micro-models-agent 2.11.0 → 2.13.1

package/dist/main.js

@@ -2609,6 +2609,8 @@ The path was joined onto the working directory because it does not exist as give
 {issues}
 Summary: {summary}`,
     "critic.advice": `A verifier flagged issues worth checking before you finish:
+{issues}`,
+    "critic.repeat": `The verifier repeats a previously flagged problem — do not produce the same answer again. Change the approach, or finish honestly if the complaint does not apply:
 {issues}`,
     "tool.subagent_queued": "Sub-agent task queued: {task}",
     "tool.subagent_artifact": `Sub-agent completed. Full result saved to artifact: {path}
@@ -3404,6 +3406,7 @@ Apply a matching solution from these results. If none is relevant — do NOT rep
     "ui.todo_action": "{action} · {count}",
     "ui.tool_running": "{tool}…",
     "ui.step_context": "step {id}: {desc}",
+    "ui.draft_retracted": "↳ draft rejected by verification, refining…",
     "indexer.map_header": "Project map",
     "indexer.top_directories": "Top directories",
     "indexer.files": "Files",
@@ -3578,6 +3581,46 @@ Updated: {updatedAt}`,
     "web.sidebar.session": "session",
     "web.sidebar.usage": "usage",
     "web.sidebar.env": "environment",
+    "web.sidebar.tab_session": "Session",
+    "web.sidebar.tab_map": "Map",
+    "web.sidebar.tab_trace": "Trace",
+    "web.sidebar.map_status": "status",
+    "web.sidebar.map_ready": "ready",
+    "web.sidebar.map_indexing": "indexing…",
+    "web.sidebar.map_stale": "stale",
+    "web.sidebar.map_updated": "updated",
+    "web.sidebar.map_never": "never",
+    "web.sidebar.map_today": "today, {time}",
+    "web.sidebar.map_watcher": "watcher",
+    "web.sidebar.map_on": "on",
+    "web.sidebar.map_off": "off",
+    "web.sidebar.map_files": "files",
+    "web.sidebar.map_symbols": "symbols",
+    "web.sidebar.map_tokens": "tokens",
+    "web.sidebar.map_root": "root",
+    "web.sidebar.map_languages": "languages",
+    "web.sidebar.map_reindex": "Re-index",
+    "web.sidebar.map_reindexing": "re-indexing…",
+    "web.sidebar.map_reindex_failed": "re-index failed",
+    "web.sidebar.trace_empty": "no events yet",
+    "web.sidebar.trace_turn": "turn {n}",
+    "web.sidebar.trace_text": "composing… {count} chars",
+    "web.sidebar.trace_plan": "plan update",
+    "web.sidebar.trace_question": "question",
+    "web.sidebar.detail_metadata": "metadata",
+    "web.sidebar.detail_arguments": "arguments",
+    "web.sidebar.detail_output": "output",
+    "web.sidebar.detail_error": "error",
+    "web.sidebar.detail_text": "text",
+    "web.sidebar.detail_plan": "plan",
+    "web.sidebar.detail_reasoning": "reasoning",
+    "web.sidebar.detail_status": "status",
+    "web.sidebar.detail_ok": "ok",
+    "web.sidebar.detail_fail": "failed",
+    "web.sidebar.detail_duration": "duration",
+    "web.sidebar.detail_time": "time",
+    "web.sidebar.detail_tool_call": "tool call",
+    "web.sidebar.detail_session": "session",
     "web.env.dir": "dir",
     "web.env.agents": "AGENTS.md",
     "web.env.map": "map",
@@ -3972,6 +4015,7 @@ Updated: {updatedAt}`,
     "web.history.loading": "loading…",
     "web.history.unavailable": "— history unavailable",
     "web.history.empty": "— empty session —",
+    "web.scroll.latest": "latest",
     "web.tool.output_one": "output · {count} char",
     "web.tool.output_few": "output · {count} chars",
     "web.tool.output_many": "output · {count} chars",
@@ -4015,7 +4059,7 @@ Updated: {updatedAt}`,
     "web.setup.language.title": "Choose your language",
     "web.setup.language.hint": "Used for the interface.",
     "web.setup.provider.title": "Choose a provider",
-    "web.setup.provider.hint": "For a local model pick the OpenAI-compatible option and scan for your server.",
+    "web.setup.provider.hint": "For a local model pick the OpenAI-compatible option, scan for your server, then test the connection before continuing.",
     "web.setup.provider.base_url": "Base URL",
     "web.setup.provider.scan": "Scan for local servers",
     "web.setup.provider.scan_found_one": "Found {count} server",
@@ -4024,6 +4068,10 @@ Updated: {updatedAt}`,
     "web.setup.provider.scan_none": "No local servers found — enter the URL manually.",
     "web.setup.provider.scan_failed": "Scan failed. Enter the URL manually.",
     "web.setup.provider.required": "Please enter a base URL.",
+    "web.setup.provider.test": "Test connection",
+    "web.setup.provider.testing": "Testing…",
+    "web.setup.provider.test_ok": "Server reachable.",
+    "web.setup.provider.test_fail": "Could not reach the server at this URL.",
     "web.setup.key.title": "API key",
     "web.setup.key.hint": "Leave empty for local servers. Stored only in your config file and never shown again.",
     "web.setup.key.label": "Key",
@@ -4042,15 +4090,54 @@ Updated: {updatedAt}`,
     "web.setup.model.test_fail": "Could not reach the model.",
     "web.setup.model.required": "Please choose or type a model.",
     "web.setup.context.title": "Context & iterations",
-    "web.setup.context.hint": "How much context the model gets and how many tool steps it may take.",
+    "web.setup.context.hint": "Must match the context your provider gives this model. Press Detect, or copy the value from LM Studio / Ollama / provider docs.",
     "web.setup.context.contextWindow": "Context window (tokens)",
     "web.setup.context.maxToolIterations": "Max tool iterations",
     "web.setup.context.required": "Enter a positive number.",
+    "web.setup.context.detect": "Detect from provider",
+    "web.setup.context.detecting": "Detecting…",
+    "web.setup.context.detect_ok": "Context set from provider: {count} tokens.",
+    "web.setup.context.detect_fail": "Could not detect context — enter it manually.",
     "web.setup.security.title": "Security",
-    "web.setup.security.hint": "Safe defaults are on; turn off only what you need.",
+    "web.setup.security.hint": "Safe defaults are on; turn off only what you need. Nothing is blocked silently — each toggle only asks the agent to confirm first.",
     "web.setup.security.paths": "Restrict file access to the workspace",
+    "web.setup.security.paths_desc": "The agent reads and writes only inside the workspace, and asks before touching .git, .env, keys and other sensitive paths.",
     "web.setup.security.bash": "Block dangerous shell commands",
+    "web.setup.security.bash_desc": "Blocks destructive commands (rm, sudo, ssh, curl, shutdown, …). The agent asks instead of running them.",
     "web.setup.security.flags": "Block dangerous command flags",
+    "web.setup.security.flags_desc": "Blocks risky flags (--force, -rf, …) that make safe commands dangerous. Works together with the command block.",
+    "web.setup.security.configure": "Configure",
+    "web.setup.security.advanced": "Advanced security settings",
+    "web.setup.security.popup_hint": "One item per line. Empty list = disabled. Changes apply only to this install; you can edit them later in Settings → Security.",
+    "web.setup.security.popup_done": "Done",
+    "web.setup.security.reset": "Reset to defaults",
+    "web.setup.security.denied": "Always denied paths",
+    "web.setup.security.allowed": "Only allowed paths (empty = all except denied)",
+    "web.setup.security.blacklist": "Always blocked commands",
+    "web.setup.security.whitelist": "Only allowed commands (empty = all except blocked)",
+    "web.setup.security.log_commands": "Log every executed command to the audit log",
+    "web.setup.security.dangerous_flags": "Blocked command flags",
+    "web.setup.security.dangerous_operators": "Blocked shell operators",
+    "web.setup.security.network_enabled": "Network protection (block private/internal addresses)",
+    "web.setup.security.denied_domains": "Always denied domains",
+    "web.setup.security.allowed_domains": "Only allowed domains (empty = all except denied)",
+    "web.setup.security.request_timeout": "Network request timeout (ms)",
+    "web.setup.security.max_response_size": "Max response size (bytes)",
+    "web.setup.security.max_recursion": "Max subagent recursion depth",
+    "web.setup.security.max_file_ops": "Max file operations per session",
+    "web.setup.security.rate_rpm": "Max LLM requests per minute",
+    "web.setup.security.rate_parallel": "Max parallel tasks",
+    "web.setup.security.content_scan": "Scan file content for dangerous patterns",
+    "web.setup.security.session_encryption": "Encrypt session logs on disk",
+    "web.setup.security.audit_enabled": "Send security events to the audit notifier",
+    "web.setup.security.audit_severity": "Minimum severity to notify",
+    "web.setup.security.audit_events": "Notified event types",
+    "web.setup.security.audit_retries": "Webhook max retries",
+    "web.setup.security.audit_timeout": "Webhook timeout (ms)",
+    "web.setup.security.severity.low": "low",
+    "web.setup.security.severity.medium": "medium",
+    "web.setup.security.severity.high": "high",
+    "web.setup.security.severity.critical": "critical",
     "web.setup.review.title": "Review",
     "web.setup.review.hint": "Check the values, then finish. Settings are saved to your config.",
     "web.setup.review.provider": "Provider",
@@ -4423,6 +4510,8 @@ var init_ru = __esm(() => {
 {issues}
 Сводка: {summary}`,
     "critic.advice": `Верификатор отметил проблемы, которые стоит проверить до завершения:
+{issues}`,
+    "critic.repeat": `Верификатор повторяет уже отмеченную проблему — не выдавай тот же ответ снова. Смени подход или заверши честно, если жалоба неприменима:
 {issues}`,
     "tool.subagent_queued": "Задача подагенту добавлена: {task}",
     "tool.subagent_artifact": `Суб-агент завершён. Полный результат сохранён в артефакт: {path}
@@ -5221,6 +5310,7 @@ var init_ru = __esm(() => {
     "ui.todo_action": "{action} · {count}",
     "ui.tool_running": "{tool}…",
     "ui.step_context": "шаг {id}: {desc}",
+    "ui.draft_retracted": "↳ черновик отклонён проверкой, уточняю…",
     "indexer.map_header": "Карта проекта",
     "indexer.top_directories": "Основные директории",
     "indexer.files": "Файлы",
@@ -5398,6 +5488,46 @@ var init_ru = __esm(() => {
     "web.sidebar.session": "сессия",
     "web.sidebar.usage": "использование",
     "web.sidebar.env": "окружение",
+    "web.sidebar.tab_session": "Сессия",
+    "web.sidebar.tab_map": "Карта",
+    "web.sidebar.tab_trace": "Трассировка",
+    "web.sidebar.map_status": "статус",
+    "web.sidebar.map_ready": "готово",
+    "web.sidebar.map_indexing": "индексация…",
+    "web.sidebar.map_stale": "устарело",
+    "web.sidebar.map_updated": "обновлено",
+    "web.sidebar.map_never": "никогда",
+    "web.sidebar.map_today": "сегодня, {time}",
+    "web.sidebar.map_watcher": "вотчер",
+    "web.sidebar.map_on": "вкл.",
+    "web.sidebar.map_off": "выкл.",
+    "web.sidebar.map_files": "файлы",
+    "web.sidebar.map_symbols": "символы",
+    "web.sidebar.map_tokens": "токены",
+    "web.sidebar.map_root": "корень",
+    "web.sidebar.map_languages": "языки",
+    "web.sidebar.map_reindex": "Переиндексировать",
+    "web.sidebar.map_reindexing": "переиндексация…",
+    "web.sidebar.map_reindex_failed": "не удалось переиндексировать",
+    "web.sidebar.trace_empty": "событий пока нет",
+    "web.sidebar.trace_turn": "ход {n}",
+    "web.sidebar.trace_text": "печатает… {count} симв.",
+    "web.sidebar.trace_plan": "обновление плана",
+    "web.sidebar.trace_question": "вопрос",
+    "web.sidebar.detail_metadata": "метаданные",
+    "web.sidebar.detail_arguments": "аргументы",
+    "web.sidebar.detail_output": "вывод",
+    "web.sidebar.detail_error": "ошибка",
+    "web.sidebar.detail_text": "текст",
+    "web.sidebar.detail_plan": "план",
+    "web.sidebar.detail_reasoning": "размышление",
+    "web.sidebar.detail_status": "статус",
+    "web.sidebar.detail_ok": "ok",
+    "web.sidebar.detail_fail": "ошибка",
+    "web.sidebar.detail_duration": "длительность",
+    "web.sidebar.detail_time": "время",
+    "web.sidebar.detail_tool_call": "вызов тула",
+    "web.sidebar.detail_session": "сессия",
     "web.env.dir": "директория",
     "web.env.agents": "AGENTS.md",
     "web.env.map": "карта",
@@ -5765,6 +5895,7 @@ var init_ru = __esm(() => {
     "web.history.loading": "загрузка…",
     "web.history.unavailable": "— история недоступна",
     "web.history.empty": "— пустая сессия —",
+    "web.scroll.latest": "к новому",
     "web.tool.output_one": "вывод · {count} символ",
     "web.tool.output_few": "вывод · {count} символа",
     "web.tool.output_many": "вывод · {count} символов",
@@ -5835,7 +5966,7 @@ var init_ru = __esm(() => {
     "web.setup.language.title": "Выберите язык",
     "web.setup.language.hint": "Используется для интерфейса.",
     "web.setup.provider.title": "Выберите провайдера",
-    "web.setup.provider.hint": "Для локальной модели выберите OpenAI-совместимый вариант и просканируйте сервер.",
+    "web.setup.provider.hint": "Для локальной модели выберите OpenAI-совместимый вариант, просканируйте сервер и проверьте подключение перед продолжением.",
     "web.setup.provider.base_url": "Базовый URL",
     "web.setup.provider.scan": "Найти локальные серверы",
     "web.setup.provider.scan_found_one": "Найден {count} сервер",
@@ -5844,6 +5975,10 @@ var init_ru = __esm(() => {
     "web.setup.provider.scan_none": "Локальные серверы не найдены — введите URL вручную.",
     "web.setup.provider.scan_failed": "Сканирование не удалось. Введите URL вручную.",
     "web.setup.provider.required": "Укажите базовый URL.",
+    "web.setup.provider.test": "Проверить подключение",
+    "web.setup.provider.testing": "Проверка…",
+    "web.setup.provider.test_ok": "Сервер отвечает.",
+    "web.setup.provider.test_fail": "Не удалось связаться с сервером по этому URL.",
     "web.setup.key.title": "API-ключ",
     "web.setup.key.hint": "Для локальных серверов можно оставить пустым. Хранится только в файле конфигурации и больше не показывается.",
     "web.setup.key.label": "Ключ",
@@ -5862,15 +5997,54 @@ var init_ru = __esm(() => {
     "web.setup.model.test_fail": "Не удалось связаться с моделью.",
     "web.setup.model.required": "Выберите или введите модель.",
     "web.setup.context.title": "Контекст и итерации",
-    "web.setup.context.hint": "Сколько контекста получает модель и сколько шагов с тулами она может сделать.",
+    "web.setup.context.hint": "Должно совпадать с контекстом, который провайдер выделяет этой модели. Нажмите «Определить» либо сверьтесь с LM Studio / Ollama / документацией провайдера.",
     "web.setup.context.contextWindow": "Окно контекста (токены)",
     "web.setup.context.maxToolIterations": "Максимум итераций тулов",
     "web.setup.context.required": "Введите положительное число.",
+    "web.setup.context.detect": "Определить у провайдера",
+    "web.setup.context.detecting": "Определение…",
+    "web.setup.context.detect_ok": "Контекст от провайдера: {count} токенов.",
+    "web.setup.context.detect_fail": "Не удалось определить контекст — введите вручную.",
     "web.setup.security.title": "Безопасность",
-    "web.setup.security.hint": "Безопасные значения включены; отключайте только нужное.",
+    "web.setup.security.hint": "Безопасные значения включены; отключайте только нужное. Ничего не блокируется молча — каждый переключатель лишь требует подтверждения перед опасным действием.",
     "web.setup.security.paths": "Ограничить доступ к файлам рабочей папкой",
+    "web.setup.security.paths_desc": "Агент читает и пишет только внутри рабочей папки, а перед доступом к .git, .env, ключам и другим чувствительным путям спросит подтверждения.",
     "web.setup.security.bash": "Блокировать опасные shell-команды",
+    "web.setup.security.bash_desc": "Блокирует разрушительные команды (rm, sudo, ssh, curl, shutdown, …). Вместо запуска агент спросит подтверждения.",
     "web.setup.security.flags": "Блокировать опасные флаги команд",
+    "web.setup.security.flags_desc": "Блокирует рискованные флаги (--force, -rf, …), которые делают безопасные команды опасными. Работает вместе с блокировкой команд.",
+    "web.setup.security.configure": "Настроить",
+    "web.setup.security.advanced": "Расширенные настройки безопасности",
+    "web.setup.security.popup_hint": "По одному элементу в строке. Пустой список = выключено. Изменения применяются только к этой установке; позже их можно править в Настройках → Безопасность.",
+    "web.setup.security.popup_done": "Готово",
+    "web.setup.security.reset": "Сбросить к значениям по умолчанию",
+    "web.setup.security.denied": "Всегда запрещённые пути",
+    "web.setup.security.allowed": "Разрешены только эти пути (пусто = все, кроме запрещённых)",
+    "web.setup.security.blacklist": "Всегда блокируемые команды",
+    "web.setup.security.whitelist": "Разрешены только эти команды (пусто = все, кроме блокируемых)",
+    "web.setup.security.log_commands": "Писать каждую выполненную команду в аудит-лог",
+    "web.setup.security.dangerous_flags": "Блокируемые флаги команд",
+    "web.setup.security.dangerous_operators": "Блокируемые shell-операторы",
+    "web.setup.security.network_enabled": "Сетевая защита (блокировать приватные/внутренние адреса)",
+    "web.setup.security.denied_domains": "Всегда запрещённые домены",
+    "web.setup.security.allowed_domains": "Разрешены только эти домены (пусто = все, кроме запрещённых)",
+    "web.setup.security.request_timeout": "Таймаут сетевых запросов (мс)",
+    "web.setup.security.max_response_size": "Максимум размера ответа (байты)",
+    "web.setup.security.max_recursion": "Максимум глубины рекурсии субагентов",
+    "web.setup.security.max_file_ops": "Максимум файловых операций за сессию",
+    "web.setup.security.rate_rpm": "Максимум LLM-запросов в минуту",
+    "web.setup.security.rate_parallel": "Максимум параллельных задач",
+    "web.setup.security.content_scan": "Сканировать содержимое файлов на опасные паттерны",
+    "web.setup.security.session_encryption": "Шифровать логи сессий на диске",
+    "web.setup.security.audit_enabled": "Отправлять события безопасности в аудит-нотификатор",
+    "web.setup.security.audit_severity": "Минимальная severity для уведомления",
+    "web.setup.security.audit_events": "Типы событий для уведомления",
+    "web.setup.security.audit_retries": "Повторы вебхука",
+    "web.setup.security.audit_timeout": "Таймаут вебхука (мс)",
+    "web.setup.security.severity.low": "низкая",
+    "web.setup.security.severity.medium": "средняя",
+    "web.setup.security.severity.high": "высокая",
+    "web.setup.security.severity.critical": "критическая",
     "web.setup.review.title": "Проверка",
     "web.setup.review.hint": "Проверьте значения и завершите. Настройки сохранятся в конфиг.",
     "web.setup.review.provider": "Провайдер",
@@ -9386,6 +9560,13 @@ function defaultUserAgent() {
     cachedUserAgent = `micro-models-agent/${readMmaVersion()}`;
   return cachedUserAgent;
 }
+function normalizeReasoningEffort(level) {
+  if (!level || level === "default" || level === "none")
+    return;
+  if (level === "max")
+    return "high";
+  return level;
+}
 function buildRequestBody(opts) {
   const body = {
     model: opts.model,
@@ -9403,13 +9584,15 @@ function buildRequestBody(opts) {
   if (opts.stream && opts.streamUsage)
     body.stream_options = { include_usage: true };
   const strategy = opts.reasoningStrategy ?? "openai-effort";
-  const level = opts.reasoningEffort;
-  if (strategy === "openai-effort" && level && level !== "default") {
-    body.reasoning_effort = level;
+  const effort = normalizeReasoningEffort(opts.reasoningEffort);
+  if (strategy === "openai-effort") {
+    if (effort)
+      body.reasoning_effort = effort;
   } else if (strategy === "template-kwarg") {
-    body.chat_template_kwargs = { enable_thinking: level !== "none" };
-  } else if (strategy === "prompt-tag" && level && level !== "default") {
-    body.reasoning_effort = level;
+    body.chat_template_kwargs = { enable_thinking: opts.reasoningEffort !== "none" };
+  } else if (strategy === "prompt-tag") {
+    if (effort)
+      body.reasoning_effort = effort;
   }
   if (opts.tools && opts.tools.length > 0) {
     body.tools = opts.tools.map((t2) => ({
@@ -9456,6 +9639,9 @@ class OpenAICompatProvider {
     this.userAgent = config.userAgent ?? defaultUserAgent();
     this.debug = config.logger ? config.logger.debug.bind(config.logger) : null;
   }
+  get idleTimeoutMs() {
+    return this.retryConfig.noDataTimeoutMs ?? 180000;
+  }
   async* chat(messages, tools, signal, options) {
     if (!this.rateLimiter.canMakeRequest()) {
       const waitMs = Math.min(this.rateLimiter.msUntilRequest(), LLM_MAX_RATE_WAIT_MS);
@@ -9486,7 +9672,7 @@ class OpenAICompatProvider {
     }
     if (!hasToolCall && !hasText) {
       this.debug?.("LLM streaming produced no text/tool_call — falling back to non-streaming");
-      const fallback = await this.doNonStreaming(effectiveMessages, tools, signal, options);
+      const fallback = await this.doNonStreaming(effectiveMessages, tools, signal, options, this.idleTimeoutMs);
       this.debug?.("LLM non-streaming fallback result", { chunks: fallback.length });
       for (const chunk of fallback) {
         if (hasReasoning && chunk.type === "reasoning")
@@ -9513,9 +9699,9 @@ ${tag}`;
     return copy;
   }
   async* doStream(messages, tools, signal, options) {
-    const { baseDelay, maxDelay, maxStreamRetries, noDataTimeoutMs } = this.retryConfig;
+    const { baseDelay, maxDelay, maxStreamRetries } = this.retryConfig;
     const streamRetries = maxStreamRetries ?? 2;
-    const idleTimeoutMs = noDataTimeoutMs ?? 180000;
+    const idleTimeoutMs = this.idleTimeoutMs;
     let usedNonStreamingFallback = false;
     for (let attempt = 0;; attempt++) {
       let emitted = false;
@@ -9534,7 +9720,7 @@ ${tag}`;
         if (err?.stalledAfterToolCall === true && !usedNonStreamingFallback) {
           usedNonStreamingFallback = true;
           this.debug?.("LLM stream stalled after tool_call — falling back to non-streaming request");
-          const fallback = await this.doNonStreaming(messages, tools, signal, options);
+          const fallback = await this.doNonStreaming(messages, tools, signal, options, idleTimeoutMs);
           this.debug?.("LLM non-streaming fallback result", { chunks: fallback.length });
           for (const chunk of fallback) {
             if (chunk.type === "reasoning")
@@ -9581,8 +9767,12 @@ ${tag}`;
         signal: abortSignal
       });
     } catch (err) {
-      if (err?.name === "AbortError")
+      if (err?.name === "AbortError") {
+        if (isTimeout()) {
+          throw new Error(t("error.llm_timeout", { timeout: LLM_REQUEST_TIMEOUT_MS }));
+        }
         throw err;
+      }
       const wrapped = err instanceof Error ? err : new Error(String(err));
       if (wrapped instanceof LlmError) {
         wrapped.markTerminal();
@@ -9609,6 +9799,7 @@ ${tag}`;
       cleanup();
       throw new Error(t("error.no_response_body"));
     }
+    cleanup();
     const decoder = new TextDecoder;
     let buffer = "";
     const toolCallAccs = new Map;
@@ -9774,7 +9965,7 @@ ${tag}`;
       streamUsage: this.cache?.requestStreamUsage === true
     };
   }
-  buildRequestSetup(signal) {
+  buildRequestSetup(signal, totalTimeoutMs = LLM_REQUEST_TIMEOUT_MS) {
     const headers = {
       "Content-Type": "application/json",
       "User-Agent": this.userAgent
@@ -9791,7 +9982,7 @@ ${tag}`;
     const timeoutId = setTimeout(() => {
       timedOut = true;
       controller.abort();
-    }, LLM_REQUEST_TIMEOUT_MS);
+    }, totalTimeoutMs);
     const abortSignal = (() => {
       if (!signal)
         return controller.signal;
@@ -9815,7 +10006,7 @@ ${tag}`;
       controller
     };
   }
-  async doNonStreaming(messages, tools, signal, options) {
+  async doNonStreaming(messages, tools, signal, options, totalTimeoutMs = LLM_REQUEST_TIMEOUT_MS) {
     const maxTokens = options?.maxTokens ?? this.config.maxCompletionTokens ?? DEFAULT_MAX_COMPLETION_TOKENS;
     const body = buildRequestBody({
       model: this.model,
@@ -9827,7 +10018,7 @@ ${tag}`;
       reasoningStrategy: options?.reasoningStrategy,
       ...this.cacheHints()
     });
-    const { headers, abortSignal, cleanup, isTimeout } = this.buildRequestSetup(signal);
+    const { headers, abortSignal, cleanup, isTimeout } = this.buildRequestSetup(signal, totalTimeoutMs);
     try {
       const response = await this.fetchWithRetry(`${this.config.baseUrl}/chat/completions`, {
         method: "POST",
@@ -9892,7 +10083,7 @@ ${tag}`;
       return chunks;
     } catch (err) {
       if (isTimeout() && err?.name === "AbortError") {
-        throw new Error(t("error.llm_timeout", { timeout: LLM_REQUEST_TIMEOUT_MS }));
+        throw new Error(t("error.llm_timeout", { timeout: totalTimeoutMs }));
       }
       throw err instanceof Error ? err : new Error(String(err));
     } finally {
@@ -10281,6 +10472,14 @@ var init_cache = __esm(() => {
 });
 
 // src/modules/providers/manager.ts
+var exports_manager = {};
+__export(exports_manager, {
+  reasoningStrategyForProvider: () => reasoningStrategyForProvider,
+  presetOf: () => presetOf,
+  activeProviderEndpoint: () => activeProviderEndpoint,
+  ProviderManager: () => ProviderManager
+});
+
 class ProviderManager {
   entries;
   lastKnownFallback;
@@ -10420,6 +10619,12 @@ class ProviderManager {
     this.cache.clear();
   }
 }
+function presetOf(type) {
+  const spec = BUILTIN_PROVIDERS.find((p) => p.type === type);
+  if (!spec)
+    return;
+  return { label: spec.label, baseUrl: spec.baseUrl };
+}
 function activeProviderEndpoint(config) {
   const entries = Array.isArray(config?.entries) ? config.entries : [];
   const active = entries.find((e) => e.label === config?.active || e.type === config?.active) ?? entries[0];
@@ -10428,6 +10633,10 @@ function activeProviderEndpoint(config) {
   }
   return { baseUrl: config?.baseUrl ?? "", apiKey: config?.apiKey, type: config?.type ?? "openai-compat" };
 }
+function reasoningStrategyForProvider(config) {
+  const type = activeProviderEndpoint(config).type;
+  return BUILTIN_PROVIDERS.find((p) => p.type === type)?.capabilities.reasoningStrategy ?? "none";
+}
 var init_manager = __esm(() => {
   init_create();
   init_cache();
@@ -10629,6 +10838,8 @@ function cachePath2() {
 async function probeReasoningSupport(provider, strategy, signal) {
   if (strategy === "none")
     return false;
+  if (strategy === "openai-effort")
+    return true;
   try {
     let hasReasoning = false;
     for await (const chunk of provider.chat(PROBE_MESSAGES, undefined, signal, {
@@ -10775,8 +10986,7 @@ async function setupProviderPhase(config, logger, dir) {
   const builtProvider = buildActiveProvider(config, logger, { getSessionId });
   const providerManager = builtProvider.manager;
   const llmProvider = builtProvider.provider;
-  const providerSpec = BUILTIN_PROVIDERS.find((p) => p.type === config.provider.type);
-  const reasoningStrategy = providerSpec?.capabilities.reasoningStrategy ?? "none";
+  const reasoningStrategy = reasoningStrategyForProvider(config.provider);
   let reasoningProbePromise = Promise.resolve(false);
   if (config.reasoning && config.reasoning.mode !== "none" && reasoningStrategy !== "none") {
     reasoningProbePromise = (async () => {
@@ -10816,7 +11026,6 @@ var init_provider_phase = __esm(() => {
   init_model_loader();
   init_factory();
   init_manager();
-  init_presets();
   init_profile();
   init_i18n();
 });
@@ -11703,6 +11912,7 @@ import { join as join20 } from "path";
 class IndexCache {
   cachePath;
   cache = null;
+  cachedBuiltAt = null;
   root;
   signature;
   constructor(cacheDir, opts = {}) {
@@ -11724,17 +11934,21 @@ class IndexCache {
       if (this.signature && parsed.signature !== this.currentSignature())
         return null;
       this.cache = parsed.result;
+      this.cachedBuiltAt = typeof parsed.builtAt === "number" ? parsed.builtAt : null;
       return this.cache;
     } catch {
       return null;
     }
   }
   save(result) {
+    const now = Date.now();
     this.cache = result;
+    this.cachedBuiltAt = now;
     const envelope = {
       version: CACHE_VERSION,
       root: this.root ?? "",
       signature: this.currentSignature(),
+      builtAt: now,
       result
     };
     const dir = join20(this.cachePath, "..");
@@ -11744,12 +11958,16 @@ class IndexCache {
   }
   invalidate() {
     this.cache = null;
+    this.cachedBuiltAt = null;
     if (existsSync18(this.cachePath)) {
       try {
         rmSync(this.cachePath);
       } catch {}
     }
   }
+  getBuiltAt() {
+    return this.cachedBuiltAt;
+  }
   currentSignature() {
     if (!this.signature)
       return "";
@@ -12077,7 +12295,11 @@ class IndexerModule {
   cache;
   baseDir;
   index = null;
-  statsCache = null;
+  mapCache = null;
+  buildPromise = null;
+  indexing = false;
+  builtAt = null;
+  watcherActive = false;
   rebuildTimeout = null;
   constructor(opts) {
     this.baseDir = opts.baseDir;
@@ -12087,26 +12309,38 @@ class IndexerModule {
       signature: () => this.indexer.scanSignature()
     });
   }
-  async buildIndex() {
+  buildIndex() {
     if (this.index)
-      return this.index;
+      return Promise.resolve(this.index);
+    if (this.buildPromise)
+      return this.buildPromise;
     const cached = this.cache.load();
     if (cached) {
       this.index = cached;
-      return cached;
-    }
-    try {
-      const result = await this.indexer.walk();
-      this.cache.save(result);
-      this.index = result;
-      return result;
-    } catch {
-      return null;
+      this.builtAt = this.cache.getBuiltAt();
+      return Promise.resolve(cached);
     }
+    this.indexing = true;
+    this.buildPromise = (async () => {
+      try {
+        const result = await this.indexer.walk();
+        this.cache.save(result);
+        this.index = result;
+        this.builtAt = Date.now();
+        return result;
+      } catch {
+        return null;
+      } finally {
+        this.indexing = false;
+        this.buildPromise = null;
+      }
+    })();
+    return this.buildPromise;
   }
   async refresh() {
     this.cache.invalidate();
     this.index = null;
+    this.builtAt = null;
     return this.buildIndex();
   }
   find(query) {
@@ -12146,9 +12380,11 @@ class IndexerModule {
           this.refresh().catch(() => {});
         }, 2000);
       });
+      this.watcherActive = true;
     } catch {}
   }
   unwatch() {
+    this.watcherActive = false;
     if (this.rebuildTimeout) {
       clearTimeout(this.rebuildTimeout);
       this.rebuildTimeout = null;
@@ -12167,19 +12403,47 @@ class IndexerModule {
       kind: "project-map"
     };
   }
-  stats() {
-    if (!this.index)
-      return null;
-    if (this.statsCache && this.statsCache.index === this.index)
-      return this.statsCache.value;
+  mapInfo() {
+    if (!this.index) {
+      return {
+        indexed: false,
+        indexing: this.indexing,
+        files: 0,
+        symbols: 0,
+        tokens: 0,
+        updatedAt: this.builtAt,
+        languages: [],
+        watcher: this.watcherActive
+      };
+    }
+    if (this.mapCache && this.mapCache.index === this.index) {
+      return { ...this.mapCache.value, indexing: this.indexing, watcher: this.watcherActive };
+    }
     const symbols = this.index.files.reduce((n, f) => n + f.exports.length, 0);
+    const langMap = new Map;
+    for (const f of this.index.files) {
+      const lang = f.language;
+      const cur = langMap.get(lang) ?? { files: 0, symbols: 0 };
+      cur.files += 1;
+      cur.symbols += f.exports.length;
+      langMap.set(lang, cur);
+    }
+    const languages = [...langMap.entries()].map(([language, v]) => ({ language, ...v })).sort((a, b) => b.files - a.files || a.language.localeCompare(b.language)).slice(0, 8);
     const value = {
+      indexed: true,
       files: this.index.files.length,
       symbols,
-      tokens: this.estimateTokens(this.formatMap(this.index))
+      tokens: this.estimateTokens(this.formatMap(this.index)),
+      updatedAt: this.builtAt,
+      languages,
+      watcher: this.watcherActive
     };
-    this.statsCache = { index: this.index, value };
-    return value;
+    this.mapCache = { index: this.index, value };
+    return { ...value, indexing: this.indexing };
+  }
+  stats() {
+    const info = this.mapInfo();
+    return info.indexed ? { files: info.files, symbols: info.symbols, tokens: info.tokens } : null;
   }
   getToolDefinitions() {
     return [this.createProjectMapTool()];
@@ -16801,6 +17065,15 @@ class SessionLogger {
       ...data
     });
   }
+  logClaimRetry(data) {
+    this.session?.appendLog({
+      ts: new Date().toISOString(),
+      type: "claim_retry",
+      content: data.reason,
+      kind: data.kind,
+      iteration: data.iteration
+    });
+  }
   logCritic(event, data = {}) {
     this.session?.appendLog({
       ts: new Date().toISOString(),
@@ -19391,8 +19664,17 @@ function isFilePathLike(s) {
   return true;
 }
 function extractFileLikeTokens(text) {
-  const matches = text.match(FILE_TOKEN_RE) || [];
-  return [...new Set(matches.filter(isFilePathLike))];
+  const out = new Set;
+  const re = new RegExp(FILE_TOKEN_RE.source, "gi");
+  for (const m of text.matchAll(re)) {
+    const token = m[0];
+    const after = text[(m.index ?? 0) + token.length];
+    if (after === "(")
+      continue;
+    if (isFilePathLike(token))
+      out.add(token);
+  }
+  return [...out];
 }
 function stripUrls(text) {
   return text.replace(/\bhttps?:\/\/[^\s"'<>]+/gi, " ");
@@ -20720,6 +21002,7 @@ function createLoopState() {
     criticCalls: 0,
     criticRepairCycles: 0,
     mutationsSinceCritic: 0,
+    criticHistoryMark: 0,
     seenCriticIssues: new Set,
     emptyResponseRetries: 0,
     emptyResponseExhausted: false,
@@ -20991,6 +21274,55 @@ class ReasoningEffortResolver {
 }
 var init_reasoning_resolver = () => {};
 
+// src/core/agent/tool-pairing.ts
+function repairToolCallPairing(messages) {
+  const out = [];
+  let pending = [];
+  const closePending = () => {
+    for (const call of pending) {
+      out.push({
+        role: "tool",
+        name: call.name,
+        content: UNRESOLVED_TOOL_RESULT,
+        tool_call_id: call.id,
+        success: false,
+        blocked: true
+      });
+    }
+    pending = [];
+  };
+  for (const msg of messages) {
+    if (msg.role === "assistant" && msg.tool_calls?.length) {
+      const last = out[out.length - 1];
+      if (last?.role === "assistant" && last.tool_calls?.length) {
+        const merged = {
+          ...last,
+          tool_calls: [...last.tool_calls, ...msg.tool_calls]
+        };
+        out[out.length - 1] = merged;
+        pending = merged.tool_calls.map((tc) => ({ id: tc.id, name: tc.function.name }));
+        continue;
+      }
+      closePending();
+      out.push(msg);
+      pending = msg.tool_calls.map((tc) => ({ id: tc.id, name: tc.function.name }));
+      continue;
+    }
+    if (msg.role === "tool" && msg.tool_call_id) {
+      if (pending.some((c) => c.id === msg.tool_call_id)) {
+        out.push(msg);
+        pending = pending.filter((c) => c.id !== msg.tool_call_id);
+      }
+      continue;
+    }
+    closePending();
+    out.push(msg);
+  }
+  closePending();
+  return out;
+}
+var UNRESOLVED_TOOL_RESULT = "[Result unavailable]";
+
 // src/core/agent/context-renderer.ts
 class ContextRenderer {
   lastCompactionShown = 0;
@@ -21481,6 +21813,7 @@ class HallucinationGate {
       return { action: "warn" };
     }
     if (result.status === "retry") {
+      this.retractDraft(deps, result.kind ?? "retry", result.reason ?? "");
       return this.applyRetry(deps, textContent, result);
     }
     const claimRetry = this.checkSuccessClaim(deps, textContent);
@@ -21529,30 +21862,35 @@ class HallucinationGate {
         return this.retryClaim(deps, textContent, t("hall.claim_contradiction", {
           tool: contradiction.tool,
           snippet: contradiction.snippet
-        }), `Success-claim contradiction: ${contradiction.tool}: ${contradiction.snippet}`);
+        }), `Success-claim contradiction: ${contradiction.tool}: ${contradiction.snippet}`, "success");
       }
     }
     if (state.artifactClaimRetries < MAX_CLAIM_CHECK_RETRIES && deps.artifacts && deps.artifacts.length > 0) {
       const artifact = checkArtifactClaims(text, deps.artifacts);
       if (artifact) {
         state.artifactClaimRetries++;
-        return this.retryClaim(deps, textContent, t("hall.claim_artifact", { path: artifact.path, detail: artifact.snippet }), `Artifact-claim contradiction: ${artifact.snippet}`);
+        return this.retryClaim(deps, textContent, t("hall.claim_artifact", { path: artifact.path, detail: artifact.snippet }), `Artifact-claim contradiction: ${artifact.snippet}`, "artifact");
       }
     }
     if (state.outputClaimRetries < MAX_CLAIM_CHECK_RETRIES) {
       const unverified = checkUnverifiedOutput(text, evidence);
       if (unverified) {
         state.outputClaimRetries++;
-        return this.retryClaim(deps, textContent, t("hall.claim_output_unverified", { detail: unverified.snippet }), `Unverified output: ${unverified.snippet}`);
+        return this.retryClaim(deps, textContent, t("hall.claim_output_unverified", { detail: unverified.snippet }), `Unverified output: ${unverified.snippet}`, "output");
       }
     }
     return null;
   }
-  retryClaim(deps, textContent, reason, logLine) {
+  retractDraft(deps, kind, reason) {
+    deps.onMeta?.(t("ui.draft_retracted"), "retract");
+    deps.slog?.logClaimRetry({ kind, reason, iteration: deps.state.iteration });
+  }
+  retryClaim(deps, textContent, reason, logLine, kind) {
     const { state, logger: logger3 } = deps;
     state.iterHallucinationRetry = true;
     state.suppressRepetitionRetry = true;
     logger3.diagnostic("warn", logLine);
+    this.retractDraft(deps, kind, reason);
     if (textContent) {
       deps.contextManager.addMessage({ role: "assistant", content: textContent });
     }
@@ -21611,27 +21949,30 @@ function resolveArtifactStates(baseDir, response) {
     const rel = relative6(baseDir, abs);
     if (rel.startsWith("..") || isAbsolute4(rel))
       continue;
-    const state = resolveOneArtifact(token, abs);
+    const state = resolveOneArtifact(token, baseDir);
     if (state)
       out.push(state);
   }
   return out;
 }
-function resolveOneArtifact(token, abs) {
+function resolveOneArtifact(token, baseDir) {
+  const found = findExistingFile(baseDir, token);
+  if (!found)
+    return { path: token, exists: false };
   let size;
   try {
-    const st = statSync8(abs);
+    const st = statSync8(found);
     if (!st.isFile())
       return { path: token, exists: false };
     size = st.size;
   } catch {
-    return { path: token, exists: false };
+    return { path: token, exists: true };
   }
   if (size > MAX_BYTES)
     return { path: token, exists: true };
   let content;
   try {
-    content = readFileSync25(abs, "utf-8");
+    content = readFileSync25(found, "utf-8");
   } catch {
     return { path: token, exists: true };
   }
@@ -21641,6 +21982,7 @@ var MAX_PATHS = 10, MAX_BYTES, JSON_EXTS, XML_EXTS;
 var init_artifact_resolve = __esm(() => {
   init_js_identifiers();
   init_syntax_validator();
+  init_auditor();
   MAX_BYTES = 500 * 1024;
   JSON_EXTS = new Set([".json", ".jsonc"]);
   XML_EXTS = new Set([".xml", ".drawio", ".svg", ".xaml", ".plist", ".iml"]);
@@ -21678,6 +22020,7 @@ class AuditGate {
       return { action: "exhausted", summary: audit.summary };
     }
     state.suppressRepetitionRetry = true;
+    deps.onMeta?.(t("ui.draft_retracted"), "retract");
     return { action: "reject" };
   }
 }
@@ -21689,10 +22032,17 @@ var init_audit_gate = __esm(() => {
 function issueSignature(issue) {
   return `${issue.severity}:${issue.claim}`.toLowerCase().replace(/\s+/g, " ").slice(0, 120);
 }
+function normalizedSignature(issue) {
+  const body = `${issue.severity}:${issue.claim}`.toLowerCase().replace(/[^a-z0-9а-яё\s]/gi, " ").replace(/\s+/g, " ").trim().slice(0, 120);
+  return `~${body}`;
+}
 function renderIssues(issues) {
   return issues.slice(0, 5).map((i) => `- [${i.severity}] ${i.problem || i.claim}${i.suggestion ? ` → ${i.suggestion}` : ""}`).join(`
 `);
 }
+function isRepeatedVerdict(state, issues) {
+  return issues.length > 0 && issues.every((i) => state.seenCriticIssues.has(normalizedSignature(i)));
+}
 
 class CriticGate {
   opts;
@@ -21708,18 +22058,26 @@ class CriticGate {
     const verdict = await this.verifySafely(deps);
     if (!verdict || verdict.status === "ok")
       return "pass";
+    const isRepeat = isRepeatedVerdict(deps.state, verdict.issues);
     const fresh = this.takeFreshIssues(deps.state, verdict.issues);
     if (fresh.length === 0)
       return "pass";
     this.logVerdict(deps, verdict, fresh.length);
-    const canRepair = verdict.status === "critical" && deps.beforeFinish && deps.state.criticRepairCycles < this.opts.maxRepairCycles;
-    this.inject(deps, verdict, fresh, canRepair);
+    if (!this.shouldRepair(deps, verdict, isRepeat)) {
+      this.injectRepeatOrAdvice(deps, fresh, isRepeat);
+      return "pass";
+    }
+    this.injectRepair(deps, verdict, fresh);
     return "retry";
   }
+  shouldRepair(deps, verdict, isRepeat) {
+    return verdict.status === "critical" && deps.beforeFinish && deps.state.criticRepairCycles < this.opts.maxRepairCycles && !isRepeat;
+  }
   async verifySafely(deps) {
     try {
       return await this.opts.verify(this.opts.buildPack(deps), this.opts.signal);
-    } catch {
+    } catch (err) {
+      deps.logger.diagnostic("warn", `Critic verify failed (fail-open): ${String(err?.message ?? err)}`);
       return null;
     }
   }
@@ -21728,9 +22086,8 @@ class CriticGate {
       return false;
     if (deps.state.criticCalls >= this.opts.maxCalls)
       return false;
-    if (!deps.beforeFinish && deps.state.mutationsSinceCritic < MUTATIONS_BEFORE_CHECK) {
+    if (!deps.beforeFinish)
       return false;
-    }
     return deps.toolEvents.length !== 0;
   }
   takeFreshIssues(state, issues) {
@@ -21740,6 +22097,7 @@ class CriticGate {
       if (state.seenCriticIssues.has(sig))
         continue;
       state.seenCriticIssues.add(sig);
+      state.seenCriticIssues.add(normalizedSignature(issue));
       fresh.push(issue);
     }
     return fresh;
@@ -21760,15 +22118,15 @@ class CriticGate {
     });
     deps.logger.diagnostic("info", `Critic ${verdict.status}: ${verdict.summary} (${count} issue(s))`);
   }
-  inject(deps, verdict, fresh, canRepair) {
-    if (!canRepair) {
-      deps.contextManager.addMessage({
-        role: "user",
-        content: `<system-summary>${t("critic.advice", { issues: renderIssues(fresh) })}</system-summary>`
-      });
-      return;
-    }
+  injectRepeatOrAdvice(deps, fresh, isRepeat) {
+    deps.contextManager.addMessage({
+      role: "user",
+      content: `<system-summary>${isRepeat ? t("critic.repeat", { issues: renderIssues(fresh) }) : t("critic.advice", { issues: renderIssues(fresh) })}</system-summary>`
+    });
+  }
+  injectRepair(deps, verdict, fresh) {
     deps.state.criticRepairCycles++;
+    deps.onMeta?.(t("ui.draft_retracted"), "retract");
     deps.slog.logCritic("critic_escalation", {
       summary: verdict.summary,
       cycle: deps.state.criticRepairCycles
@@ -21782,9 +22140,11 @@ class CriticGate {
     });
   }
 }
-function gatherTurnToolEvents(contextManager) {
+function gatherTurnToolEvents(contextManager, fromIndex = 0) {
   const events = [];
-  for (const m of contextManager.getActiveHistory()) {
+  const history = contextManager.getActiveHistory();
+  const start = Math.max(0, Math.min(fromIndex, history.length));
+  for (const m of history.slice(start)) {
     if (m.role !== "tool" || !m.name)
       continue;
     const output = typeof m.content === "string" ? m.content.slice(-MAX_EVENT_OUTPUT_CHARS) : undefined;
@@ -21792,7 +22152,7 @@ function gatherTurnToolEvents(contextManager) {
   }
   return events;
 }
-var MUTATIONS_BEFORE_CHECK = 3, MAX_EVENT_OUTPUT_CHARS = 600;
+var MAX_EVENT_OUTPUT_CHARS = 600;
 var init_critic_gate = __esm(() => {
   init_i18n();
 });
@@ -21979,7 +22339,9 @@ ${f.excerpt}`);
     pack.toolDigest || "(empty)",
     files.length > 0 ? `FILE CONTENTS:
 ${files.join(`
-`)}` : ""
+`)}` : "",
+    pack.answerExcerpt ? `ANSWER (the agent's chat delivery — may satisfy the task without files):
+${pack.answerExcerpt}` : ""
   ].filter(Boolean).join(`
 `);
 }
@@ -22033,6 +22395,7 @@ Rules:
 - Flag ONLY issues that can be verified from the evidence provided. Do not speculate or invent.
 - Do not nitpick style, wording, or preferences unless the user's task demanded it.
 - If the evidence is insufficient to judge, return status "ok" (prefer silence over noise).
+- A chat-delivered answer (ANSWER section) can fully satisfy the task without any files or commands; absence of changed files is NOT itself an issue when ANSWER contains the requested result.
 - "critical" = the task's stated result is demonstrably not delivered. "concern" = a concrete, checkable gap. "info" = minor.
 - Every issue must reference concrete evidence (file, command, output).
 Reply with JSON ONLY:
@@ -22047,8 +22410,12 @@ var init_client = __esm(() => {
 // src/modules/critic/provider.ts
 function buildCriticProvider(critic, config, defaultProvider, deps) {
   const model = critic?.model?.trim();
-  if (!model)
+  if (!model) {
+    if (critic?.provider && Object.keys(critic.provider).length > 0) {
+      deps?.logger?.warn("critic.provider is set without critic.model — provider ignored, using active provider");
+    }
     return defaultProvider;
+  }
   try {
     const providerCfg = critic?.provider ?? {
       type: "openai-compat",
@@ -22106,7 +22473,8 @@ function buildEvidencePack(input) {
     commands,
     toolDigest: digest.slice(-MAX_DIGEST_LINES).join(`
 `),
-    fileExcerpts: input.baseDir ? readExcerpts(input.baseDir, [...changedFiles]) : undefined
+    fileExcerpts: input.baseDir ? readExcerpts(input.baseDir, [...changedFiles]) : undefined,
+    answerExcerpt: input.answerText ? redactContextSecrets(input.answerText).slice(0, MAX_ANSWER_CHARS) : undefined
   };
 }
 function digestLine(ev) {
@@ -22127,7 +22495,7 @@ function commandOf(ev) {
     return;
   return {
     command: ev.args.command,
-    exitCode: ev.ok === false ? 1 : 0,
+    exitCode: ev.ok === false ? 1 : undefined,
     output: ev.output?.slice(-MAX_DIGEST_OUTPUT_CHARS)
   };
 }
@@ -22145,9 +22513,10 @@ function readExcerpts(baseDir, paths) {
   }
   return out;
 }
-var MUTATING_TOOLS, MAX_DIGEST_LINES = 40, MAX_DIGEST_OUTPUT_CHARS = 300, MAX_EXCERPT_FILES = 5, MAX_EXCERPT_CHARS = 1200;
+var MUTATING_TOOLS, MAX_DIGEST_LINES = 40, MAX_DIGEST_OUTPUT_CHARS = 300, MAX_EXCERPT_FILES = 5, MAX_EXCERPT_CHARS = 1200, MAX_ANSWER_CHARS = 2000;
 var init_evidence = __esm(() => {
   init_tool_output();
+  init_context_log();
   MUTATING_TOOLS = new Set(["write_file", "edit_file", "delete_file", "move_file", "create_dir"]);
 });
 
@@ -22842,6 +23211,7 @@ class Agent {
     } = this.deps;
     this.abortController = new AbortController;
     const state = createLoopState();
+    state.criticHistoryMark = contextManager.getActiveHistory().length;
     const compactionService = new CompactionService({
       contextManager,
       logger: logger3,
@@ -22899,7 +23269,8 @@ class Agent {
         task: d.task,
         planSummary: d.planSummary,
         toolEvents: d.toolEvents,
-        baseDir: this.deps.baseDir
+        baseDir: this.deps.baseDir,
+        answerText: d.answerText
       }),
       signal: this.abortController?.signal
     });
@@ -22927,7 +23298,7 @@ class Agent {
       });
       compactionService.compactIfNeeded(state);
       this.refreshSystemPrompt();
-      const history = contextManager.getActiveHistory();
+      const history = repairToolCallPairing(contextManager.getActiveHistory());
       const promptSnapshot = buildPromptSnapshot(history, allToolsForBudget);
       state.prefixDelta = diffPrompt(state.prevPrompt, promptSnapshot, estimateTokens);
       state.prevPrompt = promptSnapshot;
@@ -23180,7 +23551,8 @@ class Agent {
         onMeta,
         onChunk,
         verbose: resolveVerbosity(this.deps.config.ui) === "verbose",
-        artifacts: resolveArtifactStates(this.deps.baseDir, textContent)
+        artifacts: resolveArtifactStates(this.deps.baseDir, textContent),
+        slog
       });
       if (verdict.action === "block") {
         return {
@@ -23233,8 +23605,10 @@ class Agent {
         slog,
         task: input,
         planSummary: this.deps.planSummary?.() ?? undefined,
-        toolEvents: gatherTurnToolEvents(contextManager),
-        beforeFinish: true
+        toolEvents: gatherTurnToolEvents(contextManager, state.criticHistoryMark),
+        beforeFinish: true,
+        answerText: state.mutationsSinceCritic === 0 ? textContent : undefined,
+        onMeta
       });
       if (criticAction === "retry") {
         state.suppressRepetitionRetry = true;
@@ -23246,7 +23620,8 @@ class Agent {
         maxIterations: config.maxToolIterations,
         logger: logger3,
         contextManager,
-        slog
+        slog,
+        onMeta
       });
       if (auditVerdict === null || auditVerdict.action === "pass") {
         state.finalAnswerAccepted = true;
@@ -23351,6 +23726,13 @@ class Agent {
     if (this.deps.configRef)
       this.deps.configRef.current = config;
     this.costTracker.setModel(config.model);
+    this.applyReasoningStrategy(config.provider);
+  }
+  applyReasoningStrategy(provider) {
+    const strategy = reasoningStrategyForProvider(provider);
+    this.deps.reasoningStrategy = strategy;
+    if (strategy === "none")
+      this.probePassed = false;
   }
   setProvider(name, model) {
     const { manager, provider } = buildActiveProvider(this.deps.config, this.deps.logger, {
@@ -23359,6 +23741,7 @@ class Agent {
     manager.switch(name, model);
     const providerCfg = manager.toConfig();
     this.deps.config.provider = providerCfg;
+    this.applyReasoningStrategy(providerCfg);
     this.deps.llmProvider = provider;
     this.deps.getProviderName = () => manager.activeName;
     this.deps.toolExecutor.updateProvider(provider);
@@ -30508,6 +30891,33 @@ class PlanStore {
   activePath() {
     return join44(this.plansDir, "active.json");
   }
+  sessionsDir() {
+    return join44(this.plansDir, "sessions");
+  }
+  sessionActivePath(sessionId) {
+    if (!/^[A-Za-z0-9_-]+$/.test(sessionId)) {
+      throw new Error(`invalid session id: ${sessionId}`);
+    }
+    return join44(this.sessionsDir(), sessionId, "active.json");
+  }
+  saveSessionActive(sessionId, plan) {
+    const p = this.sessionActivePath(sessionId);
+    const dir = join44(this.sessionsDir(), sessionId);
+    if (!existsSync50(dir))
+      mkdirSync24(dir, { recursive: true });
+    writePlanFile(p, plan);
+  }
+  loadSessionActive(sessionId) {
+    const p = this.sessionActivePath(sessionId);
+    if (!existsSync50(p))
+      return null;
+    return readPlanFile(p, this.baseDir);
+  }
+  clearSessionActive(sessionId) {
+    const p = this.sessionActivePath(sessionId);
+    if (existsSync50(p))
+      rmSync3(p, { force: true });
+  }
   saveActive(plan) {
     writePlanFile(this.activePath(), plan);
   }
@@ -31033,7 +31443,7 @@ Last compile error: ${first[1]}`;
         }
       }
       if (result.success && FS_MUTATING_TOOLS.has(call.name)) {
-        deps.advancePlanIfStepComplete(ctx.contextManager, ctx.sessionLog);
+        deps.advancePlanIfStepComplete(ctx.sessionLog);
       }
       deps.maybeSearchError(ctx, call);
     }
@@ -31982,6 +32392,7 @@ function planPathToken(p) {
 class ExecutionModule {
   name = "execution";
   tracker = null;
+  sessionId = null;
   verifier;
   stuckDetector;
   auditor;
@@ -32018,9 +32429,20 @@ class ExecutionModule {
       },
       set current(v) {
         self.tracker = v;
+        self.flushSessionPlan();
       }
     };
   })();
+  flushSessionPlan() {
+    if (!this.sessionId)
+      return;
+    try {
+      if (this.tracker)
+        this.store.saveSessionActive(this.sessionId, this.tracker.getPlan());
+      else
+        this.store.clearSessionActive(this.sessionId);
+    } catch {}
+  }
   constructor(baseDir, stuckThreshold = 6, webSearchThreshold = 5, searchRunner = performWebSearch, errorSearchCooldownMs = EXECUTION_ERROR_SEARCH_MIN_INTERVAL_MS) {
     this.baseDir = baseDir;
     this.verifier = new StepVerifier(baseDir);
@@ -32034,9 +32456,69 @@ class ExecutionModule {
     this.tracker = new PlanTracker(plan);
     this.tracker.syncCurrentStep();
     this.store.saveActive(plan);
+    if (this.sessionId) {
+      try {
+        this.store.saveSessionActive(this.sessionId, plan);
+      } catch {}
+    }
     this.completedPlan = null;
     this._auditSkipsRemaining = 0;
   }
+  switchSession(id) {
+    const prev = this.sessionId;
+    if (prev === id)
+      return;
+    if (this.tracker) {
+      try {
+        this.store.saveSessionActive(prev ?? id ?? "", this.tracker.getPlan());
+      } catch {}
+    } else if (prev) {
+      try {
+        this.store.clearSessionActive(prev);
+      } catch {}
+    }
+    this.sessionId = id;
+    this.completedPlan = null;
+    if (!id) {
+      this.tracker = null;
+      this._auditSkipsRemaining = 0;
+      return;
+    }
+    let plan = null;
+    try {
+      plan = this.store.loadSessionActive(id);
+    } catch {
+      plan = null;
+    }
+    if (!plan) {
+      this.tracker = null;
+      this._auditSkipsRemaining = 0;
+      return;
+    }
+    const restored = new PlanTracker(plan);
+    if (restored.isComplete()) {
+      this.store.archivePlan(plan);
+      try {
+        this.store.clearSessionActive(id);
+      } catch {}
+      this.tracker = null;
+      return;
+    }
+    this.tracker = restored;
+    this.tracker.syncCurrentStep();
+    this._auditSkipsRemaining = 1;
+  }
+  forgetSession(id) {
+    try {
+      this.store.clearSessionActive(id);
+    } catch {}
+    if (this.sessionId === id) {
+      this.sessionId = null;
+      this.tracker = null;
+      this.completedPlan = null;
+      this._auditSkipsRemaining = 0;
+    }
+  }
   setHallucinationDetector(detector) {
     this.hallucinationDetector = detector;
   }
@@ -32167,6 +32649,7 @@ class ExecutionModule {
       const done2 = plan2.steps.filter((s) => s.status === "done").length;
       if (autoClosed2 > 0) {
         this.store.saveActive(plan2);
+        this.flushSessionPlan();
       }
       return {
         passed: audit2.passed && pendingSteps2.length === 0,
@@ -32185,6 +32668,7 @@ class ExecutionModule {
     const autoClosed = this.autoCloseEvidenceSteps(plan);
     if (autoClosed > 0) {
       this.store.saveActive(plan);
+      this.flushSessionPlan();
     }
     const audit = await this.auditor.audit(plan);
     const pendingSteps = plan.steps.flatMap((s) => s.status !== "done" && s.status !== "skipped" ? [`${s.id}. ${s.description}`] : []);
@@ -32261,7 +32745,7 @@ class ExecutionModule {
       state: this.state,
       store: this.store,
       checkPlanAlignment: (call) => this.checkPlanAlignment(call),
-      advancePlanIfStepComplete: (cm, sl) => this.advancePlanIfStepComplete(cm, sl),
+      advancePlanIfStepComplete: (sl) => this.advancePlanIfStepComplete(sl),
       maybeSearchError: (ctx, call) => this.maybeSearchError(ctx, call)
     });
   }
@@ -32330,7 +32814,7 @@ class ExecutionModule {
     }
     return out;
   }
-  advancePlanIfStepComplete(contextManager, sessionLog) {
+  advancePlanIfStepComplete(sessionLog) {
     const step = this.tracker?.getCurrentStep();
     if (!step)
       return;
@@ -32352,19 +32836,17 @@ class ExecutionModule {
       ];
       const hasLockFile = lockFiles.some((f) => existsSync51(resolve22(this.baseDir, f)));
       if (!hasLockFile) {
-        if (contextManager) {
-          const hints = this.state.depsGateHints.get(step.id) || 0;
-          this.state.depsGateHints.set(step.id, hints + 1);
-          const force = hints >= 1;
-          const content = force ? t("exec.step_gate_deps_force", { step: String(step.id) }) : t("exec.step_gate_deps", {
-            step: String(step.id),
-            description: step.description
-          });
-          contextManager.addMessage({
-            role: "user",
-            content: `<system-summary>${content}</system-summary>`
-          });
-        }
+        const hints = this.state.depsGateHints.get(step.id) || 0;
+        this.state.depsGateHints.set(step.id, hints + 1);
+        const force = hints >= 1;
+        const content = force ? t("exec.step_gate_deps_force", { step: String(step.id) }) : t("exec.step_gate_deps", {
+          step: String(step.id),
+          description: step.description
+        });
+        this.pendingMessages.push({
+          role: "user",
+          content: `<system-summary>${content}</system-summary>`
+        });
         return;
       }
     }
@@ -32388,8 +32870,8 @@ class ExecutionModule {
           }
         } catch {}
       }
-      if (emptyFiles.length > 0 && contextManager) {
-        contextManager.addMessage({
+      if (emptyFiles.length > 0) {
+        this.pendingMessages.push({
           role: "user",
           content: `<system-summary>${t("exec.step_gate_empty", { step: String(step.id), files: emptyFiles.join(", ") })}</system-summary>`
         });
@@ -32400,25 +32882,25 @@ class ExecutionModule {
     const hadNext = this.tracker?.advance() ?? false;
     if (this.tracker) {
       this.store.saveActive(this.tracker.getPlan());
+      this.flushSessionPlan();
       sessionLog?.plan("auto-advance", `Step ${step.id} auto-completed | ${this.tracker.getProgressString()} | current: step ${this.tracker.getCurrentStepIndex() + 1}`);
     }
-    if (contextManager) {
-      const nextStep = hadNext ? this.tracker?.getCurrentStep() : null;
-      const nextMsg = nextStep ? t("exec.step_gate_ok", {
-        step: String(step.id),
-        nextStep: String(nextStep.id),
-        nextDesc: nextStep.description
-      }) : t("exec.step_gate_last", { step: String(step.id) });
-      contextManager.addMessage({
-        role: "user",
-        content: `<system-summary>${nextMsg}</system-summary>`
-      });
-    }
+    const nextStep = hadNext ? this.tracker?.getCurrentStep() : null;
+    const nextMsg = nextStep ? t("exec.step_gate_ok", {
+      step: String(step.id),
+      nextStep: String(nextStep.id),
+      nextDesc: nextStep.description
+    }) : t("exec.step_gate_last", { step: String(step.id) });
+    this.pendingMessages.push({
+      role: "user",
+      content: `<system-summary>${nextMsg}</system-summary>`
+    });
     if (this.tracker?.isComplete()) {
       const completed = this.tracker.getPlan();
       this.store.archivePlan(completed);
       this.recordCompleted(completed);
       this.tracker = null;
+      this.flushSessionPlan();
       sessionLog?.plan("auto-archive", `Plan ${completed.id} complete — archived`);
     }
   }
@@ -33777,6 +34259,9 @@ async function registerCoreModules(input, moduleRegistry) {
   const { config, logger: logger5, dir, baseDir, hallucinationDetector } = input;
   const execModule = new ExecutionModule(baseDir, config.stuckThreshold, config.errorWebSearch?.threshold ?? 5);
   execModule.restorePlan();
+  try {
+    execModule.switchSession(input.sessionManager.getActive());
+  } catch {}
   moduleRegistry.register(execModule);
   execModule.setHallucinationDetector(hallucinationDetector);
   const sessionModule = new SessionModule(input.sessionManager);
@@ -34746,6 +35231,40 @@ var init_box = __esm(() => {
 });
 
 // src/modules/setup/answers.ts
+function securityDetailFromConfig(s) {
+  return {
+    bash: {
+      blacklist: [...s.bash.blacklist],
+      whitelist: [...s.bash.whitelist],
+      logCommands: s.bash.logCommands
+    },
+    paths: { denied: [...s.paths.denied], allowed: [...s.paths.allowed] },
+    flags: {
+      dangerousFlags: [...s.bash.dangerousFlags],
+      dangerousOperators: [...s.bash.dangerousOperators]
+    },
+    network: {
+      enabled: s.network.enabled,
+      deniedDomains: [...s.network.deniedDomains],
+      allowedDomains: [...s.network.allowedDomains],
+      requestTimeout: s.network.requestTimeout,
+      maxResponseSize: s.network.maxResponseSize
+    },
+    advanced: {
+      maxRecursionDepth: s.maxRecursionDepth,
+      maxFileOperations: s.maxFileOperations,
+      maxRequestsPerMinute: s.rateLimits.maxRequestsPerMinute,
+      maxParallelTasks: s.rateLimits.maxParallelTasks,
+      contentScanEnabled: s.contentScan.enabled,
+      sessionEncryptionEnabled: s.sessionEncryption.enabled,
+      auditNotifierEnabled: s.auditNotifier.enabled,
+      auditNotifierMinSeverity: s.auditNotifier.minSeverity ?? "medium",
+      auditNotifierEventTypes: [...s.auditNotifier.eventTypes ?? []],
+      auditNotifierMaxRetries: s.auditNotifier.maxRetries ?? 3,
+      auditNotifierWebhookTimeout: s.auditNotifier.webhookTimeout ?? 5000
+    }
+  };
+}
 function buildSetupDisplay() {
   const providers = BUILTIN_PROVIDERS.map((spec) => {
     const option = { type: spec.type, label: spec.label };
@@ -35135,20 +35654,62 @@ function applyAnswersToConfig(config, a) {
     config.provider.entries = next;
     config.provider.active = updated.label || updated.type;
   }
-  if (config.security) {
-    config.security.enabled = true;
-    config.security.bash.enabled = true;
-    config.security.bash.blockDangerousFlags = a.securityFlagsBlock || config.security.bash.blockDangerousFlags;
-    if (a.securityBashBlock) {
-      config.security.bash.blacklist = [
-        ...new Set([...config.security.bash.blacklist, ...SECURITY_BASH_BLOCKLIST])
-      ];
-    }
-    config.security.paths.enabled = a.securityPathsRestrict;
-  }
+  applySecurityAnswers(config, a);
   return config;
 }
-var SECURITY_BASH_BLOCKLIST;
+function applySecurityAnswers(config, a) {
+  if (!config.security)
+    return;
+  config.security.enabled = true;
+  config.security.bash.enabled = true;
+  config.security.bash.blockDangerousFlags = a.securityFlagsBlock || config.security.bash.blockDangerousFlags;
+  if (a.securityBashBlock) {
+    config.security.bash.blacklist = [
+      ...new Set([...config.security.bash.blacklist, ...SECURITY_BASH_BLOCKLIST])
+    ];
+  }
+  config.security.paths.enabled = a.securityPathsRestrict;
+  if (a.securityDetail)
+    applySecurityDetail(config.security, a.securityDetail);
+}
+function readPath(obj, path) {
+  let cur = obj;
+  for (const key of path.split(".")) {
+    if (cur === null || typeof cur !== "object")
+      return;
+    cur = cur[key];
+  }
+  return cur;
+}
+function writePath(obj, path, value) {
+  const keys = path.split(".");
+  let cur = obj;
+  for (let i = 0;i < keys.length - 1; i++) {
+    if (cur[keys[i]] === null || typeof cur[keys[i]] !== "object")
+      cur[keys[i]] = {};
+    cur = cur[keys[i]];
+  }
+  cur[keys[keys.length - 1]] = value;
+}
+function isFieldValue(v, kind) {
+  if (kind === "list")
+    return Array.isArray(v) && v.every((x) => typeof x === "string");
+  if (kind === "bool")
+    return typeof v === "boolean";
+  if (kind === "int")
+    return typeof v === "number" && Number.isInteger(v) && v > 0;
+  return typeof v === "string" && SEVERITIES2.includes(v);
+}
+function applySecurityDetail(security, detail) {
+  const target = security;
+  for (const field of DETAIL_FIELDS) {
+    const value = readPath(detail, field.from);
+    if (!isFieldValue(value, field.kind))
+      continue;
+    writePath(target, field.to, Array.isArray(value) ? [...value] : value);
+  }
+}
+var SECURITY_BASH_BLOCKLIST, SEVERITIES2, DETAIL_FIELDS;
 var init_apply = __esm(() => {
   SECURITY_BASH_BLOCKLIST = [
     "rm",
@@ -35168,6 +35729,32 @@ var init_apply = __esm(() => {
     "shutdown",
     "reboot"
   ];
+  SEVERITIES2 = ["low", "medium", "high", "critical"];
+  DETAIL_FIELDS = [
+    { from: "bash.blacklist", to: "bash.blacklist", kind: "list" },
+    { from: "bash.whitelist", to: "bash.whitelist", kind: "list" },
+    { from: "bash.logCommands", to: "bash.logCommands", kind: "bool" },
+    { from: "paths.denied", to: "paths.denied", kind: "list" },
+    { from: "paths.allowed", to: "paths.allowed", kind: "list" },
+    { from: "flags.dangerousFlags", to: "bash.dangerousFlags", kind: "list" },
+    { from: "flags.dangerousOperators", to: "bash.dangerousOperators", kind: "list" },
+    { from: "network.enabled", to: "network.enabled", kind: "bool" },
+    { from: "network.deniedDomains", to: "network.deniedDomains", kind: "list" },
+    { from: "network.allowedDomains", to: "network.allowedDomains", kind: "list" },
+    { from: "network.requestTimeout", to: "network.requestTimeout", kind: "int" },
+    { from: "network.maxResponseSize", to: "network.maxResponseSize", kind: "int" },
+    { from: "advanced.maxRecursionDepth", to: "maxRecursionDepth", kind: "int" },
+    { from: "advanced.maxFileOperations", to: "maxFileOperations", kind: "int" },
+    { from: "advanced.maxRequestsPerMinute", to: "rateLimits.maxRequestsPerMinute", kind: "int" },
+    { from: "advanced.maxParallelTasks", to: "rateLimits.maxParallelTasks", kind: "int" },
+    { from: "advanced.contentScanEnabled", to: "contentScan.enabled", kind: "bool" },
+    { from: "advanced.sessionEncryptionEnabled", to: "sessionEncryption.enabled", kind: "bool" },
+    { from: "advanced.auditNotifierEnabled", to: "auditNotifier.enabled", kind: "bool" },
+    { from: "advanced.auditNotifierMinSeverity", to: "auditNotifier.minSeverity", kind: "severity" },
+    { from: "advanced.auditNotifierEventTypes", to: "auditNotifier.eventTypes", kind: "list" },
+    { from: "advanced.auditNotifierMaxRetries", to: "auditNotifier.maxRetries", kind: "int" },
+    { from: "advanced.auditNotifierWebhookTimeout", to: "auditNotifier.webhookTimeout", kind: "int" }
+  ];
 });
 
 // src/cli/setup-order.ts
@@ -35914,6 +36501,14 @@ function getConfigValue(config, name) {
   const value = def.get(config);
   return { ok: true, key: def.key, def, value, display: formatConfigValue(value) };
 }
+function mirrorActiveEntryFields(provider, activeName) {
+  const entry = (provider.entries ?? []).find((e) => e.label === activeName || e.type === activeName);
+  if (!entry)
+    return;
+  provider.type = entry.type;
+  provider.baseUrl = entry.baseUrl;
+  provider.apiKey = entry.apiKey;
+}
 function applyProviderModelMemory(config, key, value) {
   const provider = config.provider;
   const activeName = provider.active ?? provider.type;
@@ -35927,6 +36522,7 @@ function applyProviderModelMemory(config, key, value) {
     const remembered = provider.models?.[String(value)];
     if (remembered)
       config.model = remembered;
+    mirrorActiveEntryFields(provider, String(value));
   }
 }
 function setConfigValue(config, name, raw) {
@@ -45457,8 +46053,9 @@ function registerProviderCommands(ctx) {
   const list2 = () => {
     const providers = ctx.agent.listProviders();
     if (providers.length === 0) {
-      ctx.output.writeLine(`${t("repl.provider_current")}  ${ctx.config.provider.type}`);
-      ctx.output.writeLine(`  ${ctx.config.provider.baseUrl}`);
+      const endpoint = activeProviderEndpoint(ctx.config.provider);
+      ctx.output.writeLine(`${t("repl.provider_current")}  ${endpoint.type}`);
+      ctx.output.writeLine(`  ${endpoint.baseUrl}`);
       return;
     }
     ctx.output.writeLine(t("repl.provider_current"));
@@ -45720,7 +46317,8 @@ function registerAgentCommands(ctx) {
       ctx.output.writeLine(pc.green(t("repl.reloaded")));
       ctx.output.writeLine(`${t("repl.model")}       ${ctx.config.model}`);
       ctx.output.writeLine(`${t("repl.context")}     ${ctx.config.contextWindow}`);
-      ctx.output.writeLine(`${t("repl.provider")}    ${ctx.config.provider.type} @ ${ctx.config.provider.baseUrl}`);
+      const endpoint = activeProviderEndpoint(ctx.config.provider);
+      ctx.output.writeLine(`${t("repl.provider")}    ${endpoint.type} @ ${endpoint.baseUrl}`);
     }
   });
   ctx.registerCommand({
@@ -45826,6 +46424,10 @@ function registerSessionCommands(ctx) {
       const name = args.join(" ") || undefined;
       const meta = ctx.sessionManager.create(name);
       ctx.agent.clearContext();
+      const exec = ctx.agent.getModule("execution");
+      try {
+        exec?.switchSession(meta.id);
+      } catch {}
       ctx.output.clearScreen();
       ctx.output.writeLine(`${t("session.created", { name: meta.name })} (${pc.dim(meta.id.slice(0, 12))})`);
       ctx.output.writeLine(pc.dim(`  ${t("session.chat_cleared")}
@@ -45860,6 +46462,12 @@ function registerSessionCommands(ctx) {
       ctx.sessionManager.setActive(match.id);
       const history = ctx.sessionManager.loadHistory();
       ctx.agent.setContext(history);
+      const exec = ctx.agent.getModule("execution");
+      let planLine = null;
+      try {
+        exec?.switchSession(match.id);
+        planLine = exec?.getPlanSummary() ?? null;
+      } catch {}
       ctx.output.clearScreen();
       ctx.output.writeLine(pc.bold(pc.green(t("session.resumed", { name: match.name }))) + " " + pc.dim(`(${match.id.slice(0, 12)})`) + "  —  " + match.messageCount + " " + t("repl.msgs"));
       ctx.output.writeLine(pc.dim("─".repeat(50)));
@@ -45882,6 +46490,7 @@ function registerSessionCommands(ctx) {
       }
       ctx.output.writeLine(pc.dim("─".repeat(50)));
       ctx.output.writeLine(pc.dim(`  ${t("session.chat_loaded")}`));
+      ctx.output.writeLine(pc.dim(`  ◇ ${planLine ?? t("plan.no_active")}`));
     }
   });
   ctx.registerCommand({
@@ -45921,6 +46530,9 @@ function registerSessionCommands(ctx) {
         return;
       }
       ctx.sessionManager.delete(match.id);
+      try {
+        ctx.agent.getModule("execution")?.forgetSession(match.id);
+      } catch {}
       ctx.output.writeLine(`${t("session.deleted", { id: match.id })}: ${match.name}`);
     }
   });
@@ -46031,6 +46643,7 @@ var init_repl_commands = __esm(() => {
   init_setup_order();
   init_config2();
   init_presets();
+  init_manager();
   init_budget();
   init_registry2();
   init_export();
@@ -47083,10 +47696,12 @@ function buildModelCommands(program2) {
     const { config } = await bootstrap();
     getDefaultChannel().writeLine(`${t("cli.current_model")} ${config.model}`);
     const { createProvider: createProvider2 } = await Promise.resolve().then(() => (init_create(), exports_create));
-    const provider = createProvider2(config.provider.type, {
+    const { activeProviderEndpoint: activeProviderEndpoint2 } = await Promise.resolve().then(() => (init_manager(), exports_manager));
+    const endpoint = activeProviderEndpoint2(config.provider);
+    const provider = createProvider2(endpoint.type, {
       model: config.model,
-      baseUrl: config.provider.baseUrl,
-      apiKey: config.provider.apiKey,
+      baseUrl: endpoint.baseUrl,
+      apiKey: endpoint.apiKey,
       contextWindow: config.contextWindow
     });
     const spinner = (await Promise.resolve().then(() => (init_spinner(), exports_spinner))).Spinner;
@@ -49692,6 +50307,7 @@ function adaptActivePlan(plan) {
 // src/cli/repl.ts
 init_repl_commands();
 init_registry2();
+init_manager();
 
 // src/modules/lsp/probe.ts
 init_client3();
@@ -50692,7 +51308,8 @@ ${divider()}`);
     const resBudget = Math.floor(ctx * this.config.contextBudget.responseReserve);
     const histBudget = ctx - sysBudget - resBudget;
     row(t("repl.model"), pc.white(this.config.model));
-    row(t("repl.provider"), `${this.config.provider.type}  →  ${pc.dim(this.config.provider.baseUrl)}`);
+    const endpoint = activeProviderEndpoint(this.config.provider);
+    row(t("repl.provider"), `${endpoint.type}  →  ${pc.dim(endpoint.baseUrl)}`);
     row(t("repl.context"), `${pc.white(String(ctx))}  ${pc.dim(`(sys:${sysBudget}  res:${resBudget}  hist:${histBudget})`)}`);
     const si = this.agent.getSystemPromptInfo();
     row(t("repl.sysprompt_label"), pc.dim(t("repl.sysprompt_size", { used: si.tokenCount, budget: sysBudget })));
@@ -51607,6 +52224,11 @@ function makeForwarder(s, sink = (ev) => broadcast(ev, s), opts = {}) {
       schedule();
     },
     onMeta(chunk, kind) {
+      if (kind === "retract") {
+        flush();
+        sink({ type: "retract", ts: Date.now(), reason: stripAnsi2(chunk) });
+        return;
+      }
       const next = kind ?? "status";
       if (buf.meta && (buf.metaKind ?? "status") !== next)
         flush();
@@ -52290,6 +52912,9 @@ function handleSessionCreate(req, res, s) {
     }
     try {
       const meta = create(name);
+      try {
+        s.execModule?.switchSession(meta.id);
+      } catch {}
       sendJson(res, 201, {
         ok: true,
         session: {
@@ -52330,6 +52955,9 @@ function handleSessionActivate(req, res, s) {
       sendJson(res, 404, { error: "not_found" });
       return;
     }
+    try {
+      s.execModule?.switchSession(id);
+    } catch {}
     sendJson(res, 200, { ok: true });
   }).catch((err) => {
     readBodyError(req, res, err);
@@ -52354,6 +52982,9 @@ function handleSessionDelete(res, id, s) {
     sendJson(res, 404, { error: "not_found" });
     return;
   }
+  try {
+    s.execModule?.forgetSession(id);
+  } catch {}
   sendJson(res, 200, { ok: true });
 }
 function handleSessionsApi(req, res, reqUrl, s) {
@@ -53408,9 +54039,11 @@ function servePreview(res, absReal, buf) {
 
 // src/modules/webui/setup-api.ts
 init_i18n();
+init_registry_extra();
 init_apply();
 init_answers();
 init_discovery();
+init_provider_context();
 function str3(rec, key) {
   const v = rec[key];
   return typeof v === "string" ? v.trim() : "";
@@ -53420,6 +54053,76 @@ function positiveInt(rec, key) {
   const n = typeof v === "number" ? v : typeof v === "string" ? Number(v) : NaN;
   return Number.isInteger(n) && n > 0 ? n : null;
 }
+var SEVERITIES3 = ["low", "medium", "high", "critical"];
+var MAX_DETAIL_LIST = 200;
+var MAX_DETAIL_ITEM = 200;
+function strList(v) {
+  if (!Array.isArray(v))
+    return;
+  const out = v.filter((x) => typeof x === "string").map((x) => x.trim()).filter((x) => x !== "" && x.length <= MAX_DETAIL_ITEM).slice(0, MAX_DETAIL_LIST);
+  return out;
+}
+function optBool(v) {
+  return typeof v === "boolean" ? v : undefined;
+}
+function optInt(v) {
+  const n = typeof v === "number" ? v : typeof v === "string" ? Number(v) : NaN;
+  return Number.isInteger(n) && n > 0 ? n : undefined;
+}
+function parseSecurityDetail(v) {
+  if (!v || typeof v !== "object")
+    return;
+  const rec = v;
+  const detail = {};
+  const bash = rec.bash;
+  if (bash && typeof bash === "object") {
+    detail.bash = {
+      blacklist: strList(bash.blacklist),
+      whitelist: strList(bash.whitelist),
+      logCommands: optBool(bash.logCommands)
+    };
+  }
+  const paths = rec.paths;
+  if (paths && typeof paths === "object") {
+    detail.paths = { denied: strList(paths.denied), allowed: strList(paths.allowed) };
+  }
+  const flags = rec.flags;
+  if (flags && typeof flags === "object") {
+    detail.flags = {
+      dangerousFlags: strList(flags.dangerousFlags),
+      dangerousOperators: strList(flags.dangerousOperators)
+    };
+  }
+  const network = rec.network;
+  if (network && typeof network === "object") {
+    detail.network = {
+      enabled: optBool(network.enabled),
+      deniedDomains: strList(network.deniedDomains),
+      allowedDomains: strList(network.allowedDomains),
+      requestTimeout: optInt(network.requestTimeout),
+      maxResponseSize: optInt(network.maxResponseSize)
+    };
+  }
+  const adv = rec.advanced;
+  if (adv && typeof adv === "object") {
+    const rawSev = adv.auditNotifierMinSeverity;
+    const sev = typeof rawSev === "string" && SEVERITIES3.includes(rawSev) ? rawSev : undefined;
+    detail.advanced = {
+      maxRecursionDepth: optInt(adv.maxRecursionDepth),
+      maxFileOperations: optInt(adv.maxFileOperations),
+      maxRequestsPerMinute: optInt(adv.maxRequestsPerMinute),
+      maxParallelTasks: optInt(adv.maxParallelTasks),
+      contentScanEnabled: optBool(adv.contentScanEnabled),
+      sessionEncryptionEnabled: optBool(adv.sessionEncryptionEnabled),
+      auditNotifierEnabled: optBool(adv.auditNotifierEnabled),
+      auditNotifierMinSeverity: sev,
+      auditNotifierEventTypes: strList(adv.auditNotifierEventTypes)?.filter((e) => AUDIT_EVENT_TYPES.includes(e)),
+      auditNotifierMaxRetries: optInt(adv.auditNotifierMaxRetries),
+      auditNotifierWebhookTimeout: optInt(adv.auditNotifierWebhookTimeout)
+    };
+  }
+  return detail;
+}
 function parseSetupAnswers(rec) {
   const provider = str3(rec, "provider");
   const apiBase = str3(rec, "apiBase");
@@ -53449,15 +54152,17 @@ function parseSetupAnswers(rec) {
     locale,
     securityBashBlock: rec.securityBashBlock,
     securityFlagsBlock: rec.securityFlagsBlock,
-    securityPathsRestrict: rec.securityPathsRestrict
+    securityPathsRestrict: rec.securityPathsRestrict,
+    securityDetail: parseSecurityDetail(rec.securityDetail)
   };
 }
 function handleSetupGet(res, s) {
+  const defaults = s.setup?.defaults ?? { contextWindow: 0, maxToolIterations: 0 };
   sendJson(res, 200, {
     required: s.setupRequired,
     languages: s.setup?.languages ?? [],
     providers: s.setup?.providers ?? [],
-    defaults: s.setup?.defaults ?? { contextWindow: 0, maxToolIterations: 0 }
+    defaults: s.config?.security ? { ...defaults, security: securityDetailFromConfig(s.config.security) } : defaults
   });
 }
 function handleSetupScan(req, res, s) {
@@ -53503,6 +54208,31 @@ function handleSetupTest(req, res, s) {
     readBodyError(req, res, err);
   });
 }
+function handleSetupContext(req, res, s) {
+  readJsonBody(req, s.maxBodyBytes).then(async (rec) => {
+    if (!rec) {
+      sendJson(res, 400, { ok: false, error: "invalid JSON" });
+      return;
+    }
+    const baseUrl = str3(rec, "baseUrl");
+    const model = str3(rec, "model");
+    if (!baseUrl || !model) {
+      sendJson(res, 400, { ok: false, error: "invalid-context-request" });
+      return;
+    }
+    const probe = await probeProviderContext(baseUrl, model, {
+      apiKey: str3(rec, "apiKey") || undefined,
+      providerType: str3(rec, "providerType") || undefined
+    });
+    if (!probe) {
+      sendJson(res, 200, { ok: false });
+      return;
+    }
+    sendJson(res, 200, { ok: true, contextWindow: probe.actual, model: probe.model });
+  }).catch((err) => {
+    readBodyError(req, res, err);
+  });
+}
 function handleSetupLocale(req, res, s) {
   readJsonBody(req, s.maxBodyBytes).then((rec) => {
     if (!rec) {
@@ -53575,6 +54305,10 @@ function handleSetupApi(req, res, reqUrl, s) {
     handleSetupTest(req, res, s);
     return true;
   }
+  if (p === "/api/setup/context" && req.method === "POST") {
+    handleSetupContext(req, res, s);
+    return true;
+  }
   if (p === "/api/setup/locale" && req.method === "POST") {
     handleSetupLocale(req, res, s);
     return true;
@@ -53652,6 +54386,7 @@ var API_ROUTES = {
   "GET /api/models": (_req, res, s) => handleModelsGet(res, s),
   "POST /api/command": (req, res, s) => handleCommandPost(req, res, s),
   "POST /api/interrupt": (_req, res, s) => handleInterruptPost(res, s),
+  "POST /api/index": (_req, res, s) => handleIndexPost(res, s),
   "POST /api/mcp": (req, res, s) => handleMcpCreate(req, res, s),
   "GET /api/lsp": (_req, res, s) => handleLspGet(res, s)
 };
@@ -53693,6 +54428,14 @@ function handleInterruptPost(res, s) {
   s.bridge?.interrupt();
   sendJson(res, 200, { ok: true });
 }
+function handleIndexPost(res, s) {
+  if (!s.refreshIndex) {
+    sendJson(res, 503, { error: "unavailable" });
+    return;
+  }
+  Promise.resolve(s.refreshIndex()).catch(() => {});
+  sendJson(res, 202, { ok: true });
+}
 function handleRequest(req, res, assets, s) {
   let reqUrl;
   try {
@@ -53947,13 +54690,22 @@ async function startWebUi(deps) {
   state.setup = buildSetupDisplay();
   state.config = deps.config;
   state.sessionManager = deps.sessionManager;
+  state.execModule = deps.execModule;
   state.memory = deps.memory;
   state.skills = deps.skills;
   state.plugins = deps.plugins;
   state.workspace = deps.baseDir;
   state.agentsMd = deps.agentsMd;
-  if (deps.indexer)
+  if (deps.indexer) {
     state.projectMapStats = () => deps.indexer?.stats() ?? null;
+    if (deps.indexer.refresh) {
+      const refresh = deps.indexer.refresh.bind(deps.indexer);
+      state.refreshIndex = async () => {
+        await refresh();
+        broadcast({ type: "state", ts: Date.now(), busy: state.busy, usage: state.usage }, state);
+      };
+    }
+  }
   state.saveConfig = (config) => saveConfig(config, CONFIG_FILE, deps.configDir);
   installWebPromptIO({
     state,
@@ -53997,10 +54749,7 @@ async function startWebUi(deps) {
       contextProbe: probe,
       workspace: deps.baseDir,
       instructions: deps.agentsMd,
-      projectMap: (() => {
-        const s = deps.indexer?.stats();
-        return s ? { indexed: true, ...s } : { indexed: false, files: 0, symbols: 0, tokens: 0 };
-      })()
+      projectMap: deps.indexer?.mapInfo?.()
     }, state.busy),
     addPendingImage: (url2) => {
       deps.agent.contextManager?.addPendingImage?.({