@wrongstack/webui-server 0.284.0 → 0.285.0

package/dist/server/entry.js

@@ -1,35 +1,18 @@
 #!/usr/bin/env node
-import { DefaultSecretScrubber, ToolValidationError, expectDefined, createDefaultPipelines, resolveSessionLoggingConfig, createSessionEventBridge, watchProviderConfig, atomicWrite, bootConfig as bootConfig$1, DefaultModelsRegistry, TOKENS, ProviderRegistry, ToolRegistry, DefaultMemoryStore, EventBus, makeMailboxTool, makeMailSendTool, makeMailInboxTool, makeFleetStatusTool, applyToolDescriptionModes, applyToolResultRenderModes, DefaultSessionStore, getSessionRegistry, DEFAULT_SESSION_PRUNE_DAYS, DefaultSessionReader, AnnotationsStore, FleetNotifier, AgentStatusTracker, DefaultModeStore, DefaultSkillLoader, SkillInstaller, DefaultPromptLoader, PromptUsageStore, DefaultSystemPromptBuilder, GlobalMailbox, Context, resolveContextWindowPolicy, CollaborationBus, collabInjectMiddleware, collabPauseMiddleware, installDesignStudioMiddleware, createStrategyCompactor, AutoCompactionMiddleware, estimateRequestTokensCalibrated, ToolExecutor, DEFAULT_TOOLS_CONFIG, Agent, ObservableBrainArbiter, createTieredBrainArbiter, DefaultBrainArbiter, BrainMonitor, mailboxSessionTag, resolveProjectDir, wstackGlobalRoot, createAutonomyBrain, PhaseStore, PhaseGraphBuilder, WorktreeManager, PhaseOrchestrator, AutoPhasePlanner, assignNickname, computeTaskProgress, DEFAULT_CONTEXT_WINDOW_MODE_ID, repairToolUseAdjacency, resolveWstackPaths, recentTextTurns, gatedEnhancerReasoning, enhanceUserPrompt, resolveProviderModelList, listContextWindowModes, projectSlug, allServers, ConfigError, deserializeTaskGraph, serializeTaskGraph, loadActiveKit, getDesignKitLoader, applyTokenOverrides, runDesignVerify, isDesignStack, materializeTokens, recordOverrides, setDesignOverrides, getDesignState, setActiveKit, recordKitChoice } from '@wrongstack/core';
-import { spawnSync, spawn } from 'child_process';
-import { toErrorMessage, atomicWrite as atomicWrite$1, resolveWstackPaths as resolveWstackPaths$1, wstackGlobalRoot as wstackGlobalRoot$1 } from '@wrongstack/core/utils';
-import * as path5 from 'path';
-import path5__default, { resolve, join, sep, dirname } from 'path';
-import { searchCodebaseIndex } from '@wrongstack/tools/codebase-index/index';
-import { randomUUID, randomBytes, timingSafeEqual } from 'crypto';
-import { WebSocket, WebSocketServer } from 'ws';
-import * as fs4 from 'fs/promises';
-import * as http from 'http';
-import { Buffer } from 'buffer';
-import * as os from 'os';
-import { MCPRegistry, discoverMcp, restartMcp, disableMcp, enableMcp, removeMcp, updateMcp, addMcp, listMcp } from '@wrongstack/mcp';
-import * as net from 'net';
-import { decryptConfigSecrets, encryptConfigSecrets } from '@wrongstack/core/security';
-import { SpecStore, TaskGraphStore, SddBoardStore, applySddLifecycle, SddRunRegistry, SddInterviewDriver, cleanupStaleSddWorktrees, makeCommandVerifier, SddSupervisor, makeLlmSubtaskGenerator, startSddRun } from '@wrongstack/sdd';
-import * as fs12 from 'fs';
-import { watch, existsSync, promises } from 'fs';
-import JSZip from 'jszip';
-import { createRequire } from 'module';
-import { fileURLToPath } from 'url';
-import { makeProviderFromConfig, buildProviderFactoriesFromRegistry, discoverOpenAICompatibleModels, capabilitiesFor, COMPATIBLE_PRESETS } from '@wrongstack/providers';
-import { DefaultTokenCounter } from '@wrongstack/core/infrastructure';
-import { createDefaultContainer, makeLightSubagentFactory } from '@wrongstack/runtime';
-import { ensureSessionShell, builtinToolsPack, rememberTool, forgetTool, searchMemoryTool, relatedMemoryTool, configureExecPolicy, configureDangerBypass, runStartupIndex, isIndexableFile, enqueueReindex, cancelPendingReindexes, shutdownCodebaseIndexHost } from '@wrongstack/tools';
-import { readLiveLock } from '@wrongstack/core/coordination';
-import { removeColumn, addColumn, getTask, removeTask, assignTask, updateGoalMetricOnTask, addGoalMetricToTask, releaseTaskClaim, claimReadyTask, getTaskChain, setTaskChain, copyTaskToBoard, transferTaskToBoard, moveTask, updateTask, mergeTasks, splitTask, addTask, syncBoardFromTaskGraph, exportBoardToTaskGraph, getKanbanOrchestrationSnapshot, listReadyTasks, createBoard, generateBoardFromDescription, parseLinesIntoTasks, getBoard, removeBoard, duplicateBoard, updateBoard, getKanbanQueueHealth, listBoards } from '@wrongstack/kanban';
-import { beginOAuthLogin } from '@wrongstack/providers/oauth';
-import { probeLocalLlm } from '@wrongstack/runtime/probe';
-
 // src/server/entry.ts
+import { ToolValidationError as ToolValidationError6 } from "@wrongstack/core";
+
+// src/server/autophase-ws-handler.ts
+import { spawnSync } from "node:child_process";
+import { toErrorMessage } from "@wrongstack/core/utils";
+import {
+  assignNickname,
+  AutoPhasePlanner,
+  PhaseGraphBuilder,
+  PhaseOrchestrator,
+  PhaseStore,
+  WorktreeManager
+} from "@wrongstack/core";
 function deriveTitle(goal) {
   const firstLine = goal.split("\n").map((l) => l.trim()).find(Boolean);
   if (!firstLine) return "AutoPhase";
@@ -520,6 +503,14 @@ Type: ${task.type}`;
     }
   }
 };
+
+// src/server/completion-handlers.ts
+import * as path from "node:path";
+import { searchCodebaseIndex } from "@wrongstack/tools/codebase-index/index";
+
+// src/server/ws-utils.ts
+import { randomBytes } from "node:crypto";
+import { WebSocket } from "ws";
 function send(ws, msg) {
   if (ws.readyState === WebSocket.OPEN) {
     ws.send(JSON.stringify(msg));
@@ -651,8 +642,8 @@ async function handleCompletionRequest(ws, msg, opts) {
     return;
   }
   const payload = parsed.payload;
-  const projectRoot = path5.resolve(opts.projectRoot);
-  const resolved = path5.resolve(projectRoot, payload.filePath);
+  const projectRoot = path.resolve(opts.projectRoot);
+  const resolved = path.resolve(projectRoot, payload.filePath);
   if (!isInside(projectRoot, resolved)) {
     send(ws, {
       type: "completion.result",
@@ -1051,7 +1042,7 @@ function buildSearchQuery(linePrefix, filePath) {
   if (memberMatch?.[1]) return memberMatch[1];
   const token = linePrefix.match(/([A-Za-z_$][\w$]*)$/)?.[1];
   if (token && token.length >= 2) return token;
-  return path5.basename(filePath, path5.extname(filePath));
+  return path.basename(filePath, path.extname(filePath));
 }
 function currentLinePrefix(prefix) {
   const idx = Math.max(prefix.lastIndexOf("\n"), prefix.lastIndexOf("\r"));
@@ -1081,11 +1072,16 @@ function head(value, max) {
   return value.length <= max ? value : value.slice(0, max);
 }
 function isInside(root, target) {
-  return target === root || target.startsWith(root + path5.sep);
+  return target === root || target.startsWith(root + path.sep);
 }
+
+// src/server/custom-context-modes.ts
+import { listContextWindowModes, atomicWrite } from "@wrongstack/core";
+import * as fs from "node:fs/promises";
+import * as path2 from "node:path";
 var STORE_FILENAME = "custom-context-modes.json";
 function storePath(wrongstackDir) {
-  return path5.join(wrongstackDir, STORE_FILENAME);
+  return path2.join(wrongstackDir, STORE_FILENAME);
 }
 var BUILTIN_IDS = /* @__PURE__ */ new Set(["balanced", "frugal", "deep", "archival"]);
 function createCustomModeStore(wrongstackDir) {
@@ -1093,7 +1089,7 @@ function createCustomModeStore(wrongstackDir) {
   const load2 = async () => {
     modes.clear();
     try {
-      const raw = await fs4.readFile(storePath(wrongstackDir), "utf8");
+      const raw = await fs.readFile(storePath(wrongstackDir), "utf8");
       const parsed = JSON.parse(raw);
       if (Array.isArray(parsed.modes)) {
         for (const m of parsed.modes) {
@@ -1198,6 +1194,23 @@ function createCustomModeStore(wrongstackDir) {
   };
   return { modes, load: load2, save: save2, create, update, remove, list };
 }
+
+// src/server/design-handlers.ts
+import * as fs2 from "node:fs/promises";
+import * as path3 from "node:path";
+import {
+  applyTokenOverrides,
+  getDesignKitLoader,
+  getDesignState,
+  isDesignStack,
+  loadActiveKit,
+  materializeTokens,
+  recordKitChoice,
+  recordOverrides,
+  runDesignVerify,
+  setActiveKit,
+  setDesignOverrides
+} from "@wrongstack/core";
 function readOverrides(value) {
   const out = {};
   if (value && typeof value === "object") {
@@ -1345,9 +1358,9 @@ async function handleDesignMaterialize(ws, ctx, msg) {
       kitId: active.kit,
       outPath: typeof payload.out === "string" ? payload.out : void 0
     });
-    const abs = path5.join(ctx.projectRoot, result.path);
-    await fs4.mkdir(path5.dirname(abs), { recursive: true });
-    await fs4.writeFile(abs, result.content);
+    const abs = path3.join(ctx.projectRoot, result.path);
+    await fs2.mkdir(path3.dirname(abs), { recursive: true });
+    await fs2.writeFile(abs, result.content);
     send(ws, {
       type: "design.materialize",
       payload: { ok: true, path: result.path, format: result.format, stack }
@@ -1406,6 +1419,11 @@ function createEternalSubscription(subscribe, broadcast2, clientsRef) {
   };
 }
 
+// src/server/file-handlers.ts
+import * as fs4 from "node:fs/promises";
+import * as path5 from "node:path";
+import { atomicWrite as atomicWrite2, ToolValidationError as ToolValidationError2 } from "@wrongstack/core";
+
 // src/server/file-picker.ts
 var SKIP_DIRS = /* @__PURE__ */ new Set([
   ".git",
@@ -1453,15 +1471,20 @@ function rankFiles(paths, query, limit) {
   scored.sort((a, b) => b.score - a.score || a.path.localeCompare(b.path));
   return scored.slice(0, limit).map((s) => s.path);
 }
+
+// src/server/path-containment.ts
+import * as fs3 from "node:fs/promises";
+import * as path4 from "node:path";
+import { ToolValidationError } from "@wrongstack/core";
 function isPathInside(root, target) {
-  const relative4 = path5.relative(root, target);
-  return relative4 === "" || !relative4.startsWith("..") && !path5.isAbsolute(relative4);
+  const relative4 = path4.relative(root, target);
+  return relative4 === "" || !relative4.startsWith("..") && !path4.isAbsolute(relative4);
 }
 async function resolveWorkingDirInsideProject(projectRoot, inputPath) {
-  const resolved = path5.resolve(projectRoot, inputPath);
+  const resolved = path4.resolve(projectRoot, inputPath);
   let stat2;
   try {
-    stat2 = await fs4.stat(resolved);
+    stat2 = await fs3.stat(resolved);
   } catch {
     throw new ToolValidationError({
       message: `Directory not found or not accessible: ${resolved}`,
@@ -1475,8 +1498,8 @@ async function resolveWorkingDirInsideProject(projectRoot, inputPath) {
     });
   }
   const [realProjectRoot, realResolved] = await Promise.all([
-    fs4.realpath(projectRoot),
-    fs4.realpath(resolved)
+    fs3.realpath(projectRoot),
+    fs3.realpath(resolved)
   ]);
   if (!isPathInside(realProjectRoot, realResolved)) {
     throw new ToolValidationError({
@@ -1491,14 +1514,14 @@ async function resolveWorkingDirInsideProject(projectRoot, inputPath) {
 async function resolveFileInsideProject(projectRoot, filePath) {
   const resolved = path5.resolve(projectRoot, filePath);
   if (!isPathInside(projectRoot, resolved)) {
-    throw new ToolValidationError({ message: "Path outside project root", field: "path" });
+    throw new ToolValidationError2({ message: "Path outside project root", field: "path" });
   }
   const { parent, base } = splitParentAndBase(resolved);
   const realProjectRoot = await fs4.realpath(projectRoot);
   const realParent = await realpathAllowMissing(parent);
   const realFull = path5.join(realParent, base);
   if (!isPathInside(realProjectRoot, realFull)) {
-    throw new ToolValidationError({ message: "Path outside project root", field: "path" });
+    throw new ToolValidationError2({ message: "Path outside project root", field: "path" });
   }
   return realFull;
 }
@@ -1518,7 +1541,7 @@ async function realpathAllowMissing(p) {
   while (true) {
     const parent = path5.dirname(cursor);
     if (parent === cursor) {
-      throw new ToolValidationError({ message: "Path outside project root", field: "path" });
+      throw new ToolValidationError2({ message: "Path outside project root", field: "path" });
     }
     segments.unshift(path5.basename(cursor));
     try {
@@ -1651,7 +1674,7 @@ async function handleFilesWrite(ws, msg, projectRoot, opts = {}) {
     return;
   }
   try {
-    await atomicWrite(realResolved, content);
+    await atomicWrite2(realResolved, content);
     send(ws, { type: "files.written", payload: { filePath, success: true } });
     if (opts.onWritten) {
       void Promise.resolve(opts.onWritten(realResolved)).catch(() => void 0);
@@ -1715,10 +1738,13 @@ async function handleFilesList(ws, msg, projectRoot) {
     payload: { files: rankFiles(results, payload.query ?? "", limit) }
   });
 }
+
+// src/server/git-handlers.ts
+import nodePath from "node:path";
 async function handleGitInfo(ws, projectRoot) {
   const cwd = projectRoot || void 0;
   try {
-    const { execFile: ef } = await import('child_process');
+    const { execFile: ef } = await import("node:child_process");
     const git = (args) => new Promise((resolve10) => {
       ef("git", args, { cwd, timeout: 3e3 }, (err, stdout) => {
         resolve10(err ? "" : stdout.trim());
@@ -1746,7 +1772,7 @@ async function handleGitInfo(ws, projectRoot) {
 }
 function makeGit(cwd) {
   return async (args) => {
-    const { execFile: ef } = await import('child_process');
+    const { execFile: ef } = await import("node:child_process");
     return new Promise((resolve10) => {
       ef(
         "git",
@@ -1776,15 +1802,15 @@ async function handleGitChanges(ws, projectRoot) {
         if (!m) continue;
         const added = m[1] === "-" ? 0 : Number(m[1]);
         const deleted = m[2] === "-" ? 0 : Number(m[2]);
-        let path23 = m[3] ?? "";
-        if (path23 === "") {
+        let path22 = m[3] ?? "";
+        if (path22 === "") {
           i += 1;
-          path23 = parts[i + 1] ?? parts[i] ?? "";
+          path22 = parts[i + 1] ?? parts[i] ?? "";
           i += 1;
         }
-        if (!path23) continue;
-        const prev = counts.get(path23) ?? { added: 0, deleted: 0 };
-        counts.set(path23, { added: prev.added + added, deleted: prev.deleted + deleted });
+        if (!path22) continue;
+        const prev = counts.get(path22) ?? { added: 0, deleted: 0 };
+        counts.set(path22, { added: prev.added + added, deleted: prev.deleted + deleted });
       }
     };
     parseNumstat(unstagedNumstat);
@@ -1796,7 +1822,7 @@ async function handleGitChanges(ws, projectRoot) {
       if (!rec || rec.length < 3) continue;
       const x = rec[0] ?? " ";
       const y = rec[1] ?? " ";
-      const path23 = rec.slice(3);
+      const path22 = rec.slice(3);
       const isRename = x === "R" || x === "C" || y === "R" || y === "C";
       if (isRename) i += 1;
       let status;
@@ -1808,13 +1834,13 @@ async function handleGitChanges(ws, projectRoot) {
       else if (x === "D" || y === "D") status = "D";
       else status = "M";
       const staged = x !== " " && x !== "?";
-      let added = counts.get(path23)?.added ?? 0;
-      let deleted = counts.get(path23)?.deleted ?? 0;
+      let added = counts.get(path22)?.added ?? 0;
+      let deleted = counts.get(path22)?.deleted ?? 0;
       if (status === "?") {
         added = 0;
         deleted = 0;
       }
-      files.push({ path: path23, status, added, deleted, staged });
+      files.push({ path: path22, status, added, deleted, staged });
     }
     send(ws, { type: "git.changes", payload: { files } });
   } catch (err) {
@@ -1825,21 +1851,21 @@ async function handleGitChanges(ws, projectRoot) {
   }
 }
 var MAX_DIFF_BYTES = 2 * 1024 * 1024;
-async function handleGitDiff(ws, projectRoot, path23) {
+async function handleGitDiff(ws, projectRoot, path22) {
   const cwd = projectRoot || void 0;
-  const reply = (extra) => send(ws, { type: "git.diff", payload: { path: path23, ...extra } });
-  if (!path23 || path23.includes("\0") || path23.includes("..") || path5__default.isAbsolute(path23)) {
+  const reply = (extra) => send(ws, { type: "git.diff", payload: { path: path22, ...extra } });
+  if (!path22 || path22.includes("\0") || path22.includes("..") || nodePath.isAbsolute(path22)) {
     reply({ oldText: "", newText: "", error: "invalid path" });
     return;
   }
   try {
     const git = makeGit(cwd);
-    const { readFile: readFile10 } = await import('fs/promises');
-    const { join: join15 } = await import('path');
-    const oldText = await git(["show", `HEAD:${path23}`]);
+    const { readFile: readFile10 } = await import("node:fs/promises");
+    const { join: join14 } = await import("node:path");
+    const oldText = await git(["show", `HEAD:${path22}`]);
     let newText = "";
     try {
-      const abs = cwd ? join15(cwd, path23) : path23;
+      const abs = cwd ? join14(cwd, path22) : path22;
       const buf = await readFile10(abs);
       if (buf.includes(0)) {
         reply({ oldText: "", newText: "", binary: true });
@@ -1867,6 +1893,11 @@ async function handleGitDiff(ws, projectRoot, path23) {
   }
 }
 
+// src/server/http-server.ts
+import * as fs5 from "node:fs/promises";
+import * as http from "node:http";
+import * as path6 from "node:path";
+
 // src/server/http-server/api-handlers.ts
 async function handleApiSessions(res, globalRoot) {
   if (!globalRoot) {
@@ -1875,7 +1906,7 @@ async function handleApiSessions(res, globalRoot) {
     return;
   }
   try {
-    const { SessionRegistry } = await import('@wrongstack/core');
+    const { SessionRegistry } = await import("@wrongstack/core");
     const registry = new SessionRegistry(globalRoot);
     const sessions = await registry.list();
     const result = sessions.map((s) => ({
@@ -1913,7 +1944,7 @@ async function handleApiSessionAgents(res, globalRoot, sessionId) {
     return;
   }
   try {
-    const { SessionRegistry } = await import('@wrongstack/core');
+    const { SessionRegistry } = await import("@wrongstack/core");
     const registry = new SessionRegistry(globalRoot);
     const entry = await registry.get(sessionId);
     if (!entry) {
@@ -2053,7 +2084,7 @@ async function handleApiSessionEvents(res, globalRoot, sessionId, limit) {
     return;
   }
   try {
-    const { SessionRegistry, resolveWstackPaths: resolveWstackPaths3, DefaultSessionStore: DefaultSessionStore2, DefaultSessionReader: DefaultSessionReader2 } = await import('@wrongstack/core');
+    const { SessionRegistry, resolveWstackPaths: resolveWstackPaths3, DefaultSessionStore: DefaultSessionStore2, DefaultSessionReader: DefaultSessionReader2 } = await import("@wrongstack/core");
     const registry = new SessionRegistry(globalRoot);
     const entry = await registry.get(sessionId);
     if (!entry) {
@@ -2135,7 +2166,7 @@ async function handleApiSessionMessage(res, req, globalRoot, sessionId) {
   const priority = ["low", "normal", "high"].includes(rawPriority) ? rawPriority : "high";
   const subject = typeof body["subject"] === "string" && body["subject"].trim() ? body["subject"].trim() : "Message from Fleet HQ";
   try {
-    const { SessionRegistry, resolveWstackPaths: resolveWstackPaths3, GlobalMailbox: GlobalMailbox4, mailboxSessionTag: mailboxSessionTag2 } = await import('@wrongstack/core');
+    const { SessionRegistry, resolveWstackPaths: resolveWstackPaths3, GlobalMailbox: GlobalMailbox4, mailboxSessionTag: mailboxSessionTag2 } = await import("@wrongstack/core");
     const registry = new SessionRegistry(globalRoot);
     const entry = await registry.get(sessionId);
     if (!entry) {
@@ -2161,7 +2192,7 @@ async function handleApiSessionMailbox(res, globalRoot, sessionId) {
     return;
   }
   try {
-    const { SessionRegistry, resolveWstackPaths: resolveWstackPaths3, GlobalMailbox: GlobalMailbox4, mailboxSessionTag: mailboxSessionTag2 } = await import('@wrongstack/core');
+    const { SessionRegistry, resolveWstackPaths: resolveWstackPaths3, GlobalMailbox: GlobalMailbox4, mailboxSessionTag: mailboxSessionTag2 } = await import("@wrongstack/core");
     const registry = new SessionRegistry(globalRoot);
     const entry = await registry.get(sessionId);
     if (!entry) {
@@ -2219,7 +2250,7 @@ async function handleApiSessionInterrupt(res, req, globalRoot, sessionId) {
   const reason = typeof body["reason"] === "string" && body["reason"].trim() ? body["reason"].trim() : "Operator requested stop from Fleet HQ";
   const from = typeof body["from"] === "string" && body["from"].trim() ? body["from"].trim() : "human@webui";
   try {
-    const { SessionRegistry, resolveWstackPaths: resolveWstackPaths3, GlobalMailbox: GlobalMailbox4, mailboxSessionTag: mailboxSessionTag2 } = await import('@wrongstack/core');
+    const { SessionRegistry, resolveWstackPaths: resolveWstackPaths3, GlobalMailbox: GlobalMailbox4, mailboxSessionTag: mailboxSessionTag2 } = await import("@wrongstack/core");
     const registry = new SessionRegistry(globalRoot);
     const entry = await registry.get(sessionId);
     if (!entry) {
@@ -2267,7 +2298,7 @@ async function handleApiFleetBroadcast(res, req, globalRoot) {
   }
   const from = typeof body["from"] === "string" && body["from"].trim() ? body["from"].trim() : "human@webui";
   try {
-    const { SessionRegistry, resolveWstackPaths: resolveWstackPaths3, GlobalMailbox: GlobalMailbox4, mailboxSessionTag: mailboxSessionTag2 } = await import('@wrongstack/core');
+    const { SessionRegistry, resolveWstackPaths: resolveWstackPaths3, GlobalMailbox: GlobalMailbox4, mailboxSessionTag: mailboxSessionTag2 } = await import("@wrongstack/core");
     const registry = new SessionRegistry(globalRoot);
     const all = await registry.list();
     const mySlug = all.find((s) => s.pid === process.pid)?.projectSlug;
@@ -2415,6 +2446,10 @@ async function handleApiAnalyticsSummary(res) {
     })
   );
 }
+
+// src/server/ws-auth.ts
+import { Buffer as Buffer2 } from "node:buffer";
+import { timingSafeEqual } from "node:crypto";
 function isLoopbackHostname(hostname) {
   return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1" || hostname === "[::1]";
 }
@@ -2443,8 +2478,8 @@ function allowedHostname(hostname, allowedHostnames) {
 }
 function tokenMatches(provided, expected) {
   if (!provided) return false;
-  const a = Buffer.from(provided);
-  const b = Buffer.from(expected);
+  const a = Buffer2.from(provided);
+  const b = Buffer2.from(expected);
   if (a.length !== b.length) return false;
   return timingSafeEqual(a, b);
 }
@@ -2600,9 +2635,9 @@ function buildCspHeader(wsPort, requestHost, publicWsUrl) {
   return `default-src 'self'; script-src ${scriptSrc}; style-src 'self' 'unsafe-inline'; connect-src ${Array.from(connect).join(" ")}; img-src 'self' data:; font-src 'self' data:; worker-src 'self' blob:; object-src 'none'; base-uri 'self'; frame-ancestors 'none'; form-action 'self'`;
 }
 function isInsideDist(candidate, distDir) {
-  const root = path5.resolve(distDir);
-  const resolved = path5.resolve(candidate);
-  return resolved === root || resolved.startsWith(root + path5.sep);
+  const root = path6.resolve(distDir);
+  const resolved = path6.resolve(candidate);
+  return resolved === root || resolved.startsWith(root + path6.sep);
 }
 function decodeSessionId(segment) {
   try {
@@ -2613,7 +2648,7 @@ function decodeSessionId(segment) {
 }
 function createHttpServer(opts) {
   const port = opts.port ?? Number.parseInt(process.env["PORT"] ?? "3456", 10);
-  const distDir = path5.resolve(opts.distDir);
+  const distDir = path6.resolve(opts.distDir);
   const wsPort = opts.wsPort;
   const requireAccessToken = Boolean(opts.requireToken) || !isLoopbackBind(opts.host);
   return http.createServer(async (req, res) => {
@@ -2790,21 +2825,21 @@ function createHttpServer(opts) {
       }
       let filePath;
       if (url.pathname === "/" || url.pathname === "") {
-        filePath = path5.join(distDir, "index.html");
+        filePath = path6.join(distDir, "index.html");
       } else if (url.pathname.startsWith("/assets/")) {
-        filePath = path5.join(distDir, url.pathname);
+        filePath = path6.join(distDir, url.pathname);
       } else if (url.pathname.startsWith("/")) {
-        filePath = path5.join(distDir, url.pathname);
+        filePath = path6.join(distDir, url.pathname);
       } else {
-        filePath = path5.join(distDir, "index.html");
+        filePath = path6.join(distDir, "index.html");
       }
-      const resolvedPath = path5.resolve(filePath);
+      const resolvedPath = path6.resolve(filePath);
       if (!isInsideDist(resolvedPath, distDir)) {
         res.writeHead(403, { "Content-Type": "text/plain" });
         res.end("Forbidden");
         return;
       }
-      const ext = path5.extname(resolvedPath);
+      const ext = path6.extname(resolvedPath);
       const contentType = MIME_TYPES[ext] ?? "application/octet-stream";
       res.setHeader("Content-Type", contentType);
       res.setHeader("X-Content-Type-Options", "nosniff");
@@ -2816,18 +2851,18 @@ function createHttpServer(opts) {
           "Content-Security-Policy",
           buildCspHeader(wsPort, requestHostForCsp(req.headers.host), opts.publicWsUrl)
         );
-        const html = await fs4.readFile(resolvedPath, "utf8");
+        const html = await fs5.readFile(resolvedPath, "utf8");
         res.writeHead(200);
         res.end(injectWsConfig(html, { wsPort, publicWsUrl: opts.publicWsUrl }));
         return;
       }
-      const fileContent = await fs4.readFile(resolvedPath);
+      const fileContent = await fs5.readFile(resolvedPath);
       res.writeHead(200);
       res.end(fileContent);
     } catch (err) {
       if (err.code === "ENOENT") {
         try {
-          const html = await fs4.readFile(path5.join(distDir, "index.html"), "utf8");
+          const html = await fs5.readFile(path6.join(distDir, "index.html"), "utf8");
           res.writeHead(200, {
             "Content-Type": "text/html",
             "X-Content-Type-Options": "nosniff",
@@ -2851,11 +2886,17 @@ function createHttpServer(opts) {
     }
   });
 }
+
+// src/server/instance-registry.ts
+import * as os from "node:os";
+import * as path7 from "node:path";
+import * as fs6 from "node:fs/promises";
+import { atomicWrite as atomicWrite3 } from "@wrongstack/core";
 function defaultBaseDir() {
-  return path5.join(os.homedir(), ".wrongstack");
+  return path7.join(os.homedir(), ".wrongstack");
 }
 function registryPath(baseDir = defaultBaseDir()) {
-  return path5.join(baseDir, "webui-instances.json");
+  return path7.join(baseDir, "webui-instances.json");
 }
 function isPidAlive(pid) {
   if (!Number.isInteger(pid) || pid <= 0) return false;
@@ -2868,7 +2909,7 @@ function isPidAlive(pid) {
 }
 async function load(file) {
   try {
-    const raw = await fs4.readFile(file, "utf8");
+    const raw = await fs6.readFile(file, "utf8");
     const parsed = JSON.parse(raw);
     if (parsed?.version === 1 && Array.isArray(parsed.instances)) {
       return parsed;
@@ -2878,7 +2919,7 @@ async function load(file) {
   return { version: 1, instances: [] };
 }
 async function save(file, instances) {
-  await atomicWrite(file, `${JSON.stringify({ version: 1, instances }, null, 2)}
+  await atomicWrite3(file, `${JSON.stringify({ version: 1, instances }, null, 2)}
 `, {
     mode: 384
   });
@@ -2923,6 +2964,19 @@ function formatInstances(instances) {
   }
   return lines.join("\n");
 }
+
+// src/server/mcp-handlers.ts
+import { allServers } from "@wrongstack/core";
+import {
+  addMcp,
+  disableMcp,
+  discoverMcp,
+  enableMcp,
+  listMcp,
+  removeMcp,
+  restartMcp,
+  updateMcp
+} from "@wrongstack/mcp";
 function mapStatus(raw) {
   switch (raw) {
     case "connected":
@@ -3160,6 +3214,9 @@ async function handleMemoryForget(ws, msg, memoryStore) {
     sendResult(ws, false, errMessage(err));
   }
 }
+
+// src/server/open-browser.ts
+import { spawn } from "node:child_process";
 function browserOpenCommand(url, platform = process.platform) {
   if (platform === "win32") {
     return { command: "cmd", args: ["/c", "start", "", url] };
@@ -3178,7 +3235,7 @@ function openBrowser(url, platform = process.platform) {
     child.unref();
     if (child.pid) {
       try {
-        import('@wrongstack/tools').then(({ getProcessRegistry }) => {
+        import("@wrongstack/tools").then(({ getProcessRegistry }) => {
           const pid = child.pid;
           if (pid === void 0) return;
           getProcessRegistry().register({
@@ -3200,6 +3257,10 @@ function openBrowser(url, platform = process.platform) {
   } catch {
   }
 }
+
+// src/server/port-utils.ts
+import * as net from "node:net";
+import { ToolValidationError as ToolValidationError3 } from "@wrongstack/core";
 function isPortFree(host, port) {
   return new Promise((resolve10) => {
     const srv = net.createServer();
@@ -3225,7 +3286,7 @@ async function findFreePort(host, startPort, opts = {}) {
     }
     port++;
   }
-  throw new ToolValidationError({
+  throw new ToolValidationError3({
     message: `No free port found near ${startPort} on ${host} after ${maxTries} attempts.`,
     field: "port"
   });
@@ -3435,10 +3496,15 @@ async function handlePromptsRecent(ws, ctx) {
     send(ws, { type: "prompts.recent", payload: { slugs: [], error: errMessage(err) } });
   }
 }
+
+// src/server/provider-config-io.ts
+import * as fs7 from "node:fs/promises";
+import { ConfigError, atomicWrite as atomicWrite4 } from "@wrongstack/core";
+import { decryptConfigSecrets, encryptConfigSecrets } from "@wrongstack/core/security";
 async function loadSavedProviders(configPath, vault) {
   let raw;
   try {
-    raw = await fs4.readFile(configPath, "utf8");
+    raw = await fs7.readFile(configPath, "utf8");
   } catch {
     return {};
   }
@@ -3455,7 +3521,7 @@ async function saveProviders(configPath, vault, providers) {
   let raw;
   let fileExists = true;
   try {
-    raw = await fs4.readFile(configPath, "utf8");
+    raw = await fs7.readFile(configPath, "utf8");
   } catch (err) {
     if (err.code !== "ENOENT") {
       throw new ConfigError({
@@ -3484,8 +3550,11 @@ async function saveProviders(configPath, vault, providers) {
   }
   parsed.providers = providers;
   const encrypted = encryptConfigSecrets(parsed, vault);
-  await atomicWrite(configPath, JSON.stringify(encrypted, null, 2), { mode: 384 });
+  await atomicWrite4(configPath, JSON.stringify(encrypted, null, 2), { mode: 384 });
 }
+
+// src/server/provider-keys.ts
+import { expectDefined } from "@wrongstack/core";
 function normalizeKeys(cfg) {
   if (Array.isArray(cfg.apiKeys) && cfg.apiKeys.length > 0) {
     return cfg.apiKeys.map((k) => ({ ...k }));
@@ -3579,6 +3648,12 @@ function removeProvider(providers, providerId) {
   delete providers[providerId];
   return { ok: true, message: `Provider "${providerId}" removed` };
 }
+
+// src/server/sdd-board-ws-handler.ts
+import {
+  applySddLifecycle,
+  SddBoardStore
+} from "@wrongstack/sdd";
 var CONTROL_TYPES = /* @__PURE__ */ new Set([
   "pause",
   "resume",
@@ -3723,6 +3798,26 @@ var SddBoardWebSocketHandler = class {
     if (client.ws.readyState === 1) client.ws.send(JSON.stringify(msg));
   }
 };
+
+// src/server/sdd-wizard-wiring.ts
+import * as path8 from "node:path";
+import { spawnSync as spawnSync2 } from "node:child_process";
+import {
+  WorktreeManager as WorktreeManager2,
+  ToolValidationError as ToolValidationError4
+} from "@wrongstack/core";
+import {
+  cleanupStaleSddWorktrees,
+  makeCommandVerifier,
+  makeLlmSubtaskGenerator,
+  SddBoardStore as SddBoardStore2,
+  SddInterviewDriver,
+  SddRunRegistry,
+  SddSupervisor,
+  SpecStore,
+  startSddRun,
+  TaskGraphStore
+} from "@wrongstack/sdd";
 var PLANNING_ONLY_GUARD = "SYSTEM: You are running a PLANNING-ONLY specification interview. Do NOT write, create, or edit any files, and do NOT run shell/terminal commands or use any code-editing tools \u2014 they are disabled here and any attempt will fail and waste the turn. Respond with TEXT ONLY: ask your question, or emit the requested spec / plan / task JSON. All code is written later, automatically, once the plan is approved and the multi-agent run starts.\n\n---\n\n";
 function buildSddWizardDeps(opts) {
   const registry = new SddRunRegistry();
@@ -3746,14 +3841,14 @@ function buildSddWizardDeps(opts) {
     makeDriver: () => new SddInterviewDriver({
       specStore: new SpecStore({ baseDir: opts.paths.projectSpecs }),
       graphStore: new TaskGraphStore({ baseDir: opts.paths.projectTaskGraphs }),
-      sessionPath: path5.join(opts.paths.projectDir, "sdd-wizard-session.json")
+      sessionPath: path8.join(opts.paths.projectDir, "sdd-wizard-session.json")
     }),
     runInterviewTurn: (prompt) => runIsolatedTurn(prompt, "Spec Architect"),
     startRun: async (driver, { parallelSlots, defaultModel, defaultProvider, fallbackModels, worktrees: useWorktrees }) => {
       const graph = driver.getGraph();
       const tracker = driver.getTracker();
       if (!graph || !tracker) {
-        throw new ToolValidationError({
+        throw new ToolValidationError4({
           message: "No task graph to run \u2014 finish the interview first.",
           field: "taskGraph"
         });
@@ -3761,7 +3856,7 @@ function buildSddWizardDeps(opts) {
       const worktreesEnabled = useWorktrees ?? process.env["WRONGSTACK_SDD_WORKTREES"] !== "0";
       let worktrees;
       if (worktreesEnabled) {
-        const inGit = spawnSync("git", ["rev-parse", "--is-inside-work-tree"], {
+        const inGit = spawnSync2("git", ["rev-parse", "--is-inside-work-tree"], {
           cwd: opts.projectRoot,
           encoding: "utf8",
           windowsHide: true
@@ -3771,14 +3866,14 @@ function buildSddWizardDeps(opts) {
             projectRoot: opts.projectRoot,
             boardsDir: opts.paths.projectSddBoards
           }).catch(() => void 0);
-          worktrees = new WorktreeManager({
+          worktrees = new WorktreeManager2({
             projectRoot: opts.projectRoot,
             events: opts.events,
             sessionId: () => opts.agent.ctx.session?.id
           });
         }
       }
-      const boardStore = new SddBoardStore({ baseDir: opts.paths.projectSddBoards });
+      const boardStore = new SddBoardStore2({ baseDir: opts.paths.projectSddBoards });
       const verifyTask = makeCommandVerifier();
       const superviseFailure = opts.brain ? new SddSupervisor({
         brain: opts.brain,
@@ -3958,20 +4053,25 @@ var SddWizardWebSocketHandler = class {
     if (client.ws.readyState === 1) client.ws.send(JSON.stringify(msg));
   }
 };
+
+// src/server/shell-open.ts
+import * as fs8 from "node:fs/promises";
+import * as path9 from "node:path";
+import { spawn as spawn2 } from "node:child_process";
 var METACHAR_REGEX = /[&|<>^"'`'\n\r]/;
 function shellQuote(s) {
   return s.replaceAll("'", `'"'"'`);
 }
 async function handleShellOpen(req, logger) {
   try {
-    const resolved = path5.resolve(req.path);
-    await fs4.access(resolved);
+    const resolved = path9.resolve(req.path);
+    await fs8.access(resolved);
     if (METACHAR_REGEX.test(resolved)) {
       return { success: false, message: "Path contains unsupported characters." };
     }
     const platform = process.platform;
     const launch = (cmd, args, onError) => {
-      const child = spawn(cmd, args, {
+      const child = spawn2(cmd, args, {
         detached: true,
         stdio: "ignore",
         windowsHide: true
@@ -4015,6 +4115,12 @@ async function handleShellOpen(req, logger) {
   }
 }
 
+// src/server/skills-handlers.ts
+import { promises as fs9 } from "node:fs";
+import path10 from "node:path";
+import { atomicWrite as atomicWrite5 } from "@wrongstack/core";
+import { wstackGlobalRoot } from "@wrongstack/core/utils";
+
 // src/server/ws-payload-validation.ts
 function isRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -4235,34 +4341,34 @@ var ENUM_PREF_KEYS = {
   reasoningEffort: REASONING_EFFORT_VALUES,
   cacheTtl: CACHE_TTL_VALUES
 };
-function validateModelRuntimeValue(modelRuntime, path23) {
+function validateModelRuntimeValue(modelRuntime, path22) {
   const reasoning = modelRuntime["reasoning"];
   if (reasoning !== void 0) {
-    if (!isRecord(reasoning)) return `${path23}.reasoning must be an object when provided`;
+    if (!isRecord(reasoning)) return `${path22}.reasoning must be an object when provided`;
     const mode = reasoning["mode"];
     const effort = reasoning["effort"];
     const preserve = reasoning["preserve"];
     if (mode !== void 0 && (typeof mode !== "string" || !REASONING_MODE_VALUES.has(mode))) {
-      return `${path23}.reasoning.mode must be one of: ${Array.from(REASONING_MODE_VALUES).join(", ")}`;
+      return `${path22}.reasoning.mode must be one of: ${Array.from(REASONING_MODE_VALUES).join(", ")}`;
     }
     if (effort !== void 0 && (typeof effort !== "string" || !REASONING_EFFORT_VALUES.has(effort))) {
-      return `${path23}.reasoning.effort must be one of: ${Array.from(REASONING_EFFORT_VALUES).join(", ")}`;
+      return `${path22}.reasoning.effort must be one of: ${Array.from(REASONING_EFFORT_VALUES).join(", ")}`;
     }
     if (preserve !== void 0 && typeof preserve !== "boolean") {
-      return `${path23}.reasoning.preserve must be a boolean when provided`;
+      return `${path22}.reasoning.preserve must be a boolean when provided`;
     }
   }
   const cache = modelRuntime["cache"];
   if (cache !== void 0) {
-    if (!isRecord(cache)) return `${path23}.cache must be an object when provided`;
+    if (!isRecord(cache)) return `${path22}.cache must be an object when provided`;
     const ttl = cache["ttl"];
     if (ttl !== void 0 && (typeof ttl !== "string" || !CACHE_TTL_VALUES.has(ttl) || ttl === "default")) {
-      return `${path23}.cache.ttl must be one of: 5m, 1h`;
+      return `${path22}.cache.ttl must be one of: 5m, 1h`;
     }
   }
   const parameters = modelRuntime["parameters"];
   if (parameters !== void 0 && !isRecord(parameters)) {
-    return `${path23}.parameters must be an object when provided`;
+    return `${path22}.parameters must be an object when provided`;
   }
   return null;
 }
@@ -4542,8 +4648,8 @@ function validateShellOpenPayload(payload) {
   if (!isRecord(payload)) {
     return { ok: false, message: "shell.open payload must be an object with string path" };
   }
-  const path23 = payload["path"];
-  if (typeof path23 !== "string" || path23.trim().length === 0) {
+  const path22 = payload["path"];
+  if (typeof path22 !== "string" || path22.trim().length === 0) {
     return { ok: false, message: "shell.open payload.path must be a non-empty string" };
   }
   const target = payload["target"];
@@ -4556,7 +4662,7 @@ function validateShellOpenPayload(payload) {
   return {
     ok: true,
     value: {
-      path: path23,
+      path: path22,
       ...target !== void 0 ? { target } : {}
     }
   };
@@ -4565,14 +4671,89 @@ function validateGitDiffPayload(payload) {
   if (!isRecord(payload)) {
     return { ok: false, message: "git.diff payload must be an object" };
   }
-  const path23 = payload["path"];
-  if (path23 === void 0 || path23 === null) {
+  const path22 = payload["path"];
+  if (path22 === void 0 || path22 === null) {
     return { ok: true, value: { path: "" } };
   }
-  if (typeof path23 !== "string") {
+  if (typeof path22 !== "string") {
     return { ok: false, message: "git.diff payload.path must be a string when provided" };
   }
-  return { ok: true, value: { path: path23 } };
+  return { ok: true, value: { path: path22 } };
+}
+
+// src/server/zip.ts
+import { deflateRawSync, inflateRawSync } from "node:zlib";
+function createZipBuffer(entries) {
+  const localParts = [];
+  const centralParts = [];
+  let offset = 0;
+  const { date, time } = dosDateTime(/* @__PURE__ */ new Date());
+  for (const entry of entries) {
+    const name2 = Buffer.from(normalizeZipPath(entry.name), "utf8");
+    const data = typeof entry.data === "string" ? Buffer.from(entry.data, "utf8") : Buffer.from(entry.data);
+    const compressed = deflateRawSync(data);
+    const crc = crc32(data);
+    const local = Buffer.alloc(30);
+    local.writeUInt32LE(67324752, 0);
+    local.writeUInt16LE(20, 4);
+    local.writeUInt16LE(2048, 6);
+    local.writeUInt16LE(8, 8);
+    local.writeUInt16LE(time, 10);
+    local.writeUInt16LE(date, 12);
+    local.writeUInt32LE(crc, 14);
+    local.writeUInt32LE(compressed.length, 18);
+    local.writeUInt32LE(data.length, 22);
+    local.writeUInt16LE(name2.length, 26);
+    localParts.push(local, name2, compressed);
+    const central = Buffer.alloc(46);
+    central.writeUInt32LE(33639248, 0);
+    central.writeUInt16LE(798, 4);
+    central.writeUInt16LE(20, 6);
+    central.writeUInt16LE(2048, 8);
+    central.writeUInt16LE(8, 10);
+    central.writeUInt16LE(time, 12);
+    central.writeUInt16LE(date, 14);
+    central.writeUInt32LE(crc, 16);
+    central.writeUInt32LE(compressed.length, 20);
+    central.writeUInt32LE(data.length, 24);
+    central.writeUInt16LE(name2.length, 28);
+    central.writeUInt32LE(offset, 42);
+    centralParts.push(central, name2);
+    offset += local.length + name2.length + compressed.length;
+  }
+  const centralDirectory = Buffer.concat(centralParts);
+  const end = Buffer.alloc(22);
+  end.writeUInt32LE(101010256, 0);
+  end.writeUInt16LE(entries.length, 8);
+  end.writeUInt16LE(entries.length, 10);
+  end.writeUInt32LE(centralDirectory.length, 12);
+  end.writeUInt32LE(offset, 16);
+  return Buffer.concat([...localParts, centralDirectory, end]);
+}
+function normalizeZipPath(value) {
+  const normalized = value.replace(/\\/g, "/").replace(/^\/+/, "");
+  if (!isSafeZipPath(normalized)) throw new Error(`Unsafe ZIP entry path: ${value}`);
+  return normalized;
+}
+function isSafeZipPath(value) {
+  return value.length > 0 && !value.includes("\0") && !value.startsWith("/") && !/^[a-z]:/i.test(value) && !value.split("/").includes("..");
+}
+function dosDateTime(value) {
+  const year = Math.max(1980, Math.min(2107, value.getFullYear()));
+  return {
+    date: year - 1980 << 9 | value.getMonth() + 1 << 5 | value.getDate(),
+    time: value.getHours() << 11 | value.getMinutes() << 5 | Math.floor(value.getSeconds() / 2)
+  };
+}
+var CRC_TABLE = Array.from({ length: 256 }, (_, index) => {
+  let crc = index;
+  for (let bit = 0; bit < 8; bit++) crc = (crc & 1) !== 0 ? 3988292384 ^ crc >>> 1 : crc >>> 1;
+  return crc >>> 0;
+});
+function crc32(data) {
+  let crc = 4294967295;
+  for (const byte of data) crc = crc >>> 8 ^ (CRC_TABLE[(crc ^ byte) & 255] ?? 0);
+  return (crc ^ 4294967295) >>> 0;
 }
 
 // src/server/skills-handlers.ts
@@ -4643,19 +4824,19 @@ async function handleSkillsContent(ws, ctx, msg) {
       send(ws, { type: "skills.content", payload: { name: name2, body: "", path: "", source, relatedFiles: [], references: [], error: `Skill "${name2}" not found` } });
       return;
     }
-    const body = await promises.readFile(entry.path, "utf8");
-    const skillDir = path5__default.dirname(entry.path);
+    const body = await fs9.readFile(entry.path, "utf8");
+    const skillDir = path10.dirname(entry.path);
     let relatedFiles = [];
     try {
-      const files = await promises.readdir(skillDir);
-      relatedFiles = files.filter((f) => f !== path5__default.basename(entry.path)).map((f) => path5__default.join(skillDir, f));
+      const files = await fs9.readdir(skillDir);
+      relatedFiles = files.filter((f) => f !== path10.basename(entry.path)).map((f) => path10.join(skillDir, f));
     } catch {
     }
     const nameLower = name2.toLowerCase();
     const refResults = await Promise.all(
       entries.filter((e) => e.name.toLowerCase() !== nameLower).map(async (e) => {
         try {
-          const content = await promises.readFile(e.path, "utf8");
+          const content = await fs9.readFile(e.path, "utf8");
           return [e.name, content.toLowerCase().includes(nameLower)];
         } catch {
           return [e.name, false];
@@ -4745,20 +4926,20 @@ async function handleSkillsCreate(ws, ctx, msg) {
   }
   const createPayload = parsed.value;
   try {
-    const targetDir = createPayload.scope === "global" ? path5__default.join(
-      ctx.globalSkillsDir ?? path5__default.join(wstackGlobalRoot$1(), "skills"),
+    const targetDir = createPayload.scope === "global" ? path10.join(
+      ctx.globalSkillsDir ?? path10.join(wstackGlobalRoot(), "skills"),
       createPayload.name.trim()
-    ) : path5__default.join(
-      ctx.projectSkillsDir ?? path5__default.join(ctx.projectRoot, ".wrongstack", "skills"),
+    ) : path10.join(
+      ctx.projectSkillsDir ?? path10.join(ctx.projectRoot, ".wrongstack", "skills"),
       createPayload.name.trim()
     );
     try {
-      await promises.access(targetDir);
+      await fs9.access(targetDir);
       send(ws, { type: "skills.created", payload: { success: false, error: `Skill "${createPayload.name}" already exists` } });
       return;
     } catch {
     }
-    await promises.mkdir(targetDir, { recursive: true });
+    await fs9.mkdir(targetDir, { recursive: true });
     const lines = createPayload.description.trim().split("\n");
     const firstLine = (lines[0] ?? "").trim();
     const bodyLines = lines.slice(1).map((l) => l.trim()).filter(Boolean);
@@ -4806,13 +4987,13 @@ ${trigger}
       "- `bug-hunter` \u2014 for systematic bug detection patterns",
       "- `output-standards` \u2014 for standardized `<nextsteps>` formatting"
     ].join("\n");
-    await atomicWrite(path5__default.join(targetDir, "SKILL.md"), skillContent);
+    await atomicWrite5(path10.join(targetDir, "SKILL.md"), skillContent);
     send(ws, {
       type: "skills.created",
       payload: {
         success: true,
         error: null,
-        skill: { name: createPayload.name.trim(), path: path5__default.join(targetDir, "SKILL.md"), scope: createPayload.scope }
+        skill: { name: createPayload.name.trim(), path: path10.join(targetDir, "SKILL.md"), scope: createPayload.scope }
       }
     });
   } catch (err) {
@@ -4842,7 +5023,7 @@ async function handleSkillsEdit(ws, ctx, msg) {
       send(ws, { type: "skills.edited", payload: { success: false, error: `${label} skills cannot be edited` } });
       return;
     }
-    await atomicWrite(entry.path, editPayload.body);
+    await atomicWrite5(entry.path, editPayload.body);
     send(ws, { type: "skills.edited", payload: { success: true, error: null } });
   } catch (err) {
     send(ws, { type: "skills.edited", payload: { success: false, error: errMessage(err) } });
@@ -4855,29 +5036,35 @@ async function handleSkillsExport(ws, ctx) {
   }
   try {
     const entries = await ctx.skillLoader.listEntries();
-    const zip = new JSZip();
+    const zipEntries = [];
     for (const entry of entries) {
       try {
         const body = await ctx.skillLoader.readBody(entry.name);
         const safeName = entry.name.replace(/\//g, "_");
-        zip.file(`${safeName}/SKILL.md`, body);
+        zipEntries.push({ name: `${safeName}/SKILL.md`, data: body });
       } catch {
       }
     }
-    const zipBuffer = await zip.generateAsync({ type: "nodebuffer", compression: "DEFLATE" });
+    const zipBuffer = createZipBuffer(zipEntries);
     const zipBase64 = zipBuffer.toString("base64");
     send(ws, { type: "skills.exported", payload: { zipBase64, skillCount: entries.length, error: void 0 } });
   } catch (err) {
     send(ws, { type: "skills.exported", payload: { zipBase64: "", skillCount: 0, error: errMessage(err) } });
   }
 }
+
+// src/server/specs-ws-handler.ts
+import {
+  computeTaskProgress
+} from "@wrongstack/core";
+import { SpecStore as SpecStore2, TaskGraphStore as TaskGraphStore2 } from "@wrongstack/sdd";
 var SpecsWebSocketHandler = class {
   specStore;
   graphStore;
   clients = /* @__PURE__ */ new Set();
   constructor(specsDir, taskGraphsDir) {
-    this.specStore = new SpecStore({ baseDir: specsDir });
-    this.graphStore = new TaskGraphStore({ baseDir: taskGraphsDir });
+    this.specStore = new SpecStore2({ baseDir: specsDir });
+    this.graphStore = new TaskGraphStore2({ baseDir: taskGraphsDir });
   }
   addClient(ws) {
     const client = { ws, id: crypto.randomUUID() };
@@ -5081,6 +5268,13 @@ function estimateContextBreakdown(input) {
     messages: { total: msgTokens, count: input.messages.length, breakdown: messageBreakdown }
   };
 }
+
+// src/server/worktree-ws-handler.ts
+import { join as join7, resolve as resolve6, sep as sep3 } from "node:path";
+import { WorktreeManager as WorktreeManager3 } from "@wrongstack/core";
+import { cleanupStaleSddWorktrees as cleanupStaleSddWorktrees2 } from "@wrongstack/sdd";
+import { toErrorMessage as toErrorMessage2 } from "@wrongstack/core/utils";
+var MAX_ACTIVITY = 6;
 var ACTIVE_STATUSES = /* @__PURE__ */ new Set(["allocating", "active", "committing", "merging"]);
 var MANAGED_BRANCH_RE = /^wstack\/ap\/[A-Za-z0-9._/-]+$/;
 var WorktreeWebSocketHandler = class {
@@ -5137,13 +5331,13 @@ var WorktreeWebSocketHandler = class {
   // ── orphan management ─────────────────────────────────────────────────────
   /** Absolute managed-worktrees root for this project. */
   worktreesRoot() {
-    return resolve(join(this.management.projectRoot, ".wrongstack", "worktrees"));
+    return resolve6(join7(this.management.projectRoot, ".wrongstack", "worktrees"));
   }
   /** True iff `dir` resolves strictly inside the managed worktrees root. */
   underRoot(dir) {
-    const abs = resolve(dir);
+    const abs = resolve6(dir);
     const root = this.worktreesRoot();
-    return abs !== root && abs.startsWith(root + sep);
+    return abs !== root && abs.startsWith(root + sep3);
   }
   /** Branches of worktrees a live in-session run currently owns. */
   liveActiveBranches() {
@@ -5164,7 +5358,7 @@ var WorktreeWebSocketHandler = class {
       return;
     }
     try {
-      const wt = new WorktreeManager({ projectRoot: this.management.projectRoot });
+      const wt = new WorktreeManager3({ projectRoot: this.management.projectRoot });
       const { worktrees, branches } = await wt.listManaged();
       const live = this.liveActiveBranches();
       const orphans = [];
@@ -5188,7 +5382,7 @@ var WorktreeWebSocketHandler = class {
         }
       });
     } catch (err) {
-      this.logger.debug?.(`worktree orphan scan failed: ${toErrorMessage(err)}`);
+      this.logger.debug?.(`worktree orphan scan failed: ${toErrorMessage2(err)}`);
       this.broadcast({ type: "worktree.orphans", payload: { orphans: [], canClean: false } });
     }
   }
@@ -5212,7 +5406,7 @@ var WorktreeWebSocketHandler = class {
       });
       return;
     }
-    const res = await cleanupStaleSddWorktrees({
+    const res = await cleanupStaleSddWorktrees2({
       projectRoot: this.management.projectRoot,
       boardsDir: this.management.boardsDir
     });
@@ -5251,7 +5445,7 @@ var WorktreeWebSocketHandler = class {
     }
     let removed = false;
     if (dir) {
-      const wt = new WorktreeManager({ projectRoot: this.management.projectRoot });
+      const wt = new WorktreeManager3({ projectRoot: this.management.projectRoot });
       ({ removed } = await wt.removeOne(dir, branch));
     }
     for (const [id, h] of [...this.handles]) {
@@ -5275,7 +5469,7 @@ var WorktreeWebSocketHandler = class {
       this.broadcast({ type: "worktree.merge_result", payload: { ok: false, branch, reason: "a run is live on this worktree \u2014 stop it first" } });
       return;
     }
-    const wt = new WorktreeManager({ projectRoot: this.management.projectRoot });
+    const wt = new WorktreeManager3({ projectRoot: this.management.projectRoot });
     const res = await wt.mergeBranch(branch);
     this.broadcast({
       type: "worktree.merge_result",
@@ -5290,8 +5484,8 @@ var WorktreeWebSocketHandler = class {
       return;
     }
     const base = baseBranch && MANAGED_BRANCH_RE.test(baseBranch) ? baseBranch : void 0;
-    const wt = new WorktreeManager({ projectRoot: this.management.projectRoot });
-    const summary = await wt.diffSummary(resolve(dir), base);
+    const wt = new WorktreeManager3({ projectRoot: this.management.projectRoot });
+    const summary = await wt.diffSummary(resolve6(dir), base);
     this.broadcast({ type: "worktree.diff_result", payload: { dir, summary } });
   }
   // ── internals ───────────────────────────────────────────────────────────
@@ -5363,7 +5557,7 @@ var WorktreeWebSocketHandler = class {
   activity(id, kind, text) {
     const cur = this.handles.get(id);
     if (cur) {
-      const recentActivity = [...cur.recentActivity, { kind, text, at: Date.now() }].slice(-6);
+      const recentActivity = [...cur.recentActivity, { kind, text, at: Date.now() }].slice(-MAX_ACTIVITY);
       this.handles.set(id, { ...cur, recentActivity });
     }
     this.broadcast({ type: "worktree.event", payload: { kind, handleId: id, text, at: Date.now() } });
@@ -5395,7 +5589,7 @@ var WorktreeWebSocketHandler = class {
       try {
         if (ws.readyState === 1) ws.send(data);
       } catch (err) {
-        this.logger.debug?.(`worktree broadcast failed: ${toErrorMessage(err)}`);
+        this.logger.debug?.(`worktree broadcast failed: ${toErrorMessage2(err)}`);
       }
     }
   }
@@ -5407,6 +5601,12 @@ var WorktreeWebSocketHandler = class {
   }
 };
 
+// src/server/server-runtime.ts
+import * as path12 from "node:path";
+import { createRequire } from "node:module";
+import { fileURLToPath } from "node:url";
+import { WebSocketServer } from "ws";
+
 // src/server/lifecycle.ts
 function createShutdown(res) {
   const log = res.log ?? ((m) => console.log(m));
@@ -5442,9 +5642,14 @@ function registerShutdownHandlers(res) {
     process.off("SIGTERM", shutdown);
   };
 }
+
+// src/server/setup-events.ts
+import * as fs10 from "node:fs/promises";
+import { watch as fsWatch } from "node:fs";
+import * as path11 from "node:path";
 function statusProjectHashFromWatchFilename(projectsDir, filename) {
   const raw = String(filename);
-  const relative4 = path5.isAbsolute(raw) ? path5.relative(projectsDir, raw) : raw;
+  const relative4 = path11.isAbsolute(raw) ? path11.relative(projectsDir, raw) : raw;
   const parts = relative4.split(/[\\/]+/).filter(Boolean);
   if (parts.length < 2) return null;
   if (parts[parts.length - 1] !== "status.json") return null;
@@ -5581,7 +5786,7 @@ function setupEvents(deps2) {
         try {
           const taskPath = context.meta["task.path"];
           if (typeof taskPath === "string" && taskPath) {
-            const { loadTasks } = await import('@wrongstack/core');
+            const { loadTasks } = await import("@wrongstack/core");
             const file = await loadTasks(taskPath);
             broadcast2(clients, { type: "tasks.updated", payload: sessionPayload2({ sessionId: e.sessionId, tasks: file?.tasks ?? [] }) });
           }
@@ -5590,7 +5795,7 @@ function setupEvents(deps2) {
         try {
           const planPath = context.meta["plan.path"];
           if (typeof planPath === "string" && planPath) {
-            const { loadPlan } = await import('@wrongstack/core');
+            const { loadPlan } = await import("@wrongstack/core");
             const plan = await loadPlan(planPath);
             broadcast2(clients, { type: "plan.updated", payload: sessionPayload2({ sessionId: e.sessionId, plan: plan ?? { version: 1, sessionId: e.sessionId ?? context.session?.id ?? "", updatedAt: (/* @__PURE__ */ new Date()).toISOString(), items: [] } }) });
           }
@@ -5887,6 +6092,7 @@ function setupEvents(deps2) {
   events.on("subagent.budget_extended", (e) => forwardSubagent("budget_extended", { sessionId: e.sessionId, subagentId: e.subagentId, budgetKind: e.kind, newLimit: e.newLimit, totalExtensions: e.totalExtensions }));
   events.on("subagent.ctx_pct", (e) => forwardSubagent("ctx_pct", { sessionId: e.sessionId, subagentId: e.subagentId, load: e.load, tokens: e.tokens, maxContext: e.maxContext }));
   events.on("subagent.task_completed", (e) => forwardSubagent("task_completed", { sessionId: e.sessionId, subagentId: e.subagentId, status: e.status, iterations: e.iterations, toolCalls: e.toolCalls, finalText: e.finalText, failureReason: e.error?.kind, error: e.error ? { kind: e.error.kind, message: e.error.message } : void 0 }));
+  events.on("subagent.removed", (e) => forwardSubagent("removed", { sessionId: e.sessionId, subagentId: e.subagentId, reason: e.reason }));
   events.on("agent.timeline.message", (e) => {
     broadcast2(clients, {
       type: "agent.timeline.message",
@@ -5984,14 +6190,20 @@ function setupEvents(deps2) {
       payload: sessionPayload2({ event: eventName, ...payload })
     });
   });
+  events.onPattern("memory.*", (eventName, payload) => {
+    broadcast2(clients, {
+      type: "memory.event",
+      payload: sessionPayload2({ event: eventName, ...payload })
+    });
+  });
   events.on("client.status", async (e) => {
     broadcast2(clients, { type: "client.status_update", payload: e });
     if (wpaths?.projectStatus) {
       try {
         const statusFile = wpaths.projectStatus(e.projectHash);
-        const dir = path5.dirname(statusFile);
-        await fs4.mkdir(dir, { recursive: true });
-        await fs4.writeFile(statusFile, JSON.stringify(e, null, 2), "utf-8");
+        const dir = path11.dirname(statusFile);
+        await fs10.mkdir(dir, { recursive: true });
+        await fs10.writeFile(statusFile, JSON.stringify(e, null, 2), "utf-8");
       } catch (err) {
         console.error(
           JSON.stringify({
@@ -6005,7 +6217,7 @@ function setupEvents(deps2) {
     }
   });
   if (wpaths?.projectStatus && wpaths.configDir) {
-    const projectsDir = path5.join(wpaths.configDir, "projects");
+    const projectsDir = path11.join(wpaths.configDir, "projects");
     const knownProjectHashes = /* @__PURE__ */ new Set();
     const debounceTimers = /* @__PURE__ */ new Map();
     const DEBOUNCE_MS = 150;
@@ -6069,8 +6281,8 @@ function setupEvents(deps2) {
     let watcher;
     const startWatcher = async () => {
       try {
-        await fs4.mkdir(projectsDir, { recursive: true });
-        watcher = watch(projectsDir, { persistent: true, recursive: true }, async (eventType, filename) => {
+        await fs10.mkdir(projectsDir, { recursive: true });
+        watcher = fsWatch(projectsDir, { persistent: true, recursive: true }, async (eventType, filename) => {
           if (eventType !== "change" && eventType !== "rename") return;
           if (filename == null) return;
           const projectHash = statusProjectHashFromWatchFilename(projectsDir, filename);
@@ -6079,8 +6291,8 @@ function setupEvents(deps2) {
           if (!knownProjectHashes.has(projectHash)) return;
           if (watcherMetrics) watcherMetrics.filesProcessed++;
           try {
-            const targetFile = path5.join(projectsDir, projectHash, "status.json");
-            const content = await fs4.readFile(targetFile, "utf-8");
+            const targetFile = path11.join(projectsDir, projectHash, "status.json");
+            const content = await fs10.readFile(targetFile, "utf-8");
             const statusData = JSON.parse(content);
             scheduleBroadcast(projectHash, statusData);
           } catch {
@@ -6132,11 +6344,11 @@ function setupEvents(deps2) {
       }
     });
   }
-  const globalRoot = globalConfigPath ? path5.dirname(globalConfigPath) : void 0;
+  const globalRoot = globalConfigPath ? path11.dirname(globalConfigPath) : void 0;
   if (globalRoot) {
     const broadcastSessions = async () => {
       try {
-        const { SessionRegistry } = await import('@wrongstack/core');
+        const { SessionRegistry } = await import("@wrongstack/core");
         const registry = new SessionRegistry(globalRoot);
         const sessions = await registry.list();
         const mySlug = sessions.find((s) => s.pid === process.pid)?.projectSlug;
@@ -6179,7 +6391,7 @@ function setupEvents(deps2) {
     disposers.push(() => clearInterval(statusInterval));
     let regDebounce;
     try {
-      const regWatcher = watch(globalRoot, { persistent: false }, (_event, filename) => {
+      const regWatcher = fsWatch(globalRoot, { persistent: false }, (_event, filename) => {
         const name2 = filename ? String(filename) : "";
         if (!name2.startsWith("session-registry.json") || name2.endsWith(".lock")) return;
         if (regDebounce) clearTimeout(regDebounce);
@@ -6215,6 +6427,9 @@ function getCostRates(model) {
 function computeUsageCost(usage, rates) {
   return (usage.input * rates.input + usage.output * rates.output + (usage.cacheRead ?? 0) * rates.cacheRead) / 1e6;
 }
+
+// src/server/model-catalog.ts
+import { capabilitiesFor } from "@wrongstack/providers";
 var SIBLING_CATALOG = {
   "anthropic-oauth": "anthropic",
   "openai-codex": "openai",
@@ -6321,6 +6536,9 @@ function readConfiguredBool(providerConfig, key) {
 function positiveNumber(value) {
   return typeof value === "number" && Number.isFinite(value) && value > 0 ? value : void 0;
 }
+
+// src/server/server-runtime.ts
+import { toErrorMessage as toErrorMessage3 } from "@wrongstack/core/utils";
 async function resolvePorts(opts) {
   const requestedWsPort = opts.wsPort ?? 3457;
   const wsHost = opts.wsHost ?? process.env["WEBUI_HOST"] ?? process.env["WS_HOST"] ?? "127.0.0.1";
@@ -6381,7 +6599,7 @@ function createSessionStartPayload(g) {
       inputCost,
       outputCost,
       cacheReadCost,
-      projectName: path5.basename(projectRoot) || projectRoot,
+      projectName: path12.basename(projectRoot) || projectRoot,
       projectRoot,
       cwd: g.getWorkingDir(),
       mode: g.getModeId(),
@@ -6419,13 +6637,26 @@ function createWsServers(ports, accessToken) {
     port: ports.wsPort,
     host: ports.wsHost,
     verifyClient: verifyClient2,
-    maxPayload: WS_MAX_PAYLOAD
+    maxPayload: WS_MAX_PAYLOAD,
+    // Send a ping every 15s to keep idle connections alive. Without this,
+    // network equipment (routers, proxies, NAT gateways) may drop idle TCP
+    // connections, causing the browser to see a close event and show the
+    // "reconnecting" banner. The browser responds with a pong automatically
+    // (the WebSocket API handles this at the transport level).
+    pingInterval: 15e3,
+    // Wait 5s for a pong before considering the connection dead. A client
+    // that hasn't responded to 3 consecutive pings in a row (45s total
+    // quiet) is almost certainly unreachable — close the socket so the
+    // client can reconnect cleanly rather than hanging indefinitely.
+    pingTimeout: 5e3
   });
   const wssSecondary = ports.wsHost === "127.0.0.1" ? new WebSocketServer({
     port: ports.wsPort,
     host: "::1",
     verifyClient: verifyClient2,
-    maxPayload: WS_MAX_PAYLOAD
+    maxPayload: WS_MAX_PAYLOAD,
+    pingInterval: 15e3,
+    pingTimeout: 5e3
   }) : null;
   const clients = /* @__PURE__ */ new Map();
   console.log(
@@ -6447,7 +6678,7 @@ function armEvents(wssPrimary, wssSecondary, wsHost, wsPort, setupInput, watcher
   };
   wssPrimary.on("listening", () => arm(`${wsHost}:${wsPort}`));
   wssPrimary.on("error", (err) => {
-    console.error(JSON.stringify({ level: "error", event: "webui.ws_server_error", host: wsHost, message: toErrorMessage(err), timestamp: (/* @__PURE__ */ new Date()).toISOString() }));
+    console.error(JSON.stringify({ level: "error", event: "webui.ws_server_error", host: wsHost, message: toErrorMessage3(err), timestamp: (/* @__PURE__ */ new Date()).toISOString() }));
   });
   if (wssSecondary) {
     wssSecondary.on("listening", () => arm(`::1:${wsPort}`));
@@ -6466,13 +6697,13 @@ function armEvents(wssPrimary, wssSecondary, wsHost, wsPort, setupInput, watcher
   };
 }
 function resolveWebuiDistDir(fromUrl, explicitDistDir) {
-  if (explicitDistDir) return path5.resolve(explicitDistDir);
+  if (explicitDistDir) return path12.resolve(explicitDistDir);
   try {
     const requireFromHere2 = createRequire(fromUrl);
     const serverEntry = requireFromHere2.resolve("@wrongstack/webui/server");
-    return path5.resolve(path5.dirname(serverEntry), "..");
+    return path12.resolve(path12.dirname(serverEntry), "..");
   } catch {
-    return path5.resolve(path5.dirname(fileURLToPath(fromUrl)), "..", "..", "dist");
+    return path12.resolve(path12.dirname(fileURLToPath(fromUrl)), "..", "..", "dist");
   }
 }
 function startHttpServer(opts) {
@@ -6487,13 +6718,13 @@ function startHttpServer(opts) {
     watcherMetrics: opts.watcherMetrics,
     onFleetPing: opts.onFleetPing
   });
-  const registryBaseDir = path5.dirname(opts.globalConfigPath);
+  const registryBaseDir = path12.dirname(opts.globalConfigPath);
   httpServer.listen(opts.httpPort, opts.wsHost, () => {
     const openUrl = buildWebUIAccessUrl({ host: opts.wsHost, port: opts.httpPort, token: opts.wsToken, publicUrl: opts.publicUrl });
     console.log(`[WebUI] HTTP server running on ${openUrl}`);
     if (opts.openBrowser) openBrowser(openUrl);
     void registerInstance(
-      { pid: process.pid, httpPort: opts.httpPort, wsPort: opts.wsPort, host: opts.wsHost, projectRoot: opts.projectRoot, projectName: path5.basename(opts.projectRoot) || opts.projectRoot, startedAt: (/* @__PURE__ */ new Date()).toISOString(), url: buildWebUIAccessUrl({ host: opts.wsHost, port: opts.httpPort, publicUrl: opts.publicUrl }) },
+      { pid: process.pid, httpPort: opts.httpPort, wsPort: opts.wsPort, host: opts.wsHost, projectRoot: opts.projectRoot, projectName: path12.basename(opts.projectRoot) || opts.projectRoot, startedAt: (/* @__PURE__ */ new Date()).toISOString(), url: buildWebUIAccessUrl({ host: opts.wsHost, port: opts.httpPort, publicUrl: opts.publicUrl }) },
       registryBaseDir
     ).catch((err) => console.warn(JSON.stringify({ level: "warn", event: "webui.instance_record_failed", message: errMessage(err), timestamp: (/* @__PURE__ */ new Date()).toISOString() })));
   });
@@ -6507,6 +6738,63 @@ function registerShutdown(deps2) {
     onShutdown: deps2.onShutdown
   });
 }
+
+// src/server/pre-context-services.ts
+import * as path14 from "node:path";
+import { createRequire as createRequire2 } from "node:module";
+import { WebSocket as WebSocket2 } from "ws";
+import { DefaultTokenCounter } from "@wrongstack/core/infrastructure";
+import {
+  AgentStatusTracker,
+  AnnotationsStore,
+  DEFAULT_SESSION_PRUNE_DAYS,
+  DefaultModelsRegistry,
+  DefaultModeStore,
+  DefaultPromptLoader,
+  DefaultSessionReader,
+  DefaultSessionStore,
+  DefaultSkillLoader,
+  DefaultSystemPromptBuilder,
+  EventBus,
+  FleetNotifier,
+  GlobalMailbox,
+  PromptUsageStore,
+  ProviderRegistry,
+  SkillInstaller,
+  TOKENS,
+  ToolRegistry,
+  Context,
+  applyToolDescriptionModes,
+  applyToolResultRenderModes,
+  configureChildEnvGitIdentity,
+  resolveContextWindowPolicy,
+  getSessionRegistry,
+  makeMailboxTool,
+  makeMailInboxTool,
+  makeFleetStatusTool,
+  makeMailSendTool
+} from "@wrongstack/core";
+import {
+  createSuperMemoryTools
+} from "@wrongstack/super-memory";
+import { MCPRegistry } from "@wrongstack/mcp";
+import { buildProviderFactoriesFromRegistry } from "@wrongstack/providers";
+import { createDefaultContainer } from "@wrongstack/runtime";
+import {
+  builtinToolsPack,
+  configureDangerBypass,
+  configureExecPolicy,
+  forgetTool,
+  relatedMemoryTool,
+  rememberTool,
+  searchMemoryTool
+} from "@wrongstack/tools";
+import { toErrorMessage as toErrorMessage5 } from "@wrongstack/core/utils";
+
+// src/server/setup-screen.ts
+import { expectDefined as expectDefined2 } from "@wrongstack/core";
+import { toErrorMessage as toErrorMessage4 } from "@wrongstack/core/utils";
+import { makeProviderFromConfig } from "@wrongstack/providers";
 var UNCONFIGURED_CAPABILITIES = {
   tools: false,
   parallelTools: false,
@@ -6546,7 +6834,7 @@ function logCreateFailure(event, err) {
     JSON.stringify({
       level: "error",
       event,
-      message: toErrorMessage(err),
+      message: toErrorMessage4(err),
       timestamp: (/* @__PURE__ */ new Date()).toISOString()
     })
   );
@@ -6571,7 +6859,7 @@ function resolveSetupProvider(opts) {
   const savedProviders = config.providers ?? {};
   const firstKey = Object.keys(savedProviders)[0];
   if (firstKey) {
-    const firstProvider = expectDefined(savedProviders[firstKey]);
+    const firstProvider = expectDefined2(savedProviders[firstKey]);
     try {
       const provider2 = makeProviderFromConfig(firstKey, {
         ...firstProvider,
@@ -6651,6 +6939,11 @@ function seedContextMeta(config, context) {
   const tgMs = tgExt?.["longToolThresholdMs"];
   meta["tgLongToolMs"] = typeof tgMs === "number" ? tgMs : 3e4;
 }
+
+// src/server/model-auto-discovery.ts
+import * as fs11 from "node:fs/promises";
+import * as path13 from "node:path";
+import { COMPATIBLE_PRESETS, discoverOpenAICompatibleModels } from "@wrongstack/providers";
 function isOverlayRegistry(value) {
   return !!value && typeof value === "object" && typeof value.mergeOverlay === "function";
 }
@@ -6675,7 +6968,7 @@ function eligibleProviders(config) {
 }
 async function readCache(file) {
   try {
-    return JSON.parse(await fs4.readFile(file, "utf8"));
+    return JSON.parse(await fs11.readFile(file, "utf8"));
   } catch {
     return {};
   }
@@ -6685,7 +6978,7 @@ async function discoverAndMergeWebuiProviders(opts) {
   if (!isOverlayRegistry(registry)) return;
   const targets = eligibleProviders(opts.config);
   if (targets.length === 0) return;
-  const cacheFile = path5.join(opts.cacheDir, "discovered-models-cache.json");
+  const cacheFile = path13.join(opts.cacheDir, "discovered-models-cache.json");
   const cache = await readCache(cacheFile);
   let cacheDirty = false;
   await Promise.all(
@@ -6722,8 +7015,8 @@ async function discoverAndMergeWebuiProviders(opts) {
   );
   if (cacheDirty) {
     try {
-      await fs4.mkdir(path5.dirname(cacheFile), { recursive: true });
-      await fs4.writeFile(cacheFile, JSON.stringify(cache), "utf8");
+      await fs11.mkdir(path13.dirname(cacheFile), { recursive: true });
+      await fs11.writeFile(cacheFile, JSON.stringify(cache), "utf8");
     } catch {
       opts.logger?.debug?.("provider auto-discovery cache write failed");
     }
@@ -6745,20 +7038,22 @@ async function createPreContextServices(input) {
       await modelsRegistry.refresh();
       logger.info("models.dev catalog refreshed");
     } catch (err) {
-      logger.warn(`models.dev refresh failed (${toErrorMessage(err)}); using cached catalog`);
+      logger.warn(`models.dev refresh failed (${toErrorMessage5(err)}); using cached catalog`);
     }
   }
   try {
     await discoverAndMergeWebuiProviders({
       config,
       registry: modelsRegistry,
-      cacheDir: path5.dirname(wpaths.modelsCache),
+      cacheDir: path14.dirname(wpaths.modelsCache),
       logger
     });
   } catch (err) {
-    logger.debug(`provider auto-discovery skipped: ${toErrorMessage(err)}`);
+    logger.debug(`provider auto-discovery skipped: ${toErrorMessage5(err)}`);
   }
-  const container = createDefaultContainer({ config, wpaths, logger, modelsRegistry });
+  const events = opts.services?.events ?? new EventBus();
+  events.setLogger(logger);
+  const container = createDefaultContainer({ config, wpaths, logger, modelsRegistry, events });
   const configStore = opts.services?.configStore ?? container.resolve(TOKENS.ConfigStore);
   const providerRegistry = new ProviderRegistry();
   try {
@@ -6766,22 +7061,23 @@ async function createPreContextServices(input) {
     for (const f of factories) providerRegistry.register(f);
     console.log("[WebUI] Provider registry loaded:", providerRegistry.list().length, "providers");
   } catch (err) {
-    console.warn(JSON.stringify({ level: "warn", event: "webui.provider_registry_load_failed", message: toErrorMessage(err), timestamp: (/* @__PURE__ */ new Date()).toISOString() }));
+    console.warn(JSON.stringify({ level: "warn", event: "webui.provider_registry_load_failed", message: toErrorMessage5(err), timestamp: (/* @__PURE__ */ new Date()).toISOString() }));
   }
   const toolRegistry = opts.services?.toolRegistry ?? (() => {
     const r = new ToolRegistry();
     r.registerAllOrThrow([...builtinToolsPack.tools ?? []], builtinToolsPack.name);
     return r;
   })();
-  const memoryStore = new DefaultMemoryStore({ paths: wpaths });
+  const memoryStore = container.resolve(TOKENS.MemoryStore);
   if (config.features.memory) {
     toolRegistry.register(rememberTool(memoryStore));
     toolRegistry.register(forgetTool(memoryStore));
     toolRegistry.register(searchMemoryTool(memoryStore));
     toolRegistry.register(relatedMemoryTool(memoryStore));
+    if (isSuperMemoryService(memoryStore)) {
+      for (const tool of createSuperMemoryTools(memoryStore)) toolRegistry.register(tool);
+    }
   }
-  const events = opts.services?.events ?? new EventBus();
-  events.setLogger(logger);
   toolRegistry.register(makeMailboxTool({ projectDir: wpaths.projectDir, events }));
   toolRegistry.register(makeMailSendTool({ projectDir: wpaths.projectDir, events }));
   toolRegistry.register(makeMailInboxTool({ projectDir: wpaths.projectDir, events }));
@@ -6790,6 +7086,7 @@ async function createPreContextServices(input) {
   applyToolResultRenderModes(toolRegistry, config.tools?.resultRenderMode);
   configureExecPolicy(config.tools?.exec ?? {});
   configureDangerBypass(config.tools?.exec?.danger ?? {});
+  configureChildEnvGitIdentity(config.git?.identity ?? null);
   console.log("[WebUI] Tool registry loaded:", toolRegistry.list().length, "tools");
   const mcpRegistry = new MCPRegistry({ toolRegistry, events, log: logger, cacheDir: wpaths.cacheDir });
   if (config.features.mcp && config.mcpServers) {
@@ -6841,7 +7138,7 @@ async function createPreContextServices(input) {
       sessionId: session.id,
       projectSlug: wpaths.projectSlug,
       projectRoot,
-      projectName: path5.basename(projectRoot),
+      projectName: path14.basename(projectRoot),
       workingDir,
       clientType: "webui",
       pid: process.pid,
@@ -6867,13 +7164,13 @@ async function createPreContextServices(input) {
         startWorktreeTelemetryBridge,
         startToolTelemetryBridge,
         startCostTelemetryBridge
-      } = await import('@wrongstack/core');
+      } = await import("@wrongstack/core");
       const hqTelemetry = createHqPublisherFromEnv({
         clientKind: "webui",
         projectRoot,
-        projectName: path5.basename(projectRoot),
+        projectName: path14.basename(projectRoot),
         appConfig: config,
-        socketFactory: (url) => new WebSocket(url)
+        socketFactory: (url) => new WebSocket2(url)
       });
       if (hqTelemetry) {
         hqTelemetry.connect();
@@ -6883,7 +7180,7 @@ async function createPreContextServices(input) {
           events,
           sessionId: session.id,
           projectRoot,
-          projectName: path5.basename(projectRoot),
+          projectName: path14.basename(projectRoot),
           globalRoot: wpaths.globalRoot,
           initialAgents: statusTracker?.getAgents(),
           startedAt: (/* @__PURE__ */ new Date()).toISOString()
@@ -6972,7 +7269,7 @@ async function createPreContextServices(input) {
   const modelCapabilitiesRef = { current: modelCapabilities };
   const skillLoader = config.features.skills ? new DefaultSkillLoader({ paths: wpaths }) : void 0;
   const skillInstaller = config.features.skills ? new SkillInstaller({
-    manifestPath: path5.join(wpaths.globalRoot, "installed-skills.json"),
+    manifestPath: path14.join(wpaths.globalRoot, "installed-skills.json"),
     projectSkillsDir: wpaths.inProjectSkills,
     globalSkillsDir: wpaths.globalSkills,
     projectHash: wpaths.projectHash,
@@ -6981,8 +7278,8 @@ async function createPreContextServices(input) {
   const promptsEnabled = config.features.prompts !== false;
   const bundledPromptsDir = promptsEnabled ? (() => {
     try {
-      const req = createRequire(import.meta.url);
-      return path5.join(path5.dirname(req.resolve("@wrongstack/core/package.json")), "data", "prompts");
+      const req = createRequire2(import.meta.url);
+      return path14.join(path14.dirname(req.resolve("@wrongstack/core/package.json")), "data", "prompts");
     } catch {
       return void 0;
     }
@@ -7063,8 +7360,33 @@ async function createPreContextServices(input) {
     needsSetup
   };
 }
+function isSuperMemoryService(memoryStore) {
+  const value = memoryStore;
+  return typeof value["retrieveForPath"] === "function" && typeof value["searchSuper"] === "function" && typeof value["graphFor"] === "function" && typeof value["verify"] === "function" && typeof value["hygiene"] === "function" && typeof value["listCandidates"] === "function";
+}
+
+// src/server/start-webui.ts
+import * as path21 from "node:path";
+import {
+  createDefaultPipelines,
+  createSessionEventBridge,
+  DEFAULT_CONTEXT_WINDOW_MODE_ID as DEFAULT_CONTEXT_WINDOW_MODE_ID2,
+  expectDefined as expectDefined3,
+  resolveSessionLoggingConfig,
+  watchProviderConfig
+} from "@wrongstack/core";
+import { toErrorMessage as toErrorMessage10 } from "@wrongstack/core/utils";
+import { makeProviderFromConfig as makeProviderFromConfig3 } from "@wrongstack/providers";
+import {
+  ensureSessionShell
+} from "@wrongstack/tools";
+
+// src/server/boot.ts
+import {
+  bootConfig as coreBootConfig
+} from "@wrongstack/core";
 async function bootConfig() {
-  const { config, vault, globalConfigPath, projectRoot, wpaths, logger } = await bootConfig$1({
+  const { config, vault, globalConfigPath, projectRoot, wpaths, logger } = await coreBootConfig({
     appLabel: "WebUI"
   });
   return { config, vault, globalConfigPath, projectRoot, wpaths, logger };
@@ -7072,6 +7394,35 @@ async function bootConfig() {
 function patchConfig(config, updates) {
   return Object.freeze({ ...config, ...updates });
 }
+
+// src/server/backend-services.ts
+import {
+  Agent,
+  AutoCompactionMiddleware as AutoCompactionMiddlewareCtor,
+  BrainMonitor,
+  CollaborationBus as CollaborationBusCtor,
+  DEFAULT_TOOLS_CONFIG,
+  createStrategyCompactor,
+  collabInjectMiddleware,
+  collabPauseMiddleware,
+  estimateRequestTokensCalibrated,
+  installDesignStudioMiddleware,
+  ObservableBrainArbiter as ObservableBrainArbiterCtor,
+  resolveContextWindowPolicy as resolveContextWindowPolicy2,
+  createAutonomyBrain,
+  createTieredBrainArbiter,
+  DefaultBrainArbiter,
+  GlobalMailbox as GlobalMailbox2,
+  mailboxSessionTag,
+  SessionMemoryConsolidator,
+  TOKENS as TOKENS2,
+  ToolExecutor
+} from "@wrongstack/core";
+
+// src/server/collaboration-ws-handler.ts
+import { randomUUID } from "node:crypto";
+import { toErrorMessage as toErrorMessage6 } from "@wrongstack/core/utils";
+var REPLAY_LIMIT = 50;
 var PAUSE_TIMEOUT_MS = 6e4;
 var CollaborationWebSocketHandler = class {
   constructor(events, logger, reader, annotations, bus) {
@@ -7199,7 +7550,7 @@ var CollaborationWebSocketHandler = class {
     if (this.reader) {
       this.replayHistory(ws, sessionId).catch((err) => {
         this.logger.debug?.(
-          `collab: replay failed for ${sessionId}: ${toErrorMessage(err)}`
+          `collab: replay failed for ${sessionId}: ${toErrorMessage6(err)}`
         );
       });
     }
@@ -7317,7 +7668,7 @@ var CollaborationWebSocketHandler = class {
       this.send(
         ws,
         this.errorMessage(
-          `annotation rejected: ${toErrorMessage(err)}`
+          `annotation rejected: ${toErrorMessage6(err)}`
         )
       );
     }
@@ -7384,7 +7735,7 @@ var CollaborationWebSocketHandler = class {
       this.send(
         ws,
         this.errorMessage(
-          `resolve failed: ${toErrorMessage(err)}`
+          `resolve failed: ${toErrorMessage6(err)}`
         )
       );
     }
@@ -7432,7 +7783,7 @@ var CollaborationWebSocketHandler = class {
           if (p.ws.readyState === 1) p.ws.send(data);
         } catch (err) {
           this.logger.debug?.(
-            `collab broadcast failed: ${toErrorMessage(err)}`
+            `collab broadcast failed: ${toErrorMessage6(err)}`
           );
         }
       }
@@ -7459,11 +7810,11 @@ var CollaborationWebSocketHandler = class {
       }
     } catch (err) {
       this.logger.debug?.(
-        `collab: session reader rejected ${sessionId}: ${toErrorMessage(err)}`
+        `collab: session reader rejected ${sessionId}: ${toErrorMessage6(err)}`
       );
       return;
     }
-    const tail2 = all.slice(-50);
+    const tail2 = all.slice(-REPLAY_LIMIT);
     if (tail2.length === 0) return;
     for (const raw of tail2) {
       const ev = raw;
@@ -7540,7 +7891,7 @@ var CollaborationWebSocketHandler = class {
         if (p.ws.readyState === 1) p.ws.send(data);
       } catch (err) {
         this.logger.debug?.(
-          `collab broadcast failed: ${toErrorMessage(err)}`
+          `collab broadcast failed: ${toErrorMessage6(err)}`
         );
       }
     }
@@ -7792,6 +8143,17 @@ var CollaborationWebSocketHandler = class {
     }
   }
 };
+
+// src/server/codebase-indexing.ts
+import * as fs12 from "node:fs";
+import * as path15 from "node:path";
+import {
+  cancelPendingReindexes,
+  enqueueReindex,
+  isIndexableFile,
+  runStartupIndex,
+  shutdownCodebaseIndexHost
+} from "@wrongstack/tools";
 var IGNORE_DIRS = /* @__PURE__ */ new Set([
   "node_modules",
   ".git",
@@ -7837,7 +8199,7 @@ function setupWebUICodebaseIndexing(deps2) {
         if (!filename) return;
         const rel = filename.toString();
         if (isIgnored(rel)) return;
-        const abs = path5.resolve(deps2.projectRoot, rel);
+        const abs = path15.resolve(deps2.projectRoot, rel);
         enqueueFile(abs);
       });
       watcher.on("error", (err) => deps2.logger.debug(`webui codebase index watcher error: ${err}`));
@@ -7850,7 +8212,7 @@ function setupWebUICodebaseIndexing(deps2) {
   }
   function enqueueFile(filePath) {
     if (!idx.onEdit && !idx.watchExternal) return;
-    const abs = path5.isAbsolute(filePath) ? path5.normalize(filePath) : path5.resolve(deps2.projectRoot, filePath);
+    const abs = path15.isAbsolute(filePath) ? path15.normalize(filePath) : path15.resolve(deps2.projectRoot, filePath);
     if (!isInside2(deps2.projectRoot, abs) || !isIndexableFile(abs)) return;
     enqueueReindex({
       projectRoot: deps2.projectRoot,
@@ -7887,15 +8249,23 @@ function isIgnored(rel) {
   return rel.split(/[/\\]/).some((seg) => IGNORE_DIRS.has(seg));
 }
 function isInside2(root, target) {
-  const normalizedRoot = path5.resolve(root);
-  const normalizedTarget = path5.resolve(target);
-  return normalizedTarget === normalizedRoot || normalizedTarget.startsWith(normalizedRoot + path5.sep);
+  const normalizedRoot = path15.resolve(root);
+  const normalizedTarget = path15.resolve(target);
+  return normalizedTarget === normalizedRoot || normalizedTarget.startsWith(normalizedRoot + path15.sep);
 }
+
+// src/server/discover-mailbox-bridge.ts
+import { spawn as spawn3 } from "node:child_process";
+import { createRequire as createRequire3 } from "node:module";
+import { existsSync } from "node:fs";
+import { dirname as dirname7, join as join11 } from "node:path";
+import { resolveProjectDir, wstackGlobalRoot as wstackGlobalRoot2 } from "@wrongstack/core";
+import { readLiveLock } from "@wrongstack/core/coordination";
 var MAILBOX_BRIDGE_BOOT_TIMEOUT_MS = 5e3;
 async function discoverMailboxBridgeForWebui(params) {
   const mode = params.config?.features?.mailboxBridge ?? "auto";
   if (mode === "off") return;
-  const projectDir = resolveProjectDir(params.projectRoot, wstackGlobalRoot());
+  const projectDir = resolveProjectDir(params.projectRoot, wstackGlobalRoot2());
   let result = await readLiveLock(projectDir);
   let spawnedPid = null;
   if (result.kind !== "live") {
@@ -7961,7 +8331,7 @@ async function waitForLiveMailboxBridge(projectDir, timeoutMs) {
 function spawnMailboxBridge(projectRoot, logger) {
   const invocation = mailboxServeInvocation(projectRoot);
   try {
-    const child = spawn(invocation.command, invocation.args, {
+    const child = spawn3(invocation.command, invocation.args, {
       cwd: projectRoot,
       detached: process.platform !== "win32" && !invocation.useShell,
       env: process.env,
@@ -7992,7 +8362,7 @@ function mailboxServeInvocation(projectRoot) {
     return { command: process.execPath, args: [explicitCliEntry, "mailbox", "serve"] };
   }
   try {
-    const require2 = createRequire(import.meta.url);
+    const require2 = createRequire3(import.meta.url);
     const cliEntry = require2.resolve("@wrongstack/cli");
     return { command: process.execPath, args: [cliEntry, "mailbox", "serve"] };
   } catch {
@@ -8016,9 +8386,9 @@ function mailboxServeInvocation(projectRoot) {
 function findWorkspaceCliEntry(projectRoot) {
   let dir = projectRoot;
   for (let i = 0; i < 6; i++) {
-    const candidate = join(dir, "packages", "cli", "dist", "index.js");
+    const candidate = join11(dir, "packages", "cli", "dist", "index.js");
     if (existsSync(candidate)) return candidate;
-    const parent = dirname(dir);
+    const parent = dirname7(dir);
     if (parent === dir) return null;
     dir = parent;
   }
@@ -8027,10 +8397,15 @@ function findWorkspaceCliEntry(projectRoot) {
 function sleep(ms) {
   return new Promise((resolve10) => setTimeout(resolve10, ms));
 }
+
+// src/server/terminal-ws-handler.ts
+import { spawn as spawnChild } from "node:child_process";
+import { createRequire as createRequire4 } from "node:module";
+import { toErrorMessage as toErrorMessage7 } from "@wrongstack/core/utils";
 var MAX_SESSIONS_PER_CLIENT = 8;
 var DEFAULT_COLS = 80;
 var DEFAULT_ROWS = 24;
-var requireFromHere = createRequire(import.meta.url);
+var requireFromHere = createRequire4(import.meta.url);
 var cachedNodePty;
 var TerminalWebSocketHandler = class {
   constructor(getCwd, logger, loadNodePty = defaultLoadNodePty, killProcessTree = defaultKillProcessTree) {
@@ -8108,8 +8483,8 @@ var TerminalWebSocketHandler = class {
         ...windowsPtyOptions()
       });
     } catch (err) {
-      const msg = `Integrated terminal failed to start: ${toErrorMessage(err)}`;
-      this.logger.warn?.(`terminal spawn failed: ${toErrorMessage(err)}`);
+      const msg = `Integrated terminal failed to start: ${toErrorMessage7(err)}`;
+      this.logger.warn?.(`terminal spawn failed: ${toErrorMessage7(err)}`);
       this.send(ws, { type: "terminal.output", payload: { id: payload.id, data: `${msg}\r
 ` } });
       this.send(ws, { type: "terminal.exit", payload: { id: payload.id, exitCode: -1 } });
@@ -8162,7 +8537,7 @@ var TerminalWebSocketHandler = class {
     try {
       pty.kill();
     } catch (err) {
-      this.logger.warn?.(`${reason} failed: ${toErrorMessage(err)}`);
+      this.logger.warn?.(`${reason} failed: ${toErrorMessage7(err)}`);
     }
   }
   killWindowsProcessTree(pty, reason) {
@@ -8174,7 +8549,7 @@ var TerminalWebSocketHandler = class {
       } catch {
       }
     } catch (err) {
-      this.logger.warn?.(`${reason} taskkill failed: ${toErrorMessage(err)}`);
+      this.logger.warn?.(`${reason} taskkill failed: ${toErrorMessage7(err)}`);
     }
   }
   send(ws, msg) {
@@ -8205,7 +8580,7 @@ function windowsPtyOptions() {
   return { useConptyDll: true };
 }
 function defaultKillProcessTree(pid) {
-  const child = spawn("taskkill", ["/PID", String(pid), "/T", "/F"], {
+  const child = spawnChild("taskkill", ["/PID", String(pid), "/T", "/F"], {
     stdio: "ignore",
     windowsHide: true
   });
@@ -8218,6 +8593,14 @@ function clampDim(value, fallback) {
   if (typeof value !== "number" || !Number.isFinite(value)) return fallback;
   return Math.max(1, Math.min(1e3, Math.floor(value)));
 }
+
+// src/server/backend-services.ts
+import { makeLightSubagentFactory } from "@wrongstack/runtime";
+import {
+  createSuperMemoryToolCallMiddleware,
+  createSuperMemoryTurnMiddleware
+} from "@wrongstack/super-memory";
+import { toErrorMessage as toErrorMessage8 } from "@wrongstack/core/utils";
 async function createAgentServices(input) {
   const {
     config,
@@ -8232,15 +8615,37 @@ async function createAgentServices(input) {
     providerRegistry,
     modelsRegistry,
     events,
+    memoryStore,
     modelCapabilitiesRef
   } = input;
-  const collabBus = new CollaborationBus();
+  const collabBus = new CollaborationBusCtor();
   const pipelines = input.pipelines;
   const collabInject = collabInjectMiddleware(collabBus, { logger });
   pipelines.toolCall.prepend(collabInject);
   const collabPause = collabPauseMiddleware(collabBus, { logger });
   pipelines.toolCall.prepend(collabPause);
   installDesignStudioMiddleware({ pipelines, ctx: context });
+  if (config.features.memory !== false && config.superMemory?.enabled !== false && isSuperMemoryRetriever(memoryStore)) {
+    if (config.superMemory?.inject?.toolResults !== false) {
+      pipelines.toolCall.use(createSuperMemoryToolCallMiddleware({
+        memory: memoryStore,
+        maxHintsPerTool: config.superMemory?.inject?.maxHintsPerTool,
+        maxCharsPerTool: config.superMemory?.inject?.maxCharsPerTool,
+        minScore: config.superMemory?.inject?.minScore,
+        repeatCooldownMs: config.superMemory?.inject?.repeatCooldownMs,
+        verifyOnMutation: config.superMemory?.hygiene?.autoOnFileChange,
+        triggers: config.superMemory?.inject?.triggers
+      }));
+    }
+    if (config.superMemory?.inject?.turnContext !== false) {
+      pipelines.request.use(createSuperMemoryTurnMiddleware({
+        memory: memoryStore,
+        maxMemories: config.superMemory?.inject?.maxTurnMemories,
+        maxChars: config.superMemory?.inject?.maxCharsPerTurn,
+        minScore: config.superMemory?.inject?.minScore
+      }));
+    }
+  }
   const codebaseIndexing = setupWebUICodebaseIndexing({
     config,
     context,
@@ -8254,7 +8659,7 @@ async function createAgentServices(input) {
     summarizerModel: config.context?.summarizerModel,
     llmSelector: config.context?.llmSelector
   });
-  const initialContextPolicy = resolveContextWindowPolicy(config.context);
+  const initialContextPolicy = resolveContextWindowPolicy2(config.context);
   let autoCompactor;
   if (config.context?.autoCompact !== false) {
     let effectiveMaxContext = config.context?.effectiveMaxContext ?? 0;
@@ -8271,7 +8676,7 @@ async function createAgentServices(input) {
       }
     }
     if (!effectiveMaxContext) effectiveMaxContext = provider.capabilities.maxContext;
-    autoCompactor = new AutoCompactionMiddleware(
+    autoCompactor = new AutoCompactionMiddlewareCtor(
       compactor,
       effectiveMaxContext,
       (ctx) => estimateRequestTokensCalibrated(
@@ -8299,7 +8704,7 @@ async function createAgentServices(input) {
   const updateAutoCompactionMaxContext = async (newProvider, providerId = newProvider.id, providerCfg) => {
     await modelsRegistry.refresh().catch((err) => {
       logger.warn(
-        `models.dev refresh failed for ${providerId}/${context.model}: ${toErrorMessage(err)}; using cached catalog`
+        `models.dev refresh failed for ${providerId}/${context.model}: ${toErrorMessage8(err)}; using cached catalog`
       );
     });
     const currentConfig = input.config;
@@ -8336,9 +8741,9 @@ async function createAgentServices(input) {
       maxContext: newMaxContext
     });
   };
-  const secretScrubber = container.resolve(TOKENS.SecretScrubber);
-  const renderer = container.has(TOKENS.Renderer) ? container.resolve(TOKENS.Renderer) : void 0;
-  const permissionPolicy = container.resolve(TOKENS.PermissionPolicy);
+  const secretScrubber = container.resolve(TOKENS2.SecretScrubber);
+  const renderer = container.has(TOKENS2.Renderer) ? container.resolve(TOKENS2.Renderer) : void 0;
+  const permissionPolicy = container.resolve(TOKENS2.PermissionPolicy);
   const toolExecutor = new ToolExecutor(toolRegistry, {
     permissionPolicy,
     secretScrubber,
@@ -8349,7 +8754,7 @@ async function createAgentServices(input) {
     perIterationOutputCapBytes: config.tools?.perIterationOutputCapBytes ?? DEFAULT_TOOLS_CONFIG.perIterationOutputCapBytes,
     tracer: void 0
   });
-  const webuiLogger = container.resolve(TOKENS.Logger);
+  const webuiLogger = container.resolve(TOKENS2.Logger);
   void discoverMailboxBridgeForWebui({
     projectRoot,
     config,
@@ -8375,6 +8780,9 @@ async function createAgentServices(input) {
     confirmAwaiter: void 0,
     toolExecutor
   });
+  if (config.features.memory && config.features.memoryConsolidation !== false) {
+    agent.extensions.register(new SessionMemoryConsolidator({ memoryStore }));
+  }
   console.log("[WebUI] Agent initialized");
   const brainSettings = { maxAutoRisk: "medium" };
   const autonomousBrain = {
@@ -8385,7 +8793,7 @@ async function createAgentServices(input) {
       // the tiered ceiling gates risk — keep inner permissive
     }).decide(request)
   };
-  const brain = new ObservableBrainArbiter(
+  const brain = new ObservableBrainArbiterCtor(
     createTieredBrainArbiter({
       policy: new DefaultBrainArbiter(),
       autonomous: autonomousBrain,
@@ -8393,7 +8801,7 @@ async function createAgentServices(input) {
     }),
     events
   );
-  container.bind(TOKENS.BrainArbiter, () => brain);
+  container.bind(TOKENS2.BrainArbiter, () => brain);
   const brainLog = [];
   const pushBrainLog = (entry) => {
     brainLog.push(entry);
@@ -8426,7 +8834,7 @@ async function createAgentServices(input) {
       outcome: e.decision.type === "deny" ? e.decision.reason : ""
     })
   );
-  const brainMailbox = new GlobalMailbox(wpaths.projectDir, events);
+  const brainMailbox = new GlobalMailbox2(wpaths.projectDir, events);
   const brainMonitor = new BrainMonitor({
     events,
     brain,
@@ -8519,14 +8927,14 @@ async function createAgentServices(input) {
     updateAutoCompactionMaxContext
   };
 }
+function isSuperMemoryRetriever(memoryStore) {
+  const value = memoryStore;
+  return typeof value["retrieveForPath"] === "function" && typeof value["searchSuper"] === "function";
+}
 
 // src/server/pending-confirms.ts
-function isDestructivePendingConfirm(confirm) {
-  return confirm.riskTier === "destructive" || confirm.decisionSource === "yolo_destructive";
-}
 function resolveYoloEligiblePendingConfirms(pendingConfirms) {
   for (const [id, confirm] of pendingConfirms) {
-    if (isDestructivePendingConfirm(confirm)) continue;
     pendingConfirms.delete(id);
     confirm.resolve("yes");
   }
@@ -8682,6 +9090,9 @@ function createConnectionHandler(opts) {
   };
 }
 
+// src/server/message-dispatcher.ts
+import path16 from "node:path";
+
 // src/server/autophase-routes.ts
 async function handleAutoPhaseRoute(_ws, msg, handlers) {
   if (!msg.type.startsWith("autophase.")) return false;
@@ -8705,10 +9116,13 @@ async function handleBrainRoute(ws, msg, handlers) {
       return false;
   }
 }
+
+// src/server/goal-handlers.ts
+import { resolveWstackPaths } from "@wrongstack/core/utils";
 async function handleGoalGet(projectRoot, broadcast2) {
   try {
-    const goalPath = resolveWstackPaths$1({ projectRoot }).projectGoal;
-    const { readFile: readFile10 } = await import('fs/promises');
+    const goalPath = resolveWstackPaths({ projectRoot }).projectGoal;
+    const { readFile: readFile10 } = await import("node:fs/promises");
     const raw = await readFile10(goalPath, "utf8");
     const goal = JSON.parse(raw);
     broadcast2({ type: "goal.updated", payload: goal });
@@ -8762,7 +9176,7 @@ async function handleTasksGet(ctx, ws) {
   const taskPath = ctx.context.meta["task.path"];
   if (typeof taskPath === "string" && taskPath) {
     try {
-      const { loadTasks } = await import('@wrongstack/core');
+      const { loadTasks } = await import("@wrongstack/core");
       const file = await loadTasks(taskPath);
       ctx.send(ws, { type: "tasks.updated", payload: sessionPayload(ctx, { tasks: file?.tasks ?? [] }) });
     } catch {
@@ -8782,7 +9196,7 @@ async function handleTaskUpdate(ctx, ws, payload) {
     return;
   }
   try {
-    const { loadTasks, saveTasks } = await import('@wrongstack/core');
+    const { loadTasks, saveTasks } = await import("@wrongstack/core");
     const file = await loadTasks(taskPath);
     if (!file) {
       sendResult2(ws, ctx, false, "No task file found.");
@@ -8811,7 +9225,7 @@ async function handlePlanGet(ctx, ws) {
   const sessionId = ctx.context.session?.id ?? "";
   if (typeof planPath === "string" && planPath) {
     try {
-      const { loadPlan } = await import('@wrongstack/core');
+      const { loadPlan } = await import("@wrongstack/core");
       const plan = await loadPlan(planPath);
       ctx.send(ws, {
         type: "plan.updated",
@@ -8852,7 +9266,7 @@ async function handlePlanTemplateUse(ctx, ws, template) {
     return;
   }
   try {
-    const { getPlanTemplate, loadPlan, savePlan, emptyPlan, addPlanItem } = await import('@wrongstack/core');
+    const { getPlanTemplate, loadPlan, savePlan, emptyPlan, addPlanItem } = await import("@wrongstack/core");
     const tpl = getPlanTemplate(template);
     if (!tpl) {
       sendResult2(ws, ctx, false, `Unknown template "${template}".`);
@@ -8877,7 +9291,7 @@ async function handlePlanItemUpdate(ctx, ws, payload) {
     return;
   }
   try {
-    const { mutatePlan, setPlanItemStatus } = await import('@wrongstack/core');
+    const { mutatePlan, setPlanItemStatus } = await import("@wrongstack/core");
     let changed = false;
     const plan = await mutatePlan(planPath, sessionId, async (p) => {
       const before = p.updatedAt;
@@ -8944,6 +9358,45 @@ async function handleWorklistMessage(ctx, ws, msg) {
       return;
   }
 }
+
+// src/server/kanban-routes.ts
+import {
+  deserializeTaskGraph,
+  serializeTaskGraph
+} from "@wrongstack/core";
+import {
+  addColumn,
+  addGoalMetricToTask,
+  addTask,
+  assignTask,
+  claimReadyTask,
+  copyTaskToBoard,
+  createBoard,
+  duplicateBoard,
+  exportBoardToTaskGraph,
+  generateBoardFromDescription,
+  getBoard,
+  getKanbanOrchestrationSnapshot,
+  getKanbanQueueHealth,
+  getTask,
+  getTaskChain,
+  listReadyTasks,
+  listBoards,
+  mergeTasks,
+  moveTask,
+  parseLinesIntoTasks,
+  removeBoard,
+  removeColumn,
+  removeTask,
+  releaseTaskClaim,
+  setTaskChain,
+  splitTask,
+  syncBoardFromTaskGraph,
+  transferTaskToBoard,
+  updateBoard,
+  updateGoalMetricOnTask,
+  updateTask
+} from "@wrongstack/kanban";
 function ok(ws, type, data) {
   send(ws, { type, payload: { success: true, data: data ?? null } });
 }
@@ -9544,7 +9997,7 @@ async function handlePrefsRoute(ws, msg, handlers) {
 // src/server/process-handlers.ts
 async function handleProcessList(ws) {
   try {
-    const { getProcessRegistry } = await import('@wrongstack/tools');
+    const { getProcessRegistry } = await import("@wrongstack/tools");
     const procs = getProcessRegistry().list();
     send(ws, {
       type: "process.list",
@@ -9571,7 +10024,7 @@ async function handleProcessKill(ws, payload) {
   }
   const { pid } = parsed.value;
   try {
-    const { getProcessRegistry } = await import('@wrongstack/tools');
+    const { getProcessRegistry } = await import("@wrongstack/tools");
     const proc = getProcessRegistry().get(pid);
     if (proc?.protected) {
       sendResult(ws, false, `Cannot kill protected process (PID ${pid})`);
@@ -9585,7 +10038,7 @@ async function handleProcessKill(ws, payload) {
 }
 async function handleProcessKillAll(ws) {
   try {
-    const { getProcessRegistry } = await import('@wrongstack/tools');
+    const { getProcessRegistry } = await import("@wrongstack/tools");
     getProcessRegistry().killAll();
     sendResult(ws, true, "All processes killed");
   } catch (err) {
@@ -9895,7 +10348,7 @@ function createMessageDispatcher(opts) {
       skillLoader: deps2.skillLoader,
       skillInstaller: deps2.skillInstaller,
       projectRoot,
-      projectSkillsDir: path5__default.join(projectRoot, ".wrongstack", "skills"),
+      projectSkillsDir: path16.join(projectRoot, ".wrongstack", "skills"),
       globalSkillsDir: deps2.wpaths.globalSkills
     };
   }
@@ -10350,6 +10803,7 @@ function createMessageDispatcher(opts) {
         break;
       }
       case "prefs.update": {
+        void ws;
         throw new Error("handlePrefsRoute did not claim prefs.update \u2014 check chain order");
       }
       case "prefs.get": {
@@ -10363,6 +10817,11 @@ function createMessageDispatcher(opts) {
     }
   };
 }
+
+// src/server/pref-helpers.ts
+import { atomicWrite as atomicWrite6 } from "@wrongstack/core/utils";
+import { decryptConfigSecrets as decryptConfigSecrets2, encryptConfigSecrets as encryptConfigSecrets2 } from "@wrongstack/core/security";
+import * as fs13 from "node:fs/promises";
 var PREF_KEYS = [
   "autonomy",
   "autonomyDelayMs",
@@ -10422,7 +10881,7 @@ async function updateGlobalConfig(deps2, holder, mutate, errorLabel) {
   const write = async () => {
     let raw;
     try {
-      raw = await fs4.readFile(globalConfigPath, "utf8");
+      raw = await fs13.readFile(globalConfigPath, "utf8");
     } catch {
       raw = "{}";
     }
@@ -10433,10 +10892,10 @@ async function updateGlobalConfig(deps2, holder, mutate, errorLabel) {
       logger.warn(`${errorLabel}: refusing to overwrite corrupt config at ${globalConfigPath}`);
       return;
     }
-    const decrypted = decryptConfigSecrets(parsed, vault);
+    const decrypted = decryptConfigSecrets2(parsed, vault);
     mutate(decrypted);
-    const encrypted = encryptConfigSecrets(decrypted, vault);
-    await atomicWrite$1(globalConfigPath, JSON.stringify(encrypted, null, 2), { mode: 384 });
+    const encrypted = encryptConfigSecrets2(decrypted, vault);
+    await atomicWrite6(globalConfigPath, JSON.stringify(encrypted, null, 2), { mode: 384 });
   };
   const next = holder.lock.then(write);
   holder.lock = next.then(
@@ -10598,13 +11057,18 @@ async function persistPrefsToConfig(deps2, holder, payload) {
     }
   }, "prefs");
 }
+
+// src/server/projects-manifest.ts
+import * as fs14 from "node:fs/promises";
+import * as path17 from "node:path";
+import { projectSlug } from "@wrongstack/core";
 function projectsJsonPath(globalConfigPath) {
-  const base = path5.dirname(globalConfigPath);
-  return path5.join(base, "projects.json");
+  const base = path17.dirname(globalConfigPath);
+  return path17.join(base, "projects.json");
 }
 async function loadManifest(globalConfigPath) {
   try {
-    const raw = await fs4.readFile(projectsJsonPath(globalConfigPath), "utf8");
+    const raw = await fs14.readFile(projectsJsonPath(globalConfigPath), "utf8");
     const parsed = JSON.parse(raw);
     return { projects: parsed.projects ?? [] };
   } catch {
@@ -10613,18 +11077,26 @@ async function loadManifest(globalConfigPath) {
 }
 async function saveManifest(manifest, globalConfigPath) {
   const file = projectsJsonPath(globalConfigPath);
-  await fs4.mkdir(path5.dirname(file), { recursive: true });
-  await fs4.writeFile(file, JSON.stringify(manifest, null, 2), "utf8");
+  await fs14.mkdir(path17.dirname(file), { recursive: true });
+  await fs14.writeFile(file, JSON.stringify(manifest, null, 2), "utf8");
 }
 function generateProjectSlug(rootPath) {
   return projectSlug(rootPath);
 }
 async function ensureProjectDataDir(slug, globalConfigPath) {
-  const base = path5.dirname(globalConfigPath);
-  const dir = path5.join(base, "projects", slug);
-  await fs4.mkdir(dir, { recursive: true });
+  const base = path17.dirname(globalConfigPath);
+  const dir = path17.join(base, "projects", slug);
+  await fs14.mkdir(dir, { recursive: true });
   return dir;
 }
+
+// src/server/provider-handlers.ts
+import { DefaultSecretScrubber } from "@wrongstack/core";
+import {
+  beginOAuthLogin
+} from "@wrongstack/providers/oauth";
+import { probeLocalLlm } from "@wrongstack/runtime/probe";
+import { toErrorMessage as toErrorMessage9 } from "@wrongstack/core/utils";
 function projectSavedProviders(providers) {
   return Object.entries(providers).map(([id, cfg]) => {
     const keys = normalizeKeys(cfg);
@@ -10655,7 +11127,7 @@ function createProviderHandlers(deps2) {
   }
   async function saveConfigProviders(providers) {
     const next = configWriteLock.then(() => saveProviders(globalConfigPath, vault, providers)).catch((err) => {
-      const msg = toErrorMessage(err);
+      const msg = toErrorMessage9(err);
       console.error(JSON.stringify({
         level: "error",
         event: "webui.provider_save_failed",
@@ -10927,10 +11399,23 @@ function createProviderHandlers(deps2) {
     loadConfigProviders
   };
 }
+
+// src/server/routes.ts
+import path20 from "node:path";
+import {
+  enhanceUserPrompt,
+  gatedEnhancerReasoning,
+  recentTextTurns,
+  resolveProviderModelList
+} from "@wrongstack/core";
+import { makeProviderFromConfig as makeProviderFromConfig2 } from "@wrongstack/providers";
+
+// src/server/mailbox-handlers.ts
+import { GlobalMailbox as GlobalMailbox3, resolveProjectDir as resolveProjectDir2 } from "@wrongstack/core";
 async function handleMailboxMessages(ws, deps2, payload) {
   try {
-    const dir = resolveProjectDir(deps2.projectRoot, deps2.globalRoot);
-    const mb = new GlobalMailbox(dir);
+    const dir = resolveProjectDir2(deps2.projectRoot, deps2.globalRoot);
+    const mb = new GlobalMailbox3(dir);
     const limit = payload?.limit ?? 30;
     const unreadForAgent = payload?.unreadOnly === true && payload.agentId !== void 0;
     const messages = await mb.query({
@@ -10970,8 +11455,8 @@ async function handleMailboxMessages(ws, deps2, payload) {
 }
 async function handleMailboxAgents(ws, deps2, payload) {
   try {
-    const dir = resolveProjectDir(deps2.projectRoot, deps2.globalRoot);
-    const mb = new GlobalMailbox(dir);
+    const dir = resolveProjectDir2(deps2.projectRoot, deps2.globalRoot);
+    const mb = new GlobalMailbox3(dir);
     const agents = payload?.onlineOnly ? await mb.getOnlineAgents() : await mb.getAgentStatuses();
     send(ws, {
       type: "mailbox.agents",
@@ -10999,8 +11484,8 @@ async function handleMailboxAgents(ws, deps2, payload) {
 }
 async function handleMailboxClear(ws, deps2) {
   try {
-    const dir = resolveProjectDir(deps2.projectRoot, deps2.globalRoot);
-    const mb = new GlobalMailbox(dir);
+    const dir = resolveProjectDir2(deps2.projectRoot, deps2.globalRoot);
+    const mb = new GlobalMailbox3(dir);
     await mb.clearAll();
     send(ws, { type: "mailbox.cleared", payload: {} });
   } catch (err) {
@@ -11009,14 +11494,21 @@ async function handleMailboxClear(ws, deps2) {
 }
 async function handleMailboxPurge(ws, deps2, opts) {
   try {
-    const dir = resolveProjectDir(deps2.projectRoot, deps2.globalRoot);
-    const mb = new GlobalMailbox(dir);
+    const dir = resolveProjectDir2(deps2.projectRoot, deps2.globalRoot);
+    const mb = new GlobalMailbox3(dir);
     const result = await mb.purgeStale(opts);
     send(ws, { type: "mailbox.purged", payload: result });
   } catch (err) {
     send(ws, { type: "mailbox.purged", payload: { error: errMessage(err) } });
   }
 }
+
+// src/server/mode-handlers.ts
+import {
+  DefaultSystemPromptBuilder as DefaultSystemPromptBuilder2,
+  resolveWstackPaths as resolveWstackPaths2,
+  ToolValidationError as ToolValidationError5
+} from "@wrongstack/core";
 function createModeHandlers(ctx) {
   return {
     listModes: async (ws) => {
@@ -11059,14 +11551,14 @@ function createModeHandlers(ctx) {
         } else {
           const found = await ctx.modeStore.getMode(id);
           if (!found) {
-            throw new ToolValidationError({ message: `Unknown mode "${id}"`, field: "modeId" });
+            throw new ToolValidationError5({ message: `Unknown mode "${id}"`, field: "modeId" });
           }
           await ctx.modeStore.setActiveMode(id);
         }
         ctx.setModeId(id);
         const modePrompt = id === "default" ? "" : (await ctx.modeStore.getMode(id))?.prompt ?? "";
-        const paths = resolveWstackPaths({ projectRoot: ctx.projectRoot, globalRoot: ctx.globalRoot });
-        const freshBuilder = new DefaultSystemPromptBuilder({
+        const paths = resolveWstackPaths2({ projectRoot: ctx.projectRoot, globalRoot: ctx.globalRoot });
+        const freshBuilder = new DefaultSystemPromptBuilder2({
           memoryStore: ctx.memoryStore,
           skillLoader: ctx.skillLoader,
           modeStore: ctx.modeStore,
@@ -11096,6 +11588,9 @@ function createModeHandlers(ctx) {
     }
   };
 }
+
+// src/server/project-handlers.ts
+import * as path18 from "node:path";
 function createProjectHandlers(ctx) {
   return {
     listProjects: async (ws) => {
@@ -11121,7 +11616,7 @@ function createProjectHandlers(ctx) {
     selectProject: async (ws, msg) => {
       const payload = msg.payload;
       const root = typeof payload?.root === "string" ? payload.root : "";
-      const name2 = typeof payload?.name === "string" ? payload.name : root ? path5.basename(root) : "";
+      const name2 = typeof payload?.name === "string" ? payload.name : root ? path18.basename(root) : "";
       send(ws, {
         type: "projects.selected",
         payload: {
@@ -11154,6 +11649,14 @@ function createProjectHandlers(ctx) {
     }
   };
 }
+
+// src/server/session-handlers.ts
+import * as path19 from "node:path";
+import {
+  DEFAULT_CONTEXT_WINDOW_MODE_ID,
+  repairToolUseAdjacency,
+  resolveContextWindowPolicy as resolveContextWindowPolicy3
+} from "@wrongstack/core";
 function createSessionHandlers(ctx) {
   const currentSessionId = () => ctx.getSession().id;
   const sessionPayload2 = (payload) => {
@@ -11307,7 +11810,7 @@ function createSessionHandlers(ctx) {
         return;
       }
       const { id } = parsed.value;
-      let policy = resolveContextWindowPolicy({}, id);
+      let policy = resolveContextWindowPolicy3({}, id);
       if (policy.id !== id) {
         const customModes = ctx.customModeStore.list().filter((m) => m.custom === true);
         const custom = customModes.find((m) => m.id === id);
@@ -11379,7 +11882,7 @@ function createSessionHandlers(ctx) {
       const { id } = parsed.value;
       if (String(ctx.context.meta["contextWindowMode"] ?? "") === id) {
         ctx.context.meta["contextWindowMode"] = DEFAULT_CONTEXT_WINDOW_MODE_ID;
-        ctx.context.meta["contextWindowPolicy"] = resolveContextWindowPolicy({}, DEFAULT_CONTEXT_WINDOW_MODE_ID);
+        ctx.context.meta["contextWindowPolicy"] = resolveContextWindowPolicy3({}, DEFAULT_CONTEXT_WINDOW_MODE_ID);
       }
       const result = ctx.customModeStore.remove(id);
       sendResult(ws, result.ok, result.error ?? `Mode "${id}" deleted`);
@@ -11499,10 +12002,10 @@ function createSessionHandlers(ctx) {
     listCheckpoints: async (ws, msg) => {
       if (!ensureCurrentSession(ws, msg, "session.checkpoints")) return;
       try {
-        const { DefaultSessionRewinder } = await import('@wrongstack/core');
+        const { DefaultSessionRewinder } = await import("@wrongstack/core");
         const projectRoot = ctx.getProjectRoot();
         const rewinder = new DefaultSessionRewinder(
-          path5.join(projectRoot, ".wrongstack", "sessions"),
+          path19.join(projectRoot, ".wrongstack", "sessions"),
           projectRoot
         );
         const checkpoints = await rewinder.listCheckpoints(ctx.getSession().id);
@@ -11515,10 +12018,10 @@ function createSessionHandlers(ctx) {
       if (!ensureCurrentSession(ws, msg, "session.rewind")) return;
       const { checkpointIndex } = msg.payload;
       try {
-        const { DefaultSessionRewinder } = await import('@wrongstack/core');
+        const { DefaultSessionRewinder } = await import("@wrongstack/core");
         const projectRoot = ctx.getProjectRoot();
         const rewinder = new DefaultSessionRewinder(
-          path5.join(projectRoot, ".wrongstack", "sessions"),
+          path19.join(projectRoot, ".wrongstack", "sessions"),
           projectRoot
         );
         await rewinder.rewindToCheckpoint(ctx.getSession().id, checkpointIndex);
@@ -11603,11 +12106,13 @@ function buildRoutes(state, deps2, cb) {
       const saved = await providerHandlers.loadConfigProviders();
       const cfg = saved[providerId];
       const provider = await resolveProviderCatalogForModels(deps2.modelsRegistry, providerId, cfg);
+      const siblingId = SIBLING_CATALOG[providerId];
+      const siblingCatalog = siblingId && siblingId !== providerId ? await deps2.modelsRegistry.getProvider(siblingId).catch(() => void 0) : void 0;
       const models = await enrichProviderModelDescriptors(
         deps2.modelsRegistry,
         providerId,
         cfg,
-        resolveProviderModelList(cfg?.models, provider, cfg?.type ?? providerId)
+        resolveProviderModelList(cfg?.models, provider, cfg?.type ?? providerId, siblingCatalog)
       );
       send(ws, {
         type: "provider.models",
@@ -11633,7 +12138,7 @@ function buildRoutes(state, deps2, cb) {
         const providerCfg = newCfg.providers?.[newProvider] ?? {
           type: newProvider
         };
-        const newProv = deps2.providerRegistry.has(newProvider) ? deps2.providerRegistry.create({ ...providerCfg, type: newProvider }) : makeProviderFromConfig(newProvider, providerCfg);
+        const newProv = deps2.providerRegistry.has(newProvider) ? deps2.providerRegistry.create({ ...providerCfg, type: newProvider }) : makeProviderFromConfig2(newProvider, providerCfg);
         deps2.context.provider = newProv;
         await cb.updateAutoCompactionMaxContext(newProv, newProvider, providerCfg);
         await cb.updateGlobalConfig((config) => {
@@ -11876,7 +12381,7 @@ function buildRoutes(state, deps2, cb) {
       }
       return handleMailboxMessages(
         ws,
-        { projectRoot: state.getProjectRoot(), globalRoot: path5__default.dirname(deps2.globalConfigPath) },
+        { projectRoot: state.getProjectRoot(), globalRoot: path20.dirname(deps2.globalConfigPath) },
         parsed.value
       );
     },
@@ -11888,13 +12393,13 @@ function buildRoutes(state, deps2, cb) {
       }
       return handleMailboxAgents(
         ws,
-        { projectRoot: state.getProjectRoot(), globalRoot: path5__default.dirname(deps2.globalConfigPath) },
+        { projectRoot: state.getProjectRoot(), globalRoot: path20.dirname(deps2.globalConfigPath) },
         parsed.value
       );
     },
     clear: (ws) => handleMailboxClear(ws, {
       projectRoot: state.getProjectRoot(),
-      globalRoot: path5__default.dirname(deps2.globalConfigPath)
+      globalRoot: path20.dirname(deps2.globalConfigPath)
     }),
     purge: (ws, msg) => {
       const parsed = validateMailboxPurgePayload(msg.payload);
@@ -11904,7 +12409,7 @@ function buildRoutes(state, deps2, cb) {
       }
       return handleMailboxPurge(
         ws,
-        { projectRoot: state.getProjectRoot(), globalRoot: path5__default.dirname(deps2.globalConfigPath) },
+        { projectRoot: state.getProjectRoot(), globalRoot: path20.dirname(deps2.globalConfigPath) },
         parsed.value
       );
     }
@@ -12012,7 +12517,7 @@ async function startWebUI(opts = {}) {
   const updateGlobalConfig2 = async (mutate, errorLabel) => updateGlobalConfig(prefHelperDeps, configWriteLock, mutate, errorLabel);
   console.log("[WebUI] Config loaded:", config.provider ?? "(none)", "/", config.model ?? "(none)");
   if (!config.provider && config.providers && typeof config.providers === "object" && config.providers !== null && !Array.isArray(config.providers) && Object.keys(config.providers).length > 0) {
-    const firstKey = expectDefined(Object.keys(config.providers)[0]);
+    const firstKey = expectDefined3(Object.keys(config.providers)[0]);
     config = patchConfig(config, { provider: firstKey });
     console.log("[WebUI] No active provider \u2014 auto-selected:", firstKey);
   }
@@ -12112,7 +12617,7 @@ async function startWebUI(opts = {}) {
     getProjectRoot: () => projectRoot,
     getWorkingDir: () => workingDir,
     getModeId: () => modeId,
-    getContextMode: () => String(context.meta["contextWindowMode"] ?? DEFAULT_CONTEXT_WINDOW_MODE_ID),
+    getContextMode: () => String(context.meta["contextWindowMode"] ?? DEFAULT_CONTEXT_WINDOW_MODE_ID2),
     getNeedsSetup: () => needsSetup,
     modelsRegistry
   });
@@ -12155,21 +12660,21 @@ async function startWebUI(opts = {}) {
     wpaths
   }, watcherMetricsRef);
   async function touchProjectEntry(root, workDir) {
-    const resolved = path5.resolve(root);
+    const resolved = path21.resolve(root);
     const manifest = await loadManifest(globalConfigPath);
     const now = (/* @__PURE__ */ new Date()).toISOString();
-    const existing = manifest.projects.find((p) => path5.resolve(p.root) === resolved);
+    const existing = manifest.projects.find((p) => path21.resolve(p.root) === resolved);
     if (existing) {
       existing.lastSeen = now;
-      if (workDir) existing.lastWorkingDir = path5.resolve(workDir);
+      if (workDir) existing.lastWorkingDir = path21.resolve(workDir);
     } else {
       manifest.projects.push({
-        name: path5.basename(resolved),
+        name: path21.basename(resolved),
         root: resolved,
         slug: generateProjectSlug(resolved),
         createdAt: now,
         lastSeen: now,
-        lastWorkingDir: workDir ? path5.resolve(workDir) : void 0
+        lastWorkingDir: workDir ? path21.resolve(workDir) : void 0
       });
     }
     await saveManifest(manifest, globalConfigPath);
@@ -12314,13 +12819,13 @@ async function startWebUI(opts = {}) {
             ...snapshot.apiKey !== void 0 ? { apiKey: snapshot.apiKey } : {},
             ...snapshot.baseUrl !== void 0 ? { baseUrl: snapshot.baseUrl } : {}
           };
-          const newProv = deps2.providerRegistry.has(activeId) ? deps2.providerRegistry.create({ ...providerCfg, type: activeId }) : makeProviderFromConfig(activeId, { ...providerCfg, type: activeId });
+          const newProv = deps2.providerRegistry.has(activeId) ? deps2.providerRegistry.create({ ...providerCfg, type: activeId }) : makeProviderFromConfig3(activeId, { ...providerCfg, type: activeId });
           deps2.context.provider = newProv;
           void updateAutoCompactionMaxContext(newProv).catch(() => void 0);
           console.log(`[WebUI] Provider credentials reloaded from config.json (${activeId})`);
         } catch (err) {
           console.warn(
-            `[WebUI] Credential hot-reload failed for ${activeId}: ${toErrorMessage(err)}`
+            `[WebUI] Credential hot-reload failed for ${activeId}: ${toErrorMessage10(err)}`
           );
         }
       },
@@ -12387,17 +12892,24 @@ async function startWebUI(opts = {}) {
     },
     clients: () => clients.keys(),
     servers: [httpServer, wssPrimary, ...wssSecondary ? [wssSecondary] : []],
-    onShutdown: () => {
+    onShutdown: async () => {
       credentialWatcherClose?.();
       brainMonitor.stop();
-      void mcpRegistry.stopAll().catch(() => void 0);
+      await mcpRegistry.stopAll().catch(() => void 0);
       eventArming.getDispose()?.();
       if (eternalSubscription) {
         eternalSubscription.dispose();
         eternalSubscription = null;
       }
       codebaseIndexing.dispose();
-      return unregisterInstance(process.pid, path5.dirname(globalConfigPath));
+      if (config.superMemory?.enabled !== false && config.superMemory?.hygiene?.autoAfterSession !== false) {
+        const candidate = memoryStore;
+        await candidate.hygiene?.({
+          retentionDays: config.superMemory?.hygiene?.retentionDays,
+          archiveLowConfidenceAfterDays: config.superMemory?.hygiene?.archiveLowConfidenceAfterDays
+        }).catch((err) => logger.warn(`super-memory session hygiene failed: ${toErrorMessage10(err)}`));
+      }
+      await unregisterInstance(process.pid, path21.dirname(globalConfigPath));
     }
   });
 }
@@ -12412,7 +12924,7 @@ function readArg(names) {
       if (current === name2) {
         const next = argv[i + 1];
         if (!next || next.startsWith("-")) {
-          throw new ToolValidationError({ message: `${name2} requires a value`, field: name2 });
+          throw new ToolValidationError6({ message: `${name2} requires a value`, field: name2 });
         }
         return next;
       }
@@ -12425,7 +12937,7 @@ function parsePort(value, fallback, label) {
   if (value === void 0) return fallback;
   const parsed = Number.parseInt(value, 10);
   if (!Number.isInteger(parsed) || parsed <= 0 || parsed > 65535) {
-    throw new ToolValidationError({
+    throw new ToolValidationError6({
       message: `${label} must be a port between 1 and 65535`,
       field: "port"
     });
@@ -12517,4 +13029,3 @@ if (argv.includes("--help") || argv.includes("-h")) {
   });
 }
 //# sourceMappingURL=entry.js.map
-//# sourceMappingURL=entry.js.map