create-walle 0.9.25 → 0.9.26

package/template/wall-e/coding-prompts.js

@@ -222,9 +222,48 @@ function buildAgentSystemPrompt({ resolvedCwd, projectInfo, projectSkills, taskF
     userMessage: runtimeContext.userTask || '',
   }).replace(/\s+/g, ' ').trim();
 
+  // Per-turn environment grounding (mirrors OpenCode's sys.environment): re-state
+  // the working directory, git root, and repo status every turn so the model never
+  // loses track of where it is.
+  const env = runtimeContext.environment || {};
+  const gitRoot = env.gitRoot || '';
+  const isGitRepo = env.isGitRepo != null ? !!env.isGitRepo : !!gitRoot;
+  const platform = env.platform || process.platform;
+  const envBlock = [
+    '<env>',
+    `Working directory: ${resolvedCwd || '(not set)'}`,
+    `Workspace root (git): ${gitRoot || resolvedCwd || '(not set)'}`,
+    `Is git repo: ${isGitRepo ? 'yes' : 'no'}`,
+    `Platform: ${platform}`,
+    '</env>',
+  ].join('\n');
+  // When a session has been reused across more than one directory, surface every
+  // root it has touched so "the page/site/file you built" resolves to where it
+  // actually lives — not a glob of the current cwd (session c3f3af97).
+  const sessionWorkspaces = Array.isArray(runtimeContext.sessionWorkspaces)
+    ? runtimeContext.sessionWorkspaces.filter(Boolean)
+    : [];
+  const workspacesBlock = sessionWorkspaces.length > 1
+    ? `\n\n<session_workspaces>
+This coding session has worked in MORE THAN ONE directory. Files you created earlier may live in a different directory than the current working directory above. When the user refers to something you built ("the web page", "the site", "the file you created") and it is not under the current working directory, look under these other roots — read/glob the specific path — before answering or globbing the cwd:
+${sessionWorkspaces.map((w) => `- ${w}${w === resolvedCwd ? ' (current working directory)' : ''}`).join('\n')}
+</session_workspaces>`
+    : '';
+  // Anchor: the session's home project (its first root). Gives the agent a stable
+  // "this session belongs to project X" even when a turn is pointed elsewhere, so a
+  // bare "the project / the site / what you built" resolves to the anchor, not the cwd.
+  const sessionAnchor = typeof runtimeContext.sessionAnchor === 'string' ? runtimeContext.sessionAnchor : '';
+  const currentRoot = gitRoot || resolvedCwd || '';
+  const anchorBlock = sessionAnchor
+    ? `\n\n<session_anchor>
+This coding session is anchored to its home project: ${sessionAnchor}
+Treat that as the session's primary project. When the user refers to "the project", "the app", "the site", or something you built earlier without naming a directory, resolve it under the anchor — not whichever directory this turn happens to point at.${currentRoot && sessionAnchor && currentRoot !== sessionAnchor ? `\nNOTE: the current working directory (${currentRoot}) is a DIFFERENT project than the anchor. Say which project you are acting on before you change files.` : ''}
+</session_anchor>`
+    : '';
+
   const body = `You are an expert software engineer executing a coding task. Use the provided tools to actually do the work — describing what to do is not completing the task.${projectCtx}${projectSkillCtx}
 
-Working directory: ${resolvedCwd || '(not set)'}
+${envBlock}${anchorBlock}${workspacesBlock}
 ${largeTaskCtx}
 
 # Runtime role
@@ -238,11 +277,21 @@ ${memoryProtocolCtx ? `${memoryProtocolCtx}\n\n` : ''}${frontendDesignCtx ? `${f
 3. Edit, don't create. Prefer edit_file (or multi_edit / apply_patch) on existing files. Only write_file when a new file is genuinely required by the task. NEVER create README/docs files unless explicitly asked.
 4. Verify with run_shell. Run the test command, lint, or build that proves the change works. Report the actual output — "tests pass" without showing them is not verification.
 
+# Finishing — apply, don't ask to apply
+
+- You are in BUILD mode, not plan mode: you have the authority to edit this project directly, and the edit tools (edit_file/multi_edit/apply_patch/write_file) write the change immediately. You do NOT need the user's permission to apply a change you've already designed. Asking "Want me to proceed / apply these edits?" is plan-mode behavior — you are not in plan mode.
+- When you say you'll make a change, ACTUALLY make the tool call THIS turn. Never end a turn describing an edit you intend to make, or asking whether to apply it — make it, then report what changed. A turn that ends with "I investigated; confirm and I'll apply" while you already know the edit is a FAILURE, even when the analysis is correct.
+- Keep going until the request is actually resolved before yielding back. If part of the task is ambiguous, pick the reasonable default, APPLY it, and note your assumption in the summary — don't hand the whole task back over one open detail. You are a capable autonomous agent; finish the work instead of asking for permission to act on it.
+
 # Doing tasks
 
 - Find root causes, not symptoms. If a test fails, understand why before patching the test. If error handling fires, understand the underlying error before swallowing it.
 - If the requested symbol, file, or behavior does not exist after you have searched the codebase, do not invent code just to make an edit. Report the blocker, the searches you ran, and leave the tree unchanged.
 - For large multi-file tasks, first identify the target file set, then batch work aggressively: use apply_patch or multi_edit to update several files per editing turn, and defer broad test suites until after the first complete code pass. Do not spend most of the run budget on exploration when the prompt already names target files.
+- Bank the certain fix first. When a task mixes fixes you're sure of (root cause found, the change is unambiguous) with parts that need a decision or more digging, APPLY the sure fixes this turn before doing anything expensive on the open parts. Never end a turn with zero edits when you already know a correct, in-scope edit — a turn that lands the certain fix and flags the open question beats one that investigates everything and changes nothing.
+- Cheap before expensive. Land the edits you're sure of before sinking the budget into costly verification — building a viewer/harness page, screenshotting every asset, scraping. Verify AFTER the known edits are in, with the cheapest check that proves the point.
+- Batch probes; don't loop. To inspect many files (dimensions, sizes, types), run ONE batched command — most CLIs take multiple paths (\`sips -g pixelWidth -g pixelHeight a.jpg b.jpg …\`), or use a glob or a tiny script — never a per-file \`for\` loop of separate run_shell calls. Push genuinely slow verification to \`background: true\` and poll bg_output instead of blocking the turn. And don't re-measure: reuse what you already ran this turn — don't repeat the same \`git diff\` / \`ls\` / screenshot; cite your earlier result.
+- Stay in the named scope. Work the one project the task is about. Don't wander into sibling repos, and don't spin up static servers or screenshot harnesses unless the task genuinely can't be verified any cheaper.
 - Don't add features, refactors, or abstractions beyond what the task requires. Three similar lines is fine — premature abstraction is worse than duplication.
 - Don't add error handling, fallbacks, or validation for scenarios that can't happen. Trust internal call shapes and framework guarantees. Validate at system boundaries (user input, network, filesystem) only.
 - Don't add backwards-compat shims when you can just change the code: no \`_unused\` renames, no \`// removed X\` comments, no re-exports of deleted types. If a thing is unused, delete it.
@@ -270,7 +319,7 @@ ${memoryProtocolCtx ? `${memoryProtocolCtx}\n\n` : ''}${frontendDesignCtx ? `${f
 - ${responseLanguagePolicy}
 - If the task is ambiguous, make a best-guess interpretation and note it explicitly: "I interpreted X as Y; tell me if you meant Z." Don't refuse and ask — answer + clarify.
 - If you genuinely cannot complete the task, say what you tried, what you ruled out, and the narrowed-down problem. That's a useful failure; "I couldn't" alone is not.
-- Use ask_user only when the answer is genuinely undeterminable from the codebase + reasonable defaults. Most "ambiguous" tasks aren't — pick the obvious interpretation and proceed.`;
+- Use ask_user only when the answer is genuinely undeterminable from the codebase + reasonable defaults. Most "ambiguous" tasks aren't — pick the obvious interpretation and proceed. When there IS one real decision (a product choice with no obvious default), first bank every safe edit, then ask that ONE focused question mid-task — don't turn it into a turn-ending "I investigated; confirm and I'll apply everything" wrap-up that hands the work back to the user. ask_user is for a product decision you cannot default — NOT for permission to apply edits you've already designed. If the only thing left is whether to apply the change, the answer is yes: apply it and report; never ask that.`;
 
   const bundle = buildPromptBundle({ body, mode, provider, model, extraInstructions, returnEnvelope: true });
   const envelope = buildRuntimePromptEnvelope({

package/template/wall-e/docs/model-routing-policy.md

@@ -0,0 +1,59 @@
+# Wall-E Model Routing Policy
+
+Wall-E keeps model fallback routing as durable policy data in the brain DB. UI reads should not recompute fallback order on every page load.
+
+## Precedence
+
+1. Task-specific model override from `model_defaults`
+2. Provider-card default (`walle_provider` / `walle_model`)
+3. User-defined fallback routes
+4. Generated fallback routes from currently available providers and local CLIs
+5. Failure with a surfaced provider-health notice
+
+## Storage
+
+`model_routing_policies` stores the policy header:
+
+- mode: `smart` or `strict`
+- CLI-tail and final-answer fallback toggles
+- generation/effective timestamps
+- last materialization error
+
+`model_routing_policy_routes` stores ordered route rows. The `source` column separates:
+
+- `user`: manual user order
+- `generated`: Wall-E suggestions from provider availability, credentials, health, and CLI checks
+- `effective`: materialized runtime route after merging provider-card default, user routes, and generated routes
+
+Runtime and CTM UI use the `effective` chain when present. If no effective chain exists, Wall-E materializes one once, persists it, and subsequent reads are cheap DB reads.
+
+## Manual Editing
+
+The Model Operations fallback editor writes only the `user` layer. The provider-card default remains locked as route 1 so users cannot accidentally demote the configured default provider from the fallback editor.
+
+When the user saves fallback order:
+
+1. CTM posts ordered user route keys to `/api/models/routing-policy/routes`.
+2. Wall-E validates the route keys against the current persisted generated/effective routes.
+3. Wall-E stores enabled and disabled user rows with `source = 'user'`.
+4. Wall-E rematerializes `effective` as:
+   - generated primary/default route;
+   - enabled user routes in saved order;
+   - remaining generated routes that were not already used and were not disabled by a user row.
+
+Resetting the editor clears all `user` rows and rebuilds `effective` from generated suggestions.
+
+## Refresh Rules
+
+Recompute only when:
+
+- the policy has no materialized routes yet;
+- the user explicitly refreshes fallback policy;
+- the user changes routing mode/toggles;
+- a later provider/model/credential workflow marks the policy stale and triggers a background refresh.
+
+Normal `GET /api/models/routing-policy` returns the persisted policy. It should not rescore the catalog on every page render.
+
+## Runtime
+
+The resilient default client reads the persisted effective chain when available and uses it to order fallback candidates. Existing provider resolution remains the source of truth for credentials and client construction; the route table only controls order and visibility.

package/template/wall-e/docs/walle-shell-sandbox.md

@@ -0,0 +1,61 @@
+# Wall-E coding-agent shell sandbox (`WALLE_SHELL_SANDBOX`)
+
+Opt-in OS sandbox for the coding agent's `run_shell` tool. **Default OFF.**
+
+## The problem it solves
+
+`run_shell` gates commands with a static allowlist; in a headless coding turn an *unlisted*
+command (e.g. `sips`, ImageMagick, `ffmpeg`, `pandoc`, `pdftoppm`) evaluates to "ask" and is
+auto-**denied** — the agent dead-ends ("I can't, that tool isn't allowed"). A static allowlist both
+blocks legitimate tools and can't prompt mid-run.
+
+This is the same trade-off Claude Code and Codex solve with an **OS sandbox**: run the command
+**contained** (filesystem writes bounded to the workspace) and auto-allow it, instead of blocking by
+name. Anthropic measured ~84% fewer approval prompts with sandboxing vs prompting.
+
+## What it does (when on)
+
+- Every non-denylisted `run_shell` command (foreground and background) runs wrapped in the host OS
+  sandbox: **macOS Seatbelt** (`sandbox-exec`) or **Linux bubblewrap** (`bwrap`).
+- **Filesystem writes** are contained to the workspace (`cwd` + `os.tmpdir()`, realpath-expanded so
+  macOS `/var`→`/private/var` symlinks don't leak). **Reads, process-exec, and network are allowed**
+  (so `npm install` / fetches keep working).
+- The permission layer stops dead-ending unlisted shell commands (returns `allow` with
+  `source: 'sandbox'`) so they reach the runner; the runner does the actual containment.
+- The hard **denylist** (`sudo`, `su`, `dd`, `mkfs`, `fdisk`, `diskutil`, `shutdown`, `reboot`,
+  `chmod`, `chown`, `kill`, `killall`, `rm*`…) is **still refused** — a filesystem sandbox does not
+  neutralize privilege/device/system operations.
+- **Graceful fallback:** if no sandbox backend is present (`sandbox-exec`/`bwrap` missing), behavior
+  is unchanged (unlisted commands stay denied in headless) — no false sense of safety.
+
+## Enable it
+
+Add to the launchd plist `EnvironmentVariables` (then bootout/bootstrap the service), or `.env`:
+
+```
+WALLE_SHELL_SANDBOX=1
+```
+
+It only takes effect after a Wall-E restart. Validate on `/ctm-dev` before enabling on the primary
+(same discipline as `CTM_CODEX_SANDBOX` / `CTM_APPROVAL_HOOK_SANDBOX`).
+
+## Caveats
+
+- **macOS `sandbox-exec` is deprecated** (but still shipped + used by Claude Code and Codex; there is
+  no public replacement). Linux uses `bwrap` (install `bubblewrap`).
+- **Network is allowed** in v1 — writes are contained but a command can still reach the network.
+  Network containment is a future toggle.
+- Reads are unrestricted, so a command can still *read* `~/.ssh` / `~/.aws`. Tighten with a deny-read
+  layer if your threat model needs it.
+
+## Implementation
+
+- `coding/shell-sandbox.js` — `sandboxAvailable()`, `buildSeatbeltProfile()`, `wrapShellArgv()`,
+  `shellSandboxEnabled()`.
+- `coding/permission-service.js` — headless block returns `allow + source:'sandbox'` for an unlisted
+  `run_shell` when the flag + a backend are present.
+- `tools/local-tools.js` — `runShell` / `runShellBackground` wrap the spawn via `wrapShellArgv` for
+  non-denylisted commands; the static allowlist gate is skipped under the sandbox (the OS is the
+  boundary), the denylist is honored as a floor.
+- Tests: `tests/shell-sandbox.test.js` (incl. a real Seatbelt containment check),
+  `tests/shell-sandbox-runner.test.js`, `tests/permission-service-sandbox.test.js`.

package/template/wall-e/extraction/knowledge-extractor.js

@@ -7,6 +7,53 @@ const VALID_CATEGORIES = ['technical', 'preference', 'relationship', 'work', 'pe
 const REQUIRED_FIELDS = ['category', 'subject', 'predicate', 'object'];
 const MAX_CONTENT_LENGTH = 2000;
 const MAX_FIELD_LENGTH = 500;
+const MAX_STRUCTURED_PREVIEW_LENGTH = 4000;
+const MAX_SOURCE_MEMORY_IDS = 20;
+
+function scalarString(value) {
+  if (typeof value === 'string') return value;
+  if (typeof value === 'number' || typeof value === 'boolean' || typeof value === 'bigint') return String(value);
+  return null;
+}
+
+function normalizeKnowledgeField(value) {
+  const scalar = scalarString(value);
+  if (scalar == null) return null;
+  const normalized = scalar.replace(/\s+/g, ' ').trim();
+  if (!normalized) return null;
+  return normalized.length > MAX_FIELD_LENGTH ? normalized.slice(0, MAX_FIELD_LENGTH) : normalized;
+}
+
+function normalizeSourceMemoryIds(value) {
+  const raw = Array.isArray(value) ? value : value == null ? [] : [value];
+  const ids = [];
+  const seen = new Set();
+  for (const item of raw) {
+    const id = normalizeKnowledgeField(item);
+    if (!id || seen.has(id)) continue;
+    seen.add(id);
+    ids.push(id);
+    if (ids.length >= MAX_SOURCE_MEMORY_IDS) break;
+  }
+  return ids;
+}
+
+function normalizeMemoryContent(content) {
+  if (content == null) return '';
+  if (typeof content === 'string') return content;
+  if (Buffer.isBuffer(content)) return content.toString('utf8');
+  if (typeof content === 'number' || typeof content === 'boolean') return String(content);
+  try {
+    return JSON.stringify(content, (_key, value) => {
+      if (typeof value === 'string' && value.length > MAX_STRUCTURED_PREVIEW_LENGTH) {
+        return value.slice(0, MAX_STRUCTURED_PREVIEW_LENGTH) + '...[truncated]';
+      }
+      return value;
+    });
+  } catch {
+    return String(content);
+  }
+}
 
 /**
  * Escape memory content to prevent prompt injection.
@@ -14,9 +61,10 @@ const MAX_FIELD_LENGTH = 500;
  */
 function escapeMemoryContent(content) {
   if (!content) return '';
-  const truncated = content.length > MAX_CONTENT_LENGTH
-    ? content.slice(0, MAX_CONTENT_LENGTH) + '...[truncated]'
-    : content;
+  const normalized = normalizeMemoryContent(content);
+  const truncated = normalized.length > MAX_CONTENT_LENGTH
+    ? normalized.slice(0, MAX_CONTENT_LENGTH) + '...[truncated]'
+    : normalized;
   return truncated.replace(/```/g, '` ` `');
 }
 
@@ -87,32 +135,37 @@ function parseExtractionResponse(text) {
       return { knowledge: [], classifications: [] };
     }
 
-    const validKnowledge = knowledgeEntries.filter(entry => {
-      if (!REQUIRED_FIELDS.every(field => entry[field] !== undefined && entry[field] !== null)) {
-        return false;
-      }
+    const validKnowledge = knowledgeEntries.map(entry => {
+      if (!entry || typeof entry !== 'object') return null;
+      const normalized = { ...entry };
       for (const field of REQUIRED_FIELDS) {
-        if (typeof entry[field] === 'string' && entry[field].length > MAX_FIELD_LENGTH) {
-          entry[field] = entry[field].slice(0, MAX_FIELD_LENGTH);
-        }
+        const value = normalizeKnowledgeField(entry[field]);
+        if (value == null) return null;
+        normalized[field] = value;
       }
+      normalized.source_memory_ids = normalizeSourceMemoryIds(entry.source_memory_ids);
       if (entry.confidence !== undefined) {
-        entry.confidence = Number(entry.confidence);
-        if (isNaN(entry.confidence) || entry.confidence < 0 || entry.confidence > 1) {
-          entry.confidence = 0.5;
+        normalized.confidence = Number(entry.confidence);
+        if (isNaN(normalized.confidence) || normalized.confidence < 0 || normalized.confidence > 1) {
+          normalized.confidence = 0.5;
         }
       }
-      return true;
-    });
+      return normalized;
+    }).filter(Boolean);
 
     // Validate classifications
-    const validClassifications = classifications.filter(c =>
-      c.memory_id && c.domain && VALID_DOMAINS.includes(c.domain)
-    ).map(c => ({
-      memory_id: c.memory_id,
-      domain: c.domain,
-      topic: typeof c.topic === 'string' ? c.topic.slice(0, 100).toLowerCase() : null,
-    }));
+    const validClassifications = classifications.map(c => {
+      if (!c || typeof c !== 'object') return null;
+      const memoryId = normalizeKnowledgeField(c.memory_id);
+      const domain = normalizeKnowledgeField(c.domain);
+      if (!memoryId || !domain || !VALID_DOMAINS.includes(domain)) return null;
+      const topic = normalizeKnowledgeField(c.topic);
+      return {
+        memory_id: memoryId,
+        domain,
+        topic: topic ? topic.slice(0, 100).toLowerCase() : null,
+      };
+    }).filter(Boolean);
 
     return { knowledge: validKnowledge, classifications: validClassifications };
   } catch (_) {
@@ -162,4 +215,4 @@ async function extractKnowledge(memories, ownerName, opts = {}) {
 // Re-export buildClientOpts for backward compatibility (used by contradiction.js, skill-executor.js, etc.)
 const buildClientOpts = buildClientOptsFromEnv;
 
-module.exports = { buildExtractionPrompt, parseExtractionResponse, extractKnowledge, buildClientOpts, VALID_DOMAINS };
+module.exports = { buildExtractionPrompt, parseExtractionResponse, extractKnowledge, buildClientOpts, VALID_DOMAINS, normalizeMemoryContent };

package/template/wall-e/http/chat-api.js

@@ -166,6 +166,14 @@ function buildChatOptionsFromRequestBody(body = {}, {
     allowNetworkLocationInference: true,
     abortSignal,
     attachments: parsedAttachments.length ? parsedAttachments : undefined,
+    // Durable branch-tree identity for the default chat: the client mints a stable
+    // message id (so the optimistic bubble, the durable jsonl/db record, and the echo
+    // share identity) and, for an edit-resend, the parent the new prompt is a sibling
+    // under. Absent on a normal turn → the user message gets a uuid + the session head
+    // as parent (linear append).
+    clientMessageId: body.clientMessageId || body.client_message_id || undefined,
+    parentUuid: body.parentUuid !== undefined ? body.parentUuid
+      : (body.parent_uuid !== undefined ? body.parent_uuid : undefined),
   };
 }
 
@@ -447,7 +455,9 @@ function handleWalleChatApi(req, res, url, { brain, ensureBrainInit }) {
     try {
       const sessionId = params.get('session_id') || 'default';
       const limit = parseLimit(params, 100);
-      const data = brain.listChatMessages({ session_id: sessionId, limit });
+      const data = typeof brain.listChatMessagesWithParts === 'function'
+        ? brain.listChatMessagesWithParts({ session_id: sessionId, limit })
+        : brain.listChatMessages({ session_id: sessionId, limit });
       jsonResponse(res, { data });
     } catch (e) {
       jsonResponse(res, { error: e.message }, 500);
@@ -503,34 +513,42 @@ function handleWalleChatApi(req, res, url, { brain, ensureBrainInit }) {
     return true;
   }
 
+  // Branch state is tree-only now: the conversation tree is rebuilt from the
+  // chat_messages parent_uuid edges, so the ONLY persisted branch state is the
+  // head-leaf pointer (KV walle_session_head:<sid>). No index blob.
   if (p === '/api/wall-e/chat/branches' && m === 'GET') {
     if (!ensureChatBrain(res, brain, ensureBrainInit)) return true;
     const sid = params.get('session_id') || 'default';
     try {
-      jsonResponse(res, { data: brain.loadChatBranches(sid) });
+      let headUuid = '';
+      let headFrozen = false;
+      try { if (typeof brain.getKv === 'function') headUuid = brain.getKv('walle_session_head:' + sid) || ''; } catch (_) { /* best-effort */ }
+      // The "stop here" marker set by an explicit delete; absent (falsy) on legacy heads.
+      try { if (typeof brain.getKv === 'function') headFrozen = brain.getKv('walle_session_head_frozen:' + sid) === '1'; } catch (_) { /* best-effort */ }
+      jsonResponse(res, { data: { head_uuid: headUuid, head_frozen: headFrozen } });
     } catch (e) {
       jsonResponse(res, { error: e.message }, 500);
     }
     return true;
   }
 
-  if (p === '/api/wall-e/chat/branches' && m === 'POST') {
+  if (p === '/api/wall-e/chat/branch-state' && m === 'POST') {
     if (!ensureChatBrain(res, brain, ensureBrainInit)) return true;
-    // A branch snapshot serializes the whole conversation (active history plus
-    // every stored branch version), so it routinely outgrows the 1MB default —
-    // use the same large limit as the chat-send endpoint, which carries the
-    // same message payloads.
-    readBody(req, { maxBytes: BODY_LIMIT_LARGE }).then(body => {
+    readBody(req).then(body => {
       try {
-        const updatedAtMs = Number(body.updated_at_ms || body.saved_at_ms || body.updatedAtMs || body.savedAtMs || 0) || Date.now();
-        brain.saveChatBranches(body.session_id || 'default', body.branches || {}, body.active || {}, body.history || [], updatedAtMs);
+        if (typeof body.head_uuid === 'string' && typeof brain.setKv === 'function') {
+          try { brain.setKv('walle_session_head:' + (body.session_id || 'default'), body.head_uuid); } catch (_) { /* best-effort */ }
+        }
+        // Persist the explicit-delete "stop here" marker alongside the head so a frozen
+        // delete-view survives reload (and clears the instant the head moves forward).
+        if (typeof body.head_frozen !== 'undefined' && typeof brain.setKv === 'function') {
+          try { brain.setKv('walle_session_head_frozen:' + (body.session_id || 'default'), body.head_frozen ? '1' : ''); } catch (_) { /* best-effort */ }
+        }
         jsonResponse(res, { data: { ok: true } });
       } catch (e) {
         jsonResponse(res, { error: e.message }, 500);
       }
     }).catch(e => {
-      // An oversize body is a 413, not a generic 400, so the client can tell
-      // "too big" from a malformed/aborted request.
       if (e && e.code === 'BODY_TOO_LARGE') { send413(res, e); return; }
       jsonResponse(res, { error: e.message }, 400);
     });

package/template/wall-e/http/model-admin.js

@@ -714,6 +714,55 @@ async function handleModelAdminApi(req, res, url) {
     }
   }
 
+  if (p === '/api/models/routing-policy' && m === 'GET') {
+    if (!brainApi) return jsonResponse(res, 500, { error: 'Wall-E brain not available' });
+    try {
+      const { getPersistedRoutingPolicy } = require('../llm/routing-policy');
+      return jsonResponse(res, 200, getPersistedRoutingPolicy({ brain: brainApi }));
+    } catch (e) {
+      return jsonResponse(res, 500, { error: e.message });
+    }
+  }
+
+  if (p === '/api/models/routing-policy' && m === 'POST') {
+    if (!brainApi) return jsonResponse(res, 500, { error: 'Wall-E brain not available' });
+    try {
+      const body = await readSmallJsonBody(req);
+      const { materializeRoutingPolicy, setRoutingPolicySettings } = require('../llm/routing-policy');
+      const settings = setRoutingPolicySettings(brainApi, body || {});
+      try { require('../llm/client').resetDefaultClient(); } catch {}
+      return jsonResponse(res, 200, { ok: true, settings, policy: materializeRoutingPolicy({ brain: brainApi }) });
+    } catch (e) {
+      return jsonResponse(res, 400, { error: e.message });
+    }
+  }
+
+  if (p === '/api/models/routing-policy/routes' && m === 'POST') {
+    if (!brainApi) return jsonResponse(res, 500, { error: 'Wall-E brain not available' });
+    try {
+      const body = await readSmallJsonBody(req);
+      const { setUserRoutingPolicyRoutes } = require('../llm/routing-policy');
+      const routes = body && body.reset ? [] : (body && body.routes);
+      const policy = setUserRoutingPolicyRoutes({ brain: brainApi, routes });
+      try { require('../llm/client').resetDefaultClient(); } catch {}
+      return jsonResponse(res, 200, { ok: true, policy });
+    } catch (e) {
+      return jsonResponse(res, 400, { error: e.message });
+    }
+  }
+
+  if (p === '/api/models/routing-policy/refresh' && m === 'POST') {
+    if (!brainApi) return jsonResponse(res, 500, { error: 'Wall-E brain not available' });
+    try {
+      const { materializeRoutingPolicy } = require('../llm/routing-policy');
+      const policy = materializeRoutingPolicy({ brain: brainApi, repairDefault: true });
+      try { require('../llm/client').resetDefaultClient(); } catch {}
+      return jsonResponse(res, 200, { ok: true, policy });
+    } catch (e) {
+      return jsonResponse(res, 400, { error: e.message });
+    }
+  }
+
   if (p === '/api/models/provider-route-policy' && m === 'POST') {
     if (!brainApi) return jsonResponse(res, 500, { error: 'Wall-E brain not available' });
     try {
@@ -998,9 +1047,12 @@ async function handleModelAdminApi(req, res, url) {
     if (!brainApi) return jsonResponse(res, 500, { error: 'Wall-E brain not available' });
     try {
       const days = parseScorecardDays(url.searchParams.get('days'), 7);
+      // One GROUP BY for all models instead of one query per model (thousands).
+      const statsByModel = brainApi.getModelScorecardsBatch(days);
+      const emptyStats = brainApi.emptyModelScorecardStats();
       const scorecard = brainApi.listAllModels().map((model) => ({
         ...model,
-        stats: brainApi.getModelScorecard(model.id, days),
+        stats: statsByModel.get(model.id) || emptyStats,
       }));
       let benchmarks = [];
       let benchmarkCoverage = null;
@@ -1038,6 +1090,20 @@ async function handleModelAdminApi(req, res, url) {
     }
   }
 
+  if (p === '/api/models/session-token-summary' && m === 'GET') {
+    if (!brainApi) return jsonResponse(res, 500, { error: 'Wall-E brain not available' });
+    try {
+      const sessionId = url.searchParams.get('session_id') || url.searchParams.get('sessionId') || '';
+      if (!String(sessionId || '').trim()) return jsonResponse(res, 400, { error: 'session_id required' });
+      const summary = typeof brainApi.summarizeSessionModelUsage === 'function'
+        ? brainApi.summarizeSessionModelUsage({ sessionId })
+        : null;
+      return jsonResponse(res, 200, { summary });
+    } catch (e) {
+      return jsonResponse(res, 500, { error: e.message });
+    }
+  }
+
   if (p === '/api/models/test-connection' && m === 'POST') {
     try {
       const body = await readSmallJsonBody(req);
@@ -1063,6 +1129,32 @@ async function handleModelAdminApi(req, res, url) {
         baseUrl,
         customHeaders: parseCustomHeaders(customHeaders),
       });
+      if (typeof client.probeConnection === 'function') {
+        const probe = await client.probeConnection({
+          model: body.model || body.modelId || body.model_id,
+          timeoutMs: Number(body.timeoutMs || body.timeout_ms || 25000),
+        });
+        try {
+          const { recordProviderHealthStatus } = require('../llm/provider-health-state');
+          recordProviderHealthStatus({
+            provider: providerType,
+            model: probe.model || body.model || '',
+            ok: probe.ok === true,
+            source: 'model-admin-test',
+            error_type: probe.error_type || '',
+            error: probe.error || '',
+            latency_ms: probe.latency_ms,
+            diagnostics: probe.diagnostics || null,
+          }, { brain });
+        } catch {}
+        if (!probe.ok) {
+          return jsonResponse(res, 400, { error: probe.error || 'Provider not available', probe });
+        }
+        const models = Array.isArray(probe.models)
+          ? probe.models.map((id) => ({ id, name: id }))
+          : await client.listModels().catch(() => []);
+        return jsonResponse(res, 200, { ok: true, models, probe });
+      }
       if (client.isAvailable) {
         const available = await client.isAvailable();
         if (!available) return jsonResponse(res, 400, { error: 'Provider not available' });