cascade-ai 0.13.2 → 0.15.0

package/dist/index.cjs

@@ -236,7 +236,7 @@ var init_audit_logger = __esm({
 });
 
 // src/constants.ts
-var CASCADE_VERSION = "0.13.2";
+var CASCADE_VERSION = "0.15.0";
 var CASCADE_CONFIG_DIR = ".cascade";
 var CASCADE_MD_FILE = "CASCADE.md";
 var CASCADE_IGNORE_FILE = ".cascadeignore";
@@ -1482,29 +1482,71 @@ var OllamaProvider = class extends BaseProvider {
   async countTokens(text) {
     return Math.ceil(text.length / 4);
   }
+  /**
+   * Ask the Ollama server what a model can actually do. Modern Ollama returns a
+   * `capabilities` array ("completion", "tools", "vision", …) and the model's
+   * real context length in `model_info` — authoritative, unlike the hardcoded
+   * family-name allowlist, which silently misclassifies any unlisted family.
+   * Best-effort: null on old servers / errors, callers fall back to heuristics.
+   */
+  async showModel(name) {
+    const ac = new AbortController();
+    const timer = setTimeout(() => ac.abort(), 2500);
+    try {
+      const resp = await fetch(`${this.baseUrl}/api/show`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ model: name }),
+        signal: ac.signal
+      });
+      if (!resp.ok) return null;
+      const data = await resp.json();
+      const out = {};
+      if (Array.isArray(data.capabilities)) {
+        out.tools = data.capabilities.includes("tools");
+        out.vision = data.capabilities.includes("vision");
+      }
+      for (const [k, v] of Object.entries(data.model_info ?? {})) {
+        if (k.endsWith(".context_length") && typeof v === "number" && v > 0) {
+          out.contextWindow = v;
+          break;
+        }
+      }
+      return out.tools !== void 0 || out.contextWindow ? out : null;
+    } catch {
+      return null;
+    } finally {
+      clearTimeout(timer);
+    }
+  }
   async listModels() {
     try {
       const response = await fetch(`${this.baseUrl}/api/tags`);
       if (!response.ok) return [];
       const data = await response.json();
       const supportedKeywords = ["llama3", "llama2", "gemma", "mistral", "mixtral", "qwen", "phi3", "codellama", "deepseek", "llava", "starcoder", "stable-code", "nomic-embed"];
-      return data.models.filter((m) => {
+      const entries = data.models.filter((m) => {
         const name = m.name.toLowerCase();
         return supportedKeywords.some((k) => name.includes(k));
-      }).map((m) => ({
-        id: m.name,
-        name: m.name,
-        provider: "ollama",
-        contextWindow: 128e3,
-        isVisionCapable: m.name.includes("llava") || m.name.includes("vision"),
-        inputCostPer1kTokens: 0,
-        outputCostPer1kTokens: 0,
-        maxOutputTokens: 4e3,
-        supportsStreaming: true,
-        isLocal: true,
-        supportsToolUse: isToolCapable(m.name),
-        minSizeB: this.parseSizeB(m.details?.parameter_size)
-      }));
+      });
+      const shows = await Promise.all(entries.map((m) => this.showModel(m.name)));
+      return entries.map((m, i) => {
+        const show = shows[i];
+        return {
+          id: m.name,
+          name: m.name,
+          provider: "ollama",
+          contextWindow: show?.contextWindow ?? 128e3,
+          isVisionCapable: show?.vision ?? (m.name.includes("llava") || m.name.includes("vision")),
+          inputCostPer1kTokens: 0,
+          outputCostPer1kTokens: 0,
+          maxOutputTokens: 4e3,
+          supportsStreaming: true,
+          isLocal: true,
+          supportsToolUse: show?.tools ?? isToolCapable(m.name),
+          minSizeB: this.parseSizeB(m.details?.parameter_size)
+        };
+      });
     } catch {
       return [];
     }
@@ -2181,6 +2223,7 @@ function normalizeModelId(id) {
 var LiveDataProvider = class {
   snapshot = null;
   prices = /* @__PURE__ */ new Map();
+  capabilities = /* @__PURE__ */ new Map();
   source = "bundled";
   fetchedAt = 0;
   loaded = false;
@@ -2209,6 +2252,9 @@ var LiveDataProvider = class {
       if (cache.prices) {
         for (const [id, p] of Object.entries(cache.prices)) this.prices.set(id, p);
       }
+      if (cache.capabilities) {
+        for (const [id, c] of Object.entries(cache.capabilities)) this.capabilities.set(id, c);
+      }
       this.fetchedAt = cache.fetchedAt ?? 0;
     } catch {
     }
@@ -2229,9 +2275,9 @@ var LiveDataProvider = class {
     const ttlMs = this.opts.refreshHours * 36e5;
     const fresh = ttlMs > 0 && Date.now() - this.fetchedAt < ttlMs;
     if (!force && fresh && this.source !== "bundled") return;
-    const [snap, prices] = await Promise.all([
+    const [snap, catalog] = await Promise.all([
       this.opts.live ? this.fetchSnapshot() : Promise.resolve(null),
-      this.opts.pricingLive ? this.fetchPrices() : Promise.resolve(null)
+      this.opts.pricingLive ? this.fetchCatalog() : Promise.resolve(null)
     ]);
     let changed = false;
     if (snap) {
@@ -2239,8 +2285,12 @@ var LiveDataProvider = class {
       this.source = "live";
       changed = true;
     }
-    if (prices && prices.size > 0) {
-      this.prices = prices;
+    if (catalog && catalog.prices.size > 0) {
+      this.prices = catalog.prices;
+      changed = true;
+    }
+    if (catalog && catalog.capabilities.size > 0) {
+      this.capabilities = catalog.capabilities;
       changed = true;
     }
     if (changed) {
@@ -2262,21 +2312,43 @@ var LiveDataProvider = class {
       return null;
     }
   }
-  async fetchPrices() {
+  /**
+   * One fetch of the OpenRouter catalog yields BOTH pricing and capability
+   * facts (context window, native tool support, input modalities) — the
+   * capability fields used to be discarded while providers guessed/hardcoded
+   * them in their listModels() stubs.
+   */
+  async fetchCatalog() {
     try {
       const resp = await withTimeout(fetch(OPENROUTER_MODELS_URL), FETCH_TIMEOUT_MS, "pricing fetch timed out");
       if (!resp.ok) return null;
       const data = await resp.json();
       if (!Array.isArray(data?.data)) return null;
-      const out = /* @__PURE__ */ new Map();
+      const prices = /* @__PURE__ */ new Map();
+      const capabilities = /* @__PURE__ */ new Map();
       for (const m of data.data) {
-        if (!m?.id || !m.pricing) continue;
-        const input = Number(m.pricing.prompt) * 1e3;
-        const output = Number(m.pricing.completion) * 1e3;
-        if (!Number.isFinite(input) || !Number.isFinite(output)) continue;
-        out.set(normalizeModelId(m.id), { input, output });
+        if (!m?.id) continue;
+        const key = normalizeModelId(m.id);
+        if (m.pricing) {
+          const input = Number(m.pricing.prompt) * 1e3;
+          const output = Number(m.pricing.completion) * 1e3;
+          if (Number.isFinite(input) && Number.isFinite(output)) {
+            prices.set(key, { input, output });
+          }
+        }
+        const cap = {};
+        if (typeof m.context_length === "number" && m.context_length > 0) {
+          cap.contextWindow = m.context_length;
+        }
+        if (Array.isArray(m.supported_parameters)) {
+          cap.supportsTools = m.supported_parameters.includes("tools");
+        }
+        if (Array.isArray(m.architecture?.input_modalities)) {
+          cap.inputModalities = m.architecture.input_modalities;
+        }
+        if (Object.keys(cap).length > 0) capabilities.set(key, cap);
       }
-      return out;
+      return { prices, capabilities };
     } catch {
       return null;
     }
@@ -2287,7 +2359,8 @@ var LiveDataProvider = class {
       const cache = {
         fetchedAt: this.fetchedAt,
         snapshot: this.snapshot ?? void 0,
-        prices: Object.fromEntries(this.prices)
+        prices: Object.fromEntries(this.prices),
+        capabilities: Object.fromEntries(this.capabilities)
       };
       await fs4__default.default.writeFile(this.opts.cacheFile, JSON.stringify(cache, null, 2), "utf-8");
     } catch {
@@ -2312,6 +2385,27 @@ var LiveDataProvider = class {
       return { ...m, inputCostPer1kTokens: p.input, outputCostPer1kTokens: p.output };
     });
   }
+  /** Current capability facts for a model id, or null when unknown. */
+  getCapability(modelId) {
+    return this.capabilities.get(normalizeModelId(modelId)) ?? null;
+  }
+  /**
+   * Returns capability-corrected copies of each model (originals untouched):
+   * real context windows replace the providers' hardcoded guesses, native
+   * tool support replaces the assume-by-provider default, and vision is set
+   * from the declared input modalities.
+   */
+  applyLiveCapabilities(models) {
+    return models.map((m) => {
+      const c = this.getCapability(m.id);
+      if (!c) return m;
+      const next = { ...m };
+      if (c.contextWindow) next.contextWindow = c.contextWindow;
+      if (c.supportsTools !== void 0) next.supportsToolUse = c.supportsTools;
+      if (c.inputModalities) next.isVisionCapable = c.inputModalities.includes("image");
+      return next;
+    });
+  }
   /** Where the active quality data came from — for /why and `cascade models`. */
   getDataSource() {
     return this.source;
@@ -2322,6 +2416,9 @@ var LiveDataProvider = class {
   hasLivePricing() {
     return this.prices.size > 0;
   }
+  hasCapabilities() {
+    return this.capabilities.size > 0;
+  }
 };
 
 // src/core/router/benchmarks.ts
@@ -2510,6 +2607,57 @@ var CascadeRouter = class _CascadeRouter extends EventEmitter__default.default {
     profiler.profileAll(allModels).catch(() => {
     });
   }
+  /**
+   * One-time native tool-call probe for local/compat models with NO capability
+   * metadata. llama.cpp / LM Studio "/models" endpoints return ids only, so
+   * `supportsToolUse` stays undefined and the T3 tool gate ASSUMES native
+   * support — wrong for many local builds, which then fumble tool-format
+   * output. Each unknown model is probed once with a trivial tool; the verdict
+   * persists in the MemoryStore's model_cache (via the previously-dormant
+   * getModelProfile read-back), so a model is probed once EVER, not per run.
+   * Cloud providers are never probed — their metadata is authoritative.
+   */
+  async probeLocalToolSupport(store) {
+    const unknown = this.selector.getAllAvailableModels().filter(
+      (m) => m.provider === "openai-compatible" && m.supportsToolUse === void 0
+    );
+    for (const model of unknown) {
+      const cached = store.getModelProfile(model.id, model.provider);
+      let verdict = cached?.supportsToolUse;
+      if (verdict === void 0) {
+        const probed = await this.probeNativeToolCall(model);
+        if (probed === null) continue;
+        verdict = probed;
+        store.saveModelCapability(model.id, model.provider, { supportsToolUse: verdict });
+      }
+      this.selector.addDynamicModel({ ...model, supportsToolUse: verdict });
+    }
+    for (const tier of ["T1", "T2", "T3"]) {
+      const cur = this.tierModels.get(tier);
+      if (!cur) continue;
+      const fresh = this.selector.getModelById(cur.id);
+      if (fresh) this.tierModels.set(tier, fresh);
+    }
+  }
+  async probeNativeToolCall(model) {
+    try {
+      const cfg = this.config.providers.find((p) => p.type === model.provider) ?? { type: model.provider };
+      const provider = this.createProvider(cfg, model);
+      const result = await withTimeout(provider.generate({
+        messages: [{ role: "user", content: "Call the echo tool with text set to 'ping'. Use the tool; do not answer in prose." }],
+        tools: [{
+          name: "echo",
+          description: "Echo the given text back to the caller.",
+          inputSchema: { type: "object", properties: { text: { type: "string", description: "Text to echo" } }, required: ["text"] }
+        }],
+        maxTokens: 80,
+        temperature: 0
+      }), 3e4, "tool-support probe timed out");
+      return (result.toolCalls?.length ?? 0) > 0;
+    } catch {
+      return null;
+    }
+  }
   /**
    * Cascade Auto live data: discover/validate real model ids from each cloud
    * provider, then fetch current public quality scores + per-token prices and
@@ -2559,12 +2707,17 @@ var CascadeRouter = class _CascadeRouter extends EventEmitter__default.default {
     await Promise.allSettled(tasks);
   }
   /**
-   * Replace available models with live-priced copies and refresh the already
-   * resolved tier models so shared-tier cost accounting uses current prices.
+   * Replace available models with live-priced AND capability-corrected copies
+   * (real context windows, native tool support, vision from modalities), then
+   * refresh the already resolved tier models so shared-tier cost accounting and
+   * the tool-use gate both see current data.
    */
   applyLivePricing() {
-    if (!this.liveData?.hasLivePricing()) return;
-    const updated = this.liveData.applyLivePricing(this.selector.getAllAvailableModels());
+    if (!this.liveData) return;
+    if (!this.liveData.hasLivePricing() && !this.liveData.hasCapabilities()) return;
+    let updated = this.selector.getAllAvailableModels();
+    if (this.liveData.hasLivePricing()) updated = this.liveData.applyLivePricing(updated);
+    if (this.liveData.hasCapabilities()) updated = this.liveData.applyLiveCapabilities(updated);
     for (const m of updated) this.selector.addDynamicModel(m);
     for (const tier of ["T1", "T2", "T3"]) {
       const cur = this.tierModels.get(tier);
@@ -2739,6 +2892,10 @@ var CascadeRouter = class _CascadeRouter extends EventEmitter__default.default {
     const r = this.config?.reinforcements;
     return { enabled: r?.enabled === true, maxPerSection: r?.maxPerSection ?? 4 };
   }
+  /** Project-knowledge settings (config.knowledge). Facts extraction on by default. */
+  getKnowledgeConfig() {
+    return { factsExtraction: this.config?.knowledge?.factsExtraction !== false };
+  }
   /**
    * Resolved T3 wave execution mode. 'auto' becomes 'sequential' when the T3
    * tier resolves to a LOCAL model (the single-GPU queue serializes anyway, so
@@ -2825,10 +2982,10 @@ var CascadeRouter = class _CascadeRouter extends EventEmitter__default.default {
    * null when Cascade Auto is off (callers then use the shared tier model).
    * Pure heuristic — no extra LLM call.
    */
-  async selectModelForSubtask(tier, text) {
+  async selectModelForSubtask(tier, text, opts) {
     if (!this.config?.cascadeAuto || !this.taskAnalyzer || !text.trim()) return null;
     try {
-      return await this.taskAnalyzer.selectModel(text, tier, this.selector);
+      return await this.taskAnalyzer.selectModel(text, tier, this.selector, opts);
     } catch {
       return null;
     }
@@ -3583,6 +3740,13 @@ EXAMPLE \u2014 calling the "shell" tool to list files:
 {"name": "shell", "input": {"command": "ls -la"}}
 </tool_call>
 
+When you have enough information, stop calling tools and write your final answer.`;
+}
+function buildTextToolReminder(tools) {
+  return `
+TOOL USE REMINDER:
+Call tools with a single <tool_call>{"name": "<tool_name>", "input": { ... }}</tool_call> block (valid JSON, double quotes, one tool per turn), matching the argument shapes of your earlier calls in this conversation.
+Available tools: ${tools.map((t) => t.name).join(", ")}.
 When you have enough information, stop calling tools and write your final answer.`;
 }
 
@@ -3822,6 +3986,9 @@ Now execute your subtask using this context where relevant.`
         } catch (e) {
           this.log("Failed to write to World State DB");
         }
+        if (this.router.getKnowledgeConfig?.().factsExtraction !== false) {
+          await this.extractAndStoreFacts(db, assignment, output);
+        }
       }
       this.setStatus("COMPLETED", output);
       this.sendStatusUpdate({ progressPct: 100, currentAction: "Subtask complete", status: "IN_PROGRESS", output });
@@ -3883,7 +4050,7 @@ Now execute your subtask using this context where relevant.`
     let subtaskModel;
     try {
       const subtaskText = `${this.assignment?.subtaskTitle ?? ""} ${this.assignment?.description ?? ""} ${this.assignment?.expectedOutput ?? ""}`;
-      subtaskModel = await this.router.selectModelForSubtask("T3", subtaskText) ?? void 0;
+      subtaskModel = await this.router.selectModelForSubtask("T3", subtaskText, { requiresToolUse: tools.length > 0 }) ?? void 0;
       if (subtaskModel) {
         this.log(`Cascade Auto: routing this subtask to ${subtaskModel.provider}:${subtaskModel.id}`);
       }
@@ -3891,7 +4058,8 @@ Now execute your subtask using this context where relevant.`
     }
     const effectiveModel = subtaskModel ?? this.router.getModelForTier("T3");
     const useTextTools = effectiveModel?.supportsToolUse === false && tools.length > 0;
-    const textToolSuffix = useTextTools ? buildTextToolSystemPrompt(tools) : "";
+    let sentFullTextContract = false;
+    let textContractSignature = "";
     while (iterations < MAX_ITERATIONS) {
       iterations++;
       this.throwIfCancelled();
@@ -3905,6 +4073,17 @@ Now execute your subtask using this context where relevant.`
 ${g.text}`
         });
       }
+      let textToolSuffix = "";
+      if (useTextTools) {
+        const signature = tools.map((t) => t.name).join(",");
+        if (!sentFullTextContract || signature !== textContractSignature) {
+          textToolSuffix = buildTextToolSystemPrompt(tools);
+          sentFullTextContract = true;
+          textContractSignature = signature;
+        } else {
+          textToolSuffix = buildTextToolReminder(tools);
+        }
+      }
       const options = {
         messages: this.context.getMessages(),
         systemPrompt: this.systemPromptOverride + systemPrompt + (this.hierarchyContext ? `
@@ -4394,6 +4573,41 @@ HIERARCHY CONTEXT: ${this.hierarchyContext}` : ""),
       };
     }
   }
+  /**
+   * world-state v2: distill a completed subtask's output into durable
+   * `(entity, relation, value)` facts and upsert them into the knowledge graph.
+   * A bounded, cheap T3-tier call; entirely best-effort — any failure is swallowed
+   * so it never blocks or fails the subtask. Respects the subtask's privacy tier
+   * (a local-only subtask extracts on a local model too, never leaking to cloud).
+   */
+  async extractAndStoreFacts(db, assignment, output) {
+    try {
+      const prompt = `Extract durable project facts from this completed subtask.
+Return ONLY a JSON array of {"entity","relation","value"} triples describing lasting
+facts about the codebase/project \u2014 e.g. {"entity":"auth module","relation":"uses","value":"JWT"}.
+Ignore transient step-by-step details. At most 6 triples. If nothing durable, return [].
+
+Subtask: ${assignment.subtaskTitle}
+Output:
+${output.slice(0, 4e3)}`;
+      const result = await this.router.generate("T3", {
+        messages: [{ role: "user", content: prompt }],
+        maxTokens: 300,
+        temperature: 0,
+        ...this.localOnlyMatch ? { forceLocal: true } : {}
+      });
+      const match = /\[[\s\S]*\]/.exec(result.content);
+      if (!match) return;
+      const facts = JSON.parse(match[0]);
+      if (!Array.isArray(facts)) return;
+      for (const f of facts.slice(0, 8)) {
+        if (f && typeof f.entity === "string" && typeof f.relation === "string" && typeof f.value === "string") {
+          db.upsertFact(f.entity, f.relation, f.value, this.id);
+        }
+      }
+    } catch {
+    }
+  }
   async correctOutput(originalOutput, failures) {
     const correctionPrompt = `The following output failed these checks: ${failures.join(", ")}.
 
@@ -5796,10 +6010,24 @@ In 3-5 terse bullets, flag the most important RISKS, GAPS, or over-/under-decomp
   }
   async decomposeTask(prompt, systemContext) {
     const db = this.router.getWorldStateDB?.();
-    const worldStateContext = db ? `
+    let worldStateContext = "";
+    if (db) {
+      const knowledge = db.getFormattedKnowledge(prompt);
+      if (knowledge) {
+        worldStateContext = `
+
+PROJECT KNOWLEDGE (relevant facts about this codebase):
+${knowledge}`;
+      } else {
+        const log = db.getFormattedState();
+        if (log && log !== "World State is currently empty.") {
+          worldStateContext = `
 
 PROJECT WORLD STATE (Current architecture and recent changes):
-${db.getFormattedState()}` : "";
+${log}`;
+        }
+      }
+    }
     const contextSection = systemContext ? `
 Project context:
 ${systemContext}` : "";
@@ -8061,7 +8289,15 @@ var ToolsConfigSchema = zod.z.object({
   mcpServers: zod.z.array(McpServerConfigSchema).optional(),
   mcpTrusted: zod.z.array(zod.z.string()).optional(),
   /** Web search backends — at least one should be configured for best results */
-  webSearch: WebSearchConfigSchema.optional()
+  webSearch: WebSearchConfigSchema.optional(),
+  /**
+   * Sandbox runtime for LLM-authored dynamic tools:
+   * - 'isolate': hard V8 isolate (isolated-vm) — no Node globals, true capability
+   *   confinement. Requires the optional native `isolated-vm` dependency.
+   * - 'worker': node:worker_threads (resource/kill limits, but not capability-confined).
+   * - 'auto' (default): use the isolate when `isolated-vm` loads, else fall back to worker.
+   */
+  dynamicToolSandbox: zod.z.enum(["isolate", "worker", "auto"]).default("auto")
 });
 var HookDefinitionSchema = zod.z.object({
   name: zod.z.string().optional(),
@@ -8173,10 +8409,20 @@ var CascadeConfigSchema = zod.z.object({
   /**
    * Runtime Tool Creation: when true, T3 workers can generate and register new tools
    * at runtime via the ToolCreator when no existing tool can handle a required operation.
-   * Generated tools are session-scoped and sandboxed in node:vm.
+   * Generated tools are session-scoped and sandboxed (see tools.dynamicToolSandbox).
    * HTTP calls from generated tools require approval.
    */
   enableToolCreation: zod.z.boolean().default(true),
+  /**
+   * Project knowledge (world state). `factsExtraction`: after each worker
+   * completes, run a cheap extraction pass that distills its output into
+   * queryable entity/relation/value facts (superseding older facts), which T1
+   * queries during planning instead of replaying the whole linear log. Best-effort
+   * and non-blocking; set false to keep only the raw linear log.
+   */
+  knowledge: zod.z.object({
+    factsExtraction: zod.z.boolean().default(true)
+  }).default({}),
   /**
    * Persist runtime-generated tools to .cascade/dynamic-tools.json and reload them
    * on startup for cross-run dedup. Reloaded (and peer-received) tools are always
@@ -8469,13 +8715,17 @@ var TaskAnalyzer = class {
    * Scores tier-eligible models using cost efficiency + historical performance.
    * Falls back to the priority-list default when no candidates have history.
    */
-  async selectModel(prompt, tier, selector) {
+  async selectModel(prompt, tier, selector, opts) {
     const profile = await this.analyze(prompt);
     if (profile.requiresVision) {
       return selector.selectVisionModel();
     }
-    const candidates = selector.getCandidatesForTier(tier);
+    let candidates = selector.getCandidatesForTier(tier);
     if (candidates.length === 0) return selector.selectForTier(tier);
+    if (opts?.requiresToolUse) {
+      const toolCapable = candidates.filter((m) => m.supportsToolUse !== false);
+      if (toolCapable.length > 0) candidates = toolCapable;
+    }
     const scored = candidates.map((m) => ({
       model: m,
       score: this.scoreModel(m, profile)
@@ -8654,6 +8904,28 @@ var ModelPerformanceTracker = class {
     return Math.max(0.1, 1 - normalised * complexityWeight);
   }
 };
+var ivmCache;
+var ivmWarned = false;
+async function loadIsolatedVm() {
+  if (ivmCache !== void 0) return ivmCache;
+  try {
+    const specifier = "isolated-vm";
+    const mod = await import(specifier);
+    ivmCache = mod.default ?? mod;
+  } catch {
+    ivmCache = null;
+  }
+  return ivmCache;
+}
+function safeJsonParse(text) {
+  if (typeof text !== "string") return {};
+  try {
+    const v = JSON.parse(text);
+    return v && typeof v === "object" ? v : {};
+  } catch {
+    return {};
+  }
+}
 var DYNAMIC_TOOLS_FILE = "dynamic-tools.json";
 function normalizeToolSchema(schema) {
   if (schema && schema["type"] === "object" && typeof schema["properties"] === "object") {
@@ -8756,7 +9028,12 @@ var DynamicTool = class extends BaseTool {
   getEscalator;
   /** Untrusted = loaded from disk / a peer; its dangerous calls always re-prompt. */
   trusted;
-  constructor(spec, registry, getEscalator, trusted) {
+  /** Resolve the configured sandbox mode at call time (default 'auto'). */
+  getSandboxMode;
+  /** Optional diagnostics sink (routed through the host so it survives the Ink TUI). */
+  log;
+  constructor(spec, registry, getEscalator, trusted, getSandboxMode = () => "auto", log = () => {
+  }) {
     super();
     this.name = spec.name;
     this.description = spec.description;
@@ -8766,6 +9043,8 @@ var DynamicTool = class extends BaseTool {
     this.registry = registry;
     this.getEscalator = getEscalator;
     this.trusted = trusted;
+    this.getSandboxMode = getSandboxMode;
+    this.log = log;
   }
   isDangerous() {
     return this._isDangerous;
@@ -8802,8 +9081,94 @@ var DynamicTool = class extends BaseTool {
         return `Error calling ${toolName}: ${err instanceof Error ? err.message : String(err)}`;
       }
     };
+    const mode = this.getSandboxMode();
+    if (mode !== "worker") {
+      const ivm = await loadIsolatedVm();
+      if (ivm) return this.runInIsolate(ivm, input, callTool);
+      if (mode === "isolate" && !ivmWarned) {
+        ivmWarned = true;
+        this.log("[tool-creator] isolated-vm is not available (not installed or failed to build) \u2014 dynamic tools fall back to the worker sandbox, which is NOT capability-confined. Install isolated-vm for a hard isolate.");
+      }
+    }
     return this.runInWorker(input, callTool);
   }
+  /**
+   * Run the generated code in a hard V8 isolate (isolated-vm). The isolate global
+   * has no Node built-ins, so the code cannot see `process`, `require`, the
+   * filesystem, or the network — it reaches the host ONLY through the injected
+   * `callTool` (escalator-gated on the main thread) and `fetch` (SSRF-guarded via
+   * bridgeFetch). `script.run({ timeout })` bounds synchronous CPU; an outer
+   * wall-clock race + `isolate.dispose()` bounds async runaway (a never-resolving
+   * await), mirroring the worker's terminate().
+   */
+  async runInIsolate(ivm, input, callTool) {
+    const timeoutMs = Math.max(200, Number(process.env["CASCADE_DYNAMIC_TOOL_TIMEOUT_MS"]) || DYNAMIC_TOOL_TIMEOUT_MS);
+    const isolate = new ivm.Isolate({ memoryLimit: 128 });
+    let disposed = false;
+    const dispose = () => {
+      if (!disposed) {
+        disposed = true;
+        try {
+          isolate.dispose();
+        } catch {
+        }
+      }
+    };
+    try {
+      const context = await isolate.createContext();
+      const jail = context.global;
+      await jail.set("_callTool", new ivm.Reference(async (name, inputJson) => {
+        const out = await callTool(String(name), safeJsonParse(inputJson));
+        return String(out);
+      }));
+      await jail.set("_fetch", new ivm.Reference(async (url, initJson) => {
+        const r = await bridgeFetch(String(url), safeJsonParse(initJson));
+        return JSON.stringify(r);
+      }));
+      await jail.set("_input", new ivm.ExternalCopy(input).copyInto());
+      await jail.set("_code", this.executeCode);
+      const bootstrap = `
+        const callTool = (name, toolInput) => _callTool.apply(undefined,
+          [String(name), JSON.stringify(toolInput || {})],
+          { result: { promise: true }, arguments: { copy: true } });
+        const fetch = async (url, init) => {
+          const raw = await _fetch.apply(undefined,
+            [String(url), JSON.stringify(init || null)],
+            { result: { promise: true }, arguments: { copy: true } });
+          const r = JSON.parse(raw);
+          if (r && r.__error) throw new Error(r.__error);
+          return {
+            ok: r.ok, status: r.status, statusText: r.statusText,
+            headers: { get: (k) => (String(k).toLowerCase() === 'content-type' ? r.contentType : null) },
+            text: async () => r.body,
+            json: async () => JSON.parse(r.body),
+          };
+        };
+        const console = { log() {}, error() {} };
+        const AsyncFunction = Object.getPrototypeOf(async function () {}).constructor;
+        const fn = new AsyncFunction('input', 'callTool', 'fetch', 'console', _code);
+        (async () => { const r = await fn(_input, callTool, fetch, console); return String(r == null ? '' : r); })();
+      `;
+      const script = await isolate.compileScript(bootstrap);
+      const runPromise = script.run(context, { timeout: timeoutMs, promise: true }).then((v) => String(v ?? ""));
+      const timeoutPromise = new Promise((resolve) => {
+        const t = setTimeout(() => {
+          dispose();
+          resolve(`Dynamic tool "${this.name}" timed out after ${timeoutMs}ms and was terminated.`);
+        }, timeoutMs + 500);
+        t.unref?.();
+      });
+      return await Promise.race([runPromise, timeoutPromise]);
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      if (/timed? out/i.test(msg)) {
+        return `Dynamic tool "${this.name}" timed out after ${timeoutMs}ms and was terminated.`;
+      }
+      return `Tool error: ${msg}`;
+    } finally {
+      dispose();
+    }
+  }
   /** Spawn the worker, service its callTool/fetch bridge, enforce the kill timeout. */
   runInWorker(input, callTool) {
     const timeoutMs = Math.max(200, Number(process.env["CASCADE_DYNAMIC_TOOL_TIMEOUT_MS"]) || DYNAMIC_TOOL_TIMEOUT_MS);
@@ -8883,16 +9248,19 @@ var ToolCreator = class {
   workspacePath;
   /** When false, persisted tools are neither loaded nor written. */
   persistEnabled;
+  /** Sandbox runtime for generated tools; passed to each DynamicTool. */
+  sandboxMode;
   logger;
   /** name → spec, for persistence, broadcast, and re-registration. */
   specs = /* @__PURE__ */ new Map();
   /** capability fingerprint → tool name, so the same need isn't re-generated. */
   capabilityIndex = /* @__PURE__ */ new Map();
-  constructor(router, registry, workspacePath, persistEnabled = true) {
+  constructor(router, registry, workspacePath, persistEnabled = true, sandboxMode = "auto") {
     this.router = router;
     this.registry = registry;
     this.workspacePath = workspacePath;
     this.persistEnabled = persistEnabled;
+    this.sandboxMode = sandboxMode;
   }
   setPermissionEscalator(escalator) {
     this.escalator = escalator;
@@ -8980,7 +9348,14 @@ Required capability: ${description.slice(0, 300)}`;
       this.specs.set(spec.name, spec);
       return;
     }
-    const tool = new DynamicTool(spec, this.registry, () => this.escalator, trusted);
+    const tool = new DynamicTool(
+      spec,
+      this.registry,
+      () => this.escalator,
+      trusted,
+      () => this.sandboxMode,
+      (msg) => this.log(msg)
+    );
     this.registry.register(tool);
     this.specs.set(spec.name, spec);
     this.capabilityIndex.set(capabilityKey(`${spec.description}`), spec.name);
@@ -9029,6 +9404,9 @@ Required capability: ${description.slice(0, 300)}`;
     return Array.from(this.specs.keys());
   }
 };
+function normalizeKey(text) {
+  return text.trim().toLowerCase().replace(/\s+/g, " ");
+}
 var WorldStateDB = class {
   constructor(workspacePath, debugMode = false) {
     this.workspacePath = workspacePath;
@@ -9050,6 +9428,16 @@ var WorldStateDB = class {
         encrypted_payload TEXT NOT NULL
       )
     `);
+    this.db.exec(`
+      CREATE TABLE IF NOT EXISTS facts (
+        entity TEXT NOT NULL,
+        relation TEXT NOT NULL,
+        encrypted_value TEXT NOT NULL,
+        source_worker TEXT NOT NULL,
+        timestamp TEXT NOT NULL,
+        PRIMARY KEY (entity, relation)
+      )
+    `);
   }
   workspacePath;
   debugMode;
@@ -9123,6 +9511,131 @@ var WorldStateDB = class {
     if (entries.length === 0) return "World State is currently empty.";
     return entries.map((e, idx) => `[${e.timestamp}] Step ${idx + 1} (${e.workerId}): ${e.summary}`).join("\n");
   }
+  // ── world-state v2: queryable facts ──────────────
+  /**
+   * Upsert a fact. `(entity, relation)` is normalized so casing/whitespace don't
+   * fragment the key; an existing pair is superseded (value + provenance updated)
+   * rather than duplicated. Empty entity/relation/value are ignored.
+   */
+  upsertFact(entity, relation, value, sourceWorker, timestamp) {
+    const e = normalizeKey(entity);
+    const r = normalizeKey(relation);
+    const v = value.trim();
+    if (!e || !r || !v) return;
+    const encrypted = this.encrypt(JSON.stringify({ value: v }));
+    const stmt = this.db.prepare(`
+      INSERT INTO facts (entity, relation, encrypted_value, source_worker, timestamp)
+      VALUES (?, ?, ?, ?, ?)
+      ON CONFLICT(entity, relation) DO UPDATE SET
+        encrypted_value = excluded.encrypted_value,
+        source_worker   = excluded.source_worker,
+        timestamp       = excluded.timestamp
+    `);
+    stmt.run(e, r, encrypted, sourceWorker, timestamp ?? (/* @__PURE__ */ new Date()).toISOString());
+    this.dumpDebugIfNeeded();
+  }
+  rowToFact(row) {
+    let value;
+    try {
+      value = JSON.parse(this.decrypt(row.encrypted_value)).value;
+    } catch {
+      value = "[Decryption Failed - Payload Corrupted]";
+    }
+    return { entity: row.entity, relation: row.relation, value, sourceWorker: row.source_worker, timestamp: row.timestamp };
+  }
+  /** All facts whose entity matches one of the (normalized) query entities. */
+  getFactsForEntities(entities) {
+    const keys = Array.from(new Set(entities.map(normalizeKey).filter(Boolean)));
+    if (keys.length === 0) return [];
+    const placeholders = keys.map(() => "?").join(", ");
+    const stmt = this.db.prepare(
+      `SELECT entity, relation, encrypted_value, source_worker, timestamp FROM facts WHERE entity IN (${placeholders}) ORDER BY entity ASC, relation ASC`
+    );
+    return stmt.all(...keys).map((row) => this.rowToFact(row));
+  }
+  /** Every fact (used for tests / debug / whole-graph views). */
+  getAllFacts() {
+    const stmt = this.db.prepare("SELECT entity, relation, encrypted_value, source_worker, timestamp FROM facts ORDER BY entity ASC, relation ASC");
+    return stmt.all().map((row) => this.rowToFact(row));
+  }
+  /**
+   * A compact, human/LLM-readable fact block for T1/T2 planning. When `entities`
+   * is given, only facts about those entities are included; otherwise all facts.
+   * Returns '' when there are none so callers can fall back to the linear log.
+   */
+  getFormattedFacts(entities) {
+    const facts = entities && entities.length > 0 ? this.getFactsForEntities(entities) : this.getAllFacts();
+    if (facts.length === 0) return "";
+    return facts.map((f) => `- ${f.entity} ${f.relation} ${f.value}`).join("\n");
+  }
+  /**
+   * A compact knowledge block for T1/T2 planning. When `prompt` is given, facts
+   * whose entity/relation/value mention a prompt token are preferred (relevance
+   * filter); otherwise, or when nothing matches, all facts are used (capped at
+   * `limit`). Returns '' when there are no facts, so the caller can fall back to
+   * the raw linear log — this replaces replaying the whole log during planning.
+   */
+  getFormattedKnowledge(prompt, limit = 40) {
+    const all = this.getAllFacts();
+    if (all.length === 0) return "";
+    let selected = all;
+    if (prompt && prompt.trim()) {
+      const tokens = Array.from(new Set(prompt.toLowerCase().match(/[a-z0-9_./-]{3,}/g) ?? []));
+      if (tokens.length > 0) {
+        const matched = all.filter((f) => {
+          const hay = `${f.entity} ${f.relation} ${f.value}`.toLowerCase();
+          return tokens.some((t) => hay.includes(t));
+        });
+        if (matched.length > 0) selected = matched;
+      }
+    }
+    return selected.slice(0, limit).map((f) => `- ${f.entity} ${f.relation} ${f.value}`).join("\n");
+  }
+  // ── Export / Import ──────────────────────────
+  //
+  //  Knowledge travels DECRYPTED in the export bundle (a portable plaintext
+  //  JSON file — the encryption key never leaves this machine) and re-encrypts
+  //  with the LOCAL key on import.
+  exportKnowledge() {
+    return { facts: this.getAllFacts(), worldLog: this.getAllEntries() };
+  }
+  /**
+   * Merge imported knowledge. Facts upsert on (entity, relation) with
+   * newer-timestamp-wins (a local fact newer than the imported one is kept);
+   * log entries append with fresh ids, skipping exact duplicates
+   * (worker + timestamp + summary). Returns counts of what actually landed.
+   */
+  importKnowledge(data) {
+    let facts = 0;
+    let logEntries = 0;
+    if (Array.isArray(data.facts)) {
+      const local = new Map(this.getAllFacts().map((f) => [`${f.entity}\0${f.relation}`, f.timestamp]));
+      for (const f of data.facts) {
+        if (!f || typeof f.entity !== "string" || typeof f.relation !== "string" || typeof f.value !== "string") continue;
+        const key = `${normalizeKey(f.entity)}\0${normalizeKey(f.relation)}`;
+        const localTs = local.get(key);
+        const importTs = f.timestamp ?? (/* @__PURE__ */ new Date()).toISOString();
+        if (localTs && localTs >= importTs) continue;
+        this.upsertFact(f.entity, f.relation, f.value, f.sourceWorker ?? "imported", importTs);
+        facts++;
+      }
+    }
+    if (Array.isArray(data.worldLog)) {
+      const seen = new Set(this.getAllEntries().map((e) => `${e.workerId}\0${e.timestamp}\0${e.summary}`));
+      const stmt = this.db.prepare("INSERT INTO world_state (id, timestamp, worker_id, encrypted_payload) VALUES (?, ?, ?, ?)");
+      for (const e of data.worldLog) {
+        if (!e || typeof e.summary !== "string") continue;
+        const workerId = e.workerId ?? "imported";
+        const timestamp = e.timestamp ?? (/* @__PURE__ */ new Date()).toISOString();
+        const key = `${workerId}\0${timestamp}\0${e.summary}`;
+        if (seen.has(key)) continue;
+        stmt.run(crypto3__default.default.randomUUID(), timestamp, workerId, this.encrypt(JSON.stringify({ summary: e.summary })));
+        seen.add(key);
+        logEntries++;
+      }
+    }
+    return { facts, logEntries };
+  }
   dumpDebugIfNeeded() {
     if (!this.debugMode) return;
     try {
@@ -9259,7 +9772,8 @@ var Cascade = class _Cascade extends EventEmitter__default.default {
     }
     const cfg = this.config;
     if (cfg["enableToolCreation"] === true) {
-      this.toolCreator = new ToolCreator(this.router, this.toolRegistry, this.workspacePath, cfg["persistDynamicTools"] !== false);
+      const sandboxMode = this.config.tools?.dynamicToolSandbox ?? "auto";
+      this.toolCreator = new ToolCreator(this.router, this.toolRegistry, this.workspacePath, cfg["persistDynamicTools"] !== false, sandboxMode);
       this.toolCreator.setLogger((m) => {
         if (this.listenerCount("log") > 0) this.emit("log", { level: "info", message: m });
       });
@@ -9497,6 +10011,10 @@ ${last.partialOutput}` : "");
         this.router.profileModels(this.store).catch(() => {
         });
       }
+      if (this.store) {
+        this.router.probeLocalToolSupport(this.store).catch(() => {
+        });
+      }
       if (this.config.cascadeAuto) {
         this.router.refreshLiveData().catch(() => {
         });
@@ -10568,6 +11086,78 @@ Original error: ${err.message}`
     `).all(`%${query}%`, limit);
     return rows.map(this.deserializeMessage);
   }
+  // ── Export / Import ──────────────────────────
+  //
+  //  Chats travel as full Session objects (messages included) inside a
+  //  plaintext-JSON bundle. Import NEVER overwrites: every imported session
+  //  gets a fresh id (title suffixed "(imported)") and fresh message ids, so
+  //  re-importing the same bundle can duplicate but can never clobber.
+  /** Full sessions (with messages) for the given ids, or ALL sessions. */
+  exportSessions(ids) {
+    const targets = ids && ids.length > 0 ? ids : this.db.prepare("SELECT id FROM sessions ORDER BY updated_at DESC").all().map((r) => r.id);
+    const out = [];
+    for (const id of targets) {
+      const s = this.getSession(id);
+      if (s) out.push(s);
+    }
+    return out;
+  }
+  /**
+   * Import sessions from a bundle. Returns the created `{id, title}` rows so
+   * the caller can mirror them into the runtime session list (the sidebar
+   * reads runtime_sessions, not sessions). Malformed entries are skipped.
+   */
+  importSessions(sessions) {
+    const out = [];
+    const msgStmt = this.db.prepare(`
+      INSERT INTO messages (id, session_id, role, content, timestamp, tokens, agent_messages)
+      VALUES (?, ?, ?, ?, ?, ?, ?)
+    `);
+    for (const s of sessions) {
+      if (!s || typeof s !== "object") continue;
+      const newId = crypto3.randomUUID();
+      const now = (/* @__PURE__ */ new Date()).toISOString();
+      const title = `${String(s.title || "Untitled").slice(0, 200)} (imported)`;
+      const metadata = s.metadata && typeof s.metadata === "object" ? s.metadata : { totalTokens: 0, totalCostUsd: 0, modelsUsed: [], toolsUsed: [], taskCount: 0 };
+      this.db.prepare(`
+        INSERT INTO sessions (id, title, created_at, updated_at, identity_id, workspace_path, metadata)
+        VALUES (?, ?, ?, ?, ?, ?, ?)
+      `).run(newId, title, s.createdAt ?? now, s.updatedAt ?? now, s.identityId ?? "default", s.workspacePath ?? "", JSON.stringify(metadata));
+      for (const m of Array.isArray(s.messages) ? s.messages : []) {
+        if (!m || m.role !== "user" && m.role !== "assistant" && m.role !== "system") continue;
+        msgStmt.run(
+          crypto3.randomUUID(),
+          newId,
+          m.role,
+          typeof m.content === "string" ? m.content : JSON.stringify(m.content),
+          m.timestamp ?? now,
+          m.tokens ? JSON.stringify(m.tokens) : null,
+          m.agentMessages ? JSON.stringify(m.agentMessages) : null
+        );
+      }
+      out.push({ id: newId, title });
+    }
+    return out;
+  }
+  /** Import identities/personas, deduped by (case-insensitive) name — an
+   *  existing name is skipped, never replaced. Imports are never the default. */
+  importIdentities(identities) {
+    const existing = new Set(this.listIdentities().map((i) => i.name.toLowerCase()));
+    let imported = 0;
+    for (const ident of identities ?? []) {
+      if (!ident?.name || typeof ident.name !== "string") continue;
+      if (existing.has(ident.name.toLowerCase())) continue;
+      this.createIdentity({
+        ...ident,
+        id: crypto3.randomUUID(),
+        isDefault: false,
+        createdAt: ident.createdAt ?? (/* @__PURE__ */ new Date()).toISOString()
+      });
+      existing.add(ident.name.toLowerCase());
+      imported++;
+    }
+    return imported;
+  }
   // ── Identities ────────────────────────────────
   createIdentity(identity) {
     this.db.prepare(`
@@ -10745,6 +11335,23 @@ Original error: ${err.message}`
     const row = this.db.prepare("SELECT metadata FROM model_cache WHERE id = ?").get(`${provider}:${modelId}`);
     return row ? JSON.parse(row.metadata) : void 0;
   }
+  /**
+   * Persist a probed capability verdict (currently: native tool support) into
+   * the model's cached profile, merging with whatever is already recorded.
+   * Read back via getModelProfile — so a model is probed once ever, not once
+   * per run.
+   */
+  saveModelCapability(modelId, provider, caps) {
+    const cacheKey = `${provider}:${modelId}`;
+    const existing = this.db.prepare("SELECT metadata FROM model_cache WHERE id = ?").get(cacheKey);
+    const meta = existing ? JSON.parse(existing.metadata) : { id: modelId, provider, name: modelId, contextWindow: 0, isVisionCapable: false, inputCostPer1kTokens: 0, outputCostPer1kTokens: 0, maxOutputTokens: 0, supportsStreaming: false, isLocal: false };
+    if (caps.supportsToolUse !== void 0) meta.supportsToolUse = caps.supportsToolUse;
+    this.db.prepare(`
+      INSERT INTO model_cache (id, provider, model_id, name, metadata, updated_at)
+      VALUES (?, ?, ?, ?, ?, ?)
+      ON CONFLICT(id) DO UPDATE SET metadata = excluded.metadata, updated_at = excluded.updated_at
+    `).run(cacheKey, provider, modelId, meta.name ?? modelId, JSON.stringify(meta), (/* @__PURE__ */ new Date()).toISOString());
+  }
   getProfiledModelIds() {
     const rows = this.db.prepare(
       "SELECT model_id FROM model_cache WHERE json_extract(metadata, '$.specializations') IS NOT NULL"
@@ -11904,6 +12511,60 @@ ${prompt}`;
       this.socket.broadcast("runtime:refresh", { scope: "global" });
       res.json({ ok: true });
     });
+    this.app.get("/api/export", auth, (req, res) => {
+      try {
+        const sessionsParam = typeof req.query["sessions"] === "string" ? req.query["sessions"] : "all";
+        const includeMemories = req.query["memories"] === "1" || req.query["memories"] === "true";
+        const ids = sessionsParam === "all" ? void 0 : sessionsParam.split(",").map((s) => s.trim()).filter(Boolean);
+        const bundle = {
+          format: "cascade-export@1",
+          exportedAt: (/* @__PURE__ */ new Date()).toISOString(),
+          sessions: this.store.exportSessions(ids)
+        };
+        if (includeMemories) {
+          const ws = new WorldStateDB(this.workspacePath);
+          try {
+            bundle["memories"] = { ...ws.exportKnowledge(), identities: this.store.listIdentities() };
+          } finally {
+            ws.close();
+          }
+        }
+        res.json(bundle);
+      } catch (err) {
+        res.status(500).json({ error: err instanceof Error ? err.message : String(err) });
+      }
+    });
+    this.app.post("/api/import", auth, mutationLimiter, (req, res) => {
+      try {
+        const bundle = req.body;
+        if (!bundle || bundle.format !== "cascade-export@1") {
+          res.status(400).json({ error: "Not a cascade-export@1 bundle." });
+          return;
+        }
+        const importedSessions = Array.isArray(bundle.sessions) ? this.store.importSessions(bundle.sessions) : [];
+        for (const s of importedSessions) this.persistRuntimeRow(s.id, s.title, "COMPLETED");
+        let facts = 0;
+        let logEntries = 0;
+        let identities = 0;
+        if (bundle.memories) {
+          const ws = new WorldStateDB(this.workspacePath);
+          try {
+            const counts = ws.importKnowledge(bundle.memories);
+            facts = counts.facts;
+            logEntries = counts.logEntries;
+          } finally {
+            ws.close();
+          }
+          if (Array.isArray(bundle.memories.identities)) {
+            identities = this.store.importIdentities(bundle.memories.identities);
+          }
+        }
+        this.socket.broadcast("runtime:refresh", { scope: "workspace" });
+        res.json({ ok: true, imported: { sessions: importedSessions.length, facts, logEntries, identities } });
+      } catch (err) {
+        res.status(500).json({ error: err instanceof Error ? err.message : String(err) });
+      }
+    });
     this.app.post("/api/sessions/:id/rollback", auth, mutationLimiter, async (req, res) => {
       const sessionId = req.params.id;
       const taskIds = this.sessionTaskIds.get(sessionId) ?? [];