npm - @wrongstack/cli - Versions diffs - 0.296.2 → 0.296.3 - Mend

@wrongstack/cli 0.296.2 → 0.296.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (59) hide show

package/dist/boot/dispatch-webui.d.ts +1 -0
package/dist/boot/dispatch-webui.d.ts.map +1 -1
package/dist/boot/tui-session-resume.d.ts.map +1 -1
package/dist/{chunk-IN4GXGYW.js → chunk-BQCAJ7FI.js} +2 -2
package/dist/{chunk-IN4GXGYW.js.map → chunk-BQCAJ7FI.js.map} +2 -2
package/dist/{chunk-X5DQTPXT.js → chunk-OI7GWJDS.js} +1048 -804
package/dist/chunk-OI7GWJDS.js.map +7 -0
package/dist/{cli-main-6AU6E4XZ.js → cli-main-RTY35OPD.js} +196 -54
package/dist/cli-main-RTY35OPD.js.map +7 -0
package/dist/cli-main.d.ts.map +1 -1
package/dist/execute-deps.d.ts +1 -0
package/dist/execute-deps.d.ts.map +1 -1
package/dist/{execution-V26SE52F.js → execution-O7I5DYE6.js} +34 -8
package/dist/execution-O7I5DYE6.js.map +7 -0
package/dist/execution-storage-observability.d.ts.map +1 -1
package/dist/execution.d.ts.map +1 -1
package/dist/fleet/host-subagent-factory.d.ts.map +1 -1
package/dist/{hq-BECGICEZ.js → hq-JUYKUNJX.js} +2 -2
package/dist/hq-server/auth.d.ts +15 -4
package/dist/hq-server/auth.d.ts.map +1 -1
package/dist/hq-server/routes/auth-handlers.d.ts +6 -13
package/dist/hq-server/routes/auth-handlers.d.ts.map +1 -1
package/dist/hq-server/routes.d.ts +6 -4
package/dist/hq-server/routes.d.ts.map +1 -1
package/dist/hq-server/snapshot.d.ts +44 -0
package/dist/hq-server/snapshot.d.ts.map +1 -1
package/dist/hq-server/types.d.ts +22 -4
package/dist/hq-server/types.d.ts.map +1 -1
package/dist/hq-server/utils.d.ts +8 -0
package/dist/hq-server/utils.d.ts.map +1 -1
package/dist/hq-server/ws.d.ts +1 -1
package/dist/hq-server/ws.d.ts.map +1 -1
package/dist/{hq-server-FJOVOERO.js → hq-server-6AQ3BXZA.js} +2 -2
package/dist/hq-server.d.ts +3 -3
package/dist/hq-server.d.ts.map +1 -1
package/dist/{hq-tunnel-YZLRONPV.js → hq-tunnel-RFKGC4HI.js} +8 -5
package/dist/{hq-tunnel-YZLRONPV.js.map → hq-tunnel-RFKGC4HI.js.map} +2 -2
package/dist/hq-tunnel.d.ts +1 -1
package/dist/hq-tunnel.d.ts.map +1 -1
package/dist/index.js +5 -5
package/dist/{sdd-runtime-IKPROVV2.js → sdd-runtime-JG4EEKL6.js} +2 -2
package/dist/services/sdd/task-manager.d.ts.map +1 -1
package/dist/slash-commands/settings.d.ts.map +1 -1
package/dist/{webui-server-G3TISUIY.js → webui-server-ZF5KVGC5.js} +3 -2
package/dist/webui-server-ZF5KVGC5.js.map +7 -0
package/dist/webui-server-options.d.ts +2 -0
package/dist/webui-server-options.d.ts.map +1 -1
package/dist/webui-server.d.ts.map +1 -1
package/dist/wiring/sage.d.ts.map +1 -1
package/dist/wiring/session.d.ts +3 -1
package/dist/wiring/session.d.ts.map +1 -1
package/package.json +22 -22
package/dist/chunk-X5DQTPXT.js.map +0 -7
package/dist/cli-main-6AU6E4XZ.js.map +0 -7
package/dist/execution-V26SE52F.js.map +0 -7
package/dist/webui-server-G3TISUIY.js.map +0 -7
/package/dist/{hq-BECGICEZ.js.map → hq-JUYKUNJX.js.map} +0 -0
/package/dist/{hq-server-FJOVOERO.js.map → hq-server-6AQ3BXZA.js.map} +0 -0
/package/dist/{sdd-runtime-IKPROVV2.js.map → sdd-runtime-JG4EEKL6.js.map} +0 -0

package/dist/{chunk-X5DQTPXT.js → chunk-OI7GWJDS.js} RENAMED Viewed

@@ -7,17 +7,26 @@ import { randomUUID as randomUUID4 } from "node:crypto";
 import * as fs4 from "node:fs/promises";
 import * as http from "node:http";
 import * as path6 from "node:path";
-import { WebSocket as WebSocket3, WebSocketServer } from "ws";
-import { createCompatibilityTrustBoundary } from "@wrongstack/core/security";
-import { createHqPersistence, toAlertMessage, watchHqAuthFile } from "@wrongstack/core/hq";
-import { createMailboxHttpRouter, MAILBOX_HTTP_DEFAULT_MAX_AGE_MS } from "@wrongstack/core/coordination";
-import { HqAlertEngine, HqCommandAuditLog } from "@wrongstack/core/hq";
 import {
+  createMailboxHttpRouter,
   createProjectMailbox,
   getSharedProjectMailbox,
+  MAILBOX_HTTP_DEFAULT_MAX_AGE_MS,
   MailboxEventEmitter,
   MailboxHttpRateLimiter
 } from "@wrongstack/core/coordination";
+import {
+  createHqPersistence,
+  HqAlertEngine,
+  HqCommandAuditLog,
+  HqBootstrapCodeStore,
+  mintHqCookieSecret as mintHqCookieSecret2,
+  mutateHqAuthFile as mutateHqAuthFile2,
+  toAlertMessage,
+  watchHqAuthFile
+} from "@wrongstack/core/hq";
+import { createCompatibilityTrustBoundary } from "@wrongstack/core/security";
+import { WebSocket as WebSocket3, WebSocketServer } from "ws";
 // src/hq-recovery-html.ts
 var HQ_RECOVERY_HTML = `<!doctype html>
@@ -172,7 +181,10 @@ function clearHqSessionCookie(res, secure) {
   res.setHeader("Set-Cookie", parts.join("; "));
 }
 function isTokenAuth(auth) {
-  return auth !== void 0 && auth !== "cookie";
+  return auth !== void 0 && auth.kind === "token";
+}
+function isCookieAuth(auth) {
+  return auth !== void 0 && auth.kind === "cookie";
 }
 function extractBrowserToken(req, url) {
   const queryToken = url.searchParams.get("token");
@@ -217,7 +229,7 @@ function authenticateBrowserRequest(req, url, mutableAuth, sessions) {
       return ctx;
     }
   }
-  if (mutableAuth.passwordHash && mutableAuth.cookieSecret) {
+  if (mutableAuth.cookieSecret) {
     const cookies = parseCookieHeader(req.headers.cookie);
     const raw = cookies[HQ_SESSION_COOKIE];
     if (raw) {
@@ -225,7 +237,19 @@ function authenticateBrowserRequest(req, url, mutableAuth, sessions) {
       if (sessionId) {
         const session = sessions.get(sessionId);
         if (session && Date.now() - session.createdAt < HQ_SESSION_MAX_AGE_MS) {
-          return "cookie";
+          if (session.kind === "token" && session.tokenId !== void 0) {
+            const liveToken = [...mutableAuth.browserTokenObjs.values()].find(
+              (obj) => obj.id === session.tokenId
+            );
+            if (!liveToken) {
+              sessions.delete(sessionId);
+              return void 0;
+            }
+            const ctx = { kind: "cookie", tokenId: session.tokenId };
+            if (liveToken.capabilities !== void 0) ctx.capabilities = liveToken.capabilities;
+            return ctx;
+          }
+          return { kind: "cookie" };
         }
         if (session) sessions.delete(sessionId);
       }
@@ -234,14 +258,260 @@ function authenticateBrowserRequest(req, url, mutableAuth, sessions) {
   return void 0;
 }
+// src/hq-server/auth-state.ts
+import { DEFAULT_HQ_REDACTION_POLICY, hqAuthContentHash, isTokenExpired, logHqAuthAudit } from "@wrongstack/core/hq";
+var TOKEN_EXPIRY_WARNING_MS = 24 * 60 * 60 * 1e3;
+function liveTokens(list) {
+  return (list ?? []).filter((token) => !isTokenExpired(token));
+}
+function createHqAuthState(authFile, dataDir) {
+  let rawBrowserTokens = authFile.browserTokens ?? [];
+  let rawClientTokens = authFile.clientTokens ?? [];
+  const mutableAuth = {
+    operatorPolicy: { ...DEFAULT_HQ_REDACTION_POLICY, ...authFile.redactionPolicy ?? {} },
+    operatorPolicyOverride: authFile.redactionPolicy,
+    browserTokens: new Set(liveTokens(authFile.browserTokens).map(({ token }) => token)),
+    clientTokens: new Set(liveTokens(authFile.clientTokens).map(({ token }) => token)),
+    browserTokenObjs: browserTokenMap(authFile.browserTokens),
+    clientTokenObjs: new Map(liveTokens(authFile.clientTokens).map((token) => [token.token, token])),
+    passwordHash: authFile.passwordHash,
+    cookieSecret: authFile.cookieSecret,
+    alertRules: authFile.alertRules
+  };
+  return {
+    mutableAuth,
+    tokenStats: () => {
+      const now = Date.now();
+      const all = [...rawBrowserTokens, ...rawClientTokens];
+      const live = all.filter((token) => !isTokenExpired(token, now));
+      return {
+        browserTotal: mutableAuth.browserTokens.size,
+        clientTotal: mutableAuth.clientTokens.size,
+        expired: all.length - live.length,
+        expiringSoon: live.filter((token) => {
+          if (token.expiresAt === void 0) return false;
+          const expiry = Date.parse(token.expiresAt);
+          return Number.isFinite(expiry) && expiry - now <= TOKEN_EXPIRY_WARNING_MS;
+        }).length
+      };
+    },
+    apply: (next) => {
+      const newBrowser = next.browserTokens ?? [];
+      const newClient = next.clientTokens ?? [];
+      auditPrunedTokens("browser", rawBrowserTokens, newBrowser, next, dataDir);
+      auditPrunedTokens("client", rawClientTokens, newClient, next, dataDir);
+      rawBrowserTokens = newBrowser;
+      rawClientTokens = newClient;
+      mutableAuth.operatorPolicy = {
+        ...DEFAULT_HQ_REDACTION_POLICY,
+        ...next.redactionPolicy ?? {}
+      };
+      mutableAuth.operatorPolicyOverride = next.redactionPolicy;
+      mutableAuth.browserTokens = new Set(liveTokens(next.browserTokens).map(({ token }) => token));
+      mutableAuth.clientTokens = new Set(liveTokens(next.clientTokens).map(({ token }) => token));
+      mutableAuth.browserTokenObjs = browserTokenMap(next.browserTokens);
+      mutableAuth.clientTokenObjs = new Map(
+        liveTokens(next.clientTokens).map((token) => [token.token, token])
+      );
+      mutableAuth.passwordHash = next.passwordHash;
+      mutableAuth.cookieSecret = next.cookieSecret;
+      mutableAuth.alertRules = next.alertRules;
+    }
+  };
+}
+function browserTokenMap(tokens) {
+  return new Map(
+    liveTokens(tokens).map((token) => [
+      token.token,
+      {
+        id: token.id,
+        ...token.capabilities !== void 0 ? { capabilities: token.capabilities } : {},
+        ...token.expiresAt !== void 0 ? { expiresAt: token.expiresAt } : {}
+      }
+    ])
+  );
+}
+function auditPrunedTokens(scope, previous, next, authFile, dataDir) {
+  const previouslyLive = new Set(previous.filter((token) => !isTokenExpired(token)).map(({ id }) => id));
+  const prunedCount = next.filter((token) => isTokenExpired(token) && previouslyLive.has(token.id)).length;
+  if (prunedCount === 0) return;
+  const contentHash = hqAuthContentHash(authFile);
+  logHqAuthAudit(dataDir, {
+    kind: "expired-prune",
+    scope,
+    tokenId: "(aggregate)",
+    prunedCount,
+    ...contentHash !== void 0 ? { contentHash } : {}
+  });
+}
+// src/hq-server/preflight.ts
+import { assessHqExposure, ensureHqFirstRunAuthFile, resolveHqDataDir } from "@wrongstack/core/hq";
+import { HqInsecureExposureError } from "@wrongstack/core/hq";
+async function prepareHqServerStart(options, defaults) {
+  const host = options.host ?? defaults.host;
+  const port = options.port ?? defaults.port;
+  const dataDir = resolveHqDataDir(options.dataDir);
+  const firstRunAuth = await ensureHqFirstRunAuthFile(dataDir, {
+    warn: (message) => console.warn(
+      JSON.stringify({
+        level: "warn",
+        event: "hq.auth_load_failed",
+        message,
+        timestamp: (/* @__PURE__ */ new Date()).toISOString()
+      })
+    ),
+    actor: resolveAuditActor(),
+    ...options.password !== void 0 ? { password: options.password } : {},
+    ...options.tokenTtlMs !== void 0 ? { tokenTtlMs: options.tokenTtlMs } : {}
+  });
+  const { authFile } = firstRunAuth;
+  if (options.requireBrowserAuth && (authFile.browserTokens ?? []).length === 0 && authFile.passwordHash === void 0) {
+    throw new HqInsecureExposureError(
+      "HQ public relay requires browser authentication. Set --password or create a browser token first."
+    );
+  }
+  const exposure = assessHqExposure({
+    host,
+    hasBrowserTokens: (authFile.browserTokens ?? []).length > 0,
+    hasPassword: authFile.passwordHash !== void 0,
+    allowInsecure: options.allowInsecureOpen
+  });
+  if (exposure.kind === "refuse") throw new HqInsecureExposureError(exposure.message);
+  if (exposure.kind === "warn") {
+    console.warn(
+      JSON.stringify({
+        level: "warn",
+        event: "hq.insecure_exposure",
+        message: exposure.message,
+        host,
+        timestamp: (/* @__PURE__ */ new Date()).toISOString()
+      })
+    );
+  }
+  return { host, port, dataDir, firstRunAuth };
+}
+// src/hq-server/routes.ts
+import { randomUUID as randomUUID2 } from "node:crypto";
+import * as path4 from "node:path";
+import { tokenHasCapability, validateHqCommand } from "@wrongstack/core/hq";
+import {
+  resolveProjectDir
+} from "@wrongstack/core/coordination";
+// src/hq-static-serve.ts
+import * as fs from "node:fs";
+import { createRequire } from "node:module";
+import * as path from "node:path";
+var requireFromHere = createRequire(import.meta.url);
+var MIME = {
+  ".html": "text/html; charset=utf-8",
+  ".js": "application/javascript; charset=utf-8",
+  ".mjs": "application/javascript; charset=utf-8",
+  ".css": "text/css; charset=utf-8",
+  ".json": "application/json; charset=utf-8",
+  ".svg": "image/svg+xml",
+  ".png": "image/png",
+  ".jpg": "image/jpeg",
+  ".woff": "font/woff",
+  ".woff2": "font/woff2",
+  ".ico": "image/x-icon"
+};
+var cachedDistDir;
+function resolveHqDistDir() {
+  if (cachedDistDir !== void 0) return cachedDistDir;
+  try {
+    const pkgJson = requireFromHere.resolve("@wrongstack/webui-hq/package.json");
+    const dist = path.join(path.dirname(pkgJson), "dist");
+    if (fs.existsSync(path.join(dist, "index.html"))) {
+      cachedDistDir = dist;
+      return dist;
+    }
+  } catch {
+  }
+  try {
+    let dir = path.dirname(new URL(import.meta.url).pathname.replace(/^\/(\w:)/, "$1"));
+    for (let i = 0; i < 8; i++) {
+      const candidate = path.join(dir, "node_modules", "@wrongstack", "webui-hq", "dist");
+      if (fs.existsSync(path.join(candidate, "index.html"))) {
+        cachedDistDir = candidate;
+        return candidate;
+      }
+      const parent = path.dirname(dir);
+      if (parent === dir) break;
+      dir = parent;
+    }
+  } catch {
+  }
+  cachedDistDir = null;
+  return null;
+}
+function isInsideDist(filePath, distDir) {
+  const rel = path.relative(distDir, filePath);
+  return rel !== "" && !rel.startsWith("..") && !path.isAbsolute(rel);
+}
+function isMissingPath(error) {
+  const code = error.code;
+  return code === "ENOENT" || code === "ENOTDIR";
+}
+async function readRegularFile(filePath) {
+  try {
+    const info = await fs.promises.stat(filePath);
+    if (!info.isFile()) return null;
+    return await fs.promises.readFile(filePath);
+  } catch (error) {
+    if (isMissingPath(error)) return null;
+    throw error;
+  }
+}
+async function serveHqStatic(_req, res, urlPath, distDir) {
+  const relPath = urlPath === "/" || urlPath === "" ? "/index.html" : urlPath;
+  let decodedPath;
+  try {
+    decodedPath = decodeURIComponent(relPath);
+  } catch {
+    return { handled: false };
+  }
+  const filePath = path.join(distDir, decodedPath);
+  if (!isInsideDist(filePath, distDir)) {
+    return { handled: false };
+  }
+  const data = await readRegularFile(filePath);
+  if (data === null) {
+    const indexPath = path.join(distDir, "index.html");
+    const html = await readRegularFile(indexPath);
+    if (html !== null) {
+      res.writeHead(200, {
+        "Content-Type": MIME[".html"],
+        "Cache-Control": "no-cache",
+        "Content-Length": html.byteLength
+      });
+      res.end(html);
+      return { handled: true };
+    }
+    return { handled: false };
+  }
+  const ext = path.extname(filePath).toLowerCase();
+  const mime = MIME[ext] ?? "application/octet-stream";
+  const cacheControl = decodedPath.startsWith("/assets/") ? "public, max-age=31536000, immutable" : ext === ".html" ? "no-cache" : "public, max-age=3600";
+  res.writeHead(200, {
+    "Content-Type": mime,
+    "Cache-Control": cacheControl,
+    "Content-Length": data.byteLength
+  });
+  res.end(data);
+  return { handled: true };
+}
 // src/hq-server/snapshot.ts
 import { WebSocket } from "ws";
 // src/hq-server/utils.ts
-import * as fs from "node:fs/promises";
+import * as fs2 from "node:fs/promises";
 import * as os from "node:os";
-import * as path from "node:path";
-import { resolveHqDataDir } from "@wrongstack/core/hq";
+import * as path2 from "node:path";
+import { resolveHqDataDir as resolveHqDataDir2 } from "@wrongstack/core/hq";
 var TRANSCRIPT_RING_MAX = 4e3;
 var MAX_TRANSCRIPT_SESSIONS = 400;
 var MAX_AGENT_RINGS = 800;
@@ -270,14 +540,14 @@ async function readLocalSubagentTranscript(sessionId, subagentId) {
   try {
     const { SessionRegistry } = await import("@wrongstack/core/storage");
     const { resolveWstackPaths, sessionScopedPath } = await import("@wrongstack/core/utils");
-    const globalRoot = path.dirname(resolveHqDataDir());
+    const globalRoot = path2.dirname(resolveHqDataDir2());
     const registry = new SessionRegistry(globalRoot);
     const entry = await registry.get(sessionId).catch(() => null);
     if (!entry) return null;
     const paths = resolveWstackPaths({ projectRoot: entry.projectRoot, globalRoot });
     const sessionDir = sessionScopedPath(paths.projectSessions, sessionId, "");
-    const file = path.join(sessionDir, "subagents", "transcripts", subagentId, "transcript.jsonl");
-    const raw = await fs.readFile(file, "utf8").catch(() => null);
+    const file = path2.join(sessionDir, "subagents", "transcripts", subagentId, "transcript.jsonl");
+    const raw = await fs2.readFile(file, "utf8").catch(() => null);
     if (raw === null) return null;
     const out = [];
     for (const line of raw.split("\n")) {
@@ -339,13 +609,18 @@ function buildHttpUrl(host, port, token) {
   if (token) url.searchParams.set("token", token);
   return url.toString();
 }
+function buildBootstrapHttpUrl(host, port, bootstrapCode) {
+  const url = new URL(`http://${displayHost(host)}:${port}/`);
+  url.hash = `bootstrap=${bootstrapCode}`;
+  return url.toString();
+}
 function buildClientWsUrl(host, port, token) {
   const url = new URL(`ws://${displayHost(host)}:${port}/ws/client`);
   if (token) url.searchParams.set("token", token);
   return url.toString();
 }
 function hqRuntimeMarkerPath(dataDir) {
-  return path.join(dataDir, "runtime.json");
+  return path2.join(dataDir, "runtime.json");
 }
 function lanIPv4Addresses() {
   const out = [];
@@ -410,22 +685,59 @@ function sanitizeApiError(err) {
 // src/hq-server/snapshot.ts
 var HQ_SNAPSHOT_BROADCAST_DEBOUNCE_MS = 100;
 var HQ_SNAPSHOT_PERSIST_MIN_INTERVAL_MS = 3e3;
-function buildSnapshot(clients, options) {
-  const now = (/* @__PURE__ */ new Date()).toISOString();
-  const clientRecordById = /* @__PURE__ */ new Map();
-  const projectMap = /* @__PURE__ */ new Map();
-  const mailboxSummaries = [];
-  const sessionById = /* @__PURE__ */ new Map();
-  const fleetByRunId = /* @__PURE__ */ new Map();
-  for (const client of clients.values()) {
-    const machineId = client.machineId || client.project.machineId || "";
-    if (!clientRecordById.has(client.clientId)) {
-      clientRecordById.set(client.clientId, {
-        clientId: client.clientId,
-        kind: client.kind,
-        machineId,
-        ...client.hostname ? { hostname: client.hostname } : {},
-        ...client.pid ? { pid: client.pid } : {},
+var HQ_BROWSER_MAX_BUFFERED_BYTES = 32 * 1024 * 1024;
+function sendGuarded(ws, data) {
+  if (ws.readyState !== WebSocket.OPEN) return false;
+  const buffered = Number.isFinite(ws.bufferedAmount) ? ws.bufferedAmount : 0;
+  if (buffered + Buffer.byteLength(data, "utf8") > HQ_BROWSER_MAX_BUFFERED_BYTES) {
+    try {
+      ws.terminate();
+    } catch {
+      try {
+        ws.close(1013, "client cannot keep up");
+      } catch {
+      }
+    }
+    return false;
+  }
+  try {
+    ws.send(data);
+    return true;
+  } catch {
+    return false;
+  }
+}
+var HQ_STALE_SNAPSHOT_MS = 5 * 6e4;
+function reapStaleClientState(clients, nowMs = Date.now()) {
+  for (const client of clients.values()) {
+    for (const [sessionId, tracked] of client.sessions) {
+      if (nowMs - tracked.receivedAt > HQ_STALE_SNAPSHOT_MS) client.sessions.delete(sessionId);
+    }
+    for (const [runId, fleet] of client.fleets) {
+      if (nowMs - fleet.receivedAt > HQ_STALE_SNAPSHOT_MS) client.fleets.delete(runId);
+    }
+    for (const [sessionId, tracked] of client.mcpSnapshots) {
+      if (nowMs - tracked.receivedAt > HQ_STALE_SNAPSHOT_MS) client.mcpSnapshots.delete(sessionId);
+    }
+  }
+}
+function buildSnapshot(clients, options) {
+  reapStaleClientState(clients);
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const clientRecordById = /* @__PURE__ */ new Map();
+  const projectMap = /* @__PURE__ */ new Map();
+  const mailboxSummaries = [];
+  const sessionById = /* @__PURE__ */ new Map();
+  const fleetByRunId = /* @__PURE__ */ new Map();
+  for (const client of clients.values()) {
+    const machineId = client.machineId || client.project.machineId || "";
+    if (!clientRecordById.has(client.clientId)) {
+      clientRecordById.set(client.clientId, {
+        clientId: client.clientId,
+        kind: client.kind,
+        machineId,
+        ...client.hostname ? { hostname: client.hostname } : {},
+        ...client.pid ? { pid: client.pid } : {},
         ...client.version ? { version: client.version } : {},
         connected: true,
         connectedAt: client.connectedAt,
@@ -630,8 +942,8 @@ function buildSnapshot(clients, options) {
   const mcpServers = [];
   const seenMcp = /* @__PURE__ */ new Set();
   for (const client of clients.values()) {
-    for (const [sessionId, servers] of client.mcpSnapshots.entries()) {
-      for (const server of servers) {
+    for (const [sessionId, tracked] of client.mcpSnapshots.entries()) {
+      for (const server of tracked.servers) {
         const key = `${client.clientId}:${sessionId}:${server.name}`;
         if (seenMcp.has(key)) continue;
         seenMcp.add(key);
@@ -657,619 +969,121 @@ function buildSnapshot(clients, options) {
       unreadMailboxMessages: unread,
       incompleteMailboxMessages: incomplete,
       totalCostUsd,
-      activeMachines: machines.length,
-      activeAgents: totalAgents,
-      ...options?.tokenStats !== void 0 ? { tokenStats: options.tokenStats } : {}
-    }
-  };
-}
-function createSnapshotBroadcaster(clients, browsers, persistence) {
-  let cached = "";
-  let dirty = true;
-  let timer = null;
-  let closed = false;
-  let lastPersistAt = 0;
-  const persistCheckpoint = (snapshot) => {
-    if (persistence === void 0) return;
-    const now = Date.now();
-    if (now - lastPersistAt < HQ_SNAPSHOT_PERSIST_MIN_INTERVAL_MS) return;
-    lastPersistAt = now;
-    persistence.snapshotStore.save(snapshot);
-  };
-  const serialize = () => {
-    if (!dirty && cached.length > 0) return cached;
-    const snapshot = buildSnapshot(clients);
-    const msg = { type: "hq.snapshot", snapshot };
-    cached = JSON.stringify(msg);
-    dirty = false;
-    persistCheckpoint(snapshot);
-    return cached;
-  };
-  const flush = () => {
-    timer = null;
-    if (browsers.size === 0) {
-      if (persistence !== void 0 && Date.now() - lastPersistAt >= HQ_SNAPSHOT_PERSIST_MIN_INTERVAL_MS) {
-        persistCheckpoint(buildSnapshot(clients));
-      }
-      return;
-    }
-    const data = serialize();
-    for (const ws of browsers) {
-      if (ws.readyState === WebSocket.OPEN) ws.send(data);
-    }
-  };
-  return {
-    currentSerialized: serialize,
-    broadcast: () => {
-      if (closed) return;
-      dirty = true;
-      if (timer !== null) return;
-      timer = setTimeout(flush, HQ_SNAPSHOT_BROADCAST_DEBOUNCE_MS);
-      timer.unref?.();
-    },
-    close: () => {
-      closed = true;
-      if (timer !== null) {
-        clearTimeout(timer);
-        timer = null;
-      }
-    }
-  };
-}
-function buildProjectDetail(clients, projectId) {
-  const projectClients = [];
-  for (const c of clients.values()) {
-    if (c.projectId === projectId) projectClients.push(c);
-  }
-  if (projectClients.length === 0) return null;
-  const now = (/* @__PURE__ */ new Date()).toISOString();
-  const clientRecords = projectClients.map((c) => ({
-    clientId: c.clientId,
-    kind: c.kind,
-    machineId: "",
-    ...c.hostname ? { hostname: c.hostname } : {},
-    ...c.pid ? { pid: c.pid } : {},
-    ...c.version ? { version: c.version } : {},
-    connected: true,
-    connectedAt: c.connectedAt,
-    lastSeenAt: c.lastSeenAt,
-    projectId: c.projectId,
-    capabilities: c.capabilities
-  }));
-  const mailboxPayloads = [];
-  let latestActivity = now;
-  for (const c of projectClients) {
-    for (const snap of c.mailboxes.values()) {
-      mailboxPayloads.push(snap);
-      if (snap.totals.messages > 0) latestActivity = now;
-    }
-  }
-  const primaryProject = projectClients[0].project;
-  const machineIds = Array.from(new Set(projectClients.map((client) => client.project.machineId)));
-  const project = {
-    projectId,
-    projectName: primaryProject.projectName || projectId,
-    projectRootDisplay: primaryProject.projectRoot,
-    machineIds,
-    ...primaryProject.gitBranch ? { gitBranch: primaryProject.gitBranch } : {},
-    activeClients: projectClients.length,
-    activeSessions: 0,
-    activeSubagents: 0,
-    totalCostUsd: 0,
-    lastActivityAt: latestActivity,
-    status: "active"
-  };
-  return {
-    generatedAt: now,
-    project,
-    clients: clientRecords,
-    mailboxes: mailboxPayloads
-  };
-}
-function broadcastEvent(event, browsers) {
-  const msg = { type: "hq.event", event };
-  const data = JSON.stringify(msg);
-  for (const ws of browsers) {
-    if (ws.readyState === WebSocket.OPEN) ws.send(data);
-  }
-}
-function broadcastCommandStatus(command, browsers) {
-  const data = JSON.stringify({ type: "hq.command_status", command });
-  for (const ws of browsers) {
-    if (ws.readyState === WebSocket.OPEN) ws.send(data);
-  }
-}
-// src/hq-server/ws.ts
-import { randomUUID } from "node:crypto";
-import { WebSocket as WebSocket2 } from "ws";
-import { HQ_PROTOCOL_VERSION, HQ_TRANSCRIPT_TEXT_CAP, parseHqEventPayload, parseHqFrame, redactHqEvent, resolveHqRedactionPolicy, tightenHqRedactionPolicy, tokenHasCapability } from "@wrongstack/core/hq";
-var MAX_EVENT_LOG = 5e3;
-function handleBrowser(ws, snapshotBroadcaster, browsers) {
-  browsers.add(ws);
-  ws.on("error", (err) => {
-    console.warn(
-      JSON.stringify({
-        level: "warn",
-        event: "hq.browser_socket_error",
-        message: err instanceof Error ? err.message : String(err),
-        timestamp: (/* @__PURE__ */ new Date()).toISOString()
-      })
-    );
-  });
-  ws.send(snapshotBroadcaster.currentSerialized());
-  ws.on("close", () => {
-    browsers.delete(ws);
-  });
-}
-function handleClient(ws, clients, browsers, eventLog, auth, snapshotBroadcaster, transcripts, agentMessages, persistence, auditLog) {
-  let registered = false;
-  function persistEvent(event) {
-    eventLog.push(event);
-    if (eventLog.length > MAX_EVENT_LOG) eventLog.splice(0, eventLog.length - MAX_EVENT_LOG);
-    if (persistence !== void 0) {
-      persistence.eventLog.append(event);
-      recordTimeseriesSignal(persistence, event);
-    }
-  }
-  ws.on("error", (err) => {
-    console.warn(
-      JSON.stringify({
-        level: "warn",
-        event: "hq.client_socket_error",
-        message: err instanceof Error ? err.message : String(err),
-        timestamp: (/* @__PURE__ */ new Date()).toISOString()
-      })
-    );
-  });
-  ws.on("message", (data) => {
-    const raw = typeof data === "string" ? data : Buffer.isBuffer(data) ? data : new TextDecoder().decode(data);
-    const parsed = parseHqFrame(raw);
-    if (!parsed.ok) {
-      const code = parsed.reason === "invalid-json" ? 1003 : 1008;
-      ws.close(code, `invalid frame: ${parsed.reason}`);
-      return;
-    }
-    const frame = parsed.frame;
-    if (frame.type === "client.hello") {
-      if (registered) {
-        ws.close(1008, "duplicate client.hello");
-        return;
-      }
-      const payload = frame.payload;
-      if (payload.protocolVersion !== HQ_PROTOCOL_VERSION) {
-        ws.close(1008, "protocol version mismatch");
-        return;
-      }
-      const canPublishTelemetry = auth.token === void 0 || tokenHasCapability(auth.token, "telemetry.publish");
-      const acceptedCapabilities = payload.capabilities.filter(
-        (capability) => capability === "control.receive" || canPublishTelemetry
-      );
-      const declaredRedactionPolicy = resolveHqRedactionPolicy(payload.redactionPolicy);
-      for (const [otherWs, otherClient] of clients) {
-        const samePublisher = otherClient.projectId === payload.project.projectId && otherClient.kind === payload.client.kind && otherClient.pid !== void 0 && payload.client.pid !== void 0 && otherClient.pid === payload.client.pid && (otherClient.machineId || otherClient.project.machineId) === (payload.client.machineId || payload.project.machineId);
-        if (otherWs !== ws && (otherClient.clientId === payload.client.clientId || samePublisher && otherClient.sessions.size === 0)) {
-          clients.delete(otherWs);
-          otherWs.close(4001, "superseded by a newer HQ connection");
-        }
-      }
-      const client = {
-        ws,
-        clientId: payload.client.clientId,
-        projectId: payload.project.projectId,
-        project: payload.project,
-        kind: payload.client.kind,
-        connectedAt: (/* @__PURE__ */ new Date()).toISOString(),
-        lastSeenAt: (/* @__PURE__ */ new Date()).toISOString(),
-        ...payload.client.hostname ? { hostname: payload.client.hostname } : {},
-        ...payload.client.pid ? { pid: payload.client.pid } : {},
-        ...payload.client.version ? { version: payload.client.version } : {},
-        capabilities: acceptedCapabilities,
-        ...auth.token !== void 0 ? { authToken: auth.token } : {},
-        declaredRedactionPolicy,
-        lastEventSeq: 0,
-        mailboxes: /* @__PURE__ */ new Map(),
-        machineId: payload.client.machineId || payload.project.machineId,
-        sessions: /* @__PURE__ */ new Map(),
-        fleets: /* @__PURE__ */ new Map(),
-        mcpSnapshots: /* @__PURE__ */ new Map(),
-        commandQueue: []
-      };
-      clients.set(ws, client);
-      registered = true;
-      const welcome = {
-        type: "hq.welcome",
-        protocolVersion: HQ_PROTOCOL_VERSION,
-        serverTime: (/* @__PURE__ */ new Date()).toISOString(),
-        acceptedCapabilities,
-        // The operator-configured override (from <dataDir>/auth.json) wins
-        // over the default. The client learns the *effective* policy.
-        redactionPolicy: tightenHqRedactionPolicy(
-          declaredRedactionPolicy,
-          auth.getOperatorPolicy()
-        )
-      };
-      ws.send(JSON.stringify(welcome));
-      if (persistence !== void 0) {
-        void persistence.kanban.load(client.projectId).then((payload2) => {
-          if (ws.readyState === WebSocket2.OPEN) {
-            ws.send(JSON.stringify({ type: "hq.kanban_snapshot", payload: payload2 }));
-          }
-        }).catch(() => void 0);
-      }
-      const event = {
-        id: randomUUID(),
-        type: "client.hello",
-        schemaVersion: HQ_PROTOCOL_VERSION,
-        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-        clientId: payload.client.clientId,
-        projectId: payload.project.projectId,
-        seq: 0,
-        payload: { client: payload.client, project: payload.project }
-      };
-      persistEvent(event);
-      snapshotBroadcaster.broadcast();
-      broadcastEvent(event, browsers);
-      return;
-    }
-    if (!registered) return;
-    if (frame.type === "client.command_poll") {
-      const client = clients.get(ws);
-      if (client) {
-        if (frame.clientId !== client.clientId || frame.projectId !== client.projectId) {
-          ws.close(1008, "command poll identity mismatch");
-          return;
-        }
-        client.lastSeenAt = (/* @__PURE__ */ new Date()).toISOString();
-        const afterId = frame.afterCommandId;
-        const limit = frame.limit ?? 25;
-        let toSend;
-        if (afterId === void 0) {
-          toSend = client.commandQueue.slice(0, limit);
-        } else {
-          const idx = client.commandQueue.findIndex((c) => c.commandId === afterId);
-          toSend = (idx >= 0 ? client.commandQueue.slice(idx + 1) : client.commandQueue).slice(
-            0,
-            limit
-          );
-        }
-        if (toSend.length > 0) {
-          const batch = JSON.stringify({ type: "hq.command_batch", commands: toSend });
-          if (ws.readyState === WebSocket2.OPEN) ws.send(batch);
-          for (const cmd of toSend) {
-            auditLog?.update(cmd.commandId, { status: "delivered" });
-            const updated = auditLog?.get(cmd.commandId);
-            if (updated !== void 0) broadcastCommandStatus(updated, browsers);
-          }
-        }
-      }
-      return;
-    }
-    if (frame.type === "client.command_ack") {
-      const client = clients.get(ws);
-      if (client) {
-        if (frame.clientId !== client.clientId || frame.projectId !== client.projectId) {
-          ws.close(1008, "command ack identity mismatch");
-          return;
-        }
-        client.lastSeenAt = (/* @__PURE__ */ new Date()).toISOString();
-      }
-      if (client) {
-        const updated = auditLog?.updateForClient(frame.commandId, client.clientId, {
-          status: "acked",
-          ackStatus: frame.status,
-          ...frame.message !== void 0 ? { ackMessage: frame.message } : {},
-          ackedAt: (/* @__PURE__ */ new Date()).toISOString()
-        });
-        if (updated === true) {
-          const entry = auditLog?.get(frame.commandId);
-          if (entry !== void 0) broadcastCommandStatus(entry, browsers);
-        }
-      }
-      return;
-    }
-    if (frame.type === "client.event") {
-      const client = clients.get(ws);
-      if (!client) return;
-      const incomingEvent = frame.event;
-      if (incomingEvent.clientId !== client.clientId || incomingEvent.projectId !== client.projectId) {
-        ws.close(1008, "event identity mismatch");
-        return;
-      }
-      if (!tokenHasCapability(client.authToken, "telemetry.publish") && auth.token !== void 0) {
-        ws.close(1008, "client token lacks telemetry.publish capability");
-        return;
-      }
-      if (incomingEvent.seq <= client.lastEventSeq) {
-        ws.close(1008, "event sequence must increase monotonically");
-        return;
-      }
-      const parsedPayload = parseHqEventPayload(incomingEvent.type, incomingEvent.payload);
-      if (!parsedPayload.ok) {
-        return;
-      }
-      client.lastEventSeq = incomingEvent.seq;
-      client.lastSeenAt = (/* @__PURE__ */ new Date()).toISOString();
-      const event = redactHqEvent(
-        { ...incomingEvent, payload: parsedPayload.payload },
-        {
-          policy: tightenHqRedactionPolicy(
-            client.declaredRedactionPolicy,
-            auth.getOperatorPolicy()
-          ),
-          projectRoot: client.project.projectRoot,
-          // Chat-transcript events carry full turns — the generic 500-char
-          // summary cap would truncate them a second time after the
-          // publisher already applied the transcript cap.
-          ...incomingEvent.type === "session.transcript" || incomingEvent.type === "agent.message" ? { maxSummaryLength: HQ_TRANSCRIPT_TEXT_CAP } : {}
-        }
-      ).value;
-      if (event.type === "client.heartbeat") {
-        return;
-      }
-      if (event.type === "kanban.snapshot") {
-        const payload = event.payload;
-        if (payload.projectId !== client.projectId || persistence === void 0) return;
-        void persistence.kanban.merge(payload).then((merged) => {
-          const touched = /* @__PURE__ */ new Set();
-          for (const record of payload.boards) touched.add(record.boardId);
-          for (const record of payload.tombstones) touched.add(record.boardId);
-          const delta = {
-            projectId: merged.projectId,
-            generatedAt: merged.generatedAt,
-            boards: merged.boards.filter((record) => touched.has(record.boardId)),
-            tombstones: merged.tombstones.filter((record) => touched.has(record.boardId))
-          };
-          const message = JSON.stringify({ type: "hq.kanban_snapshot", payload: delta });
-          for (const peer of clients.values()) {
-            if (peer.projectId === client.projectId && peer.ws.readyState === WebSocket2.OPEN) {
-              peer.ws.send(message);
-            }
-          }
-        }).catch((error) => {
-          console.warn(
-            JSON.stringify({
-              level: "warn",
-              event: "hq.kanban_merge_failed",
-              message: error instanceof Error ? error.message : String(error),
-              timestamp: (/* @__PURE__ */ new Date()).toISOString()
-            })
-          );
-        });
-        persistEvent(event);
-        broadcastEvent(event, browsers);
-        return;
-      }
-      if (event.type === "mailbox.snapshot" && client !== void 0) {
-        const payloadResult = parseHqEventPayload(event.type, event.payload);
-        if (payloadResult.ok) {
-          const payload = payloadResult.payload;
-          client.mailboxes.set(client.projectId + ":" + payload.mailboxId, payload);
-          persistEvent(event);
-          snapshotBroadcaster.broadcast();
-          broadcastEvent(event, browsers);
-          return;
-        }
-        return;
-      }
-      if (event.type === "mailbox.event") {
-        const payloadResult = parseHqEventPayload(event.type, event.payload);
-        if (!payloadResult.ok) {
-          return;
-        }
-        const payload = payloadResult.payload;
-        const sanitizedSummary = truncateHqSummary(payload.summary, 280);
-        const sanitizedEvent = sanitizedSummary === void 0 ? event : { ...event, payload: { ...payload, summary: sanitizedSummary } };
-        persistEvent(sanitizedEvent);
-        broadcastEvent(sanitizedEvent, browsers);
-        return;
-      }
-      if (event.type === "session.snapshot" && client !== void 0) {
-        const result = parseHqEventPayload(event.type, event.payload);
-        if (result.ok) {
-          const payload = result.payload;
-          client.sessions.set(payload.sessionId, { payload, receivedAt: Date.now() });
-          snapshotBroadcaster.broadcast();
-        }
-        return;
-      }
-      if (event.type === "session.ended" && client !== void 0) {
-        const result = parseHqEventPayload(event.type, event.payload);
-        if (result.ok) {
-          const payload = result.payload;
-          client.sessions.delete(payload.sessionId);
-          client.mcpSnapshots.delete(payload.sessionId);
-          for (const [runId, fleet] of client.fleets) {
-            if (fleet.sessionId === payload.sessionId) client.fleets.delete(runId);
-          }
-          snapshotBroadcaster.broadcast();
-        }
-        return;
-      }
-      if (event.type === "fleet.snapshot" && client !== void 0) {
-        const result = parseHqEventPayload(event.type, event.payload);
-        if (result.ok) {
-          const payload = result.payload;
-          client.fleets.set(payload.runId, {
-            payload,
-            ...event.sessionId !== void 0 ? { sessionId: event.sessionId } : {},
-            receivedAt: Date.now()
-          });
-          snapshotBroadcaster.broadcast();
-        }
-        return;
-      }
-      if (event.type === "mcp.health.snapshot" && client !== void 0) {
-        const result = parseHqEventPayload(event.type, event.payload);
-        if (result.ok) {
-          const payload = result.payload;
-          const sessionId = event.sessionId || "unknown";
-          const stamped = payload.servers.map((s) => ({
-            ...s,
-            projectId: client.projectId,
-            clientId: client.clientId
-          }));
-          client.mcpSnapshots.set(sessionId, stamped);
-          snapshotBroadcaster.broadcast();
-        }
-        return;
-      }
-      if (event.type === "session.transcript" && client !== void 0) {
-        const result = parseHqEventPayload(event.type, event.payload);
-        if (result.ok) {
-          const payload = result.payload;
-          let ring = transcripts.get(payload.sessionId);
-          if (!ring) {
-            ring = { entries: [], ...client.machineId ? { machineId: client.machineId } : {} };
-          }
-          for (const entry of payload.entries) ring.entries.push(entry);
-          if (ring.entries.length > TRANSCRIPT_RING_MAX) {
-            ring.entries.splice(0, ring.entries.length - TRANSCRIPT_RING_MAX);
-          }
-          transcripts.delete(payload.sessionId);
-          transcripts.set(payload.sessionId, ring);
-          evictOldest(transcripts, MAX_TRANSCRIPT_SESSIONS);
-          broadcastEvent(event, browsers);
-        }
-        return;
-      }
-      if (event.type === "agent.message") {
-        const p = event.payload;
-        const subId = p && typeof p["subagentId"] === "string" ? p["subagentId"] : void 0;
-        if (subId) {
-          const key = agentRingKey(event.sessionId, subId);
-          let ring = agentMessages.get(key);
-          if (!ring) ring = [];
-          ring.push(agentMessageToEntry(p));
-          if (ring.length > TRANSCRIPT_RING_MAX) ring.splice(0, ring.length - TRANSCRIPT_RING_MAX);
-          agentMessages.delete(key);
-          agentMessages.set(key, ring);
-          evictOldest(agentMessages, MAX_AGENT_RINGS);
-        }
-        persistEvent(event);
-        broadcastEvent(event, browsers);
-        return;
-      }
-      persistEvent(event);
-      broadcastEvent(event, browsers);
+      activeMachines: machines.length,
+      activeAgents: totalAgents,
+      ...options?.tokenStats !== void 0 ? { tokenStats: options.tokenStats } : {}
     }
-  });
-  ws.on("close", () => {
-    clients.delete(ws);
-    snapshotBroadcaster.broadcast();
-  });
+  };
 }
-// src/hq-server/routes.ts
-import { randomUUID as randomUUID3 } from "node:crypto";
-import * as path4 from "node:path";
-import { tokenHasCapability as tokenHasCapability2, validateHqCommand } from "@wrongstack/core/hq";
-import {
-  resolveProjectDir
-} from "@wrongstack/core/coordination";
-// src/hq-static-serve.ts
-import * as fs2 from "node:fs";
-import { createRequire } from "node:module";
-import * as path2 from "node:path";
-var requireFromHere = createRequire(import.meta.url);
-var MIME = {
-  ".html": "text/html; charset=utf-8",
-  ".js": "application/javascript; charset=utf-8",
-  ".mjs": "application/javascript; charset=utf-8",
-  ".css": "text/css; charset=utf-8",
-  ".json": "application/json; charset=utf-8",
-  ".svg": "image/svg+xml",
-  ".png": "image/png",
-  ".jpg": "image/jpeg",
-  ".woff": "font/woff",
-  ".woff2": "font/woff2",
-  ".ico": "image/x-icon"
-};
-var cachedDistDir;
-function resolveHqDistDir() {
-  if (cachedDistDir !== void 0) return cachedDistDir;
-  try {
-    const pkgJson = requireFromHere.resolve("@wrongstack/webui-hq/package.json");
-    const dist = path2.join(path2.dirname(pkgJson), "dist");
-    if (fs2.existsSync(path2.join(dist, "index.html"))) {
-      cachedDistDir = dist;
-      return dist;
+function createSnapshotBroadcaster(clients, browsers, persistence) {
+  let cached = "";
+  let dirty = true;
+  let timer = null;
+  let closed = false;
+  let lastPersistAt = 0;
+  const persistCheckpoint = (snapshot) => {
+    if (persistence === void 0) return;
+    const now = Date.now();
+    if (now - lastPersistAt < HQ_SNAPSHOT_PERSIST_MIN_INTERVAL_MS) return;
+    lastPersistAt = now;
+    persistence.snapshotStore.save(snapshot);
+  };
+  const serialize = () => {
+    if (!dirty && cached.length > 0) return cached;
+    const snapshot = buildSnapshot(clients);
+    const msg = { type: "hq.snapshot", snapshot };
+    cached = JSON.stringify(msg);
+    dirty = false;
+    persistCheckpoint(snapshot);
+    return cached;
+  };
+  const flush = () => {
+    timer = null;
+    if (browsers.size === 0) {
+      if (persistence !== void 0 && Date.now() - lastPersistAt >= HQ_SNAPSHOT_PERSIST_MIN_INTERVAL_MS) {
+        persistCheckpoint(buildSnapshot(clients));
+      }
+      return;
     }
-  } catch {
-  }
-  try {
-    let dir = path2.dirname(new URL(import.meta.url).pathname.replace(/^\/(\w:)/, "$1"));
-    for (let i = 0; i < 8; i++) {
-      const candidate = path2.join(dir, "node_modules", "@wrongstack", "webui-hq", "dist");
-      if (fs2.existsSync(path2.join(candidate, "index.html"))) {
-        cachedDistDir = candidate;
-        return candidate;
+    const data = serialize();
+    for (const ws of browsers) sendGuarded(ws, data);
+  };
+  return {
+    currentSerialized: serialize,
+    broadcast: () => {
+      if (closed) return;
+      dirty = true;
+      if (timer !== null) return;
+      timer = setTimeout(flush, HQ_SNAPSHOT_BROADCAST_DEBOUNCE_MS);
+      timer.unref?.();
+    },
+    close: () => {
+      closed = true;
+      if (timer !== null) {
+        clearTimeout(timer);
+        timer = null;
       }
-      const parent = path2.dirname(dir);
-      if (parent === dir) break;
-      dir = parent;
     }
-  } catch {
-  }
-  cachedDistDir = null;
-  return null;
-}
-function isInsideDist(filePath, distDir) {
-  const rel = path2.relative(distDir, filePath);
-  return rel !== "" && !rel.startsWith("..") && !path2.isAbsolute(rel);
-}
-function isMissingPath(error) {
-  const code = error.code;
-  return code === "ENOENT" || code === "ENOTDIR";
-}
-async function readRegularFile(filePath) {
-  try {
-    const info = await fs2.promises.stat(filePath);
-    if (!info.isFile()) return null;
-    return await fs2.promises.readFile(filePath);
-  } catch (error) {
-    if (isMissingPath(error)) return null;
-    throw error;
-  }
+  };
 }
-async function serveHqStatic(_req, res, urlPath, distDir) {
-  const relPath = urlPath === "/" || urlPath === "" ? "/index.html" : urlPath;
-  let decodedPath;
-  try {
-    decodedPath = decodeURIComponent(relPath);
-  } catch {
-    return { handled: false };
-  }
-  const filePath = path2.join(distDir, decodedPath);
-  if (!isInsideDist(filePath, distDir)) {
-    return { handled: false };
+function buildProjectDetail(clients, projectId) {
+  const projectClients = [];
+  for (const c of clients.values()) {
+    if (c.projectId === projectId) projectClients.push(c);
   }
-  const data = await readRegularFile(filePath);
-  if (data === null) {
-    const indexPath = path2.join(distDir, "index.html");
-    const html = await readRegularFile(indexPath);
-    if (html !== null) {
-      res.writeHead(200, {
-        "Content-Type": MIME[".html"],
-        "Cache-Control": "no-cache",
-        "Content-Length": html.byteLength
-      });
-      res.end(html);
-      return { handled: true };
+  if (projectClients.length === 0) return null;
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const clientRecords = projectClients.map((c) => ({
+    clientId: c.clientId,
+    kind: c.kind,
+    machineId: "",
+    ...c.hostname ? { hostname: c.hostname } : {},
+    ...c.pid ? { pid: c.pid } : {},
+    ...c.version ? { version: c.version } : {},
+    connected: true,
+    connectedAt: c.connectedAt,
+    lastSeenAt: c.lastSeenAt,
+    projectId: c.projectId,
+    capabilities: c.capabilities
+  }));
+  const mailboxPayloads = [];
+  let latestActivity = now;
+  for (const c of projectClients) {
+    for (const snap of c.mailboxes.values()) {
+      mailboxPayloads.push(snap);
+      if (snap.totals.messages > 0) latestActivity = now;
     }
-    return { handled: false };
   }
-  const ext = path2.extname(filePath).toLowerCase();
-  const mime = MIME[ext] ?? "application/octet-stream";
-  const cacheControl = decodedPath.startsWith("/assets/") ? "public, max-age=31536000, immutable" : ext === ".html" ? "no-cache" : "public, max-age=3600";
-  res.writeHead(200, {
-    "Content-Type": mime,
-    "Cache-Control": cacheControl,
-    "Content-Length": data.byteLength
-  });
-  res.end(data);
-  return { handled: true };
+  const primaryProject = projectClients[0].project;
+  const machineIds = Array.from(new Set(projectClients.map((client) => client.project.machineId)));
+  const project = {
+    projectId,
+    projectName: primaryProject.projectName || projectId,
+    projectRootDisplay: primaryProject.projectRoot,
+    machineIds,
+    ...primaryProject.gitBranch ? { gitBranch: primaryProject.gitBranch } : {},
+    activeClients: projectClients.length,
+    activeSessions: 0,
+    activeSubagents: 0,
+    totalCostUsd: 0,
+    lastActivityAt: latestActivity,
+    status: "active"
+  };
+  return {
+    generatedAt: now,
+    project,
+    clients: clientRecords,
+    mailboxes: mailboxPayloads
+  };
+}
+function broadcastEvent(event, browsers) {
+  const msg = { type: "hq.event", event };
+  const data = JSON.stringify(msg);
+  for (const ws of browsers) sendGuarded(ws, data);
+}
+function broadcastCommandStatus(command, browsers) {
+  const data = JSON.stringify({ type: "hq.command_status", command });
+  for (const ws of browsers) sendGuarded(ws, data);
 }
 // src/hq-server/trust-boundary.ts
@@ -1319,9 +1133,9 @@ async function authorizeHqCommand(input) {
 }
 // src/hq-server/routes/auth-handlers.ts
-import { randomUUID as randomUUID2 } from "node:crypto";
+import { randomUUID } from "node:crypto";
 import {
-  DEFAULT_HQ_REDACTION_POLICY,
+  DEFAULT_HQ_REDACTION_POLICY as DEFAULT_HQ_REDACTION_POLICY2,
   hashHqPassword,
   isLoopbackHost,
   mintHqCookieSecret,
@@ -1346,7 +1160,7 @@ async function handleApiAuthStatus(req, res, url, mutableAuth, sessions, require
       ...publicOrigin !== void 0 ? { publicOrigin } : {},
       secureCookies: secureCookies === true,
       loggedIn: auth !== void 0 || localOpenMode,
-      authKind: auth === "cookie" ? "password" : isTokenAuth(auth) ? "token" : localOpenMode ? "open" : void 0
+      authKind: isCookieAuth(auth) ? "password" : isTokenAuth(auth) ? "token" : localOpenMode ? "open" : void 0
     })
   );
 }
@@ -1412,8 +1226,8 @@ async function handleApiLogin(req, res, mutableAuth, sessions, loginAttempts, se
     return;
   }
   loginAttempts.delete(clientIp);
-  const sessionId = randomUUID2();
-  sessions.set(sessionId, { createdAt: Date.now() });
+  const sessionId = randomUUID();
+  sessions.set(sessionId, { createdAt: Date.now(), kind: "password" });
   setHqSessionCookie(
     res,
     serializeHqSessionCookie(sessionId, mutableAuth.cookieSecret),
@@ -1429,7 +1243,7 @@ async function handleApiLogout(req, res, mutableAuth, sessions, secureCookies) {
     mutableAuth,
     sessions
   );
-  if (auth === "cookie") {
+  if (isCookieAuth(auth)) {
     const cookies = parseCookieHeader(req.headers.cookie);
     const raw = cookies[HQ_SESSION_COOKIE];
     if (raw) {
@@ -1471,7 +1285,7 @@ async function handleApiPassword(req, res, mutableAuth, sessions, dataDir, secur
     );
     return;
   }
-  if (auth === "cookie" && mutableAuth.passwordHash !== void 0) {
+  if (isCookieAuth(auth) && mutableAuth.passwordHash !== void 0) {
     const currentPassword = typeof body.currentPassword === "string" ? body.currentPassword : "";
     if (!currentPassword || !await verifyHqPassword(currentPassword, mutableAuth.passwordHash)) {
       res.writeHead(403, { "Content-Type": "application/json" });
@@ -1510,7 +1324,7 @@ async function handleApiPassword(req, res, mutableAuth, sessions, dataDir, secur
       JSON.stringify({
         passwordMode: false,
         tokenMode: mutableAuth.browserTokens.size > 0,
-        loggedIn: auth !== "cookie" && isTokenAuth(auth)
+        loggedIn: !isCookieAuth(auth) && isTokenAuth(auth)
       })
     );
     return;
@@ -1534,9 +1348,9 @@ async function handleApiPassword(req, res, mutableAuth, sessions, dataDir, secur
   }));
   applyAuthFile(mutableAuth, next);
   sessions.clear();
-  if (auth === "cookie" || localOpenBootstrap) {
-    const sessionId = randomUUID2();
-    sessions.set(sessionId, { createdAt: Date.now() });
+  if (isCookieAuth(auth) || localOpenBootstrap) {
+    const sessionId = randomUUID();
+    sessions.set(sessionId, { createdAt: Date.now(), kind: "password" });
     setHqSessionCookie(
       res,
       serializeHqSessionCookie(sessionId, cookieSecret),
@@ -1554,7 +1368,7 @@ async function handleApiPassword(req, res, mutableAuth, sessions, dataDir, secur
 }
 function applyAuthFile(mutableAuth, next) {
   mutableAuth.operatorPolicy = {
-    ...DEFAULT_HQ_REDACTION_POLICY,
+    ...DEFAULT_HQ_REDACTION_POLICY2,
     ...next.redactionPolicy ?? {}
   };
   mutableAuth.operatorPolicyOverride = next.redactionPolicy;
@@ -1573,6 +1387,76 @@ function applyAuthFile(mutableAuth, next) {
   mutableAuth.cookieSecret = next.cookieSecret;
   mutableAuth.alertRules = next.alertRules;
 }
+async function handleApiBootstrap(req, res, mutableAuth, sessions, secureCookies, bootstrapStore) {
+  if (!mutableAuth.cookieSecret) {
+    res.writeHead(503, { "Content-Type": "application/json" });
+    res.end(
+      JSON.stringify({
+        error: {
+          code: "BOOTSTRAP_UNAVAILABLE",
+          message: "Cookie signing is not configured on this HQ server."
+        }
+      })
+    );
+    return;
+  }
+  let body;
+  try {
+    body = JSON.parse(await readRequestBody(req));
+  } catch (error) {
+    writeInvalidBody(res, error);
+    return;
+  }
+  if (typeof body.code !== "string" || body.code.length === 0) {
+    res.writeHead(400, { "Content-Type": "application/json" });
+    res.end(
+      JSON.stringify({ error: { code: "BAD_REQUEST", message: "code is required" } })
+    );
+    return;
+  }
+  const entry = bootstrapStore.consume(body.code);
+  if (!entry) {
+    res.writeHead(401, { "Content-Type": "application/json" });
+    res.end(
+      JSON.stringify({
+        error: {
+          code: "INVALID_OR_EXPIRED_CODE",
+          message: "The bootstrap code is invalid, already used, or expired."
+        }
+      })
+    );
+    return;
+  }
+  const tokenLive = [...mutableAuth.browserTokenObjs.values()].some(
+    (obj) => obj.id === entry.tokenId
+  );
+  if (!tokenLive) {
+    res.writeHead(401, { "Content-Type": "application/json" });
+    res.end(
+      JSON.stringify({
+        error: {
+          code: "TOKEN_REVOKED",
+          message: "The token that issued this bootstrap code has been revoked."
+        }
+      })
+    );
+    return;
+  }
+  const sessionId = randomUUID();
+  sessions.set(sessionId, {
+    createdAt: Date.now(),
+    kind: "token",
+    tokenId: entry.tokenId,
+    ...entry.capabilities !== void 0 ? { capabilities: entry.capabilities } : {}
+  });
+  setHqSessionCookie(
+    res,
+    serializeHqSessionCookie(sessionId, mutableAuth.cookieSecret),
+    secureCookies
+  );
+  res.writeHead(200, { "Content-Type": "application/json" });
+  res.end(JSON.stringify({ loggedIn: true }));
+}
 // src/hq-server/routes/system-handlers.ts
 async function handleApiSystemUpdate(res) {
@@ -1665,11 +1549,11 @@ async function handleApiAlerts(req, res, alertEngine) {
 import * as path3 from "node:path";
 import {
   buildTranscriptFromEvents,
-  resolveHqDataDir as resolveHqDataDir2
+  resolveHqDataDir as resolveHqDataDir3
 } from "@wrongstack/core/hq";
 async function handleApiSessions(res) {
   const { SessionRegistry } = await import("@wrongstack/core/storage");
-  const globalRoot = path3.dirname(resolveHqDataDir2());
+  const globalRoot = path3.dirname(resolveHqDataDir3());
   try {
     const registry = new SessionRegistry(globalRoot);
     const sessions = await registry.list();
@@ -1714,7 +1598,7 @@ async function handleApiSessionEvents(req, res, match, transcripts) {
     res.end(JSON.stringify({ error: "invalid sessionId encoding" }));
     return;
   }
-  const globalRoot = path3.dirname(resolveHqDataDir2());
+  const globalRoot = path3.dirname(resolveHqDataDir3());
   try {
     const registry = new SessionRegistry(globalRoot);
     const entry = await registry.get(sessionId).catch(() => null);
@@ -1849,6 +1733,7 @@ var setHqSecurityHeaders2 = setHqSecurityHeaders;
 var hasTrustedBrowserOrigin2 = hasTrustedBrowserOrigin;
 var authenticateBrowserRequest2 = authenticateBrowserRequest;
 var isTokenAuth2 = isTokenAuth;
+var isCookieAuth2 = isCookieAuth;
 var parseHqSessionCookie2 = parseHqSessionCookie;
 var parseCookieHeader2 = parseCookieHeader;
 var HQ_SESSION_COOKIE2 = HQ_SESSION_COOKIE;
@@ -1857,6 +1742,7 @@ var readRequestBody2 = readRequestBody;
 var writeInvalidBody2 = writeInvalidBody;
 var sanitizeApiError2 = sanitizeApiError;
 var buildHttpUrl2 = buildHttpUrl;
+var buildBootstrapHttpUrl2 = buildBootstrapHttpUrl;
 var buildClientWsUrl2 = buildClientWsUrl;
 var agentRingKey2 = agentRingKey;
 var agentMessageToEntry2 = agentMessageToEntry;
@@ -1884,7 +1770,8 @@ function createHqRouter(deps) {
     authorizeMailboxGateway,
     getMailboxGateway,
     getTokenStats,
-    trustBoundary
+    trustBoundary,
+    bootstrapStore
   } = deps;
   return async (req, res) => {
     try {
@@ -1895,7 +1782,7 @@ function createHqRouter(deps) {
         res.end(JSON.stringify({ error: "forbidden: untrusted request origin" }));
         return;
       }
-      if (url.pathname.startsWith("/api/") && url.pathname !== "/api/auth/status" && url.pathname !== "/api/login" && (requireBrowserAuth || mutableAuth.browserTokens.size > 0 || mutableAuth.passwordHash)) {
+      if (url.pathname.startsWith("/api/") && url.pathname !== "/api/auth/status" && url.pathname !== "/api/login" && url.pathname !== "/api/auth/bootstrap" && (requireBrowserAuth || mutableAuth.browserTokens.size > 0 || mutableAuth.passwordHash)) {
         const auth = authenticateBrowserRequest2(req, url, mutableAuth, sessions);
         if (!auth) {
           const tokenOnly = mutableAuth.browserTokens.size > 0 && !mutableAuth.passwordHash;
@@ -1930,6 +1817,22 @@ function createHqRouter(deps) {
         await handleApiLogin(req, res, mutableAuth, sessions, loginAttempts, secureCookies);
         return;
       }
+      if (url.pathname === "/api/auth/bootstrap" && req.method === "POST") {
+        if (bootstrapStore) {
+          await handleApiBootstrap(req, res, mutableAuth, sessions, secureCookies, bootstrapStore);
+        } else {
+          res.writeHead(503, { "Content-Type": "application/json" });
+          res.end(
+            JSON.stringify({
+              error: {
+                code: "BOOTSTRAP_UNAVAILABLE",
+                message: "Bootstrap exchange is not enabled on this HQ server."
+              }
+            })
+          );
+        }
+        return;
+      }
       if (url.pathname === "/api/logout" && req.method === "POST") {
         await handleApiLogout(req, res, mutableAuth, sessions, secureCookies);
         return;
@@ -2148,8 +2051,7 @@ async function handleApiCommand(req, res, url, mutableAuth, sessions, clients, b
     res.end(JSON.stringify({ error: "unauthorized" }));
     return;
   }
-  const tokenObj = isTokenAuth2(auth) ? mutableAuth.browserTokenObjs.get(auth.token) : void 0;
-  const canEnqueue = auth === "cookie" || !inBrowserTokenMode || tokenObj?.capabilities === void 0 || tokenObj.capabilities.includes("control.enqueue");
+  const canEnqueue = isCookieAuth2(auth) ? auth.tokenId === void 0 || auth.capabilities === void 0 || auth.capabilities.includes("control.enqueue") : isTokenAuth2(auth) ? auth.capabilities === void 0 || auth.capabilities.includes("control.enqueue") : !inBrowserTokenMode;
   if (!canEnqueue) {
     res.writeHead(403, { "Content-Type": "application/json" });
     res.end(JSON.stringify({ error: "forbidden: token lacks control.enqueue capability" }));
@@ -2189,7 +2091,7 @@ async function handleApiCommand(req, res, url, mutableAuth, sessions, clients, b
     );
     return;
   }
-  const commandId = randomUUID3();
+  const commandId = randomUUID2();
   const queued = {
     commandId,
     type: body.type,
@@ -2205,7 +2107,7 @@ async function handleApiCommand(req, res, url, mutableAuth, sessions, clients, b
     );
     return;
   }
-  if (validated.type === "run-command" && !tokenHasCapability2(target.authToken, "control.execute")) {
+  if (validated.type === "run-command" && !tokenHasCapability(target.authToken, "control.execute")) {
     res.writeHead(403, { "Content-Type": "application/json" });
     res.end(
       JSON.stringify({
@@ -2214,13 +2116,13 @@ async function handleApiCommand(req, res, url, mutableAuth, sessions, clients, b
     );
     return;
   }
-  const enqueuedBy = auth === "cookie" ? "password-session" : tokenObj?.id ?? "open-mode";
+  const enqueuedBy = isCookieAuth2(auth) ? auth.tokenId ?? "password-session" : isTokenAuth2(auth) ? auth.id : "open-mode";
   const authorization = await authorizeHqCommand({
     boundary: trustBoundary,
     command: validated,
     commandId,
     enqueuedBy,
-    authMethod: auth === "cookie" ? "session" : "bearer-token",
+    authMethod: isCookieAuth2(auth) ? "session" : "bearer-token",
     target
   });
   if (!authorization.allowed) {
@@ -2251,8 +2153,7 @@ async function handleApiMailboxSend(_req, res, mutableAuth, sessions, dataDir, g
     mutableAuth,
     sessions
   );
-  const token = isTokenAuth2(auth) ? mutableAuth.browserTokenObjs.get(auth.token) : void 0;
-  const canEnqueue = auth === "cookie" || mutableAuth.browserTokens.size === 0 || token?.capabilities === void 0 || token.capabilities.includes("control.enqueue");
+  const canEnqueue = isCookieAuth2(auth) ? auth.tokenId === void 0 || auth.capabilities === void 0 || auth.capabilities.includes("control.enqueue") : isTokenAuth2(auth) ? auth.capabilities === void 0 || auth.capabilities.includes("control.enqueue") : mutableAuth.browserTokens.size === 0;
   if (!canEnqueue) {
     res.writeHead(403, { "Content-Type": "application/json" });
     res.end(JSON.stringify({ error: "forbidden: token lacks control.enqueue capability" }));
@@ -2487,138 +2388,389 @@ function writeHqLanEndpoints(write, handle, browserToken) {
 `);
 }
-// src/hq-server/auth-state.ts
-import { DEFAULT_HQ_REDACTION_POLICY as DEFAULT_HQ_REDACTION_POLICY2, hqAuthContentHash, isTokenExpired, logHqAuthAudit } from "@wrongstack/core/hq";
-var TOKEN_EXPIRY_WARNING_MS = 24 * 60 * 60 * 1e3;
-function liveTokens(list) {
-  return (list ?? []).filter((token) => !isTokenExpired(token));
+// src/hq-server/ws.ts
+import { randomUUID as randomUUID3 } from "node:crypto";
+import {
+  HQ_PROTOCOL_VERSION,
+  HQ_TRANSCRIPT_TEXT_CAP,
+  parseHqEventPayload,
+  parseHqFrame,
+  redactHqEvent,
+  resolveHqRedactionPolicy,
+  tightenHqRedactionPolicy,
+  tokenHasCapability as tokenHasCapability2
+} from "@wrongstack/core/hq";
+import { WebSocket as WebSocket2 } from "ws";
+var MAX_EVENT_LOG = 5e3;
+function handleBrowser(ws, snapshotBroadcaster, browsers) {
+  browsers.add(ws);
+  ws.on("error", (err) => {
+    console.warn(
+      JSON.stringify({
+        level: "warn",
+        event: "hq.browser_socket_error",
+        message: err instanceof Error ? err.message : String(err),
+        timestamp: (/* @__PURE__ */ new Date()).toISOString()
+      })
+    );
+  });
+  sendGuarded(ws, snapshotBroadcaster.currentSerialized());
+  ws.on("close", () => {
+    browsers.delete(ws);
+  });
 }
-function createHqAuthState(authFile, dataDir) {
-  let rawBrowserTokens = authFile.browserTokens ?? [];
-  let rawClientTokens = authFile.clientTokens ?? [];
-  const mutableAuth = {
-    operatorPolicy: { ...DEFAULT_HQ_REDACTION_POLICY2, ...authFile.redactionPolicy ?? {} },
-    operatorPolicyOverride: authFile.redactionPolicy,
-    browserTokens: new Set(liveTokens(authFile.browserTokens).map(({ token }) => token)),
-    clientTokens: new Set(liveTokens(authFile.clientTokens).map(({ token }) => token)),
-    browserTokenObjs: browserTokenMap(authFile.browserTokens),
-    clientTokenObjs: new Map(liveTokens(authFile.clientTokens).map((token) => [token.token, token])),
-    passwordHash: authFile.passwordHash,
-    cookieSecret: authFile.cookieSecret,
-    alertRules: authFile.alertRules
-  };
-  return {
-    mutableAuth,
-    tokenStats: () => {
-      const now = Date.now();
-      const all = [...rawBrowserTokens, ...rawClientTokens];
-      const live = all.filter((token) => !isTokenExpired(token, now));
-      return {
-        browserTotal: mutableAuth.browserTokens.size,
-        clientTotal: mutableAuth.clientTokens.size,
-        expired: all.length - live.length,
-        expiringSoon: live.filter((token) => {
-          if (token.expiresAt === void 0) return false;
-          const expiry = Date.parse(token.expiresAt);
-          return Number.isFinite(expiry) && expiry - now <= TOKEN_EXPIRY_WARNING_MS;
-        }).length
+function handleClient(ws, clients, browsers, eventLog, auth, snapshotBroadcaster, transcripts, agentMessages, persistence, auditLog) {
+  let registered = false;
+  function persistEvent(event) {
+    eventLog.push(event);
+    if (eventLog.length > MAX_EVENT_LOG) eventLog.splice(0, eventLog.length - MAX_EVENT_LOG);
+    if (persistence !== void 0) {
+      persistence.eventLog.append(event);
+      recordTimeseriesSignal(persistence, event);
+    }
+  }
+  ws.on("error", (err) => {
+    console.warn(
+      JSON.stringify({
+        level: "warn",
+        event: "hq.client_socket_error",
+        message: err instanceof Error ? err.message : String(err),
+        timestamp: (/* @__PURE__ */ new Date()).toISOString()
+      })
+    );
+  });
+  ws.on("message", (data) => {
+    const raw = typeof data === "string" ? data : Buffer.isBuffer(data) ? data : new TextDecoder().decode(data);
+    const parsed = parseHqFrame(raw);
+    if (!parsed.ok) {
+      const code = parsed.reason === "invalid-json" ? 1003 : 1008;
+      ws.close(code, `invalid frame: ${parsed.reason}`);
+      return;
+    }
+    const frame = parsed.frame;
+    if (frame.type === "client.hello") {
+      if (registered) {
+        ws.close(1008, "duplicate client.hello");
+        return;
+      }
+      const payload = frame.payload;
+      if (payload.protocolVersion !== HQ_PROTOCOL_VERSION) {
+        ws.close(1008, "protocol version mismatch");
+        return;
+      }
+      const canPublishTelemetry = auth.token === void 0 || tokenHasCapability2(auth.token, "telemetry.publish");
+      const acceptedCapabilities = payload.capabilities.filter(
+        (capability) => capability === "control.receive" || canPublishTelemetry
+      );
+      const declaredRedactionPolicy = resolveHqRedactionPolicy(payload.redactionPolicy);
+      for (const [otherWs, otherClient] of clients) {
+        const samePublisher = otherClient.projectId === payload.project.projectId && otherClient.kind === payload.client.kind && otherClient.pid !== void 0 && payload.client.pid !== void 0 && otherClient.pid === payload.client.pid && (otherClient.machineId || otherClient.project.machineId) === (payload.client.machineId || payload.project.machineId);
+        if (otherWs !== ws && (otherClient.clientId === payload.client.clientId || samePublisher && otherClient.sessions.size === 0)) {
+          clients.delete(otherWs);
+          otherWs.close(4001, "superseded by a newer HQ connection");
+        }
+      }
+      const client = {
+        ws,
+        clientId: payload.client.clientId,
+        projectId: payload.project.projectId,
+        project: payload.project,
+        kind: payload.client.kind,
+        connectedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        lastSeenAt: (/* @__PURE__ */ new Date()).toISOString(),
+        ...payload.client.hostname ? { hostname: payload.client.hostname } : {},
+        ...payload.client.pid ? { pid: payload.client.pid } : {},
+        ...payload.client.version ? { version: payload.client.version } : {},
+        capabilities: acceptedCapabilities,
+        ...auth.token !== void 0 ? { authToken: auth.token } : {},
+        declaredRedactionPolicy,
+        lastEventSeq: 0,
+        mailboxes: /* @__PURE__ */ new Map(),
+        machineId: payload.client.machineId || payload.project.machineId,
+        sessions: /* @__PURE__ */ new Map(),
+        fleets: /* @__PURE__ */ new Map(),
+        mcpSnapshots: /* @__PURE__ */ new Map(),
+        commandQueue: []
       };
-    },
-    apply: (next) => {
-      const newBrowser = next.browserTokens ?? [];
-      const newClient = next.clientTokens ?? [];
-      auditPrunedTokens("browser", rawBrowserTokens, newBrowser, next, dataDir);
-      auditPrunedTokens("client", rawClientTokens, newClient, next, dataDir);
-      rawBrowserTokens = newBrowser;
-      rawClientTokens = newClient;
-      mutableAuth.operatorPolicy = {
-        ...DEFAULT_HQ_REDACTION_POLICY2,
-        ...next.redactionPolicy ?? {}
+      clients.set(ws, client);
+      registered = true;
+      const welcome = {
+        type: "hq.welcome",
+        protocolVersion: HQ_PROTOCOL_VERSION,
+        serverTime: (/* @__PURE__ */ new Date()).toISOString(),
+        acceptedCapabilities,
+        // The operator-configured override (from <dataDir>/auth.json) wins
+        // over the default. The client learns the *effective* policy.
+        redactionPolicy: tightenHqRedactionPolicy(
+          declaredRedactionPolicy,
+          auth.getOperatorPolicy()
+        )
       };
-      mutableAuth.operatorPolicyOverride = next.redactionPolicy;
-      mutableAuth.browserTokens = new Set(liveTokens(next.browserTokens).map(({ token }) => token));
-      mutableAuth.clientTokens = new Set(liveTokens(next.clientTokens).map(({ token }) => token));
-      mutableAuth.browserTokenObjs = browserTokenMap(next.browserTokens);
-      mutableAuth.clientTokenObjs = new Map(
-        liveTokens(next.clientTokens).map((token) => [token.token, token])
-      );
-      mutableAuth.passwordHash = next.passwordHash;
-      mutableAuth.cookieSecret = next.cookieSecret;
-      mutableAuth.alertRules = next.alertRules;
+      ws.send(JSON.stringify(welcome));
+      if (persistence !== void 0) {
+        void persistence.kanban.load(client.projectId).then((payload2) => {
+          sendGuarded(ws, JSON.stringify({ type: "hq.kanban_snapshot", payload: payload2 }));
+        }).catch(() => void 0);
+      }
+      const event = {
+        id: randomUUID3(),
+        type: "client.hello",
+        schemaVersion: HQ_PROTOCOL_VERSION,
+        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+        clientId: payload.client.clientId,
+        projectId: payload.project.projectId,
+        seq: 0,
+        payload: { client: payload.client, project: payload.project }
+      };
+      persistEvent(event);
+      snapshotBroadcaster.broadcast();
+      broadcastEvent(event, browsers);
+      return;
     }
-  };
-}
-function browserTokenMap(tokens) {
-  return new Map(
-    liveTokens(tokens).map((token) => [
-      token.token,
-      {
-        id: token.id,
-        ...token.capabilities !== void 0 ? { capabilities: token.capabilities } : {},
-        ...token.expiresAt !== void 0 ? { expiresAt: token.expiresAt } : {}
+    if (!registered) return;
+    if (frame.type === "client.command_poll") {
+      const client = clients.get(ws);
+      if (client) {
+        if (frame.clientId !== client.clientId || frame.projectId !== client.projectId) {
+          ws.close(1008, "command poll identity mismatch");
+          return;
+        }
+        client.lastSeenAt = (/* @__PURE__ */ new Date()).toISOString();
+        const afterId = frame.afterCommandId;
+        const limit = frame.limit ?? 25;
+        let toSend;
+        if (afterId === void 0) {
+          toSend = client.commandQueue.slice(0, limit);
+        } else {
+          const idx = client.commandQueue.findIndex((c) => c.commandId === afterId);
+          toSend = (idx >= 0 ? client.commandQueue.slice(idx + 1) : client.commandQueue).slice(
+            0,
+            limit
+          );
+        }
+        if (toSend.length > 0) {
+          const batch = JSON.stringify({ type: "hq.command_batch", commands: toSend });
+          if (ws.readyState === WebSocket2.OPEN) ws.send(batch);
+          for (const cmd of toSend) {
+            auditLog?.update(cmd.commandId, { status: "delivered" });
+            const updated = auditLog?.get(cmd.commandId);
+            if (updated !== void 0) broadcastCommandStatus(updated, browsers);
+          }
+        }
+      }
+      return;
+    }
+    if (frame.type === "client.command_ack") {
+      const client = clients.get(ws);
+      if (client) {
+        if (frame.clientId !== client.clientId || frame.projectId !== client.projectId) {
+          ws.close(1008, "command ack identity mismatch");
+          return;
+        }
+        client.lastSeenAt = (/* @__PURE__ */ new Date()).toISOString();
+      }
+      if (client) {
+        const updated = auditLog?.updateForClient(frame.commandId, client.clientId, {
+          status: "acked",
+          ackStatus: frame.status,
+          ...frame.message !== void 0 ? { ackMessage: frame.message } : {},
+          ackedAt: (/* @__PURE__ */ new Date()).toISOString()
+        });
+        if (updated === true) {
+          const entry = auditLog?.get(frame.commandId);
+          if (entry !== void 0) broadcastCommandStatus(entry, browsers);
+        }
+      }
+      return;
+    }
+    if (frame.type === "client.event") {
+      const client = clients.get(ws);
+      if (!client) return;
+      const incomingEvent = frame.event;
+      if (incomingEvent.clientId !== client.clientId || incomingEvent.projectId !== client.projectId) {
+        ws.close(1008, "event identity mismatch");
+        return;
+      }
+      if (!tokenHasCapability2(client.authToken, "telemetry.publish") && auth.token !== void 0) {
+        ws.close(1008, "client token lacks telemetry.publish capability");
+        return;
+      }
+      if (incomingEvent.seq <= client.lastEventSeq) {
+        ws.close(1008, "event sequence must increase monotonically");
+        return;
       }
-    ])
-  );
-}
-function auditPrunedTokens(scope, previous, next, authFile, dataDir) {
-  const previouslyLive = new Set(previous.filter((token) => !isTokenExpired(token)).map(({ id }) => id));
-  const prunedCount = next.filter((token) => isTokenExpired(token) && previouslyLive.has(token.id)).length;
-  if (prunedCount === 0) return;
-  const contentHash = hqAuthContentHash(authFile);
-  logHqAuthAudit(dataDir, {
-    kind: "expired-prune",
-    scope,
-    tokenId: "(aggregate)",
-    prunedCount,
-    ...contentHash !== void 0 ? { contentHash } : {}
-  });
-}
-// src/hq-server/preflight.ts
-import { assessHqExposure, ensureHqFirstRunAuthFile, resolveHqDataDir as resolveHqDataDir3 } from "@wrongstack/core/hq";
-import { HqInsecureExposureError } from "@wrongstack/core/hq";
-async function prepareHqServerStart(options, defaults) {
-  const host = options.host ?? defaults.host;
-  const port = options.port ?? defaults.port;
-  const dataDir = resolveHqDataDir3(options.dataDir);
-  const firstRunAuth = await ensureHqFirstRunAuthFile(dataDir, {
-    warn: (message) => console.warn(
-      JSON.stringify({
-        level: "warn",
-        event: "hq.auth_load_failed",
-        message,
-        timestamp: (/* @__PURE__ */ new Date()).toISOString()
-      })
-    ),
-    actor: resolveAuditActor(),
-    ...options.password !== void 0 ? { password: options.password } : {},
-    ...options.tokenTtlMs !== void 0 ? { tokenTtlMs: options.tokenTtlMs } : {}
+      const parsedPayload = parseHqEventPayload(incomingEvent.type, incomingEvent.payload);
+      if (!parsedPayload.ok) {
+        return;
+      }
+      client.lastEventSeq = incomingEvent.seq;
+      client.lastSeenAt = (/* @__PURE__ */ new Date()).toISOString();
+      const event = redactHqEvent(
+        { ...incomingEvent, payload: parsedPayload.payload },
+        {
+          policy: tightenHqRedactionPolicy(
+            client.declaredRedactionPolicy,
+            auth.getOperatorPolicy()
+          ),
+          projectRoot: client.project.projectRoot,
+          // Chat-transcript events carry full turns — the generic 500-char
+          // summary cap would truncate them a second time after the
+          // publisher already applied the transcript cap.
+          ...incomingEvent.type === "session.transcript" || incomingEvent.type === "agent.message" ? { maxSummaryLength: HQ_TRANSCRIPT_TEXT_CAP } : {}
+        }
+      ).value;
+      if (event.type === "client.heartbeat") {
+        return;
+      }
+      if (event.type === "kanban.snapshot") {
+        const payload = event.payload;
+        if (payload.projectId !== client.projectId || persistence === void 0) return;
+        void persistence.kanban.merge(payload).then((merged) => {
+          const touched = /* @__PURE__ */ new Set();
+          for (const record of payload.boards) touched.add(record.boardId);
+          for (const record of payload.tombstones) touched.add(record.boardId);
+          const delta = {
+            projectId: merged.projectId,
+            generatedAt: merged.generatedAt,
+            boards: merged.boards.filter((record) => touched.has(record.boardId)),
+            tombstones: merged.tombstones.filter((record) => touched.has(record.boardId))
+          };
+          const message = JSON.stringify({ type: "hq.kanban_snapshot", payload: delta });
+          for (const peer of clients.values()) {
+            if (peer.projectId === client.projectId) sendGuarded(peer.ws, message);
+          }
+        }).catch((error) => {
+          console.warn(
+            JSON.stringify({
+              level: "warn",
+              event: "hq.kanban_merge_failed",
+              message: error instanceof Error ? error.message : String(error),
+              timestamp: (/* @__PURE__ */ new Date()).toISOString()
+            })
+          );
+        });
+        persistEvent(event);
+        broadcastEvent(event, browsers);
+        return;
+      }
+      if (event.type === "mailbox.snapshot" && client !== void 0) {
+        const payloadResult = parseHqEventPayload(event.type, event.payload);
+        if (payloadResult.ok) {
+          const payload = payloadResult.payload;
+          client.mailboxes.set(client.projectId + ":" + payload.mailboxId, payload);
+          persistEvent(event);
+          snapshotBroadcaster.broadcast();
+          broadcastEvent(event, browsers);
+          return;
+        }
+        return;
+      }
+      if (event.type === "mailbox.event") {
+        const payloadResult = parseHqEventPayload(event.type, event.payload);
+        if (!payloadResult.ok) {
+          return;
+        }
+        const payload = payloadResult.payload;
+        const sanitizedSummary = truncateHqSummary(payload.summary, 280);
+        const sanitizedEvent = sanitizedSummary === void 0 ? event : { ...event, payload: { ...payload, summary: sanitizedSummary } };
+        persistEvent(sanitizedEvent);
+        broadcastEvent(sanitizedEvent, browsers);
+        return;
+      }
+      if (event.type === "session.snapshot" && client !== void 0) {
+        const result = parseHqEventPayload(event.type, event.payload);
+        if (result.ok) {
+          const payload = result.payload;
+          client.sessions.set(payload.sessionId, { payload, receivedAt: Date.now() });
+          snapshotBroadcaster.broadcast();
+        }
+        return;
+      }
+      if (event.type === "session.ended" && client !== void 0) {
+        const result = parseHqEventPayload(event.type, event.payload);
+        if (result.ok) {
+          const payload = result.payload;
+          client.sessions.delete(payload.sessionId);
+          client.mcpSnapshots.delete(payload.sessionId);
+          for (const [runId, fleet] of client.fleets) {
+            if (fleet.sessionId === payload.sessionId) client.fleets.delete(runId);
+          }
+          snapshotBroadcaster.broadcast();
+        }
+        return;
+      }
+      if (event.type === "fleet.snapshot" && client !== void 0) {
+        const result = parseHqEventPayload(event.type, event.payload);
+        if (result.ok) {
+          const payload = result.payload;
+          client.fleets.set(payload.runId, {
+            payload,
+            ...event.sessionId !== void 0 ? { sessionId: event.sessionId } : {},
+            receivedAt: Date.now()
+          });
+          snapshotBroadcaster.broadcast();
+        }
+        return;
+      }
+      if (event.type === "mcp.health.snapshot" && client !== void 0) {
+        const result = parseHqEventPayload(event.type, event.payload);
+        if (result.ok) {
+          const payload = result.payload;
+          const sessionId = event.sessionId || "unknown";
+          const stamped = payload.servers.map((s) => ({
+            ...s,
+            projectId: client.projectId,
+            clientId: client.clientId
+          }));
+          client.mcpSnapshots.set(sessionId, { servers: stamped, receivedAt: Date.now() });
+          snapshotBroadcaster.broadcast();
+        }
+        return;
+      }
+      if (event.type === "session.transcript" && client !== void 0) {
+        const result = parseHqEventPayload(event.type, event.payload);
+        if (result.ok) {
+          const payload = result.payload;
+          let ring = transcripts.get(payload.sessionId);
+          if (!ring) {
+            ring = { entries: [], ...client.machineId ? { machineId: client.machineId } : {} };
+          }
+          for (const entry of payload.entries) ring.entries.push(entry);
+          if (ring.entries.length > TRANSCRIPT_RING_MAX) {
+            ring.entries.splice(0, ring.entries.length - TRANSCRIPT_RING_MAX);
+          }
+          transcripts.delete(payload.sessionId);
+          transcripts.set(payload.sessionId, ring);
+          evictOldest(transcripts, MAX_TRANSCRIPT_SESSIONS);
+          broadcastEvent(event, browsers);
+        }
+        return;
+      }
+      if (event.type === "agent.message") {
+        const p = event.payload;
+        const subId = p && typeof p["subagentId"] === "string" ? p["subagentId"] : void 0;
+        if (subId) {
+          const key = agentRingKey(event.sessionId, subId);
+          let ring = agentMessages.get(key);
+          if (!ring) ring = [];
+          ring.push(agentMessageToEntry(p));
+          if (ring.length > TRANSCRIPT_RING_MAX) ring.splice(0, ring.length - TRANSCRIPT_RING_MAX);
+          agentMessages.delete(key);
+          agentMessages.set(key, ring);
+          evictOldest(agentMessages, MAX_AGENT_RINGS);
+        }
+        persistEvent(event);
+        broadcastEvent(event, browsers);
+        return;
+      }
+      persistEvent(event);
+      broadcastEvent(event, browsers);
+    }
   });
-  const { authFile } = firstRunAuth;
-  if (options.requireBrowserAuth && (authFile.browserTokens ?? []).length === 0 && authFile.passwordHash === void 0) {
-    throw new HqInsecureExposureError(
-      "HQ public relay requires browser authentication. Set --password or create a browser token first."
-    );
-  }
-  const exposure = assessHqExposure({
-    host,
-    hasBrowserTokens: (authFile.browserTokens ?? []).length > 0,
-    hasPassword: authFile.passwordHash !== void 0,
-    allowInsecure: options.allowInsecureOpen
+  ws.on("close", () => {
+    clients.delete(ws);
+    snapshotBroadcaster.broadcast();
   });
-  if (exposure.kind === "refuse") throw new HqInsecureExposureError(exposure.message);
-  if (exposure.kind === "warn") {
-    console.warn(
-      JSON.stringify({
-        level: "warn",
-        event: "hq.insecure_exposure",
-        message: exposure.message,
-        host,
-        timestamp: (/* @__PURE__ */ new Date()).toISOString()
-      })
-    );
-  }
-  return { host, port, dataDir, firstRunAuth };
 }
 // src/hq-server.ts
@@ -2638,11 +2790,28 @@ async function startHqServer(options = {}) {
   });
   return startHqServerWithAuth(options, host, port, dataDir, firstRunAuth);
 }
-function startHqServerWithAuth(options, host, port, dataDir, firstRunAuth) {
+async function startHqServerWithAuth(options, host, port, dataDir, firstRunAuth) {
   const trustBoundary = options.trustBoundary ?? createCompatibilityTrustBoundary({ policyId: "hq-trusted-host-compat-v1" });
   const authFile = firstRunAuth.authFile;
   const authState = createHqAuthState(authFile, dataDir);
   const { mutableAuth } = authState;
+  if (!mutableAuth.cookieSecret && mutableAuth.browserTokens.size > 0) {
+    const secret = mintHqCookieSecret2();
+    const next = await mutateHqAuthFile2(dataDir, (current) => ({
+      ...current,
+      cookieSecret: secret
+    }));
+    mutableAuth.cookieSecret = next.cookieSecret;
+    console.warn(
+      JSON.stringify({
+        level: "info",
+        event: "hq.cookie_secret_provisioned",
+        message: "Cookie signing secret provisioned for token-mode bootstrap exchange.",
+        timestamp: (/* @__PURE__ */ new Date()).toISOString()
+      })
+    );
+  }
+  const bootstrapStore = new HqBootstrapCodeStore();
   console.warn(
     JSON.stringify({
       level: "info",
@@ -2696,8 +2865,29 @@ function startHqServerWithAuth(options, host, port, dataDir, firstRunAuth) {
       const entries = await fs4.readdir(projectsDir, { withFileTypes: true }).catch(() => []);
       await Promise.all(
         entries.filter((entry) => entry.isDirectory()).map(async (entry) => {
-          const mailbox = getSharedProjectMailbox(path6.join(projectsDir, entry.name));
-          await Promise.all([mailbox.getAgentStatuses(), mailbox.purgeClients()]);
+          const projectDir = path6.join(projectsDir, entry.name);
+          const metadataPath = path6.join(projectDir, ".mailbox-server.json");
+          const ownerPid = await fs4.readFile(metadataPath, "utf8").then((raw) => JSON.parse(raw).pid).catch(() => void 0);
+          if (ownerPid === void 0) return;
+          let ownerAlive = false;
+          try {
+            process.kill(ownerPid, 0);
+            ownerAlive = true;
+          } catch {
+            ownerAlive = false;
+          }
+          if (!ownerAlive) {
+            await fs4.rm(metadataPath, { force: true }).catch(() => {
+            });
+            return;
+          }
+          const mailbox = getSharedProjectMailbox(projectDir);
+          try {
+            await Promise.all([mailbox.getAgentStatuses(), mailbox.purgeClients()]);
+          } finally {
+            await mailbox.close().catch(() => {
+            });
+          }
         })
       );
     })().catch(() => {
@@ -2709,14 +2899,27 @@ function startHqServerWithAuth(options, host, port, dataDir, firstRunAuth) {
       const tokenMode = mutableAuth.browserTokens.size > 0;
       const passwordMode = mutableAuth.passwordHash !== void 0;
       if ((tokenMode || passwordMode) && auth === void 0) {
-        return { allowed: false, status: 401, body: { error: { code: "UNAUTHORIZED", message: "unauthorized" } } };
+        return {
+          allowed: false,
+          status: 401,
+          body: { error: { code: "UNAUTHORIZED", message: "unauthorized" } }
+        };
       }
       const token = isTokenAuth2(auth) ? mutableAuth.browserTokenObjs.get(auth.token) : void 0;
-      const canUseMailbox = auth === "cookie" || !tokenMode || token?.capabilities === void 0 || token.capabilities.includes("control.enqueue");
+      const canUseMailbox = isCookieAuth2(auth) ? auth.capabilities === void 0 || auth.capabilities.includes("control.enqueue") : isTokenAuth2(auth) ? token?.capabilities === void 0 || !!token?.capabilities.includes("control.enqueue") : !tokenMode;
       if (!canUseMailbox) {
-        return { allowed: false, status: 403, body: { error: { code: "FORBIDDEN", message: "forbidden: token lacks control.enqueue capability" } } };
+        return {
+          allowed: false,
+          status: 403,
+          body: {
+            error: {
+              code: "FORBIDDEN",
+              message: "forbidden: token lacks control.enqueue capability"
+            }
+          }
+        };
       }
-      const identity = isTokenAuth2(auth) ? auth.id : auth === "cookie" ? "cookie" : "open";
+      const identity = isTokenAuth2(auth) ? auth.id : isCookieAuth2(auth) ? "cookie" : "open";
       return { allowed: true, rateLimitKey: `hq:${identity}:${projectDir}` };
     };
     const getMailboxGateway = (projectDir) => {
@@ -2768,7 +2971,11 @@ function startHqServerWithAuth(options, host, port, dataDir, firstRunAuth) {
       persistence.timeseries.flush();
     }, 6e4);
     timeseriesFlushTimer.unref?.();
-    const snapshotBroadcaster = createSnapshotBroadcaster(clients, browsers, persistence);
+    const snapshotBroadcaster = createSnapshotBroadcaster(
+      clients,
+      browsers,
+      persistence
+    );
     snapshotBroadcaster.currentSerialized();
     const stopAlertEngine = alertEngine.startPeriodic(
       () => buildSnapshot(clients, { tokenStats: authState.tokenStats() }),
@@ -2835,7 +3042,8 @@ function startHqServerWithAuth(options, host, port, dataDir, firstRunAuth) {
       secureCookies: options.secureCookies,
       authorizeMailboxGateway,
       getMailboxGateway,
-      getTokenStats: () => authState.tokenStats()
+      getTokenStats: () => authState.tokenStats(),
+      bootstrapStore
     };
     const handleRequest = createHqRouter(routerDeps);
     const httpServer = http.createServer((req, res) => {
@@ -2843,7 +3051,10 @@ function startHqServerWithAuth(options, host, port, dataDir, firstRunAuth) {
     });
     const wss = new WebSocketServer({ noServer: true, maxPayload: 1 * 1024 * 1024 });
     const browserHeartbeatTimer = setInterval(() => {
-      const heartbeat = JSON.stringify({ type: "hq.heartbeat", serverTime: (/* @__PURE__ */ new Date()).toISOString() });
+      const heartbeat = JSON.stringify({
+        type: "hq.heartbeat",
+        serverTime: (/* @__PURE__ */ new Date()).toISOString()
+      });
       for (const browser of browsers) {
         if (browser.readyState === WebSocket3.OPEN) browser.send(heartbeat);
       }
@@ -2858,7 +3069,12 @@ function startHqServerWithAuth(options, host, port, dataDir, firstRunAuth) {
       }
       if (!hasTrustedBrowserOrigin2(req, host, listeningPort, trustedPublicOrigins)) {
         socket.write(
-          "HTTP/1.1 403 Forbidden\r\nContent-Type: application/json\r\nConnection: close\r\n\r\n" + JSON.stringify({ error: { code: "INVALID_ORIGIN", message: "Cross-origin WebSocket upgrade rejected." } })
+          "HTTP/1.1 403 Forbidden\r\nContent-Type: application/json\r\nConnection: close\r\n\r\n" + JSON.stringify({
+            error: {
+              code: "INVALID_ORIGIN",
+              message: "Cross-origin WebSocket upgrade rejected."
+            }
+          })
         );
         socket.destroy();
         return;
@@ -2868,12 +3084,21 @@ function startHqServerWithAuth(options, host, port, dataDir, firstRunAuth) {
       if (needsAuth) {
         const supplied = url.searchParams.get("token") ?? "";
         const tokenValid = timingSafeTokenMatch(tokenSet, supplied) !== void 0;
-        const cookieValid = pathname === "/ws/browser" && mutableAuth.passwordHash !== void 0 && mutableAuth.cookieSecret !== void 0 && (() => {
+        const cookieValid = pathname === "/ws/browser" && mutableAuth.cookieSecret !== void 0 && (() => {
           const cookies = parseCookieHeader2(req.headers.cookie);
           const raw = cookies[HQ_SESSION_COOKIE2];
           if (!raw) return false;
           const sessionId = parseHqSessionCookie2(raw, mutableAuth.cookieSecret);
-          return sessionId !== void 0 && sessions.has(sessionId);
+          if (sessionId === void 0) return false;
+          const session = sessions.get(sessionId);
+          if (!session || Date.now() - session.createdAt >= HQ_SESSION_MAX_AGE_MS)
+            return false;
+          if (session.kind === "token" && session.tokenId !== void 0) {
+            return [...mutableAuth.browserTokenObjs.values()].some(
+              (obj) => obj.id === session.tokenId
+            );
+          }
+          return true;
         })();
         if (!tokenValid && !cookieValid) {
           socket.write(
@@ -2937,7 +3162,12 @@ function startHqServerWithAuth(options, host, port, dataDir, firstRunAuth) {
       },
       {
         warn: (msg) => console.warn(
-          JSON.stringify({ level: "warn", event: "hq.auth.reload_failed", message: msg, timestamp: (/* @__PURE__ */ new Date()).toISOString() })
+          JSON.stringify({
+            level: "warn",
+            event: "hq.auth.reload_failed",
+            message: msg,
+            timestamp: (/* @__PURE__ */ new Date()).toISOString()
+          })
         )
       }
     );
@@ -2969,9 +3199,20 @@ function startHqServerWithAuth(options, host, port, dataDir, firstRunAuth) {
         const hqUrl = `http://${host === "0.0.0.0" ? "127.0.0.1" : host}:${actualPort}`;
         await writeHqRuntimeMarker(dataDir, hqUrl).catch(() => {
         });
+        const browserTokenObj = mutableAuth.browserTokenObjs.get(browserToken ?? "");
+        let browserUrl;
+        if (browserToken && browserTokenObj) {
+          const code = bootstrapStore.issue({
+            tokenId: browserTokenObj.id,
+            ...browserTokenObj.capabilities !== void 0 ? { capabilities: browserTokenObj.capabilities } : {}
+          });
+          browserUrl = buildBootstrapHttpUrl2(host, actualPort, code);
+        } else {
+          browserUrl = buildHttpUrl2(host, actualPort);
+        }
         const startupInfo = {
           dataDir,
-          browserUrl: buildHttpUrl2(host, actualPort, browserToken),
+          browserUrl,
           clientUrl: buildClientWsUrl2(host, actualPort, clientToken),
           clientEnv: {
             WRONGSTACK_HQ_URL: hqUrl,
@@ -2989,7 +3230,9 @@ function startHqServerWithAuth(options, host, port, dataDir, firstRunAuth) {
           trustPublicOrigin: (origin) => {
             const parsed = new URL(origin);
             if (parsed.protocol !== "https:" || parsed.origin !== origin) {
-              throw new TypeError("Trusted HQ public origin must be an exact HTTPS origin without a path.");
+              throw new TypeError(
+                "Trusted HQ public origin must be an exact HTTPS origin without a path."
+              );
             }
             trustedPublicOrigins.add(parsed.origin.toLowerCase());
           },
@@ -3007,6 +3250,7 @@ function startHqServerWithAuth(options, host, port, dataDir, firstRunAuth) {
             stopAlertEngine();
             authWatcher.close();
             snapshotBroadcaster.close();
+            bootstrapStore.clear();
             persistence.timeseries.flush();
             for (const ws of browsers) ws.close(1001, "HQ shutting down");
             for (const ws of clients.keys()) ws.close(1001, "HQ shutting down");
@@ -3056,4 +3300,4 @@ export {
   startHqServer,
   HqInsecureExposureError2 as HqInsecureExposureError
 };
-//# sourceMappingURL=chunk-X5DQTPXT.js.map
+//# sourceMappingURL=chunk-OI7GWJDS.js.map