freddie 0.0.102 → 0.0.104

package/AGENTS.md

@@ -30,7 +30,7 @@ When you touch one of the four direct-fetch utility plugins above, the right fix
 
 Consume these top-level acptoapi exports directly (no re-export shim, no helper module): `chat`, `stream`, `chain`, `chatChain`, `streamChain`, `fallback`, `buildAutoChain`, `resolveModel`, `parseCommaList`, `splitPrefix`, `listAllModelsAndQueues`, `resolveQueue`, `listAllQueues`, `loadMatrix`, `matrixScore`, `clearMatrixCache`, `peekStatus`, `getStatus`, `isAvailable`, `markFailed`, `markOk`, `resetAvailability`, `startSampler`, `stopSampler`, `createSampler`, `probe`, `probeModels`, `getCachedModels`, `getRunHistory`, `PROVIDER_KEYS`, `PROVIDER_DEFAULTS`.
 
-Public surface reference: `node_modules/acptoapi/AGENTS.md` "Public API — unified chain SDK". Acceptable freddie-side adapters (cannot be deleted yet): `model-discovery.js` (claude-cli/ACP/ollama probing breadth acptoapi doesn't cover), `model-sampler.js` (13L re-export shim — test.js imports from it), `model-matrix.js` (28L MATRIX_FILE path helper), `acptoapi-bridge.js` (HTTP daemon passthrough at FREDDIE_LLM_URL when reachable, for `claude/*` etc that need the OAuth-managed daemon).
+Public surface reference: `node_modules/acptoapi/AGENTS.md` "Public API — unified chain SDK". Acceptable freddie-side adapters (cannot be deleted yet): `model-discovery.js` (claude-cli/ACP/ollama probing breadth acptoapi doesn't cover; `listKnownProviders` merges `agent.discovered_models` keys + acptoapi `PROVIDER_KEYS` + `[claude-cli,kilo,opencode,ollama]`), `model-matrix.js` (28L MATRIX_FILE path helper + `matrixUsable` predicate — freddie-side because the matrix file path is repo-local), `acptoapi-bridge.js` (HTTP daemon passthrough at FREDDIE_LLM_URL when reachable, for `claude/*` etc that need the OAuth-managed daemon). Removed 2026-05-17: `src/agent/model-sampler.js` (was 13L re-export shim — callers now import sampler funcs directly via `createRequire('acptoapi')`).
 
 Matrix wired: shim passes `matrixSource: process.env.FREDDIE_MATRIX_URL || <repo>/.gm/model-availability.json` only for comma-list or `queue/<name>` model strings (single-shot omits to avoid leaking chain opts into upstream HTTP body — bug fixed in acptoapi 1.0.62 buildParams/_stripChainOpts, but the conditional pass-through stays as defense-in-depth).
 
@@ -64,7 +64,7 @@ Thin shims (still resolved through host, do not bypass):
 
 Witness 2026-05-03: test.js 12/12 green @ 195L (asserts `host.plugins().length>=100`, `platforms.list>=18`, `memory.list>=8`, surface guard throws, cycle throws). `node bin/freddie.js tools` shows 70. `help-all` 32 lines. 11 dashboard `/api/*` routes return 200.
 
-**gm-cc plugin integration** (2026-05-04) — gm-cc npm package (v2.0.727) successfully integrated via `plugins/gm-cc/plugin.js`. Plugin auto-discovers 12 SKILL.md files from gm-cc package, extracts name/description from YAML frontmatter, registers via `pi.skills.register({name: 'gm:'+name, description, content, source:'gm-cc'})`. Skills: browser, code-search, create-lang-plugin, gm, gm-complete, gm-emit, gm-execute, governance, pages, planning, ssh, update-docs. All accessible via `gm:*` namespace in pi.skills registry.
+**gm-skill plugin integration** — `plugins/gm-skill/plugin.js` registers ONE canonical skill named `gm-skill`. Resolution order: (1) `~/.claude/skills/gm-skill/SKILL.md` (the `bun x skills add AnEntrypoint/gm-skill -y -g` install), (2) `node_modules/gm-cc/skills/gm-skill/SKILL.md` (npm fallback). All other `gm-*` platform variants (gm-cc, gm-codex, gm-cursor, gm-jetbrains, gm-kilo, gm-oc, gm-vscode, gm-zed, gm-gc, gm-copilot-cli) are DEPRECATED — do not register them. `src/host/host_helpers.js::loadCcFromNodeModules` carries `CC_EXCLUDE = new Set(['gm-cc'])` so the gm-cc npm package is not auto-discovered as a cc-plugin (which would otherwise inject all 25 deprecated variants). test.js asserts exactly one gm-prefixed skill is registered, named `gm-skill`.
 
 ## Multi-project workspace system (2026-05-04)
 
@@ -269,7 +269,7 @@ All 21 named integration tests in `test.js` pass (exit 0). Subsystem coverage:
 - **acptoapi bridge** — Integrated at `src/agent/acptoapi-bridge.js` + `src/agent/llm_resolver.js` (commit 5f55f1e). Localhost API (default port 4800) converting OpenAI/Anthropic SDK calls to multiple backends: Kilo Code, opencode, Claude CLI, Anthropic API, Gemini, Ollama, Bedrock. Endpoint `/v1/chat/completions`, OpenAI-compatible, accepts `Bearer none` auth.
 - **acptoapi dep pattern** (2026-05-12) — `package.json` now pins `"acptoapi": "^1.0.55"` from the npm registry (CI auto-bumps on each acptoapi push; restore-package.cjs ROOT FIX prevents file: regressions). For local SDK iteration, swap to `file:../acptoapi` temporarily. CJS/ESM boundary bridged via `createRequire(import.meta.url)` in freddie ESM files that import acptoapi CJS exports.
 - **LLM resolver priority** (2026-05-10) — (1) explicit provider+key, (2) acptoapi if `/v1/models` returns 200, (3) `agent.model_preference` config array (ordered failover, sampler-gated), (4) `sdk.buildAutoChain()` env-key scan, (5) throw. `PROVIDER_KEYS` and `PROVIDER_DEFAULTS` imported from `acptoapi` — not maintained in freddie. `sdk.chat()` returns OpenAI `{choices:[{message}]}` format; `sdkChat()` adapter in llm_resolver converts to freddie's `{content, tool_calls, raw}`.
-- **Model sampler — re-export shim** (2026-05-10) — `src/agent/model-sampler.js` is a 13-line re-export shim over acptoapi sampler. Sampler logic (5-step backoff 30s→480s, createSampler factory, singleton) lives in `c:\dev\acptoapi\lib\sampler.js`. Exports: `isAvailable`, `markFailed`, `markOk`, `resetAvailability`, `getStatus`, `probe`, `startSampler`, `stopSampler`, `createSampler`.
+- **Model sampler — direct acptoapi import** (2026-05-17) — `src/agent/model-sampler.js` was deleted as redundant. Sampler funcs (`isAvailable`, `markFailed`, `markOk`, `resetAvailability`, `getStatus`, `probe`, `startSampler`, `stopSampler`, `createSampler`) come straight from `acptoapi` via `createRequire`. Backoff logic (5-step 30s→480s, createSampler factory, singleton) lives in `c:\dev\acptoapi\lib\sampler.js`.
 - **model_preference config key** (2026-05-10) — `agent.model_preference: []` in `~/.freddie/config.yaml`. Array of `{ provider, model? }` objects; `resolveCallLLM` tries each in order, skipping unavailable (sampler-gated) and marking failures with backoff. Config v2 migration adds the key on upgrade from v1.
 - **acptoapi Claude backend verified** (2026-05-03) — Live agent loop working: start acptoapi server `node bin/agentapi.js --port 4800` (c:\dev\acptoapi), then set `FREDDIE_LLM_URL=http://localhost:4800/v1 + FREDDIE_LLM_MODEL=claude/haiku`. Model prefix `claude/` routes to Claude CLI subprocess. freddie test.js 12/12 green confirming integration production-ready. Dashboard `/api/chat` and `/api/batch` are POST-only; GET returns 404 (correct).
 
@@ -290,6 +290,8 @@ All 12 test.js named groups passing: home+config+skin, sessions+FTS5, tools+tool
 - 2026-05-03 (session 4): Plugin-architecture decomposition recorded — added "Plugin architecture" section before Layout, rewrote "Adding a tool" + "Adding a gateway platform" for plugins/<name>/{plugin,handler}.js shape. Ingested 6 facts to rs-learn (project/freddie-plugin-architecture, reference/freddie-host-contract, reference/freddie-plugin-ctx, project/freddie-migrated-subsystems, reference/freddie-thin-shims, project/freddie-plugin-witness). Audit: 5 queries fired (pi-ai env keys, profile safe paths, libsql async debt, browser inline module errors, yaml colon space trap, plus self-test on freddie-plugin-architecture) — all returned "No recall results". rs-learn ingest path live but retrieval side empty for this session (likely needs learn-build propagation). 0 items migrated; AGENTS.md items retained.
 - 2026-05-04: Recorded freddie publish workflow root fix — `.github/workflows/restore-package.cjs` now pins anentrypoint-design via `npm view` + version (`^<latest>`) instead of file: dep; `publish.yml` runs `npm install --package-lock-only` to sync lockfile. Updated "Rebase regression trap" entry with detailed causation + recurrence tell. Added new "GitHub Actions deploy-pages@v5 duplicate artifact rejection" caveat (rerun --failed silently re-uploads; trigger fresh run instead). rs-learn store still unavailable. 0 items migrated; 2 facts added/refined in AGENTS.md.
 - 2026-05-10: 15-provider LLM resolver expansion. Added model-sampler.js (backoff), PROVIDER_KEYS/DEFAULTS expansion, model_preference config key, config v2 migration. Updated "LLM resolver priority" + "15-provider support" + "Model sampler" + "model_preference" entries in AGENTS.md. test.js 12/12 green at exactly 200 lines. rs-learn store still unavailable. 4 new facts added to AGENTS.md.
+- 2026-05-17 (continuation): +2 memorizes for uncommitted working-tree state — freddie-llm-resolver-anthropic-fallback-removed (project) captures the ~95L deletion of @anthropic-ai/sdk fallback in src/agent/llm_resolver.js (aligns with 'acptoapi is THE SDK' policy); freddie-stray-test-files-policy-violation (feedback) flags untracked src/agent/acptoapi-provider.js + test-acptoapi.js as violating the 'one test.js at root' rule. Total session exfiltration: 20 KV keys.
+- 2026-05-17: AGENTS.md exfiltration to learning store. 18 memorize dispatches landed (KV keys mem-1779041362557 through mem-1779041487836, 21KB total) covering: substrate stack, dynamic stack contract, acptoapi SDK surface, plugin architecture, multi-project workspace, 3 gotcha batches (browser/async, codeinsight FPs, exec/CI), dashboard caveats, website YAML, LLM resolver+sampler, trajectory v2 + validation witness, opencode+kilo ACP, gm-cc + sync-upstream, model availability matrix, plugsdk + Rust gotchas, testing/profile/cache policies, layout map. learn-status confirms wasm-via-KV mode. In-session recall still returns empty (consistent with documented retrieval-side gap; index propagation is cross-session). PRD 18/18 resolved; phases PLAN -> EXECUTE -> VERIFY -> COMPLETE.
 - 2026-05-10 (session 2): Deep integration audit between freddie and acptoapi SDK. Moved sampler logic into acptoapi lib/sampler.js (createSampler factory + singleton, 5-step backoff). Added lib/provider-maps.js (PROVIDER_KEYS + PROVIDER_DEFAULTS, 17 providers, derived from BRANDS+auto-chain). freddie: switched to file:../acptoapi dep, model-sampler.js replaced with 13-line re-export shim, llm_resolver.js simplified 131→95L (OPENAI_COMPAT removed, PROVIDER_KEYS/DEFAULTS from SDK, buildAutoChain() for auto-scan, sdkChat() adapter for OpenAI→freddie format). test.js 12/12 green. Both repos pushed. AGENTS.md updated with acptoapi dep pattern, re-export shim pattern, CJS/ESM bridge via createRequire.
 
 ## Dashboard web UI caveats

package/package.json

@@ -1,33 +1,43 @@
 {
   "name": "freddie",
-  "version": "0.0.102",
+  "version": "0.0.104",
   "type": "module",
   "description": "Open JS agent harness built on pi-mono, floosie, xstate, and anentrypoint-design",
   "bin": {
     "freddie": "./bin/freddie.js"
   },
   "main": "./src/index.js",
+  "exports": {
+    ".": "./src/index.js",
+    "./browser": {
+      "browser": "./dist/browser/freddie.js",
+      "default": "./src/browser/index.js"
+    }
+  },
   "scripts": {
     "start": "node bin/freddie.js",
-    "test": "node test.js"
+    "test": "node test.js",
+    "build:browser": "vite build --config vite.browser.config.js"
   },
   "dependencies": {
+    "@anentrypoint/libsql-plugkit-client": "github:AnEntrypoint/libsql-plugkit-client",
     "@libsql/client": "^0.5.0",
     "@mariozechner/pi-agent-core": "^0.70.6",
     "@mariozechner/pi-ai": "^0.70.6",
     "@mariozechner/pi-coding-agent": "^0.70.6",
     "@mariozechner/pi-tui": "^0.70.6",
+    "acptoapi": "^1.0.90",
+    "anentrypoint-design": "^0.0.108",
     "commander": "^14.0.0",
     "express": "^5.0.0",
     "flatspace": "^1.0.18",
     "floosie": "^0.6.14",
-    "gm-cc": "^2.0.727",
+    "gm-cc": "^2.0.1081",
     "js-yaml": "^4.1.0",
-    "plugsdk": "^1.0.16",
+    "libsql-plugkit-client": "^0.0.10",
+    "plugsdk": "^1.0.20",
     "xstate": "^5.31.0",
-    "zod": "^4.0.0",
-    "anentrypoint-design": "^0.0.95",
-    "acptoapi": "latest"
+    "zod": "^4.0.0"
   },
   "optionalDependencies": {
     "@libsql/darwin-arm64": "0.3.19",
@@ -71,5 +81,8 @@
     "freddie",
     "pi-mono",
     "xstate"
-  ]
+  ],
+  "devDependencies": {
+    "vite": "^8.0.13"
+  }
 }

package/plugins/gm-skill/plugin.js

@@ -0,0 +1,49 @@
+import { createRequire } from 'module'
+import path from 'path'
+import fs from 'fs'
+
+const _require = createRequire(import.meta.url)
+
+function resolveSkillMd() {
+    const home = process.env.USERPROFILE || process.env.HOME
+    if (home) {
+        const userSkill = path.join(home, '.claude', 'skills', 'gm-skill', 'SKILL.md')
+        if (fs.existsSync(userSkill)) return userSkill
+    }
+    try {
+        const pkgPath = _require.resolve('gm-cc/package.json')
+        const candidate = path.join(path.dirname(pkgPath), 'skills', 'gm-skill', 'SKILL.md')
+        if (fs.existsSync(candidate)) return candidate
+    } catch {}
+    return null
+}
+
+function parseFrontmatter(md) {
+    const m = md.match(/^---\r?\n([\s\S]*?)\r?\n---\r?\n([\s\S]*)$/)
+    if (!m) return { fields: {}, body: md }
+    const fields = {}
+    for (const line of m[1].split(/\r?\n/)) {
+        const kv = line.match(/^([A-Za-z0-9_-]+):\s*(.*)$/)
+        if (kv) fields[kv[1]] = kv[2]
+    }
+    return { fields, body: m[2] }
+}
+
+export default {
+    name: 'gm-skill',
+    surfaces: 'pi',
+    register({ pi }) {
+        const skillPath = resolveSkillMd()
+        if (!skillPath) return
+        const raw = fs.readFileSync(skillPath, 'utf8')
+        const { fields, body } = parseFrontmatter(raw)
+        pi.skills.register({
+            name: 'gm-skill',
+            description: fields.description || 'AI-native software engineering harness',
+            content: body,
+            source: 'gm-skill',
+            frontmatter: fields,
+            file: skillPath,
+        })
+    },
+}

package/plugins/gui-acptoapi-chains/plugin.js

@@ -0,0 +1,77 @@
+// freddie ↔ acptoapi chain bridge — surfaces acptoapi /v1/chains, /debug/probe-live
+// through freddie's GUI API so the dashboard can manage named fallback chains
+// without thebird talking directly to acptoapi.
+import { getAcptoapiUrl } from '../../src/agent/acptoapi-bridge.js'
+
+function base() { return getAcptoapiUrl().replace(/\/v1\/?$/, '') }
+const HDR = () => ({ 'content-type': 'application/json', authorization: 'Bearer none' })
+
+async function fwd(url, init) {
+    try {
+        const r = await fetch(url, init)
+        const ct = r.headers.get('content-type') || ''
+        if (ct.includes('json')) return { status: r.status, json: await r.json() }
+        return { status: r.status, text: await r.text() }
+    } catch (e) { return { status: 502, json: { error: { message: e.message, via: url } } } }
+}
+
+export default {
+    name: 'gui-acptoapi-chains', surfaces: 'gui',
+    register({ gui }) {
+        gui.route('GET', '/api/acptoapi/health', async (_, res) => {
+            const r = await fwd(base() + '/health', { headers: HDR() })
+            res.status(r.status === 502 ? 502 : 200).json(r.json || { text: r.text })
+        })
+
+        gui.route('GET', '/api/acptoapi/chains', async (_, res) => {
+            const r = await fwd(base() + '/v1/chains', { headers: HDR() })
+            res.status(r.status).json(r.json || {})
+        })
+
+        gui.route('POST', '/api/acptoapi/chains', async (req, res) => {
+            const { name, links } = req.body || {}
+            if (!name || !Array.isArray(links)) return res.status(400).json({ error: { message: 'name + links[] required' } })
+            const r = await fwd(base() + '/v1/chains', {
+                method: 'POST', headers: HDR(), body: JSON.stringify({ name, links }),
+            })
+            res.status(r.status).json(r.json || {})
+        })
+
+        gui.route('DELETE', '/api/acptoapi/chains/:name', async (req, res) => {
+            const r = await fwd(base() + '/v1/chains?name=' + encodeURIComponent(req.params.name), {
+                method: 'DELETE', headers: HDR(),
+            })
+            res.status(r.status).json(r.json || {})
+        })
+
+        gui.route('GET', '/api/acptoapi/probe', async (req, res) => {
+            const force = req.query.force === '1' ? '?force=1' : ''
+            const r = await fwd(base() + '/debug/probe-live' + force, { headers: HDR() })
+            res.status(r.status).json(r.json || {})
+        })
+
+        gui.route('GET', '/api/acptoapi/models', async (_, res) => {
+            const r = await fwd(base() + '/v1/models', { headers: HDR() })
+            res.status(r.status).json(r.json || {})
+        })
+
+        gui.route('GET', '/api/acptoapi/auto-chain', async (_, res) => {
+            const r = await fwd(base() + '/debug/auto-chain', { headers: HDR() })
+            res.status(r.status).json(r.json || {})
+        })
+
+        // surface acptoapi config knobs freddie exposes via env
+        gui.route('GET', '/api/acptoapi/config', (_, res) => {
+            res.json({
+                url: base(),
+                model: process.env.FREDDIE_LLM_MODEL || 'claude/haiku',
+                envHints: {
+                    FREDDIE_LLM_URL: process.env.FREDDIE_LLM_URL || null,
+                    FREDDIE_LLM_MODEL: process.env.FREDDIE_LLM_MODEL || null,
+                    ACPTOAPI_LIVE_PROBE: process.env.ACPTOAPI_LIVE_PROBE || null,
+                    ACPTOAPI_PROBE_CAP: process.env.ACPTOAPI_PROBE_CAP || null,
+                },
+            })
+        })
+    },
+}

package/plugins/image_gen/handler.js

@@ -1,9 +1,12 @@
+// All upstream connectivity lives in acptoapi. This handler is a thin wrapper.
+import { getAcptoapiUrl } from '../../src/agent/acptoapi-bridge.js'
+
 export const _tool = ({
     name: 'image_gen',
     toolset: 'creative',
     schema: {
         name: 'image_gen',
-        description: 'Generate an image from a prompt. Provider via config.image_gen.provider (openai|replicate).',
+        description: 'Generate an image from a prompt. Routes through acptoapi /v1/images/generations.',
         parameters: {
             type: 'object',
             properties: {
@@ -19,13 +22,15 @@ export const _tool = ({
     requiresEnv: ['OPENAI_API_KEY or REPLICATE_API_TOKEN'],
     handler: async ({ prompt, provider, size = '1024x1024', model }) => {
         const which = provider || (process.env.OPENAI_API_KEY ? 'openai' : 'replicate')
-        if (which === 'openai') {
-            if (!process.env.OPENAI_API_KEY) return { error: 'OPENAI_API_KEY required' }
-            const res = await fetch('https://api.openai.com/v1/images/generations', { method: 'POST', headers: { authorization: `Bearer ${process.env.OPENAI_API_KEY}`, 'content-type': 'application/json' }, body: JSON.stringify({ model: model || 'gpt-image-1', prompt, size }) })
-            return await res.json()
-        }
-        if (!process.env.REPLICATE_API_TOKEN) return { error: 'REPLICATE_API_TOKEN required' }
-        const res = await fetch('https://api.replicate.com/v1/predictions', { method: 'POST', headers: { authorization: `Token ${process.env.REPLICATE_API_TOKEN}`, 'content-type': 'application/json' }, body: JSON.stringify({ version: model || 'black-forest-labs/flux-schnell', input: { prompt } }) })
-        return await res.json()
+        const base = getAcptoapiUrl().replace(/\/v1\/?$/, '')
+        const body = which === 'openai'
+            ? { model: model || 'gpt-image-1', prompt, size }
+            : { version: model || 'black-forest-labs/flux-schnell', input: { prompt } }
+        const r = await fetch(base + '/v1/images/generations', {
+            method: 'POST',
+            headers: { 'content-type': 'application/json', 'x-provider': which, authorization: 'Bearer none' },
+            body: JSON.stringify(body),
+        })
+        return await r.json()
     },
 })

package/plugins/transcription/handler.js

@@ -1,18 +1,25 @@
+// Upstream connectivity lives in acptoapi.
 import fs from 'node:fs'
+import { getAcptoapiUrl } from '../../src/agent/acptoapi-bridge.js'
+
 export const _tool = ({
     name: 'transcription',
     toolset: 'creative',
-    schema: { name: 'transcription', description: 'Transcribe audio with OpenAI Whisper.', parameters: { type: 'object', properties: { file_path: { type: 'string' }, model: { type: 'string', default: 'whisper-1' } }, required: ['file_path'] } },
+    schema: { name: 'transcription', description: 'Transcribe audio via acptoapi /v1/audio/transcriptions (OpenAI Whisper).', parameters: { type: 'object', properties: { file_path: { type: 'string' }, model: { type: 'string', default: 'whisper-1' } }, required: ['file_path'] } },
     requiresEnv: ['OPENAI_API_KEY'],
     checkFn: () => Boolean(process.env.OPENAI_API_KEY),
     handler: async ({ file_path, model = 'whisper-1' }) => {
-        if (!process.env.OPENAI_API_KEY) return { error: 'OPENAI_API_KEY required' }
         if (!fs.existsSync(file_path)) return { error: 'file not found: ' + file_path }
+        const base = getAcptoapiUrl().replace(/\/v1\/?$/, '')
         const blob = new Blob([fs.readFileSync(file_path)])
         const fd = new FormData()
         fd.append('file', blob, file_path.split(/[\\/]/).pop())
         fd.append('model', model)
-        const r = await fetch('https://api.openai.com/v1/audio/transcriptions', { method: 'POST', headers: { authorization: `Bearer ${process.env.OPENAI_API_KEY}` }, body: fd })
+        const r = await fetch(base + '/v1/audio/transcriptions', {
+            method: 'POST',
+            headers: { authorization: 'Bearer none' },
+            body: fd,
+        })
         return await r.json()
     },
 })

package/plugins/tts/handler.js

@@ -1,18 +1,23 @@
+// Upstream connectivity lives in acptoapi.
+import { getAcptoapiUrl } from '../../src/agent/acptoapi-bridge.js'
+
 export const _tool = ({
     name: 'tts',
     toolset: 'creative',
-    schema: { name: 'tts', description: 'Synthesize speech (OpenAI tts-1 or ElevenLabs).', parameters: { type: 'object', properties: { text: { type: 'string' }, provider: { type: 'string', enum: ['openai', 'elevenlabs'], default: 'openai' }, voice: { type: 'string' } }, required: ['text'] } },
+    schema: { name: 'tts', description: 'Synthesize speech (OpenAI tts-1 or ElevenLabs) via acptoapi.', parameters: { type: 'object', properties: { text: { type: 'string' }, provider: { type: 'string', enum: ['openai', 'elevenlabs'], default: 'openai' }, voice: { type: 'string' } }, required: ['text'] } },
     requiresEnv: ['OPENAI_API_KEY or ELEVENLABS_API_KEY'],
     checkFn: () => Boolean(process.env.OPENAI_API_KEY || process.env.ELEVENLABS_API_KEY),
     handler: async ({ text, provider = 'openai', voice = 'alloy' }) => {
-        if (provider === 'elevenlabs') {
-            if (!process.env.ELEVENLABS_API_KEY) return { error: 'ELEVENLABS_API_KEY required' }
-            const v = voice || '21m00Tcm4TlvDq8ikWAM'
-            const r = await fetch(`https://api.elevenlabs.io/v1/text-to-speech/${v}`, { method: 'POST', headers: { 'xi-api-key': process.env.ELEVENLABS_API_KEY, 'content-type': 'application/json' }, body: JSON.stringify({ text }) })
-            return { status: r.status, contentType: r.headers.get('content-type'), bytes: (await r.arrayBuffer()).byteLength }
-        }
-        if (!process.env.OPENAI_API_KEY) return { error: 'OPENAI_API_KEY required' }
-        const r = await fetch('https://api.openai.com/v1/audio/speech', { method: 'POST', headers: { authorization: `Bearer ${process.env.OPENAI_API_KEY}`, 'content-type': 'application/json' }, body: JSON.stringify({ model: 'tts-1', input: text, voice }) })
-        return { status: r.status, bytes: (await r.arrayBuffer()).byteLength }
+        const base = getAcptoapiUrl().replace(/\/v1\/?$/, '')
+        const body = provider === 'elevenlabs'
+            ? { text, voice: voice || '21m00Tcm4TlvDq8ikWAM', provider: 'elevenlabs' }
+            : { model: 'tts-1', input: text, voice }
+        const xProv = provider === 'elevenlabs' ? 'tts.elevenlabs' : 'speech.openai'
+        const r = await fetch(base + '/v1/audio/speech', {
+            method: 'POST',
+            headers: { 'content-type': 'application/json', 'x-provider': xProv, authorization: 'Bearer none' },
+            body: JSON.stringify(body),
+        })
+        return { status: r.status, contentType: r.headers.get('content-type'), bytes: (await r.arrayBuffer()).byteLength }
     },
 })

package/plugins/vision/handler.js

@@ -1,17 +1,26 @@
+// All upstream connectivity lives in acptoapi. Vision is just a multimodal
+// chat-completions call — go through the existing bridge.
+import { callLLM, getAcptoapiUrl } from '../../src/agent/acptoapi-bridge.js'
+
 export const _tool = ({
     name: 'vision',
     toolset: 'creative',
-    schema: { name: 'vision', description: 'Describe an image (URL or base64) using a vision-capable LLM.', parameters: { type: 'object', properties: { image_url: { type: 'string' }, prompt: { type: 'string', default: 'Describe this image.' }, provider: { type: 'string', enum: ['openai', 'anthropic'], default: 'openai' } }, required: ['image_url'] } },
-    requiresEnv: ['OPENAI_API_KEY or ANTHROPIC_API_KEY'],
+    schema: { name: 'vision', description: 'Describe an image (URL or base64) via acptoapi chat-completions.', parameters: { type: 'object', properties: { image_url: { type: 'string' }, prompt: { type: 'string', default: 'Describe this image.' }, model: { type: 'string' } }, required: ['image_url'] } },
+    requiresEnv: ['OPENAI_API_KEY or ANTHROPIC_API_KEY (provided to acptoapi)'],
     checkFn: () => Boolean(process.env.OPENAI_API_KEY || process.env.ANTHROPIC_API_KEY),
-    handler: async ({ image_url, prompt = 'Describe this image.', provider = 'openai' }) => {
-        if (provider === 'anthropic') {
-            if (!process.env.ANTHROPIC_API_KEY) return { error: 'ANTHROPIC_API_KEY required' }
-            const r = await fetch('https://api.anthropic.com/v1/messages', { method: 'POST', headers: { 'x-api-key': process.env.ANTHROPIC_API_KEY, 'anthropic-version': '2023-06-01', 'content-type': 'application/json' }, body: JSON.stringify({ model: 'claude-sonnet-4-6', max_tokens: 1024, messages: [{ role: 'user', content: [{ type: 'image', source: { type: 'url', url: image_url } }, { type: 'text', text: prompt }] }] }) })
-            return await r.json()
+    handler: async ({ image_url, prompt = 'Describe this image.', model }) => {
+        const messages = [{
+            role: 'user',
+            content: [
+                { type: 'text', text: prompt },
+                { type: 'image_url', image_url: { url: image_url } },
+            ],
+        }]
+        try {
+            const r = await callLLM({ messages, model: model || 'openai/gpt-4o-mini' })
+            return { content: r.content, raw: r.raw }
+        } catch (e) {
+            return { error: e.message, via: getAcptoapiUrl() }
         }
-        if (!process.env.OPENAI_API_KEY) return { error: 'OPENAI_API_KEY required' }
-        const r = await fetch('https://api.openai.com/v1/chat/completions', { method: 'POST', headers: { authorization: `Bearer ${process.env.OPENAI_API_KEY}`, 'content-type': 'application/json' }, body: JSON.stringify({ model: 'gpt-4o-mini', messages: [{ role: 'user', content: [{ type: 'text', text: prompt }, { type: 'image_url', image_url: { url: image_url } }] }] }) })
-        return await r.json()
     },
 })

package/src/agent/__browser_shims/alias-plugin.mjs

@@ -0,0 +1,24 @@
+
+import path from 'path';
+const F='C:/dev/freddie';
+const R=p=>path.resolve(p);
+const ALIAS={
+  [R(F+'/src/host/index.js')]: R(F+'/src/agent/__browser_shims/host.js'),
+  [R(F+'/src/toolsets.js')]: R(F+'/src/agent/__browser_shims/toolsets.js'),
+  [R(F+'/src/agent/llm_resolver.js')]: R(F+'/src/agent/__browser_shims/llm_resolver.js'),
+  [R(F+'/src/observability/log.js')]: R(F+'/src/agent/__browser_shims/log.js'),
+  [R(F+'/src/config.js')]: R(F+'/src/agent/__browser_shims/config.js'),
+  [R(F+'/src/home.js')]: R(F+'/src/agent/__browser_shims/home.js'),
+};
+export default {
+  name: 'freddie-browser-alias',
+  setup(build){
+    build.onResolve({filter: /.*/}, async args=>{
+      if(args.path.startsWith('node:') || (!args.path.startsWith('.') && !path.isAbsolute(args.path))) return null;
+      const resolved = path.resolve(args.resolveDir||'', args.path);
+      const candidates=[resolved, resolved+'.js', resolved+'/index.js'];
+      for(const c of candidates) if(ALIAS[c]) return { path: ALIAS[c] };
+      return null;
+    });
+  }
+};

package/src/agent/__browser_shims/build.mjs

@@ -0,0 +1,18 @@
+
+import * as esbuild from 'esbuild';
+import alias from './alias-plugin.mjs';
+await esbuild.build({
+  entryPoints: ['C:/dev/freddie/src/agent/__browser_shims/entry.js'],
+  bundle: true,
+  format: 'esm',
+  platform: 'browser',
+  conditions: ['browser','module','import'],
+  outfile: 'C:/dev/thebird/docs/freddie-runtime.js',
+  plugins: [alias],
+  legalComments: 'none',
+  minify: false,
+  sourcemap: false,
+  logLevel: 'info',
+  external: [],
+});
+console.log('bundle ok');

package/src/agent/__browser_shims/config.js

@@ -0,0 +1,4 @@
+export function getConfigValue(k,d){ return d }
+export function setConfigValue(){}
+export function loadConfig(){ return {} }
+export function saveConfig(){}

package/src/agent/__browser_shims/entry.js

@@ -0,0 +1,2 @@
+export { createAgentMachine } from '../machine.js'
+export { createMachine, createActor, assign, fromPromise, waitFor } from 'xstate'

package/src/agent/__browser_shims/home.js

@@ -0,0 +1,3 @@
+export function getFreddieHome(){ return '/freddie' }
+export function getFreddieProfileDir(){ return '/freddie/profile' }
+export function ensureFreddieHome(){}

package/src/agent/__browser_shims/host.js

@@ -0,0 +1,36 @@
+export async function bootHost() {
+    const br = globalThis.__freddieRuntimeBridge
+    if (!br || !br.host) throw new Error('freddie-runtime: __freddieRuntimeBridge.host not set')
+    const host = br.host
+    return {
+        hooks: {
+            async invoke(name, payload) {
+                const map = { preToolCall: 'pre_tool_use', postToolCall: 'post_tool_use', onMessageInbound: 'user_prompt_submit', onMessageOutbound: null, onSessionStart: null, onSessionEnd: 'stop', onPreCompact: null, onPostCompact: null }
+                const key = map[name]
+                if (!key || !host.pi.hooks[key]) return null
+                let merged = null
+                for (const fn of host.pi.hooks[key]) {
+                    try {
+                        const r = await fn(payload || {})
+                        if (!r || typeof r !== 'object') continue
+                        merged = merged || {}
+                        if (r.decision === 'block') return { behavior: 'block', reason: r.reason || 'denied' }
+                        if (r.systemMessage) merged.systemMessage = (merged.systemMessage ? merged.systemMessage + '\n' : '') + r.systemMessage
+                        if (r.additionalContext) merged.additionalContext = (merged.additionalContext ? merged.additionalContext + '\n' : '') + r.additionalContext
+                        if (r.args) merged.args = r.args
+                    } catch (e) { console.warn('[freddie-runtime] hook ' + key + ' threw:', e && e.message) }
+                }
+                return merged
+            },
+        },
+        pi: {
+            tools: host.pi.tools,
+            skills: host.pi.skills,
+            hooks: host.pi.hooks,
+            dispatchTool: async (name, args) => {
+                const out = await host.runTool(name, args || {})
+                return typeof out === 'string' ? out : JSON.stringify(out)
+            },
+        },
+    }
+}

package/src/agent/__browser_shims/llm_resolver.js

@@ -0,0 +1,8 @@
+export function resolveCallLLM({ provider, model } = {}) {
+    return async (input) => {
+        const br = globalThis.__freddieRuntimeBridge
+        if (!br || !br.callLLM) throw new Error('freddie-runtime: __freddieRuntimeBridge.callLLM not set')
+        return await br.callLLM({ ...input, provider, model: model || input.model })
+    }
+}
+export const matrixUsable = () => false

package/src/agent/__browser_shims/log.js

@@ -0,0 +1,10 @@
+export function log(rec){ try{ console.debug('[freddie]', rec) }catch{} }
+export function logger(subsystem){
+    return {
+        debug: (msg, e={}) => console.debug('[freddie:'+subsystem+']', msg, e),
+        info:  (msg, e={}) => console.log('[freddie:'+subsystem+']', msg, e),
+        warn:  (msg, e={}) => console.warn('[freddie:'+subsystem+']', msg, e),
+        error: (msg, e={}) => console.error('[freddie:'+subsystem+']', msg, e),
+    }
+}
+export function closeAll(){}

package/src/agent/__browser_shims/toolsets.js

@@ -0,0 +1,18 @@
+export async function getEnabledToolSchemas(enabled = ['core'], disabled = []) {
+    const br = globalThis.__freddieRuntimeBridge
+    if (!br || !br.host) return []
+    const host = br.host
+    const disabledSet = new Set(disabled)
+    const out = []
+    for (const [name, t] of host.pi.tools.entries()) {
+        if (disabledSet.has(name)) continue
+        out.push({ type: 'function', function: { name, description: t.description || '', parameters: t.inputSchema || { type: 'object', properties: {} } } })
+    }
+    return out
+}
+export async function getEnabledToolNames(enabled = ['core'], disabled = []) {
+    const br = globalThis.__freddieRuntimeBridge; if (!br || !br.host) return []
+    return [...br.host.pi.tools.keys()]
+}
+export async function getAvailableToolsets() { return ['core'] }
+export const _FREDDIE_CORE_TOOLS = ['read','write','edit','grep','list']

package/src/agent/acptoapi-bridge.js

@@ -84,11 +84,21 @@ function adaptResponse(r) {
 
 function tryParseJson(s) { try { return typeof s === 'string' ? JSON.parse(s) : (s || {}) } catch { return {} } }
 
-export async function isReachable() {
+export async function isReachable(timeoutMs = 2000) {
     try {
-        const res = await fetch(getAcptoapiUrl().replace(/\/$/, '') + '/models', { headers: { authorization: 'Bearer none' } })
-        if (!res.ok) return false
-        const json = await res.json()
-        return Array.isArray(json.data) && json.data.length > 0
+        const controller = new AbortController()
+        const timeoutId = setTimeout(() => controller.abort(), timeoutMs)
+        try {
+            const res = await fetch(getAcptoapiUrl().replace(/\/$/, '') + '/models', {
+                headers: { authorization: 'Bearer none' },
+                signal: controller.signal
+            })
+            clearTimeout(timeoutId)
+            if (!res.ok) return false
+            const json = await res.json()
+            return Array.isArray(json.data) && json.data.length > 0
+        } finally {
+            clearTimeout(timeoutId)
+        }
     } catch { return false }
 }

package/src/agent/codex_responses_adapter.js

@@ -1,10 +1,15 @@
-import { resolveKey } from './credential_sources.js'
+// Upstream connectivity lives in acptoapi via /v1/responses passthrough.
+import { getAcptoapiUrl } from './acptoapi-bridge.js'
 import { isCodexModel } from '../cli/codex_models.js'
+
 export async function chat({ input, model = 'o3-mini', tools = [], reasoning_effort = 'medium' } = {}) {
-    const k = await resolveKey('openai')
-    if (!k.value) throw new Error('OPENAI_API_KEY required (source: ' + k.source + ')')
     if (!isCodexModel(model)) console.warn('[codex_responses] non-codex model: ' + model)
-    const r = await fetch('https://api.openai.com/v1/responses', { method: 'POST', headers: { authorization: 'Bearer ' + k.value, 'content-type': 'application/json' }, body: JSON.stringify({ model, input, ...(tools.length ? { tools } : {}), reasoning: { effort: reasoning_effort } }) })
+    const base = getAcptoapiUrl().replace(/\/v1\/?$/, '')
+    const r = await fetch(base + '/v1/responses', {
+        method: 'POST',
+        headers: { authorization: 'Bearer none', 'content-type': 'application/json' },
+        body: JSON.stringify({ model, input, ...(tools.length ? { tools } : {}), reasoning: { effort: reasoning_effort } }),
+    })
     return await r.json()
 }
 export const provider = 'codex_responses'

package/src/agent/gemini_native_adapter.js

@@ -1,11 +1,16 @@
-import { resolveKey } from './credential_sources.js'
+// Gemini upstream connectivity lives in acptoapi /v1beta/models/<model>:generateContent.
+import { getAcptoapiUrl } from './acptoapi-bridge.js'
 import { adaptToolForGemini, adaptMessagesForGemini } from './gemini_schema.js'
+
 export async function chat({ messages, model = 'gemini-2.5-flash', tools = [] } = {}) {
-    const k = await resolveKey('google')
-    if (!k.value) throw new Error('GOOGLE_API_KEY required')
-    const url = 'https://generativelanguage.googleapis.com/v1beta/models/' + model + ':generateContent?key=' + k.value
+    const base = getAcptoapiUrl().replace(/\/v1\/?$/, '')
+    const url = `${base}/v1beta/models/${model}:generateContent`
     const body = { contents: adaptMessagesForGemini(messages), ...(tools.length ? { tools: [{ function_declarations: tools.map(adaptToolForGemini) }] } : {}) }
-    const r = await fetch(url, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(body) })
+    const r = await fetch(url, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json', authorization: 'Bearer none' },
+        body: JSON.stringify(body),
+    })
     return await r.json()
 }
 export const provider = 'google'

package/src/agent/image_gen_provider.js

@@ -1,8 +1,20 @@
-import { resolveKey } from './credential_sources.js'
-const PROVIDERS = {
-    openai: async ({ prompt, size, model }) => { const k = (await resolveKey('openai')).value; const r = await fetch('https://api.openai.com/v1/images/generations', { method: 'POST', headers: { authorization: 'Bearer ' + k, 'content-type': 'application/json' }, body: JSON.stringify({ model: model || 'gpt-image-1', prompt, size }) }); return await r.json() },
-    replicate: async ({ prompt, model }) => { const k = process.env.REPLICATE_API_TOKEN; const r = await fetch('https://api.replicate.com/v1/predictions', { method: 'POST', headers: { authorization: 'Token ' + k, 'content-type': 'application/json' }, body: JSON.stringify({ version: model || 'black-forest-labs/flux-schnell', input: { prompt } }) }); return await r.json() },
-    stability: async ({ prompt, model }) => { const k = process.env.STABILITY_API_KEY; const r = await fetch('https://api.stability.ai/v2beta/stable-image/generate/' + (model || 'core'), { method: 'POST', headers: { authorization: 'Bearer ' + k, accept: 'application/json' }, body: (() => { const fd = new FormData(); fd.append('prompt', prompt); return fd })() }); return await r.json() },
+// All upstream image-generation traffic routes through acptoapi.
+import { getAcptoapiUrl } from './acptoapi-bridge.js'
+
+const PROVIDERS = ['openai', 'replicate', 'stability']
+
+export async function generate({ provider = 'openai', prompt, size, model } = {}) {
+    if (!PROVIDERS.includes(provider)) throw new Error('unknown image provider: ' + provider)
+    const base = getAcptoapiUrl().replace(/\/v1\/?$/, '')
+    const body = provider === 'replicate'
+        ? { version: model || 'black-forest-labs/flux-schnell', input: { prompt } }
+        : { model: model || 'gpt-image-1', prompt, size }
+    const r = await fetch(base + '/v1/images/generations', {
+        method: 'POST',
+        headers: { authorization: 'Bearer none', 'content-type': 'application/json', 'x-provider': provider },
+        body: JSON.stringify(body),
+    })
+    return await r.json()
 }
-export async function generate({ provider = 'openai', ...args } = {}) { const fn = PROVIDERS[provider]; if (!fn) throw new Error('unknown image provider: ' + provider); return await fn(args) }
-export function listProviders() { return Object.keys(PROVIDERS) }
+
+export function listProviders() { return PROVIDERS.slice() }

package/src/agent/llm_resolver.js

@@ -6,6 +6,7 @@ export { matrixUsable } from './model-matrix.js'
 
 const _require = createRequire(import.meta.url)
 const sdk = _require('acptoapi')
+
 export const PROVIDER_KEYS = sdk.PROVIDER_KEYS
 export const DEFAULTS = sdk.PROVIDER_DEFAULTS
 
@@ -59,10 +60,15 @@ export function resolveCallLLM({ provider, model } = {}) {
         }
         try {
             const isSimple = typeof m === 'string' && !m.includes(',') && !/^queue\//.test(m)
-            if (isSimple && await bridgeReachable()) return await bridgeCall({ ...input, model: m })
+
+            if (isSimple && await bridgeReachable()) {
+                return await bridgeCall({ ...input, model: m })
+            }
+
             const opts = { model: m, messages: toMsgs(input.messages), tools: toTools(input.tools), onFallback: input.onFallback, output: 'openai' }
             if (/^queue\//.test(m)) opts.queuesMap = getConfigValue('agent.model_queues', {}) || {}
             if (m.includes(',') || /^queue\//.test(m)) opts.matrixSource = process.env.FREDDIE_MATRIX_URL || MATRIX_FILE
+
             const r = await sdk.chat(opts)
             return adapt(r)
         } catch (e) {

package/src/agent/machine.js

@@ -74,15 +74,23 @@ export function createAgentMachine({ provider, model, maxIterations = 90, callLL
                         const last = input.messages[input.messages.length - 1]
                         const calls = last.tool_calls || []
                         const results = []
+                        const extras = []
                         for (const call of calls) {
-                            const res = await h.pi.dispatchTool(call.name || call.function?.name, call.arguments || call.function?.arguments || {})
-                            results.push({ tool_call_id: call.id || call.tool_call_id, content: res })
+                            const tname = call.name || call.function?.name
+                            const targs = call.arguments || call.function?.arguments || {}
+                            const tcid = call.id || call.tool_call_id
+                            const pushExtras = r => { if (r?.systemMessage) extras.push({ role: 'system', content: '[hook] ' + r.systemMessage }); if (r?.additionalContext) extras.push({ role: 'system', content: r.additionalContext }) }
+                            const pre = await h.hooks.invoke('preToolCall', { name: tname, args: targs }); pushExtras(pre)
+                            if (pre?.behavior === 'block') { results.push({ tool_call_id: tcid, content: JSON.stringify({ error: 'tool call denied by plugsdk hook', tool: tname, reason: pre.reason || 'denied' }) }); continue }
+                            const res = await h.pi.dispatchTool(tname, (pre && pre.args) || targs)
+                            pushExtras(await h.hooks.invoke('postToolCall', { name: tname, args: targs, result: res }))
+                            results.push({ tool_call_id: tcid, content: res })
                         }
-                        return results
+                        return { results, extras }
                     }),
                     input: ({ context }) => ({ messages: context.messages }),
                     onDone: { target: 'prompting', actions: assign({
-                        messages: ({ context, event }) => [...context.messages, ...event.output.map(r => ({ role: 'tool', tool_call_id: r.tool_call_id, content: r.content }))],
+                        messages: ({ context, event }) => [...context.messages, ...event.output.results.map(r => ({ role: 'tool', tool_call_id: r.tool_call_id, content: r.content })), ...event.output.extras],
                         iterations: ({ context }) => context.iterations + 1,
                     }) },
                     onError: { target: 'done', actions: assign({ error: ({ event }) => String(event.error?.message || event.error) }) },
@@ -143,30 +151,45 @@ async function writeTrajectory(out, { prompt, provider, model, skill, cwd, event
     } catch (_) {}
 }
 
+function mergeHookExtras(messages, r, tag) {
+    if (!r) return messages
+    const e = []
+    if (r.systemMessage) e.push({ role: 'system', content: '[hook:' + tag + '] ' + r.systemMessage })
+    if (r.additionalContext) e.push({ role: 'system', content: r.additionalContext })
+    return e.length ? [...messages, ...e] : messages
+}
+
 export async function runTurn({ prompt, messages = [], model, provider, callLLM, enabledToolsets, disabledToolsets, maxIterations = 90, timeoutMs = 30000, cwd, skill, witnessPath } = {}) {
-    const events = []
-    const initMessages = [...messages]
-    const systemParts = []
-    if (cwd) systemParts.push(`Working directory: ${cwd}. Always pass cwd="${cwd}" to bash tool calls. When reading or writing files use paths relative to this directory or absolute paths under it.`)
-    if (skill) {
-        const h = await bootHost()
-        const skillDef = h.pi.skills.get(skill)
-        if (skillDef?.content) systemParts.push('Skill context:\n' + skillDef.content)
-    }
-    if (systemParts.length > 0) initMessages.unshift({ role: 'user', content: systemParts.join('\n\n') })
+    const events = []; const h = await bootHost()
+    await h.hooks.invoke('onSessionStart', { prompt, model, provider, skill, cwd })
+    let initMessages = [...messages]; const sysParts = []
+    if (cwd) sysParts.push(`Working directory: ${cwd}. Always pass cwd="${cwd}" to bash tool calls. When reading or writing files use paths relative to this directory or absolute paths under it.`)
+    if (skill) { const sd = h.pi.skills.get(skill); if (sd?.content) sysParts.push('Skill context:\n' + sd.content) }
+    if (sysParts.length) initMessages.unshift({ role: 'user', content: sysParts.join('\n\n') })
+    const inbound = await h.hooks.invoke('onMessageInbound', { content: prompt })
+    if (inbound?.behavior === 'block') { await h.hooks.invoke('onSessionEnd', { reason: 'prompt_blocked' }); return { messages: initMessages, result: null, error: 'prompt blocked by plugsdk hook: ' + (inbound.reason || 'denied'), iterations: 0 } }
+    initMessages = mergeHookExtras(initMessages, inbound, 'onMessageInbound')
     const machine = createAgentMachine({ model, provider, callLLM, enabledToolsets, disabledToolsets, maxIterations, events })
-    const actor = createActor(machine, { input: { messages: initMessages } })
-    actor.start()
-    actor.send({ type: 'SUBMIT', prompt })
+    const actor = createActor(machine, { input: { messages: initMessages } }); actor.start(); actor.send({ type: 'SUBMIT', prompt })
     return await new Promise((resolve, reject) => {
         const t = setTimeout(() => { try { actor.stop() } catch {} reject(new Error('agent turn timeout')) }, timeoutMs)
-        actor.subscribe(snap => {
-            if (snap.status === 'done') {
-                clearTimeout(t)
-                const errorStack = snap.output?.error ? (events.find(e => e.type === 'llm_call' && !e.ok)?.stack || null) : null
-                writeTrajectory(snap.output, { prompt, provider, model, skill, cwd, events, errorStack, witnessPath }).finally(() => resolve(snap.output))
-            }
+        actor.subscribe(snap => { if (snap.status !== 'done') return; clearTimeout(t)
+            ;(async () => {
+                const out = snap.output
+                const outbound = await h.hooks.invoke('onMessageOutbound', { content: out?.result || '' })
+                if (outbound?.systemMessage || outbound?.additionalContext) out.messages = mergeHookExtras(out.messages || [], outbound, 'onMessageOutbound')
+                await h.hooks.invoke('onSessionEnd', { reason: out?.error ? 'error' : 'ok', iterations: out?.iterations })
+                const errorStack = out?.error ? (events.find(e => e.type === 'llm_call' && !e.ok)?.stack || null) : null
+                await writeTrajectory(out, { prompt, provider, model, skill, cwd, events, errorStack, witnessPath }); resolve(out)
+            })().catch(reject)
         })
     })
 }
 
+export async function invokeCompactHooks({ trigger = 'auto', messages = [] } = {}) {
+    const h = await bootHost()
+    const pre = await h.hooks.invoke('onPreCompact', { trigger, messages })
+    if (pre?.behavior === 'block') return { skipped: true, reason: pre.reason || 'blocked' }
+    return { pre, post: async (summary) => h.hooks.invoke('onPostCompact', { trigger, messages, summary }) }
+}
+

package/src/agent/model-discovery.js

@@ -1,98 +1,52 @@
+// Upstream model enumeration lives in acptoapi. This module is a thin shim
+// over GET /v1/models so freddie has zero direct vendor connectivity.
 import { createRequire } from 'module'
-import { resolveKey } from './credential_sources.js'
+import { getAcptoapiUrl } from './acptoapi-bridge.js'
 import { saveConfigValue, getConfigValue } from '../config.js'
 import { logger } from '../observability/log.js'
 
 const _require = createRequire(import.meta.url)
-const { createModelProber } = _require('acptoapi/lib/model-prober')
-const { BRANDS } = _require('acptoapi/lib/openai-brands')
+const _sdk = _require('acptoapi')
 const log = logger('model-discovery')
 
-const EXTRA = {
-    anthropic: { url: 'https://api.anthropic.com/v1/models', envName: 'ANTHROPIC_API_KEY', auth: k => ({ 'x-api-key': k, 'anthropic-version': '2023-06-01' }), pick: j => (j.data || []).map(m => m.id) },
-    gemini: { url: 'https://generativelanguage.googleapis.com/v1beta/models', envName: 'GOOGLE_API_KEY', keyParam: 'key', auth: () => ({}), pick: j => (j.models || []).map(m => (m.name || '').replace(/^models\//, '')).filter(Boolean) },
-    ollama: { url: 'http://localhost:11434/api/tags', envName: null, auth: () => ({}), pick: j => (j.models || []).map(m => m.name || m.model).filter(Boolean) },
-}
-const ACP_BACKENDS = {
-    kilo: { url: 'http://localhost:4780/session', staticModels: ['x-ai/grok-code-fast-1:optimized:free'] },
-    opencode: { url: 'http://localhost:4790/session', staticModels: ['minimax-m2.5-free'] },
-}
-const CLI_BACKENDS = {
-    'claude-cli': { models: ['claude-haiku-4-5', 'claude-sonnet-4-6', 'claude-opus-4-7', 'haiku', 'sonnet', 'opus'] },
-}
-
-const prober = createModelProber()
-
-async function probeBrand(provider) {
-    const resolved = await resolveKey(provider).catch(() => ({ value: null }))
-    const brand = BRANDS[provider]
-    const envKey = brand?.envKey
-    const key = resolved.value || (envKey ? process.env[envKey] : undefined)
-    if (!key) return { provider, error: 'no_key' }
-    try {
-        const r = await prober.probe(provider, key)
-        if (r.error) return { provider, error: r.error }
-        return { provider, models: r.models || [], last_ok_at: r.ts }
-    } catch (e) { return { provider, error: String(e.message || e) } }
-}
-
-async function probeExtra(provider) {
-    const ep = EXTRA[provider]
-    if (!ep) return { provider, error: 'no_extra_endpoint' }
-    const resolved = await resolveKey(provider).catch(() => ({ value: null }))
-    const key = resolved.value || (ep.envName ? process.env[ep.envName] : undefined)
-    if (!key && provider !== 'ollama') return { provider, error: 'no_key' }
-    try {
-        const url = ep.keyParam ? `${ep.url}?${ep.keyParam}=${encodeURIComponent(key)}` : ep.url
-        const headers = ep.auth(key)
-        const res = await fetch(url, { method: 'GET', headers, signal: AbortSignal.timeout(8000) })
-        if (!res.ok) { const t = await res.text(); return { provider, error: `${res.status}: ${t.slice(0, 200)}` } }
-        const json = await res.json()
-        return { provider, models: ep.pick(json) || [], last_ok_at: Date.now() }
-    } catch (e) { return { provider, error: String(e.message || e) } }
-}
-
-async function probeAcp(provider) {
-    const b = ACP_BACKENDS[provider]
-    try {
-        const r = await fetch(b.url, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: '{}', signal: AbortSignal.timeout(2000) })
-        if (!r.ok) return { provider, error: `${r.status}`, models: b.staticModels }
-        return { provider, models: b.staticModels, last_ok_at: Date.now() }
-    } catch (e) { return { provider, error: String(e.message || e), models: b.staticModels } }
-}
-
-async function probeCli(provider) {
-    if (provider !== 'claude-cli') return { provider, error: 'unknown_cli', models: [] }
-    try {
-        const { spawn } = await import('node:child_process')
-        const ok = await new Promise(res => {
-            const p = spawn('claude', ['--version'], { stdio: 'ignore', shell: false })
-            const t = setTimeout(() => { p.kill(); res(false) }, 3000)
-            p.on('exit', c => { clearTimeout(t); res(c === 0) })
-            p.on('error', () => { clearTimeout(t); res(false) })
-        })
-        if (!ok) return { provider, error: 'claude_cli_not_available', models: [] }
-        return { provider, models: CLI_BACKENDS['claude-cli'].models, last_ok_at: Date.now() }
-    } catch (e) { return { provider, error: String(e.message || e), models: [] } }
-}
+const NON_KEY_PROVIDERS = ['claude-cli', 'kilo', 'opencode', 'ollama']
 
 export function listKnownProviders() {
-    return [...Object.keys(BRANDS), ...Object.keys(EXTRA), ...Object.keys(ACP_BACKENDS), ...Object.keys(CLI_BACKENDS)]
+    const cached = getConfigValue('agent.discovered_models', {}) || {}
+    const set = new Set([...Object.keys(cached), ...Object.keys(_sdk.PROVIDER_KEYS || {}), ...NON_KEY_PROVIDERS])
+    return [...set]
 }
 
 export async function discoverModels({ provider } = {}) {
-    const providers = provider ? [provider] : listKnownProviders()
-    const results = await Promise.all(providers.map(p => {
-        if (BRANDS[p]) return probeBrand(p)
-        if (EXTRA[p]) return probeExtra(p)
-        if (ACP_BACKENDS[p]) return probeAcp(p)
-        if (CLI_BACKENDS[p]) return probeCli(p)
-        return Promise.resolve({ provider: p, error: 'unknown_provider' })
-    }))
-    const byProvider = {}
-    for (const r of results) byProvider[r.provider] = r
-    log.info('discovered', { count: results.length, ok: results.filter(r => !r.error).length })
-    return byProvider
+    const base = getAcptoapiUrl().replace(/\/v1\/?$/, '')
+    try {
+        const r = await fetch(base + '/v1/models', {
+            headers: { authorization: 'Bearer none' },
+            signal: AbortSignal.timeout(10000),
+        })
+        if (!r.ok) {
+            const text = await r.text()
+            log.warn('discover failed', { status: r.status, body: text.slice(0, 200) })
+            return {}
+        }
+        const json = await r.json()
+        const byProvider = {}
+        for (const m of (json.data || [])) {
+            const id = m.id || ''
+            const slash = id.indexOf('/')
+            if (slash <= 0) continue
+            const p = id.slice(0, slash)
+            const modelName = id.slice(slash + 1)
+            if (provider && p !== provider) continue
+            byProvider[p] = byProvider[p] || { provider: p, models: [], last_ok_at: Date.now() }
+            byProvider[p].models.push(modelName)
+        }
+        log.info('discovered', { count: Object.keys(byProvider).length })
+        return byProvider
+    } catch (e) {
+        log.warn('discover error', { error: e.message })
+        return {}
+    }
 }
 
 export async function discoverAndPersist({ provider } = {}) {
@@ -101,7 +55,6 @@ export async function discoverAndPersist({ provider } = {}) {
     const merged = { ...existing }
     for (const [p, r] of Object.entries(result)) {
         if (!r.error) merged[p] = { models: r.models, last_ok_at: r.last_ok_at }
-        else merged[p] = { ...(existing[p] || {}), models: r.models || (existing[p]?.models) || [], error: r.error, last_error_at: Date.now() }
     }
     saveConfigValue('agent.discovered_models', merged)
     return result

package/src/browser/index.js

@@ -0,0 +1,23 @@
+// Browser entry for freddie. Polymorphic with the Node CLI.
+// node:* imports are expected to be satisfied by the host environment shims
+// (thebird provides them via docs/vendor/esm/node/ + docs/shell-node-*.js).
+//
+// This entry deliberately re-exports only the browser-safe surface needed
+// to embed freddie as an agent in a web OS: the xstate-driven agent machine,
+// the host bootstrapper, and configuration defaults. It avoids re-exporting
+// CLI/TUI/dashboard/MCP/ACP server code which pulls in commander, express,
+// child_process, and other Node-only subsystems.
+
+export { bootHost, host, resetHostForTests } from '../host/index.js'
+export { createAgentMachine, runTurn } from '../agent/machine.js'
+export { createActor, createMachine, assign, fromPromise, waitFor } from 'xstate'
+
+// Re-export config defaults under the documented browser name.
+import { DEFAULT_CONFIG } from '../config.js'
+export const FREDDIE_DEFAULT_CONFIG = DEFAULT_CONFIG
+export { DEFAULT_CONFIG }
+
+// Optional extras that are browser-friendly when their node:* imports are shimmed.
+export { buildContext, blocksToSystemMessage, ContextPlugins } from '../context/engine.js'
+export { listSkills, findSkill, skillAsUserMessage } from '../skills/index.js'
+export { log, logger } from '../observability/log.js'

package/src/host/contract.js

@@ -16,6 +16,7 @@ export const HOOK_NAMES = [
     'onSessionStart', 'onSessionEnd',
     'onTurnStart', 'onTurnEnd',
     'onMessageInbound', 'onMessageOutbound',
+    'onPreCompact', 'onPostCompact',
 ]
 
 export const FREDDIE_TO_SDK_HOOK = {
@@ -25,6 +26,8 @@ export const FREDDIE_TO_SDK_HOOK = {
     onSessionEnd:       HookType.SESSION_END,
     onMessageInbound:   HookType.PROMPT_SUBMIT,
     onMessageOutbound:  HookType.STOP,
+    onPreCompact:       HookType.PRE_COMPACT,
+    onPostCompact:      HookType.POST_COMPACT,
 }
 
 export const FREDDIE_TO_NATIVE_HOOK = {
@@ -34,6 +37,8 @@ export const FREDDIE_TO_NATIVE_HOOK = {
     onSessionEnd:      'SessionEnd',
     onMessageInbound:  'UserPromptSubmit',
     onMessageOutbound: 'Stop',
+    onPreCompact:      'PreCompact',
+    onPostCompact:     'PostCompact',
 }
 
 export function validatePlugin(p) {

package/src/host/host_helpers.js

@@ -48,6 +48,8 @@ function ccPayloadFor(name, payload) {
         return { tool_name: payload?.name, tool_input: payload?.args || payload?.input, tool_response: payload?.result }
     if (name === 'onMessageInbound' || name === 'onMessageOutbound')
         return { prompt: payload?.content || payload?.text || '' }
+    if (name === 'onPreCompact' || name === 'onPostCompact')
+        return { trigger: payload?.trigger || 'auto', messages_count: payload?.messages?.length ?? 0, summary: payload?.summary ?? null }
     return payload || {}
 }
 
@@ -90,12 +92,17 @@ export function makeHooksRegistry(ccHost) {
             let cur = payload
             for (const fn of reg2[name] || []) cur = (await fn(cur)) ?? cur
             const native = FREDDIE_TO_NATIVE_HOOK[name]
-            if (native && ccHost.plugins().length) {
+            if (native && ccHost.plugins().length && !process.env.FREDDIE_DISABLE_CC_HOOKS) {
                 const r = await ccHost.dispatch(native, ccPayloadFor(name, cur))
-                if (r.decision === 'block') return { ...cur, behavior: 'block', reason: r.reason }
+                const extras = {}
+                if (typeof r.systemMessage === 'string' && r.systemMessage.length) extras.systemMessage = r.systemMessage
+                const addCtx = r.hookSpecificOutput?.additionalContext
+                if (typeof addCtx === 'string' && addCtx.length) extras.additionalContext = addCtx
+                if (r.decision === 'block') return { ...cur, ...extras, behavior: 'block', reason: r.reason }
                 const pd = r.hookSpecificOutput?.permissionDecision
-                if (pd === 'deny') return { ...cur, behavior: 'block', reason: r.hookSpecificOutput?.permissionDecisionReason || 'denied' }
-                if (r.hookSpecificOutput?.updatedInput) return { ...cur, ...r.hookSpecificOutput.updatedInput }
+                if (pd === 'deny') return { ...cur, ...extras, behavior: 'block', reason: r.hookSpecificOutput?.permissionDecisionReason || 'denied' }
+                if (r.hookSpecificOutput?.updatedInput) return { ...cur, ...extras, ...r.hookSpecificOutput.updatedInput }
+                if (Object.keys(extras).length) return { ...cur, ...extras }
             }
             return cur
         },
@@ -127,6 +134,7 @@ export function makeCcLoaders(ccHost, env) {
         }
         return ccHost.plugins().length
     }
+    const CC_EXCLUDE = new Set(['gm-cc'])
     async function loadCcFromNodeModules(startDir) {
         const seen = new Set(ccHost.plugins().map(p => p.root))
         let cur = path.resolve(startDir)
@@ -138,7 +146,7 @@ export function makeCcLoaders(ccHost, env) {
                     ? fs.readdirSync(path.join(nm, entry.name), { withFileTypes: true }).filter(e => e.isDirectory()).map(e => path.join(nm, entry.name, e.name))
                     : [path.join(nm, entry.name)]
                 for (const d of dirs) {
-                    if (seen.has(d) || !isCcPluginDir(d)) continue
+                    if (seen.has(d) || !isCcPluginDir(d) || CC_EXCLUDE.has(path.basename(d))) continue
                     seen.add(d); await useCcDir(d)
                 }
             }

package/src/web/server.js

@@ -12,8 +12,8 @@ export async function createDashboard({ port = 0 } = {}) {
     app.use(express.static(__dirname))
     const fromNodeModules = path.join(__dirname, '..', '..', 'node_modules', 'anentrypoint-design', 'dist')
     app.use('/vendor/anentrypoint-design', express.static(fromNodeModules))
-    const nmDesktop = path.join(__dirname, '..', '..', 'node_modules', 'anentrypoint-design', 'src', 'desktop')
-    app.use('/vendor/anentrypoint-design/desktop', express.static(nmDesktop))
+    const nmKitsOs = path.join(__dirname, '..', '..', 'node_modules', 'anentrypoint-design', 'src', 'kits', 'os')
+    app.use('/vendor/anentrypoint-design/kits/os', express.static(nmKitsOs))
     for (const r of host.gui.routes.list()) {
         const verb = r.method.toLowerCase()
         if (typeof app[verb] === 'function') app[verb](r.path, r.handler)

package/plugins/gm-cc/plugin.js

@@ -1,26 +0,0 @@
-import { createRequire } from 'module'
-import path from 'path'
-import fs from 'fs'
-import { loadClaudePlugin } from 'plugsdk'
-
-const _require = createRequire(import.meta.url)
-const gmCcBase = path.dirname(_require.resolve('gm-cc/package.json'))
-
-export default {
-    name: 'gm-cc',
-    surfaces: 'pi',
-    register({ pi }) {
-        if (!fs.existsSync(path.join(gmCcBase, 'skills'))) return
-        const cc = loadClaudePlugin(gmCcBase)
-        for (const s of cc.skills) {
-            pi.skills.register({
-                name: 'gm:' + s.name,
-                description: s.fields.description || '',
-                content: s.body,
-                source: 'gm-cc',
-                frontmatter: s.fields,
-                file: s.file,
-            })
-        }
-    },
-}

package/src/agent/model-sampler.js

@@ -1,13 +0,0 @@
-import { createRequire } from 'module'
-const _require = createRequire(import.meta.url)
-const _sdk = _require('acptoapi')
-
-export const isAvailable = _sdk.isAvailable
-export const markFailed = _sdk.markFailed
-export const markOk = _sdk.markOk
-export const resetAvailability = _sdk.resetAvailability
-export const getStatus = _sdk.getStatus
-export const probe = _sdk.probe
-export const startSampler = _sdk.startSampler
-export const stopSampler = _sdk.stopSampler
-export const createSampler = _sdk.createSampler