@wrongstack/webui-server 0.296.4 → 0.298.0

package/dist/server/frontend-static-serve.d.ts

@@ -59,6 +59,13 @@ export interface StaticServeOptions {
     apiToken?: string | undefined;
     /** Force token auth even when the server binds to loopback. */
     requireToken?: boolean | undefined;
+    /**
+     * Extra hostnames the HTTP CSRF/DNS-rebinding guard accepts, for operators
+     * fronting the WebUI with a tunnel or reverse proxy. `publicWsUrl`'s hostname
+     * is trusted implicitly; set this when the browser-facing HTTP origin differs
+     * from it (WS-001).
+     */
+    allowedHostnames?: readonly string[] | undefined;
     /**
      * When true, skip `server.listen()` — the caller is responsible for
      * calling listen after attaching the WebSocketServer. This prevents

package/dist/server/goal-ws-handler.d.ts

@@ -1,7 +1,7 @@
-import type { WebSocket } from 'ws';
 import type { Agent, Context } from '@wrongstack/core/agent';
 import type { EventBus } from '@wrongstack/core/kernel';
 import type { Logger } from '@wrongstack/core/types';
+import type { WebSocket } from 'ws';
 interface GoalWSMessage {
     type: string;
     payload?: Record<string, unknown>;
@@ -66,6 +66,8 @@ export declare class GoalWebSocketHandler {
      */
     onBoardState?: ((graphId: string, state: Record<string, unknown>) => void) | undefined);
     addClient(ws: WebSocket): void;
+    /** Release timers, in-flight work, and socket references owned by this host. */
+    dispose(): void;
     handleMessage(ws: WebSocket, msg: GoalWSMessage): Promise<void>;
     /**
      * Assess a goal prompt for duration realism. Runs a lightweight LLM call

package/dist/server/governance-runtime.d.ts

@@ -0,0 +1,30 @@
+import type { AgentPipelines } from '@wrongstack/core/agent';
+import type { EventBus } from '@wrongstack/core/kernel';
+import type { Logger, WorkspaceCheckpointRef } from '@wrongstack/core/types';
+import type { BootstrapGovernanceRuntimeOptions, GovernanceRuntimeBootstrapCloseResult, GovernanceRuntimeBootstrapResult } from '@wrongstack/runtime/governance-bootstrap';
+import { createGovernanceMutationSnapshotBridge } from '@wrongstack/runtime/governance-mutation-snapshot-bridge';
+export declare const WRONGSTACK_GOVERNANCE_ENV = "WRONGSTACK_GOVERNANCE";
+interface GovernanceBootstrapModule {
+    bootstrapGovernanceRuntime(options: BootstrapGovernanceRuntimeOptions): Promise<GovernanceRuntimeBootstrapResult>;
+}
+interface WebUiGovernanceDependencies {
+    readonly load: () => Promise<GovernanceBootstrapModule>;
+    readonly createMutationBridge: typeof createGovernanceMutationSnapshotBridge;
+}
+export interface WebUiGovernanceRuntimeHandle {
+    installToolBoundary(pipelines: AgentPipelines): void;
+    close(): Promise<GovernanceRuntimeBootstrapCloseResult>;
+}
+export declare function webUiGovernanceRuntimeEnabled(environment: Readonly<Record<string, string | undefined>>): boolean;
+export declare function setupWebUiGovernance(input: {
+    readonly environment: Readonly<Record<string, string | undefined>>;
+    readonly projectRoot: string;
+    readonly projectId: string;
+    readonly sessionId: string;
+    readonly contextMeta: Record<string, unknown>;
+    readonly events: EventBus;
+    readonly logger: Pick<Logger, 'info' | 'warn'>;
+    readonly captureWorkspaceCheckpoint: () => Promise<WorkspaceCheckpointRef | undefined>;
+}, dependencies?: WebUiGovernanceDependencies): Promise<WebUiGovernanceRuntimeHandle | undefined>;
+export {};
+//# sourceMappingURL=governance-runtime.d.ts.map

package/dist/server/http-server.d.ts

@@ -27,6 +27,13 @@ export interface CreateHttpServerOptions {
     apiToken?: string | undefined;
     /** Force HTTP token auth even on loopback binds, useful behind public tunnels. */
     requireToken?: boolean | undefined;
+    /**
+     * Extra `Host`/`Origin` hostnames accepted by the CSRF/rebinding guard, for
+     * operators fronting the WebUI with a tunnel or reverse proxy. The hostname
+     * of `publicWsUrl` is trusted implicitly. Mirrors the WS path's
+     * `allowedHostnames` (see ws-auth.ts).
+     */
+    allowedHostnames?: readonly string[] | undefined;
     /**
      * If true, the `/ws-auth` endpoint exchanges a `?token=` query param (or
      * `X-WS-Token` header) for an `HttpOnly` auth cookie. The cookie is then

package/dist/server/kanban-supervisor.d.ts

@@ -36,6 +36,12 @@ export interface KanbanSupervisorDeps {
 export interface KanbanSupervisor {
     getSnapshot(boardId: string): KanbanSupervisorSnapshot | undefined;
     auditNow(boardId?: string): Promise<KanbanSupervisorSnapshot[]>;
+    getStats(): {
+        snapshots: number;
+        scheduledBoards: number;
+        agentCooldowns: number;
+        runningAgents: number;
+    };
     dispose(): void;
 }
 /**

package/dist/server/mailbox-handlers.d.ts

@@ -8,7 +8,7 @@
 import { type RemoteMailbox } from '@wrongstack/core/coordination';
 import type { EventBus } from '@wrongstack/core/kernel';
 import type { WebSocket } from 'ws';
-import type { MailboxSendPayload } from './ws-payload-validation.js';
+import type { MailboxActionPayload, MailboxSendPayload } from './ws-payload-validation.js';
 export interface MailboxHandlerDeps {
     /** Absolute project root or a live getter for hosts that can switch projects. */
     projectRoot: string | (() => string);
@@ -18,6 +18,7 @@ export interface MailboxHandlerDeps {
     events?: EventBus | undefined;
 }
 export declare function getMailboxForDeps(deps: MailboxHandlerDeps): RemoteMailbox | null;
+export declare function handleMailboxAction(ws: WebSocket, deps: MailboxHandlerDeps, payload: MailboxActionPayload): Promise<void>;
 /** Persist a human-authored WebUI message in the shared project mailbox. */
 export declare function handleMailboxSend(ws: WebSocket, deps: MailboxHandlerDeps, payload: MailboxSendPayload): Promise<void>;
 /**

package/dist/server/mailbox-routes.d.ts

@@ -2,6 +2,7 @@ import type { EventBus } from '@wrongstack/core/kernel';
 import type { WebSocket } from 'ws';
 import type { WSClientMessage } from './types.js';
 export interface MailboxRouteHandlers {
+    action: (ws: WebSocket, msg: WSClientMessage) => Promise<void> | void;
     send: (ws: WebSocket, msg: WSClientMessage) => Promise<void> | void;
     messages: (ws: WebSocket, msg: WSClientMessage) => Promise<void> | void;
     agents: (ws: WebSocket, msg: WSClientMessage) => Promise<void> | void;

package/dist/server/mcp-handlers.d.ts

@@ -8,7 +8,7 @@
  * config IO, url/header persistence, and live registry start/stop logic lives
  * there; here we only map structured results to WS events the browser expects.
  */
-import { type MCPRegistry, type MCPServerOperationalHealth } from '@wrongstack/mcp';
+import { type MCPRegistry, type MCPServerOperationalHealth, type McpServerInfo } from '@wrongstack/mcp';
 import type { WebSocket } from 'ws';
 import type { WSClientMessage } from './types.js';
 /** Wire view of a server as the browser MCP panel consumes it. */
@@ -28,6 +28,8 @@ export interface MCPServerView {
     url?: string;
     health?: MCPServerOperationalHealth;
 }
+/** Project the shared {@link McpServerInfo} into the browser wire shape. */
+export declare function toView(info: McpServerInfo, health?: MCPServerOperationalHealth | undefined): MCPServerView;
 /** mcp.list — configured servers merged with live registry status + tools. */
 export declare function handleMcpList(ws: WebSocket, _msg: WSClientMessage, globalConfigPath: string, mcpRegistry?: MCPRegistry): Promise<void>;
 /** mcp.add — persist a new server (incl. url/headers) and start it if enabled. */

package/dist/server/memory-diagnostics.d.ts

@@ -0,0 +1,69 @@
+export interface ProcessMemoryDiagnostic {
+    pid: number;
+    surface: string;
+    sessionId?: string | undefined;
+    ts: string;
+    memory: {
+        rss: number;
+        heapUsed: number;
+        heapTotal: number;
+        retainedHeapUsed?: number | undefined;
+        nativeResidual?: number | undefined;
+        external?: number | undefined;
+        arrayBuffers?: number | undefined;
+    };
+    signal?: string | undefined;
+    heapGrowthBytesPerHour?: number | undefined;
+    rssGrowthBytesPerHour?: number | undefined;
+    workload: {
+        messages?: number | undefined;
+        messageEstimatedTokens?: number | undefined;
+        historyEntries?: number | undefined;
+        historyMountedEntries?: number | undefined;
+        historyCachedGroups?: number | undefined;
+        appRenders?: number | undefined;
+        metricsDroppedObservations?: number | undefined;
+        kanbanSyncActive?: boolean | undefined;
+        kanbanSyncPendingBoards?: number | undefined;
+        kanbanSyncFullRescanPending?: boolean | undefined;
+        kanbanSyncRemoteApplyQueued?: boolean | undefined;
+        kanbanSyncPendingRemoteBoards?: number | undefined;
+        kanbanSyncPublishRuns?: number | undefined;
+        kanbanSyncCoalescedRefreshes?: number | undefined;
+        kanbanSupervisorSnapshots?: number | undefined;
+        kanbanSupervisorScheduledBoards?: number | undefined;
+        kanbanSupervisorAgentCooldowns?: number | undefined;
+        kanbanSupervisorRunningAgents?: number | undefined;
+    };
+    resources: {
+        active?: number | undefined;
+        types?: string | undefined;
+    };
+    hqQueue?: {
+        entries: number;
+        bytes: number;
+        maxBytes: number;
+        droppedFrames: number;
+        droppedBytes: number;
+        coalescedFrames: number;
+        coalescedBytes: number;
+    } | undefined;
+    hqSnapshot?: {
+        inFlight: boolean;
+        pending: boolean;
+        timerScheduled: boolean;
+        eventInFlight: boolean;
+        pendingEvents: number;
+        coalescedEvents: number;
+        droppedEvents: number;
+    } | undefined;
+    profileTopStack?: string | undefined;
+    profileTopStackBytes?: number | undefined;
+}
+/**
+ * Read only the tail of the process-wide heap JSONL flight recorder and
+ * return the newest sample for each PID. This endpoint must stay cheap even
+ * after weeks of uptime, so it never loads the full log into the WebUI server.
+ */
+export declare function readRecentProcessMemoryDiagnostics(globalRoot: string | undefined, tailBytes?: number): Promise<ProcessMemoryDiagnostic[]>;
+//# sourceMappingURL=memory-diagnostics.d.ts.map

package/dist/server/memory-handlers.d.ts

@@ -67,9 +67,9 @@ export declare function handleSageRemember(ws: WebSocket, msg: unknown, memorySt
  * Request:  { type: 'memory.sage.delete', payload: { id, reason?, force?, neverInject? } }
  * Response: { type: 'memory.sage.delete', payload: { success, message } }
  *
- * `force` defaults to `true` (backward-compatible). When `false`, the
- * permanent-memory guard in `deleteSage` is respected and
- * `persistence: 'permanent'` entries cannot be deleted.
+ * `force` defaults to `false`. The caller must explicitly pass `force: true`
+ * to authorize deletion. The permanent-memory guard in `deleteSage` is
+ * always respected when force is not set.
  *
  * `neverInject` (default false) marks the memory so context injection
  * never loads it — used when a memory is factually wrong, not just

package/dist/server/pending-confirms.d.ts

@@ -1,6 +1,15 @@
 export type ConfirmDecision = 'yes' | 'no' | 'always' | 'deny';
 export interface PendingConfirm {
     resolve: (decision: ConfirmDecision) => void;
+    /**
+     * Session this prompt belongs to. `pendingConfirms` is one process-wide map
+     * replayed to every connected client, and the resolver keyed only on a
+     * client-supplied id — with a session check that no-op'd whenever the client
+     * omitted `sessionId`. So any client could answer any session's prompt
+     * (WS-082). Recorded here so ownership is checked against the server's own
+     * record rather than against whatever the client chose to send.
+     */
+    sessionId?: string | undefined;
     decisionSource?: string | undefined;
     riskTier?: 'safe' | 'standard' | 'destructive' | undefined;
     boundaryReason?: string | undefined;

package/dist/server/sdd-board-ws-handler.d.ts

@@ -9,6 +9,10 @@ interface SddBoardWSMessage {
 /** Project paths the handler needs to apply lifecycle ops directly. */
 export interface SddBoardLifecycleDeps {
     projectRoot: string;
+    /** Explicit compatibility hook for file-codec tests and old integrations. */
+    controlTransport?: 'kanban' | 'legacy-file' | undefined;
+    /** Explicit compatibility hook for legacy snapshot-file readers. */
+    stateTransport?: 'kanban' | 'legacy-file' | undefined;
     paths: {
         projectSpecs: string;
         projectTaskGraphs: string;
@@ -27,28 +31,29 @@ export interface SddBoardSecurityDeps {
  * Two observe modes (one class, shared by both webui servers):
  *  • in-process (CLI-hosted): subscribe the shared EventBus `sdd.board.snapshot`
  *    for instant updates;
- *  • standalone (separate process): poll the on-disk snapshot store (the CLI
- *    run persists JSON every change).
+ *  • standalone (separate process): poll the project-scoped Kanban workflow
+ *    state owned by the daemon.
  *
- * Control is uniform + cross-process: every command is appended to the run's
- * `<runId>.control.jsonl`, which the CLI run drains and applies — so the run
- * stays the single driver and nothing races on shared state.
+ * Control is uniform + cross-process: every command is durably enqueued in the
+ * Kanban project daemon, which the CLI run drains and applies — so the run stays
+ * the single driver and nothing races on shared state.
  */
 export declare class SddBoardWebSocketHandler {
     private readonly store;
     private readonly clients;
     private readonly lifecycle?;
     private readonly security?;
-    private readonly diskPollingEnabled;
+    private readonly standalonePollingEnabled;
     private latest;
     private poll;
     private pollInFlight;
     private unsub;
+    private disposed;
     constructor(boardsDir: string, events?: EventBus, lifecycle?: SddBoardLifecycleDeps, security?: SddBoardSecurityDeps);
     addClient(ws: WebSocket): void;
     handleMessage(msg: SddBoardWSMessage): Promise<void>;
     /**
-     * Apply a cleanup/rollback/destroy from disk and broadcast a structured
+     * Apply a cleanup/rollback/destroy from durable state and broadcast a structured
      * `sdd.board.lifecycle_result`. Refuses (no-op) while a run is still active —
      * the user must stop it first; the UI gates the buttons on `!active` and the
      * Destroy flow auto-stops then waits before sending `destroy`.
@@ -60,7 +65,9 @@ export declare class SddBoardWebSocketHandler {
     private stopPolling;
     private sendCurrent;
     private broadcastCurrent;
-    private loadLatestFromDisk;
+    private loadLatestSnapshot;
+    private listBoardEntries;
+    private usesKanbanState;
     private broadcast;
     private send;
 }

package/dist/server/sdd-wizard-wiring.d.ts

@@ -1,7 +1,7 @@
-import type { AgentFactory, BrainArbiter } from '@wrongstack/core/coordination';
 import type { Agent } from '@wrongstack/core/agent';
-import { TaskTracker } from '@wrongstack/core/tasking';
+import type { AgentFactory, BrainArbiter } from '@wrongstack/core/coordination';
 import type { EventBus } from '@wrongstack/core/kernel';
+import { type TaskStore, TaskTracker } from '@wrongstack/core/tasking';
 import type { TaskGraph } from '@wrongstack/core/types';
 import { type SddRunHandle, SddRunRegistry } from '@wrongstack/sdd';
 import type { SddWizardDeps } from './sdd-wizard-ws-handler.js';
@@ -27,6 +27,8 @@ export interface StartSddRunFromGraphDeps {
     subagentFactory: AgentFactory;
     brain?: BrainArbiter | undefined;
     projectSddBoards: string;
+    /** Persist task status transitions so a replacement process can resume. */
+    taskStore?: TaskStore | undefined;
     registry?: SddRunRegistry | undefined;
     /** Isolated read-only LLM turn for the supervisor's auto-split. Omit → no split. */
     runIsolatedTurn?: ((prompt: string, name: string) => Promise<string>) | undefined;
@@ -61,10 +63,7 @@ export interface SddWizardWiringOptions {
         projectTaskGraphs: string;
         projectSddBoards: string;
         projectDir: string;
-        /**
-         * Canonical interview session file (same as wpaths.projectSddSession).
-         * Destroy + resume share this path so a wipe actually clears the wizard.
-         */
+        /** Legacy interview session file imported into project workflow state. */
         projectSddSession?: string | undefined;
     };
 }

package/dist/server/sdd-wizard-ws-handler.d.ts

@@ -1,5 +1,5 @@
-import type { WebSocket } from 'ws';
 import type { SddInterviewDriver } from '@wrongstack/sdd';
+import type { WebSocket } from 'ws';
 interface WizardMessage {
     type: string;
     payload?: Record<string, unknown>;
@@ -22,11 +22,11 @@ export interface SddRunStartOpts {
  * light factory). This keeps the wizard protocol identical across both servers.
  */
 export interface SddWizardDeps {
-    /** Build a fresh interview driver (disk spec/graph stores + session path). */
+    /** Build a fresh interview driver (artifact stores + durable session owner). */
     makeDriver: () => SddInterviewDriver;
     /**
      * Await before the first message / client snapshot so project context and any
-     * disk resume finish loading. Optional for unit tests that inject a ready driver.
+     * durable resume finish loading. Optional for unit tests that inject a ready driver.
      */
     ensureReady?: (() => Promise<void>) | undefined;
     /**
@@ -62,7 +62,7 @@ export interface SddWizardDeps {
  * {@link SddWizardDeps}.
  *
  * Continuity: on construction (and before the first client message) the handler
- * rehydrates any on-disk interview session so a browser refresh or process
+ * rehydrates the durable interview session so a browser refresh or process
  * restart resumes mid-Q&A / mid-review without re-running the model.
  */
 export declare class SddWizardWebSocketHandler {
@@ -73,13 +73,25 @@ export declare class SddWizardWebSocketHandler {
     private lastAgentText;
     /** Guards against overlapping interview turns (one in flight at a time). */
     private busy;
-    /** Resolves once project-context gather + disk resume finish. */
+    /** Set when authoritative session state could not be read during bootstrap. */
+    private resumeError;
+    /** Resolves once project-context gather + durable resume finish. */
     private readonly ready;
+    /**
+     * Single-flight slot for the resume probe. `handleMessage` awaits this
+     * when `resumeError` is set, so concurrent frames cannot race the retry
+     * — one probe either clears the gate or re-latches it, then every
+     * queued frame re-checks and proceeds. `null` when no probe is in
+     * flight (or after the probe has settled).
+     */
+    private resumeProbe;
+    private disposed;
     constructor(deps: SddWizardDeps);
     private bootstrap;
-    /** Rehydrate a persisted interview if one exists on disk. */
+    /** Rehydrate a persisted interview if one exists. */
     private tryResume;
     addClient(ws: WebSocket): void;
+    dispose(): void;
     handleMessage(msg: WizardMessage): Promise<void>;
     private parseRunOpts;
     private onStart;

package/dist/server/specs-ws-handler.d.ts

@@ -19,6 +19,7 @@ export declare class SpecsWebSocketHandler {
     private clients;
     constructor(specsDir: string, taskGraphsDir: string);
     addClient(ws: WebSocket): void;
+    dispose(): void;
     handleMessage(msg: SpecsWSMessage): Promise<void>;
     private buildList;
     private broadcastList;

package/dist/server/types.d.ts

@@ -2,7 +2,7 @@ import type { WebSocket } from 'ws';
 import type { TrustBoundary } from '@wrongstack/core/security';
 import type { ConfigStore, ModelsRegistry, SecretVault, SessionStore } from '@wrongstack/core/types';
 import type { JournalEntry } from '@wrongstack/core/storage';
-import type { Agent } from '@wrongstack/core/agent';
+import type { Agent, AgentPipelines } from '@wrongstack/core/agent';
 import type { EventBus } from '@wrongstack/core/kernel';
 import type { ToolRegistry } from '@wrongstack/core/registry';
 /** Compatibility envelope; new boundaries should decode to CanonicalServerMessage. */
@@ -16,8 +16,12 @@ export interface WSClientMessage {
     payload?: unknown | undefined;
 }
 export interface WebUIOptions {
+    /** Runtime surface label used by instance registration and memory diagnostics. */
+    surface?: 'webui' | 'simpleui' | undefined;
     /** Policy authority for terminal/process/native-shell actions. */
     trustBoundary?: TrustBoundary | undefined;
+    /** Trusted host-only hook installed around leader and light-subagent tools. */
+    installToolBoundary?: ((pipelines: AgentPipelines) => void) | undefined;
     /** HTTP frontend port. Prefer `httpPort`; `port` is kept for compatibility. */
     port?: number | undefined;
     /** HTTP frontend port. */

package/dist/server/worktree-ws-handler.d.ts

@@ -1,6 +1,6 @@
-import type { WebSocket } from 'ws';
 import type { EventBus } from '@wrongstack/core/kernel';
 import type { Logger } from '@wrongstack/core/types';
+import type { WebSocket } from 'ws';
 export interface WorktreeManagementDeps {
     projectRoot: string;
     /** Board snapshot dir — powers the cross-process liveness guard on cleanup. */
@@ -22,6 +22,20 @@ export declare class WorktreeWebSocketHandler {
     private baseBranch;
     private broadcastInterval;
     private readonly offs;
+    /**
+     * Single-flight guard for orphan scans. Two concurrent `scanAndBroadcast()`
+     * calls would race: the first call reads `wt.listManaged()`, then the
+     * second call's mutation completes (e.g. `removeOne`), then the first call
+     * broadcasts a stale orphan list — the user sees a row persist and clicks
+     * Remove a second time, hitting "remove failed (not a managed worktree?)".
+     *
+     * We coalesce concurrent triggers: while a scan is in flight, additional
+     * callers are remembered as "need a re-scan" and exactly one follow-up
+     * scan runs after the in-flight one finishes. The re-scan picks up any
+     * mutations that landed during the previous scan's `listManaged()` window.
+     */
+    private scanInFlight;
+    private scanRescanNeeded;
     constructor(events: EventBus, logger: Logger, management?: WorktreeManagementDeps | undefined);
     addClient(ws: WebSocket): void;
     /** Handle worktree-panel control messages (scan / clean / per-row ops). */
@@ -36,12 +50,26 @@ export declare class WorktreeWebSocketHandler {
     private underRoot;
     /** Branches of worktrees a live in-session run currently owns. */
     private liveActiveBranches;
+    /**
+     * Coalesced orphan scan entry point. Multiple concurrent callers share one
+     * in-flight scan; if a caller arrives during a scan, a single follow-up
+     * scan is scheduled to pick up mutations that landed mid-scan. Returns the
+     * shared promise so `await this.scanAndBroadcast()` still works for callers
+     * that want to chain after the next broadcast.
+     */
+    private scanAndBroadcast;
+    /**
+     * Run the actual scan, then drain a pending re-scan request if one came in
+     * during the scan. The re-scan is bounded (one follow-up) — additional
+     * requests that arrive during the follow-up coalesce into the next one.
+     */
+    private runScanAndMaybeRescan;
     /**
      * Scan the disk for managed worktrees/branches NOT owned by a live in-session
      * run and broadcast them as orphans, with whether it is safe to clean now.
      * No-op (empty inventory) when management deps were not wired.
      */
-    private scanAndBroadcast;
+    private runScanOnce;
     /**
      * Force-remove every orphaned worktree + branch. Refused while a run is live —
      * in this session (active handles) OR another process (the SDD board liveness

package/dist/server/ws-auth.d.ts

@@ -42,6 +42,30 @@ export declare function hostHeaderOk(input: {
     wsHost: string;
     allowedHostnames?: readonly string[] | undefined;
 }): boolean;
+/**
+ * CSRF / drive-by guard for the HTTP surface (WS-001).
+ *
+ * The WebSocket upgrade path has always been Origin- and Host-checked, but the
+ * plain HTTP `/api/*` surface was not: it built its URL from a hardcoded base,
+ * never read `Origin`, and (on the default loopback bind) required no token. A
+ * `POST` with `Content-Type: text/plain` is a CORS *simple request*, so any page
+ * the user visits could fire one without a preflight — the response being
+ * unreadable does not undo the side effect.
+ *
+ * Policy, mirroring `hasTrustedBrowserOrigin` in the HQ server:
+ *  - the `Host` authority must already be trusted (DNS-rebinding guard), and
+ *  - when the browser sends `Origin`, it must name that same authority.
+ *
+ * A missing `Origin` is allowed: same-origin top-level navigations and
+ * non-browser clients (curl, the CLI, tests) legitimately omit it, and those
+ * cannot be driven by a hostile page.
+ */
+export declare function httpRequestOriginOk(input: {
+    origin: string | undefined;
+    hostHeader: string | undefined;
+    wsHost: string;
+    allowedHostnames?: readonly string[] | undefined;
+}): boolean;
 export interface VerifyClientInput {
     /** Browser `Origin` header, or undefined for non-browser clients. */
     origin?: string | undefined;

package/dist/server/ws-payload-validation.d.ts

@@ -22,8 +22,16 @@ export declare function validateMailboxMessagesPayload(payload: unknown): Payloa
 interface MailboxAgentsPayload {
     onlineOnly?: boolean;
 }
+export interface MailboxActionPayload {
+    requestId: string;
+    mailId: string;
+    action: 'mark-read' | 'acknowledge' | 'reopen' | 'soft-delete';
+    readerId: string;
+}
+export declare function validateMailboxActionPayload(payload: unknown): PayloadValidationResult<MailboxActionPayload>;
 export interface MailboxSendPayload {
     requestId: string;
+    from?: string | undefined;
     to: string;
     type: 'note' | 'ask' | 'assign' | 'steer' | 'btw' | 'broadcast' | 'status' | 'result' | 'review';
     audience: 'all' | 'leaders';
@@ -132,4 +140,22 @@ interface ProjectsSelectPayload {
     name?: string;
 }
 export declare function validateProjectsSelectPayload(payload: unknown): PayloadValidationResult<ProjectsSelectPayload>;
+/**
+ * `mcp.add` / `mcp.update` payload.
+ *
+ * WS-004: these handlers cast the raw WS payload with `as McpServerInput` and
+ * passed it straight to `addMcp`, which persists `command`/`args`/`env` to the
+ * global config and spawns them — so an unvalidated frame became a persistent
+ * child process that respawns on every restart. Validate the shape and the
+ * types before anything reaches disk.
+ *
+ * This checks structure, not policy: `command` is still whatever the operator
+ * configures. The spawn itself is hardened separately by
+ * `buildWin32CmdShimInvocation` (CMDI-005).
+ */
+export interface McpServerPayload {
+    name: string;
+    [key: string]: unknown;
+}
+export declare function validateMcpServerPayload(payload: unknown, label: string): PayloadValidationResult<McpServerPayload>;
 //# sourceMappingURL=ws-payload-validation.d.ts.map

package/dist/server/ws-utils.d.ts

@@ -25,7 +25,18 @@ export declare function broadcast(clients: Map<WebSocket, ConnectedClient>, msg:
  */
 export declare function sendResult(ws: WebSocket, success: boolean, message: string): void;
 /**
- * Extract a human-readable message from an unknown thrown value.
+ * Extract a human-readable message from an unknown thrown value, safe to put
+ * in a frame that leaves the process.
+ *
+ * WS-066: this was `err instanceof Error ? err.message : String(err)` — the
+ * verbatim throw. A provider that echoes an `Authorization` header back in its
+ * error body, or a connection string with an inline password, went straight to
+ * the browser and into whatever the browser logs. {@link scrubErrorDetail}
+ * keeps the message (this is a local dev tool; opaque errors would gut it) but
+ * removes credentials and rewrites the home directory to `~`.
+ *
+ * For HTTP `/api/*` JSON bodies — a less authenticated surface — use
+ * `sanitizeApiError` instead, which returns a category and nothing else.
  */
 export declare function errMessage(err: unknown): string;
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrongstack/webui-server",
-  "version": "0.296.4",
+  "version": "0.298.0",
   "license": "MIT",
   "description": "WrongStack WebUI HTTP/WebSocket server module — extracted from @wrongstack/webui in PR #243/244 to remove the CLI -> @wrongstack/webui/server cross-package edge (audit §3.1.1). Pure backend: HTTP routes, WebSocket handlers, MCP tool wrappers, HTML serving. The web frontend lives in @wrongstack/webui; this package is the standalone server it can run on.",
   "keywords": [
@@ -35,19 +35,20 @@
     "./package.json": "./package.json"
   },
   "files": [
-    "dist"
+    "dist",
+    "!dist/**/*.map"
   ],
   "dependencies": {
     "ws": "^8.21.1",
-    "@wrongstack/core": "0.296.4",
-    "@wrongstack/runtime": "0.296.4",
-    "@wrongstack/kanban": "0.296.4",
-    "@wrongstack/sage": "0.296.4",
-    "@wrongstack/mcp": "0.296.4",
-    "@wrongstack/sdd": "0.296.4",
-    "@wrongstack/techstack": "0.296.4",
-    "@wrongstack/tools": "0.296.4",
-    "@wrongstack/providers": "0.296.4"
+    "@wrongstack/core": "0.298.0",
+    "@wrongstack/runtime": "0.298.0",
+    "@wrongstack/sdd": "0.298.0",
+    "@wrongstack/kanban": "0.298.0",
+    "@wrongstack/mcp": "0.298.0",
+    "@wrongstack/techstack": "0.298.0",
+    "@wrongstack/providers": "0.298.0",
+    "@wrongstack/sage": "0.298.0",
+    "@wrongstack/tools": "0.298.0"
   },
   "devDependencies": {
     "@types/node": "^26.1.1",

package/dist/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,cAAc,mBAAmB,CAAC;AAClC,cAAc,qBAAqB,CAAC"}