scream-code 0.15.0 → 0.15.2

package/dist/{app-CPu6R7nd.mjs → app-6Hcxs2tP.mjs}

@@ -4,7 +4,7 @@ import { dirname as __cjsShimDirname } from 'node:path';
 const __filename = __cjsShimFileURLToPath(import.meta.url);
 const __dirname = __cjsShimDirname(__filename);
 import "./suppress-sqlite-warning-C2VB0doZ.mjs";
-import { $t as isTodoItemShape, A as renderDiffLinesClustered, An as getInputHistoryFile, At as ENABLE_TERMINAL_FOCUS_REPORTING, B as BackgroundAgentStatusComponent, Bn as ScreamHarness, Bt as TERMINAL_THEME_LIGHT, Cn as PULSE_WAVE_FRAMES, Ct as createThemeStyles, D as toggleEmptySessionHint, Dn as saveTuiConfig, Dt as parseOsc11BackgroundTheme, E as isTurnElapsedEnabled, En as loadTuiConfig, Et as detectTerminalTheme, F as estimateTokens, Fn as CLI_USER_AGENT_PRODUCT, Ft as OSC11_RESPONSE_PREFIX_NO_ESC, G as getBreathingFrame, Gn as log, H as AgentGroupComponent, Hn as resolveScreamHome, Ht as isStreaming, I as getSharedSpeedTracker, In as PRODUCT_NAME, It as QUERY_TERMINAL_THEME, J as refineGoal, Jn as isOrphanedToolCallError, Jt as printableChar, K as resetBreathingClock, Kn as resolveGlobalLogPath, L as SkillActivationComponent, Ln as DEFAULT_CATALOG_URL, Lt as TERMINAL_FOCUS_IN, M as langFromPath, Mn as detectInstallSource, Mt as OSC11_QUERY, N as CachedContainer, Nn as CLI_COMMAND_NAME, Nt as OSC11_RESPONSE, O as ToolCallComponent, On as detectShellEnvironment, Ot as DISABLE_TERMINAL_FOCUS_REPORTING, P as ThinkingComponent, Pn as CLI_UI_MODE, Pt as OSC11_RESPONSE_PREFIX, Qt as formatErrorMessage, R as ReadGroupComponent, Rn as fetchCatalog, Rt as TERMINAL_FOCUS_OUT, S as getDaemonInstructions, Sn as PIXEL_PULSE_FRAMES, St as createMarkdownTheme, T as isEmptySessionHintDismissed, Tn as TuiLikePreferencesSchema, Tt as getColorPalette, U as WelcomeComponent, Un as MemoryMemoStore, Ut as FooterComponent, V as AssistantMessageComponent, Vt as isBusy, W as BREATHE_CYCLE_MS, Wn as flushDiagnosticLogs, Xn as SCREAM_ERROR_INFO, Xt as appendStreamingArgsPreview, Yn as ErrorCodes, Yt as STATUS_BULLET, Zt as argsRecord, _ as refreshUpdateCache, _n as isExperimentalFlagEnabled, _t as clearInfoPanelState, an as EMPTY_SESSION_HINT_URL, b as readJsonlFile, bn as isEmbeddingModelCached, bt as resolveThemeSync, c as hasDispose, cn as SESSION_TIPS, ct as handlePlanCommand, d as formatMemoryMemoForInjection, dn as getCtrlDHint, en as parseStreamingArgs, et as toTerminalHyperlink, fn as getLlmNotSetMessage, g as selectUpdateTarget, gn as sortSlashCommands, gt as supportsBalance, hn as BUILTIN_SLASH_COMMANDS, ht as refreshProviderBalance, i as buildRoleAdditionalText, in as CHARS_PER_TOKEN, j as highlightLines, jn as getLogDir, jt as ENABLE_TERMINAL_THEME_REPORTING, k as renderDiffLines, kn as getDataDir, kt as DISABLE_TERMINAL_THEME_REPORTING, l as isPlanExpandable, ln as TIP_ROTATION_INTERVAL_MS, mn as buildSkillSlashCommands, n as clearEvalPanelState, nn as stringValue, nt as getModelCycleLevel, on as EXIT_CONFIRM_WINDOW_MS, ot as handleFusionPlanCommand, pn as getNoActiveSessionMessage, q as clearGoalState, qn as isScreamError, r as openUrl, rn as truncateErrorMessage, s as disposeChildren, sn as MAIN_AGENT_ID, t as dispatchInput, tn as serializeToolResultOutput, tt as changeThinkingLevel, u as MoonLoader, un as getCtrlCHint, v as readUpdateCache, vn as setExperimentalFlags, w as UserMessageComponent, wn as TuiConfigParseError, wt as contrastTextHex, xn as startManualEmbeddingDownload, xt as createEditorTheme, y as appendJsonlLine, yn as getKnowledgeStore, z as parseReadGroupOutput, zn as saveCatalogCache, zt as TERMINAL_THEME_DARK } from "./dispatch-D8ovLbmr.mjs";
+import { $t as isTodoItemShape, A as renderDiffLinesClustered, An as getInputHistoryFile, At as ENABLE_TERMINAL_FOCUS_REPORTING, B as BackgroundAgentStatusComponent, Bn as ScreamHarness, Bt as TERMINAL_THEME_LIGHT, Cn as PULSE_WAVE_FRAMES, Ct as createThemeStyles, D as toggleEmptySessionHint, Dn as saveTuiConfig, Dt as parseOsc11BackgroundTheme, E as isTurnElapsedEnabled, En as loadTuiConfig, Et as detectTerminalTheme, F as estimateTokens, Fn as CLI_USER_AGENT_PRODUCT, Ft as OSC11_RESPONSE_PREFIX_NO_ESC, G as getBreathingFrame, Gn as log, H as AgentGroupComponent, Hn as resolveScreamHome, Ht as isStreaming, I as getSharedSpeedTracker, In as PRODUCT_NAME, It as QUERY_TERMINAL_THEME, J as refineGoal, Jn as isOrphanedToolCallError, Jt as printableChar, K as resetBreathingClock, Kn as resolveGlobalLogPath, L as SkillActivationComponent, Ln as DEFAULT_CATALOG_URL, Lt as TERMINAL_FOCUS_IN, M as langFromPath, Mn as detectInstallSource, Mt as OSC11_QUERY, N as CachedContainer, Nn as CLI_COMMAND_NAME, Nt as OSC11_RESPONSE, O as ToolCallComponent, On as detectShellEnvironment, Ot as DISABLE_TERMINAL_FOCUS_REPORTING, P as ThinkingComponent, Pn as CLI_UI_MODE, Pt as OSC11_RESPONSE_PREFIX, Qt as formatErrorMessage, R as ReadGroupComponent, Rn as fetchCatalog, Rt as TERMINAL_FOCUS_OUT, S as getDaemonInstructions, Sn as PIXEL_PULSE_FRAMES, St as createMarkdownTheme, T as isEmptySessionHintDismissed, Tn as TuiLikePreferencesSchema, Tt as getColorPalette, U as WelcomeComponent, Un as MemoryMemoStore, Ut as FooterComponent, V as AssistantMessageComponent, Vt as isBusy, W as BREATHE_CYCLE_MS, Wn as flushDiagnosticLogs, Xn as SCREAM_ERROR_INFO, Xt as appendStreamingArgsPreview, Yn as ErrorCodes, Yt as STATUS_BULLET, Zt as argsRecord, _ as refreshUpdateCache, _n as isExperimentalFlagEnabled, _t as clearInfoPanelState, an as EMPTY_SESSION_HINT_URL, b as readJsonlFile, bn as isEmbeddingModelCached, bt as resolveThemeSync, c as hasDispose, cn as SESSION_TIPS, ct as handlePlanCommand, d as formatMemoryMemoForInjection, dn as getCtrlDHint, en as parseStreamingArgs, et as toTerminalHyperlink, fn as getLlmNotSetMessage, g as selectUpdateTarget, gn as sortSlashCommands, gt as supportsBalance, hn as BUILTIN_SLASH_COMMANDS, ht as refreshProviderBalance, i as buildRoleAdditionalText, in as CHARS_PER_TOKEN, j as highlightLines, jn as getLogDir, jt as ENABLE_TERMINAL_THEME_REPORTING, k as renderDiffLines, kn as getDataDir, kt as DISABLE_TERMINAL_THEME_REPORTING, l as isPlanExpandable, ln as TIP_ROTATION_INTERVAL_MS, mn as buildSkillSlashCommands, n as clearEvalPanelState, nn as stringValue, nt as getModelCycleLevel, on as EXIT_CONFIRM_WINDOW_MS, ot as handleFusionPlanCommand, pn as getNoActiveSessionMessage, q as clearGoalState, qn as isScreamError, r as openUrl, rn as truncateErrorMessage, s as disposeChildren, sn as MAIN_AGENT_ID, t as dispatchInput, tn as serializeToolResultOutput, tt as changeThinkingLevel, u as MoonLoader, un as getCtrlCHint, v as readUpdateCache, vn as setExperimentalFlags, w as UserMessageComponent, wn as TuiConfigParseError, wt as contrastTextHex, xn as startManualEmbeddingDownload, xt as createEditorTheme, y as appendJsonlLine, yn as getKnowledgeStore, z as parseReadGroupOutput, zn as saveCatalogCache, zt as TERMINAL_THEME_DARK } from "./dispatch-B_ViYZer.mjs";
 import { a as setLocale, o as t } from "./text-input-dialog-BUXAKycx.mjs";
 import { createRequire } from "node:module";
 import { randomBytes, randomUUID, scryptSync, timingSafeEqual } from "node:crypto";
@@ -32,7 +32,7 @@ function optionalBuildString(value) {
 	return typeof value === "string" && value.length > 0 ? value : void 0;
 }
 const SCREAM_BUILD_INFO = {
-	version: optionalBuildString("0.15.0"),
+	version: optionalBuildString("0.15.2"),
 	channel: optionalBuildString(""),
 	commit: optionalBuildString(""),
 	buildTarget: optionalBuildString("darwin-arm64")
@@ -12397,7 +12397,7 @@ var ScreamTUI = class {
 		const card = new OnboardingCardComponent({
 			colors: this.state.theme.colors,
 			onConfigure: () => {
-				import("./dispatch-BPcn43Vw.mjs").then(({ handleConnectCommand }) => handleConnectCommand(this, "")).finally(() => {
+				import("./dispatch-Dur5jHVw.mjs").then(({ handleConnectCommand }) => handleConnectCommand(this, "")).finally(() => {
 					this.restoreEditor();
 					onDone?.();
 				});
@@ -14527,7 +14527,14 @@ function toHttpError(error) {
 	if (isScreamError(error)) switch (error.code) {
 		case ErrorCodes.GOAL_OBJECTIVE_EMPTY:
 		case ErrorCodes.GOAL_OBJECTIVE_TOO_LONG:
-		case ErrorCodes.REQUEST_INVALID: return new HttpError(400, error.message, error.code);
+		case ErrorCodes.REQUEST_INVALID:
+		case ErrorCodes.SESSION_PERMISSION_MODE_INVALID:
+		case ErrorCodes.SESSION_PLAN_MODE_INVALID:
+		case ErrorCodes.SESSION_WOLFPACK_MODE_INVALID:
+		case ErrorCodes.SESSION_MODEL_EMPTY:
+		case ErrorCodes.SESSION_THINKING_EMPTY:
+		case ErrorCodes.SKILL_NAME_EMPTY:
+		case ErrorCodes.BACKGROUND_TASK_ID_EMPTY: return new HttpError(400, error.message, error.code);
 		case ErrorCodes.GOAL_NOT_FOUND:
 		case ErrorCodes.SESSION_NOT_FOUND: return new HttpError(404, error.message, error.code);
 		case ErrorCodes.GOAL_ALREADY_EXISTS:
@@ -14629,9 +14636,13 @@ async function appendJournalLine(homeDir, sessionId, line) {
 		});
 	}
 }
+let metaWriteSeq = 0;
 async function saveMetadata(homeDir, meta) {
 	try {
-		await writeFile(getMetaPath(homeDir, meta.sessionId), JSON.stringify(meta, null, 2));
+		const path = getMetaPath(homeDir, meta.sessionId);
+		const tmp = `${path}.${process.pid}.${metaWriteSeq++}.tmp`;
+		await writeFile(tmp, JSON.stringify(meta, null, 2));
+		await rename(tmp, path);
 	} catch (error) {
 		log.warn("web: failed to save metadata", {
 			sessionId: meta.sessionId,
@@ -15032,6 +15043,15 @@ var WebSession = class {
 		});
 		await appendJournalLine(this.homeDir, this.sessionId, line);
 	}
+	/** In-flight fire-and-forget persistence writes, drained by close(). */
+	pendingWrites = /* @__PURE__ */ new Set();
+	/** Register a background persistence promise so close() can await it. */
+	trackPending(promise) {
+		const tracked = promise.catch(() => {}).then(() => {
+			this.pendingWrites.delete(tracked);
+		});
+		this.pendingWrites.add(tracked);
+	}
 	loadFromPersisted(entries) {
 		for (const entry of entries) if ("type" in entry && entry.type === "user_message") {
 			const um = entry;
@@ -15082,7 +15102,7 @@ var WebSession = class {
 			payload
 		};
 		this.journal.push(entry);
-		if (!entry.volatile) this.persistEntry(entry);
+		if (!entry.volatile) this.trackPending(this.persistEntry(entry));
 		return entry;
 	}
 	/**
@@ -15098,7 +15118,7 @@ var WebSession = class {
 			payload
 		};
 		this.journal.push(entry);
-		this.persistEntry(entry);
+		this.trackPending(this.persistEntry(entry));
 		return entry;
 	}
 	subscribeEvents() {
@@ -15148,7 +15168,7 @@ var WebSession = class {
 					});
 				}
 				this.liveAssistant = null;
-				this.updateTitle();
+				this.trackPending(this.updateTitle());
 			} else if (event.type === "assistant.delta") {
 				const live = this.liveAssistant;
 				if (live) live.content += event.delta;
@@ -15336,7 +15356,7 @@ var WebSession = class {
 					return;
 				}
 				this.busy = true;
-				this.persistUserMessage(text, this.nextSeq, clientMessageId);
+				this.trackPending(this.persistUserMessage(text, this.nextSeq, clientMessageId));
 				this.broadcast({
 					type: "user_message",
 					clientMessageId,
@@ -15683,6 +15703,49 @@ var WebSession = class {
 			status: this.cachedStatus
 		}, false);
 	}
+	/** Switch permission mode, then sync status + metadata (TUI /auto,/yes parity). */
+	async switchPermission(mode) {
+		if (!this.session) throw new HttpError(409, "会话已归档（只读），无法切换权限模式。");
+		await this.session.setPermission(mode);
+		this.permission = mode;
+		await this.refreshStatus();
+		this.broadcast({
+			type: "status",
+			status: this.cachedStatus
+		}, false);
+		if (this.homeDir) await saveMetadata(this.homeDir, this.getMetadata());
+	}
+	/** Toggle plan mode, then sync status (TUI /plan parity). */
+	async switchPlanMode(enabled, strategy) {
+		if (!this.session) throw new HttpError(409, "会话已归档（只读），无法切换计划模式。");
+		await this.session.setPlanMode(enabled, strategy);
+		await this.refreshStatus();
+		this.broadcast({
+			type: "status",
+			status: this.cachedStatus
+		}, false);
+	}
+	/** Toggle wolfpack mode, then sync status. */
+	async switchWolfpackMode(enabled) {
+		if (!this.session) throw new HttpError(409, "会话已归档（只读），无法切换 Wolfpack 模式。");
+		await this.session.setWolfpackMode(enabled);
+		await this.refreshStatus();
+		this.broadcast({
+			type: "status",
+			status: this.cachedStatus
+		}, false);
+	}
+	/** Toggle RLM persistent-python mode (+ optional max depth), then sync status. */
+	async switchRlm(enabled, maxDepth) {
+		if (!this.session) throw new HttpError(409, "会话已归档（只读），无法切换 RLM 模式。");
+		await this.session.setRlmEnabled(enabled);
+		if (maxDepth !== void 0) await this.session.setRlmMaxDepth(maxDepth);
+		await this.refreshStatus();
+		this.broadcast({
+			type: "status",
+			status: this.cachedStatus
+		}, false);
+	}
 	getCoreSessionId() {
 		return this.coreSessionId;
 	}
@@ -15745,6 +15808,15 @@ var WebSession = class {
 			await session.cancelGoal();
 		}, true);
 	}
+	/**
+	* Public handle to the live core Session for REST RPC forwarding.
+	* Throws 409 for archived (read-only) sessions so handlers never call into a
+	* closed core session instead of silently creating one.
+	*/
+	requireLiveSession() {
+		if (!this.session) throw new HttpError(409, "Session is archived (read-only)", ErrorCodes.SESSION_CLOSED);
+		return this.session;
+	}
 	requireGoalSession(allowBusy = false) {
 		if (!this.session) throw new HttpError(409, "Session is archived (read-only)", ErrorCodes.SESSION_CLOSED);
 		if (!allowBusy && this.busy) throw new HttpError(409, "Session is busy", ErrorCodes.TURN_AGENT_BUSY);
@@ -15910,6 +15982,7 @@ var WebSession = class {
 		});
 		this.pendingApprovals.clear();
 		this.unsubscribe?.();
+		await Promise.allSettled(this.pendingWrites);
 		for (const [ws] of this.connections) ws.terminate();
 		this.connections.clear();
 		if (this.session) {
@@ -16232,7 +16305,529 @@ var SessionManager = class {
 		for (const [, ws] of this.sessions) await ws.close();
 		this.sessions.clear();
 	}
+	/** Resolve a live session or throw 404/409; the single guard for all handlers. */
+	getLiveSession(sessionId) {
+		const ws = this.sessions.get(sessionId);
+		if (!ws) throw new HttpError(404, "Session not found", ErrorCodes.SESSION_NOT_FOUND);
+		return ws.requireLiveSession();
+	}
+	async getSessionStatus(sessionId) {
+		return this.getLiveSession(sessionId).getStatus();
+	}
+	async getSessionUsage(sessionId) {
+		return this.getLiveSession(sessionId).getUsage();
+	}
+	async getSessionContext(sessionId) {
+		return this.getLiveSession(sessionId).getContext();
+	}
+	async getSessionPlan(sessionId) {
+		return this.getLiveSession(sessionId).getPlan();
+	}
+	async setPermission(sessionId, mode) {
+		const ws = this.sessions.get(sessionId);
+		if (!ws) throw new HttpError(404, "Session not found", ErrorCodes.SESSION_NOT_FOUND);
+		await ws.switchPermission(mode);
+	}
+	async setPlanMode(sessionId, enabled, strategy) {
+		const ws = this.sessions.get(sessionId);
+		if (!ws) throw new HttpError(404, "Session not found", ErrorCodes.SESSION_NOT_FOUND);
+		await ws.switchPlanMode(enabled, strategy);
+	}
+	async clearPlan(sessionId) {
+		await this.getLiveSession(sessionId).clearPlan();
+	}
+	async setWolfpackMode(sessionId, enabled) {
+		const ws = this.sessions.get(sessionId);
+		if (!ws) throw new HttpError(404, "Session not found", ErrorCodes.SESSION_NOT_FOUND);
+		await ws.switchWolfpackMode(enabled);
+	}
+	async setRlm(sessionId, enabled, maxDepth) {
+		const ws = this.sessions.get(sessionId);
+		if (!ws) throw new HttpError(404, "Session not found", ErrorCodes.SESSION_NOT_FOUND);
+		await ws.switchRlm(enabled, maxDepth);
+	}
+	async undoHistory(sessionId, count) {
+		await this.getLiveSession(sessionId).undoHistory(count);
+	}
+	async compact(sessionId, instruction) {
+		await this.getLiveSession(sessionId).compact(instruction ? { instruction } : {});
+	}
+	async listSkills(sessionId) {
+		return this.getLiveSession(sessionId).listSkills();
+	}
+	async activateSkill(sessionId, name, args) {
+		await this.getLiveSession(sessionId).activateSkill(name, args);
+	}
+	async removeSkill(sessionId, name) {
+		await this.getLiveSession(sessionId).removeSkill(name);
+	}
+	async listPlugins(sessionId) {
+		return this.getLiveSession(sessionId).listPlugins();
+	}
+	async getPluginInfo(sessionId, id) {
+		return this.getLiveSession(sessionId).getPluginInfo(id);
+	}
+	async installPlugin(sessionId, source) {
+		return this.getLiveSession(sessionId).installPlugin(source);
+	}
+	async setPluginEnabled(sessionId, id, enabled) {
+		await this.getLiveSession(sessionId).setPluginEnabled(id, enabled);
+	}
+	async setPluginMcpServerEnabled(sessionId, id, server, enabled) {
+		await this.getLiveSession(sessionId).setPluginMcpServerEnabled(id, server, enabled);
+	}
+	async removePlugin(sessionId, id) {
+		await this.getLiveSession(sessionId).removePlugin(id);
+	}
+	async reloadPlugins(sessionId) {
+		return this.getLiveSession(sessionId).reloadPlugins();
+	}
+	async activatePlugin(sessionId, id) {
+		await this.getLiveSession(sessionId).activatePlugin(id);
+	}
+	async deactivatePlugin(sessionId, id) {
+		await this.getLiveSession(sessionId).deactivatePlugin(id);
+	}
+	async injectPlugin(sessionId, id) {
+		await this.getLiveSession(sessionId).injectPlugin(id);
+	}
+	async listMcpServers(sessionId) {
+		return this.getLiveSession(sessionId).listMcpServers();
+	}
+	async getMcpStartupMetrics(sessionId) {
+		return this.getLiveSession(sessionId).getMcpStartupMetrics();
+	}
+	async addMcpServer(sessionId, name, config) {
+		await this.getLiveSession(sessionId).addMcpServer(name, config);
+	}
+	async reconnectMcpServer(sessionId, name) {
+		await this.getLiveSession(sessionId).reconnectMcpServer(name);
+	}
+	async stopMcpServer(sessionId, name) {
+		await this.getLiveSession(sessionId).stopMcpServer(name);
+	}
+	async removeMcpServer(sessionId, name) {
+		await this.getLiveSession(sessionId).removeMcpServer(name);
+	}
+	async listBackgroundTasks(sessionId, activeOnly, limit) {
+		return this.getLiveSession(sessionId).listBackgroundTasks({
+			activeOnly,
+			limit
+		});
+	}
+	async getBackgroundTaskOutput(sessionId, taskId, tail) {
+		return this.getLiveSession(sessionId).getBackgroundTaskOutput(taskId, tail !== void 0 ? { tail } : {});
+	}
+	async stopBackgroundTask(sessionId, taskId, reason) {
+		await this.getLiveSession(sessionId).stopBackgroundTask(taskId, reason !== void 0 ? { reason } : {});
+	}
+	getConfig(options) {
+		return this.harness.getConfig(options);
+	}
+	setConfig(patch) {
+		return this.harness.setConfig(patch);
+	}
+	removeProvider(providerId) {
+		return this.harness.removeProvider(providerId);
+	}
+	getExperimentalFlags() {
+		return this.harness.getExperimentalFlags();
+	}
+	preflight() {
+		return this.harness.preflight();
+	}
 };
+async function handleSessionControlRoutes(req, res, url, method, manager) {
+	const statusMatch = new RegExp(`^${API_PREFIX}/sessions/([^/]+)/status$`).exec(url);
+	if (statusMatch && method === "GET") {
+		try {
+			sendJson(res, 200, await manager.getSessionStatus(decodeURIComponent(statusMatch[1])));
+		} catch (error) {
+			sendHttpError(res, error);
+		}
+		return true;
+	}
+	const usageMatch = new RegExp(`^${API_PREFIX}/sessions/([^/]+)/usage$`).exec(url);
+	if (usageMatch && method === "GET") {
+		try {
+			sendJson(res, 200, await manager.getSessionUsage(decodeURIComponent(usageMatch[1])));
+		} catch (error) {
+			sendHttpError(res, error);
+		}
+		return true;
+	}
+	const contextMatch = new RegExp(`^${API_PREFIX}/sessions/([^/]+)/context$`).exec(url);
+	if (contextMatch && method === "GET") {
+		try {
+			sendJson(res, 200, await manager.getSessionContext(decodeURIComponent(contextMatch[1])));
+		} catch (error) {
+			sendHttpError(res, error);
+		}
+		return true;
+	}
+	const planMatch = new RegExp(`^${API_PREFIX}/sessions/([^/]+)/plan$`).exec(url);
+	if (planMatch && method === "GET") {
+		try {
+			sendJson(res, 200, await manager.getSessionPlan(decodeURIComponent(planMatch[1])));
+		} catch (error) {
+			sendHttpError(res, error);
+		}
+		return true;
+	}
+	const permissionMatch = new RegExp(`^${API_PREFIX}/sessions/([^/]+)/permission$`).exec(url);
+	if (permissionMatch && method === "POST") {
+		try {
+			const mode = requiredString(await readJsonBody(req), "mode");
+			await manager.setPermission(decodeURIComponent(permissionMatch[1]), mode);
+			sendJson(res, 200, { ok: true });
+		} catch (error) {
+			sendHttpError(res, error);
+		}
+		return true;
+	}
+	const planModeMatch = new RegExp(`^${API_PREFIX}/sessions/([^/]+)/plan$`).exec(url);
+	if (planModeMatch && method === "POST") {
+		try {
+			const body = await readJsonBody(req);
+			const enabled = optionalBoolean(body, "enabled", true);
+			const strategy = optionalString(body, "strategy");
+			await manager.setPlanMode(decodeURIComponent(planModeMatch[1]), enabled, strategy);
+			sendJson(res, 200, { ok: true });
+		} catch (error) {
+			sendHttpError(res, error);
+		}
+		return true;
+	}
+	const clearPlanMatch = new RegExp(`^${API_PREFIX}/sessions/([^/]+)/plan/clear$`).exec(url);
+	if (clearPlanMatch && method === "POST") {
+		try {
+			await manager.clearPlan(decodeURIComponent(clearPlanMatch[1]));
+			sendJson(res, 200, { ok: true });
+		} catch (error) {
+			sendHttpError(res, error);
+		}
+		return true;
+	}
+	const wolfpackMatch = new RegExp(`^${API_PREFIX}/sessions/([^/]+)/wolfpack$`).exec(url);
+	if (wolfpackMatch && method === "POST") {
+		try {
+			const enabled = optionalBoolean(await readJsonBody(req), "enabled", true);
+			await manager.setWolfpackMode(decodeURIComponent(wolfpackMatch[1]), enabled);
+			sendJson(res, 200, { ok: true });
+		} catch (error) {
+			sendHttpError(res, error);
+		}
+		return true;
+	}
+	const rlmMatch = new RegExp(`^${API_PREFIX}/sessions/([^/]+)/rlm$`).exec(url);
+	if (rlmMatch && method === "POST") {
+		try {
+			const body = await readJsonBody(req);
+			const enabled = optionalBoolean(body, "enabled", true);
+			const maxDepth = typeof body["maxDepth"] === "number" ? Number(body["maxDepth"]) : void 0;
+			await manager.setRlm(decodeURIComponent(rlmMatch[1]), enabled, maxDepth);
+			sendJson(res, 200, { ok: true });
+		} catch (error) {
+			sendHttpError(res, error);
+		}
+		return true;
+	}
+	const undoMatch = new RegExp(`^${API_PREFIX}/sessions/([^/]+)/undo$`).exec(url);
+	if (undoMatch && method === "POST") {
+		try {
+			const body = await readJsonBody(req);
+			const count = typeof body["count"] === "number" ? Number(body["count"]) : 1;
+			await manager.undoHistory(decodeURIComponent(undoMatch[1]), count);
+			sendJson(res, 200, { ok: true });
+		} catch (error) {
+			sendHttpError(res, error);
+		}
+		return true;
+	}
+	const compactMatch = new RegExp(`^${API_PREFIX}/sessions/([^/]+)/compact$`).exec(url);
+	if (compactMatch && method === "POST") {
+		try {
+			const body = await readJsonBody(req);
+			await manager.compact(decodeURIComponent(compactMatch[1]), optionalString(body, "instruction"));
+			sendJson(res, 200, { ok: true });
+		} catch (error) {
+			sendHttpError(res, error);
+		}
+		return true;
+	}
+	return false;
+}
+async function handleResourceRoutes(req, res, url, method, manager) {
+	const skillsMatch = new RegExp(`^${API_PREFIX}/sessions/([^/]+)/skills$`).exec(url);
+	if (skillsMatch && method === "GET") {
+		try {
+			sendJson(res, 200, await manager.listSkills(decodeURIComponent(skillsMatch[1])));
+		} catch (error) {
+			sendHttpError(res, error);
+		}
+		return true;
+	}
+	const skillActivateMatch = new RegExp(`^${API_PREFIX}/sessions/([^/]+)/skills/([^/]+)/activate$`).exec(url);
+	if (skillActivateMatch && method === "POST") {
+		try {
+			const body = await readJsonBody(req);
+			await manager.activateSkill(decodeURIComponent(skillActivateMatch[1]), decodeURIComponent(skillActivateMatch[2]), optionalString(body, "args"));
+			sendJson(res, 200, { ok: true });
+		} catch (error) {
+			sendHttpError(res, error);
+		}
+		return true;
+	}
+	const skillRemoveMatch = new RegExp(`^${API_PREFIX}/sessions/([^/]+)/skills/([^/]+)$`).exec(url);
+	if (skillRemoveMatch && method === "DELETE") {
+		try {
+			await manager.removeSkill(decodeURIComponent(skillRemoveMatch[1]), decodeURIComponent(skillRemoveMatch[2]));
+			sendJson(res, 200, { ok: true });
+		} catch (error) {
+			sendHttpError(res, error);
+		}
+		return true;
+	}
+	const pluginsMatch = new RegExp(`^${API_PREFIX}/sessions/([^/]+)/plugins$`).exec(url);
+	if (pluginsMatch && method === "GET") {
+		try {
+			sendJson(res, 200, await manager.listPlugins(decodeURIComponent(pluginsMatch[1])));
+		} catch (error) {
+			sendHttpError(res, error);
+		}
+		return true;
+	}
+	const pluginInstallMatch = new RegExp(`^${API_PREFIX}/sessions/([^/]+)/plugins/install$`).exec(url);
+	if (pluginInstallMatch && method === "POST") {
+		try {
+			const body = await readJsonBody(req);
+			sendJson(res, 200, await manager.installPlugin(decodeURIComponent(pluginInstallMatch[1]), requiredString(body, "source")));
+		} catch (error) {
+			sendHttpError(res, error);
+		}
+		return true;
+	}
+	const pluginReloadMatch = new RegExp(`^${API_PREFIX}/sessions/([^/]+)/plugins/reload$`).exec(url);
+	if (pluginReloadMatch && method === "POST") {
+		try {
+			sendJson(res, 200, await manager.reloadPlugins(decodeURIComponent(pluginReloadMatch[1])));
+		} catch (error) {
+			sendHttpError(res, error);
+		}
+		return true;
+	}
+	const pluginEnableMatch = new RegExp(`^${API_PREFIX}/sessions/([^/]+)/plugins/([^/]+)/enable$`).exec(url);
+	if (pluginEnableMatch && method === "POST") {
+		try {
+			const body = await readJsonBody(req);
+			await manager.setPluginEnabled(decodeURIComponent(pluginEnableMatch[1]), decodeURIComponent(pluginEnableMatch[2]), optionalBoolean(body, "enabled", true));
+			sendJson(res, 200, { ok: true });
+		} catch (error) {
+			sendHttpError(res, error);
+		}
+		return true;
+	}
+	const pluginMcpEnableMatch = new RegExp(`^${API_PREFIX}/sessions/([^/]+)/plugins/([^/]+)/mcp/([^/]+)/enable$`).exec(url);
+	if (pluginMcpEnableMatch && method === "POST") {
+		try {
+			const body = await readJsonBody(req);
+			await manager.setPluginMcpServerEnabled(decodeURIComponent(pluginMcpEnableMatch[1]), decodeURIComponent(pluginMcpEnableMatch[2]), decodeURIComponent(pluginMcpEnableMatch[3]), optionalBoolean(body, "enabled", true));
+			sendJson(res, 200, { ok: true });
+		} catch (error) {
+			sendHttpError(res, error);
+		}
+		return true;
+	}
+	const pluginActivateMatch = new RegExp(`^${API_PREFIX}/sessions/([^/]+)/plugins/([^/]+)/activate$`).exec(url);
+	if (pluginActivateMatch && method === "POST") {
+		try {
+			await manager.activatePlugin(decodeURIComponent(pluginActivateMatch[1]), decodeURIComponent(pluginActivateMatch[2]));
+			sendJson(res, 200, { ok: true });
+		} catch (error) {
+			sendHttpError(res, error);
+		}
+		return true;
+	}
+	const pluginDeactivateMatch = new RegExp(`^${API_PREFIX}/sessions/([^/]+)/plugins/([^/]+)/deactivate$`).exec(url);
+	if (pluginDeactivateMatch && method === "POST") {
+		try {
+			await manager.deactivatePlugin(decodeURIComponent(pluginDeactivateMatch[1]), decodeURIComponent(pluginDeactivateMatch[2]));
+			sendJson(res, 200, { ok: true });
+		} catch (error) {
+			sendHttpError(res, error);
+		}
+		return true;
+	}
+	const pluginInjectMatch = new RegExp(`^${API_PREFIX}/sessions/([^/]+)/plugins/([^/]+)/inject$`).exec(url);
+	if (pluginInjectMatch && method === "POST") {
+		try {
+			await manager.injectPlugin(decodeURIComponent(pluginInjectMatch[1]), decodeURIComponent(pluginInjectMatch[2]));
+			sendJson(res, 200, { ok: true });
+		} catch (error) {
+			sendHttpError(res, error);
+		}
+		return true;
+	}
+	const pluginInfoMatch = new RegExp(`^${API_PREFIX}/sessions/([^/]+)/plugins/(?!(?:install|reload)$)([^/]+)$`).exec(url);
+	if (pluginInfoMatch && method === "GET") {
+		try {
+			sendJson(res, 200, await manager.getPluginInfo(decodeURIComponent(pluginInfoMatch[1]), decodeURIComponent(pluginInfoMatch[2])));
+		} catch (error) {
+			sendHttpError(res, error);
+		}
+		return true;
+	}
+	if (pluginInfoMatch && method === "DELETE") {
+		try {
+			await manager.removePlugin(decodeURIComponent(pluginInfoMatch[1]), decodeURIComponent(pluginInfoMatch[2]));
+			sendJson(res, 200, { ok: true });
+		} catch (error) {
+			sendHttpError(res, error);
+		}
+		return true;
+	}
+	const mcpMatch = new RegExp(`^${API_PREFIX}/sessions/([^/]+)/mcp$`).exec(url);
+	if (mcpMatch && method === "GET") {
+		try {
+			sendJson(res, 200, await manager.listMcpServers(decodeURIComponent(mcpMatch[1])));
+		} catch (error) {
+			sendHttpError(res, error);
+		}
+		return true;
+	}
+	const mcpMetricsMatch = new RegExp(`^${API_PREFIX}/sessions/([^/]+)/mcp/startup-metrics$`).exec(url);
+	if (mcpMetricsMatch && method === "GET") {
+		try {
+			sendJson(res, 200, await manager.getMcpStartupMetrics(decodeURIComponent(mcpMetricsMatch[1])));
+		} catch (error) {
+			sendHttpError(res, error);
+		}
+		return true;
+	}
+	const mcpAddMatch = new RegExp(`^${API_PREFIX}/sessions/([^/]+)/mcp/add$`).exec(url);
+	if (mcpAddMatch && method === "POST") {
+		try {
+			const body = await readJsonBody(req);
+			await manager.addMcpServer(decodeURIComponent(mcpAddMatch[1]), requiredString(body, "name"), body["config"] ?? {});
+			sendJson(res, 200, { ok: true });
+		} catch (error) {
+			sendHttpError(res, error);
+		}
+		return true;
+	}
+	const mcpReconnectMatch = new RegExp(`^${API_PREFIX}/sessions/([^/]+)/mcp/([^/]+)/reconnect$`).exec(url);
+	if (mcpReconnectMatch && method === "POST") {
+		try {
+			await manager.reconnectMcpServer(decodeURIComponent(mcpReconnectMatch[1]), decodeURIComponent(mcpReconnectMatch[2]));
+			sendJson(res, 200, { ok: true });
+		} catch (error) {
+			sendHttpError(res, error);
+		}
+		return true;
+	}
+	const mcpStopMatch = new RegExp(`^${API_PREFIX}/sessions/([^/]+)/mcp/([^/]+)/stop$`).exec(url);
+	if (mcpStopMatch && method === "POST") {
+		try {
+			await manager.stopMcpServer(decodeURIComponent(mcpStopMatch[1]), decodeURIComponent(mcpStopMatch[2]));
+			sendJson(res, 200, { ok: true });
+		} catch (error) {
+			sendHttpError(res, error);
+		}
+		return true;
+	}
+	const mcpRemoveMatch = new RegExp(`^${API_PREFIX}/sessions/([^/]+)/mcp/(?!(?:add|reconnect|stop|startup-metrics)$)([^/]+)$`).exec(url);
+	if (mcpRemoveMatch && method === "DELETE") {
+		try {
+			await manager.removeMcpServer(decodeURIComponent(mcpRemoveMatch[1]), decodeURIComponent(mcpRemoveMatch[2]));
+			sendJson(res, 200, { ok: true });
+		} catch (error) {
+			sendHttpError(res, error);
+		}
+		return true;
+	}
+	const tasksMatch = new RegExp(`^${API_PREFIX}/sessions/([^/]+)/tasks$`).exec(url);
+	if (tasksMatch && method === "GET") {
+		try {
+			const query = new URLSearchParams(url.split("?")[1] ?? "");
+			const activeOnly = query.get("activeOnly") === "true" ? true : query.get("activeOnly") === "false" ? false : void 0;
+			const limit = query.get("limit") ? Number(query.get("limit")) : void 0;
+			sendJson(res, 200, await manager.listBackgroundTasks(decodeURIComponent(tasksMatch[1]), activeOnly, limit));
+		} catch (error) {
+			sendHttpError(res, error);
+		}
+		return true;
+	}
+	const taskOutputMatch = new RegExp(`^${API_PREFIX}/sessions/([^/]+)/tasks/([^/]+)/output$`).exec(url);
+	if (taskOutputMatch && method === "GET") {
+		try {
+			const query = new URLSearchParams(url.split("?")[1] ?? "");
+			const tail = query.get("tail") ? Number(query.get("tail")) : void 0;
+			sendJson(res, 200, { output: await manager.getBackgroundTaskOutput(decodeURIComponent(taskOutputMatch[1]), decodeURIComponent(taskOutputMatch[2]), tail) });
+		} catch (error) {
+			sendHttpError(res, error);
+		}
+		return true;
+	}
+	const taskStopMatch = new RegExp(`^${API_PREFIX}/sessions/([^/]+)/tasks/([^/]+)/stop$`).exec(url);
+	if (taskStopMatch && method === "POST") {
+		try {
+			const body = await readJsonBody(req);
+			await manager.stopBackgroundTask(decodeURIComponent(taskStopMatch[1]), decodeURIComponent(taskStopMatch[2]), optionalString(body, "reason"));
+			sendJson(res, 200, { ok: true });
+		} catch (error) {
+			sendHttpError(res, error);
+		}
+		return true;
+	}
+	return false;
+}
+async function handleGlobalRoutes(req, res, url, method, manager) {
+	if (url === `${API_PREFIX}/config` && method === "GET") {
+		try {
+			sendJson(res, 200, await manager.getConfig());
+		} catch (error) {
+			sendHttpError(res, error);
+		}
+		return true;
+	}
+	if (url === `${API_PREFIX}/config` && method === "POST") {
+		try {
+			const patch = (await readJsonBody(req))["patch"];
+			if (patch === null || typeof patch !== "object" || Array.isArray(patch)) throw new HttpError(400, "Missing or invalid patch field", "request.invalid");
+			sendJson(res, 200, await manager.setConfig(patch));
+		} catch (error) {
+			sendHttpError(res, error);
+		}
+		return true;
+	}
+	const providerMatch = new RegExp(`^${API_PREFIX}/config/providers/([^/]+)$`).exec(url);
+	if (providerMatch && method === "DELETE") {
+		try {
+			sendJson(res, 200, await manager.removeProvider(decodeURIComponent(providerMatch[1])));
+		} catch (error) {
+			sendHttpError(res, error);
+		}
+		return true;
+	}
+	if (url === `${API_PREFIX}/experimental-flags` && method === "GET") {
+		try {
+			sendJson(res, 200, await manager.getExperimentalFlags());
+		} catch (error) {
+			sendHttpError(res, error);
+		}
+		return true;
+	}
+	if (url === `${API_PREFIX}/preflight` && method === "GET") {
+		try {
+			await manager.preflight();
+			sendJson(res, 200, { ok: true });
+		} catch (error) {
+			sendHttpError(res, error);
+		}
+		return true;
+	}
+	return false;
+}
 async function runWebServer(opts) {
 	const homeDir = resolveScreamHome();
 	const workDir = opts.workDir;
@@ -16342,6 +16937,9 @@ async function runWebServer(opts) {
 			return;
 		}
 		if (await handleGoalRoute(req, res, url, (sessionId) => manager.get(sessionId))) return;
+		if (await handleSessionControlRoutes(req, res, url, method, manager)) return;
+		if (await handleResourceRoutes(req, res, url, method, manager)) return;
+		if (await handleGlobalRoutes(req, res, url, method, manager)) return;
 		const snapshotMatch = new RegExp(`^${API_PREFIX}/sessions/([^/]+)/snapshot(\\?|$)`).exec(url);
 		if (snapshotMatch && method === "GET") {
 			const sessionId = decodeURIComponent(snapshotMatch[1]);