@wrongstack/webui-server 0.313.0 → 0.316.1

package/dist/server/standalone-session-identity.d.ts

@@ -1,13 +1,13 @@
-import type { EventBus } from '@wrongstack/core/kernel';
 import { AgentStatusTracker } from '@wrongstack/core/coordination';
+import type { EventBus } from '@wrongstack/core/kernel';
 import { getSessionRegistry } from '@wrongstack/core/storage';
 import type { Config, Logger } from '@wrongstack/core/types';
-export interface StandaloneSessionIdentityPaths {
+interface StandaloneSessionIdentityPaths {
     globalRoot: string;
     projectRoot: string;
     projectSlug: string;
 }
-export interface StandaloneSessionIdentityOptions {
+interface StandaloneSessionIdentityOptions {
     config: Config;
     events: EventBus;
     logger: Logger;

package/dist/server/start-webui-proxy-apply.d.ts

@@ -22,7 +22,7 @@
  */
 import type { Provider, ProviderConfig } from '@wrongstack/core/types';
 import type { WebuiDeps, WebuiMutableState } from './routes.js';
-export interface WebuiProxyApplyOptions {
+interface WebuiProxyApplyOptions {
     state: WebuiMutableState;
     deps: WebuiDeps;
     /** Mirrors `cb.updateAutoCompactionMaxContext` in start-webui.ts. */
@@ -35,4 +35,5 @@ export interface WebuiProxyApplyOptions {
  * semantics (effective-URL comparison, serialized rebuilds).
  */
 export declare function setupWebuiProxyInstantApply(options: WebuiProxyApplyOptions): () => void;
+export {};
 //# sourceMappingURL=start-webui-proxy-apply.d.ts.map

package/dist/server/start-webui-shutdown.d.ts

@@ -17,6 +17,9 @@ export declare function setupWebuiShutdown(options: {
         detach: () => Promise<void>;
     };
     stopHeapWatchdog: () => Promise<void>;
+    stopLiveStatusLogger?: (() => void) | undefined;
+    /** Erase the fixed status panel and restore the raw console. */
+    stopTerminalDashboard?: (() => void) | undefined;
     getCredentialWatcherClose: () => (() => void) | undefined;
     getProxyInstantApplyDispose: () => () => void;
     disposeRealtimeHandlers: () => void;
@@ -44,6 +47,18 @@ export declare function setupWebuiShutdown(options: {
     vectorMemoryStore: {
         close(): void;
     } | undefined;
+    /**
+     * Drain every open tab's journal synchronously. Registered as a fatal-exit
+     * salvage hook: this host had none at all, so a crash truncated the buffered
+     * tail of the leader's journal AND of every other open tab.
+     */
+    flushSessionJournalsSync?: (() => void) | undefined;
+    /**
+     * End and close the journals of every tab that is not the leader's. Without
+     * it a clean quit left them with no trailing `session_end`, which is exactly
+     * what a crash looks like — the next launch offered them all for recovery.
+     */
+    closeSessionJournals?: (() => Promise<void>) | undefined;
     globalConfigPath: string;
 }): () => void;
 //# sourceMappingURL=start-webui-shutdown.d.ts.map

package/dist/server/system-prompt-handlers.d.ts

@@ -0,0 +1,67 @@
+/**
+ * The identity-prompt picker surface: which variants exist, what each costs,
+ * which one this session is running, and whether the user has ever chosen.
+ *
+ * `chosen` is the non-obvious field. The config loader materializes
+ * `systemPrompt: { variant: 'default' }` for every config, so the live Config
+ * cannot tell "the user picked Standard" from "nobody has ever asked". Only the
+ * raw profile config file can — the key is written explicitly on selection — so
+ * `chosen: false` is what lets the browser open the picker once on a fresh
+ * install and never nag again. It is the same signal the CLI startup menu uses
+ * to decide between the full menu and the one-line confirmation.
+ */
+import { type SystemInstructionVariant, type SystemPromptVariantPaths } from '@wrongstack/core/agent';
+/** Everything the picker needs from the host, injected so both WS hosts share it. */
+export interface SystemPromptSurface {
+    /** Instruction dirs, resolved the way the SystemPromptBuilder resolves them. */
+    paths: () => SystemPromptVariantPaths;
+    /** Active profile config — the file whose `systemPrompt.variant` marks a choice. */
+    profileConfigPath: string;
+    /** The variant the running session is currently built from. */
+    current: () => SystemInstructionVariant;
+    /**
+     * Recompose the live system prompt for the new variant. Persistence is the
+     * prefs layer's job; this only refreshes the in-memory prompt so the change
+     * takes effect on the next turn instead of the next boot.
+     */
+    /**
+     * Rebuild the live identity prompt. `sessionId` names the tab that asked —
+     * each WebUI tab runs its own context, so the rebuild has to land on that
+     * one rather than on whichever session the runtime is currently pointing at.
+     */
+    applyVariant?: ((variant: SystemInstructionVariant, sessionId?: string) => void | Promise<void>) | undefined;
+}
+export interface SystemPromptVariantInfo {
+    variant: SystemInstructionVariant;
+    label: string;
+    hint: string;
+    /** Upper-bound token estimate of the identity block this variant injects. */
+    tokens: number;
+}
+export interface SystemPromptInfoPayload {
+    current: SystemInstructionVariant;
+    /** False until the user has explicitly picked a variant at least once. */
+    chosen: boolean;
+    variants: SystemPromptVariantInfo[];
+    /** Set when the token estimate could not be computed; variants still list. */
+    error?: string | undefined;
+}
+/**
+ * Compose the picker payload. Token counting reads the bundled/global/project
+ * instruction files, so a failure there (unreadable override dir, for instance)
+ * degrades to zero counts rather than denying the user the picker entirely.
+ */
+/**
+ * The variant catalogue, plus which variant is live.
+ *
+ * The catalogue (labels, token costs, whether the user has ever chosen) is a
+ * project fact and the same for every tab. `current` is NOT: the identity
+ * variant is a per-session preference, so a tab that picked "lite" must not be
+ * told it is on the "pro" another tab just selected. `currentOverride` carries
+ * the asking session's own value; without one the config default stands, which
+ * is what a single-session host wants.
+ */
+export declare function buildSystemPromptInfo(surface: SystemPromptSurface, currentOverride?: string | undefined): Promise<SystemPromptInfoPayload>;
+/** Payload for a host that never wired the picker — the browser hides it. */
+export declare function unavailableSystemPromptInfo(): SystemPromptInfoPayload;
+//# sourceMappingURL=system-prompt-handlers.d.ts.map

package/dist/server/system-prompt-rebuild.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Rebuild the live system prompt after something that feeds it changed.
+ *
+ * Two things can move underneath a running session: the active mode (which
+ * contributes a whole prompt layer) and the identity variant (Lite / Standard /
+ * Pro, which selects `system.md` vs `system-lite.md` vs `system-pro.md`). Both
+ * need the exact same eleven-dependency `DefaultSystemPromptBuilder` call, and
+ * a second copy of that call is a second place to forget `injectMemory: false`
+ * — which would double-inject SAGE memories, since its turn middleware is the
+ * single memory channel.
+ */
+import { type Context, DefaultSystemPromptBuilder } from '@wrongstack/core/agent';
+import { type Container } from '@wrongstack/core/kernel';
+import type { ToolRegistry } from '@wrongstack/core/registry';
+import type { Config, MemoryPort, ModeStore, SkillLoader } from '@wrongstack/core/types';
+type ModelCapabilities = NonNullable<ConstructorParameters<typeof DefaultSystemPromptBuilder>[0]>['modelCapabilities'];
+export interface SystemPromptRebuildDeps {
+    modeStore: ModeStore | undefined;
+    memoryStore: MemoryPort | undefined;
+    skillLoader: SkillLoader | undefined;
+    modelCapabilities: ModelCapabilities;
+    context: Context;
+    toolRegistry: ToolRegistry;
+    getConfig: () => Pick<Config, 'provider' | 'model' | 'systemPrompt' | 'features'>;
+    projectRoot: string;
+    globalRoot: string;
+    /**
+     * When supplied, the freshly built builder replaces the container-bound one.
+     *
+     * Matters for the identity variant specifically: the boot-time builder has
+     * the old variant baked into its `instructionPaths`, and everything that
+     * resolves `TOKENS.SystemPromptBuilder` later — the subagent factory, most
+     * visibly — would otherwise keep composing subagent prompts from the variant
+     * the user just moved away from.
+     */
+    container?: Container | undefined;
+}
+/**
+ * Recompose `context.systemPrompt` for `modeId` using the variant that context
+ * is running. Mutates the context in place; the caller decides what to
+ * broadcast afterwards.
+ */
+export declare function rebuildSystemPrompt(deps: SystemPromptRebuildDeps, modeId: string): Promise<void>;
+export {};
+//# sourceMappingURL=system-prompt-rebuild.d.ts.map

package/dist/server/terminal-dashboard.d.ts

@@ -0,0 +1,145 @@
+/**
+ * Terminal dashboard — the WebUI host's tidy console surface.
+ *
+ * The server process talks to the terminal through raw `console.*` calls
+ * scattered across dozens of modules (structured JSON warn/error lines,
+ * `[WebUI] …` progress chatter) and, on top of that, a live status block
+ * that used to be re-printed on every state change. With four tabs running
+ * those streams interleaved into an unreadable wall of text.
+ *
+ * This module is the single coordinator for both hosts (standalone server
+ * and the CLI-embedded `wstack --webui`):
+ *
+ *   - **A fixed status panel at the bottom.** Session rows (running/idle,
+ *     iteration, subagents, elapsed) are redrawn IN PLACE with ANSI cursor
+ *     moves instead of appended, so the stats stay visible without growing
+ *     the scrollback. `setSessions` is fingerprint-gated: identical rows
+ *     never rewrite the panel.
+ *
+ *   - **An ordered log stream above the panel.** Every forwarded
+ *     `console.*` line erases the panel, prints with a `HH:MM:SS LEVEL`
+ *     prefix, then redraws the panel — a log line can never land mid-panel.
+ *     Structured JSON lines (the `{level,event,message,…}` shape the log
+ *     shims emit) are rendered as readable single lines.
+ *
+ *   - **Noise control.** Identical consecutive lines collapse into one
+ *     `↑ previous line repeated N×` notice, and `quiet` mode keeps
+ *     `log/info/debug` chatter out of the terminal entirely (ring-buffered
+ *     for a failure dump) while `warn/error` still flow — the contract the
+ *     CLI host's quiet surface used to own.
+ *
+ * Non-TTY output and `WEBUI_VERBOSE=1` bypass everything: redirected
+ * output and log collectors keep the complete append-only log.
+ */
+/** Minimal console surface the dashboard can wrap (injectable for tests). */
+export interface DashboardConsoleTarget {
+    log: (...args: unknown[]) => void;
+    info: (...args: unknown[]) => void;
+    warn: (...args: unknown[]) => void;
+    error: (...args: unknown[]) => void;
+    debug: (...args: unknown[]) => void;
+}
+/** Minimal stdout surface for panel drawing (injectable for tests). */
+export interface DashboardStdout {
+    isTTY?: boolean | undefined;
+    columns?: number | undefined;
+    write(chunk: string): void;
+}
+/** One session row on the panel. Built by the live-status logger. */
+export interface DashboardSessionRow {
+    id: string;
+    provider: string;
+    model: string;
+    isRunning: boolean;
+    iteration?: {
+        index: number;
+        max?: number | undefined;
+    } | undefined;
+    runningSubagents: number;
+    totalSubagents: number;
+    /** Epoch ms when the current run started, for the elapsed column. */
+    runningSince?: number | undefined;
+    agents?: readonly DashboardAgentRow[] | undefined;
+}
+/** One leader/subagent row nested under a session branch. */
+export interface DashboardAgentRow {
+    id: string;
+    label: string;
+    provider: string;
+    model: string;
+    status: string;
+    iteration?: {
+        index: number;
+        max?: number | undefined;
+    } | undefined;
+    toolCalls: number;
+    /** Epoch ms while the agent is still active. */
+    startedAt?: number | undefined;
+    /** Final elapsed time for completed agents. */
+    durationMs?: number | undefined;
+}
+export interface TerminalDashboardOptions {
+    /** Panel title, e.g. `WebUI` / `SimpleUI`. */
+    title?: string | undefined;
+    /** Live URL shown in the panel header (token-less). */
+    getUrl?: (() => string | undefined) | undefined;
+    stdout?: DashboardStdout | undefined;
+    consoleTarget?: DashboardConsoleTarget | undefined;
+    /**
+     * Mute `log/info/debug` chatter into the ring buffer; only `warn/error`
+     * reach the terminal. The CLI-embedded host defaults this on (the browser
+     * owns the chatter), the standalone host off.
+     */
+    quiet?: boolean | undefined;
+    /** Pass EVERYTHING through untouched — the `WEBUI_VERBOSE=1` escape hatch. */
+    verbose?: boolean | undefined;
+    /** Ring-buffer size for {@link TerminalDashboard.recent}. */
+    bufferLines?: number | undefined;
+    /** Max session rows drawn before a `+N more` overflow line. */
+    maxRows?: number | undefined;
+    /** Max visible log lines kept above the live status tree. */
+    maxLogRows?: number | undefined;
+    now?: (() => number) | undefined;
+}
+export interface TerminalDashboard {
+    /** `false` when the console was left untouched (non-TTY or verbose). */
+    readonly enabled: boolean;
+    /** Chatter lines dropped from the terminal so far (quiet mode). */
+    readonly mutedCount: number;
+    /** Newest muted lines, oldest first — for a diagnostic dump on failure. */
+    recent(): readonly string[];
+    /** Redraw the status panel in place. No-op when the rows are unchanged. */
+    setSessions(rows: readonly DashboardSessionRow[]): void;
+    /** Erase the panel, flush pending notices, restore the console. Idempotent. */
+    stop(): void;
+}
+export declare function isWebUIVerboseEnv(env?: Record<string, string | undefined>): boolean;
+/**
+ * Render one structured `{level,event,message,…}` JSON line into a body
+ * (event, message, `sess:` tag, scalar extras) plus the record's own level.
+ * The caller stamps the timestamp and level tag exactly once — returning the
+ * full line here would double-stamp. Returns `null` when the line is not a
+ * structured record, in which case the raw text is shown as-is.
+ */
+export declare function prettifyStructuredLine(raw: string, colorize: boolean): {
+    level: string;
+    text: string;
+} | null;
+/**
+ * Build the panel lines for the current session rows. Pure — exported for
+ * tests. Lines are plain (no ANSI); the caller colorizes.
+ */
+export declare function renderSessionPanelLines(rows: readonly DashboardSessionRow[], options: {
+    title: string;
+    url?: string | undefined;
+    maxRows?: number | undefined;
+    width?: number | undefined;
+    now?: number | undefined;
+}): string[];
+/**
+ * Start the dashboard. Disabled (console untouched, panel never drawn) on a
+ * non-TTY stdout or when `verbose` is set — redirected output and log
+ * collectors keep the complete append-only log.
+ */
+export declare function startTerminalDashboard(options?: TerminalDashboardOptions): TerminalDashboard;
+//# sourceMappingURL=terminal-dashboard.d.ts.map

package/dist/server/types.d.ts

@@ -1,10 +1,10 @@
-import type { WebSocket } from 'ws';
-import type { TrustBoundary } from '@wrongstack/core/security';
-import type { ConfigStore, ModelsRegistry, SecretVault, SessionStore } from '@wrongstack/core/types';
-import type { JournalEntry } from '@wrongstack/core/storage';
 import type { Agent, AgentPipelines } from '@wrongstack/core/agent';
 import type { EventBus } from '@wrongstack/core/kernel';
 import type { ToolRegistry } from '@wrongstack/core/registry';
+import type { TrustBoundary } from '@wrongstack/core/security';
+import type { JournalEntry } from '@wrongstack/core/storage';
+import type { ConfigStore, ModelsRegistry, SecretVault, SessionStore } from '@wrongstack/core/types';
+import type { WebSocket } from 'ws';
 /** Compatibility envelope; new boundaries should decode to CanonicalServerMessage. */
 export interface WSServerMessage {
     type: string;
@@ -84,6 +84,20 @@ export interface WebUIOptions {
      * webui an observer slot.
      */
     subscribeEternalIteration?: ((fn: (entry: JournalEntry) => void) => () => void) | undefined;
+    /**
+     * Stop every subagent that ONE session spawned.
+     *
+     * Aborting a session's run only unwinds the workers the leader is blocked
+     * on. Anything started with `spawn_subagent` + `assign_task` keeps running
+     * because nothing asked it to stop — so a tab's Stop button silenced the
+     * leader while its fleet ground on in the background. The host owns the
+     * Director, so it supplies the cascade; the webui server only knows WHICH
+     * session was stopped.
+     *
+     * Session-scoped by contract: with four tabs live, stopping one tab must
+     * never reach into another tab's fleet.
+     */
+    stopSessionFleet?: ((sessionId: string) => void | Promise<void>) | undefined;
 }
 export interface BackendServices {
     agent: Agent;
@@ -98,7 +112,22 @@ export interface BackendServices {
 }
 export interface ConnectedClient {
     ws: WebSocket;
+    /**
+     * The session this connection last acted on. Kept for the abort-on-close
+     * path and for surfaces that only ever show one session at a time.
+     */
     sessionId: string | null;
+    /**
+     * EVERY session this connection is displaying.
+     *
+     * One browser page holds up to four tabs on ONE socket, so `sessionId`
+     * alone describes only whichever tab the user last touched — filtering
+     * broadcasts by it dropped the other three tabs' runs before they left the
+     * server. The client declares its open set with `session.subscribe`; an
+     * empty set means "not declared", and such a client falls back to the
+     * single-session filter.
+     */
+    sessionIds?: Set<string> | undefined;
     connectedAt: number;
     /** Remote socket address captured for verbose rejection logging. */
     remoteAddress?: string;

package/dist/server/webui-status-logger.d.ts

@@ -0,0 +1,61 @@
+/**
+ * Live status tracker for the WebUI host terminal.
+ *
+ * Subscribes to the agent/iteration events, merges them with the host's
+ * session list, and feeds one {@link DashboardSessionRow} per session to the
+ * terminal dashboard's fixed panel — running/idle state, iteration counter,
+ * subagent counts and run elapsed time. Redraws are debounced and
+ * fingerprint-gated by the dashboard, so bursts of events cost at most one
+ * panel repaint, and the heartbeat only refreshes the elapsed column.
+ *
+ * When the dashboard is disabled (non-TTY output or `WEBUI_VERBOSE=1`) the
+ * tracker falls back to printing a compact status block on change — the
+ * append-only shape redirected output and log collectors expect.
+ */
+import type { DashboardSessionRow, TerminalDashboard } from './terminal-dashboard.js';
+interface EventBusLike {
+    on(event: string, listener: (...args: unknown[]) => void): unknown;
+    off(event: string, listener: (...args: unknown[]) => void): unknown;
+}
+export interface StatusSessionInfo {
+    id: string;
+    model: string;
+    provider: string;
+    isRunning: boolean;
+}
+interface SubagentRecord {
+    id: string;
+    role: string;
+    status: string;
+    provider?: string | undefined;
+    model?: string | undefined;
+    iteration?: {
+        index: number;
+        max?: number | undefined;
+    } | undefined;
+    toolCalls: number;
+    startedAt?: number | undefined;
+    durationMs?: number | undefined;
+}
+export interface WebUILiveStatusLoggerOptions {
+    events: EventBusLike;
+    getSessionList: () => StatusSessionInfo[];
+    /** The terminal dashboard that owns the fixed panel. */
+    dashboard: Pick<TerminalDashboard, 'enabled' | 'setSessions'>;
+    debounceMs?: number | undefined;
+    heartbeatMs?: number | undefined;
+    now?: (() => number) | undefined;
+}
+/**
+ * Merge the host session list with the tracked subagents, iterations and
+ * run-start timestamps into panel rows. Pure — exported for tests.
+ */
+export declare function buildSessionRows(sessions: readonly StatusSessionInfo[], sessionSubagents: ReadonlyMap<string, Map<string, SubagentRecord>>, sessionIterations: ReadonlyMap<string, {
+    index: number;
+    max?: number | undefined;
+}>, runStartedAt: ReadonlyMap<string, number>, sessionToolCalls?: ReadonlyMap<string, number>): DashboardSessionRow[];
+/** Compact append-only block for non-TTY output (log files, pipes). */
+export declare function formatSessionRowsBlock(rows: readonly DashboardSessionRow[]): string;
+export declare function startWebUILiveStatusLogger(options: WebUILiveStatusLoggerOptions): () => void;
+export {};
+//# sourceMappingURL=webui-status-logger.d.ts.map

package/dist/server/worklist-routes.d.ts

@@ -1,5 +1,5 @@
 import type { WebSocket } from 'ws';
-import { type WorklistContext } from './handlers/worklist-handlers.js';
+import { type WorklistContext, type WorklistMessage } from './handlers/worklist-handlers.js';
 import type { WSClientMessage } from './types.js';
 export interface WorklistRouteHandlers {
     getTodos: (ws: WebSocket, msg: WSClientMessage) => Promise<void> | void;
@@ -13,7 +13,13 @@ export interface WorklistRouteHandlers {
     updatePlanItem: (ws: WebSocket, msg: WSClientMessage) => Promise<void> | void;
 }
 export interface WorklistRouteContext {
-    getContext: () => WorklistContext;
+    /**
+     * Resolve the worklist context for ONE request. The message is handed over
+     * so a multi-session host can bind to the session the payload names instead
+     * of whichever session the shared root context currently points at.
+     * Hosts that ignore it keep the single-context behaviour.
+     */
+    getContext: (message?: WorklistMessage) => WorklistContext;
     allowMessage?: ((ws: WebSocket, message: WSClientMessage) => boolean) | undefined;
 }
 export declare function createWorklistRouteHandlers(ctx: WorklistRouteContext): WorklistRouteHandlers;

package/dist/server/worklist-session-context.d.ts

@@ -0,0 +1,44 @@
+import type { Agent, Context } from '@wrongstack/core/agent';
+import type { WebSocket } from 'ws';
+import type { WorklistContext, WorklistMessage } from './handlers/worklist-handlers.js';
+import type { WSServerMessage } from './types.js';
+/**
+ * Per-session binding for the worklist routes (todos / tasks / plan).
+ *
+ * The worklist used to read and write through the shared ROOT context — the
+ * one `session.resume` re-points to whichever tab was switched to last. A
+ * request stamped with a background tab's session id was therefore *allowed*
+ * by the session gate but served (and mutated!) the foreground session's
+ * board: every tab showed one shared list, and a click in tab B could rewrite
+ * tab A's todos.
+ *
+ * This factory resolves the context the request actually names:
+ *
+ *   - untagged requests keep the root context (single-session hosts, older
+ *     clients) — identical to the previous behaviour;
+ *   - a request naming the root session keeps the root context;
+ *   - a request naming another session resolves that session's agent
+ *     (read-only `peekAgent` first, then `getAgent`, which creates one — the
+ *     four-tab registry with idle eviction is the same one the conversation
+ *     routes already use).
+ *
+ * Agents minted while the root sat on a different session inherit the root's
+ * meta verbatim, including its `plan.path` / `task.path` sidecar paths. Those
+ * are re-scoped to the requested session here, before any read or write can
+ * land in the neighbouring session's `.plan.json` / `.tasks.json`.
+ */
+interface SessionWorklistDeps {
+    /** Shared root context — bound to whichever session the runtime last activated. */
+    rootContext: Context;
+    /** Agent for a session WITHOUT creating one; preferred for read paths. */
+    peekAgent?: ((sessionId?: string) => Agent | undefined) | undefined;
+    /** Agent for a session, creating one when absent (four-tab registry). */
+    getAgent?: ((sessionId?: string) => Agent) | undefined;
+    /** Sessions directory holding the per-session plan/task/todos sidecars. */
+    sessionsDir?: string | undefined;
+    send: (ws: WebSocket, msg: WSServerMessage) => void;
+    broadcast: (msg: WSServerMessage) => void;
+}
+export declare function createSessionAwareWorklistContext(deps: SessionWorklistDeps): (message?: WorklistMessage | undefined) => WorklistContext;
+export {};
+//# sourceMappingURL=worklist-session-context.d.ts.map

package/dist/server/worktree-ws-handler.d.ts

@@ -1,7 +1,7 @@
 import type { EventBus } from '@wrongstack/core/kernel';
 import type { Logger } from '@wrongstack/core/types';
 import type { WebSocket } from 'ws';
-export interface WorktreeManagementDeps {
+interface WorktreeManagementDeps {
     projectRoot: string;
     /** Board snapshot dir — powers the cross-process liveness guard on cleanup. */
     boardsDir: string;
@@ -100,4 +100,5 @@ export declare class WorktreeWebSocketHandler {
     private broadcast;
     private send;
 }
+export {};
 //# sourceMappingURL=worktree-ws-handler.d.ts.map

package/dist/server/ws-payload-validation.d.ts

@@ -10,9 +10,15 @@ interface ModelSwitchPayload {
     provider: string;
     model: string;
     requestId?: string | undefined;
+    /**
+     * The tab that asked. Every WebUI tab runs its own session with its own
+     * model, so a switch applies to the requesting session's context — not to
+     * whichever session the runtime last had in front.
+     */
+    sessionId?: string | undefined;
 }
 export declare function validateModelSwitchPayload(payload: unknown): PayloadValidationResult<ModelSwitchPayload>;
-export interface ModelFallbackChoicePayload {
+interface ModelFallbackChoicePayload {
     requestId: string;
     providerId?: string | undefined;
     model?: string | undefined;
@@ -46,6 +52,15 @@ export interface MailboxSendPayload {
     body: string;
     priority: 'low' | 'normal' | 'high';
     replyTo?: string | undefined;
+    /**
+     * The tab this message was composed in.
+     *
+     * Carried because `to: 'leader'` is AMBIGUOUS once a WebUI page holds four
+     * sessions: every tab's agent is registered as a leader, so an unscoped
+     * message addressed that way is folded into whichever of them happens to
+     * poll the mailbox — a "btw" typed in tab 3 steering the run in tab 1.
+     */
+    sessionId?: string | undefined;
 }
 export declare function validateMailboxSendPayload(payload: unknown): PayloadValidationResult<MailboxSendPayload>;
 export declare function validateMailboxAgentsPayload(payload: unknown): PayloadValidationResult<MailboxAgentsPayload | undefined>;
@@ -137,6 +152,16 @@ interface GitDiffPayload {
     path: string;
 }
 export declare function validateGitDiffPayload(payload: unknown): PayloadValidationResult<GitDiffPayload>;
+interface GitPathsPayload {
+    paths: string[];
+}
+export declare function validateGitStagePayload(payload: unknown): PayloadValidationResult<GitPathsPayload>;
+export declare function validateGitUnstagePayload(payload: unknown): PayloadValidationResult<GitPathsPayload>;
+export declare function validateGitDiscardPayload(payload: unknown): PayloadValidationResult<GitPathsPayload>;
+interface GitCommitPayload {
+    message: string;
+}
+export declare function validateGitCommitPayload(payload: unknown): PayloadValidationResult<GitCommitPayload>;
 interface ProjectsAddPayload {
     root: string;
     name?: string;
@@ -160,7 +185,7 @@ export declare function validateProjectsSelectPayload(payload: unknown): Payload
  * configures. The spawn itself is hardened separately by
  * `buildWin32CmdShimInvocation` (CMDI-005).
  */
-export interface McpServerPayload {
+interface McpServerPayload {
     name: string;
     [key: string]: unknown;
 }

package/dist/server/ws-utils.d.ts

@@ -14,11 +14,28 @@ export declare function sendSerialized(ws: WebSocket, data: string, frameBytes?:
  */
 export declare function send(ws: WebSocket, msg: object): void;
 /**
- * Broadcast a JSON message to every connected client.
- * Swallows per-socket send errors — a client that disconnected between the
- * readyState check and `ws.send()` is cleaned up by its own `close` handler.
+ * Broadcast a JSON message to connected clients.
+ *
+ * When a sessionId is present in msg.payload, only clients displaying that
+ * session receive it — see `clientWantsSession`. Global messages without a
+ * sessionId are sent to all connected clients.
+ */
+export declare function broadcast(clients: Map<WebSocket, ConnectedClient>, msg: object, targetSessionId?: string): void;
+/**
+ * Does this connection display the session a message is addressed to?
+ *
+ * A page with four tabs open is ONE socket. Deciding delivery from
+ * `client.sessionId` — the tab last touched — silently dropped the other
+ * three tabs' runs at the wire, which looks exactly like "the background tab
+ * stopped working". `sessionIds` is the declared open set (`session.subscribe`);
+ * a connection that has not declared one keeps the old single-session filter,
+ * so surfaces that only ever show one session are unaffected.
  */
-export declare function broadcast(clients: Map<WebSocket, ConnectedClient>, msg: object): void;
+export declare function clientWantsSession(client: Pick<ConnectedClient, 'sessionId' | 'sessionIds'>, sessionId: string | undefined): boolean;
+/**
+ * Broadcast unconditionally to all connected clients.
+ */
+export declare function broadcastAll(clients: Map<WebSocket, ConnectedClient>, msg: object): void;
 /**
  * Send a success/failure result message (used by key.* and provider.* handlers).
  * The frontend expects `key.operation_result` with `{ success, message }`.
@@ -54,4 +71,12 @@ export declare function buildWebUIAccessUrl(opts: {
     publicUrl?: string | undefined;
 }): string;
 export declare function envFlag(name: string): boolean;
+/**
+ * The session a client message names, or undefined. Session-scoped replies
+ * (`brain.status`, `/diag`) use it so the answer describes the tab that asked
+ * rather than whichever session the runtime happens to be on.
+ */
+export declare function messageSessionId(msg: {
+    payload?: unknown;
+}): string | undefined;
 //# sourceMappingURL=ws-utils.d.ts.map