madarx 2.17.0 → 2.19.0

package/app/settings/team/page.js

@@ -23,7 +23,9 @@ import { requireSession, getAuthMode } from '@/lib/auth.js';
 import { getSupabaseAuthConfig, isServiceKeyConfigured, isAuthModeEnvLocked } from '@/lib/auth-config.js';
 import { getOrgById, listMembers, getMembership } from '@/lib/org.js';
 import { isSharedCloudReady } from '@/lib/shared-cloud.js';
-import { ShieldCheck, Cloud, CloudOff } from 'lucide-react';
+import { probeCloudSchema } from '@/lib/cloud-schema.js';
+import { getPublicBaseUrl } from '@/lib/public-url.js';
+import { ShieldCheck, Cloud, CloudOff, Wand2, ArrowRight } from 'lucide-react';
 import AuthConfigForm from '../account/auth-config-form.jsx';
 import TeamCreateOrg from './team-create-org.jsx';
 import TeamMembers from './team-members.jsx';
@@ -50,6 +52,7 @@ export default async function SettingsTeamPage() {
     url: supabaseCfg.url || '',
     anonKey: supabaseCfg.anonKey || '',
     serviceKeySet: isServiceKeyConfigured(),
+    publicBaseUrl: getPublicBaseUrl() || '',
     envLocked: isAuthModeEnvLocked(),
   };
 
@@ -69,12 +72,35 @@ export default async function SettingsTeamPage() {
   const myRole = myMembership?.role || session?.role || 'owner';
   const canManage = CAN_MANAGE.has(myRole);
   const cloudReady = isSharedCloudReady();
+  // Probe the shared-layer schema so the page can show real table readiness and
+  // steer the operator into the guided wizard when setup is incomplete. Network
+  // call — guarded and best-effort; never blocks the page.
+  let schema = null;
+  if (cloudReady) {
+    try {
+      const probe = await probeCloudSchema();
+      schema = probe?.configured ? probe : null;
+    } catch {
+      schema = null;
+    }
+  }
   // The seeded `personal-org` in local auth mode is the solo, machine-local
   // default — never shared, never the cloud org. Label it as such so it isn't
   // mistaken for a shareable organization (a real org is auto-created with a
   // unique id on first Supabase sign-in).
   const isLocalDefault = authMode === 'local' && org?.id === 'personal-org';
 
+  // Is the team still mid-setup? Drives the guided-wizard call-to-action.
+  const tablesReady = schema ? schema.ready : null;
+  const setupIncomplete = !cloudReady || tablesReady === false || !org || isLocalDefault;
+  const ctaText = !cloudReady
+    ? 'Connect a Supabase project, stand up the tables, create your org, and invite your team — all in one guided flow.'
+    : tablesReady === false
+      ? `Almost there — ${schema.missing.length} shared-layer table${schema.missing.length === 1 ? '' : 's'} still need creating. Finish in the guided flow.`
+      : isLocalDefault || !org
+        ? 'Create your shareable organization and invite teammates in a few guided steps.'
+        : 'Walk through team setup step by step.';
+
   return (
     <AdminShell
       kicker="Settings"
@@ -84,6 +110,20 @@ export default async function SettingsTeamPage() {
     >
       <div className="mkt-page" data-page="settings-team">
 
+        {/* Guided setup call-to-action */}
+        {setupIncomplete ? (
+          <a className="wiz-setup-cta" href="/onboarding/team">
+            <span className="wiz-cta-icon"><Wand2 size={18} strokeWidth={1.75} aria-hidden="true" /></span>
+            <div>
+              <b>{cloudReady ? 'Finish setting up your team' : 'Set up your team'}</b>
+              <small>{ctaText}</small>
+            </div>
+            <span className="admin-btn-primary" style={{ pointerEvents: 'none' }}>
+              Guided setup <ArrowRight size={15} aria-hidden="true" />
+            </span>
+          </a>
+        ) : null}
+
         {/* Stats strip */}
         <section className="mkt-stats">
           <div className="mkt-stat">
@@ -153,6 +193,16 @@ export default async function SettingsTeamPage() {
                     <dt>Cloud sync</dt>
                     <dd>{cloudReady ? 'Connected to Supabase' : 'Local only (no service-role key)'}</dd>
                   </div>
+                  {schema ? (
+                    <div>
+                      <dt>Tables</dt>
+                      <dd>
+                        {schema.ready
+                          ? `All ${schema.total} present`
+                          : <a href="/onboarding/team">{schema.present.length}/{schema.total} — finish setup →</a>}
+                      </dd>
+                    </div>
+                  ) : null}
                 </dl>
                 <div className="admin-form-actions" style={{ marginTop: '0.75rem', gap: '0.5rem' }}>
                   <a href="/admin" className="admin-btn-sm" style={{ display: 'inline-flex', alignItems: 'center', gap: '0.4rem' }}>

package/app/settings/team/team-invites.jsx

@@ -87,7 +87,9 @@ export default function TeamInvites({ orgId, creatorRole = 'owner', cloudReady =
       });
       const data = await res.json().catch(() => ({}));
       if (!res.ok) throw new Error(data.message || data.error || 'Could not create link');
-      const url = data.joinPath ? `${window.location.origin}${data.joinPath}` : '';
+      const url = data.joinUrl
+        ? data.joinUrl
+        : data.joinPath ? `${window.location.origin}${data.joinPath}` : '';
       setCreated({ token: data.token, invite: data.invite, url });
       setCopied('');
       setShowOptions(false);

package/lib/agent-config.js

@@ -92,6 +92,13 @@ TOOL_SELF_MANAGEMENT
 - If the tool exists but is disabled, call install_tool to enable it. Tools rated irreversible_external will gate on operator approval — surface that to the principal.
 - After enabling a tool, immediately use it to complete the task.
 
+BROWSER_CONTROL
+- When asked to open, visit, or navigate a real web page and then read it, click, type, or search on it, drive a real browser — do NOT refuse and do NOT settle for web_fetch (which cannot click or run JavaScript-heavy pages).
+- Use browser_open to load the URL, browser_act to click/fill/type/press/scroll, browser_extract to read the rendered result, and browser_screenshot to capture it. The page persists across calls so you can chain open → act → extract.
+- These interactive browser tools start disabled. If a browser_* call is unavailable, call install_tool to enable it first, then proceed — exactly as TOOL_SELF_MANAGEMENT describes. Do not tell the principal you cannot browse; enable the tool and do it.
+- When the principal explicitly wants to WATCH the browser live (a visible window, "open the browser so I can see", "connect chrome"), use skill_bridge_run with skill="connect-chrome" or skill="browse" — it drives the real visible GStack browser. This tool ALWAYS asks for owner approval before each run (it crosses the local CLI boundary); surface that one approval, then proceed. For silent/background automation prefer the headless browser_* tools instead.
+- This applies identically whether the request arrives by voice or typed chat — voice runs through this same brain and toolset.
+
 ARTIFACT_LIFECYCLE
 - When asked to build a UI, page, interface, web component, landing page, dashboard, or any visual output — use generate_ui. Never use create_artifact for HTML or UI work.
 - When the principal refines, extends, or follows up on a previous artifact, use update_artifact with the existing artifact_id — do NOT create a new artifact.

package/lib/agent-engines.js

@@ -7,18 +7,42 @@ import { chatWithClaude } from './claude.js';
 const ANTHROPIC_MODEL = 'claude-sonnet-4-6';
 import { publishLiveEvent } from './live-events.js';
 import { WORKSPACE, DATA_DIR, ensureDirs } from './paths.js';
+import { getStreamVerbosity, verbosityStreamsThinking, thinkingBudgetTokens } from './engine-verbosity.js';
 
 const PROJECT_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 
+// Extract a short, human-readable preview from a tool_result block's content.
+// Content can be a string or an array of {type:'text', text} / image parts.
+function previewToolResultContent(block) {
+  const c = block?.content;
+  let text = '';
+  if (typeof c === 'string') text = c;
+  else if (Array.isArray(c)) {
+    text = c.map(p => (typeof p === 'string' ? p : (p?.type === 'text' && typeof p.text === 'string' ? p.text : ''))).join('');
+  }
+  text = String(text || '');
+  return {
+    preview: text.slice(0, 200),
+    chars: text.length,
+    lines: text ? text.split('\n').length : 0,
+  };
+}
+
 // Parses Claude Code's `--output-format stream-json` stdout. Each line is a JSON
 // envelope. We care about:
 //   - assistant.message.content[].type === 'text'       → accumulate response text
+//   - assistant.message.content[].type === 'thinking'   → surface reasoning (onThinkingDelta)
 //   - assistant.message.content[].type === 'tool_use'   → emit agent_tool_start
 //   - user.message.content[].type      === 'tool_result' → emit agent_tool_result
-// Everything else (system, init, hooks, partials, result) is ignored.
-function makeStreamJsonParser({ agentId, agentName, onText, onToolStart, onToolResult, onResult }) {
+//   - stream_event (only with --include-partial-messages) → incremental text /
+//     thinking deltas for smooth token-by-token streaming.
+// `partial` tells us deltas are active: when true the live preview is driven by
+// stream_event deltas, and the complete assistant envelope is used ONLY to
+// accumulate the authoritative final answer (avoids double-counting).
+export function makeStreamJsonParser({ agentId, agentName, partial = false, onText, onTextDelta, onThinkingDelta, onToolStart, onToolResult, onResult, onStatus }) {
   let buffer = '';
   const toolNameById = new Map();
+  const toolStartedAt = new Map();
   return function handleChunk(chunk) {
     buffer += chunk;
     let nl;
@@ -29,6 +53,28 @@ function makeStreamJsonParser({ agentId, agentName, onText, onToolStart, onToolR
       let evt;
       try { evt = JSON.parse(raw); } catch { continue; }
       if (!evt || typeof evt !== 'object') continue;
+
+      // Partial-message deltas (present only with --include-partial-messages).
+      // These wrap the raw Anthropic SSE event under evt.event. They drive the
+      // live preview; the authoritative answer still comes from the complete
+      // `assistant` envelopes below.
+      if (evt.type === 'stream_event' && evt.event && typeof evt.event === 'object') {
+        const se = evt.event;
+        if (se.type === 'content_block_delta' && se.delta) {
+          const d = se.delta;
+          if (d.type === 'text_delta' && typeof d.text === 'string') {
+            onTextDelta?.(d.text);
+          } else if (d.type === 'thinking_delta' && typeof d.thinking === 'string') {
+            onThinkingDelta?.(d.thinking);
+          }
+        } else if (se.type === 'content_block_start' && se.content_block?.type === 'thinking') {
+          onStatus?.('thinking');
+        } else if (se.type === 'message_start') {
+          onStatus?.('generating');
+        }
+        continue;
+      }
+
       // Terminal result event carries the run's final text at top level
       // (`evt.result`), not inside message.content. Capture it as a last-resort
       // answer for turns that emitted only tool_use blocks and no clean text
@@ -52,6 +98,16 @@ function makeStreamJsonParser({ agentId, agentName, onText, onToolStart, onToolR
         // can keep it for the live chat preview but exclude it from the
         // final return value.
         const hasToolUse = content.some(b => b?.type === 'tool_use');
+        // Thinking blocks in a complete envelope: only surface here when partial
+        // streaming is OFF (otherwise the stream_event deltas already did, and
+        // re-emitting would duplicate the reasoning).
+        if (!partial) {
+          for (const b of content) {
+            if (b?.type === 'thinking' && typeof b.thinking === 'string' && b.thinking) {
+              onThinkingDelta?.(b.thinking);
+            }
+          }
+        }
         const messageText = content
           .filter(b => b?.type === 'text' && typeof b.text === 'string')
           .map(b => b.text)
@@ -59,7 +115,10 @@ function makeStreamJsonParser({ agentId, agentName, onText, onToolStart, onToolR
         if (messageText) onText?.(messageText, { isFinal: !hasToolUse });
         for (const block of content) {
           if (block?.type === 'tool_use') {
-            if (block.id) toolNameById.set(block.id, block.name || 'tool');
+            if (block.id) {
+              toolNameById.set(block.id, block.name || 'tool');
+              toolStartedAt.set(block.id, Date.now());
+            }
             onToolStart?.({ id: block.id, name: block.name || 'tool', input: block.input });
             if (agentId) {
               publishLiveEvent({
@@ -76,7 +135,18 @@ function makeStreamJsonParser({ agentId, agentName, onText, onToolStart, onToolR
         for (const block of content) {
           if (block?.type === 'tool_result') {
             const toolName = toolNameById.get(block.tool_use_id) || 'tool';
-            onToolResult?.({ tool_use_id: block.tool_use_id, name: toolName, isError: Boolean(block.is_error) });
+            const startedAt = toolStartedAt.get(block.tool_use_id);
+            const durationMs = startedAt ? Date.now() - startedAt : null;
+            const { preview, chars, lines } = previewToolResultContent(block);
+            onToolResult?.({
+              tool_use_id: block.tool_use_id,
+              name: toolName,
+              isError: Boolean(block.is_error),
+              durationMs,
+              preview,
+              chars,
+              lines,
+            });
             if (agentId) {
               publishLiveEvent({
                 type: 'agent_tool_result',
@@ -85,9 +155,11 @@ function makeStreamJsonParser({ agentId, agentName, onText, onToolStart, onToolR
                 tool: toolName,
                 status: block.is_error ? 'error' : 'done',
                 isError: Boolean(block.is_error),
+                duration_ms: durationMs,
               });
             }
             toolNameById.delete(block.tool_use_id);
+            toolStartedAt.delete(block.tool_use_id);
           }
         }
       }
@@ -292,6 +364,30 @@ export async function commandExists(command) {
   });
 }
 
+// Whether the installed `claude` CLI understands --include-partial-messages
+// (needed for token-by-token streaming + thinking deltas). Older CLIs reject
+// unknown flags and fail the whole spawn, so we probe `claude --help` once and
+// cache the result, degrading gracefully to chunked streaming when absent.
+// Force with MADARX_CC_FORCE_PARTIAL=1, disable with =0.
+let _ccPartialSupport;
+async function claudeSupportsPartialMessages() {
+  if (process.env.MADARX_MOCK_CLAUDE_CODE_RESPONSE) return false;
+  if (process.env.MADARX_CC_FORCE_PARTIAL === '1') return true;
+  if (process.env.MADARX_CC_FORCE_PARTIAL === '0') return false;
+  if (_ccPartialSupport !== undefined) return _ccPartialSupport;
+  _ccPartialSupport = await new Promise(resolve => {
+    try {
+      const child = spawn(commandSpawnTarget('claude'), ['--help'], { shell: false });
+      let out = '';
+      child.stdout.on('data', c => { out += c.toString(); });
+      child.stderr.on('data', c => { out += c.toString(); });
+      child.on('error', () => resolve(false));
+      child.on('close', () => resolve(out.includes('include-partial-messages')));
+    } catch { resolve(false); }
+  });
+  return _ccPartialSupport;
+}
+
 async function listOllamaModels() {
   try {
     const response = await fetch(`${OLLAMA_BASE_URL}/api/tags`, { signal: AbortSignal.timeout(1500) });
@@ -384,32 +480,73 @@ function cliOutput(command, args, { cwd = process.cwd(), timeoutMs = 120000, clo
   });
 }
 
-export async function runOllamaAgent({ model, systemPrompt, userMessage, maxTokens = 2048 }) {
+export async function runOllamaAgent({ model, systemPrompt, userMessage, maxTokens = 2048, onChunk, onThinking } = {}) {
   if (process.env.MADARX_MOCK_OLLAMA_RESPONSE) return process.env.MADARX_MOCK_OLLAMA_RESPONSE;
+  // Stream only when a consumer wants live output. `think` surfaces reasoning on
+  // models that support it (deepseek-r1, qwen3, …) but errors on some Ollama
+  // versions/models, so it's opt-in via MADARX_OLLAMA_THINK=1.
+  const wantStream = Boolean(onChunk || onThinking);
+  const wantThink = wantStream && verbosityStreamsThinking() && process.env.MADARX_OLLAMA_THINK === '1';
+  const body = {
+    model: model || process.env.OLLAMA_MODEL,
+    stream: wantStream,
+    options: { num_predict: maxTokens },
+    messages: [
+      { role: 'system', content: systemPrompt },
+      { role: 'user', content: userMessage },
+    ],
+  };
+  if (wantThink) body.think = true;
   const response = await fetch(`${OLLAMA_BASE_URL}/api/chat`, {
     method: 'POST',
     headers: { 'Content-Type': 'application/json' },
-    body: JSON.stringify({
-      model: model || process.env.OLLAMA_MODEL,
-      stream: false,
-      options: { num_predict: maxTokens },
-      messages: [
-        { role: 'system', content: systemPrompt },
-        { role: 'user', content: userMessage },
-      ],
-    }),
+    body: JSON.stringify(body),
   });
   if (!response.ok) throw new Error(`Ollama chat failed: HTTP ${response.status}`);
-  const data = await response.json();
-  const content = data.message?.content || data.response || '';
+  if (!wantStream) {
+    const data = await response.json();
+    const content = data.message?.content || data.response || '';
+    if (!content.trim()) throw new Error('Ollama returned no text');
+    return content.trim();
+  }
+  // Streaming: Ollama emits newline-delimited JSON. Accumulate content + thinking
+  // and forward incremental pieces to the callbacks for a live chat preview.
+  let content = '';
+  let thinking = '';
+  const reader = response.body.getReader();
+  const dec = new TextDecoder();
+  let buf = '';
+  while (true) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    buf += dec.decode(value, { stream: true });
+    let nl;
+    while ((nl = buf.indexOf('\n')) >= 0) {
+      const line = buf.slice(0, nl).trim();
+      buf = buf.slice(nl + 1);
+      if (!line) continue;
+      let evt;
+      try { evt = JSON.parse(line); } catch { continue; }
+      const piece = evt.message?.content || evt.response || '';
+      const think = evt.message?.thinking || '';
+      if (piece) { content += piece; onChunk?.(piece, content); }
+      if (think) { thinking += think; onThinking?.(thinking, think); }
+    }
+  }
   if (!content.trim()) throw new Error('Ollama returned no text');
   return content.trim();
 }
 
-export async function runClaudeCodeAgent({ model, systemPrompt, userMessage, maxTurns, allowedTools = [], timeoutMs, onChunk, onAssistantText, onToolStart, onToolResult, cwd, addDirs = [], agentId, agentName } = {}) {
+export async function runClaudeCodeAgent({ model, systemPrompt, userMessage, maxTurns, allowedTools = [], timeoutMs, onChunk, onAssistantText, onThinking, onStatus, onToolStart, onToolResult, cwd, addDirs = [], agentId, agentName, verbosity } = {}) {
   if (process.env.MADARX_MOCK_CLAUDE_CODE_RESPONSE) return process.env.MADARX_MOCK_CLAUDE_CODE_RESPONSE;
   const prompt = `${systemPrompt}\n\n${userMessage}`;
   const effectiveMaxTurns = Number(maxTurns || process.env.CLAUDE_CODE_MAX_TURNS || 30);
+  const v = verbosity || getStreamVerbosity();
+  const wantsThinking = verbosityStreamsThinking(v);
+  // Token-by-token streaming + reasoning need --include-partial-messages, which
+  // only newer CLIs support. Probe once; fall back to chunked complete-message
+  // streaming when unavailable so nothing breaks on older installs.
+  const partial = wantsThinking && await claudeSupportsPartialMessages();
   const args = [
     '-p', prompt,
     '--max-turns', String(effectiveMaxTurns),
@@ -418,12 +555,21 @@ export async function runClaudeCodeAgent({ model, systemPrompt, userMessage, max
     '--permission-mode', 'bypassPermissions',
     '--setting-sources', 'project,local,user',
   ];
+  if (partial) args.push('--include-partial-messages');
   for (const dir of addDirs) {
     if (dir) args.push('--add-dir', dir);
   }
   if (allowedTools.length) args.push('--allowedTools', allowedTools.join(','));
   if (model && model !== 'claude-code') args.splice(2, 0, '--model', model);
 
+  // Best-effort nudge for the spawned CLI to actually produce extended thinking.
+  // Harmless when unsupported (the env var is simply ignored).
+  const subEnv = claudeSubprocessEnv();
+  if (wantsThinking) {
+    const budget = thinkingBudgetTokens(v);
+    if (budget > 0) subEnv.MAX_THINKING_TOKENS = String(Math.max(1024, budget));
+  }
+
   // Two buffers: `narrationParts` keeps every assistant text block (used only
   // for the live chat preview), `finalParts` keeps text from messages that had
   // NO tool_use — i.e. the actual answer, not the "let me search next…" prose.
@@ -433,17 +579,32 @@ export async function runClaudeCodeAgent({ model, systemPrompt, userMessage, max
   const finalParts = [];
   let lastNarration = '';
   let resultText = '';
+  // Live preview accumulators for partial mode. `liveDelta` is the running
+  // answer text (token deltas); `liveThinking` is the running reasoning. They
+  // never feed the returned answer — only the live chat surface.
+  let liveDelta = '';
+  let liveThinking = '';
   const parse = makeStreamJsonParser({
     agentId,
     agentName,
+    partial,
     onText: (t, opts = {}) => {
       narrationParts.push(t);
       if (opts.isFinal) finalParts.push(t);
       else lastNarration = t;
-      // Snapshot of running assistant prose so the route can stream a clean
-      // preview to the chat without exposing raw stream-json envelopes.
-      onAssistantText?.(narrationParts.join('').trim());
+      // When partial deltas are streaming the preview, the complete envelope is
+      // authoritative-only — don't also drive the preview from it (would double).
+      if (!partial) onAssistantText?.(narrationParts.join('').trim());
+    },
+    onTextDelta: (delta) => {
+      liveDelta += delta;
+      onAssistantText?.(liveDelta.trim());
+    },
+    onThinkingDelta: (delta) => {
+      liveThinking += delta;
+      onThinking?.(liveThinking.trim(), delta);
     },
+    onStatus: (phase) => { onStatus?.(phase); },
     onResult: (t) => { resultText = t; },
     onToolStart,
     onToolResult,
@@ -461,7 +622,7 @@ export async function runClaudeCodeAgent({ model, systemPrompt, userMessage, max
     // local CLI engine. Strip them so CC uses the logged-in subscription.
     // Honor an explicit opt-out for users who genuinely want API-key billing
     // for the spawned CLI (MADARX_CLI_USE_API_KEY=1).
-    env: claudeSubprocessEnv(),
+    env: subEnv,
     onChunk: (chunk) => {
       parse(chunk);
       onChunk?.(chunk);

package/lib/auth-config.js

@@ -6,9 +6,14 @@
  * vault so the operator can configure everything from Settings — no env edits,
  * no restart.
  *
- * Precedence:
- *   auth mode  : explicit process.env.MADARX_AUTH_MODE (emergency backstop)
- *                → config['auth_mode'] → 'local'
+ * Precedence (auth mode):
+ *   1. MADARX_AUTH_MODE_LOCK=1 + MADARX_AUTH_MODE — hard lock, env wins outright.
+ *   2. MADARX_AUTH_MODE=supabase WITH resolvable creds — env wins over config.
+ *      (Safe: creds present ⇒ the supabase login can always initialise, so this
+ *      can never strand the operator. Honors an env-configured install whose
+ *      config table holds a stale/default 'local'.)
+ *   3. config['auth_mode'] (UI / recovery-token managed) — wins otherwise.
+ *   4. MADARX_AUTH_MODE as a bare seed, else 'local'.
  *   url/anon   : vault (SUPABASE_URL / SUPABASE_ANON_KEY)
  *                → NEXT_PUBLIC_SUPABASE_* env → SUPABASE_* env
  *   service key: vault (SUPABASE_SERVICE_ROLE_KEY) → env
@@ -74,26 +79,51 @@ export function verifyRecoveryToken(provided) {
 
 function envMode() {
   const raw = process.env.MADARX_AUTH_MODE;
-  if (raw && String(raw).trim()) return String(raw).trim().toLowerCase();
+  if (raw && String(raw).trim()) {
+    const m = String(raw).trim().toLowerCase();
+    if (VALID_MODES.has(m)) return m;
+  }
   return null;
 }
 
-/** True when MADARX_AUTH_MODE is explicitly set — the UI cannot override it. */
+/**
+ * True ONLY when the operator opts into a hard lock via MADARX_AUTH_MODE_LOCK=1
+ * (alongside a valid MADARX_AUTH_MODE). In that state the UI / recovery flow
+ * cannot change the mode — for multi-tenant deployments that must fail closed.
+ *
+ * A bare `MADARX_AUTH_MODE` is NOT a lock: it only seeds the initial default the
+ * UI can still override. This is deliberate — a stray `MADARX_AUTH_MODE=supabase`
+ * with no resolvable credentials must never strand the operator behind a login
+ * that can't initialise, because the config-table mode (written by the login
+ * screen and the recovery-token hatch) always wins over the env seed.
+ */
 export function isAuthModeEnvLocked() {
-  const m = envMode();
-  return Boolean(m && VALID_MODES.has(m));
+  const lock = String(process.env.MADARX_AUTH_MODE_LOCK || '').trim().toLowerCase();
+  return Boolean(envMode() && (lock === '1' || lock === 'true'));
 }
 
 export function getAuthMode() {
-  const override = envMode();
-  if (override && VALID_MODES.has(override)) return override;
+  // Hard lock (opt-in): env wins outright, UI cannot override.
+  if (isAuthModeEnvLocked()) return envMode();
+  // A fully-configured supabase env (URL + anon key resolve) is authoritative
+  // over a stale config-table value. This honors an operator who set
+  // MADARX_AUTH_MODE=supabase in their env (e.g. the `madarx` CLI install, whose
+  // ~/.madarx data home is a SEPARATE DB whose config table may still seed
+  // 'local') without re-running setup/UI. It CANNOT strand them: the creds are
+  // present, so the supabase login always initialises — the anti-lockout guard
+  // below only ever mattered for the no-creds case.
+  if (envMode() === 'supabase' && isSupabaseConfigured()) return 'supabase';
+  // Normal precedence: the config table (UI/recovery-managed) wins, so the
+  // login screen and the recovery-token hatch can always change the mode —
+  // including dropping back to local when supabase is misconfigured (no creds).
   try {
     const stored = getConfig(AUTH_MODE_KEY, null);
     if (stored && VALID_MODES.has(stored)) return stored;
   } catch {
-    // DB not ready (very early boot) — fall through to the safe default.
+    // DB not ready (very early boot) — fall through to the env seed / default.
   }
-  return 'local';
+  // No stored mode yet → env acts as the initial default (seed), else local.
+  return envMode() || 'local';
 }
 
 export function getSupabaseAuthConfig() {

package/lib/auth-env-fastpath.js

@@ -0,0 +1,34 @@
+/**
+ * lib/auth-env-fastpath.js — env-only resolution of the middleware auth gate.
+ *
+ * Pure + dependency-free so the Edge middleware can import it AND node:test can
+ * unit-test it (importing middleware.js itself pulls `next/server`, which only
+ * resolves under the Next bundler).
+ *
+ * Honors BOTH the public (build-inlined) and plain server-side credential names
+ * — the `madarx` CLI install configures SUPABASE_URL / SUPABASE_ANON_KEY (not the
+ * NEXT_PUBLIC_* aliases), mirroring getSupabaseAuthConfig().
+ *
+ * Returns a config object to short-circuit on, or null to defer to
+ * /api/auth/config (which resolves creds from the encrypted vault). The
+ * fast-path fires ONLY when the env fully specifies the answer: local mode (no
+ * creds needed) or supabase mode WITH resolvable creds. A bare
+ * MADARX_AUTH_MODE=supabase with no env creds returns null so the gate does NOT
+ * bounce every request to /login?error=missing_supabase_env while the vault
+ * holds valid keys — the exact CLI-install lockout this avoids.
+ *
+ * @param {Record<string,string|undefined>} [env]
+ * @returns {{ authMode: string, supabaseUrl: string|null, supabaseAnonKey: string|null } | null}
+ */
+export function resolveEnvAuthConfig(env = {}) {
+  const envRaw = (env.MADARX_AUTH_MODE || '').trim().toLowerCase();
+  const envUrl = env.NEXT_PUBLIC_SUPABASE_URL || env.SUPABASE_URL || null;
+  const envAnon = env.NEXT_PUBLIC_SUPABASE_ANON_KEY || env.SUPABASE_ANON_KEY || null;
+  if (envRaw === 'local') {
+    return { authMode: 'local', supabaseUrl: envUrl, supabaseAnonKey: envAnon };
+  }
+  if (envRaw === 'supabase' && envUrl && envAnon) {
+    return { authMode: 'supabase', supabaseUrl: envUrl, supabaseAnonKey: envAnon };
+  }
+  return null;
+}

package/lib/claude.js

@@ -76,15 +76,32 @@ export async function chatWithClaude(messages, systemPrompt, tools = [], options
   return withRetry(() => client.messages.create(params), `chat(${params.model})`);
 }
 
-export async function streamChatWithClaude(messages, systemPrompt, tools = [], model = MODEL) {
+// Extended thinking is supported on Claude 3.7+ Sonnet and the Claude 4 family.
+// Enabling it on an older model (e.g. 3.5 Haiku/Sonnet) is a 400 — so we
+// allowlist and silently skip otherwise rather than break the turn.
+export function modelSupportsThinking(model) {
+  return /(sonnet-4|opus-4|haiku-4|3-7-sonnet)/i.test(String(model || ''));
+}
+
+export async function streamChatWithClaude(messages, systemPrompt, tools = [], model = MODEL, options = {}) {
   const client = getClient();
   const params = {
     model,
-    max_tokens: 8192,
+    max_tokens: options.max_tokens || 8192,
     system: systemPrompt,
     messages,
   };
   if (tools.length) params.tools = tools;
+  // Extended thinking: when a budget is requested AND the model supports it,
+  // enable interleaved reasoning so the route can stream `thinking` deltas.
+  // max_tokens must exceed the thinking budget — leave generous headroom for
+  // the actual answer (HTML artifacts can be large). temperature must be unset
+  // with thinking, so we never pass it here.
+  if (options.thinkingBudget > 0 && modelSupportsThinking(model)) {
+    const budget = Math.max(1024, Math.floor(options.thinkingBudget));
+    params.thinking = { type: 'enabled', budget_tokens: budget };
+    params.max_tokens = Math.max(params.max_tokens, budget + 8192);
+  }
   // Stream cannot be resumed mid-flight; outer retry only covers establishing
   // the stream (connection/429 before the first token), not a mid-stream drop.
   return withRetry(() => client.messages.stream(params), `stream(${model})`);

package/lib/cli/dispatch.js

@@ -84,7 +84,7 @@ export function helpText() {
     '  run            Boot web + cron + heartbeat + WhatsApp, open the dashboard (default)',
     '  setup          Interactive setup: data home, master key, folder grants, keys',
     '  status         Show component status (version, web, approvals, whatsapp)',
-    '  doctor         Diagnose Node version, data home, master key, port',
+    '  doctor         Diagnose env/host + DB drift (auth-mode, vault, org owner). --fix repairs',
     '  update         Update to the latest release (npm i -g madarx@latest)',
     '  whatsapp       Pair / reset the WhatsApp bridge                                [' + DEFERRED_COMMANDS.whatsapp + ']',
     '  stop           Stop a running instance                                         [' + DEFERRED_COMMANDS.stop + ']',
@@ -124,7 +124,7 @@ export async function dispatch(argv = []) {
   }
   if (command === 'doctor') {
     const { doctor } = await import('./doctor.js');
-    return await doctor();
+    return await doctor({ args, flags });
   }
   if (command === 'status') {
     const { status } = await import('./status.js');