kward 0.83.0 → 0.85.0

data/lib/kward/conversation.rb

@@ -3,7 +3,7 @@ require "set"
 require_relative "context_budget_meter"
 require_relative "image_attachments"
 require_relative "message_access"
-require_relative "plugin_registry"
+require_relative "plugins/registry"
 require_relative "prompts"
 
 # Namespace for the Kward CLI agent runtime.
@@ -176,9 +176,38 @@ module Kward
       "toolout_#{digest}"
     end
 
+    # Scopes plugin instructions to one host-owned turn, including retries.
+    # The overlay is deliberately not persisted or folded into the base prompt.
+    def with_system_turn(request)
+      previous = @system_turn
+      raise ArgumentError, "A system-instruction turn is already active" if previous
+
+      @system_turn = request
+      yield
+    ensure
+      @system_turn = previous
+    end
+
+    def append_system_turn(request)
+      append_message(request.history_message)
+    end
+
     # @return [Array<Hash>] provider request context: current system prompt plus durable transcript
     def context_messages
-      @system_message ? [@system_message] + @messages : @messages.dup
+      instruction = { role: "system", content: @system_turn.system, system_turn: true } if @system_turn
+      inserted = false
+      messages = @messages.filter_map do |message|
+        record = message[:plugin_system_turn] || message["plugin_system_turn"]
+        next message unless record
+        next unless @system_turn && (record[:id] || record["id"]) == @system_turn.id
+
+        inserted = true
+        instruction
+      end
+      # Compaction can remove the history marker; reissue the current directive
+      # after the compacted context rather than demoting it to the base prompt.
+      messages << instruction if instruction && !inserted
+      @system_message ? [@system_message] + messages : messages
     end
 
     # Rebuilds the system message from current config, memory, plugins, and

data/lib/kward/image_attachments.rb

@@ -4,7 +4,7 @@ require "open3"
 require "shellwords"
 require "tmpdir"
 require "uri"
-require_relative "terminal_image_support"
+require_relative "terminal/image_support"
 
 # Namespace for the Kward CLI agent runtime.
 module Kward

data/lib/kward/model/client.rb

@@ -8,7 +8,7 @@ require_relative "../auth/openai_oauth"
 require_relative "../cancellation"
 require_relative "../config_files"
 require_relative "../http"
-require_relative "../openrouter_model_cache"
+require_relative "openrouter_model_cache"
 require_relative "context_overflow"
 require_relative "azure_openai_config"
 require_relative "copilot_models"
@@ -37,12 +37,12 @@ module Kward
       "lm_studio" => "http://127.0.0.1:1234/v1",
       "llama_cpp" => "http://127.0.0.1:8080/v1"
     }.freeze
-    AUTH_ERROR = "No OpenAI OAuth login found. Run `ruby lib/main.rb login`, or set OPENAI_ACCESS_TOKEN/OPENROUTER_API_KEY."
-    OPENROUTER_AUTH_ERROR = "No OpenRouter API key found. Set OPENROUTER_API_KEY or sign in with an API key."
-    OPENAI_API_AUTH_ERROR = "No OpenAI API key found. Set OPENAI_API_KEY or sign in with an API key."
-    AZURE_OPENAI_AUTH_ERROR = "No Azure OpenAI API key found. Set AZURE_OPENAI_API_KEY or sign in with an API key."
-    COPILOT_AUTH_ERROR = "No GitHub Copilot OAuth login found. Run `ruby lib/main.rb login github` or set COPILOT_GITHUB_TOKEN."
-    ANTHROPIC_AUTH_ERROR = "No Anthropic OAuth login found. Run `ruby lib/main.rb login anthropic`."
+    AUTH_ERROR = "No OpenAI OAuth login found. Run `kward login`, or set OPENAI_ACCESS_TOKEN or OPENROUTER_API_KEY."
+    OPENROUTER_AUTH_ERROR = "No OpenRouter API key found. Run `kward login openrouter`, or set OPENROUTER_API_KEY."
+    OPENAI_API_AUTH_ERROR = "No OpenAI API key found. Run `kward login`, or set OPENAI_API_KEY."
+    AZURE_OPENAI_AUTH_ERROR = "No Azure OpenAI API key found. Run `kward login`, or set AZURE_OPENAI_API_KEY."
+    COPILOT_AUTH_ERROR = "No GitHub Copilot OAuth login found. Run `kward login github`, or set COPILOT_GITHUB_TOKEN."
+    ANTHROPIC_AUTH_ERROR = "No Anthropic OAuth login found. Run `kward login anthropic`."
     DEFAULT_OPENAI_MODEL = ModelInfo::DEFAULT_OPENAI_MODEL
     DEFAULT_REASONING_EFFORT = ModelInfo::DEFAULT_REASONING_EFFORT
     RETRY_DELAYS = [1, 2].freeze
@@ -61,6 +61,8 @@ module Kward
       /(?:exceeded|reached).*(?:usage|quota|credit|budget|balance)/i
     ].freeze
 
+    AuthenticationError = Class.new(RuntimeError)
+
     RequestError = Class.new(StandardError) do
       attr_reader :provider, :code, :body
 
@@ -108,11 +110,12 @@ module Kward
       @local_models = nil
     end
 
-    def chat(messages, tools: [], on_reasoning_delta: nil, on_reasoning_boundary: nil, on_assistant_delta: nil, on_retry: nil, cancellation: nil, steering: nil, max_tokens: nil, provider: nil, model: nil, reasoning: nil)
+    def chat(messages, tools: [], on_reasoning_delta: nil, on_reasoning_boundary: nil, on_assistant_delta: nil, on_retry: nil, cancellation: nil, steering: nil, max_tokens: nil, provider: nil, model: nil, reasoning: nil, provider_required: false)
       cancellation&.raise_if_cancelled!
       requested_provider = provider
+      validate_required_provider!(requested_provider) if provider_required
       url, token, resolved_provider, account_id = credentials(provider: requested_provider)
-      if token.to_s.empty? && authentication_required?(resolved_provider) && !requested_provider.to_s.empty? && resolved_provider != "OpenAI"
+      if token.to_s.empty? && authentication_required?(resolved_provider) && !provider_required && !requested_provider.to_s.empty? && resolved_provider != "OpenAI"
         url, token, resolved_provider, account_id = credentials
         model = nil
         reasoning = nil
@@ -593,20 +596,22 @@ module Kward
     end
 
     def auth_error_for(provider)
-      case provider
-      when "Azure OpenAI"
-        AZURE_OPENAI_AUTH_ERROR
-      when "OpenAI"
-        OPENAI_API_AUTH_ERROR
-      when "OpenRouter"
-        OPENROUTER_AUTH_ERROR
-      when "Copilot"
-        COPILOT_AUTH_ERROR
-      when "Anthropic"
-        ANTHROPIC_AUTH_ERROR
-      else
-        AUTH_ERROR
-      end
+      message =
+        case provider
+        when "Azure OpenAI"
+          AZURE_OPENAI_AUTH_ERROR
+        when "OpenAI"
+          OPENAI_API_AUTH_ERROR
+        when "OpenRouter"
+          OPENROUTER_AUTH_ERROR
+        when "Copilot"
+          COPILOT_AUTH_ERROR
+        when "Anthropic"
+          ANTHROPIC_AUTH_ERROR
+        else
+          AUTH_ERROR
+        end
+      AuthenticationError.new(message)
     end
 
     def with_retries(provider, model, request_bytes: nil, on_retry: nil, cancellation: nil)
@@ -707,7 +712,7 @@ module Kward
     end
 
     def copilot_responses_model?(model)
-      model.to_s.match?(/\Agpt-5(?:\.|-|\z)/)
+      model.to_s.match?(/\Agpt-(?:5|6)(?:\.|-|\z)/)
     end
 
     def model_entry(provider, id, current: false, metadata: nil)
@@ -1063,6 +1068,13 @@ module Kward
       ModelInfo.reasoning_effort(config: @config, provider: provider)
     end
 
+    def validate_required_provider!(provider)
+      provider_id = provider.to_s.strip.downcase
+      return if ProviderCatalog.configuration_ids.include?(provider_id)
+
+      raise ArgumentError, "Unknown provider: #{provider}"
+    end
+
     def authentication_required?(provider)
       provider != "Local"
     end

data/lib/kward/model/copilot_models.rb

@@ -14,7 +14,7 @@ module Kward
 
     def supported?(model)
       text = model.to_s
-      text.match?(/\Agpt-5(?:\.|-|\z)/) || text.match?(/\A(?:gemini-|gpt-4\.1|oswe-)/)
+      text.match?(/\Agpt-(?:5|6)(?:\.|-|\z)/) || text.match?(/\A(?:gemini-|gpt-4\.1|oswe-)/)
     end
 
     def supported_choices(choices)
@@ -24,7 +24,7 @@ module Kward
     def resolved_chat_model(configured_model, choices)
       return configured_model if choices.empty? || choices.include?(configured_model)
 
-      choices.find { |model| supported?(model) } || raise("No Copilot models supported by Kward are available for this account. Kward currently supports Copilot GPT-5 Responses and Gemini/GPT-4.1 chat models.")
+      choices.find { |model| supported?(model) } || raise("No Copilot models supported by Kward are available for this account. Kward currently supports Copilot GPT-5/GPT-6 Responses and Gemini/GPT-4.1 chat models.")
     end
 
     def catalog_entries(body)

data/lib/kward/model/model_info.rb

@@ -9,7 +9,7 @@ module Kward
     DEFAULT_COPILOT_MODEL = "gpt-5-mini"
     DEFAULT_ANTHROPIC_MODEL = "claude-sonnet-5"
     DEFAULT_REASONING_EFFORT = "medium"
-    OPENAI_MODEL_CHOICES = %w[gpt-5.6-sol gpt-5.6-terra gpt-5.6-luna gpt-5.5 gpt-5.4 gpt-5.4-mini gpt-5.3-codex-spark].freeze
+    OPENAI_MODEL_CHOICES = %w[gpt-6-astra gpt-6.1-sol gpt-6-luna gpt-5.6-sol gpt-5.6-terra gpt-5.6-luna gpt-5.5 gpt-5.4 gpt-5.4-mini gpt-5.3-codex-spark].freeze
     ANTHROPIC_MODEL_CHOICES = %w[
       claude-fable-5
       claude-opus-5
@@ -24,6 +24,7 @@ module Kward
     ].freeze
     COPILOT_MODEL_CHOICES = %w[
       gpt-5-mini
+      gpt-6-astra
       gpt-5.3-codex
       gpt-5.4
       gpt-5.4-mini
@@ -54,6 +55,14 @@ module Kward
       *OPENAI_REASONING_EFFORT_CHOICES,
       ["max", "Max"]
     ].freeze
+    GPT_6_REASONING_EFFORT_CHOICES = [
+      *REASONING_EFFORT_CHOICES,
+      ["max", "Max"]
+    ].freeze
+    GPT_6_LUNA_REASONING_EFFORT_CHOICES = [
+      *OPENAI_REASONING_EFFORT_CHOICES,
+      ["max", "Max"]
+    ].freeze
     ANTHROPIC_HIGH_REASONING_EFFORT_CHOICES = [
       ["low", "Low"],
       ["medium", "Medium"],
@@ -78,6 +87,7 @@ module Kward
     ].freeze
 
     CODEX_CONTEXT_WINDOWS = [
+      [/\Agpt-6(?:\.1)?-(?:astra|sol|luna)(?:\z|-)/, 1_050_000],
       [/\Agpt-5\.6/, 1_050_000],
       [/\Agpt-5\.5/, 400_000],
       [/\Agpt-5\.4-mini/, 400_000],
@@ -96,6 +106,7 @@ module Kward
       [/\Agpt-3\.5-turbo/, 16_385]
     ].freeze
     OPENAI_CONTEXT_WINDOWS = [
+      [/\Agpt-6(?:\.1)?-(?:astra|sol|luna)(?:\z|-)/, 1_050_000],
       [/\Agpt-5\.6/, 1_050_000],
       [/\Agpt-5\.5/, 1_050_000],
       [/\Agpt-5\.4-mini/, 400_000],
@@ -423,10 +434,12 @@ module Kward
       case provider
       when "Codex", "OpenRouter"
         true
+      when "OpenAI"
+        id.to_s.match?(/\Agpt-6(?:\.1)?-(?:astra|sol|luna)(?:\z|-)/)
       when "Anthropic"
         !reasoning_effort_choices(provider, id).empty?
       when "Copilot"
-        id.to_s.match?(/\Agpt-5(?:\.|-|\z)/)
+        id.to_s.match?(/\Agpt-(?:5|6)(?:\.|-|\z)/)
       else
         false
       end
@@ -436,10 +449,12 @@ module Kward
       case provider
       when "Codex", "OpenRouter"
         openai_reasoning_effort_choices(id)
+      when "OpenAI"
+        reasoning_supported?(provider, id) ? openai_reasoning_effort_choices(id) : []
       when "Anthropic"
         anthropic_reasoning_effort_choices(id)
       when "Copilot"
-        id.to_s.match?(/\Agpt-5(?:\.|-|\z)/) ? openai_reasoning_effort_choices(id) : []
+        id.to_s.match?(/\Agpt-(?:5|6)(?:\.|-|\z)/) ? openai_reasoning_effort_choices(id) : []
       else
         []
       end
@@ -447,6 +462,8 @@ module Kward
 
     def openai_reasoning_effort_choices(id)
       text = id.to_s.delete_prefix("openai/")
+      return GPT_6_LUNA_REASONING_EFFORT_CHOICES if text.match?(/\Agpt-6-luna(?:\z|-)/)
+      return GPT_6_REASONING_EFFORT_CHOICES if text.match?(/\Agpt-6\.1-sol(?:\z|-)|\Agpt-6-astra(?:\z|-)/)
       return REASONING_EFFORT_CHOICES if text.match?(/\Agpt-5\.[23]-codex/)
       return OPENAI_MAX_REASONING_EFFORT_CHOICES if text.match?(/\Agpt-5\.6(?:\z|-)/)
 

data/lib/kward/{openrouter_model_cache.rb → model/openrouter_model_cache.rb}

@@ -3,9 +3,9 @@ require "json"
 require "net/http"
 require "time"
 require "uri"
-require_relative "config_files"
-require_relative "http"
-require_relative "private_file"
+require_relative "../config_files"
+require_relative "../http"
+require_relative "../private_file"
 
 # Namespace for the Kward CLI agent runtime.
 module Kward

data/lib/kward/model/payloads.rb

@@ -95,6 +95,8 @@ module Kward
 
     def anthropic_payload(messages, tools, max_tokens: nil, model: nil, reasoning: nil)
       parts = build_context_parts("Anthropic", messages, tools, model: model)
+      raise ArgumentError, "Anthropic requires conversation messages; a system-only turn is unavailable in an empty session" if parts[:messages].empty?
+
       system = [{ type: "text", text: "You are Claude Code, Anthropic's official CLI for Claude." }]
       system << { type: "text", text: parts[:system] } unless parts[:system].to_s.empty?
       payload = {
@@ -122,6 +124,8 @@ module Kward
         contents: messages.filter_map { |message| gemini_message(message) },
         tools: tools.empty? ? nil : [{ functionDeclarations: tools.map { |tool| gemini_tool_schema(tool) } }]
       }.compact
+      raise ArgumentError, "Gemini requires conversation contents; a system-only turn is unavailable in an empty session" if payload[:contents].empty?
+
       payload[:systemInstruction] = { parts: system_parts } unless system_parts.empty?
       payload[:generationConfig] = { maxOutputTokens: max_tokens.to_i } if max_tokens.to_i.positive?
       payload
@@ -219,7 +223,8 @@ module Kward
           tools: tools.map { |tool| codex_tool_schema(tool) }
         }
       elsif ["Codex", "OpenAI"].include?(provider)
-        instructions, input = codex_messages(messages)
+        # The Codex subscription endpoint rejects inline system messages.
+        instructions, input = codex_messages(messages, system_turn_role: provider == "Codex" ? "developer" : "system")
         {
           provider: provider,
           model: model_for(provider, override_model: model),
@@ -335,7 +340,7 @@ module Kward
       }
     end
 
-    def codex_messages(messages)
+    def codex_messages(messages, system_turn_role: "system")
       instructions = []
       input = []
 
@@ -344,7 +349,11 @@ module Kward
         content = MessageAccess.content(message) || ""
         case role.to_s
         when "system"
-          instructions << plain_content(content).to_s
+          if MessageAccess.value(message, :system_turn)
+            input << codex_message(system_turn_role, plain_content(content).to_s)
+          else
+            instructions << plain_content(content).to_s
+          end
         when "tool", "toolResult"
           input << {
             type: "function_call_output",

data/lib/kward/model/provider_catalog.rb

@@ -71,9 +71,14 @@ module Kward
       Definition.new(id: "xai", name: "xAI", api_key_env: ["XAI_API_KEY"], protocol: "openai_chat", oauth_name: "xAI Grok"),
       Definition.new(id: "copilot", name: "GitHub Copilot", api_key_env: [], protocol: "copilot", oauth_name: "GitHub Copilot")
     ].freeze
+    CONFIGURATION_IDS = (["codex", "openai_api", "local"] + DEFINITIONS.map(&:id).reject { |id| id == "openai" }).freeze
 
     module_function
 
+    def configuration_ids
+      CONFIGURATION_IDS
+    end
+
     def all
       DEFINITIONS
     end

data/lib/kward/model/stream_parser.rb

@@ -347,7 +347,7 @@ module Kward
       when "response.content_part.added"
         codex_content_part_added(state, event["part"])
       when "response.output_text.delta", "response.refusal.delta"
-        codex_output_text_delta(state, event["delta"], on_assistant_delta: on_assistant_delta)
+        codex_output_text_delta(state, event["delta"], on_reasoning_delta: on_reasoning_delta, on_assistant_delta: on_assistant_delta)
       when "response.reasoning_summary_part.added"
         codex_reasoning_summary_part_added(state, event["part"])
       when "response.reasoning_summary_text.delta"
@@ -417,7 +417,7 @@ module Kward
       state[:current_text_content_part] = item["content"].last
     end
 
-    def codex_output_text_delta(state, delta, on_assistant_delta: nil)
+    def codex_output_text_delta(state, delta, on_reasoning_delta: nil, on_assistant_delta: nil)
       text = delta.to_s
       return if text.empty?
 
@@ -432,6 +432,9 @@ module Kward
         if codex_streamable_message_item?(item)
           on_assistant_delta&.call(text)
           state[:emitted_message_keys] << codex_item_key(item)
+        elsif codex_commentary_message_item?(item)
+          on_reasoning_delta&.call(text)
+          state[:emitted_message_keys] << codex_item_key(item)
         end
       end
       state[:raw_content] << text
@@ -647,10 +650,19 @@ module Kward
       case item["type"]
       when "message"
         text = text_from_codex_items([item])
-        return if text.empty? || !codex_streamable_message_item?(item)
+        return if text.empty?
 
-        state[:content] << text
         key = codex_item_key(item)
+        if codex_commentary_message_item?(item)
+          unless state[:emitted_message_keys].include?(key)
+            on_reasoning_delta&.call(text)
+            state[:emitted_message_keys] << key
+          end
+          return
+        end
+        return unless codex_streamable_message_item?(item)
+
+        state[:content] << text
         unless state[:emitted_message_keys].include?(key)
           on_assistant_delta&.call(text)
           state[:emitted_message_keys] << key
@@ -774,6 +786,10 @@ module Kward
       phase.empty? || phase == "final_answer"
     end
 
+    def codex_commentary_message_item?(item)
+      codex_message_phase(item) == "commentary"
+    end
+
     def codex_message_phase(item)
       item["phase"].to_s
     end

data/lib/kward/model/typesafe_client.rb

@@ -0,0 +1,78 @@
+require "json"
+require "net/http"
+require "uri"
+require_relative "../cancellation"
+require_relative "../http"
+
+module Kward
+  # HTTP client for TypeSafe's structured System One evaluation endpoint.
+  class TypeSafeClient
+    DEFAULT_ENDPOINT = "https://api.typesafe.ai/v1/systemone"
+    DEFAULT_MODEL = "jev-latest"
+    MAX_STATE_BYTES = 100_000
+    MAX_QUESTIONS = 100
+    HTTP_TIMEOUT_SECONDS = 30
+
+    class RequestError < StandardError
+      attr_reader :status
+
+      def initialize(status:, message:)
+        @status = status.to_i
+        super(message)
+      end
+    end
+
+    def initialize(api_key: ENV["TYPESAFE_API_KEY"], endpoint: DEFAULT_ENDPOINT, http: Net::HTTP)
+      @api_key = api_key.to_s.strip
+      @endpoint = URI(endpoint)
+      @http = http
+    end
+
+    def available?
+      !@api_key.empty?
+    end
+
+    def evaluate(state:, questions:, model: DEFAULT_MODEL, cancellation: nil)
+      raise ArgumentError, "TypeSafe API key is not configured" unless available?
+
+      cancellation&.raise_if_cancelled!
+      request = Net::HTTP::Post.new(@endpoint)
+      request["Authorization"] = "Bearer #{@api_key}"
+      request["Content-Type"] = "application/json"
+      request["Accept"] = "application/json"
+      Http.apply_user_agent(request)
+      request.body = JSON.dump({ state: state, model: model, questions: questions })
+
+      response_body = nil
+      @http.start(@endpoint.hostname, @endpoint.port, use_ssl: @endpoint.scheme == "https", read_timeout: HTTP_TIMEOUT_SECONDS) do |http|
+        cancellation&.on_cancel { close_http(http) }
+        cancellation&.raise_if_cancelled!
+        response = http.request(request)
+        response_body = response.body.to_s
+        unless response.is_a?(Net::HTTPSuccess)
+          raise RequestError.new(status: response.code, message: error_message(response.code, response_body))
+        end
+      end
+      cancellation&.raise_if_cancelled!
+      JSON.parse(response_body)
+    rescue JSON::ParserError
+      raise RequestError.new(status: 200, message: "TypeSafe returned invalid JSON")
+    end
+
+    private
+
+    def error_message(status, body)
+      detail = JSON.parse(body).fetch("error", nil) rescue nil
+      detail = detail["message"] if detail.is_a?(Hash)
+      detail = detail.to_s unless detail.nil?
+      detail = "request failed" if detail.nil? || detail.empty?
+      "TypeSafe request failed (#{status}): #{detail[0, 500]}"
+    end
+
+    def close_http(http)
+      http.finish if http&.started?
+    rescue IOError
+      nil
+    end
+  end
+end

data/lib/kward/pan/index.html.erb

@@ -162,7 +162,7 @@
         <button class="icon-button" id="open-sessions" type="button" aria-label="Open sessions">☰</button>
         <div class="title-block">
           <div class="title-row"><span class="live-dot"></span><h1 id="conversation-title">New session</h1></div>
-          <div class="top-meta" id="session-meta">Secure LAN workspace</div>
+          <div class="top-meta" id="session-meta">Authenticated HTTP workspace</div>
         </div>
         <button class="text-button" id="capture-skill" type="button">Capture skill</button>
         <button class="text-button" id="rename-session" type="button">Rename</button>
@@ -176,7 +176,7 @@
       <div class="composer-shell">
         <form id="prompt-form">
           <div class="composer">
-            <textarea id="prompt" name="prompt" rows="1" autocomplete="off" enterkeyhint="send" aria-label="Prompt" placeholder="Give <%= ERB::Util.html_escape(@assistant_label) %> an order…"></textarea>
+            <textarea id="prompt" name="prompt" rows="1" autocomplete="off" enterkeyhint="send" aria-label="Prompt" placeholder="Ask <%= ERB::Util.html_escape(@assistant_label) %> to inspect, explain, or change code…"></textarea>
             <button class="send" id="send" type="submit" aria-label="Send prompt">↑</button>
           </div>
           <div class="composer-meta"><span id="status">Connecting…</span><span>Return to send · Shift Return for a new line</span></div>
@@ -437,7 +437,7 @@
       if (!activeSession) return;
       titleEl.textContent = activeSession.title || activeSession.name || 'New session';
       const details = [activeSession.model, activeSession.messageCount != null ? `${activeSession.messageCount} messages` : null].filter(Boolean);
-      sessionMeta.textContent = details.join(' · ') || 'Secure LAN workspace';
+      sessionMeta.textContent = details.join(' · ') || 'Authenticated HTTP workspace';
     }
 
     async function changeSession(action, values = {}) {

data/lib/kward/pan/server.rb

@@ -1,5 +1,6 @@
 require "base64"
 require "erb"
+require "ipaddr"
 require "json"
 require "socket"
 require "thread"
@@ -9,22 +10,22 @@ require_relative "../agent"
 require_relative "../config_files"
 require_relative "../events"
 require_relative "../model/retry_message"
-require_relative "../plugin_registry"
+require_relative "../plugins/registry"
 require_relative "../prompts/commands"
 require_relative "../rpc/transcript_normalizer"
-require_relative "../session_store"
+require_relative "../sessions/store"
 require_relative "../skills/capture"
-require_relative "../session_trash"
+require_relative "../sessions/trash"
 require_relative "../tools/tool_call"
 require_relative "../tools/registry"
 require_relative "../version"
-require_relative "../workspace_factory"
+require_relative "../workspace/factory"
 
 # Namespace for the Kward CLI agent runtime.
 module Kward
   # Local HTTP server for the mobile-friendly Pan web UI.
   class PanServer
-    DEFAULT_HOST = "0.0.0.0"
+    DEFAULT_HOST = "127.0.0.1"
     DEFAULT_PORT = 8765
     MAX_REQUEST_BODY_BYTES = 64 * 1024
     ROUTING_PROBE_ADDRESS = "8.8.8.8"
@@ -44,8 +45,11 @@ module Kward
       @host = @config.fetch("host", DEFAULT_HOST).to_s
       @port = positive_port(@config.fetch("port", DEFAULT_PORT))
       @username = @config["username"].to_s
-      @password = @config["password"].to_s
-      raise "Pan mode requires pan_mode.username and pan_mode.password in #{ConfigFiles.config_path}" if @username.empty? || @password.empty?
+      environment_password = ENV["KWARD_PAN_PASSWORD"].to_s
+      @password = environment_password.empty? ? @config["password"].to_s : environment_password
+      if @username.empty? || @password.empty?
+        raise "Pan mode requires pan_mode.username and either pan_mode.password or KWARD_PAN_PASSWORD"
+      end
 
       @session_store = SessionStore.new(config_dir: config_dir, cwd: @workspace.root.to_s)
       @session = @session_store.create(
@@ -69,6 +73,7 @@ module Kward
     attr_reader :host, :port, :session, :workspace
 
     def run
+      warn_if_exposed
       start_worker
       @server = TCPServer.new(@host, @port)
       actual_port = @server.addr[1]
@@ -90,6 +95,8 @@ module Kward
       @server&.close unless @server&.closed?
     rescue IOError
       nil
+    ensure
+      @plugin_registry&.shutdown!
     end
 
     def enqueue_prompt(prompt)
@@ -125,7 +132,7 @@ module Kward
       hook_manager = lifecycle_hook_manager
       Agent.new(
         client: @client,
-        tool_registry: ToolRegistry.new(workspace: @workspace, ask_user_question_enabled: false, hook_manager: hook_manager, hook_context: hook_context),
+        tool_registry: ToolRegistry.new(workspace: @workspace, ask_user_question_enabled: false, plugin_tools: plugin_registry.tools, hook_manager: hook_manager, hook_context: hook_context),
         conversation: @conversation,
         hook_manager: hook_manager,
         hook_context: hook_context
@@ -172,7 +179,7 @@ module Kward
     end
 
     def plugin_registry
-      @plugin_registry ||= PluginRegistry.load(reserved_commands: PromptCommands::BUILTIN_RESERVED_COMMAND_NAMES)
+      @plugin_registry ||= PluginRegistry.load(reserved_commands: PromptCommands::BUILTIN_RESERVED_COMMAND_NAMES).tap(&:start!)
     end
 
     def start_worker
@@ -236,7 +243,8 @@ module Kward
       when ["GET", "/kward-logo.png"]
         write_response(socket, 200, { "Content-Type" => "image/png", "Cache-Control" => "public, max-age=86400" }, File.binread(File.join(__dir__, "kward_logo.png")))
       when ["GET", "/transcript"]
-        write_json(socket, 200, transcript: transcript_items, session: active_session_payload, workspace: @workspace.root.to_s)
+        write_json(socket, 200, transcript: transcript_items, session: active_session_payload, workspace: @workspace.root.to_s,
+          capabilities: { pluginCommandTurns: { supported: false, reason: "Pan has no plugin slash-command dispatcher; use the TUI or RPC turns/start." } })
       when ["GET", "/sessions"]
         write_json(socket, 200, sessions: session_payloads, activeSessionId: @session.id)
       when ["GET", "/skill-capture/sessions"]
@@ -595,6 +603,21 @@ module Kward
       lan_address || "<lan-address>"
     end
 
+    def warn_if_exposed
+      return if loopback_host?
+
+      @output.puts "Warning: Pan is exposed over plain HTTP on #{@host}."
+      @output.puts "Use it only on a trusted network, or bind pan_mode.host to 127.0.0.1."
+    end
+
+    def loopback_host?
+      return true if @host.casecmp?("localhost")
+
+      IPAddr.new(@host).loopback?
+    rescue IPAddr::InvalidAddressError
+      false
+    end
+
     def lan_address
       socket = @udp_socket_class.new
       socket.connect(ROUTING_PROBE_ADDRESS, ROUTING_PROBE_PORT)

data/lib/kward/permissions/policy.rb

@@ -160,11 +160,15 @@ module Kward
       end
 
       def network?(request)
-        NETWORK_TOOLS.include?(request.fetch("tool")) || request["source"] == "mcp"
+        NETWORK_TOOLS.include?(request.fetch("tool"))
+      end
+
+      def extension_tool?(request)
+        %w[mcp plugin].include?(request["source"])
       end
 
       def risky?(request)
-        mutating?(request) || request.fetch("tool") == "run_shell_command" || network?(request)
+        mutating?(request) || request.fetch("tool") == "run_shell_command" || network?(request) || extension_tool?(request)
       end
 
       def outside_write_scopes?(request)