cascade-ai 0.12.24 → 0.13.2

package/dist/index.js

@@ -1,5 +1,9 @@
+import Database from 'better-sqlite3';
+import path20 from 'path';
+import fs19 from 'fs';
+import os6 from 'os';
+import crypto3, { randomUUID, timingSafeEqual } from 'crypto';
 import EventEmitter from 'events';
-import crypto, { randomUUID, timingSafeEqual } from 'crypto';
 import { glob } from 'glob';
 import Anthropic from '@anthropic-ai/sdk';
 import OpenAI, { AzureOpenAI } from 'openai';
@@ -10,13 +14,10 @@ import https from 'https';
 import zlib from 'zlib';
 import { Readable } from 'stream';
 import fs4 from 'fs/promises';
-import path18 from 'path';
-import os4 from 'os';
 import * as ignoreFactory from 'ignore';
 import ignoreFactory__default from 'ignore';
 import { exec, execFile, execSync } from 'child_process';
 import { promisify } from 'util';
-import fs17 from 'fs';
 import { simpleGit } from 'simple-git';
 import PDFDocument from 'pdfkit';
 import dns2 from 'dns/promises';
@@ -25,7 +26,6 @@ import { Client } from '@modelcontextprotocol/sdk/client/index.js';
 import { StdioClientTransport } from '@modelcontextprotocol/sdk/client/stdio.js';
 import { z } from 'zod';
 import { Worker } from 'worker_threads';
-import Database from 'better-sqlite3';
 import { fileURLToPath } from 'url';
 import express from 'express';
 import rateLimit from 'express-rate-limit';
@@ -36,10 +36,161 @@ import jwt from 'jsonwebtoken';
 import cron from 'node-cron';
 
 // Cascade AI — Multi-tier AI Orchestration System
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
 
+// src/core/audit/audit-logger.ts
+var audit_logger_exports = {};
+__export(audit_logger_exports, {
+  AuditLogger: () => AuditLogger2
+});
+var AuditLogger2;
+var init_audit_logger = __esm({
+  "src/core/audit/audit-logger.ts"() {
+    AuditLogger2 = class {
+      constructor(workspacePath, debugMode = false) {
+        this.workspacePath = workspacePath;
+        this.debugMode = debugMode;
+        const cascadeDir = path20.join(workspacePath, ".cascade");
+        if (!fs19.existsSync(cascadeDir)) {
+          fs19.mkdirSync(cascadeDir, { recursive: true });
+        }
+        this.keyPath = path20.join(cascadeDir, "audit_log.key");
+        this.dbPath = path20.join(cascadeDir, "audit_log.db");
+        this.initEncryptionKey();
+        this.db = new Database(this.dbPath);
+        this.db.pragma("journal_mode = WAL");
+        this.db.exec(`
+      CREATE TABLE IF NOT EXISTS audit_logs (
+        id TEXT PRIMARY KEY,
+        timestamp TEXT NOT NULL,
+        event_type TEXT NOT NULL,
+        tier_id TEXT NOT NULL,
+        encrypted_payload TEXT NOT NULL,
+        prev_hash TEXT NOT NULL DEFAULT '',
+        hash TEXT NOT NULL DEFAULT ''
+      )
+    `);
+        const cols = this.db.pragma("table_info(audit_logs)").map((c) => c.name);
+        if (!cols.includes("prev_hash")) this.db.exec(`ALTER TABLE audit_logs ADD COLUMN prev_hash TEXT NOT NULL DEFAULT ''`);
+        if (!cols.includes("hash")) this.db.exec(`ALTER TABLE audit_logs ADD COLUMN hash TEXT NOT NULL DEFAULT ''`);
+      }
+      workspacePath;
+      debugMode;
+      db;
+      keyPath;
+      dbPath;
+      encryptionKey;
+      /** SHA-256 link over everything that identifies an entry, chained to the previous entry's hash. */
+      chainHash(prevHash, timestamp, eventType, tierId, encryptedPayload) {
+        return crypto3.createHash("sha256").update(`${prevHash}|${timestamp}|${eventType}|${tierId}|${encryptedPayload}`).digest("hex");
+      }
+      initEncryptionKey() {
+        if (fs19.existsSync(this.keyPath)) {
+          this.encryptionKey = fs19.readFileSync(this.keyPath);
+        } else {
+          this.encryptionKey = crypto3.randomBytes(32);
+          fs19.writeFileSync(this.keyPath, this.encryptionKey);
+        }
+      }
+      encrypt(text) {
+        const iv = crypto3.randomBytes(16);
+        const cipher = crypto3.createCipheriv("aes-256-gcm", this.encryptionKey, iv);
+        let encrypted = cipher.update(text, "utf8", "hex");
+        encrypted += cipher.final("hex");
+        const authTag = cipher.getAuthTag().toString("hex");
+        return `${iv.toString("hex")}:${authTag}:${encrypted}`;
+      }
+      decrypt(text) {
+        const parts = text.split(":");
+        if (parts.length !== 3) throw new Error("Invalid encrypted payload format");
+        const [ivHex, authTagHex, encryptedHex] = parts;
+        const iv = Buffer.from(ivHex, "hex");
+        const authTag = Buffer.from(authTagHex, "hex");
+        const decipher = crypto3.createDecipheriv("aes-256-gcm", this.encryptionKey, iv);
+        decipher.setAuthTag(authTag);
+        let decrypted = decipher.update(encryptedHex, "hex", "utf8");
+        decrypted += decipher.final("utf8");
+        return decrypted;
+      }
+      logEvent(eventType, tierId, payloadObj) {
+        const id = crypto3.randomUUID();
+        const timestamp = (/* @__PURE__ */ new Date()).toISOString();
+        const payload = JSON.stringify(payloadObj);
+        const encryptedPayload = this.encrypt(payload);
+        const last = this.db.prepare("SELECT hash FROM audit_logs ORDER BY rowid DESC LIMIT 1").get();
+        const prevHash = last?.hash ?? "";
+        const hash = this.chainHash(prevHash, timestamp, eventType, tierId, encryptedPayload);
+        const stmt = this.db.prepare("INSERT INTO audit_logs (id, timestamp, event_type, tier_id, encrypted_payload, prev_hash, hash) VALUES (?, ?, ?, ?, ?, ?, ?)");
+        stmt.run(id, timestamp, eventType, tierId, encryptedPayload, prevHash, hash);
+        this.dumpDebugIfNeeded();
+        return id;
+      }
+      /**
+       * Recompute the whole hash chain in insertion (rowid) order. Any edited,
+       * removed, or reordered row makes every later hash mismatch. Rows written
+       * before the chain existed (empty hash) fail verification too — integrity
+       * can only be claimed for chained history.
+       */
+      verifyChain() {
+        const rows = this.db.prepare(
+          "SELECT rowid, timestamp, event_type, tier_id, encrypted_payload, prev_hash, hash FROM audit_logs ORDER BY rowid ASC"
+        ).all();
+        let prevHash = "";
+        for (const row of rows) {
+          const expected = this.chainHash(prevHash, row.timestamp, row.event_type, row.tier_id, row.encrypted_payload);
+          if (row.prev_hash !== prevHash || row.hash !== expected) {
+            return { ok: false, entries: rows.length, firstBadRow: row.rowid };
+          }
+          prevHash = row.hash;
+        }
+        return { ok: true, entries: rows.length };
+      }
+      getAllLogs() {
+        const stmt = this.db.prepare("SELECT id, timestamp, event_type, tier_id, encrypted_payload FROM audit_logs ORDER BY timestamp ASC");
+        const rows = stmt.all();
+        return rows.map((row) => {
+          let payload = "";
+          try {
+            payload = this.decrypt(row.encrypted_payload);
+          } catch (err) {
+            payload = '{"error":"[Decryption Failed - Payload Corrupted]"}';
+          }
+          return {
+            id: row.id,
+            timestamp: row.timestamp,
+            eventType: row.event_type,
+            tierId: row.tier_id,
+            payload
+          };
+        });
+      }
+      dumpDebugIfNeeded() {
+        if (!this.debugMode) return;
+        try {
+          const dumpPath = path20.join(os6.tmpdir(), "cascade_audit_logs_debug.json");
+          const entries = this.getAllLogs();
+          fs19.writeFileSync(dumpPath, JSON.stringify(entries, null, 2), "utf-8");
+        } catch (err) {
+          console.error("Failed to dump debug audit logs", err);
+        }
+      }
+      close() {
+        this.db.close();
+      }
+    };
+  }
+});
 
 // src/constants.ts
-var CASCADE_VERSION = "0.12.24";
+var CASCADE_VERSION = "0.13.2";
 var CASCADE_CONFIG_DIR = ".cascade";
 var CASCADE_MD_FILE = "CASCADE.md";
 var CASCADE_IGNORE_FILE = ".cascadeignore";
@@ -1971,7 +2122,7 @@ function computeDelegationSavings(stats, t1Model) {
 var DEFAULT_SNAPSHOT_URL = "https://raw.githubusercontent.com/Varun-SV/Cascade-AI/main/src/core/router/benchmark-data.json";
 var OPENROUTER_MODELS_URL = "https://openrouter.ai/api/v1/models";
 var FETCH_TIMEOUT_MS = 8e3;
-var DEFAULT_CACHE_FILE = path18.join(os4.homedir(), GLOBAL_CONFIG_DIR, "benchmarks-cache.json");
+var DEFAULT_CACHE_FILE = path20.join(os6.homedir(), GLOBAL_CONFIG_DIR, "benchmarks-cache.json");
 function normalizeModelId(id) {
   let s = id.toLowerCase();
   const slash = s.lastIndexOf("/");
@@ -2086,7 +2237,7 @@ var LiveDataProvider = class {
   }
   async saveCache() {
     try {
-      await fs4.mkdir(path18.dirname(this.opts.cacheFile), { recursive: true });
+      await fs4.mkdir(path20.dirname(this.opts.cacheFile), { recursive: true });
       const cache = {
         fetchedAt: this.fetchedAt,
         snapshot: this.snapshot ?? void 0,
@@ -2216,7 +2367,8 @@ var CascadeRouter = class _CascadeRouter extends EventEmitter {
     costByTier: {},
     tokensByTier: {},
     inputTokensByTier: {},
-    outputTokensByTier: {}
+    outputTokensByTier: {},
+    costByFeature: {}
   };
   tierModels = /* @__PURE__ */ new Map();
   config;
@@ -2238,6 +2390,9 @@ var CascadeRouter = class _CascadeRouter extends EventEmitter {
   tpmLimiter;
   localQueue;
   taskAnalyzer;
+  worldStateDB;
+  privacyPaths;
+  guidanceQueue;
   liveData;
   /** Snapshot of configured/default tier models, taken before Cascade Auto overrides them. */
   originalTierModels;
@@ -2395,7 +2550,17 @@ var CascadeRouter = class _CascadeRouter extends EventEmitter {
     if (options.model && !requireVision) {
       this.ensureProvider(options.model, this.config.providers);
     }
-    const model = requireVision ? this.selector.selectVisionModel() : options.model ?? this.tierModels.get(tier);
+    let model = requireVision ? this.selector.selectVisionModel() : options.model ?? this.tierModels.get(tier);
+    if (options.forceLocal && model && !this.isPrivateModel(model)) {
+      const localModel = this.selector.getAllAvailableModels().find((m) => this.isPrivateModel(m));
+      if (!localModel) {
+        throw new Error(
+          "privacy.paths: this subtask touches a local-only path but no LOCAL model is available. Configure Ollama or an OpenAI-compatible endpoint on a loopback/private host, or remove the privacy policy."
+        );
+      }
+      this.ensureProvider(localModel, this.config.providers);
+      model = localModel;
+    }
     if (!model) throw new Error(`No model available for tier ${tier}`);
     const provider = this.getProvider(model);
     if (!provider) throw new Error(`No provider for model ${model.id}`);
@@ -2467,7 +2632,7 @@ var CascadeRouter = class _CascadeRouter extends EventEmitter {
       if (!result || typeof result.content !== "string" || !result.usage) {
         throw new Error(`Provider ${model.provider}:${model.id} returned an invalid generation result.`);
       }
-      this.recordStats(tier, model, result.usage);
+      this.recordStats(tier, model, result.usage, options.featureTag);
       this.failover.recordSuccess(model.provider);
       return result;
     } catch (err) {
@@ -2572,6 +2737,42 @@ var CascadeRouter = class _CascadeRouter extends EventEmitter {
   setTaskAnalyzer(analyzer) {
     this.taskAnalyzer = analyzer;
   }
+  setWorldStateDB(db) {
+    this.worldStateDB = db;
+  }
+  getWorldStateDB() {
+    return this.worldStateDB;
+  }
+  setPrivacyPaths(paths) {
+    this.privacyPaths = paths;
+  }
+  getPrivacyPaths() {
+    return this.privacyPaths;
+  }
+  setGuidanceQueue(queue) {
+    this.guidanceQueue = queue;
+  }
+  getGuidanceQueue() {
+    return this.guidanceQueue;
+  }
+  /**
+   * "Private" = inference never leaves the user's machine/network: Ollama
+   * models (isLocal), or an OpenAI-compatible endpoint (e.g. llama.cpp, vLLM,
+   * LM Studio) whose configured host is loopback or a private range. A cloud
+   * OpenAI-compatible endpoint (public host) does NOT qualify.
+   */
+  isPrivateModel(model) {
+    if (model.isLocal) return true;
+    if (model.provider !== "openai-compatible") return false;
+    const baseUrl = this.config?.providers?.find((p) => p.type === "openai-compatible")?.baseUrl;
+    if (!baseUrl) return false;
+    try {
+      const host = new URL(baseUrl).hostname.toLowerCase();
+      return host === "localhost" || host === "127.0.0.1" || host === "::1" || host === "[::1]" || /^10\./.test(host) || /^192\.168\./.test(host) || /^172\.(1[6-9]|2\d|3[01])\./.test(host) || host.endsWith(".local");
+    } catch {
+      return false;
+    }
+  }
   /**
    * Cascade Auto per-subtask routing: pick the benchmark-best model for a
    * specific subtask's text, scoped to the tier's eligible candidates. Returns
@@ -2595,7 +2796,8 @@ var CascadeRouter = class _CascadeRouter extends EventEmitter {
       costByTier: { ...this.stats.costByTier },
       tokensByTier: { ...this.stats.tokensByTier },
       inputTokensByTier: { ...this.stats.inputTokensByTier },
-      outputTokensByTier: { ...this.stats.outputTokensByTier }
+      outputTokensByTier: { ...this.stats.outputTokensByTier },
+      costByFeature: { ...this.stats.costByFeature }
     };
   }
   /**
@@ -2645,7 +2847,8 @@ var CascadeRouter = class _CascadeRouter extends EventEmitter {
       costByTier: {},
       tokensByTier: {},
       inputTokensByTier: {},
-      outputTokensByTier: {}
+      outputTokensByTier: {},
+      costByFeature: {}
     };
     this.sessionCostUsd = 0;
     this.budgetState = "ok";
@@ -2811,7 +3014,7 @@ var CascadeRouter = class _CascadeRouter extends EventEmitter {
     }
     return void 0;
   }
-  recordStats(tier, model, usage) {
+  recordStats(tier, model, usage, featureTag) {
     this.stats.totalTokens += usage.totalTokens;
     this.stats.totalCostUsd += usage.estimatedCostUsd;
     this.sessionCostUsd += usage.estimatedCostUsd;
@@ -2821,6 +3024,9 @@ var CascadeRouter = class _CascadeRouter extends EventEmitter {
     this.stats.tokensByTier[tier] = (this.stats.tokensByTier[tier] ?? 0) + usage.totalTokens;
     this.stats.inputTokensByTier[tier] = (this.stats.inputTokensByTier[tier] ?? 0) + usage.inputTokens;
     this.stats.outputTokensByTier[tier] = (this.stats.outputTokensByTier[tier] ?? 0) + usage.outputTokens;
+    if (featureTag) {
+      this.stats.costByFeature[featureTag] = (this.stats.costByFeature[featureTag] ?? 0) + usage.estimatedCostUsd;
+    }
     this.runTokens += usage.totalTokens;
     this.runCostUsd += usage.estimatedCostUsd;
     this.updateBudgetState();
@@ -2917,6 +3123,13 @@ var BaseTier = class extends EventEmitter {
   hierarchyContext = "";
   /** Propagated AbortSignal — set by the tier's `execute()` before work begins. */
   signal;
+  /**
+   * True for the run's ROOT tier (T3 for Simple, T2 for Moderate, T1 for
+   * Complex). Its own synthesis stream is the user-facing answer and is
+   * tagged `primary` so the desktop renders it live — background workers,
+   * which would interleave, are not tagged.
+   */
+  isPresenter = false;
   constructor(role, id, parentId) {
     super();
     this.role = role;
@@ -2924,6 +3137,10 @@ var BaseTier = class extends EventEmitter {
     this.parentId = parentId;
     this.label = this.id;
   }
+  /** Mark this tier as the run's presenter (root tier). */
+  setPresenter(on = true) {
+    this.isPresenter = on;
+  }
   getStatus() {
     return this.status;
   }
@@ -3357,6 +3574,8 @@ var T3Worker = class extends BaseTier {
   toolRegistry;
   context;
   assignment;
+  /** True when this subtask matched a privacy.paths local-only pattern. */
+  localOnlyMatch = false;
   peerSyncBuffer = [];
   store;
   audit;
@@ -3412,6 +3631,11 @@ var T3Worker = class extends BaseTier {
     this.taskId = taskId;
     this.setLabel(assignment.subtaskTitle);
     this.setStatus("ACTIVE");
+    const privacy = this.router.getPrivacyPaths?.();
+    this.localOnlyMatch = !!privacy?.hasPolicies() && privacy.anyLocalOnly(this.extractArtifactPaths(assignment));
+    if (this.localOnlyMatch) {
+      this.log("Privacy: subtask touches a local-only path \u2014 forcing a private model; raw output will be withheld upstream.");
+    }
     this.tools = this.toolRegistry.getToolDefinitions();
     if (this.reinforcementDepth === 0 && this.router.getReinforcementsConfig?.()?.enabled) {
       this.tools = [...this.tools, {
@@ -3542,9 +3766,17 @@ Now execute your subtask using this context where relevant.`
       }
       const reflectCfg = this.router.getReflectionConfig?.() ?? { enabled: false, maxRounds: 1 };
       if (reflectCfg.enabled) {
-        this.sendStatusUpdate({ progressPct: 85, currentAction: "Reflecting on output", status: "IN_PROGRESS" });
+        this.sendStatusUpdate({ progressPct: 85, currentAction: "Reflecting on output via T2-Critic", status: "IN_PROGRESS" });
         output = await this.reflectAndImprove(assignment, output, reflectCfg.maxRounds);
       }
+      const db = this.router.getWorldStateDB?.();
+      if (db) {
+        try {
+          db.addEntry(this.id, `Completed: ${assignment.subtaskTitle}. Output length: ${output.length} chars.`);
+        } catch (e) {
+          this.log("Failed to write to World State DB");
+        }
+      }
       this.setStatus("COMPLETED", output);
       this.sendStatusUpdate({ progressPct: 100, currentAction: "Subtask complete", status: "IN_PROGRESS", output });
       this.peerBus?.publish(this.id, assignment.subtaskId, output, "COMPLETED");
@@ -3617,6 +3849,16 @@ Now execute your subtask using this context where relevant.`
     while (iterations < MAX_ITERATIONS) {
       iterations++;
       this.throwIfCancelled();
+      const guidance = this.router.getGuidanceQueue?.()?.drain(this.id) ?? [];
+      for (const g of guidance) {
+        this.log(`User intervention received: ${g.text}`);
+        this.sendStatusUpdate({ progressPct: 50, currentAction: "Applying user intervention", status: "IN_PROGRESS" });
+        await this.context.addMessage({
+          role: "user",
+          content: `USER INTERVENTION (mid-run steering \u2014 follow this over prior instructions where they conflict):
+${g.text}`
+        });
+      }
       const options = {
         messages: this.context.getMessages(),
         systemPrompt: this.systemPromptOverride + systemPrompt + (this.hierarchyContext ? `
@@ -3625,13 +3867,15 @@ HIERARCHY CONTEXT: ${this.hierarchyContext}` : "") + textToolSuffix,
         // Don't pass tools array when model can't use them natively
         tools: useTextTools ? void 0 : tools.length ? tools : void 0,
         maxTokens: 4096,
-        ...subtaskModel ? { model: subtaskModel } : {}
+        ...subtaskModel ? { model: subtaskModel } : {},
+        featureTag: this.assignment?.sectionTitle,
+        ...this.localOnlyMatch ? { forceLocal: true } : {}
       };
       const result = await this.router.generate(
         "T3",
         options,
         (chunk) => {
-          this.emit("stream:token", { tierId: this.id, text: chunk.text });
+          this.emit("stream:token", { tierId: this.id, text: chunk.text, primary: this.isPresenter });
         }
       );
       let effectiveToolCalls = result.toolCalls ?? [];
@@ -3789,8 +4033,8 @@ HIERARCHY CONTEXT: ${this.hierarchyContext}` : "") + textToolSuffix,
         tierId: this.id,
         sessionId: this.taskId,
         requireApproval: false,
-        saveSnapshot: async (path19, content) => {
-          this.store?.addFileSnapshot(this.taskId, path19, content);
+        saveSnapshot: async (path21, content) => {
+          this.store?.addFileSnapshot(this.taskId, path21, content);
         },
         sendPeerSync: (to, syncType, content) => {
           this.peerBus?.send(this.id, to, syncType, this.assignment?.subtaskId ?? "", content);
@@ -3960,7 +4204,7 @@ ${assignment.expectedOutput}`;
     const { promisify: promisify4 } = await import('util');
     const execAsync2 = promisify4(exec2);
     for (const artifactPath of artifactPaths) {
-      const absolutePath = path18.resolve(process.cwd(), artifactPath);
+      const absolutePath = path20.resolve(process.cwd(), artifactPath);
       try {
         const stat = await fs4.stat(absolutePath);
         if (!stat.isFile()) {
@@ -3981,7 +4225,7 @@ ${assignment.expectedOutput}`;
           issues.push(`PDF artifact looks too small to be valid: ${artifactPath}`);
           continue;
         }
-        const ext = path18.extname(absolutePath).toLowerCase();
+        const ext = path20.extname(absolutePath).toLowerCase();
         try {
           if (ext === ".ts" || ext === ".tsx") {
             await execAsync2(`npx tsc --noEmit ${absolutePath}`, { timeout: 1e4 });
@@ -4010,30 +4254,35 @@ ${stdout}`);
    * needed. Best-effort: any parse/error just keeps the current output.
    */
   async reflectAndImprove(assignment, output, maxRounds) {
-    const sys = this.systemPromptOverride + (this.hierarchyContext ? `
-
-HIERARCHY CONTEXT: ${this.hierarchyContext}` : "");
     let current = output;
-    for (let round = 0; round < Math.max(1, maxRounds); round++) {
-      try {
-        const verdict = await this.router.generate("T3", {
+    try {
+      for (let round = 0; round < Math.max(1, maxRounds); round++) {
+        const verdictResult = await this.router.generate("T2", {
           messages: [{
             role: "user",
-            content: `Does this output FULLY achieve the goal \u2014 not just the literal task, but the intent behind it?
+            content: `You are an independent critic reviewing another worker's output against its assignment.
 
-Goal / expected: ${assignment.expectedOutput}
+Goal: ${assignment.expectedOutput}
 Subtask: ${assignment.description}
-
-Output:
+Current Output:
 ${current}
 
-Reply with ONLY JSON: {"sufficient": true|false, "notes": "what is weak or missing if not sufficient"}`
+Is this output sufficient and correct? Respond with ONLY a JSON object:
+{"sufficient": true|false, "notes": "what is wrong or missing if false"}`
           }],
-          systemPrompt: sys,
-          maxTokens: 400
+          systemPrompt: "You are a T2-Critic reviewing a T3 Worker's output. Judge strictly against the stated goal.",
+          maxTokens: 400,
+          signal: this.signal,
+          featureTag: assignment.sectionTitle,
+          ...this.localOnlyMatch ? { forceLocal: true } : {}
         });
-        const parsed = JSON.parse(/\{[\s\S]*\}/.exec(verdict.content)?.[0] ?? "{}");
-        if (parsed.sufficient !== false) break;
+        const match = /\{[\s\S]*\}/.exec(verdictResult.content);
+        const parsed = match ? JSON.parse(match[0]) : { sufficient: true };
+        if (parsed.sufficient !== false) {
+          this.log("T2-Critic approved output.");
+          break;
+        }
+        this.log(`T2-Critic rejected output: ${parsed.notes}`);
         const improved = await this.router.generate("T3", {
           messages: [{
             role: "user",
@@ -4045,16 +4294,20 @@ Goal / expected: ${assignment.expectedOutput}
 Current output:
 ${current}`
           }],
-          systemPrompt: sys,
-          maxTokens: 4096
+          systemPrompt: this.systemPromptOverride + (this.hierarchyContext ? `
+
+HIERARCHY CONTEXT: ${this.hierarchyContext}` : ""),
+          maxTokens: 4096,
+          featureTag: assignment.sectionTitle,
+          ...this.localOnlyMatch ? { forceLocal: true } : {}
         });
         const next = (improved.content ?? "").trim();
         if (!next) break;
         current = next;
         this.log("Reflection: revised output for better goal alignment.");
-      } catch {
-        break;
       }
+    } catch (e) {
+      this.log(`T2-Critic reflection failed: ${e}`);
     }
     return current;
   }
@@ -4075,7 +4328,9 @@ Reply with JSON: { "completeness": "pass"|"fail", "correctness": "pass"|"fail",
       maxTokens: 500,
       systemPrompt: this.systemPromptOverride + (this.hierarchyContext ? `
 
-HIERARCHY CONTEXT: ${this.hierarchyContext}` : "")
+HIERARCHY CONTEXT: ${this.hierarchyContext}` : ""),
+      featureTag: assignment.sectionTitle,
+      ...this.localOnlyMatch ? { forceLocal: true } : {}
     });
     try {
       const jsonMatch = /\{[\s\S]*\}/.exec(testResult.content);
@@ -4170,6 +4425,7 @@ Begin execution now.`;
       issues,
       peerSyncsUsed: this.peerSyncBuffer.map((m) => m.fromId),
       correctionAttempts,
+      localOnly: this.localOnlyMatch || void 0,
       reinforcements: this.pendingReinforcements.length ? this.pendingReinforcements : void 0
     };
   }
@@ -4461,6 +4717,42 @@ var PeerBus = class extends EventEmitter {
   }
 };
 
+// src/core/audit/redaction.ts
+var RedactionLayer = class {
+  // Regexes for common secrets/PII
+  static RULES = [
+    // IPv4 addresses (basic approximation)
+    { pattern: /\b(?:\d{1,3}\.){3}\d{1,3}\b/g, replacement: "[REDACTED_IP]" },
+    // Generic API keys/Secrets (looks like a long random hex or b64 string preceded by key/secret/token)
+    { pattern: /(?:\b(?:api_key|apikey|secret|token|password|bearer|auth|authorization)\b[^a-zA-Z0-9_]{1,4})([a-zA-Z0-9_\-\.]{16,})/gi, replacement: "$1[REDACTED_SECRET]" },
+    // Email addresses
+    { pattern: /\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,7}\b/g, replacement: "[REDACTED_EMAIL]" },
+    // Phone numbers (simplistic)
+    { pattern: /\b(?:\+\d{1,3}[- ]?)?\(?\d{3}\)?[- ]?\d{3}[- ]?\d{4}\b/g, replacement: "[REDACTED_PHONE]" },
+    // AWS Access Key ID
+    { pattern: /\b(AKIA[0-9A-Z]{16})\b/g, replacement: "[REDACTED_AWS_AK]" }
+  ];
+  /**
+   * Applies all redaction rules to the input string.
+   */
+  static redact(text) {
+    if (!text) return text;
+    let redacted = text;
+    for (const rule of this.RULES) {
+      if (rule.pattern.test(redacted)) {
+        rule.pattern.lastIndex = 0;
+        redacted = redacted.replace(rule.pattern, (match, p1, offset, str) => {
+          if (p1 && match.includes(p1) && p1 !== match) {
+            return match.replace(p1, rule.replacement.replace("$1", ""));
+          }
+          return rule.replacement;
+        });
+      }
+    }
+    return redacted;
+  }
+};
+
 // src/core/tiers/t2-manager.ts
 var T2_SYSTEM_PROMPT = `You are a T2 Manager agent in the Cascade AI system.
 Your role is to analyze a section of a task and decompose it into 2-5 discrete subtasks for T3 Workers.
@@ -4689,7 +4981,8 @@ HIERARCHY CONTEXT: ${this.hierarchyContext}` : ""),
     try {
       const jsonMatch = /\[[\s\S]*\]/.exec(result.content);
       if (!jsonMatch) throw new Error("No JSON array found");
-      return JSON.parse(jsonMatch[0]);
+      const parsed = JSON.parse(jsonMatch[0]);
+      return parsed.map((a) => ({ ...a, sectionTitle: assignment.sectionTitle }));
     } catch {
       return [{
         subtaskId: randomUUID(),
@@ -4699,6 +4992,8 @@ HIERARCHY CONTEXT: ${this.hierarchyContext}` : ""),
         constraints: assignment.constraints,
         peerT3Ids: [],
         parentT2: this.id,
+        sectionTitle: assignment.sectionTitle,
+        dependsOn: [],
         executionMode: "parallel"
       }];
     }
@@ -4818,6 +5113,14 @@ HIERARCHY CONTEXT: ${this.hierarchyContext}` : ""),
         const assignment = sanitizedAssignments.find((a) => a.subtaskId === id);
         const worker = workerMap.get(id);
         const result = await worker.execute(assignment, taskId, waveSignal);
+        if (result.localOnly) {
+          result.output = `[local-only path \u2014 output withheld by privacy policy; status: ${result.status}; checks passed: ${result.testResults.passed.length}/${result.testResults.checksRun.length || 0}]`;
+        } else {
+          if (typeof result.output === "string" && result.output) {
+            result.output = RedactionLayer.redact(result.output);
+          }
+        }
+        if (result.issues) result.issues = result.issues.map((i) => RedactionLayer.redact(i));
         resultMap.set(id, result);
         return result;
       };
@@ -5033,6 +5336,7 @@ ${peerOutputs}` : "";
         chunkEnd++;
       }
       i = chunkEnd;
+      const isLastChunk = chunkEnd >= completed.length;
       const prompt = `Summarize these T3 worker outputs for section "${assignment.sectionTitle}" in 2-3 sentences.
   ${currentSummary ? `
 PREVIOUS SUMMARY SO FAR:
@@ -5042,6 +5346,7 @@ NEW OUTPUTS TO INTEGRATE:
 ` : "\nOUTPUTS:\n"}${chunkText}${peerContext}`;
       const messages = [{ role: "user", content: prompt }];
       try {
+        const streamFinal = isLastChunk && this.isPresenter ? (chunk) => this.emit("stream:token", { tierId: this.id, text: chunk.text, primary: true }) : void 0;
         const result = await this.router.generate("T2", {
           messages,
           systemPrompt: this.systemPromptOverride + "You are a T2 Manager. Summarize the work of your T3 workers succinctly." + (this.hierarchyContext ? `
@@ -5049,7 +5354,7 @@ NEW OUTPUTS TO INTEGRATE:
 HIERARCHY CONTEXT: ${this.hierarchyContext}` : ""),
           maxTokens: 500,
           ...this.sectionModel ? { model: this.sectionModel } : {}
-        });
+        }, streamFinal);
         currentSummary = result.content;
       } catch (err) {
         this.log(`aggregateResults: LLM summarization failed at chunk \u2014 returning raw T3 outputs. Error: ${err instanceof Error ? err.message : String(err)}`);
@@ -5101,14 +5406,11 @@ HIERARCHY CONTEXT: ${this.hierarchyContext}` : ""),
         ...this.sectionModel ? { model: this.sectionModel } : {}
       });
       const answer = result.content.trim().toUpperCase();
-      if (answer.includes("YES")) {
-        return { requestId: req.id, approved: true, always: true, decidedBy: "T2", reasoning: "T2 LLM evaluated: consistent with section goal" };
-      }
-      if (answer.includes("NO")) {
-        return { requestId: req.id, approved: false, always: true, decidedBy: "T2", reasoning: "T2 LLM evaluated: inconsistent with section goal" };
-      }
+      const verdict = answer.includes("YES") ? "approve" : answer.includes("NO") ? "deny" : "unsure";
+      (req.trail ??= []).push({ tier: "T2", verdict, reason: `T2: ${verdict === "approve" ? "consistent with section goal" : verdict === "deny" ? "inconsistent with section goal" : "unsure"}` });
       return null;
     } catch {
+      (req.trail ??= []).push({ tier: "T2", verdict: "unsure", reason: "T2 evaluation failed" });
       return null;
     }
   }
@@ -5447,10 +5749,15 @@ In 3-5 terse bullets, flag the most important RISKS, GAPS, or over-/under-decomp
     }
   }
   async decomposeTask(prompt, systemContext) {
+    const db = this.router.getWorldStateDB?.();
+    const worldStateContext = db ? `
+
+PROJECT WORLD STATE (Current architecture and recent changes):
+${db.getFormattedState()}` : "";
     const contextSection = systemContext ? `
 Project context:
 ${systemContext}` : "";
-    const decompositionPrompt = `Analyze this task and create an execution plan.${contextSection}
+    const decompositionPrompt = `Analyze this task and create an execution plan.${contextSection}${worldStateContext}
 
     Task: ${prompt}
 
@@ -5782,7 +6089,7 @@ Instructions:
       systemPrompt: this.systemPromptOverride + "You are a final output compiler. Summarize and format the task results clearly.",
       maxTokens: 8e3
     }, (chunk) => {
-      this.emit("stream:token", { tierId: this.id, text: chunk.text });
+      this.emit("stream:token", { tierId: this.id, text: chunk.text, primary: this.isPresenter });
     });
     return result.content;
   }
@@ -5811,14 +6118,11 @@ Reply with exactly one word: YES, NO, or UNSURE.
         temperature: 0
       });
       const answer = result.content.trim().toUpperCase();
-      if (answer.includes("YES")) {
-        return { requestId: req.id, approved: true, always: true, decidedBy: "T1", reasoning: "T1 evaluated: consistent with overall task goal" };
-      }
-      if (answer.includes("NO")) {
-        return { requestId: req.id, approved: false, always: true, decidedBy: "T1", reasoning: "T1 evaluated: not consistent with overall task goal" };
-      }
+      const verdict = answer.includes("YES") ? "approve" : answer.includes("NO") ? "deny" : "unsure";
+      (req.trail ??= []).push({ tier: "T1", verdict, reason: `T1: ${verdict === "approve" ? "consistent with overall task goal" : verdict === "deny" ? "not consistent with overall task goal" : "unsure"}` });
       return null;
     } catch {
+      (req.trail ??= []).push({ tier: "T1", verdict: "unsure", reason: "T1 evaluation failed" });
       return null;
     }
   }
@@ -5932,16 +6236,16 @@ function resolveInWorkspace(workspaceRoot, input) {
   if (typeof input !== "string" || input.length === 0) {
     throw new WorkspaceSandboxError(String(input), workspaceRoot);
   }
-  const root = path18.resolve(workspaceRoot);
-  const abs = path18.isAbsolute(input) ? path18.resolve(input) : path18.resolve(root, input);
-  const rel = path18.relative(root, abs);
-  if (rel === "" || rel === ".") ; else if (rel.startsWith("..") || path18.isAbsolute(rel)) {
+  const root = path20.resolve(workspaceRoot);
+  const abs = path20.isAbsolute(input) ? path20.resolve(input) : path20.resolve(root, input);
+  const rel = path20.relative(root, abs);
+  if (rel === "" || rel === ".") ; else if (rel.startsWith("..") || path20.isAbsolute(rel)) {
     throw new WorkspaceSandboxError(input, root);
   }
   try {
-    const real = fs17.realpathSync(abs);
-    const realRel = path18.relative(root, real);
-    if (realRel !== "" && realRel !== "." && (realRel.startsWith("..") || path18.isAbsolute(realRel))) {
+    const real = fs19.realpathSync(abs);
+    const realRel = path20.relative(root, real);
+    if (realRel !== "" && realRel !== "." && (realRel.startsWith("..") || path20.isAbsolute(realRel))) {
       throw new WorkspaceSandboxError(input, root);
     }
   } catch (e) {
@@ -6002,7 +6306,7 @@ var FileWriteTool = class extends BaseTool {
       } catch {
       }
     }
-    await fs4.mkdir(path18.dirname(absPath), { recursive: true });
+    await fs4.mkdir(path20.dirname(absPath), { recursive: true });
     await fs4.writeFile(absPath, content, "utf-8");
     return `Written ${content.length} characters to ${filePath}`;
   }
@@ -6500,7 +6804,7 @@ var ImageAnalyzeTool = class extends BaseTool {
 };
 async function fileToImageAttachment(filePath) {
   const data = await fs4.readFile(filePath);
-  const ext = path18.extname(filePath).toLowerCase();
+  const ext = path20.extname(filePath).toLowerCase();
   const mimeMap = {
     ".jpg": "image/jpeg",
     ".jpeg": "image/jpeg",
@@ -6534,14 +6838,14 @@ var PDFCreateTool = class extends BaseTool {
     const filePath = input["path"];
     const content = input["content"];
     const title = input["title"];
-    const dir = path18.dirname(filePath);
-    if (!fs17.existsSync(dir)) {
-      fs17.mkdirSync(dir, { recursive: true });
+    const dir = path20.dirname(filePath);
+    if (!fs19.existsSync(dir)) {
+      fs19.mkdirSync(dir, { recursive: true });
     }
     return new Promise((resolve, reject) => {
       try {
         const doc = new PDFDocument({ margin: 50 });
-        const stream = fs17.createWriteStream(filePath);
+        const stream = fs19.createWriteStream(filePath);
         doc.pipe(stream);
         if (title) {
           doc.info["Title"] = title;
@@ -6619,22 +6923,22 @@ var CodeInterpreterTool = class extends BaseTool {
       }
       cmdPrefix = NODE_CMD;
     }
-    const tmpDir = path18.join(this.workspaceRoot, ".cascade", "tmp");
-    if (!fs17.existsSync(tmpDir)) {
-      fs17.mkdirSync(tmpDir, { recursive: true });
+    const tmpDir = path20.join(this.workspaceRoot, ".cascade", "tmp");
+    if (!fs19.existsSync(tmpDir)) {
+      fs19.mkdirSync(tmpDir, { recursive: true });
     }
     const extension = language === "python" ? "py" : "js";
     const fileName = `intp_${randomUUID().slice(0, 8)}.${extension}`;
-    const filePath = path18.join(tmpDir, fileName);
-    fs17.writeFileSync(filePath, code, "utf-8");
+    const filePath = path20.join(tmpDir, fileName);
+    fs19.writeFileSync(filePath, code, "utf-8");
     const execArgs = [filePath, ...args];
     return new Promise((resolve) => {
       const startMs = Date.now();
       execFile(cmdPrefix, execArgs, { cwd: this.workspaceRoot, timeout: 3e4 }, (error, stdout, stderr) => {
         const duration = Date.now() - startMs;
         try {
-          if (fs17.existsSync(filePath)) {
-            fs17.unlinkSync(filePath);
+          if (fs19.existsSync(filePath)) {
+            fs19.unlinkSync(filePath);
           }
         } catch (cleanupErr) {
           console.error(`Failed to cleanup interpreter script ${filePath}:`, cleanupErr);
@@ -6913,7 +7217,7 @@ var GlobTool = class extends BaseTool {
   };
   async execute(input, _options) {
     const pattern = input["pattern"];
-    const searchPath = input["path"] ? path18.resolve(this.workspaceRoot, input["path"]) : this.workspaceRoot;
+    const searchPath = input["path"] ? path20.resolve(this.workspaceRoot, input["path"]) : this.workspaceRoot;
     const matches = await glob(pattern, {
       cwd: searchPath,
       ignore: ["node_modules/**", ".git/**", "dist/**", "build/**"],
@@ -6926,7 +7230,7 @@ var GlobTool = class extends BaseTool {
     const withMtime = await Promise.all(
       matches.map(async (rel) => {
         try {
-          const stat = await fs4.stat(path18.join(searchPath, rel));
+          const stat = await fs4.stat(path20.join(searchPath, rel));
           return { rel, mtime: stat.mtimeMs };
         } catch {
           return { rel, mtime: 0 };
@@ -6975,7 +7279,7 @@ var GrepTool = class extends BaseTool {
   };
   async execute(input, _options) {
     const pattern = input["pattern"];
-    const searchPath = input["path"] ? path18.resolve(this.workspaceRoot, input["path"]) : this.workspaceRoot;
+    const searchPath = input["path"] ? path20.resolve(this.workspaceRoot, input["path"]) : this.workspaceRoot;
     const globPattern = input["glob"];
     const outputMode = input["output_mode"] ?? "content";
     const context = input["context"] ?? 0;
@@ -7029,12 +7333,12 @@ var GrepTool = class extends BaseTool {
         nodir: true
       });
     } catch {
-      files = [path18.relative(searchPath, searchPath) || "."];
+      files = [path20.relative(searchPath, searchPath) || "."];
     }
     const results = [];
     let totalCount = 0;
     for (const rel of files) {
-      const abs = path18.join(searchPath, rel);
+      const abs = path20.join(searchPath, rel);
       let content;
       try {
         content = await fs4.readFile(abs, "utf-8");
@@ -7396,10 +7700,10 @@ var ToolRegistry = class extends EventEmitter {
   }
   isIgnored(filePath) {
     if (!filePath) return false;
-    const abs = path18.resolve(this.workspaceRoot, filePath);
-    const rel = path18.relative(this.workspaceRoot, abs);
-    if (!rel || rel.startsWith("..") || path18.isAbsolute(rel)) return true;
-    const posixRel = rel.split(path18.sep).join("/");
+    const abs = path20.resolve(this.workspaceRoot, filePath);
+    const rel = path20.relative(this.workspaceRoot, abs);
+    if (!rel || rel.startsWith("..") || path20.isAbsolute(rel)) return true;
+    const posixRel = rel.split(path20.sep).join("/");
     return this.ignoreMatcher.ignores(posixRel);
   }
 };
@@ -7516,6 +7820,9 @@ var McpClient = class _McpClient {
     return this.clients.has(serverName);
   }
 };
+
+// src/core/cascade.ts
+init_audit_logger();
 var SAFE_TOOLS = /* @__PURE__ */ new Set([
   "file_read",
   "file_list",
@@ -7768,7 +8075,8 @@ var WorkspaceConfigSchema = z.object({
   cascadeMdPath: z.string().default("CASCADE.md"),
   configPath: z.string().default(".cascade/config.json"),
   keystorePath: z.string().default(".cascade/keystore.enc"),
-  auditLogPath: z.string().default(".cascade/audit.log")
+  auditLogPath: z.string().default(".cascade/audit.log"),
+  debugWorldState: z.boolean().default(false)
 });
 var CascadeConfigSchema = z.object({
   version: z.literal("1.0").default("1.0"),
@@ -7913,6 +8221,16 @@ var CascadeConfigSchema = z.object({
    *   'parallel' / 'sequential' — force it.
    */
   t3Execution: z.enum(["auto", "parallel", "sequential"]).default("auto"),
+  /**
+   * Per-path privacy tiers. A subtask touching a `local-only` path is forced
+   * onto LOCAL models (never cloud) and its raw output is withheld from the
+   * tiers above. Patterns use .gitignore syntax, like .cascadeignore.
+   */
+  privacy: z.object({
+    paths: z.array(z.object({ pattern: z.string().min(1), policy: z.enum(["local-only"]) })).default([])
+  }).optional(),
+  /** Routing controls — forceTier pins the root tier, bypassing the classifier. */
+  routing: z.object({ forceTier: z.enum(["auto", "T1", "T2", "T3"]).default("auto") }).optional(),
   /**
    * T3→T2 reinforcement: when enabled, a worker that discovers its subtask should
    * fan out can call the `request_workers` tool to have its T2 manager spawn
@@ -8181,9 +8499,10 @@ var TaskAnalyzer = class {
     analysisCache.clear();
   }
 };
-var DEFAULT_STATS_FILE = path18.join(os4.homedir(), ".cascade", "model-perf.json");
+var DEFAULT_STATS_FILE = path20.join(os6.homedir(), ".cascade", "model-perf.json");
 var ModelPerformanceTracker = class {
   stats = /* @__PURE__ */ new Map();
+  featureStats = /* @__PURE__ */ new Map();
   statsFile;
   loaded = false;
   constructor(statsFile = DEFAULT_STATS_FILE) {
@@ -8195,18 +8514,29 @@ var ModelPerformanceTracker = class {
     try {
       const raw = await fs4.readFile(this.statsFile, "utf-8");
       const parsed = JSON.parse(raw);
-      for (const [key, stat] of Object.entries(parsed)) {
-        this.stats.set(key, stat);
+      if (parsed.models) {
+        for (const [key, stat] of Object.entries(parsed.models)) this.stats.set(key, stat);
+      } else {
+        for (const [key, stat] of Object.entries(parsed)) {
+          if (stat && typeof stat === "object" && typeof stat.successCount === "number") {
+            this.stats.set(key, stat);
+          }
+        }
+      }
+      if (parsed.features) {
+        for (const [key, stat] of Object.entries(parsed.features)) this.featureStats.set(key, stat);
       }
     } catch {
     }
   }
   async save() {
     try {
-      await fs4.mkdir(path18.dirname(this.statsFile), { recursive: true });
-      const obj = {};
-      for (const [key, stat] of this.stats) obj[key] = stat;
-      await fs4.writeFile(this.statsFile, JSON.stringify(obj, null, 2), "utf-8");
+      await fs4.mkdir(path20.dirname(this.statsFile), { recursive: true });
+      const modelsObj = {};
+      const featuresObj = {};
+      for (const [key, stat] of this.stats) modelsObj[key] = stat;
+      for (const [key, stat] of this.featureStats) featuresObj[key] = stat;
+      await fs4.writeFile(this.statsFile, JSON.stringify({ models: modelsObj, features: featuresObj }, null, 2), "utf-8");
     } catch {
     }
   }
@@ -8227,6 +8557,13 @@ var ModelPerformanceTracker = class {
       sampleCount: s.sampleCount + 1
     });
   }
+  recordFeatureCost(featureTag, costUsd) {
+    const s = this.featureStats.get(featureTag) ?? { totalCostUsd: 0, runCount: 0 };
+    this.featureStats.set(featureTag, {
+      totalCostUsd: s.totalCostUsd + costUsd,
+      runCount: s.runCount + 1
+    });
+  }
   /**
    * Record an explicit user rating (good/bad). Counts as 3 automatic samples
    * so user feedback carries significantly more weight than auto-detected outcomes.
@@ -8241,6 +8578,9 @@ var ModelPerformanceTracker = class {
   getAll() {
     return new Map(this.stats);
   }
+  getAllFeatures() {
+    return new Map(this.featureStats);
+  }
   /**
    * Returns 0.05–1.0; defaults to 0.5 (neutral prior) when no history exists.
    * High retry counts penalise the score.
@@ -8605,7 +8945,7 @@ Required capability: ${description.slice(0, 300)}`;
    *  any dangerous action, so a silently-reloaded tool can't act without approval. */
   async loadPersistedTools() {
     if (!this.workspacePath || !this.persistEnabled) return;
-    const file = path18.join(this.workspacePath, ".cascade", DYNAMIC_TOOLS_FILE);
+    const file = path20.join(this.workspacePath, ".cascade", DYNAMIC_TOOLS_FILE);
     try {
       const raw = await fs4.readFile(file, "utf-8");
       const specs = JSON.parse(raw);
@@ -8629,8 +8969,8 @@ Required capability: ${description.slice(0, 300)}`;
   }
   async persist() {
     if (!this.workspacePath || !this.persistEnabled) return;
-    const dir = path18.join(this.workspacePath, ".cascade");
-    const file = path18.join(dir, DYNAMIC_TOOLS_FILE);
+    const dir = path20.join(this.workspacePath, ".cascade");
+    const file = path20.join(dir, DYNAMIC_TOOLS_FILE);
     try {
       await fs4.mkdir(dir, { recursive: true });
       await fs4.writeFile(file, JSON.stringify(Array.from(this.specs.values()), null, 2), "utf-8");
@@ -8643,6 +8983,166 @@ Required capability: ${description.slice(0, 300)}`;
     return Array.from(this.specs.keys());
   }
 };
+var WorldStateDB = class {
+  constructor(workspacePath, debugMode = false) {
+    this.workspacePath = workspacePath;
+    this.debugMode = debugMode;
+    const cascadeDir = path20.join(workspacePath, ".cascade");
+    if (!fs19.existsSync(cascadeDir)) {
+      fs19.mkdirSync(cascadeDir, { recursive: true });
+    }
+    this.keyPath = path20.join(cascadeDir, "world_state.key");
+    this.dbPath = path20.join(cascadeDir, "world_state.db");
+    this.initEncryptionKey();
+    this.db = new Database(this.dbPath);
+    this.db.pragma("journal_mode = WAL");
+    this.db.exec(`
+      CREATE TABLE IF NOT EXISTS world_state (
+        id TEXT PRIMARY KEY,
+        timestamp TEXT NOT NULL,
+        worker_id TEXT NOT NULL,
+        encrypted_payload TEXT NOT NULL
+      )
+    `);
+  }
+  workspacePath;
+  debugMode;
+  db;
+  keyPath;
+  dbPath;
+  encryptionKey;
+  initEncryptionKey() {
+    if (fs19.existsSync(this.keyPath)) {
+      this.encryptionKey = fs19.readFileSync(this.keyPath);
+    } else {
+      this.encryptionKey = crypto3.randomBytes(32);
+      fs19.writeFileSync(this.keyPath, this.encryptionKey);
+    }
+  }
+  encrypt(text) {
+    const iv = crypto3.randomBytes(16);
+    const cipher = crypto3.createCipheriv("aes-256-gcm", this.encryptionKey, iv);
+    let encrypted = cipher.update(text, "utf8", "hex");
+    encrypted += cipher.final("hex");
+    const authTag = cipher.getAuthTag().toString("hex");
+    return `${iv.toString("hex")}:${authTag}:${encrypted}`;
+  }
+  decrypt(text) {
+    const parts = text.split(":");
+    if (parts.length !== 3) throw new Error("Invalid encrypted payload format");
+    const [ivHex, authTagHex, encryptedHex] = parts;
+    const iv = Buffer.from(ivHex, "hex");
+    const authTag = Buffer.from(authTagHex, "hex");
+    const decipher = crypto3.createDecipheriv("aes-256-gcm", this.encryptionKey, iv);
+    decipher.setAuthTag(authTag);
+    let decrypted = decipher.update(encryptedHex, "hex", "utf8");
+    decrypted += decipher.final("utf8");
+    return decrypted;
+  }
+  addEntry(workerId, summary) {
+    const id = crypto3.randomUUID();
+    const timestamp = (/* @__PURE__ */ new Date()).toISOString();
+    const payload = JSON.stringify({ summary });
+    const encryptedPayload = this.encrypt(payload);
+    const stmt = this.db.prepare("INSERT INTO world_state (id, timestamp, worker_id, encrypted_payload) VALUES (?, ?, ?, ?)");
+    stmt.run(id, timestamp, workerId, encryptedPayload);
+    this.dumpDebugIfNeeded();
+    return id;
+  }
+  getAllEntries() {
+    const stmt = this.db.prepare("SELECT id, timestamp, worker_id, encrypted_payload FROM world_state ORDER BY timestamp ASC");
+    const rows = stmt.all();
+    return rows.map((row) => {
+      try {
+        const decrypted = this.decrypt(row.encrypted_payload);
+        const parsed = JSON.parse(decrypted);
+        return {
+          id: row.id,
+          timestamp: row.timestamp,
+          workerId: row.worker_id,
+          summary: parsed.summary
+        };
+      } catch (err) {
+        return {
+          id: row.id,
+          timestamp: row.timestamp,
+          workerId: row.worker_id,
+          summary: "[Decryption Failed - Payload Corrupted]"
+        };
+      }
+    });
+  }
+  getFormattedState() {
+    const entries = this.getAllEntries();
+    if (entries.length === 0) return "World State is currently empty.";
+    return entries.map((e, idx) => `[${e.timestamp}] Step ${idx + 1} (${e.workerId}): ${e.summary}`).join("\n");
+  }
+  dumpDebugIfNeeded() {
+    if (!this.debugMode) return;
+    try {
+      const dumpPath = path20.join(os6.tmpdir(), "cascade_world_state_debug.json");
+      const entries = this.getAllEntries();
+      fs19.writeFileSync(dumpPath, JSON.stringify(entries, null, 2), "utf-8");
+    } catch (err) {
+      console.error("Failed to dump debug world state", err);
+    }
+  }
+  close() {
+    this.db.close();
+  }
+};
+var ignore2 = ignoreFactory.default ?? ignoreFactory;
+var PrivacyPaths = class {
+  localOnly;
+  hasRules;
+  constructor(policies = []) {
+    this.localOnly = ignore2();
+    const patterns = policies.filter((p) => p.policy === "local-only").map((p) => p.pattern);
+    if (patterns.length) this.localOnly.add(patterns);
+    this.hasRules = patterns.length > 0;
+  }
+  /** True when any privacy rules are configured at all (cheap short-circuit). */
+  hasPolicies() {
+    return this.hasRules;
+  }
+  /** True when the given workspace-relative path falls under a local-only policy. */
+  isLocalOnly(relativePath) {
+    if (!this.hasRules || !relativePath) return false;
+    try {
+      return this.localOnly.ignores(relativePath.replace(/^\.?\//, ""));
+    } catch {
+      return false;
+    }
+  }
+  /** True when ANY of the given paths falls under a local-only policy. */
+  anyLocalOnly(relativePaths) {
+    return relativePaths.some((p) => this.isLocalOnly(p));
+  }
+};
+
+// src/core/steering/guidance.ts
+var GuidanceQueue = class {
+  entries = [];
+  /** Per-consumer read cursor so a broadcast entry reaches each worker once. */
+  cursors = /* @__PURE__ */ new Map();
+  push(text, nodeId) {
+    const entry = { text, nodeId, timestamp: (/* @__PURE__ */ new Date()).toISOString() };
+    this.entries.push(entry);
+    return entry;
+  }
+  /**
+   * New entries for this consumer since its last drain, filtered to entries
+   * that target it (or target everyone). Advances the consumer's cursor.
+   */
+  drain(consumerId) {
+    const from = this.cursors.get(consumerId) ?? 0;
+    this.cursors.set(consumerId, this.entries.length);
+    return this.entries.slice(from).filter((e) => !e.nodeId || consumerId === e.nodeId || consumerId.startsWith(e.nodeId));
+  }
+  get size() {
+    return this.entries.length;
+  }
+};
 
 // src/core/cascade.ts
 var Cascade = class _Cascade extends EventEmitter {
@@ -8662,6 +9162,9 @@ var Cascade = class _Cascade extends EventEmitter {
   taskAnalyzer;
   perfTracker;
   toolCreator;
+  worldStateDB;
+  encryptedAuditLogger;
+  guidanceQueue;
   workspacePath;
   constructor(config, workspacePath, store) {
     super();
@@ -8683,6 +9186,23 @@ var Cascade = class _Cascade extends EventEmitter {
     });
     this.toolRegistry = new ToolRegistry(this.config.tools, workspacePath);
     this.telemetry = config.telemetry?.enabled ? new Telemetry(config.telemetry, config.telemetry.distinctId ?? "anonymous") : noopTelemetry;
+    this.worldStateDB = new WorldStateDB(this.workspacePath, this.config.workspace?.debugWorldState ?? false);
+    this.router.setWorldStateDB(this.worldStateDB);
+    this.encryptedAuditLogger = new AuditLogger2(this.workspacePath, this.config.workspace?.debugWorldState ?? false);
+    const privacyPolicies = this.config.privacy?.paths ?? [];
+    if (privacyPolicies.length) this.router.setPrivacyPaths(new PrivacyPaths(privacyPolicies));
+    this.guidanceQueue = new GuidanceQueue();
+    this.router.setGuidanceQueue(this.guidanceQueue);
+  }
+  /**
+   * Live intervention: inject a user correction into the running hierarchy.
+   * Every active T3 worker (or only the one matching `nodeId`) picks it up at
+   * the top of its next agent-loop iteration as a USER INTERVENTION message.
+   */
+  injectGuidance(text, nodeId) {
+    const entry = this.guidanceQueue.push(text, nodeId);
+    this.encryptedAuditLogger?.logEvent("user_guidance", nodeId ?? "*", { text });
+    this.emit("guidance:injected", entry);
   }
   initOptionalFeatures() {
     if (this.config.cascadeAuto === true) {
@@ -8845,6 +9365,12 @@ ${last.partialOutput}` : "");
     if (!prompt) return null;
     return this.run({ prompt });
   }
+  getWorkspacePath() {
+    return this.workspacePath;
+  }
+  getWorldStateDB() {
+    return this.worldStateDB;
+  }
   /**
    * Record an explicit user rating for the last completed run.
    * Explicit ratings carry 3× the weight of auto-detected outcomes so user
@@ -8931,6 +9457,11 @@ ${last.partialOutput}` : "");
       }
       this.initOptionalFeatures();
       if (this.toolCreator) await this.toolCreator.loadPersistedTools();
+      if (this.encryptedAuditLogger) {
+        this.on("tool:call", (e) => this.encryptedAuditLogger.logEvent("tool_call", e.tierId || "unknown", e));
+        this.on("tool:result", (e) => this.encryptedAuditLogger.logEvent("tool_result", e.tierId || "unknown", e));
+        this.on("tier:status", (e) => this.encryptedAuditLogger.logEvent("tier_status", e.tierId || "unknown", e));
+      }
       this.initialized = true;
     })();
     try {
@@ -8974,6 +9505,21 @@ ${last.partialOutput}` : "");
     const producesArtifact = /\b(?:create|build|implement|generate|write|refactor|rewrite|add|fix|deploy|install|migrate|scaffold|set up|save (?:a|the)|report|\.(?:pdf|md|txt|json|csv|py|js|ts|tsx|jsx|html|docx?))\b/i.test(p);
     return inquiry && !producesArtifact;
   }
+  /**
+   * Strong, explicit signals that a task needs the full hierarchy (planning +
+   * multiple sections/workers). Deliberately conservative: requires a
+   * build/implementation verb AND either an app/system-scale noun or an
+   * explicit multi-part structure, so ordinary single-file asks (handled as
+   * Simple/Moderate) don't get over-escalated.
+   */
+  looksClearlyComplex(prompt) {
+    const p = prompt.trim();
+    if (p.length < 24) return false;
+    const buildVerb = /\b(?:build|implement|create|develop|design|scaffold|refactor|migrate|architect|set up|integrate)\b/i.test(p);
+    const scaleNoun = /\b(?:app(?:lication)?|system|platform|service|api|backend|frontend|full[- ]?stack|website|dashboard|pipeline|microservices?|database schema|authentication|end[- ]to[- ]end|codebase|project|multiple files|several (?:files|modules|components)|test suite)\b/i.test(p);
+    const multiPart = /(?:\b(?:and|then|also|plus|as well as)\b.*\b(?:and|then|also)\b)|(?:^|\n)\s*(?:[-*]|\d+[.)])\s+/i.test(p);
+    return buildVerb && (scaleNoun || multiPart);
+  }
   // Cache glob scan results per workspace path to avoid repeated I/O.
   static globCache = /* @__PURE__ */ new Map();
   async countWorkspaceFiles(workspacePath) {
@@ -9057,10 +9603,16 @@ ${prompt}` : prompt;
       let verdict;
       if (match) {
         verdict = match[1] === "simple" ? "Simple" : match[1] === "moderate" ? "Moderate" : "Complex";
-        this.recordDecision("complexity", `${verdict} \u2014 classifier: ${reason || "no reason given"}`);
+        if (verdict !== "Complex" && this.looksClearlyComplex(prompt)) {
+          this.recordDecision("complexity", `Complex \u2014 heuristic floor over classifier "${verdict}": explicit multi-step build/implementation signals (T1 engaged)`);
+          verdict = "Complex";
+        } else {
+          this.recordDecision("complexity", `${verdict} \u2014 classifier: ${reason || "no reason given"}`);
+        }
       } else {
-        verdict = prompt.trim().split(/\s+/).length <= 12 ? "Simple" : "Moderate";
-        this.recordDecision("complexity", `${verdict} \u2014 classifier output unparseable; defaulted by length`);
+        const words = prompt.trim().split(/\s+/).length;
+        verdict = words <= 12 ? "Simple" : words >= 40 || this.looksClearlyComplex(prompt) ? "Complex" : "Moderate";
+        this.recordDecision("complexity", `${verdict} \u2014 classifier output unparseable; defaulted by length/signals`);
       }
       return verdict;
     } catch {
@@ -9112,7 +9664,15 @@ ${prompt}` : prompt;
       }
       escalator.resolveUserDecision(req.id, approved, always);
     });
-    const complexity = await this.determineComplexity(options.prompt, options.workspacePath || process.cwd(), options.conversationHistory);
+    const forceTier = this.config.routing?.forceTier;
+    const forced = forceTier === "T1" ? "Complex" : forceTier === "T2" ? "Moderate" : forceTier === "T3" ? "Simple" : void 0;
+    let complexity;
+    if (forced) {
+      complexity = forced;
+      this.recordDecision("complexity", `${forced} \u2014 manually forced via routing.forceTier=${forceTier}`);
+    } else {
+      complexity = await this.determineComplexity(options.prompt, options.workspacePath || process.cwd(), options.conversationHistory);
+    }
     this.telemetry.capture("cascade:session_start", {
       complexity,
       providerCount: this.config.providers.length,
@@ -9192,6 +9752,7 @@ ${prompt}` : prompt;
     try {
       if (complexity === "Simple") {
         const t3 = new T3Worker(this.router, this.toolRegistry, "root");
+        t3.setPresenter(true);
         t3.setHierarchyContext("You are the DIRECT worker for this task. There is no T1 Administrator or T2 Manager involved in this run.");
         if (identityPrompt) {
           t3.setSystemPromptOverride(identityPrompt);
@@ -9216,6 +9777,7 @@ ${prompt}` : prompt;
         this.emit("tier:status", { tierId: "t3-root", status: "COMPLETED", role: "T3" });
       } else if (complexity === "Moderate") {
         const t2 = new T2Manager(this.router, this.toolRegistry, "root");
+        t2.setPresenter(true);
         t2.setHierarchyContext("You are the ROOT Manager for this task. There is no T1 Administrator involved in this run. You are responsible for decomposing the task and managing T3 workers directly.");
         if (identityPrompt) {
           t2.setSystemPromptOverride(identityPrompt);
@@ -9265,6 +9827,7 @@ ${prompt}` : prompt;
         }
       } else {
         const t1 = new T1Administrator(this.router, this.toolRegistry, this.config);
+        t1.setPresenter(true);
         t1.setHierarchyContext("You are the top-level Administrator. You are responsible for the overall plan and supervising multiple T2 Managers.");
         if (identityPrompt) {
           t1.setSystemPromptOverride(identityPrompt);
@@ -9356,6 +9919,7 @@ ${prompt}` : prompt;
       durationMs,
       costByTier: stats.costByTier,
       tokensByTier: stats.tokensByTier,
+      costByFeature: stats.costByFeature,
       costPercentByTier: this.router.getTierCostPercentages()
     };
   }
@@ -9423,7 +9987,7 @@ var Keystore = class {
       const creds = await this.keytar.findCredentials(KEYTAR_SERVICE);
       this.cache = Object.fromEntries(creds.map((c) => [c.account, c.password]));
       this.backend = "keytar";
-      if (password && fs17.existsSync(this.storePath)) {
+      if (password && fs19.existsSync(this.storePath)) {
         try {
           const fileEntries = this.decryptFile(password);
           for (const [k, v] of Object.entries(fileEntries)) {
@@ -9442,8 +10006,8 @@ var Keystore = class {
         "Keystore unlock requires a password because the OS keychain (keytar) is not available on this system."
       );
     }
-    if (!fs17.existsSync(this.storePath)) {
-      const salt = crypto.randomBytes(SALT_LEN);
+    if (!fs19.existsSync(this.storePath)) {
+      const salt = crypto3.randomBytes(SALT_LEN);
       this.masterKey = this.deriveKey(password, salt);
       this.writeWithSalt({}, salt);
       this.cache = {};
@@ -9456,8 +10020,8 @@ var Keystore = class {
   }
   /** Synchronous legacy unlock kept for AES-only environments. */
   unlockSync(password) {
-    if (!fs17.existsSync(this.storePath)) {
-      const salt = crypto.randomBytes(SALT_LEN);
+    if (!fs19.existsSync(this.storePath)) {
+      const salt = crypto3.randomBytes(SALT_LEN);
       this.masterKey = this.deriveKey(password, salt);
       this.writeWithSalt({}, salt);
       this.cache = {};
@@ -9514,12 +10078,12 @@ var Keystore = class {
     }
   }
   decryptFile(password, knownSalt) {
-    if (!fs17.existsSync(this.storePath)) return {};
+    if (!fs19.existsSync(this.storePath)) return {};
     try {
       const { salt, ciphertext, iv, tag } = this.readRaw();
       const useSalt = knownSalt ?? salt;
       const key = this.masterKey ?? this.deriveKey(password, useSalt);
-      const decipher = crypto.createDecipheriv(ALGORITHM, key, iv);
+      const decipher = crypto3.createDecipheriv(ALGORITHM, key, iv);
       decipher.setAuthTag(tag);
       const decrypted = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
       return JSON.parse(decrypted.toString("utf-8"));
@@ -9530,28 +10094,28 @@ var Keystore = class {
   saveAll(data) {
     if (!this.masterKey) return;
     const raw = this.readRaw();
-    const iv = crypto.randomBytes(IV_LEN);
-    const cipher = crypto.createCipheriv(ALGORITHM, this.masterKey, iv);
+    const iv = crypto3.randomBytes(IV_LEN);
+    const cipher = crypto3.createCipheriv(ALGORITHM, this.masterKey, iv);
     const plaintext = Buffer.from(JSON.stringify(data), "utf-8");
     const ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);
     const tag = cipher.getAuthTag();
     const out = Buffer.concat([raw.salt, iv, tag, ciphertext]);
-    fs17.mkdirSync(path18.dirname(this.storePath), { recursive: true });
-    fs17.writeFileSync(this.storePath, out, { mode: 384 });
+    fs19.mkdirSync(path20.dirname(this.storePath), { recursive: true });
+    fs19.writeFileSync(this.storePath, out, { mode: 384 });
   }
   writeWithSalt(data, salt) {
     if (!this.masterKey) throw new Error("writeWithSalt called before masterKey was set");
-    const iv = crypto.randomBytes(IV_LEN);
-    const cipher = crypto.createCipheriv(ALGORITHM, this.masterKey, iv);
+    const iv = crypto3.randomBytes(IV_LEN);
+    const cipher = crypto3.createCipheriv(ALGORITHM, this.masterKey, iv);
     const plaintext = Buffer.from(JSON.stringify(data), "utf-8");
     const ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);
     const tag = cipher.getAuthTag();
     const out = Buffer.concat([salt, iv, tag, ciphertext]);
-    fs17.mkdirSync(path18.dirname(this.storePath), { recursive: true });
-    fs17.writeFileSync(this.storePath, out, { mode: 384 });
+    fs19.mkdirSync(path20.dirname(this.storePath), { recursive: true });
+    fs19.writeFileSync(this.storePath, out, { mode: 384 });
   }
   readRaw() {
-    const buf = fs17.readFileSync(this.storePath);
+    const buf = fs19.readFileSync(this.storePath);
     let offset = 0;
     const salt = buf.subarray(offset, offset + SALT_LEN);
     offset += SALT_LEN;
@@ -9563,15 +10127,15 @@ var Keystore = class {
     return { salt, iv, tag, ciphertext };
   }
   deriveKey(password, salt) {
-    return crypto.pbkdf2Sync(password, salt, PBKDF2_ITERATIONS, KEY_LEN, "sha256");
+    return crypto3.pbkdf2Sync(password, salt, PBKDF2_ITERATIONS, KEY_LEN, "sha256");
   }
 };
-var ignore2 = ignoreFactory.default ?? ignoreFactory;
+var ignore3 = ignoreFactory.default ?? ignoreFactory;
 var CascadeIgnore = class {
   ig;
   loaded = false;
   constructor() {
-    this.ig = ignore2();
+    this.ig = ignore3();
     this.ig.add([
       ".cascade/keystore.enc",
       ".cascade/memory.db",
@@ -9584,7 +10148,7 @@ var CascadeIgnore = class {
     ]);
   }
   async load(workspacePath) {
-    const filePath = path18.join(workspacePath, ".cascadeignore");
+    const filePath = path20.join(workspacePath, ".cascadeignore");
     try {
       const content = await fs4.readFile(filePath, "utf-8");
       const lines = content.split("\n").filter((l) => l.trim() && !l.startsWith("#"));
@@ -9595,7 +10159,7 @@ var CascadeIgnore = class {
   }
   isIgnored(filePath, workspacePath) {
     try {
-      const relative = workspacePath ? path18.relative(workspacePath, filePath) : filePath;
+      const relative = workspacePath ? path20.relative(workspacePath, filePath) : filePath;
       return this.ig.ignores(relative);
     } catch {
       return false;
@@ -9606,7 +10170,7 @@ var CascadeIgnore = class {
   }
 };
 async function loadCascadeMd(workspacePath) {
-  const filePath = path18.join(workspacePath, "CASCADE.md");
+  const filePath = path20.join(workspacePath, "CASCADE.md");
   try {
     const raw = await fs4.readFile(filePath, "utf-8");
     return parseCascadeMd(raw);
@@ -9637,7 +10201,7 @@ ${raw.trim()}`;
 var MemoryStore = class _MemoryStore {
   db;
   constructor(dbPath) {
-    fs17.mkdirSync(path18.dirname(dbPath), { recursive: true });
+    fs19.mkdirSync(path20.dirname(dbPath), { recursive: true });
     try {
       this.db = new Database(dbPath, { timeout: 5e3 });
       this.db.pragma("journal_mode = WAL");
@@ -10395,15 +10959,15 @@ var ConfigManager = class {
   globalDir;
   constructor(workspacePath = process.cwd()) {
     this.workspacePath = workspacePath;
-    this.globalDir = path18.join(os4.homedir(), GLOBAL_CONFIG_DIR);
+    this.globalDir = path20.join(os6.homedir(), GLOBAL_CONFIG_DIR);
   }
   async load() {
     this.config = await this.loadConfig();
     this.ignore = new CascadeIgnore();
     await this.ignore.load(this.workspacePath);
     this.cascadeMd = await loadCascadeMd(this.workspacePath);
-    this.keystore = new Keystore(path18.join(this.globalDir, GLOBAL_KEYSTORE_FILE));
-    this.store = new MemoryStore(path18.join(this.workspacePath, CASCADE_DB_FILE));
+    this.keystore = new Keystore(path20.join(this.globalDir, GLOBAL_KEYSTORE_FILE));
+    this.store = new MemoryStore(path20.join(this.workspacePath, CASCADE_DB_FILE));
     await this.injectEnvKeys();
     await this.ensureDefaultIdentity();
   }
@@ -10426,8 +10990,8 @@ var ConfigManager = class {
     return this.workspacePath;
   }
   async save() {
-    const configPath = path18.join(this.workspacePath, CASCADE_CONFIG_FILE);
-    await fs4.mkdir(path18.dirname(configPath), { recursive: true });
+    const configPath = path20.join(this.workspacePath, CASCADE_CONFIG_FILE);
+    await fs4.mkdir(path20.dirname(configPath), { recursive: true });
     await fs4.writeFile(configPath, JSON.stringify(this.config, null, 2), "utf-8");
   }
   async updateConfig(updates) {
@@ -10451,7 +11015,7 @@ var ConfigManager = class {
     return configProvider?.apiKey;
   }
   async loadConfig() {
-    const configPath = path18.join(this.workspacePath, CASCADE_CONFIG_FILE);
+    const configPath = path20.join(this.workspacePath, CASCADE_CONFIG_FILE);
     try {
       const raw = await fs4.readFile(configPath, "utf-8");
       return validateConfig(JSON.parse(raw));
@@ -10681,6 +11245,24 @@ var DashboardSocket = class {
       });
     });
   }
+  onSessionHalt(callback) {
+    this.io.on("connection", (socket) => {
+      socket.on("session:halt", (payload) => {
+        if (typeof payload?.sessionId === "string") {
+          callback(payload.sessionId);
+        }
+      });
+    });
+  }
+  onSessionSteer(callback) {
+    this.io.on("connection", (socket) => {
+      socket.on("session:steer", (payload) => {
+        if (typeof payload?.message === "string" && payload.message.trim()) {
+          callback(payload.message.trim(), payload.sessionId, payload.nodeId);
+        }
+      });
+    });
+  }
   onConfigUpdate(callback) {
     this.io.on("connection", (socket) => {
       socket.on("config:update", (payload) => {
@@ -10703,7 +11285,8 @@ var DashboardSocket = class {
       socket.on("cascade:run", (payload) => {
         if (typeof payload?.prompt === "string" && payload.prompt.trim()) {
           const sessionId = typeof payload.sessionId === "string" && payload.sessionId.trim() ? payload.sessionId.trim() : void 0;
-          callback(payload.prompt.trim(), payload.model ?? "auto", socket.id, sessionId);
+          const forceTier = ["T1", "T2", "T3"].includes(payload.forceTier) ? payload.forceTier : void 0;
+          callback(payload.prompt.trim(), payload.model ?? "auto", socket.id, sessionId, forceTier);
         }
       });
     });
@@ -10712,7 +11295,7 @@ var DashboardSocket = class {
     this.io.close();
   }
 };
-var __dirname$1 = path18.dirname(fileURLToPath(import.meta.url));
+var __dirname$1 = path20.dirname(fileURLToPath(import.meta.url));
 var DashboardServer = class {
   app;
   httpServer;
@@ -10723,6 +11306,20 @@ var DashboardServer = class {
   globalStore = null;
   broadcastTimer = null;
   activeSessions = /* @__PURE__ */ new Map();
+  activeControllers = /* @__PURE__ */ new Map();
+  /**
+   * Run taskIds per chat session — file snapshots are keyed by the run's
+   * taskId (see t3-worker saveSnapshot), so session rollback needs the list
+   * of runs the session performed in this server's lifetime.
+   */
+  sessionTaskIds = /* @__PURE__ */ new Map();
+  /**
+   * Tool-approval requests awaiting a user decision from a connected client,
+   * keyed by the request's uuid. The desktop shows a modal on
+   * `permission:user-required` and answers with `permission:decision`; this
+   * map is how that answer reaches the run that's blocked on it.
+   */
+  pendingApprovals = /* @__PURE__ */ new Map();
   port;
   host;
   workspacePath;
@@ -10781,15 +11378,18 @@ var DashboardServer = class {
       }
       this.persistConfig();
     });
-    this.socket.onCascadeRun(async (prompt, model, socketId, requestedSessionId) => {
+    this.socket.onCascadeRun(async (prompt, model, socketId, requestedSessionId, forceTier) => {
       const sessionId = requestedSessionId ?? randomUUID();
+      const abortController = new AbortController();
+      this.activeControllers.set(sessionId, abortController);
       const runPrompt = requestedSessionId ? this.buildContinuationPrompt(sessionId, prompt) : prompt;
       const title = this.persistRunStart(sessionId, prompt);
-      const cfg = model !== "auto" ? { ...this.config, models: { ...this.config.models, t1: model } } : this.config;
+      let cfg = model !== "auto" ? { ...this.config, models: { ...this.config.models, t1: model } } : this.config;
+      if (forceTier) cfg = { ...cfg, routing: { ...cfg.routing, forceTier } };
       const cascade = new Cascade(cfg, this.workspacePath, this.store);
       this.activeSessions.set(sessionId, cascade);
       cascade.on("stream:token", (e) => {
-        this.socket.emitToSocket(socketId, "stream:token", { sessionId, tierId: e.tierId, text: e.text });
+        this.socket.emitToSocket(socketId, "stream:token", { sessionId, tierId: e.tierId, text: e.text, primary: e.primary });
       });
       cascade.on("tier:status", (e) => {
         this.socket.emitToSocket(socketId, "tier:status", { sessionId, ...e });
@@ -10801,7 +11401,12 @@ var DashboardServer = class {
         this.socket.emitPeerMessage(e);
       });
       try {
-        const result = await cascade.run({ prompt: runPrompt });
+        const result = await cascade.run({
+          prompt: runPrompt,
+          signal: abortController.signal,
+          approvalCallback: this.makeApprovalCallback(sessionId)
+        });
+        this.recordSessionTask(sessionId, result.taskId);
         this.persistRunEnd(sessionId, title, prompt, result.output, "COMPLETED");
         this.socket.emitToSocket(socketId, "session:complete", { sessionId, result });
         this.socket.broadcast("cost:update", {
@@ -10818,6 +11423,24 @@ var DashboardServer = class {
         });
       } finally {
         this.activeSessions.delete(sessionId);
+        this.activeControllers.delete(sessionId);
+        this.denyPendingApprovals(sessionId);
+      }
+    });
+    this.socket.onSessionHalt((sessionId) => {
+      this.activeControllers.get(sessionId)?.abort();
+      this.denyPendingApprovals(sessionId);
+    });
+    this.socket.onApprovalResponse(({ requestId, approved, always }) => {
+      const pending = this.pendingApprovals.get(requestId);
+      if (!pending) return;
+      this.pendingApprovals.delete(requestId);
+      pending.resolve({ approved: !!approved, always: !!always });
+    });
+    this.socket.onSessionSteer((message, sessionId, nodeId) => {
+      const steered = this.steerSessions(message, sessionId, nodeId);
+      if (steered > 0) {
+        this.socket.broadcast("session:message-injected", { sessionId, nodeId, message, steered, requestedAt: (/* @__PURE__ */ new Date()).toISOString() });
       }
     });
   }
@@ -10865,9 +11488,9 @@ var DashboardServer = class {
    */
   persistConfig() {
     try {
-      const configPath = path18.join(this.workspacePath, CASCADE_CONFIG_FILE);
-      fs17.mkdirSync(path18.dirname(configPath), { recursive: true });
-      fs17.writeFileSync(configPath, JSON.stringify(this.config, null, 2), "utf-8");
+      const configPath = path20.join(this.workspacePath, CASCADE_CONFIG_FILE);
+      fs19.mkdirSync(path20.dirname(configPath), { recursive: true });
+      fs19.writeFileSync(configPath, JSON.stringify(this.config, null, 2), "utf-8");
     } catch (err) {
       console.warn(`[dashboard] Failed to persist config: ${err instanceof Error ? err.message : String(err)}`);
     }
@@ -10882,15 +11505,15 @@ var DashboardServer = class {
   resolveDashboardSecret() {
     const fromConfig = this.config.dashboard.secret ?? process.env["CASCADE_DASHBOARD_SECRET"];
     if (fromConfig) return fromConfig;
-    const secretPath = path18.join(this.workspacePath, CASCADE_DASHBOARD_SECRET_FILE);
+    const secretPath = path20.join(this.workspacePath, CASCADE_DASHBOARD_SECRET_FILE);
     try {
-      if (fs17.existsSync(secretPath)) {
-        const existing = fs17.readFileSync(secretPath, "utf-8").trim();
+      if (fs19.existsSync(secretPath)) {
+        const existing = fs19.readFileSync(secretPath, "utf-8").trim();
         if (existing.length >= 16) return existing;
       }
       const generated = randomUUID();
-      fs17.mkdirSync(path18.dirname(secretPath), { recursive: true });
-      fs17.writeFileSync(secretPath, generated, { encoding: "utf-8", mode: 384 });
+      fs19.mkdirSync(path20.dirname(secretPath), { recursive: true });
+      fs19.writeFileSync(secretPath, generated, { encoding: "utf-8", mode: 384 });
       if (this.config.dashboard.auth) {
         console.warn(
           `Dashboard auth enabled with no secret configured; persisted a generated secret to ${secretPath}. Set CASCADE_DASHBOARD_SECRET or config.dashboard.secret to override.`
@@ -10917,7 +11540,7 @@ var DashboardServer = class {
   // ── Setup ─────────────────────────────────────
   getGlobalStore() {
     if (!this.globalStore) {
-      const globalDbPath = path18.join(os4.homedir(), GLOBAL_CONFIG_DIR, GLOBAL_RUNTIME_DB_FILE);
+      const globalDbPath = path20.join(os6.homedir(), GLOBAL_CONFIG_DIR, GLOBAL_RUNTIME_DB_FILE);
       this.globalStore = new MemoryStore(globalDbPath);
     }
     return this.globalStore;
@@ -10965,6 +11588,44 @@ var DashboardServer = class {
     }
     this.persistRuntimeRow(sessionId, title, status, latestPrompt);
   }
+  /**
+   * Route steering text into running Cascade instances. Targets the given
+   * session, or every active session when none is specified (the desktop
+   * usually has exactly one run in flight). Returns how many were reached.
+   */
+  steerSessions(message, sessionId, nodeId) {
+    const targets = sessionId ? [this.activeSessions.get(sessionId)].filter((c) => !!c) : [...this.activeSessions.values()];
+    for (const cascade of targets) cascade.injectGuidance(message, nodeId);
+    return targets.length;
+  }
+  recordSessionTask(sessionId, taskId) {
+    const list = this.sessionTaskIds.get(sessionId) ?? [];
+    list.push(taskId);
+    this.sessionTaskIds.set(sessionId, list);
+  }
+  /**
+   * Approval bridge: cascade calls this when a dangerous tool escalates to the
+   * user. The request itself was already pushed to the client via the
+   * `permission:user-required` forward; here we just park a resolver keyed by
+   * the request id and wait for the client's `permission:decision` (handled in
+   * onApprovalResponse). Never auto-approves — an unanswered request stays
+   * pending until the client answers, the run ends, or the escalator's own
+   * timeout denies it.
+   */
+  makeApprovalCallback(sessionId) {
+    return (request) => new Promise((resolve) => {
+      this.pendingApprovals.set(request.id, { resolve, sessionId });
+    });
+  }
+  /** Deny + clear any approvals still pending for a session (run end / abort). */
+  denyPendingApprovals(sessionId) {
+    for (const [id, pending] of this.pendingApprovals) {
+      if (pending.sessionId === sessionId) {
+        this.pendingApprovals.delete(id);
+        pending.resolve({ approved: false, always: false });
+      }
+    }
+  }
   persistRuntimeRow(sessionId, title, status, latestPrompt) {
     const now = (/* @__PURE__ */ new Date()).toISOString();
     const row = { sessionId, title, workspacePath: this.workspacePath, status, startedAt: now, updatedAt: now, latestPrompt, isGlobal: false };
@@ -11058,12 +11719,12 @@ ${prompt}`;
     }
   }
   watchRuntimeChanges() {
-    const workspaceDbPath = path18.join(this.workspacePath, CASCADE_DB_FILE);
-    const globalDbPath = path18.join(os4.homedir(), GLOBAL_CONFIG_DIR, GLOBAL_RUNTIME_DB_FILE);
+    const workspaceDbPath = path20.join(this.workspacePath, CASCADE_DB_FILE);
+    const globalDbPath = path20.join(os6.homedir(), GLOBAL_CONFIG_DIR, GLOBAL_RUNTIME_DB_FILE);
     const watchPaths = [workspaceDbPath, globalDbPath].filter((p, index, arr) => arr.indexOf(p) === index);
     for (const watchPath of watchPaths) {
-      if (!fs17.existsSync(watchPath)) continue;
-      fs17.watchFile(watchPath, { interval: 3e3 }, () => {
+      if (!fs19.existsSync(watchPath)) continue;
+      fs19.watchFile(watchPath, { interval: 3e3 }, () => {
         this.throttledBroadcast(watchPath === globalDbPath ? "global" : "workspace");
       });
     }
@@ -11153,15 +11814,6 @@ ${prompt}`;
       if (sessionId) this.socket.broadcastToRoom(`session:${sessionId}`, "session:halt", payload);
       res.json({ success: true, ...payload });
     });
-    this.app.post("/api/approve", auth, mutationLimiter, (req, res) => {
-      const body = req.body;
-      const sessionId = typeof body["sessionId"] === "string" ? body["sessionId"] : void 0;
-      const nodeId = typeof body["nodeId"] === "string" ? body["nodeId"] : void 0;
-      const payload = { sessionId, nodeId, requestedAt: (/* @__PURE__ */ new Date()).toISOString() };
-      this.socket.broadcast("session:approve", payload);
-      if (sessionId) this.socket.broadcastToRoom(`session:${sessionId}`, "session:approve", payload);
-      res.json({ success: true, ...payload });
-    });
     this.app.post("/api/inject", auth, mutationLimiter, (req, res) => {
       const body = req.body;
       const message = typeof body["message"] === "string" ? body["message"] : void 0;
@@ -11171,7 +11823,8 @@ ${prompt}`;
         res.status(400).json({ error: "message is required and must be a string" });
         return;
       }
-      const payload = { sessionId, nodeId, message, requestedAt: (/* @__PURE__ */ new Date()).toISOString() };
+      const steered = this.steerSessions(message, sessionId, nodeId);
+      const payload = { sessionId, nodeId, message, steered, requestedAt: (/* @__PURE__ */ new Date()).toISOString() };
       this.socket.broadcast("session:message-injected", payload);
       if (sessionId) this.socket.broadcastToRoom(`session:${sessionId}`, "session:message-injected", payload);
       res.json({ success: true, ...payload });
@@ -11193,7 +11846,7 @@ ${prompt}`;
       const sessionId = req.params.id;
       this.store.deleteSession(sessionId);
       this.store.deleteRuntimeSession(sessionId);
-      const globalDbPath = path18.join(os4.homedir(), GLOBAL_CONFIG_DIR, GLOBAL_RUNTIME_DB_FILE);
+      const globalDbPath = path20.join(os6.homedir(), GLOBAL_CONFIG_DIR, GLOBAL_RUNTIME_DB_FILE);
       const globalStore = new MemoryStore(globalDbPath);
       try {
         globalStore.deleteRuntimeSession(sessionId);
@@ -11205,9 +11858,34 @@ ${prompt}`;
       this.socket.broadcast("runtime:refresh", { scope: "global" });
       res.json({ ok: true });
     });
+    this.app.post("/api/sessions/:id/rollback", auth, mutationLimiter, async (req, res) => {
+      const sessionId = req.params.id;
+      const taskIds = this.sessionTaskIds.get(sessionId) ?? [];
+      if (!taskIds.length) {
+        res.json({ ok: true, restored: 0, message: "No file snapshots recorded for this session in the current app run." });
+        return;
+      }
+      const toRestore = /* @__PURE__ */ new Map();
+      for (const taskId of taskIds) {
+        for (const { filePath, content } of this.store.getLatestFileSnapshots(taskId)) {
+          if (!toRestore.has(filePath)) toRestore.set(filePath, content);
+        }
+      }
+      const { writeFile } = await import('fs/promises');
+      let restored = 0;
+      for (const [filePath, content] of toRestore) {
+        try {
+          await writeFile(filePath, content, "utf-8");
+          restored++;
+        } catch (err) {
+          console.warn(`[dashboard] rollback restore failed: ${filePath}`, err);
+        }
+      }
+      res.json({ ok: true, restored });
+    });
     this.app.delete("/api/sessions", auth, (req, res) => {
       const body = req.body;
-      const globalDbPath = path18.join(os4.homedir(), GLOBAL_CONFIG_DIR, GLOBAL_RUNTIME_DB_FILE);
+      const globalDbPath = path20.join(os6.homedir(), GLOBAL_CONFIG_DIR, GLOBAL_RUNTIME_DB_FILE);
       if (body?.ids && Array.isArray(body.ids) && body.ids.length > 0) {
         const globalStore = new MemoryStore(globalDbPath);
         try {
@@ -11230,7 +11908,7 @@ ${prompt}`;
     });
     this.app.delete("/api/runtime", auth, (_req, res) => {
       this.store.deleteAllRuntimeNodes();
-      const globalDbPath = path18.join(os4.homedir(), GLOBAL_CONFIG_DIR, GLOBAL_RUNTIME_DB_FILE);
+      const globalDbPath = path20.join(os6.homedir(), GLOBAL_CONFIG_DIR, GLOBAL_RUNTIME_DB_FILE);
       const globalStore = new MemoryStore(globalDbPath);
       try {
         globalStore.deleteAllRuntimeNodes();
@@ -11281,6 +11959,19 @@ ${prompt}`;
       this.store.deleteIdentity(req.params.id);
       res.json({ ok: true });
     });
+    this.app.get("/api/audit/verify", auth, async (_req, res) => {
+      try {
+        const { AuditLogger: AuditLogger3 } = await Promise.resolve().then(() => (init_audit_logger(), audit_logger_exports));
+        const logger = new AuditLogger3(this.workspacePath);
+        try {
+          res.json(logger.verifyChain());
+        } finally {
+          logger.close();
+        }
+      } catch (err) {
+        res.status(500).json({ error: err instanceof Error ? err.message : String(err) });
+      }
+    });
     this.app.get("/api/audit/:sessionId", auth, (req, res) => {
       const log = this.store.getAuditLog(req.params.sessionId);
       res.json(log);
@@ -11303,12 +11994,12 @@ ${prompt}`;
       if (body["tierLimits"]) this.config.tierLimits = { ...this.config.tierLimits, ...body["tierLimits"] };
       if (body["budget"]) this.config.budget = { ...this.config.budget, ...body["budget"] };
       try {
-        const configPath = path18.join(this.workspacePath, CASCADE_CONFIG_FILE);
-        const existing = fs17.existsSync(configPath) ? JSON.parse(fs17.readFileSync(configPath, "utf-8")) : {};
+        const configPath = path20.join(this.workspacePath, CASCADE_CONFIG_FILE);
+        const existing = fs19.existsSync(configPath) ? JSON.parse(fs19.readFileSync(configPath, "utf-8")) : {};
         const updated = { ...existing, tierLimits: this.config.tierLimits, budget: this.config.budget };
         const tmp = configPath + ".tmp";
-        fs17.writeFileSync(tmp, JSON.stringify(updated, null, 2), "utf-8");
-        fs17.renameSync(tmp, configPath);
+        fs19.writeFileSync(tmp, JSON.stringify(updated, null, 2), "utf-8");
+        fs19.renameSync(tmp, configPath);
         res.json({ ok: true });
       } catch (err) {
         res.status(500).json({ error: `Failed to save config: ${err instanceof Error ? err.message : String(err)}` });
@@ -11336,7 +12027,7 @@ ${prompt}`;
     this.app.get("/api/runtime", auth, (req, res) => {
       const scope = req.query["scope"] ?? "workspace";
       if (scope === "global") {
-        const globalDbPath = path18.join(os4.homedir(), GLOBAL_CONFIG_DIR, GLOBAL_RUNTIME_DB_FILE);
+        const globalDbPath = path20.join(os6.homedir(), GLOBAL_CONFIG_DIR, GLOBAL_RUNTIME_DB_FILE);
         const globalStore = new MemoryStore(globalDbPath);
         try {
           res.json({
@@ -11373,7 +12064,7 @@ ${prompt}`;
         const cascade = new Cascade(this.config, this.workspacePath, this.store);
         this.activeSessions.set(sessionId, cascade);
         cascade.on("stream:token", (e) => {
-          this.socket.broadcastToRoom(`session:${sessionId}`, "stream:token", { sessionId, tierId: e.tierId, text: e.text });
+          this.socket.broadcastToRoom(`session:${sessionId}`, "stream:token", { sessionId, tierId: e.tierId, text: e.text, primary: e.primary });
         });
         cascade.on("tier:status", (e) => {
           this.socket.broadcastToRoom(`session:${sessionId}`, "tier:status", { sessionId, ...e });
@@ -11385,7 +12076,12 @@ ${prompt}`;
           this.socket.emitPeerMessage(e);
         });
         try {
-          const result = await cascade.run({ prompt: runPrompt, identityId: body.identityId });
+          const result = await cascade.run({
+            prompt: runPrompt,
+            identityId: body.identityId,
+            approvalCallback: this.makeApprovalCallback(sessionId)
+          });
+          this.recordSessionTask(sessionId, result.taskId);
           this.persistRunEnd(sessionId, title, prompt, result.output, "COMPLETED");
           this.socket.broadcast("cost:update", {
             sessionId,
@@ -11402,6 +12098,7 @@ ${prompt}`;
           });
         } finally {
           this.activeSessions.delete(sessionId);
+          this.denyPendingApprovals(sessionId);
         }
       })();
     });
@@ -11416,13 +12113,13 @@ ${prompt}`;
         }))
       });
     });
-    const prodPath = path18.resolve(__dirname$1, "../web/dist");
-    const devPath = path18.resolve(__dirname$1, "../../web/dist");
-    const webDistPath = fs17.existsSync(prodPath) ? prodPath : devPath;
-    if (fs17.existsSync(webDistPath)) {
+    const prodPath = path20.resolve(__dirname$1, "../web/dist");
+    const devPath = path20.resolve(__dirname$1, "../../web/dist");
+    const webDistPath = fs19.existsSync(prodPath) ? prodPath : devPath;
+    if (fs19.existsSync(webDistPath)) {
       this.app.use(express.static(webDistPath));
       this.app.get("*", (_req, res) => {
-        res.sendFile(path18.join(webDistPath, "index.html"));
+        res.sendFile(path20.join(webDistPath, "index.html"));
       });
     } else {
       this.app.get("/", (_req, res) => {