madarx 2.17.0 → 2.18.0

package/CHANGELOG.md

@@ -4,6 +4,31 @@ All notable changes to Madarx OS. Newest first.
 
 ## Unreleased
 
+## [2.18.0] - 2026-06-06
+
+### Added
+
+- **Background-agent activity popover in the top toolbar.** The toolbar's "agents running" indicator is now a clickable **Activity** pill that opens a live panel of every background agent the Main Agent spawns — each agent's name, what triggered it, its current tool, and a recent tool-step trail (running / done / error), reusing the chat feed's tool-step icons and sublabels. The detail rides the existing SSE connection: `app/agents/agent-events-bus.js` now also forwards `agent_tool_start` / `agent_tool_result` (existing subscribers filter by `event.type`, so the extra events are inert for them), so no new socket is opened. The popover is portaled to `document.body` at `z-index:9300` so it paints above canvas artifacts (`.artifact-fs` is `9100`) and stays below the search/help overlays (12000+), anchored to the pill via the trigger's viewport rect with outside-click handling across the portal. At idle it shows an empty state describing the feature, so the control is discoverable before any agent runs. Files: `app/components/app-topbar.jsx`, `app/globals.css`.
+- **Live thinking + verbose streaming (engine-agnostic).** The main agent's chat now surfaces the engine's work in real time — token-by-token answer text, the model's reasoning ("thinking") in a collapsible panel, a cold-start / long-tool status heartbeat with elapsed time, and richer tool steps (full input + output preview + duration). One knob governs every engine: `MADARX_CC_STREAM_VERBOSITY` = `quiet` | `thinking` (default) | `full`. `claude-code` adds `--include-partial-messages` (capability-probed via `claude --help`; older CLIs degrade gracefully to chunked streaming) plus a best-effort `MAX_THINKING_TOKENS`; `anthropic` enables extended thinking on thinking-capable models (budget `MADARX_THINKING_BUDGET_TOKENS`, default 4000) with `thinking`/`redacted_thinking` signatures preserved for tool-use turns and never persisted to chat history or artifacts; `ollama` streams NDJSON tokens (reasoning via `MADARX_OLLAMA_THINK=1`). New SSE events `cli_thinking` / `cli_status`. Reference: `ai-docs/key-constraints.md`; spec `specs/active/claude-code-engine-live-thinking-stream.md`.
+- **Voice = the main agent (full tool parity).** The Jarvis voice console now drives the exact same brain, live tool catalog, and gates as typed chat. `lib/voice/tools.js` attaches the full `getTools()` catalog to the Realtime session (advertised list in `lib/voice/context.js` always matches what's attached), so anything the typed agent can do, voice can do. Set `MADARX_VOICE_FAST_TOOLS=1` to trim to a 10-tool conversational subset.
+- **Greeting on connect.** Opening voice greets the operator by name ("Hello, Ak.") — spoken by the Realtime model on data-channel open (legacy brain) or via the TTS lane (transport brain). Name resolves from the signed-in session (`display_name`, else capitalised email local-part).
+- **On-brand voice artifacts.** Voice instructions now mandate that every visual artifact route through `generate_ui` (which composes `DESIGN_RULES + brandInstructionText(getBrandProfile())`), so spoken "make me a page/brief/report" requests render on-brand with no emoji.
+- **Skill bridge (`skill_bridge_run`).** A new, tightly-gated tool that lets the agent (and voice) drive the real **visible** GStack browser by invoking an allowlisted first-party gstack CLI skill (`connect-chrome`, `browse`, `qa-only`) via `runClaudeCodeAgent`. Risk `irreversible_external`, `enabled_default:false`, **always** approval-gated on both the main and agent paths (force-gated alongside `browser_harness_run`), hard kill-switch `MADARX_SKILL_BRIDGE_DISABLED=1`, bounded by the `.claude/settings.json` deny list. `lib/tools/adapters/skill-bridge.js` + `tests/skill-bridge.test.js`. Verified end-to-end: gate → approve → real browser opened https://example.com and read its title.
+- **Transport voice brain (opt-in).** Behind `localStorage madarx:voice-brain='transport'`, Realtime runs STT-only and routes cognition through `/api/orchestrator/stream` (same brain as chat), speaking replies via TTS. Default stays the proven in-browser `realtime` brain.
+
+### Changed
+
+- **Chat hides raw HTML while streaming.** An agent turn that emits a full HTML artifact no longer types raw markup into the chat bubble — the artifact renders on the canvas while a tasteful "Designing the page…" placeholder shows in chat, replaced by the turn's summary on completion. Server-side stripping for the CLI engine also stops re-sending the growing HTML page on every SSE tick; a client-side strip covers Anthropic/Ollama deltas too.
+- **Voice latency tuned the right way.** `session.reasoning.effort='low'` on `gpt-realtime-2` (`lib/realtime-openai.js`, model-guarded; override `OPENAI_REALTIME_REASONING`) is the latency dial instead of hiding tools — keeps first-audio snappy while voice keeps the whole toolset. Researched against the 2026 voice-agent landscape: OpenAI Realtime (speech-to-speech) stays the right provider; TTS-only alternatives would force a slower pipeline.
+
+### Fixed
+
+- **Operator stuck below admin on their own default org (auto-healed on update).** When an install flipped to Supabase auth mode, the seeded `personal-org` was owned by the synthetic `local-user-1`, so the real operator was added as a `member` and the first-login owner-bootstrap was skipped — leaving them permanently below admin (every owner/admin gate, including the folder picker, 403'd). The boot migration (`runAuthV1Migration`, runs idempotently on every start) now self-heals: when the default org has no real owner, it promotes the unambiguous operator to `owner` (the sole real member, or the `MADARX_OWNER_EMAIL` match when several). Conservative — never downgrades, never guesses on an ambiguous shared org. Existing affected installs fix themselves on the next restart after updating. Logic + tests: `scripts/migrate-auth-v1.mjs::healDefaultOrgOwnership`, `tests/default-org-owner-heal.test.js`.
+- **"Choose folder…" returned `insufficient_role` for non-admin users.** The native folder picker (`/api/fs/pick-folder`, used by New/Edit project) required the org `admin` role, so a `member`/`viewer` (e.g. a non-owner user in supabase auth mode) hit a 403 `insufficient_role` and could never select a custom project folder — even though creating the project and creating a folder weren't gated at all. Plain folder selection now only needs an authenticated session (the picker just opens an OS dialog and returns a path; project creation + the disk layer enforce allowed roots). Registering a Mines import root stays admin-gated. Gate extracted to `lib/pick-folder-authz.js` with a regression test.
+- **Consistent artifact corner radius.** The canvas window and the expand/fullscreen overlay (enter/open/exit) now share one `--artifact-radius` token (14px) instead of three different values (17 / 22 / 0), so a larger or fullscreen artifact no longer balloons its corners into the title-bar buttons.
+- **Deterministic `org-invites` test isolation.** A `joinBootstrap` test left `auth_mode` flipped to `supabase` in the config table, which (since the config table outranks the env) broke a later test's clean-install precondition under a full-file run. The cleanup now clears the persisted mode so the suite is deterministic (full suite 1360/1360).
+- **Voice no longer stalls after a transport regression.** Reverted the transport brain from default to opt-in after it shipped with unverified Realtime GA session fields that left the model silent. The default `realtime` path is restored and snappy.
+
 ## [2.17.0] - 2026-06-05
 
 ### Added

package/CLAUDE.md

@@ -140,7 +140,7 @@ node --no-warnings --test --test-name-pattern="your test name" tests/api-behavio
 - **Main agent trust mode** — `executeRegistryTool()` gates risky calls. Default `approval_required`. `auto` skips gate for `high` and below — `blocked` and `irreversible_external` never auto-approved.
 - **`irreversible_external` risk tier** — always creates an approval request even in trust-mode `auto`. Load-bearing guarantee that an LLM on auto-trust cannot make irreversible external writes without a human in the loop. Tiers: `blocked` → refuse | `irreversible_external` → always gate | `high`/`medium` → gate in `approval_required` mode | `low` → always execute.
 - **Tool adapters** — Resend email, GitHub (11 tools), Supabase writes (6 tools), `flight_search` dual-provider routing (Amadeus → Google Flights fallback). Details and credentials in [`ai-docs/key-constraints.md`](ai-docs/key-constraints.md#tool-adapters).
-- **Voice tools (Jarvis)** — provider abstraction (`realtime` → `tts` → `local` → `off`). Curated tool catalog routed through standard gates. Realtime ephemeral secrets never persisted. Brand: Onyx/Bone/Graphite, Mars Red only on active speech + approval banners.
+- **Voice tools (Jarvis)** — provider abstraction (`realtime` → `tts` → `local` → `off`). **Voice IS the main agent.** Default `realtime` brain is **transport-only**: OpenAI Realtime does STT (and the TTS lane speaks); cognition + tool calls run through the SAME `/api/orchestrator/stream` path as typed chat — same model, same live `getTools()` catalog, same trust/approval/allowlist/rate-limit gates. No per-session tool snapshot, so a tool enabled mid-conversation is usable on the next turn. Legacy in-browser-brain path is behind `localStorage madarx:voice-brain='realtime'` for rollback. Realtime ephemeral secrets never persisted. Brand: Onyx/Bone/Graphite, Mars Red only on active speech + approval banners.
 - **WhatsApp gateway** — Baileys sub-package, separate-process daemon. **Pair only a dedicated WhatsApp number, not personal account.** Router enforces allowlist + 5-msg/min per-sender rate limit.
 - **Sub-agent engines** — five engines in `lib/agent-engines.js`: `claude-code` (**default**), `anthropic`, `ollama`, `codex`, `hermes`. CC spawns the local CLI with `--permission-mode bypassPermissions`; **the `deny` list in `.claude/settings.json` is the load-bearing safety boundary**.
 - **Process engine ownership of state** — `lib/process/engine.js` is the SOLE writer of `process_cases.current_stage_id`, `current_stage_slug`, `status`, and `context_json`. Stage handlers receive a read-only case snapshot; they never mutate case state. Every transition flows through `transitionTo`, which is transaction-wrapped and asserts the expected `from_stage_id`. Full details: [`ai-docs/process-engine.md`](ai-docs/process-engine.md).

package/README.md

@@ -71,7 +71,7 @@ A polished voice console for the Main Agent — open it from the chat panel's mi
 | **Local** (open-source slots) | `MADARX_LOCAL_STT_URL`, `MADARX_LOCAL_TTS_URL` | URL slots for Whisper.cpp / FasterWhisper / Piper / Coqui. |
 | **Off** | – | Default when no providers are configured. |
 
-The voice agent is given the durable Madarx context on every session mint: today's date, active project, open tasks, recent artifact titles, pending approvals, brand voice, and non-`local_only` memory rows. It can call a curated tool set (`create_artifact`, `update_artifact`, `delete_artifact`, `find_artifacts`, `get_state`, `web_search`, `web_fetch`, `voice_speak`); every call routes through `executeRegistryTool` / `executeTool`, so trust-mode, approval gates, allowlists, rate limits, and audit are identical to typed chat. Voice **never** bypasses the `irreversible_external` approval gate (e.g. `gh_pr_merge`, `email_send`, `supabase_sql`).
+The voice agent is given the durable Madarx context on every session mint: today's date, active project, open tasks, recent artifact titles, pending approvals, brand voice, and non-`local_only` memory rows. **Voice is the main agent** — it sees the *full* main-agent tool catalog (the same `getTools()` list typed chat uses, not a curated subset), and every call routes through `executeRegistryTool` / `executeTool`, so trust-mode, approval gates, allowlists, rate limits, and audit are identical to typed chat. Latency is held down by `session.reasoning.effort='low'` on `gpt-realtime-2`, not by hiding tools. Voice **never** bypasses the `irreversible_external` approval gate (e.g. `gh_pr_merge`, `email_send`, `supabase_sql`, `skill_bridge_run`). Visual artifacts route through `generate_ui` so spoken page/report requests render on-brand.
 
 Brand: Onyx surface, Bone/Graphite text, Mars Red reserved for active speech peaks + approval banners.
 

package/ai-docs/key-constraints.md

@@ -44,13 +44,15 @@ Integration credentials (`GITHUB_TOKEN`, `RESEND_API_KEY`, `SUPABASE_*`, `VERCEL
 
 **GitHub (A1)** — 11 tools in `lib/tools/adapters/github.js`. All disabled by default (`enabled_default: false`), credential: `GITHUB_TOKEN` via secrets vault. Read tools (`gh_repo_read`, `gh_repo_list`, `gh_issue_list`, `gh_pr_list`) are `low` risk, rate-limited 60/min, no allowlist. Write tools (`gh_issue_create`, `gh_issue_comment`, `gh_pr_comment`) are `medium` risk, require a `repo_full_name` allowlist entry. High-risk tools (`gh_pr_create`, `gh_actions_dispatch`, `gh_release_create`) require allowlist + trust-mode gate. `gh_pr_merge` is `irreversible_external` — always requires human approval regardless of trust mode. All responses return curated shapes (never raw API blobs). All calls use `wrapFetch` for egress logging. Auth: `Authorization: Bearer <GITHUB_TOKEN>`, `Accept: application/vnd.github+json`, `X-GitHub-Api-Version: 2022-11-28`, `User-Agent: madarx-os`.
 
+**Skill bridge (`skill_bridge_run`)** — Phase 4 of voice/main-agent unification. `lib/tools/adapters/skill-bridge.js` exposes a 3-entry allowlist of first-party gstack CLI skills (`connect-chrome`, `browse`, `qa-only`) as ONE tool so the main agent — and voice, which shares the full catalog — can drive the **visible** GStack browser the operator watches live. Risk `irreversible_external`, `enabled_default:false`, rate-limited 10/5min. It crosses the Claude Code CLI trust boundary, so it is the most sharply gated tool: ALWAYS approval-gated on the main path (even trust-mode `auto`), force-gated on the agent path (added next to `browser_harness_run` in `registry.js`'s `agentIrreversibleGate`), hard kill-switch `MADARX_SKILL_BRIDGE_DISABLED=1`, and only allowlisted skill slugs are runnable (the LLM supplies the skill choice + a plain-language instruction as data, never a shell line). It runs via `runClaudeCodeAgent` under `bypassPermissions` bounded by the load-bearing `.claude/settings.json` deny list. These are first-party skills, NOT agent-authored code, so the "never execute LLM-authored code" invariant holds. Output is capped + redacted. Tested in `tests/skill-bridge.test.js` (allowlist, kill-switch, always-gate on both paths, approved one-shot replay via `MADARX_MOCK_CLAUDE_CODE_RESPONSE`).
+
 **Supabase writes** — six new tools in `lib/tools/adapters/supabase.js`. All disabled by default, all use `wrapFetch` for egress logging, all credentials via secrets vault (`SUPABASE_URL` + `SUPABASE_SERVICE_ROLE_KEY` or `SUPABASE_ANON_KEY`). Table and function names validated against `/^[a-zA-Z_][a-zA-Z0-9_]*(\.[a-zA-Z_][a-zA-Z0-9_]*)?$/` (schema-qualified names like `auth.users` accepted). `supabase_rest_insert` (medium, 30/min, table allowlist) — POST rows; `supabase_rest_upsert` (medium, 30/min, table allowlist) — merge-on-conflict POST; `supabase_rest_update` (high, 30/min, table allowlist) — PATCH with required filters; `supabase_rest_delete` (irreversible_external, 10/hour, table allowlist) — DELETE with required filters, always approval-gated; `supabase_rpc` (high, 30/min, function_name allowlist) — RPC call; `supabase_sql` (irreversible_external, 5/hour, default_allow) — raw SQL via `madarx_exec_sql()` Postgres function, uses service-role key and bypasses RLS, approval payload always includes RLS-bypass warning and full query text. Both `supabase_rest_update` and `supabase_rest_delete` throw synchronously on empty/missing filters before any network call.
 
 **`flight_search` dual-provider routing** — `flight_search` is always available regardless of credential state (`required_env: []`). `lib/tools/adapters/travel.js::flightSearch` is a router: when both `AMADEUS_CLIENT_ID` and `AMADEUS_CLIENT_SECRET` resolve, it calls `_flightSearchAmadeus`; otherwise falls back to `googleFlightsSearch` in `lib/tools/adapters/google-flights.js`, a key-less reverse-engineered call to Google's batchexecute RPC (`https://www.google.com/_/TravelFrontendUi/data/batchexecute`, RPC id `H4cFwe`). Both providers return the same curated shape; callers branch on `source.provider` (`'amadeus' | 'google_flights_web'`) only when they want to disclose origin. `lib/flight-cache.js` is a 15-minute in-process LRU (cap 200) keyed by sha1 of the normalized query — cache hits skip `wrapFetch` and rate-limit accounting and set `source.cache_hit=true`. Set `MADARX_FLIGHT_SEARCH_NO_FALLBACK=1` to disable the Google fallback and surface the Amadeus error instead. Pure helpers `encodeFreq`, `parseBatchexecute`, `curateGoogleOffer` are exported for golden testing; the parser is defensive (strips `)]}'` prefix, balance-scans frames, walks the inner payload heuristically) and degrades gracefully to `{ count: 0, offers: [], source.parse_warning: ... }` if Google's RPC shape shifts.
 
 ## Voice tools (Jarvis console)
 
-Provider abstraction lives in `lib/voice/providers.js`. Lanes: `realtime` (primary — OpenAI Realtime via WebRTC; vault keys `OPENAI_API_KEY`, optional `OPENAI_REALTIME_MODEL`, `OPENAI_REALTIME_VOICE`), `tts` (fallback — existing typed chat speaks final reply via OpenAI TTS, ElevenLabs, or the env-driven local HTTP TTS slot; vault keys `OPENAI_API_KEY`/`ELEVENLABS_API_KEY` + optional `ELEVENLABS_VOICE_ID`; local uses `MADARX_LOCAL_TTS_URL`, optional `MADARX_LOCAL_TTS_MODEL`/`MADARX_LOCAL_TTS_VOICE`), and `local` (open-source STT/TTS slots — `MADARX_LOCAL_STT_URL`/`MADARX_LOCAL_TTS_URL`; `scripts/misotts-local-server.py` provides a minimal MisoLabsAI/MisoTTS bridge). Default mode resolves at runtime (`realtime` → `tts` → `local` → `off`) and respects `MADARX_VOICE_DEFAULT_PROVIDER`. Every voice session is minted with a durable Madarx context (`lib/voice/context.js`): today's ISO date, active project, brand voice, open tasks, recent artifact titles, pending approvals, and non-`local_only` agent memory — never API keys, ephemeral tokens, or `local_only` memory. The voice model sees a curated tool catalog (`lib/voice/tools.js`): `create_artifact`, `update_artifact`, `delete_artifact`, `find_artifacts`, `get_state`, `web_search`, `web_fetch`, `voice_speak`. All calls flow through `executeVoiceTool` → `executeTool` → `executeRegistryTool`, so trust-mode, approval gates (including the never-bypassable `irreversible_external` tier), allowlists, rate limits, egress logging, and audit rows are preserved exactly as for typed chat. Realtime ephemeral client secrets are returned to the browser but never persisted; the long-lived OpenAI key never crosses to the browser. UI: `app/components/dashboard/voice-panel.jsx` + `voice-orb.jsx` + `use-realtime-voice.js`. Brand: Onyx surface, Bone/Graphite text, Mars Red only on active speech peaks + approval banners. Operator guide: `docs/voice/jarvis.md`. `cli-printing-press` documented as a deferred external companion in `docs/integrations/cli-printing-press.md`.
+Provider abstraction lives in `lib/voice/providers.js`. Lanes: `realtime` (primary — OpenAI Realtime via WebRTC; vault keys `OPENAI_API_KEY`, optional `OPENAI_REALTIME_MODEL`, `OPENAI_REALTIME_VOICE`), `tts` (fallback — existing typed chat speaks final reply via OpenAI TTS, ElevenLabs, or the env-driven local HTTP TTS slot; vault keys `OPENAI_API_KEY`/`ELEVENLABS_API_KEY` + optional `ELEVENLABS_VOICE_ID`; local uses `MADARX_LOCAL_TTS_URL`, optional `MADARX_LOCAL_TTS_MODEL`/`MADARX_LOCAL_TTS_VOICE`), and `local` (open-source STT/TTS slots — `MADARX_LOCAL_STT_URL`/`MADARX_LOCAL_TTS_URL`; `scripts/misotts-local-server.py` provides a minimal MisoLabsAI/MisoTTS bridge). Default mode resolves at runtime (`realtime` → `tts` → `local` → `off`) and respects `MADARX_VOICE_DEFAULT_PROVIDER`. Every voice session is minted with a durable Madarx context (`lib/voice/context.js`): today's ISO date, active project, brand voice, open tasks, recent artifact titles, pending approvals, and non-`local_only` agent memory — never API keys, ephemeral tokens, or `local_only` memory. **Voice IS the main agent — transport-only realtime brain (unified path).** The `realtime` lane is, by default, STT/TTS transport only: OpenAI Realtime captures speech and emits the user's final transcript (`mintOpenAIRealtimeSession({ mode: 'transport' })` forces `tools: []`, a transcribe-only instruction block, `audio.input.transcription`, and `turn_detection.create_response:false` so the Realtime model never reasons or speaks). The browser forwards each final utterance to `mainAgent.command(text)` — the SAME `/api/orchestrator/stream` path typed chat uses — so cognition, the live `getTools()` catalog, trust-mode, approval gates (including the never-bypassable `irreversible_external` tier), allowlists, rate limits, egress logging, and audit rows are literally identical to typed chat. The orchestrator's reply is voiced through the TTS lane (`speakText` → `/api/voice/tts`). Because there is no per-session tool snapshot, a tool enabled mid-conversation is usable on the next voice turn. The legacy in-browser-brain path (Realtime reasons + calls `getVoiceToolsForRealtime()` tools + speaks, via `lib/voice/tools.js` → `relayRealtimeToolCall`) still exists for rollback behind `localStorage madarx:voice-brain='realtime'` (`mode:'realtime'` on mint). Voice approvals surface in the chat panel; the voice orb says "needs your approval" and pauses. Realtime ephemeral client secrets are returned to the browser but never persisted; the long-lived OpenAI key never crosses to the browser. UI: `app/components/dashboard/voice-panel.jsx` + `voice-orb.jsx` + `use-realtime-voice.js` (the `transport` flag + `onUserUtterance` callback drive the unified loop). Brand: Onyx surface, Bone/Graphite text, Mars Red only on active speech peaks + approval banners. Operator guide: `docs/voice/jarvis.md`. `cli-printing-press` documented as a deferred external companion in `docs/integrations/cli-printing-press.md`.
 
 ## WhatsApp gateway
 
@@ -64,6 +66,12 @@ Provider abstraction lives in `lib/voice/providers.js`. Lanes: `realtime` (prima
 
 `lib/agent-engines.js` defines five engines: `claude-code` (**default**), `anthropic` (madarx tool marketplace via the Anthropic Messages API — required for `create_artifact`, `generate_ui`, `whatsapp_send`, `competitor_report`, `marketing_plan` which do NOT exist on the CC path), `ollama`, `codex`, `hermes`. `claude-code` agents spawn the local CC CLI per run via `runClaudeCodeAgent` with `--permission-mode bypassPermissions --setting-sources project,local,user --max-turns 30 --add-dir workspace --add-dir data` (matches the pattern OpenClaw's `extensions/anthropic/cli-backend.ts` uses). `bypassPermissions` skips per-call confirmation prompts so multi-step agentic work runs uninterrupted; **the `deny` list in `.claude/settings.json` is the load-bearing safety boundary** — it hard-blocks `sudo`, `rm -rf/-r/-f`, `git reset --hard`, force-push, `git clean -fd`, package-manager installs/publishes, outbound network from shell (`curl`/`wget`/`nc`/`ssh`/`scp`), database CLIs (`psql`/`mysql`/`redis-cli`), filesystem ops (`dd`/`mkfs`/`fdisk`), service control (`systemctl`/`launchctl`), reads of `.env*` / `data/whatsapp/session/` / `~/.ssh` / `~/.aws` / `/etc`, and writes to `.git/`, `node_modules/`, `data/madarx.sqlite`, `.claude/`. The allow list pre-approves read-only tools (Read/Glob/Grep/LS), Web (WebSearch/WebFetch), edits inside `workspace/`, and a curated Bash safelist (git status/log/diff, ls/cat/head/tail/wc, jq, mkdir/touch/cp/mv inside `workspace/`). Extend in `.claude/settings.json` (shared) or `.claude/settings.local.json` (personal, gitignored). Override the spawn timeout via `CLAUDE_CODE_TICK_TIMEOUT_MS` (default 600000) and max turns via `CLAUDE_CODE_MAX_TURNS` (default 30).
 
+**Live verbose streaming (engine-agnostic).** When the main agent answers in chat, madarX surfaces the engine's work in real time — token-by-token text, the model's reasoning ("thinking"), and rich tool detail (full input + output preview + elapsed ms). One knob governs every engine: `MADARX_CC_STREAM_VERBOSITY` = `quiet` | `thinking` (default) | `full` (`lib/engine-verbosity.js`). Mechanics by engine:
+- **`claude-code`** — `runClaudeCodeAgent` adds `--include-partial-messages` (capability-probed once via `claude --help`; older CLIs degrade to chunked complete-message streaming) so the stream-json parser (`makeStreamJsonParser`) emits `stream_event` text/thinking deltas. Best-effort thinking via the `MAX_THINKING_TOKENS` subprocess env.
+- **`anthropic`** — the orchestrator loop enables extended thinking on thinking-capable models (`modelSupportsThinking` allowlist: sonnet-4/opus-4/haiku-4/3.7-sonnet) with budget `MADARX_THINKING_BUDGET_TOKENS` (default 4000); `thinking`/`redacted_thinking` blocks (with signatures) are preserved in the assistant turn so tool-use follow-ups validate. Thinking is streamed but never persisted to chat history or saved artifacts.
+- **`ollama`** — streams NDJSON tokens; reasoning when `MADARX_OLLAMA_THINK=1` (opt-in; `think:true` errors on some models). The fabrication guard still runs on the full output before persistence.
+- **SSE events** — `cli_thinking` (accumulated reasoning), `cli_status` (`starting`/`working`+`elapsedMs`/`thinking`/`generating`/`done` cold-start + heartbeat), enriched `tool_result` (`durationMs`, output `preview`/`lines`). Client: `use-stream-command.js` → `ThinkingDisclosure` collapsible panel + per-step duration/preview in `chat-panel.jsx`. Set `MADARX_CC_FORCE_PARTIAL=0/1` to override the CC capability probe.
+
 **Tool-loop capability + no-fabrication guarantee.** Only `anthropic` runs the GOVERNED madarX tool loop (`generateTickOutput`: `chatWithClaude` + `executeRegistryTool` with gates/allowlists/audit). `claude-code`/`codex` run their own native CLI tool runtimes (real, but not the madarX toolset). `ollama`/`hermes` complete text single-shot with **no tool dispatch at all** — a Hermes/Nous-template model "satisfies" a tool task by role-playing the whole loop, emitting `<tool_call>`/`<tool_response>` with **invented results** in plain text. Two layers stop that fiction ever reaching the user as a real result:
 - **Layer A (`lib/engine-capabilities.js::assertRunnable`)** — runs in `agent-runner.js` before the engine ternary. A tool-needing agent (≥1 enabled tool) on a non-tool-executing engine (`ollama`/`hermes`) throws `engine_cannot_run_tools` → recorded as a FAILED run with remediation, never a fabricated "complete" deliverable. Tool-less agents run single-shot on any engine.
 - **Layer B (`lib/fabricated-tool-output.js::looksFabricatedToolTranscript`)** — backstop after output. When `toolEvents.length === 0` and the output is a fabricated tool transcript, the run throws `fabricated_tool_output` (no artifact written). The detector strips fenced/inline code first so genuine reports *quoting* `<tool_call>` are not false-positives.

package/app/agents/agent-events-bus.js

@@ -4,7 +4,17 @@
 // browser tab, regardless of how many agents are on screen — important
 // because the server caps subscribers per process.
 
-const EVENT_TYPES = ['agent_created', 'agent_run_start', 'agent_run_complete'];
+// Tool-level events (agent_tool_start / agent_tool_result) ride the same
+// connection so the global topbar can show *what* a background agent is doing,
+// not just that something is running. Existing subscribers filter by
+// event.type, so the extra types are inert for them.
+const EVENT_TYPES = [
+  'agent_created',
+  'agent_run_start',
+  'agent_run_complete',
+  'agent_tool_start',
+  'agent_tool_result',
+];
 
 let source = null;
 const subscribers = new Set();

package/app/api/connections/[service]/verify/route.js

@@ -166,11 +166,39 @@ async function verifyGithub(creds) {
     if (!res.ok) return { ok: false, reason: 'invalid_key' };
     const data = await res.json().catch(() => ({}));
     const login = typeof data?.login === 'string' ? data.login : null;
+
+    // Probe real reach: does the token see any repos beyond the owner's own?
+    // A token that authenticates fine but was never granted org/collaborator
+    // repos is the #1 "connected but can't read the repo" confusion — surface
+    // it as a non-blocking warning rather than silently reporting success.
+    let reach = null;
+    try {
+      const probe = wrapFetch('connection.verify.github.reach', null, fetch);
+      const pr = await probe(
+        'https://api.github.com/user/repos?per_page=1&affiliation=collaborator,organization_member',
+        { method: 'GET', headers: {
+          authorization: `Bearer ${token}`,
+          accept: 'application/vnd.github+json',
+          'x-github-api-version': '2022-11-28',
+          'user-agent': 'madarx-os',
+        } },
+      );
+      if (pr.ok) {
+        const arr = await pr.json().catch(() => []);
+        reach = Array.isArray(arr) && arr.length > 0 ? 'org_or_collaborator' : 'owner_only';
+      }
+    } catch {
+      // best-effort — never fail verify on the reach probe
+    }
+
     return {
       ok: true,
       account_label: login ? `@${login}` : 'GitHub',
       last_4: fingerprintLast4(token),
-      summary: { login },
+      summary: { login, repo_reach: reach },
+      warning: reach === 'owner_only'
+        ? { field: 'GITHUB_TOKEN', reason: 'owner_only_access' }
+        : null,
     };
   } catch {
     return { ok: false, reason: 'network' };

package/app/api/fs/pick-folder/route.js

@@ -2,9 +2,9 @@ import { spawn } from 'node:child_process';
 import os from 'node:os';
 import fs from 'node:fs';
 import path from 'node:path';
-import { requireFreshMembership, requireSession } from '@/lib/auth.js';
-import { requireRole } from '@/lib/authz.js';
-import { approveMinesImportRoot } from '@/lib/mines/import-roots.js';
+import { requireFreshMembership, requireSession } from '../../../../lib/auth.js';
+import { assertPickFolderRole } from '../../../../lib/pick-folder-authz.js';
+import { approveMinesImportRoot } from '../../../../lib/mines/import-roots.js';
 
 export const dynamic = 'force-dynamic';
 export const runtime = 'nodejs';
@@ -30,10 +30,10 @@ function appleScriptString(value) {
   return String(value || '').replace(/\\/g, '\\\\').replace(/"/g, '\\"');
 }
 
-async function requireAdmin(request) {
+async function authenticatePicker(request, registerImportRoot) {
   const session = await requireSession(request);
   await requireFreshMembership(session, session.org_id);
-  requireRole(session, 'admin', session.org_id);
+  assertPickFolderRole(session, registerImportRoot);
   return session;
 }
 
@@ -45,18 +45,20 @@ function authError(err) {
 }
 
 export async function POST(request) {
+  // Parse the body first so the auth gate knows whether this is a privileged
+  // import-root registration (admin-only) or a plain folder pick (any session).
+  const body = await request.json().catch(() => ({}));
+  const title = String(body.title || 'Select a folder').replace(/["\\]/g, '');
+  const startPath = String(body.start_path || os.homedir() || '/').trim();
+  const registerImportRoot = Boolean(body.register_import_root);
+
   let session;
   try {
-    session = await requireAdmin(request);
+    session = await authenticatePicker(request, registerImportRoot);
   } catch (err) {
     return authError(err);
   }
 
-  const body = await request.json().catch(() => ({}));
-  const title = String(body.title || 'Select a folder').replace(/["\\]/g, '');
-  const startPath = String(body.start_path || os.homedir() || '/').trim();
-  const registerImportRoot = Boolean(body.register_import_root);
-
   try {
     let picked;
     if (process.platform === 'darwin') {

package/app/api/orchestrator/stream/route.js

@@ -6,6 +6,7 @@ import { getSystemPrompt, getModel, getModels, currentDateInstruction } from '@/
 import { brandInstructionText } from '@/lib/brand.js';
 import { agentMemoryContext } from '@/lib/agent-memory-context.js';
 import { runOllamaAgent, runClaudeCodeAgent, runCodexAgent } from '@/lib/agent-engines.js';
+import { thinkingBudgetTokens, getStreamVerbosity } from '@/lib/engine-verbosity.js';
 import {
   createChatSession,
   appendChatMessage,
@@ -510,7 +511,21 @@ export async function POST(req) {
           : baseUserContent) + attachmentPromptText;
 
         if (activeEngine === 'ollama') {
-          const output = await runOllamaAgent({ model: activeModel, systemPrompt, userMessage: userContent, maxTokens: 2048 });
+          emit('cli_status', { phase: 'starting', engine: 'ollama' });
+          // Stream tokens (and reasoning, on models that support it) for a live
+          // preview. The full output is still returned so the fabrication guard
+          // below runs on the complete text before anything is persisted.
+          const output = await runOllamaAgent({
+            model: activeModel,
+            systemPrompt,
+            userMessage: userContent,
+            maxTokens: 2048,
+            onChunk: (_piece, full) => {
+              const disp = full.replace(/```madarx-action[\s\S]*?```/gi, '').replace(/```madarx-action[\s\S]*$/i, '').trim();
+              if (disp) emit('cli_stream', { text: disp });
+            },
+            onThinking: (full) => { if (full) emit('cli_thinking', { text: full }); },
+          });
           // Ollama runs single-shot with NO madarX tool loop. A Hermes/Nous-template model
           // satisfies a tool task by role-playing the whole loop — emitting <tool_call> and a
           // fabricated <tool_response> in plain text. Never save that fiction as an artifact.
@@ -550,14 +565,36 @@ export async function POST(req) {
             if (displayText) emit('cli_stream', { text: displayText });
           };
           const ccOnAssistantText = (text) => {
-            const displayText = text.replace(/```madarx-action[\s\S]*?```/gi, '').trim();
-            if (displayText) emit('cli_stream', { text: displayText });
+            // Strip from the chat preview: (a) madarx-action blocks (complete +
+            // in-progress trailing fence) so half-streamed JSON never flashes, and
+            // (b) the HTML artifact body — it renders on the canvas, not as raw
+            // markup typing into the chat bubble. Also drops the huge re-sent HTML
+            // from every SSE tick. `building` tells the client to show a tasteful
+            // "designing the page…" placeholder when the turn is artifact-only.
+            const hadHtml = /```html|<!doctype html|<html[\s>]/i.test(text);
+            const displayText = text
+              .replace(/```madarx-action[\s\S]*?```/gi, '')
+              .replace(/```madarx-action[\s\S]*$/i, '')
+              .replace(/```html[\s\S]*?```/gi, '')
+              .replace(/```html[\s\S]*$/i, '')
+              .replace(/<!doctype html[\s\S]*$/i, '')
+              .replace(/<html[\s>][\s\S]*$/i, '')
+              .trim();
+            if (displayText || hadHtml) {
+              emit('cli_stream', { text: displayText, building: hadHtml && !displayText });
+            }
+          };
+          const ccOnThinking = (text) => {
+            if (text) emit('cli_thinking', { text });
+          };
+          const ccOnStatus = (phase) => {
+            emit('cli_status', { phase, engine: activeEngine });
           };
           const ccOnToolStart = ({ name, input }) => {
             emit('tool_start', { name, input });
           };
-          const ccOnToolResult = ({ name, isError }) => {
-            emit('tool_result', { name, output: { ok: !isError }, isError: Boolean(isError) });
+          const ccOnToolResult = ({ name, isError, durationMs, preview, lines, chars }) => {
+            emit('tool_result', { name, output: { ok: !isError, preview, lines, chars }, isError: Boolean(isError), durationMs });
           };
           const invokeCli = (userMessage) => activeEngine === 'claude-code'
             ? runClaudeCodeAgent({
@@ -566,13 +603,28 @@ export async function POST(req) {
                 allowedTools: [],
                 maxTurns: 5,
                 timeoutMs: Number(process.env.CLAUDE_CODE_CHAT_TIMEOUT_MS || 600000),
+                verbosity: getStreamVerbosity(),
                 onAssistantText: ccOnAssistantText,
+                onThinking: ccOnThinking,
+                onStatus: ccOnStatus,
                 onToolStart: ccOnToolStart,
                 onToolResult: ccOnToolResult,
               })
             : runCodexAgent({ systemPrompt, userMessage, onChunk: codexOnChunk });
+          // Heartbeat wrapper: the CLI can sit silent for seconds booting or inside
+          // a slow tool. Emit an elapsed status tick around each invocation so the
+          // user always sees it's alive, and clear it the instant the call returns.
+          const invokeCliWithHeartbeat = async (userMessage) => {
+            const startedAt = Date.now();
+            emit('cli_status', { phase: 'starting', engine: activeEngine });
+            const hb = setInterval(() => {
+              emit('cli_status', { phase: 'working', engine: activeEngine, elapsedMs: Date.now() - startedAt });
+            }, 3000);
+            try { return await invokeCli(userMessage); }
+            finally { clearInterval(hb); emit('cli_status', { phase: 'done', engine: activeEngine }); }
+          };
           try {
-            raw = await invokeCli(cliUserContent);
+            raw = await invokeCliWithHeartbeat(cliUserContent);
             emit('tool_result', { name: cliLabel, output: { ok: true }, isError: false });
           } catch (cliErr) {
             emit('tool_result', { name: cliLabel, output: { error: cliErr.message }, isError: true });
@@ -607,7 +659,7 @@ export async function POST(req) {
             emit('cli_stream', { text: 'No action ran on the first pass — retrying…' });
             let retryRaw = null;
             try {
-              retryRaw = await invokeCli(nudge);
+              retryRaw = await invokeCliWithHeartbeat(nudge);
             } catch (retryErr) {
               if (process.env.MADARX_DEBUG) console.error('[madarx] intent-nudge retry failed:', retryErr.message);
             }
@@ -909,6 +961,9 @@ Rules (non-negotiable):
         }
         let iterations = 0;
         const MAX_TURNS = 8;
+        // Extended-thinking budget for the Anthropic loop. Verbosity-gated and
+        // only applied to thinking-capable models (streamChatWithClaude guards).
+        const anthropicThinkingBudget = thinkingBudgetTokens();
         let artifactCreated = false;
         let totalAgentText = '';
         let totalInputTokens = 0;
@@ -924,7 +979,8 @@ Rules (non-negotiable):
             currentMessages,
             systemPrompt,
             getTools(),
-            loopModel
+            loopModel,
+            { thinkingBudget: anthropicThinkingBudget }
           );
 
           let textBuffer = '';
@@ -936,6 +992,13 @@ Rules (non-negotiable):
           let turnOutputTokens = 0;
           let turnCacheReadTokens = 0;
           let turnCacheCreationTokens = 0;
+          // Extended-thinking capture. Thinking/redacted_thinking blocks must be
+          // preserved (with their signatures) and replayed in the assistant turn
+          // when tool_use is present, or the API rejects the next request. They
+          // also drive the live "Thinking…" surface via the cli_thinking event.
+          let thinkingBlocks = [];
+          let currentThinking = null;
+          let thinkingLive = '';
 
           // Stream events from the Anthropic SDK stream object
           for await (const event of claudeStream) {
@@ -952,6 +1015,12 @@ Rules (non-negotiable):
                   input: {},
                 };
                 inputJsonBuffer = '';
+              } else if (event.content_block.type === 'thinking') {
+                currentThinking = { type: 'thinking', thinking: '', signature: '' };
+                emit('cli_status', { phase: 'thinking', engine: activeEngine });
+              } else if (event.content_block.type === 'redacted_thinking') {
+                // No deltas — the encrypted payload arrives whole. Preserve it for replay.
+                thinkingBlocks.push({ type: 'redacted_thinking', data: event.content_block.data });
               }
             } else if (event.type === 'content_block_delta') {
               if (event.delta.type === 'text_delta') {
@@ -959,6 +1028,12 @@ Rules (non-negotiable):
                 emit('text', { delta: event.delta.text });
               } else if (event.delta.type === 'input_json_delta') {
                 inputJsonBuffer += event.delta.partial_json;
+              } else if (event.delta.type === 'thinking_delta' && currentThinking) {
+                currentThinking.thinking += event.delta.thinking;
+                thinkingLive += event.delta.thinking;
+                emit('cli_thinking', { text: thinkingLive });
+              } else if (event.delta.type === 'signature_delta' && currentThinking) {
+                currentThinking.signature += event.delta.signature;
               }
             } else if (event.type === 'content_block_stop') {
               if (currentToolBlock) {
@@ -970,6 +1045,9 @@ Rules (non-negotiable):
                 toolUseBlocks.push(currentToolBlock);
                 currentToolBlock = null;
                 inputJsonBuffer = '';
+              } else if (currentThinking) {
+                thinkingBlocks.push(currentThinking);
+                currentThinking = null;
               }
             } else if (event.type === 'message_delta') {
               if (event.delta.stop_reason) stopReason = event.delta.stop_reason;
@@ -991,8 +1069,13 @@ Rules (non-negotiable):
             context: lastContextTokens,
           });
 
-          // Build the assistant message for the agentic loop
+          // Build the assistant message for the agentic loop. Thinking blocks
+          // come FIRST (the API requires them ahead of text/tool_use, with their
+          // signatures intact) so the next turn carrying tool_results validates.
           const assistantContent = [];
+          if (stopReason === 'tool_use') {
+            for (const tb of thinkingBlocks) assistantContent.push(tb);
+          }
           if (textBuffer) {
             assistantContent.push({ type: 'text', text: textBuffer });
           }

package/app/api/voice/realtime/session/route.js

@@ -37,6 +37,10 @@ export async function POST(request) {
         ? body.instructions
         : undefined,
       tools: Array.isArray(body?.tools) ? body.tools : undefined,
+      // 'transport' = STT-only (orchestrator is the brain); 'realtime' = proven
+      // in-browser brain. Default to realtime; transport is opt-in until the
+      // GA session shape is verified against a live mic.
+      mode: body?.mode === 'transport' ? 'transport' : 'realtime',
       project_id: body?.project_id || null,
       agent_id: body?.agent_id || 'main',
       active_space: body?.active_space || null,