@wrongstack/cli 0.302.0 → 0.303.0

package/dist/{chunk-2KDOFTTM.js → chunk-LUAFQIXT.js}

@@ -27,13 +27,14 @@ import {
   HqCommandAuditLog,
   hqTokenKey as hqTokenKey2,
   hqTokenVerifier as hqTokenVerifier2,
+  isLoopbackHost as isLoopbackHost3,
+  isTokenExpired as isTokenExpired4,
   mintHqCookieSecret as mintHqCookieSecret2,
   mutateHqAuthFile as mutateHqAuthFile2,
   toAlertMessage,
   watchHqAuthFile
 } from "@wrongstack/core/hq";
 import { createCompatibilityTrustBoundary } from "@wrongstack/core/security";
-import { isLoopbackHost as isLoopbackHost3 } from "@wrongstack/core/hq";
 import { WebSocket as WebSocket3, WebSocketServer } from "ws";
 
 // src/hq-recovery-html.ts
@@ -414,8 +415,8 @@ function auditPrunedTokens(scope, previous, next, authFile, dataDir) {
 import { createHash } from "node:crypto";
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
-import { atomicWrite } from "@wrongstack/core/utils";
 import { restrictFilePermissions } from "@wrongstack/core/security";
+import { atomicWrite } from "@wrongstack/core/utils";
 var LoginAttemptStore = class _LoginAttemptStore {
   store = /* @__PURE__ */ new Map();
   writeTimer;
@@ -586,10 +587,10 @@ var LoginAttemptStore = class _LoginAttemptStore {
 import {
   assessHqExposure,
   ensureHqFirstRunAuthFile,
+  HqInsecureExposureError,
   isTokenExpired as isTokenExpired3,
   resolveHqDataDir
 } from "@wrongstack/core/hq";
-import { HqInsecureExposureError } from "@wrongstack/core/hq";
 async function prepareHqServerStart(options, defaults) {
   const host = options.host ?? defaults.host;
   const port = options.port ?? defaults.port;
@@ -645,10 +646,13 @@ async function prepareHqServerStart(options, defaults) {
 // src/hq-server/routes.ts
 import { randomUUID as randomUUID2 } from "node:crypto";
 import * as path5 from "node:path";
-import { tokenHasCapability, validateHqCommand } from "@wrongstack/core/hq";
 import {
   resolveProjectDir
 } from "@wrongstack/core/coordination";
+import {
+  tokenHasCapability,
+  validateHqCommand
+} from "@wrongstack/core/hq";
 
 // src/hq-static-serve.ts
 import * as fs2 from "node:fs";
@@ -754,8 +758,99 @@ async function serveHqStatic(_req, res, urlPath, distDir) {
   return { handled: true };
 }
 
-// src/hq-server/snapshot.ts
-import { WebSocket } from "ws";
+// src/hq-server/project-root.ts
+import { deriveHqProjectId } from "@wrongstack/core/hq";
+function resolveHqProjectRoot(globalRoot, ids) {
+  const fn = async () => {
+    const { getSessionRegistry } = await import("@wrongstack/core/storage");
+    try {
+      const registry = getSessionRegistry(globalRoot);
+      if (typeof ids.sessionId === "string") {
+        const entry = await registry.get(ids.sessionId).catch(() => null);
+        if (entry?.projectRoot) return entry.projectRoot;
+      }
+      if (typeof ids.projectId === "string") {
+        const { createHash: createHash2 } = await import("node:crypto");
+        const all = await registry.list().catch(() => []);
+        const projectIds = /* @__PURE__ */ new Map();
+        const projectIdForRoot = (projectRoot) => {
+          const cached = projectIds.get(projectRoot);
+          if (cached !== void 0) return cached;
+          const derived = deriveHqProjectId(projectRoot);
+          projectIds.set(projectRoot, derived);
+          return derived;
+        };
+        const match = all.find(
+          (e) => e.projectSlug === ids.projectId || projectIdForRoot(e.projectRoot) === ids.projectId || createHash2("sha256").update(e.projectRoot).digest("hex").slice(0, 12) === ids.projectId
+        );
+        if (match) return match.projectRoot;
+      }
+    } catch {
+    }
+    return void 0;
+  };
+  return fn();
+}
+
+// src/hq-server/routes/auth-handlers.ts
+import { randomUUID } from "node:crypto";
+import {
+  hashHqPassword,
+  isLoopbackHost as isLoopbackHost2,
+  mintHqCookieSecret,
+  mutateHqAuthFile,
+  verifyHqPassword
+} from "@wrongstack/core/hq";
+import {
+  buildOtpAuthUri,
+  generateRecoveryCodes,
+  generateTotpSecret,
+  hashRecoveryCode,
+  verifyRecoveryCode,
+  verifyTotp,
+  verifyTotpCounter
+} from "@wrongstack/core/security";
+
+// src/hq-server/client-address.ts
+import { isIP as isIP2 } from "node:net";
+function normalizeAddress(raw) {
+  const trimmed = raw.trim().replace(/^\[(.*)\]$/, "$1");
+  return trimmed.replace(/^::ffff:/i, "");
+}
+function parseForwardedEntry(entry) {
+  const value = entry.trim();
+  if (!value) return void 0;
+  const bracketed = /^\[([^\]]+)\](?::\d+)?$/.exec(value);
+  if (bracketed?.[1] !== void 0) {
+    const inner = normalizeAddress(bracketed[1]);
+    return isIP2(inner) !== 0 ? inner : void 0;
+  }
+  const normalized = normalizeAddress(value);
+  if (isIP2(normalized) !== 0) return normalized;
+  const lastColon = normalized.lastIndexOf(":");
+  if (lastColon > 0 && normalized.indexOf(":") === lastColon) {
+    const host = normalized.slice(0, lastColon);
+    if (isIP2(host) === 4) return host;
+  }
+  return void 0;
+}
+function forwardedChain(req) {
+  const header = req.headers["x-forwarded-for"];
+  if (header === void 0) return [];
+  const raw = Array.isArray(header) ? header.join(",") : header;
+  return raw.split(",").map((entry) => parseForwardedEntry(entry)).filter((entry) => entry !== void 0);
+}
+function resolveClientAddress(req, trustedProxyHops = 0) {
+  const socketAddress = req.socket.remoteAddress ? normalizeAddress(req.socket.remoteAddress) : void 0;
+  const hops = Number.isFinite(trustedProxyHops) ? Math.max(0, Math.trunc(trustedProxyHops)) : 0;
+  if (hops === 0) return socketAddress ?? "unknown";
+  const chain = [
+    ...socketAddress !== void 0 ? [socketAddress] : [],
+    ...forwardedChain(req).reverse()
+  ];
+  if (hops >= chain.length) return socketAddress ?? "unknown";
+  return chain[hops] ?? socketAddress ?? "unknown";
+}
 
 // src/hq-server/utils.ts
 import * as fs3 from "node:fs/promises";
@@ -789,10 +884,10 @@ function agentMessageToEntry(p) {
 }
 async function readLocalSubagentTranscript(sessionId, subagentId) {
   try {
-    const { SessionRegistry } = await import("@wrongstack/core/storage");
+    const { getSessionRegistry } = await import("@wrongstack/core/storage");
     const { resolveWstackPaths, sessionScopedPath } = await import("@wrongstack/core/utils");
     const globalRoot = path3.dirname(resolveHqDataDir2());
-    const registry = new SessionRegistry(globalRoot);
+    const registry = getSessionRegistry(globalRoot);
     const entry = await registry.get(sessionId).catch(() => null);
     if (!entry) return null;
     const paths = resolveWstackPaths({ projectRoot: entry.projectRoot, globalRoot });
@@ -949,610 +1044,69 @@ function recordTimeseriesSignal(persistence, event) {
   }
 }
 
-// src/hq-server/snapshot.ts
-var HQ_SNAPSHOT_BROADCAST_DEBOUNCE_MS = 100;
-var HQ_SNAPSHOT_PERSIST_MIN_INTERVAL_MS = 3e3;
-var HQ_BROWSER_MAX_BUFFERED_BYTES = 32 * 1024 * 1024;
-function sendGuarded(ws, data) {
-  if (ws.readyState !== WebSocket.OPEN) return false;
-  const buffered = Number.isFinite(ws.bufferedAmount) ? ws.bufferedAmount : 0;
-  if (buffered + Buffer.byteLength(data, "utf8") > HQ_BROWSER_MAX_BUFFERED_BYTES) {
-    try {
-      ws.terminate();
-    } catch {
-      try {
-        ws.close(1013, "client cannot keep up");
-      } catch {
+// src/hq-server/routes/auth-handlers.ts
+import { readHqAuthAuditTail } from "@wrongstack/core/hq";
+function isLoopbackRequest(req) {
+  const address = req.socket.remoteAddress?.replace(/^::ffff:/, "");
+  return address !== void 0 && isLoopbackHost2(address);
+}
+var HQ_AUTH_ADMIN_CAPABILITY = "auth.admin";
+function callerCanAdministerAuth(auth) {
+  if (auth === void 0) return false;
+  if (auth.kind === "cookie" && auth.tokenId === void 0) return true;
+  if (auth.capabilities === void 0) return true;
+  return auth.capabilities.includes(HQ_AUTH_ADMIN_CAPABILITY);
+}
+function writeAuthAdminRequired(res) {
+  res.writeHead(403, { "Content-Type": "application/json" });
+  res.end(
+    JSON.stringify({
+      error: {
+        code: "AUTH_ADMIN_REQUIRED",
+        message: `This endpoint requires the '${HQ_AUTH_ADMIN_CAPABILITY}' capability.`
       }
-    }
-    return false;
+    })
+  );
+}
+function authorizeAuthAdmin(req, res, mutableAuth, sessions) {
+  const auth = authenticateBrowserRequest(
+    req,
+    new URL(req.url ?? "/", "http://localhost"),
+    mutableAuth,
+    sessions
+  );
+  if (!auth) {
+    res.writeHead(401, { "Content-Type": "application/json" });
+    res.end(
+      JSON.stringify({ error: { code: "UNAUTHORIZED", message: "Authentication required." } })
+    );
+    return void 0;
   }
-  try {
-    ws.send(data);
-    return true;
-  } catch {
-    return false;
+  if (!callerCanAdministerAuth(auth)) {
+    writeAuthAdminRequired(res);
+    return void 0;
   }
+  return auth;
 }
-var HQ_STALE_SNAPSHOT_MS = 5 * 6e4;
-function reapStaleClientState(clients, nowMs = Date.now()) {
-  for (const client of clients.values()) {
-    for (const [sessionId, tracked] of client.sessions) {
-      if (nowMs - tracked.receivedAt > HQ_STALE_SNAPSHOT_MS) client.sessions.delete(sessionId);
-    }
-    for (const [runId, fleet] of client.fleets) {
-      if (nowMs - fleet.receivedAt > HQ_STALE_SNAPSHOT_MS) client.fleets.delete(runId);
-    }
-    for (const [sessionId, tracked] of client.mcpSnapshots) {
-      if (nowMs - tracked.receivedAt > HQ_STALE_SNAPSHOT_MS) client.mcpSnapshots.delete(sessionId);
-    }
-    if (client.governanceSnapshot !== void 0 && nowMs - client.governanceSnapshot.receivedAt > HQ_STALE_SNAPSHOT_MS) {
-      delete client.governanceSnapshot;
-    }
-  }
-}
-function buildSnapshot(clients, options) {
-  reapStaleClientState(clients);
-  const now = (/* @__PURE__ */ new Date()).toISOString();
-  const clientRecordById = /* @__PURE__ */ new Map();
-  const projectMap = /* @__PURE__ */ new Map();
-  const mailboxSummaries = [];
-  const sessionById = /* @__PURE__ */ new Map();
-  const fleetByRunId = /* @__PURE__ */ new Map();
-  for (const client of clients.values()) {
-    const machineId = client.machineId || client.project.machineId || "";
-    if (!clientRecordById.has(client.clientId)) {
-      clientRecordById.set(client.clientId, {
-        clientId: client.clientId,
-        kind: client.kind,
-        machineId,
-        ...client.hostname ? { hostname: client.hostname } : {},
-        ...client.pid ? { pid: client.pid } : {},
-        ...client.version ? { version: client.version } : {},
-        connected: true,
-        connectedAt: client.connectedAt,
-        lastSeenAt: client.lastSeenAt,
-        projectId: client.projectId,
-        capabilities: client.capabilities
-      });
-    }
-    let project = projectMap.get(client.projectId);
-    if (!project) {
-      project = {
-        projectId: client.projectId,
-        projectName: client.project.projectName || client.projectId,
-        projectRootDisplay: client.project.projectRoot,
-        machineIds: [machineId],
-        ...client.project.gitBranch ? { gitBranch: client.project.gitBranch } : {},
-        activeClients: 0,
-        activeSessions: 0,
-        activeSubagents: 0,
-        totalCostUsd: 0,
-        lastActivityAt: now,
-        status: "active"
-      };
-      projectMap.set(client.projectId, project);
-    } else if (machineId && !project.machineIds.includes(machineId)) {
-      project.machineIds = [...project.machineIds, machineId];
-    }
-    const governance = client.governanceSnapshot?.payload;
-    if (governance !== void 0 && (project.governance === void 0 || Date.parse(governance.observedAt) >= Date.parse(project.governance.observedAt))) {
-      project.governance = governance;
-    }
-    for (const tracked of client.sessions.values()) {
-      const cutoff = Date.now() - 5 * 6e4;
-      const agents = tracked.payload.agents.filter((agent) => {
-        if (agent.id === "leader") return true;
-        const lastActivityAt = Date.parse(agent.lastActivityAt);
-        return Number.isFinite(lastActivityAt) && lastActivityAt >= cutoff;
-      });
-      sessionById.set(tracked.payload.sessionId, {
-        ...tracked.payload,
-        clientId: client.clientId,
-        agents,
-        agentCount: agents.length
-      });
-    }
-    for (const snapshot of client.mailboxes.values()) {
-      mailboxSummaries.push({
-        mailboxId: snapshot.mailboxId,
-        projectId: client.projectId,
-        scope: snapshot.scope,
-        messageCount: snapshot.totals.messages,
-        unreadCount: snapshot.totals.unread,
-        incompleteCount: snapshot.totals.incomplete,
-        highPriorityCount: snapshot.totals.highPriority,
-        onlineAgentCount: snapshot.totals.onlineAgents,
-        lastActivityAt: now
-      });
-    }
-    for (const fleet of client.fleets.values()) {
-      fleetByRunId.set(fleet.payload.runId, {
-        payload: fleet.payload,
-        clientId: client.clientId,
-        projectId: client.projectId,
-        lastActivityAt: new Date(fleet.receivedAt).toISOString()
-      });
-    }
-  }
-  const processKeyOf = (rec) => rec.pid !== void 0 ? `${rec.machineId}:${rec.pid}` : rec.clientId;
-  const countedProjectProcesses = /* @__PURE__ */ new Set();
-  for (const rec of clientRecordById.values()) {
-    const key = `${rec.projectId}|${processKeyOf(rec)}`;
-    if (countedProjectProcesses.has(key)) continue;
-    countedProjectProcesses.add(key);
-    const project = projectMap.get(rec.projectId);
-    if (project) project.activeClients++;
-  }
-  const liveSessions = Array.from(sessionById.values());
-  const machineMap = /* @__PURE__ */ new Map();
-  let totalAgents = 0;
-  let totalSubagents = 0;
-  let totalCostUsd = 0;
-  for (const session of liveSessions) {
-    let project = projectMap.get(session.projectId);
-    if (!project) {
-      project = {
-        projectId: session.projectId,
-        projectName: session.projectName || session.projectId,
-        projectRootDisplay: session.projectRoot,
-        machineIds: [session.machineId],
-        ...session.gitBranch ? { gitBranch: session.gitBranch } : {},
-        activeClients: 0,
-        activeSessions: 0,
-        activeSubagents: 0,
-        totalCostUsd: 0,
-        lastActivityAt: session.lastActivityAt,
-        status: "active"
-      };
-      projectMap.set(session.projectId, project);
-    } else if (session.machineId && !project.machineIds.includes(session.machineId)) {
-      project.machineIds = [...project.machineIds, session.machineId];
-    }
-    project.activeSessions++;
-    let sessionCost = 0;
-    for (const agent of session.agents) {
-      totalAgents++;
-      if (agent.id !== "leader") totalSubagents++;
-      if (typeof agent.costUsd === "number") {
-        sessionCost += agent.costUsd;
-      }
-    }
-    project.activeSubagents += session.agents.filter((a) => a.id !== "leader").length;
-    project.totalCostUsd += sessionCost;
-    totalCostUsd += sessionCost;
-    const mKey = hqMachineKey(session.hostname, session.machineId);
-    let machine = machineMap.get(mKey);
-    if (!machine) {
-      machine = {
-        record: {
-          machineId: session.machineId,
-          ...session.hostname ? { hostname: session.hostname } : {},
-          clientCount: 0,
-          sessionCount: 0,
-          agentCount: 0,
-          projectIds: [],
-          lastActivityAt: session.lastActivityAt
-        },
-        projects: /* @__PURE__ */ new Set()
-      };
-      machineMap.set(mKey, machine);
-    }
-    machine.record.sessionCount++;
-    machine.record.agentCount += session.agents.length;
-    machine.projects.add(session.projectId);
-    if (session.lastActivityAt > machine.record.lastActivityAt) {
-      machine.record.lastActivityAt = session.lastActivityAt;
-    }
-  }
-  const countedMachineProcesses = /* @__PURE__ */ new Set();
-  for (const rec of clientRecordById.values()) {
-    if (!rec.machineId && !rec.hostname) continue;
-    const rKey = hqMachineKey(rec.hostname, rec.machineId);
-    let machine = machineMap.get(rKey);
-    if (!machine) {
-      machine = {
-        record: {
-          machineId: rec.machineId,
-          ...rec.hostname ? { hostname: rec.hostname } : {},
-          clientCount: 0,
-          sessionCount: 0,
-          agentCount: 0,
-          projectIds: [],
-          lastActivityAt: rec.lastSeenAt
-        },
-        projects: /* @__PURE__ */ new Set()
-      };
-      machineMap.set(rKey, machine);
-    }
-    const processKey = `${rKey}|${processKeyOf(rec)}`;
-    if (!countedMachineProcesses.has(processKey)) {
-      countedMachineProcesses.add(processKey);
-      machine.record.clientCount++;
-    }
-    machine.projects.add(rec.projectId);
-    if (rec.hostname && !machine.record.hostname) machine.record.hostname = rec.hostname;
-  }
-  const machines = Array.from(machineMap.values()).map((m) => ({
-    ...m.record,
-    projectIds: Array.from(m.projects)
-  }));
-  const clientRecords = Array.from(clientRecordById.values());
-  const projects = Array.from(projectMap.values());
-  let unread = 0;
-  let incomplete = 0;
-  for (const m of mailboxSummaries) {
-    unread += m.unreadCount;
-    incomplete += m.incompleteCount;
-  }
-  const sessions = liveSessions.map((s) => {
-    let sessionCost = 0;
-    for (const agent of s.agents) {
-      if (typeof agent.costUsd === "number") sessionCost += agent.costUsd;
-    }
-    const provider = s.agents.find((a) => a.model !== void 0)?.model;
-    return {
-      sessionId: s.sessionId,
-      projectId: s.projectId,
-      clientId: s.clientId ?? `${s.machineId}:${s.clientKind}`,
-      status: s.status === "active" ? "running" : "idle",
-      ...provider !== void 0 ? { model: provider } : {},
-      startedAt: s.startedAt,
-      lastActivityAt: s.lastActivityAt,
-      ...sessionCost > 0 ? { costUsd: sessionCost } : {}
-    };
-  });
-  const fleets = Array.from(fleetByRunId.values()).map((f) => ({
-    runId: f.payload.runId,
-    projectId: f.projectId,
-    clientId: f.clientId,
-    activeSubagents: f.payload.activeSubagents,
-    queuedTasks: f.payload.queuedTasks,
-    completedTasks: f.payload.completedTasks,
-    failedTasks: f.payload.failedTasks,
-    ...f.payload.totalCostUsd !== void 0 ? { totalCostUsd: f.payload.totalCostUsd } : {},
-    lastActivityAt: f.lastActivityAt,
-    ...f.payload.maxConcurrent !== void 0 ? { maxConcurrent: f.payload.maxConcurrent } : {},
-    ...f.payload.maxSpawns !== void 0 ? { maxSpawns: f.payload.maxSpawns } : {},
-    ...f.payload.usedSpawns !== void 0 ? { usedSpawns: f.payload.usedSpawns } : {},
-    ...f.payload.remainingSpawns !== void 0 ? { remainingSpawns: f.payload.remainingSpawns } : {},
-    ...f.payload.effectiveSource !== void 0 ? { effectiveSource: f.payload.effectiveSource } : {},
-    ...f.payload.checkpointMaxSpawns !== void 0 ? { checkpointMaxSpawns: f.payload.checkpointMaxSpawns } : {},
-    ...f.payload.ceilingMismatch ? { ceilingMismatch: true } : {}
-  }));
-  const mcpServers = [];
-  const seenMcp = /* @__PURE__ */ new Set();
-  for (const client of clients.values()) {
-    for (const [sessionId, tracked] of client.mcpSnapshots.entries()) {
-      for (const server of tracked.servers) {
-        const key = `${client.clientId}:${sessionId}:${server.name}`;
-        if (seenMcp.has(key)) continue;
-        seenMcp.add(key);
-        mcpServers.push(server);
-      }
-    }
-  }
-  return {
-    generatedAt: now,
-    clients: clientRecords,
-    projects,
-    sessions,
-    fleets,
-    mailboxes: mailboxSummaries,
-    machines,
-    liveSessions,
-    mcpServers,
-    totals: {
-      activeProjects: projects.length,
-      activeClients: new Set(clientRecords.map(processKeyOf)).size,
-      activeSessions: liveSessions.length,
-      activeSubagents: totalSubagents,
-      unreadMailboxMessages: unread,
-      incompleteMailboxMessages: incomplete,
-      totalCostUsd,
-      activeMachines: machines.length,
-      activeAgents: totalAgents,
-      ...options?.tokenStats !== void 0 ? { tokenStats: options.tokenStats } : {}
-    }
-  };
-}
-function createSnapshotBroadcaster(clients, browsers, persistence) {
-  let cached = "";
-  let dirty = true;
-  let timer = null;
-  let closed = false;
-  let lastPersistAt = 0;
-  const persistCheckpoint = (snapshot) => {
-    if (persistence === void 0) return;
-    const now = Date.now();
-    if (now - lastPersistAt < HQ_SNAPSHOT_PERSIST_MIN_INTERVAL_MS) return;
-    lastPersistAt = now;
-    persistence.snapshotStore.save(snapshot);
-  };
-  const serialize = () => {
-    if (!dirty && cached.length > 0) return cached;
-    const snapshot = buildSnapshot(clients);
-    const msg = { type: "hq.snapshot", snapshot };
-    cached = JSON.stringify(msg);
-    dirty = false;
-    persistCheckpoint(snapshot);
-    return cached;
-  };
-  const flush = () => {
-    timer = null;
-    if (browsers.size === 0) {
-      if (persistence !== void 0 && Date.now() - lastPersistAt >= HQ_SNAPSHOT_PERSIST_MIN_INTERVAL_MS) {
-        persistCheckpoint(buildSnapshot(clients));
-      }
-      return;
-    }
-    const data = serialize();
-    for (const ws of browsers) sendGuarded(ws, data);
-  };
-  return {
-    currentSerialized: serialize,
-    broadcast: () => {
-      if (closed) return;
-      dirty = true;
-      if (timer !== null) return;
-      timer = setTimeout(flush, HQ_SNAPSHOT_BROADCAST_DEBOUNCE_MS);
-      timer.unref?.();
-    },
-    close: () => {
-      closed = true;
-      if (timer !== null) {
-        clearTimeout(timer);
-        timer = null;
-      }
-    }
-  };
-}
-function buildProjectDetail(clients, projectId) {
-  const projectClients = [];
-  for (const c of clients.values()) {
-    if (c.projectId === projectId) projectClients.push(c);
-  }
-  if (projectClients.length === 0) return null;
-  const now = (/* @__PURE__ */ new Date()).toISOString();
-  const clientRecords = projectClients.map((c) => ({
-    clientId: c.clientId,
-    kind: c.kind,
-    machineId: "",
-    ...c.hostname ? { hostname: c.hostname } : {},
-    ...c.pid ? { pid: c.pid } : {},
-    ...c.version ? { version: c.version } : {},
-    connected: true,
-    connectedAt: c.connectedAt,
-    lastSeenAt: c.lastSeenAt,
-    projectId: c.projectId,
-    capabilities: c.capabilities
-  }));
-  const mailboxPayloads = [];
-  let latestActivity = now;
-  for (const c of projectClients) {
-    for (const snap of c.mailboxes.values()) {
-      mailboxPayloads.push(snap);
-      if (snap.totals.messages > 0) latestActivity = now;
-    }
-  }
-  const primaryProject = projectClients[0].project;
-  const machineIds = Array.from(new Set(projectClients.map((client) => client.project.machineId)));
-  const project = {
-    projectId,
-    projectName: primaryProject.projectName || projectId,
-    projectRootDisplay: primaryProject.projectRoot,
-    machineIds,
-    ...primaryProject.gitBranch ? { gitBranch: primaryProject.gitBranch } : {},
-    activeClients: projectClients.length,
-    activeSessions: 0,
-    activeSubagents: 0,
-    totalCostUsd: 0,
-    lastActivityAt: latestActivity,
-    status: "active"
-  };
-  return {
-    generatedAt: now,
-    project,
-    clients: clientRecords,
-    mailboxes: mailboxPayloads
-  };
-}
-function broadcastEvent(event, browsers) {
-  const msg = { type: "hq.event", event };
-  const data = JSON.stringify(msg);
-  for (const ws of browsers) sendGuarded(ws, data);
-}
-function broadcastCommandStatus(command, browsers) {
-  const data = JSON.stringify({ type: "hq.command_status", command });
-  for (const ws of browsers) sendGuarded(ws, data);
-}
-
-// src/hq-server/trust-boundary.ts
-import {
-  isTrustDecisionAllowed
-} from "@wrongstack/core/security";
-async function authorizeHqCommand(input) {
-  const { boundary, command, commandId, enqueuedBy, authMethod, target } = input;
-  const subject = command.type === "run-command" ? {
-    kind: "command",
-    id: command.command,
-    attributes: { targetClientId: target.clientId }
-  } : {
-    kind: "custom",
-    id: command.type,
-    attributes: { targetClientId: target.clientId }
-  };
-  const request = {
-    version: 1,
-    requestId: commandId,
-    // WS-050: this was hardcoded to `kind: 'user'`, which made the
-    // compatibility policy's ONLY deny rule — `remote-client` + `critical` —
-    // unreachable from HQ. A boundary whose single rule can never fire is not
-    // defence in depth, it is decoration.
-    //
-    // The provenance is derived from how the caller authenticated, because
-    // that is the honest signal available here:
-    //
-    //   session cookie → `user`. The dashboard's primary flow is a bootstrap
-    //     code exchanged for an HttpOnly cookie, so this is a human at the
-    //     browser. NOTE: bootstrap sessions DO carry a `tokenId`, so a
-    //     "cookie without tokenId" test would have misclassified every normal
-    //     dashboard user as remote and denied them run-command. Checked before
-    //     writing this, not assumed.
-    //   raw bearer token → `remote-client`. The legacy `?token=` / manual-entry
-    //     path and any script calling the HTTP API directly. A credential that
-    //     can be copied into a script is not a person at a console.
-    //
-    // Consequence, deliberate: a bearer-token caller can no longer trigger
-    // `run-command` (the only `critical` capability here). `enqueue` is `high`
-    // and unaffected. The migration for automation that needs execute is the
-    // bootstrap exchange, which is the same thing the dashboard does.
-    actor: { kind: authMethod === "session" ? "user" : "remote-client", id: enqueuedBy },
-    surface: "hq",
-    capability: command.type === "run-command" ? "hq.control.execute" : "hq.control.enqueue",
-    subject,
-    risk: command.type === "run-command" ? "critical" : "high",
-    scope: { projectId: target.projectId },
-    authContext: { method: authMethod, principalId: enqueuedBy },
-    metadata: { commandType: command.type, targetKind: target.kind }
-  };
-  const decision = await boundary.evaluate(request);
-  console.warn(
-    JSON.stringify({
-      level: "info",
-      event: "hq.trust_boundary.decision",
-      requestId: commandId,
-      capability: request.capability,
-      decision: decision.kind,
-      policyId: decision.policyId,
-      actor: enqueuedBy,
-      clientId: target.clientId,
-      timestamp: (/* @__PURE__ */ new Date()).toISOString()
-    })
-  );
-  return { allowed: isTrustDecisionAllowed(decision), reason: decision.reason };
-}
-
-// src/hq-server/routes/auth-handlers.ts
-import { randomUUID } from "node:crypto";
-import {
-  hashHqPassword,
-  isLoopbackHost as isLoopbackHost2,
-  mintHqCookieSecret,
-  mutateHqAuthFile,
-  verifyHqPassword
-} from "@wrongstack/core/hq";
-import {
-  buildOtpAuthUri,
-  generateRecoveryCodes,
-  generateTotpSecret,
-  hashRecoveryCode,
-  verifyRecoveryCode,
-  verifyTotp,
-  verifyTotpCounter
-} from "@wrongstack/core/security";
-
-// src/hq-server/client-address.ts
-import { isIP as isIP2 } from "node:net";
-function normalizeAddress(raw) {
-  const trimmed = raw.trim().replace(/^\[(.*)\]$/, "$1");
-  return trimmed.replace(/^::ffff:/i, "");
-}
-function parseForwardedEntry(entry) {
-  const value = entry.trim();
-  if (!value) return void 0;
-  const bracketed = /^\[([^\]]+)\](?::\d+)?$/.exec(value);
-  if (bracketed?.[1] !== void 0) {
-    const inner = normalizeAddress(bracketed[1]);
-    return isIP2(inner) !== 0 ? inner : void 0;
-  }
-  const normalized = normalizeAddress(value);
-  if (isIP2(normalized) !== 0) return normalized;
-  const lastColon = normalized.lastIndexOf(":");
-  if (lastColon > 0 && normalized.indexOf(":") === lastColon) {
-    const host = normalized.slice(0, lastColon);
-    if (isIP2(host) === 4) return host;
-  }
-  return void 0;
-}
-function forwardedChain(req) {
-  const header = req.headers["x-forwarded-for"];
-  if (header === void 0) return [];
-  const raw = Array.isArray(header) ? header.join(",") : header;
-  return raw.split(",").map((entry) => parseForwardedEntry(entry)).filter((entry) => entry !== void 0);
-}
-function resolveClientAddress(req, trustedProxyHops = 0) {
-  const socketAddress = req.socket.remoteAddress ? normalizeAddress(req.socket.remoteAddress) : void 0;
-  const hops = Number.isFinite(trustedProxyHops) ? Math.max(0, Math.trunc(trustedProxyHops)) : 0;
-  if (hops === 0) return socketAddress ?? "unknown";
-  const chain = [...socketAddress !== void 0 ? [socketAddress] : [], ...forwardedChain(req).reverse()];
-  if (hops >= chain.length) return socketAddress ?? "unknown";
-  return chain[hops] ?? socketAddress ?? "unknown";
-}
-
-// src/hq-server/routes/auth-handlers.ts
-import { readHqAuthAuditTail } from "@wrongstack/core/hq";
-function isLoopbackRequest(req) {
-  const address = req.socket.remoteAddress?.replace(/^::ffff:/, "");
-  return address !== void 0 && isLoopbackHost2(address);
-}
-var HQ_AUTH_ADMIN_CAPABILITY = "auth.admin";
-function callerCanAdministerAuth(auth) {
-  if (auth === void 0) return false;
-  if (auth.kind === "cookie" && auth.tokenId === void 0) return true;
-  if (auth.capabilities === void 0) return true;
-  return auth.capabilities.includes(HQ_AUTH_ADMIN_CAPABILITY);
-}
-function writeAuthAdminRequired(res) {
-  res.writeHead(403, { "Content-Type": "application/json" });
-  res.end(
-    JSON.stringify({
-      error: {
-        code: "AUTH_ADMIN_REQUIRED",
-        message: `This endpoint requires the '${HQ_AUTH_ADMIN_CAPABILITY}' capability.`
-      }
-    })
-  );
-}
-function authorizeAuthAdmin(req, res, mutableAuth, sessions) {
-  const auth = authenticateBrowserRequest(
-    req,
-    new URL(req.url ?? "/", "http://localhost"),
-    mutableAuth,
-    sessions
-  );
-  if (!auth) {
-    res.writeHead(401, { "Content-Type": "application/json" });
-    res.end(
-      JSON.stringify({ error: { code: "UNAUTHORIZED", message: "Authentication required." } })
-    );
-    return void 0;
-  }
-  if (!callerCanAdministerAuth(auth)) {
-    writeAuthAdminRequired(res);
-    return void 0;
-  }
-  return auth;
-}
-async function handleApiAuthStatus(req, res, url, mutableAuth, sessions, requireBrowserAuth, trustedPublicOrigins, secureCookies) {
-  const auth = authenticateBrowserRequest(req, url, mutableAuth, sessions);
-  const openMode = mutableAuth.browserTokens.size === 0 && mutableAuth.passwordHash === void 0 && mutableAuth.requireAuthFloor !== true;
-  const localOpenMode = openMode && !requireBrowserAuth && isLoopbackRequest(req);
-  const publicOrigin = trustedPublicOrigins.values().next().value;
-  res.writeHead(200, { "Content-Type": "application/json" });
-  res.end(
-    JSON.stringify({
-      tokenMode: mutableAuth.browserTokens.size > 0,
-      passwordMode: mutableAuth.passwordHash !== void 0,
-      totpEnabled: mutableAuth.totpSecret !== void 0,
-      recoveryCodesRemaining: mutableAuth.totpRecoveryCodes?.length ?? 0,
-      publicRelay: requireBrowserAuth === true || publicOrigin !== void 0,
-      ...publicOrigin !== void 0 ? { publicOrigin } : {},
-      secureCookies: secureCookies === true,
-      loggedIn: auth !== void 0 || localOpenMode,
-      authKind: isCookieAuth(auth) ? "password" : isTokenAuth(auth) ? "token" : localOpenMode ? "open" : void 0
-    })
-  );
+async function handleApiAuthStatus(req, res, url, mutableAuth, sessions, requireBrowserAuth, trustedPublicOrigins, secureCookies) {
+  const auth = authenticateBrowserRequest(req, url, mutableAuth, sessions);
+  const openMode = mutableAuth.browserTokens.size === 0 && mutableAuth.passwordHash === void 0 && mutableAuth.requireAuthFloor !== true;
+  const localOpenMode = openMode && !requireBrowserAuth && isLoopbackRequest(req);
+  const publicOrigin = trustedPublicOrigins.values().next().value;
+  res.writeHead(200, { "Content-Type": "application/json" });
+  res.end(
+    JSON.stringify({
+      tokenMode: mutableAuth.browserTokens.size > 0,
+      passwordMode: mutableAuth.passwordHash !== void 0,
+      totpEnabled: mutableAuth.totpSecret !== void 0,
+      recoveryCodesRemaining: mutableAuth.totpRecoveryCodes?.length ?? 0,
+      publicRelay: requireBrowserAuth === true || publicOrigin !== void 0,
+      ...publicOrigin !== void 0 ? { publicOrigin } : {},
+      secureCookies: secureCookies === true,
+      loggedIn: auth !== void 0 || localOpenMode,
+      authKind: isCookieAuth(auth) ? "password" : isTokenAuth(auth) ? "token" : localOpenMode ? "open" : void 0
+    })
+  );
 }
 async function handleApiLogin(req, res, mutableAuth, sessions, loginAttempts, secureCookies, trustedProxyHops) {
   if (!mutableAuth.passwordHash) {
@@ -1704,7 +1258,10 @@ async function handleApiPassword(req, res, mutableAuth, sessions, dataDir, secur
       res.writeHead(403, { "Content-Type": "application/json" });
       res.end(
         JSON.stringify({
-          error: { code: "INVALID_CURRENT_PASSWORD", message: "Current password is required to change or remove it." }
+          error: {
+            code: "INVALID_CURRENT_PASSWORD",
+            message: "Current password is required to change or remove it."
+          }
         })
       );
       return;
@@ -1926,26 +1483,40 @@ async function handleApiLoginVerify(req, res, _url, mutableAuth, sessions, login
   const { blocked, retryAfter } = loginAttempts.checkBlocked(clientIp);
   if (blocked) {
     res.writeHead(429, { "Content-Type": "application/json", "Retry-After": String(retryAfter) });
-    res.end(JSON.stringify({ error: { code: "RATE_LIMITED", message: "Too many attempts. Try again later." } }));
+    res.end(
+      JSON.stringify({
+        error: { code: "RATE_LIMITED", message: "Too many attempts. Try again later." }
+      })
+    );
     return;
   }
   const raw = readHqSessionCookie(req.headers.cookie);
   const sessionId = raw ? parseHqSessionCookie(raw, mutableAuth.cookieSecret) : void 0;
   if (!sessionId) {
     res.writeHead(401, { "Content-Type": "application/json" });
-    res.end(JSON.stringify({ error: { code: "NO_PENDING_SESSION", message: "No pending 2FA session." } }));
+    res.end(
+      JSON.stringify({ error: { code: "NO_PENDING_SESSION", message: "No pending 2FA session." } })
+    );
     return;
   }
   const session = sessions.get(sessionId);
   if (!session?.pending2fa) {
     res.writeHead(401, { "Content-Type": "application/json" });
-    res.end(JSON.stringify({ error: { code: "NO_PENDING_SESSION", message: "Session is not pending 2FA." } }));
+    res.end(
+      JSON.stringify({
+        error: { code: "NO_PENDING_SESSION", message: "Session is not pending 2FA." }
+      })
+    );
     return;
   }
   if (Date.now() - session.createdAt > PENDING_2FA_TTL_MS) {
     sessions.delete(sessionId);
     res.writeHead(401, { "Content-Type": "application/json" });
-    res.end(JSON.stringify({ error: { code: "TOTP_EXPIRED", message: "2FA session expired. Please log in again." } }));
+    res.end(
+      JSON.stringify({
+        error: { code: "TOTP_EXPIRED", message: "2FA session expired. Please log in again." }
+      })
+    );
     return;
   }
   let body;
@@ -1959,7 +1530,9 @@ async function handleApiLoginVerify(req, res, _url, mutableAuth, sessions, login
   if (typeof body.code === "string" && body.code.length > 0) {
     if (!mutableAuth.totpSecret) {
       res.writeHead(400, { "Content-Type": "application/json" });
-      res.end(JSON.stringify({ error: { code: "TOTP_NOT_ENABLED", message: "2FA is not configured." } }));
+      res.end(
+        JSON.stringify({ error: { code: "TOTP_NOT_ENABLED", message: "2FA is not configured." } })
+      );
       return;
     }
     const matchedCounter = verifyTotpCounter(body.code, mutableAuth.totpSecret);
@@ -1983,7 +1556,11 @@ async function handleApiLoginVerify(req, res, _url, mutableAuth, sessions, login
     loginAttempts.clearOnSuccess(clientIp);
     sessions.delete(sessionId);
     const fullSessionId = randomUUID();
-    sessions.set(fullSessionId, { createdAt: Date.now(), kind: "password", lastSeenAt: Date.now() });
+    sessions.set(fullSessionId, {
+      createdAt: Date.now(),
+      kind: "password",
+      lastSeenAt: Date.now()
+    });
     setHqSessionCookie(
       res,
       serializeHqSessionCookie(fullSessionId, mutableAuth.cookieSecret),
@@ -1998,7 +1575,11 @@ async function handleApiLoginVerify(req, res, _url, mutableAuth, sessions, login
     const storedHashes = mutableAuth.totpRecoveryCodes ?? [];
     if (storedHashes.length === 0) {
       res.writeHead(400, { "Content-Type": "application/json" });
-      res.end(JSON.stringify({ error: { code: "NO_RECOVERY_CODES", message: "No recovery codes available." } }));
+      res.end(
+        JSON.stringify({
+          error: { code: "NO_RECOVERY_CODES", message: "No recovery codes available." }
+        })
+      );
       return;
     }
     if (!verifyRecoveryCode(body.recoveryCode, storedHashes)) {
@@ -2006,7 +1587,11 @@ async function handleApiLoginVerify(req, res, _url, mutableAuth, sessions, login
         sessions.delete(sessionId);
       }
       res.writeHead(401, { "Content-Type": "application/json" });
-      res.end(JSON.stringify({ error: { code: "INVALID_RECOVERY_CODE", message: "Invalid recovery code." } }));
+      res.end(
+        JSON.stringify({
+          error: { code: "INVALID_RECOVERY_CODE", message: "Invalid recovery code." }
+        })
+      );
       return;
     }
     let consumed = false;
@@ -2033,7 +1618,14 @@ async function handleApiLoginVerify(req, res, _url, mutableAuth, sessions, login
       });
       if (!consumed) {
         res.writeHead(409, { "Content-Type": "application/json" });
-        res.end(JSON.stringify({ error: { code: "RECOVERY_CODE_ALREADY_USED", message: "This recovery code has already been used." } }));
+        res.end(
+          JSON.stringify({
+            error: {
+              code: "RECOVERY_CODE_ALREADY_USED",
+              message: "This recovery code has already been used."
+            }
+          })
+        );
         return;
       }
       applyAuthFile(next);
@@ -2043,7 +1635,11 @@ async function handleApiLoginVerify(req, res, _url, mutableAuth, sessions, login
     loginAttempts.clearOnSuccess(clientIp);
     sessions.delete(sessionId);
     const fullSessionId = randomUUID();
-    sessions.set(fullSessionId, { createdAt: Date.now(), kind: "password", lastSeenAt: Date.now() });
+    sessions.set(fullSessionId, {
+      createdAt: Date.now(),
+      kind: "password",
+      lastSeenAt: Date.now()
+    });
     setHqSessionCookie(
       res,
       serializeHqSessionCookie(fullSessionId, mutableAuth.cookieSecret),
@@ -2055,7 +1651,9 @@ async function handleApiLoginVerify(req, res, _url, mutableAuth, sessions, login
   }
   res.writeHead(400, { "Content-Type": "application/json" });
   res.end(
-    JSON.stringify({ error: { code: "BAD_REQUEST", message: "Provide a `code` or `recoveryCode`." } })
+    JSON.stringify({
+      error: { code: "BAD_REQUEST", message: "Provide a `code` or `recoveryCode`." }
+    })
   );
 }
 async function handleApiTotpSetup(req, res, mutableAuth, sessions, dataDir, applyAuthFile) {
@@ -2063,7 +1661,12 @@ async function handleApiTotpSetup(req, res, mutableAuth, sessions, dataDir, appl
   if (mutableAuth.totpSecret) {
     res.writeHead(409, { "Content-Type": "application/json" });
     res.end(
-      JSON.stringify({ error: { code: "TOTP_ALREADY_ENABLED", message: "2FA is already active. Disable it first to re-enroll." } })
+      JSON.stringify({
+        error: {
+          code: "TOTP_ALREADY_ENABLED",
+          message: "2FA is already active. Disable it first to re-enroll."
+        }
+      })
     );
     return;
   }
@@ -2082,7 +1685,9 @@ async function handleApiTotpEnable(req, res, mutableAuth, sessions, dataDir, app
   if (mutableAuth.totpSecret) {
     res.writeHead(409, { "Content-Type": "application/json" });
     res.end(
-      JSON.stringify({ error: { code: "TOTP_ALREADY_ENABLED", message: "2FA is already active." } })
+      JSON.stringify({
+        error: { code: "TOTP_ALREADY_ENABLED", message: "2FA is already active." }
+      })
     );
     return;
   }
@@ -2090,7 +1695,9 @@ async function handleApiTotpEnable(req, res, mutableAuth, sessions, dataDir, app
   if (!pendingSecret) {
     res.writeHead(400, { "Content-Type": "application/json" });
     res.end(
-      JSON.stringify({ error: { code: "TOTP_NOT_SETUP", message: "Call /api/auth/totp/setup first." } })
+      JSON.stringify({
+        error: { code: "TOTP_NOT_SETUP", message: "Call /api/auth/totp/setup first." }
+      })
     );
     return;
   }
@@ -2109,7 +1716,9 @@ async function handleApiTotpEnable(req, res, mutableAuth, sessions, dataDir, app
   }
   if (!verifyTotp(body.code, pendingSecret)) {
     res.writeHead(401, { "Content-Type": "application/json" });
-    res.end(JSON.stringify({ error: { code: "INVALID_TOTP", message: "Invalid authenticator code." } }));
+    res.end(
+      JSON.stringify({ error: { code: "INVALID_TOTP", message: "Invalid authenticator code." } })
+    );
     return;
   }
   const recoveryCodes = generateRecoveryCodes();
@@ -2132,7 +1741,11 @@ async function handleApiTotpDisable(req, res, mutableAuth, sessions, loginAttemp
   const { blocked, retryAfter } = loginAttempts.checkBlocked(clientIp);
   if (blocked) {
     res.writeHead(429, { "Content-Type": "application/json", "Retry-After": String(retryAfter) });
-    res.end(JSON.stringify({ error: { code: "RATE_LIMITED", message: "Too many attempts. Try again later." } }));
+    res.end(
+      JSON.stringify({
+        error: { code: "RATE_LIMITED", message: "Too many attempts. Try again later." }
+      })
+    );
     return;
   }
   let body;
@@ -2154,7 +1767,12 @@ async function handleApiTotpDisable(req, res, mutableAuth, sessions, loginAttemp
     recordVerifyFailure(loginAttempts, clientIp);
     res.writeHead(403, { "Content-Type": "application/json" });
     res.end(
-      JSON.stringify({ error: { code: "CONFIRMATION_REQUIRED", message: "Provide the current password or a TOTP code." } })
+      JSON.stringify({
+        error: {
+          code: "CONFIRMATION_REQUIRED",
+          message: "Provide the current password or a TOTP code."
+        }
+      })
     );
     return;
   }
@@ -2224,11 +1842,163 @@ function handleApiAuthAudit(_req, res, dataDir) {
   res.end(JSON.stringify({ entries }));
 }
 
+// src/hq-server/routes/session-handlers.ts
+import * as path4 from "node:path";
+import {
+  buildTranscriptFromEvents,
+  resolveHqDataDir as resolveHqDataDir3
+} from "@wrongstack/core/hq";
+async function handleApiSessions(res) {
+  const { getSessionRegistry } = await import("@wrongstack/core/storage");
+  const globalRoot = path4.dirname(resolveHqDataDir3());
+  try {
+    const registry = getSessionRegistry(globalRoot);
+    const sessions = await registry.list();
+    const result = sessions.filter((s) => s.status !== "stale").map((s) => ({
+      sessionId: s.sessionId,
+      projectSlug: s.projectSlug,
+      projectName: s.projectName,
+      projectRoot: s.projectRoot,
+      workingDir: s.workingDir,
+      status: s.status,
+      pid: s.pid,
+      startedAt: s.startedAt,
+      lastHeartbeatAt: s.lastHeartbeatAt,
+      agentCount: s.agentCount,
+      agents: s.agents.map((a) => ({
+        id: a.id,
+        name: a.name,
+        status: a.status,
+        currentTool: a.currentTool,
+        iterations: a.iterations,
+        toolCalls: a.toolCalls,
+        lastActivityAt: a.lastActivityAt
+      }))
+    }));
+    res.writeHead(200, { "Content-Type": "application/json" });
+    res.end(JSON.stringify(result));
+  } catch (err) {
+    res.writeHead(500, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ error: sanitizeApiError(err) }));
+  }
+}
+async function handleApiSessionEvents(req, res, match, transcripts) {
+  const { getSessionRegistry, DefaultSessionStore } = await import("@wrongstack/core/storage");
+  const { resolveWstackPaths } = await import("@wrongstack/core/utils");
+  const url = new URL(req.url ?? "/", "http://localhost");
+  const full = url.searchParams.get("full") === "1";
+  const rawLimit = Number.parseInt(url.searchParams.get("limit") ?? "200", 10);
+  const limit = Math.min(5e3, Math.max(1, Number.isFinite(rawLimit) ? rawLimit : 200));
+  const sessionId = decodeSessionId(match[1]);
+  if (sessionId === null) {
+    res.writeHead(400, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ error: "invalid sessionId encoding" }));
+    return;
+  }
+  const globalRoot = path4.dirname(resolveHqDataDir3());
+  try {
+    const registry = getSessionRegistry(globalRoot);
+    const entry = await registry.get(sessionId).catch(() => null);
+    let entries = [];
+    let source = "stream";
+    let status;
+    let clientType;
+    let projectName;
+    if (entry && "projectRoot" in entry) {
+      const paths = resolveWstackPaths({
+        projectRoot: entry.projectRoot,
+        globalRoot
+      });
+      const store = new DefaultSessionStore({
+        dir: paths.projectSessions,
+        projectRoot: entry.projectRoot
+      });
+      const data = await store.load(sessionId).catch(() => null);
+      if (data) {
+        entries = buildTranscriptFromEvents(
+          data.events.map((e) => e)
+        );
+        source = "disk";
+        status = entry.status;
+        clientType = entry.clientType;
+        projectName = entry.projectName;
+      }
+    }
+    if (entries.length === 0) {
+      const ring = transcripts.get(sessionId);
+      if (!ring && !entry) {
+        res.writeHead(404, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ error: "Session not found" }));
+        return;
+      }
+      entries = ring ? ring.entries : [];
+      source = "stream";
+      if (entry) {
+        status = entry.status;
+        clientType = entry.clientType;
+        projectName = entry.projectName;
+      }
+    }
+    const total = entries.length;
+    const tail = full ? entries : entries.slice(-limit);
+    res.writeHead(200, { "Content-Type": "application/json" });
+    res.end(
+      JSON.stringify({
+        sessionId,
+        source,
+        ...status !== void 0 ? { status } : {},
+        ...clientType !== void 0 ? { clientType } : {},
+        ...projectName !== void 0 ? { projectName } : {},
+        total,
+        entries: tail
+      })
+    );
+  } catch (err) {
+    res.writeHead(500, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ error: sanitizeApiError(err) }));
+  }
+}
+async function handleApiSessionAgentMessages(req, res, match, agentMessages) {
+  const url = new URL(req.url ?? "/", "http://localhost");
+  const sid = decodeSessionId(match[1]);
+  const aid = decodePathSegment(match[2]);
+  if (sid === null || aid === null) {
+    res.writeHead(400, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ error: "invalid session or agent id encoding" }));
+    return;
+  }
+  const full = url.searchParams.get("full") === "1";
+  const disk = await readLocalSubagentTranscript(sid, aid);
+  const source = disk !== null ? "disk" : "stream";
+  const all = disk !== null ? disk : agentMessages.get(agentRingKey(sid, aid)) ?? agentMessages.get(aid) ?? [];
+  const entries = full ? all : all.slice(-200);
+  res.writeHead(200, { "Content-Type": "application/json" });
+  res.end(JSON.stringify({ subagentId: aid, sessionId: sid, source, total: all.length, entries }));
+}
+async function handleApiAgentMessages(req, res, match, agentMessages) {
+  const url = new URL(req.url ?? "/", "http://localhost");
+  const id = decodePathSegment(match[1]);
+  if (id === null) {
+    res.writeHead(400, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ error: "invalid agent id encoding" }));
+    return;
+  }
+  const full = url.searchParams.get("full") === "1";
+  const merged = [];
+  for (const [key, ring] of agentMessages) {
+    if (key === id || key.endsWith(`::${id}`)) merged.push(...ring);
+  }
+  merged.sort((a, b) => a.ts.localeCompare(b.ts));
+  const entries = full ? merged : merged.slice(-200);
+  res.writeHead(200, { "Content-Type": "application/json" });
+  res.end(JSON.stringify({ subagentId: id, total: merged.length, entries }));
+}
+
 // src/hq-server/routes/system-handlers.ts
 async function handleApiSystemUpdate(res) {
   const [{ checkForUpdate }, { detectUpdatePackageName }] = await Promise.all([
-    import("./update-check-UMYTOH7Z.js"),
-    import("./update-MV6TUACD.js")
+    import("./update-check-WARHSVZA.js"),
+    import("./update-VZSOZGYC.js")
   ]);
   const packageName = detectUpdatePackageName();
   const info = await checkForUpdate({ packageName });
@@ -2238,260 +2008,562 @@ async function handleApiSystemUpdate(res) {
   });
   res.end(
     JSON.stringify({
-      ...info,
-      packageName,
-      command: "wstack update"
+      ...info,
+      packageName,
+      command: "wstack update"
+    })
+  );
+}
+async function handleApiSystemHealth(res, clients, persistence, eventLog) {
+  const now = Date.now();
+  const eventCount = eventLog.length;
+  let timeseriesStoreStatus = "unknown";
+  let kanbanStoreStatus = "unknown";
+  try {
+    const tsOk = await persistence.timeseries.read(now - 3e5);
+    timeseriesStoreStatus = Array.isArray(tsOk) ? "ok" : "degraded";
+  } catch {
+    timeseriesStoreStatus = "degraded";
+  }
+  try {
+    await persistence.kanban.load("__hq_health_probe__");
+    kanbanStoreStatus = "ok";
+  } catch {
+    kanbanStoreStatus = "degraded";
+  }
+  const inMemoryEventLogActive = true;
+  const allOk = inMemoryEventLogActive && timeseriesStoreStatus === "ok" && kanbanStoreStatus === "ok";
+  const clientCount = clients.size;
+  const connectedClients = [...clients.values()].filter(
+    (c) => Date.now() - new Date(c.lastSeenAt).getTime() < 6e4
+  ).length;
+  res.writeHead(200, {
+    "Content-Type": "application/json",
+    "Cache-Control": "no-store"
+  });
+  res.end(
+    JSON.stringify({
+      status: allOk ? "healthy" : "degraded",
+      uptime: {
+        serverTime: (/* @__PURE__ */ new Date()).toISOString(),
+        eventLogSize: eventCount
+      },
+      stores: {
+        events: "ok",
+        timeseries: timeseriesStoreStatus,
+        kanban: kanbanStoreStatus
+      },
+      connections: {
+        total: clientCount,
+        active: connectedClients,
+        stale: clientCount - connectedClients
+      }
+    })
+  );
+}
+async function handleApiCommandsAudit(req, res, auditLog) {
+  const url = new URL(req.url ?? "/", "http://localhost");
+  const rawLimit = Number.parseInt(url.searchParams.get("limit") ?? "200", 10);
+  const limit = Math.min(1e3, Math.max(1, Number.isFinite(rawLimit) ? rawLimit : 200));
+  res.writeHead(200, { "Content-Type": "application/json" });
+  res.end(JSON.stringify({ commands: auditLog.recent(limit) }));
+}
+async function handleApiAlerts(req, res, alertEngine) {
+  const url = new URL(req.url ?? "/", "http://localhost");
+  const rawLimit = Number.parseInt(url.searchParams.get("limit") ?? "100", 10);
+  const limit = Math.min(500, Math.max(1, Number.isFinite(rawLimit) ? rawLimit : 100));
+  res.writeHead(200, { "Content-Type": "application/json" });
+  res.end(
+    JSON.stringify({
+      active: alertEngine.activeAlerts(),
+      history: alertEngine.recentAlerts(limit)
     })
   );
 }
-async function handleApiSystemHealth(res, clients, persistence, eventLog) {
-  const now = Date.now();
-  const eventCount = eventLog.length;
-  let timeseriesStoreStatus = "unknown";
-  let kanbanStoreStatus = "unknown";
-  try {
-    const tsOk = await persistence.timeseries.read(now - 3e5);
-    timeseriesStoreStatus = Array.isArray(tsOk) ? "ok" : "degraded";
-  } catch {
-    timeseriesStoreStatus = "degraded";
+
+// src/hq-server/snapshot.ts
+import { WebSocket } from "ws";
+var HQ_SNAPSHOT_BROADCAST_DEBOUNCE_MS = 100;
+var HQ_SNAPSHOT_PERSIST_MIN_INTERVAL_MS = 3e3;
+var HQ_BROWSER_MAX_BUFFERED_BYTES = 32 * 1024 * 1024;
+function sendGuarded(ws, data) {
+  if (ws.readyState !== WebSocket.OPEN) return false;
+  const buffered = Number.isFinite(ws.bufferedAmount) ? ws.bufferedAmount : 0;
+  if (buffered + Buffer.byteLength(data, "utf8") > HQ_BROWSER_MAX_BUFFERED_BYTES) {
+    try {
+      ws.terminate();
+    } catch {
+      try {
+        ws.close(1013, "client cannot keep up");
+      } catch {
+      }
+    }
+    return false;
   }
   try {
-    await persistence.kanban.load("__hq_health_probe__");
-    kanbanStoreStatus = "ok";
+    ws.send(data);
+    return true;
   } catch {
-    kanbanStoreStatus = "degraded";
+    return false;
+  }
+}
+var HQ_STALE_SNAPSHOT_MS = 5 * 6e4;
+function reapStaleClientState(clients, nowMs = Date.now()) {
+  for (const client of clients.values()) {
+    for (const [sessionId, tracked] of client.sessions) {
+      if (nowMs - tracked.receivedAt > HQ_STALE_SNAPSHOT_MS) client.sessions.delete(sessionId);
+    }
+    for (const [runId, fleet] of client.fleets) {
+      if (nowMs - fleet.receivedAt > HQ_STALE_SNAPSHOT_MS) client.fleets.delete(runId);
+    }
+    for (const [sessionId, tracked] of client.mcpSnapshots) {
+      if (nowMs - tracked.receivedAt > HQ_STALE_SNAPSHOT_MS) client.mcpSnapshots.delete(sessionId);
+    }
+    if (client.governanceSnapshot !== void 0 && nowMs - client.governanceSnapshot.receivedAt > HQ_STALE_SNAPSHOT_MS) {
+      delete client.governanceSnapshot;
+    }
+  }
+}
+function buildSnapshot(clients, options) {
+  reapStaleClientState(clients);
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const clientRecordById = /* @__PURE__ */ new Map();
+  const projectMap = /* @__PURE__ */ new Map();
+  const mailboxSummaries = [];
+  const sessionById = /* @__PURE__ */ new Map();
+  const fleetByRunId = /* @__PURE__ */ new Map();
+  for (const client of clients.values()) {
+    const machineId = client.machineId || client.project.machineId || "";
+    if (!clientRecordById.has(client.clientId)) {
+      clientRecordById.set(client.clientId, {
+        clientId: client.clientId,
+        kind: client.kind,
+        machineId,
+        ...client.hostname ? { hostname: client.hostname } : {},
+        ...client.pid ? { pid: client.pid } : {},
+        ...client.version ? { version: client.version } : {},
+        connected: true,
+        connectedAt: client.connectedAt,
+        lastSeenAt: client.lastSeenAt,
+        projectId: client.projectId,
+        capabilities: client.capabilities
+      });
+    }
+    let project = projectMap.get(client.projectId);
+    if (!project) {
+      project = {
+        projectId: client.projectId,
+        projectName: client.project.projectName || client.projectId,
+        projectRootDisplay: client.project.projectRoot,
+        machineIds: [machineId],
+        ...client.project.gitBranch ? { gitBranch: client.project.gitBranch } : {},
+        activeClients: 0,
+        activeSessions: 0,
+        activeSubagents: 0,
+        totalCostUsd: 0,
+        lastActivityAt: now,
+        status: "active"
+      };
+      projectMap.set(client.projectId, project);
+    } else if (machineId && !project.machineIds.includes(machineId)) {
+      project.machineIds = [...project.machineIds, machineId];
+    }
+    const governance = client.governanceSnapshot?.payload;
+    if (governance !== void 0 && (project.governance === void 0 || Date.parse(governance.observedAt) >= Date.parse(project.governance.observedAt))) {
+      project.governance = governance;
+    }
+    for (const tracked of client.sessions.values()) {
+      const cutoff = Date.now() - 5 * 6e4;
+      const agents = tracked.payload.agents.filter((agent) => {
+        if (agent.id === "leader") return true;
+        const lastActivityAt = Date.parse(agent.lastActivityAt);
+        return Number.isFinite(lastActivityAt) && lastActivityAt >= cutoff;
+      });
+      sessionById.set(tracked.payload.sessionId, {
+        ...tracked.payload,
+        clientId: client.clientId,
+        agents,
+        agentCount: agents.length
+      });
+    }
+    for (const snapshot of client.mailboxes.values()) {
+      mailboxSummaries.push({
+        mailboxId: snapshot.mailboxId,
+        projectId: client.projectId,
+        scope: snapshot.scope,
+        messageCount: snapshot.totals.messages,
+        unreadCount: snapshot.totals.unread,
+        incompleteCount: snapshot.totals.incomplete,
+        highPriorityCount: snapshot.totals.highPriority,
+        onlineAgentCount: snapshot.totals.onlineAgents,
+        lastActivityAt: now
+      });
+    }
+    for (const fleet of client.fleets.values()) {
+      fleetByRunId.set(fleet.payload.runId, {
+        payload: fleet.payload,
+        clientId: client.clientId,
+        projectId: client.projectId,
+        lastActivityAt: new Date(fleet.receivedAt).toISOString()
+      });
+    }
+  }
+  const processKeyOf = (rec) => rec.pid !== void 0 ? `${rec.machineId}:${rec.pid}` : rec.clientId;
+  const countedProjectProcesses = /* @__PURE__ */ new Set();
+  for (const rec of clientRecordById.values()) {
+    const key = `${rec.projectId}|${processKeyOf(rec)}`;
+    if (countedProjectProcesses.has(key)) continue;
+    countedProjectProcesses.add(key);
+    const project = projectMap.get(rec.projectId);
+    if (project) project.activeClients++;
+  }
+  const liveSessions = Array.from(sessionById.values());
+  const machineMap = /* @__PURE__ */ new Map();
+  let totalAgents = 0;
+  let totalSubagents = 0;
+  let totalCostUsd = 0;
+  for (const session of liveSessions) {
+    let project = projectMap.get(session.projectId);
+    if (!project) {
+      project = {
+        projectId: session.projectId,
+        projectName: session.projectName || session.projectId,
+        projectRootDisplay: session.projectRoot,
+        machineIds: [session.machineId],
+        ...session.gitBranch ? { gitBranch: session.gitBranch } : {},
+        activeClients: 0,
+        activeSessions: 0,
+        activeSubagents: 0,
+        totalCostUsd: 0,
+        lastActivityAt: session.lastActivityAt,
+        status: "active"
+      };
+      projectMap.set(session.projectId, project);
+    } else if (session.machineId && !project.machineIds.includes(session.machineId)) {
+      project.machineIds = [...project.machineIds, session.machineId];
+    }
+    project.activeSessions++;
+    let sessionCost = 0;
+    for (const agent of session.agents) {
+      totalAgents++;
+      if (agent.id !== "leader") totalSubagents++;
+      if (typeof agent.costUsd === "number") {
+        sessionCost += agent.costUsd;
+      }
+    }
+    project.activeSubagents += session.agents.filter((a) => a.id !== "leader").length;
+    project.totalCostUsd += sessionCost;
+    totalCostUsd += sessionCost;
+    const mKey = hqMachineKey(session.hostname, session.machineId);
+    let machine = machineMap.get(mKey);
+    if (!machine) {
+      machine = {
+        record: {
+          machineId: session.machineId,
+          ...session.hostname ? { hostname: session.hostname } : {},
+          clientCount: 0,
+          sessionCount: 0,
+          agentCount: 0,
+          projectIds: [],
+          lastActivityAt: session.lastActivityAt
+        },
+        projects: /* @__PURE__ */ new Set()
+      };
+      machineMap.set(mKey, machine);
+    }
+    machine.record.sessionCount++;
+    machine.record.agentCount += session.agents.length;
+    machine.projects.add(session.projectId);
+    if (session.lastActivityAt > machine.record.lastActivityAt) {
+      machine.record.lastActivityAt = session.lastActivityAt;
+    }
+  }
+  const countedMachineProcesses = /* @__PURE__ */ new Set();
+  for (const rec of clientRecordById.values()) {
+    if (!rec.machineId && !rec.hostname) continue;
+    const rKey = hqMachineKey(rec.hostname, rec.machineId);
+    let machine = machineMap.get(rKey);
+    if (!machine) {
+      machine = {
+        record: {
+          machineId: rec.machineId,
+          ...rec.hostname ? { hostname: rec.hostname } : {},
+          clientCount: 0,
+          sessionCount: 0,
+          agentCount: 0,
+          projectIds: [],
+          lastActivityAt: rec.lastSeenAt
+        },
+        projects: /* @__PURE__ */ new Set()
+      };
+      machineMap.set(rKey, machine);
+    }
+    const processKey = `${rKey}|${processKeyOf(rec)}`;
+    if (!countedMachineProcesses.has(processKey)) {
+      countedMachineProcesses.add(processKey);
+      machine.record.clientCount++;
+    }
+    machine.projects.add(rec.projectId);
+    if (rec.hostname && !machine.record.hostname) machine.record.hostname = rec.hostname;
+  }
+  const machines = Array.from(machineMap.values()).map((m) => ({
+    ...m.record,
+    projectIds: Array.from(m.projects)
+  }));
+  const clientRecords = Array.from(clientRecordById.values());
+  const projects = Array.from(projectMap.values());
+  let unread = 0;
+  let incomplete = 0;
+  for (const m of mailboxSummaries) {
+    unread += m.unreadCount;
+    incomplete += m.incompleteCount;
   }
-  const inMemoryEventLogActive = true;
-  const allOk = inMemoryEventLogActive && timeseriesStoreStatus === "ok" && kanbanStoreStatus === "ok";
-  const clientCount = clients.size;
-  const connectedClients = [...clients.values()].filter(
-    (c) => Date.now() - new Date(c.lastSeenAt).getTime() < 6e4
-  ).length;
-  res.writeHead(200, {
-    "Content-Type": "application/json",
-    "Cache-Control": "no-store"
-  });
-  res.end(
-    JSON.stringify({
-      status: allOk ? "healthy" : "degraded",
-      uptime: {
-        serverTime: (/* @__PURE__ */ new Date()).toISOString(),
-        eventLogSize: eventCount
-      },
-      stores: {
-        events: "ok",
-        timeseries: timeseriesStoreStatus,
-        kanban: kanbanStoreStatus
-      },
-      connections: {
-        total: clientCount,
-        active: connectedClients,
-        stale: clientCount - connectedClients
-      }
-    })
-  );
-}
-async function handleApiCommandsAudit(req, res, auditLog) {
-  const url = new URL(req.url ?? "/", "http://localhost");
-  const rawLimit = Number.parseInt(url.searchParams.get("limit") ?? "200", 10);
-  const limit = Math.min(1e3, Math.max(1, Number.isFinite(rawLimit) ? rawLimit : 200));
-  res.writeHead(200, { "Content-Type": "application/json" });
-  res.end(JSON.stringify({ commands: auditLog.recent(limit) }));
-}
-async function handleApiAlerts(req, res, alertEngine) {
-  const url = new URL(req.url ?? "/", "http://localhost");
-  const rawLimit = Number.parseInt(url.searchParams.get("limit") ?? "100", 10);
-  const limit = Math.min(500, Math.max(1, Number.isFinite(rawLimit) ? rawLimit : 100));
-  res.writeHead(200, { "Content-Type": "application/json" });
-  res.end(
-    JSON.stringify({
-      active: alertEngine.activeAlerts(),
-      history: alertEngine.recentAlerts(limit)
-    })
-  );
-}
-
-// src/hq-server/routes/session-handlers.ts
-import * as path4 from "node:path";
-import {
-  buildTranscriptFromEvents,
-  resolveHqDataDir as resolveHqDataDir3
-} from "@wrongstack/core/hq";
-async function handleApiSessions(res) {
-  const { SessionRegistry } = await import("@wrongstack/core/storage");
-  const globalRoot = path4.dirname(resolveHqDataDir3());
-  try {
-    const registry = new SessionRegistry(globalRoot);
-    const sessions = await registry.list();
-    const result = sessions.filter((s) => s.status !== "stale").map((s) => ({
+  const sessions = liveSessions.map((s) => {
+    let sessionCost = 0;
+    for (const agent of s.agents) {
+      if (typeof agent.costUsd === "number") sessionCost += agent.costUsd;
+    }
+    const provider = s.agents.find((a) => a.model !== void 0)?.model;
+    return {
       sessionId: s.sessionId,
-      projectSlug: s.projectSlug,
-      projectName: s.projectName,
-      projectRoot: s.projectRoot,
-      workingDir: s.workingDir,
-      status: s.status,
-      pid: s.pid,
+      projectId: s.projectId,
+      clientId: s.clientId ?? `${s.machineId}:${s.clientKind}`,
+      status: s.status === "active" ? "running" : "idle",
+      ...provider !== void 0 ? { model: provider } : {},
       startedAt: s.startedAt,
-      lastHeartbeatAt: s.lastHeartbeatAt,
-      agentCount: s.agentCount,
-      agents: s.agents.map((a) => ({
-        id: a.id,
-        name: a.name,
-        status: a.status,
-        currentTool: a.currentTool,
-        iterations: a.iterations,
-        toolCalls: a.toolCalls,
-        lastActivityAt: a.lastActivityAt
-      }))
-    }));
-    res.writeHead(200, { "Content-Type": "application/json" });
-    res.end(JSON.stringify(result));
-  } catch (err) {
-    res.writeHead(500, { "Content-Type": "application/json" });
-    res.end(JSON.stringify({ error: sanitizeApiError(err) }));
+      lastActivityAt: s.lastActivityAt,
+      ...sessionCost > 0 ? { costUsd: sessionCost } : {}
+    };
+  });
+  const fleets = Array.from(fleetByRunId.values()).map((f) => ({
+    runId: f.payload.runId,
+    projectId: f.projectId,
+    clientId: f.clientId,
+    activeSubagents: f.payload.activeSubagents,
+    queuedTasks: f.payload.queuedTasks,
+    completedTasks: f.payload.completedTasks,
+    failedTasks: f.payload.failedTasks,
+    ...f.payload.totalCostUsd !== void 0 ? { totalCostUsd: f.payload.totalCostUsd } : {},
+    lastActivityAt: f.lastActivityAt,
+    ...f.payload.maxConcurrent !== void 0 ? { maxConcurrent: f.payload.maxConcurrent } : {},
+    ...f.payload.maxSpawns !== void 0 ? { maxSpawns: f.payload.maxSpawns } : {},
+    ...f.payload.usedSpawns !== void 0 ? { usedSpawns: f.payload.usedSpawns } : {},
+    ...f.payload.remainingSpawns !== void 0 ? { remainingSpawns: f.payload.remainingSpawns } : {},
+    ...f.payload.effectiveSource !== void 0 ? { effectiveSource: f.payload.effectiveSource } : {},
+    ...f.payload.checkpointMaxSpawns !== void 0 ? { checkpointMaxSpawns: f.payload.checkpointMaxSpawns } : {},
+    ...f.payload.ceilingMismatch ? { ceilingMismatch: true } : {}
+  }));
+  const mcpServers = [];
+  const seenMcp = /* @__PURE__ */ new Set();
+  for (const client of clients.values()) {
+    for (const [sessionId, tracked] of client.mcpSnapshots.entries()) {
+      for (const server of tracked.servers) {
+        const key = `${client.clientId}:${sessionId}:${server.name}`;
+        if (seenMcp.has(key)) continue;
+        seenMcp.add(key);
+        mcpServers.push(server);
+      }
+    }
   }
+  return {
+    generatedAt: now,
+    clients: clientRecords,
+    projects,
+    sessions,
+    fleets,
+    mailboxes: mailboxSummaries,
+    machines,
+    liveSessions,
+    mcpServers,
+    totals: {
+      activeProjects: projects.length,
+      activeClients: new Set(clientRecords.map(processKeyOf)).size,
+      activeSessions: liveSessions.length,
+      activeSubagents: totalSubagents,
+      unreadMailboxMessages: unread,
+      incompleteMailboxMessages: incomplete,
+      totalCostUsd,
+      activeMachines: machines.length,
+      activeAgents: totalAgents,
+      ...options?.tokenStats !== void 0 ? { tokenStats: options.tokenStats } : {}
+    }
+  };
 }
-async function handleApiSessionEvents(req, res, match, transcripts) {
-  const { SessionRegistry, DefaultSessionStore } = await import("@wrongstack/core/storage");
-  const { resolveWstackPaths } = await import("@wrongstack/core/utils");
-  const url = new URL(req.url ?? "/", "http://localhost");
-  const full = url.searchParams.get("full") === "1";
-  const rawLimit = Number.parseInt(url.searchParams.get("limit") ?? "200", 10);
-  const limit = Math.min(5e3, Math.max(1, Number.isFinite(rawLimit) ? rawLimit : 200));
-  const sessionId = decodeSessionId(match[1]);
-  if (sessionId === null) {
-    res.writeHead(400, { "Content-Type": "application/json" });
-    res.end(JSON.stringify({ error: "invalid sessionId encoding" }));
-    return;
-  }
-  const globalRoot = path4.dirname(resolveHqDataDir3());
-  try {
-    const registry = new SessionRegistry(globalRoot);
-    const entry = await registry.get(sessionId).catch(() => null);
-    let entries = [];
-    let source = "stream";
-    let status;
-    let clientType;
-    let projectName;
-    if (entry && "projectRoot" in entry) {
-      const paths = resolveWstackPaths({
-        projectRoot: entry.projectRoot,
-        globalRoot
-      });
-      const store = new DefaultSessionStore({ dir: paths.projectSessions });
-      const data = await store.load(sessionId).catch(() => null);
-      if (data) {
-        entries = buildTranscriptFromEvents(
-          data.events.map((e) => e)
-        );
-        source = "disk";
-        status = entry.status;
-        clientType = entry.clientType;
-        projectName = entry.projectName;
+function createSnapshotBroadcaster(clients, browsers, persistence) {
+  let cached = "";
+  let dirty = true;
+  let timer = null;
+  let closed = false;
+  let lastPersistAt = 0;
+  const persistCheckpoint = (snapshot) => {
+    if (persistence === void 0) return;
+    const now = Date.now();
+    if (now - lastPersistAt < HQ_SNAPSHOT_PERSIST_MIN_INTERVAL_MS) return;
+    lastPersistAt = now;
+    persistence.snapshotStore.save(snapshot);
+  };
+  const serialize = () => {
+    if (!dirty && cached.length > 0) return cached;
+    const snapshot = buildSnapshot(clients);
+    const msg = { type: "hq.snapshot", snapshot };
+    cached = JSON.stringify(msg);
+    dirty = false;
+    persistCheckpoint(snapshot);
+    return cached;
+  };
+  const flush = () => {
+    timer = null;
+    if (browsers.size === 0) {
+      if (persistence !== void 0 && Date.now() - lastPersistAt >= HQ_SNAPSHOT_PERSIST_MIN_INTERVAL_MS) {
+        persistCheckpoint(buildSnapshot(clients));
       }
+      return;
     }
-    if (entries.length === 0) {
-      const ring = transcripts.get(sessionId);
-      if (!ring && !entry) {
-        res.writeHead(404, { "Content-Type": "application/json" });
-        res.end(JSON.stringify({ error: "Session not found" }));
-        return;
-      }
-      entries = ring ? ring.entries : [];
-      source = "stream";
-      if (entry) {
-        status = entry.status;
-        clientType = entry.clientType;
-        projectName = entry.projectName;
+    const data = serialize();
+    for (const ws of browsers) sendGuarded(ws, data);
+  };
+  return {
+    currentSerialized: serialize,
+    broadcast: () => {
+      if (closed) return;
+      dirty = true;
+      if (timer !== null) return;
+      timer = setTimeout(flush, HQ_SNAPSHOT_BROADCAST_DEBOUNCE_MS);
+      timer.unref?.();
+    },
+    close: () => {
+      closed = true;
+      if (timer !== null) {
+        clearTimeout(timer);
+        timer = null;
       }
     }
-    const total = entries.length;
-    const tail = full ? entries : entries.slice(-limit);
-    res.writeHead(200, { "Content-Type": "application/json" });
-    res.end(
-      JSON.stringify({
-        sessionId,
-        source,
-        ...status !== void 0 ? { status } : {},
-        ...clientType !== void 0 ? { clientType } : {},
-        ...projectName !== void 0 ? { projectName } : {},
-        total,
-        entries: tail
-      })
-    );
-  } catch (err) {
-    res.writeHead(500, { "Content-Type": "application/json" });
-    res.end(JSON.stringify({ error: sanitizeApiError(err) }));
+  };
+}
+function buildProjectDetail(clients, projectId) {
+  const projectClients = [];
+  for (const c of clients.values()) {
+    if (c.projectId === projectId) projectClients.push(c);
+  }
+  if (projectClients.length === 0) return null;
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const clientRecords = projectClients.map((c) => ({
+    clientId: c.clientId,
+    kind: c.kind,
+    machineId: "",
+    ...c.hostname ? { hostname: c.hostname } : {},
+    ...c.pid ? { pid: c.pid } : {},
+    ...c.version ? { version: c.version } : {},
+    connected: true,
+    connectedAt: c.connectedAt,
+    lastSeenAt: c.lastSeenAt,
+    projectId: c.projectId,
+    capabilities: c.capabilities
+  }));
+  const mailboxPayloads = [];
+  let latestActivity = now;
+  for (const c of projectClients) {
+    for (const snap of c.mailboxes.values()) {
+      mailboxPayloads.push(snap);
+      if (snap.totals.messages > 0) latestActivity = now;
+    }
   }
+  const primaryProject = projectClients[0].project;
+  const machineIds = Array.from(new Set(projectClients.map((client) => client.project.machineId)));
+  const project = {
+    projectId,
+    projectName: primaryProject.projectName || projectId,
+    projectRootDisplay: primaryProject.projectRoot,
+    machineIds,
+    ...primaryProject.gitBranch ? { gitBranch: primaryProject.gitBranch } : {},
+    activeClients: projectClients.length,
+    activeSessions: 0,
+    activeSubagents: 0,
+    totalCostUsd: 0,
+    lastActivityAt: latestActivity,
+    status: "active"
+  };
+  return {
+    generatedAt: now,
+    project,
+    clients: clientRecords,
+    mailboxes: mailboxPayloads
+  };
 }
-async function handleApiSessionAgentMessages(req, res, match, agentMessages) {
-  const url = new URL(req.url ?? "/", "http://localhost");
-  const sid = decodeSessionId(match[1]);
-  const aid = decodePathSegment(match[2]);
-  if (sid === null || aid === null) {
-    res.writeHead(400, { "Content-Type": "application/json" });
-    res.end(JSON.stringify({ error: "invalid session or agent id encoding" }));
-    return;
-  }
-  const full = url.searchParams.get("full") === "1";
-  const disk = await readLocalSubagentTranscript(sid, aid);
-  const source = disk !== null ? "disk" : "stream";
-  const all = disk !== null ? disk : agentMessages.get(agentRingKey(sid, aid)) ?? agentMessages.get(aid) ?? [];
-  const entries = full ? all : all.slice(-200);
-  res.writeHead(200, { "Content-Type": "application/json" });
-  res.end(JSON.stringify({ subagentId: aid, sessionId: sid, source, total: all.length, entries }));
+function broadcastEvent(event, browsers) {
+  const msg = { type: "hq.event", event };
+  const data = JSON.stringify(msg);
+  for (const ws of browsers) sendGuarded(ws, data);
 }
-async function handleApiAgentMessages(req, res, match, agentMessages) {
-  const url = new URL(req.url ?? "/", "http://localhost");
-  const id = decodePathSegment(match[1]);
-  if (id === null) {
-    res.writeHead(400, { "Content-Type": "application/json" });
-    res.end(JSON.stringify({ error: "invalid agent id encoding" }));
-    return;
-  }
-  const full = url.searchParams.get("full") === "1";
-  const merged = [];
-  for (const [key, ring] of agentMessages) {
-    if (key === id || key.endsWith(`::${id}`)) merged.push(...ring);
-  }
-  merged.sort((a, b) => a.ts.localeCompare(b.ts));
-  const entries = full ? merged : merged.slice(-200);
-  res.writeHead(200, { "Content-Type": "application/json" });
-  res.end(JSON.stringify({ subagentId: id, total: merged.length, entries }));
+function broadcastCommandStatus(command, browsers) {
+  const data = JSON.stringify({ type: "hq.command_status", command });
+  for (const ws of browsers) sendGuarded(ws, data);
 }
 
-// src/hq-server/project-root.ts
-import { deriveHqProjectId } from "@wrongstack/core/hq";
-function resolveHqProjectRoot(globalRoot, ids) {
-  const fn = async () => {
-    const { SessionRegistry } = await import("@wrongstack/core/storage");
-    try {
-      const registry = new SessionRegistry(globalRoot);
-      if (typeof ids.sessionId === "string") {
-        const entry = await registry.get(ids.sessionId).catch(() => null);
-        if (entry?.projectRoot) return entry.projectRoot;
-      }
-      if (typeof ids.projectId === "string") {
-        const { createHash: createHash2 } = await import("node:crypto");
-        const all = await registry.list().catch(() => []);
-        const projectIds = /* @__PURE__ */ new Map();
-        const projectIdForRoot = (projectRoot) => {
-          const cached = projectIds.get(projectRoot);
-          if (cached !== void 0) return cached;
-          const derived = deriveHqProjectId(projectRoot);
-          projectIds.set(projectRoot, derived);
-          return derived;
-        };
-        const match = all.find(
-          (e) => e.projectSlug === ids.projectId || projectIdForRoot(e.projectRoot) === ids.projectId || createHash2("sha256").update(e.projectRoot).digest("hex").slice(0, 12) === ids.projectId
-        );
-        if (match) return match.projectRoot;
-      }
-    } catch {
-    }
-    return void 0;
+// src/hq-server/trust-boundary.ts
+import {
+  isTrustDecisionAllowed
+} from "@wrongstack/core/security";
+async function authorizeHqCommand(input) {
+  const { boundary, command, commandId, enqueuedBy, authMethod, target } = input;
+  const subject = command.type === "run-command" ? {
+    kind: "command",
+    id: command.command,
+    attributes: { targetClientId: target.clientId }
+  } : {
+    kind: "custom",
+    id: command.type,
+    attributes: { targetClientId: target.clientId }
   };
-  return fn();
+  const request = {
+    version: 1,
+    requestId: commandId,
+    // WS-050: this was hardcoded to `kind: 'user'`, which made the
+    // compatibility policy's ONLY deny rule — `remote-client` + `critical` —
+    // unreachable from HQ. A boundary whose single rule can never fire is not
+    // defence in depth, it is decoration.
+    //
+    // The provenance is derived from how the caller authenticated, because
+    // that is the honest signal available here:
+    //
+    //   session cookie → `user`. The dashboard's primary flow is a bootstrap
+    //     code exchanged for an HttpOnly cookie, so this is a human at the
+    //     browser. NOTE: bootstrap sessions DO carry a `tokenId`, so a
+    //     "cookie without tokenId" test would have misclassified every normal
+    //     dashboard user as remote and denied them run-command. Checked before
+    //     writing this, not assumed.
+    //   raw bearer token → `remote-client`. The legacy `?token=` / manual-entry
+    //     path and any script calling the HTTP API directly. A credential that
+    //     can be copied into a script is not a person at a console.
+    //
+    // Consequence, deliberate: a bearer-token caller can no longer trigger
+    // `run-command` (the only `critical` capability here). `enqueue` is `high`
+    // and unaffected. The migration for automation that needs execute is the
+    // bootstrap exchange, which is the same thing the dashboard does.
+    actor: { kind: authMethod === "session" ? "user" : "remote-client", id: enqueuedBy },
+    surface: "hq",
+    capability: command.type === "run-command" ? "hq.control.execute" : "hq.control.enqueue",
+    subject,
+    risk: command.type === "run-command" ? "critical" : "high",
+    scope: { projectId: target.projectId },
+    authContext: { method: authMethod, principalId: enqueuedBy },
+    metadata: { commandType: command.type, targetKind: target.kind }
+  };
+  const decision = await boundary.evaluate(request);
+  console.warn(
+    JSON.stringify({
+      level: "info",
+      event: "hq.trust_boundary.decision",
+      requestId: commandId,
+      capability: request.capability,
+      decision: decision.kind,
+      policyId: decision.policyId,
+      actor: enqueuedBy,
+      clientId: target.clientId,
+      timestamp: (/* @__PURE__ */ new Date()).toISOString()
+    })
+  );
+  return { allowed: isTrustDecisionAllowed(decision), reason: decision.reason };
 }
 
 // src/hq-server/routes.ts
@@ -2545,13 +2617,7 @@ function createHqRouter(deps) {
     try {
       const url = new URL(req.url ?? "/", `http://${host}:${listeningPort()}`);
       setHqSecurityHeaders2(res);
-      if (!hasTrustedBrowserOrigin2(
-        req,
-        host,
-        listeningPort(),
-        trustedPublicOrigins,
-        allowFileOrigin
-      )) {
+      if (!hasTrustedBrowserOrigin2(req, host, listeningPort(), trustedPublicOrigins, allowFileOrigin)) {
         res.writeHead(403, { "Content-Type": "application/json" });
         res.end(JSON.stringify({ error: "forbidden: untrusted request origin" }));
         return;
@@ -2584,7 +2650,16 @@ function createHqRouter(deps) {
         return;
       }
       if (url.pathname === "/api/auth/status" && req.method === "GET") {
-        await handleApiAuthStatus(req, res, url, mutableAuth, sessions, requireBrowserAuth, trustedPublicOrigins, secureCookies);
+        await handleApiAuthStatus(
+          req,
+          res,
+          url,
+          mutableAuth,
+          sessions,
+          requireBrowserAuth,
+          trustedPublicOrigins,
+          secureCookies
+        );
         return;
       }
       if (url.pathname === "/api/auth/audit" && req.method === "GET" || url.pathname.startsWith("/api/auth/sessions") && (req.method === "GET" || req.method === "DELETE") || url.pathname.startsWith("/api/auth/totp/") && req.method === "POST") {
@@ -2615,7 +2690,15 @@ function createHqRouter(deps) {
         return;
       }
       if (url.pathname === "/api/login" && req.method === "POST") {
-        await handleApiLogin(req, res, mutableAuth, sessions, loginAttempts, secureCookies, trustedProxyHops);
+        await handleApiLogin(
+          req,
+          res,
+          mutableAuth,
+          sessions,
+          loginAttempts,
+          secureCookies,
+          trustedProxyHops
+        );
         return;
       }
       if (url.pathname === "/api/auth/bootstrap" && req.method === "POST") {
@@ -2643,7 +2726,18 @@ function createHqRouter(deps) {
         return;
       }
       if (url.pathname === "/api/login/verify" && req.method === "POST") {
-        await handleApiLoginVerify(req, res, url, mutableAuth, sessions, loginAttempts, dataDir, secureCookies, applyAuthFile, trustedProxyHops);
+        await handleApiLoginVerify(
+          req,
+          res,
+          url,
+          mutableAuth,
+          sessions,
+          loginAttempts,
+          dataDir,
+          secureCookies,
+          applyAuthFile,
+          trustedProxyHops
+        );
         return;
       }
       if (url.pathname === "/api/auth/totp/setup" && req.method === "POST") {
@@ -2655,16 +2749,38 @@ function createHqRouter(deps) {
         return;
       }
       if (url.pathname === "/api/auth/totp/disable" && req.method === "POST") {
-        await handleApiTotpDisable(req, res, mutableAuth, sessions, loginAttempts, dataDir, applyAuthFile, trustedProxyHops);
+        await handleApiTotpDisable(
+          req,
+          res,
+          mutableAuth,
+          sessions,
+          loginAttempts,
+          dataDir,
+          applyAuthFile,
+          trustedProxyHops
+        );
         return;
       }
       if (url.pathname === "/api/auth/password" && (req.method === "POST" || req.method === "DELETE")) {
-        await handleApiPassword(req, res, mutableAuth, sessions, dataDir, secureCookies, requireBrowserAuth, applyAuthFile);
+        await handleApiPassword(
+          req,
+          res,
+          mutableAuth,
+          sessions,
+          dataDir,
+          secureCookies,
+          requireBrowserAuth,
+          applyAuthFile
+        );
         return;
       }
       if (url.pathname === "/api/snapshot" && req.method === "GET") {
         res.writeHead(200, { "Content-Type": "application/json" });
-        res.end(JSON.stringify(buildSnapshot(clients, { tokenStats: getTokenStats?.() })));
+        res.end(
+          JSON.stringify(
+            buildSnapshot(clients, { tokenStats: getTokenStats?.() })
+          )
+        );
         return;
       }
       if (url.pathname === "/api/system/update" && req.method === "GET") {
@@ -2679,7 +2795,14 @@ function createHqRouter(deps) {
         /^\/api\/projects\/([^/]+)\/mailbox(?:\/(.*))?$/
       );
       if (mailboxGatewayMatch) {
-        await handleMailboxGateway(req, res, mailboxGatewayMatch, authorizeMailboxGateway, getMailboxGateway, dataDir);
+        await handleMailboxGateway(
+          req,
+          res,
+          mailboxGatewayMatch,
+          authorizeMailboxGateway,
+          getMailboxGateway,
+          dataDir
+        );
         return;
       }
       const projectKanbanMatch = url.pathname.match(/^\/api\/projects\/([^/]+)\/kanban$/);
@@ -2687,7 +2810,9 @@ function createHqRouter(deps) {
         const projectId = decodePathSegment2(projectKanbanMatch[1]);
         if (projectId === null) {
           res.writeHead(400, { "Content-Type": "application/json" });
-          res.end(JSON.stringify({ error: { code: "VALIDATION_ERROR", message: "Invalid project id." } }));
+          res.end(
+            JSON.stringify({ error: { code: "VALIDATION_ERROR", message: "Invalid project id." } })
+          );
           return;
         }
         const snapshot = await persistence.kanban.load(projectId);
@@ -2701,7 +2826,11 @@ function createHqRouter(deps) {
       }
       if (url.pathname === "/api/fleet" && req.method === "GET") {
         res.writeHead(200, { "Content-Type": "application/json" });
-        res.end(JSON.stringify(buildSnapshot(clients, { tokenStats: getTokenStats?.() })));
+        res.end(
+          JSON.stringify(
+            buildSnapshot(clients, { tokenStats: getTokenStats?.() })
+          )
+        );
         return;
       }
       if (url.pathname === "/api/events" && req.method === "GET") {
@@ -2727,14 +2856,28 @@ function createHqRouter(deps) {
         return;
       }
       if (url.pathname === "/api/mailbox-send" && req.method === "POST") {
-        await handleApiMailboxSend(req, res, mutableAuth, sessions, dataDir, getMailboxGateway, hqSessionTag);
+        await handleApiMailboxSend(
+          req,
+          res,
+          mutableAuth,
+          sessions,
+          dataDir,
+          getMailboxGateway,
+          hqSessionTag
+        );
         return;
       }
-      const mailboxActionMatch = url.pathname.match(
-        /^\/api\/mailbox\/messages\/([^/]+)\/action$/
-      );
+      const mailboxActionMatch = url.pathname.match(/^\/api\/mailbox\/messages\/([^/]+)\/action$/);
       if (mailboxActionMatch && req.method === "POST") {
-        await handleMailboxAction(req, res, mailboxActionMatch, mutableAuth, sessions, dataDir, getMailboxGateway);
+        await handleMailboxAction(
+          req,
+          res,
+          mailboxActionMatch,
+          mutableAuth,
+          sessions,
+          dataDir,
+          getMailboxGateway
+        );
         return;
       }
       if (url.pathname === "/api/commands" && req.method === "GET") {
@@ -2830,9 +2973,7 @@ async function handleApiProjectDetail(_req, res, url, clients) {
   }
   if (!projectId) {
     res.writeHead(400, { "Content-Type": "application/json" });
-    res.end(
-      JSON.stringify({ error: { code: "BAD_REQUEST", message: "projectId is required" } })
-    );
+    res.end(JSON.stringify({ error: { code: "BAD_REQUEST", message: "projectId is required" } }));
     return;
   }
   const detail = buildProjectDetail(clients, projectId);
@@ -2921,9 +3062,7 @@ async function handleApiCommand(req, res, url, mutableAuth, sessions, clients, b
   const validated = validateHqCommand(queued);
   if (validated === null) {
     res.writeHead(400, { "Content-Type": "application/json" });
-    res.end(
-      JSON.stringify({ error: "unrecognized or malformed command", type: body.type })
-    );
+    res.end(JSON.stringify({ error: "unrecognized or malformed command", type: body.type }));
     return;
   }
   if (validated.type === "run-command" && !tokenHasCapability(target.authToken, "control.execute")) {
@@ -3019,9 +3158,17 @@ async function handleApiMailboxSend(_req, res, mutableAuth, sessions, dataDir, g
   const subject = typeof mbody.subject === "string" ? mbody.subject : "HQ prompt";
   const priority = mbody.priority === "high" ? "high" : mbody.priority === "low" ? "low" : "normal";
   const audience = mbody.audience === "leaders" ? "leaders" : "all";
-  const mailboxType = mbody.type === "queue" ? "note" : ["note", "ask", "assign", "steer", "btw", "broadcast", "status", "result", "review"].includes(
-    mbody.type
-  ) ? mbody.type : void 0;
+  const mailboxType = mbody.type === "queue" ? "note" : [
+    "note",
+    "ask",
+    "assign",
+    "steer",
+    "btw",
+    "broadcast",
+    "status",
+    "result",
+    "review"
+  ].includes(mbody.type) ? mbody.type : void 0;
   if (mailboxType === void 0) {
     res.writeHead(400, { "Content-Type": "application/json" });
     res.end(
@@ -3092,13 +3239,7 @@ async function handleMailboxAction(_req, res, match, mutableAuth, sessions, data
     res.end(JSON.stringify({ error: "forbidden: token lacks control.enqueue capability" }));
     return;
   }
-  const MAILBOX_ACTIONS = [
-    "mark-read",
-    "acknowledge",
-    "reopen",
-    "soft-delete",
-    "restore"
-  ];
+  const MAILBOX_ACTIONS = ["mark-read", "acknowledge", "reopen", "soft-delete", "restore"];
   let abody;
   try {
     abody = JSON.parse(await readRequestBody2(_req));
@@ -4046,6 +4187,7 @@ async function startHqServerWithAuth(options, host, port, dataDir, firstRunAuth)
     const trustedPublicOrigins = /* @__PURE__ */ new Set();
     let listeningPort = port;
     const clients = /* @__PURE__ */ new Map();
+    const clientSocketTokens = /* @__PURE__ */ new Map();
     const browsers = /* @__PURE__ */ new Set();
     const sessions = /* @__PURE__ */ new Map();
     const eventLog = [];
@@ -4417,6 +4559,9 @@ async function startHqServerWithAuth(options, host, port, dataDir, firstRunAuth)
         handleBrowser(ws, snapshotBroadcaster, browsers, eventLog);
       } else {
         const token = new URL(req.url ?? "/", `http://${host}:${port}`).searchParams.get("token");
+        const authToken = token ? mutableAuth.clientTokenObjs.get(hqTokenVerifier2(token)) : void 0;
+        clientSocketTokens.set(ws, authToken);
+        ws.once("close", () => clientSocketTokens.delete(ws));
         handleClient(
           ws,
           clients,
@@ -4427,7 +4572,7 @@ async function startHqServerWithAuth(options, host, port, dataDir, firstRunAuth)
             // so the presented secret is hashed before lookup. Indexing with the
             // raw value silently returned undefined, which downgraded a scoped
             // token to "no capabilities record" at the capability gate.
-            ...token ? { token: mutableAuth.clientTokenObjs.get(hqTokenVerifier2(token)) } : {},
+            ...authToken ? { token: authToken } : {},
             getOperatorPolicy: () => mutableAuth.operatorPolicyOverride
           },
           snapshotBroadcaster,
@@ -4441,7 +4586,29 @@ async function startHqServerWithAuth(options, host, port, dataDir, firstRunAuth)
     const authWatcher = watchHqAuthFile(
       dataDir,
       (next) => {
+        const previousBrowserTokens = mutableAuth.browserTokens;
+        const previousPasswordHash = mutableAuth.passwordHash;
+        const previousCookieSecret = mutableAuth.cookieSecret;
         authState.apply(next);
+        const browserTokensChanged = previousBrowserTokens.size !== mutableAuth.browserTokens.size || [...previousBrowserTokens].some((token) => !mutableAuth.browserTokens.has(token));
+        const passwordChanged = previousPasswordHash !== mutableAuth.passwordHash;
+        const cookieSecretChanged = previousCookieSecret !== mutableAuth.cookieSecret;
+        if (browserTokensChanged || passwordChanged || cookieSecretChanged) {
+          const liveBrowserTokenIds = new Set(
+            [...mutableAuth.browserTokenObjs.values()].map((token) => token.id)
+          );
+          for (const [sessionId, session] of sessions) {
+            if (passwordChanged || cookieSecretChanged || session.kind === "token" && (session.tokenId === void 0 || !liveBrowserTokenIds.has(session.tokenId))) {
+              sessions.delete(sessionId);
+            }
+          }
+          for (const browser of browsers) browser.close(1008, "Browser authentication changed");
+        }
+        const clientAuthRequired = hqClientAuthRequired(mutableAuth);
+        for (const [clientSocket, authToken] of clientSocketTokens) {
+          const stillAuthorized = authToken === void 0 ? !clientAuthRequired : !isTokenExpired4(authToken) && mutableAuth.clientTokenObjs.has(hqTokenKey2(authToken));
+          if (!stillAuthorized) clientSocket.close(1008, "Client authentication revoked");
+        }
         if ((options.requireBrowserAuth || mutableAuth.requireAuthFloor) && mutableAuth.browserTokens.size === 0 && mutableAuth.passwordHash === void 0) {
           sessions.clear();
           for (const browser of browsers) browser.close(1008, "Browser authentication removed");
@@ -4606,4 +4773,4 @@ export {
   startHqServer,
   HqInsecureExposureError2 as HqInsecureExposureError
 };
-//# sourceMappingURL=chunk-2KDOFTTM.js.map
+//# sourceMappingURL=chunk-LUAFQIXT.js.map