@wrongstack/webui-server 0.301.0 → 0.302.2

package/dist/index.js

@@ -4409,7 +4409,8 @@ function createConversationOperations(ctx) {
     userMessage: async (ws, msg) => {
       if (!ensureCurrentSession(ws, msg, "user_message")) return;
       const payload = msg.payload ?? {};
-      const controller = ctx.runControl.begin(ws);
+      const originSessionId = ctx.getSessionId();
+      const controller = ctx.runControl.begin(ws, originSessionId);
       if (!controller) {
         ctx.send(ws, {
           type: "error",
@@ -4420,7 +4421,6 @@ function createConversationOperations(ctx) {
         });
         return;
       }
-      const originSessionId = ctx.getSessionId();
       try {
         const agent = ctx.getAgent();
         if (payload.freshContext === true) await startFreshTopicContext(agent.ctx);
@@ -4479,12 +4479,13 @@ function createConversationOperations(ctx) {
           });
         }
       } finally {
-        ctx.runControl.end(ws, controller);
+        ctx.runControl.end(ws, originSessionId, controller);
       }
     },
     abort: (ws, msg) => {
       if (!ensureCurrentSession(ws, msg, "abort")) return;
-      ctx.runControl.abort(ws);
+      const sessionId = requestedSessionId(msg) ?? ctx.getSessionId();
+      ctx.runControl.abort(ws, sessionId);
       ctx.notifyAbort(ws, {
         type: "error",
         payload: sessionPayload2({ phase: "abort", message: "User aborted" })
@@ -5536,6 +5537,7 @@ function createConnectionLifecycle(options) {
 }
 
 // src/server/connections-health-route.ts
+import * as net from "node:net";
 import {
   ChronicleProjectServerClient,
   createChronicleProjectAccess as createChronicleProjectAccess2,
@@ -5545,13 +5547,22 @@ import {
   isMailboxProjectServerAvailable,
   MailboxProjectServerConnection
 } from "@wrongstack/core/coordination";
+import { SessionCatalogProjectClient } from "@wrongstack/core/session-catalog";
 import { resolveWstackPaths as resolveWstackPaths2 } from "@wrongstack/core/utils";
 import {
   closeKanbanServerConnections,
   getKanbanServerConnection,
   isKanbanServerAvailable
 } from "@wrongstack/kanban";
-import * as net from "node:net";
+import { readGovernanceDaemonOperatorStatus } from "@wrongstack/runtime/governance-bootstrap";
+import { isSageProjectServerAvailable, SageProjectServerConnection } from "@wrongstack/sage";
+import {
+  checkCodebaseIndexServerHealth,
+  ensureCodebaseIndexServer as ensureCodebaseIndexServer2,
+  getIndexState,
+  resolveProjectIndexDaemonAvailability,
+  shutdownCodebaseIndexServer
+} from "@wrongstack/tools";
 
 // src/server/privileged-actions.ts
 import { randomUUID as randomUUID2 } from "node:crypto";
@@ -5585,15 +5596,6 @@ async function authorizeWebUIAction(boundary, action, logger) {
 }
 
 // src/server/connections-health-route.ts
-import { readGovernanceDaemonOperatorStatus } from "@wrongstack/runtime/governance-bootstrap";
-import { isSageProjectServerAvailable, SageProjectServerConnection } from "@wrongstack/sage";
-import {
-  checkCodebaseIndexServerHealth,
-  ensureCodebaseIndexServer as ensureCodebaseIndexServer2,
-  getIndexState,
-  resolveProjectIndexDaemonAvailability,
-  shutdownCodebaseIndexServer
-} from "@wrongstack/tools";
 async function handleConnectionsHealthRoute(context, ws, message) {
   if (message.type !== "connections.health") return false;
   try {
@@ -5614,6 +5616,7 @@ async function handleConnectionsHealthRoute(context, ws, message) {
 async function collectConnectionsHealth(options) {
   const services = await Promise.all([
     Promise.resolve(webuiHealth(options.backend)),
+    sessionCatalogHealth(options.projectRoot),
     chronicleHealth(options.projectRoot),
     codebaseIndexHealth(options.projectRoot, options.indexDir),
     sageHealth(options.projectRoot),
@@ -5631,6 +5634,50 @@ async function collectConnectionsHealth(options) {
     services
   };
 }
+async function sessionCatalogHealth(projectRoot) {
+  const startedAt = Date.now();
+  try {
+    const paths = resolveWstackPaths2({ projectRoot });
+    const client = new SessionCatalogProjectClient({
+      projectDir: paths.projectDir,
+      projectRoot
+    });
+    try {
+      const health = await client.ping();
+      return {
+        id: "session-catalog",
+        label: "Session Catalog",
+        status: health.damagedRows > 0 ? "degraded" : "healthy",
+        required: true,
+        mode: "project-daemon",
+        detail: health.damagedRows > 0 ? `${health.damagedRows} damaged catalog row(s); rebuild is required.` : `${health.catalogRows} catalog session(s), ${health.liveLeases} live lease(s), ${health.reservations} reservation(s).`,
+        ownerPid: health.pid,
+        endpoint: health.endpoint,
+        storage: health.databasePath,
+        uptimeMs: health.uptimeMs,
+        latencyMs: Date.now() - startedAt,
+        clients: health.clients,
+        activeRequests: health.activeRequests,
+        queuedWork: health.reservations + health.maintenanceLeases,
+        control: "none"
+      };
+    } finally {
+      await client.close().catch(() => void 0);
+    }
+  } catch (error2) {
+    return {
+      id: "session-catalog",
+      label: "Session Catalog",
+      status: "error",
+      required: true,
+      mode: "project-daemon",
+      detail: "Project-scoped session ownership and catalog are unavailable.",
+      latencyMs: Date.now() - startedAt,
+      lastError: error2 instanceof Error ? error2.message : String(error2),
+      control: "none"
+    };
+  }
+}
 function webuiHealth(backend) {
   return {
     id: "webui",
@@ -6229,7 +6276,11 @@ async function restartSageServer(projectRoot) {
   });
   const verifyConn = new SageProjectServerConnection(projectRoot);
   try {
-    await verifyConn.call("ping", {}, { timeoutMs: 1e4, meta: { clientId: `sage-restart-${process.pid}` } });
+    await verifyConn.call(
+      "ping",
+      {},
+      { timeoutMs: 1e4, meta: { clientId: `sage-restart-${process.pid}` } }
+    );
     return {
       serviceId: "sage",
       action: "restart",
@@ -6463,28 +6514,28 @@ async function restartMailboxServer(projectRoot) {
 var RESTART_POLL_INTERVAL_MS = 250;
 var RESTART_DEADLINE_MS = 3e3;
 function isEndpointAlive(endpoint) {
-  return new Promise((resolve16) => {
+  return new Promise((resolve17) => {
     const sock = net.createConnection(endpoint);
     const timer = setTimeout(() => {
       sock.destroy();
-      resolve16(false);
+      resolve17(false);
     }, 500);
     timer.unref?.();
     sock.once("connect", () => {
       clearTimeout(timer);
       sock.destroy();
-      resolve16(true);
+      resolve17(true);
     });
     sock.once("error", () => {
       clearTimeout(timer);
       sock.destroy();
-      resolve16(false);
+      resolve17(false);
     });
   });
 }
 async function waitForShutdown(probe) {
   if (!probe) {
-    await new Promise((resolve16) => setTimeout(resolve16, RESTART_POLL_INTERVAL_MS));
+    await new Promise((resolve17) => setTimeout(resolve17, RESTART_POLL_INTERVAL_MS));
     return;
   }
   const deadline = Date.now() + RESTART_DEADLINE_MS;
@@ -6495,7 +6546,7 @@ async function waitForShutdown(probe) {
     } catch {
       return;
     }
-    await new Promise((resolve16) => setTimeout(resolve16, RESTART_POLL_INTERVAL_MS));
+    await new Promise((resolve17) => setTimeout(resolve17, RESTART_POLL_INTERVAL_MS));
   }
 }
 function failureService(id, label, required, mode, error2, latencyMs) {
@@ -6658,9 +6709,9 @@ async function handleGitInfo(ws, projectRoot) {
   const cwd = projectRoot || void 0;
   try {
     const { execFile: ef } = await import("node:child_process");
-    const git = (args) => new Promise((resolve16) => {
+    const git = (args) => new Promise((resolve17) => {
       ef("git", args, { cwd, timeout: 3e3 }, (err, stdout) => {
-        resolve16(err ? "" : stdout.trim());
+        resolve17(err ? "" : stdout.trim());
       });
     });
     const [branchRaw, diffRaw, statusRaw, upstreamRaw] = await Promise.all([
@@ -6686,12 +6737,12 @@ async function handleGitInfo(ws, projectRoot) {
 function makeGit(cwd) {
   return async (args) => {
     const { execFile: ef } = await import("node:child_process");
-    return new Promise((resolve16) => {
+    return new Promise((resolve17) => {
       ef(
         "git",
         args,
         { cwd, timeout: 5e3, maxBuffer: 1024 * 1024 * 16 },
-        (err, stdout) => resolve16(err ? "" : stdout)
+        (err, stdout) => resolve17(err ? "" : stdout)
       );
     });
   };
@@ -6856,7 +6907,7 @@ import { execFile } from "node:child_process";
 var GIT_TIMEOUT_MS = 1e4;
 var GIT_MAX_OUTPUT_BYTES = 1024 * 1024;
 function gitStdout(cwd, args) {
-  return new Promise((resolve16) => {
+  return new Promise((resolve17) => {
     execFile(
       "git",
       [...args],
@@ -6867,7 +6918,7 @@ function gitStdout(cwd, args) {
         timeout: GIT_TIMEOUT_MS,
         maxBuffer: GIT_MAX_OUTPUT_BYTES
       },
-      (error2, stdout) => resolve16(error2 ? null : stdout)
+      (error2, stdout) => resolve17(error2 ? null : stdout)
     );
   });
 }
@@ -7158,14 +7209,14 @@ var GoalWebSocketHandler = class {
         const cwd = env?.cwd ?? this.projectRoot;
         try {
           const { execFile: execFile2 } = await import("node:child_process");
-          const result = await new Promise((resolve16) => {
+          const result = await new Promise((resolve17) => {
             const npxCommand = process.platform === "win32" ? "npx.cmd" : "npx";
             execFile2(npxCommand, ["tsc", "--noEmit"], { cwd, timeout: 6e4 }, (err, stdout, stderr) => {
               if (err && err.code === "ENOENT") {
-                resolve16("[verify] tsc not found \u2014 skipping");
+                resolve17("[verify] tsc not found \u2014 skipping");
                 return;
               }
-              resolve16(stdout + stderr);
+              resolve17(stdout + stderr);
             });
           });
           if (result.includes("[verify]") || result.trim().length === 0) {
@@ -7903,7 +7954,7 @@ function pushEvent(event) {
   }
 }
 function parseBody(req) {
-  return new Promise((resolve16, reject) => {
+  return new Promise((resolve17, reject) => {
     let body = "";
     let bodyBytes = 0;
     let tooLarge = false;
@@ -7923,7 +7974,7 @@ function parseBody(req) {
         return;
       }
       try {
-        resolve16(JSON.parse(body));
+        resolve17(JSON.parse(body));
       } catch {
         reject(new Error("Invalid JSON"));
       }
@@ -8018,7 +8069,7 @@ import * as path10 from "node:path";
 import { runDeadCodeScan } from "@wrongstack/tools/codebase-index";
 var MAX_BODY_BYTES = 10 * 1024 * 1024;
 function readJsonBody(req) {
-  return new Promise((resolve16, reject) => {
+  return new Promise((resolve17, reject) => {
     const chunks = [];
     let total = 0;
     req.on("data", (chunk) => {
@@ -8030,7 +8081,7 @@ function readJsonBody(req) {
       }
       chunks.push(chunk);
     });
-    req.on("end", () => resolve16(Buffer.concat(chunks).toString("utf8")));
+    req.on("end", () => resolve17(Buffer.concat(chunks).toString("utf8")));
     req.on("error", (err) => reject(err));
   });
 }
@@ -8248,8 +8299,8 @@ async function handleApiSessions(res, globalRoot) {
     return;
   }
   try {
-    const { SessionRegistry } = await import("@wrongstack/core/storage");
-    const registry = new SessionRegistry(globalRoot);
+    const { getSessionRegistry: getSessionRegistry3 } = await import("@wrongstack/core/storage");
+    const registry = getSessionRegistry3(globalRoot);
     const sessions = await registry.list();
     const result = sessions.map((s) => ({
       sessionId: s.sessionId,
@@ -8286,8 +8337,8 @@ async function handleApiSessionAgents(res, globalRoot, sessionId) {
     return;
   }
   try {
-    const { SessionRegistry } = await import("@wrongstack/core/storage");
-    const registry = new SessionRegistry(globalRoot);
+    const { getSessionRegistry: getSessionRegistry3 } = await import("@wrongstack/core/storage");
+    const registry = getSessionRegistry3(globalRoot);
     const entry = await registry.get(sessionId);
     if (!entry) {
       res.writeHead(404, { "Content-Type": "application/json" });
@@ -8295,20 +8346,22 @@ async function handleApiSessionAgents(res, globalRoot, sessionId) {
       return;
     }
     res.writeHead(200, { "Content-Type": "application/json" });
-    res.end(JSON.stringify({
-      sessionId: entry.sessionId,
-      projectName: entry.projectName,
-      status: entry.status,
-      agents: entry.agents.map((a) => ({
-        id: a.id,
-        name: a.name,
-        status: a.status,
-        currentTool: a.currentTool,
-        iterations: a.iterations,
-        toolCalls: a.toolCalls,
-        lastActivityAt: a.lastActivityAt
-      }))
-    }));
+    res.end(
+      JSON.stringify({
+        sessionId: entry.sessionId,
+        projectName: entry.projectName,
+        status: entry.status,
+        agents: entry.agents.map((a) => ({
+          id: a.id,
+          name: a.name,
+          status: a.status,
+          currentTool: a.currentTool,
+          iterations: a.iterations,
+          toolCalls: a.toolCalls,
+          lastActivityAt: a.lastActivityAt
+        }))
+      })
+    );
   } catch (err) {
     res.writeHead(500, { "Content-Type": "application/json" });
     res.end(JSON.stringify({ error: sanitizeApiError(err) }));
@@ -8426,9 +8479,9 @@ async function handleApiSessionEvents(res, globalRoot, sessionId, limit) {
     return;
   }
   try {
-    const { SessionRegistry, DefaultSessionStore: DefaultSessionStore4, DefaultSessionReader: DefaultSessionReader2 } = await import("@wrongstack/core/storage");
+    const { getSessionRegistry: getSessionRegistry3, DefaultSessionStore: DefaultSessionStore4, DefaultSessionReader: DefaultSessionReader2 } = await import("@wrongstack/core/storage");
     const { resolveWstackPaths: resolveWstackPaths7 } = await import("@wrongstack/core/utils");
-    const registry = new SessionRegistry(globalRoot);
+    const registry = getSessionRegistry3(globalRoot);
     const entry = await registry.get(sessionId);
     if (!entry) {
       res.writeHead(404, { "Content-Type": "application/json" });
@@ -8436,7 +8489,10 @@ async function handleApiSessionEvents(res, globalRoot, sessionId, limit) {
       return;
     }
     const paths = resolveWstackPaths7({ projectRoot: entry.projectRoot, globalRoot });
-    const store = new DefaultSessionStore4({ dir: paths.projectSessions });
+    const store = new DefaultSessionStore4({
+      dir: paths.projectSessions,
+      projectRoot: entry.projectRoot
+    });
     const reader = new DefaultSessionReader2({ store });
     const RING = Math.max(limit * 4, 2e3);
     const ring = [];
@@ -8476,7 +8532,7 @@ async function handleApiSessionEvents(res, globalRoot, sessionId, limit) {
   }
 }
 function readJsonBody2(req) {
-  return new Promise((resolve16, reject) => {
+  return new Promise((resolve17, reject) => {
     const contentType = (req.headers["content-type"] ?? "").split(";")[0]?.trim().toLowerCase();
     if (contentType !== "application/json") {
       reject(new Error(`Unsupported Content-Type: ${contentType || "(absent)"}`));
@@ -8492,7 +8548,7 @@ function readJsonBody2(req) {
     });
     req.on("end", () => {
       try {
-        resolve16(data ? JSON.parse(data) : {});
+        resolve17(data ? JSON.parse(data) : {});
       } catch (err) {
         reject(err instanceof Error ? err : new Error(String(err)));
       }
@@ -8528,10 +8584,10 @@ async function handleApiSessionMessage(res, req, globalRoot, sessionId) {
   const priority = ["low", "normal", "high"].includes(rawPriority) ? rawPriority : "high";
   const subject = typeof body["subject"] === "string" && body["subject"].trim() ? body["subject"].trim() : "Message from Fleet HQ";
   try {
-    const { SessionRegistry } = await import("@wrongstack/core/storage");
+    const { getSessionRegistry: getSessionRegistry3 } = await import("@wrongstack/core/storage");
     const { getSharedProjectMailbox: getSharedProjectMailbox6, mailboxSessionTag: mailboxSessionTag2 } = await import("@wrongstack/core/coordination");
     const { resolveWstackPaths: resolveWstackPaths7 } = await import("@wrongstack/core/utils");
-    const registry = new SessionRegistry(globalRoot);
+    const registry = getSessionRegistry3(globalRoot);
     const entry = await registry.get(sessionId);
     if (!entry) {
       res.writeHead(404, { "Content-Type": "application/json" });
@@ -8556,10 +8612,10 @@ async function handleApiSessionMailbox(res, globalRoot, sessionId) {
     return;
   }
   try {
-    const { SessionRegistry } = await import("@wrongstack/core/storage");
+    const { getSessionRegistry: getSessionRegistry3 } = await import("@wrongstack/core/storage");
     const { getSharedProjectMailbox: getSharedProjectMailbox6, mailboxSessionTag: mailboxSessionTag2 } = await import("@wrongstack/core/coordination");
     const { resolveWstackPaths: resolveWstackPaths7 } = await import("@wrongstack/core/utils");
-    const registry = new SessionRegistry(globalRoot);
+    const registry = getSessionRegistry3(globalRoot);
     const entry = await registry.get(sessionId);
     if (!entry) {
       res.writeHead(404, { "Content-Type": "application/json" });
@@ -8616,10 +8672,10 @@ async function handleApiSessionInterrupt(res, req, globalRoot, sessionId) {
   const reason = typeof body["reason"] === "string" && body["reason"].trim() ? body["reason"].trim() : "Operator requested stop from Fleet HQ";
   const from = typeof body["from"] === "string" && body["from"].trim() ? body["from"].trim() : "human@webui";
   try {
-    const { SessionRegistry } = await import("@wrongstack/core/storage");
+    const { getSessionRegistry: getSessionRegistry3 } = await import("@wrongstack/core/storage");
     const { getSharedProjectMailbox: getSharedProjectMailbox6, mailboxSessionTag: mailboxSessionTag2 } = await import("@wrongstack/core/coordination");
     const { resolveWstackPaths: resolveWstackPaths7 } = await import("@wrongstack/core/utils");
-    const registry = new SessionRegistry(globalRoot);
+    const registry = getSessionRegistry3(globalRoot);
     const entry = await registry.get(sessionId);
     if (!entry) {
       res.writeHead(404, { "Content-Type": "application/json" });
@@ -8665,10 +8721,10 @@ async function handleApiFleetBroadcast(res, req, globalRoot) {
   }
   const from = typeof body["from"] === "string" && body["from"].trim() ? body["from"].trim() : "human@webui";
   try {
-    const { SessionRegistry } = await import("@wrongstack/core/storage");
+    const { getSessionRegistry: getSessionRegistry3 } = await import("@wrongstack/core/storage");
     const { getSharedProjectMailbox: getSharedProjectMailbox6, mailboxSessionTag: mailboxSessionTag2 } = await import("@wrongstack/core/coordination");
     const { resolveWstackPaths: resolveWstackPaths7 } = await import("@wrongstack/core/utils");
-    const registry = new SessionRegistry(globalRoot);
+    const registry = getSessionRegistry3(globalRoot);
     const all = await registry.list();
     const mySlug = all.find((s) => s.pid === process.pid)?.projectSlug;
     const targets = all.filter((s) => s.status !== "stale").filter((s) => mySlug ? s.projectSlug === mySlug : true);
@@ -8768,14 +8824,14 @@ async function readJsonBody3(res, req) {
     });
     return null;
   }
-  return new Promise((resolve16) => {
+  return new Promise((resolve17) => {
     let data = "";
     let failed = false;
     const fail2 = (message) => {
       if (failed) return;
       failed = true;
       sendJson2(res, 400, { error: { code: "INVALID_BODY", message } });
-      resolve16(null);
+      resolve17(null);
     };
     req.on("data", (chunk) => {
       if (failed) return;
@@ -8788,7 +8844,7 @@ async function readJsonBody3(res, req) {
     req.on("end", () => {
       if (failed) return;
       try {
-        resolve16(data.trim().length === 0 ? {} : JSON.parse(data));
+        resolve17(data.trim().length === 0 ? {} : JSON.parse(data));
       } catch {
         fail2("Request body is not valid JSON");
       }
@@ -9627,7 +9683,7 @@ function strictDecodeParam(segment, res) {
 function createHttpServer(opts) {
   const port = opts.port ?? Number.parseInt(process.env["PORT"] ?? "3456", 10);
   const distDir = path13.resolve(opts.distDir);
-  const requireAccessToken = true;
+  const requireAccessToken = Boolean(opts.requireToken) || !isLoopbackBind(opts.host);
   const secureCookies = opts.secureCookies ?? (opts.publicWsUrl?.trim().toLowerCase().startsWith("wss:") ?? false);
   const trustedHostnames = (() => {
     const names = [...opts.allowedHostnames ?? []];
@@ -10173,10 +10229,78 @@ function createHttpServer(opts) {
 }
 
 // src/server/instance-registry.ts
+import * as fs11 from "node:fs/promises";
 import * as os from "node:os";
 import * as path14 from "node:path";
-import * as fs11 from "node:fs/promises";
 import { atomicWrite as atomicWrite4 } from "@wrongstack/core/utils";
+function normalizeRoot(root) {
+  const resolved = path14.resolve(root);
+  return process.platform === "win32" ? resolved.toLowerCase() : resolved;
+}
+function isLiveSessionStatus(status) {
+  return status === "active" || status === "idle";
+}
+function instanceRole(instance) {
+  return instance.role ?? "standalone";
+}
+function resolveAttachability(input) {
+  const { session, instance } = input;
+  if (!isLiveSessionStatus(session.status)) {
+    return { attachable: false, degradedReason: "session-not-live" };
+  }
+  if (!instance) {
+    return { attachable: false, degradedReason: "live-session-no-webui-endpoint" };
+  }
+  if (instance.pid !== session.pid) {
+    return { attachable: false, degradedReason: "endpoint-owner-mismatch" };
+  }
+  if (!instance.sessionId) {
+    return { attachable: false, instance, degradedReason: "endpoint-missing-session-id" };
+  }
+  if (instance.sessionId !== session.sessionId) {
+    return { attachable: false, instance, degradedReason: "endpoint-session-mismatch" };
+  }
+  if (instanceRole(instance) !== "session-child") {
+    return { attachable: false, instance, degradedReason: "endpoint-not-session-child" };
+  }
+  if (instance.attachable === false) {
+    return { attachable: false, instance, degradedReason: "endpoint-not-attachable" };
+  }
+  return {
+    attachable: true,
+    endpoint: {
+      host: instance.host,
+      httpPort: instance.httpPort,
+      url: instance.url,
+      ...instance.authToken ? { authToken: instance.authToken } : {}
+    }
+  };
+}
+function joinSessionRegistryWithWebUIInstances(input) {
+  const targetRoot = input.projectRoot ? normalizeRoot(input.projectRoot) : void 0;
+  const sessions = input.sessions.filter((session) => {
+    if (input.projectSlug && session.projectSlug !== input.projectSlug) return false;
+    if (targetRoot && normalizeRoot(session.projectRoot) !== targetRoot) return false;
+    return true;
+  });
+  return sessions.map((session) => {
+    const instance = input.instances.find((candidate) => candidate.sessionId === session.sessionId) ?? input.instances.find(
+      (candidate) => candidate.pid === session.pid && normalizeRoot(candidate.projectRoot) === normalizeRoot(session.projectRoot)
+    );
+    const resolved = resolveAttachability({ session, instance });
+    return {
+      sessionId: session.sessionId,
+      projectRoot: session.projectRoot,
+      workingDir: session.workingDir,
+      sessionPid: session.pid,
+      status: session.status,
+      ...instance ? { instance } : {},
+      ...resolved.endpoint ? { endpoint: resolved.endpoint } : {},
+      attachable: resolved.attachable,
+      ...resolved.degradedReason ? { degradedReason: resolved.degradedReason } : {}
+    };
+  });
+}
 function defaultBaseDir() {
   return path14.join(os.homedir(), ".wrongstack");
 }
@@ -11236,6 +11360,14 @@ async function handleKanbanRoute(ws, msg, ctx) {
           fail(ws, type, `Board not found: ${boardId}`);
           return true;
         }
+        if (ctx.supervisor) {
+          const snapshots = await ctx.supervisor.auditNow(boardId);
+          const snapshot = snapshots[0];
+          if (snapshot) {
+            ok(ws, type, snapshot);
+            return true;
+          }
+        }
         const reconciled = await reconcileKanbanBoard(ctx.projectRoot, boardId);
         let health = await getKanbanQueueHealth(ctx.projectRoot, { boardId });
         const recovered = health.staleAssignments.count ? await recoverStaleTaskAssignments(ctx.projectRoot, boardId, {
@@ -12000,6 +12132,15 @@ function createShutdown(res) {
       } catch {
       }
     }
+    if (res.onPreShutdown) {
+      try {
+        await res.onPreShutdown();
+      } catch (e) {
+        log(
+          `[WebUI] Error during pre-shutdown cleanup: ${e instanceof Error ? e.message : String(e)}`
+        );
+      }
+    }
     for (const server of res.servers) server?.close();
     if (res.onShutdown) {
       try {
@@ -13723,16 +13864,16 @@ function getSurfaceDefaultPorts(surface) {
   return { http: SURFACE_DEFAULT_PORTS[surface].http };
 }
 function isPortFree(host, port) {
-  return new Promise((resolve16) => {
+  return new Promise((resolve17) => {
     const srv = net2.createServer();
-    srv.once("error", () => resolve16(false));
+    srv.once("error", () => resolve17(false));
     srv.once("listening", () => {
-      srv.close(() => resolve16(true));
+      srv.close(() => resolve17(true));
     });
     try {
       srv.listen(port, host);
     } catch {
-      resolve16(false);
+      resolve17(false);
     }
   });
 }
@@ -13888,7 +14029,7 @@ async function startStaticServe(opts, deps2 = {}) {
   return { server, port: opts.httpPort };
 }
 function runPnpmBuild(cwd, workspace, timeoutMs) {
-  return new Promise((resolve16, reject) => {
+  return new Promise((resolve17, reject) => {
     const child = spawn2("pnpm", ["--filter", workspace, "build"], {
       cwd,
       shell: process.platform === "win32",
@@ -13906,7 +14047,7 @@ function runPnpmBuild(cwd, workspace, timeoutMs) {
     });
     child.once("close", (code) => {
       clearTimeout(timer);
-      if (code === 0) resolve16();
+      if (code === 0) resolve17();
       else reject(new Error(`pnpm build exited with code ${String(code)}`));
     });
   });
@@ -13970,27 +14111,41 @@ function formatExternalAccessUrls(opts) {
 }
 
 // src/server/embedded-lifecycle.ts
-function registerWebuiInstance(p, deps2 = {}) {
+async function registerWebuiInstance(p, deps2 = {}) {
   const register = deps2.registerFn ?? registerInstance;
-  void register(
-    {
-      pid: p.pid,
-      surface: p.surface,
-      httpPort: p.httpPort,
-      host: p.host,
-      projectRoot: p.projectRoot,
-      projectName: path16.basename(p.projectRoot) || p.projectRoot,
-      startedAt: p.startedAt,
-      url: buildWebUIAccessUrl({
+  try {
+    await register(
+      {
+        pid: p.pid,
+        surface: p.surface,
+        httpPort: p.httpPort,
         host: p.host,
-        port: p.httpPort,
-        publicUrl: p.publicUrl
-      }),
-      ...p.authToken ? { authToken: p.authToken } : {}
-    },
-    p.registryBaseDir
-  ).catch(() => {
-  });
+        projectRoot: p.projectRoot,
+        projectName: path16.basename(p.projectRoot) || p.projectRoot,
+        startedAt: p.startedAt,
+        url: buildWebUIAccessUrl({
+          host: p.host,
+          port: p.httpPort,
+          publicUrl: p.publicUrl
+        }),
+        ...p.authToken ? { authToken: p.authToken } : {},
+        ...p.role ? { role: p.role } : {},
+        ...p.sessionId ? { sessionId: p.sessionId } : {},
+        ...p.parentPid !== void 0 ? { parentPid: p.parentPid } : {},
+        ...p.parentShellId ? { parentShellId: p.parentShellId } : {},
+        ...p.runtimeId ? { runtimeId: p.runtimeId } : {},
+        ...p.attachable !== void 0 ? { attachable: p.attachable } : {},
+        ...p.authToken ? { auth: { scheme: "registry-token", tokenPresent: true } } : {},
+        ...p.lastReadyAt ? { lastReadyAt: p.lastReadyAt } : {},
+        ...p.protocolVersion !== void 0 ? { protocolVersion: p.protocolVersion } : {},
+        ...p.capabilities ? { capabilities: p.capabilities } : {}
+      },
+      p.registryBaseDir
+    );
+    return true;
+  } catch {
+    return false;
+  }
 }
 function announceWebuiReady(p) {
   const log = p.log ?? ((m) => console.log(m));
@@ -14028,10 +14183,10 @@ async function runBounded(work, timeoutMs, label, debug) {
       Promise.resolve().then(() => work()).catch((err) => {
         debug(`[webui-server] ${label} failed: ${err}`);
       }),
-      new Promise((resolve16) => {
+      new Promise((resolve17) => {
         timer = setTimeout(() => {
           debug(`[webui-server] ${label} timed out after ${timeoutMs}ms`);
-          resolve16();
+          resolve17();
         }, timeoutMs);
         timer.unref?.();
       })
@@ -14064,8 +14219,8 @@ function createWebuiShutdown(res) {
       const unregistered = unregister(res.pid, res.registryBaseDir).catch(
         (err) => debug(`[webui-server] unregister failed: ${err}`)
       );
-      await new Promise((resolve16) => {
-        res.wss.close(() => resolve16());
+      await new Promise((resolve17) => {
+        res.wss.close(() => resolve17());
       });
       await unregistered;
       log("[WebUI] Server stopped");
@@ -14874,6 +15029,10 @@ import {
   recoverStaleTaskAssignments as recoverStaleTaskAssignments2,
   resolveGateEnforcement
 } from "@wrongstack/kanban";
+function resolveProjectRoot(deps2) {
+  const root = deps2.projectRoot;
+  return typeof root === "function" ? root() : root;
+}
 var DEFAULT_INTERVAL_MS = 1e4;
 var MIN_INTERVAL_MS = 2e3;
 var DEFAULT_AGENT_COOLDOWN_MS = 5 * 6e4;
@@ -14938,14 +15097,14 @@ function createKanbanSupervisor(deps2) {
       publish(snapshot2);
       return snapshot2;
     }
-    const reconciled = await reconcileKanbanBoard2(deps2.projectRoot, board.id);
+    const reconciled = await reconcileKanbanBoard2(resolveProjectRoot(deps2), board.id);
     const gateSwept = await sweepGateParkedTasks(deps2, reconciled?.board ?? board);
-    let health = await getKanbanQueueHealth2(deps2.projectRoot, { boardId: board.id });
-    const recovered = health.staleAssignments.count ? await recoverStaleTaskAssignments2(deps2.projectRoot, board.id, {
+    let health = await getKanbanQueueHealth2(resolveProjectRoot(deps2), { boardId: board.id });
+    const recovered = health.staleAssignments.count ? await recoverStaleTaskAssignments2(resolveProjectRoot(deps2), board.id, {
       mode: config.recoveryMode ?? "auto",
       reason: "Kanban supervisor found an expired worker lease."
     }) : null;
-    if (recovered) health = await getKanbanQueueHealth2(deps2.projectRoot, { boardId: board.id });
+    if (recovered) health = await getKanbanQueueHealth2(resolveProjectRoot(deps2), { boardId: board.id });
     const anomalyCount = countAnomalies(health);
     const snapshot = {
       boardId: board.id,
@@ -14964,7 +15123,7 @@ function createKanbanSupervisor(deps2) {
       await publishKanbanBoard(
         deps2.broadcast,
         changedBoard,
-        () => listBoards4(deps2.projectRoot)
+        () => listBoards4(resolveProjectRoot(deps2))
       );
     }
     if (config.mode === "agentic" && anomalyCount > 0) {
@@ -15002,11 +15161,11 @@ function createKanbanSupervisor(deps2) {
         // tool-runtime boundary gate (`evaluateToolKanbanBoundary`) can resolve
         // the live board policy instead of failing open. Whole-board agentic
         // runs have no taskId, so only boardId is propagated.
-        context: { kanban: { boardId: board.id, projectRoot: deps2.projectRoot } },
+        context: { kanban: { boardId: board.id, projectRoot: resolveProjectRoot(deps2) } },
         onDone: async (result) => {
           clearTimeout(watchdog);
           agentRunning.delete(board.id);
-          if (await getBoard3(deps2.projectRoot, board.id) === null) return;
+          if (await getBoard3(resolveProjectRoot(deps2), board.id) === null) return;
           const current3 = snapshots.get(board.id) ?? snapshot;
           publish({
             ...current3,
@@ -15030,7 +15189,7 @@ function createKanbanSupervisor(deps2) {
   const auditNow = async (boardId) => {
     let boards;
     if (boardId) {
-      const board = await getBoard3(deps2.projectRoot, boardId);
+      const board = await getBoard3(resolveProjectRoot(deps2), boardId);
       if (board === null) {
         forgetBoard(boardId);
         boards = [];
@@ -15038,9 +15197,9 @@ function createKanbanSupervisor(deps2) {
         boards = [board];
       }
     } else {
-      const summaries = await listBoards4(deps2.projectRoot);
+      const summaries = await listBoards4(resolveProjectRoot(deps2));
       pruneAbsentBoards(new Set(summaries.map((summary) => summary.id)));
-      boards = (await Promise.all(summaries.map((summary) => getBoard3(deps2.projectRoot, summary.id)))).filter((board) => Boolean(board));
+      boards = (await Promise.all(summaries.map((summary) => getBoard3(resolveProjectRoot(deps2), summary.id)))).filter((board) => Boolean(board));
     }
     const results = [];
     for (const board of boards) results.push(await auditBoard(board));
@@ -15075,11 +15234,11 @@ function createKanbanSupervisor(deps2) {
     if (disposed) return;
     try {
       const now = Date.now();
-      const summaries = await listBoards4(deps2.projectRoot);
+      const summaries = await listBoards4(resolveProjectRoot(deps2));
       pruneAbsentBoards(new Set(summaries.map((summary) => summary.id)));
       for (const summary of summaries) {
         if ((nextDue.get(summary.id) ?? 0) > now) continue;
-        const board = await getBoard3(deps2.projectRoot, summary.id);
+        const board = await getBoard3(resolveProjectRoot(deps2), summary.id);
         if (board) await auditBoard(board);
       }
     } catch (error2) {
@@ -15122,7 +15281,7 @@ async function sweepGateParkedTasks(deps2, board) {
   let lastBoard;
   for (const task of parked) {
     try {
-      const finalized = await finalizeTaskCompletion(deps2.projectRoot, board.id, task.id, {
+      const finalized = await finalizeTaskCompletion(resolveProjectRoot(deps2), board.id, task.id, {
         eventContext: { actor: "kanban-supervisor" }
       });
       if (finalized) lastBoard = finalized.board;
@@ -17912,6 +18071,8 @@ function labelForEvent(e) {
       const count = e.messagesOmitted ?? e.messages.length;
       return `Messages replaced (${e.messagesOmitted ? "~" : ""}${count} msgs)`;
     }
+    case "messages_dropped":
+      return `Oldest ${e.count} message${e.count === 1 ? "" : "s"} evicted`;
     case "message_truncated":
       return `Message truncated: ${e.before} \u2192 ${e.after}`;
     case "file_event":
@@ -17999,6 +18160,8 @@ function detailForEvent(e) {
       return `at index ${e.index}`;
     case "messages_replaced":
       return `${e.messagesOmitted ?? e.messages.length} total`;
+    case "messages_dropped":
+      return `dropped ${e.count} from the front`;
     case "message_truncated":
       return `truncated to ${e.after} tokens`;
     case "mode_changed":
@@ -18216,7 +18379,7 @@ function createSessionHandlers(ctx) {
     const current2 = ctx.getSession();
     if (current2 !== next) {
       try {
-        ctx.abortActiveRun?.();
+        ctx.abortActiveRun?.(current2.id);
       } catch {
       }
       await finalizeSession(current2);
@@ -18803,16 +18966,17 @@ function createEmbeddedConversationRoutes(ctx) {
     getAgent: () => ctx.agent,
     getSessionId: () => ctx.agent.ctx.session?.id ?? "",
     runControl: {
-      begin: (ws) => {
-        if (ctx.abortControllers.has(ws)) return void 0;
+      begin: (_ws, sessionId) => {
+        if (ctx.abortControllers.has(sessionId)) return void 0;
         const controller = new AbortController();
-        ctx.abortControllers.set(ws, controller);
+        ctx.abortControllers.set(sessionId, controller);
         return controller;
       },
-      end: (ws, controller) => {
-        if (ctx.abortControllers.get(ws) === controller) ctx.abortControllers.delete(ws);
+      end: (_ws, sessionId, controller) => {
+        if (ctx.abortControllers.get(sessionId) === controller)
+          ctx.abortControllers.delete(sessionId);
       },
-      abort: (ws) => ctx.abortControllers.get(ws)?.abort()
+      abort: (_ws, sessionId) => ctx.abortControllers.get(sessionId)?.abort()
     },
     pendingConfirms: ctx.pendingConfirms,
     send: ctx.send,
@@ -20234,9 +20398,13 @@ function createEmbeddedMessageRouter(deps2) {
     // stream from the previous session would otherwise keep running in the
     // background after session.new/resume. The run's own end() cleanup
     // removes controllers from the map when it unwinds.
-    abortActiveRun: () => {
-      for (const controller of deps2.conversationCtx.abortControllers.values()) {
-        controller.abort();
+    abortActiveRun: (sessionId) => {
+      if (sessionId) {
+        deps2.conversationCtx.abortControllers.get(sessionId)?.abort();
+      } else {
+        for (const controller of [...deps2.conversationCtx.abortControllers.values()]) {
+          controller.abort();
+        }
       }
     },
     isRunActive: () => deps2.conversationCtx.abortControllers.size > 0
@@ -20458,8 +20626,8 @@ function createConfigWriteLock() {
     acquire() {
       const prev = lock;
       let release = () => void 0;
-      lock = new Promise((resolve16) => {
-        release = resolve16;
+      lock = new Promise((resolve17) => {
+        release = resolve17;
       });
       return { prev, release };
     }
@@ -21414,7 +21582,6 @@ function registerSetupEventsClientStatusWriter(deps2) {
 }
 
 // src/server/setup-events-fleet-broadcaster.ts
-import { watch as fsWatch } from "node:fs";
 import * as path25 from "node:path";
 function registerSetupEventsFleetBroadcaster(deps2) {
   const { globalConfigPath, wpaths, context, clients, broadcast: broadcast2, onFleetBroadcaster, isDisposed } = deps2;
@@ -21423,8 +21590,8 @@ function registerSetupEventsFleetBroadcaster(deps2) {
   const disposers = [];
   const broadcastSessions = async () => {
     try {
-      const { SessionRegistry } = await import("@wrongstack/core/storage");
-      const registry = new SessionRegistry(globalRoot);
+      const { getSessionRegistry: getSessionRegistry3 } = await import("@wrongstack/core/storage");
+      const registry = getSessionRegistry3(globalRoot);
       const sessions = await registry.list();
       const ownEntry = sessions.find((s) => s.pid === process.pid);
       const mySlug = ownEntry?.projectSlug ?? wpaths?.projectSlug;
@@ -21471,7 +21638,7 @@ function registerSetupEventsFleetBroadcaster(deps2) {
     }
   };
   onFleetBroadcaster?.(broadcastSessions);
-  let regWatchLive = false;
+  let subscriptionLive = false;
   let statusTimer;
   const scheduleStatusPoll = () => {
     if (isDisposed()) return;
@@ -21480,35 +21647,31 @@ function registerSetupEventsFleetBroadcaster(deps2) {
         void broadcastSessions();
         scheduleStatusPoll();
       },
-      regWatchLive ? 3e4 : 5e3
+      subscriptionLive ? 3e4 : 5e3
     );
     if (statusTimer.unref) statusTimer.unref();
   };
   disposers.push(() => {
     if (statusTimer) clearTimeout(statusTimer);
   });
-  let regDebounce;
-  try {
-    const regWatcher = fsWatch(globalRoot, { persistent: false }, (_event, filename) => {
-      const name2 = filename ? String(filename) : "";
-      if (!name2.startsWith("session-registry.json") || name2.endsWith(".lock")) return;
-      if (regDebounce) clearTimeout(regDebounce);
-      regDebounce = setTimeout(() => void broadcastSessions(), 150);
-    });
-    regWatcher.on("error", () => {
-      regWatchLive = false;
-      try {
-        regWatcher.close();
-      } catch {
-      }
-    });
-    regWatchLive = true;
-    disposers.push(() => {
-      if (regDebounce) clearTimeout(regDebounce);
-      regWatcher.close();
-    });
-  } catch {
-  }
+  let eventDebounce;
+  let unsubscribe;
+  void import("@wrongstack/core/storage").then(async ({ getSessionRegistry: getSessionRegistry3 }) => {
+    const registry = getSessionRegistry3(globalRoot);
+    const projectSlug2 = wpaths?.projectSlug;
+    if (!projectSlug2 || isDisposed()) return;
+    unsubscribe = await registry.subscribeProject(projectSlug2, context.projectRoot, () => {
+      if (eventDebounce) clearTimeout(eventDebounce);
+      eventDebounce = setTimeout(() => void broadcastSessions(), 25);
+    });
+    subscriptionLive = true;
+  }).catch(() => {
+    subscriptionLive = false;
+  });
+  disposers.push(() => {
+    if (eventDebounce) clearTimeout(eventDebounce);
+    void unsubscribe?.();
+  });
   scheduleStatusPoll();
   void broadcastSessions();
   return () => {
@@ -21621,7 +21784,7 @@ function createSetupEventSessionHelpers(context, sessionBridge) {
 }
 
 // src/server/setup-events-status-watcher.ts
-import { watch as fsWatch2 } from "node:fs";
+import { watch as fsWatch } from "node:fs";
 import * as fs20 from "node:fs/promises";
 import * as path27 from "node:path";
 
@@ -21711,7 +21874,7 @@ function registerSetupEventsStatusWatcher(deps2) {
     try {
       await fs20.mkdir(projectsDir, { recursive: true });
       if (isDisposed()) return;
-      watcher = fsWatch2(
+      watcher = fsWatch(
         projectsDir,
         { persistent: true, recursive: true },
         async (eventType, filename) => {
@@ -22873,7 +23036,6 @@ import {
   mailboxSessionTag,
   ObservableBrainArbiter as ObservableBrainArbiterCtor
 } from "@wrongstack/core/coordination";
-import { DEFAULT_TOOLS_CONFIG } from "@wrongstack/core/types";
 import { installDesignStudioMiddleware } from "@wrongstack/core/design";
 import {
   AutoCompactionMiddleware as AutoCompactionMiddlewareCtor,
@@ -22885,6 +23047,7 @@ import {
 import { TOKENS as TOKENS2 } from "@wrongstack/core/kernel";
 import { SessionMemoryConsolidator } from "@wrongstack/core/storage";
 import {
+  DEFAULT_TOOLS_CONFIG,
   resolveContextWindowPolicy as resolveContextWindowPolicy2
 } from "@wrongstack/core/types";
 import {
@@ -23045,7 +23208,7 @@ function findWorkspaceCliEntry(projectRoot) {
   return null;
 }
 function sleep(ms) {
-  return new Promise((resolve16) => setTimeout(resolve16, ms));
+  return new Promise((resolve17) => setTimeout(resolve17, ms));
 }
 
 // src/server/terminal-ws-handler.ts
@@ -23288,7 +23451,7 @@ function clampDim(value, fallback) {
 }
 
 // src/server/worktree-ws-handler.ts
-import { join as join14, resolve as resolve13, sep as sep5 } from "node:path";
+import { join as join14, resolve as resolve14, sep as sep5 } from "node:path";
 import { toErrorMessage as toErrorMessage9 } from "@wrongstack/core/utils";
 import { WorktreeManager as WorktreeManager3 } from "@wrongstack/core/worktree";
 import { cleanupStaleSddWorktrees as cleanupStaleSddWorktrees2 } from "@wrongstack/sdd";
@@ -23373,11 +23536,11 @@ var WorktreeWebSocketHandler = class {
   // ── orphan management ─────────────────────────────────────────────────────
   /** Absolute managed-worktrees root for this project. */
   worktreesRoot() {
-    return resolve13(join14(this.management.projectRoot, ".wrongstack", "worktrees"));
+    return resolve14(join14(this.management.projectRoot, ".wrongstack", "worktrees"));
   }
   /** True iff `dir` resolves strictly inside the managed worktrees root. */
   underRoot(dir) {
-    const abs = resolve13(dir);
+    const abs = resolve14(dir);
     const root = this.worktreesRoot();
     return abs !== root && abs.startsWith(root + sep5);
   }
@@ -23601,7 +23764,7 @@ var WorktreeWebSocketHandler = class {
     }
     const base = baseBranch && MANAGED_BRANCH_RE.test(baseBranch) ? baseBranch : void 0;
     const wt = new WorktreeManager3({ projectRoot: this.management.projectRoot });
-    const summary = await wt.diffSummary(resolve13(dir), base);
+    const summary = await wt.diffSummary(resolve14(dir), base);
     this.broadcast({ type: "worktree.diff_result", payload: { dir, summary } });
   }
   // ── internals ───────────────────────────────────────────────────────────
@@ -23766,6 +23929,11 @@ async function createAgentServices(input) {
           taskAware: config.Sage?.inject?.taskAware,
           minScore: config.Sage?.inject?.minScore,
           minImportance: config.Sage?.inject?.minImportance,
+          // Forward the explicit relation floor so an operator-configured
+          // `Sage.inject.relationFloor` is honored in WebUI sessions. Without
+          // this we silently fall back to MIN_RELATION_STRENGTH (0.85), which
+          // is the CLI default but masks operator overrides.
+          relationFloor: config.Sage?.inject?.relationFloor,
           repeatCooldownMs: config.Sage?.inject?.repeatCooldownMs,
           verifyOnMutation: config.Sage?.hygiene?.autoOnFileChange,
           triggers: config.Sage?.inject?.triggers,
@@ -23787,6 +23955,10 @@ async function createAgentServices(input) {
           maxMemories: config.Sage?.inject?.maxTurnMemories,
           maxChars: config.Sage?.inject?.maxCharsPerTurn,
           minScore: config.Sage?.inject?.minScore,
+          // CLI parity: honor `Sage.retrieval.metadataWeight` so the same config
+          // value drives both runtimes instead of silently falling back to the
+          // 0.3 default. The undefined case keeps the middleware's own default.
+          metadataWeight: config.Sage?.retrieval?.metadataWeight,
           getSessionId: getSageSessionId,
           tracker: sageInjectionTracker
         })
@@ -23811,25 +23983,29 @@ async function createAgentServices(input) {
     strategy: config.context?.strategy,
     preserveK: config.context?.preserveK ?? 10,
     eliseThreshold: config.context?.eliseThreshold ?? 2e3,
+    // Match the CLI/TUI runtime: keep corrections, errors and decisions
+    // verbatim while collapsing routine assistant chatter/tool protocol.
+    // Without this WebUI's hybrid strategy builds an ever-growing lossless
+    // digest and eventually relies on blunt emergency head/tail trimming.
+    smart: true,
     summarizerModel: config.context?.summarizerModel,
     llmSelector: config.context?.llmSelector
   });
   const initialContextPolicy = resolveContextWindowPolicy2(config.context);
   let autoCompactor;
   if (config.context?.autoCompact !== false) {
-    let effectiveMaxContext = config.context?.effectiveMaxContext ?? 0;
-    if (!effectiveMaxContext) {
-      try {
-        const m = await resolveProviderModelMetadata(
-          modelsRegistry,
-          config.provider,
-          context.model,
-          config.providers?.[config.provider]
-        );
-        effectiveMaxContext = m?.capabilities?.maxContext ?? 0;
-      } catch {
-      }
+    let effectiveMaxContext = 0;
+    try {
+      const m = await resolveProviderModelMetadata(
+        modelsRegistry,
+        config.provider,
+        context.model,
+        config.providers?.[config.provider]
+      );
+      effectiveMaxContext = m?.capabilities?.maxContext ?? 0;
+    } catch {
     }
+    if (!effectiveMaxContext) effectiveMaxContext = config.context?.effectiveMaxContext ?? 0;
     if (!effectiveMaxContext) effectiveMaxContext = provider.capabilities.maxContext;
     autoCompactor = new AutoCompactionMiddlewareCtor(
       compactor,
@@ -24451,16 +24627,24 @@ function createMessageDispatcher(opts) {
     getAgent: () => deps2.agent,
     getSessionId: () => state.getSession().id,
     runControl: {
-      begin: () => {
+      begin: (_ws, sessionId) => {
         if (runLock.get()) return void 0;
         const controller = new AbortController();
         runLock.set(controller);
+        runLock.setSession(sessionId);
         return controller;
       },
-      end: (_ws, controller) => {
-        if (runLock.get() === controller) runLock.set(null);
+      end: (_ws, _sessionId, controller) => {
+        if (runLock.get() === controller) {
+          runLock.set(null);
+          runLock.setSession(null);
+        }
       },
-      abort: () => runLock.get()?.abort()
+      abort: (_ws, sessionId) => {
+        if (runLock.getSession() === sessionId || !runLock.getSession()) {
+          runLock.get()?.abort();
+        }
+      }
     },
     pendingConfirms,
     send,
@@ -24482,10 +24666,20 @@ function createMessageDispatcher(opts) {
   const goalSnapshotRoutes = {
     getSnapshot: () => handleGoalGet(state.getProjectRoot(), (message) => broadcast(state.getClients(), message))
   };
+  const kanbanSupervisor = createKanbanSupervisor({
+    projectRoot: () => state.getProjectRoot(),
+    broadcast: (message) => broadcast(state.getClients(), message),
+    log: (message) => deps2.logger.warn?.(`[KanbanSupervisor] ${message}`)
+  });
+  if (opts.onDispose) {
+    const dispose = () => kanbanSupervisor.dispose();
+    opts.onDispose(dispose);
+  }
   const kanbanContext = () => ({
     projectRoot: state.getProjectRoot(),
     context: deps2.context,
-    broadcast: (message) => broadcast(state.getClients(), message)
+    broadcast: (message) => broadcast(state.getClients(), message),
+    supervisor: kanbanSupervisor
   });
   const kanbanHostRoutes = {
     meta: async (ws) => {
@@ -25001,6 +25195,14 @@ async function createStandaloneSessionIdentityLifecycle(opts) {
     transition = transition.then(async () => {
       if (stopped) return;
       if (pendingClaim?.sessionId === sessionId) {
+        await pendingClaim.claim.activate({
+          sessionId,
+          ...target,
+          clientType: "webui",
+          pid: process.pid,
+          startedAt: (/* @__PURE__ */ new Date()).toISOString(),
+          agents: statusTracker.getAgents()
+        });
         pendingClaim = void 0;
       } else {
         await register(sessionId, true, target);
@@ -25024,14 +25226,35 @@ async function createStandaloneSessionIdentityLifecycle(opts) {
     }
     if (sessionId === activeSessionId) return async () => {
     };
-    const previousSessionId = activeSessionId;
-    const previousTarget = activeTarget;
     const token = Symbol(sessionId);
-    await register(sessionId, true, target);
-    pendingClaim = { sessionId, previousSessionId, token };
+    if ("reserveResume" in registry && typeof registry.reserveResume === "function") {
+      const reservation = await registry.reserveResume({
+        sessionId,
+        projectSlug: target.projectSlug,
+        projectRoot: target.projectRoot
+      });
+      pendingClaim = { sessionId, token, claim: reservation, target };
+    } else {
+      await register(sessionId, true, target);
+      pendingClaim = {
+        sessionId,
+        token,
+        target,
+        claim: {
+          reservation: {
+            reservationId: "legacy",
+            targetSessionId: sessionId,
+            requesterInstanceId: "legacy",
+            expiresAt: Number.MAX_SAFE_INTEGER
+          },
+          activate: async () => void 0,
+          cancel: async () => register(activeSessionId, true, activeTarget)
+        }
+      };
+    }
     return async () => {
       if (pendingClaim?.token !== token) return;
-      await register(previousSessionId, true, previousTarget);
+      await pendingClaim.claim.cancel();
       pendingClaim = void 0;
     };
   };
@@ -25958,10 +26181,11 @@ function startHttpServer(opts) {
   return httpServer;
 }
 function registerShutdown(deps2) {
-  registerShutdownHandlers({
+  return registerShutdownHandlers({
     flushSession: deps2.flushSession,
     clients: deps2.clients,
     servers: deps2.servers,
+    onPreShutdown: deps2.onPreShutdown,
     onShutdown: deps2.onShutdown
   });
 }
@@ -26231,7 +26455,7 @@ async function startWebUI(opts = {}) {
         if (events.listenerCount("tool.confirm_needed") === 0) {
           throw new Error("No permission confirmation surface is connected");
         }
-        const decision = await new Promise((resolve16) => {
+        const decision = await new Promise((resolve17) => {
           events.emit("tool.confirm_needed", {
             sessionId: context.session.id,
             tool: confirmTool,
@@ -26241,7 +26465,7 @@ async function startWebUI(opts = {}) {
             decisionSource: pending.decisionSource,
             riskTier: pending.riskTier,
             boundaryReason: pending.boundaryReason,
-            resolve: resolve16
+            resolve: resolve17
           });
         });
         const rule = { tool: "language_package", pattern: pending.suggestedPattern };
@@ -26276,10 +26500,15 @@ async function startWebUI(opts = {}) {
     );
   }
   let _runLock = null;
+  let _runLockSession = null;
   const runLockControl = {
     get: () => _runLock,
     set: (ctrl) => {
       _runLock = ctrl;
+    },
+    getSession: () => _runLockSession,
+    setSession: (id) => {
+      _runLockSession = id;
     }
   };
   const pendingConfirms = /* @__PURE__ */ new Map();
@@ -26404,6 +26633,7 @@ async function startWebUI(opts = {}) {
       if (ctrl) {
         ctrl.abort();
         runLockControl.set(null);
+        runLockControl.setSession(null);
       }
     },
     isRunActive: () => runLockControl.get() !== null,
@@ -26553,6 +26783,7 @@ async function startWebUI(opts = {}) {
     })
   });
   const routes = buildRoutes(state, deps2, cb);
+  let kanbanSupervisorDispose = null;
   const handleMessage = createMessageDispatcher({
     state,
     deps: deps2,
@@ -26560,7 +26791,10 @@ async function startWebUI(opts = {}) {
     promptsCtx,
     codebaseIndexing,
     runLock: runLockControl,
-    pendingConfirms
+    pendingConfirms,
+    onDispose: (dispose) => {
+      kanbanSupervisorDispose = dispose;
+    }
   });
   const mailbox = getSharedProjectMailbox5(
     resolveProjectDir4(context.projectRoot, wstackGlobalRoot4()),
@@ -26594,7 +26828,14 @@ projectRoot: ${ev.projectRoot ?? "?"}`,
         priority: "high",
         senderSessionId: session.id
       }).catch((err) => {
-        console.warn(`[WebUI] security-rejection mailbox note failed: ${String(err)}`);
+        console.warn(
+          JSON.stringify({
+            level: "warn",
+            event: "webui.security_rejection_mailbox_note_failed",
+            message: String(err),
+            timestamp: (/* @__PURE__ */ new Date()).toISOString()
+          })
+        );
       });
     },
     goalHandler,
@@ -26608,7 +26849,9 @@ projectRoot: ${ev.projectRoot ?? "?"}`,
   });
   wssPrimary.on("connection", handleConnection);
   if (wssSecondary) wssSecondary.on("connection", handleConnection);
-  registerShutdown({
+  let unregisterShutdown = () => {
+  };
+  unregisterShutdown = registerShutdown({
     flushSession: async () => {
       await session.append({
         type: "session_end",
@@ -26624,7 +26867,12 @@ projectRoot: ${ev.projectRoot ?? "?"}`,
       wssPrimary,
       ...wssSecondary ? [wssSecondary] : []
     ],
+    onPreShutdown: () => {
+      kanbanSupervisorDispose?.();
+      kanbanSupervisorDispose = null;
+    },
     onShutdown: async () => {
+      unregisterShutdown();
       await todosCheckpoint.detach();
       await stopHeapWatchdog();
       credentialWatcherClose?.();
@@ -26883,6 +27131,7 @@ export {
   isPortFree,
   isRegisteredMessageType,
   isWildcardBind,
+  joinSessionRegistryWithWebUIInstances,
   listInstances,
   loadManifest,
   loadSavedProviders,