madarx 2.17.0 → 2.19.0

package/.next/static/sO4ApzzsDEnqk70DEBOS6/_buildManifest.js

@@ -0,0 +1 @@
+self.__BUILD_MANIFEST=function(e,r,t,_){return{__rewrites:{afterFiles:[],beforeFiles:[],fallback:[]},__routerFilterStatic:{numItems:144,errorRate:1e-4,numBits:2761,numHashes:14,bitArray:[0,0,r,r,1,r,r,r,r,1,e,e,e,r,e,r,r,e,r,r,r,r,r,e,e,r,r,e,e,e,e,r,r,e,e,e,r,r,e,e,e,e,r,r,r,e,r,e,e,e,r,r,e,r,e,e,r,e,e,e,e,e,e,r,r,e,e,r,e,r,r,e,e,r,r,e,e,e,r,r,r,e,r,e,e,e,r,r,e,e,r,e,e,e,e,r,e,r,r,r,r,e,e,r,r,r,r,r,e,r,e,r,e,r,e,r,e,e,r,e,e,e,e,e,r,e,e,e,e,r,r,e,e,e,e,e,e,r,r,r,e,r,e,r,e,r,e,r,e,r,r,e,e,e,r,r,r,e,e,r,e,e,r,e,r,r,r,r,e,r,r,r,e,e,r,e,e,r,r,r,r,r,e,e,e,r,e,e,r,r,r,e,e,r,r,r,e,e,e,e,r,e,e,r,r,e,r,r,e,e,r,r,e,e,r,r,r,r,e,e,e,e,r,r,e,e,e,e,r,e,e,e,e,r,e,e,e,e,e,e,r,r,r,e,e,r,r,r,r,r,r,r,e,e,r,e,r,r,e,r,r,e,r,r,e,e,e,r,e,e,e,r,e,e,r,e,e,e,r,r,r,r,e,e,r,r,e,e,e,e,r,e,e,e,e,r,e,r,r,r,r,r,r,e,r,e,r,e,e,e,e,e,e,e,r,e,r,r,e,e,r,e,r,r,e,e,e,e,e,e,r,r,r,e,r,r,e,e,r,e,r,r,e,r,r,r,e,e,r,r,e,e,r,r,e,e,r,r,e,r,e,e,e,r,e,r,e,e,r,e,r,r,e,r,r,r,r,r,e,r,e,e,r,r,r,e,r,r,r,r,e,r,r,r,e,e,r,r,e,e,r,r,e,e,e,r,r,r,r,r,e,e,r,e,e,e,e,r,e,e,r,e,r,e,e,r,r,e,e,r,e,r,r,e,e,r,e,e,r,r,r,r,r,e,e,e,e,e,r,r,e,e,e,e,e,r,e,e,e,e,e,r,e,e,r,r,e,e,e,e,e,r,e,e,e,e,e,e,e,e,e,r,r,e,r,e,r,e,r,r,r,e,e,r,r,e,r,r,r,r,r,e,e,e,r,r,r,e,e,r,e,e,r,r,e,r,r,e,e,r,e,r,e,e,e,r,e,r,r,r,e,r,e,r,r,e,e,r,e,e,r,r,e,r,e,e,e,r,r,e,e,r,r,r,r,e,e,e,e,e,r,e,e,r,r,e,r,r,r,e,r,e,e,e,r,e,e,e,e,e,r,e,r,r,r,e,r,r,r,r,e,r,r,r,r,e,r,e,r,r,e,e,r,r,r,r,r,r,e,r,r,r,e,e,e,e,r,e,r,e,e,e,e,e,r,e,e,r,r,e,e,r,r,r,e,r,r,r,e,e,r,r,e,e,e,r,r,e,e,r,e,e,e,r,r,r,e,e,r,r,e,r,r,e,e,r,e,r,r,r,r,r,e,e,e,e,r,r,e,r,r,r,r,r,r,r,r,r,e,r,r,e,e,e,r,r,e,r,e,e,e,e,e,e,e,e,e,e,e,r,r,r,r,r,r,e,e,e,e,r,e,r,r,e,e,e,r,r,r,e,r,e,r,r,e,r,r,r,e,r,e,e,r,e,e,e,e,e,e,e,r,e,r,e,r,e,r,r,r,r,r,r,e,e,r,e,r,e,r,r,e,e,r,r,e,r,e,e,r,e,e,r,r,r,e,r,e,e,e,r,e,r,r,r,e,e,e,r,e,r,e,r,r,r,e,e,e,e,r,e,e,e,r,e,e,r,r,e,e,r,e,e,e,r,r,r,r,r,e,r,e,r,e,r,e,r,r,r,e,e,e,r,e,r,e,r,r,e,r,r,e,e,e,e,r,e,e,e,e,e,e,e,e,r,r,r,r,e,e,e,e,r,e,r,r,e,r,e,e,e,e,r,e,e,e,r,r,r,r,e,r,r,r,r,r,e,r,r,r,e,r,e,e,r,r,r,e,r,r,r,r,e,r,e,e,r,r,r,e,e,r,r,r,r,e,e,r,r,r,e,e,r,e,e,e,r,r,r,e,r,r,e,r,e,r,r,r,r,e,r,r,e,e,r,e,r,e,e,e,e,r,e,e,r,e,e,r,r,e,e,e,r,e,e,e,e,e,e,e,r,r,r,r,e,r,r,r,r,e,r,r,e,r,r,r,e,r,e,r,e,e,e,r,r,e,e,r,r,r,r,r,e,r,e,e,e,e,r,e,e,e,r,e,e,r,r,r,e,r,r,r,e,r,r,e,r,r,r,r,r,r,e,r,e,e,e,r,r,e,e,e,r,r,e,e,e,e,e,e,r,e,e,r,r,r,e,e,e,e,e,r,r,e,r,r,r,r,r,e,e,r,e,r,e,r,r,e,r,r,r,r,e,e,e,r,e,e,e,e,r,r,e,e,r,e,e,e,e,r,e,e,r,r,r,e,e,e,r,r,r,r,e,r,r,e,r,e,r,e,r,e,e,r,e,e,r,e,e,r,r,r,r,e,e,e,r,r,r,e,r,r,e,r,r,e,r,e,r,e,e,r,e,r,e,e,r,r,r,e,r,r,r,e,e,e,r,e,r,r,e,r,r,r,r,r,e,r,e,e,e,e,e,e,e,e,e,r,e,e,r,e,r,r,r,e,e,e,r,e,r,r,e,e,e,r,r,r,e,e,r,e,r,e,e,r,r,e,e,r,e,r,e,e,r,e,e,e,e,e,e,e,e,r,r,r,e,r,r,e,r,e,r,r,r,r,r,r,e,r,e,r,r,e,r,e,e,r,e,e,e,e,e,r,r,r,e,r,e,r,e,r,r,r,e,e,e,r,e,e,e,r,r,r,r,r,e,e,e,r,e,e,e,e,r,e,e,r,e,r,r,e,e,e,r,e,e,e,e,r,r,e,r,r,r,r,r,e,e,e,e,e,r,e,e,e,e,r,e,e,r,r,e,r,e,r,e,r,e,e,r,r,r,e,e,r,r,r,e,r,e,e,r,r,r,e,e,e,e,r,r,e,r,e,r,e,r,e,r,e,r,r,r,e,e,r,e,e,e,e,e,r,r,e,r,r,r,e,r,r,e,r,r,r,r,r,e,r,e,r,e,r,r,r,e,r,r,e,r,e,r,e,e,r,e,e,r,e,r,r,r,e,r,r,e,e,e,r,r,e,e,e,e,r,r,r,e,r,e,e,e,e,e,e,e,r,r,r,e,e,e,r,e,e,e,e,r,e,e,e,e,r,e,e,e,r,r,r,r,r,e,e,e,r,r,e,r,r,r,e,e,r,r,r,e,r,r,e,e,e,r,e,e,e,r,r,r,e,e,r,e,e,e,e,e,r,r,r,e,r,e,e,r,r,e,r,e,r,r,r,r,e,r,e,r,r,e,e,e,e,r,r,e,r,r,e,e,e,r,r,r,e,r,e,e,e,e,e,r,r,r,r,e,e,e,e,e,r,r,e,e,e,r,e,r,e,e,e,r,e,e,e,e,r,e,e,e,e,r,r,r,e,r,r,r,r,e,e,e,e,r,e,e,r,e,r,r,r,e,e,r,e,e,e,r,e,e,r,r,r,r,e,r,e,r,e,e,r,e,r,r,e,e,r,e,e,r,r,r,e,r,r,e,e,r,e,r,e,e,e,e,e,r,e,e,e,e,r,r,r,r,e,e,e,e,r,r,e,e,r,r,e,e,r,e,r,e,e,e,r,r,e,e,r,r,e,e,e,e,e,r,r,e,e,e,r,r,r,r,e,e,e,r,r,e,e,r,r,e,e,e,r,r,r,r,r,r,e,e,r,r,r,e,e,r,r,r,e,r,r,r,e,r,r,r,e,r,r,e,e,e,r,r,e,e,e,r,e,e,e,r,r,e,r,e,r,r,r,e,e,r,r,e,r,r,r,e,r,r,e,e,e,r,r,r,r,e,r,r,r,e,e,r,r,r,r,r,e,r,r,e,r,e,e,e,r,e,e,e,r,r,e,r,r,r,e,r,e,r,r,e,r,e,r,r,e,r,e,r,r,e,e,r,e,e,r,e,e,e,e,r,e,r,r,r,r,e,r,e,e,e,e,e,e,r,e,e,r,e,e,r,e,e,e,e,r,r,r,e,e,e,r,e,e,e,e,e,r,r,e,r,r,e,e,r,r,r,e,r,r,r,e,e,e,e,r,r,r,r,r,e,r,r,e,e,r,e,e,e,r,e,e,e,r,r,r,e,e,e,e,r,e,e,e,r,r,e,e,e,e,r,r,e,r,r,r,r,e,r,e,e,r,e,e,e,r,e,e,r,e,e,e,e,r,e,r,e,r,r,e,e,e,r,r,e,e,r,r,r,e,e,e,r,e,e,e,e,r,r,e,e,e,e,e,e,e,e,e,r,r,e,r,e,e,e,e,e,e,r,r,r,r,r,r,e,r,e,e,r,e,r,r,e,r,r,e,e,e,r,e,r,e,e,e,r,e,r,r,e,e,e,e,e,r,r,e,r,r,r,e,e,e,r,e,e,r,r,e,e,e,r,e,e,e,e,r,r,r,r,r,e,e,r,e,e,e,r,e,e,r,r,e,e,r,e,r,e,r,r,e,r,r,e,e,e,e,r,e,r,e,r,e,e,r,r,r,e,e,e,e,r,e,e,e,e,e,e,r,r,e,r,r,e,e,r,r,r,r,e,r,r,r,r,r,e,e,e,r,e,r,r,r,e,r,r,r,e,e,r,r,e,r,e,e,r,r,r,r,e,r,r,r,e,r,e,r,e,r,r,e,e,e,e,r,e,r,r,r,e,r,e,e,r,r,e,e,r,r,e,e,r,r,e,r,r,e,e,e,e,e,r,r,e,r,r,r,r,e,e,r,r,e,r,r,e,r,e,e,e,e,r,r,r,r,e,e,e,r,r,e,e,r,r,r,e,e,e,e,r,e,e,r,e,r,r,r,r,e,e,e,r,e,e,e,e,e,r,e,e,e,e,e,e,r,e,e,e,r,r,r,e,r,r,r,r,e,e,r,r,e,r,e,e,r,e,e,r,e,e,e,r,r,e,e,r,e,r,r,e,e,e,r,r,r,e,e,r,r,r,e,r,e,e,r,e,r,e,r,e,e,e,e,e,r,e,e,r,e,r,e,e,r,r,r,r,r,e,e,e,r,e,r,r,r,e,r,r,r,e,r,r,e,r,r,e,e,e,r,r,r,e,r,e,e,e,e,e,r,r,r,e,e,r,r,e,r,e,r,r,r,r,r,r,e,r,r,r,e,r,e,e,r,r,r,e,r,e,r,e,r,e,e,r,e,e,r,r,r,e,e,e,e,r,r,r,r,r,e,e,r,e,r,r,e,r,r,e,r,r,e,r,r,e,r,r,e,r,e,r,e,e,e,r,r,r,e,r,e,e,r,r,r,e,e,r,e,r,e,e,r,e,r,e,e,r,r,e,r,r,e,e,r,r,r,e,e,r,e,e,e,r,e,e,r,e,e,e,r,r,e,e,e,r,e,r,e,e,r,r,r,e,e,r,e,e,e,r,r,r,e,e,r,r,e,r,e,e,e,r,e,r,e,r,e,e,r,e,r,e,e,r,r,e,e,e,r,r,r,r,r,e,r,e,e,e,e,e,r,r,e,r,r,e,e,r,r,r,r,r,r,e,r,e,e,r,e,e,e,e,r,e,e,e,e,r,e,r,e,e,r,e,e,e,r,e,e,r,r,e,e,e,e,e,e,e,e,r,r,e,e,e,r,e,r,e,r,e,r,r,r,e,r,r,r,e,r,r,e,r,e,e,r,r,e,e,r,e,e,r,e,e,r,e,r,r,r,e,e,e,r,e,r,r,r,r,r,e,r,r,e,r,e,e,r,r,r,r,e,r,e,r,r,r,e,r,r,r,r,r,e,e,e,r,r,e,r,e,r,e,r,e,r,r,e,e,r,r,r,r,e,e,e,r,r,e,r,r,r,e,e,e,r,e,r,r,e,r,e,e,r,r,r,r,r,r,r,e,e,e,e,e,e,e,e,e,r,e,e,e,r,r,e,r,e,r,e,r,r,r,r,r,e,r,r,e,r,r,e,e,r,r,e,e,e,e,r,e,e,e,r,e,r,e,e,r,e,e,r,r,e,e,e,r,e,r,e,e,e,e,r,r,r]},__routerFilterDynamic:{numItems:39,errorRate:1e-4,numBits:748,numHashes:14,bitArray:[r,e,r,r,e,e,e,e,r,r,r,e,r,r,e,r,e,r,e,r,e,e,r,e,e,r,e,e,e,e,r,r,e,r,e,r,e,r,e,r,e,e,e,r,r,r,r,r,e,r,r,r,e,e,r,e,e,r,r,r,r,r,e,e,r,r,r,e,e,r,r,e,r,e,e,r,r,e,r,e,e,e,e,e,e,r,e,e,r,r,r,e,e,e,r,e,r,e,r,r,e,r,e,r,e,e,e,r,e,e,e,e,r,r,e,e,r,r,e,r,r,r,r,e,e,r,e,e,e,r,e,e,e,r,r,r,r,r,e,r,r,r,r,e,r,e,e,r,r,e,e,r,e,r,e,r,r,r,r,r,e,r,r,e,r,e,r,r,e,r,r,e,e,e,e,e,r,r,r,e,r,r,e,e,r,r,e,e,e,r,r,e,r,e,e,e,r,r,e,e,r,e,r,r,e,r,e,e,e,e,e,r,r,r,e,r,r,r,e,r,e,e,e,r,e,e,e,e,r,e,r,e,e,r,e,e,r,e,e,r,r,r,r,e,e,r,e,r,r,r,e,e,r,r,r,r,e,e,r,r,e,r,r,r,e,e,e,r,r,e,e,r,e,e,e,e,e,e,e,r,r,e,r,e,r,e,e,r,r,r,r,r,r,r,e,r,r,e,r,r,e,r,e,e,r,e,e,e,e,r,r,e,r,e,e,r,r,r,e,e,e,r,e,e,r,r,e,r,e,r,r,r,r,r,r,e,r,e,e,e,r,r,e,r,e,r,r,e,r,e,r,e,e,e,r,e,e,r,r,r,r,r,r,r,r,e,e,e,e,r,r,e,r,e,e,r,r,e,e,r,e,e,r,e,e,e,e,e,e,e,r,r,e,e,e,r,r,e,e,r,r,e,e,r,r,r,r,r,r,r,r,e,e,r,r,r,e,e,r,r,e,e,e,e,r,r,e,r,r,r,r,r,r,e,r,e,r,e,e,e,e,e,e,r,e,r,r,e,r,r,e,e,r,e,e,r,e,e,r,r,r,r,e,r,r,e,r,r,r,e,e,e,e,r,e,e,e,e,r,r,r,r,r,e,e,e,r,e,e,e,e,r,r,e,r,r,r,e,r,r,e,e,r,r,r,e,e,e,r,r,r,e,r,e,r,r,e,r,e,e,e,e,e,r,r,e,r,r,e,r,e,r,e,r,e,r,e,r,r,r,e,r,e,e,r,r,e,e,r,r,e,e,e,e,r,r,r,e,r,r,e,e,e,e,e,e,e,r,e,r,e,e,r,e,r,e,r,r,e,r,e,e,e,e,e,e,r,r,e,e,r,r,e,e,e,e,e,e,r,e,r,e,e,r,r,r,r,e,r,e,e,e,e,r,r,r,r,e,e,e,r,e,r,r,r,r,e,e,r,e,r,r,r,e,r,e,e,r,e,r,r,e,e,e,r,r,r,r,e,r,r,r,e,r,e,e,r,e,e,r,e,r,r,r,e,r,r,e,e,e,r,e,r,e,e,e,e,r,e,e,e,e,e,e,e,e,r,e,e,r,r,r,r,e,r,e,e,e,r,r,e,r,e,e,r,e,e,e,e,r,e,r,e,e,r,e,e,e,e,e,r,e,e,e,r,e,r,r,e,r,e,e,e,e,r,r,r,e,e,r,e,e,r,e,r,e,r,r]},"/_error":["static/chunks/pages/_error-c970d8b55ace1b48.js"],sortedPages:["/_app","/_error"]}}(1,0,1e-4,14),self.__BUILD_MANIFEST_CB&&self.__BUILD_MANIFEST_CB();

package/CHANGELOG.md

@@ -4,6 +4,42 @@ All notable changes to Madarx OS. Newest first.
 
 ## Unreleased
 
+## [2.19.0] - 2026-06-06
+
+### Added
+
+- **Chat persistence & live-activity continuity across navigation.** Navigate away from the dashboard during a main-agent turn and come back — the chat now resumes instead of going silent until a manual refresh. Two phases ship together. **Phase 1:** the orchestrator stamps an `active_turn_id` / `active_turn_started_at` on the chat session at turn start and clears it in `finally` (so it self-heals on error/cancel), with a derived `agent_working` flag gated by a TTL (`MADARX_ACTIVE_TURN_TTL_MS`, default 15 min) so a crashed turn reads as idle instead of stuck. On return the UI shows an "Agent still working…" banner and progressively refetches persisted turns — including tool-call steps, which the restore path previously dropped. **Phase 2:** a process-local broadcaster (`lib/orchestrator-broadcast.js`) decouples the running turn from the originating request via a per-session ring buffer (`MADARX_TURN_BUFFER_MAX`, default 1000) retained briefly after completion (`MADARX_TURN_BUFFER_RETENTION_MS`, default 30 s); a new `GET /api/orchestrator/stream/attach?session_id=&from_seq=` replays the buffered tail then tails live, so a returning client resumes token-level output and ends on the same transcript as if it never left. The SSE event handling is extracted into a shared reducer (`app/components/dashboard/apply-stream-event.js`) used by both the live POST stream and the attach reconnect, so behavior stays identical. `chat_turn` events are observation-only (persisted to `activity_log`, never mutate agent/case state) and a per-session attach-subscriber cap (`MADARX_TURN_MAX_SUBSCRIBERS`, default 8) bounds listener growth. Single-process / local-first: on a server restart mid-turn the live buffer is lost, but Phase-1 persistence + the TTL flag are the durable fallback. Spec: `specs/active/chat-persistence-live-continuity.md`. Files: `lib/schema.js`, `lib/db.js`, `lib/runtime.js`, `lib/orchestrator-broadcast.js`, `lib/delegation-contracts.js`, `app/api/orchestrator/stream/route.js`, `app/api/orchestrator/stream/attach/route.js`, `app/components/dashboard/*`. Tests: `tests/chat-continuity.test.js`, `tests/chat-continuity-phase2.test.js`.
+- **Artifact layout & team onboarding.** Improved canvas artifact positioning/ordering (`app/components/dashboard/artifact-board.jsx`, `artifact-order.js`, `use-artifact-layout.js`) with regression coverage in `tests/artifact-layout.test.js`, plus a dedicated team-onboarding flow (`app/onboarding/team/`) and team settings/invite refinements. Adds a cloud-schema export pipeline (`lib/cloud-schema.js`, `scripts/build-cloud-schema.mjs`, `GET /api/cloud/schema`) and a `lib/public-url.js` helper for share/public URL resolution.
+
+### Fixed
+
+- **CLI-install login lockout in supabase mode.** Under `madarx` (separate `~/.madarx` data home, plain `SUPABASE_*` env + vault keys) three gaps stacked into a hard lockout: a correct password sign-in succeeded, then the next page load bounced back to `/login?error=missing_supabase_env`. The middleware auth gate's env fast-path read only `NEXT_PUBLIC_SUPABASE_*`; it now resolves plain `SUPABASE_*` too and defers to the vault-backed `/api/auth/config` (returns null instead of short-circuiting) when a mode is named but creds are absent. Auth-mode drift (stale config-table `local` overriding env) and related resolution gaps closed. New pure, unit-tested `lib/auth-env-fastpath.js::resolveEnvAuthConfig()`. Only reproduced under the CLI install, never under `npm run dev`.
+
+## [2.18.0] - 2026-06-06
+
+### Added
+
+- **Background-agent activity popover in the top toolbar.** The toolbar's "agents running" indicator is now a clickable **Activity** pill that opens a live panel of every background agent the Main Agent spawns — each agent's name, what triggered it, its current tool, and a recent tool-step trail (running / done / error), reusing the chat feed's tool-step icons and sublabels. The detail rides the existing SSE connection: `app/agents/agent-events-bus.js` now also forwards `agent_tool_start` / `agent_tool_result` (existing subscribers filter by `event.type`, so the extra events are inert for them), so no new socket is opened. The popover is portaled to `document.body` at `z-index:9300` so it paints above canvas artifacts (`.artifact-fs` is `9100`) and stays below the search/help overlays (12000+), anchored to the pill via the trigger's viewport rect with outside-click handling across the portal. At idle it shows an empty state describing the feature, so the control is discoverable before any agent runs. Files: `app/components/app-topbar.jsx`, `app/globals.css`.
+- **Live thinking + verbose streaming (engine-agnostic).** The main agent's chat now surfaces the engine's work in real time — token-by-token answer text, the model's reasoning ("thinking") in a collapsible panel, a cold-start / long-tool status heartbeat with elapsed time, and richer tool steps (full input + output preview + duration). One knob governs every engine: `MADARX_CC_STREAM_VERBOSITY` = `quiet` | `thinking` (default) | `full`. `claude-code` adds `--include-partial-messages` (capability-probed via `claude --help`; older CLIs degrade gracefully to chunked streaming) plus a best-effort `MAX_THINKING_TOKENS`; `anthropic` enables extended thinking on thinking-capable models (budget `MADARX_THINKING_BUDGET_TOKENS`, default 4000) with `thinking`/`redacted_thinking` signatures preserved for tool-use turns and never persisted to chat history or artifacts; `ollama` streams NDJSON tokens (reasoning via `MADARX_OLLAMA_THINK=1`). New SSE events `cli_thinking` / `cli_status`. Reference: `ai-docs/key-constraints.md`; spec `specs/active/claude-code-engine-live-thinking-stream.md`.
+- **Voice = the main agent (full tool parity).** The Jarvis voice console now drives the exact same brain, live tool catalog, and gates as typed chat. `lib/voice/tools.js` attaches the full `getTools()` catalog to the Realtime session (advertised list in `lib/voice/context.js` always matches what's attached), so anything the typed agent can do, voice can do. Set `MADARX_VOICE_FAST_TOOLS=1` to trim to a 10-tool conversational subset.
+- **Greeting on connect.** Opening voice greets the operator by name ("Hello, Ak.") — spoken by the Realtime model on data-channel open (legacy brain) or via the TTS lane (transport brain). Name resolves from the signed-in session (`display_name`, else capitalised email local-part).
+- **On-brand voice artifacts.** Voice instructions now mandate that every visual artifact route through `generate_ui` (which composes `DESIGN_RULES + brandInstructionText(getBrandProfile())`), so spoken "make me a page/brief/report" requests render on-brand with no emoji.
+- **Skill bridge (`skill_bridge_run`).** A new, tightly-gated tool that lets the agent (and voice) drive the real **visible** GStack browser by invoking an allowlisted first-party gstack CLI skill (`connect-chrome`, `browse`, `qa-only`) via `runClaudeCodeAgent`. Risk `irreversible_external`, `enabled_default:false`, **always** approval-gated on both the main and agent paths (force-gated alongside `browser_harness_run`), hard kill-switch `MADARX_SKILL_BRIDGE_DISABLED=1`, bounded by the `.claude/settings.json` deny list. `lib/tools/adapters/skill-bridge.js` + `tests/skill-bridge.test.js`. Verified end-to-end: gate → approve → real browser opened https://example.com and read its title.
+- **Transport voice brain (opt-in).** Behind `localStorage madarx:voice-brain='transport'`, Realtime runs STT-only and routes cognition through `/api/orchestrator/stream` (same brain as chat), speaking replies via TTS. Default stays the proven in-browser `realtime` brain.
+
+### Changed
+
+- **Chat hides raw HTML while streaming.** An agent turn that emits a full HTML artifact no longer types raw markup into the chat bubble — the artifact renders on the canvas while a tasteful "Designing the page…" placeholder shows in chat, replaced by the turn's summary on completion. Server-side stripping for the CLI engine also stops re-sending the growing HTML page on every SSE tick; a client-side strip covers Anthropic/Ollama deltas too.
+- **Voice latency tuned the right way.** `session.reasoning.effort='low'` on `gpt-realtime-2` (`lib/realtime-openai.js`, model-guarded; override `OPENAI_REALTIME_REASONING`) is the latency dial instead of hiding tools — keeps first-audio snappy while voice keeps the whole toolset. Researched against the 2026 voice-agent landscape: OpenAI Realtime (speech-to-speech) stays the right provider; TTS-only alternatives would force a slower pipeline.
+
+### Fixed
+
+- **Operator stuck below admin on their own default org (auto-healed on update).** When an install flipped to Supabase auth mode, the seeded `personal-org` was owned by the synthetic `local-user-1`, so the real operator was added as a `member` and the first-login owner-bootstrap was skipped — leaving them permanently below admin (every owner/admin gate, including the folder picker, 403'd). The boot migration (`runAuthV1Migration`, runs idempotently on every start) now self-heals: when the default org has no real owner, it promotes the unambiguous operator to `owner` (the sole real member, or the `MADARX_OWNER_EMAIL` match when several). Conservative — never downgrades, never guesses on an ambiguous shared org. Existing affected installs fix themselves on the next restart after updating. Logic + tests: `scripts/migrate-auth-v1.mjs::healDefaultOrgOwnership`, `tests/default-org-owner-heal.test.js`.
+- **"Choose folder…" returned `insufficient_role` for non-admin users.** The native folder picker (`/api/fs/pick-folder`, used by New/Edit project) required the org `admin` role, so a `member`/`viewer` (e.g. a non-owner user in supabase auth mode) hit a 403 `insufficient_role` and could never select a custom project folder — even though creating the project and creating a folder weren't gated at all. Plain folder selection now only needs an authenticated session (the picker just opens an OS dialog and returns a path; project creation + the disk layer enforce allowed roots). Registering a Mines import root stays admin-gated. Gate extracted to `lib/pick-folder-authz.js` with a regression test.
+- **Consistent artifact corner radius.** The canvas window and the expand/fullscreen overlay (enter/open/exit) now share one `--artifact-radius` token (14px) instead of three different values (17 / 22 / 0), so a larger or fullscreen artifact no longer balloons its corners into the title-bar buttons.
+- **Deterministic `org-invites` test isolation.** A `joinBootstrap` test left `auth_mode` flipped to `supabase` in the config table, which (since the config table outranks the env) broke a later test's clean-install precondition under a full-file run. The cleanup now clears the persisted mode so the suite is deterministic (full suite 1360/1360).
+- **Voice no longer stalls after a transport regression.** Reverted the transport brain from default to opt-in after it shipped with unverified Realtime GA session fields that left the model silent. The default `realtime` path is restored and snappy.
+
 ## [2.17.0] - 2026-06-05
 
 ### Added

package/CLAUDE.md

@@ -140,7 +140,7 @@ node --no-warnings --test --test-name-pattern="your test name" tests/api-behavio
 - **Main agent trust mode** — `executeRegistryTool()` gates risky calls. Default `approval_required`. `auto` skips gate for `high` and below — `blocked` and `irreversible_external` never auto-approved.
 - **`irreversible_external` risk tier** — always creates an approval request even in trust-mode `auto`. Load-bearing guarantee that an LLM on auto-trust cannot make irreversible external writes without a human in the loop. Tiers: `blocked` → refuse | `irreversible_external` → always gate | `high`/`medium` → gate in `approval_required` mode | `low` → always execute.
 - **Tool adapters** — Resend email, GitHub (11 tools), Supabase writes (6 tools), `flight_search` dual-provider routing (Amadeus → Google Flights fallback). Details and credentials in [`ai-docs/key-constraints.md`](ai-docs/key-constraints.md#tool-adapters).
-- **Voice tools (Jarvis)** — provider abstraction (`realtime` → `tts` → `local` → `off`). Curated tool catalog routed through standard gates. Realtime ephemeral secrets never persisted. Brand: Onyx/Bone/Graphite, Mars Red only on active speech + approval banners.
+- **Voice tools (Jarvis)** — provider abstraction (`realtime` → `tts` → `local` → `off`). **Voice IS the main agent.** Default `realtime` brain is **transport-only**: OpenAI Realtime does STT (and the TTS lane speaks); cognition + tool calls run through the SAME `/api/orchestrator/stream` path as typed chat — same model, same live `getTools()` catalog, same trust/approval/allowlist/rate-limit gates. No per-session tool snapshot, so a tool enabled mid-conversation is usable on the next turn. Legacy in-browser-brain path is behind `localStorage madarx:voice-brain='realtime'` for rollback. Realtime ephemeral secrets never persisted. Brand: Onyx/Bone/Graphite, Mars Red only on active speech + approval banners.
 - **WhatsApp gateway** — Baileys sub-package, separate-process daemon. **Pair only a dedicated WhatsApp number, not personal account.** Router enforces allowlist + 5-msg/min per-sender rate limit.
 - **Sub-agent engines** — five engines in `lib/agent-engines.js`: `claude-code` (**default**), `anthropic`, `ollama`, `codex`, `hermes`. CC spawns the local CLI with `--permission-mode bypassPermissions`; **the `deny` list in `.claude/settings.json` is the load-bearing safety boundary**.
 - **Process engine ownership of state** — `lib/process/engine.js` is the SOLE writer of `process_cases.current_stage_id`, `current_stage_slug`, `status`, and `context_json`. Stage handlers receive a read-only case snapshot; they never mutate case state. Every transition flows through `transitionTo`, which is transaction-wrapped and asserts the expected `from_stage_id`. Full details: [`ai-docs/process-engine.md`](ai-docs/process-engine.md).

package/README.md

@@ -71,7 +71,7 @@ A polished voice console for the Main Agent — open it from the chat panel's mi
 | **Local** (open-source slots) | `MADARX_LOCAL_STT_URL`, `MADARX_LOCAL_TTS_URL` | URL slots for Whisper.cpp / FasterWhisper / Piper / Coqui. |
 | **Off** | – | Default when no providers are configured. |
 
-The voice agent is given the durable Madarx context on every session mint: today's date, active project, open tasks, recent artifact titles, pending approvals, brand voice, and non-`local_only` memory rows. It can call a curated tool set (`create_artifact`, `update_artifact`, `delete_artifact`, `find_artifacts`, `get_state`, `web_search`, `web_fetch`, `voice_speak`); every call routes through `executeRegistryTool` / `executeTool`, so trust-mode, approval gates, allowlists, rate limits, and audit are identical to typed chat. Voice **never** bypasses the `irreversible_external` approval gate (e.g. `gh_pr_merge`, `email_send`, `supabase_sql`).
+The voice agent is given the durable Madarx context on every session mint: today's date, active project, open tasks, recent artifact titles, pending approvals, brand voice, and non-`local_only` memory rows. **Voice is the main agent** — it sees the *full* main-agent tool catalog (the same `getTools()` list typed chat uses, not a curated subset), and every call routes through `executeRegistryTool` / `executeTool`, so trust-mode, approval gates, allowlists, rate limits, and audit are identical to typed chat. Latency is held down by `session.reasoning.effort='low'` on `gpt-realtime-2`, not by hiding tools. Voice **never** bypasses the `irreversible_external` approval gate (e.g. `gh_pr_merge`, `email_send`, `supabase_sql`, `skill_bridge_run`). Visual artifacts route through `generate_ui` so spoken page/report requests render on-brand.
 
 Brand: Onyx surface, Bone/Graphite text, Mars Red reserved for active speech peaks + approval banners.
 

package/ai-docs/key-constraints.md

@@ -44,13 +44,15 @@ Integration credentials (`GITHUB_TOKEN`, `RESEND_API_KEY`, `SUPABASE_*`, `VERCEL
 
 **GitHub (A1)** — 11 tools in `lib/tools/adapters/github.js`. All disabled by default (`enabled_default: false`), credential: `GITHUB_TOKEN` via secrets vault. Read tools (`gh_repo_read`, `gh_repo_list`, `gh_issue_list`, `gh_pr_list`) are `low` risk, rate-limited 60/min, no allowlist. Write tools (`gh_issue_create`, `gh_issue_comment`, `gh_pr_comment`) are `medium` risk, require a `repo_full_name` allowlist entry. High-risk tools (`gh_pr_create`, `gh_actions_dispatch`, `gh_release_create`) require allowlist + trust-mode gate. `gh_pr_merge` is `irreversible_external` — always requires human approval regardless of trust mode. All responses return curated shapes (never raw API blobs). All calls use `wrapFetch` for egress logging. Auth: `Authorization: Bearer <GITHUB_TOKEN>`, `Accept: application/vnd.github+json`, `X-GitHub-Api-Version: 2022-11-28`, `User-Agent: madarx-os`.
 
+**Skill bridge (`skill_bridge_run`)** — Phase 4 of voice/main-agent unification. `lib/tools/adapters/skill-bridge.js` exposes a 3-entry allowlist of first-party gstack CLI skills (`connect-chrome`, `browse`, `qa-only`) as ONE tool so the main agent — and voice, which shares the full catalog — can drive the **visible** GStack browser the operator watches live. Risk `irreversible_external`, `enabled_default:false`, rate-limited 10/5min. It crosses the Claude Code CLI trust boundary, so it is the most sharply gated tool: ALWAYS approval-gated on the main path (even trust-mode `auto`), force-gated on the agent path (added next to `browser_harness_run` in `registry.js`'s `agentIrreversibleGate`), hard kill-switch `MADARX_SKILL_BRIDGE_DISABLED=1`, and only allowlisted skill slugs are runnable (the LLM supplies the skill choice + a plain-language instruction as data, never a shell line). It runs via `runClaudeCodeAgent` under `bypassPermissions` bounded by the load-bearing `.claude/settings.json` deny list. These are first-party skills, NOT agent-authored code, so the "never execute LLM-authored code" invariant holds. Output is capped + redacted. Tested in `tests/skill-bridge.test.js` (allowlist, kill-switch, always-gate on both paths, approved one-shot replay via `MADARX_MOCK_CLAUDE_CODE_RESPONSE`).
+
 **Supabase writes** — six new tools in `lib/tools/adapters/supabase.js`. All disabled by default, all use `wrapFetch` for egress logging, all credentials via secrets vault (`SUPABASE_URL` + `SUPABASE_SERVICE_ROLE_KEY` or `SUPABASE_ANON_KEY`). Table and function names validated against `/^[a-zA-Z_][a-zA-Z0-9_]*(\.[a-zA-Z_][a-zA-Z0-9_]*)?$/` (schema-qualified names like `auth.users` accepted). `supabase_rest_insert` (medium, 30/min, table allowlist) — POST rows; `supabase_rest_upsert` (medium, 30/min, table allowlist) — merge-on-conflict POST; `supabase_rest_update` (high, 30/min, table allowlist) — PATCH with required filters; `supabase_rest_delete` (irreversible_external, 10/hour, table allowlist) — DELETE with required filters, always approval-gated; `supabase_rpc` (high, 30/min, function_name allowlist) — RPC call; `supabase_sql` (irreversible_external, 5/hour, default_allow) — raw SQL via `madarx_exec_sql()` Postgres function, uses service-role key and bypasses RLS, approval payload always includes RLS-bypass warning and full query text. Both `supabase_rest_update` and `supabase_rest_delete` throw synchronously on empty/missing filters before any network call.
 
 **`flight_search` dual-provider routing** — `flight_search` is always available regardless of credential state (`required_env: []`). `lib/tools/adapters/travel.js::flightSearch` is a router: when both `AMADEUS_CLIENT_ID` and `AMADEUS_CLIENT_SECRET` resolve, it calls `_flightSearchAmadeus`; otherwise falls back to `googleFlightsSearch` in `lib/tools/adapters/google-flights.js`, a key-less reverse-engineered call to Google's batchexecute RPC (`https://www.google.com/_/TravelFrontendUi/data/batchexecute`, RPC id `H4cFwe`). Both providers return the same curated shape; callers branch on `source.provider` (`'amadeus' | 'google_flights_web'`) only when they want to disclose origin. `lib/flight-cache.js` is a 15-minute in-process LRU (cap 200) keyed by sha1 of the normalized query — cache hits skip `wrapFetch` and rate-limit accounting and set `source.cache_hit=true`. Set `MADARX_FLIGHT_SEARCH_NO_FALLBACK=1` to disable the Google fallback and surface the Amadeus error instead. Pure helpers `encodeFreq`, `parseBatchexecute`, `curateGoogleOffer` are exported for golden testing; the parser is defensive (strips `)]}'` prefix, balance-scans frames, walks the inner payload heuristically) and degrades gracefully to `{ count: 0, offers: [], source.parse_warning: ... }` if Google's RPC shape shifts.
 
 ## Voice tools (Jarvis console)
 
-Provider abstraction lives in `lib/voice/providers.js`. Lanes: `realtime` (primary — OpenAI Realtime via WebRTC; vault keys `OPENAI_API_KEY`, optional `OPENAI_REALTIME_MODEL`, `OPENAI_REALTIME_VOICE`), `tts` (fallback — existing typed chat speaks final reply via OpenAI TTS, ElevenLabs, or the env-driven local HTTP TTS slot; vault keys `OPENAI_API_KEY`/`ELEVENLABS_API_KEY` + optional `ELEVENLABS_VOICE_ID`; local uses `MADARX_LOCAL_TTS_URL`, optional `MADARX_LOCAL_TTS_MODEL`/`MADARX_LOCAL_TTS_VOICE`), and `local` (open-source STT/TTS slots — `MADARX_LOCAL_STT_URL`/`MADARX_LOCAL_TTS_URL`; `scripts/misotts-local-server.py` provides a minimal MisoLabsAI/MisoTTS bridge). Default mode resolves at runtime (`realtime` → `tts` → `local` → `off`) and respects `MADARX_VOICE_DEFAULT_PROVIDER`. Every voice session is minted with a durable Madarx context (`lib/voice/context.js`): today's ISO date, active project, brand voice, open tasks, recent artifact titles, pending approvals, and non-`local_only` agent memory — never API keys, ephemeral tokens, or `local_only` memory. The voice model sees a curated tool catalog (`lib/voice/tools.js`): `create_artifact`, `update_artifact`, `delete_artifact`, `find_artifacts`, `get_state`, `web_search`, `web_fetch`, `voice_speak`. All calls flow through `executeVoiceTool` → `executeTool` → `executeRegistryTool`, so trust-mode, approval gates (including the never-bypassable `irreversible_external` tier), allowlists, rate limits, egress logging, and audit rows are preserved exactly as for typed chat. Realtime ephemeral client secrets are returned to the browser but never persisted; the long-lived OpenAI key never crosses to the browser. UI: `app/components/dashboard/voice-panel.jsx` + `voice-orb.jsx` + `use-realtime-voice.js`. Brand: Onyx surface, Bone/Graphite text, Mars Red only on active speech peaks + approval banners. Operator guide: `docs/voice/jarvis.md`. `cli-printing-press` documented as a deferred external companion in `docs/integrations/cli-printing-press.md`.
+Provider abstraction lives in `lib/voice/providers.js`. Lanes: `realtime` (primary — OpenAI Realtime via WebRTC; vault keys `OPENAI_API_KEY`, optional `OPENAI_REALTIME_MODEL`, `OPENAI_REALTIME_VOICE`), `tts` (fallback — existing typed chat speaks final reply via OpenAI TTS, ElevenLabs, or the env-driven local HTTP TTS slot; vault keys `OPENAI_API_KEY`/`ELEVENLABS_API_KEY` + optional `ELEVENLABS_VOICE_ID`; local uses `MADARX_LOCAL_TTS_URL`, optional `MADARX_LOCAL_TTS_MODEL`/`MADARX_LOCAL_TTS_VOICE`), and `local` (open-source STT/TTS slots — `MADARX_LOCAL_STT_URL`/`MADARX_LOCAL_TTS_URL`; `scripts/misotts-local-server.py` provides a minimal MisoLabsAI/MisoTTS bridge). Default mode resolves at runtime (`realtime` → `tts` → `local` → `off`) and respects `MADARX_VOICE_DEFAULT_PROVIDER`. Every voice session is minted with a durable Madarx context (`lib/voice/context.js`): today's ISO date, active project, brand voice, open tasks, recent artifact titles, pending approvals, and non-`local_only` agent memory — never API keys, ephemeral tokens, or `local_only` memory. **Voice IS the main agent — transport-only realtime brain (unified path).** The `realtime` lane is, by default, STT/TTS transport only: OpenAI Realtime captures speech and emits the user's final transcript (`mintOpenAIRealtimeSession({ mode: 'transport' })` forces `tools: []`, a transcribe-only instruction block, `audio.input.transcription`, and `turn_detection.create_response:false` so the Realtime model never reasons or speaks). The browser forwards each final utterance to `mainAgent.command(text)` — the SAME `/api/orchestrator/stream` path typed chat uses — so cognition, the live `getTools()` catalog, trust-mode, approval gates (including the never-bypassable `irreversible_external` tier), allowlists, rate limits, egress logging, and audit rows are literally identical to typed chat. The orchestrator's reply is voiced through the TTS lane (`speakText` → `/api/voice/tts`). Because there is no per-session tool snapshot, a tool enabled mid-conversation is usable on the next voice turn. The legacy in-browser-brain path (Realtime reasons + calls `getVoiceToolsForRealtime()` tools + speaks, via `lib/voice/tools.js` → `relayRealtimeToolCall`) still exists for rollback behind `localStorage madarx:voice-brain='realtime'` (`mode:'realtime'` on mint). Voice approvals surface in the chat panel; the voice orb says "needs your approval" and pauses. Realtime ephemeral client secrets are returned to the browser but never persisted; the long-lived OpenAI key never crosses to the browser. UI: `app/components/dashboard/voice-panel.jsx` + `voice-orb.jsx` + `use-realtime-voice.js` (the `transport` flag + `onUserUtterance` callback drive the unified loop). Brand: Onyx surface, Bone/Graphite text, Mars Red only on active speech peaks + approval banners. Operator guide: `docs/voice/jarvis.md`. `cli-printing-press` documented as a deferred external companion in `docs/integrations/cli-printing-press.md`.
 
 ## WhatsApp gateway
 
@@ -64,6 +66,12 @@ Provider abstraction lives in `lib/voice/providers.js`. Lanes: `realtime` (prima
 
 `lib/agent-engines.js` defines five engines: `claude-code` (**default**), `anthropic` (madarx tool marketplace via the Anthropic Messages API — required for `create_artifact`, `generate_ui`, `whatsapp_send`, `competitor_report`, `marketing_plan` which do NOT exist on the CC path), `ollama`, `codex`, `hermes`. `claude-code` agents spawn the local CC CLI per run via `runClaudeCodeAgent` with `--permission-mode bypassPermissions --setting-sources project,local,user --max-turns 30 --add-dir workspace --add-dir data` (matches the pattern OpenClaw's `extensions/anthropic/cli-backend.ts` uses). `bypassPermissions` skips per-call confirmation prompts so multi-step agentic work runs uninterrupted; **the `deny` list in `.claude/settings.json` is the load-bearing safety boundary** — it hard-blocks `sudo`, `rm -rf/-r/-f`, `git reset --hard`, force-push, `git clean -fd`, package-manager installs/publishes, outbound network from shell (`curl`/`wget`/`nc`/`ssh`/`scp`), database CLIs (`psql`/`mysql`/`redis-cli`), filesystem ops (`dd`/`mkfs`/`fdisk`), service control (`systemctl`/`launchctl`), reads of `.env*` / `data/whatsapp/session/` / `~/.ssh` / `~/.aws` / `/etc`, and writes to `.git/`, `node_modules/`, `data/madarx.sqlite`, `.claude/`. The allow list pre-approves read-only tools (Read/Glob/Grep/LS), Web (WebSearch/WebFetch), edits inside `workspace/`, and a curated Bash safelist (git status/log/diff, ls/cat/head/tail/wc, jq, mkdir/touch/cp/mv inside `workspace/`). Extend in `.claude/settings.json` (shared) or `.claude/settings.local.json` (personal, gitignored). Override the spawn timeout via `CLAUDE_CODE_TICK_TIMEOUT_MS` (default 600000) and max turns via `CLAUDE_CODE_MAX_TURNS` (default 30).
 
+**Live verbose streaming (engine-agnostic).** When the main agent answers in chat, madarX surfaces the engine's work in real time — token-by-token text, the model's reasoning ("thinking"), and rich tool detail (full input + output preview + elapsed ms). One knob governs every engine: `MADARX_CC_STREAM_VERBOSITY` = `quiet` | `thinking` (default) | `full` (`lib/engine-verbosity.js`). Mechanics by engine:
+- **`claude-code`** — `runClaudeCodeAgent` adds `--include-partial-messages` (capability-probed once via `claude --help`; older CLIs degrade to chunked complete-message streaming) so the stream-json parser (`makeStreamJsonParser`) emits `stream_event` text/thinking deltas. Best-effort thinking via the `MAX_THINKING_TOKENS` subprocess env.
+- **`anthropic`** — the orchestrator loop enables extended thinking on thinking-capable models (`modelSupportsThinking` allowlist: sonnet-4/opus-4/haiku-4/3.7-sonnet) with budget `MADARX_THINKING_BUDGET_TOKENS` (default 4000); `thinking`/`redacted_thinking` blocks (with signatures) are preserved in the assistant turn so tool-use follow-ups validate. Thinking is streamed but never persisted to chat history or saved artifacts.
+- **`ollama`** — streams NDJSON tokens; reasoning when `MADARX_OLLAMA_THINK=1` (opt-in; `think:true` errors on some models). The fabrication guard still runs on the full output before persistence.
+- **SSE events** — `cli_thinking` (accumulated reasoning), `cli_status` (`starting`/`working`+`elapsedMs`/`thinking`/`generating`/`done` cold-start + heartbeat), enriched `tool_result` (`durationMs`, output `preview`/`lines`). Client: `use-stream-command.js` → `ThinkingDisclosure` collapsible panel + per-step duration/preview in `chat-panel.jsx`. Set `MADARX_CC_FORCE_PARTIAL=0/1` to override the CC capability probe.
+
 **Tool-loop capability + no-fabrication guarantee.** Only `anthropic` runs the GOVERNED madarX tool loop (`generateTickOutput`: `chatWithClaude` + `executeRegistryTool` with gates/allowlists/audit). `claude-code`/`codex` run their own native CLI tool runtimes (real, but not the madarX toolset). `ollama`/`hermes` complete text single-shot with **no tool dispatch at all** — a Hermes/Nous-template model "satisfies" a tool task by role-playing the whole loop, emitting `<tool_call>`/`<tool_response>` with **invented results** in plain text. Two layers stop that fiction ever reaching the user as a real result:
 - **Layer A (`lib/engine-capabilities.js::assertRunnable`)** — runs in `agent-runner.js` before the engine ternary. A tool-needing agent (≥1 enabled tool) on a non-tool-executing engine (`ollama`/`hermes`) throws `engine_cannot_run_tools` → recorded as a FAILED run with remediation, never a fabricated "complete" deliverable. Tool-less agents run single-shot on any engine.
 - **Layer B (`lib/fabricated-tool-output.js::looksFabricatedToolTranscript`)** — backstop after output. When `toolEvents.length === 0` and the output is a fabricated tool transcript, the run throws `fabricated_tool_output` (no artifact written). The detector strips fenced/inline code first so genuine reports *quoting* `<tool_call>` are not false-positives.

package/app/agents/agent-events-bus.js

@@ -4,7 +4,17 @@
 // browser tab, regardless of how many agents are on screen — important
 // because the server caps subscribers per process.
 
-const EVENT_TYPES = ['agent_created', 'agent_run_start', 'agent_run_complete'];
+// Tool-level events (agent_tool_start / agent_tool_result) ride the same
+// connection so the global topbar can show *what* a background agent is doing,
+// not just that something is running. Existing subscribers filter by
+// event.type, so the extra types are inert for them.
+const EVENT_TYPES = [
+  'agent_created',
+  'agent_run_start',
+  'agent_run_complete',
+  'agent_tool_start',
+  'agent_tool_result',
+];
 
 let source = null;
 const subscribers = new Set();

package/app/api/auth/config/route.js

@@ -22,6 +22,7 @@ import {
   testSupabaseConnection,
   verifyRecoveryToken,
 } from '@/lib/auth-config.js';
+import { getPublicBaseUrl, setPublicBaseUrl } from '@/lib/public-url.js';
 import { requireSession } from '@/lib/auth.js';
 
 export const runtime = 'nodejs';
@@ -35,6 +36,7 @@ export async function GET() {
     supabaseConfigured: Boolean(url && anonKey),
     supabaseUrl: url || null,
     supabaseAnonKey: anonKey || null,
+    publicBaseUrl: getPublicBaseUrl() || null,
   });
 }
 
@@ -105,9 +107,14 @@ export async function POST(req) {
       anonKey: body.anonKey,
       serviceKey: body.serviceKey,
     });
+    // The public app URL is not a secret; persist it on the same save so invite
+    // and share links resolve to a host teammates can actually reach.
+    if (body.publicBaseUrl !== undefined) {
+      setPublicBaseUrl(body.publicBaseUrl);
+    }
   } catch (err) {
     return Response.json({ ok: false, error: err.message }, { status: 400 });
   }
 
-  return Response.json({ ok: true, authMode: getAuthMode() });
+  return Response.json({ ok: true, authMode: getAuthMode(), publicBaseUrl: getPublicBaseUrl() || null });
 }

package/app/api/cloud/schema/route.js

@@ -0,0 +1,109 @@
+/**
+ * /api/cloud/schema — Supabase shared-layer schema bootstrap surface.
+ *
+ *   GET                         → readiness snapshot for the onboarding wizard:
+ *                                 { configured, ready, present[], missing[],
+ *                                   total, version, projectRef, sqlEditorUrl,
+ *                                   schemaSql, serviceKeyConfigured }
+ *   POST { action: 'verify' }   → re-probe the tables (after a manual apply).
+ *   POST { action: 'apply', accessToken } → one-click apply via the Supabase
+ *                                 Management API using a personal access token.
+ *                                 The token is used once and never persisted.
+ *
+ * Authorization mirrors /api/auth/config: in local mode the app is already open
+ * to the single operator; in supabase mode an owner/admin session is required.
+ * The schema SQL is public DDL (safe to return); no secret is ever returned.
+ */
+
+import { getAuthMode } from '@/lib/auth.js';
+import { requireSession } from '@/lib/auth.js';
+import { getSupabaseAuthConfig, isServiceKeyConfigured } from '@/lib/auth-config.js';
+import {
+  probeCloudSchema,
+  applySchemaViaManagementApi,
+  projectRefFromUrl,
+  sqlEditorUrl,
+  CLOUD_SCHEMA_SQL,
+  SCHEMA_VERSION,
+} from '@/lib/cloud-schema.js';
+
+export const runtime = 'nodejs';
+export const dynamic = 'force-dynamic';
+
+/** Owner/admin gate; in local mode the single operator is always allowed. */
+async function canManage(req) {
+  if (getAuthMode() === 'local') return true;
+  let session = null;
+  try {
+    session = await requireSession(req);
+  } catch {
+    session = null;
+  }
+  return Boolean(session && ['owner', 'admin'].includes(session.role));
+}
+
+function baseSnapshot() {
+  const { url } = getSupabaseAuthConfig();
+  return {
+    projectRef: projectRefFromUrl(url) || null,
+    sqlEditorUrl: sqlEditorUrl(url) || null,
+    serviceKeyConfigured: isServiceKeyConfigured(),
+    schemaSql: CLOUD_SCHEMA_SQL,
+    version: SCHEMA_VERSION,
+  };
+}
+
+export async function GET(req) {
+  if (!(await canManage(req))) {
+    return Response.json({ ok: false, error: 'forbidden' }, { status: 403 });
+  }
+  const snap = baseSnapshot();
+  let probe = { configured: false };
+  try {
+    probe = await probeCloudSchema();
+  } catch {
+    probe = { configured: false };
+  }
+  return Response.json({ ok: true, ...snap, ...probe });
+}
+
+export async function POST(req) {
+  if (!(await canManage(req))) {
+    return Response.json({ ok: false, error: 'forbidden' }, { status: 403 });
+  }
+  const body = await req.json().catch(() => ({}));
+  const action = body.action || 'verify';
+
+  if (action === 'verify') {
+    let probe = { configured: false };
+    try {
+      probe = await probeCloudSchema();
+    } catch {
+      probe = { configured: false };
+    }
+    return Response.json({ ok: true, ...probe });
+  }
+
+  if (action === 'apply') {
+    const { url } = getSupabaseAuthConfig();
+    const ref = projectRefFromUrl(body.projectRef || url);
+    if (!ref) {
+      return Response.json({ ok: false, error: 'no_project_ref' }, { status: 400 });
+    }
+    const result = await applySchemaViaManagementApi({ ref, pat: body.accessToken });
+    if (!result.ok) {
+      const status = result.error === 'unauthorized_token' ? 422 : 400;
+      return Response.json({ ok: false, error: result.error }, { status });
+    }
+    // Re-probe so the client gets fresh readiness in the same round-trip.
+    let probe = { configured: false };
+    try {
+      probe = await probeCloudSchema();
+    } catch {
+      probe = { configured: false };
+    }
+    return Response.json({ ok: true, applied: true, ...probe });
+  }
+
+  return Response.json({ ok: false, error: 'unknown_action' }, { status: 400 });
+}

package/app/api/connections/[service]/verify/route.js

@@ -166,11 +166,39 @@ async function verifyGithub(creds) {
     if (!res.ok) return { ok: false, reason: 'invalid_key' };
     const data = await res.json().catch(() => ({}));
     const login = typeof data?.login === 'string' ? data.login : null;
+
+    // Probe real reach: does the token see any repos beyond the owner's own?
+    // A token that authenticates fine but was never granted org/collaborator
+    // repos is the #1 "connected but can't read the repo" confusion — surface
+    // it as a non-blocking warning rather than silently reporting success.
+    let reach = null;
+    try {
+      const probe = wrapFetch('connection.verify.github.reach', null, fetch);
+      const pr = await probe(
+        'https://api.github.com/user/repos?per_page=1&affiliation=collaborator,organization_member',
+        { method: 'GET', headers: {
+          authorization: `Bearer ${token}`,
+          accept: 'application/vnd.github+json',
+          'x-github-api-version': '2022-11-28',
+          'user-agent': 'madarx-os',
+        } },
+      );
+      if (pr.ok) {
+        const arr = await pr.json().catch(() => []);
+        reach = Array.isArray(arr) && arr.length > 0 ? 'org_or_collaborator' : 'owner_only';
+      }
+    } catch {
+      // best-effort — never fail verify on the reach probe
+    }
+
     return {
       ok: true,
       account_label: login ? `@${login}` : 'GitHub',
       last_4: fingerprintLast4(token),
-      summary: { login },
+      summary: { login, repo_reach: reach },
+      warning: reach === 'owner_only'
+        ? { field: 'GITHUB_TOKEN', reason: 'owner_only_access' }
+        : null,
     };
   } catch {
     return { ok: false, reason: 'network' };

package/app/api/fs/pick-folder/route.js

@@ -2,9 +2,9 @@ import { spawn } from 'node:child_process';
 import os from 'node:os';
 import fs from 'node:fs';
 import path from 'node:path';
-import { requireFreshMembership, requireSession } from '@/lib/auth.js';
-import { requireRole } from '@/lib/authz.js';
-import { approveMinesImportRoot } from '@/lib/mines/import-roots.js';
+import { requireFreshMembership, requireSession } from '../../../../lib/auth.js';
+import { assertPickFolderRole } from '../../../../lib/pick-folder-authz.js';
+import { approveMinesImportRoot } from '../../../../lib/mines/import-roots.js';
 
 export const dynamic = 'force-dynamic';
 export const runtime = 'nodejs';
@@ -30,10 +30,10 @@ function appleScriptString(value) {
   return String(value || '').replace(/\\/g, '\\\\').replace(/"/g, '\\"');
 }
 
-async function requireAdmin(request) {
+async function authenticatePicker(request, registerImportRoot) {
   const session = await requireSession(request);
   await requireFreshMembership(session, session.org_id);
-  requireRole(session, 'admin', session.org_id);
+  assertPickFolderRole(session, registerImportRoot);
   return session;
 }
 
@@ -45,18 +45,20 @@ function authError(err) {
 }
 
 export async function POST(request) {
+  // Parse the body first so the auth gate knows whether this is a privileged
+  // import-root registration (admin-only) or a plain folder pick (any session).
+  const body = await request.json().catch(() => ({}));
+  const title = String(body.title || 'Select a folder').replace(/["\\]/g, '');
+  const startPath = String(body.start_path || os.homedir() || '/').trim();
+  const registerImportRoot = Boolean(body.register_import_root);
+
   let session;
   try {
-    session = await requireAdmin(request);
+    session = await authenticatePicker(request, registerImportRoot);
   } catch (err) {
     return authError(err);
   }
 
-  const body = await request.json().catch(() => ({}));
-  const title = String(body.title || 'Select a folder').replace(/["\\]/g, '');
-  const startPath = String(body.start_path || os.homedir() || '/').trim();
-  const registerImportRoot = Boolean(body.register_import_root);
-
   try {
     let picked;
     if (process.platform === 'darwin') {

package/app/api/orchestrator/stream/attach/route.js

@@ -0,0 +1,101 @@
+import { requireSession } from '@/lib/auth.js';
+import { getActiveTurn, subscribe } from '@/lib/orchestrator-broadcast.js';
+
+export const runtime = 'nodejs';
+export const dynamic = 'force-dynamic';
+
+// Phase 2: re-attach to an in-flight orchestrator turn.
+//
+// GET /api/orchestrator/stream/attach?session_id=<id>&from_seq=<n>
+//
+// When a turn is live (or just finished, within the broadcaster's retention
+// window) for the session, this replays the buffered tail after `from_seq`,
+// then streams live frames until the terminal `__end`. When nothing is in
+// flight it returns 204 so the client can stay on its persisted state.
+// SECURITY — session ownership: `requireSession` authenticates the caller but
+// `chat_sessions` has no `user_id` column yet, so we cannot scope the attach to
+// the owner. In `MADARX_AUTH_MODE=local` (single synthetic user) this is moot.
+// In `supabase` multi-user mode an authenticated user could attach to another
+// user's live turn by guessing its session_id. Closing this requires adding
+// `user_id` to `chat_sessions` (set at createChatSession, propagated from the
+// orchestrator's authenticated session) and an ownership assert here — tracked
+// as a follow-up, out of scope for the continuity feature. The broadcaster only
+// holds an in-flight turn for a session that genuinely started one, so this is
+// not a path to historical/persisted data, only the live token tail.
+export async function GET(req) {
+  try {
+    await requireSession(req);
+  } catch (err) {
+    if (err && typeof err === 'object' && err.status) {
+      return Response.json({ error: err.error || 'unauthorized' }, { status: err.status });
+    }
+    throw err;
+  }
+
+  const url = new URL(req.url);
+  const sessionId = url.searchParams.get('session_id');
+  const fromSeq = Number(url.searchParams.get('from_seq')) || 0;
+  if (!sessionId) {
+    return Response.json({ error: 'session_id required' }, { status: 400 });
+  }
+
+  const active = getActiveTurn(sessionId);
+  if (!active) {
+    // Nothing in flight — the client keeps its persisted view.
+    return new Response(null, { status: 204 });
+  }
+
+  const encoder = new TextEncoder();
+  let cleanup = () => {};
+
+  const stream = new ReadableStream({
+    start(ctrl) {
+      let closed = false;
+      function safeEnqueue(chunk) {
+        if (closed) return;
+        try { ctrl.enqueue(encoder.encode(chunk)); }
+        catch { closed = true; }
+      }
+      function send(event, data) {
+        // Serialise exactly as the live stream's emit() does so the shared
+        // client reducer treats replayed and live frames identically.
+        const payload = typeof data === 'string' ? data : JSON.stringify(data);
+        safeEnqueue(`event: ${event}\ndata: ${payload}\n\n`);
+      }
+
+      // Tell the client which turn it attached to.
+      send('attach', { session_id: sessionId, turn_id: active.turnId });
+
+      const unsubscribe = subscribe(sessionId, fromSeq, (frame) => {
+        if (frame.event === '__end') {
+          send('done', { ok: true, resumed: true });
+          cleanup();
+          return;
+        }
+        send(frame.event, frame.data);
+      });
+
+      cleanup = () => {
+        if (closed) return;
+        closed = true;
+        try { unsubscribe(); } catch { /* ignore */ }
+        try { ctrl.close(); } catch { /* ignore */ }
+      };
+
+      req.signal.addEventListener('abort', cleanup);
+
+      // If the turn already finished before we subscribed, the buffered tail
+      // (incl. __end) was replayed synchronously above and cleanup ran.
+    },
+    cancel() { cleanup(); },
+  });
+
+  return new Response(stream, {
+    headers: {
+      'Content-Type': 'text/event-stream',
+      'Cache-Control': 'no-cache, no-transform',
+      Connection: 'keep-alive',
+      'X-Accel-Buffering': 'no',
+    },
+  });
+}