bazilion 0.1.0 → 0.1.1

package/dist/daemon.js

@@ -541,12 +541,32 @@ Fill this in during your first conversation. Make it yours.
 `;
 var DEFAULT_BOOTSTRAP = `# BOOTSTRAP.md \u2014 First Run
 
-You just woke up. There is no memory yet \u2014 that's normal.
+You just woke up. There is no memory yet \u2014 that's normal. This is a multi-turn
+ritual: ask ONE question per turn and wait for the human's reply before moving
+on. Do not race through it. Do not call any tool until the ritual is finished.
 
-## What to do
-1. Ask your human who they are and what they want to call you.
-2. Call the \`home_write\` tool with \`file: "IDENTITY.md"\` and new content that captures your name, vibe, and emoji. Do NOT use the generic \`edit\` / \`write\` tools for this \u2014 those land in your workspace, not your private home, and would collide with other agents.
-3. Call \`bootstrap_done\` when finished \u2014 it removes this file so it does not appear in future sessions.
+## The ritual
+
+**Turn 1 (right now):** Greet the human warmly and ask a single opening
+question \u2014 what should they call you, or what should you focus on for them.
+Do NOT call any tool yet. Just reply with greeting + one question.
+
+**Turn 2+:** Continue with one more question per turn to fill in the rest of
+your identity \u2014 vibe (warm / sharp / playful / calm / \u2026), an emoji that
+feels right. Each turn is acknowledging the previous answer + at most one
+new question. Skip a turn when you already have enough.
+
+**Final turn:** Once you have everything (Name, Vibe, Emoji), call \`home_write\`
+with \`file: "IDENTITY.md"\` and the populated content. Do NOT use the generic
+\`edit\` / \`write\` tools \u2014 those land in the shared workspace.
+
+Then call \`bootstrap_done\` to retire this ritual file. After that, future
+sessions skip the bootstrap and start from IDENTITY.md directly.
+
+## Hard rules
+- Do not invent a name on your own. Ask the human and use what they say.
+- Do not call \`home_write\` or \`bootstrap_done\` on your very first reply.
+- One question per turn. Wait for the human to answer.
 `;
 
 // ../daemon/src/core/profile/create.ts
@@ -903,6 +923,25 @@ function updateProfile(db, paths, id, input) {
 // ../daemon/src/core/services.ts
 var SERVICES = [
   // --- LLM providers (configured via API keys / URLs) ---
+  // Top 3: openai-codex (ChatGPT OAuth), openai (API key), anthropic.
+  // Everything else in rough popularity order; locals last.
+  {
+    id: "openai-codex",
+    displayName: "OpenAI ChatGPT (OAuth)",
+    category: "provider",
+    hint: "Use your ChatGPT Plus/Pro/Team account (same login as Codex CLI)",
+    // No form fields — credentials come from an OAuth flow. The /config page
+    // renders a Connect/Disconnect card using /api/auth/openai instead of the
+    // standard field inputs.
+    fields: []
+  },
+  {
+    id: "openai",
+    displayName: "OpenAI",
+    category: "provider",
+    hint: "GPT models \xB7 platform.openai.com",
+    fields: [{ envVar: "OPENAI_API_KEY", kind: "secret", label: "API key", placeholder: "sk-..." }]
+  },
   {
     id: "anthropic",
     displayName: "Anthropic",
@@ -918,23 +957,6 @@ var SERVICES = [
       }
     ]
   },
-  {
-    id: "openai",
-    displayName: "OpenAI",
-    category: "provider",
-    hint: "GPT models \xB7 platform.openai.com",
-    fields: [{ envVar: "OPENAI_API_KEY", kind: "secret", label: "API key", placeholder: "sk-..." }]
-  },
-  {
-    id: "openai-codex",
-    displayName: "OpenAI ChatGPT (OAuth)",
-    category: "provider",
-    hint: "Use your ChatGPT Plus/Pro/Team account (same login as Codex CLI)",
-    // No form fields — credentials come from an OAuth flow. The /config page
-    // renders a Connect/Disconnect card using /api/auth/openai instead of the
-    // standard field inputs.
-    fields: []
-  },
   {
     id: "google",
     displayName: "Google (Gemini)",
@@ -977,6 +999,27 @@ var SERVICES = [
     hint: "Authenticates via AWS SDK env (AWS_PROFILE or AWS_ACCESS_KEY_ID/SECRET)",
     fields: []
   },
+  {
+    id: "github-copilot",
+    displayName: "GitHub Copilot",
+    category: "provider",
+    hint: "Use a GitHub Copilot subscription to call Claude/GPT/Gemini via Copilot",
+    fields: [
+      {
+        envVar: "COPILOT_GITHUB_TOKEN",
+        kind: "secret",
+        label: "GitHub token",
+        description: "Generic GH_TOKEN/GITHUB_TOKEN are ignored \u2014 set this scoped variable explicitly (or run `bazilion auth copilot login` once available)."
+      }
+    ]
+  },
+  {
+    id: "deepseek",
+    displayName: "DeepSeek",
+    category: "provider",
+    hint: "DeepSeek V4 Flash / Pro \xB7 platform.deepseek.com",
+    fields: [{ envVar: "DEEPSEEK_API_KEY", kind: "secret", label: "API key" }]
+  },
   {
     id: "mistral",
     displayName: "Mistral",
@@ -984,6 +1027,13 @@ var SERVICES = [
     hint: "mistral.ai",
     fields: [{ envVar: "MISTRAL_API_KEY", kind: "secret", label: "API key" }]
   },
+  {
+    id: "xai",
+    displayName: "xAI",
+    category: "provider",
+    hint: "Grok \xB7 x.ai",
+    fields: [{ envVar: "XAI_API_KEY", kind: "secret", label: "API key" }]
+  },
   {
     id: "groq",
     displayName: "Groq",
@@ -998,11 +1048,46 @@ var SERVICES = [
     fields: [{ envVar: "CEREBRAS_API_KEY", kind: "secret", label: "API key" }]
   },
   {
-    id: "xai",
-    displayName: "xAI",
+    id: "fireworks",
+    displayName: "Fireworks AI",
     category: "provider",
-    hint: "Grok \xB7 x.ai",
-    fields: [{ envVar: "XAI_API_KEY", kind: "secret", label: "API key" }]
+    hint: "DeepSeek/GLM/Kimi via fireworks.ai",
+    fields: [{ envVar: "FIREWORKS_API_KEY", kind: "secret", label: "API key" }]
+  },
+  {
+    id: "together",
+    displayName: "Together AI",
+    category: "provider",
+    hint: "Open-weight models \xB7 together.ai",
+    fields: [{ envVar: "TOGETHER_API_KEY", kind: "secret", label: "API key" }]
+  },
+  {
+    id: "moonshotai",
+    displayName: "Moonshot AI",
+    category: "provider",
+    hint: "Kimi K2/K2.5/K2.6 \xB7 platform.moonshot.ai",
+    fields: [{ envVar: "MOONSHOT_API_KEY", kind: "secret", label: "API key" }]
+  },
+  {
+    id: "kimi-coding",
+    displayName: "Kimi Coding",
+    category: "provider",
+    hint: "Coding-tuned Kimi endpoint \xB7 platform.moonshot.cn",
+    fields: [{ envVar: "KIMI_API_KEY", kind: "secret", label: "API key" }]
+  },
+  {
+    id: "minimax",
+    displayName: "MiniMax",
+    category: "provider",
+    hint: "MiniMax M2 family \xB7 platform.minimaxi.com",
+    fields: [{ envVar: "MINIMAX_API_KEY", kind: "secret", label: "API key" }]
+  },
+  {
+    id: "xiaomi",
+    displayName: "Xiaomi MiMo",
+    category: "provider",
+    hint: "API billing endpoint \xB7 platform.xiaomimimo.com",
+    fields: [{ envVar: "XIAOMI_API_KEY", kind: "secret", label: "API key" }]
   },
   {
     id: "zai",
@@ -1017,6 +1102,27 @@ var SERVICES = [
     hint: "Inference endpoints \xB7 huggingface.co",
     fields: [{ envVar: "HF_TOKEN", kind: "secret", label: "Access token", placeholder: "hf_..." }]
   },
+  {
+    id: "cloudflare-ai-gateway",
+    displayName: "Cloudflare AI Gateway",
+    category: "provider",
+    hint: "Per-gateway routing to OpenAI/Anthropic/Workers AI",
+    fields: [
+      { envVar: "CLOUDFLARE_API_KEY", kind: "secret", label: "API key" },
+      { envVar: "CLOUDFLARE_ACCOUNT_ID", kind: "config", label: "Account ID" },
+      { envVar: "CLOUDFLARE_GATEWAY_ID", kind: "config", label: "Gateway ID" }
+    ]
+  },
+  {
+    id: "cloudflare-workers-ai",
+    displayName: "Cloudflare Workers AI",
+    category: "provider",
+    hint: "Inference on Cloudflare Workers \xB7 ai.cloudflare.com",
+    fields: [
+      { envVar: "CLOUDFLARE_API_KEY", kind: "secret", label: "API key" },
+      { envVar: "CLOUDFLARE_ACCOUNT_ID", kind: "config", label: "Account ID" }
+    ]
+  },
   {
     id: "openrouter",
     displayName: "OpenRouter",
@@ -1040,6 +1146,13 @@ var SERVICES = [
       }
     ]
   },
+  {
+    id: "opencode",
+    displayName: "OpenCode",
+    category: "provider",
+    hint: "OpenAI-compatible proxy from the OpenCode CLI",
+    fields: [{ envVar: "OPENCODE_API_KEY", kind: "secret", label: "API key" }]
+  },
   {
     id: "lmstudio",
     displayName: "LM Studio",
@@ -1078,11 +1191,54 @@ var SERVICES = [
       }
     ]
   },
+  {
+    id: "llamacpp",
+    displayName: "llama.cpp",
+    category: "provider",
+    hint: "Local inference \xB7 llama.cpp llama-server (OpenAI-compat /v1 endpoint)",
+    fields: [
+      {
+        envVar: "LLAMACPP_URL",
+        kind: "config",
+        label: "Endpoint URL",
+        placeholder: "http://127.0.0.1:8080/v1"
+      },
+      {
+        envVar: "LLAMACPP_API_KEY",
+        kind: "secret",
+        label: "API key (only if started with --api-key)",
+        description: "llama-server runs without auth by default. Set this only if you launched the server with the `--api-key KEY` flag."
+      }
+    ]
+  },
   // --- Ancillary services (web search, etc) ---
+  {
+    id: "firecrawl",
+    displayName: "Firecrawl",
+    category: "service",
+    group: "Web Search",
+    hint: "web_fetch fallback for JS-heavy/blocked pages \xB7 firecrawl.dev (free tier available)",
+    fields: [
+      {
+        envVar: "FIRECRAWL_API_KEY",
+        kind: "secret",
+        label: "API key",
+        placeholder: "fc-...",
+        description: "When set, web_fetch automatically falls back to Firecrawl if the primary Readability extraction yields too little content."
+      },
+      {
+        envVar: "FIRECRAWL_URL",
+        kind: "config",
+        label: "Base URL (optional, for self-hosted)",
+        placeholder: "https://api.firecrawl.dev"
+      }
+    ]
+  },
   {
     id: "brave-search",
     displayName: "Brave Search",
     category: "service",
+    group: "Web Search",
     hint: "Web search tool \xB7 free tier at brave.com/search/api/",
     fields: [{ envVar: "BRAVE_API_KEY", kind: "secret", label: "API key", placeholder: "BSA..." }]
   },
@@ -1090,6 +1246,7 @@ var SERVICES = [
     id: "searxng",
     displayName: "SearXNG",
     category: "service",
+    group: "Web Search",
     hint: "Self-hosted meta-search engine \xB7 searxng.org",
     fields: [
       {
@@ -1516,7 +1673,9 @@ function revoke(db, id, when = Date.now()) {
 import { existsSync as existsSync6, readFileSync as readFileSync4 } from "fs";
 function readAuthFile(authFile) {
   if (!existsSync6(authFile)) {
-    throw new Error(`${authFile} not found. Start the daemon (\`bazilion serve\`) \u2014 it auto-bootstraps on first run.`);
+    throw new Error(
+      `${authFile} not found. Start the daemon (\`bazilion serve\`) \u2014 it auto-bootstraps on first run.`
+    );
   }
   const raw = readFileSync4(authFile, "utf8");
   const parsed = JSON.parse(raw);
@@ -1724,7 +1883,7 @@ function isActiveAgent(agentId) {
 }
 
 // ../daemon/src/runtime/auth/openai-codex.ts
-import { loginOpenAICodex, refreshOpenAICodexToken } from "@mariozechner/pi-ai/oauth";
+import { loginOpenAICodex, refreshOpenAICodexToken } from "@earendil-works/pi-ai/oauth";
 var OPENAI_CODEX_SECRET_KEY = "OPENAI_CODEX_OAUTH";
 var REFRESH_MARGIN_MS = 6e4;
 function readCredentials(db, authToken) {
@@ -1999,14 +2158,14 @@ import {
   ModelRegistry,
   SessionManager,
   SettingsManager
-} from "@mariozechner/pi-coding-agent";
+} from "@earendil-works/pi-coding-agent";
 
 // ../daemon/src/runtime/providers/pi-adapter.ts
 import {
   getModel,
   streamSimple,
   Type
-} from "@mariozechner/pi-ai";
+} from "@earendil-works/pi-ai";
 function defaultBaseUrlFor(providerName) {
   switch (providerName) {
     case "lmstudio":
@@ -2343,6 +2502,10 @@ function loadProviderConfigFromEnv(env = process.env, oauth) {
     ollama: {
       ...env.OLLAMA_URL !== void 0 ? { baseURL: env.OLLAMA_URL } : {},
       ...env.OLLAMA_API_KEY !== void 0 ? { apiKey: env.OLLAMA_API_KEY } : {}
+    },
+    llamacpp: {
+      ...env.LLAMACPP_URL !== void 0 ? { baseURL: env.LLAMACPP_URL } : {},
+      ...env.LLAMACPP_API_KEY !== void 0 ? { apiKey: env.LLAMACPP_API_KEY } : {}
     }
   };
   if (env.ANTHROPIC_API_KEY || env.ANTHROPIC_OAUTH_TOKEN) {
@@ -2365,6 +2528,28 @@ function loadProviderConfigFromEnv(env = process.env, oauth) {
   if (env.HF_TOKEN) config.huggingface = { apiKey: env.HF_TOKEN };
   if (env.OPENROUTER_API_KEY) config.openrouter = { apiKey: env.OPENROUTER_API_KEY };
   if (env.AI_GATEWAY_API_KEY) config.vercelAiGateway = { apiKey: env.AI_GATEWAY_API_KEY };
+  if (env.DEEPSEEK_API_KEY) config.deepseek = { apiKey: env.DEEPSEEK_API_KEY };
+  if (env.FIREWORKS_API_KEY) config.fireworks = { apiKey: env.FIREWORKS_API_KEY };
+  if (env.TOGETHER_API_KEY) config.together = { apiKey: env.TOGETHER_API_KEY };
+  if (env.MOONSHOT_API_KEY) config.moonshotai = { apiKey: env.MOONSHOT_API_KEY };
+  if (env.KIMI_API_KEY) config.kimiCoding = { apiKey: env.KIMI_API_KEY };
+  if (env.MINIMAX_API_KEY) config.minimax = { apiKey: env.MINIMAX_API_KEY };
+  if (env.XIAOMI_API_KEY) config.xiaomi = { apiKey: env.XIAOMI_API_KEY };
+  if (env.OPENCODE_API_KEY) config.opencode = { apiKey: env.OPENCODE_API_KEY };
+  if (env.COPILOT_GITHUB_TOKEN) config.githubCopilot = { apiKey: env.COPILOT_GITHUB_TOKEN };
+  if (env.CLOUDFLARE_API_KEY && env.CLOUDFLARE_ACCOUNT_ID) {
+    config.cloudflareWorkersAi = {
+      apiKey: env.CLOUDFLARE_API_KEY,
+      accountId: env.CLOUDFLARE_ACCOUNT_ID
+    };
+    if (env.CLOUDFLARE_GATEWAY_ID) {
+      config.cloudflareAiGateway = {
+        apiKey: env.CLOUDFLARE_API_KEY,
+        accountId: env.CLOUDFLARE_ACCOUNT_ID,
+        gatewayId: env.CLOUDFLARE_GATEWAY_ID
+      };
+    }
+  }
   if (oauth && hasCredentials(oauth.db, oauth.authToken)) {
     config.openaiCodex = oauth;
   }
@@ -2523,6 +2708,113 @@ var PROVIDERS = {
     }),
     hint: "AI_GATEWAY_API_KEY"
   },
+  deepseek: {
+    configured: (c) => !!c.deepseek,
+    build: (c) => piProvider({
+      providerName: "deepseek",
+      fallbackApi: "openai-completions",
+      apiKey: c.deepseek?.apiKey,
+      baseUrl: c.deepseek?.baseURL
+    }),
+    hint: "DEEPSEEK_API_KEY"
+  },
+  fireworks: {
+    configured: (c) => !!c.fireworks,
+    build: (c) => piProvider({
+      providerName: "fireworks",
+      fallbackApi: "anthropic-messages",
+      apiKey: c.fireworks?.apiKey,
+      baseUrl: c.fireworks?.baseURL
+    }),
+    hint: "FIREWORKS_API_KEY"
+  },
+  together: {
+    configured: (c) => !!c.together,
+    build: (c) => piProvider({
+      providerName: "together",
+      fallbackApi: "openai-completions",
+      apiKey: c.together?.apiKey,
+      baseUrl: c.together?.baseURL
+    }),
+    hint: "TOGETHER_API_KEY"
+  },
+  moonshotai: {
+    configured: (c) => !!c.moonshotai,
+    build: (c) => piProvider({
+      providerName: "moonshotai",
+      fallbackApi: "openai-completions",
+      apiKey: c.moonshotai?.apiKey,
+      baseUrl: c.moonshotai?.baseURL
+    }),
+    hint: "MOONSHOT_API_KEY"
+  },
+  "kimi-coding": {
+    configured: (c) => !!c.kimiCoding,
+    build: (c) => piProvider({
+      providerName: "kimi-coding",
+      fallbackApi: "anthropic-messages",
+      apiKey: c.kimiCoding?.apiKey,
+      baseUrl: c.kimiCoding?.baseURL
+    }),
+    hint: "KIMI_API_KEY"
+  },
+  minimax: {
+    configured: (c) => !!c.minimax,
+    build: (c) => piProvider({
+      providerName: "minimax",
+      fallbackApi: "anthropic-messages",
+      apiKey: c.minimax?.apiKey,
+      baseUrl: c.minimax?.baseURL
+    }),
+    hint: "MINIMAX_API_KEY"
+  },
+  xiaomi: {
+    configured: (c) => !!c.xiaomi,
+    build: (c) => piProvider({
+      providerName: "xiaomi",
+      fallbackApi: "openai-completions",
+      apiKey: c.xiaomi?.apiKey,
+      baseUrl: c.xiaomi?.baseURL
+    }),
+    hint: "XIAOMI_API_KEY"
+  },
+  opencode: {
+    configured: (c) => !!c.opencode,
+    build: (c) => piProvider({
+      providerName: "opencode",
+      fallbackApi: "openai-completions",
+      apiKey: c.opencode?.apiKey,
+      baseUrl: c.opencode?.baseURL
+    }),
+    hint: "OPENCODE_API_KEY"
+  },
+  "github-copilot": {
+    configured: (c) => !!c.githubCopilot,
+    build: (c) => piProvider({
+      providerName: "github-copilot",
+      fallbackApi: "anthropic-messages",
+      apiKey: c.githubCopilot?.apiKey
+    }),
+    hint: "COPILOT_GITHUB_TOKEN (generic GH_TOKEN/GITHUB_TOKEN are ignored)"
+  },
+  "cloudflare-ai-gateway": {
+    configured: (c) => !!c.cloudflareAiGateway,
+    build: (c) => piProvider({
+      providerName: "cloudflare-ai-gateway",
+      fallbackApi: "anthropic-messages",
+      apiKey: c.cloudflareAiGateway?.apiKey
+    }),
+    hint: "CLOUDFLARE_API_KEY + CLOUDFLARE_ACCOUNT_ID + CLOUDFLARE_GATEWAY_ID"
+  },
+  "cloudflare-workers-ai": {
+    configured: (c) => !!c.cloudflareWorkersAi,
+    build: (c) => piProvider({
+      providerName: "cloudflare-workers-ai",
+      fallbackApi: "openai-completions",
+      apiKey: c.cloudflareWorkersAi?.apiKey
+    }),
+    hint: "CLOUDFLARE_API_KEY + CLOUDFLARE_ACCOUNT_ID"
+  },
   lmstudio: {
     configured: () => true,
     build: (c) => piProvider({
@@ -2542,6 +2834,20 @@ var PROVIDERS = {
       baseUrl: c.ollama?.baseURL ?? "http://127.0.0.1:11434/v1"
     }),
     hint: "OLLAMA_URL (default http://127.0.0.1:11434/v1)"
+  },
+  llamacpp: {
+    // Like lmstudio/ollama, always considered "configured" — the daemon
+    // can't tell if llama-server is actually running until a request hits
+    // it. Falls back to the documented default port + a placeholder
+    // apiKey (llama-server ignores it unless --api-key was passed).
+    configured: () => true,
+    build: (c) => piProvider({
+      providerName: "llamacpp",
+      fallbackApi: "openai-completions",
+      apiKey: c.llamacpp?.apiKey ?? "no-key",
+      baseUrl: c.llamacpp?.baseURL ?? "http://127.0.0.1:8080/v1"
+    }),
+    hint: "LLAMACPP_URL (default http://127.0.0.1:8080/v1)"
   }
 };
 function createProviderRegistry(config, opts = {}) {
@@ -2606,13 +2912,11 @@ var CONTEXT_FILE_ORDER = [
   "SOUL.md",
   "TOOLS.md",
   "IDENTITY.md",
-  "HEARTBEAT.md",
-  "BOOTSTRAP.md"
+  "HEARTBEAT.md"
 ];
 function buildSystemPrompt(agent) {
   const parts = [];
   const contextBlocks = [];
-  let bootstrapPresent = false;
   for (const file of CONTEXT_FILE_ORDER) {
     const path = join11(agent.agent.dir, file);
     if (!existsSync10(path)) continue;
@@ -2621,23 +2925,39 @@ function buildSystemPrompt(agent) {
     contextBlocks.push(`## ${file}
 
 ${content}`);
-    if (file === "BOOTSTRAP.md") bootstrapPresent = true;
   }
   if (contextBlocks.length > 0) {
     parts.push(`# Project Context
 
 ${contextBlocks.join("\n\n")}`);
   }
-  if (bootstrapPresent) {
-    parts.push(
-      "NOTE: This is your first session. After you have completed the bootstrap conversation, call the `bootstrap_done` tool to delete BOOTSTRAP.md."
-    );
+  const bootstrapPath = join11(agent.agent.dir, "BOOTSTRAP.md");
+  if (existsSync10(bootstrapPath)) {
+    const bootstrap2 = readFileSync8(bootstrapPath, "utf8").trimEnd();
+    if (bootstrap2) {
+      parts.push(
+        [
+          "# First-Run Ritual",
+          "",
+          "This is your first session. The document below is **conversational guidance**, not a checklist to execute in one shot. It describes a multi-turn Q&A you should have with the human, one question per turn.",
+          "",
+          "## Hard rules",
+          "- Your first reply is ONLY a greeting + ONE question. No tool calls. Wait for the human to answer.",
+          "- Each subsequent turn: at most one new question. Wait between turns.",
+          "- Only after the ritual is complete (you have enough to write IDENTITY.md): call `home_write` once, then `bootstrap_done`.",
+          "",
+          "## BOOTSTRAP.md",
+          "",
+          bootstrap2
+        ].join("\n")
+      );
+    }
   }
   parts.push(
     [
       "# Agent Home",
       "",
-      "Your private home holds who you are \u2014 identity, soul, behaviour rules, wake-up routine. It is not shared with other agents and cannot be overwritten by them. The files above (IDENTITY.md, SOUL.md, AGENTS.md, TOOLS.md, HEARTBEAT.md, BOOTSTRAP.md) live in this home.",
+      "Your private home holds who you are \u2014 identity, soul, behaviour rules, wake-up routine. It is not shared with other agents and cannot be overwritten by them. The files above (IDENTITY.md, SOUL.md, AGENTS.md, TOOLS.md, HEARTBEAT.md) live in this home, plus BOOTSTRAP.md when you are still in your first-run ritual.",
       "",
       "- To change who you are (name, vibe, personality, how you behave): use `home_write`.",
       "- To inspect exact wording of your own files: use `home_read` or `home_list`.",
@@ -2664,13 +2984,19 @@ You have access to the following skills: ${agent.skills.join(", ")}.`
     parts.push(
       `# About the User
 
-Read-only context about the human you're working with in this group. You cannot edit this \u2014 if it's wrong, say so and they will update it.
+Shared context about the human you're working with in this group. Both you and the human curate it. To update: call \`user_md_get\` (returns current content + an etag), merge your change into the full text, then call \`user_md_write\` with the merged content and the etag. Use this for STABLE user-specific facts (preferences, role, working hours, how they like to be addressed) \u2014 and to CORRECT stale entries when the human tells you something different from what's recorded. For project knowledge use \`memory_write\` instead; for personal notes about yourself use \`home_write\` on IDENTITY.md. **Do NOT send peer messages announcing USER.md changes \u2014 every agent in the group sees the new content in their system prompt on their next turn automatically.**
 
 ${agent.group.userMd.trim()}`
     );
+  } else {
+    parts.push(
+      `# About the User
+
+This group's USER.md is empty. As you learn STABLE facts about the human (preferences, role, working hours, how they like to be addressed), populate it via \`user_md_get\` then \`user_md_write\` (always get first \u2014 you need the etag). Reserve this for things you're confident are durable \u2014 project knowledge belongs in \`memory_write\`, personal notes about yourself in \`home_write\` on IDENTITY.md. **Do NOT send peer messages announcing USER.md changes \u2014 every agent in the group sees the new content in their system prompt on their next turn automatically.**`
+    );
   }
   parts.push(
-    "# Memory\n\nYou share a persistent memory backend with every other agent in this group. Use `memory_write` to remember things across sessions, and `memory_search` / `memory_read` / `memory_list` to recall them. This memory is for project knowledge \u2014 codebase notes, decisions, things the user told you about the work. For personal notes about yourself (preferences, persona quirks), use `home_write` on IDENTITY.md instead. Always check memory at the start of a session: another agent in the group may have already learned something useful."
+    "# Memory\n\nYou share a persistent memory backend with every other agent in this group. Use `memory_write` to remember things across sessions, and `memory_search` / `memory_read` / `memory_list` to recall them. This memory is for project knowledge \u2014 codebase notes, decisions, things the user told you about the work. For personal notes about yourself (preferences, persona quirks), use `home_write` on IDENTITY.md instead. Always check memory at the start of a session: another agent in the group may have already learned something useful. **Do NOT send peer messages announcing memory writes \u2014 every agent has access to the same store via `memory_search` and will find your note when they need it.**"
   );
   return parts.join("\n\n---\n\n");
 }
@@ -2811,7 +3137,7 @@ function memoryTools(memory) {
     {
       def: {
         name: "memory_write",
-        description: 'Write or update a memory note in the GROUP-SHARED memory. All agents in this group can read what you write. Use it for project knowledge, codebase notes, decisions, and findings \u2014 anything other agents in the group should benefit from. For personal notes about yourself (preferences, persona), use `home_write` on IDENTITY.md instead. Key is a path-like string with a markdown extension, e.g. "auth-flow.md" or "people/alice.md".',
+        description: 'Write or update a memory note in the GROUP-SHARED memory. All agents in this group can read what you write. Use it for project knowledge, codebase notes, decisions, and findings \u2014 anything other agents in the group should benefit from. For personal notes about yourself (preferences, persona) use `home_write` on IDENTITY.md. For STABLE facts about the human you\'re working with (their preferences, role, working hours, how they like to be addressed) use `user_md_get` then `user_md_write` \u2014 those land in every agent\'s system prompt directly. Key is a path-like string with a markdown extension, e.g. "auth-flow.md" or "decisions/2026-05-migration.md".',
         parameters: {
           type: "object",
           properties: {
@@ -2897,7 +3223,7 @@ function messagingTools(host2, fromAgentId) {
     {
       def: {
         name: "send_message",
-        description: "Send a message to another agent. Use the recipient's agent id (UUID).",
+        description: `Send a message to another agent. Use the recipient's agent id (UUID). Use this ONLY for things the recipient needs to ACT on: delegating a task, asking a peer for information you cannot get yourself, escalating a decision. Do NOT use it for status updates or to announce changes to group-shared resources \u2014 USER.md and the group memory backend both propagate to every agent in the group automatically on their next turn, so messages like "I updated USER.md" or "I wrote a new memory note" are pure noise and will trigger an inbox-wake loop on the recipient.`,
         parameters: {
           type: "object",
           properties: {
@@ -3001,6 +3327,64 @@ function messagingTools(host2, fromAgentId) {
   ];
 }
 
+// ../daemon/src/runtime/tools/user-md.ts
+function userMdTools(host2, groupId) {
+  return [
+    {
+      def: {
+        name: "user_md_get",
+        description: "Read the group-shared USER.md (facts every agent in the group knows about the human). Returns the current content followed by an `etag:` line \u2014 you MUST pass that etag back as `if_match` on the next `user_md_write` so the daemon can detect concurrent edits by other agents in the group. Always call this immediately before any `user_md_write`.",
+        parameters: {
+          type: "object",
+          properties: {}
+        }
+      },
+      async invoke() {
+        const { content, etag } = await host2.get(groupId);
+        const body = content.length > 0 ? content : "(USER.md is empty)";
+        return `${body}
+
+---
+etag: ${etag}`;
+      }
+    },
+    {
+      def: {
+        name: "user_md_write",
+        description: "Replace the group-shared USER.md with new content. Use this for STABLE user-specific facts (preferences, role, working hours, how the human likes to be addressed). MANDATORY workflow: (1) call `user_md_get` first, (2) integrate your change into the full content preserving everything unrelated, (3) call `user_md_write` with the merged content and the etag you got from `user_md_get`. If another agent in the group wrote to USER.md between your get and write, this returns an etag-mismatch error \u2014 just call `user_md_get` again and retry the merge. The full result must fit under 12 KB. For project knowledge use `memory_write`; for notes about yourself use `home_write` on IDENTITY.md.",
+        parameters: {
+          type: "object",
+          properties: {
+            content: {
+              type: "string",
+              description: "Full new contents of USER.md (this is a complete replacement, NOT an append). Include everything you want to keep."
+            },
+            if_match: {
+              type: "string",
+              description: "The etag returned by your most recent `user_md_get`. The write fails if USER.md changed in the meantime."
+            }
+          },
+          required: ["content", "if_match"]
+        }
+      },
+      async invoke(args) {
+        const content = String(args.content ?? "");
+        const ifMatch = String(args.if_match ?? "");
+        if (!ifMatch) {
+          throw new Error(
+            'user_md_write: "if_match" is required \u2014 call user_md_get first to obtain the current etag.'
+          );
+        }
+        const { etag, totalBytes } = await host2.write(groupId, content, ifMatch);
+        return `wrote USER.md (${totalBytes} bytes, new etag: ${etag})`;
+      }
+    }
+  ];
+}
+
+// ../daemon/src/runtime/tools/web.ts
+import { fetch as undiciFetch2 } from "undici";
+
 // ../daemon/src/runtime/tools/web-extract.ts
 import { Readability } from "@mozilla/readability";
 import { parseHTML } from "linkedom";
@@ -3081,7 +3465,7 @@ function extractReadable(html, url, mode) {
 // ../daemon/src/runtime/tools/web-ssrf.ts
 import { lookup as dnsLookupCb } from "dns";
 import { lookup as dnsLookup } from "dns/promises";
-import { Agent } from "undici";
+import { Agent, fetch as undiciFetch } from "undici";
 var SsrFBlockedError = class extends Error {
   constructor(message) {
     super(message);
@@ -3190,7 +3574,7 @@ async function closeDispatcher(d) {
   }
 }
 async function guardedFetch(opts) {
-  const fetcher = opts.fetchImpl ?? globalThis.fetch;
+  const fetcher = opts.fetchImpl ?? undiciFetch;
   const maxRedirects = opts.maxRedirects ?? 3;
   const abortController = new AbortController();
   const timeoutId = opts.timeoutMs ? setTimeout(() => abortController.abort(new Error("timeout")), opts.timeoutMs) : null;
@@ -3271,7 +3655,10 @@ var DEFAULT_USER_AGENT = "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_7_2) AppleWe
 var DEFAULT_CACHE_TTL_MS = 15 * 6e4;
 var DEFAULT_CACHE_MAX = 100;
 var DEFAULT_MAX_LENGTH = 2e4;
-var DEFAULT_TIMEOUT_MS = 2e4;
+var DEFAULT_TIMEOUT_MS = 3e4;
+var DEFAULT_MAX_BODY_BYTES = 3 * 1024 * 1024;
+var FIRECRAWL_FALLBACK_THRESHOLD = 200;
+var FIRECRAWL_DEFAULT_URL = "https://api.firecrawl.dev";
 function stripHtml(s) {
   return s.replace(/<[^>]*>/g, "").replace(/&amp;/g, "&").replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&quot;/g, '"').replace(/&#39;/g, "'").replace(/&nbsp;/g, " ").trim();
 }
@@ -3305,6 +3692,92 @@ async function searxngSearch(query, limit, baseURL, fetchFn) {
     snippet: r.content ?? ""
   }));
 }
+function describeError(err) {
+  if (!(err instanceof Error)) return String(err);
+  const parts = [];
+  const seen = /* @__PURE__ */ new Set();
+  let cur = err;
+  while (cur instanceof Error && !seen.has(cur)) {
+    seen.add(cur);
+    const code = cur.code;
+    parts.push(code ? `[${code}] ${cur.message}` : cur.message);
+    cur = cur.cause;
+  }
+  return parts.join(" \u2014 cause: ");
+}
+async function readBodyCapped(res, maxBytes) {
+  const ct = res.headers.get("content-type") ?? "";
+  const charset = /charset=([^;]+)/i.exec(ct)?.[1]?.trim().toLowerCase() || "utf-8";
+  const decoder = new TextDecoder(charset, { fatal: false });
+  const reader = res.body?.getReader();
+  if (!reader) {
+    const text = await res.text();
+    if (text.length > maxBytes) return { text: text.slice(0, maxBytes), truncated: true };
+    return { text, truncated: false };
+  }
+  const chunks = [];
+  let total = 0;
+  let truncated = false;
+  while (true) {
+    const { value, done } = await reader.read();
+    if (done) break;
+    if (!value) continue;
+    if (total + value.byteLength > maxBytes) {
+      const keep = maxBytes - total;
+      if (keep > 0) chunks.push(value.subarray(0, keep));
+      truncated = true;
+      try {
+        await reader.cancel();
+      } catch {
+      }
+      break;
+    }
+    chunks.push(value);
+    total += value.byteLength;
+  }
+  const sum = chunks.reduce((s, c) => s + c.byteLength, 0);
+  const merged = new Uint8Array(sum);
+  let off = 0;
+  for (const c of chunks) {
+    merged.set(c, off);
+    off += c.byteLength;
+  }
+  return { text: decoder.decode(merged), truncated };
+}
+async function firecrawlScrape(url, mode, env, fetchFn, timeoutMs) {
+  const apiKey = env.FIRECRAWL_API_KEY;
+  if (!apiKey) return null;
+  const base = (env.FIRECRAWL_URL ?? FIRECRAWL_DEFAULT_URL).replace(/\/$/, "");
+  const ac = new AbortController();
+  const t = setTimeout(() => ac.abort(new Error("firecrawl timeout")), timeoutMs);
+  try {
+    const res = await fetchFn(`${base}/v1/scrape`, {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        authorization: `Bearer ${apiKey}`,
+        accept: "application/json"
+      },
+      body: JSON.stringify({
+        url,
+        formats: ["markdown"],
+        onlyMainContent: true
+      }),
+      signal: ac.signal
+    });
+    if (!res.ok) return null;
+    const body = await res.json();
+    if (!body.success || !body.data?.markdown) return null;
+    const md = body.data.markdown;
+    const title = body.data.metadata?.title;
+    const text = mode === "text" ? markdownToPlain(md) : md;
+    return title ? { text, title } : { text };
+  } catch {
+    return null;
+  } finally {
+    clearTimeout(t);
+  }
+}
 function cacheGet(cache, key) {
   const entry = cache.get(key);
   if (!entry) return null;
@@ -3325,12 +3798,14 @@ function cacheSet(cache, key, value, ttlMs, maxEntries) {
   }
 }
 function webTools(opts) {
-  const fetchFn = opts?.fetchImpl ?? fetch;
+  const fetchFn = opts?.fetchImpl ?? undiciFetch2;
   const env = opts?.env ?? process.env;
   const allowPrivate = opts?.allowPrivate ?? false;
   const cacheTtlMs = opts?.cacheTtlMs ?? DEFAULT_CACHE_TTL_MS;
   const cacheMax = opts?.cacheMax ?? DEFAULT_CACHE_MAX;
   const timeoutMs = opts?.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  const maxBodyBytes = opts?.maxBodyBytes ?? DEFAULT_MAX_BODY_BYTES;
+  const firecrawlDisabled = opts?.firecrawlDisabled ?? false;
   const cache = /* @__PURE__ */ new Map();
   return [
     {
@@ -3368,7 +3843,7 @@ function webTools(opts) {
     {
       def: {
         name: "web_fetch",
-        description: "Fetch a URL and return its readable content. HTML is extracted via Readability and converted to markdown. Results are cached for 15 minutes.",
+        description: "Fetch a URL and return its readable content. HTML is extracted via Readability and converted to markdown. When the primary extraction returns near-empty content from a 2xx HTML page (typical of JS-only shells), the tool automatically retries via Firecrawl if FIRECRAWL_API_KEY is configured. Results are cached for 15 minutes.",
         parameters: {
           type: "object",
           properties: {
@@ -3394,7 +3869,7 @@ function webTools(opts) {
         const cacheKey = `${mode}|${url}`;
         const cached = cacheGet(cache, cacheKey);
         if (cached) return formatOutput(cached, maxLen);
-        let result;
+        let result = null;
         try {
           result = await guardedFetch({
             url,
@@ -3409,18 +3884,14 @@ function webTools(opts) {
               }
             }
           });
-        } catch (err) {
-          if (err instanceof SsrFBlockedError) throw new Error(`web_fetch: ${err.message}`);
-          throw err;
-        }
-        try {
           if (!result.response.ok) {
-            throw new Error(`web_fetch: ${result.response.status} ${result.response.statusText}`);
+            throw new Error(`${result.response.status} ${result.response.statusText}`);
           }
           const ct = result.response.headers.get("content-type") ?? "";
-          const body = await result.response.text();
+          const isHtml = ct.includes("text/html") || ct.includes("xhtml");
+          const { text: body, truncated } = await readBodyCapped(result.response, maxBodyBytes);
           let extracted;
-          if (ct.includes("text/html") || ct.includes("xhtml")) {
+          if (isHtml) {
             extracted = extractReadable(body, result.finalUrl, mode);
           } else if (ct.includes("application/json")) {
             try {
@@ -3431,10 +3902,38 @@ function webTools(opts) {
           } else {
             extracted = { text: body };
           }
+          if (isHtml && !firecrawlDisabled && extracted.text.length < FIRECRAWL_FALLBACK_THRESHOLD) {
+            const rescued = await firecrawlScrape(
+              result.finalUrl,
+              mode,
+              env,
+              fetchFn,
+              timeoutMs
+            );
+            if (rescued) {
+              extracted = {
+                ...rescued,
+                text: `${rescued.text}
+
+[content rendered via Firecrawl fallback \u2014 primary extraction returned ${extracted.text.length} chars]`
+              };
+            }
+          }
+          if (truncated) {
+            extracted = {
+              ...extracted,
+              text: `${extracted.text}
+
+[raw body truncated at ${maxBodyBytes} bytes before extraction \u2014 page exceeded the size cap]`
+            };
+          }
           cacheSet(cache, cacheKey, extracted, cacheTtlMs, cacheMax);
           return formatOutput(extracted, maxLen);
+        } catch (err) {
+          if (err instanceof SsrFBlockedError) throw new Error(`web_fetch: ${err.message}`);
+          throw new Error(`web_fetch: ${describeError(err)}`);
         } finally {
-          await result.release();
+          if (result) await result.release();
         }
       }
     }
@@ -3481,13 +3980,16 @@ function createBazilionCustomTools(opts) {
   if (opts.messagingHost) {
     handlers.push(...messagingTools(opts.messagingHost, opts.agent.agent.id));
   }
+  if (opts.userMdHost) {
+    handlers.push(...userMdTools(opts.userMdHost, opts.agent.group.id));
+  }
   return handlers.map(ourToolToPiTool);
 }
 
 // ../daemon/src/runtime/pi/session.ts
 var BUILTIN_TOOL_NAMES = ["read", "bash", "edit", "write", "grep", "find", "ls"];
 async function createBazilionSession(opts) {
-  const { agent, paths, env, memory, enabledProviders, messagingHost, refreshApiKey } = opts;
+  const { agent, paths, env, memory, enabledProviders, messagingHost, userMdHost, refreshApiKey } = opts;
   const { providerName, modelId } = splitModelString(agent.model);
   if (enabledProviders.size > 0 && !enabledProviders.has(providerName)) {
     throw new Error(`${providerName} provider is disabled \u2014 enable it on the /config page`);
@@ -3524,12 +4026,17 @@ async function createBazilionSession(opts) {
   const sessionManager = existing ? SessionManager.open(existing, sessionDir, cwd) : SessionManager.create(cwd, sessionDir);
   const settingsManager = SettingsManager.inMemory({
     compaction: { enabled: false },
-    retry: { enabled: true, maxRetries: 2, baseDelayMs: 500, maxDelayMs: 8e3 }
+    retry: {
+      enabled: true,
+      maxRetries: 2,
+      baseDelayMs: 500,
+      provider: { maxRetryDelayMs: 8e3 }
+    }
   });
   const bazilionPrompt = buildSystemPrompt(agent);
   const resourceLoader = createBazilionResourceLoader(bazilionPrompt);
   await resourceLoader.reload();
-  const customTools = createBazilionCustomTools({ agent, memory, messagingHost, env });
+  const customTools = createBazilionCustomTools({ agent, memory, messagingHost, userMdHost, env });
   const allowedTools = [...BUILTIN_TOOL_NAMES, ...customTools.map((t) => t.name)];
   const { session } = await createAgentSession({
     cwd,
@@ -3705,7 +4212,8 @@ function findMostRecent(sessionDir) {
 }
 
 // ../daemon/src/runtime/providers/catalog.ts
-import { getModels as piGetModels } from "@mariozechner/pi-ai";
+import { getModels as piGetModels } from "@earendil-works/pi-ai";
+import { fetch as undiciFetch3 } from "undici";
 var REGISTRY_TO_PI = {
   bedrock: "amazon-bedrock",
   "azure-openai": "azure-openai-responses"
@@ -3716,6 +4224,8 @@ function liveEndpointFor(providerName, env) {
       return env.LMSTUDIO_URL ?? "http://127.0.0.1:1234/v1";
     case "ollama":
       return env.OLLAMA_URL ?? "http://127.0.0.1:11434/v1";
+    case "llamacpp":
+      return env.LLAMACPP_URL ?? "http://127.0.0.1:8080/v1";
     case "openrouter":
       return "https://openrouter.ai/api/v1";
     case "vercel-ai-gateway":
@@ -3746,7 +4256,7 @@ async function fetchModelsFrom(baseURL, apiKey, signal) {
   try {
     const headers = { accept: "application/json" };
     if (apiKey) headers.authorization = `Bearer ${apiKey}`;
-    const res = await fetch(`${baseURL.replace(/\/$/, "")}/models`, { headers, signal });
+    const res = await undiciFetch3(`${baseURL.replace(/\/$/, "")}/models`, { headers, signal });
     if (!res.ok) return { models: [], error: `${res.status} ${res.statusText}` };
     const body = await res.json();
     const ids = (body?.data ?? []).map((m) => m.id).filter((id) => !!id);
@@ -3819,7 +4329,9 @@ async function* spawnWorkerTurn(spec, opts = {}) {
     env: opts.env ?? process.env,
     stdio: ["pipe", "pipe", "inherit", "ipc"]
   });
-  if (opts.messagingHost) attachIpcHandler(child, opts.messagingHost);
+  if (opts.messagingHost || opts.userMdHost) {
+    attachIpcHandler(child, opts.messagingHost, opts.userMdHost);
+  }
   child.stdin?.write(JSON.stringify(spec));
   child.stdin?.end();
   const grace = opts.killGraceMs ?? DEFAULT_KILL_GRACE_MS;
@@ -3899,10 +4411,10 @@ function parseFrame(line) {
     return { kind: "fatal", error: `worker emitted malformed frame: ${line.slice(0, 200)}` };
   }
 }
-function attachIpcHandler(child, host2) {
+function attachIpcHandler(child, messagingHost, userMdHost) {
   child.on("message", (msg) => {
     if (!isIpcRequest(msg)) return;
-    void dispatch(msg, host2).then((reply) => {
+    void dispatch(msg, messagingHost, userMdHost).then((reply) => {
       try {
         child.send?.(reply);
       } catch {
@@ -3915,25 +4427,49 @@ function isIpcRequest(msg) {
   const m = msg;
   return m.type === "rpc" && typeof m.id === "string" && typeof m.method === "string";
 }
-async function dispatch(req, host2) {
+function requireMessagingHost(host2, method) {
+  if (!host2) throw new Error(`worker called messaging method "${method}" without a messagingHost`);
+  return host2;
+}
+function requireUserMdHost(host2, method) {
+  if (!host2) throw new Error(`worker called user_md method "${method}" without a userMdHost`);
+  return host2;
+}
+async function dispatch(req, messagingHost, userMdHost) {
   try {
     let result;
     switch (req.method) {
       case "agentExists":
-        result = await host2.agentExists(req.args.agentId);
+        result = await requireMessagingHost(messagingHost, req.method).agentExists(req.args.agentId);
         break;
       case "sendMessage":
-        result = await host2.sendMessage(req.args);
+        result = await requireMessagingHost(messagingHost, req.method).sendMessage(req.args);
         break;
       case "listInbox":
-        result = await host2.listInbox(req.args.agentId, { unreadOnly: req.args.unreadOnly });
+        result = await requireMessagingHost(messagingHost, req.method).listInbox(
+          req.args.agentId,
+          { unreadOnly: req.args.unreadOnly }
+        );
         break;
       case "markRead":
-        await host2.markRead(req.args.messageId);
+        await requireMessagingHost(messagingHost, req.method).markRead(req.args.messageId);
         result = null;
         break;
       case "findReplies":
-        result = await host2.findReplies(req.args.agentId, req.args.replyTo);
+        result = await requireMessagingHost(messagingHost, req.method).findReplies(
+          req.args.agentId,
+          req.args.replyTo
+        );
+        break;
+      case "userMdGet":
+        result = await requireUserMdHost(userMdHost, req.method).get(req.args.groupId);
+        break;
+      case "userMdWrite":
+        result = await requireUserMdHost(userMdHost, req.method).write(
+          req.args.groupId,
+          req.args.content,
+          req.args.ifMatch
+        );
         break;
     }
     return { type: "rpc-reply", id: req.id, ok: true, result };
@@ -3986,6 +4522,40 @@ function createDbMessagingHost(db) {
   };
 }
 
+// ../daemon/src/lib/user-md-host.ts
+import { createHash as createHash2 } from "crypto";
+var USER_MD_MAX_BYTES = 12e3;
+function computeEtag(content) {
+  return createHash2("sha256").update(content, "utf8").digest("hex").slice(0, 16);
+}
+function createDbUserMdHost(db, paths) {
+  return {
+    get(groupId) {
+      const group = groups_exports.get(db, groupId, paths);
+      if (!group) throw new Error(`group not found: ${groupId}`);
+      return { content: group.userMd, etag: computeEtag(group.userMd) };
+    },
+    write(groupId, content, ifMatch) {
+      const group = groups_exports.get(db, groupId, paths);
+      if (!group) throw new Error(`group not found: ${groupId}`);
+      const currentEtag = computeEtag(group.userMd);
+      if (currentEtag !== ifMatch) {
+        throw new Error(
+          `etag mismatch \u2014 USER.md was updated by another agent. Current etag is ${currentEtag} (you passed ${ifMatch}). Call user_md_get again to re-read, merge your change, and retry.`
+        );
+      }
+      const bytes = Buffer.byteLength(content, "utf8");
+      if (bytes > USER_MD_MAX_BYTES) {
+        throw new Error(
+          `USER.md would exceed the ${USER_MD_MAX_BYTES}-byte cap (you tried to write ${bytes}). Trim your content or ask the human to compact via the web UI.`
+        );
+      }
+      groups_exports.setUserMd(db, groupId, content);
+      return { etag: computeEtag(content), totalBytes: bytes };
+    }
+  };
+}
+
 // ../daemon/src/lib/agent-turn.ts
 async function* runAgentTurn(agentId, message, opts = {}) {
   const { db, paths, authToken } = getCtx();
@@ -3993,13 +4563,14 @@ async function* runAgentTurn(agentId, message, opts = {}) {
   const enabledProviders = Array.from(providerState_exports.listEnabled(db));
   const env = mergeSecretsIntoEnv(db, authToken);
   const messagingHost = createDbMessagingHost(db);
+  const userMdHost = createDbUserMdHost(db, paths);
   const { apiKey } = await resolveAgentApiKey(db, authToken, agent);
   const controller = opts.controller ?? new AbortController();
   registerAgent(agentId, controller);
   try {
     for await (const frame of spawnWorkerTurn(
       { agent, message, enabledProviders, apiKey },
-      { signal: controller.signal, env, messagingHost }
+      { signal: controller.signal, env, messagingHost, userMdHost }
     )) {
       yield frame;
     }
@@ -5136,6 +5707,7 @@ configRouter.get("/services", (c) => {
     id: svc.id,
     displayName: svc.displayName,
     ...svc.hint ? { hint: svc.hint } : {},
+    ...svc.group ? { group: svc.group } : {},
     fields: resolveFieldStates(svc, configValues, secretValues)
   }));
   const body = { services };
@@ -5270,7 +5842,7 @@ function knownProviderRegistryNames() {
 // ../daemon/src/routes/groups.ts
 import { join as join16 } from "path";
 import { Hono as Hono4 } from "hono";
-var USER_MD_MAX_BYTES = 12e3;
+var USER_MD_MAX_BYTES2 = 12e3;
 var groupsRouter = new Hono4();
 groupsRouter.get("/", (c) => {
   const { db, paths } = getCtx();
@@ -5309,8 +5881,8 @@ groupsRouter.put("/:id/user-md", async (c) => {
   if (!body || typeof body.userMd !== "string") {
     return c.json({ error: "userMd (string) is required" }, 400);
   }
-  if (Buffer.byteLength(body.userMd, "utf8") > USER_MD_MAX_BYTES) {
-    return c.json({ error: `userMd exceeds ${USER_MD_MAX_BYTES}-byte cap` }, 413);
+  if (Buffer.byteLength(body.userMd, "utf8") > USER_MD_MAX_BYTES2) {
+    return c.json({ error: `userMd exceeds ${USER_MD_MAX_BYTES2}-byte cap` }, 413);
   }
   const { db, paths } = getCtx();
   const g = groups_exports.get(db, c.req.param("id"), paths);