@wrongstack/webui 0.257.2 → 0.264.0

package/dist/server/entry.js

@@ -1,14 +1,8 @@
 #!/usr/bin/env node
-var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
-  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
-}) : x)(function(x) {
-  if (typeof require !== "undefined") return require.apply(this, arguments);
-  throw Error('Dynamic require of "' + x + '" is not supported');
-});
-
 // src/server/index.ts
 import { expectDefined as expectDefined2, GlobalMailbox as GlobalMailbox2, projectSlug, getSessionRegistry, AgentStatusTracker } from "@wrongstack/core";
 import { makeMailboxTool, makeMailSendTool, makeMailInboxTool, mailboxSessionTag } from "@wrongstack/core";
+import { toErrorMessage as toErrorMessage5 } from "@wrongstack/core/utils";
 import {
   BrainMonitor,
   DefaultBrainArbiter,
@@ -17,7 +11,7 @@ import {
   createTieredBrainArbiter
 } from "@wrongstack/core";
 import * as fs7 from "fs/promises";
-import * as path9 from "path";
+import * as path8 from "path";
 
 // src/server/http-server.ts
 import * as fs from "fs/promises";
@@ -25,7 +19,7 @@ import * as http from "http";
 import * as path from "path";
 
 // src/server/ws-auth.ts
-import { Buffer as Buffer2 } from "buffer";
+import { Buffer } from "buffer";
 import { timingSafeEqual } from "crypto";
 function isLoopbackHostname(hostname) {
   return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1" || hostname === "[::1]";
@@ -44,8 +38,8 @@ function isLoopbackBind(wsHost) {
 }
 function tokenMatches(provided, expected) {
   if (!provided) return false;
-  const a = Buffer2.from(provided);
-  const b = Buffer2.from(expected);
+  const a = Buffer.from(provided);
+  const b = Buffer.from(expected);
   if (a.length !== b.length) return false;
   return timingSafeEqual(a, b);
 }
@@ -711,6 +705,7 @@ function patchConfig(config, updates) {
 
 // src/server/autophase-ws-handler.ts
 import { spawnSync } from "child_process";
+import { toErrorMessage } from "@wrongstack/core/utils";
 import {
   AutoPhasePlanner,
   PhaseGraphBuilder,
@@ -880,7 +875,7 @@ var AutoPhaseWebSocketHandler = class {
       );
       this.broadcastState();
     }).catch((err) => {
-      this.logger.error(`[AutoPhase] Aborted: ${err instanceof Error ? err.message : String(err)}`);
+      this.logger.error(`[AutoPhase] Aborted: ${toErrorMessage(err)}`);
       this.stopBroadcast();
       this.broadcast({ type: "autophase.failed", payload: { title, error: String(err) } });
     });
@@ -913,7 +908,7 @@ var AutoPhaseWebSocketHandler = class {
       }
       this.logger.info(`[AutoPhase] Planner produced no phases; using defaults for: ${goal}`);
     } catch (err) {
-      this.logger.error(`[AutoPhase] Planning failed, using defaults: ${err instanceof Error ? err.message : String(err)}`);
+      this.logger.error(`[AutoPhase] Planning failed, using defaults: ${toErrorMessage(err)}`);
     }
     return this.defaultPhases();
   }
@@ -1040,6 +1035,7 @@ Type: ${task.type}`;
 
 // src/server/collaboration-ws-handler.ts
 import { randomUUID } from "crypto";
+import { toErrorMessage as toErrorMessage2 } from "@wrongstack/core/utils";
 var REPLAY_LIMIT = 50;
 var PAUSE_TIMEOUT_MS = 6e4;
 var CollaborationWebSocketHandler = class {
@@ -1167,7 +1163,7 @@ var CollaborationWebSocketHandler = class {
     if (this.reader) {
       this.replayHistory(ws, sessionId).catch((err) => {
         this.logger.debug?.(
-          `collab: replay failed for ${sessionId}: ${err instanceof Error ? err.message : String(err)}`
+          `collab: replay failed for ${sessionId}: ${toErrorMessage2(err)}`
         );
       });
     }
@@ -1277,7 +1273,7 @@ var CollaborationWebSocketHandler = class {
       this.send(
         ws,
         this.errorMessage(
-          `annotation rejected: ${err instanceof Error ? err.message : String(err)}`
+          `annotation rejected: ${toErrorMessage2(err)}`
         )
       );
     }
@@ -1344,7 +1340,7 @@ var CollaborationWebSocketHandler = class {
       this.send(
         ws,
         this.errorMessage(
-          `resolve failed: ${err instanceof Error ? err.message : String(err)}`
+          `resolve failed: ${toErrorMessage2(err)}`
         )
       );
     }
@@ -1392,7 +1388,7 @@ var CollaborationWebSocketHandler = class {
           if (p.ws.readyState === 1) p.ws.send(data);
         } catch (err) {
           this.logger.debug?.(
-            `collab broadcast failed: ${err instanceof Error ? err.message : String(err)}`
+            `collab broadcast failed: ${toErrorMessage2(err)}`
           );
         }
       }
@@ -1419,7 +1415,7 @@ var CollaborationWebSocketHandler = class {
       }
     } catch (err) {
       this.logger.debug?.(
-        `collab: session reader rejected ${sessionId}: ${err instanceof Error ? err.message : String(err)}`
+        `collab: session reader rejected ${sessionId}: ${toErrorMessage2(err)}`
       );
       return;
     }
@@ -1500,7 +1496,7 @@ var CollaborationWebSocketHandler = class {
         if (p.ws.readyState === 1) p.ws.send(data);
       } catch (err) {
         this.logger.debug?.(
-          `collab broadcast failed: ${err instanceof Error ? err.message : String(err)}`
+          `collab broadcast failed: ${toErrorMessage2(err)}`
         );
       }
     }
@@ -1697,6 +1693,7 @@ var CollaborationWebSocketHandler = class {
 };
 
 // src/server/worktree-ws-handler.ts
+import { toErrorMessage as toErrorMessage3 } from "@wrongstack/core/utils";
 var MAX_ACTIVITY = 6;
 var WorktreeWebSocketHandler = class {
   constructor(events, logger) {
@@ -1822,7 +1819,7 @@ var WorktreeWebSocketHandler = class {
       try {
         if (ws.readyState === 1) ws.send(data);
       } catch (err) {
-        this.logger.debug?.(`worktree broadcast failed: ${err instanceof Error ? err.message : String(err)}`);
+        this.logger.debug?.(`worktree broadcast failed: ${toErrorMessage3(err)}`);
       }
     }
   }
@@ -1835,22 +1832,14 @@ var WorktreeWebSocketHandler = class {
 };
 
 // src/server/mailbox-handlers.ts
-import * as path3 from "path";
-import { GlobalMailbox } from "@wrongstack/core";
-function resolveProjectDir(projectRoot, globalRoot) {
-  const { createHash } = __require("crypto");
-  const hash = createHash("sha256").update(path3.resolve(projectRoot)).digest("hex").slice(0, 6);
-  const slug = path3.basename(projectRoot).toLowerCase().replace(/[^a-z0-9]+/g, "-").slice(0, 40) || "project";
-  return path3.join(globalRoot, "projects", `${slug}-${hash}`);
-}
+import { GlobalMailbox, resolveProjectDir } from "@wrongstack/core";
 async function handleMailboxMessages(ws, deps, payload) {
   try {
     const dir = resolveProjectDir(deps.projectRoot, deps.globalRoot);
     const mb = new GlobalMailbox(dir);
     const messages = await mb.query({
       limit: payload?.limit ?? 30,
-      to: payload?.agentId,
-      unreadBy: payload?.unreadOnly ? payload.agentId : void 0
+      incompleteOnly: payload?.incompleteOnly ?? false
     });
     send(ws, {
       type: "mailbox.messages",
@@ -1867,10 +1856,12 @@ async function handleMailboxMessages(ws, deps, payload) {
           readByCount: Object.keys(m.readBy).length,
           completed: m.completed,
           completedBy: m.completedBy,
+          completedAt: m.completedAt,
           outcome: m.outcome,
           timestamp: m.timestamp,
           replyTo: m.replyTo,
-          senderSessionId: m.senderSessionId
+          senderSessionId: m.senderSessionId,
+          taskContext: m.taskContext
         }))
       }
     });
@@ -1917,6 +1908,16 @@ async function handleMailboxClear(ws, deps) {
     send(ws, { type: "mailbox.cleared", payload: { error: errMessage(err) } });
   }
 }
+async function handleMailboxPurge(ws, deps, opts) {
+  try {
+    const dir = resolveProjectDir(deps.projectRoot, deps.globalRoot);
+    const mb = new GlobalMailbox(dir);
+    const result = await mb.purgeStale(opts);
+    send(ws, { type: "mailbox.purged", payload: result });
+  } catch (err) {
+    send(ws, { type: "mailbox.purged", payload: { error: errMessage(err) } });
+  }
+}
 
 // src/server/lifecycle.ts
 function createShutdown(res) {
@@ -1956,14 +1957,14 @@ function registerShutdownHandlers(res) {
 
 // src/server/instance-registry.ts
 import * as os from "os";
-import * as path4 from "path";
+import * as path3 from "path";
 import * as fs3 from "fs/promises";
 import { atomicWrite as atomicWrite2 } from "@wrongstack/core";
 function defaultBaseDir() {
-  return path4.join(os.homedir(), ".wrongstack");
+  return path3.join(os.homedir(), ".wrongstack");
 }
 function registryPath(baseDir = defaultBaseDir()) {
-  return path4.join(baseDir, "webui-instances.json");
+  return path3.join(baseDir, "webui-instances.json");
 }
 function isPidAlive(pid) {
   if (!Number.isInteger(pid) || pid <= 0) return false;
@@ -2035,16 +2036,16 @@ function formatInstances(instances) {
 // src/server/port-utils.ts
 import * as net from "net";
 function isPortFree(host, port) {
-  return new Promise((resolve6) => {
+  return new Promise((resolve5) => {
     const srv = net.createServer();
-    srv.once("error", () => resolve6(false));
+    srv.once("error", () => resolve5(false));
     srv.once("listening", () => {
-      srv.close(() => resolve6(true));
+      srv.close(() => resolve5(true));
     });
     try {
       srv.listen(port, host);
     } catch {
-      resolve6(false);
+      resolve5(false);
     }
   });
 }
@@ -2119,9 +2120,13 @@ function computeUsageCost(usage, rates) {
   return (usage.input * rates.input + usage.output * rates.output + (usage.cacheRead ?? 0) * rates.cacheRead) / 1e6;
 }
 
+// src/server/provider-handlers.ts
+import { DefaultSecretScrubber as DefaultSecretScrubber2 } from "@wrongstack/core";
+import { probeLocalLlm } from "@wrongstack/runtime/probe";
+
 // src/server/provider-config-io.ts
 import * as fs4 from "fs/promises";
-import * as path5 from "path";
+import * as path4 from "path";
 import { atomicWrite as atomicWrite3 } from "@wrongstack/core";
 import { decryptConfigSecrets, encryptConfigSecrets } from "@wrongstack/core/security";
 import { DefaultSecretVault } from "@wrongstack/core";
@@ -2173,6 +2178,9 @@ async function saveProviders(configPath, vault, providers) {
   await atomicWrite3(configPath, JSON.stringify(encrypted, null, 2), { mode: 384 });
 }
 
+// src/server/provider-handlers.ts
+import { toErrorMessage as toErrorMessage4 } from "@wrongstack/core/utils";
+
 // src/server/provider-keys.ts
 import { expectDefined } from "@wrongstack/core";
 function normalizeKeys(cfg) {
@@ -2270,6 +2278,28 @@ function removeProvider(providers, providerId) {
 }
 
 // src/server/provider-handlers.ts
+function projectSavedProviders(providers) {
+  return Object.entries(providers).map(([id, cfg]) => {
+    const keys = normalizeKeys(cfg);
+    const models = cfg.models;
+    const view = {
+      id,
+      family: cfg.family ?? id,
+      baseUrl: cfg.baseUrl,
+      models,
+      apiKeys: keys.map((k) => ({
+        label: k.label,
+        maskedKey: maskedKey(k.apiKey),
+        isActive: k.label === cfg.activeKey,
+        createdAt: k.createdAt
+      }))
+    };
+    const picked = models && models.length > 0 ? models[0] : void 0;
+    if (picked !== void 0) view.pickedModelId = picked;
+    return view;
+  });
+}
+var probeScrubber = new DefaultSecretScrubber2();
 function createProviderHandlers(deps) {
   const { globalConfigPath, vault, broadcast: broadcast2, clients } = deps;
   let configWriteLock = deps.getConfigWriteLock();
@@ -2278,7 +2308,7 @@ function createProviderHandlers(deps) {
   }
   async function saveConfigProviders(providers) {
     const next = configWriteLock.then(() => saveProviders(globalConfigPath, vault, providers)).catch((err) => {
-      const msg = err instanceof Error ? err.message : String(err);
+      const msg = toErrorMessage4(err);
       console.error(JSON.stringify({
         level: "error",
         event: "webui.provider_save_failed",
@@ -2328,25 +2358,7 @@ function createProviderHandlers(deps) {
       sendResult(ws, result.ok, result.message);
       if (result.ok) {
         console.log(`[WebUI] Provider "${payload.id}" added via provider.add`);
-        broadcast2(clients, {
-          type: "providers.saved",
-          payload: {
-            providers: Object.entries(providers).map(([id, cfg]) => {
-              const keys = normalizeKeys(cfg);
-              return {
-                id,
-                family: cfg.family ?? id,
-                baseUrl: cfg.baseUrl,
-                apiKeys: keys.map((k) => ({
-                  label: k.label,
-                  maskedKey: maskedKey(k.apiKey),
-                  isActive: k.label === cfg.activeKey,
-                  createdAt: k.createdAt
-                }))
-              };
-            })
-          }
-        });
+        broadcastSaved(providers);
       }
     } catch (err) {
       sendResult(ws, false, errMessage(err));
@@ -2362,11 +2374,106 @@ function createProviderHandlers(deps) {
       sendResult(ws, false, errMessage(err));
     }
   }
-  return { handleKeyUpsert, handleKeyDelete, handleKeySetActive, handleProviderAdd, handleProviderRemove, loadConfigProviders };
+  function broadcastSaved(providers) {
+    broadcast2(clients, {
+      type: "providers.saved",
+      payload: { providers: projectSavedProviders(providers) }
+    });
+  }
+  async function handleProviderClearModels(ws, providerId) {
+    try {
+      const providers = await loadConfigProviders();
+      const cfg = providers[providerId];
+      if (!cfg) {
+        sendResult(ws, false, `Unknown provider "${providerId}"`);
+        return;
+      }
+      delete cfg.models;
+      await saveConfigProviders(providers);
+      sendResult(ws, true, `Cleared model allowlist for ${providerId}`);
+      broadcastSaved(providers);
+    } catch (err) {
+      sendResult(ws, false, errMessage(err));
+    }
+  }
+  async function handleProviderUndoClear(ws, providerId, previousModels) {
+    try {
+      const providers = await loadConfigProviders();
+      const cfg = providers[providerId];
+      if (!cfg) {
+        sendResult(ws, false, `Unknown provider "${providerId}"`);
+        return;
+      }
+      cfg.models = [...previousModels];
+      await saveConfigProviders(providers);
+      sendResult(ws, true, `Restored ${previousModels.length} model(s) for ${providerId}`);
+      broadcastSaved(providers);
+    } catch (err) {
+      sendResult(ws, false, errMessage(err));
+    }
+  }
+  async function handleProviderUpdate(ws, payload) {
+    try {
+      const providers = await loadConfigProviders();
+      const cfg = providers[payload.id];
+      if (!cfg) {
+        sendResult(ws, false, `Unknown provider "${payload.id}"`);
+        return;
+      }
+      if (payload.family !== void 0) cfg.family = payload.family;
+      if (payload.baseUrl !== void 0) cfg.baseUrl = payload.baseUrl;
+      if (payload.envVars !== void 0) cfg.envVars = payload.envVars;
+      if (payload.models !== void 0) cfg.models = payload.models;
+      await saveConfigProviders(providers);
+      sendResult(ws, true, `Updated ${payload.id}`);
+      broadcastSaved(providers);
+    } catch (err) {
+      sendResult(ws, false, errMessage(err));
+    }
+  }
+  async function handleProviderProbe(ws, providerId, timeoutMs) {
+    const reply = (payload) => send(ws, { type: "provider.probe", payload: { providerId, ...payload } });
+    try {
+      const providers = await loadConfigProviders();
+      const cfg = providers[providerId];
+      if (!cfg) {
+        reply({ ok: false, status: "no_provider" });
+        return;
+      }
+      if (!cfg.baseUrl) {
+        reply({ ok: false, status: "no_base_url" });
+        return;
+      }
+      const keys = normalizeKeys(cfg);
+      const active = keys.find((k) => k.label === cfg.activeKey) ?? keys[0];
+      const result = await probeLocalLlm({
+        baseUrl: cfg.baseUrl,
+        apiKey: active?.apiKey,
+        noAuth: false,
+        scrubber: probeScrubber,
+        ...timeoutMs !== void 0 ? { timeoutMs } : {}
+      });
+      reply(result);
+    } catch (err) {
+      reply({ ok: false, status: "unreachable", detail: errMessage(err) });
+    }
+  }
+  return {
+    handleKeyUpsert,
+    handleKeyDelete,
+    handleKeySetActive,
+    handleProviderAdd,
+    handleProviderRemove,
+    handleProviderClearModels,
+    handleProviderUndoClear,
+    handleProviderUpdate,
+    handleProviderProbe,
+    loadConfigProviders
+  };
 }
 
 // src/server/setup-events.ts
-import * as path6 from "path";
+import * as path5 from "path";
 function setupEvents(deps) {
   const { events, broadcast: broadcast2, clients, config, context, pendingConfirms, globalConfigPath, sessionBridge } = deps;
   events.on("iteration.started", (e) => {
@@ -2565,7 +2672,7 @@ function setupEvents(deps) {
   events.onPattern("brain.*", (eventName, payload) => {
     broadcast2(clients, { type: "brain.event", payload: { event: eventName, ...payload } });
   });
-  const globalRoot = globalConfigPath ? path6.dirname(globalConfigPath) : void 0;
+  const globalRoot = globalConfigPath ? path5.dirname(globalConfigPath) : void 0;
   if (globalRoot) {
     const statusInterval = setInterval(async () => {
       try {
@@ -2604,10 +2711,10 @@ function setupEvents(deps) {
 // src/server/custom-context-modes.ts
 import { listContextWindowModes, atomicWrite as atomicWrite4 } from "@wrongstack/core";
 import * as fs5 from "fs/promises";
-import * as path7 from "path";
+import * as path6 from "path";
 var STORE_FILENAME = "custom-context-modes.json";
 function storePath(wrongstackDir) {
-  return path7.join(wrongstackDir, STORE_FILENAME);
+  return path6.join(wrongstackDir, STORE_FILENAME);
 }
 var BUILTIN_IDS = /* @__PURE__ */ new Set(["balanced", "frugal", "deep", "archival"]);
 function createCustomModeStore(wrongstackDir) {
@@ -2796,12 +2903,12 @@ function createEternalSubscription(subscribe, broadcast2, clientsRef) {
 
 // src/server/shell-open.ts
 import * as fs6 from "fs/promises";
-import * as path8 from "path";
+import * as path7 from "path";
 import { spawn as spawn2 } from "child_process";
 var METACHAR_REGEX = /[&|<>^"'`\n\r]/;
 async function handleShellOpen(req, logger) {
   try {
-    const resolved = path8.resolve(req.path);
+    const resolved = path7.resolve(req.path);
     await fs6.access(resolved);
     if (METACHAR_REGEX.test(resolved)) {
       return { success: false, message: "Path contains unsupported characters." };
@@ -2913,7 +3020,7 @@ async function startWebUI(opts = {}) {
     console.warn(JSON.stringify({
       level: "warn",
       event: "webui.provider_registry_load_failed",
-      message: err instanceof Error ? err.message : String(err),
+      message: toErrorMessage5(err),
       timestamp: (/* @__PURE__ */ new Date()).toISOString()
     }));
   }
@@ -2942,7 +3049,7 @@ async function startWebUI(opts = {}) {
     }).catch(() => void 0);
   }
   const sessionReader = new DefaultSessionReader({ store: sessionStore });
-  const annotationsStore = new AnnotationsStore({ dir: wpaths.projectSessions });
+  const annotationsStore = new AnnotationsStore({ dir: wpaths.projectSessions, events });
   let session = await sessionStore.create({
     id: "",
     title: "",
@@ -2962,7 +3069,7 @@ async function startWebUI(opts = {}) {
       sessionId: session.id,
       projectSlug: wpaths.projectSlug,
       projectRoot,
-      projectName: path9.basename(projectRoot),
+      projectName: path8.basename(projectRoot),
       workingDir,
       pid: process.pid,
       startedAt: (/* @__PURE__ */ new Date()).toISOString()
@@ -3050,7 +3157,7 @@ async function startWebUI(opts = {}) {
       console.error(JSON.stringify({
         level: "error",
         event: "webui.provider_create_failed",
-        message: err instanceof Error ? err.message : String(err),
+        message: toErrorMessage5(err),
         timestamp: (/* @__PURE__ */ new Date()).toISOString()
       }));
       throw err;
@@ -3072,7 +3179,7 @@ async function startWebUI(opts = {}) {
         console.error(JSON.stringify({
           level: "error",
           event: "webui.provider_stub_create_failed",
-          message: err instanceof Error ? err.message : String(err),
+          message: toErrorMessage5(err),
           timestamp: (/* @__PURE__ */ new Date()).toISOString()
         }));
         throw err;
@@ -3121,6 +3228,12 @@ async function startWebUI(opts = {}) {
     context.meta["logLevel"] = config.log?.level ?? "info";
     context.meta["auditLevel"] = config.session?.auditLevel ?? "standard";
     context.meta["maxIterations"] = config.tools?.maxIterations ?? 500;
+    const tgExt = config.extensions?.["telegram"];
+    context.meta["tgConfigured"] = typeof tgExt?.["botToken"] === "string" && tgExt["botToken"].length > 0;
+    context.meta["tgSessionEnd"] = tgExt?.["notifyOnSessionEnd"] === true;
+    context.meta["tgDelegate"] = tgExt?.["notifyOnDelegate"] !== false;
+    const tgMs = tgExt?.["longToolThresholdMs"];
+    context.meta["tgLongToolMs"] = typeof tgMs === "number" ? tgMs : 3e4;
   }
   const PREF_KEYS = [
     "autonomy",
@@ -3144,7 +3257,11 @@ async function startWebUI(opts = {}) {
     "contextAutoCompact",
     "contextStrategy",
     "logLevel",
-    "auditLevel"
+    "auditLevel",
+    "tgConfigured",
+    "tgSessionEnd",
+    "tgDelegate",
+    "tgLongToolMs"
   ];
   const prefSnapshot = () => {
     const snapshot = {};
@@ -3229,6 +3346,22 @@ async function startWebUI(opts = {}) {
         toolsCfg.maxIterations = payload["maxIterations"];
         decrypted.tools = toolsCfg;
       }
+      const tgTouched = typeof payload["tgSessionEnd"] === "boolean" || typeof payload["tgDelegate"] === "boolean" || typeof payload["tgLongToolMs"] === "number";
+      if (tgTouched) {
+        const ext = decrypted.extensions ?? {};
+        const tg = ext["telegram"] ?? {};
+        if (typeof payload["tgSessionEnd"] === "boolean") {
+          tg["notifyOnSessionEnd"] = payload["tgSessionEnd"];
+        }
+        if (typeof payload["tgDelegate"] === "boolean") {
+          tg["notifyOnDelegate"] = payload["tgDelegate"];
+        }
+        if (typeof payload["tgLongToolMs"] === "number") {
+          tg["longToolThresholdMs"] = payload["tgLongToolMs"];
+        }
+        ext["telegram"] = tg;
+        decrypted.extensions = ext;
+      }
       const encrypted = encryptConfigSecrets2(decrypted, vault);
       await atomicWrite5(globalConfigPath, JSON.stringify(encrypted, null, 2), { mode: 384 });
     };
@@ -3450,7 +3583,7 @@ async function startWebUI(opts = {}) {
       inputCost,
       outputCost,
       cacheReadCost,
-      projectName: path9.basename(projectRoot) || projectRoot,
+      projectName: path8.basename(projectRoot) || projectRoot,
       projectRoot,
       cwd: workingDir,
       mode: modeId,
@@ -3531,7 +3664,7 @@ async function startWebUI(opts = {}) {
       console.warn(JSON.stringify({
         level: "warn",
         event: "webui.session_start_payload_failed",
-        message: err instanceof Error ? err.message : String(err),
+        message: toErrorMessage5(err),
         timestamp: (/* @__PURE__ */ new Date()).toISOString()
       }));
     });
@@ -3568,7 +3701,7 @@ async function startWebUI(opts = {}) {
         console.error(JSON.stringify({
           level: "error",
           event: "webui.ws_message_parse_failed",
-          message: err instanceof Error ? err.message : String(err),
+          message: toErrorMessage5(err),
           timestamp: (/* @__PURE__ */ new Date()).toISOString()
         }));
       }
@@ -3577,8 +3710,8 @@ async function startWebUI(opts = {}) {
       clients.delete(ws);
       rateLimits.delete(String(ws));
       if (pendingConfirms.size > 0) {
-        for (const [id, resolve6] of pendingConfirms) {
-          resolve6("no");
+        for (const [id, resolve5] of pendingConfirms) {
+          resolve5("no");
           pendingConfirms.delete(id);
         }
       }
@@ -3614,7 +3747,7 @@ async function startWebUI(opts = {}) {
       level: "error",
       event: "webui.ws_server_error",
       host: wsHost,
-      message: err instanceof Error ? err.message : String(err),
+      message: toErrorMessage5(err),
       timestamp: (/* @__PURE__ */ new Date()).toISOString()
     }));
   });
@@ -3642,29 +3775,29 @@ async function startWebUI(opts = {}) {
     });
   }
   async function touchProjectEntry(root, workDir) {
-    const resolved = path9.resolve(root);
+    const resolved = path8.resolve(root);
     const manifest = await loadManifest(globalConfigPath);
     const now = (/* @__PURE__ */ new Date()).toISOString();
-    const existing = manifest.projects.find((p) => path9.resolve(p.root) === resolved);
+    const existing = manifest.projects.find((p) => path8.resolve(p.root) === resolved);
     if (existing) {
       existing.lastSeen = now;
-      if (workDir) existing.lastWorkingDir = path9.resolve(workDir);
+      if (workDir) existing.lastWorkingDir = path8.resolve(workDir);
     } else {
       manifest.projects.push({
-        name: path9.basename(resolved),
+        name: path8.basename(resolved),
         root: resolved,
         slug: generateProjectSlug(resolved),
         createdAt: now,
         lastSeen: now,
-        lastWorkingDir: workDir ? path9.resolve(workDir) : void 0
+        lastWorkingDir: workDir ? path8.resolve(workDir) : void 0
       });
     }
     await saveManifest(manifest, globalConfigPath);
     await ensureProjectDataDir(generateProjectSlug(resolved), globalConfigPath);
   }
   function projectsJsonPath(globalConfigPath2) {
-    const base = path9.dirname(globalConfigPath2);
-    return path9.join(base, "projects.json");
+    const base = path8.dirname(globalConfigPath2);
+    return path8.join(base, "projects.json");
   }
   async function loadManifest(globalConfigPath2) {
     try {
@@ -3677,15 +3810,15 @@ async function startWebUI(opts = {}) {
   }
   async function saveManifest(manifest, globalConfigPath2) {
     const file = projectsJsonPath(globalConfigPath2);
-    await fs7.mkdir(path9.dirname(file), { recursive: true });
+    await fs7.mkdir(path8.dirname(file), { recursive: true });
     await fs7.writeFile(file, JSON.stringify(manifest, null, 2), "utf8");
   }
   function generateProjectSlug(rootPath) {
     return projectSlug(rootPath);
   }
   async function ensureProjectDataDir(slug, globalConfigPath2) {
-    const base = path9.dirname(globalConfigPath2);
-    const dir = path9.join(base, "projects", slug);
+    const base = path8.dirname(globalConfigPath2);
+    const dir = path8.join(base, "projects", slug);
     await fs7.mkdir(dir, { recursive: true });
     return dir;
   }
@@ -3697,7 +3830,9 @@ async function startWebUI(opts = {}) {
       case "collab.join":
       case "collab.leave":
       case "collab.annotate":
-      case "collab.resolve": {
+      case "collab.resolve":
+      case "collab.request_pause":
+      case "collab.resume": {
         collabHandler.handleMessage(ws, msg);
         return;
       }
@@ -3748,10 +3883,10 @@ async function startWebUI(opts = {}) {
       }
       case "tool.confirm_result": {
         const { id, decision } = msg.payload;
-        const resolve6 = pendingConfirms.get(id);
-        if (resolve6) {
+        const resolve5 = pendingConfirms.get(id);
+        if (resolve5) {
           pendingConfirms.delete(id);
-          resolve6(decision);
+          resolve5(decision);
         }
         break;
       }
@@ -4036,7 +4171,7 @@ async function startWebUI(opts = {}) {
             console.warn(JSON.stringify({
               level: "warn",
               event: "webui.config_save_failed",
-              message: err instanceof Error ? err.message : String(err),
+              message: toErrorMessage5(err),
               timestamp: (/* @__PURE__ */ new Date()).toISOString()
             }));
           }
@@ -4134,6 +4269,26 @@ async function startWebUI(opts = {}) {
         await providerHandlers.handleProviderRemove(ws, providerId);
         break;
       }
+      case "provider.clear_models": {
+        const { providerId } = msg.payload;
+        await providerHandlers.handleProviderClearModels(ws, providerId);
+        break;
+      }
+      case "provider.undo_clear": {
+        const { providerId, previousModels } = msg.payload;
+        await providerHandlers.handleProviderUndoClear(ws, providerId, previousModels);
+        break;
+      }
+      case "provider.update": {
+        const p = msg.payload;
+        await providerHandlers.handleProviderUpdate(ws, p);
+        break;
+      }
+      case "provider.probe": {
+        const { providerId, timeoutMs } = msg.payload;
+        await providerHandlers.handleProviderProbe(ws, providerId, timeoutMs);
+        break;
+      }
       case "sessions.list": {
         const limit = msg.payload?.limit ?? 50;
         try {
@@ -4422,6 +4577,75 @@ async function startWebUI(opts = {}) {
         }
         break;
       }
+      case "todo.update": {
+        const payload = msg.payload;
+        const idx = context.todos.findIndex((t) => t.id === payload.id);
+        if (idx === -1) {
+          sendResult(ws, false, "Todo not found");
+          break;
+        }
+        const next = [...context.todos];
+        const existing = expectDefined2(next[idx]);
+        next[idx] = {
+          ...existing,
+          status: payload.status ?? existing.status,
+          activeForm: payload.activeForm !== void 0 ? payload.activeForm : existing.activeForm
+        };
+        context.state.replaceTodos(next);
+        sendResult(ws, true, `Todo "${existing.content}" updated`);
+        broadcast(clients, { type: "todos.updated", payload: { todos: next } });
+        break;
+      }
+      case "task.update": {
+        const payload = msg.payload;
+        const taskPath = context.meta["task.path"];
+        if (typeof taskPath !== "string" || !taskPath) {
+          sendResult(ws, false, "Task storage not configured.");
+          break;
+        }
+        try {
+          const { mutateTasks } = await import("@wrongstack/core");
+          const file = await mutateTasks(taskPath, session.id, async (f) => {
+            const task = f.tasks.find((t) => t.id === payload.id);
+            if (!task) return f;
+            task.status = payload.status;
+            task.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+            return f;
+          });
+          sendResult(ws, true, `Task status updated to "${payload.status}".`);
+          broadcast(clients, { type: "tasks.updated", payload: { tasks: file.tasks } });
+        } catch (err) {
+          sendResult(ws, false, errMessage(err));
+        }
+        break;
+      }
+      case "plan.item.update": {
+        const payload = msg.payload;
+        const planPath = context.meta["plan.path"];
+        if (typeof planPath !== "string" || !planPath) {
+          sendResult(ws, false, "Plan storage is not configured for this session.");
+          break;
+        }
+        try {
+          const { mutatePlan, setPlanItemStatus } = await import("@wrongstack/core");
+          let changed = false;
+          const plan = await mutatePlan(planPath, session.id, async (p) => {
+            const before = p.updatedAt;
+            const updated = setPlanItemStatus(p, payload.target, payload.status);
+            changed = updated.updatedAt !== before;
+            return updated;
+          });
+          if (!changed) {
+            sendResult(ws, false, `No plan item matched "${payload.target}".`);
+            break;
+          }
+          sendResult(ws, true, `Plan item status updated to "${payload.status}".`);
+          broadcast(clients, { type: "plan.updated", payload: { plan } });
+        } catch (err) {
+          sendResult(ws, false, errMessage(err));
+        }
+        break;
+      }
       // ── File operations — delegated to shared handlers (file-handlers.ts) ──
       // These handlers are also used by the CLI's webui-server.ts. When
       // adding or modifying file-operation WebSocket messages, update
@@ -4569,9 +4793,40 @@ async function startWebUI(opts = {}) {
         }
         break;
       }
+      case "git.info": {
+        const cwd = projectRoot;
+        const execFile = (cmd, args) => new Promise((resolve5) => {
+          import("child_process").then(({ execFile: ef }) => {
+            ef(cmd, args, { cwd, timeout: 3e3 }, (err, stdout) => {
+              resolve5(err ? "" : stdout.trim());
+            });
+          });
+        });
+        const [branchRaw, diffRaw, statusRaw, upstreamRaw] = await Promise.all([
+          execFile("git", ["branch", "--show-current"]),
+          execFile("git", ["diff", "--stat"]),
+          execFile("git", ["status", "--porcelain"]),
+          execFile("git", ["rev-list", "--left-right", "--count", "@{upstream}...HEAD"])
+        ]);
+        const branch = branchRaw || "(detached)";
+        const diffMatch = /\+\s*(\d+)\s*deletion/i.exec(diffRaw);
+        const addMatch = /(\d+)\s*insertion/i.exec(diffRaw) ?? /(\d+)\s*addition/i.exec(diffRaw);
+        const delMatch = /\+\s*(\d+)\s*deletion/i.exec(diffRaw);
+        const added = addMatch ? Number(addMatch[1]) : 0;
+        const deleted = delMatch ? Number(delMatch[1]) : 0;
+        const untracked = statusRaw.split("\n").filter((l) => l.startsWith("??")).length;
+        const [aheadRaw, behindRaw] = (upstreamRaw || "0	0").split("	");
+        const ahead = Number(aheadRaw) || 0;
+        const behind = Number(behindRaw) || 0;
+        send(ws, {
+          type: "git.info",
+          payload: { branch, added, deleted, untracked, ahead, behind }
+        });
+        break;
+      }
       case "goal.get": {
         try {
-          const goalPath = path9.join(projectRoot, ".wrongstack", "goal.json");
+          const goalPath = path8.join(projectRoot, ".wrongstack", "goal.json");
           const raw = await fs7.readFile(goalPath, "utf8");
           const goal = JSON.parse(raw);
           broadcast(clients, { type: "goal.updated", payload: goal });
@@ -4632,7 +4887,7 @@ async function startWebUI(opts = {}) {
         try {
           const { DefaultSessionRewinder } = await import("@wrongstack/core");
           const rewinder = new DefaultSessionRewinder(
-            path9.join(projectRoot, ".wrongstack", "sessions"),
+            path8.join(projectRoot, ".wrongstack", "sessions"),
             projectRoot
           );
           const checkpoints = await rewinder.listCheckpoints(session.id);
@@ -4653,7 +4908,7 @@ async function startWebUI(opts = {}) {
         try {
           const { DefaultSessionRewinder } = await import("@wrongstack/core");
           const rewinder = new DefaultSessionRewinder(
-            path9.join(projectRoot, ".wrongstack", "sessions"),
+            path8.join(projectRoot, ".wrongstack", "sessions"),
             projectRoot
           );
           await rewinder.rewindToCheckpoint(session.id, checkpointIndex);
@@ -4687,7 +4942,7 @@ async function startWebUI(opts = {}) {
       case "projects.add": {
         const { root: addRoot, name: displayName } = msg.payload;
         try {
-          const resolved = path9.resolve(addRoot);
+          const resolved = path8.resolve(addRoot);
           await fs7.access(resolved);
           const stat2 = await fs7.stat(resolved);
           if (!stat2.isDirectory()) throw new Error(`Not a directory: ${resolved}`);
@@ -4705,7 +4960,7 @@ async function startWebUI(opts = {}) {
             });
             break;
           }
-          const name = displayName?.trim() || path9.basename(resolved);
+          const name = displayName?.trim() || path8.basename(resolved);
           const slug = generateProjectSlug(resolved);
           await ensureProjectDataDir(slug, globalConfigPath);
           const now = (/* @__PURE__ */ new Date()).toISOString();
@@ -4724,7 +4979,7 @@ async function startWebUI(opts = {}) {
           send(ws, {
             type: "projects.added",
             payload: {
-              name: path9.basename(addRoot),
+              name: path8.basename(addRoot),
               root: addRoot,
               slug: "",
               message: errMessage(err)
@@ -4736,7 +4991,7 @@ async function startWebUI(opts = {}) {
       case "projects.select": {
         const { root: selRoot, name: selName } = msg.payload;
         try {
-          const resolved = path9.resolve(selRoot);
+          const resolved = path8.resolve(selRoot);
           try {
             await fs7.access(resolved);
             const stat2 = await fs7.stat(resolved);
@@ -4746,7 +5001,7 @@ async function startWebUI(opts = {}) {
               type: "projects.selected",
               payload: {
                 root: selRoot,
-                name: selName || path9.basename(selRoot),
+                name: selName || path8.basename(selRoot),
                 message: `Cannot switch: ${errMessage(err)}`
               }
             });
@@ -4758,7 +5013,7 @@ async function startWebUI(opts = {}) {
             entry.lastSeen = (/* @__PURE__ */ new Date()).toISOString();
             entry.lastWorkingDir = resolved;
           } else {
-            const name = selName?.trim() || path9.basename(resolved);
+            const name = selName?.trim() || path8.basename(resolved);
             const slug = generateProjectSlug(resolved);
             manifest.projects.push({
               name,
@@ -4799,8 +5054,8 @@ async function startWebUI(opts = {}) {
             });
           } catch {
           }
-          const newSessionsDir = path9.join(
-            path9.dirname(globalConfigPath),
+          const newSessionsDir = path8.join(
+            path8.dirname(globalConfigPath),
             "projects",
             switchSlug,
             "sessions"
@@ -4837,7 +5092,7 @@ async function startWebUI(opts = {}) {
               sessionId: session.id,
               projectSlug: switchSlug,
               projectRoot,
-              projectName: path9.basename(projectRoot),
+              projectName: path8.basename(projectRoot),
               workingDir,
               pid: process.pid,
               startedAt: (/* @__PURE__ */ new Date()).toISOString()
@@ -4848,8 +5103,8 @@ async function startWebUI(opts = {}) {
             type: "projects.selected",
             payload: {
               root: resolved,
-              name: selName || path9.basename(resolved),
-              message: `Switched to ${selName || path9.basename(resolved)}`
+              name: selName || path8.basename(resolved),
+              message: `Switched to ${selName || path8.basename(resolved)}`
             }
           });
           broadcast(clients, {
@@ -4872,7 +5127,7 @@ async function startWebUI(opts = {}) {
             type: "projects.selected",
             payload: {
               root: selRoot,
-              name: selName || path9.basename(selRoot),
+              name: selName || path8.basename(selRoot),
               message: errMessage(err)
             }
           });
@@ -4883,8 +5138,8 @@ async function startWebUI(opts = {}) {
       case "working_dir.set": {
         const { path: newPath } = msg.payload;
         try {
-          const resolved = path9.resolve(projectRoot, newPath);
-          if (!resolved.startsWith(projectRoot + path9.sep) && resolved !== projectRoot) {
+          const resolved = path8.resolve(projectRoot, newPath);
+          if (!resolved.startsWith(projectRoot + path8.sep) && resolved !== projectRoot) {
             sendResult(ws, false, `Path must stay inside the project root: ${projectRoot}`);
             break;
           }
@@ -4921,19 +5176,25 @@ async function startWebUI(opts = {}) {
       case "mailbox.messages":
         return handleMailboxMessages(
           ws,
-          { projectRoot, globalRoot: path9.dirname(globalConfigPath) },
+          { projectRoot, globalRoot: path8.dirname(globalConfigPath) },
           msg.payload
         );
       case "mailbox.agents":
         return handleMailboxAgents(
           ws,
-          { projectRoot, globalRoot: path9.dirname(globalConfigPath) },
+          { projectRoot, globalRoot: path8.dirname(globalConfigPath) },
           msg.payload
         );
       case "mailbox.clear":
         return handleMailboxClear(
           ws,
-          { projectRoot, globalRoot: path9.dirname(globalConfigPath) }
+          { projectRoot, globalRoot: path8.dirname(globalConfigPath) }
+        );
+      case "mailbox.purge":
+        return handleMailboxPurge(
+          ws,
+          { projectRoot, globalRoot: path8.dirname(globalConfigPath) },
+          msg.payload
         );
       // ── Brain — status, autonomy ceiling, direct decision support ───
       case "brain.status":
@@ -5001,12 +5262,12 @@ async function startWebUI(opts = {}) {
   });
   const httpServer = createHttpServer({
     host: wsHost,
-    distDir: path9.resolve(import.meta.dirname, "../../dist"),
+    distDir: path8.resolve(import.meta.dirname, "../../dist"),
     wsPort,
     globalRoot: wpaths.globalRoot,
     apiToken: wsToken
   });
-  const registryBaseDir = path9.dirname(globalConfigPath);
+  const registryBaseDir = path8.dirname(globalConfigPath);
   httpServer.listen(httpPort, wsHost, () => {
     const openUrl = `http://${wsHost}:${httpPort}`;
     console.log(`[WebUI] HTTP server running on ${openUrl}`);
@@ -5018,7 +5279,7 @@ async function startWebUI(opts = {}) {
         wsPort,
         host: wsHost,
         projectRoot,
-        projectName: path9.basename(projectRoot) || projectRoot,
+        projectName: path8.basename(projectRoot) || projectRoot,
         startedAt: (/* @__PURE__ */ new Date()).toISOString(),
         url: `http://${wsHost}:${httpPort}`
       },