@wrongstack/webui-server 0.308.1 → 0.308.4

package/dist/index.js

@@ -12010,6 +12010,7 @@ ${metrics}` : "",
     task.labels?.length ? `Labels: ${task.labels.join(", ")}` : "",
     "",
     "Work the task end-to-end. Use the kanban tool, not direct file edits, to update this task.",
+    "Stay inside this task: its description and success criteria define the boundary. If you notice problems outside this task while working, do not fix them \u2014 note them in lastResult instead.",
     ...leaseId ? [
       "LEASE CONTRACT:",
       `- Your leaseId is "${leaseId}". Include expectedLeaseId "${leaseId}" in every mark_assignment and heartbeat_assignment call.`,
@@ -12018,7 +12019,7 @@ ${metrics}` : "",
       "On failure the host may call recover_stale; respect its decisions and do not duplicate work."
     ] : [],
     `When you start or finish, call kanban with action "mark_assignment", boardId "${board.id}", taskId "${task.id}", and assignmentStatus "running", "completed", or "failed"${leaseId ? `, and expectedLeaseId "${leaseId}"` : ""}. Include lastResult or error when you finish. On managed lifecycle boards, mark_assignment(completed) will automatically advance your card from Running to Review \u2014 a separate verification step is required before the card reaches Done.`,
-    "When finished, report what changed, what you verified, and any remaining blockers."
+    "When finished, report what changed, what you verified, any remaining blockers, and any issues you noticed outside this task's scope."
   ].filter(Boolean).join("\n");
 }
 function findTask(tasks, taskId) {
@@ -16042,9 +16043,19 @@ async function handleBrainAsk(ctx, ws, question) {
       risk: "medium",
       fallback: "ask_human"
     });
+    const answerSessionId = ctx.getSessionId?.();
     ctx.send(ws, {
       type: "brain.answer",
-      payload: { sessionId: ctx.getSessionId?.(), question: q, decision }
+      // Omit sessionId when there is no session: this is a direct reply to
+      // the asker, not a broadcast, but the client's session gate
+      // (isActiveSessionMessage) is fail-closed on a present-but-empty
+      // sessionId — stamping '' would hide the answer from its own asker
+      // in an embedded host with an unbound agent context.
+      payload: {
+        ...answerSessionId ? { sessionId: answerSessionId } : {},
+        question: q,
+        decision
+      }
     });
   } catch (err) {
     sendResult6(ctx, ws, false, `Brain consultation failed: ${toErrorMessage6(err)}`);
@@ -18530,7 +18541,12 @@ function createProviderHandlers(deps2) {
 
 // src/server/session-handlers.ts
 import { loadTodosCheckpoint } from "@wrongstack/core/storage";
-import { DEFAULT_CONTEXT_WINDOW_MODE_ID, resolveContextWindowPolicy } from "@wrongstack/core/types";
+import {
+  CONTEXT_WINDOW_MODE_PINNED_META_KEY,
+  DEFAULT_CONTEXT_WINDOW_MODE_ID,
+  isContextWindowModeId,
+  resolveContextWindowPolicy
+} from "@wrongstack/core/types";
 import { repairToolUseAdjacency as repairToolUseAdjacency2, sessionScopedPath } from "@wrongstack/core/utils";
 
 // src/protocol/connection-fsm.ts
@@ -19115,6 +19131,7 @@ var SERVER_WORKSPACE_MESSAGE_TYPES = [
 var SERVER_CONFIGURATION_MESSAGE_TYPES = [
   "auth.oauth.status",
   "codebase.index.server.shutdown_result",
+  "connections.auto_heal_status",
   "connections.health_error",
   "connections.health_result",
   "connections.service_action_result",
@@ -20084,8 +20101,8 @@ function createSessionHandlers(ctx) {
         return;
       }
       const { id } = parsed.value;
-      let policy = resolveContextWindowPolicy({}, id);
-      if (policy.id !== id) {
+      let policy = resolveContextWindowPolicy({}, id, readSessionWindowTokens(ctx.context));
+      if (!isContextWindowModeId(id) && policy.id !== id) {
         const customModes = (await modeStore()).list().filter((m) => m.custom === true);
         const custom = customModes.find((m) => m.id === id);
         if (!custom) {
@@ -20096,6 +20113,7 @@ function createSessionHandlers(ctx) {
       }
       ctx.context.meta["contextWindowMode"] = policy.id;
       ctx.context.meta["contextWindowPolicy"] = policy;
+      ctx.context.meta[CONTEXT_WINDOW_MODE_PINNED_META_KEY] = true;
       result(ws, true, `Context mode switched to ${policy.id}`);
       broadcastToAll({
         type: "context.mode.changed",
@@ -20159,11 +20177,14 @@ function createSessionHandlers(ctx) {
       }
       const { id } = parsed.value;
       if (String(ctx.context.meta["contextWindowMode"] ?? "") === id) {
-        ctx.context.meta["contextWindowMode"] = DEFAULT_CONTEXT_WINDOW_MODE_ID;
-        ctx.context.meta["contextWindowPolicy"] = resolveContextWindowPolicy(
+        const policy = resolveContextWindowPolicy(
           {},
-          DEFAULT_CONTEXT_WINDOW_MODE_ID
+          DEFAULT_CONTEXT_WINDOW_MODE_ID,
+          readSessionWindowTokens(ctx.context)
         );
+        ctx.context.meta["contextWindowMode"] = policy.id;
+        ctx.context.meta["contextWindowPolicy"] = policy;
+        delete ctx.context.meta[CONTEXT_WINDOW_MODE_PINNED_META_KEY];
       }
       const store = await modeStore();
       const operation = store.remove(id);
@@ -20370,6 +20391,12 @@ function createSessionHandlers(ctx) {
     }
   };
 }
+function readSessionWindowTokens(context) {
+  const meta = context.meta?.["effectiveMaxContext"];
+  if (typeof meta === "number" && Number.isFinite(meta) && meta > 0) return meta;
+  const cap = context.provider?.capabilities?.maxContext;
+  return typeof cap === "number" && Number.isFinite(cap) && cap > 0 ? cap : 0;
+}
 
 // src/server/embedded-host-adapters.ts
 async function applyEmbeddedModelSwitch(ctx, providerId, modelId) {
@@ -21032,6 +21059,259 @@ async function handleCodebaseIndexServerControl(ws, message, deps2) {
   return true;
 }
 
+// src/server/connections/auto-healer.ts
+var AUTO_HEAL_ENV_FLAG = "WRONGSTACK_AUTO_HEAL_SERVICES";
+var AUTO_HEAL_DEFAULT_INTERVAL_MS = 3e4;
+var AUTO_HEAL_DEFAULT_COOLDOWN_MS = 5 * 6e4;
+var AUTO_HEAL_DEFAULT_MAX_ATTEMPTS = 3;
+var RESTARTABLE_SERVICE_IDS = /* @__PURE__ */ new Set([
+  "kanban",
+  "sage",
+  "chronicle",
+  "codebase-index",
+  "mailbox"
+]);
+function isAutoHealEnabled() {
+  return process.env[AUTO_HEAL_ENV_FLAG] === "1";
+}
+function createAutoHealer(options) {
+  const enabled = options.enabled ?? isAutoHealEnabled();
+  const intervalMs = options.intervalMs ?? AUTO_HEAL_DEFAULT_INTERVAL_MS;
+  const cooldownMs = options.cooldownMs ?? AUTO_HEAL_DEFAULT_COOLDOWN_MS;
+  const maxAttempts = options.maxAttempts ?? AUTO_HEAL_DEFAULT_MAX_ATTEMPTS;
+  const collect = options.collect ?? (() => collectConnectionsHealth({
+    projectRoot: options.projectRoot(),
+    indexDir: options.indexDir(),
+    backend: "standalone"
+  }));
+  const execute = options.execute ?? executeServiceAction;
+  const services = /* @__PURE__ */ new Map();
+  let timer = null;
+  let running = false;
+  let ticking = false;
+  let disposed = false;
+  let inFlightTick = null;
+  let lastTickAt = null;
+  let warnedNoBoundary = false;
+  function stateFor(serviceId) {
+    let state = services.get(serviceId);
+    if (!state) {
+      state = {
+        lastAttemptAt: null,
+        consecutiveFailures: 0,
+        lastSuccess: null,
+        lastMessage: null,
+        inFlight: false,
+        escalated: false
+      };
+      services.set(serviceId, state);
+    }
+    return state;
+  }
+  function snapshot() {
+    return {
+      enabled,
+      running,
+      lastTickAt,
+      services: Object.fromEntries(services)
+    };
+  }
+  function emitStatus(event) {
+    try {
+      options.onStatus?.({ ...event, at: Date.now() });
+    } catch (error2) {
+      options.logger?.warn?.(
+        `[AutoHeal] onStatus hook threw: ${error2 instanceof Error ? error2.message : String(error2)}`
+      );
+    }
+  }
+  async function tick() {
+    if (!enabled || disposed) return snapshot();
+    if (!options.trustBoundary) {
+      if (!warnedNoBoundary) {
+        warnedNoBoundary = true;
+        options.logger?.warn?.(
+          "[AutoHeal] Disabled: no policy authority (trust boundary) is configured."
+        );
+      }
+      return snapshot();
+    }
+    if (ticking) return snapshot();
+    ticking = true;
+    try {
+      const report = await collect();
+      const now = Date.now();
+      const projectRoot = options.projectRoot();
+      const indexDir = options.indexDir();
+      for (const service of report.services) {
+        if (disposed) break;
+        const state = stateFor(service.id);
+        if (service.status !== "error") {
+          state.consecutiveFailures = 0;
+          state.escalated = false;
+          continue;
+        }
+        if (!RESTARTABLE_SERVICE_IDS.has(service.id) || service.control === "none") {
+          continue;
+        }
+        if (state.lastAttemptAt !== null && now - state.lastAttemptAt < cooldownMs) continue;
+        if (state.consecutiveFailures >= maxAttempts) {
+          state.escalated = true;
+          options.logger?.warn?.(
+            `[AutoHeal] ${service.id} left to manual intervention after ${state.consecutiveFailures} failed auto-restart(s): ${state.lastMessage ?? "unknown"}`
+          );
+          continue;
+        }
+        if (state.inFlight) continue;
+        const authorization = await authorizeWebUIAction(
+          options.trustBoundary,
+          {
+            capability: "connections.service.restart",
+            subject: { kind: "process", id: `${service.id}@${projectRoot}` },
+            risk: "elevated",
+            cwd: projectRoot,
+            metadata: { transport: "auto-heal", serviceId: service.id, action: "restart" }
+          },
+          options.logger
+        );
+        if (disposed) break;
+        if (!authorization.allowed) {
+          state.lastAttemptAt = now;
+          state.lastMessage = `refused by policy: ${authorization.reason}`;
+          emitStatus({
+            serviceId: service.id,
+            phase: "refused",
+            message: `refused by policy: ${authorization.reason}`,
+            attempt: state.consecutiveFailures + 1
+          });
+          options.logger?.warn?.(
+            `[AutoHeal] ${service.id} restart refused by policy: ${authorization.reason}`
+          );
+          continue;
+        }
+        state.inFlight = true;
+        const attempt = state.consecutiveFailures + 1;
+        emitStatus({
+          serviceId: service.id,
+          phase: "restarting",
+          message: `Auto-restarting ${service.id}`,
+          attempt
+        });
+        try {
+          const result = await execute(service.id, "restart", projectRoot, indexDir);
+          state.consecutiveFailures = result.success ? 0 : state.consecutiveFailures + 1;
+          state.lastSuccess = result.success;
+          state.lastMessage = result.message;
+          emitStatus({
+            serviceId: service.id,
+            phase: result.success ? "restarted" : "failed",
+            message: result.message,
+            attempt
+          });
+          if (!result.success && state.consecutiveFailures >= maxAttempts) {
+            state.escalated = true;
+            emitStatus({
+              serviceId: service.id,
+              phase: "escalated",
+              message: `left to manual intervention after ${state.consecutiveFailures} failed auto-restart(s): ${result.message}`,
+              attempt
+            });
+            options.logger?.warn?.(
+              `[AutoHeal] ${service.id} escalated after ${state.consecutiveFailures} failed auto-restart(s): ${result.message}`
+            );
+          }
+          options.logger?.[result.success ? "info" : "warn"]?.(
+            `[AutoHeal] ${service.id} auto-restart ${result.success ? "succeeded" : "failed"}: ${result.message}`
+          );
+        } catch (error2) {
+          state.consecutiveFailures += 1;
+          state.lastSuccess = false;
+          state.lastMessage = error2 instanceof Error ? error2.message : String(error2);
+          emitStatus({
+            serviceId: service.id,
+            phase: "failed",
+            message: state.lastMessage,
+            attempt
+          });
+          if (state.consecutiveFailures >= maxAttempts) {
+            state.escalated = true;
+            emitStatus({
+              serviceId: service.id,
+              phase: "escalated",
+              message: `left to manual intervention after ${state.consecutiveFailures} failed auto-restart(s): ${state.lastMessage}`,
+              attempt
+            });
+            options.logger?.warn?.(
+              `[AutoHeal] ${service.id} escalated after ${state.consecutiveFailures} failed auto-restart(s): ${state.lastMessage}`
+            );
+          }
+          options.logger?.warn?.(
+            `[AutoHeal] ${service.id} auto-restart threw: ${state.lastMessage}`
+          );
+        } finally {
+          state.lastAttemptAt = Date.now();
+          state.inFlight = false;
+        }
+      }
+      lastTickAt = Date.now();
+    } catch (error2) {
+      options.logger?.warn?.(
+        `[AutoHeal] health collect failed: ${error2 instanceof Error ? error2.message : String(error2)}`
+      );
+    } finally {
+      ticking = false;
+    }
+    return snapshot();
+  }
+  function runTick() {
+    if (!enabled || disposed || running === false || ticking) return;
+    const pending = tick();
+    const tracked = pending.then(
+      () => void 0,
+      () => void 0
+    );
+    inFlightTick = tracked;
+    void tracked.finally(() => {
+      if (inFlightTick === tracked) inFlightTick = null;
+    });
+  }
+  function stopInternal() {
+    if (timer) {
+      clearInterval(timer);
+      timer = null;
+    }
+    running = false;
+  }
+  return {
+    start() {
+      if (!enabled || running || disposed) return;
+      running = true;
+      runTick();
+      timer = setInterval(runTick, intervalMs);
+      timer.unref?.();
+    },
+    stop: stopInternal,
+    async dispose() {
+      stopInternal();
+      disposed = true;
+      const pending = inFlightTick;
+      if (pending) {
+        await Promise.race([
+          pending,
+          new Promise((resolve20) => {
+            const t = setTimeout(resolve20, 3e4);
+            t.unref?.();
+          })
+        ]);
+      }
+      disposed = true;
+    },
+    tick,
+    getSnapshot: snapshot,
+    isRunning: () => running
+  };
+}
+
 // src/server/fallback-choice.ts
 function emitFallbackChoice(events, msg) {
   const parsed = validateModelFallbackChoicePayload(msg.payload);
@@ -21721,6 +22001,22 @@ async function handleShellOpen(req, logger, options) {
 function createEmbeddedMessageRouter(deps2) {
   const { opts, send: send2, sendResult: sendResult7 } = deps2;
   const projectRoot = () => opts.projectRoot ?? opts.agent.ctx.projectRoot ?? "";
+  const autoHealer = createAutoHealer({
+    projectRoot,
+    indexDir: () => typeof opts.agent.ctx.meta["codebaseIndexDir"] === "string" ? opts.agent.ctx.meta["codebaseIndexDir"] : void 0,
+    trustBoundary: deps2.trustBoundary,
+    logger: deps2.logger,
+    onStatus: (event) => deps2.providerCtx.broadcast({
+      type: "connections.auto_heal_status",
+      payload: event
+    })
+  });
+  autoHealer.start();
+  if (deps2.onDispose) {
+    deps2.onDispose(async () => {
+      await autoHealer.dispose();
+    });
+  }
   const terminal = async (ws, message) => {
     await deps2.terminalHandler.handleMessage(ws, message).catch((error2) => {
       const text2 = error2 instanceof Error ? error2.message : String(error2);
@@ -24704,6 +25000,7 @@ import {
 import { TOKENS as TOKENS2 } from "@wrongstack/core/kernel";
 import { SessionMemoryConsolidator } from "@wrongstack/core/storage";
 import {
+  CONTEXT_WINDOW_MODE_PINNED_META_KEY as CONTEXT_WINDOW_MODE_PINNED_META_KEY2,
   DEFAULT_TOOLS_CONFIG,
   resolveContextWindowPolicy as resolveContextWindowPolicy2
 } from "@wrongstack/core/types";
@@ -25624,22 +25921,26 @@ async function createAgentServices(input) {
     summarizerModel: config.context?.summarizerModel,
     llmSelector: config.context?.llmSelector
   });
-  const initialContextPolicy = resolveContextWindowPolicy2(config.context);
+  let effectiveMaxContext = 0;
+  try {
+    const m = await resolveProviderModelMetadata(
+      modelsRegistry,
+      config.provider,
+      context.model,
+      config.providers?.[config.provider]
+    );
+    effectiveMaxContext = m?.capabilities?.maxContext ?? 0;
+  } catch {
+  }
+  if (!effectiveMaxContext) effectiveMaxContext = config.context?.effectiveMaxContext ?? 0;
+  if (!effectiveMaxContext) effectiveMaxContext = provider.capabilities.maxContext;
+  const initialContextPolicy = resolveContextWindowPolicy2(
+    config.context,
+    void 0,
+    effectiveMaxContext
+  );
   let autoCompactor;
   if (config.context?.autoCompact !== false) {
-    let effectiveMaxContext = 0;
-    try {
-      const m = await resolveProviderModelMetadata(
-        modelsRegistry,
-        config.provider,
-        context.model,
-        config.providers?.[config.provider]
-      );
-      effectiveMaxContext = m?.capabilities?.maxContext ?? 0;
-    } catch {
-    }
-    if (!effectiveMaxContext) effectiveMaxContext = config.context?.effectiveMaxContext ?? 0;
-    if (!effectiveMaxContext) effectiveMaxContext = provider.capabilities.maxContext;
     autoCompactor = new AutoCompactionMiddlewareCtor(
       compactor,
       effectiveMaxContext,
@@ -25694,6 +25995,15 @@ async function createAgentServices(input) {
       context.meta["effectiveMaxContext"] = newMaxContext;
       autoCompactor?.setMaxContext(newMaxContext);
       autoCompactor?.setEnabled(config.context?.autoCompact !== false);
+      if (context.meta[CONTEXT_WINDOW_MODE_PINNED_META_KEY2] !== true) {
+        const policy = resolveContextWindowPolicy2(
+          currentConfig.context ?? {},
+          void 0,
+          newMaxContext
+        );
+        context.meta["contextWindowMode"] = policy.id;
+        context.meta["contextWindowPolicy"] = policy;
+      }
     } else {
       delete context.meta["effectiveMaxContext"];
       autoCompactor?.setEnabled(false);
@@ -26325,8 +26635,22 @@ function createMessageDispatcher(opts) {
     broadcast: (message) => broadcast(state.getClients(), message),
     log: (message) => deps2.logger.warn?.(`[KanbanSupervisor] ${message}`)
   });
+  const autoHealer = createAutoHealer({
+    projectRoot: () => state.getProjectRoot(),
+    indexDir: () => typeof deps2.context.meta["codebaseIndexDir"] === "string" ? deps2.context.meta["codebaseIndexDir"] : void 0,
+    trustBoundary: deps2.trustBoundary,
+    logger: deps2.logger,
+    onStatus: (event) => broadcast(state.getClients(), {
+      type: "connections.auto_heal_status",
+      payload: event
+    })
+  });
+  autoHealer.start();
   if (opts.onDispose) {
-    const dispose = () => kanbanSupervisor.dispose();
+    const dispose = async () => {
+      kanbanSupervisor.dispose();
+      await autoHealer.dispose();
+    };
     opts.onDispose(dispose);
   }
   const kanbanContext = () => ({
@@ -27190,7 +27514,11 @@ async function createPreContextServices(input) {
     model: config.model
   });
   context.meta["promptOnlineAgents"] = onlineAgents;
-  const initialContextPolicy = resolveContextWindowPolicy3(config.context);
+  const initialContextPolicy = resolveContextWindowPolicy3(
+    config.context,
+    void 0,
+    provider.capabilities?.maxContext
+  );
   context.meta["contextWindowMode"] = initialContextPolicy.id;
   context.meta["contextWindowPolicy"] = initialContextPolicy;
   context.state.setMeta(
@@ -28035,7 +28363,7 @@ function setupWebuiShutdown(options) {
     onPreShutdown: async () => {
       await options.stopEmptySessionCleanup.dispose();
       const disposeKanban = options.getKanbanSupervisorDispose();
-      disposeKanban?.();
+      await disposeKanban?.();
     },
     onShutdown: async () => {
       unregister();

package/dist/protocol/index.js

@@ -580,6 +580,7 @@ var SERVER_WORKSPACE_MESSAGE_TYPES = [
 var SERVER_CONFIGURATION_MESSAGE_TYPES = [
   "auth.oauth.status",
   "codebase.index.server.shutdown_result",
+  "connections.auto_heal_status",
   "connections.health_error",
   "connections.health_result",
   "connections.service_action_result",

package/dist/protocol/registry.d.ts

@@ -1,5 +1,5 @@
 export declare const CLIENT_MESSAGE_TYPES: readonly ["abort", "ping", "user_message", "tool.confirm_result", "topic.advice", "completion.request", "model.switch", "model.refine", "model.fallback_choice", "autonomy.switch", "context.clear", "context.compact", "context.debug", "context.editor.open", "context.editor.validate", "context.editor.apply", "context.mode.create", "context.mode.delete", "context.mode.switch", "context.mode.update", "context.modes.list", "context.repair", "mode.switch", "modes.list", "session.checkpoints", "session.delete", "session.inspect", "session.new", "session.rename", "session.resume", "session.rewind", "session.save", "sessions.list", "side_effects.list", "stats.get", "todo.update", "todos.clear", "todos.get", "todos.remove", "collab.join", "collab.leave", "collab.annotate", "collab.resolve", "collab.request_pause", "collab.resume", "collab.grant_control", "collab.inject_tool", "mailbox.action", "mailbox.agents", "mailbox.clear", "mailbox.compact", "mailbox.messages", "mailbox.purge", "mailbox.send", "files.create", "files.delete", "files.list", "files.move", "files.read", "files.rename", "files.skeleton", "files.tree", "files.write", "git.changes", "git.diff", "git.info", "projects.add", "projects.list", "projects.select", "working_dir.set", "worktree.cleanup", "worktree.diff", "worktree.merge", "worktree.remove", "worktree.scan", "shell.open", "process.kill", "process.killAll", "process.list", "terminal.close", "terminal.create", "terminal.input", "terminal.resize", "codebase.index.server.shutdown", "connections.health", "connections.service_action", "diag.get", "key.add", "key.delete", "key.set_active", "key.update", "prefs.get", "prefs.update", "provider.add", "provider.clear_models", "provider.custom_models.remove", "provider.custom_models.set", "provider.models", "provider.models.search", "provider.probe", "provider.remove", "provider.status.clear", "provider.status.get", "provider.status.retry", "provider.undo_clear", "provider.update", "providers.list", "providers.saved", "tool.disable", "tool.enable", "tools.list", "webui.shutdown", "goal-state.get", "goal.addTask", "goal.assess", "goal.assignTask", "goal.clear", "goal.get", "goal.list", "goal.load", "goal.moveTask", "goal.pause", "goal.resume", "goal.retryTask", "goal.revert", "goal.runTask", "goal.save", "goal.selectPhase", "goal.start", "goal.state", "goal.status", "goal.stop", "goal.taskStatus", "goal.toggleAutonomous", "plan.get", "plan.item.update", "plan.template_use", "task.update", "tasks.get", "sdd.board.cancel_task", "sdd.board.cleanup_worktrees", "sdd.board.delete_task", "sdd.board.destroy", "sdd.board.get", "sdd.board.list", "sdd.board.pause", "sdd.board.reassign", "sdd.board.resume", "sdd.board.retry", "sdd.board.retry_all_failed", "sdd.board.rollback", "sdd.board.set_task_fallbacks", "sdd.board.set_task_model", "sdd.board.set_task_verification", "sdd.board.split_task", "sdd.board.stop", "sdd.run.from_graph", "sdd.run.from_spec", "sdd.run.start", "sdd.spec.approve", "sdd.spec.discard", "sdd.spec.get", "sdd.spec.message", "sdd.spec.rewind", "sdd.spec.start", "specs.get", "specs.list", "specs.taskStatus", "brain.ask", "brain.config.get", "brain.config.set", "brain.risk", "brain.status", "chronicle.facet", "chronicle.facets", "chronicle.graph", "chronicle.metrics", "chronicle.query", "chronicle.status", "config.doctor", "design.list", "design.materialize", "design.set", "design.state", "design.swap", "design.tune", "design.use", "design.verify", "memory.list", "memory.sage.backfillRecoverable", "memory.sage.candidateResolve", "memory.sage.delete", "memory.sage.forFile", "memory.sage.get", "memory.sage.graph", "memory.sage.list", "memory.sage.listCandidates", "memory.sage.listPage", "memory.sage.recover", "memory.sage.remember", "memory.sage.searchBreakdown", "memory.sage.update", "auth.oauth.cancel", "auth.oauth.code", "auth.oauth.start", "mcp.add", "mcp.disable", "mcp.discover", "mcp.enable", "mcp.list", "mcp.prompt.get", "mcp.prompts", "mcp.remove", "mcp.resource.read", "mcp.resources", "mcp.restart", "mcp.sleep", "mcp.update", "mcp.wake", "prompts.content", "prompts.create", "prompts.favorite", "prompts.journal", "prompts.list", "prompts.recent", "prompts.search", "prompts.used", "skills.content", "skills.create", "skills.edit", "skills.export", "skills.install", "skills.list", "skills.uninstall", "skills.update"];
-export declare const SERVER_MESSAGE_TYPES: readonly ["error", "log", "pong", "side_effects", "agent.status_changed", "agent.timeline.message", "client.status_update", "chimera.report_available", "compaction.failed", "completion.result", "context.compacted", "context.debug", "context.editor.snapshot", "context.editor.validation", "context.editor.applied", "context.mode.changed", "context.modes.list", "context.repaired", "ctx.max_context", "ctx.pct", "delegate.completed", "delegate.started", "iteration.completed", "iteration.limit_reached", "iteration.started", "model.refine_result", "modes.list", "provider.active_blocked", "provider.error", "provider.fallback", "provider.fallback_pending", "provider.response", "provider.retry", "provider.status_changed", "provider.stream_error", "provider.text_delta", "provider.thinking_delta", "run.result", "session.checkpoints", "session.damaged", "session.end", "session.inspect", "session.rewound", "session.start", "session.stats", "sessions.list", "sessions.status_update", "stats.get", "token.cost_estimate_unavailable", "token.threshold", "tool.confirm_needed", "tool.disabled", "tool.enabled", "tool.executed", "tool.loop_detected", "tool.progress", "tool.started", "topic.advice_result", "tools.list", "trust.persisted", "collab.annotation.added", "collab.annotation.resolved", "collab.event", "collab.injection.granted", "collab.participant.joined", "collab.participant.left", "collab.pause.granted", "collab.pause.released", "collab.state", "mailbox.action_result", "mailbox.agent_registered", "mailbox.agent_deregistered", "mailbox.agents", "mailbox.cleared", "mailbox.compacted", "mailbox.event", "mailbox.messages", "mailbox.sent", "mailbox.purged", "mailbox.received", "subagent.budget_extended", "subagent.event", "checkpoint.written", "codemap.file_event", "codemap.index_updated", "codemap.tool_executed", "codemap.tool_started", "file.saved", "files.created", "files.deleted", "files.list", "files.moved", "files.read", "files.renamed", "files.skeleton_result", "files.tree", "files.tree.changed", "files.written", "git.changes", "git.diff", "git.info", "process.list", "projects.added", "projects.list", "projects.selected", "terminal.exit", "terminal.output", "working_dir.changed", "worktree.cleanup_result", "worktree.diff_result", "worktree.event", "worktree.merge_result", "worktree.orphans", "worktree.state", "auth.oauth.status", "codebase.index.server.shutdown_result", "connections.health_error", "connections.health_result", "connections.service_action_result", "diag.get", "key.operation_result", "model.switch_result", "prefs.updated", "provider.catalog", "provider.models", "provider.models.search_result", "provider.probe", "provider.status.snapshot", "providers.saved", "budget.decision", "budget.threshold_reached", "coordinator.stats", "coordinator.status", "eternal.iteration", "fleet.concurrency_update", "goal-state.updated", "goal.assess.result", "goal.list", "goal.paused", "goal.resumed", "goal.saved", "goal.error", "goal.stopped", "goal.failed", "goal.completed", "goal.cleared", "goal.reverted", "goal.progress", "goal.state", "in_flight.ended", "in_flight.started", "plan.updated", "task.completed", "task.failed", "task.pending", "task.started", "tasks.updated", "todos.cleared", "todos.updated", "kanban.task.activity", "sdd.board.lifecycle_result", "sdd.board.list", "sdd.board.snapshot", "sdd.run.started", "sdd.spec.agent_text", "sdd.spec.error", "sdd.spec.snapshot", "specs.detail", "specs.list", "consensus.vote_cast", "consensus.vote_initiated", "consensus.vote_resolved", "cron.job_fired", "cron.snapshot", "techstack.job.cancelled", "techstack.job.failed", "techstack.job.progress", "techstack.job.started", "techstack.report.delivered", "techstack.report.ready", "techstack.snapshot.updated", "techstack.workspace.completed", "brain.answer", "brain.config", "brain.event", "brain.status", "chronicle.error", "chronicle.facet_result", "chronicle.facets_result", "chronicle.graph_result", "chronicle.metrics_result", "chronicle.query_result", "chronicle.status_result", "config.doctor.result", "design.list", "design.materialize", "design.set", "design.state", "design.swap", "design.tune", "design.use", "design.verify", "memory.event", "memory.list", "memory.sage.backfillRecoverable", "memory.sage.candidateResolve", "memory.sage.delete", "memory.sage.forFile", "memory.sage.get", "memory.sage.graph", "memory.sage.list", "memory.sage.listCandidates", "memory.sage.listPage", "memory.sage.recover", "memory.sage.remember", "memory.sage.searchBreakdown", "memory.sage.update", "mcp.content.error", "mcp.content.selected", "mcp.list", "mcp.operation_result", "mcp.prompts", "mcp.resources", "mcp.server.added", "mcp.server.connected", "mcp.server.disconnected", "mcp.server.discovered", "mcp.server.error", "mcp.server.reconnected", "mcp.server.removed", "mcp.server.sleeping", "mcp.server.updated", "mcp.server.waking", "prompts.content", "prompts.created", "prompts.favorite", "prompts.journal", "prompts.list", "prompts.recent", "prompts.search", "prompts.used", "skills.content", "skills.created", "skills.edited", "skills.exported", "skills.installed", "skills.list", "skills.uninstalled", "skills.updated"];
+export declare const SERVER_MESSAGE_TYPES: readonly ["error", "log", "pong", "side_effects", "agent.status_changed", "agent.timeline.message", "client.status_update", "chimera.report_available", "compaction.failed", "completion.result", "context.compacted", "context.debug", "context.editor.snapshot", "context.editor.validation", "context.editor.applied", "context.mode.changed", "context.modes.list", "context.repaired", "ctx.max_context", "ctx.pct", "delegate.completed", "delegate.started", "iteration.completed", "iteration.limit_reached", "iteration.started", "model.refine_result", "modes.list", "provider.active_blocked", "provider.error", "provider.fallback", "provider.fallback_pending", "provider.response", "provider.retry", "provider.status_changed", "provider.stream_error", "provider.text_delta", "provider.thinking_delta", "run.result", "session.checkpoints", "session.damaged", "session.end", "session.inspect", "session.rewound", "session.start", "session.stats", "sessions.list", "sessions.status_update", "stats.get", "token.cost_estimate_unavailable", "token.threshold", "tool.confirm_needed", "tool.disabled", "tool.enabled", "tool.executed", "tool.loop_detected", "tool.progress", "tool.started", "topic.advice_result", "tools.list", "trust.persisted", "collab.annotation.added", "collab.annotation.resolved", "collab.event", "collab.injection.granted", "collab.participant.joined", "collab.participant.left", "collab.pause.granted", "collab.pause.released", "collab.state", "mailbox.action_result", "mailbox.agent_registered", "mailbox.agent_deregistered", "mailbox.agents", "mailbox.cleared", "mailbox.compacted", "mailbox.event", "mailbox.messages", "mailbox.sent", "mailbox.purged", "mailbox.received", "subagent.budget_extended", "subagent.event", "checkpoint.written", "codemap.file_event", "codemap.index_updated", "codemap.tool_executed", "codemap.tool_started", "file.saved", "files.created", "files.deleted", "files.list", "files.moved", "files.read", "files.renamed", "files.skeleton_result", "files.tree", "files.tree.changed", "files.written", "git.changes", "git.diff", "git.info", "process.list", "projects.added", "projects.list", "projects.selected", "terminal.exit", "terminal.output", "working_dir.changed", "worktree.cleanup_result", "worktree.diff_result", "worktree.event", "worktree.merge_result", "worktree.orphans", "worktree.state", "auth.oauth.status", "codebase.index.server.shutdown_result", "connections.auto_heal_status", "connections.health_error", "connections.health_result", "connections.service_action_result", "diag.get", "key.operation_result", "model.switch_result", "prefs.updated", "provider.catalog", "provider.models", "provider.models.search_result", "provider.probe", "provider.status.snapshot", "providers.saved", "budget.decision", "budget.threshold_reached", "coordinator.stats", "coordinator.status", "eternal.iteration", "fleet.concurrency_update", "goal-state.updated", "goal.assess.result", "goal.list", "goal.paused", "goal.resumed", "goal.saved", "goal.error", "goal.stopped", "goal.failed", "goal.completed", "goal.cleared", "goal.reverted", "goal.progress", "goal.state", "in_flight.ended", "in_flight.started", "plan.updated", "task.completed", "task.failed", "task.pending", "task.started", "tasks.updated", "todos.cleared", "todos.updated", "kanban.task.activity", "sdd.board.lifecycle_result", "sdd.board.list", "sdd.board.snapshot", "sdd.run.started", "sdd.spec.agent_text", "sdd.spec.error", "sdd.spec.snapshot", "specs.detail", "specs.list", "consensus.vote_cast", "consensus.vote_initiated", "consensus.vote_resolved", "cron.job_fired", "cron.snapshot", "techstack.job.cancelled", "techstack.job.failed", "techstack.job.progress", "techstack.job.started", "techstack.report.delivered", "techstack.report.ready", "techstack.snapshot.updated", "techstack.workspace.completed", "brain.answer", "brain.config", "brain.event", "brain.status", "chronicle.error", "chronicle.facet_result", "chronicle.facets_result", "chronicle.graph_result", "chronicle.metrics_result", "chronicle.query_result", "chronicle.status_result", "config.doctor.result", "design.list", "design.materialize", "design.set", "design.state", "design.swap", "design.tune", "design.use", "design.verify", "memory.event", "memory.list", "memory.sage.backfillRecoverable", "memory.sage.candidateResolve", "memory.sage.delete", "memory.sage.forFile", "memory.sage.get", "memory.sage.graph", "memory.sage.list", "memory.sage.listCandidates", "memory.sage.listPage", "memory.sage.recover", "memory.sage.remember", "memory.sage.searchBreakdown", "memory.sage.update", "mcp.content.error", "mcp.content.selected", "mcp.list", "mcp.operation_result", "mcp.prompts", "mcp.resources", "mcp.server.added", "mcp.server.connected", "mcp.server.disconnected", "mcp.server.discovered", "mcp.server.error", "mcp.server.reconnected", "mcp.server.removed", "mcp.server.sleeping", "mcp.server.updated", "mcp.server.waking", "prompts.content", "prompts.created", "prompts.favorite", "prompts.journal", "prompts.list", "prompts.recent", "prompts.search", "prompts.used", "skills.content", "skills.created", "skills.edited", "skills.exported", "skills.installed", "skills.list", "skills.uninstalled", "skills.updated"];
 export type ExactClientMessageType = (typeof CLIENT_MESSAGE_TYPES)[number];
 export type ExactServerMessageType = (typeof SERVER_MESSAGE_TYPES)[number];
 export declare function isRegisteredMessageType(type: string, direction: 'client' | 'server'): boolean;

package/dist/protocol/server-workspace.d.ts

@@ -1,3 +1,3 @@
 export declare const SERVER_WORKSPACE_MESSAGE_TYPES: readonly ['checkpoint.written', 'codemap.file_event', 'codemap.index_updated', 'codemap.tool_executed', 'codemap.tool_started', 'file.saved', 'files.created', 'files.deleted', 'files.list', 'files.moved', 'files.read', 'files.renamed', 'files.skeleton_result', 'files.tree', 'files.tree.changed', 'files.written', 'git.changes', 'git.diff', 'git.info', 'process.list', 'projects.added', 'projects.list', 'projects.selected', 'terminal.exit', 'terminal.output', 'working_dir.changed', 'worktree.cleanup_result', 'worktree.diff_result', 'worktree.event', 'worktree.merge_result', 'worktree.orphans', 'worktree.state'];
-export declare const SERVER_CONFIGURATION_MESSAGE_TYPES: readonly ['auth.oauth.status', 'codebase.index.server.shutdown_result', 'connections.health_error', 'connections.health_result', 'connections.service_action_result', 'diag.get', 'key.operation_result', 'model.switch_result', 'prefs.updated', 'provider.catalog', 'provider.models', 'provider.models.search_result', 'provider.probe', 'provider.status.snapshot', 'providers.saved'];
+export declare const SERVER_CONFIGURATION_MESSAGE_TYPES: readonly ['auth.oauth.status', 'codebase.index.server.shutdown_result', 'connections.auto_heal_status', 'connections.health_error', 'connections.health_result', 'connections.service_action_result', 'diag.get', 'key.operation_result', 'model.switch_result', 'prefs.updated', 'provider.catalog', 'provider.models', 'provider.models.search_result', 'provider.probe', 'provider.status.snapshot', 'providers.saved'];
 //# sourceMappingURL=server-workspace.d.ts.map

package/dist/server/connections/auto-healer.d.ts

@@ -0,0 +1,85 @@
+import type { Logger } from '@wrongstack/core/types';
+import type { TrustBoundary } from '@wrongstack/core/security';
+import type { ConnectionHealthService, ConnectionsHealthReport, ServiceActionResult } from './types.js';
+/**
+ * Auto-heal watchdog for /connections IPC services.
+ *
+ * There is deliberately no retry loop in the /connections layer: the health
+ * report is a passive, read-only probe and the RotateCcw button drives the
+ * only restart path (`connections.service_action` → `executeServiceAction`).
+ * This module turns that same machinery into an opt-in server-side watchdog:
+ * on an interval it collects the health report and, for any restartable
+ * service stuck in `error`, re-runs the exact restart used by the button
+ * (shutdown → wait-for-dead → respawn → ping verification).
+ *
+ * Trigger contract — status `error` only. `offline` / `unavailable` are the
+ * normal sleeping states of on-demand daemons and must never be restarted;
+ * `degraded` means the service is serving (inline fallback, quarantine,
+ * damaged rows) and should also never trigger a restart.
+ */
+export declare const AUTO_HEAL_ENV_FLAG = "WRONGSTACK_AUTO_HEAL_SERVICES";
+export declare const AUTO_HEAL_DEFAULT_INTERVAL_MS = 30000;
+export declare const AUTO_HEAL_DEFAULT_COOLDOWN_MS: number;
+export declare const AUTO_HEAL_DEFAULT_MAX_ATTEMPTS = 3;
+export interface AutoHealServiceState {
+    lastAttemptAt: number | null;
+    consecutiveFailures: number;
+    lastSuccess: boolean | null;
+    lastMessage: string | null;
+    inFlight: boolean;
+    escalated: boolean;
+}
+/** UI-facing event emitted at each healer decision point. */
+export type AutoHealStatusPhase = 'restarting' | 'restarted' | 'failed' | 'escalated' | 'refused';
+export interface AutoHealStatusEvent {
+    serviceId: ConnectionHealthService['id'] | null;
+    phase: AutoHealStatusPhase;
+    message: string;
+    at: number;
+    /** 1-based attempt number within the current failure streak. */
+    attempt: number;
+}
+export interface AutoHealSnapshot {
+    enabled: boolean;
+    running: boolean;
+    lastTickAt: number | null;
+    services: Record<string, AutoHealServiceState>;
+}
+export interface AutoHealerOptions {
+    projectRoot: () => string;
+    indexDir: () => string | undefined;
+    /** Policy boundary. When absent, auto-heal refuses to act (same rule as the manual WS path). */
+    trustBoundary?: TrustBoundary | undefined;
+    logger?: Logger | undefined;
+    /**
+     * UI visibility hook. The wiring layer forwards these to the WebSocket
+     * broadcast as `connections.auto_heal_status` so clients can render an
+     * "auto-restarting…" state instead of silently flipping statuses.
+     */
+    onStatus?: ((event: AutoHealStatusEvent) => void) | undefined;
+    /** Health collector override (tests). Defaults to the real per-project collector. */
+    collect?: () => Promise<ConnectionsHealthReport>;
+    /** Restart executor override (tests). Defaults to the button's `executeServiceAction`. */
+    execute?: (serviceId: ConnectionHealthService['id'], action: 'restart', projectRoot: string, indexDir: string | undefined) => Promise<ServiceActionResult>;
+    /** Enable override. Defaults to the `WRONGSTACK_AUTO_HEAL_SERVICES` env flag. */
+    enabled?: boolean;
+    intervalMs?: number;
+    cooldownMs?: number;
+    maxAttempts?: number;
+}
+export interface AutoHealer {
+    start(): void;
+    stop(): void;
+    /**
+     * Idempotent teardown: stops the interval and waits for any in-flight tick
+     * (including a restart in progress) to finish. No new restart is started
+     * after disposal begins. Safe to call multiple times and when never started.
+     */
+    dispose(): Promise<void>;
+    tick(): Promise<AutoHealSnapshot>;
+    getSnapshot(): AutoHealSnapshot;
+    isRunning(): boolean;
+}
+export declare function isAutoHealEnabled(): boolean;
+export declare function createAutoHealer(options: AutoHealerOptions): AutoHealer;
+//# sourceMappingURL=auto-healer.d.ts.map

package/dist/server/embedded-message-router.d.ts

@@ -40,6 +40,14 @@ export interface EmbeddedMessageRouterDeps {
     };
     currentSessionId: () => string;
     shutdown: () => void;
+    /**
+     * Caller-supplied register hook for long-lived disposables created inside
+     * the router (the auto-heal watchdog). The router hands its disposer to the
+     * caller once during construction; the caller is responsible for invoking
+     * it during its own shutdown — the router itself never invokes it. Mirrors
+     * `MessageDispatcherOptions.onDispose` in the standalone dispatcher.
+     */
+    onDispose?: ((disposer: () => void | Promise<void>) => void) | undefined;
     providerCtx: EmbeddedProviderContext;
     brainCtx: BrainHandlerContext;
     introspectionCtx: IntrospectionRouteContext;

package/dist/server/entry.js

@@ -11827,6 +11827,7 @@ ${metrics}` : "",
     task.labels?.length ? `Labels: ${task.labels.join(", ")}` : "",
     "",
     "Work the task end-to-end. Use the kanban tool, not direct file edits, to update this task.",
+    "Stay inside this task: its description and success criteria define the boundary. If you notice problems outside this task while working, do not fix them \u2014 note them in lastResult instead.",
     ...leaseId ? [
       "LEASE CONTRACT:",
       `- Your leaseId is "${leaseId}". Include expectedLeaseId "${leaseId}" in every mark_assignment and heartbeat_assignment call.`,
@@ -11835,7 +11836,7 @@ ${metrics}` : "",
       "On failure the host may call recover_stale; respect its decisions and do not duplicate work."
     ] : [],
     `When you start or finish, call kanban with action "mark_assignment", boardId "${board.id}", taskId "${task.id}", and assignmentStatus "running", "completed", or "failed"${leaseId ? `, and expectedLeaseId "${leaseId}"` : ""}. Include lastResult or error when you finish. On managed lifecycle boards, mark_assignment(completed) will automatically advance your card from Running to Review \u2014 a separate verification step is required before the card reaches Done.`,
-    "When finished, report what changed, what you verified, and any remaining blockers."
+    "When finished, report what changed, what you verified, any remaining blockers, and any issues you noticed outside this task's scope."
   ].filter(Boolean).join("\n");
 }
 function findTask(tasks, taskId) {
@@ -15217,9 +15218,19 @@ async function handleBrainAsk(ctx, ws, question) {
       risk: "medium",
       fallback: "ask_human"
     });
+    const answerSessionId = ctx.getSessionId?.();
     ctx.send(ws, {
       type: "brain.answer",
-      payload: { sessionId: ctx.getSessionId?.(), question: q, decision }
+      // Omit sessionId when there is no session: this is a direct reply to
+      // the asker, not a broadcast, but the client's session gate
+      // (isActiveSessionMessage) is fail-closed on a present-but-empty
+      // sessionId — stamping '' would hide the answer from its own asker
+      // in an embedded host with an unbound agent context.
+      payload: {
+        ...answerSessionId ? { sessionId: answerSessionId } : {},
+        question: q,
+        decision
+      }
     });
   } catch (err) {
     sendResult6(ctx, ws, false, `Brain consultation failed: ${toErrorMessage6(err)}`);
@@ -17303,7 +17314,12 @@ function createProviderHandlers(deps2) {
 
 // src/server/session-handlers.ts
 import { loadTodosCheckpoint } from "@wrongstack/core/storage";
-import { DEFAULT_CONTEXT_WINDOW_MODE_ID, resolveContextWindowPolicy } from "@wrongstack/core/types";
+import {
+  CONTEXT_WINDOW_MODE_PINNED_META_KEY,
+  DEFAULT_CONTEXT_WINDOW_MODE_ID,
+  isContextWindowModeId,
+  resolveContextWindowPolicy
+} from "@wrongstack/core/types";
 import { repairToolUseAdjacency as repairToolUseAdjacency2, sessionScopedPath } from "@wrongstack/core/utils";
 
 // src/protocol/client-conversation.ts
@@ -17825,6 +17841,7 @@ var SERVER_WORKSPACE_MESSAGE_TYPES = [
 var SERVER_CONFIGURATION_MESSAGE_TYPES = [
   "auth.oauth.status",
   "codebase.index.server.shutdown_result",
+  "connections.auto_heal_status",
   "connections.health_error",
   "connections.health_result",
   "connections.service_action_result",
@@ -18603,8 +18620,8 @@ function createSessionHandlers(ctx) {
         return;
       }
       const { id } = parsed.value;
-      let policy = resolveContextWindowPolicy({}, id);
-      if (policy.id !== id) {
+      let policy = resolveContextWindowPolicy({}, id, readSessionWindowTokens(ctx.context));
+      if (!isContextWindowModeId(id) && policy.id !== id) {
         const customModes = (await modeStore()).list().filter((m) => m.custom === true);
         const custom = customModes.find((m) => m.id === id);
         if (!custom) {
@@ -18615,6 +18632,7 @@ function createSessionHandlers(ctx) {
       }
       ctx.context.meta["contextWindowMode"] = policy.id;
       ctx.context.meta["contextWindowPolicy"] = policy;
+      ctx.context.meta[CONTEXT_WINDOW_MODE_PINNED_META_KEY] = true;
       result(ws, true, `Context mode switched to ${policy.id}`);
       broadcastToAll({
         type: "context.mode.changed",
@@ -18678,11 +18696,14 @@ function createSessionHandlers(ctx) {
       }
       const { id } = parsed.value;
       if (String(ctx.context.meta["contextWindowMode"] ?? "") === id) {
-        ctx.context.meta["contextWindowMode"] = DEFAULT_CONTEXT_WINDOW_MODE_ID;
-        ctx.context.meta["contextWindowPolicy"] = resolveContextWindowPolicy(
+        const policy = resolveContextWindowPolicy(
           {},
-          DEFAULT_CONTEXT_WINDOW_MODE_ID
+          DEFAULT_CONTEXT_WINDOW_MODE_ID,
+          readSessionWindowTokens(ctx.context)
         );
+        ctx.context.meta["contextWindowMode"] = policy.id;
+        ctx.context.meta["contextWindowPolicy"] = policy;
+        delete ctx.context.meta[CONTEXT_WINDOW_MODE_PINNED_META_KEY];
       }
       const store = await modeStore();
       const operation = store.remove(id);
@@ -18889,6 +18910,12 @@ function createSessionHandlers(ctx) {
     }
   };
 }
+function readSessionWindowTokens(context) {
+  const meta = context.meta?.["effectiveMaxContext"];
+  if (typeof meta === "number" && Number.isFinite(meta) && meta > 0) return meta;
+  const cap = context.provider?.capabilities?.maxContext;
+  return typeof cap === "number" && Number.isFinite(cap) && cap > 0 ? cap : 0;
+}
 
 // src/server/agent-roster-handlers.ts
 import {
@@ -19387,6 +19414,259 @@ async function handleCodebaseIndexServerControl(ws, message, deps2) {
   return true;
 }
 
+// src/server/connections/auto-healer.ts
+var AUTO_HEAL_ENV_FLAG = "WRONGSTACK_AUTO_HEAL_SERVICES";
+var AUTO_HEAL_DEFAULT_INTERVAL_MS = 3e4;
+var AUTO_HEAL_DEFAULT_COOLDOWN_MS = 5 * 6e4;
+var AUTO_HEAL_DEFAULT_MAX_ATTEMPTS = 3;
+var RESTARTABLE_SERVICE_IDS = /* @__PURE__ */ new Set([
+  "kanban",
+  "sage",
+  "chronicle",
+  "codebase-index",
+  "mailbox"
+]);
+function isAutoHealEnabled() {
+  return process.env[AUTO_HEAL_ENV_FLAG] === "1";
+}
+function createAutoHealer(options) {
+  const enabled = options.enabled ?? isAutoHealEnabled();
+  const intervalMs = options.intervalMs ?? AUTO_HEAL_DEFAULT_INTERVAL_MS;
+  const cooldownMs = options.cooldownMs ?? AUTO_HEAL_DEFAULT_COOLDOWN_MS;
+  const maxAttempts = options.maxAttempts ?? AUTO_HEAL_DEFAULT_MAX_ATTEMPTS;
+  const collect = options.collect ?? (() => collectConnectionsHealth({
+    projectRoot: options.projectRoot(),
+    indexDir: options.indexDir(),
+    backend: "standalone"
+  }));
+  const execute = options.execute ?? executeServiceAction;
+  const services = /* @__PURE__ */ new Map();
+  let timer = null;
+  let running = false;
+  let ticking = false;
+  let disposed = false;
+  let inFlightTick = null;
+  let lastTickAt = null;
+  let warnedNoBoundary = false;
+  function stateFor(serviceId) {
+    let state = services.get(serviceId);
+    if (!state) {
+      state = {
+        lastAttemptAt: null,
+        consecutiveFailures: 0,
+        lastSuccess: null,
+        lastMessage: null,
+        inFlight: false,
+        escalated: false
+      };
+      services.set(serviceId, state);
+    }
+    return state;
+  }
+  function snapshot() {
+    return {
+      enabled,
+      running,
+      lastTickAt,
+      services: Object.fromEntries(services)
+    };
+  }
+  function emitStatus(event) {
+    try {
+      options.onStatus?.({ ...event, at: Date.now() });
+    } catch (error2) {
+      options.logger?.warn?.(
+        `[AutoHeal] onStatus hook threw: ${error2 instanceof Error ? error2.message : String(error2)}`
+      );
+    }
+  }
+  async function tick() {
+    if (!enabled || disposed) return snapshot();
+    if (!options.trustBoundary) {
+      if (!warnedNoBoundary) {
+        warnedNoBoundary = true;
+        options.logger?.warn?.(
+          "[AutoHeal] Disabled: no policy authority (trust boundary) is configured."
+        );
+      }
+      return snapshot();
+    }
+    if (ticking) return snapshot();
+    ticking = true;
+    try {
+      const report = await collect();
+      const now = Date.now();
+      const projectRoot = options.projectRoot();
+      const indexDir = options.indexDir();
+      for (const service of report.services) {
+        if (disposed) break;
+        const state = stateFor(service.id);
+        if (service.status !== "error") {
+          state.consecutiveFailures = 0;
+          state.escalated = false;
+          continue;
+        }
+        if (!RESTARTABLE_SERVICE_IDS.has(service.id) || service.control === "none") {
+          continue;
+        }
+        if (state.lastAttemptAt !== null && now - state.lastAttemptAt < cooldownMs) continue;
+        if (state.consecutiveFailures >= maxAttempts) {
+          state.escalated = true;
+          options.logger?.warn?.(
+            `[AutoHeal] ${service.id} left to manual intervention after ${state.consecutiveFailures} failed auto-restart(s): ${state.lastMessage ?? "unknown"}`
+          );
+          continue;
+        }
+        if (state.inFlight) continue;
+        const authorization = await authorizeWebUIAction(
+          options.trustBoundary,
+          {
+            capability: "connections.service.restart",
+            subject: { kind: "process", id: `${service.id}@${projectRoot}` },
+            risk: "elevated",
+            cwd: projectRoot,
+            metadata: { transport: "auto-heal", serviceId: service.id, action: "restart" }
+          },
+          options.logger
+        );
+        if (disposed) break;
+        if (!authorization.allowed) {
+          state.lastAttemptAt = now;
+          state.lastMessage = `refused by policy: ${authorization.reason}`;
+          emitStatus({
+            serviceId: service.id,
+            phase: "refused",
+            message: `refused by policy: ${authorization.reason}`,
+            attempt: state.consecutiveFailures + 1
+          });
+          options.logger?.warn?.(
+            `[AutoHeal] ${service.id} restart refused by policy: ${authorization.reason}`
+          );
+          continue;
+        }
+        state.inFlight = true;
+        const attempt = state.consecutiveFailures + 1;
+        emitStatus({
+          serviceId: service.id,
+          phase: "restarting",
+          message: `Auto-restarting ${service.id}`,
+          attempt
+        });
+        try {
+          const result = await execute(service.id, "restart", projectRoot, indexDir);
+          state.consecutiveFailures = result.success ? 0 : state.consecutiveFailures + 1;
+          state.lastSuccess = result.success;
+          state.lastMessage = result.message;
+          emitStatus({
+            serviceId: service.id,
+            phase: result.success ? "restarted" : "failed",
+            message: result.message,
+            attempt
+          });
+          if (!result.success && state.consecutiveFailures >= maxAttempts) {
+            state.escalated = true;
+            emitStatus({
+              serviceId: service.id,
+              phase: "escalated",
+              message: `left to manual intervention after ${state.consecutiveFailures} failed auto-restart(s): ${result.message}`,
+              attempt
+            });
+            options.logger?.warn?.(
+              `[AutoHeal] ${service.id} escalated after ${state.consecutiveFailures} failed auto-restart(s): ${result.message}`
+            );
+          }
+          options.logger?.[result.success ? "info" : "warn"]?.(
+            `[AutoHeal] ${service.id} auto-restart ${result.success ? "succeeded" : "failed"}: ${result.message}`
+          );
+        } catch (error2) {
+          state.consecutiveFailures += 1;
+          state.lastSuccess = false;
+          state.lastMessage = error2 instanceof Error ? error2.message : String(error2);
+          emitStatus({
+            serviceId: service.id,
+            phase: "failed",
+            message: state.lastMessage,
+            attempt
+          });
+          if (state.consecutiveFailures >= maxAttempts) {
+            state.escalated = true;
+            emitStatus({
+              serviceId: service.id,
+              phase: "escalated",
+              message: `left to manual intervention after ${state.consecutiveFailures} failed auto-restart(s): ${state.lastMessage}`,
+              attempt
+            });
+            options.logger?.warn?.(
+              `[AutoHeal] ${service.id} escalated after ${state.consecutiveFailures} failed auto-restart(s): ${state.lastMessage}`
+            );
+          }
+          options.logger?.warn?.(
+            `[AutoHeal] ${service.id} auto-restart threw: ${state.lastMessage}`
+          );
+        } finally {
+          state.lastAttemptAt = Date.now();
+          state.inFlight = false;
+        }
+      }
+      lastTickAt = Date.now();
+    } catch (error2) {
+      options.logger?.warn?.(
+        `[AutoHeal] health collect failed: ${error2 instanceof Error ? error2.message : String(error2)}`
+      );
+    } finally {
+      ticking = false;
+    }
+    return snapshot();
+  }
+  function runTick() {
+    if (!enabled || disposed || running === false || ticking) return;
+    const pending = tick();
+    const tracked = pending.then(
+      () => void 0,
+      () => void 0
+    );
+    inFlightTick = tracked;
+    void tracked.finally(() => {
+      if (inFlightTick === tracked) inFlightTick = null;
+    });
+  }
+  function stopInternal() {
+    if (timer) {
+      clearInterval(timer);
+      timer = null;
+    }
+    running = false;
+  }
+  return {
+    start() {
+      if (!enabled || running || disposed) return;
+      running = true;
+      runTick();
+      timer = setInterval(runTick, intervalMs);
+      timer.unref?.();
+    },
+    stop: stopInternal,
+    async dispose() {
+      stopInternal();
+      disposed = true;
+      const pending = inFlightTick;
+      if (pending) {
+        await Promise.race([
+          pending,
+          new Promise((resolve19) => {
+            const t = setTimeout(resolve19, 3e4);
+            t.unref?.();
+          })
+        ]);
+      }
+      disposed = true;
+    },
+    tick,
+    getSnapshot: snapshot,
+    isRunning: () => running
+  };
+}
+
 // src/server/fallback-choice.ts
 function emitFallbackChoice(events, msg) {
   const parsed = validateModelFallbackChoicePayload(msg.payload);
@@ -22572,6 +22852,7 @@ import {
 import { TOKENS } from "@wrongstack/core/kernel";
 import { SessionMemoryConsolidator } from "@wrongstack/core/storage";
 import {
+  CONTEXT_WINDOW_MODE_PINNED_META_KEY as CONTEXT_WINDOW_MODE_PINNED_META_KEY2,
   DEFAULT_TOOLS_CONFIG,
   resolveContextWindowPolicy as resolveContextWindowPolicy2
 } from "@wrongstack/core/types";
@@ -23492,22 +23773,26 @@ async function createAgentServices(input) {
     summarizerModel: config.context?.summarizerModel,
     llmSelector: config.context?.llmSelector
   });
-  const initialContextPolicy = resolveContextWindowPolicy2(config.context);
+  let effectiveMaxContext = 0;
+  try {
+    const m = await resolveProviderModelMetadata(
+      modelsRegistry,
+      config.provider,
+      context.model,
+      config.providers?.[config.provider]
+    );
+    effectiveMaxContext = m?.capabilities?.maxContext ?? 0;
+  } catch {
+  }
+  if (!effectiveMaxContext) effectiveMaxContext = config.context?.effectiveMaxContext ?? 0;
+  if (!effectiveMaxContext) effectiveMaxContext = provider.capabilities.maxContext;
+  const initialContextPolicy = resolveContextWindowPolicy2(
+    config.context,
+    void 0,
+    effectiveMaxContext
+  );
   let autoCompactor;
   if (config.context?.autoCompact !== false) {
-    let effectiveMaxContext = 0;
-    try {
-      const m = await resolveProviderModelMetadata(
-        modelsRegistry,
-        config.provider,
-        context.model,
-        config.providers?.[config.provider]
-      );
-      effectiveMaxContext = m?.capabilities?.maxContext ?? 0;
-    } catch {
-    }
-    if (!effectiveMaxContext) effectiveMaxContext = config.context?.effectiveMaxContext ?? 0;
-    if (!effectiveMaxContext) effectiveMaxContext = provider.capabilities.maxContext;
     autoCompactor = new AutoCompactionMiddlewareCtor(
       compactor,
       effectiveMaxContext,
@@ -23562,6 +23847,15 @@ async function createAgentServices(input) {
       context.meta["effectiveMaxContext"] = newMaxContext;
       autoCompactor?.setMaxContext(newMaxContext);
       autoCompactor?.setEnabled(config.context?.autoCompact !== false);
+      if (context.meta[CONTEXT_WINDOW_MODE_PINNED_META_KEY2] !== true) {
+        const policy = resolveContextWindowPolicy2(
+          currentConfig.context ?? {},
+          void 0,
+          newMaxContext
+        );
+        context.meta["contextWindowMode"] = policy.id;
+        context.meta["contextWindowPolicy"] = policy;
+      }
     } else {
       delete context.meta["effectiveMaxContext"];
       autoCompactor?.setEnabled(false);
@@ -24193,8 +24487,22 @@ function createMessageDispatcher(opts) {
     broadcast: (message) => broadcast(state.getClients(), message),
     log: (message) => deps2.logger.warn?.(`[KanbanSupervisor] ${message}`)
   });
+  const autoHealer = createAutoHealer({
+    projectRoot: () => state.getProjectRoot(),
+    indexDir: () => typeof deps2.context.meta["codebaseIndexDir"] === "string" ? deps2.context.meta["codebaseIndexDir"] : void 0,
+    trustBoundary: deps2.trustBoundary,
+    logger: deps2.logger,
+    onStatus: (event) => broadcast(state.getClients(), {
+      type: "connections.auto_heal_status",
+      payload: event
+    })
+  });
+  autoHealer.start();
   if (opts.onDispose) {
-    const dispose = () => kanbanSupervisor.dispose();
+    const dispose = async () => {
+      kanbanSupervisor.dispose();
+      await autoHealer.dispose();
+    };
     opts.onDispose(dispose);
   }
   const kanbanContext = () => ({
@@ -25058,7 +25366,11 @@ async function createPreContextServices(input) {
     model: config.model
   });
   context.meta["promptOnlineAgents"] = onlineAgents;
-  const initialContextPolicy = resolveContextWindowPolicy3(config.context);
+  const initialContextPolicy = resolveContextWindowPolicy3(
+    config.context,
+    void 0,
+    provider.capabilities?.maxContext
+  );
   context.meta["contextWindowMode"] = initialContextPolicy.id;
   context.meta["contextWindowPolicy"] = initialContextPolicy;
   context.state.setMeta(
@@ -25903,7 +26215,7 @@ function setupWebuiShutdown(options) {
     onPreShutdown: async () => {
       await options.stopEmptySessionCleanup.dispose();
       const disposeKanban = options.getKanbanSupervisorDispose();
-      disposeKanban?.();
+      await disposeKanban?.();
     },
     onShutdown: async () => {
       unregister();

package/dist/server/start-webui-shutdown.d.ts

@@ -12,7 +12,7 @@ export declare function setupWebuiShutdown(options: {
     stopEmptySessionCleanup: {
         dispose: () => Promise<void>;
     };
-    getKanbanSupervisorDispose: () => (() => void) | null;
+    getKanbanSupervisorDispose: () => (() => void | Promise<void>) | null;
     todosCheckpoint: {
         detach: () => Promise<void>;
     };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrongstack/webui-server",
-  "version": "0.308.1",
+  "version": "0.308.4",
   "license": "MIT",
   "description": "WrongStack WebUI HTTP/WebSocket server module — extracted from @wrongstack/webui in PR #243/244 to remove the CLI -> @wrongstack/webui/server cross-package edge (audit §3.1.1). Pure backend: HTTP routes, WebSocket handlers, MCP tool wrappers, HTML serving. The web frontend lives in @wrongstack/webui; this package is the standalone server it can run on.",
   "keywords": [
@@ -40,17 +40,17 @@
   ],
   "dependencies": {
     "ws": "^8.21.3",
-    "@wrongstack/core": "0.308.1",
-    "@wrongstack/requirement-intake": "0.308.1",
-    "@wrongstack/kanban": "0.308.1",
-    "@wrongstack/sdd": "0.308.1",
-    "@wrongstack/mcp": "0.308.1",
-    "@wrongstack/providers": "0.308.1",
-    "@wrongstack/runtime": "0.308.1",
-    "@wrongstack/techstack": "0.308.1",
-    "@wrongstack/sage": "0.308.1",
-    "@wrongstack/tools": "0.308.1",
-    "@wrongstack/vector-memory": "0.308.1"
+    "@wrongstack/requirement-intake": "0.308.4",
+    "@wrongstack/core": "0.308.4",
+    "@wrongstack/mcp": "0.308.4",
+    "@wrongstack/kanban": "0.308.4",
+    "@wrongstack/techstack": "0.308.4",
+    "@wrongstack/sage": "0.308.4",
+    "@wrongstack/sdd": "0.308.4",
+    "@wrongstack/runtime": "0.308.4",
+    "@wrongstack/vector-memory": "0.308.4",
+    "@wrongstack/tools": "0.308.4",
+    "@wrongstack/providers": "0.308.4"
   },
   "devDependencies": {
     "@types/node": "^26.2.0",