@poncho-ai/cli 0.38.0 → 0.39.0

package/src/index.ts

@@ -55,6 +55,7 @@ import type {
   ApiThreadSummary,
 } from "@poncho-ai/sdk";
 import { getTextContent } from "@poncho-ai/sdk";
+import { buildZip, type ZipEntry } from "./vfs-zip.js";
 import {
   AgentBridge,
   ResendAdapter,
@@ -134,6 +135,22 @@ const collectToolCallIds = (msgs: Message[]): Set<string> => {
   }
   return ids;
 };
+
+const MEMORY_VFILE_PATH = "/memory.md";
+
+const isSafeVfsPath = (p: string): boolean => {
+  if (typeof p !== "string" || p.length === 0) return false;
+  if (!p.startsWith("/")) return false;
+  if (p.includes("\0")) return false;
+  const segments = p.split("/").slice(1);
+  if (p !== "/" && segments[segments.length - 1] === "") return false;
+  for (const seg of segments) {
+    if (seg === "" && p !== "/") return false;
+    if (seg === "." || seg === "..") return false;
+  }
+  return true;
+};
+
 const serverlessLog = createLogger("serverless");
 import {
   type DeployTarget,
@@ -307,6 +324,13 @@ export type RequestHandler = ((
   _finishConversationStream?: (conversationId: string) => void;
   _checkAndFireReminders?: () => Promise<{ fired: string[]; count: number; duration: number }>;
   _reminderPollIntervalMs?: number;
+  _buildTurnParameters?: (
+    conversation: Conversation,
+    opts?: {
+      bodyParameters?: Record<string, unknown>;
+      messagingMetadata?: { platform: string; sender: { id: string; name?: string | null }; threadId?: string };
+    },
+  ) => Record<string, unknown>;
 };
 
 export const createRequestHandler = async (options?: {
@@ -355,6 +379,32 @@ export const createRequestHandler = async (options?: {
   const conversationEventStreams = new Map<string, ConversationEventStream>();
   type EventCallback = (event: AgentEvent) => void;
   const conversationEventCallbacks = new Map<string, Set<EventCallback>>();
+  // Per-conversation replay-buffer cap. Live subscribers get full events; the
+  // buffer is just so a reconnecting client can catch up. Keep the most recent
+  // N events to bound memory.
+  const MAX_BUFFERED_EVENTS_PER_CONVERSATION = 1000;
+  // Deep-clone an event with any string > 4 KB replaced by a placeholder. Used
+  // when buffering for replay: a reconnecting client doesn't need fresh
+  // screenshots/large blobs (they're persisted in the conversation), and
+  // accumulating them caused OOMs (e.g. tool:completed for browser_screenshot
+  // carries a ~134 KB base64 JPEG per call).
+  const STRIP_LARGE_STRING_BYTES = 4096;
+  const stripLargeStringsForBuffer = (value: unknown): unknown => {
+    if (typeof value === "string") {
+      return value.length > STRIP_LARGE_STRING_BYTES
+        ? `[stripped-for-replay len=${value.length}]`
+        : value;
+    }
+    if (Array.isArray(value)) return value.map(stripLargeStringsForBuffer);
+    if (value && typeof value === "object") {
+      const out: Record<string, unknown> = {};
+      for (const [k, v] of Object.entries(value as Record<string, unknown>)) {
+        out[k] = stripLargeStringsForBuffer(v);
+      }
+      return out;
+    }
+    return value;
+  };
   const broadcastEvent = (conversationId: string, event: AgentEvent): void => {
     let stream = conversationEventStreams.get(conversationId);
     if (!stream) {
@@ -365,7 +415,10 @@ export const createRequestHandler = async (options?: {
     // Buffering them for reconnect replay grew to multi-GB and OOM'd the process;
     // they're ephemeral like browser:status and should never replay.
     if (event.type !== "browser:frame") {
-      stream.buffer.push(event);
+      stream.buffer.push(stripLargeStringsForBuffer(event) as AgentEvent);
+      if (stream.buffer.length > MAX_BUFFERED_EVENTS_PER_CONVERSATION) {
+        stream.buffer.splice(0, stream.buffer.length - MAX_BUFFERED_EVENTS_PER_CONVERSATION);
+      }
     }
     for (const subscriber of stream.subscribers) {
       try {
@@ -681,6 +734,40 @@ export const createRequestHandler = async (options?: {
     };
   };
 
+  // ---------------------------------------------------------------------------
+  // Single helper for assembling runInput.parameters across every turn entry
+  // point (HTTP route, messaging adapter, cron, reminder). All `__`-prefixed
+  // context params live here so adding a new one only requires one edit.
+  // ---------------------------------------------------------------------------
+  const buildTurnParameters = (
+    conversation: Conversation,
+    opts: {
+      bodyParameters?: Record<string, unknown>;
+      messagingMetadata?: {
+        platform: string;
+        sender: { id: string; name?: string | null };
+        threadId?: string;
+      };
+    } = {},
+  ): Record<string, unknown> => {
+    return withToolResultArchiveParam({
+      ...(opts.bodyParameters ?? {}),
+      ...buildRecallParams({
+        ownerId: conversation.ownerId,
+        tenantId: conversation.tenantId,
+        excludeConversationId: conversation.conversationId,
+      }),
+      ...(opts.messagingMetadata ? {
+        __messaging_platform: opts.messagingMetadata.platform,
+        __messaging_sender_id: opts.messagingMetadata.sender.id,
+        __messaging_sender_name: opts.messagingMetadata.sender.name ?? "",
+        __messaging_thread_id: opts.messagingMetadata.threadId,
+      } : {}),
+      __activeConversationId: conversation.conversationId,
+      __ownerId: conversation.ownerId,
+    }, conversation);
+  };
+
   // Subagent lifecycle extracted to AgentOrchestrator (Phase 5).
 
   // ---------------------------------------------------------------------------
@@ -790,6 +877,7 @@ export const createRequestHandler = async (options?: {
       let runContextWindow = 0;
       let runContinuation = false;
       let runContinuationMessages: Message[] | undefined;
+      let runHarnessMessages: Message[] | undefined;
       let runSteps = 0;
       let runMaxSteps: number | undefined;
 
@@ -828,17 +916,22 @@ export const createRequestHandler = async (options?: {
       const runInput = {
         task: input.task,
         conversationId,
+        tenantId: latestConversation?.tenantId ?? undefined,
         messages: historyMessages,
         files: input.files,
-        parameters: withToolResultArchiveParam({
-          ...(input.metadata ? {
-            __messaging_platform: input.metadata.platform,
-            __messaging_sender_id: input.metadata.sender.id,
-            __messaging_sender_name: input.metadata.sender.name ?? "",
-            __messaging_thread_id: input.metadata.threadId,
-          } : {}),
-          __activeConversationId: conversationId,
-        }, latestConversation ?? { _toolResultArchive: {} } as Conversation),
+        parameters: latestConversation
+          ? buildTurnParameters(latestConversation, {
+              messagingMetadata: input.metadata,
+            })
+          : withToolResultArchiveParam({
+              ...(input.metadata ? {
+                __messaging_platform: input.metadata.platform,
+                __messaging_sender_id: input.metadata.sender.id,
+                __messaging_sender_name: input.metadata.sender.name ?? "",
+                __messaging_thread_id: input.metadata.threadId,
+              } : {}),
+              __activeConversationId: conversationId,
+            }, { _toolResultArchive: {} } as Conversation),
       };
 
       try {
@@ -939,6 +1032,7 @@ export const createRequestHandler = async (options?: {
         });
         runContinuation = execution.runContinuation;
         runContinuationMessages = execution.runContinuationMessages;
+        runHarnessMessages = execution.runHarnessMessages;
         runSteps = execution.runSteps;
         runMaxSteps = execution.runMaxSteps;
         runContextTokens = execution.runContextTokens;
@@ -962,7 +1056,11 @@ export const createRequestHandler = async (options?: {
             contextWindow: runContextWindow,
             continuation: runContinuation,
             continuationMessages: runContinuationMessages,
-            harnessMessages: runContinuationMessages,
+            // Prefer the cancellation/end-of-run snapshot from the harness so
+            // _harnessMessages stays in sync with what the model just saw,
+            // even on aborted runs. Falls back to continuationMessages when
+            // the run completed via continuation.
+            harnessMessages: runHarnessMessages ?? runContinuationMessages,
             toolResultArchive: harness.getToolResultArchive(conversationId),
           }, { shouldRebuildCanonical: true });
         });
@@ -1428,7 +1526,7 @@ export const createRequestHandler = async (options?: {
     }
 
     if (webUiEnabled) {
-      if (request.method === "GET" && (pathname === "/" || pathname.startsWith("/c/"))) {
+      if (request.method === "GET" && (pathname === "/" || pathname.startsWith("/c/") || pathname.startsWith("/f/"))) {
         writeHtml(response, 200, renderWebUiHtml({ agentName, isDev: !isProduction }));
         return;
       }
@@ -2650,13 +2748,16 @@ export const createRequestHandler = async (options?: {
           && Array.isArray(conversation._continuationMessages)
           && conversation._continuationMessages.length > 0
           && !hasPendingApprovals;
+        const verboseDev = process.env.PONCHO_DEV_VERBOSE === "1";
         writeJson(response, 200, {
           conversation: {
             ...conversation,
             messages: conversation.messages.map(normalizeMessageForClient).filter((m): m is Message => m !== null),
             pendingApprovals: storedPending,
             _continuationMessages: undefined,
-            _harnessMessages: undefined,
+            // In verbose dev mode the web UI exposes a toggle to inspect the
+            // raw harness messages sent to the model API. Strip it otherwise.
+            _harnessMessages: verboseDev ? conversation._harnessMessages : undefined,
             // The browser has no use for the archive; make sure we never ship
             // it back even if the conversation was loaded via getWithArchive.
             _toolResultArchive: undefined,
@@ -2665,6 +2766,7 @@ export const createRequestHandler = async (options?: {
           hasActiveRun: hasActiveRun || hasPendingCallbackResults,
           hasRunningSubagents,
           needsContinuation,
+          verboseDev,
         });
         return;
       }
@@ -2789,6 +2891,22 @@ export const createRequestHandler = async (options?: {
         writeJson(response, 500, { code: "NO_ENGINE", message: "Storage engine not available" });
         return;
       }
+      if (vfsPath === MEMORY_VFILE_PATH) {
+        try {
+          const memory = await engine.memory.get(tenantId);
+          const data = Buffer.from(memory.content, "utf-8");
+          response.writeHead(200, {
+            "Content-Type": "text/markdown; charset=utf-8",
+            "Content-Length": data.length,
+            "Content-Disposition": `inline; filename="memory.md"`,
+            "Cache-Control": "no-cache",
+          });
+          response.end(data);
+        } catch (err) {
+          writeJson(response, 500, { code: "READ_FAILED", message: (err as Error)?.message ?? "Failed to read memory" });
+        }
+        return;
+      }
       try {
         const stat = await engine.vfs.stat(tenantId, vfsPath);
         if (!stat || stat.type !== "file") {
@@ -2823,6 +2941,273 @@ export const createRequestHandler = async (options?: {
       return;
     }
 
+    if (vfsMatch && request.method === "PUT") {
+      const rawPath = "/" + decodeURIComponent(vfsMatch[1] ?? "");
+      const tenantId = ctx.tenantId ?? "__default__";
+      const engine = harness.storageEngine;
+      if (!engine) {
+        writeJson(response, 500, { code: "NO_ENGINE", message: "Storage engine not available" });
+        return;
+      }
+      if (!isSafeVfsPath(rawPath) || rawPath === "/") {
+        writeJson(response, 400, { code: "BAD_PATH", message: "Invalid path" });
+        return;
+      }
+      if (rawPath === MEMORY_VFILE_PATH) {
+        try {
+          const chunks: Buffer[] = [];
+          for await (const chunk of request) chunks.push(chunk as Buffer);
+          const body = Buffer.concat(chunks);
+          const content = body.toString("utf-8").trim();
+          const memory = await engine.memory.update(content, tenantId);
+          writeJson(response, 200, {
+            path: MEMORY_VFILE_PATH,
+            size: Buffer.byteLength(memory.content, "utf-8"),
+            mimeType: "text/markdown",
+            updatedAt: memory.updatedAt,
+          });
+        } catch (err) {
+          writeJson(response, 500, { code: "WRITE_FAILED", message: (err as Error)?.message ?? "Failed to write memory" });
+        }
+        return;
+      }
+      const allowOverwrite = requestUrl.searchParams.get("overwrite") === "1";
+      try {
+        const existing = await engine.vfs.stat(tenantId, rawPath);
+        if (existing && !allowOverwrite) {
+          writeJson(response, 409, { code: "EXISTS", message: "File already exists" });
+          return;
+        }
+        if (existing && existing.type !== "file") {
+          writeJson(response, 409, { code: "NOT_A_FILE", message: "Path exists and is not a file" });
+          return;
+        }
+        const chunks: Buffer[] = [];
+        for await (const chunk of request) chunks.push(chunk as Buffer);
+        const body = Buffer.concat(chunks);
+        const mimeType = (request.headers["content-type"] as string | undefined)?.split(";")[0]?.trim() || undefined;
+        await engine.vfs.writeFile(tenantId, rawPath, new Uint8Array(body), mimeType);
+        if (rawPath === "/skills" || rawPath.startsWith("/skills/")) {
+          harness.invalidateSkillsForTenant(tenantId);
+        }
+        const stat = await engine.vfs.stat(tenantId, rawPath);
+        writeJson(response, 200, {
+          path: rawPath,
+          size: stat?.size ?? body.length,
+          mimeType: stat?.mimeType ?? mimeType ?? null,
+          updatedAt: stat?.updatedAt ?? Date.now(),
+        });
+      } catch (err) {
+        const message = (err as Error)?.message ?? "Upload failed";
+        const code = /quota|too large|exceed/i.test(message) ? 413 : 500;
+        writeJson(response, code, { code: code === 413 ? "QUOTA" : "WRITE_FAILED", message });
+      }
+      return;
+    }
+
+    if (vfsMatch && request.method === "DELETE") {
+      const rawPath = "/" + decodeURIComponent(vfsMatch[1] ?? "");
+      const tenantId = ctx.tenantId ?? "__default__";
+      const engine = harness.storageEngine;
+      if (!engine) {
+        writeJson(response, 500, { code: "NO_ENGINE", message: "Storage engine not available" });
+        return;
+      }
+      if (!isSafeVfsPath(rawPath) || rawPath === "/") {
+        writeJson(response, 400, { code: "BAD_PATH", message: "Invalid path" });
+        return;
+      }
+      if (rawPath === MEMORY_VFILE_PATH) {
+        writeJson(response, 400, {
+          code: "RESERVED",
+          message: "memory.md cannot be deleted; clear its contents instead.",
+        });
+        return;
+      }
+      try {
+        const stat = await engine.vfs.stat(tenantId, rawPath);
+        if (!stat) {
+          writeJson(response, 404, { code: "NOT_FOUND", message: "Path not found" });
+          return;
+        }
+        if (stat.type === "directory") {
+          await engine.vfs.deleteDir(tenantId, rawPath, true);
+        } else {
+          await engine.vfs.deleteFile(tenantId, rawPath);
+        }
+        if (rawPath === "/skills" || rawPath.startsWith("/skills/")) {
+          harness.invalidateSkillsForTenant(tenantId);
+        }
+        writeJson(response, 200, { ok: true, path: rawPath });
+      } catch (err) {
+        writeJson(response, 500, { code: "DELETE_FAILED", message: (err as Error)?.message ?? "Failed to delete" });
+      }
+      return;
+    }
+
+    if (pathname === "/api/vfs-archive" && request.method === "GET") {
+      const dirPath = requestUrl.searchParams.get("path") ?? "/";
+      const tenantId = ctx.tenantId ?? "__default__";
+      const engine = harness.storageEngine;
+      if (!engine) {
+        writeJson(response, 500, { code: "NO_ENGINE", message: "Storage engine not available" });
+        return;
+      }
+      if (!isSafeVfsPath(dirPath)) {
+        writeJson(response, 400, { code: "BAD_PATH", message: "Invalid path" });
+        return;
+      }
+      try {
+        if (dirPath !== "/") {
+          const stat = await engine.vfs.stat(tenantId, dirPath);
+          if (!stat || stat.type !== "directory") {
+            writeJson(response, 404, { code: "NOT_FOUND", message: "Directory not found" });
+            return;
+          }
+        }
+        const entries: ZipEntry[] = [];
+        const walk = async (dir: string, prefix: string): Promise<void> => {
+          const children = await engine.vfs.readdir(tenantId, dir);
+          for (const child of children) {
+            if (dir === "/" && child.name === "memory.md") continue;
+            const childPath = dir === "/" ? "/" + child.name : dir + "/" + child.name;
+            const relName = prefix === "" ? child.name : prefix + "/" + child.name;
+            if (child.type === "directory") {
+              await walk(childPath, relName);
+            } else if (child.type === "file") {
+              const content = await engine.vfs.readFile(tenantId, childPath);
+              const stat = await engine.vfs.stat(tenantId, childPath);
+              entries.push({
+                name: relName,
+                content,
+                mtime: stat?.updatedAt ? new Date(stat.updatedAt) : undefined,
+              });
+            }
+          }
+        };
+        await walk(dirPath, "");
+        if (dirPath === "/") {
+          const memory = await engine.memory.get(tenantId);
+          entries.push({
+            name: "memory.md",
+            content: new Uint8Array(Buffer.from(memory.content, "utf-8")),
+            mtime: memory.updatedAt > 0 ? new Date(memory.updatedAt) : undefined,
+          });
+        }
+        const archiveName = (dirPath === "/" ? "vfs" : (dirPath.split("/").pop() || "archive")) + ".zip";
+        const zip = buildZip(entries);
+        response.writeHead(200, {
+          "Content-Type": "application/zip",
+          "Content-Length": zip.length,
+          "Content-Disposition": `attachment; filename="${archiveName}"`,
+          "Cache-Control": "no-cache",
+        });
+        response.end(zip);
+      } catch (err) {
+        writeJson(response, 500, { code: "ARCHIVE_FAILED", message: (err as Error)?.message ?? "Failed to build archive" });
+      }
+      return;
+    }
+
+    if (pathname === "/api/vfs-list" && request.method === "GET") {
+      const dirPath = requestUrl.searchParams.get("path") ?? "/";
+      const tenantId = ctx.tenantId ?? "__default__";
+      const engine = harness.storageEngine;
+      if (!engine) {
+        writeJson(response, 500, { code: "NO_ENGINE", message: "Storage engine not available" });
+        return;
+      }
+      if (!isSafeVfsPath(dirPath)) {
+        writeJson(response, 400, { code: "BAD_PATH", message: "Invalid path" });
+        return;
+      }
+      try {
+        if (dirPath !== "/") {
+          const stat = await engine.vfs.stat(tenantId, dirPath);
+          if (!stat || stat.type !== "directory") {
+            writeJson(response, 404, { code: "NOT_FOUND", message: "Directory not found" });
+            return;
+          }
+        }
+        const rawDirEntries = await engine.vfs.readdir(tenantId, dirPath);
+        const dirEntries = dirPath === "/"
+          ? rawDirEntries.filter((e) => e.name !== "memory.md")
+          : rawDirEntries;
+        const entries: Array<{
+          name: string;
+          type: "file" | "directory" | "symlink";
+          size: number;
+          mimeType: string | null;
+          updatedAt: number | null;
+        }> = await Promise.all(dirEntries.map(async (entry) => {
+          const childPath = dirPath === "/" ? "/" + entry.name : dirPath + "/" + entry.name;
+          const stat = await engine.vfs.stat(tenantId, childPath);
+          return {
+            name: entry.name,
+            type: entry.type,
+            size: stat?.size ?? 0,
+            mimeType: stat?.mimeType ?? null,
+            updatedAt: stat?.updatedAt ?? null,
+          };
+        }));
+        if (dirPath === "/") {
+          const memory = await engine.memory.get(tenantId);
+          entries.push({
+            name: "memory.md",
+            type: "file",
+            size: Buffer.byteLength(memory.content, "utf-8"),
+            mimeType: "text/markdown",
+            updatedAt: memory.updatedAt > 0 ? memory.updatedAt : null,
+          });
+        }
+        entries.sort((a, b) => {
+          if (a.type !== b.type) return a.type === "directory" ? -1 : 1;
+          return a.name.localeCompare(b.name);
+        });
+        const usage = await engine.vfs.getUsage(tenantId);
+        writeJson(response, 200, { path: dirPath, entries, usage });
+      } catch (err) {
+        writeJson(response, 500, { code: "READDIR_FAILED", message: (err as Error)?.message ?? "Failed to list directory" });
+      }
+      return;
+    }
+
+    if (pathname === "/api/vfs-mkdir" && request.method === "POST") {
+      const tenantId = ctx.tenantId ?? "__default__";
+      const engine = harness.storageEngine;
+      if (!engine) {
+        writeJson(response, 500, { code: "NO_ENGINE", message: "Storage engine not available" });
+        return;
+      }
+      try {
+        const chunks: Buffer[] = [];
+        for await (const chunk of request) chunks.push(chunk as Buffer);
+        const body = JSON.parse(Buffer.concat(chunks).toString() || "{}") as { path?: string };
+        const dirPath = body.path ?? "";
+        if (!isSafeVfsPath(dirPath) || dirPath === "/") {
+          writeJson(response, 400, { code: "BAD_PATH", message: "Invalid path" });
+          return;
+        }
+        if (dirPath === MEMORY_VFILE_PATH) {
+          writeJson(response, 400, { code: "RESERVED", message: "memory.md is reserved" });
+          return;
+        }
+        const existing = await engine.vfs.stat(tenantId, dirPath);
+        if (existing) {
+          writeJson(response, 409, { code: "EXISTS", message: "Path already exists" });
+          return;
+        }
+        await engine.vfs.mkdir(tenantId, dirPath, true);
+        if (dirPath === "/skills" || dirPath.startsWith("/skills/")) {
+          harness.invalidateSkillsForTenant(tenantId);
+        }
+        writeJson(response, 200, { path: dirPath });
+      } catch (err) {
+        writeJson(response, 500, { code: "MKDIR_FAILED", message: (err as Error)?.message ?? "Failed to create directory" });
+      }
+      return;
+    }
+
     if (pathname === "/api/slash-commands" && request.method === "GET") {
       const skills: ApiSlashCommand[] = harness.listSkills().map((s) => ({
         command: "/" + s.name,
@@ -3104,6 +3489,10 @@ export const createRequestHandler = async (options?: {
       let checkpointedRun = false;
       let runCancelled = false;
       let runContinuationMessages: Message[] | undefined;
+      // Snapshot of the harness's in-flight messages emitted with run:cancelled,
+      // so the catch-path (executeConversationTurn threw) can still persist a
+      // canonical history that includes the cancelled work.
+      let cancelHarnessMessages: Message[] | undefined;
 
       // Hoist stable ids for this turn. The same userMessage / assistantId is
       // reused across every buildMessages() call so the in-flight assistant
@@ -3170,12 +3559,7 @@ export const createRequestHandler = async (options?: {
             task: messageText,
             conversationId,
             tenantId: ctx.tenantId ?? undefined,
-            parameters: withToolResultArchiveParam({
-              ...(bodyParameters ?? {}),
-              ...buildRecallParams({ ownerId, tenantId: ctx.tenantId, excludeConversationId: conversationId }),
-              __activeConversationId: conversationId,
-              __ownerId: ownerId,
-            }, conversation),
+            parameters: buildTurnParameters(conversation, { bodyParameters }),
             messages: harnessMessages,
             files: files.length > 0 ? files : undefined,
             abortSignal: abortController.signal,
@@ -3200,6 +3584,7 @@ export const createRequestHandler = async (options?: {
             }
             if (event.type === "run:cancelled") {
               runCancelled = true;
+              if (event.messages) cancelHarnessMessages = event.messages;
             }
             if (event.type === "compaction:completed") {
               if (event.compactedMessages) {
@@ -3327,7 +3712,17 @@ export const createRequestHandler = async (options?: {
         if (abortController.signal.aborted || runCancelled) {
           if (draft.assistantResponse.length > 0 || draft.toolTimeline.length > 0 || draft.sections.length > 0) {
             conversation.messages = buildMessages();
-            conversation.updatedAt = Date.now();
+            // Keep _harnessMessages aligned with what the model just saw.
+            // Without this, loadCanonicalHistory will hand the next turn a
+            // pre-cancellation snapshot and the agent will have no memory of
+            // the work it just did.
+            applyTurnMetadata(conversation, {
+              latestRunId,
+              contextTokens: 0,
+              contextWindow: 0,
+              harnessMessages: cancelHarnessMessages,
+              toolResultArchive: harness.getToolResultArchive(conversationId),
+            }, { shouldRebuildCanonical: true });
             await conversationStore.update(conversation);
           }
           if (!checkpointedRun) {
@@ -3456,6 +3851,8 @@ export const createRequestHandler = async (options?: {
               const result = await runCronAgent(harness, task, conv.conversationId, historyMessages,
                 conv._toolResultArchive,
                 async (event) => { await telemetry.emit(event); },
+                buildTurnParameters(conv),
+                conv.tenantId,
               );
 
               const freshConv = await conversationStore.get(conv.conversationId);
@@ -3526,6 +3923,8 @@ export const createRequestHandler = async (options?: {
               broadcastEvent(convId, event);
               await telemetry.emit(event);
             },
+            buildTurnParameters(conversation),
+            conversation.tenantId,
           );
           finishConversationStream(convId);
 
@@ -3673,6 +4072,9 @@ export const createRequestHandler = async (options?: {
                 harness, framedMessage, originConv.conversationId,
                 originConv.messages ?? [],
                 originConv._toolResultArchive,
+                undefined,
+                buildTurnParameters(originConv),
+                originConv.tenantId,
               );
               if (result.response) {
                 try {
@@ -3705,7 +4107,13 @@ export const createRequestHandler = async (options?: {
               `[reminder] ${reminder.task.slice(0, 80)} ${timestamp}`,
             );
             const convId = conversation.conversationId;
-            const result = await runCronAgent(harness, framedMessage, convId, []);
+            const result = await runCronAgent(
+              harness, framedMessage, convId, [],
+              undefined,
+              undefined,
+              buildTurnParameters(conversation),
+              conversation.tenantId,
+            );
             const freshConv = await conversationStore.get(convId);
             if (freshConv) {
               freshConv.messages = buildCronMessages(framedMessage, [], result);
@@ -3741,6 +4149,7 @@ export const createRequestHandler = async (options?: {
   handler._finishConversationStream = finishConversationStream;
   handler._checkAndFireReminders = checkAndFireReminders;
   handler._reminderPollIntervalMs = reminderPollWindowMs;
+  handler._buildTurnParameters = buildTurnParameters;
 
   // Recover stale subagent runs that were "running" when the server last stopped
   orchestrator.recoverStaleSubagents().catch(err =>
@@ -3785,6 +4194,7 @@ export const startDevServer = async (
     const activeRuns = handler._activeConversationRuns;
     const deferredCallbacks = handler._pendingCallbackNeeded;
     const runCallback = handler._processSubagentCallback;
+    const buildParams = handler._buildTurnParameters;
     if (!harnessRef || !store) return;
 
     for (const [jobName, config] of entries) {
@@ -3845,6 +4255,8 @@ export const startDevServer = async (
                   const result = await runCronAgent(harnessRef, task, convId, historyMessages,
                     conversation._toolResultArchive,
                     broadcastCh ? (ev) => broadcastCh(convId, ev) : undefined,
+                    buildParams?.(conversation),
+                    conversation.tenantId,
                   );
                   handler._finishConversationStream?.(convId);
 
@@ -3913,6 +4325,8 @@ export const startDevServer = async (
             const result = await runCronAgent(harnessRef, config.task, cronConvId, [],
               conversation._toolResultArchive,
               broadcast ? (ev) => broadcast(cronConvId!, ev) : undefined,
+              buildParams?.(conversation),
+              conversation.tenantId,
             );
             handler._finishConversationStream?.(cronConvId);
             const freshConv = await store.get(cronConvId);
@@ -4054,6 +4468,12 @@ export const buildCli = (): Command => {
         }
         setLogLevel(level as typeof valid[number]);
       }
+      if (options.verbose) {
+        // Surfaced to the request handler so the web UI can offer a toggle
+        // between user-facing messages and the raw harness-message stream
+        // sent to the model API.
+        process.env.PONCHO_DEV_VERBOSE = "1";
+      }
       if (process.stdout.isTTY && !process.env.NO_COLOR) {
         process.stdout.write("\n");
         for (const line of getMascotLines()) process.stdout.write(`${line}\n`);