@wrongstack/desktop 1.0.3 → 1.0.6

package/dist/main/main.js

@@ -1,5 +1,6 @@
 // src/main/main.ts
 import * as path6 from "node:path";
+import { watchProviderConfig } from "@wrongstack/core/storage";
 import { installCrashShield, resolveWstackPaths as resolveWstackPaths3 } from "@wrongstack/core/utils";
 import {
   app as app2,
@@ -10,52 +11,6 @@ import {
   WebContentsView as WebContentsView2
 } from "electron";
 
-// src/main/macos-platform.ts
-import { app, Menu } from "electron";
-function initMacOS() {
-  if (process.platform !== "darwin") return;
-  app.setActivationPolicy("regular");
-  app.on("open-file", (_event, filePath) => {
-    if (app.isReady()) {
-      handleFileOpen(filePath);
-    }
-  });
-  app.dock?.setMenu(
-    Menu.buildFromTemplate([
-      {
-        label: "New Window",
-        click: () => {
-        }
-      }
-    ])
-  );
-  app.setAboutPanelOptions({
-    applicationName: "WrongStack Desktop",
-    applicationVersion: app.getVersion(),
-    version: process.versions.electron ? `Electron ${process.versions.electron}` : ""
-  });
-}
-function handleFileOpen(filePath) {
-  pendingOpenFilePath = filePath;
-}
-var pendingOpenFilePath = null;
-function drainPendingOpenFilePath() {
-  const path7 = pendingOpenFilePath;
-  pendingOpenFilePath = null;
-  return path7;
-}
-function firstOpenFileArg(argv) {
-  if (process.platform !== "darwin") return null;
-  for (let index = 1; index < argv.length; index++) {
-    const arg = argv[index];
-    if (arg == null) continue;
-    if (arg.startsWith("-")) continue;
-    if (arg === "." || arg === "--") continue;
-    return arg;
-  }
-  return null;
-}
-
 // src/main/agent-bridge.ts
 import { randomUUID } from "node:crypto";
 import { EventEmitter } from "node:events";
@@ -233,9 +188,7 @@ var DesktopAgentBridge = class extends EventEmitter {
       conversation.reconnectTimer = null;
       if (!conversation.reconnectUrl) return;
       if (conversation.ws?.readyState !== WebSocket.OPEN) {
-        void this.connect(conversation.runtimeId, conversation.reconnectUrl).catch(
-          () => void 0
-        );
+        void this.connect(conversation.runtimeId, conversation.reconnectUrl).catch(() => void 0);
       }
     }, reconnect.plan.delayMs);
   }
@@ -457,6 +410,99 @@ function stringValue(value) {
   return typeof value === "string" ? value : void 0;
 }
 
+// src/main/app-icon.ts
+import * as fs from "node:fs/promises";
+import { fileURLToPath } from "node:url";
+import { nativeImage } from "electron";
+var ICON_CANDIDATES = ["../../assets/icon.png", "../../assets/icon.icns"];
+async function readIcon(relativePath) {
+  try {
+    const iconPath = fileURLToPath(new URL(relativePath, import.meta.url));
+    await fs.stat(iconPath);
+    const icon = nativeImage.createFromPath(iconPath);
+    return icon.isEmpty() ? void 0 : icon;
+  } catch {
+    return void 0;
+  }
+}
+async function loadDesktopAppIcon() {
+  for (const candidate of ICON_CANDIDATES) {
+    const icon = await readIcon(candidate);
+    if (icon) return icon;
+  }
+  return void 0;
+}
+
+// src/main/desktop-config-io.ts
+import * as fs2 from "node:fs/promises";
+import * as path from "node:path";
+import {
+  decryptConfigSecrets,
+  DefaultSecretVault,
+  encryptConfigSecrets
+} from "@wrongstack/core/security";
+import { atomicWrite, wstackGlobalRoot } from "@wrongstack/core/utils";
+var globalRoot = wstackGlobalRoot();
+var bootstrapConfigPath = path.join(globalRoot, "config.json");
+var defaultProfileConfigPath = path.join(globalRoot, "profiles", "default", "config.json");
+var vault = new DefaultSecretVault({
+  keyFile: path.join(globalRoot, ".key")
+});
+function safeProfileName(value) {
+  if (typeof value !== "string" || !value.trim()) return "default";
+  return value.replace(/[/\\:]/g, "_").replace(/\.\./g, "_") || "default";
+}
+async function resolveActiveProfileConfigPath() {
+  try {
+    const raw = await fs2.readFile(bootstrapConfigPath, "utf8");
+    const parsed = JSON.parse(raw);
+    return path.join(globalRoot, "profiles", safeProfileName(parsed.activeProfile), "config.json");
+  } catch {
+    return defaultProfileConfigPath;
+  }
+}
+async function readUiLocale() {
+  const profileConfigPath = await resolveActiveProfileConfigPath();
+  let raw;
+  try {
+    raw = await fs2.readFile(profileConfigPath, "utf8");
+  } catch {
+    return void 0;
+  }
+  try {
+    const decrypted = decryptConfigSecrets(JSON.parse(raw), vault);
+    const value = decrypted.uiLocale;
+    return typeof value === "string" && value ? value : void 0;
+  } catch {
+    return void 0;
+  }
+}
+var desktopConfigPaths = {
+  bootstrapConfigPath,
+  profileConfigPath: defaultProfileConfigPath,
+  vault
+};
+async function writeUiLocale(code) {
+  const profileConfigPath = await resolveActiveProfileConfigPath();
+  let raw;
+  try {
+    raw = await fs2.readFile(profileConfigPath, "utf8");
+  } catch {
+    raw = "{}";
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return;
+  }
+  const decrypted = decryptConfigSecrets(parsed, vault);
+  decrypted.uiLocale = code;
+  const encrypted = encryptConfigSecrets(decrypted, vault);
+  await fs2.mkdir(path.dirname(profileConfigPath), { recursive: true });
+  await atomicWrite(profileConfigPath, JSON.stringify(encrypted, null, 2), { mode: 384 });
+}
+
 // src/main/desktop-privileged-actions.ts
 import { randomUUID as randomUUID2 } from "node:crypto";
 import {
@@ -464,19 +510,26 @@ import {
   isTrustDecisionAllowed
 } from "@wrongstack/core/security";
 var desktopCompatibilityTrustBoundary = createCompatibilityTrustBoundary({
-  policyId: "desktop-trusted-host-compat-v1"
+  policyId: "desktop-trusted-host-compat-v1",
+  // WS-SEC-03: the desktop shell hosts a renderer that loads *remote* content
+  // (the WebUI runtime over http://127.0.0.1). Actions originating there are
+  // attributed to `remote-client`, so refuse the high/critical tiers from it —
+  // spawning or terminating a runtime is a shell-menu action, never something
+  // page content should be able to drive.
+  denyHighRiskRemoteClient: true
 });
 async function authorizeDesktopAction(boundary, action, logger) {
+  const principalId = action.origin === "user" ? "desktop-user" : "desktop-webui-view";
   const request = {
     version: 1,
     requestId: randomUUID2(),
-    actor: { kind: "user", id: "desktop-user" },
+    actor: { kind: action.origin, id: principalId },
     surface: "desktop",
     capability: action.capability,
     subject: action.subject,
     risk: action.risk,
     scope: action.cwd ? { cwd: action.cwd } : {},
-    authContext: { method: "local-process", principalId: "desktop-user" },
+    authContext: { method: "local-process", principalId },
     ...action.metadata ? { metadata: action.metadata } : {}
   };
   const decision = await boundary.evaluate(request);
@@ -484,6 +537,10 @@ async function authorizeDesktopAction(boundary, action, logger) {
     event: "desktop.trust_boundary.decision",
     requestId: request.requestId,
     capability: request.capability,
+    // The origin is the whole point of the decision now, so an audit line that
+    // omits it cannot be used to tell an allowed shell action from an allowed
+    // renderer-driven one.
+    actor: request.actor.kind,
     decision: decision.kind,
     policyId: decision.policyId
   };
@@ -499,6 +556,8 @@ async function authorizeDesktopAction(boundary, action, logger) {
 function authorizeDesktopRuntimeStart(boundary, cwd, runtimeKind) {
   return authorizeDesktopAction(boundary, {
     capability: "process.spawn",
+    // Shell-driven: reached from the app menu / shell renderer's open-project.
+    origin: "user",
     subject: {
       kind: "command",
       id: "wrongstack-webui-runtime",
@@ -512,6 +571,7 @@ function authorizeDesktopRuntimeStart(boundary, cwd, runtimeKind) {
 function authorizeDesktopRuntimeStop(boundary, runtime) {
   return authorizeDesktopAction(boundary, {
     capability: "process.terminate",
+    origin: "user",
     subject: {
       kind: "process",
       id: runtime.id,
@@ -526,45 +586,6 @@ function authorizeDesktopRuntimeStop(boundary, runtime) {
   });
 }
 
-// src/main/ipc.ts
-var IPC = {
-  getState: "desktop:get-state",
-  getConversation: "desktop:get-conversation",
-  getWebuiStatus: "desktop:get-webui-status",
-  openProject: "desktop:open-project",
-  registerProject: "desktop:register-project",
-  unregisterProject: "desktop:unregister-project",
-  openProjectSession: "desktop:open-project-session",
-  activateRuntime: "desktop:activate-runtime",
-  closeRuntime: "desktop:close-runtime",
-  navigateWebui: "desktop:navigate-webui",
-  reloadWebui: "desktop:reload-webui",
-  setShellSidebarCollapsed: "desktop:set-shell-sidebar-collapsed",
-  openSettings: "desktop:open-settings",
-  sendMessage: "desktop:send-message",
-  abortRuntime: "desktop:abort-runtime",
-  openRuntimeInBrowser: "desktop:open-runtime-in-browser",
-  revealRuntimeRoot: "desktop:reveal-runtime-root",
-  stateChanged: "desktop:state-changed",
-  conversationChanged: "desktop:conversation-changed",
-  webuiStatusChanged: "desktop:webui-status-changed",
-  webuiReadyChanged: "desktop:webui-ready-changed",
-  webuiPrefsChanged: "desktop:webui-prefs-changed",
-  webuiCommandAck: "desktop:webui-command-ack",
-  webuiCommand: "desktop:webui-command",
-  shellSidebarCollapsedChanged: "desktop:shell-sidebar-collapsed-changed",
-  setLocale: "desktop:set-locale",
-  localeChanged: "desktop:locale-changed",
-  // Embedded WebUI view side — the desktop shell pushes locale changes here
-  // so the React WebUI inside Electron can swap i18n instantly, without waiting
-  // for the config-file watcher → WS prefs.updated round-trip.
-  webuiLocaleChanged: "desktop:webui-locale-changed",
-  // macOS open-file event forwarded from main process to shell renderer.
-  // The shell uses this to decide whether to open a dragged/double-clicked
-  // path as a project directory.
-  openFile: "desktop:open-file"
-};
-
 // src/main/i18n-main.ts
 var en = {
   windowTitle: "WrongStack Desktop",
@@ -865,2191 +886,2370 @@ function tMain(key) {
   return CATALOGS[mainLocale]?.[key] ?? CATALOGS.en[key] ?? key;
 }
 
-// src/main/desktop-config-io.ts
-import * as fs from "node:fs/promises";
-import * as path from "node:path";
-import {
-  decryptConfigSecrets,
-  DefaultSecretVault,
-  encryptConfigSecrets
-} from "@wrongstack/core/security";
-import { atomicWrite, wstackGlobalRoot } from "@wrongstack/core/utils";
-var globalRoot = wstackGlobalRoot();
-var bootstrapConfigPath = path.join(globalRoot, "config.json");
-var defaultProfileConfigPath = path.join(globalRoot, "profiles", "default", "config.json");
-var vault = new DefaultSecretVault({
-  keyFile: path.join(globalRoot, ".key")
-});
-function safeProfileName(value) {
-  if (typeof value !== "string" || !value.trim()) return "default";
-  return value.replace(/[/\\:]/g, "_").replace(/\.\./g, "_") || "default";
-}
-async function resolveActiveProfileConfigPath() {
+// src/main/ipc.ts
+var IPC = {
+  getState: "desktop:get-state",
+  getConversation: "desktop:get-conversation",
+  getWebuiStatus: "desktop:get-webui-status",
+  getOpenSessions: "desktop:get-open-sessions",
+  openProject: "desktop:open-project",
+  registerProject: "desktop:register-project",
+  unregisterProject: "desktop:unregister-project",
+  openProjectSession: "desktop:open-project-session",
+  activateRuntime: "desktop:activate-runtime",
+  closeRuntime: "desktop:close-runtime",
+  navigateWebui: "desktop:navigate-webui",
+  reloadWebui: "desktop:reload-webui",
+  setShellSidebarCollapsed: "desktop:set-shell-sidebar-collapsed",
+  openSettings: "desktop:open-settings",
+  sendMessage: "desktop:send-message",
+  abortRuntime: "desktop:abort-runtime",
+  openRuntimeInBrowser: "desktop:open-runtime-in-browser",
+  revealRuntimeRoot: "desktop:reveal-runtime-root",
+  stateChanged: "desktop:state-changed",
+  conversationChanged: "desktop:conversation-changed",
+  webuiStatusChanged: "desktop:webui-status-changed",
+  webuiReadyChanged: "desktop:webui-ready-changed",
+  webuiPrefsChanged: "desktop:webui-prefs-changed",
+  webuiOpenSessionsChanged: "desktop:webui-open-sessions-changed",
+  openSessionsChanged: "desktop:open-sessions-changed",
+  webuiCommandAck: "desktop:webui-command-ack",
+  webuiCommand: "desktop:webui-command",
+  shellSidebarCollapsedChanged: "desktop:shell-sidebar-collapsed-changed",
+  setLocale: "desktop:set-locale",
+  localeChanged: "desktop:locale-changed",
+  // Embedded WebUI view side — the desktop shell pushes locale changes here
+  // so the React WebUI inside Electron can swap i18n instantly, without waiting
+  // for the config-file watcher → WS prefs.updated round-trip.
+  webuiLocaleChanged: "desktop:webui-locale-changed",
+  // macOS open-file event forwarded from main process to shell renderer.
+  // The shell uses this to decide whether to open a dragged/double-clicked
+  // path as a project directory.
+  openFile: "desktop:open-file"
+};
+
+// src/main/ipc-handlers/index.ts
+import { ipcMain } from "electron";
+
+// src/main/validation/index.ts
+function validate(schema, data) {
   try {
-    const raw = await fs.readFile(bootstrapConfigPath, "utf8");
-    const parsed = JSON.parse(raw);
-    return path.join(globalRoot, "profiles", safeProfileName(parsed.activeProfile), "config.json");
-  } catch {
-    return defaultProfileConfigPath;
+    const result = schema.safeParse(data);
+    if (result.success) {
+      return { success: true, data: result.data };
+    }
+    return { success: false, error: formatZodError(result.error) };
+  } catch (err) {
+    return { success: false, error: String(err) };
   }
 }
-async function readUiLocale() {
-  const profileConfigPath = await resolveActiveProfileConfigPath();
-  let raw;
-  try {
-    raw = await fs.readFile(profileConfigPath, "utf8");
-  } catch {
-    return void 0;
-  }
-  try {
-    const decrypted = decryptConfigSecrets(JSON.parse(raw), vault);
-    const value = decrypted.uiLocale;
-    return typeof value === "string" && value ? value : void 0;
-  } catch {
-    return void 0;
-  }
+function validateOrDefault(schema, data, defaultValue) {
+  const result = validate(schema, data);
+  return result.success ? result.data : defaultValue;
 }
-var desktopConfigPaths = {
-  bootstrapConfigPath,
-  profileConfigPath: defaultProfileConfigPath,
-  vault
-};
-async function writeUiLocale(code) {
-  const profileConfigPath = await resolveActiveProfileConfigPath();
-  let raw;
-  try {
-    raw = await fs.readFile(profileConfigPath, "utf8");
-  } catch {
-    raw = "{}";
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(raw);
-  } catch {
-    return;
-  }
-  const decrypted = decryptConfigSecrets(parsed, vault);
-  decrypted.uiLocale = code;
-  const encrypted = encryptConfigSecrets(decrypted, vault);
-  await fs.mkdir(path.dirname(profileConfigPath), { recursive: true });
-  await atomicWrite(profileConfigPath, JSON.stringify(encrypted, null, 2), { mode: 384 });
+function formatZodError(error) {
+  return error.issues.map((e) => `${e.path.join(".")}: ${e.message}`).join("; ");
+}
+function createValidationLogger(prefix) {
+  const loggedErrors = /* @__PURE__ */ new Set();
+  const maxErrors = 100;
+  return {
+    log(error) {
+      if (loggedErrors.size >= maxErrors) return;
+      const key = `${prefix}:${error}`;
+      if (!loggedErrors.has(key)) {
+        loggedErrors.add(key);
+        console.warn(
+          JSON.stringify({
+            level: "warn",
+            event: "desktop.validation_error",
+            prefix,
+            message: error,
+            timestamp: (/* @__PURE__ */ new Date()).toISOString()
+          })
+        );
+      }
+    },
+    reset() {
+      loggedErrors.clear();
+    }
+  };
 }
 
-// src/main/runtime-manager.ts
-import { spawn } from "node:child_process";
-import { randomBytes } from "node:crypto";
-import { EventEmitter as EventEmitter2 } from "node:events";
-import * as fs2 from "node:fs/promises";
-import * as http from "node:http";
-import * as net from "node:net";
-import * as os from "node:os";
-import * as path3 from "node:path";
-import {
-  atomicWrite as atomicWrite2,
-  buildChildEnv,
-  projectSlug,
-  resolveWstackPaths as resolveWstackPaths2,
-  toErrorMessage,
-  wstackGlobalRoot as wstackGlobalRoot2
-} from "@wrongstack/core/utils";
-
-// src/main/runtime-manager-paths.ts
-import { existsSync } from "node:fs";
-import { createRequire } from "node:module";
+// src/main/validation/schemas.ts
+import { statSync } from "node:fs";
 import * as path2 from "node:path";
-import { fileURLToPath } from "node:url";
-import { resolveWstackPaths } from "@wrongstack/core/utils";
-function resolveWebUiEntry() {
-  if (process.env["WRONGSTACK_WEBUI_ENTRY"]) {
-    return path2.resolve(process.env["WRONGSTACK_WEBUI_ENTRY"]);
-  }
-  const require2 = createRequire(import.meta.url);
-  try {
-    const serverPkgPath = require2.resolve("@wrongstack/webui-server/package.json");
-    const candidate = path2.join(path2.dirname(serverPkgPath), "dist", "server", "entry.js");
-    if (existsSync(candidate)) return candidate;
-  } catch {
-  }
-  const serverIndex = require2.resolve("@wrongstack/webui-server");
-  return path2.join(path2.dirname(serverIndex), "server", "entry.js");
-}
-function resolveWebUiDistDir() {
-  if (process.env["WRONGSTACK_WEBUI_DIST"]) {
-    return path2.resolve(process.env["WRONGSTACK_WEBUI_DIST"]);
+import { z } from "zod";
+var RUNTIME_ID_PATTERN = /^[a-zA-Z0-9._:-]{3,120}$/;
+var runtimeIdSchema = z.string().regex(RUNTIME_ID_PATTERN, "Invalid runtime ID format");
+var pathSchema = z.string().min(1).max(1e4);
+var projectRootSchema = pathSchema.refine((value) => !value.includes("\0"), {
+  message: "path must not contain a NUL byte"
+}).refine(
+  (value) => {
+    try {
+      return statSync(path2.resolve(value)).isDirectory();
+    } catch {
+      return false;
+    }
+  },
+  { message: "path must be an existing directory" }
+);
+var booleanSchema = z.boolean();
+var numberSchema = z.number().int().finite();
+var openProjectSchema = z.object({
+  requestedRoot: pathSchema.optional()
+});
+var registerProjectSchema = z.object({
+  requestedRoot: pathSchema.optional()
+});
+var unregisterProjectSchema = z.object({
+  root: pathSchema
+});
+var openProjectSessionSchema = z.object({
+  runtimeId: runtimeIdSchema.optional()
+});
+var activateRuntimeSchema = z.object({
+  id: runtimeIdSchema
+});
+var closeRuntimeSchema = z.object({
+  id: runtimeIdSchema
+});
+var sendMessageSchema = z.object({
+  id: runtimeIdSchema,
+  content: z.string()
+});
+var abortRuntimeSchema = z.object({
+  id: runtimeIdSchema
+});
+var openRuntimeInBrowserSchema = z.object({
+  id: runtimeIdSchema
+});
+var revealRuntimeRootSchema = z.object({
+  id: runtimeIdSchema
+});
+var setShellSidebarCollapsedSchema = z.object({
+  collapsed: booleanSchema
+});
+var navigateWebuiSchema = z.object({
+  command: z.unknown()
+});
+var getConversationSchema = z.object({
+  runtimeId: runtimeIdSchema
+});
+var webuiReadyChangedSchema = z.object({
+  ready: booleanSchema
+});
+var webuiPrefsChangedSchema = z.object({
+  prefs: z.record(z.string(), z.unknown())
+});
+var webuiCommandAckSchema = z.object({
+  requestId: z.string(),
+  handled: z.boolean(),
+  message: z.string().optional()
+});
+var setLocaleSchema = z.object({
+  locale: z.string().min(2).max(10)
+});
+
+// src/main/webui/open-sessions.ts
+function sanitizeOpenSessions(value) {
+  if (!Array.isArray(value)) return [];
+  const sessions = [];
+  const ids = /* @__PURE__ */ new Set();
+  const slots = /* @__PURE__ */ new Set();
+  for (const raw of value) {
+    if (!isRecord(raw)) continue;
+    const id = raw["id"];
+    const title = raw["title"];
+    const slot = raw["slot"];
+    if (typeof id !== "string" || id.length === 0 || id.length > 512 || typeof title !== "string" || !Number.isInteger(slot) || slot < 0 || slot > 3 || typeof raw["active"] !== "boolean" || typeof raw["running"] !== "boolean" || ids.has(id) || slots.has(slot)) {
+      continue;
+    }
+    ids.add(id);
+    slots.add(slot);
+    sessions.push({
+      id,
+      title: title.trim().slice(0, 200) || id.slice(0, 8),
+      slot,
+      active: raw["active"],
+      running: raw["running"]
+    });
+    if (sessions.length === 4) break;
   }
-  const require2 = createRequire(import.meta.url);
-  const serverEntry = require2.resolve("@wrongstack/webui");
-  const candidate = path2.dirname(serverEntry);
-  if (existsSync(candidate)) return candidate;
-  throw new Error(
-    `WebUI frontend assets not found at ${candidate}. Build @wrongstack/webui or set WRONGSTACK_WEBUI_DIST.`
-  );
-}
-function rendererIndexPath() {
-  return new URL("../renderer/index.html", import.meta.url).href;
-}
-function preloadPath() {
-  return fileURLToPath(new URL("../preload/preload.cjs", import.meta.url));
-}
-function webuiPreloadPath() {
-  return fileURLToPath(new URL("../preload/webui-preload.cjs", import.meta.url));
+  return sessions.sort((a, b) => a.slot - b.slot);
 }
-function desktopSettingsWorkspaceRoot() {
-  return path2.join(resolveWstackPaths({ projectRoot: process.cwd() }).configDir, "settings");
+function isRecord(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
 
-// src/main/runtime-manager.ts
-var HTTP_PORT_START = 34560;
-var WS_PORT_START = 34660;
-var START_TIMEOUT_MS = 3e4;
-var MIN_WINDOW_WIDTH = 760;
-var MIN_WINDOW_HEIGHT = 520;
-var DesktopRuntimeManager = class extends EventEmitter2 {
-  constructor(trustBoundary = desktopCompatibilityTrustBoundary) {
-    super();
-    this.trustBoundary = trustBoundary;
-  }
-  trustBoundary;
-  runtimes = /* @__PURE__ */ new Map();
-  stateFile = path3.join(
-    resolveWstackPaths2({ projectRoot: process.cwd() }).configDir,
-    "desktop.json"
-  );
-  recentProjects = [];
-  registeredProjects = [];
-  restoreProjectSessions = [];
-  restoreActiveRuntimeId = null;
-  restoreActiveProjectRoot = null;
-  lastActiveProjectRoot = null;
-  windowState = null;
-  activeRuntimeId = null;
-  restoring = false;
-  workspaceRestoreCompleted = false;
-  async init() {
-    const state = await this.loadDesktopState();
-    this.recentProjects = state.recentProjects;
-    this.registeredProjects = await readGlobalProjectManifest();
-    this.restoreProjectSessions = state.openProjectSessions;
-    this.restoreActiveRuntimeId = state.activeRuntimeId;
-    this.restoreActiveProjectRoot = state.activeProjectRoot;
-    this.lastActiveProjectRoot = state.activeProjectRoot;
-    this.windowState = state.window;
-  }
-  snapshot() {
-    return {
-      activeRuntimeId: this.activeRuntimeId,
-      runtimes: Array.from(this.runtimes.values()).map(publicRuntime),
-      recentProjects: [...this.recentProjects],
-      registeredProjects: [...this.registeredProjects],
-      restoring: this.restoring
-    };
-  }
-  getWindowState() {
-    return this.windowState ? { ...this.windowState } : null;
-  }
-  async saveWindowState(window) {
-    this.windowState = { ...window };
-    await this.saveDesktopState();
-  }
-  async restoreLastWorkspace() {
-    const sessions = this.restoreProjectSessions.filter(
-      (session) => typeof session.root === "string" && session.root.trim()
-    );
-    if (sessions.length === 0 || this.restoring || this.runtimes.size > 0) {
-      this.workspaceRestoreCompleted = true;
-      return;
+// src/main/ipc-handlers/index.ts
+var validationLogger = createValidationLogger("IPC");
+function isShellSender(ctx, senderId) {
+  const shell3 = ctx.getShellView();
+  if (shell3 === null) return false;
+  const contents = shell3.webContents;
+  return !contents.isDestroyed() && contents.id === senderId;
+}
+function handleShellOnly(ctx, channel, handler) {
+  ipcMain.handle(channel, (event, ...args) => {
+    if (!isShellSender(ctx, event.sender.id)) {
+      validationLogger.log(`${channel}: rejected invoke from sender ${event.sender.id}`);
+      throw new Error(`IPC channel ${channel} is restricted to the shell renderer`);
     }
-    this.restoring = true;
-    this.emitChanged();
-    try {
-      const seen = /* @__PURE__ */ new Map();
-      for (const session of sessions) {
-        const key = pathKey(session.root);
-        const seenCount = seen.get(key) ?? 0;
-        seen.set(key, seenCount + 1);
-        await this.openProject(session.root, {
-          forceNew: seenCount > 0,
-          name: session.name,
-          runtimeId: session.runtimeId
-        }).catch((err) => {
-          process.stderr.write(
-            `[desktop:restore] Failed to restore ${session.root}: ${toErrorMessage(err)}
-`
-          );
-        });
-      }
-      let restoredActive = false;
-      if (this.restoreActiveRuntimeId) {
-        const active = this.runtimes.get(this.restoreActiveRuntimeId);
-        if (active) {
-          await this.activateRuntime(active.id);
-          restoredActive = true;
-        }
-      }
-      if (!restoredActive && this.restoreActiveProjectRoot) {
-        const active = Array.from(this.runtimes.values()).find(
-          (runtime) => samePath(runtime.root, this.restoreActiveProjectRoot ?? "")
-        );
-        if (active) await this.activateRuntime(active.id);
-      }
-    } finally {
-      this.restoring = false;
-      this.workspaceRestoreCompleted = true;
-      this.emitChanged();
-      await this.saveDesktopState();
-    }
-  }
-  getRuntime(id) {
-    const runtime = this.runtimes.get(id);
-    return runtime ? publicRuntime(runtime) : void 0;
-  }
-  getRuntimeUrlWithToken(id) {
-    const runtime = this.runtimes.get(id);
-    if (!runtime) return void 0;
-    const url = new URL(runtime.url);
-    url.searchParams.set("token", runtime.token);
-    url.searchParams.set("shell", "desktop");
-    return url.toString();
-  }
-  getRuntimeWsUrlWithToken(id) {
-    const runtime = this.runtimes.get(id);
-    if (!runtime) return void 0;
-    const url = new URL(`ws://127.0.0.1:${runtime.wsPort}`);
-    url.searchParams.set("token", runtime.token);
-    return url.toString();
-  }
-  async openProject(projectRoot, options = {}) {
-    const resolved = path3.resolve(projectRoot);
-    const stat3 = await fs2.stat(resolved).catch(() => null);
-    if (!stat3?.isDirectory()) throw new Error(`Not a directory: ${resolved}`);
-    const kind = options.kind ?? "project";
-    const touchRecent = options.touchRecent ?? kind === "project";
-    const forceNew = options.forceNew === true;
-    const authorization = await authorizeDesktopRuntimeStart(this.trustBoundary, resolved, kind);
-    if (!authorization.allowed) {
-      throw new Error(`Desktop runtime start denied: ${authorization.reason}`);
+    return handler(event, ...args);
+  });
+}
+function registerIpcHandlers(ctx) {
+  handleShellOnly(ctx, IPC.getState, () => ctx.getRuntimeManager().snapshot());
+  handleShellOnly(ctx, IPC.getConversation, (_event, runtimeId) => {
+    const result = validate(runtimeIdSchema, runtimeId);
+    if (!result.success) {
+      validationLogger.log(`getConversation: ${result.error}`);
+      return ctx.getAgentBridge().snapshot("");
     }
-    if (!forceNew) {
-      const existing = Array.from(this.runtimes.values()).find(
-        (runtime2) => samePath(runtime2.root, resolved) && runtime2.kind === kind && (runtime2.status === "starting" || runtime2.status === "running")
-      );
-      if (existing) {
-        this.activeRuntimeId = existing.id;
-        if (existing.kind === "project") this.lastActiveProjectRoot = existing.root;
-        if (touchRecent) {
-          await this.touchProject(existing.root);
-        } else {
-          await this.persistWorkspaceState();
-        }
-        this.emitChanged();
-        return publicRuntime(existing);
-      }
-      const staleSameRoot = Array.from(this.runtimes.values()).filter(
-        (runtime2) => samePath(runtime2.root, resolved) && runtime2.kind === kind
-      );
-      for (const stale of staleSameRoot) {
-        await this.closeRuntimeInternal(stale.id, { persistWorkspace: false });
-      }
+    return ctx.getAgentBridge().snapshot(result.data);
+  });
+  handleShellOnly(ctx, IPC.getWebuiStatus, () => ctx.getWebuiStatus());
+  handleShellOnly(ctx, IPC.getOpenSessions, () => ctx.getOpenSessions());
+  handleShellOnly(ctx, IPC.navigateWebui, async (_event, command) => {
+    return ctx.dispatchWebuiCommand(command);
+  });
+  handleShellOnly(ctx, IPC.reloadWebui, async () => ctx.reloadActiveWebuiView());
+  handleShellOnly(ctx, IPC.setShellSidebarCollapsed, (_event, collapsed) => {
+    const result = validateOrDefault(booleanSchema, collapsed, true);
+    ctx.setShellSidebarCollapsed(result);
+    return true;
+  });
+  handleShellOnly(ctx, IPC.openSettings, async () => ctx.openSettings());
+  handleShellOnly(ctx, IPC.openProjectSession, async (_event, runtimeId) => {
+    const validated = validateOptional(runtimeIdSchema, runtimeId);
+    return ctx.openProjectSession(validated);
+  });
+  handleShellOnly(ctx, IPC.openProject, async (_event, requestedRoot) => {
+    const validated = validateOptional(projectRootSchema, requestedRoot);
+    return ctx.openProject(validated);
+  });
+  handleShellOnly(ctx, IPC.registerProject, async (_event, requestedRoot) => {
+    const validated = validateOptional(projectRootSchema, requestedRoot);
+    return ctx.registerProject(validated);
+  });
+  handleShellOnly(ctx, IPC.unregisterProject, async (_event, root) => {
+    const result = validate(pathSchema, root);
+    if (!result.success) {
+      validationLogger.log(`unregisterProject: ${result.error}`);
+      return ctx.getRuntimeManager().snapshot();
     }
-    const slug = projectSlug(resolved);
-    const requestedRuntimeId = normalizeRuntimeId(options.runtimeId);
-    const runtimeId = requestedRuntimeId && !this.runtimes.has(requestedRuntimeId) ? requestedRuntimeId : `${slug}-${randomBytes(3).toString("hex")}`;
-    const name = options.name ?? nextRuntimeName(this.runtimes, resolved, kind);
-    const httpPort = await findFreePort(HTTP_PORT_START, usedPorts(this.runtimes));
-    const wsPort = await findFreePort(
-      WS_PORT_START,
-      /* @__PURE__ */ new Set([...usedPorts(this.runtimes), httpPort])
-    );
-    const token = randomBytes(24).toString("hex");
-    const runtime = {
-      id: runtimeId,
-      name,
-      root: resolved,
-      slug,
-      kind,
-      status: "starting",
-      httpPort,
-      wsPort,
-      url: `http://127.0.0.1:${httpPort}`,
-      startedAt: (/* @__PURE__ */ new Date()).toISOString(),
-      token,
-      child: null,
-      logs: [],
-      logNotifyTimer: null
-    };
-    this.runtimes.set(runtimeId, runtime);
-    this.activeRuntimeId = runtimeId;
-    if (kind === "project") this.lastActiveProjectRoot = resolved;
-    if (touchRecent) {
-      await this.touchProject(resolved);
-    } else {
-      await this.persistWorkspaceState();
+    return ctx.unregisterProject(result.data);
+  });
+  handleShellOnly(ctx, IPC.activateRuntime, async (_event, id) => {
+    const result = validate(runtimeIdSchema, id);
+    if (!result.success) {
+      validationLogger.log(`activateRuntime: ${result.error}`);
+      return ctx.getRuntimeManager().snapshot();
     }
-    this.emitChanged();
-    try {
-      const entry = resolveWebUiEntry();
-      const distDir = resolveWebUiDistDir();
-      const child = spawn(
-        process.execPath,
-        [
-          entry,
-          "--host",
-          "127.0.0.1",
-          "--port",
-          String(httpPort),
-          "--ws-port",
-          String(wsPort),
-          "--dist-dir",
-          distDir,
-          "--require-token"
-        ],
-        {
-          cwd: resolved,
-          env: {
-            ...buildChildEnv(),
-            ELECTRON_RUN_AS_NODE: "1",
-            WEBUI_STRICT_PORT: "1",
-            WRONGSTACK_DESKTOP: "1",
-            // Passed by environment, not argv. A process command line is
-            // world-readable on every platform this ships to — `ps -ef` on
-            // POSIX, Task Manager's command-line column or a plain WMI query on
-            // Windows — so `--token <secret>` handed the WebUI access token to
-            // any local process that cared to look. The token grants full agent
-            // control, so that is a credential disclosure, not a nuisance.
-            // entry.ts already reads WEBUI_TOKEN; argv only took precedence
-            // over it (WS-087).
-            WEBUI_TOKEN: token
-          },
-          stdio: ["ignore", "pipe", "pipe"],
-          windowsHide: true
-        }
-      );
-      runtime.child = child;
-      runtime.pid = child.pid;
-      child.stdout?.on("data", (chunk) => {
-        const text = chunk.toString();
-        appendRuntimeLog(runtime, "stdout", text);
-        this.scheduleLogChanged(runtime);
-        process.stdout.write(`[desktop:${runtime.id}] ${text}`);
-      });
-      child.stderr?.on("data", (chunk) => {
-        const text = chunk.toString();
-        appendRuntimeLog(runtime, "stderr", text);
-        this.scheduleLogChanged(runtime);
-        process.stderr.write(`[desktop:${runtime.id}] ${text}`);
-      });
-      child.once("error", (err) => {
-        runtime.status = "error";
-        runtime.error = toErrorMessage(err);
-        runtime.child = null;
-        if (this.activeRuntimeId === runtime.id) {
-          this.activeRuntimeId = firstRunningRuntimeId(this.runtimes);
-        }
-        this.emitChanged();
-      });
-      child.once("exit", (code, signal) => {
-        if (runtime.status === "error") return;
-        runtime.status = "stopped";
-        runtime.error = code === 0 ? void 0 : `Exited with ${signal ?? `code ${code ?? "unknown"}`}`;
-        runtime.child = null;
-        if (this.activeRuntimeId === runtime.id) {
-          this.activeRuntimeId = firstRunningRuntimeId(this.runtimes);
-        }
-        this.emitChanged();
-      });
-      await waitForHttpReady(runtime.url, token, START_TIMEOUT_MS);
-      if (runtime.status !== "starting") {
-        throw new Error(runtime.error ?? "WebUI process exited during startup");
-      }
-      runtime.status = "running";
-      await this.persistWorkspaceState();
-      this.emitChanged();
-      return publicRuntime(runtime);
-    } catch (err) {
-      if (runtime.status !== "stopped" && runtime.status !== "error") {
-        runtime.status = "error";
-      }
-      if (runtime.error === void 0) {
-        runtime.error = toErrorMessage(err);
-      }
-      await terminateProcessTree(runtime.child);
-      runtime.child = null;
-      if (this.activeRuntimeId === runtime.id) {
-        this.activeRuntimeId = firstRunningRuntimeId(this.runtimes);
-      }
-      this.emitChanged();
-      throw err;
+    return ctx.activateRuntime(result.data);
+  });
+  handleShellOnly(ctx, IPC.closeRuntime, async (_event, id) => {
+    const result = validate(runtimeIdSchema, id);
+    if (!result.success) {
+      validationLogger.log(`closeRuntime: ${result.error}`);
+      return ctx.getRuntimeManager().snapshot();
     }
-  }
-  async activateRuntime(id) {
-    const runtime = this.runtimes.get(id);
-    if (!runtime) throw new Error(`Runtime not found: ${id}`);
-    this.activeRuntimeId = id;
-    if (runtime.kind === "project") this.lastActiveProjectRoot = runtime.root;
-    if (runtime.kind === "project") {
-      await this.touchProject(runtime.root);
-    } else {
-      await this.persistWorkspaceState();
+    return ctx.closeRuntime(result.data);
+  });
+  handleShellOnly(ctx, IPC.sendMessage, async (_event, id, content) => {
+    const idResult = validate(runtimeIdSchema, id);
+    if (!idResult.success) {
+      validationLogger.log(`sendMessage (id): ${idResult.error}`);
+      return ctx.sendMessage("", "", "");
     }
-    this.emitChanged();
-  }
-  async closeRuntime(id) {
-    const runtime = this.runtimes.get(id);
-    if (runtime) {
-      const authorization = await authorizeDesktopRuntimeStop(this.trustBoundary, runtime);
-      if (!authorization.allowed) {
-        throw new Error(`Desktop runtime stop denied: ${authorization.reason}`);
-      }
-    }
-    await this.closeRuntimeInternal(id, { persistWorkspace: true });
-  }
-  async closeAll(options = {}) {
-    const persistWorkspace = options.persistWorkspace ?? true;
-    await Promise.all(
-      Array.from(this.runtimes.keys()).map(
-        (id) => this.closeRuntimeInternal(id, { persistWorkspace })
-      )
+    const contentResult = validate(
+      pathSchema.transform(() => String(content ?? "")),
+      content
     );
-  }
-  async registerProject(projectRoot) {
-    const resolved = path3.resolve(projectRoot);
-    const stat3 = await fs2.stat(resolved).catch(() => null);
-    if (!stat3?.isDirectory()) throw new Error(`Not a directory: ${resolved}`);
-    const now = (/* @__PURE__ */ new Date()).toISOString();
-    const entry = {
-      name: path3.basename(resolved) || resolved,
-      root: resolved,
-      slug: projectSlug(resolved),
-      lastSeen: now,
-      lastWorkingDir: resolved
-    };
-    this.registeredProjects = await touchGlobalProjectManifest(entry);
-    this.emitChanged();
-  }
-  async unregisterProject(projectRoot) {
-    const resolved = path3.resolve(projectRoot);
-    this.registeredProjects = await removeGlobalProjectManifest(resolved);
-    await this.saveDesktopState();
-    this.emitChanged();
-  }
-  async closeRuntimeInternal(id, options) {
-    const runtime = this.runtimes.get(id);
-    if (!runtime) return;
-    runtime.status = "stopped";
-    const child = runtime.child;
-    runtime.child = null;
-    await terminateProcessTree(child);
-    if (runtime.logNotifyTimer) {
-      clearTimeout(runtime.logNotifyTimer);
-      runtime.logNotifyTimer = null;
-    }
-    this.runtimes.delete(id);
-    if (this.activeRuntimeId === id) this.activeRuntimeId = firstRunningRuntimeId(this.runtimes);
-    if (this.lastActiveProjectRoot && samePath(this.lastActiveProjectRoot, runtime.root)) {
-      this.lastActiveProjectRoot = firstProjectRuntimeRoot(this.runtimes);
-    }
-    if (options.persistWorkspace) {
-      await this.persistWorkspaceState();
-    }
-    this.emitChanged();
-  }
-  async touchProject(projectRoot) {
-    const resolved = path3.resolve(projectRoot);
-    const now = (/* @__PURE__ */ new Date()).toISOString();
-    const entry = {
-      name: path3.basename(resolved) || resolved,
-      root: resolved,
-      slug: projectSlug(resolved),
-      lastSeen: now,
-      lastWorkingDir: resolved
-    };
-    this.recentProjects = [
-      entry,
-      ...this.recentProjects.filter((p) => !samePath(p.root, resolved))
-    ].slice(0, 24);
-    const [, registeredProjects] = await Promise.all([
-      this.saveDesktopState(),
-      touchGlobalProjectManifest(entry)
-    ]);
-    this.registeredProjects = registeredProjects;
-  }
-  async persistWorkspaceState() {
-    await this.saveDesktopState();
-  }
-  async loadDesktopState() {
-    try {
-      const raw = await fs2.readFile(this.stateFile, "utf8");
-      const parsed = JSON.parse(raw);
-      const openProjects = normalizePathList(parsed.openProjects);
-      const openProjectSessions = normalizeSessionStateList(
-        parsed.openProjectSessions,
-        openProjects
-      );
-      return {
-        recentProjects: normalizeProjectEntries(parsed.recentProjects),
-        openProjects,
-        openProjectSessions,
-        activeRuntimeId: normalizeRuntimeId(parsed.activeRuntimeId) ?? null,
-        activeProjectRoot: typeof parsed.activeProjectRoot === "string" && parsed.activeProjectRoot.trim() ? path3.resolve(parsed.activeProjectRoot) : null,
-        window: normalizeWindowState(parsed.window)
-      };
-    } catch {
-      return {
-        recentProjects: [],
-        openProjects: [],
-        openProjectSessions: [],
-        activeRuntimeId: null,
-        activeProjectRoot: null,
-        window: null
-      };
+    const safeContent = contentResult.success ? contentResult.data : String(content ?? "");
+    return ctx.sendMessage(
+      idResult.data,
+      ctx.getRuntimeManager().getRuntimeWsUrlWithToken(idResult.data) ?? "",
+      safeContent
+    );
+  });
+  handleShellOnly(ctx, IPC.abortRuntime, async (_event, id) => {
+    const result = validate(runtimeIdSchema, id);
+    if (!result.success) {
+      validationLogger.log(`abortRuntime: ${result.error}`);
+      return ctx.abortRuntime("", "");
     }
-  }
-  async saveDesktopState() {
-    await fs2.mkdir(path3.dirname(this.stateFile), { recursive: true });
-    const liveProjectSessions = Array.from(this.runtimes.values()).filter((runtime) => runtime.status !== "stopped" && runtime.kind === "project").map((runtime) => runtimeToSessionState(runtime));
-    const openProjectSessions = liveProjectSessions.length === 0 && !this.workspaceRestoreCompleted ? [...this.restoreProjectSessions] : liveProjectSessions;
-    const openProjects = openProjectSessions.map((session) => session.root);
-    const activeRuntime = this.activeRuntimeId ? this.runtimes.get(this.activeRuntimeId) : null;
-    const lastActiveProjectRoot = this.lastActiveProjectRoot;
-    const fallbackSession = lastActiveProjectRoot ? openProjectSessions.find((session) => samePath(session.root, lastActiveProjectRoot)) : void 0;
-    const activeSession = activeRuntime?.kind === "project" ? runtimeToSessionState(activeRuntime) : fallbackSession ?? openProjectSessions[0];
-    const activeRoot = activeSession?.root;
-    const activeRuntimeId = activeSession?.runtimeId ?? null;
-    await atomicWrite2(
-      this.stateFile,
-      `${JSON.stringify(
-        {
-          recentProjects: this.recentProjects,
-          openProjects,
-          openProjectSessions,
-          activeRuntimeId,
-          activeProjectRoot: activeRoot ?? null,
-          window: this.windowState
-        },
-        null,
-        2
-      )}
-`,
-      { mode: 384 }
+    return ctx.abortRuntime(
+      result.data,
+      ctx.getRuntimeManager().getRuntimeWsUrlWithToken(result.data) ?? ""
     );
-  }
-  emitChanged() {
-    this.emit("changed");
-  }
-  scheduleLogChanged(runtime) {
-    if (runtime.logNotifyTimer) return;
-    runtime.logNotifyTimer = setTimeout(() => {
-      runtime.logNotifyTimer = null;
-      if (this.runtimes.get(runtime.id) === runtime) {
-        this.emitChanged();
-      }
-    }, 250);
-  }
-};
-function hasChildExited(child) {
-  return child.exitCode !== null || child.signalCode !== null;
-}
-function waitForChildExit(child, timeoutMs) {
-  if (hasChildExited(child)) return Promise.resolve(true);
-  return new Promise((resolve4) => {
-    let settled = false;
-    const finish = (exited) => {
-      if (settled) return;
-      settled = true;
-      clearTimeout(timer);
-      child.off("exit", onExit);
-      resolve4(exited);
-    };
-    const onExit = () => finish(true);
-    const timer = setTimeout(() => finish(hasChildExited(child)), timeoutMs);
-    timer.unref?.();
-    child.once("exit", onExit);
-    if (hasChildExited(child)) finish(true);
   });
-}
-async function terminateProcessTree(child) {
-  if (!child?.pid || hasChildExited(child)) return;
-  if (process.platform !== "win32") {
-    const pid = child.pid;
-    const exited = waitForChildExit(child, 5e3);
-    child.kill("SIGTERM");
-    if (await exited) return;
-    if (!hasChildExited(child)) {
-      try {
-        process.kill(-pid, "SIGKILL");
-      } catch {
-        child.kill("SIGKILL");
-      }
-      await waitForChildExit(child, 1e3);
+  handleShellOnly(ctx, IPC.openRuntimeInBrowser, async (_event, id) => {
+    const result = validate(runtimeIdSchema, id);
+    if (!result.success) {
+      validationLogger.log(`openRuntimeInBrowser: ${result.error}`);
+      return;
     }
-    return;
-  }
-  await new Promise((resolve4) => {
-    let settled = false;
-    const finish = () => {
-      if (settled) return;
-      settled = true;
-      resolve4();
-    };
-    const timer = setTimeout(finish, 3e3);
-    timer.unref?.();
-    const killer = spawn("taskkill", ["/PID", String(child.pid), "/T", "/F"], {
-      stdio: "ignore",
-      windowsHide: true
-    });
-    killer.once("exit", () => {
-      clearTimeout(timer);
-      finish();
-    });
-    killer.once("error", () => {
-      clearTimeout(timer);
-      child.kill();
-      finish();
-    });
+    const url = ctx.getRuntimeManager().getRuntimeUrlWithToken(result.data);
+    if (url) ctx.openExternal(url);
   });
-}
-function publicRuntime(runtime) {
-  const {
-    child: _child,
-    token: _token,
-    logs,
-    logNotifyTimer: _logNotifyTimer,
-    ...record
-  } = runtime;
-  void _child;
-  void _token;
-  void _logNotifyTimer;
-  return {
-    ...record,
-    recentLogs: logs.slice(-40)
-  };
-}
-function runtimeToSessionState(runtime) {
-  return {
-    runtimeId: runtime.id,
-    name: runtime.name,
-    root: runtime.root,
-    startedAt: runtime.startedAt
-  };
-}
-function appendRuntimeLog(runtime, stream, text) {
-  for (const rawLine of text.split(/\r?\n/)) {
-    const line = rawLine.trimEnd();
-    if (!line) continue;
-    runtime.logs.push(`[${stream}] ${line}`);
-  }
-  if (runtime.logs.length > 120) {
-    runtime.logs.splice(0, runtime.logs.length - 120);
-  }
-}
-function normalizePathList(value) {
-  if (!Array.isArray(value)) return [];
-  const roots = [];
-  for (const item of value) {
-    if (typeof item !== "string" || !item.trim()) continue;
-    const resolved = path3.resolve(item);
-    roots.push(resolved);
-  }
-  return roots.slice(0, 12);
-}
-function normalizeSessionStateList(value, fallbackRoots) {
-  if (!Array.isArray(value)) {
-    return fallbackRoots.map((root) => ({ root })).slice(0, 12);
-  }
-  const sessions = [];
-  for (const item of value) {
-    if (!item || typeof item !== "object") continue;
-    const candidate = item;
-    if (typeof candidate.root !== "string" || !candidate.root.trim()) continue;
-    const session = {
-      root: path3.resolve(candidate.root)
-    };
-    const runtimeId = normalizeRuntimeId(candidate.runtimeId);
-    if (runtimeId) session.runtimeId = runtimeId;
-    if (typeof candidate.name === "string" && candidate.name.trim()) {
-      session.name = candidate.name.trim().slice(0, 120);
-    }
-    if (typeof candidate.startedAt === "string" && candidate.startedAt.trim()) {
-      session.startedAt = candidate.startedAt.trim();
+  handleShellOnly(ctx, IPC.revealRuntimeRoot, async (_event, id) => {
+    const result = validate(runtimeIdSchema, id);
+    if (!result.success) {
+      validationLogger.log(`revealRuntimeRoot: ${result.error}`);
+      return;
     }
-    sessions.push(session);
-  }
-  return sessions.slice(0, 12);
-}
-function normalizeRuntimeId(value) {
-  if (typeof value !== "string") return void 0;
-  const trimmed = value.trim();
-  if (!/^[a-zA-Z0-9._:-]{3,120}$/.test(trimmed)) return void 0;
-  return trimmed;
-}
-function normalizeWindowState(value) {
-  if (!value || typeof value !== "object") return null;
-  const candidate = value;
-  const width = Number(candidate.width);
-  const height = Number(candidate.height);
-  if (!Number.isFinite(width) || !Number.isFinite(height)) return null;
-  if (width < MIN_WINDOW_WIDTH || height < MIN_WINDOW_HEIGHT) return null;
-  const state = {
-    width: Math.round(width),
-    height: Math.round(height),
-    maximized: Boolean(candidate.maximized)
-  };
-  if (Number.isFinite(Number(candidate.x))) state.x = Math.round(Number(candidate.x));
-  if (Number.isFinite(Number(candidate.y))) state.y = Math.round(Number(candidate.y));
-  return state;
-}
-function firstRunningRuntimeId(runtimes) {
-  return Array.from(runtimes.values()).find((runtime) => runtime.status === "running")?.id ?? null;
-}
-function firstProjectRuntimeRoot(runtimes) {
-  return Array.from(runtimes.values()).find(
-    (runtime) => runtime.status === "running" && runtime.kind === "project"
-  )?.root ?? null;
-}
-function usedPorts(runtimes) {
-  const ports = /* @__PURE__ */ new Set();
-  for (const runtime of runtimes.values()) {
-    ports.add(runtime.httpPort);
-    ports.add(runtime.wsPort);
-  }
-  return ports;
-}
-function nextRuntimeName(runtimes, root, kind) {
-  const baseName = path3.basename(root) || root;
-  if (kind !== "project") return baseName;
-  const liveSameRoot = Array.from(runtimes.values()).filter(
-    (runtime) => runtime.kind === "project" && samePath(runtime.root, root) && runtime.status !== "stopped"
-  ).length;
-  return liveSameRoot === 0 ? baseName : `${baseName} #${liveSameRoot + 1}`;
-}
-function pathKey(value) {
-  const resolved = path3.resolve(value);
-  return os.platform() === "win32" ? resolved.toLowerCase() : resolved;
-}
-async function findFreePort(startPort, exclude) {
-  for (let port = startPort; port < startPort + 200; port++) {
-    if (exclude.has(port)) continue;
-    if (await isPortFree(port)) return port;
-  }
-  throw new Error(`No free local port found near ${startPort}`);
-}
-function isPortFree(port) {
-  return new Promise((resolve4) => {
-    const server = net.createServer();
-    server.once("error", () => resolve4(false));
-    server.once("listening", () => {
-      server.close(() => resolve4(true));
-    });
-    server.listen(port, "127.0.0.1");
-  });
-}
-function waitForHttpReady(baseUrl, token, timeoutMs) {
-  const deadline = Date.now() + timeoutMs;
-  const url = new URL(baseUrl);
-  url.searchParams.set("token", token);
-  url.searchParams.set("shell", "desktop");
-  return new Promise((resolve4, reject) => {
-    let probeTimer;
-    const cleanup = () => {
-      if (probeTimer) {
-        clearTimeout(probeTimer);
-        probeTimer = void 0;
-      }
-    };
-    const probe = () => {
-      let done = false;
-      const triggerRetry = () => {
-        if (done) return;
-        done = true;
-        if (Date.now() >= deadline) {
-          reject(new Error(`WebUI did not become ready at ${baseUrl}`));
-          return;
-        }
-        probeTimer = setTimeout(probe, 250);
-      };
-      const req = http.get(url, (res) => {
-        res.resume();
-        if (res.statusCode && res.statusCode >= 200 && res.statusCode < 500) {
-          if (!done) {
-            done = true;
-            cleanup();
-            resolve4();
-          }
-          return;
-        }
-        triggerRetry();
-      });
-      req.once("error", () => {
-        triggerRetry();
-      });
-      req.setTimeout(1e3, () => {
-        req.destroy();
-        triggerRetry();
-      });
-    };
-    probe();
-  });
-}
-async function readGlobalProjectManifest() {
-  const manifestFile = path3.join(wstackGlobalRoot2(), "projects.json");
-  try {
-    const raw = await fs2.readFile(manifestFile, "utf8");
-    return normalizeProjectManifest(JSON.parse(raw));
-  } catch {
-    return [];
-  }
-}
-function normalizeProjectManifest(value) {
-  if (Array.isArray(value)) return normalizeProjectEntries(value).slice(0, 80);
-  if (!value || typeof value !== "object") return [];
-  const manifest = value;
-  const source = Array.isArray(manifest.projects) ? manifest.projects : Array.isArray(manifest.recentProjects) ? manifest.recentProjects : Array.isArray(manifest.recents) ? manifest.recents : [];
-  return normalizeProjectEntries(source).slice(0, 80);
-}
-function normalizeProjectEntries(value) {
-  if (!Array.isArray(value)) return [];
-  const seen = /* @__PURE__ */ new Set();
-  const projects = [];
-  for (const item of value) {
-    const project = normalizeProjectEntry(item);
-    if (!project) continue;
-    const key = pathKey(project.root);
-    if (seen.has(key)) continue;
-    seen.add(key);
-    projects.push(project);
-  }
-  return projects.sort(
-    (a, b) => (b.lastSeen ?? b.createdAt ?? "").localeCompare(a.lastSeen ?? a.createdAt ?? "")
-  );
-}
-function normalizeProjectEntry(value) {
-  if (!value || typeof value !== "object") return null;
-  const candidate = value;
-  if (typeof candidate.root !== "string" || !candidate.root.trim()) return null;
-  const root = path3.resolve(candidate.root);
-  const name = typeof candidate.name === "string" && candidate.name.trim() ? candidate.name.trim() : path3.basename(root) || root;
-  const entry = {
-    name,
-    root,
-    slug: typeof candidate.slug === "string" && candidate.slug.trim() ? candidate.slug.trim() : projectSlug(root)
-  };
-  if (typeof candidate.lastSeen === "string" && candidate.lastSeen.trim()) {
-    entry.lastSeen = candidate.lastSeen.trim();
-  }
-  if (typeof candidate.createdAt === "string" && candidate.createdAt.trim()) {
-    entry.createdAt = candidate.createdAt.trim();
-  }
-  if (typeof candidate.lastWorkingDir === "string" && candidate.lastWorkingDir.trim()) {
-    entry.lastWorkingDir = path3.resolve(candidate.lastWorkingDir);
-  }
-  return entry;
-}
-async function touchGlobalProjectManifest(entry) {
-  const manifestFile = path3.join(wstackGlobalRoot2(), "projects.json");
-  const projects = await readGlobalProjectManifest();
-  const existing = projects.find((p) => samePath(p.root, entry.root));
-  if (existing) {
-    existing.name = entry.name;
-    existing.slug = entry.slug;
-    existing.lastSeen = entry.lastSeen;
-    existing.lastWorkingDir = entry.lastWorkingDir;
-  } else {
-    projects.push({ ...entry, createdAt: entry.lastSeen });
-  }
-  const sorted = projects.sort(
-    (a, b) => (b.lastSeen ?? b.createdAt ?? "").localeCompare(a.lastSeen ?? a.createdAt ?? "")
-  ).slice(0, 80);
-  await fs2.mkdir(path3.dirname(manifestFile), { recursive: true });
-  await atomicWrite2(manifestFile, `${JSON.stringify({ projects: sorted }, null, 2)}
-`, {
-    mode: 384
+    const runtime = ctx.getRuntimeManager().getRuntime(result.data);
+    if (runtime) ctx.revealInExplorer(runtime.root);
   });
-  return sorted;
-}
-async function removeGlobalProjectManifest(projectRoot) {
-  const manifestFile = path3.join(wstackGlobalRoot2(), "projects.json");
-  const resolved = path3.resolve(projectRoot);
-  const projects = (await readGlobalProjectManifest()).filter(
-    (project) => !samePath(project.root, resolved)
-  );
-  await fs2.mkdir(path3.dirname(manifestFile), { recursive: true });
-  await atomicWrite2(manifestFile, `${JSON.stringify({ projects }, null, 2)}
-`, { mode: 384 });
-  return projects;
-}
-function samePath(left, right) {
-  const a = path3.resolve(left);
-  const b = path3.resolve(right);
-  return os.platform() === "win32" ? a.toLowerCase() === b.toLowerCase() : a === b;
-}
-
-// src/main/main.ts
-import { watchProviderConfig } from "@wrongstack/core/storage";
-
-// src/main/webui/controller.ts
-import { shell, WebContentsView } from "electron";
-
-// src/main/state/constants.ts
-var OPEN_EXTERNAL_ALLOWED_PROTOCOLS = /* @__PURE__ */ new Set(["http:", "https:", "mailto:"]);
-var SIDEBAR_WIDTH_WIDE = 292;
-var SIDEBAR_WIDTH_MEDIUM = 276;
-var SIDEBAR_WIDTH_NARROW = 252;
-var SIDEBAR_WIDTH_COLLAPSED = 56;
-var MIN_WINDOW_WIDTH2 = 760;
-var MIN_WINDOW_HEIGHT2 = 520;
-var MAX_PENDING_WEBUI_COMMANDS = 50;
-var MAX_PENDING_FLUSH_ATTEMPTS = 80;
-var WEBUI_COMMAND_FALLBACK_MS = 350;
-var WEBUI_COMMAND_ACK_TIMEOUT_MS = 2e3;
-
-// src/main/webui-command-bridge.ts
-var DESKTOP_WEBUI_ACTIONS = /* @__PURE__ */ new Set([
-  "new-session",
-  "clear-context",
-  "compact-context",
-  "repair-context",
-  "download-chat",
-  "focus-chat",
-  "open-command-palette",
-  "open-shortcuts",
-  "search-chat",
-  "open-model-switcher",
-  "open-prompt-library"
-]);
-var DESKTOP_WEBUI_VIEWS = /* @__PURE__ */ new Set([
-  "chat",
-  "settings",
-  "goal",
-  "sddhub",
-  "files",
-  "changes",
-  "sessions",
-  "setup",
-  "skill",
-  "roster",
-  "mailbox",
-  "debug",
-  "design-gallery",
-  "refresh-debug",
-  "analytics"
-]);
-var DESKTOP_WEBUI_ACTIVITIES = /* @__PURE__ */ new Set([
-  "chat",
-  "agents",
-  "history",
-  "files",
-  "changes",
-  "mailbox",
-  "skills",
-  "design"
-]);
-var DESKTOP_WEBUI_OVERLAYS = /* @__PURE__ */ new Set([
-  "fleet",
-  "agents-monitor",
-  "processes",
-  "queue"
-]);
-var DESKTOP_WEBUI_DOCKS = /* @__PURE__ */ new Set([
-  "goal",
-  "fleet",
-  "work",
-  "worktrees",
-  "collab"
-]);
-var DESKTOP_WEBUI_WORK_TABS = /* @__PURE__ */ new Set(["todos", "tasks", "plan"]);
-var DESKTOP_WEBUI_PREF_KEYS = /* @__PURE__ */ new Set([
-  "yolo",
-  "nextPrediction",
-  "contextAutoCompact"
-]);
-function normalizeDesktopWebuiCommand(value) {
-  if (!isRecord(value)) return null;
-  const command = {};
-  let hasCommand = false;
-  const action = value["action"];
-  if (action !== void 0) {
-    if (typeof action !== "string" || !DESKTOP_WEBUI_ACTIONS.has(action)) {
-      return null;
-    }
-    command.action = action;
-    hasCommand = true;
-  }
-  const view = value["view"];
-  if (view !== void 0) {
-    if (typeof view !== "string" || !DESKTOP_WEBUI_VIEWS.has(view)) {
-      return null;
+  ipcMain.on(IPC.webuiReadyChanged, (event, ready) => {
+    const entry = ctx.findWebuiEntryBySenderId(event.sender.id);
+    if (!entry) return;
+    const isReady = ready === true;
+    entry.bridgeReady = isReady;
+    if (entry.bridgeReady) {
+      ctx.setEntryWebuiStatus(entry, { ...entry.status, status: "ready" });
+      ctx.schedulePendingWebuiFlush(entry);
+    } else if (entry.status.status === "ready") {
+      ctx.setEntryWebuiStatus(entry, { ...entry.status, status: "loading" });
     }
-    command.view = view;
-    hasCommand = true;
-  }
-  const activity = value["activity"];
-  if (activity !== void 0) {
-    if (typeof activity !== "string" || !DESKTOP_WEBUI_ACTIVITIES.has(activity)) {
-      return null;
+  });
+  ipcMain.on(IPC.webuiPrefsChanged, (event, prefs) => {
+    const entry = ctx.findWebuiEntryBySenderId(event.sender.id);
+    if (!entry) return;
+    const sanitized = sanitizeWebuiPrefs(prefs);
+    if (Object.keys(sanitized).length === 0) return;
+    ctx.setEntryWebuiStatus(entry, {
+      ...entry.status,
+      prefs: { ...entry.status.prefs ?? {}, ...sanitized }
+    });
+  });
+  ipcMain.on(IPC.webuiOpenSessionsChanged, (event, sessions) => {
+    const entry = ctx.findWebuiEntryBySenderId(event.sender.id);
+    if (!entry) return;
+    ctx.setOpenSessions(entry.runtimeId, sanitizeOpenSessions(sessions));
+  });
+  ipcMain.on(
+    IPC.webuiCommandAck,
+    (event, requestId, handled, _message) => {
+      const entry = ctx.findWebuiEntryBySenderId(event.sender.id);
+      if (!entry) return;
+      const result = validate(webuiCommandAckSchema, {
+        requestId,
+        handled,
+        message: _message
+      });
+      if (!result.success) {
+        validationLogger.log(`webuiCommandAck: ${result.error}`);
+        return;
+      }
+      const pending = ctx.getPendingWebuiCommandAcks().get(result.data.requestId);
+      if (!pending || pending.runtimeId !== entry.runtimeId) return;
+      ctx.settlePendingWebuiCommandAck(result.data.requestId, result.data.handled);
     }
-    command.activity = activity;
-    hasCommand = true;
-  }
-  const overlay = value["overlay"];
-  if (overlay !== void 0) {
-    if (typeof overlay !== "string" || !DESKTOP_WEBUI_OVERLAYS.has(overlay)) {
-      return null;
+  );
+  ipcMain.on(IPC.setLocale, (_event, locale) => {
+    const result = validate(setLocaleSchema, { locale });
+    if (!result.success) {
+      validationLogger.log(`setLocale: ${result.error}`);
+      return;
     }
-    command.overlay = overlay;
-    hasCommand = true;
+    ctx.getI18n().setMainLocale(result.data.locale);
+    ctx.configureApplicationMenu();
+    ctx.broadcastLocaleToEmbeddedWebuis(result.data.locale);
+    void ctx.getConfigIo().writeUiLocale(result.data.locale);
+  });
+}
+function validateOptional(schema, value) {
+  if (value === void 0 || value === null) return void 0;
+  const result = schema.safeParse(value);
+  return result.success ? result.data : void 0;
+}
+function sanitizeWebuiPrefs(prefs) {
+  const next = {};
+  if (!isRecord2(prefs)) return next;
+  if (typeof prefs["yolo"] === "boolean") next.yolo = prefs["yolo"];
+  if (typeof prefs["nextPrediction"] === "boolean") next.nextPrediction = prefs["nextPrediction"];
+  if (typeof prefs["contextAutoCompact"] === "boolean") {
+    next.contextAutoCompact = prefs["contextAutoCompact"];
   }
-  const dockSection = value["dockSection"];
-  if (dockSection !== void 0) {
-    if (typeof dockSection !== "string" || !DESKTOP_WEBUI_DOCKS.has(dockSection)) {
-      return null;
+  return next;
+}
+function isRecord2(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+
+// src/main/state/constants.ts
+var OPEN_EXTERNAL_ALLOWED_PROTOCOLS = /* @__PURE__ */ new Set(["http:", "https:", "mailto:"]);
+var SIDEBAR_WIDTH_WIDE = 292;
+var SIDEBAR_WIDTH_MEDIUM = 276;
+var SIDEBAR_WIDTH_NARROW = 252;
+var SIDEBAR_WIDTH_COLLAPSED = 56;
+var MIN_WINDOW_WIDTH = 760;
+var MIN_WINDOW_HEIGHT = 520;
+var MAX_PENDING_WEBUI_COMMANDS = 50;
+var MAX_PENDING_FLUSH_ATTEMPTS = 80;
+var WEBUI_COMMAND_FALLBACK_MS = 350;
+var WEBUI_COMMAND_ACK_TIMEOUT_MS = 2e3;
+
+// src/main/layout/sidebar.ts
+function getSidebarWidth(windowWidth, collapsed) {
+  if (collapsed) return SIDEBAR_WIDTH_COLLAPSED;
+  if (windowWidth < 900) return SIDEBAR_WIDTH_NARROW;
+  if (windowWidth < 1180) return SIDEBAR_WIDTH_MEDIUM;
+  return SIDEBAR_WIDTH_WIDE;
+}
+
+// src/main/macos-platform.ts
+import { app, Menu } from "electron";
+function initMacOS() {
+  if (process.platform !== "darwin") return;
+  app.setActivationPolicy("regular");
+  app.on("open-file", (_event, filePath) => {
+    if (app.isReady()) {
+      handleFileOpen(filePath);
     }
-    command.dockSection = dockSection;
-    hasCommand = true;
+  });
+  app.dock?.setMenu(
+    Menu.buildFromTemplate([
+      {
+        label: "New Window",
+        click: () => {
+        }
+      }
+    ])
+  );
+  app.setAboutPanelOptions({
+    applicationName: "WrongStack Desktop",
+    applicationVersion: app.getVersion(),
+    version: process.versions.electron ? `Electron ${process.versions.electron}` : ""
+  });
+}
+function handleFileOpen(filePath) {
+  pendingOpenFilePath = filePath;
+}
+var pendingOpenFilePath = null;
+function drainPendingOpenFilePath() {
+  const path7 = pendingOpenFilePath;
+  pendingOpenFilePath = null;
+  return path7;
+}
+function firstOpenFileArg(argv) {
+  if (process.platform !== "darwin") return null;
+  for (let index = 1; index < argv.length; index++) {
+    const arg = argv[index];
+    if (arg == null) continue;
+    if (arg.startsWith("-")) continue;
+    if (arg === "." || arg === "--") continue;
+    return arg;
   }
-  const workTab = value["workTab"];
-  if (workTab !== void 0) {
-    if (typeof workTab !== "string" || !DESKTOP_WEBUI_WORK_TABS.has(workTab)) {
-      return null;
-    }
-    command.workTab = workTab;
-    hasCommand = true;
+  return null;
+}
+
+// src/main/menu/index.ts
+import { Menu as Menu2 } from "electron";
+
+// src/main/menu/projects-menu.ts
+import path3 from "node:path";
+function buildProjectsMenu(runtimes, actions, t) {
+  const projectGroups = groupProjectRuntimesForMenu(runtimes);
+  const menu = [
+    {
+      label: t("openProjectEllipsis"),
+      accelerator: "CmdOrCtrl+O",
+      click: () => actions.newSession("")
+    },
+    {
+      label: t("registerProjectEllipsis"),
+      click: () => actions.registerProject?.()
+    },
+    { type: "separator" }
+  ];
+  if (projectGroups.length === 0) {
+    menu.push({ label: t("noOpenProjectSessions"), enabled: false });
+    return menu;
   }
-  const terminal = value["terminal"];
-  if (terminal !== void 0) {
-    if (terminal !== true && terminal !== false && terminal !== "toggle" && terminal !== "new") {
-      return null;
-    }
-    command.terminal = terminal;
-    hasCommand = true;
+  for (const group of projectGroups) {
+    menu.push({
+      label: group.name,
+      submenu: [
+        {
+          label: t("newSession"),
+          click: () => actions.newSession(group.sessions[0]?.id ?? ""),
+          enabled: Boolean(group.sessions[0])
+        },
+        {
+          label: t("revealProjectFolder"),
+          click: () => actions.reveal(group.sessions[0]?.id ?? ""),
+          enabled: Boolean(group.sessions[0])
+        },
+        { type: "separator" },
+        ...group.sessions.map((runtime, index) => buildSessionMenu(runtime, index + 1, actions, t))
+      ]
+    });
   }
-  const pref = value["pref"];
-  if (pref !== void 0) {
-    if (!isRecord(pref)) return null;
-    const key = pref["key"];
-    if (typeof key !== "string" || !DESKTOP_WEBUI_PREF_KEYS.has(key)) {
-      return null;
+  return menu;
+}
+function buildSessionMenu(runtime, index, actions, t) {
+  const running = runtime.status === "running";
+  const label = `${t("session")} ${index} \xB7 ${runtime.status}`;
+  return {
+    label,
+    submenu: [
+      {
+        label: t("quickView"),
+        click: () => actions.activate(runtime.id)
+      },
+      {
+        label: "WebUI",
+        enabled: running,
+        submenu: [
+          {
+            label: t("chat"),
+            click: () => actions.activateAndNavigate(runtime.id, { activity: "chat", view: "chat" })
+          },
+          {
+            label: t("focusPrompt"),
+            click: () => actions.activateAndNavigate(runtime.id, { action: "focus-chat" })
+          },
+          {
+            label: t("terminal"),
+            click: () => actions.activateAndNavigate(runtime.id, { terminal: "toggle" })
+          },
+          {
+            label: t("newTerminal"),
+            click: () => actions.activateAndNavigate(runtime.id, { terminal: "new" })
+          },
+          { type: "separator" },
+          {
+            label: t("files"),
+            click: () => actions.activateAndNavigate(runtime.id, { activity: "files", view: "files" })
+          },
+          {
+            label: t("changes"),
+            click: () => actions.activateAndNavigate(runtime.id, { activity: "changes", view: "changes" })
+          },
+          {
+            label: t("sessions"),
+            click: () => actions.activateAndNavigate(runtime.id, { view: "sessions" })
+          },
+          {
+            label: t("fleetHQ"),
+            click: () => actions.activateAndNavigate(runtime.id, { view: "roster" })
+          },
+          {
+            label: t("settings"),
+            click: () => actions.activateAndNavigate(runtime.id, { view: "settings" })
+          },
+          { type: "separator" },
+          {
+            label: t("commandPalette"),
+            click: () => actions.activateAndNavigate(runtime.id, { action: "open-command-palette" })
+          },
+          {
+            label: t("modelSwitcher"),
+            click: () => actions.activateAndNavigate(runtime.id, { action: "open-model-switcher" })
+          }
+        ]
+      },
+      { type: "separator" },
+      {
+        label: t("openInBrowser"),
+        enabled: running,
+        click: () => actions.openBrowser(runtime.id)
+      },
+      {
+        label: t("reloadWebui"),
+        enabled: running,
+        click: () => actions.reload(runtime.id)
+      },
+      {
+        label: t("closeSession"),
+        click: () => actions.close(runtime.id)
+      }
+    ]
+  };
+}
+function groupProjectRuntimesForMenu(runtimes) {
+  const groups = /* @__PURE__ */ new Map();
+  for (const runtime of runtimes) {
+    if (runtime.kind !== "project") continue;
+    const key = normalizeMenuRoot(runtime.root);
+    const existing = groups.get(key);
+    if (existing) {
+      existing.sessions.push(runtime);
+      continue;
     }
-    const toggle = pref["toggle"];
-    const prefValue = pref["value"];
-    if (toggle !== void 0 && typeof toggle !== "boolean") return null;
-    if (prefValue !== void 0 && typeof prefValue !== "boolean") return null;
-    if (toggle === void 0 && prefValue === void 0) return null;
-    command.pref = {
+    groups.set(key, {
       key,
-      ...typeof prefValue === "boolean" ? { value: prefValue } : {},
-      ...typeof toggle === "boolean" ? { toggle } : {}
-    };
-    hasCommand = true;
+      name: path3.basename(runtime.root) || runtime.name,
+      root: runtime.root,
+      sessions: [runtime]
+    });
   }
-  return hasCommand ? command : null;
+  return [...groups.values()].sort((a, b) => a.name.localeCompare(b.name));
 }
-function buildWebuiCommandFallbackScript(command) {
-  const payload = JSON.stringify(command).replace(/</g, "\\u003c");
-  return `window.dispatchEvent(new CustomEvent('wrongstack:desktop-command', { detail: ${payload} })); true;`;
+function normalizeMenuRoot(root) {
+  return root.replace(/\\/g, "/").replace(/\/+$/g, "").toLowerCase();
 }
-function isRecord(value) {
-  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+
+// src/main/menu/sections.ts
+function buildFileMenu(ctx, _actions, hasActiveRuntime, hasActiveProjectWebui, active, navigate, getActiveRuntimeId) {
+  return {
+    label: ctx.t("file"),
+    submenu: [
+      {
+        label: ctx.t("openProjectEllipsis"),
+        accelerator: "CmdOrCtrl+O",
+        click: () => void ctx.openProject()
+      },
+      { label: ctx.t("registerProjectEllipsis"), click: () => void ctx.registerProject() },
+      {
+        label: ctx.t("removeActiveFromRegistry"),
+        enabled: hasActiveProjectWebui,
+        click: () => {
+          if (active?.kind === "project") void ctx.unregisterProject(active.root);
+        }
+      },
+      { type: "separator" },
+      {
+        label: ctx.t("newSessionForActive"),
+        accelerator: "CmdOrCtrl+N",
+        enabled: hasActiveProjectWebui,
+        click: () => void ctx.openProjectSession(active?.id)
+      },
+      {
+        label: ctx.t("settings"),
+        accelerator: "CmdOrCtrl+,",
+        click: () => {
+          if (hasActiveRuntime) navigate({ view: "settings" });
+          else void ctx.openSettings();
+        }
+      },
+      { type: "separator" },
+      {
+        label: ctx.t("closeActiveRuntime"),
+        accelerator: "CmdOrCtrl+W",
+        enabled: hasActiveRuntime,
+        click: () => {
+          const id = getActiveRuntimeId();
+          if (id) void ctx.closeRuntime(id);
+        }
+      },
+      { type: "separator" },
+      {
+        role: process.platform === "darwin" ? "close" : "quit"
+      }
+    ]
+  };
+}
+function buildWorkspaceMenu(ctx, _actions, hasActiveWebui, prefs, navigate) {
+  const yoloChecked = prefs?.yolo === true;
+  const nextPredictionChecked = prefs?.nextPrediction === true;
+  const contextAutoCompactChecked = prefs?.contextAutoCompact === true;
+  const webuiItem = (item) => ({
+    ...item,
+    enabled: item.enabled ?? hasActiveWebui
+  });
+  return {
+    label: ctx.t("workspace"),
+    submenu: [
+      webuiItem({
+        label: ctx.t("openChat"),
+        accelerator: "CmdOrCtrl+1",
+        click: () => navigate({ activity: "chat", view: "chat" })
+      }),
+      webuiItem({
+        label: ctx.t("focusPrompt"),
+        accelerator: "CmdOrCtrl+/",
+        click: () => navigate({ action: "focus-chat" })
+      }),
+      webuiItem({
+        label: ctx.t("toggleTerminal"),
+        accelerator: "CmdOrCtrl+`",
+        click: () => navigate({ terminal: "toggle" })
+      }),
+      webuiItem({ label: ctx.t("newTerminal"), click: () => navigate({ terminal: "new" }) }),
+      { type: "separator" },
+      webuiItem({
+        label: ctx.t("commandPalette"),
+        accelerator: "CmdOrCtrl+K",
+        click: () => navigate({ action: "open-command-palette" })
+      }),
+      webuiItem({
+        label: ctx.t("quickModelSwitcher"),
+        accelerator: "CmdOrCtrl+M",
+        click: () => navigate({ action: "open-model-switcher" })
+      }),
+      webuiItem({
+        type: "checkbox",
+        label: ctx.t("yoloMode"),
+        checked: yoloChecked,
+        accelerator: "CmdOrCtrl+Shift+Y",
+        click: () => navigate({ pref: { key: "yolo", toggle: true } })
+      }),
+      webuiItem({
+        type: "checkbox",
+        label: ctx.t("nextPrediction"),
+        checked: nextPredictionChecked,
+        click: () => navigate({ pref: { key: "nextPrediction", toggle: true } })
+      }),
+      webuiItem({
+        type: "checkbox",
+        label: ctx.t("contextAutoCompact"),
+        checked: contextAutoCompactChecked,
+        click: () => navigate({ pref: { key: "contextAutoCompact", toggle: true } })
+      }),
+      { type: "separator" },
+      webuiItem({
+        label: ctx.t("reloadActiveWebui"),
+        accelerator: "CmdOrCtrl+Shift+R",
+        click: () => void ctx.reloadActiveWebuiView()
+      })
+    ]
+  };
+}
+function buildViewMenu(ctx) {
+  return {
+    label: ctx.t("view"),
+    submenu: [
+      {
+        type: "checkbox",
+        label: ctx.t("compactDesktopSidebar"),
+        accelerator: "CmdOrCtrl+B",
+        checked: ctx.getShellSidebarCollapsed(),
+        click: () => ctx.setShellSidebarCollapsed(!ctx.getShellSidebarCollapsed())
+      },
+      { type: "separator" },
+      { role: "reload" },
+      { role: "toggleDevTools" },
+      { type: "separator" },
+      { role: "resetZoom" },
+      { role: "zoomIn" },
+      { role: "zoomOut" },
+      { type: "separator" },
+      { role: "togglefullscreen" }
+    ]
+  };
+}
+
+// src/main/menu/index.ts
+function configureApplicationMenu(ctx) {
+  const snapshot = ctx.getSnapshot();
+  const active = ctx.getActiveRuntime();
+  const hasActiveRuntime = Boolean(active);
+  const hasActiveWebui = active?.status === "running";
+  const hasActiveProjectWebui = hasActiveWebui && active?.kind === "project";
+  const activeWebuiPrefs = ctx.getActiveWebuiPrefs();
+  const navigate = (command) => {
+    void ctx.dispatchWebuiCommand(command);
+  };
+  const activateAndNavigate = (runtimeId, command) => {
+    void ctx.activateRuntime(runtimeId).then(() => ctx.dispatchWebuiCommand(command));
+  };
+  const reloadRuntimeWebui = (runtimeId) => {
+    void ctx.activateRuntime(runtimeId).then(() => ctx.reloadActiveWebuiView());
+  };
+  const actions = {
+    activate: (runtimeId) => void ctx.activateRuntime(runtimeId),
+    activateAndNavigate,
+    registerProject: () => void ctx.registerProject(),
+    newSession: (runtimeId) => {
+      if (runtimeId) void ctx.openProjectSession(runtimeId);
+      else void ctx.openProject();
+    },
+    openBrowser: (runtimeId) => {
+      const url = ctx.getRuntimeManager().getRuntimeUrlWithToken(runtimeId);
+      if (url) ctx.openExternal(url);
+    },
+    reload: reloadRuntimeWebui,
+    close: (runtimeId) => void ctx.closeRuntime(runtimeId),
+    reveal: (runtimeId) => {
+      const runtime = ctx.getRuntimeManager().getRuntime(runtimeId);
+      if (runtime) ctx.revealInExplorer(runtime.root);
+    }
+  };
+  const template = [
+    buildFileMenu(
+      ctx,
+      actions,
+      hasActiveRuntime,
+      hasActiveProjectWebui,
+      active,
+      navigate,
+      ctx.getActiveRuntimeId
+    ),
+    {
+      label: ctx.t("projects"),
+      submenu: buildProjectsMenu(snapshot.runtimes, actions, ctx.t)
+    },
+    buildWorkspaceMenu(ctx, actions, hasActiveWebui, activeWebuiPrefs, navigate),
+    buildViewMenu(ctx)
+  ];
+  Menu2.setApplicationMenu(Menu2.buildFromTemplate(template));
 }
 
-// src/main/webui/navigation.ts
-function allowedExternalProtocol(target) {
+// src/main/runtime/operations.ts
+import * as fs4 from "node:fs/promises";
+
+// src/main/runtime-manager.ts
+import { spawn } from "node:child_process";
+import { randomBytes } from "node:crypto";
+import { EventEmitter as EventEmitter2 } from "node:events";
+import * as fs3 from "node:fs/promises";
+import * as http from "node:http";
+import * as net from "node:net";
+import * as os from "node:os";
+import * as path5 from "node:path";
+import {
+  atomicWrite as atomicWrite2,
+  buildChildEnv,
+  projectSlug,
+  resolveWstackPaths as resolveWstackPaths2,
+  toErrorMessage,
+  wstackGlobalRoot as wstackGlobalRoot2
+} from "@wrongstack/core/utils";
+
+// src/main/runtime-manager-paths.ts
+import { existsSync } from "node:fs";
+import { createRequire } from "node:module";
+import * as path4 from "node:path";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
+import { resolveWstackPaths } from "@wrongstack/core/utils";
+function resolveWebUiEntry() {
+  if (process.env["WRONGSTACK_WEBUI_ENTRY"]) {
+    return path4.resolve(process.env["WRONGSTACK_WEBUI_ENTRY"]);
+  }
+  const require2 = createRequire(import.meta.url);
   try {
-    const protocol = new URL(target).protocol;
-    return OPEN_EXTERNAL_ALLOWED_PROTOCOLS.has(protocol) ? protocol : void 0;
+    const serverPkgPath = require2.resolve("@wrongstack/webui-server/package.json");
+    const candidate = path4.join(path4.dirname(serverPkgPath), "dist", "server", "entry.js");
+    if (existsSync(candidate)) return candidate;
   } catch {
-    return void 0;
   }
+  const serverIndex = require2.resolve("@wrongstack/webui-server");
+  return path4.join(path4.dirname(serverIndex), "server", "entry.js");
 }
-function sameOrigin(candidate, base) {
-  if (!base) return false;
-  try {
-    return new URL(candidate).origin === new URL(base).origin;
-  } catch {
-    return false;
+function resolveWebUiDistDir() {
+  if (process.env["WRONGSTACK_WEBUI_DIST"]) {
+    return path4.resolve(process.env["WRONGSTACK_WEBUI_DIST"]);
   }
+  const require2 = createRequire(import.meta.url);
+  const serverEntry = require2.resolve("@wrongstack/webui");
+  const candidate = path4.dirname(serverEntry);
+  if (existsSync(candidate)) return candidate;
+  throw new Error(
+    `WebUI frontend assets not found at ${candidate}. Build @wrongstack/webui or set WRONGSTACK_WEBUI_DIST.`
+  );
+}
+function rendererIndexPath() {
+  return new URL("../renderer/index.html", import.meta.url).href;
+}
+function preloadPath() {
+  return fileURLToPath2(new URL("../preload/preload.cjs", import.meta.url));
+}
+function webuiPreloadPath() {
+  return fileURLToPath2(new URL("../preload/webui-preload.cjs", import.meta.url));
+}
+function desktopSettingsWorkspaceRoot() {
+  return path4.join(resolveWstackPaths({ projectRoot: process.cwd() }).configDir, "settings");
 }
 
-// src/main/webui/controller.ts
-var DesktopWebuiController = class {
-  constructor(ctx) {
-    this.ctx = ctx;
+// src/main/runtime-manager.ts
+var HTTP_PORT_START = 34560;
+var WS_PORT_START = 34660;
+var START_TIMEOUT_MS = 3e4;
+var MIN_WINDOW_WIDTH2 = 760;
+var MIN_WINDOW_HEIGHT2 = 520;
+var DEFAULT_IDLE_MINUTES = 15;
+var IDLE_SWEEP_INTERVAL_MS = 6e4;
+function resolveIdleTimeoutMs(env = process.env) {
+  const raw = Number.parseFloat(env.WRONGSTACK_DESKTOP_IDLE_MINUTES ?? "");
+  if (Number.isFinite(raw)) return raw > 0 ? raw * 6e4 : 0;
+  return DEFAULT_IDLE_MINUTES * 6e4;
+}
+function reclaimableRuntimeIds(runtimes, options) {
+  if (options.idleTimeoutMs <= 0) return [];
+  const out = [];
+  for (const [id, runtime] of runtimes) {
+    if (id === options.activeRuntimeId) continue;
+    if (runtime.status !== "running") continue;
+    if (options.now - runtime.lastActivityAt < options.idleTimeoutMs) continue;
+    out.push(id);
+  }
+  return out;
+}
+var DesktopRuntimeManager = class extends EventEmitter2 {
+  constructor(trustBoundary = desktopCompatibilityTrustBoundary) {
+    super();
+    this.trustBoundary = trustBoundary;
   }
-  ctx;
-  views = /* @__PURE__ */ new Map();
-  pendingAcks = /* @__PURE__ */ new Map();
+  trustBoundary;
+  runtimes = /* @__PURE__ */ new Map();
+  stateFile = path5.join(
+    resolveWstackPaths2({ projectRoot: process.cwd() }).configDir,
+    "desktop.json"
+  );
+  recentProjects = [];
+  registeredProjects = [];
+  restoreProjectSessions = [];
+  restoreActiveRuntimeId = null;
+  restoreActiveProjectRoot = null;
+  lastActiveProjectRoot = null;
+  windowState = null;
   activeRuntimeId = null;
-  status = { runtimeId: null, status: "idle" };
-  commandSequence = 0;
-  openExternal(target) {
-    const protocol = allowedExternalProtocol(target);
-    if (!protocol) return;
-    void authorizeDesktopAction(this.ctx.trustBoundary, {
-      capability: "url.open-external",
-      subject: { kind: "url", id: target, attributes: { protocol } },
-      risk: "elevated",
-      metadata: { operation: "webui-navigation" }
-    }).then((decision) => decision.allowed ? void shell.openExternal(target) : void 0).catch(() => void 0);
-  }
-  publishStatus(next) {
-    this.status = next;
-    const shellView2 = this.ctx.getShellView();
-    if (!shellView2 || shellView2.webContents.isDestroyed()) return;
-    shellView2.webContents.send(IPC.webuiStatusChanged, next);
-  }
-  setEntryStatus(entry, next) {
-    const previousPrefs = entry.status.prefs;
-    entry.status = {
-      ...next,
-      ...next.prefs === void 0 && previousPrefs !== void 0 ? { prefs: previousPrefs } : {},
-      // `pendingCommands` is always derived from the entry's own array (source of truth).
-      // Any `next.pendingCommands` value is intentionally overwritten.
-      pendingCommands: entry.pendingCommands.length
-    };
-    if (this.activeRuntimeId === entry.runtimeId) {
-      this.publishStatus(entry.status);
-      this.ctx.onPrefsChanged?.(previousPrefs, entry.status.prefs);
-    }
-  }
-  ensure(runtimeId) {
-    const mainWindow2 = this.ctx.getMainWindow();
-    if (!mainWindow2) return null;
-    const existing = this.views.get(runtimeId);
-    if (existing) return existing;
-    const view = new WebContentsView({
-      webPreferences: {
-        preload: webuiPreloadPath(),
-        contextIsolation: true,
-        nodeIntegration: false,
-        // This is the view that renders agent output, tool results, file
-        // contents, and fetched pages — i.e. the most attacker-influenceable
-        // surface in the app, and the one that most needs process-level
-        // containment rather than only bridge-level. webui-preload.ts imports
-        // just electron's contextBridge/ipcRenderer and a constants map, so it
-        // is already within the sandboxed preload subset (WS-093).
-        sandbox: true
-      }
-    });
-    const entry = {
-      runtimeId,
-      view,
-      url: null,
-      status: { runtimeId, status: "idle" },
-      bridgeReady: false,
-      attached: false,
-      pendingCommands: [],
-      pendingFlushTimer: null,
-      pendingFlushAttempts: 0
-    };
-    view.webContents.setWindowOpenHandler(({ url }) => {
-      this.openExternal(url);
-      return { action: "deny" };
-    });
-    view.webContents.on("will-navigate", (event, url) => {
-      if (sameOrigin(url, entry.url)) return;
-      event.preventDefault();
-      this.openExternal(url);
-    });
-    view.webContents.on("did-start-loading", () => {
-      if (this.views.get(runtimeId) !== entry) return;
-      entry.bridgeReady = false;
-      this.setEntryStatus(entry, { runtimeId, status: "loading" });
-    });
-    view.webContents.on("did-finish-load", () => {
-      if (this.views.get(runtimeId) !== entry) return;
-      this.scheduleFlush(entry);
-      try {
-        entry.view.webContents.send(IPC.webuiLocaleChanged, this.ctx.getLocale());
-      } catch {
-      }
-    });
-    view.webContents.on("did-fail-load", (_event, errorCode, errorDescription) => {
-      if (this.views.get(runtimeId) !== entry || errorCode === -3) return;
-      this.setEntryStatus(entry, { runtimeId, status: "error", error: errorDescription });
-    });
-    view.webContents.on("render-process-gone", (_event, details) => {
-      if (this.views.get(runtimeId) !== entry) return;
-      this.setEntryStatus(entry, {
-        runtimeId,
-        status: "error",
-        error: `WebUI renderer exited: ${details.reason}`
-      });
-    });
-    this.views.set(runtimeId, entry);
-    return entry;
-  }
-  attach(entry) {
-    const mainWindow2 = this.ctx.getMainWindow();
-    if (!mainWindow2 || entry.attached) return;
-    mainWindow2.contentView.addChildView(entry.view);
-    entry.attached = true;
-  }
-  dispose(entry) {
-    this.views.delete(entry.runtimeId);
-    entry.pendingCommands.length = 0;
-    this.settleRuntimeAcks(entry.runtimeId, false);
-    if (entry.pendingFlushTimer) clearTimeout(entry.pendingFlushTimer);
-    entry.pendingFlushTimer = null;
-    const mainWindow2 = this.ctx.getMainWindow();
-    if (mainWindow2 && entry.attached) mainWindow2.contentView.removeChildView(entry.view);
-    entry.attached = false;
-    if (!entry.view.webContents.isDestroyed()) entry.view.webContents.close();
-    if (this.activeRuntimeId === entry.runtimeId) this.activeRuntimeId = null;
-  }
-  disposeAll() {
-    for (const entry of [...this.views.values()]) this.dispose(entry);
-  }
-  findBySenderId(senderId) {
-    return [...this.views.values()].find((entry) => entry.view.webContents.id === senderId);
-  }
-  syncActive() {
-    if (!this.ctx.getMainWindow()) return;
-    const snapshot = this.ctx.manager.snapshot();
-    const live = new Set(snapshot.runtimes.filter((r) => r.status === "running").map((r) => r.id));
-    for (const [id, entry2] of this.views) if (!live.has(id)) this.dispose(entry2);
-    const active = snapshot.runtimes.find((runtime) => runtime.id === snapshot.activeRuntimeId);
-    if (active?.status !== "running") {
-      this.activeRuntimeId = active?.id ?? null;
-      this.publishStatus({ runtimeId: active?.id ?? null, status: "idle" });
-      this.ctx.layoutViews();
-      return;
-    }
-    const url = this.ctx.manager.getRuntimeUrlWithToken(active.id);
-    if (!url) {
-      this.activeRuntimeId = active.id;
-      this.publishStatus({ runtimeId: active.id, status: "idle" });
-      this.ctx.layoutViews();
-      return;
-    }
-    const entry = this.ensure(active.id);
-    if (!entry) return;
-    this.activeRuntimeId = active.id;
-    this.attach(entry);
-    this.ctx.layoutViews();
-    this.publishStatus(entry.status);
-    if (entry.url === url) return;
-    entry.url = url;
-    entry.bridgeReady = false;
-    this.setEntryStatus(entry, { runtimeId: active.id, status: "loading" });
-    void entry.view.webContents.loadURL(url).catch((error) => {
-      this.setEntryStatus(entry, {
-        runtimeId: active.id,
-        status: "error",
-        error: error instanceof Error ? error.message : String(error)
-      });
-    });
+  restoring = false;
+  workspaceRestoreCompleted = false;
+  idleSweepTimer = null;
+  idleTimeoutMs = 0;
+  async init() {
+    const state = await this.loadDesktopState();
+    this.recentProjects = state.recentProjects;
+    this.registeredProjects = await readGlobalProjectManifest();
+    this.restoreProjectSessions = state.openProjectSessions;
+    this.restoreActiveRuntimeId = state.activeRuntimeId;
+    this.restoreActiveProjectRoot = state.activeProjectRoot;
+    this.lastActiveProjectRoot = state.activeProjectRoot;
+    this.windowState = state.window;
   }
-  broadcastLocale(locale) {
-    for (const entry of this.views.values()) {
-      if (!entry.view.webContents.isDestroyed())
-        entry.view.webContents.send(IPC.webuiLocaleChanged, locale);
-    }
+  snapshot() {
+    const activeId = this.activeRuntimeId;
+    return {
+      activeRuntimeId: activeId,
+      runtimes: Array.from(this.runtimes.values()).map(
+        (runtime) => publicRuntime(runtime, runtime.id === activeId)
+      ),
+      recentProjects: [...this.recentProjects],
+      registeredProjects: [...this.registeredProjects],
+      restoring: this.restoring
+    };
   }
-  activeEntry() {
-    const id = this.ctx.manager.snapshot().activeRuntimeId;
-    return id ? this.views.get(id) : void 0;
+  getWindowState() {
+    return this.windowState ? { ...this.windowState } : null;
   }
-  async dispatch(commandInput) {
-    const command = normalizeDesktopWebuiCommand(commandInput);
-    if (!command) return false;
-    const entry = this.activeEntry();
-    if (!entry?.url) return false;
-    if (entry.status.status !== "ready" || !entry.bridgeReady) {
-      if (!entry.view.webContents.isLoading() && entry.status.status !== "error")
-        return this.dispatchNow(entry, command);
-      this.queue(entry, command);
-      this.scheduleFlush(entry);
-      return true;
+  async saveWindowState(window) {
+    this.windowState = { ...window };
+    await this.saveDesktopState();
+  }
+  async restoreLastWorkspace() {
+    const sessions = this.restoreProjectSessions.filter(
+      (session) => typeof session.root === "string" && session.root.trim()
+    );
+    if (sessions.length === 0 || this.restoring || this.runtimes.size > 0) {
+      this.workspaceRestoreCompleted = true;
+      return;
+    }
+    this.restoring = true;
+    this.emitChanged();
+    try {
+      const seen = /* @__PURE__ */ new Map();
+      for (const session of sessions) {
+        const key = pathKey(session.root);
+        const seenCount = seen.get(key) ?? 0;
+        seen.set(key, seenCount + 1);
+        await this.openProject(session.root, {
+          forceNew: seenCount > 0,
+          name: session.name,
+          runtimeId: session.runtimeId
+        }).catch((err) => {
+          process.stderr.write(
+            `[desktop:restore] Failed to restore ${session.root}: ${toErrorMessage(err)}
+`
+          );
+        });
+      }
+      let restoredActive = false;
+      if (this.restoreActiveRuntimeId) {
+        const active = this.runtimes.get(this.restoreActiveRuntimeId);
+        if (active) {
+          await this.activateRuntime(active.id);
+          restoredActive = true;
+        }
+      }
+      if (!restoredActive && this.restoreActiveProjectRoot) {
+        const active = Array.from(this.runtimes.values()).find(
+          (runtime) => samePath(runtime.root, this.restoreActiveProjectRoot ?? "")
+        );
+        if (active) await this.activateRuntime(active.id);
+      }
+    } finally {
+      this.restoring = false;
+      this.workspaceRestoreCompleted = true;
+      this.emitChanged();
+      await this.saveDesktopState();
     }
-    return this.dispatchNow(entry, command);
   }
-  async reload() {
-    const entry = this.activeEntry();
-    if (!entry?.url) return false;
-    entry.bridgeReady = false;
-    this.setEntryStatus(entry, { runtimeId: entry.runtimeId, status: "loading" });
-    return entry.view.webContents.loadURL(entry.url).then(() => true).catch((error) => {
-      this.setEntryStatus(entry, {
-        runtimeId: entry.runtimeId,
-        status: "error",
-        error: error instanceof Error ? error.message : String(error)
-      });
-      return false;
-    });
+  getRuntime(id) {
+    const runtime = this.runtimes.get(id);
+    return runtime ? publicRuntime(runtime, true) : void 0;
   }
-  queue(entry, command) {
-    entry.pendingCommands.push(command);
-    if (entry.pendingCommands.length > MAX_PENDING_WEBUI_COMMANDS)
-      entry.pendingCommands.splice(0, entry.pendingCommands.length - MAX_PENDING_WEBUI_COMMANDS);
-    entry.pendingFlushAttempts = 0;
-    this.setEntryStatus(entry, entry.status);
+  getRuntimeUrlWithToken(id) {
+    const runtime = this.runtimes.get(id);
+    if (!runtime) return void 0;
+    const url = new URL(runtime.url);
+    url.searchParams.set("token", runtime.token);
+    url.searchParams.set("shell", "desktop");
+    return url.toString();
   }
-  dispatchNow(entry, command) {
-    if (this.views.get(entry.runtimeId) !== entry || !entry.url) return Promise.resolve(false);
-    const requestId = `${entry.runtimeId}:${Date.now()}:${++this.commandSequence}`;
-    const outbound = { ...command, requestId };
-    return new Promise((resolve4) => {
-      const fallbackTimer = setTimeout(() => {
-        if (!this.pendingAcks.has(requestId)) return;
-        if (this.views.get(entry.runtimeId) !== entry || entry.view.webContents.isDestroyed())
-          return;
-        void entry.view.webContents.executeJavaScript(buildWebuiCommandFallbackScript(outbound), true).catch(() => void 0);
-      }, WEBUI_COMMAND_FALLBACK_MS);
-      const timer = setTimeout(
-        () => this.settleAck(requestId, false),
-        WEBUI_COMMAND_ACK_TIMEOUT_MS
+  getRuntimeWsUrlWithToken(id) {
+    const runtime = this.runtimes.get(id);
+    if (!runtime) return void 0;
+    const url = new URL(`ws://127.0.0.1:${runtime.wsPort}`);
+    url.searchParams.set("token", runtime.token);
+    return url.toString();
+  }
+  async openProject(projectRoot, options = {}) {
+    const resolved = path5.resolve(projectRoot);
+    const stat3 = await fs3.stat(resolved).catch(() => null);
+    if (!stat3?.isDirectory()) throw new Error(`Not a directory: ${resolved}`);
+    const kind = options.kind ?? "project";
+    const touchRecent = options.touchRecent ?? kind === "project";
+    const forceNew = options.forceNew === true;
+    const authorization = await authorizeDesktopRuntimeStart(this.trustBoundary, resolved, kind);
+    if (!authorization.allowed) {
+      throw new Error(`Desktop runtime start denied: ${authorization.reason}`);
+    }
+    if (!forceNew) {
+      const existing = Array.from(this.runtimes.values()).find(
+        (runtime2) => samePath(runtime2.root, resolved) && runtime2.kind === kind && (runtime2.status === "starting" || runtime2.status === "running")
       );
-      this.pendingAcks.set(requestId, {
-        runtimeId: entry.runtimeId,
-        timer,
-        fallbackTimer,
-        resolve: resolve4
+      if (existing) {
+        this.activeRuntimeId = existing.id;
+        if (existing.kind === "project") this.lastActiveProjectRoot = existing.root;
+        if (touchRecent) {
+          await this.touchProject(existing.root);
+        } else {
+          await this.persistWorkspaceState();
+        }
+        this.emitChanged();
+        return publicRuntime(existing, true);
+      }
+      const staleSameRoot = Array.from(this.runtimes.values()).filter(
+        (runtime2) => samePath(runtime2.root, resolved) && runtime2.kind === kind
+      );
+      for (const stale of staleSameRoot) {
+        await this.closeRuntimeInternal(stale.id, { persistWorkspace: false });
+      }
+    }
+    const slug = projectSlug(resolved);
+    const requestedRuntimeId = normalizeRuntimeId(options.runtimeId);
+    const runtimeId = requestedRuntimeId && !this.runtimes.has(requestedRuntimeId) ? requestedRuntimeId : `${slug}-${randomBytes(3).toString("hex")}`;
+    const name = options.name ?? nextRuntimeName(this.runtimes, resolved, kind);
+    const httpPort = await findFreePort(HTTP_PORT_START, usedPorts(this.runtimes));
+    const wsPort = await findFreePort(
+      WS_PORT_START,
+      /* @__PURE__ */ new Set([...usedPorts(this.runtimes), httpPort])
+    );
+    const token = randomBytes(24).toString("hex");
+    const runtime = {
+      id: runtimeId,
+      name,
+      root: resolved,
+      slug,
+      kind,
+      status: "starting",
+      httpPort,
+      wsPort,
+      url: `http://127.0.0.1:${httpPort}`,
+      startedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      token,
+      child: null,
+      logs: [],
+      logNotifyTimer: null,
+      lastActivityAt: Date.now()
+    };
+    this.runtimes.set(runtimeId, runtime);
+    this.activeRuntimeId = runtimeId;
+    if (kind === "project") this.lastActiveProjectRoot = resolved;
+    if (touchRecent) {
+      await this.touchProject(resolved);
+    } else {
+      await this.persistWorkspaceState();
+    }
+    this.emitChanged();
+    try {
+      const entry = resolveWebUiEntry();
+      const distDir = resolveWebUiDistDir();
+      const child = spawn(
+        process.execPath,
+        [
+          entry,
+          "--host",
+          "127.0.0.1",
+          "--port",
+          String(httpPort),
+          "--ws-port",
+          String(wsPort),
+          "--dist-dir",
+          distDir,
+          "--require-token"
+        ],
+        {
+          cwd: resolved,
+          env: {
+            ...buildChildEnv(),
+            ELECTRON_RUN_AS_NODE: "1",
+            WEBUI_STRICT_PORT: "1",
+            WRONGSTACK_DESKTOP: "1",
+            // Passed by environment, not argv. A process command line is
+            // world-readable on every platform this ships to — `ps -ef` on
+            // POSIX, Task Manager's command-line column or a plain WMI query on
+            // Windows — so `--token <secret>` handed the WebUI access token to
+            // any local process that cared to look. The token grants full agent
+            // control, so that is a credential disclosure, not a nuisance.
+            // entry.ts already reads WEBUI_TOKEN; argv only took precedence
+            // over it (WS-087).
+            WEBUI_TOKEN: token
+          },
+          stdio: ["ignore", "pipe", "pipe"],
+          windowsHide: true
+        }
+      );
+      runtime.child = child;
+      runtime.pid = child.pid;
+      child.stdout?.on("data", (chunk) => {
+        const text = chunk.toString();
+        appendRuntimeLog(runtime, "stdout", text);
+        runtime.lastActivityAt = Date.now();
+        this.scheduleLogChanged(runtime);
+        process.stdout.write(`[desktop:${runtime.id}] ${text}`);
+      });
+      child.stderr?.on("data", (chunk) => {
+        const text = chunk.toString();
+        appendRuntimeLog(runtime, "stderr", text);
+        runtime.lastActivityAt = Date.now();
+        this.scheduleLogChanged(runtime);
+        process.stderr.write(`[desktop:${runtime.id}] ${text}`);
+      });
+      child.once("error", (err) => {
+        runtime.status = "error";
+        runtime.error = toErrorMessage(err);
+        runtime.child = null;
+        if (this.activeRuntimeId === runtime.id) {
+          this.activeRuntimeId = firstRunningRuntimeId(this.runtimes);
+        }
+        this.emitChanged();
       });
-      try {
-        entry.view.webContents.send(IPC.webuiCommand, outbound);
-        if (this.activeRuntimeId === entry.runtimeId) entry.view.webContents.focus();
-      } catch {
-        this.settleAck(requestId, false);
+      child.once("exit", (code, signal) => {
+        if (runtime.status === "error") return;
+        runtime.status = "stopped";
+        runtime.error = code === 0 ? void 0 : `Exited with ${signal ?? `code ${code ?? "unknown"}`}`;
+        runtime.child = null;
+        if (this.activeRuntimeId === runtime.id) {
+          this.activeRuntimeId = firstRunningRuntimeId(this.runtimes);
+        }
+        this.emitChanged();
+      });
+      await waitForHttpReady(runtime.url, token, START_TIMEOUT_MS);
+      if (runtime.status !== "starting") {
+        throw new Error(runtime.error ?? "WebUI process exited during startup");
       }
-    });
-  }
-  settleAck(requestId, handled) {
-    const pending = this.pendingAcks.get(requestId);
-    if (!pending) return;
-    this.pendingAcks.delete(requestId);
-    clearTimeout(pending.timer);
-    if (pending.fallbackTimer) clearTimeout(pending.fallbackTimer);
-    if (handled) {
-      const entry = this.views.get(pending.runtimeId);
-      if (entry) {
-        entry.bridgeReady = true;
-        this.setEntryStatus(entry, { ...entry.status, status: "ready" });
+      runtime.status = "running";
+      await this.persistWorkspaceState();
+      this.emitChanged();
+      return publicRuntime(runtime, true);
+    } catch (err) {
+      if (runtime.status !== "stopped" && runtime.status !== "error") {
+        runtime.status = "error";
+      }
+      if (runtime.error === void 0) {
+        runtime.error = toErrorMessage(err);
+      }
+      await terminateProcessTree(runtime.child);
+      runtime.child = null;
+      if (this.activeRuntimeId === runtime.id) {
+        this.activeRuntimeId = firstRunningRuntimeId(this.runtimes);
       }
+      this.emitChanged();
+      throw err;
     }
-    pending.resolve(handled);
-  }
-  settleRuntimeAcks(runtimeId, handled) {
-    for (const [id, pending] of [...this.pendingAcks])
-      if (pending.runtimeId === runtimeId) this.settleAck(id, handled);
   }
-  scheduleFlush(entry) {
-    if (entry.pendingFlushTimer) return;
-    entry.pendingFlushTimer = setTimeout(() => {
-      entry.pendingFlushTimer = null;
-      void this.flush(entry);
-    }, 250);
+  async activateRuntime(id) {
+    const runtime = this.runtimes.get(id);
+    if (!runtime) throw new Error(`Runtime not found: ${id}`);
+    this.activeRuntimeId = id;
+    runtime.lastActivityAt = Date.now();
+    if (runtime.kind === "project") this.lastActiveProjectRoot = runtime.root;
+    if (runtime.kind === "project") {
+      await this.touchProject(runtime.root);
+    } else {
+      await this.persistWorkspaceState();
+    }
+    this.emitChanged();
   }
-  async flush(entry) {
-    if (this.views.get(entry.runtimeId) !== entry || entry.pendingCommands.length === 0) return;
-    if (!entry.bridgeReady) {
-      entry.pendingFlushAttempts += 1;
-      const shouldExecuteFallback = !entry.view.webContents.isLoading() && entry.pendingFlushAttempts >= 4;
-      if (!shouldExecuteFallback && entry.pendingFlushAttempts <= MAX_PENDING_FLUSH_ATTEMPTS) {
-        this.scheduleFlush(entry);
-        this.setEntryStatus(entry, entry.status);
-        return;
-      }
-      if (!shouldExecuteFallback) {
-        entry.pendingCommands.length = 0;
-        this.setEntryStatus(entry, {
-          runtimeId: entry.runtimeId,
-          status: "error",
-          error: "WebUI command bridge did not become ready."
-        });
-        return;
+  async closeRuntime(id) {
+    const runtime = this.runtimes.get(id);
+    if (runtime) {
+      const authorization = await authorizeDesktopRuntimeStop(this.trustBoundary, runtime);
+      if (!authorization.allowed) {
+        throw new Error(`Desktop runtime stop denied: ${authorization.reason}`);
       }
     }
-    entry.pendingFlushAttempts = 0;
-    const commands = entry.pendingCommands.splice(0);
-    this.setEntryStatus(entry, entry.status);
-    for (const command of commands) await this.dispatchNow(entry, command).catch(() => void 0);
+    await this.closeRuntimeInternal(id, { persistWorkspace: true });
   }
-};
-
-// src/main/app-icon.ts
-import * as fs3 from "node:fs/promises";
-import { fileURLToPath as fileURLToPath2 } from "node:url";
-import { nativeImage } from "electron";
-async function readIcon(relativePath) {
-  try {
-    const iconPath = fileURLToPath2(new URL(relativePath, import.meta.url));
-    await fs3.stat(iconPath);
-    const icon = nativeImage.createFromPath(iconPath);
-    return icon.isEmpty() ? void 0 : icon;
-  } catch {
-    return void 0;
+  async closeAll(options = {}) {
+    const persistWorkspace = options.persistWorkspace ?? true;
+    await Promise.all(
+      Array.from(this.runtimes.keys()).map(
+        (id) => this.closeRuntimeInternal(id, { persistWorkspace })
+      )
+    );
   }
-}
-async function loadDesktopAppIcon() {
-  if (process.platform !== "darwin") return readIcon("../../assets/icon.svg");
-  return await readIcon("../../assets/icon.png") ?? readIcon("../../assets/icon.icns");
-}
-
-// src/main/window-state-controller.ts
-var DesktopWindowStateController = class {
-  constructor(ctx) {
-    this.ctx = ctx;
+  async registerProject(projectRoot) {
+    const resolved = path5.resolve(projectRoot);
+    const stat3 = await fs3.stat(resolved).catch(() => null);
+    if (!stat3?.isDirectory()) throw new Error(`Not a directory: ${resolved}`);
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const entry = {
+      name: path5.basename(resolved) || resolved,
+      root: resolved,
+      slug: projectSlug(resolved),
+      lastSeen: now,
+      lastWorkingDir: resolved
+    };
+    this.registeredProjects = await touchGlobalProjectManifest(entry);
+    this.emitChanged();
   }
-  ctx;
-  saveTimer = null;
-  scheduleSave() {
-    if (this.saveTimer) clearTimeout(this.saveTimer);
-    this.saveTimer = setTimeout(() => {
-      this.saveTimer = null;
-      void this.save();
-    }, 350);
+  async unregisterProject(projectRoot) {
+    const resolved = path5.resolve(projectRoot);
+    this.registeredProjects = await removeGlobalProjectManifest(resolved);
+    await this.saveDesktopState();
+    this.emitChanged();
   }
-  async save() {
-    const window = this.ctx.getWindow();
-    if (!window || window.isDestroyed?.()) return;
-    const bounds = window.getNormalBounds();
-    await this.ctx.save({ ...bounds, maximized: window.isMaximized() });
+  async closeRuntimeInternal(id, options) {
+    const runtime = this.runtimes.get(id);
+    if (!runtime) return;
+    runtime.status = "stopped";
+    const child = runtime.child;
+    runtime.child = null;
+    await terminateProcessTree(child);
+    if (runtime.logNotifyTimer) {
+      clearTimeout(runtime.logNotifyTimer);
+      runtime.logNotifyTimer = null;
+    }
+    this.runtimes.delete(id);
+    if (this.activeRuntimeId === id) this.activeRuntimeId = firstRunningRuntimeId(this.runtimes);
+    if (this.lastActiveProjectRoot && samePath(this.lastActiveProjectRoot, runtime.root)) {
+      this.lastActiveProjectRoot = firstProjectRuntimeRoot(this.runtimes);
+    }
+    if (options.persistWorkspace) {
+      await this.persistWorkspaceState();
+    }
+    this.emitChanged();
   }
-  validated(state) {
-    if (!state || !Number.isFinite(state.width) || !Number.isFinite(state.height) || state.width < MIN_WINDOW_WIDTH2 || state.height < MIN_WINDOW_HEIGHT2)
-      return null;
-    if (state.x === void 0 || state.y === void 0) {
-      return { width: state.width, height: state.height, maximized: state.maximized };
+  async touchProject(projectRoot) {
+    const resolved = path5.resolve(projectRoot);
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const entry = {
+      name: path5.basename(resolved) || resolved,
+      root: resolved,
+      slug: projectSlug(resolved),
+      lastSeen: now,
+      lastWorkingDir: resolved
+    };
+    this.recentProjects = [
+      entry,
+      ...this.recentProjects.filter((p) => !samePath(p.root, resolved))
+    ].slice(0, 24);
+    const [, registeredProjects] = await Promise.all([
+      this.saveDesktopState(),
+      touchGlobalProjectManifest(entry)
+    ]);
+    this.registeredProjects = registeredProjects;
+  }
+  async persistWorkspaceState() {
+    await this.saveDesktopState();
+  }
+  async loadDesktopState() {
+    try {
+      const raw = await fs3.readFile(this.stateFile, "utf8");
+      const parsed = JSON.parse(raw);
+      const openProjects = normalizePathList(parsed.openProjects);
+      const openProjectSessions = normalizeSessionStateList(
+        parsed.openProjectSessions,
+        openProjects
+      );
+      return {
+        recentProjects: normalizeProjectEntries(parsed.recentProjects),
+        openProjects,
+        openProjectSessions,
+        activeRuntimeId: normalizeRuntimeId(parsed.activeRuntimeId) ?? null,
+        activeProjectRoot: typeof parsed.activeProjectRoot === "string" && parsed.activeProjectRoot.trim() ? path5.resolve(parsed.activeProjectRoot) : null,
+        window: normalizeWindowState(parsed.window)
+      };
+    } catch {
+      return {
+        recentProjects: [],
+        openProjects: [],
+        openProjectSessions: [],
+        activeRuntimeId: null,
+        activeProjectRoot: null,
+        window: null
+      };
     }
-    const candidate = { x: state.x, y: state.y, width: state.width, height: state.height };
-    return this.ctx.getDisplays().some(({ workArea }) => intersects(candidate, workArea)) ? {
-      x: state.x,
-      y: state.y,
-      width: state.width,
-      height: state.height,
-      maximized: state.maximized
-    } : null;
   }
-};
-function intersects(left, right) {
-  return left.x < right.x + right.width && left.x + left.width > right.x && left.y < right.y + right.height && left.y + left.height > right.y;
-}
-
-// src/main/runtime/operations.ts
-import * as fs4 from "node:fs/promises";
-async function openProject(ctx, requestedRoot) {
-  let projectRoot = requestedRoot;
-  if (!projectRoot) {
-    projectRoot = await ctx.chooseProjectRoot("open");
+  async saveDesktopState() {
+    await fs3.mkdir(path5.dirname(this.stateFile), { recursive: true });
+    const liveProjectSessions = Array.from(this.runtimes.values()).filter((runtime) => runtime.status !== "stopped" && runtime.kind === "project").map((runtime) => runtimeToSessionState(runtime));
+    const openProjectSessions = liveProjectSessions.length === 0 && !this.workspaceRestoreCompleted ? [...this.restoreProjectSessions] : liveProjectSessions;
+    const openProjects = openProjectSessions.map((session) => session.root);
+    const activeRuntime = this.activeRuntimeId ? this.runtimes.get(this.activeRuntimeId) : null;
+    const lastActiveProjectRoot = this.lastActiveProjectRoot;
+    const fallbackSession = lastActiveProjectRoot ? openProjectSessions.find((session) => samePath(session.root, lastActiveProjectRoot)) : void 0;
+    const activeSession = activeRuntime?.kind === "project" ? runtimeToSessionState(activeRuntime) : fallbackSession ?? openProjectSessions[0];
+    const activeRoot = activeSession?.root;
+    const activeRuntimeId = activeSession?.runtimeId ?? null;
+    await atomicWrite2(
+      this.stateFile,
+      `${JSON.stringify(
+        {
+          recentProjects: this.recentProjects,
+          openProjects,
+          openProjectSessions,
+          activeRuntimeId,
+          activeProjectRoot: activeRoot ?? null,
+          window: this.windowState
+        },
+        null,
+        2
+      )}
+`,
+      { mode: 384 }
+    );
+  }
+  emitChanged() {
+    this.emit("changed");
   }
-  if (!projectRoot) return ctx.getRuntimeManager().snapshot();
-  await ctx.getRuntimeManager().openProject(projectRoot);
-  ctx.syncActiveWebuiView();
-  ctx.broadcastState();
-  return ctx.getRuntimeManager().snapshot();
-}
-async function registerProject(ctx, requestedRoot) {
-  let projectRoot = requestedRoot;
-  if (!projectRoot) {
-    projectRoot = await ctx.chooseProjectRoot("register");
+  /**
+   * Notify the shell that a runtime produced output.
+   *
+   * Only the ACTIVE runtime's logs reach the renderer (see `publicRuntime`), so
+   * output from a background project has nothing to show and must not cost a
+   * broadcast. Before this guard, every project writing to stdout scheduled its
+   * own 250 ms timer, and each one fired a FULL snapshot: N chatty projects
+   * produced 4N broadcasts per second carrying N x 40 log lines each, for a
+   * panel that displays one runtime's output.
+   *
+   * The 250 ms debounce is per-runtime by construction (the timer lives on the
+   * runtime record) but only one runtime can be active, so at most one such
+   * timer is ever armed now.
+   */
+  /**
+   * Begin reclaiming idle project servers.
+   *
+   * Idempotent, and a no-op when the timeout is disabled. The interval is
+   * unref'd so a pending sweep never holds the process open during quit.
+   */
+  startIdleSweep(options = {}) {
+    if (this.idleSweepTimer) return;
+    this.idleTimeoutMs = options.idleTimeoutMs ?? resolveIdleTimeoutMs();
+    if (this.idleTimeoutMs <= 0) return;
+    this.idleSweepTimer = setInterval(() => {
+      void this.sweepIdleRuntimes();
+    }, IDLE_SWEEP_INTERVAL_MS);
+    this.idleSweepTimer.unref?.();
+  }
+  stopIdleSweep() {
+    if (!this.idleSweepTimer) return;
+    clearInterval(this.idleSweepTimer);
+    this.idleSweepTimer = null;
+  }
+  /** One pass. Exposed so a test can drive it without waiting on the interval. */
+  async sweepIdleRuntimes(now = Date.now()) {
+    const ids = reclaimableRuntimeIds(this.runtimes, {
+      activeRuntimeId: this.activeRuntimeId,
+      idleTimeoutMs: this.idleTimeoutMs,
+      now
+    });
+    for (const id of ids) {
+      await this.closeRuntimeInternal(id, { persistWorkspace: false });
+    }
+    return ids;
   }
-  if (!projectRoot) return ctx.getRuntimeManager().snapshot();
-  await ctx.getRuntimeManager().registerProject(projectRoot);
-  ctx.broadcastState();
-  return ctx.getRuntimeManager().snapshot();
+  scheduleLogChanged(runtime) {
+    if (runtime.id !== this.activeRuntimeId) return;
+    if (runtime.logNotifyTimer) return;
+    runtime.logNotifyTimer = setTimeout(() => {
+      runtime.logNotifyTimer = null;
+      if (this.runtimes.get(runtime.id) === runtime && runtime.id === this.activeRuntimeId) {
+        this.emitChanged();
+      }
+    }, 250);
+  }
+};
+function hasChildExited(child) {
+  return child.exitCode !== null || child.signalCode !== null;
 }
-async function unregisterProject(ctx, root) {
-  if (!root || typeof root !== "string") return ctx.getRuntimeManager().snapshot();
-  await ctx.getRuntimeManager().unregisterProject(root);
-  ctx.broadcastState();
-  return ctx.getRuntimeManager().snapshot();
+function waitForChildExit(child, timeoutMs) {
+  if (hasChildExited(child)) return Promise.resolve(true);
+  return new Promise((resolve4) => {
+    let settled = false;
+    const finish = (exited) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      child.off("exit", onExit);
+      resolve4(exited);
+    };
+    const onExit = () => finish(true);
+    const timer = setTimeout(() => finish(hasChildExited(child)), timeoutMs);
+    timer.unref?.();
+    child.once("exit", onExit);
+    if (hasChildExited(child)) finish(true);
+  });
 }
-async function openProjectSession(ctx, runtimeId) {
-  const snapshot = ctx.getRuntimeManager().snapshot();
-  const runtime = (runtimeId ? snapshot.runtimes.find((candidate) => candidate.id === runtimeId) : void 0) ?? snapshot.runtimes.find((candidate) => candidate.id === snapshot.activeRuntimeId);
-  if (runtime?.kind !== "project") {
-    return openProject(ctx);
+async function terminateProcessTree(child) {
+  if (!child?.pid || hasChildExited(child)) return;
+  if (process.platform !== "win32") {
+    const pid = child.pid;
+    const exited = waitForChildExit(child, 5e3);
+    child.kill("SIGTERM");
+    if (await exited) return;
+    if (!hasChildExited(child)) {
+      try {
+        process.kill(-pid, "SIGKILL");
+      } catch {
+        child.kill("SIGKILL");
+      }
+      await waitForChildExit(child, 1e3);
+    }
+    return;
   }
-  await ctx.getRuntimeManager().openProject(runtime.root, { forceNew: true });
-  ctx.syncActiveWebuiView();
-  ctx.broadcastState();
-  return ctx.getRuntimeManager().snapshot();
-}
-async function openSettings(ctx) {
-  const snapshot = ctx.getRuntimeManager().snapshot();
-  const active = snapshot.runtimes.find((runtime) => runtime.id === snapshot.activeRuntimeId);
-  if (!active || active.kind === "global-settings" || active.status !== "running") {
-    const root = desktopSettingsWorkspaceRoot();
-    await fs4.mkdir(root, { recursive: true });
-    await ctx.getRuntimeManager().openProject(root, {
-      name: "Global Settings",
-      kind: "global-settings",
-      touchRecent: false
+  await new Promise((resolve4) => {
+    let settled = false;
+    const finish = () => {
+      if (settled) return;
+      settled = true;
+      resolve4();
+    };
+    const timer = setTimeout(finish, 3e3);
+    timer.unref?.();
+    const killer = spawn("taskkill", ["/PID", String(child.pid), "/T", "/F"], {
+      stdio: "ignore",
+      windowsHide: true
     });
-    ctx.syncActiveWebuiView();
-    ctx.broadcastState();
-  }
-  await ctx.dispatchWebuiCommand({ view: "settings" });
-  return ctx.getRuntimeManager().snapshot();
+    killer.once("exit", () => {
+      clearTimeout(timer);
+      finish();
+    });
+    killer.once("error", () => {
+      clearTimeout(timer);
+      child.kill();
+      finish();
+    });
+  });
 }
-async function activateRuntime(ctx, id) {
-  await ctx.getRuntimeManager().activateRuntime(id);
-  ctx.syncActiveWebuiView();
-  ctx.broadcastState();
-  return ctx.getRuntimeManager().snapshot();
+var SNAPSHOT_LOG_LINES = 40;
+function publicRuntime(runtime, includeLogs) {
+  const {
+    child: _child,
+    token: _token,
+    logs,
+    logNotifyTimer: _logNotifyTimer,
+    ...record
+  } = runtime;
+  void _child;
+  void _token;
+  void _logNotifyTimer;
+  if (!includeLogs) return record;
+  return {
+    ...record,
+    recentLogs: logs.slice(-SNAPSHOT_LOG_LINES)
+  };
 }
-async function closeRuntime(ctx, id) {
-  ctx.getAgentBridge().close(id);
-  await ctx.getRuntimeManager().closeRuntime(id);
-  ctx.syncActiveWebuiView();
-  ctx.broadcastState();
-  return ctx.getRuntimeManager().snapshot();
+function runtimeToSessionState(runtime) {
+  return {
+    runtimeId: runtime.id,
+    name: runtime.name,
+    root: runtime.root,
+    startedAt: runtime.startedAt
+  };
 }
-async function restoreLastWorkspace(ctx) {
-  await ctx.getRuntimeManager().restoreLastWorkspace();
-  ctx.syncActiveWebuiView();
-  ctx.broadcastState();
+function appendRuntimeLog(runtime, stream, text) {
+  for (const rawLine of text.split(/\r?\n/)) {
+    const line = rawLine.trimEnd();
+    if (!line) continue;
+    runtime.logs.push(`[${stream}] ${line}`);
+  }
+  if (runtime.logs.length > 120) {
+    runtime.logs.splice(0, runtime.logs.length - 120);
+  }
 }
-
-// src/main/layout/sidebar.ts
-function getSidebarWidth(windowWidth, collapsed) {
-  if (collapsed) return SIDEBAR_WIDTH_COLLAPSED;
-  if (windowWidth < 900) return SIDEBAR_WIDTH_NARROW;
-  if (windowWidth < 1180) return SIDEBAR_WIDTH_MEDIUM;
-  return SIDEBAR_WIDTH_WIDE;
+function normalizePathList(value) {
+  if (!Array.isArray(value)) return [];
+  const roots = [];
+  for (const item of value) {
+    if (typeof item !== "string" || !item.trim()) continue;
+    const resolved = path5.resolve(item);
+    roots.push(resolved);
+  }
+  return roots.slice(0, 12);
 }
-
-// src/main/menu/index.ts
-import { Menu as Menu2 } from "electron";
-
-// src/main/menu/projects-menu.ts
-import path4 from "node:path";
-function buildProjectsMenu(runtimes, actions, t) {
-  const projectGroups = groupProjectRuntimesForMenu(runtimes);
-  const menu = [
-    {
-      label: t("openProjectEllipsis"),
-      accelerator: "CmdOrCtrl+O",
-      click: () => actions.newSession("")
-    },
-    {
-      label: t("registerProjectEllipsis"),
-      click: () => actions.registerProject?.()
-    },
-    { type: "separator" }
-  ];
-  if (projectGroups.length === 0) {
-    menu.push({ label: t("noOpenProjectSessions"), enabled: false });
-    return menu;
+function normalizeSessionStateList(value, fallbackRoots) {
+  if (!Array.isArray(value)) {
+    return fallbackRoots.map((root) => ({ root })).slice(0, 12);
   }
-  for (const group of projectGroups) {
-    menu.push({
-      label: group.name,
-      submenu: [
-        {
-          label: t("newSession"),
-          click: () => actions.newSession(group.sessions[0]?.id ?? ""),
-          enabled: Boolean(group.sessions[0])
-        },
-        {
-          label: t("revealProjectFolder"),
-          click: () => actions.reveal(group.sessions[0]?.id ?? ""),
-          enabled: Boolean(group.sessions[0])
-        },
-        { type: "separator" },
-        ...group.sessions.map((runtime, index) => buildSessionMenu(runtime, index + 1, actions, t))
-      ]
-    });
+  const sessions = [];
+  for (const item of value) {
+    if (!item || typeof item !== "object") continue;
+    const candidate = item;
+    if (typeof candidate.root !== "string" || !candidate.root.trim()) continue;
+    const session = {
+      root: path5.resolve(candidate.root)
+    };
+    const runtimeId = normalizeRuntimeId(candidate.runtimeId);
+    if (runtimeId) session.runtimeId = runtimeId;
+    if (typeof candidate.name === "string" && candidate.name.trim()) {
+      session.name = candidate.name.trim().slice(0, 120);
+    }
+    if (typeof candidate.startedAt === "string" && candidate.startedAt.trim()) {
+      session.startedAt = candidate.startedAt.trim();
+    }
+    sessions.push(session);
   }
-  return menu;
+  return sessions.slice(0, 12);
 }
-function buildSessionMenu(runtime, index, actions, t) {
-  const running = runtime.status === "running";
-  const label = `${t("session")} ${index} \xB7 ${runtime.status}`;
-  return {
-    label,
-    submenu: [
-      {
-        label: t("quickView"),
-        click: () => actions.activate(runtime.id)
-      },
-      {
-        label: "WebUI",
-        enabled: running,
-        submenu: [
-          {
-            label: t("chat"),
-            click: () => actions.activateAndNavigate(runtime.id, { activity: "chat", view: "chat" })
-          },
-          {
-            label: t("focusPrompt"),
-            click: () => actions.activateAndNavigate(runtime.id, { action: "focus-chat" })
-          },
-          {
-            label: t("terminal"),
-            click: () => actions.activateAndNavigate(runtime.id, { terminal: "toggle" })
-          },
-          {
-            label: t("newTerminal"),
-            click: () => actions.activateAndNavigate(runtime.id, { terminal: "new" })
-          },
-          { type: "separator" },
-          {
-            label: t("files"),
-            click: () => actions.activateAndNavigate(runtime.id, { activity: "files", view: "files" })
-          },
-          {
-            label: t("changes"),
-            click: () => actions.activateAndNavigate(runtime.id, { activity: "changes", view: "changes" })
-          },
-          {
-            label: t("sessions"),
-            click: () => actions.activateAndNavigate(runtime.id, { view: "sessions" })
-          },
-          {
-            label: t("fleetHQ"),
-            click: () => actions.activateAndNavigate(runtime.id, { view: "roster" })
-          },
-          {
-            label: t("settings"),
-            click: () => actions.activateAndNavigate(runtime.id, { view: "settings" })
-          },
-          { type: "separator" },
-          {
-            label: t("commandPalette"),
-            click: () => actions.activateAndNavigate(runtime.id, { action: "open-command-palette" })
-          },
-          {
-            label: t("modelSwitcher"),
-            click: () => actions.activateAndNavigate(runtime.id, { action: "open-model-switcher" })
-          }
-        ]
-      },
-      { type: "separator" },
-      {
-        label: t("openInBrowser"),
-        enabled: running,
-        click: () => actions.openBrowser(runtime.id)
-      },
-      {
-        label: t("reloadWebui"),
-        enabled: running,
-        click: () => actions.reload(runtime.id)
-      },
-      {
-        label: t("closeSession"),
-        click: () => actions.close(runtime.id)
-      }
-    ]
+function normalizeRuntimeId(value) {
+  if (typeof value !== "string") return void 0;
+  const trimmed = value.trim();
+  if (!/^[a-zA-Z0-9._:-]{3,120}$/.test(trimmed)) return void 0;
+  return trimmed;
+}
+function normalizeWindowState(value) {
+  if (!value || typeof value !== "object") return null;
+  const candidate = value;
+  const width = Number(candidate.width);
+  const height = Number(candidate.height);
+  if (!Number.isFinite(width) || !Number.isFinite(height)) return null;
+  if (width < MIN_WINDOW_WIDTH2 || height < MIN_WINDOW_HEIGHT2) return null;
+  const state = {
+    width: Math.round(width),
+    height: Math.round(height),
+    maximized: Boolean(candidate.maximized)
   };
+  if (Number.isFinite(Number(candidate.x))) state.x = Math.round(Number(candidate.x));
+  if (Number.isFinite(Number(candidate.y))) state.y = Math.round(Number(candidate.y));
+  return state;
 }
-function groupProjectRuntimesForMenu(runtimes) {
-  const groups = /* @__PURE__ */ new Map();
-  for (const runtime of runtimes) {
-    if (runtime.kind !== "project") continue;
-    const key = normalizeMenuRoot(runtime.root);
-    const existing = groups.get(key);
-    if (existing) {
-      existing.sessions.push(runtime);
-      continue;
-    }
-    groups.set(key, {
-      key,
-      name: path4.basename(runtime.root) || runtime.name,
-      root: runtime.root,
-      sessions: [runtime]
-    });
+function firstRunningRuntimeId(runtimes) {
+  return Array.from(runtimes.values()).find((runtime) => runtime.status === "running")?.id ?? null;
+}
+function firstProjectRuntimeRoot(runtimes) {
+  return Array.from(runtimes.values()).find(
+    (runtime) => runtime.status === "running" && runtime.kind === "project"
+  )?.root ?? null;
+}
+function usedPorts(runtimes) {
+  const ports = /* @__PURE__ */ new Set();
+  for (const runtime of runtimes.values()) {
+    ports.add(runtime.httpPort);
+    ports.add(runtime.wsPort);
   }
-  return [...groups.values()].sort((a, b) => a.name.localeCompare(b.name));
+  return ports;
 }
-function normalizeMenuRoot(root) {
-  return root.replace(/\\/g, "/").replace(/\/+$/g, "").toLowerCase();
+function nextRuntimeName(runtimes, root, kind) {
+  const baseName = path5.basename(root) || root;
+  if (kind !== "project") return baseName;
+  const liveSameRoot = Array.from(runtimes.values()).filter(
+    (runtime) => runtime.kind === "project" && samePath(runtime.root, root) && runtime.status !== "stopped"
+  ).length;
+  return liveSameRoot === 0 ? baseName : `${baseName} #${liveSameRoot + 1}`;
 }
-
-// src/main/menu/sections.ts
-function buildFileMenu(ctx, _actions, hasActiveRuntime, hasActiveProjectWebui, active, navigate, getActiveRuntimeId) {
-  return {
-    label: ctx.t("file"),
-    submenu: [
-      {
-        label: ctx.t("openProjectEllipsis"),
-        accelerator: "CmdOrCtrl+O",
-        click: () => void ctx.openProject()
-      },
-      { label: ctx.t("registerProjectEllipsis"), click: () => void ctx.registerProject() },
-      {
-        label: ctx.t("removeActiveFromRegistry"),
-        enabled: hasActiveProjectWebui,
-        click: () => {
-          if (active?.kind === "project") void ctx.unregisterProject(active.root);
-        }
-      },
-      { type: "separator" },
-      {
-        label: ctx.t("newSessionForActive"),
-        accelerator: "CmdOrCtrl+N",
-        enabled: hasActiveProjectWebui,
-        click: () => void ctx.openProjectSession(active?.id)
-      },
-      {
-        label: ctx.t("settings"),
-        accelerator: "CmdOrCtrl+,",
-        click: () => {
-          if (hasActiveRuntime) navigate({ view: "settings" });
-          else void ctx.openSettings();
+function pathKey(value) {
+  const resolved = path5.resolve(value);
+  return os.platform() === "win32" ? resolved.toLowerCase() : resolved;
+}
+async function findFreePort(startPort, exclude) {
+  for (let port = startPort; port < startPort + 200; port++) {
+    if (exclude.has(port)) continue;
+    if (await isPortFree(port)) return port;
+  }
+  throw new Error(`No free local port found near ${startPort}`);
+}
+function isPortFree(port) {
+  return new Promise((resolve4) => {
+    const server = net.createServer();
+    server.once("error", () => resolve4(false));
+    server.once("listening", () => {
+      server.close(() => resolve4(true));
+    });
+    server.listen(port, "127.0.0.1");
+  });
+}
+function waitForHttpReady(baseUrl, token, timeoutMs) {
+  const deadline = Date.now() + timeoutMs;
+  const url = new URL(baseUrl);
+  url.searchParams.set("token", token);
+  url.searchParams.set("shell", "desktop");
+  return new Promise((resolve4, reject) => {
+    let probeTimer;
+    const cleanup = () => {
+      if (probeTimer) {
+        clearTimeout(probeTimer);
+        probeTimer = void 0;
+      }
+    };
+    const probe = () => {
+      let done = false;
+      const triggerRetry = () => {
+        if (done) return;
+        done = true;
+        if (Date.now() >= deadline) {
+          reject(new Error(`WebUI did not become ready at ${baseUrl}`));
+          return;
         }
-      },
-      { type: "separator" },
-      {
-        label: ctx.t("closeActiveRuntime"),
-        accelerator: "CmdOrCtrl+W",
-        enabled: hasActiveRuntime,
-        click: () => {
-          const id = getActiveRuntimeId();
-          if (id) void ctx.closeRuntime(id);
+        probeTimer = setTimeout(probe, 250);
+      };
+      const req = http.get(url, (res) => {
+        res.resume();
+        if (res.statusCode && res.statusCode >= 200 && res.statusCode < 500) {
+          if (!done) {
+            done = true;
+            cleanup();
+            resolve4();
+          }
+          return;
         }
-      },
-      { type: "separator" },
-      {
-        role: process.platform === "darwin" ? "close" : "quit"
-      }
-    ]
+        triggerRetry();
+      });
+      req.once("error", () => {
+        triggerRetry();
+      });
+      req.setTimeout(1e3, () => {
+        req.destroy();
+        triggerRetry();
+      });
+    };
+    probe();
+  });
+}
+async function readGlobalProjectManifest() {
+  const manifestFile = path5.join(wstackGlobalRoot2(), "projects.json");
+  try {
+    const raw = await fs3.readFile(manifestFile, "utf8");
+    return normalizeProjectManifest(JSON.parse(raw));
+  } catch {
+    return [];
+  }
+}
+function normalizeProjectManifest(value) {
+  if (Array.isArray(value)) return normalizeProjectEntries(value).slice(0, 80);
+  if (!value || typeof value !== "object") return [];
+  const manifest = value;
+  const source = Array.isArray(manifest.projects) ? manifest.projects : Array.isArray(manifest.recentProjects) ? manifest.recentProjects : Array.isArray(manifest.recents) ? manifest.recents : [];
+  return normalizeProjectEntries(source).slice(0, 80);
+}
+function normalizeProjectEntries(value) {
+  if (!Array.isArray(value)) return [];
+  const seen = /* @__PURE__ */ new Set();
+  const projects = [];
+  for (const item of value) {
+    const project = normalizeProjectEntry(item);
+    if (!project) continue;
+    const key = pathKey(project.root);
+    if (seen.has(key)) continue;
+    seen.add(key);
+    projects.push(project);
+  }
+  return projects.sort(
+    (a, b) => (b.lastSeen ?? b.createdAt ?? "").localeCompare(a.lastSeen ?? a.createdAt ?? "")
+  );
+}
+function normalizeProjectEntry(value) {
+  if (!value || typeof value !== "object") return null;
+  const candidate = value;
+  if (typeof candidate.root !== "string" || !candidate.root.trim()) return null;
+  const root = path5.resolve(candidate.root);
+  const name = typeof candidate.name === "string" && candidate.name.trim() ? candidate.name.trim() : path5.basename(root) || root;
+  const entry = {
+    name,
+    root,
+    slug: typeof candidate.slug === "string" && candidate.slug.trim() ? candidate.slug.trim() : projectSlug(root)
   };
+  if (typeof candidate.lastSeen === "string" && candidate.lastSeen.trim()) {
+    entry.lastSeen = candidate.lastSeen.trim();
+  }
+  if (typeof candidate.createdAt === "string" && candidate.createdAt.trim()) {
+    entry.createdAt = candidate.createdAt.trim();
+  }
+  if (typeof candidate.lastWorkingDir === "string" && candidate.lastWorkingDir.trim()) {
+    entry.lastWorkingDir = path5.resolve(candidate.lastWorkingDir);
+  }
+  return entry;
 }
-function buildWorkspaceMenu(ctx, _actions, hasActiveWebui, prefs, navigate) {
-  const yoloChecked = prefs?.yolo === true;
-  const nextPredictionChecked = prefs?.nextPrediction === true;
-  const contextAutoCompactChecked = prefs?.contextAutoCompact === true;
-  const webuiItem = (item) => ({
-    ...item,
-    enabled: item.enabled ?? hasActiveWebui
+async function touchGlobalProjectManifest(entry) {
+  const manifestFile = path5.join(wstackGlobalRoot2(), "projects.json");
+  const projects = await readGlobalProjectManifest();
+  const existing = projects.find((p) => samePath(p.root, entry.root));
+  if (existing) {
+    existing.name = entry.name;
+    existing.slug = entry.slug;
+    existing.lastSeen = entry.lastSeen;
+    existing.lastWorkingDir = entry.lastWorkingDir;
+  } else {
+    projects.push({ ...entry, createdAt: entry.lastSeen });
+  }
+  const sorted = projects.sort(
+    (a, b) => (b.lastSeen ?? b.createdAt ?? "").localeCompare(a.lastSeen ?? a.createdAt ?? "")
+  ).slice(0, 80);
+  await fs3.mkdir(path5.dirname(manifestFile), { recursive: true });
+  await atomicWrite2(manifestFile, `${JSON.stringify({ projects: sorted }, null, 2)}
+`, {
+    mode: 384
   });
-  return {
-    label: ctx.t("workspace"),
-    submenu: [
-      webuiItem({
-        label: ctx.t("openChat"),
-        accelerator: "CmdOrCtrl+1",
-        click: () => navigate({ activity: "chat", view: "chat" })
-      }),
-      webuiItem({
-        label: ctx.t("focusPrompt"),
-        accelerator: "CmdOrCtrl+/",
-        click: () => navigate({ action: "focus-chat" })
-      }),
-      webuiItem({
-        label: ctx.t("toggleTerminal"),
-        accelerator: "CmdOrCtrl+`",
-        click: () => navigate({ terminal: "toggle" })
-      }),
-      webuiItem({ label: ctx.t("newTerminal"), click: () => navigate({ terminal: "new" }) }),
-      { type: "separator" },
-      webuiItem({
-        label: ctx.t("commandPalette"),
-        accelerator: "CmdOrCtrl+K",
-        click: () => navigate({ action: "open-command-palette" })
-      }),
-      webuiItem({
-        label: ctx.t("quickModelSwitcher"),
-        accelerator: "CmdOrCtrl+M",
-        click: () => navigate({ action: "open-model-switcher" })
-      }),
-      webuiItem({
-        type: "checkbox",
-        label: ctx.t("yoloMode"),
-        checked: yoloChecked,
-        accelerator: "CmdOrCtrl+Shift+Y",
-        click: () => navigate({ pref: { key: "yolo", toggle: true } })
-      }),
-      webuiItem({
-        type: "checkbox",
-        label: ctx.t("nextPrediction"),
-        checked: nextPredictionChecked,
-        click: () => navigate({ pref: { key: "nextPrediction", toggle: true } })
-      }),
-      webuiItem({
-        type: "checkbox",
-        label: ctx.t("contextAutoCompact"),
-        checked: contextAutoCompactChecked,
-        click: () => navigate({ pref: { key: "contextAutoCompact", toggle: true } })
-      }),
-      { type: "separator" },
-      webuiItem({
-        label: ctx.t("reloadActiveWebui"),
-        accelerator: "CmdOrCtrl+Shift+R",
-        click: () => void ctx.reloadActiveWebuiView()
-      })
-    ]
-  };
+  return sorted;
 }
-function buildViewMenu(ctx) {
-  return {
-    label: ctx.t("view"),
-    submenu: [
-      {
-        type: "checkbox",
-        label: ctx.t("compactDesktopSidebar"),
-        accelerator: "CmdOrCtrl+B",
-        checked: ctx.getShellSidebarCollapsed(),
-        click: () => ctx.setShellSidebarCollapsed(!ctx.getShellSidebarCollapsed())
-      },
-      { type: "separator" },
-      { role: "reload" },
-      { role: "toggleDevTools" },
-      { type: "separator" },
-      { role: "resetZoom" },
-      { role: "zoomIn" },
-      { role: "zoomOut" },
-      { type: "separator" },
-      { role: "togglefullscreen" }
-    ]
-  };
+async function removeGlobalProjectManifest(projectRoot) {
+  const manifestFile = path5.join(wstackGlobalRoot2(), "projects.json");
+  const resolved = path5.resolve(projectRoot);
+  const projects = (await readGlobalProjectManifest()).filter(
+    (project) => !samePath(project.root, resolved)
+  );
+  await fs3.mkdir(path5.dirname(manifestFile), { recursive: true });
+  await atomicWrite2(manifestFile, `${JSON.stringify({ projects }, null, 2)}
+`, { mode: 384 });
+  return projects;
 }
-
-// src/main/menu/index.ts
-function configureApplicationMenu(ctx) {
-  const snapshot = ctx.getSnapshot();
-  const active = ctx.getActiveRuntime();
-  const hasActiveRuntime = Boolean(active);
-  const hasActiveWebui = active?.status === "running";
-  const hasActiveProjectWebui = hasActiveWebui && active?.kind === "project";
-  const activeWebuiPrefs = ctx.getActiveWebuiPrefs();
-  const navigate = (command) => {
-    void ctx.dispatchWebuiCommand(command);
-  };
-  const activateAndNavigate = (runtimeId, command) => {
-    void ctx.activateRuntime(runtimeId).then(() => ctx.dispatchWebuiCommand(command));
-  };
-  const reloadRuntimeWebui = (runtimeId) => {
-    void ctx.activateRuntime(runtimeId).then(() => ctx.reloadActiveWebuiView());
-  };
-  const actions = {
-    activate: (runtimeId) => void ctx.activateRuntime(runtimeId),
-    activateAndNavigate,
-    registerProject: () => void ctx.registerProject(),
-    newSession: (runtimeId) => {
-      if (runtimeId) void ctx.openProjectSession(runtimeId);
-      else void ctx.openProject();
-    },
-    openBrowser: (runtimeId) => {
-      const url = ctx.getRuntimeManager().getRuntimeUrlWithToken(runtimeId);
-      if (url) ctx.openExternal(url);
-    },
-    reload: reloadRuntimeWebui,
-    close: (runtimeId) => void ctx.closeRuntime(runtimeId),
-    reveal: (runtimeId) => {
-      const runtime = ctx.getRuntimeManager().getRuntime(runtimeId);
-      if (runtime) ctx.revealInExplorer(runtime.root);
-    }
-  };
-  const template = [
-    buildFileMenu(
-      ctx,
-      actions,
-      hasActiveRuntime,
-      hasActiveProjectWebui,
-      active,
-      navigate,
-      ctx.getActiveRuntimeId
-    ),
-    {
-      label: ctx.t("projects"),
-      submenu: buildProjectsMenu(snapshot.runtimes, actions, ctx.t)
-    },
-    buildWorkspaceMenu(ctx, actions, hasActiveWebui, activeWebuiPrefs, navigate),
-    buildViewMenu(ctx)
-  ];
-  Menu2.setApplicationMenu(Menu2.buildFromTemplate(template));
+function samePath(left, right) {
+  const a = path5.resolve(left);
+  const b = path5.resolve(right);
+  return os.platform() === "win32" ? a.toLowerCase() === b.toLowerCase() : a === b;
 }
 
-// src/main/ipc-handlers/index.ts
-import { ipcMain } from "electron";
-
-// src/main/validation/index.ts
-function validate(schema, data) {
-  try {
-    const result = schema.safeParse(data);
-    if (result.success) {
-      return { success: true, data: result.data };
-    }
-    return { success: false, error: formatZodError(result.error) };
-  } catch (err) {
-    return { success: false, error: String(err) };
+// src/main/runtime/operations.ts
+async function openProject(ctx, requestedRoot) {
+  let projectRoot = requestedRoot;
+  if (!projectRoot) {
+    projectRoot = await ctx.chooseProjectRoot("open");
+  }
+  if (!projectRoot) return ctx.getRuntimeManager().snapshot();
+  await ctx.getRuntimeManager().openProject(projectRoot);
+  ctx.syncActiveWebuiView();
+  ctx.broadcastState();
+  return ctx.getRuntimeManager().snapshot();
+}
+async function registerProject(ctx, requestedRoot) {
+  let projectRoot = requestedRoot;
+  if (!projectRoot) {
+    projectRoot = await ctx.chooseProjectRoot("register");
+  }
+  if (!projectRoot) return ctx.getRuntimeManager().snapshot();
+  await ctx.getRuntimeManager().registerProject(projectRoot);
+  ctx.broadcastState();
+  return ctx.getRuntimeManager().snapshot();
+}
+async function unregisterProject(ctx, root) {
+  if (!root || typeof root !== "string") return ctx.getRuntimeManager().snapshot();
+  await ctx.getRuntimeManager().unregisterProject(root);
+  ctx.broadcastState();
+  return ctx.getRuntimeManager().snapshot();
+}
+async function openProjectSession(ctx, runtimeId) {
+  const snapshot = ctx.getRuntimeManager().snapshot();
+  const runtime = (runtimeId ? snapshot.runtimes.find((candidate) => candidate.id === runtimeId) : void 0) ?? snapshot.runtimes.find((candidate) => candidate.id === snapshot.activeRuntimeId);
+  if (runtime?.kind !== "project") {
+    return openProject(ctx);
+  }
+  await ctx.getRuntimeManager().openProject(runtime.root, { forceNew: true });
+  ctx.syncActiveWebuiView();
+  ctx.broadcastState();
+  return ctx.getRuntimeManager().snapshot();
+}
+async function openSettings(ctx) {
+  const snapshot = ctx.getRuntimeManager().snapshot();
+  const active = snapshot.runtimes.find((runtime) => runtime.id === snapshot.activeRuntimeId);
+  if (!active || active.kind === "global-settings" || active.status !== "running") {
+    const root = desktopSettingsWorkspaceRoot();
+    await fs4.mkdir(root, { recursive: true });
+    await ctx.getRuntimeManager().openProject(root, {
+      name: "Global Settings",
+      kind: "global-settings",
+      touchRecent: false
+    });
+    ctx.syncActiveWebuiView();
+    ctx.broadcastState();
   }
+  await ctx.dispatchWebuiCommand({ view: "settings" });
+  return ctx.getRuntimeManager().snapshot();
 }
-function validateOrDefault(schema, data, defaultValue) {
-  const result = validate(schema, data);
-  return result.success ? result.data : defaultValue;
+async function activateRuntime(ctx, id) {
+  await ctx.getRuntimeManager().activateRuntime(id);
+  ctx.syncActiveWebuiView();
+  ctx.broadcastState();
+  return ctx.getRuntimeManager().snapshot();
 }
-function formatZodError(error) {
-  return error.issues.map((e) => `${e.path.join(".")}: ${e.message}`).join("; ");
+async function closeRuntime(ctx, id) {
+  ctx.getAgentBridge().close(id);
+  await ctx.getRuntimeManager().closeRuntime(id);
+  ctx.syncActiveWebuiView();
+  ctx.broadcastState();
+  return ctx.getRuntimeManager().snapshot();
 }
-function createValidationLogger(prefix) {
-  const loggedErrors = /* @__PURE__ */ new Set();
-  const maxErrors = 100;
-  return {
-    log(error) {
-      if (loggedErrors.size >= maxErrors) return;
-      const key = `${prefix}:${error}`;
-      if (!loggedErrors.has(key)) {
-        loggedErrors.add(key);
-        console.warn(
-          JSON.stringify({
-            level: "warn",
-            event: "desktop.validation_error",
-            prefix,
-            message: error,
-            timestamp: (/* @__PURE__ */ new Date()).toISOString()
-          })
-        );
-      }
-    },
-    reset() {
-      loggedErrors.clear();
-    }
-  };
+async function restoreLastWorkspace(ctx) {
+  await ctx.getRuntimeManager().restoreLastWorkspace();
+  ctx.syncActiveWebuiView();
+  ctx.broadcastState();
 }
 
-// src/main/validation/schemas.ts
-import { statSync } from "node:fs";
-import * as path5 from "node:path";
-import { z } from "zod";
-var RUNTIME_ID_PATTERN = /^[a-zA-Z0-9._:-]{3,120}$/;
-var runtimeIdSchema = z.string().regex(RUNTIME_ID_PATTERN, "Invalid runtime ID format");
-var pathSchema = z.string().min(1).max(1e4);
-var projectRootSchema = pathSchema.refine((value) => !value.includes("\0"), {
-  message: "path must not contain a NUL byte"
-}).refine(
-  (value) => {
-    try {
-      return statSync(path5.resolve(value)).isDirectory();
-    } catch {
-      return false;
-    }
-  },
-  { message: "path must be an existing directory" }
-);
-var booleanSchema = z.boolean();
-var numberSchema = z.number().int().finite();
-var openProjectSchema = z.object({
-  requestedRoot: pathSchema.optional()
-});
-var registerProjectSchema = z.object({
-  requestedRoot: pathSchema.optional()
-});
-var unregisterProjectSchema = z.object({
-  root: pathSchema
-});
-var openProjectSessionSchema = z.object({
-  runtimeId: runtimeIdSchema.optional()
-});
-var activateRuntimeSchema = z.object({
-  id: runtimeIdSchema
-});
-var closeRuntimeSchema = z.object({
-  id: runtimeIdSchema
-});
-var sendMessageSchema = z.object({
-  id: runtimeIdSchema,
-  content: z.string()
-});
-var abortRuntimeSchema = z.object({
-  id: runtimeIdSchema
-});
-var openRuntimeInBrowserSchema = z.object({
-  id: runtimeIdSchema
-});
-var revealRuntimeRootSchema = z.object({
-  id: runtimeIdSchema
-});
-var setShellSidebarCollapsedSchema = z.object({
-  collapsed: booleanSchema
-});
-var navigateWebuiSchema = z.object({
-  command: z.unknown()
-});
-var getConversationSchema = z.object({
-  runtimeId: runtimeIdSchema
-});
-var webuiReadyChangedSchema = z.object({
-  ready: booleanSchema
-});
-var webuiPrefsChangedSchema = z.object({
-  prefs: z.record(z.string(), z.unknown())
-});
-var webuiCommandAckSchema = z.object({
-  requestId: z.string(),
-  handled: z.boolean(),
-  message: z.string().optional()
-});
-var setLocaleSchema = z.object({
-  locale: z.string().min(2).max(10)
-});
+// src/main/webui/controller.ts
+import { shell, WebContentsView } from "electron";
 
-// src/main/ipc-handlers/index.ts
-var validationLogger = createValidationLogger("IPC");
-function registerIpcHandlers(ctx) {
-  ipcMain.handle(IPC.getState, () => ctx.getRuntimeManager().snapshot());
-  ipcMain.handle(IPC.getConversation, (_event, runtimeId) => {
-    const result = validate(runtimeIdSchema, runtimeId);
-    if (!result.success) {
-      validationLogger.log(`getConversation: ${result.error}`);
-      return ctx.getAgentBridge().snapshot("");
+// src/main/webui-command-bridge.ts
+var DESKTOP_WEBUI_ACTIONS = /* @__PURE__ */ new Set([
+  "new-session",
+  "clear-context",
+  "compact-context",
+  "repair-context",
+  "download-chat",
+  "focus-chat",
+  "open-command-palette",
+  "open-shortcuts",
+  "search-chat",
+  "open-model-switcher",
+  "open-prompt-library"
+]);
+var DESKTOP_WEBUI_VIEWS = /* @__PURE__ */ new Set([
+  "chat",
+  "settings",
+  "goal",
+  "sddhub",
+  "files",
+  "changes",
+  "sessions",
+  "setup",
+  "skill",
+  "roster",
+  "mailbox",
+  "debug",
+  "design-gallery",
+  "refresh-debug",
+  "analytics"
+]);
+var DESKTOP_WEBUI_ACTIVITIES = /* @__PURE__ */ new Set([
+  "chat",
+  "agents",
+  "history",
+  "files",
+  "changes",
+  "mailbox",
+  "skills",
+  "design"
+]);
+var DESKTOP_WEBUI_OVERLAYS = /* @__PURE__ */ new Set([
+  "fleet",
+  "agents-monitor",
+  "processes",
+  "queue"
+]);
+var DESKTOP_WEBUI_DOCKS = /* @__PURE__ */ new Set([
+  "goal",
+  "fleet",
+  "work",
+  "worktrees",
+  "collab"
+]);
+var DESKTOP_WEBUI_WORK_TABS = /* @__PURE__ */ new Set(["todos", "tasks", "plan"]);
+var DESKTOP_WEBUI_PREF_KEYS = /* @__PURE__ */ new Set([
+  "yolo",
+  "nextPrediction",
+  "contextAutoCompact"
+]);
+function normalizeDesktopWebuiCommand(value) {
+  if (!isRecord3(value)) return null;
+  const command = {};
+  let hasCommand = false;
+  const sessionId = value["sessionId"];
+  if (sessionId !== void 0) {
+    if (typeof sessionId !== "string" || sessionId.length === 0 || sessionId.length > 512) {
+      return null;
     }
-    return ctx.getAgentBridge().snapshot(result.data);
-  });
-  ipcMain.handle(IPC.getWebuiStatus, () => ctx.getWebuiStatus());
-  ipcMain.handle(IPC.navigateWebui, async (_event, command) => {
-    return ctx.dispatchWebuiCommand(command);
-  });
-  ipcMain.handle(IPC.reloadWebui, async () => ctx.reloadActiveWebuiView());
-  ipcMain.handle(IPC.setShellSidebarCollapsed, (_event, collapsed) => {
-    const result = validateOrDefault(booleanSchema, collapsed, true);
-    ctx.setShellSidebarCollapsed(result);
-    return true;
-  });
-  ipcMain.handle(IPC.openSettings, async () => ctx.openSettings());
-  ipcMain.handle(IPC.openProjectSession, async (_event, runtimeId) => {
-    const validated = validateOptional(runtimeIdSchema, runtimeId);
-    return ctx.openProjectSession(validated);
-  });
-  ipcMain.handle(IPC.openProject, async (_event, requestedRoot) => {
-    const validated = validateOptional(projectRootSchema, requestedRoot);
-    return ctx.openProject(validated);
-  });
-  ipcMain.handle(IPC.registerProject, async (_event, requestedRoot) => {
-    const validated = validateOptional(projectRootSchema, requestedRoot);
-    return ctx.registerProject(validated);
-  });
-  ipcMain.handle(IPC.unregisterProject, async (_event, root) => {
-    const result = validate(pathSchema, root);
-    if (!result.success) {
-      validationLogger.log(`unregisterProject: ${result.error}`);
-      return ctx.getRuntimeManager().snapshot();
+    command.sessionId = sessionId;
+    hasCommand = true;
+  }
+  const action = value["action"];
+  if (action !== void 0) {
+    if (typeof action !== "string" || !DESKTOP_WEBUI_ACTIONS.has(action)) {
+      return null;
+    }
+    command.action = action;
+    hasCommand = true;
+  }
+  const view = value["view"];
+  if (view !== void 0) {
+    if (typeof view !== "string" || !DESKTOP_WEBUI_VIEWS.has(view)) {
+      return null;
+    }
+    command.view = view;
+    hasCommand = true;
+  }
+  const activity = value["activity"];
+  if (activity !== void 0) {
+    if (typeof activity !== "string" || !DESKTOP_WEBUI_ACTIVITIES.has(activity)) {
+      return null;
+    }
+    command.activity = activity;
+    hasCommand = true;
+  }
+  const overlay = value["overlay"];
+  if (overlay !== void 0) {
+    if (typeof overlay !== "string" || !DESKTOP_WEBUI_OVERLAYS.has(overlay)) {
+      return null;
     }
-    return ctx.unregisterProject(result.data);
-  });
-  ipcMain.handle(IPC.activateRuntime, async (_event, id) => {
-    const result = validate(runtimeIdSchema, id);
-    if (!result.success) {
-      validationLogger.log(`activateRuntime: ${result.error}`);
-      return ctx.getRuntimeManager().snapshot();
+    command.overlay = overlay;
+    hasCommand = true;
+  }
+  const dockSection = value["dockSection"];
+  if (dockSection !== void 0) {
+    if (typeof dockSection !== "string" || !DESKTOP_WEBUI_DOCKS.has(dockSection)) {
+      return null;
     }
-    return ctx.activateRuntime(result.data);
-  });
-  ipcMain.handle(IPC.closeRuntime, async (_event, id) => {
-    const result = validate(runtimeIdSchema, id);
-    if (!result.success) {
-      validationLogger.log(`closeRuntime: ${result.error}`);
-      return ctx.getRuntimeManager().snapshot();
+    command.dockSection = dockSection;
+    hasCommand = true;
+  }
+  const workTab = value["workTab"];
+  if (workTab !== void 0) {
+    if (typeof workTab !== "string" || !DESKTOP_WEBUI_WORK_TABS.has(workTab)) {
+      return null;
     }
-    return ctx.closeRuntime(result.data);
-  });
-  ipcMain.handle(IPC.sendMessage, async (_event, id, content) => {
-    const idResult = validate(runtimeIdSchema, id);
-    if (!idResult.success) {
-      validationLogger.log(`sendMessage (id): ${idResult.error}`);
-      return ctx.sendMessage("", "", "");
+    command.workTab = workTab;
+    hasCommand = true;
+  }
+  const terminal = value["terminal"];
+  if (terminal !== void 0) {
+    if (terminal !== true && terminal !== false && terminal !== "toggle" && terminal !== "new") {
+      return null;
     }
-    const contentResult = validate(
-      pathSchema.transform(() => String(content ?? "")),
-      content
-    );
-    const safeContent = contentResult.success ? contentResult.data : String(content ?? "");
-    return ctx.sendMessage(
-      idResult.data,
-      ctx.getRuntimeManager().getRuntimeWsUrlWithToken(idResult.data) ?? "",
-      safeContent
-    );
-  });
-  ipcMain.handle(IPC.abortRuntime, async (_event, id) => {
-    const result = validate(runtimeIdSchema, id);
-    if (!result.success) {
-      validationLogger.log(`abortRuntime: ${result.error}`);
-      return ctx.abortRuntime("", "");
+    command.terminal = terminal;
+    hasCommand = true;
+  }
+  const pref = value["pref"];
+  if (pref !== void 0) {
+    if (!isRecord3(pref)) return null;
+    const key = pref["key"];
+    if (typeof key !== "string" || !DESKTOP_WEBUI_PREF_KEYS.has(key)) {
+      return null;
     }
-    return ctx.abortRuntime(
-      result.data,
-      ctx.getRuntimeManager().getRuntimeWsUrlWithToken(result.data) ?? ""
-    );
-  });
-  ipcMain.handle(IPC.openRuntimeInBrowser, async (_event, id) => {
-    const result = validate(runtimeIdSchema, id);
-    if (!result.success) {
-      validationLogger.log(`openRuntimeInBrowser: ${result.error}`);
+    const toggle = pref["toggle"];
+    const prefValue = pref["value"];
+    if (toggle !== void 0 && typeof toggle !== "boolean") return null;
+    if (prefValue !== void 0 && typeof prefValue !== "boolean") return null;
+    if (toggle === void 0 && prefValue === void 0) return null;
+    command.pref = {
+      key,
+      ...typeof prefValue === "boolean" ? { value: prefValue } : {},
+      ...typeof toggle === "boolean" ? { toggle } : {}
+    };
+    hasCommand = true;
+  }
+  return hasCommand ? command : null;
+}
+function buildWebuiCommandFallbackScript(command) {
+  const payload = JSON.stringify(command).replace(/</g, "\\u003c");
+  return `window.dispatchEvent(new CustomEvent('wrongstack:desktop-command', { detail: ${payload} })); true;`;
+}
+function isRecord3(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+
+// src/main/webui/navigation.ts
+function allowedExternalProtocol(target) {
+  try {
+    const protocol = new URL(target).protocol;
+    return OPEN_EXTERNAL_ALLOWED_PROTOCOLS.has(protocol) ? protocol : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function sameOrigin(candidate, base) {
+  if (!base) return false;
+  try {
+    return new URL(candidate).origin === new URL(base).origin;
+  } catch {
+    return false;
+  }
+}
+
+// src/main/webui/controller.ts
+var DesktopWebuiController = class {
+  constructor(ctx) {
+    this.ctx = ctx;
+  }
+  ctx;
+  views = /* @__PURE__ */ new Map();
+  /** Last live four-tab declaration from each running project WebUI. */
+  openSessions = /* @__PURE__ */ new Map();
+  pendingAcks = /* @__PURE__ */ new Map();
+  activeRuntimeId = null;
+  status = { runtimeId: null, status: "idle" };
+  commandSequence = 0;
+  openExternal(target) {
+    const protocol = allowedExternalProtocol(target);
+    if (!protocol) return;
+    void authorizeDesktopAction(this.ctx.trustBoundary, {
+      capability: "url.open-external",
+      subject: { kind: "url", id: target, attributes: { protocol } },
+      risk: "elevated",
+      // Reached from the WebUI view, whose content is remote and reflects agent
+      // and tool output (WS-SEC-03).
+      origin: "remote-client",
+      metadata: { operation: "webui-navigation" }
+    }).then((decision) => decision.allowed ? void shell.openExternal(target) : void 0).catch(() => void 0);
+  }
+  publishStatus(next) {
+    this.status = next;
+    const shellView2 = this.ctx.getShellView();
+    if (!shellView2 || shellView2.webContents.isDestroyed()) return;
+    shellView2.webContents.send(IPC.webuiStatusChanged, next);
+  }
+  setEntryStatus(entry, next) {
+    const previousPrefs = entry.status.prefs;
+    entry.status = {
+      ...next,
+      ...next.prefs === void 0 && previousPrefs !== void 0 ? { prefs: previousPrefs } : {},
+      // `pendingCommands` is always derived from the entry's own array (source of truth).
+      // Any `next.pendingCommands` value is intentionally overwritten.
+      pendingCommands: entry.pendingCommands.length
+    };
+    if (this.activeRuntimeId === entry.runtimeId) {
+      this.publishStatus(entry.status);
+      this.ctx.onPrefsChanged?.(previousPrefs, entry.status.prefs);
+    }
+  }
+  openSessionSnapshots() {
+    return [...this.openSessions].map(([runtimeId, sessions]) => ({ runtimeId, sessions }));
+  }
+  setOpenSessions(runtimeId, sessions) {
+    if (sessions.length === 0) this.openSessions.delete(runtimeId);
+    else this.openSessions.set(runtimeId, sessions);
+    this.ctx.onOpenSessionsChanged?.({ runtimeId, sessions });
+  }
+  pruneOpenSessions(liveRuntimeIds) {
+    for (const runtimeId of [...this.openSessions.keys()]) {
+      if (liveRuntimeIds.has(runtimeId)) continue;
+      this.openSessions.delete(runtimeId);
+      this.ctx.onOpenSessionsChanged?.({ runtimeId, sessions: [] });
+    }
+  }
+  ensure(runtimeId) {
+    const mainWindow2 = this.ctx.getMainWindow();
+    if (!mainWindow2) return null;
+    const existing = this.views.get(runtimeId);
+    if (existing) return existing;
+    const view = new WebContentsView({
+      webPreferences: {
+        preload: webuiPreloadPath(),
+        contextIsolation: true,
+        nodeIntegration: false,
+        // This is the view that renders agent output, tool results, file
+        // contents, and fetched pages — i.e. the most attacker-influenceable
+        // surface in the app, and the one that most needs process-level
+        // containment rather than only bridge-level. webui-preload.ts imports
+        // just electron's contextBridge/ipcRenderer and a constants map, so it
+        // is already within the sandboxed preload subset (WS-093).
+        sandbox: true
+      }
+    });
+    const entry = {
+      runtimeId,
+      view,
+      url: null,
+      status: { runtimeId, status: "idle" },
+      bridgeReady: false,
+      attached: false,
+      pendingCommands: [],
+      pendingFlushTimer: null,
+      pendingFlushAttempts: 0
+    };
+    view.webContents.setWindowOpenHandler(({ url }) => {
+      this.openExternal(url);
+      return { action: "deny" };
+    });
+    view.webContents.on("will-navigate", (event, url) => {
+      if (sameOrigin(url, entry.url)) return;
+      event.preventDefault();
+      this.openExternal(url);
+    });
+    view.webContents.on("did-start-loading", () => {
+      if (this.views.get(runtimeId) !== entry) return;
+      entry.bridgeReady = false;
+      this.setEntryStatus(entry, { runtimeId, status: "loading" });
+    });
+    view.webContents.on("did-finish-load", () => {
+      if (this.views.get(runtimeId) !== entry) return;
+      this.scheduleFlush(entry);
+      try {
+        entry.view.webContents.send(IPC.webuiLocaleChanged, this.ctx.getLocale());
+      } catch {
+      }
+    });
+    view.webContents.on("did-fail-load", (_event, errorCode, errorDescription) => {
+      if (this.views.get(runtimeId) !== entry || errorCode === -3) return;
+      this.setEntryStatus(entry, { runtimeId, status: "error", error: errorDescription });
+    });
+    view.webContents.on("render-process-gone", (_event, details) => {
+      if (this.views.get(runtimeId) !== entry) return;
+      this.setEntryStatus(entry, {
+        runtimeId,
+        status: "error",
+        error: `WebUI renderer exited: ${details.reason}`
+      });
+    });
+    this.views.set(runtimeId, entry);
+    return entry;
+  }
+  attach(entry) {
+    const mainWindow2 = this.ctx.getMainWindow();
+    if (!mainWindow2 || entry.attached) return;
+    mainWindow2.contentView.addChildView(entry.view);
+    entry.attached = true;
+  }
+  dispose(entry) {
+    this.views.delete(entry.runtimeId);
+    entry.pendingCommands.length = 0;
+    this.settleRuntimeAcks(entry.runtimeId, false);
+    if (entry.pendingFlushTimer) clearTimeout(entry.pendingFlushTimer);
+    entry.pendingFlushTimer = null;
+    const mainWindow2 = this.ctx.getMainWindow();
+    if (mainWindow2 && entry.attached) mainWindow2.contentView.removeChildView(entry.view);
+    entry.attached = false;
+    if (!entry.view.webContents.isDestroyed()) entry.view.webContents.close();
+    if (this.activeRuntimeId === entry.runtimeId) this.activeRuntimeId = null;
+  }
+  disposeAll() {
+    for (const entry of [...this.views.values()]) this.dispose(entry);
+    this.openSessions.clear();
+  }
+  findBySenderId(senderId) {
+    return [...this.views.values()].find((entry) => entry.view.webContents.id === senderId);
+  }
+  /**
+   * Point the window at the active runtime's WebUI, and keep no other view.
+   *
+   * Only views whose runtime had STOPPED were released here. A view for a
+   * running-but-background project stayed alive for the life of the app — a
+   * full Chromium renderer process each, hidden purely by setting its width to
+   * zero in `layoutViews`. Ten open projects meant ten renderer processes to
+   * show one, and memory grew with every project ever visited.
+   *
+   * Now exactly one view exists: the active one. Switching projects releases
+   * the previous view and loads the next, which costs a page load on the way
+   * back — the deliberate trade for a footprint that does not grow with how
+   * many projects are open. The shell covers that load with its own
+   * `loading` state, so the gap is visible as progress rather than as a blank
+   * window.
+   *
+   * Queued WebUI commands are not at risk: `dispatch` only ever targets
+   * `activeEntry()`, so a disposed background view cannot have had any.
+   */
+  syncActive() {
+    if (!this.ctx.getMainWindow()) return;
+    const snapshot = this.ctx.manager.snapshot();
+    this.pruneOpenSessions(
+      new Set(
+        snapshot.runtimes.filter((runtime) => runtime.status === "running" || runtime.status === "starting").map((runtime) => runtime.id)
+      )
+    );
+    const active = snapshot.runtimes.find((runtime) => runtime.id === snapshot.activeRuntimeId);
+    const keep = active?.status === "running" ? active.id : null;
+    for (const [id, entry2] of this.views) if (id !== keep) this.dispose(entry2);
+    if (active?.status !== "running") {
+      this.activeRuntimeId = active?.id ?? null;
+      this.publishStatus({ runtimeId: active?.id ?? null, status: "idle" });
+      this.ctx.layoutViews();
       return;
     }
-    const url = ctx.getRuntimeManager().getRuntimeUrlWithToken(result.data);
-    if (url) ctx.openExternal(url);
-  });
-  ipcMain.handle(IPC.revealRuntimeRoot, async (_event, id) => {
-    const result = validate(runtimeIdSchema, id);
-    if (!result.success) {
-      validationLogger.log(`revealRuntimeRoot: ${result.error}`);
+    const url = this.ctx.manager.getRuntimeUrlWithToken(active.id);
+    if (!url) {
+      this.activeRuntimeId = active.id;
+      this.publishStatus({ runtimeId: active.id, status: "idle" });
+      this.ctx.layoutViews();
       return;
     }
-    const runtime = ctx.getRuntimeManager().getRuntime(result.data);
-    if (runtime) ctx.revealInExplorer(runtime.root);
-  });
-  ipcMain.on(IPC.webuiReadyChanged, (event, ready) => {
-    const entry = ctx.findWebuiEntryBySenderId(event.sender.id);
+    const entry = this.ensure(active.id);
     if (!entry) return;
-    const isReady = ready === true;
-    entry.bridgeReady = isReady;
-    if (entry.bridgeReady) {
-      ctx.setEntryWebuiStatus(entry, { ...entry.status, status: "ready" });
-      ctx.schedulePendingWebuiFlush(entry);
-    } else if (entry.status.status === "ready") {
-      ctx.setEntryWebuiStatus(entry, { ...entry.status, status: "loading" });
+    this.activeRuntimeId = active.id;
+    this.attach(entry);
+    this.ctx.layoutViews();
+    this.publishStatus(entry.status);
+    if (entry.url === url) return;
+    entry.url = url;
+    entry.bridgeReady = false;
+    this.setEntryStatus(entry, { runtimeId: active.id, status: "loading" });
+    void entry.view.webContents.loadURL(url).catch((error) => {
+      this.setEntryStatus(entry, {
+        runtimeId: active.id,
+        status: "error",
+        error: error instanceof Error ? error.message : String(error)
+      });
+    });
+  }
+  broadcastLocale(locale) {
+    for (const entry of this.views.values()) {
+      if (!entry.view.webContents.isDestroyed())
+        entry.view.webContents.send(IPC.webuiLocaleChanged, locale);
     }
-  });
-  ipcMain.on(IPC.webuiPrefsChanged, (event, prefs) => {
-    const entry = ctx.findWebuiEntryBySenderId(event.sender.id);
-    if (!entry) return;
-    const sanitized = sanitizeWebuiPrefs(prefs);
-    if (Object.keys(sanitized).length === 0) return;
-    ctx.setEntryWebuiStatus(entry, {
-      ...entry.status,
-      prefs: { ...entry.status.prefs ?? {}, ...sanitized }
+  }
+  activeEntry() {
+    const id = this.ctx.manager.snapshot().activeRuntimeId;
+    return id ? this.views.get(id) : void 0;
+  }
+  async dispatch(commandInput) {
+    const command = normalizeDesktopWebuiCommand(commandInput);
+    if (!command) return false;
+    const entry = this.activeEntry();
+    if (!entry?.url) return false;
+    if (entry.status.status !== "ready" || !entry.bridgeReady) {
+      if (!entry.view.webContents.isLoading() && entry.status.status !== "error")
+        return this.dispatchNow(entry, command);
+      this.queue(entry, command);
+      this.scheduleFlush(entry);
+      return true;
+    }
+    return this.dispatchNow(entry, command);
+  }
+  async reload() {
+    const entry = this.activeEntry();
+    if (!entry?.url) return false;
+    entry.bridgeReady = false;
+    this.setEntryStatus(entry, { runtimeId: entry.runtimeId, status: "loading" });
+    return entry.view.webContents.loadURL(entry.url).then(() => true).catch((error) => {
+      this.setEntryStatus(entry, {
+        runtimeId: entry.runtimeId,
+        status: "error",
+        error: error instanceof Error ? error.message : String(error)
+      });
+      return false;
     });
-  });
-  ipcMain.on(
-    IPC.webuiCommandAck,
-    (event, requestId, handled, _message) => {
-      const entry = ctx.findWebuiEntryBySenderId(event.sender.id);
-      if (!entry) return;
-      const result = validate(webuiCommandAckSchema, {
-        requestId,
-        handled,
-        message: _message
+  }
+  queue(entry, command) {
+    entry.pendingCommands.push(command);
+    if (entry.pendingCommands.length > MAX_PENDING_WEBUI_COMMANDS)
+      entry.pendingCommands.splice(0, entry.pendingCommands.length - MAX_PENDING_WEBUI_COMMANDS);
+    entry.pendingFlushAttempts = 0;
+    this.setEntryStatus(entry, entry.status);
+  }
+  dispatchNow(entry, command) {
+    if (this.views.get(entry.runtimeId) !== entry || !entry.url) return Promise.resolve(false);
+    const requestId = `${entry.runtimeId}:${Date.now()}:${++this.commandSequence}`;
+    const outbound = { ...command, requestId };
+    return new Promise((resolve4) => {
+      const fallbackTimer = setTimeout(() => {
+        if (!this.pendingAcks.has(requestId)) return;
+        if (this.views.get(entry.runtimeId) !== entry || entry.view.webContents.isDestroyed())
+          return;
+        void entry.view.webContents.executeJavaScript(buildWebuiCommandFallbackScript(outbound), true).catch(() => void 0);
+      }, WEBUI_COMMAND_FALLBACK_MS);
+      const timer = setTimeout(
+        () => this.settleAck(requestId, false),
+        WEBUI_COMMAND_ACK_TIMEOUT_MS
+      );
+      this.pendingAcks.set(requestId, {
+        runtimeId: entry.runtimeId,
+        timer,
+        fallbackTimer,
+        resolve: resolve4
       });
-      if (!result.success) {
-        validationLogger.log(`webuiCommandAck: ${result.error}`);
+      try {
+        entry.view.webContents.send(IPC.webuiCommand, outbound);
+        if (this.activeRuntimeId === entry.runtimeId) entry.view.webContents.focus();
+      } catch {
+        this.settleAck(requestId, false);
+      }
+    });
+  }
+  settleAck(requestId, handled) {
+    const pending = this.pendingAcks.get(requestId);
+    if (!pending) return;
+    this.pendingAcks.delete(requestId);
+    clearTimeout(pending.timer);
+    if (pending.fallbackTimer) clearTimeout(pending.fallbackTimer);
+    if (handled) {
+      const entry = this.views.get(pending.runtimeId);
+      if (entry) {
+        entry.bridgeReady = true;
+        this.setEntryStatus(entry, { ...entry.status, status: "ready" });
+      }
+    }
+    pending.resolve(handled);
+  }
+  settleRuntimeAcks(runtimeId, handled) {
+    for (const [id, pending] of [...this.pendingAcks])
+      if (pending.runtimeId === runtimeId) this.settleAck(id, handled);
+  }
+  scheduleFlush(entry) {
+    if (entry.pendingFlushTimer) return;
+    entry.pendingFlushTimer = setTimeout(() => {
+      entry.pendingFlushTimer = null;
+      void this.flush(entry);
+    }, 250);
+  }
+  async flush(entry) {
+    if (this.views.get(entry.runtimeId) !== entry || entry.pendingCommands.length === 0) return;
+    if (!entry.bridgeReady) {
+      entry.pendingFlushAttempts += 1;
+      const shouldExecuteFallback = !entry.view.webContents.isLoading() && entry.pendingFlushAttempts >= 4;
+      if (!shouldExecuteFallback && entry.pendingFlushAttempts <= MAX_PENDING_FLUSH_ATTEMPTS) {
+        this.scheduleFlush(entry);
+        this.setEntryStatus(entry, entry.status);
+        return;
+      }
+      if (!shouldExecuteFallback) {
+        entry.pendingCommands.length = 0;
+        this.setEntryStatus(entry, {
+          runtimeId: entry.runtimeId,
+          status: "error",
+          error: "WebUI command bridge did not become ready."
+        });
         return;
       }
-      const pending = ctx.getPendingWebuiCommandAcks().get(result.data.requestId);
-      if (!pending || pending.runtimeId !== entry.runtimeId) return;
-      ctx.settlePendingWebuiCommandAck(result.data.requestId, result.data.handled);
     }
-  );
-  ipcMain.on(IPC.setLocale, (_event, locale) => {
-    const result = validate(setLocaleSchema, { locale });
-    if (!result.success) {
-      validationLogger.log(`setLocale: ${result.error}`);
-      return;
+    entry.pendingFlushAttempts = 0;
+    const commands = entry.pendingCommands.splice(0);
+    this.setEntryStatus(entry, entry.status);
+    for (const command of commands) await this.dispatchNow(entry, command).catch(() => void 0);
+  }
+};
+
+// src/main/window-state-controller.ts
+var DesktopWindowStateController = class {
+  constructor(ctx) {
+    this.ctx = ctx;
+  }
+  ctx;
+  saveTimer = null;
+  scheduleSave() {
+    if (this.saveTimer) clearTimeout(this.saveTimer);
+    this.saveTimer = setTimeout(() => {
+      this.saveTimer = null;
+      void this.save();
+    }, 350);
+  }
+  async save() {
+    const window = this.ctx.getWindow();
+    if (!window || window.isDestroyed?.()) return;
+    const bounds = window.getNormalBounds();
+    await this.ctx.save({ ...bounds, maximized: window.isMaximized() });
+  }
+  validated(state) {
+    if (!state || !Number.isFinite(state.width) || !Number.isFinite(state.height) || state.width < MIN_WINDOW_WIDTH || state.height < MIN_WINDOW_HEIGHT)
+      return null;
+    if (state.x === void 0 || state.y === void 0) {
+      return { width: state.width, height: state.height, maximized: state.maximized };
     }
-    ctx.getI18n().setMainLocale(result.data.locale);
-    ctx.configureApplicationMenu();
-    ctx.broadcastLocaleToEmbeddedWebuis(result.data.locale);
-    void ctx.getConfigIo().writeUiLocale(result.data.locale);
-  });
-}
-function validateOptional(schema, value) {
-  if (value === void 0 || value === null) return void 0;
-  const result = schema.safeParse(value);
-  return result.success ? result.data : void 0;
-}
-function sanitizeWebuiPrefs(prefs) {
-  const next = {};
-  if (!isRecord2(prefs)) return next;
-  if (typeof prefs["yolo"] === "boolean") next.yolo = prefs["yolo"];
-  if (typeof prefs["nextPrediction"] === "boolean") next.nextPrediction = prefs["nextPrediction"];
-  if (typeof prefs["contextAutoCompact"] === "boolean") {
-    next.contextAutoCompact = prefs["contextAutoCompact"];
+    const candidate = { x: state.x, y: state.y, width: state.width, height: state.height };
+    return this.ctx.getDisplays().some(({ workArea }) => intersects(candidate, workArea)) ? {
+      x: state.x,
+      y: state.y,
+      width: state.width,
+      height: state.height,
+      maximized: state.maximized
+    } : null;
   }
-  return next;
-}
-function isRecord2(value) {
-  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+};
+function intersects(left, right) {
+  return left.x < right.x + right.width && left.x + left.width > right.x && left.y < right.y + right.height && left.y + left.height > right.y;
 }
 
 // src/main/main.ts
@@ -3081,6 +3281,10 @@ var webuiController = new DesktopWebuiController({
   layoutViews: () => layoutWebuiViews(),
   onPrefsChanged: (previous, next) => {
     if (menuRelevantPrefsChanged(previous, next)) configureApplicationMenu2();
+  },
+  onOpenSessionsChanged: (snapshot) => {
+    if (!shellView || shellView.webContents.isDestroyed()) return;
+    shellView.webContents.send(IPC.openSessionsChanged, snapshot);
   }
 });
 var windowStateController = new DesktopWindowStateController({
@@ -3095,6 +3299,7 @@ function safeOpenExternal(target) {
       capability: "url.open-external",
       subject: { kind: "url", id: target, attributes: { protocol } },
       risk: "elevated",
+      origin: "user",
       metadata: { operation: "open-external" }
     }).then((authorization) => {
       if (authorization.allowed) return shell2.openExternal(target);
@@ -3107,6 +3312,7 @@ function revealInExplorer(root) {
     capability: "filesystem.open-native",
     subject: { kind: "path", id: root, attributes: { target: "file-manager" } },
     risk: "elevated",
+    origin: "user",
     cwd: root,
     metadata: { operation: "reveal-in-explorer" }
   }).then((authorization) => {
@@ -3252,6 +3458,7 @@ function buildIpcHandlerContext() {
     getShellView: () => shellView,
     getWebuiViews: () => webuiController.views,
     getWebuiStatus: () => webuiController.status,
+    getOpenSessions: () => webuiController.openSessionSnapshots(),
     getRuntimeManager: () => manager,
     getAgentBridge: () => bridge,
     getI18n: () => ({ getMainLocale, setMainLocale, tMain }),
@@ -3285,7 +3492,8 @@ function buildIpcHandlerContext() {
     getPendingWebuiCommandAcks: () => webuiController.pendingAcks,
     settlePendingWebuiCommandAck: (requestId, handled) => webuiController.settleAck(requestId, handled),
     setEntryWebuiStatus: (entry, next) => webuiController.setEntryStatus(entry, next),
-    schedulePendingWebuiFlush: (entry) => webuiController.scheduleFlush(entry)
+    schedulePendingWebuiFlush: (entry) => webuiController.scheduleFlush(entry),
+    setOpenSessions: (runtimeId, sessions) => webuiController.setOpenSessions(runtimeId, sessions)
   };
 }
 async function boot() {
@@ -3325,8 +3533,8 @@ async function boot() {
     width: prevState?.width ?? defaultWidth,
     height: prevState?.height ?? defaultHeight,
     show: false,
-    minWidth: MIN_WINDOW_WIDTH2,
-    minHeight: MIN_WINDOW_HEIGHT2,
+    minWidth: MIN_WINDOW_WIDTH,
+    minHeight: MIN_WINDOW_HEIGHT,
     title: tMain("windowTitle"),
     ...appIcon ? { icon: appIcon } : {}
   };
@@ -3382,6 +3590,7 @@ async function boot() {
     void windowStateController.save().finally(() => app2.exit(0));
   });
   await restoreLastWorkspace2();
+  manager.startIdleSweep();
   const argvOpenPath = firstOpenFileArg(process.argv);
   const queuedOpenPath = drainPendingOpenFilePath();
   const openPath = argvOpenPath ?? queuedOpenPath;
@@ -3409,6 +3618,7 @@ app2.on("before-quit", () => {
   }
   bridge.closeAll();
   webuiController.disposeAll();
+  manager.stopIdleSweep();
   void manager.closeAll({ persistWorkspace: false });
 });
 app2.on("activate", () => {