@wrongstack/webui-server 0.300.0 → 0.302.0

package/dist/index.js

@@ -48,6 +48,7 @@ var BOOLEAN_PREF_KEYS = /* @__PURE__ */ new Set([
   "chime",
   "confirmExit",
   "nextPrediction",
+  "nextStepsTool",
   "titleAnimation",
   "enhanceEnabled",
   "featureMcp",
@@ -171,6 +172,7 @@ var ENUM_PREF_KEYS = {
   fsAccess: /* @__PURE__ */ new Set(["unrestricted", "project"]),
   // Chimera autoFix + auto-review cascade threshold
   chimeraAutoFix: /* @__PURE__ */ new Set(["off", "ask", "auto"]),
+  autoReviewModelSelection: /* @__PURE__ */ new Set(["round-robin", "random"]),
   autoReviewCascadeOn: /* @__PURE__ */ new Set(["off", "critical", "high"]),
   fleetChatVerbosity: /* @__PURE__ */ new Set(["off", "full"]),
   showAgentSwarmPanel: /* @__PURE__ */ new Set(["bottom", "sidebar", "off"])
@@ -4316,6 +4318,9 @@ async function handleConversationRoute(ws, msg, handlers) {
     case "user_message":
       await handlers.userMessage(ws, msg);
       return true;
+    case "topic.advice":
+      await handlers.topicAdvice(ws, msg);
+      return true;
     case "abort":
       await handlers.abort(ws, msg);
       return true;
@@ -4331,6 +4336,7 @@ async function handleConversationRoute(ws, msg, handlers) {
 }
 
 // src/server/conversation-operations.ts
+import { startFreshTopicContext, TopicShiftAdvisor } from "@wrongstack/core/execution";
 import {
   buildUserContentBlocks,
   IncomingImageError,
@@ -4347,6 +4353,7 @@ function requestedSessionId(msg) {
   return payload && typeof payload === "object" && typeof payload.sessionId === "string" ? payload.sessionId : void 0;
 }
 function createConversationOperations(ctx) {
+  const topicShiftAdvisor = new TopicShiftAdvisor();
   const sessionPayload2 = (payload) => {
     const provided = payload["sessionId"];
     const sessionId = typeof provided === "string" && provided.length > 0 ? provided : ctx.getSessionId();
@@ -4367,6 +4374,38 @@ function createConversationOperations(ctx) {
     return false;
   };
   return {
+    topicAdvice: async (ws, msg) => {
+      if (!ensureCurrentSession(ws, msg, "topic.advice")) return;
+      const payload = msg.payload ?? {};
+      if (typeof payload.requestId !== "string" || typeof payload.prompt !== "string") {
+        ctx.send(ws, {
+          type: "topic.advice_result",
+          payload: sessionPayload2({
+            requestId: typeof payload.requestId === "string" ? payload.requestId : "",
+            suggestNewContext: false,
+            confidence: 0,
+            reason: "Invalid topic advice request.",
+            source: "local"
+          })
+        });
+        return;
+      }
+      const agent = ctx.getAgent();
+      const configuredMax = agent.ctx.meta["effectiveMaxContext"];
+      const maxContext = typeof configuredMax === "number" ? configuredMax : agent.ctx.provider.capabilities.maxContext;
+      const advice = await topicShiftAdvisor.advise({
+        prompt: payload.prompt,
+        messages: agent.ctx.messages,
+        provider: agent.ctx.provider,
+        model: agent.ctx.model,
+        contextTokens: agent.ctx.lastRequestTokens,
+        maxContext
+      });
+      ctx.send(ws, {
+        type: "topic.advice_result",
+        payload: sessionPayload2({ requestId: payload.requestId, ...advice })
+      });
+    },
     userMessage: async (ws, msg) => {
       if (!ensureCurrentSession(ws, msg, "user_message")) return;
       const payload = msg.payload ?? {};
@@ -4384,6 +4423,7 @@ function createConversationOperations(ctx) {
       const originSessionId = ctx.getSessionId();
       try {
         const agent = ctx.getAgent();
+        if (payload.freshContext === true) await startFreshTopicContext(agent.ctx);
         const content = typeof payload.content === "string" ? payload.content : "";
         let input = content;
         const imageBlocks = parseIncomingImages(payload.images, payload.imageBase64);
@@ -5512,6 +5552,39 @@ import {
   isKanbanServerAvailable
 } from "@wrongstack/kanban";
 import * as net from "node:net";
+
+// src/server/privileged-actions.ts
+import { randomUUID as randomUUID2 } from "node:crypto";
+import {
+  isTrustDecisionAllowed
+} from "@wrongstack/core/security";
+async function authorizeWebUIAction(boundary, action, logger) {
+  const request = {
+    version: 1,
+    requestId: randomUUID2(),
+    actor: {
+      kind: "remote-client",
+      ...action.sessionId ? { sessionId: action.sessionId } : {}
+    },
+    surface: "webui",
+    capability: action.capability,
+    subject: action.subject,
+    risk: action.risk,
+    scope: {
+      ...action.cwd ? { cwd: action.cwd } : {},
+      ...action.sessionId ? { sessionId: action.sessionId } : {}
+    },
+    authContext: { method: "session" },
+    ...action.metadata ? { metadata: action.metadata } : {}
+  };
+  const decision = await boundary.evaluate(request);
+  logger?.debug?.(
+    `[trust-boundary] ${request.capability} ${decision.kind} request=${request.requestId}`
+  );
+  return { allowed: isTrustDecisionAllowed(decision), reason: decision.reason, request };
+}
+
+// src/server/connections-health-route.ts
 import { readGovernanceDaemonOperatorStatus } from "@wrongstack/runtime/governance-bootstrap";
 import { isSageProjectServerAvailable, SageProjectServerConnection } from "@wrongstack/sage";
 import {
@@ -5917,6 +5990,42 @@ async function handleConnectionsServiceAction(ws, message, context) {
     return true;
   }
   const action = rawAction;
+  if (!context.trustBoundary) {
+    context.send(ws, {
+      type: "connections.service_action_result",
+      payload: {
+        serviceId,
+        action,
+        success: false,
+        message: "Service control is unavailable: no policy authority is configured."
+      }
+    });
+    return true;
+  }
+  const projectRootForAuth = context.getProjectRoot();
+  const authorization = await authorizeWebUIAction(
+    context.trustBoundary,
+    {
+      capability: `connections.service.${action}`,
+      subject: { kind: "process", id: `${serviceId}@${projectRootForAuth}` },
+      risk: "elevated",
+      cwd: projectRootForAuth,
+      metadata: { transport: "websocket", serviceId, action }
+    },
+    context.logger
+  );
+  if (!authorization.allowed) {
+    context.send(ws, {
+      type: "connections.service_action_result",
+      payload: {
+        serviceId,
+        action,
+        success: false,
+        message: authorization.reason ?? "Refused by policy."
+      }
+    });
+    return true;
+  }
   if (serviceId === "webui") {
     context.send(ws, {
       type: "connections.service_action_result",
@@ -6354,28 +6463,28 @@ async function restartMailboxServer(projectRoot) {
 var RESTART_POLL_INTERVAL_MS = 250;
 var RESTART_DEADLINE_MS = 3e3;
 function isEndpointAlive(endpoint) {
-  return new Promise((resolve16) => {
+  return new Promise((resolve17) => {
     const sock = net.createConnection(endpoint);
     const timer = setTimeout(() => {
       sock.destroy();
-      resolve16(false);
+      resolve17(false);
     }, 500);
     timer.unref?.();
     sock.once("connect", () => {
       clearTimeout(timer);
       sock.destroy();
-      resolve16(true);
+      resolve17(true);
     });
     sock.once("error", () => {
       clearTimeout(timer);
       sock.destroy();
-      resolve16(false);
+      resolve17(false);
     });
   });
 }
 async function waitForShutdown(probe) {
   if (!probe) {
-    await new Promise((resolve16) => setTimeout(resolve16, RESTART_POLL_INTERVAL_MS));
+    await new Promise((resolve17) => setTimeout(resolve17, RESTART_POLL_INTERVAL_MS));
     return;
   }
   const deadline = Date.now() + RESTART_DEADLINE_MS;
@@ -6386,7 +6495,7 @@ async function waitForShutdown(probe) {
     } catch {
       return;
     }
-    await new Promise((resolve16) => setTimeout(resolve16, RESTART_POLL_INTERVAL_MS));
+    await new Promise((resolve17) => setTimeout(resolve17, RESTART_POLL_INTERVAL_MS));
   }
 }
 function failureService(id, label, required, mode, error2, latencyMs) {
@@ -6549,9 +6658,9 @@ async function handleGitInfo(ws, projectRoot) {
   const cwd = projectRoot || void 0;
   try {
     const { execFile: ef } = await import("node:child_process");
-    const git = (args) => new Promise((resolve16) => {
+    const git = (args) => new Promise((resolve17) => {
       ef("git", args, { cwd, timeout: 3e3 }, (err, stdout) => {
-        resolve16(err ? "" : stdout.trim());
+        resolve17(err ? "" : stdout.trim());
       });
     });
     const [branchRaw, diffRaw, statusRaw, upstreamRaw] = await Promise.all([
@@ -6577,12 +6686,12 @@ async function handleGitInfo(ws, projectRoot) {
 function makeGit(cwd) {
   return async (args) => {
     const { execFile: ef } = await import("node:child_process");
-    return new Promise((resolve16) => {
+    return new Promise((resolve17) => {
       ef(
         "git",
         args,
         { cwd, timeout: 5e3, maxBuffer: 1024 * 1024 * 16 },
-        (err, stdout) => resolve16(err ? "" : stdout)
+        (err, stdout) => resolve17(err ? "" : stdout)
       );
     });
   };
@@ -6747,7 +6856,7 @@ import { execFile } from "node:child_process";
 var GIT_TIMEOUT_MS = 1e4;
 var GIT_MAX_OUTPUT_BYTES = 1024 * 1024;
 function gitStdout(cwd, args) {
-  return new Promise((resolve16) => {
+  return new Promise((resolve17) => {
     execFile(
       "git",
       [...args],
@@ -6758,7 +6867,7 @@ function gitStdout(cwd, args) {
         timeout: GIT_TIMEOUT_MS,
         maxBuffer: GIT_MAX_OUTPUT_BYTES
       },
-      (error2, stdout) => resolve16(error2 ? null : stdout)
+      (error2, stdout) => resolve17(error2 ? null : stdout)
     );
   });
 }
@@ -7049,14 +7158,14 @@ var GoalWebSocketHandler = class {
         const cwd = env?.cwd ?? this.projectRoot;
         try {
           const { execFile: execFile2 } = await import("node:child_process");
-          const result = await new Promise((resolve16) => {
+          const result = await new Promise((resolve17) => {
             const npxCommand = process.platform === "win32" ? "npx.cmd" : "npx";
             execFile2(npxCommand, ["tsc", "--noEmit"], { cwd, timeout: 6e4 }, (err, stdout, stderr) => {
               if (err && err.code === "ENOENT") {
-                resolve16("[verify] tsc not found \u2014 skipping");
+                resolve17("[verify] tsc not found \u2014 skipping");
                 return;
               }
-              resolve16(stdout + stderr);
+              resolve17(stdout + stderr);
             });
           });
           if (result.includes("[verify]") || result.trim().length === 0) {
@@ -7097,12 +7206,12 @@ Run npx tsc --noEmit to verify the fix. Output the fixed file paths.`;
         ...maybeVerify,
         onPhaseComplete: (phase) => {
           this.logger.info(`[Goal] Phase completed: ${phase.name}`);
-          void this.store.save(graph);
+          this.persistDetached(graph);
           this.broadcastState();
         },
         onPhaseFail: (phase, error2) => {
           this.logger.error(`[Goal] Phase failed: ${phase.name} \u2014 ${error2.message}`);
-          void this.store.save(graph);
+          this.persistDetached(graph);
           this.broadcastState();
         }
       },
@@ -7119,7 +7228,7 @@ Run npx tsc --noEmit to verify the fix. Output the fixed file paths.`;
     this.broadcastState();
     void this.orchestrator.start().then(() => {
       this.orchestrator?.stop();
-      void this.store.save(graph);
+      this.persistDetached(graph);
       this.stopBroadcast();
       const failed = graph.failedPhaseIds.length > 0;
       this.broadcast(
@@ -7317,9 +7426,27 @@ ${result_.finalText.slice(0, 2e3)}`
       this.logger.warn(`[Goal] Chimera review failed for "${task.title}": ${toErrorMessage2(err)}`);
     }
   }
+  /**
+   * Fire-and-forget persist.
+   *
+   * Every detached `store.save()` used to be a bare `void`, so a rejection
+   * became an unhandled rejection and — under Node 22's default
+   * `--unhandled-rejections=throw` — killed the process mid-run. On Windows an
+   * AV scanner or indexer holding the `.wrongstack/phases/<id>.json` rename
+   * target for a few hundred ms is enough (EPERM from `atomicWrite`), and in
+   * `--webui` mode that takes the CLI session down with it. `handleStop` at
+   * `:549` already had the `.catch`; these call sites did not.
+   */
+  persistDetached(graph) {
+    void this.store.save(graph).catch((err) => {
+      this.logger.warn(
+        `[Goal] Failed to persist phase graph: ${err instanceof Error ? err.message : String(err)}`
+      );
+    });
+  }
   /** Persist + broadcast after an interactive board mutation. */
   afterBoardMutation() {
-    if (this.graph) void this.store.save(this.graph);
+    if (this.graph) this.persistDetached(this.graph);
     this.broadcastState();
   }
   async handleTaskStatusChange(taskId, status) {
@@ -7776,7 +7903,7 @@ function pushEvent(event) {
   }
 }
 function parseBody(req) {
-  return new Promise((resolve16, reject) => {
+  return new Promise((resolve17, reject) => {
     let body = "";
     let bodyBytes = 0;
     let tooLarge = false;
@@ -7796,7 +7923,7 @@ function parseBody(req) {
         return;
       }
       try {
-        resolve16(JSON.parse(body));
+        resolve17(JSON.parse(body));
       } catch {
         reject(new Error("Invalid JSON"));
       }
@@ -7891,7 +8018,7 @@ import * as path10 from "node:path";
 import { runDeadCodeScan } from "@wrongstack/tools/codebase-index";
 var MAX_BODY_BYTES = 10 * 1024 * 1024;
 function readJsonBody(req) {
-  return new Promise((resolve16, reject) => {
+  return new Promise((resolve17, reject) => {
     const chunks = [];
     let total = 0;
     req.on("data", (chunk) => {
@@ -7903,7 +8030,7 @@ function readJsonBody(req) {
       }
       chunks.push(chunk);
     });
-    req.on("end", () => resolve16(Buffer.concat(chunks).toString("utf8")));
+    req.on("end", () => resolve17(Buffer.concat(chunks).toString("utf8")));
     req.on("error", (err) => reject(err));
   });
 }
@@ -8311,12 +8438,21 @@ async function handleApiSessionEvents(res, globalRoot, sessionId, limit) {
     const paths = resolveWstackPaths7({ projectRoot: entry.projectRoot, globalRoot });
     const store = new DefaultSessionStore4({ dir: paths.projectSessions });
     const reader = new DefaultSessionReader2({ store });
-    const rawEntries = [];
+    const RING = Math.max(limit * 4, 2e3);
+    const ring = [];
+    let totalRaw = 0;
+    let dropped = false;
     for await (const ev of reader.replay(sessionId)) {
       const mapped = mapWatchEntry(ev);
-      if (mapped) rawEntries.push(mapped);
+      if (!mapped) continue;
+      totalRaw += 1;
+      ring.push(mapped);
+      if (ring.length > RING) {
+        ring.shift();
+        dropped = true;
+      }
     }
-    const all = correlateToolEvents(rawEntries);
+    const all = correlateToolEvents(ring);
     const tail2 = all.slice(-limit);
     res.writeHead(200, { "Content-Type": "application/json" });
     res.end(
@@ -8325,7 +8461,12 @@ async function handleApiSessionEvents(res, globalRoot, sessionId, limit) {
         status: entry.status,
         clientType: entry.clientType,
         projectName: entry.projectName,
-        total: all.length,
+        // Exact when the whole session fit in the ring (the previous
+        // behaviour). Past that, correlation never ran over the dropped
+        // prefix, so report the raw event count — an upper bound — and say so
+        // rather than silently understating the session's size.
+        total: dropped ? totalRaw : all.length,
+        ...dropped ? { truncated: true } : {},
         entries: tail2
       })
     );
@@ -8335,7 +8476,7 @@ async function handleApiSessionEvents(res, globalRoot, sessionId, limit) {
   }
 }
 function readJsonBody2(req) {
-  return new Promise((resolve16, reject) => {
+  return new Promise((resolve17, reject) => {
     const contentType = (req.headers["content-type"] ?? "").split(";")[0]?.trim().toLowerCase();
     if (contentType !== "application/json") {
       reject(new Error(`Unsupported Content-Type: ${contentType || "(absent)"}`));
@@ -8351,7 +8492,7 @@ function readJsonBody2(req) {
     });
     req.on("end", () => {
       try {
-        resolve16(data ? JSON.parse(data) : {});
+        resolve17(data ? JSON.parse(data) : {});
       } catch (err) {
         reject(err instanceof Error ? err : new Error(String(err)));
       }
@@ -8627,14 +8768,14 @@ async function readJsonBody3(res, req) {
     });
     return null;
   }
-  return new Promise((resolve16) => {
+  return new Promise((resolve17) => {
     let data = "";
     let failed = false;
     const fail2 = (message) => {
       if (failed) return;
       failed = true;
       sendJson2(res, 400, { error: { code: "INVALID_BODY", message } });
-      resolve16(null);
+      resolve17(null);
     };
     req.on("data", (chunk) => {
       if (failed) return;
@@ -8647,7 +8788,7 @@ async function readJsonBody3(res, req) {
     req.on("end", () => {
       if (failed) return;
       try {
-        resolve16(data.trim().length === 0 ? {} : JSON.parse(data));
+        resolve17(data.trim().length === 0 ? {} : JSON.parse(data));
       } catch {
         fail2("Request body is not valid JSON");
       }
@@ -9015,7 +9156,7 @@ async function touchProjectInManifest(options, globalConfigPath) {
 }
 
 // src/server/techstack-handlers.ts
-import { randomUUID as randomUUID2 } from "node:crypto";
+import { randomUUID as randomUUID3 } from "node:crypto";
 var DEEP_DIVE_TIMEOUT_MS = 6e4;
 function sendJson3(res, status, data) {
   res.writeHead(status, { "Content-Type": "application/json" });
@@ -9056,7 +9197,7 @@ function requireJobDeps(res, deps2) {
 }
 function startJob(res, deps2, kind) {
   if (!requireJobDeps(res, deps2)) return;
-  const jobId = randomUUID2();
+  const jobId = randomUUID3();
   const controller = new AbortController();
   deps2.runningJobs?.set(jobId, controller);
   deps2.emit?.({ type: "techstack.job.started", payload: { jobId, kind } });
@@ -9486,7 +9627,7 @@ function strictDecodeParam(segment, res) {
 function createHttpServer(opts) {
   const port = opts.port ?? Number.parseInt(process.env["PORT"] ?? "3456", 10);
   const distDir = path13.resolve(opts.distDir);
-  const requireAccessToken = true;
+  const requireAccessToken = Boolean(opts.requireToken) || !isLoopbackBind(opts.host);
   const secureCookies = opts.secureCookies ?? (opts.publicWsUrl?.trim().toLowerCase().startsWith("wss:") ?? false);
   const trustedHostnames = (() => {
     const names = [...opts.allowedHostnames ?? []];
@@ -9522,7 +9663,7 @@ function createHttpServer(opts) {
         res.end(JSON.stringify({ error: "forbidden: untrusted request origin" }));
         return;
       }
-      const providedAccessToken = requestToken(req, url);
+      const providedAccessToken = requestToken(req, url, { allowQuery: true });
       const accessTokenOk = Boolean(opts.apiToken) && tokenMatches(providedAccessToken, opts.apiToken ?? "");
       const shouldSetAuthCookie = Boolean(opts.apiToken) && tokenMatches(url.searchParams.get("token") ?? void 0, opts.apiToken ?? "");
       if (url.pathname === "/ws-auth" && req.method === "GET" && (opts.enableWsCookie ?? true)) {
@@ -10032,10 +10173,78 @@ function createHttpServer(opts) {
 }
 
 // src/server/instance-registry.ts
+import * as fs11 from "node:fs/promises";
 import * as os from "node:os";
 import * as path14 from "node:path";
-import * as fs11 from "node:fs/promises";
 import { atomicWrite as atomicWrite4 } from "@wrongstack/core/utils";
+function normalizeRoot(root) {
+  const resolved = path14.resolve(root);
+  return process.platform === "win32" ? resolved.toLowerCase() : resolved;
+}
+function isLiveSessionStatus(status) {
+  return status === "active" || status === "idle";
+}
+function instanceRole(instance) {
+  return instance.role ?? "standalone";
+}
+function resolveAttachability(input) {
+  const { session, instance } = input;
+  if (!isLiveSessionStatus(session.status)) {
+    return { attachable: false, degradedReason: "session-not-live" };
+  }
+  if (!instance) {
+    return { attachable: false, degradedReason: "live-session-no-webui-endpoint" };
+  }
+  if (instance.pid !== session.pid) {
+    return { attachable: false, degradedReason: "endpoint-owner-mismatch" };
+  }
+  if (!instance.sessionId) {
+    return { attachable: false, instance, degradedReason: "endpoint-missing-session-id" };
+  }
+  if (instance.sessionId !== session.sessionId) {
+    return { attachable: false, instance, degradedReason: "endpoint-session-mismatch" };
+  }
+  if (instanceRole(instance) !== "session-child") {
+    return { attachable: false, instance, degradedReason: "endpoint-not-session-child" };
+  }
+  if (instance.attachable === false) {
+    return { attachable: false, instance, degradedReason: "endpoint-not-attachable" };
+  }
+  return {
+    attachable: true,
+    endpoint: {
+      host: instance.host,
+      httpPort: instance.httpPort,
+      url: instance.url,
+      ...instance.authToken ? { authToken: instance.authToken } : {}
+    }
+  };
+}
+function joinSessionRegistryWithWebUIInstances(input) {
+  const targetRoot = input.projectRoot ? normalizeRoot(input.projectRoot) : void 0;
+  const sessions = input.sessions.filter((session) => {
+    if (input.projectSlug && session.projectSlug !== input.projectSlug) return false;
+    if (targetRoot && normalizeRoot(session.projectRoot) !== targetRoot) return false;
+    return true;
+  });
+  return sessions.map((session) => {
+    const instance = input.instances.find((candidate) => candidate.sessionId === session.sessionId) ?? input.instances.find(
+      (candidate) => candidate.pid === session.pid && normalizeRoot(candidate.projectRoot) === normalizeRoot(session.projectRoot)
+    );
+    const resolved = resolveAttachability({ session, instance });
+    return {
+      sessionId: session.sessionId,
+      projectRoot: session.projectRoot,
+      workingDir: session.workingDir,
+      sessionPid: session.pid,
+      status: session.status,
+      ...instance ? { instance } : {},
+      ...resolved.endpoint ? { endpoint: resolved.endpoint } : {},
+      attachable: resolved.attachable,
+      ...resolved.degradedReason ? { degradedReason: resolved.degradedReason } : {}
+    };
+  });
+}
 function defaultBaseDir() {
   return path14.join(os.homedir(), ".wrongstack");
 }
@@ -10383,6 +10592,27 @@ import {
   getServerKanbanStore
 } from "@wrongstack/kanban";
 import { recordKanbanVerificationEvidence } from "@wrongstack/tools";
+
+// src/server/kanban-broadcast.ts
+function kanbanBoardMessage(board) {
+  return { type: "kanban.get", payload: { success: true, data: { board } } };
+}
+function kanbanListMessage(boards) {
+  return { type: "kanban.list", payload: { success: true, data: boards } };
+}
+function kanbanDeletedMessage(boardId) {
+  return { type: "kanban.delete", payload: { success: true, data: { removed: true, boardId } } };
+}
+async function publishKanbanBoard(broadcast2, board, listBoards6) {
+  broadcast2(kanbanBoardMessage(board));
+  if (!listBoards6) return;
+  try {
+    broadcast2(kanbanListMessage(await listBoards6()));
+  } catch {
+  }
+}
+
+// src/server/kanban-dispatch.ts
 function parseResolvedDispatchRoute(summary) {
   const tags = summary.match(/Spawned subagent\s+\S+\s+\((.*?)\)\s+for task/i)?.[1];
   if (!tags) return {};
@@ -10513,10 +10743,7 @@ async function handleKanbanTaskDispatch(ws, payload, ctx) {
           payload: { success: true, data: { boardId: board.id, task: completedTask } }
         });
         if (completedBoard) {
-          ctx.broadcast?.({
-            type: "kanban.get",
-            payload: { success: true, data: { board: completedBoard } }
-          });
+          ctx.broadcast?.(kanbanBoardMessage(completedBoard));
         }
         ctx.broadcast?.({
           type: "kanban.list",
@@ -10540,7 +10767,7 @@ async function handleKanbanTaskDispatch(ws, payload, ctx) {
       payload: { success: true, data: { boardId: board.id, task: runningTask } }
     });
     if (started?.board) {
-      ctx.broadcast?.({ type: "kanban.get", payload: { success: true, data: { board: started.board } } });
+      ctx.broadcast?.(kanbanBoardMessage(started.board));
     }
     reply(ws, "kanban.task.dispatch", true, { boardId: board.id, task: runningTask, summary });
   } catch (error2) {
@@ -10783,14 +11010,11 @@ async function handleDecompositionResolution(ws, type, payload, ctx) {
       type: "kanban.decomposition.applied",
       payload: { success: true, data: { board: resolved.board } }
     });
-    ctx.broadcast?.({
-      type: "kanban.get",
-      payload: { success: true, data: { board: resolved.board } }
-    });
-    ctx.broadcast?.({
-      type: "kanban.list",
-      payload: { success: true, data: await listBoards(ctx.projectRoot) }
-    });
+    await publishKanbanBoard(
+      (message) => ctx.broadcast?.(message),
+      resolved.board,
+      () => listBoards(ctx.projectRoot)
+    );
   } else {
     ctx.broadcast?.({
       type: "kanban.decomposition.resolved",
@@ -10823,10 +11047,7 @@ async function handleTaskVerification(ws, type, payload, ctx) {
       payload: { success: true, data: { boardId, task: freshTask } }
     });
     if (persisted) {
-      ctx.broadcast?.({
-        type: "kanban.get",
-        payload: { success: true, data: { board: persisted } }
-      });
+      ctx.broadcast?.(kanbanBoardMessage(persisted));
     }
   } catch (err) {
     ctx.broadcast?.({
@@ -11749,10 +11970,7 @@ function subscribeKanbanDaemonEvents(projectRoot, broadcastMessage) {
   let connectionCount = 0;
   const broadcastDeleted = (boardId) => {
     knownRevisions.delete(boardId);
-    broadcastMessage({
-      type: "kanban.delete",
-      payload: { success: true, data: { removed: true, boardId } }
-    });
+    broadcastMessage(kanbanDeletedMessage(boardId));
   };
   const broadcastBoard = async (boardId) => {
     const board = await store.getBoard(boardId);
@@ -11761,10 +11979,7 @@ function subscribeKanbanDaemonEvents(projectRoot, broadcastMessage) {
       return;
     }
     knownRevisions.set(boardId, board.updatedAt);
-    broadcastMessage({
-      type: "kanban.get",
-      payload: { success: true, data: { board } }
-    });
+    broadcastMessage(kanbanBoardMessage(board));
   };
   const reconcileAfterConnect = async () => {
     const summaries = await store.listBoards();
@@ -11783,20 +11998,36 @@ function subscribeKanbanDaemonEvents(projectRoot, broadcastMessage) {
       }
     }
   };
-  return bridgeKanbanSupervisor(
+  const COALESCE_MS = 300;
+  const pendingBroadcasts = /* @__PURE__ */ new Map();
+  const scheduleBroadcast = (boardId) => {
+    if (pendingBroadcasts.has(boardId)) return;
+    const timer = setTimeout(() => {
+      pendingBroadcasts.delete(boardId);
+      void broadcastBoard(boardId).catch(() => {
+      });
+    }, COALESCE_MS);
+    timer.unref?.();
+    pendingBroadcasts.set(boardId, timer);
+  };
+  const unsubscribe = bridgeKanbanSupervisor(
     projectRoot,
     async (event) => {
+      const family = event.event?.split(".")[0];
+      if (family !== "board" && family !== "task" && family !== "column") return;
       const evData = event.data;
       const boardId = evData?.boardId;
       if (!boardId) return;
-      try {
-        if (event.event === "board.deleted") {
-          broadcastDeleted(boardId);
-          return;
+      if (event.event === "board.deleted") {
+        const timer = pendingBroadcasts.get(boardId);
+        if (timer) {
+          clearTimeout(timer);
+          pendingBroadcasts.delete(boardId);
         }
-        await broadcastBoard(boardId);
-      } catch {
+        broadcastDeleted(boardId);
+        return;
       }
+      scheduleBroadcast(boardId);
     },
     {
       autoReconnect: true,
@@ -11804,6 +12035,11 @@ function subscribeKanbanDaemonEvents(projectRoot, broadcastMessage) {
       onConnected: reconcileAfterConnect
     }
   );
+  return () => {
+    for (const timer of pendingBroadcasts.values()) clearTimeout(timer);
+    pendingBroadcasts.clear();
+    unsubscribe();
+  };
 }
 
 // src/server/kanban-board-watcher.ts
@@ -11825,7 +12061,13 @@ function createShutdown(res) {
     } catch (e) {
       log(`[WebUI] Error closing session: ${e instanceof Error ? e.message : String(e)}`);
     }
-    for (const ws of res.clients()) ws.close();
+    for (const ws of res.clients()) {
+      try {
+        ws.close();
+        ws.terminate?.();
+      } catch {
+      }
+    }
     for (const server of res.servers) server?.close();
     if (res.onShutdown) {
       try {
@@ -12262,39 +12504,6 @@ import {
   restartMcp,
   updateMcp
 } from "@wrongstack/mcp";
-
-// src/server/privileged-actions.ts
-import { randomUUID as randomUUID3 } from "node:crypto";
-import {
-  isTrustDecisionAllowed
-} from "@wrongstack/core/security";
-async function authorizeWebUIAction(boundary, action, logger) {
-  const request = {
-    version: 1,
-    requestId: randomUUID3(),
-    actor: {
-      kind: "remote-client",
-      ...action.sessionId ? { sessionId: action.sessionId } : {}
-    },
-    surface: "webui",
-    capability: action.capability,
-    subject: action.subject,
-    risk: action.risk,
-    scope: {
-      ...action.cwd ? { cwd: action.cwd } : {},
-      ...action.sessionId ? { sessionId: action.sessionId } : {}
-    },
-    authContext: { method: "session" },
-    ...action.metadata ? { metadata: action.metadata } : {}
-  };
-  const decision = await boundary.evaluate(request);
-  logger?.debug?.(
-    `[trust-boundary] ${request.capability} ${decision.kind} request=${request.requestId}`
-  );
-  return { allowed: isTrustDecisionAllowed(decision), reason: decision.reason, request };
-}
-
-// src/server/mcp-handlers.ts
 async function authorizeMcpMutation(ws, operation, serverName, trustBoundary) {
   if (!trustBoundary) return true;
   const authorization = await authorizeWebUIAction(trustBoundary, {
@@ -13582,16 +13791,16 @@ function getSurfaceDefaultPorts(surface) {
   return { http: SURFACE_DEFAULT_PORTS[surface].http };
 }
 function isPortFree(host, port) {
-  return new Promise((resolve16) => {
+  return new Promise((resolve17) => {
     const srv = net2.createServer();
-    srv.once("error", () => resolve16(false));
+    srv.once("error", () => resolve17(false));
     srv.once("listening", () => {
-      srv.close(() => resolve16(true));
+      srv.close(() => resolve17(true));
     });
     try {
       srv.listen(port, host);
     } catch {
-      resolve16(false);
+      resolve17(false);
     }
   });
 }
@@ -13747,7 +13956,7 @@ async function startStaticServe(opts, deps2 = {}) {
   return { server, port: opts.httpPort };
 }
 function runPnpmBuild(cwd, workspace, timeoutMs) {
-  return new Promise((resolve16, reject) => {
+  return new Promise((resolve17, reject) => {
     const child = spawn2("pnpm", ["--filter", workspace, "build"], {
       cwd,
       shell: process.platform === "win32",
@@ -13765,7 +13974,7 @@ function runPnpmBuild(cwd, workspace, timeoutMs) {
     });
     child.once("close", (code) => {
       clearTimeout(timer);
-      if (code === 0) resolve16();
+      if (code === 0) resolve17();
       else reject(new Error(`pnpm build exited with code ${String(code)}`));
     });
   });
@@ -13829,27 +14038,41 @@ function formatExternalAccessUrls(opts) {
 }
 
 // src/server/embedded-lifecycle.ts
-function registerWebuiInstance(p, deps2 = {}) {
+async function registerWebuiInstance(p, deps2 = {}) {
   const register = deps2.registerFn ?? registerInstance;
-  void register(
-    {
-      pid: p.pid,
-      surface: p.surface,
-      httpPort: p.httpPort,
-      host: p.host,
-      projectRoot: p.projectRoot,
-      projectName: path16.basename(p.projectRoot) || p.projectRoot,
-      startedAt: p.startedAt,
-      url: buildWebUIAccessUrl({
+  try {
+    await register(
+      {
+        pid: p.pid,
+        surface: p.surface,
+        httpPort: p.httpPort,
         host: p.host,
-        port: p.httpPort,
-        publicUrl: p.publicUrl
-      }),
-      ...p.authToken ? { authToken: p.authToken } : {}
-    },
-    p.registryBaseDir
-  ).catch(() => {
-  });
+        projectRoot: p.projectRoot,
+        projectName: path16.basename(p.projectRoot) || p.projectRoot,
+        startedAt: p.startedAt,
+        url: buildWebUIAccessUrl({
+          host: p.host,
+          port: p.httpPort,
+          publicUrl: p.publicUrl
+        }),
+        ...p.authToken ? { authToken: p.authToken } : {},
+        ...p.role ? { role: p.role } : {},
+        ...p.sessionId ? { sessionId: p.sessionId } : {},
+        ...p.parentPid !== void 0 ? { parentPid: p.parentPid } : {},
+        ...p.parentShellId ? { parentShellId: p.parentShellId } : {},
+        ...p.runtimeId ? { runtimeId: p.runtimeId } : {},
+        ...p.attachable !== void 0 ? { attachable: p.attachable } : {},
+        ...p.authToken ? { auth: { scheme: "registry-token", tokenPresent: true } } : {},
+        ...p.lastReadyAt ? { lastReadyAt: p.lastReadyAt } : {},
+        ...p.protocolVersion !== void 0 ? { protocolVersion: p.protocolVersion } : {},
+        ...p.capabilities ? { capabilities: p.capabilities } : {}
+      },
+      p.registryBaseDir
+    );
+    return true;
+  } catch {
+    return false;
+  }
 }
 function announceWebuiReady(p) {
   const log = p.log ?? ((m) => console.log(m));
@@ -13887,10 +14110,10 @@ async function runBounded(work, timeoutMs, label, debug) {
       Promise.resolve().then(() => work()).catch((err) => {
         debug(`[webui-server] ${label} failed: ${err}`);
       }),
-      new Promise((resolve16) => {
+      new Promise((resolve17) => {
         timer = setTimeout(() => {
           debug(`[webui-server] ${label} timed out after ${timeoutMs}ms`);
-          resolve16();
+          resolve17();
         }, timeoutMs);
         timer.unref?.();
       })
@@ -13923,8 +14146,8 @@ function createWebuiShutdown(res) {
       const unregistered = unregister(res.pid, res.registryBaseDir).catch(
         (err) => debug(`[webui-server] unregister failed: ${err}`)
       );
-      await new Promise((resolve16) => {
-        res.wss.close(() => resolve16());
+      await new Promise((resolve17) => {
+        res.wss.close(() => resolve17());
       });
       await unregistered;
       log("[WebUI] Server stopped");
@@ -14415,12 +14638,9 @@ function createKanbanRunMirror(deps2) {
   }
   async function publish(board) {
     if (board) {
-      broadcast2({ type: "kanban.get", payload: { success: true, data: { board } } });
+      broadcast2(kanbanBoardMessage(board));
     }
-    broadcast2({
-      type: "kanban.list",
-      payload: { success: true, data: await listBoards3(projectRoot) }
-    });
+    broadcast2(kanbanListMessage(await listBoards3(projectRoot)));
   }
   async function projectSdd(runId, snapshot) {
     const k = mapKey("sdd", runId);
@@ -14823,14 +15043,11 @@ function createKanbanSupervisor(deps2) {
     publish(snapshot);
     const changedBoard = recovered?.board ?? gateSwept ?? reconciled?.board;
     if (changedBoard) {
-      deps2.broadcast({
-        type: "kanban.get",
-        payload: { success: true, data: { board: changedBoard } }
-      });
-      deps2.broadcast({
-        type: "kanban.list",
-        payload: { success: true, data: await listBoards4(deps2.projectRoot) }
-      });
+      await publishKanbanBoard(
+        deps2.broadcast,
+        changedBoard,
+        () => listBoards4(deps2.projectRoot)
+      );
     }
     if (config.mode === "agentic" && anomalyCount > 0) {
       await maybeRunAgent(board, config, health, snapshot);
@@ -15059,6 +15276,7 @@ function seedContextMeta(config, context) {
   meta["enhanceDelayMs"] = autonomyCfg["enhanceDelayMs"] ?? 6e4;
   meta["enhanceLanguage"] = autonomyCfg["enhanceLanguage"] ?? "original";
   meta["nextPrediction"] = config.nextPrediction ?? false;
+  meta["nextStepsTool"] = config.tools?.nextsteps?.enabled === true;
   meta["fallbackModels"] = config.fallbackModels ?? [];
   meta["fallbackBridge"] = config.fallbackBridge ?? "";
   meta["fallbackProfiles"] = config.fallbackProfiles ?? {};
@@ -15147,6 +15365,7 @@ function seedContextMeta(config, context) {
   meta["autoReviewProvider"] = autoReviewExt?.["provider"] ?? "";
   meta["autoReviewModel"] = autoReviewExt?.["model"] ?? "";
   meta["autoReviewFallbackProfile"] = autoReviewExt?.["fallbackProfile"] ?? "";
+  meta["autoReviewModelSelection"] = autoReviewExt?.["modelSelection"] === "random" ? "random" : "round-robin";
   meta["autoReviewFallbackModels"] = Array.isArray(autoReviewExt?.["fallbackModels"]) ? autoReviewExt?.["fallbackModels"] : [];
   meta["autoReviewDebounceMs"] = typeof autoReviewExt?.["debounceMs"] === "number" && autoReviewExt["debounceMs"] >= 0 ? autoReviewExt["debounceMs"] : 15e3;
   meta["autoReviewMaxFilesPerBatch"] = typeof autoReviewExt?.["maxFilesPerBatch"] === "number" && autoReviewExt["maxFilesPerBatch"] >= 1 ? autoReviewExt["maxFilesPerBatch"] : 15;
@@ -15184,6 +15403,7 @@ var PREF_KEYS = [
   "chime",
   "confirmExit",
   "nextPrediction",
+  "nextStepsTool",
   "enhanceEnabled",
   "enhanceDelayMs",
   "enhanceLanguage",
@@ -15247,6 +15467,7 @@ var PREF_KEYS = [
   "autoReviewProvider",
   "autoReviewModel",
   "autoReviewFallbackProfile",
+  "autoReviewModelSelection",
   "autoReviewFallbackModels",
   "autoReviewDebounceMs",
   "autoReviewMaxFilesPerBatch",
@@ -15460,6 +15681,11 @@ async function persistPrefsToConfig(deps2, holder, payload) {
         toolsCfg.maxIterations = payload["maxIterations"];
         decrypted.tools = toolsCfg;
       }
+      if (typeof payload["nextStepsTool"] === "boolean") {
+        const toolsCfg = decrypted.tools ?? {};
+        toolsCfg.nextsteps = { enabled: payload["nextStepsTool"] };
+        decrypted.tools = toolsCfg;
+      }
       const hqTouched = typeof payload["hqEnabled"] === "boolean" || typeof payload["hqUrl"] === "string" || typeof payload["hqToken"] === "string" || typeof payload["hqRawContent"] === "boolean";
       if (hqTouched) {
         const hqCfg = decrypted.hq ?? {};
@@ -15567,7 +15793,7 @@ async function persistPrefsToConfig(deps2, holder, payload) {
         ext["wstack-chimera"] = chimera;
         decrypted.extensions = ext;
       }
-      const autoReviewTouched = typeof payload["autoReviewEnabled"] === "boolean" || typeof payload["autoReviewProvider"] === "string" || typeof payload["autoReviewModel"] === "string" || typeof payload["autoReviewFallbackProfile"] === "string" || Array.isArray(payload["autoReviewFallbackModels"]) || typeof payload["autoReviewDebounceMs"] === "number" || typeof payload["autoReviewMaxFilesPerBatch"] === "number" || typeof payload["autoReviewMaxConcurrentReviews"] === "number" || typeof payload["autoReviewCascadeOn"] === "string";
+      const autoReviewTouched = typeof payload["autoReviewEnabled"] === "boolean" || typeof payload["autoReviewProvider"] === "string" || typeof payload["autoReviewModel"] === "string" || typeof payload["autoReviewFallbackProfile"] === "string" || typeof payload["autoReviewModelSelection"] === "string" || Array.isArray(payload["autoReviewFallbackModels"]) || typeof payload["autoReviewDebounceMs"] === "number" || typeof payload["autoReviewMaxFilesPerBatch"] === "number" || typeof payload["autoReviewMaxConcurrentReviews"] === "number" || typeof payload["autoReviewCascadeOn"] === "string";
       if (autoReviewTouched) {
         const ext = decrypted.extensions ?? {};
         const ar = ext["wstack-auto-review"] ?? {};
@@ -15584,6 +15810,9 @@ async function persistPrefsToConfig(deps2, holder, payload) {
             ar["fallbackProfile"] = payload["autoReviewFallbackProfile"];
           }
         }
+        if (payload["autoReviewModelSelection"] === "round-robin" || payload["autoReviewModelSelection"] === "random") {
+          ar["modelSelection"] = payload["autoReviewModelSelection"];
+        }
         if (typeof payload["autoReviewDebounceMs"] === "number" && payload["autoReviewDebounceMs"] >= 0) {
           ar["debounceMs"] = payload["autoReviewDebounceMs"];
         }
@@ -15952,6 +16181,7 @@ function createProjectHandlers(ctx) {
         ctx.context.session = next;
         ctx.context.state.replaceMessages([]);
         ctx.context.state.replaceTodos([]);
+        ctx.context.clearMemoryEvidence?.();
         ctx.context.readFiles.clear();
         ctx.context.fileMtimes.clear();
         ctx.tokenCounter.reset();
@@ -15996,7 +16226,7 @@ function createProjectHandlers(ctx) {
 }
 
 // src/server/provider-handlers.ts
-import { resolveProviderModelList } from "@wrongstack/core/models";
+import { hasProviderCredential, resolveProviderModelList } from "@wrongstack/core/models";
 import { DefaultSecretScrubber as DefaultSecretScrubber2 } from "@wrongstack/core/security";
 import { toErrorMessage as toErrorMessage6 } from "@wrongstack/core/utils";
 import {
@@ -16303,7 +16533,7 @@ function createProviderOperations(deps2) {
     }
     try {
       const providers = await deps2.modelsRegistry.listProviders();
-      const savedIds = new Set(Object.keys(await loadConfigProviders()));
+      const savedProviders = await loadConfigProviders();
       sendMessage(ws, {
         type: "provider.catalog",
         payload: {
@@ -16314,7 +16544,7 @@ function createProviderOperations(deps2) {
             apiBase: provider.apiBase,
             envVars: provider.envVars,
             modelCount: provider.models.length,
-            hasApiKey: savedIds.has(provider.id) || provider.envVars.some((name2) => !!process.env[name2])
+            hasApiKey: hasProviderCredential(provider, { providers: savedProviders })
           }))
         }
       });
@@ -16861,6 +17091,7 @@ var CLIENT_CONVERSATION_MESSAGE_TYPES = [
   "ping",
   "user_message",
   "tool.confirm_result",
+  "topic.advice",
   "completion.request",
   "model.switch",
   "model.refine",
@@ -17163,6 +17394,7 @@ var SERVER_CONVERSATION_MESSAGE_TYPES = [
   "tool.loop_detected",
   "tool.progress",
   "tool.started",
+  "topic.advice_result",
   "tools.list",
   "trust.persisted"
 ];
@@ -17672,6 +17904,8 @@ var SURFACE_PROTOCOL_CAPABILITIES = [
   "chronicle.metrics",
   "chronicle.status",
   "connections.health",
+  /** Bounded topic-shift advice plus same-session provider-context boundaries. */
+  "context.topic-boundary",
   /** Interview resume/discard + lastAgentText/lastRunId continuity. */
   "sdd.interview.continuity",
   /** Launch multi-agent runs from a graph id or resolved spec id. */
@@ -18076,6 +18310,7 @@ function createSessionHandlers(ctx) {
     await ctx.onBeforeSessionTodosReplaced?.(next.id, sessionsDirectory());
     ctx.context.state.replaceTodos(todos);
     resetContextAccounting();
+    ctx.context.clearMemoryEvidence?.();
     ctx.context.readFiles.clear();
     ctx.context.fileMtimes.clear();
     ctx.context.state.setMeta?.(
@@ -18123,6 +18358,7 @@ function createSessionHandlers(ctx) {
         ctx.context.state.replaceMessages([]);
         ctx.context.state.replaceTodos([]);
         resetContextAccounting();
+        ctx.context.clearMemoryEvidence?.();
         ctx.context.readFiles.clear();
         ctx.context.fileMtimes.clear();
         ctx.tokenCounter.reset?.();
@@ -18137,6 +18373,7 @@ function createSessionHandlers(ctx) {
       ctx.context.state.replaceMessages([]);
       ctx.context.state.replaceTodos([]);
       resetContextAccounting();
+      ctx.context.clearMemoryEvidence?.();
       ctx.context.readFiles.clear();
       ctx.context.fileMtimes.clear();
       ctx.tokenCounter.reset?.();
@@ -19922,6 +20159,7 @@ function createEmbeddedMessageRouter(deps2) {
   };
   const guardedTypes = /* @__PURE__ */ new Set([
     "user_message",
+    "topic.advice",
     "abort",
     "tool.confirm_result",
     "session.new",
@@ -20249,6 +20487,8 @@ function createEmbeddedMessageRouter(deps2) {
     ))
       return;
     if (await handleConnectionsServiceAction(ws, message, {
+      trustBoundary: deps2.trustBoundary,
+      logger: deps2.logger,
       getProjectRoot: projectRoot,
       getIndexDir: () => typeof opts.agent.ctx.meta["codebaseIndexDir"] === "string" ? opts.agent.ctx.meta["codebaseIndexDir"] : void 0,
       send: send2,
@@ -20300,8 +20540,8 @@ function createConfigWriteLock() {
     acquire() {
       const prev = lock;
       let release = () => void 0;
-      lock = new Promise((resolve16) => {
-        release = resolve16;
+      lock = new Promise((resolve17) => {
+        release = resolve17;
       });
       return { prev, release };
     }
@@ -21235,7 +21475,7 @@ function registerSetupEventsClientStatusWriter(deps2) {
   const on = (event, listener) => events.on(event, listener);
   return on("client.status", async (e) => {
     broadcast2(clients, { type: "client.status_update", payload: e });
-    if (wpaths?.projectStatus) {
+    if (wpaths?.projectStatus && e.projectHash !== "unknown") {
       try {
         const statusFile = wpaths.projectStatus(e.projectHash);
         const dir = path24.dirname(statusFile);
@@ -21410,7 +21650,10 @@ function registerSetupEventsProviderHandlers({
         sessionId: e.sessionId,
         providerId: e.providerId,
         modelId: e.modelId,
-        maxContext: e.maxContext
+        maxContext: e.maxContext,
+        ...e.previousMaxContext !== void 0 ? { previousMaxContext: e.previousMaxContext } : {},
+        ...e.source !== void 0 ? { source: e.source } : {},
+        ...e.decreased !== void 0 ? { decreased: e.decreased } : {}
       })
     });
   });
@@ -22520,7 +22763,15 @@ var SpecsWebSocketHandler = class {
     this.clients.add(client);
     ws.on("close", () => this.clients.delete(client));
     ws.on("error", () => this.clients.delete(client));
-    void this.sendList(client);
+    void this.sendList(client).catch((err) => {
+      console.warn(
+        JSON.stringify({
+          level: "warn",
+          event: "specs.initial_send_failed",
+          message: err instanceof Error ? err.message : String(err)
+        })
+      );
+    });
   }
   dispose() {
     this.clients.clear();
@@ -22734,15 +22985,17 @@ import {
 
 // src/server/discover-mailbox-bridge.ts
 import { spawn as spawn4 } from "node:child_process";
-import { createRequire } from "node:module";
 import { existsSync as existsSync2 } from "node:fs";
+import { createRequire } from "node:module";
 import { dirname as dirname10, join as join13 } from "node:path";
-import { resolveProjectDir as resolveProjectDir3 } from "@wrongstack/core/coordination";
+import {
+  readLiveLock,
+  resolveProjectDir as resolveProjectDir3
+} from "@wrongstack/core/coordination";
 import { wstackGlobalRoot as wstackGlobalRoot3 } from "@wrongstack/core/utils";
-import { readLiveLock } from "@wrongstack/core/coordination";
 var MAILBOX_BRIDGE_BOOT_TIMEOUT_MS = 5e3;
 async function discoverMailboxBridgeForWebui(params) {
-  const mode = params.config?.features?.mailboxBridge ?? "auto";
+  const mode = params.config?.features?.mailboxBridge ?? "off";
   if (mode === "off") return;
   const projectDir = resolveProjectDir3(params.projectRoot, wstackGlobalRoot3());
   let result = await readLiveLock(projectDir);
@@ -22874,7 +23127,7 @@ function findWorkspaceCliEntry(projectRoot) {
   return null;
 }
 function sleep(ms) {
-  return new Promise((resolve16) => setTimeout(resolve16, ms));
+  return new Promise((resolve17) => setTimeout(resolve17, ms));
 }
 
 // src/server/terminal-ws-handler.ts
@@ -23004,6 +23257,13 @@ var TerminalWebSocketHandler = class {
       this.send(ws, { type: "terminal.exit", payload: { id: payload.id, exitCode: -1 } });
       return;
     }
+    if (this.sessions.get(ws) !== map) {
+      this.logger.info?.(
+        `terminal.create raced a disconnect (id=${payload.id}) \u2014 killing the orphan`
+      );
+      this.killPty(pty, "terminal create after disconnect");
+      return;
+    }
     map.set(payload.id, pty);
     this.logger.info?.(`terminal.create spawned (id=${payload.id}, pid=${pty.pid ?? "?"}) in ${cwd}`);
     pty.onData((data) => {
@@ -23110,7 +23370,7 @@ function clampDim(value, fallback) {
 }
 
 // src/server/worktree-ws-handler.ts
-import { join as join14, resolve as resolve13, sep as sep5 } from "node:path";
+import { join as join14, resolve as resolve14, sep as sep5 } from "node:path";
 import { toErrorMessage as toErrorMessage9 } from "@wrongstack/core/utils";
 import { WorktreeManager as WorktreeManager3 } from "@wrongstack/core/worktree";
 import { cleanupStaleSddWorktrees as cleanupStaleSddWorktrees2 } from "@wrongstack/sdd";
@@ -23195,11 +23455,11 @@ var WorktreeWebSocketHandler = class {
   // ── orphan management ─────────────────────────────────────────────────────
   /** Absolute managed-worktrees root for this project. */
   worktreesRoot() {
-    return resolve13(join14(this.management.projectRoot, ".wrongstack", "worktrees"));
+    return resolve14(join14(this.management.projectRoot, ".wrongstack", "worktrees"));
   }
   /** True iff `dir` resolves strictly inside the managed worktrees root. */
   underRoot(dir) {
-    const abs = resolve13(dir);
+    const abs = resolve14(dir);
     const root = this.worktreesRoot();
     return abs !== root && abs.startsWith(root + sep5);
   }
@@ -23423,7 +23683,7 @@ var WorktreeWebSocketHandler = class {
     }
     const base = baseBranch && MANAGED_BRANCH_RE.test(baseBranch) ? baseBranch : void 0;
     const wt = new WorktreeManager3({ projectRoot: this.management.projectRoot });
-    const summary = await wt.diffSummary(resolve13(dir), base);
+    const summary = await wt.diffSummary(resolve14(dir), base);
     this.broadcast({ type: "worktree.diff_result", payload: { dir, summary } });
   }
   // ── internals ───────────────────────────────────────────────────────────
@@ -24429,6 +24689,15 @@ function createMessageDispatcher(opts) {
       msg
     ))
       return;
+    if (await handleConnectionsServiceAction(ws, msg, {
+      trustBoundary: deps2.trustBoundary,
+      logger: deps2.logger,
+      getProjectRoot: state.getProjectRoot,
+      getIndexDir: () => typeof deps2.context.meta["codebaseIndexDir"] === "string" ? deps2.context.meta["codebaseIndexDir"] : void 0,
+      send,
+      backend: "standalone"
+    }))
+      return;
     if (await handleCodebaseIndexServerControl(ws, msg, {
       trustBoundary: deps2.trustBoundary,
       logger: deps2.logger,
@@ -24935,6 +25204,7 @@ async function createPreContextServices(input) {
       registry: toolRegistry,
       tier: normalizeTokenSavingTier(config.features.tokenSavingMode),
       memory: { enabled: config.features.memory, store: memoryStore },
+      nextSteps: { enabled: config.tools?.nextsteps?.enabled === true },
       coordinationTools: [
         makeMailboxTool({ projectDir: wpaths.projectDir, events }),
         makeMailSendTool({ projectDir: wpaths.projectDir, events }),
@@ -26043,7 +26313,7 @@ async function startWebUI(opts = {}) {
         if (events.listenerCount("tool.confirm_needed") === 0) {
           throw new Error("No permission confirmation surface is connected");
         }
-        const decision = await new Promise((resolve16) => {
+        const decision = await new Promise((resolve17) => {
           events.emit("tool.confirm_needed", {
             sessionId: context.session.id,
             tool: confirmTool,
@@ -26053,7 +26323,7 @@ async function startWebUI(opts = {}) {
             decisionSource: pending.decisionSource,
             riskTier: pending.riskTier,
             boundaryReason: pending.boundaryReason,
-            resolve: resolve16
+            resolve: resolve17
           });
         });
         const rule = { tool: "language_package", pattern: pending.suggestedPattern };
@@ -26122,7 +26392,8 @@ async function startWebUI(opts = {}) {
     watcherMetricsRef
   );
   httpServer.listen(httpPort, wsHost, () => {
-    console.log(`[WebUI] HTTP server running on http://${wsHost}:${httpPort}`);
+    const tokenQuery = accessToken ? `/?token=${encodeURIComponent(accessToken)}` : "";
+    console.log(`[WebUI] HTTP server running on http://${wsHost}:${httpPort}${tokenQuery}`);
     const extraUrls = formatExternalAccessUrls({
       bindHost: wsHost,
       port: httpPort,
@@ -26144,8 +26415,11 @@ async function startWebUI(opts = {}) {
       (req, socket, head2) => httpServer.emit("upgrade", req, socket, head2)
     );
     companionServer.on("error", (err) => {
-      if (err.code !== "EAFNOSUPPORT" && err.code !== "EADDRNOTAVAIL" && err.code !== "EADDRINUSE") {
-        throw err;
+      const expected = err.code === "EAFNOSUPPORT" || err.code === "EADDRNOTAVAIL" || err.code === "EADDRINUSE";
+      if (!expected) {
+        console.warn(
+          `[WebUI] companion listener on ${companionLabel} failed (${err.code ?? "unknown"}): ${err.message}. The primary address is unaffected.`
+        );
       }
     });
     companionServer.listen(httpPort, companion, () => {
@@ -26387,24 +26661,23 @@ async function startWebUI(opts = {}) {
     clients,
     pendingConfirms,
     onSecurityRejection: (ev) => {
-      try {
-        void mailbox.send({
-          from: context.agentId,
-          to: "*",
-          type: "note",
-          audience: "leaders",
-          subject: `Security rejection: ${ev.issueCode}`,
-          body: `Decoder tripwire ${ev.issueCode}: ${ev.issueMessage}
+      void mailbox.send({
+        from: context.agentId,
+        to: "*",
+        type: "note",
+        audience: "leaders",
+        subject: `Security rejection: ${ev.issueCode}`,
+        body: `Decoder tripwire ${ev.issueCode}: ${ev.issueMessage}
 
 connectionId: ${ev.connectionId ?? "?"}
 sessionId: ${ev.sessionId ?? "?"}
 agentId: ${ev.agentId ?? "?"}
 projectRoot: ${ev.projectRoot ?? "?"}`,
-          priority: "high",
-          senderSessionId: session.id
-        });
-      } catch {
-      }
+        priority: "high",
+        senderSessionId: session.id
+      }).catch((err) => {
+        console.warn(`[WebUI] security-rejection mailbox note failed: ${String(err)}`);
+      });
     },
     goalHandler,
     specsHandler,
@@ -26489,6 +26762,7 @@ export {
   SddWizardWebSocketHandler,
   SpecsWebSocketHandler,
   TerminalWebSocketHandler,
+  WEBUI_WS_MAX_BUFFERED_BYTES,
   WorktreeWebSocketHandler,
   addProvider,
   announceWebuiReady,
@@ -26691,6 +26965,7 @@ export {
   isPortFree,
   isRegisteredMessageType,
   isWildcardBind,
+  joinSessionRegistryWithWebUIInstances,
   listInstances,
   loadManifest,
   loadSavedProviders,
@@ -26743,6 +27018,7 @@ export {
   seedContextMeta,
   send,
   sendResult2 as sendResult,
+  sendSerialized,
   setActiveKey,
   setupEvents,
   setupWebUICodebaseIndexing,