@wrongstack/cli 0.295.1 → 0.296.3

package/dist/webui-server-ZF5KVGC5.js

@@ -0,0 +1,1460 @@
+import {
+  createKanbanRunMirror
+} from "./chunk-VCYZ3WZV.js";
+import {
+  createHqCommandDispatcher
+} from "./chunk-OP47B3IX.js";
+import {
+  startCliHqConnection
+} from "./chunk-WY7KKOUK.js";
+import {
+  loadConfigProviders,
+  mutateConfigProviders
+} from "./chunk-PJHET45A.js";
+import "./chunk-7OCVIDC7.js";
+
+// src/webui-server.ts
+import { findPackageJSON } from "node:module";
+import * as os from "node:os";
+import * as path5 from "node:path";
+import { DefaultSecretScrubber } from "@wrongstack/core/security";
+import { PromptUsageStore, watchProviderConfig } from "@wrongstack/core/storage";
+import { resolveWstackPaths as resolveWstackPaths2, wstackGlobalRoot } from "@wrongstack/core/utils";
+import { TOKENS } from "@wrongstack/core/kernel";
+import { createCompatibilityTrustBoundary } from "@wrongstack/core/security";
+import { SkillInstaller } from "@wrongstack/core/skills";
+import { toErrorMessage } from "@wrongstack/core/utils/error";
+import { makeProviderFromConfig } from "@wrongstack/providers";
+import {
+  buildSddWizardDeps,
+  buildWebUIAccessUrl,
+  createCustomModeStore,
+  createEmbeddedMessageRouter,
+  createEmbeddedProviderOperations,
+  createMailboxRouteHandlers,
+  envFlag,
+  findFreePort,
+  GoalWebSocketHandler,
+  resolveAuthToken,
+  SddBoardWebSocketHandler,
+  SddWizardWebSocketHandler,
+  SpecsWebSocketHandler,
+  TerminalWebSocketHandler,
+  WorktreeWebSocketHandler
+} from "@wrongstack/webui-server";
+import { WebSocket, WebSocketServer } from "ws";
+
+// src/webui-server/client-registration.ts
+import { createWebuiClientPresence } from "@wrongstack/webui-server";
+function createWebuiClientRegistration(deps) {
+  const control = deps.hqControl;
+  return createWebuiClientPresence({
+    projectRoot: deps.projectRoot,
+    appConfig: deps.appConfig,
+    events: deps.events,
+    hqSessionId: deps.hqSessionId,
+    getSessionId: deps.getSessionId,
+    startHqConnection: (options) => startCliHqConnection({
+      ...options,
+      capabilities: options.capabilities
+    }),
+    ...control ? {
+      createCommandHandler: (mailbox) => createHqCommandDispatcher({
+        steerMailbox: mailbox,
+        interruptLeader: control.interruptLeader,
+        allowRunCommand: control.allowRunCommand,
+        sessionTag: deps.getSessionId,
+        ...control.spawnAgent ? { spawnAgent: control.spawnAgent } : {},
+        ...control.killFleet ? { killFleet: control.killFleet } : {},
+        ...control.terminateAgent ? { terminateAgent: control.terminateAgent } : {}
+      })
+    } : {}
+  });
+}
+
+// src/webui-server/connection-handler.ts
+import {
+  createConnectionLifecycle,
+  verifyClient as verifyWsClient
+} from "@wrongstack/webui-server";
+import { buildReplayPayload, decodeProtocolFrame } from "@wrongstack/webui-server/protocol";
+function createConnectionHandler(deps) {
+  const clientHandlers = [
+    deps.goalHandler,
+    deps.specsHandler,
+    deps.sddBoardHandler,
+    ...deps.sddWizardHandler ? [deps.sddWizardHandler] : [],
+    deps.worktreeHandler,
+    deps.terminalHandler
+  ];
+  return createConnectionLifecycle({
+    clients: deps.clients,
+    pendingConfirms: deps.pendingConfirms,
+    // ── Auth trust model ────────────────────────────────────────────────
+    // Three layered defenses (see verifyClient in @wrongstack/webui-server/ws-auth):
+    //   1. DNS-rebinding guard (Host header must be loopback on loopback bind)
+    //   2. Shared-token auth via Cookie (ws_token) or URL query param (?token=)
+    //   3. Loopback bootstrap: when requireToken=false (default) AND the server
+    //      is bound to a loopback interface, browser clients bypass token auth
+    //      entirely — the Origin header being http://localhost is sufficient.
+    //
+    // COOKIE PERSISTENCE AFTER TOKEN ROTATION:
+    // The HttpOnly ws_token cookie, once set by /ws-auth, survives a process
+    // restart. On the next process the expectedToken is a fresh random value,
+    // so the old cookie alone would fail the token check. However, on a
+    // loopback bind with requireToken=false (default), the loopback-bootstrap
+    // path at layer 3 accepts the connection before the cookie is ever
+    // compared — the old cookie is harmless because no token is needed.
+    //
+    // This means a token rotation (e.g. the operator sets a new accessToken
+    // in config) does NOT invalidate already-distributed cookies for loopback
+    // clients. The mitigating factors:
+    //   - Loopback bind + requireToken=false already trusts any local process
+    //     that can reach 127.0.0.1 — a trivial perimeter.
+    //   - A LAN/0.0.0.0 bind with requireToken=true DOES enforce cookie
+    //     matching against the new expectedToken on every reconnect.
+    // If stronger isolation is needed, set requireToken=true or rebind the
+    // server to a non-loopback interface with token enforcement.
+    authenticate: (ws, req) => {
+      const allowed = verifyWsClient({
+        origin: req.headers.origin,
+        url: req.url ?? "/",
+        hostHeader: req.headers.host,
+        remoteAddress: req.socket.remoteAddress,
+        cookieHeader: req.headers.cookie,
+        wsHost: deps.host,
+        expectedToken: deps.wsToken,
+        requireToken: deps.requireToken,
+        allowedHostnames: deps.publicHostnames,
+        allowBrowserUrlToken: Boolean(deps.publicWsUrl)
+      });
+      if (!allowed) ws.close(4003, "Forbidden");
+      return allowed;
+    },
+    createClient: (ws) => ({ ws, sessionId: deps.currentSessionId() }),
+    // Enrich parse-failure / unknown-type logs with per-connection identity
+    // so operators can identify which client sent a malformed frame. The
+    // `connectionId`/`sessionId` fields are read from the `client` argument
+    // directly inside `logRejection`; the CLI's `ConnectedClient` only has
+    // `sessionId` (no per-socket `connId`), so the verbose payload carries
+    // `sessionId` only. Server-wide identity (`agentId`/`projectRoot`) isn't
+    // in scope at this handler and is omitted.
+    verboseWsLogging: true,
+    registerClient: (ws) => {
+      for (const handler of clientHandlers) handler.addClient(ws);
+    },
+    decode: (raw) => decodeProtocolFrame(raw, "client"),
+    dispatch: deps.handleMessage,
+    send: deps.send,
+    sessionPayload: deps.sessionPayload,
+    rateLimitMax: deps.rateLimitMax,
+    onClose: (ws) => deps.abortControllers.delete(ws),
+    buildInitialPayload: async () => {
+      const payload = { ...await deps.buildSessionStartPayload({}, deps.needsSetup) };
+      try {
+        const replay = await deps.loadReplay?.();
+        if (replay) Object.assign(payload, buildReplayPayload(replay));
+      } catch {
+        console.debug("[WebUI] Failed to load replay");
+      }
+      try {
+        const sessions = await deps.loadAgentSessions?.();
+        if (sessions?.length) payload["agentSessions"] = sessions;
+      } catch {
+        console.debug("[WebUI] Failed to load agent sessions");
+      }
+      return payload;
+    }
+  });
+}
+
+// src/webui-server/kanban-host-adapter.ts
+import { PhaseGraphBuilder } from "@wrongstack/core/goal";
+import { resolveWstackPaths } from "@wrongstack/core/utils";
+import { exportBoardToTaskGraph } from "@wrongstack/kanban";
+import {
+  startSddRunFromGraph
+} from "@wrongstack/webui-server";
+function createCliKanbanHostRoutes(deps) {
+  const { opts, send, goalHandler } = deps;
+  let isolatedSeq = 0;
+  const runIsolatedTurn = opts.sddSubagentFactory ? async (prompt, name) => {
+    const result = await opts.sddSubagentFactory({
+      id: `sdd-kanban-${name.toLowerCase().replace(/\s+/g, "-")}-${isolatedSeq++}`,
+      role: "executor",
+      name,
+      disabledTools: ["delegate", "write", "edit", "patch", "bash", "exec"],
+      allowedCapabilities: ["fs.read", "net.outbound"]
+    });
+    try {
+      const res = await result.agent.run([{ type: "text", text: prompt }]);
+      return res.finalText ?? "";
+    } finally {
+      await result.dispose?.();
+    }
+  } : void 0;
+  return {
+    meta: async (ws) => {
+      const tools = (opts.agent.ctx.tools ?? []).map((tool) => ({
+        name: tool.name,
+        description: tool.description ?? ""
+      }));
+      const skills = opts.skillLoader ? (await opts.skillLoader.list()).map((skill) => ({
+        name: skill.name,
+        description: skill.description,
+        source: skill.source
+      })) : [];
+      send(ws, {
+        type: "kanban.meta",
+        payload: {
+          success: true,
+          data: {
+            tools,
+            skills,
+            fallbackProfiles: opts.appConfig?.fallbackProfiles ?? {},
+            sessionProvider: opts.agent.ctx.provider,
+            sessionModel: opts.agent.ctx.model
+          }
+        }
+      });
+    },
+    supervisorStatus: async (ws, msg) => {
+      const boardId = msg.payload?.boardId;
+      if (!boardId || !deps.kanbanSupervisor) {
+        send(ws, {
+          type: "kanban.supervisor.status",
+          payload: { success: false, error: "Kanban supervisor is unavailable." }
+        });
+        return;
+      }
+      const snapshot = deps.kanbanSupervisor.getSnapshot(boardId) ?? (await deps.kanbanSupervisor.auditNow(boardId))[0];
+      send(ws, {
+        type: "kanban.supervisor.status",
+        payload: { success: true, data: snapshot ?? null }
+      });
+    },
+    supervisorAudit: async (ws, msg) => {
+      const boardId = msg.payload?.boardId;
+      if (!deps.kanbanSupervisor) {
+        send(ws, {
+          type: "kanban.supervisor.audit",
+          payload: { success: false, error: "Kanban supervisor is unavailable." }
+        });
+        return;
+      }
+      const snapshots = await deps.kanbanSupervisor.auditNow(boardId);
+      send(ws, {
+        type: "kanban.supervisor.audit",
+        payload: { success: true, data: boardId ? snapshots[0] ?? null : snapshots }
+      });
+    },
+    runStart: async (ws, msg) => {
+      const payload = msg.payload ?? {};
+      const boardId = payload.boardId;
+      const engine = payload.engine === "goal" ? "goal" : payload.engine === "sdd" ? "sdd" : void 0;
+      const projectRoot = opts.projectRoot ?? "";
+      const failRun = (error) => send(ws, { type: "kanban.run.start", payload: { success: false, error } });
+      if (!boardId || !engine) return failRun("boardId and engine required");
+      if (!projectRoot) return failRun("No project root");
+      try {
+        const exported = await exportBoardToTaskGraph(projectRoot, boardId, {
+          preserveOriginTaskIds: true
+        });
+        if (!exported) return failRun(`Board not found: ${boardId}`);
+        if (exported.graph.nodes.size === 0) return failRun("Board has no tasks to run");
+        if (engine === "goal") {
+          deps.kanbanRunMirror?.bindGoalNext(boardId);
+          const graph = await PhaseGraphBuilder.fromTaskGraph(exported.graph, {
+            title: exported.board.title,
+            description: exported.board.description ?? exported.board.title
+          });
+          const phases = Array.from(graph.phases.values()).map((phase) => ({
+            name: phase.name,
+            description: phase.description,
+            priority: phase.priority,
+            estimateHours: phase.estimateHours,
+            parallelizable: phase.parallelizable,
+            taskTemplates: Array.from(phase.taskGraph.nodes.values()).map((task) => ({
+              title: task.title,
+              description: task.description,
+              type: task.type,
+              priority: task.priority,
+              estimateHours: task.estimateHours ?? 0,
+              ...task.tags ? { tags: task.tags } : {}
+            }))
+          }));
+          await goalHandler.handleMessage(ws, {
+            type: "goal.start",
+            payload: {
+              title: exported.board.title,
+              phases,
+              autonomous: payload.autonomous ?? false
+            }
+          });
+          send(ws, {
+            type: "kanban.run.start",
+            payload: { success: true, data: { engine: "goal", boardId } }
+          });
+          return;
+        }
+        if (!opts.sddSubagentFactory) {
+          return failRun("SDD runs need the multi-agent host, which is not available here.");
+        }
+        const paths = resolveWstackPaths({ projectRoot });
+        const handle = await startSddRunFromGraph(
+          exported.graph,
+          {
+            agent: opts.agent,
+            events: opts.events,
+            projectRoot,
+            subagentFactory: opts.sddSubagentFactory,
+            projectSddBoards: paths.projectSddBoards,
+            ...opts.brain ? { brain: opts.brain } : {},
+            ...runIsolatedTurn ? { runIsolatedTurn } : {}
+          },
+          { worktrees: true }
+        );
+        deps.kanbanRunMirror?.bind("sdd", handle.runId, boardId);
+        void handle.completion.catch(() => {
+        });
+        const started = {
+          type: "sdd.run.started",
+          payload: { runId: handle.runId, graphId: exported.graph.id }
+        };
+        send(ws, started);
+        deps.broadcast?.(started);
+        send(ws, {
+          type: "kanban.run.start",
+          payload: { success: true, data: { engine: "sdd", boardId, runId: handle.runId } }
+        });
+      } catch (err) {
+        failRun(err instanceof Error ? err.message : String(err));
+      }
+    }
+  };
+}
+
+// src/webui-server/kanban-supervisor.ts
+import {
+  createKanbanSupervisor
+} from "@wrongstack/webui-server";
+
+// src/webui-server/lifecycle.ts
+import {
+  announceWebuiReady,
+  createWebuiShutdown,
+  registerWebuiInstance,
+  registerWebuiSignalHandlers
+} from "@wrongstack/webui-server";
+
+// src/webui-server/logger-shim.ts
+var structuredLine = (level, message) => JSON.stringify({
+  level,
+  event: "webui.goal",
+  message,
+  timestamp: (/* @__PURE__ */ new Date()).toISOString()
+});
+var consoleLogger = {
+  level: "debug",
+  error(msg, _ctx) {
+    console.error(structuredLine("error", msg));
+  },
+  warn(msg, _ctx) {
+    console.warn(structuredLine("warn", msg));
+  },
+  info(msg, _ctx) {
+    console.log(structuredLine("info", msg));
+  },
+  debug(msg, _ctx) {
+    console.debug(structuredLine("debug", msg));
+  },
+  trace(msg, _ctx) {
+    console.debug(structuredLine("trace", msg));
+  },
+  child(_bindings) {
+    return this;
+  }
+};
+
+// src/webui-server/prefs-seeding.ts
+import * as fs from "node:fs/promises";
+import * as path from "node:path";
+import { DefaultSecretVault } from "@wrongstack/core/security";
+import {
+  PREF_KEYS,
+  persistPrefsToConfig,
+  prefSnapshot as snapshotPrefs,
+  seedContextMeta
+} from "@wrongstack/webui-server";
+async function seedConfigToMeta(opts) {
+  let config = opts.appConfig;
+  if (!config || Object.keys(config).length === 0) {
+    if (!opts.profileConfigPath) return;
+    try {
+      config = JSON.parse(await fs.readFile(opts.profileConfigPath, "utf8"));
+    } catch {
+      return;
+    }
+  }
+  seedContextMeta(config, { meta: opts.agent.ctx.meta });
+}
+function createPrefsSeeding(opts) {
+  const writeLock = { lock: Promise.resolve() };
+  const patchLiveAppConfig = (patch) => {
+    if (!opts.appConfig) return;
+    opts.appConfig = { ...opts.appConfig, ...patch };
+  };
+  const persistPrefs = async (payload) => {
+    if (Array.isArray(payload["fallbackModels"])) {
+      patchLiveAppConfig({ fallbackModels: payload["fallbackModels"] });
+    }
+    if (payload["fallbackProfiles"] && typeof payload["fallbackProfiles"] === "object" && !Array.isArray(payload["fallbackProfiles"])) {
+      patchLiveAppConfig({
+        fallbackProfiles: payload["fallbackProfiles"]
+      });
+    }
+    if (Array.isArray(payload["favoriteModels"])) {
+      patchLiveAppConfig({ favoriteModels: payload["favoriteModels"] });
+    }
+    if (typeof payload["favoriteModelsOnly"] === "boolean") {
+      patchLiveAppConfig({ favoriteModelsOnly: payload["favoriteModelsOnly"] });
+    }
+    if (Array.isArray(payload["modelAvailabilitySchedule"])) {
+      patchLiveAppConfig({
+        modelAvailabilitySchedule: payload["modelAvailabilitySchedule"]
+      });
+    }
+    if (typeof payload["fallbackAuto"] === "boolean") {
+      patchLiveAppConfig({ fallbackAuto: payload["fallbackAuto"] });
+    }
+    if (typeof payload["uiLocale"] === "string") {
+      patchLiveAppConfig({ uiLocale: payload["uiLocale"] });
+    }
+    if (payload["modelMatrix"] && typeof payload["modelMatrix"] === "object" && !Array.isArray(payload["modelMatrix"])) {
+      patchLiveAppConfig({ modelMatrix: payload["modelMatrix"] });
+    }
+    if (!opts.profileConfigPath) return;
+    const globalRoot = opts.globalConfigPath ? path.dirname(opts.globalConfigPath) : path.dirname(opts.profileConfigPath);
+    const vault = new DefaultSecretVault({ keyFile: path.join(globalRoot, ".key") });
+    await persistPrefsToConfig(
+      {
+        profileConfigPath: opts.profileConfigPath,
+        vault,
+        logger: {
+          warn(message) {
+            console.error(
+              JSON.stringify({
+                level: "warn",
+                event: "webui.prefs.persist_failed",
+                message,
+                timestamp: (/* @__PURE__ */ new Date()).toISOString()
+              })
+            );
+          }
+        }
+      },
+      writeLock,
+      payload
+    );
+  };
+  return {
+    prefSnapshot: () => snapshotPrefs(opts.agent.ctx.meta),
+    persistPrefs
+  };
+}
+
+// src/webui-server/provider-config.ts
+import * as path2 from "node:path";
+import { DefaultSecretVault as DefaultSecretVault2 } from "@wrongstack/core/security";
+function getVault(globalConfigPath) {
+  const configDir = path2.dirname(globalConfigPath ?? "");
+  const parentDir = path2.dirname(configDir);
+  const globalRoot = path2.basename(parentDir) === "profiles" ? path2.dirname(parentDir) : configDir;
+  const keyFile = path2.join(globalRoot, ".key");
+  return new DefaultSecretVault2({ keyFile });
+}
+async function loadSavedProviders(globalConfigPath) {
+  if (!globalConfigPath) return {};
+  return loadConfigProviders(globalConfigPath, getVault(globalConfigPath));
+}
+async function saveProviders(globalConfigPath, providers) {
+  if (!globalConfigPath) return;
+  await mutateConfigProviders(
+    globalConfigPath,
+    getVault(globalConfigPath),
+    (existing) => {
+      for (const key of Object.keys(existing)) delete existing[key];
+      Object.assign(existing, providers);
+    }
+  );
+}
+function createProviderConfigStore(globalConfigPath, configProvidersRef) {
+  return {
+    load: () => configProvidersRef ? Promise.resolve(configProvidersRef()) : loadSavedProviders(globalConfigPath),
+    save: (providers) => saveProviders(globalConfigPath, providers)
+  };
+}
+
+// src/webui-server/session-start-payload.ts
+import * as path3 from "node:path";
+import { DEFAULT_CONTEXT_WINDOW_MODE_ID } from "@wrongstack/core/types";
+import { protocolAdvertisement } from "@wrongstack/webui-server/protocol";
+
+// src/webui-server/cost-helpers.ts
+import {
+  computeUsageCost,
+  getCostRates
+} from "@wrongstack/webui-server";
+
+// src/webui-server/session-start-payload.ts
+function createSessionStartPayloadBuilder(deps) {
+  return async function buildSessionStartPayload(overrides, needsSetup = false) {
+    let maxContext = 0;
+    let inputCost = 0;
+    let outputCost = 0;
+    let cacheReadCost = 0;
+    try {
+      if (deps.modelsRegistry) {
+        const m = await deps.modelsRegistry.getModel(
+          deps.agent.ctx.provider.id,
+          deps.agent.ctx.model
+        );
+        const registryMax = m?.capabilities.maxContext;
+        maxContext = registryMax ?? deps.agent.ctx.provider.capabilities?.maxContext ?? 0;
+        const rates = getCostRates(m);
+        inputCost = rates.input;
+        outputCost = rates.output;
+        cacheReadCost = rates.cacheRead;
+      } else {
+        maxContext = deps.agent.ctx.provider.capabilities?.maxContext ?? 0;
+      }
+    } catch {
+    }
+    const lastInputTokens = typeof deps.agent.ctx.lastRequestTokens === "number" && deps.agent.ctx.lastRequestTokens > 0 ? deps.agent.ctx.lastRequestTokens : 0;
+    return {
+      sessionId: deps.agent.ctx.session?.id ?? deps.session.id,
+      model: deps.agent.ctx.model,
+      provider: deps.agent.ctx.provider.id,
+      mode: deps.modeId ?? "default",
+      projectName: deps.projectRoot ? path3.basename(deps.projectRoot) : void 0,
+      // Frontend reads `projectRoot` from session.start (ws-handlers setEnv) —
+      // omitting it left the store's projectRoot empty after a project switch.
+      projectRoot: deps.projectRoot ?? deps.agent.ctx.projectRoot ?? "",
+      cwd: deps.projectRoot ?? deps.agent.ctx.projectRoot ?? "",
+      needsSetup,
+      // true when provider/model not configured and running in --webui mode
+      contextMode: String(
+        deps.agent.ctx.meta?.["contextWindowMode"] ?? DEFAULT_CONTEXT_WINDOW_MODE_ID
+      ),
+      maxContext,
+      inputCost,
+      outputCost,
+      cacheReadCost,
+      lastInputTokens,
+      providerStatuses: deps.statusTracker?.getAllStatuses() ?? [],
+      ...protocolAdvertisement(),
+      ...overrides
+    };
+  };
+}
+
+// src/webui-server/setup-events.ts
+import {
+  createEternalSubscription,
+  setupEvents as setupCanonicalEvents
+} from "@wrongstack/webui-server";
+function createSetupEvents(deps) {
+  let fleetConcurrency = 0;
+  let fleetConcurrencyMax = 4;
+  const emitConcurrency = () => {
+    deps.broadcast({
+      type: "fleet.concurrency_update",
+      payload: deps.sessionPayload({ fleetConcurrency, fleetConcurrencyMax })
+    });
+  };
+  return function setupEvents() {
+    for (const unsubscribe of deps.eventUnsubscribers) unsubscribe();
+    deps.eventUnsubscribers.length = 0;
+    const maxIterations = deps.agent.ctx?.meta?.["maxIterations"];
+    const disposeCanonical = setupCanonicalEvents({
+      events: deps.events,
+      broadcast: (_clients, message) => deps.broadcast(message),
+      clients: deps.getClients(),
+      config: {
+        tools: {
+          ...typeof maxIterations === "number" ? { maxIterations } : {}
+        }
+      },
+      context: deps.agent.ctx,
+      pendingConfirms: deps.pendingConfirms,
+      globalConfigPath: deps.globalConfigPath,
+      onFleetBroadcaster: deps.onFleetBroadcaster,
+      projection: {
+        scrubObject: (value) => deps.secretScrubber.scrubObject(value),
+        queueTextDelta: deps.queueTextDelta,
+        queueThinkingDelta: deps.queueThinkingDelta,
+        queueToolProgress: (payload) => deps.queueToolProgress(payload),
+        flushThinkingDelta: deps.flushThinkingDelta,
+        flushAllStreamBuffers: deps.flushAllStreamBuffers
+      }
+    });
+    deps.eventUnsubscribers.push(disposeCanonical);
+    deps.broadcast({
+      type: "subagent.event",
+      payload: deps.sessionPayload({
+        kind: "leader_updated",
+        subagentId: "leader",
+        isLeader: true,
+        name: "Leader",
+        status: "running"
+      })
+    });
+    emitConcurrency();
+    deps.eventUnsubscribers.push(
+      deps.events.on("concurrency.changed", (event) => {
+        fleetConcurrencyMax = Math.max(1, event.n);
+        emitConcurrency();
+      }),
+      deps.events.on("subagent.spawned", () => {
+        fleetConcurrency += 1;
+        emitConcurrency();
+      }),
+      deps.events.on("subagent.task_completed", () => {
+        fleetConcurrency = Math.max(0, fleetConcurrency - 1);
+        emitConcurrency();
+      })
+    );
+    if (deps.subscribeEternalIteration) {
+      const subscription = createEternalSubscription(
+        deps.subscribeEternalIteration,
+        (_clients, message) => deps.broadcast(message),
+        deps.getClients
+      );
+      deps.eventUnsubscribers.push(() => subscription.dispose());
+    }
+  };
+}
+
+// src/webui-server/static-serve.ts
+import {
+  ensureDistDir,
+  resolveDistDir,
+  startStaticServe
+} from "@wrongstack/webui-server";
+
+// src/webui-server/stream-coalescer.ts
+import {
+  createStreamCoalescer
+} from "@wrongstack/webui-server";
+
+// src/webui-server/terminal-log-view.ts
+import { format } from "node:util";
+var DEFAULT_MAX_LINES = 5;
+var DEFAULT_REFRESH_MS = 5e3;
+var CLEAR_VISIBLE_TERMINAL = "\x1B[2J\x1B[H";
+function startBoundedTerminalLogView(options = {}) {
+  const isTTY = options.isTTY ?? process.stdout.isTTY === true;
+  if (!isTTY) {
+    return { enabled: false, redraw: () => {
+    }, stop: () => {
+    } };
+  }
+  const maxLines = Math.max(1, Math.trunc(options.maxLines ?? DEFAULT_MAX_LINES));
+  const refreshMs = Math.max(100, Math.trunc(options.refreshMs ?? DEFAULT_REFRESH_MS));
+  const target = options.consoleTarget ?? console;
+  const write = options.write ?? ((chunk) => process.stdout.write(chunk));
+  const setIntervalFn = options.setIntervalFn ?? setInterval;
+  const clearIntervalFn = options.clearIntervalFn ?? clearInterval;
+  const lines = [];
+  let stopped = false;
+  const originals = {
+    log: target.log,
+    info: target.info,
+    warn: target.warn,
+    error: target.error,
+    debug: target.debug
+  };
+  const wrappers = {};
+  const remember = (args) => {
+    for (const line of format(...args).split(/\r?\n/u)) {
+      lines.push(line);
+      if (lines.length > maxLines) lines.shift();
+    }
+  };
+  for (const level of Object.keys(originals)) {
+    const original = originals[level];
+    const wrapper = (...args) => {
+      remember(args);
+      original.apply(target, args);
+    };
+    wrappers[level] = wrapper;
+    target[level] = wrapper;
+  }
+  const redraw = () => {
+    if (stopped || lines.length === 0) return;
+    write(`${CLEAR_VISIBLE_TERMINAL}${lines.join("\n")}
+`);
+  };
+  const timer = setIntervalFn(redraw, refreshMs);
+  timer.unref?.();
+  return {
+    enabled: true,
+    redraw,
+    stop: () => {
+      if (stopped) return;
+      stopped = true;
+      clearIntervalFn(timer);
+      for (const level of Object.keys(originals)) {
+        if (target[level] === wrappers[level]) target[level] = originals[level];
+      }
+    }
+  };
+}
+
+// src/webui-server/node-pty-loader.ts
+import { existsSync } from "node:fs";
+import { createRequire } from "node:module";
+import * as path4 from "node:path";
+import { fileURLToPath } from "node:url";
+function createNodePtyLoader(importMetaUrl, logger) {
+  const requireFromCli = createRequire(importMetaUrl);
+  let cachedNodePty;
+  return () => {
+    if (cachedNodePty !== void 0) return cachedNodePty;
+    try {
+      const webuiEntry = requireFromCli.resolve("@wrongstack/webui");
+      const webuiDir = webuiEntry.replace(/[\\/]dist.*$/, "");
+      const webuiPkgJson = path4.join(webuiDir, "package.json");
+      cachedNodePty = createRequire(webuiPkgJson)("node-pty");
+      if (cachedNodePty) {
+        logger.debug?.(`[terminal] node-pty loaded via webui package (${webuiDir})`);
+        return cachedNodePty;
+      }
+    } catch (err) {
+      logger.debug?.(`[terminal] webui-route failed: ${err.message}`);
+    }
+    try {
+      cachedNodePty = requireFromCli("node-pty");
+      logger.debug?.("[terminal] node-pty loaded via direct requireFromCli");
+      return cachedNodePty;
+    } catch (err) {
+      logger.debug?.(`[terminal] direct require failed: ${err.message}`);
+    }
+    try {
+      const cliPkgJson = path4.join(path4.dirname(fileURLToPath(importMetaUrl)), "..", "package.json");
+      let dir = path4.dirname(cliPkgJson);
+      for (let i = 0; i < 6; i++) {
+        const candidate = path4.join(dir, "node_modules", "node-pty");
+        if (existsSync(candidate)) {
+          cachedNodePty = createRequire(candidate)("node-pty");
+          if (cachedNodePty) {
+            logger.debug?.(`[terminal] node-pty loaded via workspace root (${candidate})`);
+            return cachedNodePty;
+          }
+        }
+        const parent = path4.dirname(dir);
+        if (parent === dir) break;
+        dir = parent;
+      }
+    } catch (err) {
+      logger.debug?.(`[terminal] workspace-root walk failed: ${err.message}`);
+    }
+    cachedNodePty = null;
+    logger.debug?.('[terminal] node-pty resolution failed; terminal panel will report "unavailable"');
+    return cachedNodePty;
+  };
+}
+
+// src/webui-server/listen-helpers.ts
+import * as http from "node:http";
+async function startDeferredHttpListen(args) {
+  const { server, host, httpPort, logger } = args;
+  await new Promise((resolveListen, rejectListen) => {
+    server.listen(httpPort, host, () => resolveListen());
+    server.once("error", rejectListen);
+  });
+  server.on("error", (err) => {
+    logger.error("http_server_error", {
+      message: err.message,
+      port: httpPort
+    });
+  });
+}
+async function startIpv6LoopbackProxy(args) {
+  const { primary, httpPort, logger } = args;
+  const v6 = http.createServer();
+  v6.on("request", (req, res) => primary.emit("request", req, res));
+  v6.on("upgrade", (req, socket, head) => primary.emit("upgrade", req, socket, head));
+  const logIpv6Error = (err) => {
+    if (err.code === "EAFNOSUPPORT" || err.code === "EADDRNOTAVAIL" || err.code === "EADDRINUSE") {
+      logger.warn("ipv6_loopback_unavailable", { code: err.code, port: httpPort });
+      return;
+    }
+    logger.error("http_server_error", { message: err.message, port: httpPort });
+  };
+  v6.on("error", logIpv6Error);
+  const ipv6Listening = await new Promise((resolveListen) => {
+    const onListening = () => {
+      v6.off("error", onInitialError);
+      resolveListen(true);
+    };
+    const onInitialError = () => {
+      v6.off("listening", onListening);
+      resolveListen(false);
+    };
+    v6.once("listening", onListening);
+    v6.once("error", onInitialError);
+    v6.listen(httpPort, "::1");
+  });
+  if (!ipv6Listening) return null;
+  console.log(`[WebUI] Also listening on http://[::1]:${httpPort}`);
+  return v6;
+}
+
+// src/webui-server.ts
+async function runWebUI(opts) {
+  const trustBoundary = opts.trustBoundary ?? createCompatibilityTrustBoundary({ policyId: "cli-webui-trusted-host-compat-v1" });
+  const host = opts.host ?? process.env["WEBUI_HOST"] ?? process.env["WS_HOST"] ?? "127.0.0.1";
+  const publicUrl = opts.publicUrl ?? process.env["WEBUI_PUBLIC_URL"];
+  const publicWsUrl = opts.publicWsUrl ?? process.env["WEBUI_PUBLIC_WS_URL"];
+  const requireToken = opts.requireToken ?? envFlag("WEBUI_REQUIRE_TOKEN");
+  const surface = opts.surface ?? "webui";
+  const surfaceDefaults = surface === "simpleui" ? { http: 3466 } : { http: 3456 };
+  const requestedHttpPort = opts.httpPort ?? opts.port ?? surfaceDefaults.http;
+  const strictPort = process.env["WEBUI_STRICT_PORT"] === "1" || process.env["WEBUI_STRICT_PORT"] === "true";
+  let httpPort = requestedHttpPort;
+  if (!strictPort) {
+    httpPort = await findFreePort(host, requestedHttpPort);
+  }
+  const wsPort = httpPort;
+  const globalRoot = opts.globalConfigPath ? path5.dirname(opts.globalConfigPath) : wstackGlobalRoot();
+  const profileConfigPath = opts.profileConfigPath ?? opts.globalConfigPath ?? path5.join(globalRoot, "config.json");
+  const rateLimitMax = Number.parseInt(process.env["WEBUI_RATE_LIMIT"] ?? "0", 10);
+  const clients = /* @__PURE__ */ new Map();
+  const pendingConfirms = /* @__PURE__ */ new Map();
+  const secretScrubber = new DefaultSecretScrubber();
+  let abortController = null;
+  const abortControllers = /* @__PURE__ */ new Map();
+  const profileDir = path5.dirname(profileConfigPath);
+  let customModeStoreP = null;
+  const getCustomModeStore = () => {
+    customModeStoreP ??= (async () => {
+      const store = createCustomModeStore(profileDir);
+      await store.load();
+      return store;
+    })();
+    return customModeStoreP;
+  };
+  const goalStoreDir = opts.projectRoot ? path5.join(opts.projectRoot, ".wrongstack", "goal") : path5.join(os.tmpdir(), ".wrongstack", "goal");
+  const kanbanRunMirror = opts.projectRoot ? createKanbanRunMirror({
+    projectRoot: opts.projectRoot,
+    events: opts.events,
+    broadcast,
+    log: (m) => consoleLogger.info(m)
+  }) : null;
+  const kanbanSupervisor = opts.projectRoot ? createKanbanSupervisor({
+    projectRoot: opts.projectRoot,
+    broadcast,
+    ...opts.onKanbanDispatch ? { dispatchTask: opts.onKanbanDispatch } : {},
+    log: (message) => consoleLogger.info(message)
+  }) : null;
+  const goalHandler = new GoalWebSocketHandler(
+    opts.agent,
+    opts.agent.ctx,
+    consoleLogger,
+    goalStoreDir,
+    opts.events,
+    opts.projectRoot,
+    kanbanRunMirror ? (graphId, state) => kanbanRunMirror.onGoalState(graphId, state) : void 0
+  );
+  const worktreeHandler = new WorktreeWebSocketHandler(opts.events, consoleLogger);
+  const loadNodePtyViaWebui = createNodePtyLoader(import.meta.url, consoleLogger);
+  const terminalHandler = new TerminalWebSocketHandler(
+    () => opts.agent.ctx.cwd ?? opts.projectRoot ?? process.cwd(),
+    consoleLogger,
+    loadNodePtyViaWebui,
+    void 0,
+    trustBoundary
+  );
+  const specsPaths = opts.projectRoot ? resolveWstackPaths2({ projectRoot: opts.projectRoot }) : null;
+  const specsHandler = new SpecsWebSocketHandler(
+    specsPaths?.projectSpecs ?? path5.join(os.tmpdir(), ".wrongstack", "specs"),
+    specsPaths?.projectTaskGraphs ?? path5.join(os.tmpdir(), ".wrongstack", "task-graphs")
+  );
+  const sddBoardHandler = new SddBoardWebSocketHandler(
+    specsPaths?.projectSddBoards ?? path5.join(os.tmpdir(), ".wrongstack", "sdd-boards"),
+    opts.events,
+    specsPaths && opts.projectRoot ? {
+      projectRoot: opts.projectRoot,
+      paths: {
+        projectSpecs: specsPaths.projectSpecs,
+        projectTaskGraphs: specsPaths.projectTaskGraphs,
+        projectSddSession: specsPaths.projectSddSession,
+        projectSddBoards: specsPaths.projectSddBoards
+      }
+    } : void 0,
+    { trustBoundary, logger: consoleLogger }
+  );
+  const sddWizardHandler = opts.sddSubagentFactory && specsPaths ? new SddWizardWebSocketHandler(
+    buildSddWizardDeps({
+      agent: opts.agent,
+      events: opts.events,
+      projectRoot: opts.projectRoot ?? process.cwd(),
+      subagentFactory: opts.sddSubagentFactory,
+      // Failure supervisor parity with /sdd execute — omit only when
+      // the host never bound a BrainArbiter.
+      ...opts.brain ? { brain: opts.brain } : {},
+      paths: {
+        projectSpecs: specsPaths.projectSpecs,
+        projectTaskGraphs: specsPaths.projectTaskGraphs,
+        projectSddBoards: specsPaths.projectSddBoards,
+        projectDir: specsPaths.projectDir,
+        projectSddSession: specsPaths.projectSddSession
+      }
+    })
+  ) : null;
+  await seedConfigToMeta(opts);
+  if (typeof opts.agent.ctx?.meta?.["yolo"] === "boolean") {
+    opts.onYoloSwitch?.(opts.agent.ctx.meta["yolo"]);
+  }
+  const { prefSnapshot, persistPrefs } = createPrefsSeeding(opts);
+  const sessionStartedAt = Date.now();
+  const buildSessionStartPayload = createSessionStartPayloadBuilder(opts);
+  const { register: registerWebuiClient, unregister: unregisterWebuiClient } = createWebuiClientRegistration({
+    projectRoot: opts.projectRoot,
+    appConfig: opts.appConfig,
+    events: opts.events,
+    hqSessionId: opts.session.id,
+    getSessionId: () => opts.agent.ctx.session?.id ?? opts.session.id,
+    // Two-way HQ control for the WebUI client: steer/btw/queue/broadcast
+    // land in the project mailbox (the WebUI's agent reads it like any
+    // other surface), and abort tears down every in-flight run on this
+    // instance. Without this block the WebUI would be HQ-invisible to the
+    // Control tab — telemetry only.
+    hqControl: {
+      interruptLeader: () => {
+        let aborted = false;
+        if (abortController) {
+          abortController.abort();
+          abortController = null;
+          aborted = true;
+        }
+        for (const c of abortControllers.values()) {
+          c.abort();
+          aborted = true;
+        }
+        abortControllers.clear();
+        return aborted;
+      },
+      allowRunCommand: () => opts.hqAllowExec === true
+    }
+  });
+  registerWebuiClient();
+  const wsToken = resolveAuthToken(opts.accessToken);
+  const publicHostnames = [publicUrl, publicWsUrl].map((value) => {
+    if (!value) return void 0;
+    try {
+      return new URL(value).hostname;
+    } catch {
+      return void 0;
+    }
+  }).filter((value) => Boolean(value));
+  const accessUrl = buildWebUIAccessUrl({
+    host,
+    port: httpPort,
+    token: wsToken,
+    publicUrl
+  });
+  let fleetBroadcastCli = null;
+  const httpServer = await startStaticServe({
+    host,
+    httpPort,
+    globalRoot,
+    distDir: opts.frontendDistDir,
+    ensureDistDeps: {
+      resolvePackageJson: (id) => {
+        const packageJson = findPackageJSON(id, import.meta.url);
+        if (!packageJson) throw new Error(`Package not found: ${id}`);
+        return packageJson;
+      }
+    },
+    onFleetPing: () => {
+      void fleetBroadcastCli?.();
+    },
+    onTechStackEvent: (event) => broadcast(event),
+    // Read through the live agent context so a mid-session model switch or a
+    // credential hot-reload takes effect on the next analyze.
+    getLlm: () => opts.agent.ctx.provider && opts.agent.ctx.model ? { provider: opts.agent.ctx.provider, model: opts.agent.ctx.model } : void 0,
+    projectRoot: opts.projectRoot,
+    publicWsUrl,
+    apiToken: wsToken,
+    requireToken,
+    // SimpleUI only: defer listen until after the WebSocketServer is
+    // attached, so a WS upgrade request cannot arrive between listen()
+    // and the WS handler registration.
+    deferListen: surface === "simpleui"
+  });
+  const wss = httpServer ? new WebSocketServer({ server: httpServer.server, maxPayload: 20 * 1024 * 1024 }) : new WebSocketServer({ port: httpPort, host, maxPayload: 20 * 1024 * 1024 });
+  if (httpServer && surface === "simpleui") {
+    await startDeferredHttpListen({
+      server: httpServer.server,
+      host,
+      httpPort,
+      logger: consoleLogger
+    });
+  }
+  let ipv6LoopbackServer = null;
+  if (httpServer && host === "127.0.0.1") {
+    ipv6LoopbackServer = await startIpv6LoopbackProxy({
+      primary: httpServer.server,
+      httpPort,
+      logger: consoleLogger
+    });
+  }
+  console.log(`[WebUI] WebSocket server starting on ws://${host}:${httpPort}`);
+  if (httpServer) {
+    announceWebuiReady({
+      surface,
+      server: httpServer.server,
+      host,
+      httpPort,
+      open: !!opts.open,
+      wsToken,
+      publicUrl
+    });
+  } else {
+    console.warn(
+      `[WebUI] Frontend not served (run \`pnpm --filter @wrongstack/webui build\`). WS bridge still active on ws://${host}:${httpPort}.`
+    );
+  }
+  const registryBaseDir = globalRoot;
+  if (opts.projectRoot) {
+    registerWebuiInstance({
+      pid: process.pid,
+      surface,
+      host,
+      httpPort,
+      publicUrl,
+      projectRoot: opts.projectRoot,
+      startedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      registryBaseDir
+    });
+  }
+  const eventUnsubscribers = [];
+  const currentSessionId = () => opts.agent.ctx.session?.id ?? opts.session.id;
+  const sessionPayload = (payload) => {
+    const provided = payload["sessionId"];
+    const sessionId = typeof provided === "string" && provided.length > 0 ? provided : currentSessionId();
+    return { ...payload, sessionId };
+  };
+  const {
+    queueTextDelta,
+    queueThinkingDelta,
+    queueToolProgress,
+    flushThinkingDelta,
+    flushAllStreamBuffers
+  } = createStreamCoalescer({ broadcast, sessionPayload });
+  const setupEvents = createSetupEvents({
+    events: opts.events,
+    agent: opts.agent,
+    subscribeEternalIteration: opts.subscribeEternalIteration,
+    broadcast,
+    sessionPayload,
+    currentSessionId,
+    queueTextDelta,
+    queueThinkingDelta,
+    queueToolProgress,
+    flushThinkingDelta,
+    flushAllStreamBuffers,
+    pendingConfirms,
+    secretScrubber,
+    getClients: () => clients,
+    eventUnsubscribers,
+    globalConfigPath: path5.join(globalRoot, "config.json"),
+    onFleetBroadcaster: (fn) => {
+      fleetBroadcastCli = fn;
+    }
+  });
+  const wsHandlerCtx = {
+    providerStore: createProviderConfigStore(
+      profileConfigPath,
+      // Use the in-memory merged config providers so the WebUI sees the
+      // same provider list the agent uses. Without this, providers stored
+      // only in the project-local config (config.local.json) would be
+      // invisible to the WebUI's saved-providers panel because the store
+      // reads exclusively from the global config file.
+      () => opts.appConfig?.providers ?? {}
+    ),
+    modelsRegistry: opts.modelsRegistry,
+    send,
+    broadcast,
+    log: (m) => console.log(m)
+  };
+  const embeddedProviderOperations = createEmbeddedProviderOperations(wsHandlerCtx);
+  const watchConfigPath = profileConfigPath;
+  let credentialWatcherClose;
+  if (watchConfigPath && process.env["WRONGSTACK_DISABLE_CONFIG_WATCH"] !== "1") {
+    let lastActiveCfg = JSON.stringify(
+      opts.appConfig?.providers?.[opts.agent.ctx.provider.id] ?? null
+    );
+    let lastUiLocale = opts.appConfig?.uiLocale;
+    const watcher = watchProviderConfig(
+      watchConfigPath,
+      // Vault key lives at ~/.wrongstack/.key (derived from globalConfigPath),
+      // not inside the profile directory — resolve via global root to stay correct.
+      getVault(opts.globalConfigPath),
+      (snapshot) => {
+        try {
+          if (opts.appConfig && !Object.isFrozen(opts.appConfig)) {
+            opts.appConfig.providers = snapshot.providers;
+            if (snapshot.uiLocale) opts.appConfig.uiLocale = snapshot.uiLocale;
+          }
+        } catch {
+        }
+        const routingChanged = snapshot.fallbackModels !== void 0 || snapshot.fallbackProfiles !== void 0 || snapshot.favoriteModels !== void 0 || snapshot.favoriteModelsOnly !== void 0 || snapshot.modelMatrix !== void 0 || snapshot.fallbackAuto !== void 0;
+        if (routingChanged) {
+          const configStore = opts.agent.container?.safeResolve?.(TOKENS.ConfigStore);
+          configStore?.update({
+            ...snapshot.fallbackModels !== void 0 ? { fallbackModels: snapshot.fallbackModels } : {},
+            ...snapshot.fallbackProfiles !== void 0 ? { fallbackProfiles: snapshot.fallbackProfiles } : {},
+            ...snapshot.favoriteModels !== void 0 ? { favoriteModels: snapshot.favoriteModels } : {},
+            ...snapshot.favoriteModelsOnly !== void 0 ? { favoriteModelsOnly: snapshot.favoriteModelsOnly } : {},
+            ...snapshot.modelMatrix !== void 0 ? { modelMatrix: snapshot.modelMatrix } : {},
+            ...snapshot.fallbackAuto !== void 0 ? { fallbackAuto: snapshot.fallbackAuto } : {}
+          });
+        }
+        embeddedProviderOperations.broadcastSaved(snapshot.providers);
+        if (snapshot.uiLocale !== lastUiLocale) {
+          lastUiLocale = snapshot.uiLocale;
+          if (snapshot.uiLocale) {
+            opts.agent.ctx.meta["uiLocale"] = snapshot.uiLocale;
+            broadcast({ type: "prefs.updated", payload: { uiLocale: snapshot.uiLocale } });
+          }
+        }
+        const activeId = opts.agent.ctx.provider.id;
+        const newCfgStr = JSON.stringify(snapshot.providers[activeId] ?? null);
+        if (newCfgStr === lastActiveCfg) return;
+        lastActiveCfg = newCfgStr;
+        try {
+          const newCfg = snapshot.providers[activeId] ?? {
+            type: activeId,
+            ...snapshot.apiKey !== void 0 ? { apiKey: snapshot.apiKey } : {},
+            ...snapshot.baseUrl !== void 0 ? { baseUrl: snapshot.baseUrl } : {}
+          };
+          const oldMax = opts.agent.ctx.provider.capabilities?.maxContext;
+          const prov = makeProviderFromConfig(activeId, { ...newCfg, type: activeId });
+          if (oldMax != null && prov.capabilities) prov.capabilities.maxContext = oldMax;
+          opts.agent.ctx.provider = prov;
+          console.log(`[WebUI] Provider credentials reloaded from config.json (${activeId})`);
+        } catch (err) {
+          console.warn(
+            `[WebUI] Credential hot-reload failed for ${activeId}: ${toErrorMessage(err)}`
+          );
+        }
+      },
+      {
+        warn: (m) => console.warn(
+          JSON.stringify({
+            level: "warn",
+            event: "webui.config_watcher",
+            message: m,
+            timestamp: (/* @__PURE__ */ new Date()).toISOString()
+          })
+        )
+      }
+    );
+    credentialWatcherClose = watcher.close;
+  }
+  const brainCtx = {
+    brainSettings: opts.brainSettings,
+    brainRuntime: opts.brainRuntime,
+    getBrainLog: opts.getBrainLog,
+    // Prefer the host-supplied arbiter; otherwise resolve the one bound
+    // in the agent container (if any). Mirrors the former inline lookup.
+    resolveArbiter: () => opts.brain ?? (opts.agent.container.has(TOKENS.BrainArbiter) ? opts.agent.container.resolve(TOKENS.BrainArbiter) : void 0),
+    getSessionId: currentSessionId,
+    send
+  };
+  const introspectionConfigStore = opts.agent.container?.safeResolve?.(TOKENS.ConfigStore);
+  const introspectionCtx = {
+    agent: opts.agent,
+    modelsRegistry: opts.modelsRegistry,
+    configStore: introspectionConfigStore,
+    getConfig: () => {
+      const cfg = introspectionConfigStore?.get() ?? opts.appConfig;
+      if (!cfg)
+        throw new Error(
+          "Introspection route requires a config but neither ConfigStore nor opts.appConfig is available"
+        );
+      return cfg;
+    },
+    getProjectRoot: () => opts.projectRoot ?? opts.agent.ctx.projectRoot ?? "",
+    getSessionId: currentSessionId,
+    getSessionStartedAt: () => sessionStartedAt,
+    getModeId: () => opts.modeId ?? "default",
+    send
+  };
+  const skillsProjectRoot = opts.projectRoot ?? opts.agent.ctx.projectRoot ?? "";
+  const skillsPaths = skillsProjectRoot ? resolveWstackPaths2({
+    projectRoot: skillsProjectRoot,
+    globalRoot
+  }) : void 0;
+  const skillsCtx = {
+    skillLoader: opts.skillLoader,
+    skillInstaller: opts.skillLoader ? new SkillInstaller({
+      manifestPath: path5.join(skillsPaths?.configDir ?? profileDir, "installed-skills.json"),
+      projectSkillsDir: skillsPaths?.inProjectSkills ?? path5.join(skillsProjectRoot, ".wrongstack", "skills"),
+      globalSkillsDir: skillsPaths?.globalSkills ?? path5.join(profileDir, "skills"),
+      projectHash: skillsPaths?.projectHash ?? "",
+      skillLoader: opts.skillLoader
+    }) : void 0,
+    projectRoot: skillsProjectRoot,
+    projectSkillsDir: skillsPaths?.inProjectSkills,
+    globalSkillsDir: skillsPaths?.globalSkills
+  };
+  const promptsCtx = {
+    promptLoader: opts.promptLoader,
+    promptUsage: new PromptUsageStore(
+      skillsPaths?.promptUsage ?? path5.join(profileDir, "prompt-usage.json")
+    )
+  };
+  const designCtx = {
+    projectRoot: skillsProjectRoot,
+    agentMeta: opts.agent.ctx
+  };
+  const agentConfigCtx = {
+    agent: opts.agent,
+    modeStore: opts.modeStore,
+    loadSavedProviders: () => loadSavedProviders(profileConfigPath),
+    buildSessionStart: (overrides) => buildSessionStartPayload(overrides),
+    modelsRegistry: opts.modelsRegistry,
+    memoryStore: opts.memoryStore,
+    getConfig: () => opts.appConfig,
+    onMaxContextResolved: opts.onModelContextResolved,
+    persistPrefs,
+    send,
+    broadcast,
+    log: (m) => console.log(m)
+  };
+  const prefsCtx = {
+    meta: opts.agent.ctx.meta,
+    snapshot: prefSnapshot,
+    persist: persistPrefs,
+    setYolo: opts.onYoloSwitch,
+    setAutonomy: opts.onAutonomySwitch,
+    pendingConfirms,
+    configStore: opts.agent.container?.safeResolve?.(TOKENS.ConfigStore),
+    send,
+    broadcast
+  };
+  const projectsCtx = {
+    opts,
+    abortControllers,
+    abortLegacyRun: () => {
+      if (abortController) {
+        abortController.abort();
+        abortController = null;
+      }
+    },
+    buildSessionStart: (overrides) => buildSessionStartPayload(overrides),
+    send,
+    broadcast,
+    log: (m) => console.log(m)
+  };
+  const mailboxRoutes = createMailboxRouteHandlers({
+    getProjectRoot: () => opts.projectRoot ?? opts.agent.ctx.projectRoot ?? "",
+    getGlobalRoot: () => opts.globalConfigPath ? path5.dirname(opts.globalConfigPath) : "",
+    events: opts.events
+  });
+  const sessionsCtx = {
+    opts,
+    buildSessionStart: (overrides) => buildSessionStartPayload(overrides),
+    getCustomModeStore,
+    send,
+    broadcast,
+    log: (m) => console.log(m)
+  };
+  const connectionCtx = {
+    agent: opts.agent,
+    abortControllers,
+    pendingConfirms,
+    send,
+    broadcast,
+    log: (m) => console.log(m)
+  };
+  const kanbanHostRoutes = createCliKanbanHostRoutes({
+    opts,
+    send,
+    broadcast,
+    goalHandler,
+    ...kanbanSupervisor ? { kanbanSupervisor } : {},
+    ...kanbanRunMirror ? { kanbanRunMirror } : {}
+  });
+  const handleMessage = createEmbeddedMessageRouter({
+    trustBoundary,
+    opts,
+    logger: consoleLogger,
+    send,
+    sendResult,
+    sessionPayload,
+    currentSessionId,
+    shutdown,
+    providerCtx: wsHandlerCtx,
+    brainCtx,
+    introspectionCtx,
+    skillsCtx,
+    promptsCtx,
+    designCtx,
+    agentConfigCtx,
+    prefsCtx,
+    projectCtx: projectsCtx,
+    mailboxRoutes,
+    sessionCtx: sessionsCtx,
+    conversationCtx: connectionCtx,
+    goalHandler,
+    specsHandler,
+    sddBoardHandler,
+    sddWizardHandler,
+    worktreeHandler,
+    terminalHandler,
+    kanbanHostRoutes,
+    statusTracker: opts.statusTracker
+  });
+  const terminalLogView = startBoundedTerminalLogView();
+  const stopped = new Promise((resolve) => {
+    let listeningAnnounced = false;
+    const announceListening = () => {
+      if (listeningAnnounced) return;
+      listeningAnnounced = true;
+      console.log(`[WebUI] WebSocket server running on ws://${host}:${httpPort}`);
+      try {
+        setupEvents();
+        opts.onListening?.({ httpPort, wsPort, host, url: accessUrl });
+      } catch (err) {
+        consoleLogger.error("setup_events_failed", { message: toErrorMessage(err) });
+      }
+    };
+    wss.on("listening", announceListening);
+    if (httpServer?.server.listening || wss.address()) queueMicrotask(announceListening);
+    wss.on(
+      "connection",
+      createConnectionHandler({
+        host,
+        wsToken,
+        requireToken,
+        publicHostnames,
+        publicWsUrl,
+        clients,
+        currentSessionId,
+        goalHandler,
+        specsHandler,
+        sddBoardHandler,
+        sddWizardHandler,
+        worktreeHandler,
+        terminalHandler,
+        rateLimitMax,
+        send,
+        sessionPayload,
+        handleMessage,
+        abortControllers,
+        pendingConfirms,
+        buildSessionStartPayload,
+        loadReplay: async () => {
+          const activeSession = opts.agent.ctx.session ?? opts.session;
+          await activeSession.flush().catch(() => void 0);
+          if (opts.sessionStore) {
+            const data = await opts.sessionStore.load(activeSession.id);
+            return { messages: data.messages, events: data.events, usage: data.usage };
+          }
+          const usage = opts.agent.ctx.tokenCounter.total();
+          return { messages: opts.agent.ctx.messages, usage };
+        },
+        // Reads the on-disk transcripts when the in-memory ring is cold, which
+        // it always is after a resume — the ring only holds what this process
+        // watched happen.
+        loadAgentSessions: async () => await opts.agentTranscripts?.loadSessionsFromDisk() ?? [],
+        needsSetup: opts.needsSetup ?? false
+      })
+    );
+    wss.on("error", (err) => {
+      console.error(
+        JSON.stringify({
+          level: "error",
+          event: "webui_server.error",
+          message: err instanceof Error ? err.message : String(err),
+          timestamp: (/* @__PURE__ */ new Date()).toISOString()
+        })
+      );
+    });
+    const signalShutdown = createWebuiShutdown({
+      abortInFlight: () => {
+        if (abortController) {
+          abortController.abort();
+          abortController = null;
+        }
+        for (const c of abortControllers.values()) c.abort();
+        abortControllers.clear();
+      },
+      unsubscribeEvents: () => {
+        flushAllStreamBuffers();
+        for (const unsub of eventUnsubscribers) unsub();
+      },
+      closeClients: () => {
+        for (const [ws] of clients) ws.close();
+        clients.clear();
+      },
+      closeHttpServer: () => {
+        ipv6LoopbackServer?.close();
+        httpServer?.server.close();
+      },
+      wss,
+      pid: process.pid,
+      registryBaseDir,
+      onStopped: () => {
+        terminalLogView.redraw();
+        terminalLogView.stop();
+        resolve();
+      }
+    });
+    registerWebuiSignalHandlers(signalShutdown);
+  });
+  function send(ws, msg) {
+    if (ws.readyState === WebSocket.OPEN) {
+      ws.send(JSON.stringify(msg));
+    }
+  }
+  function shutdown() {
+    console.log("[WebUI] Shutting down...");
+    terminalLogView.redraw();
+    terminalLogView.stop();
+    credentialWatcherClose?.();
+    flushAllStreamBuffers();
+    worktreeHandler.dispose();
+    terminalHandler.dispose();
+    kanbanRunMirror?.dispose();
+    kanbanSupervisor?.dispose();
+    unregisterWebuiClient();
+    ipv6LoopbackServer?.close();
+    httpServer?.server.close();
+    opts.onExit?.();
+  }
+  function broadcast(msg) {
+    const data = JSON.stringify(msg);
+    for (const [ws] of clients) {
+      if (ws.readyState === WebSocket.OPEN) {
+        try {
+          ws.send(data);
+        } catch {
+        }
+      }
+    }
+  }
+  function sendResult(ws, success, message) {
+    send(ws, { type: "key.operation_result", payload: { success, message } });
+  }
+  return stopped.finally(() => terminalLogView.stop());
+}
+export {
+  runWebUI
+};
+//# sourceMappingURL=webui-server-ZF5KVGC5.js.map