castle-web-cli 0.4.82 → 0.4.83

package/dist/agent.d.ts

@@ -3,6 +3,7 @@ import { Duplex } from "stream";
 export declare const AGENT_WS_PATH = "/__castle/agent";
 export declare const AGENT_ATTACHMENT_PREFIX = "/__castle/agent/attachments/";
 export declare const AGENT_PLAYTEST_PREFIX = "/__castle/agent/playtest/";
+export declare const AGENT_MODEL_CAPS_PREFIX = "/__castle/agent/model-caps";
 export type AgentBackend = "cursor" | "claude" | "smith";
 export type ClaudeModel = "sonnet" | "opus" | "fable" | "openrouter";
 type TaskStatus = "waiting" | "running" | "blocked" | "done" | "failed" | "interrupted";

package/dist/agent.js

@@ -30,16 +30,38 @@ export const AGENT_ATTACHMENT_PREFIX = "/__castle/agent/attachments/";
 // Playtest frame PNGs (tasks/<id>/playtest/<file>.png), served for the
 // finished-task card's thumbnails -- see makePlaytestFrameHandler.
 export const AGENT_PLAYTEST_PREFIX = "/__castle/agent/playtest/";
+// Same-origin proxy for OpenRouter model capabilities (avoids browser CORS
+// against openrouter.ai). GET ?model=<slug> -> ModelCaps JSON. Powers the
+// settings popover's dynamic reasoning-effort / provider-tier pickers.
+export const AGENT_MODEL_CAPS_PREFIX = "/__castle/agent/model-caps";
 const DEFAULT_SETTINGS = {
     router: "claude",
     tasks: "claude",
     routerClaudeModel: "opus",
     // Tasks default one tier down: task agents run long unattended builds, so
-    // sonnet's cost/speed wins by default; the conductor stays on opus.
+    // sonnet's cost/speed wins by default; the operator stays on opus.
     tasksClaudeModel: "sonnet",
     // Free-form -- change to any OpenRouter slug.
     routerOpenrouterModel: "openai/gpt-5.6-sol",
     tasksOpenrouterModel: "openai/gpt-5.6-terra",
+    // Both roles think at "medium": the operator stays snappy (the user waits
+    // on every operator turn), and task agents' multi-turn tool loops don't pay
+    // reasoning tax on mechanical read/edit/run turns. Deep decomposition
+    // quality comes from the operator prompt, not a higher effort default.
+    routerReasoningEffort: "medium",
+    tasksReasoningEffort: "medium",
+    // Routing splits by what each role optimizes for: the interactive operator
+    // routes for speed (nitro = throughput-sorted endpoints), unattended task
+    // agents route for correctness (exacto = benchmark-accurate endpoints,
+    // which matters for tool-calling fidelity over long loops).
+    routerRouting: "nitro",
+    tasksRouting: "exacto",
+    // Operator pins OpenAI's priority (low-latency SLA) tier for the default
+    // sol model; harmless with other slugs since the pin falls back when the
+    // tag doesn't exist (allow_fallbacks). Tasks stay on auto: high-volume
+    // background turns should ride the cheapest available capacity.
+    routerProviderTier: "openai/priority",
+    tasksProviderTier: "",
 };
 function normalizeBackend(value) {
     return value === "cursor" || value === "claude" || value === "smith"
@@ -73,6 +95,48 @@ function normalizeOpenrouterModel(value) {
     const trimmed = value.trim();
     return trimmed && trimmed.length <= OPENROUTER_MODEL_MAX_LEN ? trimmed : null;
 }
+// OpenRouter's full effort superset -- validated against the union rather than
+// a per-model list because supported efforts are model-specific (the client
+// fetches them from the model-caps endpoint to build the picker) and
+// OpenRouter maps an unsupported level to the nearest one anyway.
+const REASONING_EFFORTS = [
+    "none",
+    "minimal",
+    "low",
+    "medium",
+    "high",
+    "xhigh",
+    "max",
+];
+function normalizeReasoningEffort(value) {
+    return REASONING_EFFORTS.includes(value)
+        ? value
+        : null;
+}
+const ROUTING_MODES = [
+    "balanced",
+    "nitro",
+    "exacto",
+    "floor",
+];
+function normalizeRoutingMode(value) {
+    return ROUTING_MODES.includes(value)
+        ? value
+        : null;
+}
+// Provider tier is an OpenRouter endpoint `tag` ("openai/flex", "azure/eu",
+// ...) which is model-specific, so validation is loose like the model slug.
+// Unlike the slug, empty string is VALID and meaningful: "auto" (no pin), so
+// this returns "" rather than null for the clear case -- callers must treat
+// null (invalid) and "" (clear) differently.
+function normalizeProviderTier(value) {
+    if (typeof value !== "string")
+        return null;
+    const trimmed = value.trim();
+    if (trimmed.length > OPENROUTER_MODEL_MAX_LEN)
+        return null;
+    return trimmed;
+}
 // OpenRouter's Anthropic-compatible endpoint (confirmed current, 2026: it
 // accepts the standard Anthropic Messages API shape -- text/tool-use/
 // extended-thinking -- for ANY OpenRouter model slug, not just Anthropic
@@ -116,6 +180,127 @@ const OPENROUTER_KEY_NAME = "OPENROUTER_API_KEY";
 function openrouterApiKey() {
     return castleKeys()[OPENROUTER_KEY_NAME] ?? process.env[OPENROUTER_KEY_NAME] ?? "";
 }
+const MODEL_CAPS_TTL_MS = 10 * 60_000;
+const OPENROUTER_API_BASE = "https://openrouter.ai/api/v1";
+const modelCapsCache = new Map();
+let modelsListCache = null;
+function asRecord(v) {
+    return v && typeof v === "object" ? v : null;
+}
+async function openrouterModelsById() {
+    if (modelsListCache && Date.now() - modelsListCache.at < MODEL_CAPS_TTL_MS) {
+        return modelsListCache.byId;
+    }
+    const res = await fetch(`${OPENROUTER_API_BASE}/models`);
+    if (!res.ok)
+        throw new Error(`models list HTTP ${res.status}`);
+    const json = asRecord(await res.json());
+    const data = json && Array.isArray(json.data) ? json.data : [];
+    const byId = new Map();
+    for (const entry of data) {
+        const rec = asRecord(entry);
+        const id = rec && typeof rec.id === "string" ? rec.id : null;
+        if (id)
+            byId.set(id, entry);
+    }
+    modelsListCache = { byId, at: Date.now() };
+    return byId;
+}
+async function openrouterProviderTiers(slug) {
+    const res = await fetch(`${OPENROUTER_API_BASE}/models/${slug}/endpoints`);
+    if (!res.ok)
+        return [];
+    const json = asRecord(await res.json());
+    const data = asRecord(json?.data);
+    const endpoints = data && Array.isArray(data.endpoints) ? data.endpoints : [];
+    const tags = [];
+    for (const ep of endpoints) {
+        const rec = asRecord(ep);
+        const tag = rec && typeof rec.tag === "string" ? rec.tag : null;
+        if (tag && !tags.includes(tag))
+            tags.push(tag);
+    }
+    return tags;
+}
+async function fetchModelCaps(slug) {
+    const cached = modelCapsCache.get(slug);
+    if (cached && Date.now() - cached.at < MODEL_CAPS_TTL_MS)
+        return cached.caps;
+    // Best-effort per source: a failure in either leaves that half empty rather
+    // than failing the whole lookup, so a bad slug still yields a usable (empty)
+    // caps object the client can render as "no dynamic options".
+    let reasoningEfforts = null;
+    let defaultEffort = null;
+    try {
+        const model = asRecord((await openrouterModelsById()).get(slug));
+        const reasoning = asRecord(model?.reasoning);
+        const efforts = reasoning?.supported_efforts;
+        const supportedParams = model?.supported_parameters;
+        const acceptsEffort = Array.isArray(supportedParams) &&
+            (supportedParams.includes("reasoning_effort") ||
+                supportedParams.includes("reasoning"));
+        if (acceptsEffort && Array.isArray(efforts) && efforts.length > 0) {
+            reasoningEfforts = efforts.filter((e) => typeof e === "string");
+            defaultEffort =
+                typeof reasoning?.default_effort === "string"
+                    ? reasoning.default_effort
+                    : null;
+        }
+    }
+    catch {
+        // leave reasoning fields null
+    }
+    let providerTiers = [];
+    try {
+        providerTiers = await openrouterProviderTiers(slug);
+    }
+    catch {
+        // leave providerTiers empty
+    }
+    const caps = {
+        model: slug,
+        reasoningEfforts,
+        defaultEffort,
+        providerTiers,
+    };
+    modelCapsCache.set(slug, { caps, at: Date.now() });
+    return caps;
+}
+// GET AGENT_MODEL_CAPS_PREFIX?model=<slug>. Returns 400 for a missing/oversized
+// slug, 200 ModelCaps otherwise (empty caps on upstream failure -- see
+// fetchModelCaps). reqPath is already query-stripped; parse req.url for it.
+function handleModelCaps(req, res) {
+    const send = (status, body) => {
+        res.writeHead(status, {
+            "content-type": "application/json",
+            "cache-control": "no-store",
+        });
+        res.end(JSON.stringify(body));
+        return true;
+    };
+    let slug = "";
+    try {
+        slug = (new URL(req.url ?? "", "http://localhost").searchParams.get("model") ?? "").trim();
+    }
+    catch {
+        slug = "";
+    }
+    if (!slug || slug.length > OPENROUTER_MODEL_MAX_LEN) {
+        return send(400, { error: "missing or invalid model" });
+    }
+    // Strip any routing suffix the client may have on the displayed slug so the
+    // OpenRouter lookup hits the base model id.
+    const baseSlug = slug.replace(/:(nitro|exacto|floor)$/, "");
+    fetchModelCaps(baseSlug)
+        .then((caps) => send(200, caps))
+        .catch(() => send(200, {
+        model: baseSlug,
+        reasoningEfforts: null,
+        defaultEffort: null,
+        providerTiers: [],
+    }));
+    return true;
+}
 // Build the headless CLI invocation for a spawning backend/role (smith never
 // comes through here -- it has no CLI process; see runAgentSmith). Cursor's
 // router runs in read-only ask mode; claude runs permission-mode auto for
@@ -520,16 +705,31 @@ const BACKEND_KEY_ENV = {
     claude: "ANTHROPIC_API_KEY",
     cursor: "CURSOR_API_KEY",
 };
-// True when the user has their OWN saved auth for this backend -- a /login, or
-// (for cursor, which reuses one auth.json) any saved creds. When so we do NOT
-// inject Castle's key, so their auth is used and billed to them.
+// cursor-agent rewrites ~/.config/cursor/auth.json on every successful run,
+// including Castle's own CURSOR_API_KEY runs -- so the file existing does NOT
+// mean a user logged in. A real login (OAuth, or a tester's own key) overwrites
+// it and drops Castle's apiKey; a file whose apiKey is still Castle's key is just
+// our cache. Treating that cache as a login would suppress the injected key, and
+// once its ~60-min token expires cursor-agent (no headless refresh) fails auth.
+function cursorHasUserLogin(home) {
+    const authPath = path.join(home, ".config", "cursor", "auth.json");
+    try {
+        const auth = JSON.parse(fs.readFileSync(authPath, "utf8"));
+        return auth.apiKey !== castleKeys().CURSOR_API_KEY;
+    }
+    catch {
+        return false;
+    }
+}
+// True when the user has their OWN saved auth for this backend -- a login that we
+// should defer to (and bill to them) instead of injecting Castle's key.
 function backendHasSavedAuth(backend) {
     const home = os.homedir();
     if (backend === "claude") {
         return fs.existsSync(path.join(home, ".claude", ".credentials.json"));
     }
     if (backend === "cursor") {
-        return fs.existsSync(path.join(home, ".config", "cursor", "auth.json"));
+        return cursorHasUserLogin(home);
     }
     return false;
 }
@@ -836,6 +1036,62 @@ function logAgentUsage(label, backend, usage) {
     const output = formatTokenCount(usage.output_tokens);
     console.error(`[agent usage] ${label} ${backend}: input=${input} cache_read=${read} cache_created=${created} output=${output}`);
 }
+// Per-deck machine-readable usage ledger, appended to <deckDir>/.castle/agent/,
+// harvested out-of-band (by the cloud launcher) for rough per-user token
+// metering. Distinct from logAgentUsage's stderr line, which is lossy
+// (rounds to "3.2k") and gets truncated when the serve restarts.
+const USAGE_LEDGER_FILE = "usage.jsonl";
+// The ledger is only useful where the cloud launcher harvests it, so the managed
+// sandbox environments set CASTLE_USAGE_LEDGER=1 (E2B via cloudSandbox.serveOnPort,
+// castle-sandboxes via its image). A local `castle-web serve` leaves it unset, so
+// dev deck dirs don't accumulate a ledger nothing reads.
+const USAGE_LEDGER_ENABLED = process.env.CASTLE_USAGE_LEDGER === "1";
+// Concrete model behind a finished run: smith and claude-via-OpenRouter both
+// bill the OpenRouter slug; plain claude bills its own slug; cursor has no
+// per-model split tracked here.
+function resolveRunModel(backend, claudeModel, openrouterModel) {
+    if (backend === "smith")
+        return openrouterModel;
+    if (backend === "claude") {
+        return claudeModel === "openrouter" ? openrouterModel : claudeModel;
+    }
+    return backend;
+}
+// One record per finished run: the human-readable stderr line PLUS a precise
+// append-only JSONL line in the deck's usage ledger. Precise counts (not the
+// stderr line's rounded values) and self-describing (id/role/backend/model) so
+// the harvester can attribute and de-dup. Best-effort: a metering write must
+// never fail an agent run.
+function reportRunUsage(agentDir, role, backend, claudeModel, openrouterModel, usage, taskId) {
+    logAgentUsage(taskId ? `task ${taskId}` : "router", backend, usage);
+    if (!USAGE_LEDGER_ENABLED)
+        return;
+    // cursor-agent's stream-json doesn't report token usage, so a cursor run has no
+    // `usage`; still record it (zero counts, tokens_reported:false) for run-count
+    // visibility. Other backends only write once they actually produced usage.
+    if (!usage && backend !== "cursor")
+        return;
+    try {
+        const line = JSON.stringify({
+            at: nowIso(),
+            id: nanoid(),
+            role,
+            backend,
+            model: resolveRunModel(backend, claudeModel, openrouterModel),
+            ...(taskId ? { taskId } : {}),
+            tokens_reported: usage !== undefined,
+            input_tokens: usage?.input_tokens ?? 0,
+            output_tokens: usage?.output_tokens ?? 0,
+            cache_read_input_tokens: usage?.cache_read_input_tokens ?? 0,
+            cache_creation_input_tokens: usage?.cache_creation_input_tokens ?? 0,
+        });
+        fs.mkdirSync(agentDir, { recursive: true });
+        fs.appendFileSync(path.join(agentDir, USAGE_LEDGER_FILE), line + "\n");
+    }
+    catch {
+        /* best-effort: a metering write must never fail an agent run */
+    }
+}
 // Build the per-run stdout event handler over a shared mutable parser state.
 // Splitting the cursor + claude stream decoding out of runAgentCli keeps each
 // within the max-lines budget; behavior is identical (same delta/activity/
@@ -1094,6 +1350,10 @@ async function runAgentSmith(opts) {
             role: opts.role,
             model: opts.model,
             apiKey: openrouterApiKey(),
+            reasoningEffort: opts.openrouterTuning?.reasoningEffort,
+            routing: opts.openrouterTuning?.routing,
+            // "" (auto) becomes undefined so no provider.order is sent.
+            providerTier: opts.openrouterTuning?.providerTier || undefined,
             prompt: opts.prompt,
             systemReminder: opts.systemReminder,
             attachments: opts.attachments,
@@ -1144,6 +1404,7 @@ function runAgentTurn(opts) {
             // appends it to its own system framing).
             systemReminder: opts.role === "task" ? CLAUDE_TASK_SYSTEM_REMINDER : undefined,
             attachments: opts.attachments,
+            openrouterTuning: opts.openrouterTuning,
             timeoutMs: opts.timeoutMs,
             logPath: opts.logPath,
             playtest: opts.playtest,
@@ -1398,6 +1659,7 @@ async function runTaskAgentIn(ctx, task) {
             prompt: taskPrompt,
             claudeModel: ctx.claudeModel,
             openrouterModel: ctx.openrouterModel,
+            openrouterTuning: ctx.openrouterTuning,
             cwd: ctx.deckDir,
             timeoutMs: TASK_TIMEOUT_MS,
             logPath: path.join(dir, "log.jsonl"),
@@ -1416,7 +1678,7 @@ async function runTaskAgentIn(ctx, task) {
                     ctx.onFeed(`[${activity}]`);
             },
         });
-        logAgentUsage(`task ${task.id}`, ctx.backend, result.usage);
+        reportRunUsage(path.dirname(ctx.tasksDir), "task", ctx.backend, ctx.claudeModel, ctx.openrouterModel, result.usage, task.id);
         if (ctx.stopRequested.has(task.id))
             return result;
         if (!result.crashed)
@@ -1451,6 +1713,7 @@ function startTask(ctx, task) {
         backend: ctx.backend(),
         claudeModel: ctx.claudeModel(),
         openrouterModel: ctx.openrouterModel(),
+        openrouterTuning: ctx.openrouterTuning(),
         stopRequested: ctx.stopRequested,
         quickReference: ctx.quickReference,
         playtest: ctx.playtest,
@@ -1646,6 +1909,7 @@ function createTaskStore(opts) {
         backend: opts.backend,
         claudeModel: opts.claudeModel,
         openrouterModel: opts.openrouterModel,
+        openrouterTuning: opts.openrouterTuning,
         playtest: opts.playtest,
         restart: opts.restart,
         onStarted: opts.onStarted,
@@ -2161,6 +2425,7 @@ function runRouterTurnIn(ctx, instruction, attachments = []) {
         prompt,
         claudeModel: ctx.claudeModel(),
         openrouterModel: ctx.openrouterModel(),
+        openrouterTuning: ctx.openrouterTuning(),
         attachments,
         cwd: ctx.deckDir,
         timeoutMs: ROUTER_TIMEOUT_MS,
@@ -2193,7 +2458,7 @@ function runRouterTurnIn(ctx, instruction, attachments = []) {
         },
     })
         .then((result) => {
-        logAgentUsage("router", backend, result.usage);
+        reportRunUsage(ctx.agentDir, "router", backend, ctx.claudeModel(), ctx.openrouterModel(), result.usage);
         // Signals the finally -> onSettled(retryable): the turn failed cleanly
         // enough (transient, nothing salvaged) that the queue may re-run it.
         let retryable = false;
@@ -2323,14 +2588,37 @@ function applyAgentSettings(incoming, ctx) {
         const value = normalizeClaudeModel(incoming[key]);
         if (value && value !== settings[key]) {
             settings[key] = value;
-            changes.push(`${key === "routerClaudeModel" ? "conductor" : "tasks"} claude model -> ${value}`);
+            changes.push(`${key === "routerClaudeModel" ? "operator" : "tasks"} claude model -> ${value}`);
         }
     }
     for (const key of ["routerOpenrouterModel", "tasksOpenrouterModel"]) {
         const value = normalizeOpenrouterModel(incoming[key]);
         if (value && value !== settings[key]) {
             settings[key] = value;
-            changes.push(`${key === "routerOpenrouterModel" ? "conductor" : "tasks"} openrouter model -> ${value}`);
+            changes.push(`${key === "routerOpenrouterModel" ? "operator" : "tasks"} openrouter model -> ${value}`);
+        }
+    }
+    for (const key of ["routerReasoningEffort", "tasksReasoningEffort"]) {
+        const value = normalizeReasoningEffort(incoming[key]);
+        if (value && value !== settings[key]) {
+            settings[key] = value;
+            changes.push(`${key === "routerReasoningEffort" ? "operator" : "tasks"} reasoning effort -> ${value}`);
+        }
+    }
+    for (const key of ["routerRouting", "tasksRouting"]) {
+        const value = normalizeRoutingMode(incoming[key]);
+        if (value && value !== settings[key]) {
+            settings[key] = value;
+            changes.push(`${key === "routerRouting" ? "operator" : "tasks"} routing -> ${value}`);
+        }
+    }
+    for (const key of ["routerProviderTier", "tasksProviderTier"]) {
+        // "" is a valid value (auto), so check for null (invalid) explicitly
+        // rather than truthiness -- otherwise the tier could never be cleared.
+        const value = normalizeProviderTier(incoming[key]);
+        if (value !== null && value !== settings[key]) {
+            settings[key] = value;
+            changes.push(`${key === "routerProviderTier" ? "operator" : "tasks"} provider tier -> ${value || "auto"}`);
         }
     }
     if (changes.length === 0)
@@ -2495,6 +2783,11 @@ function startRouterTurn(ctx, instruction, attachments = []) {
         backend: () => ctx.settings.router,
         claudeModel: () => ctx.settings.routerClaudeModel,
         openrouterModel: () => ctx.settings.routerOpenrouterModel,
+        openrouterTuning: () => ({
+            reasoningEffort: ctx.settings.routerReasoningEffort,
+            routing: ctx.settings.routerRouting,
+            providerTier: ctx.settings.routerProviderTier,
+        }),
         canAutoRetry: () => !ctx.state.autoRetryUsed && ctx.state.pendingSends.length === 0,
         onSettled: (retryable) => onRouterQueueSettled(ctx, retryable),
     }, instruction, attachments);
@@ -2784,6 +3077,20 @@ export function createAgentServer(opts) {
         tasksOpenrouterModel: normalizeOpenrouterModel(storedSettings?.tasksOpenrouterModel) ??
             legacyOpenrouterModel ??
             DEFAULT_SETTINGS.tasksOpenrouterModel,
+        routerReasoningEffort: normalizeReasoningEffort(storedSettings?.routerReasoningEffort) ??
+            DEFAULT_SETTINGS.routerReasoningEffort,
+        tasksReasoningEffort: normalizeReasoningEffort(storedSettings?.tasksReasoningEffort) ??
+            DEFAULT_SETTINGS.tasksReasoningEffort,
+        routerRouting: normalizeRoutingMode(storedSettings?.routerRouting) ??
+            DEFAULT_SETTINGS.routerRouting,
+        tasksRouting: normalizeRoutingMode(storedSettings?.tasksRouting) ??
+            DEFAULT_SETTINGS.tasksRouting,
+        // Provider tier: "" is valid (auto), so keep a normalized "" over the
+        // default rather than treating it as absent.
+        routerProviderTier: normalizeProviderTier(storedSettings?.routerProviderTier) ??
+            DEFAULT_SETTINGS.routerProviderTier,
+        tasksProviderTier: normalizeProviderTier(storedSettings?.tasksProviderTier) ??
+            DEFAULT_SETTINGS.tasksProviderTier,
     };
     const applySettings = (incoming) => applyAgentSettings(incoming, { settings, settingsPath, broadcast });
     const taskFeeds = createTaskFeeds(broadcast);
@@ -2797,6 +3104,11 @@ export function createAgentServer(opts) {
         backend: () => settings.tasks,
         openrouterModel: () => settings.tasksOpenrouterModel,
         claudeModel: () => settings.tasksClaudeModel,
+        openrouterTuning: () => ({
+            reasoningEffort: settings.tasksReasoningEffort,
+            routing: settings.tasksRouting,
+            providerTier: settings.tasksProviderTier,
+        }),
         playtest,
         restart: opts.restart,
         // Task lifecycle stays on the board only -- log lines for it were spam.
@@ -2896,6 +3208,8 @@ export function createAgentServer(opts) {
     const handleAttachment = makeAttachmentHandler(attachmentsDir);
     const handlePlaytestFrame = makePlaytestFrameHandler(tasksDir);
     function handleHttpRequest(req, res, reqPath) {
+        if (reqPath === AGENT_MODEL_CAPS_PREFIX)
+            return handleModelCaps(req, res);
         return handleAttachment(req, res, reqPath) || handlePlaytestFrame(req, res, reqPath);
     }
     function shutdown() {

package/dist/ide.js

@@ -268,6 +268,136 @@ function handleFilesWrite(deckDir, req, res) {
         }
     })();
 }
+// Add `<rel>/**` to the deck's editor.visiblePaths so files created in a
+// newly-made folder show in the curated Files tree. Only touches a deck that is
+// ALREADY curated (non-empty visiblePaths) -- when visiblePaths is empty
+// everything is visible, and adding a glob would wrongly start hiding things.
+// No-op if an existing glob already covers the folder. Returns whether it wrote.
+function ensureVisiblePath(deckDir, rel) {
+    const file = path.join(deckDir, "castle.json");
+    let data;
+    try {
+        data = JSON.parse(fs.readFileSync(file, "utf8"));
+    }
+    catch {
+        return false; // no castle.json yet (deck never saved) -> treat as not curated
+    }
+    const visible = data.editor && Array.isArray(data.editor.visiblePaths)
+        ? data.editor.visiblePaths.filter((v) => typeof v === "string")
+        : null;
+    if (!visible || visible.length === 0)
+        return false; // not curated -> all visible
+    const glob = `${rel}/**`;
+    if (visible.includes(glob))
+        return false;
+    if (picomatch(visible)(`${rel}/__probe__`))
+        return false; // already covered
+    visible.push(glob);
+    data.editor.visiblePaths = visible;
+    try {
+        fs.writeFileSync(file, `${JSON.stringify(data, null, 2)}\n`, "utf8");
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function handleFilesMkdir(deckDir, req, res) {
+    void (async () => {
+        let body;
+        try {
+            body = JSON.parse(await readRequestBody(req));
+        }
+        catch {
+            return sendJson(res, 400, { error: "Invalid JSON body." });
+        }
+        const resolved = resolveDeckPath(deckDir, body.path);
+        if (!resolved.ok)
+            return sendJson(res, 400, { error: resolved.error });
+        try {
+            fs.mkdirSync(resolved.abs, { recursive: true });
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            return sendJson(res, 500, { error: `Could not create folder ${resolved.rel}: ${message}` });
+        }
+        const visiblePathAdded = ensureVisiblePath(deckDir, resolved.rel);
+        sendJson(res, 200, { ok: true, path: resolved.rel, visiblePathAdded });
+    })();
+}
+// True when two paths resolve to the same underlying file (same inode+device) --
+// e.g. the source and target of a case-only rename on a case-insensitive FS.
+function isSameFile(a, b) {
+    try {
+        const sa = fs.statSync(a);
+        const sb = fs.statSync(b);
+        return sa.ino === sb.ino && sa.dev === sb.dev;
+    }
+    catch {
+        return false;
+    }
+}
+function handleFilesRename(deckDir, req, res) {
+    void (async () => {
+        let body;
+        try {
+            body = JSON.parse(await readRequestBody(req));
+        }
+        catch {
+            return sendJson(res, 400, { error: "Invalid JSON body." });
+        }
+        const from = resolveDeckPath(deckDir, body.from);
+        if (!from.ok)
+            return sendJson(res, 400, { error: from.error });
+        const to = resolveDeckPath(deckDir, body.to);
+        if (!to.ok)
+            return sendJson(res, 400, { error: to.error });
+        if (!fs.existsSync(from.abs)) {
+            return sendJson(res, 404, { error: `Not found: ${from.rel}` });
+        }
+        // Block a collision with a DIFFERENT existing file. On a case-insensitive
+        // filesystem (default on macOS/Windows) `to` can "exist" only because it is
+        // `from` under a different case -- a case-only rename like bounce.jsx ->
+        // Bounce.jsx. Allow that by treating same-inode as not-a-collision.
+        if (from.abs !== to.abs && fs.existsSync(to.abs) && !isSameFile(from.abs, to.abs)) {
+            return sendJson(res, 409, { error: `Already exists: ${to.rel}` });
+        }
+        try {
+            fs.mkdirSync(path.dirname(to.abs), { recursive: true });
+            fs.renameSync(from.abs, to.abs);
+            sendJson(res, 200, { ok: true, path: to.rel });
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            sendJson(res, 500, { error: `Could not rename ${from.rel}: ${message}` });
+        }
+    })();
+}
+function handleFilesDelete(deckDir, req, res) {
+    void (async () => {
+        let body;
+        try {
+            body = JSON.parse(await readRequestBody(req));
+        }
+        catch {
+            return sendJson(res, 400, { error: "Invalid JSON body." });
+        }
+        const resolved = resolveDeckPath(deckDir, body.path);
+        if (!resolved.ok)
+            return sendJson(res, 400, { error: resolved.error });
+        if (!fs.existsSync(resolved.abs)) {
+            return sendJson(res, 404, { error: `Not found: ${resolved.rel}` });
+        }
+        try {
+            fs.rmSync(resolved.abs, { recursive: true, force: true });
+            sendJson(res, 200, { ok: true, path: resolved.rel });
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            sendJson(res, 500, { error: `Could not delete ${resolved.rel}: ${message}` });
+        }
+    })();
+}
 // The builtin Files + code-editor backend: list / read / write deck files and
 // report kit-owned editor extensions. Paths are deck-relative; resolveDeckPath
 // rejects traversal and protected dirs.
@@ -286,7 +416,14 @@ function handleFilesApi(deckDir, req, res, reqPath) {
         return true;
     }
     if (action === "list") {
-        const files = filterDeckFiles(listDeckFiles(deckDir), readEditorConfig(deckDir));
+        // `?all=1` returns the unfiltered listing (the "show hidden files & folders"
+        // toggle) -- still minus the always-ignored dirs (node_modules/.castle/...),
+        // just without the deck's visible/hidden path curation.
+        const url = new URL(req.url ?? "/", "http://localhost");
+        const listed = listDeckFiles(deckDir);
+        const files = url.searchParams.get("all") === "1"
+            ? listed
+            : filterDeckFiles(listed, readEditorConfig(deckDir));
         sendJson(res, 200, { files });
         return true;
     }
@@ -308,6 +445,18 @@ function handleFilesApi(deckDir, req, res, reqPath) {
         handleFilesWrite(deckDir, req, res);
         return true;
     }
+    if (action === "rename") {
+        handleFilesRename(deckDir, req, res);
+        return true;
+    }
+    if (action === "delete") {
+        handleFilesDelete(deckDir, req, res);
+        return true;
+    }
+    if (action === "mkdir") {
+        handleFilesMkdir(deckDir, req, res);
+        return true;
+    }
     return sendJson(res, 404, { error: `Unknown files action: ${action}` }), true;
 }
 function defaultShell() {

package/dist/native/loop.js

@@ -598,7 +598,11 @@ async function runLoop(opts, toolSchemas, log) {
                 model: opts.model,
                 messages,
                 tools: toolSchemas,
-                reasoningEffort: REASONING_EFFORT[opts.role],
+                // Settings-driven per-role effort; falls back to the built-in table
+                // when a caller doesn't supply one (e.g. the QA harness).
+                reasoningEffort: opts.reasoningEffort ?? REASONING_EFFORT[opts.role],
+                routing: opts.routing,
+                providerTier: opts.providerTier,
                 maxTokens: MAX_COMPLETION_TOKENS,
                 signal: controller.signal,
                 onDelta: opts.onDelta,