@wrongstack/webui 0.264.0 → 0.265.1

package/dist/server/entry.js

@@ -1,8 +1,180 @@
 #!/usr/bin/env node
 // src/server/index.ts
-import { expectDefined as expectDefined2, GlobalMailbox as GlobalMailbox2, projectSlug, getSessionRegistry, AgentStatusTracker } from "@wrongstack/core";
+import { expectDefined as expectDefined2, GlobalMailbox as GlobalMailbox2, projectSlug, getSessionRegistry, AgentStatusTracker, FleetNotifier } from "@wrongstack/core";
+
+// src/server/handlers/worklist-handlers.ts
+function sendResult(ws, ctx, ok, message) {
+  ctx.send(ws, { type: ok ? "ok" : "error", message });
+}
+function handleTodosGet(ctx, ws) {
+  ctx.send(ws, { type: "todos.updated", payload: { todos: ctx.context.todos } });
+}
+function handleTodosClear(ctx, ws) {
+  ctx.replaceTodos?.([]);
+  ctx.broadcast({ type: "todos.cleared" });
+  sendResult(ws, ctx, true, "Todo board cleared.");
+}
+function handleTodosRemove(ctx, ws, payload) {
+  if (!payload || payload.id === void 0 && payload.index === void 0) {
+    sendResult(ws, ctx, false, "todos.remove requires id or index.");
+    return;
+  }
+  const next = payload.id !== void 0 ? ctx.context.todos.filter((t) => t.id !== payload.id) : ctx.context.todos.filter((_, i) => i !== payload.index);
+  ctx.replaceTodos?.(next);
+  ctx.broadcast({ type: "todos.updated", payload: { todos: next } });
+  sendResult(ws, ctx, true, "Todo item removed.");
+}
+function handleTodoUpdate(ctx, ws, payload) {
+  const todo = ctx.context.todos.find((t) => t.id === payload.id);
+  if (!todo) {
+    sendResult(ws, ctx, false, `No todo with id "${payload.id}".`);
+    return;
+  }
+  const next = ctx.context.todos.map(
+    (t) => t.id === payload.id ? { ...t, ...payload.status !== void 0 && { status: payload.status }, ...payload.activeForm !== void 0 && { activeForm: payload.activeForm } } : t
+  );
+  ctx.replaceTodos?.(next);
+  ctx.broadcast({ type: "todos.updated", payload: { todos: next } });
+  sendResult(ws, ctx, true, `Todo "${todo.content}" updated.`);
+}
+async function handleTasksGet(ctx, ws) {
+  const taskPath = ctx.context.meta["task.path"];
+  if (typeof taskPath === "string" && taskPath) {
+    try {
+      const { loadTasks } = await import("@wrongstack/core");
+      const file = await loadTasks(taskPath);
+      ctx.send(ws, { type: "tasks.updated", payload: { tasks: file?.tasks ?? [] } });
+    } catch {
+      ctx.send(ws, { type: "tasks.updated", payload: { tasks: [] } });
+    }
+  } else {
+    ctx.send(ws, {
+      type: "tasks.updated",
+      payload: { tasks: [], error: "Task storage not configured." }
+    });
+  }
+}
+async function handleTaskUpdate(ctx, ws, payload) {
+  const taskPath = ctx.context.meta["task.path"];
+  if (typeof taskPath !== "string" || !taskPath) {
+    sendResult(ws, ctx, false, "Task storage is not configured for this session.");
+    return;
+  }
+  try {
+    const { loadTasks, saveTasks } = await import("@wrongstack/core");
+    const file = await loadTasks(taskPath);
+    if (!file) {
+      sendResult(ws, ctx, false, "No task file found.");
+      return;
+    }
+    const idx = file.tasks.findIndex((t) => t.id === payload.id);
+    if (idx === -1) {
+      sendResult(ws, ctx, false, `Task "${payload.id}" not found.`);
+      return;
+    }
+    file.tasks[idx] = { ...file.tasks[idx], status: payload.status };
+    await saveTasks(taskPath, file);
+    ctx.broadcast({ type: "tasks.updated", payload: { tasks: file.tasks } });
+    sendResult(ws, ctx, true, `Task "${payload.id}" marked ${payload.status}.`);
+  } catch (err) {
+    sendResult(ws, ctx, false, String(err));
+  }
+}
+async function handlePlanGet(ctx, ws) {
+  const planPath = ctx.context.meta["plan.path"];
+  const sessionId = ctx.context.session?.id ?? "";
+  if (typeof planPath === "string" && planPath) {
+    try {
+      const { loadPlan } = await import("@wrongstack/core");
+      const plan = await loadPlan(planPath);
+      ctx.send(ws, {
+        type: "plan.updated",
+        payload: {
+          plan: plan ?? {
+            version: 1,
+            sessionId,
+            updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+            items: []
+          }
+        }
+      });
+    } catch {
+      ctx.send(ws, {
+        type: "plan.updated",
+        payload: {
+          plan: {
+            version: 1,
+            sessionId,
+            updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+            items: []
+          }
+        }
+      });
+    }
+  } else {
+    ctx.send(ws, {
+      type: "plan.updated",
+      payload: { plan: null, error: "Plan storage is not configured for this session." }
+    });
+  }
+}
+async function handlePlanTemplateUse(ctx, ws, template) {
+  const planPath = ctx.context.meta["plan.path"];
+  const sessionId = ctx.context.session?.id ?? "";
+  if (typeof planPath !== "string" || !planPath) {
+    sendResult(ws, ctx, false, "Plan storage is not configured for this session.");
+    return;
+  }
+  try {
+    const { getPlanTemplate, loadPlan, savePlan, emptyPlan, addPlanItem } = await import("@wrongstack/core");
+    const tpl = getPlanTemplate(template);
+    if (!tpl) {
+      sendResult(ws, ctx, false, `Unknown template "${template}".`);
+      return;
+    }
+    let plan = await loadPlan(planPath) ?? emptyPlan(sessionId);
+    for (const item of tpl.items) {
+      ({ plan } = addPlanItem(plan, item.title, item.details));
+    }
+    await savePlan(planPath, plan);
+    sendResult(ws, ctx, true, `Applied template "${tpl.name}" \u2014 ${tpl.items.length} items added.`);
+    ctx.broadcast({ type: "plan.updated", payload: { plan } });
+  } catch (err) {
+    sendResult(ws, ctx, false, String(err));
+  }
+}
+async function handlePlanItemUpdate(ctx, ws, payload) {
+  const planPath = ctx.context.meta["plan.path"];
+  const sessionId = ctx.context.session?.id ?? "";
+  if (typeof planPath !== "string" || !planPath) {
+    sendResult(ws, ctx, false, "Plan storage is not configured for this session.");
+    return;
+  }
+  try {
+    const { loadPlan, savePlan, mutatePlan, setPlanItemStatus } = await import("@wrongstack/core");
+    let changed = false;
+    const plan = await mutatePlan(planPath, sessionId, async (p) => {
+      const before = p.updatedAt;
+      const updated = setPlanItemStatus(p, payload.target, payload.status);
+      changed = updated.updatedAt !== before;
+      return updated;
+    });
+    if (!changed) {
+      sendResult(ws, ctx, false, `No plan item matched "${payload.target}".`);
+      return;
+    }
+    sendResult(ws, ctx, true, `Plan item status updated to "${payload.status}".`);
+    ctx.broadcast({ type: "plan.updated", payload: { plan } });
+  } catch (err) {
+    sendResult(ws, ctx, false, String(err));
+  }
+}
+
+// src/server/index.ts
 import { makeMailboxTool, makeMailSendTool, makeMailInboxTool, mailboxSessionTag } from "@wrongstack/core";
-import { toErrorMessage as toErrorMessage5 } from "@wrongstack/core/utils";
+import { toErrorMessage as toErrorMessage5, wstackGlobalRoot as wstackGlobalRoot2, projectHash, resolveWstackPaths } from "@wrongstack/core/utils";
+import { SkillInstaller } from "@wrongstack/core/skills";
+import JSZip2 from "jszip";
 import {
   BrainMonitor,
   DefaultBrainArbiter,
@@ -10,8 +182,8 @@ import {
   createAutonomyBrain,
   createTieredBrainArbiter
 } from "@wrongstack/core";
-import * as fs7 from "fs/promises";
-import * as path8 from "path";
+import * as fs10 from "fs/promises";
+import * as path10 from "path";
 
 // src/server/http-server.ts
 import * as fs from "fs/promises";
@@ -130,6 +302,13 @@ function isInsideDist(candidate, distDir) {
   const resolved = path.resolve(candidate);
   return resolved === root || resolved.startsWith(root + path.sep);
 }
+function decodeSessionId(segment) {
+  try {
+    return decodeURIComponent(segment);
+  } catch {
+    return segment;
+  }
+}
 function createHttpServer(opts) {
   const port = opts.port ?? Number.parseInt(process.env["PORT"] ?? "3456", 10);
   const distDir = path.resolve(opts.distDir);
@@ -155,6 +334,22 @@ function createHttpServer(opts) {
         res.end("ok");
         return;
       }
+      if (url.pathname === "/api/fleet/ping" && req.method === "POST") {
+        const headerToken = req.headers["x-ws-token"];
+        const provided = Array.isArray(headerToken) ? headerToken[0] : headerToken;
+        if (requireApiToken && !tokenMatches(provided, opts.apiToken ?? "")) {
+          res.writeHead(401, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ error: "Unauthorized" }));
+          return;
+        }
+        try {
+          opts.onFleetPing?.();
+        } catch {
+        }
+        res.writeHead(204);
+        res.end();
+        return;
+      }
       if (url.pathname === "/api/sessions" && req.method === "GET") {
         const headerToken = req.headers["x-ws-token"];
         const provided = Array.isArray(headerToken) ? headerToken[0] : headerToken;
@@ -175,7 +370,89 @@ function createHttpServer(opts) {
           res.end(JSON.stringify({ error: "Unauthorized" }));
           return;
         }
-        await handleApiSessionAgents(res, opts.globalRoot, agentsMatch[1]);
+        await handleApiSessionAgents(res, opts.globalRoot, decodeSessionId(agentsMatch[1]));
+        return;
+      }
+      const eventsMatch = url.pathname.match(/^\/api\/sessions\/([^/]+)\/events$/);
+      if (eventsMatch && req.method === "GET") {
+        const headerToken = req.headers["x-ws-token"];
+        const provided = Array.isArray(headerToken) ? headerToken[0] : headerToken;
+        if (requireApiToken && !tokenMatches(provided, opts.apiToken ?? "")) {
+          res.writeHead(401, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ error: "Unauthorized" }));
+          return;
+        }
+        const rawLimit = Number.parseInt(url.searchParams.get("limit") ?? "200", 10);
+        const limit = Math.min(500, Math.max(1, Number.isFinite(rawLimit) ? rawLimit : 200));
+        await handleApiSessionEvents(res, opts.globalRoot, decodeSessionId(eventsMatch[1]), limit);
+        return;
+      }
+      const msgMatch = url.pathname.match(/^\/api\/sessions\/([^/]+)\/message$/);
+      if (msgMatch && req.method === "POST") {
+        const headerToken = req.headers["x-ws-token"];
+        const provided = Array.isArray(headerToken) ? headerToken[0] : headerToken;
+        if (requireApiToken && !tokenMatches(provided, opts.apiToken ?? "")) {
+          res.writeHead(401, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ error: "Unauthorized" }));
+          return;
+        }
+        await handleApiSessionMessage(res, req, opts.globalRoot, decodeSessionId(msgMatch[1]));
+        return;
+      }
+      const mailboxMatch = url.pathname.match(/^\/api\/sessions\/([^/]+)\/mailbox$/);
+      if (mailboxMatch && req.method === "GET") {
+        const headerToken = req.headers["x-ws-token"];
+        const provided = Array.isArray(headerToken) ? headerToken[0] : headerToken;
+        if (requireApiToken && !tokenMatches(provided, opts.apiToken ?? "")) {
+          res.writeHead(401, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ error: "Unauthorized" }));
+          return;
+        }
+        await handleApiSessionMailbox(res, opts.globalRoot, decodeSessionId(mailboxMatch[1]));
+        return;
+      }
+      const interruptMatch = url.pathname.match(/^\/api\/sessions\/([^/]+)\/interrupt$/);
+      if (interruptMatch && req.method === "POST") {
+        const headerToken = req.headers["x-ws-token"];
+        const provided = Array.isArray(headerToken) ? headerToken[0] : headerToken;
+        if (requireApiToken && !tokenMatches(provided, opts.apiToken ?? "")) {
+          res.writeHead(401, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ error: "Unauthorized" }));
+          return;
+        }
+        await handleApiSessionInterrupt(
+          res,
+          req,
+          opts.globalRoot,
+          decodeSessionId(interruptMatch[1])
+        );
+        return;
+      }
+      if (url.pathname === "/api/fleet/broadcast" && req.method === "POST") {
+        const headerToken = req.headers["x-ws-token"];
+        const provided = Array.isArray(headerToken) ? headerToken[0] : headerToken;
+        if (requireApiToken && !tokenMatches(provided, opts.apiToken ?? "")) {
+          res.writeHead(401, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ error: "Unauthorized" }));
+          return;
+        }
+        await handleApiFleetBroadcast(res, req, opts.globalRoot);
+        return;
+      }
+      if (url.pathname === "/debug/watcher-metrics" && req.method === "GET") {
+        if (opts.watcherMetrics) {
+          const avgDelay = opts.watcherMetrics.broadcastsSent > 0 ? opts.watcherMetrics.totalDebounceDelayMs / opts.watcherMetrics.broadcastsSent : 0;
+          const response = {
+            ...opts.watcherMetrics,
+            averageDebounceDelayMs: avgDelay,
+            timestamp: Date.now()
+          };
+          res.writeHead(200, { "Content-Type": "application/json" });
+          res.end(JSON.stringify(response));
+        } else {
+          res.writeHead(503, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ error: "File watcher metrics not available" }));
+        }
         return;
       }
       let filePath;
@@ -307,6 +584,324 @@ async function handleApiSessionAgents(res, globalRoot, sessionId) {
     res.end(JSON.stringify({ error: String(err) }));
   }
 }
+function blocksToText(content) {
+  if (typeof content === "string") return content;
+  if (Array.isArray(content)) {
+    return content.filter(
+      (b) => !!b && typeof b === "object" && b.type === "text" && typeof b.text === "string"
+    ).map((b) => b.text).join("\n");
+  }
+  return "";
+}
+function clip(s, n = 600) {
+  return s.length > n ? `${s.slice(0, n)}\u2026` : s;
+}
+function asString(v) {
+  if (typeof v === "string") return v;
+  try {
+    return JSON.stringify(v);
+  } catch {
+    return String(v);
+  }
+}
+function mapWatchEntry(ev) {
+  const ts = typeof ev["ts"] === "string" ? ev["ts"] : "";
+  switch (ev["type"]) {
+    case "user_input":
+      return { ts, role: "user", text: clip(blocksToText(ev["content"])) };
+    case "llm_response": {
+      const text = blocksToText(ev["content"]);
+      return text.trim() ? { ts, role: "assistant", text: clip(text) } : null;
+    }
+    case "tool_use":
+    case "tool_call_start": {
+      const input = ev["input"] ?? ev["args"];
+      const preview = input !== void 0 && input !== null ? clip(asString(input), 160) : "";
+      return { ts, role: "tool", tool: String(ev["name"] ?? "tool"), text: preview };
+    }
+    case "tool_result": {
+      if (ev["isError"]) return { ts, role: "error", text: clip(asString(ev["content"])) };
+      const out = asString(ev["content"]).trim();
+      return out ? { ts, role: "tool", tool: "\u21B3 result", text: clip(out, 240) } : null;
+    }
+    case "error":
+    case "provider_error":
+      return { ts, role: "error", text: clip(String(ev["message"] ?? "error")) };
+    case "agent_spawned":
+      return { ts, role: "system", text: `spawned ${String(ev["role"] ?? "agent")}` };
+    case "task_completed":
+      return { ts, role: "system", text: `task done: ${String(ev["title"] ?? "")}` };
+    case "task_failed":
+      return { ts, role: "system", text: `task failed: ${String(ev["title"] ?? "")}` };
+    default:
+      return null;
+  }
+}
+async function handleApiSessionEvents(res, globalRoot, sessionId, limit) {
+  if (!globalRoot) {
+    res.writeHead(500, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ error: "SessionRegistry not available" }));
+    return;
+  }
+  try {
+    const { SessionRegistry, resolveWstackPaths: resolveWstackPaths2, DefaultSessionStore: DefaultSessionStore3, DefaultSessionReader: DefaultSessionReader2 } = await import("@wrongstack/core");
+    const registry = new SessionRegistry(globalRoot);
+    const entry = await registry.get(sessionId);
+    if (!entry) {
+      res.writeHead(404, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ error: "Session not found" }));
+      return;
+    }
+    const paths = resolveWstackPaths2({ projectRoot: entry.projectRoot, globalRoot });
+    const store = new DefaultSessionStore3({ dir: paths.projectSessions });
+    const reader = new DefaultSessionReader2({ store });
+    const all = [];
+    for await (const ev of reader.replay(sessionId)) {
+      const mapped = mapWatchEntry(ev);
+      if (mapped) all.push(mapped);
+    }
+    const tail = all.slice(-limit);
+    res.writeHead(200, { "Content-Type": "application/json" });
+    res.end(
+      JSON.stringify({
+        sessionId,
+        status: entry.status,
+        clientType: entry.clientType,
+        projectName: entry.projectName,
+        total: all.length,
+        entries: tail
+      })
+    );
+  } catch (err) {
+    res.writeHead(500, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ error: String(err) }));
+  }
+}
+function readJsonBody(req) {
+  return new Promise((resolve5, reject) => {
+    let data = "";
+    req.on("data", (chunk) => {
+      data += chunk;
+      if (data.length > 64e3) {
+        reject(new Error("Request body too large"));
+        req.destroy();
+      }
+    });
+    req.on("end", () => {
+      try {
+        resolve5(data ? JSON.parse(data) : {});
+      } catch (err) {
+        reject(err instanceof Error ? err : new Error(String(err)));
+      }
+    });
+    req.on("error", reject);
+  });
+}
+async function handleApiSessionMessage(res, req, globalRoot, sessionId) {
+  if (!globalRoot) {
+    res.writeHead(500, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ error: "SessionRegistry not available" }));
+    return;
+  }
+  let body;
+  try {
+    body = await readJsonBody(req);
+  } catch {
+    res.writeHead(400, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ error: "Invalid request body" }));
+    return;
+  }
+  const text = typeof body["text"] === "string" ? body["text"].trim() : "";
+  if (!text) {
+    res.writeHead(400, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ error: "text is required" }));
+    return;
+  }
+  const from = typeof body["from"] === "string" && body["from"].trim() ? body["from"].trim() : "human@webui";
+  const ALLOWED = /* @__PURE__ */ new Set(["steer", "ask", "assign", "note", "btw"]);
+  const rawType = typeof body["type"] === "string" ? body["type"] : "steer";
+  const type = ALLOWED.has(rawType) ? rawType : "steer";
+  const rawPriority = typeof body["priority"] === "string" ? body["priority"] : "";
+  const priority = ["low", "normal", "high"].includes(rawPriority) ? rawPriority : "high";
+  const subject = typeof body["subject"] === "string" && body["subject"].trim() ? body["subject"].trim() : "Message from Fleet HQ";
+  try {
+    const { SessionRegistry, resolveWstackPaths: resolveWstackPaths2, GlobalMailbox: GlobalMailbox3, mailboxSessionTag: mailboxSessionTag2 } = await import("@wrongstack/core");
+    const registry = new SessionRegistry(globalRoot);
+    const entry = await registry.get(sessionId);
+    if (!entry) {
+      res.writeHead(404, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ error: "Session not found" }));
+      return;
+    }
+    const paths = resolveWstackPaths2({ projectRoot: entry.projectRoot, globalRoot });
+    const mailbox = new GlobalMailbox3(paths.projectDir);
+    const to = `leader@${mailboxSessionTag2(sessionId)}`;
+    const sent = await mailbox.send({ from, to, type, subject, body: text, priority });
+    res.writeHead(200, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ ok: true, id: sent.id, to, type, delivered: entry.status }));
+  } catch (err) {
+    res.writeHead(500, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ error: String(err) }));
+  }
+}
+async function handleApiSessionMailbox(res, globalRoot, sessionId) {
+  if (!globalRoot) {
+    res.writeHead(500, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ error: "SessionRegistry not available" }));
+    return;
+  }
+  try {
+    const { SessionRegistry, resolveWstackPaths: resolveWstackPaths2, GlobalMailbox: GlobalMailbox3, mailboxSessionTag: mailboxSessionTag2 } = await import("@wrongstack/core");
+    const registry = new SessionRegistry(globalRoot);
+    const entry = await registry.get(sessionId);
+    if (!entry) {
+      res.writeHead(404, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ error: "Session not found" }));
+      return;
+    }
+    const paths = resolveWstackPaths2({ projectRoot: entry.projectRoot, globalRoot });
+    const mailbox = new GlobalMailbox3(paths.projectDir);
+    const leaderAddr = `leader@${mailboxSessionTag2(sessionId)}`;
+    const [inbound, outbound] = await Promise.all([
+      mailbox.query({ to: leaderAddr, limit: 50 }),
+      mailbox.query({ from: leaderAddr, limit: 50 })
+    ]);
+    const seen = /* @__PURE__ */ new Set();
+    const thread = [...inbound, ...outbound].filter((m) => {
+      if (seen.has(m.id)) return false;
+      seen.add(m.id);
+      return true;
+    }).sort((a, b) => Date.parse(a.timestamp) - Date.parse(b.timestamp)).map((m) => ({
+      id: m.id,
+      from: m.from,
+      to: m.to,
+      type: m.type,
+      subject: m.subject,
+      body: m.body,
+      priority: m.priority,
+      // Whether the leader has read it, and when.
+      readByLeader: m.readBy?.[leaderAddr] ?? null,
+      readByCount: Object.keys(m.readBy ?? {}).length,
+      completed: m.completed,
+      outcome: m.outcome ?? null,
+      timestamp: m.timestamp,
+      replyTo: m.replyTo ?? null,
+      fromLeader: m.from === leaderAddr
+    }));
+    res.writeHead(200, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ sessionId, leader: leaderAddr, status: entry.status, thread }));
+  } catch (err) {
+    res.writeHead(500, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ error: String(err) }));
+  }
+}
+async function handleApiSessionInterrupt(res, req, globalRoot, sessionId) {
+  if (!globalRoot) {
+    res.writeHead(500, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ error: "SessionRegistry not available" }));
+    return;
+  }
+  let body = {};
+  try {
+    body = await readJsonBody(req);
+  } catch {
+  }
+  const reason = typeof body["reason"] === "string" && body["reason"].trim() ? body["reason"].trim() : "Operator requested stop from Fleet HQ";
+  const from = typeof body["from"] === "string" && body["from"].trim() ? body["from"].trim() : "human@webui";
+  try {
+    const { SessionRegistry, resolveWstackPaths: resolveWstackPaths2, GlobalMailbox: GlobalMailbox3, mailboxSessionTag: mailboxSessionTag2 } = await import("@wrongstack/core");
+    const registry = new SessionRegistry(globalRoot);
+    const entry = await registry.get(sessionId);
+    if (!entry) {
+      res.writeHead(404, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ error: "Session not found" }));
+      return;
+    }
+    const paths = resolveWstackPaths2({ projectRoot: entry.projectRoot, globalRoot });
+    const mailbox = new GlobalMailbox3(paths.projectDir);
+    const to = `leader@${mailboxSessionTag2(sessionId)}`;
+    const sent = await mailbox.send({
+      from,
+      to,
+      type: "control",
+      subject: "interrupt",
+      body: reason,
+      priority: "high"
+    });
+    res.writeHead(200, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ ok: true, id: sent.id, to, delivered: entry.status }));
+  } catch (err) {
+    res.writeHead(500, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ error: String(err) }));
+  }
+}
+async function handleApiFleetBroadcast(res, req, globalRoot) {
+  if (!globalRoot) {
+    res.writeHead(500, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ error: "SessionRegistry not available" }));
+    return;
+  }
+  let body;
+  try {
+    body = await readJsonBody(req);
+  } catch {
+    res.writeHead(400, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ error: "Invalid request body" }));
+    return;
+  }
+  const text = typeof body["text"] === "string" ? body["text"].trim() : "";
+  if (!text) {
+    res.writeHead(400, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ error: "text is required" }));
+    return;
+  }
+  const from = typeof body["from"] === "string" && body["from"].trim() ? body["from"].trim() : "human@webui";
+  try {
+    const { SessionRegistry, resolveWstackPaths: resolveWstackPaths2, GlobalMailbox: GlobalMailbox3, mailboxSessionTag: mailboxSessionTag2 } = await import("@wrongstack/core");
+    const registry = new SessionRegistry(globalRoot);
+    const all = await registry.list();
+    const mySlug = all.find((s) => s.pid === process.pid)?.projectSlug;
+    const targets = all.filter((s) => s.status !== "stale").filter((s) => mySlug ? s.projectSlug === mySlug : true);
+    if (targets.length === 0) {
+      res.writeHead(200, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ ok: true, delivered: 0 }));
+      return;
+    }
+    const mbByDir = /* @__PURE__ */ new Map();
+    const mailboxFor = (projectRoot) => {
+      const dir = resolveWstackPaths2({ projectRoot, globalRoot }).projectDir;
+      let mb = mbByDir.get(dir);
+      if (!mb) {
+        mb = new GlobalMailbox3(dir);
+        mbByDir.set(dir, mb);
+      }
+      return mb;
+    };
+    let delivered = 0;
+    await Promise.all(
+      targets.map(async (s) => {
+        try {
+          const mb = mailboxFor(s.projectRoot);
+          await mb.send({
+            from,
+            to: `leader@${mailboxSessionTag2(s.sessionId)}`,
+            type: "steer",
+            subject: "Broadcast from Fleet HQ",
+            body: text,
+            priority: "high"
+          });
+          delivered++;
+        } catch {
+        }
+      })
+    );
+    res.writeHead(200, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ ok: true, delivered, targets: targets.length }));
+  } catch (err) {
+    res.writeHead(500, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ error: String(err) }));
+  }
+}
 
 // src/server/file-handlers.ts
 import * as fs2 from "fs/promises";
@@ -380,7 +975,7 @@ function broadcast(clients, msg) {
     }
   }
 }
-function sendResult(ws, success, message) {
+function sendResult2(ws, success, message) {
   send(ws, { type: "key.operation_result", payload: { success, message } });
 }
 function errMessage(err) {
@@ -529,23 +1124,265 @@ async function handleMemoryRemember(ws, msg, memoryStore) {
   const { text, scope } = msg.payload;
   try {
     await memoryStore.remember(text, scope ?? "project-memory");
-    sendResult(ws, true, "Saved to memory");
+    sendResult2(ws, true, "Saved to memory");
   } catch (err) {
-    sendResult(ws, false, errMessage(err));
+    sendResult2(ws, false, errMessage(err));
   }
 }
 async function handleMemoryForget(ws, msg, memoryStore) {
   const { text, scope } = msg.payload;
   try {
     const removed = await memoryStore.forget(text, scope ?? "project-memory");
-    sendResult(
+    sendResult2(
       ws,
       removed > 0,
       removed > 0 ? `Removed ${removed} entr${removed === 1 ? "y" : "ies"}` : "No matching entries"
     );
   } catch (err) {
-    sendResult(ws, false, errMessage(err));
+    sendResult2(ws, false, errMessage(err));
+  }
+}
+
+// src/server/mcp-handlers.ts
+import * as fs3 from "fs/promises";
+import * as path3 from "path";
+function isMcpServerRecord(val) {
+  if (typeof val !== "object" || val === null) return false;
+  return true;
+}
+function projectServer(name, cfg, _status = "stopped", tools = []) {
+  return {
+    name,
+    transport: cfg.transport,
+    status: _status,
+    enabled: cfg.enabled ?? true,
+    description: cfg.description,
+    tools
+  };
+}
+async function readConfig(configPath) {
+  try {
+    const content = await fs3.readFile(configPath, "utf-8");
+    return JSON.parse(content);
+  } catch {
+    return {};
+  }
+}
+async function writeConfig(configPath, cfg) {
+  const dir = path3.dirname(configPath);
+  await fs3.mkdir(dir, { recursive: true });
+  await fs3.writeFile(configPath, JSON.stringify(cfg, null, 2), "utf-8");
+}
+async function getMcpServers(config, globalConfigPath) {
+  const servers = [];
+  const configured = isMcpServerRecord(config.mcpServers) ? config.mcpServers : {};
+  for (const [name, cfg] of Object.entries(configured)) {
+    servers.push(projectServer(name, cfg));
+  }
+  return servers;
+}
+function getRegistryStates(mcpRegistry) {
+  const states = /* @__PURE__ */ new Map();
+  if (!mcpRegistry?.list) return states;
+  try {
+    const list = mcpRegistry.list();
+    for (const item of list) {
+      states.set(item.name, { state: item.state, toolCount: item.toolCount });
+    }
+  } catch {
+  }
+  return states;
+}
+async function handleMcpList(ws, _msg, config, _globalConfigPath, mcpRegistry) {
+  const servers = await getMcpServers(config, _globalConfigPath);
+  const registryStates = getRegistryStates(mcpRegistry);
+  for (const server of servers) {
+    const registryState = registryStates.get(server.name);
+    if (registryState) {
+      server.status = registryState.state;
+      server.tools = Array.from({ length: registryState.toolCount }, (_, i) => `tool-${i + 1}`);
+    }
+  }
+  send(ws, { type: "mcp.list", payload: { servers } });
+}
+async function handleMcpAdd(ws, msg, config, globalConfigPath, mcpRegistry) {
+  const payload = msg.payload;
+  if (!payload.name) {
+    send(ws, { type: "mcp.operation_result", payload: { success: false, message: "Server name is required" } });
+    return;
+  }
+  try {
+    const diskConfig = await readConfig(globalConfigPath);
+    const mcpServers = isMcpServerRecord(diskConfig.mcpServers) ? diskConfig.mcpServers : {};
+    if (mcpServers[payload.name]) {
+      send(ws, { type: "mcp.operation_result", payload: { success: false, message: `Server "${payload.name}" already exists` } });
+      return;
+    }
+    mcpServers[payload.name] = {
+      transport: payload.transport,
+      description: payload.description,
+      enabled: payload.enabled ?? true,
+      command: payload.command,
+      args: payload.args,
+      env: payload.env,
+      allowedTools: payload.allowedTools
+    };
+    diskConfig.mcpServers = mcpServers;
+    await writeConfig(globalConfigPath, diskConfig);
+    const newServer = projectServer(payload.name, mcpServers[payload.name]);
+    send(ws, { type: "mcp.server.added", payload: { server: newServer } });
+    if (mcpRegistry && (payload.enabled ?? true)) {
+      const serverConfig = mcpServers[payload.name];
+      try {
+        await mcpRegistry.start({
+          name: payload.name,
+          transport: payload.transport,
+          command: payload.command,
+          args: payload.args,
+          env: payload.env,
+          allowedTools: payload.allowedTools,
+          enabled: true
+        });
+      } catch (err) {
+        send(ws, { type: "mcp.server.error", payload: { name: payload.name, error: String(err) } });
+      }
+    }
+    send(ws, { type: "mcp.operation_result", payload: { success: true, message: `Server "${payload.name}" added` } });
+  } catch (err) {
+    send(ws, { type: "mcp.operation_result", payload: { success: false, message: `Failed to add server: ${err}` } });
+  }
+}
+async function handleMcpRemove(ws, msg, _config, globalConfigPath, mcpRegistry) {
+  const payload = msg.payload;
+  if (!payload.name) {
+    send(ws, { type: "mcp.operation_result", payload: { success: false, message: "Server name is required" } });
+    return;
+  }
+  try {
+    if (mcpRegistry) {
+      try {
+        await mcpRegistry.stop(payload.name);
+      } catch {
+      }
+    }
+    const diskConfig = await readConfig(globalConfigPath);
+    const mcpServers = isMcpServerRecord(diskConfig.mcpServers) ? diskConfig.mcpServers : {};
+    if (!mcpServers[payload.name]) {
+      send(ws, { type: "mcp.operation_result", payload: { success: false, message: `Server "${payload.name}" not found` } });
+      return;
+    }
+    delete mcpServers[payload.name];
+    diskConfig.mcpServers = mcpServers;
+    await writeConfig(globalConfigPath, diskConfig);
+    send(ws, { type: "mcp.server.removed", payload: { name: payload.name } });
+    send(ws, { type: "mcp.operation_result", payload: { success: true, message: `Server "${payload.name}" removed` } });
+  } catch (err) {
+    send(ws, { type: "mcp.operation_result", payload: { success: false, message: `Failed to remove server: ${err}` } });
+  }
+}
+async function handleMcpUpdate(ws, msg, _config, globalConfigPath) {
+  const payload = msg.payload;
+  if (!payload.name) {
+    send(ws, { type: "mcp.operation_result", payload: { success: false, message: "Server name is required" } });
+    return;
+  }
+  try {
+    const diskConfig = await readConfig(globalConfigPath);
+    const mcpServers = isMcpServerRecord(diskConfig.mcpServers) ? diskConfig.mcpServers : {};
+    if (!mcpServers[payload.name]) {
+      send(ws, { type: "mcp.operation_result", payload: { success: false, message: `Server "${payload.name}" not found` } });
+      return;
+    }
+    const existing = mcpServers[payload.name];
+    mcpServers[payload.name] = {
+      transport: payload.transport ?? existing.transport,
+      description: payload.description ?? existing.description,
+      enabled: payload.enabled ?? existing.enabled,
+      command: payload.command ?? existing.command,
+      args: payload.args ?? existing.args,
+      env: payload.env ?? existing.env,
+      allowedTools: payload.allowedTools ?? existing.allowedTools
+    };
+    diskConfig.mcpServers = mcpServers;
+    await writeConfig(globalConfigPath, diskConfig);
+    const updatedServer = projectServer(payload.name, mcpServers[payload.name]);
+    send(ws, { type: "mcp.server.updated", payload: { server: updatedServer } });
+    send(ws, { type: "mcp.operation_result", payload: { success: true, message: `Server "${payload.name}" updated` } });
+  } catch (err) {
+    send(ws, { type: "mcp.operation_result", payload: { success: false, message: `Failed to update server: ${err}` } });
+  }
+}
+async function handleMcpWake(ws, msg, _config, _globalConfigPath, mcpRegistry) {
+  const payload = msg.payload;
+  if (!payload.name) {
+    send(ws, { type: "mcp.operation_result", payload: { success: false, message: "Server name is required" } });
+    return;
+  }
+  if (!mcpRegistry) {
+    send(ws, { type: "mcp.operation_result", payload: { success: false, message: "MCP registry not available" } });
+    return;
+  }
+  try {
+    send(ws, { type: "mcp.server.waking", payload: { name: payload.name } });
+    await mcpRegistry.restart(payload.name);
+    send(ws, { type: "mcp.server.connected", payload: { name: payload.name } });
+    send(ws, { type: "mcp.operation_result", payload: { success: true, message: `Server "${payload.name}" restarted` } });
+  } catch (err) {
+    send(ws, { type: "mcp.server.error", payload: { name: payload.name, error: String(err) } });
+    send(ws, { type: "mcp.operation_result", payload: { success: false, message: `Failed to restart "${payload.name}": ${err}` } });
+  }
+}
+async function handleMcpSleep(ws, msg, _config, _globalConfigPath, mcpRegistry) {
+  const payload = msg.payload;
+  if (!payload.name) {
+    send(ws, { type: "mcp.operation_result", payload: { success: false, message: "Server name is required" } });
+    return;
+  }
+  if (!mcpRegistry) {
+    send(ws, { type: "mcp.operation_result", payload: { success: false, message: "MCP registry not available" } });
+    return;
+  }
+  try {
+    await mcpRegistry.stop(payload.name);
+    send(ws, { type: "mcp.server.sleeping", payload: { name: payload.name } });
+    send(ws, { type: "mcp.operation_result", payload: { success: true, message: `Server "${payload.name}" stopped` } });
+  } catch (err) {
+    send(ws, { type: "mcp.server.error", payload: { name: payload.name, error: String(err) } });
+    send(ws, { type: "mcp.operation_result", payload: { success: false, message: `Failed to stop "${payload.name}": ${err}` } });
+  }
+}
+async function handleMcpDiscover(ws, msg, _config, _globalConfigPath, _mcpRegistry) {
+  const payload = msg.payload;
+  if (!payload.name) {
+    send(ws, { type: "mcp.operation_result", payload: { success: false, message: "Server name is required" } });
+    return;
+  }
+  send(ws, { type: "mcp.server.discovered", payload: { name: payload.name, tools: [] } });
+  send(ws, { type: "mcp.operation_result", payload: { success: true, message: `Server "${payload.name}" tools were discovered on connect` } });
+}
+async function handleMcpEnable(ws, msg, _config, _globalConfigPath) {
+  const payload = msg.payload;
+  if (!payload.name) {
+    send(ws, { type: "mcp.operation_result", payload: { success: false, message: "Server name is required" } });
+    return;
+  }
+  send(ws, { type: "mcp.operation_result", payload: { success: true, message: `Enable command sent for "${payload.name}"` } });
+}
+async function handleMcpDisable(ws, msg, _config, _globalConfigPath) {
+  const payload = msg.payload;
+  if (!payload.name) {
+    send(ws, { type: "mcp.operation_result", payload: { success: false, message: "Server name is required" } });
+    return;
+  }
+  send(ws, { type: "mcp.operation_result", payload: { success: true, message: `Disable command sent for "${payload.name}"` } });
+}
+async function handleMcpRestart(ws, msg, _config, _globalConfigPath) {
+  const payload = msg.payload;
+  if (!payload.name) {
+    send(ws, { type: "mcp.operation_result", payload: { success: false, message: "Server name is required" } });
+    return;
   }
+  send(ws, { type: "mcp.operation_result", payload: { success: true, message: `Restart command sent for "${payload.name}"` } });
 }
 
 // src/server/index.ts
@@ -1957,14 +2794,14 @@ function registerShutdownHandlers(res) {
 
 // src/server/instance-registry.ts
 import * as os from "os";
-import * as path3 from "path";
-import * as fs3 from "fs/promises";
+import * as path4 from "path";
+import * as fs4 from "fs/promises";
 import { atomicWrite as atomicWrite2 } from "@wrongstack/core";
 function defaultBaseDir() {
-  return path3.join(os.homedir(), ".wrongstack");
+  return path4.join(os.homedir(), ".wrongstack");
 }
 function registryPath(baseDir = defaultBaseDir()) {
-  return path3.join(baseDir, "webui-instances.json");
+  return path4.join(baseDir, "webui-instances.json");
 }
 function isPidAlive(pid) {
   if (!Number.isInteger(pid) || pid <= 0) return false;
@@ -1977,7 +2814,7 @@ function isPidAlive(pid) {
 }
 async function load(file) {
   try {
-    const raw = await fs3.readFile(file, "utf8");
+    const raw = await fs4.readFile(file, "utf8");
     const parsed = JSON.parse(raw);
     if (parsed?.version === 1 && Array.isArray(parsed.instances)) {
       return parsed;
@@ -2125,15 +2962,15 @@ import { DefaultSecretScrubber as DefaultSecretScrubber2 } from "@wrongstack/cor
 import { probeLocalLlm } from "@wrongstack/runtime/probe";
 
 // src/server/provider-config-io.ts
-import * as fs4 from "fs/promises";
-import * as path4 from "path";
+import * as fs5 from "fs/promises";
+import * as path5 from "path";
 import { atomicWrite as atomicWrite3 } from "@wrongstack/core";
 import { decryptConfigSecrets, encryptConfigSecrets } from "@wrongstack/core/security";
 import { DefaultSecretVault } from "@wrongstack/core";
 async function loadSavedProviders(configPath, vault) {
   let raw;
   try {
-    raw = await fs4.readFile(configPath, "utf8");
+    raw = await fs5.readFile(configPath, "utf8");
   } catch {
     return {};
   }
@@ -2150,7 +2987,7 @@ async function saveProviders(configPath, vault, providers) {
   let raw;
   let fileExists = true;
   try {
-    raw = await fs4.readFile(configPath, "utf8");
+    raw = await fs5.readFile(configPath, "utf8");
   } catch (err) {
     if (err.code !== "ENOENT") {
       throw new Error(
@@ -2201,7 +3038,7 @@ function writeKeysBack(cfg, keys) {
   }
   cfg.apiKeys = keys;
   const active = keys.find((k) => k.label === cfg.activeKey) ?? expectDefined(keys[0]);
-  cfg.apiKey = active.apiKey;
+  delete cfg.apiKey;
   if (!cfg.activeKey || !keys.some((k) => k.label === cfg.activeKey)) {
     cfg.activeKey = active.label;
   }
@@ -2325,9 +3162,9 @@ function createProviderHandlers(deps) {
       const providers = await loadConfigProviders();
       const result = upsertKey(providers, providerId, label, apiKey, (/* @__PURE__ */ new Date()).toISOString());
       if (result.ok) await saveConfigProviders(providers);
-      sendResult(ws, result.ok, result.message);
+      sendResult2(ws, result.ok, result.message);
     } catch (err) {
-      sendResult(ws, false, errMessage(err));
+      sendResult2(ws, false, errMessage(err));
     }
   }
   async function handleKeyDelete(ws, providerId, label) {
@@ -2335,9 +3172,9 @@ function createProviderHandlers(deps) {
       const providers = await loadConfigProviders();
       const result = deleteKey(providers, providerId, label);
       if (result.ok) await saveConfigProviders(providers);
-      sendResult(ws, result.ok, result.message);
+      sendResult2(ws, result.ok, result.message);
     } catch (err) {
-      sendResult(ws, false, errMessage(err));
+      sendResult2(ws, false, errMessage(err));
     }
   }
   async function handleKeySetActive(ws, providerId, label) {
@@ -2345,9 +3182,9 @@ function createProviderHandlers(deps) {
       const providers = await loadConfigProviders();
       const result = setActiveKey(providers, providerId, label);
       if (result.ok) await saveConfigProviders(providers);
-      sendResult(ws, result.ok, result.message);
+      sendResult2(ws, result.ok, result.message);
     } catch (err) {
-      sendResult(ws, false, errMessage(err));
+      sendResult2(ws, false, errMessage(err));
     }
   }
   async function handleProviderAdd(ws, payload) {
@@ -2355,13 +3192,13 @@ function createProviderHandlers(deps) {
       const providers = await loadConfigProviders();
       const result = addProvider(providers, payload, (/* @__PURE__ */ new Date()).toISOString());
       if (result.ok) await saveConfigProviders(providers);
-      sendResult(ws, result.ok, result.message);
+      sendResult2(ws, result.ok, result.message);
       if (result.ok) {
         console.log(`[WebUI] Provider "${payload.id}" added via provider.add`);
         broadcastSaved(providers);
       }
     } catch (err) {
-      sendResult(ws, false, errMessage(err));
+      sendResult2(ws, false, errMessage(err));
     }
   }
   async function handleProviderRemove(ws, providerId) {
@@ -2369,9 +3206,9 @@ function createProviderHandlers(deps) {
       const providers = await loadConfigProviders();
       const result = removeProvider(providers, providerId);
       if (result.ok) await saveConfigProviders(providers);
-      sendResult(ws, result.ok, result.message);
+      sendResult2(ws, result.ok, result.message);
     } catch (err) {
-      sendResult(ws, false, errMessage(err));
+      sendResult2(ws, false, errMessage(err));
     }
   }
   function broadcastSaved(providers) {
@@ -2385,15 +3222,15 @@ function createProviderHandlers(deps) {
       const providers = await loadConfigProviders();
       const cfg = providers[providerId];
       if (!cfg) {
-        sendResult(ws, false, `Unknown provider "${providerId}"`);
+        sendResult2(ws, false, `Unknown provider "${providerId}"`);
         return;
       }
       delete cfg.models;
       await saveConfigProviders(providers);
-      sendResult(ws, true, `Cleared model allowlist for ${providerId}`);
+      sendResult2(ws, true, `Cleared model allowlist for ${providerId}`);
       broadcastSaved(providers);
     } catch (err) {
-      sendResult(ws, false, errMessage(err));
+      sendResult2(ws, false, errMessage(err));
     }
   }
   async function handleProviderUndoClear(ws, providerId, previousModels) {
@@ -2401,15 +3238,15 @@ function createProviderHandlers(deps) {
       const providers = await loadConfigProviders();
       const cfg = providers[providerId];
       if (!cfg) {
-        sendResult(ws, false, `Unknown provider "${providerId}"`);
+        sendResult2(ws, false, `Unknown provider "${providerId}"`);
         return;
       }
       cfg.models = [...previousModels];
       await saveConfigProviders(providers);
-      sendResult(ws, true, `Restored ${previousModels.length} model(s) for ${providerId}`);
+      sendResult2(ws, true, `Restored ${previousModels.length} model(s) for ${providerId}`);
       broadcastSaved(providers);
     } catch (err) {
-      sendResult(ws, false, errMessage(err));
+      sendResult2(ws, false, errMessage(err));
     }
   }
   async function handleProviderUpdate(ws, payload) {
@@ -2417,7 +3254,7 @@ function createProviderHandlers(deps) {
       const providers = await loadConfigProviders();
       const cfg = providers[payload.id];
       if (!cfg) {
-        sendResult(ws, false, `Unknown provider "${payload.id}"`);
+        sendResult2(ws, false, `Unknown provider "${payload.id}"`);
         return;
       }
       if (payload.family !== void 0) cfg.family = payload.family;
@@ -2425,10 +3262,10 @@ function createProviderHandlers(deps) {
       if (payload.envVars !== void 0) cfg.envVars = payload.envVars;
       if (payload.models !== void 0) cfg.models = payload.models;
       await saveConfigProviders(providers);
-      sendResult(ws, true, `Updated ${payload.id}`);
+      sendResult2(ws, true, `Updated ${payload.id}`);
       broadcastSaved(providers);
     } catch (err) {
-      sendResult(ws, false, errMessage(err));
+      sendResult2(ws, false, errMessage(err));
     }
   }
   async function handleProviderProbe(ws, providerId, timeoutMs) {
@@ -2473,9 +3310,12 @@ function createProviderHandlers(deps) {
 }
 
 // src/server/setup-events.ts
-import * as path5 from "path";
+import * as fs6 from "fs/promises";
+import { watch as fsWatch } from "fs";
+import * as path6 from "path";
 function setupEvents(deps) {
-  const { events, broadcast: broadcast2, clients, config, context, pendingConfirms, globalConfigPath, sessionBridge } = deps;
+  const { events, broadcast: broadcast2, clients, config, context, pendingConfirms, globalConfigPath, sessionBridge, wpaths, watcherMetrics, onFleetBroadcaster } = deps;
+  const disposers = [];
   events.on("iteration.started", (e) => {
     const maxIt = typeof context.meta["maxIterations"] === "number" ? context.meta["maxIterations"] : config.tools?.maxIterations ?? 100;
     broadcast2(clients, {
@@ -2506,7 +3346,11 @@ function setupEvents(deps) {
   events.on("tool.progress", (e) => {
     broadcast2(clients, {
       type: "tool.progress",
-      payload: { id: e.id, name: e.name, eventType: e.event.type, text: e.event.text }
+      // Nested `event` shape — the client handler reads `payload.event?.text`
+      // and early-returns on a falsy text, so a flat { eventType, text } payload
+      // makes live tool progress (bash streaming, partial_output, warnings)
+      // never render. Must match WSToolProgress and the CLI server.
+      payload: { id: e.id, name: e.name, event: { type: e.event.type, text: e.event.text, data: e.event.data } }
     });
     sessionBridge?.append({
       type: "tool_progress",
@@ -2672,20 +3516,165 @@ function setupEvents(deps) {
   events.onPattern("brain.*", (eventName, payload) => {
     broadcast2(clients, { type: "brain.event", payload: { event: eventName, ...payload } });
   });
-  const globalRoot = globalConfigPath ? path5.dirname(globalConfigPath) : void 0;
+  events.on("client.status", async (e) => {
+    broadcast2(clients, { type: "client.status_update", payload: e });
+    if (wpaths?.projectStatus) {
+      try {
+        const statusFile = wpaths.projectStatus(e.projectHash);
+        const dir = path6.dirname(statusFile);
+        await fs6.mkdir(dir, { recursive: true });
+        await fs6.writeFile(statusFile, JSON.stringify(e, null, 2), "utf-8");
+      } catch (err) {
+        console.error("[setup-events] Failed to write status.json:", err);
+      }
+    }
+  });
+  if (wpaths?.projectStatus && wpaths.configDir) {
+    const projectsDir = path6.join(wpaths.configDir, "projects");
+    const knownProjectHashes = /* @__PURE__ */ new Set();
+    const debounceTimers = /* @__PURE__ */ new Map();
+    const DEBOUNCE_MS = 150;
+    const pendingStatuses = /* @__PURE__ */ new Map();
+    if (watcherMetrics) {
+      watcherMetrics.fileChangesDetected = 0;
+      watcherMetrics.filesProcessed = 0;
+      watcherMetrics.broadcastsSent = 0;
+      watcherMetrics.debounceResets = 0;
+      watcherMetrics.totalDebounceDelayMs = 0;
+      watcherMetrics.activeProjects = 0;
+      watcherMetrics.averageDebounceDelayMs = 0;
+      watcherMetrics.watcherActive = true;
+    }
+    const getAverageDebounceDelay = () => {
+      if (!watcherMetrics || watcherMetrics.broadcastsSent === 0) return 0;
+      return watcherMetrics.totalDebounceDelayMs / watcherMetrics.broadcastsSent;
+    };
+    const logWatcherMetrics = () => {
+      if (!watcherMetrics) return;
+      watcherMetrics.averageDebounceDelayMs = getAverageDebounceDelay();
+      console.log(
+        `[setup-events] File watcher stats: ${watcherMetrics.broadcastsSent} broadcasts, ${watcherMetrics.fileChangesDetected} file changes, ${watcherMetrics.debounceResets} debounce resets, avg delay: ${watcherMetrics.averageDebounceDelayMs.toFixed(1)}ms, ${watcherMetrics.activeProjects} active projects`
+      );
+    };
+    const metricsInterval = setInterval(logWatcherMetrics, 6e4);
+    const broadcastStatus = (projectHash2, statusData, actualDelayMs) => {
+      broadcast2(clients, { type: "client.status_update", payload: statusData });
+      if (watcherMetrics) {
+        watcherMetrics.broadcastsSent++;
+        watcherMetrics.totalDebounceDelayMs += actualDelayMs;
+        watcherMetrics.averageDebounceDelayMs = getAverageDebounceDelay();
+      }
+    };
+    const scheduleBroadcast = (projectHash2, statusData) => {
+      const now = Date.now();
+      const existing = pendingStatuses.get(projectHash2);
+      if (existing && watcherMetrics) {
+        watcherMetrics.debounceResets++;
+      }
+      pendingStatuses.set(projectHash2, {
+        data: statusData,
+        firstWriteAt: existing ? existing.firstWriteAt : now
+      });
+      const existingTimer = debounceTimers.get(projectHash2);
+      if (existingTimer) {
+        clearTimeout(existingTimer);
+      }
+      const timer = setTimeout(() => {
+        debounceTimers.delete(projectHash2);
+        const pending = pendingStatuses.get(projectHash2);
+        if (pending) {
+          const actualDelay = Date.now() - pending.firstWriteAt;
+          broadcastStatus(projectHash2, pending.data, actualDelay);
+          pendingStatuses.delete(projectHash2);
+        }
+      }, DEBOUNCE_MS);
+      debounceTimers.set(projectHash2, timer);
+    };
+    let watcher;
+    const startWatcher = async () => {
+      try {
+        await fs6.mkdir(projectsDir, { recursive: true });
+        watcher = fsWatch(projectsDir, { persistent: true, recursive: true }, async (eventType, filename) => {
+          if (eventType === "change") {
+            if (filename == null) return;
+            if (watcherMetrics) watcherMetrics.fileChangesDetected++;
+            const targetFile = path6.join(projectsDir, String(filename));
+            if (targetFile.endsWith("status.json")) {
+              const projectHash2 = path6.basename(path6.dirname(targetFile));
+              if (knownProjectHashes.size > 0 && !knownProjectHashes.has(projectHash2)) {
+                return;
+              }
+              if (watcherMetrics) watcherMetrics.filesProcessed++;
+              try {
+                const content = await fs6.readFile(targetFile, "utf-8");
+                const statusData = JSON.parse(content);
+                if (statusData.projectHash) {
+                  const hash = String(statusData.projectHash);
+                  if (!knownProjectHashes.has(hash)) {
+                    knownProjectHashes.add(hash);
+                    if (watcherMetrics) watcherMetrics.activeProjects = knownProjectHashes.size;
+                  }
+                }
+                scheduleBroadcast(projectHash2, statusData);
+              } catch {
+              }
+            }
+          }
+        });
+        console.log(`[setup-events] Watching ${projectsDir} for status.json changes (hash-filtered, debounced)`);
+      } catch (err) {
+        console.error("[setup-events] Failed to start status file watcher:", err);
+      }
+    };
+    events.on("client.status", (e) => {
+      if (e.projectHash) {
+        const hash = String(e.projectHash);
+        if (!knownProjectHashes.has(hash)) {
+          knownProjectHashes.add(hash);
+          if (watcherMetrics) watcherMetrics.activeProjects = knownProjectHashes.size;
+        }
+      }
+    });
+    startWatcher();
+    disposers.push(() => {
+      clearInterval(metricsInterval);
+      logWatcherMetrics();
+      if (watcherMetrics) watcherMetrics.watcherActive = false;
+      for (const [projectHash2, pending] of pendingStatuses) {
+        const timer = debounceTimers.get(projectHash2);
+        if (timer) {
+          clearTimeout(timer);
+          broadcastStatus(projectHash2, pending.data, 0);
+        }
+      }
+      for (const timer of debounceTimers.values()) {
+        clearTimeout(timer);
+      }
+      debounceTimers.clear();
+      pendingStatuses.clear();
+      if (watcher) {
+        watcher.close();
+        console.log("[setup-events] Closed status file watcher");
+      }
+    });
+  }
+  const globalRoot = globalConfigPath ? path6.dirname(globalConfigPath) : void 0;
   if (globalRoot) {
-    const statusInterval = setInterval(async () => {
+    const broadcastSessions = async () => {
       try {
         const { SessionRegistry } = await import("@wrongstack/core");
         const registry = new SessionRegistry(globalRoot);
         const sessions = await registry.list();
-        const live = sessions.filter((s) => s.status !== "stale").map((s) => ({
+        const mySlug = sessions.find((s) => s.pid === process.pid)?.projectSlug;
+        const live = sessions.filter((s) => s.status !== "stale").filter((s) => mySlug ? s.projectSlug === mySlug : true).map((s) => ({
           sessionId: s.sessionId,
           projectName: s.projectName,
           projectSlug: s.projectSlug,
           projectRoot: s.projectRoot,
           workingDir: s.workingDir,
           gitBranch: s.gitBranch,
+          // Surface (tui/webui/cli) so Fleet HQ can label each live client node.
+          clientType: s.clientType,
           status: s.status,
           pid: s.pid,
           startedAt: s.startedAt,
@@ -2697,24 +3686,56 @@ function setupEvents(deps) {
             currentTool: a.currentTool,
             iterations: a.iterations,
             toolCalls: a.toolCalls,
+            costUsd: a.costUsd,
+            tokensIn: a.tokensIn,
+            tokensOut: a.tokensOut,
+            ctxPct: a.ctxPct,
+            model: a.model,
+            partialText: a.partialText,
             lastActivityAt: a.lastActivityAt
           }))
         }));
         broadcast2(clients, { type: "sessions.status_update", payload: { sessions: live } });
       } catch {
       }
-    }, 5e3);
+    };
+    onFleetBroadcaster?.(broadcastSessions);
+    const statusInterval = setInterval(() => void broadcastSessions(), 5e3);
     if (statusInterval.unref) statusInterval.unref();
+    disposers.push(() => clearInterval(statusInterval));
+    let regDebounce;
+    try {
+      const regWatcher = fsWatch(globalRoot, { persistent: false }, (_event, filename) => {
+        const name = filename ? String(filename) : "";
+        if (!name.startsWith("session-registry.json") || name.endsWith(".lock")) return;
+        if (regDebounce) clearTimeout(regDebounce);
+        regDebounce = setTimeout(() => void broadcastSessions(), 150);
+      });
+      disposers.push(() => {
+        if (regDebounce) clearTimeout(regDebounce);
+        regWatcher.close();
+      });
+    } catch {
+    }
+    void broadcastSessions();
   }
+  return () => {
+    for (const dispose of disposers) {
+      try {
+        dispose();
+      } catch {
+      }
+    }
+  };
 }
 
 // src/server/custom-context-modes.ts
 import { listContextWindowModes, atomicWrite as atomicWrite4 } from "@wrongstack/core";
-import * as fs5 from "fs/promises";
-import * as path6 from "path";
+import * as fs7 from "fs/promises";
+import * as path7 from "path";
 var STORE_FILENAME = "custom-context-modes.json";
 function storePath(wrongstackDir) {
-  return path6.join(wrongstackDir, STORE_FILENAME);
+  return path7.join(wrongstackDir, STORE_FILENAME);
 }
 var BUILTIN_IDS = /* @__PURE__ */ new Set(["balanced", "frugal", "deep", "archival"]);
 function createCustomModeStore(wrongstackDir) {
@@ -2722,7 +3743,7 @@ function createCustomModeStore(wrongstackDir) {
   const load2 = async () => {
     modes.clear();
     try {
-      const raw = await fs5.readFile(storePath(wrongstackDir), "utf8");
+      const raw = await fs7.readFile(storePath(wrongstackDir), "utf8");
       const parsed = JSON.parse(raw);
       if (Array.isArray(parsed.modes)) {
         for (const m of parsed.modes) {
@@ -2902,14 +3923,14 @@ function createEternalSubscription(subscribe, broadcast2, clientsRef) {
 }
 
 // src/server/shell-open.ts
-import * as fs6 from "fs/promises";
-import * as path7 from "path";
+import * as fs8 from "fs/promises";
+import * as path8 from "path";
 import { spawn as spawn2 } from "child_process";
 var METACHAR_REGEX = /[&|<>^"'`\n\r]/;
 async function handleShellOpen(req, logger) {
   try {
-    const resolved = path7.resolve(req.path);
-    await fs6.access(resolved);
+    const resolved = path8.resolve(req.path);
+    await fs8.access(resolved);
     if (METACHAR_REGEX.test(resolved)) {
       return { success: false, message: "Path contains unsupported characters." };
     }
@@ -2955,6 +3976,43 @@ async function handleShellOpen(req, logger) {
   }
 }
 
+// src/server/git-handlers.ts
+async function handleGitInfo(ws, projectRoot) {
+  const cwd = projectRoot || void 0;
+  try {
+    const { execFile: ef } = await import("child_process");
+    const git = (args) => new Promise((resolve5) => {
+      ef("git", args, { cwd, timeout: 3e3 }, (err, stdout) => {
+        resolve5(err ? "" : stdout.trim());
+      });
+    });
+    const [branchRaw, diffRaw, statusRaw, upstreamRaw] = await Promise.all([
+      git(["branch", "--show-current"]),
+      git(["diff", "--stat"]),
+      git(["status", "--porcelain"]),
+      git(["rev-list", "--left-right", "--count", "@{upstream}...HEAD"])
+    ]);
+    const branch = branchRaw || "(detached)";
+    const addMatch = /(\d+)\s+insertion/i.exec(diffRaw);
+    const delMatch = /(\d+)\s+deletion/i.exec(diffRaw);
+    const added = addMatch ? Number(addMatch[1]) : 0;
+    const deleted = delMatch ? Number(delMatch[1]) : 0;
+    const untracked = statusRaw.split("\n").filter((l) => l.startsWith("??")).length;
+    const [behindRaw, aheadRaw] = (upstreamRaw || "0	0").split("	");
+    const behind = Number(behindRaw) || 0;
+    const ahead = Number(aheadRaw) || 0;
+    send(ws, { type: "git.info", payload: { branch, added, deleted, untracked, ahead, behind } });
+  } catch {
+    send(ws, { type: "git.info", payload: { branch: "", added: 0, deleted: 0, untracked: 0, ahead: 0, behind: 0 } });
+  }
+}
+
+// src/server/skills-handlers.ts
+import { promises as fs9 } from "fs";
+import path9 from "path";
+import JSZip from "jszip";
+import { wstackGlobalRoot } from "@wrongstack/core/utils";
+
 // src/server/index.ts
 async function startWebUI(opts = {}) {
   const requestedWsPort = opts.wsPort ?? 3457;
@@ -3069,15 +4127,22 @@ async function startWebUI(opts = {}) {
       sessionId: session.id,
       projectSlug: wpaths.projectSlug,
       projectRoot,
-      projectName: path8.basename(projectRoot),
+      projectName: path10.basename(projectRoot),
       workingDir,
+      clientType: "webui",
       pid: process.pid,
       startedAt: (/* @__PURE__ */ new Date()).toISOString()
     });
-    statusTracker = new AgentStatusTracker({ events, registry });
+    const fleetNotifier = new FleetNotifier({
+      baseDir: wpaths.globalRoot,
+      projectRoot,
+      selfPid: process.pid
+    });
+    statusTracker = new AgentStatusTracker({ events, registry, onUpdate: () => fleetNotifier.notify() });
     statusTracker.start();
     const stopTracking = async () => {
       try {
+        fleetNotifier.dispose();
         await registry.markClosing();
         statusTracker?.stop();
       } catch {
@@ -3117,6 +4182,13 @@ async function startWebUI(opts = {}) {
     supportsReasoning: resolvedModel.capabilities.reasoning
   } : void 0;
   const skillLoader = config.features.skills ? new DefaultSkillLoader2({ paths: wpaths }) : void 0;
+  const skillInstaller = config.features.skills ? new SkillInstaller({
+    manifestPath: path10.join(wstackGlobalRoot2(), "installed-skills.json"),
+    projectSkillsDir: path10.join(projectRoot, ".wrongstack", "skills"),
+    globalSkillsDir: path10.join(wstackGlobalRoot2(), "skills"),
+    projectHash: projectHash(projectRoot),
+    skillLoader
+  }) : void 0;
   const systemPromptBuilder = new DefaultSystemPromptBuilder2({
     memoryStore,
     skillLoader,
@@ -3186,7 +4258,7 @@ async function startWebUI(opts = {}) {
       }
     } else {
       throw new Error(
-        "No provider configured. Run `wrongstack init` first, or configure via the WebUI."
+        "No provider configured. Run `wrongstack auth` to set up, or configure via the WebUI."
       );
     }
   }
@@ -3274,7 +4346,7 @@ async function startWebUI(opts = {}) {
     const write = async () => {
       let raw;
       try {
-        raw = await fs7.readFile(globalConfigPath, "utf8");
+        raw = await fs10.readFile(globalConfigPath, "utf8");
       } catch {
         raw = "{}";
       }
@@ -3583,7 +4655,7 @@ async function startWebUI(opts = {}) {
       inputCost,
       outputCost,
       cacheReadCost,
-      projectName: path8.basename(projectRoot) || projectRoot,
+      projectName: path10.basename(projectRoot) || projectRoot,
       projectRoot,
       cwd: workingDir,
       mode: modeId,
@@ -3637,10 +4709,11 @@ async function startWebUI(opts = {}) {
   const RATE_LIMIT_MESSAGES = Number.parseInt(process.env["WEBUI_RATE_LIMIT"] ?? "0", 10);
   const RATE_LIMIT_WINDOW_MS = 6e4;
   const rateLimits = /* @__PURE__ */ new Map();
-  function checkRateLimit(ws, client) {
+  let connSeq = 0;
+  function checkRateLimit(_ws, client) {
     if (RATE_LIMIT_MESSAGES <= 0) return true;
     const now = Date.now();
-    const key = client.sessionId ?? String(ws);
+    const key = client.connId;
     const limit = rateLimits.get(key);
     if (!limit || now > limit.resetAt) {
       rateLimits.set(key, { count: 1, resetAt: now + RATE_LIMIT_WINDOW_MS });
@@ -3656,7 +4729,12 @@ async function startWebUI(opts = {}) {
   );
   const pendingConfirms = /* @__PURE__ */ new Map();
   const handleConnection = (ws) => {
-    const client = { ws, sessionId: session.id, connectedAt: Date.now() };
+    const client = {
+      ws,
+      sessionId: session.id,
+      connectedAt: Date.now(),
+      connId: `c${++connSeq}`
+    };
     clients.set(ws, client);
     void sessionStartPayload().then((payload) => {
       send(ws, { type: "session.start", payload });
@@ -3686,7 +4764,7 @@ async function startWebUI(opts = {}) {
         const rawObj = JSON.parse(data.toString());
         if (typeof rawObj === "object" && rawObj !== null) {
           const obj = rawObj;
-          if ("__proto__" in obj || "constructor" in obj || "prototype" in obj) {
+          if (Object.hasOwn(obj, "__proto__") || Object.hasOwn(obj, "constructor") || Object.hasOwn(obj, "prototype")) {
             send(ws, {
               type: "error",
               payload: { phase: "parse", message: "Invalid message object" }
@@ -3707,8 +4785,9 @@ async function startWebUI(opts = {}) {
       }
     });
     ws.on("close", () => {
+      const closing = clients.get(ws);
       clients.delete(ws);
-      rateLimits.delete(String(ws));
+      if (closing) rateLimits.delete(closing.connId);
       if (pendingConfirms.size > 0) {
         for (const [id, resolve5] of pendingConfirms) {
           resolve5("no");
@@ -3734,11 +4813,27 @@ async function startWebUI(opts = {}) {
     { sampling: sessionLogging.sampling }
   );
   let eventsArmed = false;
+  let disposeEvents = null;
+  let fleetBroadcast = null;
   const armOnce = (label) => {
     if (eventsArmed) return;
     eventsArmed = true;
     console.log(`[WebUI] Backend ready (${label})`);
-    setupEvents({ events, broadcast, clients, config, context, pendingConfirms, globalConfigPath, sessionBridge });
+    disposeEvents = setupEvents({
+      events,
+      broadcast,
+      clients,
+      config,
+      context,
+      pendingConfirms,
+      globalConfigPath,
+      sessionBridge,
+      wpaths,
+      watcherMetrics,
+      onFleetBroadcaster: (fn) => {
+        fleetBroadcast = fn;
+      }
+    });
   };
   wssPrimary.on("listening", () => armOnce(`${wsHost}:${wsPort}`));
   wssPrimary.on("connection", handleConnection);
@@ -3775,33 +4870,33 @@ async function startWebUI(opts = {}) {
     });
   }
   async function touchProjectEntry(root, workDir) {
-    const resolved = path8.resolve(root);
+    const resolved = path10.resolve(root);
     const manifest = await loadManifest(globalConfigPath);
     const now = (/* @__PURE__ */ new Date()).toISOString();
-    const existing = manifest.projects.find((p) => path8.resolve(p.root) === resolved);
+    const existing = manifest.projects.find((p) => path10.resolve(p.root) === resolved);
     if (existing) {
       existing.lastSeen = now;
-      if (workDir) existing.lastWorkingDir = path8.resolve(workDir);
+      if (workDir) existing.lastWorkingDir = path10.resolve(workDir);
     } else {
       manifest.projects.push({
-        name: path8.basename(resolved),
+        name: path10.basename(resolved),
         root: resolved,
         slug: generateProjectSlug(resolved),
         createdAt: now,
         lastSeen: now,
-        lastWorkingDir: workDir ? path8.resolve(workDir) : void 0
+        lastWorkingDir: workDir ? path10.resolve(workDir) : void 0
       });
     }
     await saveManifest(manifest, globalConfigPath);
     await ensureProjectDataDir(generateProjectSlug(resolved), globalConfigPath);
   }
   function projectsJsonPath(globalConfigPath2) {
-    const base = path8.dirname(globalConfigPath2);
-    return path8.join(base, "projects.json");
+    const base = path10.dirname(globalConfigPath2);
+    return path10.join(base, "projects.json");
   }
   async function loadManifest(globalConfigPath2) {
     try {
-      const raw = await fs7.readFile(projectsJsonPath(globalConfigPath2), "utf8");
+      const raw = await fs10.readFile(projectsJsonPath(globalConfigPath2), "utf8");
       const parsed = JSON.parse(raw);
       return { projects: parsed.projects ?? [] };
     } catch {
@@ -3810,16 +4905,16 @@ async function startWebUI(opts = {}) {
   }
   async function saveManifest(manifest, globalConfigPath2) {
     const file = projectsJsonPath(globalConfigPath2);
-    await fs7.mkdir(path8.dirname(file), { recursive: true });
-    await fs7.writeFile(file, JSON.stringify(manifest, null, 2), "utf8");
+    await fs10.mkdir(path10.dirname(file), { recursive: true });
+    await fs10.writeFile(file, JSON.stringify(manifest, null, 2), "utf8");
   }
   function generateProjectSlug(rootPath) {
     return projectSlug(rootPath);
   }
   async function ensureProjectDataDir(slug, globalConfigPath2) {
-    const base = path8.dirname(globalConfigPath2);
-    const dir = path8.join(base, "projects", slug);
-    await fs7.mkdir(dir, { recursive: true });
+    const base = path10.dirname(globalConfigPath2);
+    const dir = path10.join(base, "projects", slug);
+    await fs10.mkdir(dir, { recursive: true });
     return dir;
   }
   async function handleMessage(ws, _client, msg) {
@@ -3929,7 +5024,7 @@ async function startWebUI(opts = {}) {
         context.readFiles.clear();
         context.fileMtimes.clear();
         tokenCounter.reset();
-        sendResult(ws, true, "Context cleared");
+        sendResult2(ws, true, "Context cleared");
         broadcast(clients, {
           type: "session.start",
           payload: { ...await sessionStartPayload(), reset: true }
@@ -3966,13 +5061,13 @@ async function startWebUI(opts = {}) {
               repaired: report.repaired
             }
           });
-          sendResult(
+          sendResult2(
             ws,
             true,
             `Compacted: ${report.before} \u2192 ${report.after} tokens (saved ~${Math.max(0, report.before - report.after)})`
           );
         } catch (err) {
-          sendResult(ws, false, errMessage(err));
+          sendResult2(ws, false, errMessage(err));
         }
         break;
       }
@@ -3991,7 +5086,7 @@ async function startWebUI(opts = {}) {
         };
         broadcast(clients, { type: "context.repaired", payload });
         const removed = payload.removedToolUses.length + payload.removedToolResults.length + payload.removedMessages;
-        sendResult(
+        sendResult2(
           ws,
           true,
           removed > 0 ? `Context repaired: removed ${removed} orphan protocol item(s)` : "Context repair found no orphan protocol blocks"
@@ -4025,14 +5120,14 @@ async function startWebUI(opts = {}) {
           );
           const custom = customModes.find((m) => m.id === id);
           if (!custom) {
-            sendResult(ws, false, `Unknown context mode "${id}"`);
+            sendResult2(ws, false, `Unknown context mode "${id}"`);
             break;
           }
           policy = custom;
         }
         context.meta["contextWindowMode"] = policy.id;
         context.meta["contextWindowPolicy"] = policy;
-        sendResult(ws, true, `Context mode switched to ${policy.id}`);
+        sendResult2(ws, true, `Context mode switched to ${policy.id}`);
         broadcast(clients, {
           type: "context.mode.changed",
           payload: { id: policy.id, name: policy.name, policy }
@@ -4052,7 +5147,7 @@ async function startWebUI(opts = {}) {
           aggressiveOn: "soft",
           targetLoad: 0.65
         });
-        sendResult(ws, result.ok, result.error ?? `Mode "${payload.id}" created`);
+        sendResult2(ws, result.ok, result.error ?? `Mode "${payload.id}" created`);
         break;
       }
       case "context.mode.update": {
@@ -4068,7 +5163,7 @@ async function startWebUI(opts = {}) {
           preserveK: payload.preserveK,
           eliseThreshold: payload.eliseThreshold
         });
-        sendResult(ws, result.ok, result.error ?? `Mode "${payload.id}" updated`);
+        sendResult2(ws, result.ok, result.error ?? `Mode "${payload.id}" updated`);
         break;
       }
       case "context.mode.delete": {
@@ -4078,7 +5173,7 @@ async function startWebUI(opts = {}) {
           context.meta["contextWindowPolicy"] = resolveContextWindowPolicy({}, DEFAULT_CONTEXT_WINDOW_MODE_ID);
         }
         const result = customModeStore.remove(id);
-        sendResult(ws, result.ok, result.error ?? `Mode "${id}" deleted`);
+        sendResult2(ws, result.ok, result.error ?? `Mode "${id}" deleted`);
         break;
       }
       case "providers.list": {
@@ -4159,14 +5254,15 @@ async function startWebUI(opts = {}) {
           context.provider = newProv;
           updateAutoCompactionMaxContext?.(newProv);
           try {
-            configWriteLock = configWriteLock.then(async () => {
-              const raw = await fs7.readFile(globalConfigPath, "utf8");
+            const next = configWriteLock.then(async () => {
+              const raw = await fs10.readFile(globalConfigPath, "utf8");
               const parsed = JSON.parse(raw);
               parsed.provider = newProvider;
               parsed.model = newModel;
               await atomicWrite5(globalConfigPath, JSON.stringify(parsed, null, 2));
             });
-            await configWriteLock;
+            configWriteLock = next.then(() => void 0, () => void 0);
+            await next;
           } catch (err) {
             console.warn(JSON.stringify({
               level: "warn",
@@ -4319,13 +5415,13 @@ async function startWebUI(opts = {}) {
         const { id } = msg.payload;
         try {
           if (id === session.id) {
-            sendResult(ws, false, "Cannot delete the active session");
+            sendResult2(ws, false, "Cannot delete the active session");
             break;
           }
           await sessionStore.delete(id);
-          sendResult(ws, true, `Session ${id} deleted`);
+          sendResult2(ws, true, `Session ${id} deleted`);
         } catch (err) {
-          sendResult(ws, false, errMessage(err));
+          sendResult2(ws, false, errMessage(err));
         }
         break;
       }
@@ -4333,7 +5429,7 @@ async function startWebUI(opts = {}) {
         const { id } = msg.payload;
         try {
           if (id === session.id) {
-            sendResult(ws, false, "Session is already active");
+            sendResult2(ws, false, "Session is already active");
             break;
           }
           const resumed = await sessionStore.resume(id);
@@ -4363,14 +5459,14 @@ async function startWebUI(opts = {}) {
               replayUsage: resumed.data.usage
             }
           });
-          sendResult(ws, true, `Resumed session ${id}`);
+          sendResult2(ws, true, `Resumed session ${id}`);
         } catch (err) {
-          sendResult(ws, false, errMessage(err));
+          sendResult2(ws, false, errMessage(err));
         }
         break;
       }
       case "session.save": {
-        sendResult(ws, true, `Session ${session.id} is auto-saved`);
+        sendResult2(ws, true, `Session ${session.id} is auto-saved`);
         break;
       }
       case "tools.list": {
@@ -4393,6 +5489,27 @@ async function startWebUI(opts = {}) {
         return handleMemoryRemember(ws, msg, memoryStore);
       case "memory.forget":
         return handleMemoryForget(ws, msg, memoryStore);
+      // ── MCP operations — delegated to shared handlers (mcp-handlers.ts) ──
+      case "mcp.list":
+        return handleMcpList(ws, msg, config, globalConfigPath, void 0);
+      case "mcp.add":
+        return handleMcpAdd(ws, msg, config, globalConfigPath, void 0);
+      case "mcp.remove":
+        return handleMcpRemove(ws, msg, config, globalConfigPath, void 0);
+      case "mcp.update":
+        return handleMcpUpdate(ws, msg, config, globalConfigPath);
+      case "mcp.wake":
+        return handleMcpWake(ws, msg, config, globalConfigPath, void 0);
+      case "mcp.sleep":
+        return handleMcpSleep(ws, msg, config, globalConfigPath, void 0);
+      case "mcp.discover":
+        return handleMcpDiscover(ws, msg, config, globalConfigPath);
+      case "mcp.enable":
+        return handleMcpEnable(ws, msg, config, globalConfigPath);
+      case "mcp.disable":
+        return handleMcpDisable(ws, msg, config, globalConfigPath);
+      case "mcp.restart":
+        return handleMcpRestart(ws, msg, config, globalConfigPath);
       case "skills.list": {
         if (!skillLoader) {
           send(ws, { type: "skills.list", payload: { skills: [], enabled: false } });
@@ -4402,6 +5519,18 @@ async function startWebUI(opts = {}) {
           const manifests = await skillLoader.list();
           const entries = await skillLoader.listEntries();
           const byName = new Map(entries.map((e) => [e.name, e]));
+          const sourceUrlsByName = /* @__PURE__ */ new Map();
+          const refsByName = /* @__PURE__ */ new Map();
+          if (skillInstaller) {
+            try {
+              const installed = await skillInstaller.listInstalled();
+              for (const entry of installed) {
+                sourceUrlsByName.set(entry.name, entry.source);
+                refsByName.set(entry.name, entry.ref);
+              }
+            } catch {
+            }
+          }
           send(ws, {
             type: "skills.list",
             payload: {
@@ -4411,6 +5540,8 @@ async function startWebUI(opts = {}) {
                 description: m.description,
                 version: m.version ?? "",
                 source: m.source,
+                sourceUrl: sourceUrlsByName.get(m.name) ?? "",
+                ref: refsByName.get(m.name) ?? "",
                 path: m.path,
                 trigger: byName.get(m.name)?.trigger ?? "",
                 scope: byName.get(m.name)?.scope ?? []
@@ -4429,6 +5560,261 @@ async function startWebUI(opts = {}) {
         }
         break;
       }
+      case "skills.content": {
+        if (!skillLoader) {
+          send(ws, { type: "skills.content", payload: { name: "", body: "", path: "", source: "", relatedFiles: [], references: [], error: "Skills not enabled" } });
+          break;
+        }
+        const contentPayload = msg.payload;
+        if (!contentPayload?.name) {
+          send(ws, { type: "skills.content", payload: { name: "", body: "", path: "", source: "", relatedFiles: [], references: [], error: "Skill name is required" } });
+          break;
+        }
+        try {
+          const { name, source } = contentPayload;
+          const entries = await skillLoader.listEntries();
+          const entry = entries.find((e) => e.name.toLowerCase() === name.toLowerCase());
+          if (!entry) {
+            send(ws, { type: "skills.content", payload: { name, body: "", path: "", source, relatedFiles: [], references: [], error: `Skill "${name}" not found` } });
+            break;
+          }
+          const body = await skillLoader.readBody(name);
+          const skillDir = path10.dirname(entry.path);
+          let relatedFiles = [];
+          try {
+            const files = await fs10.readdir(skillDir);
+            relatedFiles = files.filter((f) => f !== path10.basename(entry.path)).map((f) => path10.join(skillDir, f));
+          } catch {
+          }
+          const refs = [];
+          for (const e of entries) {
+            if (e.name.toLowerCase() === name.toLowerCase()) continue;
+            try {
+              const content = await skillLoader.readBody(e.name);
+              if (content.toLowerCase().includes(name.toLowerCase())) {
+                refs.push(e.name);
+              }
+            } catch {
+            }
+          }
+          send(ws, { type: "skills.content", payload: { name, body, path: entry.path, source, relatedFiles, references: refs } });
+        } catch (err) {
+          send(ws, { type: "skills.content", payload: { name: contentPayload.name, body: "", path: "", source: contentPayload.source, relatedFiles: [], references: [], error: errMessage(err) } });
+        }
+        break;
+      }
+      case "skills.install": {
+        if (!skillInstaller) {
+          send(ws, { type: "skills.installed", payload: { success: false, error: "Skills not enabled" } });
+          break;
+        }
+        const installPayload = msg.payload;
+        if (!installPayload?.ref?.trim()) {
+          send(ws, { type: "skills.installed", payload: { success: false, error: "Skill reference is required (e.g. owner/repo or https://github.com/owner/repo)" } });
+          break;
+        }
+        try {
+          const results = await skillInstaller.install(installPayload.ref.trim(), { global: installPayload.global });
+          send(ws, {
+            type: "skills.installed",
+            payload: {
+              success: true,
+              results,
+              error: null
+            }
+          });
+        } catch (err) {
+          send(ws, {
+            type: "skills.installed",
+            payload: {
+              success: false,
+              error: errMessage(err)
+            }
+          });
+        }
+        break;
+      }
+      case "skills.uninstall": {
+        if (!skillInstaller) {
+          send(ws, { type: "skills.uninstalled", payload: { success: false, error: "Skills not enabled" } });
+          break;
+        }
+        const uninstallPayload = msg.payload;
+        if (!uninstallPayload?.name?.trim()) {
+          send(ws, { type: "skills.uninstalled", payload: { success: false, error: "Skill name is required" } });
+          break;
+        }
+        try {
+          await skillInstaller.uninstall(uninstallPayload.name.trim(), { global: uninstallPayload.global });
+          send(ws, { type: "skills.uninstalled", payload: { success: true, error: null } });
+        } catch (err) {
+          send(ws, { type: "skills.uninstalled", payload: { success: false, error: errMessage(err) } });
+        }
+        break;
+      }
+      case "skills.update": {
+        if (!skillInstaller) {
+          send(ws, { type: "skills.updated", payload: { success: false, error: "Skills not enabled" } });
+          break;
+        }
+        const updatePayload = msg.payload;
+        try {
+          const result = await skillInstaller.update(updatePayload?.name, { global: updatePayload?.global });
+          send(ws, {
+            type: "skills.updated",
+            payload: {
+              success: true,
+              error: null,
+              updated: result.updated,
+              unchanged: result.unchanged,
+              errors: result.errors
+            }
+          });
+        } catch (err) {
+          send(ws, { type: "skills.updated", payload: { success: false, error: errMessage(err) } });
+        }
+        break;
+      }
+      case "skills.create": {
+        const createPayload = msg.payload;
+        if (!createPayload?.name?.trim()) {
+          send(ws, { type: "skills.created", payload: { success: false, error: "Skill name is required" } });
+          break;
+        }
+        if (!/^[a-z0-9]+(-[a-z0-9]+)*$/.test(createPayload.name.trim())) {
+          send(ws, { type: "skills.created", payload: { success: false, error: "Skill name must be kebab-case (e.g. my-new-skill)" } });
+          break;
+        }
+        if (!createPayload?.description?.trim()) {
+          send(ws, { type: "skills.created", payload: { success: false, error: "Description/trigger is required" } });
+          break;
+        }
+        try {
+          const targetDir = createPayload.scope === "global" ? path10.join(wstackGlobalRoot2(), "skills", createPayload.name.trim()) : path10.join(projectRoot, ".wrongstack", "skills", createPayload.name.trim());
+          try {
+            await fs10.access(targetDir);
+            send(ws, { type: "skills.created", payload: { success: false, error: `Skill "${createPayload.name}" already exists` } });
+            break;
+          } catch {
+          }
+          await fs10.mkdir(targetDir, { recursive: true });
+          const lines = createPayload.description.trim().split("\n");
+          const firstLine = lines[0].trim();
+          const bodyLines = lines.slice(1).map((l) => l.trim()).filter(Boolean);
+          const descriptionText = firstLine + (bodyLines.length > 0 ? `
+${bodyLines.join("\n")}` : "");
+          const trigger = bodyLines.find((l) => l.toLowerCase().startsWith("triggers:")) ?? "";
+          const skillContent = [
+            "---",
+            `name: ${createPayload.name.trim()}`,
+            "description: |",
+            `  ${descriptionText.replace(/\n/g, "\n  ")}`,
+            `version: 1.0.0`,
+            "---",
+            "",
+            `# ${createPayload.name.trim().split("-").map((w) => w.charAt(0).toUpperCase() + w.slice(1)).join(" ")}`,
+            "",
+            "## Overview",
+            "",
+            firstLine,
+            "",
+            ...bodyLines.length > 0 ? bodyLines.filter((l) => !l.toLowerCase().startsWith("triggers:")) : [],
+            "",
+            "## Rules",
+            "- TODO: add your first rule",
+            "",
+            "## Patterns",
+            "### Do",
+            "```ts",
+            "// TODO: add a good example",
+            "```",
+            "",
+            "### Don't",
+            "```ts",
+            "// TODO: add a bad example",
+            "```",
+            "",
+            "## Workflow",
+            "1. TODO: describe step one",
+            "2. TODO: describe step two",
+            "",
+            trigger ? `
+${trigger}
+` : "",
+            "## Skills in scope",
+            "- `bug-hunter` \u2014 for systematic bug detection patterns",
+            "- `output-standards` \u2014 for standardized `<next_steps>` formatting"
+          ].join("\n");
+          await fs10.writeFile(path10.join(targetDir, "SKILL.md"), skillContent, "utf-8");
+          send(ws, {
+            type: "skills.created",
+            payload: {
+              success: true,
+              error: null,
+              skill: { name: createPayload.name.trim(), path: path10.join(targetDir, "SKILL.md"), scope: createPayload.scope }
+            }
+          });
+        } catch (err) {
+          send(ws, { type: "skills.created", payload: { success: false, error: errMessage(err) } });
+        }
+        break;
+      }
+      case "skills.edit": {
+        if (!skillLoader) {
+          send(ws, { type: "skills.edited", payload: { success: false, error: "Skills not enabled" } });
+          break;
+        }
+        const editPayload = msg.payload;
+        if (!editPayload?.name?.trim()) {
+          send(ws, { type: "skills.edited", payload: { success: false, error: "Skill name is required" } });
+          break;
+        }
+        if (!editPayload?.body) {
+          send(ws, { type: "skills.edited", payload: { success: false, error: "Skill body is required" } });
+          break;
+        }
+        try {
+          const entries = await skillLoader.listEntries();
+          const entry = entries.find((e) => e.name.toLowerCase() === editPayload.name.toLowerCase());
+          if (!entry) {
+            send(ws, { type: "skills.edited", payload: { success: false, error: `Skill "${editPayload.name}" not found` } });
+            break;
+          }
+          if (entry.scope.includes("bundled")) {
+            send(ws, { type: "skills.edited", payload: { success: false, error: "Bundled skills cannot be edited" } });
+            break;
+          }
+          await fs10.writeFile(entry.path, editPayload.body, "utf-8");
+          send(ws, { type: "skills.edited", payload: { success: true, error: null } });
+        } catch (err) {
+          send(ws, { type: "skills.edited", payload: { success: false, error: errMessage(err) } });
+        }
+        break;
+      }
+      case "skills.export": {
+        if (!skillLoader) {
+          send(ws, { type: "skills.exported", payload: { zipBase64: "", skillCount: 0, error: "Skills not enabled" } });
+          break;
+        }
+        try {
+          const entries = await skillLoader.listEntries();
+          const zip = new JSZip2();
+          for (const entry of entries) {
+            try {
+              const body = await skillLoader.readBody(entry.name);
+              const safeName = entry.name.replace(/\//g, "_");
+              zip.file(`${safeName}/SKILL.md`, body);
+            } catch {
+            }
+          }
+          const zipBuffer = await zip.generateAsync({ type: "nodebuffer", compression: "DEFLATE" });
+          const zipBase64 = zipBuffer.toString("base64");
+          send(ws, { type: "skills.exported", payload: { zipBase64, skillCount: entries.length, error: void 0 } });
+        } catch (err) {
+          send(ws, { type: "skills.exported", payload: { zipBase64: "", skillCount: 0, error: errMessage(err) } });
+        }
+        break;
+      }
       case "diag.get": {
         const usage = tokenCounter.total();
         send(ws, {
@@ -4456,194 +5842,84 @@ async function startWebUI(opts = {}) {
         break;
       }
       case "todos.get": {
-        send(ws, {
-          type: "todos.updated",
-          payload: { todos: [...context.todos] }
-        });
+        const ctx = {
+          context: { todos: context.todos, meta: context.meta, session: context.session ? { id: context.session.id } : null, state: context.state },
+          send: (w, m) => send(w, m),
+          broadcast: (m) => broadcast(clients, m)
+        };
+        handleTodosGet(ctx, ws);
         break;
       }
       case "todos.clear": {
-        context.state.replaceTodos([]);
-        sendResult(ws, true, "Todos cleared");
-        broadcast(clients, { type: "todos.updated", payload: { todos: [] } });
+        const ctx = {
+          context: { todos: context.todos, meta: context.meta, session: context.session ? { id: context.session.id } : null, state: context.state },
+          send: (w, m) => send(w, m),
+          broadcast: (m) => broadcast(clients, m)
+        };
+        handleTodosClear(ctx, ws);
         break;
       }
       case "todos.remove": {
-        const payload = msg.payload;
-        if (!payload) {
-          sendResult(ws, false, "Missing id or index");
-          break;
-        }
-        const { id, index } = payload;
-        let targetIdx = -1;
-        if (typeof id === "string") {
-          targetIdx = context.todos.findIndex((t) => t.id === id);
-        } else if (typeof index === "number" && index > 0) {
-          targetIdx = index - 1;
-        }
-        if (targetIdx < 0 || !context.todos[targetIdx]) {
-          sendResult(ws, false, "Todo not found");
-          break;
-        }
-        const removed = expectDefined2(context.todos[targetIdx]);
-        const next = [...context.todos.slice(0, targetIdx), ...context.todos.slice(targetIdx + 1)];
-        context.state.replaceTodos(next);
-        sendResult(ws, true, `Removed: ${removed.content}`);
-        broadcast(clients, { type: "todos.updated", payload: { todos: next } });
+        const ctx = {
+          context: { todos: context.todos, meta: context.meta, session: context.session ? { id: context.session.id } : null, state: context.state },
+          send: (w, m) => send(w, m),
+          broadcast: (m) => broadcast(clients, m)
+        };
+        handleTodosRemove(ctx, ws, msg.payload);
         break;
       }
       case "tasks.get": {
-        const taskPath = context.meta["task.path"];
-        if (typeof taskPath === "string" && taskPath) {
-          try {
-            const { loadTasks } = await import("@wrongstack/core");
-            const file = await loadTasks(taskPath);
-            send(ws, {
-              type: "tasks.updated",
-              payload: { tasks: file?.tasks ?? [] }
-            });
-          } catch {
-            send(ws, { type: "tasks.updated", payload: { tasks: [] } });
-          }
-        } else {
-          send(ws, { type: "tasks.updated", payload: { tasks: [], error: "Task storage not configured." } });
-        }
+        const ctx = {
+          context: { todos: context.todos, meta: context.meta, session: context.session ? { id: context.session.id } : null, state: context.state },
+          send: (w, m) => send(w, m),
+          broadcast: (m) => broadcast(clients, m)
+        };
+        await handleTasksGet(ctx, ws);
         break;
       }
       case "plan.get": {
-        const planPath = context.meta["plan.path"];
-        if (typeof planPath === "string" && planPath) {
-          try {
-            const { loadPlan } = await import("@wrongstack/core");
-            const plan = await loadPlan(planPath);
-            send(ws, {
-              type: "plan.updated",
-              payload: {
-                plan: plan ?? {
-                  version: 1,
-                  sessionId: session.id,
-                  updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
-                  items: []
-                }
-              }
-            });
-          } catch {
-            send(ws, {
-              type: "plan.updated",
-              payload: {
-                plan: {
-                  version: 1,
-                  sessionId: session.id,
-                  updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
-                  items: []
-                }
-              }
-            });
-          }
-        } else {
-          send(ws, {
-            type: "plan.updated",
-            payload: { plan: null, error: "Plan storage is not configured for this session." }
-          });
-        }
+        const ctx = {
+          context: { todos: context.todos, meta: context.meta, session: context.session ? { id: context.session.id } : null, state: context.state },
+          send: (w, m) => send(w, m),
+          broadcast: (m) => broadcast(clients, m)
+        };
+        await handlePlanGet(ctx, ws);
         break;
       }
       case "plan.template_use": {
-        const { template } = msg.payload;
-        const planPath = context.meta["plan.path"];
-        if (typeof planPath !== "string" || !planPath) {
-          sendResult(ws, false, "Plan storage is not configured for this session.");
-          break;
-        }
-        try {
-          const { getPlanTemplate, loadPlan, savePlan, emptyPlan, addPlanItem } = await import("@wrongstack/core");
-          const tpl = getPlanTemplate(template);
-          if (!tpl) {
-            sendResult(ws, false, `Unknown template "${template}".`);
-            break;
-          }
-          let plan = await loadPlan(planPath) ?? emptyPlan(session.id);
-          for (const item of tpl.items) {
-            ({ plan } = addPlanItem(plan, item.title, item.details));
-          }
-          await savePlan(planPath, plan);
-          sendResult(ws, true, `Applied template "${tpl.name}" \u2014 ${tpl.items.length} items added.`);
-          broadcast(clients, {
-            type: "plan.updated",
-            payload: { plan }
-          });
-        } catch (err) {
-          sendResult(ws, false, errMessage(err));
-        }
+        const ctx = {
+          context: { todos: context.todos, meta: context.meta, session: context.session ? { id: context.session.id } : null, state: context.state },
+          send: (w, m) => send(w, m),
+          broadcast: (m) => broadcast(clients, m)
+        };
+        await handlePlanTemplateUse(ctx, ws, msg.payload.template);
         break;
       }
       case "todo.update": {
-        const payload = msg.payload;
-        const idx = context.todos.findIndex((t) => t.id === payload.id);
-        if (idx === -1) {
-          sendResult(ws, false, "Todo not found");
-          break;
-        }
-        const next = [...context.todos];
-        const existing = expectDefined2(next[idx]);
-        next[idx] = {
-          ...existing,
-          status: payload.status ?? existing.status,
-          activeForm: payload.activeForm !== void 0 ? payload.activeForm : existing.activeForm
+        const ctx = {
+          context: { todos: context.todos, meta: context.meta, session: context.session ? { id: context.session.id } : null, state: context.state },
+          send: (w, m) => send(w, m),
+          broadcast: (m) => broadcast(clients, m)
         };
-        context.state.replaceTodos(next);
-        sendResult(ws, true, `Todo "${existing.content}" updated`);
-        broadcast(clients, { type: "todos.updated", payload: { todos: next } });
+        handleTodoUpdate(ctx, ws, msg.payload);
         break;
       }
       case "task.update": {
-        const payload = msg.payload;
-        const taskPath = context.meta["task.path"];
-        if (typeof taskPath !== "string" || !taskPath) {
-          sendResult(ws, false, "Task storage not configured.");
-          break;
-        }
-        try {
-          const { mutateTasks } = await import("@wrongstack/core");
-          const file = await mutateTasks(taskPath, session.id, async (f) => {
-            const task = f.tasks.find((t) => t.id === payload.id);
-            if (!task) return f;
-            task.status = payload.status;
-            task.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
-            return f;
-          });
-          sendResult(ws, true, `Task status updated to "${payload.status}".`);
-          broadcast(clients, { type: "tasks.updated", payload: { tasks: file.tasks } });
-        } catch (err) {
-          sendResult(ws, false, errMessage(err));
-        }
+        const ctx = {
+          context: { todos: context.todos, meta: context.meta, session: context.session ? { id: context.session.id } : null, state: context.state },
+          send: (w, m) => send(w, m),
+          broadcast: (m) => broadcast(clients, m)
+        };
+        await handleTaskUpdate(ctx, ws, msg.payload);
         break;
       }
       case "plan.item.update": {
-        const payload = msg.payload;
-        const planPath = context.meta["plan.path"];
-        if (typeof planPath !== "string" || !planPath) {
-          sendResult(ws, false, "Plan storage is not configured for this session.");
-          break;
-        }
-        try {
-          const { mutatePlan, setPlanItemStatus } = await import("@wrongstack/core");
-          let changed = false;
-          const plan = await mutatePlan(planPath, session.id, async (p) => {
-            const before = p.updatedAt;
-            const updated = setPlanItemStatus(p, payload.target, payload.status);
-            changed = updated.updatedAt !== before;
-            return updated;
-          });
-          if (!changed) {
-            sendResult(ws, false, `No plan item matched "${payload.target}".`);
-            break;
-          }
-          sendResult(ws, true, `Plan item status updated to "${payload.status}".`);
-          broadcast(clients, { type: "plan.updated", payload: { plan } });
-        } catch (err) {
-          sendResult(ws, false, errMessage(err));
-        }
+        const ctx = {
+          context: { todos: context.todos, meta: context.meta, session: context.session ? { id: context.session.id } : null, state: context.state },
+          send: (w, m) => send(w, m),
+          broadcast: (m) => broadcast(clients, m)
+        };
+        await handlePlanItemUpdate(ctx, ws, msg.payload);
         break;
       }
       // ── File operations — delegated to shared handlers (file-handlers.ts) ──
@@ -4713,13 +5989,13 @@ async function startWebUI(opts = {}) {
             provider: config.provider,
             model: config.model
           });
-          sendResult(ws, true, `Switched to mode "${id}"`);
+          sendResult2(ws, true, `Switched to mode "${id}"`);
           broadcast(clients, {
             type: "session.start",
             payload: { ...await sessionStartPayload() }
           });
         } catch (err) {
-          sendResult(ws, false, errMessage(err));
+          sendResult2(ws, false, errMessage(err));
         }
         break;
       }
@@ -4773,13 +6049,13 @@ async function startWebUI(opts = {}) {
           const { getProcessRegistry } = await import("@wrongstack/tools");
           const proc = getProcessRegistry().get(pid);
           if (proc?.protected) {
-            sendResult(ws, false, `Cannot kill protected process (PID ${pid})`);
+            sendResult2(ws, false, `Cannot kill protected process (PID ${pid})`);
             break;
           }
           getProcessRegistry().kill(pid);
-          sendResult(ws, true, `Killed PID ${pid}`);
+          sendResult2(ws, true, `Killed PID ${pid}`);
         } catch (err) {
-          sendResult(ws, false, errMessage(err));
+          sendResult2(ws, false, errMessage(err));
         }
         break;
       }
@@ -4787,47 +6063,25 @@ async function startWebUI(opts = {}) {
         try {
           const { getProcessRegistry } = await import("@wrongstack/tools");
           getProcessRegistry().killAll();
-          sendResult(ws, true, "All processes killed");
+          sendResult2(ws, true, "All processes killed");
         } catch (err) {
-          sendResult(ws, false, errMessage(err));
+          sendResult2(ws, false, errMessage(err));
         }
         break;
       }
       case "git.info": {
-        const cwd = projectRoot;
-        const execFile = (cmd, args) => new Promise((resolve5) => {
-          import("child_process").then(({ execFile: ef }) => {
-            ef(cmd, args, { cwd, timeout: 3e3 }, (err, stdout) => {
-              resolve5(err ? "" : stdout.trim());
-            });
-          });
-        });
-        const [branchRaw, diffRaw, statusRaw, upstreamRaw] = await Promise.all([
-          execFile("git", ["branch", "--show-current"]),
-          execFile("git", ["diff", "--stat"]),
-          execFile("git", ["status", "--porcelain"]),
-          execFile("git", ["rev-list", "--left-right", "--count", "@{upstream}...HEAD"])
-        ]);
-        const branch = branchRaw || "(detached)";
-        const diffMatch = /\+\s*(\d+)\s*deletion/i.exec(diffRaw);
-        const addMatch = /(\d+)\s*insertion/i.exec(diffRaw) ?? /(\d+)\s*addition/i.exec(diffRaw);
-        const delMatch = /\+\s*(\d+)\s*deletion/i.exec(diffRaw);
-        const added = addMatch ? Number(addMatch[1]) : 0;
-        const deleted = delMatch ? Number(delMatch[1]) : 0;
-        const untracked = statusRaw.split("\n").filter((l) => l.startsWith("??")).length;
-        const [aheadRaw, behindRaw] = (upstreamRaw || "0	0").split("	");
-        const ahead = Number(aheadRaw) || 0;
-        const behind = Number(behindRaw) || 0;
-        send(ws, {
-          type: "git.info",
-          payload: { branch, added, deleted, untracked, ahead, behind }
-        });
+        await handleGitInfo(ws, projectRoot);
+        break;
+      }
+      case "webui.shutdown": {
+        console.log("[WebUI] Shutdown requested from client");
+        process.kill(process.pid, "SIGINT");
         break;
       }
       case "goal.get": {
         try {
-          const goalPath = path8.join(projectRoot, ".wrongstack", "goal.json");
-          const raw = await fs7.readFile(goalPath, "utf8");
+          const goalPath = resolveWstackPaths({ projectRoot }).projectGoal;
+          const raw = await fs10.readFile(goalPath, "utf8");
           const goal = JSON.parse(raw);
           broadcast(clients, { type: "goal.updated", payload: goal });
         } catch {
@@ -4838,7 +6092,7 @@ async function startWebUI(opts = {}) {
       case "autonomy.switch": {
         const { mode } = msg.payload;
         context.meta["autonomy"] = mode;
-        sendResult(ws, true, `Autonomy mode set to "${mode}"`);
+        sendResult2(ws, true, `Autonomy mode set to "${mode}"`);
         broadcast(clients, { type: "prefs.updated", payload: { autonomy: mode } });
         void persistPrefsToConfig({ autonomy: mode });
         break;
@@ -4887,7 +6141,7 @@ async function startWebUI(opts = {}) {
         try {
           const { DefaultSessionRewinder } = await import("@wrongstack/core");
           const rewinder = new DefaultSessionRewinder(
-            path8.join(projectRoot, ".wrongstack", "sessions"),
+            path10.join(projectRoot, ".wrongstack", "sessions"),
             projectRoot
           );
           const checkpoints = await rewinder.listCheckpoints(session.id);
@@ -4908,18 +6162,18 @@ async function startWebUI(opts = {}) {
         try {
           const { DefaultSessionRewinder } = await import("@wrongstack/core");
           const rewinder = new DefaultSessionRewinder(
-            path8.join(projectRoot, ".wrongstack", "sessions"),
+            path10.join(projectRoot, ".wrongstack", "sessions"),
             projectRoot
           );
           await rewinder.rewindToCheckpoint(session.id, checkpointIndex);
           await context.session.truncateToCheckpoint(checkpointIndex);
-          sendResult(ws, true, `Rewound to checkpoint ${checkpointIndex}`);
+          sendResult2(ws, true, `Rewound to checkpoint ${checkpointIndex}`);
           broadcast(clients, {
             type: "session.start",
             payload: { ...await sessionStartPayload(), reset: true }
           });
         } catch (err) {
-          sendResult(ws, false, errMessage(err));
+          sendResult2(ws, false, errMessage(err));
         }
         break;
       }
@@ -4942,9 +6196,9 @@ async function startWebUI(opts = {}) {
       case "projects.add": {
         const { root: addRoot, name: displayName } = msg.payload;
         try {
-          const resolved = path8.resolve(addRoot);
-          await fs7.access(resolved);
-          const stat2 = await fs7.stat(resolved);
+          const resolved = path10.resolve(addRoot);
+          await fs10.access(resolved);
+          const stat2 = await fs10.stat(resolved);
           if (!stat2.isDirectory()) throw new Error(`Not a directory: ${resolved}`);
           const manifest = await loadManifest(globalConfigPath);
           const existing = manifest.projects.find((p) => p.root === resolved);
@@ -4960,7 +6214,7 @@ async function startWebUI(opts = {}) {
             });
             break;
           }
-          const name = displayName?.trim() || path8.basename(resolved);
+          const name = displayName?.trim() || path10.basename(resolved);
           const slug = generateProjectSlug(resolved);
           await ensureProjectDataDir(slug, globalConfigPath);
           const now = (/* @__PURE__ */ new Date()).toISOString();
@@ -4979,7 +6233,7 @@ async function startWebUI(opts = {}) {
           send(ws, {
             type: "projects.added",
             payload: {
-              name: path8.basename(addRoot),
+              name: path10.basename(addRoot),
               root: addRoot,
               slug: "",
               message: errMessage(err)
@@ -4991,17 +6245,17 @@ async function startWebUI(opts = {}) {
       case "projects.select": {
         const { root: selRoot, name: selName } = msg.payload;
         try {
-          const resolved = path8.resolve(selRoot);
+          const resolved = path10.resolve(selRoot);
           try {
-            await fs7.access(resolved);
-            const stat2 = await fs7.stat(resolved);
+            await fs10.access(resolved);
+            const stat2 = await fs10.stat(resolved);
             if (!stat2.isDirectory()) throw new Error(`Not a directory: ${resolved}`);
           } catch (err) {
             send(ws, {
               type: "projects.selected",
               payload: {
                 root: selRoot,
-                name: selName || path8.basename(selRoot),
+                name: selName || path10.basename(selRoot),
                 message: `Cannot switch: ${errMessage(err)}`
               }
             });
@@ -5013,7 +6267,7 @@ async function startWebUI(opts = {}) {
             entry.lastSeen = (/* @__PURE__ */ new Date()).toISOString();
             entry.lastWorkingDir = resolved;
           } else {
-            const name = selName?.trim() || path8.basename(resolved);
+            const name = selName?.trim() || path10.basename(resolved);
             const slug = generateProjectSlug(resolved);
             manifest.projects.push({
               name,
@@ -5054,13 +6308,13 @@ async function startWebUI(opts = {}) {
             });
           } catch {
           }
-          const newSessionsDir = path8.join(
-            path8.dirname(globalConfigPath),
+          const newSessionsDir = path10.join(
+            path10.dirname(globalConfigPath),
             "projects",
             switchSlug,
             "sessions"
           );
-          await fs7.mkdir(newSessionsDir, { recursive: true });
+          await fs10.mkdir(newSessionsDir, { recursive: true });
           const newSessionStore = new DefaultSessionStore2({ dir: newSessionsDir });
           const oldSessionId = session.id;
           try {
@@ -5092,8 +6346,9 @@ async function startWebUI(opts = {}) {
               sessionId: session.id,
               projectSlug: switchSlug,
               projectRoot,
-              projectName: path8.basename(projectRoot),
+              projectName: path10.basename(projectRoot),
               workingDir,
+              clientType: "webui",
               pid: process.pid,
               startedAt: (/* @__PURE__ */ new Date()).toISOString()
             });
@@ -5103,8 +6358,8 @@ async function startWebUI(opts = {}) {
             type: "projects.selected",
             payload: {
               root: resolved,
-              name: selName || path8.basename(resolved),
-              message: `Switched to ${selName || path8.basename(resolved)}`
+              name: selName || path10.basename(resolved),
+              message: `Switched to ${selName || path10.basename(resolved)}`
             }
           });
           broadcast(clients, {
@@ -5127,7 +6382,7 @@ async function startWebUI(opts = {}) {
             type: "projects.selected",
             payload: {
               root: selRoot,
-              name: selName || path8.basename(selRoot),
+              name: selName || path10.basename(selRoot),
               message: errMessage(err)
             }
           });
@@ -5138,17 +6393,17 @@ async function startWebUI(opts = {}) {
       case "working_dir.set": {
         const { path: newPath } = msg.payload;
         try {
-          const resolved = path8.resolve(projectRoot, newPath);
-          if (!resolved.startsWith(projectRoot + path8.sep) && resolved !== projectRoot) {
-            sendResult(ws, false, `Path must stay inside the project root: ${projectRoot}`);
+          const resolved = path10.resolve(projectRoot, newPath);
+          if (!resolved.startsWith(projectRoot + path10.sep) && resolved !== projectRoot) {
+            sendResult2(ws, false, `Path must stay inside the project root: ${projectRoot}`);
             break;
           }
           try {
-            await fs7.access(resolved);
-            const stat2 = await fs7.stat(resolved);
+            await fs10.access(resolved);
+            const stat2 = await fs10.stat(resolved);
             if (!stat2.isDirectory()) throw new Error("Not a directory");
           } catch {
-            sendResult(ws, false, `Directory not found or not accessible: ${resolved}`);
+            sendResult2(ws, false, `Directory not found or not accessible: ${resolved}`);
             break;
           }
           workingDir = resolved;
@@ -5157,9 +6412,9 @@ async function startWebUI(opts = {}) {
             type: "working_dir.changed",
             payload: { cwd: resolved, projectRoot }
           });
-          sendResult(ws, true, `Working directory set to ${resolved}`);
+          sendResult2(ws, true, `Working directory set to ${resolved}`);
         } catch (err) {
-          sendResult(ws, false, errMessage(err));
+          sendResult2(ws, false, errMessage(err));
         }
         break;
       }
@@ -5169,31 +6424,31 @@ async function startWebUI(opts = {}) {
           msg.payload,
           logger
         );
-        sendResult(ws, result.success, result.message);
+        sendResult2(ws, result.success, result.message);
         break;
       }
       // ── Mailbox operations — project-level inter-agent messaging ────
       case "mailbox.messages":
         return handleMailboxMessages(
           ws,
-          { projectRoot, globalRoot: path8.dirname(globalConfigPath) },
+          { projectRoot, globalRoot: path10.dirname(globalConfigPath) },
           msg.payload
         );
       case "mailbox.agents":
         return handleMailboxAgents(
           ws,
-          { projectRoot, globalRoot: path8.dirname(globalConfigPath) },
+          { projectRoot, globalRoot: path10.dirname(globalConfigPath) },
           msg.payload
         );
       case "mailbox.clear":
         return handleMailboxClear(
           ws,
-          { projectRoot, globalRoot: path8.dirname(globalConfigPath) }
+          { projectRoot, globalRoot: path10.dirname(globalConfigPath) }
         );
       case "mailbox.purge":
         return handleMailboxPurge(
           ws,
-          { projectRoot, globalRoot: path8.dirname(globalConfigPath) },
+          { projectRoot, globalRoot: path10.dirname(globalConfigPath) },
           msg.payload
         );
       // ── Brain — status, autonomy ceiling, direct decision support ───
@@ -5207,7 +6462,7 @@ async function startWebUI(opts = {}) {
         const level = msg.payload?.level ?? "";
         const valid = ["off", "low", "medium", "high", "all"];
         if (!valid.includes(level)) {
-          sendResult(ws, false, `Unknown risk level "${level}". Use: ${valid.join(", ")}.`);
+          sendResult2(ws, false, `Unknown risk level "${level}". Use: ${valid.join(", ")}.`);
           break;
         }
         brainSettings.maxAutoRisk = level;
@@ -5220,7 +6475,7 @@ async function startWebUI(opts = {}) {
       case "brain.ask": {
         const question = msg.payload?.question?.trim();
         if (!question) {
-          sendResult(ws, false, "Usage: /brain ask <question>");
+          sendResult2(ws, false, "Usage: /brain ask <question>");
           break;
         }
         try {
@@ -5233,7 +6488,7 @@ async function startWebUI(opts = {}) {
           });
           send(ws, { type: "brain.answer", payload: { question, decision } });
         } catch (err) {
-          sendResult(ws, false, `Brain consultation failed: ${errMessage(err)}`);
+          sendResult2(ws, false, `Brain consultation failed: ${errMessage(err)}`);
         }
         break;
       }
@@ -5260,14 +6515,28 @@ async function startWebUI(opts = {}) {
     broadcast,
     clients
   });
+  const watcherMetrics = {
+    fileChangesDetected: 0,
+    filesProcessed: 0,
+    broadcastsSent: 0,
+    debounceResets: 0,
+    totalDebounceDelayMs: 0,
+    activeProjects: 0,
+    averageDebounceDelayMs: 0,
+    watcherActive: false
+  };
   const httpServer = createHttpServer({
     host: wsHost,
-    distDir: path8.resolve(import.meta.dirname, "../../dist"),
+    distDir: path10.resolve(import.meta.dirname, "../../dist"),
     wsPort,
     globalRoot: wpaths.globalRoot,
-    apiToken: wsToken
+    apiToken: wsToken,
+    watcherMetrics,
+    onFleetPing: () => {
+      void fleetBroadcast?.();
+    }
   });
-  const registryBaseDir = path8.dirname(globalConfigPath);
+  const registryBaseDir = path10.dirname(globalConfigPath);
   httpServer.listen(httpPort, wsHost, () => {
     const openUrl = `http://${wsHost}:${httpPort}`;
     console.log(`[WebUI] HTTP server running on ${openUrl}`);
@@ -5279,7 +6548,7 @@ async function startWebUI(opts = {}) {
         wsPort,
         host: wsHost,
         projectRoot,
-        projectName: path8.basename(projectRoot) || projectRoot,
+        projectName: path10.basename(projectRoot) || projectRoot,
         startedAt: (/* @__PURE__ */ new Date()).toISOString(),
         url: `http://${wsHost}:${httpPort}`
       },
@@ -5306,6 +6575,10 @@ async function startWebUI(opts = {}) {
     // reality. Crash exits are healed by the next register()/list() prune pass.
     onShutdown: () => {
       brainMonitor.stop();
+      if (disposeEvents) {
+        disposeEvents();
+        disposeEvents = null;
+      }
       if (eternalSubscription) {
         eternalSubscription.dispose();
         eternalSubscription = null;