@wrongstack/cli 0.306.4 → 0.307.1

package/dist/{chunk-RHLQT3EV.js → chunk-CB35UVXO.js}

@@ -7,17 +7,12 @@ import {
 } from "./chunk-Q5GTM25S.js";
 
 // src/hq-server.ts
-import { randomUUID as randomUUID4 } from "node:crypto";
+import { randomUUID as randomUUID6 } from "node:crypto";
 import * as fs5 from "node:fs/promises";
 import * as http from "node:http";
 import * as path7 from "node:path";
 import {
-  createMailboxHttpRouter,
-  createProjectMailbox,
-  getSharedProjectMailbox,
-  MAILBOX_HTTP_DEFAULT_MAX_AGE_MS,
-  MailboxEventEmitter,
-  MailboxHttpRateLimiter
+  getSharedProjectMailbox
 } from "@wrongstack/core/coordination";
 import {
   assessHqExposure as assessHqExposure2,
@@ -26,11 +21,9 @@ import {
   HqBootstrapCodeStore,
   HqCommandAuditLog,
   hqTokenKey as hqTokenKey2,
-  hqTokenVerifier as hqTokenVerifier2,
-  isLoopbackHost as isLoopbackHost3,
   isTokenExpired as isTokenExpired4,
   mintHqCookieSecret as mintHqCookieSecret2,
-  mutateHqAuthFile as mutateHqAuthFile2,
+  mutateHqAuthFile as mutateHqAuthFile3,
   toAlertMessage,
   watchHqAuthFile
 } from "@wrongstack/core/hq";
@@ -583,76 +576,14 @@ var LoginAttemptStore = class _LoginAttemptStore {
   }
 };
 
-// src/hq-server/preflight.ts
-import {
-  assessHqExposure,
-  ensureHqFirstRunAuthFile,
-  HqInsecureExposureError,
-  isTokenExpired as isTokenExpired3,
-  resolveHqDataDir
-} from "@wrongstack/core/hq";
-async function prepareHqServerStart(options, defaults) {
-  const host = options.host ?? defaults.host;
-  const port = options.port ?? defaults.port;
-  const dataDir = resolveHqDataDir(options.dataDir);
-  const firstRunAuth = await ensureHqFirstRunAuthFile(dataDir, {
-    warn: (message) => console.warn(
-      JSON.stringify({
-        level: "warn",
-        event: "hq.auth_load_failed",
-        message,
-        timestamp: (/* @__PURE__ */ new Date()).toISOString()
-      })
-    ),
-    actor: resolveAuditActor(),
-    ...options.password !== void 0 ? { password: options.password } : {},
-    ...options.tokenTtlMs !== void 0 ? { tokenTtlMs: options.tokenTtlMs } : {}
-  });
-  const { authFile } = firstRunAuth;
-  const rawBrowserTokens = authFile.browserTokens ?? [];
-  const liveBrowserTokens = rawBrowserTokens.filter((token) => !isTokenExpired3(token));
-  const hasPassword = authFile.passwordHash !== void 0;
-  const allTokensExpired = rawBrowserTokens.length > 0 && liveBrowserTokens.length === 0;
-  if (options.requireBrowserAuth && liveBrowserTokens.length === 0 && !hasPassword) {
-    throw new HqInsecureExposureError(
-      allTokensExpired ? `HQ public relay requires browser authentication, but all ${rawBrowserTokens.length} browser token(s) in the auth file have expired. Create a fresh token or set --password.` : "HQ public relay requires browser authentication. Set --password or create a browser token first."
-    );
-  }
-  const exposure = assessHqExposure({
-    host,
-    hasBrowserTokens: liveBrowserTokens.length > 0,
-    hasPassword,
-    allowInsecure: options.allowInsecureOpen
-  });
-  if (exposure.kind === "refuse") {
-    throw new HqInsecureExposureError(
-      allTokensExpired ? `${exposure.message} (all ${rawBrowserTokens.length} browser token(s) in the auth file have expired)` : exposure.message
-    );
-  }
-  if (exposure.kind === "warn") {
-    console.warn(
-      JSON.stringify({
-        level: "warn",
-        event: "hq.insecure_exposure",
-        message: exposure.message,
-        host,
-        timestamp: (/* @__PURE__ */ new Date()).toISOString()
-      })
-    );
-  }
-  return { host, port, dataDir, firstRunAuth };
-}
-
-// src/hq-server/routes.ts
-import { randomUUID as randomUUID2 } from "node:crypto";
-import * as path5 from "node:path";
+// src/hq-server/mailbox-gateway-manager.ts
 import {
-  resolveProjectDir
+  createMailboxHttpRouter,
+  createProjectMailbox,
+  MAILBOX_HTTP_DEFAULT_MAX_AGE_MS,
+  MailboxEventEmitter,
+  MailboxHttpRateLimiter
 } from "@wrongstack/core/coordination";
-import {
-  tokenHasCapability,
-  validateHqCommand
-} from "@wrongstack/core/hq";
 
 // src/hq-static-serve.ts
 import * as fs2 from "node:fs";
@@ -758,58 +689,59 @@ async function serveHqStatic(_req, res, urlPath, distDir) {
   return { handled: true };
 }
 
-// src/hq-server/project-root.ts
-import { deriveHqProjectId } from "@wrongstack/core/hq";
-function resolveHqProjectRoot(globalRoot, ids) {
-  const fn = async () => {
-    const { getSessionRegistry } = await import("@wrongstack/core/storage");
-    try {
-      const registry = getSessionRegistry(globalRoot);
-      if (typeof ids.sessionId === "string") {
-        const entry = await registry.get(ids.sessionId).catch(() => null);
-        if (entry?.projectRoot) return entry.projectRoot;
-      }
-      if (typeof ids.projectId === "string") {
-        const { createHash: createHash2 } = await import("node:crypto");
-        const all = await registry.list().catch(() => []);
-        const projectIds = /* @__PURE__ */ new Map();
-        const projectIdForRoot = (projectRoot) => {
-          const cached = projectIds.get(projectRoot);
-          if (cached !== void 0) return cached;
-          const derived = deriveHqProjectId(projectRoot);
-          projectIds.set(projectRoot, derived);
-          return derived;
-        };
-        const match = all.find(
-          (e) => e.projectSlug === ids.projectId || projectIdForRoot(e.projectRoot) === ids.projectId || createHash2("sha256").update(e.projectRoot).digest("hex").slice(0, 12) === ids.projectId
-        );
-        if (match) return match.projectRoot;
+// src/hq-server/routes/auth/common.ts
+import { isLoopbackHost as isLoopbackHost2 } from "@wrongstack/core/hq";
+function isLoopbackRequest(req) {
+  const address = req.socket.remoteAddress?.replace(/^::ffff:/, "");
+  return address !== void 0 && isLoopbackHost2(address);
+}
+var HQ_AUTH_ADMIN_CAPABILITY = "auth.admin";
+function callerCanAdministerAuth(auth) {
+  if (auth === void 0) return false;
+  if (auth.kind === "cookie" && auth.tokenId === void 0) return true;
+  if (auth.capabilities === void 0) return true;
+  return auth.capabilities.includes(HQ_AUTH_ADMIN_CAPABILITY);
+}
+function writeAuthAdminRequired(res) {
+  res.writeHead(403, { "Content-Type": "application/json" });
+  res.end(
+    JSON.stringify({
+      error: {
+        code: "AUTH_ADMIN_REQUIRED",
+        message: `This endpoint requires the '${HQ_AUTH_ADMIN_CAPABILITY}' capability.`
       }
-    } catch {
-    }
+    })
+  );
+}
+function authorizeAuthAdmin(req, res, mutableAuth, sessions) {
+  const auth = authenticateBrowserRequest(
+    req,
+    new URL(req.url ?? "/", "http://localhost"),
+    mutableAuth,
+    sessions
+  );
+  if (!auth) {
+    res.writeHead(401, { "Content-Type": "application/json" });
+    res.end(
+      JSON.stringify({ error: { code: "UNAUTHORIZED", message: "Authentication required." } })
+    );
     return void 0;
-  };
-  return fn();
+  }
+  if (!callerCanAdministerAuth(auth)) {
+    writeAuthAdminRequired(res);
+    return void 0;
+  }
+  return auth;
 }
 
-// src/hq-server/routes/auth-handlers.ts
+// src/hq-server/routes/auth/password-routes.ts
 import { randomUUID } from "node:crypto";
 import {
   hashHqPassword,
-  isLoopbackHost as isLoopbackHost2,
   mintHqCookieSecret,
   mutateHqAuthFile,
   verifyHqPassword
 } from "@wrongstack/core/hq";
-import {
-  buildOtpAuthUri,
-  generateRecoveryCodes,
-  generateTotpSecret,
-  hashRecoveryCode,
-  verifyRecoveryCode,
-  verifyTotp,
-  verifyTotpCounter
-} from "@wrongstack/core/security";
 
 // src/hq-server/client-address.ts
 import { isIP as isIP2 } from "node:net";
@@ -856,7 +788,7 @@ function resolveClientAddress(req, trustedProxyHops = 0) {
 import * as fs3 from "node:fs/promises";
 import * as os from "node:os";
 import * as path3 from "node:path";
-import { resolveHqDataDir as resolveHqDataDir2 } from "@wrongstack/core/hq";
+import { resolveHqDataDir } from "@wrongstack/core/hq";
 import { sanitizeApiError, scrubErrorDetail } from "@wrongstack/core/security";
 var TRANSCRIPT_RING_MAX = 4e3;
 var MAX_TRANSCRIPT_SESSIONS = 400;
@@ -886,7 +818,7 @@ async function readLocalSubagentTranscript(sessionId, subagentId) {
   try {
     const { getSessionRegistry } = await import("@wrongstack/core/storage");
     const { resolveWstackPaths, sessionScopedPath } = await import("@wrongstack/core/utils");
-    const globalRoot = path3.dirname(resolveHqDataDir2());
+    const globalRoot = path3.dirname(resolveHqDataDir());
     const registry = getSessionRegistry(globalRoot);
     const entry = await registry.get(sessionId).catch(() => null);
     if (!entry) return null;
@@ -1044,50 +976,7 @@ function recordTimeseriesSignal(persistence, event) {
   }
 }
 
-// src/hq-server/routes/auth-handlers.ts
-import { readHqAuthAuditTail } from "@wrongstack/core/hq";
-function isLoopbackRequest(req) {
-  const address = req.socket.remoteAddress?.replace(/^::ffff:/, "");
-  return address !== void 0 && isLoopbackHost2(address);
-}
-var HQ_AUTH_ADMIN_CAPABILITY = "auth.admin";
-function callerCanAdministerAuth(auth) {
-  if (auth === void 0) return false;
-  if (auth.kind === "cookie" && auth.tokenId === void 0) return true;
-  if (auth.capabilities === void 0) return true;
-  return auth.capabilities.includes(HQ_AUTH_ADMIN_CAPABILITY);
-}
-function writeAuthAdminRequired(res) {
-  res.writeHead(403, { "Content-Type": "application/json" });
-  res.end(
-    JSON.stringify({
-      error: {
-        code: "AUTH_ADMIN_REQUIRED",
-        message: `This endpoint requires the '${HQ_AUTH_ADMIN_CAPABILITY}' capability.`
-      }
-    })
-  );
-}
-function authorizeAuthAdmin(req, res, mutableAuth, sessions) {
-  const auth = authenticateBrowserRequest(
-    req,
-    new URL(req.url ?? "/", "http://localhost"),
-    mutableAuth,
-    sessions
-  );
-  if (!auth) {
-    res.writeHead(401, { "Content-Type": "application/json" });
-    res.end(
-      JSON.stringify({ error: { code: "UNAUTHORIZED", message: "Authentication required." } })
-    );
-    return void 0;
-  }
-  if (!callerCanAdministerAuth(auth)) {
-    writeAuthAdminRequired(res);
-    return void 0;
-  }
-  return auth;
-}
+// src/hq-server/routes/auth/password-routes.ts
 async function handleApiAuthStatus(req, res, url, mutableAuth, sessions, requireBrowserAuth, trustedPublicOrigins, secureCookies) {
   const auth = authenticateBrowserRequest(req, url, mutableAuth, sessions);
   const openMode = mutableAuth.browserTokens.size === 0 && mutableAuth.passwordHash === void 0 && mutableAuth.requireAuthFloor !== true;
@@ -1338,164 +1227,51 @@ async function handleApiPassword(req, res, mutableAuth, sessions, dataDir, secur
     })
   );
 }
-async function handleApiBootstrap(req, res, mutableAuth, sessions, secureCookies, bootstrapStore) {
+
+// src/hq-server/routes/auth/totp-routes.ts
+import { randomUUID as randomUUID2 } from "node:crypto";
+import { mutateHqAuthFile as mutateHqAuthFile2, verifyHqPassword as verifyHqPassword2 } from "@wrongstack/core/hq";
+import {
+  buildOtpAuthUri,
+  generateRecoveryCodes,
+  generateTotpSecret,
+  hashRecoveryCode,
+  verifyRecoveryCode,
+  verifyTotp,
+  verifyTotpCounter
+} from "@wrongstack/core/security";
+var PENDING_2FA_TTL_MS = 5 * 6e4;
+var recoveryCodeLock = Promise.resolve();
+var MAX_2FA_VERIFY_FAILURES = 5;
+function recordVerifyFailure(loginAttempts, clientIp) {
+  const prev = loginAttempts.get(clientIp);
+  const count = (prev?.count ?? 0) + 1;
+  loginAttempts.recordFailure(clientIp);
+  return count;
+}
+async function handleApiLoginVerify(req, res, _url, mutableAuth, sessions, loginAttempts, dataDir, secureCookies, applyAuthFile, trustedProxyHops) {
   if (!mutableAuth.cookieSecret) {
     res.writeHead(503, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ error: { code: "NO_COOKIE_SECRET" } }));
+    return;
+  }
+  const clientIp = resolveClientAddress(req, trustedProxyHops);
+  const { blocked, retryAfter } = loginAttempts.checkBlocked(clientIp);
+  if (blocked) {
+    res.writeHead(429, { "Content-Type": "application/json", "Retry-After": String(retryAfter) });
     res.end(
       JSON.stringify({
-        error: {
-          code: "BOOTSTRAP_UNAVAILABLE",
-          message: "Cookie signing is not configured on this HQ server."
-        }
+        error: { code: "RATE_LIMITED", message: "Too many attempts. Try again later." }
       })
     );
     return;
   }
-  let body;
-  try {
-    body = JSON.parse(await readRequestBody(req));
-  } catch (error) {
-    writeInvalidBody(res, error);
-    return;
-  }
-  if (typeof body.code !== "string" || body.code.length === 0) {
-    res.writeHead(400, { "Content-Type": "application/json" });
-    res.end(JSON.stringify({ error: { code: "BAD_REQUEST", message: "code is required" } }));
-    return;
-  }
-  const entry = bootstrapStore.consume(body.code);
-  if (!entry) {
+  const raw = readHqSessionCookie(req.headers.cookie);
+  const sessionId = raw ? parseHqSessionCookie(raw, mutableAuth.cookieSecret) : void 0;
+  if (!sessionId) {
     res.writeHead(401, { "Content-Type": "application/json" });
     res.end(
-      JSON.stringify({
-        error: {
-          code: "INVALID_OR_EXPIRED_CODE",
-          message: "The bootstrap code is invalid, already used, or expired."
-        }
-      })
-    );
-    return;
-  }
-  const tokenLive = [...mutableAuth.browserTokenObjs.values()].some(
-    (obj) => obj.id === entry.tokenId
-  );
-  if (!tokenLive) {
-    res.writeHead(401, { "Content-Type": "application/json" });
-    res.end(
-      JSON.stringify({
-        error: {
-          code: "TOKEN_REVOKED",
-          message: "The token that issued this bootstrap code has been revoked."
-        }
-      })
-    );
-    return;
-  }
-  const sessionId = randomUUID();
-  sessions.set(sessionId, {
-    createdAt: Date.now(),
-    lastSeenAt: Date.now(),
-    kind: "token",
-    tokenId: entry.tokenId,
-    ...entry.capabilities !== void 0 ? { capabilities: entry.capabilities } : {}
-  });
-  setHqSessionCookie(
-    res,
-    serializeHqSessionCookie(sessionId, mutableAuth.cookieSecret),
-    secureCookies
-  );
-  res.writeHead(200, { "Content-Type": "application/json" });
-  res.end(JSON.stringify({ loggedIn: true }));
-}
-async function handleApiTokenUpgrade(req, res, url, mutableAuth, sessions, secureCookies) {
-  if (!mutableAuth.cookieSecret) {
-    res.writeHead(503, { "Content-Type": "application/json" });
-    res.end(
-      JSON.stringify({
-        error: {
-          code: "UPGRADE_UNAVAILABLE",
-          message: "Cookie signing is not configured on this HQ server."
-        }
-      })
-    );
-    return;
-  }
-  const auth = authenticateBrowserRequest(req, url, mutableAuth, sessions);
-  if (isCookieAuth(auth)) {
-    res.writeHead(200, { "Content-Type": "application/json" });
-    res.end(JSON.stringify({ loggedIn: true, upgraded: false }));
-    return;
-  }
-  if (!isTokenAuth(auth)) {
-    res.writeHead(401, { "Content-Type": "application/json" });
-    res.end(
-      JSON.stringify({
-        error: { code: "UNAUTHORIZED", message: "A valid browser token is required." }
-      })
-    );
-    return;
-  }
-  const tokenLive = [...mutableAuth.browserTokenObjs.values()].some((obj) => obj.id === auth.id);
-  if (!tokenLive) {
-    res.writeHead(409, { "Content-Type": "application/json" });
-    res.end(
-      JSON.stringify({
-        error: {
-          code: "TOKEN_NOT_UPGRADEABLE",
-          message: "This token has no server-side record to bind a session to."
-        }
-      })
-    );
-    return;
-  }
-  const sessionId = randomUUID();
-  sessions.set(sessionId, {
-    createdAt: Date.now(),
-    lastSeenAt: Date.now(),
-    kind: "token",
-    tokenId: auth.id,
-    ...auth.capabilities !== void 0 ? { capabilities: auth.capabilities } : {}
-  });
-  setHqSessionCookie(
-    res,
-    serializeHqSessionCookie(sessionId, mutableAuth.cookieSecret),
-    secureCookies
-  );
-  res.writeHead(200, { "Content-Type": "application/json" });
-  res.end(JSON.stringify({ loggedIn: true, upgraded: true }));
-}
-var PENDING_2FA_TTL_MS = 5 * 6e4;
-var recoveryCodeLock = Promise.resolve();
-var MAX_2FA_VERIFY_FAILURES = 5;
-function recordVerifyFailure(loginAttempts, clientIp) {
-  const prev = loginAttempts.get(clientIp);
-  const count = (prev?.count ?? 0) + 1;
-  loginAttempts.recordFailure(clientIp);
-  return count;
-}
-async function handleApiLoginVerify(req, res, _url, mutableAuth, sessions, loginAttempts, dataDir, secureCookies, applyAuthFile, trustedProxyHops) {
-  if (!mutableAuth.cookieSecret) {
-    res.writeHead(503, { "Content-Type": "application/json" });
-    res.end(JSON.stringify({ error: { code: "NO_COOKIE_SECRET" } }));
-    return;
-  }
-  const clientIp = resolveClientAddress(req, trustedProxyHops);
-  const { blocked, retryAfter } = loginAttempts.checkBlocked(clientIp);
-  if (blocked) {
-    res.writeHead(429, { "Content-Type": "application/json", "Retry-After": String(retryAfter) });
-    res.end(
-      JSON.stringify({
-        error: { code: "RATE_LIMITED", message: "Too many attempts. Try again later." }
-      })
-    );
-    return;
-  }
-  const raw = readHqSessionCookie(req.headers.cookie);
-  const sessionId = raw ? parseHqSessionCookie(raw, mutableAuth.cookieSecret) : void 0;
-  if (!sessionId) {
-    res.writeHead(401, { "Content-Type": "application/json" });
-    res.end(
-      JSON.stringify({ error: { code: "NO_PENDING_SESSION", message: "No pending 2FA session." } })
+      JSON.stringify({ error: { code: "NO_PENDING_SESSION", message: "No pending 2FA session." } })
     );
     return;
   }
@@ -1555,7 +1331,7 @@ async function handleApiLoginVerify(req, res, _url, mutableAuth, sessions, login
     mutableAuth.totpLastUsedCounter = matchedCounter;
     loginAttempts.clearOnSuccess(clientIp);
     sessions.delete(sessionId);
-    const fullSessionId = randomUUID();
+    const fullSessionId = randomUUID2();
     sessions.set(fullSessionId, {
       createdAt: Date.now(),
       kind: "password",
@@ -1603,7 +1379,7 @@ async function handleApiLoginVerify(req, res, _url, mutableAuth, sessions, login
       releaseLock = resolve2;
     });
     try {
-      const next = await mutateHqAuthFile(dataDir, (current) => {
+      const next = await mutateHqAuthFile2(dataDir, (current) => {
         const diskHashes = current.totpRecoveryCodes ?? [];
         const idx = diskHashes.indexOf(usedHash);
         if (idx === -1) {
@@ -1634,7 +1410,7 @@ async function handleApiLoginVerify(req, res, _url, mutableAuth, sessions, login
     }
     loginAttempts.clearOnSuccess(clientIp);
     sessions.delete(sessionId);
-    const fullSessionId = randomUUID();
+    const fullSessionId = randomUUID2();
     sessions.set(fullSessionId, {
       createdAt: Date.now(),
       kind: "password",
@@ -1672,7 +1448,7 @@ async function handleApiTotpSetup(req, res, mutableAuth, sessions, dataDir, appl
   }
   const secret = generateTotpSecret();
   const uri = buildOtpAuthUri(secret, "HQ");
-  const next = await mutateHqAuthFile(dataDir, (current) => ({
+  const next = await mutateHqAuthFile2(dataDir, (current) => ({
     ...current,
     totpPendingSecret: secret
   }));
@@ -1723,7 +1499,7 @@ async function handleApiTotpEnable(req, res, mutableAuth, sessions, dataDir, app
   }
   const recoveryCodes = generateRecoveryCodes();
   const recoveryHashes = recoveryCodes.map(hashRecoveryCode);
-  const next = await mutateHqAuthFile(dataDir, (current) => {
+  const next = await mutateHqAuthFile2(dataDir, (current) => {
     const updated = { ...current };
     updated.totpSecret = pendingSecret;
     delete updated.totpPendingSecret;
@@ -1758,7 +1534,7 @@ async function handleApiTotpDisable(req, res, mutableAuth, sessions, loginAttemp
   }
   let confirmed = false;
   if (typeof body.password === "string" && body.password.length > 0 && mutableAuth.passwordHash) {
-    confirmed = await verifyHqPassword(body.password, mutableAuth.passwordHash);
+    confirmed = await verifyHqPassword2(body.password, mutableAuth.passwordHash);
   }
   if (!confirmed && typeof body.code === "string" && mutableAuth.totpSecret) {
     confirmed = verifyTotp(body.code, mutableAuth.totpSecret);
@@ -1777,7 +1553,7 @@ async function handleApiTotpDisable(req, res, mutableAuth, sessions, loginAttemp
     return;
   }
   loginAttempts.delete(clientIp);
-  const next = await mutateHqAuthFile(dataDir, (current) => {
+  const next = await mutateHqAuthFile2(dataDir, (current) => {
     const updated = { ...current };
     delete updated.totpSecret;
     delete updated.totpPendingSecret;
@@ -1788,13 +1564,144 @@ async function handleApiTotpDisable(req, res, mutableAuth, sessions, loginAttemp
   res.writeHead(200, { "Content-Type": "application/json" });
   res.end(JSON.stringify({ enabled: false }));
 }
+
+// src/hq-server/routes/auth/bootstrap-routes.ts
+import { randomUUID as randomUUID3 } from "node:crypto";
+async function handleApiBootstrap(req, res, mutableAuth, sessions, secureCookies, bootstrapStore) {
+  if (!mutableAuth.cookieSecret) {
+    res.writeHead(503, { "Content-Type": "application/json" });
+    res.end(
+      JSON.stringify({
+        error: {
+          code: "BOOTSTRAP_UNAVAILABLE",
+          message: "Cookie signing is not configured on this HQ server."
+        }
+      })
+    );
+    return;
+  }
+  let body;
+  try {
+    body = JSON.parse(await readRequestBody(req));
+  } catch (error) {
+    writeInvalidBody(res, error);
+    return;
+  }
+  if (typeof body.code !== "string" || body.code.length === 0) {
+    res.writeHead(400, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ error: { code: "BAD_REQUEST", message: "code is required" } }));
+    return;
+  }
+  const entry = bootstrapStore.consume(body.code);
+  if (!entry) {
+    res.writeHead(401, { "Content-Type": "application/json" });
+    res.end(
+      JSON.stringify({
+        error: {
+          code: "INVALID_OR_EXPIRED_CODE",
+          message: "The bootstrap code is invalid, already used, or expired."
+        }
+      })
+    );
+    return;
+  }
+  const tokenLive = [...mutableAuth.browserTokenObjs.values()].some(
+    (obj) => obj.id === entry.tokenId
+  );
+  if (!tokenLive) {
+    res.writeHead(401, { "Content-Type": "application/json" });
+    res.end(
+      JSON.stringify({
+        error: {
+          code: "TOKEN_REVOKED",
+          message: "The token that issued this bootstrap code has been revoked."
+        }
+      })
+    );
+    return;
+  }
+  const sessionId = randomUUID3();
+  sessions.set(sessionId, {
+    createdAt: Date.now(),
+    lastSeenAt: Date.now(),
+    kind: "token",
+    tokenId: entry.tokenId,
+    ...entry.capabilities !== void 0 ? { capabilities: entry.capabilities } : {}
+  });
+  setHqSessionCookie(
+    res,
+    serializeHqSessionCookie(sessionId, mutableAuth.cookieSecret),
+    secureCookies
+  );
+  res.writeHead(200, { "Content-Type": "application/json" });
+  res.end(JSON.stringify({ loggedIn: true }));
+}
+async function handleApiTokenUpgrade(req, res, url, mutableAuth, sessions, secureCookies) {
+  if (!mutableAuth.cookieSecret) {
+    res.writeHead(503, { "Content-Type": "application/json" });
+    res.end(
+      JSON.stringify({
+        error: {
+          code: "UPGRADE_UNAVAILABLE",
+          message: "Cookie signing is not configured on this HQ server."
+        }
+      })
+    );
+    return;
+  }
+  const auth = authenticateBrowserRequest(req, url, mutableAuth, sessions);
+  if (isCookieAuth(auth)) {
+    res.writeHead(200, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ loggedIn: true, upgraded: false }));
+    return;
+  }
+  if (!isTokenAuth(auth)) {
+    res.writeHead(401, { "Content-Type": "application/json" });
+    res.end(
+      JSON.stringify({
+        error: { code: "UNAUTHORIZED", message: "A valid browser token is required." }
+      })
+    );
+    return;
+  }
+  const tokenLive = [...mutableAuth.browserTokenObjs.values()].some((obj) => obj.id === auth.id);
+  if (!tokenLive) {
+    res.writeHead(409, { "Content-Type": "application/json" });
+    res.end(
+      JSON.stringify({
+        error: {
+          code: "TOKEN_NOT_UPGRADEABLE",
+          message: "This token has no server-side record to bind a session to."
+        }
+      })
+    );
+    return;
+  }
+  const sessionId = randomUUID3();
+  sessions.set(sessionId, {
+    createdAt: Date.now(),
+    lastSeenAt: Date.now(),
+    kind: "token",
+    tokenId: auth.id,
+    ...auth.capabilities !== void 0 ? { capabilities: auth.capabilities } : {}
+  });
+  setHqSessionCookie(
+    res,
+    serializeHqSessionCookie(sessionId, mutableAuth.cookieSecret),
+    secureCookies
+  );
+  res.writeHead(200, { "Content-Type": "application/json" });
+  res.end(JSON.stringify({ loggedIn: true, upgraded: true }));
+}
+
+// src/hq-server/routes/auth/session-audit-routes.ts
+import { readHqAuthAuditTail } from "@wrongstack/core/hq";
 function handleApiAuthSessions(_req, res, mutableAuth, sessions) {
   const now = Date.now();
   const list = [];
   for (const [id, session] of sessions) {
     if (session.pending2fa) continue;
     list.push({
-      // The client sends the full ID back to revoke; `shortId` is for display.
       id,
       shortId: id.slice(0, 8),
       kind: session.kind,
@@ -1842,244 +1749,12 @@ function handleApiAuthAudit(_req, res, dataDir) {
   res.end(JSON.stringify({ entries }));
 }
 
-// src/hq-server/routes/session-handlers.ts
-import * as path4 from "node:path";
+// src/hq-server/routes/command-handlers.ts
+import { randomUUID as randomUUID4 } from "node:crypto";
 import {
-  buildTranscriptFromEvents,
-  resolveHqDataDir as resolveHqDataDir3
+  tokenHasCapability,
+  validateHqCommand
 } from "@wrongstack/core/hq";
-async function handleApiSessions(res) {
-  const { getSessionRegistry } = await import("@wrongstack/core/storage");
-  const globalRoot = path4.dirname(resolveHqDataDir3());
-  try {
-    const registry = getSessionRegistry(globalRoot);
-    const sessions = await registry.list();
-    const result = sessions.filter((s) => s.status !== "stale").map((s) => ({
-      sessionId: s.sessionId,
-      projectSlug: s.projectSlug,
-      projectName: s.projectName,
-      projectRoot: s.projectRoot,
-      workingDir: s.workingDir,
-      status: s.status,
-      pid: s.pid,
-      startedAt: s.startedAt,
-      lastHeartbeatAt: s.lastHeartbeatAt,
-      agentCount: s.agentCount,
-      agents: s.agents.map((a) => ({
-        id: a.id,
-        name: a.name,
-        status: a.status,
-        currentTool: a.currentTool,
-        iterations: a.iterations,
-        toolCalls: a.toolCalls,
-        lastActivityAt: a.lastActivityAt
-      }))
-    }));
-    res.writeHead(200, { "Content-Type": "application/json" });
-    res.end(JSON.stringify(result));
-  } catch (err) {
-    res.writeHead(500, { "Content-Type": "application/json" });
-    res.end(JSON.stringify({ error: sanitizeApiError(err) }));
-  }
-}
-async function handleApiSessionEvents(req, res, match, transcripts) {
-  const { getSessionRegistry, DefaultSessionStore } = await import("@wrongstack/core/storage");
-  const { resolveWstackPaths } = await import("@wrongstack/core/utils");
-  const url = new URL(req.url ?? "/", "http://localhost");
-  const full = url.searchParams.get("full") === "1";
-  const rawLimit = Number.parseInt(url.searchParams.get("limit") ?? "200", 10);
-  const limit = Math.min(5e3, Math.max(1, Number.isFinite(rawLimit) ? rawLimit : 200));
-  const sessionId = decodeSessionId(match[1]);
-  if (sessionId === null) {
-    res.writeHead(400, { "Content-Type": "application/json" });
-    res.end(JSON.stringify({ error: "invalid sessionId encoding" }));
-    return;
-  }
-  const globalRoot = path4.dirname(resolveHqDataDir3());
-  try {
-    const registry = getSessionRegistry(globalRoot);
-    const entry = await registry.get(sessionId).catch(() => null);
-    let entries = [];
-    let source = "stream";
-    let status;
-    let clientType;
-    let projectName;
-    if (entry && "projectRoot" in entry) {
-      const paths = resolveWstackPaths({
-        projectRoot: entry.projectRoot,
-        globalRoot
-      });
-      const store = new DefaultSessionStore({
-        dir: paths.projectSessions,
-        projectRoot: entry.projectRoot
-      });
-      const data = await store.load(sessionId).catch(() => null);
-      if (data) {
-        entries = buildTranscriptFromEvents(
-          data.events.map((e) => e)
-        );
-        source = "disk";
-        status = entry.status;
-        clientType = entry.clientType;
-        projectName = entry.projectName;
-      }
-    }
-    if (entries.length === 0) {
-      const ring = transcripts.get(sessionId);
-      if (!ring && !entry) {
-        res.writeHead(404, { "Content-Type": "application/json" });
-        res.end(JSON.stringify({ error: "Session not found" }));
-        return;
-      }
-      entries = ring ? ring.entries : [];
-      source = "stream";
-      if (entry) {
-        status = entry.status;
-        clientType = entry.clientType;
-        projectName = entry.projectName;
-      }
-    }
-    const total = entries.length;
-    const tail = full ? entries : entries.slice(-limit);
-    res.writeHead(200, { "Content-Type": "application/json" });
-    res.end(
-      JSON.stringify({
-        sessionId,
-        source,
-        ...status !== void 0 ? { status } : {},
-        ...clientType !== void 0 ? { clientType } : {},
-        ...projectName !== void 0 ? { projectName } : {},
-        total,
-        entries: tail
-      })
-    );
-  } catch (err) {
-    res.writeHead(500, { "Content-Type": "application/json" });
-    res.end(JSON.stringify({ error: sanitizeApiError(err) }));
-  }
-}
-async function handleApiSessionAgentMessages(req, res, match, agentMessages) {
-  const url = new URL(req.url ?? "/", "http://localhost");
-  const sid = decodeSessionId(match[1]);
-  const aid = decodePathSegment(match[2]);
-  if (sid === null || aid === null) {
-    res.writeHead(400, { "Content-Type": "application/json" });
-    res.end(JSON.stringify({ error: "invalid session or agent id encoding" }));
-    return;
-  }
-  const full = url.searchParams.get("full") === "1";
-  const disk = await readLocalSubagentTranscript(sid, aid);
-  const source = disk !== null ? "disk" : "stream";
-  const all = disk !== null ? disk : agentMessages.get(agentRingKey(sid, aid)) ?? agentMessages.get(aid) ?? [];
-  const entries = full ? all : all.slice(-200);
-  res.writeHead(200, { "Content-Type": "application/json" });
-  res.end(JSON.stringify({ subagentId: aid, sessionId: sid, source, total: all.length, entries }));
-}
-async function handleApiAgentMessages(req, res, match, agentMessages) {
-  const url = new URL(req.url ?? "/", "http://localhost");
-  const id = decodePathSegment(match[1]);
-  if (id === null) {
-    res.writeHead(400, { "Content-Type": "application/json" });
-    res.end(JSON.stringify({ error: "invalid agent id encoding" }));
-    return;
-  }
-  const full = url.searchParams.get("full") === "1";
-  const merged = [];
-  for (const [key, ring] of agentMessages) {
-    if (key === id || key.endsWith(`::${id}`)) merged.push(...ring);
-  }
-  merged.sort((a, b) => a.ts.localeCompare(b.ts));
-  const entries = full ? merged : merged.slice(-200);
-  res.writeHead(200, { "Content-Type": "application/json" });
-  res.end(JSON.stringify({ subagentId: id, total: merged.length, entries }));
-}
-
-// src/hq-server/routes/system-handlers.ts
-async function handleApiSystemUpdate(res) {
-  const [{ checkForUpdate }, { detectUpdatePackageName }] = await Promise.all([
-    import("./update-check-WARHSVZA.js"),
-    import("./update-VZSOZGYC.js")
-  ]);
-  const packageName = detectUpdatePackageName();
-  const info = await checkForUpdate({ packageName });
-  res.writeHead(200, {
-    "Content-Type": "application/json",
-    "Cache-Control": "no-store"
-  });
-  res.end(
-    JSON.stringify({
-      ...info,
-      packageName,
-      command: "wstack update"
-    })
-  );
-}
-async function handleApiSystemHealth(res, clients, persistence, eventLog) {
-  const now = Date.now();
-  const eventCount = eventLog.length;
-  let timeseriesStoreStatus = "unknown";
-  let kanbanStoreStatus = "unknown";
-  try {
-    const tsOk = await persistence.timeseries.read(now - 3e5);
-    timeseriesStoreStatus = Array.isArray(tsOk) ? "ok" : "degraded";
-  } catch {
-    timeseriesStoreStatus = "degraded";
-  }
-  try {
-    await persistence.kanban.load("__hq_health_probe__");
-    kanbanStoreStatus = "ok";
-  } catch {
-    kanbanStoreStatus = "degraded";
-  }
-  const inMemoryEventLogActive = true;
-  const allOk = inMemoryEventLogActive && timeseriesStoreStatus === "ok" && kanbanStoreStatus === "ok";
-  const clientCount = clients.size;
-  const connectedClients = [...clients.values()].filter(
-    (c) => Date.now() - new Date(c.lastSeenAt).getTime() < 6e4
-  ).length;
-  res.writeHead(200, {
-    "Content-Type": "application/json",
-    "Cache-Control": "no-store"
-  });
-  res.end(
-    JSON.stringify({
-      status: allOk ? "healthy" : "degraded",
-      uptime: {
-        serverTime: (/* @__PURE__ */ new Date()).toISOString(),
-        eventLogSize: eventCount
-      },
-      stores: {
-        events: "ok",
-        timeseries: timeseriesStoreStatus,
-        kanban: kanbanStoreStatus
-      },
-      connections: {
-        total: clientCount,
-        active: connectedClients,
-        stale: clientCount - connectedClients
-      }
-    })
-  );
-}
-async function handleApiCommandsAudit(req, res, auditLog) {
-  const url = new URL(req.url ?? "/", "http://localhost");
-  const rawLimit = Number.parseInt(url.searchParams.get("limit") ?? "200", 10);
-  const limit = Math.min(1e3, Math.max(1, Number.isFinite(rawLimit) ? rawLimit : 200));
-  res.writeHead(200, { "Content-Type": "application/json" });
-  res.end(JSON.stringify({ commands: auditLog.recent(limit) }));
-}
-async function handleApiAlerts(req, res, alertEngine) {
-  const url = new URL(req.url ?? "/", "http://localhost");
-  const rawLimit = Number.parseInt(url.searchParams.get("limit") ?? "100", 10);
-  const limit = Math.min(500, Math.max(1, Number.isFinite(rawLimit) ? rawLimit : 100));
-  res.writeHead(200, { "Content-Type": "application/json" });
-  res.end(
-    JSON.stringify({
-      active: alertEngine.activeAlerts(),
-      history: alertEngine.recentAlerts(limit)
-    })
-  );
-}
 
 // src/hq-server/snapshot.ts
 import { WebSocket } from "ws";
@@ -2566,33 +2241,691 @@ async function authorizeHqCommand(input) {
   return { allowed: isTrustDecisionAllowed(decision), reason: decision.reason };
 }
 
-// src/hq-server/routes.ts
-var setHqSecurityHeaders2 = setHqSecurityHeaders;
-var hasTrustedBrowserOrigin2 = hasTrustedBrowserOrigin;
-var authenticateBrowserRequest2 = authenticateBrowserRequest;
-var isTokenAuth2 = isTokenAuth;
-var isCookieAuth2 = isCookieAuth;
-var hqAuthRequired2 = hqAuthRequired;
-var parseHqSessionCookie2 = parseHqSessionCookie;
-var decodePathSegment2 = decodePathSegment;
-var readRequestBody2 = readRequestBody;
-var writeInvalidBody2 = writeInvalidBody;
-var sanitizeApiError2 = sanitizeApiError;
-var buildHttpUrl2 = buildHttpUrl;
-var buildBootstrapHttpUrl2 = buildBootstrapHttpUrl;
-var buildClientWsUrl2 = buildClientWsUrl;
-var agentRingKey2 = agentRingKey;
-var agentMessageToEntry2 = agentMessageToEntry;
-var readLocalSubagentTranscript2 = readLocalSubagentTranscript;
-function createHqRouter(deps) {
-  const {
-    host,
-    listeningPort,
-    trustedPublicOrigins,
-    allowFileOrigin,
-    mutableAuth,
-    sessions,
-    loginAttempts,
+// src/hq-server/routes/mailbox-handlers.ts
+import * as path4 from "node:path";
+import {
+  resolveProjectDir
+} from "@wrongstack/core/coordination";
+
+// src/hq-server/project-root.ts
+import { deriveHqProjectId } from "@wrongstack/core/hq";
+function resolveHqProjectRoot(globalRoot, ids) {
+  const fn = async () => {
+    const { getSessionRegistry } = await import("@wrongstack/core/storage");
+    try {
+      const registry = getSessionRegistry(globalRoot);
+      if (typeof ids.sessionId === "string") {
+        const entry = await registry.get(ids.sessionId).catch(() => null);
+        if (entry?.projectRoot) return entry.projectRoot;
+      }
+      if (typeof ids.projectId === "string") {
+        const { createHash: createHash2 } = await import("node:crypto");
+        const all = await registry.list().catch(() => []);
+        const projectIds = /* @__PURE__ */ new Map();
+        const projectIdForRoot = (projectRoot) => {
+          const cached = projectIds.get(projectRoot);
+          if (cached !== void 0) return cached;
+          const derived = deriveHqProjectId(projectRoot);
+          projectIds.set(projectRoot, derived);
+          return derived;
+        };
+        const match = all.find(
+          (e) => e.projectSlug === ids.projectId || projectIdForRoot(e.projectRoot) === ids.projectId || createHash2("sha256").update(e.projectRoot).digest("hex").slice(0, 12) === ids.projectId
+        );
+        if (match) return match.projectRoot;
+      }
+    } catch {
+    }
+    return void 0;
+  };
+  return fn();
+}
+
+// src/hq-server/routes/mailbox-handlers.ts
+function callerCanEnqueue(auth, mutableAuth) {
+  if (isCookieAuth(auth)) {
+    return auth.tokenId === void 0 || auth.capabilities === void 0 || auth.capabilities.includes("control.enqueue");
+  }
+  if (isTokenAuth(auth)) {
+    return auth.capabilities === void 0 || auth.capabilities.includes("control.enqueue");
+  }
+  return !hqAuthRequired(mutableAuth);
+}
+async function handleMailboxGateway(_req, res, match, authorizeMailboxGateway, getMailboxGateway, dataDir) {
+  const projectId = decodePathSegment(match[1]);
+  if (projectId === null || projectId.length === 0) {
+    res.writeHead(400, { "Content-Type": "application/json" });
+    res.end(
+      JSON.stringify({ error: { code: "BAD_REQUEST", message: "invalid projectId encoding" } })
+    );
+    return;
+  }
+  const gatewayGlobalRoot = path4.dirname(dataDir);
+  const preliminaryAccess = authorizeMailboxGateway(_req, `project:${projectId}`);
+  if (!preliminaryAccess.allowed) {
+    res.writeHead(preliminaryAccess.status ?? 401, {
+      "Content-Type": "application/json; charset=utf-8",
+      "Cache-Control": "no-store"
+    });
+    res.end(JSON.stringify(preliminaryAccess.body));
+    return;
+  }
+  const projectRoot = await resolveHqProjectRoot(gatewayGlobalRoot, { projectId });
+  if (!projectRoot) {
+    res.writeHead(404, { "Content-Type": "application/json" });
+    res.end(
+      JSON.stringify({ error: { code: "NOT_FOUND", message: `Unknown project: ${projectId}` } })
+    );
+    return;
+  }
+  const suffix = match[2];
+  const rawUrl = _req.url ?? "";
+  const queryIndex = rawUrl.indexOf("?");
+  const querySuffix = queryIndex === -1 ? "" : rawUrl.slice(queryIndex);
+  const canonicalPath = suffix ? `/mailbox/${suffix}${querySuffix}` : `/mailbox${querySuffix}`;
+  const projectDir = resolveProjectDir(projectRoot, gatewayGlobalRoot);
+  await getMailboxGateway(projectDir).router.handle(_req, res, canonicalPath);
+}
+async function handleApiMailboxSend(_req, res, mutableAuth, sessions, dataDir, getMailboxGateway, hqSessionTag) {
+  const auth = authenticateBrowserRequest(
+    _req,
+    new URL(_req.url ?? "/", "http://localhost"),
+    mutableAuth,
+    sessions
+  );
+  if (hqAuthRequired(mutableAuth) && !auth) {
+    res.writeHead(401, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ error: { code: "UNAUTHORIZED", message: "unauthorized" } }));
+    return;
+  }
+  const canEnqueue = callerCanEnqueue(auth, mutableAuth);
+  if (!canEnqueue) {
+    res.writeHead(403, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ error: "forbidden: token lacks control.enqueue capability" }));
+    return;
+  }
+  let mbody;
+  try {
+    mbody = JSON.parse(await readRequestBody(_req));
+  } catch (error) {
+    writeInvalidBody(res, error);
+    return;
+  }
+  if (typeof mbody.type !== "string" || typeof mbody.body !== "string") {
+    res.writeHead(400, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ error: "missing type or body" }));
+    return;
+  }
+  if (typeof mbody.sessionId !== "string" && typeof mbody.projectId !== "string") {
+    res.writeHead(400, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ error: "missing sessionId or projectId" }));
+    return;
+  }
+  if (mbody.audience !== void 0 && mbody.audience !== "all" && mbody.audience !== "leaders") {
+    res.writeHead(400, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ error: "audience must be all or leaders" }));
+    return;
+  }
+  const mbGlobalRoot = path4.dirname(dataDir);
+  const projectRoot = await resolveHqProjectRoot(mbGlobalRoot, {
+    sessionId: mbody.sessionId,
+    projectId: mbody.projectId
+  });
+  if (typeof projectRoot !== "string" || projectRoot.length === 0) {
+    res.writeHead(404, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ error: "could not resolve target project mailbox" }));
+    return;
+  }
+  const to = typeof mbody.to === "string" ? mbody.to : "leader";
+  const subject = typeof mbody.subject === "string" ? mbody.subject : "HQ prompt";
+  const priority = mbody.priority === "high" ? "high" : mbody.priority === "low" ? "low" : "normal";
+  const audience = mbody.audience === "leaders" ? "leaders" : "all";
+  const mailboxType = mbody.type === "queue" ? "note" : [
+    "note",
+    "ask",
+    "assign",
+    "steer",
+    "btw",
+    "broadcast",
+    "status",
+    "result",
+    "review"
+  ].includes(mbody.type) ? mbody.type : void 0;
+  if (mailboxType === void 0) {
+    res.writeHead(400, { "Content-Type": "application/json" });
+    res.end(
+      JSON.stringify({
+        error: "unrecognized or malformed mailbox message",
+        type: mbody.type
+      })
+    );
+    return;
+  }
+  if ((mailboxType === "assign" || mailboxType === "steer") && (to === "*" || to.trim().toLowerCase() === "all")) {
+    res.writeHead(400, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ error: `${mailboxType} requires a specific recipient` }));
+    return;
+  }
+  try {
+    const projectDir = resolveProjectDir(projectRoot, mbGlobalRoot);
+    const mailbox = getMailboxGateway(projectDir).mailbox;
+    const from = `hq@${hqSessionTag}`;
+    const deliveryTo = mailboxType === "broadcast" ? "all" : to;
+    const sent = await mailbox.send({
+      from,
+      to: deliveryTo,
+      type: mailboxType,
+      subject,
+      body: mbody.body,
+      priority,
+      audience
+    });
+    res.writeHead(202, { "Content-Type": "application/json" });
+    res.end(
+      JSON.stringify({
+        delivered: true,
+        messageId: sent?.id,
+        to: sent?.to ?? deliveryTo,
+        type: mailboxType,
+        audience
+      })
+    );
+  } catch (err) {
+    res.writeHead(500, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ error: "mailbox write failed", detail: sanitizeApiError(err) }));
+  }
+}
+async function handleMailboxAction(_req, res, match, mutableAuth, sessions, dataDir, getMailboxGateway) {
+  const auth = authenticateBrowserRequest(
+    _req,
+    new URL(_req.url ?? "/", "http://localhost"),
+    mutableAuth,
+    sessions
+  );
+  if (hqAuthRequired(mutableAuth) && !auth) {
+    res.writeHead(401, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ error: "unauthorized" }));
+    return;
+  }
+  if (!callerCanEnqueue(auth, mutableAuth)) {
+    res.writeHead(403, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ error: "forbidden: token lacks control.enqueue capability" }));
+    return;
+  }
+  const MAILBOX_ACTIONS = ["mark-read", "acknowledge", "reopen", "soft-delete", "restore"];
+  let abody;
+  try {
+    abody = JSON.parse(await readRequestBody(_req));
+  } catch (error) {
+    writeInvalidBody(res, error);
+    return;
+  }
+  const mailId = decodePathSegment(match[1]);
+  if (mailId === null) {
+    res.writeHead(400, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ error: "invalid mailId encoding" }));
+    return;
+  }
+  const action = MAILBOX_ACTIONS.find((a) => a === abody.action);
+  if (action === void 0) {
+    res.writeHead(400, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ error: "unrecognized action", action: abody.action }));
+    return;
+  }
+  const authenticatedReaderId = isCookieAuth(auth) ? auth.tokenId ?? "hq-password-session" : isTokenAuth(auth) ? auth.id : void 0;
+  const resolvedReaderId = authenticatedReaderId ?? abody.readerId;
+  if (typeof resolvedReaderId !== "string" || resolvedReaderId.length === 0) {
+    res.writeHead(400, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ error: "missing readerId" }));
+    return;
+  }
+  if (typeof abody.sessionId !== "string" && typeof abody.projectId !== "string") {
+    res.writeHead(400, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ error: "missing sessionId or projectId" }));
+    return;
+  }
+  const actGlobalRoot = path4.dirname(dataDir);
+  const projectRoot = await resolveHqProjectRoot(actGlobalRoot, {
+    sessionId: abody.sessionId,
+    projectId: abody.projectId
+  });
+  if (typeof projectRoot !== "string" || projectRoot.length === 0) {
+    res.writeHead(404, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ error: "could not resolve target project mailbox" }));
+    return;
+  }
+  try {
+    const { actionToAckInput } = await import("@wrongstack/core/coordination");
+    const projectDir = resolveProjectDir(projectRoot, actGlobalRoot);
+    const mailbox = getMailboxGateway(projectDir).mailbox;
+    const readerId = resolvedReaderId;
+    const message = action === "soft-delete" ? await mailbox.softDelete(mailId, readerId) : action === "restore" ? await mailbox.restore(mailId) : await mailbox.ack(actionToAckInput(action, { action, mailId, readerId }));
+    if (message === null) {
+      res.writeHead(404, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ error: "message not found", mailId }));
+      return;
+    }
+    res.writeHead(200, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ action, mailId, message: null, changed: true }));
+  } catch (err) {
+    res.writeHead(500, { "Content-Type": "application/json" });
+    res.end(
+      JSON.stringify({
+        error: "mailbox action failed",
+        detail: sanitizeApiError(err)
+      })
+    );
+  }
+}
+
+// src/hq-server/routes/command-handlers.ts
+async function handleApiCommand(req, res, url, mutableAuth, sessions, clients, browsers, auditLog, trustBoundary) {
+  const auth = authenticateBrowserRequest(req, url, mutableAuth, sessions);
+  if (hqAuthRequired(mutableAuth) && !auth) {
+    res.writeHead(401, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ error: "unauthorized" }));
+    return;
+  }
+  const canEnqueue = callerCanEnqueue(auth, mutableAuth);
+  if (!canEnqueue) {
+    res.writeHead(403, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ error: "forbidden: token lacks control.enqueue capability" }));
+    return;
+  }
+  let body;
+  try {
+    body = JSON.parse(await readRequestBody(req));
+  } catch (error) {
+    writeInvalidBody(res, error);
+    return;
+  }
+  if (typeof body.clientId !== "string" || typeof body.type !== "string") {
+    res.writeHead(400, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ error: "missing clientId or type" }));
+    return;
+  }
+  let target;
+  for (const c of clients.values()) {
+    if (c.clientId === body.clientId) {
+      target = c;
+      break;
+    }
+  }
+  if (target === void 0) {
+    res.writeHead(404, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ error: "client not connected", clientId: body.clientId }));
+    return;
+  }
+  if (!target.capabilities.includes("control.receive")) {
+    res.writeHead(409, { "Content-Type": "application/json" });
+    res.end(
+      JSON.stringify({
+        error: "client does not accept control commands",
+        clientId: body.clientId
+      })
+    );
+    return;
+  }
+  const commandId = randomUUID4();
+  const queued = {
+    commandId,
+    type: body.type,
+    createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+    payload: body.payload ?? {},
+    requiresAck: true
+  };
+  const validated = validateHqCommand(queued);
+  if (validated === null) {
+    res.writeHead(400, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ error: "unrecognized or malformed command", type: body.type }));
+    return;
+  }
+  if (validated.type === "run-command" && !tokenHasCapability(target.authToken, "control.execute")) {
+    res.writeHead(403, { "Content-Type": "application/json" });
+    res.end(
+      JSON.stringify({
+        error: "forbidden: target client token lacks control.execute capability"
+      })
+    );
+    return;
+  }
+  const enqueuedBy = isCookieAuth(auth) ? auth.tokenId ?? "password-session" : isTokenAuth(auth) ? auth.id : "open-mode";
+  const authorization = await authorizeHqCommand({
+    boundary: trustBoundary,
+    command: validated,
+    commandId,
+    enqueuedBy,
+    authMethod: isCookieAuth(auth) ? "session" : "bearer-token",
+    target
+  });
+  if (!authorization.allowed) {
+    res.writeHead(403, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ error: `command denied: ${authorization.reason}` }));
+    return;
+  }
+  target.commandQueue.push(queued);
+  if (target.commandQueue.length > 200)
+    target.commandQueue.splice(0, target.commandQueue.length - 200);
+  const auditEntry = {
+    commandId,
+    type: validated.type,
+    clientId: target.clientId,
+    enqueuedBy,
+    enqueuedAt: queued.createdAt,
+    status: "queued"
+  };
+  auditLog.record(auditEntry);
+  broadcastCommandStatus(auditEntry, browsers);
+  res.writeHead(202, { "Content-Type": "application/json" });
+  res.end(JSON.stringify({ commandId, queued: true, clientId: target.clientId }));
+}
+
+// src/hq-server/routes/data-handlers.ts
+async function handleApiProjectDetail(_req, res, url, clients) {
+  const projectId = decodePathSegment(url.pathname.slice("/api/projects/".length));
+  if (projectId === null) {
+    res.writeHead(400, { "Content-Type": "application/json" });
+    res.end(
+      JSON.stringify({ error: { code: "BAD_REQUEST", message: "invalid projectId encoding" } })
+    );
+    return;
+  }
+  if (!projectId) {
+    res.writeHead(400, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ error: { code: "BAD_REQUEST", message: "projectId is required" } }));
+    return;
+  }
+  const detail = buildProjectDetail(clients, projectId);
+  if (!detail) {
+    res.writeHead(404, { "Content-Type": "application/json" });
+    res.end(
+      JSON.stringify({ error: { code: "NOT_FOUND", message: `Unknown project: ${projectId}` } })
+    );
+    return;
+  }
+  res.writeHead(200, { "Content-Type": "application/json" });
+  res.end(JSON.stringify(detail));
+}
+async function handleApiEvents(req, res, persistence) {
+  const url = new URL(req.url ?? "/", "http://localhost");
+  const rawLimit = Number.parseInt(url.searchParams.get("limit") ?? "200", 10);
+  const limit = Math.min(5e3, Math.max(1, Number.isFinite(rawLimit) ? rawLimit : 200));
+  const typeFilter = url.searchParams.get("type") ?? void 0;
+  const events = await persistence.eventLog.recent(limit, typeFilter);
+  res.writeHead(200, { "Content-Type": "application/json" });
+  res.end(JSON.stringify({ events, total: events.length }));
+}
+async function handleApiTrendsCost(req, res, persistence) {
+  const url = new URL(req.url ?? "/", "http://localhost");
+  const rawSince = Number.parseInt(url.searchParams.get("since") ?? "0", 10);
+  const since = Number.isFinite(rawSince) ? rawSince : 0;
+  const samples = await persistence.timeseries.read(since);
+  res.writeHead(200, { "Content-Type": "application/json" });
+  res.end(JSON.stringify({ samples }));
+}
+
+// src/hq-server/routes/session-handlers.ts
+import * as path5 from "node:path";
+import {
+  buildTranscriptFromEvents,
+  resolveHqDataDir as resolveHqDataDir2
+} from "@wrongstack/core/hq";
+async function handleApiSessions(res) {
+  const { getSessionRegistry } = await import("@wrongstack/core/storage");
+  const globalRoot = path5.dirname(resolveHqDataDir2());
+  try {
+    const registry = getSessionRegistry(globalRoot);
+    const sessions = await registry.list();
+    const result = sessions.filter((s) => s.status !== "stale").map((s) => ({
+      sessionId: s.sessionId,
+      projectSlug: s.projectSlug,
+      projectName: s.projectName,
+      projectRoot: s.projectRoot,
+      workingDir: s.workingDir,
+      status: s.status,
+      pid: s.pid,
+      startedAt: s.startedAt,
+      lastHeartbeatAt: s.lastHeartbeatAt,
+      agentCount: s.agentCount,
+      agents: s.agents.map((a) => ({
+        id: a.id,
+        name: a.name,
+        status: a.status,
+        currentTool: a.currentTool,
+        iterations: a.iterations,
+        toolCalls: a.toolCalls,
+        lastActivityAt: a.lastActivityAt
+      }))
+    }));
+    res.writeHead(200, { "Content-Type": "application/json" });
+    res.end(JSON.stringify(result));
+  } catch (err) {
+    res.writeHead(500, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ error: sanitizeApiError(err) }));
+  }
+}
+async function handleApiSessionEvents(req, res, match, transcripts) {
+  const { getSessionRegistry, DefaultSessionStore } = await import("@wrongstack/core/storage");
+  const { resolveWstackPaths } = await import("@wrongstack/core/utils");
+  const url = new URL(req.url ?? "/", "http://localhost");
+  const full = url.searchParams.get("full") === "1";
+  const rawLimit = Number.parseInt(url.searchParams.get("limit") ?? "200", 10);
+  const limit = Math.min(5e3, Math.max(1, Number.isFinite(rawLimit) ? rawLimit : 200));
+  const sessionId = decodeSessionId(match[1]);
+  if (sessionId === null) {
+    res.writeHead(400, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ error: "invalid sessionId encoding" }));
+    return;
+  }
+  const globalRoot = path5.dirname(resolveHqDataDir2());
+  try {
+    const registry = getSessionRegistry(globalRoot);
+    const entry = await registry.get(sessionId).catch(() => null);
+    let entries = [];
+    let source = "stream";
+    let status;
+    let clientType;
+    let projectName;
+    if (entry && "projectRoot" in entry) {
+      const paths = resolveWstackPaths({
+        projectRoot: entry.projectRoot,
+        globalRoot
+      });
+      const store = new DefaultSessionStore({
+        dir: paths.projectSessions,
+        projectRoot: entry.projectRoot
+      });
+      const data = await store.load(sessionId).catch(() => null);
+      if (data) {
+        entries = buildTranscriptFromEvents(
+          data.events.map((e) => e)
+        );
+        source = "disk";
+        status = entry.status;
+        clientType = entry.clientType;
+        projectName = entry.projectName;
+      }
+    }
+    if (entries.length === 0) {
+      const ring = transcripts.get(sessionId);
+      if (!ring && !entry) {
+        res.writeHead(404, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ error: "Session not found" }));
+        return;
+      }
+      entries = ring ? ring.entries : [];
+      source = "stream";
+      if (entry) {
+        status = entry.status;
+        clientType = entry.clientType;
+        projectName = entry.projectName;
+      }
+    }
+    const total = entries.length;
+    const tail = full ? entries : entries.slice(-limit);
+    res.writeHead(200, { "Content-Type": "application/json" });
+    res.end(
+      JSON.stringify({
+        sessionId,
+        source,
+        ...status !== void 0 ? { status } : {},
+        ...clientType !== void 0 ? { clientType } : {},
+        ...projectName !== void 0 ? { projectName } : {},
+        total,
+        entries: tail
+      })
+    );
+  } catch (err) {
+    res.writeHead(500, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ error: sanitizeApiError(err) }));
+  }
+}
+async function handleApiSessionAgentMessages(req, res, match, agentMessages) {
+  const url = new URL(req.url ?? "/", "http://localhost");
+  const sid = decodeSessionId(match[1]);
+  const aid = decodePathSegment(match[2]);
+  if (sid === null || aid === null) {
+    res.writeHead(400, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ error: "invalid session or agent id encoding" }));
+    return;
+  }
+  const full = url.searchParams.get("full") === "1";
+  const disk = await readLocalSubagentTranscript(sid, aid);
+  const source = disk !== null ? "disk" : "stream";
+  const all = disk !== null ? disk : agentMessages.get(agentRingKey(sid, aid)) ?? agentMessages.get(aid) ?? [];
+  const entries = full ? all : all.slice(-200);
+  res.writeHead(200, { "Content-Type": "application/json" });
+  res.end(JSON.stringify({ subagentId: aid, sessionId: sid, source, total: all.length, entries }));
+}
+async function handleApiAgentMessages(req, res, match, agentMessages) {
+  const url = new URL(req.url ?? "/", "http://localhost");
+  const id = decodePathSegment(match[1]);
+  if (id === null) {
+    res.writeHead(400, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ error: "invalid agent id encoding" }));
+    return;
+  }
+  const full = url.searchParams.get("full") === "1";
+  const merged = [];
+  for (const [key, ring] of agentMessages) {
+    if (key === id || key.endsWith(`::${id}`)) merged.push(...ring);
+  }
+  merged.sort((a, b) => a.ts.localeCompare(b.ts));
+  const entries = full ? merged : merged.slice(-200);
+  res.writeHead(200, { "Content-Type": "application/json" });
+  res.end(JSON.stringify({ subagentId: id, total: merged.length, entries }));
+}
+
+// src/hq-server/routes/system-handlers.ts
+async function handleApiSystemUpdate(res) {
+  const [{ checkForUpdate }, { detectUpdatePackageName }] = await Promise.all([
+    import("./update-check-WARHSVZA.js"),
+    import("./update-VZSOZGYC.js")
+  ]);
+  const packageName = detectUpdatePackageName();
+  const info = await checkForUpdate({ packageName });
+  res.writeHead(200, {
+    "Content-Type": "application/json",
+    "Cache-Control": "no-store"
+  });
+  res.end(
+    JSON.stringify({
+      ...info,
+      packageName,
+      command: "wstack update"
+    })
+  );
+}
+async function handleApiSystemHealth(res, clients, persistence, eventLog) {
+  const now = Date.now();
+  const eventCount = eventLog.length;
+  let timeseriesStoreStatus = "unknown";
+  let kanbanStoreStatus = "unknown";
+  try {
+    const tsOk = await persistence.timeseries.read(now - 3e5);
+    timeseriesStoreStatus = Array.isArray(tsOk) ? "ok" : "degraded";
+  } catch {
+    timeseriesStoreStatus = "degraded";
+  }
+  try {
+    await persistence.kanban.load("__hq_health_probe__");
+    kanbanStoreStatus = "ok";
+  } catch {
+    kanbanStoreStatus = "degraded";
+  }
+  const inMemoryEventLogActive = true;
+  const allOk = inMemoryEventLogActive && timeseriesStoreStatus === "ok" && kanbanStoreStatus === "ok";
+  const clientCount = clients.size;
+  const connectedClients = [...clients.values()].filter(
+    (c) => Date.now() - new Date(c.lastSeenAt).getTime() < 6e4
+  ).length;
+  res.writeHead(200, {
+    "Content-Type": "application/json",
+    "Cache-Control": "no-store"
+  });
+  res.end(
+    JSON.stringify({
+      status: allOk ? "healthy" : "degraded",
+      uptime: {
+        serverTime: (/* @__PURE__ */ new Date()).toISOString(),
+        eventLogSize: eventCount
+      },
+      stores: {
+        events: "ok",
+        timeseries: timeseriesStoreStatus,
+        kanban: kanbanStoreStatus
+      },
+      connections: {
+        total: clientCount,
+        active: connectedClients,
+        stale: clientCount - connectedClients
+      }
+    })
+  );
+}
+async function handleApiCommandsAudit(req, res, auditLog) {
+  const url = new URL(req.url ?? "/", "http://localhost");
+  const rawLimit = Number.parseInt(url.searchParams.get("limit") ?? "200", 10);
+  const limit = Math.min(1e3, Math.max(1, Number.isFinite(rawLimit) ? rawLimit : 200));
+  res.writeHead(200, { "Content-Type": "application/json" });
+  res.end(JSON.stringify({ commands: auditLog.recent(limit) }));
+}
+async function handleApiAlerts(req, res, alertEngine) {
+  const url = new URL(req.url ?? "/", "http://localhost");
+  const rawLimit = Number.parseInt(url.searchParams.get("limit") ?? "100", 10);
+  const limit = Math.min(500, Math.max(1, Number.isFinite(rawLimit) ? rawLimit : 100));
+  res.writeHead(200, { "Content-Type": "application/json" });
+  res.end(
+    JSON.stringify({
+      active: alertEngine.activeAlerts(),
+      history: alertEngine.recentAlerts(limit)
+    })
+  );
+}
+
+// src/hq-server/routes.ts
+var hasTrustedBrowserOrigin2 = hasTrustedBrowserOrigin;
+var authenticateBrowserRequest2 = authenticateBrowserRequest;
+var isTokenAuth2 = isTokenAuth;
+var isCookieAuth2 = isCookieAuth;
+var parseHqSessionCookie2 = parseHqSessionCookie;
+var decodePathSegment2 = decodePathSegment;
+var sanitizeApiError2 = sanitizeApiError;
+var buildHttpUrl2 = buildHttpUrl;
+var buildBootstrapHttpUrl2 = buildBootstrapHttpUrl;
+var buildClientWsUrl2 = buildClientWsUrl;
+var agentRingKey2 = agentRingKey;
+var agentMessageToEntry2 = agentMessageToEntry;
+var readLocalSubagentTranscript2 = readLocalSubagentTranscript;
+function createHqRouter(deps) {
+  const {
+    host,
+    listeningPort,
+    trustedPublicOrigins,
+    allowFileOrigin,
+    mutableAuth,
+    sessions,
+    loginAttempts,
     clients,
     browsers,
     eventLog,
@@ -2616,14 +2949,20 @@ function createHqRouter(deps) {
   return async (req, res) => {
     try {
       const url = new URL(req.url ?? "/", `http://${host}:${listeningPort()}`);
-      setHqSecurityHeaders2(res);
-      if (!hasTrustedBrowserOrigin2(req, host, listeningPort(), trustedPublicOrigins, allowFileOrigin)) {
+      setHqSecurityHeaders(res);
+      if (!hasTrustedBrowserOrigin(
+        req,
+        host,
+        listeningPort(),
+        trustedPublicOrigins,
+        allowFileOrigin
+      )) {
         res.writeHead(403, { "Content-Type": "application/json" });
         res.end(JSON.stringify({ error: "forbidden: untrusted request origin" }));
         return;
       }
-      if (url.pathname.startsWith("/api/") && url.pathname !== "/api/auth/status" && url.pathname !== "/api/login" && url.pathname !== "/api/login/verify" && url.pathname !== "/api/auth/bootstrap" && hqAuthRequired2(mutableAuth, requireBrowserAuth)) {
-        const auth = authenticateBrowserRequest2(req, url, mutableAuth, sessions);
+      if (url.pathname.startsWith("/api/") && url.pathname !== "/api/auth/status" && url.pathname !== "/api/login" && url.pathname !== "/api/login/verify" && url.pathname !== "/api/auth/bootstrap" && hqAuthRequired(mutableAuth, requireBrowserAuth)) {
+        const auth = authenticateBrowserRequest(req, url, mutableAuth, sessions);
         if (!auth) {
           const tokenOnly = mutableAuth.browserTokens.size > 0 && !mutableAuth.passwordHash;
           res.writeHead(401, { "Content-Type": "application/json" });
@@ -2663,7 +3002,7 @@ function createHqRouter(deps) {
         return;
       }
       if (url.pathname === "/api/auth/audit" && req.method === "GET" || url.pathname.startsWith("/api/auth/sessions") && (req.method === "GET" || req.method === "DELETE") || url.pathname.startsWith("/api/auth/totp/") && req.method === "POST") {
-        const auth = authenticateBrowserRequest2(req, url, mutableAuth, sessions);
+        const auth = authenticateBrowserRequest(req, url, mutableAuth, sessions);
         if (auth !== void 0 && !callerCanAdministerAuth(auth)) {
           res.writeHead(403, { "Content-Type": "application/json" });
           res.end(
@@ -2807,7 +3146,7 @@ function createHqRouter(deps) {
       }
       const projectKanbanMatch = url.pathname.match(/^\/api\/projects\/([^/]+)\/kanban$/);
       if (projectKanbanMatch && req.method === "GET") {
-        const projectId = decodePathSegment2(projectKanbanMatch[1]);
+        const projectId = decodePathSegment(projectKanbanMatch[1]);
         if (projectId === null) {
           res.writeHead(400, { "Content-Type": "application/json" });
           res.end(
@@ -2894,415 +3233,187 @@ function createHqRouter(deps) {
       }
       const eventsMatch = url.pathname.match(/^\/api\/sessions\/([^/]+)\/events$/);
       if (eventsMatch && req.method === "GET") {
-        await handleApiSessionEvents(req, res, eventsMatch, transcripts);
-        return;
-      }
-      const sessionAgentMsgMatch = url.pathname.match(
-        /^\/api\/sessions\/([^/]+)\/agents\/([^/]+)\/messages$/
-      );
-      if (sessionAgentMsgMatch && req.method === "GET") {
-        await handleApiSessionAgentMessages(req, res, sessionAgentMsgMatch, agentMessages);
-        return;
-      }
-      const agentMsgMatch = url.pathname.match(/^\/api\/agents\/([^/]+)\/messages$/);
-      if (agentMsgMatch && req.method === "GET") {
-        await handleApiAgentMessages(req, res, agentMsgMatch, agentMessages);
-        return;
-      }
-      res.writeHead(404, { "Content-Type": "text/plain" });
-      res.end("Not found");
-    } catch (err) {
-      console.error(
-        JSON.stringify({
-          level: "error",
-          event: "hq.http_handler_error",
-          message: String(err),
-          timestamp: (/* @__PURE__ */ new Date()).toISOString()
-        })
-      );
-      if (!res.headersSent) {
-        res.writeHead(500, { "Content-Type": "application/json" });
-        res.end(JSON.stringify({ error: "Internal server error" }));
-      }
-    }
-  };
-}
-async function handleMailboxGateway(_req, res, match, authorizeMailboxGateway, getMailboxGateway, dataDir) {
-  const projectId = decodePathSegment2(match[1]);
-  if (projectId === null || projectId.length === 0) {
-    res.writeHead(400, { "Content-Type": "application/json" });
-    res.end(
-      JSON.stringify({ error: { code: "BAD_REQUEST", message: "invalid projectId encoding" } })
-    );
-    return;
-  }
-  const gatewayGlobalRoot = path5.dirname(dataDir);
-  const preliminaryAccess = authorizeMailboxGateway(_req, `project:${projectId}`);
-  if (!preliminaryAccess.allowed) {
-    res.writeHead(preliminaryAccess.status ?? 401, {
-      "Content-Type": "application/json; charset=utf-8",
-      "Cache-Control": "no-store"
-    });
-    res.end(JSON.stringify(preliminaryAccess.body));
-    return;
-  }
-  const projectRoot = await resolveHqProjectRoot(gatewayGlobalRoot, { projectId });
-  if (!projectRoot) {
-    res.writeHead(404, { "Content-Type": "application/json" });
-    res.end(
-      JSON.stringify({ error: { code: "NOT_FOUND", message: `Unknown project: ${projectId}` } })
-    );
-    return;
-  }
-  const suffix = match[2];
-  const rawUrl = _req.url ?? "";
-  const queryIndex = rawUrl.indexOf("?");
-  const querySuffix = queryIndex === -1 ? "" : rawUrl.slice(queryIndex);
-  const canonicalPath = suffix ? `/mailbox/${suffix}${querySuffix}` : `/mailbox${querySuffix}`;
-  const projectDir = resolveProjectDir(projectRoot, gatewayGlobalRoot);
-  await getMailboxGateway(projectDir).router.handle(_req, res, canonicalPath);
-}
-async function handleApiProjectDetail(_req, res, url, clients) {
-  const projectId = decodePathSegment2(url.pathname.slice("/api/projects/".length));
-  if (projectId === null) {
-    res.writeHead(400, { "Content-Type": "application/json" });
-    res.end(
-      JSON.stringify({ error: { code: "BAD_REQUEST", message: "invalid projectId encoding" } })
-    );
-    return;
-  }
-  if (!projectId) {
-    res.writeHead(400, { "Content-Type": "application/json" });
-    res.end(JSON.stringify({ error: { code: "BAD_REQUEST", message: "projectId is required" } }));
-    return;
-  }
-  const detail = buildProjectDetail(clients, projectId);
-  if (!detail) {
-    res.writeHead(404, { "Content-Type": "application/json" });
-    res.end(
-      JSON.stringify({ error: { code: "NOT_FOUND", message: `Unknown project: ${projectId}` } })
-    );
-    return;
-  }
-  res.writeHead(200, { "Content-Type": "application/json" });
-  res.end(JSON.stringify(detail));
-}
-async function handleApiEvents(req, res, persistence) {
-  const url = new URL(req.url ?? "/", "http://localhost");
-  const rawLimit = Number.parseInt(url.searchParams.get("limit") ?? "200", 10);
-  const limit = Math.min(5e3, Math.max(1, Number.isFinite(rawLimit) ? rawLimit : 200));
-  const typeFilter = url.searchParams.get("type") ?? void 0;
-  const events = await persistence.eventLog.recent(limit, typeFilter);
-  res.writeHead(200, { "Content-Type": "application/json" });
-  res.end(JSON.stringify({ events, total: events.length }));
-}
-async function handleApiTrendsCost(req, res, persistence) {
-  const url = new URL(req.url ?? "/", "http://localhost");
-  const rawSince = Number.parseInt(url.searchParams.get("since") ?? "0", 10);
-  const since = Number.isFinite(rawSince) ? rawSince : 0;
-  const samples = await persistence.timeseries.read(since);
-  res.writeHead(200, { "Content-Type": "application/json" });
-  res.end(JSON.stringify({ samples }));
-}
-async function handleApiCommand(req, res, url, mutableAuth, sessions, clients, browsers, auditLog, trustBoundary) {
-  const auth = authenticateBrowserRequest2(req, url, mutableAuth, sessions);
-  if (hqAuthRequired2(mutableAuth) && !auth) {
-    res.writeHead(401, { "Content-Type": "application/json" });
-    res.end(JSON.stringify({ error: "unauthorized" }));
-    return;
-  }
-  const canEnqueue = callerCanEnqueue(auth, mutableAuth);
-  if (!canEnqueue) {
-    res.writeHead(403, { "Content-Type": "application/json" });
-    res.end(JSON.stringify({ error: "forbidden: token lacks control.enqueue capability" }));
-    return;
-  }
-  let body;
-  try {
-    body = JSON.parse(await readRequestBody2(req));
-  } catch (error) {
-    writeInvalidBody2(res, error);
-    return;
-  }
-  if (typeof body.clientId !== "string" || typeof body.type !== "string") {
-    res.writeHead(400, { "Content-Type": "application/json" });
-    res.end(JSON.stringify({ error: "missing clientId or type" }));
-    return;
-  }
-  let target;
-  for (const c of clients.values()) {
-    if (c.clientId === body.clientId) {
-      target = c;
-      break;
+        await handleApiSessionEvents(req, res, eventsMatch, transcripts);
+        return;
+      }
+      const sessionAgentMsgMatch = url.pathname.match(
+        /^\/api\/sessions\/([^/]+)\/agents\/([^/]+)\/messages$/
+      );
+      if (sessionAgentMsgMatch && req.method === "GET") {
+        await handleApiSessionAgentMessages(req, res, sessionAgentMsgMatch, agentMessages);
+        return;
+      }
+      const agentMsgMatch = url.pathname.match(/^\/api\/agents\/([^/]+)\/messages$/);
+      if (agentMsgMatch && req.method === "GET") {
+        await handleApiAgentMessages(req, res, agentMsgMatch, agentMessages);
+        return;
+      }
+      res.writeHead(404, { "Content-Type": "text/plain" });
+      res.end("Not found");
+    } catch (err) {
+      console.error(
+        JSON.stringify({
+          level: "error",
+          event: "hq.http_handler_error",
+          message: String(err),
+          timestamp: (/* @__PURE__ */ new Date()).toISOString()
+        })
+      );
+      if (!res.headersSent) {
+        res.writeHead(500, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ error: "Internal server error" }));
+      }
     }
-  }
-  if (target === void 0) {
-    res.writeHead(404, { "Content-Type": "application/json" });
-    res.end(JSON.stringify({ error: "client not connected", clientId: body.clientId }));
-    return;
-  }
-  if (!target.capabilities.includes("control.receive")) {
-    res.writeHead(409, { "Content-Type": "application/json" });
-    res.end(
-      JSON.stringify({
-        error: "client does not accept control commands",
-        clientId: body.clientId
-      })
-    );
-    return;
-  }
-  const commandId = randomUUID2();
-  const queued = {
-    commandId,
-    type: body.type,
-    createdAt: (/* @__PURE__ */ new Date()).toISOString(),
-    payload: body.payload ?? {},
-    requiresAck: true
-  };
-  const validated = validateHqCommand(queued);
-  if (validated === null) {
-    res.writeHead(400, { "Content-Type": "application/json" });
-    res.end(JSON.stringify({ error: "unrecognized or malformed command", type: body.type }));
-    return;
-  }
-  if (validated.type === "run-command" && !tokenHasCapability(target.authToken, "control.execute")) {
-    res.writeHead(403, { "Content-Type": "application/json" });
-    res.end(
-      JSON.stringify({
-        error: "forbidden: target client token lacks control.execute capability"
-      })
-    );
-    return;
-  }
-  const enqueuedBy = isCookieAuth2(auth) ? auth.tokenId ?? "password-session" : isTokenAuth2(auth) ? auth.id : "open-mode";
-  const authorization = await authorizeHqCommand({
-    boundary: trustBoundary,
-    command: validated,
-    commandId,
-    enqueuedBy,
-    authMethod: isCookieAuth2(auth) ? "session" : "bearer-token",
-    target
-  });
-  if (!authorization.allowed) {
-    res.writeHead(403, { "Content-Type": "application/json" });
-    res.end(JSON.stringify({ error: `command denied: ${authorization.reason}` }));
-    return;
-  }
-  target.commandQueue.push(queued);
-  if (target.commandQueue.length > 200)
-    target.commandQueue.splice(0, target.commandQueue.length - 200);
-  const auditEntry = {
-    commandId,
-    type: validated.type,
-    clientId: target.clientId,
-    enqueuedBy,
-    enqueuedAt: queued.createdAt,
-    status: "queued"
   };
-  auditLog.record(auditEntry);
-  broadcastCommandStatus(auditEntry, browsers);
-  res.writeHead(202, { "Content-Type": "application/json" });
-  res.end(JSON.stringify({ commandId, queued: true, clientId: target.clientId }));
 }
-async function handleApiMailboxSend(_req, res, mutableAuth, sessions, dataDir, getMailboxGateway, hqSessionTag) {
-  const auth = authenticateBrowserRequest2(
-    _req,
-    new URL(_req.url ?? "/", "http://localhost"),
-    mutableAuth,
-    sessions
-  );
-  if (hqAuthRequired2(mutableAuth) && !auth) {
-    res.writeHead(401, { "Content-Type": "application/json" });
-    res.end(JSON.stringify({ error: { code: "UNAUTHORIZED", message: "unauthorized" } }));
-    return;
-  }
-  const canEnqueue = callerCanEnqueue(auth, mutableAuth);
-  if (!canEnqueue) {
-    res.writeHead(403, { "Content-Type": "application/json" });
-    res.end(JSON.stringify({ error: "forbidden: token lacks control.enqueue capability" }));
-    return;
-  }
-  let mbody;
-  try {
-    mbody = JSON.parse(await readRequestBody2(_req));
-  } catch (error) {
-    writeInvalidBody2(res, error);
-    return;
-  }
-  if (typeof mbody.type !== "string" || typeof mbody.body !== "string") {
-    res.writeHead(400, { "Content-Type": "application/json" });
-    res.end(JSON.stringify({ error: "missing type or body" }));
-    return;
-  }
-  if (typeof mbody.sessionId !== "string" && typeof mbody.projectId !== "string") {
-    res.writeHead(400, { "Content-Type": "application/json" });
-    res.end(JSON.stringify({ error: "missing sessionId or projectId" }));
-    return;
-  }
-  if (mbody.audience !== void 0 && mbody.audience !== "all" && mbody.audience !== "leaders") {
-    res.writeHead(400, { "Content-Type": "application/json" });
-    res.end(JSON.stringify({ error: "audience must be all or leaders" }));
-    return;
-  }
-  const mbGlobalRoot = path5.dirname(dataDir);
-  const projectRoot = await resolveHqProjectRoot(mbGlobalRoot, {
-    sessionId: mbody.sessionId,
-    projectId: mbody.projectId
-  });
-  if (typeof projectRoot !== "string" || projectRoot.length === 0) {
-    res.writeHead(404, { "Content-Type": "application/json" });
-    res.end(JSON.stringify({ error: "could not resolve target project mailbox" }));
-    return;
-  }
-  const to = typeof mbody.to === "string" ? mbody.to : "leader";
-  const subject = typeof mbody.subject === "string" ? mbody.subject : "HQ prompt";
-  const priority = mbody.priority === "high" ? "high" : mbody.priority === "low" ? "low" : "normal";
-  const audience = mbody.audience === "leaders" ? "leaders" : "all";
-  const mailboxType = mbody.type === "queue" ? "note" : [
-    "note",
-    "ask",
-    "assign",
-    "steer",
-    "btw",
-    "broadcast",
-    "status",
-    "result",
-    "review"
-  ].includes(mbody.type) ? mbody.type : void 0;
-  if (mailboxType === void 0) {
-    res.writeHead(400, { "Content-Type": "application/json" });
-    res.end(
-      JSON.stringify({
-        error: "unrecognized or malformed mailbox message",
-        type: mbody.type
-      })
+
+// src/hq-server/mailbox-gateway-manager.ts
+var MailboxGatewayManager = class {
+  constructor(deps) {
+    this.deps = deps;
+    this.rateLimitCleanupTimer = setInterval(
+      () => this.mailboxGatewayRateLimiter.cleanup(),
+      12e4
     );
-    return;
-  }
-  if ((mailboxType === "assign" || mailboxType === "steer") && (to === "*" || to.trim().toLowerCase() === "all")) {
-    res.writeHead(400, { "Content-Type": "application/json" });
-    res.end(JSON.stringify({ error: `${mailboxType} requires a specific recipient` }));
-    return;
-  }
-  try {
-    const projectDir = resolveProjectDir(projectRoot, mbGlobalRoot);
-    const mailbox = getMailboxGateway(projectDir).mailbox;
-    const from = `hq@${hqSessionTag}`;
-    const deliveryTo = mailboxType === "broadcast" ? "all" : to;
-    const sent = await mailbox.send({
-      from,
-      to: deliveryTo,
-      type: mailboxType,
-      subject,
-      body: mbody.body,
-      priority,
-      audience
-    });
-    res.writeHead(202, { "Content-Type": "application/json" });
-    res.end(
-      JSON.stringify({
-        delivered: true,
-        messageId: sent?.id,
-        to: sent?.to ?? deliveryTo,
-        type: mailboxType,
-        audience
-      })
+    this.rateLimitCleanupTimer.unref?.();
+    this.sweepTimer = setInterval(
+      () => this.evictIdleGateways(),
+      this.MAILBOX_GATEWAY_SWEEP_INTERVAL_MS
     );
-  } catch (err) {
-    res.writeHead(500, { "Content-Type": "application/json" });
-    res.end(JSON.stringify({ error: "mailbox write failed", detail: sanitizeApiError2(err) }));
-  }
-}
-function callerCanEnqueue(auth, mutableAuth) {
-  if (isCookieAuth2(auth)) {
-    return auth.tokenId === void 0 || auth.capabilities === void 0 || auth.capabilities.includes("control.enqueue");
-  }
-  if (isTokenAuth2(auth)) {
-    return auth.capabilities === void 0 || auth.capabilities.includes("control.enqueue");
-  }
-  return !hqAuthRequired2(mutableAuth);
-}
-async function handleMailboxAction(_req, res, match, mutableAuth, sessions, dataDir, getMailboxGateway) {
-  const auth = authenticateBrowserRequest2(
-    _req,
-    new URL(_req.url ?? "/", "http://localhost"),
-    mutableAuth,
-    sessions
-  );
-  if (hqAuthRequired2(mutableAuth) && !auth) {
-    res.writeHead(401, { "Content-Type": "application/json" });
-    res.end(JSON.stringify({ error: "unauthorized" }));
-    return;
-  }
-  if (!callerCanEnqueue(auth, mutableAuth)) {
-    res.writeHead(403, { "Content-Type": "application/json" });
-    res.end(JSON.stringify({ error: "forbidden: token lacks control.enqueue capability" }));
-    return;
-  }
-  const MAILBOX_ACTIONS = ["mark-read", "acknowledge", "reopen", "soft-delete", "restore"];
-  let abody;
-  try {
-    abody = JSON.parse(await readRequestBody2(_req));
-  } catch (error) {
-    writeInvalidBody2(res, error);
-    return;
-  }
-  const mailId = decodePathSegment2(match[1]);
-  if (mailId === null) {
-    res.writeHead(400, { "Content-Type": "application/json" });
-    res.end(JSON.stringify({ error: "invalid mailId encoding" }));
-    return;
-  }
-  const action = MAILBOX_ACTIONS.find((a) => a === abody.action);
-  if (action === void 0) {
-    res.writeHead(400, { "Content-Type": "application/json" });
-    res.end(JSON.stringify({ error: "unrecognized action", action: abody.action }));
-    return;
-  }
-  const authenticatedReaderId = isCookieAuth2(auth) ? auth.tokenId ?? "hq-password-session" : isTokenAuth2(auth) ? auth.id : void 0;
-  const resolvedReaderId = authenticatedReaderId ?? abody.readerId;
-  if (typeof resolvedReaderId !== "string" || resolvedReaderId.length === 0) {
-    res.writeHead(400, { "Content-Type": "application/json" });
-    res.end(JSON.stringify({ error: "missing readerId" }));
-    return;
-  }
-  if (typeof abody.sessionId !== "string" && typeof abody.projectId !== "string") {
-    res.writeHead(400, { "Content-Type": "application/json" });
-    res.end(JSON.stringify({ error: "missing sessionId or projectId" }));
-    return;
+    this.sweepTimer.unref?.();
+  }
+  deps;
+  mailboxGateways = /* @__PURE__ */ new Map();
+  mailboxGatewayLastUsed = /* @__PURE__ */ new Map();
+  mailboxGatewayRateLimiter = new MailboxHttpRateLimiter();
+  rateLimitCleanupTimer;
+  sweepTimer;
+  MAILBOX_GATEWAY_IDLE_TTL_MS = 15 * 6e4;
+  MAILBOX_GATEWAY_SWEEP_INTERVAL_MS = 6e4;
+  authorizeMailboxGateway(req, projectDir) {
+    const requestUrl = new URL(req.url ?? "/", `http://${this.deps.host}:${this.deps.port}`);
+    const auth = authenticateBrowserRequest2(req, requestUrl, this.deps.mutableAuth, this.deps.sessions);
+    const tokenMode = this.deps.mutableAuth.browserTokens.size > 0;
+    if (hqAuthRequired(this.deps.mutableAuth) && auth === void 0) {
+      return {
+        allowed: false,
+        status: 401,
+        body: { error: { code: "UNAUTHORIZED", message: "unauthorized" } }
+      };
+    }
+    const token = isTokenAuth2(auth) ? this.deps.mutableAuth.browserTokenObjs.get(auth.token) : void 0;
+    const canUseMailbox = isCookieAuth2(auth) ? auth.capabilities === void 0 || auth.capabilities.includes("control.enqueue") : isTokenAuth2(auth) ? token?.capabilities === void 0 || !!token?.capabilities.includes("control.enqueue") : !tokenMode;
+    if (!canUseMailbox) {
+      return {
+        allowed: false,
+        status: 403,
+        body: {
+          error: {
+            code: "FORBIDDEN",
+            message: "forbidden: token lacks control.enqueue capability"
+          }
+        }
+      };
+    }
+    const identity = isTokenAuth2(auth) ? auth.id : isCookieAuth2(auth) ? "cookie" : "open";
+    return { allowed: true, rateLimitKey: `hq:${identity}:${projectDir}` };
+  }
+  getMailboxGateway(projectDir) {
+    const existing = this.mailboxGateways.get(projectDir);
+    if (existing) {
+      this.mailboxGatewayLastUsed.set(projectDir, Date.now());
+      return existing;
+    }
+    const eventEmitter = new MailboxEventEmitter();
+    const mailbox = createProjectMailbox({ projectDir, eventEmitter });
+    const router = createMailboxHttpRouter({
+      mailbox,
+      eventEmitter,
+      rateLimiter: this.mailboxGatewayRateLimiter,
+      authorize: (request) => this.authorizeMailboxGateway(request, projectDir),
+      defaultMaxAgeMs: MAILBOX_HTTP_DEFAULT_MAX_AGE_MS
+    });
+    const gateway = { mailbox, router };
+    this.mailboxGateways.set(projectDir, gateway);
+    this.mailboxGatewayLastUsed.set(projectDir, Date.now());
+    return gateway;
+  }
+  evictIdleGateways() {
+    const cutoff = Date.now() - this.MAILBOX_GATEWAY_IDLE_TTL_MS;
+    for (const [projectDir, gateway] of [...this.mailboxGateways]) {
+      if ((this.mailboxGatewayLastUsed.get(projectDir) ?? 0) > cutoff) continue;
+      if (gateway.router.hasActiveStreams()) continue;
+      this.mailboxGateways.delete(projectDir);
+      this.mailboxGatewayLastUsed.delete(projectDir);
+      gateway.router.close();
+      void gateway.mailbox.close().catch(() => void 0);
+    }
   }
-  const actGlobalRoot = path5.dirname(dataDir);
-  const projectRoot = await resolveHqProjectRoot(actGlobalRoot, {
-    sessionId: abody.sessionId,
-    projectId: abody.projectId
+  close() {
+    clearInterval(this.rateLimitCleanupTimer);
+    clearInterval(this.sweepTimer);
+    for (const { router } of this.mailboxGateways.values()) router.close();
+  }
+};
+
+// src/hq-server/preflight.ts
+import {
+  assessHqExposure,
+  ensureHqFirstRunAuthFile,
+  HqInsecureExposureError,
+  isTokenExpired as isTokenExpired3,
+  resolveHqDataDir as resolveHqDataDir3
+} from "@wrongstack/core/hq";
+async function prepareHqServerStart(options, defaults) {
+  const host = options.host ?? defaults.host;
+  const port = options.port ?? defaults.port;
+  const dataDir = resolveHqDataDir3(options.dataDir);
+  const firstRunAuth = await ensureHqFirstRunAuthFile(dataDir, {
+    warn: (message) => console.warn(
+      JSON.stringify({
+        level: "warn",
+        event: "hq.auth_load_failed",
+        message,
+        timestamp: (/* @__PURE__ */ new Date()).toISOString()
+      })
+    ),
+    actor: resolveAuditActor(),
+    ...options.password !== void 0 ? { password: options.password } : {},
+    ...options.tokenTtlMs !== void 0 ? { tokenTtlMs: options.tokenTtlMs } : {}
   });
-  if (typeof projectRoot !== "string" || projectRoot.length === 0) {
-    res.writeHead(404, { "Content-Type": "application/json" });
-    res.end(JSON.stringify({ error: "could not resolve target project mailbox" }));
-    return;
+  const { authFile } = firstRunAuth;
+  const rawBrowserTokens = authFile.browserTokens ?? [];
+  const liveBrowserTokens = rawBrowserTokens.filter((token) => !isTokenExpired3(token));
+  const hasPassword = authFile.passwordHash !== void 0;
+  const allTokensExpired = rawBrowserTokens.length > 0 && liveBrowserTokens.length === 0;
+  if (options.requireBrowserAuth && liveBrowserTokens.length === 0 && !hasPassword) {
+    throw new HqInsecureExposureError(
+      allTokensExpired ? `HQ public relay requires browser authentication, but all ${rawBrowserTokens.length} browser token(s) in the auth file have expired. Create a fresh token or set --password.` : "HQ public relay requires browser authentication. Set --password or create a browser token first."
+    );
   }
-  try {
-    const { actionToAckInput } = await import("@wrongstack/core/coordination");
-    const projectDir = resolveProjectDir(projectRoot, actGlobalRoot);
-    const mailbox = getMailboxGateway(projectDir).mailbox;
-    const readerId = resolvedReaderId;
-    const message = action === "soft-delete" ? await mailbox.softDelete(mailId, readerId) : action === "restore" ? await mailbox.restore(mailId) : await mailbox.ack(actionToAckInput(action, { action, mailId, readerId }));
-    if (message === null) {
-      res.writeHead(404, { "Content-Type": "application/json" });
-      res.end(JSON.stringify({ error: "message not found", mailId }));
-      return;
-    }
-    res.writeHead(200, { "Content-Type": "application/json" });
-    res.end(JSON.stringify({ action, mailId, message: null, changed: true }));
-  } catch (err) {
-    res.writeHead(500, { "Content-Type": "application/json" });
-    res.end(
+  const exposure = assessHqExposure({
+    host,
+    hasBrowserTokens: liveBrowserTokens.length > 0,
+    hasPassword,
+    allowInsecure: options.allowInsecureOpen
+  });
+  if (exposure.kind === "refuse") {
+    throw new HqInsecureExposureError(
+      allTokensExpired ? `${exposure.message} (all ${rawBrowserTokens.length} browser token(s) in the auth file have expired)` : exposure.message
+    );
+  }
+  if (exposure.kind === "warn") {
+    console.warn(
       JSON.stringify({
-        error: "mailbox action failed",
-        detail: sanitizeApiError2(err)
+        level: "warn",
+        event: "hq.insecure_exposure",
+        message: exposure.message,
+        host,
+        timestamp: (/* @__PURE__ */ new Date()).toISOString()
       })
     );
   }
+  return { host, port, dataDir, firstRunAuth };
 }
 
 // src/hq-server/startup.ts
@@ -3388,24 +3499,320 @@ ${terminalText("Reachable from other machines on your network:", "blue", { bold:
   );
 }
 
+// src/hq-server/server-lifecycle.ts
+function createHqServerShutdown(params) {
+  let closed = false;
+  return () => new Promise((res) => {
+    if (closed) {
+      res();
+      return;
+    }
+    closed = true;
+    clearInterval(params.cleanupTimer);
+    clearInterval(params.browserHeartbeatTimer);
+    clearInterval(params.timeseriesFlushTimer);
+    clearInterval(params.sessionCleanupTimer);
+    void params.loginAttempts.flush();
+    params.stopAlertEngine();
+    params.authWatcher.close();
+    params.snapshotBroadcaster.close();
+    params.bootstrapStore.clear();
+    params.persistence.timeseries.flush();
+    for (const ws of [...params.browsers, ...params.clients.keys()]) {
+      try {
+        ws.close(1001, "HQ shutting down");
+        ws.terminate();
+      } catch {
+      }
+    }
+    params.wss.close();
+    params.mailboxManager.close();
+    params.httpServer.close(() => {
+      const mailboxCloses = [...params.mailboxManager.mailboxGateways.values()].map(
+        ({ mailbox }) => mailbox.close().catch(() => void 0)
+      );
+      params.mailboxManager.mailboxGateways.clear();
+      params.mailboxManager.mailboxGatewayLastUsed.clear();
+      void Promise.all([
+        ...mailboxCloses,
+        params.persistence.eventLog.drain(),
+        params.persistence.snapshotStore.drain(),
+        params.persistence.timeseries.drain(),
+        params.persistence.kanban.drain()
+      ]).then(() => clearHqRuntimeMarker(params.dataDir, params.hqUrl)).catch(() => void 0).finally(() => res());
+    });
+  });
+}
+
+// src/hq-server/upgrade-handler.ts
+import { isLoopbackHost as isLoopbackHost3, hqTokenVerifier as hqTokenVerifier2 } from "@wrongstack/core/hq";
+
 // src/hq-server/ws.ts
-import { randomUUID as randomUUID3 } from "node:crypto";
+import { randomUUID as randomUUID5 } from "node:crypto";
+import {
+  HQ_PROTOCOL_VERSION as HQ_PROTOCOL_VERSION2,
+  parseHqFrame,
+  resolveHqRedactionPolicy,
+  tightenHqRedactionPolicy as tightenHqRedactionPolicy2,
+  tokenHasCapability as tokenHasCapability3
+} from "@wrongstack/core/hq";
+import { WebSocket as WebSocket2 } from "ws";
+
+// src/hq-server/ws-client-events.ts
 import {
-  HQ_BROWSER_PEER_RESUME_CLIENT_ID,
-  HQ_PROTOCOL_VERSION,
-  HQ_RESUME_GAP_MAX_BYTES,
-  HQ_RESUME_GAP_MAX_ENVELOPES,
-  HQ_RESUME_GAP_MAX_STALE_MS,
   HQ_TRANSCRIPT_TEXT_CAP,
   parseHqEventPayload,
-  parseHqFrame,
   redactHqEvent,
-  resolveHqRedactionPolicy,
   tightenHqRedactionPolicy,
   tokenHasCapability as tokenHasCapability2
 } from "@wrongstack/core/hq";
-import { WebSocket as WebSocket2 } from "ws";
+function fanoutKanbanDelta(message, clients, _browsers, projectId) {
+  let clientsNotified = 0;
+  for (const peer of clients.values()) {
+    if (peer.projectId === projectId) {
+      sendGuarded(peer.ws, message);
+      clientsNotified++;
+    }
+  }
+  return { clientsNotified, browsersNotified: 0 };
+}
+function handleIncomingClientEvent(ws, incomingEvent, clients, browsers, auth, snapshotBroadcaster, transcripts, agentMessages, persistence, persistEvent) {
+  const client = clients.get(ws);
+  if (!client) return;
+  if (incomingEvent.clientId !== client.clientId || incomingEvent.projectId !== client.projectId) {
+    ws.close(1008, "event identity mismatch");
+    return;
+  }
+  if (!tokenHasCapability2(client.authToken, "telemetry.publish") && auth.token !== void 0) {
+    ws.close(1008, "client token lacks telemetry.publish capability");
+    return;
+  }
+  if (incomingEvent.seq <= client.lastEventSeq) {
+    ws.close(1008, "event sequence must increase monotonically");
+    return;
+  }
+  const parsedPayload = parseHqEventPayload(incomingEvent.type, incomingEvent.payload);
+  if (!parsedPayload.ok) {
+    console.warn(
+      JSON.stringify({
+        level: "warn",
+        event: "hq.event_payload_rejected",
+        eventType: incomingEvent.type,
+        clientId: client.clientId,
+        projectId: client.projectId,
+        timestamp: (/* @__PURE__ */ new Date()).toISOString()
+      })
+    );
+    return;
+  }
+  client.lastEventSeq = incomingEvent.seq;
+  client.lastSeenAt = (/* @__PURE__ */ new Date()).toISOString();
+  const event = redactHqEvent(
+    { ...incomingEvent, payload: parsedPayload.payload },
+    {
+      policy: tightenHqRedactionPolicy(
+        client.declaredRedactionPolicy,
+        auth.getOperatorPolicy()
+      ),
+      projectRoot: client.project.projectRoot,
+      // Chat-transcript events carry full turns — the generic 500-char
+      // summary cap would truncate them a second time after the
+      // publisher already applied the transcript cap.
+      ...incomingEvent.type === "session.transcript" || incomingEvent.type === "agent.message" ? { maxSummaryLength: HQ_TRANSCRIPT_TEXT_CAP } : {}
+    }
+  ).value;
+  if (event.type === "client.heartbeat") {
+    return;
+  }
+  if (event.type === "kanban.snapshot") {
+    const payload = event.payload;
+    if (payload.projectId !== client.projectId || persistence === void 0) return;
+    void persistence.kanban.merge(payload).then((merged) => {
+      const touched = /* @__PURE__ */ new Set();
+      for (const record of payload.boards) touched.add(record.boardId);
+      for (const record of payload.tombstones) touched.add(record.boardId);
+      const delta = {
+        projectId: merged.projectId,
+        generatedAt: merged.generatedAt,
+        boards: merged.boards.filter((record) => touched.has(record.boardId)),
+        tombstones: merged.tombstones.filter((record) => touched.has(record.boardId))
+      };
+      const message = JSON.stringify({ type: "hq.kanban_snapshot", payload: delta });
+      fanoutKanbanDelta(message, clients, browsers, client.projectId);
+    }).catch((error) => {
+      console.warn(
+        JSON.stringify({
+          level: "warn",
+          event: "hq.kanban_merge_failed",
+          message: error instanceof Error ? error.message : String(error),
+          timestamp: (/* @__PURE__ */ new Date()).toISOString()
+        })
+      );
+    });
+    persistEvent(event);
+    broadcastEvent(event, browsers);
+    return;
+  }
+  if (event.type === "mailbox.snapshot") {
+    const payloadResult = parseHqEventPayload(event.type, event.payload);
+    if (payloadResult.ok) {
+      const payload = payloadResult.payload;
+      client.mailboxes.set(client.projectId + ":" + payload.mailboxId, payload);
+      persistEvent(event);
+      snapshotBroadcaster.broadcast();
+      broadcastEvent(event, browsers);
+      return;
+    }
+    return;
+  }
+  if (event.type === "mailbox.event") {
+    const payloadResult = parseHqEventPayload(event.type, event.payload);
+    if (!payloadResult.ok) {
+      return;
+    }
+    const payload = payloadResult.payload;
+    const sanitizedSummary = truncateHqSummary(payload.summary, 280);
+    const sanitizedEvent = sanitizedSummary === void 0 ? event : { ...event, payload: { ...payload, summary: sanitizedSummary } };
+    persistEvent(sanitizedEvent);
+    broadcastEvent(sanitizedEvent, browsers);
+    return;
+  }
+  if (event.type === "session.snapshot") {
+    const result = parseHqEventPayload(event.type, event.payload);
+    if (result.ok) {
+      const payload = result.payload;
+      client.sessions.set(payload.sessionId, { payload, receivedAt: Date.now() });
+      snapshotBroadcaster.broadcast();
+    }
+    return;
+  }
+  if (event.type === "session.ended") {
+    const result = parseHqEventPayload(event.type, event.payload);
+    if (result.ok) {
+      const payload = result.payload;
+      client.sessions.delete(payload.sessionId);
+      client.mcpSnapshots.delete(payload.sessionId);
+      for (const [runId, fleet] of client.fleets) {
+        if (fleet.sessionId === payload.sessionId) client.fleets.delete(runId);
+      }
+      snapshotBroadcaster.broadcast();
+    }
+    return;
+  }
+  if (event.type === "fleet.snapshot") {
+    const result = parseHqEventPayload(event.type, event.payload);
+    if (result.ok) {
+      const payload = result.payload;
+      client.fleets.set(payload.runId, {
+        payload,
+        ...event.sessionId !== void 0 ? { sessionId: event.sessionId } : {},
+        receivedAt: Date.now()
+      });
+      snapshotBroadcaster.broadcast();
+    }
+    return;
+  }
+  if (event.type === "mcp.health.snapshot") {
+    const result = parseHqEventPayload(event.type, event.payload);
+    if (result.ok) {
+      const payload = result.payload;
+      const sessionId = event.sessionId || "unknown";
+      const stamped = payload.servers.map((s) => ({
+        ...s,
+        projectId: client.projectId,
+        clientId: client.clientId
+      }));
+      client.mcpSnapshots.set(sessionId, { servers: stamped, receivedAt: Date.now() });
+      snapshotBroadcaster.broadcast();
+    }
+    return;
+  }
+  if (event.type === "governance.snapshot") {
+    if (!client.isLeader) return;
+    const result = parseHqEventPayload(event.type, event.payload);
+    if (result.ok) {
+      const payload = result.payload;
+      if (payload.projectId !== client.projectId) return;
+      client.governanceSnapshot = { payload, receivedAt: Date.now() };
+      snapshotBroadcaster.broadcast();
+    }
+    return;
+  }
+  if (event.type === "session.transcript") {
+    const result = parseHqEventPayload(event.type, event.payload);
+    if (result.ok) {
+      const payload = result.payload;
+      let ring = transcripts.get(payload.sessionId);
+      if (!ring) {
+        ring = { entries: [], ...client.machineId ? { machineId: client.machineId } : {} };
+      }
+      for (const entry of payload.entries) ring.entries.push(entry);
+      if (ring.entries.length > TRANSCRIPT_RING_MAX) {
+        ring.entries.splice(0, ring.entries.length - TRANSCRIPT_RING_MAX);
+      }
+      transcripts.delete(payload.sessionId);
+      transcripts.set(payload.sessionId, ring);
+      evictOldest(transcripts, MAX_TRANSCRIPT_SESSIONS);
+      broadcastEvent(event, browsers);
+    }
+    return;
+  }
+  if (event.type === "agent.message") {
+    const p = event.payload;
+    const subId = p && typeof p["subagentId"] === "string" ? p["subagentId"] : void 0;
+    if (subId) {
+      const key = agentRingKey(event.sessionId, subId);
+      let ring = agentMessages.get(key);
+      if (!ring) ring = [];
+      ring.push(agentMessageToEntry(p));
+      if (ring.length > TRANSCRIPT_RING_MAX) ring.splice(0, ring.length - TRANSCRIPT_RING_MAX);
+      agentMessages.delete(key);
+      agentMessages.set(key, ring);
+      evictOldest(agentMessages, MAX_AGENT_RINGS);
+    }
+    persistEvent(event);
+    broadcastEvent(event, browsers);
+    return;
+  }
+  persistEvent(event);
+  broadcastEvent(event, browsers);
+}
+
+// src/hq-server/ws-leader.ts
+import {
+  HQ_BROWSER_PEER_RESUME_CLIENT_ID,
+  HQ_PROTOCOL_VERSION
+} from "@wrongstack/core/hq";
 var MAX_EVENT_LOG = 5e3;
+var PEER_DEDUP_WINDOW_MS = 60 * 60 * 1e3;
+var peerDedupMap = /* @__PURE__ */ new Map();
+function peerDedupKey(projectId, previousLeaderHandle) {
+  return `${projectId}::${previousLeaderHandle}`;
+}
+function checkPeerDedup(projectId, previousLeaderHandle) {
+  const key = peerDedupKey(projectId, previousLeaderHandle);
+  const now = Date.now();
+  for (const [k, ts] of peerDedupMap) {
+    if (now - ts > PEER_DEDUP_WINDOW_MS) peerDedupMap.delete(k);
+  }
+  const last = peerDedupMap.get(key);
+  return last !== void 0 && now - last <= PEER_DEDUP_WINDOW_MS;
+}
+function recordPeerEmit(projectId, previousLeaderHandle) {
+  peerDedupMap.set(peerDedupKey(projectId, previousLeaderHandle), Date.now());
+}
+var peerEventSeq = 0;
+function nextPeerEventSeq(eventLog) {
+  if (eventLog !== void 0) {
+    for (const env of eventLog) {
+      if (env.clientId === HQ_BROWSER_PEER_RESUME_CLIENT_ID && env.seq > peerEventSeq) {
+        peerEventSeq = env.seq;
+      }
+    }
+  }
+  peerEventSeq += 1;
+  return peerEventSeq;
+}
 function computeIsLeader(clients, projectId, acceptedCapabilities) {
   if (!acceptedCapabilities.includes("control.receive")) return false;
   for (const other of clients.values()) {
@@ -3504,27 +3911,48 @@ function detectLeaderLoss(lostClient, clients, browsers, reason, eventSink) {
   }
   return true;
 }
-var peerEventSeq = 0;
-function nextPeerEventSeq(eventLog) {
-  if (eventLog !== void 0) {
-    for (const env of eventLog) {
-      if (env.clientId === HQ_BROWSER_PEER_RESUME_CLIENT_ID && env.seq > peerEventSeq) {
-        peerEventSeq = env.seq;
+
+// src/hq-server/ws-resume.ts
+import {
+  HQ_BROWSER_PEER_RESUME_CLIENT_ID as HQ_BROWSER_PEER_RESUME_CLIENT_ID2,
+  HQ_RESUME_GAP_MAX_BYTES,
+  HQ_RESUME_GAP_MAX_ENVELOPES,
+  HQ_RESUME_GAP_MAX_STALE_MS
+} from "@wrongstack/core/hq";
+function browserResumeClient(ws, clientId) {
+  return /* @__PURE__ */ new Map([
+    [
+      ws,
+      {
+        ws,
+        clientId,
+        projectId: "",
+        project: {
+          projectId: "",
+          projectName: "",
+          projectRoot: "",
+          machineId: "",
+          workspaceKind: "git"
+        },
+        kind: "browser",
+        connectedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        lastSeenAt: (/* @__PURE__ */ new Date()).toISOString(),
+        capabilities: [],
+        declaredRedactionPolicy: {
+          rawContent: false,
+          toolArgs: "summary",
+          paths: "project-relative"
+        },
+        lastEventSeq: 0,
+        mailboxes: /* @__PURE__ */ new Map(),
+        sessions: /* @__PURE__ */ new Map(),
+        fleets: /* @__PURE__ */ new Map(),
+        mcpSnapshots: /* @__PURE__ */ new Map(),
+        commandQueue: [],
+        isLeader: false
       }
-    }
-  }
-  peerEventSeq += 1;
-  return peerEventSeq;
-}
-function fanoutKanbanDelta(message, clients, _browsers, projectId) {
-  let clientsNotified = 0;
-  for (const peer of clients.values()) {
-    if (peer.projectId === projectId) {
-      sendGuarded(peer.ws, message);
-      clientsNotified++;
-    }
-  }
-  return { clientsNotified, browsersNotified: 0 };
+    ]
+  ]);
 }
 function handleClientResume(ws, clients, eventLog, frame, snapshotBroadcaster) {
   const client = clients.get(ws);
@@ -3542,7 +3970,7 @@ function handleClientResume(ws, clients, eventLog, frame, snapshotBroadcaster) {
   const now = Date.now();
   const recent = [];
   let cursorTimestamp;
-  const skipPeerEnvelopes = client.clientId !== HQ_BROWSER_PEER_RESUME_CLIENT_ID;
+  const skipPeerEnvelopes = client.clientId !== HQ_BROWSER_PEER_RESUME_CLIENT_ID2;
   for (const env of eventLog) {
     if (env.clientId !== client.clientId) continue;
     if (skipPeerEnvelopes && (env.type === "peer.rehydrate" || env.type === "peer.lost")) {
@@ -3614,60 +4042,10 @@ function handleClientResume(ws, clients, eventLog, frame, snapshotBroadcaster) {
       truncated: false
     })
   );
-  return;
-}
-var PEER_DEDUP_WINDOW_MS = 60 * 60 * 1e3;
-var peerDedupMap = /* @__PURE__ */ new Map();
-function peerDedupKey(projectId, previousLeaderHandle) {
-  return `${projectId}::${previousLeaderHandle}`;
-}
-function checkPeerDedup(projectId, previousLeaderHandle) {
-  const key = peerDedupKey(projectId, previousLeaderHandle);
-  const now = Date.now();
-  for (const [k, ts] of peerDedupMap) {
-    if (now - ts > PEER_DEDUP_WINDOW_MS) peerDedupMap.delete(k);
-  }
-  const last = peerDedupMap.get(key);
-  return last !== void 0 && now - last <= PEER_DEDUP_WINDOW_MS;
-}
-function recordPeerEmit(projectId, previousLeaderHandle) {
-  peerDedupMap.set(peerDedupKey(projectId, previousLeaderHandle), Date.now());
-}
-function browserResumeClient(ws, clientId) {
-  return /* @__PURE__ */ new Map([
-    [
-      ws,
-      {
-        ws,
-        clientId,
-        projectId: "",
-        project: {
-          projectId: "",
-          projectName: "",
-          projectRoot: "",
-          machineId: "",
-          workspaceKind: "git"
-        },
-        kind: "browser",
-        connectedAt: (/* @__PURE__ */ new Date()).toISOString(),
-        lastSeenAt: (/* @__PURE__ */ new Date()).toISOString(),
-        capabilities: [],
-        declaredRedactionPolicy: {
-          rawContent: false,
-          toolArgs: "summary",
-          paths: "project-relative"
-        },
-        lastEventSeq: 0,
-        mailboxes: /* @__PURE__ */ new Map(),
-        sessions: /* @__PURE__ */ new Map(),
-        fleets: /* @__PURE__ */ new Map(),
-        mcpSnapshots: /* @__PURE__ */ new Map(),
-        commandQueue: [],
-        isLeader: false
-      }
-    ]
-  ]);
 }
+
+// src/hq-server/ws.ts
+var MAX_EVENT_LOG2 = 5e3;
 function handleBrowser(ws, snapshotBroadcaster, browsers, eventLog) {
   browsers.add(ws);
   ws.on("error", (err) => {
@@ -3723,7 +4101,7 @@ function handleClient(ws, clients, browsers, eventLog, auth, snapshotBroadcaster
   let registered = false;
   function persistEvent(event) {
     eventLog.push(event);
-    if (eventLog.length > MAX_EVENT_LOG) eventLog.splice(0, eventLog.length - MAX_EVENT_LOG);
+    if (eventLog.length > MAX_EVENT_LOG2) eventLog.splice(0, eventLog.length - MAX_EVENT_LOG2);
     if (persistence !== void 0) {
       persistence.eventLog.append(event);
       recordTimeseriesSignal(persistence, event);
@@ -3754,11 +4132,11 @@ function handleClient(ws, clients, browsers, eventLog, auth, snapshotBroadcaster
         return;
       }
       const payload = frame.payload;
-      if (payload.protocolVersion !== HQ_PROTOCOL_VERSION) {
+      if (payload.protocolVersion !== HQ_PROTOCOL_VERSION2) {
         ws.close(1008, "protocol version mismatch");
         return;
       }
-      const canPublishTelemetry = auth.token === void 0 || tokenHasCapability2(auth.token, "telemetry.publish");
+      const canPublishTelemetry = auth.token === void 0 || tokenHasCapability3(auth.token, "telemetry.publish");
       const acceptedCapabilities = payload.capabilities.filter(
         (capability) => capability === "control.receive" || canPublishTelemetry
       );
@@ -3798,11 +4176,6 @@ function handleClient(ws, clients, browsers, eventLog, auth, snapshotBroadcaster
         fleets: /* @__PURE__ */ new Map(),
         mcpSnapshots: /* @__PURE__ */ new Map(),
         commandQueue: [],
-        // Leader for the project is the unique client with `control.receive`
-        // capability. First such client wins; subsequent clients with the
-        // capability are followers. Same-clientId reconnects inherit this
-        // flag from the superseded socket because that identity never really
-        // disappeared; different-client supersedes still use the loss detector.
         isLeader: inheritedLeader || computeIsLeader(clients, payload.project.projectId, acceptedCapabilities)
       };
       clients.set(ws, client);
@@ -3812,26 +4185,24 @@ function handleClient(ws, clients, browsers, eventLog, auth, snapshotBroadcaster
       }
       const welcome = {
         type: "hq.welcome",
-        protocolVersion: HQ_PROTOCOL_VERSION,
+        protocolVersion: HQ_PROTOCOL_VERSION2,
         serverTime: (/* @__PURE__ */ new Date()).toISOString(),
         acceptedCapabilities,
-        // The operator-configured override (from <dataDir>/auth.json) wins
-        // over the default. The client learns the *effective* policy.
-        redactionPolicy: tightenHqRedactionPolicy(
+        redactionPolicy: tightenHqRedactionPolicy2(
           declaredRedactionPolicy,
           auth.getOperatorPolicy()
         )
       };
       ws.send(JSON.stringify(welcome));
       if (persistence !== void 0) {
-        void persistence.kanban.load(client.projectId).then((payload2) => {
-          sendGuarded(ws, JSON.stringify({ type: "hq.kanban_snapshot", payload: payload2 }));
+        void persistence.kanban.load(client.projectId).then((p) => {
+          sendGuarded(ws, JSON.stringify({ type: "hq.kanban_snapshot", payload: p }));
         }).catch(() => void 0);
       }
       const event = {
-        id: randomUUID3(),
+        id: randomUUID5(),
         type: "client.hello",
-        schemaVersion: HQ_PROTOCOL_VERSION,
+        schemaVersion: HQ_PROTOCOL_VERSION2,
         timestamp: (/* @__PURE__ */ new Date()).toISOString(),
         clientId: payload.client.clientId,
         projectId: payload.project.projectId,
@@ -3904,223 +4275,148 @@ function handleClient(ws, clients, browsers, eventLog, auth, snapshotBroadcaster
       return;
     }
     if (frame.type === "client.event") {
-      const client = clients.get(ws);
-      if (!client) return;
-      const incomingEvent = frame.event;
-      if (incomingEvent.clientId !== client.clientId || incomingEvent.projectId !== client.projectId) {
-        ws.close(1008, "event identity mismatch");
-        return;
-      }
-      if (!tokenHasCapability2(client.authToken, "telemetry.publish") && auth.token !== void 0) {
-        ws.close(1008, "client token lacks telemetry.publish capability");
-        return;
-      }
-      if (incomingEvent.seq <= client.lastEventSeq) {
-        ws.close(1008, "event sequence must increase monotonically");
-        return;
+      handleIncomingClientEvent(
+        ws,
+        frame.event,
+        clients,
+        browsers,
+        auth,
+        snapshotBroadcaster,
+        transcripts,
+        agentMessages,
+        persistence,
+        persistEvent
+      );
+    }
+  });
+  ws.on("close", () => {
+    const lostClient = clients.get(ws);
+    clients.delete(ws);
+    if (lostClient) {
+      detectLeaderLoss(lostClient, clients, browsers, "graceful", { eventLog, persistence });
+    }
+    snapshotBroadcaster.broadcast();
+  });
+}
+
+// src/hq-server/upgrade-handler.ts
+function handleHqUpgrade(req, socket, head, deps) {
+  const url = new URL(req.url ?? "/", `http://${deps.host}:${deps.port}`);
+  const pathname = url.pathname;
+  if (pathname !== "/ws/client" && pathname !== "/ws/browser") {
+    socket.destroy();
+    return;
+  }
+  if (!hasTrustedBrowserOrigin2(
+    req,
+    deps.host,
+    deps.listeningPort(),
+    deps.trustedPublicOrigins,
+    deps.allowFileOrigin
+  )) {
+    socket.write(
+      "HTTP/1.1 403 Forbidden\r\nContent-Type: application/json\r\nConnection: close\r\n\r\n" + JSON.stringify({
+        error: {
+          code: "INVALID_ORIGIN",
+          message: "Cross-origin WebSocket upgrade rejected."
+        }
+      })
+    );
+    socket.destroy();
+    return;
+  }
+  const tokenSet = pathname === "/ws/browser" ? deps.mutableAuth.browserTokens : deps.mutableAuth.clientTokens;
+  const needsAuth = pathname === "/ws/browser" ? hqAuthRequired(deps.mutableAuth, deps.requireBrowserAuth) : hqClientAuthRequired(deps.mutableAuth);
+  if (needsAuth) {
+    let supplied = url.searchParams.get("token") ?? "";
+    if (supplied && pathname === "/ws/browser") {
+      const requestHost = (req.headers.host ?? "").trim();
+      let wsHostname = "";
+      try {
+        wsHostname = new URL(`http://${requestHost}`).hostname;
+      } catch {
       }
-      const parsedPayload = parseHqEventPayload(incomingEvent.type, incomingEvent.payload);
-      if (!parsedPayload.ok) {
+      if (wsHostname && !isLoopbackHost3(wsHostname)) {
         console.warn(
           JSON.stringify({
             level: "warn",
-            event: "hq.event_payload_rejected",
-            eventType: incomingEvent.type,
-            clientId: client.clientId,
-            projectId: client.projectId,
+            event: "hq.ws_token_from_query_rejected",
+            message: "Browser token in WS query rejected on non-loopback \u2014 use session cookie instead.",
             timestamp: (/* @__PURE__ */ new Date()).toISOString()
           })
         );
-        return;
-      }
-      client.lastEventSeq = incomingEvent.seq;
-      client.lastSeenAt = (/* @__PURE__ */ new Date()).toISOString();
-      const event = redactHqEvent(
-        { ...incomingEvent, payload: parsedPayload.payload },
-        {
-          policy: tightenHqRedactionPolicy(
-            client.declaredRedactionPolicy,
-            auth.getOperatorPolicy()
-          ),
-          projectRoot: client.project.projectRoot,
-          // Chat-transcript events carry full turns — the generic 500-char
-          // summary cap would truncate them a second time after the
-          // publisher already applied the transcript cap.
-          ...incomingEvent.type === "session.transcript" || incomingEvent.type === "agent.message" ? { maxSummaryLength: HQ_TRANSCRIPT_TEXT_CAP } : {}
-        }
-      ).value;
-      if (event.type === "client.heartbeat") {
-        return;
-      }
-      if (event.type === "kanban.snapshot") {
-        const payload = event.payload;
-        if (payload.projectId !== client.projectId || persistence === void 0) return;
-        void persistence.kanban.merge(payload).then((merged) => {
-          const touched = /* @__PURE__ */ new Set();
-          for (const record of payload.boards) touched.add(record.boardId);
-          for (const record of payload.tombstones) touched.add(record.boardId);
-          const delta = {
-            projectId: merged.projectId,
-            generatedAt: merged.generatedAt,
-            boards: merged.boards.filter((record) => touched.has(record.boardId)),
-            tombstones: merged.tombstones.filter((record) => touched.has(record.boardId))
-          };
-          const message = JSON.stringify({ type: "hq.kanban_snapshot", payload: delta });
-          fanoutKanbanDelta(message, clients, browsers, client.projectId);
-        }).catch((error) => {
-          console.warn(
-            JSON.stringify({
-              level: "warn",
-              event: "hq.kanban_merge_failed",
-              message: error instanceof Error ? error.message : String(error),
-              timestamp: (/* @__PURE__ */ new Date()).toISOString()
-            })
-          );
-        });
-        persistEvent(event);
-        broadcastEvent(event, browsers);
-        return;
-      }
-      if (event.type === "mailbox.snapshot" && client !== void 0) {
-        const payloadResult = parseHqEventPayload(event.type, event.payload);
-        if (payloadResult.ok) {
-          const payload = payloadResult.payload;
-          client.mailboxes.set(client.projectId + ":" + payload.mailboxId, payload);
-          persistEvent(event);
-          snapshotBroadcaster.broadcast();
-          broadcastEvent(event, browsers);
-          return;
-        }
-        return;
-      }
-      if (event.type === "mailbox.event") {
-        const payloadResult = parseHqEventPayload(event.type, event.payload);
-        if (!payloadResult.ok) {
-          return;
-        }
-        const payload = payloadResult.payload;
-        const sanitizedSummary = truncateHqSummary(payload.summary, 280);
-        const sanitizedEvent = sanitizedSummary === void 0 ? event : { ...event, payload: { ...payload, summary: sanitizedSummary } };
-        persistEvent(sanitizedEvent);
-        broadcastEvent(sanitizedEvent, browsers);
-        return;
-      }
-      if (event.type === "session.snapshot" && client !== void 0) {
-        const result = parseHqEventPayload(event.type, event.payload);
-        if (result.ok) {
-          const payload = result.payload;
-          client.sessions.set(payload.sessionId, { payload, receivedAt: Date.now() });
-          snapshotBroadcaster.broadcast();
-        }
-        return;
-      }
-      if (event.type === "session.ended" && client !== void 0) {
-        const result = parseHqEventPayload(event.type, event.payload);
-        if (result.ok) {
-          const payload = result.payload;
-          client.sessions.delete(payload.sessionId);
-          client.mcpSnapshots.delete(payload.sessionId);
-          for (const [runId, fleet] of client.fleets) {
-            if (fleet.sessionId === payload.sessionId) client.fleets.delete(runId);
-          }
-          snapshotBroadcaster.broadcast();
-        }
-        return;
-      }
-      if (event.type === "fleet.snapshot" && client !== void 0) {
-        const result = parseHqEventPayload(event.type, event.payload);
-        if (result.ok) {
-          const payload = result.payload;
-          client.fleets.set(payload.runId, {
-            payload,
-            ...event.sessionId !== void 0 ? { sessionId: event.sessionId } : {},
-            receivedAt: Date.now()
-          });
-          snapshotBroadcaster.broadcast();
-        }
-        return;
-      }
-      if (event.type === "mcp.health.snapshot" && client !== void 0) {
-        const result = parseHqEventPayload(event.type, event.payload);
-        if (result.ok) {
-          const payload = result.payload;
-          const sessionId = event.sessionId || "unknown";
-          const stamped = payload.servers.map((s) => ({
-            ...s,
-            projectId: client.projectId,
-            clientId: client.clientId
-          }));
-          client.mcpSnapshots.set(sessionId, { servers: stamped, receivedAt: Date.now() });
-          snapshotBroadcaster.broadcast();
-        }
-        return;
+        supplied = "";
       }
-      if (event.type === "governance.snapshot" && client !== void 0) {
-        if (!client.isLeader) return;
-        const result = parseHqEventPayload(event.type, event.payload);
-        if (result.ok) {
-          const payload = result.payload;
-          if (payload.projectId !== client.projectId) return;
-          client.governanceSnapshot = { payload, receivedAt: Date.now() };
-          snapshotBroadcaster.broadcast();
-        }
-        return;
+    }
+    const tokenValid = timingSafeTokenMatch(tokenSet, supplied) !== void 0;
+    const cookieValid = pathname === "/ws/browser" && deps.mutableAuth.cookieSecret !== void 0 && (() => {
+      const raw = readHqSessionCookie(req.headers.cookie);
+      if (!raw) return false;
+      const sessionId = parseHqSessionCookie2(raw, deps.mutableAuth.cookieSecret);
+      if (sessionId === void 0) return false;
+      const session = deps.sessions.get(sessionId);
+      if (!session || Date.now() - session.createdAt >= HQ_SESSION_MAX_AGE_MS)
+        return false;
+      const now2 = Date.now();
+      if (!session.pending2fa && now2 - session.lastSeenAt > HQ_SESSION_IDLE_TIMEOUT_MS)
+        return false;
+      session.lastSeenAt = now2;
+      if (session.pending2fa) return false;
+      if (session.kind === "token" && session.tokenId !== void 0) {
+        return [...deps.mutableAuth.browserTokenObjs.values()].some(
+          (obj) => obj.id === session.tokenId
+        );
       }
-      if (event.type === "session.transcript" && client !== void 0) {
-        const result = parseHqEventPayload(event.type, event.payload);
-        if (result.ok) {
-          const payload = result.payload;
-          let ring = transcripts.get(payload.sessionId);
-          if (!ring) {
-            ring = { entries: [], ...client.machineId ? { machineId: client.machineId } : {} };
-          }
-          for (const entry of payload.entries) ring.entries.push(entry);
-          if (ring.entries.length > TRANSCRIPT_RING_MAX) {
-            ring.entries.splice(0, ring.entries.length - TRANSCRIPT_RING_MAX);
+      return true;
+    })();
+    if (!tokenValid && !cookieValid) {
+      socket.write(
+        "HTTP/1.1 401 Unauthorized\r\nContent-Type: application/json\r\nConnection: close\r\n\r\n" + JSON.stringify({
+          error: {
+            code: "UNAUTHORIZED",
+            message: pathname === "/ws/browser" ? "A valid ?token= or password session is required for browser connections." : "A valid ?token= is required for client connections in token mode."
           }
-          transcripts.delete(payload.sessionId);
-          transcripts.set(payload.sessionId, ring);
-          evictOldest(transcripts, MAX_TRANSCRIPT_SESSIONS);
-          broadcastEvent(event, browsers);
-        }
-        return;
-      }
-      if (event.type === "agent.message") {
-        const p = event.payload;
-        const subId = p && typeof p["subagentId"] === "string" ? p["subagentId"] : void 0;
-        if (subId) {
-          const key = agentRingKey(event.sessionId, subId);
-          let ring = agentMessages.get(key);
-          if (!ring) ring = [];
-          ring.push(agentMessageToEntry(p));
-          if (ring.length > TRANSCRIPT_RING_MAX) ring.splice(0, ring.length - TRANSCRIPT_RING_MAX);
-          agentMessages.delete(key);
-          agentMessages.set(key, ring);
-          evictOldest(agentMessages, MAX_AGENT_RINGS);
-        }
-        persistEvent(event);
-        broadcastEvent(event, browsers);
-        return;
-      }
-      persistEvent(event);
-      broadcastEvent(event, browsers);
-    }
-  });
-  ws.on("close", () => {
-    const lostClient = clients.get(ws);
-    clients.delete(ws);
-    if (lostClient) {
-      detectLeaderLoss(lostClient, clients, browsers, "graceful", { eventLog, persistence });
+        })
+      );
+      socket.destroy();
+      return;
     }
-    snapshotBroadcaster.broadcast();
+  }
+  deps.wss.handleUpgrade(req, socket, head, (ws) => {
+    deps.wss.emit("connection", ws, req, pathname);
   });
 }
+function handleHqConnection(ws, req, pathname, deps) {
+  if (pathname === "/ws/browser") {
+    handleBrowser(ws, deps.snapshotBroadcaster, deps.browsers, deps.eventLog);
+  } else {
+    const token = new URL(req.url ?? "/", `http://${deps.host}:${deps.port}`).searchParams.get("token");
+    const authToken = token ? deps.mutableAuth.clientTokenObjs.get(hqTokenVerifier2(token)) : void 0;
+    deps.clientSocketTokens.set(ws, authToken);
+    ws.once("close", () => deps.clientSocketTokens.delete(ws));
+    handleClient(
+      ws,
+      deps.clients,
+      deps.browsers,
+      deps.eventLog,
+      {
+        ...authToken ? { token: authToken } : {},
+        getOperatorPolicy: () => deps.mutableAuth.operatorPolicyOverride
+      },
+      deps.snapshotBroadcaster,
+      deps.transcripts,
+      deps.agentMessages,
+      deps.persistence,
+      deps.auditLog
+    );
+  }
+}
 
 // src/hq-server.ts
 import { HqInsecureExposureError as HqInsecureExposureError2 } from "@wrongstack/core/hq";
 var DEFAULT_HOST = "127.0.0.1";
 var DEFAULT_PORT = 3499;
-var MAX_EVENT_LOG2 = 5e3;
+var MAX_EVENT_LOG3 = 5e3;
 var MAX_NON_STRICT_PORT_SCAN = 50;
 var CLIENT_TTL_MS = 6e4;
 var CLIENT_CLEANUP_INTERVAL_MS = 3e4;
@@ -4163,7 +4459,7 @@ async function startHqServerWithAuth(options, host, port, dataDir, firstRunAuth)
   const { mutableAuth } = authState;
   if (!mutableAuth.cookieSecret && mutableAuth.browserTokens.size > 0) {
     const secret = mintHqCookieSecret2();
-    const next = await mutateHqAuthFile2(dataDir, (current) => ({
+    const next = await mutateHqAuthFile3(dataDir, (current) => ({
       ...current,
       cookieSecret: secret
     }));
@@ -4203,16 +4499,12 @@ async function startHqServerWithAuth(options, host, port, dataDir, firstRunAuth)
     const eventLog = [];
     const transcripts = /* @__PURE__ */ new Map();
     const agentMessages = /* @__PURE__ */ new Map();
-    const mailboxGateways = /* @__PURE__ */ new Map();
-    const MAILBOX_GATEWAY_IDLE_TTL_MS = 15 * 6e4;
-    const MAILBOX_GATEWAY_SWEEP_INTERVAL_MS = 6e4;
-    const mailboxGatewayLastUsed = /* @__PURE__ */ new Map();
-    const mailboxGatewayRateLimiter = new MailboxHttpRateLimiter();
-    const mailboxGatewayRateLimitCleanup = setInterval(
-      () => mailboxGatewayRateLimiter.cleanup(),
-      12e4
-    );
-    mailboxGatewayRateLimitCleanup.unref?.();
+    const mailboxManager = new MailboxGatewayManager({
+      host,
+      port,
+      mutableAuth,
+      sessions
+    });
     const loginAttempts = new LoginAttemptStore(dataDir);
     void loginAttempts.load();
     const HQ_SESSION_MAX_AGE_MS2 = 7 * 24 * 60 * 60 * 1e3;
@@ -4276,76 +4568,7 @@ async function startHqServerWithAuth(options, host, port, dataDir, firstRunAuth)
       );
     })().catch(() => {
     });
-    const hqSessionTag = randomUUID4().slice(0, 8);
-    const authorizeMailboxGateway = (req, projectDir) => {
-      const requestUrl = new URL(req.url ?? "/", `http://${host}:${port}`);
-      const auth = authenticateBrowserRequest2(req, requestUrl, mutableAuth, sessions);
-      const tokenMode = mutableAuth.browserTokens.size > 0;
-      if (hqAuthRequired(mutableAuth) && auth === void 0) {
-        return {
-          allowed: false,
-          status: 401,
-          body: { error: { code: "UNAUTHORIZED", message: "unauthorized" } }
-        };
-      }
-      const token = isTokenAuth2(auth) ? mutableAuth.browserTokenObjs.get(auth.token) : void 0;
-      const canUseMailbox = isCookieAuth2(auth) ? auth.capabilities === void 0 || auth.capabilities.includes("control.enqueue") : isTokenAuth2(auth) ? token?.capabilities === void 0 || !!token?.capabilities.includes("control.enqueue") : !tokenMode;
-      if (!canUseMailbox) {
-        return {
-          allowed: false,
-          status: 403,
-          body: {
-            error: {
-              code: "FORBIDDEN",
-              message: "forbidden: token lacks control.enqueue capability"
-            }
-          }
-        };
-      }
-      const identity = isTokenAuth2(auth) ? auth.id : isCookieAuth2(auth) ? "cookie" : "open";
-      return { allowed: true, rateLimitKey: `hq:${identity}:${projectDir}` };
-    };
-    const getMailboxGateway = (projectDir) => {
-      const existing = mailboxGateways.get(projectDir);
-      if (existing) {
-        mailboxGatewayLastUsed.set(projectDir, Date.now());
-        return existing;
-      }
-      const eventEmitter = new MailboxEventEmitter();
-      const mailbox = createProjectMailbox({ projectDir, eventEmitter });
-      const router = createMailboxHttpRouter({
-        mailbox,
-        eventEmitter,
-        rateLimiter: mailboxGatewayRateLimiter,
-        authorize: (request) => authorizeMailboxGateway(request, projectDir),
-        // Wire the 1h look-back that the router's docs promise at
-        // mailbox-http-router.ts:25-32 / :47-62. The router itself is
-        // opt-in (L146-152): without this option, every retained
-        // message would be returned. Per-request opt-in to the full
-        // history remains available via `?sinceMs=0`.
-        defaultMaxAgeMs: MAILBOX_HTTP_DEFAULT_MAX_AGE_MS
-      });
-      const gateway = { mailbox, router };
-      mailboxGateways.set(projectDir, gateway);
-      mailboxGatewayLastUsed.set(projectDir, Date.now());
-      return gateway;
-    };
-    const evictIdleMailboxGateways = () => {
-      const cutoff = Date.now() - MAILBOX_GATEWAY_IDLE_TTL_MS;
-      for (const [projectDir, gateway] of [...mailboxGateways]) {
-        if ((mailboxGatewayLastUsed.get(projectDir) ?? 0) > cutoff) continue;
-        if (gateway.router.hasActiveStreams()) continue;
-        mailboxGateways.delete(projectDir);
-        mailboxGatewayLastUsed.delete(projectDir);
-        gateway.router.close();
-        void gateway.mailbox.close().catch(() => void 0);
-      }
-    };
-    const mailboxGatewaySweepTimer = setInterval(
-      evictIdleMailboxGateways,
-      MAILBOX_GATEWAY_SWEEP_INTERVAL_MS
-    );
-    mailboxGatewaySweepTimer.unref?.();
+    const hqSessionTag = randomUUID6().slice(0, 8);
     const alertEngine = new HqAlertEngine({
       onAlert: (alert) => {
         const msg = toAlertMessage(alert);
@@ -4358,7 +4581,7 @@ async function startHqServerWithAuth(options, host, port, dataDir, firstRunAuth)
     });
     void persistence.eventLog.hydrate().catch(() => void 0);
     void persistence.timeseries.load().catch(() => void 0);
-    persistence.eventLog.recent(MAX_EVENT_LOG2).then((prior) => {
+    persistence.eventLog.recent(MAX_EVENT_LOG3).then((prior) => {
       for (let i = prior.length - 1; i >= 0; i--) eventLog.push(prior[i]);
     }).catch(() => {
     });
@@ -4445,8 +4668,8 @@ async function startHqServerWithAuth(options, host, port, dataDir, firstRunAuth)
       eventLog,
       transcripts,
       agentMessages,
-      mailboxGateways,
-      mailboxGatewayRateLimiter,
+      mailboxGateways: mailboxManager.mailboxGateways,
+      mailboxGatewayRateLimiter: mailboxManager.mailboxGatewayRateLimiter,
       alertEngine,
       auditLog,
       persistence,
@@ -4454,11 +4677,9 @@ async function startHqServerWithAuth(options, host, port, dataDir, firstRunAuth)
       hqSessionTag,
       requireBrowserAuth: options.requireBrowserAuth,
       secureCookies: options.secureCookies,
-      authorizeMailboxGateway,
-      getMailboxGateway,
+      authorizeMailboxGateway: (req, projectDir) => mailboxManager.authorizeMailboxGateway(req, projectDir),
+      getMailboxGateway: (projectDir) => mailboxManager.getMailboxGateway(projectDir),
       getTokenStats: () => authState.tokenStats(),
-      // Single projection + single floor evaluation, shared with the reload
-      // watcher below. See `createHqAuthState`'s `onApplied` hook.
       applyAuthFile: (next) => authState.apply(next),
       trustedProxyHops: options.trustedProxyHops ?? 0,
       bootstrapStore
@@ -4478,120 +4699,31 @@ async function startHqServerWithAuth(options, host, port, dataDir, firstRunAuth)
       }
     }, options.browserHeartbeatIntervalMs ?? BROWSER_HEARTBEAT_INTERVAL_MS);
     browserHeartbeatTimer.unref?.();
+    const upgradeDeps = {
+      host,
+      port,
+      listeningPort: () => listeningPort,
+      trustedPublicOrigins,
+      allowFileOrigin: options.allowFileOrigin,
+      requireBrowserAuth: options.requireBrowserAuth,
+      mutableAuth,
+      sessions,
+      clients,
+      clientSocketTokens,
+      browsers,
+      eventLog,
+      transcripts,
+      agentMessages,
+      persistence,
+      auditLog,
+      snapshotBroadcaster,
+      wss
+    };
     httpServer.on("upgrade", (req, socket, head) => {
-      const url = new URL(req.url ?? "/", `http://${host}:${port}`);
-      const pathname = url.pathname;
-      if (pathname !== "/ws/client" && pathname !== "/ws/browser") {
-        socket.destroy();
-        return;
-      }
-      if (!hasTrustedBrowserOrigin2(
-        req,
-        host,
-        listeningPort,
-        trustedPublicOrigins,
-        options.allowFileOrigin
-      )) {
-        socket.write(
-          "HTTP/1.1 403 Forbidden\r\nContent-Type: application/json\r\nConnection: close\r\n\r\n" + JSON.stringify({
-            error: {
-              code: "INVALID_ORIGIN",
-              message: "Cross-origin WebSocket upgrade rejected."
-            }
-          })
-        );
-        socket.destroy();
-        return;
-      }
-      const tokenSet = pathname === "/ws/browser" ? mutableAuth.browserTokens : mutableAuth.clientTokens;
-      const needsAuth = pathname === "/ws/browser" ? hqAuthRequired(mutableAuth, options.requireBrowserAuth) : hqClientAuthRequired(mutableAuth);
-      if (needsAuth) {
-        let supplied = url.searchParams.get("token") ?? "";
-        if (supplied && pathname === "/ws/browser") {
-          const requestHost = (req.headers.host ?? "").trim();
-          let wsHostname = "";
-          try {
-            wsHostname = new URL(`http://${requestHost}`).hostname;
-          } catch {
-          }
-          if (wsHostname && !isLoopbackHost3(wsHostname)) {
-            console.warn(
-              JSON.stringify({
-                level: "warn",
-                event: "hq.ws_token_from_query_rejected",
-                message: "Browser token in WS query rejected on non-loopback \u2014 use session cookie instead.",
-                timestamp: (/* @__PURE__ */ new Date()).toISOString()
-              })
-            );
-            supplied = "";
-          }
-        }
-        const tokenValid = timingSafeTokenMatch(tokenSet, supplied) !== void 0;
-        const cookieValid = pathname === "/ws/browser" && mutableAuth.cookieSecret !== void 0 && (() => {
-          const raw = readHqSessionCookie(req.headers.cookie);
-          if (!raw) return false;
-          const sessionId = parseHqSessionCookie2(raw, mutableAuth.cookieSecret);
-          if (sessionId === void 0) return false;
-          const session = sessions.get(sessionId);
-          if (!session || Date.now() - session.createdAt >= HQ_SESSION_MAX_AGE_MS)
-            return false;
-          const now2 = Date.now();
-          if (!session.pending2fa && now2 - session.lastSeenAt > HQ_SESSION_IDLE_TIMEOUT_MS)
-            return false;
-          session.lastSeenAt = now2;
-          if (session.pending2fa) return false;
-          if (session.kind === "token" && session.tokenId !== void 0) {
-            return [...mutableAuth.browserTokenObjs.values()].some(
-              (obj) => obj.id === session.tokenId
-            );
-          }
-          return true;
-        })();
-        if (!tokenValid && !cookieValid) {
-          socket.write(
-            "HTTP/1.1 401 Unauthorized\r\nContent-Type: application/json\r\nConnection: close\r\n\r\n" + JSON.stringify({
-              error: {
-                code: "UNAUTHORIZED",
-                message: pathname === "/ws/browser" ? "A valid ?token= or password session is required for browser connections." : "A valid ?token= is required for client connections in token mode."
-              }
-            })
-          );
-          socket.destroy();
-          return;
-        }
-      }
-      wss.handleUpgrade(req, socket, head, (ws) => {
-        wss.emit("connection", ws, req, pathname);
-      });
+      handleHqUpgrade(req, socket, head, upgradeDeps);
     });
     wss.on("connection", (ws, req, pathname) => {
-      if (pathname === "/ws/browser") {
-        handleBrowser(ws, snapshotBroadcaster, browsers, eventLog);
-      } else {
-        const token = new URL(req.url ?? "/", `http://${host}:${port}`).searchParams.get("token");
-        const authToken = token ? mutableAuth.clientTokenObjs.get(hqTokenVerifier2(token)) : void 0;
-        clientSocketTokens.set(ws, authToken);
-        ws.once("close", () => clientSocketTokens.delete(ws));
-        handleClient(
-          ws,
-          clients,
-          browsers,
-          eventLog,
-          {
-            // WS-044: `clientTokenObjs` is keyed on `hqTokenKey` — the verifier —
-            // so the presented secret is hashed before lookup. Indexing with the
-            // raw value silently returned undefined, which downgraded a scoped
-            // token to "no capabilities record" at the capability gate.
-            ...authToken ? { token: authToken } : {},
-            getOperatorPolicy: () => mutableAuth.operatorPolicyOverride
-          },
-          snapshotBroadcaster,
-          transcripts,
-          agentMessages,
-          persistence,
-          auditLog
-        );
-      }
+      handleHqConnection(ws, req, pathname, upgradeDeps);
     });
     const authWatcher = watchHqAuthFile(
       dataDir,
@@ -4697,7 +4829,6 @@ async function startHqServerWithAuth(options, host, port, dataDir, firstRunAuth)
           browserTokenMode: mutableAuth.browserTokens.size > 0,
           passwordMode: mutableAuth.passwordHash !== void 0
         };
-        let closed = false;
         const handle = {
           host,
           port: actualPort,
@@ -4711,47 +4842,24 @@ async function startHqServerWithAuth(options, host, port, dataDir, firstRunAuth)
             }
             trustedPublicOrigins.add(parsed.origin.toLowerCase());
           },
-          close: () => new Promise((res) => {
-            if (closed) {
-              res();
-              return;
-            }
-            closed = true;
-            clearInterval(cleanupTimer);
-            clearInterval(browserHeartbeatTimer);
-            clearInterval(timeseriesFlushTimer);
-            clearInterval(mailboxGatewayRateLimitCleanup);
-            clearInterval(mailboxGatewaySweepTimer);
-            clearInterval(sessionCleanupTimer);
-            void loginAttempts.flush();
-            stopAlertEngine();
-            authWatcher.close();
-            snapshotBroadcaster.close();
-            bootstrapStore.clear();
-            persistence.timeseries.flush();
-            for (const ws of [...browsers, ...clients.keys()]) {
-              try {
-                ws.close(1001, "HQ shutting down");
-                ws.terminate();
-              } catch {
-              }
-            }
-            wss.close();
-            for (const { router } of mailboxGateways.values()) router.close();
-            httpServer.close(() => {
-              const mailboxCloses = [...mailboxGateways.values()].map(
-                ({ mailbox }) => mailbox.close().catch(() => void 0)
-              );
-              mailboxGateways.clear();
-              mailboxGatewayLastUsed.clear();
-              void Promise.all([
-                ...mailboxCloses,
-                persistence.eventLog.drain(),
-                persistence.snapshotStore.drain(),
-                persistence.timeseries.drain(),
-                persistence.kanban.drain()
-              ]).then(() => clearHqRuntimeMarker(dataDir, hqUrl)).catch(() => void 0).finally(() => res());
-            });
+          close: createHqServerShutdown({
+            cleanupTimer,
+            browserHeartbeatTimer,
+            timeseriesFlushTimer,
+            sessionCleanupTimer,
+            loginAttempts,
+            stopAlertEngine,
+            authWatcher,
+            snapshotBroadcaster,
+            bootstrapStore,
+            persistence,
+            browsers,
+            clients,
+            wss,
+            mailboxManager,
+            httpServer,
+            dataDir,
+            hqUrl
           })
         };
         writeHqStartupInfo((line) => console.log(line.trimEnd()), {
@@ -4774,7 +4882,7 @@ export {
   readLocalSubagentTranscript2 as readLocalSubagentTranscript,
   DEFAULT_HOST,
   DEFAULT_PORT,
-  MAX_EVENT_LOG2 as MAX_EVENT_LOG,
+  MAX_EVENT_LOG3 as MAX_EVENT_LOG,
   MAX_NON_STRICT_PORT_SCAN,
   CLIENT_TTL_MS,
   CLIENT_CLEANUP_INTERVAL_MS,
@@ -4783,4 +4891,4 @@ export {
   startHqServer,
   HqInsecureExposureError2 as HqInsecureExposureError
 };
-//# sourceMappingURL=chunk-RHLQT3EV.js.map
+//# sourceMappingURL=chunk-CB35UVXO.js.map