@wrongstack/webui-server 0.310.0 → 0.310.1

package/dist/index.js

@@ -97,7 +97,12 @@ var BOOLEAN_PREF_KEYS = /* @__PURE__ */ new Set([
   // `prefs.update` exactly so the panel does not error with
   // "unknown preference key".
   "readSymbols",
-  "showSageMemoryInject"
+  "showSageMemoryInject",
+  // WrongProxy / WrongTrace master switch. When on, the CLI rewrites every
+  // provider's base URL through the configured proxy URL (default
+  // http://localhost:8000 → http://localhost:8000/proxy/<host><path>).
+  // Excluded providers (openai-codex) flow through unchanged.
+  "wrongProxyEnabled"
 ]);
 var STRING_ARRAY_PREF_KEYS = /* @__PURE__ */ new Set([
   "fallbackModels",
@@ -164,7 +169,11 @@ var STRING_PREF_KEYS = /* @__PURE__ */ new Set([
   "chimeraModel",
   "autoReviewProvider",
   "autoReviewModel",
-  "autoReviewFallbackProfile"
+  "autoReviewFallbackProfile",
+  // WrongProxy / WrongTrace URL. Empty = unset. Default lives in
+  // `LocalPrefs.DEFAULTS.wrongProxyUrl` ('http://localhost:8000'); users
+  // can override here for non-default daemon ports / paths.
+  "wrongProxyUrl"
 ]);
 var ENUM_PREF_KEYS = {
   autonomy: AUTONOMY_VALUES,
@@ -1054,7 +1063,7 @@ function routingPatch(payload) {
 function handlePrefsGet(ctx, ws) {
   ctx.send(ws, { type: "prefs.updated", payload: ctx.snapshot() });
 }
-function handlePrefsUpdate(ctx, ws, input) {
+async function handlePrefsUpdate(ctx, ws, input) {
   const parsed = validatePrefsUpdatePayload(input);
   if (!parsed.ok) {
     sendResult(ctx, ws, false, parsed.message);
@@ -1087,6 +1096,9 @@ function handlePrefsUpdate(ctx, ws, input) {
       ({ setDebugStreamEnabled }) => setDebugStreamEnabled(payload["debugStream"])
     );
   }
+  if (typeof payload["wrongProxyEnabled"] === "boolean" || typeof payload["wrongProxyUrl"] === "string") {
+    await ctx.applyWrongProxyPrefs?.(payload);
+  }
   if (typeof payload["logLevel"] === "string" && ["debug", "info", "warn", "error"].includes(payload["logLevel"])) {
     ctx.setLogLevel?.(payload["logLevel"]);
   }
@@ -7290,6 +7302,8 @@ function seedContextMeta(config, context) {
   meta["tgDelegate"] = tgExt?.["notifyOnDelegate"] !== false;
   const tgMs = tgExt?.["longToolThresholdMs"];
   meta["tgLongToolMs"] = typeof tgMs === "number" ? tgMs : 3e4;
+  meta["wrongProxyEnabled"] = config.tools?.wrongProxy?.enabled === true;
+  meta["wrongProxyUrl"] = config.tools?.wrongProxy?.url ?? "";
   {
     const pluginsEnabled = {};
     const record = (name2) => {
@@ -7662,6 +7676,87 @@ import * as path13 from "node:path";
 import { TOKENS } from "@wrongstack/core/kernel";
 import { DefaultSessionStore as DefaultSessionStore2 } from "@wrongstack/core/storage";
 import { toErrorMessage as toErrorMessage7, wstackGlobalRoot as wstackGlobalRoot2 } from "@wrongstack/core/utils";
+
+// src/server/proxy-runtime.ts
+import {
+  applyProxyConfig,
+  getProxyConfig,
+  rewriteBaseUrl,
+  shouldRewriteFor
+} from "@wrongstack/core/wiring/proxy-rewrite";
+var HEALTH_PATH = "/api/health";
+var PROBE_TIMEOUT_MS = 2e3;
+function seedWrongProxyFromConfig(config) {
+  const wp = config.tools?.wrongProxy;
+  if (!wp) {
+    return;
+  }
+  applyProxyConfig({
+    enabled: wp.enabled === true,
+    url: typeof wp.url === "string" ? wp.url : ""
+  });
+}
+async function probeWrongProxyActive() {
+  const cfg = getProxyConfig();
+  if (!cfg.enabled || !cfg.url) {
+    applyProxyConfig({ active: false });
+    return false;
+  }
+  const abort = new AbortController();
+  const timeout = setTimeout(() => abort.abort(), PROBE_TIMEOUT_MS);
+  if (typeof timeout.unref === "function") {
+    timeout.unref();
+  }
+  try {
+    const healthUrl = `${cfg.url.replace(/\/+$/, "")}${HEALTH_PATH}`;
+    const res = await fetch(healthUrl, {
+      method: "GET",
+      signal: abort.signal,
+      headers: { accept: "application/json" }
+    });
+    const ok2 = res.ok && res.status >= 200 && res.status < 300;
+    applyProxyConfig({ active: ok2 });
+    return ok2;
+  } catch {
+    applyProxyConfig({ active: false });
+    return false;
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+async function applyWrongProxyPrefs(payload) {
+  const patch = {};
+  if (typeof payload["wrongProxyEnabled"] === "boolean") {
+    patch.enabled = payload["wrongProxyEnabled"];
+  }
+  if (typeof payload["wrongProxyUrl"] === "string") {
+    patch.url = payload["wrongProxyUrl"];
+  }
+  if (Object.keys(patch).length === 0) return;
+  applyProxyConfig(patch);
+  await probeWrongProxyActive();
+}
+async function bootstrapWrongProxyFromConfig(config) {
+  seedWrongProxyFromConfig(config);
+  await probeWrongProxyActive();
+}
+function routeProviderCfgThroughProxy(cfg, fallbackBaseUrl, providerId) {
+  const raw = cfg;
+  const cfgType = typeof raw.type === "string" ? raw.type : void 0;
+  const cfgBaseUrl = typeof raw.baseUrl === "string" ? raw.baseUrl : void 0;
+  const factoryType = cfgType ?? providerId;
+  const rawBaseUrl = cfgBaseUrl ?? fallbackBaseUrl;
+  if (!rawBaseUrl || !shouldRewriteFor(factoryType)) {
+    return { ...cfg };
+  }
+  const baseUrl = rewriteBaseUrl(rawBaseUrl, getProxyConfig().url);
+  return {
+    ...cfg,
+    ...baseUrl !== cfgBaseUrl ? { baseUrl } : {}
+  };
+}
+
+// src/server/embedded-host-adapters.ts
 import { makeProviderFromConfig } from "@wrongstack/providers";
 
 // src/server/project-handlers.ts
@@ -9884,7 +9979,12 @@ async function applyEmbeddedModelSwitch(ctx, providerId, modelId) {
   await agentContext.runModelTransition(async () => {
     const saved = await ctx.loadSavedProviders();
     const providerConfig = saved[providerId] ?? { type: providerId };
-    const nextProvider = makeProviderFromConfig(providerId, providerConfig);
+    const routedConfig = routeProviderCfgThroughProxy(
+      providerConfig,
+      ctx.getConfig?.()?.baseUrl,
+      providerId
+    );
+    const nextProvider = makeProviderFromConfig(providerId, routedConfig);
     await ctx.modelsRegistry?.refresh().catch((error2) => {
       ctx.log(
         JSON.stringify({
@@ -16267,7 +16367,15 @@ function createEmbeddedMessageRouter(deps2) {
     getLiveProviderId: () => deps2.agentConfigCtx.agent.ctx.provider.id,
     buildProvider: async (providerId) => {
       const saved = await deps2.agentConfigCtx.loadSavedProviders();
-      return makeProviderFromConfig2(providerId, saved[providerId] ?? { type: providerId });
+      const providerCfg = saved[providerId] ?? { type: providerId };
+      return makeProviderFromConfig2(
+        providerId,
+        routeProviderCfgThroughProxy(
+          providerCfg,
+          deps2.agentConfigCtx.getConfig?.()?.baseUrl,
+          providerId
+        )
+      );
     },
     applyModelSwitch: (providerId, modelId) => applyEmbeddedModelSwitch(deps2.agentConfigCtx, providerId, modelId),
     isRunActive: () => deps2.conversationCtx.abortControllers.size > 0,
@@ -21101,7 +21209,13 @@ var PREF_KEYS = [
   // Per-plugin enable/disable map (parity with the embedded server).
   "pluginsEnabled",
   // Fleet chat verbosity: off | full (migrated from streamFleet boolean).
-  "fleetChatVerbosity"
+  "fleetChatVerbosity",
+  // WrongProxy / WrongTrace: master switch + configurable URL (default
+  // http://localhost:8000). When `wrongProxyEnabled` is true and the daemon
+  // is reachable, every provider's base URL flows through
+  // `${wrongProxyUrl}/proxy/<host><path>`. openai-codex is excluded by spec.
+  "wrongProxyEnabled",
+  "wrongProxyUrl"
 ];
 function prefSnapshot(contextMeta) {
   const snapshot = {};
@@ -21367,6 +21481,15 @@ async function persistPrefsToConfig(deps2, holder, payload) {
       }
       if (typeof payload["debugStream"] === "boolean")
         decrypted.debugStream = payload["debugStream"];
+      if (typeof payload["wrongProxyEnabled"] === "boolean" || typeof payload["wrongProxyUrl"] === "string") {
+        const toolsCfg = decrypted.tools ?? {};
+        const wp = toolsCfg["wrongProxy"] ?? {};
+        if (typeof payload["wrongProxyEnabled"] === "boolean")
+          wp["enabled"] = payload["wrongProxyEnabled"];
+        if (typeof payload["wrongProxyUrl"] === "string") wp["url"] = payload["wrongProxyUrl"];
+        toolsCfg["wrongProxy"] = wp;
+        decrypted.tools = toolsCfg;
+      }
       if (typeof payload["pluginsEnabled"] === "object" && payload["pluginsEnabled"] !== null) {
         const ext = decrypted.extensions ?? {};
         const toggled = [];
@@ -26133,7 +26256,12 @@ function resolveSetupProvider(opts) {
       baseUrl: config.baseUrl
     };
     try {
-      const cfgWithType = { ...providerConfig, type: config.provider };
+      const routedConfig = routeProviderCfgThroughProxy(
+        providerConfig,
+        config.baseUrl,
+        config.provider
+      );
+      const cfgWithType = { ...routedConfig, type: config.provider };
       const provider2 = config.features.modelsRegistry && providerRegistry.has(config.provider) ? providerRegistry.create(cfgWithType) : makeProviderFromConfig3(config.provider, cfgWithType);
       return { provider: provider2, needsSetup: false };
     } catch (err) {
@@ -26146,8 +26274,13 @@ function resolveSetupProvider(opts) {
   if (firstKey) {
     const firstProvider = expectDefined3(savedProviders[firstKey]);
     try {
+      const routedConfig = routeProviderCfgThroughProxy(
+        firstProvider,
+        config.baseUrl,
+        firstKey
+      );
       const provider2 = makeProviderFromConfig3(firstKey, {
-        ...firstProvider,
+        ...routedConfig,
         type: firstKey,
         family: firstProvider.family,
         apiKey: firstProvider.apiKey
@@ -26793,9 +26926,14 @@ function buildRoutes(state, deps2, cb) {
       const cur = state.getConfig();
       const newCfg = patchConfig(cur, { provider: newProvider, model: newModel });
       const providerCfg = newCfg.providers?.[newProvider] ?? { type: newProvider };
-      const built = deps2.providerRegistry.has(newProvider) ? deps2.providerRegistry.create({ ...providerCfg, type: newProvider }) : makeProviderFromConfig4(newProvider, providerCfg);
+      const routedCfg = routeProviderCfgThroughProxy(
+        providerCfg,
+        newCfg.baseUrl,
+        newProvider
+      );
+      const built = deps2.providerRegistry.has(newProvider) ? deps2.providerRegistry.create({ ...routedCfg, type: newProvider }) : makeProviderFromConfig4(newProvider, routedCfg);
       const newProv = deps2.modelsRegistry ? await withCatalogCapabilities(deps2.modelsRegistry, newProvider, built, {
-        ...providerCfg,
+        ...routedCfg,
         type: newProvider,
         model: newModel
       }) : built;
@@ -26807,7 +26945,7 @@ function buildRoutes(state, deps2, cb) {
       deps2.configStore.update({ provider: newProvider, model: newModel });
       deps2.context.model = newModel;
       deps2.context.provider = newProv;
-      await cb.updateAutoCompactionMaxContext(newProv, newProvider, providerCfg).catch((error2) => {
+      await cb.updateAutoCompactionMaxContext(newProv, newProvider, routedCfg).catch((error2) => {
         deps2.logger.warn(`model.switch capability refresh failed: ${String(error2)}`);
       });
       broadcast(state.getClients(), {
@@ -26948,6 +27086,13 @@ function buildRoutes(state, deps2, cb) {
       if (typeof payload["fallbackAuto"] === "boolean")
         config.fallbackAuto = payload["fallbackAuto"];
     },
+    // WrongProxy / WrongTrace: reflect the standalone toggle/URL into the
+    // shared `ProxyConfig` singleton immediately and await the re-probe so
+    // `active` is fresh before a subsequent model.switch reads it. In the
+    // CLI-hosted path this same key is the CLI's `applyWrongProxyPrefs`; when
+    // running as its own process there is no CLI to inject it, so route it to
+    // the server-local runtime module.
+    applyWrongProxyPrefs: (payload) => applyWrongProxyPrefs(payload),
     setAutoCompact: (enabled) => {
       deps2.pipelines.contextWindow.remove("AutoCompaction", { optional: true });
       if (enabled && deps2.autoCompactor) {
@@ -27432,7 +27577,12 @@ function setupWebuiCredentialWatcher(options) {
           ...snapshot.apiKey !== void 0 ? { apiKey: snapshot.apiKey } : {},
           ...snapshot.baseUrl !== void 0 ? { baseUrl: snapshot.baseUrl } : {}
         };
-        const newProv = deps2.providerRegistry.has(activeId) ? deps2.providerRegistry.create({ ...providerCfg, type: activeId }) : makeProviderFromConfig5(activeId, { ...providerCfg, type: activeId });
+        const routedCfg = routeProviderCfgThroughProxy(
+          providerCfg,
+          state.getConfig().baseUrl,
+          activeId
+        );
+        const newProv = deps2.providerRegistry.has(activeId) ? deps2.providerRegistry.create({ ...routedCfg, type: activeId }) : makeProviderFromConfig5(activeId, { ...routedCfg, type: activeId });
         deps2.context.provider = newProv;
         void updateAutoCompactionMaxContext(newProv).catch(() => void 0);
         console.log(`[WebUI] Provider credentials reloaded from config.json (${activeId})`);
@@ -27634,6 +27784,7 @@ async function startWebUI(opts = {}) {
   console.log("[WebUI] Starting backend services...");
   const boot = await bootConfig();
   const { config: baseConfig, globalConfigPath, wpaths, logger } = boot;
+  await bootstrapWrongProxyFromConfig(baseConfig);
   const vault = opts.services?.vault ?? boot.vault;
   let config = baseConfig;
   let projectRoot = boot.projectRoot;

package/dist/server/entry.js

@@ -98,7 +98,12 @@ var BOOLEAN_PREF_KEYS = /* @__PURE__ */ new Set([
   // `prefs.update` exactly so the panel does not error with
   // "unknown preference key".
   "readSymbols",
-  "showSageMemoryInject"
+  "showSageMemoryInject",
+  // WrongProxy / WrongTrace master switch. When on, the CLI rewrites every
+  // provider's base URL through the configured proxy URL (default
+  // http://localhost:8000 → http://localhost:8000/proxy/<host><path>).
+  // Excluded providers (openai-codex) flow through unchanged.
+  "wrongProxyEnabled"
 ]);
 var STRING_ARRAY_PREF_KEYS = /* @__PURE__ */ new Set([
   "fallbackModels",
@@ -165,7 +170,11 @@ var STRING_PREF_KEYS = /* @__PURE__ */ new Set([
   "chimeraModel",
   "autoReviewProvider",
   "autoReviewModel",
-  "autoReviewFallbackProfile"
+  "autoReviewFallbackProfile",
+  // WrongProxy / WrongTrace URL. Empty = unset. Default lives in
+  // `LocalPrefs.DEFAULTS.wrongProxyUrl` ('http://localhost:8000'); users
+  // can override here for non-default daemon ports / paths.
+  "wrongProxyUrl"
 ]);
 var ENUM_PREF_KEYS = {
   autonomy: AUTONOMY_VALUES,
@@ -1031,7 +1040,7 @@ function routingPatch(payload) {
 function handlePrefsGet(ctx, ws) {
   ctx.send(ws, { type: "prefs.updated", payload: ctx.snapshot() });
 }
-function handlePrefsUpdate(ctx, ws, input) {
+async function handlePrefsUpdate(ctx, ws, input) {
   const parsed = validatePrefsUpdatePayload(input);
   if (!parsed.ok) {
     sendResult(ctx, ws, false, parsed.message);
@@ -1064,6 +1073,9 @@ function handlePrefsUpdate(ctx, ws, input) {
       ({ setDebugStreamEnabled }) => setDebugStreamEnabled(payload["debugStream"])
     );
   }
+  if (typeof payload["wrongProxyEnabled"] === "boolean" || typeof payload["wrongProxyUrl"] === "string") {
+    await ctx.applyWrongProxyPrefs?.(payload);
+  }
   if (typeof payload["logLevel"] === "string" && ["debug", "info", "warn", "error"].includes(payload["logLevel"])) {
     ctx.setLogLevel?.(payload["logLevel"]);
   }
@@ -7105,6 +7117,8 @@ function seedContextMeta(config, context) {
   meta["tgDelegate"] = tgExt?.["notifyOnDelegate"] !== false;
   const tgMs = tgExt?.["longToolThresholdMs"];
   meta["tgLongToolMs"] = typeof tgMs === "number" ? tgMs : 3e4;
+  meta["wrongProxyEnabled"] = config.tools?.wrongProxy?.enabled === true;
+  meta["wrongProxyUrl"] = config.tools?.wrongProxy?.url ?? "";
   {
     const pluginsEnabled = {};
     const record = (name2) => {
@@ -7471,6 +7485,85 @@ function createCustomModeStore(wrongstackDir) {
   return { modes, load: load2, save: save2, create, update, remove, list };
 }
 
+// src/server/proxy-runtime.ts
+import {
+  applyProxyConfig,
+  getProxyConfig,
+  rewriteBaseUrl,
+  shouldRewriteFor
+} from "@wrongstack/core/wiring/proxy-rewrite";
+var HEALTH_PATH = "/api/health";
+var PROBE_TIMEOUT_MS = 2e3;
+function seedWrongProxyFromConfig(config) {
+  const wp = config.tools?.wrongProxy;
+  if (!wp) {
+    return;
+  }
+  applyProxyConfig({
+    enabled: wp.enabled === true,
+    url: typeof wp.url === "string" ? wp.url : ""
+  });
+}
+async function probeWrongProxyActive() {
+  const cfg = getProxyConfig();
+  if (!cfg.enabled || !cfg.url) {
+    applyProxyConfig({ active: false });
+    return false;
+  }
+  const abort = new AbortController();
+  const timeout = setTimeout(() => abort.abort(), PROBE_TIMEOUT_MS);
+  if (typeof timeout.unref === "function") {
+    timeout.unref();
+  }
+  try {
+    const healthUrl = `${cfg.url.replace(/\/+$/, "")}${HEALTH_PATH}`;
+    const res = await fetch(healthUrl, {
+      method: "GET",
+      signal: abort.signal,
+      headers: { accept: "application/json" }
+    });
+    const ok2 = res.ok && res.status >= 200 && res.status < 300;
+    applyProxyConfig({ active: ok2 });
+    return ok2;
+  } catch {
+    applyProxyConfig({ active: false });
+    return false;
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+async function applyWrongProxyPrefs(payload) {
+  const patch = {};
+  if (typeof payload["wrongProxyEnabled"] === "boolean") {
+    patch.enabled = payload["wrongProxyEnabled"];
+  }
+  if (typeof payload["wrongProxyUrl"] === "string") {
+    patch.url = payload["wrongProxyUrl"];
+  }
+  if (Object.keys(patch).length === 0) return;
+  applyProxyConfig(patch);
+  await probeWrongProxyActive();
+}
+async function bootstrapWrongProxyFromConfig(config) {
+  seedWrongProxyFromConfig(config);
+  await probeWrongProxyActive();
+}
+function routeProviderCfgThroughProxy(cfg, fallbackBaseUrl, providerId) {
+  const raw = cfg;
+  const cfgType = typeof raw.type === "string" ? raw.type : void 0;
+  const cfgBaseUrl = typeof raw.baseUrl === "string" ? raw.baseUrl : void 0;
+  const factoryType = cfgType ?? providerId;
+  const rawBaseUrl = cfgBaseUrl ?? fallbackBaseUrl;
+  if (!rawBaseUrl || !shouldRewriteFor(factoryType)) {
+    return { ...cfg };
+  }
+  const baseUrl = rewriteBaseUrl(rawBaseUrl, getProxyConfig().url);
+  return {
+    ...cfg,
+    ...baseUrl !== cfgBaseUrl ? { baseUrl } : {}
+  };
+}
+
 // src/server/project-handlers.ts
 import * as fs10 from "node:fs/promises";
 import * as path11 from "node:path";
@@ -19402,7 +19495,13 @@ var PREF_KEYS = [
   // Per-plugin enable/disable map (parity with the embedded server).
   "pluginsEnabled",
   // Fleet chat verbosity: off | full (migrated from streamFleet boolean).
-  "fleetChatVerbosity"
+  "fleetChatVerbosity",
+  // WrongProxy / WrongTrace: master switch + configurable URL (default
+  // http://localhost:8000). When `wrongProxyEnabled` is true and the daemon
+  // is reachable, every provider's base URL flows through
+  // `${wrongProxyUrl}/proxy/<host><path>`. openai-codex is excluded by spec.
+  "wrongProxyEnabled",
+  "wrongProxyUrl"
 ];
 function prefSnapshot(contextMeta) {
   const snapshot = {};
@@ -19668,6 +19767,15 @@ async function persistPrefsToConfig(deps2, holder, payload) {
       }
       if (typeof payload["debugStream"] === "boolean")
         decrypted.debugStream = payload["debugStream"];
+      if (typeof payload["wrongProxyEnabled"] === "boolean" || typeof payload["wrongProxyUrl"] === "string") {
+        const toolsCfg = decrypted.tools ?? {};
+        const wp = toolsCfg["wrongProxy"] ?? {};
+        if (typeof payload["wrongProxyEnabled"] === "boolean")
+          wp["enabled"] = payload["wrongProxyEnabled"];
+        if (typeof payload["wrongProxyUrl"] === "string") wp["url"] = payload["wrongProxyUrl"];
+        toolsCfg["wrongProxy"] = wp;
+        decrypted.tools = toolsCfg;
+      }
       if (typeof payload["pluginsEnabled"] === "object" && payload["pluginsEnabled"] !== null) {
         const ext = decrypted.extensions ?? {};
         const toggled = [];
@@ -24332,7 +24440,12 @@ function resolveSetupProvider(opts) {
       baseUrl: config.baseUrl
     };
     try {
-      const cfgWithType = { ...providerConfig, type: config.provider };
+      const routedConfig = routeProviderCfgThroughProxy(
+        providerConfig,
+        config.baseUrl,
+        config.provider
+      );
+      const cfgWithType = { ...routedConfig, type: config.provider };
       const provider2 = config.features.modelsRegistry && providerRegistry.has(config.provider) ? providerRegistry.create(cfgWithType) : makeProviderFromConfig(config.provider, cfgWithType);
       return { provider: provider2, needsSetup: false };
     } catch (err) {
@@ -24345,8 +24458,13 @@ function resolveSetupProvider(opts) {
   if (firstKey) {
     const firstProvider = expectDefined2(savedProviders[firstKey]);
     try {
+      const routedConfig = routeProviderCfgThroughProxy(
+        firstProvider,
+        config.baseUrl,
+        firstKey
+      );
       const provider2 = makeProviderFromConfig(firstKey, {
-        ...firstProvider,
+        ...routedConfig,
         type: firstKey,
         family: firstProvider.family,
         apiKey: firstProvider.apiKey
@@ -24992,9 +25110,14 @@ function buildRoutes(state, deps2, cb) {
       const cur = state.getConfig();
       const newCfg = patchConfig(cur, { provider: newProvider, model: newModel });
       const providerCfg = newCfg.providers?.[newProvider] ?? { type: newProvider };
-      const built = deps2.providerRegistry.has(newProvider) ? deps2.providerRegistry.create({ ...providerCfg, type: newProvider }) : makeProviderFromConfig2(newProvider, providerCfg);
+      const routedCfg = routeProviderCfgThroughProxy(
+        providerCfg,
+        newCfg.baseUrl,
+        newProvider
+      );
+      const built = deps2.providerRegistry.has(newProvider) ? deps2.providerRegistry.create({ ...routedCfg, type: newProvider }) : makeProviderFromConfig2(newProvider, routedCfg);
       const newProv = deps2.modelsRegistry ? await withCatalogCapabilities(deps2.modelsRegistry, newProvider, built, {
-        ...providerCfg,
+        ...routedCfg,
         type: newProvider,
         model: newModel
       }) : built;
@@ -25006,7 +25129,7 @@ function buildRoutes(state, deps2, cb) {
       deps2.configStore.update({ provider: newProvider, model: newModel });
       deps2.context.model = newModel;
       deps2.context.provider = newProv;
-      await cb.updateAutoCompactionMaxContext(newProv, newProvider, providerCfg).catch((error2) => {
+      await cb.updateAutoCompactionMaxContext(newProv, newProvider, routedCfg).catch((error2) => {
         deps2.logger.warn(`model.switch capability refresh failed: ${String(error2)}`);
       });
       broadcast(state.getClients(), {
@@ -25147,6 +25270,13 @@ function buildRoutes(state, deps2, cb) {
       if (typeof payload["fallbackAuto"] === "boolean")
         config.fallbackAuto = payload["fallbackAuto"];
     },
+    // WrongProxy / WrongTrace: reflect the standalone toggle/URL into the
+    // shared `ProxyConfig` singleton immediately and await the re-probe so
+    // `active` is fresh before a subsequent model.switch reads it. In the
+    // CLI-hosted path this same key is the CLI's `applyWrongProxyPrefs`; when
+    // running as its own process there is no CLI to inject it, so route it to
+    // the server-local runtime module.
+    applyWrongProxyPrefs: (payload) => applyWrongProxyPrefs(payload),
     setAutoCompact: (enabled) => {
       deps2.pipelines.contextWindow.remove("AutoCompaction", { optional: true });
       if (enabled && deps2.autoCompactor) {
@@ -25631,7 +25761,12 @@ function setupWebuiCredentialWatcher(options) {
           ...snapshot.apiKey !== void 0 ? { apiKey: snapshot.apiKey } : {},
           ...snapshot.baseUrl !== void 0 ? { baseUrl: snapshot.baseUrl } : {}
         };
-        const newProv = deps2.providerRegistry.has(activeId) ? deps2.providerRegistry.create({ ...providerCfg, type: activeId }) : makeProviderFromConfig3(activeId, { ...providerCfg, type: activeId });
+        const routedCfg = routeProviderCfgThroughProxy(
+          providerCfg,
+          state.getConfig().baseUrl,
+          activeId
+        );
+        const newProv = deps2.providerRegistry.has(activeId) ? deps2.providerRegistry.create({ ...routedCfg, type: activeId }) : makeProviderFromConfig3(activeId, { ...routedCfg, type: activeId });
         deps2.context.provider = newProv;
         void updateAutoCompactionMaxContext(newProv).catch(() => void 0);
         console.log(`[WebUI] Provider credentials reloaded from config.json (${activeId})`);
@@ -25833,6 +25968,7 @@ async function startWebUI(opts = {}) {
   console.log("[WebUI] Starting backend services...");
   const boot = await bootConfig();
   const { config: baseConfig, globalConfigPath, wpaths, logger } = boot;
+  await bootstrapWrongProxyFromConfig(baseConfig);
   const vault = opts.services?.vault ?? boot.vault;
   let config = baseConfig;
   let projectRoot = boot.projectRoot;

package/dist/server/pref-helpers.d.ts

@@ -17,7 +17,7 @@
  */
 import type { SecretVault } from '@wrongstack/core/types';
 /** Pref keys exposed to the settings panel via prefs.get / prefs.updated. */
-export declare const PREF_KEYS: readonly ['autonomy', 'autonomyDelayMs', 'autoProceedMaxIterations', 'yolo', 'maxIterations', 'chime', 'confirmExit', 'nextPrediction', 'nextStepsTool', 'enhanceEnabled', 'enhanceDelayMs', 'enhanceLanguage', 'featureMcp', 'featurePlugins', 'featureMemory', 'featureSkills', 'featureModelsRegistry', 'indexOnStart', 'contextAutoCompact', 'contextStrategy', 'contextMode', 'tokenSavingTier', 'maxConcurrent', 'titleAnimation', 'uiLocale', 'logLevel', 'auditLevel', 'hqEnabled', 'hqUrl', 'hqRawContent', 'tgConfigured', 'tgSessionEnd', 'tgDelegate', 'tgLongToolMs', 'reasoningMode', 'reasoningEffort', 'reasoningPreserve', 'cacheTtl', 'fallbackModels', 'fallbackProfiles', 'favoriteModels', 'favoriteModelsOnly', 'modelAvailabilitySchedule', 'modelMatrix', 'fallbackAuto', 'refinerProvider', 'refinerModel', 'refinerFallbackProfile', 'thinkingWord', 'statuslineMode', 'animationStyle', 'showModelReasoning', 'breakerEnabled', 'breakerAutoKillResetMs', 'fsAccess', 'debugStream', 'chimeraEnabled', 'chimeraProvider', 'chimeraModel', 'chimeraMaxFiles', 'chimeraAutoFix', 'autoReviewEnabled', 'autoReviewProvider', 'autoReviewModel', 'autoReviewFallbackProfile', 'autoReviewModelSelection', 'autoReviewFallbackModels', 'autoReviewDebounceMs', 'autoReviewMaxFilesPerBatch', 'autoReviewMaxConcurrentReviews', 'autoReviewCascadeOn', 'groupToolCalls', 'showThinkingLogs', 'autoCollapseInput', 'pluginsEnabled', 'fleetChatVerbosity'];
+export declare const PREF_KEYS: readonly ['autonomy', 'autonomyDelayMs', 'autoProceedMaxIterations', 'yolo', 'maxIterations', 'chime', 'confirmExit', 'nextPrediction', 'nextStepsTool', 'enhanceEnabled', 'enhanceDelayMs', 'enhanceLanguage', 'featureMcp', 'featurePlugins', 'featureMemory', 'featureSkills', 'featureModelsRegistry', 'indexOnStart', 'contextAutoCompact', 'contextStrategy', 'contextMode', 'tokenSavingTier', 'maxConcurrent', 'titleAnimation', 'uiLocale', 'logLevel', 'auditLevel', 'hqEnabled', 'hqUrl', 'hqRawContent', 'tgConfigured', 'tgSessionEnd', 'tgDelegate', 'tgLongToolMs', 'reasoningMode', 'reasoningEffort', 'reasoningPreserve', 'cacheTtl', 'fallbackModels', 'fallbackProfiles', 'favoriteModels', 'favoriteModelsOnly', 'modelAvailabilitySchedule', 'modelMatrix', 'fallbackAuto', 'refinerProvider', 'refinerModel', 'refinerFallbackProfile', 'thinkingWord', 'statuslineMode', 'animationStyle', 'showModelReasoning', 'breakerEnabled', 'breakerAutoKillResetMs', 'fsAccess', 'debugStream', 'chimeraEnabled', 'chimeraProvider', 'chimeraModel', 'chimeraMaxFiles', 'chimeraAutoFix', 'autoReviewEnabled', 'autoReviewProvider', 'autoReviewModel', 'autoReviewFallbackProfile', 'autoReviewModelSelection', 'autoReviewFallbackModels', 'autoReviewDebounceMs', 'autoReviewMaxFilesPerBatch', 'autoReviewMaxConcurrentReviews', 'autoReviewCascadeOn', 'groupToolCalls', 'showThinkingLogs', 'autoCollapseInput', 'pluginsEnabled', 'fleetChatVerbosity', 'wrongProxyEnabled', 'wrongProxyUrl'];
 export interface PrefHelperDeps {
     /** Path to the active profile config; the sole settings mutation target. */
     profileConfigPath: string;

package/dist/server/prefs-handlers.d.ts

@@ -13,10 +13,20 @@ export interface PrefsHandlerContext {
     applyConfigPrefs?: ((payload: Record<string, unknown>) => void) | undefined;
     setAutoCompact?: ((enabled: boolean) => void) | undefined;
     setLogLevel?: ((level: 'debug' | 'info' | 'warn' | 'error') => void) | undefined;
+    /**
+     * WrongProxy / WrongTrace: applies the toggle + URL to the runtime
+     * config and kicks the periodic probe. Injected by the CLI's
+     * `createPrefsSeeding` so the WS server stays package-agnostic — the
+     * server doesn't pull `@wrongstack/cli`'s import graph or its
+     * `setInterval`-owning probe module. May return a promise so the
+     * standalone server's re-probe can be awaited before the next
+     * prefs-dependent request (e.g. an immediate model.switch).
+     */
+    applyWrongProxyPrefs?: ((payload: Record<string, unknown>) => void | Promise<void>) | undefined;
     send: (ws: WebSocket, message: WSServerMessage) => void;
     broadcast: (message: WSServerMessage) => void;
 }
 export declare function handlePrefsGet(ctx: PrefsHandlerContext, ws: WebSocket): void;
-export declare function handlePrefsUpdate(ctx: PrefsHandlerContext, ws: WebSocket, input: Record<string, unknown>): void;
+export declare function handlePrefsUpdate(ctx: PrefsHandlerContext, ws: WebSocket, input: Record<string, unknown>): Promise<void>;
 export declare function handleAutonomySwitch(ctx: PrefsHandlerContext, ws: WebSocket, mode: string): void;
 //# sourceMappingURL=prefs-handlers.d.ts.map

package/dist/server/proxy-runtime.d.ts

@@ -0,0 +1,82 @@
+/**
+ * WrongProxy / WrongTrace runtime seeding for the standalone WebUI server.
+ *
+ * The CLI hosts WebUI in-process via `dispatch-webui.ts`, which injects
+ * `applyWrongProxyPrefs` (from `@wrongstack/cli/wiring/proxy-wiring`) into
+ * the WS prefs handler and shares the CLI's proxy singleton. But when the
+ * WebUI server runs as its OWN process (`startWebUI`), no CLI is present to
+ * seed the `ProxyConfig` singleton in `@wrongstack/core/wiring/proxy-rewrite`
+ * — so all of the server's provider-build paths would construct providers
+ * with the raw base URL and never traverse the proxy.
+ *
+ * webui ⇏ cli, so this module cannot import `@wrongstack/cli`'s probe. It
+ * owns the same two concerns the CLI's `proxy-wiring` does, but dependency-
+ * light and self-contained:
+ *
+ *   1. Seeding the shared `ProxyConfig` singleton (`enabled` / `url`) from
+ *      `config.tools.wrongProxy` at boot.
+ *   2. A one-shot `/api/health` reachability probe that flips `active` to
+ *      true so `shouldRewriteFor()` returns true for subsequent provider
+ *      builds. Unlike the CLI's periodic probe this runs once at seed time
+ *      (the standalone server re-probes when the operator toggles the field
+ *      via `applyWrongProxyPrefs`); a long-lived daemon is assumed stable.
+ *
+ * The rewrite itself (`shouldRewriteFor` / `rewriteBaseUrl`) is pure logic
+ * in `@wrongstack/core` and is applied at each provider-build site in this
+ * server (setup-screen, routes applyModelSwitchCore, embedded-message-router,
+ * embedded-host-adapters, start-webui-credential-watcher).
+ */
+import type { Config } from '@wrongstack/core/types';
+/**
+ * Seed the shared `ProxyConfig` singleton from the persisted
+ * `config.tools.wrongProxy.{enabled,url}` block. Idempotent — safe to call
+ * at every boot. A provider that is eligible and reachable with a
+ * configured URL will then have its base URL rewritten through the proxy.
+ */
+export declare function seedWrongProxyFromConfig(config: Config): void;
+/**
+ * Probe the configured proxy daemon once and flip `active` to true when it
+ * answers a 2xx on `/api/health`. Mirrors the CLI's probe contract but
+ * without owning a `setInterval` loop. Resolves with the new `active` value.
+ * A non-2xx / timeout / ECONNREFUSED leaves `active` false so the rewriter
+ * keeps base URLs unchanged.
+ */
+export declare function probeWrongProxyActive(): Promise<boolean>;
+/**
+ * Apply the `wrongProxyEnabled` + `wrongProxyUrl` portion of a WS prefs
+ * payload, then re-probe so the rewrite reflects the new state immediately
+ * (the next provider build reads the freshly-probed `active`). Skips when the
+ * payload carries neither key. Mirrors the CLI's `applyWrongProxyPrefs`.
+ */
+export declare function applyWrongProxyPrefs(payload: Record<string, unknown>): Promise<void>;
+/**
+ * Seed the singleton from the persisted config and await the first probe so
+ * `active` is correct BEFORE the server's provider is constructed. Without
+ * the await, `setup-screen`'s `resolveSetupProvider` reads the singleton
+ * (synchronously) while `active` is still false and bakes the raw base URL
+ * into the initial provider. Mirrors the CLI's
+ * `bootstrapWrongProxy` + `awaitFirstWrongProxyProbe` pair.
+ */
+export declare function bootstrapWrongProxyFromConfig(config: Config): Promise<void>;
+/**
+ * Apply the WrongProxy / WrongTrace base-URL rewrite to ONE provider config
+ * before it is handed to a provider factory. This is the single shared seam
+ * for every WebUI-server provider-build path so the eligibility + compose
+ * rules cannot drift between call sites:
+ *
+ *   - `routes.ts` `applyModelSwitchCore` (model.switch rebuild)
+ *   - `setup-screen.ts` `resolveSetupProvider` (boot branches 1 + 2)
+ *   - `embedded-message-router.ts` `buildProvider`
+ *   - `embedded-host-adapters.ts` `applyEmbeddedModelSwitch`
+ *   - `start-webui-credential-watcher.ts` (credential hot-reload)
+ *
+ * Returns a copy of `cfg` with `baseUrl` overridden to
+ * `${proxyUrl}/proxy/<host><path>` when the toggle is on, the daemon is
+ * reachable (`active`) and the provider is eligible (openai-codex excluded
+ * by the rewriter). `fallbackBaseUrl` is used when `cfg` carries no explicit
+ * baseUrl (the call site's top-level config baseUrl). When the proxy is off
+ * or unreachable, the cfg is returned unchanged so factory construction
+ * behaves exactly as before the proxy feature existed.
+ */
+export declare function routeProviderCfgThroughProxy<T extends object>(cfg: Readonly<T>, fallbackBaseUrl: string | undefined, providerId: string): T;
+//# sourceMappingURL=proxy-runtime.d.ts.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrongstack/webui-server",
-  "version": "0.310.0",
+  "version": "0.310.1",
   "license": "MIT",
   "description": "WrongStack WebUI HTTP/WebSocket server module — extracted from @wrongstack/webui in PR #243/244 to remove the CLI -> @wrongstack/webui/server cross-package edge (audit §3.1.1). Pure backend: HTTP routes, WebSocket handlers, MCP tool wrappers, HTML serving. The web frontend lives in @wrongstack/webui; this package is the standalone server it can run on.",
   "keywords": [
@@ -36,18 +36,18 @@
   ],
   "dependencies": {
     "ws": "^8.21.3",
-    "@wrongstack/kanban": "0.310.0",
-    "@wrongstack/requirement-intake": "0.310.0",
-    "@wrongstack/providers": "0.310.0",
-    "@wrongstack/runtime": "0.310.0",
-    "@wrongstack/sdd": "0.310.0",
-    "@wrongstack/core": "0.310.0",
-    "@wrongstack/sage": "0.310.0",
-    "@wrongstack/techstack": "0.310.0",
-    "@wrongstack/mcp": "0.310.0",
-    "@wrongstack/vector-memory": "0.310.0",
-    "@wrongstack/tools": "0.310.0",
-    "@wrongstack/webui-protocol": "0.310.0"
+    "@wrongstack/core": "0.310.1",
+    "@wrongstack/kanban": "0.310.1",
+    "@wrongstack/mcp": "0.310.1",
+    "@wrongstack/sage": "0.310.1",
+    "@wrongstack/runtime": "0.310.1",
+    "@wrongstack/providers": "0.310.1",
+    "@wrongstack/sdd": "0.310.1",
+    "@wrongstack/tools": "0.310.1",
+    "@wrongstack/requirement-intake": "0.310.1",
+    "@wrongstack/vector-memory": "0.310.1",
+    "@wrongstack/techstack": "0.310.1",
+    "@wrongstack/webui-protocol": "0.310.1"
   },
   "devDependencies": {
     "@types/node": "^26.2.0",