madarx 2.16.3 → 2.18.0

package/CHANGELOG.md

@@ -4,6 +4,45 @@ All notable changes to Madarx OS. Newest first.
 
 ## Unreleased
 
+## [2.18.0] - 2026-06-06
+
+### Added
+
+- **Background-agent activity popover in the top toolbar.** The toolbar's "agents running" indicator is now a clickable **Activity** pill that opens a live panel of every background agent the Main Agent spawns — each agent's name, what triggered it, its current tool, and a recent tool-step trail (running / done / error), reusing the chat feed's tool-step icons and sublabels. The detail rides the existing SSE connection: `app/agents/agent-events-bus.js` now also forwards `agent_tool_start` / `agent_tool_result` (existing subscribers filter by `event.type`, so the extra events are inert for them), so no new socket is opened. The popover is portaled to `document.body` at `z-index:9300` so it paints above canvas artifacts (`.artifact-fs` is `9100`) and stays below the search/help overlays (12000+), anchored to the pill via the trigger's viewport rect with outside-click handling across the portal. At idle it shows an empty state describing the feature, so the control is discoverable before any agent runs. Files: `app/components/app-topbar.jsx`, `app/globals.css`.
+- **Live thinking + verbose streaming (engine-agnostic).** The main agent's chat now surfaces the engine's work in real time — token-by-token answer text, the model's reasoning ("thinking") in a collapsible panel, a cold-start / long-tool status heartbeat with elapsed time, and richer tool steps (full input + output preview + duration). One knob governs every engine: `MADARX_CC_STREAM_VERBOSITY` = `quiet` | `thinking` (default) | `full`. `claude-code` adds `--include-partial-messages` (capability-probed via `claude --help`; older CLIs degrade gracefully to chunked streaming) plus a best-effort `MAX_THINKING_TOKENS`; `anthropic` enables extended thinking on thinking-capable models (budget `MADARX_THINKING_BUDGET_TOKENS`, default 4000) with `thinking`/`redacted_thinking` signatures preserved for tool-use turns and never persisted to chat history or artifacts; `ollama` streams NDJSON tokens (reasoning via `MADARX_OLLAMA_THINK=1`). New SSE events `cli_thinking` / `cli_status`. Reference: `ai-docs/key-constraints.md`; spec `specs/active/claude-code-engine-live-thinking-stream.md`.
+- **Voice = the main agent (full tool parity).** The Jarvis voice console now drives the exact same brain, live tool catalog, and gates as typed chat. `lib/voice/tools.js` attaches the full `getTools()` catalog to the Realtime session (advertised list in `lib/voice/context.js` always matches what's attached), so anything the typed agent can do, voice can do. Set `MADARX_VOICE_FAST_TOOLS=1` to trim to a 10-tool conversational subset.
+- **Greeting on connect.** Opening voice greets the operator by name ("Hello, Ak.") — spoken by the Realtime model on data-channel open (legacy brain) or via the TTS lane (transport brain). Name resolves from the signed-in session (`display_name`, else capitalised email local-part).
+- **On-brand voice artifacts.** Voice instructions now mandate that every visual artifact route through `generate_ui` (which composes `DESIGN_RULES + brandInstructionText(getBrandProfile())`), so spoken "make me a page/brief/report" requests render on-brand with no emoji.
+- **Skill bridge (`skill_bridge_run`).** A new, tightly-gated tool that lets the agent (and voice) drive the real **visible** GStack browser by invoking an allowlisted first-party gstack CLI skill (`connect-chrome`, `browse`, `qa-only`) via `runClaudeCodeAgent`. Risk `irreversible_external`, `enabled_default:false`, **always** approval-gated on both the main and agent paths (force-gated alongside `browser_harness_run`), hard kill-switch `MADARX_SKILL_BRIDGE_DISABLED=1`, bounded by the `.claude/settings.json` deny list. `lib/tools/adapters/skill-bridge.js` + `tests/skill-bridge.test.js`. Verified end-to-end: gate → approve → real browser opened https://example.com and read its title.
+- **Transport voice brain (opt-in).** Behind `localStorage madarx:voice-brain='transport'`, Realtime runs STT-only and routes cognition through `/api/orchestrator/stream` (same brain as chat), speaking replies via TTS. Default stays the proven in-browser `realtime` brain.
+
+### Changed
+
+- **Chat hides raw HTML while streaming.** An agent turn that emits a full HTML artifact no longer types raw markup into the chat bubble — the artifact renders on the canvas while a tasteful "Designing the page…" placeholder shows in chat, replaced by the turn's summary on completion. Server-side stripping for the CLI engine also stops re-sending the growing HTML page on every SSE tick; a client-side strip covers Anthropic/Ollama deltas too.
+- **Voice latency tuned the right way.** `session.reasoning.effort='low'` on `gpt-realtime-2` (`lib/realtime-openai.js`, model-guarded; override `OPENAI_REALTIME_REASONING`) is the latency dial instead of hiding tools — keeps first-audio snappy while voice keeps the whole toolset. Researched against the 2026 voice-agent landscape: OpenAI Realtime (speech-to-speech) stays the right provider; TTS-only alternatives would force a slower pipeline.
+
+### Fixed
+
+- **Operator stuck below admin on their own default org (auto-healed on update).** When an install flipped to Supabase auth mode, the seeded `personal-org` was owned by the synthetic `local-user-1`, so the real operator was added as a `member` and the first-login owner-bootstrap was skipped — leaving them permanently below admin (every owner/admin gate, including the folder picker, 403'd). The boot migration (`runAuthV1Migration`, runs idempotently on every start) now self-heals: when the default org has no real owner, it promotes the unambiguous operator to `owner` (the sole real member, or the `MADARX_OWNER_EMAIL` match when several). Conservative — never downgrades, never guesses on an ambiguous shared org. Existing affected installs fix themselves on the next restart after updating. Logic + tests: `scripts/migrate-auth-v1.mjs::healDefaultOrgOwnership`, `tests/default-org-owner-heal.test.js`.
+- **"Choose folder…" returned `insufficient_role` for non-admin users.** The native folder picker (`/api/fs/pick-folder`, used by New/Edit project) required the org `admin` role, so a `member`/`viewer` (e.g. a non-owner user in supabase auth mode) hit a 403 `insufficient_role` and could never select a custom project folder — even though creating the project and creating a folder weren't gated at all. Plain folder selection now only needs an authenticated session (the picker just opens an OS dialog and returns a path; project creation + the disk layer enforce allowed roots). Registering a Mines import root stays admin-gated. Gate extracted to `lib/pick-folder-authz.js` with a regression test.
+- **Consistent artifact corner radius.** The canvas window and the expand/fullscreen overlay (enter/open/exit) now share one `--artifact-radius` token (14px) instead of three different values (17 / 22 / 0), so a larger or fullscreen artifact no longer balloons its corners into the title-bar buttons.
+- **Deterministic `org-invites` test isolation.** A `joinBootstrap` test left `auth_mode` flipped to `supabase` in the config table, which (since the config table outranks the env) broke a later test's clean-install precondition under a full-file run. The cleanup now clears the persisted mode so the suite is deterministic (full suite 1360/1360).
+- **Voice no longer stalls after a transport regression.** Reverted the transport brain from default to opt-in after it shipped with unverified Realtime GA session fields that left the model silent. The default `realtime` path is restored and snappy.
+
+## [2.17.0] - 2026-06-05
+
+### Added
+
+- **Persistent top toolbar.** A macOS-style toolbar mounted in the root layout (`AppChrome`) now stays on every non-chromeless page across navigation — showing the current section, a global "agents running" indicator (live via the SSE bus), and a search trigger. The dashboard's canvas controls (Approve & Run, Hermes, Runtime, Reset layout) are portaled into this single bar so "spaces" no longer shows two toolbars. The Hermes control appears only when a Hermes-engine agent exists.
+- **Durable manual agent runs.** Clicking **Run** now enqueues a durable `heartbeat_tasks` row (leased, stale-recovered) and kicks one worker pass for low latency, instead of a fire-and-forget promise — so a manual run survives a server recompile/restart. `max_attempts:1` avoids retry-storming deterministic config errors.
+- **Visible manual-run failures.** A failed manual run now persists a FAILED `runs` row + `agent.run.failed` audit carrying the error code and remediation, so engine/tool misconfigurations (e.g. a tool-needing agent on the Hermes/Ollama engine) surface in the agent's activity feed instead of failing silently to the console.
+- **Live agent activity feed + run-state hydration.** The agent detail activity feed subscribes to the SSE bus and surfaces run start/complete/failure without a reload; the Run button hydrates its state from a new `GET /api/agents/[id]/active-run` so it reflects an in-flight run after navigating away and back.
+
+### Fixed
+
+- **claude-code missing from the main chat model picker despite being "available".** `/api/models` (the main-agent picker) now uses the same robust CLI detector as `/settings/engines` — absolute-path candidates plus the `MADARX_CLAUDE_BIN` / `MADARX_CODEX_BIN` override — instead of a login-shell-only `command -v`. A CLI installed outside the server's inherited PATH (common on desktop/GUI-launched servers) now appears in the picker wherever the engines page reports it available; pin it explicitly with `MADARX_CLAUDE_BIN=/abs/path/to/claude`.
+- **Artifact canvas top alignment.** Removed the leftover top inset so the artifact window aligns flush with the chat panel and sidebar.
+
 ## [2.16.3] - 2026-06-05
 
 ### Added

package/CLAUDE.md

@@ -140,7 +140,7 @@ node --no-warnings --test --test-name-pattern="your test name" tests/api-behavio
 - **Main agent trust mode** — `executeRegistryTool()` gates risky calls. Default `approval_required`. `auto` skips gate for `high` and below — `blocked` and `irreversible_external` never auto-approved.
 - **`irreversible_external` risk tier** — always creates an approval request even in trust-mode `auto`. Load-bearing guarantee that an LLM on auto-trust cannot make irreversible external writes without a human in the loop. Tiers: `blocked` → refuse | `irreversible_external` → always gate | `high`/`medium` → gate in `approval_required` mode | `low` → always execute.
 - **Tool adapters** — Resend email, GitHub (11 tools), Supabase writes (6 tools), `flight_search` dual-provider routing (Amadeus → Google Flights fallback). Details and credentials in [`ai-docs/key-constraints.md`](ai-docs/key-constraints.md#tool-adapters).
-- **Voice tools (Jarvis)** — provider abstraction (`realtime` → `tts` → `local` → `off`). Curated tool catalog routed through standard gates. Realtime ephemeral secrets never persisted. Brand: Onyx/Bone/Graphite, Mars Red only on active speech + approval banners.
+- **Voice tools (Jarvis)** — provider abstraction (`realtime` → `tts` → `local` → `off`). **Voice IS the main agent.** Default `realtime` brain is **transport-only**: OpenAI Realtime does STT (and the TTS lane speaks); cognition + tool calls run through the SAME `/api/orchestrator/stream` path as typed chat — same model, same live `getTools()` catalog, same trust/approval/allowlist/rate-limit gates. No per-session tool snapshot, so a tool enabled mid-conversation is usable on the next turn. Legacy in-browser-brain path is behind `localStorage madarx:voice-brain='realtime'` for rollback. Realtime ephemeral secrets never persisted. Brand: Onyx/Bone/Graphite, Mars Red only on active speech + approval banners.
 - **WhatsApp gateway** — Baileys sub-package, separate-process daemon. **Pair only a dedicated WhatsApp number, not personal account.** Router enforces allowlist + 5-msg/min per-sender rate limit.
 - **Sub-agent engines** — five engines in `lib/agent-engines.js`: `claude-code` (**default**), `anthropic`, `ollama`, `codex`, `hermes`. CC spawns the local CLI with `--permission-mode bypassPermissions`; **the `deny` list in `.claude/settings.json` is the load-bearing safety boundary**.
 - **Process engine ownership of state** — `lib/process/engine.js` is the SOLE writer of `process_cases.current_stage_id`, `current_stage_slug`, `status`, and `context_json`. Stage handlers receive a read-only case snapshot; they never mutate case state. Every transition flows through `transitionTo`, which is transaction-wrapped and asserts the expected `from_stage_id`. Full details: [`ai-docs/process-engine.md`](ai-docs/process-engine.md).

package/README.md

@@ -71,7 +71,7 @@ A polished voice console for the Main Agent — open it from the chat panel's mi
 | **Local** (open-source slots) | `MADARX_LOCAL_STT_URL`, `MADARX_LOCAL_TTS_URL` | URL slots for Whisper.cpp / FasterWhisper / Piper / Coqui. |
 | **Off** | – | Default when no providers are configured. |
 
-The voice agent is given the durable Madarx context on every session mint: today's date, active project, open tasks, recent artifact titles, pending approvals, brand voice, and non-`local_only` memory rows. It can call a curated tool set (`create_artifact`, `update_artifact`, `delete_artifact`, `find_artifacts`, `get_state`, `web_search`, `web_fetch`, `voice_speak`); every call routes through `executeRegistryTool` / `executeTool`, so trust-mode, approval gates, allowlists, rate limits, and audit are identical to typed chat. Voice **never** bypasses the `irreversible_external` approval gate (e.g. `gh_pr_merge`, `email_send`, `supabase_sql`).
+The voice agent is given the durable Madarx context on every session mint: today's date, active project, open tasks, recent artifact titles, pending approvals, brand voice, and non-`local_only` memory rows. **Voice is the main agent** — it sees the *full* main-agent tool catalog (the same `getTools()` list typed chat uses, not a curated subset), and every call routes through `executeRegistryTool` / `executeTool`, so trust-mode, approval gates, allowlists, rate limits, and audit are identical to typed chat. Latency is held down by `session.reasoning.effort='low'` on `gpt-realtime-2`, not by hiding tools. Voice **never** bypasses the `irreversible_external` approval gate (e.g. `gh_pr_merge`, `email_send`, `supabase_sql`, `skill_bridge_run`). Visual artifacts route through `generate_ui` so spoken page/report requests render on-brand.
 
 Brand: Onyx surface, Bone/Graphite text, Mars Red reserved for active speech peaks + approval banners.
 

package/ai-docs/key-constraints.md

@@ -44,13 +44,15 @@ Integration credentials (`GITHUB_TOKEN`, `RESEND_API_KEY`, `SUPABASE_*`, `VERCEL
 
 **GitHub (A1)** — 11 tools in `lib/tools/adapters/github.js`. All disabled by default (`enabled_default: false`), credential: `GITHUB_TOKEN` via secrets vault. Read tools (`gh_repo_read`, `gh_repo_list`, `gh_issue_list`, `gh_pr_list`) are `low` risk, rate-limited 60/min, no allowlist. Write tools (`gh_issue_create`, `gh_issue_comment`, `gh_pr_comment`) are `medium` risk, require a `repo_full_name` allowlist entry. High-risk tools (`gh_pr_create`, `gh_actions_dispatch`, `gh_release_create`) require allowlist + trust-mode gate. `gh_pr_merge` is `irreversible_external` — always requires human approval regardless of trust mode. All responses return curated shapes (never raw API blobs). All calls use `wrapFetch` for egress logging. Auth: `Authorization: Bearer <GITHUB_TOKEN>`, `Accept: application/vnd.github+json`, `X-GitHub-Api-Version: 2022-11-28`, `User-Agent: madarx-os`.
 
+**Skill bridge (`skill_bridge_run`)** — Phase 4 of voice/main-agent unification. `lib/tools/adapters/skill-bridge.js` exposes a 3-entry allowlist of first-party gstack CLI skills (`connect-chrome`, `browse`, `qa-only`) as ONE tool so the main agent — and voice, which shares the full catalog — can drive the **visible** GStack browser the operator watches live. Risk `irreversible_external`, `enabled_default:false`, rate-limited 10/5min. It crosses the Claude Code CLI trust boundary, so it is the most sharply gated tool: ALWAYS approval-gated on the main path (even trust-mode `auto`), force-gated on the agent path (added next to `browser_harness_run` in `registry.js`'s `agentIrreversibleGate`), hard kill-switch `MADARX_SKILL_BRIDGE_DISABLED=1`, and only allowlisted skill slugs are runnable (the LLM supplies the skill choice + a plain-language instruction as data, never a shell line). It runs via `runClaudeCodeAgent` under `bypassPermissions` bounded by the load-bearing `.claude/settings.json` deny list. These are first-party skills, NOT agent-authored code, so the "never execute LLM-authored code" invariant holds. Output is capped + redacted. Tested in `tests/skill-bridge.test.js` (allowlist, kill-switch, always-gate on both paths, approved one-shot replay via `MADARX_MOCK_CLAUDE_CODE_RESPONSE`).
+
 **Supabase writes** — six new tools in `lib/tools/adapters/supabase.js`. All disabled by default, all use `wrapFetch` for egress logging, all credentials via secrets vault (`SUPABASE_URL` + `SUPABASE_SERVICE_ROLE_KEY` or `SUPABASE_ANON_KEY`). Table and function names validated against `/^[a-zA-Z_][a-zA-Z0-9_]*(\.[a-zA-Z_][a-zA-Z0-9_]*)?$/` (schema-qualified names like `auth.users` accepted). `supabase_rest_insert` (medium, 30/min, table allowlist) — POST rows; `supabase_rest_upsert` (medium, 30/min, table allowlist) — merge-on-conflict POST; `supabase_rest_update` (high, 30/min, table allowlist) — PATCH with required filters; `supabase_rest_delete` (irreversible_external, 10/hour, table allowlist) — DELETE with required filters, always approval-gated; `supabase_rpc` (high, 30/min, function_name allowlist) — RPC call; `supabase_sql` (irreversible_external, 5/hour, default_allow) — raw SQL via `madarx_exec_sql()` Postgres function, uses service-role key and bypasses RLS, approval payload always includes RLS-bypass warning and full query text. Both `supabase_rest_update` and `supabase_rest_delete` throw synchronously on empty/missing filters before any network call.
 
 **`flight_search` dual-provider routing** — `flight_search` is always available regardless of credential state (`required_env: []`). `lib/tools/adapters/travel.js::flightSearch` is a router: when both `AMADEUS_CLIENT_ID` and `AMADEUS_CLIENT_SECRET` resolve, it calls `_flightSearchAmadeus`; otherwise falls back to `googleFlightsSearch` in `lib/tools/adapters/google-flights.js`, a key-less reverse-engineered call to Google's batchexecute RPC (`https://www.google.com/_/TravelFrontendUi/data/batchexecute`, RPC id `H4cFwe`). Both providers return the same curated shape; callers branch on `source.provider` (`'amadeus' | 'google_flights_web'`) only when they want to disclose origin. `lib/flight-cache.js` is a 15-minute in-process LRU (cap 200) keyed by sha1 of the normalized query — cache hits skip `wrapFetch` and rate-limit accounting and set `source.cache_hit=true`. Set `MADARX_FLIGHT_SEARCH_NO_FALLBACK=1` to disable the Google fallback and surface the Amadeus error instead. Pure helpers `encodeFreq`, `parseBatchexecute`, `curateGoogleOffer` are exported for golden testing; the parser is defensive (strips `)]}'` prefix, balance-scans frames, walks the inner payload heuristically) and degrades gracefully to `{ count: 0, offers: [], source.parse_warning: ... }` if Google's RPC shape shifts.
 
 ## Voice tools (Jarvis console)
 
-Provider abstraction lives in `lib/voice/providers.js`. Lanes: `realtime` (primary — OpenAI Realtime via WebRTC; vault keys `OPENAI_API_KEY`, optional `OPENAI_REALTIME_MODEL`, `OPENAI_REALTIME_VOICE`), `tts` (fallback — existing typed chat speaks final reply via OpenAI TTS, ElevenLabs, or the env-driven local HTTP TTS slot; vault keys `OPENAI_API_KEY`/`ELEVENLABS_API_KEY` + optional `ELEVENLABS_VOICE_ID`; local uses `MADARX_LOCAL_TTS_URL`, optional `MADARX_LOCAL_TTS_MODEL`/`MADARX_LOCAL_TTS_VOICE`), and `local` (open-source STT/TTS slots — `MADARX_LOCAL_STT_URL`/`MADARX_LOCAL_TTS_URL`; `scripts/misotts-local-server.py` provides a minimal MisoLabsAI/MisoTTS bridge). Default mode resolves at runtime (`realtime` → `tts` → `local` → `off`) and respects `MADARX_VOICE_DEFAULT_PROVIDER`. Every voice session is minted with a durable Madarx context (`lib/voice/context.js`): today's ISO date, active project, brand voice, open tasks, recent artifact titles, pending approvals, and non-`local_only` agent memory — never API keys, ephemeral tokens, or `local_only` memory. The voice model sees a curated tool catalog (`lib/voice/tools.js`): `create_artifact`, `update_artifact`, `delete_artifact`, `find_artifacts`, `get_state`, `web_search`, `web_fetch`, `voice_speak`. All calls flow through `executeVoiceTool` → `executeTool` → `executeRegistryTool`, so trust-mode, approval gates (including the never-bypassable `irreversible_external` tier), allowlists, rate limits, egress logging, and audit rows are preserved exactly as for typed chat. Realtime ephemeral client secrets are returned to the browser but never persisted; the long-lived OpenAI key never crosses to the browser. UI: `app/components/dashboard/voice-panel.jsx` + `voice-orb.jsx` + `use-realtime-voice.js`. Brand: Onyx surface, Bone/Graphite text, Mars Red only on active speech peaks + approval banners. Operator guide: `docs/voice/jarvis.md`. `cli-printing-press` documented as a deferred external companion in `docs/integrations/cli-printing-press.md`.
+Provider abstraction lives in `lib/voice/providers.js`. Lanes: `realtime` (primary — OpenAI Realtime via WebRTC; vault keys `OPENAI_API_KEY`, optional `OPENAI_REALTIME_MODEL`, `OPENAI_REALTIME_VOICE`), `tts` (fallback — existing typed chat speaks final reply via OpenAI TTS, ElevenLabs, or the env-driven local HTTP TTS slot; vault keys `OPENAI_API_KEY`/`ELEVENLABS_API_KEY` + optional `ELEVENLABS_VOICE_ID`; local uses `MADARX_LOCAL_TTS_URL`, optional `MADARX_LOCAL_TTS_MODEL`/`MADARX_LOCAL_TTS_VOICE`), and `local` (open-source STT/TTS slots — `MADARX_LOCAL_STT_URL`/`MADARX_LOCAL_TTS_URL`; `scripts/misotts-local-server.py` provides a minimal MisoLabsAI/MisoTTS bridge). Default mode resolves at runtime (`realtime` → `tts` → `local` → `off`) and respects `MADARX_VOICE_DEFAULT_PROVIDER`. Every voice session is minted with a durable Madarx context (`lib/voice/context.js`): today's ISO date, active project, brand voice, open tasks, recent artifact titles, pending approvals, and non-`local_only` agent memory — never API keys, ephemeral tokens, or `local_only` memory. **Voice IS the main agent — transport-only realtime brain (unified path).** The `realtime` lane is, by default, STT/TTS transport only: OpenAI Realtime captures speech and emits the user's final transcript (`mintOpenAIRealtimeSession({ mode: 'transport' })` forces `tools: []`, a transcribe-only instruction block, `audio.input.transcription`, and `turn_detection.create_response:false` so the Realtime model never reasons or speaks). The browser forwards each final utterance to `mainAgent.command(text)` — the SAME `/api/orchestrator/stream` path typed chat uses — so cognition, the live `getTools()` catalog, trust-mode, approval gates (including the never-bypassable `irreversible_external` tier), allowlists, rate limits, egress logging, and audit rows are literally identical to typed chat. The orchestrator's reply is voiced through the TTS lane (`speakText` → `/api/voice/tts`). Because there is no per-session tool snapshot, a tool enabled mid-conversation is usable on the next voice turn. The legacy in-browser-brain path (Realtime reasons + calls `getVoiceToolsForRealtime()` tools + speaks, via `lib/voice/tools.js` → `relayRealtimeToolCall`) still exists for rollback behind `localStorage madarx:voice-brain='realtime'` (`mode:'realtime'` on mint). Voice approvals surface in the chat panel; the voice orb says "needs your approval" and pauses. Realtime ephemeral client secrets are returned to the browser but never persisted; the long-lived OpenAI key never crosses to the browser. UI: `app/components/dashboard/voice-panel.jsx` + `voice-orb.jsx` + `use-realtime-voice.js` (the `transport` flag + `onUserUtterance` callback drive the unified loop). Brand: Onyx surface, Bone/Graphite text, Mars Red only on active speech peaks + approval banners. Operator guide: `docs/voice/jarvis.md`. `cli-printing-press` documented as a deferred external companion in `docs/integrations/cli-printing-press.md`.
 
 ## WhatsApp gateway
 
@@ -64,6 +66,12 @@ Provider abstraction lives in `lib/voice/providers.js`. Lanes: `realtime` (prima
 
 `lib/agent-engines.js` defines five engines: `claude-code` (**default**), `anthropic` (madarx tool marketplace via the Anthropic Messages API — required for `create_artifact`, `generate_ui`, `whatsapp_send`, `competitor_report`, `marketing_plan` which do NOT exist on the CC path), `ollama`, `codex`, `hermes`. `claude-code` agents spawn the local CC CLI per run via `runClaudeCodeAgent` with `--permission-mode bypassPermissions --setting-sources project,local,user --max-turns 30 --add-dir workspace --add-dir data` (matches the pattern OpenClaw's `extensions/anthropic/cli-backend.ts` uses). `bypassPermissions` skips per-call confirmation prompts so multi-step agentic work runs uninterrupted; **the `deny` list in `.claude/settings.json` is the load-bearing safety boundary** — it hard-blocks `sudo`, `rm -rf/-r/-f`, `git reset --hard`, force-push, `git clean -fd`, package-manager installs/publishes, outbound network from shell (`curl`/`wget`/`nc`/`ssh`/`scp`), database CLIs (`psql`/`mysql`/`redis-cli`), filesystem ops (`dd`/`mkfs`/`fdisk`), service control (`systemctl`/`launchctl`), reads of `.env*` / `data/whatsapp/session/` / `~/.ssh` / `~/.aws` / `/etc`, and writes to `.git/`, `node_modules/`, `data/madarx.sqlite`, `.claude/`. The allow list pre-approves read-only tools (Read/Glob/Grep/LS), Web (WebSearch/WebFetch), edits inside `workspace/`, and a curated Bash safelist (git status/log/diff, ls/cat/head/tail/wc, jq, mkdir/touch/cp/mv inside `workspace/`). Extend in `.claude/settings.json` (shared) or `.claude/settings.local.json` (personal, gitignored). Override the spawn timeout via `CLAUDE_CODE_TICK_TIMEOUT_MS` (default 600000) and max turns via `CLAUDE_CODE_MAX_TURNS` (default 30).
 
+**Live verbose streaming (engine-agnostic).** When the main agent answers in chat, madarX surfaces the engine's work in real time — token-by-token text, the model's reasoning ("thinking"), and rich tool detail (full input + output preview + elapsed ms). One knob governs every engine: `MADARX_CC_STREAM_VERBOSITY` = `quiet` | `thinking` (default) | `full` (`lib/engine-verbosity.js`). Mechanics by engine:
+- **`claude-code`** — `runClaudeCodeAgent` adds `--include-partial-messages` (capability-probed once via `claude --help`; older CLIs degrade to chunked complete-message streaming) so the stream-json parser (`makeStreamJsonParser`) emits `stream_event` text/thinking deltas. Best-effort thinking via the `MAX_THINKING_TOKENS` subprocess env.
+- **`anthropic`** — the orchestrator loop enables extended thinking on thinking-capable models (`modelSupportsThinking` allowlist: sonnet-4/opus-4/haiku-4/3.7-sonnet) with budget `MADARX_THINKING_BUDGET_TOKENS` (default 4000); `thinking`/`redacted_thinking` blocks (with signatures) are preserved in the assistant turn so tool-use follow-ups validate. Thinking is streamed but never persisted to chat history or saved artifacts.
+- **`ollama`** — streams NDJSON tokens; reasoning when `MADARX_OLLAMA_THINK=1` (opt-in; `think:true` errors on some models). The fabrication guard still runs on the full output before persistence.
+- **SSE events** — `cli_thinking` (accumulated reasoning), `cli_status` (`starting`/`working`+`elapsedMs`/`thinking`/`generating`/`done` cold-start + heartbeat), enriched `tool_result` (`durationMs`, output `preview`/`lines`). Client: `use-stream-command.js` → `ThinkingDisclosure` collapsible panel + per-step duration/preview in `chat-panel.jsx`. Set `MADARX_CC_FORCE_PARTIAL=0/1` to override the CC capability probe.
+
 **Tool-loop capability + no-fabrication guarantee.** Only `anthropic` runs the GOVERNED madarX tool loop (`generateTickOutput`: `chatWithClaude` + `executeRegistryTool` with gates/allowlists/audit). `claude-code`/`codex` run their own native CLI tool runtimes (real, but not the madarX toolset). `ollama`/`hermes` complete text single-shot with **no tool dispatch at all** — a Hermes/Nous-template model "satisfies" a tool task by role-playing the whole loop, emitting `<tool_call>`/`<tool_response>` with **invented results** in plain text. Two layers stop that fiction ever reaching the user as a real result:
 - **Layer A (`lib/engine-capabilities.js::assertRunnable`)** — runs in `agent-runner.js` before the engine ternary. A tool-needing agent (≥1 enabled tool) on a non-tool-executing engine (`ollama`/`hermes`) throws `engine_cannot_run_tools` → recorded as a FAILED run with remediation, never a fabricated "complete" deliverable. Tool-less agents run single-shot on any engine.
 - **Layer B (`lib/fabricated-tool-output.js::looksFabricatedToolTranscript`)** — backstop after output. When `toolEvents.length === 0` and the output is a fabricated tool transcript, the run throws `fabricated_tool_output` (no artifact written). The detector strips fenced/inline code first so genuine reports *quoting* `<tool_call>` are not false-positives.

package/app/agents/[id]/agent-activity-feed.tsx

@@ -1,7 +1,8 @@
 'use client';
 
-import { useMemo, useState } from 'react';
+import { useEffect, useMemo, useState } from 'react';
 import { Search, Play, ShieldCheck } from 'lucide-react';
+import { subscribeAgentEvents } from '../agent-events-bus.js';
 import { formatRelativeTime, humanizeRunStatus } from './format-helpers';
 
 type ActivityItem = {
@@ -30,24 +31,59 @@ function statusLabel(item: ActivityItem): string {
   return humanizeRunStatus(item.status);
 }
 
-export function AgentActivityFeed({ items }: { items: ActivityItem[] }) {
+export function AgentActivityFeed({ agentId, items }: { agentId: string; items: ActivityItem[] }) {
   const [query, setQuery] = useState('');
+  // Live runs for THIS agent, layered above the server-rendered snapshot. The
+  // server feed is a static render (no revalidate on run), so a manual run —
+  // especially a FAILED one — would otherwise be invisible until a reload. We
+  // surface start/complete/failed from the SSE bus immediately. Keyed by run_id
+  // (or 'manual' for fire-and-forget runs) so complete updates the same row.
+  const [liveItems, setLiveItems] = useState<ActivityItem[]>([]);
+
+  useEffect(() => {
+    return subscribeAgentEvents((event: any) => {
+      if (event.agent_id !== agentId) return;
+      const key = `live-${event.run_id || 'manual'}`;
+      if (event.type === 'agent_run_start') {
+        setLiveItems((cur) => {
+          const rest = cur.filter((i) => i.id !== key);
+          return [
+            { id: key, kind: 'execution', status: 'running', title: `${event.agent_name || 'Agent'} run`, at: new Date().toISOString() },
+            ...rest,
+          ];
+        });
+      } else if (event.type === 'agent_run_complete') {
+        const status = event.isError ? (event.status || 'failed') : (event.status || 'complete');
+        setLiveItems((cur) => {
+          const existing = cur.find((i) => i.id === key);
+          const title = event.error ? `${event.agent_name || 'Agent'} run — ${String(event.error).slice(0, 120)}` : (existing?.title || `${event.agent_name || 'Agent'} run`);
+          const updated: ActivityItem = { id: key, kind: 'execution', status, title, at: existing?.at || new Date().toISOString() };
+          const rest = cur.filter((i) => i.id !== key);
+          return [updated, ...rest];
+        });
+      }
+    });
+  }, [agentId]);
+
+  // Merge live over server items; dedupe is unnecessary — live items use a
+  // `live-` id and reset on remount, while server items use `run-`/`approval-`.
+  const merged = useMemo(() => [...liveItems, ...items], [liveItems, items]);
 
   const filtered = useMemo(() => {
     const q = query.trim().toLowerCase();
-    if (!q) return items;
-    return items.filter((item) =>
+    if (!q) return merged;
+    return merged.filter((item) =>
       item.title.toLowerCase().includes(q)
       || item.status.toLowerCase().includes(q)
       || item.kind.includes(q)
     );
-  }, [items, query]);
+  }, [merged, query]);
 
   return (
     <section className="ad-activity">
       <div className="ad-activity-head">
         <span className="ad-activity-title">Recent activity</span>
-        {items.length ? (
+        {merged.length ? (
           <label className="ad-activity-search">
             <Search size={13} aria-hidden />
             <input
@@ -83,7 +119,7 @@ export function AgentActivityFeed({ items }: { items: ActivityItem[] }) {
             );
           })}
         </ul>
-      ) : items.length ? (
+      ) : merged.length ? (
         <div className="ad-feed-empty">No activity matches “{query}”.</div>
       ) : (
         <div className="ad-feed-empty">

package/app/agents/[id]/agent-detail-simple.tsx

@@ -111,7 +111,7 @@ export function AgentDetailSimple({
         updateDefaultSpaceAction={updateDefaultSpaceAction}
       />
 
-      <AgentActivityFeed items={activity} />
+      <AgentActivityFeed agentId={agent.id} items={activity} />
     </section>
   );
 }

package/app/agents/agent-events-bus.js

@@ -4,7 +4,17 @@
 // browser tab, regardless of how many agents are on screen — important
 // because the server caps subscribers per process.
 
-const EVENT_TYPES = ['agent_created', 'agent_run_start', 'agent_run_complete'];
+// Tool-level events (agent_tool_start / agent_tool_result) ride the same
+// connection so the global topbar can show *what* a background agent is doing,
+// not just that something is running. Existing subscribers filter by
+// event.type, so the extra types are inert for them.
+const EVENT_TYPES = [
+  'agent_created',
+  'agent_run_start',
+  'agent_run_complete',
+  'agent_tool_start',
+  'agent_tool_result',
+];
 
 let source = null;
 const subscribers = new Set();

package/app/agents/agent-run-button.jsx

@@ -6,6 +6,19 @@ export default function AgentRunButton({ agentId }) {
   const [running, setRunning] = useState(false);
   const [submitting, setSubmitting] = useState(false);
 
+  // Hydrate from server truth on mount. The SSE `agent_run_start` event fires
+  // once at run start; if the user navigated away and back, that event was
+  // missed and this freshly-mounted button would wrongly show "Run" while a run
+  // is still live. Ask the server whether a run is currently active.
+  useEffect(() => {
+    let cancelled = false;
+    fetch(`/api/agents/${encodeURIComponent(agentId)}/active-run`)
+      .then((res) => (res.ok ? res.json() : null))
+      .then((data) => { if (!cancelled && data?.active) setRunning(true); })
+      .catch(() => { /* best-effort; SSE still drives live flips */ });
+    return () => { cancelled = true; };
+  }, [agentId]);
+
   useEffect(() => {
     return subscribeAgentEvents((event) => {
       if (event.agent_id !== agentId) return;

package/app/api/agents/[id]/active-run/route.js

@@ -0,0 +1,23 @@
+import { isRunActive } from '@/lib/active-runs.js';
+import { listAgentRuns } from '@/lib/delegation.js';
+import { isActiveRunStatus } from '@/lib/delegation-contracts.js';
+
+export const runtime = 'nodejs';
+export const dynamic = 'force-dynamic';
+
+// Source of truth for "is this agent running right now?" so the Run button can
+// hydrate the correct state after the user navigates away and back. Combines:
+//   - the in-process manual-run registry (fire-and-forget runs have no DB row)
+//   - any delegated/task agent_runs row in an active status (queued/running/...)
+export async function GET(_req, { params }) {
+  const { id } = await params;
+  let taskActive = false;
+  try {
+    taskActive = listAgentRuns({ agent_id: id, limit: 20 })
+      .some(run => isActiveRunStatus(run.status));
+  } catch {
+    taskActive = false;
+  }
+  const active = isRunActive(id) || taskActive;
+  return Response.json({ active, agent_id: id });
+}

package/app/api/agents/[id]/run/route.js

@@ -1,21 +1,40 @@
 import { getAgent } from '@/lib/runtime.js';
-import { runAgentTick } from '@/lib/agent-runner.js';
+import { createHeartbeatTask } from '@/lib/heartbeat-queue.js';
+import { runHeartbeatWorkerOnce } from '@/lib/heartbeat-worker.js';
 
 export const runtime = 'nodejs';
 export const dynamic = 'force-dynamic';
 
-// Fire-and-forget manual run. The dashboard SSE stream (`agent_run_start` /
-// `agent_run_complete`) drives the UI, so this route returns immediately and
-// lets the run finish in the background — otherwise the request would block
-// for the full duration of the tick and the button would lock up.
+// Manual run = durable + low-latency (hybrid).
+//
+// Previously this was a fire-and-forget `runAgentTick().catch()` promise: it
+// survived browser navigation (server-side) but NOT a dev recompile / server
+// restart, and it was untracked. Now we ENQUEUE a heartbeat_tasks row (durable —
+// leased, retried-once, stale-recovered by the worker) and immediately KICK one
+// worker pass so it still starts in ~milliseconds. If this process dies mid-run,
+// the lease expires and the in-process/standalone heartbeat worker re-claims it.
+//
+// max_attempts:1 — a manual click is one intent; a deterministic config error
+// (e.g. engine_cannot_run_tools) must not retry-storm into duplicate failed runs.
 export async function POST(_req, { params }) {
   const { id } = await params;
   const agent = getAgent(id);
   if (!agent) return Response.json({ ok: false, error: 'agent not found' }, { status: 404 });
 
-  runAgentTick(id, { triggered_by: 'manual' }).catch(err => {
-    console.warn(`[agents/${id}/run] tick failed:`, err?.message || err);
+  const task = createHeartbeatTask({
+    agent_id: id,
+    type: 'agent_tick',
+    priority: 10, // ahead of background ticks so the click feels instant
+    max_attempts: 1,
+    payload: { type: 'agent_tick', agent_id: id, triggered_by: 'manual', reason: 'manual-run' },
   });
 
-  return Response.json({ ok: true, agent_id: id, status: 'queued' });
+  // Low-latency kick. Best-effort: the durable queue is the safety net, so a
+  // failed kick (or none, e.g. management mode) just means the worker picks it
+  // up on its next interval.
+  runHeartbeatWorkerOnce().catch(err => {
+    console.warn(`[agents/${id}/run] worker kick failed:`, err?.message || err);
+  });
+
+  return Response.json({ ok: true, agent_id: id, task_id: task.id, status: 'queued' });
 }

package/app/api/connections/[service]/verify/route.js

@@ -166,11 +166,39 @@ async function verifyGithub(creds) {
     if (!res.ok) return { ok: false, reason: 'invalid_key' };
     const data = await res.json().catch(() => ({}));
     const login = typeof data?.login === 'string' ? data.login : null;
+
+    // Probe real reach: does the token see any repos beyond the owner's own?
+    // A token that authenticates fine but was never granted org/collaborator
+    // repos is the #1 "connected but can't read the repo" confusion — surface
+    // it as a non-blocking warning rather than silently reporting success.
+    let reach = null;
+    try {
+      const probe = wrapFetch('connection.verify.github.reach', null, fetch);
+      const pr = await probe(
+        'https://api.github.com/user/repos?per_page=1&affiliation=collaborator,organization_member',
+        { method: 'GET', headers: {
+          authorization: `Bearer ${token}`,
+          accept: 'application/vnd.github+json',
+          'x-github-api-version': '2022-11-28',
+          'user-agent': 'madarx-os',
+        } },
+      );
+      if (pr.ok) {
+        const arr = await pr.json().catch(() => []);
+        reach = Array.isArray(arr) && arr.length > 0 ? 'org_or_collaborator' : 'owner_only';
+      }
+    } catch {
+      // best-effort — never fail verify on the reach probe
+    }
+
     return {
       ok: true,
       account_label: login ? `@${login}` : 'GitHub',
       last_4: fingerprintLast4(token),
-      summary: { login },
+      summary: { login, repo_reach: reach },
+      warning: reach === 'owner_only'
+        ? { field: 'GITHUB_TOKEN', reason: 'owner_only_access' }
+        : null,
     };
   } catch {
     return { ok: false, reason: 'network' };

package/app/api/fs/pick-folder/route.js

@@ -2,9 +2,9 @@ import { spawn } from 'node:child_process';
 import os from 'node:os';
 import fs from 'node:fs';
 import path from 'node:path';
-import { requireFreshMembership, requireSession } from '@/lib/auth.js';
-import { requireRole } from '@/lib/authz.js';
-import { approveMinesImportRoot } from '@/lib/mines/import-roots.js';
+import { requireFreshMembership, requireSession } from '../../../../lib/auth.js';
+import { assertPickFolderRole } from '../../../../lib/pick-folder-authz.js';
+import { approveMinesImportRoot } from '../../../../lib/mines/import-roots.js';
 
 export const dynamic = 'force-dynamic';
 export const runtime = 'nodejs';
@@ -30,10 +30,10 @@ function appleScriptString(value) {
   return String(value || '').replace(/\\/g, '\\\\').replace(/"/g, '\\"');
 }
 
-async function requireAdmin(request) {
+async function authenticatePicker(request, registerImportRoot) {
   const session = await requireSession(request);
   await requireFreshMembership(session, session.org_id);
-  requireRole(session, 'admin', session.org_id);
+  assertPickFolderRole(session, registerImportRoot);
   return session;
 }
 
@@ -45,18 +45,20 @@ function authError(err) {
 }
 
 export async function POST(request) {
+  // Parse the body first so the auth gate knows whether this is a privileged
+  // import-root registration (admin-only) or a plain folder pick (any session).
+  const body = await request.json().catch(() => ({}));
+  const title = String(body.title || 'Select a folder').replace(/["\\]/g, '');
+  const startPath = String(body.start_path || os.homedir() || '/').trim();
+  const registerImportRoot = Boolean(body.register_import_root);
+
   let session;
   try {
-    session = await requireAdmin(request);
+    session = await authenticatePicker(request, registerImportRoot);
   } catch (err) {
     return authError(err);
   }
 
-  const body = await request.json().catch(() => ({}));
-  const title = String(body.title || 'Select a folder').replace(/["\\]/g, '');
-  const startPath = String(body.start_path || os.homedir() || '/').trim();
-  const registerImportRoot = Boolean(body.register_import_root);
-
   try {
     let picked;
     if (process.platform === 'darwin') {