@wrongstack/webui 0.260.0 → 0.265.1

package/dist/server/index.js

@@ -1,13 +1,179 @@
-var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
-  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
-}) : x)(function(x) {
-  if (typeof require !== "undefined") return require.apply(this, arguments);
-  throw Error('Dynamic require of "' + x + '" is not supported');
-});
+// src/server/index.ts
+import { expectDefined as expectDefined2, GlobalMailbox as GlobalMailbox2, projectSlug, getSessionRegistry, AgentStatusTracker, FleetNotifier } from "@wrongstack/core";
+
+// src/server/handlers/worklist-handlers.ts
+function sendResult(ws, ctx, ok, message) {
+  ctx.send(ws, { type: ok ? "ok" : "error", message });
+}
+function handleTodosGet(ctx, ws) {
+  ctx.send(ws, { type: "todos.updated", payload: { todos: ctx.context.todos } });
+}
+function handleTodosClear(ctx, ws) {
+  ctx.replaceTodos?.([]);
+  ctx.broadcast({ type: "todos.cleared" });
+  sendResult(ws, ctx, true, "Todo board cleared.");
+}
+function handleTodosRemove(ctx, ws, payload) {
+  if (!payload || payload.id === void 0 && payload.index === void 0) {
+    sendResult(ws, ctx, false, "todos.remove requires id or index.");
+    return;
+  }
+  const next = payload.id !== void 0 ? ctx.context.todos.filter((t) => t.id !== payload.id) : ctx.context.todos.filter((_, i) => i !== payload.index);
+  ctx.replaceTodos?.(next);
+  ctx.broadcast({ type: "todos.updated", payload: { todos: next } });
+  sendResult(ws, ctx, true, "Todo item removed.");
+}
+function handleTodoUpdate(ctx, ws, payload) {
+  const todo = ctx.context.todos.find((t) => t.id === payload.id);
+  if (!todo) {
+    sendResult(ws, ctx, false, `No todo with id "${payload.id}".`);
+    return;
+  }
+  const next = ctx.context.todos.map(
+    (t) => t.id === payload.id ? { ...t, ...payload.status !== void 0 && { status: payload.status }, ...payload.activeForm !== void 0 && { activeForm: payload.activeForm } } : t
+  );
+  ctx.replaceTodos?.(next);
+  ctx.broadcast({ type: "todos.updated", payload: { todos: next } });
+  sendResult(ws, ctx, true, `Todo "${todo.content}" updated.`);
+}
+async function handleTasksGet(ctx, ws) {
+  const taskPath = ctx.context.meta["task.path"];
+  if (typeof taskPath === "string" && taskPath) {
+    try {
+      const { loadTasks } = await import("@wrongstack/core");
+      const file = await loadTasks(taskPath);
+      ctx.send(ws, { type: "tasks.updated", payload: { tasks: file?.tasks ?? [] } });
+    } catch {
+      ctx.send(ws, { type: "tasks.updated", payload: { tasks: [] } });
+    }
+  } else {
+    ctx.send(ws, {
+      type: "tasks.updated",
+      payload: { tasks: [], error: "Task storage not configured." }
+    });
+  }
+}
+async function handleTaskUpdate(ctx, ws, payload) {
+  const taskPath = ctx.context.meta["task.path"];
+  if (typeof taskPath !== "string" || !taskPath) {
+    sendResult(ws, ctx, false, "Task storage is not configured for this session.");
+    return;
+  }
+  try {
+    const { loadTasks, saveTasks } = await import("@wrongstack/core");
+    const file = await loadTasks(taskPath);
+    if (!file) {
+      sendResult(ws, ctx, false, "No task file found.");
+      return;
+    }
+    const idx = file.tasks.findIndex((t) => t.id === payload.id);
+    if (idx === -1) {
+      sendResult(ws, ctx, false, `Task "${payload.id}" not found.`);
+      return;
+    }
+    file.tasks[idx] = { ...file.tasks[idx], status: payload.status };
+    await saveTasks(taskPath, file);
+    ctx.broadcast({ type: "tasks.updated", payload: { tasks: file.tasks } });
+    sendResult(ws, ctx, true, `Task "${payload.id}" marked ${payload.status}.`);
+  } catch (err) {
+    sendResult(ws, ctx, false, String(err));
+  }
+}
+async function handlePlanGet(ctx, ws) {
+  const planPath = ctx.context.meta["plan.path"];
+  const sessionId = ctx.context.session?.id ?? "";
+  if (typeof planPath === "string" && planPath) {
+    try {
+      const { loadPlan } = await import("@wrongstack/core");
+      const plan = await loadPlan(planPath);
+      ctx.send(ws, {
+        type: "plan.updated",
+        payload: {
+          plan: plan ?? {
+            version: 1,
+            sessionId,
+            updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+            items: []
+          }
+        }
+      });
+    } catch {
+      ctx.send(ws, {
+        type: "plan.updated",
+        payload: {
+          plan: {
+            version: 1,
+            sessionId,
+            updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+            items: []
+          }
+        }
+      });
+    }
+  } else {
+    ctx.send(ws, {
+      type: "plan.updated",
+      payload: { plan: null, error: "Plan storage is not configured for this session." }
+    });
+  }
+}
+async function handlePlanTemplateUse(ctx, ws, template) {
+  const planPath = ctx.context.meta["plan.path"];
+  const sessionId = ctx.context.session?.id ?? "";
+  if (typeof planPath !== "string" || !planPath) {
+    sendResult(ws, ctx, false, "Plan storage is not configured for this session.");
+    return;
+  }
+  try {
+    const { getPlanTemplate, loadPlan, savePlan, emptyPlan, addPlanItem } = await import("@wrongstack/core");
+    const tpl = getPlanTemplate(template);
+    if (!tpl) {
+      sendResult(ws, ctx, false, `Unknown template "${template}".`);
+      return;
+    }
+    let plan = await loadPlan(planPath) ?? emptyPlan(sessionId);
+    for (const item of tpl.items) {
+      ({ plan } = addPlanItem(plan, item.title, item.details));
+    }
+    await savePlan(planPath, plan);
+    sendResult(ws, ctx, true, `Applied template "${tpl.name}" \u2014 ${tpl.items.length} items added.`);
+    ctx.broadcast({ type: "plan.updated", payload: { plan } });
+  } catch (err) {
+    sendResult(ws, ctx, false, String(err));
+  }
+}
+async function handlePlanItemUpdate(ctx, ws, payload) {
+  const planPath = ctx.context.meta["plan.path"];
+  const sessionId = ctx.context.session?.id ?? "";
+  if (typeof planPath !== "string" || !planPath) {
+    sendResult(ws, ctx, false, "Plan storage is not configured for this session.");
+    return;
+  }
+  try {
+    const { loadPlan, savePlan, mutatePlan, setPlanItemStatus } = await import("@wrongstack/core");
+    let changed = false;
+    const plan = await mutatePlan(planPath, sessionId, async (p) => {
+      const before = p.updatedAt;
+      const updated = setPlanItemStatus(p, payload.target, payload.status);
+      changed = updated.updatedAt !== before;
+      return updated;
+    });
+    if (!changed) {
+      sendResult(ws, ctx, false, `No plan item matched "${payload.target}".`);
+      return;
+    }
+    sendResult(ws, ctx, true, `Plan item status updated to "${payload.status}".`);
+    ctx.broadcast({ type: "plan.updated", payload: { plan } });
+  } catch (err) {
+    sendResult(ws, ctx, false, String(err));
+  }
+}
 
 // src/server/index.ts
-import { expectDefined as expectDefined2, GlobalMailbox as GlobalMailbox2, projectSlug, getSessionRegistry, AgentStatusTracker } from "@wrongstack/core";
 import { makeMailboxTool, makeMailSendTool, makeMailInboxTool, mailboxSessionTag } from "@wrongstack/core";
+import { toErrorMessage as toErrorMessage5, wstackGlobalRoot as wstackGlobalRoot2, projectHash, resolveWstackPaths } from "@wrongstack/core/utils";
+import { SkillInstaller } from "@wrongstack/core/skills";
+import JSZip2 from "jszip";
 import {
   BrainMonitor,
   DefaultBrainArbiter,
@@ -15,8 +181,8 @@ import {
   createAutonomyBrain,
   createTieredBrainArbiter
 } from "@wrongstack/core";
-import * as fs7 from "fs/promises";
-import * as path9 from "path";
+import * as fs10 from "fs/promises";
+import * as path10 from "path";
 
 // src/server/http-server.ts
 import * as fs from "fs/promises";
@@ -24,7 +190,7 @@ import * as http from "http";
 import * as path from "path";
 
 // src/server/ws-auth.ts
-import { Buffer as Buffer2 } from "buffer";
+import { Buffer } from "buffer";
 import { timingSafeEqual } from "crypto";
 function isLoopbackHostname(hostname) {
   return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1" || hostname === "[::1]";
@@ -43,8 +209,8 @@ function isLoopbackBind(wsHost) {
 }
 function tokenMatches(provided, expected) {
   if (!provided) return false;
-  const a = Buffer2.from(provided);
-  const b = Buffer2.from(expected);
+  const a = Buffer.from(provided);
+  const b = Buffer.from(expected);
   if (a.length !== b.length) return false;
   return timingSafeEqual(a, b);
 }
@@ -135,6 +301,13 @@ function isInsideDist(candidate, distDir) {
   const resolved = path.resolve(candidate);
   return resolved === root || resolved.startsWith(root + path.sep);
 }
+function decodeSessionId(segment) {
+  try {
+    return decodeURIComponent(segment);
+  } catch {
+    return segment;
+  }
+}
 function createHttpServer(opts) {
   const port = opts.port ?? Number.parseInt(process.env["PORT"] ?? "3456", 10);
   const distDir = path.resolve(opts.distDir);
@@ -160,6 +333,22 @@ function createHttpServer(opts) {
         res.end("ok");
         return;
       }
+      if (url.pathname === "/api/fleet/ping" && req.method === "POST") {
+        const headerToken = req.headers["x-ws-token"];
+        const provided = Array.isArray(headerToken) ? headerToken[0] : headerToken;
+        if (requireApiToken && !tokenMatches(provided, opts.apiToken ?? "")) {
+          res.writeHead(401, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ error: "Unauthorized" }));
+          return;
+        }
+        try {
+          opts.onFleetPing?.();
+        } catch {
+        }
+        res.writeHead(204);
+        res.end();
+        return;
+      }
       if (url.pathname === "/api/sessions" && req.method === "GET") {
         const headerToken = req.headers["x-ws-token"];
         const provided = Array.isArray(headerToken) ? headerToken[0] : headerToken;
@@ -180,7 +369,89 @@ function createHttpServer(opts) {
           res.end(JSON.stringify({ error: "Unauthorized" }));
           return;
         }
-        await handleApiSessionAgents(res, opts.globalRoot, agentsMatch[1]);
+        await handleApiSessionAgents(res, opts.globalRoot, decodeSessionId(agentsMatch[1]));
+        return;
+      }
+      const eventsMatch = url.pathname.match(/^\/api\/sessions\/([^/]+)\/events$/);
+      if (eventsMatch && req.method === "GET") {
+        const headerToken = req.headers["x-ws-token"];
+        const provided = Array.isArray(headerToken) ? headerToken[0] : headerToken;
+        if (requireApiToken && !tokenMatches(provided, opts.apiToken ?? "")) {
+          res.writeHead(401, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ error: "Unauthorized" }));
+          return;
+        }
+        const rawLimit = Number.parseInt(url.searchParams.get("limit") ?? "200", 10);
+        const limit = Math.min(500, Math.max(1, Number.isFinite(rawLimit) ? rawLimit : 200));
+        await handleApiSessionEvents(res, opts.globalRoot, decodeSessionId(eventsMatch[1]), limit);
+        return;
+      }
+      const msgMatch = url.pathname.match(/^\/api\/sessions\/([^/]+)\/message$/);
+      if (msgMatch && req.method === "POST") {
+        const headerToken = req.headers["x-ws-token"];
+        const provided = Array.isArray(headerToken) ? headerToken[0] : headerToken;
+        if (requireApiToken && !tokenMatches(provided, opts.apiToken ?? "")) {
+          res.writeHead(401, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ error: "Unauthorized" }));
+          return;
+        }
+        await handleApiSessionMessage(res, req, opts.globalRoot, decodeSessionId(msgMatch[1]));
+        return;
+      }
+      const mailboxMatch = url.pathname.match(/^\/api\/sessions\/([^/]+)\/mailbox$/);
+      if (mailboxMatch && req.method === "GET") {
+        const headerToken = req.headers["x-ws-token"];
+        const provided = Array.isArray(headerToken) ? headerToken[0] : headerToken;
+        if (requireApiToken && !tokenMatches(provided, opts.apiToken ?? "")) {
+          res.writeHead(401, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ error: "Unauthorized" }));
+          return;
+        }
+        await handleApiSessionMailbox(res, opts.globalRoot, decodeSessionId(mailboxMatch[1]));
+        return;
+      }
+      const interruptMatch = url.pathname.match(/^\/api\/sessions\/([^/]+)\/interrupt$/);
+      if (interruptMatch && req.method === "POST") {
+        const headerToken = req.headers["x-ws-token"];
+        const provided = Array.isArray(headerToken) ? headerToken[0] : headerToken;
+        if (requireApiToken && !tokenMatches(provided, opts.apiToken ?? "")) {
+          res.writeHead(401, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ error: "Unauthorized" }));
+          return;
+        }
+        await handleApiSessionInterrupt(
+          res,
+          req,
+          opts.globalRoot,
+          decodeSessionId(interruptMatch[1])
+        );
+        return;
+      }
+      if (url.pathname === "/api/fleet/broadcast" && req.method === "POST") {
+        const headerToken = req.headers["x-ws-token"];
+        const provided = Array.isArray(headerToken) ? headerToken[0] : headerToken;
+        if (requireApiToken && !tokenMatches(provided, opts.apiToken ?? "")) {
+          res.writeHead(401, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ error: "Unauthorized" }));
+          return;
+        }
+        await handleApiFleetBroadcast(res, req, opts.globalRoot);
+        return;
+      }
+      if (url.pathname === "/debug/watcher-metrics" && req.method === "GET") {
+        if (opts.watcherMetrics) {
+          const avgDelay = opts.watcherMetrics.broadcastsSent > 0 ? opts.watcherMetrics.totalDebounceDelayMs / opts.watcherMetrics.broadcastsSent : 0;
+          const response = {
+            ...opts.watcherMetrics,
+            averageDebounceDelayMs: avgDelay,
+            timestamp: Date.now()
+          };
+          res.writeHead(200, { "Content-Type": "application/json" });
+          res.end(JSON.stringify(response));
+        } else {
+          res.writeHead(503, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ error: "File watcher metrics not available" }));
+        }
         return;
       }
       let filePath;
@@ -312,6 +583,324 @@ async function handleApiSessionAgents(res, globalRoot, sessionId) {
     res.end(JSON.stringify({ error: String(err) }));
   }
 }
+function blocksToText(content) {
+  if (typeof content === "string") return content;
+  if (Array.isArray(content)) {
+    return content.filter(
+      (b) => !!b && typeof b === "object" && b.type === "text" && typeof b.text === "string"
+    ).map((b) => b.text).join("\n");
+  }
+  return "";
+}
+function clip(s, n = 600) {
+  return s.length > n ? `${s.slice(0, n)}\u2026` : s;
+}
+function asString(v) {
+  if (typeof v === "string") return v;
+  try {
+    return JSON.stringify(v);
+  } catch {
+    return String(v);
+  }
+}
+function mapWatchEntry(ev) {
+  const ts = typeof ev["ts"] === "string" ? ev["ts"] : "";
+  switch (ev["type"]) {
+    case "user_input":
+      return { ts, role: "user", text: clip(blocksToText(ev["content"])) };
+    case "llm_response": {
+      const text = blocksToText(ev["content"]);
+      return text.trim() ? { ts, role: "assistant", text: clip(text) } : null;
+    }
+    case "tool_use":
+    case "tool_call_start": {
+      const input = ev["input"] ?? ev["args"];
+      const preview = input !== void 0 && input !== null ? clip(asString(input), 160) : "";
+      return { ts, role: "tool", tool: String(ev["name"] ?? "tool"), text: preview };
+    }
+    case "tool_result": {
+      if (ev["isError"]) return { ts, role: "error", text: clip(asString(ev["content"])) };
+      const out = asString(ev["content"]).trim();
+      return out ? { ts, role: "tool", tool: "\u21B3 result", text: clip(out, 240) } : null;
+    }
+    case "error":
+    case "provider_error":
+      return { ts, role: "error", text: clip(String(ev["message"] ?? "error")) };
+    case "agent_spawned":
+      return { ts, role: "system", text: `spawned ${String(ev["role"] ?? "agent")}` };
+    case "task_completed":
+      return { ts, role: "system", text: `task done: ${String(ev["title"] ?? "")}` };
+    case "task_failed":
+      return { ts, role: "system", text: `task failed: ${String(ev["title"] ?? "")}` };
+    default:
+      return null;
+  }
+}
+async function handleApiSessionEvents(res, globalRoot, sessionId, limit) {
+  if (!globalRoot) {
+    res.writeHead(500, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ error: "SessionRegistry not available" }));
+    return;
+  }
+  try {
+    const { SessionRegistry, resolveWstackPaths: resolveWstackPaths2, DefaultSessionStore: DefaultSessionStore3, DefaultSessionReader: DefaultSessionReader2 } = await import("@wrongstack/core");
+    const registry = new SessionRegistry(globalRoot);
+    const entry = await registry.get(sessionId);
+    if (!entry) {
+      res.writeHead(404, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ error: "Session not found" }));
+      return;
+    }
+    const paths = resolveWstackPaths2({ projectRoot: entry.projectRoot, globalRoot });
+    const store = new DefaultSessionStore3({ dir: paths.projectSessions });
+    const reader = new DefaultSessionReader2({ store });
+    const all = [];
+    for await (const ev of reader.replay(sessionId)) {
+      const mapped = mapWatchEntry(ev);
+      if (mapped) all.push(mapped);
+    }
+    const tail = all.slice(-limit);
+    res.writeHead(200, { "Content-Type": "application/json" });
+    res.end(
+      JSON.stringify({
+        sessionId,
+        status: entry.status,
+        clientType: entry.clientType,
+        projectName: entry.projectName,
+        total: all.length,
+        entries: tail
+      })
+    );
+  } catch (err) {
+    res.writeHead(500, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ error: String(err) }));
+  }
+}
+function readJsonBody(req) {
+  return new Promise((resolve5, reject) => {
+    let data = "";
+    req.on("data", (chunk) => {
+      data += chunk;
+      if (data.length > 64e3) {
+        reject(new Error("Request body too large"));
+        req.destroy();
+      }
+    });
+    req.on("end", () => {
+      try {
+        resolve5(data ? JSON.parse(data) : {});
+      } catch (err) {
+        reject(err instanceof Error ? err : new Error(String(err)));
+      }
+    });
+    req.on("error", reject);
+  });
+}
+async function handleApiSessionMessage(res, req, globalRoot, sessionId) {
+  if (!globalRoot) {
+    res.writeHead(500, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ error: "SessionRegistry not available" }));
+    return;
+  }
+  let body;
+  try {
+    body = await readJsonBody(req);
+  } catch {
+    res.writeHead(400, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ error: "Invalid request body" }));
+    return;
+  }
+  const text = typeof body["text"] === "string" ? body["text"].trim() : "";
+  if (!text) {
+    res.writeHead(400, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ error: "text is required" }));
+    return;
+  }
+  const from = typeof body["from"] === "string" && body["from"].trim() ? body["from"].trim() : "human@webui";
+  const ALLOWED = /* @__PURE__ */ new Set(["steer", "ask", "assign", "note", "btw"]);
+  const rawType = typeof body["type"] === "string" ? body["type"] : "steer";
+  const type = ALLOWED.has(rawType) ? rawType : "steer";
+  const rawPriority = typeof body["priority"] === "string" ? body["priority"] : "";
+  const priority = ["low", "normal", "high"].includes(rawPriority) ? rawPriority : "high";
+  const subject = typeof body["subject"] === "string" && body["subject"].trim() ? body["subject"].trim() : "Message from Fleet HQ";
+  try {
+    const { SessionRegistry, resolveWstackPaths: resolveWstackPaths2, GlobalMailbox: GlobalMailbox3, mailboxSessionTag: mailboxSessionTag2 } = await import("@wrongstack/core");
+    const registry = new SessionRegistry(globalRoot);
+    const entry = await registry.get(sessionId);
+    if (!entry) {
+      res.writeHead(404, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ error: "Session not found" }));
+      return;
+    }
+    const paths = resolveWstackPaths2({ projectRoot: entry.projectRoot, globalRoot });
+    const mailbox = new GlobalMailbox3(paths.projectDir);
+    const to = `leader@${mailboxSessionTag2(sessionId)}`;
+    const sent = await mailbox.send({ from, to, type, subject, body: text, priority });
+    res.writeHead(200, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ ok: true, id: sent.id, to, type, delivered: entry.status }));
+  } catch (err) {
+    res.writeHead(500, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ error: String(err) }));
+  }
+}
+async function handleApiSessionMailbox(res, globalRoot, sessionId) {
+  if (!globalRoot) {
+    res.writeHead(500, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ error: "SessionRegistry not available" }));
+    return;
+  }
+  try {
+    const { SessionRegistry, resolveWstackPaths: resolveWstackPaths2, GlobalMailbox: GlobalMailbox3, mailboxSessionTag: mailboxSessionTag2 } = await import("@wrongstack/core");
+    const registry = new SessionRegistry(globalRoot);
+    const entry = await registry.get(sessionId);
+    if (!entry) {
+      res.writeHead(404, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ error: "Session not found" }));
+      return;
+    }
+    const paths = resolveWstackPaths2({ projectRoot: entry.projectRoot, globalRoot });
+    const mailbox = new GlobalMailbox3(paths.projectDir);
+    const leaderAddr = `leader@${mailboxSessionTag2(sessionId)}`;
+    const [inbound, outbound] = await Promise.all([
+      mailbox.query({ to: leaderAddr, limit: 50 }),
+      mailbox.query({ from: leaderAddr, limit: 50 })
+    ]);
+    const seen = /* @__PURE__ */ new Set();
+    const thread = [...inbound, ...outbound].filter((m) => {
+      if (seen.has(m.id)) return false;
+      seen.add(m.id);
+      return true;
+    }).sort((a, b) => Date.parse(a.timestamp) - Date.parse(b.timestamp)).map((m) => ({
+      id: m.id,
+      from: m.from,
+      to: m.to,
+      type: m.type,
+      subject: m.subject,
+      body: m.body,
+      priority: m.priority,
+      // Whether the leader has read it, and when.
+      readByLeader: m.readBy?.[leaderAddr] ?? null,
+      readByCount: Object.keys(m.readBy ?? {}).length,
+      completed: m.completed,
+      outcome: m.outcome ?? null,
+      timestamp: m.timestamp,
+      replyTo: m.replyTo ?? null,
+      fromLeader: m.from === leaderAddr
+    }));
+    res.writeHead(200, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ sessionId, leader: leaderAddr, status: entry.status, thread }));
+  } catch (err) {
+    res.writeHead(500, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ error: String(err) }));
+  }
+}
+async function handleApiSessionInterrupt(res, req, globalRoot, sessionId) {
+  if (!globalRoot) {
+    res.writeHead(500, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ error: "SessionRegistry not available" }));
+    return;
+  }
+  let body = {};
+  try {
+    body = await readJsonBody(req);
+  } catch {
+  }
+  const reason = typeof body["reason"] === "string" && body["reason"].trim() ? body["reason"].trim() : "Operator requested stop from Fleet HQ";
+  const from = typeof body["from"] === "string" && body["from"].trim() ? body["from"].trim() : "human@webui";
+  try {
+    const { SessionRegistry, resolveWstackPaths: resolveWstackPaths2, GlobalMailbox: GlobalMailbox3, mailboxSessionTag: mailboxSessionTag2 } = await import("@wrongstack/core");
+    const registry = new SessionRegistry(globalRoot);
+    const entry = await registry.get(sessionId);
+    if (!entry) {
+      res.writeHead(404, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ error: "Session not found" }));
+      return;
+    }
+    const paths = resolveWstackPaths2({ projectRoot: entry.projectRoot, globalRoot });
+    const mailbox = new GlobalMailbox3(paths.projectDir);
+    const to = `leader@${mailboxSessionTag2(sessionId)}`;
+    const sent = await mailbox.send({
+      from,
+      to,
+      type: "control",
+      subject: "interrupt",
+      body: reason,
+      priority: "high"
+    });
+    res.writeHead(200, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ ok: true, id: sent.id, to, delivered: entry.status }));
+  } catch (err) {
+    res.writeHead(500, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ error: String(err) }));
+  }
+}
+async function handleApiFleetBroadcast(res, req, globalRoot) {
+  if (!globalRoot) {
+    res.writeHead(500, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ error: "SessionRegistry not available" }));
+    return;
+  }
+  let body;
+  try {
+    body = await readJsonBody(req);
+  } catch {
+    res.writeHead(400, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ error: "Invalid request body" }));
+    return;
+  }
+  const text = typeof body["text"] === "string" ? body["text"].trim() : "";
+  if (!text) {
+    res.writeHead(400, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ error: "text is required" }));
+    return;
+  }
+  const from = typeof body["from"] === "string" && body["from"].trim() ? body["from"].trim() : "human@webui";
+  try {
+    const { SessionRegistry, resolveWstackPaths: resolveWstackPaths2, GlobalMailbox: GlobalMailbox3, mailboxSessionTag: mailboxSessionTag2 } = await import("@wrongstack/core");
+    const registry = new SessionRegistry(globalRoot);
+    const all = await registry.list();
+    const mySlug = all.find((s) => s.pid === process.pid)?.projectSlug;
+    const targets = all.filter((s) => s.status !== "stale").filter((s) => mySlug ? s.projectSlug === mySlug : true);
+    if (targets.length === 0) {
+      res.writeHead(200, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ ok: true, delivered: 0 }));
+      return;
+    }
+    const mbByDir = /* @__PURE__ */ new Map();
+    const mailboxFor = (projectRoot) => {
+      const dir = resolveWstackPaths2({ projectRoot, globalRoot }).projectDir;
+      let mb = mbByDir.get(dir);
+      if (!mb) {
+        mb = new GlobalMailbox3(dir);
+        mbByDir.set(dir, mb);
+      }
+      return mb;
+    };
+    let delivered = 0;
+    await Promise.all(
+      targets.map(async (s) => {
+        try {
+          const mb = mailboxFor(s.projectRoot);
+          await mb.send({
+            from,
+            to: `leader@${mailboxSessionTag2(s.sessionId)}`,
+            type: "steer",
+            subject: "Broadcast from Fleet HQ",
+            body: text,
+            priority: "high"
+          });
+          delivered++;
+        } catch {
+        }
+      })
+    );
+    res.writeHead(200, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ ok: true, delivered, targets: targets.length }));
+  } catch (err) {
+    res.writeHead(500, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ error: String(err) }));
+  }
+}
 
 // src/server/file-handlers.ts
 import * as fs2 from "fs/promises";
@@ -385,7 +974,7 @@ function broadcast(clients, msg) {
     }
   }
 }
-function sendResult(ws, success, message) {
+function sendResult2(ws, success, message) {
   send(ws, { type: "key.operation_result", payload: { success, message } });
 }
 function errMessage(err) {
@@ -534,24 +1123,266 @@ async function handleMemoryRemember(ws, msg, memoryStore) {
   const { text, scope } = msg.payload;
   try {
     await memoryStore.remember(text, scope ?? "project-memory");
-    sendResult(ws, true, "Saved to memory");
+    sendResult2(ws, true, "Saved to memory");
   } catch (err) {
-    sendResult(ws, false, errMessage(err));
+    sendResult2(ws, false, errMessage(err));
   }
 }
 async function handleMemoryForget(ws, msg, memoryStore) {
   const { text, scope } = msg.payload;
   try {
     const removed = await memoryStore.forget(text, scope ?? "project-memory");
-    sendResult(
+    sendResult2(
       ws,
       removed > 0,
       removed > 0 ? `Removed ${removed} entr${removed === 1 ? "y" : "ies"}` : "No matching entries"
     );
   } catch (err) {
-    sendResult(ws, false, errMessage(err));
+    sendResult2(ws, false, errMessage(err));
+  }
+}
+
+// src/server/mcp-handlers.ts
+import * as fs3 from "fs/promises";
+import * as path3 from "path";
+function isMcpServerRecord(val) {
+  if (typeof val !== "object" || val === null) return false;
+  return true;
+}
+function projectServer(name, cfg, _status = "stopped", tools = []) {
+  return {
+    name,
+    transport: cfg.transport,
+    status: _status,
+    enabled: cfg.enabled ?? true,
+    description: cfg.description,
+    tools
+  };
+}
+async function readConfig(configPath) {
+  try {
+    const content = await fs3.readFile(configPath, "utf-8");
+    return JSON.parse(content);
+  } catch {
+    return {};
+  }
+}
+async function writeConfig(configPath, cfg) {
+  const dir = path3.dirname(configPath);
+  await fs3.mkdir(dir, { recursive: true });
+  await fs3.writeFile(configPath, JSON.stringify(cfg, null, 2), "utf-8");
+}
+async function getMcpServers(config, globalConfigPath) {
+  const servers = [];
+  const configured = isMcpServerRecord(config.mcpServers) ? config.mcpServers : {};
+  for (const [name, cfg] of Object.entries(configured)) {
+    servers.push(projectServer(name, cfg));
+  }
+  return servers;
+}
+function getRegistryStates(mcpRegistry) {
+  const states = /* @__PURE__ */ new Map();
+  if (!mcpRegistry?.list) return states;
+  try {
+    const list = mcpRegistry.list();
+    for (const item of list) {
+      states.set(item.name, { state: item.state, toolCount: item.toolCount });
+    }
+  } catch {
+  }
+  return states;
+}
+async function handleMcpList(ws, _msg, config, _globalConfigPath, mcpRegistry) {
+  const servers = await getMcpServers(config, _globalConfigPath);
+  const registryStates = getRegistryStates(mcpRegistry);
+  for (const server of servers) {
+    const registryState = registryStates.get(server.name);
+    if (registryState) {
+      server.status = registryState.state;
+      server.tools = Array.from({ length: registryState.toolCount }, (_, i) => `tool-${i + 1}`);
+    }
+  }
+  send(ws, { type: "mcp.list", payload: { servers } });
+}
+async function handleMcpAdd(ws, msg, config, globalConfigPath, mcpRegistry) {
+  const payload = msg.payload;
+  if (!payload.name) {
+    send(ws, { type: "mcp.operation_result", payload: { success: false, message: "Server name is required" } });
+    return;
+  }
+  try {
+    const diskConfig = await readConfig(globalConfigPath);
+    const mcpServers = isMcpServerRecord(diskConfig.mcpServers) ? diskConfig.mcpServers : {};
+    if (mcpServers[payload.name]) {
+      send(ws, { type: "mcp.operation_result", payload: { success: false, message: `Server "${payload.name}" already exists` } });
+      return;
+    }
+    mcpServers[payload.name] = {
+      transport: payload.transport,
+      description: payload.description,
+      enabled: payload.enabled ?? true,
+      command: payload.command,
+      args: payload.args,
+      env: payload.env,
+      allowedTools: payload.allowedTools
+    };
+    diskConfig.mcpServers = mcpServers;
+    await writeConfig(globalConfigPath, diskConfig);
+    const newServer = projectServer(payload.name, mcpServers[payload.name]);
+    send(ws, { type: "mcp.server.added", payload: { server: newServer } });
+    if (mcpRegistry && (payload.enabled ?? true)) {
+      const serverConfig = mcpServers[payload.name];
+      try {
+        await mcpRegistry.start({
+          name: payload.name,
+          transport: payload.transport,
+          command: payload.command,
+          args: payload.args,
+          env: payload.env,
+          allowedTools: payload.allowedTools,
+          enabled: true
+        });
+      } catch (err) {
+        send(ws, { type: "mcp.server.error", payload: { name: payload.name, error: String(err) } });
+      }
+    }
+    send(ws, { type: "mcp.operation_result", payload: { success: true, message: `Server "${payload.name}" added` } });
+  } catch (err) {
+    send(ws, { type: "mcp.operation_result", payload: { success: false, message: `Failed to add server: ${err}` } });
+  }
+}
+async function handleMcpRemove(ws, msg, _config, globalConfigPath, mcpRegistry) {
+  const payload = msg.payload;
+  if (!payload.name) {
+    send(ws, { type: "mcp.operation_result", payload: { success: false, message: "Server name is required" } });
+    return;
+  }
+  try {
+    if (mcpRegistry) {
+      try {
+        await mcpRegistry.stop(payload.name);
+      } catch {
+      }
+    }
+    const diskConfig = await readConfig(globalConfigPath);
+    const mcpServers = isMcpServerRecord(diskConfig.mcpServers) ? diskConfig.mcpServers : {};
+    if (!mcpServers[payload.name]) {
+      send(ws, { type: "mcp.operation_result", payload: { success: false, message: `Server "${payload.name}" not found` } });
+      return;
+    }
+    delete mcpServers[payload.name];
+    diskConfig.mcpServers = mcpServers;
+    await writeConfig(globalConfigPath, diskConfig);
+    send(ws, { type: "mcp.server.removed", payload: { name: payload.name } });
+    send(ws, { type: "mcp.operation_result", payload: { success: true, message: `Server "${payload.name}" removed` } });
+  } catch (err) {
+    send(ws, { type: "mcp.operation_result", payload: { success: false, message: `Failed to remove server: ${err}` } });
   }
 }
+async function handleMcpUpdate(ws, msg, _config, globalConfigPath) {
+  const payload = msg.payload;
+  if (!payload.name) {
+    send(ws, { type: "mcp.operation_result", payload: { success: false, message: "Server name is required" } });
+    return;
+  }
+  try {
+    const diskConfig = await readConfig(globalConfigPath);
+    const mcpServers = isMcpServerRecord(diskConfig.mcpServers) ? diskConfig.mcpServers : {};
+    if (!mcpServers[payload.name]) {
+      send(ws, { type: "mcp.operation_result", payload: { success: false, message: `Server "${payload.name}" not found` } });
+      return;
+    }
+    const existing = mcpServers[payload.name];
+    mcpServers[payload.name] = {
+      transport: payload.transport ?? existing.transport,
+      description: payload.description ?? existing.description,
+      enabled: payload.enabled ?? existing.enabled,
+      command: payload.command ?? existing.command,
+      args: payload.args ?? existing.args,
+      env: payload.env ?? existing.env,
+      allowedTools: payload.allowedTools ?? existing.allowedTools
+    };
+    diskConfig.mcpServers = mcpServers;
+    await writeConfig(globalConfigPath, diskConfig);
+    const updatedServer = projectServer(payload.name, mcpServers[payload.name]);
+    send(ws, { type: "mcp.server.updated", payload: { server: updatedServer } });
+    send(ws, { type: "mcp.operation_result", payload: { success: true, message: `Server "${payload.name}" updated` } });
+  } catch (err) {
+    send(ws, { type: "mcp.operation_result", payload: { success: false, message: `Failed to update server: ${err}` } });
+  }
+}
+async function handleMcpWake(ws, msg, _config, _globalConfigPath, mcpRegistry) {
+  const payload = msg.payload;
+  if (!payload.name) {
+    send(ws, { type: "mcp.operation_result", payload: { success: false, message: "Server name is required" } });
+    return;
+  }
+  if (!mcpRegistry) {
+    send(ws, { type: "mcp.operation_result", payload: { success: false, message: "MCP registry not available" } });
+    return;
+  }
+  try {
+    send(ws, { type: "mcp.server.waking", payload: { name: payload.name } });
+    await mcpRegistry.restart(payload.name);
+    send(ws, { type: "mcp.server.connected", payload: { name: payload.name } });
+    send(ws, { type: "mcp.operation_result", payload: { success: true, message: `Server "${payload.name}" restarted` } });
+  } catch (err) {
+    send(ws, { type: "mcp.server.error", payload: { name: payload.name, error: String(err) } });
+    send(ws, { type: "mcp.operation_result", payload: { success: false, message: `Failed to restart "${payload.name}": ${err}` } });
+  }
+}
+async function handleMcpSleep(ws, msg, _config, _globalConfigPath, mcpRegistry) {
+  const payload = msg.payload;
+  if (!payload.name) {
+    send(ws, { type: "mcp.operation_result", payload: { success: false, message: "Server name is required" } });
+    return;
+  }
+  if (!mcpRegistry) {
+    send(ws, { type: "mcp.operation_result", payload: { success: false, message: "MCP registry not available" } });
+    return;
+  }
+  try {
+    await mcpRegistry.stop(payload.name);
+    send(ws, { type: "mcp.server.sleeping", payload: { name: payload.name } });
+    send(ws, { type: "mcp.operation_result", payload: { success: true, message: `Server "${payload.name}" stopped` } });
+  } catch (err) {
+    send(ws, { type: "mcp.server.error", payload: { name: payload.name, error: String(err) } });
+    send(ws, { type: "mcp.operation_result", payload: { success: false, message: `Failed to stop "${payload.name}": ${err}` } });
+  }
+}
+async function handleMcpDiscover(ws, msg, _config, _globalConfigPath, _mcpRegistry) {
+  const payload = msg.payload;
+  if (!payload.name) {
+    send(ws, { type: "mcp.operation_result", payload: { success: false, message: "Server name is required" } });
+    return;
+  }
+  send(ws, { type: "mcp.server.discovered", payload: { name: payload.name, tools: [] } });
+  send(ws, { type: "mcp.operation_result", payload: { success: true, message: `Server "${payload.name}" tools were discovered on connect` } });
+}
+async function handleMcpEnable(ws, msg, _config, _globalConfigPath) {
+  const payload = msg.payload;
+  if (!payload.name) {
+    send(ws, { type: "mcp.operation_result", payload: { success: false, message: "Server name is required" } });
+    return;
+  }
+  send(ws, { type: "mcp.operation_result", payload: { success: true, message: `Enable command sent for "${payload.name}"` } });
+}
+async function handleMcpDisable(ws, msg, _config, _globalConfigPath) {
+  const payload = msg.payload;
+  if (!payload.name) {
+    send(ws, { type: "mcp.operation_result", payload: { success: false, message: "Server name is required" } });
+    return;
+  }
+  send(ws, { type: "mcp.operation_result", payload: { success: true, message: `Disable command sent for "${payload.name}"` } });
+}
+async function handleMcpRestart(ws, msg, _config, _globalConfigPath) {
+  const payload = msg.payload;
+  if (!payload.name) {
+    send(ws, { type: "mcp.operation_result", payload: { success: false, message: "Server name is required" } });
+    return;
+  }
+  send(ws, { type: "mcp.operation_result", payload: { success: true, message: `Restart command sent for "${payload.name}"` } });
+}
 
 // src/server/index.ts
 import {
@@ -710,6 +1541,7 @@ function patchConfig(config, updates) {
 
 // src/server/autophase-ws-handler.ts
 import { spawnSync } from "child_process";
+import { toErrorMessage } from "@wrongstack/core/utils";
 import {
   AutoPhasePlanner,
   PhaseGraphBuilder,
@@ -879,7 +1711,7 @@ var AutoPhaseWebSocketHandler = class {
       );
       this.broadcastState();
     }).catch((err) => {
-      this.logger.error(`[AutoPhase] Aborted: ${err instanceof Error ? err.message : String(err)}`);
+      this.logger.error(`[AutoPhase] Aborted: ${toErrorMessage(err)}`);
       this.stopBroadcast();
       this.broadcast({ type: "autophase.failed", payload: { title, error: String(err) } });
     });
@@ -912,7 +1744,7 @@ var AutoPhaseWebSocketHandler = class {
       }
       this.logger.info(`[AutoPhase] Planner produced no phases; using defaults for: ${goal}`);
     } catch (err) {
-      this.logger.error(`[AutoPhase] Planning failed, using defaults: ${err instanceof Error ? err.message : String(err)}`);
+      this.logger.error(`[AutoPhase] Planning failed, using defaults: ${toErrorMessage(err)}`);
     }
     return this.defaultPhases();
   }
@@ -1039,6 +1871,7 @@ Type: ${task.type}`;
 
 // src/server/collaboration-ws-handler.ts
 import { randomUUID } from "crypto";
+import { toErrorMessage as toErrorMessage2 } from "@wrongstack/core/utils";
 var REPLAY_LIMIT = 50;
 var PAUSE_TIMEOUT_MS = 6e4;
 var CollaborationWebSocketHandler = class {
@@ -1166,7 +1999,7 @@ var CollaborationWebSocketHandler = class {
     if (this.reader) {
       this.replayHistory(ws, sessionId).catch((err) => {
         this.logger.debug?.(
-          `collab: replay failed for ${sessionId}: ${err instanceof Error ? err.message : String(err)}`
+          `collab: replay failed for ${sessionId}: ${toErrorMessage2(err)}`
         );
       });
     }
@@ -1276,7 +2109,7 @@ var CollaborationWebSocketHandler = class {
       this.send(
         ws,
         this.errorMessage(
-          `annotation rejected: ${err instanceof Error ? err.message : String(err)}`
+          `annotation rejected: ${toErrorMessage2(err)}`
         )
       );
     }
@@ -1343,7 +2176,7 @@ var CollaborationWebSocketHandler = class {
       this.send(
         ws,
         this.errorMessage(
-          `resolve failed: ${err instanceof Error ? err.message : String(err)}`
+          `resolve failed: ${toErrorMessage2(err)}`
         )
       );
     }
@@ -1391,7 +2224,7 @@ var CollaborationWebSocketHandler = class {
           if (p.ws.readyState === 1) p.ws.send(data);
         } catch (err) {
           this.logger.debug?.(
-            `collab broadcast failed: ${err instanceof Error ? err.message : String(err)}`
+            `collab broadcast failed: ${toErrorMessage2(err)}`
           );
         }
       }
@@ -1418,7 +2251,7 @@ var CollaborationWebSocketHandler = class {
       }
     } catch (err) {
       this.logger.debug?.(
-        `collab: session reader rejected ${sessionId}: ${err instanceof Error ? err.message : String(err)}`
+        `collab: session reader rejected ${sessionId}: ${toErrorMessage2(err)}`
       );
       return;
     }
@@ -1499,7 +2332,7 @@ var CollaborationWebSocketHandler = class {
         if (p.ws.readyState === 1) p.ws.send(data);
       } catch (err) {
         this.logger.debug?.(
-          `collab broadcast failed: ${err instanceof Error ? err.message : String(err)}`
+          `collab broadcast failed: ${toErrorMessage2(err)}`
         );
       }
     }
@@ -1696,6 +2529,7 @@ var CollaborationWebSocketHandler = class {
 };
 
 // src/server/worktree-ws-handler.ts
+import { toErrorMessage as toErrorMessage3 } from "@wrongstack/core/utils";
 var MAX_ACTIVITY = 6;
 var WorktreeWebSocketHandler = class {
   constructor(events, logger) {
@@ -1821,7 +2655,7 @@ var WorktreeWebSocketHandler = class {
       try {
         if (ws.readyState === 1) ws.send(data);
       } catch (err) {
-        this.logger.debug?.(`worktree broadcast failed: ${err instanceof Error ? err.message : String(err)}`);
+        this.logger.debug?.(`worktree broadcast failed: ${toErrorMessage3(err)}`);
       }
     }
   }
@@ -1834,22 +2668,14 @@ var WorktreeWebSocketHandler = class {
 };
 
 // src/server/mailbox-handlers.ts
-import * as path3 from "path";
-import { GlobalMailbox } from "@wrongstack/core";
-function resolveProjectDir(projectRoot, globalRoot) {
-  const { createHash } = __require("crypto");
-  const hash = createHash("sha256").update(path3.resolve(projectRoot)).digest("hex").slice(0, 6);
-  const slug = path3.basename(projectRoot).toLowerCase().replace(/[^a-z0-9]+/g, "-").slice(0, 40) || "project";
-  return path3.join(globalRoot, "projects", `${slug}-${hash}`);
-}
+import { GlobalMailbox, resolveProjectDir } from "@wrongstack/core";
 async function handleMailboxMessages(ws, deps, payload) {
   try {
     const dir = resolveProjectDir(deps.projectRoot, deps.globalRoot);
     const mb = new GlobalMailbox(dir);
     const messages = await mb.query({
       limit: payload?.limit ?? 30,
-      to: payload?.agentId,
-      unreadBy: payload?.unreadOnly ? payload.agentId : void 0
+      incompleteOnly: payload?.incompleteOnly ?? false
     });
     send(ws, {
       type: "mailbox.messages",
@@ -1866,10 +2692,12 @@ async function handleMailboxMessages(ws, deps, payload) {
           readByCount: Object.keys(m.readBy).length,
           completed: m.completed,
           completedBy: m.completedBy,
+          completedAt: m.completedAt,
           outcome: m.outcome,
           timestamp: m.timestamp,
           replyTo: m.replyTo,
-          senderSessionId: m.senderSessionId
+          senderSessionId: m.senderSessionId,
+          taskContext: m.taskContext
         }))
       }
     });
@@ -1916,6 +2744,16 @@ async function handleMailboxClear(ws, deps) {
     send(ws, { type: "mailbox.cleared", payload: { error: errMessage(err) } });
   }
 }
+async function handleMailboxPurge(ws, deps, opts) {
+  try {
+    const dir = resolveProjectDir(deps.projectRoot, deps.globalRoot);
+    const mb = new GlobalMailbox(dir);
+    const result = await mb.purgeStale(opts);
+    send(ws, { type: "mailbox.purged", payload: result });
+  } catch (err) {
+    send(ws, { type: "mailbox.purged", payload: { error: errMessage(err) } });
+  }
+}
 
 // src/server/lifecycle.ts
 function createShutdown(res) {
@@ -1956,7 +2794,7 @@ function registerShutdownHandlers(res) {
 // src/server/instance-registry.ts
 import * as os from "os";
 import * as path4 from "path";
-import * as fs3 from "fs/promises";
+import * as fs4 from "fs/promises";
 import { atomicWrite as atomicWrite2 } from "@wrongstack/core";
 function defaultBaseDir() {
   return path4.join(os.homedir(), ".wrongstack");
@@ -1975,7 +2813,7 @@ function isPidAlive(pid) {
 }
 async function load(file) {
   try {
-    const raw = await fs3.readFile(file, "utf8");
+    const raw = await fs4.readFile(file, "utf8");
     const parsed = JSON.parse(raw);
     if (parsed?.version === 1 && Array.isArray(parsed.instances)) {
       return parsed;
@@ -2034,16 +2872,16 @@ function formatInstances(instances) {
 // src/server/port-utils.ts
 import * as net from "net";
 function isPortFree(host, port) {
-  return new Promise((resolve6) => {
+  return new Promise((resolve5) => {
     const srv = net.createServer();
-    srv.once("error", () => resolve6(false));
+    srv.once("error", () => resolve5(false));
     srv.once("listening", () => {
-      srv.close(() => resolve6(true));
+      srv.close(() => resolve5(true));
     });
     try {
       srv.listen(port, host);
     } catch {
-      resolve6(false);
+      resolve5(false);
     }
   });
 }
@@ -2118,8 +2956,12 @@ function computeUsageCost(usage, rates) {
   return (usage.input * rates.input + usage.output * rates.output + (usage.cacheRead ?? 0) * rates.cacheRead) / 1e6;
 }
 
+// src/server/provider-handlers.ts
+import { DefaultSecretScrubber as DefaultSecretScrubber2 } from "@wrongstack/core";
+import { probeLocalLlm } from "@wrongstack/runtime/probe";
+
 // src/server/provider-config-io.ts
-import * as fs4 from "fs/promises";
+import * as fs5 from "fs/promises";
 import * as path5 from "path";
 import { atomicWrite as atomicWrite3 } from "@wrongstack/core";
 import { decryptConfigSecrets, encryptConfigSecrets } from "@wrongstack/core/security";
@@ -2127,7 +2969,7 @@ import { DefaultSecretVault } from "@wrongstack/core";
 async function loadSavedProviders(configPath, vault) {
   let raw;
   try {
-    raw = await fs4.readFile(configPath, "utf8");
+    raw = await fs5.readFile(configPath, "utf8");
   } catch {
     return {};
   }
@@ -2144,7 +2986,7 @@ async function saveProviders(configPath, vault, providers) {
   let raw;
   let fileExists = true;
   try {
-    raw = await fs4.readFile(configPath, "utf8");
+    raw = await fs5.readFile(configPath, "utf8");
   } catch (err) {
     if (err.code !== "ENOENT") {
       throw new Error(
@@ -2180,6 +3022,9 @@ function createProviderConfigIO(configPath) {
   };
 }
 
+// src/server/provider-handlers.ts
+import { toErrorMessage as toErrorMessage4 } from "@wrongstack/core/utils";
+
 // src/server/provider-keys.ts
 import { expectDefined } from "@wrongstack/core";
 function normalizeKeys(cfg) {
@@ -2200,7 +3045,7 @@ function writeKeysBack(cfg, keys) {
   }
   cfg.apiKeys = keys;
   const active = keys.find((k) => k.label === cfg.activeKey) ?? expectDefined(keys[0]);
-  cfg.apiKey = active.apiKey;
+  delete cfg.apiKey;
   if (!cfg.activeKey || !keys.some((k) => k.label === cfg.activeKey)) {
     cfg.activeKey = active.label;
   }
@@ -2277,6 +3122,28 @@ function removeProvider(providers, providerId) {
 }
 
 // src/server/provider-handlers.ts
+function projectSavedProviders(providers) {
+  return Object.entries(providers).map(([id, cfg]) => {
+    const keys = normalizeKeys(cfg);
+    const models = cfg.models;
+    const view = {
+      id,
+      family: cfg.family ?? id,
+      baseUrl: cfg.baseUrl,
+      models,
+      apiKeys: keys.map((k) => ({
+        label: k.label,
+        maskedKey: maskedKey(k.apiKey),
+        isActive: k.label === cfg.activeKey,
+        createdAt: k.createdAt
+      }))
+    };
+    const picked = models && models.length > 0 ? models[0] : void 0;
+    if (picked !== void 0) view.pickedModelId = picked;
+    return view;
+  });
+}
+var probeScrubber = new DefaultSecretScrubber2();
 function createProviderHandlers(deps) {
   const { globalConfigPath, vault, broadcast: broadcast2, clients } = deps;
   let configWriteLock = deps.getConfigWriteLock();
@@ -2285,7 +3152,7 @@ function createProviderHandlers(deps) {
   }
   async function saveConfigProviders(providers) {
     const next = configWriteLock.then(() => saveProviders(globalConfigPath, vault, providers)).catch((err) => {
-      const msg = err instanceof Error ? err.message : String(err);
+      const msg = toErrorMessage4(err);
       console.error(JSON.stringify({
         level: "error",
         event: "webui.provider_save_failed",
@@ -2302,9 +3169,9 @@ function createProviderHandlers(deps) {
       const providers = await loadConfigProviders();
       const result = upsertKey(providers, providerId, label, apiKey, (/* @__PURE__ */ new Date()).toISOString());
       if (result.ok) await saveConfigProviders(providers);
-      sendResult(ws, result.ok, result.message);
+      sendResult2(ws, result.ok, result.message);
     } catch (err) {
-      sendResult(ws, false, errMessage(err));
+      sendResult2(ws, false, errMessage(err));
     }
   }
   async function handleKeyDelete(ws, providerId, label) {
@@ -2312,9 +3179,9 @@ function createProviderHandlers(deps) {
       const providers = await loadConfigProviders();
       const result = deleteKey(providers, providerId, label);
       if (result.ok) await saveConfigProviders(providers);
-      sendResult(ws, result.ok, result.message);
+      sendResult2(ws, result.ok, result.message);
     } catch (err) {
-      sendResult(ws, false, errMessage(err));
+      sendResult2(ws, false, errMessage(err));
     }
   }
   async function handleKeySetActive(ws, providerId, label) {
@@ -2322,9 +3189,9 @@ function createProviderHandlers(deps) {
       const providers = await loadConfigProviders();
       const result = setActiveKey(providers, providerId, label);
       if (result.ok) await saveConfigProviders(providers);
-      sendResult(ws, result.ok, result.message);
+      sendResult2(ws, result.ok, result.message);
     } catch (err) {
-      sendResult(ws, false, errMessage(err));
+      sendResult2(ws, false, errMessage(err));
     }
   }
   async function handleProviderAdd(ws, payload) {
@@ -2332,31 +3199,13 @@ function createProviderHandlers(deps) {
       const providers = await loadConfigProviders();
       const result = addProvider(providers, payload, (/* @__PURE__ */ new Date()).toISOString());
       if (result.ok) await saveConfigProviders(providers);
-      sendResult(ws, result.ok, result.message);
+      sendResult2(ws, result.ok, result.message);
       if (result.ok) {
         console.log(`[WebUI] Provider "${payload.id}" added via provider.add`);
-        broadcast2(clients, {
-          type: "providers.saved",
-          payload: {
-            providers: Object.entries(providers).map(([id, cfg]) => {
-              const keys = normalizeKeys(cfg);
-              return {
-                id,
-                family: cfg.family ?? id,
-                baseUrl: cfg.baseUrl,
-                apiKeys: keys.map((k) => ({
-                  label: k.label,
-                  maskedKey: maskedKey(k.apiKey),
-                  isActive: k.label === cfg.activeKey,
-                  createdAt: k.createdAt
-                }))
-              };
-            })
-          }
-        });
+        broadcastSaved(providers);
       }
     } catch (err) {
-      sendResult(ws, false, errMessage(err));
+      sendResult2(ws, false, errMessage(err));
     }
   }
   async function handleProviderRemove(ws, providerId) {
@@ -2364,18 +3213,116 @@ function createProviderHandlers(deps) {
       const providers = await loadConfigProviders();
       const result = removeProvider(providers, providerId);
       if (result.ok) await saveConfigProviders(providers);
-      sendResult(ws, result.ok, result.message);
+      sendResult2(ws, result.ok, result.message);
+    } catch (err) {
+      sendResult2(ws, false, errMessage(err));
+    }
+  }
+  function broadcastSaved(providers) {
+    broadcast2(clients, {
+      type: "providers.saved",
+      payload: { providers: projectSavedProviders(providers) }
+    });
+  }
+  async function handleProviderClearModels(ws, providerId) {
+    try {
+      const providers = await loadConfigProviders();
+      const cfg = providers[providerId];
+      if (!cfg) {
+        sendResult2(ws, false, `Unknown provider "${providerId}"`);
+        return;
+      }
+      delete cfg.models;
+      await saveConfigProviders(providers);
+      sendResult2(ws, true, `Cleared model allowlist for ${providerId}`);
+      broadcastSaved(providers);
+    } catch (err) {
+      sendResult2(ws, false, errMessage(err));
+    }
+  }
+  async function handleProviderUndoClear(ws, providerId, previousModels) {
+    try {
+      const providers = await loadConfigProviders();
+      const cfg = providers[providerId];
+      if (!cfg) {
+        sendResult2(ws, false, `Unknown provider "${providerId}"`);
+        return;
+      }
+      cfg.models = [...previousModels];
+      await saveConfigProviders(providers);
+      sendResult2(ws, true, `Restored ${previousModels.length} model(s) for ${providerId}`);
+      broadcastSaved(providers);
+    } catch (err) {
+      sendResult2(ws, false, errMessage(err));
+    }
+  }
+  async function handleProviderUpdate(ws, payload) {
+    try {
+      const providers = await loadConfigProviders();
+      const cfg = providers[payload.id];
+      if (!cfg) {
+        sendResult2(ws, false, `Unknown provider "${payload.id}"`);
+        return;
+      }
+      if (payload.family !== void 0) cfg.family = payload.family;
+      if (payload.baseUrl !== void 0) cfg.baseUrl = payload.baseUrl;
+      if (payload.envVars !== void 0) cfg.envVars = payload.envVars;
+      if (payload.models !== void 0) cfg.models = payload.models;
+      await saveConfigProviders(providers);
+      sendResult2(ws, true, `Updated ${payload.id}`);
+      broadcastSaved(providers);
+    } catch (err) {
+      sendResult2(ws, false, errMessage(err));
+    }
+  }
+  async function handleProviderProbe(ws, providerId, timeoutMs) {
+    const reply = (payload) => send(ws, { type: "provider.probe", payload: { providerId, ...payload } });
+    try {
+      const providers = await loadConfigProviders();
+      const cfg = providers[providerId];
+      if (!cfg) {
+        reply({ ok: false, status: "no_provider" });
+        return;
+      }
+      if (!cfg.baseUrl) {
+        reply({ ok: false, status: "no_base_url" });
+        return;
+      }
+      const keys = normalizeKeys(cfg);
+      const active = keys.find((k) => k.label === cfg.activeKey) ?? keys[0];
+      const result = await probeLocalLlm({
+        baseUrl: cfg.baseUrl,
+        apiKey: active?.apiKey,
+        noAuth: false,
+        scrubber: probeScrubber,
+        ...timeoutMs !== void 0 ? { timeoutMs } : {}
+      });
+      reply(result);
     } catch (err) {
-      sendResult(ws, false, errMessage(err));
+      reply({ ok: false, status: "unreachable", detail: errMessage(err) });
     }
   }
-  return { handleKeyUpsert, handleKeyDelete, handleKeySetActive, handleProviderAdd, handleProviderRemove, loadConfigProviders };
+  return {
+    handleKeyUpsert,
+    handleKeyDelete,
+    handleKeySetActive,
+    handleProviderAdd,
+    handleProviderRemove,
+    handleProviderClearModels,
+    handleProviderUndoClear,
+    handleProviderUpdate,
+    handleProviderProbe,
+    loadConfigProviders
+  };
 }
 
 // src/server/setup-events.ts
+import * as fs6 from "fs/promises";
+import { watch as fsWatch } from "fs";
 import * as path6 from "path";
 function setupEvents(deps) {
-  const { events, broadcast: broadcast2, clients, config, context, pendingConfirms, globalConfigPath, sessionBridge } = deps;
+  const { events, broadcast: broadcast2, clients, config, context, pendingConfirms, globalConfigPath, sessionBridge, wpaths, watcherMetrics, onFleetBroadcaster } = deps;
+  const disposers = [];
   events.on("iteration.started", (e) => {
     const maxIt = typeof context.meta["maxIterations"] === "number" ? context.meta["maxIterations"] : config.tools?.maxIterations ?? 100;
     broadcast2(clients, {
@@ -2406,7 +3353,11 @@ function setupEvents(deps) {
   events.on("tool.progress", (e) => {
     broadcast2(clients, {
       type: "tool.progress",
-      payload: { id: e.id, name: e.name, eventType: e.event.type, text: e.event.text }
+      // Nested `event` shape — the client handler reads `payload.event?.text`
+      // and early-returns on a falsy text, so a flat { eventType, text } payload
+      // makes live tool progress (bash streaming, partial_output, warnings)
+      // never render. Must match WSToolProgress and the CLI server.
+      payload: { id: e.id, name: e.name, event: { type: e.event.type, text: e.event.text, data: e.event.data } }
     });
     sessionBridge?.append({
       type: "tool_progress",
@@ -2572,20 +3523,165 @@ function setupEvents(deps) {
   events.onPattern("brain.*", (eventName, payload) => {
     broadcast2(clients, { type: "brain.event", payload: { event: eventName, ...payload } });
   });
+  events.on("client.status", async (e) => {
+    broadcast2(clients, { type: "client.status_update", payload: e });
+    if (wpaths?.projectStatus) {
+      try {
+        const statusFile = wpaths.projectStatus(e.projectHash);
+        const dir = path6.dirname(statusFile);
+        await fs6.mkdir(dir, { recursive: true });
+        await fs6.writeFile(statusFile, JSON.stringify(e, null, 2), "utf-8");
+      } catch (err) {
+        console.error("[setup-events] Failed to write status.json:", err);
+      }
+    }
+  });
+  if (wpaths?.projectStatus && wpaths.configDir) {
+    const projectsDir = path6.join(wpaths.configDir, "projects");
+    const knownProjectHashes = /* @__PURE__ */ new Set();
+    const debounceTimers = /* @__PURE__ */ new Map();
+    const DEBOUNCE_MS = 150;
+    const pendingStatuses = /* @__PURE__ */ new Map();
+    if (watcherMetrics) {
+      watcherMetrics.fileChangesDetected = 0;
+      watcherMetrics.filesProcessed = 0;
+      watcherMetrics.broadcastsSent = 0;
+      watcherMetrics.debounceResets = 0;
+      watcherMetrics.totalDebounceDelayMs = 0;
+      watcherMetrics.activeProjects = 0;
+      watcherMetrics.averageDebounceDelayMs = 0;
+      watcherMetrics.watcherActive = true;
+    }
+    const getAverageDebounceDelay = () => {
+      if (!watcherMetrics || watcherMetrics.broadcastsSent === 0) return 0;
+      return watcherMetrics.totalDebounceDelayMs / watcherMetrics.broadcastsSent;
+    };
+    const logWatcherMetrics = () => {
+      if (!watcherMetrics) return;
+      watcherMetrics.averageDebounceDelayMs = getAverageDebounceDelay();
+      console.log(
+        `[setup-events] File watcher stats: ${watcherMetrics.broadcastsSent} broadcasts, ${watcherMetrics.fileChangesDetected} file changes, ${watcherMetrics.debounceResets} debounce resets, avg delay: ${watcherMetrics.averageDebounceDelayMs.toFixed(1)}ms, ${watcherMetrics.activeProjects} active projects`
+      );
+    };
+    const metricsInterval = setInterval(logWatcherMetrics, 6e4);
+    const broadcastStatus = (projectHash2, statusData, actualDelayMs) => {
+      broadcast2(clients, { type: "client.status_update", payload: statusData });
+      if (watcherMetrics) {
+        watcherMetrics.broadcastsSent++;
+        watcherMetrics.totalDebounceDelayMs += actualDelayMs;
+        watcherMetrics.averageDebounceDelayMs = getAverageDebounceDelay();
+      }
+    };
+    const scheduleBroadcast = (projectHash2, statusData) => {
+      const now = Date.now();
+      const existing = pendingStatuses.get(projectHash2);
+      if (existing && watcherMetrics) {
+        watcherMetrics.debounceResets++;
+      }
+      pendingStatuses.set(projectHash2, {
+        data: statusData,
+        firstWriteAt: existing ? existing.firstWriteAt : now
+      });
+      const existingTimer = debounceTimers.get(projectHash2);
+      if (existingTimer) {
+        clearTimeout(existingTimer);
+      }
+      const timer = setTimeout(() => {
+        debounceTimers.delete(projectHash2);
+        const pending = pendingStatuses.get(projectHash2);
+        if (pending) {
+          const actualDelay = Date.now() - pending.firstWriteAt;
+          broadcastStatus(projectHash2, pending.data, actualDelay);
+          pendingStatuses.delete(projectHash2);
+        }
+      }, DEBOUNCE_MS);
+      debounceTimers.set(projectHash2, timer);
+    };
+    let watcher;
+    const startWatcher = async () => {
+      try {
+        await fs6.mkdir(projectsDir, { recursive: true });
+        watcher = fsWatch(projectsDir, { persistent: true, recursive: true }, async (eventType, filename) => {
+          if (eventType === "change") {
+            if (filename == null) return;
+            if (watcherMetrics) watcherMetrics.fileChangesDetected++;
+            const targetFile = path6.join(projectsDir, String(filename));
+            if (targetFile.endsWith("status.json")) {
+              const projectHash2 = path6.basename(path6.dirname(targetFile));
+              if (knownProjectHashes.size > 0 && !knownProjectHashes.has(projectHash2)) {
+                return;
+              }
+              if (watcherMetrics) watcherMetrics.filesProcessed++;
+              try {
+                const content = await fs6.readFile(targetFile, "utf-8");
+                const statusData = JSON.parse(content);
+                if (statusData.projectHash) {
+                  const hash = String(statusData.projectHash);
+                  if (!knownProjectHashes.has(hash)) {
+                    knownProjectHashes.add(hash);
+                    if (watcherMetrics) watcherMetrics.activeProjects = knownProjectHashes.size;
+                  }
+                }
+                scheduleBroadcast(projectHash2, statusData);
+              } catch {
+              }
+            }
+          }
+        });
+        console.log(`[setup-events] Watching ${projectsDir} for status.json changes (hash-filtered, debounced)`);
+      } catch (err) {
+        console.error("[setup-events] Failed to start status file watcher:", err);
+      }
+    };
+    events.on("client.status", (e) => {
+      if (e.projectHash) {
+        const hash = String(e.projectHash);
+        if (!knownProjectHashes.has(hash)) {
+          knownProjectHashes.add(hash);
+          if (watcherMetrics) watcherMetrics.activeProjects = knownProjectHashes.size;
+        }
+      }
+    });
+    startWatcher();
+    disposers.push(() => {
+      clearInterval(metricsInterval);
+      logWatcherMetrics();
+      if (watcherMetrics) watcherMetrics.watcherActive = false;
+      for (const [projectHash2, pending] of pendingStatuses) {
+        const timer = debounceTimers.get(projectHash2);
+        if (timer) {
+          clearTimeout(timer);
+          broadcastStatus(projectHash2, pending.data, 0);
+        }
+      }
+      for (const timer of debounceTimers.values()) {
+        clearTimeout(timer);
+      }
+      debounceTimers.clear();
+      pendingStatuses.clear();
+      if (watcher) {
+        watcher.close();
+        console.log("[setup-events] Closed status file watcher");
+      }
+    });
+  }
   const globalRoot = globalConfigPath ? path6.dirname(globalConfigPath) : void 0;
   if (globalRoot) {
-    const statusInterval = setInterval(async () => {
+    const broadcastSessions = async () => {
       try {
         const { SessionRegistry } = await import("@wrongstack/core");
         const registry = new SessionRegistry(globalRoot);
         const sessions = await registry.list();
-        const live = sessions.filter((s) => s.status !== "stale").map((s) => ({
+        const mySlug = sessions.find((s) => s.pid === process.pid)?.projectSlug;
+        const live = sessions.filter((s) => s.status !== "stale").filter((s) => mySlug ? s.projectSlug === mySlug : true).map((s) => ({
           sessionId: s.sessionId,
           projectName: s.projectName,
           projectSlug: s.projectSlug,
           projectRoot: s.projectRoot,
           workingDir: s.workingDir,
           gitBranch: s.gitBranch,
+          // Surface (tui/webui/cli) so Fleet HQ can label each live client node.
+          clientType: s.clientType,
           status: s.status,
           pid: s.pid,
           startedAt: s.startedAt,
@@ -2597,20 +3693,52 @@ function setupEvents(deps) {
             currentTool: a.currentTool,
             iterations: a.iterations,
             toolCalls: a.toolCalls,
+            costUsd: a.costUsd,
+            tokensIn: a.tokensIn,
+            tokensOut: a.tokensOut,
+            ctxPct: a.ctxPct,
+            model: a.model,
+            partialText: a.partialText,
             lastActivityAt: a.lastActivityAt
           }))
         }));
         broadcast2(clients, { type: "sessions.status_update", payload: { sessions: live } });
       } catch {
       }
-    }, 5e3);
+    };
+    onFleetBroadcaster?.(broadcastSessions);
+    const statusInterval = setInterval(() => void broadcastSessions(), 5e3);
     if (statusInterval.unref) statusInterval.unref();
+    disposers.push(() => clearInterval(statusInterval));
+    let regDebounce;
+    try {
+      const regWatcher = fsWatch(globalRoot, { persistent: false }, (_event, filename) => {
+        const name = filename ? String(filename) : "";
+        if (!name.startsWith("session-registry.json") || name.endsWith(".lock")) return;
+        if (regDebounce) clearTimeout(regDebounce);
+        regDebounce = setTimeout(() => void broadcastSessions(), 150);
+      });
+      disposers.push(() => {
+        if (regDebounce) clearTimeout(regDebounce);
+        regWatcher.close();
+      });
+    } catch {
+    }
+    void broadcastSessions();
   }
+  return () => {
+    for (const dispose of disposers) {
+      try {
+        dispose();
+      } catch {
+      }
+    }
+  };
 }
 
 // src/server/custom-context-modes.ts
 import { listContextWindowModes, atomicWrite as atomicWrite4 } from "@wrongstack/core";
-import * as fs5 from "fs/promises";
+import * as fs7 from "fs/promises";
 import * as path7 from "path";
 var STORE_FILENAME = "custom-context-modes.json";
 function storePath(wrongstackDir) {
@@ -2622,7 +3750,7 @@ function createCustomModeStore(wrongstackDir) {
   const load2 = async () => {
     modes.clear();
     try {
-      const raw = await fs5.readFile(storePath(wrongstackDir), "utf8");
+      const raw = await fs7.readFile(storePath(wrongstackDir), "utf8");
       const parsed = JSON.parse(raw);
       if (Array.isArray(parsed.modes)) {
         for (const m of parsed.modes) {
@@ -2798,60 +3926,346 @@ function createEternalSubscription(subscribe, broadcast2, clientsRef) {
       disposed = true;
       dispose();
     }
-  };
+  };
+}
+
+// src/server/shell-open.ts
+import * as fs8 from "fs/promises";
+import * as path8 from "path";
+import { spawn as spawn2 } from "child_process";
+var METACHAR_REGEX = /[&|<>^"'`\n\r]/;
+async function handleShellOpen(req, logger) {
+  try {
+    const resolved = path8.resolve(req.path);
+    await fs8.access(resolved);
+    if (METACHAR_REGEX.test(resolved)) {
+      return { success: false, message: "Path contains unsupported characters." };
+    }
+    const platform = process.platform;
+    const launch = (cmd, args, onError) => {
+      const child = spawn2(cmd, args, {
+        detached: true,
+        stdio: "ignore",
+        windowsHide: true
+      });
+      child.on("error", (err) => {
+        logger.warn(`shell.open spawn failed: ${err.message}`);
+        onError?.();
+      });
+      child.unref();
+    };
+    if (req.target === "file-manager") {
+      if (platform === "win32") launch("explorer", [resolved]);
+      else if (platform === "darwin") launch("open", [resolved]);
+      else launch("xdg-open", [resolved]);
+    } else if (req.target === "terminal") {
+      if (platform === "win32") {
+        launch("cmd", ["/c", "start", "cmd", "/k", "cd", "/d", resolved]);
+      } else if (platform === "darwin") {
+        launch("open", ["-a", "Terminal", resolved]);
+      } else {
+        launch(
+          "x-terminal-emulator",
+          [`--working-directory=${resolved}`],
+          () => launch(
+            "gnome-terminal",
+            [`--working-directory=${resolved}`],
+            () => launch("xterm", ["-e", `cd '${resolved}' && ${process.env["SHELL"] ?? "sh"}`])
+          )
+        );
+      }
+    } else {
+      return { success: false, message: `Unknown shell.open target: ${String(req.target)}` };
+    }
+    return { success: true, message: `Opened ${req.target} at ${resolved}` };
+  } catch (err) {
+    return { success: false, message: err instanceof Error ? err.message : String(err) };
+  }
+}
+
+// src/server/git-handlers.ts
+async function handleGitInfo(ws, projectRoot) {
+  const cwd = projectRoot || void 0;
+  try {
+    const { execFile: ef } = await import("child_process");
+    const git = (args) => new Promise((resolve5) => {
+      ef("git", args, { cwd, timeout: 3e3 }, (err, stdout) => {
+        resolve5(err ? "" : stdout.trim());
+      });
+    });
+    const [branchRaw, diffRaw, statusRaw, upstreamRaw] = await Promise.all([
+      git(["branch", "--show-current"]),
+      git(["diff", "--stat"]),
+      git(["status", "--porcelain"]),
+      git(["rev-list", "--left-right", "--count", "@{upstream}...HEAD"])
+    ]);
+    const branch = branchRaw || "(detached)";
+    const addMatch = /(\d+)\s+insertion/i.exec(diffRaw);
+    const delMatch = /(\d+)\s+deletion/i.exec(diffRaw);
+    const added = addMatch ? Number(addMatch[1]) : 0;
+    const deleted = delMatch ? Number(delMatch[1]) : 0;
+    const untracked = statusRaw.split("\n").filter((l) => l.startsWith("??")).length;
+    const [behindRaw, aheadRaw] = (upstreamRaw || "0	0").split("	");
+    const behind = Number(behindRaw) || 0;
+    const ahead = Number(aheadRaw) || 0;
+    send(ws, { type: "git.info", payload: { branch, added, deleted, untracked, ahead, behind } });
+  } catch {
+    send(ws, { type: "git.info", payload: { branch: "", added: 0, deleted: 0, untracked: 0, ahead: 0, behind: 0 } });
+  }
+}
+
+// src/server/skills-handlers.ts
+import { promises as fs9 } from "fs";
+import path9 from "path";
+import JSZip from "jszip";
+import { wstackGlobalRoot } from "@wrongstack/core/utils";
+async function handleSkillsContent(ws, ctx, msg) {
+  if (!ctx.skillLoader) {
+    send(ws, { type: "skills.content", payload: { name: "", body: "", path: "", source: "", relatedFiles: [], references: [], error: "Skills not enabled" } });
+    return;
+  }
+  const contentPayload = msg.payload;
+  if (!contentPayload?.name) {
+    send(ws, { type: "skills.content", payload: { name: "", body: "", path: "", source: "", relatedFiles: [], references: [], error: "Skill name is required" } });
+    return;
+  }
+  try {
+    const { name, source } = contentPayload;
+    const entries = await ctx.skillLoader.listEntries();
+    const entry = entries.find((e) => e.name.toLowerCase() === name.toLowerCase());
+    if (!entry) {
+      send(ws, { type: "skills.content", payload: { name, body: "", path: "", source, relatedFiles: [], references: [], error: `Skill "${name}" not found` } });
+      return;
+    }
+    const body = await fs9.readFile(entry.path, "utf8");
+    const skillDir = path9.dirname(entry.path);
+    let relatedFiles = [];
+    try {
+      const files = await fs9.readdir(skillDir);
+      relatedFiles = files.filter((f) => f !== path9.basename(entry.path)).map((f) => path9.join(skillDir, f));
+    } catch {
+    }
+    const nameLower = name.toLowerCase();
+    const refResults = await Promise.all(
+      entries.filter((e) => e.name.toLowerCase() !== nameLower).map(async (e) => {
+        try {
+          const content = await fs9.readFile(e.path, "utf8");
+          return [e.name, content.toLowerCase().includes(nameLower)];
+        } catch {
+          return [e.name, false];
+        }
+      })
+    );
+    const refs = refResults.filter(([, hasRef]) => hasRef).map(([n]) => n);
+    send(ws, { type: "skills.content", payload: { name, body, path: entry.path, source, relatedFiles, references: refs } });
+  } catch (err) {
+    send(ws, { type: "skills.content", payload: { name: contentPayload.name, body: "", path: "", source: contentPayload.source, relatedFiles: [], references: [], error: errMessage(err) } });
+  }
+}
+async function handleSkillsInstall(ws, ctx, msg) {
+  if (!ctx.skillInstaller) {
+    send(ws, { type: "skills.installed", payload: { success: false, error: "Skills not enabled" } });
+    return;
+  }
+  const installPayload = msg.payload;
+  if (!installPayload?.ref?.trim()) {
+    send(ws, { type: "skills.installed", payload: { success: false, error: "Skill reference is required (e.g. owner/repo or https://github.com/owner/repo)" } });
+    return;
+  }
+  try {
+    const results = await ctx.skillInstaller.install(installPayload.ref.trim(), { global: installPayload.global });
+    send(ws, {
+      type: "skills.installed",
+      payload: {
+        success: true,
+        results,
+        error: null
+      }
+    });
+  } catch (err) {
+    send(ws, {
+      type: "skills.installed",
+      payload: {
+        success: false,
+        error: errMessage(err)
+      }
+    });
+  }
+}
+async function handleSkillsUninstall(ws, ctx, msg) {
+  if (!ctx.skillInstaller) {
+    send(ws, { type: "skills.uninstalled", payload: { success: false, error: "Skills not enabled" } });
+    return;
+  }
+  const uninstallPayload = msg.payload;
+  if (!uninstallPayload?.name?.trim()) {
+    send(ws, { type: "skills.uninstalled", payload: { success: false, error: "Skill name is required" } });
+    return;
+  }
+  try {
+    await ctx.skillInstaller.uninstall(uninstallPayload.name.trim(), { global: uninstallPayload.global });
+    send(ws, { type: "skills.uninstalled", payload: { success: true, error: null } });
+  } catch (err) {
+    send(ws, { type: "skills.uninstalled", payload: { success: false, error: errMessage(err) } });
+  }
+}
+async function handleSkillsUpdate(ws, ctx, msg) {
+  if (!ctx.skillInstaller) {
+    send(ws, { type: "skills.updated", payload: { success: false, error: "Skills not enabled" } });
+    return;
+  }
+  const updatePayload = msg.payload;
+  try {
+    const result = await ctx.skillInstaller.update(updatePayload?.name, { global: updatePayload?.global });
+    send(ws, {
+      type: "skills.updated",
+      payload: {
+        success: true,
+        error: null,
+        updated: result.updated,
+        unchanged: result.unchanged,
+        errors: result.errors
+      }
+    });
+  } catch (err) {
+    send(ws, { type: "skills.updated", payload: { success: false, error: errMessage(err) } });
+  }
+}
+async function handleSkillsCreate(ws, ctx, msg) {
+  const createPayload = msg.payload;
+  if (!createPayload?.name?.trim()) {
+    send(ws, { type: "skills.created", payload: { success: false, error: "Skill name is required" } });
+    return;
+  }
+  if (!/^[a-z0-9]+(-[a-z0-9]+)*$/.test(createPayload.name.trim())) {
+    send(ws, { type: "skills.created", payload: { success: false, error: "Skill name must be kebab-case (e.g. my-new-skill)" } });
+    return;
+  }
+  if (!createPayload?.description?.trim()) {
+    send(ws, { type: "skills.created", payload: { success: false, error: "Description/trigger is required" } });
+    return;
+  }
+  try {
+    const targetDir = createPayload.scope === "global" ? path9.join(wstackGlobalRoot(), "skills", createPayload.name.trim()) : path9.join(ctx.projectRoot, ".wrongstack", "skills", createPayload.name.trim());
+    try {
+      await fs9.access(targetDir);
+      send(ws, { type: "skills.created", payload: { success: false, error: `Skill "${createPayload.name}" already exists` } });
+      return;
+    } catch {
+    }
+    await fs9.mkdir(targetDir, { recursive: true });
+    const lines = createPayload.description.trim().split("\n");
+    const firstLine = lines[0].trim();
+    const bodyLines = lines.slice(1).map((l) => l.trim()).filter(Boolean);
+    const descriptionText = firstLine + (bodyLines.length > 0 ? `
+${bodyLines.join("\n")}` : "");
+    const trigger = bodyLines.find((l) => l.toLowerCase().startsWith("triggers:")) ?? "";
+    const skillContent = [
+      "---",
+      `name: ${createPayload.name.trim()}`,
+      "description: |",
+      `  ${descriptionText.replace(/\n/g, "\n  ")}`,
+      `version: 1.0.0`,
+      "---",
+      "",
+      `# ${createPayload.name.trim().split("-").map((w) => w.charAt(0).toUpperCase() + w.slice(1)).join(" ")}`,
+      "",
+      "## Overview",
+      "",
+      firstLine,
+      "",
+      ...bodyLines.length > 0 ? bodyLines.filter((l) => !l.toLowerCase().startsWith("triggers:")) : [],
+      "",
+      "## Rules",
+      "- TODO: add your first rule",
+      "",
+      "## Patterns",
+      "### Do",
+      "```ts",
+      "// TODO: add a good example",
+      "```",
+      "",
+      "### Don't",
+      "```ts",
+      "// TODO: add a bad example",
+      "```",
+      "",
+      "## Workflow",
+      "1. TODO: describe step one",
+      "2. TODO: describe step two",
+      "",
+      trigger ? `
+${trigger}
+` : "",
+      "## Skills in scope",
+      "- `bug-hunter` \u2014 for systematic bug detection patterns",
+      "- `output-standards` \u2014 for standardized `<next_steps>` formatting"
+    ].join("\n");
+    await fs9.writeFile(path9.join(targetDir, "SKILL.md"), skillContent, "utf-8");
+    send(ws, {
+      type: "skills.created",
+      payload: {
+        success: true,
+        error: null,
+        skill: { name: createPayload.name.trim(), path: path9.join(targetDir, "SKILL.md"), scope: createPayload.scope }
+      }
+    });
+  } catch (err) {
+    send(ws, { type: "skills.created", payload: { success: false, error: errMessage(err) } });
+  }
+}
+async function handleSkillsEdit(ws, ctx, msg) {
+  if (!ctx.skillLoader) {
+    send(ws, { type: "skills.edited", payload: { success: false, error: "Skills not enabled" } });
+    return;
+  }
+  const editPayload = msg.payload;
+  if (!editPayload?.name?.trim()) {
+    send(ws, { type: "skills.edited", payload: { success: false, error: "Skill name is required" } });
+    return;
+  }
+  if (!editPayload?.body) {
+    send(ws, { type: "skills.edited", payload: { success: false, error: "Skill body is required" } });
+    return;
+  }
+  try {
+    const entries = await ctx.skillLoader.listEntries();
+    const entry = entries.find((e) => e.name.toLowerCase() === editPayload.name.toLowerCase());
+    if (!entry) {
+      send(ws, { type: "skills.edited", payload: { success: false, error: `Skill "${editPayload.name}" not found` } });
+      return;
+    }
+    if (entry.scope.includes("bundled")) {
+      send(ws, { type: "skills.edited", payload: { success: false, error: "Bundled skills cannot be edited" } });
+      return;
+    }
+    await fs9.writeFile(entry.path, editPayload.body, "utf-8");
+    send(ws, { type: "skills.edited", payload: { success: true, error: null } });
+  } catch (err) {
+    send(ws, { type: "skills.edited", payload: { success: false, error: errMessage(err) } });
+  }
 }
-
-// src/server/shell-open.ts
-import * as fs6 from "fs/promises";
-import * as path8 from "path";
-import { spawn as spawn2 } from "child_process";
-var METACHAR_REGEX = /[&|<>^"'`\n\r]/;
-async function handleShellOpen(req, logger) {
+async function handleSkillsExport(ws, ctx) {
+  if (!ctx.skillLoader) {
+    send(ws, { type: "skills.exported", payload: { zipBase64: "", skillCount: 0, error: "Skills not enabled" } });
+    return;
+  }
   try {
-    const resolved = path8.resolve(req.path);
-    await fs6.access(resolved);
-    if (METACHAR_REGEX.test(resolved)) {
-      return { success: false, message: "Path contains unsupported characters." };
-    }
-    const platform = process.platform;
-    const launch = (cmd, args, onError) => {
-      const child = spawn2(cmd, args, {
-        detached: true,
-        stdio: "ignore",
-        windowsHide: true
-      });
-      child.on("error", (err) => {
-        logger.warn(`shell.open spawn failed: ${err.message}`);
-        onError?.();
-      });
-      child.unref();
-    };
-    if (req.target === "file-manager") {
-      if (platform === "win32") launch("explorer", [resolved]);
-      else if (platform === "darwin") launch("open", [resolved]);
-      else launch("xdg-open", [resolved]);
-    } else if (req.target === "terminal") {
-      if (platform === "win32") {
-        launch("cmd", ["/c", "start", "cmd", "/k", "cd", "/d", resolved]);
-      } else if (platform === "darwin") {
-        launch("open", ["-a", "Terminal", resolved]);
-      } else {
-        launch(
-          "x-terminal-emulator",
-          [`--working-directory=${resolved}`],
-          () => launch(
-            "gnome-terminal",
-            [`--working-directory=${resolved}`],
-            () => launch("xterm", ["-e", `cd '${resolved}' && ${process.env["SHELL"] ?? "sh"}`])
-          )
-        );
+    const entries = await ctx.skillLoader.listEntries();
+    const zip = new JSZip();
+    for (const entry of entries) {
+      try {
+        const body = await ctx.skillLoader.readBody(entry.name);
+        const safeName = entry.name.replace(/\//g, "_");
+        zip.file(`${safeName}/SKILL.md`, body);
+      } catch {
       }
-    } else {
-      return { success: false, message: `Unknown shell.open target: ${String(req.target)}` };
     }
-    return { success: true, message: `Opened ${req.target} at ${resolved}` };
+    const zipBuffer = await zip.generateAsync({ type: "nodebuffer", compression: "DEFLATE" });
+    const zipBase64 = zipBuffer.toString("base64");
+    send(ws, { type: "skills.exported", payload: { zipBase64, skillCount: entries.length, error: void 0 } });
   } catch (err) {
-    return { success: false, message: err instanceof Error ? err.message : String(err) };
+    send(ws, { type: "skills.exported", payload: { zipBase64: "", skillCount: 0, error: errMessage(err) } });
   }
 }
 
@@ -2920,7 +4334,7 @@ async function startWebUI(opts = {}) {
     console.warn(JSON.stringify({
       level: "warn",
       event: "webui.provider_registry_load_failed",
-      message: err instanceof Error ? err.message : String(err),
+      message: toErrorMessage5(err),
       timestamp: (/* @__PURE__ */ new Date()).toISOString()
     }));
   }
@@ -2969,15 +4383,22 @@ async function startWebUI(opts = {}) {
       sessionId: session.id,
       projectSlug: wpaths.projectSlug,
       projectRoot,
-      projectName: path9.basename(projectRoot),
+      projectName: path10.basename(projectRoot),
       workingDir,
+      clientType: "webui",
       pid: process.pid,
       startedAt: (/* @__PURE__ */ new Date()).toISOString()
     });
-    statusTracker = new AgentStatusTracker({ events, registry });
+    const fleetNotifier = new FleetNotifier({
+      baseDir: wpaths.globalRoot,
+      projectRoot,
+      selfPid: process.pid
+    });
+    statusTracker = new AgentStatusTracker({ events, registry, onUpdate: () => fleetNotifier.notify() });
     statusTracker.start();
     const stopTracking = async () => {
       try {
+        fleetNotifier.dispose();
         await registry.markClosing();
         statusTracker?.stop();
       } catch {
@@ -3017,6 +4438,13 @@ async function startWebUI(opts = {}) {
     supportsReasoning: resolvedModel.capabilities.reasoning
   } : void 0;
   const skillLoader = config.features.skills ? new DefaultSkillLoader2({ paths: wpaths }) : void 0;
+  const skillInstaller = config.features.skills ? new SkillInstaller({
+    manifestPath: path10.join(wstackGlobalRoot2(), "installed-skills.json"),
+    projectSkillsDir: path10.join(projectRoot, ".wrongstack", "skills"),
+    globalSkillsDir: path10.join(wstackGlobalRoot2(), "skills"),
+    projectHash: projectHash(projectRoot),
+    skillLoader
+  }) : void 0;
   const systemPromptBuilder = new DefaultSystemPromptBuilder2({
     memoryStore,
     skillLoader,
@@ -3057,7 +4485,7 @@ async function startWebUI(opts = {}) {
       console.error(JSON.stringify({
         level: "error",
         event: "webui.provider_create_failed",
-        message: err instanceof Error ? err.message : String(err),
+        message: toErrorMessage5(err),
         timestamp: (/* @__PURE__ */ new Date()).toISOString()
       }));
       throw err;
@@ -3079,14 +4507,14 @@ async function startWebUI(opts = {}) {
         console.error(JSON.stringify({
           level: "error",
           event: "webui.provider_stub_create_failed",
-          message: err instanceof Error ? err.message : String(err),
+          message: toErrorMessage5(err),
           timestamp: (/* @__PURE__ */ new Date()).toISOString()
         }));
         throw err;
       }
     } else {
       throw new Error(
-        "No provider configured. Run `wrongstack init` first, or configure via the WebUI."
+        "No provider configured. Run `wrongstack auth` to set up, or configure via the WebUI."
       );
     }
   }
@@ -3128,6 +4556,12 @@ async function startWebUI(opts = {}) {
     context.meta["logLevel"] = config.log?.level ?? "info";
     context.meta["auditLevel"] = config.session?.auditLevel ?? "standard";
     context.meta["maxIterations"] = config.tools?.maxIterations ?? 500;
+    const tgExt = config.extensions?.["telegram"];
+    context.meta["tgConfigured"] = typeof tgExt?.["botToken"] === "string" && tgExt["botToken"].length > 0;
+    context.meta["tgSessionEnd"] = tgExt?.["notifyOnSessionEnd"] === true;
+    context.meta["tgDelegate"] = tgExt?.["notifyOnDelegate"] !== false;
+    const tgMs = tgExt?.["longToolThresholdMs"];
+    context.meta["tgLongToolMs"] = typeof tgMs === "number" ? tgMs : 3e4;
   }
   const PREF_KEYS = [
     "autonomy",
@@ -3151,7 +4585,11 @@ async function startWebUI(opts = {}) {
     "contextAutoCompact",
     "contextStrategy",
     "logLevel",
-    "auditLevel"
+    "auditLevel",
+    "tgConfigured",
+    "tgSessionEnd",
+    "tgDelegate",
+    "tgLongToolMs"
   ];
   const prefSnapshot = () => {
     const snapshot = {};
@@ -3164,7 +4602,7 @@ async function startWebUI(opts = {}) {
     const write = async () => {
       let raw;
       try {
-        raw = await fs7.readFile(globalConfigPath, "utf8");
+        raw = await fs10.readFile(globalConfigPath, "utf8");
       } catch {
         raw = "{}";
       }
@@ -3236,6 +4674,22 @@ async function startWebUI(opts = {}) {
         toolsCfg.maxIterations = payload["maxIterations"];
         decrypted.tools = toolsCfg;
       }
+      const tgTouched = typeof payload["tgSessionEnd"] === "boolean" || typeof payload["tgDelegate"] === "boolean" || typeof payload["tgLongToolMs"] === "number";
+      if (tgTouched) {
+        const ext = decrypted.extensions ?? {};
+        const tg = ext["telegram"] ?? {};
+        if (typeof payload["tgSessionEnd"] === "boolean") {
+          tg["notifyOnSessionEnd"] = payload["tgSessionEnd"];
+        }
+        if (typeof payload["tgDelegate"] === "boolean") {
+          tg["notifyOnDelegate"] = payload["tgDelegate"];
+        }
+        if (typeof payload["tgLongToolMs"] === "number") {
+          tg["longToolThresholdMs"] = payload["tgLongToolMs"];
+        }
+        ext["telegram"] = tg;
+        decrypted.extensions = ext;
+      }
       const encrypted = encryptConfigSecrets2(decrypted, vault);
       await atomicWrite5(globalConfigPath, JSON.stringify(encrypted, null, 2), { mode: 384 });
     };
@@ -3457,7 +4911,7 @@ async function startWebUI(opts = {}) {
       inputCost,
       outputCost,
       cacheReadCost,
-      projectName: path9.basename(projectRoot) || projectRoot,
+      projectName: path10.basename(projectRoot) || projectRoot,
       projectRoot,
       cwd: workingDir,
       mode: modeId,
@@ -3511,10 +4965,11 @@ async function startWebUI(opts = {}) {
   const RATE_LIMIT_MESSAGES = Number.parseInt(process.env["WEBUI_RATE_LIMIT"] ?? "0", 10);
   const RATE_LIMIT_WINDOW_MS = 6e4;
   const rateLimits = /* @__PURE__ */ new Map();
-  function checkRateLimit(ws, client) {
+  let connSeq = 0;
+  function checkRateLimit(_ws, client) {
     if (RATE_LIMIT_MESSAGES <= 0) return true;
     const now = Date.now();
-    const key = client.sessionId ?? String(ws);
+    const key = client.connId;
     const limit = rateLimits.get(key);
     if (!limit || now > limit.resetAt) {
       rateLimits.set(key, { count: 1, resetAt: now + RATE_LIMIT_WINDOW_MS });
@@ -3530,7 +4985,12 @@ async function startWebUI(opts = {}) {
   );
   const pendingConfirms = /* @__PURE__ */ new Map();
   const handleConnection = (ws) => {
-    const client = { ws, sessionId: session.id, connectedAt: Date.now() };
+    const client = {
+      ws,
+      sessionId: session.id,
+      connectedAt: Date.now(),
+      connId: `c${++connSeq}`
+    };
     clients.set(ws, client);
     void sessionStartPayload().then((payload) => {
       send(ws, { type: "session.start", payload });
@@ -3538,7 +4998,7 @@ async function startWebUI(opts = {}) {
       console.warn(JSON.stringify({
         level: "warn",
         event: "webui.session_start_payload_failed",
-        message: err instanceof Error ? err.message : String(err),
+        message: toErrorMessage5(err),
         timestamp: (/* @__PURE__ */ new Date()).toISOString()
       }));
     });
@@ -3560,7 +5020,7 @@ async function startWebUI(opts = {}) {
         const rawObj = JSON.parse(data.toString());
         if (typeof rawObj === "object" && rawObj !== null) {
           const obj = rawObj;
-          if ("__proto__" in obj || "constructor" in obj || "prototype" in obj) {
+          if (Object.hasOwn(obj, "__proto__") || Object.hasOwn(obj, "constructor") || Object.hasOwn(obj, "prototype")) {
             send(ws, {
               type: "error",
               payload: { phase: "parse", message: "Invalid message object" }
@@ -3575,17 +5035,18 @@ async function startWebUI(opts = {}) {
         console.error(JSON.stringify({
           level: "error",
           event: "webui.ws_message_parse_failed",
-          message: err instanceof Error ? err.message : String(err),
+          message: toErrorMessage5(err),
           timestamp: (/* @__PURE__ */ new Date()).toISOString()
         }));
       }
     });
     ws.on("close", () => {
+      const closing = clients.get(ws);
       clients.delete(ws);
-      rateLimits.delete(String(ws));
+      if (closing) rateLimits.delete(closing.connId);
       if (pendingConfirms.size > 0) {
-        for (const [id, resolve6] of pendingConfirms) {
-          resolve6("no");
+        for (const [id, resolve5] of pendingConfirms) {
+          resolve5("no");
           pendingConfirms.delete(id);
         }
       }
@@ -3608,11 +5069,27 @@ async function startWebUI(opts = {}) {
     { sampling: sessionLogging.sampling }
   );
   let eventsArmed = false;
+  let disposeEvents = null;
+  let fleetBroadcast = null;
   const armOnce = (label) => {
     if (eventsArmed) return;
     eventsArmed = true;
     console.log(`[WebUI] Backend ready (${label})`);
-    setupEvents({ events, broadcast, clients, config, context, pendingConfirms, globalConfigPath, sessionBridge });
+    disposeEvents = setupEvents({
+      events,
+      broadcast,
+      clients,
+      config,
+      context,
+      pendingConfirms,
+      globalConfigPath,
+      sessionBridge,
+      wpaths,
+      watcherMetrics,
+      onFleetBroadcaster: (fn) => {
+        fleetBroadcast = fn;
+      }
+    });
   };
   wssPrimary.on("listening", () => armOnce(`${wsHost}:${wsPort}`));
   wssPrimary.on("connection", handleConnection);
@@ -3621,7 +5098,7 @@ async function startWebUI(opts = {}) {
       level: "error",
       event: "webui.ws_server_error",
       host: wsHost,
-      message: err instanceof Error ? err.message : String(err),
+      message: toErrorMessage5(err),
       timestamp: (/* @__PURE__ */ new Date()).toISOString()
     }));
   });
@@ -3649,33 +5126,33 @@ async function startWebUI(opts = {}) {
     });
   }
   async function touchProjectEntry(root, workDir) {
-    const resolved = path9.resolve(root);
+    const resolved = path10.resolve(root);
     const manifest = await loadManifest(globalConfigPath);
     const now = (/* @__PURE__ */ new Date()).toISOString();
-    const existing = manifest.projects.find((p) => path9.resolve(p.root) === resolved);
+    const existing = manifest.projects.find((p) => path10.resolve(p.root) === resolved);
     if (existing) {
       existing.lastSeen = now;
-      if (workDir) existing.lastWorkingDir = path9.resolve(workDir);
+      if (workDir) existing.lastWorkingDir = path10.resolve(workDir);
     } else {
       manifest.projects.push({
-        name: path9.basename(resolved),
+        name: path10.basename(resolved),
         root: resolved,
         slug: generateProjectSlug(resolved),
         createdAt: now,
         lastSeen: now,
-        lastWorkingDir: workDir ? path9.resolve(workDir) : void 0
+        lastWorkingDir: workDir ? path10.resolve(workDir) : void 0
       });
     }
     await saveManifest(manifest, globalConfigPath);
     await ensureProjectDataDir(generateProjectSlug(resolved), globalConfigPath);
   }
   function projectsJsonPath(globalConfigPath2) {
-    const base = path9.dirname(globalConfigPath2);
-    return path9.join(base, "projects.json");
+    const base = path10.dirname(globalConfigPath2);
+    return path10.join(base, "projects.json");
   }
   async function loadManifest(globalConfigPath2) {
     try {
-      const raw = await fs7.readFile(projectsJsonPath(globalConfigPath2), "utf8");
+      const raw = await fs10.readFile(projectsJsonPath(globalConfigPath2), "utf8");
       const parsed = JSON.parse(raw);
       return { projects: parsed.projects ?? [] };
     } catch {
@@ -3684,16 +5161,16 @@ async function startWebUI(opts = {}) {
   }
   async function saveManifest(manifest, globalConfigPath2) {
     const file = projectsJsonPath(globalConfigPath2);
-    await fs7.mkdir(path9.dirname(file), { recursive: true });
-    await fs7.writeFile(file, JSON.stringify(manifest, null, 2), "utf8");
+    await fs10.mkdir(path10.dirname(file), { recursive: true });
+    await fs10.writeFile(file, JSON.stringify(manifest, null, 2), "utf8");
   }
   function generateProjectSlug(rootPath) {
     return projectSlug(rootPath);
   }
   async function ensureProjectDataDir(slug, globalConfigPath2) {
-    const base = path9.dirname(globalConfigPath2);
-    const dir = path9.join(base, "projects", slug);
-    await fs7.mkdir(dir, { recursive: true });
+    const base = path10.dirname(globalConfigPath2);
+    const dir = path10.join(base, "projects", slug);
+    await fs10.mkdir(dir, { recursive: true });
     return dir;
   }
   async function handleMessage(ws, _client, msg) {
@@ -3704,7 +5181,9 @@ async function startWebUI(opts = {}) {
       case "collab.join":
       case "collab.leave":
       case "collab.annotate":
-      case "collab.resolve": {
+      case "collab.resolve":
+      case "collab.request_pause":
+      case "collab.resume": {
         collabHandler.handleMessage(ws, msg);
         return;
       }
@@ -3755,10 +5234,10 @@ async function startWebUI(opts = {}) {
       }
       case "tool.confirm_result": {
         const { id, decision } = msg.payload;
-        const resolve6 = pendingConfirms.get(id);
-        if (resolve6) {
+        const resolve5 = pendingConfirms.get(id);
+        if (resolve5) {
           pendingConfirms.delete(id);
-          resolve6(decision);
+          resolve5(decision);
         }
         break;
       }
@@ -3801,7 +5280,7 @@ async function startWebUI(opts = {}) {
         context.readFiles.clear();
         context.fileMtimes.clear();
         tokenCounter.reset();
-        sendResult(ws, true, "Context cleared");
+        sendResult2(ws, true, "Context cleared");
         broadcast(clients, {
           type: "session.start",
           payload: { ...await sessionStartPayload(), reset: true }
@@ -3838,13 +5317,13 @@ async function startWebUI(opts = {}) {
               repaired: report.repaired
             }
           });
-          sendResult(
+          sendResult2(
             ws,
             true,
             `Compacted: ${report.before} \u2192 ${report.after} tokens (saved ~${Math.max(0, report.before - report.after)})`
           );
         } catch (err) {
-          sendResult(ws, false, errMessage(err));
+          sendResult2(ws, false, errMessage(err));
         }
         break;
       }
@@ -3863,7 +5342,7 @@ async function startWebUI(opts = {}) {
         };
         broadcast(clients, { type: "context.repaired", payload });
         const removed = payload.removedToolUses.length + payload.removedToolResults.length + payload.removedMessages;
-        sendResult(
+        sendResult2(
           ws,
           true,
           removed > 0 ? `Context repaired: removed ${removed} orphan protocol item(s)` : "Context repair found no orphan protocol blocks"
@@ -3897,14 +5376,14 @@ async function startWebUI(opts = {}) {
           );
           const custom = customModes.find((m) => m.id === id);
           if (!custom) {
-            sendResult(ws, false, `Unknown context mode "${id}"`);
+            sendResult2(ws, false, `Unknown context mode "${id}"`);
             break;
           }
           policy = custom;
         }
         context.meta["contextWindowMode"] = policy.id;
         context.meta["contextWindowPolicy"] = policy;
-        sendResult(ws, true, `Context mode switched to ${policy.id}`);
+        sendResult2(ws, true, `Context mode switched to ${policy.id}`);
         broadcast(clients, {
           type: "context.mode.changed",
           payload: { id: policy.id, name: policy.name, policy }
@@ -3924,7 +5403,7 @@ async function startWebUI(opts = {}) {
           aggressiveOn: "soft",
           targetLoad: 0.65
         });
-        sendResult(ws, result.ok, result.error ?? `Mode "${payload.id}" created`);
+        sendResult2(ws, result.ok, result.error ?? `Mode "${payload.id}" created`);
         break;
       }
       case "context.mode.update": {
@@ -3940,7 +5419,7 @@ async function startWebUI(opts = {}) {
           preserveK: payload.preserveK,
           eliseThreshold: payload.eliseThreshold
         });
-        sendResult(ws, result.ok, result.error ?? `Mode "${payload.id}" updated`);
+        sendResult2(ws, result.ok, result.error ?? `Mode "${payload.id}" updated`);
         break;
       }
       case "context.mode.delete": {
@@ -3950,7 +5429,7 @@ async function startWebUI(opts = {}) {
           context.meta["contextWindowPolicy"] = resolveContextWindowPolicy({}, DEFAULT_CONTEXT_WINDOW_MODE_ID);
         }
         const result = customModeStore.remove(id);
-        sendResult(ws, result.ok, result.error ?? `Mode "${id}" deleted`);
+        sendResult2(ws, result.ok, result.error ?? `Mode "${id}" deleted`);
         break;
       }
       case "providers.list": {
@@ -4031,19 +5510,20 @@ async function startWebUI(opts = {}) {
           context.provider = newProv;
           updateAutoCompactionMaxContext?.(newProv);
           try {
-            configWriteLock = configWriteLock.then(async () => {
-              const raw = await fs7.readFile(globalConfigPath, "utf8");
+            const next = configWriteLock.then(async () => {
+              const raw = await fs10.readFile(globalConfigPath, "utf8");
               const parsed = JSON.parse(raw);
               parsed.provider = newProvider;
               parsed.model = newModel;
               await atomicWrite5(globalConfigPath, JSON.stringify(parsed, null, 2));
             });
-            await configWriteLock;
+            configWriteLock = next.then(() => void 0, () => void 0);
+            await next;
           } catch (err) {
             console.warn(JSON.stringify({
               level: "warn",
               event: "webui.config_save_failed",
-              message: err instanceof Error ? err.message : String(err),
+              message: toErrorMessage5(err),
               timestamp: (/* @__PURE__ */ new Date()).toISOString()
             }));
           }
@@ -4141,6 +5621,26 @@ async function startWebUI(opts = {}) {
         await providerHandlers.handleProviderRemove(ws, providerId);
         break;
       }
+      case "provider.clear_models": {
+        const { providerId } = msg.payload;
+        await providerHandlers.handleProviderClearModels(ws, providerId);
+        break;
+      }
+      case "provider.undo_clear": {
+        const { providerId, previousModels } = msg.payload;
+        await providerHandlers.handleProviderUndoClear(ws, providerId, previousModels);
+        break;
+      }
+      case "provider.update": {
+        const p = msg.payload;
+        await providerHandlers.handleProviderUpdate(ws, p);
+        break;
+      }
+      case "provider.probe": {
+        const { providerId, timeoutMs } = msg.payload;
+        await providerHandlers.handleProviderProbe(ws, providerId, timeoutMs);
+        break;
+      }
       case "sessions.list": {
         const limit = msg.payload?.limit ?? 50;
         try {
@@ -4171,13 +5671,13 @@ async function startWebUI(opts = {}) {
         const { id } = msg.payload;
         try {
           if (id === session.id) {
-            sendResult(ws, false, "Cannot delete the active session");
+            sendResult2(ws, false, "Cannot delete the active session");
             break;
           }
           await sessionStore.delete(id);
-          sendResult(ws, true, `Session ${id} deleted`);
+          sendResult2(ws, true, `Session ${id} deleted`);
         } catch (err) {
-          sendResult(ws, false, errMessage(err));
+          sendResult2(ws, false, errMessage(err));
         }
         break;
       }
@@ -4185,7 +5685,7 @@ async function startWebUI(opts = {}) {
         const { id } = msg.payload;
         try {
           if (id === session.id) {
-            sendResult(ws, false, "Session is already active");
+            sendResult2(ws, false, "Session is already active");
             break;
           }
           const resumed = await sessionStore.resume(id);
@@ -4215,14 +5715,14 @@ async function startWebUI(opts = {}) {
               replayUsage: resumed.data.usage
             }
           });
-          sendResult(ws, true, `Resumed session ${id}`);
+          sendResult2(ws, true, `Resumed session ${id}`);
         } catch (err) {
-          sendResult(ws, false, errMessage(err));
+          sendResult2(ws, false, errMessage(err));
         }
         break;
       }
       case "session.save": {
-        sendResult(ws, true, `Session ${session.id} is auto-saved`);
+        sendResult2(ws, true, `Session ${session.id} is auto-saved`);
         break;
       }
       case "tools.list": {
@@ -4245,6 +5745,27 @@ async function startWebUI(opts = {}) {
         return handleMemoryRemember(ws, msg, memoryStore);
       case "memory.forget":
         return handleMemoryForget(ws, msg, memoryStore);
+      // ── MCP operations — delegated to shared handlers (mcp-handlers.ts) ──
+      case "mcp.list":
+        return handleMcpList(ws, msg, config, globalConfigPath, void 0);
+      case "mcp.add":
+        return handleMcpAdd(ws, msg, config, globalConfigPath, void 0);
+      case "mcp.remove":
+        return handleMcpRemove(ws, msg, config, globalConfigPath, void 0);
+      case "mcp.update":
+        return handleMcpUpdate(ws, msg, config, globalConfigPath);
+      case "mcp.wake":
+        return handleMcpWake(ws, msg, config, globalConfigPath, void 0);
+      case "mcp.sleep":
+        return handleMcpSleep(ws, msg, config, globalConfigPath, void 0);
+      case "mcp.discover":
+        return handleMcpDiscover(ws, msg, config, globalConfigPath);
+      case "mcp.enable":
+        return handleMcpEnable(ws, msg, config, globalConfigPath);
+      case "mcp.disable":
+        return handleMcpDisable(ws, msg, config, globalConfigPath);
+      case "mcp.restart":
+        return handleMcpRestart(ws, msg, config, globalConfigPath);
       case "skills.list": {
         if (!skillLoader) {
           send(ws, { type: "skills.list", payload: { skills: [], enabled: false } });
@@ -4254,6 +5775,18 @@ async function startWebUI(opts = {}) {
           const manifests = await skillLoader.list();
           const entries = await skillLoader.listEntries();
           const byName = new Map(entries.map((e) => [e.name, e]));
+          const sourceUrlsByName = /* @__PURE__ */ new Map();
+          const refsByName = /* @__PURE__ */ new Map();
+          if (skillInstaller) {
+            try {
+              const installed = await skillInstaller.listInstalled();
+              for (const entry of installed) {
+                sourceUrlsByName.set(entry.name, entry.source);
+                refsByName.set(entry.name, entry.ref);
+              }
+            } catch {
+            }
+          }
           send(ws, {
             type: "skills.list",
             payload: {
@@ -4263,6 +5796,8 @@ async function startWebUI(opts = {}) {
                 description: m.description,
                 version: m.version ?? "",
                 source: m.source,
+                sourceUrl: sourceUrlsByName.get(m.name) ?? "",
+                ref: refsByName.get(m.name) ?? "",
                 path: m.path,
                 trigger: byName.get(m.name)?.trigger ?? "",
                 scope: byName.get(m.name)?.scope ?? []
@@ -4281,6 +5816,261 @@ async function startWebUI(opts = {}) {
         }
         break;
       }
+      case "skills.content": {
+        if (!skillLoader) {
+          send(ws, { type: "skills.content", payload: { name: "", body: "", path: "", source: "", relatedFiles: [], references: [], error: "Skills not enabled" } });
+          break;
+        }
+        const contentPayload = msg.payload;
+        if (!contentPayload?.name) {
+          send(ws, { type: "skills.content", payload: { name: "", body: "", path: "", source: "", relatedFiles: [], references: [], error: "Skill name is required" } });
+          break;
+        }
+        try {
+          const { name, source } = contentPayload;
+          const entries = await skillLoader.listEntries();
+          const entry = entries.find((e) => e.name.toLowerCase() === name.toLowerCase());
+          if (!entry) {
+            send(ws, { type: "skills.content", payload: { name, body: "", path: "", source, relatedFiles: [], references: [], error: `Skill "${name}" not found` } });
+            break;
+          }
+          const body = await skillLoader.readBody(name);
+          const skillDir = path10.dirname(entry.path);
+          let relatedFiles = [];
+          try {
+            const files = await fs10.readdir(skillDir);
+            relatedFiles = files.filter((f) => f !== path10.basename(entry.path)).map((f) => path10.join(skillDir, f));
+          } catch {
+          }
+          const refs = [];
+          for (const e of entries) {
+            if (e.name.toLowerCase() === name.toLowerCase()) continue;
+            try {
+              const content = await skillLoader.readBody(e.name);
+              if (content.toLowerCase().includes(name.toLowerCase())) {
+                refs.push(e.name);
+              }
+            } catch {
+            }
+          }
+          send(ws, { type: "skills.content", payload: { name, body, path: entry.path, source, relatedFiles, references: refs } });
+        } catch (err) {
+          send(ws, { type: "skills.content", payload: { name: contentPayload.name, body: "", path: "", source: contentPayload.source, relatedFiles: [], references: [], error: errMessage(err) } });
+        }
+        break;
+      }
+      case "skills.install": {
+        if (!skillInstaller) {
+          send(ws, { type: "skills.installed", payload: { success: false, error: "Skills not enabled" } });
+          break;
+        }
+        const installPayload = msg.payload;
+        if (!installPayload?.ref?.trim()) {
+          send(ws, { type: "skills.installed", payload: { success: false, error: "Skill reference is required (e.g. owner/repo or https://github.com/owner/repo)" } });
+          break;
+        }
+        try {
+          const results = await skillInstaller.install(installPayload.ref.trim(), { global: installPayload.global });
+          send(ws, {
+            type: "skills.installed",
+            payload: {
+              success: true,
+              results,
+              error: null
+            }
+          });
+        } catch (err) {
+          send(ws, {
+            type: "skills.installed",
+            payload: {
+              success: false,
+              error: errMessage(err)
+            }
+          });
+        }
+        break;
+      }
+      case "skills.uninstall": {
+        if (!skillInstaller) {
+          send(ws, { type: "skills.uninstalled", payload: { success: false, error: "Skills not enabled" } });
+          break;
+        }
+        const uninstallPayload = msg.payload;
+        if (!uninstallPayload?.name?.trim()) {
+          send(ws, { type: "skills.uninstalled", payload: { success: false, error: "Skill name is required" } });
+          break;
+        }
+        try {
+          await skillInstaller.uninstall(uninstallPayload.name.trim(), { global: uninstallPayload.global });
+          send(ws, { type: "skills.uninstalled", payload: { success: true, error: null } });
+        } catch (err) {
+          send(ws, { type: "skills.uninstalled", payload: { success: false, error: errMessage(err) } });
+        }
+        break;
+      }
+      case "skills.update": {
+        if (!skillInstaller) {
+          send(ws, { type: "skills.updated", payload: { success: false, error: "Skills not enabled" } });
+          break;
+        }
+        const updatePayload = msg.payload;
+        try {
+          const result = await skillInstaller.update(updatePayload?.name, { global: updatePayload?.global });
+          send(ws, {
+            type: "skills.updated",
+            payload: {
+              success: true,
+              error: null,
+              updated: result.updated,
+              unchanged: result.unchanged,
+              errors: result.errors
+            }
+          });
+        } catch (err) {
+          send(ws, { type: "skills.updated", payload: { success: false, error: errMessage(err) } });
+        }
+        break;
+      }
+      case "skills.create": {
+        const createPayload = msg.payload;
+        if (!createPayload?.name?.trim()) {
+          send(ws, { type: "skills.created", payload: { success: false, error: "Skill name is required" } });
+          break;
+        }
+        if (!/^[a-z0-9]+(-[a-z0-9]+)*$/.test(createPayload.name.trim())) {
+          send(ws, { type: "skills.created", payload: { success: false, error: "Skill name must be kebab-case (e.g. my-new-skill)" } });
+          break;
+        }
+        if (!createPayload?.description?.trim()) {
+          send(ws, { type: "skills.created", payload: { success: false, error: "Description/trigger is required" } });
+          break;
+        }
+        try {
+          const targetDir = createPayload.scope === "global" ? path10.join(wstackGlobalRoot2(), "skills", createPayload.name.trim()) : path10.join(projectRoot, ".wrongstack", "skills", createPayload.name.trim());
+          try {
+            await fs10.access(targetDir);
+            send(ws, { type: "skills.created", payload: { success: false, error: `Skill "${createPayload.name}" already exists` } });
+            break;
+          } catch {
+          }
+          await fs10.mkdir(targetDir, { recursive: true });
+          const lines = createPayload.description.trim().split("\n");
+          const firstLine = lines[0].trim();
+          const bodyLines = lines.slice(1).map((l) => l.trim()).filter(Boolean);
+          const descriptionText = firstLine + (bodyLines.length > 0 ? `
+${bodyLines.join("\n")}` : "");
+          const trigger = bodyLines.find((l) => l.toLowerCase().startsWith("triggers:")) ?? "";
+          const skillContent = [
+            "---",
+            `name: ${createPayload.name.trim()}`,
+            "description: |",
+            `  ${descriptionText.replace(/\n/g, "\n  ")}`,
+            `version: 1.0.0`,
+            "---",
+            "",
+            `# ${createPayload.name.trim().split("-").map((w) => w.charAt(0).toUpperCase() + w.slice(1)).join(" ")}`,
+            "",
+            "## Overview",
+            "",
+            firstLine,
+            "",
+            ...bodyLines.length > 0 ? bodyLines.filter((l) => !l.toLowerCase().startsWith("triggers:")) : [],
+            "",
+            "## Rules",
+            "- TODO: add your first rule",
+            "",
+            "## Patterns",
+            "### Do",
+            "```ts",
+            "// TODO: add a good example",
+            "```",
+            "",
+            "### Don't",
+            "```ts",
+            "// TODO: add a bad example",
+            "```",
+            "",
+            "## Workflow",
+            "1. TODO: describe step one",
+            "2. TODO: describe step two",
+            "",
+            trigger ? `
+${trigger}
+` : "",
+            "## Skills in scope",
+            "- `bug-hunter` \u2014 for systematic bug detection patterns",
+            "- `output-standards` \u2014 for standardized `<next_steps>` formatting"
+          ].join("\n");
+          await fs10.writeFile(path10.join(targetDir, "SKILL.md"), skillContent, "utf-8");
+          send(ws, {
+            type: "skills.created",
+            payload: {
+              success: true,
+              error: null,
+              skill: { name: createPayload.name.trim(), path: path10.join(targetDir, "SKILL.md"), scope: createPayload.scope }
+            }
+          });
+        } catch (err) {
+          send(ws, { type: "skills.created", payload: { success: false, error: errMessage(err) } });
+        }
+        break;
+      }
+      case "skills.edit": {
+        if (!skillLoader) {
+          send(ws, { type: "skills.edited", payload: { success: false, error: "Skills not enabled" } });
+          break;
+        }
+        const editPayload = msg.payload;
+        if (!editPayload?.name?.trim()) {
+          send(ws, { type: "skills.edited", payload: { success: false, error: "Skill name is required" } });
+          break;
+        }
+        if (!editPayload?.body) {
+          send(ws, { type: "skills.edited", payload: { success: false, error: "Skill body is required" } });
+          break;
+        }
+        try {
+          const entries = await skillLoader.listEntries();
+          const entry = entries.find((e) => e.name.toLowerCase() === editPayload.name.toLowerCase());
+          if (!entry) {
+            send(ws, { type: "skills.edited", payload: { success: false, error: `Skill "${editPayload.name}" not found` } });
+            break;
+          }
+          if (entry.scope.includes("bundled")) {
+            send(ws, { type: "skills.edited", payload: { success: false, error: "Bundled skills cannot be edited" } });
+            break;
+          }
+          await fs10.writeFile(entry.path, editPayload.body, "utf-8");
+          send(ws, { type: "skills.edited", payload: { success: true, error: null } });
+        } catch (err) {
+          send(ws, { type: "skills.edited", payload: { success: false, error: errMessage(err) } });
+        }
+        break;
+      }
+      case "skills.export": {
+        if (!skillLoader) {
+          send(ws, { type: "skills.exported", payload: { zipBase64: "", skillCount: 0, error: "Skills not enabled" } });
+          break;
+        }
+        try {
+          const entries = await skillLoader.listEntries();
+          const zip = new JSZip2();
+          for (const entry of entries) {
+            try {
+              const body = await skillLoader.readBody(entry.name);
+              const safeName = entry.name.replace(/\//g, "_");
+              zip.file(`${safeName}/SKILL.md`, body);
+            } catch {
+            }
+          }
+          const zipBuffer = await zip.generateAsync({ type: "nodebuffer", compression: "DEFLATE" });
+          const zipBase64 = zipBuffer.toString("base64");
+          send(ws, { type: "skills.exported", payload: { zipBase64, skillCount: entries.length, error: void 0 } });
+        } catch (err) {
+          send(ws, { type: "skills.exported", payload: { zipBase64: "", skillCount: 0, error: errMessage(err) } });
+        }
+        break;
+      }
       case "diag.get": {
         const usage = tokenCounter.total();
         send(ws, {
@@ -4308,125 +6098,84 @@ async function startWebUI(opts = {}) {
         break;
       }
       case "todos.get": {
-        send(ws, {
-          type: "todos.updated",
-          payload: { todos: [...context.todos] }
-        });
+        const ctx = {
+          context: { todos: context.todos, meta: context.meta, session: context.session ? { id: context.session.id } : null, state: context.state },
+          send: (w, m) => send(w, m),
+          broadcast: (m) => broadcast(clients, m)
+        };
+        handleTodosGet(ctx, ws);
         break;
       }
       case "todos.clear": {
-        context.state.replaceTodos([]);
-        sendResult(ws, true, "Todos cleared");
-        broadcast(clients, { type: "todos.updated", payload: { todos: [] } });
+        const ctx = {
+          context: { todos: context.todos, meta: context.meta, session: context.session ? { id: context.session.id } : null, state: context.state },
+          send: (w, m) => send(w, m),
+          broadcast: (m) => broadcast(clients, m)
+        };
+        handleTodosClear(ctx, ws);
         break;
       }
       case "todos.remove": {
-        const payload = msg.payload;
-        if (!payload) {
-          sendResult(ws, false, "Missing id or index");
-          break;
-        }
-        const { id, index } = payload;
-        let targetIdx = -1;
-        if (typeof id === "string") {
-          targetIdx = context.todos.findIndex((t) => t.id === id);
-        } else if (typeof index === "number" && index > 0) {
-          targetIdx = index - 1;
-        }
-        if (targetIdx < 0 || !context.todos[targetIdx]) {
-          sendResult(ws, false, "Todo not found");
-          break;
-        }
-        const removed = expectDefined2(context.todos[targetIdx]);
-        const next = [...context.todos.slice(0, targetIdx), ...context.todos.slice(targetIdx + 1)];
-        context.state.replaceTodos(next);
-        sendResult(ws, true, `Removed: ${removed.content}`);
-        broadcast(clients, { type: "todos.updated", payload: { todos: next } });
+        const ctx = {
+          context: { todos: context.todos, meta: context.meta, session: context.session ? { id: context.session.id } : null, state: context.state },
+          send: (w, m) => send(w, m),
+          broadcast: (m) => broadcast(clients, m)
+        };
+        handleTodosRemove(ctx, ws, msg.payload);
         break;
       }
       case "tasks.get": {
-        const taskPath = context.meta["task.path"];
-        if (typeof taskPath === "string" && taskPath) {
-          try {
-            const { loadTasks } = await import("@wrongstack/core");
-            const file = await loadTasks(taskPath);
-            send(ws, {
-              type: "tasks.updated",
-              payload: { tasks: file?.tasks ?? [] }
-            });
-          } catch {
-            send(ws, { type: "tasks.updated", payload: { tasks: [] } });
-          }
-        } else {
-          send(ws, { type: "tasks.updated", payload: { tasks: [], error: "Task storage not configured." } });
-        }
+        const ctx = {
+          context: { todos: context.todos, meta: context.meta, session: context.session ? { id: context.session.id } : null, state: context.state },
+          send: (w, m) => send(w, m),
+          broadcast: (m) => broadcast(clients, m)
+        };
+        await handleTasksGet(ctx, ws);
         break;
       }
       case "plan.get": {
-        const planPath = context.meta["plan.path"];
-        if (typeof planPath === "string" && planPath) {
-          try {
-            const { loadPlan } = await import("@wrongstack/core");
-            const plan = await loadPlan(planPath);
-            send(ws, {
-              type: "plan.updated",
-              payload: {
-                plan: plan ?? {
-                  version: 1,
-                  sessionId: session.id,
-                  updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
-                  items: []
-                }
-              }
-            });
-          } catch {
-            send(ws, {
-              type: "plan.updated",
-              payload: {
-                plan: {
-                  version: 1,
-                  sessionId: session.id,
-                  updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
-                  items: []
-                }
-              }
-            });
-          }
-        } else {
-          send(ws, {
-            type: "plan.updated",
-            payload: { plan: null, error: "Plan storage is not configured for this session." }
-          });
-        }
+        const ctx = {
+          context: { todos: context.todos, meta: context.meta, session: context.session ? { id: context.session.id } : null, state: context.state },
+          send: (w, m) => send(w, m),
+          broadcast: (m) => broadcast(clients, m)
+        };
+        await handlePlanGet(ctx, ws);
         break;
       }
       case "plan.template_use": {
-        const { template } = msg.payload;
-        const planPath = context.meta["plan.path"];
-        if (typeof planPath !== "string" || !planPath) {
-          sendResult(ws, false, "Plan storage is not configured for this session.");
-          break;
-        }
-        try {
-          const { getPlanTemplate, loadPlan, savePlan, emptyPlan, addPlanItem } = await import("@wrongstack/core");
-          const tpl = getPlanTemplate(template);
-          if (!tpl) {
-            sendResult(ws, false, `Unknown template "${template}".`);
-            break;
-          }
-          let plan = await loadPlan(planPath) ?? emptyPlan(session.id);
-          for (const item of tpl.items) {
-            ({ plan } = addPlanItem(plan, item.title, item.details));
-          }
-          await savePlan(planPath, plan);
-          sendResult(ws, true, `Applied template "${tpl.name}" \u2014 ${tpl.items.length} items added.`);
-          broadcast(clients, {
-            type: "plan.updated",
-            payload: { plan }
-          });
-        } catch (err) {
-          sendResult(ws, false, errMessage(err));
-        }
+        const ctx = {
+          context: { todos: context.todos, meta: context.meta, session: context.session ? { id: context.session.id } : null, state: context.state },
+          send: (w, m) => send(w, m),
+          broadcast: (m) => broadcast(clients, m)
+        };
+        await handlePlanTemplateUse(ctx, ws, msg.payload.template);
+        break;
+      }
+      case "todo.update": {
+        const ctx = {
+          context: { todos: context.todos, meta: context.meta, session: context.session ? { id: context.session.id } : null, state: context.state },
+          send: (w, m) => send(w, m),
+          broadcast: (m) => broadcast(clients, m)
+        };
+        handleTodoUpdate(ctx, ws, msg.payload);
+        break;
+      }
+      case "task.update": {
+        const ctx = {
+          context: { todos: context.todos, meta: context.meta, session: context.session ? { id: context.session.id } : null, state: context.state },
+          send: (w, m) => send(w, m),
+          broadcast: (m) => broadcast(clients, m)
+        };
+        await handleTaskUpdate(ctx, ws, msg.payload);
+        break;
+      }
+      case "plan.item.update": {
+        const ctx = {
+          context: { todos: context.todos, meta: context.meta, session: context.session ? { id: context.session.id } : null, state: context.state },
+          send: (w, m) => send(w, m),
+          broadcast: (m) => broadcast(clients, m)
+        };
+        await handlePlanItemUpdate(ctx, ws, msg.payload);
         break;
       }
       // ── File operations — delegated to shared handlers (file-handlers.ts) ──
@@ -4496,13 +6245,13 @@ async function startWebUI(opts = {}) {
             provider: config.provider,
             model: config.model
           });
-          sendResult(ws, true, `Switched to mode "${id}"`);
+          sendResult2(ws, true, `Switched to mode "${id}"`);
           broadcast(clients, {
             type: "session.start",
             payload: { ...await sessionStartPayload() }
           });
         } catch (err) {
-          sendResult(ws, false, errMessage(err));
+          sendResult2(ws, false, errMessage(err));
         }
         break;
       }
@@ -4556,13 +6305,13 @@ async function startWebUI(opts = {}) {
           const { getProcessRegistry } = await import("@wrongstack/tools");
           const proc = getProcessRegistry().get(pid);
           if (proc?.protected) {
-            sendResult(ws, false, `Cannot kill protected process (PID ${pid})`);
+            sendResult2(ws, false, `Cannot kill protected process (PID ${pid})`);
             break;
           }
           getProcessRegistry().kill(pid);
-          sendResult(ws, true, `Killed PID ${pid}`);
+          sendResult2(ws, true, `Killed PID ${pid}`);
         } catch (err) {
-          sendResult(ws, false, errMessage(err));
+          sendResult2(ws, false, errMessage(err));
         }
         break;
       }
@@ -4570,16 +6319,25 @@ async function startWebUI(opts = {}) {
         try {
           const { getProcessRegistry } = await import("@wrongstack/tools");
           getProcessRegistry().killAll();
-          sendResult(ws, true, "All processes killed");
+          sendResult2(ws, true, "All processes killed");
         } catch (err) {
-          sendResult(ws, false, errMessage(err));
+          sendResult2(ws, false, errMessage(err));
         }
         break;
       }
+      case "git.info": {
+        await handleGitInfo(ws, projectRoot);
+        break;
+      }
+      case "webui.shutdown": {
+        console.log("[WebUI] Shutdown requested from client");
+        process.kill(process.pid, "SIGINT");
+        break;
+      }
       case "goal.get": {
         try {
-          const goalPath = path9.join(projectRoot, ".wrongstack", "goal.json");
-          const raw = await fs7.readFile(goalPath, "utf8");
+          const goalPath = resolveWstackPaths({ projectRoot }).projectGoal;
+          const raw = await fs10.readFile(goalPath, "utf8");
           const goal = JSON.parse(raw);
           broadcast(clients, { type: "goal.updated", payload: goal });
         } catch {
@@ -4590,7 +6348,7 @@ async function startWebUI(opts = {}) {
       case "autonomy.switch": {
         const { mode } = msg.payload;
         context.meta["autonomy"] = mode;
-        sendResult(ws, true, `Autonomy mode set to "${mode}"`);
+        sendResult2(ws, true, `Autonomy mode set to "${mode}"`);
         broadcast(clients, { type: "prefs.updated", payload: { autonomy: mode } });
         void persistPrefsToConfig({ autonomy: mode });
         break;
@@ -4639,7 +6397,7 @@ async function startWebUI(opts = {}) {
         try {
           const { DefaultSessionRewinder } = await import("@wrongstack/core");
           const rewinder = new DefaultSessionRewinder(
-            path9.join(projectRoot, ".wrongstack", "sessions"),
+            path10.join(projectRoot, ".wrongstack", "sessions"),
             projectRoot
           );
           const checkpoints = await rewinder.listCheckpoints(session.id);
@@ -4660,18 +6418,18 @@ async function startWebUI(opts = {}) {
         try {
           const { DefaultSessionRewinder } = await import("@wrongstack/core");
           const rewinder = new DefaultSessionRewinder(
-            path9.join(projectRoot, ".wrongstack", "sessions"),
+            path10.join(projectRoot, ".wrongstack", "sessions"),
             projectRoot
           );
           await rewinder.rewindToCheckpoint(session.id, checkpointIndex);
           await context.session.truncateToCheckpoint(checkpointIndex);
-          sendResult(ws, true, `Rewound to checkpoint ${checkpointIndex}`);
+          sendResult2(ws, true, `Rewound to checkpoint ${checkpointIndex}`);
           broadcast(clients, {
             type: "session.start",
             payload: { ...await sessionStartPayload(), reset: true }
           });
         } catch (err) {
-          sendResult(ws, false, errMessage(err));
+          sendResult2(ws, false, errMessage(err));
         }
         break;
       }
@@ -4694,9 +6452,9 @@ async function startWebUI(opts = {}) {
       case "projects.add": {
         const { root: addRoot, name: displayName } = msg.payload;
         try {
-          const resolved = path9.resolve(addRoot);
-          await fs7.access(resolved);
-          const stat2 = await fs7.stat(resolved);
+          const resolved = path10.resolve(addRoot);
+          await fs10.access(resolved);
+          const stat2 = await fs10.stat(resolved);
           if (!stat2.isDirectory()) throw new Error(`Not a directory: ${resolved}`);
           const manifest = await loadManifest(globalConfigPath);
           const existing = manifest.projects.find((p) => p.root === resolved);
@@ -4712,7 +6470,7 @@ async function startWebUI(opts = {}) {
             });
             break;
           }
-          const name = displayName?.trim() || path9.basename(resolved);
+          const name = displayName?.trim() || path10.basename(resolved);
           const slug = generateProjectSlug(resolved);
           await ensureProjectDataDir(slug, globalConfigPath);
           const now = (/* @__PURE__ */ new Date()).toISOString();
@@ -4731,7 +6489,7 @@ async function startWebUI(opts = {}) {
           send(ws, {
             type: "projects.added",
             payload: {
-              name: path9.basename(addRoot),
+              name: path10.basename(addRoot),
               root: addRoot,
               slug: "",
               message: errMessage(err)
@@ -4743,17 +6501,17 @@ async function startWebUI(opts = {}) {
       case "projects.select": {
         const { root: selRoot, name: selName } = msg.payload;
         try {
-          const resolved = path9.resolve(selRoot);
+          const resolved = path10.resolve(selRoot);
           try {
-            await fs7.access(resolved);
-            const stat2 = await fs7.stat(resolved);
+            await fs10.access(resolved);
+            const stat2 = await fs10.stat(resolved);
             if (!stat2.isDirectory()) throw new Error(`Not a directory: ${resolved}`);
           } catch (err) {
             send(ws, {
               type: "projects.selected",
               payload: {
                 root: selRoot,
-                name: selName || path9.basename(selRoot),
+                name: selName || path10.basename(selRoot),
                 message: `Cannot switch: ${errMessage(err)}`
               }
             });
@@ -4765,7 +6523,7 @@ async function startWebUI(opts = {}) {
             entry.lastSeen = (/* @__PURE__ */ new Date()).toISOString();
             entry.lastWorkingDir = resolved;
           } else {
-            const name = selName?.trim() || path9.basename(resolved);
+            const name = selName?.trim() || path10.basename(resolved);
             const slug = generateProjectSlug(resolved);
             manifest.projects.push({
               name,
@@ -4806,13 +6564,13 @@ async function startWebUI(opts = {}) {
             });
           } catch {
           }
-          const newSessionsDir = path9.join(
-            path9.dirname(globalConfigPath),
+          const newSessionsDir = path10.join(
+            path10.dirname(globalConfigPath),
             "projects",
             switchSlug,
             "sessions"
           );
-          await fs7.mkdir(newSessionsDir, { recursive: true });
+          await fs10.mkdir(newSessionsDir, { recursive: true });
           const newSessionStore = new DefaultSessionStore2({ dir: newSessionsDir });
           const oldSessionId = session.id;
           try {
@@ -4844,8 +6602,9 @@ async function startWebUI(opts = {}) {
               sessionId: session.id,
               projectSlug: switchSlug,
               projectRoot,
-              projectName: path9.basename(projectRoot),
+              projectName: path10.basename(projectRoot),
               workingDir,
+              clientType: "webui",
               pid: process.pid,
               startedAt: (/* @__PURE__ */ new Date()).toISOString()
             });
@@ -4855,8 +6614,8 @@ async function startWebUI(opts = {}) {
             type: "projects.selected",
             payload: {
               root: resolved,
-              name: selName || path9.basename(resolved),
-              message: `Switched to ${selName || path9.basename(resolved)}`
+              name: selName || path10.basename(resolved),
+              message: `Switched to ${selName || path10.basename(resolved)}`
             }
           });
           broadcast(clients, {
@@ -4879,7 +6638,7 @@ async function startWebUI(opts = {}) {
             type: "projects.selected",
             payload: {
               root: selRoot,
-              name: selName || path9.basename(selRoot),
+              name: selName || path10.basename(selRoot),
               message: errMessage(err)
             }
           });
@@ -4890,17 +6649,17 @@ async function startWebUI(opts = {}) {
       case "working_dir.set": {
         const { path: newPath } = msg.payload;
         try {
-          const resolved = path9.resolve(projectRoot, newPath);
-          if (!resolved.startsWith(projectRoot + path9.sep) && resolved !== projectRoot) {
-            sendResult(ws, false, `Path must stay inside the project root: ${projectRoot}`);
+          const resolved = path10.resolve(projectRoot, newPath);
+          if (!resolved.startsWith(projectRoot + path10.sep) && resolved !== projectRoot) {
+            sendResult2(ws, false, `Path must stay inside the project root: ${projectRoot}`);
             break;
           }
           try {
-            await fs7.access(resolved);
-            const stat2 = await fs7.stat(resolved);
+            await fs10.access(resolved);
+            const stat2 = await fs10.stat(resolved);
             if (!stat2.isDirectory()) throw new Error("Not a directory");
           } catch {
-            sendResult(ws, false, `Directory not found or not accessible: ${resolved}`);
+            sendResult2(ws, false, `Directory not found or not accessible: ${resolved}`);
             break;
           }
           workingDir = resolved;
@@ -4909,9 +6668,9 @@ async function startWebUI(opts = {}) {
             type: "working_dir.changed",
             payload: { cwd: resolved, projectRoot }
           });
-          sendResult(ws, true, `Working directory set to ${resolved}`);
+          sendResult2(ws, true, `Working directory set to ${resolved}`);
         } catch (err) {
-          sendResult(ws, false, errMessage(err));
+          sendResult2(ws, false, errMessage(err));
         }
         break;
       }
@@ -4921,26 +6680,32 @@ async function startWebUI(opts = {}) {
           msg.payload,
           logger
         );
-        sendResult(ws, result.success, result.message);
+        sendResult2(ws, result.success, result.message);
         break;
       }
       // ── Mailbox operations — project-level inter-agent messaging ────
       case "mailbox.messages":
         return handleMailboxMessages(
           ws,
-          { projectRoot, globalRoot: path9.dirname(globalConfigPath) },
+          { projectRoot, globalRoot: path10.dirname(globalConfigPath) },
           msg.payload
         );
       case "mailbox.agents":
         return handleMailboxAgents(
           ws,
-          { projectRoot, globalRoot: path9.dirname(globalConfigPath) },
+          { projectRoot, globalRoot: path10.dirname(globalConfigPath) },
           msg.payload
         );
       case "mailbox.clear":
         return handleMailboxClear(
           ws,
-          { projectRoot, globalRoot: path9.dirname(globalConfigPath) }
+          { projectRoot, globalRoot: path10.dirname(globalConfigPath) }
+        );
+      case "mailbox.purge":
+        return handleMailboxPurge(
+          ws,
+          { projectRoot, globalRoot: path10.dirname(globalConfigPath) },
+          msg.payload
         );
       // ── Brain — status, autonomy ceiling, direct decision support ───
       case "brain.status":
@@ -4953,7 +6718,7 @@ async function startWebUI(opts = {}) {
         const level = msg.payload?.level ?? "";
         const valid = ["off", "low", "medium", "high", "all"];
         if (!valid.includes(level)) {
-          sendResult(ws, false, `Unknown risk level "${level}". Use: ${valid.join(", ")}.`);
+          sendResult2(ws, false, `Unknown risk level "${level}". Use: ${valid.join(", ")}.`);
           break;
         }
         brainSettings.maxAutoRisk = level;
@@ -4966,7 +6731,7 @@ async function startWebUI(opts = {}) {
       case "brain.ask": {
         const question = msg.payload?.question?.trim();
         if (!question) {
-          sendResult(ws, false, "Usage: /brain ask <question>");
+          sendResult2(ws, false, "Usage: /brain ask <question>");
           break;
         }
         try {
@@ -4979,7 +6744,7 @@ async function startWebUI(opts = {}) {
           });
           send(ws, { type: "brain.answer", payload: { question, decision } });
         } catch (err) {
-          sendResult(ws, false, `Brain consultation failed: ${errMessage(err)}`);
+          sendResult2(ws, false, `Brain consultation failed: ${errMessage(err)}`);
         }
         break;
       }
@@ -5006,14 +6771,28 @@ async function startWebUI(opts = {}) {
     broadcast,
     clients
   });
+  const watcherMetrics = {
+    fileChangesDetected: 0,
+    filesProcessed: 0,
+    broadcastsSent: 0,
+    debounceResets: 0,
+    totalDebounceDelayMs: 0,
+    activeProjects: 0,
+    averageDebounceDelayMs: 0,
+    watcherActive: false
+  };
   const httpServer = createHttpServer({
     host: wsHost,
-    distDir: path9.resolve(import.meta.dirname, "../../dist"),
+    distDir: path10.resolve(import.meta.dirname, "../../dist"),
     wsPort,
     globalRoot: wpaths.globalRoot,
-    apiToken: wsToken
+    apiToken: wsToken,
+    watcherMetrics,
+    onFleetPing: () => {
+      void fleetBroadcast?.();
+    }
   });
-  const registryBaseDir = path9.dirname(globalConfigPath);
+  const registryBaseDir = path10.dirname(globalConfigPath);
   httpServer.listen(httpPort, wsHost, () => {
     const openUrl = `http://${wsHost}:${httpPort}`;
     console.log(`[WebUI] HTTP server running on ${openUrl}`);
@@ -5025,7 +6804,7 @@ async function startWebUI(opts = {}) {
         wsPort,
         host: wsHost,
         projectRoot,
-        projectName: path9.basename(projectRoot) || projectRoot,
+        projectName: path10.basename(projectRoot) || projectRoot,
         startedAt: (/* @__PURE__ */ new Date()).toISOString(),
         url: `http://${wsHost}:${httpPort}`
       },
@@ -5052,6 +6831,10 @@ async function startWebUI(opts = {}) {
     // reality. Crash exits are healed by the next register()/list() prune pass.
     onShutdown: () => {
       brainMonitor.stop();
+      if (disposeEvents) {
+        disposeEvents();
+        disposeEvents = null;
+      }
       if (eternalSubscription) {
         eternalSubscription.dispose();
         eternalSubscription = null;
@@ -5082,10 +6865,28 @@ export {
   handleFilesRead,
   handleFilesTree,
   handleFilesWrite,
+  handleGitInfo,
+  handleMcpAdd,
+  handleMcpDisable,
+  handleMcpDiscover,
+  handleMcpEnable,
+  handleMcpList,
+  handleMcpRemove,
+  handleMcpRestart,
+  handleMcpSleep,
+  handleMcpUpdate,
+  handleMcpWake,
   handleMemoryForget,
   handleMemoryList,
   handleMemoryRemember,
   handleShellOpen,
+  handleSkillsContent,
+  handleSkillsCreate,
+  handleSkillsEdit,
+  handleSkillsExport,
+  handleSkillsInstall,
+  handleSkillsUninstall,
+  handleSkillsUpdate,
   hostHeaderOk,
   injectWsPort,
   isLoopbackBind,
@@ -5103,7 +6904,7 @@ export {
   removeProvider,
   saveProviders,
   send,
-  sendResult,
+  sendResult2 as sendResult,
   setActiveKey,
   startWebUI,
   stringifyContent,