@wrongstack/webui-server 0.309.0 → 0.310.0

package/dist/server/frontend-static-serve.d.ts

@@ -26,6 +26,8 @@ export interface StaticServeHandle {
     server: Server;
     port: number;
 }
+/** Bun-compatible replacement for Node's newer `module.findPackageJSON`. */
+export declare function findInstalledPackageJson(specifier: string, baseUrl?: string | URL): string | undefined;
 export interface StaticServeOptions {
     host: string;
     httpPort: number;

package/dist/server/index.d.ts

@@ -10,28 +10,34 @@
  */
 export { type AutonomyRouteHandlers, createAutonomyRouteHandlers, handleAutonomyRoute, } from './autonomy-routes.js';
 export { bootConfig, patchConfig } from './boot.js';
-export { cleanupOwnerlessEmptySessions, DEFAULT_EMPTY_SESSION_CLEANUP_INTERVAL_MS, EMPTY_SESSION_CLEANUP_INTERVAL_ENV, resolveEmptySessionCleanupInterval, scheduleOwnerlessEmptySessionCleanup, } from './session-cleanup-scheduler.js';
-export { deleteWebUISession } from './session-deletion.js';
+export { type BrainHandlerContext, type BrainLogEntry, type BrainTransportContext, handleBrainAsk, handleBrainConfigGet, handleBrainConfigSet, handleBrainRisk, handleBrainStatus, } from './brain-handlers.js';
 export type { BrainRouteHandlers } from './brain-routes.js';
 export { handleBrainRoute } from './brain-routes.js';
 export { type ChronicleRouteContext, handleChronicleRoute, } from './chronicle-routes.js';
+export { createWebuiClientPresence, type WebuiClientPresence, type WebuiClientPresenceDeps, type WebuiHqConnection, type WebuiHqConnectionOptions, } from './client-presence.js';
 export { type ClientTransportRouteHandlers, handleClientTransportRoute, } from './client-transport-routes.js';
 export { setupWebUICodebaseIndexing } from './codebase-indexing.js';
 export { type CodeMapFileTarget, type CodeMapOperation, extractCodeMapFileTargets, normalizeCodeMapFileTarget, } from './codemap-telemetry.js';
 export { type CollaborationHandlerOptions, CollaborationWebSocketHandler, } from './collaboration-ws-handler.js';
 export { type CompletionHandlerOptions, type CompletionItemKind, type CompletionSuggestion, createToolLspCompletionSource, handleCompletionRequest, type LspCompletionSource, type LspCompletionSourceRequest, } from './completion-handlers.js';
 export { type CompletionRouteHandlers, handleCompletionRoute } from './completion-routes.js';
+export { type ConfigDoctorDeps, handleConfigDoctor, } from './config-doctor.js';
+export { type ConnectionLifecycleOptions, createConnectionLifecycle, } from './connection-lifecycle.js';
+export { type ConnectionHealthService, type ConnectionsHealthContext, type ConnectionsHealthReport, collectConnectionsHealth, handleConnectionsHealthRoute, } from './connections-health-route.js';
 export { type ContentRouteContext, handleContentRoute } from './content-routes.js';
+export { applyContextEditorProposal, buildContextEditorSnapshot, type ContextEditorAppliedResult, type ContextEditorBlock, type ContextEditorConflict, type ContextEditorDiagnostics, type ContextEditorMessage, type ContextEditorMetrics, type ContextEditorRepairPreview, type ContextEditorSnapshot, type ContextEditorValidationError, type ContextEditorValidationResult, type ContextEditorWarning, contextEditorRevision, validateContextEditorMessages, validateContextEditorProposal, } from './context-editor.js';
+export { seedContextMeta } from './context-meta.js';
+export { type ConversationOperationsContext, type ConversationRunControl, createConversationOperations, } from './conversation-operations.js';
 export { type ConversationRouteHandlers, handleConversationRoute, } from './conversation-routes.js';
-export { createConversationOperations, type ConversationOperationsContext, type ConversationRunControl, } from './conversation-operations.js';
-export { applyContextEditorProposal, buildContextEditorSnapshot, contextEditorRevision, validateContextEditorMessages, validateContextEditorProposal, type ContextEditorAppliedResult, type ContextEditorBlock, type ContextEditorConflict, type ContextEditorDiagnostics, type ContextEditorMessage, type ContextEditorMetrics, type ContextEditorRepairPreview, type ContextEditorSnapshot, type ContextEditorValidationError, type ContextEditorValidationResult, type ContextEditorWarning, } from './context-editor.js';
-export { createConnectionLifecycle, type ConnectionLifecycleOptions, } from './connection-lifecycle.js';
-export { collectConnectionsHealth, type ConnectionHealthService, type ConnectionsHealthContext, type ConnectionsHealthReport, handleConnectionsHealthRoute, } from './connections-health-route.js';
 export { type CustomContextMode, type CustomModeStore, createCustomModeStore, } from './custom-context-modes.js';
 export { type DesignContext, handleDesignList, handleDesignMaterialize, handleDesignSet, handleDesignState, handleDesignSwap, handleDesignTune, handleDesignUse, handleDesignVerify, } from './design-handlers.js';
+export { applyEmbeddedModelSwitch, broadcastEmbeddedGoalSnapshot, createEmbeddedConversationRoutes, createEmbeddedProjectRoutes, createEmbeddedProviderOperations, createEmbeddedSessionRoutes, type EmbeddedAgentConfigContext, type EmbeddedConversationContext, type EmbeddedHostTransport, type EmbeddedProjectContext, type EmbeddedProviderContext, type EmbeddedProviderStore, type EmbeddedSessionContext, type EmbeddedSessionOptions, } from './embedded-host-adapters.js';
+export { type AnnounceWebuiReadyParams, announceWebuiReady, createWebuiShutdown, type RegisterWebuiInstanceDeps, type RegisterWebuiInstanceParams, registerWebuiInstance, registerWebuiSignalHandlers, type WebuiShutdownResources, } from './embedded-lifecycle.js';
+export { createEmbeddedMessageRouter, type EmbeddedMessageRouter, type EmbeddedMessageRouterDeps, type EmbeddedMessageRouterOptions, } from './embedded-message-router.js';
 export { createEternalSubscription, type EternalBroadcast, type EternalSubscribe, type EternalSubscription, } from './eternal-iteration-broadcast.js';
 export { handleFilesCreate, handleFilesDelete, handleFilesList, handleFilesMove, handleFilesRead, handleFilesRename, handleFilesSkeleton, handleFilesTree, handleFilesWrite, } from './file-handlers.js';
 export { isHiddenEntry, rankFiles, SKIP_DIRS } from './file-picker.js';
+export { type EnsureDistDeps, ensureDistDir, findInstalledPackageJson, type ResolveDistOptions, resolveDistDir, type StaticServeDeps, type StaticServeHandle, type StaticServeOptions, startStaticServe, } from './frontend-static-serve.js';
 export { handleGitChanges, handleGitDiff, handleGitInfo } from './git-handlers.js';
 export { handleGoalGet } from './goal-handlers.js';
 export type { GoalRouteHandlers } from './goal-routes.js';
@@ -46,13 +52,14 @@ export type { CreateHttpServerOptions } from './http-server.js';
 export { buildCspHeader, createHttpServer, decodeSessionId, injectWsConfig, isInsideDist, } from './http-server.js';
 export { defaultBaseDir, formatInstances, isPidAlive, joinSessionRegistryWithWebUIInstances, listInstances, registerInstance, registryPath, unregisterInstance, type WebUIInstanceAuthInfo, type WebUIInstanceRecord, type WebUIInstanceRole, type WebUISessionAttachCandidate, type WebUISessionAttachDegradedReason, type WebUISessionAttachEndpoint, } from './instance-registry.js';
 export { handleIntrospectionRoute, type IntrospectionRouteContext, } from './introspection-routes.js';
+export { watchKanbanBoards } from './kanban-board-watcher.js';
 export { handleKanbanTaskDispatch, type KanbanDispatchContext, type KanbanDispatchResult, type KanbanTaskDispatcher, parseResolvedDispatchRoute, type ResolvedDispatchRoute, } from './kanban-dispatch.js';
 export { handleKanbanHostRoute, type KanbanHostRouteHandlers } from './kanban-host-routes.js';
 export type { KanbanBoardPage, KanbanRouteContext } from './kanban-routes.js';
 export { handleKanbanRoute, KANBAN_CLIENT_MESSAGE_TYPES, paginateKanbanBoards, } from './kanban-routes.js';
-export { watchKanbanBoards } from './kanban-board-watcher.js';
+export { buildTaskGraphFromGoalPhase, buildTaskGraphFromSddSnapshot, createKanbanRunMirror, type KanbanRunMirror, type KanbanRunMirrorDeps, } from './kanban-run-mirror.js';
+export { createKanbanSupervisor, type KanbanSupervisor, type KanbanSupervisorDeps, type KanbanSupervisorDispatchOptions, } from './kanban-supervisor.js';
 export { createShutdown, registerShutdownHandlers } from './lifecycle.js';
-export { handleConfigDoctor, type ConfigDoctorDeps, } from './config-doctor.js';
 export { getMailboxForDeps, handleMailboxAgents, handleMailboxClear, handleMailboxCompact, handleMailboxMessages, handleMailboxPurge, type MailboxHandlerDeps, } from './mailbox-handlers.js';
 export { createMailboxRouteHandlers, handleMailboxRoute, type MailboxRouteContext, type MailboxRouteHandlers, } from './mailbox-routes.js';
 export { handleMcpAdd, handleMcpDisable, handleMcpDiscover, handleMcpEnable, handleMcpList, handleMcpPromptGet, handleMcpPrompts, handleMcpRemove, handleMcpResourceRead, handleMcpResources, handleMcpRestart, handleMcpSleep, handleMcpUpdate, handleMcpWake, } from './mcp-handlers.js';
@@ -65,30 +72,21 @@ export type { ModeRouteHandlers } from './mode-routes.js';
 export { createModeRouteHandlers, handleModeRoute } from './mode-routes.js';
 export { resolveProviderCatalogForModels, resolveProviderModelMetadata } from './model-catalog.js';
 export { createModelOperations, type ModelOperationsContext, type ModelRefinePayload, } from './model-operations.js';
+export { formatExternalAccessUrls, getExternalAddresses, type NetworkAddress, } from './network-info.js';
 export { browserOpenCommand, openBrowser } from './open-browser.js';
 export { isPathInside, resolveWorkingDirInsideProject } from './path-containment.js';
 export type { ConfirmDecision, PendingConfirm } from './pending-confirms.js';
 export { isDestructivePendingConfirm, resolveAllPendingConfirms, resolveYoloEligiblePendingConfirms, } from './pending-confirms.js';
 export { findFreePort, getSurfaceDefaultPorts, isPortFree, isStrictPort, listenWithRetry, SURFACE_DEFAULT_PORTS, type SurfaceKind, surfaceLabel, } from './port-utils.js';
-export { ensureDistDir, resolveDistDir, startStaticServe, type EnsureDistDeps, type ResolveDistOptions, type StaticServeDeps, type StaticServeHandle, type StaticServeOptions, } from './frontend-static-serve.js';
-export { announceWebuiReady, createWebuiShutdown, registerWebuiInstance, registerWebuiSignalHandlers, type AnnounceWebuiReadyParams, type RegisterWebuiInstanceDeps, type RegisterWebuiInstanceParams, type WebuiShutdownResources, } from './embedded-lifecycle.js';
-export { createStreamCoalescer, type StreamCoalescer, type StreamCoalescerDeps, type ToolProgressPayload, } from './stream-coalescer.js';
-export { createWebuiClientPresence, type WebuiClientPresence, type WebuiClientPresenceDeps, type WebuiHqConnection, type WebuiHqConnectionOptions, } from './client-presence.js';
-export { handleBrainAsk, handleBrainConfigGet, handleBrainConfigSet, handleBrainRisk, handleBrainStatus, type BrainHandlerContext, type BrainLogEntry, type BrainTransportContext, } from './brain-handlers.js';
-export { buildTaskGraphFromGoalPhase, buildTaskGraphFromSddSnapshot, createKanbanRunMirror, type KanbanRunMirror, type KanbanRunMirrorDeps, } from './kanban-run-mirror.js';
-export { createKanbanSupervisor, type KanbanSupervisor, type KanbanSupervisorDeps, type KanbanSupervisorDispatchOptions, } from './kanban-supervisor.js';
-export { seedContextMeta } from './context-meta.js';
-export { type ConfigWriteLockHolder, type PrefHelperDeps, PREF_KEYS, persistPrefsToConfig, prefSnapshot, } from './pref-helpers.js';
+export { type ConfigWriteLockHolder, PREF_KEYS, type PrefHelperDeps, persistPrefsToConfig, prefSnapshot, } from './pref-helpers.js';
 export { handleAutonomySwitch, handlePrefsGet, handlePrefsUpdate, type PrefsHandlerContext, } from './prefs-handlers.js';
 export { createPrefsRouteHandlers, handlePrefsRoute, type PrefsRouteHandlers, } from './prefs-routes.js';
 export { handleProcessKill, handleProcessKillAll, handleProcessList, } from './process-handlers.js';
 export { handleProcessRoute, type ProcessRouteHandlers } from './process-routes.js';
-export { applyEmbeddedModelSwitch, broadcastEmbeddedGoalSnapshot, createEmbeddedConversationRoutes, createEmbeddedProjectRoutes, createEmbeddedProviderOperations, createEmbeddedSessionRoutes, type EmbeddedAgentConfigContext, type EmbeddedConversationContext, type EmbeddedHostTransport, type EmbeddedProjectContext, type EmbeddedProviderContext, type EmbeddedProviderStore, type EmbeddedSessionContext, type EmbeddedSessionOptions, } from './embedded-host-adapters.js';
-export { createEmbeddedMessageRouter, type EmbeddedMessageRouter, type EmbeddedMessageRouterDeps, type EmbeddedMessageRouterOptions, } from './embedded-message-router.js';
-export { createRouteFamilyDispatcher, type RouteFamilyDispatcher, type RouteFamilyDispatcherOptions, type RouteFamilyTable, } from './route-family-dispatcher.js';
+export { createProjectHandlers, type ProjectHandlersContext } from './project-handlers.js';
 export type { ProjectRouteHandlers } from './project-routes.js';
 export { handleProjectRoute } from './project-routes.js';
-export { createProjectHandlers, type ProjectHandlersContext } from './project-handlers.js';
+export { startProjectWatcher } from './project-watcher.js';
 export { ensureProjectDataDir, loadManifest, projectsJsonPath, saveManifest, touchProjectInManifest, } from './projects-manifest.js';
 export { handlePromptsContent, handlePromptsCreate, handlePromptsFavorite, handlePromptsJournal, handlePromptsList, handlePromptsRecent, handlePromptsSearch, handlePromptsUsed, type PromptsContext, } from './prompts-handlers.js';
 export { loadSavedProviders, saveProviders } from './provider-config-io.js';
@@ -99,15 +97,18 @@ export type { ProviderMutationHandlers, ProviderRouteHandlers } from './provider
 export { handleProviderRoute } from './provider-routes.js';
 export type { ProviderStore } from './provider-store.js';
 export { createConfigWriteLock, createProviderStore } from './provider-store.js';
+export { createRouteFamilyDispatcher, type RouteFamilyDispatcher, type RouteFamilyDispatcherOptions, type RouteFamilyTable, } from './route-family-dispatcher.js';
 export { handleSddBoardRoute, type SddBoardRouteHandlers } from './sdd-board-routes.js';
 export { SddBoardWebSocketHandler } from './sdd-board-ws-handler.js';
 export { handleSddWizardRoute, type SddWizardRouteHandlers } from './sdd-wizard-routes.js';
 export { buildSddWizardDeps, type SddWizardWiringOptions, type StartSddRunFromGraphConfig, type StartSddRunFromGraphDeps, startSddRunFromGraph, } from './sdd-wizard-wiring.js';
 export { type SddWizardDeps, SddWizardWebSocketHandler } from './sdd-wizard-ws-handler.js';
+export { cleanupOwnerlessEmptySessions, DEFAULT_EMPTY_SESSION_CLEANUP_INTERVAL_MS, EMPTY_SESSION_CLEANUP_INTERVAL_ENV, resolveEmptySessionCleanupInterval, scheduleOwnerlessEmptySessionCleanup, } from './session-cleanup-scheduler.js';
+export { deleteWebUISession } from './session-deletion.js';
+export { createSessionHandlers, type SessionHandlersContext } from './session-handlers.js';
 export { type SessionHistoryWireEntry, toSessionHistoryEntries, toSessionHistoryEntry, } from './session-history.js';
 export type { SessionRouteHandlers } from './session-routes.js';
 export { handleSessionRoute } from './session-routes.js';
-export { createSessionHandlers, type SessionHandlersContext } from './session-handlers.js';
 export { setupEvents, statusProjectHashFromWatchFilename } from './setup-events.js';
 export type { ShellGitRouteHandlers } from './shell-git-routes.js';
 export { handleShellGitRoute } from './shell-git-routes.js';
@@ -115,18 +116,17 @@ export { handleShellOpen, type ShellOpenOptions, type ShellOpenRequest, type She
 export { handleSkillsContent, handleSkillsCreate, handleSkillsEdit, handleSkillsExport, handleSkillsInstall, handleSkillsList, handleSkillsUninstall, handleSkillsUpdate, type SkillsContext, } from './skills-handlers.js';
 export { handleSpecsRoute, type SpecsRouteHandlers } from './specs-routes.js';
 export { SpecsWebSocketHandler } from './specs-ws-handler.js';
-export { startProjectWatcher } from './project-watcher.js';
 export { startWebUI } from './start-webui.js';
+export { createStreamCoalescer, type StreamCoalescer, type StreamCoalescerDeps, type ToolProgressPayload, } from './stream-coalescer.js';
 export { TerminalWebSocketHandler } from './terminal-ws-handler.js';
 export { type ContextBreakdown, estimateContextBreakdown, estimateTokens, type MessageTokenEntry, messagePreview, messageTokens, stringifyContent, type ToolTokenEntry, } from './token-estimator.js';
 export type { BackendServices, ConnectedClient, WebUIOptions, WSClientMessage, WSServerMessage, } from './types.js';
-export { computeUsageCost, getCostRates, type CostRates, type TokenUsage, } from './usage-cost.js';
+export { type CostRates, computeUsageCost, getCostRates, type TokenUsage, } from './usage-cost.js';
 export { createWorklistRouteHandlers, handleWorklistRoute, type WorklistRouteContext, type WorklistRouteHandlers, } from './worklist-routes.js';
 export { handleWorktreeRoute, type WorktreeRouteHandlers } from './worktree-routes.js';
 export { WorktreeWebSocketHandler } from './worktree-ws-handler.js';
 export { extractToken, extractTokenFromCookie, hostHeaderOk, isLoopbackBind, isLoopbackHostname, isWildcardBind, tokenMatches, type VerifyClientInput, verifyClient, } from './ws-auth.js';
 export { validateAutonomySwitchPayload, validateBrainAskPayload, validateBrainRiskPayload, validateContextModeCreatePayload, validateContextModeDeletePayload, validateContextModeSwitchPayload, validateContextModeUpdatePayload, validateGitDiffPayload, validateMailboxAgentsPayload, validateMailboxMessagesPayload, validateMailboxPurgePayload, validateModelSwitchPayload, validateModeSwitchPayload, validatePlanTemplateUsePayload, validatePrefsUpdatePayload, validateProcessKillPayload, validateProjectsAddPayload, validateProjectsSelectPayload, validateShellOpenPayload, validateSkillsCreatePayload, validateSkillsEditPayload, validateWorkingDirSetPayload, } from './ws-payload-validation.js';
 export { broadcast, buildWebUIAccessUrl, envFlag, errMessage, generateAuthToken, hostForBrowserUrl, resolveAuthToken, send, sendResult, sendSerialized, WEBUI_WS_MAX_BUFFERED_BYTES, } from './ws-utils.js';
-export { formatExternalAccessUrls, getExternalAddresses, type NetworkAddress } from './network-info.js';
 export { createZipBuffer, readZipEntries, type ZipEntryInput } from './zip.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/server/open-browser.d.ts

@@ -5,6 +5,15 @@
  * fire-and-forget: a missing opener, a headless box, or a spawn failure must
  * NEVER take the server down — the URL is always also printed to the console.
  */
+/**
+ * True when `url` is safe to hand to an OS opener.
+ *
+ * Scheme is checked as well as metacharacters: an opener will happily launch
+ * `file:`, `ms-msdt:` or a UNC path, and this function's callers include one
+ * (`github-copilot-oauth.ts`) whose URL comes from an HTTP response body rather
+ * than from our own code.
+ */
+export declare function isSafeBrowserUrl(url: string): boolean;
 /** Resolve the platform's URL-opener command + args. */
 export declare function browserOpenCommand(url: string, platform?: NodeJS.Platform): {
     command: string;

package/dist/server/pre-context-services.d.ts

@@ -26,7 +26,8 @@ import { type Container, EventBus } from '@wrongstack/core/kernel';
 import { DefaultModeStore } from '@wrongstack/core/models';
 import { ProviderRegistry, ToolRegistry } from '@wrongstack/core/registry';
 import { SkillInstaller } from '@wrongstack/core/skills';
-import { type AgentStatusTracker, AnnotationsStore, DefaultSessionReader, DefaultSessionStore, PromptUsageStore } from '@wrongstack/core/storage';
+import { AnnotationsStore, DefaultSessionReader, DefaultSessionStore, PromptUsageStore } from '@wrongstack/core/storage';
+import type { AgentStatusTracker } from '@wrongstack/core/coordination';
 import { type Config, type ConfigStore, type Logger, type MemoryPort, type ModelsRegistry, type Provider, type SecretVault, type SessionStore } from '@wrongstack/core/types';
 import { type WstackPaths } from '@wrongstack/core/utils';
 import type { CustomModeStore } from './custom-context-modes.js';

package/dist/server/provider/catalog.d.ts

@@ -0,0 +1,15 @@
+import type { WebSocket } from 'ws';
+import type { ProviderServiceContext } from './mutations.js';
+/**
+ * Catalog + model-resolution surface (6B-2). Moved verbatim from
+ * provider-handlers.ts: list/saved/search/models handlers plus the
+ * default-provider adoption flow.
+ */
+export declare function createCatalogHandlers(ctx: ProviderServiceContext): {
+    handleProvidersList: (ws: WebSocket) => Promise<void>;
+    handleProvidersSaved: (ws: WebSocket) => Promise<void>;
+    handleProviderModels: (ws: WebSocket, providerId: string) => Promise<void>;
+    handleProviderModelsSearch: (ws: WebSocket, query: string, limit?: number | undefined) => Promise<void>;
+    adoptDefaultProviderIfUnset: (providerId: string) => Promise<void>;
+};
+//# sourceMappingURL=catalog.d.ts.map

package/dist/server/provider/custom-models.d.ts

@@ -0,0 +1,13 @@
+import type { ProviderConfig } from '@wrongstack/core/types';
+import type { WebSocket } from 'ws';
+import type { ProviderServiceContext } from './mutations.js';
+/**
+ * Custom model definition CRUD (ME-3, 6B-2). Moved verbatim from
+ * provider-handlers.ts: own-property lookups (Object.hasOwn — prototype
+ * pollution guard) and the models[] allowlist sync semantics.
+ */
+export declare function createCustomModelHandlers(ctx: ProviderServiceContext): {
+    handleCustomModelSet: (ws: WebSocket, providerId: string, modelId: string, definition: NonNullable<ProviderConfig['customModels']>[string]) => Promise<void>;
+    handleCustomModelRemove: (ws: WebSocket, providerId: string, modelId: string) => Promise<void>;
+};
+//# sourceMappingURL=custom-models.d.ts.map

package/dist/server/provider/keys-records.d.ts

@@ -0,0 +1,2 @@
+export { addProvider as addProviderRecord, deleteKey as deleteKeyRecord, maskedKey, normalizeKeys, removeProvider as removeProviderRecord, setActiveKey as setActiveKeyRecord, upsertKey as upsertKeyRecord, writeKeysBack, } from '../provider-keys.js';
+//# sourceMappingURL=keys-records.d.ts.map

package/dist/server/provider/keys.d.ts

@@ -0,0 +1,36 @@
+import type { ProviderConfig } from '@wrongstack/core/types';
+import type { WebSocket } from 'ws';
+import type { ProviderServiceContext } from './mutations.js';
+/**
+ * API-key + provider CRUD surface (6B-2). Moved verbatim from
+ * provider-handlers.ts: every handler keeps the load → mutate → save →
+ * broadcast ordering and the exact operation_result messages.
+ */
+export declare function createKeyHandlers(ctx: ProviderServiceContext): {
+    handleKeyUpsert: (ws: WebSocket, providerId: string, label: string, apiKey: string) => Promise<void>;
+    handleKeyDelete: (ws: WebSocket, providerId: string, label: string) => Promise<void>;
+    handleKeySetActive: (ws: WebSocket, providerId: string, label: string) => Promise<void>;
+};
+/** Provider-level CRUD (add/remove/update/clear/undo-clear). */
+export declare function createProviderCrudHandlers(ctx: ProviderServiceContext): {
+    handleProviderAdd: (ws: WebSocket, payload: {
+        id: string;
+        family: string;
+        baseUrl?: string | undefined;
+        apiKey?: string | undefined;
+        models?: string[] | undefined;
+        customModels?: ProviderConfig['customModels'] | undefined;
+    }) => Promise<boolean>;
+    handleProviderRemove: (ws: WebSocket, providerId: string) => Promise<void>;
+    handleProviderClearModels: (ws: WebSocket, providerId: string) => Promise<void>;
+    handleProviderUndoClear: (ws: WebSocket, providerId: string, previousModels: string[]) => Promise<void>;
+    handleProviderUpdate: (ws: WebSocket, payload: {
+        id: string;
+        family?: string | undefined;
+        baseUrl?: string | undefined;
+        envVars?: string[] | undefined;
+        models?: string[] | undefined;
+        customModels?: ProviderConfig['customModels'] | undefined;
+    }) => Promise<void>;
+};
+//# sourceMappingURL=keys.d.ts.map

package/dist/server/provider/mutations.d.ts

@@ -0,0 +1,34 @@
+import type { ModelsRegistry, ProviderConfig } from '@wrongstack/core/types';
+import type { WebSocket } from 'ws';
+import type { WSServerMessage } from '../types.js';
+export interface ProviderPersistence {
+    load(): Promise<Record<string, ProviderConfig>>;
+    save(providers: Record<string, ProviderConfig>): Promise<void>;
+}
+export interface ProviderOperationsDeps {
+    providerStore: ProviderPersistence;
+    broadcast: (message: WSServerMessage) => void;
+    send?: ((ws: WebSocket, message: WSServerMessage) => void) | undefined;
+    modelsRegistry?: ModelsRegistry | undefined;
+    log?: ((message: string) => void) | undefined;
+    hasActiveModel?: (() => boolean) | undefined;
+    onProvidersLoaded?: ((providers: Record<string, ProviderConfig>) => void | Promise<void>) | undefined;
+    applyModelSwitch?: ((providerId: string, modelId: string) => Promise<void>) | undefined;
+}
+/**
+ * Shared service context for every provider/ domain module (6B-1).
+ * Owns the load → mutate → save → broadcast plumbing each handler repeated,
+ * so domain modules stay verbatim handlers with no boilerplate of their own.
+ */
+export interface ProviderServiceContext {
+    readonly deps: ProviderOperationsDeps;
+    sendMessage(ws: WebSocket, message: WSServerMessage): void;
+    sendOperationResult(ws: WebSocket, success: boolean, message: string): void;
+    loadConfigProviders(): Promise<Record<string, ProviderConfig>>;
+    saveConfigProviders(providers: Record<string, ProviderConfig>): Promise<void>;
+    /** Broadcast the current saved-provider list to every connected client. */
+    broadcastSaved(providers: Record<string, ProviderConfig>): void;
+}
+export declare function createProviderServiceContext(deps: ProviderOperationsDeps): ProviderServiceContext;
+export type { ProviderServiceContext as ProviderMutationsContext };
+//# sourceMappingURL=mutations.d.ts.map

package/dist/server/provider/oauth.d.ts

@@ -0,0 +1,17 @@
+import { type OAuthKind } from '@wrongstack/providers/oauth';
+import type { WebSocket } from 'ws';
+import type { ProviderServiceContext } from './mutations.js';
+/**
+ * Subscription OAuth login state machine (ChatGPT / Claude / Copilot) — 6B-2.
+ * Moved verbatim from provider-handlers.ts:
+ *
+ * One in-flight session per kind, shared across clients (single-user). A
+ * second start for the same kind closes the prior one. The engine
+ * (@wrongstack/providers/oauth) is IO-free — persistence is local below.
+ */
+export declare function createOauthHandlers(ctx: ProviderServiceContext): {
+    handleOAuthStart: (ws: WebSocket, kind: OAuthKind, customProviderId?: string) => Promise<void>;
+    handleOAuthCode: (ws: WebSocket, kind: OAuthKind, input: string) => Promise<void>;
+    handleOAuthCancel: (ws: WebSocket, kind: OAuthKind) => void;
+};
+//# sourceMappingURL=oauth.d.ts.map

package/dist/server/provider/probe.d.ts

@@ -0,0 +1,9 @@
+import type { WebSocket } from 'ws';
+import type { ProviderServiceContext } from './mutations.js';
+/**
+ * Health probing (6B-2). Moved verbatim from provider-handlers.ts.
+ */
+export declare function createProbeHandlers(ctx: ProviderServiceContext): {
+    handleProviderProbe: (ws: WebSocket, providerId: string, timeoutMs?: number) => Promise<void>;
+};
+//# sourceMappingURL=probe.d.ts.map

package/dist/server/provider/projection.d.ts

@@ -0,0 +1,50 @@
+import { DefaultSecretScrubber } from '@wrongstack/core/security';
+import type { ProviderConfig } from '@wrongstack/core/types';
+/**
+ * Wire shape of one saved provider as broadcast over `providers.saved`.
+ * The WebUI's `<ProviderModelsPanel>` consumes this — when
+ * `pickedModelId` / `models` is missing, the panel renders the empty
+ * state.
+ */
+export interface SavedProviderView {
+    id: string;
+    family?: string | undefined;
+    baseUrl?: string | undefined;
+    /** Saved model allowlist, verbatim (undefined / [] both possible). */
+    models?: string[] | undefined;
+    /** Per-model metadata (display name, output limits, capability overrides). */
+    customModels?: ProviderConfig['customModels'] | undefined;
+    /** First entry of `models`, or undefined when the list is empty/unset. */
+    pickedModelId?: string | undefined;
+    apiKeys: Array<{
+        label: string;
+        maskedKey: string;
+        isActive: boolean;
+        createdAt: string;
+    }>;
+}
+/**
+ * Canonical projection from in-memory `ProviderConfig` to the
+ * `providers.saved` wire shape. Pure (no I/O) so it's unit-tested in
+ * isolation — see `tests/server/provider-handlers-projection.test.ts`.
+ *
+ * Secrets never leave: every key is run through `maskedKey` before it
+ * reaches the wire.
+ */
+export declare function projectSavedProviders(providers: Record<string, ProviderConfig>): SavedProviderView[];
+/** Shared scrubber for probe error/body redaction. */
+export declare const probeScrubber: DefaultSecretScrubber;
+/**
+ * Probe a saved provider's OpenAI-compatible `/v1/models` and map the
+ * discovered ids into the minimal model-descriptor shape the WebUI dropdown
+ * needs. Used as a fallback when a config-only custom provider (no saved
+ * `models` allowlist, absent from models.dev) would otherwise resolve to an
+ * empty list. Returns `[]` on any failure — the caller treats that as "no
+ * models" (unchanged behaviour).
+ */
+export declare function probeModelDescriptors(cfg: ProviderConfig): Promise<Array<{
+    id: string;
+    name: string;
+    capabilities: [];
+}>>;
+//# sourceMappingURL=projection.d.ts.map

package/dist/server/provider-handlers.d.ts

@@ -1,90 +1,25 @@
 import type { ModelsRegistry, ProviderConfig } from '@wrongstack/core/types';
-import { type OAuthKind } from '@wrongstack/providers/oauth';
 import type { WebSocket } from 'ws';
+import { type ProviderOperationsDeps, type ProviderPersistence } from './provider/mutations.js';
+import { probeModelDescriptors, projectSavedProviders, type SavedProviderView } from './provider/projection.js';
 import type { ConnectedClient, WSServerMessage } from './types.js';
 /**
- * Wire shape of one saved provider as broadcast over `providers.saved`.
- * The WebUI's `<ProviderModelsPanel>` consumes this — when
- * `pickedModelId` / `models` is missing, the panel renders the empty
- * state.
+ * Per-concern split of the former 827-line provider-handlers.ts (card #6B).
+ * This module is the thin composition shell: every handler body moved
+ * verbatim into `./provider/*` domain modules; the public surface below is
+ * unchanged, so `routes.ts`, the embedded/standalone adapters, the barrel
+ * and every test keep importing from here.
  */
-export interface SavedProviderView {
-    id: string;
-    family?: string | undefined;
-    baseUrl?: string | undefined;
-    /** Saved model allowlist, verbatim (undefined / [] both possible). */
-    models?: string[] | undefined;
-    /** Per-model metadata (display name, output limits, capability overrides). */
-    customModels?: ProviderConfig['customModels'] | undefined;
-    /** First entry of `models`, or undefined when the list is empty/unset. */
-    pickedModelId?: string | undefined;
-    apiKeys: Array<{
-        label: string;
-        maskedKey: string;
-        isActive: boolean;
-        createdAt: string;
-    }>;
-}
-/**
- * Canonical projection from in-memory `ProviderConfig` to the
- * `providers.saved` wire shape. Pure (no I/O) so it's unit-tested in
- * isolation — see `tests/server/provider-handlers-projection.test.ts`.
- *
- * Secrets never leave: every key is run through `maskedKey` before it
- * reaches the wire.
- */
-export declare function projectSavedProviders(providers: Record<string, ProviderConfig>): SavedProviderView[];
-/**
- * Probe a saved provider's OpenAI-compatible `/v1/models` and map the
- * discovered ids into the minimal model-descriptor shape the WebUI dropdown
- * needs. Used as a fallback when a config-only custom provider (no saved
- * `models` allowlist, absent from models.dev) would otherwise resolve to an
- * empty list. Returns `[]` on any failure — the caller treats that as "no
- * models" (unchanged behaviour).
- */
-export declare function probeModelDescriptors(cfg: ProviderConfig): Promise<Array<{
-    id: string;
-    name: string;
-    capabilities: [];
-}>>;
-export interface ProviderHandlerDeps {
-    /** Path to the active profile config; the only provider mutation target. */
-    profileConfigPath: string;
-    vault: import('@wrongstack/core/types').SecretVault;
-    /** Shared config write lock — serialized via chained promises */
-    setConfigWriteLock: (lock: Promise<void>) => void;
-    getConfigWriteLock: () => Promise<void>;
-    /** Broadcast a message to all connected WebUI clients */
-    broadcast: (clients: Map<WebSocket, ConnectedClient>, msg: WSServerMessage) => void;
-    /** Connected WebUI clients map */
-    clients: Map<WebSocket, ConnectedClient>;
-    /** Used by the ChatGPT OAuth flow's tier-2 model lookup (best-effort). */
-    modelsRegistry?: ModelsRegistry | undefined;
-    hasActiveModel?: (() => boolean) | undefined;
-    onProvidersLoaded?: ((providers: Record<string, ProviderConfig>) => void | Promise<void>) | undefined;
-    applyModelSwitch?: ((providerId: string, modelId: string) => Promise<void>) | undefined;
-}
-export interface ProviderPersistence {
-    load(): Promise<Record<string, ProviderConfig>>;
-    save(providers: Record<string, ProviderConfig>): Promise<void>;
-}
-export interface ProviderOperationsDeps {
-    providerStore: ProviderPersistence;
-    broadcast: (message: WSServerMessage) => void;
-    send?: ((ws: WebSocket, message: WSServerMessage) => void) | undefined;
-    modelsRegistry?: ModelsRegistry | undefined;
-    log?: ((message: string) => void) | undefined;
-    hasActiveModel?: (() => boolean) | undefined;
-    onProvidersLoaded?: ((providers: Record<string, ProviderConfig>) => void | Promise<void>) | undefined;
-    applyModelSwitch?: ((providerId: string, modelId: string) => Promise<void>) | undefined;
-}
+export type { ProviderOperationsDeps, ProviderPersistence, SavedProviderView };
+export { probeModelDescriptors, projectSavedProviders };
 export declare function createProviderOperations(deps: ProviderOperationsDeps): {
     handleProvidersList: (ws: WebSocket) => Promise<void>;
     handleProvidersSaved: (ws: WebSocket) => Promise<void>;
     handleProviderModels: (ws: WebSocket, providerId: string) => Promise<void>;
     handleProviderModelsSearch: (ws: WebSocket, query: string, limit?: number | undefined) => Promise<void>;
     adoptDefaultProviderIfUnset: (providerId: string) => Promise<void>;
-    broadcastSaved: (providers: Record<string, ProviderConfig>) => void;
+    handleCustomModelSet: (ws: WebSocket, providerId: string, modelId: string, definition: NonNullable<ProviderConfig['customModels']>[string]) => Promise<void>;
+    handleCustomModelRemove: (ws: WebSocket, providerId: string, modelId: string) => Promise<void>;
     handleKeyUpsert: (ws: WebSocket, providerId: string, label: string, apiKey: string) => Promise<void>;
     handleKeyDelete: (ws: WebSocket, providerId: string, label: string) => Promise<void>;
     handleKeySetActive: (ws: WebSocket, providerId: string, label: string) => Promise<void>;
@@ -98,8 +33,6 @@ export declare function createProviderOperations(deps: ProviderOperationsDeps):
     }) => Promise<boolean>;
     handleProviderRemove: (ws: WebSocket, providerId: string) => Promise<void>;
     handleProviderClearModels: (ws: WebSocket, providerId: string) => Promise<void>;
-    handleCustomModelSet: (ws: WebSocket, providerId: string, modelId: string, definition: NonNullable<ProviderConfig['customModels']>[string]) => Promise<void>;
-    handleCustomModelRemove: (ws: WebSocket, providerId: string, modelId: string) => Promise<void>;
     handleProviderUndoClear: (ws: WebSocket, providerId: string, previousModels: string[]) => Promise<void>;
     handleProviderUpdate: (ws: WebSocket, payload: {
         id: string;
@@ -109,12 +42,30 @@ export declare function createProviderOperations(deps: ProviderOperationsDeps):
         models?: string[] | undefined;
         customModels?: ProviderConfig['customModels'] | undefined;
     }) => Promise<void>;
+    handleOAuthStart: (ws: WebSocket, kind: import("@wrongstack/providers/oauth").OAuthKind, customProviderId?: string) => Promise<void>;
+    handleOAuthCode: (ws: WebSocket, kind: import("@wrongstack/providers/oauth").OAuthKind, input: string) => Promise<void>;
+    handleOAuthCancel: (ws: WebSocket, kind: import("@wrongstack/providers/oauth").OAuthKind) => void;
     handleProviderProbe: (ws: WebSocket, providerId: string, timeoutMs?: number) => Promise<void>;
-    handleOAuthStart: (ws: WebSocket, kind: OAuthKind, customProviderId?: string) => Promise<void>;
-    handleOAuthCode: (ws: WebSocket, kind: OAuthKind, input: string) => Promise<void>;
-    handleOAuthCancel: (ws: WebSocket, kind: OAuthKind) => void;
+    broadcastSaved: (providers: Record<string, ProviderConfig>) => void;
     loadConfigProviders: () => Promise<Record<string, ProviderConfig>>;
 };
+export interface ProviderHandlerDeps {
+    /** Path to the active profile config; the only provider mutation target. */
+    profileConfigPath: string;
+    vault: import('@wrongstack/core/types').SecretVault;
+    /** Shared config write lock — serialized via chained promises */
+    setConfigWriteLock: (lock: Promise<void>) => void;
+    getConfigWriteLock: () => Promise<void>;
+    /** Broadcast a message to all connected WebUI clients */
+    broadcast: (clients: Map<WebSocket, ConnectedClient>, msg: WSServerMessage) => void;
+    /** Connected WebUI clients map */
+    clients: Map<WebSocket, ConnectedClient>;
+    /** Used by the ChatGPT OAuth flow's tier-2 model lookup (best-effort). */
+    modelsRegistry?: ModelsRegistry | undefined;
+    hasActiveModel?: (() => boolean) | undefined;
+    onProvidersLoaded?: ((providers: Record<string, ProviderConfig>) => void | Promise<void>) | undefined;
+    applyModelSwitch?: ((providerId: string, modelId: string) => Promise<void>) | undefined;
+}
 /**
  * Standalone-host adapter. It preserves the existing serialized profile-file
  * persistence while delegating all provider and OAuth behavior to the
@@ -126,7 +77,8 @@ export declare function createProviderHandlers(deps: ProviderHandlerDeps): {
     handleProviderModels: (ws: WebSocket, providerId: string) => Promise<void>;
     handleProviderModelsSearch: (ws: WebSocket, query: string, limit?: number | undefined) => Promise<void>;
     adoptDefaultProviderIfUnset: (providerId: string) => Promise<void>;
-    broadcastSaved: (providers: Record<string, ProviderConfig>) => void;
+    handleCustomModelSet: (ws: WebSocket, providerId: string, modelId: string, definition: NonNullable<ProviderConfig['customModels']>[string]) => Promise<void>;
+    handleCustomModelRemove: (ws: WebSocket, providerId: string, modelId: string) => Promise<void>;
     handleKeyUpsert: (ws: WebSocket, providerId: string, label: string, apiKey: string) => Promise<void>;
     handleKeyDelete: (ws: WebSocket, providerId: string, label: string) => Promise<void>;
     handleKeySetActive: (ws: WebSocket, providerId: string, label: string) => Promise<void>;
@@ -140,8 +92,6 @@ export declare function createProviderHandlers(deps: ProviderHandlerDeps): {
     }) => Promise<boolean>;
     handleProviderRemove: (ws: WebSocket, providerId: string) => Promise<void>;
     handleProviderClearModels: (ws: WebSocket, providerId: string) => Promise<void>;
-    handleCustomModelSet: (ws: WebSocket, providerId: string, modelId: string, definition: NonNullable<ProviderConfig['customModels']>[string]) => Promise<void>;
-    handleCustomModelRemove: (ws: WebSocket, providerId: string, modelId: string) => Promise<void>;
     handleProviderUndoClear: (ws: WebSocket, providerId: string, previousModels: string[]) => Promise<void>;
     handleProviderUpdate: (ws: WebSocket, payload: {
         id: string;
@@ -151,10 +101,11 @@ export declare function createProviderHandlers(deps: ProviderHandlerDeps): {
         models?: string[] | undefined;
         customModels?: ProviderConfig['customModels'] | undefined;
     }) => Promise<void>;
+    handleOAuthStart: (ws: WebSocket, kind: import("@wrongstack/providers/oauth").OAuthKind, customProviderId?: string) => Promise<void>;
+    handleOAuthCode: (ws: WebSocket, kind: import("@wrongstack/providers/oauth").OAuthKind, input: string) => Promise<void>;
+    handleOAuthCancel: (ws: WebSocket, kind: import("@wrongstack/providers/oauth").OAuthKind) => void;
     handleProviderProbe: (ws: WebSocket, providerId: string, timeoutMs?: number) => Promise<void>;
-    handleOAuthStart: (ws: WebSocket, kind: OAuthKind, customProviderId?: string) => Promise<void>;
-    handleOAuthCode: (ws: WebSocket, kind: OAuthKind, input: string) => Promise<void>;
-    handleOAuthCancel: (ws: WebSocket, kind: OAuthKind) => void;
+    broadcastSaved: (providers: Record<string, ProviderConfig>) => void;
     loadConfigProviders: () => Promise<Record<string, ProviderConfig>>;
 };
 //# sourceMappingURL=provider-handlers.d.ts.map

package/dist/server/standalone-session-identity.d.ts

@@ -1,5 +1,6 @@
 import type { EventBus } from '@wrongstack/core/kernel';
-import { AgentStatusTracker, getSessionRegistry } from '@wrongstack/core/storage';
+import { AgentStatusTracker } from '@wrongstack/core/coordination';
+import { getSessionRegistry } from '@wrongstack/core/storage';
 import type { Config, Logger } from '@wrongstack/core/types';
 export interface StandaloneSessionIdentityPaths {
     globalRoot: string;

package/dist/server/token-estimator.d.ts

@@ -1,16 +1,27 @@
 /**
  * Per-section context-window token estimate for the `context.debug` command.
  *
- * Uses the simple 4-chars-per-token heuristic — not exact, but close enough to
- * spot which section (system prompt, tool schemas, or message history) is
- * eating the context window. Tool schemas in particular are easy to overlook:
- * each tool ships its full JSON schema to the model every turn, so 20+ builtins
- * can cost 10-20k tokens on their own.
+ * Since card #5 (slice 5g) this module delegates the actual token math to
+ * the canonical calibrated estimator in `@wrongstack/core/utils`
+ * (3.5 chars/token basis + per-model-family EWM calibration — see
+ * `core/src/utils/token-estimate.ts`). Before this, the WebUI computed a
+ * private 4-chars/token estimate, so the number in the browser's context
+ * debug view diverged from what compaction and the TUI context bar were
+ * actually deciding on (~14% for typical mixed content). Delegating means
+ * the user sees the same number the system acts on.
  *
- * Extracted from `index.ts` as a pure function so the breakdown maths can be
- * unit tested without standing up a Context/ToolRegistry.
+ * User-visible shift (intentional): all token figures shown by the WebUI
+ * context breakdown now match the CLI/TUI estimator — mixed-content
+ * conversations read ~14% HIGHER than the old 4-chars/token figures
+ * (3.5 chars/token is a more conservative, over-estimating basis by
+ * design, so compaction triggers are consistent rather than optimistic).
+ * Previews, block walking, and the `ContextBreakdown` shape are unchanged.
+ *
+ * `stringifyContent` stays local: its circular-reference fallback and the
+ * duck-typed block walk below are presentation-side concerns the canonical
+ * estimator does not share (it walks typed `Message` content).
  */
-/** 4-chars-per-token heuristic estimate for a string. */
+/** Calibrated token estimate for a string — delegates to the shared basis. */
 export declare function estimateTokens(s: string): number;
 /** Stringify arbitrary content for length estimation (JSON, with fallbacks). */
 export declare function stringifyContent(c: unknown): string;