cascade-ai 0.17.0 → 0.19.0

package/dist/cli.cjs

@@ -9,8 +9,8 @@ var https = require('https');
 var zlib = require('zlib');
 var stream = require('stream');
 var Database2 = require('better-sqlite3');
-var path25 = require('path');
-var fs23 = require('fs');
+var path26 = require('path');
+var fs24 = require('fs');
 var os8 = require('os');
 var crypto = require('crypto');
 var ink = require('ink');
@@ -19,7 +19,7 @@ var React2 = require('react');
 var chalk9 = require('chalk');
 var dotenv = require('dotenv');
 var url = require('url');
-var fs9 = require('fs/promises');
+var fs10 = require('fs/promises');
 var _ignoreModule = require('ignore');
 var zod = require('zod');
 var child_process = require('child_process');
@@ -73,14 +73,14 @@ var http__default = /*#__PURE__*/_interopDefault(http);
 var https__default = /*#__PURE__*/_interopDefault(https);
 var zlib__default = /*#__PURE__*/_interopDefault(zlib);
 var Database2__default = /*#__PURE__*/_interopDefault(Database2);
-var path25__default = /*#__PURE__*/_interopDefault(path25);
-var fs23__default = /*#__PURE__*/_interopDefault(fs23);
+var path26__default = /*#__PURE__*/_interopDefault(path26);
+var fs24__default = /*#__PURE__*/_interopDefault(fs24);
 var os8__default = /*#__PURE__*/_interopDefault(os8);
 var crypto__default = /*#__PURE__*/_interopDefault(crypto);
 var React2__default = /*#__PURE__*/_interopDefault(React2);
 var chalk9__default = /*#__PURE__*/_interopDefault(chalk9);
 var dotenv__default = /*#__PURE__*/_interopDefault(dotenv);
-var fs9__default = /*#__PURE__*/_interopDefault(fs9);
+var fs10__default = /*#__PURE__*/_interopDefault(fs10);
 var _ignoreModule__namespace = /*#__PURE__*/_interopNamespace(_ignoreModule);
 var EventEmitter__default = /*#__PURE__*/_interopDefault(EventEmitter);
 var PDFDocument__default = /*#__PURE__*/_interopDefault(PDFDocument);
@@ -108,16 +108,17 @@ var __export = (target, all) => {
 };
 
 // src/constants.ts
-var CASCADE_VERSION, CASCADE_CONFIG_FILE, CASCADE_DB_FILE, CASCADE_DASHBOARD_SECRET_FILE, GLOBAL_CONFIG_DIR, GLOBAL_DB_FILE, GLOBAL_KEYSTORE_FILE, GLOBAL_RUNTIME_DB_FILE, DEFAULT_DASHBOARD_PORT, DEFAULT_CONTEXT_LIMIT, DEFAULT_AUTO_SUMMARIZE_AT, MODELS, T1_MODEL_PRIORITY, T2_MODEL_PRIORITY, T3_MODEL_PRIORITY, VISION_MODEL_PRIORITY, COMPLEXITY_T2_COUNT, THEME_NAMES, DEFAULT_THEME, OLLAMA_BASE_URL, LM_STUDIO_BASE_URL, AZURE_BASE_URL_TEMPLATE, TOOL_NAMES, DEFAULT_APPROVAL_REQUIRED;
+var CASCADE_VERSION, CASCADE_CONFIG_FILE, CASCADE_DB_FILE, CASCADE_DASHBOARD_SECRET_FILE, GLOBAL_CONFIG_DIR, GLOBAL_DB_FILE, GLOBAL_KEYSTORE_FILE, GLOBAL_CREDENTIALS_FILE, GLOBAL_RUNTIME_DB_FILE, DEFAULT_DASHBOARD_PORT, DEFAULT_CONTEXT_LIMIT, DEFAULT_AUTO_SUMMARIZE_AT, MODELS, T1_MODEL_PRIORITY, T2_MODEL_PRIORITY, T3_MODEL_PRIORITY, VISION_MODEL_PRIORITY, COMPLEXITY_T2_COUNT, THEME_NAMES, DEFAULT_THEME, OLLAMA_BASE_URL, LM_STUDIO_BASE_URL, AZURE_BASE_URL_TEMPLATE, TOOL_NAMES, DEFAULT_APPROVAL_REQUIRED;
 var init_constants = __esm({
   "src/constants.ts"() {
-    CASCADE_VERSION = "0.17.0";
+    CASCADE_VERSION = "0.19.0";
     CASCADE_CONFIG_FILE = ".cascade/config.json";
     CASCADE_DB_FILE = ".cascade/memory.db";
     CASCADE_DASHBOARD_SECRET_FILE = ".cascade/dashboard-secret";
     GLOBAL_CONFIG_DIR = ".cascade-ai";
     GLOBAL_DB_FILE = "memory.db";
     GLOBAL_KEYSTORE_FILE = "keystore.enc";
+    GLOBAL_CREDENTIALS_FILE = "credentials.json";
     GLOBAL_RUNTIME_DB_FILE = "runtime.db";
     DEFAULT_DASHBOARD_PORT = 4891;
     DEFAULT_CONTEXT_LIMIT = 2e5;
@@ -936,8 +937,26 @@ var init_openai = __esm({
 // src/providers/azure.ts
 var azure_exports = {};
 __export(azure_exports, {
-  AzureOpenAIProvider: () => AzureOpenAIProvider
+  AzureOpenAIProvider: () => AzureOpenAIProvider,
+  azureModelForDeployment: () => azureModelForDeployment
 });
+function azureModelForDeployment(cfg) {
+  if (cfg.type !== "azure" || !cfg.deploymentName?.trim()) return null;
+  const id = cfg.deploymentName.trim();
+  return {
+    id,
+    name: cfg.label?.trim() || id,
+    provider: "azure",
+    contextWindow: 128e3,
+    isVisionCapable: false,
+    inputCostPer1kTokens: 25e-4,
+    outputCostPer1kTokens: 0.01,
+    maxOutputTokens: 16e3,
+    supportsStreaming: true,
+    isLocal: false,
+    supportsToolUse: true
+  };
+}
 var AzureOpenAIProvider;
 var init_azure = __esm({
   "src/providers/azure.ts"() {
@@ -963,7 +982,8 @@ var init_azure = __esm({
         });
       }
       async listModels() {
-        return [this.model];
+        const fromDeployment = azureModelForDeployment(this.config);
+        return [fromDeployment ?? this.model];
       }
       async isAvailable() {
         try {
@@ -1632,12 +1652,12 @@ var init_audit_logger = __esm({
       constructor(workspacePath, debugMode = false) {
         this.workspacePath = workspacePath;
         this.debugMode = debugMode;
-        const cascadeDir = path25__default.default.join(workspacePath, ".cascade");
-        if (!fs23__default.default.existsSync(cascadeDir)) {
-          fs23__default.default.mkdirSync(cascadeDir, { recursive: true });
+        const cascadeDir = path26__default.default.join(workspacePath, ".cascade");
+        if (!fs24__default.default.existsSync(cascadeDir)) {
+          fs24__default.default.mkdirSync(cascadeDir, { recursive: true });
         }
-        this.keyPath = path25__default.default.join(cascadeDir, "audit_log.key");
-        this.dbPath = path25__default.default.join(cascadeDir, "audit_log.db");
+        this.keyPath = path26__default.default.join(cascadeDir, "audit_log.key");
+        this.dbPath = path26__default.default.join(cascadeDir, "audit_log.db");
         this.initEncryptionKey();
         this.db = new Database2__default.default(this.dbPath);
         this.db.pragma("journal_mode = WAL");
@@ -1667,11 +1687,11 @@ var init_audit_logger = __esm({
         return crypto__default.default.createHash("sha256").update(`${prevHash}|${timestamp}|${eventType}|${tierId}|${encryptedPayload}`).digest("hex");
       }
       initEncryptionKey() {
-        if (fs23__default.default.existsSync(this.keyPath)) {
-          this.encryptionKey = fs23__default.default.readFileSync(this.keyPath);
+        if (fs24__default.default.existsSync(this.keyPath)) {
+          this.encryptionKey = fs24__default.default.readFileSync(this.keyPath);
         } else {
           this.encryptionKey = crypto__default.default.randomBytes(32);
-          fs23__default.default.writeFileSync(this.keyPath, this.encryptionKey);
+          fs24__default.default.writeFileSync(this.keyPath, this.encryptionKey);
         }
       }
       encrypt(text) {
@@ -1749,9 +1769,9 @@ var init_audit_logger = __esm({
       dumpDebugIfNeeded() {
         if (!this.debugMode) return;
         try {
-          const dumpPath = path25__default.default.join(os8__default.default.tmpdir(), "cascade_audit_logs_debug.json");
+          const dumpPath = path26__default.default.join(os8__default.default.tmpdir(), "cascade_audit_logs_debug.json");
           const entries = this.getAllLogs();
-          fs23__default.default.writeFileSync(dumpPath, JSON.stringify(entries, null, 2), "utf-8");
+          fs24__default.default.writeFileSync(dumpPath, JSON.stringify(entries, null, 2), "utf-8");
         } catch (err) {
           console.error("Failed to dump debug audit logs", err);
         }
@@ -1806,7 +1826,7 @@ var Keystore = class {
       const creds = await this.keytar.findCredentials(KEYTAR_SERVICE);
       this.cache = Object.fromEntries(creds.map((c) => [c.account, c.password]));
       this.backend = "keytar";
-      if (password && fs23__default.default.existsSync(this.storePath)) {
+      if (password && fs24__default.default.existsSync(this.storePath)) {
         try {
           const fileEntries = this.decryptFile(password);
           for (const [k, v] of Object.entries(fileEntries)) {
@@ -1825,7 +1845,7 @@ var Keystore = class {
         "Keystore unlock requires a password because the OS keychain (keytar) is not available on this system."
       );
     }
-    if (!fs23__default.default.existsSync(this.storePath)) {
+    if (!fs24__default.default.existsSync(this.storePath)) {
       const salt = crypto__default.default.randomBytes(SALT_LEN);
       this.masterKey = this.deriveKey(password, salt);
       this.writeWithSalt({}, salt);
@@ -1839,7 +1859,7 @@ var Keystore = class {
   }
   /** Synchronous legacy unlock kept for AES-only environments. */
   unlockSync(password) {
-    if (!fs23__default.default.existsSync(this.storePath)) {
+    if (!fs24__default.default.existsSync(this.storePath)) {
       const salt = crypto__default.default.randomBytes(SALT_LEN);
       this.masterKey = this.deriveKey(password, salt);
       this.writeWithSalt({}, salt);
@@ -1897,7 +1917,7 @@ var Keystore = class {
     }
   }
   decryptFile(password, knownSalt) {
-    if (!fs23__default.default.existsSync(this.storePath)) return {};
+    if (!fs24__default.default.existsSync(this.storePath)) return {};
     try {
       const { salt, ciphertext, iv, tag } = this.readRaw();
       const useSalt = knownSalt ?? salt;
@@ -1919,8 +1939,8 @@ var Keystore = class {
     const ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);
     const tag = cipher.getAuthTag();
     const out = Buffer.concat([raw.salt, iv, tag, ciphertext]);
-    fs23__default.default.mkdirSync(path25__default.default.dirname(this.storePath), { recursive: true });
-    fs23__default.default.writeFileSync(this.storePath, out, { mode: 384 });
+    fs24__default.default.mkdirSync(path26__default.default.dirname(this.storePath), { recursive: true });
+    fs24__default.default.writeFileSync(this.storePath, out, { mode: 384 });
   }
   writeWithSalt(data, salt) {
     if (!this.masterKey) throw new Error("writeWithSalt called before masterKey was set");
@@ -1930,11 +1950,11 @@ var Keystore = class {
     const ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);
     const tag = cipher.getAuthTag();
     const out = Buffer.concat([salt, iv, tag, ciphertext]);
-    fs23__default.default.mkdirSync(path25__default.default.dirname(this.storePath), { recursive: true });
-    fs23__default.default.writeFileSync(this.storePath, out, { mode: 384 });
+    fs24__default.default.mkdirSync(path26__default.default.dirname(this.storePath), { recursive: true });
+    fs24__default.default.writeFileSync(this.storePath, out, { mode: 384 });
   }
   readRaw() {
-    const buf = fs23__default.default.readFileSync(this.storePath);
+    const buf = fs24__default.default.readFileSync(this.storePath);
     let offset = 0;
     const salt = buf.subarray(offset, offset + SALT_LEN);
     offset += SALT_LEN;
@@ -1967,9 +1987,9 @@ var CascadeIgnore = class {
     ]);
   }
   async load(workspacePath) {
-    const filePath = path25__default.default.join(workspacePath, ".cascadeignore");
+    const filePath = path26__default.default.join(workspacePath, ".cascadeignore");
     try {
-      const content = await fs9__default.default.readFile(filePath, "utf-8");
+      const content = await fs10__default.default.readFile(filePath, "utf-8");
       const lines = content.split("\n").filter((l) => l.trim() && !l.startsWith("#"));
       this.ig.add(lines);
       this.loaded = true;
@@ -1978,7 +1998,7 @@ var CascadeIgnore = class {
   }
   isIgnored(filePath, workspacePath) {
     try {
-      const relative = workspacePath ? path25__default.default.relative(workspacePath, filePath) : filePath;
+      const relative = workspacePath ? path26__default.default.relative(workspacePath, filePath) : filePath;
       return this.ig.ignores(relative);
     } catch {
       return false;
@@ -1989,7 +2009,7 @@ var CascadeIgnore = class {
   }
 };
 async function createDefaultIgnoreFile(workspacePath) {
-  const filePath = path25__default.default.join(workspacePath, ".cascadeignore");
+  const filePath = path26__default.default.join(workspacePath, ".cascadeignore");
   const content = `# .cascadeignore \u2014 Files Cascade agents cannot read or modify
 # Syntax identical to .gitignore
 
@@ -2016,12 +2036,12 @@ build/
 .DS_Store
 Thumbs.db
 `;
-  await fs9__default.default.writeFile(filePath, content, "utf-8");
+  await fs10__default.default.writeFile(filePath, content, "utf-8");
 }
 async function loadCascadeMd(workspacePath) {
-  const filePath = path25__default.default.join(workspacePath, "CASCADE.md");
+  const filePath = path26__default.default.join(workspacePath, "CASCADE.md");
   try {
-    const raw = await fs9__default.default.readFile(filePath, "utf-8");
+    const raw = await fs10__default.default.readFile(filePath, "utf-8");
     return parseCascadeMd(raw);
   } catch {
     return null;
@@ -2048,7 +2068,7 @@ ${raw.trim()}`;
   return { raw, sections, systemPrompt };
 }
 async function createDefaultCascadeMd(workspacePath) {
-  const filePath = path25__default.default.join(workspacePath, "CASCADE.md");
+  const filePath = path26__default.default.join(workspacePath, "CASCADE.md");
   const content = `# Cascade Project Instructions
 
 This file contains project-specific instructions for the Cascade AI agent.
@@ -2078,12 +2098,12 @@ All tools are allowed unless specified otherwise.
 
 List any areas the agent should not touch.
 `;
-  await fs9__default.default.writeFile(filePath, content, "utf-8");
+  await fs10__default.default.writeFile(filePath, content, "utf-8");
 }
 var MemoryStore = class _MemoryStore {
   db;
   constructor(dbPath) {
-    fs23__default.default.mkdirSync(path25__default.default.dirname(dbPath), { recursive: true });
+    fs24__default.default.mkdirSync(path26__default.default.dirname(dbPath), { recursive: true });
     try {
       this.db = new Database2__default.default(dbPath, { timeout: 5e3 });
       this.db.pragma("journal_mode = WAL");
@@ -3048,8 +3068,11 @@ var CascadeConfigSchema = zod.z.object({
    * Cascade Auto: when true, the TaskAnalyzer selects the optimal model for each
    * tier based on task type and complexity, overriding the static priority lists.
    * Heuristic-first with AI inference fallback (adds ~0–500ms per task).
+   * ON by default since v0.19.0 — "Auto" without it was just a static priority
+   * list, not the benchmark-value routing the docs describe. Explicit per-tier
+   * model pins are unaffected; disable via config/Settings → Advanced.
    */
-  cascadeAuto: zod.z.boolean().default(false),
+  cascadeAuto: zod.z.boolean().default(true),
   /**
    * Cascade Auto trade-off bias when picking a model for a task:
    *   - 'balanced' (default): quality × cost-efficiency — cheap models win
@@ -3230,6 +3253,63 @@ function validateConfig(raw) {
   return result.data;
 }
 
+// src/config/global-credentials.ts
+init_constants();
+function credentialsPath(globalDir) {
+  return path26__default.default.join(globalDir, GLOBAL_CREDENTIALS_FILE);
+}
+function providerKey(p) {
+  if (p.type === "azure") {
+    return `azure:${p.deploymentName ?? p.baseUrl ?? p.label ?? ""}`;
+  }
+  return p.type;
+}
+function isPersistable(p) {
+  return Boolean(p.apiKey || p.authToken || p.type === "azure" || p.baseUrl);
+}
+function loadGlobalCredentials(globalDir) {
+  try {
+    const raw = fs24__default.default.readFileSync(credentialsPath(globalDir), "utf-8");
+    const parsed = JSON.parse(raw);
+    if (!Array.isArray(parsed.providers)) return [];
+    return parsed.providers.filter(
+      (p) => Boolean(p) && typeof p.type === "string"
+    );
+  } catch {
+    return [];
+  }
+}
+function saveGlobalCredentials(globalDir, providers) {
+  const filePath = credentialsPath(globalDir);
+  fs24__default.default.mkdirSync(globalDir, { recursive: true, mode: 448 });
+  const body = { version: 1, providers: providers.filter(isPersistable) };
+  const tmp = `${filePath}.tmp`;
+  fs24__default.default.writeFileSync(tmp, JSON.stringify(body, null, 2), { encoding: "utf-8", mode: 384 });
+  fs24__default.default.renameSync(tmp, filePath);
+  try {
+    fs24__default.default.chmodSync(filePath, 384);
+  } catch {
+  }
+}
+function mergeGlobalCredentials(workspaceProviders, globalProviders) {
+  const merged = [...workspaceProviders];
+  const byKey = new Map(merged.map((p) => [providerKey(p), p]));
+  for (const g of globalProviders) {
+    const existing = byKey.get(providerKey(g));
+    if (!existing) {
+      merged.push({ ...g });
+      byKey.set(providerKey(g), merged[merged.length - 1]);
+      continue;
+    }
+    if (!existing.apiKey && g.apiKey) existing.apiKey = g.apiKey;
+    if (!existing.authToken && g.authToken) existing.authToken = g.authToken;
+    if (!existing.baseUrl && g.baseUrl) existing.baseUrl = g.baseUrl;
+    if (!existing.apiVersion && g.apiVersion) existing.apiVersion = g.apiVersion;
+    if (!existing.label && g.label) existing.label = g.label;
+  }
+  return merged;
+}
+
 // src/config/index.ts
 init_constants();
 var KEY_OPTIONAL_PROVIDER_TYPES = /* @__PURE__ */ new Set(["ollama", "openai-compatible"]);
@@ -3245,18 +3325,20 @@ var ConfigManager = class {
   cascadeMd = null;
   workspacePath;
   globalDir;
-  constructor(workspacePath = process.cwd()) {
+  /** `globalDirOverride` exists for tests — never point it at the real home dir there. */
+  constructor(workspacePath = process.cwd(), globalDirOverride) {
     this.workspacePath = workspacePath;
-    this.globalDir = path25__default.default.join(os8__default.default.homedir(), GLOBAL_CONFIG_DIR);
+    this.globalDir = globalDirOverride ?? path26__default.default.join(os8__default.default.homedir(), GLOBAL_CONFIG_DIR);
   }
   async load() {
     this.config = await this.loadConfig();
     this.ignore = new CascadeIgnore();
     await this.ignore.load(this.workspacePath);
     this.cascadeMd = await loadCascadeMd(this.workspacePath);
-    this.keystore = new Keystore(path25__default.default.join(this.globalDir, GLOBAL_KEYSTORE_FILE));
-    this.store = new MemoryStore(path25__default.default.join(this.workspacePath, CASCADE_DB_FILE));
+    this.keystore = new Keystore(path26__default.default.join(this.globalDir, GLOBAL_KEYSTORE_FILE));
+    this.store = new MemoryStore(path26__default.default.join(this.workspacePath, CASCADE_DB_FILE));
     await this.injectEnvKeys();
+    this.config.providers = mergeGlobalCredentials(this.config.providers, loadGlobalCredentials(this.globalDir));
     await this.ensureDefaultIdentity();
   }
   getConfig() {
@@ -3278,9 +3360,14 @@ var ConfigManager = class {
     return this.workspacePath;
   }
   async save() {
-    const configPath = path25__default.default.join(this.workspacePath, CASCADE_CONFIG_FILE);
-    await fs9__default.default.mkdir(path25__default.default.dirname(configPath), { recursive: true });
-    await fs9__default.default.writeFile(configPath, JSON.stringify(this.config, null, 2), "utf-8");
+    const configPath = path26__default.default.join(this.workspacePath, CASCADE_CONFIG_FILE);
+    await fs10__default.default.mkdir(path26__default.default.dirname(configPath), { recursive: true });
+    await fs10__default.default.writeFile(configPath, JSON.stringify(this.config, null, 2), "utf-8");
+    try {
+      saveGlobalCredentials(this.globalDir, this.config.providers);
+    } catch (err) {
+      console.warn(`Failed to sync credentials to global store: ${err instanceof Error ? err.message : String(err)}`);
+    }
   }
   async updateConfig(updates) {
     this.config = validateConfig({ ...this.config, ...updates });
@@ -3303,9 +3390,9 @@ var ConfigManager = class {
     return configProvider?.apiKey;
   }
   async loadConfig() {
-    const configPath = path25__default.default.join(this.workspacePath, CASCADE_CONFIG_FILE);
+    const configPath = path26__default.default.join(this.workspacePath, CASCADE_CONFIG_FILE);
     try {
-      const raw = await fs9__default.default.readFile(configPath, "utf-8");
+      const raw = await fs10__default.default.readFile(configPath, "utf-8");
       return validateConfig(JSON.parse(raw));
     } catch (err) {
       if (err.code === "ENOENT") {
@@ -4182,7 +4269,7 @@ init_constants();
 var DEFAULT_SNAPSHOT_URL = "https://raw.githubusercontent.com/Varun-SV/Cascade-AI/main/src/core/router/benchmark-data.json";
 var OPENROUTER_MODELS_URL = "https://openrouter.ai/api/v1/models";
 var FETCH_TIMEOUT_MS = 8e3;
-var DEFAULT_CACHE_FILE = path25__default.default.join(os8__default.default.homedir(), GLOBAL_CONFIG_DIR, "benchmarks-cache.json");
+var DEFAULT_CACHE_FILE = path26__default.default.join(os8__default.default.homedir(), GLOBAL_CONFIG_DIR, "benchmarks-cache.json");
 function normalizeModelId(id) {
   let s = id.toLowerCase();
   const slash = s.lastIndexOf("/");
@@ -4215,7 +4302,7 @@ var LiveDataProvider = class {
     if (this.loaded) return;
     this.loaded = true;
     try {
-      const raw = await fs9__default.default.readFile(this.opts.cacheFile, "utf-8");
+      const raw = await fs10__default.default.readFile(this.opts.cacheFile, "utf-8");
       const cache = JSON.parse(raw);
       if (cache.snapshot?.families) {
         this.snapshot = cache.snapshot;
@@ -4327,14 +4414,14 @@ var LiveDataProvider = class {
   }
   async saveCache() {
     try {
-      await fs9__default.default.mkdir(path25__default.default.dirname(this.opts.cacheFile), { recursive: true });
+      await fs10__default.default.mkdir(path26__default.default.dirname(this.opts.cacheFile), { recursive: true });
       const cache = {
         fetchedAt: this.fetchedAt,
         snapshot: this.snapshot ?? void 0,
         prices: Object.fromEntries(this.prices),
         capabilities: Object.fromEntries(this.capabilities)
       };
-      await fs9__default.default.writeFile(this.opts.cacheFile, JSON.stringify(cache, null, 2), "utf-8");
+      await fs10__default.default.writeFile(this.opts.cacheFile, JSON.stringify(cache, null, 2), "utf-8");
     } catch {
     }
   }
@@ -4539,6 +4626,12 @@ var CascadeRouter = class _CascadeRouter extends EventEmitter__default.default {
       const results = await Promise.all(ocConfigs.map((cfg) => this.discoverOpenAICompatibleModels(cfg)));
       if (results.some(Boolean)) this.selector.markProviderAvailable("openai-compatible");
     }
+    if (availableProviders.has("azure")) {
+      for (const cfg of config.providers) {
+        const model = azureModelForDeployment(cfg);
+        if (model) this.selector.addDynamicModel(model);
+      }
+    }
     for (const tier of ["T1", "T2", "T3"]) {
       const override = tier === "T1" ? config.models.t1 : tier === "T2" ? config.models.t2 : config.models.t3;
       if (!override || override === "auto") continue;
@@ -5145,7 +5238,7 @@ var CascadeRouter = class _CascadeRouter extends EventEmitter__default.default {
   ensureProvider(model, configs) {
     const key = `${model.provider}:${model.id}`;
     if (this.providers.has(key)) return;
-    const cfg = configs.find((c) => c.type === model.provider) ?? { type: model.provider };
+    const cfg = (model.provider === "azure" ? configs.find((c) => c.type === "azure" && c.deploymentName === model.id) : void 0) ?? configs.find((c) => c.type === model.provider) ?? { type: model.provider };
     const provider = this.createProvider(cfg, model);
     this.providers.set(key, provider);
   }
@@ -5305,6 +5398,12 @@ var BaseTier = class extends EventEmitter__default.default {
    * which would interleave, are not tagged.
    */
   isPresenter = false;
+  /**
+   * The model actually serving this tier (`provider:id`), once resolved —
+   * rides on every tier:status event so the desktop can show which model ran
+   * which node (Cockpit node panel / Why panel).
+   */
+  servingModel;
   constructor(role, id, parentId) {
     super();
     this.role = role;
@@ -5329,11 +5428,16 @@ var BaseTier = class extends EventEmitter__default.default {
       label: this.label,
       status,
       timestamp,
-      output
+      output,
+      model: this.servingModel
     };
     this.emit("status", event);
     this.emit("tier:status", event);
   }
+  /** Record the model serving this tier; future status events carry it. */
+  setServingModel(model) {
+    this.servingModel = model || void 0;
+  }
   setLabel(label) {
     this.label = label;
   }
@@ -5356,7 +5460,8 @@ var BaseTier = class extends EventEmitter__default.default {
       currentAction: update.currentAction,
       progressPct: update.progressPct,
       timestamp,
-      output: update.output
+      output: update.output,
+      model: this.servingModel
     });
   }
   buildMessage(type, to, payload) {
@@ -5723,6 +5828,21 @@ Available tools: ${tools.map((t) => t.name).join(", ")}.
 When you have enough information, stop calling tools and write your final answer.`;
 }
 
+// src/utils/truncate.ts
+function truncateForContext(text, maxChars = 12e3) {
+  if (text.length <= maxChars) return text;
+  const headLen = Math.floor(maxChars * 0.75);
+  const tailLen = maxChars - headLen;
+  const head = text.slice(0, headLen);
+  const tail = text.slice(-tailLen);
+  const elided = text.length - headLen - tailLen;
+  return `${head}
+
+[... ${elided.toLocaleString()} characters elided to keep context small \u2014 re-read the file with a line range if you need the middle ...]
+
+${tail}`;
+}
+
 // src/core/tiers/t3-worker.ts
 var CriticalToolError = class extends Error {
   constructor(message, toolName) {
@@ -6030,6 +6150,7 @@ Now execute your subtask using this context where relevant.`
     } catch {
     }
     const effectiveModel = subtaskModel ?? this.router.getModelForTier("T3");
+    if (effectiveModel) this.setServingModel(`${effectiveModel.provider}:${effectiveModel.id}`);
     const useTextTools = effectiveModel?.supportsToolUse === false && tools.length > 0;
     let sentFullTextContract = false;
     let textContractSignature = "";
@@ -6127,7 +6248,7 @@ HIERARCHY CONTEXT: ${this.hierarchyContext}` : "") + textToolSuffix,
         const toolResult = await this.executeTool(tc);
         await this.context.addMessage({
           role: "tool",
-          content: toolResult,
+          content: truncateForContext(toolResult),
           toolCallId: tc.id
         });
       }
@@ -6231,8 +6352,8 @@ HIERARCHY CONTEXT: ${this.hierarchyContext}` : "") + textToolSuffix,
         tierId: this.id,
         sessionId: this.taskId,
         requireApproval: false,
-        saveSnapshot: async (path30, content) => {
-          this.store?.addFileSnapshot(this.taskId, path30, content);
+        saveSnapshot: async (path31, content) => {
+          this.store?.addFileSnapshot(this.taskId, path31, content);
         },
         sendPeerSync: (to, syncType, content) => {
           this.peerBus?.send(this.id, to, syncType, this.assignment?.subtaskId ?? "", content);
@@ -6384,15 +6505,17 @@ ${assignment.expectedOutput}`;
     };
   }
   requiresArtifact() {
+    if (this.assignment?.files?.length) return true;
     const haystack = `${this.assignment?.description ?? ""}
 ${this.assignment?.expectedOutput ?? ""}`;
     return /\b[\w./-]+\.(pdf|md|html|txt|json|csv|py|js|ts|tsx|jsx|docx?|png|jpg|jpeg|svg|gif)\b/i.test(haystack) || /save (?:a|the)? file|create (?:a|the)? file|write (?:a|the)? file/i.test(haystack);
   }
   extractArtifactPaths(assignment) {
+    const declared = (assignment.files ?? []).map((f) => f.trim()).filter((f) => f.includes("."));
     const haystack = `${assignment.description}
 ${assignment.expectedOutput}`;
     const matches = haystack.match(/\b[\w./-]+\.(pdf|md|html|txt|json|csv|py|js|ts|tsx|jsx|docx?|png|jpg|jpeg|svg|gif)\b/gi) ?? [];
-    return [...new Set(matches.map((m) => m.trim()))];
+    return [.../* @__PURE__ */ new Set([...declared, ...matches.map((m) => m.trim())])];
   }
   async verifyArtifacts(assignment) {
     const artifactPaths = this.extractArtifactPaths(assignment);
@@ -6402,9 +6525,9 @@ ${assignment.expectedOutput}`;
     const { promisify: promisify4 } = await import('util');
     const execAsync3 = promisify4(exec3);
     for (const artifactPath of artifactPaths) {
-      const absolutePath = path25__default.default.resolve(process.cwd(), artifactPath);
+      const absolutePath = path26__default.default.resolve(process.cwd(), artifactPath);
       try {
-        const stat = await fs9__default.default.stat(absolutePath);
+        const stat = await fs10__default.default.stat(absolutePath);
         if (!stat.isFile()) {
           issues.push(`Expected artifact is not a file: ${artifactPath}`);
           continue;
@@ -6414,7 +6537,7 @@ ${assignment.expectedOutput}`;
           continue;
         }
         if (!/\.pdf$/i.test(artifactPath)) {
-          const content = await fs9__default.default.readFile(absolutePath, "utf-8");
+          const content = await fs10__default.default.readFile(absolutePath, "utf-8");
           if (!content.trim()) {
             issues.push(`Artifact content is empty: ${artifactPath}`);
             continue;
@@ -6423,7 +6546,7 @@ ${assignment.expectedOutput}`;
           issues.push(`PDF artifact looks too small to be valid: ${artifactPath}`);
           continue;
         }
-        const ext = path25__default.default.extname(absolutePath).toLowerCase();
+        const ext = path26__default.default.extname(absolutePath).toLowerCase();
         try {
           if (ext === ".ts" || ext === ".tsx") {
             await execAsync3(`npx tsc --noEmit ${absolutePath}`, { timeout: 1e4 });
@@ -6515,7 +6638,9 @@ HIERARCHY CONTEXT: ${this.hierarchyContext}` : ""),
 Assignment: ${assignment.description}
 Expected output: ${assignment.expectedOutput}
 Constraints: ${assignment.constraints.join("; ")}
-
+${assignment.acceptance?.length ? `Acceptance criteria \u2014 ALL must be satisfied for "completeness" to pass:
+${assignment.acceptance.map((a) => `- ${a}`).join("\n")}
+` : ""}
 Output to test:
 ${output}
 
@@ -6604,17 +6729,27 @@ Your subtask:
 - Title: ${assignment.subtaskTitle}
 - Description: ${assignment.description}
 - Expected output: ${assignment.expectedOutput}
-- Constraints: ${assignment.constraints.join("; ")}`;
+- Constraints: ${assignment.constraints.join("; ")}${assignment.files?.length ? `
+- Files you own (create/edit ONLY these): ${assignment.files.join(", ")}` : ""}${assignment.acceptance?.length ? `
+- Definition of done: ${assignment.acceptance.join("; ")}` : ""}`;
   }
   buildInitialPrompt(assignment) {
     return `Execute the following subtask completely:
 
 **${assignment.subtaskTitle}**
-
+${assignment.contextBrief ? `
+Context: ${assignment.contextBrief}
+` : ""}
 ${assignment.description}
 
 Expected output: ${assignment.expectedOutput}
-
+${assignment.files?.length ? `
+Files you own (create or edit exactly these paths):
+${assignment.files.map((f) => `- ${f}`).join("\n")}
+` : ""}${assignment.acceptance?.length ? `
+Definition of done (your output must satisfy ALL of these):
+${assignment.acceptance.map((a) => `- ${a}`).join("\n")}
+` : ""}
 Constraints:
 ${assignment.constraints.map((c) => `- ${c}`).join("\n")}
 
@@ -7095,6 +7230,8 @@ var T2Manager = class extends BaseTier {
     this.assignment = assignment;
     this.taskId = taskId;
     this.setLabel(assignment.sectionTitle);
+    const m = this.router.getModelForTier("T2");
+    if (m) this.setServingModel(`${m.provider}:${m.id}`);
     this.setStatus("ACTIVE");
     this.sendStatusUpdate({
       progressPct: 0,
@@ -7181,7 +7318,7 @@ Guidance (must be followed): ${decision.note}`
   // ── Private ──────────────────────────────────
   async decomposeSection(assignment) {
     const peerPlans = this.peerSyncBuffer.filter((p) => p.content?.type === "T2_PLAN_ANNOUNCEMENT").map((p) => `[Peer ${p.fromId} Plan]: ${p.content.sectionTitle} - ${p.content.subtaskTitles?.join(", ")}`).join("\n");
-    const prompt = `Decompose this section into 2-5 concrete subtasks for T3 workers.
+    const prompt = `Decompose this section into 1-4 concrete subtasks for T3 workers \u2014 the FEWEST that fully cover it (one subtask is the correct answer for a small section).
 
 Section: ${assignment.sectionTitle}
 Description: ${assignment.description}
@@ -7200,6 +7337,9 @@ Return a JSON array of subtask objects, each with:
 - peerT3Ids: string[] (empty for now)
 - dependsOn: string[] (array of subtaskIds this task depends on to start)
 - executionMode: "parallel|sequential" (default is parallel)
+- files: string[] (the EXACT relative paths this subtask creates or edits)
+- acceptance: string[] (1-3 mechanically checkable done-criteria: file exists / contains X / command exits 0)
+- contextBrief: string (1-3 short sentences with ALL the background the worker needs \u2014 it sees nothing else)
 
 Return ONLY the JSON array.`;
     const messages = [{ role: "user", content: prompt }];
@@ -7800,6 +7940,8 @@ var T1Administrator = class extends BaseTier {
     this.signal = signal;
     this.taskId = crypto.randomUUID();
     this.setLabel("Administrator");
+    const m = this.router.getModelForTier("T1");
+    if (m) this.setServingModel(`${m.provider}:${m.id}`);
     this.setStatus("ACTIVE");
     this.taskGoal = userPrompt;
     this.sendStatusUpdate({
@@ -8046,10 +8188,13 @@ Return JSON where SECTIONS can declare dependencies on other SECTIONS:
       "description": "Run npm init",
       "expectedOutput": "package.json created",
       "constraints": [],
-      "dependsOn": []
+      "dependsOn": [],
+      "files": ["package.json"],                       // \u2190 exact paths this subtask owns
+      "acceptance": ["package.json exists and parses as JSON"],  // \u2190 objectively checkable
+      "contextBrief": "Fresh Node 20 project; npm available."    // \u2190 ALL the background the worker gets
     }]
   }, {
-    "sectionId": "s2", 
+    "sectionId": "s2",
     "sectionTitle": "Write Tests",
     "description": "Write tests for the project",
     "expectedOutput": "Tests passing",
@@ -8059,7 +8204,13 @@ Return JSON where SECTIONS can declare dependencies on other SECTIONS:
   }]
 }
 Use dependsOn at the SECTION level when a whole T2 Manager needs the output of a previous T2 Manager.
-Leave dependsOn empty for sections that can run immediately in parallel.`;
+Leave dependsOn empty for sections that can run immediately in parallel.
+
+SPEC RULES \u2014 each subtask is a self-contained spec slice (workers execute from their slice ALONE):
+- "files": the exact relative paths the subtask creates or edits. Never vague ("some files"); always concrete.
+- "acceptance": 1-3 checks a reviewer could verify mechanically (file exists / contains X / command exits 0). These define done.
+- "contextBrief": 1-3 short sentences with the ONLY background the worker needs. It sees nothing else about the task, so make the brief self-sufficient \u2014 but never pad it.
+- RIGHT-SIZE the plan: use the FEWEST sections and workers that fully cover the task. One section with 1-2 subtasks is the CORRECT plan for a small task; padding a plan with filler sections wastes the user's money.`;
     const messages = [{ role: "user", content: decompositionPrompt }];
     const result = await this.router.generate("T1", {
       messages,
@@ -8514,16 +8665,16 @@ function resolveInWorkspace(workspaceRoot, input) {
   if (typeof input !== "string" || input.length === 0) {
     throw new WorkspaceSandboxError(String(input), workspaceRoot);
   }
-  const root = path25__default.default.resolve(workspaceRoot);
-  const abs = path25__default.default.isAbsolute(input) ? path25__default.default.resolve(input) : path25__default.default.resolve(root, input);
-  const rel = path25__default.default.relative(root, abs);
-  if (rel === "" || rel === ".") ; else if (rel.startsWith("..") || path25__default.default.isAbsolute(rel)) {
+  const root = path26__default.default.resolve(workspaceRoot);
+  const abs = path26__default.default.isAbsolute(input) ? path26__default.default.resolve(input) : path26__default.default.resolve(root, input);
+  const rel = path26__default.default.relative(root, abs);
+  if (rel === "" || rel === ".") ; else if (rel.startsWith("..") || path26__default.default.isAbsolute(rel)) {
     throw new WorkspaceSandboxError(input, root);
   }
   try {
-    const real = fs23__default.default.realpathSync(abs);
-    const realRel = path25__default.default.relative(root, real);
-    if (realRel !== "" && realRel !== "." && (realRel.startsWith("..") || path25__default.default.isAbsolute(realRel))) {
+    const real = fs24__default.default.realpathSync(abs);
+    const realRel = path26__default.default.relative(root, real);
+    if (realRel !== "" && realRel !== "." && (realRel.startsWith("..") || path26__default.default.isAbsolute(realRel))) {
       throw new WorkspaceSandboxError(input, root);
     }
   } catch (e) {
@@ -8550,7 +8701,7 @@ var FileReadTool = class extends BaseTool {
     const absPath = resolveInWorkspace(this.workspaceRoot, filePath);
     const offset = input["offset"] ?? 1;
     const limit = input["limit"];
-    const content = await fs9__default.default.readFile(absPath, "utf-8");
+    const content = await fs10__default.default.readFile(absPath, "utf-8");
     const lines = content.split("\n");
     const start = Math.max(0, offset - 1);
     const end = limit ? start + limit : lines.length;
@@ -8579,13 +8730,13 @@ var FileWriteTool = class extends BaseTool {
     const content = input["content"];
     if (options.saveSnapshot) {
       try {
-        const oldContent = await fs9__default.default.readFile(absPath, "utf-8");
+        const oldContent = await fs10__default.default.readFile(absPath, "utf-8");
         await options.saveSnapshot(absPath, oldContent);
       } catch {
       }
     }
-    await fs9__default.default.mkdir(path25__default.default.dirname(absPath), { recursive: true });
-    await fs9__default.default.writeFile(absPath, content, "utf-8");
+    await fs10__default.default.mkdir(path26__default.default.dirname(absPath), { recursive: true });
+    await fs10__default.default.writeFile(absPath, content, "utf-8");
     return `Written ${content.length} characters to ${filePath}`;
   }
 };
@@ -8611,7 +8762,7 @@ var FileEditTool = class extends BaseTool {
     const oldString = input["old_string"];
     const newString = input["new_string"];
     const replaceAll = input["replace_all"] ?? false;
-    const rawContent = await fs9__default.default.readFile(absPath, "utf-8");
+    const rawContent = await fs10__default.default.readFile(absPath, "utf-8");
     if (options.saveSnapshot) {
       await options.saveSnapshot(absPath, rawContent);
     }
@@ -8623,7 +8774,7 @@ var FileEditTool = class extends BaseTool {
       );
     }
     const updated = replaceAll ? content.split(normalizedOld).join(newString) : content.replace(normalizedOld, newString);
-    await fs9__default.default.writeFile(absPath, updated, "utf-8");
+    await fs10__default.default.writeFile(absPath, updated, "utf-8");
     const count = replaceAll ? content.split(normalizedOld).length - 1 : 1;
     return `Replaced ${count} occurrence(s) in ${filePath}`;
   }
@@ -8646,12 +8797,12 @@ var FileDeleteTool = class extends BaseTool {
     const absPath = resolveInWorkspace(this.workspaceRoot, filePath);
     if (options.saveSnapshot) {
       try {
-        const oldContent = await fs9__default.default.readFile(absPath, "utf-8");
+        const oldContent = await fs10__default.default.readFile(absPath, "utf-8");
         await options.saveSnapshot(absPath, oldContent);
       } catch {
       }
     }
-    await fs9__default.default.rm(absPath, { recursive: false });
+    await fs10__default.default.rm(absPath, { recursive: false });
     return `Deleted ${filePath}`;
   }
 };
@@ -8668,7 +8819,7 @@ var FileListTool = class extends BaseTool {
   async execute(input, _options) {
     const inputPath = input["path"] || ".";
     const absPath = resolveInWorkspace(this.workspaceRoot, inputPath);
-    const entries = await fs9__default.default.readdir(absPath, { withFileTypes: true });
+    const entries = await fs10__default.default.readdir(absPath, { withFileTypes: true });
     return entries.map((e) => `${e.isDirectory() ? "[DIR] " : "      "}${e.name}`).join("\n") || "(empty directory)";
   }
 };
@@ -9081,8 +9232,8 @@ var ImageAnalyzeTool = class extends BaseTool {
   }
 };
 async function fileToImageAttachment(filePath) {
-  const data = await fs9__default.default.readFile(filePath);
-  const ext = path25__default.default.extname(filePath).toLowerCase();
+  const data = await fs10__default.default.readFile(filePath);
+  const ext = path26__default.default.extname(filePath).toLowerCase();
   const mimeMap = {
     ".jpg": "image/jpeg",
     ".jpeg": "image/jpeg",
@@ -9116,14 +9267,14 @@ var PDFCreateTool = class extends BaseTool {
     const filePath = input["path"];
     const content = input["content"];
     const title = input["title"];
-    const dir = path25__default.default.dirname(filePath);
-    if (!fs23__default.default.existsSync(dir)) {
-      fs23__default.default.mkdirSync(dir, { recursive: true });
+    const dir = path26__default.default.dirname(filePath);
+    if (!fs24__default.default.existsSync(dir)) {
+      fs24__default.default.mkdirSync(dir, { recursive: true });
     }
     return new Promise((resolve, reject) => {
       try {
         const doc = new PDFDocument__default.default({ margin: 50 });
-        const stream = fs23__default.default.createWriteStream(filePath);
+        const stream = fs24__default.default.createWriteStream(filePath);
         doc.pipe(stream);
         if (title) {
           doc.info["Title"] = title;
@@ -9201,22 +9352,22 @@ var CodeInterpreterTool = class extends BaseTool {
       }
       cmdPrefix = NODE_CMD;
     }
-    const tmpDir = path25__default.default.join(this.workspaceRoot, ".cascade", "tmp");
-    if (!fs23__default.default.existsSync(tmpDir)) {
-      fs23__default.default.mkdirSync(tmpDir, { recursive: true });
+    const tmpDir = path26__default.default.join(this.workspaceRoot, ".cascade", "tmp");
+    if (!fs24__default.default.existsSync(tmpDir)) {
+      fs24__default.default.mkdirSync(tmpDir, { recursive: true });
     }
     const extension = language === "python" ? "py" : "js";
     const fileName = `intp_${crypto.randomUUID().slice(0, 8)}.${extension}`;
-    const filePath = path25__default.default.join(tmpDir, fileName);
-    fs23__default.default.writeFileSync(filePath, code, "utf-8");
+    const filePath = path26__default.default.join(tmpDir, fileName);
+    fs24__default.default.writeFileSync(filePath, code, "utf-8");
     const execArgs = [filePath, ...args];
     return new Promise((resolve) => {
       const startMs = Date.now();
       child_process.execFile(cmdPrefix, execArgs, { cwd: this.workspaceRoot, timeout: 3e4 }, (error, stdout, stderr) => {
         const duration = Date.now() - startMs;
         try {
-          if (fs23__default.default.existsSync(filePath)) {
-            fs23__default.default.unlinkSync(filePath);
+          if (fs24__default.default.existsSync(filePath)) {
+            fs24__default.default.unlinkSync(filePath);
           }
         } catch (cleanupErr) {
           console.error(`Failed to cleanup interpreter script ${filePath}:`, cleanupErr);
@@ -9367,30 +9518,56 @@ async function searchTavily(query, apiKey, maxResults) {
     engine: "tavily"
   }));
 }
-async function searchDuckDuckGoLite(query, maxResults) {
-  const resp = await fetch(`https://lite.duckduckgo.com/lite/?q=${encodeURIComponent(query)}`, {
-    headers: { "User-Agent": "Mozilla/5.0 (compatible; Cascade-AI/1.0)" },
-    signal: AbortSignal.timeout(1e4)
-  });
-  if (!resp.ok) throw new Error(`DuckDuckGo Lite returned HTTP ${resp.status}`);
-  const html = await resp.text();
-  const linkPattern = /<a[^>]+class="result-link"[^>]+href="([^"]+)"[^>]*>([^<]+)<\/a>/g;
-  const snippetPattern = /<td[^>]+class="result-snippet"[^>]*>([\s\S]*?)<\/td>/g;
-  const links = [];
-  const snippets = [];
+var BROWSER_UA = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36";
+function unwrapDdgRedirect(href) {
+  try {
+    const url = new URL(href.startsWith("//") ? `https:${href}` : href, "https://duckduckgo.com");
+    if (/(^|\.)duckduckgo\.com$/i.test(url.hostname) && url.pathname.startsWith("/l/")) {
+      const target = url.searchParams.get("uddg");
+      if (target) return decodeURIComponent(target);
+    }
+    return url.protocol === "http:" || url.protocol === "https:" ? url.toString() : href;
+  } catch {
+    return href;
+  }
+}
+function stripTags(html) {
+  return html.replace(/<[^>]+>/g, "").replace(/\s+/g, " ").trim();
+}
+function decodeEntities(text) {
+  return text.replace(/&amp;/g, "&").replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&quot;/g, '"').replace(/&#x27;|&#39;/g, "'").replace(/&nbsp;/g, " ");
+}
+function parseDdgAnchors(html, anchorClass, snippetClass) {
+  const anchorRe = new RegExp(`<a\\b[^>]*class=["']?[^"'>]*\\b${anchorClass}\\b[^"'>]*["']?[^>]*>([\\s\\S]*?)<\\/a>`, "gi");
+  const snippetRe = new RegExp(`class=["']?[^"'>]*\\b${snippetClass}\\b[^"'>]*["']?[^>]*>([\\s\\S]*?)<\\/(?:td|a|div|span)>`, "gi");
+  const results = [];
   let m;
-  while ((m = linkPattern.exec(html)) !== null) {
-    links.push({ url: m[1], title: m[2].trim() });
+  while ((m = anchorRe.exec(html)) !== null) {
+    const tag = m[0];
+    const href = /href=["']([^"']+)["']/i.exec(tag)?.[1];
+    const title = decodeEntities(stripTags(m[1] ?? ""));
+    if (!href || !title) continue;
+    results.push({ title, url: unwrapDdgRedirect(decodeEntities(href)), snippet: "" });
   }
-  while ((m = snippetPattern.exec(html)) !== null) {
-    snippets.push(m[1].replace(/<[^>]+>/g, "").trim());
+  const snippets = [];
+  while ((m = snippetRe.exec(html)) !== null) {
+    snippets.push(decodeEntities(stripTags(m[1] ?? "")));
   }
-  return links.slice(0, maxResults).map((link, i) => ({
-    title: link.title,
-    url: link.url,
-    snippet: snippets[i] ?? "",
-    engine: "duckduckgo-lite"
-  }));
+  for (let i = 0; i < results.length; i++) {
+    if (snippets[i]) results[i].snippet = snippets[i];
+  }
+  return results;
+}
+async function searchDuckDuckGo(query, maxResults, variant) {
+  const base = variant === "html" ? "https://html.duckduckgo.com/html/?q=" : "https://lite.duckduckgo.com/lite/?q=";
+  const resp = await fetch(`${base}${encodeURIComponent(query)}`, {
+    headers: { "User-Agent": BROWSER_UA, Accept: "text/html" },
+    signal: AbortSignal.timeout(1e4)
+  });
+  if (!resp.ok) throw new Error(`DuckDuckGo ${variant} returned HTTP ${resp.status}`);
+  const html = await resp.text();
+  const parsed = variant === "html" ? parseDdgAnchors(html, "result__a", "result__snippet") : parseDdgAnchors(html, "result-link", "result-snippet");
+  return parsed.slice(0, maxResults).map((r) => ({ ...r, engine: `duckduckgo-${variant}` }));
 }
 var WebSearchTool = class extends BaseTool {
   name = "web_search";
@@ -9449,12 +9626,14 @@ var WebSearchTool = class extends BaseTool {
         errors.push(`Tavily: ${err instanceof Error ? err.message : String(err)}`);
       }
     }
-    try {
-      results = await searchDuckDuckGoLite(query, maxResults);
-      if (results.length > 0) return this.formatResults(query, results);
-      errors.push("DuckDuckGo Lite: returned 0 results");
-    } catch (err) {
-      errors.push(`DuckDuckGo Lite: ${err instanceof Error ? err.message : String(err)}`);
+    for (const variant of ["html", "lite"]) {
+      try {
+        results = await searchDuckDuckGo(query, maxResults, variant);
+        if (results.length > 0) return this.formatResults(query, results);
+        errors.push(`DuckDuckGo ${variant}: returned 0 results`);
+      } catch (err) {
+        errors.push(`DuckDuckGo ${variant}: ${err instanceof Error ? err.message : String(err)}`);
+      }
     }
     const configHint = !this.config.searxngUrl && !this.config.braveApiKey && !this.config.tavilyApiKey ? "\nTip: Configure a search backend for better results:\n  \u2022 Self-hosted: set SEARXNG_URL in your environment\n  \u2022 Brave Search API: set BRAVE_SEARCH_API_KEY\n  \u2022 Tavily API: set TAVILY_API_KEY" : "";
     return [
@@ -9495,7 +9674,7 @@ var GlobTool = class extends BaseTool {
   };
   async execute(input, _options) {
     const pattern = input["pattern"];
-    const searchPath = input["path"] ? path25__default.default.resolve(this.workspaceRoot, input["path"]) : this.workspaceRoot;
+    const searchPath = input["path"] ? path26__default.default.resolve(this.workspaceRoot, input["path"]) : this.workspaceRoot;
     const matches = await glob.glob(pattern, {
       cwd: searchPath,
       ignore: ["node_modules/**", ".git/**", "dist/**", "build/**"],
@@ -9508,7 +9687,7 @@ var GlobTool = class extends BaseTool {
     const withMtime = await Promise.all(
       matches.map(async (rel) => {
         try {
-          const stat = await fs9__default.default.stat(path25__default.default.join(searchPath, rel));
+          const stat = await fs10__default.default.stat(path26__default.default.join(searchPath, rel));
           return { rel, mtime: stat.mtimeMs };
         } catch {
           return { rel, mtime: 0 };
@@ -9557,7 +9736,7 @@ var GrepTool = class extends BaseTool {
   };
   async execute(input, _options) {
     const pattern = input["pattern"];
-    const searchPath = input["path"] ? path25__default.default.resolve(this.workspaceRoot, input["path"]) : this.workspaceRoot;
+    const searchPath = input["path"] ? path26__default.default.resolve(this.workspaceRoot, input["path"]) : this.workspaceRoot;
     const globPattern = input["glob"];
     const outputMode = input["output_mode"] ?? "content";
     const context = input["context"] ?? 0;
@@ -9611,15 +9790,15 @@ var GrepTool = class extends BaseTool {
         nodir: true
       });
     } catch {
-      files = [path25__default.default.relative(searchPath, searchPath) || "."];
+      files = [path26__default.default.relative(searchPath, searchPath) || "."];
     }
     const results = [];
     let totalCount = 0;
     for (const rel of files) {
-      const abs = path25__default.default.join(searchPath, rel);
+      const abs = path26__default.default.join(searchPath, rel);
       let content;
       try {
-        content = await fs9__default.default.readFile(abs, "utf-8");
+        content = await fs10__default.default.readFile(abs, "utf-8");
       } catch {
         continue;
       }
@@ -9978,10 +10157,10 @@ var ToolRegistry = class extends EventEmitter__default.default {
   }
   isIgnored(filePath) {
     if (!filePath) return false;
-    const abs = path25__default.default.resolve(this.workspaceRoot, filePath);
-    const rel = path25__default.default.relative(this.workspaceRoot, abs);
-    if (!rel || rel.startsWith("..") || path25__default.default.isAbsolute(rel)) return true;
-    const posixRel = rel.split(path25__default.default.sep).join("/");
+    const abs = path26__default.default.resolve(this.workspaceRoot, filePath);
+    const rel = path26__default.default.relative(this.workspaceRoot, abs);
+    if (!rel || rel.startsWith("..") || path26__default.default.isAbsolute(rel)) return true;
+    const posixRel = rel.split(path26__default.default.sep).join("/");
     return this.ignoreMatcher.ignores(posixRel);
   }
 };
@@ -10504,7 +10683,7 @@ var TaskAnalyzer = class {
     analysisCache.clear();
   }
 };
-var DEFAULT_STATS_FILE = path25__default.default.join(os8__default.default.homedir(), ".cascade", "model-perf.json");
+var DEFAULT_STATS_FILE = path26__default.default.join(os8__default.default.homedir(), ".cascade", "model-perf.json");
 var ModelPerformanceTracker = class {
   stats = /* @__PURE__ */ new Map();
   featureStats = /* @__PURE__ */ new Map();
@@ -10517,7 +10696,7 @@ var ModelPerformanceTracker = class {
     if (this.loaded) return;
     this.loaded = true;
     try {
-      const raw = await fs9__default.default.readFile(this.statsFile, "utf-8");
+      const raw = await fs10__default.default.readFile(this.statsFile, "utf-8");
       const parsed = JSON.parse(raw);
       if (parsed.models) {
         for (const [key, stat] of Object.entries(parsed.models)) this.stats.set(key, stat);
@@ -10536,12 +10715,12 @@ var ModelPerformanceTracker = class {
   }
   async save() {
     try {
-      await fs9__default.default.mkdir(path25__default.default.dirname(this.statsFile), { recursive: true });
+      await fs10__default.default.mkdir(path26__default.default.dirname(this.statsFile), { recursive: true });
       const modelsObj = {};
       const featuresObj = {};
       for (const [key, stat] of this.stats) modelsObj[key] = stat;
       for (const [key, stat] of this.featureStats) featuresObj[key] = stat;
-      await fs9__default.default.writeFile(this.statsFile, JSON.stringify({ models: modelsObj, features: featuresObj }, null, 2), "utf-8");
+      await fs10__default.default.writeFile(this.statsFile, JSON.stringify({ models: modelsObj, features: featuresObj }, null, 2), "utf-8");
     } catch {
     }
   }
@@ -11075,9 +11254,9 @@ Required capability: ${description.slice(0, 300)}`;
    *  any dangerous action, so a silently-reloaded tool can't act without approval. */
   async loadPersistedTools() {
     if (!this.workspacePath || !this.persistEnabled) return;
-    const file = path25__default.default.join(this.workspacePath, ".cascade", DYNAMIC_TOOLS_FILE);
+    const file = path26__default.default.join(this.workspacePath, ".cascade", DYNAMIC_TOOLS_FILE);
     try {
-      const raw = await fs9__default.default.readFile(file, "utf-8");
+      const raw = await fs10__default.default.readFile(file, "utf-8");
       const specs = JSON.parse(raw);
       if (!Array.isArray(specs)) return;
       let loaded = 0;
@@ -11099,11 +11278,11 @@ Required capability: ${description.slice(0, 300)}`;
   }
   async persist() {
     if (!this.workspacePath || !this.persistEnabled) return;
-    const dir = path25__default.default.join(this.workspacePath, ".cascade");
-    const file = path25__default.default.join(dir, DYNAMIC_TOOLS_FILE);
+    const dir = path26__default.default.join(this.workspacePath, ".cascade");
+    const file = path26__default.default.join(dir, DYNAMIC_TOOLS_FILE);
     try {
-      await fs9__default.default.mkdir(dir, { recursive: true });
-      await fs9__default.default.writeFile(file, JSON.stringify(Array.from(this.specs.values()), null, 2), "utf-8");
+      await fs10__default.default.mkdir(dir, { recursive: true });
+      await fs10__default.default.writeFile(file, JSON.stringify(Array.from(this.specs.values()), null, 2), "utf-8");
     } catch (err) {
       this.log(`[tool-creator] Failed to persist tools: ${err instanceof Error ? err.message : String(err)}`);
     }
@@ -11120,12 +11299,12 @@ var WorldStateDB = class {
   constructor(workspacePath, debugMode = false) {
     this.workspacePath = workspacePath;
     this.debugMode = debugMode;
-    const cascadeDir = path25__default.default.join(workspacePath, ".cascade");
-    if (!fs23__default.default.existsSync(cascadeDir)) {
-      fs23__default.default.mkdirSync(cascadeDir, { recursive: true });
+    const cascadeDir = path26__default.default.join(workspacePath, ".cascade");
+    if (!fs24__default.default.existsSync(cascadeDir)) {
+      fs24__default.default.mkdirSync(cascadeDir, { recursive: true });
     }
-    this.keyPath = path25__default.default.join(cascadeDir, "world_state.key");
-    this.dbPath = path25__default.default.join(cascadeDir, "world_state.db");
+    this.keyPath = path26__default.default.join(cascadeDir, "world_state.key");
+    this.dbPath = path26__default.default.join(cascadeDir, "world_state.db");
     this.initEncryptionKey();
     this.db = new Database2__default.default(this.dbPath);
     this.db.pragma("journal_mode = WAL");
@@ -11155,11 +11334,11 @@ var WorldStateDB = class {
   dbPath;
   encryptionKey;
   initEncryptionKey() {
-    if (fs23__default.default.existsSync(this.keyPath)) {
-      this.encryptionKey = fs23__default.default.readFileSync(this.keyPath);
+    if (fs24__default.default.existsSync(this.keyPath)) {
+      this.encryptionKey = fs24__default.default.readFileSync(this.keyPath);
     } else {
       this.encryptionKey = crypto__default.default.randomBytes(32);
-      fs23__default.default.writeFileSync(this.keyPath, this.encryptionKey);
+      fs24__default.default.writeFileSync(this.keyPath, this.encryptionKey);
     }
   }
   encrypt(text) {
@@ -11300,6 +11479,22 @@ var WorldStateDB = class {
     }
     return selected.slice(0, limit).map((f) => `- ${f.entity} ${f.relation} ${f.value}`).join("\n");
   }
+  /**
+   * Delete one fact by its (normalized) entity + relation key. Returns whether
+   * a row was actually removed. Powers the desktop Knowledge tab's per-fact
+   * delete — users can prune what the planner remembers about their project.
+   */
+  deleteFact(entity, relation) {
+    const e = normalizeKey(entity);
+    const r = normalizeKey(relation);
+    if (!e || !r) return false;
+    const result = this.db.prepare("DELETE FROM facts WHERE entity = ? AND relation = ?").run(e, r);
+    return result.changes > 0;
+  }
+  /** Delete every fact. Returns how many were removed. */
+  clearFacts() {
+    return this.db.prepare("DELETE FROM facts").run().changes;
+  }
   // ── Export / Import ──────────────────────────
   //
   //  Knowledge travels DECRYPTED in the export bundle (a portable plaintext
@@ -11348,9 +11543,9 @@ var WorldStateDB = class {
   dumpDebugIfNeeded() {
     if (!this.debugMode) return;
     try {
-      const dumpPath = path25__default.default.join(os8__default.default.tmpdir(), "cascade_world_state_debug.json");
+      const dumpPath = path26__default.default.join(os8__default.default.tmpdir(), "cascade_world_state_debug.json");
       const entries = this.getAllEntries();
-      fs23__default.default.writeFileSync(dumpPath, JSON.stringify(entries, null, 2), "utf-8");
+      fs24__default.default.writeFileSync(dumpPath, JSON.stringify(entries, null, 2), "utf-8");
     } catch (err) {
       console.error("Failed to dump debug world state", err);
     }
@@ -11785,13 +11980,30 @@ ${last.partialOutput}` : "");
    * explicit multi-part structure, so ordinary single-file asks (handled as
    * Simple/Moderate) don't get over-escalated.
    */
-  looksClearlyComplex(prompt) {
+  /** Shared build/scale signals for the complexity floors below. */
+  buildSignals(prompt) {
     const p = prompt.trim();
-    if (p.length < 24) return false;
+    if (p.length < 24) return { buildVerb: false, scaleCount: 0, multiPart: false };
     const buildVerb = /\b(?:build|implement|create|develop|design|scaffold|refactor|migrate|architect|set up|integrate)\b/i.test(p);
-    const scaleNoun = /\b(?:app(?:lication)?|system|platform|service|api|backend|frontend|full[- ]?stack|website|dashboard|pipeline|microservices?|database schema|authentication|end[- ]to[- ]end|codebase|project|multiple files|several (?:files|modules|components)|test suite)\b/i.test(p);
+    const scaleCount = (p.match(/\b(?:app(?:lication)?|system|platform|service|api|backend|frontend|full[- ]?stack|website|dashboard|pipeline|microservices?|database schema|authentication|end[- ]to[- ]end|codebase|project|multiple files|several (?:files|modules|components)|test suite)\b/gi) ?? []).length;
     const multiPart = /(?:\b(?:and|then|also|plus|as well as)\b.*\b(?:and|then|also)\b)|(?:^|\n)\s*(?:[-*]|\d+[.)])\s+/i.test(p);
-    return buildVerb && (scaleNoun || multiPart);
+    return { buildVerb, scaleCount, multiPart };
+  }
+  /**
+   * A build prompt with REAL scale: multiple system-level deliverables, or a
+   * deliverable plus explicitly multi-part phrasing. Only these floor to the
+   * full T1→T2→T3 hierarchy — "create a todo app" is a build prompt too, but
+   * flooring every small build to Complex was the #1 token bomb (3-5 managers
+   * × workers for a task one worker handles).
+   */
+  looksClearlyComplex(prompt) {
+    const s = this.buildSignals(prompt);
+    return s.buildVerb && (s.scaleCount >= 2 || s.scaleCount >= 1 && s.multiPart);
+  }
+  /** A small single-deliverable build — real work, but one manager's worth. */
+  looksLikeModerateBuild(prompt) {
+    const s = this.buildSignals(prompt);
+    return s.buildVerb && (s.scaleCount >= 1 || s.multiPart);
   }
   // Cache glob scan results per workspace path to avoid repeated I/O.
   static globCache = /* @__PURE__ */ new Map();
@@ -11879,6 +12091,9 @@ ${prompt}` : prompt;
         if (verdict !== "Complex" && this.looksClearlyComplex(prompt)) {
           this.recordDecision("complexity", `Complex \u2014 heuristic floor over classifier "${verdict}": explicit multi-step build/implementation signals (T1 engaged)`);
           verdict = "Complex";
+        } else if (verdict === "Simple" && this.looksLikeModerateBuild(prompt)) {
+          this.recordDecision("complexity", 'Moderate \u2014 heuristic floor over classifier "Simple": build signals without multi-system scale (single manager)');
+          verdict = "Moderate";
         } else {
           this.recordDecision("complexity", `${verdict} \u2014 classifier: ${reason || "no reason given"}`);
         }
@@ -13768,10 +13983,10 @@ function Repl({ config, workspacePath, themeName, initialPrompt, identityName, a
       }
     } catch {
     }
-    const configPath = path25__default.default.join(workspacePath, ".cascade", "config.json");
+    const configPath = path26__default.default.join(workspacePath, ".cascade", "config.json");
     try {
-      await fs9__default.default.mkdir(path25__default.default.dirname(configPath), { recursive: true });
-      await fs9__default.default.writeFile(configPath, JSON.stringify(config, null, 2), "utf-8");
+      await fs10__default.default.mkdir(path26__default.default.dirname(configPath), { recursive: true });
+      await fs10__default.default.writeFile(configPath, JSON.stringify(config, null, 2), "utf-8");
     } catch (err) {
       const msg = err instanceof Error ? err.message : String(err);
       dispatch({
@@ -13822,9 +14037,9 @@ function Repl({ config, workspacePath, themeName, initialPrompt, identityName, a
       if (msg.includes("non-text parts")) return;
       originalLog(...args);
     };
-    const store = new MemoryStore(path25__default.default.join(workspacePath, CASCADE_DB_FILE));
+    const store = new MemoryStore(path26__default.default.join(workspacePath, CASCADE_DB_FILE));
     storeRef.current = store;
-    globalStoreRef.current = new MemoryStore(path25__default.default.join(os8__default.default.homedir(), GLOBAL_CONFIG_DIR, GLOBAL_RUNTIME_DB_FILE));
+    globalStoreRef.current = new MemoryStore(path26__default.default.join(os8__default.default.homedir(), GLOBAL_CONFIG_DIR, GLOBAL_RUNTIME_DB_FILE));
     const identityRows = store.listIdentities().map((i) => ({ id: i.id, name: i.name, isDefault: i.isDefault }));
     setIdentities(identityRows);
     let initialIdentityId = config.defaultIdentityId ?? identityRows.find((i) => i.isDefault)?.id ?? identityRows[0]?.id;
@@ -13887,14 +14102,14 @@ function Repl({ config, workspacePath, themeName, initialPrompt, identityName, a
       onThemeChange: (name) => setTheme(getTheme(name)),
       onExport: async (fmt) => {
         const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
-        const exportPath = path25__default.default.join(workspacePath, `cascade-export-${stamp}.${fmt === "json" ? "json" : "md"}`);
+        const exportPath = path26__default.default.join(workspacePath, `cascade-export-${stamp}.${fmt === "json" ? "json" : "md"}`);
         if (fmt === "json") {
-          await fs9__default.default.writeFile(exportPath, JSON.stringify({ sessionId: sessionIdRef.current, messages: state.messages }, null, 2), "utf-8");
+          await fs10__default.default.writeFile(exportPath, JSON.stringify({ sessionId: sessionIdRef.current, messages: state.messages }, null, 2), "utf-8");
         } else {
           const markdown = state.messages.map((msg) => `## ${msg.role.toUpperCase()} \u2014 ${msg.timestamp}
 
 ${msg.content}`).join("\n\n");
-          await fs9__default.default.writeFile(exportPath, markdown, "utf-8");
+          await fs10__default.default.writeFile(exportPath, markdown, "utf-8");
         }
       },
       onRollback: async () => {
@@ -13904,7 +14119,7 @@ ${msg.content}`).join("\n\n");
         if (!snapshots.length) return "No file snapshots found for this session.";
         for (const { filePath, content } of snapshots) {
           try {
-            await fs9__default.default.writeFile(filePath, content, "utf-8");
+            await fs10__default.default.writeFile(filePath, content, "utf-8");
           } catch (err) {
             console.error(`Restore failed: ${filePath}`, err);
           }
@@ -14783,9 +14998,9 @@ function stringifySlashOutput(val) {
 }
 async function searchSessionsAndMessages(query, workspacePath) {
   if (!query) return "Usage: /search <query>";
-  const dbPath = path25__default.default.join(workspacePath, CASCADE_DB_FILE);
+  const dbPath = path26__default.default.join(workspacePath, CASCADE_DB_FILE);
   try {
-    await fs9__default.default.access(dbPath);
+    await fs10__default.default.access(dbPath);
   } catch {
     return "No database found. Start a conversation first.";
   }
@@ -14817,7 +15032,7 @@ async function searchSessionsAndMessages(query, workspacePath) {
 async function diagnoseRuntime(config, workspacePath) {
   const providers = config.providers.map((p) => `${p.type}${p.apiKey ? " (key set)" : " (no key)"}`).join("\n");
   const models = [`T1: ${config.models.t1 ?? "default"}`, `T2: ${config.models.t2 ?? "default"}`, `T3: ${config.models.t3 ?? "default"}`].join("\n");
-  const store = new MemoryStore(path25__default.default.join(workspacePath, CASCADE_DB_FILE));
+  const store = new MemoryStore(path26__default.default.join(workspacePath, CASCADE_DB_FILE));
   try {
     const sessions = store.listSessions(void 0, 3);
     return [
@@ -14836,7 +15051,7 @@ async function diagnoseRuntime(config, workspacePath) {
 }
 async function showRecentLogs(args, workspacePath) {
   const limit = Number.parseInt(args[0] ?? "10", 10) || 10;
-  const store = new MemoryStore(path25__default.default.join(workspacePath, CASCADE_DB_FILE));
+  const store = new MemoryStore(path26__default.default.join(workspacePath, CASCADE_DB_FILE));
   try {
     const logs = store.listRuntimeNodeLogs(void 0, void 0, limit);
     if (!logs.length) return "No recent runtime logs.";
@@ -14848,7 +15063,7 @@ async function showRecentLogs(args, workspacePath) {
 async function loadSessionSnapshot(args, workspacePath) {
   const sessionId = args[0];
   if (!sessionId) return "Usage: /resume <sessionId>";
-  const store = new MemoryStore(path25__default.default.join(workspacePath, CASCADE_DB_FILE));
+  const store = new MemoryStore(path26__default.default.join(workspacePath, CASCADE_DB_FILE));
   try {
     const session = store.getSession(sessionId);
     if (!session) return `Session not found: ${sessionId}`;
@@ -15268,10 +15483,10 @@ function SetupWizard({ workspacePath, onComplete }) {
           ...anyAuto ? { cascadeAuto: true } : {}
         };
         const config = CascadeConfigSchema.parse(rawConfig);
-        const configDir = path25__default.default.join(workspacePath, ".cascade");
-        await fs9__default.default.mkdir(configDir, { recursive: true });
-        const configPath = path25__default.default.join(workspacePath, CASCADE_CONFIG_FILE);
-        await fs9__default.default.writeFile(configPath, JSON.stringify(config, null, 2), "utf-8");
+        const configDir = path26__default.default.join(workspacePath, ".cascade");
+        await fs10__default.default.mkdir(configDir, { recursive: true });
+        const configPath = path26__default.default.join(workspacePath, CASCADE_CONFIG_FILE);
+        await fs10__default.default.writeFile(configPath, JSON.stringify(config, null, 2), "utf-8");
         savedConfigRef.current = config;
         dispatchRef.current({ type: "GO_DONE" });
       } catch (err) {
@@ -15611,14 +15826,14 @@ function printTelemetryBanner() {
 async function initCommand(workspacePath = process.cwd()) {
   const spin = ora__default.default({ text: "Initializing Cascade project\u2026", color: "magenta" }).start();
   try {
-    const configDir = path25__default.default.join(workspacePath, ".cascade");
-    await fs9__default.default.mkdir(configDir, { recursive: true });
-    const mdPath = path25__default.default.join(workspacePath, "CASCADE.md");
+    const configDir = path26__default.default.join(workspacePath, ".cascade");
+    await fs10__default.default.mkdir(configDir, { recursive: true });
+    const mdPath = path26__default.default.join(workspacePath, "CASCADE.md");
     if (!await fileExists(mdPath)) {
       await createDefaultCascadeMd(workspacePath);
       spin.succeed(chalk9__default.default.green("Created CASCADE.md"));
     }
-    const ignorePath = path25__default.default.join(workspacePath, ".cascadeignore");
+    const ignorePath = path26__default.default.join(workspacePath, ".cascadeignore");
     if (!await fileExists(ignorePath)) {
       await createDefaultIgnoreFile(workspacePath);
       spin.succeed(chalk9__default.default.green("Created .cascadeignore"));
@@ -15627,7 +15842,7 @@ async function initCommand(workspacePath = process.cwd()) {
     console.log();
     console.log(chalk9__default.default.magenta("  \u25C8 Cascade AI \u2014 Project initialized"));
     console.log();
-    const configPath = path25__default.default.join(workspacePath, CASCADE_CONFIG_FILE);
+    const configPath = path26__default.default.join(workspacePath, CASCADE_CONFIG_FILE);
     if (await fileExists(configPath)) {
       console.log(chalk9__default.default.yellow("  .cascade/config.json already exists \u2014 launching wizard to reconfigure."));
       console.log();
@@ -15646,7 +15861,7 @@ async function initCommand(workspacePath = process.cwd()) {
 }
 async function fileExists(p) {
   try {
-    await fs9__default.default.access(p);
+    await fs10__default.default.access(p);
     return true;
   } catch {
     return false;
@@ -15658,7 +15873,7 @@ init_constants();
 var TOS_WARNING = "Reusing this subscription token outside its own CLI may violate the vendor\u2019s terms of service.";
 async function readJson(file) {
   try {
-    const raw = await fs9__default.default.readFile(file, "utf-8");
+    const raw = await fs10__default.default.readFile(file, "utf-8");
     return JSON.parse(raw);
   } catch {
     return null;
@@ -15685,7 +15900,7 @@ function fromEnv(env) {
   return out;
 }
 async function fromClaudeCode(home) {
-  const file = path25__default.default.join(home, ".claude", ".credentials.json");
+  const file = path26__default.default.join(home, ".claude", ".credentials.json");
   const data = await readJson(file);
   if (!data) return [];
   const oauth = data["claudeAiOauth"];
@@ -15708,7 +15923,7 @@ async function fromClaudeCode(home) {
   return [];
 }
 async function fromCodex(home) {
-  const file = path25__default.default.join(home, ".codex", "auth.json");
+  const file = path26__default.default.join(home, ".codex", "auth.json");
   const data = await readJson(file);
   if (!data) return [];
   const apiKey = str(data["OPENAI_API_KEY"]);
@@ -15731,7 +15946,7 @@ async function fromCodex(home) {
   return [];
 }
 async function fromGemini(home) {
-  const file = path25__default.default.join(home, ".gemini", "oauth_creds.json");
+  const file = path26__default.default.join(home, ".gemini", "oauth_creds.json");
   const data = await readJson(file);
   const accessToken = str(data?.["access_token"]);
   if (!accessToken) return [];
@@ -15747,7 +15962,7 @@ async function fromGemini(home) {
 }
 async function fromCopilot(home) {
   for (const name of ["apps.json", "hosts.json"]) {
-    const file = path25__default.default.join(home, ".config", "github-copilot", name);
+    const file = path26__default.default.join(home, ".config", "github-copilot", name);
     const data = await readJson(file);
     if (!data) continue;
     for (const value of Object.values(data)) {
@@ -15801,7 +16016,7 @@ async function doctorCommand() {
   checks.push({
     label: "Cascade config",
     ok: true,
-    detail: `Loaded ${path25__default.default.join(process.cwd(), CASCADE_CONFIG_FILE)}`
+    detail: `Loaded ${path26__default.default.join(process.cwd(), CASCADE_CONFIG_FILE)}`
   });
   const providers = [
     { type: "anthropic", name: "Anthropic" },
@@ -15957,6 +16172,11 @@ function authMiddleware(secret, required = true) {
     }
     const user = verifyToken(token, secret);
     if (!user) {
+      if (!required) {
+        req.user = void 0;
+        next();
+        return;
+      }
       res.status(401).json({ error: "Invalid or expired token" });
       return;
     }
@@ -16268,7 +16488,7 @@ function aggregateCostStats(sessions, opts = {}) {
 }
 
 // src/dashboard/server.ts
-var __dirname$1 = path25__default.default.dirname(url.fileURLToPath((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli.cjs', document.baseURI).href))));
+var __dirname$1 = path26__default.default.dirname(url.fileURLToPath((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli.cjs', document.baseURI).href))));
 var DashboardServer = class {
   app;
   httpServer;
@@ -16502,12 +16722,17 @@ var DashboardServer = class {
    */
   persistConfig() {
     try {
-      const configPath = path25__default.default.join(this.workspacePath, CASCADE_CONFIG_FILE);
-      fs23__default.default.mkdirSync(path25__default.default.dirname(configPath), { recursive: true });
-      fs23__default.default.writeFileSync(configPath, JSON.stringify(this.config, null, 2), "utf-8");
+      const configPath = path26__default.default.join(this.workspacePath, CASCADE_CONFIG_FILE);
+      fs24__default.default.mkdirSync(path26__default.default.dirname(configPath), { recursive: true });
+      fs24__default.default.writeFileSync(configPath, JSON.stringify(this.config, null, 2), "utf-8");
     } catch (err) {
       console.warn(`[dashboard] Failed to persist config: ${err instanceof Error ? err.message : String(err)}`);
     }
+    try {
+      saveGlobalCredentials(path26__default.default.join(os8__default.default.homedir(), GLOBAL_CONFIG_DIR), this.config.providers ?? []);
+    } catch (err) {
+      console.warn(`[dashboard] Failed to sync global credentials: ${err instanceof Error ? err.message : String(err)}`);
+    }
   }
   /**
    * Produce a stable dashboard JWT signing secret.
@@ -16519,15 +16744,15 @@ var DashboardServer = class {
   resolveDashboardSecret() {
     const fromConfig = this.config.dashboard.secret ?? process.env["CASCADE_DASHBOARD_SECRET"];
     if (fromConfig) return fromConfig;
-    const secretPath = path25__default.default.join(this.workspacePath, CASCADE_DASHBOARD_SECRET_FILE);
+    const secretPath = path26__default.default.join(this.workspacePath, CASCADE_DASHBOARD_SECRET_FILE);
     try {
-      if (fs23__default.default.existsSync(secretPath)) {
-        const existing = fs23__default.default.readFileSync(secretPath, "utf-8").trim();
+      if (fs24__default.default.existsSync(secretPath)) {
+        const existing = fs24__default.default.readFileSync(secretPath, "utf-8").trim();
         if (existing.length >= 16) return existing;
       }
       const generated = crypto.randomUUID();
-      fs23__default.default.mkdirSync(path25__default.default.dirname(secretPath), { recursive: true });
-      fs23__default.default.writeFileSync(secretPath, generated, { encoding: "utf-8", mode: 384 });
+      fs24__default.default.mkdirSync(path26__default.default.dirname(secretPath), { recursive: true });
+      fs24__default.default.writeFileSync(secretPath, generated, { encoding: "utf-8", mode: 384 });
       if (this.config.dashboard.auth) {
         console.warn(
           `Dashboard auth enabled with no secret configured; persisted a generated secret to ${secretPath}. Set CASCADE_DASHBOARD_SECRET or config.dashboard.secret to override.`
@@ -16554,7 +16779,7 @@ var DashboardServer = class {
   // ── Setup ─────────────────────────────────────
   getGlobalStore() {
     if (!this.globalStore) {
-      const globalDbPath = path25__default.default.join(os8__default.default.homedir(), GLOBAL_CONFIG_DIR, GLOBAL_RUNTIME_DB_FILE);
+      const globalDbPath = path26__default.default.join(os8__default.default.homedir(), GLOBAL_CONFIG_DIR, GLOBAL_RUNTIME_DB_FILE);
       this.globalStore = new MemoryStore(globalDbPath);
     }
     return this.globalStore;
@@ -16823,12 +17048,12 @@ ${prompt}`;
     }
   }
   watchRuntimeChanges() {
-    const workspaceDbPath = path25__default.default.join(this.workspacePath, CASCADE_DB_FILE);
-    const globalDbPath = path25__default.default.join(os8__default.default.homedir(), GLOBAL_CONFIG_DIR, GLOBAL_RUNTIME_DB_FILE);
+    const workspaceDbPath = path26__default.default.join(this.workspacePath, CASCADE_DB_FILE);
+    const globalDbPath = path26__default.default.join(os8__default.default.homedir(), GLOBAL_CONFIG_DIR, GLOBAL_RUNTIME_DB_FILE);
     const watchPaths = [workspaceDbPath, globalDbPath].filter((p, index, arr) => arr.indexOf(p) === index);
     for (const watchPath of watchPaths) {
-      if (!fs23__default.default.existsSync(watchPath)) continue;
-      fs23__default.default.watchFile(watchPath, { interval: 3e3 }, () => {
+      if (!fs24__default.default.existsSync(watchPath)) continue;
+      fs24__default.default.watchFile(watchPath, { interval: 3e3 }, () => {
         this.throttledBroadcast(watchPath === globalDbPath ? "global" : "workspace");
       });
     }
@@ -16950,7 +17175,7 @@ ${prompt}`;
       const sessionId = req.params.id;
       this.store.deleteSession(sessionId);
       this.store.deleteRuntimeSession(sessionId);
-      const globalDbPath = path25__default.default.join(os8__default.default.homedir(), GLOBAL_CONFIG_DIR, GLOBAL_RUNTIME_DB_FILE);
+      const globalDbPath = path26__default.default.join(os8__default.default.homedir(), GLOBAL_CONFIG_DIR, GLOBAL_RUNTIME_DB_FILE);
       const globalStore = new MemoryStore(globalDbPath);
       try {
         globalStore.deleteRuntimeSession(sessionId);
@@ -17043,7 +17268,7 @@ ${prompt}`;
     });
     this.app.delete("/api/sessions", auth, (req, res) => {
       const body = req.body;
-      const globalDbPath = path25__default.default.join(os8__default.default.homedir(), GLOBAL_CONFIG_DIR, GLOBAL_RUNTIME_DB_FILE);
+      const globalDbPath = path26__default.default.join(os8__default.default.homedir(), GLOBAL_CONFIG_DIR, GLOBAL_RUNTIME_DB_FILE);
       if (body?.ids && Array.isArray(body.ids) && body.ids.length > 0) {
         const globalStore = new MemoryStore(globalDbPath);
         try {
@@ -17066,7 +17291,7 @@ ${prompt}`;
     });
     this.app.delete("/api/runtime", auth, (_req, res) => {
       this.store.deleteAllRuntimeNodes();
-      const globalDbPath = path25__default.default.join(os8__default.default.homedir(), GLOBAL_CONFIG_DIR, GLOBAL_RUNTIME_DB_FILE);
+      const globalDbPath = path26__default.default.join(os8__default.default.homedir(), GLOBAL_CONFIG_DIR, GLOBAL_RUNTIME_DB_FILE);
       const globalStore = new MemoryStore(globalDbPath);
       try {
         globalStore.deleteAllRuntimeNodes();
@@ -17152,12 +17377,12 @@ ${prompt}`;
       if (body["tierLimits"]) this.config.tierLimits = { ...this.config.tierLimits, ...body["tierLimits"] };
       if (body["budget"]) this.config.budget = { ...this.config.budget, ...body["budget"] };
       try {
-        const configPath = path25__default.default.join(this.workspacePath, CASCADE_CONFIG_FILE);
-        const existing = fs23__default.default.existsSync(configPath) ? JSON.parse(fs23__default.default.readFileSync(configPath, "utf-8")) : {};
+        const configPath = path26__default.default.join(this.workspacePath, CASCADE_CONFIG_FILE);
+        const existing = fs24__default.default.existsSync(configPath) ? JSON.parse(fs24__default.default.readFileSync(configPath, "utf-8")) : {};
         const updated = { ...existing, tierLimits: this.config.tierLimits, budget: this.config.budget };
         const tmp = configPath + ".tmp";
-        fs23__default.default.writeFileSync(tmp, JSON.stringify(updated, null, 2), "utf-8");
-        fs23__default.default.renameSync(tmp, configPath);
+        fs24__default.default.writeFileSync(tmp, JSON.stringify(updated, null, 2), "utf-8");
+        fs24__default.default.renameSync(tmp, configPath);
         res.json({ ok: true });
       } catch (err) {
         res.status(500).json({ error: `Failed to save config: ${err instanceof Error ? err.message : String(err)}` });
@@ -17185,7 +17410,7 @@ ${prompt}`;
     this.app.get("/api/runtime", auth, (req, res) => {
       const scope = req.query["scope"] ?? "workspace";
       if (scope === "global") {
-        const globalDbPath = path25__default.default.join(os8__default.default.homedir(), GLOBAL_CONFIG_DIR, GLOBAL_RUNTIME_DB_FILE);
+        const globalDbPath = path26__default.default.join(os8__default.default.homedir(), GLOBAL_CONFIG_DIR, GLOBAL_RUNTIME_DB_FILE);
         const globalStore = new MemoryStore(globalDbPath);
         try {
           res.json({
@@ -17420,6 +17645,48 @@ ${prompt}`;
         res.status(500).json({ error: err instanceof Error ? err.message : String(err) });
       }
     });
+    this.app.get("/api/knowledge", auth, (_req, res) => {
+      try {
+        const ws = new WorldStateDB(this.workspacePath);
+        try {
+          const facts = ws.getAllFacts();
+          res.json({ total: facts.length, facts });
+        } finally {
+          ws.close();
+        }
+      } catch (err) {
+        res.status(500).json({ error: err instanceof Error ? err.message : String(err) });
+      }
+    });
+    this.app.delete("/api/knowledge/fact", auth, mutationLimiter, (req, res) => {
+      const body = req.body;
+      if (!body.entity || !body.relation) {
+        res.status(400).json({ error: "entity and relation are required" });
+        return;
+      }
+      try {
+        const ws = new WorldStateDB(this.workspacePath);
+        try {
+          res.json({ ok: true, deleted: ws.deleteFact(body.entity, body.relation) });
+        } finally {
+          ws.close();
+        }
+      } catch (err) {
+        res.status(500).json({ error: err instanceof Error ? err.message : String(err) });
+      }
+    });
+    this.app.delete("/api/knowledge", auth, mutationLimiter, (_req, res) => {
+      try {
+        const ws = new WorldStateDB(this.workspacePath);
+        try {
+          res.json({ ok: true, deleted: ws.clearFacts() });
+        } finally {
+          ws.close();
+        }
+      } catch (err) {
+        res.status(500).json({ error: err instanceof Error ? err.message : String(err) });
+      }
+    });
     this.app.get("/api/audit-chain", auth, async (req, res) => {
       try {
         const limit = Math.min(500, Math.max(1, parseInt(req.query["limit"] || "200", 10) || 200));
@@ -17438,13 +17705,13 @@ ${prompt}`;
         res.status(500).json({ error: err instanceof Error ? err.message : String(err) });
       }
     });
-    const prodPath = path25__default.default.resolve(__dirname$1, "../web/dist");
-    const devPath = path25__default.default.resolve(__dirname$1, "../../web/dist");
-    const webDistPath = fs23__default.default.existsSync(prodPath) ? prodPath : devPath;
-    if (fs23__default.default.existsSync(webDistPath)) {
+    const prodPath = path26__default.default.resolve(__dirname$1, "../web/dist");
+    const devPath = path26__default.default.resolve(__dirname$1, "../../web/dist");
+    const webDistPath = fs24__default.default.existsSync(prodPath) ? prodPath : devPath;
+    if (fs24__default.default.existsSync(webDistPath)) {
       this.app.use(express__default.default.static(webDistPath));
       this.app.get("*", (_req, res) => {
-        res.sendFile(path25__default.default.join(webDistPath, "index.html"));
+        res.sendFile(path26__default.default.join(webDistPath, "index.html"));
       });
     } else {
       this.app.get("/", (_req, res) => {
@@ -17465,7 +17732,7 @@ init_constants();
 async function dashboardCommand(config, workspacePath = process.cwd()) {
   const port = config.dashboard.port ?? DEFAULT_DASHBOARD_PORT;
   const spin = ora__default.default({ text: `Starting dashboard on port ${port}\u2026`, color: "magenta" }).start();
-  const store = new MemoryStore(path25__default.default.join(workspacePath, CASCADE_DB_FILE));
+  const store = new MemoryStore(path26__default.default.join(workspacePath, CASCADE_DB_FILE));
   const server = new DashboardServer(config, store, workspacePath);
   server.watchRuntimeChanges();
   const gThis = globalThis;
@@ -17497,7 +17764,7 @@ init_constants();
 function makeIdentityCommand(workspacePath = process.cwd()) {
   const identity = new commander.Command("identity").alias("id").description("Manage Cascade identities");
   identity.command("list").description("List all available identities").action(() => {
-    const store = new MemoryStore(path25__default.default.join(workspacePath, CASCADE_DB_FILE));
+    const store = new MemoryStore(path26__default.default.join(workspacePath, CASCADE_DB_FILE));
     try {
       const identities = store.listIdentities();
       console.log(chalk9__default.default.bold("\n  Identities:"));
@@ -17517,7 +17784,7 @@ function makeIdentityCommand(workspacePath = process.cwd()) {
     }
   });
   identity.command("create <name>").description("Create a new identity").option("-d, --desc <text>", "Description of the identity").option("-s, --system <text>", "System prompt").option("--default", "Set as default identity").action((name, options) => {
-    const store = new MemoryStore(path25__default.default.join(workspacePath, CASCADE_DB_FILE));
+    const store = new MemoryStore(path26__default.default.join(workspacePath, CASCADE_DB_FILE));
     try {
       if (options.default) {
         const existingDefault = store.getDefaultIdentity();
@@ -17543,7 +17810,7 @@ function makeIdentityCommand(workspacePath = process.cwd()) {
     }
   });
   identity.command("set-default <name>").description("Set an identity as default by name or ID").action((query) => {
-    const store = new MemoryStore(path25__default.default.join(workspacePath, CASCADE_DB_FILE));
+    const store = new MemoryStore(path26__default.default.join(workspacePath, CASCADE_DB_FILE));
     try {
       const identities = store.listIdentities();
       const match = identities.find((i) => i.id === query || i.name.toLowerCase() === query.toLowerCase());
@@ -17671,11 +17938,11 @@ async function exportCommand(options = {}) {
   let store;
   try {
     const workspacePath = options.workspacePath ?? process.cwd();
-    const workspaceDbPath = path25__default.default.join(workspacePath, CASCADE_DB_FILE);
-    const globalDbPath = path25__default.default.join(os8__default.default.homedir(), GLOBAL_CONFIG_DIR, GLOBAL_DB_FILE);
+    const workspaceDbPath = path26__default.default.join(workspacePath, CASCADE_DB_FILE);
+    const globalDbPath = path26__default.default.join(os8__default.default.homedir(), GLOBAL_CONFIG_DIR, GLOBAL_DB_FILE);
     let dbPath = globalDbPath;
     try {
-      await fs9__default.default.access(workspaceDbPath);
+      await fs10__default.default.access(workspaceDbPath);
       dbPath = workspaceDbPath;
     } catch {
     }
@@ -17714,8 +17981,8 @@ async function exportCommand(options = {}) {
     const ext = format === "json" ? ".json" : ".md";
     const safeName = session.title.replace(/[^\w\s-]/g, "").replace(/\s+/g, "-").slice(0, 60);
     const defaultFile = `cascade-export-${safeName}${ext}`;
-    const outPath = options.output ? path25__default.default.resolve(options.output) : path25__default.default.join(process.cwd(), defaultFile);
-    await fs9__default.default.writeFile(outPath, content, "utf-8");
+    const outPath = options.output ? path26__default.default.resolve(options.output) : path26__default.default.join(process.cwd(), defaultFile);
+    await fs10__default.default.writeFile(outPath, content, "utf-8");
     spin.succeed(chalk9__default.default.green(`Exported to ${chalk9__default.default.white(outPath)}`));
     const messageCount = Array.isArray(session.messages) ? session.messages.length : 0;
     console.log();
@@ -17942,11 +18209,11 @@ async function statsCommand() {
 dotenv__default.default.config();
 function warnIfBuildIsStale() {
   try {
-    const here = path25__default.default.dirname(url.fileURLToPath((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli.cjs', document.baseURI).href))));
+    const here = path26__default.default.dirname(url.fileURLToPath((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli.cjs', document.baseURI).href))));
     for (const rel of ["..", "../.."]) {
-      const pkgPath = path25__default.default.join(here, rel, "package.json");
-      if (!fs23__default.default.existsSync(pkgPath)) continue;
-      const pkg = JSON.parse(fs23__default.default.readFileSync(pkgPath, "utf-8"));
+      const pkgPath = path26__default.default.join(here, rel, "package.json");
+      if (!fs24__default.default.existsSync(pkgPath)) continue;
+      const pkg = JSON.parse(fs24__default.default.readFileSync(pkgPath, "utf-8"));
       if (pkg.name !== "cascade-ai") continue;
       if (pkg.version && pkg.version !== CASCADE_VERSION) {
         console.error(