@wrongstack/webui-server 0.303.0 → 0.305.1

package/dist/index.js

@@ -28,7 +28,14 @@ function isRecord(value) {
 var AUTONOMY_VALUES = /* @__PURE__ */ new Set(["off", "suggest", "auto", "eternal", "eternal-parallel"]);
 var CONTEXT_STRATEGY_VALUES = /* @__PURE__ */ new Set(["hybrid", "intelligent", "selective"]);
 var CONTEXT_MODE_VALUES = /* @__PURE__ */ new Set(["balanced", "frugal", "deep"]);
-var TOKEN_SAVING_TIER_VALUES = /* @__PURE__ */ new Set(["off", "minimal", "light", "medium", "aggressive"]);
+var TOKEN_SAVING_TIER_VALUES = /* @__PURE__ */ new Set([
+  "auto",
+  "off",
+  "minimal",
+  "light",
+  "medium",
+  "aggressive"
+]);
 var ENHANCE_LANGUAGE_VALUES = /* @__PURE__ */ new Set(["original", "english"]);
 var LOG_LEVEL_VALUES = /* @__PURE__ */ new Set(["debug", "info", "warn", "error"]);
 var AUDIT_LEVEL_VALUES = /* @__PURE__ */ new Set(["minimal", "standard", "full"]);
@@ -285,12 +292,8 @@ function validatePreferenceValue(key, value) {
     if (!Array.isArray(value)) return `prefs.update payload.${key} must be an array`;
     for (let i = 0; i < value.length; i++) {
       const item = value[i];
-      if (!isRecord(item))
-        return `prefs.update payload.${key}[${i}] must be an object`;
-      const error2 = arrayValidator(
-        item,
-        `prefs.update payload.${key}[${i}]`
-      );
+      if (!isRecord(item)) return `prefs.update payload.${key}[${i}] must be an object`;
+      const error2 = arrayValidator(item, `prefs.update payload.${key}[${i}]`);
       if (error2) return error2;
     }
     return null;
@@ -1099,11 +1102,11 @@ import { randomBytes } from "node:crypto";
 import { scrubErrorDetail } from "@wrongstack/core/security";
 import { WebSocket } from "ws";
 var WEBUI_WS_MAX_BUFFERED_BYTES = 32 * 1024 * 1024;
-function sendSerialized(ws, data) {
+function sendSerialized(ws, data, frameBytes) {
   if (ws.readyState !== WebSocket.OPEN) return false;
   const buffered = Number.isFinite(ws.bufferedAmount) ? ws.bufferedAmount : 0;
-  const frameBytes = Buffer.byteLength(data, "utf8");
-  if (buffered + frameBytes > WEBUI_WS_MAX_BUFFERED_BYTES) {
+  const bytes = frameBytes ?? Buffer.byteLength(data, "utf8");
+  if (buffered + bytes > WEBUI_WS_MAX_BUFFERED_BYTES) {
     try {
       ws.terminate();
     } catch {
@@ -1126,8 +1129,9 @@ function send(ws, msg) {
 }
 function broadcast(clients, msg) {
   const data = JSON.stringify(msg);
+  const frameBytes = Buffer.byteLength(data, "utf8");
   for (const [ws] of clients) {
-    sendSerialized(ws, data);
+    sendSerialized(ws, data, frameBytes);
   }
 }
 function sendResult2(ws, success, message) {
@@ -2202,6 +2206,7 @@ var CollaborationWebSocketHandler = class {
         this.broadcast(sessionId, this.stateMessage(sessionId));
       }
     }, 2e3);
+    this.broadcastInterval.unref?.();
   }
   stopBroadcast() {
     if (this.broadcastInterval) {
@@ -7217,13 +7222,18 @@ var GoalWebSocketHandler = class {
           const { execFile: execFile2 } = await import("node:child_process");
           const result = await new Promise((resolve17) => {
             const npxCommand = process.platform === "win32" ? "npx.cmd" : "npx";
-            execFile2(npxCommand, ["tsc", "--noEmit"], { cwd, timeout: 6e4 }, (err, stdout, stderr) => {
-              if (err && err.code === "ENOENT") {
-                resolve17("[verify] tsc not found \u2014 skipping");
-                return;
+            execFile2(
+              npxCommand,
+              ["tsc", "--noEmit"],
+              { cwd, timeout: 6e4 },
+              (err, stdout, stderr) => {
+                if (err && err.code === "ENOENT") {
+                  resolve17("[verify] tsc not found \u2014 skipping");
+                  return;
+                }
+                resolve17(stdout + stderr);
               }
-              resolve17(stdout + stderr);
-            });
+            );
           });
           if (result.includes("[verify]") || result.trim().length === 0) {
             return { ok: true };
@@ -7525,6 +7535,7 @@ ${result_.finalText.slice(0, 2e3)}`
       if (progress) this.broadcast({ type: "goal.progress", payload: progress });
       this.broadcastState();
     }, 2e3);
+    this.broadcastInterval.unref?.();
   }
   stopBroadcast() {
     if (this.broadcastInterval) {
@@ -7649,8 +7660,9 @@ ${result_.finalText.slice(0, 2e3)}`
   }
   broadcast(msg) {
     const data = JSON.stringify(msg);
+    const frameBytes = Buffer.byteLength(data, "utf8");
     for (const client of this.clients) {
-      sendSerialized(client.ws, data);
+      sendSerialized(client.ws, data, frameBytes);
     }
   }
   send(client, msg) {
@@ -9561,7 +9573,19 @@ function isTrustedLoopbackOrigin(origin, hostHeader) {
     if (!host) return false;
     const hostUrl = new URL(`${url.protocol}//${host}`);
     if (!isLoopbackHostname(hostUrl.hostname)) return false;
-    return effectivePort(url) === effectivePort(hostUrl);
+    return normalizeHostname(url.hostname) === normalizeHostname(hostUrl.hostname) && effectivePort(url) === effectivePort(hostUrl);
+  } catch {
+    return false;
+  }
+}
+function originMatchesHost(origin, hostHeader) {
+  try {
+    const originUrl = new URL(origin);
+    if (originUrl.protocol !== "http:" && originUrl.protocol !== "https:") return false;
+    const host = (hostHeader ?? "").trim();
+    if (!host) return false;
+    const requestUrl = new URL(`${originUrl.protocol}//${host}`);
+    return normalizeHostname(originUrl.hostname) === normalizeHostname(requestUrl.hostname) && effectivePort(originUrl) === effectivePort(requestUrl);
   } catch {
     return false;
   }
@@ -9666,13 +9690,15 @@ function verifyClient(input) {
   try {
     const { hostname: originHostname } = new URL(origin);
     if (isLoopbackHostname(originHostname)) {
-      if (requireToken || !isLoopbackBind(wsHost)) return cookieTokenOk;
+      if (requireToken || !isLoopbackBind(wsHost)) {
+        return cookieTokenOk && (originMatchesHost(origin, hostHeader) || Boolean(allowCrossPortLoopbackCookie));
+      }
       if (!isTrustedLoopbackOrigin(origin, hostHeader)) {
         return Boolean(allowCrossPortLoopbackCookie) && cookieTokenOk;
       }
       return true;
     }
-    return cookieTokenOk || Boolean(allowBrowserUrlToken) && urlTokenOk && allowedHostname(originHostname, allowedHostnames);
+    return cookieTokenOk && originMatchesHost(origin, hostHeader) || Boolean(allowBrowserUrlToken) && urlTokenOk && allowedHostname(originHostname, allowedHostnames);
   } catch {
     return false;
   }
@@ -10637,7 +10663,8 @@ async function handleIntrospectionRoute(ctx, ws, message) {
   switch (message.type) {
     case "diag.get": {
       if (!sessionAllowed(ctx, ws, message)) return true;
-      const tools = ctx.agent.tools.list();
+      const registry = ctx.agent.tools;
+      const tools = registry.listForProvider?.() ?? registry.list();
       ctx.send(ws, {
         type: "diag.get",
         payload: {
@@ -10720,6 +10747,7 @@ async function handleIntrospectionRoute(ctx, ws, message) {
           description: tool.description ?? "",
           params: schema.properties ? Object.keys(schema.properties) : [],
           disabled: registry.isDisabled?.(tool.name) ?? false,
+          direct: registry.isExposedToProvider?.(tool.name) ?? true,
           mutating: !!tool.mutating,
           permission: tool.permission ?? "auto"
         };
@@ -11029,7 +11057,6 @@ async function handleKanbanHostRoute(ws, msg, handlers) {
 import { deserializeTaskGraph, serializeTaskGraph } from "@wrongstack/core/tasking";
 import {
   addCheckToTask,
-  addColumn,
   addGoalMetricToTask,
   addNoteToTask,
   addTask,
@@ -11044,7 +11071,10 @@ import {
   getKanbanOrchestrationSnapshot,
   getKanbanQueueHealth,
   getTaskChain,
+  hasKanbanQueueAnomalies,
+  kanbanQueueAnomalyCount,
   listBoards as listBoards2,
+  listBoardHistory,
   listReadyTasks,
   mergeTasks,
   moveTask,
@@ -11053,7 +11083,6 @@ import {
   recoverStaleTaskAssignments,
   releaseTaskClaim,
   removeBoard,
-  removeColumn,
   setTaskChain,
   splitTask,
   syncBoardFromTaskGraph,
@@ -11065,14 +11094,16 @@ import {
   updateTask as updateTask2
 } from "@wrongstack/kanban";
 
-// src/server/kanban-decomposition-routes.ts
+// src/server/kanban-contract-routes.ts
 import {
-  listBoards,
-  resolveDecompositionProposal,
-  updateTask,
-  verifyTaskCompletion
+  addContractEdge,
+  configureContractGraph,
+  evaluateTaskContractGraph,
+  getContractGraph,
+  removeContractEdge,
+  removeContractNode,
+  upsertContractNode
 } from "@wrongstack/kanban";
-import { recordKanbanVerificationEvidence as recordKanbanVerificationEvidence2 } from "@wrongstack/tools";
 
 // src/server/kanban-route-helpers.ts
 import { touchKanbanPresence } from "@wrongstack/kanban";
@@ -11124,7 +11155,150 @@ function findTask2(tasks, taskId) {
   return tasks.find((task) => task.id === taskId || task.id.startsWith(taskId));
 }
 
+// src/server/kanban-contract-routes.ts
+async function handleKanbanContractRoute(ws, type, payload, ctx) {
+  switch (type) {
+    case "kanban.contract.get":
+      await handleGet(ws, type, payload, ctx);
+      return true;
+    case "kanban.contract.configure":
+      await handleConfigure(ws, type, payload, ctx);
+      return true;
+    case "kanban.contract.node.upsert":
+      await handleNodeUpsert(ws, type, payload, ctx);
+      return true;
+    case "kanban.contract.node.remove":
+      await handleNodeRemove(ws, type, payload, ctx);
+      return true;
+    case "kanban.contract.edge.add":
+      await handleEdgeAdd(ws, type, payload, ctx);
+      return true;
+    case "kanban.contract.edge.remove":
+      await handleEdgeRemove(ws, type, payload, ctx);
+      return true;
+    default:
+      return false;
+  }
+}
+var str = (payload, key) => typeof payload?.[key] === "string" ? payload[key] : void 0;
+async function publishBoard(ctx, board) {
+  await publishKanbanBoard((message) => ctx.broadcast?.(message), board);
+}
+async function handleGet(ws, type, payload, ctx) {
+  const boardId = str(payload, "boardId");
+  if (!boardId) return fail(ws, type, "boardId required");
+  const found = await getContractGraph(ctx.projectRoot, boardId);
+  if (!found) return fail(ws, type, "Board not found");
+  const taskId = str(payload, "taskId");
+  const evaluated = taskId ? await evaluateTaskContractGraph(ctx.projectRoot, boardId, taskId) : null;
+  if (taskId && !evaluated) return fail(ws, type, "Task not found on this board");
+  ok(ws, type, {
+    boardId,
+    graph: found.graph,
+    ...evaluated ? { evaluation: evaluated.evaluation } : {}
+  });
+}
+async function handleConfigure(ws, type, payload, ctx) {
+  const boardId = str(payload, "boardId");
+  if (!boardId) return fail(ws, type, "boardId required");
+  const enforcement = str(payload, "enforcement") ?? "advisory";
+  const board = await configureContractGraph(ctx.projectRoot, boardId, enforcement);
+  if (!board) return fail(ws, type, "Board not found");
+  await publishBoard(ctx, board);
+  ok(ws, type, { boardId, graph: board.contractGraph ?? null });
+}
+async function handleNodeUpsert(ws, type, payload, ctx) {
+  const boardId = str(payload, "boardId");
+  const taskId = str(payload, "taskId");
+  const kind = str(payload, "kind");
+  const title = str(payload, "title");
+  if (!boardId || !taskId || !kind || !title) {
+    return fail(ws, type, "boardId, taskId, kind, and title required");
+  }
+  const state = str(payload, "state");
+  const waiverActor = str(payload, "waiverActor");
+  const waiverReason = str(payload, "waiverReason");
+  if (state === "waived" && (!waiverActor?.trim() || !waiverReason?.trim())) {
+    return fail(ws, type, "A waived contract node requires waiverActor and waiverReason");
+  }
+  try {
+    const result = await upsertContractNode(ctx.projectRoot, boardId, {
+      taskId,
+      kind,
+      title,
+      ...str(payload, "nodeId") !== void 0 ? { id: str(payload, "nodeId") } : {},
+      ...str(payload, "description") !== void 0 ? { description: str(payload, "description") } : {},
+      ...state !== void 0 ? { state } : {},
+      ...str(payload, "enforcement") !== void 0 ? { enforcement: str(payload, "enforcement") } : {},
+      ...str(payload, "checkId") !== void 0 ? { checkId: str(payload, "checkId") } : {},
+      ...str(payload, "metricId") !== void 0 ? { metricId: str(payload, "metricId") } : {},
+      ...state === "waived" ? {
+        waiver: {
+          actor: waiverActor,
+          reason: waiverReason,
+          at: (/* @__PURE__ */ new Date()).toISOString()
+        }
+      } : {},
+      ...str(payload, "createdBy") !== void 0 ? { createdBy: str(payload, "createdBy") } : { createdBy: "webui" }
+    });
+    if (!result) return fail(ws, type, "Board or task not found");
+    await publishBoard(ctx, result.board);
+    ok(ws, type, { boardId, node: result.node, graph: result.board.contractGraph ?? null });
+  } catch (err) {
+    fail(ws, type, err instanceof Error ? err.message : String(err));
+  }
+}
+async function handleNodeRemove(ws, type, payload, ctx) {
+  const boardId = str(payload, "boardId");
+  const nodeId = str(payload, "nodeId");
+  if (!boardId || !nodeId) return fail(ws, type, "boardId and nodeId required");
+  const board = await removeContractNode(ctx.projectRoot, boardId, nodeId);
+  if (!board) return fail(ws, type, "Contract node not found");
+  await publishBoard(ctx, board);
+  ok(ws, type, { boardId, graph: board.contractGraph ?? null });
+}
+async function handleEdgeAdd(ws, type, payload, ctx) {
+  const boardId = str(payload, "boardId");
+  const from = str(payload, "from");
+  const to = str(payload, "to");
+  const edgeType = str(payload, "edgeType");
+  if (!boardId || !from || !to || !edgeType) {
+    return fail(ws, type, "boardId, from, to, and edgeType required");
+  }
+  try {
+    const result = await addContractEdge(ctx.projectRoot, boardId, {
+      from,
+      to,
+      type: edgeType,
+      ...str(payload, "enforcement") !== void 0 ? { enforcement: str(payload, "enforcement") } : {},
+      ...str(payload, "rationale") !== void 0 ? { rationale: str(payload, "rationale") } : {},
+      createdBy: str(payload, "createdBy") ?? "webui"
+    });
+    if (!result) return fail(ws, type, "Board not found");
+    await publishBoard(ctx, result.board);
+    ok(ws, type, { boardId, edge: result.edge, graph: result.board.contractGraph ?? null });
+  } catch (err) {
+    fail(ws, type, err instanceof Error ? err.message : String(err));
+  }
+}
+async function handleEdgeRemove(ws, type, payload, ctx) {
+  const boardId = str(payload, "boardId");
+  const edgeId = str(payload, "edgeId");
+  if (!boardId || !edgeId) return fail(ws, type, "boardId and edgeId required");
+  const board = await removeContractEdge(ctx.projectRoot, boardId, edgeId);
+  if (!board) return fail(ws, type, "Contract edge not found");
+  await publishBoard(ctx, board);
+  ok(ws, type, { boardId, graph: board.contractGraph ?? null });
+}
+
 // src/server/kanban-decomposition-routes.ts
+import {
+  listBoards,
+  resolveDecompositionProposal,
+  updateTask,
+  verifyTaskCompletion
+} from "@wrongstack/kanban";
+import { recordKanbanVerificationEvidence as recordKanbanVerificationEvidence2 } from "@wrongstack/tools";
 async function handleKanbanDecompositionRoute(ws, type, payload, ctx) {
   switch (type) {
     case "kanban.decomposition.approve":
@@ -11373,8 +11547,12 @@ async function handleTaskActivityAdd(ws, type, payload, ctx) {
 // src/server/kanban-route-protocol.ts
 var KANBAN_CLIENT_MESSAGE_TYPES = [
   "kanban.capabilities",
-  "kanban.column.add",
-  "kanban.column.remove",
+  "kanban.contract.configure",
+  "kanban.contract.edge.add",
+  "kanban.contract.edge.remove",
+  "kanban.contract.get",
+  "kanban.contract.node.remove",
+  "kanban.contract.node.upsert",
   "kanban.create",
   "kanban.decomposition.approve",
   "kanban.decomposition.reject",
@@ -11425,6 +11603,7 @@ async function handleKanbanRoute(ws, msg, ctx) {
   const type = msg.type;
   try {
     if (await handleKanbanDecompositionRoute(ws, type, payload, ctx)) return true;
+    if (await handleKanbanContractRoute(ws, type, payload, ctx)) return true;
     if (await handleKanbanTaskRoute(ws, type, payload, ctx)) return true;
     switch (type) {
       case "kanban.list": {
@@ -11463,7 +11642,14 @@ async function handleKanbanRoute(ws, msg, ctx) {
           fail(ws, type, "boardId required");
           return true;
         }
-        ok(ws, type, await getKanbanQueueHealth(ctx.projectRoot, { boardId: hBoardId }));
+        ok(
+          ws,
+          type,
+          await getKanbanQueueHealth(ctx.projectRoot, {
+            boardId: hBoardId,
+            includeClassifications: false
+          })
+        );
         return true;
       }
       case "kanban.supervisor.status":
@@ -11493,16 +11679,16 @@ async function handleKanbanRoute(ws, msg, ctx) {
           reason: "On-demand standalone Kanban supervisor audit."
         }) : null;
         if (recovered) health = await getKanbanQueueHealth(ctx.projectRoot, { boardId });
-        const anomalyCount = health.staleAssignments.count + health.dependencyBlocked.count + health.failedRetryable.count + health.counts.failed + health.counts.blocked;
+        const anomalyCount = kanbanQueueAnomalyCount(health);
         ok(ws, type, {
           boardId,
-          status: board.supervisor?.enabled === false ? "disabled" : anomalyCount ? "attention" : "healthy",
+          status: board.supervisor?.enabled === false ? "disabled" : hasKanbanQueueAnomalies(health) ? "attention" : "healthy",
           mode: board.supervisor?.mode ?? "deterministic",
           lastAuditAt: (/* @__PURE__ */ new Date()).toISOString(),
           reconciledTaskIds: reconciled?.tasks.map((task) => task.id) ?? [],
           staleRecoveredTaskIds: recovered?.tasks.map((task) => task.id) ?? [],
           anomalyCount,
-          summary: `${health.counts.running} running \xB7 ${health.counts.ready} ready \xB7 ${health.counts.review} review \xB7 ${health.counts.blocked} blocked \xB7 ${health.counts.failed} failed`
+          summary: `${health.counts.running} running \xB7 ${health.counts.startable} ready \xB7 ${health.counts.review} review \xB7 ${health.counts.blocked} blocked \xB7 ${health.counts.failed} failed`
         });
         return true;
       }
@@ -11519,7 +11705,6 @@ async function handleKanbanRoute(ws, msg, ctx) {
             title,
             ...payload?.description ? { description: payload.description } : {},
             ...payload?.tags ? { tags: payload.tags } : {},
-            ...payload?.columns ? { columns: payload.columns } : {},
             ...has(payload, "lifecycle") ? { lifecycle: payload?.lifecycle } : {},
             ...has(payload, "boundary") ? { boundary: payload?.boundary } : {}
           })
@@ -11536,7 +11721,6 @@ async function handleKanbanRoute(ws, msg, ctx) {
           ...payload?.title ? { title: payload.title } : {},
           ...payload?.description ? { description: payload.description } : {},
           ...payload?.tags ? { tags: payload.tags } : {},
-          ...payload?.columns ? { columns: payload.columns } : {},
           ...has(payload, "lifecycle") ? {
             lifecycle: payload?.lifecycle ?? null
           } : {},
@@ -11583,6 +11767,12 @@ async function handleKanbanRoute(ws, msg, ctx) {
         });
         return true;
       }
+      case "kanban.board.history": {
+        const boardId = payload?.boardId;
+        const history = await listBoardHistory(ctx.projectRoot, boardId);
+        ok(ws, type, history);
+        return true;
+      }
       case "kanban.generate": {
         const description = payload?.description;
         if (!description) {
@@ -12044,8 +12234,14 @@ async function handleKanbanRoute(ws, msg, ctx) {
           taskId,
           {
             description,
+            // The old cast listed `manual | auto | agent | test | review` —
+            // three of which have no verifier plugin, while the six that do
+            // (command, file_exists, file_matches, git_diff, metric, test)
+            // were unreachable. `notes` carries the executable body every
+            // deterministic plugin reads.
             type: payload?.checkType ?? "manual",
-            status: payload?.status ?? "pending"
+            status: payload?.status ?? "pending",
+            ...typeof payload?.notes === "string" ? { notes: payload.notes } : {}
           },
           activityContext(
             ctx,
@@ -12110,30 +12306,6 @@ async function handleKanbanRoute(ws, msg, ctx) {
       case "kanban.capabilities":
         ok(ws, type, { dispatchSupported: Boolean(ctx.dispatchTask) });
         return true;
-      case "kanban.column.add": {
-        const boardId = payload?.boardId;
-        const title = payload?.title;
-        if (!boardId || !title) {
-          fail(ws, type, "boardId and title required");
-          return true;
-        }
-        const result = await addColumn(ctx.projectRoot, boardId, { title });
-        result ? ok(ws, type, result.board.columns) : fail(ws, type, `Board not found: ${boardId}`);
-        return true;
-      }
-      case "kanban.column.remove": {
-        const boardId = payload?.boardId;
-        const columnId = payload?.columnId;
-        if (!boardId || !columnId) {
-          fail(ws, type, "boardId and columnId required");
-          return true;
-        }
-        const board = await removeColumn(ctx.projectRoot, boardId, columnId, {
-          moveTasksToColumnId: payload?.moveTasksToColumnId
-        });
-        board ? ok(ws, type, { removed: true, boardId: board.id, columnId, board }) : fail(ws, type, `Column not found: ${columnId}`);
-        return true;
-      }
       default:
         fail(ws, type, `Unknown kanban message type: ${type}`);
         return true;
@@ -13403,6 +13575,34 @@ async function handleSageRecover(ws, msg, memoryStore) {
     send(ws, { type: "memory.sage.recover", payload: { error: errMessage(err) } });
   }
 }
+async function handleSageListCandidates(ws, msg, memoryStore) {
+  const Sage = getSageSurface(memoryStore);
+  if (!Sage) {
+    send(ws, {
+      type: "memory.sage.listCandidates",
+      payload: { error: requiresSage("memory.sage.listCandidates") }
+    });
+    return;
+  }
+  try {
+    const payload = msg.payload ?? {};
+    const includeResolved = payload["includeResolved"] === true;
+    if (typeof Sage.listCandidates !== "function") {
+      send(ws, {
+        type: "memory.sage.listCandidates",
+        payload: { error: "listCandidates is not available on this SAGE surface" }
+      });
+      return;
+    }
+    const candidates = await Sage.listCandidates(includeResolved);
+    send(ws, { type: "memory.sage.listCandidates", payload: { candidates } });
+  } catch (err) {
+    send(ws, {
+      type: "memory.sage.listCandidates",
+      payload: { error: errMessage(err) }
+    });
+  }
+}
 async function handleSageCandidateResolve(ws, msg, memoryStore) {
   const Sage = getSageSurface(memoryStore);
   if (!Sage) {
@@ -13581,6 +13781,9 @@ async function handleMemoryRoute(ctx, ws, message) {
     case "memory.sage.recover":
       await handleSageRecover(ws, message, store);
       return true;
+    case "memory.sage.listCandidates":
+      await handleSageListCandidates(ws, message, store);
+      return true;
     case "memory.sage.candidateResolve":
       await handleSageCandidateResolve(ws, message, store);
       return true;
@@ -15147,6 +15350,7 @@ import {
   finalizeTaskCompletion,
   getBoard as getBoard3,
   getKanbanQueueHealth as getKanbanQueueHealth2,
+  kanbanQueueAnomalyCount as kanbanQueueAnomalyCount2,
   listBoards as listBoards4,
   reconcileKanbanBoard as reconcileKanbanBoard2,
   recoverStaleTaskAssignments as recoverStaleTaskAssignments2,
@@ -15229,7 +15433,7 @@ function createKanbanSupervisor(deps2) {
     }) : null;
     if (recovered)
       health = await getKanbanQueueHealth2(resolveProjectRoot(deps2), { boardId: board.id });
-    const anomalyCount = countAnomalies(health);
+    const anomalyCount = kanbanQueueAnomalyCount2(health);
     const snapshot = {
       boardId: board.id,
       status: anomalyCount > 0 ? "attention" : "healthy",
@@ -15428,13 +15632,10 @@ function dispatchRoute(routing) {
     ...routing.fallbackModels?.length ? { fallbackModels: routing.fallbackModels } : {}
   };
 }
-function countAnomalies(health) {
-  return health.staleAssignments.count + health.heartbeatDue.count + health.counts.failed + health.counts.blocked;
-}
 function healthSummary(health) {
   return [
     `${health.counts.running} running`,
-    `${health.counts.ready} ready`,
+    `${health.counts.startable} ready`,
     `${health.counts.review} review`,
     `${health.counts.blocked} blocked`,
     `${health.counts.failed} failed`,
@@ -16196,7 +16397,7 @@ import { makeProviderFromConfig } from "@wrongstack/providers";
 import * as fs14 from "node:fs/promises";
 import * as path19 from "node:path";
 import { DefaultSessionStore } from "@wrongstack/core/storage";
-import { resolveWstackPaths as resolveWstackPaths5 } from "@wrongstack/core/utils";
+import { activateProjectStateGuard, resolveWstackPaths as resolveWstackPaths5 } from "@wrongstack/core/utils";
 function createProjectHandlers(ctx) {
   const sendTo = (ws, message) => {
     if (ctx.sendMessage) ctx.sendMessage(ws, message);
@@ -16361,6 +16562,7 @@ function createProjectHandlers(ctx) {
         try {
           await ctx.onSessionSwapped?.(next.id, identityTarget);
           await ctx.onBeforeSessionTodosReplaced?.(next.id, paths.projectSessions);
+          await activateProjectStateGuard(resolved);
         } catch (err) {
           try {
             await ctx.onBeforeSessionTodosReplaced?.(previous.id, previousPaths.projectSessions);
@@ -17378,6 +17580,7 @@ var CLIENT_KNOWLEDGE_MESSAGE_TYPES = [
   "memory.sage.get",
   "memory.sage.graph",
   "memory.sage.list",
+  "memory.sage.listCandidates",
   "memory.sage.listPage",
   "memory.sage.recover",
   "memory.sage.remember",
@@ -17657,6 +17860,7 @@ var SERVER_KNOWLEDGE_MESSAGE_TYPES = [
   "memory.sage.get",
   "memory.sage.graph",
   "memory.sage.list",
+  "memory.sage.listCandidates",
   "memory.sage.listPage",
   "memory.sage.recover",
   "memory.sage.remember",
@@ -18508,6 +18712,7 @@ function createSessionHandlers(ctx) {
         ctx.abortActiveRun?.(current2.id);
       } catch {
       }
+      await ctx.context.flushConversationJournal?.().catch(() => void 0);
       await finalizeSession(current2);
     }
     ctx.setSession(next);
@@ -19206,6 +19411,7 @@ import {
   clearProjectAgentConsolidated,
   clearProjectSkillAugmentation,
   createProjectAgent,
+  DEFAULT_EAGER_SKILL_LIMIT,
   detectLearnedConflicts,
   evaluateAutoOptimize,
   FLEET_ROSTER,
@@ -19223,12 +19429,15 @@ import {
   loadProjectSkillAugmentation,
   loadSkillAffinity,
   optimizeProjectAgentLearning,
+  rankRoleSkills,
+  readQuarantinedDirectives,
   readRawLearnedEntries,
   resetProjectAgentIdentity,
   resolveAutoOptimizePolicy,
   resolveRoleSkillCandidates,
   saveProjectAgentConsolidated,
   saveProjectSkillAugmentation,
+  scoreSkillAffinity,
   setSkillPinned,
   slugifyProjectAgentRole,
   updateProjectAgentConfig,
@@ -19535,9 +19744,7 @@ ${String(p.content ?? "")}`;
       // eligible right now, and why not when it does not. Surfacing the reason
       // is what keeps "nothing happened" from looking like a broken feature.
       case "agent-roster.auto-optimize-status": {
-        const policy = resolveAutoOptimizePolicy(
-          this.getAutoOptimizeSettings?.() ?? void 0
-        );
+        const policy = resolveAutoOptimizePolicy(this.getAutoOptimizeSettings?.() ?? void 0);
         const roles = role ? [role] : listProjectAgentRoles(projectRoot);
         return {
           type,
@@ -19560,18 +19767,30 @@ ${String(p.content ?? "")}`;
         const candidates = resolveRoleSkillCandidates(role, projectRoot);
         const developed = listProjectSkillAugmentations(role, projectRoot);
         const affinity = loadSkillAffinity(role, projectRoot);
+        const eager = new Set(rankRoleSkills(role, candidates, projectRoot));
         return {
           type,
           payload: {
             role,
+            eagerLimit: DEFAULT_EAGER_SKILL_LIMIT,
             skills: candidates.map((skill) => ({
               skill,
               developed: developed.includes(skill),
-              affinity: affinity.entries[skill] ?? null
+              affinity: affinity.entries[skill] ?? null,
+              score: scoreSkillAffinity(affinity.entries[skill]) + (developed.includes(skill) ? 1 : 0),
+              eager: eager.has(skill)
             }))
           }
         };
       }
+      // ── Directives the loop stopped believing ─────────────────────────────
+      case "agent-roster.quarantine": {
+        if (!role) return { type, payload: { error: "role required" } };
+        return {
+          type,
+          payload: { role, retired: readQuarantinedDirectives(role, projectRoot) }
+        };
+      }
       case "agent-roster.read-skill": {
         const skill = typeof p.skill === "string" ? p.skill : "";
         if (!role || !skill) return { type, payload: { error: "role and skill required" } };
@@ -21977,6 +22196,7 @@ function registerSetupEventsStatusWatcher(deps2) {
   const logWatcherMetricsEnabled = shouldLogWatcherStats();
   const logWatcherMetrics = () => logFileWatcherMetrics(watcherMetrics);
   const metricsInterval = logWatcherMetricsEnabled ? setInterval(logWatcherMetrics, 6e4) : void 0;
+  metricsInterval?.unref?.();
   const broadcastStatus = (_projectHash, statusData, actualDelayMs) => {
     broadcast2(clients, { type: "client.status_update", payload: statusData });
     if (watcherMetrics) {
@@ -23196,14 +23416,7 @@ import {
   toErrorMessage as toErrorMessage10
 } from "@wrongstack/core/utils";
 import { makeLightSubagentFactory } from "@wrongstack/runtime";
-import {
-  createSageContextMonitorMiddleware,
-  createSageToolCallMiddleware,
-  createSageTurnMiddleware,
-  getSageRetrieval,
-  getSageService,
-  InjectionTracker
-} from "@wrongstack/sage";
+import { getSageService, setupSage } from "@wrongstack/sage";
 
 // src/server/discover-mailbox-bridge.ts
 import { spawn as spawn4 } from "node:child_process";
@@ -24006,6 +24219,7 @@ var WorktreeWebSocketHandler = class {
     this.broadcast(this.stateMessage());
     if (this.broadcastInterval) return;
     this.broadcastInterval = setInterval(() => this.broadcast(this.stateMessage()), 2e3);
+    this.broadcastInterval.unref?.();
   }
   stopBroadcast() {
     this.broadcast(this.stateMessage());
@@ -24057,62 +24271,15 @@ async function createAgentServices(input) {
   const collabPause = collabPauseMiddleware(collabBus, { logger });
   pipelines.toolCall.prepend(collabPause);
   installDesignStudioMiddleware({ pipelines, ctx: context });
-  const memoryRetrieval = getSageRetrieval(memoryStore);
-  if (config.features.memory !== false && config.Sage?.enabled !== false && memoryRetrieval) {
-    const sageInjectionTracker = new InjectionTracker();
-    const getSageSessionId = () => input.sessionGetter().id;
-    if (config.Sage?.inject?.toolResults !== false) {
-      pipelines.toolCall.use(
-        createSageToolCallMiddleware({
-          memory: memoryRetrieval,
-          maxHintsPerTool: config.Sage?.inject?.maxHintsPerTool,
-          maxCharsPerTool: config.Sage?.inject?.maxCharsPerTool,
-          taskAware: config.Sage?.inject?.taskAware,
-          minScore: config.Sage?.inject?.minScore,
-          minImportance: config.Sage?.inject?.minImportance,
-          // Forward the explicit relation floor so an operator-configured
-          // `Sage.inject.relationFloor` is honored in WebUI sessions. Without
-          // this we silently fall back to MIN_RELATION_STRENGTH (0.85), which
-          // is the CLI default but masks operator overrides.
-          relationFloor: config.Sage?.inject?.relationFloor,
-          repeatCooldownMs: config.Sage?.inject?.repeatCooldownMs,
-          verifyOnMutation: config.Sage?.hygiene?.autoOnFileChange,
-          triggers: config.Sage?.inject?.triggers,
-          // Resolve the live session so retrieval and cooldown are session-scoped
-          // (matching the CLI wiring in wiring/sage.ts). Without this, the
-          // middleware falls back to ctx.session.id for cooldown but passes
-          // undefined to retrieval, causing owned session-scoped memories to be
-          // silently excluded from tool-call injection.
-          getSessionId: getSageSessionId,
-          tracker: sageInjectionTracker,
-          events
-        })
-      );
-    }
-    if (config.Sage?.inject?.turnContext === true) {
-      pipelines.request.use(
-        createSageTurnMiddleware({
-          memory: memoryRetrieval,
-          maxMemories: config.Sage?.inject?.maxTurnMemories,
-          maxChars: config.Sage?.inject?.maxCharsPerTurn,
-          minScore: config.Sage?.inject?.minScore,
-          // CLI parity: honor `Sage.retrieval.metadataWeight` so the same config
-          // value drives both runtimes instead of silently falling back to the
-          // 0.3 default. The undefined case keeps the middleware's own default.
-          metadataWeight: config.Sage?.retrieval?.metadataWeight,
-          getSessionId: getSageSessionId,
-          tracker: sageInjectionTracker
-        })
-      );
-    }
-    pipelines.request.use(
-      createSageContextMonitorMiddleware({
-        tracker: sageInjectionTracker,
-        events,
-        getSessionId: getSageSessionId
-      })
-    );
-  }
+  const runSageSessionHygiene = setupSage({
+    config,
+    pipelines,
+    memoryStore,
+    logger,
+    events,
+    getSessionId: () => input.sessionGetter().id,
+    projectRoot
+  });
   const codebaseIndexing = setupWebUICodebaseIndexing({
     config,
     context,
@@ -24224,7 +24391,12 @@ async function createAgentServices(input) {
     confirmAwaiter: void 0,
     iterationTimeoutMs: config.tools?.iterationTimeoutMs ?? DEFAULT_TOOLS_CONFIG.iterationTimeoutMs,
     perIterationOutputCapBytes: config.tools?.perIterationOutputCapBytes ?? DEFAULT_TOOLS_CONFIG.perIterationOutputCapBytes,
-    tracer: void 0
+    tracer: void 0,
+    // Off unless the operator opts in. The WebUI drives the same agent as the
+    // CLI, so it must resolve this identically — a surface-dependent gate
+    // would mean the same repo governs under `wstack` and not in the browser.
+    // See packages/cli/src/wiring/pipeline.ts.
+    requireKanbanGovernance: config.tools?.kanbanGovernance ?? DEFAULT_TOOLS_CONFIG.kanbanGovernance
   });
   input.installToolBoundary?.(pipelines);
   const webuiLogger = container.resolve(TOKENS2.Logger);
@@ -24244,6 +24416,7 @@ async function createAgentServices(input) {
     providers: providerRegistry,
     events,
     pipelines,
+    refreshSystemPrompt: true,
     context,
     maxIterations: config.tools?.maxIterations ?? DEFAULT_TOOLS_CONFIG.maxIterations,
     iterationTimeoutMs: config.tools?.iterationTimeoutMs ?? DEFAULT_TOOLS_CONFIG.iterationTimeoutMs,
@@ -24511,6 +24684,7 @@ async function createAgentServices(input) {
     terminalHandler,
     collabHandler,
     disposeRealtimeHandlers,
+    runSageSessionHygiene,
     updateAutoCompactionMaxContext
   };
 }
@@ -24990,15 +25164,9 @@ import {
   makeMailInboxTool,
   makeMailSendTool
 } from "@wrongstack/core/coordination";
-import {
-  DefaultPromptLoader,
-  DefaultSkillLoader
-} from "@wrongstack/core/execution";
-import {
-  EventBus,
-  TOKENS as TOKENS3
-} from "@wrongstack/core/kernel";
+import { DefaultPromptLoader, DefaultSkillLoader } from "@wrongstack/core/execution";
 import { DefaultTokenCounter } from "@wrongstack/core/infrastructure";
+import { EventBus, TOKENS as TOKENS3 } from "@wrongstack/core/kernel";
 import { DefaultModelsRegistry, DefaultModeStore } from "@wrongstack/core/models";
 import { ProviderRegistry, ToolRegistry } from "@wrongstack/core/registry";
 import { SkillInstaller } from "@wrongstack/core/skills";
@@ -25656,6 +25824,7 @@ async function createPreContextServices(input) {
     modeId,
     modePrompt,
     modelCapabilities: () => modelCapabilitiesRef.current,
+    tokenSavingMode: config.features.tokenSavingMode,
     instructionPaths: {
       globalDir: wpaths.globalInstructions,
       projectDir: wpaths.inProjectInstructions,
@@ -25676,7 +25845,8 @@ async function createPreContextServices(input) {
   const systemPrompt = await systemPromptBuilder.build({
     cwd: projectRoot,
     projectRoot,
-    tools: toolRegistry.list(),
+    tools: toolRegistry.listForProvider(),
+    catalogTools: toolRegistry.list(),
     provider: config.provider,
     model: config.model,
     onlineAgents
@@ -25694,6 +25864,7 @@ async function createPreContextServices(input) {
     projectRoot,
     model: config.model
   });
+  context.meta["promptOnlineAgents"] = onlineAgents;
   const initialContextPolicy = resolveContextWindowPolicy3(config.context);
   context.meta["contextWindowMode"] = initialContextPolicy.id;
   context.meta["contextWindowPolicy"] = initialContextPolicy;
@@ -25766,6 +25937,7 @@ function createModeHandlers(context) {
         modeId: id,
         modePrompt,
         modelCapabilities: context.modelCapabilities,
+        tokenSavingMode: config.features?.tokenSavingMode,
         instructionPaths: {
           globalDir: paths.globalInstructions,
           projectDir: paths.inProjectInstructions,
@@ -25775,7 +25947,8 @@ function createModeHandlers(context) {
       context.context.systemPrompt = await builder.build({
         cwd: context.projectRoot,
         projectRoot: context.projectRoot,
-        tools: context.toolRegistry.list(),
+        tools: context.toolRegistry.listForProvider(),
+        catalogTools: context.toolRegistry.list(),
         provider: config.provider,
         model: config.model
       });
@@ -27050,15 +27223,7 @@ projectRoot: ${ev.projectRoot ?? "?"}`,
         eternalSubscription = null;
       }
       codebaseIndexing.dispose();
-      if (config.Sage?.enabled !== false && config.Sage?.hygiene?.autoAfterSession !== false) {
-        const candidate = memoryStore;
-        await candidate.hygiene?.({
-          retentionDays: config.Sage?.hygiene?.retentionDays,
-          archiveLowConfidenceAfterDays: config.Sage?.hygiene?.archiveLowConfidenceAfterDays
-        }).catch(
-          (err) => logger.warn(`sage session hygiene failed: ${toErrorMessage14(err)}`)
-        );
-      }
+      await agentServices.runSageSessionHygiene().catch((err) => logger.warn(`sage session hygiene failed: ${toErrorMessage14(err)}`));
       await memoryStore.dispose().catch(
         (err) => logger.warn(`sage connection disposal failed: ${toErrorMessage14(err)}`)
       );