@wrongstack/webui-server 0.296.2 → 0.296.3

package/dist/index.js

@@ -134,85 +134,85 @@ var ENUM_PREF_KEYS = {
   autoReviewCascadeOn: /* @__PURE__ */ new Set(["off", "critical", "high"]),
   fleetChatVerbosity: /* @__PURE__ */ new Set(["off", "full"])
 };
-function validateModelRuntimeValue(modelRuntime, path33) {
+function validateModelRuntimeValue(modelRuntime, path34) {
   const reasoning = modelRuntime["reasoning"];
   if (reasoning !== void 0) {
-    if (!isRecord(reasoning)) return `${path33}.reasoning must be an object when provided`;
+    if (!isRecord(reasoning)) return `${path34}.reasoning must be an object when provided`;
     const mode = reasoning["mode"];
     const effort = reasoning["effort"];
     const preserve = reasoning["preserve"];
     if (mode !== void 0 && (typeof mode !== "string" || !REASONING_MODE_VALUES.has(mode))) {
-      return `${path33}.reasoning.mode must be one of: ${Array.from(REASONING_MODE_VALUES).join(", ")}`;
+      return `${path34}.reasoning.mode must be one of: ${Array.from(REASONING_MODE_VALUES).join(", ")}`;
     }
     if (effort !== void 0 && (typeof effort !== "string" || !REASONING_EFFORT_VALUES.has(effort))) {
-      return `${path33}.reasoning.effort must be one of: ${Array.from(REASONING_EFFORT_VALUES).join(", ")}`;
+      return `${path34}.reasoning.effort must be one of: ${Array.from(REASONING_EFFORT_VALUES).join(", ")}`;
     }
     if (preserve !== void 0 && typeof preserve !== "boolean") {
-      return `${path33}.reasoning.preserve must be a boolean when provided`;
+      return `${path34}.reasoning.preserve must be a boolean when provided`;
     }
   }
   const cache2 = modelRuntime["cache"];
   if (cache2 !== void 0) {
-    if (!isRecord(cache2)) return `${path33}.cache must be an object when provided`;
+    if (!isRecord(cache2)) return `${path34}.cache must be an object when provided`;
     const ttl = cache2["ttl"];
     if (ttl !== void 0 && (typeof ttl !== "string" || !CACHE_TTL_VALUES.has(ttl) || ttl === "default")) {
-      return `${path33}.cache.ttl must be one of: 5m, 1h`;
+      return `${path34}.cache.ttl must be one of: 5m, 1h`;
     }
   }
   const parameters = modelRuntime["parameters"];
   if (parameters !== void 0 && !isRecord(parameters)) {
-    return `${path33}.parameters must be an object when provided`;
+    return `${path34}.parameters must be an object when provided`;
   }
   return null;
 }
-function validateModelBlackoutRule(rule, path33) {
+function validateModelBlackoutRule(rule, path34) {
   const id = rule["id"];
   if (typeof id !== "string" || id.trim().length === 0) {
-    return `${path33}.id must be a non-empty string`;
+    return `${path34}.id must be a non-empty string`;
   }
   const start = rule["start"];
   if (typeof start !== "string" || !/^([01]\d|2[0-3]):[0-5]\d$/.test(start)) {
-    return `${path33}.start must be a string in HH:mm (00:00-23:59) format`;
+    return `${path34}.start must be a string in HH:mm (00:00-23:59) format`;
   }
   const end = rule["end"];
   if (typeof end !== "string" || !/^([01]\d|2[0-3]):[0-5]\d$/.test(end)) {
-    return `${path33}.end must be a string in HH:mm (00:00-23:59) format`;
+    return `${path34}.end must be a string in HH:mm (00:00-23:59) format`;
   }
   if (rule["enabled"] !== void 0 && typeof rule["enabled"] !== "boolean") {
-    return `${path33}.enabled must be a boolean when provided`;
+    return `${path34}.enabled must be a boolean when provided`;
   }
   if (rule["provider"] !== void 0 && typeof rule["provider"] !== "string") {
-    return `${path33}.provider must be a string when provided`;
+    return `${path34}.provider must be a string when provided`;
   }
   if (rule["model"] !== void 0 && typeof rule["model"] !== "string") {
-    return `${path33}.model must be a string when provided`;
+    return `${path34}.model must be a string when provided`;
   }
   if (rule["days"] !== void 0) {
-    if (!Array.isArray(rule["days"])) return `${path33}.days must be an array when provided`;
+    if (!Array.isArray(rule["days"])) return `${path34}.days must be an array when provided`;
     const seen = /* @__PURE__ */ new Set();
     for (const d of rule["days"]) {
       if (typeof d !== "number" || !Number.isInteger(d) || d < 0 || d > 6) {
-        return `${path33}.days elements must be integers 0-6 when provided`;
+        return `${path34}.days elements must be integers 0-6 when provided`;
       }
-      if (seen.has(d)) return `${path33}.days contains duplicate day: ${d}`;
+      if (seen.has(d)) return `${path34}.days contains duplicate day: ${d}`;
       seen.add(d);
     }
   }
   if (rule["timezone"] !== void 0) {
     if (typeof rule["timezone"] !== "string") {
-      return `${path33}.timezone must be a string when provided`;
+      return `${path34}.timezone must be a string when provided`;
     }
     try {
       Intl.DateTimeFormat(void 0, { timeZone: rule["timezone"] });
     } catch {
-      return `${path33}.timezone is not a valid IANA timezone (e.g. "America/New_York")`;
+      return `${path34}.timezone is not a valid IANA timezone (e.g. "America/New_York")`;
     }
   }
   if (rule["label"] !== void 0 && typeof rule["label"] !== "string") {
-    return `${path33}.label must be a string when provided`;
+    return `${path34}.label must be a string when provided`;
   }
   if (rule["mode"] !== void 0 && rule["mode"] !== "blackout" && rule["mode"] !== "allow_only") {
-    return `${path33}.mode must be 'blackout' or 'allow_only' when provided`;
+    return `${path34}.mode must be 'blackout' or 'allow_only' when provided`;
   }
   return null;
 }
@@ -760,8 +760,8 @@ function validateShellOpenPayload(payload) {
   if (!isRecord2(payload)) {
     return { ok: false, message: "shell.open payload must be an object with string path" };
   }
-  const path33 = payload["path"];
-  if (typeof path33 !== "string" || path33.trim().length === 0) {
+  const path34 = payload["path"];
+  if (typeof path34 !== "string" || path34.trim().length === 0) {
     return { ok: false, message: "shell.open payload.path must be a non-empty string" };
   }
   const target = payload["target"];
@@ -774,7 +774,7 @@ function validateShellOpenPayload(payload) {
   return {
     ok: true,
     value: {
-      path: path33,
+      path: path34,
       ...target !== void 0 ? { target } : {}
     }
   };
@@ -783,14 +783,14 @@ function validateGitDiffPayload(payload) {
   if (!isRecord2(payload)) {
     return { ok: false, message: "git.diff payload must be an object" };
   }
-  const path33 = payload["path"];
-  if (path33 === void 0 || path33 === null) {
+  const path34 = payload["path"];
+  if (path34 === void 0 || path34 === null) {
     return { ok: true, value: { path: "" } };
   }
-  if (typeof path33 !== "string") {
+  if (typeof path34 !== "string") {
     return { ok: false, message: "git.diff payload.path must be a string when provided" };
   }
-  return { ok: true, value: { path: path33 } };
+  return { ok: true, value: { path: path34 } };
 }
 function validateProjectsAddPayload(payload) {
   if (!isRecord2(payload)) {
@@ -4376,8 +4376,8 @@ function jsonByteLength(value) {
     return MAX_PAYLOAD_BYTES + 1;
   }
 }
-function error(errors, path33, code, message) {
-  errors.push({ path: path33, code, message });
+function error(errors, path34, code, message) {
+  errors.push({ path: path34, code, message });
 }
 function isMessageRole(value) {
   return value === "user" || value === "assistant" || value === "system";
@@ -4385,25 +4385,25 @@ function isMessageRole(value) {
 function isPlainJsonObject(value) {
   return isRecord3(value);
 }
-function validateCacheControl(value, path33, errors) {
+function validateCacheControl(value, path34, errors) {
   if (value === void 0) return void 0;
   if (!isRecord3(value) || value["type"] !== "ephemeral") {
-    error(errors, path33, "INVALID_CACHE_CONTROL", 'cache_control must be { type: "ephemeral" }.');
+    error(errors, path34, "INVALID_CACHE_CONTROL", 'cache_control must be { type: "ephemeral" }.');
     return void 0;
   }
   return { type: "ephemeral" };
 }
-function validateProviderMeta(value, path33, errors) {
+function validateProviderMeta(value, path34, errors) {
   if (value === void 0) return void 0;
   if (!isPlainJsonObject(value)) {
-    error(errors, path33, "INVALID_PROVIDER_META", "providerMeta must be a JSON object.");
+    error(errors, path34, "INVALID_PROVIDER_META", "providerMeta must be a JSON object.");
     return void 0;
   }
   return value;
 }
-function validateBlock(value, path33, errors) {
+function validateBlock(value, path34, errors) {
   if (!isRecord3(value)) {
-    error(errors, path33, "INVALID_BLOCK", "Content block must be an object.");
+    error(errors, path34, "INVALID_BLOCK", "Content block must be an object.");
     return void 0;
   }
   const type = value["type"];
@@ -4411,14 +4411,14 @@ function validateBlock(value, path33, errors) {
     case "text": {
       const text2 = value["text"];
       if (typeof text2 !== "string") {
-        error(errors, `${path33}/text`, "INVALID_TEXT", "Text block text must be a string.");
+        error(errors, `${path34}/text`, "INVALID_TEXT", "Text block text must be a string.");
         return void 0;
       }
       if (text2.length > MAX_STRING_LENGTH) {
-        error(errors, `${path33}/text`, "TEXT_TOO_LARGE", "Text block is too large.");
+        error(errors, `${path34}/text`, "TEXT_TOO_LARGE", "Text block is too large.");
         return void 0;
       }
-      const cacheControl = validateCacheControl(value["cache_control"], `${path33}/cache_control`, errors);
+      const cacheControl = validateCacheControl(value["cache_control"], `${path34}/cache_control`, errors);
       return cacheControl ? { type: "text", text: text2, cache_control: cacheControl } : { type: "text", text: text2 };
     }
     case "tool_use": {
@@ -4426,15 +4426,15 @@ function validateBlock(value, path33, errors) {
       const name2 = value["name"];
       const input = value["input"];
       if (typeof id !== "string" || id.length === 0) {
-        error(errors, `${path33}/id`, "INVALID_TOOL_USE_ID", "tool_use.id must be a non-empty string.");
+        error(errors, `${path34}/id`, "INVALID_TOOL_USE_ID", "tool_use.id must be a non-empty string.");
       }
       if (typeof name2 !== "string" || name2.length === 0) {
-        error(errors, `${path33}/name`, "INVALID_TOOL_NAME", "tool_use.name must be a non-empty string.");
+        error(errors, `${path34}/name`, "INVALID_TOOL_NAME", "tool_use.name must be a non-empty string.");
       }
       if (!isPlainJsonObject(input)) {
-        error(errors, `${path33}/input`, "INVALID_TOOL_INPUT", "tool_use.input must be an object.");
+        error(errors, `${path34}/input`, "INVALID_TOOL_INPUT", "tool_use.input must be an object.");
       }
-      const providerMeta = validateProviderMeta(value["providerMeta"], `${path33}/providerMeta`, errors);
+      const providerMeta = validateProviderMeta(value["providerMeta"], `${path34}/providerMeta`, errors);
       if (typeof id !== "string" || id.length === 0 || typeof name2 !== "string" || name2.length === 0 || !isPlainJsonObject(input)) {
         return void 0;
       }
@@ -4446,18 +4446,18 @@ function validateBlock(value, path33, errors) {
       const content = value["content"];
       const isError = value["is_error"];
       if (typeof toolUseId !== "string" || toolUseId.length === 0) {
-        error(errors, `${path33}/tool_use_id`, "INVALID_TOOL_RESULT_ID", "tool_result.tool_use_id must be a non-empty string.");
+        error(errors, `${path34}/tool_use_id`, "INVALID_TOOL_RESULT_ID", "tool_result.tool_use_id must be a non-empty string.");
       }
       if (name2 !== void 0 && typeof name2 !== "string") {
-        error(errors, `${path33}/name`, "INVALID_TOOL_RESULT_NAME", "tool_result.name must be a string.");
+        error(errors, `${path34}/name`, "INVALID_TOOL_RESULT_NAME", "tool_result.name must be a string.");
       }
       if (typeof content !== "string") {
-        error(errors, `${path33}/content`, "INVALID_TOOL_RESULT_CONTENT", "tool_result.content must be a string.");
+        error(errors, `${path34}/content`, "INVALID_TOOL_RESULT_CONTENT", "tool_result.content must be a string.");
       } else if (content.length > MAX_STRING_LENGTH) {
-        error(errors, `${path33}/content`, "TOOL_RESULT_TOO_LARGE", "tool_result.content is too large.");
+        error(errors, `${path34}/content`, "TOOL_RESULT_TOO_LARGE", "tool_result.content is too large.");
       }
       if (isError !== void 0 && typeof isError !== "boolean") {
-        error(errors, `${path33}/is_error`, "INVALID_TOOL_RESULT_ERROR", "tool_result.is_error must be boolean.");
+        error(errors, `${path34}/is_error`, "INVALID_TOOL_RESULT_ERROR", "tool_result.is_error must be boolean.");
       }
       if (typeof toolUseId !== "string" || toolUseId.length === 0 || typeof content !== "string") return void 0;
       return {
@@ -4471,25 +4471,25 @@ function validateBlock(value, path33, errors) {
     case "image": {
       const source = value["source"];
       if (!isRecord3(source)) {
-        error(errors, `${path33}/source`, "INVALID_IMAGE_SOURCE", "image.source must be an object.");
+        error(errors, `${path34}/source`, "INVALID_IMAGE_SOURCE", "image.source must be an object.");
         return void 0;
       }
       const sourceType = source["type"];
       if (sourceType !== "base64" && sourceType !== "url") {
-        error(errors, `${path33}/source/type`, "INVALID_IMAGE_SOURCE_TYPE", "image.source.type must be base64 or url.");
+        error(errors, `${path34}/source/type`, "INVALID_IMAGE_SOURCE_TYPE", "image.source.type must be base64 or url.");
         return void 0;
       }
       const mediaType = source["media_type"];
       const data = source["data"];
       const url = source["url"];
       if (mediaType !== void 0 && typeof mediaType !== "string") {
-        error(errors, `${path33}/source/media_type`, "INVALID_IMAGE_MEDIA_TYPE", "image.source.media_type must be a string.");
+        error(errors, `${path34}/source/media_type`, "INVALID_IMAGE_MEDIA_TYPE", "image.source.media_type must be a string.");
       }
       if (data !== void 0 && typeof data !== "string") {
-        error(errors, `${path33}/source/data`, "INVALID_IMAGE_DATA", "image.source.data must be a string.");
+        error(errors, `${path34}/source/data`, "INVALID_IMAGE_DATA", "image.source.data must be a string.");
       }
       if (url !== void 0 && typeof url !== "string") {
-        error(errors, `${path33}/source/url`, "INVALID_IMAGE_URL", "image.source.url must be a string.");
+        error(errors, `${path34}/source/url`, "INVALID_IMAGE_URL", "image.source.url must be a string.");
       }
       return {
         type: "image",
@@ -4505,13 +4505,13 @@ function validateBlock(value, path33, errors) {
       const thinking = value["thinking"];
       const signature = value["signature"];
       if (typeof thinking !== "string") {
-        error(errors, `${path33}/thinking`, "INVALID_THINKING", "thinking.thinking must be a string.");
+        error(errors, `${path34}/thinking`, "INVALID_THINKING", "thinking.thinking must be a string.");
         return void 0;
       }
       if (signature !== void 0 && typeof signature !== "string") {
-        error(errors, `${path33}/signature`, "INVALID_THINKING_SIGNATURE", "thinking.signature must be a string.");
+        error(errors, `${path34}/signature`, "INVALID_THINKING_SIGNATURE", "thinking.signature must be a string.");
       }
-      const providerMeta = validateProviderMeta(value["providerMeta"], `${path33}/providerMeta`, errors);
+      const providerMeta = validateProviderMeta(value["providerMeta"], `${path34}/providerMeta`, errors);
       return {
         type: "thinking",
         thinking,
@@ -4520,7 +4520,7 @@ function validateBlock(value, path33, errors) {
       };
     }
     default:
-      error(errors, `${path33}/type`, "UNKNOWN_BLOCK_TYPE", `Unknown content block type: ${String(type)}`);
+      error(errors, `${path34}/type`, "UNKNOWN_BLOCK_TYPE", `Unknown content block type: ${String(type)}`);
       return void 0;
   }
 }
@@ -4538,39 +4538,39 @@ function validateContextEditorMessages(value, currentMessageCount = 0) {
     error(errors, "/messages", "PAYLOAD_TOO_LARGE", "Context editor payload is too large.");
   }
   value.forEach((item, index) => {
-    const path33 = `/messages/${index}`;
+    const path34 = `/messages/${index}`;
     if (!isRecord3(item)) {
-      error(errors, path33, "INVALID_MESSAGE", "Message must be an object.");
+      error(errors, path34, "INVALID_MESSAGE", "Message must be an object.");
       return;
     }
     const role = item["role"];
     if (!isMessageRole(role)) {
-      error(errors, `${path33}/role`, "INVALID_ROLE", "Message role must be user, assistant, or system.");
+      error(errors, `${path34}/role`, "INVALID_ROLE", "Message role must be user, assistant, or system.");
       return;
     }
     const rawContent = item["content"];
     let content;
     if (typeof rawContent === "string") {
       if (rawContent.length > MAX_STRING_LENGTH) {
-        error(errors, `${path33}/content`, "CONTENT_TOO_LARGE", "Message content is too large.");
+        error(errors, `${path34}/content`, "CONTENT_TOO_LARGE", "Message content is too large.");
         return;
       }
       content = rawContent;
     } else if (Array.isArray(rawContent)) {
       const blocks = [];
       rawContent.forEach((block, blockIndex) => {
-        const parsed = validateBlock(block, `${path33}/content/${blockIndex}`, errors);
+        const parsed = validateBlock(block, `${path34}/content/${blockIndex}`, errors);
         if (parsed) blocks.push(parsed);
       });
       content = blocks;
     } else {
-      error(errors, `${path33}/content`, "INVALID_CONTENT", "Message content must be a string or content block array.");
+      error(errors, `${path34}/content`, "INVALID_CONTENT", "Message content must be a string or content block array.");
       return;
     }
     const ts = item["ts"];
     if (ts !== void 0) {
       if (typeof ts !== "string" || Number.isNaN(Date.parse(ts))) {
-        error(errors, `${path33}/ts`, "INVALID_TIMESTAMP", "Message ts must be an ISO-like timestamp string.");
+        error(errors, `${path34}/ts`, "INVALID_TIMESTAMP", "Message ts must be an ISO-like timestamp string.");
         return;
       }
     }
@@ -4944,7 +4944,11 @@ function createConnectionLifecycle(options) {
 }
 
 // src/server/connections-health-route.ts
-import { createChronicleProjectAccess as createChronicleProjectAccess2 } from "@wrongstack/core/chronicle";
+import {
+  ChronicleProjectServerClient,
+  createChronicleProjectAccess as createChronicleProjectAccess2,
+  resolveChronicleProjectServerOptions
+} from "@wrongstack/core/chronicle";
 import {
   isMailboxProjectServerAvailable,
   MailboxProjectServerConnection
@@ -4952,7 +4956,11 @@ import {
 import { resolveWstackPaths as resolveWstackPaths2 } from "@wrongstack/core/utils";
 import { getKanbanServerConnection } from "@wrongstack/kanban";
 import { isSageProjectServerAvailable, SageProjectServerConnection } from "@wrongstack/sage";
-import { checkCodebaseIndexServerHealth, getIndexState } from "@wrongstack/tools";
+import {
+  checkCodebaseIndexServerHealth,
+  getIndexState,
+  shutdownCodebaseIndexServer
+} from "@wrongstack/tools";
 async function handleConnectionsHealthRoute(context, ws, message) {
   if (message.type !== "connections.health") return false;
   try {
@@ -5269,6 +5277,244 @@ async function mailboxHealth(projectRoot) {
     connection.close();
   }
 }
+async function handleConnectionsServiceAction(ws, message, context) {
+  if (message.type !== "connections.service_action") return false;
+  const payload = message.payload;
+  const serviceId = payload?.serviceId;
+  const rawAction = payload?.action ?? "shutdown";
+  if (!serviceId) {
+    context.send(ws, {
+      type: "connections.service_action_result",
+      payload: {
+        serviceId: null,
+        action: rawAction,
+        success: false,
+        message: "Missing serviceId in payload"
+      }
+    });
+    return true;
+  }
+  if (rawAction !== "shutdown") {
+    context.send(ws, {
+      type: "connections.service_action_result",
+      payload: {
+        serviceId,
+        action: rawAction,
+        success: false,
+        message: `Unsupported action "${rawAction}" \u2014 only "shutdown" is currently supported`
+      }
+    });
+    return true;
+  }
+  const action = rawAction;
+  if (serviceId === "webui") {
+    context.send(ws, {
+      type: "connections.service_action_result",
+      payload: {
+        serviceId: "webui",
+        action,
+        success: false,
+        message: "Cannot shut down the WebUI transport itself"
+      }
+    });
+    return true;
+  }
+  try {
+    const result = await executeServiceAction(
+      serviceId,
+      action,
+      context.getProjectRoot(),
+      context.getIndexDir()
+    );
+    context.send(ws, {
+      type: "connections.service_action_result",
+      payload: result
+    });
+  } catch (error2) {
+    context.send(ws, {
+      type: "connections.service_action_result",
+      payload: {
+        serviceId,
+        action,
+        success: false,
+        message: error2 instanceof Error ? error2.message : String(error2)
+      }
+    });
+  }
+  return true;
+}
+async function executeServiceAction(serviceId, action, projectRoot, indexDir) {
+  switch (serviceId) {
+    case "kanban":
+      return killKanbanServer(projectRoot, action);
+    case "sage":
+      return killSageServer(projectRoot, action);
+    case "chronicle":
+      return killChronicleServer(projectRoot, action);
+    case "codebase-index":
+      return killCodebaseIndexServer(projectRoot, indexDir, action);
+    case "mailbox":
+      return killMailboxServer(projectRoot, action);
+    default:
+      return {
+        serviceId,
+        action,
+        success: false,
+        message: `Unknown service: ${serviceId}`
+      };
+  }
+}
+async function killKanbanServer(projectRoot, action) {
+  if (process.env["WRONGSTACK_KANBAN_SERVER"] === "0") {
+    return {
+      serviceId: "kanban",
+      action,
+      success: false,
+      message: "Kanban IPC daemon is disabled via WRONGSTACK_KANBAN_SERVER=0"
+    };
+  }
+  let connection;
+  try {
+    connection = await getKanbanServerConnection(projectRoot);
+  } catch (error2) {
+    return {
+      serviceId: "kanban",
+      action,
+      success: false,
+      message: error2 instanceof Error ? error2.message : String(error2)
+    };
+  }
+  if (!connection) {
+    return {
+      serviceId: "kanban",
+      action,
+      success: false,
+      message: "Kanban IPC daemon is not running"
+    };
+  }
+  try {
+    const result = await connection.request("shutdown", {
+      reason: `WebUI request: ${action}`
+    });
+    return {
+      serviceId: "kanban",
+      action,
+      success: result.stopping,
+      message: result.stopping ? `Kanban IPC daemon ${action} requested` : `Kanban IPC daemon ${action} failed (shutdown not confirmed)`
+    };
+  } catch (error2) {
+    return {
+      serviceId: "kanban",
+      action,
+      success: false,
+      message: error2 instanceof Error ? error2.message : String(error2)
+    };
+  }
+}
+async function killSageServer(projectRoot, action) {
+  if (!isSageProjectServerAvailable()) {
+    return {
+      serviceId: "sage",
+      action,
+      success: false,
+      message: "SAGE project server is unavailable in this runtime"
+    };
+  }
+  const connection = new SageProjectServerConnection(projectRoot);
+  try {
+    const result = await connection.shutdown(`WebUI request: ${action}`);
+    return {
+      serviceId: "sage",
+      action,
+      success: result.stopped,
+      message: result.stopped ? `SAGE memory server ${action} requested` : `SAGE memory server ${action} failed: ${result.reason ?? "unknown"}`
+    };
+  } catch (error2) {
+    return {
+      serviceId: "sage",
+      action,
+      success: false,
+      message: error2 instanceof Error ? error2.message : String(error2)
+    };
+  } finally {
+    connection.close();
+  }
+}
+async function killChronicleServer(projectRoot, action) {
+  const options = resolveChronicleProjectServerOptions({ projectRoot });
+  const client = new ChronicleProjectServerClient(options);
+  try {
+    const result = await client.shutdown(`WebUI request: ${action}`);
+    return {
+      serviceId: "chronicle",
+      action,
+      success: result.stopped,
+      message: result.stopped ? `Chronicle telemetry server ${action} requested` : `Chronicle telemetry server ${action} failed: ${result.reason ?? "unknown"}`
+    };
+  } catch (error2) {
+    return {
+      serviceId: "chronicle",
+      action,
+      success: false,
+      message: error2 instanceof Error ? error2.message : String(error2)
+    };
+  } finally {
+    client.close();
+  }
+}
+async function killCodebaseIndexServer(projectRoot, indexDir, action) {
+  try {
+    const result = await shutdownCodebaseIndexServer(
+      projectRoot,
+      indexDir,
+      `websocket-request:${action}`
+    );
+    return {
+      serviceId: "codebase-index",
+      action,
+      success: result.stopped,
+      message: result.stopped ? `Codebase index server ${action} requested` : `Codebase index server ${action} failed: ${result.reason ?? "unknown"}`
+    };
+  } catch (error2) {
+    return {
+      serviceId: "codebase-index",
+      action,
+      success: false,
+      message: error2 instanceof Error ? error2.message : String(error2)
+    };
+  }
+}
+async function killMailboxServer(projectRoot, action) {
+  if (!isMailboxProjectServerAvailable()) {
+    return {
+      serviceId: "mailbox",
+      action,
+      success: false,
+      message: "Mailbox project server is unavailable in this runtime"
+    };
+  }
+  const connection = new MailboxProjectServerConnection(
+    resolveWstackPaths2({ projectRoot }).projectDir
+  );
+  try {
+    const result = await connection.shutdown(`WebUI request: ${action}`);
+    return {
+      serviceId: "mailbox",
+      action,
+      success: result.stopped,
+      message: result.stopped ? `Mailbox IPC server ${action} requested` : `Mailbox IPC server ${action} failed: ${result.reason ?? "unknown"}`
+    };
+  } catch (error2) {
+    return {
+      serviceId: "mailbox",
+      action,
+      success: false,
+      message: error2 instanceof Error ? error2.message : String(error2)
+    };
+  } finally {
+    connection.close();
+  }
+}
 function failureService(id, label, required, mode, error2, latencyMs) {
   const message = error2 instanceof Error ? error2.message : String(error2);
   return {
@@ -5429,9 +5675,9 @@ async function handleGitInfo(ws, projectRoot) {
   const cwd = projectRoot || void 0;
   try {
     const { execFile: ef } = await import("node:child_process");
-    const git = (args) => new Promise((resolve15) => {
+    const git = (args) => new Promise((resolve16) => {
       ef("git", args, { cwd, timeout: 3e3 }, (err, stdout) => {
-        resolve15(err ? "" : stdout.trim());
+        resolve16(err ? "" : stdout.trim());
       });
     });
     const [branchRaw, diffRaw, statusRaw, upstreamRaw] = await Promise.all([
@@ -5457,12 +5703,12 @@ async function handleGitInfo(ws, projectRoot) {
 function makeGit(cwd) {
   return async (args) => {
     const { execFile: ef } = await import("node:child_process");
-    return new Promise((resolve15) => {
+    return new Promise((resolve16) => {
       ef(
         "git",
         args,
         { cwd, timeout: 5e3, maxBuffer: 1024 * 1024 * 16 },
-        (err, stdout) => resolve15(err ? "" : stdout)
+        (err, stdout) => resolve16(err ? "" : stdout)
       );
     });
   };
@@ -5486,15 +5732,15 @@ async function handleGitChanges(ws, projectRoot) {
         if (!m) continue;
         const added = m[1] === "-" ? 0 : Number(m[1]);
         const deleted = m[2] === "-" ? 0 : Number(m[2]);
-        let path33 = m[3] ?? "";
-        if (path33 === "") {
+        let path34 = m[3] ?? "";
+        if (path34 === "") {
           i += 1;
-          path33 = parts[i + 1] ?? parts[i] ?? "";
+          path34 = parts[i + 1] ?? parts[i] ?? "";
           i += 1;
         }
-        if (!path33) continue;
-        const prev = counts.get(path33) ?? { added: 0, deleted: 0 };
-        counts.set(path33, { added: prev.added + added, deleted: prev.deleted + deleted });
+        if (!path34) continue;
+        const prev = counts.get(path34) ?? { added: 0, deleted: 0 };
+        counts.set(path34, { added: prev.added + added, deleted: prev.deleted + deleted });
       }
     };
     parseNumstat(unstagedNumstat);
@@ -5506,7 +5752,7 @@ async function handleGitChanges(ws, projectRoot) {
       if (!rec || rec.length < 3) continue;
       const x = rec[0] ?? " ";
       const y = rec[1] ?? " ";
-      const path33 = rec.slice(3);
+      const path34 = rec.slice(3);
       const isRename = x === "R" || x === "C" || y === "R" || y === "C";
       if (isRename) i += 1;
       let status;
@@ -5518,13 +5764,13 @@ async function handleGitChanges(ws, projectRoot) {
       else if (x === "D" || y === "D") status = "D";
       else status = "M";
       const staged = x !== " " && x !== "?";
-      let added = counts.get(path33)?.added ?? 0;
-      let deleted = counts.get(path33)?.deleted ?? 0;
+      let added = counts.get(path34)?.added ?? 0;
+      let deleted = counts.get(path34)?.deleted ?? 0;
       if (status === "?") {
         added = 0;
         deleted = 0;
       }
-      files.push({ path: path33, status, added, deleted, staged });
+      files.push({ path: path34, status, added, deleted, staged });
     }
     send(ws, { type: "git.changes", payload: { files } });
   } catch (err) {
@@ -5535,10 +5781,10 @@ async function handleGitChanges(ws, projectRoot) {
   }
 }
 var MAX_DIFF_BYTES = 2 * 1024 * 1024;
-async function handleGitDiff(ws, projectRoot, path33) {
+async function handleGitDiff(ws, projectRoot, path34) {
   const cwd = projectRoot || void 0;
-  const reply2 = (extra) => send(ws, { type: "git.diff", payload: { path: path33, ...extra } });
-  if (!path33 || path33.includes("\0") || path33.includes("..") || nodePath.isAbsolute(path33)) {
+  const reply2 = (extra) => send(ws, { type: "git.diff", payload: { path: path34, ...extra } });
+  if (!path34 || path34.includes("\0") || path34.includes("..") || nodePath.isAbsolute(path34)) {
     reply2({ oldText: "", newText: "", error: "invalid path" });
     return;
   }
@@ -5546,10 +5792,10 @@ async function handleGitDiff(ws, projectRoot, path33) {
     const git = makeGit(cwd);
     const { readFile: readFile13 } = await import("node:fs/promises");
     const { join: join18 } = await import("node:path");
-    const oldText = await git(["show", `HEAD:${path33}`]);
+    const oldText = await git(["show", `HEAD:${path34}`]);
     let newText = "";
     try {
-      const abs = cwd ? join18(cwd, path33) : path33;
+      const abs = cwd ? join18(cwd, path34) : path34;
       const buf = await readFile13(abs);
       if (buf.includes(0)) {
         reply2({ oldText: "", newText: "", binary: true });
@@ -5629,7 +5875,7 @@ import { execFile } from "node:child_process";
 var GIT_TIMEOUT_MS = 1e4;
 var GIT_MAX_OUTPUT_BYTES = 1024 * 1024;
 function gitStdout(cwd, args) {
-  return new Promise((resolve15) => {
+  return new Promise((resolve16) => {
     execFile(
       "git",
       [...args],
@@ -5640,7 +5886,7 @@ function gitStdout(cwd, args) {
         timeout: GIT_TIMEOUT_MS,
         maxBuffer: GIT_MAX_OUTPUT_BYTES
       },
-      (error2, stdout) => resolve15(error2 ? null : stdout)
+      (error2, stdout) => resolve16(error2 ? null : stdout)
     );
   });
 }
@@ -5906,13 +6152,13 @@ var GoalWebSocketHandler = class {
         const cwd = env?.cwd ?? this.projectRoot;
         try {
           const { exec } = await import("node:child_process");
-          const result = await new Promise((resolve15) => {
+          const result = await new Promise((resolve16) => {
             exec("npx tsc --noEmit", { cwd, timeout: 6e4 }, (err, stdout, stderr) => {
               if (err && err.code === "ENOENT") {
-                resolve15("[verify] tsc not found \u2014 skipping");
+                resolve16("[verify] tsc not found \u2014 skipping");
                 return;
               }
-              resolve15(stdout + stderr);
+              resolve16(stdout + stderr);
             });
           });
           if (result.includes("[verify]") || result.trim().length === 0) {
@@ -6591,7 +6837,7 @@ function pushEvent(event) {
   }
 }
 function parseBody(req) {
-  return new Promise((resolve15, reject) => {
+  return new Promise((resolve16, reject) => {
     let body = "";
     let bodyBytes = 0;
     let tooLarge = false;
@@ -6611,7 +6857,7 @@ function parseBody(req) {
         return;
       }
       try {
-        resolve15(JSON.parse(body));
+        resolve16(JSON.parse(body));
       } catch {
         reject(new Error("Invalid JSON"));
       }
@@ -6696,7 +6942,7 @@ function getAnalyticsBuffer() {
 // src/server/http-server.ts
 import * as fs9 from "node:fs/promises";
 import * as http from "node:http";
-import * as path11 from "node:path";
+import * as path12 from "node:path";
 import * as v8 from "node:v8";
 import { getIndexState as getIndexState2 } from "@wrongstack/tools";
 
@@ -6776,6 +7022,156 @@ async function handleCodemapSymbols(res, deps2, file) {
   );
 }
 
+// src/server/deadcode-handlers.ts
+import * as path10 from "node:path";
+import { runDeadCodeScan } from "@wrongstack/tools/codebase-index";
+var MAX_BODY_BYTES = 10 * 1024 * 1024;
+function readJsonBody(req) {
+  return new Promise((resolve16, reject) => {
+    const chunks = [];
+    let total = 0;
+    req.on("data", (chunk) => {
+      total += chunk.length;
+      if (total > MAX_BODY_BYTES) {
+        req.destroy(new Error("Request body too large"));
+        reject(new Error("Request body exceeds 10 MiB limit"));
+        return;
+      }
+      chunks.push(chunk);
+    });
+    req.on("end", () => resolve16(Buffer.concat(chunks).toString("utf8")));
+    req.on("error", (err) => reject(err));
+  });
+}
+async function handleDeadCodeScan(res, deps2, req) {
+  try {
+    let body = {};
+    const raw = await readJsonBody(req);
+    if (raw) {
+      try {
+        body = JSON.parse(raw);
+      } catch {
+        res.writeHead(400, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ error: "Invalid JSON body" }));
+        return;
+      }
+    }
+    const scanIndexDir = body.indexDir ?? deps2.indexDir;
+    if (scanIndexDir) {
+      const resolvedRoot = path10.resolve(deps2.projectRoot);
+      const resolvedIndex = path10.resolve(deps2.projectRoot, scanIndexDir);
+      if (resolvedIndex !== resolvedRoot && !resolvedIndex.startsWith(resolvedRoot + path10.sep)) {
+        res.writeHead(400, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ error: "Invalid indexDir: must be within project root" }));
+        return;
+      }
+    }
+    const result = runDeadCodeScan(deps2.projectRoot, {
+      indexDir: scanIndexDir,
+      userEntryPoints: body.entryPoints
+    });
+    res.writeHead(200, { "Content-Type": "application/json" });
+    res.end(JSON.stringify(result));
+  } catch (err) {
+    res.writeHead(500, { "Content-Type": "application/json" });
+    res.end(
+      JSON.stringify({
+        error: "Dead-code scan failed",
+        detail: err instanceof Error ? err.message : String(err)
+      })
+    );
+  }
+}
+function handleDeadCodeActionPlan(res, _deps, req) {
+  return readJsonBody(req).then((raw) => {
+    let parsed;
+    try {
+      parsed = JSON.parse(raw);
+    } catch {
+      res.writeHead(400, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ error: "Invalid scan result JSON" }));
+      return;
+    }
+    if (!parsed || typeof parsed !== "object" || !Array.isArray(parsed.deadPackages) || !Array.isArray(parsed.deadFiles) || !Array.isArray(parsed.deadSymbols)) {
+      res.writeHead(400, { "Content-Type": "application/json" });
+      res.end(
+        JSON.stringify({
+          error: "Invalid scan result: missing or malformed required fields (deadPackages, deadFiles, deadSymbols)"
+        })
+      );
+      return;
+    }
+    const result = parsed;
+    const plan = buildActionPlan(result);
+    res.writeHead(200, { "Content-Type": "application/json" });
+    res.end(JSON.stringify(plan));
+  }).catch((err) => {
+    res.writeHead(500, { "Content-Type": "application/json" });
+    res.end(
+      JSON.stringify({
+        error: "Failed to read request body",
+        detail: err instanceof Error ? err.message : String(err)
+      })
+    );
+  });
+}
+function buildActionPlan(result) {
+  const files = /* @__PURE__ */ new Map();
+  for (const dp of result.deadPackages) {
+    const pseudoFile = {
+      file: `${dp.package}/ (package)`,
+      symbolCount: dp.fileCount,
+      symbols: [`remove package ${dp.package} (${dp.fileCount} files, path: ${dp.path})`],
+      priority: 0
+    };
+    files.set(pseudoFile.file, pseudoFile);
+  }
+  for (const df of result.deadFiles) {
+    const existing = files.get(df.file);
+    if (existing) {
+      if (existing.priority > 1) existing.priority = 1;
+      existing.symbolCount += df.symbolCount;
+      continue;
+    }
+    files.set(df.file, {
+      file: df.file,
+      symbolCount: df.symbolCount,
+      symbols: [`entire file (${df.symbolCount} symbols) is dead`],
+      priority: 1
+    });
+  }
+  const deadInAliveFiles = /* @__PURE__ */ new Map();
+  const deadFileSet = new Set(result.deadFiles.map((df) => df.file));
+  for (const ds of result.deadSymbols) {
+    if (deadFileSet.has(ds.file)) continue;
+    const list = deadInAliveFiles.get(ds.file) ?? [];
+    list.push(`${ds.kind} ${ds.name} (line ${ds.line})`);
+    deadInAliveFiles.set(ds.file, list);
+  }
+  for (const [file, symbols] of deadInAliveFiles) {
+    const existing = files.get(file);
+    if (existing) {
+      existing.symbols.push(...symbols);
+      existing.symbolCount += symbols.length;
+      continue;
+    }
+    files.set(file, {
+      file,
+      symbolCount: symbols.length,
+      symbols,
+      priority: 2
+    });
+  }
+  const sorted = [...files.values()].sort((a, b) => a.priority - b.priority || a.file.localeCompare(b.file));
+  return {
+    summary: `Dead-code scan found ${result.stats.dead} dead symbols across ${result.deadFiles.length} dead files and ${result.deadPackages.length} dead packages. Action plan has ${sorted.length} file group(s) to address.`,
+    files: sorted,
+    totalDeadSymbols: result.stats.dead,
+    totalDeadFiles: result.deadFiles.length,
+    totalDeadPackages: result.deadPackages.length
+  };
+}
+
 // src/server/http-server/api-handlers.ts
 async function handleApiSessions(res, globalRoot) {
   if (!globalRoot) {
@@ -6997,8 +7393,8 @@ async function handleApiSessionEvents(res, globalRoot, sessionId, limit) {
     res.end(JSON.stringify({ error: String(err) }));
   }
 }
-function readJsonBody(req) {
-  return new Promise((resolve15, reject) => {
+function readJsonBody2(req) {
+  return new Promise((resolve16, reject) => {
     let data = "";
     req.on("data", (chunk) => {
       data += chunk;
@@ -7009,7 +7405,7 @@ function readJsonBody(req) {
     });
     req.on("end", () => {
       try {
-        resolve15(data ? JSON.parse(data) : {});
+        resolve16(data ? JSON.parse(data) : {});
       } catch (err) {
         reject(err instanceof Error ? err : new Error(String(err)));
       }
@@ -7025,7 +7421,7 @@ async function handleApiSessionMessage(res, req, globalRoot, sessionId) {
   }
   let body;
   try {
-    body = await readJsonBody(req);
+    body = await readJsonBody2(req);
   } catch {
     res.writeHead(400, { "Content-Type": "application/json" });
     res.end(JSON.stringify({ error: "Invalid request body" }));
@@ -7127,7 +7523,7 @@ async function handleApiSessionInterrupt(res, req, globalRoot, sessionId) {
   }
   let body = {};
   try {
-    body = await readJsonBody(req);
+    body = await readJsonBody2(req);
   } catch {
   }
   const reason = typeof body["reason"] === "string" && body["reason"].trim() ? body["reason"].trim() : "Operator requested stop from Fleet HQ";
@@ -7168,7 +7564,7 @@ async function handleApiFleetBroadcast(res, req, globalRoot) {
   }
   let body;
   try {
-    body = await readJsonBody(req);
+    body = await readJsonBody2(req);
   } catch {
     res.writeHead(400, { "Content-Type": "application/json" });
     res.end(JSON.stringify({ error: "Invalid request body" }));
@@ -7232,12 +7628,12 @@ async function handleApiFleetBroadcast(res, req, globalRoot) {
 
 // src/server/projects-manifest.ts
 import * as fs8 from "node:fs/promises";
-import * as path10 from "node:path";
+import * as path11 from "node:path";
 import { ConfigError } from "@wrongstack/core/types";
 import { projectSlug, withFileLock } from "@wrongstack/core/utils";
 function projectsJsonPath(globalConfigPath) {
-  const base = path10.dirname(globalConfigPath);
-  return path10.join(base, "projects.json");
+  const base = path11.dirname(globalConfigPath);
+  return path11.join(base, "projects.json");
 }
 async function loadManifest(globalConfigPath) {
   try {
@@ -7250,37 +7646,37 @@ async function loadManifest(globalConfigPath) {
 }
 async function saveManifest(manifest, globalConfigPath) {
   const file = projectsJsonPath(globalConfigPath);
-  await fs8.mkdir(path10.dirname(file), { recursive: true });
+  await fs8.mkdir(path11.dirname(file), { recursive: true });
   await fs8.writeFile(file, JSON.stringify(manifest, null, 2), "utf8");
 }
 function generateProjectSlug(rootPath) {
   return projectSlug(rootPath);
 }
 async function ensureProjectDataDir(slug, globalConfigPath) {
-  const base = path10.dirname(globalConfigPath);
-  const dir = path10.join(base, "projects", slug);
+  const base = path11.dirname(globalConfigPath);
+  const dir = path11.join(base, "projects", slug);
   await fs8.mkdir(dir, { recursive: true });
   return dir;
 }
 async function touchProjectInManifest(options, globalConfigPath) {
-  const root = path10.resolve(options.projectRoot);
+  const root = path11.resolve(options.projectRoot);
   const file = projectsJsonPath(globalConfigPath);
   let entry;
   await withFileLock(file, async () => {
     const manifest = await loadManifest(globalConfigPath);
     const now = (/* @__PURE__ */ new Date()).toISOString();
-    entry = manifest.projects.find((candidate) => path10.resolve(candidate.root) === root);
+    entry = manifest.projects.find((candidate) => path11.resolve(candidate.root) === root);
     if (entry) {
       entry.lastSeen = now;
-      if (options.workingDir) entry.lastWorkingDir = path10.resolve(options.workingDir);
+      if (options.workingDir) entry.lastWorkingDir = path11.resolve(options.workingDir);
     } else {
       entry = {
-        name: options.name ?? path10.basename(root),
+        name: options.name ?? path11.basename(root),
         root,
         slug: generateProjectSlug(root),
         createdAt: now,
         lastSeen: now,
-        lastWorkingDir: options.workingDir ? path10.resolve(options.workingDir) : void 0
+        lastWorkingDir: options.workingDir ? path11.resolve(options.workingDir) : void 0
       };
       manifest.projects.push(entry);
     }
@@ -7691,9 +8087,9 @@ function buildCspHeader(publicWsUrl, host, port) {
   return `default-src 'self'; script-src ${scriptSrc}; style-src 'self' 'unsafe-inline'; connect-src ${Array.from(connect).join(" ")}; img-src 'self' data:; font-src 'self' data:; worker-src 'self' blob:; object-src 'none'; base-uri 'self'; frame-ancestors 'none'; form-action 'self'`;
 }
 function isInsideDist(candidate, distDir) {
-  const root = path11.resolve(distDir);
-  const resolved = path11.resolve(candidate);
-  return resolved === root || resolved.startsWith(root + path11.sep);
+  const root = path12.resolve(distDir);
+  const resolved = path12.resolve(candidate);
+  return resolved === root || resolved.startsWith(root + path12.sep);
 }
 function decodeSessionId(segment) {
   try {
@@ -7713,7 +8109,7 @@ function strictDecodeParam(segment, res) {
 }
 function createHttpServer(opts) {
   const port = opts.port ?? Number.parseInt(process.env["PORT"] ?? "3456", 10);
-  const distDir = path11.resolve(opts.distDir);
+  const distDir = path12.resolve(opts.distDir);
   const requireAccessToken = Boolean(opts.requireToken) || !isLoopbackBind(opts.host);
   let techStackRuntime = null;
   const getTechStackRuntime = async () => {
@@ -7932,6 +8328,42 @@ function createHttpServer(opts) {
         );
         return;
       }
+      if (url.pathname === "/api/deadcode/scan" && req.method === "POST") {
+        if (requireAccessToken && !accessTokenOk) {
+          res.writeHead(401, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ error: "Unauthorized" }));
+          return;
+        }
+        if (!opts.projectRoot) {
+          res.writeHead(503, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ error: "Project root not configured" }));
+          return;
+        }
+        const deadCodeDeps = {
+          projectRoot: opts.projectRoot,
+          ...opts.indexDir ? { indexDir: opts.indexDir } : {}
+        };
+        await handleDeadCodeScan(res, deadCodeDeps, req);
+        return;
+      }
+      if (url.pathname === "/api/deadcode/action-plan" && req.method === "POST") {
+        if (requireAccessToken && !accessTokenOk) {
+          res.writeHead(401, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ error: "Unauthorized" }));
+          return;
+        }
+        if (!opts.projectRoot) {
+          res.writeHead(503, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ error: "Project root not configured" }));
+          return;
+        }
+        const deadCodeDeps = {
+          projectRoot: opts.projectRoot,
+          ...opts.indexDir ? { indexDir: opts.indexDir } : {}
+        };
+        await handleDeadCodeActionPlan(res, deadCodeDeps, req);
+        return;
+      }
       if (url.pathname.startsWith("/api/techstack/")) {
         if (requireAccessToken && !accessTokenOk) {
           res.writeHead(401, { "Content-Type": "application/json" });
@@ -8064,17 +8496,17 @@ function createHttpServer(opts) {
       }
       let filePath;
       if (url.pathname === "/" || url.pathname === "") {
-        filePath = path11.join(distDir, "index.html");
+        filePath = path12.join(distDir, "index.html");
       } else {
-        filePath = path11.join(distDir, url.pathname);
+        filePath = path12.join(distDir, url.pathname);
       }
-      const resolvedPath = path11.resolve(filePath);
+      const resolvedPath = path12.resolve(filePath);
       if (!isInsideDist(resolvedPath, distDir)) {
         res.writeHead(403, { "Content-Type": "text/plain" });
         res.end("Forbidden");
         return;
       }
-      const ext = path11.extname(resolvedPath);
+      const ext = path12.extname(resolvedPath);
       const contentType = MIME_TYPES[ext] ?? "application/octet-stream";
       res.setHeader("Content-Type", contentType);
       setStaticSecurityHeaders(res);
@@ -8098,7 +8530,7 @@ function createHttpServer(opts) {
     } catch (err) {
       if (err.code === "ENOENT") {
         try {
-          const html = await fs9.readFile(path11.join(distDir, "index.html"), "utf8");
+          const html = await fs9.readFile(path12.join(distDir, "index.html"), "utf8");
           setStaticSecurityHeaders(res);
           res.writeHead(200, {
             "Content-Type": "text/html",
@@ -8128,14 +8560,14 @@ function createHttpServer(opts) {
 
 // src/server/instance-registry.ts
 import * as os from "node:os";
-import * as path12 from "node:path";
+import * as path13 from "node:path";
 import * as fs10 from "node:fs/promises";
 import { atomicWrite as atomicWrite4 } from "@wrongstack/core/utils";
 function defaultBaseDir() {
-  return path12.join(os.homedir(), ".wrongstack");
+  return path13.join(os.homedir(), ".wrongstack");
 }
 function registryPath(baseDir = defaultBaseDir()) {
-  return path12.join(baseDir, "webui-instances.json");
+  return path13.join(baseDir, "webui-instances.json");
 }
 function isPidAlive(pid) {
   if (!Number.isInteger(pid) || pid <= 0) return false;
@@ -11610,16 +12042,16 @@ function getSurfaceDefaultPorts(surface) {
   return { http: SURFACE_DEFAULT_PORTS[surface].http };
 }
 function isPortFree(host, port) {
-  return new Promise((resolve15) => {
+  return new Promise((resolve16) => {
     const srv = net.createServer();
-    srv.once("error", () => resolve15(false));
+    srv.once("error", () => resolve16(false));
     srv.once("listening", () => {
-      srv.close(() => resolve15(true));
+      srv.close(() => resolve16(true));
     });
     try {
       srv.listen(port, host);
     } catch {
-      resolve15(false);
+      resolve16(false);
     }
   });
 }
@@ -11644,10 +12076,10 @@ async function findFreePort(host, startPort, opts = {}) {
 import { spawn as spawn2 } from "node:child_process";
 import { existsSync } from "node:fs";
 import { findPackageJSON } from "node:module";
-import * as path13 from "node:path";
+import * as path14 from "node:path";
 function resolveDistDir(input) {
   const options = typeof input === "string" ? { explicitDistDir: input } : input ?? {};
-  if (options.explicitDistDir) return path13.resolve(options.explicitDistDir);
+  if (options.explicitDistDir) return path14.resolve(options.explicitDistDir);
   const exists = options.exists ?? existsSync;
   let packageTarget;
   try {
@@ -11659,15 +12091,15 @@ function resolveDistDir(input) {
     );
   }
   if (!packageTarget) return null;
-  const distDir = path13.basename(packageTarget) === "package.json" ? path13.join(path13.dirname(packageTarget), "dist") : path13.dirname(packageTarget);
+  const distDir = path14.basename(packageTarget) === "package.json" ? path14.join(path14.dirname(packageTarget), "dist") : path14.dirname(packageTarget);
   if (options.exists === void 0 && options.resolvePackageJson) return distDir;
-  return exists(path13.join(distDir, "index.html")) ? distDir : null;
+  return exists(path14.join(distDir, "index.html")) ? distDir : null;
 }
 async function ensureDistDir(explicitDistDir, deps2 = {}) {
   const exists = deps2.exists ?? existsSync;
   if (explicitDistDir) {
-    const resolved2 = path13.resolve(explicitDistDir);
-    return exists(path13.join(resolved2, "index.html")) ? resolved2 : null;
+    const resolved2 = path14.resolve(explicitDistDir);
+    return exists(path14.join(resolved2, "index.html")) ? resolved2 : null;
   }
   const resolveOptions = {
     resolvePackageJson: deps2.resolvePackageJson,
@@ -11679,7 +12111,7 @@ async function ensureDistDir(explicitDistDir, deps2 = {}) {
   try {
     const packageJson = deps2.resolvePackageJson ? deps2.resolvePackageJson("@wrongstack/webui/package.json") : findPackageJSON("@wrongstack/webui", import.meta.url);
     if (!packageJson) throw new Error("not found");
-    packageDir = path13.dirname(packageJson);
+    packageDir = path14.dirname(packageJson);
   } catch {
     throw new Error(
       "@wrongstack/webui package could not be resolved. Install workspace dependencies and rebuild the CLI."
@@ -11688,8 +12120,8 @@ async function ensureDistDir(explicitDistDir, deps2 = {}) {
   const findRoot = deps2.findWorkspaceRoot ?? ((pkgDir) => {
     let dir = pkgDir;
     for (let i = 0; i < 10; i++) {
-      if (existsSync(path13.join(dir, "pnpm-workspace.yaml"))) return dir;
-      const parent = path13.dirname(dir);
+      if (existsSync(path14.join(dir, "pnpm-workspace.yaml"))) return dir;
+      const parent = path14.dirname(dir);
       if (parent === dir) return null;
       dir = parent;
     }
@@ -11748,7 +12180,7 @@ async function startStaticServe(opts, deps2 = {}) {
   return { server, port: opts.httpPort };
 }
 function runPnpmBuild(cwd, workspace, timeoutMs) {
-  return new Promise((resolve15, reject) => {
+  return new Promise((resolve16, reject) => {
     const child = spawn2("pnpm", ["--filter", workspace, "build"], {
       cwd,
       shell: process.platform === "win32",
@@ -11766,14 +12198,14 @@ function runPnpmBuild(cwd, workspace, timeoutMs) {
     });
     child.once("close", (code) => {
       clearTimeout(timer);
-      if (code === 0) resolve15();
+      if (code === 0) resolve16();
       else reject(new Error(`pnpm build exited with code ${String(code)}`));
     });
   });
 }
 
 // src/server/embedded-lifecycle.ts
-import * as path14 from "node:path";
+import * as path15 from "node:path";
 
 // src/server/network-info.ts
 import * as os2 from "node:os";
@@ -11839,7 +12271,7 @@ function registerWebuiInstance(p, deps2 = {}) {
       httpPort: p.httpPort,
       host: p.host,
       projectRoot: p.projectRoot,
-      projectName: path14.basename(p.projectRoot) || p.projectRoot,
+      projectName: path15.basename(p.projectRoot) || p.projectRoot,
       startedAt: p.startedAt,
       url: buildWebUIAccessUrl({
         host: p.host,
@@ -12059,7 +12491,7 @@ ${text2}` : text2;
 
 // src/server/client-presence.ts
 import * as crypto2 from "node:crypto";
-import * as path15 from "node:path";
+import * as path16 from "node:path";
 import {
   getSharedProjectMailbox as getSharedProjectMailbox2,
   resolveProjectDir as resolveProjectDir2
@@ -12077,7 +12509,7 @@ function createWebuiClientPresence(deps2) {
     if (!deps2.projectRoot) return null;
     try {
       const projectRoot = deps2.projectRoot;
-      const projectName = path15.basename(projectRoot);
+      const projectName = path16.basename(projectRoot);
       const nextMailbox = getSharedProjectMailbox2(
         resolveProjectDir2(projectRoot, wstackGlobalRoot()),
         deps2.events,
@@ -13035,7 +13467,7 @@ function seedContextMeta(config, context) {
   meta["autoReviewModel"] = autoReviewExt?.["model"] ?? "";
   meta["autoReviewFallbackProfile"] = autoReviewExt?.["fallbackProfile"] ?? "";
   meta["autoReviewFallbackModels"] = Array.isArray(autoReviewExt?.["fallbackModels"]) ? autoReviewExt?.["fallbackModels"] : [];
-  meta["autoReviewDebounceMs"] = typeof autoReviewExt?.["debounceMs"] === "number" && autoReviewExt["debounceMs"] >= 0 ? autoReviewExt["debounceMs"] : 5e3;
+  meta["autoReviewDebounceMs"] = typeof autoReviewExt?.["debounceMs"] === "number" && autoReviewExt["debounceMs"] >= 0 ? autoReviewExt["debounceMs"] : 15e3;
   meta["autoReviewMaxFilesPerBatch"] = typeof autoReviewExt?.["maxFilesPerBatch"] === "number" && autoReviewExt["maxFilesPerBatch"] >= 1 ? autoReviewExt["maxFilesPerBatch"] : 15;
   meta["autoReviewMaxConcurrentReviews"] = typeof autoReviewExt?.["maxConcurrentReviews"] === "number" && autoReviewExt["maxConcurrentReviews"] >= 1 ? autoReviewExt["maxConcurrentReviews"] : 2;
   const cascade = autoReviewExt?.["cascadeOn"];
@@ -13055,7 +13487,7 @@ function seedContextMeta(config, context) {
 
 // src/server/pref-helpers.ts
 import * as fs12 from "node:fs/promises";
-import * as path16 from "node:path";
+import * as path17 from "node:path";
 import { decryptConfigSecrets as decryptConfigSecrets2, encryptConfigSecrets } from "@wrongstack/core/security";
 import { atomicWrite as atomicWrite6, backupConfigFile, FORBIDDEN_PROTO_KEYS as FORBIDDEN_PROTO_KEYS2 } from "@wrongstack/core/utils";
 var PREF_KEYS = [
@@ -13151,7 +13583,7 @@ function prefSnapshot(contextMeta) {
   return snapshot;
 }
 async function writeGlobalConfigFile(filePath, vault, mutate, logger, errorLabel) {
-  const globalRoot = path16.dirname(filePath);
+  const globalRoot = path17.dirname(filePath);
   await backupConfigFile(filePath, { globalRoot });
   let raw;
   try {
@@ -13631,7 +14063,7 @@ async function handleProcessRoute(ws, msg, handlers) {
 
 // src/server/embedded-host-adapters.ts
 import * as fs15 from "node:fs/promises";
-import * as path18 from "node:path";
+import * as path19 from "node:path";
 import { TOKENS } from "@wrongstack/core/kernel";
 import { DefaultSessionStore as DefaultSessionStore2 } from "@wrongstack/core/storage";
 import { toErrorMessage as toErrorMessage7, wstackGlobalRoot as wstackGlobalRoot2 } from "@wrongstack/core/utils";
@@ -13639,7 +14071,7 @@ import { makeProviderFromConfig } from "@wrongstack/providers";
 
 // src/server/project-handlers.ts
 import * as fs13 from "node:fs/promises";
-import * as path17 from "node:path";
+import * as path18 from "node:path";
 import { DefaultSessionStore } from "@wrongstack/core/storage";
 import { resolveWstackPaths as resolveWstackPaths4 } from "@wrongstack/core/utils";
 function createProjectHandlers(ctx) {
@@ -13691,8 +14123,8 @@ function createProjectHandlers(ctx) {
         });
         return;
       }
-      const resolved = path17.resolve(parsed.value.root);
-      const name2 = parsed.value.name?.trim() || path17.basename(resolved);
+      const resolved = path18.resolve(parsed.value.root);
+      const name2 = parsed.value.name?.trim() || path18.basename(resolved);
       try {
         const stat3 = await fs13.stat(resolved).catch(() => null);
         if (!stat3?.isDirectory()) {
@@ -13703,7 +14135,7 @@ function createProjectHandlers(ctx) {
           return;
         }
         const before = await loadManifest(ctx.globalConfigPath);
-        const already = before.projects.some((project) => path17.resolve(project.root) === resolved);
+        const already = before.projects.some((project) => path18.resolve(project.root) === resolved);
         const entry = await touchProjectInManifest(
           { projectRoot: resolved, workingDir: resolved, name: name2 },
           ctx.globalConfigPath
@@ -13733,8 +14165,8 @@ function createProjectHandlers(ctx) {
         });
         return;
       }
-      const resolved = path17.resolve(parsed.value.root);
-      const name2 = parsed.value.name?.trim() || path17.basename(resolved);
+      const resolved = path18.resolve(parsed.value.root);
+      const name2 = parsed.value.name?.trim() || path18.basename(resolved);
       if (!ctx.allowProjectMutations) {
         sendTo(ws, {
           type: "projects.selected",
@@ -13769,6 +14201,17 @@ function createProjectHandlers(ctx) {
         });
         const previous = ctx.getSession();
         const previousId = previous.id;
+        const previousProjectRoot = ctx.getProjectRoot();
+        const previousPaths = resolveWstackPaths4({
+          projectRoot: previousProjectRoot,
+          globalRoot: ctx.wpaths.globalRoot
+        });
+        const previousIdentityTarget = {
+          projectSlug: previousPaths.projectSlug,
+          projectRoot: previousProjectRoot,
+          projectName: path18.basename(previousProjectRoot),
+          workingDir: ctx.context.workingDir
+        };
         const previousUsage = ctx.tokenCounter.total();
         const config = ctx.getConfig?.() ?? ctx.config;
         const next = await store.create({
@@ -13794,7 +14237,16 @@ function createProjectHandlers(ctx) {
         };
         try {
           await ctx.onSessionSwapped?.(next.id, identityTarget);
+          await ctx.onBeforeSessionTodosReplaced?.(next.id, paths.projectSessions);
         } catch (err) {
+          try {
+            await ctx.onBeforeSessionTodosReplaced?.(previous.id, previousPaths.projectSessions);
+          } catch {
+          }
+          try {
+            await ctx.onSessionSwapped?.(previous.id, previousIdentityTarget);
+          } catch {
+          }
           await next.close().catch(() => void 0);
           await store.delete(next.id).catch(() => void 0);
           throw err;
@@ -14880,6 +15332,7 @@ var CLIENT_WORKSPACE_MESSAGE_TYPES = [
 var CLIENT_CONFIGURATION_MESSAGE_TYPES = [
   "codebase.index.server.shutdown",
   "connections.health",
+  "connections.service_action",
   "diag.get",
   "key.add",
   "key.delete",
@@ -15153,6 +15606,7 @@ var SERVER_CONFIGURATION_MESSAGE_TYPES = [
   "codebase.index.server.shutdown_result",
   "connections.health_error",
   "connections.health_result",
+  "connections.service_action_result",
   "diag.get",
   "key.operation_result",
   "model.switch_result",
@@ -15197,13 +15651,13 @@ function isRegisteredMessageType(type, direction) {
 // src/protocol/decoder.ts
 var FORBIDDEN_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
 var MAX_PAYLOAD_DEPTH = 32;
-function inspectValue(value, path33, depth) {
+function inspectValue(value, path34, depth) {
   if (depth > MAX_PAYLOAD_DEPTH) {
-    return { code: "too_deep", message: "Protocol payload exceeds the nesting limit", path: path33 };
+    return { code: "too_deep", message: "Protocol payload exceeds the nesting limit", path: path34 };
   }
   if (value === null || typeof value !== "object") return null;
   for (const key of Object.keys(value)) {
-    const childPath = `${path33}.${key}`;
+    const childPath = `${path34}.${key}`;
     if (FORBIDDEN_KEYS.has(key)) {
       return { code: "unsafe_key", message: `Unsafe protocol key: ${key}`, path: childPath };
     }
@@ -15344,7 +15798,8 @@ function projectToolMessage(message) {
       name: text(payload["name"]),
       ok: payload["ok"] !== false,
       durationMs: finite(payload["durationMs"]),
-      ...typeof payload["output"] === "string" ? { output: payload["output"] } : {}
+      ...typeof payload["output"] === "string" ? { output: payload["output"] } : {},
+      ...Array.isArray(payload["sage"]) ? { sage: payload["sage"].filter((line) => typeof line === "string") } : {}
     };
   }
   return null;
@@ -15584,6 +16039,7 @@ function createSessionHandlers(ctx) {
     ctx.context.session = next;
     ctx.context.state.replaceMessages(messages);
     await ctx.context.flushConversationJournal?.();
+    await ctx.onBeforeSessionTodosReplaced?.(next.id, sessionsDirectory());
     ctx.context.state.replaceTodos(todos);
     resetContextAccounting();
     ctx.context.readFiles.clear();
@@ -15980,7 +16436,10 @@ function createSessionHandlers(ctx) {
         rollbackClaim = await ctx.claimSession?.(canonicalId);
         const resumed = await store.resume(canonicalId);
         const restoredTodos = await loadTodosCheckpoint(
-          sessionScopedPath(sessionsDirectory(), resumed.writer.id, ".todos.json")
+          sessionScopedPath(sessionsDirectory(), resumed.writer.id, ".todos.json"),
+          ctx.events,
+          ctx.context.traceId,
+          resumed.writer.id
         ).catch(() => null) ?? [];
         activated = true;
         await activateSession(
@@ -16132,7 +16591,7 @@ function createEmbeddedConversationRoutes(ctx) {
 }
 function sessionStoreFor(opts) {
   const projectRoot = opts.projectRoot ?? opts.agent.ctx.projectRoot;
-  return opts.sessionStore ?? new DefaultSessionStore2({ dir: path18.join(projectRoot, ".wrongstack", "sessions"), projectRoot });
+  return opts.sessionStore ?? new DefaultSessionStore2({ dir: path19.join(projectRoot, ".wrongstack", "sessions"), projectRoot });
 }
 function createEmbeddedSessionRoutes(ctx) {
   const { opts } = ctx;
@@ -16142,6 +16601,7 @@ function createEmbeddedSessionRoutes(ctx) {
     config: { model: actx.model ?? "", provider: actx.provider?.id ?? "" },
     getConfig: () => ({ model: actx.model ?? "", provider: actx.provider?.id ?? "" }),
     context: actx,
+    events: opts.events,
     listTools: () => opts.agent.tools.list(),
     getCompactor: () => opts.agent.container.resolve(TOKENS.Compactor),
     getCustomModeStore: ctx.getCustomModeStore,
@@ -16150,11 +16610,12 @@ function createEmbeddedSessionRoutes(ctx) {
     getSession: () => actx.session ?? opts.session,
     getSessionStore: () => sessionStoreFor(opts),
     canSwapSessions: () => opts.sessionStore !== void 0,
-    getSessionsDir: () => opts.sessionsDir ?? path18.join(getProjectRoot(), ".wrongstack", "sessions"),
+    getSessionsDir: () => opts.sessionsDir ?? path19.join(getProjectRoot(), ".wrongstack", "sessions"),
     setSession: (next) => {
       actx.session = next;
     },
     claimSession: opts.claimSession,
+    onBeforeSessionTodosReplaced: async (sessionId, sessionsDir) => opts.onBeforeSessionTodosReplaced?.(sessionId, sessionsDir),
     onSessionSwapped: async (sessionId, target) => opts.onSessionSwapped?.(sessionId, target),
     abortActiveRun: ctx.abortActiveRun,
     isRunActive: ctx.isRunActive,
@@ -16166,7 +16627,7 @@ function createEmbeddedSessionRoutes(ctx) {
 async function broadcastEmbeddedGoalSnapshot(ctx) {
   const projectRoot = ctx.opts.projectRoot ?? ctx.opts.agent.ctx.projectRoot;
   try {
-    const raw = await fs15.readFile(path18.join(projectRoot, ".wrongstack", "goal.json"), "utf8");
+    const raw = await fs15.readFile(path19.join(projectRoot, ".wrongstack", "goal.json"), "utf8");
     ctx.broadcast({ type: "goal-state.updated", payload: JSON.parse(raw) });
   } catch {
     ctx.broadcast({ type: "goal-state.updated", payload: null });
@@ -16175,10 +16636,10 @@ async function broadcastEmbeddedGoalSnapshot(ctx) {
 function createEmbeddedProjectRoutes(ctx) {
   const { opts } = ctx;
   const actx = opts.agent.ctx;
-  const globalConfigPath = opts.globalConfigPath ?? path18.join(wstackGlobalRoot2(), "config.json");
+  const globalConfigPath = opts.globalConfigPath ?? path19.join(wstackGlobalRoot2(), "config.json");
   return createProjectHandlers({
     globalConfigPath,
-    wpaths: { globalRoot: path18.dirname(globalConfigPath) },
+    wpaths: { globalRoot: path19.dirname(globalConfigPath) },
     context: actx,
     tokenCounter: actx.tokenCounter,
     config: { model: actx.model, provider: actx.provider.id },
@@ -16203,6 +16664,7 @@ function createEmbeddedProjectRoutes(ctx) {
       for (const controller of ctx.abortControllers.values()) controller.abort();
       ctx.abortControllers.clear();
     },
+    onBeforeSessionTodosReplaced: async (sessionId, sessionsDir) => opts.onBeforeSessionTodosReplaced?.(sessionId, sessionsDir),
     onSessionSwapped: async (sessionId, target) => opts.onSessionSwapped?.(sessionId, target),
     allowProjectMutations: true,
     sessionStartPayload: ctx.buildSessionStart,
@@ -16658,7 +17120,7 @@ ${String(p.content ?? "")}`;
 };
 
 // src/server/codebase-index-server-control.ts
-import { shutdownCodebaseIndexServer } from "@wrongstack/tools";
+import { shutdownCodebaseIndexServer as shutdownCodebaseIndexServer2 } from "@wrongstack/tools";
 async function handleCodebaseIndexServerControl(ws, message, deps2) {
   if (message.type !== "codebase.index.server.shutdown") return false;
   const requestId = message.payload && typeof message.payload === "object" && typeof message.payload.requestId === "string" ? message.payload.requestId : "";
@@ -16685,7 +17147,7 @@ async function handleCodebaseIndexServerControl(ws, message, deps2) {
     });
     return true;
   }
-  const result = await shutdownCodebaseIndexServer(
+  const result = await shutdownCodebaseIndexServer2(
     projectRoot,
     deps2.getIndexDir(),
     "websocket-request"
@@ -17226,7 +17688,7 @@ function createRouteFamilyDispatcher(options) {
 
 // src/server/shell-open.ts
 import * as fs16 from "node:fs/promises";
-import * as path19 from "node:path";
+import * as path20 from "node:path";
 import { spawn as spawn3 } from "node:child_process";
 function normalizeShellOpenTarget(target) {
   return target === "terminal" ? "terminal" : "file-manager";
@@ -17237,11 +17699,11 @@ function shellQuote(s) {
 }
 async function handleShellOpen(req, logger, options) {
   try {
-    const resolved = path19.resolve(req.path);
+    const resolved = path20.resolve(req.path);
     if (options?.projectRoot) {
-      const root = path19.resolve(options.projectRoot);
-      const relative5 = path19.relative(root, resolved);
-      const escapes = relative5.startsWith("..") || path19.isAbsolute(relative5);
+      const root = path20.resolve(options.projectRoot);
+      const relative5 = path20.relative(root, resolved);
+      const escapes = relative5.startsWith("..") || path20.isAbsolute(relative5);
       if (escapes) {
         return {
           success: false,
@@ -17632,6 +18094,13 @@ function createEmbeddedMessageRouter(deps2) {
       message
     ))
       return;
+    if (await handleConnectionsServiceAction(ws, message, {
+      getProjectRoot: projectRoot,
+      getIndexDir: () => typeof opts.agent.ctx.meta["codebaseIndexDir"] === "string" ? opts.agent.ctx.meta["codebaseIndexDir"] : void 0,
+      send: send2,
+      backend: "cli-embedded"
+    }))
+      return;
     if (await handleCodebaseIndexServerControl(ws, message, {
       trustBoundary: deps2.trustBoundary,
       logger: deps2.logger,
@@ -17646,7 +18115,7 @@ function createEmbeddedMessageRouter(deps2) {
 }
 
 // src/server/provider-config-standalone.ts
-import * as path20 from "node:path";
+import * as path21 from "node:path";
 import { DefaultSecretVault } from "@wrongstack/core/security";
 function createProviderConfigIO(configPath) {
   const keyFile = vaultKeyFileForConfigPath(configPath);
@@ -17657,10 +18126,10 @@ function createProviderConfigIO(configPath) {
   };
 }
 function vaultKeyFileForConfigPath(configPath) {
-  const configDir = path20.dirname(configPath);
-  const parentDir = path20.dirname(configDir);
-  const globalRoot = path20.basename(parentDir) === "profiles" ? path20.dirname(parentDir) : configDir;
-  return path20.join(globalRoot, ".key");
+  const configDir = path21.dirname(configPath);
+  const parentDir = path21.dirname(configDir);
+  const globalRoot = path21.basename(parentDir) === "profiles" ? path21.dirname(parentDir) : configDir;
+  return path21.join(globalRoot, ".key");
 }
 
 // src/server/provider-store.ts
@@ -17677,8 +18146,8 @@ function createConfigWriteLock() {
     acquire() {
       const prev = lock;
       let release = () => void 0;
-      lock = new Promise((resolve15) => {
-        release = resolve15;
+      lock = new Promise((resolve16) => {
+        release = resolve16;
       });
       return { prev, release };
     }
@@ -17756,6 +18225,7 @@ function createProviderStore(deps2) {
 import { listBoards as listBoards5 } from "@wrongstack/kanban";
 import {
   applySddLifecycle,
+  extractVerificationCommand,
   SddBoardStore
 } from "@wrongstack/sdd";
 var CONTROL_TYPES = /* @__PURE__ */ new Set([
@@ -17778,14 +18248,16 @@ var SddBoardWebSocketHandler = class {
   store;
   clients = /* @__PURE__ */ new Set();
   lifecycle;
+  security;
   diskPollingEnabled;
   latest = null;
   poll = null;
   pollInFlight = false;
   unsub = null;
-  constructor(boardsDir, events, lifecycle) {
+  constructor(boardsDir, events, lifecycle, security) {
     this.store = new SddBoardStore({ baseDir: boardsDir });
     this.lifecycle = lifecycle;
+    this.security = security;
     this.diskPollingEnabled = events === void 0;
     if (events) {
       const handler = (e) => {
@@ -17831,6 +18303,43 @@ var SddBoardWebSocketHandler = class {
       return;
     }
     if (CONTROL_TYPES.has(action)) {
+      const verificationCommands = [];
+      if (action === "set_task_verification") {
+        const command = msg.payload?.verificationCommand;
+        if (command !== void 0 && (typeof command !== "string" || command.length > 8192)) return;
+        if (typeof command === "string" && command.trim()) {
+          verificationCommands.push({ command, operation: "sdd.set_task_verification" });
+        }
+      } else if (action === "split_task") {
+        const subtasks = msg.payload?.subtasks;
+        if (Array.isArray(subtasks)) {
+          for (const subtask of subtasks) {
+            if (!subtask || typeof subtask !== "object") continue;
+            const criterion = subtask.successCriterion;
+            if (criterion === void 0) continue;
+            if (typeof criterion !== "string") return;
+            const command = extractVerificationCommand([criterion]);
+            if (!command) continue;
+            if (command.length > 8192) return;
+            verificationCommands.push({ command, operation: "sdd.split_task_verification" });
+          }
+        }
+      }
+      for (const { command, operation } of verificationCommands) {
+        if (!this.security) return;
+        const authorization = await authorizeWebUIAction(
+          this.security.trustBoundary,
+          {
+            capability: "process.spawn",
+            subject: { kind: "command", id: command },
+            risk: "high",
+            cwd: this.lifecycle?.projectRoot,
+            metadata: { operation }
+          },
+          this.security.logger
+        );
+        if (!authorization.allowed) return;
+      }
       const runId = msg.payload?.runId ?? this.latest?.runId ?? (await this.store.list())[0]?.runId;
       if (runId) {
         await this.store.appendControl(runId, {
@@ -17943,7 +18452,7 @@ var SddBoardWebSocketHandler = class {
 };
 
 // src/server/sdd-wizard-wiring.ts
-import * as path21 from "node:path";
+import * as path22 from "node:path";
 import {
   DefaultTaskStore,
   TaskTracker
@@ -18057,7 +18566,7 @@ function buildSddWizardDeps(opts) {
   }).catch(() => {
     projectContext = "";
   });
-  const sessionPath = opts.paths.projectSddSession ?? path21.join(opts.paths.projectDir, "sdd-session.json");
+  const sessionPath = opts.paths.projectSddSession ?? path22.join(opts.paths.projectDir, "sdd-session.json");
   const specStore = new SpecStore({ baseDir: opts.paths.projectSpecs });
   const graphStore = new TaskGraphStore({ baseDir: opts.paths.projectTaskGraphs });
   const runIsolatedTurn = async (prompt, name2) => {
@@ -18339,7 +18848,7 @@ var SddWizardWebSocketHandler = class {
       return;
     }
     const { runId } = await this.deps.startRun(this.driver, opts);
-    this.driver.setLastRunId(runId);
+    await this.driver.setLastRunId(runId);
     if (this.driver.phase() !== "executing" && this.driver.phase() !== "done") {
       try {
         if (this.driver.phase() === "task_review") await this.driver.approve();
@@ -18398,7 +18907,7 @@ var SddWizardWebSocketHandler = class {
       this.lastAgentText = text2;
       if (this.driver) {
         await this.driver.ingestAgentOutput(text2);
-        this.driver.setLastAgentText(text2);
+        await this.driver.setLastAgentText(text2);
       }
       this.broadcast({ type: "sdd.spec.agent_text", payload: { text: text2 } });
     } finally {
@@ -18429,10 +18938,10 @@ import { recordTaskFileActivity } from "@wrongstack/kanban";
 
 // src/server/setup-events-fleet-broadcaster.ts
 import { watch as fsWatch } from "node:fs";
-import * as path22 from "node:path";
+import * as path23 from "node:path";
 function registerSetupEventsFleetBroadcaster(deps2) {
   const { globalConfigPath, wpaths, context, clients, broadcast: broadcast2, onFleetBroadcaster, isDisposed } = deps2;
-  const globalRoot = globalConfigPath ? path22.dirname(globalConfigPath) : void 0;
+  const globalRoot = globalConfigPath ? path23.dirname(globalConfigPath) : void 0;
   if (!globalRoot) return void 0;
   const disposers = [];
   const broadcastSessions = async () => {
@@ -18442,8 +18951,8 @@ function registerSetupEventsFleetBroadcaster(deps2) {
       const sessions = await registry.list();
       const ownEntry = sessions.find((s) => s.pid === process.pid);
       const mySlug = ownEntry?.projectSlug ?? wpaths?.projectSlug;
-      const myRoot = path22.resolve(context.projectRoot);
-      const live = sessions.filter((s) => s.status === "active" || s.status === "idle").filter((s) => mySlug ? s.projectSlug === mySlug : path22.resolve(s.projectRoot) === myRoot).map((s) => ({
+      const myRoot = path23.resolve(context.projectRoot);
+      const live = sessions.filter((s) => s.status === "active" || s.status === "idle").filter((s) => mySlug ? s.projectSlug === mySlug : path23.resolve(s.projectRoot) === myRoot).map((s) => ({
         sessionId: s.sessionId,
         projectName: s.projectName,
         projectSlug: s.projectSlug,
@@ -18634,13 +19143,13 @@ function createSetupEventSessionHelpers(context, sessionBridge) {
 // src/server/setup-events-status-watcher.ts
 import { watch as fsWatch2 } from "node:fs";
 import * as fs18 from "node:fs/promises";
-import * as path24 from "node:path";
+import * as path25 from "node:path";
 
 // src/server/setup-events-watcher.ts
-import * as path23 from "node:path";
+import * as path24 from "node:path";
 function statusProjectHashFromWatchFilename(projectsDir, filename) {
   const raw = String(filename);
-  const relative5 = path23.isAbsolute(raw) ? path23.relative(projectsDir, raw) : raw;
+  const relative5 = path24.isAbsolute(raw) ? path24.relative(projectsDir, raw) : raw;
   const parts = relative5.split(/[\\/]+/).filter(Boolean);
   if (parts.length < 2 || parts.at(-1) !== "status.json") return null;
   return parts.at(-2) ?? null;
@@ -18675,7 +19184,7 @@ function logFileWatcherMetrics(metrics) {
 function registerSetupEventsStatusWatcher(deps2) {
   const { wpaths, watcherMetrics, clients, broadcast: broadcast2, on, isDisposed } = deps2;
   if (!wpaths?.projectStatus || !wpaths.globalRoot) return void 0;
-  const projectsDir = path24.join(wpaths.globalRoot, "projects");
+  const projectsDir = path25.join(wpaths.globalRoot, "projects");
   const knownProjectHashes = /* @__PURE__ */ new Set();
   const debounceTimers = /* @__PURE__ */ new Map();
   const DEBOUNCE_MS2 = 150;
@@ -18734,7 +19243,7 @@ function registerSetupEventsStatusWatcher(deps2) {
           if (!knownProjectHashes.has(projectHash)) return;
           if (watcherMetrics) watcherMetrics.filesProcessed++;
           try {
-            const targetFile = path24.join(projectsDir, projectHash, "status.json");
+            const targetFile = path25.join(projectsDir, projectHash, "status.json");
             const content = await fs18.readFile(targetFile, "utf-8");
             const statusData = JSON.parse(content);
             scheduleBroadcast(projectHash, statusData);
@@ -18793,7 +19302,7 @@ function registerSetupEventsStatusWatcher(deps2) {
 
 // src/server/setup-events-core-watchers.ts
 import * as fs19 from "node:fs/promises";
-import * as path25 from "node:path";
+import * as path26 from "node:path";
 function registerSetupEventsCoreWatchers(deps2) {
   const { broadcast: broadcast2, clients, context } = deps2;
   const disposers = [];
@@ -18829,7 +19338,7 @@ function registerSetupEventsClientStatusWriter(deps2) {
     if (wpaths?.projectStatus) {
       try {
         const statusFile = wpaths.projectStatus(e.projectHash);
-        const dir = path25.dirname(statusFile);
+        const dir = path26.dirname(statusFile);
         await fs19.mkdir(dir, { recursive: true });
         await fs19.writeFile(statusFile, JSON.stringify(e, null, 2), "utf-8");
       } catch (err) {
@@ -19019,6 +19528,9 @@ function setupEvents(deps2) {
         input: scrub(e.input),
         fileTargets: extractCodeMapFileTargets(projectRoot || ".", e.name, e.input),
         output: scrub(e.output),
+        // SAGE-injected memory rides beside the tool text so the client renders
+        // it as a memory card. Never folded back into `output`.
+        ...e.sage && e.sage.length > 0 ? { sage: e.sage.map((line) => scrub(line)) } : {},
         outputBytes: e.outputBytes,
         outputTokens: e.outputTokens,
         outputLines: e.outputLines,
@@ -19853,17 +20365,24 @@ var SpecsWebSocketHandler = class {
 // src/server/start-webui.ts
 import { randomUUID as randomUUID6 } from "node:crypto";
 import * as http2 from "node:http";
-import * as path32 from "node:path";
+import * as path33 from "node:path";
 import { createDefaultPipelines } from "@wrongstack/core/agent";
 import { getSharedProjectMailbox as getSharedProjectMailbox5, resolveProjectDir as resolveProjectDir4 } from "@wrongstack/core/coordination";
 import { createCompatibilityTrustBoundary as createCompatibilityTrustBoundary3 } from "@wrongstack/core/security";
 import {
+  attachTodosCheckpoint,
   createSessionEventBridge,
   resolveSessionLoggingConfig,
   watchProviderConfig
 } from "@wrongstack/core/storage";
 import { DEFAULT_CONTEXT_WINDOW_MODE_ID as DEFAULT_CONTEXT_WINDOW_MODE_ID2 } from "@wrongstack/core/types";
-import { expectDefined as expectDefined4, startHeapWatchdog, toErrorMessage as toErrorMessage14, wstackGlobalRoot as wstackGlobalRoot4 } from "@wrongstack/core/utils";
+import {
+  expectDefined as expectDefined4,
+  sessionScopedPath as sessionScopedPath3,
+  startHeapWatchdog,
+  toErrorMessage as toErrorMessage14,
+  wstackGlobalRoot as wstackGlobalRoot4
+} from "@wrongstack/core/utils";
 import { makeProviderFromConfig as makeProviderFromConfig5 } from "@wrongstack/providers";
 import { toLanguagePackageInput } from "@wrongstack/techstack";
 import { ensureSessionShell } from "@wrongstack/tools";
@@ -20050,7 +20569,7 @@ function findWorkspaceCliEntry(projectRoot) {
   return null;
 }
 function sleep(ms) {
-  return new Promise((resolve15) => setTimeout(resolve15, ms));
+  return new Promise((resolve16) => setTimeout(resolve16, ms));
 }
 
 // src/server/terminal-ws-handler.ts
@@ -20286,7 +20805,7 @@ function clampDim(value, fallback) {
 }
 
 // src/server/worktree-ws-handler.ts
-import { join as join14, resolve as resolve12, sep as sep4 } from "node:path";
+import { join as join14, resolve as resolve13, sep as sep5 } from "node:path";
 import { WorktreeManager as WorktreeManager3 } from "@wrongstack/core/worktree";
 import { cleanupStaleSddWorktrees as cleanupStaleSddWorktrees2 } from "@wrongstack/sdd";
 import { toErrorMessage as toErrorMessage9 } from "@wrongstack/core/utils";
@@ -20347,13 +20866,13 @@ var WorktreeWebSocketHandler = class {
   // ── orphan management ─────────────────────────────────────────────────────
   /** Absolute managed-worktrees root for this project. */
   worktreesRoot() {
-    return resolve12(join14(this.management.projectRoot, ".wrongstack", "worktrees"));
+    return resolve13(join14(this.management.projectRoot, ".wrongstack", "worktrees"));
   }
   /** True iff `dir` resolves strictly inside the managed worktrees root. */
   underRoot(dir) {
-    const abs = resolve12(dir);
+    const abs = resolve13(dir);
     const root = this.worktreesRoot();
-    return abs !== root && abs.startsWith(root + sep4);
+    return abs !== root && abs.startsWith(root + sep5);
   }
   /** Branches of worktrees a live in-session run currently owns. */
   liveActiveBranches() {
@@ -20501,7 +21020,7 @@ var WorktreeWebSocketHandler = class {
     }
     const base = baseBranch && MANAGED_BRANCH_RE.test(baseBranch) ? baseBranch : void 0;
     const wt = new WorktreeManager3({ projectRoot: this.management.projectRoot });
-    const summary = await wt.diffSummary(resolve12(dir), base);
+    const summary = await wt.diffSummary(resolve13(dir), base);
     this.broadcast({ type: "worktree.diff_result", payload: { dir, summary } });
   }
   // ── internals ───────────────────────────────────────────────────────────
@@ -20650,7 +21169,9 @@ async function createAgentServices(input) {
           memory: memoryRetrieval,
           maxHintsPerTool: config.Sage?.inject?.maxHintsPerTool,
           maxCharsPerTool: config.Sage?.inject?.maxCharsPerTool,
+          taskAware: config.Sage?.inject?.taskAware,
           minScore: config.Sage?.inject?.minScore,
+          minImportance: config.Sage?.inject?.minImportance,
           repeatCooldownMs: config.Sage?.inject?.repeatCooldownMs,
           verifyOnMutation: config.Sage?.hygiene?.autoOnFileChange,
           triggers: config.Sage?.inject?.triggers
@@ -20953,15 +21474,20 @@ async function createAgentServices(input) {
     projectRoot
   );
   const specsHandler = new SpecsWebSocketHandler(wpaths.projectSpecs, wpaths.projectTaskGraphs);
-  const sddBoardHandler = new SddBoardWebSocketHandler(wpaths.projectSddBoards, void 0, {
-    projectRoot,
-    paths: {
-      projectSpecs: wpaths.projectSpecs,
-      projectTaskGraphs: wpaths.projectTaskGraphs,
-      projectSddSession: wpaths.projectSddSession,
-      projectSddBoards: wpaths.projectSddBoards
-    }
-  });
+  const sddBoardHandler = new SddBoardWebSocketHandler(
+    wpaths.projectSddBoards,
+    void 0,
+    {
+      projectRoot,
+      paths: {
+        projectSpecs: wpaths.projectSpecs,
+        projectTaskGraphs: wpaths.projectTaskGraphs,
+        projectSddSession: wpaths.projectSddSession,
+        projectSddBoards: wpaths.projectSddBoards
+      }
+    },
+    { trustBoundary: input.trustBoundary, logger }
+  );
   const sddWizardHandler = new SddWizardWebSocketHandler(
     buildSddWizardDeps({
       agent,
@@ -20973,7 +21499,16 @@ async function createAgentServices(input) {
         providerRegistry,
         toolRegistry,
         session: input.sessionGetter(),
-        projectRoot
+        projectRoot,
+        // Thread the container-provided ProviderModelStatusTracker so a 429
+        // from this subagent's first call transitions the (provider, model)
+        // pair to `state: 'blocked'` instead of silently no-op'ing. The
+        // runtime container binds a default `ProviderModelStatusTracker`
+        // (see packages/runtime/src/container.ts); without this dep, the
+        // subagent's fallback extension's tracker hooks are undefined and
+        // round-robin keeps reassigning the doomed model. Mirrors the CLI
+        // factory wiring at host-subagent-factory.ts:337.
+        statusTracker: container.safeResolve(TOKENS2.ProviderModelStatusTracker)
       }),
       paths: {
         projectSpecs: wpaths.projectSpecs,
@@ -21116,7 +21651,7 @@ function createConnectionHandler(options) {
 }
 
 // src/server/message-dispatcher.ts
-import path26 from "node:path";
+import path27 from "node:path";
 function createMessageDispatcher(opts) {
   const { state, deps: deps2, routes, promptsCtx, codebaseIndexing, runLock, pendingConfirms } = opts;
   function makeWorklistContext() {
@@ -21137,7 +21672,7 @@ function createMessageDispatcher(opts) {
       skillLoader: deps2.skillLoader,
       skillInstaller: deps2.skillInstaller,
       projectRoot,
-      projectSkillsDir: path26.join(projectRoot, ".wrongstack", "skills"),
+      projectSkillsDir: path27.join(projectRoot, ".wrongstack", "skills"),
       globalSkillsDir: deps2.wpaths.globalSkills
     };
   }
@@ -21389,7 +21924,7 @@ function createMessageDispatcher(opts) {
 
 // src/server/pre-context-services.ts
 import { createRequire as createRequire3 } from "node:module";
-import * as path29 from "node:path";
+import * as path30 from "node:path";
 import { Context, DefaultSystemPromptBuilder } from "@wrongstack/core/agent";
 import {
   getSharedProjectMailbox as getSharedProjectMailbox4,
@@ -21444,7 +21979,7 @@ import { attachSessionKanbanMirror, hydrateSessionKanban } from "@wrongstack/too
 
 // src/server/model-auto-discovery.ts
 import * as fs20 from "node:fs/promises";
-import * as path27 from "node:path";
+import * as path28 from "node:path";
 import { COMPATIBLE_PRESETS, discoverOpenAICompatibleModels } from "@wrongstack/providers";
 function isOverlayRegistry(value) {
   return !!value && typeof value === "object" && typeof value.mergeOverlay === "function";
@@ -21480,7 +22015,7 @@ async function discoverAndMergeWebuiProviders(opts) {
   if (!isOverlayRegistry(registry)) return;
   const targets = eligibleProviders(opts.config);
   if (targets.length === 0) return;
-  const cacheFile = path27.join(opts.cacheDir, "discovered-models-cache.json");
+  const cacheFile = path28.join(opts.cacheDir, "discovered-models-cache.json");
   const cache2 = await readCache(cacheFile);
   let cacheDirty = false;
   await Promise.all(
@@ -21517,7 +22052,7 @@ async function discoverAndMergeWebuiProviders(opts) {
   );
   if (cacheDirty) {
     try {
-      await fs20.mkdir(path27.dirname(cacheFile), { recursive: true });
+      await fs20.mkdir(path28.dirname(cacheFile), { recursive: true });
       await fs20.writeFile(cacheFile, JSON.stringify(cache2), "utf8");
     } catch {
       opts.logger?.debug?.("provider auto-discovery cache write failed");
@@ -21614,7 +22149,7 @@ function resolveSetupProvider(opts) {
 }
 
 // src/server/standalone-session-identity.ts
-import * as path28 from "node:path";
+import * as path29 from "node:path";
 import {
   AgentStatusTracker,
   FleetNotifier,
@@ -21633,7 +22168,7 @@ async function createStandaloneSessionIdentityLifecycle(opts) {
   let activeTarget = {
     projectSlug: paths.projectSlug,
     projectRoot: paths.projectRoot,
-    projectName: path28.basename(paths.projectRoot),
+    projectName: path29.basename(paths.projectRoot),
     workingDir: opts.workingDir
   };
   let pendingClaim;
@@ -21864,7 +22399,7 @@ async function createPreContextServices(input) {
     await discoverAndMergeWebuiProviders({
       config,
       registry: modelsRegistry,
-      cacheDir: path29.dirname(wpaths.modelsCache),
+      cacheDir: path30.dirname(wpaths.modelsCache),
       logger
     });
   } catch (err) {
@@ -21916,7 +22451,7 @@ async function createPreContextServices(input) {
   configureChildEnvGitIdentity(config.git?.identity ?? null);
   console.log("[WebUI] Tool registry loaded:", toolRegistry.list().length, "tools");
   const mcpTokenStore = new MCPVaultTokenStore(
-    path29.join(wpaths.projectDir, "mcp-auth.json"),
+    path30.join(wpaths.projectDir, "mcp-auth.json"),
     vault
   );
   const mcpAuthorizationManager = new MCPAuthorizationManager({ store: mcpTokenStore });
@@ -22022,7 +22557,7 @@ async function createPreContextServices(input) {
   };
   const skillLoader = config.features.skills ? new DefaultSkillLoader({ paths: wpaths }) : void 0;
   const skillInstaller = config.features.skills ? new SkillInstaller({
-    manifestPath: path29.join(wpaths.configDir, "installed-skills.json"),
+    manifestPath: path30.join(wpaths.configDir, "installed-skills.json"),
     projectSkillsDir: wpaths.inProjectSkills,
     globalSkillsDir: wpaths.globalSkills,
     projectHash: wpaths.projectHash,
@@ -22032,8 +22567,8 @@ async function createPreContextServices(input) {
   const bundledPromptsDir = promptsEnabled ? (() => {
     try {
       const req = createRequire3(import.meta.url);
-      return path29.join(
-        path29.dirname(req.resolve("@wrongstack/core/package.json")),
+      return path30.join(
+        path30.dirname(req.resolve("@wrongstack/core/package.json")),
         "data",
         "prompts"
       );
@@ -22137,7 +22672,7 @@ async function createPreContextServices(input) {
 }
 
 // src/server/routes.ts
-import path30 from "node:path";
+import path31 from "node:path";
 import { makeProviderFromConfig as makeProviderFromConfig4, withCatalogCapabilities } from "@wrongstack/providers";
 
 // src/server/mode-handlers.ts
@@ -22262,6 +22797,7 @@ function buildRoutes(state, deps2, cb) {
     config: state.getConfig(),
     clients: state.getClients(),
     context: deps2.context,
+    events: deps2.events,
     toolRegistry: deps2.toolRegistry,
     compactor: deps2.compactor,
     customModeStore: deps2.customModeStore,
@@ -22273,6 +22809,7 @@ function buildRoutes(state, deps2, cb) {
     setSession: state.setSession,
     setSessionStartedAt: state.setSessionStartedAt,
     claimSession: cb.claimSession,
+    onBeforeSessionTodosReplaced: cb.onBeforeSessionTodosReplaced,
     onSessionSwapped: cb.onSessionSwapped,
     abortActiveRun: state.abortRunLock,
     isRunActive: state.isRunActive,
@@ -22294,6 +22831,8 @@ function buildRoutes(state, deps2, cb) {
     setSessionStore: state.setSessionStore,
     setSessionStartedAt: state.setSessionStartedAt,
     abortRunLock: state.abortRunLock,
+    onBeforeSessionTodosReplaced: cb.onBeforeSessionTodosReplaced,
+    onSessionSwapped: cb.onSessionSwapped,
     sessionStartPayload: cb.sessionStartPayload
   });
   const modeRoutes = createModeHandlers({
@@ -22425,7 +22964,7 @@ function buildRoutes(state, deps2, cb) {
   };
   const mailboxRoutes = createMailboxRouteHandlers({
     getProjectRoot: state.getProjectRoot,
-    getGlobalRoot: () => path30.dirname(deps2.globalConfigPath),
+    getGlobalRoot: () => path31.dirname(deps2.globalConfigPath),
     events: deps2.events
   });
   const mcpRoutes = {
@@ -22498,7 +23037,7 @@ function buildRoutes(state, deps2, cb) {
 }
 
 // src/server/server-runtime.ts
-import * as path31 from "node:path";
+import * as path32 from "node:path";
 import { createRequire as createRequire4 } from "node:module";
 import { fileURLToPath } from "node:url";
 import { WebSocketServer } from "ws";
@@ -22559,7 +23098,7 @@ function createSessionStartPayload(g) {
       inputCost,
       outputCost,
       cacheReadCost,
-      projectName: path31.basename(projectRoot) || projectRoot,
+      projectName: path32.basename(projectRoot) || projectRoot,
       projectRoot,
       cwd: g.getWorkingDir(),
       mode: g.getModeId(),
@@ -22647,13 +23186,13 @@ function armEvents(wssPrimary, wssSecondary, wsHost, httpPort, setupInput, watch
   };
 }
 function resolveWebuiDistDir(fromUrl, explicitDistDir) {
-  if (explicitDistDir) return path31.resolve(explicitDistDir);
+  if (explicitDistDir) return path32.resolve(explicitDistDir);
   try {
     const requireFromHere2 = createRequire4(fromUrl);
     const serverEntry = requireFromHere2.resolve("@wrongstack/webui");
-    return path31.dirname(serverEntry);
+    return path32.dirname(serverEntry);
   } catch {
-    return path31.resolve(path31.dirname(fileURLToPath(fromUrl)), "..", "..", "dist");
+    return path32.resolve(path32.dirname(fileURLToPath(fromUrl)), "..", "..", "dist");
   }
 }
 function startHttpServer(opts) {
@@ -22684,6 +23223,56 @@ function registerShutdown(deps2) {
 }
 
 // src/server/start-webui.ts
+function createStandaloneTodosCheckpointLifecycle(input) {
+  let checkpointSessionId = input.sessionId;
+  let checkpointSessionsDir = input.sessionsDir;
+  const attachCheckpoint = (sessionId, sessionsDir) => attachTodosCheckpoint(
+    input.state,
+    sessionScopedPath3(sessionsDir, sessionId, ".todos.json"),
+    sessionId,
+    input.events,
+    input.traceId,
+    input.warn
+  );
+  let detachCurrent = attachCheckpoint(input.sessionId, input.sessionsDir);
+  let checkpointAttached = true;
+  const detachCurrentCheckpoint = async () => {
+    if (!checkpointAttached) return;
+    checkpointAttached = false;
+    await detachCurrent();
+  };
+  let transitionTail = Promise.resolve();
+  const rebind = (nextSessionId, sessionsDir) => {
+    const transition = transitionTail.then(async () => {
+      if (checkpointAttached && nextSessionId === checkpointSessionId && sessionsDir === checkpointSessionsDir) {
+        return;
+      }
+      let detachFailed = false;
+      let detachError;
+      try {
+        await detachCurrentCheckpoint();
+      } catch (error2) {
+        detachFailed = true;
+        detachError = error2;
+      }
+      const nextDetach = attachCheckpoint(nextSessionId, sessionsDir);
+      checkpointSessionId = nextSessionId;
+      checkpointSessionsDir = sessionsDir;
+      detachCurrent = nextDetach;
+      checkpointAttached = true;
+      if (detachFailed) throw detachError;
+    });
+    transitionTail = transition.catch(() => void 0);
+    return transition;
+  };
+  return {
+    rebind,
+    detach: async () => {
+      await transitionTail;
+      await detachCurrentCheckpoint();
+    }
+  };
+}
 async function startWebUI(opts = {}) {
   ensureSessionShell();
   const ports = await resolvePorts(opts);
@@ -22751,6 +23340,14 @@ async function startWebUI(opts = {}) {
   } = preContext;
   let sessionStore = preContext.sessionStore;
   let session = preContext.session;
+  const todosCheckpoint = createStandaloneTodosCheckpointLifecycle({
+    state: context.state,
+    sessionsDir: wpaths.projectSessions,
+    sessionId: session.id,
+    events,
+    traceId: context.traceId,
+    warn: (message) => logger.warn(message)
+  });
   let sessionStartedAt = preContext.sessionStartedAt;
   let modeId = preContext.modeId;
   const needsSetup = preContext.needsSetup;
@@ -22877,7 +23474,7 @@ async function startWebUI(opts = {}) {
         if (events.listenerCount("tool.confirm_needed") === 0) {
           throw new Error("No permission confirmation surface is connected");
         }
-        const decision = await new Promise((resolve15) => {
+        const decision = await new Promise((resolve16) => {
           events.emit("tool.confirm_needed", {
             sessionId: context.session.id,
             tool: confirmTool,
@@ -22887,7 +23484,7 @@ async function startWebUI(opts = {}) {
             decisionSource: pending.decisionSource,
             riskTier: pending.riskTier,
             boundaryReason: pending.boundaryReason,
-            resolve: resolve15
+            resolve: resolve16
           });
         });
         const rule = { tool: "language_package", pattern: pending.suggestedPattern };
@@ -22987,21 +23584,21 @@ async function startWebUI(opts = {}) {
     });
   }
   async function touchProjectEntry(root, workDir) {
-    const resolved = path32.resolve(root);
+    const resolved = path33.resolve(root);
     const manifest = await loadManifest(globalConfigPath);
     const now = (/* @__PURE__ */ new Date()).toISOString();
-    const existing = manifest.projects.find((p) => path32.resolve(p.root) === resolved);
+    const existing = manifest.projects.find((p) => path33.resolve(p.root) === resolved);
     if (existing) {
       existing.lastSeen = now;
-      if (workDir) existing.lastWorkingDir = path32.resolve(workDir);
+      if (workDir) existing.lastWorkingDir = path33.resolve(workDir);
     } else {
       manifest.projects.push({
-        name: path32.basename(resolved),
+        name: path33.basename(resolved),
         root: resolved,
         slug: generateProjectSlug(resolved),
         createdAt: now,
         lastSeen: now,
-        lastWorkingDir: workDir ? path32.resolve(workDir) : void 0
+        lastWorkingDir: workDir ? path33.resolve(workDir) : void 0
       });
     }
     await saveManifest(manifest, globalConfigPath);
@@ -23102,6 +23699,7 @@ async function startWebUI(opts = {}) {
   const cb = {
     sessionStartPayload,
     claimSession: (sessionId, target) => sessionIdentity.claim(sessionId, target),
+    onBeforeSessionTodosReplaced: todosCheckpoint.rebind,
     onSessionSwapped: async (sessionId, target) => {
       await sessionIdentity.activate(sessionId, target);
       const { hydrateSessionKanban: hydrateSessionKanban2 } = await import("@wrongstack/tools/session-kanban");
@@ -23252,6 +23850,7 @@ projectRoot: ${ev.projectRoot ?? "?"}`,
       ...wssSecondary ? [wssSecondary] : []
     ],
     onShutdown: async () => {
+      await todosCheckpoint.detach();
       await stopHeapWatchdog();
       credentialWatcherClose?.();
       brainMonitor.stop();
@@ -23277,7 +23876,7 @@ projectRoot: ${ev.projectRoot ?? "?"}`,
       await memoryStore.dispose().catch(
         (err) => logger.warn(`sage connection disposal failed: ${toErrorMessage14(err)}`)
       );
-      await unregisterInstance(process.pid, path32.dirname(globalConfigPath));
+      await unregisterInstance(process.pid, path33.dirname(globalConfigPath));
     }
   });
 }