@wrongstack/cli 1.0.33 → 1.0.35

package/dist/{webui-server-GQOVLQS3.js → webui-server-6IC3SLZG.js}

@@ -1,12 +1,12 @@
-import {
-  WEBUI_SESSION_CHILD_CAPABILITIES
-} from "./chunk-P3Q3KMFH.js";
 import {
   createKanbanRunMirror
 } from "./chunk-VCYZ3WZV.js";
 import {
   createKanbanSupervisor
 } from "./chunk-R4QGL6GB.js";
+import {
+  WEBUI_SESSION_CHILD_CAPABILITIES
+} from "./chunk-P3Q3KMFH.js";
 import {
   loadConfigProviders,
   mutateConfigProviders
@@ -23,821 +23,273 @@ import {
   CLI_VERSION
 } from "./chunk-F5DCFAKI.js";
 
-// src/webui-server-lifecycle.ts
-import { toErrorMessage } from "@wrongstack/core/utils/error";
-
-// src/webui-server/connection-handler.ts
-import { deriveSessionAgents } from "@wrongstack/core/storage";
-import { buildReplayPayload, decodeProtocolFrame } from "@wrongstack/webui-protocol";
+// src/webui-server.ts
+import * as path8 from "node:path";
+import { createCompatibilityTrustBoundary, DefaultSecretScrubber } from "@wrongstack/core/security";
+import { addFatalSalvageHook } from "@wrongstack/core/utils";
 import {
-  createConnectionLifecycle,
-  verifyClient as verifyWsClient
+  buildWebUIAccessUrl,
+  createCustomModeStore,
+  createWebuiLeaderAutoWakeHost,
+  envFlag as envFlag2,
+  findFreePort,
+  resolveAuthToken,
+  startTerminalDashboard
 } from "@wrongstack/webui-server";
-function createConnectionHandler(deps) {
-  const clientHandlers = [
-    deps.goalHandler,
-    deps.specsHandler,
-    deps.sddBoardHandler,
-    ...deps.sddWizardHandler ? [deps.sddWizardHandler] : [],
-    deps.worktreeHandler,
-    deps.terminalHandler
-  ];
-  return createConnectionLifecycle({
-    clients: deps.clients,
-    pendingConfirms: deps.pendingConfirms,
-    // ── Auth trust model ────────────────────────────────────────────────
-    // Three layered defenses (see verifyClient in @wrongstack/webui-server/ws-auth):
-    //   1. DNS-rebinding guard (Host header must be loopback on loopback bind)
-    //   2. Shared-token auth via Cookie (ws_token) or URL query param (?token=)
-    //   3. Loopback bootstrap: when requireToken=false (default) AND the server
-    //      is bound to a loopback interface, browser clients bypass token auth
-    //      entirely — the Origin header being http://localhost is sufficient.
-    //
-    // COOKIE PERSISTENCE AFTER TOKEN ROTATION:
-    // The HttpOnly ws_token cookie, once set by /ws-auth, survives a process
-    // restart. On the next process the expectedToken is a fresh random value,
-    // so the old cookie alone would fail the token check. However, on a
-    // loopback bind with requireToken=false (default), the loopback-bootstrap
-    // path at layer 3 accepts the connection before the cookie is ever
-    // compared — the old cookie is harmless because no token is needed.
-    //
-    // This means a token rotation (e.g. the operator sets a new accessToken
-    // in config) does NOT invalidate already-distributed cookies for loopback
-    // clients. The mitigating factors:
-    //   - Loopback bind + requireToken=false already trusts any local process
-    //     that can reach 127.0.0.1 — a trivial perimeter.
-    //   - A LAN/0.0.0.0 bind with requireToken=true DOES enforce cookie
-    //     matching against the new expectedToken on every reconnect.
-    // If stronger isolation is needed, set requireToken=true or rebind the
-    // server to a non-loopback interface with token enforcement.
-    authenticate: (ws, req) => {
-      const allowed = verifyWsClient({
-        origin: req.headers.origin,
-        url: req.url ?? "/",
-        hostHeader: req.headers.host,
-        remoteAddress: req.socket.remoteAddress,
-        cookieHeader: req.headers.cookie,
-        wsHost: deps.host,
-        expectedToken: deps.wsToken,
-        requireToken: deps.requireToken,
-        allowedHostnames: deps.publicHostnames,
-        allowBrowserUrlToken: Boolean(deps.publicWsUrl)
-      });
-      if (!allowed) ws.close(4003, "Forbidden");
-      return allowed;
-    },
-    createClient: (ws) => ({ ws, sessionId: deps.currentSessionId() }),
-    // Enrich parse-failure / unknown-type logs with per-connection identity
-    // so operators can identify which client sent a malformed frame. The
-    // `connectionId`/`sessionId` fields are read from the `client` argument
-    // directly inside `logRejection`; the CLI's `ConnectedClient` only has
-    // `sessionId` (no per-socket `connId`), so the verbose payload carries
-    // `sessionId` only. Server-wide identity (`agentId`/`projectRoot`) isn't
-    // in scope at this handler and is omitted.
-    verboseWsLogging: true,
-    registerClient: (ws) => {
-      for (const handler of clientHandlers) handler.addClient(ws);
-    },
-    decode: (raw) => decodeProtocolFrame(raw, "client"),
-    dispatch: deps.handleMessage,
-    send: deps.send,
-    sessionPayload: deps.sessionPayload,
-    rateLimitMax: deps.rateLimitMax,
-    // NOTE — a closed SOCKET is not a stopped run.
-    //
-    // This used to `abortControllers.delete(client.sessionId)` — a delete
-    // WITHOUT an abort, and only for the tab this connection last acted on.
-    // Both halves were wrong. The run kept going while `isRunActive` reported
-    // `false`, so `session.delete` would happily unlink the journal a live run
-    // was still appending to, and the next `user_message` claimed a second
-    // lock for the same session and hit `Agent.run() is already in progress`.
-    // The other three declared tabs were never touched at all.
-    //
-    // Doing nothing is the correct behaviour: a background run outlives the
-    // tab that started it (the same invariant `retireUndisplayedSessions`
-    // honours), and the run's own `finally` releases the lock when it unwinds.
-    // A page that comes back is told what is still running by
-    // `session.run_state`; a browser that never comes back drains its
-    // unanswerable permission prompts through the last-client drain in
-    // `connection-lifecycle.ts`, which lets a wedged run finish and release.
-    //
-    // So there is deliberately NO `onClose` here.
-    buildInitialPayload: async () => {
-      const payload = { ...await deps.buildSessionStartPayload({}, deps.needsSetup) };
-      try {
-        const open = deps.openSessionIds?.();
-        if (open) payload["openSessionIds"] = [.../* @__PURE__ */ new Set([...open, deps.currentSessionId()])];
-      } catch {
-        console.debug("[WebUI] Failed to list open sessions");
-      }
-      let replayEvents;
-      try {
-        const replay = await deps.loadReplay?.();
-        if (replay) {
-          Object.assign(payload, buildReplayPayload(replay));
-          replayEvents = replay.events;
-        }
-      } catch {
-        console.debug("[WebUI] Failed to load replay");
-      }
-      try {
-        const roster = deriveSessionAgents(replayEvents ?? []);
-        const sessions = roster.length > 0 ? await deps.loadAgentSessions?.(roster.map((agent) => agent.agentId)) : [];
-        if (sessions?.length) payload["agentSessions"] = sessions;
-      } catch {
-        console.debug("[WebUI] Failed to load agent sessions");
-      }
-      return payload;
-    }
+
+// src/webui-client-observability.ts
+import { startWebUILiveStatusLogger } from "@wrongstack/webui-server";
+
+// src/webui-server/client-registration.ts
+import { mailboxSessionTag } from "@wrongstack/core/coordination";
+import { createWebuiClientPresence } from "@wrongstack/webui-server";
+function createWebuiClientRegistration(deps) {
+  const control = deps.hqControl;
+  return createWebuiClientPresence({
+    projectRoot: deps.projectRoot,
+    appConfig: deps.appConfig,
+    events: deps.events,
+    hqSessionId: deps.hqSessionId,
+    getSessionId: deps.getSessionId,
+    clientVersion: CLI_VERSION,
+    ...deps.listSessions ? { listSessions: deps.listSessions } : {},
+    ...deps.isSessionOwnedElsewhere ? { isSessionOwnedElsewhere: deps.isSessionOwnedElsewhere } : {},
+    ...deps.getSessionWriter ? { getSessionWriter: deps.getSessionWriter } : {},
+    startHqConnection: (options) => startCliHqConnection({
+      ...options,
+      capabilities: options.capabilities,
+      // Embedded in the CLI host, whose own HQ connection already syncs
+      // this project's Kanban boards; a second sync is a second writer.
+      ownKanbanSync: false
+    }),
+    ...control ? {
+      createCommandHandler: (mailbox, approvals) => createHqCommandDispatcher({
+        steerMailbox: mailbox,
+        interruptLeader: control.interruptLeader,
+        allowRunCommand: control.allowRunCommand,
+        // Same registry the approval bridge publishes from, so every
+        // prompt HQ shows is one this handler can actually answer.
+        resolveApproval: (toolUseId, decision, sessionId) => approvals.resolve(toolUseId, decision, sessionId),
+        // Same registry again: it publishes `user_input.requested`, so
+        // it has to be the one that answers `answer-input`.
+        resolveUserInput: (requestId, response, sessionId) => approvals.resolveUserInput?.(requestId, response, sessionId) ?? false,
+        ...deps.projectRoot ? {
+          kanbanTransition: createProjectKanbanTransitionHandler(deps.projectRoot),
+          kanbanAssign: createProjectKanbanAssignHandler(deps.projectRoot)
+        } : {},
+        // The session HQ actually SHOWS for this client — the boot
+        // session the telemetry bridge publishes under and the only one
+        // `interruptLeader` speaks for. `getSessionId` follows whichever
+        // browser tab is in front, which is a different session HQ has
+        // no view of and cannot control.
+        sessionTag: () => mailboxSessionTag(deps.hqSessionId),
+        // The session HQ falls back to when a command names none — the
+        // boot tab. A command that DOES name one is honoured (and
+        // refused when this host no longer has it) via `ownsSession`.
+        sessionId: () => deps.hqSessionId,
+        ...control.ownsSession ? { ownsSession: control.ownsSession } : {},
+        ...control.spawnAgent ? { spawnAgent: control.spawnAgent } : {},
+        ...control.killFleet ? { killFleet: control.killFleet } : {},
+        ...control.terminateAgent ? { terminateAgent: control.terminateAgent } : {}
+      })
+    } : {}
   });
 }
 
-// src/webui-server/lifecycle.ts
-import {
-  announceWebuiReady,
-  createWebuiShutdown,
-  registerWebuiInstance,
-  registerWebuiSignalHandlers
-} from "@wrongstack/webui-server";
-
-// src/webui-server/logger-shim.ts
-var structuredLine = (level, message) => JSON.stringify({
-  level,
-  event: "webui.goal",
-  message,
-  timestamp: (/* @__PURE__ */ new Date()).toISOString()
-});
-var consoleLogger = {
-  level: "debug",
-  error(msg, _ctx) {
-    console.error(structuredLine("error", msg));
-  },
-  warn(msg, _ctx) {
-    console.warn(structuredLine("warn", msg));
-  },
-  info(msg, _ctx) {
-    console.log(structuredLine("info", msg));
-  },
-  debug(msg, _ctx) {
-    console.debug(structuredLine("debug", msg));
-  },
-  trace(msg, _ctx) {
-    console.debug(structuredLine("trace", msg));
-  },
-  child(_bindings) {
-    return this;
+// src/webui-client-observability.ts
+function createEmbeddedClientRegistration(opts, clients, abortControllers, getSessionAgents) {
+  const interruptSession = (sessionId) => {
+    const leaderId = sessionId ?? opts.session.id;
+    const controller = abortControllers.get(leaderId);
+    if (!controller) return false;
+    controller.abort();
+    try {
+      void Promise.resolve(opts.stopSessionFleet?.(leaderId)).catch(() => void 0);
+    } catch {
+    }
+    return true;
+  };
+  if (opts.interruptController) {
+    opts.interruptController.abortLeader = () => interruptSession(opts.agent.ctx.session?.id ?? opts.session.id);
   }
-};
-
-// src/webui-server-lifecycle.ts
-function runWebuiServerLifecycle({
-  host,
-  httpPort,
-  setupEvents,
-  opts,
-  wsPort,
-  accessUrl,
-  wsToken,
-  webuiInstanceRegistered,
-  wss,
-  httpServer,
-  requireToken,
-  publicHostnames,
-  publicWsUrl,
-  clients,
-  currentSessionId,
-  goalHandler,
-  specsHandler,
-  sddBoardHandler,
-  sddWizardHandler,
-  worktreeHandler,
-  terminalHandler,
-  rateLimitMax,
-  send,
-  sessionPayload,
-  handleMessage,
-  pendingConfirms,
-  buildSessionStartPayload,
-  sessionAgents,
-  lifecycleState,
-  abortControllers,
-  flushAllStreamBuffers,
-  eventUnsubscribers,
-  releaseSessionSalvage,
-  autoWakeHost,
-  stopEmptySessionCleanup,
-  credentialWatcherClose,
-  kanbanRunMirror,
-  kanbanSupervisor,
-  stopKanbanSupervisorMemoryStats,
-  unregisterWebuiClient,
-  ipv6LoopbackServer,
-  registryBaseDir,
-  stopLiveStatusLogger,
-  terminalLogView
-}) {
-  const stopped = new Promise((resolve) => {
-    let listeningAnnounced = false;
-    const announceListening = () => {
-      if (listeningAnnounced) return;
-      listeningAnnounced = true;
-      console.log(`[WebUI] WebSocket server running on ws://${host}:${httpPort}`);
-      try {
-        setupEvents();
-        opts.onListening?.({
-          httpPort,
-          wsPort,
-          host,
-          url: accessUrl,
-          authToken: wsToken,
-          webuiInstanceRegistered
-        });
-      } catch (err) {
-        consoleLogger.error("setup_events_failed", { message: toErrorMessage(err) });
-      }
-    };
-    wss.on("listening", announceListening);
-    if (httpServer?.server.listening || wss.address()) queueMicrotask(announceListening);
-    wss.on(
-      "connection",
-      createConnectionHandler({
-        host,
-        wsToken,
-        requireToken,
-        publicHostnames,
-        publicWsUrl,
-        clients,
-        currentSessionId,
-        goalHandler,
-        specsHandler,
-        sddBoardHandler,
-        sddWizardHandler,
-        worktreeHandler,
-        terminalHandler,
-        rateLimitMax,
-        send,
-        sessionPayload,
-        handleMessage,
-        pendingConfirms,
-        buildSessionStartPayload,
-        loadReplay: async () => {
-          const activeSession = opts.agent.ctx.session ?? opts.session;
-          await activeSession.flush();
-          if (opts.sessionStore) {
-            const data = await opts.sessionStore.load(activeSession.id);
-            return { messages: data.messages, events: data.events, usage: data.usage };
-          }
-          const usage = opts.agent.ctx.tokenCounter.total();
-          return { messages: opts.agent.ctx.messages, usage };
-        },
-        loadAgentSessions: async (subagentIds) => await opts.agentTranscripts?.loadSessionsFromDisk(subagentIds) ?? [],
-        // What this process is actually holding right now. The browser
-        // reconciles its persisted tab strip against it, so a restarted server
-        // is not dressed in the previous run's tabs.
-        openSessionIds: () => sessionAgents.ids(),
-        needsSetup: opts.needsSetup ?? false
-      })
-    );
-    lifecycleState.signalShutdown = createWebuiShutdown({
-      abortInFlight: () => {
-        void lifecycleState.embeddedAutoHealDispose?.();
-        for (const c of abortControllers.values()) c.abort();
-        abortControllers.clear();
-      },
-      unsubscribeEvents: () => {
-        flushAllStreamBuffers();
-        for (const unsub of eventUnsubscribers) unsub();
-      },
-      stopOwnedChildren: async () => {
-        try {
-          const { getProcessRegistry } = await import("@wrongstack/tools");
-          getProcessRegistry().killAll({ force: true, includeProtected: true });
-        } catch (err) {
-          console.debug(
-            `[webui-server] process-registry killAll failed: ${err instanceof Error ? err.message : String(err)}`
-          );
-        }
-        if (opts.mcpRegistry) {
-          try {
-            await opts.mcpRegistry.stopAll();
-          } catch (err) {
-            console.debug(
-              `[webui-server] mcpRegistry.stopAll failed: ${err instanceof Error ? err.message : String(err)}`
-            );
-          }
-        }
-      },
-      disposeResources: async () => {
-        releaseSessionSalvage();
-        autoWakeHost?.dispose();
-        await stopEmptySessionCleanup?.dispose();
-        await sessionAgents.closeAll().catch(() => void 0);
-        credentialWatcherClose?.();
-        credentialWatcherClose = void 0;
-        goalHandler.dispose();
-        sddBoardHandler.dispose();
-        worktreeHandler.dispose();
-        terminalHandler.dispose();
-        kanbanRunMirror?.dispose();
-        kanbanSupervisor?.dispose();
-        void stopKanbanSupervisorMemoryStats?.();
-        await lifecycleState.embeddedAutoHealDispose?.();
-        lifecycleState.embeddedAutoHealDispose = null;
-        unregisterWebuiClient();
-      },
-      closeClients: () => {
-        for (const [ws] of clients) ws.close();
-        clients.clear();
-      },
-      closeHttpServer: () => {
-        ipv6LoopbackServer?.close();
-        httpServer?.server.close();
-      },
-      wss,
-      pid: process.pid,
-      registryBaseDir,
-      onStopped: () => {
-        stopLiveStatusLogger();
-        const muted = terminalLogView.mutedCount;
-        terminalLogView.stop();
-        if (muted > 0) {
-          console.log(
-            `[WebUI] ${muted} progress line(s) kept out of this terminal \u2014 set WEBUI_LOGS=1 to stream them.`
-          );
-        }
-        opts.onExit?.();
-        resolve();
+  return createWebuiClientRegistration({
+    projectRoot: opts.projectRoot,
+    appConfig: opts.appConfig,
+    events: opts.events,
+    hqSessionId: opts.session.id,
+    getSessionId: () => opts.agent.ctx.session?.id ?? opts.session.id,
+    // One HQ session per open tab. The set is the same one the terminal
+    // panel lists: every session a connected browser is displaying.
+    listSessions: () => {
+      const ids = /* @__PURE__ */ new Set();
+      for (const client of clients.values()) {
+        if (client.sessionId) ids.add(client.sessionId);
+        for (const id of client.sessionIds ?? []) ids.add(id);
       }
-    });
-    registerWebuiSignalHandlers(lifecycleState.signalShutdown);
+      return [...ids];
+    },
+    // `cli-main` already runs a tracker and a bridge for the root
+    // conversation; announcing it here too would put two trackers on one bus
+    // flushing the same agent list. Compared against the LIVE root writer:
+    // the CLI host's telemetry follows `ctx.session`, so once the root moves
+    // (session.new / resume) the old boot id is an ordinary tab this client
+    // must publish, and the new root id must not be published twice.
+    isSessionOwnedElsewhere: (sessionId) => sessionId === (opts.agent.ctx.session?.id ?? opts.session.id),
+    // The tab's own journal, so HQ takes its turns from the write path
+    // instead of tailing the file.
+    getSessionWriter: (sessionId) => getSessionAgents()?.peek(sessionId)?.ctx.session,
+    hqControl: {
+      interruptLeader: interruptSession,
+      ...opts.hqFleetControl ? {
+        killFleet: opts.hqFleetControl.killFleet,
+        terminateAgent: opts.hqFleetControl.terminateAgent,
+        spawnAgent: opts.hqFleetControl.spawnAgent
+      } : {},
+      allowRunCommand: () => opts.hqAllowExec === true,
+      // A command naming a tab this process no longer holds is refused, not
+      // redirected onto the boot session: the operator picked a terminal,
+      // and steering a different one is worse than not steering at all.
+      ownsSession: (sessionId) => sessionId === opts.session.id || getSessionAgents()?.has(sessionId) === true
+    }
   });
-  return { stopped };
 }
-
-// src/webui-session-retirement.ts
-import { resolvePendingConfirmsForSession } from "@wrongstack/webui-server";
-function createWebuiSessionRetirement(inputs) {
-  const { opts, getForegroundSession, pendingConfirms, abortControllers, sessionAgents } = inputs;
-  const retireUndisplayedSessions = (sessionIds) => {
-    for (const sessionId of sessionIds) {
-      if (!sessionId || sessionId === opts.session.id) continue;
-      if (sessionId === getForegroundSession().id) continue;
-      const orphaned = resolvePendingConfirmsForSession(pendingConfirms, sessionId);
-      if (orphaned > 0) {
-        console.log(
-          JSON.stringify({
-            level: "warn",
-            event: "webui.confirm_orphaned_by_tab_close",
-            sessionId,
-            count: orphaned,
-            message: `Denied ${orphaned} unanswerable permission prompt(s) for closed session ${sessionId}.`
-          })
-        );
+function startEmbeddedLiveStatusLogger(opts, clients, abortControllers, getSessionAgents, terminalLogView) {
+  return startWebUILiveStatusLogger({
+    title: opts.surface === "simpleui" ? "SimpleUI" : "WebUI",
+    events: opts.events,
+    dashboard: terminalLogView,
+    getSessionList: () => {
+      const ids = /* @__PURE__ */ new Set();
+      for (const client of clients.values()) {
+        if (client.sessionId) ids.add(client.sessionId);
+        for (const id of client.sessionIds ?? []) ids.add(id);
       }
-      if (abortControllers.has(sessionId)) continue;
-      opts.onSessionRetired?.(sessionId);
-      const agent = sessionAgents.peek(sessionId);
-      if (!agent || agent === opts.agent) continue;
-      void sessionAgents.endAndClose(sessionId);
+      const currentId = opts.agent.ctx.session?.id ?? opts.session.id;
+      if (ids.size === 0 && currentId) ids.add(currentId);
+      return Array.from(ids).map((id) => {
+        const ctx = getSessionAgents()?.peek(id)?.ctx;
+        return {
+          id,
+          model: ctx?.model ?? opts.agent.ctx.model ?? "",
+          provider: ctx?.provider?.id ?? opts.agent.ctx.provider?.id ?? "",
+          isRunning: abortControllers.has(id)
+        };
+      });
     }
-  };
-  return { retireUndisplayedSessions };
+  });
 }
 
-// src/webui-server.ts
-import * as path7 from "node:path";
-import { createCompatibilityTrustBoundary, DefaultSecretScrubber } from "@wrongstack/core/security";
-import {
-  addFatalSalvageHook,
-  startSharedHeapWatchdog,
-  wstackGlobalRoot
-} from "@wrongstack/core/utils";
+// src/webui-server/domain-handlers.ts
+import * as os from "node:os";
+import * as path2 from "node:path";
+import { resolveWstackPaths } from "@wrongstack/core/utils";
 import {
-  buildWebUIAccessUrl,
-  clientWantsSession,
-  collectDisplayedSessionIds,
-  createCustomModeStore,
-  createDefaultFileWatcherMetrics,
-  createEmbeddedMessageRouter,
-  createEmbeddedProviderOperations,
-  createSessionAgentRegistry,
-  createWebuiLeaderAutoWakeHost,
-  envFlag,
-  findFreePort,
-  findInstalledPackageJson,
-  isStrictPort,
-  resolveAuthToken,
-  scheduleOwnerlessEmptySessionCleanup,
-  sendSerialized,
-  stampDispatchSession,
-  startTerminalDashboard,
-  toSessionHistoryEntries,
-  webuiSessionFrameLog
+  buildSddWizardDeps,
+  GoalWebSocketHandler,
+  SddBoardWebSocketHandler,
+  SddWizardWebSocketHandler,
+  SpecsWebSocketHandler,
+  TerminalWebSocketHandler,
+  WorktreeWebSocketHandler
 } from "@wrongstack/webui-server";
-import { verifyClient as verifyWsClient2 } from "@wrongstack/webui-server/server/ws-auth";
-import { WebSocketServer } from "ws";
-
-// src/webui-client-observability.ts
-import { startWebUILiveStatusLogger } from "@wrongstack/webui-server";
 
-// src/webui-server/client-registration.ts
-import { mailboxSessionTag } from "@wrongstack/core/coordination";
-import { createWebuiClientPresence } from "@wrongstack/webui-server";
-function createWebuiClientRegistration(deps) {
-  const control = deps.hqControl;
-  return createWebuiClientPresence({
-    projectRoot: deps.projectRoot,
-    appConfig: deps.appConfig,
-    events: deps.events,
-    hqSessionId: deps.hqSessionId,
-    getSessionId: deps.getSessionId,
-    clientVersion: CLI_VERSION,
-    ...deps.listSessions ? { listSessions: deps.listSessions } : {},
-    ...deps.isSessionOwnedElsewhere ? { isSessionOwnedElsewhere: deps.isSessionOwnedElsewhere } : {},
-    ...deps.getSessionWriter ? { getSessionWriter: deps.getSessionWriter } : {},
-    startHqConnection: (options) => startCliHqConnection({
-      ...options,
-      capabilities: options.capabilities,
-      // Embedded in the CLI host, whose own HQ connection already syncs
-      // this project's Kanban boards; a second sync is a second writer.
-      ownKanbanSync: false
-    }),
-    ...control ? {
-      createCommandHandler: (mailbox, approvals) => createHqCommandDispatcher({
-        steerMailbox: mailbox,
-        interruptLeader: control.interruptLeader,
-        allowRunCommand: control.allowRunCommand,
-        // Same registry the approval bridge publishes from, so every
-        // prompt HQ shows is one this handler can actually answer.
-        resolveApproval: (toolUseId, decision, sessionId) => approvals.resolve(toolUseId, decision, sessionId),
-        // Same registry again: it publishes `user_input.requested`, so
-        // it has to be the one that answers `answer-input`.
-        resolveUserInput: (requestId, response, sessionId) => approvals.resolveUserInput?.(requestId, response, sessionId) ?? false,
-        ...deps.projectRoot ? {
-          kanbanTransition: createProjectKanbanTransitionHandler(deps.projectRoot),
-          kanbanAssign: createProjectKanbanAssignHandler(deps.projectRoot)
-        } : {},
-        // The session HQ actually SHOWS for this client — the boot
-        // session the telemetry bridge publishes under and the only one
-        // `interruptLeader` speaks for. `getSessionId` follows whichever
-        // browser tab is in front, which is a different session HQ has
-        // no view of and cannot control.
-        sessionTag: () => mailboxSessionTag(deps.hqSessionId),
-        // The session HQ falls back to when a command names none — the
-        // boot tab. A command that DOES name one is honoured (and
-        // refused when this host no longer has it) via `ownsSession`.
-        sessionId: () => deps.hqSessionId,
-        ...control.ownsSession ? { ownsSession: control.ownsSession } : {},
-        ...control.spawnAgent ? { spawnAgent: control.spawnAgent } : {},
-        ...control.killFleet ? { killFleet: control.killFleet } : {},
-        ...control.terminateAgent ? { terminateAgent: control.terminateAgent } : {}
-      })
-    } : {}
-  });
-}
+// src/webui-server/logger-shim.ts
+var structuredLine = (level, message) => JSON.stringify({
+  level,
+  event: "webui.goal",
+  message,
+  timestamp: (/* @__PURE__ */ new Date()).toISOString()
+});
+var consoleLogger = {
+  level: "debug",
+  error(msg, _ctx) {
+    console.error(structuredLine("error", msg));
+  },
+  warn(msg, _ctx) {
+    console.warn(structuredLine("warn", msg));
+  },
+  info(msg, _ctx) {
+    console.log(structuredLine("info", msg));
+  },
+  debug(msg, _ctx) {
+    console.debug(structuredLine("debug", msg));
+  },
+  trace(msg, _ctx) {
+    console.debug(structuredLine("trace", msg));
+  },
+  child(_bindings) {
+    return this;
+  }
+};
 
-// src/webui-client-observability.ts
-function createEmbeddedClientRegistration(opts, clients, abortControllers, getSessionAgents) {
-  const interruptSession = (sessionId) => {
-    const leaderId = sessionId ?? opts.session.id;
-    const controller = abortControllers.get(leaderId);
-    if (!controller) return false;
-    controller.abort();
+// src/webui-server/node-pty-loader.ts
+import { existsSync } from "node:fs";
+import { createRequire } from "node:module";
+import * as path from "node:path";
+import { fileURLToPath } from "node:url";
+import { isStandaloneBinary } from "@wrongstack/core/utils";
+import { repairNodePtySpawnHelper } from "@wrongstack/webui-server";
+function createNodePtyLoader(importMetaUrl, logger) {
+  const requireFromCli = createRequire(importMetaUrl);
+  let cachedNodePty;
+  const loaded = (req, via) => {
+    logger.debug?.(`[terminal] node-pty loaded via ${via}`);
+    repairNodePtySpawnHelper(req, logger);
+    return cachedNodePty;
+  };
+  return () => {
+    if (cachedNodePty !== void 0) return cachedNodePty;
+    if (isStandaloneBinary()) {
+      cachedNodePty = null;
+      return null;
+    }
     try {
-      void Promise.resolve(opts.stopSessionFleet?.(leaderId)).catch(() => void 0);
-    } catch {
+      const webuiEntry = requireFromCli.resolve("@wrongstack/webui");
+      const webuiDir = webuiEntry.replace(/[\\/]dist.*$/, "");
+      const webuiRequire = createRequire(path.join(webuiDir, "package.json"));
+      cachedNodePty = webuiRequire("node-pty");
+      if (cachedNodePty) return loaded(webuiRequire, `webui package (${webuiDir})`);
+    } catch (err) {
+      logger.debug?.(`[terminal] webui-route failed: ${err.message}`);
     }
-    return true;
-  };
-  if (opts.interruptController) {
-    opts.interruptController.abortLeader = () => interruptSession(opts.agent.ctx.session?.id ?? opts.session.id);
-  }
-  return createWebuiClientRegistration({
-    projectRoot: opts.projectRoot,
-    appConfig: opts.appConfig,
-    events: opts.events,
-    hqSessionId: opts.session.id,
-    getSessionId: () => opts.agent.ctx.session?.id ?? opts.session.id,
-    // One HQ session per open tab. The set is the same one the terminal
-    // panel lists: every session a connected browser is displaying.
-    listSessions: () => {
-      const ids = /* @__PURE__ */ new Set();
-      for (const client of clients.values()) {
-        if (client.sessionId) ids.add(client.sessionId);
-        for (const id of client.sessionIds ?? []) ids.add(id);
-      }
-      return [...ids];
-    },
-    // `cli-main` already runs a tracker and a bridge for the root
-    // conversation; announcing it here too would put two trackers on one bus
-    // flushing the same agent list. Compared against the LIVE root writer:
-    // the CLI host's telemetry follows `ctx.session`, so once the root moves
-    // (session.new / resume) the old boot id is an ordinary tab this client
-    // must publish, and the new root id must not be published twice.
-    isSessionOwnedElsewhere: (sessionId) => sessionId === (opts.agent.ctx.session?.id ?? opts.session.id),
-    // The tab's own journal, so HQ takes its turns from the write path
-    // instead of tailing the file.
-    getSessionWriter: (sessionId) => getSessionAgents()?.peek(sessionId)?.ctx.session,
-    hqControl: {
-      interruptLeader: interruptSession,
-      ...opts.hqFleetControl ? {
-        killFleet: opts.hqFleetControl.killFleet,
-        terminateAgent: opts.hqFleetControl.terminateAgent,
-        spawnAgent: opts.hqFleetControl.spawnAgent
-      } : {},
-      allowRunCommand: () => opts.hqAllowExec === true,
-      // A command naming a tab this process no longer holds is refused, not
-      // redirected onto the boot session: the operator picked a terminal,
-      // and steering a different one is worse than not steering at all.
-      ownsSession: (sessionId) => sessionId === opts.session.id || getSessionAgents()?.has(sessionId) === true
+    try {
+      cachedNodePty = requireFromCli("node-pty");
+      return loaded(requireFromCli, "direct requireFromCli");
+    } catch (err) {
+      logger.debug?.(`[terminal] direct require failed: ${err.message}`);
     }
-  });
-}
-function startEmbeddedLiveStatusLogger(opts, clients, abortControllers, getSessionAgents, terminalLogView) {
-  return startWebUILiveStatusLogger({
-    title: opts.surface === "simpleui" ? "SimpleUI" : "WebUI",
-    events: opts.events,
-    dashboard: terminalLogView,
-    getSessionList: () => {
-      const ids = /* @__PURE__ */ new Set();
-      for (const client of clients.values()) {
-        if (client.sessionId) ids.add(client.sessionId);
-        for (const id of client.sessionIds ?? []) ids.add(id);
+    try {
+      const cliPkgJson = path.join(
+        path.dirname(fileURLToPath(importMetaUrl)),
+        "..",
+        "package.json"
+      );
+      let dir = path.dirname(cliPkgJson);
+      for (let i = 0; i < 6; i++) {
+        const candidate = path.join(dir, "node_modules", "node-pty");
+        if (existsSync(candidate)) {
+          const candidateRequire = createRequire(candidate);
+          cachedNodePty = candidateRequire("node-pty");
+          if (cachedNodePty) return loaded(candidateRequire, `workspace root (${candidate})`);
+        }
+        const parent = path.dirname(dir);
+        if (parent === dir) break;
+        dir = parent;
       }
-      const currentId = opts.agent.ctx.session?.id ?? opts.session.id;
-      if (ids.size === 0 && currentId) ids.add(currentId);
-      return Array.from(ids).map((id) => {
-        const ctx = getSessionAgents()?.peek(id)?.ctx;
-        return {
-          id,
-          model: ctx?.model ?? opts.agent.ctx.model ?? "",
-          provider: ctx?.provider?.id ?? opts.agent.ctx.provider?.id ?? "",
-          isRunning: abortControllers.has(id)
-        };
-      });
+    } catch (err) {
+      logger.debug?.(`[terminal] workspace-root walk failed: ${err.message}`);
     }
-  });
-}
-
-// src/webui-server/credential-watcher.ts
-import { TOKENS } from "@wrongstack/core/kernel";
-import { watchProviderConfig } from "@wrongstack/core/storage";
-import { toErrorMessage as toErrorMessage2 } from "@wrongstack/core/utils/error";
-import { makeProviderFromConfig } from "@wrongstack/providers";
-
-// src/webui-server/provider-config.ts
-import * as path from "node:path";
-import { DefaultSecretVault } from "@wrongstack/core/security";
-import { ProviderConfigSnapshots } from "@wrongstack/providers";
-var snapshots = new ProviderConfigSnapshots();
-function getVault(globalConfigPath) {
-  const configDir = path.dirname(globalConfigPath ?? "");
-  const parentDir = path.dirname(configDir);
-  const globalRoot = path.basename(parentDir) === "profiles" ? path.dirname(parentDir) : configDir;
-  const keyFile = path.join(globalRoot, ".key");
-  return new DefaultSecretVault({ keyFile });
-}
-async function loadSavedProviders(globalConfigPath) {
-  if (!globalConfigPath) return {};
-  return snapshots.track(await loadConfigProviders(globalConfigPath, getVault(globalConfigPath)));
-}
-async function saveProviders(globalConfigPath, providers) {
-  if (!globalConfigPath) return;
-  await mutateConfigProviders(
-    globalConfigPath,
-    getVault(globalConfigPath),
-    (existing) => {
-      const merged = snapshots.merge(existing, providers);
-      for (const key of Object.keys(existing)) delete existing[key];
-      Object.assign(existing, merged);
-      for (const key of Object.keys(providers)) delete providers[key];
-      Object.assign(providers, merged);
-    }
-  );
-  snapshots.track(providers);
-}
-function createProviderConfigStore(globalConfigPath, configProvidersRef) {
-  if (configProvidersRef && globalConfigPath) {
-    const views = /* @__PURE__ */ new WeakMap();
-    const equal = (a, b) => JSON.stringify(a) === JSON.stringify(b);
-    return {
-      load: async () => {
-        const disk = await loadSavedProviders(globalConfigPath);
-        const providers = structuredClone(configProvidersRef());
-        views.set(providers, { view: structuredClone(providers), disk });
-        return providers;
-      },
-      save: async (providers) => {
-        const baseline = views.get(providers);
-        if (!baseline) {
-          throw new Error("Load the provider list before saving. Refresh and try again.");
-        }
-        const pending = structuredClone(baseline.disk);
-        snapshots.track(pending);
-        for (const id of /* @__PURE__ */ new Set([...Object.keys(baseline.view), ...Object.keys(providers)])) {
-          if (equal(baseline.view[id], providers[id])) continue;
-          if (!equal(baseline.view[id], baseline.disk[id])) {
-            throw new Error(
-              `Provider "${id}" comes from another config file. Edit its source config or create a new auth profile alias.`
-            );
-          }
-          if (Object.hasOwn(providers, id)) pending[id] = structuredClone(providers[id]);
-          else delete pending[id];
-        }
-        await saveProviders(globalConfigPath, pending);
-        for (const id of Object.keys(providers)) {
-          if (equal(baseline.view[id], baseline.disk[id])) delete providers[id];
-        }
-        for (const [id, record] of Object.entries(pending)) {
-          if (equal(baseline.view[id], baseline.disk[id])) providers[id] = record;
-        }
-        views.set(providers, { view: structuredClone(providers), disk: structuredClone(pending) });
-      }
-    };
-  }
-  return {
-    load: () => configProvidersRef ? Promise.resolve(snapshots.track(structuredClone(configProvidersRef()))) : loadSavedProviders(globalConfigPath),
-    save: (providers) => saveProviders(globalConfigPath, providers)
-  };
-}
-
-// src/webui-server/credential-watcher.ts
-function startWebuiCredentialWatcher({
-  opts,
-  profileConfigPath,
-  broadcast,
-  broadcastSaved
-}) {
-  const watchConfigPath = profileConfigPath;
-  if (!watchConfigPath || process.env["WRONGSTACK_DISABLE_CONFIG_WATCH"] === "1") {
-    return void 0;
-  }
-  let lastActiveCfg = JSON.stringify(
-    opts.appConfig?.providers?.[opts.agent.ctx.provider.id] ?? null
-  );
-  let lastUiLocale = opts.appConfig?.uiLocale;
-  const watcher = watchProviderConfig(
-    watchConfigPath,
-    // Vault key lives at ~/.wrongstack/.key (derived from globalConfigPath),
-    // not inside the profile directory — resolve via global root to stay correct.
-    getVault(opts.globalConfigPath),
-    (snapshot) => {
-      const hadFallbackBridge = Boolean(opts.appConfig?.fallbackBridge?.trim());
-      try {
-        if (opts.appConfig && !Object.isFrozen(opts.appConfig)) {
-          opts.appConfig.providers = snapshot.providers;
-          if (snapshot.uiLocale) opts.appConfig.uiLocale = snapshot.uiLocale;
-          if (snapshot.fallbackBridge !== void 0) {
-            opts.appConfig.fallbackBridge = snapshot.fallbackBridge;
-          } else {
-            delete opts.appConfig.fallbackBridge;
-          }
-        }
-      } catch {
-      }
-      const routingChanged = snapshot.fallbackModels !== void 0 || snapshot.fallbackBridge !== void 0 || hadFallbackBridge || snapshot.fallbackProfiles !== void 0 || snapshot.favoriteModels !== void 0 || snapshot.disabledModels !== void 0 || snapshot.disabledProviders !== void 0 || snapshot.favoriteModelsOnly !== void 0 || snapshot.modelMatrix !== void 0 || snapshot.fallbackAuto !== void 0;
-      if (routingChanged) {
-        const configStore = opts.agent.container?.safeResolve?.(TOKENS.ConfigStore);
-        configStore?.update({
-          ...snapshot.fallbackModels !== void 0 ? { fallbackModels: snapshot.fallbackModels } : {},
-          fallbackBridge: snapshot.fallbackBridge ?? "",
-          ...snapshot.fallbackProfiles !== void 0 ? { fallbackProfiles: snapshot.fallbackProfiles } : {},
-          ...snapshot.favoriteModels !== void 0 ? { favoriteModels: snapshot.favoriteModels } : {},
-          ...snapshot.disabledModels !== void 0 ? { disabledModels: snapshot.disabledModels } : {},
-          ...snapshot.disabledProviders !== void 0 ? { disabledProviders: snapshot.disabledProviders } : {},
-          ...snapshot.favoriteModelsOnly !== void 0 ? { favoriteModelsOnly: snapshot.favoriteModelsOnly } : {},
-          ...snapshot.modelMatrix !== void 0 ? { modelMatrix: snapshot.modelMatrix } : {},
-          ...snapshot.fallbackAuto !== void 0 ? { fallbackAuto: snapshot.fallbackAuto } : {}
-        });
-      }
-      broadcastSaved(snapshot.providers);
-      if (snapshot.uiLocale !== lastUiLocale) {
-        lastUiLocale = snapshot.uiLocale;
-        if (snapshot.uiLocale) {
-          opts.agent.ctx.meta["uiLocale"] = snapshot.uiLocale;
-          broadcast({ type: "prefs.updated", payload: { uiLocale: snapshot.uiLocale } });
-        }
-      }
-      const activeId = opts.agent.ctx.provider.id;
-      const newCfgStr = JSON.stringify(snapshot.providers[activeId] ?? null);
-      if (newCfgStr === lastActiveCfg) return;
-      lastActiveCfg = newCfgStr;
-      try {
-        const newCfg = snapshot.providers[activeId] ?? {
-          type: activeId,
-          ...snapshot.apiKey !== void 0 ? { apiKey: snapshot.apiKey } : {},
-          ...snapshot.baseUrl !== void 0 ? { baseUrl: snapshot.baseUrl } : {}
-        };
-        const oldMax = opts.agent.ctx.provider.capabilities?.maxContext;
-        const prov = makeProviderFromConfig(activeId, {
-          ...newCfg,
-          type: newCfg.type ?? activeId
-        });
-        if (oldMax != null && prov.capabilities) prov.capabilities.maxContext = oldMax;
-        opts.agent.ctx.provider = prov;
-        console.log(`[WebUI] Provider credentials reloaded from config.json (${activeId})`);
-      } catch (err) {
-        console.warn(
-          `[WebUI] Credential hot-reload failed for ${activeId}: ${toErrorMessage2(err)}`
-        );
-      }
-    },
-    {
-      warn: (m) => console.warn(
-        JSON.stringify({
-          level: "warn",
-          event: "webui.config_watcher",
-          message: m,
-          timestamp: (/* @__PURE__ */ new Date()).toISOString()
-        })
-      )
-    }
-  );
-  return watcher.close;
-}
-
-// src/webui-server/domain-handlers.ts
-import * as os from "node:os";
-import * as path3 from "node:path";
-import { resolveWstackPaths } from "@wrongstack/core/utils";
-import {
-  buildSddWizardDeps,
-  GoalWebSocketHandler,
-  SddBoardWebSocketHandler,
-  SddWizardWebSocketHandler,
-  SpecsWebSocketHandler,
-  TerminalWebSocketHandler,
-  WorktreeWebSocketHandler
-} from "@wrongstack/webui-server";
-
-// src/webui-server/node-pty-loader.ts
-import { existsSync } from "node:fs";
-import { createRequire } from "node:module";
-import * as path2 from "node:path";
-import { fileURLToPath } from "node:url";
-import { isStandaloneBinary } from "@wrongstack/core/utils";
-import { repairNodePtySpawnHelper } from "@wrongstack/webui-server";
-function createNodePtyLoader(importMetaUrl, logger) {
-  const requireFromCli = createRequire(importMetaUrl);
-  let cachedNodePty;
-  const loaded = (req, via) => {
-    logger.debug?.(`[terminal] node-pty loaded via ${via}`);
-    repairNodePtySpawnHelper(req, logger);
-    return cachedNodePty;
-  };
-  return () => {
-    if (cachedNodePty !== void 0) return cachedNodePty;
-    if (isStandaloneBinary()) {
-      cachedNodePty = null;
-      return null;
-    }
-    try {
-      const webuiEntry = requireFromCli.resolve("@wrongstack/webui");
-      const webuiDir = webuiEntry.replace(/[\\/]dist.*$/, "");
-      const webuiRequire = createRequire(path2.join(webuiDir, "package.json"));
-      cachedNodePty = webuiRequire("node-pty");
-      if (cachedNodePty) return loaded(webuiRequire, `webui package (${webuiDir})`);
-    } catch (err) {
-      logger.debug?.(`[terminal] webui-route failed: ${err.message}`);
-    }
-    try {
-      cachedNodePty = requireFromCli("node-pty");
-      return loaded(requireFromCli, "direct requireFromCli");
-    } catch (err) {
-      logger.debug?.(`[terminal] direct require failed: ${err.message}`);
-    }
-    try {
-      const cliPkgJson = path2.join(
-        path2.dirname(fileURLToPath(importMetaUrl)),
-        "..",
-        "package.json"
-      );
-      let dir = path2.dirname(cliPkgJson);
-      for (let i = 0; i < 6; i++) {
-        const candidate = path2.join(dir, "node_modules", "node-pty");
-        if (existsSync(candidate)) {
-          const candidateRequire = createRequire(candidate);
-          cachedNodePty = candidateRequire("node-pty");
-          if (cachedNodePty) return loaded(candidateRequire, `workspace root (${candidate})`);
-        }
-        const parent = path2.dirname(dir);
-        if (parent === dir) break;
-        dir = parent;
-      }
-    } catch (err) {
-      logger.debug?.(`[terminal] workspace-root walk failed: ${err.message}`);
-    }
-    cachedNodePty = null;
-    logger.debug?.(
-      '[terminal] node-pty resolution failed; terminal panel will report "unavailable"'
-    );
-    return cachedNodePty;
-  };
+    cachedNodePty = null;
+    logger.debug?.(
+      '[terminal] node-pty resolution failed; terminal panel will report "unavailable"'
+    );
+    return cachedNodePty;
+  };
 }
 
 // src/webui-server/domain-handlers.ts
 function createWebuiDomainHandlers(opts, trustBoundary, kanbanRunMirror) {
-  const goalStoreDir = opts.projectRoot ? resolveWstackPaths({ projectRoot: opts.projectRoot }).projectAutophase : path3.join(os.tmpdir(), ".wrongstack", "goal");
+  const goalStoreDir = opts.projectRoot ? resolveWstackPaths({ projectRoot: opts.projectRoot }).projectAutophase : path2.join(os.tmpdir(), ".wrongstack", "goal");
   const goalHandler = new GoalWebSocketHandler(
     opts.agent,
     opts.agent.ctx,
@@ -859,11 +311,11 @@ function createWebuiDomainHandlers(opts, trustBoundary, kanbanRunMirror) {
   );
   const specsPaths = opts.projectRoot ? resolveWstackPaths({ projectRoot: opts.projectRoot }) : null;
   const specsHandler = new SpecsWebSocketHandler(
-    specsPaths?.projectSpecs ?? path3.join(os.tmpdir(), ".wrongstack", "specs"),
-    specsPaths?.projectTaskGraphs ?? path3.join(os.tmpdir(), ".wrongstack", "task-graphs")
+    specsPaths?.projectSpecs ?? path2.join(os.tmpdir(), ".wrongstack", "specs"),
+    specsPaths?.projectTaskGraphs ?? path2.join(os.tmpdir(), ".wrongstack", "task-graphs")
   );
   const sddBoardHandler = new SddBoardWebSocketHandler(
-    specsPaths?.projectSddBoards ?? path3.join(os.tmpdir(), ".wrongstack", "sdd-boards"),
+    specsPaths?.projectSddBoards ?? path2.join(os.tmpdir(), ".wrongstack", "sdd-boards"),
     opts.events,
     specsPaths && opts.projectRoot ? {
       projectRoot: opts.projectRoot,
@@ -903,33 +355,301 @@ function createWebuiDomainHandlers(opts, trustBoundary, kanbanRunMirror) {
   };
 }
 
-// src/webui-server/kanban-host-adapter.ts
-import { PhaseGraphBuilder } from "@wrongstack/core/goal";
-import { resolveWstackPaths as resolveWstackPaths2 } from "@wrongstack/core/utils";
-import { exportBoardToTaskGraph } from "@wrongstack/kanban";
-import { TaskGraphStore } from "@wrongstack/sdd";
-import {
-  startSddRunFromGraph
-} from "@wrongstack/webui-server";
-function createCliKanbanHostRoutes(deps) {
-  const { opts, send, goalHandler } = deps;
-  let isolatedSeq = 0;
-  const runIsolatedTurn = opts.sddSubagentFactory ? async (prompt, name) => {
-    const result = await opts.sddSubagentFactory({
-      id: `sdd-kanban-${name.toLowerCase().replace(/\s+/g, "-")}-${isolatedSeq++}`,
-      role: "executor",
-      name,
-      disabledTools: ["delegate", "write", "edit", "patch", "bash", "exec"],
-      allowedCapabilities: ["fs.read", "net.outbound"]
-    });
-    try {
-      const res = await result.agent.run([{ type: "text", text: prompt }]);
-      return res.finalText ?? "";
-    } finally {
-      await result.dispose?.();
-    }
-  } : void 0;
-  return {
+// src/webui-server/host-settings.ts
+import * as path3 from "node:path";
+import { wstackGlobalRoot } from "@wrongstack/core/utils";
+import { envFlag, isStrictPort } from "@wrongstack/webui-server";
+function resolveWebuiHostSettings(opts) {
+  const host = opts.host ?? process.env["WEBUI_HOST"] ?? process.env["WS_HOST"] ?? "127.0.0.1";
+  const publicUrl = opts.publicUrl ?? process.env["WEBUI_PUBLIC_URL"];
+  const publicWsUrl = opts.publicWsUrl ?? process.env["WEBUI_PUBLIC_WS_URL"];
+  const requireToken = opts.requireToken ?? envFlag("WEBUI_REQUIRE_TOKEN");
+  const surface = opts.surface ?? "webui";
+  const surfaceDefaults = surface === "simpleui" ? { http: 3466 } : { http: 3456 };
+  const requestedHttpPort = opts.httpPort ?? opts.port ?? surfaceDefaults.http;
+  const strictPort = opts.strictPort ?? isStrictPort();
+  const globalRoot = opts.globalConfigPath ? path3.dirname(opts.globalConfigPath) : wstackGlobalRoot();
+  const profileConfigPath = opts.profileConfigPath ?? opts.globalConfigPath ?? path3.join(globalRoot, "config.json");
+  const rawRateLimit = process.env["WEBUI_RATE_LIMIT"]?.trim() ?? "";
+  const parsedRateLimit = /^\d+$/.test(rawRateLimit) ? Number(rawRateLimit) : Number.NaN;
+  const rateLimitMax = Number.isSafeInteger(parsedRateLimit) && parsedRateLimit >= 0 ? parsedRateLimit : 600;
+  const publicHostnames = [publicUrl, publicWsUrl].map((value) => {
+    if (!value) return void 0;
+    try {
+      return new URL(value).hostname;
+    } catch {
+      return void 0;
+    }
+  }).filter((value) => Boolean(value));
+  return {
+    host,
+    publicUrl,
+    publicWsUrl,
+    requireToken,
+    surface,
+    requestedHttpPort,
+    strictPort,
+    globalRoot,
+    profileConfigPath,
+    profileDir: path3.dirname(profileConfigPath),
+    rateLimitMax,
+    publicHostnames
+  };
+}
+
+// src/webui-server/http-bridge.ts
+import {
+  createDefaultFileWatcherMetrics,
+  findInstalledPackageJson
+} from "@wrongstack/webui-server";
+import { verifyClient as verifyWsClient } from "@wrongstack/webui-server/server/ws-auth";
+import { WebSocketServer } from "ws";
+
+// src/webui-server/lifecycle.ts
+import {
+  announceWebuiReady,
+  createWebuiShutdown,
+  registerWebuiInstance,
+  registerWebuiSignalHandlers
+} from "@wrongstack/webui-server";
+
+// src/webui-server/listen-helpers.ts
+import * as http from "node:http";
+import { listenWithRetry } from "@wrongstack/webui-server";
+async function startDeferredHttpListen(args) {
+  const { server, host, httpPort, logger, strictPort } = args;
+  const boundPort = await listenWithRetry(server, host, httpPort, {
+    maxTries: strictPort ? 1 : 10
+  });
+  server.on("error", (err) => {
+    logger.error("http_server_error", {
+      message: err.message,
+      port: boundPort
+    });
+  });
+  return boundPort;
+}
+async function startIpv6LoopbackProxy(args) {
+  const { primary, httpPort, logger } = args;
+  const v6 = http.createServer();
+  v6.on("request", (req, res) => primary.emit("request", req, res));
+  v6.on("upgrade", (req, socket, head) => primary.emit("upgrade", req, socket, head));
+  const logIpv6Error = (err) => {
+    if (err.code === "EAFNOSUPPORT" || err.code === "EADDRNOTAVAIL" || err.code === "EADDRINUSE") {
+      logger.warn("ipv6_loopback_unavailable", { code: err.code, port: httpPort });
+      return;
+    }
+    logger.error("http_server_error", { message: err.message, port: httpPort });
+  };
+  v6.on("error", logIpv6Error);
+  const ipv6Listening = await new Promise((resolveListen) => {
+    const onListening = () => {
+      v6.off("error", onInitialError);
+      resolveListen(true);
+    };
+    const onInitialError = () => {
+      v6.off("listening", onListening);
+      resolveListen(false);
+    };
+    v6.once("listening", onListening);
+    v6.once("error", onInitialError);
+    v6.listen(httpPort, "::1");
+  });
+  if (!ipv6Listening) return null;
+  console.log(`[WebUI] Also listening on http://[::1]:${httpPort}`);
+  return v6;
+}
+
+// src/webui-server/static-serve.ts
+import {
+  ensureDistDir,
+  resolveDistDir,
+  startStaticServe
+} from "@wrongstack/webui-server";
+
+// src/webui-server/http-bridge.ts
+async function startWebuiHttpBridge(input) {
+  const {
+    opts,
+    surface,
+    host,
+    strictPort,
+    globalRoot,
+    wsToken,
+    publicUrl,
+    publicWsUrl,
+    requireToken,
+    getSessionAgents,
+    onFleetPing,
+    broadcast,
+    onPortRebound
+  } = input;
+  let httpPort = input.httpPort;
+  const httpServer = await startStaticServe({
+    getSessionProjectRoot: (sessionId) => getSessionAgents()?.peek(sessionId)?.ctx.projectRoot ?? (opts.agent.ctx.session?.id === sessionId ? opts.agent.ctx.projectRoot : void 0),
+    host,
+    httpPort,
+    globalRoot,
+    distDir: opts.frontendDistDir,
+    ensureDistDeps: {
+      resolvePackageJson: (id) => {
+        const packageJson = findInstalledPackageJson(id, import.meta.url);
+        if (!packageJson) throw new Error(`Package not found: ${id}`);
+        return packageJson;
+      }
+    },
+    onFleetPing,
+    // Without this, /debug/watcher-metrics 503s and the Debug Dashboard has to
+    // report the watcher as "Unavailable". The CLI host runs no status watcher
+    // of its own, so this object stays all-zero and watcherActive reads false —
+    // which is the truthful state for an embedded host.
+    watcherMetrics: createDefaultFileWatcherMetrics(),
+    onTechStackEvent: (event) => broadcast(event),
+    getLlm: () => opts.agent.ctx.provider && opts.agent.ctx.model ? { provider: opts.agent.ctx.provider, model: opts.agent.ctx.model } : void 0,
+    projectRoot: opts.projectRoot,
+    publicWsUrl,
+    apiToken: wsToken,
+    requireToken,
+    deferListen: surface === "simpleui",
+    strictPort,
+    // Resolve the same-origin health probes from live preferences, including
+    // changes made after boot, just like the standalone WebUI host.
+    getIntegrationTarget: (kind) => {
+      const meta = opts.agent.ctx.meta;
+      const enabledKey = kind === "hq" ? "hqEnabled" : "wrongProxyEnabled";
+      const urlKey = kind === "hq" ? "hqUrl" : "wrongProxyUrl";
+      return meta[enabledKey] === true && typeof meta[urlKey] === "string" ? meta[urlKey] : void 0;
+    },
+    ...opts.getVectorMemoryStore ? { getVectorMemoryStore: opts.getVectorMemoryStore } : {},
+    ...opts.vectorMemoryModelCacheDir ? { vectorMemoryModelCacheDir: opts.vectorMemoryModelCacheDir } : {}
+  });
+  const verifyClient = (info) => verifyWsClient({
+    origin: info.origin,
+    url: info.req.url ?? "",
+    hostHeader: info.req.headers.host,
+    remoteAddress: info.req.socket.remoteAddress,
+    cookieHeader: info.req.headers.cookie,
+    wsHost: host,
+    expectedToken: wsToken,
+    requireToken,
+    allowedHostnames: [publicUrl, publicWsUrl].filter((value) => Boolean(value)),
+    allowBrowserUrlToken: Boolean(publicWsUrl),
+    allowCrossPortLoopbackCookie: process.env["WRONGSTACK_WEBUI_DEV_CROSS_PORT_WS"] === "1"
+  });
+  const wss = httpServer ? new WebSocketServer({ server: httpServer.server, verifyClient, maxPayload: 20 * 1024 * 1024 }) : new WebSocketServer({ port: httpPort, host, verifyClient, maxPayload: 20 * 1024 * 1024 });
+  wss.on("error", (err) => {
+    console.error(
+      JSON.stringify({
+        level: "error",
+        event: "webui_server.error",
+        message: err instanceof Error ? err.message : String(err),
+        timestamp: (/* @__PURE__ */ new Date()).toISOString()
+      })
+    );
+  });
+  if (httpServer) {
+    const boundPort = surface === "simpleui" ? await startDeferredHttpListen({
+      server: httpServer.server,
+      host,
+      httpPort,
+      logger: consoleLogger,
+      strictPort
+    }) : httpServer.port;
+    if (boundPort !== httpPort) {
+      httpPort = boundPort;
+      onPortRebound(boundPort);
+    }
+  }
+  let ipv6LoopbackServer = null;
+  if (httpServer && host === "127.0.0.1") {
+    ipv6LoopbackServer = await startIpv6LoopbackProxy({
+      primary: httpServer.server,
+      httpPort,
+      logger: consoleLogger
+    });
+  }
+  console.log(`[WebUI] WebSocket server starting on ws://${host}:${httpPort}`);
+  if (httpServer) {
+    announceWebuiReady({
+      surface,
+      server: httpServer.server,
+      host,
+      httpPort,
+      open: !!opts.open,
+      wsToken,
+      publicUrl
+    });
+  } else {
+    console.warn(
+      `[WebUI] Frontend not served (run \`pnpm --filter @wrongstack/webui build\`). WS bridge still active on ws://${host}:${httpPort}.`
+    );
+  }
+  return { httpServer, wss, ipv6LoopbackServer };
+}
+
+// src/webui-server/instance-registration.ts
+async function registerEmbeddedWebuiInstance(input) {
+  const { opts, surface, host, httpPort, publicUrl, registryBaseDir, wsToken, currentSessionId } = input;
+  if (!opts.projectRoot) return false;
+  const registration = Promise.resolve(
+    registerWebuiInstance({
+      pid: process.pid,
+      surface,
+      host,
+      httpPort,
+      publicUrl,
+      projectRoot: opts.projectRoot,
+      startedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      registryBaseDir,
+      authToken: wsToken,
+      ...opts.webuiSessionChild ? {
+        role: "session-child",
+        sessionId: currentSessionId(),
+        parentPid: opts.webuiSessionChild.parentPid,
+        parentShellId: opts.webuiSessionChild.parentShellId,
+        runtimeId: opts.webuiSessionChild.runtimeId,
+        attachable: opts.webuiSessionChild.attachable,
+        lastReadyAt: (/* @__PURE__ */ new Date()).toISOString(),
+        protocolVersion: opts.webuiSessionChild.protocolVersion,
+        capabilities: [...WEBUI_SESSION_CHILD_CAPABILITIES]
+      } : {}
+    })
+  ).then(
+    (value) => value !== false,
+    () => false
+  );
+  if (opts.webuiSessionChild) return await registration;
+  void registration;
+  return true;
+}
+
+// src/webui-server/kanban-host-adapter.ts
+import { PhaseGraphBuilder } from "@wrongstack/core/goal";
+import { resolveWstackPaths as resolveWstackPaths2 } from "@wrongstack/core/utils";
+import { exportBoardToTaskGraph } from "@wrongstack/kanban";
+import { TaskGraphStore } from "@wrongstack/sdd";
+import {
+  startSddRunFromGraph
+} from "@wrongstack/webui-server";
+function createCliKanbanHostRoutes(deps) {
+  const { opts, send, goalHandler } = deps;
+  let isolatedSeq = 0;
+  const runIsolatedTurn = opts.sddSubagentFactory ? async (prompt, name) => {
+    const result = await opts.sddSubagentFactory({
+      id: `sdd-kanban-${name.toLowerCase().replace(/\s+/g, "-")}-${isolatedSeq++}`,
+      role: "executor",
+      name,
+      disabledTools: ["delegate", "write", "edit", "patch", "bash", "exec"],
+      allowedCapabilities: ["fs.read", "net.outbound"]
+    });
+    try {
+      const res = await result.agent.run([{ type: "text", text: prompt }]);
+      return res.finalText ?? "";
+    } finally {
+      await result.dispose?.();
+    }
+  } : void 0;
+  return {
     meta: async (ws) => {
       const tools = (opts.agent.ctx.tools ?? []).map((tool) => ({
         name: tool.name,
@@ -1073,59 +793,160 @@ function createCliKanbanHostRoutes(deps) {
   };
 }
 
-// src/webui-server/listen-helpers.ts
-import * as http from "node:http";
-import { listenWithRetry } from "@wrongstack/webui-server";
-async function startDeferredHttpListen(args) {
-  const { server, host, httpPort, logger, strictPort } = args;
-  const boundPort = await listenWithRetry(server, host, httpPort, {
-    maxTries: strictPort ? 1 : 10
-  });
-  server.on("error", (err) => {
-    logger.error("http_server_error", {
-      message: err.message,
-      port: boundPort
-    });
-  });
-  return boundPort;
+// src/webui-server/kanban-services.ts
+import { startSharedHeapWatchdog } from "@wrongstack/core/utils";
+function createWebuiKanbanServices(opts, broadcast) {
+  const kanbanRunMirror = opts.projectRoot ? createKanbanRunMirror({
+    projectRoot: opts.projectRoot,
+    events: opts.events,
+    broadcast,
+    log: (m) => consoleLogger.info(m)
+  }) : null;
+  const kanbanSupervisor = opts.projectRoot ? createKanbanSupervisor({
+    projectRoot: opts.projectRoot,
+    broadcast,
+    ...opts.onKanbanDispatch ? { dispatchTask: opts.onKanbanDispatch } : {},
+    log: (message) => consoleLogger.info(message)
+  }) : null;
+  const stopKanbanSupervisorMemoryStats = kanbanSupervisor ? startSharedHeapWatchdog({
+    collectStats: () => {
+      const stats = kanbanSupervisor.getStats();
+      return {
+        kanbanSupervisorSnapshots: stats.snapshots,
+        kanbanSupervisorScheduledBoards: stats.scheduledBoards,
+        kanbanSupervisorAgentCooldowns: stats.agentCooldowns,
+        kanbanSupervisorRunningAgents: stats.runningAgents
+      };
+    }
+  }) : void 0;
+  return { kanbanRunMirror, kanbanSupervisor, stopKanbanSupervisorMemoryStats };
 }
-async function startIpv6LoopbackProxy(args) {
-  const { primary, httpPort, logger } = args;
-  const v6 = http.createServer();
-  v6.on("request", (req, res) => primary.emit("request", req, res));
-  v6.on("upgrade", (req, socket, head) => primary.emit("upgrade", req, socket, head));
-  const logIpv6Error = (err) => {
-    if (err.code === "EAFNOSUPPORT" || err.code === "EADDRNOTAVAIL" || err.code === "EADDRINUSE") {
-      logger.warn("ipv6_loopback_unavailable", { code: err.code, port: httpPort });
-      return;
+
+// src/webui-server/message-router.ts
+import { createEmbeddedMessageRouter } from "@wrongstack/webui-server";
+
+// src/webui-server/provider-config.ts
+import * as path4 from "node:path";
+import { DefaultSecretVault } from "@wrongstack/core/security";
+import { ProviderConfigSnapshots } from "@wrongstack/providers";
+var snapshots = new ProviderConfigSnapshots();
+function getVault(globalConfigPath) {
+  const configDir = path4.dirname(globalConfigPath ?? "");
+  const parentDir = path4.dirname(configDir);
+  const globalRoot = path4.basename(parentDir) === "profiles" ? path4.dirname(parentDir) : configDir;
+  const keyFile = path4.join(globalRoot, ".key");
+  return new DefaultSecretVault({ keyFile });
+}
+async function loadSavedProviders(globalConfigPath) {
+  if (!globalConfigPath) return {};
+  return snapshots.track(await loadConfigProviders(globalConfigPath, getVault(globalConfigPath)));
+}
+async function saveProviders(globalConfigPath, providers) {
+  if (!globalConfigPath) return;
+  await mutateConfigProviders(
+    globalConfigPath,
+    getVault(globalConfigPath),
+    (existing) => {
+      const merged = snapshots.merge(existing, providers);
+      for (const key of Object.keys(existing)) delete existing[key];
+      Object.assign(existing, merged);
+      for (const key of Object.keys(providers)) delete providers[key];
+      Object.assign(providers, merged);
     }
-    logger.error("http_server_error", { message: err.message, port: httpPort });
-  };
-  v6.on("error", logIpv6Error);
-  const ipv6Listening = await new Promise((resolveListen) => {
-    const onListening = () => {
-      v6.off("error", onInitialError);
-      resolveListen(true);
-    };
-    const onInitialError = () => {
-      v6.off("listening", onListening);
-      resolveListen(false);
+  );
+  snapshots.track(providers);
+}
+function createProviderConfigStore(globalConfigPath, configProvidersRef) {
+  if (configProvidersRef && globalConfigPath) {
+    const views = /* @__PURE__ */ new WeakMap();
+    const equal = (a, b) => JSON.stringify(a) === JSON.stringify(b);
+    return {
+      load: async () => {
+        const disk = await loadSavedProviders(globalConfigPath);
+        const providers = structuredClone(configProvidersRef());
+        views.set(providers, { view: structuredClone(providers), disk });
+        return providers;
+      },
+      save: async (providers) => {
+        const baseline = views.get(providers);
+        if (!baseline) {
+          throw new Error("Load the provider list before saving. Refresh and try again.");
+        }
+        const pending = structuredClone(baseline.disk);
+        snapshots.track(pending);
+        for (const id of /* @__PURE__ */ new Set([...Object.keys(baseline.view), ...Object.keys(providers)])) {
+          if (equal(baseline.view[id], providers[id])) continue;
+          if (!equal(baseline.view[id], baseline.disk[id])) {
+            throw new Error(
+              `Provider "${id}" comes from another config file. Edit its source config or create a new auth profile alias.`
+            );
+          }
+          if (Object.hasOwn(providers, id)) pending[id] = structuredClone(providers[id]);
+          else delete pending[id];
+        }
+        await saveProviders(globalConfigPath, pending);
+        for (const id of Object.keys(providers)) {
+          if (equal(baseline.view[id], baseline.disk[id])) delete providers[id];
+        }
+        for (const [id, record] of Object.entries(pending)) {
+          if (equal(baseline.view[id], baseline.disk[id])) providers[id] = record;
+        }
+        views.set(providers, { view: structuredClone(providers), disk: structuredClone(pending) });
+      }
     };
-    v6.once("listening", onListening);
-    v6.once("error", onInitialError);
-    v6.listen(httpPort, "::1");
+  }
+  return {
+    load: () => configProvidersRef ? Promise.resolve(snapshots.track(structuredClone(configProvidersRef()))) : loadSavedProviders(globalConfigPath),
+    save: (providers) => saveProviders(globalConfigPath, providers)
+  };
+}
+
+// src/webui-server/message-router.ts
+function createCliEmbeddedMessageRouter(input) {
+  const { opts, routeContexts, domainHandlers } = input;
+  return createEmbeddedMessageRouter({
+    jevVault: getVault(opts.globalConfigPath ?? opts.profileConfigPath),
+    trustBoundary: input.trustBoundary,
+    opts,
+    logger: consoleLogger,
+    send: input.send,
+    sendResult: input.sendResult,
+    sessionPayload: input.sessionPayload,
+    currentSessionId: input.currentSessionId,
+    shutdown: input.shutdown,
+    // Auto-heal watchdog disposer — `disposeResources` awaits it (bounded) so
+    // an in-flight daemon restart drains before the host exits.
+    onDispose: input.onDispose,
+    providerCtx: input.providerCtx,
+    brainCtx: routeContexts.brainCtx,
+    introspectionCtx: routeContexts.introspectionCtx,
+    skillsCtx: routeContexts.skillsCtx,
+    promptsCtx: routeContexts.promptsCtx,
+    designCtx: routeContexts.designCtx,
+    agentConfigCtx: routeContexts.agentConfigCtx,
+    prefsCtx: routeContexts.prefsCtx,
+    projectCtx: routeContexts.projectsCtx,
+    mailboxRoutes: routeContexts.mailboxRoutes,
+    chimeraRoutes: routeContexts.chimeraRoutes,
+    codeAssistRoutes: routeContexts.codeAssistRoutes,
+    sessionCtx: routeContexts.sessionsCtx,
+    conversationCtx: routeContexts.connectionCtx,
+    goalHandler: domainHandlers.goalHandler,
+    specsHandler: domainHandlers.specsHandler,
+    sddBoardHandler: domainHandlers.sddBoardHandler,
+    sddWizardHandler: domainHandlers.sddWizardHandler,
+    worktreeHandler: domainHandlers.worktreeHandler,
+    terminalHandler: domainHandlers.terminalHandler,
+    kanbanHostRoutes: input.kanbanHostRoutes,
+    statusTracker: opts.statusTracker
   });
-  if (!ipv6Listening) return null;
-  console.log(`[WebUI] Also listening on http://[::1]:${httpPort}`);
-  return v6;
 }
 
 // src/webui-server/prefs-seeding.ts
 import * as fs from "node:fs/promises";
-import * as path4 from "node:path";
+import * as path5 from "node:path";
 import { DefaultSecretVault as DefaultSecretVault2 } from "@wrongstack/core/security";
 import {
-  PREF_KEYS,
   persistPrefsToConfig,
   seedContextMeta,
   prefSnapshot as snapshotPrefs
@@ -1199,8 +1020,8 @@ function createPrefsSeeding(opts) {
       patchLiveAppConfig({ modelTiers: payload["modelTiers"] });
     }
     if (!opts.profileConfigPath) return;
-    const globalRoot = opts.globalConfigPath ? path4.dirname(opts.globalConfigPath) : path4.dirname(opts.profileConfigPath);
-    const vault = new DefaultSecretVault2({ keyFile: path4.join(globalRoot, ".key") });
+    const globalRoot = opts.globalConfigPath ? path5.dirname(opts.globalConfigPath) : path5.dirname(opts.profileConfigPath);
+    const vault = new DefaultSecretVault2({ keyFile: path5.join(globalRoot, ".key") });
     await persistPrefsToConfig(
       {
         profileConfigPath: opts.profileConfigPath,
@@ -1228,122 +1049,252 @@ function createPrefsSeeding(opts) {
   };
 }
 
-// src/webui-server/route-contexts.ts
-import * as path5 from "node:path";
+// src/webui-server/provider-plane.ts
 import {
-  normalizeSubagentModelPlan,
-  seedSessionSubagentPolicy,
-  setSessionSubagentModelPlan,
-  setSessionSubagentPolicy,
-  subagentPolicyModeFrom
-} from "@wrongstack/core/coordination";
-import { TOKENS as TOKENS2 } from "@wrongstack/core/kernel";
-import { SkillInstaller } from "@wrongstack/core/skills";
-import { PromptUsageStore } from "@wrongstack/core/storage";
-import { resolveTokenSavingTier } from "@wrongstack/core/types";
-import { isOutsideProject, resolveWstackPaths as resolveWstackPaths3 } from "@wrongstack/core/utils";
-import {
-  createChimeraRouteHandlers,
-  createCodeAssistRouteHandlers,
-  createMailboxRouteHandlers,
-  rebuildSystemPrompt
+  createEmbeddedProviderOperations
 } from "@wrongstack/webui-server";
-function createWebuiRouteContexts({
+
+// src/webui-server/credential-watcher.ts
+import { TOKENS } from "@wrongstack/core/kernel";
+import { watchProviderConfig } from "@wrongstack/core/storage";
+import { toErrorMessage } from "@wrongstack/core/utils/error";
+import { makeProviderFromConfig } from "@wrongstack/providers";
+function startWebuiCredentialWatcher({
   opts,
   profileConfigPath,
-  profileDir,
-  globalRoot,
-  sessionStartedAt,
-  currentSessionId,
-  getCustomModeStore,
-  buildSessionStartPayload,
-  prefSnapshot,
-  persistPrefs,
-  pendingConfirms,
-  abortControllers,
-  getSessionAgent,
-  peekSessionAgent,
-  isSessionLive,
-  getForegroundSession,
-  setForegroundSession,
-  clients,
-  onSessionsUndisplayed,
-  autoWake,
-  stopSessionFleet,
-  send,
   broadcast,
-  broadcastEveryone
+  broadcastSaved
 }) {
-  const brainCtx = {
-    brainSettings: opts.brainSettings,
-    brainRuntime: opts.brainRuntime,
-    getBrainLog: opts.getBrainLog,
-    resolveArbiter: () => opts.brain ?? (opts.agent.container.has(TOKENS2.BrainArbiter) ? opts.agent.container.resolve(TOKENS2.BrainArbiter) : void 0),
-    getSessionId: currentSessionId,
-    send
-  };
-  const introspectionConfigStore = opts.agent.container?.safeResolve?.(TOKENS2.ConfigStore);
-  const introspectionCtx = {
-    agent: opts.agent,
-    // Answer `diag.get` / `stats.get` / `side_effects.list` from the agent that
-    // owns the ASKING session. `opts.agent` is the leader, i.e. whichever tab
-    // the runtime last switched to, so a background tab asking for its own
-    // stats got the foreground's numbers stamped with the foreground's id —
-    // which the browser's session filter then dropped, leaving the panel blank.
-    // Read path, so `peek` first: `getAgent` creates, and materialising an
-    // agent for a stale id can evict a live tab's.
-    getAgent: (sessionId) => peekSessionAgent?.(sessionId) ?? (sessionId ? getSessionAgent(sessionId) : opts.agent),
-    modelsRegistry: opts.modelsRegistry,
-    configStore: introspectionConfigStore,
-    getConfig: () => {
-      const cfg = introspectionConfigStore?.get() ?? opts.appConfig;
-      if (!cfg)
-        throw new Error(
-          "Introspection route requires a config but neither ConfigStore nor opts.appConfig is available"
-        );
-      return cfg;
-    },
-    getProjectRoot: () => opts.projectRoot ?? opts.agent.ctx.projectRoot ?? "",
-    getSessionId: currentSessionId,
-    getSessionStartedAt: () => sessionStartedAt,
-    getModeId: () => opts.modeId ?? "default",
-    send
-  };
-  const skillsProjectRoot = opts.projectRoot ?? opts.agent.ctx.projectRoot ?? "";
-  const skillsPaths = skillsProjectRoot ? resolveWstackPaths3({
-    projectRoot: skillsProjectRoot,
-    globalRoot
-  }) : void 0;
-  const skillsCtx = {
-    skillLoader: opts.skillLoader,
-    skillInstaller: opts.skillLoader ? new SkillInstaller({
-      manifestPath: path5.join(skillsPaths?.configDir ?? profileDir, "installed-skills.json"),
-      projectSkillsDir: skillsPaths?.inProjectSkills ?? path5.join(skillsProjectRoot, ".wrongstack", "skills"),
-      globalSkillsDir: skillsPaths?.globalSkills ?? path5.join(profileDir, "skills"),
-      projectHash: skillsPaths?.projectHash ?? "",
-      skillLoader: opts.skillLoader
-    }) : void 0,
-    projectRoot: skillsProjectRoot,
-    projectSkillsDir: skillsPaths?.inProjectSkills,
-    globalSkillsDir: skillsPaths?.globalSkills
-  };
-  const promptsCtx = {
-    promptLoader: opts.promptLoader,
-    promptUsage: new PromptUsageStore(
-      skillsPaths?.promptUsage ?? path5.join(profileDir, "prompt-usage.json")
-    )
-  };
-  const designCtx = (sessionId) => ({
-    projectRoot: skillsProjectRoot,
-    agentMeta: (sessionId ? getSessionAgent(sessionId)?.ctx : void 0) ?? opts.agent.ctx
-  });
-  const agentConfigCtx = {
-    agent: opts.agent,
-    modeStore: opts.modeStore,
-    loadSavedProviders: () => loadSavedProviders(profileConfigPath),
-    buildSessionStart: (overrides) => buildSessionStartPayload(overrides),
-    modelsRegistry: opts.modelsRegistry,
-    memoryStore: opts.memoryStore,
+  const watchConfigPath = profileConfigPath;
+  if (!watchConfigPath || process.env["WRONGSTACK_DISABLE_CONFIG_WATCH"] === "1") {
+    return void 0;
+  }
+  let lastActiveCfg = JSON.stringify(
+    opts.appConfig?.providers?.[opts.agent.ctx.provider.id] ?? null
+  );
+  let lastUiLocale = opts.appConfig?.uiLocale;
+  const watcher = watchProviderConfig(
+    watchConfigPath,
+    // Vault key lives at ~/.wrongstack/.key (derived from globalConfigPath),
+    // not inside the profile directory — resolve via global root to stay correct.
+    getVault(opts.globalConfigPath),
+    (snapshot) => {
+      const hadFallbackBridge = Boolean(opts.appConfig?.fallbackBridge?.trim());
+      try {
+        if (opts.appConfig && !Object.isFrozen(opts.appConfig)) {
+          opts.appConfig.providers = snapshot.providers;
+          if (snapshot.uiLocale) opts.appConfig.uiLocale = snapshot.uiLocale;
+          if (snapshot.fallbackBridge !== void 0) {
+            opts.appConfig.fallbackBridge = snapshot.fallbackBridge;
+          } else {
+            delete opts.appConfig.fallbackBridge;
+          }
+        }
+      } catch {
+      }
+      const routingChanged = snapshot.fallbackModels !== void 0 || snapshot.fallbackBridge !== void 0 || hadFallbackBridge || snapshot.fallbackProfiles !== void 0 || snapshot.favoriteModels !== void 0 || snapshot.disabledModels !== void 0 || snapshot.disabledProviders !== void 0 || snapshot.favoriteModelsOnly !== void 0 || snapshot.modelMatrix !== void 0 || snapshot.fallbackAuto !== void 0;
+      if (routingChanged) {
+        const configStore = opts.agent.container?.safeResolve?.(TOKENS.ConfigStore);
+        configStore?.update({
+          ...snapshot.fallbackModels !== void 0 ? { fallbackModels: snapshot.fallbackModels } : {},
+          fallbackBridge: snapshot.fallbackBridge ?? "",
+          ...snapshot.fallbackProfiles !== void 0 ? { fallbackProfiles: snapshot.fallbackProfiles } : {},
+          ...snapshot.favoriteModels !== void 0 ? { favoriteModels: snapshot.favoriteModels } : {},
+          ...snapshot.disabledModels !== void 0 ? { disabledModels: snapshot.disabledModels } : {},
+          ...snapshot.disabledProviders !== void 0 ? { disabledProviders: snapshot.disabledProviders } : {},
+          ...snapshot.favoriteModelsOnly !== void 0 ? { favoriteModelsOnly: snapshot.favoriteModelsOnly } : {},
+          ...snapshot.modelMatrix !== void 0 ? { modelMatrix: snapshot.modelMatrix } : {},
+          ...snapshot.fallbackAuto !== void 0 ? { fallbackAuto: snapshot.fallbackAuto } : {}
+        });
+      }
+      broadcastSaved(snapshot.providers);
+      if (snapshot.uiLocale !== lastUiLocale) {
+        lastUiLocale = snapshot.uiLocale;
+        if (snapshot.uiLocale) {
+          opts.agent.ctx.meta["uiLocale"] = snapshot.uiLocale;
+          broadcast({ type: "prefs.updated", payload: { uiLocale: snapshot.uiLocale } });
+        }
+      }
+      const activeId = opts.agent.ctx.provider.id;
+      const newCfgStr = JSON.stringify(snapshot.providers[activeId] ?? null);
+      if (newCfgStr === lastActiveCfg) return;
+      lastActiveCfg = newCfgStr;
+      try {
+        const newCfg = snapshot.providers[activeId] ?? {
+          type: activeId,
+          ...snapshot.apiKey !== void 0 ? { apiKey: snapshot.apiKey } : {},
+          ...snapshot.baseUrl !== void 0 ? { baseUrl: snapshot.baseUrl } : {}
+        };
+        const oldMax = opts.agent.ctx.provider.capabilities?.maxContext;
+        const prov = makeProviderFromConfig(activeId, {
+          ...newCfg,
+          type: newCfg.type ?? activeId
+        });
+        if (oldMax != null && prov.capabilities) prov.capabilities.maxContext = oldMax;
+        opts.agent.ctx.provider = prov;
+        console.log(`[WebUI] Provider credentials reloaded from config.json (${activeId})`);
+      } catch (err) {
+        console.warn(
+          `[WebUI] Credential hot-reload failed for ${activeId}: ${toErrorMessage(err)}`
+        );
+      }
+    },
+    {
+      warn: (m) => console.warn(
+        JSON.stringify({
+          level: "warn",
+          event: "webui.config_watcher",
+          message: m,
+          timestamp: (/* @__PURE__ */ new Date()).toISOString()
+        })
+      )
+    }
+  );
+  return watcher.close;
+}
+
+// src/webui-server/provider-plane.ts
+function createEmbeddedProviderPlane(input) {
+  const { opts, profileConfigPath, send, broadcast } = input;
+  const wsHandlerCtx = {
+    providerStore: createProviderConfigStore(
+      profileConfigPath,
+      () => opts.appConfig?.providers ?? {}
+    ),
+    modelsRegistry: opts.modelsRegistry,
+    providerAuthRegistry: opts.providerAuthRegistry,
+    getDisabledModels: () => opts.appConfig?.disabledModels ?? [],
+    getDisabledProviders: () => opts.appConfig?.disabledProviders ?? [],
+    send,
+    broadcast,
+    log: (m) => console.log(m)
+  };
+  const embeddedProviderOperations = createEmbeddedProviderOperations(wsHandlerCtx);
+  const credentialWatcherClose = startWebuiCredentialWatcher({
+    opts,
+    profileConfigPath,
+    broadcast,
+    broadcastSaved: (providers) => embeddedProviderOperations.broadcastSaved(providers)
+  });
+  return { wsHandlerCtx, credentialWatcherClose };
+}
+
+// src/webui-server/route-contexts.ts
+import * as path6 from "node:path";
+import {
+  normalizeSubagentModelPlan,
+  seedSessionSubagentPolicy,
+  setSessionSubagentModelPlan,
+  setSessionSubagentPolicy,
+  subagentPolicyModeFrom
+} from "@wrongstack/core/coordination";
+import { TOKENS as TOKENS2 } from "@wrongstack/core/kernel";
+import { SkillInstaller } from "@wrongstack/core/skills";
+import { PromptUsageStore } from "@wrongstack/core/storage";
+import { resolveTokenSavingTier } from "@wrongstack/core/types";
+import { isOutsideProject, resolveWstackPaths as resolveWstackPaths3 } from "@wrongstack/core/utils";
+import {
+  createChimeraRouteHandlers,
+  createCodeAssistRouteHandlers,
+  createMailboxRouteHandlers,
+  rebuildSystemPrompt
+} from "@wrongstack/webui-server";
+function createWebuiRouteContexts({
+  opts,
+  profileConfigPath,
+  profileDir,
+  globalRoot,
+  sessionStartedAt,
+  currentSessionId,
+  getCustomModeStore,
+  buildSessionStartPayload,
+  prefSnapshot,
+  persistPrefs,
+  pendingConfirms,
+  abortControllers,
+  getSessionAgent,
+  peekSessionAgent,
+  isSessionLive,
+  getForegroundSession,
+  setForegroundSession,
+  clients,
+  onSessionsUndisplayed,
+  autoWake,
+  stopSessionFleet,
+  send,
+  broadcast,
+  broadcastEveryone
+}) {
+  const brainCtx = {
+    brainSettings: opts.brainSettings,
+    brainRuntime: opts.brainRuntime,
+    getBrainLog: opts.getBrainLog,
+    resolveArbiter: () => opts.brain ?? (opts.agent.container.has(TOKENS2.BrainArbiter) ? opts.agent.container.resolve(TOKENS2.BrainArbiter) : void 0),
+    getSessionId: currentSessionId,
+    send
+  };
+  const introspectionConfigStore = opts.agent.container?.safeResolve?.(TOKENS2.ConfigStore);
+  const introspectionCtx = {
+    agent: opts.agent,
+    // Answer `diag.get` / `stats.get` / `side_effects.list` from the agent that
+    // owns the ASKING session. `opts.agent` is the leader, i.e. whichever tab
+    // the runtime last switched to, so a background tab asking for its own
+    // stats got the foreground's numbers stamped with the foreground's id —
+    // which the browser's session filter then dropped, leaving the panel blank.
+    // Read path, so `peek` first: `getAgent` creates, and materialising an
+    // agent for a stale id can evict a live tab's.
+    getAgent: (sessionId) => peekSessionAgent?.(sessionId) ?? (sessionId ? getSessionAgent(sessionId) : opts.agent),
+    modelsRegistry: opts.modelsRegistry,
+    configStore: introspectionConfigStore,
+    getConfig: () => {
+      const cfg = introspectionConfigStore?.get() ?? opts.appConfig;
+      if (!cfg)
+        throw new Error(
+          "Introspection route requires a config but neither ConfigStore nor opts.appConfig is available"
+        );
+      return cfg;
+    },
+    getProjectRoot: () => opts.projectRoot ?? opts.agent.ctx.projectRoot ?? "",
+    getSessionId: currentSessionId,
+    getSessionStartedAt: () => sessionStartedAt,
+    getModeId: () => opts.modeId ?? "default",
+    send
+  };
+  const skillsProjectRoot = opts.projectRoot ?? opts.agent.ctx.projectRoot ?? "";
+  const skillsPaths = skillsProjectRoot ? resolveWstackPaths3({
+    projectRoot: skillsProjectRoot,
+    globalRoot
+  }) : void 0;
+  const skillsCtx = {
+    skillLoader: opts.skillLoader,
+    skillInstaller: opts.skillLoader ? new SkillInstaller({
+      manifestPath: path6.join(skillsPaths?.configDir ?? profileDir, "installed-skills.json"),
+      projectSkillsDir: skillsPaths?.inProjectSkills ?? path6.join(skillsProjectRoot, ".wrongstack", "skills"),
+      globalSkillsDir: skillsPaths?.globalSkills ?? path6.join(profileDir, "skills"),
+      projectHash: skillsPaths?.projectHash ?? "",
+      skillLoader: opts.skillLoader
+    }) : void 0,
+    projectRoot: skillsProjectRoot,
+    projectSkillsDir: skillsPaths?.inProjectSkills,
+    globalSkillsDir: skillsPaths?.globalSkills
+  };
+  const promptsCtx = {
+    promptLoader: opts.promptLoader,
+    promptUsage: new PromptUsageStore(
+      skillsPaths?.promptUsage ?? path6.join(profileDir, "prompt-usage.json")
+    )
+  };
+  const designCtx = (sessionId) => ({
+    projectRoot: skillsProjectRoot,
+    agentMeta: (sessionId ? getSessionAgent(sessionId)?.ctx : void 0) ?? opts.agent.ctx
+  });
+  const agentConfigCtx = {
+    agent: opts.agent,
+    modeStore: opts.modeStore,
+    loadSavedProviders: () => loadSavedProviders(profileConfigPath),
+    buildSessionStart: (overrides) => buildSessionStartPayload(overrides),
+    modelsRegistry: opts.modelsRegistry,
+    memoryStore: opts.memoryStore,
     getConfig: () => opts.appConfig,
     onMaxContextResolved: opts.onModelContextResolved,
     persistPrefs,
@@ -1458,7 +1409,7 @@ function createWebuiRouteContexts({
   };
   const mailboxRoutes = createMailboxRouteHandlers({
     getProjectRoot: () => opts.projectRoot ?? opts.agent.ctx.projectRoot ?? "",
-    getGlobalRoot: () => opts.globalConfigPath ? path5.dirname(opts.globalConfigPath) : "",
+    getGlobalRoot: () => opts.globalConfigPath ? path6.dirname(opts.globalConfigPath) : "",
     events: opts.events
   });
   const chimeraRoutes = createChimeraRouteHandlers({
@@ -1467,7 +1418,7 @@ function createWebuiRouteContexts({
     // lives. A project switch re-roots it, hence the getter.
     projectDir: () => resolveWstackPaths3({
       projectRoot: opts.projectRoot ?? opts.agent.ctx.projectRoot ?? "",
-      globalRoot: opts.globalConfigPath ? path5.dirname(opts.globalConfigPath) : ""
+      globalRoot: opts.globalConfigPath ? path6.dirname(opts.globalConfigPath) : ""
     }).projectDir,
     send,
     log: (m) => console.warn(m)
@@ -1540,8 +1491,29 @@ function createWebuiRouteContexts({
   };
 }
 
+// src/webui-server/session-agents.ts
+import { createSessionAgentRegistry } from "@wrongstack/webui-server";
+function createEmbeddedSessionAgents(opts, clients, abortControllers) {
+  const isSessionDisplayed = (sessionId) => {
+    for (const client of clients.values()) {
+      if (client.sessionId === sessionId) return true;
+      if (client.sessionIds?.has(sessionId) === true) return true;
+    }
+    return false;
+  };
+  const sessionAgents = createSessionAgentRegistry({
+    template: opts.agent,
+    ...opts.modelsRegistry ? { modelsRegistry: opts.modelsRegistry } : {},
+    isRunActive: (sessionId) => abortControllers.has(sessionId),
+    // A tab that is still on screen must outlive one that was closed, whatever
+    // order their agents were created in.
+    isDisplayed: isSessionDisplayed
+  });
+  return { sessionAgents, isSessionDisplayed };
+}
+
 // src/webui-server/session-start-payload.ts
-import * as path6 from "node:path";
+import * as path7 from "node:path";
 import { DEFAULT_CONTEXT_WINDOW_MODE_ID } from "@wrongstack/core/types";
 import { catalogProviderIdFor } from "@wrongstack/providers";
 import { protocolAdvertisement } from "@wrongstack/webui-protocol";
@@ -1579,220 +1551,635 @@ function createSessionStartPayloadBuilder(deps) {
       } else {
         maxContext = ctx.provider.capabilities?.maxContext ?? 0;
       }
-    } catch {
-    }
-    const lastInputTokens = typeof ctx.lastRequestTokens === "number" && ctx.lastRequestTokens > 0 ? ctx.lastRequestTokens : 0;
-    return {
-      sessionId: targetSessionId,
-      ...startedAt ? { startedAt } : {},
-      model: ctx.model,
-      provider: ctx.provider.id,
-      mode: deps.modeId ?? "default",
-      projectName: deps.projectRoot ? path6.basename(deps.projectRoot) : void 0,
-      // Frontend reads `projectRoot` from session.start (ws-handlers setEnv) —
-      // omitting it left the store's projectRoot empty after a project switch.
-      projectRoot: deps.projectRoot ?? ctx.projectRoot ?? "",
-      cwd: deps.projectRoot ?? ctx.projectRoot ?? "",
-      needsSetup,
-      // true when provider/model not configured and running in --webui mode
-      contextMode: String(ctx.meta?.["contextWindowMode"] ?? DEFAULT_CONTEXT_WINDOW_MODE_ID),
-      maxContext,
-      inputCost,
-      outputCost,
-      cacheReadCost,
-      lastInputTokens,
-      providerStatuses: deps.statusTracker?.getAllStatuses() ?? [],
-      appVersion: updateInfo?.current,
-      latestVersion: updateInfo?.latest,
-      updateAvailable: updateInfo?.outdated ?? false,
-      updateCheckFailed: updateInfo?.checkFailed ?? false,
-      ...protocolAdvertisement(),
-      ...overrides
-    };
-  };
+    } catch {
+    }
+    const lastInputTokens = typeof ctx.lastRequestTokens === "number" && ctx.lastRequestTokens > 0 ? ctx.lastRequestTokens : 0;
+    return {
+      sessionId: targetSessionId,
+      ...startedAt ? { startedAt } : {},
+      model: ctx.model,
+      provider: ctx.provider.id,
+      mode: deps.modeId ?? "default",
+      projectName: deps.projectRoot ? path7.basename(deps.projectRoot) : void 0,
+      // Frontend reads `projectRoot` from session.start (ws-handlers setEnv) —
+      // omitting it left the store's projectRoot empty after a project switch.
+      projectRoot: deps.projectRoot ?? ctx.projectRoot ?? "",
+      cwd: deps.projectRoot ?? ctx.projectRoot ?? "",
+      needsSetup,
+      // true when provider/model not configured and running in --webui mode
+      contextMode: String(ctx.meta?.["contextWindowMode"] ?? DEFAULT_CONTEXT_WINDOW_MODE_ID),
+      maxContext,
+      inputCost,
+      outputCost,
+      cacheReadCost,
+      lastInputTokens,
+      providerStatuses: deps.statusTracker?.getAllStatuses() ?? [],
+      appVersion: updateInfo?.current,
+      latestVersion: updateInfo?.latest,
+      updateAvailable: updateInfo?.outdated ?? false,
+      updateCheckFailed: updateInfo?.checkFailed ?? false,
+      ...protocolAdvertisement(),
+      ...overrides
+    };
+  };
+}
+
+// src/webui-server/session-start-live.ts
+function createLiveSessionStartPayloadBuilder(opts, getSessionAgents) {
+  return createSessionStartPayloadBuilder({
+    ...opts,
+    // Read through to the live `opts`, do NOT snapshot: `projects.select`
+    // re-roots the host by assigning `opts.projectRoot` / `opts.session` on
+    // this very object. A spread copy froze both at boot, so every
+    // `session.start` broadcast after a project switch still announced the
+    // previous project's root — the switch looked like it had not happened.
+    get projectRoot() {
+      return opts.projectRoot;
+    },
+    get session() {
+      return opts.session;
+    },
+    get appConfig() {
+      return opts.appConfig;
+    },
+    // `peek`, never `get`: building a payload must not materialise an agent
+    // for a session id that arrived from a stale browser tab.
+    getSessionContext: (sessionId) => getSessionAgents()?.peek(sessionId)?.ctx
+  });
+}
+
+// src/webui-server/setup-events.ts
+import { mailboxSessionTag as mailboxSessionTag2 } from "@wrongstack/core/coordination";
+import {
+  createEternalSubscription,
+  setupEvents as setupCanonicalEvents
+} from "@wrongstack/webui-server";
+function createSetupEvents(deps) {
+  let fleetConcurrency = 0;
+  let fleetConcurrencyMax = 4;
+  const emitConcurrency = () => {
+    const budget = deps.getFleetBudget?.() ?? null;
+    deps.broadcast({
+      type: "fleet.concurrency_update",
+      // Deliberately UNSTAMPED. The spawn/concurrency budget is one ceiling
+      // for the whole process — every tab draws from it and the client keeps
+      // it in a single global store — so this is a project-wide fact, not a
+      // conversation's. Stamping it with the runtime's session made it a
+      // conversation's by accident: `clientWantsSession` then dropped it for
+      // any page whose declared tabs did not include that session, and the
+      // fleet gauges froze the moment the boot tab was closed.
+      payload: {
+        fleetConcurrency: budget?.activeAgents ?? fleetConcurrency,
+        fleetConcurrencyMax: budget?.maxConcurrent ?? fleetConcurrencyMax,
+        ...budget ? {
+          maxSpawns: budget.maxSpawns,
+          usedSpawns: budget.usedSpawns,
+          remainingSpawns: budget.remainingSpawns,
+          maxSpawnsSource: budget.maxSpawnsSource,
+          maxConcurrentSource: budget.maxConcurrentSource,
+          effectiveSource: budget.effectiveSource,
+          checkpointMaxSpawns: budget.checkpointMaxSpawns,
+          ceilingMismatch: budget.ceilingMismatch
+        } : {}
+      }
+    });
+  };
+  return function setupEvents() {
+    for (const unsubscribe of deps.eventUnsubscribers) unsubscribe();
+    deps.eventUnsubscribers.length = 0;
+    const maxIterations = deps.agent.ctx?.meta?.["maxIterations"];
+    const disposeCanonical = setupCanonicalEvents({
+      events: deps.events,
+      // The third argument is not decoration: it names the tab that OWNS a
+      // subagent, and the frames that pass it carry the subagent's own
+      // session on the payload. Dropping it here routed every subagent
+      // codemap frame at a session no tab subscribes to.
+      broadcast: (_clients, message, targetSessionId) => targetSessionId !== void 0 ? deps.broadcast(message, targetSessionId) : deps.broadcast(message),
+      clients: deps.getClients(),
+      config: {
+        tools: {
+          ...typeof maxIterations === "number" ? { maxIterations } : {}
+        }
+      },
+      context: deps.agent.ctx,
+      ...deps.sessionContext ? { sessionContext: deps.sessionContext } : {},
+      pendingConfirms: deps.pendingConfirms,
+      globalConfigPath: deps.globalConfigPath,
+      onFleetBroadcaster: deps.onFleetBroadcaster,
+      projection: {
+        scrubObject: (value) => deps.secretScrubber.scrubObject(value),
+        queueTextDelta: deps.queueTextDelta,
+        queueThinkingDelta: deps.queueThinkingDelta,
+        queueToolProgress: (payload) => deps.queueToolProgress(payload),
+        flushThinkingDelta: deps.flushThinkingDelta,
+        flushAllStreamBuffers: deps.flushAllStreamBuffers
+      }
+    });
+    deps.eventUnsubscribers.push(disposeCanonical);
+    deps.broadcast({
+      type: "subagent.event",
+      payload: deps.sessionPayload({
+        kind: "leader_updated",
+        subagentId: `leader@${mailboxSessionTag2(deps.currentSessionId())}`,
+        isLeader: true,
+        name: "Leader",
+        status: "running"
+      })
+    });
+    emitConcurrency();
+    deps.eventUnsubscribers.push(
+      deps.events.on("concurrency.changed", (event) => {
+        fleetConcurrencyMax = Math.max(1, event.n);
+        emitConcurrency();
+      }),
+      deps.events.on("subagent.spawned", () => {
+        fleetConcurrency += 1;
+        emitConcurrency();
+      }),
+      deps.events.on("subagent.task_completed", () => {
+        fleetConcurrency = Math.max(0, fleetConcurrency - 1);
+        emitConcurrency();
+      })
+    );
+    if (deps.subscribeEternalIteration) {
+      const subscription = createEternalSubscription(
+        deps.subscribeEternalIteration,
+        (_clients, message) => deps.broadcast(message),
+        deps.getClients
+      );
+      deps.eventUnsubscribers.push(() => subscription.dispose());
+    }
+  };
+}
+
+// src/webui-server/stream-coalescer.ts
+import {
+  createStreamCoalescer
+} from "@wrongstack/webui-server";
+
+// src/webui-server/transport.ts
+import {
+  clientWantsSession,
+  sendSerialized,
+  stampDispatchSession,
+  webuiSessionFrameLog
+} from "@wrongstack/webui-server";
+function createWebuiTransport(clients) {
+  function send(ws, msg) {
+    sendSerialized(ws, JSON.stringify(stampDispatchSession(msg)));
+  }
+  function broadcast(msg, targetSessionId) {
+    const payload = msg.payload;
+    const sessionId = targetSessionId ?? (payload && typeof payload === "object" && typeof payload.sessionId === "string" ? payload.sessionId : void 0);
+    const data = sessionId ? webuiSessionFrameLog().sequence(sessionId, msg) : JSON.stringify(msg);
+    for (const [ws, client] of clients) {
+      if (clientWantsSession(client, sessionId)) sendSerialized(ws, data);
+    }
+  }
+  function broadcastEveryone(msg) {
+    const data = JSON.stringify(msg);
+    for (const [ws] of clients) sendSerialized(ws, data);
+  }
+  function sendResult(ws, success, message) {
+    send(ws, { type: "key.operation_result", payload: { success, message } });
+  }
+  return { send, broadcast, broadcastEveryone, sendResult };
+}
+
+// src/webui-server-lifecycle.ts
+import { toErrorMessage as toErrorMessage2 } from "@wrongstack/core/utils/error";
+
+// src/webui-server/connection-handler.ts
+import { deriveSessionAgents } from "@wrongstack/core/storage";
+import { buildReplayPayload, decodeProtocolFrame } from "@wrongstack/webui-protocol";
+import {
+  createConnectionLifecycle,
+  verifyClient as verifyWsClient2
+} from "@wrongstack/webui-server";
+function createConnectionHandler(deps) {
+  const clientHandlers = [
+    deps.goalHandler,
+    deps.specsHandler,
+    deps.sddBoardHandler,
+    ...deps.sddWizardHandler ? [deps.sddWizardHandler] : [],
+    deps.worktreeHandler,
+    deps.terminalHandler
+  ];
+  return createConnectionLifecycle({
+    clients: deps.clients,
+    pendingConfirms: deps.pendingConfirms,
+    // ── Auth trust model ────────────────────────────────────────────────
+    // Three layered defenses (see verifyClient in @wrongstack/webui-server/ws-auth):
+    //   1. DNS-rebinding guard (Host header must be loopback on loopback bind)
+    //   2. Shared-token auth via Cookie (ws_token) or URL query param (?token=)
+    //   3. Loopback bootstrap: when requireToken=false (default) AND the server
+    //      is bound to a loopback interface, browser clients bypass token auth
+    //      entirely — the Origin header being http://localhost is sufficient.
+    //
+    // COOKIE PERSISTENCE AFTER TOKEN ROTATION:
+    // The HttpOnly ws_token cookie, once set by /ws-auth, survives a process
+    // restart. On the next process the expectedToken is a fresh random value,
+    // so the old cookie alone would fail the token check. However, on a
+    // loopback bind with requireToken=false (default), the loopback-bootstrap
+    // path at layer 3 accepts the connection before the cookie is ever
+    // compared — the old cookie is harmless because no token is needed.
+    //
+    // This means a token rotation (e.g. the operator sets a new accessToken
+    // in config) does NOT invalidate already-distributed cookies for loopback
+    // clients. The mitigating factors:
+    //   - Loopback bind + requireToken=false already trusts any local process
+    //     that can reach 127.0.0.1 — a trivial perimeter.
+    //   - A LAN/0.0.0.0 bind with requireToken=true DOES enforce cookie
+    //     matching against the new expectedToken on every reconnect.
+    // If stronger isolation is needed, set requireToken=true or rebind the
+    // server to a non-loopback interface with token enforcement.
+    authenticate: (ws, req) => {
+      const allowed = verifyWsClient2({
+        origin: req.headers.origin,
+        url: req.url ?? "/",
+        hostHeader: req.headers.host,
+        remoteAddress: req.socket.remoteAddress,
+        cookieHeader: req.headers.cookie,
+        wsHost: deps.host,
+        expectedToken: deps.wsToken,
+        requireToken: deps.requireToken,
+        allowedHostnames: deps.publicHostnames,
+        allowBrowserUrlToken: Boolean(deps.publicWsUrl)
+      });
+      if (!allowed) ws.close(4003, "Forbidden");
+      return allowed;
+    },
+    createClient: (ws) => ({ ws, sessionId: deps.currentSessionId() }),
+    // Enrich parse-failure / unknown-type logs with per-connection identity
+    // so operators can identify which client sent a malformed frame. The
+    // `connectionId`/`sessionId` fields are read from the `client` argument
+    // directly inside `logRejection`; the CLI's `ConnectedClient` only has
+    // `sessionId` (no per-socket `connId`), so the verbose payload carries
+    // `sessionId` only. Server-wide identity (`agentId`/`projectRoot`) isn't
+    // in scope at this handler and is omitted.
+    verboseWsLogging: true,
+    registerClient: (ws) => {
+      for (const handler of clientHandlers) handler.addClient(ws);
+    },
+    decode: (raw) => decodeProtocolFrame(raw, "client"),
+    dispatch: deps.handleMessage,
+    send: deps.send,
+    sessionPayload: deps.sessionPayload,
+    rateLimitMax: deps.rateLimitMax,
+    // NOTE — a closed SOCKET is not a stopped run.
+    //
+    // This used to `abortControllers.delete(client.sessionId)` — a delete
+    // WITHOUT an abort, and only for the tab this connection last acted on.
+    // Both halves were wrong. The run kept going while `isRunActive` reported
+    // `false`, so `session.delete` would happily unlink the journal a live run
+    // was still appending to, and the next `user_message` claimed a second
+    // lock for the same session and hit `Agent.run() is already in progress`.
+    // The other three declared tabs were never touched at all.
+    //
+    // Doing nothing is the correct behaviour: a background run outlives the
+    // tab that started it (the same invariant `retireUndisplayedSessions`
+    // honours), and the run's own `finally` releases the lock when it unwinds.
+    // A page that comes back is told what is still running by
+    // `session.run_state`; a browser that never comes back drains its
+    // unanswerable permission prompts through the last-client drain in
+    // `connection-lifecycle.ts`, which lets a wedged run finish and release.
+    //
+    // So there is deliberately NO `onClose` here.
+    buildInitialPayload: async () => {
+      const payload = { ...await deps.buildSessionStartPayload({}, deps.needsSetup) };
+      try {
+        const open = deps.openSessionIds?.();
+        if (open) payload["openSessionIds"] = [.../* @__PURE__ */ new Set([...open, deps.currentSessionId()])];
+      } catch {
+        console.debug("[WebUI] Failed to list open sessions");
+      }
+      let replayEvents;
+      try {
+        const replay = await deps.loadReplay?.();
+        if (replay) {
+          Object.assign(payload, buildReplayPayload(replay));
+          replayEvents = replay.events;
+        }
+      } catch {
+        console.debug("[WebUI] Failed to load replay");
+      }
+      try {
+        const roster = deriveSessionAgents(replayEvents ?? []);
+        const sessions = roster.length > 0 ? await deps.loadAgentSessions?.(roster.map((agent) => agent.agentId)) : [];
+        if (sessions?.length) payload["agentSessions"] = sessions;
+      } catch {
+        console.debug("[WebUI] Failed to load agent sessions");
+      }
+      return payload;
+    }
+  });
+}
+
+// src/webui-server-lifecycle.ts
+function runWebuiServerLifecycle({
+  host,
+  httpPort,
+  setupEvents,
+  opts,
+  wsPort,
+  accessUrl,
+  wsToken,
+  webuiInstanceRegistered,
+  wss,
+  httpServer,
+  requireToken,
+  publicHostnames,
+  publicWsUrl,
+  clients,
+  currentSessionId,
+  goalHandler,
+  specsHandler,
+  sddBoardHandler,
+  sddWizardHandler,
+  worktreeHandler,
+  terminalHandler,
+  rateLimitMax,
+  send,
+  sessionPayload,
+  handleMessage,
+  pendingConfirms,
+  buildSessionStartPayload,
+  sessionAgents,
+  lifecycleState,
+  abortControllers,
+  flushAllStreamBuffers,
+  eventUnsubscribers,
+  releaseSessionSalvage,
+  autoWakeHost,
+  stopEmptySessionCleanup,
+  credentialWatcherClose,
+  kanbanRunMirror,
+  kanbanSupervisor,
+  stopKanbanSupervisorMemoryStats,
+  unregisterWebuiClient,
+  ipv6LoopbackServer,
+  registryBaseDir,
+  stopLiveStatusLogger,
+  terminalLogView
+}) {
+  const stopped = new Promise((resolve) => {
+    let listeningAnnounced = false;
+    const announceListening = () => {
+      if (listeningAnnounced) return;
+      listeningAnnounced = true;
+      console.log(`[WebUI] WebSocket server running on ws://${host}:${httpPort}`);
+      try {
+        setupEvents();
+        opts.onListening?.({
+          httpPort,
+          wsPort,
+          host,
+          url: accessUrl,
+          authToken: wsToken,
+          webuiInstanceRegistered
+        });
+      } catch (err) {
+        consoleLogger.error("setup_events_failed", { message: toErrorMessage2(err) });
+      }
+    };
+    wss.on("listening", announceListening);
+    if (httpServer?.server.listening || wss.address()) queueMicrotask(announceListening);
+    wss.on(
+      "connection",
+      createConnectionHandler({
+        host,
+        wsToken,
+        requireToken,
+        publicHostnames,
+        publicWsUrl,
+        clients,
+        currentSessionId,
+        goalHandler,
+        specsHandler,
+        sddBoardHandler,
+        sddWizardHandler,
+        worktreeHandler,
+        terminalHandler,
+        rateLimitMax,
+        send,
+        sessionPayload,
+        handleMessage,
+        pendingConfirms,
+        buildSessionStartPayload,
+        loadReplay: async () => {
+          const activeSession = opts.agent.ctx.session ?? opts.session;
+          await activeSession.flush();
+          if (opts.sessionStore) {
+            const data = await opts.sessionStore.load(activeSession.id);
+            return { messages: data.messages, events: data.events, usage: data.usage };
+          }
+          const usage = opts.agent.ctx.tokenCounter.total();
+          return { messages: opts.agent.ctx.messages, usage };
+        },
+        loadAgentSessions: async (subagentIds) => await opts.agentTranscripts?.loadSessionsFromDisk(subagentIds) ?? [],
+        // What this process is actually holding right now. The browser
+        // reconciles its persisted tab strip against it, so a restarted server
+        // is not dressed in the previous run's tabs.
+        openSessionIds: () => sessionAgents.ids(),
+        needsSetup: opts.needsSetup ?? false
+      })
+    );
+    lifecycleState.signalShutdown = createWebuiShutdown({
+      abortInFlight: () => {
+        void lifecycleState.embeddedAutoHealDispose?.();
+        for (const c of abortControllers.values()) c.abort();
+        abortControllers.clear();
+      },
+      unsubscribeEvents: () => {
+        flushAllStreamBuffers();
+        for (const unsub of eventUnsubscribers) unsub();
+      },
+      stopOwnedChildren: async () => {
+        try {
+          const { getProcessRegistry } = await import("@wrongstack/tools");
+          getProcessRegistry().killAll({ force: true, includeProtected: true });
+        } catch (err) {
+          console.debug(
+            `[webui-server] process-registry killAll failed: ${err instanceof Error ? err.message : String(err)}`
+          );
+        }
+        if (opts.mcpRegistry) {
+          try {
+            await opts.mcpRegistry.stopAll();
+          } catch (err) {
+            console.debug(
+              `[webui-server] mcpRegistry.stopAll failed: ${err instanceof Error ? err.message : String(err)}`
+            );
+          }
+        }
+      },
+      disposeResources: async () => {
+        releaseSessionSalvage();
+        autoWakeHost?.dispose();
+        await stopEmptySessionCleanup?.dispose();
+        await sessionAgents.closeAll().catch(() => void 0);
+        credentialWatcherClose?.();
+        credentialWatcherClose = void 0;
+        goalHandler.dispose();
+        sddBoardHandler.dispose();
+        worktreeHandler.dispose();
+        terminalHandler.dispose();
+        kanbanRunMirror?.dispose();
+        kanbanSupervisor?.dispose();
+        void stopKanbanSupervisorMemoryStats?.();
+        await lifecycleState.embeddedAutoHealDispose?.();
+        lifecycleState.embeddedAutoHealDispose = null;
+        unregisterWebuiClient();
+      },
+      closeClients: () => {
+        for (const [ws] of clients) ws.close();
+        clients.clear();
+      },
+      closeHttpServer: () => {
+        ipv6LoopbackServer?.close();
+        httpServer?.server.close();
+      },
+      wss,
+      pid: process.pid,
+      registryBaseDir,
+      onStopped: () => {
+        stopLiveStatusLogger();
+        const muted = terminalLogView.mutedCount;
+        terminalLogView.stop();
+        if (muted > 0) {
+          console.log(
+            `[WebUI] ${muted} progress line(s) kept out of this terminal \u2014 set WEBUI_LOGS=1 to stream them.`
+          );
+        }
+        opts.onExit?.();
+        resolve();
+      }
+    });
+    registerWebuiSignalHandlers(lifecycleState.signalShutdown);
+  });
+  return { stopped };
 }
 
-// src/webui-server/setup-events.ts
-import { mailboxSessionTag as mailboxSessionTag2 } from "@wrongstack/core/coordination";
+// src/webui-session-maintenance.ts
 import {
-  createEternalSubscription,
-  setupEvents as setupCanonicalEvents
+  collectDisplayedSessionIds,
+  scheduleOwnerlessEmptySessionCleanup,
+  toSessionHistoryEntries
 } from "@wrongstack/webui-server";
-function createSetupEvents(deps) {
-  let fleetConcurrency = 0;
-  let fleetConcurrencyMax = 4;
-  const emitConcurrency = () => {
-    const budget = deps.getFleetBudget?.() ?? null;
-    deps.broadcast({
-      type: "fleet.concurrency_update",
-      // Deliberately UNSTAMPED. The spawn/concurrency budget is one ceiling
-      // for the whole process — every tab draws from it and the client keeps
-      // it in a single global store — so this is a project-wide fact, not a
-      // conversation's. Stamping it with the runtime's session made it a
-      // conversation's by accident: `clientWantsSession` then dropped it for
-      // any page whose declared tabs did not include that session, and the
-      // fleet gauges froze the moment the boot tab was closed.
-      payload: {
-        fleetConcurrency: budget?.activeAgents ?? fleetConcurrency,
-        fleetConcurrencyMax: budget?.maxConcurrent ?? fleetConcurrencyMax,
-        ...budget ? {
-          maxSpawns: budget.maxSpawns,
-          usedSpawns: budget.usedSpawns,
-          remainingSpawns: budget.remainingSpawns,
-          maxSpawnsSource: budget.maxSpawnsSource,
-          maxConcurrentSource: budget.maxConcurrentSource,
-          effectiveSource: budget.effectiveSource,
-          checkpointMaxSpawns: budget.checkpointMaxSpawns,
-          ceilingMismatch: budget.ceilingMismatch
-        } : {}
-      }
+function setupWebuiSessionMaintenance({
+  opts,
+  broadcastEveryone,
+  getForegroundSession,
+  clients,
+  abortControllers
+}) {
+  const refreshSessionHistory = async () => {
+    const list = await opts.sessionStore?.list(200);
+    if (!list) return;
+    broadcastEveryone({
+      type: "sessions.list",
+      payload: { sessions: toSessionHistoryEntries(list, getForegroundSession().id) }
     });
   };
-  return function setupEvents() {
-    for (const unsubscribe of deps.eventUnsubscribers) unsubscribe();
-    deps.eventUnsubscribers.length = 0;
-    const maxIterations = deps.agent.ctx?.meta?.["maxIterations"];
-    const disposeCanonical = setupCanonicalEvents({
-      events: deps.events,
-      // The third argument is not decoration: it names the tab that OWNS a
-      // subagent, and the frames that pass it carry the subagent's own
-      // session on the payload. Dropping it here routed every subagent
-      // codemap frame at a session no tab subscribes to.
-      broadcast: (_clients, message, targetSessionId) => targetSessionId !== void 0 ? deps.broadcast(message, targetSessionId) : deps.broadcast(message),
-      clients: deps.getClients(),
-      config: {
-        tools: {
-          ...typeof maxIterations === "number" ? { maxIterations } : {}
-        }
-      },
-      context: deps.agent.ctx,
-      ...deps.sessionContext ? { sessionContext: deps.sessionContext } : {},
-      pendingConfirms: deps.pendingConfirms,
-      globalConfigPath: deps.globalConfigPath,
-      onFleetBroadcaster: deps.onFleetBroadcaster,
-      projection: {
-        scrubObject: (value) => deps.secretScrubber.scrubObject(value),
-        queueTextDelta: deps.queueTextDelta,
-        queueThinkingDelta: deps.queueThinkingDelta,
-        queueToolProgress: (payload) => deps.queueToolProgress(payload),
-        flushThinkingDelta: deps.flushThinkingDelta,
-        flushAllStreamBuffers: deps.flushAllStreamBuffers
-      }
-    });
-    deps.eventUnsubscribers.push(disposeCanonical);
-    deps.broadcast({
-      type: "subagent.event",
-      payload: deps.sessionPayload({
-        kind: "leader_updated",
-        subagentId: `leader@${mailboxSessionTag2(deps.currentSessionId())}`,
-        isLeader: true,
-        name: "Leader",
-        status: "running"
-      })
-    });
-    emitConcurrency();
-    deps.eventUnsubscribers.push(
-      deps.events.on("concurrency.changed", (event) => {
-        fleetConcurrencyMax = Math.max(1, event.n);
-        emitConcurrency();
-      }),
-      deps.events.on("subagent.spawned", () => {
-        fleetConcurrency += 1;
-        emitConcurrency();
-      }),
-      deps.events.on("subagent.task_completed", () => {
-        fleetConcurrency = Math.max(0, fleetConcurrency - 1);
-        emitConcurrency();
-      })
-    );
-    if (deps.subscribeEternalIteration) {
-      const subscription = createEternalSubscription(
-        deps.subscribeEternalIteration,
-        (_clients, message) => deps.broadcast(message),
-        deps.getClients
-      );
-      deps.eventUnsubscribers.push(() => subscription.dispose());
+  const emptySessionCleanup = opts.sessionStore ? scheduleOwnerlessEmptySessionCleanup({
+    getSessionStore: () => opts.sessionStore,
+    getActiveSessionId: () => getForegroundSession().id,
+    getActiveSessionIds: () => collectDisplayedSessionIds({ getSession: getForegroundSession, clients }),
+    // A run outlives the tab that started it, and a turn that has not
+    // written its first record yet looks exactly like a session nobody
+    // ever used.
+    hasParticipants: (sessionId) => abortControllers.has(sessionId),
+    refreshSessions: refreshSessionHistory,
+    logger: consoleLogger
+  }) : null;
+  const offSessionRenamed = opts.sessionStore ? opts.events.on("session.renamed", () => {
+    void refreshSessionHistory().catch(() => void 0);
+  }) : void 0;
+  const stopEmptySessionCleanup = emptySessionCleanup && {
+    runNow: emptySessionCleanup.runNow,
+    dispose: async () => {
+      offSessionRenamed?.();
+      await emptySessionCleanup.dispose();
     }
   };
+  return { stopEmptySessionCleanup };
 }
 
-// src/webui-server/static-serve.ts
-import {
-  ensureDistDir,
-  resolveDistDir,
-  startStaticServe
-} from "@wrongstack/webui-server";
-
-// src/webui-server/stream-coalescer.ts
-import {
-  createStreamCoalescer
-} from "@wrongstack/webui-server";
+// src/webui-session-retirement.ts
+import { resolvePendingConfirmsForSession } from "@wrongstack/webui-server";
+function createWebuiSessionRetirement(inputs) {
+  const { opts, getForegroundSession, pendingConfirms, abortControllers, sessionAgents } = inputs;
+  const retireUndisplayedSessions = (sessionIds) => {
+    for (const sessionId of sessionIds) {
+      if (!sessionId || sessionId === opts.session.id) continue;
+      if (sessionId === getForegroundSession().id) continue;
+      const orphaned = resolvePendingConfirmsForSession(pendingConfirms, sessionId);
+      if (orphaned > 0) {
+        console.log(
+          JSON.stringify({
+            level: "warn",
+            event: "webui.confirm_orphaned_by_tab_close",
+            sessionId,
+            count: orphaned,
+            message: `Denied ${orphaned} unanswerable permission prompt(s) for closed session ${sessionId}.`
+          })
+        );
+      }
+      if (abortControllers.has(sessionId)) continue;
+      opts.onSessionRetired?.(sessionId);
+      const agent = sessionAgents.peek(sessionId);
+      if (!agent || agent === opts.agent) continue;
+      void sessionAgents.endAndClose(sessionId);
+    }
+  };
+  return { retireUndisplayedSessions };
+}
 
 // src/webui-server.ts
 async function runWebUI(opts) {
   const trustBoundary = opts.trustBoundary ?? createCompatibilityTrustBoundary({ policyId: "cli-webui-trusted-host-compat-v1" });
-  const host = opts.host ?? process.env["WEBUI_HOST"] ?? process.env["WS_HOST"] ?? "127.0.0.1";
-  const publicUrl = opts.publicUrl ?? process.env["WEBUI_PUBLIC_URL"];
-  const publicWsUrl = opts.publicWsUrl ?? process.env["WEBUI_PUBLIC_WS_URL"];
-  const requireToken = opts.requireToken ?? envFlag("WEBUI_REQUIRE_TOKEN");
-  const surface = opts.surface ?? "webui";
-  const surfaceDefaults = surface === "simpleui" ? { http: 3466 } : { http: 3456 };
-  const requestedHttpPort = opts.httpPort ?? opts.port ?? surfaceDefaults.http;
+  const {
+    host,
+    publicUrl,
+    publicWsUrl,
+    requireToken,
+    surface,
+    requestedHttpPort,
+    strictPort,
+    globalRoot,
+    profileConfigPath,
+    profileDir,
+    rateLimitMax,
+    publicHostnames
+  } = resolveWebuiHostSettings(opts);
   const terminalLogView = startTerminalDashboard({
     title: surface === "simpleui" ? "SimpleUI" : "WebUI",
-    quiet: !envFlag("WEBUI_LOGS"),
+    quiet: !envFlag2("WEBUI_LOGS"),
     // The dashboard is operator-owned terminal output, so retain the full
     // authenticated access URL here even though startup logs remain redacted.
     getUrl: () => accessUrl
   });
-  const strictPort = opts.strictPort ?? isStrictPort();
   let httpPort = requestedHttpPort;
   if (!strictPort) {
     httpPort = await findFreePort(host, requestedHttpPort);
   }
   let wsPort = httpPort;
-  const globalRoot = opts.globalConfigPath ? path7.dirname(opts.globalConfigPath) : wstackGlobalRoot();
-  const profileConfigPath = opts.profileConfigPath ?? opts.globalConfigPath ?? path7.join(globalRoot, "config.json");
-  const rawRateLimit = process.env["WEBUI_RATE_LIMIT"]?.trim() ?? "";
-  const parsedRateLimit = /^\d+$/.test(rawRateLimit) ? Number(rawRateLimit) : Number.NaN;
-  const rateLimitMax = Number.isSafeInteger(parsedRateLimit) && parsedRateLimit >= 0 ? parsedRateLimit : 600;
   const clients = /* @__PURE__ */ new Map();
+  const { send, broadcast, broadcastEveryone, sendResult } = createWebuiTransport(clients);
   const pendingConfirms = /* @__PURE__ */ new Map();
   const secretScrubber = new DefaultSecretScrubber();
   const abortControllers = /* @__PURE__ */ new Map();
-  const profileDir = path7.dirname(profileConfigPath);
   let customModeStoreP = null;
   const getCustomModeStore = () => {
-    customModeStoreP ??= (async () => {
-      const store = createCustomModeStore(profileDir);
-      await store.load();
-      return store;
-    })();
-    return customModeStoreP;
-  };
-  const kanbanRunMirror = opts.projectRoot ? createKanbanRunMirror({
-    projectRoot: opts.projectRoot,
-    events: opts.events,
-    broadcast,
-    log: (m) => consoleLogger.info(m)
-  }) : null;
-  const kanbanSupervisor = opts.projectRoot ? createKanbanSupervisor({
-    projectRoot: opts.projectRoot,
-    broadcast,
-    ...opts.onKanbanDispatch ? { dispatchTask: opts.onKanbanDispatch } : {},
-    log: (message) => consoleLogger.info(message)
-  }) : null;
-  const stopKanbanSupervisorMemoryStats = kanbanSupervisor ? startSharedHeapWatchdog({
-    collectStats: () => {
-      const stats = kanbanSupervisor.getStats();
-      return {
-        kanbanSupervisorSnapshots: stats.snapshots,
-        kanbanSupervisorScheduledBoards: stats.scheduledBoards,
-        kanbanSupervisorAgentCooldowns: stats.agentCooldowns,
-        kanbanSupervisorRunningAgents: stats.runningAgents
-      };
-    }
-  }) : void 0;
+    customModeStoreP ??= (async () => {
+      const store = createCustomModeStore(profileDir);
+      await store.load();
+      return store;
+    })();
+    return customModeStoreP;
+  };
+  const { kanbanRunMirror, kanbanSupervisor, stopKanbanSupervisorMemoryStats } = createWebuiKanbanServices(opts, broadcast);
+  const domainHandlers = createWebuiDomainHandlers(opts, trustBoundary, kanbanRunMirror);
   const {
     goalHandler,
     worktreeHandler,
@@ -1800,7 +2187,7 @@ async function runWebUI(opts) {
     specsHandler,
     sddBoardHandler,
     sddWizardHandler
-  } = createWebuiDomainHandlers(opts, trustBoundary, kanbanRunMirror);
+  } = domainHandlers;
   await seedConfigToMeta(opts);
   if (typeof opts.agent.ctx?.meta?.["yolo"] === "boolean") {
     opts.onYoloSwitch?.(opts.agent.ctx.meta["yolo"]);
@@ -1808,37 +2195,13 @@ async function runWebUI(opts) {
   const { prefSnapshot, persistPrefs } = createPrefsSeeding(opts);
   const sessionStartedAt = Date.now();
   let sessionAgentsRef;
-  const buildSessionStartPayload = createSessionStartPayloadBuilder({
-    ...opts,
-    // Read through to the live `opts`, do NOT snapshot: `projects.select`
-    // re-roots the host by assigning `opts.projectRoot` / `opts.session` on
-    // this very object. A spread copy froze both at boot, so every
-    // `session.start` broadcast after a project switch still announced the
-    // previous project's root — the switch looked like it had not happened.
-    get projectRoot() {
-      return opts.projectRoot;
-    },
-    get session() {
-      return opts.session;
-    },
-    get appConfig() {
-      return opts.appConfig;
-    },
-    // `peek`, never `get`: building a payload must not materialise an agent
-    // for a session id that arrived from a stale browser tab.
-    getSessionContext: (sessionId) => sessionAgentsRef?.peek(sessionId)?.ctx
-  });
+  const buildSessionStartPayload = createLiveSessionStartPayloadBuilder(
+    opts,
+    () => sessionAgentsRef
+  );
   const { register: registerWebuiClient, unregister: unregisterWebuiClient } = createEmbeddedClientRegistration(opts, clients, abortControllers, () => sessionAgentsRef);
   registerWebuiClient();
   const wsToken = resolveAuthToken(opts.accessToken);
-  const publicHostnames = [publicUrl, publicWsUrl].map((value) => {
-    if (!value) return void 0;
-    try {
-      return new URL(value).hostname;
-    } catch {
-      return void 0;
-    }
-  }).filter((value) => Boolean(value));
   let accessUrl = buildWebUIAccessUrl({
     host,
     port: httpPort,
@@ -1846,147 +2209,41 @@ async function runWebUI(opts) {
     publicUrl
   });
   let fleetBroadcastCli = null;
-  const httpServer = await startStaticServe({
-    getSessionProjectRoot: (sessionId) => sessionAgentsRef?.peek(sessionId)?.ctx.projectRoot ?? (opts.agent.ctx.session?.id === sessionId ? opts.agent.ctx.projectRoot : void 0),
+  const { httpServer, wss, ipv6LoopbackServer } = await startWebuiHttpBridge({
+    opts,
+    surface,
     host,
     httpPort,
+    strictPort,
     globalRoot,
-    distDir: opts.frontendDistDir,
-    ensureDistDeps: {
-      resolvePackageJson: (id) => {
-        const packageJson = findInstalledPackageJson(id, import.meta.url);
-        if (!packageJson) throw new Error(`Package not found: ${id}`);
-        return packageJson;
-      }
-    },
-    onFleetPing: () => {
-      void fleetBroadcastCli?.();
-    },
-    // Without this, /debug/watcher-metrics 503s and the Debug Dashboard has to
-    // report the watcher as "Unavailable". The CLI host runs no status watcher
-    // of its own, so this object stays all-zero and watcherActive reads false —
-    // which is the truthful state for an embedded host.
-    watcherMetrics: createDefaultFileWatcherMetrics(),
-    onTechStackEvent: (event) => broadcast(event),
-    getLlm: () => opts.agent.ctx.provider && opts.agent.ctx.model ? { provider: opts.agent.ctx.provider, model: opts.agent.ctx.model } : void 0,
-    projectRoot: opts.projectRoot,
+    wsToken,
+    publicUrl,
     publicWsUrl,
-    apiToken: wsToken,
     requireToken,
-    deferListen: surface === "simpleui",
-    strictPort,
-    // Resolve the same-origin health probes from live preferences, including
-    // changes made after boot, just like the standalone WebUI host.
-    getIntegrationTarget: (kind) => {
-      const meta = opts.agent.ctx.meta;
-      const enabledKey = kind === "hq" ? "hqEnabled" : "wrongProxyEnabled";
-      const urlKey = kind === "hq" ? "hqUrl" : "wrongProxyUrl";
-      return meta[enabledKey] === true && typeof meta[urlKey] === "string" ? meta[urlKey] : void 0;
+    getSessionAgents: () => sessionAgentsRef,
+    onFleetPing: () => {
+      void fleetBroadcastCli?.();
     },
-    ...opts.getVectorMemoryStore ? { getVectorMemoryStore: opts.getVectorMemoryStore } : {},
-    ...opts.vectorMemoryModelCacheDir ? { vectorMemoryModelCacheDir: opts.vectorMemoryModelCacheDir } : {}
-  });
-  const verifyClient = (info) => verifyWsClient2({
-    origin: info.origin,
-    url: info.req.url ?? "",
-    hostHeader: info.req.headers.host,
-    remoteAddress: info.req.socket.remoteAddress,
-    cookieHeader: info.req.headers.cookie,
-    wsHost: host,
-    expectedToken: wsToken,
-    requireToken,
-    allowedHostnames: [publicUrl, publicWsUrl].filter((value) => Boolean(value)),
-    allowBrowserUrlToken: Boolean(publicWsUrl),
-    allowCrossPortLoopbackCookie: process.env["WRONGSTACK_WEBUI_DEV_CROSS_PORT_WS"] === "1"
-  });
-  const wss = httpServer ? new WebSocketServer({ server: httpServer.server, verifyClient, maxPayload: 20 * 1024 * 1024 }) : new WebSocketServer({ port: httpPort, host, verifyClient, maxPayload: 20 * 1024 * 1024 });
-  wss.on("error", (err) => {
-    console.error(
-      JSON.stringify({
-        level: "error",
-        event: "webui_server.error",
-        message: err instanceof Error ? err.message : String(err),
-        timestamp: (/* @__PURE__ */ new Date()).toISOString()
-      })
-    );
-  });
-  if (httpServer) {
-    const boundPort = surface === "simpleui" ? await startDeferredHttpListen({
-      server: httpServer.server,
-      host,
-      httpPort,
-      logger: consoleLogger,
-      strictPort
-    }) : httpServer.port;
-    if (boundPort !== httpPort) {
-      httpPort = boundPort;
-      wsPort = boundPort;
+    broadcast,
+    onPortRebound: (port) => {
+      httpPort = port;
+      wsPort = port;
       accessUrl = buildWebUIAccessUrl({ host, port: httpPort, token: wsToken, publicUrl });
     }
-  }
-  let ipv6LoopbackServer = null;
-  if (httpServer && host === "127.0.0.1") {
-    ipv6LoopbackServer = await startIpv6LoopbackProxy({
-      primary: httpServer.server,
-      httpPort,
-      logger: consoleLogger
-    });
-  }
-  console.log(`[WebUI] WebSocket server starting on ws://${host}:${httpPort}`);
-  if (httpServer) {
-    announceWebuiReady({
-      surface,
-      server: httpServer.server,
-      host,
-      httpPort,
-      open: !!opts.open,
-      wsToken,
-      publicUrl
-    });
-  } else {
-    console.warn(
-      `[WebUI] Frontend not served (run \`pnpm --filter @wrongstack/webui build\`). WS bridge still active on ws://${host}:${httpPort}.`
-    );
-  }
+  });
   let foregroundSession = opts.agent.ctx.session ?? opts.session;
   const currentSessionId = () => foregroundSession.id;
   const registryBaseDir = globalRoot;
-  let webuiInstanceRegistered = false;
-  if (opts.projectRoot) {
-    const registration = Promise.resolve(
-      registerWebuiInstance({
-        pid: process.pid,
-        surface,
-        host,
-        httpPort,
-        publicUrl,
-        projectRoot: opts.projectRoot,
-        startedAt: (/* @__PURE__ */ new Date()).toISOString(),
-        registryBaseDir,
-        authToken: wsToken,
-        ...opts.webuiSessionChild ? {
-          role: "session-child",
-          sessionId: currentSessionId(),
-          parentPid: opts.webuiSessionChild.parentPid,
-          parentShellId: opts.webuiSessionChild.parentShellId,
-          runtimeId: opts.webuiSessionChild.runtimeId,
-          attachable: opts.webuiSessionChild.attachable,
-          lastReadyAt: (/* @__PURE__ */ new Date()).toISOString(),
-          protocolVersion: opts.webuiSessionChild.protocolVersion,
-          capabilities: [...WEBUI_SESSION_CHILD_CAPABILITIES]
-        } : {}
-      })
-    ).then(
-      (value) => value !== false,
-      () => false
-    );
-    if (opts.webuiSessionChild) {
-      webuiInstanceRegistered = await registration;
-    } else {
-      void registration;
-      webuiInstanceRegistered = true;
-    }
-  }
+  const webuiInstanceRegistered = await registerEmbeddedWebuiInstance({
+    opts,
+    surface,
+    host,
+    httpPort,
+    publicUrl,
+    registryBaseDir,
+    wsToken,
+    currentSessionId
+  });
   const eventUnsubscribers = [];
   const sessionPayload = (payload) => {
     const provided = payload["sessionId"];
@@ -2017,54 +2274,24 @@ async function runWebUI(opts) {
     secretScrubber,
     getClients: () => clients,
     eventUnsubscribers,
-    globalConfigPath: path7.join(globalRoot, "config.json"),
+    globalConfigPath: path8.join(globalRoot, "config.json"),
     onFleetBroadcaster: (fn) => {
       fleetBroadcastCli = fn;
     },
     ...opts.getFleetBudget ? { getFleetBudget: opts.getFleetBudget } : {}
   });
-  const wsHandlerCtx = {
-    providerStore: createProviderConfigStore(
-      profileConfigPath,
-      () => opts.appConfig?.providers ?? {}
-    ),
-    modelsRegistry: opts.modelsRegistry,
-    providerAuthRegistry: opts.providerAuthRegistry,
-    getDisabledModels: () => opts.appConfig?.disabledModels ?? [],
-    getDisabledProviders: () => opts.appConfig?.disabledProviders ?? [],
-    send,
-    broadcast,
-    log: (m) => console.log(m)
-  };
-  const embeddedProviderOperations = createEmbeddedProviderOperations(wsHandlerCtx);
-  const credentialWatcherClose = startWebuiCredentialWatcher({
+  const { wsHandlerCtx, credentialWatcherClose } = createEmbeddedProviderPlane({
     opts,
     profileConfigPath,
-    broadcast,
-    broadcastSaved: (providers) => embeddedProviderOperations.broadcastSaved(providers)
-  });
-  const sessionAgents = createSessionAgentRegistry({
-    template: opts.agent,
-    ...opts.modelsRegistry ? { modelsRegistry: opts.modelsRegistry } : {},
-    isRunActive: (sessionId) => abortControllers.has(sessionId),
-    // A tab that is still on screen must outlive one that was closed, whatever
-    // order their agents were created in.
-    isDisplayed: (sessionId) => {
-      for (const client of clients.values()) {
-        if (client.sessionId === sessionId) return true;
-        if (client.sessionIds?.has(sessionId) === true) return true;
-      }
-      return false;
-    }
+    send,
+    broadcast
   });
+  const { sessionAgents, isSessionDisplayed } = createEmbeddedSessionAgents(
+    opts,
+    clients,
+    abortControllers
+  );
   sessionAgentsRef = sessionAgents;
-  const isSessionDisplayed = (sessionId) => {
-    for (const client of clients.values()) {
-      if (client.sessionId === sessionId) return true;
-      if (client.sessionIds?.has(sessionId) === true) return true;
-    }
-    return false;
-  };
   const autoWakeHost = opts.leaderAutoWake ? createWebuiLeaderAutoWakeHost({
     controller: opts.leaderAutoWake,
     events: opts.events,
@@ -2095,35 +2322,13 @@ async function runWebUI(opts) {
     abortControllers,
     sessionAgents
   });
-  const refreshSessionHistory = async () => {
-    const list = await opts.sessionStore?.list(200);
-    if (!list) return;
-    broadcastEveryone({
-      type: "sessions.list",
-      payload: { sessions: toSessionHistoryEntries(list, foregroundSession.id) }
-    });
-  };
-  const emptySessionCleanup = opts.sessionStore ? scheduleOwnerlessEmptySessionCleanup({
-    getSessionStore: () => opts.sessionStore,
-    getActiveSessionId: () => foregroundSession.id,
-    getActiveSessionIds: () => collectDisplayedSessionIds({ getSession: () => foregroundSession, clients }),
-    // A run outlives the tab that started it, and a turn that has not
-    // written its first record yet looks exactly like a session nobody
-    // ever used.
-    hasParticipants: (sessionId) => abortControllers.has(sessionId),
-    refreshSessions: refreshSessionHistory,
-    logger: consoleLogger
-  }) : null;
-  const offSessionRenamed = opts.sessionStore ? opts.events.on("session.renamed", () => {
-    void refreshSessionHistory().catch(() => void 0);
-  }) : void 0;
-  const stopEmptySessionCleanup = emptySessionCleanup && {
-    runNow: emptySessionCleanup.runNow,
-    dispose: async () => {
-      offSessionRenamed?.();
-      await emptySessionCleanup.dispose();
-    }
-  };
+  const { stopEmptySessionCleanup } = setupWebuiSessionMaintenance({
+    opts,
+    broadcastEveryone,
+    getForegroundSession: () => foregroundSession,
+    clients,
+    abortControllers
+  });
   const routeContexts = createWebuiRouteContexts({
     opts,
     profileConfigPath,
@@ -2163,43 +2368,21 @@ async function runWebUI(opts) {
   let signalShutdown;
   const shutdown = () => signalShutdown?.();
   let embeddedAutoHealDispose = null;
-  const handleMessage = createEmbeddedMessageRouter({
-    jevVault: getVault(opts.globalConfigPath ?? opts.profileConfigPath),
+  const handleMessage = createCliEmbeddedMessageRouter({
     trustBoundary,
     opts,
-    logger: consoleLogger,
     send,
     sendResult,
     sessionPayload,
     currentSessionId,
     shutdown,
-    // Auto-heal watchdog disposer — `disposeResources` awaits it (bounded) so
-    // an in-flight daemon restart drains before the host exits.
     onDispose: (dispose) => {
       embeddedAutoHealDispose = dispose;
     },
     providerCtx: wsHandlerCtx,
-    brainCtx: routeContexts.brainCtx,
-    introspectionCtx: routeContexts.introspectionCtx,
-    skillsCtx: routeContexts.skillsCtx,
-    promptsCtx: routeContexts.promptsCtx,
-    designCtx: routeContexts.designCtx,
-    agentConfigCtx: routeContexts.agentConfigCtx,
-    prefsCtx: routeContexts.prefsCtx,
-    projectCtx: routeContexts.projectsCtx,
-    mailboxRoutes: routeContexts.mailboxRoutes,
-    chimeraRoutes: routeContexts.chimeraRoutes,
-    codeAssistRoutes: routeContexts.codeAssistRoutes,
-    sessionCtx: routeContexts.sessionsCtx,
-    conversationCtx: routeContexts.connectionCtx,
-    goalHandler,
-    specsHandler,
-    sddBoardHandler,
-    sddWizardHandler,
-    worktreeHandler,
-    terminalHandler,
-    kanbanHostRoutes,
-    statusTracker: opts.statusTracker
+    routeContexts,
+    domainHandlers,
+    kanbanHostRoutes
   });
   const { stopped } = runWebuiServerLifecycle({
     host,
@@ -2260,27 +2443,9 @@ async function runWebUI(opts) {
     stopLiveStatusLogger,
     terminalLogView
   });
-  function send(ws, msg) {
-    sendSerialized(ws, JSON.stringify(stampDispatchSession(msg)));
-  }
-  function broadcast(msg, targetSessionId) {
-    const payload = msg.payload;
-    const sessionId = targetSessionId ?? (payload && typeof payload === "object" && typeof payload.sessionId === "string" ? payload.sessionId : void 0);
-    const data = sessionId ? webuiSessionFrameLog().sequence(sessionId, msg) : JSON.stringify(msg);
-    for (const [ws, client] of clients) {
-      if (clientWantsSession(client, sessionId)) sendSerialized(ws, data);
-    }
-  }
-  function broadcastEveryone(msg) {
-    const data = JSON.stringify(msg);
-    for (const [ws] of clients) sendSerialized(ws, data);
-  }
-  function sendResult(ws, success, message) {
-    send(ws, { type: "key.operation_result", payload: { success, message } });
-  }
   return stopped.finally(() => terminalLogView.stop());
 }
 export {
   runWebUI
 };
-//# sourceMappingURL=webui-server-GQOVLQS3.js.map
+//# sourceMappingURL=webui-server-6IC3SLZG.js.map