@wrongstack/webui-server 0.298.0 → 0.298.1

package/dist/index.js

@@ -73,8 +73,7 @@ var BOOLEAN_PREF_KEYS = /* @__PURE__ */ new Set([
   // Display-only toggles (purely visual, persisted in localStorage via Zustand).
   "groupToolCalls",
   "showThinkingLogs",
-  // v11 Display parity: agent-swarm panel + inverse fsAccess flag.
-  "showAgentSwarmPanel",
+  // v11 Display parity: inverse fsAccess flag.
   "allowOutsideProjectRoot",
   // v13 Display parity (TUI SettingsPicker fields 42 & 43): the read tool
   // includes codebase-index symbols, and SAGE memory-inject blocks are
@@ -169,7 +168,8 @@ var ENUM_PREF_KEYS = {
   // Chimera autoFix + auto-review cascade threshold
   chimeraAutoFix: /* @__PURE__ */ new Set(["off", "ask", "auto"]),
   autoReviewCascadeOn: /* @__PURE__ */ new Set(["off", "critical", "high"]),
-  fleetChatVerbosity: /* @__PURE__ */ new Set(["off", "full"])
+  fleetChatVerbosity: /* @__PURE__ */ new Set(["off", "full"]),
+  showAgentSwarmPanel: /* @__PURE__ */ new Set(["bottom", "sidebar", "off"])
 };
 function validateModelRuntimeValue(modelRuntime, path35) {
   const reasoning = modelRuntime["reasoning"];
@@ -8978,7 +8978,7 @@ function buildCspHeader(publicWsUrl, host, port) {
   if (host && isLoopbackHostname(host)) {
     const p = port ?? 3456;
     if (p > 0 && p <= 65535) {
-      for (const h of ["127.0.0.1", "localhost", "[::1]"]) {
+      for (const h of ["127.0.0.1", "localhost"]) {
         connect.add(`ws://${h}:${p}`);
         connect.add(`wss://${h}:${p}`);
       }
@@ -16365,6 +16365,7 @@ var SERVER_CONVERSATION_MESSAGE_TYPES = [
   "agent.status_changed",
   "agent.timeline.message",
   "client.status_update",
+  "chimera.report_available",
   "compaction.failed",
   "completion.result",
   "context.compacted",
@@ -20053,12 +20054,67 @@ var SddWizardWebSocketHandler = class {
 // src/server/setup-events.ts
 import { recordTaskFileActivity } from "@wrongstack/kanban";
 
+// src/server/setup-events-core-watchers.ts
+import * as fs19 from "node:fs/promises";
+import * as path24 from "node:path";
+function registerSetupEventsCoreWatchers(deps2) {
+  const { broadcast: broadcast2, clients, context } = deps2;
+  const disposers = [];
+  const conversationState = context.state;
+  if (typeof conversationState?.onChange === "function") {
+    disposers.push(
+      conversationState.onChange((change) => {
+        if (change.kind !== "todos_replaced") return;
+        broadcast2(clients, {
+          type: "todos.updated",
+          payload: {
+            sessionId: context.session?.id ?? "",
+            todos: [...change.todos],
+            revision: conversationState.revision
+          }
+        });
+      })
+    );
+  }
+  const projectRoot = context.projectRoot;
+  if (projectRoot) {
+    disposers.push(
+      subscribeKanbanDaemonEvents(projectRoot, (message) => broadcast2(clients, message))
+    );
+  }
+  return disposers;
+}
+function registerSetupEventsClientStatusWriter(deps2) {
+  const { broadcast: broadcast2, clients, events, wpaths } = deps2;
+  const on = (event, listener) => events.on(event, listener);
+  return on("client.status", async (e) => {
+    broadcast2(clients, { type: "client.status_update", payload: e });
+    if (wpaths?.projectStatus) {
+      try {
+        const statusFile = wpaths.projectStatus(e.projectHash);
+        const dir = path24.dirname(statusFile);
+        await fs19.mkdir(dir, { recursive: true });
+        await fs19.writeFile(statusFile, JSON.stringify(e, null, 2), "utf-8");
+      } catch (err) {
+        console.error(
+          JSON.stringify({
+            level: "error",
+            event: "setup_events.status_write_failed",
+            message: err instanceof Error ? err.message : String(err),
+            timestamp: (/* @__PURE__ */ new Date()).toISOString()
+          })
+        );
+      }
+    }
+  });
+}
+
 // src/server/setup-events-fleet-broadcaster.ts
 import { watch as fsWatch } from "node:fs";
-import * as path24 from "node:path";
+import * as path25 from "node:path";
 function registerSetupEventsFleetBroadcaster(deps2) {
   const { globalConfigPath, wpaths, context, clients, broadcast: broadcast2, onFleetBroadcaster, isDisposed } = deps2;
-  const globalRoot = globalConfigPath ? path24.dirname(globalConfigPath) : void 0;
+  const globalRoot = globalConfigPath ? path25.dirname(globalConfigPath) : void 0;
   if (!globalRoot) return void 0;
   const disposers = [];
   const broadcastSessions = async () => {
@@ -20068,8 +20124,8 @@ function registerSetupEventsFleetBroadcaster(deps2) {
       const sessions = await registry.list();
       const ownEntry = sessions.find((s) => s.pid === process.pid);
       const mySlug = ownEntry?.projectSlug ?? wpaths?.projectSlug;
-      const myRoot = path24.resolve(context.projectRoot);
-      const live = sessions.filter((s) => s.status === "active" || s.status === "idle").filter((s) => mySlug ? s.projectSlug === mySlug : path24.resolve(s.projectRoot) === myRoot).map((s) => ({
+      const myRoot = path25.resolve(context.projectRoot);
+      const live = sessions.filter((s) => s.status === "active" || s.status === "idle").filter((s) => mySlug ? s.projectSlug === mySlug : path25.resolve(s.projectRoot) === myRoot).map((s) => ({
         sessionId: s.sessionId,
         projectName: s.projectName,
         projectSlug: s.projectSlug,
@@ -20259,14 +20315,14 @@ function createSetupEventSessionHelpers(context, sessionBridge) {
 
 // src/server/setup-events-status-watcher.ts
 import { watch as fsWatch2 } from "node:fs";
-import * as fs19 from "node:fs/promises";
-import * as path26 from "node:path";
+import * as fs20 from "node:fs/promises";
+import * as path27 from "node:path";
 
 // src/server/setup-events-watcher.ts
-import * as path25 from "node:path";
+import * as path26 from "node:path";
 function statusProjectHashFromWatchFilename(projectsDir, filename) {
   const raw = String(filename);
-  const relative5 = path25.isAbsolute(raw) ? path25.relative(projectsDir, raw) : raw;
+  const relative5 = path26.isAbsolute(raw) ? path26.relative(projectsDir, raw) : raw;
   const parts = relative5.split(/[\\/]+/).filter(Boolean);
   if (parts.length < 2 || parts.at(-1) !== "status.json") return null;
   return parts.at(-2) ?? null;
@@ -20301,7 +20357,7 @@ function logFileWatcherMetrics(metrics) {
 function registerSetupEventsStatusWatcher(deps2) {
   const { wpaths, watcherMetrics, clients, broadcast: broadcast2, on, isDisposed } = deps2;
   if (!wpaths?.projectStatus || !wpaths.globalRoot) return void 0;
-  const projectsDir = path26.join(wpaths.globalRoot, "projects");
+  const projectsDir = path27.join(wpaths.globalRoot, "projects");
   const knownProjectHashes = /* @__PURE__ */ new Set();
   const debounceTimers = /* @__PURE__ */ new Map();
   const DEBOUNCE_MS2 = 150;
@@ -20346,7 +20402,7 @@ function registerSetupEventsStatusWatcher(deps2) {
   let watcher;
   const startWatcher = async () => {
     try {
-      await fs19.mkdir(projectsDir, { recursive: true });
+      await fs20.mkdir(projectsDir, { recursive: true });
       if (isDisposed()) return;
       watcher = fsWatch2(
         projectsDir,
@@ -20360,8 +20416,8 @@ function registerSetupEventsStatusWatcher(deps2) {
           if (!knownProjectHashes.has(projectHash)) return;
           if (watcherMetrics) watcherMetrics.filesProcessed++;
           try {
-            const targetFile = path26.join(projectsDir, projectHash, "status.json");
-            const content = await fs19.readFile(targetFile, "utf-8");
+            const targetFile = path27.join(projectsDir, projectHash, "status.json");
+            const content = await fs20.readFile(targetFile, "utf-8");
             const statusData = JSON.parse(content);
             scheduleBroadcast(projectHash, statusData);
           } catch {
@@ -20417,61 +20473,6 @@ function registerSetupEventsStatusWatcher(deps2) {
   };
 }
 
-// src/server/setup-events-core-watchers.ts
-import * as fs20 from "node:fs/promises";
-import * as path27 from "node:path";
-function registerSetupEventsCoreWatchers(deps2) {
-  const { broadcast: broadcast2, clients, context } = deps2;
-  const disposers = [];
-  const conversationState = context.state;
-  if (typeof conversationState?.onChange === "function") {
-    disposers.push(
-      conversationState.onChange((change) => {
-        if (change.kind !== "todos_replaced") return;
-        broadcast2(clients, {
-          type: "todos.updated",
-          payload: {
-            sessionId: context.session?.id ?? "",
-            todos: [...change.todos],
-            revision: conversationState.revision
-          }
-        });
-      })
-    );
-  }
-  const projectRoot = context.projectRoot;
-  if (projectRoot) {
-    disposers.push(
-      subscribeKanbanDaemonEvents(projectRoot, (message) => broadcast2(clients, message))
-    );
-  }
-  return disposers;
-}
-function registerSetupEventsClientStatusWriter(deps2) {
-  const { broadcast: broadcast2, clients, events, wpaths } = deps2;
-  const on = (event, listener) => events.on(event, listener);
-  return on("client.status", async (e) => {
-    broadcast2(clients, { type: "client.status_update", payload: e });
-    if (wpaths?.projectStatus) {
-      try {
-        const statusFile = wpaths.projectStatus(e.projectHash);
-        const dir = path27.dirname(statusFile);
-        await fs20.mkdir(dir, { recursive: true });
-        await fs20.writeFile(statusFile, JSON.stringify(e, null, 2), "utf-8");
-      } catch (err) {
-        console.error(
-          JSON.stringify({
-            level: "error",
-            event: "setup_events.status_write_failed",
-            message: err instanceof Error ? err.message : String(err),
-            timestamp: (/* @__PURE__ */ new Date()).toISOString()
-          })
-        );
-      }
-    }
-  });
-}
-
 // src/server/setup-events.ts
 function setupEvents(deps2) {
   const {
@@ -21027,6 +21028,12 @@ function setupEvents(deps2) {
     });
   });
   disposers.push(
+    events.onPattern("chimera.report_available", (_event, payload) => {
+      broadcast2(clients, {
+        type: "chimera.report_available",
+        payload
+      });
+    }),
     events.onPattern("mailbox.received", (_e, payload) => {
       broadcast2(clients, { type: "mailbox.received", payload });
     }),
@@ -21543,10 +21550,12 @@ import {
 } from "@wrongstack/core/utils";
 import { makeLightSubagentFactory } from "@wrongstack/runtime";
 import {
+  createSageContextMonitorMiddleware,
   createSageToolCallMiddleware,
   createSageTurnMiddleware,
   getSageRetrieval,
-  getSageService
+  getSageService,
+  InjectionTracker
 } from "@wrongstack/sage";
 
 // src/server/discover-mailbox-bridge.ts
@@ -22394,6 +22403,8 @@ async function createAgentServices(input) {
   installDesignStudioMiddleware({ pipelines, ctx: context });
   const memoryRetrieval = getSageRetrieval(memoryStore);
   if (config.features.memory !== false && config.Sage?.enabled !== false && memoryRetrieval) {
+    const sageInjectionTracker = new InjectionTracker();
+    const getSageSessionId = () => input.sessionGetter().id;
     if (config.Sage?.inject?.toolResults !== false) {
       pipelines.toolCall.use(
         createSageToolCallMiddleware({
@@ -22411,7 +22422,9 @@ async function createAgentServices(input) {
           // middleware falls back to ctx.session.id for cooldown but passes
           // undefined to retrieval, causing owned session-scoped memories to be
           // silently excluded from tool-call injection.
-          getSessionId: () => input.sessionGetter().id
+          getSessionId: getSageSessionId,
+          tracker: sageInjectionTracker,
+          events
         })
       );
     }
@@ -22421,10 +22434,19 @@ async function createAgentServices(input) {
           memory: memoryRetrieval,
           maxMemories: config.Sage?.inject?.maxTurnMemories,
           maxChars: config.Sage?.inject?.maxCharsPerTurn,
-          minScore: config.Sage?.inject?.minScore
+          minScore: config.Sage?.inject?.minScore,
+          getSessionId: getSageSessionId,
+          tracker: sageInjectionTracker
         })
       );
     }
+    pipelines.request.use(
+      createSageContextMonitorMiddleware({
+        tracker: sageInjectionTracker,
+        events,
+        getSessionId: getSageSessionId
+      })
+    );
   }
   const codebaseIndexing = setupWebUICodebaseIndexing({
     config,

package/dist/protocol/index.js

@@ -315,6 +315,7 @@ var SERVER_CONVERSATION_MESSAGE_TYPES = [
   "agent.status_changed",
   "agent.timeline.message",
   "client.status_update",
+  "chimera.report_available",
   "compaction.failed",
   "completion.result",
   "context.compacted",

package/dist/protocol/registry.d.ts

@@ -1,5 +1,5 @@
 export declare const CLIENT_MESSAGE_TYPES: readonly ["abort", "ping", "user_message", "tool.confirm_result", "completion.request", "model.switch", "model.refine", "autonomy.switch", "context.clear", "context.compact", "context.debug", "context.editor.open", "context.editor.validate", "context.editor.apply", "context.mode.create", "context.mode.delete", "context.mode.switch", "context.mode.update", "context.modes.list", "context.repair", "mode.switch", "modes.list", "session.checkpoints", "session.delete", "session.new", "session.rename", "session.resume", "session.rewind", "session.save", "sessions.list", "side_effects.list", "stats.get", "todo.update", "todos.clear", "todos.get", "todos.remove", "collab.join", "collab.leave", "collab.annotate", "collab.resolve", "collab.request_pause", "collab.resume", "collab.grant_control", "collab.inject_tool", "mailbox.action", "mailbox.agents", "mailbox.clear", "mailbox.compact", "mailbox.messages", "mailbox.purge", "mailbox.send", "files.list", "files.read", "files.tree", "files.write", "git.changes", "git.diff", "git.info", "projects.add", "projects.list", "projects.select", "working_dir.set", "worktree.cleanup", "worktree.diff", "worktree.merge", "worktree.remove", "worktree.scan", "shell.open", "process.kill", "process.killAll", "process.list", "terminal.close", "terminal.create", "terminal.input", "terminal.resize", "codebase.index.server.shutdown", "connections.health", "connections.service_action", "diag.get", "key.add", "key.delete", "key.set_active", "key.update", "prefs.get", "prefs.update", "provider.add", "provider.clear_models", "provider.models", "provider.models.search", "provider.probe", "provider.remove", "provider.status.clear", "provider.status.get", "provider.status.retry", "provider.undo_clear", "provider.update", "providers.list", "providers.saved", "tool.disable", "tool.enable", "tools.list", "webui.shutdown", "goal-state.get", "goal.addTask", "goal.assess", "goal.assignTask", "goal.clear", "goal.get", "goal.list", "goal.load", "goal.moveTask", "goal.pause", "goal.resume", "goal.retryTask", "goal.revert", "goal.runTask", "goal.save", "goal.selectPhase", "goal.start", "goal.state", "goal.status", "goal.stop", "goal.taskStatus", "goal.toggleAutonomous", "plan.get", "plan.item.update", "plan.template_use", "task.update", "tasks.get", "sdd.board.cancel_task", "sdd.board.cleanup_worktrees", "sdd.board.delete_task", "sdd.board.destroy", "sdd.board.get", "sdd.board.list", "sdd.board.pause", "sdd.board.reassign", "sdd.board.resume", "sdd.board.retry", "sdd.board.retry_all_failed", "sdd.board.rollback", "sdd.board.set_task_fallbacks", "sdd.board.set_task_model", "sdd.board.set_task_verification", "sdd.board.split_task", "sdd.board.stop", "sdd.run.from_graph", "sdd.run.from_spec", "sdd.run.start", "sdd.spec.approve", "sdd.spec.discard", "sdd.spec.get", "sdd.spec.message", "sdd.spec.start", "specs.get", "specs.list", "specs.taskStatus", "brain.ask", "brain.config.get", "brain.config.set", "brain.risk", "brain.status", "chronicle.facet", "chronicle.facets", "chronicle.graph", "chronicle.metrics", "chronicle.query", "chronicle.status", "config.doctor", "design.list", "design.materialize", "design.set", "design.state", "design.swap", "design.tune", "design.use", "design.verify", "memory.list", "memory.sage.backfillRecoverable", "memory.sage.candidateResolve", "memory.sage.delete", "memory.sage.forFile", "memory.sage.get", "memory.sage.graph", "memory.sage.list", "memory.sage.listPage", "memory.sage.recover", "memory.sage.remember", "memory.sage.update", "auth.oauth.cancel", "auth.oauth.code", "auth.oauth.start", "mcp.add", "mcp.disable", "mcp.discover", "mcp.enable", "mcp.list", "mcp.prompt.get", "mcp.prompts", "mcp.remove", "mcp.resource.read", "mcp.resources", "mcp.restart", "mcp.sleep", "mcp.update", "mcp.wake", "prompts.content", "prompts.create", "prompts.favorite", "prompts.list", "prompts.recent", "prompts.search", "prompts.used", "skills.content", "skills.create", "skills.edit", "skills.export", "skills.install", "skills.list", "skills.uninstall", "skills.update"];
-export declare const SERVER_MESSAGE_TYPES: readonly ["error", "log", "pong", "side_effects", "agent.status_changed", "agent.timeline.message", "client.status_update", "compaction.failed", "completion.result", "context.compacted", "context.debug", "context.editor.snapshot", "context.editor.validation", "context.editor.applied", "context.mode.changed", "context.modes.list", "context.repaired", "ctx.max_context", "ctx.pct", "delegate.completed", "delegate.started", "iteration.completed", "iteration.limit_reached", "iteration.started", "model.refine_result", "modes.list", "provider.active_blocked", "provider.error", "provider.fallback", "provider.response", "provider.retry", "provider.status_changed", "provider.stream_error", "provider.text_delta", "provider.thinking_delta", "run.result", "session.checkpoints", "session.damaged", "session.end", "session.rewound", "session.start", "session.stats", "sessions.list", "sessions.status_update", "stats.get", "token.cost_estimate_unavailable", "token.threshold", "tool.confirm_needed", "tool.disabled", "tool.enabled", "tool.executed", "tool.loop_detected", "tool.progress", "tool.started", "tools.list", "trust.persisted", "collab.annotation.added", "collab.annotation.resolved", "collab.event", "collab.injection.granted", "collab.participant.joined", "collab.participant.left", "collab.pause.granted", "collab.pause.released", "collab.state", "mailbox.action_result", "mailbox.agent_registered", "mailbox.agents", "mailbox.cleared", "mailbox.compacted", "mailbox.event", "mailbox.messages", "mailbox.sent", "mailbox.purged", "mailbox.received", "subagent.budget_extended", "subagent.event", "checkpoint.written", "codemap.file_event", "codemap.index_updated", "codemap.tool_executed", "codemap.tool_started", "file.saved", "files.list", "files.read", "files.tree", "files.written", "git.changes", "git.diff", "git.info", "process.list", "projects.added", "projects.list", "projects.selected", "terminal.exit", "terminal.output", "working_dir.changed", "worktree.cleanup_result", "worktree.diff_result", "worktree.event", "worktree.merge_result", "worktree.orphans", "worktree.state", "auth.oauth.status", "codebase.index.server.shutdown_result", "connections.health_error", "connections.health_result", "connections.service_action_result", "diag.get", "key.operation_result", "model.switch_result", "prefs.updated", "provider.catalog", "provider.models", "provider.models.search_result", "provider.probe", "provider.status.snapshot", "providers.saved", "budget.decision", "budget.threshold_reached", "coordinator.stats", "coordinator.status", "eternal.iteration", "fleet.concurrency_update", "goal-state.updated", "goal.assess.result", "goal.list", "goal.paused", "goal.resumed", "goal.saved", "goal.error", "goal.stopped", "goal.failed", "goal.completed", "goal.cleared", "goal.reverted", "goal.progress", "goal.state", "in_flight.ended", "in_flight.started", "plan.updated", "task.completed", "task.failed", "task.pending", "task.started", "tasks.updated", "todos.cleared", "todos.updated", "kanban.task.activity", "sdd.board.lifecycle_result", "sdd.board.list", "sdd.board.snapshot", "sdd.run.started", "sdd.spec.agent_text", "sdd.spec.error", "sdd.spec.snapshot", "specs.detail", "specs.list", "consensus.vote_cast", "consensus.vote_initiated", "consensus.vote_resolved", "cron.job_fired", "cron.snapshot", "techstack.job.cancelled", "techstack.job.failed", "techstack.job.progress", "techstack.job.started", "techstack.report.delivered", "techstack.report.ready", "techstack.snapshot.updated", "techstack.workspace.completed", "brain.answer", "brain.config", "brain.event", "brain.status", "chronicle.error", "chronicle.facet_result", "chronicle.facets_result", "chronicle.graph_result", "chronicle.metrics_result", "chronicle.query_result", "chronicle.status_result", "config.doctor.result", "design.list", "design.materialize", "design.set", "design.state", "design.swap", "design.tune", "design.use", "design.verify", "memory.event", "memory.list", "memory.sage.backfillRecoverable", "memory.sage.candidateResolve", "memory.sage.delete", "memory.sage.forFile", "memory.sage.get", "memory.sage.graph", "memory.sage.list", "memory.sage.listPage", "memory.sage.recover", "memory.sage.remember", "memory.sage.update", "mcp.content.error", "mcp.content.selected", "mcp.list", "mcp.operation_result", "mcp.prompts", "mcp.resources", "mcp.server.added", "mcp.server.connected", "mcp.server.disconnected", "mcp.server.discovered", "mcp.server.error", "mcp.server.reconnected", "mcp.server.removed", "mcp.server.sleeping", "mcp.server.updated", "mcp.server.waking", "prompts.content", "prompts.created", "prompts.favorite", "prompts.list", "prompts.recent", "prompts.search", "prompts.used", "skills.content", "skills.created", "skills.edited", "skills.exported", "skills.installed", "skills.list", "skills.uninstalled", "skills.updated"];
+export declare const SERVER_MESSAGE_TYPES: readonly ["error", "log", "pong", "side_effects", "agent.status_changed", "agent.timeline.message", "client.status_update", "chimera.report_available", "compaction.failed", "completion.result", "context.compacted", "context.debug", "context.editor.snapshot", "context.editor.validation", "context.editor.applied", "context.mode.changed", "context.modes.list", "context.repaired", "ctx.max_context", "ctx.pct", "delegate.completed", "delegate.started", "iteration.completed", "iteration.limit_reached", "iteration.started", "model.refine_result", "modes.list", "provider.active_blocked", "provider.error", "provider.fallback", "provider.response", "provider.retry", "provider.status_changed", "provider.stream_error", "provider.text_delta", "provider.thinking_delta", "run.result", "session.checkpoints", "session.damaged", "session.end", "session.rewound", "session.start", "session.stats", "sessions.list", "sessions.status_update", "stats.get", "token.cost_estimate_unavailable", "token.threshold", "tool.confirm_needed", "tool.disabled", "tool.enabled", "tool.executed", "tool.loop_detected", "tool.progress", "tool.started", "tools.list", "trust.persisted", "collab.annotation.added", "collab.annotation.resolved", "collab.event", "collab.injection.granted", "collab.participant.joined", "collab.participant.left", "collab.pause.granted", "collab.pause.released", "collab.state", "mailbox.action_result", "mailbox.agent_registered", "mailbox.agents", "mailbox.cleared", "mailbox.compacted", "mailbox.event", "mailbox.messages", "mailbox.sent", "mailbox.purged", "mailbox.received", "subagent.budget_extended", "subagent.event", "checkpoint.written", "codemap.file_event", "codemap.index_updated", "codemap.tool_executed", "codemap.tool_started", "file.saved", "files.list", "files.read", "files.tree", "files.written", "git.changes", "git.diff", "git.info", "process.list", "projects.added", "projects.list", "projects.selected", "terminal.exit", "terminal.output", "working_dir.changed", "worktree.cleanup_result", "worktree.diff_result", "worktree.event", "worktree.merge_result", "worktree.orphans", "worktree.state", "auth.oauth.status", "codebase.index.server.shutdown_result", "connections.health_error", "connections.health_result", "connections.service_action_result", "diag.get", "key.operation_result", "model.switch_result", "prefs.updated", "provider.catalog", "provider.models", "provider.models.search_result", "provider.probe", "provider.status.snapshot", "providers.saved", "budget.decision", "budget.threshold_reached", "coordinator.stats", "coordinator.status", "eternal.iteration", "fleet.concurrency_update", "goal-state.updated", "goal.assess.result", "goal.list", "goal.paused", "goal.resumed", "goal.saved", "goal.error", "goal.stopped", "goal.failed", "goal.completed", "goal.cleared", "goal.reverted", "goal.progress", "goal.state", "in_flight.ended", "in_flight.started", "plan.updated", "task.completed", "task.failed", "task.pending", "task.started", "tasks.updated", "todos.cleared", "todos.updated", "kanban.task.activity", "sdd.board.lifecycle_result", "sdd.board.list", "sdd.board.snapshot", "sdd.run.started", "sdd.spec.agent_text", "sdd.spec.error", "sdd.spec.snapshot", "specs.detail", "specs.list", "consensus.vote_cast", "consensus.vote_initiated", "consensus.vote_resolved", "cron.job_fired", "cron.snapshot", "techstack.job.cancelled", "techstack.job.failed", "techstack.job.progress", "techstack.job.started", "techstack.report.delivered", "techstack.report.ready", "techstack.snapshot.updated", "techstack.workspace.completed", "brain.answer", "brain.config", "brain.event", "brain.status", "chronicle.error", "chronicle.facet_result", "chronicle.facets_result", "chronicle.graph_result", "chronicle.metrics_result", "chronicle.query_result", "chronicle.status_result", "config.doctor.result", "design.list", "design.materialize", "design.set", "design.state", "design.swap", "design.tune", "design.use", "design.verify", "memory.event", "memory.list", "memory.sage.backfillRecoverable", "memory.sage.candidateResolve", "memory.sage.delete", "memory.sage.forFile", "memory.sage.get", "memory.sage.graph", "memory.sage.list", "memory.sage.listPage", "memory.sage.recover", "memory.sage.remember", "memory.sage.update", "mcp.content.error", "mcp.content.selected", "mcp.list", "mcp.operation_result", "mcp.prompts", "mcp.resources", "mcp.server.added", "mcp.server.connected", "mcp.server.disconnected", "mcp.server.discovered", "mcp.server.error", "mcp.server.reconnected", "mcp.server.removed", "mcp.server.sleeping", "mcp.server.updated", "mcp.server.waking", "prompts.content", "prompts.created", "prompts.favorite", "prompts.list", "prompts.recent", "prompts.search", "prompts.used", "skills.content", "skills.created", "skills.edited", "skills.exported", "skills.installed", "skills.list", "skills.uninstalled", "skills.updated"];
 export type ExactClientMessageType = (typeof CLIENT_MESSAGE_TYPES)[number];
 export type ExactServerMessageType = (typeof SERVER_MESSAGE_TYPES)[number];
 export declare function isRegisteredMessageType(type: string, direction: 'client' | 'server'): boolean;

package/dist/protocol/server-conversation.d.ts

@@ -1,3 +1,3 @@
-export declare const SERVER_CONVERSATION_MESSAGE_TYPES: readonly ['error', 'log', 'pong', 'side_effects', 'agent.status_changed', 'agent.timeline.message', 'client.status_update', 'compaction.failed', 'completion.result', 'context.compacted', 'context.debug', 'context.editor.snapshot', 'context.editor.validation', 'context.editor.applied', 'context.mode.changed', 'context.modes.list', 'context.repaired', 'ctx.max_context', 'ctx.pct', 'delegate.completed', 'delegate.started', 'iteration.completed', 'iteration.limit_reached', 'iteration.started', 'model.refine_result', 'modes.list', 'provider.active_blocked', 'provider.error', 'provider.fallback', 'provider.response', 'provider.retry', 'provider.status_changed', 'provider.stream_error', 'provider.text_delta', 'provider.thinking_delta', 'run.result', 'session.checkpoints', 'session.damaged', 'session.end', 'session.rewound', 'session.start', 'session.stats', 'sessions.list', 'sessions.status_update', 'stats.get', 'token.cost_estimate_unavailable', 'token.threshold', 'tool.confirm_needed', 'tool.disabled', 'tool.enabled', 'tool.executed', 'tool.loop_detected', 'tool.progress', 'tool.started', 'tools.list', 'trust.persisted'];
+export declare const SERVER_CONVERSATION_MESSAGE_TYPES: readonly ['error', 'log', 'pong', 'side_effects', 'agent.status_changed', 'agent.timeline.message', 'client.status_update', 'chimera.report_available', 'compaction.failed', 'completion.result', 'context.compacted', 'context.debug', 'context.editor.snapshot', 'context.editor.validation', 'context.editor.applied', 'context.mode.changed', 'context.modes.list', 'context.repaired', 'ctx.max_context', 'ctx.pct', 'delegate.completed', 'delegate.started', 'iteration.completed', 'iteration.limit_reached', 'iteration.started', 'model.refine_result', 'modes.list', 'provider.active_blocked', 'provider.error', 'provider.fallback', 'provider.response', 'provider.retry', 'provider.status_changed', 'provider.stream_error', 'provider.text_delta', 'provider.thinking_delta', 'run.result', 'session.checkpoints', 'session.damaged', 'session.end', 'session.rewound', 'session.start', 'session.stats', 'sessions.list', 'sessions.status_update', 'stats.get', 'token.cost_estimate_unavailable', 'token.threshold', 'tool.confirm_needed', 'tool.disabled', 'tool.enabled', 'tool.executed', 'tool.loop_detected', 'tool.progress', 'tool.started', 'tools.list', 'trust.persisted'];
 export declare const SERVER_COLLABORATION_MESSAGE_TYPES: readonly ['collab.annotation.added', 'collab.annotation.resolved', 'collab.event', 'collab.injection.granted', 'collab.participant.joined', 'collab.participant.left', 'collab.pause.granted', 'collab.pause.released', 'collab.state', 'mailbox.action_result', 'mailbox.agent_registered', 'mailbox.agents', 'mailbox.cleared', 'mailbox.compacted', 'mailbox.event', 'mailbox.messages', 'mailbox.sent', 'mailbox.purged', 'mailbox.received', 'subagent.budget_extended', 'subagent.event'];
 //# sourceMappingURL=server-conversation.d.ts.map

package/dist/server/entry.js

@@ -77,8 +77,7 @@ var BOOLEAN_PREF_KEYS = /* @__PURE__ */ new Set([
   // Display-only toggles (purely visual, persisted in localStorage via Zustand).
   "groupToolCalls",
   "showThinkingLogs",
-  // v11 Display parity: agent-swarm panel + inverse fsAccess flag.
-  "showAgentSwarmPanel",
+  // v11 Display parity: inverse fsAccess flag.
   "allowOutsideProjectRoot",
   // v13 Display parity (TUI SettingsPicker fields 42 & 43): the read tool
   // includes codebase-index symbols, and SAGE memory-inject blocks are
@@ -173,7 +172,8 @@ var ENUM_PREF_KEYS = {
   // Chimera autoFix + auto-review cascade threshold
   chimeraAutoFix: /* @__PURE__ */ new Set(["off", "ask", "auto"]),
   autoReviewCascadeOn: /* @__PURE__ */ new Set(["off", "critical", "high"]),
-  fleetChatVerbosity: /* @__PURE__ */ new Set(["off", "full"])
+  fleetChatVerbosity: /* @__PURE__ */ new Set(["off", "full"]),
+  showAgentSwarmPanel: /* @__PURE__ */ new Set(["bottom", "sidebar", "off"])
 };
 function validateModelRuntimeValue(modelRuntime, path30) {
   const reasoning = modelRuntime["reasoning"];
@@ -8381,7 +8381,7 @@ function buildCspHeader(publicWsUrl, host, port) {
   if (host && isLoopbackHostname(host)) {
     const p = port ?? 3456;
     if (p > 0 && p <= 65535) {
-      for (const h of ["127.0.0.1", "localhost", "[::1]"]) {
+      for (const h of ["127.0.0.1", "localhost"]) {
         connect.add(`ws://${h}:${p}`);
         connect.add(`wss://${h}:${p}`);
       }
@@ -14399,6 +14399,7 @@ var SERVER_CONVERSATION_MESSAGE_TYPES = [
   "agent.status_changed",
   "agent.timeline.message",
   "client.status_update",
+  "chimera.report_available",
   "compaction.failed",
   "completion.result",
   "context.compacted",
@@ -17289,12 +17290,67 @@ var SddWizardWebSocketHandler = class {
 // src/server/setup-events.ts
 import { recordTaskFileActivity } from "@wrongstack/kanban";
 
+// src/server/setup-events-core-watchers.ts
+import * as fs17 from "node:fs/promises";
+import * as path19 from "node:path";
+function registerSetupEventsCoreWatchers(deps2) {
+  const { broadcast: broadcast2, clients, context } = deps2;
+  const disposers = [];
+  const conversationState = context.state;
+  if (typeof conversationState?.onChange === "function") {
+    disposers.push(
+      conversationState.onChange((change) => {
+        if (change.kind !== "todos_replaced") return;
+        broadcast2(clients, {
+          type: "todos.updated",
+          payload: {
+            sessionId: context.session?.id ?? "",
+            todos: [...change.todos],
+            revision: conversationState.revision
+          }
+        });
+      })
+    );
+  }
+  const projectRoot = context.projectRoot;
+  if (projectRoot) {
+    disposers.push(
+      subscribeKanbanDaemonEvents(projectRoot, (message) => broadcast2(clients, message))
+    );
+  }
+  return disposers;
+}
+function registerSetupEventsClientStatusWriter(deps2) {
+  const { broadcast: broadcast2, clients, events, wpaths } = deps2;
+  const on = (event, listener) => events.on(event, listener);
+  return on("client.status", async (e) => {
+    broadcast2(clients, { type: "client.status_update", payload: e });
+    if (wpaths?.projectStatus) {
+      try {
+        const statusFile = wpaths.projectStatus(e.projectHash);
+        const dir = path19.dirname(statusFile);
+        await fs17.mkdir(dir, { recursive: true });
+        await fs17.writeFile(statusFile, JSON.stringify(e, null, 2), "utf-8");
+      } catch (err) {
+        console.error(
+          JSON.stringify({
+            level: "error",
+            event: "setup_events.status_write_failed",
+            message: err instanceof Error ? err.message : String(err),
+            timestamp: (/* @__PURE__ */ new Date()).toISOString()
+          })
+        );
+      }
+    }
+  });
+}
+
 // src/server/setup-events-fleet-broadcaster.ts
 import { watch as fsWatch } from "node:fs";
-import * as path19 from "node:path";
+import * as path20 from "node:path";
 function registerSetupEventsFleetBroadcaster(deps2) {
   const { globalConfigPath, wpaths, context, clients, broadcast: broadcast2, onFleetBroadcaster, isDisposed } = deps2;
-  const globalRoot = globalConfigPath ? path19.dirname(globalConfigPath) : void 0;
+  const globalRoot = globalConfigPath ? path20.dirname(globalConfigPath) : void 0;
   if (!globalRoot) return void 0;
   const disposers = [];
   const broadcastSessions = async () => {
@@ -17304,8 +17360,8 @@ function registerSetupEventsFleetBroadcaster(deps2) {
       const sessions = await registry.list();
       const ownEntry = sessions.find((s) => s.pid === process.pid);
       const mySlug = ownEntry?.projectSlug ?? wpaths?.projectSlug;
-      const myRoot = path19.resolve(context.projectRoot);
-      const live = sessions.filter((s) => s.status === "active" || s.status === "idle").filter((s) => mySlug ? s.projectSlug === mySlug : path19.resolve(s.projectRoot) === myRoot).map((s) => ({
+      const myRoot = path20.resolve(context.projectRoot);
+      const live = sessions.filter((s) => s.status === "active" || s.status === "idle").filter((s) => mySlug ? s.projectSlug === mySlug : path20.resolve(s.projectRoot) === myRoot).map((s) => ({
         sessionId: s.sessionId,
         projectName: s.projectName,
         projectSlug: s.projectSlug,
@@ -17495,14 +17551,14 @@ function createSetupEventSessionHelpers(context, sessionBridge) {
 
 // src/server/setup-events-status-watcher.ts
 import { watch as fsWatch2 } from "node:fs";
-import * as fs17 from "node:fs/promises";
-import * as path21 from "node:path";
+import * as fs18 from "node:fs/promises";
+import * as path22 from "node:path";
 
 // src/server/setup-events-watcher.ts
-import * as path20 from "node:path";
+import * as path21 from "node:path";
 function statusProjectHashFromWatchFilename(projectsDir, filename) {
   const raw = String(filename);
-  const relative5 = path20.isAbsolute(raw) ? path20.relative(projectsDir, raw) : raw;
+  const relative5 = path21.isAbsolute(raw) ? path21.relative(projectsDir, raw) : raw;
   const parts = relative5.split(/[\\/]+/).filter(Boolean);
   if (parts.length < 2 || parts.at(-1) !== "status.json") return null;
   return parts.at(-2) ?? null;
@@ -17537,7 +17593,7 @@ function logFileWatcherMetrics(metrics) {
 function registerSetupEventsStatusWatcher(deps2) {
   const { wpaths, watcherMetrics, clients, broadcast: broadcast2, on, isDisposed } = deps2;
   if (!wpaths?.projectStatus || !wpaths.globalRoot) return void 0;
-  const projectsDir = path21.join(wpaths.globalRoot, "projects");
+  const projectsDir = path22.join(wpaths.globalRoot, "projects");
   const knownProjectHashes = /* @__PURE__ */ new Set();
   const debounceTimers = /* @__PURE__ */ new Map();
   const DEBOUNCE_MS = 150;
@@ -17582,7 +17638,7 @@ function registerSetupEventsStatusWatcher(deps2) {
   let watcher;
   const startWatcher = async () => {
     try {
-      await fs17.mkdir(projectsDir, { recursive: true });
+      await fs18.mkdir(projectsDir, { recursive: true });
       if (isDisposed()) return;
       watcher = fsWatch2(
         projectsDir,
@@ -17596,8 +17652,8 @@ function registerSetupEventsStatusWatcher(deps2) {
           if (!knownProjectHashes.has(projectHash)) return;
           if (watcherMetrics) watcherMetrics.filesProcessed++;
           try {
-            const targetFile = path21.join(projectsDir, projectHash, "status.json");
-            const content = await fs17.readFile(targetFile, "utf-8");
+            const targetFile = path22.join(projectsDir, projectHash, "status.json");
+            const content = await fs18.readFile(targetFile, "utf-8");
             const statusData = JSON.parse(content);
             scheduleBroadcast(projectHash, statusData);
           } catch {
@@ -17653,61 +17709,6 @@ function registerSetupEventsStatusWatcher(deps2) {
   };
 }
 
-// src/server/setup-events-core-watchers.ts
-import * as fs18 from "node:fs/promises";
-import * as path22 from "node:path";
-function registerSetupEventsCoreWatchers(deps2) {
-  const { broadcast: broadcast2, clients, context } = deps2;
-  const disposers = [];
-  const conversationState = context.state;
-  if (typeof conversationState?.onChange === "function") {
-    disposers.push(
-      conversationState.onChange((change) => {
-        if (change.kind !== "todos_replaced") return;
-        broadcast2(clients, {
-          type: "todos.updated",
-          payload: {
-            sessionId: context.session?.id ?? "",
-            todos: [...change.todos],
-            revision: conversationState.revision
-          }
-        });
-      })
-    );
-  }
-  const projectRoot = context.projectRoot;
-  if (projectRoot) {
-    disposers.push(
-      subscribeKanbanDaemonEvents(projectRoot, (message) => broadcast2(clients, message))
-    );
-  }
-  return disposers;
-}
-function registerSetupEventsClientStatusWriter(deps2) {
-  const { broadcast: broadcast2, clients, events, wpaths } = deps2;
-  const on = (event, listener) => events.on(event, listener);
-  return on("client.status", async (e) => {
-    broadcast2(clients, { type: "client.status_update", payload: e });
-    if (wpaths?.projectStatus) {
-      try {
-        const statusFile = wpaths.projectStatus(e.projectHash);
-        const dir = path22.dirname(statusFile);
-        await fs18.mkdir(dir, { recursive: true });
-        await fs18.writeFile(statusFile, JSON.stringify(e, null, 2), "utf-8");
-      } catch (err) {
-        console.error(
-          JSON.stringify({
-            level: "error",
-            event: "setup_events.status_write_failed",
-            message: err instanceof Error ? err.message : String(err),
-            timestamp: (/* @__PURE__ */ new Date()).toISOString()
-          })
-        );
-      }
-    }
-  });
-}
-
 // src/server/setup-events.ts
 function setupEvents(deps2) {
   const {
@@ -18263,6 +18264,12 @@ function setupEvents(deps2) {
     });
   });
   disposers.push(
+    events.onPattern("chimera.report_available", (_event, payload) => {
+      broadcast2(clients, {
+        type: "chimera.report_available",
+        payload
+      });
+    }),
     events.onPattern("mailbox.received", (_e, payload) => {
       broadcast2(clients, { type: "mailbox.received", payload });
     }),
@@ -18779,10 +18786,12 @@ import {
 } from "@wrongstack/core/utils";
 import { makeLightSubagentFactory } from "@wrongstack/runtime";
 import {
+  createSageContextMonitorMiddleware,
   createSageToolCallMiddleware,
   createSageTurnMiddleware,
   getSageRetrieval,
-  getSageService
+  getSageService,
+  InjectionTracker
 } from "@wrongstack/sage";
 
 // src/server/discover-mailbox-bridge.ts
@@ -19630,6 +19639,8 @@ async function createAgentServices(input) {
   installDesignStudioMiddleware({ pipelines, ctx: context });
   const memoryRetrieval = getSageRetrieval(memoryStore);
   if (config.features.memory !== false && config.Sage?.enabled !== false && memoryRetrieval) {
+    const sageInjectionTracker = new InjectionTracker();
+    const getSageSessionId = () => input.sessionGetter().id;
     if (config.Sage?.inject?.toolResults !== false) {
       pipelines.toolCall.use(
         createSageToolCallMiddleware({
@@ -19647,7 +19658,9 @@ async function createAgentServices(input) {
           // middleware falls back to ctx.session.id for cooldown but passes
           // undefined to retrieval, causing owned session-scoped memories to be
           // silently excluded from tool-call injection.
-          getSessionId: () => input.sessionGetter().id
+          getSessionId: getSageSessionId,
+          tracker: sageInjectionTracker,
+          events
         })
       );
     }
@@ -19657,10 +19670,19 @@ async function createAgentServices(input) {
           memory: memoryRetrieval,
           maxMemories: config.Sage?.inject?.maxTurnMemories,
           maxChars: config.Sage?.inject?.maxCharsPerTurn,
-          minScore: config.Sage?.inject?.minScore
+          minScore: config.Sage?.inject?.minScore,
+          getSessionId: getSageSessionId,
+          tracker: sageInjectionTracker
         })
       );
     }
+    pipelines.request.use(
+      createSageContextMonitorMiddleware({
+        tracker: sageInjectionTracker,
+        events,
+        getSessionId: getSageSessionId
+      })
+    );
   }
   const codebaseIndexing = setupWebUICodebaseIndexing({
     config,

package/dist/server/http-server.d.ts

@@ -89,7 +89,9 @@ export declare function injectWsConfig(html: string, opts: {
  *   When set, this origin is added to `connect-src` as a `ws://`/`wss://` entry.
  * @param host - The server bind host. When it matches a known loopback address
  *   (`127.0.0.1`, `::1`, `[::1]`, or `localhost`), explicit `ws://`/`wss://`
- *   entries for all three canonical loopback hosts are added to `connect-src`.
+ *   entries for `127.0.0.1` and `localhost` are added to `connect-src`.
+ *   IPv6 loopback (`[::1]`) is excluded — it produces an invalid CSP source
+ *   and is covered by `'self'` (CSP maps ws:→http:, wss:→https:).
  * @param port - The server listen port. Defaults to `3456`. Unnecessary when
  *   only publicWsUrl is used (no loopback branch).
  */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrongstack/webui-server",
-  "version": "0.298.0",
+  "version": "0.298.1",
   "license": "MIT",
   "description": "WrongStack WebUI HTTP/WebSocket server module — extracted from @wrongstack/webui in PR #243/244 to remove the CLI -> @wrongstack/webui/server cross-package edge (audit §3.1.1). Pure backend: HTTP routes, WebSocket handlers, MCP tool wrappers, HTML serving. The web frontend lives in @wrongstack/webui; this package is the standalone server it can run on.",
   "keywords": [
@@ -40,18 +40,18 @@
   ],
   "dependencies": {
     "ws": "^8.21.1",
-    "@wrongstack/core": "0.298.0",
-    "@wrongstack/runtime": "0.298.0",
-    "@wrongstack/sdd": "0.298.0",
-    "@wrongstack/kanban": "0.298.0",
-    "@wrongstack/mcp": "0.298.0",
-    "@wrongstack/techstack": "0.298.0",
-    "@wrongstack/providers": "0.298.0",
-    "@wrongstack/sage": "0.298.0",
-    "@wrongstack/tools": "0.298.0"
+    "@wrongstack/kanban": "0.298.1",
+    "@wrongstack/core": "0.298.1",
+    "@wrongstack/runtime": "0.298.1",
+    "@wrongstack/mcp": "0.298.1",
+    "@wrongstack/providers": "0.298.1",
+    "@wrongstack/techstack": "0.298.1",
+    "@wrongstack/sage": "0.298.1",
+    "@wrongstack/sdd": "0.298.1",
+    "@wrongstack/tools": "0.298.1"
   },
   "devDependencies": {
-    "@types/node": "^26.1.1",
+    "@types/node": "^26.1.2",
     "@types/ws": "^8.18.1",
     "typescript": "^7.0.2"
   },