@wrongstack/webui-server 0.285.0 → 0.287.0

package/dist/index.js

@@ -38,12 +38,13 @@ function commitsSince(cwd, baseSha, branch) {
   }
 }
 var AutoPhaseWebSocketHandler = class {
-  constructor(agent, context, logger, storeDir, events, projectRoot) {
+  constructor(agent, context, logger, storeDir, events, projectRoot, onBoardState) {
     this.agent = agent;
     this.context = context;
     this.logger = logger;
     this.events = events;
     this.projectRoot = projectRoot;
+    this.onBoardState = onBoardState;
     this.store = new PhaseStore({ baseDir: storeDir });
   }
   agent;
@@ -51,6 +52,7 @@ var AutoPhaseWebSocketHandler = class {
   logger;
   events;
   projectRoot;
+  onBoardState;
   orchestrator = null;
   graph = null;
   store;
@@ -395,6 +397,15 @@ Type: ${task.type}`;
     if (!this.graph) return;
     const state = this.buildState(activePhaseId);
     this.broadcast({ type: "autophase.state", payload: state });
+    if (this.onBoardState) {
+      try {
+        this.onBoardState(this.graph.id, state);
+      } catch (err) {
+        this.logger.error(
+          `[AutoPhase] board-state tap failed: ${err instanceof Error ? err.message : String(err)}`
+        );
+      }
+    }
   }
   buildState(activePhaseId) {
     if (!this.graph) {
@@ -2618,10 +2629,7 @@ function cspSourceFromUrl(rawUrl) {
     return void 0;
   }
 }
-var ALLOWED_INLINE_SCRIPT_HASHES = [
-  "'sha256-6PXDy0zrpXa6mvYOl11bZ8nubNUL7ushPUhGDZtaexg='",
-  "'sha256-6sIdwbEBx7jj0drqSHHm7MqvmoYD3CQ4lp8Zp8blcb0='"
-];
+var EXTRA_SCRIPT_SOURCES = ["'wasm-unsafe-eval'"];
 function buildCspHeader(wsPort, requestHost, publicWsUrl) {
   const connect = /* @__PURE__ */ new Set([
     "'self'",
@@ -2635,7 +2643,7 @@ function buildCspHeader(wsPort, requestHost, publicWsUrl) {
   }
   const publicWsSource = publicWsUrl ? cspSourceFromUrl(publicWsUrl) : void 0;
   if (publicWsSource) connect.add(publicWsSource);
-  const scriptSrc = ["'self'", ...ALLOWED_INLINE_SCRIPT_HASHES].join(" ");
+  const scriptSrc = ["'self'", ...EXTRA_SCRIPT_SOURCES].join(" ");
   return `default-src 'self'; script-src ${scriptSrc}; style-src 'self' 'unsafe-inline'; connect-src ${Array.from(connect).join(" ")}; img-src 'self' data:; font-src 'self' data:; worker-src 'self' blob:; object-src 'none'; base-uri 'self'; frame-ancestors 'none'; form-action 'self'`;
 }
 function isInsideDist(candidate, distDir) {
@@ -2996,7 +3004,7 @@ function mapStatus(raw) {
       return "stopped";
   }
 }
-function toView(info) {
+function toView(info, health) {
   const view = {
     name: info.name,
     transport: info.transport,
@@ -3008,6 +3016,7 @@ function toView(info) {
   };
   if (info.description !== void 0) view.description = info.description;
   if (info.lazy !== void 0) view.lazy = info.lazy;
+  if (health !== void 0) view.health = health;
   return view;
 }
 function deps(ws, globalConfigPath, registry) {
@@ -3033,7 +3042,13 @@ async function handleMcpList(ws, _msg, globalConfigPath, mcpRegistry) {
     registry: mcpRegistry,
     presets: allServers()
   });
-  send(ws, { type: "mcp.list", payload: { servers: servers.map(toView) } });
+  const health = new Map(
+    (typeof mcpRegistry.operationalHealth === "function" ? mcpRegistry.operationalHealth() : []).map((item) => [item.name, item])
+  );
+  send(ws, {
+    type: "mcp.list",
+    payload: { servers: servers.map((server) => toView(server, health.get(server.name))) }
+  });
 }
 async function handleMcpAdd(ws, msg, globalConfigPath, mcpRegistry) {
   const d = deps(ws, globalConfigPath, mcpRegistry);
@@ -3183,10 +3198,119 @@ async function handleMcpDiscover(ws, msg, globalConfigPath, mcpRegistry) {
     payload: { success: result.ok, message: result.message }
   });
 }
+async function handleMcpResources(ws, msg, _globalConfigPath, mcpRegistry) {
+  if (!mcpRegistry) return sendContentError(ws, "resources", "", "MCP registry is not available.");
+  const payload = payloadRecord(msg);
+  let serverName = "";
+  try {
+    serverName = requiredPayloadString(payload, "name");
+    const refresh = payload["refresh"] === true;
+    const [resources, resourceTemplates] = await Promise.all([
+      mcpRegistry.listResources(serverName, { refresh }),
+      mcpRegistry.listResourceTemplates(serverName, { refresh })
+    ]);
+    send(ws, {
+      type: "mcp.resources",
+      payload: { name: serverName, resources, resourceTemplates }
+    });
+  } catch (err) {
+    sendContentError(ws, "resources", serverName, errorMessage(err));
+  }
+}
+async function handleMcpPrompts(ws, msg, _globalConfigPath, mcpRegistry) {
+  if (!mcpRegistry) return sendContentError(ws, "prompts", "", "MCP registry is not available.");
+  const payload = payloadRecord(msg);
+  let serverName = "";
+  try {
+    serverName = requiredPayloadString(payload, "name");
+    const prompts = await mcpRegistry.listPrompts(serverName, {
+      refresh: payload["refresh"] === true
+    });
+    send(ws, { type: "mcp.prompts", payload: { name: serverName, prompts } });
+  } catch (err) {
+    sendContentError(ws, "prompts", serverName, errorMessage(err));
+  }
+}
+async function handleMcpResourceRead(ws, msg, _globalConfigPath, mcpRegistry) {
+  if (!mcpRegistry)
+    return sendContentError(ws, "resource.read", "", "MCP registry is not available.");
+  const payload = payloadRecord(msg);
+  let serverName = "";
+  try {
+    serverName = requiredPayloadString(payload, "name");
+    const insertion = await mcpRegistry.selectResourceForInsertion(
+      serverName,
+      requiredPayloadString(payload, "uri")
+    );
+    send(ws, { type: "mcp.content.selected", payload: insertion });
+  } catch (err) {
+    sendContentError(ws, "resource.read", serverName, errorMessage(err));
+  }
+}
+async function handleMcpPromptGet(ws, msg, _globalConfigPath, mcpRegistry) {
+  if (!mcpRegistry) return sendContentError(ws, "prompt.get", "", "MCP registry is not available.");
+  const payload = payloadRecord(msg);
+  let serverName = "";
+  try {
+    serverName = requiredPayloadString(payload, "name");
+    const insertion = await mcpRegistry.selectPromptForInsertion(
+      serverName,
+      requiredPayloadString(payload, "prompt"),
+      promptArguments(payload["arguments"])
+    );
+    send(ws, { type: "mcp.content.selected", payload: insertion });
+  } catch (err) {
+    sendContentError(ws, "prompt.get", serverName, errorMessage(err));
+  }
+}
+function payloadRecord(msg) {
+  return msg.payload && typeof msg.payload === "object" && !Array.isArray(msg.payload) ? msg.payload : {};
+}
+function requiredPayloadString(payload, field) {
+  const value = payload[field];
+  if (typeof value !== "string" || value.length === 0) {
+    throw new Error(`MCP payload field "${field}" must be a non-empty string`);
+  }
+  return value;
+}
+function promptArguments(value) {
+  if (value === void 0) return void 0;
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error("MCP prompt arguments must be an object");
+  }
+  const args = {};
+  for (const [key, item] of Object.entries(value)) {
+    if (typeof item !== "string") throw new Error(`MCP prompt argument "${key}" must be a string`);
+    args[key] = item;
+  }
+  return args;
+}
+function sendContentError(ws, action, name2, error) {
+  send(ws, { type: "mcp.content.error", payload: { action, name: name2, error } });
+}
+function errorMessage(err) {
+  return err instanceof Error ? err.message : String(err);
+}
 
 // src/server/memory-handlers.ts
+function isSuperMemoryStore(store) {
+  const s = store;
+  return typeof s.stats === "function" && typeof s.listSuper === "function" && typeof s.getSuperMemory === "function" && typeof s.updateSuperMemory === "function" && typeof s.deleteSuperMemory === "function";
+}
+function requiresSuperMemory(command) {
+  return `\`${command}\` requires the Super Memory backend (superMemory.enabled).`;
+}
 async function handleMemoryList(ws, memoryStore) {
   try {
+    if (isSuperMemoryStore(memoryStore)) {
+      const [stats, memories] = await Promise.all([
+        memoryStore.stats(),
+        memoryStore.listSuper()
+      ]);
+      const text2 = memories.length === 0 ? "\u{1F9E0} Super Memory is empty." : formatSuperMemoryText(stats, memories);
+      send(ws, { type: "memory.list", payload: { text: text2 } });
+      return;
+    }
     const text = await memoryStore.readAll();
     send(ws, { type: "memory.list", payload: { text } });
   } catch (err) {
@@ -3196,26 +3320,128 @@ async function handleMemoryList(ws, memoryStore) {
     });
   }
 }
-async function handleMemoryRemember(ws, msg, memoryStore) {
-  const { text, scope } = msg.payload;
+function formatSuperMemoryText(stats, memories) {
+  const active = stats.byStatus["active"] ?? 0;
+  const stale = stats.byStatus["stale"] ?? 0;
+  const archived = stats.byStatus["archived"] ?? 0;
+  const lines = [
+    "## \u{1F9E0} Super Memory",
+    "",
+    `**Total:** ${stats.total} \xB7 \u{1F7E2} ${active} active \xB7 \u{1F7E1} ${stale} stale \xB7 \u{1F535} ${archived} archived \xB7 **edges:** ${stats.edges}`,
+    ""
+  ];
+  for (const m of memories) {
+    const tags = m.tags.length > 0 ? ` \`${m.tags.slice(0, 3).join("` `")}\`` : "";
+    const icon = m.status === "active" ? "\u{1F7E2}" : m.status === "stale" ? "\u{1F7E1}" : m.status === "archived" ? "\u{1F535}" : "\u26AA";
+    const preview = m.text.replace(/\s+/g, " ").trim().slice(0, 140);
+    lines.push(`- ${icon} \`${m.id.slice(0, 12)}\u2026\` [${m.kind}] ${preview}${tags}`);
+  }
+  return lines.join("\n");
+}
+async function handleSuperMemoryList(ws, memoryStore) {
+  if (!isSuperMemoryStore(memoryStore)) {
+    send(ws, { type: "memory.super.list", payload: { error: requiresSuperMemory("memory.super.list") } });
+    return;
+  }
   try {
-    await memoryStore.remember(text, scope ?? "project-memory");
-    sendResult(ws, true, "Saved to memory");
+    const [stats, memories] = await Promise.all([
+      memoryStore.stats(),
+      memoryStore.listSuper()
+    ]);
+    send(ws, { type: "memory.super.list", payload: { memories, stats } });
   } catch (err) {
-    sendResult(ws, false, errMessage(err));
+    send(ws, { type: "memory.super.list", payload: { error: errMessage(err) } });
   }
 }
-async function handleMemoryForget(ws, msg, memoryStore) {
-  const { text, scope } = msg.payload;
+async function handleSuperMemoryGet(ws, msg, memoryStore) {
+  if (!isSuperMemoryStore(memoryStore)) {
+    send(ws, { type: "memory.super.get", payload: { error: requiresSuperMemory("memory.super.get") } });
+    return;
+  }
+  const { id } = msg.payload;
+  if (!id) {
+    send(ws, { type: "memory.super.get", payload: { error: "id is required" } });
+    return;
+  }
   try {
-    const removed = await memoryStore.forget(text, scope ?? "project-memory");
-    sendResult(
-      ws,
-      removed > 0,
-      removed > 0 ? `Removed ${removed} entr${removed === 1 ? "y" : "ies"}` : "No matching entries"
-    );
+    const memory = await memoryStore.getSuperMemory(id);
+    if (!memory) {
+      send(ws, { type: "memory.super.get", payload: { error: `Memory "${id}" not found.` } });
+      return;
+    }
+    send(ws, { type: "memory.super.get", payload: { memory } });
   } catch (err) {
-    sendResult(ws, false, errMessage(err));
+    send(ws, { type: "memory.super.get", payload: { error: errMessage(err) } });
+  }
+}
+async function handleSuperMemoryUpdate(ws, msg, memoryStore) {
+  if (!isSuperMemoryStore(memoryStore)) {
+    send(ws, { type: "memory.super.update", payload: { error: requiresSuperMemory("memory.super.update") } });
+    return;
+  }
+  const payload = msg.payload;
+  const id = payload["id"];
+  if (!id) {
+    send(ws, { type: "memory.super.update", payload: { error: "id is required" } });
+    return;
+  }
+  const patch = { ...payload };
+  delete patch["id"];
+  if (Object.keys(patch).length === 0) {
+    send(ws, { type: "memory.super.update", payload: { error: "No fields to update." } });
+    return;
+  }
+  try {
+    const memory = await memoryStore.updateSuperMemory(id, patch);
+    send(ws, { type: "memory.super.update", payload: { memory } });
+  } catch (err) {
+    send(ws, { type: "memory.super.update", payload: { error: errMessage(err) } });
+  }
+}
+async function handleSuperMemoryRemember(ws, msg, memoryStore) {
+  if (!isSuperMemoryStore(memoryStore)) {
+    send(ws, { type: "memory.super.remember", payload: { error: requiresSuperMemory("memory.super.remember") } });
+    return;
+  }
+  const payload = msg.payload;
+  const text = payload["text"];
+  if (!text || !text.trim()) {
+    send(ws, { type: "memory.super.remember", payload: { error: "text is required" } });
+    return;
+  }
+  try {
+    const memory = await memoryStore.rememberSuper({
+      text: text.trim(),
+      kind: payload["kind"],
+      scope: payload["scope"],
+      tags: payload["tags"],
+      anchors: payload["anchors"],
+      importance: payload["importance"],
+      confidence: payload["confidence"],
+      freshness: payload["freshness"],
+      supersedes: payload["supersedes"],
+      contradicts: payload["contradicts"]
+    });
+    send(ws, { type: "memory.super.remember", payload: { memory } });
+  } catch (err) {
+    send(ws, { type: "memory.super.remember", payload: { error: errMessage(err) } });
+  }
+}
+async function handleSuperMemoryDelete(ws, msg, memoryStore) {
+  if (!isSuperMemoryStore(memoryStore)) {
+    send(ws, { type: "memory.super.delete", payload: { success: false, message: requiresSuperMemory("memory.super.delete") } });
+    return;
+  }
+  const { id, reason } = msg.payload;
+  if (!id) {
+    send(ws, { type: "memory.super.delete", payload: { success: false, message: "id is required" } });
+    return;
+  }
+  try {
+    await memoryStore.deleteSuperMemory(id, reason);
+    send(ws, { type: "memory.super.delete", payload: { success: true, message: `Deleted memory "${id}".` } });
+  } catch (err) {
+    send(ws, { type: "memory.super.delete", payload: { success: false, message: errMessage(err) } });
   }
 }
 
@@ -3265,6 +3491,16 @@ function openBrowser(url, platform = process.platform) {
 // src/server/port-utils.ts
 import * as net from "node:net";
 import { ToolValidationError as ToolValidationError3 } from "@wrongstack/core";
+var SURFACE_DEFAULT_PORTS = {
+  webui: { http: 3456, ws: 3457 },
+  simpleui: { http: 3466, ws: 3467 }
+};
+function surfaceLabel(surface) {
+  return surface === "webui" ? "WebUI" : "SimpleUI";
+}
+function getSurfaceDefaultPorts(surface) {
+  return { ...SURFACE_DEFAULT_PORTS[surface] };
+}
 function isPortFree(host, port) {
   return new Promise((resolve10) => {
     const srv = net.createServer();
@@ -3821,6 +4057,8 @@ var SddBoardWebSocketHandler = class {
 import * as path9 from "node:path";
 import { spawnSync as spawnSync2 } from "node:child_process";
 import {
+  DefaultTaskStore,
+  TaskTracker,
   WorktreeManager as WorktreeManager2,
   ToolValidationError as ToolValidationError4
 } from "@wrongstack/core";
@@ -3836,6 +4074,63 @@ import {
   startSddRun,
   TaskGraphStore
 } from "@wrongstack/sdd";
+function startSddRunFromGraph(graph, deps2, config = {}, tracker) {
+  const runTracker = tracker ?? (() => {
+    const t = new TaskTracker({ store: new DefaultTaskStore() });
+    t.setGraph(graph);
+    return t;
+  })();
+  const worktreesEnabled = config.worktrees ?? process.env["WRONGSTACK_SDD_WORKTREES"] !== "0";
+  let worktrees;
+  if (worktreesEnabled) {
+    const inGit = spawnSync2("git", ["rev-parse", "--is-inside-work-tree"], {
+      cwd: deps2.projectRoot,
+      encoding: "utf8",
+      windowsHide: true
+    }).stdout?.trim() === "true";
+    if (inGit) {
+      void cleanupStaleSddWorktrees({
+        projectRoot: deps2.projectRoot,
+        boardsDir: deps2.projectSddBoards
+      }).catch(() => void 0);
+      worktrees = new WorktreeManager2({
+        projectRoot: deps2.projectRoot,
+        events: deps2.events,
+        sessionId: () => deps2.agent.ctx.session?.id
+      });
+    }
+  }
+  const superviseFailure = deps2.brain && deps2.runIsolatedTurn ? new SddSupervisor({
+    brain: deps2.brain,
+    reassignModels: config.fallbackModels,
+    generateSubtasks: makeLlmSubtaskGenerator({
+      run: (prompt) => deps2.runIsolatedTurn(prompt, "Task Splitter")
+    }),
+    requestLlmVerdict: true
+  }).superviseFailure : deps2.brain ? new SddSupervisor({
+    brain: deps2.brain,
+    reassignModels: config.fallbackModels,
+    requestLlmVerdict: true
+  }).superviseFailure : void 0;
+  return startSddRun({
+    tracker: runTracker,
+    graph,
+    agent: deps2.agent,
+    projectRoot: deps2.projectRoot,
+    events: deps2.events,
+    sessionId: () => deps2.agent.ctx.session?.id,
+    subagentFactory: deps2.subagentFactory,
+    boardStore: new SddBoardStore2({ baseDir: deps2.projectSddBoards }),
+    registry: deps2.registry ?? new SddRunRegistry(),
+    verifyTask: makeCommandVerifier(),
+    ...superviseFailure ? { superviseFailure } : {},
+    ...config.parallelSlots !== void 0 ? { parallelSlots: config.parallelSlots } : {},
+    ...config.defaultModel !== void 0 ? { defaultModel: config.defaultModel } : {},
+    ...config.defaultProvider !== void 0 ? { defaultProvider: config.defaultProvider } : {},
+    ...config.fallbackModels !== void 0 ? { fallbackModels: config.fallbackModels } : {},
+    ...worktrees ? { worktrees } : {}
+  });
+}
 var PLANNING_ONLY_GUARD = "SYSTEM: You are running a PLANNING-ONLY specification interview. Do NOT write, create, or edit any files, and do NOT run shell/terminal commands or use any code-editing tools \u2014 they are disabled here and any attempt will fail and waste the turn. Respond with TEXT ONLY: ask your question, or emit the requested spec / plan / task JSON. All code is written later, automatically, once the plan is approved and the multi-agent run starts.\n\n---\n\n";
 function buildSddWizardDeps(opts) {
   const registry = new SddRunRegistry();
@@ -3871,64 +4166,27 @@ function buildSddWizardDeps(opts) {
           field: "taskGraph"
         });
       }
-      const worktreesEnabled = useWorktrees ?? process.env["WRONGSTACK_SDD_WORKTREES"] !== "0";
-      let worktrees;
-      if (worktreesEnabled) {
-        const inGit = spawnSync2("git", ["rev-parse", "--is-inside-work-tree"], {
-          cwd: opts.projectRoot,
-          encoding: "utf8",
-          windowsHide: true
-        }).stdout?.trim() === "true";
-        if (inGit) {
-          await cleanupStaleSddWorktrees({
-            projectRoot: opts.projectRoot,
-            boardsDir: opts.paths.projectSddBoards
-          }).catch(() => void 0);
-          worktrees = new WorktreeManager2({
-            projectRoot: opts.projectRoot,
-            events: opts.events,
-            sessionId: () => opts.agent.ctx.session?.id
-          });
-        }
-      }
-      const boardStore = new SddBoardStore2({ baseDir: opts.paths.projectSddBoards });
-      const verifyTask = makeCommandVerifier();
-      const superviseFailure = opts.brain ? new SddSupervisor({
-        brain: opts.brain,
-        // The run-level fallback chain (chosen in the wizard) doubles as the
-        // supervisor's reassign options — a `reassign` verdict rotates the
-        // worker model on retry. Empty/undefined → reassign option dropped.
-        reassignModels: fallbackModels,
-        // LLM auto-split: decompose a retry-exhausted task into smaller
-        // sub-tasks on an isolated read-only turn. Heavily validated +
-        // bounded; an empty result degrades the split into a retry.
-        generateSubtasks: makeLlmSubtaskGenerator({
-          run: (prompt) => runIsolatedTurn(prompt, "Task Splitter")
-        }),
-        // The standalone brain is a tiered policy→LLM arbiter with NO
-        // human-escalation wrapper (see index.ts), so it never blocks on a
-        // human prompt — an unresolved verdict degrades to a bounded retry.
-        // Safe to let the LLM layer actually pick reassign/split.
-        requestLlmVerdict: true
-      }).superviseFailure : void 0;
-      const handle = startSddRun({
-        tracker,
+      const handle = startSddRunFromGraph(
         graph,
-        agent: opts.agent,
-        projectRoot: opts.projectRoot,
-        events: opts.events,
-        sessionId: () => opts.agent.ctx.session?.id,
-        subagentFactory: opts.subagentFactory,
-        worktrees,
-        boardStore,
-        registry,
-        parallelSlots,
-        defaultModel,
-        defaultProvider,
-        fallbackModels,
-        verifyTask,
-        superviseFailure
-      });
+        {
+          agent: opts.agent,
+          events: opts.events,
+          projectRoot: opts.projectRoot,
+          subagentFactory: opts.subagentFactory,
+          projectSddBoards: opts.paths.projectSddBoards,
+          registry,
+          runIsolatedTurn,
+          ...opts.brain ? { brain: opts.brain } : {}
+        },
+        {
+          ...parallelSlots !== void 0 ? { parallelSlots } : {},
+          ...defaultModel !== void 0 ? { defaultModel } : {},
+          ...defaultProvider !== void 0 ? { defaultProvider } : {},
+          ...fallbackModels !== void 0 ? { fallbackModels } : {},
+          ...useWorktrees !== void 0 ? { worktrees: useWorktrees } : {}
+        },
+        tracker
+      );
       void handle.completion.catch(() => {
       });
       return { runId: handle.runId };
@@ -4072,6 +4330,31 @@ var SddWizardWebSocketHandler = class {
   }
 };
 
+// src/server/session-history.ts
+function toSessionHistoryEntry(summary, currentSessionId) {
+  return {
+    id: summary.id,
+    title: summary.title,
+    ...summary.name !== void 0 ? { name: summary.name } : {},
+    startedAt: summary.startedAt,
+    ...summary.endedAt !== void 0 ? { endedAt: summary.endedAt } : {},
+    model: summary.model,
+    provider: summary.provider,
+    tokenTotal: summary.tokenTotal,
+    ...summary.iterationCount !== void 0 ? { iterationCount: summary.iterationCount } : {},
+    ...summary.toolCallCount !== void 0 ? { toolCallCount: summary.toolCallCount } : {},
+    ...summary.toolErrorCount !== void 0 ? { toolErrorCount: summary.toolErrorCount } : {},
+    ...summary.fileChangeCount !== void 0 ? { fileChangeCount: summary.fileChangeCount } : {},
+    ...summary.toolBreakdown !== void 0 ? { toolBreakdown: summary.toolBreakdown } : {},
+    ...summary.compactionCount !== void 0 ? { compactionCount: summary.compactionCount } : {},
+    ...summary.outcome !== void 0 ? { outcome: summary.outcome } : {},
+    isCurrent: summary.id === currentSessionId
+  };
+}
+function toSessionHistoryEntries(summaries, currentSessionId) {
+  return summaries.map((summary) => toSessionHistoryEntry(summary, currentSessionId));
+}
+
 // src/server/shell-open.ts
 import * as fs8 from "node:fs/promises";
 import * as path10 from "node:path";
@@ -4272,6 +4555,16 @@ function validateBrainAskPayload(payload) {
   }
   return { ok: true, value: { question: question.trim() } };
 }
+function validateBrainConfigSetPayload(payload) {
+  if (!isRecord(payload)) {
+    return { ok: false, message: "brain.config.set payload must be an object with a patch object" };
+  }
+  const patch = payload["patch"];
+  if (!isRecord(patch)) {
+    return { ok: false, message: "brain.config.set payload.patch must be an object" };
+  }
+  return { ok: true, value: { patch } };
+}
 function validateAutonomySwitchPayload(payload) {
   if (!isRecord(payload)) {
     return { ok: false, message: "autonomy.switch payload must be an object with string mode" };
@@ -4333,7 +4626,9 @@ var BOOLEAN_PREF_KEYS = /* @__PURE__ */ new Set([
   "hqEnabled",
   "hqRawContent",
   "fallbackAuto",
-  "favoriteModelsOnly"
+  "favoriteModelsOnly",
+  "breakerEnabled",
+  "debugStream"
 ]);
 var STRING_ARRAY_PREF_KEYS = /* @__PURE__ */ new Set(["fallbackModels", "favoriteModels"]);
 var STRING_ARRAY_RECORD_PREF_KEYS = /* @__PURE__ */ new Set(["fallbackProfiles"]);
@@ -4344,9 +4639,18 @@ var NUMBER_PREF_KEYS = /* @__PURE__ */ new Set([
   "maxIterations",
   "maxConcurrent",
   "enhanceDelayMs",
-  "tgLongToolMs"
+  "tgLongToolMs",
+  "breakerAutoKillResetMs"
+]);
+var STRING_PREF_KEYS = /* @__PURE__ */ new Set([
+  "hqUrl",
+  "hqToken",
+  "uiLocale",
+  "thinkingWord",
+  "refinerProvider",
+  "refinerModel",
+  "refinerFallbackProfile"
 ]);
-var STRING_PREF_KEYS = /* @__PURE__ */ new Set(["hqUrl", "hqToken", "uiLocale"]);
 var ENUM_PREF_KEYS = {
   autonomy: AUTONOMY_VALUES,
   contextStrategy: CONTEXT_STRATEGY_VALUES,
@@ -4357,7 +4661,10 @@ var ENUM_PREF_KEYS = {
   auditLevel: AUDIT_LEVEL_VALUES,
   reasoningMode: REASONING_MODE_VALUES,
   reasoningEffort: REASONING_EFFORT_VALUES,
-  cacheTtl: CACHE_TTL_VALUES
+  cacheTtl: CACHE_TTL_VALUES,
+  statuslineMode: /* @__PURE__ */ new Set(["minimum", "detailed", "no-color"]),
+  animationStyle: /* @__PURE__ */ new Set(["rainbow", "wave", "pulse", "dots", "breathe", "cycle"]),
+  fsAccess: /* @__PURE__ */ new Set(["unrestricted", "project"])
 };
 function validateModelRuntimeValue(modelRuntime, path23) {
   const reasoning = modelRuntime["reasoning"];
@@ -5756,6 +6063,10 @@ function shouldLogWatcherStats() {
 function setupEvents(deps2) {
   const { events, broadcast: broadcast2, clients, config, context, pendingConfirms, globalConfigPath, sessionBridge, wpaths, watcherMetrics, onFleetBroadcaster } = deps2;
   const disposers = [];
+  let disposed = false;
+  const on = (event, listener) => {
+    disposers.push(events.on(event, listener));
+  };
   const currentSessionId = () => context.session?.id ?? "";
   const sessionPayload2 = (payload) => {
     const provided = payload["sessionId"];
@@ -5771,20 +6082,20 @@ function setupEvents(deps2) {
     sessionBridge?.append(event).catch(() => {
     });
   };
-  events.on("iteration.started", (e) => {
+  on("iteration.started", (e) => {
     const maxIt = typeof context.meta["maxIterations"] === "number" ? context.meta["maxIterations"] : config.tools?.maxIterations ?? 100;
     broadcast2(clients, {
       type: "iteration.started",
       payload: sessionPayload2({ sessionId: e.sessionId, index: e.index, maxIterations: maxIt })
     });
   });
-  events.on("iteration.completed", (e) => {
+  on("iteration.completed", (e) => {
     broadcast2(clients, {
       type: "iteration.completed",
       payload: sessionPayload2({ sessionId: e.sessionId, index: e.index, totalIterations: e.index + 1 })
     });
   });
-  events.on("iteration.limit_reached", (e) => {
+  on("iteration.limit_reached", (e) => {
     broadcast2(clients, {
       type: "iteration.limit_reached",
       payload: sessionPayload2({
@@ -5794,19 +6105,19 @@ function setupEvents(deps2) {
       })
     });
   });
-  events.on("provider.text_delta", (e) => {
+  on("provider.text_delta", (e) => {
     broadcast2(clients, { type: "provider.text_delta", payload: sessionPayload2({ sessionId: e.sessionId, text: e.text, messageId: "current" }) });
   });
-  events.on("provider.thinking_delta", (e) => {
+  on("provider.thinking_delta", (e) => {
     broadcast2(clients, { type: "provider.thinking_delta", payload: sessionPayload2({ sessionId: e.sessionId, text: e.text }) });
   });
-  events.on("provider.stream_error", (e) => {
+  on("provider.stream_error", (e) => {
     broadcast2(clients, {
       type: "provider.stream_error",
       payload: sessionPayload2({ sessionId: e.sessionId, eventType: e.eventType, message: e.msg })
     });
   });
-  events.on("tool.started", (e) => {
+  on("tool.started", (e) => {
     broadcast2(clients, {
       type: "tool.started",
       payload: sessionPayload2({ sessionId: e.sessionId, id: e.id, name: e.name, input: e.input, messageId: `tool_${e.id}` })
@@ -5819,7 +6130,7 @@ function setupEvents(deps2) {
       input: e.input
     });
   });
-  events.on("tool.progress", (e) => {
+  on("tool.progress", (e) => {
     broadcast2(clients, {
       type: "tool.progress",
       // Nested `event` shape — the client handler reads `payload.event?.text`
@@ -5840,7 +6151,7 @@ function setupEvents(deps2) {
       }
     });
   });
-  events.on("tool.executed", (e) => {
+  on("tool.executed", (e) => {
     broadcast2(clients, {
       type: "tool.executed",
       payload: sessionPayload2({ sessionId: e.sessionId, id: e.id, name: e.name, durationMs: e.durationMs, ok: e.ok, input: e.input, output: e.output })
@@ -5898,7 +6209,7 @@ function setupEvents(deps2) {
       })();
     }
   });
-  events.on("tool.loop_detected", (e) => {
+  on("tool.loop_detected", (e) => {
     broadcast2(clients, {
       type: "tool.loop_detected",
       payload: sessionPayload2({
@@ -5910,19 +6221,19 @@ function setupEvents(deps2) {
       })
     });
   });
-  events.on("trust.persisted", (e) => {
+  on("trust.persisted", (e) => {
     broadcast2(clients, {
       type: "trust.persisted",
       payload: sessionPayload2({ sessionId: e.sessionId, tool: e.tool, pattern: e.pattern, decision: e.decision })
     });
   });
-  events.on("delegate.started", (e) => {
+  on("delegate.started", (e) => {
     broadcast2(clients, {
       type: "delegate.started",
       payload: sessionPayload2({ sessionId: e.sessionId, target: e.target, task: e.task })
     });
   });
-  events.on("delegate.completed", (e) => {
+  on("delegate.completed", (e) => {
     broadcast2(clients, {
       type: "delegate.completed",
       payload: sessionPayload2({
@@ -5940,7 +6251,7 @@ function setupEvents(deps2) {
       })
     });
   });
-  events.on("provider.response", (e) => {
+  on("provider.response", (e) => {
     broadcast2(clients, {
       type: "provider.response",
       payload: sessionPayload2({
@@ -5952,7 +6263,7 @@ function setupEvents(deps2) {
       })
     });
   });
-  events.on("ctx.pct", (e) => {
+  on("ctx.pct", (e) => {
     broadcast2(clients, {
       type: "ctx.pct",
       payload: sessionPayload2({ sessionId: e.sessionId, load: e.load, tokens: e.tokens, maxContext: e.maxContext })
@@ -5969,28 +6280,28 @@ function setupEvents(deps2) {
       })
     });
   });
-  events.on("ctx.max_context", (e) => {
+  on("ctx.max_context", (e) => {
     broadcast2(clients, {
       type: "ctx.max_context",
       payload: sessionPayload2({ sessionId: e.sessionId, providerId: e.providerId, modelId: e.modelId, maxContext: e.maxContext })
     });
   });
-  events.on("token.threshold", (e) => {
+  on("token.threshold", (e) => {
     broadcast2(clients, {
       type: "token.threshold",
       payload: sessionPayload2({ sessionId: e.sessionId, used: e.used, limit: e.limit })
     });
   });
-  events.on("token.cost_estimate_unavailable", (e) => {
+  on("token.cost_estimate_unavailable", (e) => {
     broadcast2(clients, {
       type: "token.cost_estimate_unavailable",
       payload: sessionPayload2({ sessionId: e.sessionId, model: e.model })
     });
   });
-  events.on("context.repaired", (e) => {
+  on("context.repaired", (e) => {
     broadcast2(clients, { type: "context.repaired", payload: sessionPayload2({ sessionId: e.sessionId, removedToolUses: e.removedToolUses, removedToolResults: e.removedToolResults, removedMessages: e.removedMessages }) });
   });
-  events.on("tool.confirm_needed", (e) => {
+  on("tool.confirm_needed", (e) => {
     const id = e.toolUseId ?? `confirm_${Date.now()}`;
     const payload = sessionPayload2({ sessionId: e.sessionId, id, toolName: e.tool?.name ?? "unknown", input: e.input, suggestedPattern: e.suggestedPattern, decisionSource: e.decisionSource, riskTier: e.riskTier });
     pendingConfirms.set(id, {
@@ -6001,7 +6312,7 @@ function setupEvents(deps2) {
     });
     broadcast2(clients, { type: "tool.confirm_needed", payload });
   });
-  events.on("error", (e) => {
+  on("error", (e) => {
     broadcast2(clients, { type: "error", payload: sessionPayload2({ sessionId: e.sessionId, phase: e.phase, message: e.err instanceof Error ? e.err.message : String(e.err) }) });
     appendForCurrentSession(e.sessionId, {
       type: "error",
@@ -6010,13 +6321,13 @@ function setupEvents(deps2) {
       phase: e.phase
     });
   });
-  events.on("session.damaged", (e) => {
+  on("session.damaged", (e) => {
     broadcast2(clients, {
       type: "session.damaged",
       payload: { sessionId: e.sessionId, detail: e.detail }
     });
   });
-  events.on("session.rewound", (e) => {
+  on("session.rewound", (e) => {
     broadcast2(clients, {
       type: "session.rewound",
       payload: sessionPayload2({
@@ -6027,7 +6338,7 @@ function setupEvents(deps2) {
       })
     });
   });
-  events.on("checkpoint.written", (e) => {
+  on("checkpoint.written", (e) => {
     broadcast2(clients, {
       type: "checkpoint.written",
       payload: sessionPayload2({
@@ -6039,19 +6350,19 @@ function setupEvents(deps2) {
       })
     });
   });
-  events.on("in_flight.started", (e) => {
+  on("in_flight.started", (e) => {
     broadcast2(clients, {
       type: "in_flight.started",
       payload: sessionPayload2({ sessionId: e.sessionId, context: e.context, ts: e.ts })
     });
   });
-  events.on("in_flight.ended", (e) => {
+  on("in_flight.ended", (e) => {
     broadcast2(clients, {
       type: "in_flight.ended",
       payload: sessionPayload2({ sessionId: e.sessionId, reason: e.reason, ts: e.ts })
     });
   });
-  events.on("provider.retry", (e) => {
+  on("provider.retry", (e) => {
     broadcast2(clients, {
       type: "provider.retry",
       payload: sessionPayload2({
@@ -6073,7 +6384,7 @@ function setupEvents(deps2) {
       description: e.description
     });
   });
-  events.on("provider.error", (e) => {
+  on("provider.error", (e) => {
     broadcast2(clients, {
       type: "provider.error",
       payload: sessionPayload2({
@@ -6093,7 +6404,7 @@ function setupEvents(deps2) {
       retryable: e.retryable
     });
   });
-  events.on("provider.fallback", (e) => {
+  on("provider.fallback", (e) => {
     broadcast2(clients, {
       type: "provider.fallback",
       payload: sessionPayload2({
@@ -6105,7 +6416,7 @@ function setupEvents(deps2) {
       })
     });
   });
-  events.on("compaction.fired", (e) => {
+  on("compaction.fired", (e) => {
     broadcast2(clients, {
       type: "context.compacted",
       payload: sessionPayload2({
@@ -6117,7 +6428,7 @@ function setupEvents(deps2) {
       })
     });
   });
-  events.on("compaction.failed", (e) => {
+  on("compaction.failed", (e) => {
     broadcast2(clients, {
       type: "compaction.failed",
       payload: sessionPayload2({
@@ -6132,25 +6443,25 @@ function setupEvents(deps2) {
       })
     });
   });
-  events.on("mcp.server.connected", (e) => {
+  on("mcp.server.connected", (e) => {
     broadcast2(clients, {
       type: "mcp.server.connected",
       payload: { name: e.name, toolCount: e.toolCount }
     });
   });
-  events.on("mcp.server.reconnected", (e) => {
+  on("mcp.server.reconnected", (e) => {
     broadcast2(clients, {
       type: "mcp.server.reconnected",
       payload: { name: e.name, toolCount: e.toolCount }
     });
   });
-  events.on("mcp.server.disconnected", (e) => {
+  on("mcp.server.disconnected", (e) => {
     broadcast2(clients, {
       type: "mcp.server.disconnected",
       payload: { name: e.name, reason: e.reason }
     });
   });
-  events.on("coordinator.stats", (e) => {
+  on("coordinator.stats", (e) => {
     broadcast2(clients, {
       type: "coordinator.stats",
       payload: sessionPayload2({
@@ -6178,16 +6489,16 @@ function setupEvents(deps2) {
     broadcast2(clients, { type: "mailbox.agent_registered", payload });
   });
   const forwardSubagent = (kind, payload) => broadcast2(clients, { type: "subagent.event", payload: sessionPayload2({ kind, ...payload }) });
-  events.on("subagent.spawned", (e) => forwardSubagent("spawned", { sessionId: e.sessionId, subagentId: e.subagentId, taskId: e.taskId, name: e.name, provider: e.provider, model: e.model, description: e.description }));
-  events.on("subagent.task_started", (e) => forwardSubagent("task_started", { sessionId: e.sessionId, subagentId: e.subagentId, taskId: e.taskId, description: e.description }));
-  events.on("subagent.tool_executed", (e) => forwardSubagent("tool_executed", { sessionId: e.sessionId, subagentId: e.subagentId, toolName: e.name, durationMs: e.durationMs, ok: e.ok }));
-  events.on("subagent.iteration_summary", (e) => forwardSubagent("iteration_summary", { sessionId: e.sessionId, subagentId: e.subagentId, iteration: e.iteration, toolCalls: e.toolCalls, costUsd: e.costUsd, currentTool: e.currentTool, partialText: e.partialText }));
-  events.on("subagent.budget_warning", (e) => forwardSubagent("budget_warning", { sessionId: e.sessionId, subagentId: e.subagentId, budgetKind: e.kind, used: e.used, limit: e.limit }));
-  events.on("subagent.budget_extended", (e) => forwardSubagent("budget_extended", { sessionId: e.sessionId, subagentId: e.subagentId, budgetKind: e.kind, newLimit: e.newLimit, totalExtensions: e.totalExtensions }));
-  events.on("subagent.ctx_pct", (e) => forwardSubagent("ctx_pct", { sessionId: e.sessionId, subagentId: e.subagentId, load: e.load, tokens: e.tokens, maxContext: e.maxContext }));
-  events.on("subagent.task_completed", (e) => forwardSubagent("task_completed", { sessionId: e.sessionId, subagentId: e.subagentId, status: e.status, iterations: e.iterations, toolCalls: e.toolCalls, finalText: e.finalText, failureReason: e.error?.kind, error: e.error ? { kind: e.error.kind, message: e.error.message } : void 0 }));
-  events.on("subagent.removed", (e) => forwardSubagent("removed", { sessionId: e.sessionId, subagentId: e.subagentId, reason: e.reason }));
-  events.on("agent.timeline.message", (e) => {
+  on("subagent.spawned", (e) => forwardSubagent("spawned", { sessionId: e.sessionId, subagentId: e.subagentId, taskId: e.taskId, name: e.name, provider: e.provider, model: e.model, description: e.description }));
+  on("subagent.task_started", (e) => forwardSubagent("task_started", { sessionId: e.sessionId, subagentId: e.subagentId, taskId: e.taskId, description: e.description }));
+  on("subagent.tool_executed", (e) => forwardSubagent("tool_executed", { sessionId: e.sessionId, subagentId: e.subagentId, toolName: e.name, durationMs: e.durationMs, ok: e.ok }));
+  on("subagent.iteration_summary", (e) => forwardSubagent("iteration_summary", { sessionId: e.sessionId, subagentId: e.subagentId, iteration: e.iteration, toolCalls: e.toolCalls, costUsd: e.costUsd, currentTool: e.currentTool, partialText: e.partialText }));
+  on("subagent.budget_warning", (e) => forwardSubagent("budget_warning", { sessionId: e.sessionId, subagentId: e.subagentId, budgetKind: e.kind, used: e.used, limit: e.limit }));
+  on("subagent.budget_extended", (e) => forwardSubagent("budget_extended", { sessionId: e.sessionId, subagentId: e.subagentId, budgetKind: e.kind, newLimit: e.newLimit, totalExtensions: e.totalExtensions }));
+  on("subagent.ctx_pct", (e) => forwardSubagent("ctx_pct", { sessionId: e.sessionId, subagentId: e.subagentId, load: e.load, tokens: e.tokens, maxContext: e.maxContext }));
+  on("subagent.task_completed", (e) => forwardSubagent("task_completed", { sessionId: e.sessionId, subagentId: e.subagentId, status: e.status, iterations: e.iterations, toolCalls: e.toolCalls, finalText: e.finalText, failureReason: e.error?.kind, error: e.error ? { kind: e.error.kind, message: e.error.message } : void 0 }));
+  on("subagent.removed", (e) => forwardSubagent("removed", { sessionId: e.sessionId, subagentId: e.subagentId, reason: e.reason }));
+  on("agent.timeline.message", (e) => {
     broadcast2(clients, {
       type: "agent.timeline.message",
       payload: sessionPayload2({
@@ -6203,7 +6514,7 @@ function setupEvents(deps2) {
       })
     });
   });
-  events.on("agent.status_changed", (e) => {
+  on("agent.status_changed", (e) => {
     broadcast2(clients, {
       type: "agent.status_changed",
       payload: sessionPayload2({
@@ -6218,7 +6529,7 @@ function setupEvents(deps2) {
     });
   });
   let leaderSpawned = false;
-  events.on("iteration.started", (e) => {
+  on("iteration.started", (e) => {
     if (!leaderSpawned) {
       leaderSpawned = true;
       const provider = context.provider?.id ?? "unknown";
@@ -6232,7 +6543,7 @@ function setupEvents(deps2) {
       });
     }
   });
-  events.on("tool.executed", (e) => {
+  on("tool.executed", (e) => {
     forwardSubagent("tool_executed", {
       sessionId: e.sessionId,
       subagentId: "leader",
@@ -6241,7 +6552,7 @@ function setupEvents(deps2) {
       ok: e.ok
     });
   });
-  events.on("provider.response", (e) => {
+  on("provider.response", (e) => {
     if (e.usage?.input != null) {
       const maxCtx = context.provider.capabilities.maxContext;
       const rawLoad = maxCtx > 0 ? e.usage.input / maxCtx : 0;
@@ -6258,7 +6569,7 @@ function setupEvents(deps2) {
       });
     }
   });
-  events.on("iteration.completed", (e) => {
+  on("iteration.completed", (e) => {
     if (!leaderSpawned) {
       leaderSpawned = true;
       const provider = context.provider?.id ?? "unknown";
@@ -6290,7 +6601,19 @@ function setupEvents(deps2) {
       payload: sessionPayload2({ event: eventName, ...payload })
     });
   });
-  events.on("client.status", async (e) => {
+  events.onPattern("cron:state_snapshot", (_eventName, payload) => {
+    broadcast2(clients, {
+      type: "cron.snapshot",
+      payload
+    });
+  });
+  events.onPattern("cron:job_fired", (_eventName, payload) => {
+    broadcast2(clients, {
+      type: "cron.job_fired",
+      payload
+    });
+  });
+  on("client.status", async (e) => {
     broadcast2(clients, { type: "client.status_update", payload: e });
     if (wpaths?.projectStatus) {
       try {
@@ -6376,6 +6699,7 @@ function setupEvents(deps2) {
     const startWatcher = async () => {
       try {
         await fs10.mkdir(projectsDir, { recursive: true });
+        if (disposed) return;
         watcher = fsWatch(projectsDir, { persistent: true, recursive: true }, async (eventType, filename) => {
           if (eventType !== "change" && eventType !== "rename") return;
           if (filename == null) return;
@@ -6406,7 +6730,7 @@ function setupEvents(deps2) {
         );
       }
     };
-    events.on("client.status", (e) => {
+    on("client.status", (e) => {
       if (e.projectHash) {
         const hash = String(e.projectHash);
         if (!knownProjectHashes.has(hash)) {
@@ -6446,7 +6770,9 @@ function setupEvents(deps2) {
         const registry = new SessionRegistry(globalRoot);
         const sessions = await registry.list();
         const mySlug = sessions.find((s) => s.pid === process.pid)?.projectSlug;
-        const live = sessions.filter((s) => s.status !== "stale").filter((s) => mySlug ? s.projectSlug === mySlug : true).map((s) => ({
+        const live = sessions.filter(
+          (s) => s.status === "active" || s.status === "idle"
+        ).filter((s) => mySlug ? s.projectSlug === mySlug : true).map((s) => ({
           sessionId: s.sessionId,
           projectName: s.projectName,
           projectSlug: s.projectSlug,
@@ -6500,6 +6826,8 @@ function setupEvents(deps2) {
     void broadcastSessions();
   }
   return () => {
+    if (disposed) return;
+    disposed = true;
     for (const dispose of disposers) {
       try {
         dispose();
@@ -6634,9 +6962,11 @@ function positiveNumber(value) {
 // src/server/server-runtime.ts
 import { toErrorMessage as toErrorMessage3 } from "@wrongstack/core/utils";
 async function resolvePorts(opts) {
-  const requestedWsPort = opts.wsPort ?? 3457;
+  const surface = opts.surface ?? "webui";
+  const surfaceDefaults = surface === "simpleui" ? { http: 3466, ws: 3467 } : { http: 3456, ws: 3457 };
+  const requestedWsPort = opts.wsPort ?? surfaceDefaults.ws;
   const wsHost = opts.wsHost ?? process.env["WEBUI_HOST"] ?? process.env["WS_HOST"] ?? "127.0.0.1";
-  const requestedHttpPort = opts.httpPort ?? opts.webuiPort ?? opts.port ?? Number.parseInt(process.env["WEBUI_PORT"] ?? process.env["PORT"] ?? "3456", 10);
+  const requestedHttpPort = opts.httpPort ?? opts.webuiPort ?? opts.port ?? Number.parseInt(process.env["WEBUI_PORT"] ?? process.env["PORT"] ?? String(surfaceDefaults.http), 10);
   const publicUrl = opts.publicUrl ?? process.env["WEBUI_PUBLIC_URL"];
   const publicWsUrl = opts.publicWsUrl ?? process.env["WEBUI_PUBLIC_WS_URL"];
   const requireToken = opts.requireToken ?? envFlag("WEBUI_REQUIRE_TOKEN");
@@ -6726,7 +7056,7 @@ function createWsServers(ports, accessToken) {
     allowedHostnames: publicHostnames,
     allowBrowserUrlToken: Boolean(ports.publicWsUrl)
   });
-  const WS_MAX_PAYLOAD = 8 * 1024 * 1024;
+  const WS_MAX_PAYLOAD = 20 * 1024 * 1024;
   const wssPrimary = new WebSocketServer({
     port: ports.wsPort,
     host: ports.wsHost,
@@ -6794,8 +7124,8 @@ function resolveWebuiDistDir(fromUrl, explicitDistDir) {
   if (explicitDistDir) return path13.resolve(explicitDistDir);
   try {
     const requireFromHere2 = createRequire(fromUrl);
-    const serverEntry = requireFromHere2.resolve("@wrongstack/webui/server");
-    return path13.resolve(path13.dirname(serverEntry), "..");
+    const serverEntry = requireFromHere2.resolve("@wrongstack/webui");
+    return path13.dirname(serverEntry);
   } catch {
     return path13.resolve(path13.dirname(fileURLToPath(fromUrl)), "..", "..", "dist");
   }
@@ -6818,7 +7148,7 @@ function startHttpServer(opts) {
     console.log(`[WebUI] HTTP server running on ${openUrl}`);
     if (opts.openBrowser) openBrowser(openUrl);
     void registerInstance(
-      { pid: process.pid, httpPort: opts.httpPort, wsPort: opts.wsPort, host: opts.wsHost, projectRoot: opts.projectRoot, projectName: path13.basename(opts.projectRoot) || opts.projectRoot, startedAt: (/* @__PURE__ */ new Date()).toISOString(), url: buildWebUIAccessUrl({ host: opts.wsHost, port: opts.httpPort, publicUrl: opts.publicUrl }) },
+      { pid: process.pid, surface: "webui", httpPort: opts.httpPort, wsPort: opts.wsPort, host: opts.wsHost, projectRoot: opts.projectRoot, projectName: path13.basename(opts.projectRoot) || opts.projectRoot, startedAt: (/* @__PURE__ */ new Date()).toISOString(), url: buildWebUIAccessUrl({ host: opts.wsHost, port: opts.httpPort, publicUrl: opts.publicUrl }) },
       registryBaseDir
     ).catch((err) => console.warn(JSON.stringify({ level: "warn", event: "webui.instance_record_failed", message: errMessage(err), timestamp: (/* @__PURE__ */ new Date()).toISOString() })));
   });
@@ -6834,12 +7164,10 @@ function registerShutdown(deps2) {
 }
 
 // src/server/pre-context-services.ts
-import * as path15 from "node:path";
+import * as path16 from "node:path";
 import { createRequire as createRequire2 } from "node:module";
-import { WebSocket as WebSocket2 } from "ws";
 import { DefaultTokenCounter } from "@wrongstack/core/infrastructure";
 import {
-  AgentStatusTracker,
   AnnotationsStore,
   DEFAULT_SESSION_PRUNE_DAYS,
   DefaultModelsRegistry,
@@ -6850,7 +7178,6 @@ import {
   DefaultSkillLoader,
   DefaultSystemPromptBuilder,
   EventBus,
-  FleetNotifier,
   GlobalMailbox,
   PromptUsageStore,
   ProviderRegistry,
@@ -6861,8 +7188,8 @@ import {
   applyToolDescriptionModes,
   applyToolResultRenderModes,
   configureChildEnvGitIdentity,
+  getSessionRegistry as getSessionRegistry2,
   resolveContextWindowPolicy,
-  getSessionRegistry,
   makeMailboxTool,
   makeMailInboxTool,
   makeFleetStatusTool,
@@ -6871,7 +7198,12 @@ import {
 import {
   createSuperMemoryTools
 } from "@wrongstack/super-memory";
-import { MCPRegistry } from "@wrongstack/mcp";
+import {
+  MCPAuthorizationManager,
+  MCPRegistry,
+  MCPVaultTokenStore,
+  createVaultBackedMcpAuthorizationProviderFactory
+} from "@wrongstack/mcp";
 import { buildProviderFactoriesFromRegistry } from "@wrongstack/providers";
 import { createDefaultContainer } from "@wrongstack/runtime";
 import {
@@ -6883,7 +7215,11 @@ import {
   rememberTool,
   searchMemoryTool
 } from "@wrongstack/tools";
-import { toErrorMessage as toErrorMessage5 } from "@wrongstack/core/utils";
+import {
+  attachSessionKanbanMirror,
+  hydrateSessionKanban
+} from "@wrongstack/tools/session-kanban";
+import { sessionScopedPath, toErrorMessage as toErrorMessage5 } from "@wrongstack/core/utils";
 
 // src/server/setup-screen.ts
 import { expectDefined as expectDefined2 } from "@wrongstack/core";
@@ -7021,6 +7357,21 @@ function seedContextMeta(config, context) {
     meta["reasoningPreserve"] = mr.reasoning?.preserve === true;
     meta["cacheTtl"] = mr.cache?.ttl ?? "default";
   }
+  meta["refinerProvider"] = autonomyCfg["refinerProvider"] ?? "";
+  meta["refinerModel"] = autonomyCfg["refinerModel"] ?? "";
+  meta["refinerFallbackProfile"] = autonomyCfg["refinerFallbackProfile"] ?? "";
+  meta["thinkingWord"] = autonomyCfg["thinkingWord"] ?? "thinking";
+  meta["statuslineMode"] = autonomyCfg["statuslineMode"] ?? "detailed";
+  meta["animationStyle"] = autonomyCfg["animationStyle"] ?? "rainbow";
+  meta["breakerEnabled"] = config.circuitBreaker?.enabled === true;
+  meta["breakerAutoKillResetMs"] = config.circuitBreaker?.autoKillResetMs ?? 6e4;
+  {
+    const featuresAllow = config.features?.allowOutsideProjectRoot;
+    const toolsRestrict = config.tools?.restrictToProjectRoot;
+    const allow = featuresAllow !== void 0 ? featuresAllow : toolsRestrict !== void 0 ? !toolsRestrict : true;
+    meta["fsAccess"] = allow ? "unrestricted" : "project";
+  }
+  meta["debugStream"] = config.debugStream === true;
   const hqConfig = config.hq;
   meta["hqEnabled"] = hqConfig?.enabled === true;
   meta["hqUrl"] = hqConfig?.url ?? "";
@@ -7117,10 +7468,188 @@ async function discoverAndMergeWebuiProviders(opts) {
   }
 }
 
+// src/server/standalone-session-identity.ts
+import * as path15 from "node:path";
+import {
+  AgentStatusTracker,
+  FleetNotifier,
+  getSessionRegistry,
+  RecoveryLock
+} from "@wrongstack/core";
+import { WebSocket as WebSocket2 } from "ws";
+async function createStandaloneSessionIdentityLifecycle(opts) {
+  const { paths, events, logger } = opts;
+  const registry = opts.sessionRegistry ?? getSessionRegistry(paths.globalRoot);
+  const fleetNotifier = new FleetNotifier({
+    baseDir: paths.globalRoot,
+    projectRoot: paths.projectRoot,
+    selfPid: process.pid
+  });
+  let activeSessionId = opts.initialSessionId;
+  let stopped = false;
+  let transition = Promise.resolve();
+  const statusTracker = new AgentStatusTracker({
+    events,
+    registry,
+    sessionId: () => activeSessionId,
+    onUpdate: () => fleetNotifier.notify()
+  });
+  const register = async (sessionId) => {
+    try {
+      await registry.register({
+        sessionId,
+        projectSlug: paths.projectSlug,
+        projectRoot: paths.projectRoot,
+        projectName: path15.basename(paths.projectRoot),
+        workingDir: opts.workingDir,
+        clientType: "webui",
+        pid: process.pid,
+        startedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        agents: statusTracker.getAgents()
+      });
+      fleetNotifier.notify();
+    } catch (err) {
+      logger.debug?.(`WebUI session registry update failed: ${errorMessage2(err)}`);
+    }
+  };
+  await register(activeSessionId);
+  statusTracker.start();
+  const recoveryLock = opts.manageRecoveryLock === false ? void 0 : new RecoveryLock({ dir: paths.projectSessions, sessionStore: opts.sessionStore });
+  let ownsRecoveryLock = false;
+  if (recoveryLock) {
+    try {
+      await recoveryLock.write(activeSessionId);
+      ownsRecoveryLock = true;
+    } catch {
+    }
+  }
+  let stopHqBridges = () => {
+  };
+  let closeHqPublisher = () => {
+  };
+  let restartHqBridges = (_sessionId) => {
+  };
+  if (opts.enableHqTelemetry !== false) {
+    try {
+      const core = await import("@wrongstack/core");
+      const publisher = core.createHqPublisherFromEnv({
+        clientKind: "webui",
+        projectRoot: paths.projectRoot,
+        projectName: path15.basename(paths.projectRoot),
+        appConfig: opts.config,
+        socketFactory: (url) => new WebSocket2(url)
+      });
+      if (publisher) {
+        publisher.connect();
+        closeHqPublisher = () => publisher.close();
+        restartHqBridges = (sessionId) => {
+          stopHqBridges();
+          const stops = [];
+          const add = (start) => {
+            try {
+              stops.push(start());
+            } catch {
+            }
+          };
+          add(
+            () => core.startSessionTelemetryBridge({
+              publisher,
+              events,
+              sessionId,
+              projectRoot: paths.projectRoot,
+              projectName: path15.basename(paths.projectRoot),
+              globalRoot: paths.globalRoot,
+              initialAgents: statusTracker.getAgents(),
+              startedAt: (/* @__PURE__ */ new Date()).toISOString()
+            })
+          );
+          add(
+            () => core.startFleetTelemetryBridge({
+              events,
+              publisher,
+              runId: sessionId,
+              sessionId
+            })
+          );
+          add(() => core.startBrainTelemetryBridge({ events, publisher, sessionId }));
+          add(() => core.startWorktreeTelemetryBridge({ events, publisher, sessionId }));
+          add(
+            () => core.startToolTelemetryBridge({
+              events,
+              publisher,
+              projectRoot: paths.projectRoot,
+              sessionId
+            })
+          );
+          add(() => core.startCostTelemetryBridge({ events, publisher, sessionId }));
+          stopHqBridges = () => {
+            for (const stop2 of stops.splice(0)) {
+              try {
+                stop2();
+              } catch {
+              }
+            }
+          };
+        };
+        restartHqBridges(activeSessionId);
+      }
+    } catch (err) {
+      logger.debug?.(`WebUI HQ telemetry unavailable: ${errorMessage2(err)}`);
+    }
+  }
+  const repointRecovery = async (sessionId) => {
+    if (!recoveryLock) return;
+    try {
+      if (ownsRecoveryLock) await recoveryLock.clear();
+      await recoveryLock.write(sessionId);
+      ownsRecoveryLock = true;
+    } catch {
+      ownsRecoveryLock = false;
+    }
+  };
+  const activate = async (sessionId) => {
+    if (stopped || sessionId === activeSessionId) return;
+    transition = transition.then(async () => {
+      if (stopped || sessionId === activeSessionId) return;
+      activeSessionId = sessionId;
+      await register(sessionId);
+      await repointRecovery(sessionId);
+      try {
+        restartHqBridges(sessionId);
+      } catch (err) {
+        logger.debug?.(`WebUI HQ session swap failed: ${errorMessage2(err)}`);
+      }
+    });
+    await transition;
+  };
+  const stop = async () => {
+    if (stopped) return;
+    stopped = true;
+    await transition.catch(() => void 0);
+    statusTracker.stop();
+    stopHqBridges();
+    closeHqPublisher();
+    fleetNotifier.dispose();
+    try {
+      await registry.markClosing();
+      await registry.unregister();
+    } catch {
+    }
+    if (recoveryLock && ownsRecoveryLock) {
+      await recoveryLock.clear().catch(() => void 0);
+      ownsRecoveryLock = false;
+    }
+  };
+  return { statusTracker, activate, stop };
+}
+function errorMessage2(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+
 // src/server/pre-context-services.ts
 var GITHUB_PROVIDERS_OVERLAY_URL = "https://raw.githubusercontent.com/WrongStack/WrongStack/main/packages/cli/data/providers.json";
 async function createPreContextServices(input) {
-  const { config, wpaths, logger, opts, projectRoot, workingDir, needsProvider } = input;
+  const { config, wpaths, logger, opts, vault, projectRoot, workingDir, needsProvider } = input;
   const modelsRegistry = opts.services?.modelsRegistry ?? new DefaultModelsRegistry({
     cacheFile: wpaths.modelsCache,
     ttlSeconds: 0,
@@ -7139,7 +7668,7 @@ async function createPreContextServices(input) {
     await discoverAndMergeWebuiProviders({
       config,
       registry: modelsRegistry,
-      cacheDir: path15.dirname(wpaths.modelsCache),
+      cacheDir: path16.dirname(wpaths.modelsCache),
       logger
     });
   } catch (err) {
@@ -7164,12 +7693,13 @@ async function createPreContextServices(input) {
   })();
   const memoryStore = container.resolve(TOKENS.MemoryStore);
   if (config.features.memory) {
-    toolRegistry.register(rememberTool(memoryStore));
-    toolRegistry.register(forgetTool(memoryStore));
-    toolRegistry.register(searchMemoryTool(memoryStore));
-    toolRegistry.register(relatedMemoryTool(memoryStore));
     if (isSuperMemoryService(memoryStore)) {
       for (const tool of createSuperMemoryTools(memoryStore)) toolRegistry.register(tool);
+    } else {
+      toolRegistry.register(rememberTool(memoryStore));
+      toolRegistry.register(forgetTool(memoryStore));
+      toolRegistry.register(searchMemoryTool(memoryStore));
+      toolRegistry.register(relatedMemoryTool(memoryStore));
     }
   }
   toolRegistry.register(makeMailboxTool({ projectDir: wpaths.projectDir, events }));
@@ -7182,10 +7712,23 @@ async function createPreContextServices(input) {
   configureDangerBypass(config.tools?.exec?.danger ?? {});
   configureChildEnvGitIdentity(config.git?.identity ?? null);
   console.log("[WebUI] Tool registry loaded:", toolRegistry.list().length, "tools");
-  const mcpRegistry = new MCPRegistry({ toolRegistry, events, log: logger, cacheDir: wpaths.cacheDir });
+  const mcpTokenStore = new MCPVaultTokenStore(
+    path16.join(wpaths.projectDir, "mcp-auth.json"),
+    vault
+  );
+  const mcpAuthorizationManager = new MCPAuthorizationManager({ store: mcpTokenStore });
+  const mcpRegistry = new MCPRegistry({
+    toolRegistry,
+    events,
+    log: logger,
+    cacheDir: wpaths.cacheDir,
+    authorizationProviderFactory: createVaultBackedMcpAuthorizationProviderFactory({
+      store: mcpTokenStore
+    }),
+    authorizationManager: mcpAuthorizationManager
+  });
   if (config.features.mcp && config.mcpServers) {
     for (const [name2, cfg] of Object.entries(config.mcpServers)) {
-      if (cfg.enabled === false) continue;
       void mcpRegistry.start({ ...cfg, name: name2 }).catch((err) => {
         logger.warn(`MCP server "${name2}" failed to start at boot`, err);
       });
@@ -7200,7 +7743,7 @@ async function createPreContextServices(input) {
     // surface via the SessionRegistry.
     isSessionInUse: async (sessionId) => {
       try {
-        const registry = getSessionRegistry(wpaths.globalRoot);
+        const registry = getSessionRegistry2(wpaths.globalRoot);
         const live = await registry.listByProject(wpaths.projectSlug);
         const hit = live.find((e) => e.sessionId === sessionId);
         if (hit) {
@@ -7225,155 +7768,57 @@ async function createPreContextServices(input) {
     await input.touchProject(projectRoot, workingDir);
   } catch {
   }
-  let statusTracker;
-  try {
-    const registry = getSessionRegistry(wpaths.globalRoot);
-    await registry.register({
-      sessionId: session.id,
-      projectSlug: wpaths.projectSlug,
+  const sessionIdentity = await createStandaloneSessionIdentityLifecycle({
+    config,
+    events,
+    logger,
+    paths: {
+      globalRoot: wpaths.globalRoot,
       projectRoot,
-      projectName: path15.basename(projectRoot),
-      workingDir,
-      clientType: "webui",
-      pid: process.pid,
-      startedAt: (/* @__PURE__ */ new Date()).toISOString()
-    });
-    const fleetNotifier = new FleetNotifier({ baseDir: wpaths.globalRoot, projectRoot, selfPid: process.pid });
-    statusTracker = new AgentStatusTracker({
-      events,
-      registry,
-      sessionId: () => session.id,
-      onUpdate: () => fleetNotifier.notify()
-    });
-    statusTracker.start();
-    let stopHqSessionBridge;
-    let hqTelemetryPublisher;
-    const stopHqAuxBridges = [];
-    try {
-      const {
-        createHqPublisherFromEnv,
-        startSessionTelemetryBridge,
-        startFleetTelemetryBridge,
-        startBrainTelemetryBridge,
-        startWorktreeTelemetryBridge,
-        startToolTelemetryBridge,
-        startCostTelemetryBridge
-      } = await import("@wrongstack/core");
-      const hqTelemetry = createHqPublisherFromEnv({
-        clientKind: "webui",
-        projectRoot,
-        projectName: path15.basename(projectRoot),
-        appConfig: config,
-        socketFactory: (url) => new WebSocket2(url)
-      });
-      if (hqTelemetry) {
-        hqTelemetry.connect();
-        hqTelemetryPublisher = hqTelemetry;
-        stopHqSessionBridge = startSessionTelemetryBridge({
-          publisher: hqTelemetry,
-          events,
-          sessionId: session.id,
-          projectRoot,
-          projectName: path15.basename(projectRoot),
-          globalRoot: wpaths.globalRoot,
-          initialAgents: statusTracker?.getAgents(),
-          startedAt: (/* @__PURE__ */ new Date()).toISOString()
-        });
-        try {
-          stopHqAuxBridges.push(
-            startFleetTelemetryBridge({ events, publisher: hqTelemetry, runId: session.id, sessionId: session.id })
-          );
-        } catch {
-        }
-        try {
-          stopHqAuxBridges.push(
-            startBrainTelemetryBridge({ events, publisher: hqTelemetry, sessionId: session.id })
-          );
-        } catch {
-        }
-        try {
-          stopHqAuxBridges.push(
-            startWorktreeTelemetryBridge({ events, publisher: hqTelemetry, sessionId: session.id })
-          );
-        } catch {
-        }
-        try {
-          stopHqAuxBridges.push(
-            startToolTelemetryBridge({ events, publisher: hqTelemetry, projectRoot, sessionId: session.id })
-          );
-        } catch {
-        }
-        try {
-          stopHqAuxBridges.push(
-            startCostTelemetryBridge({ events, publisher: hqTelemetry, sessionId: session.id })
-          );
-        } catch {
-        }
-      }
-    } catch {
-    }
-    const stopTracking = async () => {
-      try {
-        fleetNotifier.dispose();
-        await registry.markClosing();
-        statusTracker?.stop();
-        stopHqSessionBridge?.();
-        for (const stop of stopHqAuxBridges) {
-          try {
-            stop();
-          } catch {
-          }
-        }
-        hqTelemetryPublisher?.close();
-      } catch {
-      }
-    };
-    process.once("beforeExit", () => {
-      void stopTracking();
-    });
-    process.once("SIGINT", () => {
-      void stopTracking();
-    });
-    process.once("SIGTERM", () => {
-      void stopTracking();
-    });
-  } catch {
-  }
-  let context;
-  const tokenCounter = new DefaultTokenCounter({
-    registry: modelsRegistry,
-    providerId: config.provider,
-    events,
-    sessionId: () => context?.session?.id ?? session.id
-  });
-  const modeStore = new DefaultModeStore({ directory: wpaths.configDir });
-  const activeMode = await modeStore.getActiveMode();
-  const modeId = activeMode?.id ?? "default";
-  const modePrompt = activeMode?.prompt ?? "";
-  const customModeStore = createCustomModeStore(wpaths.configDir);
-  await customModeStore.load();
-  console.log("[WebUI] Custom context modes loaded:", customModeStore.list().filter((m) => m.custom).length, "custom");
-  const resolvedModel = await resolveProviderModelMetadata(
-    modelsRegistry,
-    config.provider,
-    config.model,
-    config.providers?.[config.provider]
-  );
-  const modelCapabilities = resolvedModel?.capabilities ? { maxContextTokens: resolvedModel.capabilities.maxContext, supportsTools: resolvedModel.capabilities.tools, supportsVision: resolvedModel.capabilities.vision, supportsReasoning: resolvedModel.capabilities.reasoning } : void 0;
-  const modelCapabilitiesRef = { current: modelCapabilities };
-  const skillLoader = config.features.skills ? new DefaultSkillLoader({ paths: wpaths }) : void 0;
-  const skillInstaller = config.features.skills ? new SkillInstaller({
-    manifestPath: path15.join(wpaths.globalRoot, "installed-skills.json"),
-    projectSkillsDir: wpaths.inProjectSkills,
-    globalSkillsDir: wpaths.globalSkills,
-    projectHash: wpaths.projectHash,
-    skillLoader
-  }) : void 0;
-  const promptsEnabled = config.features.prompts !== false;
-  const bundledPromptsDir = promptsEnabled ? (() => {
+      projectSlug: wpaths.projectSlug,
+      projectSessions: wpaths.projectSessions
+    },
+    workingDir,
+    initialSessionId: session.id,
+    sessionStore,
+    manageRecoveryLock: !opts.services?.session
+  });
+  const statusTracker = sessionIdentity.statusTracker;
+  let context;
+  const tokenCounter = new DefaultTokenCounter({
+    registry: modelsRegistry,
+    providerId: config.provider,
+    events,
+    sessionId: () => context?.session?.id ?? session.id
+  });
+  const modeStore = new DefaultModeStore({ directory: wpaths.configDir });
+  const activeMode = await modeStore.getActiveMode();
+  const modeId = activeMode?.id ?? "default";
+  const modePrompt = activeMode?.prompt ?? "";
+  const customModeStore = createCustomModeStore(wpaths.configDir);
+  await customModeStore.load();
+  console.log("[WebUI] Custom context modes loaded:", customModeStore.list().filter((m) => m.custom).length, "custom");
+  const resolvedModel = await resolveProviderModelMetadata(
+    modelsRegistry,
+    config.provider,
+    config.model,
+    config.providers?.[config.provider]
+  );
+  const modelCapabilities = resolvedModel?.capabilities ? { maxContextTokens: resolvedModel.capabilities.maxContext, supportsTools: resolvedModel.capabilities.tools, supportsVision: resolvedModel.capabilities.vision, supportsReasoning: resolvedModel.capabilities.reasoning } : void 0;
+  const modelCapabilitiesRef = { current: modelCapabilities };
+  const skillLoader = config.features.skills ? new DefaultSkillLoader({ paths: wpaths }) : void 0;
+  const skillInstaller = config.features.skills ? new SkillInstaller({
+    manifestPath: path16.join(wpaths.globalRoot, "installed-skills.json"),
+    projectSkillsDir: wpaths.inProjectSkills,
+    globalSkillsDir: wpaths.globalSkills,
+    projectHash: wpaths.projectHash,
+    skillLoader
+  }) : void 0;
+  const promptsEnabled = config.features.prompts !== false;
+  const bundledPromptsDir = promptsEnabled ? (() => {
     try {
       const req = createRequire2(import.meta.url);
-      return path15.join(path15.dirname(req.resolve("@wrongstack/core/package.json")), "data", "prompts");
+      return path16.join(path16.dirname(req.resolve("@wrongstack/core/package.json")), "data", "prompts");
     } catch {
       return void 0;
     }
@@ -7383,6 +7828,9 @@ async function createPreContextServices(input) {
   const promptsCtx = { promptLoader, promptUsage };
   const systemPromptBuilder = new DefaultSystemPromptBuilder({
     memoryStore,
+    // Super Memory's turn middleware is the single memory-injection channel;
+    // don't also inject a static memory section here (avoids double injection).
+    injectMemory: false,
     skillLoader,
     modeStore,
     modeId,
@@ -7425,6 +7873,16 @@ async function createPreContextServices(input) {
   const initialContextPolicy = resolveContextWindowPolicy(config.context);
   context.meta["contextWindowMode"] = initialContextPolicy.id;
   context.meta["contextWindowPolicy"] = initialContextPolicy;
+  context.state.setMeta(
+    "plan.path",
+    sessionScopedPath(wpaths.projectSessions, session.id, ".plan.json")
+  );
+  context.state.setMeta(
+    "task.path",
+    sessionScopedPath(wpaths.projectSessions, session.id, ".tasks.json")
+  );
+  await hydrateSessionKanban(context);
+  attachSessionKanbanMirror(context);
   seedContextMeta(config, context);
   return {
     modelsRegistry,
@@ -7441,6 +7899,7 @@ async function createPreContextServices(input) {
     session,
     sessionStartedAt,
     statusTracker,
+    sessionIdentity,
     tokenCounter,
     modeStore,
     modeId,
@@ -7490,6 +7949,7 @@ function patchConfig(config, updates) {
 }
 
 // src/server/backend-services.ts
+import { join as join13 } from "node:path";
 import {
   Agent,
   AutoCompactionMiddleware as AutoCompactionMiddlewareCtor,
@@ -7503,9 +7963,10 @@ import {
   installDesignStudioMiddleware,
   ObservableBrainArbiter as ObservableBrainArbiterCtor,
   resolveContextWindowPolicy as resolveContextWindowPolicy2,
-  createAutonomyBrain,
-  createTieredBrainArbiter,
-  DefaultBrainArbiter,
+  BrainDecisionLedger,
+  createBrainRuntime,
+  resolveBrainConfigDefaults,
+  EscalationRoutingBrainArbiter,
   GlobalMailbox as GlobalMailbox2,
   mailboxSessionTag,
   SessionMemoryConsolidator,
@@ -7519,12 +7980,13 @@ import { toErrorMessage as toErrorMessage6 } from "@wrongstack/core/utils";
 var REPLAY_LIMIT = 50;
 var PAUSE_TIMEOUT_MS = 6e4;
 var CollaborationWebSocketHandler = class {
-  constructor(events, logger, reader, annotations, bus) {
+  constructor(events, logger, reader, annotations, bus, options = {}) {
     this.events = events;
     this.logger = logger;
     this.reader = reader;
     this.annotations = annotations;
     this.bus = bus;
+    this.options = options;
     this.subscribe();
     this.bus?.onInjectionConsumed((info) => this.broadcastInjectionConsumed(info));
   }
@@ -7533,6 +7995,7 @@ var CollaborationWebSocketHandler = class {
   reader;
   annotations;
   bus;
+  options;
   clients = /* @__PURE__ */ new Set();
   /** sessionId → participants currently watching it. */
   bySession = /* @__PURE__ */ new Map();
@@ -7560,11 +8023,16 @@ var CollaborationWebSocketHandler = class {
   handleMessage(ws, msg) {
     if (msg.type === "collab.join") {
       const payload = msg.payload;
-      if (!payload?.sessionId) {
+      if (typeof payload?.sessionId !== "string" || payload.sessionId.trim().length === 0) {
         this.send(ws, this.errorMessage("collab.join requires sessionId"));
         return true;
       }
-      this.join(ws, payload.sessionId, payload.role ?? "observer");
+      const role = payload.role ?? "observer";
+      if (role !== "observer" && role !== "annotator" && role !== "controller") {
+        this.send(ws, this.errorMessage(`unknown collaboration role '${String(role)}'`));
+        return true;
+      }
+      this.join(ws, payload.sessionId, role);
       return true;
     }
     if (msg.type === "collab.leave") {
@@ -7599,6 +8067,20 @@ var CollaborationWebSocketHandler = class {
   }
   // ── Join / leave flow ──────────────────────────────────────────────────
   join(ws, sessionId, role) {
+    const activeSessionId = this.options.getActiveSessionId?.();
+    if (activeSessionId !== void 0 && sessionId !== activeSessionId) {
+      this.send(
+        ws,
+        this.errorMessage(
+          `collab.join sessionId mismatch (active: ${activeSessionId})`
+        )
+      );
+      return;
+    }
+    if (this.findParticipant(ws)) {
+      this.send(ws, this.errorMessage("collab.join requires leaving the current session first"));
+      return;
+    }
     if (role === "controller" && !this.bus) {
       this.send(
         ws,
@@ -7617,6 +8099,13 @@ var CollaborationWebSocketHandler = class {
       );
       return;
     }
+    if (role !== "observer" && this.options.authorizeRole?.({ ws, sessionId, requestedRole: role }) !== true) {
+      this.send(
+        ws,
+        this.errorMessage(`role '${role}' requires explicit server authorization`)
+      );
+      return;
+    }
     const participant = {
       participantId: randomUUID(),
       ws,
@@ -7870,17 +8359,13 @@ var CollaborationWebSocketHandler = class {
       type: "collab.event",
       payload: { kind, payload, at: (/* @__PURE__ */ new Date()).toISOString() }
     };
-    const data = JSON.stringify(msg);
-    for (const bucket of this.bySession.values()) {
-      for (const p of bucket) {
-        try {
-          if (p.ws.readyState === 1) p.ws.send(data);
-        } catch (err) {
-          this.logger.debug?.(
-            `collab broadcast failed: ${toErrorMessage6(err)}`
-          );
-        }
-      }
+    const activeSessionId = this.options.getActiveSessionId?.();
+    if (activeSessionId !== void 0) {
+      this.broadcast(activeSessionId, msg);
+      return;
+    }
+    for (const sessionId of this.bySession.keys()) {
+      this.broadcast(sessionId, msg);
     }
   }
   /**
@@ -8204,7 +8689,8 @@ var CollaborationWebSocketHandler = class {
    * Bus callback: a queued injection was spliced into a real tool call. Re-emit
    * `collab.injection.granted` with phase `'consumed'` and the now-known tool
    * name. The injection carries no sessionId, so resolve it from the author's
-   * current session; if they've already left, fall back to every live session.
+   * current participant. If the author has left, fail closed rather than leak
+   * the payload to unrelated sessions.
    */
   broadcastInjectionConsumed(info) {
     let sessionId = null;
@@ -8233,14 +8719,16 @@ var CollaborationWebSocketHandler = class {
     if (sessionId) {
       this.broadcast(sessionId, message(sessionId));
     } else {
-      for (const sid of this.bySession.keys()) this.broadcast(sid, message(sid));
+      this.logger.debug?.(
+        `collab: consumed injection ${info.toolUseId} has no live author; broadcast suppressed`
+      );
     }
   }
 };
 
 // src/server/codebase-indexing.ts
 import * as fs12 from "node:fs";
-import * as path16 from "node:path";
+import * as path17 from "node:path";
 import {
   cancelPendingReindexes,
   enqueueReindex,
@@ -8293,7 +8781,7 @@ function setupWebUICodebaseIndexing(deps2) {
         if (!filename) return;
         const rel = filename.toString();
         if (isIgnored(rel)) return;
-        const abs = path16.resolve(deps2.projectRoot, rel);
+        const abs = path17.resolve(deps2.projectRoot, rel);
         enqueueFile(abs);
       });
       watcher.on("error", (err) => deps2.logger.debug(`webui codebase index watcher error: ${err}`));
@@ -8306,7 +8794,7 @@ function setupWebUICodebaseIndexing(deps2) {
   }
   function enqueueFile(filePath) {
     if (!idx.onEdit && !idx.watchExternal) return;
-    const abs = path16.isAbsolute(filePath) ? path16.normalize(filePath) : path16.resolve(deps2.projectRoot, filePath);
+    const abs = path17.isAbsolute(filePath) ? path17.normalize(filePath) : path17.resolve(deps2.projectRoot, filePath);
     if (!isInside2(deps2.projectRoot, abs) || !isIndexableFile(abs)) return;
     enqueueReindex({
       projectRoot: deps2.projectRoot,
@@ -8343,9 +8831,9 @@ function isIgnored(rel) {
   return rel.split(/[/\\]/).some((seg) => IGNORE_DIRS.has(seg));
 }
 function isInside2(root, target) {
-  const normalizedRoot = path16.resolve(root);
-  const normalizedTarget = path16.resolve(target);
-  return normalizedTarget === normalizedRoot || normalizedTarget.startsWith(normalizedRoot + path16.sep);
+  const normalizedRoot = path17.resolve(root);
+  const normalizedTarget = path17.resolve(target);
+  return normalizedTarget === normalizedRoot || normalizedTarget.startsWith(normalizedRoot + path17.sep);
 }
 
 // src/server/discover-mailbox-bridge.ts
@@ -8878,21 +9366,59 @@ async function createAgentServices(input) {
     agent.extensions.register(new SessionMemoryConsolidator({ memoryStore }));
   }
   console.log("[WebUI] Agent initialized");
-  const brainSettings = { maxAutoRisk: "medium" };
-  const autonomousBrain = {
-    decide: (request) => createAutonomyBrain({
-      provider,
-      model: context.model,
-      maxAutoRisk: "all"
-      // the tiered ceiling gates risk — keep inner permissive
-    }).decide(request)
+  const brainCfg = resolveBrainConfigDefaults(config.brain, {
+    fallbackModels: config.fallbackModels
+  });
+  const brainLedgerPath = join13(wpaths.projectDir, "brain-ledger.jsonl");
+  let brainLedgerEnabled = brainCfg.ledger?.enabled !== false;
+  let brainLedger;
+  const startBrainLedger = () => {
+    if (brainLedger) return;
+    brainLedger = new BrainDecisionLedger({ events, filePath: brainLedgerPath });
+    void brainLedger.start();
+  };
+  if (brainLedgerEnabled) startBrainLedger();
+  const brainRuntime = createBrainRuntime({
+    initialConfig: brainCfg,
+    defaultProviderId: config.provider,
+    sessionProvider: () => provider,
+    sessionModel: () => context.model,
+    resolveProvider: (providerId) => {
+      const savedCfg = config.providers?.[providerId] ?? {};
+      return providerRegistry.create({
+        ...savedCfg,
+        apiKey: savedCfg.apiKey ?? config.apiKey,
+        baseUrl: savedCfg.baseUrl ?? config.baseUrl,
+        type: providerId
+      });
+    },
+    ledger: {
+      getPath: () => brainLedgerEnabled ? brainLedgerPath : void 0,
+      isEnabled: () => brainLedgerEnabled,
+      setEnabled: (on) => {
+        brainLedgerEnabled = on;
+        if (on) {
+          startBrainLedger();
+        } else {
+          void brainLedger?.stop();
+          brainLedger = void 0;
+        }
+      },
+      failureStreakFor: (request) => brainLedger?.failureStreakFor(request) ?? 0,
+      getDecisionDigest: (request) => brainLedger?.digestFor(request)
+    },
+    persist: input.persistBrainConfig
+  });
+  const brainSettings = {
+    get maxAutoRisk() {
+      return brainRuntime.getMaxAutoRisk();
+    },
+    set maxAutoRisk(level) {
+      void brainRuntime.apply({ maxAutoRisk: level }).persisted;
+    }
   };
   const brain = new ObservableBrainArbiterCtor(
-    createTieredBrainArbiter({
-      policy: new DefaultBrainArbiter(),
-      autonomous: autonomousBrain,
-      getMaxAutoRisk: () => brainSettings.maxAutoRisk
-    }),
+    new EscalationRoutingBrainArbiter(brainRuntime.arbiter, void 0, () => "headless"),
     events
   );
   container.bind(TOKENS2.BrainArbiter, () => brain);
@@ -8932,6 +9458,12 @@ async function createAgentServices(input) {
   const brainMonitor = new BrainMonitor({
     events,
     brain,
+    toolFailureStreak: brainCfg.monitor?.toolFailureStreak,
+    errorStormCount: brainCfg.monitor?.errorStormCount,
+    stallMs: brainCfg.monitor?.stallMs,
+    fileChurnThreshold: brainCfg.monitor?.fileChurnThreshold,
+    fileChurnWindowMs: brainCfg.monitor?.fileChurnWindowMs,
+    cooldownMs: brainCfg.monitor?.cooldownMs,
     sessionId: () => context.session?.id,
     intervene: async ({ subject, body }) => {
       const tag = mailboxSessionTag(input.sessionGetter().id);
@@ -8996,7 +9528,10 @@ async function createAgentServices(input) {
     logger,
     input.sessionReader,
     input.annotationsStore,
-    collabBus
+    collabBus,
+    {
+      getActiveSessionId: () => context.session.id
+    }
   );
   return {
     collabBus,
@@ -9008,8 +9543,13 @@ async function createAgentServices(input) {
     pipelines,
     brain,
     brainSettings,
+    brainRuntime,
     brainLog,
     brainMonitor,
+    // Getter: ledger toggles swap the instance, shutdown must stop the LIVE one.
+    get brainLedger() {
+      return brainLedger;
+    },
     codebaseIndexing,
     autoPhaseHandler,
     specsHandler,
@@ -9185,7 +9725,18 @@ function createConnectionHandler(opts) {
 }
 
 // src/server/message-dispatcher.ts
-import path17 from "node:path";
+import path18 from "node:path";
+import {
+  buildUserContentBlocks,
+  IncomingImageError,
+  parseIncomingImages
+} from "@wrongstack/core/utils";
+import {
+  createToolVisionAdapters,
+  ImageInputUnsupportedError,
+  routeImagesForModel,
+  VisionUrlBlockedError
+} from "@wrongstack/runtime/vision";
 
 // src/server/autophase-routes.ts
 async function handleAutoPhaseRoute(_ws, msg, handlers) {
@@ -9206,6 +9757,12 @@ async function handleBrainRoute(ws, msg, handlers) {
     case "brain.ask":
       await handlers.ask(ws, msg);
       return true;
+    case "brain.config.get":
+      await handlers.configGet(ws, msg);
+      return true;
+    case "brain.config.set":
+      await handlers.configSet(ws, msg);
+      return true;
     default:
       return false;
   }
@@ -9459,8 +10016,10 @@ import {
   serializeTaskGraph
 } from "@wrongstack/core";
 import {
+  addCheckToTask,
   addColumn,
   addGoalMetricToTask,
+  addNoteToTask,
   addTask,
   assignTask,
   claimReadyTask,
@@ -9474,29 +10033,47 @@ import {
   getKanbanQueueHealth,
   getTask,
   getTaskChain,
-  listReadyTasks,
   listBoards,
+  listReadyTasks,
   mergeTasks,
   moveTask,
   parseLinesIntoTasks,
+  reconcileKanbanBoard,
+  recoverStaleTaskAssignments,
+  releaseTaskClaim,
   removeBoard,
   removeColumn,
   removeTask,
-  releaseTaskClaim,
   setTaskChain,
   splitTask,
   syncBoardFromTaskGraph,
   transferTaskToBoard,
   updateBoard,
+  updateCheckOnTask,
   updateGoalMetricOnTask,
   updateTask
 } from "@wrongstack/kanban";
+import { applySessionKanbanTaskToSource } from "@wrongstack/tools/session-kanban";
+async function syncSessionSource(ctx, task, remove = false) {
+  if (!ctx.context) return;
+  const update = await applySessionKanbanTaskToSource(ctx.context, task, { remove });
+  const sessionId = ctx.context.session?.id ?? "";
+  if (update.todos)
+    ctx.broadcast?.({ type: "todos.updated", payload: { sessionId, todos: update.todos } });
+  if (update.tasks)
+    ctx.broadcast?.({ type: "tasks.updated", payload: { sessionId, tasks: update.tasks.tasks } });
+  if (update.plan)
+    ctx.broadcast?.({ type: "plan.updated", payload: { sessionId, plan: update.plan } });
+}
 function ok(ws, type, data) {
   send(ws, { type, payload: { success: true, data: data ?? null } });
 }
 function fail(ws, type, message) {
   send(ws, { type, payload: { success: false, error: message } });
 }
+function has(payload, key) {
+  return payload !== void 0 && Object.hasOwn(payload, key);
+}
 async function handleKanbanRoute(ws, msg, ctx) {
   if (!msg.type.startsWith("kanban.")) return false;
   const payload = msg.payload;
@@ -9525,6 +10102,38 @@ async function handleKanbanRoute(ws, msg, ctx) {
         ok(ws, type, await getKanbanQueueHealth(ctx.projectRoot, { boardId: hBoardId }));
         return true;
       }
+      case "kanban.supervisor.status":
+      case "kanban.supervisor.audit": {
+        const boardId = payload?.boardId;
+        if (!boardId) {
+          fail(ws, type, "boardId required");
+          return true;
+        }
+        const board = await getBoard(ctx.projectRoot, boardId);
+        if (!board) {
+          fail(ws, type, `Board not found: ${boardId}`);
+          return true;
+        }
+        const reconciled = await reconcileKanbanBoard(ctx.projectRoot, boardId);
+        let health = await getKanbanQueueHealth(ctx.projectRoot, { boardId });
+        const recovered = health.staleAssignments.count ? await recoverStaleTaskAssignments(ctx.projectRoot, boardId, {
+          mode: board.supervisor?.recoveryMode ?? "auto",
+          reason: "On-demand standalone Kanban supervisor audit."
+        }) : null;
+        if (recovered) health = await getKanbanQueueHealth(ctx.projectRoot, { boardId });
+        const anomalyCount = health.staleAssignments.count + health.dependencyBlocked.count + health.failedRetryable.count + health.counts.failed + health.counts.blocked;
+        ok(ws, type, {
+          boardId,
+          status: board.supervisor?.enabled === false ? "disabled" : anomalyCount ? "attention" : "healthy",
+          mode: board.supervisor?.mode ?? "deterministic",
+          lastAuditAt: (/* @__PURE__ */ new Date()).toISOString(),
+          reconciledTaskIds: reconciled?.tasks.map((task) => task.id) ?? [],
+          staleRecoveredTaskIds: recovered?.tasks.map((task) => task.id) ?? [],
+          anomalyCount,
+          summary: `${health.counts.running} running \xB7 ${health.counts.ready} ready \xB7 ${health.counts.review} review \xB7 ${health.counts.blocked} blocked \xB7 ${health.counts.failed} failed`
+        });
+        return true;
+      }
       case "kanban.create": {
         const title = payload?.title;
         if (!title) {
@@ -9553,7 +10162,10 @@ async function handleKanbanRoute(ws, msg, ctx) {
           ...payload?.title ? { title: payload.title } : {},
           ...payload?.description ? { description: payload.description } : {},
           ...payload?.tags ? { tags: payload.tags } : {},
-          ...payload?.columns ? { columns: payload.columns } : {}
+          ...payload?.columns ? { columns: payload.columns } : {},
+          ...has(payload, "supervisor") ? {
+            supervisor: payload?.supervisor ?? null
+          } : {}
         });
         board ? ok(ws, type, board) : fail(ws, type, `Board not found: ${boardId}`);
         return true;
@@ -9580,6 +10192,11 @@ async function handleKanbanRoute(ws, msg, ctx) {
           return true;
         }
         const board = await getBoard(ctx.projectRoot, boardId);
+        const activeSessionId = ctx.context?.session?.id;
+        if (activeSessionId && board?.tags?.includes(`session:${activeSessionId}`)) {
+          fail(ws, type, "The active session Kanban board cannot be deleted.");
+          return true;
+        }
         ok(ws, type, {
           removed: board ? await removeBoard(ctx.projectRoot, board.id) : false,
           boardId: board?.id ?? boardId
@@ -9760,15 +10377,31 @@ async function handleKanbanRoute(ws, msg, ctx) {
           return true;
         }
         const board = await updateTask(ctx.projectRoot, boardId, taskId, {
-          ...payload?.title ? { title: payload.title } : {},
-          ...payload?.description ? { description: payload.description } : {},
-          ...payload?.columnId ? { columnId: payload.columnId } : {},
-          ...payload?.priority ? { priority: payload.priority } : {},
-          ...payload?.status ? { status: payload.status } : {},
-          ...payload?.assignedAgent ? { assignedAgent: payload.assignedAgent } : {},
-          ...payload?.labels ? { labels: payload.labels } : {}
+          ...has(payload, "title") ? { title: payload?.title } : {},
+          ...has(payload, "description") ? { description: payload?.description ?? "" } : {},
+          ...has(payload, "columnId") ? { columnId: payload?.columnId } : {},
+          ...has(payload, "priority") ? { priority: payload?.priority } : {},
+          ...has(payload, "type") ? { type: payload?.type } : {},
+          ...has(payload, "status") ? { status: payload?.status } : {},
+          ...has(payload, "dependsOn") ? { dependsOn: payload?.dependsOn ?? [] } : {},
+          ...has(payload, "chain") ? { chain: payload?.chain ?? null } : {},
+          ...has(payload, "labels") ? { labels: payload?.labels ?? [] } : {},
+          ...has(payload, "estimatedHours") ? { estimatedHours: Number(payload?.estimatedHours ?? 0) } : {},
+          ...has(payload, "actualHours") ? { actualHours: Number(payload?.actualHours ?? 0) } : {},
+          ...has(payload, "retryPolicy") ? {
+            retryPolicy: payload?.retryPolicy ?? null
+          } : {},
+          ...has(payload, "costCeilingUsd") ? {
+            costCeilingUsd: payload?.costCeilingUsd === null || payload?.costCeilingUsd === "" ? null : Number(payload?.costCeilingUsd)
+          } : {}
         });
-        board ? ok(ws, type, findTask(board.tasks, taskId)) : fail(ws, type, "Board or task not found");
+        if (!board) {
+          fail(ws, type, "Board or task not found");
+          return true;
+        }
+        const task = findTask(board.tasks, taskId);
+        if (task) await syncSessionSource(ctx, task);
+        ok(ws, type, task);
         return true;
       }
       case "kanban.task.move": {
@@ -9786,7 +10419,13 @@ async function handleKanbanRoute(ws, msg, ctx) {
           columnId,
           payload?.order
         );
-        board ? ok(ws, type, findTask(board.tasks, taskId)) : fail(ws, type, "Move failed");
+        if (!board) {
+          fail(ws, type, "Move failed");
+          return true;
+        }
+        const task = findTask(board.tasks, taskId);
+        if (task) await syncSessionSource(ctx, task);
+        ok(ws, type, task);
         return true;
       }
       case "kanban.task.copy":
@@ -9845,8 +10484,10 @@ async function handleKanbanRoute(ws, msg, ctx) {
           ...payload?.role ? { role: payload.role } : {},
           ...payload?.provider ? { provider: payload.provider } : {},
           ...payload?.model ? { model: payload.model } : {},
+          ...payload?.modelRouting ? { modelRouting: payload.modelRouting } : {},
           ...payload?.fallbackProfile ? { fallbackProfile: payload.fallbackProfile } : {},
           ...payload?.fallbackModels ? { fallbackModels: payload.fallbackModels } : {},
+          ...payload?.skills ? { skills: payload.skills } : {},
           ...payload?.tools ? { tools: payload.tools } : {},
           ...payload?.allowedCapabilities ? { allowedCapabilities: payload.allowedCapabilities } : {},
           ...payload?.assignee ? { assignee: payload.assignee } : {},
@@ -9865,7 +10506,10 @@ async function handleKanbanRoute(ws, msg, ctx) {
         const board = await releaseTaskClaim(ctx.projectRoot, boardId, taskId, {
           ...payload?.status ? { status: payload.status } : {},
           ...payload?.reason ? { reason: payload.reason } : {},
-          ...typeof payload?.clearAssignee === "boolean" ? { clearAssignee: payload.clearAssignee } : {}
+          ...typeof payload?.clearAssignee === "boolean" ? { clearAssignee: payload.clearAssignee } : {},
+          ...typeof payload?.maxAttempts === "number" ? { maxAttempts: payload.maxAttempts } : {},
+          ...typeof payload?.costCeilingUsd === "number" ? { costCeilingUsd: payload.costCeilingUsd } : {},
+          ...payload?.retryPolicy ? { retryPolicy: payload.retryPolicy } : {}
         });
         board ? ok(ws, type, board) : fail(ws, type, "Board or task not found");
         return true;
@@ -9921,14 +10565,66 @@ async function handleKanbanRoute(ws, msg, ctx) {
           ...payload?.role ? { role: payload.role } : {},
           ...payload?.provider ? { provider: payload.provider } : {},
           ...payload?.model ? { model: payload.model } : {},
+          ...payload?.modelRouting ? { modelRouting: payload.modelRouting } : {},
           ...payload?.fallbackProfile ? { fallbackProfile: payload.fallbackProfile } : {},
           ...payload?.fallbackModels ? { fallbackModels: payload.fallbackModels } : {},
+          ...payload?.skills ? { skills: payload.skills } : {},
           ...payload?.tools ? { tools: payload.tools } : {},
-          ...payload?.allowedCapabilities ? { allowedCapabilities: payload.allowedCapabilities } : {}
+          ...payload?.allowedCapabilities ? { allowedCapabilities: payload.allowedCapabilities } : {},
+          ...payload?.assignee ? { assignee: payload.assignee } : {},
+          ...payload?.maxAttempts !== void 0 ? { maxAttempts: Number(payload.maxAttempts) } : {},
+          ...payload?.costCeilingUsd !== void 0 ? { costCeilingUsd: Number(payload.costCeilingUsd) } : {},
+          ...payload?.retryPolicy ? { retryPolicy: payload.retryPolicy } : {}
         });
         board ? ok(ws, type, findTask(board.tasks, taskId)) : fail(ws, type, "Board or task not found");
         return true;
       }
+      case "kanban.task.check.add": {
+        const boardId = payload?.boardId;
+        const taskId = payload?.taskId;
+        const description = payload?.description;
+        if (!boardId || !taskId || !description) {
+          fail(ws, type, "boardId, taskId, and description required");
+          return true;
+        }
+        const board = await addCheckToTask(ctx.projectRoot, boardId, taskId, {
+          description,
+          type: payload?.checkType ?? "manual",
+          status: payload?.status ?? "pending"
+        });
+        board ? ok(ws, type, board) : fail(ws, type, "Board or task not found");
+        return true;
+      }
+      case "kanban.task.check.update": {
+        const boardId = payload?.boardId;
+        const taskId = payload?.taskId;
+        const checkId = payload?.checkId;
+        if (!boardId || !taskId || !checkId) {
+          fail(ws, type, "boardId, taskId, and checkId required");
+          return true;
+        }
+        const board = await updateCheckOnTask(ctx.projectRoot, boardId, taskId, checkId, {
+          ...has(payload, "status") ? { status: payload?.status } : {}
+        });
+        if (!board) fail(ws, type, "Check not found");
+        else ok(ws, type, (await reconcileKanbanBoard(ctx.projectRoot, boardId))?.board ?? board);
+        return true;
+      }
+      case "kanban.task.note.add": {
+        const boardId = payload?.boardId;
+        const taskId = payload?.taskId;
+        const content = payload?.content;
+        if (!boardId || !taskId || !content) {
+          fail(ws, type, "boardId, taskId, and content required");
+          return true;
+        }
+        const board = await addNoteToTask(ctx.projectRoot, boardId, taskId, {
+          author: payload?.author ?? "webui",
+          content
+        });
+        board ? ok(ws, type, board) : fail(ws, type, "Board or task not found");
+        return true;
+      }
       case "kanban.task.dispatch":
         fail(
           ws,
@@ -9936,6 +10632,9 @@ async function handleKanbanRoute(ws, msg, ctx) {
           "Kanban agent dispatch is only available from the CLI-hosted WebUI runtime."
         );
         return true;
+      case "kanban.capabilities":
+        ok(ws, type, { dispatchSupported: false });
+        return true;
       case "kanban.task.remove": {
         const boardId = payload?.boardId;
         const taskId = payload?.taskId;
@@ -9949,7 +10648,12 @@ async function handleKanbanRoute(ws, msg, ctx) {
           return true;
         }
         const board = await removeTask(ctx.projectRoot, boardId, taskId);
-        board ? ok(ws, type, { removed: true, boardId: board.id, taskId: task.id, board }) : fail(ws, type, "Board or task not found");
+        if (!board) {
+          fail(ws, type, "Board or task not found");
+          return true;
+        }
+        await syncSessionSource(ctx, task, true);
+        ok(ws, type, { removed: true, boardId: board.id, taskId: task.id, board });
         return true;
       }
       case "kanban.task.get": {
@@ -10015,6 +10719,9 @@ async function handleMailboxRoute(ws, msg, handlers) {
     case "mailbox.purge":
       await handlers.purge(ws, msg);
       return true;
+    case "mailbox.compact":
+      await handlers.compact(ws, msg);
+      return true;
     default:
       return false;
   }
@@ -10053,6 +10760,18 @@ async function handleMcpRoute(ws, msg, handlers) {
     case "mcp.discover":
       await handlers.discover(ws, msg);
       return true;
+    case "mcp.resources":
+      await handlers.resources(ws, msg);
+      return true;
+    case "mcp.prompts":
+      await handlers.prompts(ws, msg);
+      return true;
+    case "mcp.resource.read":
+      await handlers.resourceRead(ws, msg);
+      return true;
+    case "mcp.prompt.get":
+      await handlers.promptGet(ws, msg);
+      return true;
     default:
       return false;
   }
@@ -10246,6 +10965,7 @@ async function handleProviderRoute(ws, msg, routes) {
         baseUrl,
         apiKey
       });
+      await routes.adoptDefaultProviderIfUnset(id);
       return true;
     }
     case "provider.remove": {
@@ -10442,7 +11162,7 @@ function createMessageDispatcher(opts) {
       skillLoader: deps2.skillLoader,
       skillInstaller: deps2.skillInstaller,
       projectRoot,
-      projectSkillsDir: path17.join(projectRoot, ".wrongstack", "skills"),
+      projectSkillsDir: path18.join(projectRoot, ".wrongstack", "skills"),
       globalSkillsDir: deps2.wpaths.globalSkills
     };
   }
@@ -10484,7 +11204,12 @@ function createMessageDispatcher(opts) {
     if (await handleSpecsRoute(ws, msg, routes.specsRoutes)) return;
     if (await handleSddBoardRoute(ws, msg, routes.sddBoardRoutes)) return;
     if (await handleSddWizardRoute(ws, msg, routes.sddWizardRoutes)) return;
-    if (await handleKanbanRoute(ws, msg, { projectRoot: state.getProjectRoot() })) return;
+    if (await handleKanbanRoute(ws, msg, {
+      projectRoot: state.getProjectRoot(),
+      context: deps2.context,
+      broadcast: (message) => broadcast(state.getClients(), message)
+    }))
+      return;
     if (msg.type.startsWith("worktree.") && await deps2.worktreeHandler.handleMessage(
       msg
     ))
@@ -10515,7 +11240,8 @@ function createMessageDispatcher(opts) {
       }
       case "user_message": {
         if (!ensureCurrentSession(ws, msg, "user_message")) return;
-        const content = msg.payload.content;
+        const userPayload = msg.payload;
+        const content = userPayload.content;
         if (runLock.get()) {
           send(ws, {
             type: "error",
@@ -10529,8 +11255,21 @@ function createMessageDispatcher(opts) {
         const thisRun = new AbortController();
         runLock.set(thisRun);
         try {
+          let input = content;
+          const imageBlocks = parseIncomingImages(userPayload.images, userPayload.imageBase64);
+          if (imageBlocks.length > 0) {
+            const routed = await routeImagesForModel(buildUserContentBlocks(content, imageBlocks), {
+              supportsVision: deps2.agent.ctx.provider.capabilities.vision,
+              adapters: () => createToolVisionAdapters(deps2.agent.tools),
+              ctx: deps2.agent.ctx,
+              signal: thisRun.signal,
+              providerId: deps2.agent.ctx.provider.id,
+              model: deps2.agent.ctx.model
+            });
+            input = routed.blocks;
+          }
           const maxIt = typeof deps2.context.meta["maxIterations"] === "number" ? deps2.context.meta["maxIterations"] : void 0;
-          const result = await deps2.agent.run(content, {
+          const result = await deps2.agent.run(input, {
             signal: thisRun.signal,
             maxIterations: maxIt
           });
@@ -10548,13 +11287,24 @@ function createMessageDispatcher(opts) {
             })
           });
         } catch (err) {
-          send(ws, {
-            type: "error",
-            payload: sessionPayload2({
-              phase: "agent.run",
-              message: errMessage(err)
-            })
-          });
+          if (err instanceof IncomingImageError || err instanceof ImageInputUnsupportedError || err instanceof VisionUrlBlockedError) {
+            send(ws, {
+              type: "error",
+              payload: sessionPayload2({
+                phase: "user_message",
+                ...err instanceof ImageInputUnsupportedError ? { code: "vision_unsupported" } : {},
+                message: err.message
+              })
+            });
+          } else {
+            send(ws, {
+              type: "error",
+              payload: sessionPayload2({
+                phase: "agent.run",
+                message: errMessage(err)
+              })
+            });
+          }
         } finally {
           if (runLock.get() === thisRun) {
             runLock.set(null);
@@ -10602,7 +11352,7 @@ function createMessageDispatcher(opts) {
         break;
       }
       case "tool.disable": {
-        const name2 = (msg.payload ?? {}).name;
+        const name2 = msg.payload?.name;
         if (!name2) {
           send(ws, { type: "error", payload: { message: "tool.disable requires a name" } });
           break;
@@ -10611,13 +11361,15 @@ function createMessageDispatcher(opts) {
         const currentCfg = deps2.configStore.get().tools ?? {};
         const currentDisabled = currentCfg.disabledTools ?? [];
         if (ok2 && !currentDisabled.includes(name2)) {
-          deps2.configStore.update({ tools: { ...currentCfg, disabledTools: [...currentDisabled, name2] } });
+          deps2.configStore.update({
+            tools: { ...currentCfg, disabledTools: [...currentDisabled, name2] }
+          });
         }
         send(ws, { type: "tool.disabled", payload: { name: name2, ok: ok2 } });
         break;
       }
       case "tool.enable": {
-        const name2 = (msg.payload ?? {}).name;
+        const name2 = msg.payload?.name;
         if (!name2) {
           send(ws, { type: "error", payload: { message: "tool.enable requires a name" } });
           break;
@@ -10627,19 +11379,31 @@ function createMessageDispatcher(opts) {
           const currentCfg = deps2.configStore.get().tools ?? {};
           const currentDisabled = currentCfg.disabledTools ?? [];
           deps2.configStore.update({
-            tools: { ...currentCfg, disabledTools: currentDisabled.filter((n) => n !== name2) }
+            tools: {
+              ...currentCfg,
+              disabledTools: currentDisabled.filter((n) => n !== name2)
+            }
           });
         }
         send(ws, { type: "tool.enabled", payload: { name: name2, ok: ok2 } });
         break;
       }
       // ── Memory operations — delegated to shared handlers (memory-handlers.ts) ──
+      // `memory.list` renders the single Super Memory store; all writes go
+      // through the structured `memory.super.*` operations below.
       case "memory.list":
         return handleMemoryList(ws, deps2.memoryStore);
-      case "memory.remember":
-        return handleMemoryRemember(ws, msg, deps2.memoryStore);
-      case "memory.forget":
-        return handleMemoryForget(ws, msg, deps2.memoryStore);
+      // ── SuperMemory operations ──
+      case "memory.super.list":
+        return handleSuperMemoryList(ws, deps2.memoryStore);
+      case "memory.super.get":
+        return handleSuperMemoryGet(ws, msg, deps2.memoryStore);
+      case "memory.super.update":
+        return handleSuperMemoryUpdate(ws, msg, deps2.memoryStore);
+      case "memory.super.delete":
+        return handleSuperMemoryDelete(ws, msg, deps2.memoryStore);
+      case "memory.super.remember":
+        return handleSuperMemoryRemember(ws, msg, deps2.memoryStore);
       // ── MCP tripwires — handleMcpRoute claims these upstream. ──
       case "mcp.list":
         throw new Error("handleMcpRoute did not claim mcp.list \u2014 check chain order");
@@ -10661,6 +11425,14 @@ function createMessageDispatcher(opts) {
         throw new Error("handleMcpRoute did not claim mcp.restart \u2014 check chain order");
       case "mcp.discover":
         throw new Error("handleMcpRoute did not claim mcp.discover \u2014 check chain order");
+      case "mcp.resources":
+        throw new Error("handleMcpRoute did not claim mcp.resources \u2014 check chain order");
+      case "mcp.prompts":
+        throw new Error("handleMcpRoute did not claim mcp.prompts \u2014 check chain order");
+      case "mcp.resource.read":
+        throw new Error("handleMcpRoute did not claim mcp.resource.read \u2014 check chain order");
+      case "mcp.prompt.get":
+        throw new Error("handleMcpRoute did not claim mcp.prompt.get \u2014 check chain order");
       // Skills — full request→response cycle lives in skills-handlers.ts.
       case "skills.list":
         await handleSkillsList(ws, makeSkillsContext());
@@ -10961,7 +11733,20 @@ var PREF_KEYS = [
   "favoriteModels",
   "favoriteModelsOnly",
   "modelMatrix",
-  "fallbackAuto"
+  "fallbackAuto",
+  // Refiner + TUI visual prefs (parity with the CLI's embedded server —
+  // these were browser-editable there but rejected as unknown keys here).
+  "refinerProvider",
+  "refinerModel",
+  "refinerFallbackProfile",
+  "thinkingWord",
+  "statuslineMode",
+  "animationStyle",
+  // Safety / system prefs (parity with /settings breaker, fs-access, debug-stream).
+  "breakerEnabled",
+  "breakerAutoKillResetMs",
+  "fsAccess",
+  "debugStream"
 ];
 function prefSnapshot(contextMeta) {
   const snapshot = {};
@@ -11032,6 +11817,18 @@ async function persistPrefsToConfig(deps2, holder, payload) {
       setAutonomy("enhanceDelayMs", payload["enhanceDelayMs"]);
     if (typeof payload["enhanceLanguage"] === "string")
       setAutonomy("enhanceLanguage", payload["enhanceLanguage"]);
+    if (typeof payload["refinerProvider"] === "string")
+      setAutonomy("refinerProvider", payload["refinerProvider"]);
+    if (typeof payload["refinerModel"] === "string")
+      setAutonomy("refinerModel", payload["refinerModel"]);
+    if (typeof payload["refinerFallbackProfile"] === "string")
+      setAutonomy("refinerFallbackProfile", payload["refinerFallbackProfile"]);
+    if (typeof payload["thinkingWord"] === "string")
+      setAutonomy("thinkingWord", payload["thinkingWord"]);
+    if (typeof payload["statuslineMode"] === "string")
+      setAutonomy("statuslineMode", payload["statuslineMode"]);
+    if (typeof payload["animationStyle"] === "string")
+      setAutonomy("animationStyle", payload["animationStyle"]);
     if (autonomyTouched) decrypted.autonomy = autonomyCfg;
     if (typeof payload["nextPrediction"] === "boolean")
       decrypted.nextPrediction = payload["nextPrediction"];
@@ -11149,16 +11946,34 @@ async function persistPrefsToConfig(deps2, holder, payload) {
       }
       decrypted.modelRuntime = mr;
     }
+    if (typeof payload["breakerEnabled"] === "boolean" || typeof payload["breakerAutoKillResetMs"] === "number") {
+      const cb = decrypted.circuitBreaker ?? {};
+      if (typeof payload["breakerEnabled"] === "boolean") cb.enabled = payload["breakerEnabled"];
+      if (typeof payload["breakerAutoKillResetMs"] === "number")
+        cb.autoKillResetMs = payload["breakerAutoKillResetMs"];
+      decrypted.circuitBreaker = cb;
+    }
+    if (payload["fsAccess"] === "unrestricted" || payload["fsAccess"] === "project") {
+      const restrict = payload["fsAccess"] === "project";
+      const toolsCfg = decrypted.tools ?? {};
+      toolsCfg.restrictToProjectRoot = restrict;
+      decrypted.tools = toolsCfg;
+      const featsCfg = decrypted.features ?? {};
+      featsCfg.allowOutsideProjectRoot = !restrict;
+      decrypted.features = featsCfg;
+    }
+    if (typeof payload["debugStream"] === "boolean")
+      decrypted.debugStream = payload["debugStream"];
   }, "prefs");
 }
 
 // src/server/projects-manifest.ts
 import * as fs14 from "node:fs/promises";
-import * as path18 from "node:path";
+import * as path19 from "node:path";
 import { projectSlug } from "@wrongstack/core";
 function projectsJsonPath(globalConfigPath) {
-  const base = path18.dirname(globalConfigPath);
-  return path18.join(base, "projects.json");
+  const base = path19.dirname(globalConfigPath);
+  return path19.join(base, "projects.json");
 }
 async function loadManifest(globalConfigPath) {
   try {
@@ -11171,15 +11986,15 @@ async function loadManifest(globalConfigPath) {
 }
 async function saveManifest(manifest, globalConfigPath) {
   const file = projectsJsonPath(globalConfigPath);
-  await fs14.mkdir(path18.dirname(file), { recursive: true });
+  await fs14.mkdir(path19.dirname(file), { recursive: true });
   await fs14.writeFile(file, JSON.stringify(manifest, null, 2), "utf8");
 }
 function generateProjectSlug(rootPath) {
   return projectSlug(rootPath);
 }
 async function ensureProjectDataDir(slug, globalConfigPath) {
-  const base = path18.dirname(globalConfigPath);
-  const dir = path18.join(base, "projects", slug);
+  const base = path19.dirname(globalConfigPath);
+  const dir = path19.join(base, "projects", slug);
   await fs14.mkdir(dir, { recursive: true });
   return dir;
 }
@@ -11213,6 +12028,23 @@ function projectSavedProviders(providers) {
   });
 }
 var probeScrubber = new DefaultSecretScrubber();
+async function probeModelDescriptors(cfg) {
+  if (!cfg.baseUrl) return [];
+  try {
+    const keys = normalizeKeys(cfg);
+    const active = keys.find((k) => k.label === cfg.activeKey) ?? keys[0];
+    const result = await probeLocalLlm({
+      baseUrl: cfg.baseUrl,
+      apiKey: active?.apiKey,
+      noAuth: false,
+      scrubber: probeScrubber
+    });
+    if (!result.ok || !result.modelIds) return [];
+    return result.modelIds.map((id) => ({ id, name: id, capabilities: [] }));
+  } catch {
+    return [];
+  }
+}
 function createProviderHandlers(deps2) {
   const { globalConfigPath, vault, broadcast: broadcast2, clients } = deps2;
   let configWriteLock = deps2.getConfigWriteLock();
@@ -11499,7 +12331,9 @@ import path21 from "node:path";
 import {
   enhanceUserPrompt,
   gatedEnhancerReasoning,
+  nextEnhanceTimeout,
   recentTextTurns,
+  resolveEnhanceFallbackRef,
   resolveProviderModelList
 } from "@wrongstack/core";
 import { makeProviderFromConfig as makeProviderFromConfig2 } from "@wrongstack/providers";
@@ -11596,6 +12430,16 @@ async function handleMailboxPurge(ws, deps2, opts) {
     send(ws, { type: "mailbox.purged", payload: { error: errMessage(err) } });
   }
 }
+async function handleMailboxCompact(ws, deps2, opts) {
+  try {
+    const dir = resolveProjectDir2(deps2.projectRoot, deps2.globalRoot);
+    const mb = new GlobalMailbox3(dir);
+    const result = await mb.autoCompact(opts);
+    send(ws, { type: "mailbox.compacted", payload: result });
+  } catch (err) {
+    send(ws, { type: "mailbox.compacted", payload: { error: errMessage(err) } });
+  }
+}
 
 // src/server/mode-handlers.ts
 import {
@@ -11654,6 +12498,8 @@ function createModeHandlers(ctx) {
         const paths = resolveWstackPaths2({ projectRoot: ctx.projectRoot, globalRoot: ctx.globalRoot });
         const freshBuilder = new DefaultSystemPromptBuilder2({
           memoryStore: ctx.memoryStore,
+          // Single injection channel: Super Memory turn middleware, not a static section.
+          injectMemory: false,
           skillLoader: ctx.skillLoader,
           modeStore: ctx.modeStore,
           modeId: id,
@@ -11684,7 +12530,7 @@ function createModeHandlers(ctx) {
 }
 
 // src/server/project-handlers.ts
-import * as path19 from "node:path";
+import * as path20 from "node:path";
 function createProjectHandlers(ctx) {
   return {
     listProjects: async (ws) => {
@@ -11710,7 +12556,7 @@ function createProjectHandlers(ctx) {
     selectProject: async (ws, msg) => {
       const payload = msg.payload;
       const root = typeof payload?.root === "string" ? payload.root : "";
-      const name2 = typeof payload?.name === "string" ? payload.name : root ? path19.basename(root) : "";
+      const name2 = typeof payload?.name === "string" ? payload.name : root ? path20.basename(root) : "";
       send(ws, {
         type: "projects.selected",
         payload: {
@@ -11745,12 +12591,12 @@ function createProjectHandlers(ctx) {
 }
 
 // src/server/session-handlers.ts
-import * as path20 from "node:path";
 import {
   DEFAULT_CONTEXT_WINDOW_MODE_ID,
   repairToolUseAdjacency,
   resolveContextWindowPolicy as resolveContextWindowPolicy3
 } from "@wrongstack/core";
+import { sessionScopedPath as sessionScopedPath2 } from "@wrongstack/core/utils";
 function createSessionHandlers(ctx) {
   const currentSessionId = () => ctx.getSession().id;
   const sessionPayload2 = (payload) => {
@@ -11776,33 +12622,46 @@ function createSessionHandlers(ctx) {
     });
     return false;
   };
+  const finalizeSession = async (writer) => {
+    await writer.append({
+      type: "session_end",
+      ts: (/* @__PURE__ */ new Date()).toISOString(),
+      usage: ctx.tokenCounter.total()
+    }).catch(() => void 0);
+    await writer.close().catch(() => void 0);
+  };
+  const activateSession = async (next, messages, usage) => {
+    const current = ctx.getSession();
+    if (current !== next) await finalizeSession(current);
+    ctx.setSession(next);
+    ctx.context.session = next;
+    ctx.context.state.replaceMessages(messages);
+    ctx.context.state.replaceTodos([]);
+    ctx.context.readFiles.clear();
+    ctx.context.fileMtimes.clear();
+    ctx.context.state.setMeta(
+      "plan.path",
+      sessionScopedPath2(ctx.sessionsDir, next.id, ".plan.json")
+    );
+    ctx.context.state.setMeta(
+      "task.path",
+      sessionScopedPath2(ctx.sessionsDir, next.id, ".tasks.json")
+    );
+    ctx.tokenCounter.reset();
+    if (usage) ctx.tokenCounter.account(usage, ctx.config.model);
+    ctx.setSessionStartedAt(Date.now());
+    await ctx.onSessionSwapped(next.id);
+  };
   return {
     newSession: async (ws, msg) => {
       if (!ensureCurrentSession(ws, msg, "session.new")) return;
-      const session = ctx.getSession();
-      try {
-        await session.append({
-          type: "session_end",
-          ts: (/* @__PURE__ */ new Date()).toISOString(),
-          usage: ctx.tokenCounter.total()
-        });
-        await session.close();
-      } catch {
-      }
       const next = await ctx.getSessionStore().create({
         id: "",
         title: "",
         model: ctx.config.model,
         provider: ctx.config.provider
       });
-      ctx.setSession(next);
-      ctx.context.session = next;
-      ctx.context.state.replaceMessages([]);
-      ctx.context.state.replaceTodos([]);
-      ctx.context.readFiles.clear();
-      ctx.context.fileMtimes.clear();
-      ctx.tokenCounter.reset();
-      ctx.setSessionStartedAt(Date.now());
+      await activateSession(next, []);
       broadcast(ctx.clients, { type: "session.start", payload: await ctx.sessionStartPayload() });
     },
     clearContext: async (ws, msg) => {
@@ -11883,7 +12742,9 @@ function createSessionHandlers(ctx) {
     },
     listContextModes: async (ws, msg) => {
       if (!ensureCurrentSession(ws, msg, "context.modes.list")) return;
-      const active = String(ctx.context.meta["contextWindowMode"] ?? DEFAULT_CONTEXT_WINDOW_MODE_ID);
+      const active = String(
+        ctx.context.meta["contextWindowMode"] ?? DEFAULT_CONTEXT_WINDOW_MODE_ID
+      );
       const allModes = ctx.customModeStore.list().map((m) => ({
         id: m.id,
         name: m.name,
@@ -11894,7 +12755,10 @@ function createSessionHandlers(ctx) {
         eliseThreshold: m.eliseThreshold,
         custom: m.custom === true
       }));
-      send(ws, { type: "context.modes.list", payload: sessionPayload2({ activeId: active, modes: allModes }) });
+      send(ws, {
+        type: "context.modes.list",
+        payload: sessionPayload2({ activeId: active, modes: allModes })
+      });
     },
     switchContextMode: async (ws, msg) => {
       if (!ensureCurrentSession(ws, msg, "context.mode.switch")) return;
@@ -11976,7 +12840,10 @@ function createSessionHandlers(ctx) {
       const { id } = parsed.value;
       if (String(ctx.context.meta["contextWindowMode"] ?? "") === id) {
         ctx.context.meta["contextWindowMode"] = DEFAULT_CONTEXT_WINDOW_MODE_ID;
-        ctx.context.meta["contextWindowPolicy"] = resolveContextWindowPolicy3({}, DEFAULT_CONTEXT_WINDOW_MODE_ID);
+        ctx.context.meta["contextWindowPolicy"] = resolveContextWindowPolicy3(
+          {},
+          DEFAULT_CONTEXT_WINDOW_MODE_ID
+        );
       }
       const result = ctx.customModeStore.remove(id);
       sendResult(ws, result.ok, result.error ?? `Mode "${id}" deleted`);
@@ -11989,15 +12856,7 @@ function createSessionHandlers(ctx) {
         send(ws, {
           type: "sessions.list",
           payload: {
-            sessions: list.map((s) => ({
-              id: s.id,
-              title: s.title,
-              startedAt: s.startedAt,
-              model: s.model,
-              provider: s.provider,
-              tokenTotal: s.tokenTotal,
-              isCurrent: s.id === currentId
-            }))
+            sessions: toSessionHistoryEntries(list, currentId)
           }
         });
       } catch (err) {
@@ -12011,8 +12870,17 @@ function createSessionHandlers(ctx) {
           sendResult(ws, false, "Cannot delete the active session");
           return;
         }
-        await ctx.getSessionStore().delete(id);
+        const store = ctx.getSessionStore();
+        await store.delete(id);
         sendResult(ws, true, `Session ${id} deleted`);
+        try {
+          const list = await store.list(200);
+          broadcast(ctx.clients, {
+            type: "sessions.list",
+            payload: { sessions: toSessionHistoryEntries(list, ctx.getSession().id) }
+          });
+        } catch {
+        }
       } catch (err) {
         sendResult(ws, false, errMessage(err));
       }
@@ -12028,23 +12896,17 @@ function createSessionHandlers(ctx) {
       try {
         await ctx.getSessionStore().rename(id, name2);
         sendResult(ws, true, name2 ? `Renamed session to "${name2}"` : `Cleared session name`);
-        const list = await ctx.getSessionStore().list(50);
-        const currentId = ctx.getSession().id;
-        broadcast(ctx.clients, {
-          type: "sessions.list",
-          payload: {
-            sessions: list.map((s) => ({
-              id: s.id,
-              name: s.name,
-              title: s.title,
-              startedAt: s.startedAt,
-              model: s.model,
-              provider: s.provider,
-              tokenTotal: s.tokenTotal,
-              isCurrent: s.id === currentId
-            }))
-          }
-        });
+        try {
+          const list = await ctx.getSessionStore().list(200);
+          const currentId = ctx.getSession().id;
+          broadcast(ctx.clients, {
+            type: "sessions.list",
+            payload: {
+              sessions: toSessionHistoryEntries(list, currentId)
+            }
+          });
+        } catch {
+        }
       } catch (err) {
         sendResult(ws, false, errMessage(err));
       }
@@ -12058,23 +12920,7 @@ function createSessionHandlers(ctx) {
           return;
         }
         const resumed = await ctx.getSessionStore().resume(id);
-        try {
-          await current.append({
-            type: "session_end",
-            ts: (/* @__PURE__ */ new Date()).toISOString(),
-            usage: ctx.tokenCounter.total()
-          });
-          await current.close();
-        } catch {
-        }
-        ctx.setSession(resumed.writer);
-        ctx.context.session = resumed.writer;
-        ctx.context.state.replaceMessages(resumed.data.messages);
-        ctx.context.readFiles.clear();
-        ctx.context.fileMtimes.clear();
-        ctx.tokenCounter.reset();
-        ctx.tokenCounter.account(resumed.data.usage, ctx.config.model);
-        ctx.setSessionStartedAt(Date.now());
+        await activateSession(resumed.writer, resumed.data.messages, resumed.data.usage);
         broadcast(ctx.clients, {
           type: "session.start",
           payload: {
@@ -12098,10 +12944,7 @@ function createSessionHandlers(ctx) {
       try {
         const { DefaultSessionRewinder } = await import("@wrongstack/core");
         const projectRoot = ctx.getProjectRoot();
-        const rewinder = new DefaultSessionRewinder(
-          path20.join(projectRoot, ".wrongstack", "sessions"),
-          projectRoot
-        );
+        const rewinder = new DefaultSessionRewinder(ctx.sessionsDir, projectRoot);
         const checkpoints = await rewinder.listCheckpoints(ctx.getSession().id);
         send(ws, { type: "session.checkpoints", payload: sessionPayload2({ checkpoints }) });
       } catch {
@@ -12114,10 +12957,7 @@ function createSessionHandlers(ctx) {
       try {
         const { DefaultSessionRewinder } = await import("@wrongstack/core");
         const projectRoot = ctx.getProjectRoot();
-        const rewinder = new DefaultSessionRewinder(
-          path20.join(projectRoot, ".wrongstack", "sessions"),
-          projectRoot
-        );
+        const rewinder = new DefaultSessionRewinder(ctx.sessionsDir, projectRoot);
         await rewinder.rewindToCheckpoint(ctx.getSession().id, checkpointIndex);
         await ctx.context.session.truncateToCheckpoint(checkpointIndex);
         sendResult(ws, true, `Rewound to checkpoint ${checkpointIndex}`);
@@ -12166,6 +13006,25 @@ function buildRoutes(state, deps2, cb) {
     clients: state.getClients(),
     modelsRegistry: deps2.modelsRegistry
   });
+  async function applyModelSwitchCore(newProvider, newModel) {
+    const cur = state.getConfig();
+    state.setConfig(patchConfig(cur, { provider: newProvider, model: newModel }));
+    deps2.configStore.update({ provider: newProvider, model: newModel });
+    deps2.context.model = newModel;
+    const newCfg = state.getConfig();
+    const providerCfg = newCfg.providers?.[newProvider] ?? { type: newProvider };
+    const newProv = deps2.providerRegistry.has(newProvider) ? deps2.providerRegistry.create({ ...providerCfg, type: newProvider }) : makeProviderFromConfig2(newProvider, providerCfg);
+    deps2.context.provider = newProv;
+    await cb.updateAutoCompactionMaxContext(newProv, newProvider, providerCfg);
+    await cb.updateGlobalConfig((config) => {
+      config.provider = newProvider;
+      config.model = newModel;
+    }, "model.switch");
+    broadcast(state.getClients(), {
+      type: "session.start",
+      payload: await cb.sessionStartPayload()
+    });
+  }
   const providerRoutes = {
     providerHandlers,
     listProviders: async (ws) => {
@@ -12202,11 +13061,20 @@ function buildRoutes(state, deps2, cb) {
       const provider = await resolveProviderCatalogForModels(deps2.modelsRegistry, providerId, cfg);
       const siblingId = SIBLING_CATALOG[providerId];
       const siblingCatalog = siblingId && siblingId !== providerId ? await deps2.modelsRegistry.getProvider(siblingId).catch(() => void 0) : void 0;
+      let resolved = resolveProviderModelList(
+        cfg?.models,
+        provider,
+        cfg?.type ?? providerId,
+        siblingCatalog
+      );
+      if (resolved.length === 0 && cfg?.baseUrl) {
+        resolved = await probeModelDescriptors(cfg);
+      }
       const models = await enrichProviderModelDescriptors(
         deps2.modelsRegistry,
         providerId,
         cfg,
-        resolveProviderModelList(cfg?.models, provider, cfg?.type ?? providerId, siblingCatalog)
+        resolved
       );
       send(ws, {
         type: "provider.models",
@@ -12224,21 +13092,7 @@ function buildRoutes(state, deps2, cb) {
       }
       const { provider: newProvider, model: newModel } = parsed.value;
       try {
-        const cur = state.getConfig();
-        state.setConfig(patchConfig(cur, { provider: newProvider, model: newModel }));
-        deps2.configStore.update({ provider: newProvider, model: newModel });
-        deps2.context.model = newModel;
-        const newCfg = state.getConfig();
-        const providerCfg = newCfg.providers?.[newProvider] ?? {
-          type: newProvider
-        };
-        const newProv = deps2.providerRegistry.has(newProvider) ? deps2.providerRegistry.create({ ...providerCfg, type: newProvider }) : makeProviderFromConfig2(newProvider, providerCfg);
-        deps2.context.provider = newProv;
-        await cb.updateAutoCompactionMaxContext(newProv, newProvider, providerCfg);
-        await cb.updateGlobalConfig((config) => {
-          config.provider = newProvider;
-          config.model = newModel;
-        }, "model.switch");
+        await applyModelSwitchCore(newProvider, newModel);
         send(ws, {
           type: "key.operation_result",
           payload: { success: true, message: `Switched to ${newProvider} / ${newModel}` }
@@ -12251,45 +13105,100 @@ function buildRoutes(state, deps2, cb) {
             message: `Switch failed: ${errMessage(err)}`
           }
         });
-        return;
       }
-      broadcast(state.getClients(), {
-        type: "session.start",
-        payload: await cb.sessionStartPayload()
-      });
+    },
+    adoptDefaultProviderIfUnset: async (providerId) => {
+      if (state.getConfig().model) return;
+      const saved = await providerHandlers.loadConfigProviders();
+      state.setConfig(patchConfig(state.getConfig(), { providers: saved }));
+      const cfg = saved[providerId];
+      if (!cfg) return;
+      let model = cfg.models?.[0];
+      if (!model) {
+        const catalogId = cfg.type && cfg.type !== providerId ? cfg.type : providerId;
+        const catalog = await deps2.modelsRegistry.getProvider(catalogId).catch(() => void 0);
+        model = catalog?.models?.[0]?.id;
+      }
+      if (!model) {
+        const probed = await probeModelDescriptors(cfg);
+        model = probed[0]?.id;
+      }
+      if (!model) return;
+      try {
+        await applyModelSwitchCore(providerId, model);
+      } catch {
+      }
     },
     refineModel: async (ws, msg) => {
-      const { text } = msg.payload;
+      const payload = msg.payload;
+      const { text } = payload;
       if (!text?.trim()) {
         send(ws, {
           type: "model.refine_result",
-          payload: { refined: "", english: "", error: "Empty text" }
+          payload: { refined: "", english: "", error: "Empty text", errorKind: "provider_error" }
         });
         return;
       }
+      const cfg = state.getConfig();
+      const fallbackRef = resolveEnhanceFallbackRef({
+        ...cfg,
+        provider: cfg.provider ?? "",
+        model: cfg.model ?? ""
+      });
+      let provider = deps2.context.provider;
+      let providerId = cfg.provider ?? "";
+      let model = deps2.context.model;
+      if (payload.provider && payload.model) {
+        try {
+          const providerCfg = cfg.providers?.[payload.provider] ?? {
+            type: payload.provider
+          };
+          provider = deps2.providerRegistry.has(payload.provider) ? deps2.providerRegistry.create({ ...providerCfg, type: payload.provider }) : makeProviderFromConfig2(payload.provider, providerCfg);
+          providerId = payload.provider;
+          model = payload.model;
+        } catch (err) {
+          send(ws, {
+            type: "model.refine_result",
+            payload: {
+              refined: text,
+              english: text,
+              error: `Cannot use ${payload.provider}/${payload.model}: ${errMessage(err)}`,
+              errorKind: "provider_error",
+              ...fallbackRef ? { fallbackRef } : {}
+            }
+          });
+          return;
+        }
+      }
+      const baseTimeout = 9e4;
+      const timeoutMs = typeof payload.timeoutMs === "number" && payload.timeoutMs > 0 ? payload.timeoutMs : baseTimeout;
       try {
         const history = recentTextTurns(deps2.context.messages);
-        const cfg = state.getConfig();
         const resolved = await resolveProviderModelMetadata(
           deps2.modelsRegistry,
-          cfg.provider ?? "",
-          cfg.model ?? "",
-          cfg.providers?.[cfg.provider ?? ""]
+          providerId,
+          model,
+          cfg.providers?.[providerId]
         ).catch(() => void 0);
         const reasoning = gatedEnhancerReasoning(resolved?.capabilities?.reasoningConfig);
+        let failureKind;
         const result = await enhanceUserPrompt({
-          provider: deps2.context.provider,
-          model: deps2.context.model,
+          provider,
+          model,
           text,
           history,
-          timeoutMs: 9e4,
+          timeoutMs,
           ...reasoning ? { reasoning } : {},
-          onError: (reason) => {
+          onError: (reason, kind) => {
+            failureKind = kind;
             console.warn(
               JSON.stringify({
                 level: "warn",
                 event: "model.refine_failed",
                 reason,
+                kind,
+                provider: providerId,
+                model,
                 timestamp: (/* @__PURE__ */ new Date()).toISOString()
               })
             );
@@ -12298,12 +13207,23 @@ function buildRoutes(state, deps2, cb) {
         if (result) {
           send(ws, {
             type: "model.refine_result",
-            payload: { refined: result.refined, english: result.english }
+            payload: {
+              refined: result.refined,
+              english: result.english,
+              refinedWith: { provider: providerId, model }
+            }
           });
         } else {
           send(ws, {
             type: "model.refine_result",
-            payload: { refined: text, english: text, error: "Refinement returned no result" }
+            payload: {
+              refined: text,
+              english: text,
+              error: "Refinement returned no result",
+              errorKind: failureKind ?? "empty",
+              ...failureKind === "timeout" ? { retryTimeoutMs: nextEnhanceTimeout(timeoutMs, cfg.autonomy) } : {},
+              ...fallbackRef ? { fallbackRef } : {}
+            }
           });
         }
       } catch (err) {
@@ -12317,7 +13237,13 @@ function buildRoutes(state, deps2, cb) {
         );
         send(ws, {
           type: "model.refine_result",
-          payload: { refined: text, english: text, error: errMessage(err) }
+          payload: {
+            refined: text,
+            english: text,
+            error: errMessage(err),
+            errorKind: "provider_error",
+            ...fallbackRef ? { fallbackRef } : {}
+          }
         });
       }
     }
@@ -12333,8 +13259,10 @@ function buildRoutes(state, deps2, cb) {
     getProjectRoot: state.getProjectRoot,
     getSession: state.getSession,
     getSessionStore: state.getSessionStore,
+    sessionsDir: deps2.wpaths.projectSessions,
     setSession: state.setSession,
     setSessionStartedAt: state.setSessionStartedAt,
+    onSessionSwapped: cb.onSessionSwapped,
     sessionStartPayload: cb.sessionStartPayload
   });
   const projectRoutes = createProjectHandlers({
@@ -12429,6 +13357,17 @@ function buildRoutes(state, deps2, cb) {
           deps2.pipelines.contextWindow.remove("AutoCompaction", { optional: true });
         }
       }
+      if (typeof payload["breakerEnabled"] === "boolean" || typeof payload["breakerAutoKillResetMs"] === "number") {
+        const { getProcessRegistry } = await import("@wrongstack/tools");
+        getProcessRegistry().setBreakerConfig({
+          ...typeof payload["breakerEnabled"] === "boolean" ? { enabled: payload["breakerEnabled"] } : {},
+          ...typeof payload["breakerAutoKillResetMs"] === "number" ? { autoKillResetMs: payload["breakerAutoKillResetMs"] } : {}
+        });
+      }
+      if (typeof payload["debugStream"] === "boolean") {
+        const { setDebugStreamEnabled } = await import("@wrongstack/providers");
+        setDebugStreamEnabled(payload["debugStream"]);
+      }
       if (typeof payload["logLevel"] === "string") {
         const valid = ["debug", "info", "warn", "error"];
         if (valid.includes(payload["logLevel"])) {
@@ -12506,6 +13445,13 @@ function buildRoutes(state, deps2, cb) {
         { projectRoot: state.getProjectRoot(), globalRoot: path21.dirname(deps2.globalConfigPath) },
         parsed.value
       );
+    },
+    compact: (ws, msg) => {
+      return handleMailboxCompact(
+        ws,
+        { projectRoot: state.getProjectRoot(), globalRoot: path21.dirname(deps2.globalConfigPath) },
+        msg.payload ?? {}
+      );
     }
   };
   const mcpRoutes = {
@@ -12518,14 +13464,29 @@ function buildRoutes(state, deps2, cb) {
     sleep: (ws, msg) => handleMcpSleep(ws, msg, deps2.globalConfigPath, deps2.mcpRegistry),
     wake: (ws, msg) => handleMcpWake(ws, msg, deps2.globalConfigPath, deps2.mcpRegistry),
     restart: (ws, msg) => handleMcpRestart(ws, msg, deps2.globalConfigPath, deps2.mcpRegistry),
-    discover: (ws, msg) => handleMcpDiscover(ws, msg, deps2.globalConfigPath, deps2.mcpRegistry)
+    discover: (ws, msg) => handleMcpDiscover(ws, msg, deps2.globalConfigPath, deps2.mcpRegistry),
+    resources: (ws, msg) => handleMcpResources(ws, msg, deps2.globalConfigPath, deps2.mcpRegistry),
+    prompts: (ws, msg) => handleMcpPrompts(ws, msg, deps2.globalConfigPath, deps2.mcpRegistry),
+    resourceRead: (ws, msg) => handleMcpResourceRead(ws, msg, deps2.globalConfigPath, deps2.mcpRegistry),
+    promptGet: (ws, msg) => handleMcpPromptGet(ws, msg, deps2.globalConfigPath, deps2.mcpRegistry)
+  };
+  const sendBrainStatus = (ws) => {
+    const snapshot = deps2.brainRuntime.getSnapshot();
+    send(ws, {
+      type: "brain.status",
+      payload: {
+        maxAutoRisk: deps2.brainSettings.maxAutoRisk,
+        log: deps2.brainLog,
+        mode: snapshot.mode,
+        poolLabels: snapshot.poolLabels,
+        councilLabels: snapshot.councilLabels,
+        ledgerPath: snapshot.ledger.path
+      }
+    });
   };
   const brainRoutes = {
     status: (ws) => {
-      send(ws, {
-        type: "brain.status",
-        payload: { maxAutoRisk: deps2.brainSettings.maxAutoRisk, log: deps2.brainLog }
-      });
+      sendBrainStatus(ws);
     },
     risk: (ws, msg) => {
       const parsed = validateBrainRiskPayload(msg.payload);
@@ -12535,11 +13496,43 @@ function buildRoutes(state, deps2, cb) {
       }
       const { level } = parsed.value;
       deps2.brainSettings.maxAutoRisk = level;
+      sendBrainStatus(ws);
+    },
+    configGet: (ws) => {
       send(ws, {
-        type: "brain.status",
-        payload: { maxAutoRisk: deps2.brainSettings.maxAutoRisk, log: deps2.brainLog }
+        type: "brain.config",
+        payload: { config: deps2.brainRuntime.getSnapshot(), persisted: true }
       });
     },
+    configSet: async (ws, msg) => {
+      const parsed = validateBrainConfigSetPayload(msg.payload);
+      if (!parsed.ok) {
+        sendResult(ws, false, parsed.message);
+        return;
+      }
+      try {
+        const { persisted } = deps2.brainRuntime.apply(parsed.value.patch);
+        const result = await persisted;
+        send(ws, {
+          type: "brain.config",
+          payload: {
+            config: deps2.brainRuntime.getSnapshot(),
+            persisted: result.ok,
+            ...result.ok ? {} : { error: result.error ?? "Persist failed." }
+          }
+        });
+        sendBrainStatus(ws);
+      } catch (err) {
+        send(ws, {
+          type: "brain.config",
+          payload: {
+            config: deps2.brainRuntime.getSnapshot(),
+            persisted: false,
+            error: `Invalid Brain setting: ${errMessage(err)}`
+          }
+        });
+      }
+    },
     ask: async (ws, msg) => {
       const parsed = validateBrainAskPayload(msg.payload);
       if (!parsed.ok) {
@@ -12612,8 +13605,16 @@ async function startWebUI(opts = {}) {
   console.log("[WebUI] Config loaded:", config.provider ?? "(none)", "/", config.model ?? "(none)");
   if (!config.provider && config.providers && typeof config.providers === "object" && config.providers !== null && !Array.isArray(config.providers) && Object.keys(config.providers).length > 0) {
     const firstKey = expectDefined3(Object.keys(config.providers)[0]);
-    config = patchConfig(config, { provider: firstKey });
-    console.log("[WebUI] No active provider \u2014 auto-selected:", firstKey);
+    const adoptModel = !config.model ? config.providers[firstKey]?.models?.[0] : void 0;
+    config = patchConfig(config, {
+      provider: firstKey,
+      ...adoptModel ? { model: adoptModel } : {}
+    });
+    console.log(
+      "[WebUI] No active provider \u2014 auto-selected:",
+      firstKey,
+      adoptModel ? `/ ${adoptModel}` : ""
+    );
   }
   const needsProvider = !config.provider || !config.model;
   const preContext = await createPreContextServices({
@@ -12647,7 +13648,8 @@ async function startWebUI(opts = {}) {
     promptsCtx,
     modelCapabilitiesRef,
     provider,
-    context
+    context,
+    sessionIdentity
   } = preContext;
   let sessionStore = preContext.sessionStore;
   let session = preContext.session;
@@ -12680,7 +13682,12 @@ async function startWebUI(opts = {}) {
     modelCapabilitiesRef,
     sessionGetter: () => session,
     sessionReader,
-    annotationsStore
+    annotationsStore,
+    // Brain settings persist to the GLOBAL config only (config.brain is on
+    // the in-project deny list), serialized behind the shared write lock.
+    persistBrainConfig: (brainConfig) => updateGlobalConfig2((decrypted) => {
+      decrypted["brain"] = brainConfig;
+    }, "brain.config")
   });
   const {
     compactor,
@@ -12690,6 +13697,7 @@ async function startWebUI(opts = {}) {
     pipelines,
     brain,
     brainSettings,
+    brainRuntime,
     brainLog,
     brainMonitor,
     codebaseIndexing,
@@ -12860,10 +13868,16 @@ async function startWebUI(opts = {}) {
     terminalHandler,
     brain,
     brainSettings,
+    brainRuntime,
     brainLog
   };
   const cb = {
     sessionStartPayload,
+    onSessionSwapped: async (sessionId) => {
+      await sessionIdentity.activate(sessionId);
+      const { hydrateSessionKanban: hydrateSessionKanban2 } = await import("@wrongstack/tools/session-kanban");
+      await hydrateSessionKanban2(deps2.context);
+    },
     updateAutoCompactionMaxContext,
     updateGlobalConfig: updateGlobalConfig2,
     persistPrefsToConfig: persistPrefsToConfig2,
@@ -12989,7 +14003,10 @@ async function startWebUI(opts = {}) {
     onShutdown: async () => {
       credentialWatcherClose?.();
       brainMonitor.stop();
+      await agentServices.brainLedger?.stop().catch(() => {
+      });
       await mcpRegistry.stopAll().catch(() => void 0);
+      await sessionIdentity.stop();
       eventArming.getDispose()?.();
       if (eternalSubscription) {
         eternalSubscription.dispose();
@@ -13100,6 +14117,7 @@ export {
   AutoPhaseWebSocketHandler,
   CollaborationWebSocketHandler,
   SKIP_DIRS,
+  SURFACE_DEFAULT_PORTS,
   SddBoardWebSocketHandler,
   SddWizardWebSocketHandler,
   SpecsWebSocketHandler,
@@ -13139,6 +14157,7 @@ export {
   generateAuthToken,
   getAnalyticsBuffer,
   getCostRates,
+  getSurfaceDefaultPorts,
   handleApiAnalyticsGet,
   handleApiAnalyticsPost,
   handleApiAnalyticsSummary,
@@ -13166,15 +14185,17 @@ export {
   handleMcpDiscover,
   handleMcpEnable,
   handleMcpList,
+  handleMcpPromptGet,
+  handleMcpPrompts,
   handleMcpRemove,
+  handleMcpResourceRead,
+  handleMcpResources,
   handleMcpRestart,
   handleMcpRoute,
   handleMcpSleep,
   handleMcpUpdate,
   handleMcpWake,
-  handleMemoryForget,
   handleMemoryList,
-  handleMemoryRemember,
   handleModeRoute,
   handlePrefsRoute,
   handleProcessKill,
@@ -13203,6 +14224,11 @@ export {
   handleSkillsUninstall,
   handleSkillsUpdate,
   handleSpecsRoute,
+  handleSuperMemoryDelete,
+  handleSuperMemoryGet,
+  handleSuperMemoryList,
+  handleSuperMemoryRemember,
+  handleSuperMemoryUpdate,
   handleWorklistMessage,
   hostForBrowserUrl,
   hostHeaderOk,
@@ -13247,9 +14273,13 @@ export {
   setActiveKey,
   setupEvents,
   setupWebUICodebaseIndexing,
+  startSddRunFromGraph,
   startWebUI,
   statusProjectHashFromWatchFilename,
   stringifyContent,
+  surfaceLabel,
+  toSessionHistoryEntries,
+  toSessionHistoryEntry,
   tokenMatches,
   unregisterInstance,
   upsertKey,