@wrongstack/webui-server 0.284.1 → 0.286.0

package/dist/server/entry.js

@@ -1,35 +1,18 @@
 #!/usr/bin/env node
-import { DefaultSecretScrubber, ToolValidationError, expectDefined, createDefaultPipelines, resolveSessionLoggingConfig, createSessionEventBridge, watchProviderConfig, atomicWrite, bootConfig as bootConfig$1, DefaultModelsRegistry, TOKENS, ProviderRegistry, ToolRegistry, DefaultMemoryStore, EventBus, makeMailboxTool, makeMailSendTool, makeMailInboxTool, makeFleetStatusTool, applyToolDescriptionModes, applyToolResultRenderModes, DefaultSessionStore, getSessionRegistry, DEFAULT_SESSION_PRUNE_DAYS, DefaultSessionReader, AnnotationsStore, FleetNotifier, AgentStatusTracker, DefaultModeStore, DefaultSkillLoader, SkillInstaller, DefaultPromptLoader, PromptUsageStore, DefaultSystemPromptBuilder, GlobalMailbox, Context, resolveContextWindowPolicy, CollaborationBus, collabInjectMiddleware, collabPauseMiddleware, installDesignStudioMiddleware, createStrategyCompactor, AutoCompactionMiddleware, estimateRequestTokensCalibrated, ToolExecutor, DEFAULT_TOOLS_CONFIG, Agent, ObservableBrainArbiter, createTieredBrainArbiter, DefaultBrainArbiter, BrainMonitor, mailboxSessionTag, resolveProjectDir, wstackGlobalRoot, createAutonomyBrain, PhaseStore, PhaseGraphBuilder, WorktreeManager, PhaseOrchestrator, AutoPhasePlanner, assignNickname, computeTaskProgress, DEFAULT_CONTEXT_WINDOW_MODE_ID, repairToolUseAdjacency, resolveWstackPaths, recentTextTurns, gatedEnhancerReasoning, enhanceUserPrompt, resolveProviderModelList, listContextWindowModes, projectSlug, allServers, ConfigError, deserializeTaskGraph, serializeTaskGraph, loadActiveKit, getDesignKitLoader, applyTokenOverrides, runDesignVerify, isDesignStack, materializeTokens, recordOverrides, setDesignOverrides, getDesignState, setActiveKit, recordKitChoice } from '@wrongstack/core';
-import { spawnSync, spawn } from 'child_process';
-import { toErrorMessage, atomicWrite as atomicWrite$1, resolveWstackPaths as resolveWstackPaths$1, wstackGlobalRoot as wstackGlobalRoot$1 } from '@wrongstack/core/utils';
-import * as path5 from 'path';
-import path5__default, { resolve, join, sep, dirname } from 'path';
-import { searchCodebaseIndex } from '@wrongstack/tools/codebase-index/index';
-import { randomUUID, randomBytes, timingSafeEqual } from 'crypto';
-import { WebSocket, WebSocketServer } from 'ws';
-import * as fs4 from 'fs/promises';
-import * as http from 'http';
-import { Buffer } from 'buffer';
-import * as os from 'os';
-import { MCPRegistry, discoverMcp, restartMcp, disableMcp, enableMcp, removeMcp, updateMcp, addMcp, listMcp } from '@wrongstack/mcp';
-import * as net from 'net';
-import { decryptConfigSecrets, encryptConfigSecrets } from '@wrongstack/core/security';
-import { SpecStore, TaskGraphStore, SddBoardStore, applySddLifecycle, SddRunRegistry, SddInterviewDriver, cleanupStaleSddWorktrees, makeCommandVerifier, SddSupervisor, makeLlmSubtaskGenerator, startSddRun } from '@wrongstack/sdd';
-import * as fs12 from 'fs';
-import { watch, existsSync, promises } from 'fs';
-import JSZip from 'jszip';
-import { createRequire } from 'module';
-import { fileURLToPath } from 'url';
-import { makeProviderFromConfig, buildProviderFactoriesFromRegistry, discoverOpenAICompatibleModels, capabilitiesFor, COMPATIBLE_PRESETS } from '@wrongstack/providers';
-import { DefaultTokenCounter } from '@wrongstack/core/infrastructure';
-import { createDefaultContainer, makeLightSubagentFactory } from '@wrongstack/runtime';
-import { ensureSessionShell, builtinToolsPack, rememberTool, forgetTool, searchMemoryTool, relatedMemoryTool, configureExecPolicy, configureDangerBypass, runStartupIndex, isIndexableFile, enqueueReindex, cancelPendingReindexes, shutdownCodebaseIndexHost } from '@wrongstack/tools';
-import { readLiveLock } from '@wrongstack/core/coordination';
-import { removeColumn, addColumn, getTask, removeTask, assignTask, updateGoalMetricOnTask, addGoalMetricToTask, releaseTaskClaim, claimReadyTask, getTaskChain, setTaskChain, copyTaskToBoard, transferTaskToBoard, moveTask, updateTask, mergeTasks, splitTask, addTask, syncBoardFromTaskGraph, exportBoardToTaskGraph, getKanbanOrchestrationSnapshot, listReadyTasks, createBoard, generateBoardFromDescription, parseLinesIntoTasks, getBoard, removeBoard, duplicateBoard, updateBoard, getKanbanQueueHealth, listBoards } from '@wrongstack/kanban';
-import { beginOAuthLogin } from '@wrongstack/providers/oauth';
-import { probeLocalLlm } from '@wrongstack/runtime/probe';
-
 // src/server/entry.ts
+import { ToolValidationError as ToolValidationError6 } from "@wrongstack/core";
+
+// src/server/autophase-ws-handler.ts
+import { spawnSync } from "node:child_process";
+import { toErrorMessage } from "@wrongstack/core/utils";
+import {
+  assignNickname,
+  AutoPhasePlanner,
+  PhaseGraphBuilder,
+  PhaseOrchestrator,
+  PhaseStore,
+  WorktreeManager
+} from "@wrongstack/core";
 function deriveTitle(goal) {
   const firstLine = goal.split("\n").map((l) => l.trim()).find(Boolean);
   if (!firstLine) return "AutoPhase";
@@ -520,6 +503,14 @@ Type: ${task.type}`;
     }
   }
 };
+
+// src/server/completion-handlers.ts
+import * as path from "node:path";
+import { searchCodebaseIndex } from "@wrongstack/tools/codebase-index/index";
+
+// src/server/ws-utils.ts
+import { randomBytes } from "node:crypto";
+import { WebSocket } from "ws";
 function send(ws, msg) {
   if (ws.readyState === WebSocket.OPEN) {
     ws.send(JSON.stringify(msg));
@@ -651,8 +642,8 @@ async function handleCompletionRequest(ws, msg, opts) {
     return;
   }
   const payload = parsed.payload;
-  const projectRoot = path5.resolve(opts.projectRoot);
-  const resolved = path5.resolve(projectRoot, payload.filePath);
+  const projectRoot = path.resolve(opts.projectRoot);
+  const resolved = path.resolve(projectRoot, payload.filePath);
   if (!isInside(projectRoot, resolved)) {
     send(ws, {
       type: "completion.result",
@@ -1051,7 +1042,7 @@ function buildSearchQuery(linePrefix, filePath) {
   if (memberMatch?.[1]) return memberMatch[1];
   const token = linePrefix.match(/([A-Za-z_$][\w$]*)$/)?.[1];
   if (token && token.length >= 2) return token;
-  return path5.basename(filePath, path5.extname(filePath));
+  return path.basename(filePath, path.extname(filePath));
 }
 function currentLinePrefix(prefix) {
   const idx = Math.max(prefix.lastIndexOf("\n"), prefix.lastIndexOf("\r"));
@@ -1081,11 +1072,16 @@ function head(value, max) {
   return value.length <= max ? value : value.slice(0, max);
 }
 function isInside(root, target) {
-  return target === root || target.startsWith(root + path5.sep);
+  return target === root || target.startsWith(root + path.sep);
 }
+
+// src/server/custom-context-modes.ts
+import { listContextWindowModes, atomicWrite } from "@wrongstack/core";
+import * as fs from "node:fs/promises";
+import * as path2 from "node:path";
 var STORE_FILENAME = "custom-context-modes.json";
 function storePath(wrongstackDir) {
-  return path5.join(wrongstackDir, STORE_FILENAME);
+  return path2.join(wrongstackDir, STORE_FILENAME);
 }
 var BUILTIN_IDS = /* @__PURE__ */ new Set(["balanced", "frugal", "deep", "archival"]);
 function createCustomModeStore(wrongstackDir) {
@@ -1093,7 +1089,7 @@ function createCustomModeStore(wrongstackDir) {
   const load2 = async () => {
     modes.clear();
     try {
-      const raw = await fs4.readFile(storePath(wrongstackDir), "utf8");
+      const raw = await fs.readFile(storePath(wrongstackDir), "utf8");
       const parsed = JSON.parse(raw);
       if (Array.isArray(parsed.modes)) {
         for (const m of parsed.modes) {
@@ -1198,6 +1194,23 @@ function createCustomModeStore(wrongstackDir) {
   };
   return { modes, load: load2, save: save2, create, update, remove, list };
 }
+
+// src/server/design-handlers.ts
+import * as fs2 from "node:fs/promises";
+import * as path3 from "node:path";
+import {
+  applyTokenOverrides,
+  getDesignKitLoader,
+  getDesignState,
+  isDesignStack,
+  loadActiveKit,
+  materializeTokens,
+  recordKitChoice,
+  recordOverrides,
+  runDesignVerify,
+  setActiveKit,
+  setDesignOverrides
+} from "@wrongstack/core";
 function readOverrides(value) {
   const out = {};
   if (value && typeof value === "object") {
@@ -1345,9 +1358,9 @@ async function handleDesignMaterialize(ws, ctx, msg) {
       kitId: active.kit,
       outPath: typeof payload.out === "string" ? payload.out : void 0
     });
-    const abs = path5.join(ctx.projectRoot, result.path);
-    await fs4.mkdir(path5.dirname(abs), { recursive: true });
-    await fs4.writeFile(abs, result.content);
+    const abs = path3.join(ctx.projectRoot, result.path);
+    await fs2.mkdir(path3.dirname(abs), { recursive: true });
+    await fs2.writeFile(abs, result.content);
     send(ws, {
       type: "design.materialize",
       payload: { ok: true, path: result.path, format: result.format, stack }
@@ -1406,6 +1419,11 @@ function createEternalSubscription(subscribe, broadcast2, clientsRef) {
   };
 }
 
+// src/server/file-handlers.ts
+import * as fs4 from "node:fs/promises";
+import * as path5 from "node:path";
+import { atomicWrite as atomicWrite2, ToolValidationError as ToolValidationError2 } from "@wrongstack/core";
+
 // src/server/file-picker.ts
 var SKIP_DIRS = /* @__PURE__ */ new Set([
   ".git",
@@ -1453,15 +1471,20 @@ function rankFiles(paths, query, limit) {
   scored.sort((a, b) => b.score - a.score || a.path.localeCompare(b.path));
   return scored.slice(0, limit).map((s) => s.path);
 }
+
+// src/server/path-containment.ts
+import * as fs3 from "node:fs/promises";
+import * as path4 from "node:path";
+import { ToolValidationError } from "@wrongstack/core";
 function isPathInside(root, target) {
-  const relative4 = path5.relative(root, target);
-  return relative4 === "" || !relative4.startsWith("..") && !path5.isAbsolute(relative4);
+  const relative4 = path4.relative(root, target);
+  return relative4 === "" || !relative4.startsWith("..") && !path4.isAbsolute(relative4);
 }
 async function resolveWorkingDirInsideProject(projectRoot, inputPath) {
-  const resolved = path5.resolve(projectRoot, inputPath);
+  const resolved = path4.resolve(projectRoot, inputPath);
   let stat2;
   try {
-    stat2 = await fs4.stat(resolved);
+    stat2 = await fs3.stat(resolved);
   } catch {
     throw new ToolValidationError({
       message: `Directory not found or not accessible: ${resolved}`,
@@ -1475,8 +1498,8 @@ async function resolveWorkingDirInsideProject(projectRoot, inputPath) {
     });
   }
   const [realProjectRoot, realResolved] = await Promise.all([
-    fs4.realpath(projectRoot),
-    fs4.realpath(resolved)
+    fs3.realpath(projectRoot),
+    fs3.realpath(resolved)
   ]);
   if (!isPathInside(realProjectRoot, realResolved)) {
     throw new ToolValidationError({
@@ -1491,14 +1514,14 @@ async function resolveWorkingDirInsideProject(projectRoot, inputPath) {
 async function resolveFileInsideProject(projectRoot, filePath) {
   const resolved = path5.resolve(projectRoot, filePath);
   if (!isPathInside(projectRoot, resolved)) {
-    throw new ToolValidationError({ message: "Path outside project root", field: "path" });
+    throw new ToolValidationError2({ message: "Path outside project root", field: "path" });
   }
   const { parent, base } = splitParentAndBase(resolved);
   const realProjectRoot = await fs4.realpath(projectRoot);
   const realParent = await realpathAllowMissing(parent);
   const realFull = path5.join(realParent, base);
   if (!isPathInside(realProjectRoot, realFull)) {
-    throw new ToolValidationError({ message: "Path outside project root", field: "path" });
+    throw new ToolValidationError2({ message: "Path outside project root", field: "path" });
   }
   return realFull;
 }
@@ -1518,7 +1541,7 @@ async function realpathAllowMissing(p) {
   while (true) {
     const parent = path5.dirname(cursor);
     if (parent === cursor) {
-      throw new ToolValidationError({ message: "Path outside project root", field: "path" });
+      throw new ToolValidationError2({ message: "Path outside project root", field: "path" });
     }
     segments.unshift(path5.basename(cursor));
     try {
@@ -1651,7 +1674,7 @@ async function handleFilesWrite(ws, msg, projectRoot, opts = {}) {
     return;
   }
   try {
-    await atomicWrite(realResolved, content);
+    await atomicWrite2(realResolved, content);
     send(ws, { type: "files.written", payload: { filePath, success: true } });
     if (opts.onWritten) {
       void Promise.resolve(opts.onWritten(realResolved)).catch(() => void 0);
@@ -1715,10 +1738,13 @@ async function handleFilesList(ws, msg, projectRoot) {
     payload: { files: rankFiles(results, payload.query ?? "", limit) }
   });
 }
+
+// src/server/git-handlers.ts
+import nodePath from "node:path";
 async function handleGitInfo(ws, projectRoot) {
   const cwd = projectRoot || void 0;
   try {
-    const { execFile: ef } = await import('child_process');
+    const { execFile: ef } = await import("node:child_process");
     const git = (args) => new Promise((resolve10) => {
       ef("git", args, { cwd, timeout: 3e3 }, (err, stdout) => {
         resolve10(err ? "" : stdout.trim());
@@ -1746,7 +1772,7 @@ async function handleGitInfo(ws, projectRoot) {
 }
 function makeGit(cwd) {
   return async (args) => {
-    const { execFile: ef } = await import('child_process');
+    const { execFile: ef } = await import("node:child_process");
     return new Promise((resolve10) => {
       ef(
         "git",
@@ -1776,15 +1802,15 @@ async function handleGitChanges(ws, projectRoot) {
         if (!m) continue;
         const added = m[1] === "-" ? 0 : Number(m[1]);
         const deleted = m[2] === "-" ? 0 : Number(m[2]);
-        let path23 = m[3] ?? "";
-        if (path23 === "") {
+        let path22 = m[3] ?? "";
+        if (path22 === "") {
           i += 1;
-          path23 = parts[i + 1] ?? parts[i] ?? "";
+          path22 = parts[i + 1] ?? parts[i] ?? "";
           i += 1;
         }
-        if (!path23) continue;
-        const prev = counts.get(path23) ?? { added: 0, deleted: 0 };
-        counts.set(path23, { added: prev.added + added, deleted: prev.deleted + deleted });
+        if (!path22) continue;
+        const prev = counts.get(path22) ?? { added: 0, deleted: 0 };
+        counts.set(path22, { added: prev.added + added, deleted: prev.deleted + deleted });
       }
     };
     parseNumstat(unstagedNumstat);
@@ -1796,7 +1822,7 @@ async function handleGitChanges(ws, projectRoot) {
       if (!rec || rec.length < 3) continue;
       const x = rec[0] ?? " ";
       const y = rec[1] ?? " ";
-      const path23 = rec.slice(3);
+      const path22 = rec.slice(3);
       const isRename = x === "R" || x === "C" || y === "R" || y === "C";
       if (isRename) i += 1;
       let status;
@@ -1808,13 +1834,13 @@ async function handleGitChanges(ws, projectRoot) {
       else if (x === "D" || y === "D") status = "D";
       else status = "M";
       const staged = x !== " " && x !== "?";
-      let added = counts.get(path23)?.added ?? 0;
-      let deleted = counts.get(path23)?.deleted ?? 0;
+      let added = counts.get(path22)?.added ?? 0;
+      let deleted = counts.get(path22)?.deleted ?? 0;
       if (status === "?") {
         added = 0;
         deleted = 0;
       }
-      files.push({ path: path23, status, added, deleted, staged });
+      files.push({ path: path22, status, added, deleted, staged });
     }
     send(ws, { type: "git.changes", payload: { files } });
   } catch (err) {
@@ -1825,21 +1851,21 @@ async function handleGitChanges(ws, projectRoot) {
   }
 }
 var MAX_DIFF_BYTES = 2 * 1024 * 1024;
-async function handleGitDiff(ws, projectRoot, path23) {
+async function handleGitDiff(ws, projectRoot, path22) {
   const cwd = projectRoot || void 0;
-  const reply = (extra) => send(ws, { type: "git.diff", payload: { path: path23, ...extra } });
-  if (!path23 || path23.includes("\0") || path23.includes("..") || path5__default.isAbsolute(path23)) {
+  const reply = (extra) => send(ws, { type: "git.diff", payload: { path: path22, ...extra } });
+  if (!path22 || path22.includes("\0") || path22.includes("..") || nodePath.isAbsolute(path22)) {
     reply({ oldText: "", newText: "", error: "invalid path" });
     return;
   }
   try {
     const git = makeGit(cwd);
-    const { readFile: readFile10 } = await import('fs/promises');
-    const { join: join15 } = await import('path');
-    const oldText = await git(["show", `HEAD:${path23}`]);
+    const { readFile: readFile10 } = await import("node:fs/promises");
+    const { join: join14 } = await import("node:path");
+    const oldText = await git(["show", `HEAD:${path22}`]);
     let newText = "";
     try {
-      const abs = cwd ? join15(cwd, path23) : path23;
+      const abs = cwd ? join14(cwd, path22) : path22;
       const buf = await readFile10(abs);
       if (buf.includes(0)) {
         reply({ oldText: "", newText: "", binary: true });
@@ -1867,6 +1893,11 @@ async function handleGitDiff(ws, projectRoot, path23) {
   }
 }
 
+// src/server/http-server.ts
+import * as fs5 from "node:fs/promises";
+import * as http from "node:http";
+import * as path6 from "node:path";
+
 // src/server/http-server/api-handlers.ts
 async function handleApiSessions(res, globalRoot) {
   if (!globalRoot) {
@@ -1875,7 +1906,7 @@ async function handleApiSessions(res, globalRoot) {
     return;
   }
   try {
-    const { SessionRegistry } = await import('@wrongstack/core');
+    const { SessionRegistry } = await import("@wrongstack/core");
     const registry = new SessionRegistry(globalRoot);
     const sessions = await registry.list();
     const result = sessions.map((s) => ({
@@ -1913,7 +1944,7 @@ async function handleApiSessionAgents(res, globalRoot, sessionId) {
     return;
   }
   try {
-    const { SessionRegistry } = await import('@wrongstack/core');
+    const { SessionRegistry } = await import("@wrongstack/core");
     const registry = new SessionRegistry(globalRoot);
     const entry = await registry.get(sessionId);
     if (!entry) {
@@ -2053,7 +2084,7 @@ async function handleApiSessionEvents(res, globalRoot, sessionId, limit) {
     return;
   }
   try {
-    const { SessionRegistry, resolveWstackPaths: resolveWstackPaths3, DefaultSessionStore: DefaultSessionStore2, DefaultSessionReader: DefaultSessionReader2 } = await import('@wrongstack/core');
+    const { SessionRegistry, resolveWstackPaths: resolveWstackPaths3, DefaultSessionStore: DefaultSessionStore2, DefaultSessionReader: DefaultSessionReader2 } = await import("@wrongstack/core");
     const registry = new SessionRegistry(globalRoot);
     const entry = await registry.get(sessionId);
     if (!entry) {
@@ -2135,7 +2166,7 @@ async function handleApiSessionMessage(res, req, globalRoot, sessionId) {
   const priority = ["low", "normal", "high"].includes(rawPriority) ? rawPriority : "high";
   const subject = typeof body["subject"] === "string" && body["subject"].trim() ? body["subject"].trim() : "Message from Fleet HQ";
   try {
-    const { SessionRegistry, resolveWstackPaths: resolveWstackPaths3, GlobalMailbox: GlobalMailbox4, mailboxSessionTag: mailboxSessionTag2 } = await import('@wrongstack/core');
+    const { SessionRegistry, resolveWstackPaths: resolveWstackPaths3, GlobalMailbox: GlobalMailbox4, mailboxSessionTag: mailboxSessionTag2 } = await import("@wrongstack/core");
     const registry = new SessionRegistry(globalRoot);
     const entry = await registry.get(sessionId);
     if (!entry) {
@@ -2161,7 +2192,7 @@ async function handleApiSessionMailbox(res, globalRoot, sessionId) {
     return;
   }
   try {
-    const { SessionRegistry, resolveWstackPaths: resolveWstackPaths3, GlobalMailbox: GlobalMailbox4, mailboxSessionTag: mailboxSessionTag2 } = await import('@wrongstack/core');
+    const { SessionRegistry, resolveWstackPaths: resolveWstackPaths3, GlobalMailbox: GlobalMailbox4, mailboxSessionTag: mailboxSessionTag2 } = await import("@wrongstack/core");
     const registry = new SessionRegistry(globalRoot);
     const entry = await registry.get(sessionId);
     if (!entry) {
@@ -2219,7 +2250,7 @@ async function handleApiSessionInterrupt(res, req, globalRoot, sessionId) {
   const reason = typeof body["reason"] === "string" && body["reason"].trim() ? body["reason"].trim() : "Operator requested stop from Fleet HQ";
   const from = typeof body["from"] === "string" && body["from"].trim() ? body["from"].trim() : "human@webui";
   try {
-    const { SessionRegistry, resolveWstackPaths: resolveWstackPaths3, GlobalMailbox: GlobalMailbox4, mailboxSessionTag: mailboxSessionTag2 } = await import('@wrongstack/core');
+    const { SessionRegistry, resolveWstackPaths: resolveWstackPaths3, GlobalMailbox: GlobalMailbox4, mailboxSessionTag: mailboxSessionTag2 } = await import("@wrongstack/core");
     const registry = new SessionRegistry(globalRoot);
     const entry = await registry.get(sessionId);
     if (!entry) {
@@ -2267,7 +2298,7 @@ async function handleApiFleetBroadcast(res, req, globalRoot) {
   }
   const from = typeof body["from"] === "string" && body["from"].trim() ? body["from"].trim() : "human@webui";
   try {
-    const { SessionRegistry, resolveWstackPaths: resolveWstackPaths3, GlobalMailbox: GlobalMailbox4, mailboxSessionTag: mailboxSessionTag2 } = await import('@wrongstack/core');
+    const { SessionRegistry, resolveWstackPaths: resolveWstackPaths3, GlobalMailbox: GlobalMailbox4, mailboxSessionTag: mailboxSessionTag2 } = await import("@wrongstack/core");
     const registry = new SessionRegistry(globalRoot);
     const all = await registry.list();
     const mySlug = all.find((s) => s.pid === process.pid)?.projectSlug;
@@ -2415,6 +2446,10 @@ async function handleApiAnalyticsSummary(res) {
     })
   );
 }
+
+// src/server/ws-auth.ts
+import { Buffer as Buffer2 } from "node:buffer";
+import { timingSafeEqual } from "node:crypto";
 function isLoopbackHostname(hostname) {
   return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1" || hostname === "[::1]";
 }
@@ -2443,8 +2478,8 @@ function allowedHostname(hostname, allowedHostnames) {
 }
 function tokenMatches(provided, expected) {
   if (!provided) return false;
-  const a = Buffer.from(provided);
-  const b = Buffer.from(expected);
+  const a = Buffer2.from(provided);
+  const b = Buffer2.from(expected);
   if (a.length !== b.length) return false;
   return timingSafeEqual(a, b);
 }
@@ -2600,9 +2635,9 @@ function buildCspHeader(wsPort, requestHost, publicWsUrl) {
   return `default-src 'self'; script-src ${scriptSrc}; style-src 'self' 'unsafe-inline'; connect-src ${Array.from(connect).join(" ")}; img-src 'self' data:; font-src 'self' data:; worker-src 'self' blob:; object-src 'none'; base-uri 'self'; frame-ancestors 'none'; form-action 'self'`;
 }
 function isInsideDist(candidate, distDir) {
-  const root = path5.resolve(distDir);
-  const resolved = path5.resolve(candidate);
-  return resolved === root || resolved.startsWith(root + path5.sep);
+  const root = path6.resolve(distDir);
+  const resolved = path6.resolve(candidate);
+  return resolved === root || resolved.startsWith(root + path6.sep);
 }
 function decodeSessionId(segment) {
   try {
@@ -2613,7 +2648,7 @@ function decodeSessionId(segment) {
 }
 function createHttpServer(opts) {
   const port = opts.port ?? Number.parseInt(process.env["PORT"] ?? "3456", 10);
-  const distDir = path5.resolve(opts.distDir);
+  const distDir = path6.resolve(opts.distDir);
   const wsPort = opts.wsPort;
   const requireAccessToken = Boolean(opts.requireToken) || !isLoopbackBind(opts.host);
   return http.createServer(async (req, res) => {
@@ -2790,21 +2825,21 @@ function createHttpServer(opts) {
       }
       let filePath;
       if (url.pathname === "/" || url.pathname === "") {
-        filePath = path5.join(distDir, "index.html");
+        filePath = path6.join(distDir, "index.html");
       } else if (url.pathname.startsWith("/assets/")) {
-        filePath = path5.join(distDir, url.pathname);
+        filePath = path6.join(distDir, url.pathname);
       } else if (url.pathname.startsWith("/")) {
-        filePath = path5.join(distDir, url.pathname);
+        filePath = path6.join(distDir, url.pathname);
       } else {
-        filePath = path5.join(distDir, "index.html");
+        filePath = path6.join(distDir, "index.html");
       }
-      const resolvedPath = path5.resolve(filePath);
+      const resolvedPath = path6.resolve(filePath);
       if (!isInsideDist(resolvedPath, distDir)) {
         res.writeHead(403, { "Content-Type": "text/plain" });
         res.end("Forbidden");
         return;
       }
-      const ext = path5.extname(resolvedPath);
+      const ext = path6.extname(resolvedPath);
       const contentType = MIME_TYPES[ext] ?? "application/octet-stream";
       res.setHeader("Content-Type", contentType);
       res.setHeader("X-Content-Type-Options", "nosniff");
@@ -2816,18 +2851,18 @@ function createHttpServer(opts) {
           "Content-Security-Policy",
           buildCspHeader(wsPort, requestHostForCsp(req.headers.host), opts.publicWsUrl)
         );
-        const html = await fs4.readFile(resolvedPath, "utf8");
+        const html = await fs5.readFile(resolvedPath, "utf8");
         res.writeHead(200);
         res.end(injectWsConfig(html, { wsPort, publicWsUrl: opts.publicWsUrl }));
         return;
       }
-      const fileContent = await fs4.readFile(resolvedPath);
+      const fileContent = await fs5.readFile(resolvedPath);
       res.writeHead(200);
       res.end(fileContent);
     } catch (err) {
       if (err.code === "ENOENT") {
         try {
-          const html = await fs4.readFile(path5.join(distDir, "index.html"), "utf8");
+          const html = await fs5.readFile(path6.join(distDir, "index.html"), "utf8");
           res.writeHead(200, {
             "Content-Type": "text/html",
             "X-Content-Type-Options": "nosniff",
@@ -2851,11 +2886,17 @@ function createHttpServer(opts) {
     }
   });
 }
+
+// src/server/instance-registry.ts
+import * as os from "node:os";
+import * as path7 from "node:path";
+import * as fs6 from "node:fs/promises";
+import { atomicWrite as atomicWrite3 } from "@wrongstack/core";
 function defaultBaseDir() {
-  return path5.join(os.homedir(), ".wrongstack");
+  return path7.join(os.homedir(), ".wrongstack");
 }
 function registryPath(baseDir = defaultBaseDir()) {
-  return path5.join(baseDir, "webui-instances.json");
+  return path7.join(baseDir, "webui-instances.json");
 }
 function isPidAlive(pid) {
   if (!Number.isInteger(pid) || pid <= 0) return false;
@@ -2868,7 +2909,7 @@ function isPidAlive(pid) {
 }
 async function load(file) {
   try {
-    const raw = await fs4.readFile(file, "utf8");
+    const raw = await fs6.readFile(file, "utf8");
     const parsed = JSON.parse(raw);
     if (parsed?.version === 1 && Array.isArray(parsed.instances)) {
       return parsed;
@@ -2878,7 +2919,7 @@ async function load(file) {
   return { version: 1, instances: [] };
 }
 async function save(file, instances) {
-  await atomicWrite(file, `${JSON.stringify({ version: 1, instances }, null, 2)}
+  await atomicWrite3(file, `${JSON.stringify({ version: 1, instances }, null, 2)}
 `, {
     mode: 384
   });
@@ -2923,6 +2964,19 @@ function formatInstances(instances) {
   }
   return lines.join("\n");
 }
+
+// src/server/mcp-handlers.ts
+import { allServers } from "@wrongstack/core";
+import {
+  addMcp,
+  disableMcp,
+  discoverMcp,
+  enableMcp,
+  listMcp,
+  removeMcp,
+  restartMcp,
+  updateMcp
+} from "@wrongstack/mcp";
 function mapStatus(raw) {
   switch (raw) {
     case "connected":
@@ -2938,7 +2992,7 @@ function mapStatus(raw) {
       return "stopped";
   }
 }
-function toView(info) {
+function toView(info, health) {
   const view = {
     name: info.name,
     transport: info.transport,
@@ -2950,6 +3004,7 @@ function toView(info) {
   };
   if (info.description !== void 0) view.description = info.description;
   if (info.lazy !== void 0) view.lazy = info.lazy;
+  if (health !== void 0) view.health = health;
   return view;
 }
 function deps(ws, globalConfigPath, registry) {
@@ -2975,7 +3030,13 @@ async function handleMcpList(ws, _msg, globalConfigPath, mcpRegistry) {
     registry: mcpRegistry,
     presets: allServers()
   });
-  send(ws, { type: "mcp.list", payload: { servers: servers.map(toView) } });
+  const health = new Map(
+    (typeof mcpRegistry.operationalHealth === "function" ? mcpRegistry.operationalHealth() : []).map((item) => [item.name, item])
+  );
+  send(ws, {
+    type: "mcp.list",
+    payload: { servers: servers.map((server) => toView(server, health.get(server.name))) }
+  });
 }
 async function handleMcpAdd(ws, msg, globalConfigPath, mcpRegistry) {
   const d = deps(ws, globalConfigPath, mcpRegistry);
@@ -3125,6 +3186,99 @@ async function handleMcpDiscover(ws, msg, globalConfigPath, mcpRegistry) {
     payload: { success: result.ok, message: result.message }
   });
 }
+async function handleMcpResources(ws, msg, _globalConfigPath, mcpRegistry) {
+  if (!mcpRegistry) return sendContentError(ws, "resources", "", "MCP registry is not available.");
+  const payload = payloadRecord(msg);
+  let serverName = "";
+  try {
+    serverName = requiredPayloadString(payload, "name");
+    const refresh = payload["refresh"] === true;
+    const [resources, resourceTemplates] = await Promise.all([
+      mcpRegistry.listResources(serverName, { refresh }),
+      mcpRegistry.listResourceTemplates(serverName, { refresh })
+    ]);
+    send(ws, {
+      type: "mcp.resources",
+      payload: { name: serverName, resources, resourceTemplates }
+    });
+  } catch (err) {
+    sendContentError(ws, "resources", serverName, errorMessage(err));
+  }
+}
+async function handleMcpPrompts(ws, msg, _globalConfigPath, mcpRegistry) {
+  if (!mcpRegistry) return sendContentError(ws, "prompts", "", "MCP registry is not available.");
+  const payload = payloadRecord(msg);
+  let serverName = "";
+  try {
+    serverName = requiredPayloadString(payload, "name");
+    const prompts = await mcpRegistry.listPrompts(serverName, {
+      refresh: payload["refresh"] === true
+    });
+    send(ws, { type: "mcp.prompts", payload: { name: serverName, prompts } });
+  } catch (err) {
+    sendContentError(ws, "prompts", serverName, errorMessage(err));
+  }
+}
+async function handleMcpResourceRead(ws, msg, _globalConfigPath, mcpRegistry) {
+  if (!mcpRegistry)
+    return sendContentError(ws, "resource.read", "", "MCP registry is not available.");
+  const payload = payloadRecord(msg);
+  let serverName = "";
+  try {
+    serverName = requiredPayloadString(payload, "name");
+    const insertion = await mcpRegistry.selectResourceForInsertion(
+      serverName,
+      requiredPayloadString(payload, "uri")
+    );
+    send(ws, { type: "mcp.content.selected", payload: insertion });
+  } catch (err) {
+    sendContentError(ws, "resource.read", serverName, errorMessage(err));
+  }
+}
+async function handleMcpPromptGet(ws, msg, _globalConfigPath, mcpRegistry) {
+  if (!mcpRegistry) return sendContentError(ws, "prompt.get", "", "MCP registry is not available.");
+  const payload = payloadRecord(msg);
+  let serverName = "";
+  try {
+    serverName = requiredPayloadString(payload, "name");
+    const insertion = await mcpRegistry.selectPromptForInsertion(
+      serverName,
+      requiredPayloadString(payload, "prompt"),
+      promptArguments(payload["arguments"])
+    );
+    send(ws, { type: "mcp.content.selected", payload: insertion });
+  } catch (err) {
+    sendContentError(ws, "prompt.get", serverName, errorMessage(err));
+  }
+}
+function payloadRecord(msg) {
+  return msg.payload && typeof msg.payload === "object" && !Array.isArray(msg.payload) ? msg.payload : {};
+}
+function requiredPayloadString(payload, field) {
+  const value = payload[field];
+  if (typeof value !== "string" || value.length === 0) {
+    throw new Error(`MCP payload field "${field}" must be a non-empty string`);
+  }
+  return value;
+}
+function promptArguments(value) {
+  if (value === void 0) return void 0;
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error("MCP prompt arguments must be an object");
+  }
+  const args = {};
+  for (const [key, item] of Object.entries(value)) {
+    if (typeof item !== "string") throw new Error(`MCP prompt argument "${key}" must be a string`);
+    args[key] = item;
+  }
+  return args;
+}
+function sendContentError(ws, action, name2, error) {
+  send(ws, { type: "mcp.content.error", payload: { action, name: name2, error } });
+}
+function errorMessage(err) {
+  return err instanceof Error ? err.message : String(err);
+}
 
 // src/server/memory-handlers.ts
 async function handleMemoryList(ws, memoryStore) {
@@ -3160,6 +3314,9 @@ async function handleMemoryForget(ws, msg, memoryStore) {
     sendResult(ws, false, errMessage(err));
   }
 }
+
+// src/server/open-browser.ts
+import { spawn } from "node:child_process";
 function browserOpenCommand(url, platform = process.platform) {
   if (platform === "win32") {
     return { command: "cmd", args: ["/c", "start", "", url] };
@@ -3178,7 +3335,7 @@ function openBrowser(url, platform = process.platform) {
     child.unref();
     if (child.pid) {
       try {
-        import('@wrongstack/tools').then(({ getProcessRegistry }) => {
+        import("@wrongstack/tools").then(({ getProcessRegistry }) => {
           const pid = child.pid;
           if (pid === void 0) return;
           getProcessRegistry().register({
@@ -3200,6 +3357,10 @@ function openBrowser(url, platform = process.platform) {
   } catch {
   }
 }
+
+// src/server/port-utils.ts
+import * as net from "node:net";
+import { ToolValidationError as ToolValidationError3 } from "@wrongstack/core";
 function isPortFree(host, port) {
   return new Promise((resolve10) => {
     const srv = net.createServer();
@@ -3225,7 +3386,7 @@ async function findFreePort(host, startPort, opts = {}) {
     }
     port++;
   }
-  throw new ToolValidationError({
+  throw new ToolValidationError3({
     message: `No free port found near ${startPort} on ${host} after ${maxTries} attempts.`,
     field: "port"
   });
@@ -3435,10 +3596,15 @@ async function handlePromptsRecent(ws, ctx) {
     send(ws, { type: "prompts.recent", payload: { slugs: [], error: errMessage(err) } });
   }
 }
+
+// src/server/provider-config-io.ts
+import * as fs7 from "node:fs/promises";
+import { ConfigError, atomicWrite as atomicWrite4 } from "@wrongstack/core";
+import { decryptConfigSecrets, encryptConfigSecrets } from "@wrongstack/core/security";
 async function loadSavedProviders(configPath, vault) {
   let raw;
   try {
-    raw = await fs4.readFile(configPath, "utf8");
+    raw = await fs7.readFile(configPath, "utf8");
   } catch {
     return {};
   }
@@ -3455,7 +3621,7 @@ async function saveProviders(configPath, vault, providers) {
   let raw;
   let fileExists = true;
   try {
-    raw = await fs4.readFile(configPath, "utf8");
+    raw = await fs7.readFile(configPath, "utf8");
   } catch (err) {
     if (err.code !== "ENOENT") {
       throw new ConfigError({
@@ -3484,8 +3650,11 @@ async function saveProviders(configPath, vault, providers) {
   }
   parsed.providers = providers;
   const encrypted = encryptConfigSecrets(parsed, vault);
-  await atomicWrite(configPath, JSON.stringify(encrypted, null, 2), { mode: 384 });
+  await atomicWrite4(configPath, JSON.stringify(encrypted, null, 2), { mode: 384 });
 }
+
+// src/server/provider-keys.ts
+import { expectDefined } from "@wrongstack/core";
 function normalizeKeys(cfg) {
   if (Array.isArray(cfg.apiKeys) && cfg.apiKeys.length > 0) {
     return cfg.apiKeys.map((k) => ({ ...k }));
@@ -3579,6 +3748,12 @@ function removeProvider(providers, providerId) {
   delete providers[providerId];
   return { ok: true, message: `Provider "${providerId}" removed` };
 }
+
+// src/server/sdd-board-ws-handler.ts
+import {
+  applySddLifecycle,
+  SddBoardStore
+} from "@wrongstack/sdd";
 var CONTROL_TYPES = /* @__PURE__ */ new Set([
   "pause",
   "resume",
@@ -3723,6 +3898,26 @@ var SddBoardWebSocketHandler = class {
     if (client.ws.readyState === 1) client.ws.send(JSON.stringify(msg));
   }
 };
+
+// src/server/sdd-wizard-wiring.ts
+import * as path8 from "node:path";
+import { spawnSync as spawnSync2 } from "node:child_process";
+import {
+  WorktreeManager as WorktreeManager2,
+  ToolValidationError as ToolValidationError4
+} from "@wrongstack/core";
+import {
+  cleanupStaleSddWorktrees,
+  makeCommandVerifier,
+  makeLlmSubtaskGenerator,
+  SddBoardStore as SddBoardStore2,
+  SddInterviewDriver,
+  SddRunRegistry,
+  SddSupervisor,
+  SpecStore,
+  startSddRun,
+  TaskGraphStore
+} from "@wrongstack/sdd";
 var PLANNING_ONLY_GUARD = "SYSTEM: You are running a PLANNING-ONLY specification interview. Do NOT write, create, or edit any files, and do NOT run shell/terminal commands or use any code-editing tools \u2014 they are disabled here and any attempt will fail and waste the turn. Respond with TEXT ONLY: ask your question, or emit the requested spec / plan / task JSON. All code is written later, automatically, once the plan is approved and the multi-agent run starts.\n\n---\n\n";
 function buildSddWizardDeps(opts) {
   const registry = new SddRunRegistry();
@@ -3746,14 +3941,14 @@ function buildSddWizardDeps(opts) {
     makeDriver: () => new SddInterviewDriver({
       specStore: new SpecStore({ baseDir: opts.paths.projectSpecs }),
       graphStore: new TaskGraphStore({ baseDir: opts.paths.projectTaskGraphs }),
-      sessionPath: path5.join(opts.paths.projectDir, "sdd-wizard-session.json")
+      sessionPath: path8.join(opts.paths.projectDir, "sdd-wizard-session.json")
     }),
     runInterviewTurn: (prompt) => runIsolatedTurn(prompt, "Spec Architect"),
     startRun: async (driver, { parallelSlots, defaultModel, defaultProvider, fallbackModels, worktrees: useWorktrees }) => {
       const graph = driver.getGraph();
       const tracker = driver.getTracker();
       if (!graph || !tracker) {
-        throw new ToolValidationError({
+        throw new ToolValidationError4({
           message: "No task graph to run \u2014 finish the interview first.",
           field: "taskGraph"
         });
@@ -3761,7 +3956,7 @@ function buildSddWizardDeps(opts) {
       const worktreesEnabled = useWorktrees ?? process.env["WRONGSTACK_SDD_WORKTREES"] !== "0";
       let worktrees;
       if (worktreesEnabled) {
-        const inGit = spawnSync("git", ["rev-parse", "--is-inside-work-tree"], {
+        const inGit = spawnSync2("git", ["rev-parse", "--is-inside-work-tree"], {
           cwd: opts.projectRoot,
           encoding: "utf8",
           windowsHide: true
@@ -3771,14 +3966,14 @@ function buildSddWizardDeps(opts) {
             projectRoot: opts.projectRoot,
             boardsDir: opts.paths.projectSddBoards
           }).catch(() => void 0);
-          worktrees = new WorktreeManager({
+          worktrees = new WorktreeManager2({
             projectRoot: opts.projectRoot,
             events: opts.events,
             sessionId: () => opts.agent.ctx.session?.id
           });
         }
       }
-      const boardStore = new SddBoardStore({ baseDir: opts.paths.projectSddBoards });
+      const boardStore = new SddBoardStore2({ baseDir: opts.paths.projectSddBoards });
       const verifyTask = makeCommandVerifier();
       const superviseFailure = opts.brain ? new SddSupervisor({
         brain: opts.brain,
@@ -3958,20 +4153,25 @@ var SddWizardWebSocketHandler = class {
     if (client.ws.readyState === 1) client.ws.send(JSON.stringify(msg));
   }
 };
+
+// src/server/shell-open.ts
+import * as fs8 from "node:fs/promises";
+import * as path9 from "node:path";
+import { spawn as spawn2 } from "node:child_process";
 var METACHAR_REGEX = /[&|<>^"'`'\n\r]/;
 function shellQuote(s) {
   return s.replaceAll("'", `'"'"'`);
 }
 async function handleShellOpen(req, logger) {
   try {
-    const resolved = path5.resolve(req.path);
-    await fs4.access(resolved);
+    const resolved = path9.resolve(req.path);
+    await fs8.access(resolved);
     if (METACHAR_REGEX.test(resolved)) {
       return { success: false, message: "Path contains unsupported characters." };
     }
     const platform = process.platform;
     const launch = (cmd, args, onError) => {
-      const child = spawn(cmd, args, {
+      const child = spawn2(cmd, args, {
         detached: true,
         stdio: "ignore",
         windowsHide: true
@@ -4015,6 +4215,12 @@ async function handleShellOpen(req, logger) {
   }
 }
 
+// src/server/skills-handlers.ts
+import { promises as fs9 } from "node:fs";
+import path10 from "node:path";
+import { atomicWrite as atomicWrite5 } from "@wrongstack/core";
+import { wstackGlobalRoot } from "@wrongstack/core/utils";
+
 // src/server/ws-payload-validation.ts
 function isRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -4148,6 +4354,16 @@ function validateBrainAskPayload(payload) {
   }
   return { ok: true, value: { question: question.trim() } };
 }
+function validateBrainConfigSetPayload(payload) {
+  if (!isRecord(payload)) {
+    return { ok: false, message: "brain.config.set payload must be an object with a patch object" };
+  }
+  const patch = payload["patch"];
+  if (!isRecord(patch)) {
+    return { ok: false, message: "brain.config.set payload.patch must be an object" };
+  }
+  return { ok: true, value: { patch } };
+}
 function validateAutonomySwitchPayload(payload) {
   if (!isRecord(payload)) {
     return { ok: false, message: "autonomy.switch payload must be an object with string mode" };
@@ -4209,7 +4425,9 @@ var BOOLEAN_PREF_KEYS = /* @__PURE__ */ new Set([
   "hqEnabled",
   "hqRawContent",
   "fallbackAuto",
-  "favoriteModelsOnly"
+  "favoriteModelsOnly",
+  "breakerEnabled",
+  "debugStream"
 ]);
 var STRING_ARRAY_PREF_KEYS = /* @__PURE__ */ new Set(["fallbackModels", "favoriteModels"]);
 var STRING_ARRAY_RECORD_PREF_KEYS = /* @__PURE__ */ new Set(["fallbackProfiles"]);
@@ -4220,9 +4438,17 @@ var NUMBER_PREF_KEYS = /* @__PURE__ */ new Set([
   "maxIterations",
   "maxConcurrent",
   "enhanceDelayMs",
-  "tgLongToolMs"
+  "tgLongToolMs",
+  "breakerAutoKillResetMs"
+]);
+var STRING_PREF_KEYS = /* @__PURE__ */ new Set([
+  "hqUrl",
+  "hqToken",
+  "uiLocale",
+  "thinkingWord",
+  "refinerProvider",
+  "refinerModel"
 ]);
-var STRING_PREF_KEYS = /* @__PURE__ */ new Set(["hqUrl", "hqToken", "uiLocale"]);
 var ENUM_PREF_KEYS = {
   autonomy: AUTONOMY_VALUES,
   contextStrategy: CONTEXT_STRATEGY_VALUES,
@@ -4233,36 +4459,39 @@ var ENUM_PREF_KEYS = {
   auditLevel: AUDIT_LEVEL_VALUES,
   reasoningMode: REASONING_MODE_VALUES,
   reasoningEffort: REASONING_EFFORT_VALUES,
-  cacheTtl: CACHE_TTL_VALUES
+  cacheTtl: CACHE_TTL_VALUES,
+  statuslineMode: /* @__PURE__ */ new Set(["minimum", "detailed", "no-color"]),
+  animationStyle: /* @__PURE__ */ new Set(["rainbow", "wave", "pulse", "dots", "breathe", "cycle"]),
+  fsAccess: /* @__PURE__ */ new Set(["unrestricted", "project"])
 };
-function validateModelRuntimeValue(modelRuntime, path23) {
+function validateModelRuntimeValue(modelRuntime, path22) {
   const reasoning = modelRuntime["reasoning"];
   if (reasoning !== void 0) {
-    if (!isRecord(reasoning)) return `${path23}.reasoning must be an object when provided`;
+    if (!isRecord(reasoning)) return `${path22}.reasoning must be an object when provided`;
     const mode = reasoning["mode"];
     const effort = reasoning["effort"];
     const preserve = reasoning["preserve"];
     if (mode !== void 0 && (typeof mode !== "string" || !REASONING_MODE_VALUES.has(mode))) {
-      return `${path23}.reasoning.mode must be one of: ${Array.from(REASONING_MODE_VALUES).join(", ")}`;
+      return `${path22}.reasoning.mode must be one of: ${Array.from(REASONING_MODE_VALUES).join(", ")}`;
     }
     if (effort !== void 0 && (typeof effort !== "string" || !REASONING_EFFORT_VALUES.has(effort))) {
-      return `${path23}.reasoning.effort must be one of: ${Array.from(REASONING_EFFORT_VALUES).join(", ")}`;
+      return `${path22}.reasoning.effort must be one of: ${Array.from(REASONING_EFFORT_VALUES).join(", ")}`;
     }
     if (preserve !== void 0 && typeof preserve !== "boolean") {
-      return `${path23}.reasoning.preserve must be a boolean when provided`;
+      return `${path22}.reasoning.preserve must be a boolean when provided`;
     }
   }
   const cache = modelRuntime["cache"];
   if (cache !== void 0) {
-    if (!isRecord(cache)) return `${path23}.cache must be an object when provided`;
+    if (!isRecord(cache)) return `${path22}.cache must be an object when provided`;
     const ttl = cache["ttl"];
     if (ttl !== void 0 && (typeof ttl !== "string" || !CACHE_TTL_VALUES.has(ttl) || ttl === "default")) {
-      return `${path23}.cache.ttl must be one of: 5m, 1h`;
+      return `${path22}.cache.ttl must be one of: 5m, 1h`;
     }
   }
   const parameters = modelRuntime["parameters"];
   if (parameters !== void 0 && !isRecord(parameters)) {
-    return `${path23}.parameters must be an object when provided`;
+    return `${path22}.parameters must be an object when provided`;
   }
   return null;
 }
@@ -4542,8 +4771,8 @@ function validateShellOpenPayload(payload) {
   if (!isRecord(payload)) {
     return { ok: false, message: "shell.open payload must be an object with string path" };
   }
-  const path23 = payload["path"];
-  if (typeof path23 !== "string" || path23.trim().length === 0) {
+  const path22 = payload["path"];
+  if (typeof path22 !== "string" || path22.trim().length === 0) {
     return { ok: false, message: "shell.open payload.path must be a non-empty string" };
   }
   const target = payload["target"];
@@ -4556,7 +4785,7 @@ function validateShellOpenPayload(payload) {
   return {
     ok: true,
     value: {
-      path: path23,
+      path: path22,
       ...target !== void 0 ? { target } : {}
     }
   };
@@ -4565,14 +4794,89 @@ function validateGitDiffPayload(payload) {
   if (!isRecord(payload)) {
     return { ok: false, message: "git.diff payload must be an object" };
   }
-  const path23 = payload["path"];
-  if (path23 === void 0 || path23 === null) {
+  const path22 = payload["path"];
+  if (path22 === void 0 || path22 === null) {
     return { ok: true, value: { path: "" } };
   }
-  if (typeof path23 !== "string") {
+  if (typeof path22 !== "string") {
     return { ok: false, message: "git.diff payload.path must be a string when provided" };
   }
-  return { ok: true, value: { path: path23 } };
+  return { ok: true, value: { path: path22 } };
+}
+
+// src/server/zip.ts
+import { deflateRawSync, inflateRawSync } from "node:zlib";
+function createZipBuffer(entries) {
+  const localParts = [];
+  const centralParts = [];
+  let offset = 0;
+  const { date, time } = dosDateTime(/* @__PURE__ */ new Date());
+  for (const entry of entries) {
+    const name2 = Buffer.from(normalizeZipPath(entry.name), "utf8");
+    const data = typeof entry.data === "string" ? Buffer.from(entry.data, "utf8") : Buffer.from(entry.data);
+    const compressed = deflateRawSync(data);
+    const crc = crc32(data);
+    const local = Buffer.alloc(30);
+    local.writeUInt32LE(67324752, 0);
+    local.writeUInt16LE(20, 4);
+    local.writeUInt16LE(2048, 6);
+    local.writeUInt16LE(8, 8);
+    local.writeUInt16LE(time, 10);
+    local.writeUInt16LE(date, 12);
+    local.writeUInt32LE(crc, 14);
+    local.writeUInt32LE(compressed.length, 18);
+    local.writeUInt32LE(data.length, 22);
+    local.writeUInt16LE(name2.length, 26);
+    localParts.push(local, name2, compressed);
+    const central = Buffer.alloc(46);
+    central.writeUInt32LE(33639248, 0);
+    central.writeUInt16LE(798, 4);
+    central.writeUInt16LE(20, 6);
+    central.writeUInt16LE(2048, 8);
+    central.writeUInt16LE(8, 10);
+    central.writeUInt16LE(time, 12);
+    central.writeUInt16LE(date, 14);
+    central.writeUInt32LE(crc, 16);
+    central.writeUInt32LE(compressed.length, 20);
+    central.writeUInt32LE(data.length, 24);
+    central.writeUInt16LE(name2.length, 28);
+    central.writeUInt32LE(offset, 42);
+    centralParts.push(central, name2);
+    offset += local.length + name2.length + compressed.length;
+  }
+  const centralDirectory = Buffer.concat(centralParts);
+  const end = Buffer.alloc(22);
+  end.writeUInt32LE(101010256, 0);
+  end.writeUInt16LE(entries.length, 8);
+  end.writeUInt16LE(entries.length, 10);
+  end.writeUInt32LE(centralDirectory.length, 12);
+  end.writeUInt32LE(offset, 16);
+  return Buffer.concat([...localParts, centralDirectory, end]);
+}
+function normalizeZipPath(value) {
+  const normalized = value.replace(/\\/g, "/").replace(/^\/+/, "");
+  if (!isSafeZipPath(normalized)) throw new Error(`Unsafe ZIP entry path: ${value}`);
+  return normalized;
+}
+function isSafeZipPath(value) {
+  return value.length > 0 && !value.includes("\0") && !value.startsWith("/") && !/^[a-z]:/i.test(value) && !value.split("/").includes("..");
+}
+function dosDateTime(value) {
+  const year = Math.max(1980, Math.min(2107, value.getFullYear()));
+  return {
+    date: year - 1980 << 9 | value.getMonth() + 1 << 5 | value.getDate(),
+    time: value.getHours() << 11 | value.getMinutes() << 5 | Math.floor(value.getSeconds() / 2)
+  };
+}
+var CRC_TABLE = Array.from({ length: 256 }, (_, index) => {
+  let crc = index;
+  for (let bit = 0; bit < 8; bit++) crc = (crc & 1) !== 0 ? 3988292384 ^ crc >>> 1 : crc >>> 1;
+  return crc >>> 0;
+});
+function crc32(data) {
+  let crc = 4294967295;
+  for (const byte of data) crc = crc >>> 8 ^ (CRC_TABLE[(crc ^ byte) & 255] ?? 0);
+  return (crc ^ 4294967295) >>> 0;
 }
 
 // src/server/skills-handlers.ts
@@ -4643,19 +4947,19 @@ async function handleSkillsContent(ws, ctx, msg) {
       send(ws, { type: "skills.content", payload: { name: name2, body: "", path: "", source, relatedFiles: [], references: [], error: `Skill "${name2}" not found` } });
       return;
     }
-    const body = await promises.readFile(entry.path, "utf8");
-    const skillDir = path5__default.dirname(entry.path);
+    const body = await fs9.readFile(entry.path, "utf8");
+    const skillDir = path10.dirname(entry.path);
     let relatedFiles = [];
     try {
-      const files = await promises.readdir(skillDir);
-      relatedFiles = files.filter((f) => f !== path5__default.basename(entry.path)).map((f) => path5__default.join(skillDir, f));
+      const files = await fs9.readdir(skillDir);
+      relatedFiles = files.filter((f) => f !== path10.basename(entry.path)).map((f) => path10.join(skillDir, f));
     } catch {
     }
     const nameLower = name2.toLowerCase();
     const refResults = await Promise.all(
       entries.filter((e) => e.name.toLowerCase() !== nameLower).map(async (e) => {
         try {
-          const content = await promises.readFile(e.path, "utf8");
+          const content = await fs9.readFile(e.path, "utf8");
           return [e.name, content.toLowerCase().includes(nameLower)];
         } catch {
           return [e.name, false];
@@ -4745,20 +5049,20 @@ async function handleSkillsCreate(ws, ctx, msg) {
   }
   const createPayload = parsed.value;
   try {
-    const targetDir = createPayload.scope === "global" ? path5__default.join(
-      ctx.globalSkillsDir ?? path5__default.join(wstackGlobalRoot$1(), "skills"),
+    const targetDir = createPayload.scope === "global" ? path10.join(
+      ctx.globalSkillsDir ?? path10.join(wstackGlobalRoot(), "skills"),
       createPayload.name.trim()
-    ) : path5__default.join(
-      ctx.projectSkillsDir ?? path5__default.join(ctx.projectRoot, ".wrongstack", "skills"),
+    ) : path10.join(
+      ctx.projectSkillsDir ?? path10.join(ctx.projectRoot, ".wrongstack", "skills"),
       createPayload.name.trim()
     );
     try {
-      await promises.access(targetDir);
+      await fs9.access(targetDir);
       send(ws, { type: "skills.created", payload: { success: false, error: `Skill "${createPayload.name}" already exists` } });
       return;
     } catch {
     }
-    await promises.mkdir(targetDir, { recursive: true });
+    await fs9.mkdir(targetDir, { recursive: true });
     const lines = createPayload.description.trim().split("\n");
     const firstLine = (lines[0] ?? "").trim();
     const bodyLines = lines.slice(1).map((l) => l.trim()).filter(Boolean);
@@ -4806,13 +5110,13 @@ ${trigger}
       "- `bug-hunter` \u2014 for systematic bug detection patterns",
       "- `output-standards` \u2014 for standardized `<nextsteps>` formatting"
     ].join("\n");
-    await atomicWrite(path5__default.join(targetDir, "SKILL.md"), skillContent);
+    await atomicWrite5(path10.join(targetDir, "SKILL.md"), skillContent);
     send(ws, {
       type: "skills.created",
       payload: {
         success: true,
         error: null,
-        skill: { name: createPayload.name.trim(), path: path5__default.join(targetDir, "SKILL.md"), scope: createPayload.scope }
+        skill: { name: createPayload.name.trim(), path: path10.join(targetDir, "SKILL.md"), scope: createPayload.scope }
       }
     });
   } catch (err) {
@@ -4842,7 +5146,7 @@ async function handleSkillsEdit(ws, ctx, msg) {
       send(ws, { type: "skills.edited", payload: { success: false, error: `${label} skills cannot be edited` } });
       return;
     }
-    await atomicWrite(entry.path, editPayload.body);
+    await atomicWrite5(entry.path, editPayload.body);
     send(ws, { type: "skills.edited", payload: { success: true, error: null } });
   } catch (err) {
     send(ws, { type: "skills.edited", payload: { success: false, error: errMessage(err) } });
@@ -4855,29 +5159,35 @@ async function handleSkillsExport(ws, ctx) {
   }
   try {
     const entries = await ctx.skillLoader.listEntries();
-    const zip = new JSZip();
+    const zipEntries = [];
     for (const entry of entries) {
       try {
         const body = await ctx.skillLoader.readBody(entry.name);
         const safeName = entry.name.replace(/\//g, "_");
-        zip.file(`${safeName}/SKILL.md`, body);
+        zipEntries.push({ name: `${safeName}/SKILL.md`, data: body });
       } catch {
       }
     }
-    const zipBuffer = await zip.generateAsync({ type: "nodebuffer", compression: "DEFLATE" });
+    const zipBuffer = createZipBuffer(zipEntries);
     const zipBase64 = zipBuffer.toString("base64");
     send(ws, { type: "skills.exported", payload: { zipBase64, skillCount: entries.length, error: void 0 } });
   } catch (err) {
     send(ws, { type: "skills.exported", payload: { zipBase64: "", skillCount: 0, error: errMessage(err) } });
   }
 }
+
+// src/server/specs-ws-handler.ts
+import {
+  computeTaskProgress
+} from "@wrongstack/core";
+import { SpecStore as SpecStore2, TaskGraphStore as TaskGraphStore2 } from "@wrongstack/sdd";
 var SpecsWebSocketHandler = class {
   specStore;
   graphStore;
   clients = /* @__PURE__ */ new Set();
   constructor(specsDir, taskGraphsDir) {
-    this.specStore = new SpecStore({ baseDir: specsDir });
-    this.graphStore = new TaskGraphStore({ baseDir: taskGraphsDir });
+    this.specStore = new SpecStore2({ baseDir: specsDir });
+    this.graphStore = new TaskGraphStore2({ baseDir: taskGraphsDir });
   }
   addClient(ws) {
     const client = { ws, id: crypto.randomUUID() };
@@ -5081,6 +5391,13 @@ function estimateContextBreakdown(input) {
     messages: { total: msgTokens, count: input.messages.length, breakdown: messageBreakdown }
   };
 }
+
+// src/server/worktree-ws-handler.ts
+import { join as join7, resolve as resolve6, sep as sep3 } from "node:path";
+import { WorktreeManager as WorktreeManager3 } from "@wrongstack/core";
+import { cleanupStaleSddWorktrees as cleanupStaleSddWorktrees2 } from "@wrongstack/sdd";
+import { toErrorMessage as toErrorMessage2 } from "@wrongstack/core/utils";
+var MAX_ACTIVITY = 6;
 var ACTIVE_STATUSES = /* @__PURE__ */ new Set(["allocating", "active", "committing", "merging"]);
 var MANAGED_BRANCH_RE = /^wstack\/ap\/[A-Za-z0-9._/-]+$/;
 var WorktreeWebSocketHandler = class {
@@ -5137,13 +5454,13 @@ var WorktreeWebSocketHandler = class {
   // ── orphan management ─────────────────────────────────────────────────────
   /** Absolute managed-worktrees root for this project. */
   worktreesRoot() {
-    return resolve(join(this.management.projectRoot, ".wrongstack", "worktrees"));
+    return resolve6(join7(this.management.projectRoot, ".wrongstack", "worktrees"));
   }
   /** True iff `dir` resolves strictly inside the managed worktrees root. */
   underRoot(dir) {
-    const abs = resolve(dir);
+    const abs = resolve6(dir);
     const root = this.worktreesRoot();
-    return abs !== root && abs.startsWith(root + sep);
+    return abs !== root && abs.startsWith(root + sep3);
   }
   /** Branches of worktrees a live in-session run currently owns. */
   liveActiveBranches() {
@@ -5164,7 +5481,7 @@ var WorktreeWebSocketHandler = class {
       return;
     }
     try {
-      const wt = new WorktreeManager({ projectRoot: this.management.projectRoot });
+      const wt = new WorktreeManager3({ projectRoot: this.management.projectRoot });
       const { worktrees, branches } = await wt.listManaged();
       const live = this.liveActiveBranches();
       const orphans = [];
@@ -5188,7 +5505,7 @@ var WorktreeWebSocketHandler = class {
         }
       });
     } catch (err) {
-      this.logger.debug?.(`worktree orphan scan failed: ${toErrorMessage(err)}`);
+      this.logger.debug?.(`worktree orphan scan failed: ${toErrorMessage2(err)}`);
       this.broadcast({ type: "worktree.orphans", payload: { orphans: [], canClean: false } });
     }
   }
@@ -5212,7 +5529,7 @@ var WorktreeWebSocketHandler = class {
       });
       return;
     }
-    const res = await cleanupStaleSddWorktrees({
+    const res = await cleanupStaleSddWorktrees2({
       projectRoot: this.management.projectRoot,
       boardsDir: this.management.boardsDir
     });
@@ -5251,7 +5568,7 @@ var WorktreeWebSocketHandler = class {
     }
     let removed = false;
     if (dir) {
-      const wt = new WorktreeManager({ projectRoot: this.management.projectRoot });
+      const wt = new WorktreeManager3({ projectRoot: this.management.projectRoot });
       ({ removed } = await wt.removeOne(dir, branch));
     }
     for (const [id, h] of [...this.handles]) {
@@ -5275,7 +5592,7 @@ var WorktreeWebSocketHandler = class {
       this.broadcast({ type: "worktree.merge_result", payload: { ok: false, branch, reason: "a run is live on this worktree \u2014 stop it first" } });
       return;
     }
-    const wt = new WorktreeManager({ projectRoot: this.management.projectRoot });
+    const wt = new WorktreeManager3({ projectRoot: this.management.projectRoot });
     const res = await wt.mergeBranch(branch);
     this.broadcast({
       type: "worktree.merge_result",
@@ -5290,8 +5607,8 @@ var WorktreeWebSocketHandler = class {
       return;
     }
     const base = baseBranch && MANAGED_BRANCH_RE.test(baseBranch) ? baseBranch : void 0;
-    const wt = new WorktreeManager({ projectRoot: this.management.projectRoot });
-    const summary = await wt.diffSummary(resolve(dir), base);
+    const wt = new WorktreeManager3({ projectRoot: this.management.projectRoot });
+    const summary = await wt.diffSummary(resolve6(dir), base);
     this.broadcast({ type: "worktree.diff_result", payload: { dir, summary } });
   }
   // ── internals ───────────────────────────────────────────────────────────
@@ -5363,7 +5680,7 @@ var WorktreeWebSocketHandler = class {
   activity(id, kind, text) {
     const cur = this.handles.get(id);
     if (cur) {
-      const recentActivity = [...cur.recentActivity, { kind, text, at: Date.now() }].slice(-6);
+      const recentActivity = [...cur.recentActivity, { kind, text, at: Date.now() }].slice(-MAX_ACTIVITY);
       this.handles.set(id, { ...cur, recentActivity });
     }
     this.broadcast({ type: "worktree.event", payload: { kind, handleId: id, text, at: Date.now() } });
@@ -5395,7 +5712,7 @@ var WorktreeWebSocketHandler = class {
       try {
         if (ws.readyState === 1) ws.send(data);
       } catch (err) {
-        this.logger.debug?.(`worktree broadcast failed: ${toErrorMessage(err)}`);
+        this.logger.debug?.(`worktree broadcast failed: ${toErrorMessage2(err)}`);
       }
     }
   }
@@ -5407,6 +5724,12 @@ var WorktreeWebSocketHandler = class {
   }
 };
 
+// src/server/server-runtime.ts
+import * as path12 from "node:path";
+import { createRequire } from "node:module";
+import { fileURLToPath } from "node:url";
+import { WebSocketServer } from "ws";
+
 // src/server/lifecycle.ts
 function createShutdown(res) {
   const log = res.log ?? ((m) => console.log(m));
@@ -5442,9 +5765,14 @@ function registerShutdownHandlers(res) {
     process.off("SIGTERM", shutdown);
   };
 }
+
+// src/server/setup-events.ts
+import * as fs10 from "node:fs/promises";
+import { watch as fsWatch } from "node:fs";
+import * as path11 from "node:path";
 function statusProjectHashFromWatchFilename(projectsDir, filename) {
   const raw = String(filename);
-  const relative4 = path5.isAbsolute(raw) ? path5.relative(projectsDir, raw) : raw;
+  const relative4 = path11.isAbsolute(raw) ? path11.relative(projectsDir, raw) : raw;
   const parts = relative4.split(/[\\/]+/).filter(Boolean);
   if (parts.length < 2) return null;
   if (parts[parts.length - 1] !== "status.json") return null;
@@ -5457,6 +5785,10 @@ function shouldLogWatcherStats() {
 function setupEvents(deps2) {
   const { events, broadcast: broadcast2, clients, config, context, pendingConfirms, globalConfigPath, sessionBridge, wpaths, watcherMetrics, onFleetBroadcaster } = deps2;
   const disposers = [];
+  let disposed = false;
+  const on = (event, listener) => {
+    disposers.push(events.on(event, listener));
+  };
   const currentSessionId = () => context.session?.id ?? "";
   const sessionPayload2 = (payload) => {
     const provided = payload["sessionId"];
@@ -5472,20 +5804,20 @@ function setupEvents(deps2) {
     sessionBridge?.append(event).catch(() => {
     });
   };
-  events.on("iteration.started", (e) => {
+  on("iteration.started", (e) => {
     const maxIt = typeof context.meta["maxIterations"] === "number" ? context.meta["maxIterations"] : config.tools?.maxIterations ?? 100;
     broadcast2(clients, {
       type: "iteration.started",
       payload: sessionPayload2({ sessionId: e.sessionId, index: e.index, maxIterations: maxIt })
     });
   });
-  events.on("iteration.completed", (e) => {
+  on("iteration.completed", (e) => {
     broadcast2(clients, {
       type: "iteration.completed",
       payload: sessionPayload2({ sessionId: e.sessionId, index: e.index, totalIterations: e.index + 1 })
     });
   });
-  events.on("iteration.limit_reached", (e) => {
+  on("iteration.limit_reached", (e) => {
     broadcast2(clients, {
       type: "iteration.limit_reached",
       payload: sessionPayload2({
@@ -5495,19 +5827,19 @@ function setupEvents(deps2) {
       })
     });
   });
-  events.on("provider.text_delta", (e) => {
+  on("provider.text_delta", (e) => {
     broadcast2(clients, { type: "provider.text_delta", payload: sessionPayload2({ sessionId: e.sessionId, text: e.text, messageId: "current" }) });
   });
-  events.on("provider.thinking_delta", (e) => {
+  on("provider.thinking_delta", (e) => {
     broadcast2(clients, { type: "provider.thinking_delta", payload: sessionPayload2({ sessionId: e.sessionId, text: e.text }) });
   });
-  events.on("provider.stream_error", (e) => {
+  on("provider.stream_error", (e) => {
     broadcast2(clients, {
       type: "provider.stream_error",
       payload: sessionPayload2({ sessionId: e.sessionId, eventType: e.eventType, message: e.msg })
     });
   });
-  events.on("tool.started", (e) => {
+  on("tool.started", (e) => {
     broadcast2(clients, {
       type: "tool.started",
       payload: sessionPayload2({ sessionId: e.sessionId, id: e.id, name: e.name, input: e.input, messageId: `tool_${e.id}` })
@@ -5520,7 +5852,7 @@ function setupEvents(deps2) {
       input: e.input
     });
   });
-  events.on("tool.progress", (e) => {
+  on("tool.progress", (e) => {
     broadcast2(clients, {
       type: "tool.progress",
       // Nested `event` shape — the client handler reads `payload.event?.text`
@@ -5541,7 +5873,7 @@ function setupEvents(deps2) {
       }
     });
   });
-  events.on("tool.executed", (e) => {
+  on("tool.executed", (e) => {
     broadcast2(clients, {
       type: "tool.executed",
       payload: sessionPayload2({ sessionId: e.sessionId, id: e.id, name: e.name, durationMs: e.durationMs, ok: e.ok, input: e.input, output: e.output })
@@ -5581,7 +5913,7 @@ function setupEvents(deps2) {
         try {
           const taskPath = context.meta["task.path"];
           if (typeof taskPath === "string" && taskPath) {
-            const { loadTasks } = await import('@wrongstack/core');
+            const { loadTasks } = await import("@wrongstack/core");
             const file = await loadTasks(taskPath);
             broadcast2(clients, { type: "tasks.updated", payload: sessionPayload2({ sessionId: e.sessionId, tasks: file?.tasks ?? [] }) });
           }
@@ -5590,7 +5922,7 @@ function setupEvents(deps2) {
         try {
           const planPath = context.meta["plan.path"];
           if (typeof planPath === "string" && planPath) {
-            const { loadPlan } = await import('@wrongstack/core');
+            const { loadPlan } = await import("@wrongstack/core");
             const plan = await loadPlan(planPath);
             broadcast2(clients, { type: "plan.updated", payload: sessionPayload2({ sessionId: e.sessionId, plan: plan ?? { version: 1, sessionId: e.sessionId ?? context.session?.id ?? "", updatedAt: (/* @__PURE__ */ new Date()).toISOString(), items: [] } }) });
           }
@@ -5599,7 +5931,7 @@ function setupEvents(deps2) {
       })();
     }
   });
-  events.on("tool.loop_detected", (e) => {
+  on("tool.loop_detected", (e) => {
     broadcast2(clients, {
       type: "tool.loop_detected",
       payload: sessionPayload2({
@@ -5611,19 +5943,19 @@ function setupEvents(deps2) {
       })
     });
   });
-  events.on("trust.persisted", (e) => {
+  on("trust.persisted", (e) => {
     broadcast2(clients, {
       type: "trust.persisted",
       payload: sessionPayload2({ sessionId: e.sessionId, tool: e.tool, pattern: e.pattern, decision: e.decision })
     });
   });
-  events.on("delegate.started", (e) => {
+  on("delegate.started", (e) => {
     broadcast2(clients, {
       type: "delegate.started",
       payload: sessionPayload2({ sessionId: e.sessionId, target: e.target, task: e.task })
     });
   });
-  events.on("delegate.completed", (e) => {
+  on("delegate.completed", (e) => {
     broadcast2(clients, {
       type: "delegate.completed",
       payload: sessionPayload2({
@@ -5641,7 +5973,7 @@ function setupEvents(deps2) {
       })
     });
   });
-  events.on("provider.response", (e) => {
+  on("provider.response", (e) => {
     broadcast2(clients, {
       type: "provider.response",
       payload: sessionPayload2({
@@ -5653,7 +5985,7 @@ function setupEvents(deps2) {
       })
     });
   });
-  events.on("ctx.pct", (e) => {
+  on("ctx.pct", (e) => {
     broadcast2(clients, {
       type: "ctx.pct",
       payload: sessionPayload2({ sessionId: e.sessionId, load: e.load, tokens: e.tokens, maxContext: e.maxContext })
@@ -5670,28 +6002,28 @@ function setupEvents(deps2) {
       })
     });
   });
-  events.on("ctx.max_context", (e) => {
+  on("ctx.max_context", (e) => {
     broadcast2(clients, {
       type: "ctx.max_context",
       payload: sessionPayload2({ sessionId: e.sessionId, providerId: e.providerId, modelId: e.modelId, maxContext: e.maxContext })
     });
   });
-  events.on("token.threshold", (e) => {
+  on("token.threshold", (e) => {
     broadcast2(clients, {
       type: "token.threshold",
       payload: sessionPayload2({ sessionId: e.sessionId, used: e.used, limit: e.limit })
     });
   });
-  events.on("token.cost_estimate_unavailable", (e) => {
+  on("token.cost_estimate_unavailable", (e) => {
     broadcast2(clients, {
       type: "token.cost_estimate_unavailable",
       payload: sessionPayload2({ sessionId: e.sessionId, model: e.model })
     });
   });
-  events.on("context.repaired", (e) => {
+  on("context.repaired", (e) => {
     broadcast2(clients, { type: "context.repaired", payload: sessionPayload2({ sessionId: e.sessionId, removedToolUses: e.removedToolUses, removedToolResults: e.removedToolResults, removedMessages: e.removedMessages }) });
   });
-  events.on("tool.confirm_needed", (e) => {
+  on("tool.confirm_needed", (e) => {
     const id = e.toolUseId ?? `confirm_${Date.now()}`;
     const payload = sessionPayload2({ sessionId: e.sessionId, id, toolName: e.tool?.name ?? "unknown", input: e.input, suggestedPattern: e.suggestedPattern, decisionSource: e.decisionSource, riskTier: e.riskTier });
     pendingConfirms.set(id, {
@@ -5702,7 +6034,7 @@ function setupEvents(deps2) {
     });
     broadcast2(clients, { type: "tool.confirm_needed", payload });
   });
-  events.on("error", (e) => {
+  on("error", (e) => {
     broadcast2(clients, { type: "error", payload: sessionPayload2({ sessionId: e.sessionId, phase: e.phase, message: e.err instanceof Error ? e.err.message : String(e.err) }) });
     appendForCurrentSession(e.sessionId, {
       type: "error",
@@ -5711,13 +6043,13 @@ function setupEvents(deps2) {
       phase: e.phase
     });
   });
-  events.on("session.damaged", (e) => {
+  on("session.damaged", (e) => {
     broadcast2(clients, {
       type: "session.damaged",
       payload: { sessionId: e.sessionId, detail: e.detail }
     });
   });
-  events.on("session.rewound", (e) => {
+  on("session.rewound", (e) => {
     broadcast2(clients, {
       type: "session.rewound",
       payload: sessionPayload2({
@@ -5728,7 +6060,7 @@ function setupEvents(deps2) {
       })
     });
   });
-  events.on("checkpoint.written", (e) => {
+  on("checkpoint.written", (e) => {
     broadcast2(clients, {
       type: "checkpoint.written",
       payload: sessionPayload2({
@@ -5740,19 +6072,19 @@ function setupEvents(deps2) {
       })
     });
   });
-  events.on("in_flight.started", (e) => {
+  on("in_flight.started", (e) => {
     broadcast2(clients, {
       type: "in_flight.started",
       payload: sessionPayload2({ sessionId: e.sessionId, context: e.context, ts: e.ts })
     });
   });
-  events.on("in_flight.ended", (e) => {
+  on("in_flight.ended", (e) => {
     broadcast2(clients, {
       type: "in_flight.ended",
       payload: sessionPayload2({ sessionId: e.sessionId, reason: e.reason, ts: e.ts })
     });
   });
-  events.on("provider.retry", (e) => {
+  on("provider.retry", (e) => {
     broadcast2(clients, {
       type: "provider.retry",
       payload: sessionPayload2({
@@ -5774,7 +6106,7 @@ function setupEvents(deps2) {
       description: e.description
     });
   });
-  events.on("provider.error", (e) => {
+  on("provider.error", (e) => {
     broadcast2(clients, {
       type: "provider.error",
       payload: sessionPayload2({
@@ -5794,7 +6126,7 @@ function setupEvents(deps2) {
       retryable: e.retryable
     });
   });
-  events.on("provider.fallback", (e) => {
+  on("provider.fallback", (e) => {
     broadcast2(clients, {
       type: "provider.fallback",
       payload: sessionPayload2({
@@ -5806,7 +6138,7 @@ function setupEvents(deps2) {
       })
     });
   });
-  events.on("compaction.fired", (e) => {
+  on("compaction.fired", (e) => {
     broadcast2(clients, {
       type: "context.compacted",
       payload: sessionPayload2({
@@ -5818,7 +6150,7 @@ function setupEvents(deps2) {
       })
     });
   });
-  events.on("compaction.failed", (e) => {
+  on("compaction.failed", (e) => {
     broadcast2(clients, {
       type: "compaction.failed",
       payload: sessionPayload2({
@@ -5833,25 +6165,25 @@ function setupEvents(deps2) {
       })
     });
   });
-  events.on("mcp.server.connected", (e) => {
+  on("mcp.server.connected", (e) => {
     broadcast2(clients, {
       type: "mcp.server.connected",
       payload: { name: e.name, toolCount: e.toolCount }
     });
   });
-  events.on("mcp.server.reconnected", (e) => {
+  on("mcp.server.reconnected", (e) => {
     broadcast2(clients, {
       type: "mcp.server.reconnected",
       payload: { name: e.name, toolCount: e.toolCount }
     });
   });
-  events.on("mcp.server.disconnected", (e) => {
+  on("mcp.server.disconnected", (e) => {
     broadcast2(clients, {
       type: "mcp.server.disconnected",
       payload: { name: e.name, reason: e.reason }
     });
   });
-  events.on("coordinator.stats", (e) => {
+  on("coordinator.stats", (e) => {
     broadcast2(clients, {
       type: "coordinator.stats",
       payload: sessionPayload2({
@@ -5879,15 +6211,16 @@ function setupEvents(deps2) {
     broadcast2(clients, { type: "mailbox.agent_registered", payload });
   });
   const forwardSubagent = (kind, payload) => broadcast2(clients, { type: "subagent.event", payload: sessionPayload2({ kind, ...payload }) });
-  events.on("subagent.spawned", (e) => forwardSubagent("spawned", { sessionId: e.sessionId, subagentId: e.subagentId, taskId: e.taskId, name: e.name, provider: e.provider, model: e.model, description: e.description }));
-  events.on("subagent.task_started", (e) => forwardSubagent("task_started", { sessionId: e.sessionId, subagentId: e.subagentId, taskId: e.taskId, description: e.description }));
-  events.on("subagent.tool_executed", (e) => forwardSubagent("tool_executed", { sessionId: e.sessionId, subagentId: e.subagentId, toolName: e.name, durationMs: e.durationMs, ok: e.ok }));
-  events.on("subagent.iteration_summary", (e) => forwardSubagent("iteration_summary", { sessionId: e.sessionId, subagentId: e.subagentId, iteration: e.iteration, toolCalls: e.toolCalls, costUsd: e.costUsd, currentTool: e.currentTool, partialText: e.partialText }));
-  events.on("subagent.budget_warning", (e) => forwardSubagent("budget_warning", { sessionId: e.sessionId, subagentId: e.subagentId, budgetKind: e.kind, used: e.used, limit: e.limit }));
-  events.on("subagent.budget_extended", (e) => forwardSubagent("budget_extended", { sessionId: e.sessionId, subagentId: e.subagentId, budgetKind: e.kind, newLimit: e.newLimit, totalExtensions: e.totalExtensions }));
-  events.on("subagent.ctx_pct", (e) => forwardSubagent("ctx_pct", { sessionId: e.sessionId, subagentId: e.subagentId, load: e.load, tokens: e.tokens, maxContext: e.maxContext }));
-  events.on("subagent.task_completed", (e) => forwardSubagent("task_completed", { sessionId: e.sessionId, subagentId: e.subagentId, status: e.status, iterations: e.iterations, toolCalls: e.toolCalls, finalText: e.finalText, failureReason: e.error?.kind, error: e.error ? { kind: e.error.kind, message: e.error.message } : void 0 }));
-  events.on("agent.timeline.message", (e) => {
+  on("subagent.spawned", (e) => forwardSubagent("spawned", { sessionId: e.sessionId, subagentId: e.subagentId, taskId: e.taskId, name: e.name, provider: e.provider, model: e.model, description: e.description }));
+  on("subagent.task_started", (e) => forwardSubagent("task_started", { sessionId: e.sessionId, subagentId: e.subagentId, taskId: e.taskId, description: e.description }));
+  on("subagent.tool_executed", (e) => forwardSubagent("tool_executed", { sessionId: e.sessionId, subagentId: e.subagentId, toolName: e.name, durationMs: e.durationMs, ok: e.ok }));
+  on("subagent.iteration_summary", (e) => forwardSubagent("iteration_summary", { sessionId: e.sessionId, subagentId: e.subagentId, iteration: e.iteration, toolCalls: e.toolCalls, costUsd: e.costUsd, currentTool: e.currentTool, partialText: e.partialText }));
+  on("subagent.budget_warning", (e) => forwardSubagent("budget_warning", { sessionId: e.sessionId, subagentId: e.subagentId, budgetKind: e.kind, used: e.used, limit: e.limit }));
+  on("subagent.budget_extended", (e) => forwardSubagent("budget_extended", { sessionId: e.sessionId, subagentId: e.subagentId, budgetKind: e.kind, newLimit: e.newLimit, totalExtensions: e.totalExtensions }));
+  on("subagent.ctx_pct", (e) => forwardSubagent("ctx_pct", { sessionId: e.sessionId, subagentId: e.subagentId, load: e.load, tokens: e.tokens, maxContext: e.maxContext }));
+  on("subagent.task_completed", (e) => forwardSubagent("task_completed", { sessionId: e.sessionId, subagentId: e.subagentId, status: e.status, iterations: e.iterations, toolCalls: e.toolCalls, finalText: e.finalText, failureReason: e.error?.kind, error: e.error ? { kind: e.error.kind, message: e.error.message } : void 0 }));
+  on("subagent.removed", (e) => forwardSubagent("removed", { sessionId: e.sessionId, subagentId: e.subagentId, reason: e.reason }));
+  on("agent.timeline.message", (e) => {
     broadcast2(clients, {
       type: "agent.timeline.message",
       payload: sessionPayload2({
@@ -5903,7 +6236,7 @@ function setupEvents(deps2) {
       })
     });
   });
-  events.on("agent.status_changed", (e) => {
+  on("agent.status_changed", (e) => {
     broadcast2(clients, {
       type: "agent.status_changed",
       payload: sessionPayload2({
@@ -5918,7 +6251,7 @@ function setupEvents(deps2) {
     });
   });
   let leaderSpawned = false;
-  events.on("iteration.started", (e) => {
+  on("iteration.started", (e) => {
     if (!leaderSpawned) {
       leaderSpawned = true;
       const provider = context.provider?.id ?? "unknown";
@@ -5932,7 +6265,7 @@ function setupEvents(deps2) {
       });
     }
   });
-  events.on("tool.executed", (e) => {
+  on("tool.executed", (e) => {
     forwardSubagent("tool_executed", {
       sessionId: e.sessionId,
       subagentId: "leader",
@@ -5941,7 +6274,7 @@ function setupEvents(deps2) {
       ok: e.ok
     });
   });
-  events.on("provider.response", (e) => {
+  on("provider.response", (e) => {
     if (e.usage?.input != null) {
       const maxCtx = context.provider.capabilities.maxContext;
       const rawLoad = maxCtx > 0 ? e.usage.input / maxCtx : 0;
@@ -5958,7 +6291,7 @@ function setupEvents(deps2) {
       });
     }
   });
-  events.on("iteration.completed", (e) => {
+  on("iteration.completed", (e) => {
     if (!leaderSpawned) {
       leaderSpawned = true;
       const provider = context.provider?.id ?? "unknown";
@@ -5984,14 +6317,20 @@ function setupEvents(deps2) {
       payload: sessionPayload2({ event: eventName, ...payload })
     });
   });
-  events.on("client.status", async (e) => {
+  events.onPattern("memory.*", (eventName, payload) => {
+    broadcast2(clients, {
+      type: "memory.event",
+      payload: sessionPayload2({ event: eventName, ...payload })
+    });
+  });
+  on("client.status", async (e) => {
     broadcast2(clients, { type: "client.status_update", payload: e });
     if (wpaths?.projectStatus) {
       try {
         const statusFile = wpaths.projectStatus(e.projectHash);
-        const dir = path5.dirname(statusFile);
-        await fs4.mkdir(dir, { recursive: true });
-        await fs4.writeFile(statusFile, JSON.stringify(e, null, 2), "utf-8");
+        const dir = path11.dirname(statusFile);
+        await fs10.mkdir(dir, { recursive: true });
+        await fs10.writeFile(statusFile, JSON.stringify(e, null, 2), "utf-8");
       } catch (err) {
         console.error(
           JSON.stringify({
@@ -6005,7 +6344,7 @@ function setupEvents(deps2) {
     }
   });
   if (wpaths?.projectStatus && wpaths.configDir) {
-    const projectsDir = path5.join(wpaths.configDir, "projects");
+    const projectsDir = path11.join(wpaths.configDir, "projects");
     const knownProjectHashes = /* @__PURE__ */ new Set();
     const debounceTimers = /* @__PURE__ */ new Map();
     const DEBOUNCE_MS = 150;
@@ -6069,8 +6408,9 @@ function setupEvents(deps2) {
     let watcher;
     const startWatcher = async () => {
       try {
-        await fs4.mkdir(projectsDir, { recursive: true });
-        watcher = watch(projectsDir, { persistent: true, recursive: true }, async (eventType, filename) => {
+        await fs10.mkdir(projectsDir, { recursive: true });
+        if (disposed) return;
+        watcher = fsWatch(projectsDir, { persistent: true, recursive: true }, async (eventType, filename) => {
           if (eventType !== "change" && eventType !== "rename") return;
           if (filename == null) return;
           const projectHash = statusProjectHashFromWatchFilename(projectsDir, filename);
@@ -6079,8 +6419,8 @@ function setupEvents(deps2) {
           if (!knownProjectHashes.has(projectHash)) return;
           if (watcherMetrics) watcherMetrics.filesProcessed++;
           try {
-            const targetFile = path5.join(projectsDir, projectHash, "status.json");
-            const content = await fs4.readFile(targetFile, "utf-8");
+            const targetFile = path11.join(projectsDir, projectHash, "status.json");
+            const content = await fs10.readFile(targetFile, "utf-8");
             const statusData = JSON.parse(content);
             scheduleBroadcast(projectHash, statusData);
           } catch {
@@ -6100,7 +6440,7 @@ function setupEvents(deps2) {
         );
       }
     };
-    events.on("client.status", (e) => {
+    on("client.status", (e) => {
       if (e.projectHash) {
         const hash = String(e.projectHash);
         if (!knownProjectHashes.has(hash)) {
@@ -6132,15 +6472,17 @@ function setupEvents(deps2) {
       }
     });
   }
-  const globalRoot = globalConfigPath ? path5.dirname(globalConfigPath) : void 0;
+  const globalRoot = globalConfigPath ? path11.dirname(globalConfigPath) : void 0;
   if (globalRoot) {
     const broadcastSessions = async () => {
       try {
-        const { SessionRegistry } = await import('@wrongstack/core');
+        const { SessionRegistry } = await import("@wrongstack/core");
         const registry = new SessionRegistry(globalRoot);
         const sessions = await registry.list();
         const mySlug = sessions.find((s) => s.pid === process.pid)?.projectSlug;
-        const live = sessions.filter((s) => s.status !== "stale").filter((s) => mySlug ? s.projectSlug === mySlug : true).map((s) => ({
+        const live = sessions.filter(
+          (s) => s.status === "active" || s.status === "idle"
+        ).filter((s) => mySlug ? s.projectSlug === mySlug : true).map((s) => ({
           sessionId: s.sessionId,
           projectName: s.projectName,
           projectSlug: s.projectSlug,
@@ -6179,7 +6521,7 @@ function setupEvents(deps2) {
     disposers.push(() => clearInterval(statusInterval));
     let regDebounce;
     try {
-      const regWatcher = watch(globalRoot, { persistent: false }, (_event, filename) => {
+      const regWatcher = fsWatch(globalRoot, { persistent: false }, (_event, filename) => {
         const name2 = filename ? String(filename) : "";
         if (!name2.startsWith("session-registry.json") || name2.endsWith(".lock")) return;
         if (regDebounce) clearTimeout(regDebounce);
@@ -6194,6 +6536,8 @@ function setupEvents(deps2) {
     void broadcastSessions();
   }
   return () => {
+    if (disposed) return;
+    disposed = true;
     for (const dispose of disposers) {
       try {
         dispose();
@@ -6215,6 +6559,9 @@ function getCostRates(model) {
 function computeUsageCost(usage, rates) {
   return (usage.input * rates.input + usage.output * rates.output + (usage.cacheRead ?? 0) * rates.cacheRead) / 1e6;
 }
+
+// src/server/model-catalog.ts
+import { capabilitiesFor } from "@wrongstack/providers";
 var SIBLING_CATALOG = {
   "anthropic-oauth": "anthropic",
   "openai-codex": "openai",
@@ -6321,6 +6668,9 @@ function readConfiguredBool(providerConfig, key) {
 function positiveNumber(value) {
   return typeof value === "number" && Number.isFinite(value) && value > 0 ? value : void 0;
 }
+
+// src/server/server-runtime.ts
+import { toErrorMessage as toErrorMessage3 } from "@wrongstack/core/utils";
 async function resolvePorts(opts) {
   const requestedWsPort = opts.wsPort ?? 3457;
   const wsHost = opts.wsHost ?? process.env["WEBUI_HOST"] ?? process.env["WS_HOST"] ?? "127.0.0.1";
@@ -6381,7 +6731,7 @@ function createSessionStartPayload(g) {
       inputCost,
       outputCost,
       cacheReadCost,
-      projectName: path5.basename(projectRoot) || projectRoot,
+      projectName: path12.basename(projectRoot) || projectRoot,
       projectRoot,
       cwd: g.getWorkingDir(),
       mode: g.getModeId(),
@@ -6414,18 +6764,31 @@ function createWsServers(ports, accessToken) {
     allowedHostnames: publicHostnames,
     allowBrowserUrlToken: Boolean(ports.publicWsUrl)
   });
-  const WS_MAX_PAYLOAD = 8 * 1024 * 1024;
+  const WS_MAX_PAYLOAD = 20 * 1024 * 1024;
   const wssPrimary = new WebSocketServer({
     port: ports.wsPort,
     host: ports.wsHost,
     verifyClient: verifyClient2,
-    maxPayload: WS_MAX_PAYLOAD
+    maxPayload: WS_MAX_PAYLOAD,
+    // Send a ping every 15s to keep idle connections alive. Without this,
+    // network equipment (routers, proxies, NAT gateways) may drop idle TCP
+    // connections, causing the browser to see a close event and show the
+    // "reconnecting" banner. The browser responds with a pong automatically
+    // (the WebSocket API handles this at the transport level).
+    pingInterval: 15e3,
+    // Wait 5s for a pong before considering the connection dead. A client
+    // that hasn't responded to 3 consecutive pings in a row (45s total
+    // quiet) is almost certainly unreachable — close the socket so the
+    // client can reconnect cleanly rather than hanging indefinitely.
+    pingTimeout: 5e3
   });
   const wssSecondary = ports.wsHost === "127.0.0.1" ? new WebSocketServer({
     port: ports.wsPort,
     host: "::1",
     verifyClient: verifyClient2,
-    maxPayload: WS_MAX_PAYLOAD
+    maxPayload: WS_MAX_PAYLOAD,
+    pingInterval: 15e3,
+    pingTimeout: 5e3
   }) : null;
   const clients = /* @__PURE__ */ new Map();
   console.log(
@@ -6447,7 +6810,7 @@ function armEvents(wssPrimary, wssSecondary, wsHost, wsPort, setupInput, watcher
   };
   wssPrimary.on("listening", () => arm(`${wsHost}:${wsPort}`));
   wssPrimary.on("error", (err) => {
-    console.error(JSON.stringify({ level: "error", event: "webui.ws_server_error", host: wsHost, message: toErrorMessage(err), timestamp: (/* @__PURE__ */ new Date()).toISOString() }));
+    console.error(JSON.stringify({ level: "error", event: "webui.ws_server_error", host: wsHost, message: toErrorMessage3(err), timestamp: (/* @__PURE__ */ new Date()).toISOString() }));
   });
   if (wssSecondary) {
     wssSecondary.on("listening", () => arm(`::1:${wsPort}`));
@@ -6466,13 +6829,13 @@ function armEvents(wssPrimary, wssSecondary, wsHost, wsPort, setupInput, watcher
   };
 }
 function resolveWebuiDistDir(fromUrl, explicitDistDir) {
-  if (explicitDistDir) return path5.resolve(explicitDistDir);
+  if (explicitDistDir) return path12.resolve(explicitDistDir);
   try {
     const requireFromHere2 = createRequire(fromUrl);
     const serverEntry = requireFromHere2.resolve("@wrongstack/webui/server");
-    return path5.resolve(path5.dirname(serverEntry), "..");
+    return path12.resolve(path12.dirname(serverEntry), "..");
   } catch {
-    return path5.resolve(path5.dirname(fileURLToPath(fromUrl)), "..", "..", "dist");
+    return path12.resolve(path12.dirname(fileURLToPath(fromUrl)), "..", "..", "dist");
   }
 }
 function startHttpServer(opts) {
@@ -6487,13 +6850,13 @@ function startHttpServer(opts) {
     watcherMetrics: opts.watcherMetrics,
     onFleetPing: opts.onFleetPing
   });
-  const registryBaseDir = path5.dirname(opts.globalConfigPath);
+  const registryBaseDir = path12.dirname(opts.globalConfigPath);
   httpServer.listen(opts.httpPort, opts.wsHost, () => {
     const openUrl = buildWebUIAccessUrl({ host: opts.wsHost, port: opts.httpPort, token: opts.wsToken, publicUrl: opts.publicUrl });
     console.log(`[WebUI] HTTP server running on ${openUrl}`);
     if (opts.openBrowser) openBrowser(openUrl);
     void registerInstance(
-      { pid: process.pid, httpPort: opts.httpPort, wsPort: opts.wsPort, host: opts.wsHost, projectRoot: opts.projectRoot, projectName: path5.basename(opts.projectRoot) || opts.projectRoot, startedAt: (/* @__PURE__ */ new Date()).toISOString(), url: buildWebUIAccessUrl({ host: opts.wsHost, port: opts.httpPort, publicUrl: opts.publicUrl }) },
+      { pid: process.pid, httpPort: opts.httpPort, wsPort: opts.wsPort, host: opts.wsHost, projectRoot: opts.projectRoot, projectName: path12.basename(opts.projectRoot) || opts.projectRoot, startedAt: (/* @__PURE__ */ new Date()).toISOString(), url: buildWebUIAccessUrl({ host: opts.wsHost, port: opts.httpPort, publicUrl: opts.publicUrl }) },
       registryBaseDir
     ).catch((err) => console.warn(JSON.stringify({ level: "warn", event: "webui.instance_record_failed", message: errMessage(err), timestamp: (/* @__PURE__ */ new Date()).toISOString() })));
   });
@@ -6507,6 +6870,65 @@ function registerShutdown(deps2) {
     onShutdown: deps2.onShutdown
   });
 }
+
+// src/server/pre-context-services.ts
+import * as path15 from "node:path";
+import { createRequire as createRequire2 } from "node:module";
+import { DefaultTokenCounter } from "@wrongstack/core/infrastructure";
+import {
+  AnnotationsStore,
+  DEFAULT_SESSION_PRUNE_DAYS,
+  DefaultModelsRegistry,
+  DefaultModeStore,
+  DefaultPromptLoader,
+  DefaultSessionReader,
+  DefaultSessionStore,
+  DefaultSkillLoader,
+  DefaultSystemPromptBuilder,
+  EventBus,
+  GlobalMailbox,
+  PromptUsageStore,
+  ProviderRegistry,
+  SkillInstaller,
+  TOKENS,
+  ToolRegistry,
+  Context,
+  applyToolDescriptionModes,
+  applyToolResultRenderModes,
+  configureChildEnvGitIdentity,
+  getSessionRegistry as getSessionRegistry2,
+  resolveContextWindowPolicy,
+  makeMailboxTool,
+  makeMailInboxTool,
+  makeFleetStatusTool,
+  makeMailSendTool
+} from "@wrongstack/core";
+import {
+  createSuperMemoryTools
+} from "@wrongstack/super-memory";
+import {
+  MCPAuthorizationManager,
+  MCPRegistry,
+  MCPVaultTokenStore,
+  createVaultBackedMcpAuthorizationProviderFactory
+} from "@wrongstack/mcp";
+import { buildProviderFactoriesFromRegistry } from "@wrongstack/providers";
+import { createDefaultContainer } from "@wrongstack/runtime";
+import {
+  builtinToolsPack,
+  configureDangerBypass,
+  configureExecPolicy,
+  forgetTool,
+  relatedMemoryTool,
+  rememberTool,
+  searchMemoryTool
+} from "@wrongstack/tools";
+import { sessionScopedPath, toErrorMessage as toErrorMessage5 } from "@wrongstack/core/utils";
+
+// src/server/setup-screen.ts
+import { expectDefined as expectDefined2 } from "@wrongstack/core";
+import { toErrorMessage as toErrorMessage4 } from "@wrongstack/core/utils";
+import { makeProviderFromConfig } from "@wrongstack/providers";
 var UNCONFIGURED_CAPABILITIES = {
   tools: false,
   parallelTools: false,
@@ -6546,7 +6968,7 @@ function logCreateFailure(event, err) {
     JSON.stringify({
       level: "error",
       event,
-      message: toErrorMessage(err),
+      message: toErrorMessage4(err),
       timestamp: (/* @__PURE__ */ new Date()).toISOString()
     })
   );
@@ -6571,7 +6993,7 @@ function resolveSetupProvider(opts) {
   const savedProviders = config.providers ?? {};
   const firstKey = Object.keys(savedProviders)[0];
   if (firstKey) {
-    const firstProvider = expectDefined(savedProviders[firstKey]);
+    const firstProvider = expectDefined2(savedProviders[firstKey]);
     try {
       const provider2 = makeProviderFromConfig(firstKey, {
         ...firstProvider,
@@ -6639,6 +7061,20 @@ function seedContextMeta(config, context) {
     meta["reasoningPreserve"] = mr.reasoning?.preserve === true;
     meta["cacheTtl"] = mr.cache?.ttl ?? "default";
   }
+  meta["refinerProvider"] = autonomyCfg["refinerProvider"] ?? "";
+  meta["refinerModel"] = autonomyCfg["refinerModel"] ?? "";
+  meta["thinkingWord"] = autonomyCfg["thinkingWord"] ?? "thinking";
+  meta["statuslineMode"] = autonomyCfg["statuslineMode"] ?? "detailed";
+  meta["animationStyle"] = autonomyCfg["animationStyle"] ?? "rainbow";
+  meta["breakerEnabled"] = config.circuitBreaker?.enabled === true;
+  meta["breakerAutoKillResetMs"] = config.circuitBreaker?.autoKillResetMs ?? 6e4;
+  {
+    const featuresAllow = config.features?.allowOutsideProjectRoot;
+    const toolsRestrict = config.tools?.restrictToProjectRoot;
+    const allow = featuresAllow !== void 0 ? featuresAllow : toolsRestrict !== void 0 ? !toolsRestrict : true;
+    meta["fsAccess"] = allow ? "unrestricted" : "project";
+  }
+  meta["debugStream"] = config.debugStream === true;
   const hqConfig = config.hq;
   meta["hqEnabled"] = hqConfig?.enabled === true;
   meta["hqUrl"] = hqConfig?.url ?? "";
@@ -6651,6 +7087,11 @@ function seedContextMeta(config, context) {
   const tgMs = tgExt?.["longToolThresholdMs"];
   meta["tgLongToolMs"] = typeof tgMs === "number" ? tgMs : 3e4;
 }
+
+// src/server/model-auto-discovery.ts
+import * as fs11 from "node:fs/promises";
+import * as path13 from "node:path";
+import { COMPATIBLE_PRESETS, discoverOpenAICompatibleModels } from "@wrongstack/providers";
 function isOverlayRegistry(value) {
   return !!value && typeof value === "object" && typeof value.mergeOverlay === "function";
 }
@@ -6675,7 +7116,7 @@ function eligibleProviders(config) {
 }
 async function readCache(file) {
   try {
-    return JSON.parse(await fs4.readFile(file, "utf8"));
+    return JSON.parse(await fs11.readFile(file, "utf8"));
   } catch {
     return {};
   }
@@ -6685,7 +7126,7 @@ async function discoverAndMergeWebuiProviders(opts) {
   if (!isOverlayRegistry(registry)) return;
   const targets = eligibleProviders(opts.config);
   if (targets.length === 0) return;
-  const cacheFile = path5.join(opts.cacheDir, "discovered-models-cache.json");
+  const cacheFile = path13.join(opts.cacheDir, "discovered-models-cache.json");
   const cache = await readCache(cacheFile);
   let cacheDirty = false;
   await Promise.all(
@@ -6722,18 +7163,196 @@ async function discoverAndMergeWebuiProviders(opts) {
   );
   if (cacheDirty) {
     try {
-      await fs4.mkdir(path5.dirname(cacheFile), { recursive: true });
-      await fs4.writeFile(cacheFile, JSON.stringify(cache), "utf8");
+      await fs11.mkdir(path13.dirname(cacheFile), { recursive: true });
+      await fs11.writeFile(cacheFile, JSON.stringify(cache), "utf8");
     } catch {
       opts.logger?.debug?.("provider auto-discovery cache write failed");
     }
   }
 }
 
+// src/server/standalone-session-identity.ts
+import * as path14 from "node:path";
+import {
+  AgentStatusTracker,
+  FleetNotifier,
+  getSessionRegistry,
+  RecoveryLock
+} from "@wrongstack/core";
+import { WebSocket as WebSocket2 } from "ws";
+async function createStandaloneSessionIdentityLifecycle(opts) {
+  const { paths, events, logger } = opts;
+  const registry = opts.sessionRegistry ?? getSessionRegistry(paths.globalRoot);
+  const fleetNotifier = new FleetNotifier({
+    baseDir: paths.globalRoot,
+    projectRoot: paths.projectRoot,
+    selfPid: process.pid
+  });
+  let activeSessionId = opts.initialSessionId;
+  let stopped = false;
+  let transition = Promise.resolve();
+  const statusTracker = new AgentStatusTracker({
+    events,
+    registry,
+    sessionId: () => activeSessionId,
+    onUpdate: () => fleetNotifier.notify()
+  });
+  const register = async (sessionId) => {
+    try {
+      await registry.register({
+        sessionId,
+        projectSlug: paths.projectSlug,
+        projectRoot: paths.projectRoot,
+        projectName: path14.basename(paths.projectRoot),
+        workingDir: opts.workingDir,
+        clientType: "webui",
+        pid: process.pid,
+        startedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        agents: statusTracker.getAgents()
+      });
+      fleetNotifier.notify();
+    } catch (err) {
+      logger.debug?.(`WebUI session registry update failed: ${errorMessage2(err)}`);
+    }
+  };
+  await register(activeSessionId);
+  statusTracker.start();
+  const recoveryLock = opts.manageRecoveryLock === false ? void 0 : new RecoveryLock({ dir: paths.projectSessions, sessionStore: opts.sessionStore });
+  let ownsRecoveryLock = false;
+  if (recoveryLock) {
+    try {
+      await recoveryLock.write(activeSessionId);
+      ownsRecoveryLock = true;
+    } catch {
+    }
+  }
+  let stopHqBridges = () => {
+  };
+  let closeHqPublisher = () => {
+  };
+  let restartHqBridges = (_sessionId) => {
+  };
+  if (opts.enableHqTelemetry !== false) {
+    try {
+      const core = await import("@wrongstack/core");
+      const publisher = core.createHqPublisherFromEnv({
+        clientKind: "webui",
+        projectRoot: paths.projectRoot,
+        projectName: path14.basename(paths.projectRoot),
+        appConfig: opts.config,
+        socketFactory: (url) => new WebSocket2(url)
+      });
+      if (publisher) {
+        publisher.connect();
+        closeHqPublisher = () => publisher.close();
+        restartHqBridges = (sessionId) => {
+          stopHqBridges();
+          const stops = [];
+          const add = (start) => {
+            try {
+              stops.push(start());
+            } catch {
+            }
+          };
+          add(
+            () => core.startSessionTelemetryBridge({
+              publisher,
+              events,
+              sessionId,
+              projectRoot: paths.projectRoot,
+              projectName: path14.basename(paths.projectRoot),
+              globalRoot: paths.globalRoot,
+              initialAgents: statusTracker.getAgents(),
+              startedAt: (/* @__PURE__ */ new Date()).toISOString()
+            })
+          );
+          add(
+            () => core.startFleetTelemetryBridge({
+              events,
+              publisher,
+              runId: sessionId,
+              sessionId
+            })
+          );
+          add(() => core.startBrainTelemetryBridge({ events, publisher, sessionId }));
+          add(() => core.startWorktreeTelemetryBridge({ events, publisher, sessionId }));
+          add(
+            () => core.startToolTelemetryBridge({
+              events,
+              publisher,
+              projectRoot: paths.projectRoot,
+              sessionId
+            })
+          );
+          add(() => core.startCostTelemetryBridge({ events, publisher, sessionId }));
+          stopHqBridges = () => {
+            for (const stop2 of stops.splice(0)) {
+              try {
+                stop2();
+              } catch {
+              }
+            }
+          };
+        };
+        restartHqBridges(activeSessionId);
+      }
+    } catch (err) {
+      logger.debug?.(`WebUI HQ telemetry unavailable: ${errorMessage2(err)}`);
+    }
+  }
+  const repointRecovery = async (sessionId) => {
+    if (!recoveryLock) return;
+    try {
+      if (ownsRecoveryLock) await recoveryLock.clear();
+      await recoveryLock.write(sessionId);
+      ownsRecoveryLock = true;
+    } catch {
+      ownsRecoveryLock = false;
+    }
+  };
+  const activate = async (sessionId) => {
+    if (stopped || sessionId === activeSessionId) return;
+    transition = transition.then(async () => {
+      if (stopped || sessionId === activeSessionId) return;
+      activeSessionId = sessionId;
+      await register(sessionId);
+      await repointRecovery(sessionId);
+      try {
+        restartHqBridges(sessionId);
+      } catch (err) {
+        logger.debug?.(`WebUI HQ session swap failed: ${errorMessage2(err)}`);
+      }
+    });
+    await transition;
+  };
+  const stop = async () => {
+    if (stopped) return;
+    stopped = true;
+    await transition.catch(() => void 0);
+    statusTracker.stop();
+    stopHqBridges();
+    closeHqPublisher();
+    fleetNotifier.dispose();
+    try {
+      await registry.markClosing();
+      await registry.unregister();
+    } catch {
+    }
+    if (recoveryLock && ownsRecoveryLock) {
+      await recoveryLock.clear().catch(() => void 0);
+      ownsRecoveryLock = false;
+    }
+  };
+  return { statusTracker, activate, stop };
+}
+function errorMessage2(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+
 // src/server/pre-context-services.ts
 var GITHUB_PROVIDERS_OVERLAY_URL = "https://raw.githubusercontent.com/WrongStack/WrongStack/main/packages/cli/data/providers.json";
 async function createPreContextServices(input) {
-  const { config, wpaths, logger, opts, projectRoot, workingDir, needsProvider } = input;
+  const { config, wpaths, logger, opts, vault, projectRoot, workingDir, needsProvider } = input;
   const modelsRegistry = opts.services?.modelsRegistry ?? new DefaultModelsRegistry({
     cacheFile: wpaths.modelsCache,
     ttlSeconds: 0,
@@ -6745,20 +7364,22 @@ async function createPreContextServices(input) {
       await modelsRegistry.refresh();
       logger.info("models.dev catalog refreshed");
     } catch (err) {
-      logger.warn(`models.dev refresh failed (${toErrorMessage(err)}); using cached catalog`);
+      logger.warn(`models.dev refresh failed (${toErrorMessage5(err)}); using cached catalog`);
     }
   }
   try {
     await discoverAndMergeWebuiProviders({
       config,
       registry: modelsRegistry,
-      cacheDir: path5.dirname(wpaths.modelsCache),
+      cacheDir: path15.dirname(wpaths.modelsCache),
       logger
     });
   } catch (err) {
-    logger.debug(`provider auto-discovery skipped: ${toErrorMessage(err)}`);
+    logger.debug(`provider auto-discovery skipped: ${toErrorMessage5(err)}`);
   }
-  const container = createDefaultContainer({ config, wpaths, logger, modelsRegistry });
+  const events = opts.services?.events ?? new EventBus();
+  events.setLogger(logger);
+  const container = createDefaultContainer({ config, wpaths, logger, modelsRegistry, events });
   const configStore = opts.services?.configStore ?? container.resolve(TOKENS.ConfigStore);
   const providerRegistry = new ProviderRegistry();
   try {
@@ -6766,22 +7387,23 @@ async function createPreContextServices(input) {
     for (const f of factories) providerRegistry.register(f);
     console.log("[WebUI] Provider registry loaded:", providerRegistry.list().length, "providers");
   } catch (err) {
-    console.warn(JSON.stringify({ level: "warn", event: "webui.provider_registry_load_failed", message: toErrorMessage(err), timestamp: (/* @__PURE__ */ new Date()).toISOString() }));
+    console.warn(JSON.stringify({ level: "warn", event: "webui.provider_registry_load_failed", message: toErrorMessage5(err), timestamp: (/* @__PURE__ */ new Date()).toISOString() }));
   }
   const toolRegistry = opts.services?.toolRegistry ?? (() => {
     const r = new ToolRegistry();
     r.registerAllOrThrow([...builtinToolsPack.tools ?? []], builtinToolsPack.name);
     return r;
   })();
-  const memoryStore = new DefaultMemoryStore({ paths: wpaths });
+  const memoryStore = container.resolve(TOKENS.MemoryStore);
   if (config.features.memory) {
     toolRegistry.register(rememberTool(memoryStore));
     toolRegistry.register(forgetTool(memoryStore));
     toolRegistry.register(searchMemoryTool(memoryStore));
     toolRegistry.register(relatedMemoryTool(memoryStore));
+    if (isSuperMemoryService(memoryStore)) {
+      for (const tool of createSuperMemoryTools(memoryStore)) toolRegistry.register(tool);
+    }
   }
-  const events = opts.services?.events ?? new EventBus();
-  events.setLogger(logger);
   toolRegistry.register(makeMailboxTool({ projectDir: wpaths.projectDir, events }));
   toolRegistry.register(makeMailSendTool({ projectDir: wpaths.projectDir, events }));
   toolRegistry.register(makeMailInboxTool({ projectDir: wpaths.projectDir, events }));
@@ -6790,11 +7412,25 @@ async function createPreContextServices(input) {
   applyToolResultRenderModes(toolRegistry, config.tools?.resultRenderMode);
   configureExecPolicy(config.tools?.exec ?? {});
   configureDangerBypass(config.tools?.exec?.danger ?? {});
+  configureChildEnvGitIdentity(config.git?.identity ?? null);
   console.log("[WebUI] Tool registry loaded:", toolRegistry.list().length, "tools");
-  const mcpRegistry = new MCPRegistry({ toolRegistry, events, log: logger, cacheDir: wpaths.cacheDir });
+  const mcpTokenStore = new MCPVaultTokenStore(
+    path15.join(wpaths.projectDir, "mcp-auth.json"),
+    vault
+  );
+  const mcpAuthorizationManager = new MCPAuthorizationManager({ store: mcpTokenStore });
+  const mcpRegistry = new MCPRegistry({
+    toolRegistry,
+    events,
+    log: logger,
+    cacheDir: wpaths.cacheDir,
+    authorizationProviderFactory: createVaultBackedMcpAuthorizationProviderFactory({
+      store: mcpTokenStore
+    }),
+    authorizationManager: mcpAuthorizationManager
+  });
   if (config.features.mcp && config.mcpServers) {
     for (const [name2, cfg] of Object.entries(config.mcpServers)) {
-      if (cfg.enabled === false) continue;
       void mcpRegistry.start({ ...cfg, name: name2 }).catch((err) => {
         logger.warn(`MCP server "${name2}" failed to start at boot`, err);
       });
@@ -6809,7 +7445,7 @@ async function createPreContextServices(input) {
     // surface via the SessionRegistry.
     isSessionInUse: async (sessionId) => {
       try {
-        const registry = getSessionRegistry(wpaths.globalRoot);
+        const registry = getSessionRegistry2(wpaths.globalRoot);
         const live = await registry.listByProject(wpaths.projectSlug);
         const hit = live.find((e) => e.sessionId === sessionId);
         if (hit) {
@@ -6834,120 +7470,22 @@ async function createPreContextServices(input) {
     await input.touchProject(projectRoot, workingDir);
   } catch {
   }
-  let statusTracker;
-  try {
-    const registry = getSessionRegistry(wpaths.globalRoot);
-    await registry.register({
-      sessionId: session.id,
-      projectSlug: wpaths.projectSlug,
+  const sessionIdentity = await createStandaloneSessionIdentityLifecycle({
+    config,
+    events,
+    logger,
+    paths: {
+      globalRoot: wpaths.globalRoot,
       projectRoot,
-      projectName: path5.basename(projectRoot),
-      workingDir,
-      clientType: "webui",
-      pid: process.pid,
-      startedAt: (/* @__PURE__ */ new Date()).toISOString()
-    });
-    const fleetNotifier = new FleetNotifier({ baseDir: wpaths.globalRoot, projectRoot, selfPid: process.pid });
-    statusTracker = new AgentStatusTracker({
-      events,
-      registry,
-      sessionId: () => session.id,
-      onUpdate: () => fleetNotifier.notify()
-    });
-    statusTracker.start();
-    let stopHqSessionBridge;
-    let hqTelemetryPublisher;
-    const stopHqAuxBridges = [];
-    try {
-      const {
-        createHqPublisherFromEnv,
-        startSessionTelemetryBridge,
-        startFleetTelemetryBridge,
-        startBrainTelemetryBridge,
-        startWorktreeTelemetryBridge,
-        startToolTelemetryBridge,
-        startCostTelemetryBridge
-      } = await import('@wrongstack/core');
-      const hqTelemetry = createHqPublisherFromEnv({
-        clientKind: "webui",
-        projectRoot,
-        projectName: path5.basename(projectRoot),
-        appConfig: config,
-        socketFactory: (url) => new WebSocket(url)
-      });
-      if (hqTelemetry) {
-        hqTelemetry.connect();
-        hqTelemetryPublisher = hqTelemetry;
-        stopHqSessionBridge = startSessionTelemetryBridge({
-          publisher: hqTelemetry,
-          events,
-          sessionId: session.id,
-          projectRoot,
-          projectName: path5.basename(projectRoot),
-          globalRoot: wpaths.globalRoot,
-          initialAgents: statusTracker?.getAgents(),
-          startedAt: (/* @__PURE__ */ new Date()).toISOString()
-        });
-        try {
-          stopHqAuxBridges.push(
-            startFleetTelemetryBridge({ events, publisher: hqTelemetry, runId: session.id, sessionId: session.id })
-          );
-        } catch {
-        }
-        try {
-          stopHqAuxBridges.push(
-            startBrainTelemetryBridge({ events, publisher: hqTelemetry, sessionId: session.id })
-          );
-        } catch {
-        }
-        try {
-          stopHqAuxBridges.push(
-            startWorktreeTelemetryBridge({ events, publisher: hqTelemetry, sessionId: session.id })
-          );
-        } catch {
-        }
-        try {
-          stopHqAuxBridges.push(
-            startToolTelemetryBridge({ events, publisher: hqTelemetry, projectRoot, sessionId: session.id })
-          );
-        } catch {
-        }
-        try {
-          stopHqAuxBridges.push(
-            startCostTelemetryBridge({ events, publisher: hqTelemetry, sessionId: session.id })
-          );
-        } catch {
-        }
-      }
-    } catch {
-    }
-    const stopTracking = async () => {
-      try {
-        fleetNotifier.dispose();
-        await registry.markClosing();
-        statusTracker?.stop();
-        stopHqSessionBridge?.();
-        for (const stop of stopHqAuxBridges) {
-          try {
-            stop();
-          } catch {
-          }
-        }
-        hqTelemetryPublisher?.close();
-      } catch {
-      }
-    };
-    process.once("beforeExit", () => {
-      void stopTracking();
-    });
-    process.once("SIGINT", () => {
-      void stopTracking();
-    });
-    process.once("SIGTERM", () => {
-      void stopTracking();
-    });
-  } catch {
-  }
+      projectSlug: wpaths.projectSlug,
+      projectSessions: wpaths.projectSessions
+    },
+    workingDir,
+    initialSessionId: session.id,
+    sessionStore,
+    manageRecoveryLock: !opts.services?.session
+  });
+  const statusTracker = sessionIdentity.statusTracker;
   let context;
   const tokenCounter = new DefaultTokenCounter({
     registry: modelsRegistry,
@@ -6972,7 +7510,7 @@ async function createPreContextServices(input) {
   const modelCapabilitiesRef = { current: modelCapabilities };
   const skillLoader = config.features.skills ? new DefaultSkillLoader({ paths: wpaths }) : void 0;
   const skillInstaller = config.features.skills ? new SkillInstaller({
-    manifestPath: path5.join(wpaths.globalRoot, "installed-skills.json"),
+    manifestPath: path15.join(wpaths.globalRoot, "installed-skills.json"),
     projectSkillsDir: wpaths.inProjectSkills,
     globalSkillsDir: wpaths.globalSkills,
     projectHash: wpaths.projectHash,
@@ -6981,8 +7519,8 @@ async function createPreContextServices(input) {
   const promptsEnabled = config.features.prompts !== false;
   const bundledPromptsDir = promptsEnabled ? (() => {
     try {
-      const req = createRequire(import.meta.url);
-      return path5.join(path5.dirname(req.resolve("@wrongstack/core/package.json")), "data", "prompts");
+      const req = createRequire2(import.meta.url);
+      return path15.join(path15.dirname(req.resolve("@wrongstack/core/package.json")), "data", "prompts");
     } catch {
       return void 0;
     }
@@ -7034,6 +7572,14 @@ async function createPreContextServices(input) {
   const initialContextPolicy = resolveContextWindowPolicy(config.context);
   context.meta["contextWindowMode"] = initialContextPolicy.id;
   context.meta["contextWindowPolicy"] = initialContextPolicy;
+  context.state.setMeta(
+    "plan.path",
+    sessionScopedPath(wpaths.projectSessions, session.id, ".plan.json")
+  );
+  context.state.setMeta(
+    "task.path",
+    sessionScopedPath(wpaths.projectSessions, session.id, ".tasks.json")
+  );
   seedContextMeta(config, context);
   return {
     modelsRegistry,
@@ -7050,6 +7596,7 @@ async function createPreContextServices(input) {
     session,
     sessionStartedAt,
     statusTracker,
+    sessionIdentity,
     tokenCounter,
     modeStore,
     modeId,
@@ -7063,8 +7610,33 @@ async function createPreContextServices(input) {
     needsSetup
   };
 }
+function isSuperMemoryService(memoryStore) {
+  const value = memoryStore;
+  return typeof value["retrieveForPath"] === "function" && typeof value["searchSuper"] === "function" && typeof value["graphFor"] === "function" && typeof value["verify"] === "function" && typeof value["hygiene"] === "function" && typeof value["listCandidates"] === "function";
+}
+
+// src/server/start-webui.ts
+import * as path21 from "node:path";
+import {
+  createDefaultPipelines,
+  createSessionEventBridge,
+  DEFAULT_CONTEXT_WINDOW_MODE_ID as DEFAULT_CONTEXT_WINDOW_MODE_ID2,
+  expectDefined as expectDefined3,
+  resolveSessionLoggingConfig,
+  watchProviderConfig
+} from "@wrongstack/core";
+import { toErrorMessage as toErrorMessage10 } from "@wrongstack/core/utils";
+import { makeProviderFromConfig as makeProviderFromConfig3 } from "@wrongstack/providers";
+import {
+  ensureSessionShell
+} from "@wrongstack/tools";
+
+// src/server/boot.ts
+import {
+  bootConfig as coreBootConfig
+} from "@wrongstack/core";
 async function bootConfig() {
-  const { config, vault, globalConfigPath, projectRoot, wpaths, logger } = await bootConfig$1({
+  const { config, vault, globalConfigPath, projectRoot, wpaths, logger } = await coreBootConfig({
     appLabel: "WebUI"
   });
   return { config, vault, globalConfigPath, projectRoot, wpaths, logger };
@@ -7072,14 +7644,46 @@ async function bootConfig() {
 function patchConfig(config, updates) {
   return Object.freeze({ ...config, ...updates });
 }
+
+// src/server/backend-services.ts
+import { join as join12 } from "node:path";
+import {
+  Agent,
+  AutoCompactionMiddleware as AutoCompactionMiddlewareCtor,
+  BrainMonitor,
+  CollaborationBus as CollaborationBusCtor,
+  DEFAULT_TOOLS_CONFIG,
+  createStrategyCompactor,
+  collabInjectMiddleware,
+  collabPauseMiddleware,
+  estimateRequestTokensCalibrated,
+  installDesignStudioMiddleware,
+  ObservableBrainArbiter as ObservableBrainArbiterCtor,
+  resolveContextWindowPolicy as resolveContextWindowPolicy2,
+  BrainDecisionLedger,
+  createBrainRuntime,
+  resolveBrainConfigDefaults,
+  EscalationRoutingBrainArbiter,
+  GlobalMailbox as GlobalMailbox2,
+  mailboxSessionTag,
+  SessionMemoryConsolidator,
+  TOKENS as TOKENS2,
+  ToolExecutor
+} from "@wrongstack/core";
+
+// src/server/collaboration-ws-handler.ts
+import { randomUUID } from "node:crypto";
+import { toErrorMessage as toErrorMessage6 } from "@wrongstack/core/utils";
+var REPLAY_LIMIT = 50;
 var PAUSE_TIMEOUT_MS = 6e4;
 var CollaborationWebSocketHandler = class {
-  constructor(events, logger, reader, annotations, bus) {
+  constructor(events, logger, reader, annotations, bus, options = {}) {
     this.events = events;
     this.logger = logger;
     this.reader = reader;
     this.annotations = annotations;
     this.bus = bus;
+    this.options = options;
     this.subscribe();
     this.bus?.onInjectionConsumed((info) => this.broadcastInjectionConsumed(info));
   }
@@ -7088,6 +7692,7 @@ var CollaborationWebSocketHandler = class {
   reader;
   annotations;
   bus;
+  options;
   clients = /* @__PURE__ */ new Set();
   /** sessionId → participants currently watching it. */
   bySession = /* @__PURE__ */ new Map();
@@ -7115,11 +7720,16 @@ var CollaborationWebSocketHandler = class {
   handleMessage(ws, msg) {
     if (msg.type === "collab.join") {
       const payload = msg.payload;
-      if (!payload?.sessionId) {
+      if (typeof payload?.sessionId !== "string" || payload.sessionId.trim().length === 0) {
         this.send(ws, this.errorMessage("collab.join requires sessionId"));
         return true;
       }
-      this.join(ws, payload.sessionId, payload.role ?? "observer");
+      const role = payload.role ?? "observer";
+      if (role !== "observer" && role !== "annotator" && role !== "controller") {
+        this.send(ws, this.errorMessage(`unknown collaboration role '${String(role)}'`));
+        return true;
+      }
+      this.join(ws, payload.sessionId, role);
       return true;
     }
     if (msg.type === "collab.leave") {
@@ -7154,6 +7764,20 @@ var CollaborationWebSocketHandler = class {
   }
   // ── Join / leave flow ──────────────────────────────────────────────────
   join(ws, sessionId, role) {
+    const activeSessionId = this.options.getActiveSessionId?.();
+    if (activeSessionId !== void 0 && sessionId !== activeSessionId) {
+      this.send(
+        ws,
+        this.errorMessage(
+          `collab.join sessionId mismatch (active: ${activeSessionId})`
+        )
+      );
+      return;
+    }
+    if (this.findParticipant(ws)) {
+      this.send(ws, this.errorMessage("collab.join requires leaving the current session first"));
+      return;
+    }
     if (role === "controller" && !this.bus) {
       this.send(
         ws,
@@ -7172,6 +7796,13 @@ var CollaborationWebSocketHandler = class {
       );
       return;
     }
+    if (role !== "observer" && this.options.authorizeRole?.({ ws, sessionId, requestedRole: role }) !== true) {
+      this.send(
+        ws,
+        this.errorMessage(`role '${role}' requires explicit server authorization`)
+      );
+      return;
+    }
     const participant = {
       participantId: randomUUID(),
       ws,
@@ -7199,7 +7830,7 @@ var CollaborationWebSocketHandler = class {
     if (this.reader) {
       this.replayHistory(ws, sessionId).catch((err) => {
         this.logger.debug?.(
-          `collab: replay failed for ${sessionId}: ${toErrorMessage(err)}`
+          `collab: replay failed for ${sessionId}: ${toErrorMessage6(err)}`
         );
       });
     }
@@ -7317,7 +7948,7 @@ var CollaborationWebSocketHandler = class {
       this.send(
         ws,
         this.errorMessage(
-          `annotation rejected: ${toErrorMessage(err)}`
+          `annotation rejected: ${toErrorMessage6(err)}`
         )
       );
     }
@@ -7384,7 +8015,7 @@ var CollaborationWebSocketHandler = class {
       this.send(
         ws,
         this.errorMessage(
-          `resolve failed: ${toErrorMessage(err)}`
+          `resolve failed: ${toErrorMessage6(err)}`
         )
       );
     }
@@ -7425,17 +8056,13 @@ var CollaborationWebSocketHandler = class {
       type: "collab.event",
       payload: { kind, payload, at: (/* @__PURE__ */ new Date()).toISOString() }
     };
-    const data = JSON.stringify(msg);
-    for (const bucket of this.bySession.values()) {
-      for (const p of bucket) {
-        try {
-          if (p.ws.readyState === 1) p.ws.send(data);
-        } catch (err) {
-          this.logger.debug?.(
-            `collab broadcast failed: ${toErrorMessage(err)}`
-          );
-        }
-      }
+    const activeSessionId = this.options.getActiveSessionId?.();
+    if (activeSessionId !== void 0) {
+      this.broadcast(activeSessionId, msg);
+      return;
+    }
+    for (const sessionId of this.bySession.keys()) {
+      this.broadcast(sessionId, msg);
     }
   }
   /**
@@ -7459,11 +8086,11 @@ var CollaborationWebSocketHandler = class {
       }
     } catch (err) {
       this.logger.debug?.(
-        `collab: session reader rejected ${sessionId}: ${toErrorMessage(err)}`
+        `collab: session reader rejected ${sessionId}: ${toErrorMessage6(err)}`
       );
       return;
     }
-    const tail2 = all.slice(-50);
+    const tail2 = all.slice(-REPLAY_LIMIT);
     if (tail2.length === 0) return;
     for (const raw of tail2) {
       const ev = raw;
@@ -7540,7 +8167,7 @@ var CollaborationWebSocketHandler = class {
         if (p.ws.readyState === 1) p.ws.send(data);
       } catch (err) {
         this.logger.debug?.(
-          `collab broadcast failed: ${toErrorMessage(err)}`
+          `collab broadcast failed: ${toErrorMessage6(err)}`
         );
       }
     }
@@ -7759,7 +8386,8 @@ var CollaborationWebSocketHandler = class {
    * Bus callback: a queued injection was spliced into a real tool call. Re-emit
    * `collab.injection.granted` with phase `'consumed'` and the now-known tool
    * name. The injection carries no sessionId, so resolve it from the author's
-   * current session; if they've already left, fall back to every live session.
+   * current participant. If the author has left, fail closed rather than leak
+   * the payload to unrelated sessions.
    */
   broadcastInjectionConsumed(info) {
     let sessionId = null;
@@ -7788,10 +8416,23 @@ var CollaborationWebSocketHandler = class {
     if (sessionId) {
       this.broadcast(sessionId, message(sessionId));
     } else {
-      for (const sid of this.bySession.keys()) this.broadcast(sid, message(sid));
+      this.logger.debug?.(
+        `collab: consumed injection ${info.toolUseId} has no live author; broadcast suppressed`
+      );
     }
   }
 };
+
+// src/server/codebase-indexing.ts
+import * as fs12 from "node:fs";
+import * as path16 from "node:path";
+import {
+  cancelPendingReindexes,
+  enqueueReindex,
+  isIndexableFile,
+  runStartupIndex,
+  shutdownCodebaseIndexHost
+} from "@wrongstack/tools";
 var IGNORE_DIRS = /* @__PURE__ */ new Set([
   "node_modules",
   ".git",
@@ -7837,7 +8478,7 @@ function setupWebUICodebaseIndexing(deps2) {
         if (!filename) return;
         const rel = filename.toString();
         if (isIgnored(rel)) return;
-        const abs = path5.resolve(deps2.projectRoot, rel);
+        const abs = path16.resolve(deps2.projectRoot, rel);
         enqueueFile(abs);
       });
       watcher.on("error", (err) => deps2.logger.debug(`webui codebase index watcher error: ${err}`));
@@ -7850,7 +8491,7 @@ function setupWebUICodebaseIndexing(deps2) {
   }
   function enqueueFile(filePath) {
     if (!idx.onEdit && !idx.watchExternal) return;
-    const abs = path5.isAbsolute(filePath) ? path5.normalize(filePath) : path5.resolve(deps2.projectRoot, filePath);
+    const abs = path16.isAbsolute(filePath) ? path16.normalize(filePath) : path16.resolve(deps2.projectRoot, filePath);
     if (!isInside2(deps2.projectRoot, abs) || !isIndexableFile(abs)) return;
     enqueueReindex({
       projectRoot: deps2.projectRoot,
@@ -7887,15 +8528,23 @@ function isIgnored(rel) {
   return rel.split(/[/\\]/).some((seg) => IGNORE_DIRS.has(seg));
 }
 function isInside2(root, target) {
-  const normalizedRoot = path5.resolve(root);
-  const normalizedTarget = path5.resolve(target);
-  return normalizedTarget === normalizedRoot || normalizedTarget.startsWith(normalizedRoot + path5.sep);
+  const normalizedRoot = path16.resolve(root);
+  const normalizedTarget = path16.resolve(target);
+  return normalizedTarget === normalizedRoot || normalizedTarget.startsWith(normalizedRoot + path16.sep);
 }
+
+// src/server/discover-mailbox-bridge.ts
+import { spawn as spawn3 } from "node:child_process";
+import { createRequire as createRequire3 } from "node:module";
+import { existsSync } from "node:fs";
+import { dirname as dirname7, join as join11 } from "node:path";
+import { resolveProjectDir, wstackGlobalRoot as wstackGlobalRoot2 } from "@wrongstack/core";
+import { readLiveLock } from "@wrongstack/core/coordination";
 var MAILBOX_BRIDGE_BOOT_TIMEOUT_MS = 5e3;
 async function discoverMailboxBridgeForWebui(params) {
   const mode = params.config?.features?.mailboxBridge ?? "auto";
   if (mode === "off") return;
-  const projectDir = resolveProjectDir(params.projectRoot, wstackGlobalRoot());
+  const projectDir = resolveProjectDir(params.projectRoot, wstackGlobalRoot2());
   let result = await readLiveLock(projectDir);
   let spawnedPid = null;
   if (result.kind !== "live") {
@@ -7961,7 +8610,7 @@ async function waitForLiveMailboxBridge(projectDir, timeoutMs) {
 function spawnMailboxBridge(projectRoot, logger) {
   const invocation = mailboxServeInvocation(projectRoot);
   try {
-    const child = spawn(invocation.command, invocation.args, {
+    const child = spawn3(invocation.command, invocation.args, {
       cwd: projectRoot,
       detached: process.platform !== "win32" && !invocation.useShell,
       env: process.env,
@@ -7992,7 +8641,7 @@ function mailboxServeInvocation(projectRoot) {
     return { command: process.execPath, args: [explicitCliEntry, "mailbox", "serve"] };
   }
   try {
-    const require2 = createRequire(import.meta.url);
+    const require2 = createRequire3(import.meta.url);
     const cliEntry = require2.resolve("@wrongstack/cli");
     return { command: process.execPath, args: [cliEntry, "mailbox", "serve"] };
   } catch {
@@ -8016,9 +8665,9 @@ function mailboxServeInvocation(projectRoot) {
 function findWorkspaceCliEntry(projectRoot) {
   let dir = projectRoot;
   for (let i = 0; i < 6; i++) {
-    const candidate = join(dir, "packages", "cli", "dist", "index.js");
+    const candidate = join11(dir, "packages", "cli", "dist", "index.js");
     if (existsSync(candidate)) return candidate;
-    const parent = dirname(dir);
+    const parent = dirname7(dir);
     if (parent === dir) return null;
     dir = parent;
   }
@@ -8027,10 +8676,15 @@ function findWorkspaceCliEntry(projectRoot) {
 function sleep(ms) {
   return new Promise((resolve10) => setTimeout(resolve10, ms));
 }
+
+// src/server/terminal-ws-handler.ts
+import { spawn as spawnChild } from "node:child_process";
+import { createRequire as createRequire4 } from "node:module";
+import { toErrorMessage as toErrorMessage7 } from "@wrongstack/core/utils";
 var MAX_SESSIONS_PER_CLIENT = 8;
 var DEFAULT_COLS = 80;
 var DEFAULT_ROWS = 24;
-var requireFromHere = createRequire(import.meta.url);
+var requireFromHere = createRequire4(import.meta.url);
 var cachedNodePty;
 var TerminalWebSocketHandler = class {
   constructor(getCwd, logger, loadNodePty = defaultLoadNodePty, killProcessTree = defaultKillProcessTree) {
@@ -8108,8 +8762,8 @@ var TerminalWebSocketHandler = class {
         ...windowsPtyOptions()
       });
     } catch (err) {
-      const msg = `Integrated terminal failed to start: ${toErrorMessage(err)}`;
-      this.logger.warn?.(`terminal spawn failed: ${toErrorMessage(err)}`);
+      const msg = `Integrated terminal failed to start: ${toErrorMessage7(err)}`;
+      this.logger.warn?.(`terminal spawn failed: ${toErrorMessage7(err)}`);
       this.send(ws, { type: "terminal.output", payload: { id: payload.id, data: `${msg}\r
 ` } });
       this.send(ws, { type: "terminal.exit", payload: { id: payload.id, exitCode: -1 } });
@@ -8162,7 +8816,7 @@ var TerminalWebSocketHandler = class {
     try {
       pty.kill();
     } catch (err) {
-      this.logger.warn?.(`${reason} failed: ${toErrorMessage(err)}`);
+      this.logger.warn?.(`${reason} failed: ${toErrorMessage7(err)}`);
     }
   }
   killWindowsProcessTree(pty, reason) {
@@ -8174,7 +8828,7 @@ var TerminalWebSocketHandler = class {
       } catch {
       }
     } catch (err) {
-      this.logger.warn?.(`${reason} taskkill failed: ${toErrorMessage(err)}`);
+      this.logger.warn?.(`${reason} taskkill failed: ${toErrorMessage7(err)}`);
     }
   }
   send(ws, msg) {
@@ -8205,7 +8859,7 @@ function windowsPtyOptions() {
   return { useConptyDll: true };
 }
 function defaultKillProcessTree(pid) {
-  const child = spawn("taskkill", ["/PID", String(pid), "/T", "/F"], {
+  const child = spawnChild("taskkill", ["/PID", String(pid), "/T", "/F"], {
     stdio: "ignore",
     windowsHide: true
   });
@@ -8218,6 +8872,14 @@ function clampDim(value, fallback) {
   if (typeof value !== "number" || !Number.isFinite(value)) return fallback;
   return Math.max(1, Math.min(1e3, Math.floor(value)));
 }
+
+// src/server/backend-services.ts
+import { makeLightSubagentFactory } from "@wrongstack/runtime";
+import {
+  createSuperMemoryToolCallMiddleware,
+  createSuperMemoryTurnMiddleware
+} from "@wrongstack/super-memory";
+import { toErrorMessage as toErrorMessage8 } from "@wrongstack/core/utils";
 async function createAgentServices(input) {
   const {
     config,
@@ -8232,15 +8894,37 @@ async function createAgentServices(input) {
     providerRegistry,
     modelsRegistry,
     events,
+    memoryStore,
     modelCapabilitiesRef
   } = input;
-  const collabBus = new CollaborationBus();
+  const collabBus = new CollaborationBusCtor();
   const pipelines = input.pipelines;
   const collabInject = collabInjectMiddleware(collabBus, { logger });
   pipelines.toolCall.prepend(collabInject);
   const collabPause = collabPauseMiddleware(collabBus, { logger });
   pipelines.toolCall.prepend(collabPause);
   installDesignStudioMiddleware({ pipelines, ctx: context });
+  if (config.features.memory !== false && config.superMemory?.enabled !== false && isSuperMemoryRetriever(memoryStore)) {
+    if (config.superMemory?.inject?.toolResults !== false) {
+      pipelines.toolCall.use(createSuperMemoryToolCallMiddleware({
+        memory: memoryStore,
+        maxHintsPerTool: config.superMemory?.inject?.maxHintsPerTool,
+        maxCharsPerTool: config.superMemory?.inject?.maxCharsPerTool,
+        minScore: config.superMemory?.inject?.minScore,
+        repeatCooldownMs: config.superMemory?.inject?.repeatCooldownMs,
+        verifyOnMutation: config.superMemory?.hygiene?.autoOnFileChange,
+        triggers: config.superMemory?.inject?.triggers
+      }));
+    }
+    if (config.superMemory?.inject?.turnContext !== false) {
+      pipelines.request.use(createSuperMemoryTurnMiddleware({
+        memory: memoryStore,
+        maxMemories: config.superMemory?.inject?.maxTurnMemories,
+        maxChars: config.superMemory?.inject?.maxCharsPerTurn,
+        minScore: config.superMemory?.inject?.minScore
+      }));
+    }
+  }
   const codebaseIndexing = setupWebUICodebaseIndexing({
     config,
     context,
@@ -8254,7 +8938,7 @@ async function createAgentServices(input) {
     summarizerModel: config.context?.summarizerModel,
     llmSelector: config.context?.llmSelector
   });
-  const initialContextPolicy = resolveContextWindowPolicy(config.context);
+  const initialContextPolicy = resolveContextWindowPolicy2(config.context);
   let autoCompactor;
   if (config.context?.autoCompact !== false) {
     let effectiveMaxContext = config.context?.effectiveMaxContext ?? 0;
@@ -8271,7 +8955,7 @@ async function createAgentServices(input) {
       }
     }
     if (!effectiveMaxContext) effectiveMaxContext = provider.capabilities.maxContext;
-    autoCompactor = new AutoCompactionMiddleware(
+    autoCompactor = new AutoCompactionMiddlewareCtor(
       compactor,
       effectiveMaxContext,
       (ctx) => estimateRequestTokensCalibrated(
@@ -8299,7 +8983,7 @@ async function createAgentServices(input) {
   const updateAutoCompactionMaxContext = async (newProvider, providerId = newProvider.id, providerCfg) => {
     await modelsRegistry.refresh().catch((err) => {
       logger.warn(
-        `models.dev refresh failed for ${providerId}/${context.model}: ${toErrorMessage(err)}; using cached catalog`
+        `models.dev refresh failed for ${providerId}/${context.model}: ${toErrorMessage8(err)}; using cached catalog`
       );
     });
     const currentConfig = input.config;
@@ -8336,9 +9020,9 @@ async function createAgentServices(input) {
       maxContext: newMaxContext
     });
   };
-  const secretScrubber = container.resolve(TOKENS.SecretScrubber);
-  const renderer = container.has(TOKENS.Renderer) ? container.resolve(TOKENS.Renderer) : void 0;
-  const permissionPolicy = container.resolve(TOKENS.PermissionPolicy);
+  const secretScrubber = container.resolve(TOKENS2.SecretScrubber);
+  const renderer = container.has(TOKENS2.Renderer) ? container.resolve(TOKENS2.Renderer) : void 0;
+  const permissionPolicy = container.resolve(TOKENS2.PermissionPolicy);
   const toolExecutor = new ToolExecutor(toolRegistry, {
     permissionPolicy,
     secretScrubber,
@@ -8349,7 +9033,7 @@ async function createAgentServices(input) {
     perIterationOutputCapBytes: config.tools?.perIterationOutputCapBytes ?? DEFAULT_TOOLS_CONFIG.perIterationOutputCapBytes,
     tracer: void 0
   });
-  const webuiLogger = container.resolve(TOKENS.Logger);
+  const webuiLogger = container.resolve(TOKENS2.Logger);
   void discoverMailboxBridgeForWebui({
     projectRoot,
     config,
@@ -8375,25 +9059,66 @@ async function createAgentServices(input) {
     confirmAwaiter: void 0,
     toolExecutor
   });
+  if (config.features.memory && config.features.memoryConsolidation !== false) {
+    agent.extensions.register(new SessionMemoryConsolidator({ memoryStore }));
+  }
   console.log("[WebUI] Agent initialized");
-  const brainSettings = { maxAutoRisk: "medium" };
-  const autonomousBrain = {
-    decide: (request) => createAutonomyBrain({
-      provider,
-      model: context.model,
-      maxAutoRisk: "all"
-      // the tiered ceiling gates risk — keep inner permissive
-    }).decide(request)
+  const brainCfg = resolveBrainConfigDefaults(config.brain, {
+    fallbackModels: config.fallbackModels
+  });
+  const brainLedgerPath = join12(wpaths.projectDir, "brain-ledger.jsonl");
+  let brainLedgerEnabled = brainCfg.ledger?.enabled !== false;
+  let brainLedger;
+  const startBrainLedger = () => {
+    if (brainLedger) return;
+    brainLedger = new BrainDecisionLedger({ events, filePath: brainLedgerPath });
+    void brainLedger.start();
   };
-  const brain = new ObservableBrainArbiter(
-    createTieredBrainArbiter({
-      policy: new DefaultBrainArbiter(),
-      autonomous: autonomousBrain,
-      getMaxAutoRisk: () => brainSettings.maxAutoRisk
-    }),
+  if (brainLedgerEnabled) startBrainLedger();
+  const brainRuntime = createBrainRuntime({
+    initialConfig: brainCfg,
+    defaultProviderId: config.provider,
+    sessionProvider: () => provider,
+    sessionModel: () => context.model,
+    resolveProvider: (providerId) => {
+      const savedCfg = config.providers?.[providerId] ?? {};
+      return providerRegistry.create({
+        ...savedCfg,
+        apiKey: savedCfg.apiKey ?? config.apiKey,
+        baseUrl: savedCfg.baseUrl ?? config.baseUrl,
+        type: providerId
+      });
+    },
+    ledger: {
+      getPath: () => brainLedgerEnabled ? brainLedgerPath : void 0,
+      isEnabled: () => brainLedgerEnabled,
+      setEnabled: (on) => {
+        brainLedgerEnabled = on;
+        if (on) {
+          startBrainLedger();
+        } else {
+          void brainLedger?.stop();
+          brainLedger = void 0;
+        }
+      },
+      failureStreakFor: (request) => brainLedger?.failureStreakFor(request) ?? 0,
+      getDecisionDigest: (request) => brainLedger?.digestFor(request)
+    },
+    persist: input.persistBrainConfig
+  });
+  const brainSettings = {
+    get maxAutoRisk() {
+      return brainRuntime.getMaxAutoRisk();
+    },
+    set maxAutoRisk(level) {
+      void brainRuntime.apply({ maxAutoRisk: level }).persisted;
+    }
+  };
+  const brain = new ObservableBrainArbiterCtor(
+    new EscalationRoutingBrainArbiter(brainRuntime.arbiter, void 0, () => "headless"),
     events
   );
-  container.bind(TOKENS.BrainArbiter, () => brain);
+  container.bind(TOKENS2.BrainArbiter, () => brain);
   const brainLog = [];
   const pushBrainLog = (entry) => {
     brainLog.push(entry);
@@ -8426,10 +9151,16 @@ async function createAgentServices(input) {
       outcome: e.decision.type === "deny" ? e.decision.reason : ""
     })
   );
-  const brainMailbox = new GlobalMailbox(wpaths.projectDir, events);
+  const brainMailbox = new GlobalMailbox2(wpaths.projectDir, events);
   const brainMonitor = new BrainMonitor({
     events,
     brain,
+    toolFailureStreak: brainCfg.monitor?.toolFailureStreak,
+    errorStormCount: brainCfg.monitor?.errorStormCount,
+    stallMs: brainCfg.monitor?.stallMs,
+    fileChurnThreshold: brainCfg.monitor?.fileChurnThreshold,
+    fileChurnWindowMs: brainCfg.monitor?.fileChurnWindowMs,
+    cooldownMs: brainCfg.monitor?.cooldownMs,
     sessionId: () => context.session?.id,
     intervene: async ({ subject, body }) => {
       const tag = mailboxSessionTag(input.sessionGetter().id);
@@ -8494,7 +9225,10 @@ async function createAgentServices(input) {
     logger,
     input.sessionReader,
     input.annotationsStore,
-    collabBus
+    collabBus,
+    {
+      getActiveSessionId: () => context.session.id
+    }
   );
   return {
     collabBus,
@@ -8506,8 +9240,13 @@ async function createAgentServices(input) {
     pipelines,
     brain,
     brainSettings,
+    brainRuntime,
     brainLog,
     brainMonitor,
+    // Getter: ledger toggles swap the instance, shutdown must stop the LIVE one.
+    get brainLedger() {
+      return brainLedger;
+    },
     codebaseIndexing,
     autoPhaseHandler,
     specsHandler,
@@ -8519,14 +9258,14 @@ async function createAgentServices(input) {
     updateAutoCompactionMaxContext
   };
 }
+function isSuperMemoryRetriever(memoryStore) {
+  const value = memoryStore;
+  return typeof value["retrieveForPath"] === "function" && typeof value["searchSuper"] === "function";
+}
 
 // src/server/pending-confirms.ts
-function isDestructivePendingConfirm(confirm) {
-  return confirm.riskTier === "destructive" || confirm.decisionSource === "yolo_destructive";
-}
 function resolveYoloEligiblePendingConfirms(pendingConfirms) {
   for (const [id, confirm] of pendingConfirms) {
-    if (isDestructivePendingConfirm(confirm)) continue;
     pendingConfirms.delete(id);
     confirm.resolve("yes");
   }
@@ -8682,6 +9421,20 @@ function createConnectionHandler(opts) {
   };
 }
 
+// src/server/message-dispatcher.ts
+import path17 from "node:path";
+import {
+  buildUserContentBlocks,
+  IncomingImageError,
+  parseIncomingImages
+} from "@wrongstack/core/utils";
+import {
+  createToolVisionAdapters,
+  ImageInputUnsupportedError,
+  routeImagesForModel,
+  VisionUrlBlockedError
+} from "@wrongstack/runtime/vision";
+
 // src/server/autophase-routes.ts
 async function handleAutoPhaseRoute(_ws, msg, handlers) {
   if (!msg.type.startsWith("autophase.")) return false;
@@ -8701,14 +9454,23 @@ async function handleBrainRoute(ws, msg, handlers) {
     case "brain.ask":
       await handlers.ask(ws, msg);
       return true;
+    case "brain.config.get":
+      await handlers.configGet(ws, msg);
+      return true;
+    case "brain.config.set":
+      await handlers.configSet(ws, msg);
+      return true;
     default:
       return false;
   }
 }
+
+// src/server/goal-handlers.ts
+import { resolveWstackPaths } from "@wrongstack/core/utils";
 async function handleGoalGet(projectRoot, broadcast2) {
   try {
-    const goalPath = resolveWstackPaths$1({ projectRoot }).projectGoal;
-    const { readFile: readFile10 } = await import('fs/promises');
+    const goalPath = resolveWstackPaths({ projectRoot }).projectGoal;
+    const { readFile: readFile10 } = await import("node:fs/promises");
     const raw = await readFile10(goalPath, "utf8");
     const goal = JSON.parse(raw);
     broadcast2({ type: "goal.updated", payload: goal });
@@ -8762,7 +9524,7 @@ async function handleTasksGet(ctx, ws) {
   const taskPath = ctx.context.meta["task.path"];
   if (typeof taskPath === "string" && taskPath) {
     try {
-      const { loadTasks } = await import('@wrongstack/core');
+      const { loadTasks } = await import("@wrongstack/core");
       const file = await loadTasks(taskPath);
       ctx.send(ws, { type: "tasks.updated", payload: sessionPayload(ctx, { tasks: file?.tasks ?? [] }) });
     } catch {
@@ -8782,7 +9544,7 @@ async function handleTaskUpdate(ctx, ws, payload) {
     return;
   }
   try {
-    const { loadTasks, saveTasks } = await import('@wrongstack/core');
+    const { loadTasks, saveTasks } = await import("@wrongstack/core");
     const file = await loadTasks(taskPath);
     if (!file) {
       sendResult2(ws, ctx, false, "No task file found.");
@@ -8811,7 +9573,7 @@ async function handlePlanGet(ctx, ws) {
   const sessionId = ctx.context.session?.id ?? "";
   if (typeof planPath === "string" && planPath) {
     try {
-      const { loadPlan } = await import('@wrongstack/core');
+      const { loadPlan } = await import("@wrongstack/core");
       const plan = await loadPlan(planPath);
       ctx.send(ws, {
         type: "plan.updated",
@@ -8852,7 +9614,7 @@ async function handlePlanTemplateUse(ctx, ws, template) {
     return;
   }
   try {
-    const { getPlanTemplate, loadPlan, savePlan, emptyPlan, addPlanItem } = await import('@wrongstack/core');
+    const { getPlanTemplate, loadPlan, savePlan, emptyPlan, addPlanItem } = await import("@wrongstack/core");
     const tpl = getPlanTemplate(template);
     if (!tpl) {
       sendResult2(ws, ctx, false, `Unknown template "${template}".`);
@@ -8877,7 +9639,7 @@ async function handlePlanItemUpdate(ctx, ws, payload) {
     return;
   }
   try {
-    const { mutatePlan, setPlanItemStatus } = await import('@wrongstack/core');
+    const { mutatePlan, setPlanItemStatus } = await import("@wrongstack/core");
     let changed = false;
     const plan = await mutatePlan(planPath, sessionId, async (p) => {
       const before = p.updatedAt;
@@ -8944,6 +9706,45 @@ async function handleWorklistMessage(ctx, ws, msg) {
       return;
   }
 }
+
+// src/server/kanban-routes.ts
+import {
+  deserializeTaskGraph,
+  serializeTaskGraph
+} from "@wrongstack/core";
+import {
+  addColumn,
+  addGoalMetricToTask,
+  addTask,
+  assignTask,
+  claimReadyTask,
+  copyTaskToBoard,
+  createBoard,
+  duplicateBoard,
+  exportBoardToTaskGraph,
+  generateBoardFromDescription,
+  getBoard,
+  getKanbanOrchestrationSnapshot,
+  getKanbanQueueHealth,
+  getTask,
+  getTaskChain,
+  listReadyTasks,
+  listBoards,
+  mergeTasks,
+  moveTask,
+  parseLinesIntoTasks,
+  removeBoard,
+  removeColumn,
+  removeTask,
+  releaseTaskClaim,
+  setTaskChain,
+  splitTask,
+  syncBoardFromTaskGraph,
+  transferTaskToBoard,
+  updateBoard,
+  updateGoalMetricOnTask,
+  updateTask
+} from "@wrongstack/kanban";
 function ok(ws, type, data) {
   send(ws, { type, payload: { success: true, data: data ?? null } });
 }
@@ -9389,6 +10190,9 @@ async function handleKanbanRoute(ws, msg, ctx) {
           "Kanban agent dispatch is only available from the CLI-hosted WebUI runtime."
         );
         return true;
+      case "kanban.capabilities":
+        ok(ws, type, { dispatchSupported: false });
+        return true;
       case "kanban.task.remove": {
         const boardId = payload?.boardId;
         const taskId = payload?.taskId;
@@ -9468,6 +10272,9 @@ async function handleMailboxRoute(ws, msg, handlers) {
     case "mailbox.purge":
       await handlers.purge(ws, msg);
       return true;
+    case "mailbox.compact":
+      await handlers.compact(ws, msg);
+      return true;
     default:
       return false;
   }
@@ -9506,6 +10313,18 @@ async function handleMcpRoute(ws, msg, handlers) {
     case "mcp.discover":
       await handlers.discover(ws, msg);
       return true;
+    case "mcp.resources":
+      await handlers.resources(ws, msg);
+      return true;
+    case "mcp.prompts":
+      await handlers.prompts(ws, msg);
+      return true;
+    case "mcp.resource.read":
+      await handlers.resourceRead(ws, msg);
+      return true;
+    case "mcp.prompt.get":
+      await handlers.promptGet(ws, msg);
+      return true;
     default:
       return false;
   }
@@ -9544,7 +10363,7 @@ async function handlePrefsRoute(ws, msg, handlers) {
 // src/server/process-handlers.ts
 async function handleProcessList(ws) {
   try {
-    const { getProcessRegistry } = await import('@wrongstack/tools');
+    const { getProcessRegistry } = await import("@wrongstack/tools");
     const procs = getProcessRegistry().list();
     send(ws, {
       type: "process.list",
@@ -9571,7 +10390,7 @@ async function handleProcessKill(ws, payload) {
   }
   const { pid } = parsed.value;
   try {
-    const { getProcessRegistry } = await import('@wrongstack/tools');
+    const { getProcessRegistry } = await import("@wrongstack/tools");
     const proc = getProcessRegistry().get(pid);
     if (proc?.protected) {
       sendResult(ws, false, `Cannot kill protected process (PID ${pid})`);
@@ -9585,7 +10404,7 @@ async function handleProcessKill(ws, payload) {
 }
 async function handleProcessKillAll(ws) {
   try {
-    const { getProcessRegistry } = await import('@wrongstack/tools');
+    const { getProcessRegistry } = await import("@wrongstack/tools");
     getProcessRegistry().killAll();
     sendResult(ws, true, "All processes killed");
   } catch (err) {
@@ -9895,7 +10714,7 @@ function createMessageDispatcher(opts) {
       skillLoader: deps2.skillLoader,
       skillInstaller: deps2.skillInstaller,
       projectRoot,
-      projectSkillsDir: path5__default.join(projectRoot, ".wrongstack", "skills"),
+      projectSkillsDir: path17.join(projectRoot, ".wrongstack", "skills"),
       globalSkillsDir: deps2.wpaths.globalSkills
     };
   }
@@ -9968,7 +10787,8 @@ function createMessageDispatcher(opts) {
       }
       case "user_message": {
         if (!ensureCurrentSession(ws, msg, "user_message")) return;
-        const content = msg.payload.content;
+        const userPayload = msg.payload;
+        const content = userPayload.content;
         if (runLock.get()) {
           send(ws, {
             type: "error",
@@ -9982,8 +10802,24 @@ function createMessageDispatcher(opts) {
         const thisRun = new AbortController();
         runLock.set(thisRun);
         try {
+          let input = content;
+          const imageBlocks = parseIncomingImages(userPayload.images, userPayload.imageBase64);
+          if (imageBlocks.length > 0) {
+            const routed = await routeImagesForModel(
+              buildUserContentBlocks(content, imageBlocks),
+              {
+                supportsVision: deps2.agent.ctx.provider.capabilities.vision,
+                adapters: () => createToolVisionAdapters(deps2.agent.tools),
+                ctx: deps2.agent.ctx,
+                signal: thisRun.signal,
+                providerId: deps2.agent.ctx.provider.id,
+                model: deps2.agent.ctx.model
+              }
+            );
+            input = routed.blocks;
+          }
           const maxIt = typeof deps2.context.meta["maxIterations"] === "number" ? deps2.context.meta["maxIterations"] : void 0;
-          const result = await deps2.agent.run(content, {
+          const result = await deps2.agent.run(input, {
             signal: thisRun.signal,
             maxIterations: maxIt
           });
@@ -10001,13 +10837,24 @@ function createMessageDispatcher(opts) {
             })
           });
         } catch (err) {
-          send(ws, {
-            type: "error",
-            payload: sessionPayload2({
-              phase: "agent.run",
-              message: errMessage(err)
-            })
-          });
+          if (err instanceof IncomingImageError || err instanceof ImageInputUnsupportedError || err instanceof VisionUrlBlockedError) {
+            send(ws, {
+              type: "error",
+              payload: sessionPayload2({
+                phase: "user_message",
+                ...err instanceof ImageInputUnsupportedError ? { code: "vision_unsupported" } : {},
+                message: err.message
+              })
+            });
+          } else {
+            send(ws, {
+              type: "error",
+              payload: sessionPayload2({
+                phase: "agent.run",
+                message: errMessage(err)
+              })
+            });
+          }
         } finally {
           if (runLock.get() === thisRun) {
             runLock.set(null);
@@ -10055,7 +10902,7 @@ function createMessageDispatcher(opts) {
         break;
       }
       case "tool.disable": {
-        const name2 = (msg.payload ?? {}).name;
+        const name2 = msg.payload?.name;
         if (!name2) {
           send(ws, { type: "error", payload: { message: "tool.disable requires a name" } });
           break;
@@ -10070,7 +10917,7 @@ function createMessageDispatcher(opts) {
         break;
       }
       case "tool.enable": {
-        const name2 = (msg.payload ?? {}).name;
+        const name2 = msg.payload?.name;
         if (!name2) {
           send(ws, { type: "error", payload: { message: "tool.enable requires a name" } });
           break;
@@ -10114,6 +10961,14 @@ function createMessageDispatcher(opts) {
         throw new Error("handleMcpRoute did not claim mcp.restart \u2014 check chain order");
       case "mcp.discover":
         throw new Error("handleMcpRoute did not claim mcp.discover \u2014 check chain order");
+      case "mcp.resources":
+        throw new Error("handleMcpRoute did not claim mcp.resources \u2014 check chain order");
+      case "mcp.prompts":
+        throw new Error("handleMcpRoute did not claim mcp.prompts \u2014 check chain order");
+      case "mcp.resource.read":
+        throw new Error("handleMcpRoute did not claim mcp.resource.read \u2014 check chain order");
+      case "mcp.prompt.get":
+        throw new Error("handleMcpRoute did not claim mcp.prompt.get \u2014 check chain order");
       // Skills — full request→response cycle lives in skills-handlers.ts.
       case "skills.list":
         await handleSkillsList(ws, makeSkillsContext());
@@ -10350,6 +11205,7 @@ function createMessageDispatcher(opts) {
         break;
       }
       case "prefs.update": {
+        void ws;
         throw new Error("handlePrefsRoute did not claim prefs.update \u2014 check chain order");
       }
       case "prefs.get": {
@@ -10363,6 +11219,11 @@ function createMessageDispatcher(opts) {
     }
   };
 }
+
+// src/server/pref-helpers.ts
+import { atomicWrite as atomicWrite6 } from "@wrongstack/core/utils";
+import { decryptConfigSecrets as decryptConfigSecrets2, encryptConfigSecrets as encryptConfigSecrets2 } from "@wrongstack/core/security";
+import * as fs13 from "node:fs/promises";
 var PREF_KEYS = [
   "autonomy",
   "autonomyDelayMs",
@@ -10408,7 +11269,19 @@ var PREF_KEYS = [
   "favoriteModels",
   "favoriteModelsOnly",
   "modelMatrix",
-  "fallbackAuto"
+  "fallbackAuto",
+  // Refiner + TUI visual prefs (parity with the CLI's embedded server —
+  // these were browser-editable there but rejected as unknown keys here).
+  "refinerProvider",
+  "refinerModel",
+  "thinkingWord",
+  "statuslineMode",
+  "animationStyle",
+  // Safety / system prefs (parity with /settings breaker, fs-access, debug-stream).
+  "breakerEnabled",
+  "breakerAutoKillResetMs",
+  "fsAccess",
+  "debugStream"
 ];
 function prefSnapshot(contextMeta) {
   const snapshot = {};
@@ -10422,7 +11295,7 @@ async function updateGlobalConfig(deps2, holder, mutate, errorLabel) {
   const write = async () => {
     let raw;
     try {
-      raw = await fs4.readFile(globalConfigPath, "utf8");
+      raw = await fs13.readFile(globalConfigPath, "utf8");
     } catch {
       raw = "{}";
     }
@@ -10433,10 +11306,10 @@ async function updateGlobalConfig(deps2, holder, mutate, errorLabel) {
       logger.warn(`${errorLabel}: refusing to overwrite corrupt config at ${globalConfigPath}`);
       return;
     }
-    const decrypted = decryptConfigSecrets(parsed, vault);
+    const decrypted = decryptConfigSecrets2(parsed, vault);
     mutate(decrypted);
-    const encrypted = encryptConfigSecrets(decrypted, vault);
-    await atomicWrite$1(globalConfigPath, JSON.stringify(encrypted, null, 2), { mode: 384 });
+    const encrypted = encryptConfigSecrets2(decrypted, vault);
+    await atomicWrite6(globalConfigPath, JSON.stringify(encrypted, null, 2), { mode: 384 });
   };
   const next = holder.lock.then(write);
   holder.lock = next.then(
@@ -10479,6 +11352,16 @@ async function persistPrefsToConfig(deps2, holder, payload) {
       setAutonomy("enhanceDelayMs", payload["enhanceDelayMs"]);
     if (typeof payload["enhanceLanguage"] === "string")
       setAutonomy("enhanceLanguage", payload["enhanceLanguage"]);
+    if (typeof payload["refinerProvider"] === "string")
+      setAutonomy("refinerProvider", payload["refinerProvider"]);
+    if (typeof payload["refinerModel"] === "string")
+      setAutonomy("refinerModel", payload["refinerModel"]);
+    if (typeof payload["thinkingWord"] === "string")
+      setAutonomy("thinkingWord", payload["thinkingWord"]);
+    if (typeof payload["statuslineMode"] === "string")
+      setAutonomy("statuslineMode", payload["statuslineMode"]);
+    if (typeof payload["animationStyle"] === "string")
+      setAutonomy("animationStyle", payload["animationStyle"]);
     if (autonomyTouched) decrypted.autonomy = autonomyCfg;
     if (typeof payload["nextPrediction"] === "boolean")
       decrypted.nextPrediction = payload["nextPrediction"];
@@ -10596,15 +11479,38 @@ async function persistPrefsToConfig(deps2, holder, payload) {
       }
       decrypted.modelRuntime = mr;
     }
+    if (typeof payload["breakerEnabled"] === "boolean" || typeof payload["breakerAutoKillResetMs"] === "number") {
+      const cb = decrypted.circuitBreaker ?? {};
+      if (typeof payload["breakerEnabled"] === "boolean") cb.enabled = payload["breakerEnabled"];
+      if (typeof payload["breakerAutoKillResetMs"] === "number")
+        cb.autoKillResetMs = payload["breakerAutoKillResetMs"];
+      decrypted.circuitBreaker = cb;
+    }
+    if (payload["fsAccess"] === "unrestricted" || payload["fsAccess"] === "project") {
+      const restrict = payload["fsAccess"] === "project";
+      const toolsCfg = decrypted.tools ?? {};
+      toolsCfg.restrictToProjectRoot = restrict;
+      decrypted.tools = toolsCfg;
+      const featsCfg = decrypted.features ?? {};
+      featsCfg.allowOutsideProjectRoot = !restrict;
+      decrypted.features = featsCfg;
+    }
+    if (typeof payload["debugStream"] === "boolean")
+      decrypted.debugStream = payload["debugStream"];
   }, "prefs");
 }
+
+// src/server/projects-manifest.ts
+import * as fs14 from "node:fs/promises";
+import * as path18 from "node:path";
+import { projectSlug } from "@wrongstack/core";
 function projectsJsonPath(globalConfigPath) {
-  const base = path5.dirname(globalConfigPath);
-  return path5.join(base, "projects.json");
+  const base = path18.dirname(globalConfigPath);
+  return path18.join(base, "projects.json");
 }
 async function loadManifest(globalConfigPath) {
   try {
-    const raw = await fs4.readFile(projectsJsonPath(globalConfigPath), "utf8");
+    const raw = await fs14.readFile(projectsJsonPath(globalConfigPath), "utf8");
     const parsed = JSON.parse(raw);
     return { projects: parsed.projects ?? [] };
   } catch {
@@ -10613,18 +11519,26 @@ async function loadManifest(globalConfigPath) {
 }
 async function saveManifest(manifest, globalConfigPath) {
   const file = projectsJsonPath(globalConfigPath);
-  await fs4.mkdir(path5.dirname(file), { recursive: true });
-  await fs4.writeFile(file, JSON.stringify(manifest, null, 2), "utf8");
+  await fs14.mkdir(path18.dirname(file), { recursive: true });
+  await fs14.writeFile(file, JSON.stringify(manifest, null, 2), "utf8");
 }
 function generateProjectSlug(rootPath) {
   return projectSlug(rootPath);
 }
 async function ensureProjectDataDir(slug, globalConfigPath) {
-  const base = path5.dirname(globalConfigPath);
-  const dir = path5.join(base, "projects", slug);
-  await fs4.mkdir(dir, { recursive: true });
+  const base = path18.dirname(globalConfigPath);
+  const dir = path18.join(base, "projects", slug);
+  await fs14.mkdir(dir, { recursive: true });
   return dir;
 }
+
+// src/server/provider-handlers.ts
+import { DefaultSecretScrubber } from "@wrongstack/core";
+import {
+  beginOAuthLogin
+} from "@wrongstack/providers/oauth";
+import { probeLocalLlm } from "@wrongstack/runtime/probe";
+import { toErrorMessage as toErrorMessage9 } from "@wrongstack/core/utils";
 function projectSavedProviders(providers) {
   return Object.entries(providers).map(([id, cfg]) => {
     const keys = normalizeKeys(cfg);
@@ -10655,7 +11569,7 @@ function createProviderHandlers(deps2) {
   }
   async function saveConfigProviders(providers) {
     const next = configWriteLock.then(() => saveProviders(globalConfigPath, vault, providers)).catch((err) => {
-      const msg = toErrorMessage(err);
+      const msg = toErrorMessage9(err);
       console.error(JSON.stringify({
         level: "error",
         event: "webui.provider_save_failed",
@@ -10927,10 +11841,23 @@ function createProviderHandlers(deps2) {
     loadConfigProviders
   };
 }
+
+// src/server/routes.ts
+import path20 from "node:path";
+import {
+  enhanceUserPrompt,
+  gatedEnhancerReasoning,
+  recentTextTurns,
+  resolveProviderModelList
+} from "@wrongstack/core";
+import { makeProviderFromConfig as makeProviderFromConfig2 } from "@wrongstack/providers";
+
+// src/server/mailbox-handlers.ts
+import { GlobalMailbox as GlobalMailbox3, resolveProjectDir as resolveProjectDir2 } from "@wrongstack/core";
 async function handleMailboxMessages(ws, deps2, payload) {
   try {
-    const dir = resolveProjectDir(deps2.projectRoot, deps2.globalRoot);
-    const mb = new GlobalMailbox(dir);
+    const dir = resolveProjectDir2(deps2.projectRoot, deps2.globalRoot);
+    const mb = new GlobalMailbox3(dir);
     const limit = payload?.limit ?? 30;
     const unreadForAgent = payload?.unreadOnly === true && payload.agentId !== void 0;
     const messages = await mb.query({
@@ -10970,8 +11897,8 @@ async function handleMailboxMessages(ws, deps2, payload) {
 }
 async function handleMailboxAgents(ws, deps2, payload) {
   try {
-    const dir = resolveProjectDir(deps2.projectRoot, deps2.globalRoot);
-    const mb = new GlobalMailbox(dir);
+    const dir = resolveProjectDir2(deps2.projectRoot, deps2.globalRoot);
+    const mb = new GlobalMailbox3(dir);
     const agents = payload?.onlineOnly ? await mb.getOnlineAgents() : await mb.getAgentStatuses();
     send(ws, {
       type: "mailbox.agents",
@@ -10999,8 +11926,8 @@ async function handleMailboxAgents(ws, deps2, payload) {
 }
 async function handleMailboxClear(ws, deps2) {
   try {
-    const dir = resolveProjectDir(deps2.projectRoot, deps2.globalRoot);
-    const mb = new GlobalMailbox(dir);
+    const dir = resolveProjectDir2(deps2.projectRoot, deps2.globalRoot);
+    const mb = new GlobalMailbox3(dir);
     await mb.clearAll();
     send(ws, { type: "mailbox.cleared", payload: {} });
   } catch (err) {
@@ -11009,14 +11936,31 @@ async function handleMailboxClear(ws, deps2) {
 }
 async function handleMailboxPurge(ws, deps2, opts) {
   try {
-    const dir = resolveProjectDir(deps2.projectRoot, deps2.globalRoot);
-    const mb = new GlobalMailbox(dir);
+    const dir = resolveProjectDir2(deps2.projectRoot, deps2.globalRoot);
+    const mb = new GlobalMailbox3(dir);
     const result = await mb.purgeStale(opts);
     send(ws, { type: "mailbox.purged", payload: result });
   } catch (err) {
     send(ws, { type: "mailbox.purged", payload: { error: errMessage(err) } });
   }
 }
+async function handleMailboxCompact(ws, deps2, opts) {
+  try {
+    const dir = resolveProjectDir2(deps2.projectRoot, deps2.globalRoot);
+    const mb = new GlobalMailbox3(dir);
+    const result = await mb.autoCompact(opts);
+    send(ws, { type: "mailbox.compacted", payload: result });
+  } catch (err) {
+    send(ws, { type: "mailbox.compacted", payload: { error: errMessage(err) } });
+  }
+}
+
+// src/server/mode-handlers.ts
+import {
+  DefaultSystemPromptBuilder as DefaultSystemPromptBuilder2,
+  resolveWstackPaths as resolveWstackPaths2,
+  ToolValidationError as ToolValidationError5
+} from "@wrongstack/core";
 function createModeHandlers(ctx) {
   return {
     listModes: async (ws) => {
@@ -11059,14 +12003,14 @@ function createModeHandlers(ctx) {
         } else {
           const found = await ctx.modeStore.getMode(id);
           if (!found) {
-            throw new ToolValidationError({ message: `Unknown mode "${id}"`, field: "modeId" });
+            throw new ToolValidationError5({ message: `Unknown mode "${id}"`, field: "modeId" });
           }
           await ctx.modeStore.setActiveMode(id);
         }
         ctx.setModeId(id);
         const modePrompt = id === "default" ? "" : (await ctx.modeStore.getMode(id))?.prompt ?? "";
-        const paths = resolveWstackPaths({ projectRoot: ctx.projectRoot, globalRoot: ctx.globalRoot });
-        const freshBuilder = new DefaultSystemPromptBuilder({
+        const paths = resolveWstackPaths2({ projectRoot: ctx.projectRoot, globalRoot: ctx.globalRoot });
+        const freshBuilder = new DefaultSystemPromptBuilder2({
           memoryStore: ctx.memoryStore,
           skillLoader: ctx.skillLoader,
           modeStore: ctx.modeStore,
@@ -11096,6 +12040,9 @@ function createModeHandlers(ctx) {
     }
   };
 }
+
+// src/server/project-handlers.ts
+import * as path19 from "node:path";
 function createProjectHandlers(ctx) {
   return {
     listProjects: async (ws) => {
@@ -11121,7 +12068,7 @@ function createProjectHandlers(ctx) {
     selectProject: async (ws, msg) => {
       const payload = msg.payload;
       const root = typeof payload?.root === "string" ? payload.root : "";
-      const name2 = typeof payload?.name === "string" ? payload.name : root ? path5.basename(root) : "";
+      const name2 = typeof payload?.name === "string" ? payload.name : root ? path19.basename(root) : "";
       send(ws, {
         type: "projects.selected",
         payload: {
@@ -11154,6 +12101,14 @@ function createProjectHandlers(ctx) {
     }
   };
 }
+
+// src/server/session-handlers.ts
+import {
+  DEFAULT_CONTEXT_WINDOW_MODE_ID,
+  repairToolUseAdjacency,
+  resolveContextWindowPolicy as resolveContextWindowPolicy3
+} from "@wrongstack/core";
+import { sessionScopedPath as sessionScopedPath2 } from "@wrongstack/core/utils";
 function createSessionHandlers(ctx) {
   const currentSessionId = () => ctx.getSession().id;
   const sessionPayload2 = (payload) => {
@@ -11179,33 +12134,46 @@ function createSessionHandlers(ctx) {
     });
     return false;
   };
+  const finalizeSession = async (writer) => {
+    await writer.append({
+      type: "session_end",
+      ts: (/* @__PURE__ */ new Date()).toISOString(),
+      usage: ctx.tokenCounter.total()
+    }).catch(() => void 0);
+    await writer.close().catch(() => void 0);
+  };
+  const activateSession = async (next, messages, usage) => {
+    const current = ctx.getSession();
+    if (current !== next) await finalizeSession(current);
+    ctx.setSession(next);
+    ctx.context.session = next;
+    ctx.context.state.replaceMessages(messages);
+    ctx.context.state.replaceTodos([]);
+    ctx.context.readFiles.clear();
+    ctx.context.fileMtimes.clear();
+    ctx.context.state.setMeta(
+      "plan.path",
+      sessionScopedPath2(ctx.sessionsDir, next.id, ".plan.json")
+    );
+    ctx.context.state.setMeta(
+      "task.path",
+      sessionScopedPath2(ctx.sessionsDir, next.id, ".tasks.json")
+    );
+    ctx.tokenCounter.reset();
+    if (usage) ctx.tokenCounter.account(usage, ctx.config.model);
+    ctx.setSessionStartedAt(Date.now());
+    await ctx.onSessionSwapped(next.id);
+  };
   return {
     newSession: async (ws, msg) => {
       if (!ensureCurrentSession(ws, msg, "session.new")) return;
-      const session = ctx.getSession();
-      try {
-        await session.append({
-          type: "session_end",
-          ts: (/* @__PURE__ */ new Date()).toISOString(),
-          usage: ctx.tokenCounter.total()
-        });
-        await session.close();
-      } catch {
-      }
       const next = await ctx.getSessionStore().create({
         id: "",
         title: "",
         model: ctx.config.model,
         provider: ctx.config.provider
       });
-      ctx.setSession(next);
-      ctx.context.session = next;
-      ctx.context.state.replaceMessages([]);
-      ctx.context.state.replaceTodos([]);
-      ctx.context.readFiles.clear();
-      ctx.context.fileMtimes.clear();
-      ctx.tokenCounter.reset();
-      ctx.setSessionStartedAt(Date.now());
+      await activateSession(next, []);
       broadcast(ctx.clients, { type: "session.start", payload: await ctx.sessionStartPayload() });
     },
     clearContext: async (ws, msg) => {
@@ -11307,7 +12275,7 @@ function createSessionHandlers(ctx) {
         return;
       }
       const { id } = parsed.value;
-      let policy = resolveContextWindowPolicy({}, id);
+      let policy = resolveContextWindowPolicy3({}, id);
       if (policy.id !== id) {
         const customModes = ctx.customModeStore.list().filter((m) => m.custom === true);
         const custom = customModes.find((m) => m.id === id);
@@ -11379,7 +12347,7 @@ function createSessionHandlers(ctx) {
       const { id } = parsed.value;
       if (String(ctx.context.meta["contextWindowMode"] ?? "") === id) {
         ctx.context.meta["contextWindowMode"] = DEFAULT_CONTEXT_WINDOW_MODE_ID;
-        ctx.context.meta["contextWindowPolicy"] = resolveContextWindowPolicy({}, DEFAULT_CONTEXT_WINDOW_MODE_ID);
+        ctx.context.meta["contextWindowPolicy"] = resolveContextWindowPolicy3({}, DEFAULT_CONTEXT_WINDOW_MODE_ID);
       }
       const result = ctx.customModeStore.remove(id);
       sendResult(ws, result.ok, result.error ?? `Mode "${id}" deleted`);
@@ -11461,23 +12429,7 @@ function createSessionHandlers(ctx) {
           return;
         }
         const resumed = await ctx.getSessionStore().resume(id);
-        try {
-          await current.append({
-            type: "session_end",
-            ts: (/* @__PURE__ */ new Date()).toISOString(),
-            usage: ctx.tokenCounter.total()
-          });
-          await current.close();
-        } catch {
-        }
-        ctx.setSession(resumed.writer);
-        ctx.context.session = resumed.writer;
-        ctx.context.state.replaceMessages(resumed.data.messages);
-        ctx.context.readFiles.clear();
-        ctx.context.fileMtimes.clear();
-        ctx.tokenCounter.reset();
-        ctx.tokenCounter.account(resumed.data.usage, ctx.config.model);
-        ctx.setSessionStartedAt(Date.now());
+        await activateSession(resumed.writer, resumed.data.messages, resumed.data.usage);
         broadcast(ctx.clients, {
           type: "session.start",
           payload: {
@@ -11499,12 +12451,9 @@ function createSessionHandlers(ctx) {
     listCheckpoints: async (ws, msg) => {
       if (!ensureCurrentSession(ws, msg, "session.checkpoints")) return;
       try {
-        const { DefaultSessionRewinder } = await import('@wrongstack/core');
+        const { DefaultSessionRewinder } = await import("@wrongstack/core");
         const projectRoot = ctx.getProjectRoot();
-        const rewinder = new DefaultSessionRewinder(
-          path5.join(projectRoot, ".wrongstack", "sessions"),
-          projectRoot
-        );
+        const rewinder = new DefaultSessionRewinder(ctx.sessionsDir, projectRoot);
         const checkpoints = await rewinder.listCheckpoints(ctx.getSession().id);
         send(ws, { type: "session.checkpoints", payload: sessionPayload2({ checkpoints }) });
       } catch {
@@ -11515,12 +12464,9 @@ function createSessionHandlers(ctx) {
       if (!ensureCurrentSession(ws, msg, "session.rewind")) return;
       const { checkpointIndex } = msg.payload;
       try {
-        const { DefaultSessionRewinder } = await import('@wrongstack/core');
+        const { DefaultSessionRewinder } = await import("@wrongstack/core");
         const projectRoot = ctx.getProjectRoot();
-        const rewinder = new DefaultSessionRewinder(
-          path5.join(projectRoot, ".wrongstack", "sessions"),
-          projectRoot
-        );
+        const rewinder = new DefaultSessionRewinder(ctx.sessionsDir, projectRoot);
         await rewinder.rewindToCheckpoint(ctx.getSession().id, checkpointIndex);
         await ctx.context.session.truncateToCheckpoint(checkpointIndex);
         sendResult(ws, true, `Rewound to checkpoint ${checkpointIndex}`);
@@ -11603,11 +12549,13 @@ function buildRoutes(state, deps2, cb) {
       const saved = await providerHandlers.loadConfigProviders();
       const cfg = saved[providerId];
       const provider = await resolveProviderCatalogForModels(deps2.modelsRegistry, providerId, cfg);
+      const siblingId = SIBLING_CATALOG[providerId];
+      const siblingCatalog = siblingId && siblingId !== providerId ? await deps2.modelsRegistry.getProvider(siblingId).catch(() => void 0) : void 0;
       const models = await enrichProviderModelDescriptors(
         deps2.modelsRegistry,
         providerId,
         cfg,
-        resolveProviderModelList(cfg?.models, provider, cfg?.type ?? providerId)
+        resolveProviderModelList(cfg?.models, provider, cfg?.type ?? providerId, siblingCatalog)
       );
       send(ws, {
         type: "provider.models",
@@ -11633,7 +12581,7 @@ function buildRoutes(state, deps2, cb) {
         const providerCfg = newCfg.providers?.[newProvider] ?? {
           type: newProvider
         };
-        const newProv = deps2.providerRegistry.has(newProvider) ? deps2.providerRegistry.create({ ...providerCfg, type: newProvider }) : makeProviderFromConfig(newProvider, providerCfg);
+        const newProv = deps2.providerRegistry.has(newProvider) ? deps2.providerRegistry.create({ ...providerCfg, type: newProvider }) : makeProviderFromConfig2(newProvider, providerCfg);
         deps2.context.provider = newProv;
         await cb.updateAutoCompactionMaxContext(newProv, newProvider, providerCfg);
         await cb.updateGlobalConfig((config) => {
@@ -11734,8 +12682,10 @@ function buildRoutes(state, deps2, cb) {
     getProjectRoot: state.getProjectRoot,
     getSession: state.getSession,
     getSessionStore: state.getSessionStore,
+    sessionsDir: deps2.wpaths.projectSessions,
     setSession: state.setSession,
     setSessionStartedAt: state.setSessionStartedAt,
+    onSessionSwapped: cb.onSessionSwapped,
     sessionStartPayload: cb.sessionStartPayload
   });
   const projectRoutes = createProjectHandlers({
@@ -11830,6 +12780,17 @@ function buildRoutes(state, deps2, cb) {
           deps2.pipelines.contextWindow.remove("AutoCompaction", { optional: true });
         }
       }
+      if (typeof payload["breakerEnabled"] === "boolean" || typeof payload["breakerAutoKillResetMs"] === "number") {
+        const { getProcessRegistry } = await import("@wrongstack/tools");
+        getProcessRegistry().setBreakerConfig({
+          ...typeof payload["breakerEnabled"] === "boolean" ? { enabled: payload["breakerEnabled"] } : {},
+          ...typeof payload["breakerAutoKillResetMs"] === "number" ? { autoKillResetMs: payload["breakerAutoKillResetMs"] } : {}
+        });
+      }
+      if (typeof payload["debugStream"] === "boolean") {
+        const { setDebugStreamEnabled } = await import("@wrongstack/providers");
+        setDebugStreamEnabled(payload["debugStream"]);
+      }
       if (typeof payload["logLevel"] === "string") {
         const valid = ["debug", "info", "warn", "error"];
         if (valid.includes(payload["logLevel"])) {
@@ -11876,7 +12837,7 @@ function buildRoutes(state, deps2, cb) {
       }
       return handleMailboxMessages(
         ws,
-        { projectRoot: state.getProjectRoot(), globalRoot: path5__default.dirname(deps2.globalConfigPath) },
+        { projectRoot: state.getProjectRoot(), globalRoot: path20.dirname(deps2.globalConfigPath) },
         parsed.value
       );
     },
@@ -11888,13 +12849,13 @@ function buildRoutes(state, deps2, cb) {
       }
       return handleMailboxAgents(
         ws,
-        { projectRoot: state.getProjectRoot(), globalRoot: path5__default.dirname(deps2.globalConfigPath) },
+        { projectRoot: state.getProjectRoot(), globalRoot: path20.dirname(deps2.globalConfigPath) },
         parsed.value
       );
     },
     clear: (ws) => handleMailboxClear(ws, {
       projectRoot: state.getProjectRoot(),
-      globalRoot: path5__default.dirname(deps2.globalConfigPath)
+      globalRoot: path20.dirname(deps2.globalConfigPath)
     }),
     purge: (ws, msg) => {
       const parsed = validateMailboxPurgePayload(msg.payload);
@@ -11904,9 +12865,16 @@ function buildRoutes(state, deps2, cb) {
       }
       return handleMailboxPurge(
         ws,
-        { projectRoot: state.getProjectRoot(), globalRoot: path5__default.dirname(deps2.globalConfigPath) },
+        { projectRoot: state.getProjectRoot(), globalRoot: path20.dirname(deps2.globalConfigPath) },
         parsed.value
       );
+    },
+    compact: (ws, msg) => {
+      return handleMailboxCompact(
+        ws,
+        { projectRoot: state.getProjectRoot(), globalRoot: path20.dirname(deps2.globalConfigPath) },
+        msg.payload ?? {}
+      );
     }
   };
   const mcpRoutes = {
@@ -11919,14 +12887,29 @@ function buildRoutes(state, deps2, cb) {
     sleep: (ws, msg) => handleMcpSleep(ws, msg, deps2.globalConfigPath, deps2.mcpRegistry),
     wake: (ws, msg) => handleMcpWake(ws, msg, deps2.globalConfigPath, deps2.mcpRegistry),
     restart: (ws, msg) => handleMcpRestart(ws, msg, deps2.globalConfigPath, deps2.mcpRegistry),
-    discover: (ws, msg) => handleMcpDiscover(ws, msg, deps2.globalConfigPath, deps2.mcpRegistry)
+    discover: (ws, msg) => handleMcpDiscover(ws, msg, deps2.globalConfigPath, deps2.mcpRegistry),
+    resources: (ws, msg) => handleMcpResources(ws, msg, deps2.globalConfigPath, deps2.mcpRegistry),
+    prompts: (ws, msg) => handleMcpPrompts(ws, msg, deps2.globalConfigPath, deps2.mcpRegistry),
+    resourceRead: (ws, msg) => handleMcpResourceRead(ws, msg, deps2.globalConfigPath, deps2.mcpRegistry),
+    promptGet: (ws, msg) => handleMcpPromptGet(ws, msg, deps2.globalConfigPath, deps2.mcpRegistry)
+  };
+  const sendBrainStatus = (ws) => {
+    const snapshot = deps2.brainRuntime.getSnapshot();
+    send(ws, {
+      type: "brain.status",
+      payload: {
+        maxAutoRisk: deps2.brainSettings.maxAutoRisk,
+        log: deps2.brainLog,
+        mode: snapshot.mode,
+        poolLabels: snapshot.poolLabels,
+        councilLabels: snapshot.councilLabels,
+        ledgerPath: snapshot.ledger.path
+      }
+    });
   };
   const brainRoutes = {
     status: (ws) => {
-      send(ws, {
-        type: "brain.status",
-        payload: { maxAutoRisk: deps2.brainSettings.maxAutoRisk, log: deps2.brainLog }
-      });
+      sendBrainStatus(ws);
     },
     risk: (ws, msg) => {
       const parsed = validateBrainRiskPayload(msg.payload);
@@ -11936,11 +12919,43 @@ function buildRoutes(state, deps2, cb) {
       }
       const { level } = parsed.value;
       deps2.brainSettings.maxAutoRisk = level;
+      sendBrainStatus(ws);
+    },
+    configGet: (ws) => {
       send(ws, {
-        type: "brain.status",
-        payload: { maxAutoRisk: deps2.brainSettings.maxAutoRisk, log: deps2.brainLog }
+        type: "brain.config",
+        payload: { config: deps2.brainRuntime.getSnapshot(), persisted: true }
       });
     },
+    configSet: async (ws, msg) => {
+      const parsed = validateBrainConfigSetPayload(msg.payload);
+      if (!parsed.ok) {
+        sendResult(ws, false, parsed.message);
+        return;
+      }
+      try {
+        const { persisted } = deps2.brainRuntime.apply(parsed.value.patch);
+        const result = await persisted;
+        send(ws, {
+          type: "brain.config",
+          payload: {
+            config: deps2.brainRuntime.getSnapshot(),
+            persisted: result.ok,
+            ...result.ok ? {} : { error: result.error ?? "Persist failed." }
+          }
+        });
+        sendBrainStatus(ws);
+      } catch (err) {
+        send(ws, {
+          type: "brain.config",
+          payload: {
+            config: deps2.brainRuntime.getSnapshot(),
+            persisted: false,
+            error: `Invalid Brain setting: ${errMessage(err)}`
+          }
+        });
+      }
+    },
     ask: async (ws, msg) => {
       const parsed = validateBrainAskPayload(msg.payload);
       if (!parsed.ok) {
@@ -12012,7 +13027,7 @@ async function startWebUI(opts = {}) {
   const updateGlobalConfig2 = async (mutate, errorLabel) => updateGlobalConfig(prefHelperDeps, configWriteLock, mutate, errorLabel);
   console.log("[WebUI] Config loaded:", config.provider ?? "(none)", "/", config.model ?? "(none)");
   if (!config.provider && config.providers && typeof config.providers === "object" && config.providers !== null && !Array.isArray(config.providers) && Object.keys(config.providers).length > 0) {
-    const firstKey = expectDefined(Object.keys(config.providers)[0]);
+    const firstKey = expectDefined3(Object.keys(config.providers)[0]);
     config = patchConfig(config, { provider: firstKey });
     console.log("[WebUI] No active provider \u2014 auto-selected:", firstKey);
   }
@@ -12048,7 +13063,8 @@ async function startWebUI(opts = {}) {
     promptsCtx,
     modelCapabilitiesRef,
     provider,
-    context
+    context,
+    sessionIdentity
   } = preContext;
   let sessionStore = preContext.sessionStore;
   let session = preContext.session;
@@ -12081,7 +13097,12 @@ async function startWebUI(opts = {}) {
     modelCapabilitiesRef,
     sessionGetter: () => session,
     sessionReader,
-    annotationsStore
+    annotationsStore,
+    // Brain settings persist to the GLOBAL config only (config.brain is on
+    // the in-project deny list), serialized behind the shared write lock.
+    persistBrainConfig: (brainConfig) => updateGlobalConfig2((decrypted) => {
+      decrypted["brain"] = brainConfig;
+    }, "brain.config")
   });
   const {
     compactor,
@@ -12091,6 +13112,7 @@ async function startWebUI(opts = {}) {
     pipelines,
     brain,
     brainSettings,
+    brainRuntime,
     brainLog,
     brainMonitor,
     codebaseIndexing,
@@ -12112,7 +13134,7 @@ async function startWebUI(opts = {}) {
     getProjectRoot: () => projectRoot,
     getWorkingDir: () => workingDir,
     getModeId: () => modeId,
-    getContextMode: () => String(context.meta["contextWindowMode"] ?? DEFAULT_CONTEXT_WINDOW_MODE_ID),
+    getContextMode: () => String(context.meta["contextWindowMode"] ?? DEFAULT_CONTEXT_WINDOW_MODE_ID2),
     getNeedsSetup: () => needsSetup,
     modelsRegistry
   });
@@ -12155,21 +13177,21 @@ async function startWebUI(opts = {}) {
     wpaths
   }, watcherMetricsRef);
   async function touchProjectEntry(root, workDir) {
-    const resolved = path5.resolve(root);
+    const resolved = path21.resolve(root);
     const manifest = await loadManifest(globalConfigPath);
     const now = (/* @__PURE__ */ new Date()).toISOString();
-    const existing = manifest.projects.find((p) => path5.resolve(p.root) === resolved);
+    const existing = manifest.projects.find((p) => path21.resolve(p.root) === resolved);
     if (existing) {
       existing.lastSeen = now;
-      if (workDir) existing.lastWorkingDir = path5.resolve(workDir);
+      if (workDir) existing.lastWorkingDir = path21.resolve(workDir);
     } else {
       manifest.projects.push({
-        name: path5.basename(resolved),
+        name: path21.basename(resolved),
         root: resolved,
         slug: generateProjectSlug(resolved),
         createdAt: now,
         lastSeen: now,
-        lastWorkingDir: workDir ? path5.resolve(workDir) : void 0
+        lastWorkingDir: workDir ? path21.resolve(workDir) : void 0
       });
     }
     await saveManifest(manifest, globalConfigPath);
@@ -12261,10 +13283,12 @@ async function startWebUI(opts = {}) {
     terminalHandler,
     brain,
     brainSettings,
+    brainRuntime,
     brainLog
   };
   const cb = {
     sessionStartPayload,
+    onSessionSwapped: (sessionId) => sessionIdentity.activate(sessionId),
     updateAutoCompactionMaxContext,
     updateGlobalConfig: updateGlobalConfig2,
     persistPrefsToConfig: persistPrefsToConfig2,
@@ -12314,13 +13338,13 @@ async function startWebUI(opts = {}) {
             ...snapshot.apiKey !== void 0 ? { apiKey: snapshot.apiKey } : {},
             ...snapshot.baseUrl !== void 0 ? { baseUrl: snapshot.baseUrl } : {}
           };
-          const newProv = deps2.providerRegistry.has(activeId) ? deps2.providerRegistry.create({ ...providerCfg, type: activeId }) : makeProviderFromConfig(activeId, { ...providerCfg, type: activeId });
+          const newProv = deps2.providerRegistry.has(activeId) ? deps2.providerRegistry.create({ ...providerCfg, type: activeId }) : makeProviderFromConfig3(activeId, { ...providerCfg, type: activeId });
           deps2.context.provider = newProv;
           void updateAutoCompactionMaxContext(newProv).catch(() => void 0);
           console.log(`[WebUI] Provider credentials reloaded from config.json (${activeId})`);
         } catch (err) {
           console.warn(
-            `[WebUI] Credential hot-reload failed for ${activeId}: ${toErrorMessage(err)}`
+            `[WebUI] Credential hot-reload failed for ${activeId}: ${toErrorMessage10(err)}`
           );
         }
       },
@@ -12387,17 +13411,27 @@ async function startWebUI(opts = {}) {
     },
     clients: () => clients.keys(),
     servers: [httpServer, wssPrimary, ...wssSecondary ? [wssSecondary] : []],
-    onShutdown: () => {
+    onShutdown: async () => {
       credentialWatcherClose?.();
       brainMonitor.stop();
-      void mcpRegistry.stopAll().catch(() => void 0);
+      await agentServices.brainLedger?.stop().catch(() => {
+      });
+      await mcpRegistry.stopAll().catch(() => void 0);
+      await sessionIdentity.stop();
       eventArming.getDispose()?.();
       if (eternalSubscription) {
         eternalSubscription.dispose();
         eternalSubscription = null;
       }
       codebaseIndexing.dispose();
-      return unregisterInstance(process.pid, path5.dirname(globalConfigPath));
+      if (config.superMemory?.enabled !== false && config.superMemory?.hygiene?.autoAfterSession !== false) {
+        const candidate = memoryStore;
+        await candidate.hygiene?.({
+          retentionDays: config.superMemory?.hygiene?.retentionDays,
+          archiveLowConfidenceAfterDays: config.superMemory?.hygiene?.archiveLowConfidenceAfterDays
+        }).catch((err) => logger.warn(`super-memory session hygiene failed: ${toErrorMessage10(err)}`));
+      }
+      await unregisterInstance(process.pid, path21.dirname(globalConfigPath));
     }
   });
 }
@@ -12412,7 +13446,7 @@ function readArg(names) {
       if (current === name2) {
         const next = argv[i + 1];
         if (!next || next.startsWith("-")) {
-          throw new ToolValidationError({ message: `${name2} requires a value`, field: name2 });
+          throw new ToolValidationError6({ message: `${name2} requires a value`, field: name2 });
         }
         return next;
       }
@@ -12425,7 +13459,7 @@ function parsePort(value, fallback, label) {
   if (value === void 0) return fallback;
   const parsed = Number.parseInt(value, 10);
   if (!Number.isInteger(parsed) || parsed <= 0 || parsed > 65535) {
-    throw new ToolValidationError({
+    throw new ToolValidationError6({
       message: `${label} must be a port between 1 and 65535`,
       field: "port"
     });
@@ -12517,4 +13551,3 @@ if (argv.includes("--help") || argv.includes("-h")) {
   });
 }
 //# sourceMappingURL=entry.js.map
-//# sourceMappingURL=entry.js.map