@wrongstack/webui-server 0.306.2 → 0.306.4

package/dist/index.js

@@ -1210,6 +1210,102 @@ function patchConfig(config, updates) {
   return Object.freeze({ ...config, ...updates });
 }
 
+// src/server/session-cleanup-scheduler.ts
+import { toErrorMessage } from "@wrongstack/core/utils";
+
+// src/server/session-deletion.ts
+async function deleteWebUISession(ctx, sessionId) {
+  if (sessionId === ctx.getActiveSessionId()) {
+    throw new Error("Cannot delete the active session");
+  }
+  await ctx.getSessionStore().delete(sessionId);
+  await ctx.refreshSessions().catch(() => void 0);
+}
+
+// src/server/session-cleanup-scheduler.ts
+var DEFAULT_EMPTY_SESSION_CLEANUP_INTERVAL_MS = 60 * 60 * 1e3;
+var EMPTY_SESSION_CLEANUP_INTERVAL_ENV = "WRONGSTACK_EMPTY_SESSION_CLEANUP_INTERVAL_MS";
+var MAX_SESSION_SCAN = 1e3;
+function resolveEmptySessionCleanupInterval(value = process.env[EMPTY_SESSION_CLEANUP_INTERVAL_ENV]) {
+  if (value === void 0 || value.trim() === "") return DEFAULT_EMPTY_SESSION_CLEANUP_INTERVAL_MS;
+  const parsed = Number(value);
+  return Number.isFinite(parsed) && parsed >= 1e3 ? Math.floor(parsed) : DEFAULT_EMPTY_SESSION_CLEANUP_INTERVAL_MS;
+}
+async function cleanupOwnerlessEmptySessions(ctx) {
+  const store = ctx.getSessionStore();
+  let deleted = 0;
+  let errors = 0;
+  let sessions;
+  try {
+    sessions = await store.list(MAX_SESSION_SCAN);
+  } catch (error2) {
+    errors++;
+    ctx.logger.error("Empty session cleanup failed to list sessions", {
+      event: "webui.empty_session_cleanup_error",
+      phase: "list",
+      message: toErrorMessage(error2)
+    });
+    ctx.logger.info("Empty session cleanup completed", {
+      event: "webui.empty_session_cleanup_completed",
+      deleted,
+      errors
+    });
+    return { deleted, errors };
+  }
+  for (const candidate of sessions) {
+    const sessionId = candidate.id;
+    if (sessionId === ctx.getActiveSessionId() || ctx.hasParticipants(sessionId)) continue;
+    try {
+      if (!store.isEmpty || !await store.isEmpty(sessionId)) continue;
+      if (store !== ctx.getSessionStore() || sessionId === ctx.getActiveSessionId() || ctx.hasParticipants(sessionId)) {
+        continue;
+      }
+      await deleteWebUISession(
+        {
+          getActiveSessionId: ctx.getActiveSessionId,
+          getSessionStore: () => store,
+          refreshSessions: ctx.refreshSessions
+        },
+        sessionId
+      );
+      deleted++;
+    } catch (error2) {
+      errors++;
+      ctx.logger.error("Empty session cleanup failed for session", {
+        event: "webui.empty_session_cleanup_error",
+        phase: "delete",
+        sessionId,
+        message: toErrorMessage(error2)
+      });
+    }
+  }
+  ctx.logger.info("Empty session cleanup completed", {
+    event: "webui.empty_session_cleanup_completed",
+    deleted,
+    errors
+  });
+  return { deleted, errors };
+}
+function scheduleOwnerlessEmptySessionCleanup(ctx, intervalMs = resolveEmptySessionCleanupInterval()) {
+  let running = null;
+  const runNow = () => {
+    if (running) return running;
+    running = cleanupOwnerlessEmptySessions(ctx).finally(() => {
+      running = null;
+    });
+    return running;
+  };
+  const timer = setInterval(() => void runNow(), intervalMs);
+  timer.unref?.();
+  return {
+    dispose: async () => {
+      clearInterval(timer);
+      await running;
+    },
+    runNow
+  };
+}
+
 // src/server/brain-routes.ts
 async function handleBrainRoute(ws, msg, handlers) {
   switch (msg.type) {
@@ -1757,7 +1853,7 @@ function extractCodeMapFileTargets(projectRoot, toolName2, rawInput) {
 
 // src/server/collaboration-ws-handler.ts
 import { randomUUID } from "node:crypto";
-import { toErrorMessage } from "@wrongstack/core/utils";
+import { toErrorMessage as toErrorMessage2 } from "@wrongstack/core/utils";
 var REPLAY_LIMIT = 50;
 var PAUSE_TIMEOUT_MS = 6e4;
 var CollaborationWebSocketHandler = class {
@@ -1792,6 +1888,10 @@ var CollaborationWebSocketHandler = class {
     ws.on("close", () => this.handleDisconnect(ws));
     ws.on("error", () => this.handleDisconnect(ws));
   }
+  /** True while at least one collaboration participant is attached to a session. */
+  hasParticipants(sessionId) {
+    return (this.bySession.get(sessionId)?.size ?? 0) > 0;
+  }
   dispose() {
     for (const off of this.offs) off();
     this.offs.length = 0;
@@ -1909,7 +2009,7 @@ var CollaborationWebSocketHandler = class {
     this.broadcast(sessionId, this.stateMessage(sessionId));
     if (this.reader) {
       this.replayHistory(ws, sessionId).catch((err) => {
-        this.logger.debug?.(`collab: replay failed for ${sessionId}: ${toErrorMessage(err)}`);
+        this.logger.debug?.(`collab: replay failed for ${sessionId}: ${toErrorMessage2(err)}`);
       });
     }
     this.logger.debug?.(`collab: participant ${participant.participantId} joined ${sessionId}`);
@@ -2016,7 +2116,7 @@ var CollaborationWebSocketHandler = class {
         }
       });
     } catch (err) {
-      this.send(ws, this.errorMessage(`annotation rejected: ${toErrorMessage(err)}`));
+      this.send(ws, this.errorMessage(`annotation rejected: ${toErrorMessage2(err)}`));
     }
   }
   async handleResolve(ws, raw) {
@@ -2068,7 +2168,7 @@ var CollaborationWebSocketHandler = class {
         }
       });
     } catch (err) {
-      this.send(ws, this.errorMessage(`resolve failed: ${toErrorMessage(err)}`));
+      this.send(ws, this.errorMessage(`resolve failed: ${toErrorMessage2(err)}`));
     }
   }
   // ── Event subscription (live mirror) ───────────────────────────────────
@@ -2139,7 +2239,7 @@ var CollaborationWebSocketHandler = class {
         seen++;
       }
     } catch (err) {
-      this.logger.debug?.(`collab: session reader rejected ${sessionId}: ${toErrorMessage(err)}`);
+      this.logger.debug?.(`collab: session reader rejected ${sessionId}: ${toErrorMessage2(err)}`);
       return;
     }
     const tail2 = seen <= REPLAY_LIMIT ? ring.slice(0, seen) : (
@@ -2222,7 +2322,7 @@ var CollaborationWebSocketHandler = class {
       try {
         sendSerialized(p.ws, data);
       } catch (err) {
-        this.logger.debug?.(`collab broadcast failed: ${toErrorMessage(err)}`);
+        this.logger.debug?.(`collab broadcast failed: ${toErrorMessage2(err)}`);
       }
     }
   }
@@ -6910,7 +7010,7 @@ import {
   PhaseOrchestrator,
   PhaseStore
 } from "@wrongstack/core/goal";
-import { toErrorMessage as toErrorMessage2 } from "@wrongstack/core/utils";
+import { toErrorMessage as toErrorMessage3 } from "@wrongstack/core/utils";
 import { WorktreeManager } from "@wrongstack/core/worktree";
 
 // src/server/git-process.ts
@@ -7163,7 +7263,7 @@ var GoalWebSocketHandler = class {
       sendResult7(result);
     } catch (err) {
       if (mySeq !== this.assessSeq) return;
-      this.logger.error(`[Goal] Assessment failed: ${toErrorMessage2(err)}`);
+      this.logger.error(`[Goal] Assessment failed: ${toErrorMessage3(err)}`);
       sendResult7({
         realistic: true,
         durationClaimed: null,
@@ -7172,7 +7272,7 @@ var GoalWebSocketHandler = class {
         concerns: [],
         raw: "",
         parseFailed: true,
-        parseError: `Assessment error: ${toErrorMessage2(err)}`
+        parseError: `Assessment error: ${toErrorMessage3(err)}`
       });
     }
   }
@@ -7303,7 +7403,7 @@ Run npx tsc --noEmit to verify the fix. Output the fixed file paths.`;
       );
       this.broadcastState();
     }).catch((err) => {
-      this.logger.error(`[Goal] Aborted: ${toErrorMessage2(err)}`);
+      this.logger.error(`[Goal] Aborted: ${toErrorMessage3(err)}`);
       this.stopBroadcast();
       this.broadcast({ type: "goal.failed", payload: { title, error: String(err) } });
     });
@@ -7429,7 +7529,7 @@ Run npx tsc --noEmit to verify the fix. Output the fixed file paths.`;
       }
       this.logger.info(`[Goal] Planner produced no phases; using defaults for: ${goal}`);
     } catch (err) {
-      this.logger.error(`[Goal] Planning failed, using defaults: ${toErrorMessage2(err)}`);
+      this.logger.error(`[Goal] Planning failed, using defaults: ${toErrorMessage3(err)}`);
     }
     return this.defaultPhases();
   }
@@ -7490,7 +7590,7 @@ ${result_.finalText.slice(0, 2e3)}`
         );
       }
     } catch (err) {
-      this.logger.warn(`[Goal] Chimera review failed for "${task.title}": ${toErrorMessage2(err)}`);
+      this.logger.warn(`[Goal] Chimera review failed for "${task.title}": ${toErrorMessage3(err)}`);
     }
   }
   /**
@@ -9877,6 +9977,16 @@ function createHttpServer(opts) {
         res.end("Unauthorized");
         return;
       }
+      const isMutatingApiRequest = url.pathname.startsWith("/api/") && (req.method === "POST" || req.method === "PUT" || req.method === "PATCH" || req.method === "DELETE");
+      if (isMutatingApiRequest && !req.headers.origin && !accessTokenOk) {
+        res.writeHead(401, { "Content-Type": "application/json", "Cache-Control": "no-store" });
+        res.end(
+          JSON.stringify({
+            error: "Unauthorized: a request without an Origin header must present the access token (X-WS-Token header or ws_token cookie)."
+          })
+        );
+        return;
+      }
       if (shouldSetAuthCookie && opts.apiToken) {
         setAuthCookieHeaders(res, opts.apiToken, secureCookies);
       }
@@ -13800,7 +13910,7 @@ async function handleMemoryRoute(ctx, ws, message) {
 
 // src/server/mode-operations.ts
 import { ToolValidationError as ToolValidationError3 } from "@wrongstack/core/types";
-import { toErrorMessage as toErrorMessage3 } from "@wrongstack/core/utils";
+import { toErrorMessage as toErrorMessage4 } from "@wrongstack/core/utils";
 function sendResult4(context, ws, success, message) {
   context.send(ws, { type: "key.operation_result", payload: { success, message } });
 }
@@ -13832,7 +13942,7 @@ function createModeOperations(context) {
       } catch (error2) {
         context.send(ws, {
           type: "modes.list",
-          payload: { modes: [], activeId: "default", error: toErrorMessage3(error2) }
+          payload: { modes: [], activeId: "default", error: toErrorMessage4(error2) }
         });
       }
     },
@@ -13864,7 +13974,7 @@ function createModeOperations(context) {
         await context.afterSwitch?.(id);
         sendResult4(context, ws, true, `Switched to mode "${id}"`);
       } catch (error2) {
-        sendResult4(context, ws, false, toErrorMessage3(error2));
+        sendResult4(context, ws, false, toErrorMessage4(error2));
       }
     }
   };
@@ -13911,7 +14021,7 @@ import {
   resolveConfiguredRefinerRef,
   resolveEnhanceFallbackRef
 } from "@wrongstack/core/execution";
-import { toErrorMessage as toErrorMessage4 } from "@wrongstack/core/utils";
+import { toErrorMessage as toErrorMessage5 } from "@wrongstack/core/utils";
 function sendResult5(context, ws, payload, legacyResult = false) {
   const message = { type: "model.switch_result", payload };
   if (payload.success && context.broadcast) context.broadcast(message);
@@ -13969,7 +14079,7 @@ function createModelOperations(context) {
           {
             ...requestId ? { requestId } : {},
             success: false,
-            message: `Switch failed: ${toErrorMessage4(error2)}`,
+            message: `Switch failed: ${toErrorMessage5(error2)}`,
             provider,
             model,
             previousProvider,
@@ -14016,7 +14126,7 @@ function createModelOperations(context) {
           payload: {
             refined: text2,
             english: text2,
-            error: `Cannot use ${payload.provider}/${payload.model}: ${toErrorMessage4(error2)}`,
+            error: `Cannot use ${payload.provider}/${payload.model}: ${toErrorMessage5(error2)}`,
             errorKind: "provider_error",
             ...fallbackRef ? { fallbackRef } : {}
           }
@@ -14114,7 +14224,7 @@ function createModelOperations(context) {
         JSON.stringify({
           level: "error",
           event: "model.refine.error",
-          error: toErrorMessage4(error2),
+          error: toErrorMessage5(error2),
           timestamp: (/* @__PURE__ */ new Date()).toISOString()
         })
       );
@@ -14123,7 +14233,7 @@ function createModelOperations(context) {
         payload: {
           refined: text2,
           english: text2,
-          error: toErrorMessage4(error2),
+          error: toErrorMessage5(error2),
           errorKind: "provider_error",
           ...fallbackRef ? { fallbackRef } : {}
         }
@@ -14812,7 +14922,7 @@ function createWebuiClientPresence(deps2) {
 
 // src/server/brain-handlers.ts
 import { BUILTIN_COUNCIL_PERSONAS } from "@wrongstack/core/execution";
-import { toErrorMessage as toErrorMessage5 } from "@wrongstack/core/utils";
+import { toErrorMessage as toErrorMessage6 } from "@wrongstack/core/utils";
 var COUNCIL_PERSONA_CATALOG = Object.freeze(
   BUILTIN_COUNCIL_PERSONAS.map(
     (persona) => Object.freeze({
@@ -14901,7 +15011,7 @@ async function handleBrainConfigSet(ctx, ws, payload) {
       payload: {
         config: brainConfigPayload(ctx.brainRuntime),
         persisted: false,
-        error: `Invalid Brain setting: ${toErrorMessage5(err)}`
+        error: `Invalid Brain setting: ${toErrorMessage6(err)}`
       }
     });
   }
@@ -14947,7 +15057,7 @@ async function handleBrainAsk(ctx, ws, question) {
       payload: { sessionId: ctx.getSessionId?.(), question: q, decision }
     });
   } catch (err) {
-    sendResult6(ctx, ws, false, `Brain consultation failed: ${toErrorMessage5(err)}`);
+    sendResult6(ctx, ws, false, `Brain consultation failed: ${toErrorMessage6(err)}`);
   }
 }
 
@@ -15734,7 +15844,6 @@ function seedContextMeta(config, context) {
   const hqConfig = config.hq;
   meta["hqEnabled"] = hqConfig?.enabled === true;
   meta["hqUrl"] = hqConfig?.url ?? "";
-  meta["hqToken"] = hqConfig?.token ?? "";
   meta["hqRawContent"] = hqConfig?.rawContent === true;
   const tgExt = config.extensions?.["telegram"];
   meta["tgConfigured"] = typeof tgExt?.["botToken"] === "string" && tgExt["botToken"].length > 0;
@@ -15828,7 +15937,6 @@ var PREF_KEYS = [
   "auditLevel",
   "hqEnabled",
   "hqUrl",
-  "hqToken",
   "hqRawContent",
   "tgConfigured",
   "tgSessionEnd",
@@ -16390,7 +16498,7 @@ import * as fs16 from "node:fs/promises";
 import * as path20 from "node:path";
 import { TOKENS } from "@wrongstack/core/kernel";
 import { DefaultSessionStore as DefaultSessionStore2 } from "@wrongstack/core/storage";
-import { toErrorMessage as toErrorMessage7, wstackGlobalRoot as wstackGlobalRoot2 } from "@wrongstack/core/utils";
+import { toErrorMessage as toErrorMessage8, wstackGlobalRoot as wstackGlobalRoot2 } from "@wrongstack/core/utils";
 import { makeProviderFromConfig } from "@wrongstack/providers";
 
 // src/server/project-handlers.ts
@@ -16633,7 +16741,8 @@ function createProjectHandlers(ctx) {
 // src/server/provider-handlers.ts
 import { hasProviderCredential, resolveProviderModelList } from "@wrongstack/core/models";
 import { DefaultSecretScrubber as DefaultSecretScrubber2 } from "@wrongstack/core/security";
-import { toErrorMessage as toErrorMessage6 } from "@wrongstack/core/utils";
+import { validateProviderBaseUrl } from "@wrongstack/core/tools";
+import { toErrorMessage as toErrorMessage7 } from "@wrongstack/core/utils";
 import {
   beginOAuthLogin
 } from "@wrongstack/providers/oauth";
@@ -17221,6 +17330,13 @@ function createProviderOperations(deps2) {
         sendOperationResult(ws, false, `Unknown provider "${payload.id}"`);
         return;
       }
+      if (payload.baseUrl !== void 0 && payload.baseUrl !== "") {
+        const invalid = validateProviderBaseUrl(payload.baseUrl);
+        if (invalid) {
+          sendOperationResult(ws, false, invalid);
+          return;
+        }
+      }
       if (payload.family !== void 0) cfg.family = payload.family;
       if (payload.baseUrl !== void 0) cfg.baseUrl = payload.baseUrl;
       if (payload.envVars !== void 0) cfg.envVars = payload.envVars;
@@ -17401,7 +17517,7 @@ function createProviderHandlers(deps2) {
           JSON.stringify({
             level: "error",
             event: "webui.provider_save_failed",
-            message: toErrorMessage6(error2),
+            message: toErrorMessage7(error2),
             timestamp: (/* @__PURE__ */ new Date()).toISOString()
           })
         );
@@ -19057,21 +19173,21 @@ function createSessionHandlers(ctx) {
     deleteSession: async (ws, msg) => {
       const { id } = msg.payload;
       try {
-        if (id === ctx.getSession().id) {
-          result(ws, false, "Cannot delete the active session");
-          return;
-        }
-        const store = ctx.getSessionStore();
-        await store.delete(id);
+        await deleteWebUISession(
+          {
+            getActiveSessionId: () => ctx.getSession().id,
+            getSessionStore: ctx.getSessionStore,
+            refreshSessions: async () => {
+              const list = await ctx.getSessionStore().list(200);
+              broadcastToAll({
+                type: "sessions.list",
+                payload: { sessions: toSessionHistoryEntries(list, ctx.getSession().id) }
+              });
+            }
+          },
+          id
+        );
         result(ws, true, `Session ${id} deleted`);
-        try {
-          const list = await store.list(200);
-          broadcastToAll({
-            type: "sessions.list",
-            payload: { sessions: toSessionHistoryEntries(list, ctx.getSession().id) }
-          });
-        } catch {
-        }
       } catch (err) {
         result(ws, false, errMessage(err));
       }
@@ -19254,7 +19370,7 @@ async function applyEmbeddedModelSwitch(ctx, providerId, modelId) {
           event: "models.refresh_failed",
           provider: providerId,
           model: modelId,
-          message: toErrorMessage7(error2),
+          message: toErrorMessage8(error2),
           timestamp: (/* @__PURE__ */ new Date()).toISOString()
         })
       );
@@ -23376,7 +23492,7 @@ import {
   expectDefined as expectDefined4,
   sessionScopedPath as sessionScopedPath3,
   startSharedHeapWatchdog,
-  toErrorMessage as toErrorMessage14,
+  toErrorMessage as toErrorMessage15,
   wstackGlobalRoot as wstackGlobalRoot4
 } from "@wrongstack/core/utils";
 import { makeProviderFromConfig as makeProviderFromConfig5 } from "@wrongstack/providers";
@@ -23413,7 +23529,7 @@ import {
 } from "@wrongstack/core/types";
 import {
   estimateRequestTokensCalibrated,
-  toErrorMessage as toErrorMessage10
+  toErrorMessage as toErrorMessage11
 } from "@wrongstack/core/utils";
 import { makeLightSubagentFactory } from "@wrongstack/runtime";
 import { getSageService, setupSage } from "@wrongstack/sage";
@@ -23569,7 +23685,7 @@ function sleep(ms) {
 import { spawn as spawnChild } from "node:child_process";
 import { createRequire as createRequire2 } from "node:module";
 import { createCompatibilityTrustBoundary as createCompatibilityTrustBoundary2 } from "@wrongstack/core/security";
-import { buildChildEnv, toErrorMessage as toErrorMessage8 } from "@wrongstack/core/utils";
+import { buildChildEnv, toErrorMessage as toErrorMessage9 } from "@wrongstack/core/utils";
 var MAX_SESSIONS_PER_CLIENT = 8;
 var MAX_INPUT_BYTES = 1 << 16;
 var DEFAULT_COLS = 80;
@@ -23685,8 +23801,8 @@ var TerminalWebSocketHandler = class {
         ...windowsPtyOptions()
       });
     } catch (err) {
-      const msg = `Integrated terminal failed to start: ${toErrorMessage8(err)}`;
-      this.logger.warn?.(`terminal spawn failed: ${toErrorMessage8(err)}`);
+      const msg = `Integrated terminal failed to start: ${toErrorMessage9(err)}`;
+      this.logger.warn?.(`terminal spawn failed: ${toErrorMessage9(err)}`);
       this.send(ws, { type: "terminal.output", payload: { id: payload.id, data: `${msg}\r
 ` } });
       this.send(ws, { type: "terminal.exit", payload: { id: payload.id, exitCode: -1 } });
@@ -23747,7 +23863,7 @@ var TerminalWebSocketHandler = class {
     try {
       pty.kill();
     } catch (err) {
-      this.logger.warn?.(`${reason} failed: ${toErrorMessage8(err)}`);
+      this.logger.warn?.(`${reason} failed: ${toErrorMessage9(err)}`);
     }
   }
   killWindowsProcessTree(pty, reason) {
@@ -23759,7 +23875,7 @@ var TerminalWebSocketHandler = class {
       } catch {
       }
     } catch (err) {
-      this.logger.warn?.(`${reason} taskkill failed: ${toErrorMessage8(err)}`);
+      this.logger.warn?.(`${reason} taskkill failed: ${toErrorMessage9(err)}`);
     }
   }
   send(ws, msg) {
@@ -23806,7 +23922,7 @@ function clampDim(value, fallback) {
 
 // src/server/worktree-ws-handler.ts
 import { join as join14, resolve as resolve14, sep as sep5 } from "node:path";
-import { toErrorMessage as toErrorMessage9 } from "@wrongstack/core/utils";
+import { toErrorMessage as toErrorMessage10 } from "@wrongstack/core/utils";
 import { WorktreeManager as WorktreeManager3 } from "@wrongstack/core/worktree";
 import { cleanupStaleSddWorktrees as cleanupStaleSddWorktrees2 } from "@wrongstack/sdd";
 var MAX_ACTIVITY = 6;
@@ -23972,7 +24088,7 @@ var WorktreeWebSocketHandler = class {
         }
       });
     } catch (err) {
-      this.logger.debug?.(`worktree orphan scan failed: ${toErrorMessage9(err)}`);
+      this.logger.debug?.(`worktree orphan scan failed: ${toErrorMessage10(err)}`);
       this.broadcast({ type: "worktree.orphans", payload: { orphans: [], canClean: false } });
     }
   }
@@ -24234,7 +24350,7 @@ var WorktreeWebSocketHandler = class {
       try {
         sendSerialized(ws, data);
       } catch (err) {
-        this.logger.debug?.(`worktree broadcast failed: ${toErrorMessage9(err)}`);
+        this.logger.debug?.(`worktree broadcast failed: ${toErrorMessage10(err)}`);
       }
     }
   }
@@ -24343,7 +24459,7 @@ async function createAgentServices(input) {
   const updateAutoCompactionMaxContext = async (newProvider, providerId = newProvider.id, providerCfg) => {
     await modelsRegistry.refresh().catch((err) => {
       logger.warn(
-        `models.dev refresh failed for ${providerId}/${context.model}: ${toErrorMessage10(err)}; using cached catalog`
+        `models.dev refresh failed for ${providerId}/${context.model}: ${toErrorMessage11(err)}; using cached catalog`
       );
     });
     const currentConfig = input.config;
@@ -25185,7 +25301,7 @@ import {
 import {
   configureChildEnvGitIdentity,
   sessionScopedPath as sessionScopedPath2,
-  toErrorMessage as toErrorMessage12
+  toErrorMessage as toErrorMessage13
 } from "@wrongstack/core/utils";
 import {
   createVaultBackedMcpAuthorizationProviderFactory,
@@ -25267,7 +25383,7 @@ async function discoverAndMergeWebuiProviders(opts) {
 
 // src/server/setup-screen.ts
 import { expectDefined as expectDefined3 } from "@wrongstack/core/utils";
-import { toErrorMessage as toErrorMessage11 } from "@wrongstack/core/utils";
+import { toErrorMessage as toErrorMessage12 } from "@wrongstack/core/utils";
 import { makeProviderFromConfig as makeProviderFromConfig3 } from "@wrongstack/providers";
 var UNCONFIGURED_CAPABILITIES = {
   tools: false,
@@ -25308,7 +25424,7 @@ function logCreateFailure(event, err) {
     JSON.stringify({
       level: "error",
       event,
-      message: toErrorMessage11(err),
+      message: toErrorMessage12(err),
       timestamp: (/* @__PURE__ */ new Date()).toISOString()
     })
   );
@@ -25617,7 +25733,7 @@ async function createPreContextServices(input) {
       await modelsRegistry.refresh();
       logger.info("models.dev catalog refreshed");
     } catch (err) {
-      logger.warn(`models.dev refresh failed (${toErrorMessage12(err)}); using cached catalog`);
+      logger.warn(`models.dev refresh failed (${toErrorMessage13(err)}); using cached catalog`);
     }
   }
   try {
@@ -25628,7 +25744,7 @@ async function createPreContextServices(input) {
       logger
     });
   } catch (err) {
-    logger.debug(`provider auto-discovery skipped: ${toErrorMessage12(err)}`);
+    logger.debug(`provider auto-discovery skipped: ${toErrorMessage13(err)}`);
   }
   try {
     await installCatalogModelOutputLimits({
@@ -25637,7 +25753,7 @@ async function createPreContextServices(input) {
       log: (message) => logger.debug(message)
     });
   } catch (err) {
-    logger.debug(`model output-limit index skipped: ${toErrorMessage12(err)}`);
+    logger.debug(`model output-limit index skipped: ${toErrorMessage13(err)}`);
   }
   const events = opts.services?.events ?? new EventBus();
   events.setLogger(logger);
@@ -25656,7 +25772,7 @@ async function createPreContextServices(input) {
       JSON.stringify({
         level: "warn",
         event: "webui.provider_registry_load_failed",
-        message: toErrorMessage12(err),
+        message: toErrorMessage13(err),
         timestamp: (/* @__PURE__ */ new Date()).toISOString()
       })
     );
@@ -26291,7 +26407,7 @@ function buildRoutes(state, deps2, cb) {
 import { createRequire as createRequire4 } from "node:module";
 import * as path33 from "node:path";
 import { fileURLToPath } from "node:url";
-import { toErrorMessage as toErrorMessage13 } from "@wrongstack/core/utils";
+import { toErrorMessage as toErrorMessage14 } from "@wrongstack/core/utils";
 import { WebSocketServer } from "ws";
 async function resolvePorts(opts) {
   const surface = opts.surface ?? "webui";
@@ -26442,7 +26558,7 @@ function armEvents(wssPrimary, wssSecondary, wsHost, httpPort, setupInput, watch
         level: "error",
         event: "webui.ws_server_error",
         host: wsHost,
-        message: toErrorMessage13(err),
+        message: toErrorMessage14(err),
         timestamp: (/* @__PURE__ */ new Date()).toISOString()
       })
     );
@@ -27089,7 +27205,7 @@ async function startWebUI(opts = {}) {
           console.log(`[WebUI] Provider credentials reloaded from config.json (${activeId})`);
         } catch (err) {
           console.warn(
-            `[WebUI] Credential hot-reload failed for ${activeId}: ${toErrorMessage14(err)}`
+            `[WebUI] Credential hot-reload failed for ${activeId}: ${toErrorMessage15(err)}`
           );
         }
       },
@@ -27112,6 +27228,19 @@ async function startWebUI(opts = {}) {
     })
   });
   const routes = buildRoutes(state, deps2, cb);
+  const stopEmptySessionCleanup = scheduleOwnerlessEmptySessionCleanup({
+    getSessionStore: state.getSessionStore,
+    getActiveSessionId: () => state.getSession().id,
+    hasParticipants: (sessionId) => collabHandler.hasParticipants(sessionId),
+    refreshSessions: async () => {
+      const list = await state.getSessionStore().list(200);
+      broadcast(clients, {
+        type: "sessions.list",
+        payload: { sessions: toSessionHistoryEntries(list, state.getSession().id) }
+      });
+    },
+    logger
+  });
   let kanbanSupervisorDispose = null;
   const handleMessage = createMessageDispatcher({
     state,
@@ -27196,7 +27325,8 @@ projectRoot: ${ev.projectRoot ?? "?"}`,
       wssPrimary,
       ...wssSecondary ? [wssSecondary] : []
     ],
-    onPreShutdown: () => {
+    onPreShutdown: async () => {
+      await stopEmptySessionCleanup.dispose();
       kanbanSupervisorDispose?.();
       kanbanSupervisorDispose = null;
     },
@@ -27223,9 +27353,9 @@ projectRoot: ${ev.projectRoot ?? "?"}`,
         eternalSubscription = null;
       }
       codebaseIndexing.dispose();
-      await agentServices.runSageSessionHygiene().catch((err) => logger.warn(`sage session hygiene failed: ${toErrorMessage14(err)}`));
+      await agentServices.runSageSessionHygiene().catch((err) => logger.warn(`sage session hygiene failed: ${toErrorMessage15(err)}`));
       await memoryStore.dispose().catch(
-        (err) => logger.warn(`sage connection disposal failed: ${toErrorMessage14(err)}`)
+        (err) => logger.warn(`sage connection disposal failed: ${toErrorMessage15(err)}`)
       );
       await unregisterInstance(process.pid, path34.dirname(globalConfigPath));
     }
@@ -27234,7 +27364,9 @@ projectRoot: ${ev.projectRoot ?? "?"}`,
 export {
   CLIENT_MESSAGE_TYPES,
   CollaborationWebSocketHandler,
+  DEFAULT_EMPTY_SESSION_CLEANUP_INTERVAL_MS,
   DEFAULT_SURFACE_CONNECTION_CONFIG,
+  EMPTY_SESSION_CLEANUP_INTERVAL_ENV,
   GoalWebSocketHandler,
   KANBAN_CLIENT_MESSAGE_TYPES,
   PREF_KEYS,
@@ -27266,6 +27398,7 @@ export {
   buildTaskGraphFromGoalPhase,
   buildTaskGraphFromSddSnapshot,
   buildWebUIAccessUrl,
+  cleanupOwnerlessEmptySessions,
   clearAnalyticsBuffer,
   collectConnectionsHealth,
   computeUsageCost,
@@ -27309,6 +27442,7 @@ export {
   decodeSessionId,
   defaultBaseDir,
   deleteKey,
+  deleteWebUISession,
   enqueueBounded,
   ensureDistDir,
   ensureProjectDataDir,
@@ -27496,12 +27630,14 @@ export {
   resolveAllPendingConfirms,
   resolveAuthToken,
   resolveDistDir,
+  resolveEmptySessionCleanupInterval,
   resolveProviderCatalogForModels,
   resolveProviderModelMetadata,
   resolveWorkingDirInsideProject,
   resolveYoloEligiblePendingConfirms,
   saveManifest,
   saveProviders,
+  scheduleOwnerlessEmptySessionCleanup,
   seedContextMeta,
   send,
   sendResult2 as sendResult,