@wrongstack/webui 0.273.0 → 0.273.1

package/dist/server/entry.js

@@ -897,7 +897,7 @@ async function handleApiSessionEvents(res, globalRoot, sessionId, limit) {
     return;
   }
   try {
-    const { SessionRegistry, resolveWstackPaths: resolveWstackPaths2, DefaultSessionStore: DefaultSessionStore4, DefaultSessionReader: DefaultSessionReader2 } = await import("@wrongstack/core");
+    const { SessionRegistry, resolveWstackPaths: resolveWstackPaths2, DefaultSessionStore: DefaultSessionStore3, DefaultSessionReader: DefaultSessionReader2 } = await import("@wrongstack/core");
     const registry = new SessionRegistry(globalRoot);
     const entry = await registry.get(sessionId);
     if (!entry) {
@@ -906,7 +906,7 @@ async function handleApiSessionEvents(res, globalRoot, sessionId, limit) {
       return;
     }
     const paths = resolveWstackPaths2({ projectRoot: entry.projectRoot, globalRoot });
-    const store = new DefaultSessionStore4({ dir: paths.projectSessions });
+    const store = new DefaultSessionStore3({ dir: paths.projectSessions });
     const reader = new DefaultSessionReader2({ store });
     const rawEntries = [];
     for await (const ev of reader.replay(sessionId)) {
@@ -1592,8 +1592,8 @@ function isInside(root, target) {
 }
 
 // src/server/file-handlers.ts
-import * as fs3 from "fs/promises";
-import * as path3 from "path";
+import * as fs4 from "fs/promises";
+import * as path4 from "path";
 import { atomicWrite } from "@wrongstack/core";
 
 // src/server/file-picker.ts
@@ -1644,6 +1644,34 @@ function rankFiles(paths, query, limit) {
   return scored.slice(0, limit).map((s) => s.path);
 }
 
+// src/server/path-containment.ts
+import * as fs3 from "fs/promises";
+import * as path3 from "path";
+function isPathInside(root, target) {
+  const relative3 = path3.relative(root, target);
+  return relative3 === "" || !relative3.startsWith("..") && !path3.isAbsolute(relative3);
+}
+async function resolveWorkingDirInsideProject(projectRoot, inputPath) {
+  const resolved = path3.resolve(projectRoot, inputPath);
+  let stat3;
+  try {
+    stat3 = await fs3.stat(resolved);
+  } catch {
+    throw new Error(`Directory not found or not accessible: ${resolved}`);
+  }
+  if (!stat3.isDirectory()) {
+    throw new Error(`Directory not found or not accessible: ${resolved}`);
+  }
+  const [realProjectRoot, realResolved] = await Promise.all([
+    fs3.realpath(projectRoot),
+    fs3.realpath(resolved)
+  ]);
+  if (!isPathInside(realProjectRoot, realResolved)) {
+    throw new Error(`Path must stay inside the project root: ${projectRoot}`);
+  }
+  return resolved;
+}
+
 // src/server/ws-utils.ts
 import { randomBytes } from "crypto";
 import { WebSocket } from "ws";
@@ -1674,23 +1702,73 @@ function generateAuthToken() {
 }
 
 // src/server/file-handlers.ts
+async function resolveFileInsideProject(projectRoot, filePath) {
+  const resolved = path4.resolve(projectRoot, filePath);
+  if (!isPathInside(projectRoot, resolved)) {
+    throw new Error("Path outside project root");
+  }
+  const { parent, base } = splitParentAndBase(resolved);
+  const realProjectRoot = await fs4.realpath(projectRoot);
+  const realParent = await realpathAllowMissing(parent);
+  const realFull = path4.join(realParent, base);
+  if (!isPathInside(realProjectRoot, realFull)) {
+    throw new Error("Path outside project root");
+  }
+  return realFull;
+}
+function splitParentAndBase(p) {
+  const base = path4.basename(p);
+  const parent = path4.dirname(p);
+  return { parent, base };
+}
+async function realpathAllowMissing(p) {
+  try {
+    return await fs4.realpath(p);
+  } catch (err) {
+    if (err.code !== "ENOENT") throw err;
+  }
+  const segments = [];
+  let cursor = p;
+  while (true) {
+    const parent = path4.dirname(cursor);
+    if (parent === cursor) {
+      throw new Error("Path outside project root");
+    }
+    segments.unshift(path4.basename(cursor));
+    try {
+      const realParent = await fs4.realpath(parent);
+      return path4.join(realParent, ...segments);
+    } catch (err) {
+      if (err.code !== "ENOENT") throw err;
+      cursor = parent;
+    }
+  }
+}
 async function handleFilesTree(ws, msg, projectRoot) {
   const payload = msg.payload;
   const rawPath = payload?.path?.trim();
-  const treeRoot = rawPath && rawPath !== "." ? path3.resolve(projectRoot, rawPath) : projectRoot;
-  if (!treeRoot.startsWith(projectRoot + path3.sep) && treeRoot !== projectRoot) {
+  let treeRoot;
+  let realProjectRoot;
+  try {
+    if (rawPath && rawPath !== ".") {
+      treeRoot = await resolveWorkingDirInsideProject(projectRoot, rawPath);
+    } else {
+      treeRoot = projectRoot;
+    }
+    realProjectRoot = await fs4.realpath(projectRoot);
+  } catch {
     send(ws, {
       type: "files.tree",
       payload: { root: projectRoot, tree: [], error: "Path outside project root" }
     });
     return;
   }
-  const pathPrefix = treeRoot === projectRoot ? "" : (path3.relative(projectRoot, treeRoot) + "/").replace(/\\/g, "/");
+  const pathPrefix = treeRoot === projectRoot ? "" : (path4.relative(projectRoot, treeRoot) + "/").replace(/\\/g, "/");
   async function buildTree(dir, rel, depth) {
     if (depth > 10) return [];
     let entries = [];
     try {
-      entries = await fs3.readdir(dir, { withFileTypes: true });
+      entries = await fs4.readdir(dir, { withFileTypes: true });
     } catch {
       return [];
     }
@@ -1702,11 +1780,20 @@ async function handleFilesTree(ws, msg, projectRoot) {
     for (const e of entries) {
       if (isHiddenEntry(e.name)) continue;
       const childRel = rel ? `${rel}/${e.name}` : e.name;
-      const childAbs = path3.join(dir, e.name);
+      const childAbs = path4.join(dir, e.name);
       const childPath = pathPrefix + childRel;
       if (e.isDirectory()) {
         if (SKIP_DIRS.has(e.name)) continue;
-        const children = await buildTree(childAbs, childRel, depth + 1);
+        let realChild;
+        try {
+          realChild = await fs4.realpath(childAbs);
+        } catch {
+          continue;
+        }
+        if (!isPathInside(realProjectRoot, realChild)) {
+          continue;
+        }
+        const children = await buildTree(realChild, childRel, depth + 1);
         nodes.push({ name: e.name, path: childPath, type: "directory", children });
       } else if (e.isFile()) {
         nodes.push({ name: e.name, path: childPath, type: "file" });
@@ -1716,10 +1803,10 @@ async function handleFilesTree(ws, msg, projectRoot) {
   }
   try {
     const tree = await buildTree(treeRoot, "", 0);
-    const rootLabel = treeRoot === projectRoot ? projectRoot : path3.relative(projectRoot, treeRoot) || ".";
+    const rootLabel = treeRoot === projectRoot ? projectRoot : path4.relative(projectRoot, treeRoot) || ".";
     send(ws, { type: "files.tree", payload: { root: rootLabel, tree } });
   } catch (err) {
-    const rootLabel = treeRoot === projectRoot ? projectRoot : path3.relative(projectRoot, treeRoot) || ".";
+    const rootLabel = treeRoot === projectRoot ? projectRoot : path4.relative(projectRoot, treeRoot) || ".";
     send(ws, {
       type: "files.tree",
       payload: { root: rootLabel, tree: [], error: errMessage(err) }
@@ -1728,13 +1815,15 @@ async function handleFilesTree(ws, msg, projectRoot) {
 }
 async function handleFilesRead(ws, msg, projectRoot) {
   const { filePath } = msg.payload;
-  const resolved = path3.resolve(projectRoot, filePath);
-  if (!resolved.startsWith(projectRoot + path3.sep) && resolved !== projectRoot) {
+  let realResolved;
+  try {
+    realResolved = await resolveFileInsideProject(projectRoot, filePath);
+  } catch {
     send(ws, { type: "files.read", payload: { filePath, content: "", error: "Forbidden" } });
     return;
   }
   try {
-    const content = await fs3.readFile(resolved, "utf8");
+    const content = await fs4.readFile(realResolved, "utf8");
     send(ws, { type: "files.read", payload: { filePath, content } });
   } catch (err) {
     send(ws, {
@@ -1745,16 +1834,18 @@ async function handleFilesRead(ws, msg, projectRoot) {
 }
 async function handleFilesWrite(ws, msg, projectRoot, opts = {}) {
   const { filePath, content } = msg.payload;
-  const resolved = path3.resolve(projectRoot, filePath);
-  if (!resolved.startsWith(projectRoot + path3.sep) && resolved !== projectRoot) {
+  let realResolved;
+  try {
+    realResolved = await resolveFileInsideProject(projectRoot, filePath);
+  } catch {
     send(ws, { type: "files.written", payload: { filePath, success: false, error: "Forbidden" } });
     return;
   }
   try {
-    await atomicWrite(resolved, content);
+    await atomicWrite(realResolved, content);
     send(ws, { type: "files.written", payload: { filePath, success: true } });
     if (opts.onWritten) {
-      void Promise.resolve(opts.onWritten(resolved)).catch(() => void 0);
+      void Promise.resolve(opts.onWritten(realResolved)).catch(() => void 0);
     }
   } catch (err) {
     send(ws, {
@@ -1766,8 +1857,16 @@ async function handleFilesWrite(ws, msg, projectRoot, opts = {}) {
 async function handleFilesList(ws, msg, projectRoot) {
   const payload = msg.payload ?? {};
   const limit = payload.limit ?? 50;
-  const listRoot = payload.path ? path3.resolve(projectRoot, payload.path) : projectRoot;
-  if (!listRoot.startsWith(projectRoot + path3.sep) && listRoot !== projectRoot) {
+  let listRoot;
+  let realProjectRoot;
+  try {
+    if (payload.path) {
+      listRoot = await resolveWorkingDirInsideProject(projectRoot, payload.path);
+    } else {
+      listRoot = projectRoot;
+    }
+    realProjectRoot = await fs4.realpath(projectRoot);
+  } catch {
     send(ws, { type: "files.list", payload: { files: [] } });
     return;
   }
@@ -1776,7 +1875,7 @@ async function handleFilesList(ws, msg, projectRoot) {
     if (depth > 8 || results.length >= 600) return;
     let entries = [];
     try {
-      entries = await fs3.readdir(dir, { withFileTypes: true });
+      entries = await fs4.readdir(dir, { withFileTypes: true });
     } catch {
       return;
     }
@@ -1786,7 +1885,16 @@ async function handleFilesList(ws, msg, projectRoot) {
       const childRel = rel ? `${rel}/${e.name}` : e.name;
       if (e.isDirectory()) {
         if (SKIP_DIRS.has(e.name)) continue;
-        await walk(path3.join(dir, e.name), childRel, depth + 1);
+        let realChild;
+        try {
+          realChild = await fs4.realpath(path4.join(dir, e.name));
+        } catch {
+          continue;
+        }
+        if (!isPathInside(realProjectRoot, realChild)) {
+          continue;
+        }
+        await walk(realChild, childRel, depth + 1);
       } else if (e.isFile()) {
         results.push(childRel);
       }
@@ -1800,7 +1908,7 @@ async function handleFilesList(ws, msg, projectRoot) {
 }
 
 // src/server/completion-handlers.ts
-import * as path4 from "path";
+import * as path5 from "path";
 import { searchCodebaseIndex } from "@wrongstack/tools/codebase-index/index";
 var MAX_PREFIX_CHARS = 12e3;
 var MAX_SUFFIX_CHARS = 4e3;
@@ -1875,8 +1983,8 @@ async function handleCompletionRequest(ws, msg, opts) {
     return;
   }
   const payload = parsed.payload;
-  const projectRoot = path4.resolve(opts.projectRoot);
-  const resolved = path4.resolve(projectRoot, payload.filePath);
+  const projectRoot = path5.resolve(opts.projectRoot);
+  const resolved = path5.resolve(projectRoot, payload.filePath);
   if (!isInside2(projectRoot, resolved)) {
     send(ws, {
       type: "completion.result",
@@ -2275,7 +2383,7 @@ function buildSearchQuery(linePrefix, filePath) {
   if (memberMatch?.[1]) return memberMatch[1];
   const token = linePrefix.match(/([A-Za-z_$][\w$]*)$/)?.[1];
   if (token && token.length >= 2) return token;
-  return path4.basename(filePath, path4.extname(filePath));
+  return path5.basename(filePath, path5.extname(filePath));
 }
 function currentLinePrefix(prefix) {
   const idx = Math.max(prefix.lastIndexOf("\n"), prefix.lastIndexOf("\r"));
@@ -2305,7 +2413,7 @@ function head(value, max) {
   return value.length <= max ? value : value.slice(0, max);
 }
 function isInside2(root, target) {
-  return target === root || target.startsWith(root + path4.sep);
+  return target === root || target.startsWith(root + path5.sep);
 }
 
 // src/server/memory-handlers.ts
@@ -2559,8 +2667,8 @@ async function handleMcpDiscover(ws, msg, globalConfigPath, mcpRegistry) {
 }
 
 // src/server/skills-handlers.ts
-import { promises as fs4 } from "fs";
-import path5 from "path";
+import { promises as fs5 } from "fs";
+import path6 from "path";
 import JSZip from "jszip";
 import { atomicWrite as atomicWrite2 } from "@wrongstack/core";
 import { wstackGlobalRoot } from "@wrongstack/core/utils";
@@ -2631,19 +2739,19 @@ async function handleSkillsContent(ws, ctx, msg) {
       send(ws, { type: "skills.content", payload: { name: name2, body: "", path: "", source, relatedFiles: [], references: [], error: `Skill "${name2}" not found` } });
       return;
     }
-    const body = await fs4.readFile(entry.path, "utf8");
-    const skillDir = path5.dirname(entry.path);
+    const body = await fs5.readFile(entry.path, "utf8");
+    const skillDir = path6.dirname(entry.path);
     let relatedFiles = [];
     try {
-      const files = await fs4.readdir(skillDir);
-      relatedFiles = files.filter((f) => f !== path5.basename(entry.path)).map((f) => path5.join(skillDir, f));
+      const files = await fs5.readdir(skillDir);
+      relatedFiles = files.filter((f) => f !== path6.basename(entry.path)).map((f) => path6.join(skillDir, f));
     } catch {
     }
     const nameLower = name2.toLowerCase();
     const refResults = await Promise.all(
       entries.filter((e) => e.name.toLowerCase() !== nameLower).map(async (e) => {
         try {
-          const content = await fs4.readFile(e.path, "utf8");
+          const content = await fs5.readFile(e.path, "utf8");
           return [e.name, content.toLowerCase().includes(nameLower)];
         } catch {
           return [e.name, false];
@@ -2733,14 +2841,14 @@ async function handleSkillsCreate(ws, ctx, msg) {
   }
   const createPayload = parsed.value;
   try {
-    const targetDir = createPayload.scope === "global" ? path5.join(wstackGlobalRoot(), "skills", createPayload.name.trim()) : path5.join(ctx.projectRoot, ".wrongstack", "skills", createPayload.name.trim());
+    const targetDir = createPayload.scope === "global" ? path6.join(wstackGlobalRoot(), "skills", createPayload.name.trim()) : path6.join(ctx.projectRoot, ".wrongstack", "skills", createPayload.name.trim());
     try {
-      await fs4.access(targetDir);
+      await fs5.access(targetDir);
       send(ws, { type: "skills.created", payload: { success: false, error: `Skill "${createPayload.name}" already exists` } });
       return;
     } catch {
     }
-    await fs4.mkdir(targetDir, { recursive: true });
+    await fs5.mkdir(targetDir, { recursive: true });
     const lines = createPayload.description.trim().split("\n");
     const firstLine = lines[0].trim();
     const bodyLines = lines.slice(1).map((l) => l.trim()).filter(Boolean);
@@ -2788,13 +2896,13 @@ ${trigger}
       "- `bug-hunter` \u2014 for systematic bug detection patterns",
       "- `output-standards` \u2014 for standardized `<next_steps>` formatting"
     ].join("\n");
-    await atomicWrite2(path5.join(targetDir, "SKILL.md"), skillContent);
+    await atomicWrite2(path6.join(targetDir, "SKILL.md"), skillContent);
     send(ws, {
       type: "skills.created",
       payload: {
         success: true,
         error: null,
-        skill: { name: createPayload.name.trim(), path: path5.join(targetDir, "SKILL.md"), scope: createPayload.scope }
+        skill: { name: createPayload.name.trim(), path: path6.join(targetDir, "SKILL.md"), scope: createPayload.scope }
       }
     });
   } catch (err) {
@@ -2858,23 +2966,23 @@ import {
   Agent,
   AutoCompactionMiddleware,
   Context,
-  DefaultMemoryStore as DefaultMemoryStore2,
-  DefaultModeStore as DefaultModeStore2,
+  DefaultMemoryStore,
+  DefaultModeStore,
   DefaultModelsRegistry,
   DefaultSessionReader,
-  DefaultSessionStore as DefaultSessionStore3,
-  DefaultSkillLoader as DefaultSkillLoader2,
-  DefaultSystemPromptBuilder as DefaultSystemPromptBuilder4,
-  DefaultTokenCounter as DefaultTokenCounter2,
+  DefaultSessionStore as DefaultSessionStore2,
+  DefaultSkillLoader,
+  DefaultSystemPromptBuilder as DefaultSystemPromptBuilder3,
+  DefaultTokenCounter,
   AnnotationsStore,
   CollaborationBus,
   collabPauseMiddleware,
   collabInjectMiddleware,
   estimateRequestTokensCalibrated,
   EventBus,
-  createStrategyCompactor as createStrategyCompactor2,
+  createStrategyCompactor,
   ProviderRegistry,
-  TOKENS as TOKENS2,
+  TOKENS,
   ToolRegistry,
   atomicWrite as atomicWrite6,
   createDefaultPipelines,
@@ -2893,110 +3001,10 @@ import {
 import { ToolExecutor } from "@wrongstack/core/execution";
 import { decryptConfigSecrets as decryptConfigSecrets2, encryptConfigSecrets as encryptConfigSecrets2 } from "@wrongstack/core/security";
 import { buildProviderFactoriesFromRegistry, makeProviderFromConfig } from "@wrongstack/providers";
-import { builtinToolsPack, forgetTool, rememberTool, searchMemoryTool, relatedMemoryTool } from "@wrongstack/tools";
+import { builtinToolsPack, configureExecPolicy, ensureSessionShell, forgetTool, rememberTool, searchMemoryTool, relatedMemoryTool } from "@wrongstack/tools";
 import { MCPRegistry } from "@wrongstack/mcp";
 import { WebSocket as WebSocket2, WebSocketServer } from "ws";
-
-// ../runtime/src/container.ts
-import {
-  Container,
-  DefaultConfigStore,
-  DefaultErrorHandler,
-  DefaultMemoryStore,
-  DefaultModeStore,
-  DefaultPermissionPolicy,
-  DefaultRetryPolicy,
-  DefaultSecretScrubber,
-  DefaultSessionStore,
-  DefaultSkillLoader,
-  DefaultSystemPromptBuilder,
-  DefaultTokenCounter,
-  createStrategyCompactor,
-  buildRecoveryStrategies,
-  TOKENS
-} from "@wrongstack/core";
-function createDefaultContainer(opts) {
-  const { config, wpaths, logger, modelsRegistry } = opts;
-  const container = new Container();
-  const configStore = new DefaultConfigStore(config);
-  container.bind(TOKENS.ConfigStore, () => configStore);
-  container.bind(TOKENS.Logger, () => logger);
-  container.bind(TOKENS.SecretScrubber, () => new DefaultSecretScrubber());
-  container.bind(TOKENS.RetryPolicy, () => new DefaultRetryPolicy());
-  container.bind(
-    TOKENS.ErrorHandler,
-    () => new DefaultErrorHandler(
-      buildRecoveryStrategies({
-        compactor: container.resolve(TOKENS.Compactor),
-        modelsRegistry,
-        getConfig: () => configStore.get()
-      })
-    )
-  );
-  container.bind(TOKENS.ModelsRegistry, () => modelsRegistry);
-  container.bind(
-    TOKENS.TokenCounter,
-    () => new DefaultTokenCounter({ registry: modelsRegistry, providerId: config.provider })
-  );
-  const modeStore = new DefaultModeStore({ directory: wpaths.configDir });
-  container.bind(TOKENS.ModeStore, () => modeStore);
-  container.bind(
-    TOKENS.SessionStore,
-    () => new DefaultSessionStore({
-      dir: wpaths.projectSessions,
-      // Scrub secrets out of persisted user/model turns (F-06). Tool output
-      // is already scrubbed by the executor.
-      secretScrubber: container.resolve(TOKENS.SecretScrubber)
-    })
-  );
-  const memoryStore = new DefaultMemoryStore({ paths: wpaths, events: opts.events });
-  container.bind(TOKENS.MemoryStore, () => memoryStore);
-  const skillLoader = new DefaultSkillLoader({ paths: wpaths, bundledDir: opts.bundledSkillsDir });
-  container.bind(TOKENS.SkillLoader, () => skillLoader);
-  if (opts.systemPrompt) {
-    container.bind(
-      TOKENS.SystemPromptBuilder,
-      () => new DefaultSystemPromptBuilder(opts.systemPrompt)
-    );
-  }
-  container.bind(
-    TOKENS.PermissionPolicy,
-    () => {
-      const policyOptions = {
-        trustFile: wpaths.projectTrust,
-        yolo: opts.permission?.yolo ?? false,
-        yoloDestructive: opts.permission?.yoloDestructive ?? opts.permission?.forceAllYolo ?? false,
-        confirmDestructive: opts.permission?.confirmDestructive ?? false
-      };
-      if (opts.permission?.promptDelegate !== void 0) {
-        policyOptions.promptDelegate = opts.permission.promptDelegate;
-      }
-      return new DefaultPermissionPolicy(policyOptions);
-    }
-  );
-  container.bind(
-    TOKENS.Compactor,
-    () => (
-      // Strategy comes from config.context.strategy: 'hybrid' (default, lossless
-      // rules, no LLM), 'intelligent' (LLM summarization), or 'selective'
-      // (LLM-driven selection). The LLM strategies resolve their provider from
-      // ctx at compact()-time, so binding here (before context.provider exists)
-      // is safe. preserveK / eliseThreshold are class-level fallbacks; the active
-      // ContextWindowPolicy in ctx.meta normally overrides both at runtime.
-      // eliseThreshold is a TOKEN COUNT — a previous value of 0.7 elided
-      // essentially every tool_result (anything > 1 token).
-      createStrategyCompactor({
-        strategy: config.context?.strategy,
-        preserveK: opts.compactor?.preserveK ?? 10,
-        eliseThreshold: opts.compactor?.eliseThreshold ?? 2e3,
-        smart: true,
-        summarizerModel: config.context?.summarizerModel,
-        llmSelector: config.context?.llmSelector
-      })
-    )
-  );
-  return container;
-}
+import { createDefaultContainer, makeLightSubagentFactory } from "@wrongstack/runtime";
 
 // src/server/boot.ts
 import {
@@ -3357,6 +3365,13 @@ Type: ${task.type}`;
     });
     const taskItems = activePhase ? Array.from(activePhase.taskGraph.nodes.values()).map(mapTask) : [];
     const completedPhases = phases.filter((p) => p.status === "completed").length;
+    const failedPhases = phases.filter((p) => p.status === "failed").length;
+    const failedTasks = phases.reduce(
+      (sum, p) => sum + Array.from(p.taskGraph.nodes.values()).filter((t) => t.status === "failed").length,
+      0
+    );
+    const lastFailed = phases.filter((p) => p.status === "failed").sort((a, b) => (b.updatedAt ?? 0) - (a.updatedAt ?? 0))[0];
+    const lastError = lastFailed ? `${lastFailed.name}: ${lastFailed.metadata?.integrationError ?? "phase failed"}` : null;
     return {
       title: this.graph.title,
       phases: phaseItems,
@@ -3365,7 +3380,18 @@ Type: ${task.type}`;
       overallPercent: phases.length > 0 ? Math.round(completedPhases / phases.length * 100) : 0,
       autonomous: this.graph.autonomous,
       totalTasks,
-      completedTasks
+      completedTasks,
+      // Structured progress + lastError consumed by the autophase store (were
+      // defined client-side but never sent, so they stayed null on the board).
+      progress: {
+        totalPhases: phases.length,
+        completed: completedPhases,
+        failed: failedPhases,
+        totalTasks,
+        completedTasks,
+        failedTasks
+      },
+      lastError
     };
   }
   sendState(client) {
@@ -3787,7 +3813,7 @@ var SddWizardWebSocketHandler = class {
 };
 
 // src/server/sdd-wizard-wiring.ts
-import * as path6 from "path";
+import * as path7 from "path";
 import { spawnSync as spawnSync2 } from "child_process";
 import {
   makeCommandVerifier,
@@ -3823,7 +3849,7 @@ function buildSddWizardDeps(opts) {
     makeDriver: () => new SddInterviewDriver({
       specStore: new SpecStore2({ baseDir: opts.paths.projectSpecs }),
       graphStore: new TaskGraphStore2({ baseDir: opts.paths.projectTaskGraphs }),
-      sessionPath: path6.join(opts.paths.projectDir, "sdd-wizard-session.json")
+      sessionPath: path7.join(opts.paths.projectDir, "sdd-wizard-session.json")
     }),
     runInterviewTurn: (prompt) => runIsolatedTurn(prompt, "Spec Architect"),
     startRun: async (driver, { parallelSlots, defaultModel, defaultProvider, fallbackModels }) => {
@@ -3892,9 +3918,6 @@ async function handleSddWizardRoute(_ws, msg, handlers) {
   return true;
 }
 
-// src/server/index.ts
-import { makeLightSubagentFactory } from "@wrongstack/runtime";
-
 // src/server/collaboration-ws-handler.ts
 import { randomUUID } from "crypto";
 import { toErrorMessage as toErrorMessage2 } from "@wrongstack/core/utils";
@@ -4621,16 +4644,16 @@ var CollaborationWebSocketHandler = class {
 };
 
 // src/server/projects-manifest.ts
-import * as fs5 from "fs/promises";
-import * as path7 from "path";
+import * as fs6 from "fs/promises";
+import * as path8 from "path";
 import { projectSlug } from "@wrongstack/core";
 function projectsJsonPath(globalConfigPath) {
-  const base = path7.dirname(globalConfigPath);
-  return path7.join(base, "projects.json");
+  const base = path8.dirname(globalConfigPath);
+  return path8.join(base, "projects.json");
 }
 async function loadManifest(globalConfigPath) {
   try {
-    const raw = await fs5.readFile(projectsJsonPath(globalConfigPath), "utf8");
+    const raw = await fs6.readFile(projectsJsonPath(globalConfigPath), "utf8");
     const parsed = JSON.parse(raw);
     return { projects: parsed.projects ?? [] };
   } catch {
@@ -4639,16 +4662,16 @@ async function loadManifest(globalConfigPath) {
 }
 async function saveManifest(manifest, globalConfigPath) {
   const file = projectsJsonPath(globalConfigPath);
-  await fs5.mkdir(path7.dirname(file), { recursive: true });
-  await fs5.writeFile(file, JSON.stringify(manifest, null, 2), "utf8");
+  await fs6.mkdir(path8.dirname(file), { recursive: true });
+  await fs6.writeFile(file, JSON.stringify(manifest, null, 2), "utf8");
 }
 function generateProjectSlug(rootPath) {
   return projectSlug(rootPath);
 }
 async function ensureProjectDataDir(slug, globalConfigPath) {
-  const base = path7.dirname(globalConfigPath);
-  const dir = path7.join(base, "projects", slug);
-  await fs5.mkdir(dir, { recursive: true });
+  const base = path8.dirname(globalConfigPath);
+  const dir = path8.join(base, "projects", slug);
+  await fs6.mkdir(dir, { recursive: true });
   return dir;
 }
 
@@ -5074,14 +5097,14 @@ function registerShutdownHandlers(res) {
 
 // src/server/instance-registry.ts
 import * as os from "os";
-import * as path8 from "path";
-import * as fs6 from "fs/promises";
+import * as path9 from "path";
+import * as fs7 from "fs/promises";
 import { atomicWrite as atomicWrite3 } from "@wrongstack/core";
 function defaultBaseDir() {
-  return path8.join(os.homedir(), ".wrongstack");
+  return path9.join(os.homedir(), ".wrongstack");
 }
 function registryPath(baseDir = defaultBaseDir()) {
-  return path8.join(baseDir, "webui-instances.json");
+  return path9.join(baseDir, "webui-instances.json");
 }
 function isPidAlive(pid) {
   if (!Number.isInteger(pid) || pid <= 0) return false;
@@ -5094,7 +5117,7 @@ function isPidAlive(pid) {
 }
 async function load(file) {
   try {
-    const raw = await fs6.readFile(file, "utf8");
+    const raw = await fs7.readFile(file, "utf8");
     const parsed = JSON.parse(raw);
     if (parsed?.version === 1 && Array.isArray(parsed.instances)) {
       return parsed;
@@ -5239,19 +5262,19 @@ function computeUsageCost(usage, rates) {
 }
 
 // src/server/provider-handlers.ts
-import { DefaultSecretScrubber as DefaultSecretScrubber2 } from "@wrongstack/core";
+import { DefaultSecretScrubber } from "@wrongstack/core";
 import { probeLocalLlm } from "@wrongstack/runtime/probe";
 
 // src/server/provider-config-io.ts
-import * as fs7 from "fs/promises";
-import * as path9 from "path";
+import * as fs8 from "fs/promises";
+import * as path10 from "path";
 import { atomicWrite as atomicWrite4 } from "@wrongstack/core";
 import { decryptConfigSecrets, encryptConfigSecrets } from "@wrongstack/core/security";
 import { DefaultSecretVault } from "@wrongstack/core";
 async function loadSavedProviders(configPath, vault) {
   let raw;
   try {
-    raw = await fs7.readFile(configPath, "utf8");
+    raw = await fs8.readFile(configPath, "utf8");
   } catch {
     return {};
   }
@@ -5268,7 +5291,7 @@ async function saveProviders(configPath, vault, providers) {
   let raw;
   let fileExists = true;
   try {
-    raw = await fs7.readFile(configPath, "utf8");
+    raw = await fs8.readFile(configPath, "utf8");
   } catch (err) {
     if (err.code !== "ENOENT") {
       throw new Error(
@@ -5417,7 +5440,7 @@ function projectSavedProviders(providers) {
     return view;
   });
 }
-var probeScrubber = new DefaultSecretScrubber2();
+var probeScrubber = new DefaultSecretScrubber();
 function createProviderHandlers(deps2) {
   const { globalConfigPath, vault, broadcast: broadcast2, clients } = deps2;
   let configWriteLock = deps2.getConfigWriteLock();
@@ -5606,7 +5629,7 @@ function createProviderHandlers(deps2) {
 
 // src/server/mode-handlers.ts
 import {
-  DefaultSystemPromptBuilder as DefaultSystemPromptBuilder2
+  DefaultSystemPromptBuilder
 } from "@wrongstack/core";
 function createModeHandlers(ctx) {
   return {
@@ -5654,7 +5677,7 @@ function createModeHandlers(ctx) {
         }
         ctx.setModeId(id);
         const modePrompt = id === "default" ? "" : (await ctx.modeStore.getMode(id))?.prompt ?? "";
-        const freshBuilder = new DefaultSystemPromptBuilder2({
+        const freshBuilder = new DefaultSystemPromptBuilder({
           memoryStore: ctx.memoryStore,
           skillLoader: ctx.skillLoader,
           modeStore: ctx.modeStore,
@@ -5685,40 +5708,10 @@ function createModeHandlers(ctx) {
 import * as fs9 from "fs/promises";
 import * as path11 from "path";
 import {
-  DefaultSessionStore as DefaultSessionStore2,
-  DefaultSystemPromptBuilder as DefaultSystemPromptBuilder3,
+  DefaultSessionStore,
+  DefaultSystemPromptBuilder as DefaultSystemPromptBuilder2,
   getSessionRegistry
 } from "@wrongstack/core";
-
-// src/server/path-containment.ts
-import * as fs8 from "fs/promises";
-import * as path10 from "path";
-function isPathInside(root, target) {
-  const relative3 = path10.relative(root, target);
-  return relative3 === "" || !relative3.startsWith("..") && !path10.isAbsolute(relative3);
-}
-async function resolveWorkingDirInsideProject(projectRoot, inputPath) {
-  const resolved = path10.resolve(projectRoot, inputPath);
-  let stat3;
-  try {
-    stat3 = await fs8.stat(resolved);
-  } catch {
-    throw new Error(`Directory not found or not accessible: ${resolved}`);
-  }
-  if (!stat3.isDirectory()) {
-    throw new Error(`Directory not found or not accessible: ${resolved}`);
-  }
-  const [realProjectRoot, realResolved] = await Promise.all([
-    fs8.realpath(projectRoot),
-    fs8.realpath(resolved)
-  ]);
-  if (!isPathInside(realProjectRoot, realResolved)) {
-    throw new Error(`Path must stay inside the project root: ${projectRoot}`);
-  }
-  return resolved;
-}
-
-// src/server/project-handlers.ts
 function createProjectHandlers(ctx) {
   return {
     listProjects: async (ws) => {
@@ -5830,7 +5823,7 @@ function createProjectHandlers(ctx) {
         try {
           const modeId = ctx.getModeId();
           const switchMode = modeId === "default" ? void 0 : await ctx.modeStore.getMode(modeId);
-          const switchBuilder = new DefaultSystemPromptBuilder3({
+          const switchBuilder = new DefaultSystemPromptBuilder2({
             memoryStore: ctx.memoryStore,
             skillLoader: ctx.skillLoader,
             modeStore: ctx.modeStore,
@@ -5854,7 +5847,7 @@ function createProjectHandlers(ctx) {
           "sessions"
         );
         await fs9.mkdir(newSessionsDir, { recursive: true });
-        const newSessionStore = new DefaultSessionStore2({ dir: newSessionsDir });
+        const newSessionStore = new DefaultSessionStore({ dir: newSessionsDir });
         const oldSession = ctx.getSession();
         const oldSessionId = oldSession.id;
         try {
@@ -6551,6 +6544,22 @@ async function handleModeRoute(ws, msg, handlers) {
   }
 }
 
+// src/server/prefs-routes.ts
+async function handlePrefsRoute(ws, msg, handlers) {
+  switch (msg.type) {
+    case "prefs.get": {
+      await handlers.getPrefs(ws);
+      return true;
+    }
+    case "prefs.update": {
+      await handlers.updatePrefs(ws, msg.payload ?? {});
+      return true;
+    }
+    default:
+      return false;
+  }
+}
+
 // src/server/shell-git-routes.ts
 async function handleShellGitRoute(ws, msg, handlers) {
   switch (msg.type) {
@@ -6591,6 +6600,44 @@ async function handleMailboxRoute(ws, msg, handlers) {
   }
 }
 
+// src/server/mcp-routes.ts
+async function handleMcpRoute(ws, msg, handlers) {
+  switch (msg.type) {
+    case "mcp.list":
+      await handlers.list(ws, msg);
+      return true;
+    case "mcp.add":
+      await handlers.add(ws, msg);
+      return true;
+    case "mcp.update":
+      await handlers.update(ws, msg);
+      return true;
+    case "mcp.remove":
+      await handlers.remove(ws, msg);
+      return true;
+    case "mcp.enable":
+      await handlers.enable(ws, msg);
+      return true;
+    case "mcp.disable":
+      await handlers.disable(ws, msg);
+      return true;
+    case "mcp.sleep":
+      await handlers.sleep(ws, msg);
+      return true;
+    case "mcp.wake":
+      await handlers.wake(ws, msg);
+      return true;
+    case "mcp.restart":
+      await handlers.restart(ws, msg);
+      return true;
+    case "mcp.discover":
+      await handlers.discover(ws, msg);
+      return true;
+    default:
+      return false;
+  }
+}
+
 // src/server/brain-routes.ts
 async function handleBrainRoute(ws, msg, handlers) {
   switch (msg.type) {
@@ -7062,11 +7109,13 @@ function setupEvents(deps2) {
   events.on("provider.response", (e) => {
     if (e.usage?.input != null) {
       const maxCtx = context.provider.capabilities.maxContext;
-      const pct = maxCtx > 0 ? e.usage.input / maxCtx : 0;
+      const rawLoad = maxCtx > 0 ? e.usage.input / maxCtx : 0;
+      const load2 = Math.max(0, Math.min(1, rawLoad));
       const costUsd = context.tokenCounter.estimateCost().total;
       forwardSubagent("ctx_pct", {
         subagentId: "leader",
-        load: pct,
+        load: load2,
+        rawLoad,
         tokens: e.usage.input,
         maxContext: maxCtx,
         costUsd
@@ -7717,6 +7766,7 @@ async function handleGoalGet(projectRoot, broadcast2) {
 
 // src/server/index.ts
 async function startWebUI(opts = {}) {
+  ensureSessionShell();
   const requestedWsPort = opts.wsPort ?? 3457;
   const wsHost = opts.wsHost ?? "127.0.0.1";
   const requestedHttpPort = Number.parseInt(process.env["PORT"] ?? "3456", 10);
@@ -7798,7 +7848,7 @@ async function startWebUI(opts = {}) {
     ttlSeconds: 24 * 3600
   });
   const container = createDefaultContainer({ config, wpaths, logger, modelsRegistry });
-  const configStore = opts.services?.configStore ?? container.resolve(TOKENS2.ConfigStore);
+  const configStore = opts.services?.configStore ?? container.resolve(TOKENS.ConfigStore);
   const providerRegistry = new ProviderRegistry();
   try {
     const factories = await buildProviderFactoriesFromRegistry({
@@ -7820,7 +7870,7 @@ async function startWebUI(opts = {}) {
     r.registerAllOrThrow([...builtinToolsPack.tools ?? []], builtinToolsPack.name);
     return r;
   })();
-  const memoryStore = new DefaultMemoryStore2({ paths: wpaths });
+  const memoryStore = new DefaultMemoryStore({ paths: wpaths });
   if (config.features.memory) {
     toolRegistry.register(rememberTool(memoryStore));
     toolRegistry.register(forgetTool(memoryStore));
@@ -7833,6 +7883,7 @@ async function startWebUI(opts = {}) {
   toolRegistry.register(makeMailSendTool({ projectDir: wpaths.projectDir, events }));
   toolRegistry.register(makeMailInboxTool({ projectDir: wpaths.projectDir, events }));
   applyToolDescriptionModes(toolRegistry, config.tools?.descriptionMode);
+  configureExecPolicy(config.tools?.exec ?? {});
   console.log("[WebUI] Tool registry loaded:", toolRegistry.list().length, "tools");
   const mcpRegistry = new MCPRegistry({
     toolRegistry,
@@ -7849,7 +7900,7 @@ async function startWebUI(opts = {}) {
       });
     }
   }
-  let sessionStore = opts.services?.session ?? new DefaultSessionStore3({ dir: wpaths.projectSessions });
+  let sessionStore = opts.services?.session ?? new DefaultSessionStore2({ dir: wpaths.projectSessions });
   if (!opts.services?.session) {
     sessionStore.prune(DEFAULT_SESSION_PRUNE_DAYS).then((count) => {
       if (count > 0) logger.info(`Pruned ${count} old session${count === 1 ? "" : "s"}.`);
@@ -7937,11 +7988,11 @@ async function startWebUI(opts = {}) {
     });
   } catch {
   }
-  const tokenCounter = new DefaultTokenCounter2({
+  const tokenCounter = new DefaultTokenCounter({
     registry: modelsRegistry,
     providerId: config.provider
   });
-  const modeStore = new DefaultModeStore2({ directory: wpaths.configDir });
+  const modeStore = new DefaultModeStore({ directory: wpaths.configDir });
   const activeMode = await modeStore.getActiveMode();
   let modeId = activeMode?.id ?? "default";
   const modePrompt = activeMode?.prompt ?? "";
@@ -7962,7 +8013,7 @@ async function startWebUI(opts = {}) {
   const modelCapabilitiesRef = {
     current: modelCapabilities
   };
-  const skillLoader = config.features.skills ? new DefaultSkillLoader2({ paths: wpaths }) : void 0;
+  const skillLoader = config.features.skills ? new DefaultSkillLoader({ paths: wpaths }) : void 0;
   const skillInstaller = config.features.skills ? new SkillInstaller({
     manifestPath: path16.join(wstackGlobalRoot2(), "installed-skills.json"),
     projectSkillsDir: path16.join(projectRoot, ".wrongstack", "skills"),
@@ -7970,7 +8021,7 @@ async function startWebUI(opts = {}) {
     projectHash: projectHash(projectRoot),
     skillLoader
   }) : void 0;
-  const systemPromptBuilder = new DefaultSystemPromptBuilder4({
+  const systemPromptBuilder = new DefaultSystemPromptBuilder3({
     memoryStore,
     skillLoader,
     modeStore,
@@ -8260,7 +8311,7 @@ async function startWebUI(opts = {}) {
     projectRoot,
     logger
   });
-  const compactor = createStrategyCompactor2({
+  const compactor = createStrategyCompactor({
     strategy: config.context?.strategy,
     preserveK: config.context?.preserveK ?? 10,
     eliseThreshold: config.context?.eliseThreshold ?? 2e3,
@@ -8336,9 +8387,9 @@ async function startWebUI(opts = {}) {
       maxContext: newMaxContext
     });
   }
-  const secretScrubber = container.resolve(TOKENS2.SecretScrubber);
-  const renderer = container.has(TOKENS2.Renderer) ? container.resolve(TOKENS2.Renderer) : void 0;
-  const permissionPolicy = container.resolve(TOKENS2.PermissionPolicy);
+  const secretScrubber = container.resolve(TOKENS.SecretScrubber);
+  const renderer = container.has(TOKENS.Renderer) ? container.resolve(TOKENS.Renderer) : void 0;
+  const permissionPolicy = container.resolve(TOKENS.PermissionPolicy);
   const toolExecutor = new ToolExecutor(toolRegistry, {
     permissionPolicy,
     secretScrubber,
@@ -8381,7 +8432,7 @@ async function startWebUI(opts = {}) {
     }),
     events
   );
-  container.bind(TOKENS2.BrainArbiter, () => brain);
+  container.bind(TOKENS.BrainArbiter, () => brain);
   const brainMailbox = new GlobalMailbox2(wpaths.projectDir, events);
   const brainMonitor = new BrainMonitor({
     events,
@@ -8761,8 +8812,10 @@ async function startWebUI(opts = {}) {
   let sessionRoutes;
   let projectRoutes;
   let modeRoutes;
+  let prefsRoutes;
   let shellGitRoutes;
   let mailboxRoutes;
+  let mcpRoutes;
   let brainRoutes;
   let autoPhaseRoutes;
   let specsRoutes;
@@ -8773,8 +8826,10 @@ async function startWebUI(opts = {}) {
     if (await handleSessionRoute(ws, msg, sessionRoutes)) return;
     if (await handleProjectRoute(ws, msg, projectRoutes)) return;
     if (await handleModeRoute(ws, msg, modeRoutes)) return;
+    if (await handlePrefsRoute(ws, msg, prefsRoutes)) return;
     if (await handleShellGitRoute(ws, msg, shellGitRoutes)) return;
     if (await handleMailboxRoute(ws, msg, mailboxRoutes)) return;
+    if (await handleMcpRoute(ws, msg, mcpRoutes)) return;
     if (await handleBrainRoute(ws, msg, brainRoutes)) return;
     if (await handleAutoPhaseRoute(ws, msg, autoPhaseRoutes)) return;
     if (await handleSpecsRoute(ws, msg, specsRoutes)) return;
@@ -8885,27 +8940,31 @@ async function startWebUI(opts = {}) {
       case "memory.forget":
         return handleMemoryForget(ws, msg, memoryStore);
       // ── MCP operations — delegated to shared handlers (mcp-handlers.ts),
-      // backed by the live MCPRegistry constructed above. ──
+      // backed by the live MCPRegistry constructed above. Routed via
+      // handleMcpRoute (see mcpRoutes = { ... } below). These case arms
+      // are unreachable but left as tripwires for any future regression
+      // where the route chain stops claiming 'mcp.*'. If you see one
+      // fire, fix the dispatch order in the handleMessage chain above.
       case "mcp.list":
-        return handleMcpList(ws, msg, globalConfigPath, mcpRegistry);
+        throw new Error("handleMcpRoute did not claim mcp.list \u2014 check chain order");
       case "mcp.add":
-        return handleMcpAdd(ws, msg, globalConfigPath, mcpRegistry);
-      case "mcp.remove":
-        return handleMcpRemove(ws, msg, globalConfigPath, mcpRegistry);
+        throw new Error("handleMcpRoute did not claim mcp.add \u2014 check chain order");
       case "mcp.update":
-        return handleMcpUpdate(ws, msg, globalConfigPath, mcpRegistry);
-      case "mcp.wake":
-        return handleMcpWake(ws, msg, globalConfigPath, mcpRegistry);
-      case "mcp.sleep":
-        return handleMcpSleep(ws, msg, globalConfigPath, mcpRegistry);
-      case "mcp.discover":
-        return handleMcpDiscover(ws, msg, globalConfigPath, mcpRegistry);
+        throw new Error("handleMcpRoute did not claim mcp.update \u2014 check chain order");
+      case "mcp.remove":
+        throw new Error("handleMcpRoute did not claim mcp.remove \u2014 check chain order");
       case "mcp.enable":
-        return handleMcpEnable(ws, msg, globalConfigPath, mcpRegistry);
+        throw new Error("handleMcpRoute did not claim mcp.enable \u2014 check chain order");
       case "mcp.disable":
-        return handleMcpDisable(ws, msg, globalConfigPath, mcpRegistry);
+        throw new Error("handleMcpRoute did not claim mcp.disable \u2014 check chain order");
+      case "mcp.sleep":
+        throw new Error("handleMcpRoute did not claim mcp.sleep \u2014 check chain order");
+      case "mcp.wake":
+        throw new Error("handleMcpRoute did not claim mcp.wake \u2014 check chain order");
       case "mcp.restart":
-        return handleMcpRestart(ws, msg, globalConfigPath, mcpRegistry);
+        throw new Error("handleMcpRoute did not claim mcp.restart \u2014 check chain order");
+      case "mcp.discover":
+        throw new Error("handleMcpRoute did not claim mcp.discover \u2014 check chain order");
       // Skills — full request→response cycle lives in skills-handlers.ts
       // (shared with the CLI's embedded server). skillsCtx is the closed-over
       // loader/installer/projectRoot the handlers need.
@@ -9053,53 +9112,11 @@ async function startWebUI(opts = {}) {
         break;
       }
       case "prefs.update": {
-        const parsed = validatePrefsUpdatePayload(msg.payload);
-        if (!parsed.ok) {
-          sendResult2(ws, false, parsed.message);
-          break;
-        }
-        const payload = parsed.value.prefs;
-        for (const [key, val] of Object.entries(payload)) {
-          context.meta[key] = val;
-        }
-        void persistPrefsToConfig(payload);
-        if (typeof payload["yolo"] === "boolean") {
-          permissionPolicy.setYolo?.(payload["yolo"]);
-        }
-        if (typeof payload["featureMcp"] === "boolean")
-          config.features.mcp = payload["featureMcp"];
-        if (typeof payload["featurePlugins"] === "boolean")
-          config.features.plugins = payload["featurePlugins"];
-        if (typeof payload["featureMemory"] === "boolean")
-          config.features.memory = payload["featureMemory"];
-        if (typeof payload["featureSkills"] === "boolean")
-          config.features.skills = payload["featureSkills"];
-        if (typeof payload["featureModelsRegistry"] === "boolean")
-          config.features.modelsRegistry = payload["featureModelsRegistry"];
-        if (Array.isArray(payload["fallbackModels"]))
-          config.fallbackModels = payload["fallbackModels"];
-        if (typeof payload["fallbackAuto"] === "boolean")
-          config.fallbackAuto = payload["fallbackAuto"];
-        if (typeof payload["contextAutoCompact"] === "boolean") {
-          if (payload["contextAutoCompact"] && autoCompactor) {
-            pipelines.contextWindow.remove("AutoCompaction", { optional: true });
-            pipelines.contextWindow.use({ name: "AutoCompaction", handler: autoCompactor.handler() });
-          } else {
-            pipelines.contextWindow.remove("AutoCompaction", { optional: true });
-          }
-        }
-        if (typeof payload["logLevel"] === "string") {
-          const valid = ["debug", "info", "warn", "error"];
-          if (valid.includes(payload["logLevel"])) {
-            logger.level = payload["logLevel"];
-          }
-        }
-        broadcast(clients, { type: "prefs.updated", payload: prefSnapshot() });
-        break;
+        void ws;
+        throw new Error("handlePrefsRoute did not claim prefs.update \u2014 check chain order");
       }
       case "prefs.get": {
-        send(ws, { type: "prefs.updated", payload: prefSnapshot() });
-        break;
+        throw new Error("handlePrefsRoute did not claim prefs.get \u2014 check chain order");
       }
       default:
         send(ws, {
@@ -9320,6 +9337,55 @@ async function startWebUI(opts = {}) {
     },
     sessionStartPayload
   });
+  prefsRoutes = {
+    getPrefs: async (ws) => {
+      send(ws, { type: "prefs.updated", payload: prefSnapshot() });
+    },
+    updatePrefs: async (ws, msgPayload) => {
+      const parsed = validatePrefsUpdatePayload(msgPayload);
+      if (!parsed.ok) {
+        sendResult2(ws, false, parsed.message);
+        return;
+      }
+      const payload = parsed.value.prefs;
+      for (const [key, val] of Object.entries(payload)) {
+        context.meta[key] = val;
+      }
+      void persistPrefsToConfig(payload);
+      if (typeof payload["yolo"] === "boolean") {
+        permissionPolicy.setYolo?.(payload["yolo"]);
+      }
+      if (typeof payload["featureMcp"] === "boolean")
+        config.features.mcp = payload["featureMcp"];
+      if (typeof payload["featurePlugins"] === "boolean")
+        config.features.plugins = payload["featurePlugins"];
+      if (typeof payload["featureMemory"] === "boolean")
+        config.features.memory = payload["featureMemory"];
+      if (typeof payload["featureSkills"] === "boolean")
+        config.features.skills = payload["featureSkills"];
+      if (typeof payload["featureModelsRegistry"] === "boolean")
+        config.features.modelsRegistry = payload["featureModelsRegistry"];
+      if (Array.isArray(payload["fallbackModels"]))
+        config.fallbackModels = payload["fallbackModels"];
+      if (typeof payload["fallbackAuto"] === "boolean")
+        config.fallbackAuto = payload["fallbackAuto"];
+      if (typeof payload["contextAutoCompact"] === "boolean") {
+        if (payload["contextAutoCompact"] && autoCompactor) {
+          pipelines.contextWindow.remove("AutoCompaction", { optional: true });
+          pipelines.contextWindow.use({ name: "AutoCompaction", handler: autoCompactor.handler() });
+        } else {
+          pipelines.contextWindow.remove("AutoCompaction", { optional: true });
+        }
+      }
+      if (typeof payload["logLevel"] === "string") {
+        const valid = ["debug", "info", "warn", "error"];
+        if (valid.includes(payload["logLevel"])) {
+          logger.level = payload["logLevel"];
+        }
+      }
+      broadcast(clients, { type: "prefs.updated", payload: prefSnapshot() });
+    }
+  };
   shellGitRoutes = {
     gitInfo: async (ws) => {
       await handleGitInfo(ws, projectRoot);
@@ -9372,6 +9438,18 @@ async function startWebUI(opts = {}) {
       return handleMailboxPurge(ws, { projectRoot, globalRoot: path16.dirname(globalConfigPath) }, parsed.value);
     }
   };
+  mcpRoutes = {
+    list: (ws, msg) => handleMcpList(ws, msg, globalConfigPath, mcpRegistry),
+    add: (ws, msg) => handleMcpAdd(ws, msg, globalConfigPath, mcpRegistry),
+    update: (ws, msg) => handleMcpUpdate(ws, msg, globalConfigPath, mcpRegistry),
+    remove: (ws, msg) => handleMcpRemove(ws, msg, globalConfigPath, mcpRegistry),
+    enable: (ws, msg) => handleMcpEnable(ws, msg, globalConfigPath, mcpRegistry),
+    disable: (ws, msg) => handleMcpDisable(ws, msg, globalConfigPath, mcpRegistry),
+    sleep: (ws, msg) => handleMcpSleep(ws, msg, globalConfigPath, mcpRegistry),
+    wake: (ws, msg) => handleMcpWake(ws, msg, globalConfigPath, mcpRegistry),
+    restart: (ws, msg) => handleMcpRestart(ws, msg, globalConfigPath, mcpRegistry),
+    discover: (ws, msg) => handleMcpDiscover(ws, msg, globalConfigPath, mcpRegistry)
+  };
   brainRoutes = {
     status: (ws) => {
       send(ws, {