agent-nuvira 3.5.5 → 3.5.7

package/dist/web-dashboard/server.d.ts

@@ -10,6 +10,7 @@
  * Opens at: http://localhost:3030
  */
 import { createServer } from 'node:http';
+import { type DependencyStatus } from '../learning/runtime-dependencies.js';
 import type { WireFinding } from '../findings/verdicts.js';
 import { WhatsAppPairingManager } from './whatsapp-pairing.js';
 import { ChatConsole } from './chat-console.js';
@@ -304,6 +305,38 @@ export declare function readTracesData(): {
 };
 /** Full trace detail (steps included) for the replay view. */
 export declare function readTraceDetail(id: string): DashboardTrace | null;
+/**
+ * One runtime tool the agent uses but does not ship, as the System page's panel
+ * needs it. Mirrored by `RuntimeTool` in the dashboard's `types.ts` — the same
+ * split `AdminProviderSummary` uses, so the wire shape is stated where it is
+ * produced and where it is rendered, not imported across the boundary.
+ *
+ * The server maps the DECLARATION into this DTO rather than shipping the whole
+ * dependency object: the panel renders, it does not decide, and the internal
+ * probe list has no business on the wire.
+ */
+interface RuntimeTool {
+    id: string;
+    label: string;
+    need: 'recommended' | 'optional';
+    /** Whether the server found it on THIS machine. */
+    present: boolean;
+    /** What installing it buys, one sentence. */
+    enables: string;
+    /** The tools that need it (cited under the row). */
+    neededBy: string[];
+    /** The command for this OS, or null when no one-liner applies here. */
+    installCommand: string | null;
+    /** The caveat that bites, shown with the command. */
+    note?: string;
+    /** True when running it needs a human (sudo, a GUI installer). */
+    needsHumanInput: boolean;
+}
+/**
+ * One runtime tool as the panel's payload. Exported for the server test, which
+ * asserts the panel is fed the same list `nuvira doctor` prints.
+ */
+export declare function runtimeToolSummary(status: DependencyStatus): RuntimeTool;
 /** Test hook: swap the chat console (e.g. a fake engine) — routes read the
  * module variable at request time, so this works anytime. The Phase 4
  * DAG-telemetry hook is re-attached to the replacement. */

package/dist/web-dashboard/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/web-dashboard/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,YAAY,EAAmC,MAAM,WAAW,CAAC;AAgB1E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAwC3D,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAE,WAAW,EAA4C,MAAM,mBAAmB,CAAC;AAC1F,OAAO,EAAmB,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAuLvE,4DAA4D;AAC5D,wBAAgB,mBAAmB,IAAI,OAAO,CAE7C;AAED,4FAA4F;AAC5F,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI,CAOxD;AAuHD,6DAA6D;AAC7D,wBAAgB,eAAe,CAAC,KAAK,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,CAKrG;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,cAAc,GAAG,IAAI,CAK9D;AA8OD;;;GAGG;AACH,UAAU,OAAO;IACf,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,QAAQ,CAAC;IACvD,WAAW,EAAE,MAAM,CAAC;IACpB,+EAA+E;IAC/E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,UAAU,OAAO;IACf,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;CACZ;AAcD,6CAA6C;AAC7C,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,CAAC,EAAE,OAAO,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,gFAAgF;AAChF,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,uEAAuE;IACvE,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,qBAAqB,EAAE,CAAC;IACnC,aAAa,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,MAAM,EAAE,OAAO,CAAC;CACjB;AASD;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAI5F;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAcpG;AAED,sEAAsE;AACtE,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,qBAAqB,GAAG,IAAI,CAMpE;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE;IACjC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB,GAAG,IAAI,CAcP;AAED,0EAA0E;AAC1E,wBAAgB,aAAa,IAAI,IAAI,CAGpC;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE;IACpC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,GAAG,aAAa,CAAC,CAAC,CAAC;IACzD,KAAK,EAAE,OAAO,EAAE,CAAC;CAClB,GAAG,IAAI,CAyBP;AAED,oFAAoF;AACpF,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE;IAAE,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAc3G;AAED,gDAAgD;AAChD,wBAAgB,QAAQ,IAAI,IAAI,CAa/B;AAmCD,uEAAuE;AACvE,wBAAgB,WAAW,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAuErD;AAID;;;GAGG;AACH,UAAU,aAAa;IACrB,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,QAAQ,CAAC;IACvD,WAAW,EAAE,MAAM,CAAC;IACpB,+EAA+E;IAC/E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6DAA6D;IAC7D,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,iFAAiF;AACjF,UAAU,WAAW;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,aAAa,EAAE,CAAC;IACxB,6DAA6D;IAC7D,MAAM,CAAC,EAAE,UAAU,GAAG,MAAM,CAAC;IAC7B,iEAAiE;IACjE,aAAa,CAAC,EAAE;QACd,aAAa,EAAE,MAAM,CAAC;QACtB,gBAAgB,EAAE,MAAM,CAAC;QACzB,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,gBAAgB,CAAC,EAAE,OAAO,CAAC;QAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;CACH;AAeD;;GAEG;AACH,wBAAgB,gBAAgB,IAAI;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,WAAW,EAAE,CAAA;CAAE,CAMzE;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,WAAW,GAAG,QAAQ,CAAC;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,mBAAmB,EAAE,CAAC;CACnC;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,IAAI;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,iBAAiB,EAAE,CAAA;CAAE,CA8BjF;AAkGD,kFAAkF;AAClF,UAAU,kBAAkB;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE;QACR,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,CAAC;QACd,UAAU,EAAE,MAAM,CAAC;QACnB,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;CACH;AAED,UAAU,cAAc;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;OAKG;IACH,OAAO,CAAC,EAAE;QACR,IAAI,EAAE,UAAU,GAAG,OAAO,GAAG,QAAQ,GAAG,WAAW,GAAG,YAAY,CAAC;QACnE,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;QACjB,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,eAAe,CAAC,EAAE,OAAO,CAAC;QAC1B,kBAAkB,CAAC,EAAE,OAAO,CAAC;QAC7B,gFAAgF;QAChF,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB,0DAA0D;QAC1D,mBAAmB,CAAC,EAAE,OAAO,CAAC;QAC9B,yEAAyE;QACzE,oBAAoB,CAAC,EAAE,OAAO,CAAC;QAC/B,6EAA6E;QAC7E,mBAAmB,CAAC,EAAE,OAAO,CAAC;KAC/B,CAAC;IACF;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,WAAW,EAAE,CAAC;IACzB;;;;;OAKG;IACH,WAAW,CAAC,EAAE;QAAE,OAAO,EAAE,UAAU,GAAG,UAAU,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,KAAK,GAAG,WAAW,CAAA;KAAE,CAAC;IAC5F,KAAK,EAAE,kBAAkB,EAAE,CAAC;CAC7B;AAgBD;;;;GAIG;AACH,wBAAgB,cAAc,IAAI;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC,GAAG;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAChH,CAgBA;AAED,8DAA8D;AAC9D,wBAAgB,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAGjE;AAulED;;2DAE2D;AAC3D,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,WAAW,GAAG,IAAI,CAgBhE;AAED;;;;GAIG;AACH,wBAAsB,wBAAwB,IAAI,OAAO,CAAC,IAAI,CAAC,CAE9D;AA4BD;;;GAGG;AACH,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,IAAI,GAAG,IAAI,CAE7E;AAeD,4EAA4E;AAC5E,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,CAAC,MAAM,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC,GAAG,IAAI,GAClF,IAAI,CAEN;AAOD;;;;GAIG;AACH,UAAU,mBAAmB;IAC3B,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,UAAU,gBAAgB;IACxB,MAAM,EAAE,MAAM,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAC3C,KAAK,EAAE,MAAM,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,mBAAmB,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACrG,IAAI,EAAE,MAAM,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC1E;AAUD,qFAAqF;AACrF,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,gBAAgB,GAAG,IAAI,GAAG,IAAI,CAEjF;AAYD;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,sBAAsB,GAAG,IAAI,CAE/E;AA0kKD,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,UAAU,CAAC,OAAO,YAAY,CAAC,CAAC;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;;;OAQG;IACH,QAAQ,CAAC,EAAE,UAAU,CAAC,OAAO,YAAY,CAAC,CAAC;CAC5C;AAED,wBAAgB,qBAAqB,CACnC,IAAI,CAAC,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GACtC,qBAAqB,CA6GvB;AAqkBD,eAAO,MAAM,kBAAkB;;;CAAiB,CAAC"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/web-dashboard/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,YAAY,EAAmC,MAAM,WAAW,CAAC;AAe1E,OAAO,EAGL,KAAK,gBAAgB,EACtB,MAAM,qCAAqC,CAAC;AAE7C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AA+C3D,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAE,WAAW,EAA4C,MAAM,mBAAmB,CAAC;AAC1F,OAAO,EAAmB,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAC;AA2NvE,4DAA4D;AAC5D,wBAAgB,mBAAmB,IAAI,OAAO,CAE7C;AAED,4FAA4F;AAC5F,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI,CAOxD;AAuHD,6DAA6D;AAC7D,wBAAgB,eAAe,CAAC,KAAK,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,CAKrG;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,cAAc,GAAG,IAAI,CAK9D;AA8OD;;;GAGG;AACH,UAAU,OAAO;IACf,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,QAAQ,CAAC;IACvD,WAAW,EAAE,MAAM,CAAC;IACpB,+EAA+E;IAC/E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,UAAU,OAAO;IACf,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;CACZ;AAcD,6CAA6C;AAC7C,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,CAAC,EAAE,OAAO,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,gFAAgF;AAChF,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,uEAAuE;IACvE,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,qBAAqB,EAAE,CAAC;IACnC,aAAa,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,MAAM,EAAE,OAAO,CAAC;CACjB;AASD;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAI5F;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAcpG;AAED,sEAAsE;AACtE,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,qBAAqB,GAAG,IAAI,CAMpE;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE;IACjC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB,GAAG,IAAI,CAcP;AAED,0EAA0E;AAC1E,wBAAgB,aAAa,IAAI,IAAI,CAGpC;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE;IACpC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,GAAG,aAAa,CAAC,CAAC,CAAC;IACzD,KAAK,EAAE,OAAO,EAAE,CAAC;CAClB,GAAG,IAAI,CAyBP;AAED,oFAAoF;AACpF,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE;IAAE,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAc3G;AAED,gDAAgD;AAChD,wBAAgB,QAAQ,IAAI,IAAI,CAa/B;AAmCD,uEAAuE;AACvE,wBAAgB,WAAW,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAuErD;AAID;;;GAGG;AACH,UAAU,aAAa;IACrB,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,QAAQ,CAAC;IACvD,WAAW,EAAE,MAAM,CAAC;IACpB,+EAA+E;IAC/E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6DAA6D;IAC7D,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,iFAAiF;AACjF,UAAU,WAAW;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,aAAa,EAAE,CAAC;IACxB,6DAA6D;IAC7D,MAAM,CAAC,EAAE,UAAU,GAAG,MAAM,CAAC;IAC7B,iEAAiE;IACjE,aAAa,CAAC,EAAE;QACd,aAAa,EAAE,MAAM,CAAC;QACtB,gBAAgB,EAAE,MAAM,CAAC;QACzB,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,gBAAgB,CAAC,EAAE,OAAO,CAAC;QAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;CACH;AAeD;;GAEG;AACH,wBAAgB,gBAAgB,IAAI;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,WAAW,EAAE,CAAA;CAAE,CAMzE;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,WAAW,GAAG,QAAQ,CAAC;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,mBAAmB,EAAE,CAAC;CACnC;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,IAAI;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,iBAAiB,EAAE,CAAA;CAAE,CA8BjF;AAkGD,kFAAkF;AAClF,UAAU,kBAAkB;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE;QACR,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,CAAC;QACd,UAAU,EAAE,MAAM,CAAC;QACnB,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;CACH;AAED,UAAU,cAAc;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;OAKG;IACH,OAAO,CAAC,EAAE;QACR,IAAI,EAAE,UAAU,GAAG,OAAO,GAAG,QAAQ,GAAG,WAAW,GAAG,YAAY,CAAC;QACnE,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;QACjB,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,eAAe,CAAC,EAAE,OAAO,CAAC;QAC1B,kBAAkB,CAAC,EAAE,OAAO,CAAC;QAC7B,gFAAgF;QAChF,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB,0DAA0D;QAC1D,mBAAmB,CAAC,EAAE,OAAO,CAAC;QAC9B,yEAAyE;QACzE,oBAAoB,CAAC,EAAE,OAAO,CAAC;QAC/B,6EAA6E;QAC7E,mBAAmB,CAAC,EAAE,OAAO,CAAC;KAC/B,CAAC;IACF;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,WAAW,EAAE,CAAC;IACzB;;;;;OAKG;IACH,WAAW,CAAC,EAAE;QAAE,OAAO,EAAE,UAAU,GAAG,UAAU,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,KAAK,GAAG,WAAW,CAAA;KAAE,CAAC;IAC5F,KAAK,EAAE,kBAAkB,EAAE,CAAC;CAC7B;AAgBD;;;;GAIG;AACH,wBAAgB,cAAc,IAAI;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC,GAAG;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAChH,CAgBA;AAED,8DAA8D;AAC9D,wBAAgB,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAGjE;AA+3DD;;;;;;;;;GASG;AACH,UAAU,WAAW;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,aAAa,GAAG,UAAU,CAAC;IACjC,mDAAmD;IACnD,OAAO,EAAE,OAAO,CAAC;IACjB,6CAA6C;IAC7C,OAAO,EAAE,MAAM,CAAC;IAChB,oDAAoD;IACpD,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,uEAAuE;IACvE,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,qDAAqD;IACrD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kEAAkE;IAClE,eAAe,EAAE,OAAO,CAAC;CAC1B;AAyKD;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,gBAAgB,GAAG,WAAW,CAexE;AA4JD;;2DAE2D;AAC3D,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,WAAW,GAAG,IAAI,CAgBhE;AAED;;;;GAIG;AACH,wBAAsB,wBAAwB,IAAI,OAAO,CAAC,IAAI,CAAC,CAE9D;AA4BD;;;GAGG;AACH,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,IAAI,GAAG,IAAI,CAE7E;AAeD,4EAA4E;AAC5E,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,CAAC,MAAM,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC,GAAG,IAAI,GAClF,IAAI,CAEN;AAOD;;;;GAIG;AACH,UAAU,mBAAmB;IAC3B,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,UAAU,gBAAgB;IACxB,MAAM,EAAE,MAAM,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAC3C,KAAK,EAAE,MAAM,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,mBAAmB,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACrG,IAAI,EAAE,MAAM,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC1E;AAUD,qFAAqF;AACrF,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,gBAAgB,GAAG,IAAI,GAAG,IAAI,CAEjF;AAYD;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,sBAAsB,GAAG,IAAI,CAE/E;AAqtKD,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,UAAU,CAAC,OAAO,YAAY,CAAC,CAAC;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;;;OAQG;IACH,QAAQ,CAAC,EAAE,UAAU,CAAC,OAAO,YAAY,CAAC,CAAC;CAC5C;AAED,wBAAgB,qBAAqB,CACnC,IAAI,CAAC,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GACtC,qBAAqB,CAwHvB;AAqkBD,eAAO,MAAM,kBAAkB;;;CAAiB,CAAC"}

package/dist/web-dashboard/server.js

@@ -25,7 +25,9 @@ import { loadEnv } from '../utils/env.js';
 import { ConfigManager } from '../config/manager.js';
 import { parseRuntimeSpec } from '../mcp/runtime.js';
 import { runAllChecks } from '../cli/doctor.js';
+import { dependencySummary, probeRuntimeDependencies, } from '../learning/runtime-dependencies.js';
 import { getAutoRouter } from '../learning/auto-router.js';
+import { classifyEntries, } from '../learning/cost-classification.js';
 import { acceptanceSummary, collectLabelledTurns, serializeLabelledTurns, parseCorpusText, detectCorpusFormat, mergeImportedLabels, } from '../learning/acceptance-model.js';
 import { readDecisions, recallDecisions, reviseDecision } from '../learning/decision-log.js';
 import { degradedCallsFromTraces } from '../learning/reasoning-trace.js';
@@ -54,6 +56,7 @@ import { isCuratedProcessEnvVar, normalizeProcessEnvValue, } from '../config/pro
 import { FRESH_DAYS, FRESHNESS_COPY, REACHABILITY_COPY, classifyFreshness, classifyReachability, } from '../learning/model-reachability.js';
 import { VERIFY_BACKLOG_DEFAULT_PER_RUN, VERIFY_BACKLOG_MAX_PER_RUN, getVerifyBacklogState, startVerifyBacklogRun, } from '../learning/model-verify-job.js';
 import { setToolsetEnabled } from '../tools/toolsets.js';
+import { ArtifactStore } from '../tools/artifact-store.js';
 import { setSkillEnabled } from '../learning/hub-skill-catalog.js';
 // I11 — dashboard channel send-test: the same registry/adapters `nuvira gateway
 // send` uses, so a Channels-tab test message behaves identically to the CLI.
@@ -67,6 +70,7 @@ import { ChannelDirectory, PLATFORM_ENV_VARS, platformConfigVars } from '../gate
 import { applyEnvToProcess, configurablePlatforms, envVarState, platformConfigStatus, platformEnvVarMeta, redactValue, writeEnvFile, } from '../gateway/platform-config.js';
 import { SERVICE_CATALOG, getServiceDefinition, } from '../config/service-catalog.js';
 import { probeService } from '../config/service-probe.js';
+import { pruneScratchWorkspaces } from '../config/scratch-workspace.js';
 // ─── Constants ──────────────────────────────────────────────────────────────
 const PORT = parseInt(envBuff('DASHBOARD_PORT') || '3030', 10);
 const HOST = envBuff('DASHBOARD_HOST') || '127.0.0.1';
@@ -118,6 +122,40 @@ let alwaysWatchQuota = false;
  * loadApiKeysFromConfig uses). Best-effort — a missing/corrupt config just
  * keeps the default (false = arm-on-connect only).
  */
+/**
+ * The content type for an artifact file: the recorded mime when there is one,
+ * otherwise the extension. Video and image types are the ones the panel renders
+ * inline, so a wrong type is a blank frame rather than a failed download.
+ */
+function artifactFileMime(file, recorded) {
+    if (recorded && /^[a-z]+\/[a-z0-9.+-]+$/i.test(recorded))
+        return recorded;
+    const ext = (file.split('.').pop() ?? '').toLowerCase();
+    const byExt = {
+        mp4: 'video/mp4',
+        webm: 'video/webm',
+        mov: 'video/quicktime',
+        mkv: 'video/x-matroska',
+        gif: 'image/gif',
+        png: 'image/png',
+        jpg: 'image/jpeg',
+        jpeg: 'image/jpeg',
+        webp: 'image/webp',
+        svg: 'image/svg+xml',
+        mp3: 'audio/mpeg',
+        wav: 'audio/wav',
+        m4a: 'audio/mp4',
+        srt: 'application/x-subrip',
+        vtt: 'text/vtt',
+        json: 'application/json',
+        md: 'text/markdown',
+        txt: 'text/plain',
+        log: 'text/plain',
+        csv: 'text/csv',
+        pdf: 'application/pdf',
+    };
+    return byExt[ext] ?? 'application/octet-stream';
+}
 function loadAlwaysWatchQuotaFlag() {
     try {
         const configPath = resolveBuffConfigPath();
@@ -1513,9 +1551,52 @@ function readCostData() {
     if (!data?.entries) {
         // The empty state deliberately omits `recent` entirely (the dashboard reads
         // a missing list as "nothing recorded"), matching the other zero counters.
-        return { totalRequests: 0, totalCost: 0, byProvider: {}, byModel: {} };
+        return {
+            totalRequests: 0,
+            totalCost: 0,
+            byProvider: {},
+            byModel: {},
+            billedUsd: 0,
+            billedReportedUsd: 0,
+            billedListedUsd: 0,
+            unverifiedListedUsd: 0,
+            notBilledValueUsd: 0,
+            unpricedCalls: 0,
+            unpricedTokens: 0,
+            recomputedCalls: 0,
+            testOriginCalls: 0,
+            // No invoice has been checked yet — stated, not implied.
+            reconciliations: [],
+        };
     }
     const entries = data.entries;
+    // ── The classified view (ONE judgement for every surface) ────────────────
+    // The Cost page's headline used to be `totalCost` — the sum of a column the
+    // ledger had priced from its own hardcoded table — printed under the words
+    // "Total Spent". It is now split by EVIDENCE: what was billed (provider-reported
+    // exact + list-priced with a declared paid account), the value a free tier
+    // absorbed, the list-priced rows whose tier is undeclared, and the calls with no
+    // price at all. Test-origin rows are excluded here: a row written by a test run
+    // is not the user's usage (the model registry takes the same posture).
+    const classified = classifyEntries(entries, {
+        excludeTestOrigin: true,
+    });
+    const byProviderBilled = {};
+    const byProviderUnverified = {};
+    const byProviderValue = {};
+    const byProviderUnpricedCalls = {};
+    const byModelBilled = {};
+    const byModelValue = {};
+    for (const [provider, t] of Object.entries(classified.byProvider)) {
+        byProviderBilled[provider] = t.billedUsd;
+        byProviderUnverified[provider] = t.unverifiedListedUsd;
+        byProviderValue[provider] = t.notBilledValueUsd;
+        byProviderUnpricedCalls[provider] = t.unpricedCalls;
+    }
+    for (const [model, t] of Object.entries(classified.byModel)) {
+        byModelBilled[model] = t.billedUsd;
+        byModelValue[model] = t.notBilledValueUsd;
+    }
     const totalCost = entries.reduce((s, e) => s + (typeof e.costUsd === 'number' ? e.costUsd : 0), 0);
     const totalTokens = entries.reduce((s, e) => s + (typeof e.totalTokens === 'number' ? e.totalTokens : 0), 0);
     const byProvider = {};
@@ -1567,9 +1648,53 @@ function readCostData() {
         measured: e.measured === true,
         reported: e.costReported === true,
     }));
+    // ── Invoice checks: the only EXTERNAL figures on this page ───────────────
+    // Written by `nuvira stats cost reconcile` when the operator enters the
+    // provider's own charge for a window. Everything else here is an estimate of
+    // money owed; this is the one place the page can be compared against what was
+    // ACTUALLY charged. Read straight from the file (no module import) so the
+    // dashboard keeps resolving its own memory dir, and capped like `recent`.
+    const reconciliationFile = readJSON(join(MEMORY_DIR, 'cost-reconciliations.json'));
+    const reconciliations = (Array.isArray(reconciliationFile?.reconciliations) ? reconciliationFile.reconciliations : [])
+        .filter((r) => r && typeof r.provider === 'string' && typeof r.invoiceUsd === 'number')
+        .slice(0, 20)
+        .map((r) => ({
+        provider: r.provider,
+        invoiceUsd: r.invoiceUsd,
+        billedUsd: r.billedUsd,
+        deltaUsd: r.deltaUsd,
+        verdict: r.verdict,
+        since: r.since,
+        until: r.until,
+        recordedAt: r.recordedAt,
+        ...(r.note ? { note: r.note } : {}),
+        ...(r.tierEvidence ? { tier: r.tierEvidence.tier } : {}),
+    }));
     return {
         totalRequests: entries.length,
         totalCost: Math.round(totalCost * 100000) / 100000,
+        // The evidence-backed figures. `totalCost` above is kept for compatibility
+        // (it is the ledger total as recorded, including rows priced by the retired
+        // hardcoded table); these are what the page headlines.
+        billedUsd: classified.billedUsd,
+        billedReportedUsd: classified.billedReportedUsd,
+        billedListedUsd: classified.billedListedUsd,
+        billedReportedCalls: classified.billedReportedCalls,
+        billedListedCalls: classified.billedListedCalls,
+        unverifiedListedUsd: classified.unverifiedListedUsd,
+        unverifiedListedCalls: classified.unverifiedListedCalls,
+        notBilledValueUsd: classified.notBilledValueUsd,
+        notBilledValueCalls: classified.notBilledValueCalls,
+        unpricedCalls: classified.unpricedCalls,
+        unpricedTokens: classified.unpricedTokens,
+        recomputedCalls: classified.recomputedCalls,
+        testOriginCalls: classified.testOriginCalls,
+        byProviderBilled,
+        byProviderUnverified,
+        byProviderValue,
+        byProviderUnpricedCalls,
+        byModelBilled,
+        byModelValue,
         totalTokens,
         byProvider,
         byModel,
@@ -1581,6 +1706,7 @@ function readCostData() {
         estimatedCost: Math.round(estimatedCost * 100000) / 100000,
         reportedCalls,
         reportedCost: Math.round(reportedCost * 100000) / 100000,
+        reconciliations,
         recent,
     };
 }
@@ -2718,14 +2844,42 @@ function buildServiceRow(def, canReadValues) {
         envVars,
     };
 }
+/**
+ * One runtime tool as the panel's payload. Exported for the server test, which
+ * asserts the panel is fed the same list `nuvira doctor` prints.
+ */
+export function runtimeToolSummary(status) {
+    return {
+        id: status.dependency.id,
+        label: status.dependency.label,
+        need: status.dependency.need,
+        present: status.present,
+        enables: status.dependency.enables,
+        neededBy: status.dependency.neededBy,
+        // A tool the machine ALREADY has gets no command on the wire, the same way
+        // `nuvira doctor` prints a fix only for what is missing: sending one anyway
+        // invites a user to reinstall something that is working.
+        installCommand: status.present ? null : status.installCommand,
+        note: status.dependency.note,
+        needsHumanInput: status.needsHumanInput,
+    };
+}
 /** Run ALL state checks — the dashboard command-runner payload. */
 async function runAdminChecks() {
     const configManager = new ConfigManager();
     const { system, enterprise } = await runAllChecks(configManager);
+    // The SAME declaration the CLI's `nuvira doctor`, the `--fix` installer and the
+    // setup scripts read, probed once for this payload. The rows are also in
+    // `system` (one check each) because a pass/warn verdict is what a check list
+    // is for; this is the actionable half — the command to copy, the
+    // recommended/optional split, and the caveat.
+    const statuses = probeRuntimeDependencies();
     return {
         system,
         enterprise,
         providers: buildAdminProviderSummary(configManager),
+        runtimeTools: statuses.map(runtimeToolSummary),
+        runtimeToolsSummary: dependencySummary(statuses),
         serverTime: Date.now(),
     };
 }
@@ -3223,6 +3377,52 @@ function handleRequest(req, res) {
         })();
         return;
     }
+    // ── An artifact's BYTES — how the Artifacts tab shows a rendered video rather
+    // than a filename. The path is looked up in OUR OWN artifact store by (session,
+    // artifact id) and is never taken from the query string, so a caller cannot ask
+    // this endpoint for an arbitrary file; a bad pair is a 404, not a read.
+    if (pathname === '/api/artifact-file') {
+        const sessionId = url.searchParams.get('session') ?? '';
+        const artifactId = url.searchParams.get('artifact') ?? '';
+        const artifact = artifactId
+            ? new ArtifactStore().read(sessionId).find((a) => a.id === artifactId)
+            : undefined;
+        if (!artifact || !artifact.path || !existsSync(artifact.path) || !statSync(artifact.path).isFile()) {
+            writeJson(res, 404, { ok: false, error: 'No such artifact file.' });
+            return;
+        }
+        const size = statSync(artifact.path).size;
+        const type = artifactFileMime(artifact.path, artifact.mime);
+        // Range support, because a <video> that cannot seek cannot be reviewed: a
+        // player asks for byte ranges the moment the user drags the scrubber.
+        const range = /^bytes=(\d*)-(\d*)$/.exec(req.headers.range ?? '');
+        if (range) {
+            const start = range[1] ? Number(range[1]) : 0;
+            const end = range[2] ? Math.min(Number(range[2]), size - 1) : size - 1;
+            if (start >= size || end < start) {
+                res.writeHead(416, { 'Content-Range': `bytes */${size}` });
+                res.end();
+                return;
+            }
+            res.writeHead(206, {
+                'Content-Type': type,
+                'Content-Length': String(end - start + 1),
+                'Content-Range': `bytes ${start}-${end}/${size}`,
+                'Accept-Ranges': 'bytes',
+                'Cache-Control': 'no-store',
+            });
+            createReadStream(artifact.path, { start, end }).pipe(res);
+            return;
+        }
+        res.writeHead(200, {
+            'Content-Type': type,
+            'Content-Length': String(size),
+            'Accept-Ranges': 'bytes',
+            'Cache-Control': 'no-store',
+        });
+        createReadStream(artifact.path).pipe(res);
+        return;
+    }
     if (pathname === '/api/benchmarks') {
         res.writeHead(200, { 'Content-Type': 'application/json' });
         res.end(JSON.stringify(readBenchmarkData()));
@@ -3302,7 +3502,17 @@ function handleRequest(req, res) {
             res.end(JSON.stringify(payload));
         }).catch((err) => {
             res.writeHead(500, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify({ error: String(err), system: [], enterprise: [], providers: [], serverTime: Date.now() }));
+            res.end(JSON.stringify({
+                error: String(err),
+                system: [],
+                enterprise: [],
+                providers: [],
+                // An empty list, not a missing one: the panel must be able to say
+                // "nothing reported" on a failed run rather than crash on undefined.
+                runtimeTools: [],
+                runtimeToolsSummary: 'unavailable — the checks run failed',
+                serverTime: Date.now(),
+            }));
         });
         return;
     }
@@ -7216,7 +7426,27 @@ function handleRequest(req, res) {
         // `busy` lets a client that reloaded mid-turn know the answer is still being
         // produced, so it can keep the bubble alive and poll instead of showing a
         // finished-looking thread.
-        writeJson(res, 200, { ok: true, session: { id, ...rec, busy: chatConsole.isBusy(id) } });
+        // `pendingQuestion` rides with the transcript because a reload has to be
+        // able to SEE an open question, not just guess at it from `busy`. The turn
+        // holding for an answer reports `busy: true` exactly like one that is
+        // working, so without this the resumed page showed "⏳ Still working on the
+        // server" for a turn that was waiting on the user (measured 2026-10-14:
+        // trace-1791996357488-wpm352 sat in `ask_user` for 5m02s and was cancelled
+        // with the question never on screen).
+        // `busySince` is when the RUNNING turn started, so a client that gave up on
+        // its own POST (a 5-minute ceiling) or reloaded mid-turn reports how long
+        // the wait really is rather than counting from whenever it attached
+        // (measured 2026-10-14: a 664s turn shown as "1m 25s elapsed").
+        writeJson(res, 200, {
+            ok: true,
+            session: {
+                id,
+                ...rec,
+                busy: chatConsole.isBusy(id),
+                ...(chatConsole.busySince(id) !== null ? { busySince: chatConsole.busySince(id) } : {}),
+                ...(chatConsole.pendingQuestionFor(id) ? { pendingQuestion: chatConsole.pendingQuestionFor(id) } : {}),
+            },
+        });
         return;
     }
     // GET /api/continuity — the stored session snapshots + the semantic recall
@@ -7489,13 +7719,51 @@ function handleRequest(req, res) {
              */
             const configuredCwd = resolveDashboardCwd();
             const { resolveTurnWorkspace, formatWorkspaceNoticeText } = await import('./workspace-resolution.js');
+            const { workspaceNeedForMissingFolder } = await import('./workspace-guard.js');
             const sessionProjectPath = chatConsole.get(sessionId)?.projectPath;
-            const workspace = resolveTurnWorkspace({
+            /**
+             * The same ladder, asked twice when the last rung is needed.
+             *
+             * WHY TWO PASSES. The scratch folder is a real directory on disk, so it is
+             * only created when the ladder has actually RUN OUT (nothing attached,
+             * nothing named in the message, no configured default) AND the ask needs
+             * somewhere to PUT new work. Creating it eagerly would leave an empty
+             * temporary folder behind on every turn that already had a folder, and
+             * handing it to a READ ask would be the kuttaaddon defect again — an empty
+             * folder cannot answer "assess this project".
+             */
+            const resolveWorkspaceNow = (scratchPath) => resolveTurnWorkspace({
                 ...(attachedPath ? { attachedPath } : {}),
                 ...(sessionProjectPath ? { sessionPath: sessionProjectPath } : {}),
                 ...(configuredCwd ? { configuredCwd } : {}),
                 message,
+                ...(scratchPath ? { scratchPath } : {}),
             });
+            let workspace = resolveWorkspaceNow();
+            /**
+             * What this ask needs a folder FOR — `'produce'` is the case a temporary
+             * folder can serve, `'read'` is the case it cannot (and keeps the folder
+             * prompt), `null` is plain chat, which needs none.
+             */
+            const missingWorkspaceNeed = workspace.path ? null : workspaceNeedForMissingFolder(message);
+            if (missingWorkspaceNeed === 'produce') {
+                // The scratch folder is offered through the SAME rule the gateway uses
+                // (`scratchWorkspaceForTurn`), so the two surfaces cannot disagree about
+                // when a temporary folder is the right answer — in particular about an
+                // ISOLATED turn, which a scratch folder can never serve: it has no base
+                // commit to diff against. There, this turn has no folder at all, so it
+                // falls through to the folder request below rather than isolating a
+                // directory the user never chose.
+                const { scratchWorkspaceForTurn } = await import('../config/scratch-workspace.js');
+                const { resolveIsolationRequest } = await import('../tools/worktree.js');
+                const scratch = scratchWorkspaceForTurn({
+                    key: sessionId,
+                    need: missingWorkspaceNeed,
+                    isolationAsked: resolveIsolationRequest({ worktree }).asked,
+                });
+                if (scratch)
+                    workspace = resolveWorkspaceNow(scratch);
+            }
             if (workspace.path) {
                 projectPath = workspace.path;
                 const bundle = getProjectBundle(workspace.path);
@@ -7513,24 +7781,23 @@ function handleRequest(req, res) {
              * needs no caption.
              */
             const workspaceNotice = formatWorkspaceNoticeText(workspace);
-            // No workspace and no configured default: an ask that names a project, or
-            // that produces/consumes files, gets a folder request instead of an answer
-            // about the wrong tree. General chat is unaffected.
-            if (!workspace.path) {
-                const { needsProjectAttachment, projectAttachmentPrompt, projectAttachmentFollowups } = await import('./workspace-guard.js');
-                if (needsProjectAttachment(message)) {
-                    writeJson(res, 200, {
-                        ok: true,
-                        sessionId,
-                        content: projectAttachmentPrompt(),
-                        followups: projectAttachmentFollowups(),
-                        provider: null,
-                        model: null,
-                        generationFailed: false,
-                        needsProject: true,
-                    });
-                    return;
-                }
+            // Still no workspace: either the ask must READ or CHANGE work that already
+            // exists (a temporary folder holds none of it), or the scratch folder could
+            // not be created. Both are the case for a folder request rather than an
+            // answer about the wrong tree. General chat — `null` — is unaffected.
+            if (!workspace.path && missingWorkspaceNeed !== null) {
+                const { projectAttachmentPrompt, projectAttachmentFollowups } = await import('./workspace-guard.js');
+                writeJson(res, 200, {
+                    ok: true,
+                    sessionId,
+                    content: projectAttachmentPrompt(),
+                    followups: projectAttachmentFollowups(),
+                    provider: null,
+                    model: null,
+                    generationFailed: false,
+                    needsProject: true,
+                });
+                return;
             }
             // P4 (revised) — a client DISCONNECT no longer cancels the turn. It used
             // to: the server treated `res` close as an abort, which meant a page
@@ -7568,6 +7835,14 @@ function handleRequest(req, res) {
             const result = await withStrictModel(strict, () => chatConsole.answer(sessionId, message, {
                 provider,
                 model,
+                // P8b — the STRICT half of the pin rides into the console so the
+                // CONVERSATION can remember it. `withStrictModel` above scopes it to
+                // this turn, but a conversation whose lock is forgotten between turns
+                // is a pin the user cannot actually rely on: measured live
+                // (trace-1792068695325-42wb1j) the pin survived a reload and the lock
+                // did not, so the engine handed the turn to another model with the
+                // user's "this model only" instruction never in force.
+                strict,
                 projectContext,
                 projectPath,
                 // Cluster G — carry the "no folder attached" state into the turn so a
@@ -7636,7 +7911,12 @@ function handleRequest(req, res) {
                     routingNotice = `Auto routing took over: this turn ran on ${served} because your pinned ${requested} was not available. To work with ${requested} only, enable strict model mode.`;
                 }
                 else if (result.generationFailed === true) {
-                    routingNotice = `Your pinned ${requested} could not complete this turn, so auto routing may hand the work to another model. To stay on this model only, enable strict model mode.`;
+                    // The turn ran on the pair the user pinned and stopped there. Saying
+                    // "auto routing may hand the work to another model" described the old
+                    // behaviour (a pinned turn followed the health ranking the moment its
+                    // pair returned an error) and would now be a lie: a pin waits on itself
+                    // and then asks. See `pinnedEscalation`.
+                    routingNotice = `Your pinned ${requested} did not answer, and nothing was sent to another model — the turn stopped instead of substituting. Retry it, or switch models.`;
                 }
             }
             // Did the offer we are about to send get a mechanism behind it? The client
@@ -7949,6 +8229,17 @@ function handleRequest(req, res) {
             'X-Accel-Buffering': 'no',
         });
         res.write(`event: init\ndata: ${JSON.stringify({ sessionId })}\n\n`);
+        // A question asked BEFORE this client attached is still waiting for an
+        // answer, and the turn will hold until one arrives. Replaying it here is
+        // what makes a reload (or a second tab) able to ANSWER it: without this the
+        // new page shows a "still working" notice and no choice card at all, while
+        // the turn waits on a reply the page has no way to send — the exact
+        // "the model asked something but nothing appeared on screen" report
+        // (2026-10-14, trace-1791996357488-wpm352, 5m02s in `ask_user`).
+        const pendingQuestion = chatConsole.pendingQuestionFor(sessionId);
+        if (pendingQuestion) {
+            res.write(`event: question\ndata: ${JSON.stringify(pendingQuestion)}\n\n`);
+        }
         const heartbeat = setInterval(() => {
             try {
                 res.write(': heartbeat\n\n');
@@ -8228,6 +8519,18 @@ export function createDashboardServer(opts) {
             handle.ipv6Twin = undefined;
         }
     }
+    // Scratch workspaces are temporary BY DEFINITION, so the ones nobody came back
+    // to are cleaned on boot rather than accumulating in the user's home for the
+    // life of the install (see `pruneScratchWorkspaces`). Best-effort: a failed
+    // prune must never stop the server from coming up.
+    try {
+        const removed = pruneScratchWorkspaces();
+        if (removed > 0)
+            console.log(`  🧹 Removed ${removed} expired scratch workspace(s)`);
+    }
+    catch {
+        /* best-effort */
+    }
     server.listen(bindPort, bindHost, () => {
         console.log(`\n  🌐 Agent-Nuvira Dashboard`);
         console.log(`  ─────────────────────────`);