {
       try {
         const { spawn: spawn9 } = await import('child_process');
-        await new Promise((resolve11, reject) => {
+        await new Promise((resolve12, reject) => {
           const child = spawn9("git", ["init"], {
             cwd,
             signal: AbortSignal.timeout(1e4),
@@ -23683,7 +25477,7 @@ async function checkGitInCwd(opts) {
           child.on("error", reject);
           child.on(
             "close",
-            (code) => code === 0 ? resolve11() : reject(new Error(`git init failed with ${code}`))
+            (code) => code === 0 ? resolve12() : reject(new Error(`git init failed with ${code}`))
           );
         });
         renderer.write(`  ${color.green("\u2713")} Git repository initialized
@@ -24434,7 +26228,9 @@ async function runRepl(opts) {
   const replProjectRoot = opts.projectRoot ?? process.cwd();
   const projectDir = resolveProjectDir(replProjectRoot, wstackGlobalRoot());
   const clientId = `repl@${crypto3.randomUUID().slice(0, 8)}`;
-  const clientMailbox = new GlobalMailbox(projectDir);
+  const hqPublisher = createHqPublisherFromEnv({ clientKind: "repl", projectRoot: replProjectRoot, projectName: path4.basename(replProjectRoot), appConfig: opts.appConfig });
+  hqPublisher?.connect();
+  const clientMailbox = new GlobalMailbox(projectDir, void 0, hqPublisher);
   let clientHeartbeat;
   clientMailbox.registerClient({
     clientId,
@@ -24507,7 +26303,7 @@ async function runRepl(opts) {
               `[eternal] ${toErrorMessage(err)}`
             );
           }
-          await new Promise((resolve11) => setTimeout(resolve11, 250));
+          await new Promise((resolve12) => setTimeout(resolve12, 250));
           continue;
         }
       } else if (opts.getAutonomy?.() === "eternal-parallel") {
@@ -24583,7 +26379,7 @@ async function runRepl(opts) {
               `[parallel] ${toErrorMessage(err)}`
             );
           }
-          await new Promise((resolve11) => setTimeout(resolve11, 250));
+          await new Promise((resolve12) => setTimeout(resolve12, 250));
           continue;
         }
       }
@@ -25150,12 +26946,12 @@ ${color.cyan("\u23F3 Auto")}  ${color.dim("(Ctrl+C to cancel)")}
   let interval;
   let lastTickedSecond = sec + 1;
   let onAbort;
-  return new Promise((resolve11) => {
-    onAbort = () => resolve11(false);
+  return new Promise((resolve12) => {
+    onAbort = () => resolve12(false);
     signal.addEventListener("abort", onAbort, { once: true });
     interval = setInterval(() => {
       if (signal.aborted) {
-        resolve11(false);
+        resolve12(false);
         return;
       }
       const elapsed = Date.now() - start;
@@ -25163,7 +26959,7 @@ ${color.cyan("\u23F3 Auto")}  ${color.dim("(Ctrl+C to cancel)")}
       if (remaining <= 0) {
         opts.renderer.write(color.dim(`  \u21B3 ${truncated}
 `));
-        resolve11(true);
+        resolve12(true);
         return;
       }
       if (opts.onCountdownTick && remaining !== lastTickedSecond) {
@@ -25174,7 +26970,7 @@ ${color.cyan("\u23F3 Auto")}  ${color.dim("(Ctrl+C to cancel)")}
             opts.renderer.write(
               color.yellow("  \u21B3 Countdown cancelled \u2014 switching to manual mode\n")
             );
-            resolve11(false);
+            resolve12(false);
             return;
           }
         } catch {
@@ -25271,10 +27067,10 @@ async function execute(deps) {
     reader,
     session,
     mcpRegistry,
-    recoveryLock,
-    wpaths,
+    recoveryLock: initialRecoveryLock,
+    wpaths: initialWpaths,
     modelsRegistry,
-    projectRoot,
+    projectRoot: initialProjectRoot,
     flags,
     positional,
     effectiveMaxContext,
@@ -25288,6 +27084,8 @@ async function execute(deps) {
     getPickableProviders,
     switchProviderAndModel,
     director,
+    getDirector,
+    coordinatorController,
     fleetRoster,
     fleetStreamController,
     interruptController,
@@ -25324,6 +27122,11 @@ async function execute(deps) {
     restoredToolCalls,
     needsSetup
   } = deps;
+  let wpaths = initialWpaths;
+  let projectRoot = initialProjectRoot;
+  let activeSessionStore = sessionStore;
+  let activeRecoveryLock = initialRecoveryLock;
+  let detachActiveTodosCheckpoint = detachTodosCheckpoint;
   const rootTraceId = context.traceId;
   const storageLog = (event, payload) => {
     const traceId = payload.traceId ?? rootTraceId;
@@ -25372,8 +27175,8 @@ async function execute(deps) {
           timeoutMs: 3e5
         };
         const subagentId = await dir.spawn(cfg);
-        const { randomUUID: randomUUID7 } = await import('crypto');
-        const taskId = randomUUID7();
+        const { randomUUID: randomUUID8 } = await import('crypto');
+        const taskId = randomUUID8();
         await dir.assign({
           id: taskId,
           description: taskDesc,
@@ -25588,8 +27391,11 @@ async function execute(deps) {
       let pendingProjectSwitch = null;
       const coordinatorEvents = /* @__PURE__ */ new Set();
       let autonomousCoordinator = null;
-      const onDirectorReady = (dir) => {
-        if (autonomousCoordinator) return;
+      let coordinatorRun = null;
+      const ensureAutonomousCoordinator = () => {
+        if (autonomousCoordinator) return autonomousCoordinator;
+        const currentDirector = getDirector?.() ?? director;
+        if (!currentDirector) return null;
         const transcript = context.session.transcriptPath;
         const sessionDir = transcript ? path4.dirname(transcript) : wpaths.projectDir;
         const llmProvider = {
@@ -25604,7 +27410,7 @@ async function execute(deps) {
               type: "text",
               text: `Decision: ${prompt.question}
 
-Context: ${prompt.context}
+Context: ${JSON.stringify(prompt.context)}
 
 Options:
 ${prompt.options.map((o, i) => `  ${i + 1}. [${o.id}] ${o.label}${o.consequence ? ` \u2014 ${o.consequence}` : ""}`).join("\n")}
@@ -25641,7 +27447,9 @@ Reply with ONLY the JSON object.`
         };
         autonomousCoordinator = new AutonomousCoordinator({
           sessionDir,
-          fleet: dir.fleet,
+          fleet: currentDirector.fleet,
+          fleetManager: currentDirector.fleetManager,
+          director: currentDirector,
           mailbox,
           selfAgentId: `leader@${context.session.id ?? "unknown"}`,
           selfAgentName: "Leader",
@@ -25650,16 +27458,168 @@ Reply with ONLY the JSON object.`
             for (const fn of coordinatorEvents) fn(event);
           }
         });
-        deps.onCoordinatorStop = () => autonomousCoordinator?.stop();
+        deps.onCoordinatorStop = () => autonomousCoordinator?.dispose();
+        if (coordinatorController) {
+          coordinatorController["onCoordinatorStart"] = (goal) => {
+            const coordinator = autonomousCoordinator;
+            if (!coordinator) return;
+            coordinator.run({ goal: goal ?? "Improve the codebase", runUntilComplete: true }).then(() => void 0).catch((err) => console.error("[coordinator] run() failed:", err));
+          };
+          coordinatorController["onCoordinatorStop"] = () => autonomousCoordinator?.stop();
+          coordinatorController["onCoordinatorTasks"] = async () => {
+            if (!autonomousCoordinator) return null;
+            await autonomousCoordinator.graph.load();
+            return autonomousCoordinator.auction.getPendingTasks().map((task) => ({ id: task.id, title: task.title, priority: task.priority, tags: task.tags }));
+          };
+          coordinatorController["onCoordinatorClaim"] = async (taskId) => {
+            if (!autonomousCoordinator) return "No coordinator is active.";
+            await autonomousCoordinator.graph.load();
+            const goal = autonomousCoordinator.graph.get(taskId);
+            if (!goal || goal.type !== "goal") return `Task ${taskId.slice(0, 8)} not found.`;
+            if (goal.status !== "pending") return `Task ${taskId.slice(0, 8)} is ${goal.status}, not claimable.`;
+            const ok = await autonomousCoordinator.auction.claim(
+              taskId,
+              `terminal@${context.session.id ?? "unknown"}`,
+              "Terminal worker"
+            );
+            if (!ok) return `Task ${taskId.slice(0, 8)} could not be claimed.`;
+            return { description: goal.description };
+          };
+          coordinatorController["onCoordinatorComplete"] = async (taskId, result) => {
+            if (!autonomousCoordinator) return "No coordinator is active.";
+            await autonomousCoordinator.graph.load();
+            const goal = autonomousCoordinator.graph.get(taskId);
+            if (!goal || goal.type !== "goal") return `Task ${taskId.slice(0, 8)} not found.`;
+            if (goal.status !== "in_progress") return `Task ${taskId.slice(0, 8)} is ${goal.status}, cannot complete.`;
+            await autonomousCoordinator.reportTaskCompletion(taskId, result ?? "Terminal worker completed the task");
+            return null;
+          };
+          coordinatorController["onCoordinatorFail"] = async (taskId, error) => {
+            if (!autonomousCoordinator) return "No coordinator is active.";
+            await autonomousCoordinator.graph.load();
+            const goal = autonomousCoordinator.graph.get(taskId);
+            if (!goal || goal.type !== "goal") return `Task ${taskId.slice(0, 8)} not found.`;
+            if (goal.status !== "in_progress") return `Task ${taskId.slice(0, 8)} is ${goal.status}, cannot fail.`;
+            await autonomousCoordinator.reportTaskFailure(taskId, error);
+            return null;
+          };
+          coordinatorController["onCoordinatorStatus"] = async () => {
+            if (!autonomousCoordinator) return null;
+            await autonomousCoordinator.syncFromGraph();
+            const stats2 = autonomousCoordinator.getStats();
+            return {
+              goals: { total: stats2.goals.total, done: stats2.goals.done, pending: stats2.goals.pending, failed: stats2.goals.failed },
+              dag: { running: stats2.dag.running, ready: stats2.dag.ready, done: stats2.dag.done, failed: stats2.dag.failed },
+              auction: { pending: stats2.auction.pending, inProgress: stats2.auction.in_progress }
+            };
+          };
+        }
+        return autonomousCoordinator;
       };
-      if (director) onDirectorReady(director);
+      if (director) ensureAutonomousCoordinator();
       const offDirectorSpawned = events.onPattern("subagent.spawned", () => {
-        const dir = director;
-        if (dir) {
-          offDirectorSpawned();
-          onDirectorReady(dir);
-        }
+        if (ensureAutonomousCoordinator()) offDirectorSpawned();
       });
+      const switchProjectInPlace = async (targetRoot, displayName) => {
+        const resolved = path4.resolve(targetRoot);
+        const stat8 = await fsp5.stat(resolved).catch(() => null);
+        if (!stat8?.isDirectory()) return `Cannot switch: not a directory: ${resolved}`;
+        const oldWriter = context.session;
+        const oldUsage = tokenCounter.total();
+        const oldRecoveryLock = activeRecoveryLock;
+        const oldProjectRoot = projectRoot;
+        const nextWpaths = resolveWstackPaths({ projectRoot: resolved, globalRoot: wpaths.globalRoot });
+        await fsp5.mkdir(nextWpaths.projectSessions, { recursive: true });
+        const nextSessionStore = new DefaultSessionStore({ dir: nextWpaths.projectSessions });
+        const nextWriter = await nextSessionStore.create({
+          id: "",
+          title: "",
+          model: context.model,
+          provider: context.provider.id ?? config.provider
+        });
+        detachActiveTodosCheckpoint?.();
+        process.chdir(resolved);
+        projectRoot = resolved;
+        wpaths = nextWpaths;
+        activeSessionStore = nextSessionStore;
+        activeRecoveryLock = new RecoveryLock({ dir: nextWpaths.projectSessions, sessionStore: nextSessionStore });
+        context.cwd = resolved;
+        context.projectRoot = resolved;
+        context.workingDir = resolved;
+        context.session = nextWriter;
+        context.state.replaceMessages([]);
+        context.state.replaceTodos([]);
+        context.clearFileTracking();
+        context.tokenCounter.reset();
+        context.meta["packageTrackerOpts"] = { storageDir: nextWpaths.projectDir, projectRoot: resolved };
+        context.state.setMeta("plan.path", path4.join(nextWpaths.projectSessions, `${nextWriter.id}.plan.json`));
+        context.state.setMeta("task.path", path4.join(nextWpaths.projectSessions, `${nextWriter.id}.tasks.json`));
+        detachActiveTodosCheckpoint = attachTodosCheckpoint(
+          context.state,
+          path4.join(nextWpaths.projectSessions, `${nextWriter.id}.todos.json`),
+          nextWriter.id,
+          events,
+          context.traceId
+        );
+        setQueuedMessagesSnapshot(context, []);
+        try {
+          const switchMode = modeId && modeId !== "default" && modeStore ? await modeStore.getMode(modeId) : void 0;
+          const switchBuilder = new DefaultSystemPromptBuilder({
+            memoryStore: memoryStore ?? void 0,
+            skillLoader,
+            modeStore,
+            modeId: modeId ?? "default",
+            modePrompt: switchMode?.prompt ?? ""
+          });
+          context.systemPrompt = await switchBuilder.build({
+            cwd: resolved,
+            projectRoot: resolved,
+            tools: agent.tools.list(),
+            provider: context.provider.id,
+            model: context.model
+          });
+        } catch (err) {
+          console.error(
+            JSON.stringify({
+              level: "warn",
+              event: "execution.project_switch_prompt_rebuild_failed",
+              message: err instanceof Error ? err.message : String(err),
+              timestamp: (/* @__PURE__ */ new Date()).toISOString()
+            })
+          );
+        }
+        void (async () => {
+          try {
+            await oldWriter.append({ type: "session_end", ts: (/* @__PURE__ */ new Date()).toISOString(), usage: oldUsage });
+            await oldWriter.close();
+          } catch (err) {
+            console.error(
+              JSON.stringify({
+                level: "warn",
+                event: "execution.project_switch_old_session_close_failed",
+                message: err instanceof Error ? err.message : String(err),
+                timestamp: (/* @__PURE__ */ new Date()).toISOString()
+              })
+            );
+          }
+          await oldRecoveryLock.clear().catch(() => void 0);
+        })();
+        try {
+          await activeRecoveryLock.write(nextWriter.id);
+        } catch (err) {
+          console.error(
+            JSON.stringify({
+              level: "error",
+              event: "execution.project_switch_recovery_lock_failed",
+              message: err instanceof Error ? err.message : String(err),
+              timestamp: (/* @__PURE__ */ new Date()).toISOString()
+            })
+          );
+        }
+        const emitUntyped = events.emit;
+        emitUntyped("project.switched", { from: oldProjectRoot, to: resolved, name: displayName });
+        return null;
+      };
       try {
         code = await runTui({
           agent,
@@ -25729,6 +27689,9 @@ Reply with ONLY the JSON object.`
             const autonomy = cfg.autonomy;
             const rawMode = autonomy?.defaultMode;
             const mode = rawMode === "suggest" || rawMode === "auto" ? rawMode : "off";
+            const modelRuntime = cfg.modelRuntime;
+            const reasoningEffortRaw = modelRuntime?.reasoning?.effort;
+            const reasoningEffort = reasoningEffortRaw === "none" || reasoningEffortRaw === "minimal" || reasoningEffortRaw === "low" || reasoningEffortRaw === "medium" || reasoningEffortRaw === "high" || reasoningEffortRaw === "xhigh" || reasoningEffortRaw === "max" ? reasoningEffortRaw : "high";
             return {
               mode,
               delayMs: autonomy?.autoProceedDelayMs ?? 45e3,
@@ -25759,12 +27722,17 @@ Reply with ONLY the JSON object.`
               restrictFsToRoot: cfg.tools?.restrictToProjectRoot ?? false,
               autoProceedMaxIterations: cfg.autonomy?.autoProceedMaxIterations ?? 50,
               debugStream: cfg.debugStream ?? false,
+              statuslineMode: autonomy?.statuslineMode === "minimum" ? "minimum" : "detailed",
               configScope: cfg.configScope ?? "global",
               enhanceDelayMs: cfg.autonomy?.enhanceDelayMs ?? 6e4,
               enhanceEnabled: cfg.autonomy?.enhance ?? true,
               enhanceLanguage: cfg.autonomy?.enhanceLanguage === "english" ? "english" : "original",
               mouseMode: autonomy?.mouseMode ?? false,
               autonomyNextPrompt: cfg.autonomy?.autonomyNextPrompt ?? "auto {{suggestion}}",
+              reasoningMode: modelRuntime?.reasoning?.mode === "on" || modelRuntime?.reasoning?.mode === "off" ? modelRuntime.reasoning.mode : "auto",
+              reasoningEffort,
+              reasoningPreserve: modelRuntime?.reasoning?.preserve === true,
+              cacheTtl: modelRuntime?.cache?.ttl === "5m" || modelRuntime?.cache?.ttl === "1h" ? modelRuntime.cache.ttl : "default",
               breakerEnabled: cfg.circuitBreaker?.enabled === true,
               breakerAutoKillResetMs: cfg.circuitBreaker?.autoKillResetMs ?? 6e4
             };
@@ -25790,6 +27758,7 @@ Reply with ONLY the JSON object.`
                   if (s.mouseMode !== void 0) a["mouseMode"] = s.mouseMode;
                   if (s.enhanceEnabled !== void 0) a["enhance"] = s.enhanceEnabled;
                   if (s.enhanceLanguage !== void 0) a["enhanceLanguage"] = s.enhanceLanguage;
+                  if (s.statuslineMode !== void 0) a["statuslineMode"] = s.statuslineMode;
                   if (s.autonomyNextPrompt !== void 0) a["autonomyNextPrompt"] = s.autonomyNextPrompt;
                   if (s.autoProceedMaxIterations !== void 0)
                     a["autoProceedMaxIterations"] = s.autoProceedMaxIterations;
@@ -25945,7 +27914,7 @@ Reply with ONLY the JSON object.`
           // The coordinator tracks goals, tasks, knowledge, and consensus across all
           // active sessions in the same project. It runs independently of the leader
           // agent and is accessible to any session in the project via the GlobalMailbox.
-          getAutonomousCoordinator: () => autonomousCoordinator,
+          getAutonomousCoordinator: () => ensureAutonomousCoordinator(),
           subscribeCoordinatorEvents: (fn) => {
             coordinatorEvents.add(fn);
             return () => {
@@ -25953,17 +27922,105 @@ Reply with ONLY the JSON object.`
             };
           },
           onCoordinatorStart: (goal) => {
-            if (!autonomousCoordinator) {
-              console.error("[coordinator] not ready \u2014 no director yet (spawn a subagent first)");
+            const coordinator = ensureAutonomousCoordinator();
+            if (!coordinator) {
+              console.error("[coordinator] not ready \u2014 no director available");
               return;
             }
-            autonomousCoordinator.run({ goal: goal ?? "" }).catch((err) => {
+            if (coordinatorRun) return;
+            coordinatorRun = coordinator.run({ goal: goal ?? "Improve the codebase", runUntilComplete: true }).then(() => void 0).catch((err) => {
               console.error("[coordinator] run() failed:", err);
+            }).finally(() => {
+              coordinatorRun = null;
             });
           },
           onCoordinatorStop: () => {
             autonomousCoordinator?.stop();
           },
+          onCoordinatorTasks: async () => {
+            const coordinator = ensureAutonomousCoordinator();
+            if (!coordinator) return null;
+            await coordinator.graph.load();
+            return coordinator.auction.getPendingTasks().map((task) => ({
+              id: task.id,
+              title: task.title,
+              priority: task.priority,
+              tags: task.tags
+            }));
+          },
+          onCoordinatorClaim: async (taskId) => {
+            const coordinator = ensureAutonomousCoordinator();
+            if (!coordinator) return "No coordinator is active.";
+            await coordinator.graph.load();
+            const goal = coordinator.graph.get(taskId);
+            if (!goal || goal.type !== "goal") {
+              return `Task ${taskId.slice(0, 8)} not found in the coordinator graph.`;
+            }
+            if (goal.status !== "pending") {
+              return `Task ${taskId.slice(0, 8)} is ${goal.status}, not claimable.`;
+            }
+            const ok = await coordinator.auction.claim(
+              taskId,
+              `terminal@${context.session.id ?? "unknown"}`,
+              "Terminal worker"
+            );
+            if (!ok) {
+              return `Task ${taskId.slice(0, 8)} could not be claimed (status changed?).`;
+            }
+            return { description: goal.description };
+          },
+          onCoordinatorComplete: async (taskId, result) => {
+            const coordinator = ensureAutonomousCoordinator();
+            if (!coordinator) return "No coordinator is active.";
+            await coordinator.graph.load();
+            const goal = coordinator.graph.get(taskId);
+            if (!goal || goal.type !== "goal") {
+              return `Task ${taskId.slice(0, 8)} not found in the coordinator graph.`;
+            }
+            if (goal.status !== "in_progress") {
+              return `Task ${taskId.slice(0, 8)} is ${goal.status}, cannot complete.`;
+            }
+            await coordinator.reportTaskCompletion(taskId, result ?? "Terminal worker completed the task");
+            return null;
+          },
+          onCoordinatorFail: async (taskId, error) => {
+            const coordinator = ensureAutonomousCoordinator();
+            if (!coordinator) return "No coordinator is active.";
+            await coordinator.graph.load();
+            const goal = coordinator.graph.get(taskId);
+            if (!goal || goal.type !== "goal") {
+              return `Task ${taskId.slice(0, 8)} not found in the coordinator graph.`;
+            }
+            if (goal.status !== "in_progress") {
+              return `Task ${taskId.slice(0, 8)} is ${goal.status}, cannot fail.`;
+            }
+            await coordinator.reportTaskFailure(taskId, error);
+            return null;
+          },
+          onCoordinatorStatus: async () => {
+            const coordinator = ensureAutonomousCoordinator();
+            if (!coordinator) return null;
+            await coordinator.syncFromGraph();
+            const stats2 = coordinator.getStats();
+            return {
+              goals: {
+                total: stats2.goals.total,
+                done: stats2.goals.done,
+                pending: stats2.goals.pending,
+                failed: stats2.goals.failed
+              },
+              dag: {
+                running: stats2.dag.running,
+                ready: stats2.dag.ready,
+                done: stats2.dag.done,
+                failed: stats2.dag.failed
+              },
+              auction: {
+                pending: stats2.auction.pending,
+                inProgress: stats2.auction.in_progress
+              }
+            };
+          },
           // /clear: signal the TUI to wipe entries and reset fleet/leader stats
           // AND bump the context chip version — so the display reflects a
           // completely fresh session after the backend has been cleared.
@@ -26013,6 +28070,7 @@ Reply with ONLY the JSON object.`
           initialGoal: goalFlag,
           initialAsk: askFlag,
           projectRoot,
+          appConfig: config,
           getSDDContext: async () => {
             const { getActiveSDDContext: getActiveSDDContext2 } = await Promise.resolve().then(() => (init_sdd(), sdd_exports));
             return getActiveSDDContext2();
@@ -26091,9 +28149,9 @@ Reply with ONLY the JSON object.`
           restoredToolCalls,
           // ── Session resume support ──────────────────────────────────
           listSessions: async (limit = 20) => {
-            if (!sessionStore) return [];
-            const summaries = await sessionStore.list(limit);
-            const currentId = session.id;
+            if (!activeSessionStore) return [];
+            const summaries = await activeSessionStore.list(limit);
+            const currentId = agent.ctx.session?.id ?? session.id;
             return summaries.map((s) => ({
               id: s.id,
               title: s.title ?? "",
@@ -26108,7 +28166,7 @@ Reply with ONLY the JSON object.`
             }));
           },
           onResumeSession: async (sessionId) => {
-            if (!sessionStore) return null;
+            if (!activeSessionStore) return null;
             try {
               const { SessionRegistry } = await import('@wrongstack/core');
               const registry = new SessionRegistry(path4.dirname(wpaths.globalConfig));
@@ -26124,7 +28182,7 @@ Reply with ONLY the JSON object.`
               if (err instanceof Error && err.message.startsWith("Session is open")) throw err;
             }
             try {
-              const resumed = await sessionStore.resume(sessionId);
+              const resumed = await activeSessionStore.resume(sessionId);
               const meta = resumed.data.metadata;
               agent.ctx.state.replaceMessages(resumed.data.messages);
               if (meta.model && meta.model !== agent.ctx.model) {
@@ -26178,7 +28236,7 @@ Reply with ONLY the JSON object.`
               tokenCounter.reset();
               void (async () => {
                 try {
-                  await recoveryLock.clear();
+                  await activeRecoveryLock.clear();
                 } catch (err) {
                   console.error(
                     JSON.stringify({
@@ -26190,7 +28248,7 @@ Reply with ONLY the JSON object.`
                   );
                 }
                 try {
-                  await recoveryLock.write(resumed.writer.id);
+                  await activeRecoveryLock.write(resumed.writer.id);
                 } catch (err) {
                   console.error(
                     JSON.stringify({
@@ -26238,60 +28296,50 @@ Reply with ONLY the JSON object.`
           },
           /**
            * Called when the user selects a project in the picker.
-           * For projects: loads manifest, validates the project, updates lastSeen,
-           * stores the pending switch, and returns. The TUI calls requestExit(42)
-           * which causes runTui to return. The host CLI then spawns wstack in
-           * the target directory.
-           * For actions: handled by the slash command path (no-op here).
+           * Re-roots the live TUI process in place: new Context root, fresh
+           * per-project session writer, rebuilt system prompt, and no spawned
+           * replacement process.
            */
           onProjectSelect: async (slug, kind) => {
-            if (kind === "action") {
-              if (slug === "new-session") {
-                pendingProjectSwitch = {
-                  root: projectRoot,
-                  name: path4.basename(projectRoot) || projectRoot
-                };
-              }
-              return;
-            }
-            const { loadManifest: loadManifest2 } = await Promise.resolve().then(() => (init_project_utils(), project_utils_exports));
             try {
+              if (kind === "action") {
+                if (slug === "new-session") {
+                  const name = path4.basename(projectRoot) || projectRoot;
+                  const err2 = await switchProjectInPlace(projectRoot, name);
+                  if (err2) renderer.write(color.red(`Project switch failed: ${err2}
+`));
+                }
+                return;
+              }
+              const { loadManifest: loadManifest2, saveManifest: saveManifest2 } = await Promise.resolve().then(() => (init_project_utils(), project_utils_exports));
               const manifest = await loadManifest2(wpaths.globalConfig);
               const project = manifest.projects.find((p) => p.slug === slug);
               if (!project) return;
-              if (project.root === projectRoot) return;
+              const targetRoot = path4.resolve(project.root);
+              if (path4.resolve(projectRoot) === targetRoot) return;
               const fleetStatus = director?.status();
               const fleetRunning = fleetStatus?.subagents.filter((a) => a.status === "running").length ?? 0;
-              const eternalEngine = getEternalEngine?.();
-              const parallelEngine = getParallelEngine?.();
-              const eternalActive = eternalEngine?.currentState === "running";
-              const parallelActive = parallelEngine?.currentState === "running";
+              const eternalActive = getEternalEngine?.()?.currentState === "running";
+              const parallelActive = getParallelEngine?.()?.currentState === "running";
               const hasActiveAgents = fleetRunning > 0 || eternalActive || parallelActive;
               if (hasActiveAgents) {
                 const parts = [
-                  color.yellow(
-                    "\u26A0  Switching projects exits this wstack \u2014 running agents will stop:"
-                  )
+                  color.yellow("\u26A0  Switching project in place; active background work is still tied to the previous project:")
                 ];
-                if (fleetRunning > 0) {
-                  parts.push(color.dim(`  \u2022 ${fleetRunning} subagent(s) currently running`));
-                }
-                if (eternalActive) {
-                  parts.push(color.dim("  \u2022 Eternal engine is active"));
-                }
-                if (parallelActive) {
-                  parts.push(color.dim("  \u2022 Parallel engine is active"));
-                }
+                if (fleetRunning > 0) parts.push(color.dim(`  \u2022 ${fleetRunning} subagent(s) currently running`));
+                if (eternalActive) parts.push(color.dim("  \u2022 Eternal engine is active"));
+                if (parallelActive) parts.push(color.dim("  \u2022 Parallel engine is active"));
                 parts.push("");
-                parts.push(color.dim(`  Opening new session in: ${project.name}`));
+                parts.push(color.dim(`  New project: ${project.name}`));
                 renderer.write(`
 ${parts.join("\n")}
 `);
               }
               project.lastSeen = (/* @__PURE__ */ new Date()).toISOString();
-              const { saveManifest: saveManifest2 } = await Promise.resolve().then(() => (init_project_utils(), project_utils_exports));
               await saveManifest2(manifest, wpaths.globalConfig);
-              pendingProjectSwitch = { root: project.root, name: project.name };
+              const err = await switchProjectInPlace(targetRoot, project.name);
+              if (err) renderer.write(color.red(`Project switch failed: ${err}
+`));
             } catch (err) {
               renderer.write(
                 color.red(
@@ -26361,18 +28409,19 @@ ${parts.join("\n")}
         session,
         port: Number.parseInt(String(flags.port ?? "3457"), 10),
         projectRoot,
+        appConfig: config,
         open: !!flags.open,
         modelsRegistry,
         globalConfigPath: wpaths.globalConfig,
         mcpRegistry,
         subscribeEternalIteration,
-        sessionStore,
+        sessionStore: activeSessionStore,
         sessionsDir: wpaths.projectSessions,
         brain,
         brainSettings,
         getBrainLog,
         onSessionSwapped: (newSessionId) => {
-          void recoveryLock.clear().then(() => recoveryLock.write(newSessionId)).catch(() => void 0);
+          void activeRecoveryLock.clear().then(() => activeRecoveryLock.write(newSessionId)).catch(() => void 0);
         },
         memoryStore,
         skillLoader,
@@ -26404,12 +28453,12 @@ ${parts.join("\n")}
           }
         }
       });
-      const webuiExit = new Promise((resolve11) => {
+      const webuiExit = new Promise((resolve12) => {
         const onSigint = () => {
           renderer.setSilent(false);
           renderer.write("\n");
           renderer.writeInfo(color.yellow("  Shutting down WebUI server\u2026"));
-          resolve11(0);
+          resolve12(0);
         };
         process.on("SIGINT", onSigint);
         process.on("SIGTERM", onSigint);
@@ -26417,13 +28466,13 @@ ${parts.join("\n")}
           renderer.setSilent(false);
           process.off("SIGINT", onSigint);
           process.off("SIGTERM", onSigint);
-          resolve11(0);
+          resolve12(0);
         }).catch((err) => {
           renderer.setSilent(false);
           process.off("SIGINT", onSigint);
           process.off("SIGTERM", onSigint);
           console.debug(`[execution] webui error: ${err}`);
-          resolve11(1);
+          resolve12(1);
         });
       });
       code = await webuiExit;
@@ -26439,6 +28488,8 @@ ${parts.join("\n")}
         attachments,
         effectiveMaxContext,
         projectName: path4.basename(projectRoot) || void 0,
+        projectRoot,
+        appConfig: config,
         getAutonomy,
         onAutonomy,
         getNextPredict,
@@ -26494,7 +28545,7 @@ ${parts.join("\n")}
     events.emit("session.ended", { id: activeSession.id, usage: tokenCounter.total() });
     await pendingChimeraWork;
     await activeSession.close();
-    await recoveryLock.clear().catch(() => void 0);
+    await activeRecoveryLock.clear().catch(() => void 0);
     await reader.close();
   }
   return code;
@@ -27812,6 +29863,19 @@ function setupMetrics(params) {
 function setupPipelines(params) {
   const { events, logger } = params;
   const pipelines = createDefaultPipelines();
+  if (params.modelRuntime) {
+    const mr = params.modelRuntime;
+    pipelines.request.use({
+      name: "ModelRuntimeSettings",
+      async handler(req2) {
+        return applyModelRuntime(req2, {
+          getSettings: mr.getSettings,
+          getReasoningConfig: mr.getReasoningConfig,
+          onWarning: mr.onWarning
+        });
+      }
+    });
+  }
   const installBoundary = (p) => {
     p.setErrorHandler((ev) => {
       const fromPlugin = !!ev.owner && ev.owner !== "core";
@@ -28256,6 +30320,28 @@ async function main(argv) {
     const handler = earlyFlags["help"] === true ? helpCmd : versionCmd;
     return await handler([], { renderer: stubRenderer });
   }
+  if (earlyFlags["hq"] === true) {
+    const { startHqServer: startHqServer2 } = await Promise.resolve().then(() => (init_hq_server(), hq_server_exports));
+    const host = typeof earlyFlags["host"] === "string" ? earlyFlags["host"] : "127.0.0.1";
+    const port = typeof earlyFlags["port"] === "string" ? Number.parseInt(earlyFlags["port"], 10) : 3499;
+    const dataDir = typeof earlyFlags["data-dir"] === "string" ? earlyFlags["data-dir"] : void 0;
+    const handle = await startHqServer2({ host, port, strictPort: earlyFlags["strict-port"] === true, ...dataDir !== void 0 ? { dataDir } : {} });
+    if (earlyFlags["open"] === true) {
+      try {
+        const { openBrowser: openBrowser5 } = await import('@wrongstack/webui/server');
+        openBrowser5(handle.firstRunSetup?.browserUrl ?? `http://${handle.host}:${handle.port}`);
+      } catch {
+      }
+    }
+    await new Promise((resolve12) => {
+      const shutdown = () => {
+        void handle.close().then(() => resolve12());
+      };
+      process.on("SIGINT", shutdown);
+      process.on("SIGTERM", shutdown);
+    });
+    return 0;
+  }
   const ctx = await boot(argv);
   if (typeof ctx === "number") return ctx;
   let {
@@ -28499,7 +30585,10 @@ async function main(argv) {
   const promptBuilder = container.resolve(TOKENS.SystemPromptBuilder);
   let onlineAgents = [];
   try {
-    const systemMailbox = new GlobalMailbox(wpaths.projectDir);
+    const hqPublisher2 = createHqPublisherFromEnv({ clientKind: "cli", projectRoot, projectName: path4.basename(projectRoot), appConfig: config });
+    hqPublisher2?.connect();
+    if (hqPublisher2) teardownHandlers.push(() => hqPublisher2.close());
+    const systemMailbox = new GlobalMailbox(wpaths.projectDir, void 0, hqPublisher2);
     onlineAgents = await systemMailbox.getAgentStatuses();
   } catch {
   }
@@ -28710,7 +30799,27 @@ async function main(argv) {
     }).catch(() => {
     });
   });
-  const pipelines = setupPipelines({ events, logger });
+  let activeReasoningConfig;
+  const refreshActiveReasoningConfig = async (providerId, modelId) => {
+    try {
+      const resolved = await modelsRegistry.getModel(providerId, modelId);
+      activeReasoningConfig = resolved?.capabilities.reasoningConfig;
+    } catch {
+      activeReasoningConfig = void 0;
+    }
+  };
+  void refreshActiveReasoningConfig(config.provider, config.model);
+  const pipelines = setupPipelines({
+    events,
+    logger,
+    modelRuntime: {
+      getSettings: () => configStore.get().modelRuntime,
+      getReasoningConfig: () => activeReasoningConfig,
+      onWarning: (message) => {
+        logger.warn(`model-runtime: ${message}`);
+      }
+    }
+  });
   const hooksEnabled = flags["no-hooks"] !== true;
   const hookRegistry = new HookRegistry();
   if (hooksEnabled) hookRegistry.loadShellHooks(config.hooks);
@@ -28985,7 +31094,10 @@ async function main(argv) {
       outcome: e.intervened ? "steered the agent" : "observed (no action)"
     });
   });
-  const brainMailbox = new GlobalMailbox(wpaths.projectDir, events);
+  const hqPublisher = createHqPublisherFromEnv({ clientKind: "cli", projectRoot, projectName: path4.basename(projectRoot), appConfig: config });
+  hqPublisher?.connect();
+  if (hqPublisher) teardownHandlers.push(() => hqPublisher.close());
+  const brainMailbox = new GlobalMailbox(wpaths.projectDir, events, hqPublisher);
   const brainMonitor = new BrainMonitor({
     events,
     brain,
@@ -29213,6 +31325,7 @@ async function main(argv) {
     log: (line) => renderer.write(`${line}
 `)
   });
+  const coordinatorController = {};
   const slashCmds = buildBuiltinSlashCommands({
     registry: slashRegistry,
     toolRegistry,
@@ -29254,6 +31367,7 @@ async function main(argv) {
     brain,
     brainSettings,
     getBrainLog: () => brainLog,
+    coordinatorController,
     confirm: async (question, defaultYes = true) => {
       if (!isStdinTTY()) return false;
       const hint = defaultYes ? "[Y/n/q]" : "[y/N/q]";
@@ -29507,12 +31621,12 @@ ${color.dim("\u2500".repeat(40))}` : "";
           if (!f.endsWith(".jsonl")) continue;
           const full = path4.join(runDir, f);
           try {
-            const stat7 = await fsp5.stat(full);
+            const stat8 = await fsp5.stat(full);
             found.push({
               runId,
               subagentId: f.replace(/\.jsonl$/, ""),
               file: full,
-              size: stat7.size
+              size: stat8.size
             });
           } catch {
           }
@@ -29820,7 +31934,7 @@ Restart WrongStack to load or unload plugin code in this session.`;
     onBeforeExit: async () => {
       const cwd2 = projectRoot;
       const statusResult = await new Promise(
-        (resolve11, reject) => {
+        (resolve12, reject) => {
           const child = spawn("git", ["status", "--porcelain"], {
             cwd: cwd2,
             stdio: ["ignore", "pipe", "pipe"],
@@ -29832,7 +31946,7 @@ Restart WrongStack to load or unload plugin code in this session.`;
             stdout += d;
           });
           child.on("error", reject);
-          child.on("close", (code) => resolve11({ stdout, code: code ?? 0 }));
+          child.on("close", (code) => resolve12({ stdout, code: code ?? 0 }));
         }
       );
       if (statusResult.stdout.trim().length > 0) {
@@ -30002,6 +32116,8 @@ Restart WrongStack to load or unload plugin code in this session.`;
     getPickableProviders: () => buildPickableProviders(modelsRegistry, config),
     switchProviderAndModel,
     director: director ?? null,
+    getDirector: () => director,
+    coordinatorController,
     fleetRoster: FLEET_ROSTER,
     fleetStreamController,
     interruptController,