@wrongstack/webui-server 0.306.3 → 0.306.4

package/dist/server/collaboration-ws-handler.d.ts

@@ -95,6 +95,8 @@ export declare class CollaborationWebSocketHandler {
      */
     bus?: CollaborationBus | undefined, options?: CollaborationHandlerOptions);
     addClient(ws: WebSocket): void;
+    /** True while at least one collaboration participant is attached to a session. */
+    hasParticipants(sessionId: string): boolean;
     dispose(): void;
     /**
      * Dispatch a parsed client message. Returns true when the message was

package/dist/server/entry.js

@@ -1167,6 +1167,102 @@ function patchConfig(config, updates) {
   return Object.freeze({ ...config, ...updates });
 }
 
+// src/server/session-cleanup-scheduler.ts
+import { toErrorMessage } from "@wrongstack/core/utils";
+
+// src/server/session-deletion.ts
+async function deleteWebUISession(ctx, sessionId) {
+  if (sessionId === ctx.getActiveSessionId()) {
+    throw new Error("Cannot delete the active session");
+  }
+  await ctx.getSessionStore().delete(sessionId);
+  await ctx.refreshSessions().catch(() => void 0);
+}
+
+// src/server/session-cleanup-scheduler.ts
+var DEFAULT_EMPTY_SESSION_CLEANUP_INTERVAL_MS = 60 * 60 * 1e3;
+var EMPTY_SESSION_CLEANUP_INTERVAL_ENV = "WRONGSTACK_EMPTY_SESSION_CLEANUP_INTERVAL_MS";
+var MAX_SESSION_SCAN = 1e3;
+function resolveEmptySessionCleanupInterval(value = process.env[EMPTY_SESSION_CLEANUP_INTERVAL_ENV]) {
+  if (value === void 0 || value.trim() === "") return DEFAULT_EMPTY_SESSION_CLEANUP_INTERVAL_MS;
+  const parsed = Number(value);
+  return Number.isFinite(parsed) && parsed >= 1e3 ? Math.floor(parsed) : DEFAULT_EMPTY_SESSION_CLEANUP_INTERVAL_MS;
+}
+async function cleanupOwnerlessEmptySessions(ctx) {
+  const store = ctx.getSessionStore();
+  let deleted = 0;
+  let errors = 0;
+  let sessions;
+  try {
+    sessions = await store.list(MAX_SESSION_SCAN);
+  } catch (error2) {
+    errors++;
+    ctx.logger.error("Empty session cleanup failed to list sessions", {
+      event: "webui.empty_session_cleanup_error",
+      phase: "list",
+      message: toErrorMessage(error2)
+    });
+    ctx.logger.info("Empty session cleanup completed", {
+      event: "webui.empty_session_cleanup_completed",
+      deleted,
+      errors
+    });
+    return { deleted, errors };
+  }
+  for (const candidate of sessions) {
+    const sessionId = candidate.id;
+    if (sessionId === ctx.getActiveSessionId() || ctx.hasParticipants(sessionId)) continue;
+    try {
+      if (!store.isEmpty || !await store.isEmpty(sessionId)) continue;
+      if (store !== ctx.getSessionStore() || sessionId === ctx.getActiveSessionId() || ctx.hasParticipants(sessionId)) {
+        continue;
+      }
+      await deleteWebUISession(
+        {
+          getActiveSessionId: ctx.getActiveSessionId,
+          getSessionStore: () => store,
+          refreshSessions: ctx.refreshSessions
+        },
+        sessionId
+      );
+      deleted++;
+    } catch (error2) {
+      errors++;
+      ctx.logger.error("Empty session cleanup failed for session", {
+        event: "webui.empty_session_cleanup_error",
+        phase: "delete",
+        sessionId,
+        message: toErrorMessage(error2)
+      });
+    }
+  }
+  ctx.logger.info("Empty session cleanup completed", {
+    event: "webui.empty_session_cleanup_completed",
+    deleted,
+    errors
+  });
+  return { deleted, errors };
+}
+function scheduleOwnerlessEmptySessionCleanup(ctx, intervalMs = resolveEmptySessionCleanupInterval()) {
+  let running = null;
+  const runNow = () => {
+    if (running) return running;
+    running = cleanupOwnerlessEmptySessions(ctx).finally(() => {
+      running = null;
+    });
+    return running;
+  };
+  const timer = setInterval(() => void runNow(), intervalMs);
+  timer.unref?.();
+  return {
+    dispose: async () => {
+      clearInterval(timer);
+      await running;
+    },
+    runNow
+  };
+}
+
 // src/server/brain-routes.ts
 async function handleBrainRoute(ws, msg, handlers) {
   switch (msg.type) {
@@ -1714,7 +1810,7 @@ function extractCodeMapFileTargets(projectRoot, toolName2, rawInput) {
 
 // src/server/collaboration-ws-handler.ts
 import { randomUUID } from "node:crypto";
-import { toErrorMessage } from "@wrongstack/core/utils";
+import { toErrorMessage as toErrorMessage2 } from "@wrongstack/core/utils";
 var REPLAY_LIMIT = 50;
 var PAUSE_TIMEOUT_MS = 6e4;
 var CollaborationWebSocketHandler = class {
@@ -1749,6 +1845,10 @@ var CollaborationWebSocketHandler = class {
     ws.on("close", () => this.handleDisconnect(ws));
     ws.on("error", () => this.handleDisconnect(ws));
   }
+  /** True while at least one collaboration participant is attached to a session. */
+  hasParticipants(sessionId) {
+    return (this.bySession.get(sessionId)?.size ?? 0) > 0;
+  }
   dispose() {
     for (const off of this.offs) off();
     this.offs.length = 0;
@@ -1866,7 +1966,7 @@ var CollaborationWebSocketHandler = class {
     this.broadcast(sessionId, this.stateMessage(sessionId));
     if (this.reader) {
       this.replayHistory(ws, sessionId).catch((err) => {
-        this.logger.debug?.(`collab: replay failed for ${sessionId}: ${toErrorMessage(err)}`);
+        this.logger.debug?.(`collab: replay failed for ${sessionId}: ${toErrorMessage2(err)}`);
       });
     }
     this.logger.debug?.(`collab: participant ${participant.participantId} joined ${sessionId}`);
@@ -1973,7 +2073,7 @@ var CollaborationWebSocketHandler = class {
         }
       });
     } catch (err) {
-      this.send(ws, this.errorMessage(`annotation rejected: ${toErrorMessage(err)}`));
+      this.send(ws, this.errorMessage(`annotation rejected: ${toErrorMessage2(err)}`));
     }
   }
   async handleResolve(ws, raw) {
@@ -2025,7 +2125,7 @@ var CollaborationWebSocketHandler = class {
         }
       });
     } catch (err) {
-      this.send(ws, this.errorMessage(`resolve failed: ${toErrorMessage(err)}`));
+      this.send(ws, this.errorMessage(`resolve failed: ${toErrorMessage2(err)}`));
     }
   }
   // ── Event subscription (live mirror) ───────────────────────────────────
@@ -2096,7 +2196,7 @@ var CollaborationWebSocketHandler = class {
         seen++;
       }
     } catch (err) {
-      this.logger.debug?.(`collab: session reader rejected ${sessionId}: ${toErrorMessage(err)}`);
+      this.logger.debug?.(`collab: session reader rejected ${sessionId}: ${toErrorMessage2(err)}`);
       return;
     }
     const tail2 = seen <= REPLAY_LIMIT ? ring.slice(0, seen) : (
@@ -2179,7 +2279,7 @@ var CollaborationWebSocketHandler = class {
       try {
         sendSerialized(p.ws, data);
       } catch (err) {
-        this.logger.debug?.(`collab broadcast failed: ${toErrorMessage(err)}`);
+        this.logger.debug?.(`collab broadcast failed: ${toErrorMessage2(err)}`);
       }
     }
   }
@@ -6824,7 +6924,7 @@ import {
   PhaseOrchestrator,
   PhaseStore
 } from "@wrongstack/core/goal";
-import { toErrorMessage as toErrorMessage2 } from "@wrongstack/core/utils";
+import { toErrorMessage as toErrorMessage3 } from "@wrongstack/core/utils";
 import { WorktreeManager } from "@wrongstack/core/worktree";
 
 // src/server/git-process.ts
@@ -7077,7 +7177,7 @@ var GoalWebSocketHandler = class {
       sendResult7(result);
     } catch (err) {
       if (mySeq !== this.assessSeq) return;
-      this.logger.error(`[Goal] Assessment failed: ${toErrorMessage2(err)}`);
+      this.logger.error(`[Goal] Assessment failed: ${toErrorMessage3(err)}`);
       sendResult7({
         realistic: true,
         durationClaimed: null,
@@ -7086,7 +7186,7 @@ var GoalWebSocketHandler = class {
         concerns: [],
         raw: "",
         parseFailed: true,
-        parseError: `Assessment error: ${toErrorMessage2(err)}`
+        parseError: `Assessment error: ${toErrorMessage3(err)}`
       });
     }
   }
@@ -7217,7 +7317,7 @@ Run npx tsc --noEmit to verify the fix. Output the fixed file paths.`;
       );
       this.broadcastState();
     }).catch((err) => {
-      this.logger.error(`[Goal] Aborted: ${toErrorMessage2(err)}`);
+      this.logger.error(`[Goal] Aborted: ${toErrorMessage3(err)}`);
       this.stopBroadcast();
       this.broadcast({ type: "goal.failed", payload: { title, error: String(err) } });
     });
@@ -7343,7 +7443,7 @@ Run npx tsc --noEmit to verify the fix. Output the fixed file paths.`;
       }
       this.logger.info(`[Goal] Planner produced no phases; using defaults for: ${goal}`);
     } catch (err) {
-      this.logger.error(`[Goal] Planning failed, using defaults: ${toErrorMessage2(err)}`);
+      this.logger.error(`[Goal] Planning failed, using defaults: ${toErrorMessage3(err)}`);
     }
     return this.defaultPhases();
   }
@@ -7404,7 +7504,7 @@ ${result_.finalText.slice(0, 2e3)}`
         );
       }
     } catch (err) {
-      this.logger.warn(`[Goal] Chimera review failed for "${task.title}": ${toErrorMessage2(err)}`);
+      this.logger.warn(`[Goal] Chimera review failed for "${task.title}": ${toErrorMessage3(err)}`);
     }
   }
   /**
@@ -9783,6 +9883,16 @@ function createHttpServer(opts) {
         res.end("Unauthorized");
         return;
       }
+      const isMutatingApiRequest = url.pathname.startsWith("/api/") && (req.method === "POST" || req.method === "PUT" || req.method === "PATCH" || req.method === "DELETE");
+      if (isMutatingApiRequest && !req.headers.origin && !accessTokenOk) {
+        res.writeHead(401, { "Content-Type": "application/json", "Cache-Control": "no-store" });
+        res.end(
+          JSON.stringify({
+            error: "Unauthorized: a request without an Origin header must present the access token (X-WS-Token header or ws_token cookie)."
+          })
+        );
+        return;
+      }
       if (shouldSetAuthCookie && opts.apiToken) {
         setAuthCookieHeaders(res, opts.apiToken, secureCookies);
       }
@@ -13560,7 +13670,7 @@ async function handleMemoryRoute(ctx, ws, message) {
 
 // src/server/mode-operations.ts
 import { ToolValidationError as ToolValidationError3 } from "@wrongstack/core/types";
-import { toErrorMessage as toErrorMessage3 } from "@wrongstack/core/utils";
+import { toErrorMessage as toErrorMessage4 } from "@wrongstack/core/utils";
 function sendResult4(context, ws, success, message) {
   context.send(ws, { type: "key.operation_result", payload: { success, message } });
 }
@@ -13592,7 +13702,7 @@ function createModeOperations(context) {
       } catch (error2) {
         context.send(ws, {
           type: "modes.list",
-          payload: { modes: [], activeId: "default", error: toErrorMessage3(error2) }
+          payload: { modes: [], activeId: "default", error: toErrorMessage4(error2) }
         });
       }
     },
@@ -13624,7 +13734,7 @@ function createModeOperations(context) {
         await context.afterSwitch?.(id);
         sendResult4(context, ws, true, `Switched to mode "${id}"`);
       } catch (error2) {
-        sendResult4(context, ws, false, toErrorMessage3(error2));
+        sendResult4(context, ws, false, toErrorMessage4(error2));
       }
     }
   };
@@ -13671,7 +13781,7 @@ import {
   resolveConfiguredRefinerRef,
   resolveEnhanceFallbackRef
 } from "@wrongstack/core/execution";
-import { toErrorMessage as toErrorMessage4 } from "@wrongstack/core/utils";
+import { toErrorMessage as toErrorMessage5 } from "@wrongstack/core/utils";
 function sendResult5(context, ws, payload, legacyResult = false) {
   const message = { type: "model.switch_result", payload };
   if (payload.success && context.broadcast) context.broadcast(message);
@@ -13729,7 +13839,7 @@ function createModelOperations(context) {
           {
             ...requestId ? { requestId } : {},
             success: false,
-            message: `Switch failed: ${toErrorMessage4(error2)}`,
+            message: `Switch failed: ${toErrorMessage5(error2)}`,
             provider,
             model,
             previousProvider,
@@ -13776,7 +13886,7 @@ function createModelOperations(context) {
           payload: {
             refined: text,
             english: text,
-            error: `Cannot use ${payload.provider}/${payload.model}: ${toErrorMessage4(error2)}`,
+            error: `Cannot use ${payload.provider}/${payload.model}: ${toErrorMessage5(error2)}`,
             errorKind: "provider_error",
             ...fallbackRef ? { fallbackRef } : {}
           }
@@ -13874,7 +13984,7 @@ function createModelOperations(context) {
         JSON.stringify({
           level: "error",
           event: "model.refine.error",
-          error: toErrorMessage4(error2),
+          error: toErrorMessage5(error2),
           timestamp: (/* @__PURE__ */ new Date()).toISOString()
         })
       );
@@ -13883,7 +13993,7 @@ function createModelOperations(context) {
         payload: {
           refined: text,
           english: text,
-          error: toErrorMessage4(error2),
+          error: toErrorMessage5(error2),
           errorKind: "provider_error",
           ...fallbackRef ? { fallbackRef } : {}
         }
@@ -14002,7 +14112,7 @@ function formatExternalAccessUrls(opts) {
 
 // src/server/brain-handlers.ts
 import { BUILTIN_COUNCIL_PERSONAS } from "@wrongstack/core/execution";
-import { toErrorMessage as toErrorMessage5 } from "@wrongstack/core/utils";
+import { toErrorMessage as toErrorMessage6 } from "@wrongstack/core/utils";
 var COUNCIL_PERSONA_CATALOG = Object.freeze(
   BUILTIN_COUNCIL_PERSONAS.map(
     (persona) => Object.freeze({
@@ -14091,7 +14201,7 @@ async function handleBrainConfigSet(ctx, ws, payload) {
       payload: {
         config: brainConfigPayload(ctx.brainRuntime),
         persisted: false,
-        error: `Invalid Brain setting: ${toErrorMessage5(err)}`
+        error: `Invalid Brain setting: ${toErrorMessage6(err)}`
       }
     });
   }
@@ -14137,7 +14247,7 @@ async function handleBrainAsk(ctx, ws, question) {
       payload: { sessionId: ctx.getSessionId?.(), question: q, decision }
     });
   } catch (err) {
-    sendResult6(ctx, ws, false, `Brain consultation failed: ${toErrorMessage5(err)}`);
+    sendResult6(ctx, ws, false, `Brain consultation failed: ${toErrorMessage6(err)}`);
   }
 }
 
@@ -14530,7 +14640,6 @@ function seedContextMeta(config, context) {
   const hqConfig = config.hq;
   meta["hqEnabled"] = hqConfig?.enabled === true;
   meta["hqUrl"] = hqConfig?.url ?? "";
-  meta["hqToken"] = hqConfig?.token ?? "";
   meta["hqRawContent"] = hqConfig?.rawContent === true;
   const tgExt = config.extensions?.["telegram"];
   meta["tgConfigured"] = typeof tgExt?.["botToken"] === "string" && tgExt["botToken"].length > 0;
@@ -14624,7 +14733,6 @@ var PREF_KEYS = [
   "auditLevel",
   "hqEnabled",
   "hqUrl",
-  "hqToken",
   "hqRawContent",
   "tgConfigured",
   "tgSessionEnd",
@@ -15421,7 +15529,8 @@ function createProjectHandlers(ctx) {
 // src/server/provider-handlers.ts
 import { hasProviderCredential, resolveProviderModelList } from "@wrongstack/core/models";
 import { DefaultSecretScrubber as DefaultSecretScrubber2 } from "@wrongstack/core/security";
-import { toErrorMessage as toErrorMessage6 } from "@wrongstack/core/utils";
+import { validateProviderBaseUrl } from "@wrongstack/core/tools";
+import { toErrorMessage as toErrorMessage7 } from "@wrongstack/core/utils";
 import {
   beginOAuthLogin
 } from "@wrongstack/providers/oauth";
@@ -16009,6 +16118,13 @@ function createProviderOperations(deps2) {
         sendOperationResult(ws, false, `Unknown provider "${payload.id}"`);
         return;
       }
+      if (payload.baseUrl !== void 0 && payload.baseUrl !== "") {
+        const invalid = validateProviderBaseUrl(payload.baseUrl);
+        if (invalid) {
+          sendOperationResult(ws, false, invalid);
+          return;
+        }
+      }
       if (payload.family !== void 0) cfg.family = payload.family;
       if (payload.baseUrl !== void 0) cfg.baseUrl = payload.baseUrl;
       if (payload.envVars !== void 0) cfg.envVars = payload.envVars;
@@ -16189,7 +16305,7 @@ function createProviderHandlers(deps2) {
           JSON.stringify({
             level: "error",
             event: "webui.provider_save_failed",
-            message: toErrorMessage6(error2),
+            message: toErrorMessage7(error2),
             timestamp: (/* @__PURE__ */ new Date()).toISOString()
           })
         );
@@ -17591,21 +17707,21 @@ function createSessionHandlers(ctx) {
     deleteSession: async (ws, msg) => {
       const { id } = msg.payload;
       try {
-        if (id === ctx.getSession().id) {
-          result(ws, false, "Cannot delete the active session");
-          return;
-        }
-        const store = ctx.getSessionStore();
-        await store.delete(id);
+        await deleteWebUISession(
+          {
+            getActiveSessionId: () => ctx.getSession().id,
+            getSessionStore: ctx.getSessionStore,
+            refreshSessions: async () => {
+              const list = await ctx.getSessionStore().list(200);
+              broadcastToAll({
+                type: "sessions.list",
+                payload: { sessions: toSessionHistoryEntries(list, ctx.getSession().id) }
+              });
+            }
+          },
+          id
+        );
         result(ws, true, `Session ${id} deleted`);
-        try {
-          const list = await store.list(200);
-          broadcastToAll({
-            type: "sessions.list",
-            payload: { sessions: toSessionHistoryEntries(list, ctx.getSession().id) }
-          });
-        } catch {
-        }
       } catch (err) {
         result(ws, false, errMessage(err));
       }
@@ -21259,7 +21375,7 @@ import {
   expectDefined as expectDefined3,
   sessionScopedPath as sessionScopedPath3,
   startSharedHeapWatchdog,
-  toErrorMessage as toErrorMessage13,
+  toErrorMessage as toErrorMessage14,
   wstackGlobalRoot as wstackGlobalRoot2
 } from "@wrongstack/core/utils";
 import { makeProviderFromConfig as makeProviderFromConfig3 } from "@wrongstack/providers";
@@ -21296,7 +21412,7 @@ import {
 } from "@wrongstack/core/types";
 import {
   estimateRequestTokensCalibrated,
-  toErrorMessage as toErrorMessage9
+  toErrorMessage as toErrorMessage10
 } from "@wrongstack/core/utils";
 import { makeLightSubagentFactory } from "@wrongstack/runtime";
 import { getSageService, setupSage } from "@wrongstack/sage";
@@ -21452,7 +21568,7 @@ function sleep(ms) {
 import { spawn as spawnChild } from "node:child_process";
 import { createRequire as createRequire2 } from "node:module";
 import { createCompatibilityTrustBoundary as createCompatibilityTrustBoundary2 } from "@wrongstack/core/security";
-import { buildChildEnv, toErrorMessage as toErrorMessage7 } from "@wrongstack/core/utils";
+import { buildChildEnv, toErrorMessage as toErrorMessage8 } from "@wrongstack/core/utils";
 var MAX_SESSIONS_PER_CLIENT = 8;
 var MAX_INPUT_BYTES = 1 << 16;
 var DEFAULT_COLS = 80;
@@ -21568,8 +21684,8 @@ var TerminalWebSocketHandler = class {
         ...windowsPtyOptions()
       });
     } catch (err) {
-      const msg = `Integrated terminal failed to start: ${toErrorMessage7(err)}`;
-      this.logger.warn?.(`terminal spawn failed: ${toErrorMessage7(err)}`);
+      const msg = `Integrated terminal failed to start: ${toErrorMessage8(err)}`;
+      this.logger.warn?.(`terminal spawn failed: ${toErrorMessage8(err)}`);
       this.send(ws, { type: "terminal.output", payload: { id: payload.id, data: `${msg}\r
 ` } });
       this.send(ws, { type: "terminal.exit", payload: { id: payload.id, exitCode: -1 } });
@@ -21630,7 +21746,7 @@ var TerminalWebSocketHandler = class {
     try {
       pty.kill();
     } catch (err) {
-      this.logger.warn?.(`${reason} failed: ${toErrorMessage7(err)}`);
+      this.logger.warn?.(`${reason} failed: ${toErrorMessage8(err)}`);
     }
   }
   killWindowsProcessTree(pty, reason) {
@@ -21642,7 +21758,7 @@ var TerminalWebSocketHandler = class {
       } catch {
       }
     } catch (err) {
-      this.logger.warn?.(`${reason} taskkill failed: ${toErrorMessage7(err)}`);
+      this.logger.warn?.(`${reason} taskkill failed: ${toErrorMessage8(err)}`);
     }
   }
   send(ws, msg) {
@@ -21689,7 +21805,7 @@ function clampDim(value, fallback) {
 
 // src/server/worktree-ws-handler.ts
 import { join as join11, resolve as resolve13, sep as sep5 } from "node:path";
-import { toErrorMessage as toErrorMessage8 } from "@wrongstack/core/utils";
+import { toErrorMessage as toErrorMessage9 } from "@wrongstack/core/utils";
 import { WorktreeManager as WorktreeManager3 } from "@wrongstack/core/worktree";
 import { cleanupStaleSddWorktrees as cleanupStaleSddWorktrees2 } from "@wrongstack/sdd";
 var MAX_ACTIVITY = 6;
@@ -21855,7 +21971,7 @@ var WorktreeWebSocketHandler = class {
         }
       });
     } catch (err) {
-      this.logger.debug?.(`worktree orphan scan failed: ${toErrorMessage8(err)}`);
+      this.logger.debug?.(`worktree orphan scan failed: ${toErrorMessage9(err)}`);
       this.broadcast({ type: "worktree.orphans", payload: { orphans: [], canClean: false } });
     }
   }
@@ -22117,7 +22233,7 @@ var WorktreeWebSocketHandler = class {
       try {
         sendSerialized(ws, data);
       } catch (err) {
-        this.logger.debug?.(`worktree broadcast failed: ${toErrorMessage8(err)}`);
+        this.logger.debug?.(`worktree broadcast failed: ${toErrorMessage9(err)}`);
       }
     }
   }
@@ -22226,7 +22342,7 @@ async function createAgentServices(input) {
   const updateAutoCompactionMaxContext = async (newProvider, providerId = newProvider.id, providerCfg) => {
     await modelsRegistry.refresh().catch((err) => {
       logger.warn(
-        `models.dev refresh failed for ${providerId}/${context.model}: ${toErrorMessage9(err)}; using cached catalog`
+        `models.dev refresh failed for ${providerId}/${context.model}: ${toErrorMessage10(err)}; using cached catalog`
       );
     });
     const currentConfig = input.config;
@@ -23068,7 +23184,7 @@ import {
 import {
   configureChildEnvGitIdentity,
   sessionScopedPath as sessionScopedPath2,
-  toErrorMessage as toErrorMessage11
+  toErrorMessage as toErrorMessage12
 } from "@wrongstack/core/utils";
 import {
   createVaultBackedMcpAuthorizationProviderFactory,
@@ -23150,7 +23266,7 @@ async function discoverAndMergeWebuiProviders(opts) {
 
 // src/server/setup-screen.ts
 import { expectDefined as expectDefined2 } from "@wrongstack/core/utils";
-import { toErrorMessage as toErrorMessage10 } from "@wrongstack/core/utils";
+import { toErrorMessage as toErrorMessage11 } from "@wrongstack/core/utils";
 import { makeProviderFromConfig } from "@wrongstack/providers";
 var UNCONFIGURED_CAPABILITIES = {
   tools: false,
@@ -23191,7 +23307,7 @@ function logCreateFailure(event, err) {
     JSON.stringify({
       level: "error",
       event,
-      message: toErrorMessage10(err),
+      message: toErrorMessage11(err),
       timestamp: (/* @__PURE__ */ new Date()).toISOString()
     })
   );
@@ -23500,7 +23616,7 @@ async function createPreContextServices(input) {
       await modelsRegistry.refresh();
       logger.info("models.dev catalog refreshed");
     } catch (err) {
-      logger.warn(`models.dev refresh failed (${toErrorMessage11(err)}); using cached catalog`);
+      logger.warn(`models.dev refresh failed (${toErrorMessage12(err)}); using cached catalog`);
     }
   }
   try {
@@ -23511,7 +23627,7 @@ async function createPreContextServices(input) {
       logger
     });
   } catch (err) {
-    logger.debug(`provider auto-discovery skipped: ${toErrorMessage11(err)}`);
+    logger.debug(`provider auto-discovery skipped: ${toErrorMessage12(err)}`);
   }
   try {
     await installCatalogModelOutputLimits({
@@ -23520,7 +23636,7 @@ async function createPreContextServices(input) {
       log: (message) => logger.debug(message)
     });
   } catch (err) {
-    logger.debug(`model output-limit index skipped: ${toErrorMessage11(err)}`);
+    logger.debug(`model output-limit index skipped: ${toErrorMessage12(err)}`);
   }
   const events = opts.services?.events ?? new EventBus();
   events.setLogger(logger);
@@ -23539,7 +23655,7 @@ async function createPreContextServices(input) {
       JSON.stringify({
         level: "warn",
         event: "webui.provider_registry_load_failed",
-        message: toErrorMessage11(err),
+        message: toErrorMessage12(err),
         timestamp: (/* @__PURE__ */ new Date()).toISOString()
       })
     );
@@ -24174,7 +24290,7 @@ function buildRoutes(state, deps2, cb) {
 import { createRequire as createRequire4 } from "node:module";
 import * as path28 from "node:path";
 import { fileURLToPath } from "node:url";
-import { toErrorMessage as toErrorMessage12 } from "@wrongstack/core/utils";
+import { toErrorMessage as toErrorMessage13 } from "@wrongstack/core/utils";
 import { WebSocketServer } from "ws";
 async function resolvePorts(opts) {
   const surface = opts.surface ?? "webui";
@@ -24325,7 +24441,7 @@ function armEvents(wssPrimary, wssSecondary, wsHost, httpPort, setupInput, watch
         level: "error",
         event: "webui.ws_server_error",
         host: wsHost,
-        message: toErrorMessage12(err),
+        message: toErrorMessage13(err),
         timestamp: (/* @__PURE__ */ new Date()).toISOString()
       })
     );
@@ -24972,7 +25088,7 @@ async function startWebUI(opts = {}) {
           console.log(`[WebUI] Provider credentials reloaded from config.json (${activeId})`);
         } catch (err) {
           console.warn(
-            `[WebUI] Credential hot-reload failed for ${activeId}: ${toErrorMessage13(err)}`
+            `[WebUI] Credential hot-reload failed for ${activeId}: ${toErrorMessage14(err)}`
           );
         }
       },
@@ -24995,6 +25111,19 @@ async function startWebUI(opts = {}) {
     })
   });
   const routes = buildRoutes(state, deps2, cb);
+  const stopEmptySessionCleanup = scheduleOwnerlessEmptySessionCleanup({
+    getSessionStore: state.getSessionStore,
+    getActiveSessionId: () => state.getSession().id,
+    hasParticipants: (sessionId) => collabHandler.hasParticipants(sessionId),
+    refreshSessions: async () => {
+      const list = await state.getSessionStore().list(200);
+      broadcast(clients, {
+        type: "sessions.list",
+        payload: { sessions: toSessionHistoryEntries(list, state.getSession().id) }
+      });
+    },
+    logger
+  });
   let kanbanSupervisorDispose = null;
   const handleMessage = createMessageDispatcher({
     state,
@@ -25079,7 +25208,8 @@ projectRoot: ${ev.projectRoot ?? "?"}`,
       wssPrimary,
       ...wssSecondary ? [wssSecondary] : []
     ],
-    onPreShutdown: () => {
+    onPreShutdown: async () => {
+      await stopEmptySessionCleanup.dispose();
       kanbanSupervisorDispose?.();
       kanbanSupervisorDispose = null;
     },
@@ -25106,9 +25236,9 @@ projectRoot: ${ev.projectRoot ?? "?"}`,
         eternalSubscription = null;
       }
       codebaseIndexing.dispose();
-      await agentServices.runSageSessionHygiene().catch((err) => logger.warn(`sage session hygiene failed: ${toErrorMessage13(err)}`));
+      await agentServices.runSageSessionHygiene().catch((err) => logger.warn(`sage session hygiene failed: ${toErrorMessage14(err)}`));
       await memoryStore.dispose().catch(
-        (err) => logger.warn(`sage connection disposal failed: ${toErrorMessage13(err)}`)
+        (err) => logger.warn(`sage connection disposal failed: ${toErrorMessage14(err)}`)
       );
       await unregisterInstance(process.pid, path29.dirname(globalConfigPath));
     }

package/dist/server/index.d.ts

@@ -10,6 +10,8 @@
  */
 export { type AutonomyRouteHandlers, createAutonomyRouteHandlers, handleAutonomyRoute, } from './autonomy-routes.js';
 export { bootConfig, patchConfig } from './boot.js';
+export { cleanupOwnerlessEmptySessions, DEFAULT_EMPTY_SESSION_CLEANUP_INTERVAL_MS, EMPTY_SESSION_CLEANUP_INTERVAL_ENV, resolveEmptySessionCleanupInterval, scheduleOwnerlessEmptySessionCleanup, } from './session-cleanup-scheduler.js';
+export { deleteWebUISession } from './session-deletion.js';
 export type { BrainRouteHandlers } from './brain-routes.js';
 export { handleBrainRoute } from './brain-routes.js';
 export { type ChronicleRouteContext, handleChronicleRoute, } from './chronicle-routes.js';

package/dist/server/pref-helpers.d.ts

@@ -17,7 +17,7 @@
  */
 import type { SecretVault } from '@wrongstack/core/types';
 /** Pref keys exposed to the settings panel via prefs.get / prefs.updated. */
-export declare const PREF_KEYS: readonly ['autonomy', 'autonomyDelayMs', 'autoProceedMaxIterations', 'yolo', 'maxIterations', 'chime', 'confirmExit', 'nextPrediction', 'nextStepsTool', 'enhanceEnabled', 'enhanceDelayMs', 'enhanceLanguage', 'featureMcp', 'featurePlugins', 'featureMemory', 'featureSkills', 'featureModelsRegistry', 'indexOnStart', 'contextAutoCompact', 'contextStrategy', 'contextMode', 'tokenSavingTier', 'maxConcurrent', 'titleAnimation', 'uiLocale', 'logLevel', 'auditLevel', 'hqEnabled', 'hqUrl', 'hqToken', 'hqRawContent', 'tgConfigured', 'tgSessionEnd', 'tgDelegate', 'tgLongToolMs', 'reasoningMode', 'reasoningEffort', 'reasoningPreserve', 'cacheTtl', 'fallbackModels', 'fallbackProfiles', 'favoriteModels', 'favoriteModelsOnly', 'modelAvailabilitySchedule', 'modelMatrix', 'fallbackAuto', 'refinerProvider', 'refinerModel', 'refinerFallbackProfile', 'thinkingWord', 'statuslineMode', 'animationStyle', 'showModelReasoning', 'breakerEnabled', 'breakerAutoKillResetMs', 'fsAccess', 'debugStream', 'chimeraEnabled', 'chimeraProvider', 'chimeraModel', 'chimeraMaxFiles', 'chimeraAutoFix', 'autoReviewEnabled', 'autoReviewProvider', 'autoReviewModel', 'autoReviewFallbackProfile', 'autoReviewModelSelection', 'autoReviewFallbackModels', 'autoReviewDebounceMs', 'autoReviewMaxFilesPerBatch', 'autoReviewMaxConcurrentReviews', 'autoReviewCascadeOn', 'groupToolCalls', 'showThinkingLogs', 'autoCollapseInput', 'pluginsEnabled', 'fleetChatVerbosity'];
+export declare const PREF_KEYS: readonly ['autonomy', 'autonomyDelayMs', 'autoProceedMaxIterations', 'yolo', 'maxIterations', 'chime', 'confirmExit', 'nextPrediction', 'nextStepsTool', 'enhanceEnabled', 'enhanceDelayMs', 'enhanceLanguage', 'featureMcp', 'featurePlugins', 'featureMemory', 'featureSkills', 'featureModelsRegistry', 'indexOnStart', 'contextAutoCompact', 'contextStrategy', 'contextMode', 'tokenSavingTier', 'maxConcurrent', 'titleAnimation', 'uiLocale', 'logLevel', 'auditLevel', 'hqEnabled', 'hqUrl', 'hqRawContent', 'tgConfigured', 'tgSessionEnd', 'tgDelegate', 'tgLongToolMs', 'reasoningMode', 'reasoningEffort', 'reasoningPreserve', 'cacheTtl', 'fallbackModels', 'fallbackProfiles', 'favoriteModels', 'favoriteModelsOnly', 'modelAvailabilitySchedule', 'modelMatrix', 'fallbackAuto', 'refinerProvider', 'refinerModel', 'refinerFallbackProfile', 'thinkingWord', 'statuslineMode', 'animationStyle', 'showModelReasoning', 'breakerEnabled', 'breakerAutoKillResetMs', 'fsAccess', 'debugStream', 'chimeraEnabled', 'chimeraProvider', 'chimeraModel', 'chimeraMaxFiles', 'chimeraAutoFix', 'autoReviewEnabled', 'autoReviewProvider', 'autoReviewModel', 'autoReviewFallbackProfile', 'autoReviewModelSelection', 'autoReviewFallbackModels', 'autoReviewDebounceMs', 'autoReviewMaxFilesPerBatch', 'autoReviewMaxConcurrentReviews', 'autoReviewCascadeOn', 'groupToolCalls', 'showThinkingLogs', 'autoCollapseInput', 'pluginsEnabled', 'fleetChatVerbosity'];
 export interface PrefHelperDeps {
     /** Path to the active profile config; the sole settings mutation target. */
     profileConfigPath: string;

package/dist/server/server-runtime.d.ts

@@ -14,7 +14,7 @@ import type { Config, ModelsRegistry } from '@wrongstack/core/types';
 import { type WebSocket, WebSocketServer } from 'ws';
 import { type FileWatcherMetrics, setupEvents } from './setup-events.js';
 import type { ConnectedClient } from './types.js';
-interface ResolvedPorts {
+export interface ResolvedPorts {
     wsHost: string;
     httpPort: number;
     publicUrl: string | undefined;