crewx 0.9.0-rc.2 → 0.9.0-rc.21

package/dist-server/domain/doc/doc.controller.js

@@ -12,13 +12,25 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DocController = void 0;
+exports.DocController = exports.DOC_HTML_CSP = void 0;
 const common_1 = require("@nestjs/common");
 const swagger_1 = require("@nestjs/swagger");
 const fs_1 = require("fs");
 const path_1 = require("path");
 const doc_service_js_1 = require("./doc.service.js");
 const doc_dto_js_1 = require("./dto/doc.dto.js");
+exports.DOC_HTML_CSP = "sandbox allow-scripts; " +
+    "default-src 'none'; " +
+    "style-src 'self' 'unsafe-inline'; " +
+    "script-src 'self' 'unsafe-inline'; " +
+    "img-src 'self' data:; " +
+    "font-src 'self' data:; " +
+    "connect-src 'none'; " +
+    "form-action 'none'; " +
+    "base-uri 'none'; " +
+    "object-src 'none'; " +
+    "worker-src 'none'; " +
+    "frame-ancestors 'self'";
 let DocController = class DocController {
     docService;
     constructor(docService) {
@@ -55,16 +67,38 @@ let DocController = class DocController {
         });
         (0, fs_1.createReadStream)(absPath).pipe(res);
     }
-    // DOC.FILE: Serve PDF file inline
+    // DOC.FILE: Serve PDF or HTML file inline
     serveFile(filePath, res) {
         const { absPath, mime } = this.docService.getDocFilePath(filePath);
         const stat = (0, fs_1.statSync)(absPath);
-        res.set({
-            'Content-Type': mime,
-            'Content-Length': stat.size,
-            'Content-Disposition': `inline; filename="${(0, path_1.basename)(absPath)}"`,
-            'Cache-Control': 'public, max-age=3600',
-        });
+        const safeFilename = (0, doc_service_js_1.sanitizeFilename)((0, path_1.basename)(absPath));
+        const isHtml = mime.startsWith('text/html');
+        if (isHtml) {
+            // C-3: Security headers hardcoded — not configurable via env/config
+            // C-4: Cache-Control for HTML: private, no-store
+            // C-5: Isolation header set. sandbox allow-scripts permits the mockup's own
+            // inline/local CSS+JS to render, but WITHOUT allow-same-origin — so the framed
+            // document cannot read cookies/session or call same-origin APIs. Resource loads
+            // are scoped to same-origin wireframe assets only.
+            res.set({
+                'Content-Type': 'text/html; charset=utf-8',
+                'Content-Length': stat.size,
+                'Content-Disposition': `inline; filename="${safeFilename}"`,
+                'Cache-Control': 'private, no-store',
+                'Content-Security-Policy': exports.DOC_HTML_CSP,
+                'X-Content-Type-Options': 'nosniff',
+                'X-Frame-Options': 'SAMEORIGIN',
+            });
+        }
+        else {
+            // PDF: preserve existing behavior
+            res.set({
+                'Content-Type': mime,
+                'Content-Length': stat.size,
+                'Content-Disposition': `inline; filename="${safeFilename}"`,
+                'Cache-Control': 'public, max-age=3600',
+            });
+        }
         (0, fs_1.createReadStream)(absPath).pipe(res);
     }
     // DOC.SAVE: Save document content
@@ -115,7 +149,7 @@ __decorate([
     __metadata("design:returntype", void 0)
 ], DocController.prototype, "serveImage", null);
 __decorate([
-    (0, swagger_1.ApiOperation)({ operationId: 'DOC.FILE', summary: 'Stream a PDF document file inline' }),
+    (0, swagger_1.ApiOperation)({ operationId: 'DOC.FILE', summary: 'Stream a PDF or HTML document file inline' }),
     (0, common_1.Get)('file'),
     __param(0, (0, common_1.Query)('path')),
     __param(1, (0, common_1.Res)()),

package/dist-server/domain/doc/doc.service.js

@@ -7,14 +7,32 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DocService = void 0;
+exports.sanitizeFilename = sanitizeFilename;
 const common_1 = require("@nestjs/common");
 const fs_1 = require("fs");
+const node_fs_1 = require("node:fs");
 const path_1 = require("path");
 const node_crypto_1 = require("node:crypto");
 const doc_1 = require("@crewx/doc");
 const knowledge_core_1 = require("@crewx/knowledge-core");
 const workspace_context_store_js_1 = require("../../common/workspace-context.store.js");
 const image_constants_js_1 = require("./image-constants.js");
+/** Allowed directory prefix for HTML/HTM files and companion assets (C-2) */
+const HTML_ALLOWED_DIR = 'docs/wireframe';
+/** Max file size for HTML files: 5MB (C-size limit) */
+const HTML_MAX_BYTES = 5 * 1024 * 1024;
+/**
+ * Sanitize a filename for use in Content-Disposition header (C-7).
+ * Strips CR, LF, double-quote, and other control characters.
+ * Allows alphanumeric, dot, hyphen, underscore, parentheses, and space.
+ */
+function sanitizeFilename(name) {
+    return name.replace(/[^\w.\-() ]/g, '_').replace(/\s+/g, ' ').trim();
+}
+function isDocsWireframePath(filePath) {
+    const normalized = filePath.replace(/\\/g, '/').toLowerCase();
+    return normalized === HTML_ALLOWED_DIR || normalized.startsWith(HTML_ALLOWED_DIR + '/');
+}
 // Screen ID → page directory mapping for code existence check
 const SCREEN_CODE_PATHS = {
     NAVUI: 'src/ui/components/layout',
@@ -107,7 +125,9 @@ let DocService = class DocService {
             }
             else if (entry.isFile()) {
                 const ext = entry.name.split('.').pop()?.toLowerCase() ?? '';
-                if (entry.name.endsWith('.md') || image_constants_js_1.IMAGE_EXTENSIONS.has(ext) || ext === 'pdf') {
+                const entryRel = rel ? `${rel}/${entry.name}` : entry.name;
+                const isWireframeHtml = (ext === 'html' || ext === 'htm') && isDocsWireframePath(entryRel);
+                if (entry.name.endsWith('.md') || image_constants_js_1.IMAGE_EXTENSIONS.has(ext) || ext === 'pdf' || isWireframeHtml) {
                     children.push(this.fileNode(entryAbs));
                 }
             }
@@ -368,20 +388,74 @@ let DocService = class DocService {
         return { absPath: abs, mime: image_constants_js_1.EXT_MIME[ext] };
     }
     /**
-     * DOC.FILE: Validate a PDF path and return its absolute filesystem path.
-     * Only PDF is allowed in v1. Non-PDF and missing files return 404.
+     * DOC.FILE: Validate a PDF/HTML path and return its absolute filesystem path.
+     * Allowed extensions: pdf, html, htm.
+     * Security conditions C-1~C-6 enforced here.
      */
     getDocFilePath(filePath) {
-        const ext = filePath.split('.').pop()?.toLowerCase() ?? '';
-        if (ext !== 'pdf') {
+        // C-6: Null byte / control character rejection
+        if (filePath.includes('\0') || /[\x01-\x1f\x7f]/.test(filePath)) {
             throw new common_1.NotFoundException('Not found');
         }
+        // C-6: Lowercase-normalize extension before whitelist check
+        const normalizedPath = filePath.toLowerCase();
+        // Extract final extension only (guards against double-extension like .html.pdf)
+        const ext = normalizedPath.split('.').pop() ?? '';
+        const mime = image_constants_js_1.FILE_MIME[ext];
+        if (!mime) {
+            // C-6: svg/xhtml and anything outside whitelist → 404 (no info leak)
+            throw new common_1.NotFoundException('Not found');
+        }
+        // C-2: HTML/HTM and wireframe assets (css/js) must be under docs/wireframe/ only
+        const isHtml = ext === 'html' || ext === 'htm';
+        const isWireframeAsset = ext === 'css' || ext === 'js';
+        if (isHtml || isWireframeAsset) {
+            const normalizedRelative = filePath.replace(/\\/g, '/');
+            if (!isDocsWireframePath(normalizedRelative)) {
+                throw new common_1.NotFoundException('Not found');
+            }
+        }
+        // Path traversal boundary check (rejects '..' and paths outside projectRoot)
         this.validatePathBoundary(filePath);
         const abs = (0, path_1.resolve)(this.projectRoot, filePath);
+        // C-1: Symlink defense — reject symlinks outright (lstat check)
+        let lstatResult;
+        try {
+            lstatResult = (0, fs_1.lstatSync)(abs);
+        }
+        catch {
+            throw new common_1.NotFoundException('Not found');
+        }
+        if (lstatResult.isSymbolicLink()) {
+            throw new common_1.NotFoundException('Not found');
+        }
+        // C-1: Realpath re-validation — resolve any remaining symlinks in parent dirs
+        // projectRoot must also be realpath'd to handle /tmp → /private/tmp on macOS
+        let realAbs;
+        let realRoot;
+        try {
+            realAbs = (0, node_fs_1.realpathSync)(abs);
+            realRoot = (0, node_fs_1.realpathSync)(this.projectRoot);
+        }
+        catch {
+            throw new common_1.NotFoundException('Not found');
+        }
+        const realCmp = realAbs.replace(/\\/g, '/').toLowerCase();
+        const rootCmp = realRoot.replace(/\\/g, '/').toLowerCase();
+        if (realCmp !== rootCmp && !realCmp.startsWith(rootCmp + '/')) {
+            throw new common_1.NotFoundException('Not found');
+        }
         if (!(0, fs_1.existsSync)(abs)) {
             throw new common_1.NotFoundException('Not found');
         }
-        return { absPath: abs, mime: 'application/pdf' };
+        // File size limit for HTML and wireframe assets (C-size limit: 5MB)
+        if (isHtml || isWireframeAsset) {
+            const stat = (0, fs_1.statSync)(abs);
+            if (stat.size > HTML_MAX_BYTES) {
+                throw new common_1.NotFoundException('Not found');
+            }
+        }
+        return { absPath: abs, mime };
     }
     validateEditable(filePath) {
         const lower = filePath.toLowerCase();

package/dist-server/domain/doc/image-constants.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.EXT_MIME = exports.IMAGE_EXTENSIONS = void 0;
+exports.FILE_EXTENSIONS = exports.FILE_MIME = exports.EXT_MIME = exports.IMAGE_EXTENSIONS = void 0;
 exports.IMAGE_EXTENSIONS = new Set(['png', 'jpg', 'jpeg', 'gif', 'webp']);
 exports.EXT_MIME = {
     png: 'image/png',
@@ -9,3 +9,13 @@ exports.EXT_MIME = {
     gif: 'image/gif',
     webp: 'image/webp',
 };
+/** MIME map for DOC.FILE — pdf/html/htm plus wireframe assets (css/js). svg/xhtml excluded. */
+exports.FILE_MIME = {
+    pdf: 'application/pdf',
+    html: 'text/html; charset=utf-8',
+    htm: 'text/html; charset=utf-8',
+    css: 'text/css; charset=utf-8',
+    js: 'text/javascript; charset=utf-8',
+};
+/** Allowed file extensions for DOC.FILE endpoint */
+exports.FILE_EXTENSIONS = new Set(Object.keys(exports.FILE_MIME));

package/dist-server/domain/events/workspace-events.controller.js

@@ -19,6 +19,7 @@ const rxjs_1 = require("rxjs");
 const operators_1 = require("rxjs/operators");
 const workspace_event_bus_js_1 = require("./workspace-event.bus.js");
 const workspace_decorator_js_1 = require("../../common/decorators/workspace.decorator.js");
+const skip_request_log_decorator_js_1 = require("../../common/decorator/skip-request-log.decorator.js");
 const KEEPALIVE_INTERVAL_MS = 15_000;
 let WorkspaceEventsController = class WorkspaceEventsController {
     bus;
@@ -42,6 +43,7 @@ __decorate([
     __metadata("design:returntype", rxjs_1.Observable)
 ], WorkspaceEventsController.prototype, "stream", null);
 exports.WorkspaceEventsController = WorkspaceEventsController = __decorate([
+    (0, skip_request_log_decorator_js_1.SkipRequestLog)(),
     (0, common_1.Controller)('ws/:slug/events'),
     __metadata("design:paramtypes", [workspace_event_bus_js_1.WorkspaceEventBus])
 ], WorkspaceEventsController);

package/dist-server/domain/message/dto/send-message.dto.js

@@ -9,7 +9,7 @@ var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SendMessageDto = exports.ImageAttachmentDto = void 0;
+exports.SendMessageDto = exports.OverdriveDto = exports.ImageAttachmentDto = void 0;
 const swagger_1 = require("@nestjs/swagger");
 const class_validator_1 = require("class-validator");
 const class_transformer_1 = require("class-transformer");
@@ -37,23 +37,55 @@ __decorate([
     (0, swagger_1.ApiPropertyOptional)({ description: 'Original filename' }),
     __metadata("design:type", String)
 ], ImageAttachmentDto.prototype, "filename", void 0);
+class OverdriveDto {
+    action;
+    turns;
+}
+exports.OverdriveDto = OverdriveDto;
+__decorate([
+    (0, class_validator_1.IsIn)(['enable-count', 'enable-latch', 'disable', 'use-current']),
+    (0, swagger_1.ApiProperty)({
+        description: 'Overdrive (boost) action to apply for this request',
+        enum: ['enable-count', 'enable-latch', 'disable', 'use-current'],
+    }),
+    __metadata("design:type", String)
+], OverdriveDto.prototype, "action", void 0);
+__decorate([
+    (0, class_validator_1.IsInt)(),
+    (0, class_validator_1.Min)(1),
+    (0, class_validator_1.IsOptional)(),
+    (0, swagger_1.ApiPropertyOptional)({ description: 'Turn count for enable-count (default 3)', minimum: 1 }),
+    __metadata("design:type", Number)
+], OverdriveDto.prototype, "turns", void 0);
+/** True when the request only toggles boost state and carries no message. */
+function isStateOnlyOverdrive(o) {
+    return ((!o.message || !o.message.trim()) &&
+        !!o.overdrive &&
+        o.overdrive.action !== 'use-current');
+}
 class SendMessageDto {
+    // message/agent are required for a normal send, but NOT for a state-only boost
+    // toggle (enable-count / enable-latch / disable), which carries `overdrive` alone.
     message;
     agent;
     title;
     mode = 'query';
+    model;
     images;
     context;
     browserSessionId;
+    overdrive;
 }
 exports.SendMessageDto = SendMessageDto;
 __decorate([
+    (0, class_validator_1.ValidateIf)((o) => !isStateOnlyOverdrive(o)),
     (0, class_validator_1.IsString)(),
     (0, class_validator_1.IsNotEmpty)(),
     (0, swagger_1.ApiProperty)({ description: 'Message content to send' }),
     __metadata("design:type", String)
 ], SendMessageDto.prototype, "message", void 0);
 __decorate([
+    (0, class_validator_1.ValidateIf)((o) => !isStateOnlyOverdrive(o)),
     (0, class_validator_1.IsString)(),
     (0, class_validator_1.IsNotEmpty)(),
     (0, swagger_1.ApiProperty)({ description: 'Target agent ID' }),
@@ -71,6 +103,12 @@ __decorate([
     (0, swagger_1.ApiPropertyOptional)({ description: 'Execution mode: query (read-only, default) or execute (full permissions)', default: 'query' }),
     __metadata("design:type", String)
 ], SendMessageDto.prototype, "mode", void 0);
+__decorate([
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsOptional)(),
+    (0, swagger_1.ApiPropertyOptional)({ description: 'Model override for this request (falls back to agent default)' }),
+    __metadata("design:type", String)
+], SendMessageDto.prototype, "model", void 0);
 __decorate([
     (0, class_validator_1.IsOptional)(),
     (0, class_validator_1.ValidateNested)({ each: true }),
@@ -90,3 +128,13 @@ __decorate([
     (0, swagger_1.ApiPropertyOptional)({ description: 'Chrome X browser MCP session id for reverse browser-tool calls' }),
     __metadata("design:type", String)
 ], SendMessageDto.prototype, "browserSessionId", void 0);
+__decorate([
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.ValidateNested)(),
+    (0, class_transformer_1.Type)(() => OverdriveDto),
+    (0, swagger_1.ApiPropertyOptional)({
+        description: 'Overdrive (boost) action. enable-count: N-turn countdown; enable-latch: until disabled; disable: off; use-current: read thread state.',
+        type: OverdriveDto,
+    }),
+    __metadata("design:type", OverdriveDto)
+], SendMessageDto.prototype, "overdrive", void 0);

package/dist-server/domain/message/message.controller.js

@@ -50,7 +50,7 @@ let MessageController = class MessageController {
     }
     // MSG.SEND: Send message to thread (spawns crewx CLI in background)
     async sendMessage(threadId, body, ws) {
-        const data = await this.messageService.sendMessage(threadId, body.message, body.agent, body.mode, body.title, ws.id, body.images, body.context, body.browserSessionId);
+        const data = await this.messageService.sendMessage(threadId, body.message, body.agent, body.mode, body.title, ws.id, body.images, body.context, body.browserSessionId, body.overdrive, body.model);
         return { success: true, data };
     }
     serveAttachment(threadId, filename, res) {

package/dist-server/domain/message/message.module.js

@@ -13,12 +13,13 @@ const message_service_js_1 = require("./message.service.js");
 const thread_service_js_1 = require("../thread/thread.service.js");
 const box_service_js_1 = require("../box/box.service.js");
 const crewx_module_js_1 = require("../../modules/crewx.module.js");
+const settings_module_js_1 = require("../settings/settings.module.js");
 let MessageModule = class MessageModule {
 };
 exports.MessageModule = MessageModule;
 exports.MessageModule = MessageModule = __decorate([
     (0, common_1.Module)({
-        imports: [crewx_module_js_1.CrewxModule],
+        imports: [crewx_module_js_1.CrewxModule, settings_module_js_1.SettingsModule],
         controllers: [message_controller_js_1.MessageController],
         providers: [message_service_js_1.MessageService, thread_service_js_1.ThreadService, box_service_js_1.BoxService],
     })

package/dist-server/domain/message/message.service.js

@@ -8,6 +8,9 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
 var MessageService_1;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MessageService = void 0;
@@ -20,15 +23,18 @@ const thread_repository_js_1 = require("../../repository/thread.repository.js");
 const sdk_1 = require("@crewx/sdk");
 const crewx_pool_service_js_1 = require("../../modules/crewx-pool.service.js");
 const workspace_context_store_js_1 = require("../../common/workspace-context.store.js");
+const settings_service_js_1 = require("../settings/settings.service.js");
 let MessageService = MessageService_1 = class MessageService {
     crewxPool;
     threadService;
     threadRepo;
+    settingsService;
     logger = new common_1.Logger(MessageService_1.name);
-    constructor(crewxPool, threadService, threadRepo) {
+    constructor(crewxPool, threadService, threadRepo, settingsService) {
         this.crewxPool = crewxPool;
         this.threadService = threadService;
         this.threadRepo = threadRepo;
+        this.settingsService = settingsService;
     }
     // MSG.LIST: List messages with Hot/Warm zone integration
     listMessages(threadId, boxService, params, workspaceId) {
@@ -83,6 +89,9 @@ let MessageService = MessageService_1 = class MessageService {
                 if (meta?.logs) {
                     item.logs = this.filterLogs(meta.logs);
                 }
+                if (meta?.progressSteps) {
+                    item.progressSteps = meta.progressSteps;
+                }
             }
         }
         // 2) Include logs for latest logsTail completed tasks
@@ -99,6 +108,9 @@ let MessageService = MessageService_1 = class MessageService {
                 if (meta?.logs) {
                     completedItems[i].logs = this.filterLogs(meta.logs);
                 }
+                if (meta?.progressSteps) {
+                    completedItems[i].progressSteps = meta.progressSteps;
+                }
             }
         }
         // Merge warm boxes + hot tasks in chronological order
@@ -113,8 +125,23 @@ let MessageService = MessageService_1 = class MessageService {
         };
     }
     // MSG.SEND: Send message — fire crewx SDK; ConversationPlugin persists threads row
-    async sendMessage(threadId, message, agent, mode = 'query', title, workspaceId, images, context, browserSessionId) {
+    async sendMessage(threadId, message, agent, mode = 'query', title, workspaceId, images, context, browserSessionId, overdrive, model) {
         this.validateId(threadId);
+        // A boost toggle (enable-count / enable-latch / disable) carries no message.
+        // It only mutates thread overdrive state and must NOT dispatch an agent.
+        // Detecting this lets the same endpoint serve "send message" and "toggle boost"
+        // without spawning a phantom empty task.
+        const isStateOnlyOverdrive = (!message || !message.trim()) &&
+            !!overdrive &&
+            overdrive.action !== 'use-current';
+        if (isStateOnlyOverdrive) {
+            this.threadRepo.resolveOverdriveForRequest(threadId, workspaceId, overdrive.action, {
+                turns: overdrive.turns,
+                defaultTurns: overdrive.turns ?? this.getOverdriveDefaultTurns(),
+                updatedBy: 'ui',
+            });
+            return { taskId: null, status: 'ok', agent: null };
+        }
         if (!message || !message.trim()) {
             throw new common_1.BadRequestException('message is required');
         }
@@ -131,6 +158,31 @@ let MessageService = MessageService_1 = class MessageService {
                 this.logger.warn(`updateThreadTitle skipped [thread=${threadId}]: ${err.message}`);
             }
         }
+        // ensureThread MUST run before resolveOverdriveForRequest so that the
+        // thread row exists when overdrive state is read/written. Without this
+        // ordering, the very first message on a new thread (ThreadNewPage) would
+        // find no thread row and overdrive would be silently ignored.
+        const crewx = await this.crewxPool.getForCurrentRequest();
+        const ensureWorkspaceId = workspaceId ?? crewx.workspaceId;
+        // Pre-call ensureThread so REST response is safe to follow with GET /threads/:id
+        // (frontend ThreadNewPage navigates to /threads/:id right after POST /messages).
+        const conv = crewx.plugins.find((p) => p.name === 'conversation')?.conversationProvider;
+        try {
+            await conv?.ensureThread(threadId, 'cli', ensureWorkspaceId);
+        }
+        catch (err) {
+            this.logger.warn(`ensureThread skipped [thread=${threadId}]: ${err.message}`);
+        }
+        // Resolve overdrive state atomically before dispatching the agent call.
+        // This runs inside a single SQLite transaction so concurrent requests
+        // cannot double-decrement the remaining count.
+        const overdriveAction = overdrive?.action ?? 'use-current';
+        const odResult = this.threadRepo.resolveOverdriveForRequest(threadId, workspaceId, overdriveAction, {
+            turns: overdrive?.turns,
+            defaultTurns: overdrive?.turns ?? this.getOverdriveDefaultTurns(),
+            consumeCurrent: overdriveAction === 'enable-count',
+            updatedBy: 'ui',
+        });
         const savedImages = this.saveImages(threadId, images);
         let finalMessage = message;
         if (savedImages.length > 0) {
@@ -154,23 +206,31 @@ let MessageService = MessageService_1 = class MessageService {
         if (browserSessionId?.trim()) {
             metadata.browserSessionId = browserSessionId.trim();
         }
+        // Propagate the overdrive signal + resulting state to the SDK.
+        // The SDK (WI-20260702-OD-CORE) reads metadata.overdrive to apply the
+        // configured provider/model override profile.
+        // The metadata is also forwarded to task:start → persisted in task.metadata,
+        // satisfying the "task records boost execution" requirement.
+        if (odResult?.applied) {
+            const overdriveMode = odResult.appliedMode ?? (odResult.state === 'latch' ? 'latch' : 'count');
+            metadata.overdrive = true;
+            metadata.overdriveState = overdriveMode;
+            metadata.overdriveMode = mode;
+        }
         const sdkOptions = {
             threadId,
             taskId,
             platform: 'cli',
             metadata,
             cwd: (0, workspace_context_store_js_1.getWorkspacePath)(),
+            ...(model ? { model } : {}),
+            // Forward the resolved overdrive signal to the SDK so it applies the
+            // configured provider/model override profile for this request. Without
+            // this, the SDK never sees the boost signal and runs the base model.
+            ...(odResult?.applied
+                ? { overdrive: { mode: odResult.appliedMode === 'latch' ? 'latch' : 'count' } }
+                : {}),
         };
-        const crewx = await this.crewxPool.getForCurrentRequest();
-        // Pre-call ensureThread so REST response is safe to follow with GET /threads/:id
-        // (frontend ThreadNewPage navigates to /threads/:id right after POST /messages).
-        const conv = crewx.plugins.find((p) => p.name === 'conversation')?.conversationProvider;
-        try {
-            await conv?.ensureThread(threadId, sdkOptions.platform, crewx.workspaceId);
-        }
-        catch (err) {
-            this.logger.warn(`ensureThread skipped [thread=${threadId}]: ${err.message}`);
-        }
         const agentRef = `@${agent}`;
         const sdkCall = mode === 'execute'
             ? crewx.execute(agentRef, finalMessage, sdkOptions)
@@ -204,6 +264,14 @@ let MessageService = MessageService_1 = class MessageService {
             return { relativePath, mimeType: img.mimeType, filename: img.filename };
         });
     }
+    getOverdriveDefaultTurns() {
+        try {
+            return this.settingsService?.getSettings().overdrive.defaultTurns;
+        }
+        catch {
+            return undefined;
+        }
+    }
     validateId(id) {
         if (!/^[\w\p{L}\p{N}._-]+$/u.test(id)) {
             throw new common_1.BadRequestException('Invalid ID format');
@@ -217,7 +285,9 @@ let MessageService = MessageService_1 = class MessageService {
 exports.MessageService = MessageService;
 exports.MessageService = MessageService = MessageService_1 = __decorate([
     (0, common_1.Injectable)(),
+    __param(3, (0, common_1.Optional)()),
     __metadata("design:paramtypes", [crewx_pool_service_js_1.CrewxPoolService,
         thread_service_js_1.ThreadService,
-        thread_repository_js_1.ThreadRepository])
+        thread_repository_js_1.ThreadRepository,
+        settings_service_js_1.SettingsService])
 ], MessageService);