@wrongstack/webui-server 0.308.0 → 0.308.2

package/dist/server/entry.js

@@ -7290,11 +7290,11 @@ async function handleGitDiff(ws, projectRoot, path34) {
   try {
     const git = makeGit(cwd);
     const { readFile: readFile11 } = await import("node:fs/promises");
-    const { join: join15 } = await import("node:path");
+    const { join: join16 } = await import("node:path");
     const oldText = await git(["show", `HEAD:${path34}`]);
     let newText = "";
     try {
-      const abs = cwd ? join15(cwd, path34) : path34;
+      const abs = cwd ? join16(cwd, path34) : path34;
       const buf = await readFile11(abs);
       if (buf.includes(0)) {
         reply2({ oldText: "", newText: "", binary: true });
@@ -10317,6 +10317,7 @@ function strictDecodeParam(segment, res) {
 }
 
 // src/server/http-server/vector-memory-handlers.ts
+import { getSageSurface } from "@wrongstack/sage";
 import { sanitizeApiError as sanitizeApiError2 } from "@wrongstack/core/security";
 function snapshotVectorMemory(store, opts = {}) {
   const stats = store.stats();
@@ -10326,6 +10327,9 @@ function snapshotVectorMemory(store, opts = {}) {
     stats
   };
 }
+function snapshotVectorMemoryCache(store) {
+  return store.cacheStats();
+}
 async function handleVectorMemoryStatus(res, getStore, opts = {}) {
   const store = getStore();
   if (!store) {
@@ -10345,7 +10349,8 @@ async function handleVectorMemoryStatus(res, getStore, opts = {}) {
       dimensions: snap.stats.dimensions,
       entries: snap.stats.entries,
       vectors: snap.stats.vectors,
-      providers: snap.stats.providers
+      providers: snap.stats.providers,
+      cache: snapshotVectorMemoryCache(store)
     };
     res.writeHead(200, { "Content-Type": "application/json", "Cache-Control": "no-store" });
     res.end(JSON.stringify(body));
@@ -10365,7 +10370,29 @@ function parseSearchParams(url) {
   const limit = Math.min(50, Math.max(1, Number.isFinite(rawLimit) ? rawLimit : 10));
   const rawThreshold = url.searchParams.get("threshold");
   const threshold = rawThreshold !== null && rawThreshold !== "" ? Math.max(0, Math.min(1, Number.parseFloat(rawThreshold))) : void 0;
-  return { query, limit, threshold: Number.isFinite(threshold) ? threshold : void 0 };
+  const similarity = url.searchParams.get("similarity") === "1";
+  return { query, limit, threshold: Number.isFinite(threshold) ? threshold : void 0, similarity };
+}
+function cosineMatrix(vectors) {
+  const n = vectors.length;
+  const out = new Array(n);
+  for (let i = 0; i < n; i++) {
+    out[i] = new Array(n).fill(0);
+  }
+  for (let i = 0; i < n; i++) {
+    out[i][i] = 1;
+    for (let j = i + 1; j < n; j++) {
+      const a = vectors[i];
+      const b = vectors[j];
+      let dot = 0;
+      const len = Math.min(a.length, b.length);
+      for (let k = 0; k < len; k++) dot += (a[k] ?? 0) * (b[k] ?? 0);
+      const score = Math.max(0, Math.min(1, dot));
+      out[i][j] = score;
+      out[j][i] = score;
+    }
+  }
+  return out;
 }
 async function handleVectorMemorySearch(res, url, getStore) {
   const store = getStore();
@@ -10374,7 +10401,7 @@ async function handleVectorMemorySearch(res, url, getStore) {
     res.end(JSON.stringify({ error: "Vector memory not enabled in this host" }));
     return;
   }
-  const { query, limit, threshold } = parseSearchParams(url);
+  const { query, limit, threshold, similarity } = parseSearchParams(url);
   if (query.trim().length === 0) {
     res.writeHead(400, { "Content-Type": "application/json" });
     res.end(JSON.stringify({ error: "Missing required query parameter `q`" }));
@@ -10383,7 +10410,8 @@ async function handleVectorMemorySearch(res, url, getStore) {
   try {
     const hits = await store.search(query, {
       limit,
-      ...threshold !== void 0 ? { threshold } : {}
+      ...threshold !== void 0 ? { threshold } : {},
+      includeVectors: similarity
     });
     const body = {
       hits: hits.map((h) => ({
@@ -10395,6 +10423,12 @@ async function handleVectorMemorySearch(res, url, getStore) {
       })),
       count: hits.length
     };
+    if (similarity && hits.length > 1) {
+      const vecs = hits.map((h) => h.vector).filter((v) => v !== void 0);
+      if (vecs.length === hits.length) {
+        body.similarity = cosineMatrix(vecs);
+      }
+    }
     res.writeHead(200, { "Content-Type": "application/json", "Cache-Control": "no-store" });
     res.end(JSON.stringify(body));
   } catch (error2) {
@@ -10479,7 +10513,7 @@ async function handleVectorMemoryForget(res, url, getStore) {
   const id = match ? strictDecodeParam(decodeSessionId(match[1]), res) : null;
   if (id === null) return;
   try {
-    const removed = store.forget(id);
+    const removed = await store.forget(id);
     res.writeHead(200, { "Content-Type": "application/json" });
     res.end(JSON.stringify({ removed }));
   } catch (error2) {
@@ -10492,6 +10526,86 @@ async function handleVectorMemoryForget(res, url, getStore) {
     );
   }
 }
+function parseMemorySearchParams(url) {
+  const query = url.searchParams.get("q") ?? "";
+  const rawLimit = Number.parseInt(url.searchParams.get("limit") ?? "20", 10);
+  const limit = Math.min(50, Math.max(1, Number.isFinite(rawLimit) ? rawLimit : 20));
+  const explain = url.searchParams.get("explain") === "1";
+  return { query, limit, explain };
+}
+async function handleMemorySearch(res, url, getStore) {
+  const store = getStore();
+  if (!store) {
+    res.writeHead(503, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ error: "Memory store not enabled in this host" }));
+    return;
+  }
+  const { query, limit, explain } = parseMemorySearchParams(url);
+  if (query.trim().length === 0) {
+    res.writeHead(400, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ error: "Missing required query parameter `q`" }));
+    return;
+  }
+  const Sage = getSageSurface(store);
+  if (!Sage) {
+    res.writeHead(503, { "Content-Type": "application/json" });
+    res.end(
+      JSON.stringify({
+        error: "Memory search requires the SAGE surface (this host does not expose it)."
+      })
+    );
+    return;
+  }
+  try {
+    let payload;
+    if (explain && typeof Sage.searchSageWithBreakdown === "function") {
+      const hits = await Sage.searchSageWithBreakdown(query, { limit });
+      payload = {
+        count: hits.length,
+        channel: "breakdown",
+        hits: hits.map((h) => ({
+          id: h.memory.id,
+          text: h.memory.text,
+          kind: h.memory.kind,
+          status: h.memory.status,
+          tags: h.memory.tags ?? [],
+          lexicalScore: h.lexicalScore,
+          vectorScore: h.vectorScore,
+          finalScore: h.finalScore,
+          source: h.source
+        }))
+      };
+    } else {
+      const rows = await Sage.searchSage(query, { limit });
+      const total = rows.length;
+      payload = {
+        count: total,
+        channel: "lexical",
+        hits: rows.map((memory, index) => ({
+          id: memory.id,
+          text: memory.text,
+          kind: memory.kind,
+          status: memory.status,
+          tags: memory.tags ?? [],
+          lexicalScore: total <= 1 ? 1 : 1 - index / Math.max(1, total - 1),
+          vectorScore: null,
+          finalScore: total <= 1 ? 1 : 1 - index / Math.max(1, total - 1),
+          source: "lexical"
+        }))
+      };
+    }
+    res.writeHead(200, { "Content-Type": "application/json", "Cache-Control": "no-store" });
+    res.end(JSON.stringify(payload));
+  } catch (error2) {
+    res.writeHead(500, { "Content-Type": "application/json" });
+    res.end(
+      JSON.stringify({
+        error: "Memory search failed",
+        detail: sanitizeApiError2(error2)
+      })
+    );
+  }
+}
 
 // src/server/http-server/api-router.ts
 async function handleApiRoutes(req, res, url, deps2, requireAccessToken, accessTokenOk, getTechStackRuntime) {
@@ -10942,6 +11056,15 @@ async function handleApiRoutes(req, res, url, deps2, requireAccessToken, accessT
     await handleVectorMemoryStore(res, req, () => deps2.getVectorMemoryStore?.());
     return true;
   }
+  if (url.pathname === "/api/memory/search" && req.method === "GET") {
+    if (requireAccessToken && !accessTokenOk) {
+      res.writeHead(401, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ error: "Unauthorized" }));
+      return true;
+    }
+    await handleMemorySearch(res, url, () => deps2.getMemoryStore?.());
+    return true;
+  }
   if (url.pathname === "/api/deadcode/action-plan" && req.method === "POST") {
     await handleDeadCodeActionPlan(
       res,
@@ -11106,12 +11229,15 @@ function createHttpServer(opts) {
         distDir,
         url,
         opts,
-        port,
+        // Live port from the socket: the bind may have advanced past an
+        // EADDRINUSE (listenWithRetry) after this server was constructed,
+        // and the CSP must advertise the port actually serving this request.
+        res.socket?.localPort ?? port,
         shouldSetAuthCookie
       );
     } catch (err) {
       if (err.code === "ENOENT") {
-        await handleSpaFallback(res, distDir, opts, port);
+        await handleSpaFallback(res, distDir, opts, res.socket?.localPort ?? port);
       } else {
         console.error({ url: req.url, err });
         res.writeHead(500);
@@ -13896,13 +14022,13 @@ async function handleMcpRoute(ws, msg, handlers) {
 }
 
 // src/server/memory-handlers.ts
-import { getSageSurface } from "@wrongstack/sage";
+import { getSageSurface as getSageSurface2 } from "@wrongstack/sage";
 function requiresSage(command) {
   return `\`${command}\` requires the SAGE backend (Sage.enabled).`;
 }
 async function handleMemoryList(ws, memoryStore) {
   try {
-    const Sage = getSageSurface(memoryStore);
+    const Sage = getSageSurface2(memoryStore);
     if (Sage) {
       const [stats, memories] = await Promise.all([Sage.stats(), Sage.listSage()]);
       const text2 = memories.length === 0 ? "\u{1F9E0} SAGE is empty." : formatSageText(stats, memories);
@@ -13937,7 +14063,7 @@ function formatSageText(stats, memories) {
   return lines.join("\n");
 }
 async function handleSageList(ws, memoryStore) {
-  const Sage = getSageSurface(memoryStore);
+  const Sage = getSageSurface2(memoryStore);
   if (!Sage) {
     send(ws, {
       type: "memory.sage.list",
@@ -13953,7 +14079,7 @@ async function handleSageList(ws, memoryStore) {
   }
 }
 async function handleSageListPage(ws, msg, memoryStore) {
-  const Sage = getSageSurface(memoryStore);
+  const Sage = getSageSurface2(memoryStore);
   if (!Sage) {
     send(ws, {
       type: "memory.sage.listPage",
@@ -14003,8 +14129,50 @@ async function handleSageListPage(ws, msg, memoryStore) {
     send(ws, { type: "memory.sage.listPage", payload: { error: errMessage(err) } });
   }
 }
+async function handleSageSearchBreakdown(ws, msg, memoryStore) {
+  const Sage = getSageSurface2(memoryStore);
+  if (!Sage) {
+    send(ws, {
+      type: "memory.sage.searchBreakdown",
+      payload: { error: requiresSage("memory.sage.searchBreakdown") }
+    });
+    return;
+  }
+  try {
+    const payload = msg.payload ?? {};
+    const query = typeof payload["query"] === "string" ? payload["query"] : "";
+    if (query.trim().length === 0) {
+      send(ws, {
+        type: "memory.sage.searchBreakdown",
+        payload: { error: "Missing required field `query`" }
+      });
+      return;
+    }
+    const limit = typeof payload["limit"] === "number" ? payload["limit"] : 20;
+    const includeStale = payload["includeStale"] === true;
+    const includeStatuses = includeStale ? ["active", "stale"] : ["active"];
+    const options = { limit, includeStatuses };
+    if (typeof Sage.searchSageWithBreakdown === "function") {
+      const hits2 = await Sage.searchSageWithBreakdown(query, options);
+      send(ws, { type: "memory.sage.searchBreakdown", payload: { hits: hits2, source: "breakdown" } });
+      return;
+    }
+    const rows = await Sage.searchSage(query, options);
+    const total = rows.length;
+    const hits = rows.map((memory, index) => ({
+      memory,
+      vectorScore: null,
+      lexicalScore: total <= 1 ? 1 : 1 - index / Math.max(1, total - 1),
+      finalScore: total <= 1 ? 1 : 1 - index / Math.max(1, total - 1),
+      source: "lexical"
+    }));
+    send(ws, { type: "memory.sage.searchBreakdown", payload: { hits, source: "lexical" } });
+  } catch (err) {
+    send(ws, { type: "memory.sage.searchBreakdown", payload: { error: errMessage(err) } });
+  }
+}
 async function handleSageGet(ws, msg, memoryStore) {
-  const Sage = getSageSurface(memoryStore);
+  const Sage = getSageSurface2(memoryStore);
   if (!Sage) {
     send(ws, {
       type: "memory.sage.get",
@@ -14029,7 +14197,7 @@ async function handleSageGet(ws, msg, memoryStore) {
   }
 }
 async function handleSageGraph(ws, msg, memoryStore) {
-  const Sage = getSageSurface(memoryStore);
+  const Sage = getSageSurface2(memoryStore);
   if (!Sage?.graphFor) {
     send(ws, {
       type: "memory.sage.graph",
@@ -14063,7 +14231,7 @@ async function handleSageGraph(ws, msg, memoryStore) {
   }
 }
 async function handleSageUpdate(ws, msg, memoryStore) {
-  const Sage = getSageSurface(memoryStore);
+  const Sage = getSageSurface2(memoryStore);
   if (!Sage) {
     send(ws, {
       type: "memory.sage.update",
@@ -14091,7 +14259,7 @@ async function handleSageUpdate(ws, msg, memoryStore) {
   }
 }
 async function handleSageRemember(ws, msg, memoryStore) {
-  const Sage = getSageSurface(memoryStore);
+  const Sage = getSageSurface2(memoryStore);
   if (!Sage) {
     send(ws, {
       type: "memory.sage.remember",
@@ -14125,7 +14293,7 @@ async function handleSageRemember(ws, msg, memoryStore) {
   }
 }
 async function handleSageDelete(ws, msg, memoryStore) {
-  const Sage = getSageSurface(memoryStore);
+  const Sage = getSageSurface2(memoryStore);
   if (!Sage) {
     send(ws, {
       type: "memory.sage.delete",
@@ -14158,7 +14326,7 @@ async function handleSageDelete(ws, msg, memoryStore) {
   }
 }
 async function handleSageRecover(ws, msg, memoryStore) {
-  const Sage = getSageSurface(memoryStore);
+  const Sage = getSageSurface2(memoryStore);
   if (!Sage?.recoverSage) {
     send(ws, {
       type: "memory.sage.recover",
@@ -14202,7 +14370,7 @@ async function handleSageRecover(ws, msg, memoryStore) {
   }
 }
 async function handleSageListCandidates(ws, msg, memoryStore) {
-  const Sage = getSageSurface(memoryStore);
+  const Sage = getSageSurface2(memoryStore);
   if (!Sage) {
     send(ws, {
       type: "memory.sage.listCandidates",
@@ -14230,7 +14398,7 @@ async function handleSageListCandidates(ws, msg, memoryStore) {
   }
 }
 async function handleSageCandidateResolve(ws, msg, memoryStore) {
-  const Sage = getSageSurface(memoryStore);
+  const Sage = getSageSurface2(memoryStore);
   if (!Sage) {
     send(ws, {
       type: "memory.sage.candidateResolve",
@@ -14287,7 +14455,7 @@ async function handleSageCandidateResolve(ws, msg, memoryStore) {
   }
 }
 async function handleSageBackfillRecoverable(ws, msg, memoryStore) {
-  const Sage = getSageSurface(memoryStore);
+  const Sage = getSageSurface2(memoryStore);
   if (!Sage?.backfillRecoverable) {
     send(ws, {
       type: "memory.sage.backfillRecoverable",
@@ -14327,7 +14495,7 @@ async function handleSageBackfillRecoverable(ws, msg, memoryStore) {
   }
 }
 async function handleSageForFile(ws, msg, memoryStore) {
-  const Sage = getSageSurface(memoryStore);
+  const Sage = getSageSurface2(memoryStore);
   if (!Sage?.findMemoriesForFile) {
     send(ws, {
       type: "memory.sage.forFile",
@@ -14419,6 +14587,9 @@ async function handleMemoryRoute(ctx, ws, message) {
     case "memory.sage.forFile":
       await handleSageForFile(ws, message, store);
       return true;
+    case "memory.sage.searchBreakdown":
+      await handleSageSearchBreakdown(ws, message, store);
+      return true;
     default:
       return false;
   }
@@ -14762,17 +14933,25 @@ function createModelOperations(context) {
 // src/server/port-utils.ts
 import * as net2 from "node:net";
 import { ToolValidationError as ToolValidationError4 } from "@wrongstack/core/types";
+var MAX_TCP_PORT = 65535;
+function isStrictPort() {
+  const value = process.env["WEBUI_STRICT_PORT"];
+  return value === "1" || value === "true";
+}
 function isPortFree(host, port) {
+  return probePort(host, port).then((err) => err === null);
+}
+function probePort(host, port) {
   return new Promise((resolve19) => {
     const srv = net2.createServer();
-    srv.once("error", () => resolve19(false));
+    srv.once("error", (err) => resolve19(err));
     srv.once("listening", () => {
-      srv.close(() => resolve19(true));
+      srv.close(() => resolve19(null));
     });
     try {
       srv.listen(port, host);
-    } catch {
-      resolve19(false);
+    } catch (err) {
+      resolve19(err);
     }
   });
 }
@@ -14781,7 +14960,7 @@ async function findFreePort(host, startPort, opts = {}) {
   const maxTries = opts.maxTries ?? 200;
   let port = startPort;
   for (let i = 0; i < maxTries; i++) {
-    if (port > 65535) port = 1024 + port % 5e4;
+    if (port > MAX_TCP_PORT) port = 1024 + port % 5e4;
     if (!exclude.has(port) && await isPortFree(host, port)) {
       return port;
     }
@@ -14792,6 +14971,50 @@ async function findFreePort(host, startPort, opts = {}) {
     field: "port"
   });
 }
+function listenWithRetry(server, host, port, opts = {}) {
+  const maxTries = opts.maxTries ?? 10;
+  return new Promise((resolve19, reject) => {
+    const canAdvance = (candidate) => candidate < MAX_TCP_PORT;
+    const probeable = (candidate) => Number.isInteger(candidate) && candidate >= 0 && candidate <= MAX_TCP_PORT;
+    const attempt = (candidate, remaining) => {
+      void (async () => {
+        if (probeable(candidate)) {
+          const probeErr = await probePort(host, candidate);
+          if (probeErr !== null) {
+            if (probeErr.code === "EADDRINUSE" && remaining > 1 && canAdvance(candidate)) {
+              attempt(candidate + 1, remaining - 1);
+              return;
+            }
+            reject(probeErr);
+            return;
+          }
+        }
+        const onError = (err) => {
+          server.off("listening", onListening);
+          server.off("error", onError);
+          if (err.code === "EADDRINUSE" && remaining > 1 && canAdvance(candidate)) {
+            attempt(candidate + 1, remaining - 1);
+            return;
+          }
+          reject(err);
+        };
+        const onListening = () => {
+          server.off("error", onError);
+          const address = server.address();
+          resolve19(address && typeof address === "object" ? address.port : candidate);
+        };
+        server.once("error", onError);
+        server.once("listening", onListening);
+        try {
+          server.listen(candidate, host);
+        } catch (err) {
+          onError(err);
+        }
+      })();
+    };
+    attempt(port, maxTries);
+  });
+}
 
 // src/server/intake-service.ts
 import { resolveWstackPaths as resolveWstackPaths5 } from "@wrongstack/core/utils";
@@ -14994,9 +15217,19 @@ async function handleBrainAsk(ctx, ws, question) {
       risk: "medium",
       fallback: "ask_human"
     });
+    const answerSessionId = ctx.getSessionId?.();
     ctx.send(ws, {
       type: "brain.answer",
-      payload: { sessionId: ctx.getSessionId?.(), question: q, decision }
+      // Omit sessionId when there is no session: this is a direct reply to
+      // the asker, not a broadcast, but the client's session gate
+      // (isActiveSessionMessage) is fail-closed on a present-but-empty
+      // sessionId — stamping '' would hide the answer from its own asker
+      // in an embedded host with an unbound agent context.
+      payload: {
+        ...answerSessionId ? { sessionId: answerSessionId } : {},
+        question: q,
+        decision
+      }
     });
   } catch (err) {
     sendResult6(ctx, ws, false, `Brain consultation failed: ${toErrorMessage6(err)}`);
@@ -17080,7 +17313,12 @@ function createProviderHandlers(deps2) {
 
 // src/server/session-handlers.ts
 import { loadTodosCheckpoint } from "@wrongstack/core/storage";
-import { DEFAULT_CONTEXT_WINDOW_MODE_ID, resolveContextWindowPolicy } from "@wrongstack/core/types";
+import {
+  CONTEXT_WINDOW_MODE_PINNED_META_KEY,
+  DEFAULT_CONTEXT_WINDOW_MODE_ID,
+  isContextWindowModeId,
+  resolveContextWindowPolicy
+} from "@wrongstack/core/types";
 import { repairToolUseAdjacency as repairToolUseAdjacency2, sessionScopedPath } from "@wrongstack/core/utils";
 
 // src/protocol/client-conversation.ts
@@ -17177,6 +17415,7 @@ var CLIENT_KNOWLEDGE_MESSAGE_TYPES = [
   "memory.sage.listPage",
   "memory.sage.recover",
   "memory.sage.remember",
+  "memory.sage.searchBreakdown",
   "memory.sage.update"
 ];
 var CLIENT_EXTENSION_MESSAGE_TYPES = [
@@ -17464,6 +17703,7 @@ var SERVER_KNOWLEDGE_MESSAGE_TYPES = [
   "memory.sage.listPage",
   "memory.sage.recover",
   "memory.sage.remember",
+  "memory.sage.searchBreakdown",
   "memory.sage.update"
 ];
 var SERVER_EXTENSION_MESSAGE_TYPES = [
@@ -17600,6 +17840,7 @@ var SERVER_WORKSPACE_MESSAGE_TYPES = [
 var SERVER_CONFIGURATION_MESSAGE_TYPES = [
   "auth.oauth.status",
   "codebase.index.server.shutdown_result",
+  "connections.auto_heal_status",
   "connections.health_error",
   "connections.health_result",
   "connections.service_action_result",
@@ -18150,7 +18391,12 @@ function createSessionHandlers(ctx) {
       sessionScopedPath(sessionsDirectory(), next.id, ".tasks.json")
     );
     ctx.tokenCounter.reset?.();
-    if (usage) ctx.tokenCounter.account(usage, currentConfig().model, ctx.context.provider.id);
+    if (usage) {
+      ctx.tokenCounter.account(usage, currentConfig().model, ctx.context.provider.id);
+      if (typeof usage.input === "number" && usage.input > 0) {
+        ctx.context.lastRequestTokens = usage.input;
+      }
+    }
     ctx.setSessionStartedAt?.(Date.now());
     await ctx.onSessionSwapped?.(next.id);
   };
@@ -18373,8 +18619,8 @@ function createSessionHandlers(ctx) {
         return;
       }
       const { id } = parsed.value;
-      let policy = resolveContextWindowPolicy({}, id);
-      if (policy.id !== id) {
+      let policy = resolveContextWindowPolicy({}, id, readSessionWindowTokens(ctx.context));
+      if (!isContextWindowModeId(id) && policy.id !== id) {
         const customModes = (await modeStore()).list().filter((m) => m.custom === true);
         const custom = customModes.find((m) => m.id === id);
         if (!custom) {
@@ -18385,6 +18631,7 @@ function createSessionHandlers(ctx) {
       }
       ctx.context.meta["contextWindowMode"] = policy.id;
       ctx.context.meta["contextWindowPolicy"] = policy;
+      ctx.context.meta[CONTEXT_WINDOW_MODE_PINNED_META_KEY] = true;
       result(ws, true, `Context mode switched to ${policy.id}`);
       broadcastToAll({
         type: "context.mode.changed",
@@ -18448,11 +18695,14 @@ function createSessionHandlers(ctx) {
       }
       const { id } = parsed.value;
       if (String(ctx.context.meta["contextWindowMode"] ?? "") === id) {
-        ctx.context.meta["contextWindowMode"] = DEFAULT_CONTEXT_WINDOW_MODE_ID;
-        ctx.context.meta["contextWindowPolicy"] = resolveContextWindowPolicy(
+        const policy = resolveContextWindowPolicy(
           {},
-          DEFAULT_CONTEXT_WINDOW_MODE_ID
+          DEFAULT_CONTEXT_WINDOW_MODE_ID,
+          readSessionWindowTokens(ctx.context)
         );
+        ctx.context.meta["contextWindowMode"] = policy.id;
+        ctx.context.meta["contextWindowPolicy"] = policy;
+        delete ctx.context.meta[CONTEXT_WINDOW_MODE_PINNED_META_KEY];
       }
       const store = await modeStore();
       const operation = store.remove(id);
@@ -18659,6 +18909,12 @@ function createSessionHandlers(ctx) {
     }
   };
 }
+function readSessionWindowTokens(context) {
+  const meta = context.meta?.["effectiveMaxContext"];
+  if (typeof meta === "number" && Number.isFinite(meta) && meta > 0) return meta;
+  const cap = context.provider?.capabilities?.maxContext;
+  return typeof cap === "number" && Number.isFinite(cap) && cap > 0 ? cap : 0;
+}
 
 // src/server/agent-roster-handlers.ts
 import {
@@ -19157,6 +19413,259 @@ async function handleCodebaseIndexServerControl(ws, message, deps2) {
   return true;
 }
 
+// src/server/connections/auto-healer.ts
+var AUTO_HEAL_ENV_FLAG = "WRONGSTACK_AUTO_HEAL_SERVICES";
+var AUTO_HEAL_DEFAULT_INTERVAL_MS = 3e4;
+var AUTO_HEAL_DEFAULT_COOLDOWN_MS = 5 * 6e4;
+var AUTO_HEAL_DEFAULT_MAX_ATTEMPTS = 3;
+var RESTARTABLE_SERVICE_IDS = /* @__PURE__ */ new Set([
+  "kanban",
+  "sage",
+  "chronicle",
+  "codebase-index",
+  "mailbox"
+]);
+function isAutoHealEnabled() {
+  return process.env[AUTO_HEAL_ENV_FLAG] === "1";
+}
+function createAutoHealer(options) {
+  const enabled = options.enabled ?? isAutoHealEnabled();
+  const intervalMs = options.intervalMs ?? AUTO_HEAL_DEFAULT_INTERVAL_MS;
+  const cooldownMs = options.cooldownMs ?? AUTO_HEAL_DEFAULT_COOLDOWN_MS;
+  const maxAttempts = options.maxAttempts ?? AUTO_HEAL_DEFAULT_MAX_ATTEMPTS;
+  const collect = options.collect ?? (() => collectConnectionsHealth({
+    projectRoot: options.projectRoot(),
+    indexDir: options.indexDir(),
+    backend: "standalone"
+  }));
+  const execute = options.execute ?? executeServiceAction;
+  const services = /* @__PURE__ */ new Map();
+  let timer = null;
+  let running = false;
+  let ticking = false;
+  let disposed = false;
+  let inFlightTick = null;
+  let lastTickAt = null;
+  let warnedNoBoundary = false;
+  function stateFor(serviceId) {
+    let state = services.get(serviceId);
+    if (!state) {
+      state = {
+        lastAttemptAt: null,
+        consecutiveFailures: 0,
+        lastSuccess: null,
+        lastMessage: null,
+        inFlight: false,
+        escalated: false
+      };
+      services.set(serviceId, state);
+    }
+    return state;
+  }
+  function snapshot() {
+    return {
+      enabled,
+      running,
+      lastTickAt,
+      services: Object.fromEntries(services)
+    };
+  }
+  function emitStatus(event) {
+    try {
+      options.onStatus?.({ ...event, at: Date.now() });
+    } catch (error2) {
+      options.logger?.warn?.(
+        `[AutoHeal] onStatus hook threw: ${error2 instanceof Error ? error2.message : String(error2)}`
+      );
+    }
+  }
+  async function tick() {
+    if (!enabled || disposed) return snapshot();
+    if (!options.trustBoundary) {
+      if (!warnedNoBoundary) {
+        warnedNoBoundary = true;
+        options.logger?.warn?.(
+          "[AutoHeal] Disabled: no policy authority (trust boundary) is configured."
+        );
+      }
+      return snapshot();
+    }
+    if (ticking) return snapshot();
+    ticking = true;
+    try {
+      const report = await collect();
+      const now = Date.now();
+      const projectRoot = options.projectRoot();
+      const indexDir = options.indexDir();
+      for (const service of report.services) {
+        if (disposed) break;
+        const state = stateFor(service.id);
+        if (service.status !== "error") {
+          state.consecutiveFailures = 0;
+          state.escalated = false;
+          continue;
+        }
+        if (!RESTARTABLE_SERVICE_IDS.has(service.id) || service.control === "none") {
+          continue;
+        }
+        if (state.lastAttemptAt !== null && now - state.lastAttemptAt < cooldownMs) continue;
+        if (state.consecutiveFailures >= maxAttempts) {
+          state.escalated = true;
+          options.logger?.warn?.(
+            `[AutoHeal] ${service.id} left to manual intervention after ${state.consecutiveFailures} failed auto-restart(s): ${state.lastMessage ?? "unknown"}`
+          );
+          continue;
+        }
+        if (state.inFlight) continue;
+        const authorization = await authorizeWebUIAction(
+          options.trustBoundary,
+          {
+            capability: "connections.service.restart",
+            subject: { kind: "process", id: `${service.id}@${projectRoot}` },
+            risk: "elevated",
+            cwd: projectRoot,
+            metadata: { transport: "auto-heal", serviceId: service.id, action: "restart" }
+          },
+          options.logger
+        );
+        if (disposed) break;
+        if (!authorization.allowed) {
+          state.lastAttemptAt = now;
+          state.lastMessage = `refused by policy: ${authorization.reason}`;
+          emitStatus({
+            serviceId: service.id,
+            phase: "refused",
+            message: `refused by policy: ${authorization.reason}`,
+            attempt: state.consecutiveFailures + 1
+          });
+          options.logger?.warn?.(
+            `[AutoHeal] ${service.id} restart refused by policy: ${authorization.reason}`
+          );
+          continue;
+        }
+        state.inFlight = true;
+        const attempt = state.consecutiveFailures + 1;
+        emitStatus({
+          serviceId: service.id,
+          phase: "restarting",
+          message: `Auto-restarting ${service.id}`,
+          attempt
+        });
+        try {
+          const result = await execute(service.id, "restart", projectRoot, indexDir);
+          state.consecutiveFailures = result.success ? 0 : state.consecutiveFailures + 1;
+          state.lastSuccess = result.success;
+          state.lastMessage = result.message;
+          emitStatus({
+            serviceId: service.id,
+            phase: result.success ? "restarted" : "failed",
+            message: result.message,
+            attempt
+          });
+          if (!result.success && state.consecutiveFailures >= maxAttempts) {
+            state.escalated = true;
+            emitStatus({
+              serviceId: service.id,
+              phase: "escalated",
+              message: `left to manual intervention after ${state.consecutiveFailures} failed auto-restart(s): ${result.message}`,
+              attempt
+            });
+            options.logger?.warn?.(
+              `[AutoHeal] ${service.id} escalated after ${state.consecutiveFailures} failed auto-restart(s): ${result.message}`
+            );
+          }
+          options.logger?.[result.success ? "info" : "warn"]?.(
+            `[AutoHeal] ${service.id} auto-restart ${result.success ? "succeeded" : "failed"}: ${result.message}`
+          );
+        } catch (error2) {
+          state.consecutiveFailures += 1;
+          state.lastSuccess = false;
+          state.lastMessage = error2 instanceof Error ? error2.message : String(error2);
+          emitStatus({
+            serviceId: service.id,
+            phase: "failed",
+            message: state.lastMessage,
+            attempt
+          });
+          if (state.consecutiveFailures >= maxAttempts) {
+            state.escalated = true;
+            emitStatus({
+              serviceId: service.id,
+              phase: "escalated",
+              message: `left to manual intervention after ${state.consecutiveFailures} failed auto-restart(s): ${state.lastMessage}`,
+              attempt
+            });
+            options.logger?.warn?.(
+              `[AutoHeal] ${service.id} escalated after ${state.consecutiveFailures} failed auto-restart(s): ${state.lastMessage}`
+            );
+          }
+          options.logger?.warn?.(
+            `[AutoHeal] ${service.id} auto-restart threw: ${state.lastMessage}`
+          );
+        } finally {
+          state.lastAttemptAt = Date.now();
+          state.inFlight = false;
+        }
+      }
+      lastTickAt = Date.now();
+    } catch (error2) {
+      options.logger?.warn?.(
+        `[AutoHeal] health collect failed: ${error2 instanceof Error ? error2.message : String(error2)}`
+      );
+    } finally {
+      ticking = false;
+    }
+    return snapshot();
+  }
+  function runTick() {
+    if (!enabled || disposed || running === false || ticking) return;
+    const pending = tick();
+    const tracked = pending.then(
+      () => void 0,
+      () => void 0
+    );
+    inFlightTick = tracked;
+    void tracked.finally(() => {
+      if (inFlightTick === tracked) inFlightTick = null;
+    });
+  }
+  function stopInternal() {
+    if (timer) {
+      clearInterval(timer);
+      timer = null;
+    }
+    running = false;
+  }
+  return {
+    start() {
+      if (!enabled || running || disposed) return;
+      running = true;
+      runTick();
+      timer = setInterval(runTick, intervalMs);
+      timer.unref?.();
+    },
+    stop: stopInternal,
+    async dispose() {
+      stopInternal();
+      disposed = true;
+      const pending = inFlightTick;
+      if (pending) {
+        await Promise.race([
+          pending,
+          new Promise((resolve19) => {
+            const t = setTimeout(resolve19, 3e4);
+            t.unref?.();
+          })
+        ]);
+      }
+      disposed = true;
+    },
+    tick,
+    getSnapshot: snapshot,
+    isRunning: () => running
+  };
+}
+
 // src/server/fallback-choice.ts
 function emitFallbackChoice(events, msg) {
   const parsed = validateModelFallbackChoicePayload(msg.payload);
@@ -22310,6 +22819,11 @@ import {
   wstackGlobalRoot as wstackGlobalRoot2
 } from "@wrongstack/core/utils";
 import { ensureSessionShell } from "@wrongstack/tools";
+import {
+  TransformersEmbeddingProvider,
+  VectorMemoryStore,
+  startFirstBootSageSync
+} from "@wrongstack/vector-memory";
 
 // src/server/backend-services.ts
 import { join as join12 } from "node:path";
@@ -22337,6 +22851,7 @@ import {
 import { TOKENS } from "@wrongstack/core/kernel";
 import { SessionMemoryConsolidator } from "@wrongstack/core/storage";
 import {
+  CONTEXT_WINDOW_MODE_PINNED_META_KEY as CONTEXT_WINDOW_MODE_PINNED_META_KEY2,
   DEFAULT_TOOLS_CONFIG,
   resolveContextWindowPolicy as resolveContextWindowPolicy2
 } from "@wrongstack/core/types";
@@ -23257,22 +23772,26 @@ async function createAgentServices(input) {
     summarizerModel: config.context?.summarizerModel,
     llmSelector: config.context?.llmSelector
   });
-  const initialContextPolicy = resolveContextWindowPolicy2(config.context);
+  let effectiveMaxContext = 0;
+  try {
+    const m = await resolveProviderModelMetadata(
+      modelsRegistry,
+      config.provider,
+      context.model,
+      config.providers?.[config.provider]
+    );
+    effectiveMaxContext = m?.capabilities?.maxContext ?? 0;
+  } catch {
+  }
+  if (!effectiveMaxContext) effectiveMaxContext = config.context?.effectiveMaxContext ?? 0;
+  if (!effectiveMaxContext) effectiveMaxContext = provider.capabilities.maxContext;
+  const initialContextPolicy = resolveContextWindowPolicy2(
+    config.context,
+    void 0,
+    effectiveMaxContext
+  );
   let autoCompactor;
   if (config.context?.autoCompact !== false) {
-    let effectiveMaxContext = 0;
-    try {
-      const m = await resolveProviderModelMetadata(
-        modelsRegistry,
-        config.provider,
-        context.model,
-        config.providers?.[config.provider]
-      );
-      effectiveMaxContext = m?.capabilities?.maxContext ?? 0;
-    } catch {
-    }
-    if (!effectiveMaxContext) effectiveMaxContext = config.context?.effectiveMaxContext ?? 0;
-    if (!effectiveMaxContext) effectiveMaxContext = provider.capabilities.maxContext;
     autoCompactor = new AutoCompactionMiddlewareCtor(
       compactor,
       effectiveMaxContext,
@@ -23327,6 +23846,15 @@ async function createAgentServices(input) {
       context.meta["effectiveMaxContext"] = newMaxContext;
       autoCompactor?.setMaxContext(newMaxContext);
       autoCompactor?.setEnabled(config.context?.autoCompact !== false);
+      if (context.meta[CONTEXT_WINDOW_MODE_PINNED_META_KEY2] !== true) {
+        const policy = resolveContextWindowPolicy2(
+          currentConfig.context ?? {},
+          void 0,
+          newMaxContext
+        );
+        context.meta["contextWindowMode"] = policy.id;
+        context.meta["contextWindowPolicy"] = policy;
+      }
     } else {
       delete context.meta["effectiveMaxContext"];
       autoCompactor?.setEnabled(false);
@@ -23958,8 +24486,22 @@ function createMessageDispatcher(opts) {
     broadcast: (message) => broadcast(state.getClients(), message),
     log: (message) => deps2.logger.warn?.(`[KanbanSupervisor] ${message}`)
   });
+  const autoHealer = createAutoHealer({
+    projectRoot: () => state.getProjectRoot(),
+    indexDir: () => typeof deps2.context.meta["codebaseIndexDir"] === "string" ? deps2.context.meta["codebaseIndexDir"] : void 0,
+    trustBoundary: deps2.trustBoundary,
+    logger: deps2.logger,
+    onStatus: (event) => broadcast(state.getClients(), {
+      type: "connections.auto_heal_status",
+      payload: event
+    })
+  });
+  autoHealer.start();
   if (opts.onDispose) {
-    const dispose = () => kanbanSupervisor.dispose();
+    const dispose = async () => {
+      kanbanSupervisor.dispose();
+      await autoHealer.dispose();
+    };
     opts.onDispose(dispose);
   }
   const kanbanContext = () => ({
@@ -24823,7 +25365,11 @@ async function createPreContextServices(input) {
     model: config.model
   });
   context.meta["promptOnlineAgents"] = onlineAgents;
-  const initialContextPolicy = resolveContextWindowPolicy3(config.context);
+  const initialContextPolicy = resolveContextWindowPolicy3(
+    config.context,
+    void 0,
+    provider.capabilities?.maxContext
+  );
   context.meta["contextWindowMode"] = initialContextPolicy.id;
   context.meta["contextWindowPolicy"] = initialContextPolicy;
   context.state.setMeta(
@@ -25262,7 +25808,7 @@ async function resolvePorts(opts) {
   const publicUrl = opts.publicUrl ?? process.env["WEBUI_PUBLIC_URL"];
   const publicWsUrl = opts.publicWsUrl ?? process.env["WEBUI_PUBLIC_WS_URL"];
   const requireToken = opts.requireToken ?? envFlag("WEBUI_REQUIRE_TOKEN");
-  const strictPort = process.env["WEBUI_STRICT_PORT"] === "1" || process.env["WEBUI_STRICT_PORT"] === "true";
+  const strictPort = isStrictPort();
   let httpPort = requestedHttpPort;
   if (!strictPort) {
     httpPort = await findFreePort(wsHost, requestedHttpPort);
@@ -25481,7 +26027,7 @@ function registerShutdown(deps2) {
 
 // src/server/start-webui-companion.ts
 import * as http2 from "node:http";
-function setupCompanionServer(httpServer, wsHost, httpPort) {
+async function setupCompanionServer(httpServer, wsHost, httpPort) {
   const companion = wsHost === "127.0.0.1" ? "::1" : wsHost === "0.0.0.0" || wsHost === void 0 ? "::" : wsHost === "::" || wsHost === "[::]" ? "0.0.0.0" : null;
   if (!companion) return null;
   const companionLabel = companion.includes(":") ? `[${companion}]` : companion;
@@ -25492,16 +26038,23 @@ function setupCompanionServer(httpServer, wsHost, httpPort) {
     (req, socket, head2) => httpServer.emit("upgrade", req, socket, head2)
   );
   companionServer.on("error", (err) => {
-    const expected = err.code === "EAFNOSUPPORT" || err.code === "EADDRNOTAVAIL" || err.code === "EADDRINUSE";
+    const expected = err.code === "EAFNOSUPPORT" || err.code === "EADDRNOTAVAIL";
     if (!expected) {
       console.warn(
         `[WebUI] companion listener on ${companionLabel} failed (${err.code ?? "unknown"}): ${err.message}. The primary address is unaffected.`
       );
     }
   });
-  companionServer.listen(httpPort, companion, () => {
-    console.log(`[WebUI] HTTP server running on http://${companionLabel}:${httpPort}`);
-  });
+  try {
+    await listenWithRetry(companionServer, companion, httpPort, { maxTries: 1 });
+  } catch (err) {
+    const code = err?.code ?? "unknown";
+    console.warn(
+      `[WebUI] companion listener on ${companionLabel} not started (${code}): ${err?.message ?? err}. The primary address is unaffected.`
+    );
+    return null;
+  }
+  console.log(`[WebUI] HTTP server running on http://${companionLabel}:${httpPort}`);
   return companionServer;
 }
 
@@ -25661,7 +26214,7 @@ function setupWebuiShutdown(options) {
     onPreShutdown: async () => {
       await options.stopEmptySessionCleanup.dispose();
       const disposeKanban = options.getKanbanSupervisorDispose();
-      disposeKanban?.();
+      await disposeKanban?.();
     },
     onShutdown: async () => {
       unregister();
@@ -25696,6 +26249,7 @@ function setupWebuiShutdown(options) {
       await options.memoryStore.dispose().catch(
         (err) => options.logger.warn(`sage connection disposal failed: ${toErrorMessage15(err)}`)
       );
+      options.vectorMemoryStore?.close();
       await unregisterInstance(process.pid, path32.dirname(options.globalConfigPath));
     }
   });
@@ -25760,7 +26314,8 @@ function createStandaloneTodosCheckpointLifecycle(input) {
 async function startWebUI(opts = {}) {
   ensureSessionShell();
   const ports = await resolvePorts(opts);
-  const { wsHost, httpPort, publicUrl, publicWsUrl, requireToken } = ports;
+  const { wsHost, publicUrl, publicWsUrl, requireToken } = ports;
+  let httpPort = ports.httpPort;
   console.log("[WebUI] Starting backend services...");
   const boot = await bootConfig();
   const { config: baseConfig, globalConfigPath, wpaths, logger } = boot;
@@ -25788,6 +26343,27 @@ async function startWebUI(opts = {}) {
     );
   }
   const needsProvider = !config.provider || !config.model;
+  let vectorMemoryStore;
+  const vectorMemoryModelCacheDir = path33.join(
+    projectRoot,
+    ".wrongstack",
+    "cache",
+    "transformers-models"
+  );
+  try {
+    vectorMemoryStore = new VectorMemoryStore({
+      provider: new TransformersEmbeddingProvider({
+        cacheDir: vectorMemoryModelCacheDir
+      }),
+      projectRoot
+    });
+  } catch (error2) {
+    const message = error2 instanceof Error ? error2.message : String(error2);
+    logger.warn(
+      `vector memory store disabled: ${message} \u2014 standalone WebUI will run on the SAGE-only surface.`
+    );
+    vectorMemoryStore = void 0;
+  }
   const preContext = await createPreContextServices({
     config,
     wpaths,
@@ -25835,6 +26411,13 @@ async function startWebUI(opts = {}) {
   let sessionStartedAt = preContext.sessionStartedAt;
   let modeId = preContext.modeId;
   const needsSetup = preContext.needsSetup;
+  if (vectorMemoryStore) {
+    void startFirstBootSageSync({
+      store: vectorMemoryStore,
+      memoryStore,
+      logger
+    });
+  }
   const prefSnapshot2 = () => prefSnapshot(context.meta);
   const persistPrefsToConfig2 = async (payload) => persistPrefsToConfig(prefHelperDeps, configWriteLock, payload);
   const trustBoundary = opts.trustBoundary ?? createCompatibilityTrustBoundary3({ policyId: "webui-trusted-host-compat-v1" });
@@ -25955,7 +26538,12 @@ async function startWebUI(opts = {}) {
       events,
       permissionPolicy
     }),
-    distDir: opts.distDir
+    distDir: opts.distDir,
+    // Vector memory store — mirrors the CLI host. When `vectorMemoryStore`
+    // construction failed (read-only FS, etc.) we still pass the getter;
+    // it just resolves to `undefined` and the API router answers 503.
+    getVectorMemoryStore: () => vectorMemoryStore,
+    vectorMemoryModelCacheDir
   });
   const wsResult = createWsServers(httpServer, ports, accessToken);
   const { wssPrimary, wssSecondary, clients } = wsResult;
@@ -26010,7 +26598,25 @@ async function startWebUI(opts = {}) {
     },
     watcherMetricsRef
   );
-  httpServer.listen(httpPort, wsHost, () => {
+  const strictPort = isStrictPort();
+  const boundPort = await listenWithRetry(httpServer, wsHost, httpPort, {
+    maxTries: strictPort ? 1 : 10
+  });
+  if (boundPort !== httpPort) {
+    console.warn(
+      JSON.stringify({
+        level: "warn",
+        event: "webui.port_reassigned",
+        protocol: "HTTP",
+        requested: httpPort,
+        assigned: boundPort,
+        reason: "bind-time EADDRINUSE retry",
+        timestamp: (/* @__PURE__ */ new Date()).toISOString()
+      })
+    );
+    httpPort = boundPort;
+  }
+  {
     const authHint = requireToken ? " (authentication required; configure WEBUI_TOKEN out of band)" : "";
     console.log(`[WebUI] HTTP server listening on http://${wsHost}:${httpPort}${authHint}`);
     const extraUrls = formatExternalAccessUrls({
@@ -26021,8 +26627,8 @@ async function startWebUI(opts = {}) {
     if (extraUrls.length > 0) {
       console.log("[WebUI] Protected endpoints on external interfaces:\n" + extraUrls.join("\n"));
     }
-  });
-  const companionServer = setupCompanionServer(httpServer, wsHost, httpPort);
+  }
+  const companionServer = await setupCompanionServer(httpServer, wsHost, httpPort);
   async function touchProjectEntry(root, workDir) {
     const resolved = path33.resolve(root);
     const manifest = await loadManifest(globalConfigPath);
@@ -26281,6 +26887,7 @@ projectRoot: ${ev.projectRoot ?? "?"}`,
     },
     codebaseIndexing,
     memoryStore,
+    vectorMemoryStore,
     globalConfigPath
   });
 }