cascade-ai 0.16.0 → 0.18.0

package/dist/index.cjs

@@ -1,8 +1,8 @@
 'use strict';
 
 var Database = require('better-sqlite3');
-var path20 = require('path');
-var fs19 = require('fs');
+var path21 = require('path');
+var fs20 = require('fs');
 var os6 = require('os');
 var crypto3 = require('crypto');
 var EventEmitter = require('events');
@@ -58,8 +58,8 @@ function _interopNamespace(e) {
 }
 
 var Database__default = /*#__PURE__*/_interopDefault(Database);
-var path20__default = /*#__PURE__*/_interopDefault(path20);
-var fs19__default = /*#__PURE__*/_interopDefault(fs19);
+var path21__default = /*#__PURE__*/_interopDefault(path21);
+var fs20__default = /*#__PURE__*/_interopDefault(fs20);
 var os6__default = /*#__PURE__*/_interopDefault(os6);
 var crypto3__default = /*#__PURE__*/_interopDefault(crypto3);
 var EventEmitter__default = /*#__PURE__*/_interopDefault(EventEmitter);
@@ -104,12 +104,12 @@ var init_audit_logger = __esm({
       constructor(workspacePath, debugMode = false) {
         this.workspacePath = workspacePath;
         this.debugMode = debugMode;
-        const cascadeDir = path20__default.default.join(workspacePath, ".cascade");
-        if (!fs19__default.default.existsSync(cascadeDir)) {
-          fs19__default.default.mkdirSync(cascadeDir, { recursive: true });
+        const cascadeDir = path21__default.default.join(workspacePath, ".cascade");
+        if (!fs20__default.default.existsSync(cascadeDir)) {
+          fs20__default.default.mkdirSync(cascadeDir, { recursive: true });
         }
-        this.keyPath = path20__default.default.join(cascadeDir, "audit_log.key");
-        this.dbPath = path20__default.default.join(cascadeDir, "audit_log.db");
+        this.keyPath = path21__default.default.join(cascadeDir, "audit_log.key");
+        this.dbPath = path21__default.default.join(cascadeDir, "audit_log.db");
         this.initEncryptionKey();
         this.db = new Database__default.default(this.dbPath);
         this.db.pragma("journal_mode = WAL");
@@ -139,11 +139,11 @@ var init_audit_logger = __esm({
         return crypto3__default.default.createHash("sha256").update(`${prevHash}|${timestamp}|${eventType}|${tierId}|${encryptedPayload}`).digest("hex");
       }
       initEncryptionKey() {
-        if (fs19__default.default.existsSync(this.keyPath)) {
-          this.encryptionKey = fs19__default.default.readFileSync(this.keyPath);
+        if (fs20__default.default.existsSync(this.keyPath)) {
+          this.encryptionKey = fs20__default.default.readFileSync(this.keyPath);
         } else {
           this.encryptionKey = crypto3__default.default.randomBytes(32);
-          fs19__default.default.writeFileSync(this.keyPath, this.encryptionKey);
+          fs20__default.default.writeFileSync(this.keyPath, this.encryptionKey);
         }
       }
       encrypt(text) {
@@ -221,9 +221,9 @@ var init_audit_logger = __esm({
       dumpDebugIfNeeded() {
         if (!this.debugMode) return;
         try {
-          const dumpPath = path20__default.default.join(os6__default.default.tmpdir(), "cascade_audit_logs_debug.json");
+          const dumpPath = path21__default.default.join(os6__default.default.tmpdir(), "cascade_audit_logs_debug.json");
           const entries = this.getAllLogs();
-          fs19__default.default.writeFileSync(dumpPath, JSON.stringify(entries, null, 2), "utf-8");
+          fs20__default.default.writeFileSync(dumpPath, JSON.stringify(entries, null, 2), "utf-8");
         } catch (err) {
           console.error("Failed to dump debug audit logs", err);
         }
@@ -236,7 +236,7 @@ var init_audit_logger = __esm({
 });
 
 // src/constants.ts
-var CASCADE_VERSION = "0.16.0";
+var CASCADE_VERSION = "0.18.0";
 var CASCADE_CONFIG_DIR = ".cascade";
 var CASCADE_MD_FILE = "CASCADE.md";
 var CASCADE_IGNORE_FILE = ".cascadeignore";
@@ -248,6 +248,7 @@ var CASCADE_DASHBOARD_SECRET_FILE = ".cascade/dashboard-secret";
 var GLOBAL_CONFIG_DIR = ".cascade-ai";
 var GLOBAL_DB_FILE = "memory.db";
 var GLOBAL_KEYSTORE_FILE = "keystore.enc";
+var GLOBAL_CREDENTIALS_FILE = "credentials.json";
 var GLOBAL_RUNTIME_DB_FILE = "runtime.db";
 var DEFAULT_DASHBOARD_PORT = 4891;
 var DEFAULT_API_PORT = 4892;
@@ -2210,7 +2211,7 @@ function computeDelegationSavings(stats, t1Model) {
 var DEFAULT_SNAPSHOT_URL = "https://raw.githubusercontent.com/Varun-SV/Cascade-AI/main/src/core/router/benchmark-data.json";
 var OPENROUTER_MODELS_URL = "https://openrouter.ai/api/v1/models";
 var FETCH_TIMEOUT_MS = 8e3;
-var DEFAULT_CACHE_FILE = path20__default.default.join(os6__default.default.homedir(), GLOBAL_CONFIG_DIR, "benchmarks-cache.json");
+var DEFAULT_CACHE_FILE = path21__default.default.join(os6__default.default.homedir(), GLOBAL_CONFIG_DIR, "benchmarks-cache.json");
 function normalizeModelId(id) {
   let s = id.toLowerCase();
   const slash = s.lastIndexOf("/");
@@ -2355,7 +2356,7 @@ var LiveDataProvider = class {
   }
   async saveCache() {
     try {
-      await fs4__default.default.mkdir(path20__default.default.dirname(this.opts.cacheFile), { recursive: true });
+      await fs4__default.default.mkdir(path21__default.default.dirname(this.opts.cacheFile), { recursive: true });
       const cache = {
         fetchedAt: this.fetchedAt,
         snapshot: this.snapshot ?? void 0,
@@ -4258,8 +4259,8 @@ HIERARCHY CONTEXT: ${this.hierarchyContext}` : "") + textToolSuffix,
         tierId: this.id,
         sessionId: this.taskId,
         requireApproval: false,
-        saveSnapshot: async (path21, content) => {
-          this.store?.addFileSnapshot(this.taskId, path21, content);
+        saveSnapshot: async (path22, content) => {
+          this.store?.addFileSnapshot(this.taskId, path22, content);
         },
         sendPeerSync: (to, syncType, content) => {
           this.peerBus?.send(this.id, to, syncType, this.assignment?.subtaskId ?? "", content);
@@ -4429,7 +4430,7 @@ ${assignment.expectedOutput}`;
     const { promisify: promisify4 } = await import('util');
     const execAsync2 = promisify4(exec2);
     for (const artifactPath of artifactPaths) {
-      const absolutePath = path20__default.default.resolve(process.cwd(), artifactPath);
+      const absolutePath = path21__default.default.resolve(process.cwd(), artifactPath);
       try {
         const stat = await fs4__default.default.stat(absolutePath);
         if (!stat.isFile()) {
@@ -4450,7 +4451,7 @@ ${assignment.expectedOutput}`;
           issues.push(`PDF artifact looks too small to be valid: ${artifactPath}`);
           continue;
         }
-        const ext = path20__default.default.extname(absolutePath).toLowerCase();
+        const ext = path21__default.default.extname(absolutePath).toLowerCase();
         try {
           if (ext === ".ts" || ext === ".tsx") {
             await execAsync2(`npx tsc --noEmit ${absolutePath}`, { timeout: 1e4 });
@@ -6532,16 +6533,16 @@ function resolveInWorkspace(workspaceRoot, input) {
   if (typeof input !== "string" || input.length === 0) {
     throw new WorkspaceSandboxError(String(input), workspaceRoot);
   }
-  const root = path20__default.default.resolve(workspaceRoot);
-  const abs = path20__default.default.isAbsolute(input) ? path20__default.default.resolve(input) : path20__default.default.resolve(root, input);
-  const rel = path20__default.default.relative(root, abs);
-  if (rel === "" || rel === ".") ; else if (rel.startsWith("..") || path20__default.default.isAbsolute(rel)) {
+  const root = path21__default.default.resolve(workspaceRoot);
+  const abs = path21__default.default.isAbsolute(input) ? path21__default.default.resolve(input) : path21__default.default.resolve(root, input);
+  const rel = path21__default.default.relative(root, abs);
+  if (rel === "" || rel === ".") ; else if (rel.startsWith("..") || path21__default.default.isAbsolute(rel)) {
     throw new WorkspaceSandboxError(input, root);
   }
   try {
-    const real = fs19__default.default.realpathSync(abs);
-    const realRel = path20__default.default.relative(root, real);
-    if (realRel !== "" && realRel !== "." && (realRel.startsWith("..") || path20__default.default.isAbsolute(realRel))) {
+    const real = fs20__default.default.realpathSync(abs);
+    const realRel = path21__default.default.relative(root, real);
+    if (realRel !== "" && realRel !== "." && (realRel.startsWith("..") || path21__default.default.isAbsolute(realRel))) {
       throw new WorkspaceSandboxError(input, root);
     }
   } catch (e) {
@@ -6602,7 +6603,7 @@ var FileWriteTool = class extends BaseTool {
       } catch {
       }
     }
-    await fs4__default.default.mkdir(path20__default.default.dirname(absPath), { recursive: true });
+    await fs4__default.default.mkdir(path21__default.default.dirname(absPath), { recursive: true });
     await fs4__default.default.writeFile(absPath, content, "utf-8");
     return `Written ${content.length} characters to ${filePath}`;
   }
@@ -7100,7 +7101,7 @@ var ImageAnalyzeTool = class extends BaseTool {
 };
 async function fileToImageAttachment(filePath) {
   const data = await fs4__default.default.readFile(filePath);
-  const ext = path20__default.default.extname(filePath).toLowerCase();
+  const ext = path21__default.default.extname(filePath).toLowerCase();
   const mimeMap = {
     ".jpg": "image/jpeg",
     ".jpeg": "image/jpeg",
@@ -7134,14 +7135,14 @@ var PDFCreateTool = class extends BaseTool {
     const filePath = input["path"];
     const content = input["content"];
     const title = input["title"];
-    const dir = path20__default.default.dirname(filePath);
-    if (!fs19__default.default.existsSync(dir)) {
-      fs19__default.default.mkdirSync(dir, { recursive: true });
+    const dir = path21__default.default.dirname(filePath);
+    if (!fs20__default.default.existsSync(dir)) {
+      fs20__default.default.mkdirSync(dir, { recursive: true });
     }
     return new Promise((resolve, reject) => {
       try {
         const doc = new PDFDocument__default.default({ margin: 50 });
-        const stream = fs19__default.default.createWriteStream(filePath);
+        const stream = fs20__default.default.createWriteStream(filePath);
         doc.pipe(stream);
         if (title) {
           doc.info["Title"] = title;
@@ -7219,22 +7220,22 @@ var CodeInterpreterTool = class extends BaseTool {
       }
       cmdPrefix = NODE_CMD;
     }
-    const tmpDir = path20__default.default.join(this.workspaceRoot, ".cascade", "tmp");
-    if (!fs19__default.default.existsSync(tmpDir)) {
-      fs19__default.default.mkdirSync(tmpDir, { recursive: true });
+    const tmpDir = path21__default.default.join(this.workspaceRoot, ".cascade", "tmp");
+    if (!fs20__default.default.existsSync(tmpDir)) {
+      fs20__default.default.mkdirSync(tmpDir, { recursive: true });
     }
     const extension = language === "python" ? "py" : "js";
     const fileName = `intp_${crypto3.randomUUID().slice(0, 8)}.${extension}`;
-    const filePath = path20__default.default.join(tmpDir, fileName);
-    fs19__default.default.writeFileSync(filePath, code, "utf-8");
+    const filePath = path21__default.default.join(tmpDir, fileName);
+    fs20__default.default.writeFileSync(filePath, code, "utf-8");
     const execArgs = [filePath, ...args];
     return new Promise((resolve) => {
       const startMs = Date.now();
       child_process.execFile(cmdPrefix, execArgs, { cwd: this.workspaceRoot, timeout: 3e4 }, (error, stdout, stderr) => {
         const duration = Date.now() - startMs;
         try {
-          if (fs19__default.default.existsSync(filePath)) {
-            fs19__default.default.unlinkSync(filePath);
+          if (fs20__default.default.existsSync(filePath)) {
+            fs20__default.default.unlinkSync(filePath);
           }
         } catch (cleanupErr) {
           console.error(`Failed to cleanup interpreter script ${filePath}:`, cleanupErr);
@@ -7513,7 +7514,7 @@ var GlobTool = class extends BaseTool {
   };
   async execute(input, _options) {
     const pattern = input["pattern"];
-    const searchPath = input["path"] ? path20__default.default.resolve(this.workspaceRoot, input["path"]) : this.workspaceRoot;
+    const searchPath = input["path"] ? path21__default.default.resolve(this.workspaceRoot, input["path"]) : this.workspaceRoot;
     const matches = await glob.glob(pattern, {
       cwd: searchPath,
       ignore: ["node_modules/**", ".git/**", "dist/**", "build/**"],
@@ -7526,7 +7527,7 @@ var GlobTool = class extends BaseTool {
     const withMtime = await Promise.all(
       matches.map(async (rel) => {
         try {
-          const stat = await fs4__default.default.stat(path20__default.default.join(searchPath, rel));
+          const stat = await fs4__default.default.stat(path21__default.default.join(searchPath, rel));
           return { rel, mtime: stat.mtimeMs };
         } catch {
           return { rel, mtime: 0 };
@@ -7575,7 +7576,7 @@ var GrepTool = class extends BaseTool {
   };
   async execute(input, _options) {
     const pattern = input["pattern"];
-    const searchPath = input["path"] ? path20__default.default.resolve(this.workspaceRoot, input["path"]) : this.workspaceRoot;
+    const searchPath = input["path"] ? path21__default.default.resolve(this.workspaceRoot, input["path"]) : this.workspaceRoot;
     const globPattern = input["glob"];
     const outputMode = input["output_mode"] ?? "content";
     const context = input["context"] ?? 0;
@@ -7629,12 +7630,12 @@ var GrepTool = class extends BaseTool {
         nodir: true
       });
     } catch {
-      files = [path20__default.default.relative(searchPath, searchPath) || "."];
+      files = [path21__default.default.relative(searchPath, searchPath) || "."];
     }
     const results = [];
     let totalCount = 0;
     for (const rel of files) {
-      const abs = path20__default.default.join(searchPath, rel);
+      const abs = path21__default.default.join(searchPath, rel);
       let content;
       try {
         content = await fs4__default.default.readFile(abs, "utf-8");
@@ -7996,10 +7997,10 @@ var ToolRegistry = class extends EventEmitter__default.default {
   }
   isIgnored(filePath) {
     if (!filePath) return false;
-    const abs = path20__default.default.resolve(this.workspaceRoot, filePath);
-    const rel = path20__default.default.relative(this.workspaceRoot, abs);
-    if (!rel || rel.startsWith("..") || path20__default.default.isAbsolute(rel)) return true;
-    const posixRel = rel.split(path20__default.default.sep).join("/");
+    const abs = path21__default.default.resolve(this.workspaceRoot, filePath);
+    const rel = path21__default.default.relative(this.workspaceRoot, abs);
+    if (!rel || rel.startsWith("..") || path21__default.default.isAbsolute(rel)) return true;
+    const posixRel = rel.split(path21__default.default.sep).join("/");
     return this.ignoreMatcher.ignores(posixRel);
   }
 };
@@ -8833,7 +8834,7 @@ var TaskAnalyzer = class {
     analysisCache.clear();
   }
 };
-var DEFAULT_STATS_FILE = path20__default.default.join(os6__default.default.homedir(), ".cascade", "model-perf.json");
+var DEFAULT_STATS_FILE = path21__default.default.join(os6__default.default.homedir(), ".cascade", "model-perf.json");
 var ModelPerformanceTracker = class {
   stats = /* @__PURE__ */ new Map();
   featureStats = /* @__PURE__ */ new Map();
@@ -8865,7 +8866,7 @@ var ModelPerformanceTracker = class {
   }
   async save() {
     try {
-      await fs4__default.default.mkdir(path20__default.default.dirname(this.statsFile), { recursive: true });
+      await fs4__default.default.mkdir(path21__default.default.dirname(this.statsFile), { recursive: true });
       const modelsObj = {};
       const featuresObj = {};
       for (const [key, stat] of this.stats) modelsObj[key] = stat;
@@ -9404,7 +9405,7 @@ Required capability: ${description.slice(0, 300)}`;
    *  any dangerous action, so a silently-reloaded tool can't act without approval. */
   async loadPersistedTools() {
     if (!this.workspacePath || !this.persistEnabled) return;
-    const file = path20__default.default.join(this.workspacePath, ".cascade", DYNAMIC_TOOLS_FILE);
+    const file = path21__default.default.join(this.workspacePath, ".cascade", DYNAMIC_TOOLS_FILE);
     try {
       const raw = await fs4__default.default.readFile(file, "utf-8");
       const specs = JSON.parse(raw);
@@ -9428,8 +9429,8 @@ Required capability: ${description.slice(0, 300)}`;
   }
   async persist() {
     if (!this.workspacePath || !this.persistEnabled) return;
-    const dir = path20__default.default.join(this.workspacePath, ".cascade");
-    const file = path20__default.default.join(dir, DYNAMIC_TOOLS_FILE);
+    const dir = path21__default.default.join(this.workspacePath, ".cascade");
+    const file = path21__default.default.join(dir, DYNAMIC_TOOLS_FILE);
     try {
       await fs4__default.default.mkdir(dir, { recursive: true });
       await fs4__default.default.writeFile(file, JSON.stringify(Array.from(this.specs.values()), null, 2), "utf-8");
@@ -9449,12 +9450,12 @@ var WorldStateDB = class {
   constructor(workspacePath, debugMode = false) {
     this.workspacePath = workspacePath;
     this.debugMode = debugMode;
-    const cascadeDir = path20__default.default.join(workspacePath, ".cascade");
-    if (!fs19__default.default.existsSync(cascadeDir)) {
-      fs19__default.default.mkdirSync(cascadeDir, { recursive: true });
+    const cascadeDir = path21__default.default.join(workspacePath, ".cascade");
+    if (!fs20__default.default.existsSync(cascadeDir)) {
+      fs20__default.default.mkdirSync(cascadeDir, { recursive: true });
     }
-    this.keyPath = path20__default.default.join(cascadeDir, "world_state.key");
-    this.dbPath = path20__default.default.join(cascadeDir, "world_state.db");
+    this.keyPath = path21__default.default.join(cascadeDir, "world_state.key");
+    this.dbPath = path21__default.default.join(cascadeDir, "world_state.db");
     this.initEncryptionKey();
     this.db = new Database__default.default(this.dbPath);
     this.db.pragma("journal_mode = WAL");
@@ -9484,11 +9485,11 @@ var WorldStateDB = class {
   dbPath;
   encryptionKey;
   initEncryptionKey() {
-    if (fs19__default.default.existsSync(this.keyPath)) {
-      this.encryptionKey = fs19__default.default.readFileSync(this.keyPath);
+    if (fs20__default.default.existsSync(this.keyPath)) {
+      this.encryptionKey = fs20__default.default.readFileSync(this.keyPath);
     } else {
       this.encryptionKey = crypto3__default.default.randomBytes(32);
-      fs19__default.default.writeFileSync(this.keyPath, this.encryptionKey);
+      fs20__default.default.writeFileSync(this.keyPath, this.encryptionKey);
     }
   }
   encrypt(text) {
@@ -9629,6 +9630,22 @@ var WorldStateDB = class {
     }
     return selected.slice(0, limit).map((f) => `- ${f.entity} ${f.relation} ${f.value}`).join("\n");
   }
+  /**
+   * Delete one fact by its (normalized) entity + relation key. Returns whether
+   * a row was actually removed. Powers the desktop Knowledge tab's per-fact
+   * delete — users can prune what the planner remembers about their project.
+   */
+  deleteFact(entity, relation) {
+    const e = normalizeKey(entity);
+    const r = normalizeKey(relation);
+    if (!e || !r) return false;
+    const result = this.db.prepare("DELETE FROM facts WHERE entity = ? AND relation = ?").run(e, r);
+    return result.changes > 0;
+  }
+  /** Delete every fact. Returns how many were removed. */
+  clearFacts() {
+    return this.db.prepare("DELETE FROM facts").run().changes;
+  }
   // ── Export / Import ──────────────────────────
   //
   //  Knowledge travels DECRYPTED in the export bundle (a portable plaintext
@@ -9677,9 +9694,9 @@ var WorldStateDB = class {
   dumpDebugIfNeeded() {
     if (!this.debugMode) return;
     try {
-      const dumpPath = path20__default.default.join(os6__default.default.tmpdir(), "cascade_world_state_debug.json");
+      const dumpPath = path21__default.default.join(os6__default.default.tmpdir(), "cascade_world_state_debug.json");
       const entries = this.getAllEntries();
-      fs19__default.default.writeFileSync(dumpPath, JSON.stringify(entries, null, 2), "utf-8");
+      fs20__default.default.writeFileSync(dumpPath, JSON.stringify(entries, null, 2), "utf-8");
     } catch (err) {
       console.error("Failed to dump debug world state", err);
     }
@@ -10589,7 +10606,7 @@ var Keystore = class {
       const creds = await this.keytar.findCredentials(KEYTAR_SERVICE);
       this.cache = Object.fromEntries(creds.map((c) => [c.account, c.password]));
       this.backend = "keytar";
-      if (password && fs19__default.default.existsSync(this.storePath)) {
+      if (password && fs20__default.default.existsSync(this.storePath)) {
         try {
           const fileEntries = this.decryptFile(password);
           for (const [k, v] of Object.entries(fileEntries)) {
@@ -10608,7 +10625,7 @@ var Keystore = class {
         "Keystore unlock requires a password because the OS keychain (keytar) is not available on this system."
       );
     }
-    if (!fs19__default.default.existsSync(this.storePath)) {
+    if (!fs20__default.default.existsSync(this.storePath)) {
       const salt = crypto3__default.default.randomBytes(SALT_LEN);
       this.masterKey = this.deriveKey(password, salt);
       this.writeWithSalt({}, salt);
@@ -10622,7 +10639,7 @@ var Keystore = class {
   }
   /** Synchronous legacy unlock kept for AES-only environments. */
   unlockSync(password) {
-    if (!fs19__default.default.existsSync(this.storePath)) {
+    if (!fs20__default.default.existsSync(this.storePath)) {
       const salt = crypto3__default.default.randomBytes(SALT_LEN);
       this.masterKey = this.deriveKey(password, salt);
       this.writeWithSalt({}, salt);
@@ -10680,7 +10697,7 @@ var Keystore = class {
     }
   }
   decryptFile(password, knownSalt) {
-    if (!fs19__default.default.existsSync(this.storePath)) return {};
+    if (!fs20__default.default.existsSync(this.storePath)) return {};
     try {
       const { salt, ciphertext, iv, tag } = this.readRaw();
       const useSalt = knownSalt ?? salt;
@@ -10702,8 +10719,8 @@ var Keystore = class {
     const ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);
     const tag = cipher.getAuthTag();
     const out = Buffer.concat([raw.salt, iv, tag, ciphertext]);
-    fs19__default.default.mkdirSync(path20__default.default.dirname(this.storePath), { recursive: true });
-    fs19__default.default.writeFileSync(this.storePath, out, { mode: 384 });
+    fs20__default.default.mkdirSync(path21__default.default.dirname(this.storePath), { recursive: true });
+    fs20__default.default.writeFileSync(this.storePath, out, { mode: 384 });
   }
   writeWithSalt(data, salt) {
     if (!this.masterKey) throw new Error("writeWithSalt called before masterKey was set");
@@ -10713,11 +10730,11 @@ var Keystore = class {
     const ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);
     const tag = cipher.getAuthTag();
     const out = Buffer.concat([salt, iv, tag, ciphertext]);
-    fs19__default.default.mkdirSync(path20__default.default.dirname(this.storePath), { recursive: true });
-    fs19__default.default.writeFileSync(this.storePath, out, { mode: 384 });
+    fs20__default.default.mkdirSync(path21__default.default.dirname(this.storePath), { recursive: true });
+    fs20__default.default.writeFileSync(this.storePath, out, { mode: 384 });
   }
   readRaw() {
-    const buf = fs19__default.default.readFileSync(this.storePath);
+    const buf = fs20__default.default.readFileSync(this.storePath);
     let offset = 0;
     const salt = buf.subarray(offset, offset + SALT_LEN);
     offset += SALT_LEN;
@@ -10750,7 +10767,7 @@ var CascadeIgnore = class {
     ]);
   }
   async load(workspacePath) {
-    const filePath = path20__default.default.join(workspacePath, ".cascadeignore");
+    const filePath = path21__default.default.join(workspacePath, ".cascadeignore");
     try {
       const content = await fs4__default.default.readFile(filePath, "utf-8");
       const lines = content.split("\n").filter((l) => l.trim() && !l.startsWith("#"));
@@ -10761,7 +10778,7 @@ var CascadeIgnore = class {
   }
   isIgnored(filePath, workspacePath) {
     try {
-      const relative = workspacePath ? path20__default.default.relative(workspacePath, filePath) : filePath;
+      const relative = workspacePath ? path21__default.default.relative(workspacePath, filePath) : filePath;
       return this.ig.ignores(relative);
     } catch {
       return false;
@@ -10772,7 +10789,7 @@ var CascadeIgnore = class {
   }
 };
 async function loadCascadeMd(workspacePath) {
-  const filePath = path20__default.default.join(workspacePath, "CASCADE.md");
+  const filePath = path21__default.default.join(workspacePath, "CASCADE.md");
   try {
     const raw = await fs4__default.default.readFile(filePath, "utf-8");
     return parseCascadeMd(raw);
@@ -10803,7 +10820,7 @@ ${raw.trim()}`;
 var MemoryStore = class _MemoryStore {
   db;
   constructor(dbPath) {
-    fs19__default.default.mkdirSync(path20__default.default.dirname(dbPath), { recursive: true });
+    fs20__default.default.mkdirSync(path21__default.default.dirname(dbPath), { recursive: true });
     try {
       this.db = new Database__default.default(dbPath, { timeout: 5e3 });
       this.db.pragma("journal_mode = WAL");
@@ -11638,6 +11655,60 @@ Original error: ${err.message}`
     };
   }
 };
+function credentialsPath(globalDir) {
+  return path21__default.default.join(globalDir, GLOBAL_CREDENTIALS_FILE);
+}
+function providerKey(p) {
+  if (p.type === "azure") {
+    return `azure:${p.deploymentName ?? p.baseUrl ?? p.label ?? ""}`;
+  }
+  return p.type;
+}
+function isPersistable(p) {
+  return Boolean(p.apiKey || p.authToken || p.type === "azure" || p.baseUrl);
+}
+function loadGlobalCredentials(globalDir) {
+  try {
+    const raw = fs20__default.default.readFileSync(credentialsPath(globalDir), "utf-8");
+    const parsed = JSON.parse(raw);
+    if (!Array.isArray(parsed.providers)) return [];
+    return parsed.providers.filter(
+      (p) => Boolean(p) && typeof p.type === "string"
+    );
+  } catch {
+    return [];
+  }
+}
+function saveGlobalCredentials(globalDir, providers) {
+  const filePath = credentialsPath(globalDir);
+  fs20__default.default.mkdirSync(globalDir, { recursive: true, mode: 448 });
+  const body = { version: 1, providers: providers.filter(isPersistable) };
+  const tmp = `${filePath}.tmp`;
+  fs20__default.default.writeFileSync(tmp, JSON.stringify(body, null, 2), { encoding: "utf-8", mode: 384 });
+  fs20__default.default.renameSync(tmp, filePath);
+  try {
+    fs20__default.default.chmodSync(filePath, 384);
+  } catch {
+  }
+}
+function mergeGlobalCredentials(workspaceProviders, globalProviders) {
+  const merged = [...workspaceProviders];
+  const byKey = new Map(merged.map((p) => [providerKey(p), p]));
+  for (const g of globalProviders) {
+    const existing = byKey.get(providerKey(g));
+    if (!existing) {
+      merged.push({ ...g });
+      byKey.set(providerKey(g), merged[merged.length - 1]);
+      continue;
+    }
+    if (!existing.apiKey && g.apiKey) existing.apiKey = g.apiKey;
+    if (!existing.authToken && g.authToken) existing.authToken = g.authToken;
+    if (!existing.baseUrl && g.baseUrl) existing.baseUrl = g.baseUrl;
+    if (!existing.apiVersion && g.apiVersion) existing.apiVersion = g.apiVersion;
+    if (!existing.label && g.label) existing.label = g.label;
+  }
+  return merged;
+}
 
 // src/config/index.ts
 var ConfigManager = class {
@@ -11648,18 +11719,20 @@ var ConfigManager = class {
   cascadeMd = null;
   workspacePath;
   globalDir;
-  constructor(workspacePath = process.cwd()) {
+  /** `globalDirOverride` exists for tests — never point it at the real home dir there. */
+  constructor(workspacePath = process.cwd(), globalDirOverride) {
     this.workspacePath = workspacePath;
-    this.globalDir = path20__default.default.join(os6__default.default.homedir(), GLOBAL_CONFIG_DIR);
+    this.globalDir = globalDirOverride ?? path21__default.default.join(os6__default.default.homedir(), GLOBAL_CONFIG_DIR);
   }
   async load() {
     this.config = await this.loadConfig();
     this.ignore = new CascadeIgnore();
     await this.ignore.load(this.workspacePath);
     this.cascadeMd = await loadCascadeMd(this.workspacePath);
-    this.keystore = new Keystore(path20__default.default.join(this.globalDir, GLOBAL_KEYSTORE_FILE));
-    this.store = new MemoryStore(path20__default.default.join(this.workspacePath, CASCADE_DB_FILE));
+    this.keystore = new Keystore(path21__default.default.join(this.globalDir, GLOBAL_KEYSTORE_FILE));
+    this.store = new MemoryStore(path21__default.default.join(this.workspacePath, CASCADE_DB_FILE));
     await this.injectEnvKeys();
+    this.config.providers = mergeGlobalCredentials(this.config.providers, loadGlobalCredentials(this.globalDir));
     await this.ensureDefaultIdentity();
   }
   getConfig() {
@@ -11681,9 +11754,14 @@ var ConfigManager = class {
     return this.workspacePath;
   }
   async save() {
-    const configPath = path20__default.default.join(this.workspacePath, CASCADE_CONFIG_FILE);
-    await fs4__default.default.mkdir(path20__default.default.dirname(configPath), { recursive: true });
+    const configPath = path21__default.default.join(this.workspacePath, CASCADE_CONFIG_FILE);
+    await fs4__default.default.mkdir(path21__default.default.dirname(configPath), { recursive: true });
     await fs4__default.default.writeFile(configPath, JSON.stringify(this.config, null, 2), "utf-8");
+    try {
+      saveGlobalCredentials(this.globalDir, this.config.providers);
+    } catch (err) {
+      console.warn(`Failed to sync credentials to global store: ${err instanceof Error ? err.message : String(err)}`);
+    }
   }
   async updateConfig(updates) {
     this.config = validateConfig({ ...this.config, ...updates });
@@ -11706,7 +11784,7 @@ var ConfigManager = class {
     return configProvider?.apiKey;
   }
   async loadConfig() {
-    const configPath = path20__default.default.join(this.workspacePath, CASCADE_CONFIG_FILE);
+    const configPath = path21__default.default.join(this.workspacePath, CASCADE_CONFIG_FILE);
     try {
       const raw = await fs4__default.default.readFile(configPath, "utf-8");
       return validateConfig(JSON.parse(raw));
@@ -11813,6 +11891,11 @@ function authMiddleware(secret, required = true) {
     }
     const user = verifyToken(token, secret);
     if (!user) {
+      if (!required) {
+        req.user = void 0;
+        next();
+        return;
+      }
       res.status(401).json({ error: "Invalid or expired token" });
       return;
     }
@@ -11945,6 +12028,25 @@ var DashboardSocket = class {
       });
     });
   }
+  /**
+   * Boardroom plan decisions from a connected client. The desktop shows a
+   * plan-review modal on `plan:approval-required` and answers here; the
+   * server routes the decision into the paused run via resolvePlanApproval.
+   */
+  onPlanDecision(callback) {
+    this.io.on("connection", (socket) => {
+      socket.on("plan:decision", (payload) => {
+        if (typeof payload?.sessionId === "string" && typeof payload?.approved === "boolean") {
+          callback({
+            sessionId: payload.sessionId,
+            approved: payload.approved,
+            note: typeof payload.note === "string" && payload.note.trim() ? payload.note.trim() : void 0,
+            editedPlan: payload.editedPlan
+          });
+        }
+      });
+    });
+  }
   onSessionSteer(callback) {
     this.io.on("connection", (socket) => {
       socket.on("session:steer", (payload) => {
@@ -11986,7 +12088,123 @@ var DashboardSocket = class {
     this.io.close();
   }
 };
-var __dirname$1 = path20__default.default.dirname(url.fileURLToPath((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('index.cjs', document.baseURI).href))));
+var TaskScheduler = class {
+  cronJobs = /* @__PURE__ */ new Map();
+  store;
+  runner;
+  constructor(store, runner) {
+    this.store = store;
+    this.runner = runner;
+  }
+  start() {
+    const tasks = this.store.listScheduledTasks();
+    for (const task of tasks) {
+      if (task.enabled) this.schedule(task);
+    }
+  }
+  stop() {
+    for (const job of this.cronJobs.values()) job.stop();
+    this.cronJobs.clear();
+  }
+  schedule(task) {
+    if (!cron__default.default.validate(task.cronExpression)) {
+      throw new Error(`Invalid cron expression: ${task.cronExpression}`);
+    }
+    const existing = this.cronJobs.get(task.id);
+    if (existing) {
+      try {
+        existing.stop();
+      } catch {
+      }
+    }
+    const job = cron__default.default.schedule(task.cronExpression, async () => {
+      try {
+        task.lastRun = (/* @__PURE__ */ new Date()).toISOString();
+        this.store.saveScheduledTask(task);
+        await this.runner(task);
+      } catch (err) {
+        console.error(`[scheduler] Task "${task.id}" (${task.cronExpression}) failed:`, err);
+      }
+    }, { timezone: "UTC" });
+    this.cronJobs.set(task.id, job);
+  }
+  unschedule(taskId) {
+    this.cronJobs.get(taskId)?.stop();
+    this.cronJobs.delete(taskId);
+  }
+  add(task) {
+    this.store.saveScheduledTask(task);
+    if (task.enabled) this.schedule(task);
+  }
+  remove(taskId) {
+    this.unschedule(taskId);
+    this.store.deleteScheduledTask(taskId);
+  }
+  list() {
+    return this.store.listScheduledTasks();
+  }
+  isRunning(taskId) {
+    return this.cronJobs.has(taskId);
+  }
+  static validateCron(expression) {
+    return cron__default.default.validate(expression);
+  }
+};
+
+// src/dashboard/cost-stats.ts
+var DAY_MS = 24 * 60 * 60 * 1e3;
+function utcDateKey(d) {
+  return d.toISOString().slice(0, 10);
+}
+function aggregateCostStats(sessions, opts = {}) {
+  const days = Math.max(1, opts.days ?? 30);
+  const topN = Math.max(1, opts.topN ?? 8);
+  const now = opts.now ?? /* @__PURE__ */ new Date();
+  const buckets = /* @__PURE__ */ new Map();
+  for (let i = days - 1; i >= 0; i--) {
+    const key = utcDateKey(new Date(now.getTime() - i * DAY_MS));
+    buckets.set(key, { date: key, costUsd: 0, tokens: 0, runs: 0 });
+  }
+  let totalCostUsd = 0;
+  let totalTokens = 0;
+  let totalRuns = 0;
+  for (const s of sessions) {
+    const cost = s.metadata?.totalCostUsd ?? 0;
+    const tokens = s.metadata?.totalTokens ?? 0;
+    const runs = s.metadata?.taskCount ?? 0;
+    totalCostUsd += cost;
+    totalTokens += tokens;
+    totalRuns += runs;
+    const when = new Date(s.updatedAt || s.createdAt);
+    if (!Number.isNaN(when.getTime())) {
+      const bucket = buckets.get(utcDateKey(when));
+      if (bucket) {
+        bucket.costUsd += cost;
+        bucket.tokens += tokens;
+        bucket.runs += runs;
+      }
+    }
+  }
+  const topSessions = [...sessions].filter((s) => (s.metadata?.totalCostUsd ?? 0) > 0).sort((a, b) => (b.metadata?.totalCostUsd ?? 0) - (a.metadata?.totalCostUsd ?? 0)).slice(0, topN).map((s) => ({
+    sessionId: s.id,
+    title: s.title,
+    costUsd: s.metadata?.totalCostUsd ?? 0,
+    tokens: s.metadata?.totalTokens ?? 0,
+    runs: s.metadata?.taskCount ?? 0,
+    updatedAt: s.updatedAt
+  }));
+  return {
+    totalCostUsd,
+    totalTokens,
+    totalSessions: sessions.length,
+    totalRuns,
+    perDay: [...buckets.values()],
+    topSessions
+  };
+}
+
+// src/dashboard/server.ts
+var __dirname$1 = path21__default.default.dirname(url.fileURLToPath((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('index.cjs', document.baseURI).href))));
 var DashboardServer = class {
   app;
   httpServer;
@@ -12011,6 +12229,14 @@ var DashboardServer = class {
    * map is how that answer reaches the run that's blocked on it.
    */
   pendingApprovals = /* @__PURE__ */ new Map();
+  /**
+   * The orchestration decision trail ("why") of each session's most recent
+   * run — captured when the run ends so the desktop's Why panel can show it
+   * after the fact. Bounded: oldest entry evicted past 50 sessions.
+   */
+  whyBySession = /* @__PURE__ */ new Map();
+  /** Cron scheduler for the Schedules UI — runs tasks while this server is up. */
+  scheduler;
   port;
   host;
   workspacePath;
@@ -12028,6 +12254,7 @@ var DashboardServer = class {
       secret: this.dashboardSecret,
       corsOrigin: config.dashboard.auth ? [`http://localhost:${this.port}`, `http://127.0.0.1:${this.port}`] : "*"
     });
+    this.scheduler = new TaskScheduler(store, (task) => this.runScheduledTask(task));
     this.setupMiddleware();
     this.setupRoutes();
     this.socket.onSessionRate((sessionId, rating) => {
@@ -12091,6 +12318,9 @@ var DashboardServer = class {
       cascade.on("peer:message", (e) => {
         this.socket.emitPeerMessage(e);
       });
+      cascade.on("plan:approval-required", (e) => {
+        this.socket.emitToSocket(socketId, "plan:approval-required", { sessionId, ...e });
+      });
       try {
         const result = await cascade.run({
           prompt: runPrompt,
@@ -12098,7 +12328,8 @@ var DashboardServer = class {
           approvalCallback: this.makeApprovalCallback(sessionId)
         });
         this.recordSessionTask(sessionId, result.taskId);
-        this.persistRunEnd(sessionId, title, prompt, result.output, "COMPLETED");
+        this.persistRunEnd(sessionId, title, prompt, result.output, "COMPLETED", result);
+        this.captureWhy(sessionId, cascade, result);
         this.socket.emitToSocket(socketId, "session:complete", { sessionId, result });
         this.socket.broadcast("cost:update", {
           sessionId,
@@ -12108,6 +12339,7 @@ var DashboardServer = class {
         this.throttledBroadcast("workspace");
       } catch (err) {
         this.persistRunEnd(sessionId, title, prompt, void 0, "FAILED");
+        this.captureWhy(sessionId, cascade);
         this.socket.emitToSocket(socketId, "session:error", {
           sessionId,
           error: err instanceof Error ? err.message : String(err)
@@ -12118,9 +12350,17 @@ var DashboardServer = class {
         this.denyPendingApprovals(sessionId);
       }
     });
+    this.socket.onPlanDecision(({ sessionId, approved, note, editedPlan }) => {
+      this.activeSessions.get(sessionId)?.resolvePlanApproval(
+        approved,
+        note,
+        editedPlan
+      );
+    });
     this.socket.onSessionHalt((sessionId) => {
       this.activeControllers.get(sessionId)?.abort();
       this.denyPendingApprovals(sessionId);
+      this.activeSessions.get(sessionId)?.resolvePlanApproval(false);
     });
     this.socket.onApprovalResponse(({ requestId, approved, always }) => {
       const pending = this.pendingApprovals.get(requestId);
@@ -12153,12 +12393,21 @@ var DashboardServer = class {
         resolve();
       });
     });
+    try {
+      this.scheduler.start();
+    } catch (err) {
+      console.warn("[dashboard] failed to start task scheduler:", err);
+    }
   }
   async stop() {
     if (this.broadcastTimer) {
       clearTimeout(this.broadcastTimer);
       this.broadcastTimer = null;
     }
+    try {
+      this.scheduler.stop();
+    } catch {
+    }
     this.socket.close();
     try {
       this.globalStore?.close();
@@ -12189,12 +12438,17 @@ var DashboardServer = class {
    */
   persistConfig() {
     try {
-      const configPath = path20__default.default.join(this.workspacePath, CASCADE_CONFIG_FILE);
-      fs19__default.default.mkdirSync(path20__default.default.dirname(configPath), { recursive: true });
-      fs19__default.default.writeFileSync(configPath, JSON.stringify(this.config, null, 2), "utf-8");
+      const configPath = path21__default.default.join(this.workspacePath, CASCADE_CONFIG_FILE);
+      fs20__default.default.mkdirSync(path21__default.default.dirname(configPath), { recursive: true });
+      fs20__default.default.writeFileSync(configPath, JSON.stringify(this.config, null, 2), "utf-8");
     } catch (err) {
       console.warn(`[dashboard] Failed to persist config: ${err instanceof Error ? err.message : String(err)}`);
     }
+    try {
+      saveGlobalCredentials(path21__default.default.join(os6__default.default.homedir(), GLOBAL_CONFIG_DIR), this.config.providers ?? []);
+    } catch (err) {
+      console.warn(`[dashboard] Failed to sync global credentials: ${err instanceof Error ? err.message : String(err)}`);
+    }
   }
   /**
    * Produce a stable dashboard JWT signing secret.
@@ -12206,15 +12460,15 @@ var DashboardServer = class {
   resolveDashboardSecret() {
     const fromConfig = this.config.dashboard.secret ?? process.env["CASCADE_DASHBOARD_SECRET"];
     if (fromConfig) return fromConfig;
-    const secretPath = path20__default.default.join(this.workspacePath, CASCADE_DASHBOARD_SECRET_FILE);
+    const secretPath = path21__default.default.join(this.workspacePath, CASCADE_DASHBOARD_SECRET_FILE);
     try {
-      if (fs19__default.default.existsSync(secretPath)) {
-        const existing = fs19__default.default.readFileSync(secretPath, "utf-8").trim();
+      if (fs20__default.default.existsSync(secretPath)) {
+        const existing = fs20__default.default.readFileSync(secretPath, "utf-8").trim();
         if (existing.length >= 16) return existing;
       }
       const generated = crypto3.randomUUID();
-      fs19__default.default.mkdirSync(path20__default.default.dirname(secretPath), { recursive: true });
-      fs19__default.default.writeFileSync(secretPath, generated, { encoding: "utf-8", mode: 384 });
+      fs20__default.default.mkdirSync(path21__default.default.dirname(secretPath), { recursive: true });
+      fs20__default.default.writeFileSync(secretPath, generated, { encoding: "utf-8", mode: 384 });
       if (this.config.dashboard.auth) {
         console.warn(
           `Dashboard auth enabled with no secret configured; persisted a generated secret to ${secretPath}. Set CASCADE_DASHBOARD_SECRET or config.dashboard.secret to override.`
@@ -12241,7 +12495,7 @@ var DashboardServer = class {
   // ── Setup ─────────────────────────────────────
   getGlobalStore() {
     if (!this.globalStore) {
-      const globalDbPath = path20__default.default.join(os6__default.default.homedir(), GLOBAL_CONFIG_DIR, GLOBAL_RUNTIME_DB_FILE);
+      const globalDbPath = path21__default.default.join(os6__default.default.homedir(), GLOBAL_CONFIG_DIR, GLOBAL_RUNTIME_DB_FILE);
       this.globalStore = new MemoryStore(globalDbPath);
     }
     return this.globalStore;
@@ -12279,16 +12533,60 @@ var DashboardServer = class {
     return title;
   }
   /** Record run end: the assistant reply (when there is one) and the runtime row's final status. */
-  persistRunEnd(sessionId, title, latestPrompt, reply, status) {
+  persistRunEnd(sessionId, title, latestPrompt, reply, status, result) {
     try {
       if (reply && reply.trim()) {
         this.store.addMessage({ id: crypto3.randomUUID(), sessionId, role: "assistant", content: reply, timestamp: (/* @__PURE__ */ new Date()).toISOString() });
       }
+      if (result) {
+        const session = this.store.getSession(sessionId);
+        if (session) {
+          this.store.updateSession(sessionId, {
+            updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+            metadata: {
+              ...session.metadata,
+              totalTokens: session.metadata.totalTokens + result.usage.totalTokens,
+              totalCostUsd: session.metadata.totalCostUsd + result.usage.estimatedCostUsd,
+              taskCount: session.metadata.taskCount + 1
+            }
+          });
+        }
+      }
     } catch (err) {
       console.warn("[dashboard] failed to persist run end:", err);
     }
     this.persistRuntimeRow(sessionId, title, status, latestPrompt);
   }
+  /**
+   * Capture the run's decision trail + router economics ("why") and broadcast
+   * it so the desktop's Why panel updates live; kept per-session for the
+   * GET /api/sessions/:id/why fallback (panel opened after the run).
+   */
+  captureWhy(sessionId, cascade, result) {
+    try {
+      const stats = cascade.getRouter().getStats();
+      const savings = cascade.getRouter().getDelegationSavings();
+      const report = {
+        sessionId,
+        capturedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        decisions: cascade.getDecisionLog(),
+        savedUsd: savings.savedUsd,
+        savedPct: savings.savedPct,
+        totalCostUsd: stats.totalCostUsd,
+        totalTokens: stats.totalTokens,
+        costByTier: stats.costByTier,
+        durationMs: result?.durationMs
+      };
+      this.whyBySession.set(sessionId, report);
+      if (this.whyBySession.size > 50) {
+        const oldest = this.whyBySession.keys().next().value;
+        if (oldest) this.whyBySession.delete(oldest);
+      }
+      this.socket.broadcast("run:why", report);
+    } catch (err) {
+      console.warn("[dashboard] failed to capture decision trail:", err);
+    }
+  }
   /**
    * Route steering text into running Cascade instances. Targets the given
    * session, or every active session when none is specified (the desktop
@@ -12318,6 +12616,52 @@ var DashboardServer = class {
       this.pendingApprovals.set(request.id, { resolve, sessionId });
     });
   }
+  /**
+   * Execute one scheduled task firing. Runs headless (like `cascade run -p`):
+   * tool approvals are auto-granted since nobody may be watching when the cron
+   * fires — the Schedules UI states this. Events broadcast to every connected
+   * client so an open desktop sees the run appear live.
+   */
+  async runScheduledTask(task) {
+    const sessionId = crypto3.randomUUID();
+    const prompt = task.prompt;
+    const title = this.persistRunStart(sessionId, `[${task.name}] ${prompt}`);
+    const cascade = new Cascade(this.config, task.workspacePath ?? this.workspacePath, this.store);
+    this.activeSessions.set(sessionId, cascade);
+    cascade.on("tier:status", (e) => {
+      this.socket.broadcast("tier:status", { sessionId, ...e });
+    });
+    cascade.on("peer:message", (e) => {
+      this.socket.emitPeerMessage(e);
+    });
+    try {
+      const result = await cascade.run({
+        prompt,
+        identityId: task.identityId,
+        approvalCallback: async () => ({ approved: true, always: false })
+      });
+      this.recordSessionTask(sessionId, result.taskId);
+      this.persistRunEnd(sessionId, title, prompt, result.output, "COMPLETED", result);
+      this.captureWhy(sessionId, cascade, result);
+      this.socket.broadcast("session:complete", { sessionId, result });
+      this.socket.broadcast("cost:update", {
+        sessionId,
+        totalTokens: result.usage.totalTokens,
+        totalCostUsd: result.usage.estimatedCostUsd
+      });
+      this.throttledBroadcast("workspace");
+    } catch (err) {
+      this.persistRunEnd(sessionId, title, prompt, void 0, "FAILED");
+      this.captureWhy(sessionId, cascade);
+      this.socket.broadcast("session:error", {
+        sessionId,
+        error: err instanceof Error ? err.message : String(err)
+      });
+      throw err;
+    } finally {
+      this.activeSessions.delete(sessionId);
+    }
+  }
   /** Deny + clear any approvals still pending for a session (run end / abort). */
   denyPendingApprovals(sessionId) {
     for (const [id, pending] of this.pendingApprovals) {
@@ -12420,12 +12764,12 @@ ${prompt}`;
     }
   }
   watchRuntimeChanges() {
-    const workspaceDbPath = path20__default.default.join(this.workspacePath, CASCADE_DB_FILE);
-    const globalDbPath = path20__default.default.join(os6__default.default.homedir(), GLOBAL_CONFIG_DIR, GLOBAL_RUNTIME_DB_FILE);
+    const workspaceDbPath = path21__default.default.join(this.workspacePath, CASCADE_DB_FILE);
+    const globalDbPath = path21__default.default.join(os6__default.default.homedir(), GLOBAL_CONFIG_DIR, GLOBAL_RUNTIME_DB_FILE);
     const watchPaths = [workspaceDbPath, globalDbPath].filter((p, index, arr) => arr.indexOf(p) === index);
     for (const watchPath of watchPaths) {
-      if (!fs19__default.default.existsSync(watchPath)) continue;
-      fs19__default.default.watchFile(watchPath, { interval: 3e3 }, () => {
+      if (!fs20__default.default.existsSync(watchPath)) continue;
+      fs20__default.default.watchFile(watchPath, { interval: 3e3 }, () => {
         this.throttledBroadcast(watchPath === globalDbPath ? "global" : "workspace");
       });
     }
@@ -12547,7 +12891,7 @@ ${prompt}`;
       const sessionId = req.params.id;
       this.store.deleteSession(sessionId);
       this.store.deleteRuntimeSession(sessionId);
-      const globalDbPath = path20__default.default.join(os6__default.default.homedir(), GLOBAL_CONFIG_DIR, GLOBAL_RUNTIME_DB_FILE);
+      const globalDbPath = path21__default.default.join(os6__default.default.homedir(), GLOBAL_CONFIG_DIR, GLOBAL_RUNTIME_DB_FILE);
       const globalStore = new MemoryStore(globalDbPath);
       try {
         globalStore.deleteRuntimeSession(sessionId);
@@ -12640,7 +12984,7 @@ ${prompt}`;
     });
     this.app.delete("/api/sessions", auth, (req, res) => {
       const body = req.body;
-      const globalDbPath = path20__default.default.join(os6__default.default.homedir(), GLOBAL_CONFIG_DIR, GLOBAL_RUNTIME_DB_FILE);
+      const globalDbPath = path21__default.default.join(os6__default.default.homedir(), GLOBAL_CONFIG_DIR, GLOBAL_RUNTIME_DB_FILE);
       if (body?.ids && Array.isArray(body.ids) && body.ids.length > 0) {
         const globalStore = new MemoryStore(globalDbPath);
         try {
@@ -12663,7 +13007,7 @@ ${prompt}`;
     });
     this.app.delete("/api/runtime", auth, (_req, res) => {
       this.store.deleteAllRuntimeNodes();
-      const globalDbPath = path20__default.default.join(os6__default.default.homedir(), GLOBAL_CONFIG_DIR, GLOBAL_RUNTIME_DB_FILE);
+      const globalDbPath = path21__default.default.join(os6__default.default.homedir(), GLOBAL_CONFIG_DIR, GLOBAL_RUNTIME_DB_FILE);
       const globalStore = new MemoryStore(globalDbPath);
       try {
         globalStore.deleteAllRuntimeNodes();
@@ -12749,12 +13093,12 @@ ${prompt}`;
       if (body["tierLimits"]) this.config.tierLimits = { ...this.config.tierLimits, ...body["tierLimits"] };
       if (body["budget"]) this.config.budget = { ...this.config.budget, ...body["budget"] };
       try {
-        const configPath = path20__default.default.join(this.workspacePath, CASCADE_CONFIG_FILE);
-        const existing = fs19__default.default.existsSync(configPath) ? JSON.parse(fs19__default.default.readFileSync(configPath, "utf-8")) : {};
+        const configPath = path21__default.default.join(this.workspacePath, CASCADE_CONFIG_FILE);
+        const existing = fs20__default.default.existsSync(configPath) ? JSON.parse(fs20__default.default.readFileSync(configPath, "utf-8")) : {};
         const updated = { ...existing, tierLimits: this.config.tierLimits, budget: this.config.budget };
         const tmp = configPath + ".tmp";
-        fs19__default.default.writeFileSync(tmp, JSON.stringify(updated, null, 2), "utf-8");
-        fs19__default.default.renameSync(tmp, configPath);
+        fs20__default.default.writeFileSync(tmp, JSON.stringify(updated, null, 2), "utf-8");
+        fs20__default.default.renameSync(tmp, configPath);
         res.json({ ok: true });
       } catch (err) {
         res.status(500).json({ error: `Failed to save config: ${err instanceof Error ? err.message : String(err)}` });
@@ -12782,7 +13126,7 @@ ${prompt}`;
     this.app.get("/api/runtime", auth, (req, res) => {
       const scope = req.query["scope"] ?? "workspace";
       if (scope === "global") {
-        const globalDbPath = path20__default.default.join(os6__default.default.homedir(), GLOBAL_CONFIG_DIR, GLOBAL_RUNTIME_DB_FILE);
+        const globalDbPath = path21__default.default.join(os6__default.default.homedir(), GLOBAL_CONFIG_DIR, GLOBAL_RUNTIME_DB_FILE);
         const globalStore = new MemoryStore(globalDbPath);
         try {
           res.json({
@@ -12830,6 +13174,9 @@ ${prompt}`;
         cascade.on("peer:message", (e) => {
           this.socket.emitPeerMessage(e);
         });
+        cascade.on("plan:approval-required", (e) => {
+          this.socket.broadcastToRoom(`session:${sessionId}`, "plan:approval-required", { sessionId, ...e });
+        });
         try {
           const result = await cascade.run({
             prompt: runPrompt,
@@ -12837,7 +13184,8 @@ ${prompt}`;
             approvalCallback: this.makeApprovalCallback(sessionId)
           });
           this.recordSessionTask(sessionId, result.taskId);
-          this.persistRunEnd(sessionId, title, prompt, result.output, "COMPLETED");
+          this.persistRunEnd(sessionId, title, prompt, result.output, "COMPLETED", result);
+          this.captureWhy(sessionId, cascade, result);
           this.socket.broadcast("cost:update", {
             sessionId,
             totalTokens: result.usage.totalTokens,
@@ -12847,6 +13195,7 @@ ${prompt}`;
           this.throttledBroadcast("workspace");
         } catch (err) {
           this.persistRunEnd(sessionId, title, prompt, void 0, "FAILED");
+          this.captureWhy(sessionId, cascade);
           this.socket.broadcastToRoom(`session:${sessionId}`, "session:error", {
             sessionId,
             error: err instanceof Error ? err.message : String(err)
@@ -12868,13 +13217,217 @@ ${prompt}`;
         }))
       });
     });
-    const prodPath = path20__default.default.resolve(__dirname$1, "../web/dist");
-    const devPath = path20__default.default.resolve(__dirname$1, "../../web/dist");
-    const webDistPath = fs19__default.default.existsSync(prodPath) ? prodPath : devPath;
-    if (fs19__default.default.existsSync(webDistPath)) {
+    this.app.get("/api/sessions/:id/why", auth, (req, res) => {
+      const report = this.whyBySession.get(req.params.id);
+      if (!report) {
+        res.status(404).json({ error: "No decision trail recorded for this session in the current app run." });
+        return;
+      }
+      res.json(report);
+    });
+    this.app.get("/api/sessions/:id/changes", auth, async (req, res) => {
+      const sessionId = req.params.id;
+      const taskIds = this.sessionTaskIds.get(sessionId) ?? [];
+      const before = /* @__PURE__ */ new Map();
+      for (const taskId of taskIds) {
+        for (const { filePath, content } of this.store.getLatestFileSnapshots(taskId)) {
+          if (!before.has(filePath)) before.set(filePath, content);
+        }
+      }
+      const { readFile } = await import('fs/promises');
+      const MAX_DIFF_BYTES = 2 * 1024 * 1024;
+      const changes = await Promise.all([...before.entries()].map(async ([filePath, beforeContent]) => {
+        let after = "";
+        let missing = false;
+        try {
+          const buf = await readFile(filePath);
+          after = buf.length > MAX_DIFF_BYTES ? `[file too large to diff \u2014 ${buf.length} bytes]` : buf.toString("utf-8");
+        } catch {
+          missing = true;
+        }
+        return { filePath, before: beforeContent, after, missing, changed: missing || after !== beforeContent };
+      }));
+      res.json({ sessionId, changes: changes.filter((c) => c.changed) });
+    });
+    this.app.post("/api/sessions/:id/revert-file", auth, mutationLimiter, async (req, res) => {
+      const sessionId = req.params.id;
+      const body = req.body;
+      if (!body.filePath || typeof body.filePath !== "string") {
+        res.status(400).json({ error: "filePath is required" });
+        return;
+      }
+      const taskIds = this.sessionTaskIds.get(sessionId) ?? [];
+      let content;
+      for (const taskId of taskIds) {
+        const snap = this.store.getLatestFileSnapshots(taskId).find((s) => s.filePath === body.filePath);
+        if (snap) {
+          content = snap.content;
+          break;
+        }
+      }
+      if (content === void 0) {
+        res.status(404).json({ error: "No snapshot recorded for that file in this session." });
+        return;
+      }
+      try {
+        const { writeFile } = await import('fs/promises');
+        await writeFile(body.filePath, content, "utf-8");
+        res.json({ ok: true, filePath: body.filePath });
+      } catch (err) {
+        res.status(500).json({ error: err instanceof Error ? err.message : String(err) });
+      }
+    });
+    this.app.get("/api/costs", auth, (_req, res) => {
+      try {
+        const sessions = this.store.listSessions(void 0, 1e3);
+        const budget = this.config.budget ?? { warnAtPct: 80 };
+        res.json({
+          ...aggregateCostStats(sessions, { days: 30, topN: 8 }),
+          budget: {
+            dailyBudgetUsd: budget.dailyBudgetUsd,
+            sessionBudgetUsd: budget.sessionBudgetUsd,
+            maxCostPerRunUsd: budget.maxCostPerRunUsd
+          }
+        });
+      } catch (err) {
+        res.status(500).json({ error: err instanceof Error ? err.message : String(err) });
+      }
+    });
+    this.app.get("/api/schedules", auth, (_req, res) => {
+      try {
+        res.json(this.scheduler.list().map((t) => ({ ...t, armed: this.scheduler.isRunning(t.id) })));
+      } catch (err) {
+        res.status(500).json({ error: err instanceof Error ? err.message : String(err) });
+      }
+    });
+    this.app.post("/api/schedules", auth, mutationLimiter, (req, res) => {
+      const body = req.body;
+      if (!body.name?.trim() || !body.cronExpression?.trim() || !body.prompt?.trim()) {
+        res.status(400).json({ error: "name, cronExpression, and prompt are required" });
+        return;
+      }
+      if (!TaskScheduler.validateCron(body.cronExpression.trim())) {
+        res.status(400).json({ error: `Invalid cron expression: ${body.cronExpression}` });
+        return;
+      }
+      const task = {
+        id: crypto3.randomUUID(),
+        name: body.name.trim(),
+        cronExpression: body.cronExpression.trim(),
+        prompt: body.prompt.trim(),
+        workspacePath: this.workspacePath,
+        createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+        enabled: body.enabled !== false
+      };
+      try {
+        this.scheduler.add(task);
+        res.json(task);
+      } catch (err) {
+        res.status(500).json({ error: err instanceof Error ? err.message : String(err) });
+      }
+    });
+    this.app.put("/api/schedules/:id", auth, mutationLimiter, (req, res) => {
+      const id = req.params.id;
+      const existing = this.scheduler.list().find((t) => t.id === id);
+      if (!existing) {
+        res.status(404).json({ error: "Not found" });
+        return;
+      }
+      const body = req.body;
+      if (body.cronExpression !== void 0 && !TaskScheduler.validateCron(body.cronExpression)) {
+        res.status(400).json({ error: `Invalid cron expression: ${body.cronExpression}` });
+        return;
+      }
+      const updated = {
+        ...existing,
+        name: body.name?.trim() || existing.name,
+        cronExpression: body.cronExpression?.trim() || existing.cronExpression,
+        prompt: body.prompt?.trim() || existing.prompt,
+        enabled: body.enabled ?? existing.enabled
+      };
+      try {
+        this.scheduler.add(updated);
+        if (!updated.enabled) this.scheduler.unschedule(id);
+        res.json(updated);
+      } catch (err) {
+        res.status(500).json({ error: err instanceof Error ? err.message : String(err) });
+      }
+    });
+    this.app.delete("/api/schedules/:id", auth, mutationLimiter, (req, res) => {
+      try {
+        this.scheduler.remove(req.params.id);
+        res.json({ ok: true });
+      } catch (err) {
+        res.status(500).json({ error: err instanceof Error ? err.message : String(err) });
+      }
+    });
+    this.app.get("/api/knowledge", auth, (_req, res) => {
+      try {
+        const ws = new WorldStateDB(this.workspacePath);
+        try {
+          const facts = ws.getAllFacts();
+          res.json({ total: facts.length, facts });
+        } finally {
+          ws.close();
+        }
+      } catch (err) {
+        res.status(500).json({ error: err instanceof Error ? err.message : String(err) });
+      }
+    });
+    this.app.delete("/api/knowledge/fact", auth, mutationLimiter, (req, res) => {
+      const body = req.body;
+      if (!body.entity || !body.relation) {
+        res.status(400).json({ error: "entity and relation are required" });
+        return;
+      }
+      try {
+        const ws = new WorldStateDB(this.workspacePath);
+        try {
+          res.json({ ok: true, deleted: ws.deleteFact(body.entity, body.relation) });
+        } finally {
+          ws.close();
+        }
+      } catch (err) {
+        res.status(500).json({ error: err instanceof Error ? err.message : String(err) });
+      }
+    });
+    this.app.delete("/api/knowledge", auth, mutationLimiter, (_req, res) => {
+      try {
+        const ws = new WorldStateDB(this.workspacePath);
+        try {
+          res.json({ ok: true, deleted: ws.clearFacts() });
+        } finally {
+          ws.close();
+        }
+      } catch (err) {
+        res.status(500).json({ error: err instanceof Error ? err.message : String(err) });
+      }
+    });
+    this.app.get("/api/audit-chain", auth, async (req, res) => {
+      try {
+        const limit = Math.min(500, Math.max(1, parseInt(req.query["limit"] || "200", 10) || 200));
+        const offset = Math.max(0, parseInt(req.query["offset"] || "0", 10) || 0);
+        const { AuditLogger: AuditLogger3 } = await Promise.resolve().then(() => (init_audit_logger(), audit_logger_exports));
+        const logger = new AuditLogger3(this.workspacePath);
+        try {
+          const all = logger.getAllLogs();
+          const total = all.length;
+          const entries = all.reverse().slice(offset, offset + limit);
+          res.json({ total, offset, entries });
+        } finally {
+          logger.close();
+        }
+      } catch (err) {
+        res.status(500).json({ error: err instanceof Error ? err.message : String(err) });
+      }
+    });
+    const prodPath = path21__default.default.resolve(__dirname$1, "../web/dist");
+    const devPath = path21__default.default.resolve(__dirname$1, "../../web/dist");
+    const webDistPath = fs20__default.default.existsSync(prodPath) ? prodPath : devPath;
+    if (fs20__default.default.existsSync(webDistPath)) {
       this.app.use(express__default.default.static(webDistPath));
       this.app.get("*", (_req, res) => {
-        res.sendFile(path20__default.default.join(webDistPath, "index.html"));
+        res.sendFile(path21__default.default.join(webDistPath, "index.html"));
       });
     } else {
       this.app.get("/", (_req, res) => {
@@ -12889,68 +13442,6 @@ ${prompt}`;
     }
   }
 };
-var TaskScheduler = class {
-  cronJobs = /* @__PURE__ */ new Map();
-  store;
-  runner;
-  constructor(store, runner) {
-    this.store = store;
-    this.runner = runner;
-  }
-  start() {
-    const tasks = this.store.listScheduledTasks();
-    for (const task of tasks) {
-      if (task.enabled) this.schedule(task);
-    }
-  }
-  stop() {
-    for (const job of this.cronJobs.values()) job.stop();
-    this.cronJobs.clear();
-  }
-  schedule(task) {
-    if (!cron__default.default.validate(task.cronExpression)) {
-      throw new Error(`Invalid cron expression: ${task.cronExpression}`);
-    }
-    const existing = this.cronJobs.get(task.id);
-    if (existing) {
-      try {
-        existing.stop();
-      } catch {
-      }
-    }
-    const job = cron__default.default.schedule(task.cronExpression, async () => {
-      try {
-        task.lastRun = (/* @__PURE__ */ new Date()).toISOString();
-        this.store.saveScheduledTask(task);
-        await this.runner(task);
-      } catch (err) {
-        console.error(`[scheduler] Task "${task.id}" (${task.cronExpression}) failed:`, err);
-      }
-    }, { timezone: "UTC" });
-    this.cronJobs.set(task.id, job);
-  }
-  unschedule(taskId) {
-    this.cronJobs.get(taskId)?.stop();
-    this.cronJobs.delete(taskId);
-  }
-  add(task) {
-    this.store.saveScheduledTask(task);
-    if (task.enabled) this.schedule(task);
-  }
-  remove(taskId) {
-    this.unschedule(taskId);
-    this.store.deleteScheduledTask(taskId);
-  }
-  list() {
-    return this.store.listScheduledTasks();
-  }
-  isRunning(taskId) {
-    return this.cronJobs.has(taskId);
-  }
-  static validateCron(expression) {
-    return cron__default.default.validate(expression);
-  }
-};
 var execFileAsync2 = util.promisify(child_process.execFile);
 var SAFE_ENV_NAME = /^[A-Z][A-Z0-9_]*$/;
 function sanitizeEnvValue(v) {
@@ -13037,6 +13528,7 @@ exports.DEFAULT_RETENTION_DAYS = DEFAULT_RETENTION_DAYS;
 exports.DEFAULT_THEME = DEFAULT_THEME;
 exports.DashboardServer = DashboardServer;
 exports.GLOBAL_CONFIG_DIR = GLOBAL_CONFIG_DIR;
+exports.GLOBAL_CREDENTIALS_FILE = GLOBAL_CREDENTIALS_FILE;
 exports.GLOBAL_DB_FILE = GLOBAL_DB_FILE;
 exports.GLOBAL_KEYSTORE_FILE = GLOBAL_KEYSTORE_FILE;
 exports.GLOBAL_RUNTIME_DB_FILE = GLOBAL_RUNTIME_DB_FILE;