@wrongstack/webui-server 0.284.1 → 0.285.0

package/dist/index.js

@@ -1,34 +1,14 @@
-import { spawn, spawnSync } from 'child_process';
-import { toErrorMessage, wstackGlobalRoot, resolveWstackPaths, atomicWrite as atomicWrite$1 } from '@wrongstack/core/utils';
-import { DefaultSecretScrubber, PhaseStore, PhaseGraphBuilder, WorktreeManager, PhaseOrchestrator, AutoPhasePlanner, assignNickname, getDesignState, getDesignKitLoader, isDesignStack, loadActiveKit, setActiveKit, recordKitChoice, applyTokenOverrides, recordOverrides, setDesignOverrides, materializeTokens, runDesignVerify, ToolValidationError, atomicWrite, allServers, ConfigError, DefaultSecretVault, expectDefined, computeTaskProgress, bootConfig as bootConfig$1, resolveProjectDir, GlobalMailbox, createDefaultPipelines, resolveSessionLoggingConfig, createSessionEventBridge, watchProviderConfig, listContextWindowModes, DefaultModelsRegistry, TOKENS, ProviderRegistry, ToolRegistry, DefaultMemoryStore, EventBus, makeMailboxTool, makeMailSendTool, makeMailInboxTool, makeFleetStatusTool, applyToolDescriptionModes, applyToolResultRenderModes, DefaultSessionStore, getSessionRegistry, DEFAULT_SESSION_PRUNE_DAYS, DefaultSessionReader, AnnotationsStore, FleetNotifier, AgentStatusTracker, DefaultModeStore, DefaultSkillLoader, SkillInstaller, DefaultPromptLoader, PromptUsageStore, DefaultSystemPromptBuilder, Context, resolveContextWindowPolicy, CollaborationBus, collabInjectMiddleware, collabPauseMiddleware, installDesignStudioMiddleware, createStrategyCompactor, AutoCompactionMiddleware, estimateRequestTokensCalibrated, ToolExecutor, DEFAULT_TOOLS_CONFIG, Agent, ObservableBrainArbiter, createTieredBrainArbiter, DefaultBrainArbiter, BrainMonitor, mailboxSessionTag, wstackGlobalRoot as wstackGlobalRoot$1, createAutonomyBrain, DEFAULT_CONTEXT_WINDOW_MODE_ID, repairToolUseAdjacency, resolveWstackPaths as resolveWstackPaths$1, recentTextTurns, gatedEnhancerReasoning, enhanceUserPrompt, resolveProviderModelList, projectSlug, deserializeTaskGraph, serializeTaskGraph } from '@wrongstack/core';
-import * as path5 from 'path';
-import path5__default, { resolve, join, sep, dirname } from 'path';
-import { searchCodebaseIndex } from '@wrongstack/tools/codebase-index/index';
-import { randomBytes, timingSafeEqual, randomUUID } from 'crypto';
-import { WebSocket, WebSocketServer } from 'ws';
-import * as fs4 from 'fs/promises';
-import * as http from 'http';
-import { Buffer } from 'buffer';
-import * as os from 'os';
-import { listMcp, addMcp, updateMcp, removeMcp, enableMcp, disableMcp, restartMcp, discoverMcp, MCPRegistry } from '@wrongstack/mcp';
-import * as net from 'net';
-import { decryptConfigSecrets, encryptConfigSecrets } from '@wrongstack/core/security';
-import { SddBoardStore, applySddLifecycle, SddRunRegistry, SddInterviewDriver, cleanupStaleSddWorktrees, makeCommandVerifier, SddSupervisor, makeLlmSubtaskGenerator, startSddRun, TaskGraphStore, SpecStore } from '@wrongstack/sdd';
-import * as fs12 from 'fs';
-import { promises, watch, existsSync } from 'fs';
-import JSZip from 'jszip';
-import { createRequire } from 'module';
-import { fileURLToPath } from 'url';
-import { capabilitiesFor, makeProviderFromConfig, buildProviderFactoriesFromRegistry, discoverOpenAICompatibleModels, COMPATIBLE_PRESETS } from '@wrongstack/providers';
-import { DefaultTokenCounter } from '@wrongstack/core/infrastructure';
-import { createDefaultContainer, makeLightSubagentFactory } from '@wrongstack/runtime';
-import { runStartupIndex, isIndexableFile, enqueueReindex, cancelPendingReindexes, shutdownCodebaseIndexHost, ensureSessionShell, builtinToolsPack, rememberTool, forgetTool, searchMemoryTool, relatedMemoryTool, configureExecPolicy, configureDangerBypass } from '@wrongstack/tools';
-import { readLiveLock } from '@wrongstack/core/coordination';
-import { removeColumn, addColumn, getTask, removeTask, assignTask, updateGoalMetricOnTask, addGoalMetricToTask, releaseTaskClaim, claimReadyTask, getTaskChain, setTaskChain, copyTaskToBoard, transferTaskToBoard, moveTask, updateTask, mergeTasks, splitTask, addTask, syncBoardFromTaskGraph, exportBoardToTaskGraph, getKanbanOrchestrationSnapshot, listReadyTasks, createBoard, generateBoardFromDescription, parseLinesIntoTasks, getBoard, removeBoard, duplicateBoard, updateBoard, getKanbanQueueHealth, listBoards } from '@wrongstack/kanban';
-import { beginOAuthLogin } from '@wrongstack/providers/oauth';
-import { probeLocalLlm } from '@wrongstack/runtime/probe';
-
 // src/server/autophase-ws-handler.ts
+import { spawnSync } from "node:child_process";
+import { toErrorMessage } from "@wrongstack/core/utils";
+import {
+  assignNickname,
+  AutoPhasePlanner,
+  PhaseGraphBuilder,
+  PhaseOrchestrator,
+  PhaseStore,
+  WorktreeManager
+} from "@wrongstack/core";
 function deriveTitle(goal) {
   const firstLine = goal.split("\n").map((l) => l.trim()).find(Boolean);
   if (!firstLine) return "AutoPhase";
@@ -519,6 +499,14 @@ Type: ${task.type}`;
     }
   }
 };
+
+// src/server/completion-handlers.ts
+import * as path from "node:path";
+import { searchCodebaseIndex } from "@wrongstack/tools/codebase-index/index";
+
+// src/server/ws-utils.ts
+import { randomBytes } from "node:crypto";
+import { WebSocket } from "ws";
 function send(ws, msg) {
   if (ws.readyState === WebSocket.OPEN) {
     ws.send(JSON.stringify(msg));
@@ -650,8 +638,8 @@ async function handleCompletionRequest(ws, msg, opts) {
     return;
   }
   const payload = parsed.payload;
-  const projectRoot = path5.resolve(opts.projectRoot);
-  const resolved = path5.resolve(projectRoot, payload.filePath);
+  const projectRoot = path.resolve(opts.projectRoot);
+  const resolved = path.resolve(projectRoot, payload.filePath);
   if (!isInside(projectRoot, resolved)) {
     send(ws, {
       type: "completion.result",
@@ -1050,7 +1038,7 @@ function buildSearchQuery(linePrefix, filePath) {
   if (memberMatch?.[1]) return memberMatch[1];
   const token = linePrefix.match(/([A-Za-z_$][\w$]*)$/)?.[1];
   if (token && token.length >= 2) return token;
-  return path5.basename(filePath, path5.extname(filePath));
+  return path.basename(filePath, path.extname(filePath));
 }
 function currentLinePrefix(prefix) {
   const idx = Math.max(prefix.lastIndexOf("\n"), prefix.lastIndexOf("\r"));
@@ -1080,11 +1068,16 @@ function head(value, max) {
   return value.length <= max ? value : value.slice(0, max);
 }
 function isInside(root, target) {
-  return target === root || target.startsWith(root + path5.sep);
+  return target === root || target.startsWith(root + path.sep);
 }
+
+// src/server/custom-context-modes.ts
+import { listContextWindowModes, atomicWrite } from "@wrongstack/core";
+import * as fs from "node:fs/promises";
+import * as path2 from "node:path";
 var STORE_FILENAME = "custom-context-modes.json";
 function storePath(wrongstackDir) {
-  return path5.join(wrongstackDir, STORE_FILENAME);
+  return path2.join(wrongstackDir, STORE_FILENAME);
 }
 var BUILTIN_IDS = /* @__PURE__ */ new Set(["balanced", "frugal", "deep", "archival"]);
 function createCustomModeStore(wrongstackDir) {
@@ -1092,7 +1085,7 @@ function createCustomModeStore(wrongstackDir) {
   const load2 = async () => {
     modes.clear();
     try {
-      const raw = await fs4.readFile(storePath(wrongstackDir), "utf8");
+      const raw = await fs.readFile(storePath(wrongstackDir), "utf8");
       const parsed = JSON.parse(raw);
       if (Array.isArray(parsed.modes)) {
         for (const m of parsed.modes) {
@@ -1197,6 +1190,23 @@ function createCustomModeStore(wrongstackDir) {
   };
   return { modes, load: load2, save: save2, create, update, remove, list };
 }
+
+// src/server/design-handlers.ts
+import * as fs2 from "node:fs/promises";
+import * as path3 from "node:path";
+import {
+  applyTokenOverrides,
+  getDesignKitLoader,
+  getDesignState,
+  isDesignStack,
+  loadActiveKit,
+  materializeTokens,
+  recordKitChoice,
+  recordOverrides,
+  runDesignVerify,
+  setActiveKit,
+  setDesignOverrides
+} from "@wrongstack/core";
 function readOverrides(value) {
   const out = {};
   if (value && typeof value === "object") {
@@ -1344,9 +1354,9 @@ async function handleDesignMaterialize(ws, ctx, msg) {
       kitId: active.kit,
       outPath: typeof payload.out === "string" ? payload.out : void 0
     });
-    const abs = path5.join(ctx.projectRoot, result.path);
-    await fs4.mkdir(path5.dirname(abs), { recursive: true });
-    await fs4.writeFile(abs, result.content);
+    const abs = path3.join(ctx.projectRoot, result.path);
+    await fs2.mkdir(path3.dirname(abs), { recursive: true });
+    await fs2.writeFile(abs, result.content);
     send(ws, {
       type: "design.materialize",
       payload: { ok: true, path: result.path, format: result.format, stack }
@@ -1405,6 +1415,11 @@ function createEternalSubscription(subscribe, broadcast2, clientsRef) {
   };
 }
 
+// src/server/file-handlers.ts
+import * as fs4 from "node:fs/promises";
+import * as path5 from "node:path";
+import { atomicWrite as atomicWrite2, ToolValidationError as ToolValidationError2 } from "@wrongstack/core";
+
 // src/server/file-picker.ts
 var SKIP_DIRS = /* @__PURE__ */ new Set([
   ".git",
@@ -1452,15 +1467,20 @@ function rankFiles(paths, query, limit) {
   scored.sort((a, b) => b.score - a.score || a.path.localeCompare(b.path));
   return scored.slice(0, limit).map((s) => s.path);
 }
+
+// src/server/path-containment.ts
+import * as fs3 from "node:fs/promises";
+import * as path4 from "node:path";
+import { ToolValidationError } from "@wrongstack/core";
 function isPathInside(root, target) {
-  const relative4 = path5.relative(root, target);
-  return relative4 === "" || !relative4.startsWith("..") && !path5.isAbsolute(relative4);
+  const relative4 = path4.relative(root, target);
+  return relative4 === "" || !relative4.startsWith("..") && !path4.isAbsolute(relative4);
 }
 async function resolveWorkingDirInsideProject(projectRoot, inputPath) {
-  const resolved = path5.resolve(projectRoot, inputPath);
+  const resolved = path4.resolve(projectRoot, inputPath);
   let stat2;
   try {
-    stat2 = await fs4.stat(resolved);
+    stat2 = await fs3.stat(resolved);
   } catch {
     throw new ToolValidationError({
       message: `Directory not found or not accessible: ${resolved}`,
@@ -1474,8 +1494,8 @@ async function resolveWorkingDirInsideProject(projectRoot, inputPath) {
     });
   }
   const [realProjectRoot, realResolved] = await Promise.all([
-    fs4.realpath(projectRoot),
-    fs4.realpath(resolved)
+    fs3.realpath(projectRoot),
+    fs3.realpath(resolved)
   ]);
   if (!isPathInside(realProjectRoot, realResolved)) {
     throw new ToolValidationError({
@@ -1490,14 +1510,14 @@ async function resolveWorkingDirInsideProject(projectRoot, inputPath) {
 async function resolveFileInsideProject(projectRoot, filePath) {
   const resolved = path5.resolve(projectRoot, filePath);
   if (!isPathInside(projectRoot, resolved)) {
-    throw new ToolValidationError({ message: "Path outside project root", field: "path" });
+    throw new ToolValidationError2({ message: "Path outside project root", field: "path" });
   }
   const { parent, base } = splitParentAndBase(resolved);
   const realProjectRoot = await fs4.realpath(projectRoot);
   const realParent = await realpathAllowMissing(parent);
   const realFull = path5.join(realParent, base);
   if (!isPathInside(realProjectRoot, realFull)) {
-    throw new ToolValidationError({ message: "Path outside project root", field: "path" });
+    throw new ToolValidationError2({ message: "Path outside project root", field: "path" });
   }
   return realFull;
 }
@@ -1517,7 +1537,7 @@ async function realpathAllowMissing(p) {
   while (true) {
     const parent = path5.dirname(cursor);
     if (parent === cursor) {
-      throw new ToolValidationError({ message: "Path outside project root", field: "path" });
+      throw new ToolValidationError2({ message: "Path outside project root", field: "path" });
     }
     segments.unshift(path5.basename(cursor));
     try {
@@ -1650,7 +1670,7 @@ async function handleFilesWrite(ws, msg, projectRoot, opts = {}) {
     return;
   }
   try {
-    await atomicWrite(realResolved, content);
+    await atomicWrite2(realResolved, content);
     send(ws, { type: "files.written", payload: { filePath, success: true } });
     if (opts.onWritten) {
       void Promise.resolve(opts.onWritten(realResolved)).catch(() => void 0);
@@ -1714,10 +1734,13 @@ async function handleFilesList(ws, msg, projectRoot) {
     payload: { files: rankFiles(results, payload.query ?? "", limit) }
   });
 }
+
+// src/server/git-handlers.ts
+import nodePath from "node:path";
 async function handleGitInfo(ws, projectRoot) {
   const cwd = projectRoot || void 0;
   try {
-    const { execFile: ef } = await import('child_process');
+    const { execFile: ef } = await import("node:child_process");
     const git = (args) => new Promise((resolve10) => {
       ef("git", args, { cwd, timeout: 3e3 }, (err, stdout) => {
         resolve10(err ? "" : stdout.trim());
@@ -1745,7 +1768,7 @@ async function handleGitInfo(ws, projectRoot) {
 }
 function makeGit(cwd) {
   return async (args) => {
-    const { execFile: ef } = await import('child_process');
+    const { execFile: ef } = await import("node:child_process");
     return new Promise((resolve10) => {
       ef(
         "git",
@@ -1827,14 +1850,14 @@ var MAX_DIFF_BYTES = 2 * 1024 * 1024;
 async function handleGitDiff(ws, projectRoot, path23) {
   const cwd = projectRoot || void 0;
   const reply = (extra) => send(ws, { type: "git.diff", payload: { path: path23, ...extra } });
-  if (!path23 || path23.includes("\0") || path23.includes("..") || path5__default.isAbsolute(path23)) {
+  if (!path23 || path23.includes("\0") || path23.includes("..") || nodePath.isAbsolute(path23)) {
     reply({ oldText: "", newText: "", error: "invalid path" });
     return;
   }
   try {
     const git = makeGit(cwd);
-    const { readFile: readFile11 } = await import('fs/promises');
-    const { join: join15 } = await import('path');
+    const { readFile: readFile11 } = await import("node:fs/promises");
+    const { join: join15 } = await import("node:path");
     const oldText = await git(["show", `HEAD:${path23}`]);
     let newText = "";
     try {
@@ -1866,6 +1889,11 @@ async function handleGitDiff(ws, projectRoot, path23) {
   }
 }
 
+// src/server/http-server.ts
+import * as fs5 from "node:fs/promises";
+import * as http from "node:http";
+import * as path6 from "node:path";
+
 // src/server/http-server/api-handlers.ts
 async function handleApiSessions(res, globalRoot) {
   if (!globalRoot) {
@@ -1874,7 +1902,7 @@ async function handleApiSessions(res, globalRoot) {
     return;
   }
   try {
-    const { SessionRegistry } = await import('@wrongstack/core');
+    const { SessionRegistry } = await import("@wrongstack/core");
     const registry = new SessionRegistry(globalRoot);
     const sessions = await registry.list();
     const result = sessions.map((s) => ({
@@ -1912,7 +1940,7 @@ async function handleApiSessionAgents(res, globalRoot, sessionId) {
     return;
   }
   try {
-    const { SessionRegistry } = await import('@wrongstack/core');
+    const { SessionRegistry } = await import("@wrongstack/core");
     const registry = new SessionRegistry(globalRoot);
     const entry = await registry.get(sessionId);
     if (!entry) {
@@ -2052,7 +2080,7 @@ async function handleApiSessionEvents(res, globalRoot, sessionId, limit) {
     return;
   }
   try {
-    const { SessionRegistry, resolveWstackPaths: resolveWstackPaths3, DefaultSessionStore: DefaultSessionStore2, DefaultSessionReader: DefaultSessionReader2 } = await import('@wrongstack/core');
+    const { SessionRegistry, resolveWstackPaths: resolveWstackPaths3, DefaultSessionStore: DefaultSessionStore2, DefaultSessionReader: DefaultSessionReader2 } = await import("@wrongstack/core");
     const registry = new SessionRegistry(globalRoot);
     const entry = await registry.get(sessionId);
     if (!entry) {
@@ -2134,7 +2162,7 @@ async function handleApiSessionMessage(res, req, globalRoot, sessionId) {
   const priority = ["low", "normal", "high"].includes(rawPriority) ? rawPriority : "high";
   const subject = typeof body["subject"] === "string" && body["subject"].trim() ? body["subject"].trim() : "Message from Fleet HQ";
   try {
-    const { SessionRegistry, resolveWstackPaths: resolveWstackPaths3, GlobalMailbox: GlobalMailbox4, mailboxSessionTag: mailboxSessionTag2 } = await import('@wrongstack/core');
+    const { SessionRegistry, resolveWstackPaths: resolveWstackPaths3, GlobalMailbox: GlobalMailbox4, mailboxSessionTag: mailboxSessionTag2 } = await import("@wrongstack/core");
     const registry = new SessionRegistry(globalRoot);
     const entry = await registry.get(sessionId);
     if (!entry) {
@@ -2160,7 +2188,7 @@ async function handleApiSessionMailbox(res, globalRoot, sessionId) {
     return;
   }
   try {
-    const { SessionRegistry, resolveWstackPaths: resolveWstackPaths3, GlobalMailbox: GlobalMailbox4, mailboxSessionTag: mailboxSessionTag2 } = await import('@wrongstack/core');
+    const { SessionRegistry, resolveWstackPaths: resolveWstackPaths3, GlobalMailbox: GlobalMailbox4, mailboxSessionTag: mailboxSessionTag2 } = await import("@wrongstack/core");
     const registry = new SessionRegistry(globalRoot);
     const entry = await registry.get(sessionId);
     if (!entry) {
@@ -2218,7 +2246,7 @@ async function handleApiSessionInterrupt(res, req, globalRoot, sessionId) {
   const reason = typeof body["reason"] === "string" && body["reason"].trim() ? body["reason"].trim() : "Operator requested stop from Fleet HQ";
   const from = typeof body["from"] === "string" && body["from"].trim() ? body["from"].trim() : "human@webui";
   try {
-    const { SessionRegistry, resolveWstackPaths: resolveWstackPaths3, GlobalMailbox: GlobalMailbox4, mailboxSessionTag: mailboxSessionTag2 } = await import('@wrongstack/core');
+    const { SessionRegistry, resolveWstackPaths: resolveWstackPaths3, GlobalMailbox: GlobalMailbox4, mailboxSessionTag: mailboxSessionTag2 } = await import("@wrongstack/core");
     const registry = new SessionRegistry(globalRoot);
     const entry = await registry.get(sessionId);
     if (!entry) {
@@ -2266,7 +2294,7 @@ async function handleApiFleetBroadcast(res, req, globalRoot) {
   }
   const from = typeof body["from"] === "string" && body["from"].trim() ? body["from"].trim() : "human@webui";
   try {
-    const { SessionRegistry, resolveWstackPaths: resolveWstackPaths3, GlobalMailbox: GlobalMailbox4, mailboxSessionTag: mailboxSessionTag2 } = await import('@wrongstack/core');
+    const { SessionRegistry, resolveWstackPaths: resolveWstackPaths3, GlobalMailbox: GlobalMailbox4, mailboxSessionTag: mailboxSessionTag2 } = await import("@wrongstack/core");
     const registry = new SessionRegistry(globalRoot);
     const all = await registry.list();
     const mySlug = all.find((s) => s.pid === process.pid)?.projectSlug;
@@ -2422,6 +2450,10 @@ function clearAnalyticsBuffer() {
 function getAnalyticsBuffer() {
   return [...EVENT_BUFFER];
 }
+
+// src/server/ws-auth.ts
+import { Buffer as Buffer2 } from "node:buffer";
+import { timingSafeEqual } from "node:crypto";
 function isLoopbackHostname(hostname) {
   return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1" || hostname === "[::1]";
 }
@@ -2450,8 +2482,8 @@ function allowedHostname(hostname, allowedHostnames) {
 }
 function tokenMatches(provided, expected) {
   if (!provided) return false;
-  const a = Buffer.from(provided);
-  const b = Buffer.from(expected);
+  const a = Buffer2.from(provided);
+  const b = Buffer2.from(expected);
   if (a.length !== b.length) return false;
   return timingSafeEqual(a, b);
 }
@@ -2607,9 +2639,9 @@ function buildCspHeader(wsPort, requestHost, publicWsUrl) {
   return `default-src 'self'; script-src ${scriptSrc}; style-src 'self' 'unsafe-inline'; connect-src ${Array.from(connect).join(" ")}; img-src 'self' data:; font-src 'self' data:; worker-src 'self' blob:; object-src 'none'; base-uri 'self'; frame-ancestors 'none'; form-action 'self'`;
 }
 function isInsideDist(candidate, distDir) {
-  const root = path5.resolve(distDir);
-  const resolved = path5.resolve(candidate);
-  return resolved === root || resolved.startsWith(root + path5.sep);
+  const root = path6.resolve(distDir);
+  const resolved = path6.resolve(candidate);
+  return resolved === root || resolved.startsWith(root + path6.sep);
 }
 function decodeSessionId(segment) {
   try {
@@ -2620,7 +2652,7 @@ function decodeSessionId(segment) {
 }
 function createHttpServer(opts) {
   const port = opts.port ?? Number.parseInt(process.env["PORT"] ?? "3456", 10);
-  const distDir = path5.resolve(opts.distDir);
+  const distDir = path6.resolve(opts.distDir);
   const wsPort = opts.wsPort;
   const requireAccessToken = Boolean(opts.requireToken) || !isLoopbackBind(opts.host);
   return http.createServer(async (req, res) => {
@@ -2797,21 +2829,21 @@ function createHttpServer(opts) {
       }
       let filePath;
       if (url.pathname === "/" || url.pathname === "") {
-        filePath = path5.join(distDir, "index.html");
+        filePath = path6.join(distDir, "index.html");
       } else if (url.pathname.startsWith("/assets/")) {
-        filePath = path5.join(distDir, url.pathname);
+        filePath = path6.join(distDir, url.pathname);
       } else if (url.pathname.startsWith("/")) {
-        filePath = path5.join(distDir, url.pathname);
+        filePath = path6.join(distDir, url.pathname);
       } else {
-        filePath = path5.join(distDir, "index.html");
+        filePath = path6.join(distDir, "index.html");
       }
-      const resolvedPath = path5.resolve(filePath);
+      const resolvedPath = path6.resolve(filePath);
       if (!isInsideDist(resolvedPath, distDir)) {
         res.writeHead(403, { "Content-Type": "text/plain" });
         res.end("Forbidden");
         return;
       }
-      const ext = path5.extname(resolvedPath);
+      const ext = path6.extname(resolvedPath);
       const contentType = MIME_TYPES[ext] ?? "application/octet-stream";
       res.setHeader("Content-Type", contentType);
       res.setHeader("X-Content-Type-Options", "nosniff");
@@ -2823,18 +2855,18 @@ function createHttpServer(opts) {
           "Content-Security-Policy",
           buildCspHeader(wsPort, requestHostForCsp(req.headers.host), opts.publicWsUrl)
         );
-        const html = await fs4.readFile(resolvedPath, "utf8");
+        const html = await fs5.readFile(resolvedPath, "utf8");
         res.writeHead(200);
         res.end(injectWsConfig(html, { wsPort, publicWsUrl: opts.publicWsUrl }));
         return;
       }
-      const fileContent = await fs4.readFile(resolvedPath);
+      const fileContent = await fs5.readFile(resolvedPath);
       res.writeHead(200);
       res.end(fileContent);
     } catch (err) {
       if (err.code === "ENOENT") {
         try {
-          const html = await fs4.readFile(path5.join(distDir, "index.html"), "utf8");
+          const html = await fs5.readFile(path6.join(distDir, "index.html"), "utf8");
           res.writeHead(200, {
             "Content-Type": "text/html",
             "X-Content-Type-Options": "nosniff",
@@ -2858,11 +2890,17 @@ function createHttpServer(opts) {
     }
   });
 }
+
+// src/server/instance-registry.ts
+import * as os from "node:os";
+import * as path7 from "node:path";
+import * as fs6 from "node:fs/promises";
+import { atomicWrite as atomicWrite3 } from "@wrongstack/core";
 function defaultBaseDir() {
-  return path5.join(os.homedir(), ".wrongstack");
+  return path7.join(os.homedir(), ".wrongstack");
 }
 function registryPath(baseDir = defaultBaseDir()) {
-  return path5.join(baseDir, "webui-instances.json");
+  return path7.join(baseDir, "webui-instances.json");
 }
 function isPidAlive(pid) {
   if (!Number.isInteger(pid) || pid <= 0) return false;
@@ -2875,7 +2913,7 @@ function isPidAlive(pid) {
 }
 async function load(file) {
   try {
-    const raw = await fs4.readFile(file, "utf8");
+    const raw = await fs6.readFile(file, "utf8");
     const parsed = JSON.parse(raw);
     if (parsed?.version === 1 && Array.isArray(parsed.instances)) {
       return parsed;
@@ -2885,7 +2923,7 @@ async function load(file) {
   return { version: 1, instances: [] };
 }
 async function save(file, instances) {
-  await atomicWrite(file, `${JSON.stringify({ version: 1, instances }, null, 2)}
+  await atomicWrite3(file, `${JSON.stringify({ version: 1, instances }, null, 2)}
 `, {
     mode: 384
   });
@@ -2930,6 +2968,19 @@ function formatInstances(instances) {
   }
   return lines.join("\n");
 }
+
+// src/server/mcp-handlers.ts
+import { allServers } from "@wrongstack/core";
+import {
+  addMcp,
+  disableMcp,
+  discoverMcp,
+  enableMcp,
+  listMcp,
+  removeMcp,
+  restartMcp,
+  updateMcp
+} from "@wrongstack/mcp";
 function mapStatus(raw) {
   switch (raw) {
     case "connected":
@@ -3167,6 +3218,9 @@ async function handleMemoryForget(ws, msg, memoryStore) {
     sendResult(ws, false, errMessage(err));
   }
 }
+
+// src/server/open-browser.ts
+import { spawn } from "node:child_process";
 function browserOpenCommand(url, platform = process.platform) {
   if (platform === "win32") {
     return { command: "cmd", args: ["/c", "start", "", url] };
@@ -3185,7 +3239,7 @@ function openBrowser(url, platform = process.platform) {
     child.unref();
     if (child.pid) {
       try {
-        import('@wrongstack/tools').then(({ getProcessRegistry }) => {
+        import("@wrongstack/tools").then(({ getProcessRegistry }) => {
           const pid = child.pid;
           if (pid === void 0) return;
           getProcessRegistry().register({
@@ -3207,6 +3261,10 @@ function openBrowser(url, platform = process.platform) {
   } catch {
   }
 }
+
+// src/server/port-utils.ts
+import * as net from "node:net";
+import { ToolValidationError as ToolValidationError3 } from "@wrongstack/core";
 function isPortFree(host, port) {
   return new Promise((resolve10) => {
     const srv = net.createServer();
@@ -3232,7 +3290,7 @@ async function findFreePort(host, startPort, opts = {}) {
     }
     port++;
   }
-  throw new ToolValidationError({
+  throw new ToolValidationError3({
     message: `No free port found near ${startPort} on ${host} after ${maxTries} attempts.`,
     field: "port"
   });
@@ -3442,10 +3500,19 @@ async function handlePromptsRecent(ws, ctx) {
     send(ws, { type: "prompts.recent", payload: { slugs: [], error: errMessage(err) } });
   }
 }
+
+// src/server/provider-config-standalone.ts
+import * as path8 from "node:path";
+import { DefaultSecretVault } from "@wrongstack/core";
+
+// src/server/provider-config-io.ts
+import * as fs7 from "node:fs/promises";
+import { ConfigError, atomicWrite as atomicWrite4 } from "@wrongstack/core";
+import { decryptConfigSecrets, encryptConfigSecrets } from "@wrongstack/core/security";
 async function loadSavedProviders(configPath, vault) {
   let raw;
   try {
-    raw = await fs4.readFile(configPath, "utf8");
+    raw = await fs7.readFile(configPath, "utf8");
   } catch {
     return {};
   }
@@ -3462,7 +3529,7 @@ async function saveProviders(configPath, vault, providers) {
   let raw;
   let fileExists = true;
   try {
-    raw = await fs4.readFile(configPath, "utf8");
+    raw = await fs7.readFile(configPath, "utf8");
   } catch (err) {
     if (err.code !== "ENOENT") {
       throw new ConfigError({
@@ -3491,16 +3558,21 @@ async function saveProviders(configPath, vault, providers) {
   }
   parsed.providers = providers;
   const encrypted = encryptConfigSecrets(parsed, vault);
-  await atomicWrite(configPath, JSON.stringify(encrypted, null, 2), { mode: 384 });
+  await atomicWrite4(configPath, JSON.stringify(encrypted, null, 2), { mode: 384 });
 }
+
+// src/server/provider-config-standalone.ts
 function createProviderConfigIO(configPath) {
-  const keyFile = path5.join(path5.dirname(configPath), ".key");
+  const keyFile = path8.join(path8.dirname(configPath), ".key");
   const vault = new DefaultSecretVault({ keyFile });
   return {
     load: () => loadSavedProviders(configPath, vault),
     save: (providers) => saveProviders(configPath, vault, providers)
   };
 }
+
+// src/server/provider-keys.ts
+import { expectDefined } from "@wrongstack/core";
 function normalizeKeys(cfg) {
   if (Array.isArray(cfg.apiKeys) && cfg.apiKeys.length > 0) {
     return cfg.apiKeys.map((k) => ({ ...k }));
@@ -3594,6 +3666,12 @@ function removeProvider(providers, providerId) {
   delete providers[providerId];
   return { ok: true, message: `Provider "${providerId}" removed` };
 }
+
+// src/server/sdd-board-ws-handler.ts
+import {
+  applySddLifecycle,
+  SddBoardStore
+} from "@wrongstack/sdd";
 var CONTROL_TYPES = /* @__PURE__ */ new Set([
   "pause",
   "resume",
@@ -3738,6 +3816,26 @@ var SddBoardWebSocketHandler = class {
     if (client.ws.readyState === 1) client.ws.send(JSON.stringify(msg));
   }
 };
+
+// src/server/sdd-wizard-wiring.ts
+import * as path9 from "node:path";
+import { spawnSync as spawnSync2 } from "node:child_process";
+import {
+  WorktreeManager as WorktreeManager2,
+  ToolValidationError as ToolValidationError4
+} from "@wrongstack/core";
+import {
+  cleanupStaleSddWorktrees,
+  makeCommandVerifier,
+  makeLlmSubtaskGenerator,
+  SddBoardStore as SddBoardStore2,
+  SddInterviewDriver,
+  SddRunRegistry,
+  SddSupervisor,
+  SpecStore,
+  startSddRun,
+  TaskGraphStore
+} from "@wrongstack/sdd";
 var PLANNING_ONLY_GUARD = "SYSTEM: You are running a PLANNING-ONLY specification interview. Do NOT write, create, or edit any files, and do NOT run shell/terminal commands or use any code-editing tools \u2014 they are disabled here and any attempt will fail and waste the turn. Respond with TEXT ONLY: ask your question, or emit the requested spec / plan / task JSON. All code is written later, automatically, once the plan is approved and the multi-agent run starts.\n\n---\n\n";
 function buildSddWizardDeps(opts) {
   const registry = new SddRunRegistry();
@@ -3761,14 +3859,14 @@ function buildSddWizardDeps(opts) {
     makeDriver: () => new SddInterviewDriver({
       specStore: new SpecStore({ baseDir: opts.paths.projectSpecs }),
       graphStore: new TaskGraphStore({ baseDir: opts.paths.projectTaskGraphs }),
-      sessionPath: path5.join(opts.paths.projectDir, "sdd-wizard-session.json")
+      sessionPath: path9.join(opts.paths.projectDir, "sdd-wizard-session.json")
     }),
     runInterviewTurn: (prompt) => runIsolatedTurn(prompt, "Spec Architect"),
     startRun: async (driver, { parallelSlots, defaultModel, defaultProvider, fallbackModels, worktrees: useWorktrees }) => {
       const graph = driver.getGraph();
       const tracker = driver.getTracker();
       if (!graph || !tracker) {
-        throw new ToolValidationError({
+        throw new ToolValidationError4({
           message: "No task graph to run \u2014 finish the interview first.",
           field: "taskGraph"
         });
@@ -3776,7 +3874,7 @@ function buildSddWizardDeps(opts) {
       const worktreesEnabled = useWorktrees ?? process.env["WRONGSTACK_SDD_WORKTREES"] !== "0";
       let worktrees;
       if (worktreesEnabled) {
-        const inGit = spawnSync("git", ["rev-parse", "--is-inside-work-tree"], {
+        const inGit = spawnSync2("git", ["rev-parse", "--is-inside-work-tree"], {
           cwd: opts.projectRoot,
           encoding: "utf8",
           windowsHide: true
@@ -3786,14 +3884,14 @@ function buildSddWizardDeps(opts) {
             projectRoot: opts.projectRoot,
             boardsDir: opts.paths.projectSddBoards
           }).catch(() => void 0);
-          worktrees = new WorktreeManager({
+          worktrees = new WorktreeManager2({
             projectRoot: opts.projectRoot,
             events: opts.events,
             sessionId: () => opts.agent.ctx.session?.id
           });
         }
       }
-      const boardStore = new SddBoardStore({ baseDir: opts.paths.projectSddBoards });
+      const boardStore = new SddBoardStore2({ baseDir: opts.paths.projectSddBoards });
       const verifyTask = makeCommandVerifier();
       const superviseFailure = opts.brain ? new SddSupervisor({
         brain: opts.brain,
@@ -3973,20 +4071,25 @@ var SddWizardWebSocketHandler = class {
     if (client.ws.readyState === 1) client.ws.send(JSON.stringify(msg));
   }
 };
+
+// src/server/shell-open.ts
+import * as fs8 from "node:fs/promises";
+import * as path10 from "node:path";
+import { spawn as spawn2 } from "node:child_process";
 var METACHAR_REGEX = /[&|<>^"'`'\n\r]/;
 function shellQuote(s) {
   return s.replaceAll("'", `'"'"'`);
 }
 async function handleShellOpen(req, logger) {
   try {
-    const resolved = path5.resolve(req.path);
-    await fs4.access(resolved);
+    const resolved = path10.resolve(req.path);
+    await fs8.access(resolved);
     if (METACHAR_REGEX.test(resolved)) {
       return { success: false, message: "Path contains unsupported characters." };
     }
     const platform = process.platform;
     const launch = (cmd, args, onError) => {
-      const child = spawn(cmd, args, {
+      const child = spawn2(cmd, args, {
         detached: true,
         stdio: "ignore",
         windowsHide: true
@@ -4030,6 +4133,12 @@ async function handleShellOpen(req, logger) {
   }
 }
 
+// src/server/skills-handlers.ts
+import { promises as fs9 } from "node:fs";
+import path11 from "node:path";
+import { atomicWrite as atomicWrite5 } from "@wrongstack/core";
+import { wstackGlobalRoot } from "@wrongstack/core/utils";
+
 // src/server/ws-payload-validation.ts
 function isRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -4624,6 +4733,123 @@ function validateProjectsSelectPayload(payload) {
   };
 }
 
+// src/server/zip.ts
+import { deflateRawSync, inflateRawSync } from "node:zlib";
+function createZipBuffer(entries) {
+  const localParts = [];
+  const centralParts = [];
+  let offset = 0;
+  const { date, time } = dosDateTime(/* @__PURE__ */ new Date());
+  for (const entry of entries) {
+    const name2 = Buffer.from(normalizeZipPath(entry.name), "utf8");
+    const data = typeof entry.data === "string" ? Buffer.from(entry.data, "utf8") : Buffer.from(entry.data);
+    const compressed = deflateRawSync(data);
+    const crc = crc32(data);
+    const local = Buffer.alloc(30);
+    local.writeUInt32LE(67324752, 0);
+    local.writeUInt16LE(20, 4);
+    local.writeUInt16LE(2048, 6);
+    local.writeUInt16LE(8, 8);
+    local.writeUInt16LE(time, 10);
+    local.writeUInt16LE(date, 12);
+    local.writeUInt32LE(crc, 14);
+    local.writeUInt32LE(compressed.length, 18);
+    local.writeUInt32LE(data.length, 22);
+    local.writeUInt16LE(name2.length, 26);
+    localParts.push(local, name2, compressed);
+    const central = Buffer.alloc(46);
+    central.writeUInt32LE(33639248, 0);
+    central.writeUInt16LE(798, 4);
+    central.writeUInt16LE(20, 6);
+    central.writeUInt16LE(2048, 8);
+    central.writeUInt16LE(8, 10);
+    central.writeUInt16LE(time, 12);
+    central.writeUInt16LE(date, 14);
+    central.writeUInt32LE(crc, 16);
+    central.writeUInt32LE(compressed.length, 20);
+    central.writeUInt32LE(data.length, 24);
+    central.writeUInt16LE(name2.length, 28);
+    central.writeUInt32LE(offset, 42);
+    centralParts.push(central, name2);
+    offset += local.length + name2.length + compressed.length;
+  }
+  const centralDirectory = Buffer.concat(centralParts);
+  const end = Buffer.alloc(22);
+  end.writeUInt32LE(101010256, 0);
+  end.writeUInt16LE(entries.length, 8);
+  end.writeUInt16LE(entries.length, 10);
+  end.writeUInt32LE(centralDirectory.length, 12);
+  end.writeUInt32LE(offset, 16);
+  return Buffer.concat([...localParts, centralDirectory, end]);
+}
+function readZipEntries(archive) {
+  const maxEntries = 1e3;
+  const maxEntryBytes = 64 * 1024 * 1024;
+  const maxTotalBytes = 128 * 1024 * 1024;
+  const buffer = Buffer.from(archive);
+  const result = /* @__PURE__ */ new Map();
+  let totalBytes = 0;
+  let offset = 0;
+  while (offset + 4 <= buffer.length && buffer.readUInt32LE(offset) === 67324752) {
+    if (offset + 30 > buffer.length) throw new Error("Truncated ZIP local header.");
+    const flags = buffer.readUInt16LE(offset + 6);
+    const method = buffer.readUInt16LE(offset + 8);
+    if ((flags & 1) !== 0) throw new Error("Encrypted ZIP entries are not supported.");
+    if ((flags & 8) !== 0) throw new Error("ZIP data descriptors are not supported.");
+    const compressedSize = buffer.readUInt32LE(offset + 18);
+    const expectedSize = buffer.readUInt32LE(offset + 22);
+    if (result.size >= maxEntries) throw new Error("ZIP contains too many entries.");
+    if (expectedSize > maxEntryBytes || totalBytes + expectedSize > maxTotalBytes) {
+      throw new Error("ZIP expands beyond the configured size limit.");
+    }
+    if (compressedSize > 0 && expectedSize / compressedSize > 1e3) {
+      throw new Error("ZIP entry has a suspicious compression ratio.");
+    }
+    const nameLength = buffer.readUInt16LE(offset + 26);
+    const extraLength = buffer.readUInt16LE(offset + 28);
+    const nameStart = offset + 30;
+    const dataStart = nameStart + nameLength + extraLength;
+    const dataEnd = dataStart + compressedSize;
+    if (dataEnd > buffer.length) throw new Error("Truncated ZIP entry.");
+    const name2 = buffer.subarray(nameStart, nameStart + nameLength).toString("utf8");
+    if (!isSafeZipPath(name2)) throw new Error(`Unsafe ZIP entry path: ${name2}`);
+    const compressed = buffer.subarray(dataStart, dataEnd);
+    const data = method === 0 ? Buffer.from(compressed) : method === 8 ? inflateRawSync(compressed) : void 0;
+    if (!data) throw new Error(`Unsupported ZIP compression method: ${method}`);
+    if (data.length !== expectedSize) throw new Error(`ZIP size mismatch for ${name2}`);
+    if (crc32(data) !== buffer.readUInt32LE(offset + 14)) throw new Error(`ZIP CRC mismatch for ${name2}`);
+    result.set(name2, data);
+    totalBytes += data.length;
+    offset = dataEnd;
+  }
+  return result;
+}
+function normalizeZipPath(value) {
+  const normalized = value.replace(/\\/g, "/").replace(/^\/+/, "");
+  if (!isSafeZipPath(normalized)) throw new Error(`Unsafe ZIP entry path: ${value}`);
+  return normalized;
+}
+function isSafeZipPath(value) {
+  return value.length > 0 && !value.includes("\0") && !value.startsWith("/") && !/^[a-z]:/i.test(value) && !value.split("/").includes("..");
+}
+function dosDateTime(value) {
+  const year = Math.max(1980, Math.min(2107, value.getFullYear()));
+  return {
+    date: year - 1980 << 9 | value.getMonth() + 1 << 5 | value.getDate(),
+    time: value.getHours() << 11 | value.getMinutes() << 5 | Math.floor(value.getSeconds() / 2)
+  };
+}
+var CRC_TABLE = Array.from({ length: 256 }, (_, index) => {
+  let crc = index;
+  for (let bit = 0; bit < 8; bit++) crc = (crc & 1) !== 0 ? 3988292384 ^ crc >>> 1 : crc >>> 1;
+  return crc >>> 0;
+});
+function crc32(data) {
+  let crc = 4294967295;
+  for (const byte of data) crc = crc >>> 8 ^ (CRC_TABLE[(crc ^ byte) & 255] ?? 0);
+  return (crc ^ 4294967295) >>> 0;
+}
+
 // src/server/skills-handlers.ts
 async function handleSkillsList(ws, ctx) {
   if (!ctx.skillLoader) {
@@ -4692,19 +4918,19 @@ async function handleSkillsContent(ws, ctx, msg) {
       send(ws, { type: "skills.content", payload: { name: name2, body: "", path: "", source, relatedFiles: [], references: [], error: `Skill "${name2}" not found` } });
       return;
     }
-    const body = await promises.readFile(entry.path, "utf8");
-    const skillDir = path5__default.dirname(entry.path);
+    const body = await fs9.readFile(entry.path, "utf8");
+    const skillDir = path11.dirname(entry.path);
     let relatedFiles = [];
     try {
-      const files = await promises.readdir(skillDir);
-      relatedFiles = files.filter((f) => f !== path5__default.basename(entry.path)).map((f) => path5__default.join(skillDir, f));
+      const files = await fs9.readdir(skillDir);
+      relatedFiles = files.filter((f) => f !== path11.basename(entry.path)).map((f) => path11.join(skillDir, f));
     } catch {
     }
     const nameLower = name2.toLowerCase();
     const refResults = await Promise.all(
       entries.filter((e) => e.name.toLowerCase() !== nameLower).map(async (e) => {
         try {
-          const content = await promises.readFile(e.path, "utf8");
+          const content = await fs9.readFile(e.path, "utf8");
           return [e.name, content.toLowerCase().includes(nameLower)];
         } catch {
           return [e.name, false];
@@ -4794,20 +5020,20 @@ async function handleSkillsCreate(ws, ctx, msg) {
   }
   const createPayload = parsed.value;
   try {
-    const targetDir = createPayload.scope === "global" ? path5__default.join(
-      ctx.globalSkillsDir ?? path5__default.join(wstackGlobalRoot(), "skills"),
+    const targetDir = createPayload.scope === "global" ? path11.join(
+      ctx.globalSkillsDir ?? path11.join(wstackGlobalRoot(), "skills"),
       createPayload.name.trim()
-    ) : path5__default.join(
-      ctx.projectSkillsDir ?? path5__default.join(ctx.projectRoot, ".wrongstack", "skills"),
+    ) : path11.join(
+      ctx.projectSkillsDir ?? path11.join(ctx.projectRoot, ".wrongstack", "skills"),
       createPayload.name.trim()
     );
     try {
-      await promises.access(targetDir);
+      await fs9.access(targetDir);
       send(ws, { type: "skills.created", payload: { success: false, error: `Skill "${createPayload.name}" already exists` } });
       return;
     } catch {
     }
-    await promises.mkdir(targetDir, { recursive: true });
+    await fs9.mkdir(targetDir, { recursive: true });
     const lines = createPayload.description.trim().split("\n");
     const firstLine = (lines[0] ?? "").trim();
     const bodyLines = lines.slice(1).map((l) => l.trim()).filter(Boolean);
@@ -4855,13 +5081,13 @@ ${trigger}
       "- `bug-hunter` \u2014 for systematic bug detection patterns",
       "- `output-standards` \u2014 for standardized `<nextsteps>` formatting"
     ].join("\n");
-    await atomicWrite(path5__default.join(targetDir, "SKILL.md"), skillContent);
+    await atomicWrite5(path11.join(targetDir, "SKILL.md"), skillContent);
     send(ws, {
       type: "skills.created",
       payload: {
         success: true,
         error: null,
-        skill: { name: createPayload.name.trim(), path: path5__default.join(targetDir, "SKILL.md"), scope: createPayload.scope }
+        skill: { name: createPayload.name.trim(), path: path11.join(targetDir, "SKILL.md"), scope: createPayload.scope }
       }
     });
   } catch (err) {
@@ -4891,7 +5117,7 @@ async function handleSkillsEdit(ws, ctx, msg) {
       send(ws, { type: "skills.edited", payload: { success: false, error: `${label} skills cannot be edited` } });
       return;
     }
-    await atomicWrite(entry.path, editPayload.body);
+    await atomicWrite5(entry.path, editPayload.body);
     send(ws, { type: "skills.edited", payload: { success: true, error: null } });
   } catch (err) {
     send(ws, { type: "skills.edited", payload: { success: false, error: errMessage(err) } });
@@ -4904,29 +5130,35 @@ async function handleSkillsExport(ws, ctx) {
   }
   try {
     const entries = await ctx.skillLoader.listEntries();
-    const zip = new JSZip();
+    const zipEntries = [];
     for (const entry of entries) {
       try {
         const body = await ctx.skillLoader.readBody(entry.name);
         const safeName = entry.name.replace(/\//g, "_");
-        zip.file(`${safeName}/SKILL.md`, body);
+        zipEntries.push({ name: `${safeName}/SKILL.md`, data: body });
       } catch {
       }
     }
-    const zipBuffer = await zip.generateAsync({ type: "nodebuffer", compression: "DEFLATE" });
+    const zipBuffer = createZipBuffer(zipEntries);
     const zipBase64 = zipBuffer.toString("base64");
     send(ws, { type: "skills.exported", payload: { zipBase64, skillCount: entries.length, error: void 0 } });
   } catch (err) {
     send(ws, { type: "skills.exported", payload: { zipBase64: "", skillCount: 0, error: errMessage(err) } });
   }
 }
+
+// src/server/specs-ws-handler.ts
+import {
+  computeTaskProgress
+} from "@wrongstack/core";
+import { SpecStore as SpecStore2, TaskGraphStore as TaskGraphStore2 } from "@wrongstack/sdd";
 var SpecsWebSocketHandler = class {
   specStore;
   graphStore;
   clients = /* @__PURE__ */ new Set();
   constructor(specsDir, taskGraphsDir) {
-    this.specStore = new SpecStore({ baseDir: specsDir });
-    this.graphStore = new TaskGraphStore({ baseDir: taskGraphsDir });
+    this.specStore = new SpecStore2({ baseDir: specsDir });
+    this.graphStore = new TaskGraphStore2({ baseDir: taskGraphsDir });
   }
   addClient(ws) {
     const client = { ws, id: crypto.randomUUID() };
@@ -5130,6 +5362,13 @@ function estimateContextBreakdown(input) {
     messages: { total: msgTokens, count: input.messages.length, breakdown: messageBreakdown }
   };
 }
+
+// src/server/worktree-ws-handler.ts
+import { join as join8, resolve as resolve6, sep as sep3 } from "node:path";
+import { WorktreeManager as WorktreeManager3 } from "@wrongstack/core";
+import { cleanupStaleSddWorktrees as cleanupStaleSddWorktrees2 } from "@wrongstack/sdd";
+import { toErrorMessage as toErrorMessage2 } from "@wrongstack/core/utils";
+var MAX_ACTIVITY = 6;
 var ACTIVE_STATUSES = /* @__PURE__ */ new Set(["allocating", "active", "committing", "merging"]);
 var MANAGED_BRANCH_RE = /^wstack\/ap\/[A-Za-z0-9._/-]+$/;
 var WorktreeWebSocketHandler = class {
@@ -5186,13 +5425,13 @@ var WorktreeWebSocketHandler = class {
   // ── orphan management ─────────────────────────────────────────────────────
   /** Absolute managed-worktrees root for this project. */
   worktreesRoot() {
-    return resolve(join(this.management.projectRoot, ".wrongstack", "worktrees"));
+    return resolve6(join8(this.management.projectRoot, ".wrongstack", "worktrees"));
   }
   /** True iff `dir` resolves strictly inside the managed worktrees root. */
   underRoot(dir) {
-    const abs = resolve(dir);
+    const abs = resolve6(dir);
     const root = this.worktreesRoot();
-    return abs !== root && abs.startsWith(root + sep);
+    return abs !== root && abs.startsWith(root + sep3);
   }
   /** Branches of worktrees a live in-session run currently owns. */
   liveActiveBranches() {
@@ -5213,7 +5452,7 @@ var WorktreeWebSocketHandler = class {
       return;
     }
     try {
-      const wt = new WorktreeManager({ projectRoot: this.management.projectRoot });
+      const wt = new WorktreeManager3({ projectRoot: this.management.projectRoot });
       const { worktrees, branches } = await wt.listManaged();
       const live = this.liveActiveBranches();
       const orphans = [];
@@ -5237,7 +5476,7 @@ var WorktreeWebSocketHandler = class {
         }
       });
     } catch (err) {
-      this.logger.debug?.(`worktree orphan scan failed: ${toErrorMessage(err)}`);
+      this.logger.debug?.(`worktree orphan scan failed: ${toErrorMessage2(err)}`);
       this.broadcast({ type: "worktree.orphans", payload: { orphans: [], canClean: false } });
     }
   }
@@ -5261,7 +5500,7 @@ var WorktreeWebSocketHandler = class {
       });
       return;
     }
-    const res = await cleanupStaleSddWorktrees({
+    const res = await cleanupStaleSddWorktrees2({
       projectRoot: this.management.projectRoot,
       boardsDir: this.management.boardsDir
     });
@@ -5300,7 +5539,7 @@ var WorktreeWebSocketHandler = class {
     }
     let removed = false;
     if (dir) {
-      const wt = new WorktreeManager({ projectRoot: this.management.projectRoot });
+      const wt = new WorktreeManager3({ projectRoot: this.management.projectRoot });
       ({ removed } = await wt.removeOne(dir, branch));
     }
     for (const [id, h] of [...this.handles]) {
@@ -5324,7 +5563,7 @@ var WorktreeWebSocketHandler = class {
       this.broadcast({ type: "worktree.merge_result", payload: { ok: false, branch, reason: "a run is live on this worktree \u2014 stop it first" } });
       return;
     }
-    const wt = new WorktreeManager({ projectRoot: this.management.projectRoot });
+    const wt = new WorktreeManager3({ projectRoot: this.management.projectRoot });
     const res = await wt.mergeBranch(branch);
     this.broadcast({
       type: "worktree.merge_result",
@@ -5339,8 +5578,8 @@ var WorktreeWebSocketHandler = class {
       return;
     }
     const base = baseBranch && MANAGED_BRANCH_RE.test(baseBranch) ? baseBranch : void 0;
-    const wt = new WorktreeManager({ projectRoot: this.management.projectRoot });
-    const summary = await wt.diffSummary(resolve(dir), base);
+    const wt = new WorktreeManager3({ projectRoot: this.management.projectRoot });
+    const summary = await wt.diffSummary(resolve6(dir), base);
     this.broadcast({ type: "worktree.diff_result", payload: { dir, summary } });
   }
   // ── internals ───────────────────────────────────────────────────────────
@@ -5412,7 +5651,7 @@ var WorktreeWebSocketHandler = class {
   activity(id, kind, text) {
     const cur = this.handles.get(id);
     if (cur) {
-      const recentActivity = [...cur.recentActivity, { kind, text, at: Date.now() }].slice(-6);
+      const recentActivity = [...cur.recentActivity, { kind, text, at: Date.now() }].slice(-MAX_ACTIVITY);
       this.handles.set(id, { ...cur, recentActivity });
     }
     this.broadcast({ type: "worktree.event", payload: { kind, handleId: id, text, at: Date.now() } });
@@ -5444,7 +5683,7 @@ var WorktreeWebSocketHandler = class {
       try {
         if (ws.readyState === 1) ws.send(data);
       } catch (err) {
-        this.logger.debug?.(`worktree broadcast failed: ${toErrorMessage(err)}`);
+        this.logger.debug?.(`worktree broadcast failed: ${toErrorMessage2(err)}`);
       }
     }
   }
@@ -5456,6 +5695,12 @@ var WorktreeWebSocketHandler = class {
   }
 };
 
+// src/server/server-runtime.ts
+import * as path13 from "node:path";
+import { createRequire } from "node:module";
+import { fileURLToPath } from "node:url";
+import { WebSocketServer } from "ws";
+
 // src/server/lifecycle.ts
 function createShutdown(res) {
   const log = res.log ?? ((m) => console.log(m));
@@ -5491,9 +5736,14 @@ function registerShutdownHandlers(res) {
     process.off("SIGTERM", shutdown);
   };
 }
+
+// src/server/setup-events.ts
+import * as fs10 from "node:fs/promises";
+import { watch as fsWatch } from "node:fs";
+import * as path12 from "node:path";
 function statusProjectHashFromWatchFilename(projectsDir, filename) {
   const raw = String(filename);
-  const relative4 = path5.isAbsolute(raw) ? path5.relative(projectsDir, raw) : raw;
+  const relative4 = path12.isAbsolute(raw) ? path12.relative(projectsDir, raw) : raw;
   const parts = relative4.split(/[\\/]+/).filter(Boolean);
   if (parts.length < 2) return null;
   if (parts[parts.length - 1] !== "status.json") return null;
@@ -5630,7 +5880,7 @@ function setupEvents(deps2) {
         try {
           const taskPath = context.meta["task.path"];
           if (typeof taskPath === "string" && taskPath) {
-            const { loadTasks } = await import('@wrongstack/core');
+            const { loadTasks } = await import("@wrongstack/core");
             const file = await loadTasks(taskPath);
             broadcast2(clients, { type: "tasks.updated", payload: sessionPayload2({ sessionId: e.sessionId, tasks: file?.tasks ?? [] }) });
           }
@@ -5639,7 +5889,7 @@ function setupEvents(deps2) {
         try {
           const planPath = context.meta["plan.path"];
           if (typeof planPath === "string" && planPath) {
-            const { loadPlan } = await import('@wrongstack/core');
+            const { loadPlan } = await import("@wrongstack/core");
             const plan = await loadPlan(planPath);
             broadcast2(clients, { type: "plan.updated", payload: sessionPayload2({ sessionId: e.sessionId, plan: plan ?? { version: 1, sessionId: e.sessionId ?? context.session?.id ?? "", updatedAt: (/* @__PURE__ */ new Date()).toISOString(), items: [] } }) });
           }
@@ -5936,6 +6186,7 @@ function setupEvents(deps2) {
   events.on("subagent.budget_extended", (e) => forwardSubagent("budget_extended", { sessionId: e.sessionId, subagentId: e.subagentId, budgetKind: e.kind, newLimit: e.newLimit, totalExtensions: e.totalExtensions }));
   events.on("subagent.ctx_pct", (e) => forwardSubagent("ctx_pct", { sessionId: e.sessionId, subagentId: e.subagentId, load: e.load, tokens: e.tokens, maxContext: e.maxContext }));
   events.on("subagent.task_completed", (e) => forwardSubagent("task_completed", { sessionId: e.sessionId, subagentId: e.subagentId, status: e.status, iterations: e.iterations, toolCalls: e.toolCalls, finalText: e.finalText, failureReason: e.error?.kind, error: e.error ? { kind: e.error.kind, message: e.error.message } : void 0 }));
+  events.on("subagent.removed", (e) => forwardSubagent("removed", { sessionId: e.sessionId, subagentId: e.subagentId, reason: e.reason }));
   events.on("agent.timeline.message", (e) => {
     broadcast2(clients, {
       type: "agent.timeline.message",
@@ -6033,14 +6284,20 @@ function setupEvents(deps2) {
       payload: sessionPayload2({ event: eventName, ...payload })
     });
   });
+  events.onPattern("memory.*", (eventName, payload) => {
+    broadcast2(clients, {
+      type: "memory.event",
+      payload: sessionPayload2({ event: eventName, ...payload })
+    });
+  });
   events.on("client.status", async (e) => {
     broadcast2(clients, { type: "client.status_update", payload: e });
     if (wpaths?.projectStatus) {
       try {
         const statusFile = wpaths.projectStatus(e.projectHash);
-        const dir = path5.dirname(statusFile);
-        await fs4.mkdir(dir, { recursive: true });
-        await fs4.writeFile(statusFile, JSON.stringify(e, null, 2), "utf-8");
+        const dir = path12.dirname(statusFile);
+        await fs10.mkdir(dir, { recursive: true });
+        await fs10.writeFile(statusFile, JSON.stringify(e, null, 2), "utf-8");
       } catch (err) {
         console.error(
           JSON.stringify({
@@ -6054,7 +6311,7 @@ function setupEvents(deps2) {
     }
   });
   if (wpaths?.projectStatus && wpaths.configDir) {
-    const projectsDir = path5.join(wpaths.configDir, "projects");
+    const projectsDir = path12.join(wpaths.configDir, "projects");
     const knownProjectHashes = /* @__PURE__ */ new Set();
     const debounceTimers = /* @__PURE__ */ new Map();
     const DEBOUNCE_MS = 150;
@@ -6118,8 +6375,8 @@ function setupEvents(deps2) {
     let watcher;
     const startWatcher = async () => {
       try {
-        await fs4.mkdir(projectsDir, { recursive: true });
-        watcher = watch(projectsDir, { persistent: true, recursive: true }, async (eventType, filename) => {
+        await fs10.mkdir(projectsDir, { recursive: true });
+        watcher = fsWatch(projectsDir, { persistent: true, recursive: true }, async (eventType, filename) => {
           if (eventType !== "change" && eventType !== "rename") return;
           if (filename == null) return;
           const projectHash = statusProjectHashFromWatchFilename(projectsDir, filename);
@@ -6128,8 +6385,8 @@ function setupEvents(deps2) {
           if (!knownProjectHashes.has(projectHash)) return;
           if (watcherMetrics) watcherMetrics.filesProcessed++;
           try {
-            const targetFile = path5.join(projectsDir, projectHash, "status.json");
-            const content = await fs4.readFile(targetFile, "utf-8");
+            const targetFile = path12.join(projectsDir, projectHash, "status.json");
+            const content = await fs10.readFile(targetFile, "utf-8");
             const statusData = JSON.parse(content);
             scheduleBroadcast(projectHash, statusData);
           } catch {
@@ -6181,11 +6438,11 @@ function setupEvents(deps2) {
       }
     });
   }
-  const globalRoot = globalConfigPath ? path5.dirname(globalConfigPath) : void 0;
+  const globalRoot = globalConfigPath ? path12.dirname(globalConfigPath) : void 0;
   if (globalRoot) {
     const broadcastSessions = async () => {
       try {
-        const { SessionRegistry } = await import('@wrongstack/core');
+        const { SessionRegistry } = await import("@wrongstack/core");
         const registry = new SessionRegistry(globalRoot);
         const sessions = await registry.list();
         const mySlug = sessions.find((s) => s.pid === process.pid)?.projectSlug;
@@ -6228,7 +6485,7 @@ function setupEvents(deps2) {
     disposers.push(() => clearInterval(statusInterval));
     let regDebounce;
     try {
-      const regWatcher = watch(globalRoot, { persistent: false }, (_event, filename) => {
+      const regWatcher = fsWatch(globalRoot, { persistent: false }, (_event, filename) => {
         const name2 = filename ? String(filename) : "";
         if (!name2.startsWith("session-registry.json") || name2.endsWith(".lock")) return;
         if (regDebounce) clearTimeout(regDebounce);
@@ -6264,6 +6521,9 @@ function getCostRates(model) {
 function computeUsageCost(usage, rates) {
   return (usage.input * rates.input + usage.output * rates.output + (usage.cacheRead ?? 0) * rates.cacheRead) / 1e6;
 }
+
+// src/server/model-catalog.ts
+import { capabilitiesFor } from "@wrongstack/providers";
 var SIBLING_CATALOG = {
   "anthropic-oauth": "anthropic",
   "openai-codex": "openai",
@@ -6370,6 +6630,9 @@ function readConfiguredBool(providerConfig, key) {
 function positiveNumber(value) {
   return typeof value === "number" && Number.isFinite(value) && value > 0 ? value : void 0;
 }
+
+// src/server/server-runtime.ts
+import { toErrorMessage as toErrorMessage3 } from "@wrongstack/core/utils";
 async function resolvePorts(opts) {
   const requestedWsPort = opts.wsPort ?? 3457;
   const wsHost = opts.wsHost ?? process.env["WEBUI_HOST"] ?? process.env["WS_HOST"] ?? "127.0.0.1";
@@ -6430,7 +6693,7 @@ function createSessionStartPayload(g) {
       inputCost,
       outputCost,
       cacheReadCost,
-      projectName: path5.basename(projectRoot) || projectRoot,
+      projectName: path13.basename(projectRoot) || projectRoot,
       projectRoot,
       cwd: g.getWorkingDir(),
       mode: g.getModeId(),
@@ -6468,13 +6731,26 @@ function createWsServers(ports, accessToken) {
     port: ports.wsPort,
     host: ports.wsHost,
     verifyClient: verifyClient2,
-    maxPayload: WS_MAX_PAYLOAD
+    maxPayload: WS_MAX_PAYLOAD,
+    // Send a ping every 15s to keep idle connections alive. Without this,
+    // network equipment (routers, proxies, NAT gateways) may drop idle TCP
+    // connections, causing the browser to see a close event and show the
+    // "reconnecting" banner. The browser responds with a pong automatically
+    // (the WebSocket API handles this at the transport level).
+    pingInterval: 15e3,
+    // Wait 5s for a pong before considering the connection dead. A client
+    // that hasn't responded to 3 consecutive pings in a row (45s total
+    // quiet) is almost certainly unreachable — close the socket so the
+    // client can reconnect cleanly rather than hanging indefinitely.
+    pingTimeout: 5e3
   });
   const wssSecondary = ports.wsHost === "127.0.0.1" ? new WebSocketServer({
     port: ports.wsPort,
     host: "::1",
     verifyClient: verifyClient2,
-    maxPayload: WS_MAX_PAYLOAD
+    maxPayload: WS_MAX_PAYLOAD,
+    pingInterval: 15e3,
+    pingTimeout: 5e3
   }) : null;
   const clients = /* @__PURE__ */ new Map();
   console.log(
@@ -6496,7 +6772,7 @@ function armEvents(wssPrimary, wssSecondary, wsHost, wsPort, setupInput, watcher
   };
   wssPrimary.on("listening", () => arm(`${wsHost}:${wsPort}`));
   wssPrimary.on("error", (err) => {
-    console.error(JSON.stringify({ level: "error", event: "webui.ws_server_error", host: wsHost, message: toErrorMessage(err), timestamp: (/* @__PURE__ */ new Date()).toISOString() }));
+    console.error(JSON.stringify({ level: "error", event: "webui.ws_server_error", host: wsHost, message: toErrorMessage3(err), timestamp: (/* @__PURE__ */ new Date()).toISOString() }));
   });
   if (wssSecondary) {
     wssSecondary.on("listening", () => arm(`::1:${wsPort}`));
@@ -6515,13 +6791,13 @@ function armEvents(wssPrimary, wssSecondary, wsHost, wsPort, setupInput, watcher
   };
 }
 function resolveWebuiDistDir(fromUrl, explicitDistDir) {
-  if (explicitDistDir) return path5.resolve(explicitDistDir);
+  if (explicitDistDir) return path13.resolve(explicitDistDir);
   try {
     const requireFromHere2 = createRequire(fromUrl);
     const serverEntry = requireFromHere2.resolve("@wrongstack/webui/server");
-    return path5.resolve(path5.dirname(serverEntry), "..");
+    return path13.resolve(path13.dirname(serverEntry), "..");
   } catch {
-    return path5.resolve(path5.dirname(fileURLToPath(fromUrl)), "..", "..", "dist");
+    return path13.resolve(path13.dirname(fileURLToPath(fromUrl)), "..", "..", "dist");
   }
 }
 function startHttpServer(opts) {
@@ -6536,13 +6812,13 @@ function startHttpServer(opts) {
     watcherMetrics: opts.watcherMetrics,
     onFleetPing: opts.onFleetPing
   });
-  const registryBaseDir = path5.dirname(opts.globalConfigPath);
+  const registryBaseDir = path13.dirname(opts.globalConfigPath);
   httpServer.listen(opts.httpPort, opts.wsHost, () => {
     const openUrl = buildWebUIAccessUrl({ host: opts.wsHost, port: opts.httpPort, token: opts.wsToken, publicUrl: opts.publicUrl });
     console.log(`[WebUI] HTTP server running on ${openUrl}`);
     if (opts.openBrowser) openBrowser(openUrl);
     void registerInstance(
-      { pid: process.pid, httpPort: opts.httpPort, wsPort: opts.wsPort, host: opts.wsHost, projectRoot: opts.projectRoot, projectName: path5.basename(opts.projectRoot) || opts.projectRoot, startedAt: (/* @__PURE__ */ new Date()).toISOString(), url: buildWebUIAccessUrl({ host: opts.wsHost, port: opts.httpPort, publicUrl: opts.publicUrl }) },
+      { pid: process.pid, httpPort: opts.httpPort, wsPort: opts.wsPort, host: opts.wsHost, projectRoot: opts.projectRoot, projectName: path13.basename(opts.projectRoot) || opts.projectRoot, startedAt: (/* @__PURE__ */ new Date()).toISOString(), url: buildWebUIAccessUrl({ host: opts.wsHost, port: opts.httpPort, publicUrl: opts.publicUrl }) },
       registryBaseDir
     ).catch((err) => console.warn(JSON.stringify({ level: "warn", event: "webui.instance_record_failed", message: errMessage(err), timestamp: (/* @__PURE__ */ new Date()).toISOString() })));
   });
@@ -6556,6 +6832,63 @@ function registerShutdown(deps2) {
     onShutdown: deps2.onShutdown
   });
 }
+
+// src/server/pre-context-services.ts
+import * as path15 from "node:path";
+import { createRequire as createRequire2 } from "node:module";
+import { WebSocket as WebSocket2 } from "ws";
+import { DefaultTokenCounter } from "@wrongstack/core/infrastructure";
+import {
+  AgentStatusTracker,
+  AnnotationsStore,
+  DEFAULT_SESSION_PRUNE_DAYS,
+  DefaultModelsRegistry,
+  DefaultModeStore,
+  DefaultPromptLoader,
+  DefaultSessionReader,
+  DefaultSessionStore,
+  DefaultSkillLoader,
+  DefaultSystemPromptBuilder,
+  EventBus,
+  FleetNotifier,
+  GlobalMailbox,
+  PromptUsageStore,
+  ProviderRegistry,
+  SkillInstaller,
+  TOKENS,
+  ToolRegistry,
+  Context,
+  applyToolDescriptionModes,
+  applyToolResultRenderModes,
+  configureChildEnvGitIdentity,
+  resolveContextWindowPolicy,
+  getSessionRegistry,
+  makeMailboxTool,
+  makeMailInboxTool,
+  makeFleetStatusTool,
+  makeMailSendTool
+} from "@wrongstack/core";
+import {
+  createSuperMemoryTools
+} from "@wrongstack/super-memory";
+import { MCPRegistry } from "@wrongstack/mcp";
+import { buildProviderFactoriesFromRegistry } from "@wrongstack/providers";
+import { createDefaultContainer } from "@wrongstack/runtime";
+import {
+  builtinToolsPack,
+  configureDangerBypass,
+  configureExecPolicy,
+  forgetTool,
+  relatedMemoryTool,
+  rememberTool,
+  searchMemoryTool
+} from "@wrongstack/tools";
+import { toErrorMessage as toErrorMessage5 } from "@wrongstack/core/utils";
+
+// src/server/setup-screen.ts
+import { expectDefined as expectDefined2 } from "@wrongstack/core";
+import { toErrorMessage as toErrorMessage4 } from "@wrongstack/core/utils";
+import { makeProviderFromConfig } from "@wrongstack/providers";
 var UNCONFIGURED_CAPABILITIES = {
   tools: false,
   parallelTools: false,
@@ -6595,7 +6928,7 @@ function logCreateFailure(event, err) {
     JSON.stringify({
       level: "error",
       event,
-      message: toErrorMessage(err),
+      message: toErrorMessage4(err),
       timestamp: (/* @__PURE__ */ new Date()).toISOString()
     })
   );
@@ -6620,7 +6953,7 @@ function resolveSetupProvider(opts) {
   const savedProviders = config.providers ?? {};
   const firstKey = Object.keys(savedProviders)[0];
   if (firstKey) {
-    const firstProvider = expectDefined(savedProviders[firstKey]);
+    const firstProvider = expectDefined2(savedProviders[firstKey]);
     try {
       const provider2 = makeProviderFromConfig(firstKey, {
         ...firstProvider,
@@ -6700,6 +7033,11 @@ function seedContextMeta(config, context) {
   const tgMs = tgExt?.["longToolThresholdMs"];
   meta["tgLongToolMs"] = typeof tgMs === "number" ? tgMs : 3e4;
 }
+
+// src/server/model-auto-discovery.ts
+import * as fs11 from "node:fs/promises";
+import * as path14 from "node:path";
+import { COMPATIBLE_PRESETS, discoverOpenAICompatibleModels } from "@wrongstack/providers";
 function isOverlayRegistry(value) {
   return !!value && typeof value === "object" && typeof value.mergeOverlay === "function";
 }
@@ -6724,7 +7062,7 @@ function eligibleProviders(config) {
 }
 async function readCache(file) {
   try {
-    return JSON.parse(await fs4.readFile(file, "utf8"));
+    return JSON.parse(await fs11.readFile(file, "utf8"));
   } catch {
     return {};
   }
@@ -6734,7 +7072,7 @@ async function discoverAndMergeWebuiProviders(opts) {
   if (!isOverlayRegistry(registry)) return;
   const targets = eligibleProviders(opts.config);
   if (targets.length === 0) return;
-  const cacheFile = path5.join(opts.cacheDir, "discovered-models-cache.json");
+  const cacheFile = path14.join(opts.cacheDir, "discovered-models-cache.json");
   const cache = await readCache(cacheFile);
   let cacheDirty = false;
   await Promise.all(
@@ -6771,8 +7109,8 @@ async function discoverAndMergeWebuiProviders(opts) {
   );
   if (cacheDirty) {
     try {
-      await fs4.mkdir(path5.dirname(cacheFile), { recursive: true });
-      await fs4.writeFile(cacheFile, JSON.stringify(cache), "utf8");
+      await fs11.mkdir(path14.dirname(cacheFile), { recursive: true });
+      await fs11.writeFile(cacheFile, JSON.stringify(cache), "utf8");
     } catch {
       opts.logger?.debug?.("provider auto-discovery cache write failed");
     }
@@ -6794,20 +7132,22 @@ async function createPreContextServices(input) {
       await modelsRegistry.refresh();
       logger.info("models.dev catalog refreshed");
     } catch (err) {
-      logger.warn(`models.dev refresh failed (${toErrorMessage(err)}); using cached catalog`);
+      logger.warn(`models.dev refresh failed (${toErrorMessage5(err)}); using cached catalog`);
     }
   }
   try {
     await discoverAndMergeWebuiProviders({
       config,
       registry: modelsRegistry,
-      cacheDir: path5.dirname(wpaths.modelsCache),
+      cacheDir: path15.dirname(wpaths.modelsCache),
       logger
     });
   } catch (err) {
-    logger.debug(`provider auto-discovery skipped: ${toErrorMessage(err)}`);
+    logger.debug(`provider auto-discovery skipped: ${toErrorMessage5(err)}`);
   }
-  const container = createDefaultContainer({ config, wpaths, logger, modelsRegistry });
+  const events = opts.services?.events ?? new EventBus();
+  events.setLogger(logger);
+  const container = createDefaultContainer({ config, wpaths, logger, modelsRegistry, events });
   const configStore = opts.services?.configStore ?? container.resolve(TOKENS.ConfigStore);
   const providerRegistry = new ProviderRegistry();
   try {
@@ -6815,22 +7155,23 @@ async function createPreContextServices(input) {
     for (const f of factories) providerRegistry.register(f);
     console.log("[WebUI] Provider registry loaded:", providerRegistry.list().length, "providers");
   } catch (err) {
-    console.warn(JSON.stringify({ level: "warn", event: "webui.provider_registry_load_failed", message: toErrorMessage(err), timestamp: (/* @__PURE__ */ new Date()).toISOString() }));
+    console.warn(JSON.stringify({ level: "warn", event: "webui.provider_registry_load_failed", message: toErrorMessage5(err), timestamp: (/* @__PURE__ */ new Date()).toISOString() }));
   }
   const toolRegistry = opts.services?.toolRegistry ?? (() => {
     const r = new ToolRegistry();
     r.registerAllOrThrow([...builtinToolsPack.tools ?? []], builtinToolsPack.name);
     return r;
   })();
-  const memoryStore = new DefaultMemoryStore({ paths: wpaths });
+  const memoryStore = container.resolve(TOKENS.MemoryStore);
   if (config.features.memory) {
     toolRegistry.register(rememberTool(memoryStore));
     toolRegistry.register(forgetTool(memoryStore));
     toolRegistry.register(searchMemoryTool(memoryStore));
     toolRegistry.register(relatedMemoryTool(memoryStore));
+    if (isSuperMemoryService(memoryStore)) {
+      for (const tool of createSuperMemoryTools(memoryStore)) toolRegistry.register(tool);
+    }
   }
-  const events = opts.services?.events ?? new EventBus();
-  events.setLogger(logger);
   toolRegistry.register(makeMailboxTool({ projectDir: wpaths.projectDir, events }));
   toolRegistry.register(makeMailSendTool({ projectDir: wpaths.projectDir, events }));
   toolRegistry.register(makeMailInboxTool({ projectDir: wpaths.projectDir, events }));
@@ -6839,6 +7180,7 @@ async function createPreContextServices(input) {
   applyToolResultRenderModes(toolRegistry, config.tools?.resultRenderMode);
   configureExecPolicy(config.tools?.exec ?? {});
   configureDangerBypass(config.tools?.exec?.danger ?? {});
+  configureChildEnvGitIdentity(config.git?.identity ?? null);
   console.log("[WebUI] Tool registry loaded:", toolRegistry.list().length, "tools");
   const mcpRegistry = new MCPRegistry({ toolRegistry, events, log: logger, cacheDir: wpaths.cacheDir });
   if (config.features.mcp && config.mcpServers) {
@@ -6890,7 +7232,7 @@ async function createPreContextServices(input) {
       sessionId: session.id,
       projectSlug: wpaths.projectSlug,
       projectRoot,
-      projectName: path5.basename(projectRoot),
+      projectName: path15.basename(projectRoot),
       workingDir,
       clientType: "webui",
       pid: process.pid,
@@ -6916,13 +7258,13 @@ async function createPreContextServices(input) {
         startWorktreeTelemetryBridge,
         startToolTelemetryBridge,
         startCostTelemetryBridge
-      } = await import('@wrongstack/core');
+      } = await import("@wrongstack/core");
       const hqTelemetry = createHqPublisherFromEnv({
         clientKind: "webui",
         projectRoot,
-        projectName: path5.basename(projectRoot),
+        projectName: path15.basename(projectRoot),
         appConfig: config,
-        socketFactory: (url) => new WebSocket(url)
+        socketFactory: (url) => new WebSocket2(url)
       });
       if (hqTelemetry) {
         hqTelemetry.connect();
@@ -6932,7 +7274,7 @@ async function createPreContextServices(input) {
           events,
           sessionId: session.id,
           projectRoot,
-          projectName: path5.basename(projectRoot),
+          projectName: path15.basename(projectRoot),
           globalRoot: wpaths.globalRoot,
           initialAgents: statusTracker?.getAgents(),
           startedAt: (/* @__PURE__ */ new Date()).toISOString()
@@ -7021,7 +7363,7 @@ async function createPreContextServices(input) {
   const modelCapabilitiesRef = { current: modelCapabilities };
   const skillLoader = config.features.skills ? new DefaultSkillLoader({ paths: wpaths }) : void 0;
   const skillInstaller = config.features.skills ? new SkillInstaller({
-    manifestPath: path5.join(wpaths.globalRoot, "installed-skills.json"),
+    manifestPath: path15.join(wpaths.globalRoot, "installed-skills.json"),
     projectSkillsDir: wpaths.inProjectSkills,
     globalSkillsDir: wpaths.globalSkills,
     projectHash: wpaths.projectHash,
@@ -7030,8 +7372,8 @@ async function createPreContextServices(input) {
   const promptsEnabled = config.features.prompts !== false;
   const bundledPromptsDir = promptsEnabled ? (() => {
     try {
-      const req = createRequire(import.meta.url);
-      return path5.join(path5.dirname(req.resolve("@wrongstack/core/package.json")), "data", "prompts");
+      const req = createRequire2(import.meta.url);
+      return path15.join(path15.dirname(req.resolve("@wrongstack/core/package.json")), "data", "prompts");
     } catch {
       return void 0;
     }
@@ -7112,8 +7454,33 @@ async function createPreContextServices(input) {
     needsSetup
   };
 }
+function isSuperMemoryService(memoryStore) {
+  const value = memoryStore;
+  return typeof value["retrieveForPath"] === "function" && typeof value["searchSuper"] === "function" && typeof value["graphFor"] === "function" && typeof value["verify"] === "function" && typeof value["hygiene"] === "function" && typeof value["listCandidates"] === "function";
+}
+
+// src/server/start-webui.ts
+import * as path22 from "node:path";
+import {
+  createDefaultPipelines,
+  createSessionEventBridge,
+  DEFAULT_CONTEXT_WINDOW_MODE_ID as DEFAULT_CONTEXT_WINDOW_MODE_ID2,
+  expectDefined as expectDefined3,
+  resolveSessionLoggingConfig,
+  watchProviderConfig
+} from "@wrongstack/core";
+import { toErrorMessage as toErrorMessage10 } from "@wrongstack/core/utils";
+import { makeProviderFromConfig as makeProviderFromConfig3 } from "@wrongstack/providers";
+import {
+  ensureSessionShell
+} from "@wrongstack/tools";
+
+// src/server/boot.ts
+import {
+  bootConfig as coreBootConfig
+} from "@wrongstack/core";
 async function bootConfig() {
-  const { config, vault, globalConfigPath, projectRoot, wpaths, logger } = await bootConfig$1({
+  const { config, vault, globalConfigPath, projectRoot, wpaths, logger } = await coreBootConfig({
     appLabel: "WebUI"
   });
   return { config, vault, globalConfigPath, projectRoot, wpaths, logger };
@@ -7121,6 +7488,35 @@ async function bootConfig() {
 function patchConfig(config, updates) {
   return Object.freeze({ ...config, ...updates });
 }
+
+// src/server/backend-services.ts
+import {
+  Agent,
+  AutoCompactionMiddleware as AutoCompactionMiddlewareCtor,
+  BrainMonitor,
+  CollaborationBus as CollaborationBusCtor,
+  DEFAULT_TOOLS_CONFIG,
+  createStrategyCompactor,
+  collabInjectMiddleware,
+  collabPauseMiddleware,
+  estimateRequestTokensCalibrated,
+  installDesignStudioMiddleware,
+  ObservableBrainArbiter as ObservableBrainArbiterCtor,
+  resolveContextWindowPolicy as resolveContextWindowPolicy2,
+  createAutonomyBrain,
+  createTieredBrainArbiter,
+  DefaultBrainArbiter,
+  GlobalMailbox as GlobalMailbox2,
+  mailboxSessionTag,
+  SessionMemoryConsolidator,
+  TOKENS as TOKENS2,
+  ToolExecutor
+} from "@wrongstack/core";
+
+// src/server/collaboration-ws-handler.ts
+import { randomUUID } from "node:crypto";
+import { toErrorMessage as toErrorMessage6 } from "@wrongstack/core/utils";
+var REPLAY_LIMIT = 50;
 var PAUSE_TIMEOUT_MS = 6e4;
 var CollaborationWebSocketHandler = class {
   constructor(events, logger, reader, annotations, bus) {
@@ -7248,7 +7644,7 @@ var CollaborationWebSocketHandler = class {
     if (this.reader) {
       this.replayHistory(ws, sessionId).catch((err) => {
         this.logger.debug?.(
-          `collab: replay failed for ${sessionId}: ${toErrorMessage(err)}`
+          `collab: replay failed for ${sessionId}: ${toErrorMessage6(err)}`
         );
       });
     }
@@ -7366,7 +7762,7 @@ var CollaborationWebSocketHandler = class {
       this.send(
         ws,
         this.errorMessage(
-          `annotation rejected: ${toErrorMessage(err)}`
+          `annotation rejected: ${toErrorMessage6(err)}`
         )
       );
     }
@@ -7433,7 +7829,7 @@ var CollaborationWebSocketHandler = class {
       this.send(
         ws,
         this.errorMessage(
-          `resolve failed: ${toErrorMessage(err)}`
+          `resolve failed: ${toErrorMessage6(err)}`
         )
       );
     }
@@ -7481,7 +7877,7 @@ var CollaborationWebSocketHandler = class {
           if (p.ws.readyState === 1) p.ws.send(data);
         } catch (err) {
           this.logger.debug?.(
-            `collab broadcast failed: ${toErrorMessage(err)}`
+            `collab broadcast failed: ${toErrorMessage6(err)}`
           );
         }
       }
@@ -7508,11 +7904,11 @@ var CollaborationWebSocketHandler = class {
       }
     } catch (err) {
       this.logger.debug?.(
-        `collab: session reader rejected ${sessionId}: ${toErrorMessage(err)}`
+        `collab: session reader rejected ${sessionId}: ${toErrorMessage6(err)}`
       );
       return;
     }
-    const tail2 = all.slice(-50);
+    const tail2 = all.slice(-REPLAY_LIMIT);
     if (tail2.length === 0) return;
     for (const raw of tail2) {
       const ev = raw;
@@ -7589,7 +7985,7 @@ var CollaborationWebSocketHandler = class {
         if (p.ws.readyState === 1) p.ws.send(data);
       } catch (err) {
         this.logger.debug?.(
-          `collab broadcast failed: ${toErrorMessage(err)}`
+          `collab broadcast failed: ${toErrorMessage6(err)}`
         );
       }
     }
@@ -7841,6 +8237,17 @@ var CollaborationWebSocketHandler = class {
     }
   }
 };
+
+// src/server/codebase-indexing.ts
+import * as fs12 from "node:fs";
+import * as path16 from "node:path";
+import {
+  cancelPendingReindexes,
+  enqueueReindex,
+  isIndexableFile,
+  runStartupIndex,
+  shutdownCodebaseIndexHost
+} from "@wrongstack/tools";
 var IGNORE_DIRS = /* @__PURE__ */ new Set([
   "node_modules",
   ".git",
@@ -7886,7 +8293,7 @@ function setupWebUICodebaseIndexing(deps2) {
         if (!filename) return;
         const rel = filename.toString();
         if (isIgnored(rel)) return;
-        const abs = path5.resolve(deps2.projectRoot, rel);
+        const abs = path16.resolve(deps2.projectRoot, rel);
         enqueueFile(abs);
       });
       watcher.on("error", (err) => deps2.logger.debug(`webui codebase index watcher error: ${err}`));
@@ -7899,7 +8306,7 @@ function setupWebUICodebaseIndexing(deps2) {
   }
   function enqueueFile(filePath) {
     if (!idx.onEdit && !idx.watchExternal) return;
-    const abs = path5.isAbsolute(filePath) ? path5.normalize(filePath) : path5.resolve(deps2.projectRoot, filePath);
+    const abs = path16.isAbsolute(filePath) ? path16.normalize(filePath) : path16.resolve(deps2.projectRoot, filePath);
     if (!isInside2(deps2.projectRoot, abs) || !isIndexableFile(abs)) return;
     enqueueReindex({
       projectRoot: deps2.projectRoot,
@@ -7936,15 +8343,23 @@ function isIgnored(rel) {
   return rel.split(/[/\\]/).some((seg) => IGNORE_DIRS.has(seg));
 }
 function isInside2(root, target) {
-  const normalizedRoot = path5.resolve(root);
-  const normalizedTarget = path5.resolve(target);
-  return normalizedTarget === normalizedRoot || normalizedTarget.startsWith(normalizedRoot + path5.sep);
+  const normalizedRoot = path16.resolve(root);
+  const normalizedTarget = path16.resolve(target);
+  return normalizedTarget === normalizedRoot || normalizedTarget.startsWith(normalizedRoot + path16.sep);
 }
+
+// src/server/discover-mailbox-bridge.ts
+import { spawn as spawn3 } from "node:child_process";
+import { createRequire as createRequire3 } from "node:module";
+import { existsSync } from "node:fs";
+import { dirname as dirname8, join as join12 } from "node:path";
+import { resolveProjectDir, wstackGlobalRoot as wstackGlobalRoot2 } from "@wrongstack/core";
+import { readLiveLock } from "@wrongstack/core/coordination";
 var MAILBOX_BRIDGE_BOOT_TIMEOUT_MS = 5e3;
 async function discoverMailboxBridgeForWebui(params) {
   const mode = params.config?.features?.mailboxBridge ?? "auto";
   if (mode === "off") return;
-  const projectDir = resolveProjectDir(params.projectRoot, wstackGlobalRoot$1());
+  const projectDir = resolveProjectDir(params.projectRoot, wstackGlobalRoot2());
   let result = await readLiveLock(projectDir);
   let spawnedPid = null;
   if (result.kind !== "live") {
@@ -8010,7 +8425,7 @@ async function waitForLiveMailboxBridge(projectDir, timeoutMs) {
 function spawnMailboxBridge(projectRoot, logger) {
   const invocation = mailboxServeInvocation(projectRoot);
   try {
-    const child = spawn(invocation.command, invocation.args, {
+    const child = spawn3(invocation.command, invocation.args, {
       cwd: projectRoot,
       detached: process.platform !== "win32" && !invocation.useShell,
       env: process.env,
@@ -8041,7 +8456,7 @@ function mailboxServeInvocation(projectRoot) {
     return { command: process.execPath, args: [explicitCliEntry, "mailbox", "serve"] };
   }
   try {
-    const require2 = createRequire(import.meta.url);
+    const require2 = createRequire3(import.meta.url);
     const cliEntry = require2.resolve("@wrongstack/cli");
     return { command: process.execPath, args: [cliEntry, "mailbox", "serve"] };
   } catch {
@@ -8065,9 +8480,9 @@ function mailboxServeInvocation(projectRoot) {
 function findWorkspaceCliEntry(projectRoot) {
   let dir = projectRoot;
   for (let i = 0; i < 6; i++) {
-    const candidate = join(dir, "packages", "cli", "dist", "index.js");
+    const candidate = join12(dir, "packages", "cli", "dist", "index.js");
     if (existsSync(candidate)) return candidate;
-    const parent = dirname(dir);
+    const parent = dirname8(dir);
     if (parent === dir) return null;
     dir = parent;
   }
@@ -8076,10 +8491,15 @@ function findWorkspaceCliEntry(projectRoot) {
 function sleep(ms) {
   return new Promise((resolve10) => setTimeout(resolve10, ms));
 }
+
+// src/server/terminal-ws-handler.ts
+import { spawn as spawnChild } from "node:child_process";
+import { createRequire as createRequire4 } from "node:module";
+import { toErrorMessage as toErrorMessage7 } from "@wrongstack/core/utils";
 var MAX_SESSIONS_PER_CLIENT = 8;
 var DEFAULT_COLS = 80;
 var DEFAULT_ROWS = 24;
-var requireFromHere = createRequire(import.meta.url);
+var requireFromHere = createRequire4(import.meta.url);
 var cachedNodePty;
 var TerminalWebSocketHandler = class {
   constructor(getCwd, logger, loadNodePty = defaultLoadNodePty, killProcessTree = defaultKillProcessTree) {
@@ -8157,8 +8577,8 @@ var TerminalWebSocketHandler = class {
         ...windowsPtyOptions()
       });
     } catch (err) {
-      const msg = `Integrated terminal failed to start: ${toErrorMessage(err)}`;
-      this.logger.warn?.(`terminal spawn failed: ${toErrorMessage(err)}`);
+      const msg = `Integrated terminal failed to start: ${toErrorMessage7(err)}`;
+      this.logger.warn?.(`terminal spawn failed: ${toErrorMessage7(err)}`);
       this.send(ws, { type: "terminal.output", payload: { id: payload.id, data: `${msg}\r
 ` } });
       this.send(ws, { type: "terminal.exit", payload: { id: payload.id, exitCode: -1 } });
@@ -8211,7 +8631,7 @@ var TerminalWebSocketHandler = class {
     try {
       pty.kill();
     } catch (err) {
-      this.logger.warn?.(`${reason} failed: ${toErrorMessage(err)}`);
+      this.logger.warn?.(`${reason} failed: ${toErrorMessage7(err)}`);
     }
   }
   killWindowsProcessTree(pty, reason) {
@@ -8223,7 +8643,7 @@ var TerminalWebSocketHandler = class {
       } catch {
       }
     } catch (err) {
-      this.logger.warn?.(`${reason} taskkill failed: ${toErrorMessage(err)}`);
+      this.logger.warn?.(`${reason} taskkill failed: ${toErrorMessage7(err)}`);
     }
   }
   send(ws, msg) {
@@ -8254,7 +8674,7 @@ function windowsPtyOptions() {
   return { useConptyDll: true };
 }
 function defaultKillProcessTree(pid) {
-  const child = spawn("taskkill", ["/PID", String(pid), "/T", "/F"], {
+  const child = spawnChild("taskkill", ["/PID", String(pid), "/T", "/F"], {
     stdio: "ignore",
     windowsHide: true
   });
@@ -8267,6 +8687,14 @@ function clampDim(value, fallback) {
   if (typeof value !== "number" || !Number.isFinite(value)) return fallback;
   return Math.max(1, Math.min(1e3, Math.floor(value)));
 }
+
+// src/server/backend-services.ts
+import { makeLightSubagentFactory } from "@wrongstack/runtime";
+import {
+  createSuperMemoryToolCallMiddleware,
+  createSuperMemoryTurnMiddleware
+} from "@wrongstack/super-memory";
+import { toErrorMessage as toErrorMessage8 } from "@wrongstack/core/utils";
 async function createAgentServices(input) {
   const {
     config,
@@ -8281,15 +8709,37 @@ async function createAgentServices(input) {
     providerRegistry,
     modelsRegistry,
     events,
+    memoryStore,
     modelCapabilitiesRef
   } = input;
-  const collabBus = new CollaborationBus();
+  const collabBus = new CollaborationBusCtor();
   const pipelines = input.pipelines;
   const collabInject = collabInjectMiddleware(collabBus, { logger });
   pipelines.toolCall.prepend(collabInject);
   const collabPause = collabPauseMiddleware(collabBus, { logger });
   pipelines.toolCall.prepend(collabPause);
   installDesignStudioMiddleware({ pipelines, ctx: context });
+  if (config.features.memory !== false && config.superMemory?.enabled !== false && isSuperMemoryRetriever(memoryStore)) {
+    if (config.superMemory?.inject?.toolResults !== false) {
+      pipelines.toolCall.use(createSuperMemoryToolCallMiddleware({
+        memory: memoryStore,
+        maxHintsPerTool: config.superMemory?.inject?.maxHintsPerTool,
+        maxCharsPerTool: config.superMemory?.inject?.maxCharsPerTool,
+        minScore: config.superMemory?.inject?.minScore,
+        repeatCooldownMs: config.superMemory?.inject?.repeatCooldownMs,
+        verifyOnMutation: config.superMemory?.hygiene?.autoOnFileChange,
+        triggers: config.superMemory?.inject?.triggers
+      }));
+    }
+    if (config.superMemory?.inject?.turnContext !== false) {
+      pipelines.request.use(createSuperMemoryTurnMiddleware({
+        memory: memoryStore,
+        maxMemories: config.superMemory?.inject?.maxTurnMemories,
+        maxChars: config.superMemory?.inject?.maxCharsPerTurn,
+        minScore: config.superMemory?.inject?.minScore
+      }));
+    }
+  }
   const codebaseIndexing = setupWebUICodebaseIndexing({
     config,
     context,
@@ -8303,7 +8753,7 @@ async function createAgentServices(input) {
     summarizerModel: config.context?.summarizerModel,
     llmSelector: config.context?.llmSelector
   });
-  const initialContextPolicy = resolveContextWindowPolicy(config.context);
+  const initialContextPolicy = resolveContextWindowPolicy2(config.context);
   let autoCompactor;
   if (config.context?.autoCompact !== false) {
     let effectiveMaxContext = config.context?.effectiveMaxContext ?? 0;
@@ -8320,7 +8770,7 @@ async function createAgentServices(input) {
       }
     }
     if (!effectiveMaxContext) effectiveMaxContext = provider.capabilities.maxContext;
-    autoCompactor = new AutoCompactionMiddleware(
+    autoCompactor = new AutoCompactionMiddlewareCtor(
       compactor,
       effectiveMaxContext,
       (ctx) => estimateRequestTokensCalibrated(
@@ -8348,7 +8798,7 @@ async function createAgentServices(input) {
   const updateAutoCompactionMaxContext = async (newProvider, providerId = newProvider.id, providerCfg) => {
     await modelsRegistry.refresh().catch((err) => {
       logger.warn(
-        `models.dev refresh failed for ${providerId}/${context.model}: ${toErrorMessage(err)}; using cached catalog`
+        `models.dev refresh failed for ${providerId}/${context.model}: ${toErrorMessage8(err)}; using cached catalog`
       );
     });
     const currentConfig = input.config;
@@ -8385,9 +8835,9 @@ async function createAgentServices(input) {
       maxContext: newMaxContext
     });
   };
-  const secretScrubber = container.resolve(TOKENS.SecretScrubber);
-  const renderer = container.has(TOKENS.Renderer) ? container.resolve(TOKENS.Renderer) : void 0;
-  const permissionPolicy = container.resolve(TOKENS.PermissionPolicy);
+  const secretScrubber = container.resolve(TOKENS2.SecretScrubber);
+  const renderer = container.has(TOKENS2.Renderer) ? container.resolve(TOKENS2.Renderer) : void 0;
+  const permissionPolicy = container.resolve(TOKENS2.PermissionPolicy);
   const toolExecutor = new ToolExecutor(toolRegistry, {
     permissionPolicy,
     secretScrubber,
@@ -8398,7 +8848,7 @@ async function createAgentServices(input) {
     perIterationOutputCapBytes: config.tools?.perIterationOutputCapBytes ?? DEFAULT_TOOLS_CONFIG.perIterationOutputCapBytes,
     tracer: void 0
   });
-  const webuiLogger = container.resolve(TOKENS.Logger);
+  const webuiLogger = container.resolve(TOKENS2.Logger);
   void discoverMailboxBridgeForWebui({
     projectRoot,
     config,
@@ -8424,6 +8874,9 @@ async function createAgentServices(input) {
     confirmAwaiter: void 0,
     toolExecutor
   });
+  if (config.features.memory && config.features.memoryConsolidation !== false) {
+    agent.extensions.register(new SessionMemoryConsolidator({ memoryStore }));
+  }
   console.log("[WebUI] Agent initialized");
   const brainSettings = { maxAutoRisk: "medium" };
   const autonomousBrain = {
@@ -8434,7 +8887,7 @@ async function createAgentServices(input) {
       // the tiered ceiling gates risk — keep inner permissive
     }).decide(request)
   };
-  const brain = new ObservableBrainArbiter(
+  const brain = new ObservableBrainArbiterCtor(
     createTieredBrainArbiter({
       policy: new DefaultBrainArbiter(),
       autonomous: autonomousBrain,
@@ -8442,7 +8895,7 @@ async function createAgentServices(input) {
     }),
     events
   );
-  container.bind(TOKENS.BrainArbiter, () => brain);
+  container.bind(TOKENS2.BrainArbiter, () => brain);
   const brainLog = [];
   const pushBrainLog = (entry) => {
     brainLog.push(entry);
@@ -8475,7 +8928,7 @@ async function createAgentServices(input) {
       outcome: e.decision.type === "deny" ? e.decision.reason : ""
     })
   );
-  const brainMailbox = new GlobalMailbox(wpaths.projectDir, events);
+  const brainMailbox = new GlobalMailbox2(wpaths.projectDir, events);
   const brainMonitor = new BrainMonitor({
     events,
     brain,
@@ -8568,14 +9021,14 @@ async function createAgentServices(input) {
     updateAutoCompactionMaxContext
   };
 }
+function isSuperMemoryRetriever(memoryStore) {
+  const value = memoryStore;
+  return typeof value["retrieveForPath"] === "function" && typeof value["searchSuper"] === "function";
+}
 
 // src/server/pending-confirms.ts
-function isDestructivePendingConfirm(confirm) {
-  return confirm.riskTier === "destructive" || confirm.decisionSource === "yolo_destructive";
-}
 function resolveYoloEligiblePendingConfirms(pendingConfirms) {
   for (const [id, confirm] of pendingConfirms) {
-    if (isDestructivePendingConfirm(confirm)) continue;
     pendingConfirms.delete(id);
     confirm.resolve("yes");
   }
@@ -8731,6 +9184,9 @@ function createConnectionHandler(opts) {
   };
 }
 
+// src/server/message-dispatcher.ts
+import path17 from "node:path";
+
 // src/server/autophase-routes.ts
 async function handleAutoPhaseRoute(_ws, msg, handlers) {
   if (!msg.type.startsWith("autophase.")) return false;
@@ -8754,10 +9210,13 @@ async function handleBrainRoute(ws, msg, handlers) {
       return false;
   }
 }
+
+// src/server/goal-handlers.ts
+import { resolveWstackPaths } from "@wrongstack/core/utils";
 async function handleGoalGet(projectRoot, broadcast2) {
   try {
     const goalPath = resolveWstackPaths({ projectRoot }).projectGoal;
-    const { readFile: readFile11 } = await import('fs/promises');
+    const { readFile: readFile11 } = await import("node:fs/promises");
     const raw = await readFile11(goalPath, "utf8");
     const goal = JSON.parse(raw);
     broadcast2({ type: "goal.updated", payload: goal });
@@ -8811,7 +9270,7 @@ async function handleTasksGet(ctx, ws) {
   const taskPath = ctx.context.meta["task.path"];
   if (typeof taskPath === "string" && taskPath) {
     try {
-      const { loadTasks } = await import('@wrongstack/core');
+      const { loadTasks } = await import("@wrongstack/core");
       const file = await loadTasks(taskPath);
       ctx.send(ws, { type: "tasks.updated", payload: sessionPayload(ctx, { tasks: file?.tasks ?? [] }) });
     } catch {
@@ -8831,7 +9290,7 @@ async function handleTaskUpdate(ctx, ws, payload) {
     return;
   }
   try {
-    const { loadTasks, saveTasks } = await import('@wrongstack/core');
+    const { loadTasks, saveTasks } = await import("@wrongstack/core");
     const file = await loadTasks(taskPath);
     if (!file) {
       sendResult2(ws, ctx, false, "No task file found.");
@@ -8860,7 +9319,7 @@ async function handlePlanGet(ctx, ws) {
   const sessionId = ctx.context.session?.id ?? "";
   if (typeof planPath === "string" && planPath) {
     try {
-      const { loadPlan } = await import('@wrongstack/core');
+      const { loadPlan } = await import("@wrongstack/core");
       const plan = await loadPlan(planPath);
       ctx.send(ws, {
         type: "plan.updated",
@@ -8901,7 +9360,7 @@ async function handlePlanTemplateUse(ctx, ws, template) {
     return;
   }
   try {
-    const { getPlanTemplate, loadPlan, savePlan, emptyPlan, addPlanItem } = await import('@wrongstack/core');
+    const { getPlanTemplate, loadPlan, savePlan, emptyPlan, addPlanItem } = await import("@wrongstack/core");
     const tpl = getPlanTemplate(template);
     if (!tpl) {
       sendResult2(ws, ctx, false, `Unknown template "${template}".`);
@@ -8926,7 +9385,7 @@ async function handlePlanItemUpdate(ctx, ws, payload) {
     return;
   }
   try {
-    const { mutatePlan, setPlanItemStatus } = await import('@wrongstack/core');
+    const { mutatePlan, setPlanItemStatus } = await import("@wrongstack/core");
     let changed = false;
     const plan = await mutatePlan(planPath, sessionId, async (p) => {
       const before = p.updatedAt;
@@ -8993,6 +9452,45 @@ async function handleWorklistMessage(ctx, ws, msg) {
       return;
   }
 }
+
+// src/server/kanban-routes.ts
+import {
+  deserializeTaskGraph,
+  serializeTaskGraph
+} from "@wrongstack/core";
+import {
+  addColumn,
+  addGoalMetricToTask,
+  addTask,
+  assignTask,
+  claimReadyTask,
+  copyTaskToBoard,
+  createBoard,
+  duplicateBoard,
+  exportBoardToTaskGraph,
+  generateBoardFromDescription,
+  getBoard,
+  getKanbanOrchestrationSnapshot,
+  getKanbanQueueHealth,
+  getTask,
+  getTaskChain,
+  listReadyTasks,
+  listBoards,
+  mergeTasks,
+  moveTask,
+  parseLinesIntoTasks,
+  removeBoard,
+  removeColumn,
+  removeTask,
+  releaseTaskClaim,
+  setTaskChain,
+  splitTask,
+  syncBoardFromTaskGraph,
+  transferTaskToBoard,
+  updateBoard,
+  updateGoalMetricOnTask,
+  updateTask
+} from "@wrongstack/kanban";
 function ok(ws, type, data) {
   send(ws, { type, payload: { success: true, data: data ?? null } });
 }
@@ -9593,7 +10091,7 @@ async function handlePrefsRoute(ws, msg, handlers) {
 // src/server/process-handlers.ts
 async function handleProcessList(ws) {
   try {
-    const { getProcessRegistry } = await import('@wrongstack/tools');
+    const { getProcessRegistry } = await import("@wrongstack/tools");
     const procs = getProcessRegistry().list();
     send(ws, {
       type: "process.list",
@@ -9620,7 +10118,7 @@ async function handleProcessKill(ws, payload) {
   }
   const { pid } = parsed.value;
   try {
-    const { getProcessRegistry } = await import('@wrongstack/tools');
+    const { getProcessRegistry } = await import("@wrongstack/tools");
     const proc = getProcessRegistry().get(pid);
     if (proc?.protected) {
       sendResult(ws, false, `Cannot kill protected process (PID ${pid})`);
@@ -9634,7 +10132,7 @@ async function handleProcessKill(ws, payload) {
 }
 async function handleProcessKillAll(ws) {
   try {
-    const { getProcessRegistry } = await import('@wrongstack/tools');
+    const { getProcessRegistry } = await import("@wrongstack/tools");
     getProcessRegistry().killAll();
     sendResult(ws, true, "All processes killed");
   } catch (err) {
@@ -9944,7 +10442,7 @@ function createMessageDispatcher(opts) {
       skillLoader: deps2.skillLoader,
       skillInstaller: deps2.skillInstaller,
       projectRoot,
-      projectSkillsDir: path5__default.join(projectRoot, ".wrongstack", "skills"),
+      projectSkillsDir: path17.join(projectRoot, ".wrongstack", "skills"),
       globalSkillsDir: deps2.wpaths.globalSkills
     };
   }
@@ -10399,6 +10897,7 @@ function createMessageDispatcher(opts) {
         break;
       }
       case "prefs.update": {
+        void ws;
         throw new Error("handlePrefsRoute did not claim prefs.update \u2014 check chain order");
       }
       case "prefs.get": {
@@ -10412,6 +10911,11 @@ function createMessageDispatcher(opts) {
     }
   };
 }
+
+// src/server/pref-helpers.ts
+import { atomicWrite as atomicWrite6 } from "@wrongstack/core/utils";
+import { decryptConfigSecrets as decryptConfigSecrets2, encryptConfigSecrets as encryptConfigSecrets2 } from "@wrongstack/core/security";
+import * as fs13 from "node:fs/promises";
 var PREF_KEYS = [
   "autonomy",
   "autonomyDelayMs",
@@ -10471,7 +10975,7 @@ async function updateGlobalConfig(deps2, holder, mutate, errorLabel) {
   const write = async () => {
     let raw;
     try {
-      raw = await fs4.readFile(globalConfigPath, "utf8");
+      raw = await fs13.readFile(globalConfigPath, "utf8");
     } catch {
       raw = "{}";
     }
@@ -10482,10 +10986,10 @@ async function updateGlobalConfig(deps2, holder, mutate, errorLabel) {
       logger.warn(`${errorLabel}: refusing to overwrite corrupt config at ${globalConfigPath}`);
       return;
     }
-    const decrypted = decryptConfigSecrets(parsed, vault);
+    const decrypted = decryptConfigSecrets2(parsed, vault);
     mutate(decrypted);
-    const encrypted = encryptConfigSecrets(decrypted, vault);
-    await atomicWrite$1(globalConfigPath, JSON.stringify(encrypted, null, 2), { mode: 384 });
+    const encrypted = encryptConfigSecrets2(decrypted, vault);
+    await atomicWrite6(globalConfigPath, JSON.stringify(encrypted, null, 2), { mode: 384 });
   };
   const next = holder.lock.then(write);
   holder.lock = next.then(
@@ -10647,13 +11151,18 @@ async function persistPrefsToConfig(deps2, holder, payload) {
     }
   }, "prefs");
 }
+
+// src/server/projects-manifest.ts
+import * as fs14 from "node:fs/promises";
+import * as path18 from "node:path";
+import { projectSlug } from "@wrongstack/core";
 function projectsJsonPath(globalConfigPath) {
-  const base = path5.dirname(globalConfigPath);
-  return path5.join(base, "projects.json");
+  const base = path18.dirname(globalConfigPath);
+  return path18.join(base, "projects.json");
 }
 async function loadManifest(globalConfigPath) {
   try {
-    const raw = await fs4.readFile(projectsJsonPath(globalConfigPath), "utf8");
+    const raw = await fs14.readFile(projectsJsonPath(globalConfigPath), "utf8");
     const parsed = JSON.parse(raw);
     return { projects: parsed.projects ?? [] };
   } catch {
@@ -10662,18 +11171,26 @@ async function loadManifest(globalConfigPath) {
 }
 async function saveManifest(manifest, globalConfigPath) {
   const file = projectsJsonPath(globalConfigPath);
-  await fs4.mkdir(path5.dirname(file), { recursive: true });
-  await fs4.writeFile(file, JSON.stringify(manifest, null, 2), "utf8");
+  await fs14.mkdir(path18.dirname(file), { recursive: true });
+  await fs14.writeFile(file, JSON.stringify(manifest, null, 2), "utf8");
 }
 function generateProjectSlug(rootPath) {
   return projectSlug(rootPath);
 }
 async function ensureProjectDataDir(slug, globalConfigPath) {
-  const base = path5.dirname(globalConfigPath);
-  const dir = path5.join(base, "projects", slug);
-  await fs4.mkdir(dir, { recursive: true });
+  const base = path18.dirname(globalConfigPath);
+  const dir = path18.join(base, "projects", slug);
+  await fs14.mkdir(dir, { recursive: true });
   return dir;
 }
+
+// src/server/provider-handlers.ts
+import { DefaultSecretScrubber } from "@wrongstack/core";
+import {
+  beginOAuthLogin
+} from "@wrongstack/providers/oauth";
+import { probeLocalLlm } from "@wrongstack/runtime/probe";
+import { toErrorMessage as toErrorMessage9 } from "@wrongstack/core/utils";
 function projectSavedProviders(providers) {
   return Object.entries(providers).map(([id, cfg]) => {
     const keys = normalizeKeys(cfg);
@@ -10704,7 +11221,7 @@ function createProviderHandlers(deps2) {
   }
   async function saveConfigProviders(providers) {
     const next = configWriteLock.then(() => saveProviders(globalConfigPath, vault, providers)).catch((err) => {
-      const msg = toErrorMessage(err);
+      const msg = toErrorMessage9(err);
       console.error(JSON.stringify({
         level: "error",
         event: "webui.provider_save_failed",
@@ -10976,10 +11493,23 @@ function createProviderHandlers(deps2) {
     loadConfigProviders
   };
 }
+
+// src/server/routes.ts
+import path21 from "node:path";
+import {
+  enhanceUserPrompt,
+  gatedEnhancerReasoning,
+  recentTextTurns,
+  resolveProviderModelList
+} from "@wrongstack/core";
+import { makeProviderFromConfig as makeProviderFromConfig2 } from "@wrongstack/providers";
+
+// src/server/mailbox-handlers.ts
+import { GlobalMailbox as GlobalMailbox3, resolveProjectDir as resolveProjectDir2 } from "@wrongstack/core";
 async function handleMailboxMessages(ws, deps2, payload) {
   try {
-    const dir = resolveProjectDir(deps2.projectRoot, deps2.globalRoot);
-    const mb = new GlobalMailbox(dir);
+    const dir = resolveProjectDir2(deps2.projectRoot, deps2.globalRoot);
+    const mb = new GlobalMailbox3(dir);
     const limit = payload?.limit ?? 30;
     const unreadForAgent = payload?.unreadOnly === true && payload.agentId !== void 0;
     const messages = await mb.query({
@@ -11019,8 +11549,8 @@ async function handleMailboxMessages(ws, deps2, payload) {
 }
 async function handleMailboxAgents(ws, deps2, payload) {
   try {
-    const dir = resolveProjectDir(deps2.projectRoot, deps2.globalRoot);
-    const mb = new GlobalMailbox(dir);
+    const dir = resolveProjectDir2(deps2.projectRoot, deps2.globalRoot);
+    const mb = new GlobalMailbox3(dir);
     const agents = payload?.onlineOnly ? await mb.getOnlineAgents() : await mb.getAgentStatuses();
     send(ws, {
       type: "mailbox.agents",
@@ -11048,8 +11578,8 @@ async function handleMailboxAgents(ws, deps2, payload) {
 }
 async function handleMailboxClear(ws, deps2) {
   try {
-    const dir = resolveProjectDir(deps2.projectRoot, deps2.globalRoot);
-    const mb = new GlobalMailbox(dir);
+    const dir = resolveProjectDir2(deps2.projectRoot, deps2.globalRoot);
+    const mb = new GlobalMailbox3(dir);
     await mb.clearAll();
     send(ws, { type: "mailbox.cleared", payload: {} });
   } catch (err) {
@@ -11058,14 +11588,21 @@ async function handleMailboxClear(ws, deps2) {
 }
 async function handleMailboxPurge(ws, deps2, opts) {
   try {
-    const dir = resolveProjectDir(deps2.projectRoot, deps2.globalRoot);
-    const mb = new GlobalMailbox(dir);
+    const dir = resolveProjectDir2(deps2.projectRoot, deps2.globalRoot);
+    const mb = new GlobalMailbox3(dir);
     const result = await mb.purgeStale(opts);
     send(ws, { type: "mailbox.purged", payload: result });
   } catch (err) {
     send(ws, { type: "mailbox.purged", payload: { error: errMessage(err) } });
   }
 }
+
+// src/server/mode-handlers.ts
+import {
+  DefaultSystemPromptBuilder as DefaultSystemPromptBuilder2,
+  resolveWstackPaths as resolveWstackPaths2,
+  ToolValidationError as ToolValidationError5
+} from "@wrongstack/core";
 function createModeHandlers(ctx) {
   return {
     listModes: async (ws) => {
@@ -11108,14 +11645,14 @@ function createModeHandlers(ctx) {
         } else {
           const found = await ctx.modeStore.getMode(id);
           if (!found) {
-            throw new ToolValidationError({ message: `Unknown mode "${id}"`, field: "modeId" });
+            throw new ToolValidationError5({ message: `Unknown mode "${id}"`, field: "modeId" });
           }
           await ctx.modeStore.setActiveMode(id);
         }
         ctx.setModeId(id);
         const modePrompt = id === "default" ? "" : (await ctx.modeStore.getMode(id))?.prompt ?? "";
-        const paths = resolveWstackPaths$1({ projectRoot: ctx.projectRoot, globalRoot: ctx.globalRoot });
-        const freshBuilder = new DefaultSystemPromptBuilder({
+        const paths = resolveWstackPaths2({ projectRoot: ctx.projectRoot, globalRoot: ctx.globalRoot });
+        const freshBuilder = new DefaultSystemPromptBuilder2({
           memoryStore: ctx.memoryStore,
           skillLoader: ctx.skillLoader,
           modeStore: ctx.modeStore,
@@ -11145,6 +11682,9 @@ function createModeHandlers(ctx) {
     }
   };
 }
+
+// src/server/project-handlers.ts
+import * as path19 from "node:path";
 function createProjectHandlers(ctx) {
   return {
     listProjects: async (ws) => {
@@ -11170,7 +11710,7 @@ function createProjectHandlers(ctx) {
     selectProject: async (ws, msg) => {
       const payload = msg.payload;
       const root = typeof payload?.root === "string" ? payload.root : "";
-      const name2 = typeof payload?.name === "string" ? payload.name : root ? path5.basename(root) : "";
+      const name2 = typeof payload?.name === "string" ? payload.name : root ? path19.basename(root) : "";
       send(ws, {
         type: "projects.selected",
         payload: {
@@ -11203,6 +11743,14 @@ function createProjectHandlers(ctx) {
     }
   };
 }
+
+// src/server/session-handlers.ts
+import * as path20 from "node:path";
+import {
+  DEFAULT_CONTEXT_WINDOW_MODE_ID,
+  repairToolUseAdjacency,
+  resolveContextWindowPolicy as resolveContextWindowPolicy3
+} from "@wrongstack/core";
 function createSessionHandlers(ctx) {
   const currentSessionId = () => ctx.getSession().id;
   const sessionPayload2 = (payload) => {
@@ -11356,7 +11904,7 @@ function createSessionHandlers(ctx) {
         return;
       }
       const { id } = parsed.value;
-      let policy = resolveContextWindowPolicy({}, id);
+      let policy = resolveContextWindowPolicy3({}, id);
       if (policy.id !== id) {
         const customModes = ctx.customModeStore.list().filter((m) => m.custom === true);
         const custom = customModes.find((m) => m.id === id);
@@ -11428,7 +11976,7 @@ function createSessionHandlers(ctx) {
       const { id } = parsed.value;
       if (String(ctx.context.meta["contextWindowMode"] ?? "") === id) {
         ctx.context.meta["contextWindowMode"] = DEFAULT_CONTEXT_WINDOW_MODE_ID;
-        ctx.context.meta["contextWindowPolicy"] = resolveContextWindowPolicy({}, DEFAULT_CONTEXT_WINDOW_MODE_ID);
+        ctx.context.meta["contextWindowPolicy"] = resolveContextWindowPolicy3({}, DEFAULT_CONTEXT_WINDOW_MODE_ID);
       }
       const result = ctx.customModeStore.remove(id);
       sendResult(ws, result.ok, result.error ?? `Mode "${id}" deleted`);
@@ -11548,10 +12096,10 @@ function createSessionHandlers(ctx) {
     listCheckpoints: async (ws, msg) => {
       if (!ensureCurrentSession(ws, msg, "session.checkpoints")) return;
       try {
-        const { DefaultSessionRewinder } = await import('@wrongstack/core');
+        const { DefaultSessionRewinder } = await import("@wrongstack/core");
         const projectRoot = ctx.getProjectRoot();
         const rewinder = new DefaultSessionRewinder(
-          path5.join(projectRoot, ".wrongstack", "sessions"),
+          path20.join(projectRoot, ".wrongstack", "sessions"),
           projectRoot
         );
         const checkpoints = await rewinder.listCheckpoints(ctx.getSession().id);
@@ -11564,10 +12112,10 @@ function createSessionHandlers(ctx) {
       if (!ensureCurrentSession(ws, msg, "session.rewind")) return;
       const { checkpointIndex } = msg.payload;
       try {
-        const { DefaultSessionRewinder } = await import('@wrongstack/core');
+        const { DefaultSessionRewinder } = await import("@wrongstack/core");
         const projectRoot = ctx.getProjectRoot();
         const rewinder = new DefaultSessionRewinder(
-          path5.join(projectRoot, ".wrongstack", "sessions"),
+          path20.join(projectRoot, ".wrongstack", "sessions"),
           projectRoot
         );
         await rewinder.rewindToCheckpoint(ctx.getSession().id, checkpointIndex);
@@ -11652,11 +12200,13 @@ function buildRoutes(state, deps2, cb) {
       const saved = await providerHandlers.loadConfigProviders();
       const cfg = saved[providerId];
       const provider = await resolveProviderCatalogForModels(deps2.modelsRegistry, providerId, cfg);
+      const siblingId = SIBLING_CATALOG[providerId];
+      const siblingCatalog = siblingId && siblingId !== providerId ? await deps2.modelsRegistry.getProvider(siblingId).catch(() => void 0) : void 0;
       const models = await enrichProviderModelDescriptors(
         deps2.modelsRegistry,
         providerId,
         cfg,
-        resolveProviderModelList(cfg?.models, provider, cfg?.type ?? providerId)
+        resolveProviderModelList(cfg?.models, provider, cfg?.type ?? providerId, siblingCatalog)
       );
       send(ws, {
         type: "provider.models",
@@ -11682,7 +12232,7 @@ function buildRoutes(state, deps2, cb) {
         const providerCfg = newCfg.providers?.[newProvider] ?? {
           type: newProvider
         };
-        const newProv = deps2.providerRegistry.has(newProvider) ? deps2.providerRegistry.create({ ...providerCfg, type: newProvider }) : makeProviderFromConfig(newProvider, providerCfg);
+        const newProv = deps2.providerRegistry.has(newProvider) ? deps2.providerRegistry.create({ ...providerCfg, type: newProvider }) : makeProviderFromConfig2(newProvider, providerCfg);
         deps2.context.provider = newProv;
         await cb.updateAutoCompactionMaxContext(newProv, newProvider, providerCfg);
         await cb.updateGlobalConfig((config) => {
@@ -11925,7 +12475,7 @@ function buildRoutes(state, deps2, cb) {
       }
       return handleMailboxMessages(
         ws,
-        { projectRoot: state.getProjectRoot(), globalRoot: path5__default.dirname(deps2.globalConfigPath) },
+        { projectRoot: state.getProjectRoot(), globalRoot: path21.dirname(deps2.globalConfigPath) },
         parsed.value
       );
     },
@@ -11937,13 +12487,13 @@ function buildRoutes(state, deps2, cb) {
       }
       return handleMailboxAgents(
         ws,
-        { projectRoot: state.getProjectRoot(), globalRoot: path5__default.dirname(deps2.globalConfigPath) },
+        { projectRoot: state.getProjectRoot(), globalRoot: path21.dirname(deps2.globalConfigPath) },
         parsed.value
       );
     },
     clear: (ws) => handleMailboxClear(ws, {
       projectRoot: state.getProjectRoot(),
-      globalRoot: path5__default.dirname(deps2.globalConfigPath)
+      globalRoot: path21.dirname(deps2.globalConfigPath)
     }),
     purge: (ws, msg) => {
       const parsed = validateMailboxPurgePayload(msg.payload);
@@ -11953,7 +12503,7 @@ function buildRoutes(state, deps2, cb) {
       }
       return handleMailboxPurge(
         ws,
-        { projectRoot: state.getProjectRoot(), globalRoot: path5__default.dirname(deps2.globalConfigPath) },
+        { projectRoot: state.getProjectRoot(), globalRoot: path21.dirname(deps2.globalConfigPath) },
         parsed.value
       );
     }
@@ -12061,7 +12611,7 @@ async function startWebUI(opts = {}) {
   const updateGlobalConfig2 = async (mutate, errorLabel) => updateGlobalConfig(prefHelperDeps, configWriteLock, mutate, errorLabel);
   console.log("[WebUI] Config loaded:", config.provider ?? "(none)", "/", config.model ?? "(none)");
   if (!config.provider && config.providers && typeof config.providers === "object" && config.providers !== null && !Array.isArray(config.providers) && Object.keys(config.providers).length > 0) {
-    const firstKey = expectDefined(Object.keys(config.providers)[0]);
+    const firstKey = expectDefined3(Object.keys(config.providers)[0]);
     config = patchConfig(config, { provider: firstKey });
     console.log("[WebUI] No active provider \u2014 auto-selected:", firstKey);
   }
@@ -12161,7 +12711,7 @@ async function startWebUI(opts = {}) {
     getProjectRoot: () => projectRoot,
     getWorkingDir: () => workingDir,
     getModeId: () => modeId,
-    getContextMode: () => String(context.meta["contextWindowMode"] ?? DEFAULT_CONTEXT_WINDOW_MODE_ID),
+    getContextMode: () => String(context.meta["contextWindowMode"] ?? DEFAULT_CONTEXT_WINDOW_MODE_ID2),
     getNeedsSetup: () => needsSetup,
     modelsRegistry
   });
@@ -12204,21 +12754,21 @@ async function startWebUI(opts = {}) {
     wpaths
   }, watcherMetricsRef);
   async function touchProjectEntry(root, workDir) {
-    const resolved = path5.resolve(root);
+    const resolved = path22.resolve(root);
     const manifest = await loadManifest(globalConfigPath);
     const now = (/* @__PURE__ */ new Date()).toISOString();
-    const existing = manifest.projects.find((p) => path5.resolve(p.root) === resolved);
+    const existing = manifest.projects.find((p) => path22.resolve(p.root) === resolved);
     if (existing) {
       existing.lastSeen = now;
-      if (workDir) existing.lastWorkingDir = path5.resolve(workDir);
+      if (workDir) existing.lastWorkingDir = path22.resolve(workDir);
     } else {
       manifest.projects.push({
-        name: path5.basename(resolved),
+        name: path22.basename(resolved),
         root: resolved,
         slug: generateProjectSlug(resolved),
         createdAt: now,
         lastSeen: now,
-        lastWorkingDir: workDir ? path5.resolve(workDir) : void 0
+        lastWorkingDir: workDir ? path22.resolve(workDir) : void 0
       });
     }
     await saveManifest(manifest, globalConfigPath);
@@ -12363,13 +12913,13 @@ async function startWebUI(opts = {}) {
             ...snapshot.apiKey !== void 0 ? { apiKey: snapshot.apiKey } : {},
             ...snapshot.baseUrl !== void 0 ? { baseUrl: snapshot.baseUrl } : {}
           };
-          const newProv = deps2.providerRegistry.has(activeId) ? deps2.providerRegistry.create({ ...providerCfg, type: activeId }) : makeProviderFromConfig(activeId, { ...providerCfg, type: activeId });
+          const newProv = deps2.providerRegistry.has(activeId) ? deps2.providerRegistry.create({ ...providerCfg, type: activeId }) : makeProviderFromConfig3(activeId, { ...providerCfg, type: activeId });
           deps2.context.provider = newProv;
           void updateAutoCompactionMaxContext(newProv).catch(() => void 0);
           console.log(`[WebUI] Provider credentials reloaded from config.json (${activeId})`);
         } catch (err) {
           console.warn(
-            `[WebUI] Credential hot-reload failed for ${activeId}: ${toErrorMessage(err)}`
+            `[WebUI] Credential hot-reload failed for ${activeId}: ${toErrorMessage10(err)}`
           );
         }
       },
@@ -12436,20 +12986,33 @@ async function startWebUI(opts = {}) {
     },
     clients: () => clients.keys(),
     servers: [httpServer, wssPrimary, ...wssSecondary ? [wssSecondary] : []],
-    onShutdown: () => {
+    onShutdown: async () => {
       credentialWatcherClose?.();
       brainMonitor.stop();
-      void mcpRegistry.stopAll().catch(() => void 0);
+      await mcpRegistry.stopAll().catch(() => void 0);
       eventArming.getDispose()?.();
       if (eternalSubscription) {
         eternalSubscription.dispose();
         eternalSubscription = null;
       }
       codebaseIndexing.dispose();
-      return unregisterInstance(process.pid, path5.dirname(globalConfigPath));
+      if (config.superMemory?.enabled !== false && config.superMemory?.hygiene?.autoAfterSession !== false) {
+        const candidate = memoryStore;
+        await candidate.hygiene?.({
+          retentionDays: config.superMemory?.hygiene?.retentionDays,
+          archiveLowConfidenceAfterDays: config.superMemory?.hygiene?.archiveLowConfidenceAfterDays
+        }).catch((err) => logger.warn(`super-memory session hygiene failed: ${toErrorMessage10(err)}`));
+      }
+      await unregisterInstance(process.pid, path22.dirname(globalConfigPath));
     }
   });
 }
+
+// src/server/provider-store.ts
+import { expectDefined as expectDefined4 } from "@wrongstack/core";
+import * as fs15 from "node:fs/promises";
+import { decryptConfigSecrets as decryptConfigSecrets3, encryptConfigSecrets as encryptConfigSecrets3 } from "@wrongstack/core/security";
+import { atomicWrite as atomicWrite7 } from "@wrongstack/core";
 function createConfigWriteLock() {
   let lock = Promise.resolve();
   return {
@@ -12471,10 +13034,10 @@ function createProviderStore(deps2) {
   const configWriteLock = createConfigWriteLock();
   async function loadSavedProviders2() {
     try {
-      const raw = await fs4.readFile(globalConfigPath, "utf8");
+      const raw = await fs15.readFile(globalConfigPath, "utf8");
       const parsed = JSON.parse(raw);
       if (!parsed.providers) return {};
-      return decryptConfigSecrets(parsed.providers, vault);
+      return decryptConfigSecrets3(parsed.providers, vault);
     } catch {
       return {};
     }
@@ -12485,14 +13048,14 @@ function createProviderStore(deps2) {
       await prev;
       let parsed;
       try {
-        const raw = await fs4.readFile(globalConfigPath, "utf8");
+        const raw = await fs15.readFile(globalConfigPath, "utf8");
         parsed = JSON.parse(raw);
       } catch {
         parsed = {};
       }
       parsed["providers"] = providers;
-      const encrypted = encryptConfigSecrets(parsed, vault);
-      await atomicWrite(globalConfigPath, JSON.stringify(encrypted, null, 2), { mode: 384 });
+      const encrypted = encryptConfigSecrets3(parsed, vault);
+      await atomicWrite7(globalConfigPath, JSON.stringify(encrypted, null, 2), { mode: 384 });
     } finally {
       release();
     }
@@ -12514,7 +13077,7 @@ function createProviderStore(deps2) {
       return;
     }
     cfg.apiKeys = keys;
-    const active = keys.find((k) => k.label === cfg.activeKey) ?? expectDefined(keys[0]);
+    const active = keys.find((k) => k.label === cfg.activeKey) ?? expectDefined4(keys[0]);
     delete cfg.apiKey;
     if (!cfg.activeKey || !keys.some((k) => k.label === cfg.activeKey)) {
       cfg.activeKey = active.label;
@@ -12533,7 +13096,186 @@ function createProviderStore(deps2) {
     maskedKey: maskedKey2
   };
 }
-
-export { AutoPhaseWebSocketHandler, CollaborationWebSocketHandler, SKIP_DIRS, SddBoardWebSocketHandler, SddWizardWebSocketHandler, SpecsWebSocketHandler, TerminalWebSocketHandler, WorktreeWebSocketHandler, addProvider, bootConfig, broadcast, browserOpenCommand, buildCspHeader, buildSddWizardDeps, buildWebUIAccessUrl, clearAnalyticsBuffer, computeUsageCost, createConfigWriteLock, createCustomModeStore, createEternalSubscription, createHttpServer, createProviderConfigIO, createProviderHandlers, createProviderStore, createShutdown, createToolLspCompletionSource, decodeSessionId, defaultBaseDir, deleteKey, ensureProjectDataDir, envFlag, errMessage, estimateContextBreakdown, estimateTokens, extractToken, extractTokenFromCookie, findFreePort, formatInstances, generateAuthToken, getAnalyticsBuffer, getCostRates, handleApiAnalyticsGet, handleApiAnalyticsPost, handleApiAnalyticsSummary, handleAutoPhaseRoute, handleBrainRoute, handleCompletionRequest, handleDesignList, handleDesignMaterialize, handleDesignSet, handleDesignState, handleDesignUse, handleDesignVerify, handleFilesList, handleFilesRead, handleFilesTree, handleFilesWrite, handleGitChanges, handleGitDiff, handleGitInfo, handleGoalGet, handleMailboxMessages, handleMailboxRoute, handleMcpAdd, handleMcpDisable, handleMcpDiscover, handleMcpEnable, handleMcpList, handleMcpRemove, handleMcpRestart, handleMcpRoute, handleMcpSleep, handleMcpUpdate, handleMcpWake, handleMemoryForget, handleMemoryList, handleMemoryRemember, handleModeRoute, handlePrefsRoute, handleProcessKill, handleProcessKillAll, handleProcessList, handleProjectRoute, handlePromptsContent, handlePromptsCreate, handlePromptsFavorite, handlePromptsList, handlePromptsRecent, handlePromptsSearch, handlePromptsUsed, handleProviderRoute, handleSddBoardRoute, handleSddWizardRoute, handleSessionRoute, handleShellGitRoute, handleShellOpen, handleSkillsContent, handleSkillsCreate, handleSkillsEdit, handleSkillsExport, handleSkillsInstall, handleSkillsList, handleSkillsUninstall, handleSkillsUpdate, handleSpecsRoute, handleWorklistMessage, hostForBrowserUrl, hostHeaderOk, injectWsConfig, injectWsPort, isHiddenEntry, isInsideDist, isLoopbackBind, isLoopbackHostname, isPathInside, isPidAlive, isPortFree, isWildcardBind, listInstances, loadManifest, loadSavedProviders, maskedKey, messagePreview, messageTokens, normalizeKeys, openBrowser, patchConfig, persistPrefsToConfig, projectSavedProviders, projectsJsonPath, rankFiles, registerInstance, registerShutdownHandlers, registryPath, removeProvider, resolveAllPendingConfirms, resolveAuthToken, resolveProviderCatalogForModels, resolveProviderModelMetadata, resolveWorkingDirInsideProject, resolveYoloEligiblePendingConfirms, saveManifest, saveProviders, send, sendResult, setActiveKey, setupEvents, setupWebUICodebaseIndexing, startWebUI, statusProjectHashFromWatchFilename, stringifyContent, tokenMatches, unregisterInstance, upsertKey, validateAutonomySwitchPayload, validateBrainAskPayload, validateBrainRiskPayload, validateContextModeCreatePayload, validateContextModeDeletePayload, validateContextModeSwitchPayload, validateContextModeUpdatePayload, validateGitDiffPayload, validateMailboxAgentsPayload, validateMailboxMessagesPayload, validateMailboxPurgePayload, validateModeSwitchPayload, validateModelSwitchPayload, validatePlanTemplateUsePayload, validatePrefsUpdatePayload, validateProcessKillPayload, validateProjectsAddPayload, validateProjectsSelectPayload, validateShellOpenPayload, validateSkillsCreatePayload, validateSkillsEditPayload, validateWorkingDirSetPayload, verifyClient, writeKeysBack };
+export {
+  AutoPhaseWebSocketHandler,
+  CollaborationWebSocketHandler,
+  SKIP_DIRS,
+  SddBoardWebSocketHandler,
+  SddWizardWebSocketHandler,
+  SpecsWebSocketHandler,
+  TerminalWebSocketHandler,
+  WorktreeWebSocketHandler,
+  addProvider,
+  bootConfig,
+  broadcast,
+  browserOpenCommand,
+  buildCspHeader,
+  buildSddWizardDeps,
+  buildWebUIAccessUrl,
+  clearAnalyticsBuffer,
+  computeUsageCost,
+  createConfigWriteLock,
+  createCustomModeStore,
+  createEternalSubscription,
+  createHttpServer,
+  createProviderConfigIO,
+  createProviderHandlers,
+  createProviderStore,
+  createShutdown,
+  createToolLspCompletionSource,
+  createZipBuffer,
+  decodeSessionId,
+  defaultBaseDir,
+  deleteKey,
+  ensureProjectDataDir,
+  envFlag,
+  errMessage,
+  estimateContextBreakdown,
+  estimateTokens,
+  extractToken,
+  extractTokenFromCookie,
+  findFreePort,
+  formatInstances,
+  generateAuthToken,
+  getAnalyticsBuffer,
+  getCostRates,
+  handleApiAnalyticsGet,
+  handleApiAnalyticsPost,
+  handleApiAnalyticsSummary,
+  handleAutoPhaseRoute,
+  handleBrainRoute,
+  handleCompletionRequest,
+  handleDesignList,
+  handleDesignMaterialize,
+  handleDesignSet,
+  handleDesignState,
+  handleDesignUse,
+  handleDesignVerify,
+  handleFilesList,
+  handleFilesRead,
+  handleFilesTree,
+  handleFilesWrite,
+  handleGitChanges,
+  handleGitDiff,
+  handleGitInfo,
+  handleGoalGet,
+  handleMailboxMessages,
+  handleMailboxRoute,
+  handleMcpAdd,
+  handleMcpDisable,
+  handleMcpDiscover,
+  handleMcpEnable,
+  handleMcpList,
+  handleMcpRemove,
+  handleMcpRestart,
+  handleMcpRoute,
+  handleMcpSleep,
+  handleMcpUpdate,
+  handleMcpWake,
+  handleMemoryForget,
+  handleMemoryList,
+  handleMemoryRemember,
+  handleModeRoute,
+  handlePrefsRoute,
+  handleProcessKill,
+  handleProcessKillAll,
+  handleProcessList,
+  handleProjectRoute,
+  handlePromptsContent,
+  handlePromptsCreate,
+  handlePromptsFavorite,
+  handlePromptsList,
+  handlePromptsRecent,
+  handlePromptsSearch,
+  handlePromptsUsed,
+  handleProviderRoute,
+  handleSddBoardRoute,
+  handleSddWizardRoute,
+  handleSessionRoute,
+  handleShellGitRoute,
+  handleShellOpen,
+  handleSkillsContent,
+  handleSkillsCreate,
+  handleSkillsEdit,
+  handleSkillsExport,
+  handleSkillsInstall,
+  handleSkillsList,
+  handleSkillsUninstall,
+  handleSkillsUpdate,
+  handleSpecsRoute,
+  handleWorklistMessage,
+  hostForBrowserUrl,
+  hostHeaderOk,
+  injectWsConfig,
+  injectWsPort,
+  isHiddenEntry,
+  isInsideDist,
+  isLoopbackBind,
+  isLoopbackHostname,
+  isPathInside,
+  isPidAlive,
+  isPortFree,
+  isWildcardBind,
+  listInstances,
+  loadManifest,
+  loadSavedProviders,
+  maskedKey,
+  messagePreview,
+  messageTokens,
+  normalizeKeys,
+  openBrowser,
+  patchConfig,
+  persistPrefsToConfig,
+  projectSavedProviders,
+  projectsJsonPath,
+  rankFiles,
+  readZipEntries,
+  registerInstance,
+  registerShutdownHandlers,
+  registryPath,
+  removeProvider,
+  resolveAllPendingConfirms,
+  resolveAuthToken,
+  resolveProviderCatalogForModels,
+  resolveProviderModelMetadata,
+  resolveWorkingDirInsideProject,
+  resolveYoloEligiblePendingConfirms,
+  saveManifest,
+  saveProviders,
+  send,
+  sendResult,
+  setActiveKey,
+  setupEvents,
+  setupWebUICodebaseIndexing,
+  startWebUI,
+  statusProjectHashFromWatchFilename,
+  stringifyContent,
+  tokenMatches,
+  unregisterInstance,
+  upsertKey,
+  validateAutonomySwitchPayload,
+  validateBrainAskPayload,
+  validateBrainRiskPayload,
+  validateContextModeCreatePayload,
+  validateContextModeDeletePayload,
+  validateContextModeSwitchPayload,
+  validateContextModeUpdatePayload,
+  validateGitDiffPayload,
+  validateMailboxAgentsPayload,
+  validateMailboxMessagesPayload,
+  validateMailboxPurgePayload,
+  validateModeSwitchPayload,
+  validateModelSwitchPayload,
+  validatePlanTemplateUsePayload,
+  validatePrefsUpdatePayload,
+  validateProcessKillPayload,
+  validateProjectsAddPayload,
+  validateProjectsSelectPayload,
+  validateShellOpenPayload,
+  validateSkillsCreatePayload,
+  validateSkillsEditPayload,
+  validateWorkingDirSetPayload,
+  verifyClient,
+  writeKeysBack
+};
 //# sourceMappingURL=index.js.map
-//# sourceMappingURL=index.js.map