micro-models-agent 2.8.0 → 2.10.0

package/dist/assets/styles.css

@@ -239,6 +239,8 @@ body {
 .ans { color: var(--ans); white-space: pre-wrap; word-break: break-word; overflow-wrap: anywhere; }
 .think-h { color: var(--think); cursor: pointer; user-select: none; display: flex; gap: 8px; align-items: baseline; font-size: 12.5px; }
 .think-h .dur, .think-h .tog { color: var(--dim-b); }
+.think-h .tog { display: inline-flex; align-items: center; gap: 4px; }
+.think-h .tog .svg-icon { width: 12px; height: 12px; }
 .think-h .tog:hover { color: var(--dim-a); }
 .think-body { color: var(--dim-c); padding-left: 18px; white-space: pre-wrap; font-size: 12.5px; overflow-wrap: anywhere; }
 .think-body.hidden { display: none; }
@@ -410,6 +412,9 @@ body.light .imgcard .ph { background: var(--ph-light); }
 .startbanner b { font-weight: 400; color: var(--dim-a); }
 .errline { color: var(--err); padding-left: 26px; overflow-wrap: anywhere; }
 .errline .hint { color: var(--dim-a); display: block; }
+/* settings JSON validation hint — own class so global `.errline` queries
+   (chat turn errors, e2e) never match hidden settings rows. */
+.json-err { color: var(--err); overflow-wrap: anywhere; }
 .grouped { color: var(--dim-a); padding-left: 8px; overflow-wrap: anywhere; }
 .grouped .pipe { color: var(--pipe); }
 .msgs .busy { color: var(--think); display: flex; gap: 8px; align-items: baseline; font-size: 12.5px; }
@@ -667,20 +672,22 @@ body.light .kv .wn { color: var(--yellow); }
 .confirm-actions .linkbtn.danger { border-color: var(--red-strong); color: var(--red-strong); }
 .confirm-actions .linkbtn.danger:hover { background: var(--x-hover-bg); }
 
-/* nested provider add/edit dialog (opens above the settings modal) */
+/* nested sub-dialog (provider / MCP / LSP edit; opens above settings) */
 .overlay.overlay-nested { z-index: 60; }
-.modal.modal-provider {
-  width: min(520px, 92vw); height: auto; max-height: 88vh; border-radius: 8px;
+.modal.modal-sub {
+  width: min(560px, 92vw); height: auto; max-height: 88vh; border-radius: 8px;
 }
 .provider-body { display: block; padding: 20px 22px 22px; overflow-y: auto; }
 .provider-body .pform {
   margin: 0; padding: 0; border: 0; background: none;
 }
+#subHost .pform-title { display: none; }
 .menu-col {
-  width: 200px; min-width: 200px; padding: 12px 8px;
-  border-right: 1px solid var(--border); overflow-y: auto;
-  min-height: 0; flex: 0 0 auto;
+  width: 210px; min-width: 210px; padding: 12px 8px 8px;
+  border-right: 1px solid var(--border);
+  display: flex; flex-direction: column; min-height: 0; flex: 0 0 auto;
 }
+.menu-col #setMenu { overflow-y: auto; min-height: 0; flex: 1 1 auto; }
 .menu-col .mi {
   padding: 7px 12px; border-radius: 4px; cursor: pointer;
   color: var(--muted); margin-bottom: 2px; font-size: 13px;
@@ -877,6 +884,93 @@ body.light .toggle { background: var(--toggle-off); }
 .pform-adv { margin-top: 18px; }
 .pform-adv summary { cursor: pointer; font-size: 11.5px; color: var(--dim-a); text-transform: uppercase; letter-spacing: .04em; }
 .pform-adv .pform-grid { margin-top: 12px; }
+
+.sec-desc { color: var(--dim-a); font-size: 11.5px; line-height: 1.4; padding: 6px 0 0; max-width: 70ch; }
+
+/* structured editors (tags / checkboxes / table) own the full row width */
+.row > .ctl-block { flex-basis: 100%; min-width: 0; }
+
+.tagsctl, .checksctl, .tablectl { display: flex; flex-direction: column; gap: 8px; padding-top: 4px; }
+.tags-list { display: flex; flex-wrap: wrap; gap: 6px; }
+.tags-empty { color: var(--dim-b); font-size: 12px; }
+.tag-chip {
+  display: inline-flex; align-items: center; gap: 4px; max-width: 100%;
+  background: var(--surface); border: 1px solid var(--border-2); border-radius: 999px;
+  padding: 2px 6px 2px 10px; font-size: 12px; color: var(--fg);
+}
+.tag-chip .tag-text { overflow: hidden; text-overflow: ellipsis; white-space: nowrap; max-width: 320px; }
+.tag-chip .tag-rm { color: var(--dim-a); padding: 0 2px; }
+.tag-chip .tag-rm:hover { color: var(--red-strong); }
+.tags-add, .table-add { display: flex; gap: 6px; align-items: center; }
+.tags-add input, .table-add input {
+  flex: 1 1 160px; min-width: 0; max-width: 320px;
+  background: var(--input-surface); border: 1px solid var(--border-2); border-radius: 4px;
+  color: var(--fg); font: inherit; font-size: 12.5px; padding: 5px 8px; text-align: left;
+}
+.tags-plus, .table-plus { color: var(--accent); font-size: 14px; }
+
+/* `.row input` is a right-aligned 120px field — checkboxes must not inherit it. */
+.checksctl { display: grid; grid-template-columns: repeat(auto-fit, minmax(190px, 1fr)); gap: 6px 18px; }
+.check-line { display: inline-flex; align-items: center; gap: 8px; font-size: 12.5px; color: var(--muted); cursor: pointer; min-width: 0; }
+.check-line input[type="checkbox"] { width: auto; flex: 0 0 auto; margin: 0; text-align: left; accent-color: var(--accent); }
+.check-line span { overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+
+.tablectl { gap: 4px; overflow-x: auto; }
+.table-head, .table-row {
+  display: grid; grid-template-columns: minmax(120px, 1.4fr) repeat(auto-fit, minmax(84px, 1fr)) 28px;
+  gap: 6px; align-items: center; min-width: 0;
+}
+.table-head .table-th { font-size: 10.5px; text-transform: uppercase; letter-spacing: .04em; color: var(--dim-a); }
+.table-row { padding: 3px 0; }
+.table-row input {
+  width: 100%; min-width: 0;
+  background: var(--input-surface); border: 1px solid var(--border-2); border-radius: 4px;
+  color: var(--fg); font: inherit; font-size: 12px; padding: 4px 6px; text-align: left;
+}
+.table-row input[type="checkbox"] { width: auto; justify-self: start; accent-color: var(--accent); }
+.table-row .table-rm { color: var(--dim-a); }
+.table-row .table-rm:hover { color: var(--red-strong); }
+.table-body:empty::after { content: "—"; color: var(--dim-b); font-size: 12px; }
+
+/* settings search */
+.set-search {
+  position: relative; display: flex; align-items: center; gap: 6px;
+  margin: 0 4px 10px; padding: 0 8px;
+  background: var(--input-surface); border: 1px solid var(--border-2); border-radius: 5px;
+}
+.set-search .set-search-icon { display: inline-flex; color: var(--dim-a); flex: 0 0 auto; }
+.set-search .set-search-icon .svg-icon { width: 13px; height: 13px; }
+.set-search input {
+  flex: 1 1 auto; min-width: 0; background: none; border: 0; outline: none;
+  color: var(--fg); font: inherit; font-size: 12.5px; padding: 7px 0;
+}
+.set-search input::-webkit-search-cancel-button { display: none; }
+.set-search .set-search-clear { color: var(--dim-a); flex: 0 0 auto; }
+.set-search:focus-within { border-color: var(--inp-focus); box-shadow: 0 0 0 2px var(--input-shadow); }
+.set-results { display: flex; flex-direction: column; gap: 1px; }
+.set-result {
+  display: grid; grid-template-columns: 1fr auto; gap: 2px 8px;
+  padding: 6px 8px; border-radius: 4px; cursor: pointer;
+}
+.set-result:hover, .set-result.on { background: var(--accent-bg); }
+.set-result .sr-label { color: var(--fg); font-size: 12.5px; min-width: 0; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+.set-result .sr-panel { grid-column: 2; grid-row: 1; color: var(--dim-a); font-size: 11px; white-space: nowrap; }
+.set-result .sr-key {
+  grid-column: 1 / -1; color: var(--dim-b); font-size: 10.5px;
+  overflow: hidden; text-overflow: ellipsis; white-space: nowrap;
+}
+.set-results-empty { color: var(--dim-b); font-size: 12px; padding: 8px; }
+
+/* a searched setting blinks so the eye lands on it after navigation */
+.row-flash { animation: rowflash 1.2s ease-out; }
+@keyframes rowflash {
+  0%, 40% { background: var(--accent-bg); }
+  100% { background: transparent; }
+}
+
+/* sub-dialog (nested edit: provider / MCP / LSP) */
+#subHost .pform { margin: 0; padding: 0; border: 0; background: none; }
+#subHost .pform-title { display: none; }
 .pform-actions { display: flex; gap: 14px; align-items: center; padding-top: 22px; }
 .pform-actions .linkbtn.dim { color: var(--dim-a); }
 .settings-note { color: var(--dim-b); font-size: 11.5px; line-height: 1.7; padding: 8px 0 4px; }
@@ -1010,12 +1104,14 @@ button.toggle:disabled { opacity: .5; cursor: default; }
   }
   .modal-body { flex-direction: column; min-width: 0; }
   .menu-col {
-    width: 100%; min-width: 0; display: flex; flex-direction: row;
-    gap: 6px; overflow-x: auto; overflow-y: hidden;
-    border-right: none; border-bottom: 1px solid var(--border);
+    width: 100%; min-width: 0; display: flex; flex-direction: column;
+    gap: 6px; border-right: none; border-bottom: 1px solid var(--border);
     padding: 8px 10px; flex: 0 0 auto;
   }
+  .menu-col #setMenu { display: flex; flex-direction: row; gap: 6px; overflow-x: auto; overflow-y: hidden; }
   .menu-col .mi { white-space: nowrap; margin-bottom: 0; flex: 0 0 auto; width: auto; }
+  .set-search { margin: 0 0 2px; }
+  .set-results { max-height: 40vh; overflow-y: auto; }
   .content-col { padding: 14px; }
   .row { font-size: 12.5px; }
   .input-area { margin: 8px 10px 10px; }

package/dist/i18n/en.json

@@ -200,7 +200,7 @@
   "tool.interactive_disabled": "Interactive tool is disabled in exit-on-complete mode. Proceed without asking the user.",
   "proc.started": "Started background process {id} (PID {pid}).\nCommand: {command}",
   "proc.promoted_hint": "Command still running after {ms} ms — moved to the background",
-  "proc.manage_hint": "Check output: process_log id={id}. Stop it: process_kill id={id}. List all: process_list.",
+  "proc.manage_hint": "Check output: process_log id={id}. Wait for completion: process_wait id={id}. Stop it: process_kill id={id}. List all: process_list.",
   "proc.output_preview": "First output:\n{lines}",
   "proc.none": "No background processes running.",
   "proc.not_found": "Process not found: {id}",
@@ -215,9 +215,13 @@
   "proc.status_running": "running",
   "proc.status_exited": "exited",
   "proc.status_killed": "killed",
+  "proc.wait_exited": "Process {id} {status} after {ms} ms with exit code {code}.",
+  "proc.wait_running": "Process {id} still running after {ms} ms.",
+  "proc.wait_hint": "Wait again: process_wait id={id}. Check output: process_log id={id}. Stop it: process_kill id={id}.",
   "tool.friendly.process_list": "Listing background processes",
   "tool.friendly.process_log": "Process output",
   "tool.friendly.process_kill": "Stopping process",
+  "tool.friendly.process_wait": "Waiting for process",
   "plan.no_steps": "No plan steps specified. Provide concrete steps with files and commands.",
   "plan.created": "Plan created: {title} ({steps} steps)",
   "plan.coverage_warning": "Plan may be missing required files from the task: {missing}. Add steps covering them.",
@@ -311,7 +315,9 @@
   "cli.manage_config": "Manage configuration",
   "cli.config_key": "Config key (e.g., model, provider.baseUrl)",
   "cli.set_value": "Set a config value",
+  "cli.config_force": "Bypass validation and write the raw value as-is",
   "cli.set_done": "Set {key}={value}",
+  "cli.config_invalid": "Invalid value for '{key}' ({reason}). Config not changed.",
   "cli.show_config": "Show the effective configuration (secrets redacted; use --show-secrets to reveal)",
   "cli.migrate_config": "Migrate legacy config.json to domain format",
   "cli.manage_models": "Manage models",
@@ -419,6 +425,7 @@
   "cli.export_format": "Output format: md|json|jsonl (default md)",
   "cli.export_out": "Output path ('-' for stdout)",
   "cli.export_no_redact": "Do not redact secrets",
+  "cli.export_compact": "Omit tool result bodies (compact readable export)",
   "cli.first_run": "First run detected. Running setup wizard...",
   "cli.first_run_oneshot": "No configuration found — running with defaults. Run `mma` (no arguments) once to set up the wizard.",
   "cli.web_setup_required": "No configuration found — opening the browser setup wizard.",
@@ -509,6 +516,7 @@
   "repl.last_action_none": "No recent action to show.",
   "repl.status": "Show a compact status line",
   "repl.status_usage": "Usage: /status",
+  "repl.security": "Show security configuration (on/off per area)",
   "repl.plugins": "List loaded plugins",
   "repl.plugins_usage": "Usage: /plugins [--all]",
   "repl.sessions": "List all sessions (* active)",
@@ -623,7 +631,7 @@
   "repl.help_aliases": "Aliases: {names}",
   "repl.help_examples": "Examples:",
   "repl.export": "Export a session to a file",
-  "repl.export_usage": "Usage: /export [<id|name>] [--format md|json|jsonl] [--out <path>] [--no-redact]",
+  "repl.export_usage": "Usage: /export [<id|name>] [--format md|json|jsonl] [--out <path>] [--no-redact] [--compact]",
   "config.header": "Managed settings",
   "config.col_setting": "Setting",
   "config.col_value": "Value",
@@ -751,6 +759,7 @@
   "exec.tool_errors": "Tool {tool} failed {count} times. Consider using a different tool.",
   "exec.tool_errors_recovery": "Tool {tool} has failed {count} times in a row. Try an alternative: create files directly via write_file, use a different command, or if nothing works — skip this step via plan update step=N status=skipped with a note explaining why.",
   "exec.repetitive_tool": "Called {tool} {count} times with identical arguments and result. Try a different approach — create files directly, change arguments, or check process status via process_log.",
+  "exec.repetitive_process_log_hint": "You are polling a background process — call process_wait once instead of polling process_log.",
   "exec.consecutive_failures_recovery": "{count} consecutive tool failures. Create files directly via write_file instead of terminal commands. Check that dependencies are installed (npm install). Do not run build/tests until all files are created.",
   "exec.bash_flailing_recovery": "bash failed in {fails} of the last {window} attempts. Stop using shell commands for file operations on this machine — they do not work. Use the dedicated tools instead: read_file (the header shows line counts), write_file, edit_file, file_info (file size), glob/grep for search",
   "exec.bash_flailing": "bash failed in {fails} of the last {window} attempts.",
@@ -793,6 +802,7 @@
   "hall.uncertainty": "Uncertainty markers: {markers}",
   "hall.unknown_paths": "Mentioned file paths not found in known files: {paths}",
   "hall.contradiction_llm": "Contradicts an earlier decision{reason}",
+  "hall.claim_contradiction": "The answer claims success, but a recent tool result indicates a problem ({tool}: {snippet}). Either verify and fix, then re-run the check — or soften the claim to match the evidence (e.g. staged, will appear shortly).",
   "hall.uncertainty_prefix": "\n\n[⚠️ Uncertainty] ",
   "browser.repeated_action": "You have repeated the same action ({action}) {threshold} times. Try a different approach: use \"snapshot\" to re-read the page, try different element numbers, or navigate to a different URL.",
   "browser.unknown_action": "Unknown action: {action}",
@@ -1074,6 +1084,15 @@
   "config.enum.max": "max",
   "config.enum.en": "English",
   "config.enum.ru": "Russian",
+  "config.enum.security_block": "security block",
+  "config.enum.bash_command": "bash command",
+  "config.enum.file_operation": "file operation",
+  "config.enum.network_request": "network request",
+  "config.enum.tool_call": "tool call",
+  "config.enum.authentication": "authentication",
+  "config.enum.configuration_change": "config change",
+  "config.enum.session_start": "session start",
+  "config.enum.session_end": "session end",
   "config.desc.model": "Model used for the main agent.",
   "config.desc.provider.active": "Which configured provider is used.",
   "config.desc.contextWindow": "Total context size in tokens (system prompt + history + reserve).",
@@ -1092,7 +1111,7 @@
   "config.desc.critic.timeoutMs": "Verifier call timeout (fail-open).",
   "config.desc.logLevel": "Diagnostic log verbosity.",
   "config.desc.locale": "Language of the interface and agent messages.",
-  "config.desc.version": "Installed MMA version (read-only).",
+  "config.desc.version": "Installed MMA version.",
   "config.desc.security.enabled": "Master switch for the security module (path checks, content scans, limits).",
   "config.desc.security.paths.enabled": "Restrict file operations to the workspace and block paths outside it.",
   "config.desc.security.contentScan.enabled": "Scan file contents for dangerous patterns before writing.",
@@ -1104,12 +1123,99 @@
   "web.settings.context": "Context",
   "web.settings.reasoning": "Reasoning",
   "web.settings.agent": "Agent",
+  "web.settings.network": "Network",
+  "web.settings.browser": "Browser",
+  "web.settings.sessions": "Sessions",
   "web.settings.ui": "UI & Theme",
   "web.settings.memory": "Memory",
   "web.settings.skills": "Skills",
   "web.settings.plugins": "Plugins · MCP",
   "web.settings.security": "Security",
   "web.settings.advanced": "Advanced",
+  "web.settings.search_placeholder": "search settings",
+  "web.settings.search_empty": "no matching setting",
+  "web.settings.table_invalid": "fill the required fields first ({field})",
+  "web.settings.sec.general.interface": "Interface",
+  "web.settings.sec.general.agent": "Agent loop",
+  "web.settings.sec.general.agent.desc": "How long and how persistently the agent works before it stops.",
+  "web.settings.sec.general.provider": "Providers",
+  "web.settings.sec.model.tuning": "Performance",
+  "web.settings.sec.model.tuning.desc": "Token budget and how the model is loaded into memory.",
+  "web.settings.sec.model.capabilities": "Capabilities",
+  "web.settings.sec.model.capabilities.desc": "Manual overrides for vision/tools when probing a model gets it wrong.",
+  "web.settings.sec.context.window": "Context window",
+  "web.settings.sec.context.window.desc": "Total window and how it is split between the system prompt, the reply and history.",
+  "web.settings.sec.context.compaction": "Compaction",
+  "web.settings.sec.context.compaction.desc": "When old history is summarised to free space.",
+  "web.settings.sec.context.instructions": "Instructions",
+  "web.settings.sec.context.instructions.desc": "What happens when AGENTS.md or the project map is too large for the prompt.",
+  "web.settings.sec.context.log": "Context log",
+  "web.settings.sec.context.log.desc": "Write every prompt sent to the model to a diff file next to the session.",
+  "web.settings.sec.reasoning.display": "Display",
+  "web.settings.sec.reasoning.effort": "Effort",
+  "web.settings.sec.reasoning.effort.desc": "Stop overrides the range — auto picks a level per step inside it.",
+  "web.settings.sec.agent.moe": "Mixture of experts",
+  "web.settings.sec.agent.moe.desc": "Split work into expert subtasks with a planner; slower but stronger on multi-step tasks.",
+  "web.settings.sec.agent.critic": "Critic",
+  "web.settings.sec.agent.critic.desc": "A second pass that reviews the agent's own work before it answers.",
+  "web.settings.sec.agent.tools": "Tools & skills",
+  "web.settings.sec.agent.tools.desc": "Which tools are visible up front and how much of the prompt skills may use.",
+  "web.settings.sec.agent.subagent": "Sub-agents",
+  "web.settings.sec.agent.subagent.desc": "How results from sub-agents come back and how they are parallelised.",
+  "web.settings.sec.agent.hallucination": "Hallucination check",
+  "web.settings.sec.agent.hallucination.desc": "Run a consistency pass on the reply before showing it.",
+  "web.settings.sec.network.web": "Web search",
+  "web.settings.sec.network.web.desc": "Master switch for the web_search tool.",
+  "web.settings.sec.network.error": "Automatic error search",
+  "web.settings.sec.network.error.desc": "Search the web when the same error repeats.",
+  "web.settings.sec.browser.main": "Browser",
+  "web.settings.sec.browser.limits": "Limits",
+  "web.settings.sec.browser.limits.desc": "Caps that keep a page snapshot small enough for the context window.",
+  "web.settings.sec.browser.viewport": "Viewport & timeouts",
+  "web.settings.sec.sessions.main": "Sessions",
+  "web.settings.sec.sessions.main.desc": "Saving, naming and how many past sessions are kept.",
+  "web.settings.sec.sessions.isolation": "Isolation",
+  "web.settings.sec.sessions.isolation.desc": "Keep plugins and temp files separate per session.",
+  "web.settings.sec.ui.chat": "Chat output",
+  "web.settings.sec.ui.chat.desc": "Status lines, progress and context meters in the chat feed.",
+  "web.settings.sec.ui.theme": "Theme",
+  "web.settings.sec.ui.theme.desc": "Colour scheme of this web UI. Stored in the browser, not in the config file.",
+  "web.settings.sec.memory.add": "Add a note",
+  "web.settings.memory_add_title": "new memory",
+  "config.field.name": "name",
+  "config.field.model": "model",
+  "config.field.tool_tags": "tool tags",
+  "config.field.max_attempts": "attempts",
+  "config.field.description": "description",
+  "config.field.input": "input $/1M",
+  "config.field.output": "output $/1M",
+  "config.field.cachedInput": "cached $/1M",
+  "config.field.cacheWrite": "write $/1M",
+  "config.field.vision": "vision",
+  "config.field.tools": "tools",
+  "web.settings.sec.security.switches": "Switches",
+  "web.settings.sec.security.switches.desc": "Master switches per protection. Turning one off disables its whole group below.",
+  "web.settings.sec.security.limits": "Limits",
+  "web.settings.sec.security.limits.desc": "Depth, volume and rate caps for tool activity.",
+  "web.settings.sec.security.bash": "Bash rules",
+  "web.settings.sec.security.bash.desc": "Commands, flags and operators the bash tool refuses.",
+  "web.settings.sec.security.paths": "Path rules",
+  "web.settings.sec.security.paths.desc": "Glob patterns for paths that are denied or, if set, exclusively allowed.",
+  "web.settings.sec.security.network": "Network rules",
+  "web.settings.sec.security.network.desc": "Domains blocked or, if set, exclusively allowed.",
+  "web.settings.sec.security.scan": "Content scan",
+  "web.settings.sec.security.scan.desc": "Patterns searched in file contents before writing.",
+  "web.settings.sec.security.audit": "Audit log",
+  "web.settings.sec.security.audit.desc": "Send security events to a file or a webhook.",
+  "web.settings.sec.security.encryption": "Session encryption",
+  "web.settings.sec.security.encryption.desc": "Encrypt saved chat history and session log on disk.",
+  "web.settings.sec.security.access": "Access",
+  "web.settings.sec.advanced.diagnostics": "Diagnostics",
+  "web.settings.sec.advanced.diagnostics.desc": "Log verbosity and the installed version.",
+  "web.settings.sec.advanced.retry": "Retry",
+  "web.settings.sec.advanced.retry.desc": "Backoff for failed or stalled provider requests.",
+  "web.settings.sec.advanced.service": "Service",
+  "web.settings.sec.advanced.service.desc": "Cost tracking, prices and the background update check.",
   "web.settings.add": "add",
   "web.settings.forget": "forget",
   "web.settings.search": "search",
@@ -1147,6 +1253,11 @@
   "web.settings.provider_priority": "priority",
   "web.settings.provider_rpm": "requests / min",
   "web.settings.provider_parallel": "max parallel",
+  "web.settings.provider_max_tokens": "max completion tokens",
+  "web.settings.provider_cache_mechanism": "cache mechanism",
+  "web.settings.provider_cache_report": "cache report format",
+  "web.settings.provider_cache_flags": "cache flags",
+  "web.settings.provider_retry": "retry",
   "web.settings.provider_required": "type and base URL are required",
   "web.settings.provider_invalid": "invalid numeric value",
   "web.settings.provider_active_guard": "cannot delete the active provider — switch first",
@@ -1179,6 +1290,14 @@
   "web.settings.disabled": "disabled",
   "web.settings.mcp_servers": "mcp servers",
   "web.settings.no_mcp": "no MCP servers configured",
+  "web.settings.mcp_add": "add MCP server",
+  "web.settings.mcp_edit_title": "edit MCP server",
+  "web.settings.mcp_required": "name plus command (stdio) or URL (sse/http) is required",
+  "web.settings.mcp_invalid": "invalid value: timeout 1000–300000 ms, args/env/headers as JSON",
+  "web.settings.lsp_servers": "LSP servers",
+  "web.settings.no_lsp": "no LSP servers configured",
+  "web.settings.lsp_note": "LSP changes are saved to config and take effect on the next run.",
+  "web.settings.lsp_unavailable": "LSP unavailable",
   "web.settings.loading": "loading…",
   "web.input.placeholder": "message… (/ for commands)",
   "web.input.enter": "Enter — send",
@@ -1218,8 +1337,8 @@
   "web.selectors.current": "current",
   "web.selectors.context_prompt": "context window (tokens)",
   "web.action.thinking": "thinking",
-  "web.action.hide": "▾ hide",
-  "web.action.show": "▸ show",
+  "web.action.hide": "hide",
+  "web.action.show": "show",
   "web.action.actions_one": "{count} action",
   "web.action.actions_few": "{count} actions",
   "web.action.actions_many": "{count} actions",
@@ -1237,6 +1356,8 @@
   "web.command.reasoning": "reasoning display and level",
   "web.command.verbose": "set UI verbosity",
   "web.command.context": "show or set the context window",
+  "web.command.security": "show security toggles or write a security key",
+  "web.security.unknown_sub": "unknown subcommand: security {sub}",
   "web.command.session": "list or activate a session",
   "web.command.export": "export the active session to a file",
   "web.command.memory": "inspect or edit global memory",
@@ -1342,5 +1463,190 @@
   "web.setup.finish": "Finish setup",
   "web.setup.saving": "Saving…",
   "web.setup.saved_warning": "Saved with warnings: {warning}",
-  "web.setup.failed": "Setup failed. Check the values and try again."
+  "web.setup.failed": "Setup failed. Check the values and try again.",
+  "config.key.provider.fallback": "fallback providers",
+  "config.desc.provider.fallback": "Fall back to the next provider entry when the active one fails.",
+  "config.key.provider.maxCompletionTokens": "max completion tokens",
+  "config.desc.provider.maxCompletionTokens": "Hard cap on completion tokens per request (512-128000).",
+  "config.key.contextBudget.compactionThreshold": "compaction threshold",
+  "config.desc.contextBudget.compactionThreshold": "History load share that allows periodic compaction (0.05-0.9).",
+  "config.key.contextBudget.compactionMinLoad": "compaction min load",
+  "config.desc.contextBudget.compactionMinLoad": "Minimum history load required before compaction may run (0.05-0.9).",
+  "config.key.instructions.summarize": "summarize instructions",
+  "config.desc.instructions.summarize": "Summarize oversized AGENTS.md/project-map blocks instead of truncating.",
+  "config.key.contextLog.enabled": "context log",
+  "config.desc.contextLog.enabled": "Write the LLM-bound context of every iteration to <session>/context.diff.",
+  "config.key.contextLog.redact": "redact context log",
+  "config.desc.contextLog.redact": "Redact recognizable secrets (tokens, keys) in the context log.",
+  "config.key.reasoning.min": "min reasoning",
+  "config.desc.reasoning.min": "Lower bound of the reasoning effort range.",
+  "config.key.reasoning.max": "max reasoning",
+  "config.desc.reasoning.max": "Upper bound of the reasoning effort range.",
+  "config.key.reasoning.baseline": "baseline reasoning",
+  "config.desc.reasoning.baseline": "Default reasoning effort used when the model gives no signal.",
+  "config.key.reasoning.overrideCooldown": "reasoning override cooldown",
+  "config.desc.reasoning.overrideCooldown": "Turns before a fresh reasoning override is accepted again (1-60).",
+  "config.key.autoPlan": "auto-plan",
+  "config.desc.autoPlan": "Let the agent draft a plan automatically for multi-step tasks.",
+  "config.key.tools.enableOnDemand": "on-demand tools",
+  "config.desc.tools.enableOnDemand": "Load narrow tool groups on demand instead of exposing all tools.",
+  "config.key.session.autoSave": "auto-save session",
+  "config.desc.session.autoSave": "Persist the session log after every turn.",
+  "config.key.session.maxSessions": "max sessions",
+  "config.desc.session.maxSessions": "How many recent sessions are kept on disk (1-500).",
+  "config.key.session.isolateMemory": "isolate session memory",
+  "config.desc.session.isolateMemory": "Keep session memory separate from the global one.",
+  "config.key.session.autoName": "auto-name sessions",
+  "config.desc.session.autoName": "Derive a session name from the first message (LLM-refined).",
+  "config.key.sessionIsolation.enabled": "session isolation",
+  "config.desc.sessionIsolation.enabled": "Master switch for per-session isolation (plugins, temp files).",
+  "config.key.sessionIsolation.isolatePlugins": "isolate plugins",
+  "config.desc.sessionIsolation.isolatePlugins": "Give each session its own plugin sandbox.",
+  "config.key.sessionIsolation.isolateTempFiles": "isolate temp files",
+  "config.desc.sessionIsolation.isolateTempFiles": "Give each session its own temp-file directory.",
+  "config.key.ui.spinner": "spinner",
+  "config.desc.ui.spinner": "Animate a progress spinner while tools run.",
+  "config.key.ui.showContextStats": "context stats",
+  "config.desc.ui.showContextStats": "Show context usage stats after each turn.",
+  "config.key.ui.showCompaction": "compaction notice",
+  "config.desc.ui.showCompaction": "Notify in chat when history compaction runs.",
+  "config.key.retry.maxRetries": "max retries",
+  "config.desc.retry.maxRetries": "Max retries for failed LLM requests (0-10).",
+  "config.key.retry.baseDelay": "retry base delay",
+  "config.desc.retry.baseDelay": "Base backoff delay between retries in ms (0-60000).",
+  "config.key.retry.maxDelay": "retry max delay",
+  "config.desc.retry.maxDelay": "Backoff delay cap between retries in ms (0-300000).",
+  "config.key.retry.maxStreamRetries": "max stream retries",
+  "config.desc.retry.maxStreamRetries": "Max retries for stalled or interrupted streams (0-10).",
+  "config.key.retry.noDataTimeoutMs": "stream stall timeout (ms)",
+  "config.desc.retry.noDataTimeoutMs": "Give up on a stream silent for this long, in ms (1000-600000).",
+  "config.key.pricing.enabled": "cost tracking",
+  "config.desc.pricing.enabled": "Track token usage and estimated cost per session.",
+  "config.key.updater.enabled": "auto-update",
+  "config.desc.updater.enabled": "Master switch for background update checks.",
+  "config.key.updater.checkOnStart": "check on start",
+  "config.desc.updater.checkOnStart": "Check for updates when the agent starts.",
+  "config.key.updater.autoInstall": "auto-install updates",
+  "config.desc.updater.autoInstall": "Install downloaded updates without asking.",
+  "config.key.updater.intervalMs": "update check interval (ms)",
+  "config.desc.updater.intervalMs": "Minimum time between update checks, in ms (0-86400000).",
+  "config.key.skills.budget": "skills budget share",
+  "config.desc.skills.budget": "Share of the system budget reserved for skill definitions (0.05-0.9).",
+  "config.key.hallucination.judge.enabled": "hallucination judge",
+  "config.desc.hallucination.judge.enabled": "Score answer confidence and flag likely hallucinations.",
+  "config.key.subagent.resultMode": "subagent result mode",
+  "config.desc.subagent.resultMode": "How subagent results return: inline text or via file.",
+  "config.key.subagent.maxSummaryChars": "subagent summary limit",
+  "config.desc.subagent.maxSummaryChars": "Max chars kept from a subagent summary (100-50000).",
+  "config.key.subagent.maxParallelChunkQueries": "subagent parallel chunks",
+  "config.desc.subagent.maxParallelChunkQueries": "Max parallel chunk queries per subagent wave (1-16).",
+  "config.key.subagent.stableSystemPrompt": "stable subagent prompt",
+  "config.desc.subagent.stableSystemPrompt": "Reuse one frozen system prompt for all subagents in a run.",
+  "config.key.modelLoad.autoLoad": "auto-load model",
+  "config.desc.modelLoad.autoLoad": "Load the model into the backend automatically on start.",
+  "config.key.modelLoad.flashAttention": "flash attention",
+  "config.desc.modelLoad.flashAttention": "Enable flash-attention kernels when loading the model.",
+  "config.key.modelLoad.offloadKvCacheToGpu": "offload KV cache to GPU",
+  "config.desc.modelLoad.offloadKvCacheToGpu": "Keep the KV cache in GPU memory when loading the model.",
+  "config.key.modelLoad.evalBatchSize": "eval batch size",
+  "config.desc.modelLoad.evalBatchSize": "Prompt-eval batch size at load time (1-4096).",
+  "config.key.webSearch.enabled": "web search",
+  "config.desc.webSearch.enabled": "Allow the agent to search the web.",
+  "config.key.errorWebSearch.enabled": "search on error",
+  "config.desc.errorWebSearch.enabled": "Search the web automatically when an error looks searchable.",
+  "config.key.errorWebSearch.threshold": "error search threshold",
+  "config.desc.errorWebSearch.threshold": "How many matching errors trigger a search (1-20).",
+  "config.key.errorWebSearch.maxResults": "error search results",
+  "config.desc.errorWebSearch.maxResults": "Max search results attached per error lookup (1-20).",
+  "config.key.errorWebSearch.maxQueryChars": "error query limit",
+  "config.desc.errorWebSearch.maxQueryChars": "Max chars of the error text sent per query (50-2000).",
+  "config.key.errorWebSearch.maxSearchesPerSession": "error searches per session",
+  "config.desc.errorWebSearch.maxSearchesPerSession": "Max automatic error searches per session (0-20).",
+  "config.key.errorWebSearch.requestTimeoutMs": "error search timeout (ms)",
+  "config.desc.errorWebSearch.requestTimeoutMs": "Timeout per automatic error-search request, in ms (1000-120000).",
+  "config.key.browser.enabled": "browser tool",
+  "config.desc.browser.enabled": "Allow the agent to drive a browser.",
+  "config.key.browser.headless": "headless browser",
+  "config.desc.browser.headless": "Run the browser without a visible window.",
+  "config.key.browser.maxElements": "max page elements",
+  "config.desc.browser.maxElements": "Max accessibility-tree elements per snapshot (1-200).",
+  "config.key.browser.maxContentChars": "max page content",
+  "config.desc.browser.maxContentChars": "Max chars of page content kept per snapshot (100-50000).",
+  "config.key.browser.maxConsoleEntries": "max console entries",
+  "config.desc.browser.maxConsoleEntries": "Max browser console entries collected per snapshot (1-200).",
+  "config.key.browser.maxConsoleLineChars": "max console line",
+  "config.desc.browser.maxConsoleLineChars": "Max chars per console line (50-5000).",
+  "config.key.browser.viewportWidth": "viewport width",
+  "config.desc.browser.viewportWidth": "Browser viewport width in px (320-4096).",
+  "config.key.browser.viewportHeight": "viewport height",
+  "config.desc.browser.viewportHeight": "Browser viewport height in px (200-2160).",
+  "config.key.browser.navigationTimeout": "navigation timeout (ms)",
+  "config.desc.browser.navigationTimeout": "Timeout per page navigation, in ms (1000-120000).",
+  "config.key.security.maxRecursionDepth": "max recursion depth",
+  "config.desc.security.maxRecursionDepth": "Max nested tool-call depth before refusal (0-20).",
+  "config.key.security.maxFileOperations": "max file operations",
+  "config.desc.security.maxFileOperations": "Max file operations per turn before refusal (0-10000).",
+  "config.key.security.rateLimits.maxRequestsPerMinute": "max requests per minute",
+  "config.desc.security.rateLimits.maxRequestsPerMinute": "LLM request rate cap per minute (1-1000).",
+  "config.key.security.rateLimits.maxParallelTasks": "max parallel tasks",
+  "config.desc.security.rateLimits.maxParallelTasks": "Cap on parallel subtasks (1-50).",
+  "config.key.tools.defaultTags": "default tool tags",
+  "config.desc.tools.defaultTags": "Tool groups always loaded without on-demand gating.",
+  "config.key.security.bash.enabled": "bash command validation",
+  "config.desc.security.bash.enabled": "Master switch for bash tool validation.",
+  "config.key.security.bash.blockDangerousFlags": "block dangerous flags",
+  "config.desc.security.bash.blockDangerousFlags": "Reject risky shell flags like --force in the bash tool.",
+  "config.key.security.network.enabled": "network requests",
+  "config.desc.security.network.enabled": "Master switch for outbound network checks (SSRF guard).",
+  "config.key.security.bash.blacklist": "bash blacklist",
+  "config.desc.security.bash.blacklist": "Commands always blocked in the bash tool (list).",
+  "config.key.security.bash.whitelist": "bash whitelist",
+  "config.desc.security.bash.whitelist": "Commands always allowed in the bash tool (list).",
+  "config.key.security.bash.dangerousFlags": "dangerous flags",
+  "config.desc.security.bash.dangerousFlags": "Command flags treated as dangerous (list).",
+  "config.key.security.bash.dangerousOperators": "dangerous operators",
+  "config.desc.security.bash.dangerousOperators": "Shell operators treated as dangerous (list).",
+  "config.key.security.paths.denied": "denied paths",
+  "config.desc.security.paths.denied": "Paths always off-limits for file tools (list).",
+  "config.key.security.paths.allowed": "allowed paths",
+  "config.desc.security.paths.allowed": "Extra paths allowed outside the workspace (list).",
+  "config.key.security.network.deniedDomains": "denied domains",
+  "config.desc.security.network.deniedDomains": "Domains the agent may never contact (list).",
+  "config.key.security.network.allowedDomains": "allowed domains",
+  "config.desc.security.network.allowedDomains": "Domains the agent may contact (list; empty means any).",
+  "config.key.security.network.requestTimeout": "network timeout (ms)",
+  "config.desc.security.network.requestTimeout": "Timeout per outbound tool request, in ms (1000-120000).",
+  "config.key.security.network.maxResponseSize": "max response size",
+  "config.desc.security.network.maxResponseSize": "Max bytes kept per outbound response (1024-1000000).",
+  "config.key.security.contentScan.dangerousPatterns": "dangerous patterns",
+  "config.desc.security.contentScan.dangerousPatterns": "Regular expressions searched in file contents before writing.",
+  "config.key.security.auditNotifier.enabled": "audit notifier",
+  "config.desc.security.auditNotifier.enabled": "Send security-audit events to a file or webhook.",
+  "config.key.security.auditNotifier.filePath": "audit log path",
+  "config.desc.security.auditNotifier.filePath": "File the audit events are appended to.",
+  "config.key.security.auditNotifier.webhookUrl": "audit webhook URL",
+  "config.desc.security.auditNotifier.webhookUrl": "Webhook the audit events are posted to.",
+  "config.key.security.auditNotifier.webhookTimeout": "audit webhook timeout (ms)",
+  "config.desc.security.auditNotifier.webhookTimeout": "Timeout per webhook post, in ms (1000-60000).",
+  "config.key.security.auditNotifier.minSeverity": "audit min severity",
+  "config.desc.security.auditNotifier.minSeverity": "Lowest severity that still notifies (low/medium/high/critical).",
+  "config.key.security.auditNotifier.eventTypes": "audit event types",
+  "config.desc.security.auditNotifier.eventTypes": "Which audit event types notify; none selected means all.",
+  "config.key.security.auditNotifier.maxRetries": "audit max retries",
+  "config.desc.security.auditNotifier.maxRetries": "Retries per failed notification post (0-10).",
+  "config.key.security.sessionEncryption.keyPath": "encryption key path",
+  "config.desc.security.sessionEncryption.keyPath": "File holding the session-encryption key.",
+  "config.key.security.sessionEncryption.encryptHistory": "encrypt chat history",
+  "config.desc.security.sessionEncryption.encryptHistory": "Encrypt the saved chat history on disk.",
+  "config.key.security.sessionEncryption.encryptSessionLog": "encrypt session log",
+  "config.desc.security.sessionEncryption.encryptSessionLog": "Encrypt the saved session.jsonl log on disk.",
+  "config.key.pricing.overrides": "pricing overrides",
+  "config.desc.pricing.overrides": "Per-model price table overriding built-ins.",
+  "config.key.modelCapabilities": "model capabilities",
+  "config.desc.modelCapabilities": "Manual vision/tools overrides per model id.",
+  "config.key.experts": "MoE experts",
+  "config.desc.experts": "Expert roster for the MoE orchestrator.",
+  "config.enum.text": "text",
+  "config.enum.file": "file",
+  "config.enum.critical": "critical"
 }