cascade-ai 0.13.1 → 0.15.0

package/dist/cli.js

@@ -58,7 +58,7 @@ var __export = (target, all) => {
 var CASCADE_VERSION, CASCADE_CONFIG_FILE, CASCADE_DB_FILE, CASCADE_DASHBOARD_SECRET_FILE, GLOBAL_CONFIG_DIR, GLOBAL_DB_FILE, GLOBAL_KEYSTORE_FILE, GLOBAL_RUNTIME_DB_FILE, DEFAULT_DASHBOARD_PORT, DEFAULT_CONTEXT_LIMIT, DEFAULT_AUTO_SUMMARIZE_AT, MODELS, T1_MODEL_PRIORITY, T2_MODEL_PRIORITY, T3_MODEL_PRIORITY, VISION_MODEL_PRIORITY, COMPLEXITY_T2_COUNT, THEME_NAMES, DEFAULT_THEME, OLLAMA_BASE_URL, LM_STUDIO_BASE_URL, AZURE_BASE_URL_TEMPLATE, TOOL_NAMES, DEFAULT_APPROVAL_REQUIRED;
 var init_constants = __esm({
   "src/constants.ts"() {
-    CASCADE_VERSION = "0.13.1";
+    CASCADE_VERSION = "0.15.0";
     CASCADE_CONFIG_FILE = ".cascade/config.json";
     CASCADE_DB_FILE = ".cascade/memory.db";
     CASCADE_DASHBOARD_SECRET_FILE = ".cascade/dashboard-secret";
@@ -1364,29 +1364,71 @@ var init_ollama = __esm({
       async countTokens(text) {
         return Math.ceil(text.length / 4);
       }
+      /**
+       * Ask the Ollama server what a model can actually do. Modern Ollama returns a
+       * `capabilities` array ("completion", "tools", "vision", …) and the model's
+       * real context length in `model_info` — authoritative, unlike the hardcoded
+       * family-name allowlist, which silently misclassifies any unlisted family.
+       * Best-effort: null on old servers / errors, callers fall back to heuristics.
+       */
+      async showModel(name) {
+        const ac = new AbortController();
+        const timer = setTimeout(() => ac.abort(), 2500);
+        try {
+          const resp = await fetch(`${this.baseUrl}/api/show`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ model: name }),
+            signal: ac.signal
+          });
+          if (!resp.ok) return null;
+          const data = await resp.json();
+          const out = {};
+          if (Array.isArray(data.capabilities)) {
+            out.tools = data.capabilities.includes("tools");
+            out.vision = data.capabilities.includes("vision");
+          }
+          for (const [k, v] of Object.entries(data.model_info ?? {})) {
+            if (k.endsWith(".context_length") && typeof v === "number" && v > 0) {
+              out.contextWindow = v;
+              break;
+            }
+          }
+          return out.tools !== void 0 || out.contextWindow ? out : null;
+        } catch {
+          return null;
+        } finally {
+          clearTimeout(timer);
+        }
+      }
       async listModels() {
         try {
           const response = await fetch(`${this.baseUrl}/api/tags`);
           if (!response.ok) return [];
           const data = await response.json();
           const supportedKeywords = ["llama3", "llama2", "gemma", "mistral", "mixtral", "qwen", "phi3", "codellama", "deepseek", "llava", "starcoder", "stable-code", "nomic-embed"];
-          return data.models.filter((m) => {
+          const entries = data.models.filter((m) => {
             const name = m.name.toLowerCase();
             return supportedKeywords.some((k) => name.includes(k));
-          }).map((m) => ({
-            id: m.name,
-            name: m.name,
-            provider: "ollama",
-            contextWindow: 128e3,
-            isVisionCapable: m.name.includes("llava") || m.name.includes("vision"),
-            inputCostPer1kTokens: 0,
-            outputCostPer1kTokens: 0,
-            maxOutputTokens: 4e3,
-            supportsStreaming: true,
-            isLocal: true,
-            supportsToolUse: isToolCapable(m.name),
-            minSizeB: this.parseSizeB(m.details?.parameter_size)
-          }));
+          });
+          const shows = await Promise.all(entries.map((m) => this.showModel(m.name)));
+          return entries.map((m, i) => {
+            const show = shows[i];
+            return {
+              id: m.name,
+              name: m.name,
+              provider: "ollama",
+              contextWindow: show?.contextWindow ?? 128e3,
+              isVisionCapable: show?.vision ?? (m.name.includes("llava") || m.name.includes("vision")),
+              inputCostPer1kTokens: 0,
+              outputCostPer1kTokens: 0,
+              maxOutputTokens: 4e3,
+              supportsStreaming: true,
+              isLocal: true,
+              supportsToolUse: show?.tools ?? isToolCapable(m.name),
+              minSizeB: this.parseSizeB(m.details?.parameter_size)
+            };
+          });
         } catch {
           return [];
         }
@@ -2309,6 +2351,78 @@ Original error: ${err.message}`
     `).all(`%${query}%`, limit);
     return rows.map(this.deserializeMessage);
   }
+  // ── Export / Import ──────────────────────────
+  //
+  //  Chats travel as full Session objects (messages included) inside a
+  //  plaintext-JSON bundle. Import NEVER overwrites: every imported session
+  //  gets a fresh id (title suffixed "(imported)") and fresh message ids, so
+  //  re-importing the same bundle can duplicate but can never clobber.
+  /** Full sessions (with messages) for the given ids, or ALL sessions. */
+  exportSessions(ids) {
+    const targets = ids && ids.length > 0 ? ids : this.db.prepare("SELECT id FROM sessions ORDER BY updated_at DESC").all().map((r) => r.id);
+    const out = [];
+    for (const id of targets) {
+      const s = this.getSession(id);
+      if (s) out.push(s);
+    }
+    return out;
+  }
+  /**
+   * Import sessions from a bundle. Returns the created `{id, title}` rows so
+   * the caller can mirror them into the runtime session list (the sidebar
+   * reads runtime_sessions, not sessions). Malformed entries are skipped.
+   */
+  importSessions(sessions) {
+    const out = [];
+    const msgStmt = this.db.prepare(`
+      INSERT INTO messages (id, session_id, role, content, timestamp, tokens, agent_messages)
+      VALUES (?, ?, ?, ?, ?, ?, ?)
+    `);
+    for (const s of sessions) {
+      if (!s || typeof s !== "object") continue;
+      const newId = randomUUID();
+      const now = (/* @__PURE__ */ new Date()).toISOString();
+      const title = `${String(s.title || "Untitled").slice(0, 200)} (imported)`;
+      const metadata = s.metadata && typeof s.metadata === "object" ? s.metadata : { totalTokens: 0, totalCostUsd: 0, modelsUsed: [], toolsUsed: [], taskCount: 0 };
+      this.db.prepare(`
+        INSERT INTO sessions (id, title, created_at, updated_at, identity_id, workspace_path, metadata)
+        VALUES (?, ?, ?, ?, ?, ?, ?)
+      `).run(newId, title, s.createdAt ?? now, s.updatedAt ?? now, s.identityId ?? "default", s.workspacePath ?? "", JSON.stringify(metadata));
+      for (const m of Array.isArray(s.messages) ? s.messages : []) {
+        if (!m || m.role !== "user" && m.role !== "assistant" && m.role !== "system") continue;
+        msgStmt.run(
+          randomUUID(),
+          newId,
+          m.role,
+          typeof m.content === "string" ? m.content : JSON.stringify(m.content),
+          m.timestamp ?? now,
+          m.tokens ? JSON.stringify(m.tokens) : null,
+          m.agentMessages ? JSON.stringify(m.agentMessages) : null
+        );
+      }
+      out.push({ id: newId, title });
+    }
+    return out;
+  }
+  /** Import identities/personas, deduped by (case-insensitive) name — an
+   *  existing name is skipped, never replaced. Imports are never the default. */
+  importIdentities(identities) {
+    const existing = new Set(this.listIdentities().map((i) => i.name.toLowerCase()));
+    let imported = 0;
+    for (const ident of identities ?? []) {
+      if (!ident?.name || typeof ident.name !== "string") continue;
+      if (existing.has(ident.name.toLowerCase())) continue;
+      this.createIdentity({
+        ...ident,
+        id: randomUUID(),
+        isDefault: false,
+        createdAt: ident.createdAt ?? (/* @__PURE__ */ new Date()).toISOString()
+      });
+      existing.add(ident.name.toLowerCase());
+      imported++;
+    }
+    return imported;
+  }
   // ── Identities ────────────────────────────────
   createIdentity(identity) {
     this.db.prepare(`
@@ -2486,6 +2600,23 @@ Original error: ${err.message}`
     const row = this.db.prepare("SELECT metadata FROM model_cache WHERE id = ?").get(`${provider}:${modelId}`);
     return row ? JSON.parse(row.metadata) : void 0;
   }
+  /**
+   * Persist a probed capability verdict (currently: native tool support) into
+   * the model's cached profile, merging with whatever is already recorded.
+   * Read back via getModelProfile — so a model is probed once ever, not once
+   * per run.
+   */
+  saveModelCapability(modelId, provider, caps) {
+    const cacheKey = `${provider}:${modelId}`;
+    const existing = this.db.prepare("SELECT metadata FROM model_cache WHERE id = ?").get(cacheKey);
+    const meta = existing ? JSON.parse(existing.metadata) : { id: modelId, provider, name: modelId, contextWindow: 0, isVisionCapable: false, inputCostPer1kTokens: 0, outputCostPer1kTokens: 0, maxOutputTokens: 0, supportsStreaming: false, isLocal: false };
+    if (caps.supportsToolUse !== void 0) meta.supportsToolUse = caps.supportsToolUse;
+    this.db.prepare(`
+      INSERT INTO model_cache (id, provider, model_id, name, metadata, updated_at)
+      VALUES (?, ?, ?, ?, ?, ?)
+      ON CONFLICT(id) DO UPDATE SET metadata = excluded.metadata, updated_at = excluded.updated_at
+    `).run(cacheKey, provider, modelId, meta.name ?? modelId, JSON.stringify(meta), (/* @__PURE__ */ new Date()).toISOString());
+  }
   getProfiledModelIds() {
     const rows = this.db.prepare(
       "SELECT model_id FROM model_cache WHERE json_extract(metadata, '$.specializations') IS NOT NULL"
@@ -2775,7 +2906,15 @@ var ToolsConfigSchema = z.object({
   mcpServers: z.array(McpServerConfigSchema).optional(),
   mcpTrusted: z.array(z.string()).optional(),
   /** Web search backends — at least one should be configured for best results */
-  webSearch: WebSearchConfigSchema.optional()
+  webSearch: WebSearchConfigSchema.optional(),
+  /**
+   * Sandbox runtime for LLM-authored dynamic tools:
+   * - 'isolate': hard V8 isolate (isolated-vm) — no Node globals, true capability
+   *   confinement. Requires the optional native `isolated-vm` dependency.
+   * - 'worker': node:worker_threads (resource/kill limits, but not capability-confined).
+   * - 'auto' (default): use the isolate when `isolated-vm` loads, else fall back to worker.
+   */
+  dynamicToolSandbox: z.enum(["isolate", "worker", "auto"]).default("auto")
 });
 var HookDefinitionSchema = z.object({
   name: z.string().optional(),
@@ -2887,10 +3026,20 @@ var CascadeConfigSchema = z.object({
   /**
    * Runtime Tool Creation: when true, T3 workers can generate and register new tools
    * at runtime via the ToolCreator when no existing tool can handle a required operation.
-   * Generated tools are session-scoped and sandboxed in node:vm.
+   * Generated tools are session-scoped and sandboxed (see tools.dynamicToolSandbox).
    * HTTP calls from generated tools require approval.
    */
   enableToolCreation: z.boolean().default(true),
+  /**
+   * Project knowledge (world state). `factsExtraction`: after each worker
+   * completes, run a cheap extraction pass that distills its output into
+   * queryable entity/relation/value facts (superseding older facts), which T1
+   * queries during planning instead of replaying the whole linear log. Best-effort
+   * and non-blocking; set false to keep only the raw linear log.
+   */
+  knowledge: z.object({
+    factsExtraction: z.boolean().default(true)
+  }).default({}),
   /**
    * Persist runtime-generated tools to .cascade/dynamic-tools.json and reload them
    * on startup for cross-run dedup. Reloaded (and peer-received) tools are always
@@ -2989,6 +3138,8 @@ var CascadeConfigSchema = z.object({
   privacy: z.object({
     paths: z.array(z.object({ pattern: z.string().min(1), policy: z.enum(["local-only"]) })).default([])
   }).optional(),
+  /** Routing controls — forceTier pins the root tier, bypassing the classifier. */
+  routing: z.object({ forceTier: z.enum(["auto", "T1", "T2", "T3"]).default("auto") }).optional(),
   /**
    * T3→T2 reinforcement: when enabled, a worker that discovers its subtask should
    * fan out can call the `request_workers` tool to have its T2 manager spawn
@@ -3986,6 +4137,7 @@ function normalizeModelId(id) {
 var LiveDataProvider = class {
   snapshot = null;
   prices = /* @__PURE__ */ new Map();
+  capabilities = /* @__PURE__ */ new Map();
   source = "bundled";
   fetchedAt = 0;
   loaded = false;
@@ -4014,6 +4166,9 @@ var LiveDataProvider = class {
       if (cache.prices) {
         for (const [id, p] of Object.entries(cache.prices)) this.prices.set(id, p);
       }
+      if (cache.capabilities) {
+        for (const [id, c] of Object.entries(cache.capabilities)) this.capabilities.set(id, c);
+      }
       this.fetchedAt = cache.fetchedAt ?? 0;
     } catch {
     }
@@ -4034,9 +4189,9 @@ var LiveDataProvider = class {
     const ttlMs = this.opts.refreshHours * 36e5;
     const fresh = ttlMs > 0 && Date.now() - this.fetchedAt < ttlMs;
     if (!force && fresh && this.source !== "bundled") return;
-    const [snap, prices] = await Promise.all([
+    const [snap, catalog] = await Promise.all([
       this.opts.live ? this.fetchSnapshot() : Promise.resolve(null),
-      this.opts.pricingLive ? this.fetchPrices() : Promise.resolve(null)
+      this.opts.pricingLive ? this.fetchCatalog() : Promise.resolve(null)
     ]);
     let changed = false;
     if (snap) {
@@ -4044,8 +4199,12 @@ var LiveDataProvider = class {
       this.source = "live";
       changed = true;
     }
-    if (prices && prices.size > 0) {
-      this.prices = prices;
+    if (catalog && catalog.prices.size > 0) {
+      this.prices = catalog.prices;
+      changed = true;
+    }
+    if (catalog && catalog.capabilities.size > 0) {
+      this.capabilities = catalog.capabilities;
       changed = true;
     }
     if (changed) {
@@ -4067,21 +4226,43 @@ var LiveDataProvider = class {
       return null;
     }
   }
-  async fetchPrices() {
+  /**
+   * One fetch of the OpenRouter catalog yields BOTH pricing and capability
+   * facts (context window, native tool support, input modalities) — the
+   * capability fields used to be discarded while providers guessed/hardcoded
+   * them in their listModels() stubs.
+   */
+  async fetchCatalog() {
     try {
       const resp = await withTimeout(fetch(OPENROUTER_MODELS_URL), FETCH_TIMEOUT_MS, "pricing fetch timed out");
       if (!resp.ok) return null;
       const data = await resp.json();
       if (!Array.isArray(data?.data)) return null;
-      const out = /* @__PURE__ */ new Map();
+      const prices = /* @__PURE__ */ new Map();
+      const capabilities = /* @__PURE__ */ new Map();
       for (const m of data.data) {
-        if (!m?.id || !m.pricing) continue;
-        const input = Number(m.pricing.prompt) * 1e3;
-        const output = Number(m.pricing.completion) * 1e3;
-        if (!Number.isFinite(input) || !Number.isFinite(output)) continue;
-        out.set(normalizeModelId(m.id), { input, output });
+        if (!m?.id) continue;
+        const key = normalizeModelId(m.id);
+        if (m.pricing) {
+          const input = Number(m.pricing.prompt) * 1e3;
+          const output = Number(m.pricing.completion) * 1e3;
+          if (Number.isFinite(input) && Number.isFinite(output)) {
+            prices.set(key, { input, output });
+          }
+        }
+        const cap = {};
+        if (typeof m.context_length === "number" && m.context_length > 0) {
+          cap.contextWindow = m.context_length;
+        }
+        if (Array.isArray(m.supported_parameters)) {
+          cap.supportsTools = m.supported_parameters.includes("tools");
+        }
+        if (Array.isArray(m.architecture?.input_modalities)) {
+          cap.inputModalities = m.architecture.input_modalities;
+        }
+        if (Object.keys(cap).length > 0) capabilities.set(key, cap);
       }
-      return out;
+      return { prices, capabilities };
     } catch {
       return null;
     }
@@ -4092,7 +4273,8 @@ var LiveDataProvider = class {
       const cache = {
         fetchedAt: this.fetchedAt,
         snapshot: this.snapshot ?? void 0,
-        prices: Object.fromEntries(this.prices)
+        prices: Object.fromEntries(this.prices),
+        capabilities: Object.fromEntries(this.capabilities)
       };
       await fs9.writeFile(this.opts.cacheFile, JSON.stringify(cache, null, 2), "utf-8");
     } catch {
@@ -4117,6 +4299,27 @@ var LiveDataProvider = class {
       return { ...m, inputCostPer1kTokens: p.input, outputCostPer1kTokens: p.output };
     });
   }
+  /** Current capability facts for a model id, or null when unknown. */
+  getCapability(modelId) {
+    return this.capabilities.get(normalizeModelId(modelId)) ?? null;
+  }
+  /**
+   * Returns capability-corrected copies of each model (originals untouched):
+   * real context windows replace the providers' hardcoded guesses, native
+   * tool support replaces the assume-by-provider default, and vision is set
+   * from the declared input modalities.
+   */
+  applyLiveCapabilities(models) {
+    return models.map((m) => {
+      const c = this.getCapability(m.id);
+      if (!c) return m;
+      const next = { ...m };
+      if (c.contextWindow) next.contextWindow = c.contextWindow;
+      if (c.supportsTools !== void 0) next.supportsToolUse = c.supportsTools;
+      if (c.inputModalities) next.isVisionCapable = c.inputModalities.includes("image");
+      return next;
+    });
+  }
   /** Where the active quality data came from — for /why and `cascade models`. */
   getDataSource() {
     return this.source;
@@ -4127,6 +4330,9 @@ var LiveDataProvider = class {
   hasLivePricing() {
     return this.prices.size > 0;
   }
+  hasCapabilities() {
+    return this.capabilities.size > 0;
+  }
 };
 
 // src/core/router/benchmarks.ts
@@ -4315,6 +4521,57 @@ var CascadeRouter = class _CascadeRouter extends EventEmitter {
     profiler.profileAll(allModels).catch(() => {
     });
   }
+  /**
+   * One-time native tool-call probe for local/compat models with NO capability
+   * metadata. llama.cpp / LM Studio "/models" endpoints return ids only, so
+   * `supportsToolUse` stays undefined and the T3 tool gate ASSUMES native
+   * support — wrong for many local builds, which then fumble tool-format
+   * output. Each unknown model is probed once with a trivial tool; the verdict
+   * persists in the MemoryStore's model_cache (via the previously-dormant
+   * getModelProfile read-back), so a model is probed once EVER, not per run.
+   * Cloud providers are never probed — their metadata is authoritative.
+   */
+  async probeLocalToolSupport(store) {
+    const unknown = this.selector.getAllAvailableModels().filter(
+      (m) => m.provider === "openai-compatible" && m.supportsToolUse === void 0
+    );
+    for (const model of unknown) {
+      const cached = store.getModelProfile(model.id, model.provider);
+      let verdict = cached?.supportsToolUse;
+      if (verdict === void 0) {
+        const probed = await this.probeNativeToolCall(model);
+        if (probed === null) continue;
+        verdict = probed;
+        store.saveModelCapability(model.id, model.provider, { supportsToolUse: verdict });
+      }
+      this.selector.addDynamicModel({ ...model, supportsToolUse: verdict });
+    }
+    for (const tier of ["T1", "T2", "T3"]) {
+      const cur = this.tierModels.get(tier);
+      if (!cur) continue;
+      const fresh = this.selector.getModelById(cur.id);
+      if (fresh) this.tierModels.set(tier, fresh);
+    }
+  }
+  async probeNativeToolCall(model) {
+    try {
+      const cfg = this.config.providers.find((p) => p.type === model.provider) ?? { type: model.provider };
+      const provider = this.createProvider(cfg, model);
+      const result = await withTimeout(provider.generate({
+        messages: [{ role: "user", content: "Call the echo tool with text set to 'ping'. Use the tool; do not answer in prose." }],
+        tools: [{
+          name: "echo",
+          description: "Echo the given text back to the caller.",
+          inputSchema: { type: "object", properties: { text: { type: "string", description: "Text to echo" } }, required: ["text"] }
+        }],
+        maxTokens: 80,
+        temperature: 0
+      }), 3e4, "tool-support probe timed out");
+      return (result.toolCalls?.length ?? 0) > 0;
+    } catch {
+      return null;
+    }
+  }
   /**
    * Cascade Auto live data: discover/validate real model ids from each cloud
    * provider, then fetch current public quality scores + per-token prices and
@@ -4364,12 +4621,17 @@ var CascadeRouter = class _CascadeRouter extends EventEmitter {
     await Promise.allSettled(tasks);
   }
   /**
-   * Replace available models with live-priced copies and refresh the already
-   * resolved tier models so shared-tier cost accounting uses current prices.
+   * Replace available models with live-priced AND capability-corrected copies
+   * (real context windows, native tool support, vision from modalities), then
+   * refresh the already resolved tier models so shared-tier cost accounting and
+   * the tool-use gate both see current data.
    */
   applyLivePricing() {
-    if (!this.liveData?.hasLivePricing()) return;
-    const updated = this.liveData.applyLivePricing(this.selector.getAllAvailableModels());
+    if (!this.liveData) return;
+    if (!this.liveData.hasLivePricing() && !this.liveData.hasCapabilities()) return;
+    let updated = this.selector.getAllAvailableModels();
+    if (this.liveData.hasLivePricing()) updated = this.liveData.applyLivePricing(updated);
+    if (this.liveData.hasCapabilities()) updated = this.liveData.applyLiveCapabilities(updated);
     for (const m of updated) this.selector.addDynamicModel(m);
     for (const tier of ["T1", "T2", "T3"]) {
       const cur = this.tierModels.get(tier);
@@ -4544,6 +4806,10 @@ var CascadeRouter = class _CascadeRouter extends EventEmitter {
     const r = this.config?.reinforcements;
     return { enabled: r?.enabled === true, maxPerSection: r?.maxPerSection ?? 4 };
   }
+  /** Project-knowledge settings (config.knowledge). Facts extraction on by default. */
+  getKnowledgeConfig() {
+    return { factsExtraction: this.config?.knowledge?.factsExtraction !== false };
+  }
   /**
    * Resolved T3 wave execution mode. 'auto' becomes 'sequential' when the T3
    * tier resolves to a LOCAL model (the single-GPU queue serializes anyway, so
@@ -4630,10 +4896,10 @@ var CascadeRouter = class _CascadeRouter extends EventEmitter {
    * null when Cascade Auto is off (callers then use the shared tier model).
    * Pure heuristic — no extra LLM call.
    */
-  async selectModelForSubtask(tier, text) {
+  async selectModelForSubtask(tier, text, opts) {
     if (!this.config?.cascadeAuto || !this.taskAnalyzer || !text.trim()) return null;
     try {
-      return await this.taskAnalyzer.selectModel(text, tier, this.selector);
+      return await this.taskAnalyzer.selectModel(text, tier, this.selector, opts);
     } catch {
       return null;
     }
@@ -4974,6 +5240,13 @@ var BaseTier = class extends EventEmitter {
   hierarchyContext = "";
   /** Propagated AbortSignal — set by the tier's `execute()` before work begins. */
   signal;
+  /**
+   * True for the run's ROOT tier (T3 for Simple, T2 for Moderate, T1 for
+   * Complex). Its own synthesis stream is the user-facing answer and is
+   * tagged `primary` so the desktop renders it live — background workers,
+   * which would interleave, are not tagged.
+   */
+  isPresenter = false;
   constructor(role, id, parentId) {
     super();
     this.role = role;
@@ -4981,6 +5254,10 @@ var BaseTier = class extends EventEmitter {
     this.parentId = parentId;
     this.label = this.id;
   }
+  /** Mark this tier as the run's presenter (root tier). */
+  setPresenter(on = true) {
+    this.isPresenter = on;
+  }
   getStatus() {
     return this.status;
   }
@@ -5378,6 +5655,13 @@ EXAMPLE \u2014 calling the "shell" tool to list files:
 {"name": "shell", "input": {"command": "ls -la"}}
 </tool_call>
 
+When you have enough information, stop calling tools and write your final answer.`;
+}
+function buildTextToolReminder(tools) {
+  return `
+TOOL USE REMINDER:
+Call tools with a single <tool_call>{"name": "<tool_name>", "input": { ... }}</tool_call> block (valid JSON, double quotes, one tool per turn), matching the argument shapes of your earlier calls in this conversation.
+Available tools: ${tools.map((t) => t.name).join(", ")}.
 When you have enough information, stop calling tools and write your final answer.`;
 }
 
@@ -5617,6 +5901,9 @@ Now execute your subtask using this context where relevant.`
         } catch (e) {
           this.log("Failed to write to World State DB");
         }
+        if (this.router.getKnowledgeConfig?.().factsExtraction !== false) {
+          await this.extractAndStoreFacts(db, assignment, output);
+        }
       }
       this.setStatus("COMPLETED", output);
       this.sendStatusUpdate({ progressPct: 100, currentAction: "Subtask complete", status: "IN_PROGRESS", output });
@@ -5678,7 +5965,7 @@ Now execute your subtask using this context where relevant.`
     let subtaskModel;
     try {
       const subtaskText = `${this.assignment?.subtaskTitle ?? ""} ${this.assignment?.description ?? ""} ${this.assignment?.expectedOutput ?? ""}`;
-      subtaskModel = await this.router.selectModelForSubtask("T3", subtaskText) ?? void 0;
+      subtaskModel = await this.router.selectModelForSubtask("T3", subtaskText, { requiresToolUse: tools.length > 0 }) ?? void 0;
       if (subtaskModel) {
         this.log(`Cascade Auto: routing this subtask to ${subtaskModel.provider}:${subtaskModel.id}`);
       }
@@ -5686,7 +5973,8 @@ Now execute your subtask using this context where relevant.`
     }
     const effectiveModel = subtaskModel ?? this.router.getModelForTier("T3");
     const useTextTools = effectiveModel?.supportsToolUse === false && tools.length > 0;
-    const textToolSuffix = useTextTools ? buildTextToolSystemPrompt(tools) : "";
+    let sentFullTextContract = false;
+    let textContractSignature = "";
     while (iterations < MAX_ITERATIONS) {
       iterations++;
       this.throwIfCancelled();
@@ -5700,6 +5988,17 @@ Now execute your subtask using this context where relevant.`
 ${g.text}`
         });
       }
+      let textToolSuffix = "";
+      if (useTextTools) {
+        const signature = tools.map((t) => t.name).join(",");
+        if (!sentFullTextContract || signature !== textContractSignature) {
+          textToolSuffix = buildTextToolSystemPrompt(tools);
+          sentFullTextContract = true;
+          textContractSignature = signature;
+        } else {
+          textToolSuffix = buildTextToolReminder(tools);
+        }
+      }
       const options = {
         messages: this.context.getMessages(),
         systemPrompt: this.systemPromptOverride + systemPrompt + (this.hierarchyContext ? `
@@ -5716,7 +6015,7 @@ HIERARCHY CONTEXT: ${this.hierarchyContext}` : "") + textToolSuffix,
         "T3",
         options,
         (chunk) => {
-          this.emit("stream:token", { tierId: this.id, text: chunk.text });
+          this.emit("stream:token", { tierId: this.id, text: chunk.text, primary: this.isPresenter });
         }
       );
       let effectiveToolCalls = result.toolCalls ?? [];
@@ -6189,6 +6488,41 @@ HIERARCHY CONTEXT: ${this.hierarchyContext}` : ""),
       };
     }
   }
+  /**
+   * world-state v2: distill a completed subtask's output into durable
+   * `(entity, relation, value)` facts and upsert them into the knowledge graph.
+   * A bounded, cheap T3-tier call; entirely best-effort — any failure is swallowed
+   * so it never blocks or fails the subtask. Respects the subtask's privacy tier
+   * (a local-only subtask extracts on a local model too, never leaking to cloud).
+   */
+  async extractAndStoreFacts(db, assignment, output) {
+    try {
+      const prompt = `Extract durable project facts from this completed subtask.
+Return ONLY a JSON array of {"entity","relation","value"} triples describing lasting
+facts about the codebase/project \u2014 e.g. {"entity":"auth module","relation":"uses","value":"JWT"}.
+Ignore transient step-by-step details. At most 6 triples. If nothing durable, return [].
+
+Subtask: ${assignment.subtaskTitle}
+Output:
+${output.slice(0, 4e3)}`;
+      const result = await this.router.generate("T3", {
+        messages: [{ role: "user", content: prompt }],
+        maxTokens: 300,
+        temperature: 0,
+        ...this.localOnlyMatch ? { forceLocal: true } : {}
+      });
+      const match = /\[[\s\S]*\]/.exec(result.content);
+      if (!match) return;
+      const facts = JSON.parse(match[0]);
+      if (!Array.isArray(facts)) return;
+      for (const f of facts.slice(0, 8)) {
+        if (f && typeof f.entity === "string" && typeof f.relation === "string" && typeof f.value === "string") {
+          db.upsertFact(f.entity, f.relation, f.value, this.id);
+        }
+      }
+    } catch {
+    }
+  }
   async correctOutput(originalOutput, failures) {
     const correctionPrompt = `The following output failed these checks: ${failures.join(", ")}.
 
@@ -7177,6 +7511,7 @@ ${peerOutputs}` : "";
         chunkEnd++;
       }
       i = chunkEnd;
+      const isLastChunk = chunkEnd >= completed.length;
       const prompt = `Summarize these T3 worker outputs for section "${assignment.sectionTitle}" in 2-3 sentences.
   ${currentSummary ? `
 PREVIOUS SUMMARY SO FAR:
@@ -7186,6 +7521,7 @@ NEW OUTPUTS TO INTEGRATE:
 ` : "\nOUTPUTS:\n"}${chunkText}${peerContext}`;
       const messages = [{ role: "user", content: prompt }];
       try {
+        const streamFinal = isLastChunk && this.isPresenter ? (chunk) => this.emit("stream:token", { tierId: this.id, text: chunk.text, primary: true }) : void 0;
         const result = await this.router.generate("T2", {
           messages,
           systemPrompt: this.systemPromptOverride + "You are a T2 Manager. Summarize the work of your T3 workers succinctly." + (this.hierarchyContext ? `
@@ -7193,7 +7529,7 @@ NEW OUTPUTS TO INTEGRATE:
 HIERARCHY CONTEXT: ${this.hierarchyContext}` : ""),
           maxTokens: 500,
           ...this.sectionModel ? { model: this.sectionModel } : {}
-        });
+        }, streamFinal);
         currentSummary = result.content;
       } catch (err) {
         this.log(`aggregateResults: LLM summarization failed at chunk \u2014 returning raw T3 outputs. Error: ${err instanceof Error ? err.message : String(err)}`);
@@ -7245,14 +7581,11 @@ HIERARCHY CONTEXT: ${this.hierarchyContext}` : ""),
         ...this.sectionModel ? { model: this.sectionModel } : {}
       });
       const answer = result.content.trim().toUpperCase();
-      if (answer.includes("YES")) {
-        return { requestId: req.id, approved: true, always: true, decidedBy: "T2", reasoning: "T2 LLM evaluated: consistent with section goal" };
-      }
-      if (answer.includes("NO")) {
-        return { requestId: req.id, approved: false, always: true, decidedBy: "T2", reasoning: "T2 LLM evaluated: inconsistent with section goal" };
-      }
+      const verdict = answer.includes("YES") ? "approve" : answer.includes("NO") ? "deny" : "unsure";
+      (req.trail ??= []).push({ tier: "T2", verdict, reason: `T2: ${verdict === "approve" ? "consistent with section goal" : verdict === "deny" ? "inconsistent with section goal" : "unsure"}` });
       return null;
     } catch {
+      (req.trail ??= []).push({ tier: "T2", verdict: "unsure", reason: "T2 evaluation failed" });
       return null;
     }
   }
@@ -7595,10 +7928,24 @@ In 3-5 terse bullets, flag the most important RISKS, GAPS, or over-/under-decomp
   }
   async decomposeTask(prompt, systemContext) {
     const db = this.router.getWorldStateDB?.();
-    const worldStateContext = db ? `
+    let worldStateContext = "";
+    if (db) {
+      const knowledge = db.getFormattedKnowledge(prompt);
+      if (knowledge) {
+        worldStateContext = `
+
+PROJECT KNOWLEDGE (relevant facts about this codebase):
+${knowledge}`;
+      } else {
+        const log = db.getFormattedState();
+        if (log && log !== "World State is currently empty.") {
+          worldStateContext = `
 
 PROJECT WORLD STATE (Current architecture and recent changes):
-${db.getFormattedState()}` : "";
+${log}`;
+        }
+      }
+    }
     const contextSection = systemContext ? `
 Project context:
 ${systemContext}` : "";
@@ -7934,7 +8281,7 @@ Instructions:
       systemPrompt: this.systemPromptOverride + "You are a final output compiler. Summarize and format the task results clearly.",
       maxTokens: 8e3
     }, (chunk) => {
-      this.emit("stream:token", { tierId: this.id, text: chunk.text });
+      this.emit("stream:token", { tierId: this.id, text: chunk.text, primary: this.isPresenter });
     });
     return result.content;
   }
@@ -7963,14 +8310,11 @@ Reply with exactly one word: YES, NO, or UNSURE.
         temperature: 0
       });
       const answer = result.content.trim().toUpperCase();
-      if (answer.includes("YES")) {
-        return { requestId: req.id, approved: true, always: true, decidedBy: "T1", reasoning: "T1 evaluated: consistent with overall task goal" };
-      }
-      if (answer.includes("NO")) {
-        return { requestId: req.id, approved: false, always: true, decidedBy: "T1", reasoning: "T1 evaluated: not consistent with overall task goal" };
-      }
+      const verdict = answer.includes("YES") ? "approve" : answer.includes("NO") ? "deny" : "unsure";
+      (req.trail ??= []).push({ tier: "T1", verdict, reason: `T1: ${verdict === "approve" ? "consistent with overall task goal" : verdict === "deny" ? "not consistent with overall task goal" : "unsure"}` });
       return null;
     } catch {
+      (req.trail ??= []).push({ tier: "T1", verdict: "unsure", reason: "T1 evaluation failed" });
       return null;
     }
   }
@@ -9984,13 +10328,17 @@ var TaskAnalyzer = class {
    * Scores tier-eligible models using cost efficiency + historical performance.
    * Falls back to the priority-list default when no candidates have history.
    */
-  async selectModel(prompt, tier, selector) {
+  async selectModel(prompt, tier, selector, opts) {
     const profile = await this.analyze(prompt);
     if (profile.requiresVision) {
       return selector.selectVisionModel();
     }
-    const candidates2 = selector.getCandidatesForTier(tier);
+    let candidates2 = selector.getCandidatesForTier(tier);
     if (candidates2.length === 0) return selector.selectForTier(tier);
+    if (opts?.requiresToolUse) {
+      const toolCapable = candidates2.filter((m) => m.supportsToolUse !== false);
+      if (toolCapable.length > 0) candidates2 = toolCapable;
+    }
     const scored = candidates2.map((m) => ({
       model: m,
       score: this.scoreModel(m, profile)
@@ -10169,6 +10517,28 @@ var ModelPerformanceTracker = class {
     return Math.max(0.1, 1 - normalised * complexityWeight);
   }
 };
+var ivmCache;
+var ivmWarned = false;
+async function loadIsolatedVm() {
+  if (ivmCache !== void 0) return ivmCache;
+  try {
+    const specifier = "isolated-vm";
+    const mod = await import(specifier);
+    ivmCache = mod.default ?? mod;
+  } catch {
+    ivmCache = null;
+  }
+  return ivmCache;
+}
+function safeJsonParse(text) {
+  if (typeof text !== "string") return {};
+  try {
+    const v = JSON.parse(text);
+    return v && typeof v === "object" ? v : {};
+  } catch {
+    return {};
+  }
+}
 var DYNAMIC_TOOLS_FILE = "dynamic-tools.json";
 function normalizeToolSchema(schema) {
   if (schema && schema["type"] === "object" && typeof schema["properties"] === "object") {
@@ -10271,7 +10641,12 @@ var DynamicTool = class extends BaseTool {
   getEscalator;
   /** Untrusted = loaded from disk / a peer; its dangerous calls always re-prompt. */
   trusted;
-  constructor(spec, registry, getEscalator, trusted) {
+  /** Resolve the configured sandbox mode at call time (default 'auto'). */
+  getSandboxMode;
+  /** Optional diagnostics sink (routed through the host so it survives the Ink TUI). */
+  log;
+  constructor(spec, registry, getEscalator, trusted, getSandboxMode = () => "auto", log = () => {
+  }) {
     super();
     this.name = spec.name;
     this.description = spec.description;
@@ -10281,6 +10656,8 @@ var DynamicTool = class extends BaseTool {
     this.registry = registry;
     this.getEscalator = getEscalator;
     this.trusted = trusted;
+    this.getSandboxMode = getSandboxMode;
+    this.log = log;
   }
   isDangerous() {
     return this._isDangerous;
@@ -10317,8 +10694,94 @@ var DynamicTool = class extends BaseTool {
         return `Error calling ${toolName}: ${err instanceof Error ? err.message : String(err)}`;
       }
     };
+    const mode = this.getSandboxMode();
+    if (mode !== "worker") {
+      const ivm = await loadIsolatedVm();
+      if (ivm) return this.runInIsolate(ivm, input, callTool);
+      if (mode === "isolate" && !ivmWarned) {
+        ivmWarned = true;
+        this.log("[tool-creator] isolated-vm is not available (not installed or failed to build) \u2014 dynamic tools fall back to the worker sandbox, which is NOT capability-confined. Install isolated-vm for a hard isolate.");
+      }
+    }
     return this.runInWorker(input, callTool);
   }
+  /**
+   * Run the generated code in a hard V8 isolate (isolated-vm). The isolate global
+   * has no Node built-ins, so the code cannot see `process`, `require`, the
+   * filesystem, or the network — it reaches the host ONLY through the injected
+   * `callTool` (escalator-gated on the main thread) and `fetch` (SSRF-guarded via
+   * bridgeFetch). `script.run({ timeout })` bounds synchronous CPU; an outer
+   * wall-clock race + `isolate.dispose()` bounds async runaway (a never-resolving
+   * await), mirroring the worker's terminate().
+   */
+  async runInIsolate(ivm, input, callTool) {
+    const timeoutMs = Math.max(200, Number(process.env["CASCADE_DYNAMIC_TOOL_TIMEOUT_MS"]) || DYNAMIC_TOOL_TIMEOUT_MS);
+    const isolate = new ivm.Isolate({ memoryLimit: 128 });
+    let disposed = false;
+    const dispose = () => {
+      if (!disposed) {
+        disposed = true;
+        try {
+          isolate.dispose();
+        } catch {
+        }
+      }
+    };
+    try {
+      const context = await isolate.createContext();
+      const jail = context.global;
+      await jail.set("_callTool", new ivm.Reference(async (name, inputJson) => {
+        const out = await callTool(String(name), safeJsonParse(inputJson));
+        return String(out);
+      }));
+      await jail.set("_fetch", new ivm.Reference(async (url, initJson) => {
+        const r = await bridgeFetch(String(url), safeJsonParse(initJson));
+        return JSON.stringify(r);
+      }));
+      await jail.set("_input", new ivm.ExternalCopy(input).copyInto());
+      await jail.set("_code", this.executeCode);
+      const bootstrap = `
+        const callTool = (name, toolInput) => _callTool.apply(undefined,
+          [String(name), JSON.stringify(toolInput || {})],
+          { result: { promise: true }, arguments: { copy: true } });
+        const fetch = async (url, init) => {
+          const raw = await _fetch.apply(undefined,
+            [String(url), JSON.stringify(init || null)],
+            { result: { promise: true }, arguments: { copy: true } });
+          const r = JSON.parse(raw);
+          if (r && r.__error) throw new Error(r.__error);
+          return {
+            ok: r.ok, status: r.status, statusText: r.statusText,
+            headers: { get: (k) => (String(k).toLowerCase() === 'content-type' ? r.contentType : null) },
+            text: async () => r.body,
+            json: async () => JSON.parse(r.body),
+          };
+        };
+        const console = { log() {}, error() {} };
+        const AsyncFunction = Object.getPrototypeOf(async function () {}).constructor;
+        const fn = new AsyncFunction('input', 'callTool', 'fetch', 'console', _code);
+        (async () => { const r = await fn(_input, callTool, fetch, console); return String(r == null ? '' : r); })();
+      `;
+      const script = await isolate.compileScript(bootstrap);
+      const runPromise = script.run(context, { timeout: timeoutMs, promise: true }).then((v) => String(v ?? ""));
+      const timeoutPromise = new Promise((resolve) => {
+        const t = setTimeout(() => {
+          dispose();
+          resolve(`Dynamic tool "${this.name}" timed out after ${timeoutMs}ms and was terminated.`);
+        }, timeoutMs + 500);
+        t.unref?.();
+      });
+      return await Promise.race([runPromise, timeoutPromise]);
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      if (/timed? out/i.test(msg)) {
+        return `Dynamic tool "${this.name}" timed out after ${timeoutMs}ms and was terminated.`;
+      }
+      return `Tool error: ${msg}`;
+    } finally {
+      dispose();
+    }
+  }
   /** Spawn the worker, service its callTool/fetch bridge, enforce the kill timeout. */
   runInWorker(input, callTool) {
     const timeoutMs = Math.max(200, Number(process.env["CASCADE_DYNAMIC_TOOL_TIMEOUT_MS"]) || DYNAMIC_TOOL_TIMEOUT_MS);
@@ -10398,16 +10861,19 @@ var ToolCreator = class {
   workspacePath;
   /** When false, persisted tools are neither loaded nor written. */
   persistEnabled;
+  /** Sandbox runtime for generated tools; passed to each DynamicTool. */
+  sandboxMode;
   logger;
   /** name → spec, for persistence, broadcast, and re-registration. */
   specs = /* @__PURE__ */ new Map();
   /** capability fingerprint → tool name, so the same need isn't re-generated. */
   capabilityIndex = /* @__PURE__ */ new Map();
-  constructor(router, registry, workspacePath, persistEnabled = true) {
+  constructor(router, registry, workspacePath, persistEnabled = true, sandboxMode = "auto") {
     this.router = router;
     this.registry = registry;
     this.workspacePath = workspacePath;
     this.persistEnabled = persistEnabled;
+    this.sandboxMode = sandboxMode;
   }
   setPermissionEscalator(escalator) {
     this.escalator = escalator;
@@ -10495,7 +10961,14 @@ Required capability: ${description.slice(0, 300)}`;
       this.specs.set(spec.name, spec);
       return;
     }
-    const tool = new DynamicTool(spec, this.registry, () => this.escalator, trusted);
+    const tool = new DynamicTool(
+      spec,
+      this.registry,
+      () => this.escalator,
+      trusted,
+      () => this.sandboxMode,
+      (msg) => this.log(msg)
+    );
     this.registry.register(tool);
     this.specs.set(spec.name, spec);
     this.capabilityIndex.set(capabilityKey(`${spec.description}`), spec.name);
@@ -10544,6 +11017,9 @@ Required capability: ${description.slice(0, 300)}`;
     return Array.from(this.specs.keys());
   }
 };
+function normalizeKey(text) {
+  return text.trim().toLowerCase().replace(/\s+/g, " ");
+}
 var WorldStateDB = class {
   constructor(workspacePath, debugMode = false) {
     this.workspacePath = workspacePath;
@@ -10565,6 +11041,16 @@ var WorldStateDB = class {
         encrypted_payload TEXT NOT NULL
       )
     `);
+    this.db.exec(`
+      CREATE TABLE IF NOT EXISTS facts (
+        entity TEXT NOT NULL,
+        relation TEXT NOT NULL,
+        encrypted_value TEXT NOT NULL,
+        source_worker TEXT NOT NULL,
+        timestamp TEXT NOT NULL,
+        PRIMARY KEY (entity, relation)
+      )
+    `);
   }
   workspacePath;
   debugMode;
@@ -10638,6 +11124,131 @@ var WorldStateDB = class {
     if (entries.length === 0) return "World State is currently empty.";
     return entries.map((e, idx) => `[${e.timestamp}] Step ${idx + 1} (${e.workerId}): ${e.summary}`).join("\n");
   }
+  // ── world-state v2: queryable facts ──────────────
+  /**
+   * Upsert a fact. `(entity, relation)` is normalized so casing/whitespace don't
+   * fragment the key; an existing pair is superseded (value + provenance updated)
+   * rather than duplicated. Empty entity/relation/value are ignored.
+   */
+  upsertFact(entity, relation, value, sourceWorker, timestamp) {
+    const e = normalizeKey(entity);
+    const r = normalizeKey(relation);
+    const v = value.trim();
+    if (!e || !r || !v) return;
+    const encrypted = this.encrypt(JSON.stringify({ value: v }));
+    const stmt = this.db.prepare(`
+      INSERT INTO facts (entity, relation, encrypted_value, source_worker, timestamp)
+      VALUES (?, ?, ?, ?, ?)
+      ON CONFLICT(entity, relation) DO UPDATE SET
+        encrypted_value = excluded.encrypted_value,
+        source_worker   = excluded.source_worker,
+        timestamp       = excluded.timestamp
+    `);
+    stmt.run(e, r, encrypted, sourceWorker, timestamp ?? (/* @__PURE__ */ new Date()).toISOString());
+    this.dumpDebugIfNeeded();
+  }
+  rowToFact(row) {
+    let value;
+    try {
+      value = JSON.parse(this.decrypt(row.encrypted_value)).value;
+    } catch {
+      value = "[Decryption Failed - Payload Corrupted]";
+    }
+    return { entity: row.entity, relation: row.relation, value, sourceWorker: row.source_worker, timestamp: row.timestamp };
+  }
+  /** All facts whose entity matches one of the (normalized) query entities. */
+  getFactsForEntities(entities) {
+    const keys = Array.from(new Set(entities.map(normalizeKey).filter(Boolean)));
+    if (keys.length === 0) return [];
+    const placeholders = keys.map(() => "?").join(", ");
+    const stmt = this.db.prepare(
+      `SELECT entity, relation, encrypted_value, source_worker, timestamp FROM facts WHERE entity IN (${placeholders}) ORDER BY entity ASC, relation ASC`
+    );
+    return stmt.all(...keys).map((row) => this.rowToFact(row));
+  }
+  /** Every fact (used for tests / debug / whole-graph views). */
+  getAllFacts() {
+    const stmt = this.db.prepare("SELECT entity, relation, encrypted_value, source_worker, timestamp FROM facts ORDER BY entity ASC, relation ASC");
+    return stmt.all().map((row) => this.rowToFact(row));
+  }
+  /**
+   * A compact, human/LLM-readable fact block for T1/T2 planning. When `entities`
+   * is given, only facts about those entities are included; otherwise all facts.
+   * Returns '' when there are none so callers can fall back to the linear log.
+   */
+  getFormattedFacts(entities) {
+    const facts = entities && entities.length > 0 ? this.getFactsForEntities(entities) : this.getAllFacts();
+    if (facts.length === 0) return "";
+    return facts.map((f) => `- ${f.entity} ${f.relation} ${f.value}`).join("\n");
+  }
+  /**
+   * A compact knowledge block for T1/T2 planning. When `prompt` is given, facts
+   * whose entity/relation/value mention a prompt token are preferred (relevance
+   * filter); otherwise, or when nothing matches, all facts are used (capped at
+   * `limit`). Returns '' when there are no facts, so the caller can fall back to
+   * the raw linear log — this replaces replaying the whole log during planning.
+   */
+  getFormattedKnowledge(prompt, limit = 40) {
+    const all = this.getAllFacts();
+    if (all.length === 0) return "";
+    let selected = all;
+    if (prompt && prompt.trim()) {
+      const tokens = Array.from(new Set(prompt.toLowerCase().match(/[a-z0-9_./-]{3,}/g) ?? []));
+      if (tokens.length > 0) {
+        const matched = all.filter((f) => {
+          const hay = `${f.entity} ${f.relation} ${f.value}`.toLowerCase();
+          return tokens.some((t) => hay.includes(t));
+        });
+        if (matched.length > 0) selected = matched;
+      }
+    }
+    return selected.slice(0, limit).map((f) => `- ${f.entity} ${f.relation} ${f.value}`).join("\n");
+  }
+  // ── Export / Import ──────────────────────────
+  //
+  //  Knowledge travels DECRYPTED in the export bundle (a portable plaintext
+  //  JSON file — the encryption key never leaves this machine) and re-encrypts
+  //  with the LOCAL key on import.
+  exportKnowledge() {
+    return { facts: this.getAllFacts(), worldLog: this.getAllEntries() };
+  }
+  /**
+   * Merge imported knowledge. Facts upsert on (entity, relation) with
+   * newer-timestamp-wins (a local fact newer than the imported one is kept);
+   * log entries append with fresh ids, skipping exact duplicates
+   * (worker + timestamp + summary). Returns counts of what actually landed.
+   */
+  importKnowledge(data) {
+    let facts = 0;
+    let logEntries = 0;
+    if (Array.isArray(data.facts)) {
+      const local = new Map(this.getAllFacts().map((f) => [`${f.entity}\0${f.relation}`, f.timestamp]));
+      for (const f of data.facts) {
+        if (!f || typeof f.entity !== "string" || typeof f.relation !== "string" || typeof f.value !== "string") continue;
+        const key = `${normalizeKey(f.entity)}\0${normalizeKey(f.relation)}`;
+        const localTs = local.get(key);
+        const importTs = f.timestamp ?? (/* @__PURE__ */ new Date()).toISOString();
+        if (localTs && localTs >= importTs) continue;
+        this.upsertFact(f.entity, f.relation, f.value, f.sourceWorker ?? "imported", importTs);
+        facts++;
+      }
+    }
+    if (Array.isArray(data.worldLog)) {
+      const seen = new Set(this.getAllEntries().map((e) => `${e.workerId}\0${e.timestamp}\0${e.summary}`));
+      const stmt = this.db.prepare("INSERT INTO world_state (id, timestamp, worker_id, encrypted_payload) VALUES (?, ?, ?, ?)");
+      for (const e of data.worldLog) {
+        if (!e || typeof e.summary !== "string") continue;
+        const workerId = e.workerId ?? "imported";
+        const timestamp = e.timestamp ?? (/* @__PURE__ */ new Date()).toISOString();
+        const key = `${workerId}\0${timestamp}\0${e.summary}`;
+        if (seen.has(key)) continue;
+        stmt.run(crypto.randomUUID(), timestamp, workerId, this.encrypt(JSON.stringify({ summary: e.summary })));
+        seen.add(key);
+        logEntries++;
+      }
+    }
+    return { facts, logEntries };
+  }
   dumpDebugIfNeeded() {
     if (!this.debugMode) return;
     try {
@@ -10774,7 +11385,8 @@ var Cascade = class _Cascade extends EventEmitter {
     }
     const cfg = this.config;
     if (cfg["enableToolCreation"] === true) {
-      this.toolCreator = new ToolCreator(this.router, this.toolRegistry, this.workspacePath, cfg["persistDynamicTools"] !== false);
+      const sandboxMode = this.config.tools?.dynamicToolSandbox ?? "auto";
+      this.toolCreator = new ToolCreator(this.router, this.toolRegistry, this.workspacePath, cfg["persistDynamicTools"] !== false, sandboxMode);
       this.toolCreator.setLogger((m) => {
         if (this.listenerCount("log") > 0) this.emit("log", { level: "info", message: m });
       });
@@ -11012,6 +11624,10 @@ ${last.partialOutput}` : "");
         this.router.profileModels(this.store).catch(() => {
         });
       }
+      if (this.store) {
+        this.router.probeLocalToolSupport(this.store).catch(() => {
+        });
+      }
       if (this.config.cascadeAuto) {
         this.router.refreshLiveData().catch(() => {
         });
@@ -11066,6 +11682,21 @@ ${last.partialOutput}` : "");
     const producesArtifact = /\b(?:create|build|implement|generate|write|refactor|rewrite|add|fix|deploy|install|migrate|scaffold|set up|save (?:a|the)|report|\.(?:pdf|md|txt|json|csv|py|js|ts|tsx|jsx|html|docx?))\b/i.test(p);
     return inquiry && !producesArtifact;
   }
+  /**
+   * Strong, explicit signals that a task needs the full hierarchy (planning +
+   * multiple sections/workers). Deliberately conservative: requires a
+   * build/implementation verb AND either an app/system-scale noun or an
+   * explicit multi-part structure, so ordinary single-file asks (handled as
+   * Simple/Moderate) don't get over-escalated.
+   */
+  looksClearlyComplex(prompt) {
+    const p = prompt.trim();
+    if (p.length < 24) return false;
+    const buildVerb = /\b(?:build|implement|create|develop|design|scaffold|refactor|migrate|architect|set up|integrate)\b/i.test(p);
+    const scaleNoun = /\b(?:app(?:lication)?|system|platform|service|api|backend|frontend|full[- ]?stack|website|dashboard|pipeline|microservices?|database schema|authentication|end[- ]to[- ]end|codebase|project|multiple files|several (?:files|modules|components)|test suite)\b/i.test(p);
+    const multiPart = /(?:\b(?:and|then|also|plus|as well as)\b.*\b(?:and|then|also)\b)|(?:^|\n)\s*(?:[-*]|\d+[.)])\s+/i.test(p);
+    return buildVerb && (scaleNoun || multiPart);
+  }
   // Cache glob scan results per workspace path to avoid repeated I/O.
   static globCache = /* @__PURE__ */ new Map();
   async countWorkspaceFiles(workspacePath) {
@@ -11149,10 +11780,16 @@ ${prompt}` : prompt;
       let verdict;
       if (match) {
         verdict = match[1] === "simple" ? "Simple" : match[1] === "moderate" ? "Moderate" : "Complex";
-        this.recordDecision("complexity", `${verdict} \u2014 classifier: ${reason || "no reason given"}`);
+        if (verdict !== "Complex" && this.looksClearlyComplex(prompt)) {
+          this.recordDecision("complexity", `Complex \u2014 heuristic floor over classifier "${verdict}": explicit multi-step build/implementation signals (T1 engaged)`);
+          verdict = "Complex";
+        } else {
+          this.recordDecision("complexity", `${verdict} \u2014 classifier: ${reason || "no reason given"}`);
+        }
       } else {
-        verdict = prompt.trim().split(/\s+/).length <= 12 ? "Simple" : "Moderate";
-        this.recordDecision("complexity", `${verdict} \u2014 classifier output unparseable; defaulted by length`);
+        const words = prompt.trim().split(/\s+/).length;
+        verdict = words <= 12 ? "Simple" : words >= 40 || this.looksClearlyComplex(prompt) ? "Complex" : "Moderate";
+        this.recordDecision("complexity", `${verdict} \u2014 classifier output unparseable; defaulted by length/signals`);
       }
       return verdict;
     } catch {
@@ -11204,7 +11841,15 @@ ${prompt}` : prompt;
       }
       escalator.resolveUserDecision(req.id, approved, always);
     });
-    const complexity = await this.determineComplexity(options.prompt, options.workspacePath || process.cwd(), options.conversationHistory);
+    const forceTier = this.config.routing?.forceTier;
+    const forced = forceTier === "T1" ? "Complex" : forceTier === "T2" ? "Moderate" : forceTier === "T3" ? "Simple" : void 0;
+    let complexity;
+    if (forced) {
+      complexity = forced;
+      this.recordDecision("complexity", `${forced} \u2014 manually forced via routing.forceTier=${forceTier}`);
+    } else {
+      complexity = await this.determineComplexity(options.prompt, options.workspacePath || process.cwd(), options.conversationHistory);
+    }
     this.telemetry.capture("cascade:session_start", {
       complexity,
       providerCount: this.config.providers.length,
@@ -11284,6 +11929,7 @@ ${prompt}` : prompt;
     try {
       if (complexity === "Simple") {
         const t3 = new T3Worker(this.router, this.toolRegistry, "root");
+        t3.setPresenter(true);
         t3.setHierarchyContext("You are the DIRECT worker for this task. There is no T1 Administrator or T2 Manager involved in this run.");
         if (identityPrompt) {
           t3.setSystemPromptOverride(identityPrompt);
@@ -11308,6 +11954,7 @@ ${prompt}` : prompt;
         this.emit("tier:status", { tierId: "t3-root", status: "COMPLETED", role: "T3" });
       } else if (complexity === "Moderate") {
         const t2 = new T2Manager(this.router, this.toolRegistry, "root");
+        t2.setPresenter(true);
         t2.setHierarchyContext("You are the ROOT Manager for this task. There is no T1 Administrator involved in this run. You are responsible for decomposing the task and managing T3 workers directly.");
         if (identityPrompt) {
           t2.setSystemPromptOverride(identityPrompt);
@@ -11357,6 +12004,7 @@ ${prompt}` : prompt;
         }
       } else {
         const t1 = new T1Administrator(this.router, this.toolRegistry, this.config);
+        t1.setPresenter(true);
         t1.setHierarchyContext("You are the top-level Administrator. You are responsible for the overall plan and supervising multiple T2 Managers.");
         if (identityPrompt) {
           t1.setSystemPromptOverride(identityPrompt);
@@ -15357,7 +16005,8 @@ var DashboardSocket = class {
       socket.on("cascade:run", (payload) => {
         if (typeof payload?.prompt === "string" && payload.prompt.trim()) {
           const sessionId = typeof payload.sessionId === "string" && payload.sessionId.trim() ? payload.sessionId.trim() : void 0;
-          callback(payload.prompt.trim(), payload.model ?? "auto", socket.id, sessionId);
+          const forceTier = ["T1", "T2", "T3"].includes(payload.forceTier) ? payload.forceTier : void 0;
+          callback(payload.prompt.trim(), payload.model ?? "auto", socket.id, sessionId, forceTier);
         }
       });
     });
@@ -15387,6 +16036,13 @@ var DashboardServer = class {
    * of runs the session performed in this server's lifetime.
    */
   sessionTaskIds = /* @__PURE__ */ new Map();
+  /**
+   * Tool-approval requests awaiting a user decision from a connected client,
+   * keyed by the request's uuid. The desktop shows a modal on
+   * `permission:user-required` and answers with `permission:decision`; this
+   * map is how that answer reaches the run that's blocked on it.
+   */
+  pendingApprovals = /* @__PURE__ */ new Map();
   port;
   host;
   workspacePath;
@@ -15445,17 +16101,18 @@ var DashboardServer = class {
       }
       this.persistConfig();
     });
-    this.socket.onCascadeRun(async (prompt, model, socketId, requestedSessionId) => {
+    this.socket.onCascadeRun(async (prompt, model, socketId, requestedSessionId, forceTier) => {
       const sessionId = requestedSessionId ?? randomUUID();
       const abortController = new AbortController();
       this.activeControllers.set(sessionId, abortController);
       const runPrompt = requestedSessionId ? this.buildContinuationPrompt(sessionId, prompt) : prompt;
       const title = this.persistRunStart(sessionId, prompt);
-      const cfg = model !== "auto" ? { ...this.config, models: { ...this.config.models, t1: model } } : this.config;
+      let cfg = model !== "auto" ? { ...this.config, models: { ...this.config.models, t1: model } } : this.config;
+      if (forceTier) cfg = { ...cfg, routing: { ...cfg.routing, forceTier } };
       const cascade = new Cascade(cfg, this.workspacePath, this.store);
       this.activeSessions.set(sessionId, cascade);
       cascade.on("stream:token", (e) => {
-        this.socket.emitToSocket(socketId, "stream:token", { sessionId, tierId: e.tierId, text: e.text });
+        this.socket.emitToSocket(socketId, "stream:token", { sessionId, tierId: e.tierId, text: e.text, primary: e.primary });
       });
       cascade.on("tier:status", (e) => {
         this.socket.emitToSocket(socketId, "tier:status", { sessionId, ...e });
@@ -15467,7 +16124,11 @@ var DashboardServer = class {
         this.socket.emitPeerMessage(e);
       });
       try {
-        const result = await cascade.run({ prompt: runPrompt, signal: abortController.signal });
+        const result = await cascade.run({
+          prompt: runPrompt,
+          signal: abortController.signal,
+          approvalCallback: this.makeApprovalCallback(sessionId)
+        });
         this.recordSessionTask(sessionId, result.taskId);
         this.persistRunEnd(sessionId, title, prompt, result.output, "COMPLETED");
         this.socket.emitToSocket(socketId, "session:complete", { sessionId, result });
@@ -15486,10 +16147,18 @@ var DashboardServer = class {
       } finally {
         this.activeSessions.delete(sessionId);
         this.activeControllers.delete(sessionId);
+        this.denyPendingApprovals(sessionId);
       }
     });
     this.socket.onSessionHalt((sessionId) => {
       this.activeControllers.get(sessionId)?.abort();
+      this.denyPendingApprovals(sessionId);
+    });
+    this.socket.onApprovalResponse(({ requestId, approved, always }) => {
+      const pending = this.pendingApprovals.get(requestId);
+      if (!pending) return;
+      this.pendingApprovals.delete(requestId);
+      pending.resolve({ approved: !!approved, always: !!always });
     });
     this.socket.onSessionSteer((message, sessionId, nodeId) => {
       const steered = this.steerSessions(message, sessionId, nodeId);
@@ -15657,6 +16326,29 @@ var DashboardServer = class {
     list.push(taskId);
     this.sessionTaskIds.set(sessionId, list);
   }
+  /**
+   * Approval bridge: cascade calls this when a dangerous tool escalates to the
+   * user. The request itself was already pushed to the client via the
+   * `permission:user-required` forward; here we just park a resolver keyed by
+   * the request id and wait for the client's `permission:decision` (handled in
+   * onApprovalResponse). Never auto-approves — an unanswered request stays
+   * pending until the client answers, the run ends, or the escalator's own
+   * timeout denies it.
+   */
+  makeApprovalCallback(sessionId) {
+    return (request) => new Promise((resolve) => {
+      this.pendingApprovals.set(request.id, { resolve, sessionId });
+    });
+  }
+  /** Deny + clear any approvals still pending for a session (run end / abort). */
+  denyPendingApprovals(sessionId) {
+    for (const [id, pending] of this.pendingApprovals) {
+      if (pending.sessionId === sessionId) {
+        this.pendingApprovals.delete(id);
+        pending.resolve({ approved: false, always: false });
+      }
+    }
+  }
   persistRuntimeRow(sessionId, title, status, latestPrompt) {
     const now = (/* @__PURE__ */ new Date()).toISOString();
     const row = { sessionId, title, workspacePath: this.workspacePath, status, startedAt: now, updatedAt: now, latestPrompt, isGlobal: false };
@@ -15845,15 +16537,6 @@ ${prompt}`;
       if (sessionId) this.socket.broadcastToRoom(`session:${sessionId}`, "session:halt", payload);
       res.json({ success: true, ...payload });
     });
-    this.app.post("/api/approve", auth, mutationLimiter, (req, res) => {
-      const body = req.body;
-      const sessionId = typeof body["sessionId"] === "string" ? body["sessionId"] : void 0;
-      const nodeId = typeof body["nodeId"] === "string" ? body["nodeId"] : void 0;
-      const payload = { sessionId, nodeId, requestedAt: (/* @__PURE__ */ new Date()).toISOString() };
-      this.socket.broadcast("session:approve", payload);
-      if (sessionId) this.socket.broadcastToRoom(`session:${sessionId}`, "session:approve", payload);
-      res.json({ success: true, ...payload });
-    });
     this.app.post("/api/inject", auth, mutationLimiter, (req, res) => {
       const body = req.body;
       const message = typeof body["message"] === "string" ? body["message"] : void 0;
@@ -15898,6 +16581,60 @@ ${prompt}`;
       this.socket.broadcast("runtime:refresh", { scope: "global" });
       res.json({ ok: true });
     });
+    this.app.get("/api/export", auth, (req, res) => {
+      try {
+        const sessionsParam = typeof req.query["sessions"] === "string" ? req.query["sessions"] : "all";
+        const includeMemories = req.query["memories"] === "1" || req.query["memories"] === "true";
+        const ids = sessionsParam === "all" ? void 0 : sessionsParam.split(",").map((s) => s.trim()).filter(Boolean);
+        const bundle = {
+          format: "cascade-export@1",
+          exportedAt: (/* @__PURE__ */ new Date()).toISOString(),
+          sessions: this.store.exportSessions(ids)
+        };
+        if (includeMemories) {
+          const ws = new WorldStateDB(this.workspacePath);
+          try {
+            bundle["memories"] = { ...ws.exportKnowledge(), identities: this.store.listIdentities() };
+          } finally {
+            ws.close();
+          }
+        }
+        res.json(bundle);
+      } catch (err) {
+        res.status(500).json({ error: err instanceof Error ? err.message : String(err) });
+      }
+    });
+    this.app.post("/api/import", auth, mutationLimiter, (req, res) => {
+      try {
+        const bundle = req.body;
+        if (!bundle || bundle.format !== "cascade-export@1") {
+          res.status(400).json({ error: "Not a cascade-export@1 bundle." });
+          return;
+        }
+        const importedSessions = Array.isArray(bundle.sessions) ? this.store.importSessions(bundle.sessions) : [];
+        for (const s of importedSessions) this.persistRuntimeRow(s.id, s.title, "COMPLETED");
+        let facts = 0;
+        let logEntries = 0;
+        let identities = 0;
+        if (bundle.memories) {
+          const ws = new WorldStateDB(this.workspacePath);
+          try {
+            const counts = ws.importKnowledge(bundle.memories);
+            facts = counts.facts;
+            logEntries = counts.logEntries;
+          } finally {
+            ws.close();
+          }
+          if (Array.isArray(bundle.memories.identities)) {
+            identities = this.store.importIdentities(bundle.memories.identities);
+          }
+        }
+        this.socket.broadcast("runtime:refresh", { scope: "workspace" });
+        res.json({ ok: true, imported: { sessions: importedSessions.length, facts, logEntries, identities } });
+      } catch (err) {
+        res.status(500).json({ error: err instanceof Error ? err.message : String(err) });
+      }
+    });
     this.app.post("/api/sessions/:id/rollback", auth, mutationLimiter, async (req, res) => {
       const sessionId = req.params.id;
       const taskIds = this.sessionTaskIds.get(sessionId) ?? [];
@@ -16104,7 +16841,7 @@ ${prompt}`;
         const cascade = new Cascade(this.config, this.workspacePath, this.store);
         this.activeSessions.set(sessionId, cascade);
         cascade.on("stream:token", (e) => {
-          this.socket.broadcastToRoom(`session:${sessionId}`, "stream:token", { sessionId, tierId: e.tierId, text: e.text });
+          this.socket.broadcastToRoom(`session:${sessionId}`, "stream:token", { sessionId, tierId: e.tierId, text: e.text, primary: e.primary });
         });
         cascade.on("tier:status", (e) => {
           this.socket.broadcastToRoom(`session:${sessionId}`, "tier:status", { sessionId, ...e });
@@ -16116,7 +16853,11 @@ ${prompt}`;
           this.socket.emitPeerMessage(e);
         });
         try {
-          const result = await cascade.run({ prompt: runPrompt, identityId: body.identityId });
+          const result = await cascade.run({
+            prompt: runPrompt,
+            identityId: body.identityId,
+            approvalCallback: this.makeApprovalCallback(sessionId)
+          });
           this.recordSessionTask(sessionId, result.taskId);
           this.persistRunEnd(sessionId, title, prompt, result.output, "COMPLETED");
           this.socket.broadcast("cost:update", {
@@ -16134,6 +16875,7 @@ ${prompt}`;
           });
         } finally {
           this.activeSessions.delete(sessionId);
+          this.denyPendingApprovals(sessionId);
         }
       })();
     });