@wrongstack/cli 0.299.0 → 0.300.0

package/dist/hq-server.d.ts

@@ -60,6 +60,25 @@ export interface HqServerOptions {
      * `--hq-token-ttl-ms` CLI flag.
      */
     tokenTtlMs?: number;
+    /**
+     * How many trusted reverse proxies sit between a browser and this server.
+     * Controls which address the login backoff keys on (WS-106).
+     *
+     * Default `0`: `X-Forwarded-For` is ignored entirely and the socket peer is
+     * used — correct for a direct bind, and the only safe default, because the
+     * header is client-supplied and honouring it unasked would let an attacker
+     * mint a fresh rate-limit identity per request.
+     *
+     * Set it to the real hop count when HQ runs behind a tunnel or relay
+     * (`--hq-public-url`, `--hq-require-browser-auth`). Without it every request
+     * arrives from the tunnel's own address, so all users share one backoff
+     * bucket: one attacker locks out everyone, and a distributed attacker is not
+     * limited per-source at all. `1` covers the common single-tunnel case.
+     *
+     * Only the rightmost `n` forwarded entries are ever read — see
+     * `hq-server/client-address.ts`. Set via `--hq-trusted-proxy-hops`.
+     */
+    trustedProxyHops?: number;
 }
 export interface HqStartupConnectionInfo {
     dataDir: string;

package/dist/index.js

@@ -13,20 +13,20 @@ import {
 import {
   patchConfig
 } from "./chunk-TYO2OVAD.js";
+import {
+  DEFAULT_PORT
+} from "./chunk-GYDQABMA.js";
+import "./chunk-Q5GTM25S.js";
 import {
   helpCmd,
   versionCmd
 } from "./chunk-ARWGQUB3.js";
-import {
-  discoverAndMergeProviders
-} from "./chunk-TGDHN4LM.js";
-import {
-  DEFAULT_PORT
-} from "./chunk-2SLSUDYS.js";
-import "./chunk-Q5GTM25S.js";
 import {
   CLI_VERSION
 } from "./chunk-XJXDOF63.js";
+import {
+  discoverAndMergeProviders
+} from "./chunk-4GVH7V3S.js";
 import {
   runUpdateCommand
 } from "./chunk-I5MEUFDI.js";
@@ -36,11 +36,11 @@ import {
   parseArgs,
   runPicker,
   saveToGlobalConfig
-} from "./chunk-ZNZJ34RF.js";
+} from "./chunk-PEMN4T5O.js";
 import {
   isKeylessLocalProvider,
   visibleModelIds
-} from "./chunk-66T43Q4Y.js";
+} from "./chunk-N7ULWBO5.js";
 import {
   mutateConfigProviders,
   normalizeKeys,
@@ -1495,9 +1495,9 @@ function compactSingleLine(text) {
 
 // src/subcommands/index.ts
 var loaders = {
-  acp: async () => (await import("./acp-S4LZQB66.js")).acpCmd,
+  acp: async () => (await import("./acp-IDNS2YVE.js")).acpCmd,
   init: async () => (await import("./init-E2NDDOHI.js")).initCmd,
-  auth: async () => (await import("./auth-G5YKKSRH.js")).authCmd,
+  auth: async () => (await import("./auth-6T6ZOT2R.js")).authCmd,
   update: async () => (await import("./update-MV6TUACD.js")).updateCmd,
   sessions: async () => (await import("./sessions-config-NLCMK3BY.js")).sessionsCmd,
   config: async () => (await import("./sessions-config-NLCMK3BY.js")).configCmd,
@@ -1506,23 +1506,23 @@ var loaders = {
   audit: async () => (await import("./audit-2ZSFGNIF.js")).auditCmd,
   tools: async () => (await import("./tools-skills-UNKLOB7M.js")).toolsCmd,
   skills: async () => (await import("./tools-skills-UNKLOB7M.js")).skillsCmd,
-  providers: async () => (await import("./providers-models-GDELBHZK.js")).providersCmd,
-  models: async () => (await import("./providers-models-GDELBHZK.js")).modelsCmd,
+  providers: async () => (await import("./providers-models-K6RT7ABI.js")).providersCmd,
+  models: async () => (await import("./providers-models-K6RT7ABI.js")).modelsCmd,
   mcp: async () => (await import("./mcp-CYLPUEHC.js")).mcpCmd,
-  plugin: async () => (await import("./plugin-usage-VTL7ZTVC.js")).pluginCmd,
-  plugins: async () => (await import("./plugin-usage-VTL7ZTVC.js")).pluginCmd,
+  plugin: async () => (await import("./plugin-usage-EOG4ET4S.js")).pluginCmd,
+  plugins: async () => (await import("./plugin-usage-EOG4ET4S.js")).pluginCmd,
   diag: async () => (await import("./diag-doctor-OQ3AA63O.js")).diagCmd,
   doctor: async () => (await import("./diag-doctor-OQ3AA63O.js")).doctorCmd,
   export: async () => (await import("./export-TPORYVRZ.js")).exportCmd,
-  usage: async () => (await import("./plugin-usage-VTL7ZTVC.js")).usageCmd,
+  usage: async () => (await import("./plugin-usage-EOG4ET4S.js")).usageCmd,
   version: async () => (await import("./version-help-ASKQYXDJ.js")).versionCmd,
   help: async () => (await import("./version-help-ASKQYXDJ.js")).helpCmd,
   projects: async () => (await import("./projects-XE76NFNZ.js")).projectsCmd,
-  modeldiag: async () => (await import("./modeldiag-HENYJ4N7.js")).modeldiagCmd,
+  modeldiag: async () => (await import("./modeldiag-YOQZHBQV.js")).modeldiagCmd,
   quick: async () => (await import("./quick-VIO2BEHS.js")).quickCmd,
   bench: async () => (await import("./bench-7ZDWSNEF.js")).benchCmd,
   chronicle: async () => (await import("./chronicle-QQEQFSSE.js")).chronicleCmd,
-  hq: async () => (await import("./hq-BDO56CX6.js")).hqCmd,
+  hq: async () => (await import("./hq-DVDD4XPV.js")).hqCmd,
   mailbox: async () => (await import("./mailbox-serve-DBOOOOWZ.js")).mailboxServeCmd,
   permissions: async () => (await import("./permissions-FNYLZIL4.js")).permissionsCmd,
   project: async () => (await import("./project-BLQ3ALVL.js")).projectCmd,
@@ -2159,7 +2159,7 @@ async function isPortInUse(host, port) {
 }
 async function handleHqShortCircuit(flags) {
   if (flags["hq"] !== true) return null;
-  const { startHqServer } = await import("./hq-server-RJLJJZU7.js");
+  const { startHqServer } = await import("./hq-server-DQHLNHDL.js");
   const tunnelRequested = flags["tunnel"] === true;
   const host = typeof flags["host"] === "string" ? flags["host"] : tunnelRequested ? "127.0.0.1" : HQ_CLI_DEFAULT_HOST;
   if (tunnelRequested && !isLoopbackHost(host)) {
@@ -3149,7 +3149,7 @@ async function initializeCli(argv) {
 async function main(argv) {
   const cliCtx = await initializeCli(argv);
   if (typeof cliCtx === "number") return cliCtx;
-  const { runInteractive } = await import("./cli-main-3MQDFSYK.js");
+  const { runInteractive } = await import("./cli-main-7B3G2YSG.js");
   return runInteractive(cliCtx);
 }
 

package/dist/{modeldiag-HENYJ4N7.js → modeldiag-YOQZHBQV.js}

@@ -1,6 +1,6 @@
 import {
   discoverAndMergeProviders
-} from "./chunk-TGDHN4LM.js";
+} from "./chunk-4GVH7V3S.js";
 import {
   mutateConfigProviders,
   normalizeKeys,
@@ -1287,4 +1287,4 @@ ${color2.dim('Enter numbers or provider IDs (comma-separated, or "all"):')}
 export {
   modeldiagCmd
 };
-//# sourceMappingURL=modeldiag-HENYJ4N7.js.map
+//# sourceMappingURL=modeldiag-YOQZHBQV.js.map

package/dist/{plugin-usage-VTL7ZTVC.js → plugin-usage-EOG4ET4S.js}

@@ -1,6 +1,6 @@
 import {
   runPluginManagementCommand
-} from "./chunk-PEKUKUCH.js";
+} from "./chunk-3MWUZMOL.js";
 import {
   activeProfileConfigPath
 } from "./chunk-DPJZQCVP.js";
@@ -37,4 +37,4 @@ export {
   pluginCmd,
   usageCmd
 };
-//# sourceMappingURL=plugin-usage-VTL7ZTVC.js.map
+//# sourceMappingURL=plugin-usage-EOG4ET4S.js.map

package/dist/{plugins-ETY6W3DC.js → plugins-56CMWMPR.js}

@@ -7,8 +7,8 @@ import {
   pluginNameFromSpec,
   setupPlugins,
   warnIfDeprecatedPluginName
-} from "./chunk-4U3DMA2Y.js";
-import "./chunk-PEKUKUCH.js";
+} from "./chunk-4WJKVQJY.js";
+import "./chunk-3MWUZMOL.js";
 import "./chunk-TYO2OVAD.js";
 import "./chunk-7OCVIDC7.js";
 export {
@@ -21,4 +21,4 @@ export {
   setupPlugins,
   warnIfDeprecatedPluginName
 };
-//# sourceMappingURL=plugins-ETY6W3DC.js.map
+//# sourceMappingURL=plugins-56CMWMPR.js.map

package/dist/{providers-models-GDELBHZK.js → providers-models-K6RT7ABI.js}

@@ -1,6 +1,6 @@
 import {
   visibleModelIds
-} from "./chunk-66T43Q4Y.js";
+} from "./chunk-N7ULWBO5.js";
 import {
   mutateConfigProviders
 } from "./chunk-PJHET45A.js";
@@ -127,7 +127,7 @@ var modelsCmd = async (args, deps) => {
       return 1;
     }
   }
-  const flags = parseFlags(args);
+  const flags = subcommandFlags(args, deps);
   const search = typeof flags["search"] === "string" ? flags["search"].toLowerCase() : "";
   const perPage = Number(flags["per-page"]) > 0 ? Number(flags["per-page"]) : DEFAULT_PER_PAGE;
   const page = Math.max(1, Number(flags["page"]) || 1);
@@ -138,10 +138,10 @@ var modelsCmd = async (args, deps) => {
     );
     return 1;
   }
-  let lookupId = providerId;
-  const savedAlias = deps.config.providers?.[providerId];
-  if (savedAlias?.type && savedAlias.type !== providerId) lookupId = savedAlias.type;
-  const provider = await deps.modelsRegistry.getProvider(lookupId);
+  const { providerId: lookupId, provider } = await getCatalogProviderForConfigProvider(
+    providerId,
+    deps
+  );
   if (!provider) {
     deps.renderer.writeError(
       lookupId !== providerId ? `Alias "${providerId}" points at catalog id "${lookupId}" which is not in the cache.` : `Provider "${providerId}" not in catalog.`
@@ -234,11 +234,33 @@ ${navLines.join(" \xB7 ")}
 function aliasProviderId(configProviderId, cfg) {
   return cfg?.type && cfg.type !== configProviderId ? cfg.type : configProviderId;
 }
+async function discoverProviderModels(deps, ids) {
+  if (!("mergeOverlay" in deps.modelsRegistry)) return void 0;
+  try {
+    const { discoverAndMergeProviders } = await import("./auto-discover-providers-DRW4OZHG.js");
+    await discoverAndMergeProviders({
+      config: deps.config,
+      registry: deps.modelsRegistry,
+      cacheDir: deps.paths.cacheDir
+    });
+  } catch {
+    return void 0;
+  }
+  for (const id of ids) {
+    const found = await deps.modelsRegistry.getProvider(id);
+    if (found) return found;
+  }
+  return void 0;
+}
 async function getCatalogProviderForConfigProvider(providerId, deps) {
   const cfg = deps.config.providers?.[providerId];
   const lookupId = aliasProviderId(providerId, cfg);
   const provider = await deps.modelsRegistry.getProvider(lookupId);
-  return { providerId: lookupId, provider };
+  if (provider) return { providerId: lookupId, provider };
+  return {
+    providerId: lookupId,
+    provider: await discoverProviderModels(deps, [lookupId, providerId])
+  };
 }
 function uniqueStrings(values) {
   return [...new Set(values.map((v) => v.trim()).filter(Boolean))];
@@ -478,13 +500,16 @@ function parseSizeFlag(raw) {
   if (unit === "k") return Math.round(num * 1e3);
   return Math.round(num);
 }
+function subcommandFlags(args, deps) {
+  return { ...deps.flags ?? {}, ...parseFlags(args) };
+}
 function parseBoolFlag(flags, key) {
   if (flags[key] === true || flags[key] === "true") return true;
   if (flags[`no-${key}`] !== void 0) return false;
   return void 0;
 }
 async function modelsAdd(args, deps) {
-  const flags = parseFlags(args);
+  const flags = subcommandFlags(args, deps);
   const pos = positionals(args);
   const modelId = pos[0];
   if (!modelId) {
@@ -586,4 +611,4 @@ export {
   modelsCmd,
   providersCmd
 };
-//# sourceMappingURL=providers-models-GDELBHZK.js.map
+//# sourceMappingURL=providers-models-K6RT7ABI.js.map

package/dist/slash-commands/command-context.d.ts

@@ -130,6 +130,25 @@ export interface SlashCommandContext {
      * Get live coordinator status for /fleet. Returns null when no fleet is active.
      */
     onFleetStatus?: (() => import('@wrongstack/core/types').CoordinatorStatus | null) | undefined;
+    /**
+     * Read-only concurrency + lifetime spawn budget for `/fleet status`.
+     * Returns null when no fleet host is available.
+     */
+    onFleetBudget?: (() => {
+        maxConcurrent: number;
+        activeAgents: number;
+        maxSpawns: number;
+        usedSpawns: number;
+        remainingSpawns: number;
+        maxTokens?: number | undefined;
+        usedTokens?: number | undefined;
+        remainingTokens?: number | undefined;
+        maxCostUsd?: number | undefined;
+        usedCostUsd?: number | undefined;
+        remainingCostUsd?: number | undefined;
+        checkpointMaxSpawns?: number | undefined;
+        ceilingMismatch?: boolean | undefined;
+    } | null) | undefined;
     /**
      * Get fleet usage summary for /fleet usage.
      */

package/dist/webui-server/setup-events.d.ts

@@ -29,6 +29,23 @@ export interface SetupEventsDeps {
     eventUnsubscribers: Array<() => void>;
     globalConfigPath?: string | undefined;
     onFleetBroadcaster?: ((fn: () => Promise<void>) => void) | undefined;
+    /**
+     * Live fleet budget snapshot (issue #323). Merged into
+     * `fleet.concurrency_update` so the WebUI can show used/remaining spawns
+     * without a probe spawn.
+     */
+    getFleetBudget?: (() => {
+        maxSpawns?: number | undefined;
+        usedSpawns?: number | undefined;
+        remainingSpawns?: number | undefined;
+        maxConcurrent?: number | undefined;
+        activeAgents?: number | undefined;
+        maxSpawnsSource?: string | undefined;
+        maxConcurrentSource?: string | undefined;
+        effectiveSource?: string | undefined;
+        checkpointMaxSpawns?: number | undefined;
+        ceilingMismatch?: boolean | undefined;
+    } | null) | undefined;
 }
 /** CLI adapter around the canonical EventBus→WebSocket subscription graph. */
 export declare function createSetupEvents(deps: SetupEventsDeps): () => void;

package/dist/webui-server/terminal-log-view.d.ts

@@ -6,25 +6,42 @@ interface ConsoleTarget {
     error: ConsoleMethod;
     debug: ConsoleMethod;
 }
-export interface BoundedTerminalLogViewOptions {
-    maxLines?: number | undefined;
-    refreshMs?: number | undefined;
+export interface QuietSurfaceConsoleOptions {
     isTTY?: boolean | undefined;
+    /** Pass everything through untouched (the `WEBUI_VERBOSE=1` escape hatch). */
+    verbose?: boolean | undefined;
     consoleTarget?: ConsoleTarget | undefined;
-    write?: ((chunk: string) => void) | undefined;
-    setIntervalFn?: ((callback: () => void, delay: number) => NodeJS.Timeout) | undefined;
-    clearIntervalFn?: ((timer: NodeJS.Timeout) => void) | undefined;
+    /** Ring-buffer size for {@link QuietSurfaceConsole.recent}. */
+    bufferLines?: number | undefined;
 }
-export interface BoundedTerminalLogView {
+export interface QuietSurfaceConsole {
+    /** `false` when the console was left untouched (non-TTY or verbose). */
     readonly enabled: boolean;
-    redraw(): void;
+    /** Chatter lines dropped from the terminal so far. */
+    readonly mutedCount: number;
+    /** Newest muted lines, oldest first — for a diagnostic dump on failure. */
+    recent(): readonly string[];
     stop(): void;
 }
 /**
- * Periodically redraw an interactive WebUI/SimpleUI terminal with only its
- * newest physical log lines. Non-TTY output is deliberately untouched so
- * redirected output and log collectors retain the complete append-only log.
+ * Keep an interactive WebUI/SimpleUI terminal quiet while the browser owns
+ * the output surface.
+ *
+ * Two things fill that terminal, and this handles both:
+ *
+ *   - **Chatter.** Every `console.log`/`info`/`debug` from the server is
+ *     progress the browser already shows. Those are dropped from the
+ *     terminal (still counted, and the newest are kept in memory for a
+ *     failure dump); `console.warn`/`error` are forwarded untouched.
+ *
+ *   - **Repetition.** A warning that fires on a timer used to append an
+ *     identical line every tick until the terminal was pages deep in the
+ *     same text. Consecutive identical lines now collapse into a single
+ *     `↑ previous line repeated N×` notice emitted when the streak ends.
+ *
+ * Non-TTY output is deliberately untouched so redirected output and log
+ * collectors retain the complete append-only log, as is `WEBUI_VERBOSE=1`.
  */
-export declare function startBoundedTerminalLogView(options?: BoundedTerminalLogViewOptions): BoundedTerminalLogView;
+export declare function startQuietSurfaceConsole(options?: QuietSurfaceConsoleOptions): QuietSurfaceConsole;
 export {};
 //# sourceMappingURL=terminal-log-view.d.ts.map

package/dist/{webui-server-PCLSXX6L.js → webui-server-G3EKFXLL.js}

@@ -679,9 +679,23 @@ function createSetupEvents(deps) {
   let fleetConcurrency = 0;
   let fleetConcurrencyMax = 4;
   const emitConcurrency = () => {
+    const budget = deps.getFleetBudget?.() ?? null;
     deps.broadcast({
       type: "fleet.concurrency_update",
-      payload: deps.sessionPayload({ fleetConcurrency, fleetConcurrencyMax })
+      payload: deps.sessionPayload({
+        fleetConcurrency: budget?.activeAgents ?? fleetConcurrency,
+        fleetConcurrencyMax: budget?.maxConcurrent ?? fleetConcurrencyMax,
+        ...budget ? {
+          maxSpawns: budget.maxSpawns,
+          usedSpawns: budget.usedSpawns,
+          remainingSpawns: budget.remainingSpawns,
+          maxSpawnsSource: budget.maxSpawnsSource,
+          maxConcurrentSource: budget.maxConcurrentSource,
+          effectiveSource: budget.effectiveSource,
+          checkpointMaxSpawns: budget.checkpointMaxSpawns,
+          ceilingMismatch: budget.ceilingMismatch
+        } : {}
+      })
     });
   };
   return function setupEvents() {
@@ -761,24 +775,35 @@ import {
 
 // src/webui-server/terminal-log-view.ts
 import { format } from "node:util";
-var DEFAULT_MAX_LINES = 5;
-var DEFAULT_REFRESH_MS = 5e3;
-var CLEAR_VISIBLE_TERMINAL = "\x1B[2J\x1B[H";
-function startBoundedTerminalLogView(options = {}) {
-  const isTTY = options.isTTY ?? process.stdout.isTTY === true;
-  if (!isTTY) {
-    return { enabled: false, redraw: () => {
-    }, stop: () => {
-    } };
+var DEFAULT_BUFFER_LINES = 200;
+var MUTED_LEVELS = ["log", "info", "debug"];
+var FORWARDED_LEVELS = ["warn", "error"];
+var DISABLED = {
+  enabled: false,
+  mutedCount: 0,
+  recent: () => [],
+  stop: () => {
+  }
+};
+function envVerbose() {
+  for (const name of ["WEBUI_VERBOSE", "WRONGSTACK_WEBUI_VERBOSE"]) {
+    const value = process.env[name]?.trim().toLowerCase();
+    if (value === "1" || value === "true" || value === "yes" || value === "on") return true;
   }
-  const maxLines = Math.max(1, Math.trunc(options.maxLines ?? DEFAULT_MAX_LINES));
-  const refreshMs = Math.max(100, Math.trunc(options.refreshMs ?? DEFAULT_REFRESH_MS));
+  return false;
+}
+function startQuietSurfaceConsole(options = {}) {
+  const isTTY = options.isTTY ?? process.stdout.isTTY === true;
+  const verbose = options.verbose ?? envVerbose();
+  if (!isTTY || verbose) return DISABLED;
+  const bufferLines = Math.max(1, Math.trunc(options.bufferLines ?? DEFAULT_BUFFER_LINES));
   const target = options.consoleTarget ?? console;
-  const write = options.write ?? ((chunk) => process.stdout.write(chunk));
-  const setIntervalFn = options.setIntervalFn ?? setInterval;
-  const clearIntervalFn = options.clearIntervalFn ?? clearInterval;
-  const lines = [];
+  const muted = [];
+  let mutedCount = 0;
   let stopped = false;
+  let lastLine = null;
+  let lastEmit = null;
+  let repeats = 0;
   const originals = {
     log: target.log,
     info: target.info,
@@ -787,35 +812,47 @@ function startBoundedTerminalLogView(options = {}) {
     debug: target.debug
   };
   const wrappers = {};
-  const remember = (args) => {
-    for (const line of format(...args).split(/\r?\n/u)) {
-      lines.push(line);
-      if (lines.length > maxLines) lines.shift();
-    }
+  const flushRepeats = () => {
+    if (repeats === 0 || !lastEmit) return;
+    const count = repeats;
+    repeats = 0;
+    lastEmit.call(target, `  \u2191 previous line repeated ${count}\xD7`);
   };
-  for (const level of Object.keys(originals)) {
+  for (const level of MUTED_LEVELS) {
+    const wrapper = (...args) => {
+      mutedCount += 1;
+      muted.push(format(...args));
+      if (muted.length > bufferLines) muted.shift();
+    };
+    wrappers[level] = wrapper;
+    target[level] = wrapper;
+  }
+  for (const level of FORWARDED_LEVELS) {
     const original = originals[level];
     const wrapper = (...args) => {
-      remember(args);
+      const line = format(...args);
+      if (line === lastLine) {
+        repeats += 1;
+        return;
+      }
+      flushRepeats();
+      lastLine = line;
+      lastEmit = original;
       original.apply(target, args);
     };
     wrappers[level] = wrapper;
     target[level] = wrapper;
   }
-  const redraw = () => {
-    if (stopped || lines.length === 0) return;
-    write(`${CLEAR_VISIBLE_TERMINAL}${lines.join("\n")}
-`);
-  };
-  const timer = setIntervalFn(redraw, refreshMs);
-  timer.unref?.();
   return {
     enabled: true,
-    redraw,
+    get mutedCount() {
+      return mutedCount;
+    },
+    recent: () => [...muted],
     stop: () => {
       if (stopped) return;
       stopped = true;
-      clearIntervalFn(timer);
+      flushRepeats();
       for (const level of Object.keys(originals)) {
         if (target[level] === wrappers[level]) target[level] = originals[level];
       }
@@ -825,6 +862,7 @@ function startBoundedTerminalLogView(options = {}) {
 
 // src/webui-server.ts
 async function runWebUI(opts) {
+  const terminalLogView = startQuietSurfaceConsole();
   const trustBoundary = opts.trustBoundary ?? createCompatibilityTrustBoundary({ policyId: "cli-webui-trusted-host-compat-v1" });
   const host = opts.host ?? process.env["WEBUI_HOST"] ?? process.env["WS_HOST"] ?? "127.0.0.1";
   const publicUrl = opts.publicUrl ?? process.env["WEBUI_PUBLIC_URL"];
@@ -1060,7 +1098,10 @@ async function runWebUI(opts) {
       publicUrl,
       projectRoot: opts.projectRoot,
       startedAt: (/* @__PURE__ */ new Date()).toISOString(),
-      registryBaseDir
+      registryBaseDir,
+      // Lets a same-project TUI/REPL authenticate `POST /api/fleet/ping` now
+      // that the API requires a token on every bind (H3).
+      authToken: wsToken
     });
   }
   const eventUnsubscribers = [];
@@ -1096,7 +1137,8 @@ async function runWebUI(opts) {
     globalConfigPath: path5.join(globalRoot, "config.json"),
     onFleetBroadcaster: (fn) => {
       fleetBroadcastCli = fn;
-    }
+    },
+    ...opts.getFleetBudget ? { getFleetBudget: opts.getFleetBudget } : {}
   });
   const wsHandlerCtx = {
     providerStore: createProviderConfigStore(
@@ -1172,7 +1214,10 @@ async function runWebUI(opts) {
             ...snapshot.baseUrl !== void 0 ? { baseUrl: snapshot.baseUrl } : {}
           };
           const oldMax = opts.agent.ctx.provider.capabilities?.maxContext;
-          const prov = makeProviderFromConfig(activeId, { ...newCfg, type: activeId });
+          const prov = makeProviderFromConfig(activeId, {
+            ...newCfg,
+            type: newCfg.type ?? activeId
+          });
           if (oldMax != null && prov.capabilities) prov.capabilities.maxContext = oldMax;
           opts.agent.ctx.provider = prov;
           console.log(`[WebUI] Provider credentials reloaded from config.json (${activeId})`);
@@ -1352,7 +1397,6 @@ async function runWebUI(opts) {
     kanbanHostRoutes,
     statusTracker: opts.statusTracker
   });
-  const terminalLogView = startBoundedTerminalLogView();
   const stopped = new Promise((resolve) => {
     let listeningAnnounced = false;
     const announceListening = () => {
@@ -1431,6 +1475,28 @@ async function runWebUI(opts) {
         flushAllStreamBuffers();
         for (const unsub of eventUnsubscribers) unsub();
       },
+      // Issue #322: kill session-owned children (MCP, bash/exec, tool-spawned
+      // dev servers) before closing the listen socket so Windows process trees
+      // do not outlive the parent and strand the event loop on open stdio.
+      stopOwnedChildren: async () => {
+        try {
+          const { getProcessRegistry } = await import("@wrongstack/tools");
+          getProcessRegistry().killAll({ force: true, includeProtected: true });
+        } catch (err) {
+          console.debug(
+            `[webui-server] process-registry killAll failed: ${err instanceof Error ? err.message : String(err)}`
+          );
+        }
+        if (opts.mcpRegistry) {
+          try {
+            await opts.mcpRegistry.stopAll();
+          } catch (err) {
+            console.debug(
+              `[webui-server] mcpRegistry.stopAll failed: ${err instanceof Error ? err.message : String(err)}`
+            );
+          }
+        }
+      },
       disposeResources: () => {
         credentialWatcherClose?.();
         credentialWatcherClose = void 0;
@@ -1455,8 +1521,13 @@ async function runWebUI(opts) {
       pid: process.pid,
       registryBaseDir,
       onStopped: () => {
-        terminalLogView.redraw();
+        const muted = terminalLogView.mutedCount;
         terminalLogView.stop();
+        if (muted > 0) {
+          console.log(
+            `[WebUI] ${muted} progress line(s) kept out of this terminal \u2014 set WEBUI_VERBOSE=1 to see them.`
+          );
+        }
         opts.onExit?.();
         resolve();
       }
@@ -1487,4 +1558,4 @@ async function runWebUI(opts) {
 export {
   runWebUI
 };
-//# sourceMappingURL=webui-server-PCLSXX6L.js.map
+//# sourceMappingURL=webui-server-G3EKFXLL.js.map

package/dist/webui-server-options.d.ts

@@ -36,6 +36,22 @@ export interface CliWebUIOptions {
     surface?: 'webui' | 'simpleui' | undefined;
     /** Fixed access token/password. Defaults to WEBUI_TOKEN or random per process. */
     accessToken?: string | undefined;
+    /**
+     * Live fleet concurrency + lifetime spawn budget for WebUI (issue #323).
+     * Merged into `fleet.concurrency_update` broadcasts.
+     */
+    getFleetBudget?: (() => {
+        maxSpawns?: number | undefined;
+        usedSpawns?: number | undefined;
+        remainingSpawns?: number | undefined;
+        maxConcurrent?: number | undefined;
+        activeAgents?: number | undefined;
+        maxSpawnsSource?: string | undefined;
+        maxConcurrentSource?: string | undefined;
+        effectiveSource?: string | undefined;
+        checkpointMaxSpawns?: number | undefined;
+        ceilingMismatch?: boolean | undefined;
+    } | null) | undefined;
     /** Browser-facing HTTP URL, used when WebUI is exposed behind a tunnel/proxy. */
     publicUrl?: string | undefined;
     /** Browser-facing WebSocket URL injected into the frontend. */

package/dist/wiring/brain-and-orchestration.d.ts

@@ -49,6 +49,9 @@ export interface BrainOrchestrationDeps {
     stateCheckpointPath: string | undefined;
     fleetRootForPromotion: string;
     maxConcurrent: number | undefined;
+    maxSpawns?: number | undefined;
+    maxConcurrentSource?: import('../fleet/budget-source.js').FleetBudgetSource | undefined;
+    maxSpawnsSource?: import('../fleet/budget-source.js').FleetBudgetSource | undefined;
     effectiveMaxContextRef: {
         current: number;
     };

package/dist/wiring/director-setup.d.ts

@@ -23,6 +23,10 @@ export interface DirectorAutonomyResult {
     director: Director | null;
     directorMode: boolean;
     maxConcurrent: number | undefined;
+    /** Lifetime spawn ceiling resolved from flag/env/profile/default. */
+    maxSpawns: number;
+    maxConcurrentSource: import('../fleet/budget-source.js').FleetBudgetSource;
+    maxSpawnsSource: import('../fleet/budget-source.js').FleetBudgetSource;
     autonomyMode: import('../services/autonomy-mode.js').AutonomyMode;
     nextPredictEnabled: boolean;
     currentSuggestions: string[];