micro-models-agent 2.12.0 → 2.14.0

package/dist/main.js

@@ -2609,6 +2609,8 @@ The path was joined onto the working directory because it does not exist as give
 {issues}
 Summary: {summary}`,
     "critic.advice": `A verifier flagged issues worth checking before you finish:
+{issues}`,
+    "critic.repeat": `The verifier repeats a previously flagged problem — do not produce the same answer again. Change the approach, or finish honestly if the complaint does not apply:
 {issues}`,
     "tool.subagent_queued": "Sub-agent task queued: {task}",
     "tool.subagent_artifact": `Sub-agent completed. Full result saved to artifact: {path}
@@ -3404,6 +3406,7 @@ Apply a matching solution from these results. If none is relevant — do NOT rep
     "ui.todo_action": "{action} · {count}",
     "ui.tool_running": "{tool}…",
     "ui.step_context": "step {id}: {desc}",
+    "ui.draft_retracted": "↳ draft rejected by verification, refining…",
     "indexer.map_header": "Project map",
     "indexer.top_directories": "Top directories",
     "indexer.files": "Files",
@@ -3578,6 +3581,46 @@ Updated: {updatedAt}`,
     "web.sidebar.session": "session",
     "web.sidebar.usage": "usage",
     "web.sidebar.env": "environment",
+    "web.sidebar.tab_session": "Session",
+    "web.sidebar.tab_map": "Map",
+    "web.sidebar.tab_trace": "Trace",
+    "web.sidebar.map_status": "status",
+    "web.sidebar.map_ready": "ready",
+    "web.sidebar.map_indexing": "indexing…",
+    "web.sidebar.map_stale": "stale",
+    "web.sidebar.map_updated": "updated",
+    "web.sidebar.map_never": "never",
+    "web.sidebar.map_today": "today, {time}",
+    "web.sidebar.map_watcher": "watcher",
+    "web.sidebar.map_on": "on",
+    "web.sidebar.map_off": "off",
+    "web.sidebar.map_files": "files",
+    "web.sidebar.map_symbols": "symbols",
+    "web.sidebar.map_tokens": "tokens",
+    "web.sidebar.map_root": "root",
+    "web.sidebar.map_languages": "languages",
+    "web.sidebar.map_reindex": "Re-index",
+    "web.sidebar.map_reindexing": "re-indexing…",
+    "web.sidebar.map_reindex_failed": "re-index failed",
+    "web.sidebar.trace_empty": "no events yet",
+    "web.sidebar.trace_turn": "turn {n}",
+    "web.sidebar.trace_text": "composing… {count} chars",
+    "web.sidebar.trace_plan": "plan update",
+    "web.sidebar.trace_question": "question",
+    "web.sidebar.detail_metadata": "metadata",
+    "web.sidebar.detail_arguments": "arguments",
+    "web.sidebar.detail_output": "output",
+    "web.sidebar.detail_error": "error",
+    "web.sidebar.detail_text": "text",
+    "web.sidebar.detail_plan": "plan",
+    "web.sidebar.detail_reasoning": "reasoning",
+    "web.sidebar.detail_status": "status",
+    "web.sidebar.detail_ok": "ok",
+    "web.sidebar.detail_fail": "failed",
+    "web.sidebar.detail_duration": "duration",
+    "web.sidebar.detail_time": "time",
+    "web.sidebar.detail_tool_call": "tool call",
+    "web.sidebar.detail_session": "session",
     "web.env.dir": "dir",
     "web.env.agents": "AGENTS.md",
     "web.env.map": "map",
@@ -3972,6 +4015,7 @@ Updated: {updatedAt}`,
     "web.history.loading": "loading…",
     "web.history.unavailable": "— history unavailable",
     "web.history.empty": "— empty session —",
+    "web.scroll.latest": "latest",
     "web.tool.output_one": "output · {count} char",
     "web.tool.output_few": "output · {count} chars",
     "web.tool.output_many": "output · {count} chars",
@@ -3981,13 +4025,12 @@ Updated: {updatedAt}`,
     "web.code.copy_failed": "copy failed",
     "web.msg.copy": "copy",
     "web.msg.copy_md": "copy as markdown",
-    "web.card.open": "open ↗",
-    "web.card.download": "download ⤓",
-    "web.card.copy_path": "copy path",
     "web.card.open_title": "Preview in a browser tab",
-    "web.card.download_title": "Download the file",
     "web.card.copy_title": "Copy the workspace path",
     "web.card.drawio_hint": "Draw.io diagram is XML — preview shows code; open it in draw.io / VS Code to see the scheme.",
+    "web.card.files_one": "{count} file",
+    "web.card.files_few": "{count} files",
+    "web.card.files_many": "{count} files",
     "web.card.screenshot": "screenshot",
     "web.card.attached_image": "attached image",
     "web.card.browser_viewport": "browser · viewport",
@@ -4015,7 +4058,7 @@ Updated: {updatedAt}`,
     "web.setup.language.title": "Choose your language",
     "web.setup.language.hint": "Used for the interface.",
     "web.setup.provider.title": "Choose a provider",
-    "web.setup.provider.hint": "For a local model pick the OpenAI-compatible option and scan for your server.",
+    "web.setup.provider.hint": "For a local model pick the OpenAI-compatible option, scan for your server, then test the connection before continuing.",
     "web.setup.provider.base_url": "Base URL",
     "web.setup.provider.scan": "Scan for local servers",
     "web.setup.provider.scan_found_one": "Found {count} server",
@@ -4024,6 +4067,10 @@ Updated: {updatedAt}`,
     "web.setup.provider.scan_none": "No local servers found — enter the URL manually.",
     "web.setup.provider.scan_failed": "Scan failed. Enter the URL manually.",
     "web.setup.provider.required": "Please enter a base URL.",
+    "web.setup.provider.test": "Test connection",
+    "web.setup.provider.testing": "Testing…",
+    "web.setup.provider.test_ok": "Server reachable.",
+    "web.setup.provider.test_fail": "Could not reach the server at this URL.",
     "web.setup.key.title": "API key",
     "web.setup.key.hint": "Leave empty for local servers. Stored only in your config file and never shown again.",
     "web.setup.key.label": "Key",
@@ -4042,15 +4089,54 @@ Updated: {updatedAt}`,
     "web.setup.model.test_fail": "Could not reach the model.",
     "web.setup.model.required": "Please choose or type a model.",
     "web.setup.context.title": "Context & iterations",
-    "web.setup.context.hint": "How much context the model gets and how many tool steps it may take.",
+    "web.setup.context.hint": "Must match the context your provider gives this model. Press Detect, or copy the value from LM Studio / Ollama / provider docs.",
     "web.setup.context.contextWindow": "Context window (tokens)",
     "web.setup.context.maxToolIterations": "Max tool iterations",
     "web.setup.context.required": "Enter a positive number.",
+    "web.setup.context.detect": "Detect from provider",
+    "web.setup.context.detecting": "Detecting…",
+    "web.setup.context.detect_ok": "Context set from provider: {count} tokens.",
+    "web.setup.context.detect_fail": "Could not detect context — enter it manually.",
     "web.setup.security.title": "Security",
-    "web.setup.security.hint": "Safe defaults are on; turn off only what you need.",
+    "web.setup.security.hint": "Safe defaults are on; turn off only what you need. Nothing is blocked silently — each toggle only asks the agent to confirm first.",
     "web.setup.security.paths": "Restrict file access to the workspace",
+    "web.setup.security.paths_desc": "The agent reads and writes only inside the workspace, and asks before touching .git, .env, keys and other sensitive paths.",
     "web.setup.security.bash": "Block dangerous shell commands",
+    "web.setup.security.bash_desc": "Blocks destructive commands (rm, sudo, ssh, curl, shutdown, …). The agent asks instead of running them.",
     "web.setup.security.flags": "Block dangerous command flags",
+    "web.setup.security.flags_desc": "Blocks risky flags (--force, -rf, …) that make safe commands dangerous. Works together with the command block.",
+    "web.setup.security.configure": "Configure",
+    "web.setup.security.advanced": "Advanced security settings",
+    "web.setup.security.popup_hint": "One item per line. Empty list = disabled. Changes apply only to this install; you can edit them later in Settings → Security.",
+    "web.setup.security.popup_done": "Done",
+    "web.setup.security.reset": "Reset to defaults",
+    "web.setup.security.denied": "Always denied paths",
+    "web.setup.security.allowed": "Only allowed paths (empty = all except denied)",
+    "web.setup.security.blacklist": "Always blocked commands",
+    "web.setup.security.whitelist": "Only allowed commands (empty = all except blocked)",
+    "web.setup.security.log_commands": "Log every executed command to the audit log",
+    "web.setup.security.dangerous_flags": "Blocked command flags",
+    "web.setup.security.dangerous_operators": "Blocked shell operators",
+    "web.setup.security.network_enabled": "Network protection (block private/internal addresses)",
+    "web.setup.security.denied_domains": "Always denied domains",
+    "web.setup.security.allowed_domains": "Only allowed domains (empty = all except denied)",
+    "web.setup.security.request_timeout": "Network request timeout (ms)",
+    "web.setup.security.max_response_size": "Max response size (bytes)",
+    "web.setup.security.max_recursion": "Max subagent recursion depth",
+    "web.setup.security.max_file_ops": "Max file operations per session",
+    "web.setup.security.rate_rpm": "Max LLM requests per minute",
+    "web.setup.security.rate_parallel": "Max parallel tasks",
+    "web.setup.security.content_scan": "Scan file content for dangerous patterns",
+    "web.setup.security.session_encryption": "Encrypt session logs on disk",
+    "web.setup.security.audit_enabled": "Send security events to the audit notifier",
+    "web.setup.security.audit_severity": "Minimum severity to notify",
+    "web.setup.security.audit_events": "Notified event types",
+    "web.setup.security.audit_retries": "Webhook max retries",
+    "web.setup.security.audit_timeout": "Webhook timeout (ms)",
+    "web.setup.security.severity.low": "low",
+    "web.setup.security.severity.medium": "medium",
+    "web.setup.security.severity.high": "high",
+    "web.setup.security.severity.critical": "critical",
     "web.setup.review.title": "Review",
     "web.setup.review.hint": "Check the values, then finish. Settings are saved to your config.",
     "web.setup.review.provider": "Provider",
@@ -4423,6 +4509,8 @@ var init_ru = __esm(() => {
 {issues}
 Сводка: {summary}`,
     "critic.advice": `Верификатор отметил проблемы, которые стоит проверить до завершения:
+{issues}`,
+    "critic.repeat": `Верификатор повторяет уже отмеченную проблему — не выдавай тот же ответ снова. Смени подход или заверши честно, если жалоба неприменима:
 {issues}`,
     "tool.subagent_queued": "Задача подагенту добавлена: {task}",
     "tool.subagent_artifact": `Суб-агент завершён. Полный результат сохранён в артефакт: {path}
@@ -5221,6 +5309,7 @@ var init_ru = __esm(() => {
     "ui.todo_action": "{action} · {count}",
     "ui.tool_running": "{tool}…",
     "ui.step_context": "шаг {id}: {desc}",
+    "ui.draft_retracted": "↳ черновик отклонён проверкой, уточняю…",
     "indexer.map_header": "Карта проекта",
     "indexer.top_directories": "Основные директории",
     "indexer.files": "Файлы",
@@ -5398,6 +5487,46 @@ var init_ru = __esm(() => {
     "web.sidebar.session": "сессия",
     "web.sidebar.usage": "использование",
     "web.sidebar.env": "окружение",
+    "web.sidebar.tab_session": "Сессия",
+    "web.sidebar.tab_map": "Карта",
+    "web.sidebar.tab_trace": "Трассировка",
+    "web.sidebar.map_status": "статус",
+    "web.sidebar.map_ready": "готово",
+    "web.sidebar.map_indexing": "индексация…",
+    "web.sidebar.map_stale": "устарело",
+    "web.sidebar.map_updated": "обновлено",
+    "web.sidebar.map_never": "никогда",
+    "web.sidebar.map_today": "сегодня, {time}",
+    "web.sidebar.map_watcher": "вотчер",
+    "web.sidebar.map_on": "вкл.",
+    "web.sidebar.map_off": "выкл.",
+    "web.sidebar.map_files": "файлы",
+    "web.sidebar.map_symbols": "символы",
+    "web.sidebar.map_tokens": "токены",
+    "web.sidebar.map_root": "корень",
+    "web.sidebar.map_languages": "языки",
+    "web.sidebar.map_reindex": "Переиндексировать",
+    "web.sidebar.map_reindexing": "переиндексация…",
+    "web.sidebar.map_reindex_failed": "не удалось переиндексировать",
+    "web.sidebar.trace_empty": "событий пока нет",
+    "web.sidebar.trace_turn": "ход {n}",
+    "web.sidebar.trace_text": "печатает… {count} симв.",
+    "web.sidebar.trace_plan": "обновление плана",
+    "web.sidebar.trace_question": "вопрос",
+    "web.sidebar.detail_metadata": "метаданные",
+    "web.sidebar.detail_arguments": "аргументы",
+    "web.sidebar.detail_output": "вывод",
+    "web.sidebar.detail_error": "ошибка",
+    "web.sidebar.detail_text": "текст",
+    "web.sidebar.detail_plan": "план",
+    "web.sidebar.detail_reasoning": "размышление",
+    "web.sidebar.detail_status": "статус",
+    "web.sidebar.detail_ok": "ok",
+    "web.sidebar.detail_fail": "ошибка",
+    "web.sidebar.detail_duration": "длительность",
+    "web.sidebar.detail_time": "время",
+    "web.sidebar.detail_tool_call": "вызов тула",
+    "web.sidebar.detail_session": "сессия",
     "web.env.dir": "директория",
     "web.env.agents": "AGENTS.md",
     "web.env.map": "карта",
@@ -5765,6 +5894,7 @@ var init_ru = __esm(() => {
     "web.history.loading": "загрузка…",
     "web.history.unavailable": "— история недоступна",
     "web.history.empty": "— пустая сессия —",
+    "web.scroll.latest": "к новому",
     "web.tool.output_one": "вывод · {count} символ",
     "web.tool.output_few": "вывод · {count} символа",
     "web.tool.output_many": "вывод · {count} символов",
@@ -5774,13 +5904,12 @@ var init_ru = __esm(() => {
     "web.code.copy_failed": "не скопировано",
     "web.msg.copy": "копировать",
     "web.msg.copy_md": "копировать как markdown",
-    "web.card.open": "открыть ↗",
-    "web.card.download": "скачать ⤓",
-    "web.card.copy_path": "путь",
     "web.card.open_title": "Предпросмотр во вкладке браузера",
-    "web.card.download_title": "Скачать файл",
     "web.card.copy_title": "Скопировать путь в рабочей папке",
     "web.card.drawio_hint": "Диаграмма draw.io — это XML: предпросмотр покажет код, схему смотри в draw.io / VS Code.",
+    "web.card.files_one": "{count} файл",
+    "web.card.files_few": "{count} файла",
+    "web.card.files_many": "{count} файлов",
     "web.card.screenshot": "снимок экрана",
     "web.card.attached_image": "прикреплённое изображение",
     "web.card.browser_viewport": "браузер · область просмотра",
@@ -5835,7 +5964,7 @@ var init_ru = __esm(() => {
     "web.setup.language.title": "Выберите язык",
     "web.setup.language.hint": "Используется для интерфейса.",
     "web.setup.provider.title": "Выберите провайдера",
-    "web.setup.provider.hint": "Для локальной модели выберите OpenAI-совместимый вариант и просканируйте сервер.",
+    "web.setup.provider.hint": "Для локальной модели выберите OpenAI-совместимый вариант, просканируйте сервер и проверьте подключение перед продолжением.",
     "web.setup.provider.base_url": "Базовый URL",
     "web.setup.provider.scan": "Найти локальные серверы",
     "web.setup.provider.scan_found_one": "Найден {count} сервер",
@@ -5844,6 +5973,10 @@ var init_ru = __esm(() => {
     "web.setup.provider.scan_none": "Локальные серверы не найдены — введите URL вручную.",
     "web.setup.provider.scan_failed": "Сканирование не удалось. Введите URL вручную.",
     "web.setup.provider.required": "Укажите базовый URL.",
+    "web.setup.provider.test": "Проверить подключение",
+    "web.setup.provider.testing": "Проверка…",
+    "web.setup.provider.test_ok": "Сервер отвечает.",
+    "web.setup.provider.test_fail": "Не удалось связаться с сервером по этому URL.",
     "web.setup.key.title": "API-ключ",
     "web.setup.key.hint": "Для локальных серверов можно оставить пустым. Хранится только в файле конфигурации и больше не показывается.",
     "web.setup.key.label": "Ключ",
@@ -5862,15 +5995,54 @@ var init_ru = __esm(() => {
     "web.setup.model.test_fail": "Не удалось связаться с моделью.",
     "web.setup.model.required": "Выберите или введите модель.",
     "web.setup.context.title": "Контекст и итерации",
-    "web.setup.context.hint": "Сколько контекста получает модель и сколько шагов с тулами она может сделать.",
+    "web.setup.context.hint": "Должно совпадать с контекстом, который провайдер выделяет этой модели. Нажмите «Определить» либо сверьтесь с LM Studio / Ollama / документацией провайдера.",
     "web.setup.context.contextWindow": "Окно контекста (токены)",
     "web.setup.context.maxToolIterations": "Максимум итераций тулов",
     "web.setup.context.required": "Введите положительное число.",
+    "web.setup.context.detect": "Определить у провайдера",
+    "web.setup.context.detecting": "Определение…",
+    "web.setup.context.detect_ok": "Контекст от провайдера: {count} токенов.",
+    "web.setup.context.detect_fail": "Не удалось определить контекст — введите вручную.",
     "web.setup.security.title": "Безопасность",
-    "web.setup.security.hint": "Безопасные значения включены; отключайте только нужное.",
+    "web.setup.security.hint": "Безопасные значения включены; отключайте только нужное. Ничего не блокируется молча — каждый переключатель лишь требует подтверждения перед опасным действием.",
     "web.setup.security.paths": "Ограничить доступ к файлам рабочей папкой",
+    "web.setup.security.paths_desc": "Агент читает и пишет только внутри рабочей папки, а перед доступом к .git, .env, ключам и другим чувствительным путям спросит подтверждения.",
     "web.setup.security.bash": "Блокировать опасные shell-команды",
+    "web.setup.security.bash_desc": "Блокирует разрушительные команды (rm, sudo, ssh, curl, shutdown, …). Вместо запуска агент спросит подтверждения.",
     "web.setup.security.flags": "Блокировать опасные флаги команд",
+    "web.setup.security.flags_desc": "Блокирует рискованные флаги (--force, -rf, …), которые делают безопасные команды опасными. Работает вместе с блокировкой команд.",
+    "web.setup.security.configure": "Настроить",
+    "web.setup.security.advanced": "Расширенные настройки безопасности",
+    "web.setup.security.popup_hint": "По одному элементу в строке. Пустой список = выключено. Изменения применяются только к этой установке; позже их можно править в Настройках → Безопасность.",
+    "web.setup.security.popup_done": "Готово",
+    "web.setup.security.reset": "Сбросить к значениям по умолчанию",
+    "web.setup.security.denied": "Всегда запрещённые пути",
+    "web.setup.security.allowed": "Разрешены только эти пути (пусто = все, кроме запрещённых)",
+    "web.setup.security.blacklist": "Всегда блокируемые команды",
+    "web.setup.security.whitelist": "Разрешены только эти команды (пусто = все, кроме блокируемых)",
+    "web.setup.security.log_commands": "Писать каждую выполненную команду в аудит-лог",
+    "web.setup.security.dangerous_flags": "Блокируемые флаги команд",
+    "web.setup.security.dangerous_operators": "Блокируемые shell-операторы",
+    "web.setup.security.network_enabled": "Сетевая защита (блокировать приватные/внутренние адреса)",
+    "web.setup.security.denied_domains": "Всегда запрещённые домены",
+    "web.setup.security.allowed_domains": "Разрешены только эти домены (пусто = все, кроме запрещённых)",
+    "web.setup.security.request_timeout": "Таймаут сетевых запросов (мс)",
+    "web.setup.security.max_response_size": "Максимум размера ответа (байты)",
+    "web.setup.security.max_recursion": "Максимум глубины рекурсии субагентов",
+    "web.setup.security.max_file_ops": "Максимум файловых операций за сессию",
+    "web.setup.security.rate_rpm": "Максимум LLM-запросов в минуту",
+    "web.setup.security.rate_parallel": "Максимум параллельных задач",
+    "web.setup.security.content_scan": "Сканировать содержимое файлов на опасные паттерны",
+    "web.setup.security.session_encryption": "Шифровать логи сессий на диске",
+    "web.setup.security.audit_enabled": "Отправлять события безопасности в аудит-нотификатор",
+    "web.setup.security.audit_severity": "Минимальная severity для уведомления",
+    "web.setup.security.audit_events": "Типы событий для уведомления",
+    "web.setup.security.audit_retries": "Повторы вебхука",
+    "web.setup.security.audit_timeout": "Таймаут вебхука (мс)",
+    "web.setup.security.severity.low": "низкая",
+    "web.setup.security.severity.medium": "средняя",
+    "web.setup.security.severity.high": "высокая",
+    "web.setup.security.severity.critical": "критическая",
     "web.setup.review.title": "Проверка",
     "web.setup.review.hint": "Проверьте значения и завершите. Настройки сохранятся в конфиг.",
     "web.setup.review.provider": "Провайдер",
@@ -9465,6 +9637,9 @@ class OpenAICompatProvider {
     this.userAgent = config.userAgent ?? defaultUserAgent();
     this.debug = config.logger ? config.logger.debug.bind(config.logger) : null;
   }
+  get idleTimeoutMs() {
+    return this.retryConfig.noDataTimeoutMs ?? 180000;
+  }
   async* chat(messages, tools, signal, options) {
     if (!this.rateLimiter.canMakeRequest()) {
       const waitMs = Math.min(this.rateLimiter.msUntilRequest(), LLM_MAX_RATE_WAIT_MS);
@@ -9495,7 +9670,7 @@ class OpenAICompatProvider {
     }
     if (!hasToolCall && !hasText) {
       this.debug?.("LLM streaming produced no text/tool_call — falling back to non-streaming");
-      const fallback = await this.doNonStreaming(effectiveMessages, tools, signal, options);
+      const fallback = await this.doNonStreaming(effectiveMessages, tools, signal, options, this.idleTimeoutMs);
       this.debug?.("LLM non-streaming fallback result", { chunks: fallback.length });
       for (const chunk of fallback) {
         if (hasReasoning && chunk.type === "reasoning")
@@ -9522,9 +9697,9 @@ ${tag}`;
     return copy;
   }
   async* doStream(messages, tools, signal, options) {
-    const { baseDelay, maxDelay, maxStreamRetries, noDataTimeoutMs } = this.retryConfig;
+    const { baseDelay, maxDelay, maxStreamRetries } = this.retryConfig;
     const streamRetries = maxStreamRetries ?? 2;
-    const idleTimeoutMs = noDataTimeoutMs ?? 180000;
+    const idleTimeoutMs = this.idleTimeoutMs;
     let usedNonStreamingFallback = false;
     for (let attempt = 0;; attempt++) {
       let emitted = false;
@@ -9543,7 +9718,7 @@ ${tag}`;
         if (err?.stalledAfterToolCall === true && !usedNonStreamingFallback) {
           usedNonStreamingFallback = true;
           this.debug?.("LLM stream stalled after tool_call — falling back to non-streaming request");
-          const fallback = await this.doNonStreaming(messages, tools, signal, options);
+          const fallback = await this.doNonStreaming(messages, tools, signal, options, idleTimeoutMs);
           this.debug?.("LLM non-streaming fallback result", { chunks: fallback.length });
           for (const chunk of fallback) {
             if (chunk.type === "reasoning")
@@ -9590,8 +9765,12 @@ ${tag}`;
         signal: abortSignal
       });
     } catch (err) {
-      if (err?.name === "AbortError")
+      if (err?.name === "AbortError") {
+        if (isTimeout()) {
+          throw new Error(t("error.llm_timeout", { timeout: LLM_REQUEST_TIMEOUT_MS }));
+        }
         throw err;
+      }
       const wrapped = err instanceof Error ? err : new Error(String(err));
       if (wrapped instanceof LlmError) {
         wrapped.markTerminal();
@@ -9618,6 +9797,7 @@ ${tag}`;
       cleanup();
       throw new Error(t("error.no_response_body"));
     }
+    cleanup();
     const decoder = new TextDecoder;
     let buffer = "";
     const toolCallAccs = new Map;
@@ -9783,7 +9963,7 @@ ${tag}`;
       streamUsage: this.cache?.requestStreamUsage === true
     };
   }
-  buildRequestSetup(signal) {
+  buildRequestSetup(signal, totalTimeoutMs = LLM_REQUEST_TIMEOUT_MS) {
     const headers = {
       "Content-Type": "application/json",
       "User-Agent": this.userAgent
@@ -9800,7 +9980,7 @@ ${tag}`;
     const timeoutId = setTimeout(() => {
       timedOut = true;
       controller.abort();
-    }, LLM_REQUEST_TIMEOUT_MS);
+    }, totalTimeoutMs);
     const abortSignal = (() => {
       if (!signal)
         return controller.signal;
@@ -9824,7 +10004,7 @@ ${tag}`;
       controller
     };
   }
-  async doNonStreaming(messages, tools, signal, options) {
+  async doNonStreaming(messages, tools, signal, options, totalTimeoutMs = LLM_REQUEST_TIMEOUT_MS) {
     const maxTokens = options?.maxTokens ?? this.config.maxCompletionTokens ?? DEFAULT_MAX_COMPLETION_TOKENS;
     const body = buildRequestBody({
       model: this.model,
@@ -9836,7 +10016,7 @@ ${tag}`;
       reasoningStrategy: options?.reasoningStrategy,
       ...this.cacheHints()
     });
-    const { headers, abortSignal, cleanup, isTimeout } = this.buildRequestSetup(signal);
+    const { headers, abortSignal, cleanup, isTimeout } = this.buildRequestSetup(signal, totalTimeoutMs);
     try {
       const response = await this.fetchWithRetry(`${this.config.baseUrl}/chat/completions`, {
         method: "POST",
@@ -9901,7 +10081,7 @@ ${tag}`;
       return chunks;
     } catch (err) {
       if (isTimeout() && err?.name === "AbortError") {
-        throw new Error(t("error.llm_timeout", { timeout: LLM_REQUEST_TIMEOUT_MS }));
+        throw new Error(t("error.llm_timeout", { timeout: totalTimeoutMs }));
       }
       throw err instanceof Error ? err : new Error(String(err));
     } finally {
@@ -11726,10 +11906,23 @@ var init_walker = __esm(() => {
 // src/modules/indexer/cache.ts
 import { readFileSync as readFileSync14, writeFileSync as writeFileSync10, existsSync as existsSync18, mkdirSync as mkdirSync11, rmSync } from "fs";
 import { join as join20 } from "path";
+function isIndexedFile(v) {
+  if (typeof v !== "object" || v === null)
+    return false;
+  const f = v;
+  return typeof f.path === "string" && typeof f.language === "string" && Array.isArray(f.exports) && typeof f.size === "number";
+}
+function isIndexResult(v) {
+  if (typeof v !== "object" || v === null)
+    return false;
+  const r = v;
+  return Array.isArray(r.files) && r.files.every(isIndexedFile) && typeof r.totalSize === "number";
+}
 
 class IndexCache {
   cachePath;
   cache = null;
+  cachedBuiltAt = null;
   root;
   signature;
   constructor(cacheDir, opts = {}) {
@@ -11744,24 +11937,28 @@ class IndexCache {
       return null;
     try {
       const parsed = JSON.parse(readFileSync14(this.cachePath, "utf-8"));
-      if (parsed.version !== CACHE_VERSION || !parsed.result)
+      if (parsed.version !== CACHE_VERSION || !isIndexResult(parsed.result))
         return null;
       if (this.root !== undefined && parsed.root !== this.root)
         return null;
       if (this.signature && parsed.signature !== this.currentSignature())
         return null;
       this.cache = parsed.result;
+      this.cachedBuiltAt = typeof parsed.builtAt === "number" ? parsed.builtAt : null;
       return this.cache;
     } catch {
       return null;
     }
   }
   save(result) {
+    const now = Date.now();
     this.cache = result;
+    this.cachedBuiltAt = now;
     const envelope = {
       version: CACHE_VERSION,
       root: this.root ?? "",
       signature: this.currentSignature(),
+      builtAt: now,
       result
     };
     const dir = join20(this.cachePath, "..");
@@ -11771,12 +11968,16 @@ class IndexCache {
   }
   invalidate() {
     this.cache = null;
+    this.cachedBuiltAt = null;
     if (existsSync18(this.cachePath)) {
       try {
         rmSync(this.cachePath);
       } catch {}
     }
   }
+  getBuiltAt() {
+    return this.cachedBuiltAt;
+  }
   currentSignature() {
     if (!this.signature)
       return "";
@@ -12104,7 +12305,11 @@ class IndexerModule {
   cache;
   baseDir;
   index = null;
-  statsCache = null;
+  mapCache = null;
+  buildPromise = null;
+  indexing = false;
+  builtAt = null;
+  watcherActive = false;
   rebuildTimeout = null;
   constructor(opts) {
     this.baseDir = opts.baseDir;
@@ -12114,26 +12319,38 @@ class IndexerModule {
       signature: () => this.indexer.scanSignature()
     });
   }
-  async buildIndex() {
+  buildIndex() {
     if (this.index)
-      return this.index;
+      return Promise.resolve(this.index);
+    if (this.buildPromise)
+      return this.buildPromise;
     const cached = this.cache.load();
     if (cached) {
       this.index = cached;
-      return cached;
-    }
-    try {
-      const result = await this.indexer.walk();
-      this.cache.save(result);
-      this.index = result;
-      return result;
-    } catch {
-      return null;
+      this.builtAt = this.cache.getBuiltAt();
+      return Promise.resolve(cached);
     }
+    this.indexing = true;
+    this.buildPromise = (async () => {
+      try {
+        const result = await this.indexer.walk();
+        this.cache.save(result);
+        this.index = result;
+        this.builtAt = Date.now();
+        return result;
+      } catch {
+        return null;
+      } finally {
+        this.indexing = false;
+        this.buildPromise = null;
+      }
+    })();
+    return this.buildPromise;
   }
   async refresh() {
     this.cache.invalidate();
     this.index = null;
+    this.builtAt = null;
     return this.buildIndex();
   }
   find(query) {
@@ -12173,9 +12390,11 @@ class IndexerModule {
           this.refresh().catch(() => {});
         }, 2000);
       });
+      this.watcherActive = true;
     } catch {}
   }
   unwatch() {
+    this.watcherActive = false;
     if (this.rebuildTimeout) {
       clearTimeout(this.rebuildTimeout);
       this.rebuildTimeout = null;
@@ -12194,19 +12413,47 @@ class IndexerModule {
       kind: "project-map"
     };
   }
-  stats() {
-    if (!this.index)
-      return null;
-    if (this.statsCache && this.statsCache.index === this.index)
-      return this.statsCache.value;
+  mapInfo() {
+    if (!this.index) {
+      return {
+        indexed: false,
+        indexing: this.indexing,
+        files: 0,
+        symbols: 0,
+        tokens: 0,
+        updatedAt: this.builtAt,
+        languages: [],
+        watcher: this.watcherActive
+      };
+    }
+    if (this.mapCache && this.mapCache.index === this.index) {
+      return { ...this.mapCache.value, indexing: this.indexing, watcher: this.watcherActive };
+    }
     const symbols = this.index.files.reduce((n, f) => n + f.exports.length, 0);
+    const langMap = new Map;
+    for (const f of this.index.files) {
+      const lang = f.language;
+      const cur = langMap.get(lang) ?? { files: 0, symbols: 0 };
+      cur.files += 1;
+      cur.symbols += f.exports.length;
+      langMap.set(lang, cur);
+    }
+    const languages = [...langMap.entries()].map(([language, v]) => ({ language, ...v })).sort((a, b) => b.files - a.files || a.language.localeCompare(b.language)).slice(0, 8);
     const value = {
+      indexed: true,
       files: this.index.files.length,
       symbols,
-      tokens: this.estimateTokens(this.formatMap(this.index))
+      tokens: this.estimateTokens(this.formatMap(this.index)),
+      updatedAt: this.builtAt,
+      languages,
+      watcher: this.watcherActive
     };
-    this.statsCache = { index: this.index, value };
-    return value;
+    this.mapCache = { index: this.index, value };
+    return { ...value, indexing: this.indexing };
+  }
+  stats() {
+    const info = this.mapInfo();
+    return info.indexed ? { files: info.files, symbols: info.symbols, tokens: info.tokens } : null;
   }
   getToolDefinitions() {
     return [this.createProjectMapTool()];
@@ -16828,6 +17075,15 @@ class SessionLogger {
       ...data
     });
   }
+  logClaimRetry(data) {
+    this.session?.appendLog({
+      ts: new Date().toISOString(),
+      type: "claim_retry",
+      content: data.reason,
+      kind: data.kind,
+      iteration: data.iteration
+    });
+  }
   logCritic(event, data = {}) {
     this.session?.appendLog({
       ts: new Date().toISOString(),
@@ -19418,8 +19674,17 @@ function isFilePathLike(s) {
   return true;
 }
 function extractFileLikeTokens(text) {
-  const matches = text.match(FILE_TOKEN_RE) || [];
-  return [...new Set(matches.filter(isFilePathLike))];
+  const out = new Set;
+  const re = new RegExp(FILE_TOKEN_RE.source, "gi");
+  for (const m of text.matchAll(re)) {
+    const token = m[0];
+    const after = text[(m.index ?? 0) + token.length];
+    if (after === "(")
+      continue;
+    if (isFilePathLike(token))
+      out.add(token);
+  }
+  return [...out];
 }
 function stripUrls(text) {
   return text.replace(/\bhttps?:\/\/[^\s"'<>]+/gi, " ");
@@ -20747,6 +21012,7 @@ function createLoopState() {
     criticCalls: 0,
     criticRepairCycles: 0,
     mutationsSinceCritic: 0,
+    criticHistoryMark: 0,
     seenCriticIssues: new Set,
     emptyResponseRetries: 0,
     emptyResponseExhausted: false,
@@ -21557,6 +21823,7 @@ class HallucinationGate {
       return { action: "warn" };
     }
     if (result.status === "retry") {
+      this.retractDraft(deps, result.kind ?? "retry", result.reason ?? "");
       return this.applyRetry(deps, textContent, result);
     }
     const claimRetry = this.checkSuccessClaim(deps, textContent);
@@ -21605,30 +21872,35 @@ class HallucinationGate {
         return this.retryClaim(deps, textContent, t("hall.claim_contradiction", {
           tool: contradiction.tool,
           snippet: contradiction.snippet
-        }), `Success-claim contradiction: ${contradiction.tool}: ${contradiction.snippet}`);
+        }), `Success-claim contradiction: ${contradiction.tool}: ${contradiction.snippet}`, "success");
       }
     }
     if (state.artifactClaimRetries < MAX_CLAIM_CHECK_RETRIES && deps.artifacts && deps.artifacts.length > 0) {
       const artifact = checkArtifactClaims(text, deps.artifacts);
       if (artifact) {
         state.artifactClaimRetries++;
-        return this.retryClaim(deps, textContent, t("hall.claim_artifact", { path: artifact.path, detail: artifact.snippet }), `Artifact-claim contradiction: ${artifact.snippet}`);
+        return this.retryClaim(deps, textContent, t("hall.claim_artifact", { path: artifact.path, detail: artifact.snippet }), `Artifact-claim contradiction: ${artifact.snippet}`, "artifact");
       }
     }
     if (state.outputClaimRetries < MAX_CLAIM_CHECK_RETRIES) {
       const unverified = checkUnverifiedOutput(text, evidence);
       if (unverified) {
         state.outputClaimRetries++;
-        return this.retryClaim(deps, textContent, t("hall.claim_output_unverified", { detail: unverified.snippet }), `Unverified output: ${unverified.snippet}`);
+        return this.retryClaim(deps, textContent, t("hall.claim_output_unverified", { detail: unverified.snippet }), `Unverified output: ${unverified.snippet}`, "output");
       }
     }
     return null;
   }
-  retryClaim(deps, textContent, reason, logLine) {
+  retractDraft(deps, kind, reason) {
+    deps.onMeta?.(t("ui.draft_retracted"), "retract");
+    deps.slog?.logClaimRetry({ kind, reason, iteration: deps.state.iteration });
+  }
+  retryClaim(deps, textContent, reason, logLine, kind) {
     const { state, logger: logger3 } = deps;
     state.iterHallucinationRetry = true;
     state.suppressRepetitionRetry = true;
     logger3.diagnostic("warn", logLine);
+    this.retractDraft(deps, kind, reason);
     if (textContent) {
       deps.contextManager.addMessage({ role: "assistant", content: textContent });
     }
@@ -21687,27 +21959,30 @@ function resolveArtifactStates(baseDir, response) {
     const rel = relative6(baseDir, abs);
     if (rel.startsWith("..") || isAbsolute4(rel))
       continue;
-    const state = resolveOneArtifact(token, abs);
+    const state = resolveOneArtifact(token, baseDir);
     if (state)
       out.push(state);
   }
   return out;
 }
-function resolveOneArtifact(token, abs) {
+function resolveOneArtifact(token, baseDir) {
+  const found = findExistingFile(baseDir, token);
+  if (!found)
+    return { path: token, exists: false };
   let size;
   try {
-    const st = statSync8(abs);
+    const st = statSync8(found);
     if (!st.isFile())
       return { path: token, exists: false };
     size = st.size;
   } catch {
-    return { path: token, exists: false };
+    return { path: token, exists: true };
   }
   if (size > MAX_BYTES)
     return { path: token, exists: true };
   let content;
   try {
-    content = readFileSync25(abs, "utf-8");
+    content = readFileSync25(found, "utf-8");
   } catch {
     return { path: token, exists: true };
   }
@@ -21717,6 +21992,7 @@ var MAX_PATHS = 10, MAX_BYTES, JSON_EXTS, XML_EXTS;
 var init_artifact_resolve = __esm(() => {
   init_js_identifiers();
   init_syntax_validator();
+  init_auditor();
   MAX_BYTES = 500 * 1024;
   JSON_EXTS = new Set([".json", ".jsonc"]);
   XML_EXTS = new Set([".xml", ".drawio", ".svg", ".xaml", ".plist", ".iml"]);
@@ -21754,6 +22030,7 @@ class AuditGate {
       return { action: "exhausted", summary: audit.summary };
     }
     state.suppressRepetitionRetry = true;
+    deps.onMeta?.(t("ui.draft_retracted"), "retract");
     return { action: "reject" };
   }
 }
@@ -21765,10 +22042,17 @@ var init_audit_gate = __esm(() => {
 function issueSignature(issue) {
   return `${issue.severity}:${issue.claim}`.toLowerCase().replace(/\s+/g, " ").slice(0, 120);
 }
+function normalizedSignature(issue) {
+  const body = `${issue.severity}:${issue.claim}`.toLowerCase().replace(/[^a-z0-9а-яё\s]/gi, " ").replace(/\s+/g, " ").trim().slice(0, 120);
+  return `~${body}`;
+}
 function renderIssues(issues) {
   return issues.slice(0, 5).map((i) => `- [${i.severity}] ${i.problem || i.claim}${i.suggestion ? ` → ${i.suggestion}` : ""}`).join(`
 `);
 }
+function isRepeatedVerdict(state, issues) {
+  return issues.length > 0 && issues.every((i) => state.seenCriticIssues.has(normalizedSignature(i)));
+}
 
 class CriticGate {
   opts;
@@ -21784,18 +22068,26 @@ class CriticGate {
     const verdict = await this.verifySafely(deps);
     if (!verdict || verdict.status === "ok")
       return "pass";
+    const isRepeat = isRepeatedVerdict(deps.state, verdict.issues);
     const fresh = this.takeFreshIssues(deps.state, verdict.issues);
     if (fresh.length === 0)
       return "pass";
     this.logVerdict(deps, verdict, fresh.length);
-    const canRepair = verdict.status === "critical" && deps.beforeFinish && deps.state.criticRepairCycles < this.opts.maxRepairCycles;
-    this.inject(deps, verdict, fresh, canRepair);
+    if (!this.shouldRepair(deps, verdict, isRepeat)) {
+      this.injectRepeatOrAdvice(deps, fresh, isRepeat);
+      return "pass";
+    }
+    this.injectRepair(deps, verdict, fresh);
     return "retry";
   }
+  shouldRepair(deps, verdict, isRepeat) {
+    return verdict.status === "critical" && deps.beforeFinish && deps.state.criticRepairCycles < this.opts.maxRepairCycles && !isRepeat;
+  }
   async verifySafely(deps) {
     try {
       return await this.opts.verify(this.opts.buildPack(deps), this.opts.signal);
-    } catch {
+    } catch (err) {
+      deps.logger.diagnostic("warn", `Critic verify failed (fail-open): ${String(err?.message ?? err)}`);
       return null;
     }
   }
@@ -21804,9 +22096,8 @@ class CriticGate {
       return false;
     if (deps.state.criticCalls >= this.opts.maxCalls)
       return false;
-    if (!deps.beforeFinish && deps.state.mutationsSinceCritic < MUTATIONS_BEFORE_CHECK) {
+    if (!deps.beforeFinish)
       return false;
-    }
     return deps.toolEvents.length !== 0;
   }
   takeFreshIssues(state, issues) {
@@ -21816,6 +22107,7 @@ class CriticGate {
       if (state.seenCriticIssues.has(sig))
         continue;
       state.seenCriticIssues.add(sig);
+      state.seenCriticIssues.add(normalizedSignature(issue));
       fresh.push(issue);
     }
     return fresh;
@@ -21836,15 +22128,15 @@ class CriticGate {
     });
     deps.logger.diagnostic("info", `Critic ${verdict.status}: ${verdict.summary} (${count} issue(s))`);
   }
-  inject(deps, verdict, fresh, canRepair) {
-    if (!canRepair) {
-      deps.contextManager.addMessage({
-        role: "user",
-        content: `<system-summary>${t("critic.advice", { issues: renderIssues(fresh) })}</system-summary>`
-      });
-      return;
-    }
+  injectRepeatOrAdvice(deps, fresh, isRepeat) {
+    deps.contextManager.addMessage({
+      role: "user",
+      content: `<system-summary>${isRepeat ? t("critic.repeat", { issues: renderIssues(fresh) }) : t("critic.advice", { issues: renderIssues(fresh) })}</system-summary>`
+    });
+  }
+  injectRepair(deps, verdict, fresh) {
     deps.state.criticRepairCycles++;
+    deps.onMeta?.(t("ui.draft_retracted"), "retract");
     deps.slog.logCritic("critic_escalation", {
       summary: verdict.summary,
       cycle: deps.state.criticRepairCycles
@@ -21858,9 +22150,11 @@ class CriticGate {
     });
   }
 }
-function gatherTurnToolEvents(contextManager) {
+function gatherTurnToolEvents(contextManager, fromIndex = 0) {
   const events = [];
-  for (const m of contextManager.getActiveHistory()) {
+  const history = contextManager.getActiveHistory();
+  const start = Math.max(0, Math.min(fromIndex, history.length));
+  for (const m of history.slice(start)) {
     if (m.role !== "tool" || !m.name)
       continue;
     const output = typeof m.content === "string" ? m.content.slice(-MAX_EVENT_OUTPUT_CHARS) : undefined;
@@ -21868,7 +22162,7 @@ function gatherTurnToolEvents(contextManager) {
   }
   return events;
 }
-var MUTATIONS_BEFORE_CHECK = 3, MAX_EVENT_OUTPUT_CHARS = 600;
+var MAX_EVENT_OUTPUT_CHARS = 600;
 var init_critic_gate = __esm(() => {
   init_i18n();
 });
@@ -22055,7 +22349,9 @@ ${f.excerpt}`);
     pack.toolDigest || "(empty)",
     files.length > 0 ? `FILE CONTENTS:
 ${files.join(`
-`)}` : ""
+`)}` : "",
+    pack.answerExcerpt ? `ANSWER (the agent's chat delivery — may satisfy the task without files):
+${pack.answerExcerpt}` : ""
   ].filter(Boolean).join(`
 `);
 }
@@ -22109,6 +22405,7 @@ Rules:
 - Flag ONLY issues that can be verified from the evidence provided. Do not speculate or invent.
 - Do not nitpick style, wording, or preferences unless the user's task demanded it.
 - If the evidence is insufficient to judge, return status "ok" (prefer silence over noise).
+- A chat-delivered answer (ANSWER section) can fully satisfy the task without any files or commands; absence of changed files is NOT itself an issue when ANSWER contains the requested result.
 - "critical" = the task's stated result is demonstrably not delivered. "concern" = a concrete, checkable gap. "info" = minor.
 - Every issue must reference concrete evidence (file, command, output).
 Reply with JSON ONLY:
@@ -22123,8 +22420,12 @@ var init_client = __esm(() => {
 // src/modules/critic/provider.ts
 function buildCriticProvider(critic, config, defaultProvider, deps) {
   const model = critic?.model?.trim();
-  if (!model)
+  if (!model) {
+    if (critic?.provider && Object.keys(critic.provider).length > 0) {
+      deps?.logger?.warn("critic.provider is set without critic.model — provider ignored, using active provider");
+    }
     return defaultProvider;
+  }
   try {
     const providerCfg = critic?.provider ?? {
       type: "openai-compat",
@@ -22182,7 +22483,8 @@ function buildEvidencePack(input) {
     commands,
     toolDigest: digest.slice(-MAX_DIGEST_LINES).join(`
 `),
-    fileExcerpts: input.baseDir ? readExcerpts(input.baseDir, [...changedFiles]) : undefined
+    fileExcerpts: input.baseDir ? readExcerpts(input.baseDir, [...changedFiles]) : undefined,
+    answerExcerpt: input.answerText ? redactContextSecrets(input.answerText).slice(0, MAX_ANSWER_CHARS) : undefined
   };
 }
 function digestLine(ev) {
@@ -22203,7 +22505,7 @@ function commandOf(ev) {
     return;
   return {
     command: ev.args.command,
-    exitCode: ev.ok === false ? 1 : 0,
+    exitCode: ev.ok === false ? 1 : undefined,
     output: ev.output?.slice(-MAX_DIGEST_OUTPUT_CHARS)
   };
 }
@@ -22221,9 +22523,10 @@ function readExcerpts(baseDir, paths) {
   }
   return out;
 }
-var MUTATING_TOOLS, MAX_DIGEST_LINES = 40, MAX_DIGEST_OUTPUT_CHARS = 300, MAX_EXCERPT_FILES = 5, MAX_EXCERPT_CHARS = 1200;
+var MUTATING_TOOLS, MAX_DIGEST_LINES = 40, MAX_DIGEST_OUTPUT_CHARS = 300, MAX_EXCERPT_FILES = 5, MAX_EXCERPT_CHARS = 1200, MAX_ANSWER_CHARS = 2000;
 var init_evidence = __esm(() => {
   init_tool_output();
+  init_context_log();
   MUTATING_TOOLS = new Set(["write_file", "edit_file", "delete_file", "move_file", "create_dir"]);
 });
 
@@ -22918,6 +23221,7 @@ class Agent {
     } = this.deps;
     this.abortController = new AbortController;
     const state = createLoopState();
+    state.criticHistoryMark = contextManager.getActiveHistory().length;
     const compactionService = new CompactionService({
       contextManager,
       logger: logger3,
@@ -22975,7 +23279,8 @@ class Agent {
         task: d.task,
         planSummary: d.planSummary,
         toolEvents: d.toolEvents,
-        baseDir: this.deps.baseDir
+        baseDir: this.deps.baseDir,
+        answerText: d.answerText
       }),
       signal: this.abortController?.signal
     });
@@ -23256,7 +23561,8 @@ class Agent {
         onMeta,
         onChunk,
         verbose: resolveVerbosity(this.deps.config.ui) === "verbose",
-        artifacts: resolveArtifactStates(this.deps.baseDir, textContent)
+        artifacts: resolveArtifactStates(this.deps.baseDir, textContent),
+        slog
       });
       if (verdict.action === "block") {
         return {
@@ -23309,8 +23615,10 @@ class Agent {
         slog,
         task: input,
         planSummary: this.deps.planSummary?.() ?? undefined,
-        toolEvents: gatherTurnToolEvents(contextManager),
-        beforeFinish: true
+        toolEvents: gatherTurnToolEvents(contextManager, state.criticHistoryMark),
+        beforeFinish: true,
+        answerText: state.mutationsSinceCritic === 0 ? textContent : undefined,
+        onMeta
       });
       if (criticAction === "retry") {
         state.suppressRepetitionRetry = true;
@@ -23322,7 +23630,8 @@ class Agent {
         maxIterations: config.maxToolIterations,
         logger: logger3,
         contextManager,
-        slog
+        slog,
+        onMeta
       });
       if (auditVerdict === null || auditVerdict.action === "pass") {
         state.finalAnswerAccepted = true;
@@ -34932,6 +35241,40 @@ var init_box = __esm(() => {
 });
 
 // src/modules/setup/answers.ts
+function securityDetailFromConfig(s) {
+  return {
+    bash: {
+      blacklist: [...s.bash.blacklist],
+      whitelist: [...s.bash.whitelist],
+      logCommands: s.bash.logCommands
+    },
+    paths: { denied: [...s.paths.denied], allowed: [...s.paths.allowed] },
+    flags: {
+      dangerousFlags: [...s.bash.dangerousFlags],
+      dangerousOperators: [...s.bash.dangerousOperators]
+    },
+    network: {
+      enabled: s.network.enabled,
+      deniedDomains: [...s.network.deniedDomains],
+      allowedDomains: [...s.network.allowedDomains],
+      requestTimeout: s.network.requestTimeout,
+      maxResponseSize: s.network.maxResponseSize
+    },
+    advanced: {
+      maxRecursionDepth: s.maxRecursionDepth,
+      maxFileOperations: s.maxFileOperations,
+      maxRequestsPerMinute: s.rateLimits.maxRequestsPerMinute,
+      maxParallelTasks: s.rateLimits.maxParallelTasks,
+      contentScanEnabled: s.contentScan.enabled,
+      sessionEncryptionEnabled: s.sessionEncryption.enabled,
+      auditNotifierEnabled: s.auditNotifier.enabled,
+      auditNotifierMinSeverity: s.auditNotifier.minSeverity ?? "medium",
+      auditNotifierEventTypes: [...s.auditNotifier.eventTypes ?? []],
+      auditNotifierMaxRetries: s.auditNotifier.maxRetries ?? 3,
+      auditNotifierWebhookTimeout: s.auditNotifier.webhookTimeout ?? 5000
+    }
+  };
+}
 function buildSetupDisplay() {
   const providers = BUILTIN_PROVIDERS.map((spec) => {
     const option = { type: spec.type, label: spec.label };
@@ -35321,20 +35664,62 @@ function applyAnswersToConfig(config, a) {
     config.provider.entries = next;
     config.provider.active = updated.label || updated.type;
   }
-  if (config.security) {
-    config.security.enabled = true;
-    config.security.bash.enabled = true;
-    config.security.bash.blockDangerousFlags = a.securityFlagsBlock || config.security.bash.blockDangerousFlags;
-    if (a.securityBashBlock) {
-      config.security.bash.blacklist = [
-        ...new Set([...config.security.bash.blacklist, ...SECURITY_BASH_BLOCKLIST])
-      ];
-    }
-    config.security.paths.enabled = a.securityPathsRestrict;
-  }
+  applySecurityAnswers(config, a);
   return config;
 }
-var SECURITY_BASH_BLOCKLIST;
+function applySecurityAnswers(config, a) {
+  if (!config.security)
+    return;
+  config.security.enabled = true;
+  config.security.bash.enabled = true;
+  config.security.bash.blockDangerousFlags = a.securityFlagsBlock || config.security.bash.blockDangerousFlags;
+  if (a.securityBashBlock) {
+    config.security.bash.blacklist = [
+      ...new Set([...config.security.bash.blacklist, ...SECURITY_BASH_BLOCKLIST])
+    ];
+  }
+  config.security.paths.enabled = a.securityPathsRestrict;
+  if (a.securityDetail)
+    applySecurityDetail(config.security, a.securityDetail);
+}
+function readPath(obj, path) {
+  let cur = obj;
+  for (const key of path.split(".")) {
+    if (cur === null || typeof cur !== "object")
+      return;
+    cur = cur[key];
+  }
+  return cur;
+}
+function writePath(obj, path, value) {
+  const keys = path.split(".");
+  let cur = obj;
+  for (let i = 0;i < keys.length - 1; i++) {
+    if (cur[keys[i]] === null || typeof cur[keys[i]] !== "object")
+      cur[keys[i]] = {};
+    cur = cur[keys[i]];
+  }
+  cur[keys[keys.length - 1]] = value;
+}
+function isFieldValue(v, kind) {
+  if (kind === "list")
+    return Array.isArray(v) && v.every((x) => typeof x === "string");
+  if (kind === "bool")
+    return typeof v === "boolean";
+  if (kind === "int")
+    return typeof v === "number" && Number.isInteger(v) && v > 0;
+  return typeof v === "string" && SEVERITIES2.includes(v);
+}
+function applySecurityDetail(security, detail) {
+  const target = security;
+  for (const field of DETAIL_FIELDS) {
+    const value = readPath(detail, field.from);
+    if (!isFieldValue(value, field.kind))
+      continue;
+    writePath(target, field.to, Array.isArray(value) ? [...value] : value);
+  }
+}
+var SECURITY_BASH_BLOCKLIST, SEVERITIES2, DETAIL_FIELDS;
 var init_apply = __esm(() => {
   SECURITY_BASH_BLOCKLIST = [
     "rm",
@@ -35354,6 +35739,32 @@ var init_apply = __esm(() => {
     "shutdown",
     "reboot"
   ];
+  SEVERITIES2 = ["low", "medium", "high", "critical"];
+  DETAIL_FIELDS = [
+    { from: "bash.blacklist", to: "bash.blacklist", kind: "list" },
+    { from: "bash.whitelist", to: "bash.whitelist", kind: "list" },
+    { from: "bash.logCommands", to: "bash.logCommands", kind: "bool" },
+    { from: "paths.denied", to: "paths.denied", kind: "list" },
+    { from: "paths.allowed", to: "paths.allowed", kind: "list" },
+    { from: "flags.dangerousFlags", to: "bash.dangerousFlags", kind: "list" },
+    { from: "flags.dangerousOperators", to: "bash.dangerousOperators", kind: "list" },
+    { from: "network.enabled", to: "network.enabled", kind: "bool" },
+    { from: "network.deniedDomains", to: "network.deniedDomains", kind: "list" },
+    { from: "network.allowedDomains", to: "network.allowedDomains", kind: "list" },
+    { from: "network.requestTimeout", to: "network.requestTimeout", kind: "int" },
+    { from: "network.maxResponseSize", to: "network.maxResponseSize", kind: "int" },
+    { from: "advanced.maxRecursionDepth", to: "maxRecursionDepth", kind: "int" },
+    { from: "advanced.maxFileOperations", to: "maxFileOperations", kind: "int" },
+    { from: "advanced.maxRequestsPerMinute", to: "rateLimits.maxRequestsPerMinute", kind: "int" },
+    { from: "advanced.maxParallelTasks", to: "rateLimits.maxParallelTasks", kind: "int" },
+    { from: "advanced.contentScanEnabled", to: "contentScan.enabled", kind: "bool" },
+    { from: "advanced.sessionEncryptionEnabled", to: "sessionEncryption.enabled", kind: "bool" },
+    { from: "advanced.auditNotifierEnabled", to: "auditNotifier.enabled", kind: "bool" },
+    { from: "advanced.auditNotifierMinSeverity", to: "auditNotifier.minSeverity", kind: "severity" },
+    { from: "advanced.auditNotifierEventTypes", to: "auditNotifier.eventTypes", kind: "list" },
+    { from: "advanced.auditNotifierMaxRetries", to: "auditNotifier.maxRetries", kind: "int" },
+    { from: "advanced.auditNotifierWebhookTimeout", to: "auditNotifier.webhookTimeout", kind: "int" }
+  ];
 });
 
 // src/cli/setup-order.ts
@@ -51823,6 +52234,11 @@ function makeForwarder(s, sink = (ev) => broadcast(ev, s), opts = {}) {
       schedule();
     },
     onMeta(chunk, kind) {
+      if (kind === "retract") {
+        flush();
+        sink({ type: "retract", ts: Date.now(), reason: stripAnsi2(chunk) });
+        return;
+      }
       const next = kind ?? "status";
       if (buf.meta && (buf.metaKind ?? "status") !== next)
         flush();
@@ -53633,9 +54049,11 @@ function servePreview(res, absReal, buf) {
 
 // src/modules/webui/setup-api.ts
 init_i18n();
+init_registry_extra();
 init_apply();
 init_answers();
 init_discovery();
+init_provider_context();
 function str3(rec, key) {
   const v = rec[key];
   return typeof v === "string" ? v.trim() : "";
@@ -53645,6 +54063,76 @@ function positiveInt(rec, key) {
   const n = typeof v === "number" ? v : typeof v === "string" ? Number(v) : NaN;
   return Number.isInteger(n) && n > 0 ? n : null;
 }
+var SEVERITIES3 = ["low", "medium", "high", "critical"];
+var MAX_DETAIL_LIST = 200;
+var MAX_DETAIL_ITEM = 200;
+function strList(v) {
+  if (!Array.isArray(v))
+    return;
+  const out = v.filter((x) => typeof x === "string").map((x) => x.trim()).filter((x) => x !== "" && x.length <= MAX_DETAIL_ITEM).slice(0, MAX_DETAIL_LIST);
+  return out;
+}
+function optBool(v) {
+  return typeof v === "boolean" ? v : undefined;
+}
+function optInt(v) {
+  const n = typeof v === "number" ? v : typeof v === "string" ? Number(v) : NaN;
+  return Number.isInteger(n) && n > 0 ? n : undefined;
+}
+function parseSecurityDetail(v) {
+  if (!v || typeof v !== "object")
+    return;
+  const rec = v;
+  const detail = {};
+  const bash = rec.bash;
+  if (bash && typeof bash === "object") {
+    detail.bash = {
+      blacklist: strList(bash.blacklist),
+      whitelist: strList(bash.whitelist),
+      logCommands: optBool(bash.logCommands)
+    };
+  }
+  const paths = rec.paths;
+  if (paths && typeof paths === "object") {
+    detail.paths = { denied: strList(paths.denied), allowed: strList(paths.allowed) };
+  }
+  const flags = rec.flags;
+  if (flags && typeof flags === "object") {
+    detail.flags = {
+      dangerousFlags: strList(flags.dangerousFlags),
+      dangerousOperators: strList(flags.dangerousOperators)
+    };
+  }
+  const network = rec.network;
+  if (network && typeof network === "object") {
+    detail.network = {
+      enabled: optBool(network.enabled),
+      deniedDomains: strList(network.deniedDomains),
+      allowedDomains: strList(network.allowedDomains),
+      requestTimeout: optInt(network.requestTimeout),
+      maxResponseSize: optInt(network.maxResponseSize)
+    };
+  }
+  const adv = rec.advanced;
+  if (adv && typeof adv === "object") {
+    const rawSev = adv.auditNotifierMinSeverity;
+    const sev = typeof rawSev === "string" && SEVERITIES3.includes(rawSev) ? rawSev : undefined;
+    detail.advanced = {
+      maxRecursionDepth: optInt(adv.maxRecursionDepth),
+      maxFileOperations: optInt(adv.maxFileOperations),
+      maxRequestsPerMinute: optInt(adv.maxRequestsPerMinute),
+      maxParallelTasks: optInt(adv.maxParallelTasks),
+      contentScanEnabled: optBool(adv.contentScanEnabled),
+      sessionEncryptionEnabled: optBool(adv.sessionEncryptionEnabled),
+      auditNotifierEnabled: optBool(adv.auditNotifierEnabled),
+      auditNotifierMinSeverity: sev,
+      auditNotifierEventTypes: strList(adv.auditNotifierEventTypes)?.filter((e) => AUDIT_EVENT_TYPES.includes(e)),
+      auditNotifierMaxRetries: optInt(adv.auditNotifierMaxRetries),
+      auditNotifierWebhookTimeout: optInt(adv.auditNotifierWebhookTimeout)
+    };
+  }
+  return detail;
+}
 function parseSetupAnswers(rec) {
   const provider = str3(rec, "provider");
   const apiBase = str3(rec, "apiBase");
@@ -53674,15 +54162,17 @@ function parseSetupAnswers(rec) {
     locale,
     securityBashBlock: rec.securityBashBlock,
     securityFlagsBlock: rec.securityFlagsBlock,
-    securityPathsRestrict: rec.securityPathsRestrict
+    securityPathsRestrict: rec.securityPathsRestrict,
+    securityDetail: parseSecurityDetail(rec.securityDetail)
   };
 }
 function handleSetupGet(res, s) {
+  const defaults = s.setup?.defaults ?? { contextWindow: 0, maxToolIterations: 0 };
   sendJson(res, 200, {
     required: s.setupRequired,
     languages: s.setup?.languages ?? [],
     providers: s.setup?.providers ?? [],
-    defaults: s.setup?.defaults ?? { contextWindow: 0, maxToolIterations: 0 }
+    defaults: s.config?.security ? { ...defaults, security: securityDetailFromConfig(s.config.security) } : defaults
   });
 }
 function handleSetupScan(req, res, s) {
@@ -53728,6 +54218,31 @@ function handleSetupTest(req, res, s) {
     readBodyError(req, res, err);
   });
 }
+function handleSetupContext(req, res, s) {
+  readJsonBody(req, s.maxBodyBytes).then(async (rec) => {
+    if (!rec) {
+      sendJson(res, 400, { ok: false, error: "invalid JSON" });
+      return;
+    }
+    const baseUrl = str3(rec, "baseUrl");
+    const model = str3(rec, "model");
+    if (!baseUrl || !model) {
+      sendJson(res, 400, { ok: false, error: "invalid-context-request" });
+      return;
+    }
+    const probe = await probeProviderContext(baseUrl, model, {
+      apiKey: str3(rec, "apiKey") || undefined,
+      providerType: str3(rec, "providerType") || undefined
+    });
+    if (!probe) {
+      sendJson(res, 200, { ok: false });
+      return;
+    }
+    sendJson(res, 200, { ok: true, contextWindow: probe.actual, model: probe.model });
+  }).catch((err) => {
+    readBodyError(req, res, err);
+  });
+}
 function handleSetupLocale(req, res, s) {
   readJsonBody(req, s.maxBodyBytes).then((rec) => {
     if (!rec) {
@@ -53800,6 +54315,10 @@ function handleSetupApi(req, res, reqUrl, s) {
     handleSetupTest(req, res, s);
     return true;
   }
+  if (p === "/api/setup/context" && req.method === "POST") {
+    handleSetupContext(req, res, s);
+    return true;
+  }
   if (p === "/api/setup/locale" && req.method === "POST") {
     handleSetupLocale(req, res, s);
     return true;
@@ -53877,6 +54396,7 @@ var API_ROUTES = {
   "GET /api/models": (_req, res, s) => handleModelsGet(res, s),
   "POST /api/command": (req, res, s) => handleCommandPost(req, res, s),
   "POST /api/interrupt": (_req, res, s) => handleInterruptPost(res, s),
+  "POST /api/index": (_req, res, s) => handleIndexPost(res, s),
   "POST /api/mcp": (req, res, s) => handleMcpCreate(req, res, s),
   "GET /api/lsp": (_req, res, s) => handleLspGet(res, s)
 };
@@ -53918,6 +54438,14 @@ function handleInterruptPost(res, s) {
   s.bridge?.interrupt();
   sendJson(res, 200, { ok: true });
 }
+function handleIndexPost(res, s) {
+  if (!s.refreshIndex) {
+    sendJson(res, 503, { error: "unavailable" });
+    return;
+  }
+  Promise.resolve(s.refreshIndex()).catch(() => {});
+  sendJson(res, 202, { ok: true });
+}
 function handleRequest(req, res, assets, s) {
   let reqUrl;
   try {
@@ -54178,8 +54706,16 @@ async function startWebUi(deps) {
   state.plugins = deps.plugins;
   state.workspace = deps.baseDir;
   state.agentsMd = deps.agentsMd;
-  if (deps.indexer)
+  if (deps.indexer) {
     state.projectMapStats = () => deps.indexer?.stats() ?? null;
+    if (deps.indexer.refresh) {
+      const refresh = deps.indexer.refresh.bind(deps.indexer);
+      state.refreshIndex = async () => {
+        await refresh();
+        broadcast({ type: "state", ts: Date.now(), busy: state.busy, usage: state.usage }, state);
+      };
+    }
+  }
   state.saveConfig = (config) => saveConfig(config, CONFIG_FILE, deps.configDir);
   installWebPromptIO({
     state,
@@ -54223,10 +54759,7 @@ async function startWebUi(deps) {
       contextProbe: probe,
       workspace: deps.baseDir,
       instructions: deps.agentsMd,
-      projectMap: (() => {
-        const s = deps.indexer?.stats();
-        return s ? { indexed: true, ...s } : { indexed: false, files: 0, symbols: 0, tokens: 0 };
-      })()
+      projectMap: deps.indexer?.mapInfo?.()
     }, state.busy),
     addPendingImage: (url2) => {
       deps.agent.contextManager?.addPendingImage?.({