insika 0.0.1 → 0.2.0

data/lib/insika/studio/views/settings.erb

@@ -0,0 +1,168 @@
+<%# Settings — drill-down (T2): section list | selected section's form(s).
+   @section (general|models|llm) comes from ?s= and drives the detail. %>
+<% sections = [
+     ["general", "General", "streaming, timeouts"],
+     ["models",  "Model defaults", "platform model layer (Chat › Agent › platform)"],
+     ["edge",    "Edge limits", "rate-limit per chat, token ceiling per agent"],
+     ["evals",   "Evals", "who grades a rubric, and how a panel agrees"],
+     ["llm",     "LLM providers", "keys, base URL, models per provider"]
+   ] %>
+<div class="drill">
+  <aside class="drill-pane drill-master">
+    <div class="drill-pane-head"><div class="title"><strong>Settings</strong></div></div>
+    <nav class="drill-pane-body drill-list" aria-label="settings sections">
+      <% sections.each do |key, label, sub| %>
+        <a class="drill-item<%== ' active' if @section == key %>" href="/studio/settings?s=<%= key %>">
+          <div class="drill-item-name"><span class="txt"><%= label %></span><% if key == "llm" %><span class="pill info plain"><%= @providers.size %></span><% end %></div>
+          <div class="drill-item-sub"><%= sub %></div>
+        </a>
+      <% end %>
+    </nav>
+  </aside>
+
+  <section class="drill-pane drill-detail">
+    <% if @section == "general" %>
+      <div class="drill-pane-head">
+        <div class="title"><strong>General</strong></div>
+        <button type="submit" form="set-general" class="btn primary" data-turbo-submits-with="Saving…">Save</button>
+      </div>
+      <div class="drill-pane-body">
+        <p class="muted">Streaming and timeouts — saved via <code>update_settings</code> (durable, applies next turn).</p>
+        <form id="set-general" method="post" action="/studio/settings">
+          <%== csrf_tag %>
+          <label class="check">
+            <input type="checkbox" name="streaming" value="1"<%== " checked" if @settings["streaming"] %>>
+            stream model responses
+          </label>
+          <div class="grid-2">
+            <label>request_timeout (s)<input type="text" name="request_timeout" value="<%= @settings["request_timeout"] %>" inputmode="numeric"></label>
+            <label>max_retries<input type="text" name="max_retries" value="<%= @settings["max_retries"] %>" inputmode="numeric"></label>
+            <label>turn_timeout (s)<input type="text" name="turn_timeout" value="<%= @settings["turn_timeout"] %>" inputmode="numeric"></label>
+            <label>tool_timeout (s)<input type="text" name="tool_timeout" value="<%= @settings["tool_timeout"] %>" inputmode="numeric"></label>
+          </div>
+        </form>
+      </div>
+
+    <% elsif @section == "models" %>
+      <div class="drill-pane-head">
+        <div class="title"><strong>Model defaults</strong></div>
+        <button type="submit" form="set-models" class="btn primary" data-turbo-submits-with="Saving…">Save</button>
+      </div>
+      <div class="drill-pane-body">
+        <p class="muted">The platform model layer, resolved at turn start as <strong>Chat pin › Agent model › platform default</strong>. An agent with no model of its own inherits <code>default_model</code>.</p>
+        <form id="set-models" method="post" action="/studio/settings/models">
+          <%== csrf_tag %>
+          <div class="grid-2">
+            <label>default_model <span class="muted">(agents without their own model)</span><input type="text" name="default_model" value="<%= @settings["default_model"] %>" placeholder="deepseek-v4-flash"></label>
+            <label>default_provider <span class="muted">(optional)</span><input type="text" name="default_provider" value="<%= @settings["default_provider"] %>" placeholder="deepseek"></label>
+          </div>
+          <label>fallback_models <span class="muted">(ordered chain; <code>provider/model</code> or <code>model</code>, comma or newline)</span><input type="text" name="fallback_models" value="<%= Array(@settings["fallback_models"]).join(", ") %>" placeholder="deepseek/deepseek-v4-flash, openai/gpt-4o-mini"></label>
+          <label>utility_model <span class="muted">(cheap internal tasks — titles, distillation)</span><input type="text" name="utility_model" value="<%= @settings["utility_model"] %>" placeholder="deepseek-v4-flash"></label>
+          <label>reasoning <span class="muted">(global default — off/on/effort; blank = provider default)</span>
+            <%== thinking_select("thinking", @settings["thinking"], "provider default") %>
+          </label>
+        </form>
+
+        <hr>
+        <p class="muted">Per-model reasoning defaults — the layer between global and agent (resolved <strong>Chat › Agent › Model › Global</strong>). One per line.</p>
+        <form id="set-model-params" method="post" action="/studio/settings/model-params">
+          <%== csrf_tag %>
+          <label>model_params <span class="muted">(one per line: <code>provider/model | off|on|low|medium|high</code>)</span>
+            <textarea name="model_params" rows="4" placeholder="deepseek/deepseek-v4-flash | off"><%= model_params_text(@settings["model_params"]) %></textarea>
+          </label>
+          <div class="actions"><button type="submit" class="btn primary" data-turbo-submits-with="Saving…">Save per-model</button></div>
+        </form>
+      </div>
+
+    <% elsif @section == "edge" %>
+      <div class="drill-pane-head">
+        <div class="title"><strong>Edge limits</strong></div>
+        <button type="submit" form="set-edge" class="btn primary" data-turbo-submits-with="Saving…">Save</button>
+      </div>
+      <div class="drill-pane-body">
+        <p class="muted">The named place where volume/cost abuse is cut, <strong>before any LLM spend</strong>. Blank/0 = off (opt-in). A breached turn completes gracefully with the safe reply below. Per-agent overrides live in each agent's config.</p>
+        <form id="set-edge" method="post" action="/studio/settings/edge">
+          <%== csrf_tag %>
+          <div class="grid-2">
+            <label>chat_rate_limit <span class="muted">(turn attempts per chat per window)</span><input type="text" name="chat_rate_limit" value="<%= @settings.dig("edge", "chat_rate_limit") %>" inputmode="numeric" placeholder="off"></label>
+            <label>chat_rate_window (s)<input type="text" name="chat_rate_window" value="<%= @settings.dig("edge", "chat_rate_window") %>" inputmode="numeric" placeholder="60"></label>
+            <label>agent_token_ceiling <span class="muted">(total tokens per agent per window)</span><input type="text" name="agent_token_ceiling" value="<%= @settings.dig("edge", "agent_token_ceiling") %>" inputmode="numeric" placeholder="off"></label>
+            <label>agent_token_window (s)<input type="text" name="agent_token_window" value="<%= @settings.dig("edge", "agent_token_window") %>" inputmode="numeric" placeholder="86400"></label>
+          </div>
+          <label>limit_response <span class="muted">(safe reply on breach; blank = neutral built-in)</span><input type="text" name="limit_response" value="<%= @settings.dig("edge", "limit_response") %>" placeholder="Estou recebendo muitas mensagens agora…"></label>
+        </form>
+      </div>
+
+<% elsif @section == "evals" %>
+  <div class="drill-pane-head">
+    <div class="title"><strong>Evals</strong></div>
+    <button type="submit" form="set-evals" class="btn primary" data-turbo-submits-with="Saving…">Save</button>
+  </div>
+  <div class="drill-pane-body">
+    <p class="muted">Who grades a <a href="/studio/evals">case</a>'s rubric. <strong>One model per line</strong> as <code>provider/model</code> — several lines make a PANEL, and two different models disagreeing is the signal worth having (sampling one model N times mostly measures its own variance). Empty = deterministic assertions only, and rubric'd cases read as <code>judge_pending</code>.</p>
+    <form id="set-evals" method="post" action="/studio/settings/evals">
+      <%== csrf_tag %>
+      <label>judges<textarea name="judges" rows="4" spellcheck="false" placeholder="deepseek/deepseek-v4-flash&#10;openai/gpt-5-mini"><%= Array(@settings.dig("evals", "judges")).map { |j| [j["provider"], j["model"]].compact.reject(&:empty?).join("/") }.join("\n") %></textarea></label>
+      <div class="grid-2">
+        <label>aggregate <span class="muted">(how the panel's scores combine)</span>
+          <select name="aggregate">
+            <% %w[median mean min].each do |k| %>
+              <option value="<%= k %>"<%== ' selected' if @settings.dig("evals", "aggregate") == k %>><%= k %></option>
+            <% end %>
+          </select>
+        </label>
+        <label>min_agreement <span class="muted">(fraction that must pass; 1.0 = unanimous)</span><input type="text" name="min_agreement" value="<%= @settings.dig("evals", "min_agreement") %>" inputmode="decimal" placeholder="0.5"></label>
+        <label>quorum <span class="muted">(samples per judge)</span><input type="text" name="quorum" value="<%= @settings.dig("evals", "quorum") %>" inputmode="numeric" placeholder="1"></label>
+        <label>tolerance <span class="muted">(max score drop before it's a regression)</span><input type="text" name="tolerance" value="<%= @settings.dig("evals", "tolerance") %>" inputmode="decimal" placeholder="0.05"></label>
+      </div>
+    </form>
+  </div>
+
+    <% else %>
+      <div class="drill-pane-head">
+        <div class="title"><strong>LLM providers <span class="count"><%= @providers.size %></span></strong></div>
+      </div>
+      <div class="drill-pane-body">
+        <p class="muted">Key/base/models per provider. The <code>api_key</code> never returns in plaintext — the field shows <code><%= secret_sentinel %></code> when a key is saved; resubmitting untouched preserves it, clearing removes it. Applied at runtime (no restart).</p>
+        <% @providers.each do |p| %>
+          <div class="card promptfile">
+            <div class="promptfile-head">
+              <strong class="mono"><%= p["api"] %></strong>
+              <form method="post" action="/studio/settings/providers/delete" data-turbo-confirm="Remove provider &quot;<%= p["api"] %>&quot;?">
+                <%== csrf_tag %>
+                <input type="hidden" name="api" value="<%= p["api"] %>">
+                <button type="submit" class="ghost danger" data-turbo-submits-with="Removing…">Remove</button>
+              </form>
+            </div>
+            <form method="post" action="/studio/settings/providers">
+              <%== csrf_tag %>
+              <input type="hidden" name="api" value="<%= p["api"] %>">
+              <div class="grid-2">
+                <label>base_url<input type="text" name="base_url" value="<%= p["base_url"] %>" placeholder="https://api.deepseek.com/v1"></label>
+                <label>auth_header<input type="text" name="auth_header" value="<%= p["auth_header"] %>" placeholder="Authorization"></label>
+              </div>
+              <label>api_key<input type="password" name="api_key" value="<%= p["api_key"] %>" autocomplete="off"></label>
+              <label>models <span class="muted">(comma or newline)</span><input type="text" name="models" value="<%= Array(p["models"]).join(", ") %>" placeholder="deepseek-v4-flash, deepseek-reasoner"></label>
+              <div class="actions"><button type="submit" class="primary" data-turbo-submits-with="Saving…">Save provider</button></div>
+            </form>
+          </div>
+        <% end %>
+
+        <details class="card newfile"<%== " open" if @providers.empty? %>>
+          <summary>+ new provider</summary>
+          <form method="post" action="/studio/settings/providers">
+            <%== csrf_tag %>
+            <div class="grid-2">
+              <label>api <span class="muted">(slug, e.g. deepseek)</span><input type="text" name="api" placeholder="openai" required></label>
+              <label>base_url<input type="text" name="base_url" placeholder="https://api.openai.com/v1"></label>
+            </div>
+            <label>auth_header<input type="text" name="auth_header" placeholder="Authorization"></label>
+            <label>api_key<input type="password" name="api_key" autocomplete="off" placeholder="sk-…"></label>
+            <label>models <span class="muted">(comma or newline)</span><input type="text" name="models" placeholder="gpt-4o, gpt-4o-mini"></label>
+            <div class="actions"><button type="submit" class="primary" data-turbo-submits-with="Creating…">Create provider</button></div>
+          </form>
+        </details>
+      </div>
+    <% end %>
+  </section>
+</div>

data/lib/insika/studio/views/skills.erb

@@ -0,0 +1,141 @@
+<%# Skills — drill-down (T2): master list | detail editor + availability.
+   Every skill route renders THIS view (index / new / :name); @selected drives
+   which skill is open (nil = none, "" = new). @scope_agent set = editing THAT
+   agent's own version of the skill, not the shared one. %>
+<% scope = @scope_agent %>
+<% form_action = scope ? "/studio/agents/#{Rack::Utils.escape(scope)}/skills/#{Rack::Utils.escape(@selected.to_s)}" : "/studio/skills" %>
+<div class="drill" data-controller="list-filter">
+  <aside class="drill-pane drill-master">
+    <div class="drill-pane-head">
+      <div class="title"><strong>Skills <span class="count"><%= @skills.size %></span></strong></div>
+      <a class="btn primary btn-sm" href="/studio/skills/new">+ new</a>
+    </div>
+    <div class="drill-search">
+      <input type="search" class="filter-input" placeholder="Search skills…" aria-label="Filter skills"
+             data-list-filter-target="query" data-action="input->list-filter#filter keydown->list-filter#clear">
+    </div>
+    <nav class="drill-pane-body drill-list" aria-label="skills">
+      <% @skills.each do |s| %>
+        <a class="drill-item<%== ' active' if @selected == s.name %>"
+           href="/studio/skills/<%= Rack::Utils.escape(s.name) %>"
+           data-list-filter-target="item" data-filter-text="<%= s.name %> <%= s.description %>">
+          <div class="drill-item-name"><span class="txt"><%= s.name %></span><% if @stored.include?(s.name) %><span class="pill info">authored</span><% end %></div>
+          <div class="drill-item-sub"><%= s.description %></div>
+        </a>
+      <% end %>
+      <div class="empty" data-list-filter-target="empty" hidden>No skills match your filter.</div>
+    </nav>
+  </aside>
+
+  <section class="drill-pane drill-detail">
+    <% if @selected.nil? %>
+      <div class="drill-empty">
+        <div>
+          <h2>Skills</h2>
+          <p>Pick a skill on the left to edit its <code>SKILL.md</code> and choose which agents can <code>load_skill</code> it — or create a new one.</p>
+        </div>
+      </div>
+    <% else %>
+      <% new = @selected == "" %>
+      <div class="drill-pane-head">
+        <div class="title">
+          <nav class="crumbs"><a href="/studio/skills">skills</a> / <span><%= new ? "new" : @selected %></span><% if scope %> / <span>for <%= scope %></span><% end %></nav>
+          <strong class="mono"><%= new ? "New skill" : @selected %><% if scope %> <span class="pill warn">specialized for <%= scope %></span><% end %></strong>
+        </div>
+        <button type="submit" form="skill-form" class="btn primary" data-turbo-submits-with="Saving…">Save skill</button>
+      </div>
+      <div class="drill-pane-body">
+        <%# The specialization is one MORE record, not a fork: the name stays the bare
+            shared name everywhere the model and the operator see it, and deleting the
+            override falls back to the shared body. %>
+        <% if scope %>
+          <div class="drill-section">
+            <p class="muted">This is <strong><%= scope %></strong>'s own version of <code><%= @selected %></code>. Every
+              other agent keeps the <a href="/studio/skills/<%= Rack::Utils.escape(@selected.to_s) %>">shared skill</a>,
+              and the name does not change — the allowlist, <code>&lt;available_skills&gt;</code> and
+              <code>load_skill</code> all still say <code><%= @selected %></code>.</p>
+            <form method="post" action="/studio/agents/<%= Rack::Utils.escape(scope) %>/skills/<%= Rack::Utils.escape(@selected.to_s) %>/delete">
+              <%== csrf_tag %>
+              <div class="actions"><button type="submit" data-turbo-confirm="Remove this specialization? <%= scope %> falls back to the shared skill.">Stop specializing</button></div>
+            </form>
+          </div>
+        <% end %>
+        <form id="skill-form" method="post" action="<%= form_action %>" data-controller="dirty-guard">
+          <%== csrf_tag %>
+          <% if !new && !scope %><input type="hidden" name="name" value="<%= @selected %>"><% end %>
+          <% if new %>
+            <label>name <span class="muted">(canonical — same as <code>name:</code> in the frontmatter)</span>
+              <input type="text" name="name" placeholder="my-skill" required>
+            </label>
+          <% end %>
+          <label>SKILL.md <span class="muted">YAML frontmatter (<code>name</code>, <code>description</code>) + body</span></label>
+          <div data-controller="code-editor" data-code-editor-language-value="markdown" data-code-editor-preview-value="true">
+            <textarea name="content" data-code-editor-target="source" rows="18"><%= @skill_content %></textarea>
+          </div>
+        </form>
+
+        <% if !new && !scope %>
+          <div class="drill-section">
+            <div class="drill-section-head">
+              <h3>Availability</h3>
+              <span class="muted">per agent: <strong>allowed</strong> = can <code>load_skill</code> it; <strong>always on</strong> = the body
+                is in the prompt every turn. Both are the AGENT's decision, so one shared skill can be
+                always-on for one and discretionary for another. An "all" allowlist is left untouched.</span>
+            </div>
+            <form method="post" action="/studio/skills/<%= Rack::Utils.escape(@selected) %>/agents">
+              <%== csrf_tag %>
+              <% if @agents.empty? %>
+                <p class="muted">No agents configured.</p>
+              <% else %>
+                <div class="check-grid agent-grid">
+                  <% @agents.each do |a| %>
+                    <% own = Array((@specialized || {})[@selected]).include?(a.id) %>
+                    <div class="agent-check">
+                      <div class="agent-check-name">
+                        <span class="mono"><%= a.id %></span>
+                        <% if own %>
+                          <a class="pill warn" href="/studio/agents/<%= Rack::Utils.escape(a.id) %>/skills/<%= Rack::Utils.escape(@selected) %>">own version</a>
+                        <% end %>
+                      </div>
+                      <label class="check tool-check">
+                        <input type="checkbox" name="agent_ids[]" value="<%= a.id %>"<%== " checked" if skill_enabled_for?(a, @selected) %>>
+                        <span class="mono">allowed</span>
+                      </label>
+                      <label class="check tool-check">
+                        <input type="checkbox" name="eager_ids[]" value="<%= a.id %>"<%== " checked" if skill_eager_for?(a, @selected) %>>
+                        <span class="mono">always on</span>
+                      </label>
+                    </div>
+                  <% end %>
+                </div>
+                <div class="actions"><button type="submit" class="primary" data-turbo-submits-with="Applying…">Apply to agents</button></div>
+              <% end %>
+            </form>
+          </div>
+
+          <%# Specializing is what keeps a shared skill shared: without it the only way
+              to give one agent a different version was to fork it under a new name and
+              edit the allowlist, which throws the sharing away. %>
+          <% others = @agents.reject { |a| Array((@specialized || {})[@selected]).include?(a.id) } %>
+          <% if others.any? %>
+            <div class="drill-section">
+              <div class="drill-section-head">
+                <h3>Specialize</h3>
+                <span class="muted">give ONE agent its own version of this skill, seeded from the body above — same name, no fork</span>
+              </div>
+              <form method="post" action="/studio/skills/<%= Rack::Utils.escape(@selected) %>/specialize">
+                <%== csrf_tag %>
+                <label>agent
+                  <select name="agent_id" required>
+                    <% others.each do |a| %><option value="<%= a.id %>"><%= a.id %></option><% end %>
+                  </select>
+                </label>
+                <div class="actions"><button type="submit" data-turbo-submits-with="Creating…">Specialize for this agent</button></div>
+              </form>
+            </div>
+          <% end %>
+        <% end %>
+      </div>
+    <% end %>
+  </section>
+</div>

data/lib/insika/studio/views/system_files.erb

@@ -0,0 +1,65 @@
+<header class="page-head">
+  <div>
+    <nav class="crumbs"><a href="/studio/agents">agents</a> / <span>system files</span></nav>
+    <h1>System files<span class="sub"><%= @system_files.size %> file(s) · apply to every agent</span></h1>
+  </div>
+</header>
+
+<p class="muted matrix-hint">GLOBAL prompts/rules: the runtime injects these files <strong>before</strong> each BIA's own identity, every turn. Store-backed and versioned (like per-agent prompts). Empty = no global injection (the prompt stays exactly as before).</p>
+
+<% if @system_files.empty? %>
+  <div class="empty">No system files. Create one below (e.g. <code>HOUSE_RULES.md</code>) for a rule that applies to every agent.</div>
+<% end %>
+
+<% @system_files.each do |sf| %>
+  <div class="card promptfile">
+    <div class="promptfile-head">
+      <strong class="mono"><%= sf[:name] %></strong>
+      <form method="post" action="/studio/system-files/delete" data-turbo-confirm="Remove system file &quot;<%= sf[:name] %>&quot;? This can't be undone.">
+        <%== csrf_tag %>
+        <input type="hidden" name="file" value="<%= sf[:name] %>">
+        <button type="submit" class="ghost danger" data-turbo-submits-with="Removing…">Remove</button>
+      </form>
+    </div>
+    <form method="post" action="/studio/system-files" data-controller="dirty-guard">
+      <%== csrf_tag %>
+      <input type="hidden" name="file" value="<%= sf[:name] %>">
+      <div data-controller="code-editor" data-code-editor-language-value="markdown">
+        <textarea name="content" data-code-editor-target="source" rows="10"><%= sf[:content] %></textarea>
+      </div>
+      <div class="actions"><button type="submit" class="primary" data-turbo-submits-with="Saving…">Save file</button></div>
+    </form>
+    <% unless sf[:versions].empty? %>
+      <details class="versions">
+        <summary><%= sf[:versions].size %> previous version(s)</summary>
+        <ul>
+          <% sf[:versions].each_with_index do |v, i| %>
+            <li>
+              <span class="muted mono"><%= v["at"] %></span>
+              <form method="post" action="/studio/system-files/restore">
+                <%== csrf_tag %>
+                <input type="hidden" name="file" value="<%= sf[:name] %>">
+                <input type="hidden" name="version" value="<%= i %>">
+                <button type="submit" class="ghost">Restore</button>
+              </form>
+            </li>
+          <% end %>
+        </ul>
+      </details>
+    <% end %>
+  </div>
+<% end %>
+
+<details class="card newfile">
+  <summary>+ new system file</summary>
+  <form method="post" action="/studio/system-files" data-controller="dirty-guard">
+    <%== csrf_tag %>
+    <label>file name
+      <input type="text" name="file" placeholder="HOUSE_RULES.md" required>
+    </label>
+    <div data-controller="code-editor" data-code-editor-language-value="markdown">
+      <textarea name="content" data-code-editor-target="source" rows="8" placeholder="# House rules&#10;Every agent must..."></textarea>
+    </div>
+    <div class="actions"><button type="submit" class="primary" data-turbo-submits-with="Creating…">Create file</button></div>
+  </form>
+</details>

data/lib/insika/studio/views/task.erb

@@ -0,0 +1,105 @@
+<header class="page-head">
+  <div>
+    <nav class="crumbs"><a href="/studio/tasks">tasks</a> / <span>task</span></nav>
+    <h1>Task
+      <span class="copy-id" data-controller="clipboard" data-clipboard-text-value="<%= @task.id %>">
+        <span class="mono"><%= @task.id[0, 16] %></span>
+        <button type="button" class="copy-btn" data-clipboard-target="button" data-action="clipboard#copy" aria-label="Copy full task id">copy id</button>
+      </span>
+      <span class="sub">status <%= @task.status %> · updated <%= @task.updated_at %></span>
+    </h1>
+  </div>
+</header>
+
+<div class="card">
+  <div class="actions">
+    <span class="pill <%= status_class(@task.status) %>"><%= @task.status %></span>
+    <% if @task.session_id %>
+      <span class="muted">session <a class="mono" href="/studio/sessions/<%= Rack::Utils.escape(@task.session_id) %>"><%= @task.session_id[0, 12] %></a></span>
+    <% end %>
+    <form method="post" action="<%= task_path(@task.id) %>/pause">
+      <%== csrf_tag %>
+      <button type="submit">Pause</button>
+    </form>
+    <form method="post" action="<%= task_path(@task.id) %>/resume">
+      <%== csrf_tag %>
+      <button type="submit" class="primary">Resume</button>
+    </form>
+    <form method="post" action="<%= task_path(@task.id) %>/cancel"
+          data-turbo-confirm="Cancel this task? In-flight work stops and it can't be resumed.">
+      <%== csrf_tag %>
+      <button type="submit" class="danger">Cancel</button>
+    </form>
+  </div>
+</div>
+
+<% unless Array(@pending).empty? %>
+  <section class="section">
+    <div class="section-head"><h2>Pending approvals</h2></div>
+    <% @pending.each do |pa| %>
+      <div class="card">
+        <div class="skill-name mono"><%= pa.tool %></div>
+        <div class="skill-desc muted">turn <%= pa.turn %> · requested <%= pa.requested_at %></div>
+        <pre><%= message_content(pa.args) %></pre>
+        <div class="actions">
+          <form method="post" action="/studio/approvals/<%= Rack::Utils.escape(pa.id) %>">
+            <%== csrf_tag %>
+            <input type="hidden" name="decision" value="approved">
+            <input type="hidden" name="back" value="<%= task_path(@task.id) %>">
+            <button type="submit" class="primary">Approve</button>
+          </form>
+          <form method="post" action="/studio/approvals/<%= Rack::Utils.escape(pa.id) %>"
+                data-turbo-confirm="Reject this action? The turn resumes as if the tool was denied.">
+            <%== csrf_tag %>
+            <input type="hidden" name="decision" value="rejected">
+            <input type="hidden" name="back" value="<%= task_path(@task.id) %>">
+            <button type="submit" class="danger">Reject</button>
+          </form>
+        </div>
+      </div>
+    <% end %>
+  </section>
+<% end %>
+
+<section class="section">
+  <div class="section-head"><h2>Command</h2></div>
+  <div class="card"><pre><%= message_content(@task.command) %></pre></div>
+</section>
+
+<section class="section">
+  <div class="section-head"><h2>Executions <span class="muted">· <%= Array(@task.executions).size %></span></h2></div>
+  <% if Array(@task.executions).empty? %>
+    <div class="empty">No executions yet.</div>
+  <% else %>
+    <div class="card">
+      <ul class="kv">
+        <% @task.executions.each do |e| %>
+          <li>
+            <span class="k mono">#<%= e.attempt %></span>
+            <span class="v">
+              <span class="pill <%= status_class(e.outcome) %>"><%= e.outcome || "—" %></span>
+              <span class="muted mono"><%= e.started_at %> → <%= e.finished_at || "…" %></span>
+              <% if e.error %><pre><%= e.error %></pre><% end %>
+            </span>
+          </li>
+        <% end %>
+      </ul>
+    </div>
+  <% end %>
+</section>
+
+<section class="section">
+  <div class="section-head"><h2>Latest checkpoint</h2></div>
+  <% if @checkpoint.nil? %>
+    <div class="empty">No checkpoint recorded.</div>
+  <% else %>
+    <div class="card">
+      <ul class="kv">
+        <li><span class="k">turn</span><span class="v mono"><%= @checkpoint.turn %></span></li>
+        <li><span class="k">messages</span><span class="v mono"><%= Array(@checkpoint.messages).size %></span></li>
+        <li><span class="k">side effects</span><span class="v mono"><%= Array(@checkpoint.completed_side_effects).size %></span></li>
+        <li><span class="k">created</span><span class="v mono"><%= @checkpoint.created_at %></span></li>
+      </ul>
+    </div>
+  <% end %>
+</section>

data/lib/insika/studio/views/tasks.erb

@@ -0,0 +1,33 @@
+<header class="page-head">
+  <div>
+    <nav class="crumbs"><span>tasks</span></nav>
+    <h1>Tasks<span class="sub"><%= @tasks.size %> task(s)</span></h1>
+  </div>
+  <a class="btn" href="/studio/approvals">Approvals →</a>
+</header>
+
+<% if @tasks.empty? %>
+  <div class="empty">No tasks yet. A task is born when an agent runs a turn.</div>
+<% else %>
+  <div data-controller="list-filter">
+    <div class="filter-bar">
+      <input type="search" class="filter-input" placeholder="Filter tasks by id, status or session…" aria-label="Filter tasks"
+             data-list-filter-target="query" data-action="input->list-filter#filter keydown->list-filter#clear">
+      <span class="filter-count mono muted" data-list-filter-target="count"></span>
+    </div>
+    <div class="card">
+      <ul class="history">
+        <% @tasks.each do |t| %>
+          <li data-list-filter-target="item" data-filter-text="<%= t.id %> <%= t.status %> <%= t.session_id %>">
+            <a href="<%= task_path(t.id) %>"><span class="mono"><%= t.id[0, 12] %></span></a>
+            <span class="pill <%= status_class(t.status) %>"><%= t.status %></span>
+            <span class="preview muted">
+              <% if t.session_id %>session <span class="mono"><%= t.session_id[0, 12] %></span> · <% end %><%= Array(t.executions).size %> execution(s) · updated <%= t.updated_at %>
+            </span>
+          </li>
+        <% end %>
+      </ul>
+    </div>
+    <div class="empty" data-list-filter-target="empty" hidden>No tasks match your filter.</div>
+  </div>
+<% end %>

data/lib/insika/studio/views/tool_edit.erb

@@ -0,0 +1,107 @@
+<% new = @tool_name.empty? %>
+<header class="page-head">
+  <div>
+    <nav class="crumbs"><a href="/studio/tools">tools</a> / <span><%= new ? "new (data tool)" : @tool_name %></span></nav>
+    <h1><%= new ? "New data tool" : @tool_name %><span class="sub">an HTTP call described by data — no code</span></h1>
+  </div>
+</header>
+
+<p class="muted matrix-hint">The tool makes an HTTP request when the model calls it. Use <code>{{param}}</code> in any field (url, query, headers, body) to insert arguments — https only, private destinations are blocked. Credential headers listed in <strong>secret_headers</strong> never return in plaintext: they appear as <code><%= secret_sentinel %></code> (keeping it preserves the secret).</p>
+
+<form class="card" method="post" action="<%= new ? "/studio/tools/def" : "/studio/tools/def/#{Rack::Utils.escape(@tool_name)}" %>" data-controller="dirty-guard">
+  <%== csrf_tag %>
+
+  <div class="grid-2">
+    <label>name <span class="muted">(identifier for the model, <code>[a-z0-9_]</code>)</span>
+      <% if new %>
+        <input type="text" name="name" value="<%= @form[:name] %>" placeholder="lookup_zip" required>
+      <% else %>
+        <input type="text" name="name" value="<%= @tool_name %>" readonly>
+      <% end %>
+    </label>
+    <label>method
+      <select name="method">
+        <% %w[GET HEAD POST PUT PATCH DELETE].each do |m| %>
+          <option value="<%= m %>"<%== " selected" if @form[:method] == m %>><%= m %></option>
+        <% end %>
+      </select>
+    </label>
+  </div>
+
+  <label>description <span class="muted">(the model reads this to decide when to use it)</span>
+    <input type="text" name="description" value="<%= @form[:description] %>" placeholder="Look up a ZIP code and return the city" required>
+  </label>
+
+  <label>url <span class="muted">(https; use <code>{{param}}</code>)</span>
+    <input type="text" name="url" value="<%= @form[:url] %>" placeholder="https://viacep.com.br/ws/{{cep}}/json" required>
+  </label>
+
+  <label>parameters <span class="muted">(one per line: <code>name | type | required|optional | description</code> — type is <code>string</code>/<code>number</code>/<code>integer</code>/<code>boolean</code> or <code>array:string</code>. For a list of objects or a nested object, paste a full <strong>JSON Schema</strong> instead: any text starting with <code>{</code> is read as one.)</span>
+    <textarea name="parameters" rows="6" placeholder="cep | string | required | The ZIP code to look up"><%= @form[:parameters] %></textarea>
+  </label>
+
+  <div class="grid-2">
+    <label>query <span class="muted">(one <code>key=value</code> per line)</span>
+      <textarea name="query" rows="3" placeholder="term={{q}}"><%= @form[:query] %></textarea>
+    </label>
+    <label>headers <span class="muted">(one <code>Key=value</code> per line)</span>
+      <textarea name="headers" rows="3" placeholder="Authorization=Bearer {{token}}"><%= @form[:headers] %></textarea>
+    </label>
+  </div>
+
+  <label>secret_headers <span class="muted">(header names to mask, comma-separated)</span>
+    <input type="text" name="secret_headers" value="<%= @form[:secret_headers] %>" placeholder="Authorization">
+  </label>
+
+  <label>body <span class="muted">(template; a <code>{{param}}</code> string is JSON-escaped)</span>
+    <div data-controller="code-editor" data-code-editor-language-value="json">
+      <textarea name="body" data-code-editor-target="source" rows="6"><%= @form[:body] %></textarea>
+    </div>
+  </label>
+
+  <div class="grid-2">
+    <label>response
+      <select name="extract">
+        <% [["body_raw", "raw body"], ["json_path", "JSON field"], ["status", "status only"]].each do |v, lbl| %>
+          <option value="<%= v %>"<%== " selected" if @form[:extract] == v %>><%= lbl %></option>
+        <% end %>
+      </select>
+    </label>
+    <label>json_path <span class="muted">(e.g. <code>localidade</code> or <code>a.b.c</code>)</span>
+      <input type="text" name="path" value="<%= @form[:path] %>" placeholder="localidade">
+    </label>
+  </div>
+
+  <label>timeout <span class="muted">(seconds, optional)</span>
+    <input type="number" name="timeout" value="<%= @form[:timeout] %>" min="1" placeholder="30">
+  </label>
+
+  <div class="actions">
+    <button type="submit" class="primary" data-turbo-submits-with="<%= new ? "Creating…" : "Saving…" %>"><%= new ? "Create tool" : "Save tool" %></button>
+    <a class="btn ghost" href="/studio/tools">← back</a>
+  </div>
+</form>
+
+<% unless new %>
+  <form class="card" method="post" action="/studio/tools/def/<%= Rack::Utils.escape(@tool_name) %>/delete" data-turbo-confirm="Remove tool &quot;<%= @tool_name %>&quot;? Agents stop seeing it next turn.">
+    <%== csrf_tag %>
+    <div class="promptfile-head">
+      <span class="muted">Remove this tool (agents stop seeing it next turn)</span>
+      <button type="submit" class="ghost danger" data-turbo-submits-with="Removing…">Remove tool</button>
+    </div>
+  </form>
+
+  <% if @versions.any? %>
+    <div class="card">
+      <h2 class="eyebrow">versions</h2>
+      <% @versions.each_with_index do |v, i| %>
+        <form class="promptfile-head" method="post" action="/studio/tools/def/<%= Rack::Utils.escape(@tool_name) %>/restore">
+          <%== csrf_tag %>
+          <input type="hidden" name="index" value="<%= i %>">
+          <span class="mono muted"><%= v["at"] %></span>
+          <button type="submit" class="ghost">Restore</button>
+        </form>
+      <% end %>
+    </div>
+  <% end %>
+<% end %>