@wrongstack/cli 1.0.24 → 1.0.26

package/dist/{webui-server-L2SICPTB.js → webui-server-YTHLRFD2.js}

@@ -1,12 +1,12 @@
-import {
-  createKanbanRunMirror
-} from "./chunk-VCYZ3WZV.js";
 import {
   createKanbanSupervisor
 } from "./chunk-R4QGL6GB.js";
 import {
   WEBUI_SESSION_CHILD_CAPABILITIES
 } from "./chunk-ZMX5HRLI.js";
+import {
+  createKanbanRunMirror
+} from "./chunk-VCYZ3WZV.js";
 import {
   createHqCommandDispatcher,
   createProjectKanbanAssignHandler,
@@ -14,14 +14,365 @@ import {
 } from "./chunk-2EBVTYJR.js";
 import {
   startCliHqConnection
-} from "./chunk-BLD5DSVA.js";
+} from "./chunk-KJS5543T.js";
+import {
+  CLI_VERSION
+} from "./chunk-F5DCFAKI.js";
 import {
   loadConfigProviders,
   mutateConfigProviders
 } from "./chunk-LUMETJFO.js";
+
+// src/webui-server-lifecycle.ts
+import { toErrorMessage } from "@wrongstack/core/utils/error";
+
+// src/webui-server/connection-handler.ts
+import { deriveSessionAgents } from "@wrongstack/core/storage";
+import { buildReplayPayload, decodeProtocolFrame } from "@wrongstack/webui-protocol";
 import {
-  CLI_VERSION
-} from "./chunk-YBUCXXYZ.js";
+  createConnectionLifecycle,
+  verifyClient as verifyWsClient
+} from "@wrongstack/webui-server";
+function createConnectionHandler(deps) {
+  const clientHandlers = [
+    deps.goalHandler,
+    deps.specsHandler,
+    deps.sddBoardHandler,
+    ...deps.sddWizardHandler ? [deps.sddWizardHandler] : [],
+    deps.worktreeHandler,
+    deps.terminalHandler
+  ];
+  return createConnectionLifecycle({
+    clients: deps.clients,
+    pendingConfirms: deps.pendingConfirms,
+    // ── Auth trust model ────────────────────────────────────────────────
+    // Three layered defenses (see verifyClient in @wrongstack/webui-server/ws-auth):
+    //   1. DNS-rebinding guard (Host header must be loopback on loopback bind)
+    //   2. Shared-token auth via Cookie (ws_token) or URL query param (?token=)
+    //   3. Loopback bootstrap: when requireToken=false (default) AND the server
+    //      is bound to a loopback interface, browser clients bypass token auth
+    //      entirely — the Origin header being http://localhost is sufficient.
+    //
+    // COOKIE PERSISTENCE AFTER TOKEN ROTATION:
+    // The HttpOnly ws_token cookie, once set by /ws-auth, survives a process
+    // restart. On the next process the expectedToken is a fresh random value,
+    // so the old cookie alone would fail the token check. However, on a
+    // loopback bind with requireToken=false (default), the loopback-bootstrap
+    // path at layer 3 accepts the connection before the cookie is ever
+    // compared — the old cookie is harmless because no token is needed.
+    //
+    // This means a token rotation (e.g. the operator sets a new accessToken
+    // in config) does NOT invalidate already-distributed cookies for loopback
+    // clients. The mitigating factors:
+    //   - Loopback bind + requireToken=false already trusts any local process
+    //     that can reach 127.0.0.1 — a trivial perimeter.
+    //   - A LAN/0.0.0.0 bind with requireToken=true DOES enforce cookie
+    //     matching against the new expectedToken on every reconnect.
+    // If stronger isolation is needed, set requireToken=true or rebind the
+    // server to a non-loopback interface with token enforcement.
+    authenticate: (ws, req) => {
+      const allowed = verifyWsClient({
+        origin: req.headers.origin,
+        url: req.url ?? "/",
+        hostHeader: req.headers.host,
+        remoteAddress: req.socket.remoteAddress,
+        cookieHeader: req.headers.cookie,
+        wsHost: deps.host,
+        expectedToken: deps.wsToken,
+        requireToken: deps.requireToken,
+        allowedHostnames: deps.publicHostnames,
+        allowBrowserUrlToken: Boolean(deps.publicWsUrl)
+      });
+      if (!allowed) ws.close(4003, "Forbidden");
+      return allowed;
+    },
+    createClient: (ws) => ({ ws, sessionId: deps.currentSessionId() }),
+    // Enrich parse-failure / unknown-type logs with per-connection identity
+    // so operators can identify which client sent a malformed frame. The
+    // `connectionId`/`sessionId` fields are read from the `client` argument
+    // directly inside `logRejection`; the CLI's `ConnectedClient` only has
+    // `sessionId` (no per-socket `connId`), so the verbose payload carries
+    // `sessionId` only. Server-wide identity (`agentId`/`projectRoot`) isn't
+    // in scope at this handler and is omitted.
+    verboseWsLogging: true,
+    registerClient: (ws) => {
+      for (const handler of clientHandlers) handler.addClient(ws);
+    },
+    decode: (raw) => decodeProtocolFrame(raw, "client"),
+    dispatch: deps.handleMessage,
+    send: deps.send,
+    sessionPayload: deps.sessionPayload,
+    rateLimitMax: deps.rateLimitMax,
+    // NOTE — a closed SOCKET is not a stopped run.
+    //
+    // This used to `abortControllers.delete(client.sessionId)` — a delete
+    // WITHOUT an abort, and only for the tab this connection last acted on.
+    // Both halves were wrong. The run kept going while `isRunActive` reported
+    // `false`, so `session.delete` would happily unlink the journal a live run
+    // was still appending to, and the next `user_message` claimed a second
+    // lock for the same session and hit `Agent.run() is already in progress`.
+    // The other three declared tabs were never touched at all.
+    //
+    // Doing nothing is the correct behaviour: a background run outlives the
+    // tab that started it (the same invariant `retireUndisplayedSessions`
+    // honours), and the run's own `finally` releases the lock when it unwinds.
+    // A page that comes back is told what is still running by
+    // `session.run_state`; a browser that never comes back drains its
+    // unanswerable permission prompts through the last-client drain in
+    // `connection-lifecycle.ts`, which lets a wedged run finish and release.
+    //
+    // So there is deliberately NO `onClose` here.
+    buildInitialPayload: async () => {
+      const payload = { ...await deps.buildSessionStartPayload({}, deps.needsSetup) };
+      try {
+        const open = deps.openSessionIds?.();
+        if (open) payload["openSessionIds"] = [.../* @__PURE__ */ new Set([...open, deps.currentSessionId()])];
+      } catch {
+        console.debug("[WebUI] Failed to list open sessions");
+      }
+      let replayEvents;
+      try {
+        const replay = await deps.loadReplay?.();
+        if (replay) {
+          Object.assign(payload, buildReplayPayload(replay));
+          replayEvents = replay.events;
+        }
+      } catch {
+        console.debug("[WebUI] Failed to load replay");
+      }
+      try {
+        const roster = deriveSessionAgents(replayEvents ?? []);
+        const sessions = roster.length > 0 ? await deps.loadAgentSessions?.(roster.map((agent) => agent.agentId)) : [];
+        if (sessions?.length) payload["agentSessions"] = sessions;
+      } catch {
+        console.debug("[WebUI] Failed to load agent sessions");
+      }
+      return payload;
+    }
+  });
+}
+
+// src/webui-server/lifecycle.ts
+import {
+  announceWebuiReady,
+  createWebuiShutdown,
+  registerWebuiInstance,
+  registerWebuiSignalHandlers
+} from "@wrongstack/webui-server";
+
+// src/webui-server/logger-shim.ts
+var structuredLine = (level, message) => JSON.stringify({
+  level,
+  event: "webui.goal",
+  message,
+  timestamp: (/* @__PURE__ */ new Date()).toISOString()
+});
+var consoleLogger = {
+  level: "debug",
+  error(msg, _ctx) {
+    console.error(structuredLine("error", msg));
+  },
+  warn(msg, _ctx) {
+    console.warn(structuredLine("warn", msg));
+  },
+  info(msg, _ctx) {
+    console.log(structuredLine("info", msg));
+  },
+  debug(msg, _ctx) {
+    console.debug(structuredLine("debug", msg));
+  },
+  trace(msg, _ctx) {
+    console.debug(structuredLine("trace", msg));
+  },
+  child(_bindings) {
+    return this;
+  }
+};
+
+// src/webui-server-lifecycle.ts
+function runWebuiServerLifecycle({
+  host,
+  httpPort,
+  setupEvents,
+  opts,
+  wsPort,
+  accessUrl,
+  wsToken,
+  webuiInstanceRegistered,
+  wss,
+  httpServer,
+  requireToken,
+  publicHostnames,
+  publicWsUrl,
+  clients,
+  currentSessionId,
+  goalHandler,
+  specsHandler,
+  sddBoardHandler,
+  sddWizardHandler,
+  worktreeHandler,
+  terminalHandler,
+  rateLimitMax,
+  send,
+  sessionPayload,
+  handleMessage,
+  pendingConfirms,
+  buildSessionStartPayload,
+  sessionAgents,
+  lifecycleState,
+  abortControllers,
+  flushAllStreamBuffers,
+  eventUnsubscribers,
+  releaseSessionSalvage,
+  autoWakeHost,
+  stopEmptySessionCleanup,
+  credentialWatcherClose,
+  kanbanRunMirror,
+  kanbanSupervisor,
+  stopKanbanSupervisorMemoryStats,
+  unregisterWebuiClient,
+  ipv6LoopbackServer,
+  registryBaseDir,
+  stopLiveStatusLogger,
+  terminalLogView
+}) {
+  const stopped = new Promise((resolve) => {
+    let listeningAnnounced = false;
+    const announceListening = () => {
+      if (listeningAnnounced) return;
+      listeningAnnounced = true;
+      console.log(`[WebUI] WebSocket server running on ws://${host}:${httpPort}`);
+      try {
+        setupEvents();
+        opts.onListening?.({
+          httpPort,
+          wsPort,
+          host,
+          url: accessUrl,
+          authToken: wsToken,
+          webuiInstanceRegistered
+        });
+      } catch (err) {
+        consoleLogger.error("setup_events_failed", { message: toErrorMessage(err) });
+      }
+    };
+    wss.on("listening", announceListening);
+    if (httpServer?.server.listening || wss.address()) queueMicrotask(announceListening);
+    wss.on(
+      "connection",
+      createConnectionHandler({
+        host,
+        wsToken,
+        requireToken,
+        publicHostnames,
+        publicWsUrl,
+        clients,
+        currentSessionId,
+        goalHandler,
+        specsHandler,
+        sddBoardHandler,
+        sddWizardHandler,
+        worktreeHandler,
+        terminalHandler,
+        rateLimitMax,
+        send,
+        sessionPayload,
+        handleMessage,
+        pendingConfirms,
+        buildSessionStartPayload,
+        loadReplay: async () => {
+          const activeSession = opts.agent.ctx.session ?? opts.session;
+          await activeSession.flush();
+          if (opts.sessionStore) {
+            const data = await opts.sessionStore.load(activeSession.id);
+            return { messages: data.messages, events: data.events, usage: data.usage };
+          }
+          const usage = opts.agent.ctx.tokenCounter.total();
+          return { messages: opts.agent.ctx.messages, usage };
+        },
+        loadAgentSessions: async (subagentIds) => await opts.agentTranscripts?.loadSessionsFromDisk(subagentIds) ?? [],
+        // What this process is actually holding right now. The browser
+        // reconciles its persisted tab strip against it, so a restarted server
+        // is not dressed in the previous run's tabs.
+        openSessionIds: () => sessionAgents.ids(),
+        needsSetup: opts.needsSetup ?? false
+      })
+    );
+    lifecycleState.signalShutdown = createWebuiShutdown({
+      abortInFlight: () => {
+        void lifecycleState.embeddedAutoHealDispose?.();
+        for (const c of abortControllers.values()) c.abort();
+        abortControllers.clear();
+      },
+      unsubscribeEvents: () => {
+        flushAllStreamBuffers();
+        for (const unsub of eventUnsubscribers) unsub();
+      },
+      stopOwnedChildren: async () => {
+        try {
+          const { getProcessRegistry } = await import("@wrongstack/tools");
+          getProcessRegistry().killAll({ force: true, includeProtected: true });
+        } catch (err) {
+          console.debug(
+            `[webui-server] process-registry killAll failed: ${err instanceof Error ? err.message : String(err)}`
+          );
+        }
+        if (opts.mcpRegistry) {
+          try {
+            await opts.mcpRegistry.stopAll();
+          } catch (err) {
+            console.debug(
+              `[webui-server] mcpRegistry.stopAll failed: ${err instanceof Error ? err.message : String(err)}`
+            );
+          }
+        }
+      },
+      disposeResources: async () => {
+        releaseSessionSalvage();
+        autoWakeHost?.dispose();
+        await stopEmptySessionCleanup?.dispose();
+        await sessionAgents.closeAll().catch(() => void 0);
+        credentialWatcherClose?.();
+        credentialWatcherClose = void 0;
+        goalHandler.dispose();
+        sddBoardHandler.dispose();
+        worktreeHandler.dispose();
+        terminalHandler.dispose();
+        kanbanRunMirror?.dispose();
+        kanbanSupervisor?.dispose();
+        void stopKanbanSupervisorMemoryStats?.();
+        await lifecycleState.embeddedAutoHealDispose?.();
+        lifecycleState.embeddedAutoHealDispose = null;
+        unregisterWebuiClient();
+      },
+      closeClients: () => {
+        for (const [ws] of clients) ws.close();
+        clients.clear();
+      },
+      closeHttpServer: () => {
+        ipv6LoopbackServer?.close();
+        httpServer?.server.close();
+      },
+      wss,
+      pid: process.pid,
+      registryBaseDir,
+      onStopped: () => {
+        stopLiveStatusLogger();
+        const muted = terminalLogView.mutedCount;
+        terminalLogView.stop();
+        if (muted > 0) {
+          console.log(
+            `[WebUI] ${muted} progress line(s) kept out of this terminal \u2014 set WEBUI_LOGS=1 to stream them.`
+          );
+        }
+        opts.onExit?.();
+        resolve();
+      }
+    });
+    registerWebuiSignalHandlers(lifecycleState.signalShutdown);
+  });
+  return { stopped };
+}
 
 // src/webui-server.ts
 import * as path7 from "node:path";
@@ -31,7 +382,6 @@ import {
   startSharedHeapWatchdog,
   wstackGlobalRoot
 } from "@wrongstack/core/utils";
-import { toErrorMessage as toErrorMessage2 } from "@wrongstack/core/utils/error";
 import {
   buildWebUIAccessUrl,
   clientWantsSession,
@@ -51,7 +401,8 @@ import {
   sendSerialized,
   stampDispatchSession,
   startTerminalDashboard,
-  toSessionHistoryEntries
+  toSessionHistoryEntries,
+  webuiSessionFrameLog
 } from "@wrongstack/webui-server";
 import { verifyClient as verifyWsClient2 } from "@wrongstack/webui-server/server/ws-auth";
 import { WebSocketServer } from "ws";
@@ -136,182 +487,56 @@ function createEmbeddedClientRegistration(opts, clients, abortControllers, getSe
     getSessionWriter: (sessionId) => getSessionAgents()?.peek(sessionId)?.ctx.session,
     hqControl: {
       // HQ speaks for the LEADER — the boot session, the one it registered
-      // itself under (`hqSessionId`) — not for whatever else the browser
-      // has open. This used to abort every controller in the map and clear
-      // it, so a remote "interrupt" issued against the leader also killed
-      // the three other tabs' in-flight runs. Deleting the entries was
-      // wrong on its own terms too: the run's own `end()` owns removal, and
-      // clearing early makes `isRunActive` lie to every tab still running.
-      // Every open tab is its own session with its own abort controller, so
-      // the command's session is the one that gets stopped. Falling back to
-      // the boot session keeps a dashboard that sends no session — every one
-      // before this existed — behaving exactly as before.
-      interruptLeader: (sessionId) => {
-        const leaderId = sessionId ?? opts.session.id;
-        const controller = abortControllers.get(leaderId);
-        if (!controller) return false;
-        controller.abort();
-        try {
-          void Promise.resolve(opts.stopSessionFleet?.(leaderId)).catch(() => void 0);
-        } catch {
-        }
-        return true;
-      },
-      allowRunCommand: () => opts.hqAllowExec === true,
-      // A command naming a tab this process no longer holds is refused, not
-      // redirected onto the boot session: the operator picked a terminal,
-      // and steering a different one is worse than not steering at all.
-      ownsSession: (sessionId) => sessionId === opts.session.id || getSessionAgents()?.has(sessionId) === true
-    }
-  });
-}
-function startEmbeddedLiveStatusLogger(opts, clients, abortControllers, getSessionAgents, terminalLogView) {
-  return startWebUILiveStatusLogger({
-    events: opts.events,
-    dashboard: terminalLogView,
-    getSessionList: () => {
-      const ids = /* @__PURE__ */ new Set();
-      for (const client of clients.values()) {
-        if (client.sessionId) ids.add(client.sessionId);
-        for (const id of client.sessionIds ?? []) ids.add(id);
-      }
-      const currentId = opts.agent.ctx.session?.id ?? opts.session.id;
-      if (ids.size === 0 && currentId) ids.add(currentId);
-      return Array.from(ids).map((id) => {
-        const ctx = getSessionAgents()?.peek(id)?.ctx;
-        return {
-          id,
-          model: ctx?.model ?? opts.agent.ctx.model ?? "",
-          provider: ctx?.provider?.id ?? opts.agent.ctx.provider?.id ?? "",
-          isRunning: abortControllers.has(id)
-        };
-      });
-    }
-  });
-}
-
-// src/webui-server/connection-handler.ts
-import { deriveSessionAgents } from "@wrongstack/core/storage";
-import { buildReplayPayload, decodeProtocolFrame } from "@wrongstack/webui-protocol";
-import {
-  createConnectionLifecycle,
-  verifyClient as verifyWsClient
-} from "@wrongstack/webui-server";
-function createConnectionHandler(deps) {
-  const clientHandlers = [
-    deps.goalHandler,
-    deps.specsHandler,
-    deps.sddBoardHandler,
-    ...deps.sddWizardHandler ? [deps.sddWizardHandler] : [],
-    deps.worktreeHandler,
-    deps.terminalHandler
-  ];
-  return createConnectionLifecycle({
-    clients: deps.clients,
-    pendingConfirms: deps.pendingConfirms,
-    // ── Auth trust model ────────────────────────────────────────────────
-    // Three layered defenses (see verifyClient in @wrongstack/webui-server/ws-auth):
-    //   1. DNS-rebinding guard (Host header must be loopback on loopback bind)
-    //   2. Shared-token auth via Cookie (ws_token) or URL query param (?token=)
-    //   3. Loopback bootstrap: when requireToken=false (default) AND the server
-    //      is bound to a loopback interface, browser clients bypass token auth
-    //      entirely — the Origin header being http://localhost is sufficient.
-    //
-    // COOKIE PERSISTENCE AFTER TOKEN ROTATION:
-    // The HttpOnly ws_token cookie, once set by /ws-auth, survives a process
-    // restart. On the next process the expectedToken is a fresh random value,
-    // so the old cookie alone would fail the token check. However, on a
-    // loopback bind with requireToken=false (default), the loopback-bootstrap
-    // path at layer 3 accepts the connection before the cookie is ever
-    // compared — the old cookie is harmless because no token is needed.
-    //
-    // This means a token rotation (e.g. the operator sets a new accessToken
-    // in config) does NOT invalidate already-distributed cookies for loopback
-    // clients. The mitigating factors:
-    //   - Loopback bind + requireToken=false already trusts any local process
-    //     that can reach 127.0.0.1 — a trivial perimeter.
-    //   - A LAN/0.0.0.0 bind with requireToken=true DOES enforce cookie
-    //     matching against the new expectedToken on every reconnect.
-    // If stronger isolation is needed, set requireToken=true or rebind the
-    // server to a non-loopback interface with token enforcement.
-    authenticate: (ws, req) => {
-      const allowed = verifyWsClient({
-        origin: req.headers.origin,
-        url: req.url ?? "/",
-        hostHeader: req.headers.host,
-        remoteAddress: req.socket.remoteAddress,
-        cookieHeader: req.headers.cookie,
-        wsHost: deps.host,
-        expectedToken: deps.wsToken,
-        requireToken: deps.requireToken,
-        allowedHostnames: deps.publicHostnames,
-        allowBrowserUrlToken: Boolean(deps.publicWsUrl)
-      });
-      if (!allowed) ws.close(4003, "Forbidden");
-      return allowed;
-    },
-    createClient: (ws) => ({ ws, sessionId: deps.currentSessionId() }),
-    // Enrich parse-failure / unknown-type logs with per-connection identity
-    // so operators can identify which client sent a malformed frame. The
-    // `connectionId`/`sessionId` fields are read from the `client` argument
-    // directly inside `logRejection`; the CLI's `ConnectedClient` only has
-    // `sessionId` (no per-socket `connId`), so the verbose payload carries
-    // `sessionId` only. Server-wide identity (`agentId`/`projectRoot`) isn't
-    // in scope at this handler and is omitted.
-    verboseWsLogging: true,
-    registerClient: (ws) => {
-      for (const handler of clientHandlers) handler.addClient(ws);
-    },
-    decode: (raw) => decodeProtocolFrame(raw, "client"),
-    dispatch: deps.handleMessage,
-    send: deps.send,
-    sessionPayload: deps.sessionPayload,
-    rateLimitMax: deps.rateLimitMax,
-    // NOTE — a closed SOCKET is not a stopped run.
-    //
-    // This used to `abortControllers.delete(client.sessionId)` — a delete
-    // WITHOUT an abort, and only for the tab this connection last acted on.
-    // Both halves were wrong. The run kept going while `isRunActive` reported
-    // `false`, so `session.delete` would happily unlink the journal a live run
-    // was still appending to, and the next `user_message` claimed a second
-    // lock for the same session and hit `Agent.run() is already in progress`.
-    // The other three declared tabs were never touched at all.
-    //
-    // Doing nothing is the correct behaviour: a background run outlives the
-    // tab that started it (the same invariant `retireUndisplayedSessions`
-    // honours), and the run's own `finally` releases the lock when it unwinds.
-    // A page that comes back is told what is still running by
-    // `session.run_state`; a browser that never comes back drains its
-    // unanswerable permission prompts through the last-client drain in
-    // `connection-lifecycle.ts`, which lets a wedged run finish and release.
-    //
-    // So there is deliberately NO `onClose` here.
-    buildInitialPayload: async () => {
-      const payload = { ...await deps.buildSessionStartPayload({}, deps.needsSetup) };
-      try {
-        const open = deps.openSessionIds?.();
-        if (open) payload["openSessionIds"] = [.../* @__PURE__ */ new Set([...open, deps.currentSessionId()])];
-      } catch {
-        console.debug("[WebUI] Failed to list open sessions");
-      }
-      let replayEvents;
-      try {
-        const replay = await deps.loadReplay?.();
-        if (replay) {
-          Object.assign(payload, buildReplayPayload(replay));
-          replayEvents = replay.events;
+      // itself under (`hqSessionId`) — not for whatever else the browser
+      // has open. This used to abort every controller in the map and clear
+      // it, so a remote "interrupt" issued against the leader also killed
+      // the three other tabs' in-flight runs. Deleting the entries was
+      // wrong on its own terms too: the run's own `end()` owns removal, and
+      // clearing early makes `isRunActive` lie to every tab still running.
+      // Every open tab is its own session with its own abort controller, so
+      // the command's session is the one that gets stopped. Falling back to
+      // the boot session keeps a dashboard that sends no session — every one
+      // before this existed — behaving exactly as before.
+      interruptLeader: (sessionId) => {
+        const leaderId = sessionId ?? opts.session.id;
+        const controller = abortControllers.get(leaderId);
+        if (!controller) return false;
+        controller.abort();
+        try {
+          void Promise.resolve(opts.stopSessionFleet?.(leaderId)).catch(() => void 0);
+        } catch {
         }
-      } catch {
-        console.debug("[WebUI] Failed to load replay");
-      }
-      try {
-        const roster = deriveSessionAgents(replayEvents ?? []);
-        const sessions = roster.length > 0 ? await deps.loadAgentSessions?.(roster.map((agent) => agent.agentId)) : [];
-        if (sessions?.length) payload["agentSessions"] = sessions;
-      } catch {
-        console.debug("[WebUI] Failed to load agent sessions");
+        return true;
+      },
+      allowRunCommand: () => opts.hqAllowExec === true,
+      // A command naming a tab this process no longer holds is refused, not
+      // redirected onto the boot session: the operator picked a terminal,
+      // and steering a different one is worse than not steering at all.
+      ownsSession: (sessionId) => sessionId === opts.session.id || getSessionAgents()?.has(sessionId) === true
+    }
+  });
+}
+function startEmbeddedLiveStatusLogger(opts, clients, abortControllers, getSessionAgents, terminalLogView) {
+  return startWebUILiveStatusLogger({
+    events: opts.events,
+    dashboard: terminalLogView,
+    getSessionList: () => {
+      const ids = /* @__PURE__ */ new Set();
+      for (const client of clients.values()) {
+        if (client.sessionId) ids.add(client.sessionId);
+        for (const id of client.sessionIds ?? []) ids.add(id);
       }
-      return payload;
+      const currentId = opts.agent.ctx.session?.id ?? opts.session.id;
+      if (ids.size === 0 && currentId) ids.add(currentId);
+      return Array.from(ids).map((id) => {
+        const ctx = getSessionAgents()?.peek(id)?.ctx;
+        return {
+          id,
+          model: ctx?.model ?? opts.agent.ctx.model ?? "",
+          provider: ctx?.provider?.id ?? opts.agent.ctx.provider?.id ?? "",
+          isRunning: abortControllers.has(id)
+        };
+      });
     }
   });
 }
@@ -319,7 +544,7 @@ function createConnectionHandler(deps) {
 // src/webui-server/credential-watcher.ts
 import { TOKENS } from "@wrongstack/core/kernel";
 import { watchProviderConfig } from "@wrongstack/core/storage";
-import { toErrorMessage } from "@wrongstack/core/utils/error";
+import { toErrorMessage as toErrorMessage2 } from "@wrongstack/core/utils/error";
 import { makeProviderFromConfig } from "@wrongstack/providers";
 
 // src/webui-server/provider-config.ts
@@ -474,7 +699,7 @@ function startWebuiCredentialWatcher({
         console.log(`[WebUI] Provider credentials reloaded from config.json (${activeId})`);
       } catch (err) {
         console.warn(
-          `[WebUI] Credential hot-reload failed for ${activeId}: ${toErrorMessage(err)}`
+          `[WebUI] Credential hot-reload failed for ${activeId}: ${toErrorMessage2(err)}`
         );
       }
     },
@@ -506,35 +731,6 @@ import {
   WorktreeWebSocketHandler
 } from "@wrongstack/webui-server";
 
-// src/webui-server/logger-shim.ts
-var structuredLine = (level, message) => JSON.stringify({
-  level,
-  event: "webui.goal",
-  message,
-  timestamp: (/* @__PURE__ */ new Date()).toISOString()
-});
-var consoleLogger = {
-  level: "debug",
-  error(msg, _ctx) {
-    console.error(structuredLine("error", msg));
-  },
-  warn(msg, _ctx) {
-    console.warn(structuredLine("warn", msg));
-  },
-  info(msg, _ctx) {
-    console.log(structuredLine("info", msg));
-  },
-  debug(msg, _ctx) {
-    console.debug(structuredLine("debug", msg));
-  },
-  trace(msg, _ctx) {
-    console.debug(structuredLine("trace", msg));
-  },
-  child(_bindings) {
-    return this;
-  }
-};
-
 // src/webui-server/node-pty-loader.ts
 import { existsSync } from "node:fs";
 import { createRequire } from "node:module";
@@ -602,7 +798,7 @@ function createNodePtyLoader(importMetaUrl, logger) {
 
 // src/webui-server/domain-handlers.ts
 function createWebuiDomainHandlers(opts, trustBoundary, kanbanRunMirror) {
-  const goalStoreDir = opts.projectRoot ? path3.join(opts.projectRoot, ".wrongstack", "goal") : path3.join(os.tmpdir(), ".wrongstack", "goal");
+  const goalStoreDir = opts.projectRoot ? resolveWstackPaths({ projectRoot: opts.projectRoot }).projectAutophase : path3.join(os.tmpdir(), ".wrongstack", "goal");
   const goalHandler = new GoalWebSocketHandler(
     opts.agent,
     opts.agent.ctx,
@@ -610,7 +806,8 @@ function createWebuiDomainHandlers(opts, trustBoundary, kanbanRunMirror) {
     goalStoreDir,
     opts.events,
     opts.projectRoot,
-    kanbanRunMirror ? (graphId, state) => kanbanRunMirror.onGoalState(graphId, state) : void 0
+    kanbanRunMirror ? (graphId, state) => kanbanRunMirror.onGoalState(graphId, state) : void 0,
+    opts.sddSubagentFactory
   );
   const worktreeHandler = new WorktreeWebSocketHandler(opts.events, consoleLogger);
   const loadNodePtyViaWebui = createNodePtyLoader(import.meta.url, consoleLogger);
@@ -837,14 +1034,6 @@ function createCliKanbanHostRoutes(deps) {
   };
 }
 
-// src/webui-server/lifecycle.ts
-import {
-  announceWebuiReady,
-  createWebuiShutdown,
-  registerWebuiInstance,
-  registerWebuiSignalHandlers
-} from "@wrongstack/webui-server";
-
 // src/webui-server/listen-helpers.ts
 import * as http from "node:http";
 import { listenWithRetry } from "@wrongstack/webui-server";
@@ -1008,6 +1197,7 @@ import {
 import { TOKENS as TOKENS2 } from "@wrongstack/core/kernel";
 import { SkillInstaller } from "@wrongstack/core/skills";
 import { PromptUsageStore } from "@wrongstack/core/storage";
+import { resolveTokenSavingTier } from "@wrongstack/core/types";
 import { resolveWstackPaths as resolveWstackPaths3 } from "@wrongstack/core/utils";
 import {
   createChimeraRouteHandlers,
@@ -1142,6 +1332,16 @@ function createWebuiRouteContexts({
     pendingConfirms,
     configStore: opts.agent.container?.safeResolve?.(TOKENS2.ConfigStore),
     systemPrompt: {
+      previewContext: (sessionId) => {
+        const target = sessionId ? getSessionAgent(sessionId).ctx : opts.agent.ctx;
+        return {
+          toolNames: target.tools.map((tool) => tool.name),
+          tier: resolveTokenSavingTier(
+            opts.appConfig?.features?.tokenSavingMode,
+            target.provider?.capabilities?.maxContext
+          )
+        };
+      },
       paths: () => {
         const wpaths = resolveWstackPaths3({ projectRoot: promptProjectRoot(), globalRoot });
         return {
@@ -1291,6 +1491,7 @@ function createWebuiRouteContexts({
 // src/webui-server/session-start-payload.ts
 import * as path6 from "node:path";
 import { DEFAULT_CONTEXT_WINDOW_MODE_ID } from "@wrongstack/core/types";
+import { catalogProviderIdFor } from "@wrongstack/providers";
 import { protocolAdvertisement } from "@wrongstack/webui-protocol";
 
 // src/webui-server/cost-helpers.ts
@@ -1312,7 +1513,11 @@ function createSessionStartPayloadBuilder(deps) {
     const updateInfo = deps.updateInfo;
     try {
       if (deps.modelsRegistry) {
-        const m = await deps.modelsRegistry.getModel(ctx.provider.id, ctx.model);
+        const catalogId = catalogProviderIdFor(
+          ctx.provider.id,
+          deps.appConfig?.providers?.[ctx.provider.id]?.type
+        );
+        const m = await deps.modelsRegistry.getModel(catalogId, ctx.model);
         const registryMax = m?.capabilities.maxContext;
         maxContext = registryMax ?? ctx.provider.capabilities?.maxContext ?? 0;
         const rates = getCostRates(m);
@@ -1562,6 +1767,9 @@ async function runWebUI(opts) {
     get session() {
       return opts.session;
     },
+    get appConfig() {
+      return opts.appConfig;
+    },
     // `peek`, never `get`: building a payload must not materialise an agent
     // for a session id that arrived from a stale browser tab.
     getSessionContext: (sessionId) => sessionAgentsRef?.peek(sessionId)?.ctx
@@ -1768,7 +1976,7 @@ async function runWebUI(opts) {
     log: (m) => console.log(m)
   };
   const embeddedProviderOperations = createEmbeddedProviderOperations(wsHandlerCtx);
-  let credentialWatcherClose = startWebuiCredentialWatcher({
+  const credentialWatcherClose = startWebuiCredentialWatcher({
     opts,
     profileConfigPath,
     broadcast,
@@ -1842,7 +2050,15 @@ async function runWebUI(opts) {
       void sessionAgents.endAndClose(sessionId);
     }
   };
-  const stopEmptySessionCleanup = opts.sessionStore ? scheduleOwnerlessEmptySessionCleanup({
+  const refreshSessionHistory = async () => {
+    const list = await opts.sessionStore?.list(200);
+    if (!list) return;
+    broadcastEveryone({
+      type: "sessions.list",
+      payload: { sessions: toSessionHistoryEntries(list, foregroundSession.id) }
+    });
+  };
+  const emptySessionCleanup = opts.sessionStore ? scheduleOwnerlessEmptySessionCleanup({
     getSessionStore: () => opts.sessionStore,
     getActiveSessionId: () => foregroundSession.id,
     getActiveSessionIds: () => collectDisplayedSessionIds({ getSession: () => foregroundSession, clients }),
@@ -1850,16 +2066,19 @@ async function runWebUI(opts) {
     // written its first record yet looks exactly like a session nobody
     // ever used.
     hasParticipants: (sessionId) => abortControllers.has(sessionId),
-    refreshSessions: async () => {
-      const list = await opts.sessionStore?.list(200);
-      if (!list) return;
-      broadcastEveryone({
-        type: "sessions.list",
-        payload: { sessions: toSessionHistoryEntries(list, foregroundSession.id) }
-      });
-    },
+    refreshSessions: refreshSessionHistory,
     logger: consoleLogger
   }) : null;
+  const offSessionRenamed = opts.sessionStore ? opts.events.on("session.renamed", () => {
+    void refreshSessionHistory().catch(() => void 0);
+  }) : void 0;
+  const stopEmptySessionCleanup = emptySessionCleanup && {
+    runNow: emptySessionCleanup.runNow,
+    dispose: async () => {
+      offSessionRenamed?.();
+      await emptySessionCleanup.dispose();
+    }
+  };
   const routeContexts = createWebuiRouteContexts({
     opts,
     profileConfigPath,
@@ -1936,148 +2155,72 @@ async function runWebUI(opts) {
     kanbanHostRoutes,
     statusTracker: opts.statusTracker
   });
-  const stopped = new Promise((resolve) => {
-    let listeningAnnounced = false;
-    const announceListening = () => {
-      if (listeningAnnounced) return;
-      listeningAnnounced = true;
-      console.log(`[WebUI] WebSocket server running on ws://${host}:${httpPort}`);
-      try {
-        setupEvents();
-        opts.onListening?.({
-          httpPort,
-          wsPort,
-          host,
-          url: accessUrl,
-          authToken: wsToken,
-          webuiInstanceRegistered
-        });
-      } catch (err) {
-        consoleLogger.error("setup_events_failed", { message: toErrorMessage2(err) });
-      }
-    };
-    wss.on("listening", announceListening);
-    if (httpServer?.server.listening || wss.address()) queueMicrotask(announceListening);
-    wss.on(
-      "connection",
-      createConnectionHandler({
-        host,
-        wsToken,
-        requireToken,
-        publicHostnames,
-        publicWsUrl,
-        clients,
-        currentSessionId,
-        goalHandler,
-        specsHandler,
-        sddBoardHandler,
-        sddWizardHandler,
-        worktreeHandler,
-        terminalHandler,
-        rateLimitMax,
-        send,
-        sessionPayload,
-        handleMessage,
-        pendingConfirms,
-        buildSessionStartPayload,
-        loadReplay: async () => {
-          const activeSession = opts.agent.ctx.session ?? opts.session;
-          await activeSession.flush();
-          if (opts.sessionStore) {
-            const data = await opts.sessionStore.load(activeSession.id);
-            return { messages: data.messages, events: data.events, usage: data.usage };
-          }
-          const usage = opts.agent.ctx.tokenCounter.total();
-          return { messages: opts.agent.ctx.messages, usage };
-        },
-        loadAgentSessions: async (subagentIds) => await opts.agentTranscripts?.loadSessionsFromDisk(subagentIds) ?? [],
-        // What this process is actually holding right now. The browser
-        // reconciles its persisted tab strip against it, so a restarted server
-        // is not dressed in the previous run's tabs.
-        openSessionIds: () => sessionAgents.ids(),
-        needsSetup: opts.needsSetup ?? false
-      })
-    );
-    signalShutdown = createWebuiShutdown({
-      abortInFlight: () => {
-        void embeddedAutoHealDispose?.();
-        for (const c of abortControllers.values()) c.abort();
-        abortControllers.clear();
-      },
-      unsubscribeEvents: () => {
-        flushAllStreamBuffers();
-        for (const unsub of eventUnsubscribers) unsub();
-      },
-      stopOwnedChildren: async () => {
-        try {
-          const { getProcessRegistry } = await import("@wrongstack/tools");
-          getProcessRegistry().killAll({ force: true, includeProtected: true });
-        } catch (err) {
-          console.debug(
-            `[webui-server] process-registry killAll failed: ${err instanceof Error ? err.message : String(err)}`
-          );
-        }
-        if (opts.mcpRegistry) {
-          try {
-            await opts.mcpRegistry.stopAll();
-          } catch (err) {
-            console.debug(
-              `[webui-server] mcpRegistry.stopAll failed: ${err instanceof Error ? err.message : String(err)}`
-            );
-          }
-        }
-      },
-      disposeResources: async () => {
-        releaseSessionSalvage();
-        autoWakeHost?.dispose();
-        await stopEmptySessionCleanup?.dispose();
-        await sessionAgents.closeAll().catch(() => void 0);
-        credentialWatcherClose?.();
-        credentialWatcherClose = void 0;
-        goalHandler.dispose();
-        sddBoardHandler.dispose();
-        worktreeHandler.dispose();
-        terminalHandler.dispose();
-        kanbanRunMirror?.dispose();
-        kanbanSupervisor?.dispose();
-        void stopKanbanSupervisorMemoryStats?.();
-        await embeddedAutoHealDispose?.();
-        embeddedAutoHealDispose = null;
-        unregisterWebuiClient();
+  const { stopped } = runWebuiServerLifecycle({
+    host,
+    httpPort,
+    setupEvents,
+    opts,
+    wsPort,
+    accessUrl,
+    wsToken,
+    webuiInstanceRegistered,
+    wss,
+    httpServer,
+    requireToken,
+    publicHostnames,
+    publicWsUrl,
+    clients,
+    currentSessionId,
+    goalHandler,
+    specsHandler,
+    sddBoardHandler,
+    sddWizardHandler,
+    worktreeHandler,
+    terminalHandler,
+    rateLimitMax,
+    send,
+    sessionPayload,
+    handleMessage,
+    pendingConfirms,
+    buildSessionStartPayload,
+    sessionAgents,
+    lifecycleState: {
+      get signalShutdown() {
+        return signalShutdown;
       },
-      closeClients: () => {
-        for (const [ws] of clients) ws.close();
-        clients.clear();
+      set signalShutdown(value) {
+        signalShutdown = value;
       },
-      closeHttpServer: () => {
-        ipv6LoopbackServer?.close();
-        httpServer?.server.close();
+      get embeddedAutoHealDispose() {
+        return embeddedAutoHealDispose;
       },
-      wss,
-      pid: process.pid,
-      registryBaseDir,
-      onStopped: () => {
-        stopLiveStatusLogger();
-        const muted = terminalLogView.mutedCount;
-        terminalLogView.stop();
-        if (muted > 0) {
-          console.log(
-            `[WebUI] ${muted} progress line(s) kept out of this terminal \u2014 set WEBUI_LOGS=1 to stream them.`
-          );
-        }
-        opts.onExit?.();
-        resolve();
+      set embeddedAutoHealDispose(value) {
+        embeddedAutoHealDispose = value;
       }
-    });
-    registerWebuiSignalHandlers(signalShutdown);
+    },
+    abortControllers,
+    flushAllStreamBuffers,
+    eventUnsubscribers,
+    releaseSessionSalvage,
+    autoWakeHost,
+    stopEmptySessionCleanup,
+    credentialWatcherClose,
+    kanbanRunMirror,
+    kanbanSupervisor,
+    stopKanbanSupervisorMemoryStats,
+    unregisterWebuiClient,
+    ipv6LoopbackServer,
+    registryBaseDir,
+    stopLiveStatusLogger,
+    terminalLogView
   });
   function send(ws, msg) {
     sendSerialized(ws, JSON.stringify(stampDispatchSession(msg)));
   }
   function broadcast(msg, targetSessionId) {
-    const data = JSON.stringify(msg);
     const payload = msg.payload;
     const sessionId = targetSessionId ?? (payload && typeof payload === "object" && typeof payload.sessionId === "string" ? payload.sessionId : void 0);
+    const data = sessionId ? webuiSessionFrameLog().sequence(sessionId, msg) : JSON.stringify(msg);
     for (const [ws, client] of clients) {
       if (clientWantsSession(client, sessionId)) sendSerialized(ws, data);
     }
@@ -2094,4 +2237,4 @@ async function runWebUI(opts) {
 export {
   runWebUI
 };
-//# sourceMappingURL=webui-server-L2SICPTB.js.map
+//# sourceMappingURL=webui-server-YTHLRFD2.js.map