@yeaft/webchat-agent 0.1.803 → 0.1.805

package/connection/message-router.js

@@ -36,7 +36,7 @@ import { sendToServer, flushMessageBuffer } from './buffer.js';
 import { handleRestartAgent, handleUpgradeAgent } from './upgrade.js';
 import { loadMcpServers, updateMcpConfig } from '../mcp.js';
 import { getLlmConfig, updateLlmConfig, getUnifySettings, updateUnifySettings, getSearchSettings, updateSearchSettings, fetchTavilyUsage } from '../unify/config-api.js';
-import { handleUnifyGroupChat, handleUnifyModeSwitch, handleUnifyModelSwitch, resetUnifySession, handleUnifyLoadHistory, handleUnifyLoadMoreHistory, handleUnifyAbortThread, handleUnifyAbortAll, handleUnifyAbortTurn, handleUnifyVpSubscribe, handleUnifyVpCreate, handleUnifyVpUpdate, handleUnifyVpDelete, handleUnifyVpRead, handleUnifyListGroups, handleUnifyCreateGroup, handleUnifyRenameGroup, handleUnifyUpdateGroup, handleUnifyArchiveGroup, handleUnifyDeleteGroup, handleUnifyAddMember, handleUnifyRemoveMember, handleUnifySetDefaultVp, handleUnifyDreamTrigger, handleUnifyFetchToolStats, handleUnifyFetchDebugHistory, broadcastLanguageChange } from '../unify/web-bridge.js';
+import { handleUnifyGroupChat, handleUnifyModeSwitch, handleUnifyModelSwitch, resetUnifySession, handleUnifyLoadHistory, handleUnifyLoadMoreHistory, handleUnifyAbortThread, handleUnifyAbortAll, handleUnifyAbortTurn, handleUnifyVpSubscribe, handleUnifyVpCreate, handleUnifyVpUpdate, handleUnifyVpDelete, handleUnifyVpRead, handleUnifyListGroups, handleUnifyCreateGroup, handleUnifyRenameGroup, handleUnifyUpdateGroup, handleUnifyUpdateGroupConfig, handleUnifyArchiveGroup, handleUnifyDeleteGroup, handleUnifyAddMember, handleUnifyRemoveMember, handleUnifySetDefaultVp, handleUnifyDreamTrigger, handleUnifyFetchToolStats, handleUnifyFetchDebugHistory, broadcastLanguageChange } from '../unify/web-bridge.js';
 
 export async function handleMessage(msg) {
   switch (msg.type) {
@@ -476,6 +476,9 @@ export async function handleMessage(msg) {
     case 'unify_update_group':
       handleUnifyUpdateGroup(msg);
       break;
+    case 'unify_update_group_config':
+      handleUnifyUpdateGroupConfig(msg);
+      break;
     case 'unify_archive_group':
       handleUnifyArchiveGroup(msg);
       break;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yeaft/webchat-agent",
-  "version": "0.1.803",
+  "version": "0.1.805",
   "description": "Remote agent for Yeaft WebChat — connects worker machines to the central server",
   "main": "index.js",
   "type": "module",

package/unify/conversation/persist.js

@@ -142,6 +142,33 @@ function serializeMessage(msg) {
     }
   }
 
+  // task-327d: persist Anthropic extended-thinking blocks so the next turn
+  // can echo them back with their server-signed signature. Both fields are
+  // base64'd: thinking is multi-line text, and the signature is opaque
+  // bytes that don't need to be human-readable. Without this round-trip
+  // the next Anthropic request 400s with "content[].thinking in the
+  // thinking mode must be passed back to the API".
+  if (msg.thinkingBlocks && msg.thinkingBlocks.length > 0) {
+    fm.push(`thinkingBlocks:`);
+    for (const tb of msg.thinkingBlocks) {
+      if (!tb || typeof tb.signature !== 'string' || !tb.signature) continue;
+      if (tb.redacted) {
+        if (typeof tb.data !== 'string') continue;
+        const dataB64 = Buffer.from(tb.data, 'utf8').toString('base64');
+        const signatureB64 = Buffer.from(tb.signature, 'utf8').toString('base64');
+        fm.push(`  - redacted: true`);
+        fm.push(`    dataB64: ${dataB64}`);
+        fm.push(`    signatureB64: ${signatureB64}`);
+      } else {
+        if (typeof tb.thinking !== 'string') continue;
+        const thinkingB64 = Buffer.from(tb.thinking, 'utf8').toString('base64');
+        const signatureB64 = Buffer.from(tb.signature, 'utf8').toString('base64');
+        fm.push(`  - thinkingB64: ${thinkingB64}`);
+        fm.push(`    signatureB64: ${signatureB64}`);
+      }
+    }
+  }
+
   fm.push('---');
   fm.push('');
   fm.push(content);
@@ -229,6 +256,44 @@ export function parseMessage(raw) {
     if (toolCalls.length > 0) msg.toolCalls = toolCalls;
   }
 
+  // task-327d: parse thinkingBlocks (mirror of toolCalls parser above)
+  if (frontmatter.includes('thinkingBlocks:')) {
+    const thinkingBlocks = [];
+    const tbMatch = frontmatter.match(/thinkingBlocks:\n((?:\s+-\s+[\s\S]*?)(?=\n\w|$))/);
+    if (tbMatch) {
+      const tbBlock = tbMatch[1];
+      const entries = tbBlock.split(/\n\s+-\s+/).filter(Boolean);
+      for (const entry of entries) {
+        const tb = {};
+        for (const line of entry.split('\n')) {
+          const trimmed = line.trim().replace(/^-\s+/, '');
+          const ci = trimmed.indexOf(':');
+          if (ci === -1) continue;
+          const k = trimmed.slice(0, ci).trim();
+          const v = trimmed.slice(ci + 1).trim();
+          if (k === 'thinkingB64') {
+            tb.thinking = Buffer.from(v, 'base64').toString('utf8');
+          } else if (k === 'dataB64') {
+            tb.data = Buffer.from(v, 'base64').toString('utf8');
+          } else if (k === 'signatureB64') {
+            tb.signature = Buffer.from(v, 'base64').toString('utf8');
+          } else if (k === 'redacted') {
+            tb.redacted = v === 'true';
+          }
+        }
+        // Both fields required — an unsigned block would 400 on replay.
+        if (tb.redacted) {
+          if (typeof tb.data === 'string' && typeof tb.signature === 'string' && tb.signature) {
+            thinkingBlocks.push(tb);
+          }
+        } else if (typeof tb.thinking === 'string' && typeof tb.signature === 'string' && tb.signature) {
+          thinkingBlocks.push(tb);
+        }
+      }
+    }
+    if (thinkingBlocks.length > 0) msg.thinkingBlocks = thinkingBlocks;
+  }
+
   return msg;
 }
 

package/unify/effort.js

@@ -13,7 +13,7 @@
  *   4. null (no effort = adapter/router drops the param)
  *
  * Red lines:
- *   • Never error on unknown scenario — default to 'high'.
+ *   • Never error on unknown scenario — default to 'max'.
  *   • Feature flag UNIFY_THINKING_V1 is enforced at the adapter/router
  *     layer; this module just computes the intended value. If the flag
  *     is off, adapters drop it anyway.
@@ -36,7 +36,8 @@ export const LONG_LOOP_TURN_THRESHOLD = 8;
  * a scenario string before invoking `pickEffort()`.
  *
  * Tiers (6 scenarios per architect spec):
- *   chat          → high   (default interactive pair-programming turn)
+ *   chat          → max    (default interactive pair-programming turn —
+ *                            quality over latency; per user 2026-05-22)
  *   consolidate   → max    (memory compaction — quality matters, runs once)
  *   dream         → max    (memory maintenance — same rationale)
  *   sub_agent     → max    (coordinator spawns + merges)
@@ -47,7 +48,7 @@ export const LONG_LOOP_TURN_THRESHOLD = 8;
  * Unknown scenarios fall through to 'high'.
  */
 export const SCENARIO_EFFORT = Object.freeze({
-  chat: 'high',
+  chat: 'max',
   consolidate: 'max',
   dream: 'max',
   sub_agent: 'max',
@@ -65,7 +66,7 @@ export const SCENARIO_EFFORT = Object.freeze({
  *      `/max` prefix, Settings slider, or API caller.
  *   2. If toolLoopTurns >= LONG_LOOP_TURN_THRESHOLD, upgrade the
  *      base scenario to 'long_loop' (→ 'max').
- *   3. Look up SCENARIO_EFFORT[scenario]; unknown → 'high'.
+ *   3. Look up SCENARIO_EFFORT[scenario]; unknown → 'max'.
  *
  * @param {object} ctx
  * @param {string} [ctx.scenario='chat'] — Scenario tag; see SCENARIO_EFFORT.
@@ -92,7 +93,7 @@ export function pickEffort({ scenario = 'chat', toolLoopTurns = 0, userEffort =
   }
 
   // 3. Scenario table lookup.
-  return SCENARIO_EFFORT[scenario] || 'high';
+  return SCENARIO_EFFORT[scenario] || 'max';
 }
 
 /**

package/unify/engine.js

@@ -1486,6 +1486,7 @@ export class Engine {
       let ttfbMs = null;  // Time to first token
       let responseText = '';
       const toolCalls = [];
+      const thinkingBlocks = []; // task-327d: collected from adapter for round-trip
       let stopReason = 'end_turn';
       const totalUsage = { inputTokens: 0, outputTokens: 0 };
       // task-344: capture redacted raw request / raw response for debug panel.
@@ -1660,6 +1661,22 @@ export class Engine {
             case 'thinking_delta':
               yield event;
               break;
+            case 'thinking_block_end':
+              // task-327d: collect server-signed thinking block for
+              // round-trip replay. Anthropic 400s the next turn if a
+              // thinking block (regular or redacted) was emitted but not
+              // echoed back with its original signature. Drop blocks
+              // missing a signature — replay-without-sig 400s identically.
+              if (event.signature) {
+                if (event.redacted) {
+                  thinkingBlocks.push({ redacted: true, data: event.data, signature: event.signature });
+                } else {
+                  thinkingBlocks.push({ thinking: event.thinking, signature: event.signature });
+                }
+              } else {
+                console.warn('[Engine] thinking block missing signature — dropping; next turn would 400 on replay');
+              }
+              break;
             case 'tool_call':
               toolCalls.push(event);
               yield event;
@@ -1843,6 +1860,17 @@ export class Engine {
           input: tc.input,
         }));
       }
+      // task-327d: persist thinking blocks for the next turn's replay.
+      // Anthropic requires assistant.thinking blocks to be echoed back
+      // verbatim (text + signature) when the previous turn used extended
+      // thinking — see translateMessages in anthropic.js.
+      if (thinkingBlocks.length > 0) {
+        assistantMsg.thinkingBlocks = thinkingBlocks.map(tb => (
+          tb.redacted
+            ? { redacted: true, data: tb.data, signature: tb.signature }
+            : { thinking: tb.thinking, signature: tb.signature }
+        ));
+      }
       // Phase 8 (DESIGN.md §9.15): carry the router plan back on the
       // assistant message that produced it. Stripped at the wire by
       // stripMetaForWire — pure bookkeeping for priorPlan continuity.

package/unify/groups/group-config.js

@@ -0,0 +1,167 @@
+/**
+ * group-config.js — Per-group configuration overrides.
+ *
+ * Each group may carry its own `config.json` at
+ *   ~/.yeaft/groups/<groupId>/config.json
+ *
+ * v1 schema (intentionally tiny — extend via additive keys only):
+ *   {
+ *     "model": "my-proxy/claude-sonnet-4-20250514"   // optional
+ *   }
+ *
+ * Missing file → empty object. Missing field → fall back to user-level
+ * config (`~/.yeaft/config.json` via loadConfig()). Resolution is a
+ * shallow overlay (group fields override user fields when truthy).
+ *
+ * Storage layer only — no engine wiring, no validation of model strings
+ * against the provider registry (that's done lazily at resolve time by
+ * the engine when it tries to dispatch to AdapterRouter).
+ */
+
+import { existsSync, readFileSync } from 'fs';
+import { join } from 'path';
+import { writeAtomic } from '../storage/index.js';
+import { groupsRoot, resolveGroupYeaftDir } from './group-crud.js';
+
+const CONFIG_FILE = 'config.json';
+
+/** Whitelist of fields a group may override. Reject everything else. */
+const ALLOWED_KEYS = new Set(['model']);
+
+export class GroupConfigError extends Error {
+  constructor(code, message) {
+    super(message || code);
+    this.name = 'GroupConfigError';
+    this.code = code;
+  }
+}
+
+/**
+ * Resolve the on-disk path for a group's config.json. Honours the
+ * per-group workDir registry so groups bound to a project directory
+ * keep their config alongside the group meta.
+ */
+export function groupConfigPath(yeaftDir, groupId) {
+  if (!yeaftDir) return null;
+  const groupYeaftDir = resolveGroupYeaftDir(yeaftDir, groupId);
+  return join(groupsRoot(groupYeaftDir), groupId, CONFIG_FILE);
+}
+
+/**
+ * Read a group's config.json. Returns `{}` when the file is missing or
+ * corrupt — callers fall back to user-level defaults via
+ * `resolveGroupConfig`. We never auto-write on read.
+ *
+ * @param {string} yeaftDir
+ * @param {string} groupId
+ * @returns {object}
+ */
+export function loadGroupConfig(yeaftDir, groupId) {
+  if (!groupId || !yeaftDir) return {};
+  const path = groupConfigPath(yeaftDir, groupId);
+  if (!path || !existsSync(path)) return {};
+  try {
+    const parsed = JSON.parse(readFileSync(path, 'utf8'));
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) return {};
+    // Strip unknown keys at read time too — defensive against
+    // hand-edited files that predate a key removal.
+    const out = {};
+    for (const k of Object.keys(parsed)) {
+      if (ALLOWED_KEYS.has(k)) out[k] = parsed[k];
+    }
+    return out;
+  } catch {
+    return {};
+  }
+}
+
+/**
+ * Validate a partial group-config object. Throws GroupConfigError on
+ * any unknown key or malformed value. Empty / null values for known
+ * keys are allowed — they signal "fall back to user default".
+ *
+ * @param {object} cfg
+ */
+export function validateGroupConfig(cfg) {
+  if (cfg === null || cfg === undefined) return;
+  if (typeof cfg !== 'object' || Array.isArray(cfg)) {
+    throw new GroupConfigError('invalid_shape', 'config must be an object');
+  }
+  for (const k of Object.keys(cfg)) {
+    if (!ALLOWED_KEYS.has(k)) {
+      throw new GroupConfigError('unknown_key', `unknown config key: ${k}`);
+    }
+  }
+  if ('model' in cfg && cfg.model !== null && cfg.model !== undefined && cfg.model !== '') {
+    if (typeof cfg.model !== 'string' || !cfg.model.trim()) {
+      throw new GroupConfigError('invalid_model', 'model must be a non-empty string');
+    }
+  }
+}
+
+/**
+ * Shallow-merge `partial` into the group's existing config.json and
+ * persist atomically. Returns the resulting object. Passing `null` or
+ * empty string for a known key removes that key (so the group falls
+ * back to the user default).
+ *
+ * @param {string} yeaftDir
+ * @param {string} groupId
+ * @param {object} partial
+ * @returns {object}
+ */
+export function saveGroupConfig(yeaftDir, groupId, partial) {
+  if (!groupId) throw new GroupConfigError('missing_group_id', 'groupId required');
+  validateGroupConfig(partial);
+  const current = loadGroupConfig(yeaftDir, groupId);
+  const next = { ...current };
+  for (const [k, v] of Object.entries(partial || {})) {
+    if (!ALLOWED_KEYS.has(k)) continue;
+    if (v === null || v === undefined || v === '') {
+      delete next[k];
+    } else {
+      next[k] = typeof v === 'string' ? v.trim() : v;
+    }
+  }
+  const path = groupConfigPath(yeaftDir, groupId);
+  writeAtomic(path, `${JSON.stringify(next, null, 2)}\n`);
+  return next;
+}
+
+/**
+ * Initialise an empty config.json next to a brand-new group. Idempotent —
+ * leaves an existing file untouched. Called by `createGroupFromSpec`.
+ */
+export function ensureGroupConfigFile(yeaftDir, groupId) {
+  const path = groupConfigPath(yeaftDir, groupId);
+  if (!path || existsSync(path)) return;
+  try {
+    writeAtomic(path, `${JSON.stringify({}, null, 2)}\n`);
+  } catch {
+    // Best-effort — a permission failure here should never break group
+    // create. Read path returns {} on missing file anyway.
+  }
+}
+
+/**
+ * Resolve the effective config for a group by overlaying group-level
+ * overrides on top of the user-level config.
+ *
+ * Only fields that the per-group schema knows about are overlaid;
+ * everything else (providers, language, token budgets, ...) is taken
+ * verbatim from the user config.
+ *
+ * @param {object} userConfig — loadConfig() result
+ * @param {object} groupConfig — loadGroupConfig() result
+ * @returns {object} — A new config object safe to hand to the engine.
+ */
+export function resolveGroupConfig(userConfig, groupConfig) {
+  const base = userConfig ? { ...userConfig } : {};
+  const overrides = groupConfig && typeof groupConfig === 'object' ? groupConfig : {};
+  if (overrides.model && typeof overrides.model === 'string' && overrides.model.trim()) {
+    const model = overrides.model.trim();
+    base.model = model;
+    base.primaryModel = model;
+  }
+  return base;
+}

package/unify/groups/group-crud.js

@@ -53,6 +53,7 @@ import { seedDefaultGroup, DEFAULT_GROUP_ID } from './seed-default.js';
 import { nextGroupId, validateVpId, isReservedVpId } from './ids.js';
 import { scanVpLibrary, DEFAULT_VP_LIB_DIR } from '../vp/vp-store.js';
 import { seedSummaryIfMissingSync, removeScopeDirSync } from '../memory/store-v2.js';
+import { ensureGroupConfigFile, saveGroupConfig, loadGroupConfig } from './group-config.js';
 
 /**
  * Default memory root used when callers don't pass `options.memoryRoot`.
@@ -263,6 +264,20 @@ export function createGroupFromSpec(yeaftDir, spec, options = {}) {
   handle.close();
   if (normalizedWorkDir) registerGroupWorkDir(yeaftDir, id, normalizedWorkDir);
 
+  // Per-group config (v1: model only). We always create an empty
+  // config.json so the file's presence signals "owned by this group" and
+  // hand-editing tools can find a stub. Initial overrides from the
+  // wizard spec (currently just `config.model`) are persisted here so
+  // the engine cache picks them up on the very first turn.
+  try {
+    ensureGroupConfigFile(yeaftDir, id);
+    if (spec && spec.config && typeof spec.config === 'object') {
+      saveGroupConfig(yeaftDir, id, spec.config);
+    }
+  } catch (err) {
+    console.warn(`[group-crud] failed to seed config.json for ${id}:`, err?.message || err);
+  }
+
   // Seed Layer-A resident summary so the first session has memory content
   // even before Dream-v2 has run. No-op if a summary.md already exists.
   // Best-effort: a memory-root permission failure must NOT break group create.
@@ -313,6 +328,22 @@ export function updateGroupAnnouncement(yeaftDir, groupId, text) {
   return next;
 }
 
+/**
+ * (A.2.c) Update per-group config overrides (v1: just `model`).
+ * Returns the persisted config object so the caller can broadcast it.
+ *
+ * Throws GroupConfigError on validation failure (unknown key, bad type).
+ * Group must exist (we call requireGroup to assert).
+ */
+export function updateGroupConfig(yeaftDir, groupId, partial) {
+  const handle = requireGroup(yeaftDir, groupId);
+  try {
+    return saveGroupConfig(yeaftDir, groupId, partial || {});
+  } finally {
+    handle.close();
+  }
+}
+
 /**
  * (A.3) Archive — renames the dir to `.archived-<ts>-<id>`. Directory
  * prefix `.` keeps `listGroups` from picking it up (readdirSync filter in
@@ -488,6 +519,11 @@ export function snapshotGroups(yeaftDir) {
     const meta = existsSync(dir) ? loadGroupMeta(dir) : null;
     if (meta) byId.set(meta.id, meta);
   }
+  // Attach per-group config overrides (v1: just `model`). Frontend can
+  // render the effective model without re-querying.
+  for (const meta of byId.values()) {
+    meta.config = loadGroupConfig(yeaftDir, meta.id);
+  }
   return Array.from(byId.values()).sort((a, b) => String(a.createdAt || '').localeCompare(String(b.createdAt || '')));
 }
 

package/unify/groups/index.js

@@ -50,7 +50,16 @@ export {
   removeMember,
   setGroupDefaultVp,
   snapshotGroups,
+  updateGroupConfig,
+  updateGroupAnnouncement,
 } from './group-crud.js';
+export {
+  loadGroupConfig,
+  saveGroupConfig,
+  resolveGroupConfig,
+  validateGroupConfig,
+  GroupConfigError,
+} from './group-config.js';
 export {
   nextMsgId,
   nextGroupId,

package/unify/llm/adapter.js

@@ -40,20 +40,23 @@
 /**
  * @typedef {{ type: 'text_delta', text: string }} TextDeltaEvent
  * @typedef {{ type: 'thinking_delta', text: string }} ThinkingDeltaEvent
+ * @typedef {{ type: 'thinking_block_end', thinking: string, signature: string }} ThinkingBlockEndEvent
  * @typedef {{ type: 'tool_call', id: string, name: string, input: object }} ToolCallEvent
  * @typedef {{ type: 'usage', inputTokens: number, outputTokens: number, cacheReadTokens?: number, cacheWriteTokens?: number }} UsageEvent
  * @typedef {{ type: 'stop', stopReason: 'end_turn' | 'tool_use' | 'max_tokens' }} StopEvent
  * @typedef {{ type: 'error', error: Error, retryable: boolean }} ErrorEvent
  *
- * @typedef {TextDeltaEvent | ThinkingDeltaEvent | ToolCallEvent | UsageEvent | StopEvent | ErrorEvent} StreamEvent
+ * @typedef {TextDeltaEvent | ThinkingDeltaEvent | ThinkingBlockEndEvent | ToolCallEvent | UsageEvent | StopEvent | ErrorEvent} StreamEvent
  */
 
 // ─── Unified Message Types ─────────────────────────────────────
 
 /**
+ * @typedef {{ thinking: string, signature: string }} ThinkingBlock
+ *
  * @typedef {{ role: 'system', content: string }} SystemMessage
  * @typedef {{ role: 'user', content: string }} UserMessage
- * @typedef {{ role: 'assistant', content: string, toolCalls?: UnifiedToolCall[] }} AssistantMessage
+ * @typedef {{ role: 'assistant', content: string, toolCalls?: UnifiedToolCall[], thinkingBlocks?: ThinkingBlock[] }} AssistantMessage
  * @typedef {{ role: 'tool', toolCallId: string, content: string, isError?: boolean }} ToolMessage
  *
  * @typedef {SystemMessage | UserMessage | AssistantMessage | ToolMessage} UnifiedMessage

package/unify/llm/anthropic.js

@@ -73,6 +73,24 @@ export class AnthropicAdapter extends LLMAdapter {
         result.push({ role: 'user', content: msg.content });
       } else if (msg.role === 'assistant') {
         const content = [];
+        // task-327d: Anthropic requires thinking blocks to appear BEFORE
+        // any text / tool_use in the content array on echo-back. When the
+        // previous turn produced thinking blocks (with server-signed
+        // signature), we MUST replay them verbatim or the next request
+        // 400s with "content[].thinking in the thinking mode must be
+        // passed back to the API". Order is mandatory.
+        if (Array.isArray(msg.thinkingBlocks)) {
+          for (const tb of msg.thinkingBlocks) {
+            if (!tb || typeof tb.signature !== 'string' || !tb.signature) continue;
+            if (tb.redacted) {
+              if (typeof tb.data !== 'string') continue;
+              content.push({ type: 'redacted_thinking', data: tb.data, signature: tb.signature });
+            } else {
+              if (typeof tb.thinking !== 'string') continue;
+              content.push({ type: 'thinking', thinking: tb.thinking, signature: tb.signature });
+            }
+          }
+        }
         if (msg.content) {
           content.push({ type: 'text', text: msg.content });
         }
@@ -216,9 +234,16 @@ export class AnthropicAdapter extends LLMAdapter {
     const reader = response.body.getReader();
     const decoder = new TextDecoder();
     let buffer = '';
-    let currentToolCallId = null;
-    let currentToolName = null;
-    let currentToolInput = '';
+    // task-327d: index-keyed per-block state. Anthropic streams content
+    // blocks sequentially today, but the protocol exposes `event.index`
+    // precisely because that's not guaranteed. Dispatch in
+    // content_block_stop must look up by index, never "whichever scalar
+    // happens to still be set." States by kind: 'tool_use', 'thinking',
+    // 'redacted_thinking'. Redacted blocks carry opaque `data` instead
+    // of `thinking` text but share the same echo-back rule (drop without
+    // signature → next turn 400s identically).
+    /** @type {Map<number, { kind: string, [k: string]: any }>} */
+    const blockByIndex = new Map();
     // Accumulate raw SSE body verbatim for the debug panel. No truncation:
     // see `redactRawRequest` in adapter.js for the verbatim-design rationale.
     // Push-then-join keeps allocation bounded for multi-MiB payloads (avoids
@@ -254,38 +279,90 @@ export class AnthropicAdapter extends LLMAdapter {
 
           if (type === 'content_block_start') {
             const block = event.content_block;
+            const idx = event.index;
             if (block?.type === 'tool_use') {
-              currentToolCallId = block.id;
-              currentToolName = block.name;
-              currentToolInput = '';
+              blockByIndex.set(idx, {
+                kind: 'tool_use',
+                id: block.id,
+                name: block.name,
+                input: '',
+              });
+            } else if (block?.type === 'thinking') {
+              blockByIndex.set(idx, {
+                kind: 'thinking',
+                thinking: typeof block.thinking === 'string' ? block.thinking : '',
+                signature: typeof block.signature === 'string' ? block.signature : '',
+              });
+            } else if (block?.type === 'redacted_thinking') {
+              // task-327d: API-redacted thinking. Body is opaque `data`
+              // (server-encrypted, not user-readable); we still need to
+              // echo it back with signature on the next turn or the API
+              // 400s with the same "must be passed back" error.
+              blockByIndex.set(idx, {
+                kind: 'redacted_thinking',
+                data: typeof block.data === 'string' ? block.data : '',
+                signature: typeof block.signature === 'string' ? block.signature : '',
+              });
             }
           } else if (type === 'content_block_delta') {
             const delta = event.delta;
+            const idx = event.index;
+            const st = blockByIndex.get(idx);
             if (delta?.type === 'text_delta') {
               yield { type: 'text_delta', text: delta.text };
             } else if (delta?.type === 'thinking_delta') {
+              // Forward delta for live UI; ALSO accumulate for round-trip.
+              if (st && st.kind === 'thinking') st.thinking += delta.thinking || '';
               yield { type: 'thinking_delta', text: delta.thinking };
+            } else if (delta?.type === 'signature_delta') {
+              // Anthropic typically sends signature in one delta near the
+              // end of the (redacted_)thinking block. Accumulate defensively.
+              if (st && (st.kind === 'thinking' || st.kind === 'redacted_thinking')) {
+                st.signature += delta.signature || '';
+              }
             } else if (delta?.type === 'input_json_delta') {
-              currentToolInput += delta.partial_json;
+              if (st && st.kind === 'tool_use') st.input += delta.partial_json;
             }
           } else if (type === 'content_block_stop') {
-            if (currentToolCallId) {
+            const idx = event.index;
+            const st = blockByIndex.get(idx);
+            if (!st) {
+              // Unknown / unhandled block kind (e.g. text — we don't track
+              // text state because text_delta is forwarded immediately).
+            } else if (st.kind === 'tool_use') {
               let parsedInput = {};
               try {
-                parsedInput = currentToolInput ? JSON.parse(currentToolInput) : {};
+                parsedInput = st.input ? JSON.parse(st.input) : {};
               } catch {
                 parsedInput = {};
               }
               yield {
                 type: 'tool_call',
-                id: currentToolCallId,
-                name: currentToolName,
+                id: st.id,
+                name: st.name,
                 input: parsedInput,
               };
-              currentToolCallId = null;
-              currentToolName = null;
-              currentToolInput = '';
+            } else if (st.kind === 'thinking' || st.kind === 'redacted_thinking') {
+              // task-327d: emit ONE end-of-block event with the assembled
+              // payload + signature. Engine collects these for replay.
+              // We emit even when signature is empty so engine can
+              // warn-and-drop; replaying without signature would 400.
+              if (st.kind === 'thinking') {
+                yield {
+                  type: 'thinking_block_end',
+                  thinking: st.thinking,
+                  signature: st.signature,
+                };
+              } else {
+                yield {
+                  type: 'thinking_block_end',
+                  redacted: true,
+                  data: st.data,
+                  signature: st.signature,
+                };
+              }
             }
+            blockByIndex.delete(idx);
           } else if (type === 'message_delta') {
             const stopReason = event.delta?.stop_reason;
             if (stopReason) {

package/unify/web-bridge.js

@@ -45,6 +45,8 @@ import {
   groupsRoot,
 } from './groups/group-crud.js';
 import { openGroup, loadGroupMeta } from './groups/group-store.js';
+import { loadGroupConfig, resolveGroupConfig, GroupConfigError } from './groups/group-config.js';
+import { updateGroupConfig } from './groups/group-crud.js';
 import { createCoordinator } from './groups/coordinator.js';
 import { seedDefaultGroup } from './groups/seed-default.js';
 import {
@@ -760,10 +762,16 @@ function getOrCreateVpEngine(groupId, vpId, threadId = 'main') {
   let eng = vpEngines.get(key);
   if (eng) return eng;
   if (!session) throw new Error('getOrCreateVpEngine: session not loaded');
+  // Per-group config overlay (v1: model only). Falls back to the
+  // session's user-level config when no override is set. The resolver
+  // never mutates session.config — it returns a new object.
+  const yeaftDir = ctx.CONFIG?.yeaftDir || session.yeaftDir;
+  const groupCfg = loadGroupConfig(yeaftDir, groupId);
+  const effectiveConfig = resolveGroupConfig(session.config, groupCfg);
   eng = new Engine({
     adapter: session.adapter,
     trace: session.trace,
-    config: session.config,
+    config: effectiveConfig,
     conversationStore: session.conversationStore,
     memoryIndex: session.memoryIndex || null,
     amsRegistry: session.amsRegistry,
@@ -1318,8 +1326,11 @@ function sendGroupRosterChanged(group) {
 }
 
 function groupErrorPayload(err) {
+  let code = 'unknown';
+  if (err instanceof GroupCrudError) code = err.code;
+  else if (err instanceof GroupConfigError) code = err.code;
   return {
-    code: err instanceof GroupCrudError ? err.code : 'unknown',
+    code,
     groupId: err && err.groupId,
     message: err && err.message,
   };
@@ -1404,6 +1415,36 @@ export function handleUnifyUpdateGroup(msg) {
   }
 }
 
+/**
+ * Update per-group config overrides (v1: `model`). Cache invalidation:
+ * drop every cached Engine whose key starts with `${groupId}::` so the
+ * next turn picks up the new model. The group meta itself is untouched.
+ *
+ * Payload: { groupId, requestId, config: { model?: string|null } }
+ *  - `model: ''` or `null` clears the override (group falls back to user default).
+ */
+export function handleUnifyUpdateGroupConfig(msg) {
+  const requestId = msg && msg.requestId;
+  const groupId = msg && msg.groupId;
+  const partial = (msg && msg.config && typeof msg.config === 'object') ? msg.config : null;
+  try {
+    if (!groupId) throw new GroupConfigError('missing_group_id', 'groupId required');
+    if (!partial) throw new GroupConfigError('invalid_patch', 'config object required');
+    const yeaftDir = ctx.CONFIG?.yeaftDir;
+    const savedConfig = updateGroupConfig(yeaftDir, groupId, partial);
+    // Drop cached engines so the next VP turn rebuilds with the new model.
+    const prefix = `${groupId}::`;
+    for (const k of Array.from(vpEngines.keys())) {
+      if (k.startsWith(prefix)) vpEngines.delete(k);
+    }
+    invalidateGroupContext(groupId);
+    sendGroupCrudResult({ op: 'update_config', requestId, ok: true, groupId, config: savedConfig });
+    sendGroupSnapshotBroadcast();
+  } catch (err) {
+    sendGroupCrudResult({ op: 'update_config', requestId, ok: false, error: groupErrorPayload(err) });
+  }
+}
+
 export function handleUnifyArchiveGroup(msg) {
   const requestId = msg && msg.requestId;
   const groupId = msg && msg.groupId;
@@ -1610,7 +1651,7 @@ function maybeTransitionVpStatus(hctx, state) {
  * todos, debug cards, and persistence all share the same boundary.
  *
  * @param {object} event — engine event (text_delta / tool_call / …)
- * @param {{assistantTextParts:string[], toolCallsAccum:Array, toolResultsAccum:Array, resetQueryTimer:Function, groupId?:string, vpId?:string, turnId?:string}} hctx
+ * @param {{assistantTextParts:string[], toolCallsAccum:Array, toolResultsAccum:Array, thinkingBlocksAccum?:Array, resetQueryTimer:Function, groupId?:string, vpId?:string, turnId?:string}} hctx
  */
 function handleEngineEvent(event, hctx) {
   hctx.resetQueryTimer();
@@ -1638,6 +1679,30 @@ function handleEngineEvent(event, hctx) {
       sendUnifyEvent({ type: 'thinking_delta', text: event.text }, envelope);
       break;
 
+    case 'thinking_block_end':
+      // task-327d: capture the assembled thinking block (with server-
+      // signed signature) so the group history we hand to subsequent
+      // turns / VPs includes it. Without this echo Anthropic 400s the
+      // next request with "content[].thinking in the thinking mode must
+      // be passed back to the API". The signature stays server-side
+      // only — wire serializers (stripMetaForWire / sendUnifyOutput)
+      // never reference thinkingBlocks, so it cannot leak to the UI.
+      if (hctx.thinkingBlocksAccum && event.signature) {
+        if (event.redacted) {
+          hctx.thinkingBlocksAccum.push({
+            redacted: true,
+            data: event.data,
+            signature: event.signature,
+          });
+        } else {
+          hctx.thinkingBlocksAccum.push({
+            thinking: event.thinking,
+            signature: event.signature,
+          });
+        }
+      }
+      break;
+
     case 'tool_call':
       // Capture tool_call for the assistant message's toolCalls array so
       // the next turn's history pairs `tool_calls` with `role:'tool'`
@@ -2493,6 +2558,7 @@ async function runVpTurn({ prompt, promptParts = null, groupId, vpId, threadId =
       const assistantTextParts = [];
       const toolCallsAccum = [];
       const toolResultsAccum = [];
+      const thinkingBlocksAccum = []; // task-327d: round-trip to next turn
       const appendedUserPrompts = [];
       let vpEngine = null;
 
@@ -2518,6 +2584,7 @@ async function runVpTurn({ prompt, promptParts = null, groupId, vpId, threadId =
         assistantTextParts,
         toolCallsAccum,
         toolResultsAccum,
+        thinkingBlocksAccum,
         resetQueryTimer,
         groupId,
         vpId,
@@ -2558,7 +2625,7 @@ async function runVpTurn({ prompt, promptParts = null, groupId, vpId, threadId =
       }
 
       // Turn completed — atomically append this VP's output to shared history.
-      appendTurnToGroupHistory(groupId, threadId, [prompt, ...appendedUserPrompts], assistantTextParts, toolCallsAccum, toolResultsAccum);
+      appendTurnToGroupHistory(groupId, threadId, [prompt, ...appendedUserPrompts], assistantTextParts, toolCallsAccum, toolResultsAccum, thinkingBlocksAccum);
 
       sendUnifyOutput({
         type: 'assistant',
@@ -2664,7 +2731,7 @@ async function runVpTurn({ prompt, promptParts = null, groupId, vpId, threadId =
  * a session, this in-memory tape carries the un-collapsed form — which
  * is fine because each VP turn's `engine.query` re-collapses on the fly.
  */
-function appendTurnToGroupHistory(groupId, threadId, prompts, assistantTextParts, toolCallsAccum, toolResultsAccum) {
+function appendTurnToGroupHistory(groupId, threadId, prompts, assistantTextParts, toolCallsAccum, toolResultsAccum, thinkingBlocksAccum) {
   if (!groupId) return;
   const history = getOrCreateGroupHistory(groupId);
   const promptList = Array.isArray(prompts) ? prompts : [prompts];
@@ -2684,6 +2751,18 @@ function appendTurnToGroupHistory(groupId, threadId, prompts, assistantTextParts
         input: tc.input,
       }));
     }
+    // task-327d: carry thinking blocks across turns. Anthropic protocol
+    // requires us to echo them back on the next request or the API
+    // returns "content[].thinking in the thinking mode must be passed
+    // back to the API". The signature is server-private — it stays in
+    // this in-memory history and in agent-side persistence only.
+    if (Array.isArray(thinkingBlocksAccum) && thinkingBlocksAccum.length > 0) {
+      assistantMsg.thinkingBlocks = thinkingBlocksAccum.map(tb => (
+        tb.redacted
+          ? { redacted: true, data: tb.data, signature: tb.signature }
+          : { thinking: tb.thinking, signature: tb.signature }
+      ));
+    }
     history.push(assistantMsg);
 
     for (const tr of toolResultsAccum) {