@wrongstack/webui-server 0.298.3 → 0.300.0

package/dist/server/fallback-choice.d.ts

@@ -0,0 +1,19 @@
+import type { EventBus } from '@wrongstack/core/kernel';
+import type { WSClientMessage } from './types.js';
+/**
+ * Bridge a `model.fallback_choice` client message to the
+ * `provider.fallback_choice` EventBus emission consumed by the fallback gate
+ * (`packages/cli/src/wiring/fallback-gate.ts`). Shared by the standalone route
+ * table (`routes.ts`) and the embedded message router so wire validation and
+ * the event contract live in exactly one place.
+ *
+ * Returns `true` when the payload was valid and forwarded, `false` when the
+ * payload failed validation (the caller may send an error frame).
+ */
+export declare function emitFallbackChoice(events: EventBus | undefined, msg: WSClientMessage): {
+    ok: true;
+} | {
+    ok: false;
+    message: string;
+};
+//# sourceMappingURL=fallback-choice.d.ts.map

package/dist/server/frontend-static-serve.d.ts

@@ -75,6 +75,15 @@ export interface StaticServeOptions {
     deferListen?: boolean | undefined;
     /** Package-resolution/build seams supplied by the owning host. */
     ensureDistDeps?: EnsureDistDeps | undefined;
+    /**
+     * Requirements Intake service backing `/api/requirement-intakes*`. Omitted by
+     * every real host — a per-project service is constructed from `projectRoot` +
+     * `globalRoot` below, so the CLI-hosted WebUI serves the same intake records
+     * as the standalone server. Pass one only to override (tests/embeds); when
+     * `projectRoot` is absent there is no project to scope a store to and the
+     * routes correctly answer 503.
+     */
+    intakeService?: CreateHttpServerOptions['intakeService'];
 }
 /**
  * Resolve the webui package's built `dist` directory.

package/dist/server/http-server.d.ts

@@ -42,6 +42,19 @@ export interface CreateHttpServerOptions {
      * URL-token-only flow (e.g. in tests that don't want cookie state).
      */
     enableWsCookie?: boolean | undefined;
+    /**
+     * Mark the `ws_token` cookie `Secure` and give it the `__Host-` prefix.
+     *
+     * Inferred from a `wss://` {@link CreateHttpServerOptions.publicWsUrl} when
+     * omitted, which covers the tunnel deployments this server documents. Set it
+     * explicitly when TLS is terminated in front of the server by something that
+     * does not surface through `publicWsUrl` (e.g. an nginx `proxy_pass` with a
+     * separately configured WS origin).
+     *
+     * Must stay false on a plain-HTTP loopback bind: browsers do not send a
+     * `Secure` cookie over HTTP, so enabling it there breaks the WS handshake.
+     */
+    secureCookies?: boolean | undefined;
     /**
      * Optional file watcher metrics object. When provided, the
      * /debug/watcher-metrics endpoint will be enabled to expose these metrics.
@@ -74,10 +87,53 @@ export interface CreateHttpServerOptions {
     } | undefined) | undefined;
     /** Permission-governed language_package bridge for approved remediation. */
     executePackageOperation?: import('./techstack-handlers.js').TechStackHandlerDeps['executePackageOperation'];
+    /**
+     * Optional Requirements Intake service. When provided, the
+     * /api/projects/:projectId/requirement-intakes and
+     * /api/requirement-intakes/:intakeId endpoints are enabled; otherwise they
+     * respond 503.
+     */
+    intakeService?: import('@wrongstack/requirement-intake').RequirementIntakeService | undefined;
 }
 export declare function injectWsConfig(html: string, opts: {
     publicWsUrl?: string | undefined;
 }): string;
+/**
+ * WS-107: the auth cookie never carried `Secure`, on the stated grounds that
+ * "the dev server is plain HTTP on loopback". True for the default bind — and
+ * wrong for the deployment this server explicitly supports, where a tunnel
+ * terminates TLS in front of it (`publicWsUrl: wss://…`). There the browser is
+ * on HTTPS, so a cookie set without `Secure` is one the browser will also
+ * attach to a plaintext request to the same host: a downgrade or a stray
+ * `http://` link leaks the token that authenticates the whole control plane.
+ *
+ * So the flag follows the deployment. On an HTTPS-fronted server the cookie is
+ * additionally `__Host-`-prefixed, which browsers only accept when it is
+ * Secure, Path=/, and Domain-less — the same hardening the HQ server adopted.
+ * On loopback HTTP neither is usable (a `Secure` cookie would simply not be
+ * sent), so the plain name is kept there.
+ */
+export declare const WS_TOKEN_COOKIE = "ws_token";
+export declare const WS_TOKEN_COOKIE_SECURE = "__Host-ws_token";
+/**
+ * Resolve the access token presented on an HTTP request.
+ *
+ * WS-108: the `?token=` query source was accepted on EVERY route regardless of
+ * bind. On a tunnel that is the C-598 exposure the WS path already closed —
+ * the token reaches reverse-proxy access logs, browser history, and any
+ * `Referer` the page emits to a third-party origin. The header and cookie
+ * sources have none of those channels.
+ *
+ * `allowQuery` is therefore opt-in and reserved for the two places the token
+ * legitimately rides the URL: `/ws-auth`, whose entire job is to exchange it
+ * for the cookie, and the HTML page load the operator opens from the printed
+ * access URL. Everywhere else it is refused off-loopback — and when refused,
+ * resolution falls through to the header and cookie rather than returning
+ * early, so a client that sent both still authenticates.
+ */
+export declare function requestToken(req: http.IncomingMessage, url: URL, opts?: {
+    allowQuery?: boolean;
+}): string | undefined;
 /**
  * Build the Content-Security-Policy value for the WebUI.
  *

package/dist/server/instance-registry.d.ts

@@ -36,6 +36,27 @@ export interface WebUIInstanceRecord {
     startedAt: string;
     /** Convenience open-in-browser URL. */
     url: string;
+    /**
+     * Access token for this instance's HTTP API, so a same-project sibling
+     * process (TUI/REPL) can authenticate the `POST /api/fleet/ping`
+     * push-on-write nudge.
+     *
+     * Security scan 2026-08-04, finding H3: the API used to require no
+     * credential at all on a loopback bind. Closing that meant the one
+     * legitimate non-browser caller needed a way to obtain the token, and this
+     * registry — already `0o600`, already read by exactly those siblings — is
+     * where it belongs.
+     *
+     * Be precise about what this is worth. Storing the token here raises the bar
+     * against a *different-user* or sandboxed local process, which cannot read
+     * the file. It does nothing against a process running as the same user: that
+     * process can read this file, and could read `~/.wrongstack/projects/*` —
+     * the very transcripts the API exposes — without going near the API at all.
+     * The same reasoning already applies to HQ's `auth.json`.
+     *
+     * Optional so an older record (or a surface that has no token) still parses.
+     */
+    authToken?: string | undefined;
 }
 /** Default wstack home dir (`~/.wrongstack`). Callers may override the base. */
 export declare function defaultBaseDir(): string;

package/dist/server/intake-service.d.ts

@@ -0,0 +1,13 @@
+import { RequirementIntakeService } from '@wrongstack/requirement-intake';
+/**
+ * Build the intake service backed by this project's
+ * `~/.wrongstack/projects/<slug>/requirement-intakes` directory.
+ *
+ * The HTTP token gate is the authorization boundary, so the service itself
+ * runs with a permissive authorizer inside it (see requirement-intake-handlers).
+ */
+export declare function createProjectIntakeService(opts: {
+    projectRoot: string;
+    globalRoot: string;
+}): RequirementIntakeService;
+//# sourceMappingURL=intake-service.d.ts.map

package/dist/server/mcp-handlers.d.ts

@@ -9,6 +9,7 @@
  * there; here we only map structured results to WS events the browser expects.
  */
 import { type MCPRegistry, type MCPServerOperationalHealth, type McpServerInfo } from '@wrongstack/mcp';
+import type { TrustBoundary } from '@wrongstack/core/security';
 import type { WebSocket } from 'ws';
 import type { WSClientMessage } from './types.js';
 /** Wire view of a server as the browser MCP panel consumes it. */
@@ -33,9 +34,9 @@ export declare function toView(info: McpServerInfo, health?: MCPServerOperationa
 /** mcp.list — configured servers merged with live registry status + tools. */
 export declare function handleMcpList(ws: WebSocket, _msg: WSClientMessage, globalConfigPath: string, mcpRegistry?: MCPRegistry): Promise<void>;
 /** mcp.add — persist a new server (incl. url/headers) and start it if enabled. */
-export declare function handleMcpAdd(ws: WebSocket, msg: WSClientMessage, globalConfigPath: string, mcpRegistry?: MCPRegistry): Promise<void>;
+export declare function handleMcpAdd(ws: WebSocket, msg: WSClientMessage, globalConfigPath: string, mcpRegistry?: MCPRegistry, trustBoundary?: TrustBoundary): Promise<void>;
 /** mcp.update — re-persist config (incl. url/headers) and re-apply to registry. */
-export declare function handleMcpUpdate(ws: WebSocket, msg: WSClientMessage, globalConfigPath: string, mcpRegistry?: MCPRegistry): Promise<void>;
+export declare function handleMcpUpdate(ws: WebSocket, msg: WSClientMessage, globalConfigPath: string, mcpRegistry?: MCPRegistry, trustBoundary?: TrustBoundary): Promise<void>;
 /** mcp.remove — stop the server and delete it from config. */
 export declare function handleMcpRemove(ws: WebSocket, msg: WSClientMessage, globalConfigPath: string, mcpRegistry?: MCPRegistry): Promise<void>;
 /** mcp.enable — flip enabled:true in config and start the server. */

package/dist/server/pref-helpers.d.ts

@@ -17,7 +17,7 @@
  */
 import type { SecretVault } from '@wrongstack/core/types';
 /** Pref keys exposed to the settings panel via prefs.get / prefs.updated. */
-export declare const PREF_KEYS: readonly ['autonomy', 'autonomyDelayMs', 'autoProceedMaxIterations', 'yolo', 'maxIterations', 'chime', 'confirmExit', 'nextPrediction', 'enhanceEnabled', 'enhanceDelayMs', 'enhanceLanguage', 'featureMcp', 'featurePlugins', 'featureMemory', 'featureSkills', 'featureModelsRegistry', 'indexOnStart', 'contextAutoCompact', 'contextStrategy', 'contextMode', 'tokenSavingTier', 'maxConcurrent', 'titleAnimation', 'uiLocale', 'logLevel', 'auditLevel', 'hqEnabled', 'hqUrl', 'hqToken', 'hqRawContent', 'tgConfigured', 'tgSessionEnd', 'tgDelegate', 'tgLongToolMs', 'reasoningMode', 'reasoningEffort', 'reasoningPreserve', 'cacheTtl', 'fallbackModels', 'fallbackProfiles', 'favoriteModels', 'favoriteModelsOnly', 'modelAvailabilitySchedule', 'modelMatrix', 'fallbackAuto', 'refinerProvider', 'refinerModel', 'refinerFallbackProfile', 'thinkingWord', 'statuslineMode', 'animationStyle', 'showModelReasoning', 'breakerEnabled', 'breakerAutoKillResetMs', 'fsAccess', 'debugStream', 'chimeraEnabled', 'chimeraProvider', 'chimeraModel', 'chimeraMaxFiles', 'chimeraAutoFix', 'autoReviewEnabled', 'autoReviewProvider', 'autoReviewModel', 'autoReviewFallbackProfile', 'autoReviewFallbackModels', 'autoReviewDebounceMs', 'autoReviewMaxFilesPerBatch', 'autoReviewMaxConcurrentReviews', 'autoReviewCascadeOn', 'groupToolCalls', 'showThinkingLogs', 'pluginsEnabled', 'fleetChatVerbosity'];
+export declare const PREF_KEYS: readonly ['autonomy', 'autonomyDelayMs', 'autoProceedMaxIterations', 'yolo', 'maxIterations', 'chime', 'confirmExit', 'nextPrediction', 'enhanceEnabled', 'enhanceDelayMs', 'enhanceLanguage', 'featureMcp', 'featurePlugins', 'featureMemory', 'featureSkills', 'featureModelsRegistry', 'indexOnStart', 'contextAutoCompact', 'contextStrategy', 'contextMode', 'tokenSavingTier', 'maxConcurrent', 'titleAnimation', 'uiLocale', 'logLevel', 'auditLevel', 'hqEnabled', 'hqUrl', 'hqToken', 'hqRawContent', 'tgConfigured', 'tgSessionEnd', 'tgDelegate', 'tgLongToolMs', 'reasoningMode', 'reasoningEffort', 'reasoningPreserve', 'cacheTtl', 'fallbackModels', 'fallbackProfiles', 'favoriteModels', 'favoriteModelsOnly', 'modelAvailabilitySchedule', 'modelMatrix', 'fallbackAuto', 'refinerProvider', 'refinerModel', 'refinerFallbackProfile', 'thinkingWord', 'statuslineMode', 'animationStyle', 'showModelReasoning', 'breakerEnabled', 'breakerAutoKillResetMs', 'fsAccess', 'debugStream', 'chimeraEnabled', 'chimeraProvider', 'chimeraModel', 'chimeraMaxFiles', 'chimeraAutoFix', 'autoReviewEnabled', 'autoReviewProvider', 'autoReviewModel', 'autoReviewFallbackProfile', 'autoReviewFallbackModels', 'autoReviewDebounceMs', 'autoReviewMaxFilesPerBatch', 'autoReviewMaxConcurrentReviews', 'autoReviewCascadeOn', 'groupToolCalls', 'showThinkingLogs', 'autoCollapseInput', 'pluginsEnabled', 'fleetChatVerbosity'];
 export interface PrefHelperDeps {
     /** Path to the active profile config; the sole settings mutation target. */
     profileConfigPath: string;

package/dist/server/provider-handlers.d.ts

@@ -95,7 +95,7 @@ export declare function createProviderOperations(deps: ProviderOperationsDeps):
         apiKey?: string | undefined;
         models?: string[] | undefined;
         customModels?: ProviderConfig['customModels'] | undefined;
-    }) => Promise<void>;
+    }) => Promise<boolean>;
     handleProviderRemove: (ws: WebSocket, providerId: string) => Promise<void>;
     handleProviderClearModels: (ws: WebSocket, providerId: string) => Promise<void>;
     handleCustomModelSet: (ws: WebSocket, providerId: string, modelId: string, definition: NonNullable<ProviderConfig['customModels']>[string]) => Promise<void>;
@@ -137,7 +137,7 @@ export declare function createProviderHandlers(deps: ProviderHandlerDeps): {
         apiKey?: string | undefined;
         models?: string[] | undefined;
         customModels?: ProviderConfig['customModels'] | undefined;
-    }) => Promise<void>;
+    }) => Promise<boolean>;
     handleProviderRemove: (ws: WebSocket, providerId: string) => Promise<void>;
     handleProviderClearModels: (ws: WebSocket, providerId: string) => Promise<void>;
     handleCustomModelSet: (ws: WebSocket, providerId: string, modelId: string, definition: NonNullable<ProviderConfig['customModels']>[string]) => Promise<void>;

package/dist/server/provider-routes.d.ts

@@ -14,7 +14,7 @@ export interface ProviderMutationHandlers {
         apiKey?: string | undefined;
         models?: string[] | undefined;
         customModels?: ProviderConfig['customModels'] | undefined;
-    }) => Promise<void>;
+    }) => Promise<boolean>;
     handleProviderRemove: (ws: WebSocket, providerId: string) => Promise<void>;
     handleProviderClearModels: (ws: WebSocket, providerId: string) => Promise<void>;
     handleCustomModelSet: (ws: WebSocket, providerId: string, modelId: string, definition: NonNullable<ProviderConfig['customModels']>[string]) => Promise<void>;
@@ -40,6 +40,8 @@ export interface ProviderRouteHandlers {
     searchProviderModels: (ws: WebSocket, query: string, limit?: number | undefined) => Promise<void>;
     switchModel: (ws: WebSocket, msg: WSClientMessage) => Promise<void>;
     refineModel: (ws: WebSocket, msg: WSClientMessage) => Promise<void>;
+    /** Forward a model.fallback_choice client message to the EventBus. */
+    fallbackChoice: (ws: WebSocket, msg: WSClientMessage) => Promise<void>;
     /** Adopt a just-added provider as the live default when no model is active. */
     adoptDefaultProviderIfUnset: (providerId: string) => Promise<void>;
     providerHandlers: ProviderMutationHandlers;

package/dist/server/requirement-intake-handlers.d.ts

@@ -0,0 +1,41 @@
+/**
+ * HTTP handlers for the Requirements Intake REST API.
+ *
+ * Routes (registered in http-server.ts):
+ *   POST   /api/projects/:projectId/requirement-intakes
+ *   GET    /api/projects/:projectId/requirement-intakes
+ *   GET    /api/requirement-intakes/:intakeId
+ *   PATCH  /api/requirement-intakes/:intakeId
+ *   POST   /api/requirement-intakes/:intakeId/answers
+ *   POST   /api/requirement-intakes/:intakeId/suggestions
+ *   POST   /api/requirement-intakes/:intakeId/submit
+ *   POST   /api/requirement-intakes/:intakeId/cancel
+ *   POST   /api/requirement-intakes/:intakeId/archive
+ *
+ * The HTTP token gate (see http-server.ts) is the authorization boundary;
+ * the service runs with a permissive authorizer inside that boundary. Every
+ * handler maps `IntakeError` codes to conventional HTTP statuses and never
+ * echoes request content into logs.
+ */
+import type * as http from 'node:http';
+import { type RequirementIntakeService } from '@wrongstack/requirement-intake';
+/** Map a domain error to an HTTP status + JSON error body. */
+export declare function sendIntakeError(res: http.ServerResponse, error: unknown): void;
+/**
+ * List intake records for the server's own project. The webui-server serves
+ * one project; the canonical `proj_<ulid>` id lives in `.wrongstack/project.json`,
+ * which the frontend cannot read — so this route resolves it server-side and
+ * returns it alongside the records (the frontend uses it for the project-scoped
+ * create endpoint).
+ */
+export declare function handleRequirementIntakeListForServer(res: http.ServerResponse, service: RequirementIntakeService | undefined, projectRoot: string | undefined): Promise<void>;
+export declare function handleRequirementIntakeCreate(res: http.ServerResponse, req: http.IncomingMessage, service: RequirementIntakeService | undefined, projectId: string): Promise<void>;
+export declare function handleRequirementIntakeList(res: http.ServerResponse, service: RequirementIntakeService | undefined, projectId: string): Promise<void>;
+export declare function handleRequirementIntakeGet(res: http.ServerResponse, service: RequirementIntakeService | undefined, intakeId: string): Promise<void>;
+export declare function handleRequirementIntakeUpdate(res: http.ServerResponse, req: http.IncomingMessage, service: RequirementIntakeService | undefined, intakeId: string): Promise<void>;
+export declare function handleRequirementIntakeAnswers(res: http.ServerResponse, req: http.IncomingMessage, service: RequirementIntakeService | undefined, intakeId: string): Promise<void>;
+export declare function handleRequirementIntakeSuggestions(res: http.ServerResponse, req: http.IncomingMessage, service: RequirementIntakeService | undefined, intakeId: string): Promise<void>;
+export declare function handleRequirementIntakeSubmit(res: http.ServerResponse, service: RequirementIntakeService | undefined, intakeId: string): Promise<void>;
+export declare function handleRequirementIntakeCancel(res: http.ServerResponse, req: http.IncomingMessage, service: RequirementIntakeService | undefined, intakeId: string): Promise<void>;
+export declare function handleRequirementIntakeArchive(res: http.ServerResponse, service: RequirementIntakeService | undefined, intakeId: string): Promise<void>;
+//# sourceMappingURL=requirement-intake-handlers.d.ts.map

package/dist/server/server-runtime.d.ts

@@ -102,6 +102,9 @@ export declare function startHttpServer(opts: {
     } | undefined) | undefined;
     executePackageOperation?: import('./techstack-handlers.js').TechStackHandlerDeps['executePackageOperation'];
     distDir?: string | undefined;
+    /** Optional pre-built intake service (tests/embeds). Defaults to a fresh
+     *  per-project service backed by `projectRequirementIntakes`. */
+    intakeService?: import('@wrongstack/requirement-intake').RequirementIntakeService | undefined;
 }): import('node:http').Server;
 interface ShutdownDeps {
     flushSession: () => Promise<void>;

package/dist/server/session-history.d.ts

@@ -1,4 +1,4 @@
-import type { SessionSummary } from '@wrongstack/core/types';
+import type { SessionEvent, SessionSummary } from '@wrongstack/core/types';
 /**
  * Stable WebSocket projection for the WebUI history surfaces.
  *
@@ -27,6 +27,47 @@ export interface SessionHistoryWireEntry {
     outcome?: SessionSummary['outcome'];
     isCurrent: boolean;
 }
+export interface SessionInspectEvent {
+    ts: string;
+    type: SessionEvent['type'];
+    label: string;
+    detail: string;
+}
+export interface SessionInspectFileEntry {
+    operation: string;
+    filePath: string;
+    toolName: string;
+    ts: string;
+}
+export interface SessionInspectPayload {
+    id: string;
+    title: string;
+    name?: string | undefined;
+    model: string;
+    provider: string;
+    startedAt: string;
+    endedAt?: string | undefined;
+    tokenTotal: number;
+    outcome?: SessionSummary['outcome'];
+    messageCount: number;
+    iterationCount: number;
+    toolCallCount: number;
+    toolErrorCount: number;
+    fileChangeCount: number;
+    compactionCount: number;
+    toolBreakdown: Record<string, number>;
+    events: SessionInspectEvent[];
+    fileEvents: SessionInspectFileEntry[];
+    lastUserMessage?: string | undefined;
+}
+export declare function buildInspectPayload(summary: SessionSummary | undefined, events: SessionEvent[], fallback: {
+    id: string;
+    title: string;
+    model: string;
+    provider: string;
+    startedAt: string;
+    endedAt?: string | undefined;
+}): SessionInspectPayload;
 export declare function toSessionHistoryEntry(summary: SessionSummary, currentSessionId: string): SessionHistoryWireEntry;
 export declare function toSessionHistoryEntries(summaries: SessionSummary[], currentSessionId: string): SessionHistoryWireEntry[];
 //# sourceMappingURL=session-history.d.ts.map

package/dist/server/session-routes.d.ts

@@ -19,6 +19,7 @@ export interface SessionRouteHandlers {
     deleteSession: (ws: WebSocket, msg: WSClientMessage) => Promise<void>;
     resumeSession: (ws: WebSocket, msg: WSClientMessage) => Promise<void>;
     saveSession: (ws: WebSocket, msg: WSClientMessage) => Promise<void>;
+    inspectSession: (ws: WebSocket, msg: WSClientMessage) => Promise<void>;
     listCheckpoints: (ws: WebSocket, msg: WSClientMessage) => Promise<void>;
     rewindSession: (ws: WebSocket, msg: WSClientMessage) => Promise<void>;
 }

package/dist/server/ws-auth.d.ts

@@ -88,6 +88,24 @@ export interface VerifyClientInput {
     allowedHostnames?: readonly string[] | undefined;
     /** Allow browser WS URL tokens for explicit public WS URLs where cookies cannot cross hostnames. */
     allowBrowserUrlToken?: boolean | undefined;
+    /**
+     * Let a valid `ws_token` cookie authenticate a loopback origin whose **port**
+     * differs from this server's (WS-003 opt-out). **Development only.**
+     *
+     * The Vite dev server and the WS server necessarily occupy different ports
+     * (`packages/webui/vite.config.ts` asks for 3456 and auto-advances when the
+     * WS server already holds it), so the dev loop cannot satisfy the port check.
+     *
+     * It must stay opt-in because the cookie proves nothing across ports: cookies
+     * are keyed by host, not port, and SameSite computes *site* without the port,
+     * so the browser attaches `ws_token` to a socket opened from **any** other
+     * localhost origin automatically. Enabling this in a shipped build re-opens
+     * exactly the hole WS-003 closed — a second dev server, a local app's UI, or
+     * an XSS in either can drive the agent.
+     *
+     * Wired from `WRONGSTACK_WEBUI_DEV_CROSS_PORT_WS=1`; never defaulted on.
+     */
+    allowCrossPortLoopbackCookie?: boolean | undefined;
 }
 /**
  * Decide whether to accept an incoming WebSocket handshake. Pure mirror of the

package/dist/server/ws-payload-validation.d.ts

@@ -12,6 +12,13 @@ interface ModelSwitchPayload {
     requestId?: string | undefined;
 }
 export declare function validateModelSwitchPayload(payload: unknown): PayloadValidationResult<ModelSwitchPayload>;
+export interface ModelFallbackChoicePayload {
+    requestId: string;
+    providerId?: string | undefined;
+    model?: string | undefined;
+    autoSwitch?: boolean | undefined;
+}
+export declare function validateModelFallbackChoicePayload(payload: unknown): PayloadValidationResult<ModelFallbackChoicePayload>;
 interface MailboxMessagesPayload {
     limit?: number;
     agentId?: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrongstack/webui-server",
-  "version": "0.298.3",
+  "version": "0.300.0",
   "license": "MIT",
   "description": "WrongStack WebUI HTTP/WebSocket server module — extracted from @wrongstack/webui in PR #243/244 to remove the CLI -> @wrongstack/webui/server cross-package edge (audit §3.1.1). Pure backend: HTTP routes, WebSocket handlers, MCP tool wrappers, HTML serving. The web frontend lives in @wrongstack/webui; this package is the standalone server it can run on.",
   "keywords": [
@@ -40,15 +40,16 @@
   ],
   "dependencies": {
     "ws": "^8.21.1",
-    "@wrongstack/core": "0.298.3",
-    "@wrongstack/providers": "0.298.3",
-    "@wrongstack/runtime": "0.298.3",
-    "@wrongstack/kanban": "0.298.3",
-    "@wrongstack/sdd": "0.298.3",
-    "@wrongstack/sage": "0.298.3",
-    "@wrongstack/techstack": "0.298.3",
-    "@wrongstack/tools": "0.298.3",
-    "@wrongstack/mcp": "0.298.3"
+    "@wrongstack/core": "0.300.0",
+    "@wrongstack/providers": "0.300.0",
+    "@wrongstack/kanban": "0.300.0",
+    "@wrongstack/requirement-intake": "0.300.0",
+    "@wrongstack/runtime": "0.300.0",
+    "@wrongstack/techstack": "0.300.0",
+    "@wrongstack/sage": "0.300.0",
+    "@wrongstack/mcp": "0.300.0",
+    "@wrongstack/tools": "0.300.0",
+    "@wrongstack/sdd": "0.300.0"
   },
   "devDependencies": {
     "@types/node": "^26.1.2",