micro-models-agent 2.9.0 → 2.10.0

package/dist/main.js

@@ -2789,7 +2789,9 @@ Fix the error and re-edit the file (a clean write clears the failure), or mark t
     "cli.manage_config": "Manage configuration",
     "cli.config_key": "Config key (e.g., model, provider.baseUrl)",
     "cli.set_value": "Set a config value",
+    "cli.config_force": "Bypass validation and write the raw value as-is",
     "cli.set_done": "Set {key}={value}",
+    "cli.config_invalid": "Invalid value for '{key}' ({reason}). Config not changed.",
     "cli.show_config": "Show the effective configuration (secrets redacted; use --show-secrets to reveal)",
     "cli.migrate_config": "Migrate legacy config.json to domain format",
     "cli.manage_models": "Manage models",
@@ -2989,6 +2991,7 @@ Available commands:`,
     "repl.last_action_none": "No recent action to show.",
     "repl.status": "Show a compact status line",
     "repl.status_usage": "Usage: /status",
+    "repl.security": "Show security configuration (on/off per area)",
     "repl.plugins": "List loaded plugins",
     "repl.plugins_usage": "Usage: /plugins [--all]",
     "repl.sessions": "List all sessions (* active)",
@@ -3600,6 +3603,15 @@ Updated: {updatedAt}`,
     "config.enum.max": "max",
     "config.enum.en": "English",
     "config.enum.ru": "Russian",
+    "config.enum.security_block": "security block",
+    "config.enum.bash_command": "bash command",
+    "config.enum.file_operation": "file operation",
+    "config.enum.network_request": "network request",
+    "config.enum.tool_call": "tool call",
+    "config.enum.authentication": "authentication",
+    "config.enum.configuration_change": "config change",
+    "config.enum.session_start": "session start",
+    "config.enum.session_end": "session end",
     "config.desc.model": "Model used for the main agent.",
     "config.desc.provider.active": "Which configured provider is used.",
     "config.desc.contextWindow": "Total context size in tokens (system prompt + history + reserve).",
@@ -3618,7 +3630,7 @@ Updated: {updatedAt}`,
     "config.desc.critic.timeoutMs": "Verifier call timeout (fail-open).",
     "config.desc.logLevel": "Diagnostic log verbosity.",
     "config.desc.locale": "Language of the interface and agent messages.",
-    "config.desc.version": "Installed MMA version (read-only).",
+    "config.desc.version": "Installed MMA version.",
     "config.desc.security.enabled": "Master switch for the security module (path checks, content scans, limits).",
     "config.desc.security.paths.enabled": "Restrict file operations to the workspace and block paths outside it.",
     "config.desc.security.contentScan.enabled": "Scan file contents for dangerous patterns before writing.",
@@ -3630,12 +3642,99 @@ Updated: {updatedAt}`,
     "web.settings.context": "Context",
     "web.settings.reasoning": "Reasoning",
     "web.settings.agent": "Agent",
+    "web.settings.network": "Network",
+    "web.settings.browser": "Browser",
+    "web.settings.sessions": "Sessions",
     "web.settings.ui": "UI & Theme",
     "web.settings.memory": "Memory",
     "web.settings.skills": "Skills",
     "web.settings.plugins": "Plugins · MCP",
     "web.settings.security": "Security",
     "web.settings.advanced": "Advanced",
+    "web.settings.search_placeholder": "search settings",
+    "web.settings.search_empty": "no matching setting",
+    "web.settings.table_invalid": "fill the required fields first ({field})",
+    "web.settings.sec.general.interface": "Interface",
+    "web.settings.sec.general.agent": "Agent loop",
+    "web.settings.sec.general.agent.desc": "How long and how persistently the agent works before it stops.",
+    "web.settings.sec.general.provider": "Providers",
+    "web.settings.sec.model.tuning": "Performance",
+    "web.settings.sec.model.tuning.desc": "Token budget and how the model is loaded into memory.",
+    "web.settings.sec.model.capabilities": "Capabilities",
+    "web.settings.sec.model.capabilities.desc": "Manual overrides for vision/tools when probing a model gets it wrong.",
+    "web.settings.sec.context.window": "Context window",
+    "web.settings.sec.context.window.desc": "Total window and how it is split between the system prompt, the reply and history.",
+    "web.settings.sec.context.compaction": "Compaction",
+    "web.settings.sec.context.compaction.desc": "When old history is summarised to free space.",
+    "web.settings.sec.context.instructions": "Instructions",
+    "web.settings.sec.context.instructions.desc": "What happens when AGENTS.md or the project map is too large for the prompt.",
+    "web.settings.sec.context.log": "Context log",
+    "web.settings.sec.context.log.desc": "Write every prompt sent to the model to a diff file next to the session.",
+    "web.settings.sec.reasoning.display": "Display",
+    "web.settings.sec.reasoning.effort": "Effort",
+    "web.settings.sec.reasoning.effort.desc": "Stop overrides the range — auto picks a level per step inside it.",
+    "web.settings.sec.agent.moe": "Mixture of experts",
+    "web.settings.sec.agent.moe.desc": "Split work into expert subtasks with a planner; slower but stronger on multi-step tasks.",
+    "web.settings.sec.agent.critic": "Critic",
+    "web.settings.sec.agent.critic.desc": "A second pass that reviews the agent's own work before it answers.",
+    "web.settings.sec.agent.tools": "Tools & skills",
+    "web.settings.sec.agent.tools.desc": "Which tools are visible up front and how much of the prompt skills may use.",
+    "web.settings.sec.agent.subagent": "Sub-agents",
+    "web.settings.sec.agent.subagent.desc": "How results from sub-agents come back and how they are parallelised.",
+    "web.settings.sec.agent.hallucination": "Hallucination check",
+    "web.settings.sec.agent.hallucination.desc": "Run a consistency pass on the reply before showing it.",
+    "web.settings.sec.network.web": "Web search",
+    "web.settings.sec.network.web.desc": "Master switch for the web_search tool.",
+    "web.settings.sec.network.error": "Automatic error search",
+    "web.settings.sec.network.error.desc": "Search the web when the same error repeats.",
+    "web.settings.sec.browser.main": "Browser",
+    "web.settings.sec.browser.limits": "Limits",
+    "web.settings.sec.browser.limits.desc": "Caps that keep a page snapshot small enough for the context window.",
+    "web.settings.sec.browser.viewport": "Viewport & timeouts",
+    "web.settings.sec.sessions.main": "Sessions",
+    "web.settings.sec.sessions.main.desc": "Saving, naming and how many past sessions are kept.",
+    "web.settings.sec.sessions.isolation": "Isolation",
+    "web.settings.sec.sessions.isolation.desc": "Keep plugins and temp files separate per session.",
+    "web.settings.sec.ui.chat": "Chat output",
+    "web.settings.sec.ui.chat.desc": "Status lines, progress and context meters in the chat feed.",
+    "web.settings.sec.ui.theme": "Theme",
+    "web.settings.sec.ui.theme.desc": "Colour scheme of this web UI. Stored in the browser, not in the config file.",
+    "web.settings.sec.memory.add": "Add a note",
+    "web.settings.memory_add_title": "new memory",
+    "config.field.name": "name",
+    "config.field.model": "model",
+    "config.field.tool_tags": "tool tags",
+    "config.field.max_attempts": "attempts",
+    "config.field.description": "description",
+    "config.field.input": "input $/1M",
+    "config.field.output": "output $/1M",
+    "config.field.cachedInput": "cached $/1M",
+    "config.field.cacheWrite": "write $/1M",
+    "config.field.vision": "vision",
+    "config.field.tools": "tools",
+    "web.settings.sec.security.switches": "Switches",
+    "web.settings.sec.security.switches.desc": "Master switches per protection. Turning one off disables its whole group below.",
+    "web.settings.sec.security.limits": "Limits",
+    "web.settings.sec.security.limits.desc": "Depth, volume and rate caps for tool activity.",
+    "web.settings.sec.security.bash": "Bash rules",
+    "web.settings.sec.security.bash.desc": "Commands, flags and operators the bash tool refuses.",
+    "web.settings.sec.security.paths": "Path rules",
+    "web.settings.sec.security.paths.desc": "Glob patterns for paths that are denied or, if set, exclusively allowed.",
+    "web.settings.sec.security.network": "Network rules",
+    "web.settings.sec.security.network.desc": "Domains blocked or, if set, exclusively allowed.",
+    "web.settings.sec.security.scan": "Content scan",
+    "web.settings.sec.security.scan.desc": "Patterns searched in file contents before writing.",
+    "web.settings.sec.security.audit": "Audit log",
+    "web.settings.sec.security.audit.desc": "Send security events to a file or a webhook.",
+    "web.settings.sec.security.encryption": "Session encryption",
+    "web.settings.sec.security.encryption.desc": "Encrypt saved chat history and session log on disk.",
+    "web.settings.sec.security.access": "Access",
+    "web.settings.sec.advanced.diagnostics": "Diagnostics",
+    "web.settings.sec.advanced.diagnostics.desc": "Log verbosity and the installed version.",
+    "web.settings.sec.advanced.retry": "Retry",
+    "web.settings.sec.advanced.retry.desc": "Backoff for failed or stalled provider requests.",
+    "web.settings.sec.advanced.service": "Service",
+    "web.settings.sec.advanced.service.desc": "Cost tracking, prices and the background update check.",
     "web.settings.add": "add",
     "web.settings.forget": "forget",
     "web.settings.search": "search",
@@ -3673,6 +3772,11 @@ Updated: {updatedAt}`,
     "web.settings.provider_priority": "priority",
     "web.settings.provider_rpm": "requests / min",
     "web.settings.provider_parallel": "max parallel",
+    "web.settings.provider_max_tokens": "max completion tokens",
+    "web.settings.provider_cache_mechanism": "cache mechanism",
+    "web.settings.provider_cache_report": "cache report format",
+    "web.settings.provider_cache_flags": "cache flags",
+    "web.settings.provider_retry": "retry",
     "web.settings.provider_required": "type and base URL are required",
     "web.settings.provider_invalid": "invalid numeric value",
     "web.settings.provider_active_guard": "cannot delete the active provider — switch first",
@@ -3705,6 +3809,14 @@ Updated: {updatedAt}`,
     "web.settings.disabled": "disabled",
     "web.settings.mcp_servers": "mcp servers",
     "web.settings.no_mcp": "no MCP servers configured",
+    "web.settings.mcp_add": "add MCP server",
+    "web.settings.mcp_edit_title": "edit MCP server",
+    "web.settings.mcp_required": "name plus command (stdio) or URL (sse/http) is required",
+    "web.settings.mcp_invalid": "invalid value: timeout 1000–300000 ms, args/env/headers as JSON",
+    "web.settings.lsp_servers": "LSP servers",
+    "web.settings.no_lsp": "no LSP servers configured",
+    "web.settings.lsp_note": "LSP changes are saved to config and take effect on the next run.",
+    "web.settings.lsp_unavailable": "LSP unavailable",
     "web.settings.loading": "loading…",
     "web.input.placeholder": "message… (/ for commands)",
     "web.input.enter": "Enter — send",
@@ -3763,6 +3875,8 @@ Updated: {updatedAt}`,
     "web.command.reasoning": "reasoning display and level",
     "web.command.verbose": "set UI verbosity",
     "web.command.context": "show or set the context window",
+    "web.command.security": "show security toggles or write a security key",
+    "web.security.unknown_sub": "unknown subcommand: security {sub}",
     "web.command.session": "list or activate a session",
     "web.command.export": "export the active session to a file",
     "web.command.memory": "inspect or edit global memory",
@@ -3868,7 +3982,192 @@ Updated: {updatedAt}`,
     "web.setup.finish": "Finish setup",
     "web.setup.saving": "Saving…",
     "web.setup.saved_warning": "Saved with warnings: {warning}",
-    "web.setup.failed": "Setup failed. Check the values and try again."
+    "web.setup.failed": "Setup failed. Check the values and try again.",
+    "config.key.provider.fallback": "fallback providers",
+    "config.desc.provider.fallback": "Fall back to the next provider entry when the active one fails.",
+    "config.key.provider.maxCompletionTokens": "max completion tokens",
+    "config.desc.provider.maxCompletionTokens": "Hard cap on completion tokens per request (512-128000).",
+    "config.key.contextBudget.compactionThreshold": "compaction threshold",
+    "config.desc.contextBudget.compactionThreshold": "History load share that allows periodic compaction (0.05-0.9).",
+    "config.key.contextBudget.compactionMinLoad": "compaction min load",
+    "config.desc.contextBudget.compactionMinLoad": "Minimum history load required before compaction may run (0.05-0.9).",
+    "config.key.instructions.summarize": "summarize instructions",
+    "config.desc.instructions.summarize": "Summarize oversized AGENTS.md/project-map blocks instead of truncating.",
+    "config.key.contextLog.enabled": "context log",
+    "config.desc.contextLog.enabled": "Write the LLM-bound context of every iteration to <session>/context.diff.",
+    "config.key.contextLog.redact": "redact context log",
+    "config.desc.contextLog.redact": "Redact recognizable secrets (tokens, keys) in the context log.",
+    "config.key.reasoning.min": "min reasoning",
+    "config.desc.reasoning.min": "Lower bound of the reasoning effort range.",
+    "config.key.reasoning.max": "max reasoning",
+    "config.desc.reasoning.max": "Upper bound of the reasoning effort range.",
+    "config.key.reasoning.baseline": "baseline reasoning",
+    "config.desc.reasoning.baseline": "Default reasoning effort used when the model gives no signal.",
+    "config.key.reasoning.overrideCooldown": "reasoning override cooldown",
+    "config.desc.reasoning.overrideCooldown": "Turns before a fresh reasoning override is accepted again (1-60).",
+    "config.key.autoPlan": "auto-plan",
+    "config.desc.autoPlan": "Let the agent draft a plan automatically for multi-step tasks.",
+    "config.key.tools.enableOnDemand": "on-demand tools",
+    "config.desc.tools.enableOnDemand": "Load narrow tool groups on demand instead of exposing all tools.",
+    "config.key.session.autoSave": "auto-save session",
+    "config.desc.session.autoSave": "Persist the session log after every turn.",
+    "config.key.session.maxSessions": "max sessions",
+    "config.desc.session.maxSessions": "How many recent sessions are kept on disk (1-500).",
+    "config.key.session.isolateMemory": "isolate session memory",
+    "config.desc.session.isolateMemory": "Keep session memory separate from the global one.",
+    "config.key.session.autoName": "auto-name sessions",
+    "config.desc.session.autoName": "Derive a session name from the first message (LLM-refined).",
+    "config.key.sessionIsolation.enabled": "session isolation",
+    "config.desc.sessionIsolation.enabled": "Master switch for per-session isolation (plugins, temp files).",
+    "config.key.sessionIsolation.isolatePlugins": "isolate plugins",
+    "config.desc.sessionIsolation.isolatePlugins": "Give each session its own plugin sandbox.",
+    "config.key.sessionIsolation.isolateTempFiles": "isolate temp files",
+    "config.desc.sessionIsolation.isolateTempFiles": "Give each session its own temp-file directory.",
+    "config.key.ui.spinner": "spinner",
+    "config.desc.ui.spinner": "Animate a progress spinner while tools run.",
+    "config.key.ui.showContextStats": "context stats",
+    "config.desc.ui.showContextStats": "Show context usage stats after each turn.",
+    "config.key.ui.showCompaction": "compaction notice",
+    "config.desc.ui.showCompaction": "Notify in chat when history compaction runs.",
+    "config.key.retry.maxRetries": "max retries",
+    "config.desc.retry.maxRetries": "Max retries for failed LLM requests (0-10).",
+    "config.key.retry.baseDelay": "retry base delay",
+    "config.desc.retry.baseDelay": "Base backoff delay between retries in ms (0-60000).",
+    "config.key.retry.maxDelay": "retry max delay",
+    "config.desc.retry.maxDelay": "Backoff delay cap between retries in ms (0-300000).",
+    "config.key.retry.maxStreamRetries": "max stream retries",
+    "config.desc.retry.maxStreamRetries": "Max retries for stalled or interrupted streams (0-10).",
+    "config.key.retry.noDataTimeoutMs": "stream stall timeout (ms)",
+    "config.desc.retry.noDataTimeoutMs": "Give up on a stream silent for this long, in ms (1000-600000).",
+    "config.key.pricing.enabled": "cost tracking",
+    "config.desc.pricing.enabled": "Track token usage and estimated cost per session.",
+    "config.key.updater.enabled": "auto-update",
+    "config.desc.updater.enabled": "Master switch for background update checks.",
+    "config.key.updater.checkOnStart": "check on start",
+    "config.desc.updater.checkOnStart": "Check for updates when the agent starts.",
+    "config.key.updater.autoInstall": "auto-install updates",
+    "config.desc.updater.autoInstall": "Install downloaded updates without asking.",
+    "config.key.updater.intervalMs": "update check interval (ms)",
+    "config.desc.updater.intervalMs": "Minimum time between update checks, in ms (0-86400000).",
+    "config.key.skills.budget": "skills budget share",
+    "config.desc.skills.budget": "Share of the system budget reserved for skill definitions (0.05-0.9).",
+    "config.key.hallucination.judge.enabled": "hallucination judge",
+    "config.desc.hallucination.judge.enabled": "Score answer confidence and flag likely hallucinations.",
+    "config.key.subagent.resultMode": "subagent result mode",
+    "config.desc.subagent.resultMode": "How subagent results return: inline text or via file.",
+    "config.key.subagent.maxSummaryChars": "subagent summary limit",
+    "config.desc.subagent.maxSummaryChars": "Max chars kept from a subagent summary (100-50000).",
+    "config.key.subagent.maxParallelChunkQueries": "subagent parallel chunks",
+    "config.desc.subagent.maxParallelChunkQueries": "Max parallel chunk queries per subagent wave (1-16).",
+    "config.key.subagent.stableSystemPrompt": "stable subagent prompt",
+    "config.desc.subagent.stableSystemPrompt": "Reuse one frozen system prompt for all subagents in a run.",
+    "config.key.modelLoad.autoLoad": "auto-load model",
+    "config.desc.modelLoad.autoLoad": "Load the model into the backend automatically on start.",
+    "config.key.modelLoad.flashAttention": "flash attention",
+    "config.desc.modelLoad.flashAttention": "Enable flash-attention kernels when loading the model.",
+    "config.key.modelLoad.offloadKvCacheToGpu": "offload KV cache to GPU",
+    "config.desc.modelLoad.offloadKvCacheToGpu": "Keep the KV cache in GPU memory when loading the model.",
+    "config.key.modelLoad.evalBatchSize": "eval batch size",
+    "config.desc.modelLoad.evalBatchSize": "Prompt-eval batch size at load time (1-4096).",
+    "config.key.webSearch.enabled": "web search",
+    "config.desc.webSearch.enabled": "Allow the agent to search the web.",
+    "config.key.errorWebSearch.enabled": "search on error",
+    "config.desc.errorWebSearch.enabled": "Search the web automatically when an error looks searchable.",
+    "config.key.errorWebSearch.threshold": "error search threshold",
+    "config.desc.errorWebSearch.threshold": "How many matching errors trigger a search (1-20).",
+    "config.key.errorWebSearch.maxResults": "error search results",
+    "config.desc.errorWebSearch.maxResults": "Max search results attached per error lookup (1-20).",
+    "config.key.errorWebSearch.maxQueryChars": "error query limit",
+    "config.desc.errorWebSearch.maxQueryChars": "Max chars of the error text sent per query (50-2000).",
+    "config.key.errorWebSearch.maxSearchesPerSession": "error searches per session",
+    "config.desc.errorWebSearch.maxSearchesPerSession": "Max automatic error searches per session (0-20).",
+    "config.key.errorWebSearch.requestTimeoutMs": "error search timeout (ms)",
+    "config.desc.errorWebSearch.requestTimeoutMs": "Timeout per automatic error-search request, in ms (1000-120000).",
+    "config.key.browser.enabled": "browser tool",
+    "config.desc.browser.enabled": "Allow the agent to drive a browser.",
+    "config.key.browser.headless": "headless browser",
+    "config.desc.browser.headless": "Run the browser without a visible window.",
+    "config.key.browser.maxElements": "max page elements",
+    "config.desc.browser.maxElements": "Max accessibility-tree elements per snapshot (1-200).",
+    "config.key.browser.maxContentChars": "max page content",
+    "config.desc.browser.maxContentChars": "Max chars of page content kept per snapshot (100-50000).",
+    "config.key.browser.maxConsoleEntries": "max console entries",
+    "config.desc.browser.maxConsoleEntries": "Max browser console entries collected per snapshot (1-200).",
+    "config.key.browser.maxConsoleLineChars": "max console line",
+    "config.desc.browser.maxConsoleLineChars": "Max chars per console line (50-5000).",
+    "config.key.browser.viewportWidth": "viewport width",
+    "config.desc.browser.viewportWidth": "Browser viewport width in px (320-4096).",
+    "config.key.browser.viewportHeight": "viewport height",
+    "config.desc.browser.viewportHeight": "Browser viewport height in px (200-2160).",
+    "config.key.browser.navigationTimeout": "navigation timeout (ms)",
+    "config.desc.browser.navigationTimeout": "Timeout per page navigation, in ms (1000-120000).",
+    "config.key.security.maxRecursionDepth": "max recursion depth",
+    "config.desc.security.maxRecursionDepth": "Max nested tool-call depth before refusal (0-20).",
+    "config.key.security.maxFileOperations": "max file operations",
+    "config.desc.security.maxFileOperations": "Max file operations per turn before refusal (0-10000).",
+    "config.key.security.rateLimits.maxRequestsPerMinute": "max requests per minute",
+    "config.desc.security.rateLimits.maxRequestsPerMinute": "LLM request rate cap per minute (1-1000).",
+    "config.key.security.rateLimits.maxParallelTasks": "max parallel tasks",
+    "config.desc.security.rateLimits.maxParallelTasks": "Cap on parallel subtasks (1-50).",
+    "config.key.tools.defaultTags": "default tool tags",
+    "config.desc.tools.defaultTags": "Tool groups always loaded without on-demand gating.",
+    "config.key.security.bash.enabled": "bash command validation",
+    "config.desc.security.bash.enabled": "Master switch for bash tool validation.",
+    "config.key.security.bash.blockDangerousFlags": "block dangerous flags",
+    "config.desc.security.bash.blockDangerousFlags": "Reject risky shell flags like --force in the bash tool.",
+    "config.key.security.network.enabled": "network requests",
+    "config.desc.security.network.enabled": "Master switch for outbound network checks (SSRF guard).",
+    "config.key.security.bash.blacklist": "bash blacklist",
+    "config.desc.security.bash.blacklist": "Commands always blocked in the bash tool (list).",
+    "config.key.security.bash.whitelist": "bash whitelist",
+    "config.desc.security.bash.whitelist": "Commands always allowed in the bash tool (list).",
+    "config.key.security.bash.dangerousFlags": "dangerous flags",
+    "config.desc.security.bash.dangerousFlags": "Command flags treated as dangerous (list).",
+    "config.key.security.bash.dangerousOperators": "dangerous operators",
+    "config.desc.security.bash.dangerousOperators": "Shell operators treated as dangerous (list).",
+    "config.key.security.paths.denied": "denied paths",
+    "config.desc.security.paths.denied": "Paths always off-limits for file tools (list).",
+    "config.key.security.paths.allowed": "allowed paths",
+    "config.desc.security.paths.allowed": "Extra paths allowed outside the workspace (list).",
+    "config.key.security.network.deniedDomains": "denied domains",
+    "config.desc.security.network.deniedDomains": "Domains the agent may never contact (list).",
+    "config.key.security.network.allowedDomains": "allowed domains",
+    "config.desc.security.network.allowedDomains": "Domains the agent may contact (list; empty means any).",
+    "config.key.security.network.requestTimeout": "network timeout (ms)",
+    "config.desc.security.network.requestTimeout": "Timeout per outbound tool request, in ms (1000-120000).",
+    "config.key.security.network.maxResponseSize": "max response size",
+    "config.desc.security.network.maxResponseSize": "Max bytes kept per outbound response (1024-1000000).",
+    "config.key.security.contentScan.dangerousPatterns": "dangerous patterns",
+    "config.desc.security.contentScan.dangerousPatterns": "Regular expressions searched in file contents before writing.",
+    "config.key.security.auditNotifier.enabled": "audit notifier",
+    "config.desc.security.auditNotifier.enabled": "Send security-audit events to a file or webhook.",
+    "config.key.security.auditNotifier.filePath": "audit log path",
+    "config.desc.security.auditNotifier.filePath": "File the audit events are appended to.",
+    "config.key.security.auditNotifier.webhookUrl": "audit webhook URL",
+    "config.desc.security.auditNotifier.webhookUrl": "Webhook the audit events are posted to.",
+    "config.key.security.auditNotifier.webhookTimeout": "audit webhook timeout (ms)",
+    "config.desc.security.auditNotifier.webhookTimeout": "Timeout per webhook post, in ms (1000-60000).",
+    "config.key.security.auditNotifier.minSeverity": "audit min severity",
+    "config.desc.security.auditNotifier.minSeverity": "Lowest severity that still notifies (low/medium/high/critical).",
+    "config.key.security.auditNotifier.eventTypes": "audit event types",
+    "config.desc.security.auditNotifier.eventTypes": "Which audit event types notify; none selected means all.",
+    "config.key.security.auditNotifier.maxRetries": "audit max retries",
+    "config.desc.security.auditNotifier.maxRetries": "Retries per failed notification post (0-10).",
+    "config.key.security.sessionEncryption.keyPath": "encryption key path",
+    "config.desc.security.sessionEncryption.keyPath": "File holding the session-encryption key.",
+    "config.key.security.sessionEncryption.encryptHistory": "encrypt chat history",
+    "config.desc.security.sessionEncryption.encryptHistory": "Encrypt the saved chat history on disk.",
+    "config.key.security.sessionEncryption.encryptSessionLog": "encrypt session log",
+    "config.desc.security.sessionEncryption.encryptSessionLog": "Encrypt the saved session.jsonl log on disk.",
+    "config.key.pricing.overrides": "pricing overrides",
+    "config.desc.pricing.overrides": "Per-model price table overriding built-ins.",
+    "config.key.modelCapabilities": "model capabilities",
+    "config.desc.modelCapabilities": "Manual vision/tools overrides per model id.",
+    "config.key.experts": "MoE experts",
+    "config.desc.experts": "Expert roster for the MoE orchestrator.",
+    "config.enum.text": "text",
+    "config.enum.file": "file",
+    "config.enum.critical": "critical"
   };
 });
 
@@ -4219,7 +4518,9 @@ var init_ru = __esm(() => {
     "cli.manage_config": "Управление конфигурацией",
     "cli.config_key": "Ключ конфига (напр., model, provider.baseUrl)",
     "cli.set_value": "Установить значение",
+    "cli.config_force": "Обойти проверку и записать сырое значение как есть",
     "cli.set_done": "Установлено {key}={value}",
+    "cli.config_invalid": "Недопустимое значение для '{key}' ({reason}). Конфиг не изменён.",
     "cli.show_config": "Показать действующую конфигурацию (секреты скрыты; используйте --show-secrets)",
     "cli.migrate_config": "Мигрировать legacy config.json в domain-формат",
     "cli.manage_models": "Управление моделями",
@@ -4415,6 +4716,7 @@ var init_ru = __esm(() => {
     "repl.last_action_none": "Нет недавнего действия для показа.",
     "repl.status": "Показать компактную строку статуса",
     "repl.status_usage": "Использование: /status",
+    "repl.security": "Показать конфигурацию безопасности (вкл/выкл по областям)",
     "repl.plugins": "Список загруженных плагинов",
     "repl.plugins_usage": "Использование: /plugins [--all]",
     "repl.sessions": "Список всех сессий (* активная)",
@@ -5033,18 +5335,114 @@ var init_ru = __esm(() => {
     "config.enum.max": "максимум",
     "config.enum.en": "английский",
     "config.enum.ru": "русский",
+    "config.enum.security_block": "блокировка безопасности",
+    "config.enum.bash_command": "bash-команда",
+    "config.enum.file_operation": "операция с файлом",
+    "config.enum.network_request": "сетевой запрос",
+    "config.enum.tool_call": "вызов инструмента",
+    "config.enum.authentication": "аутентификация",
+    "config.enum.configuration_change": "изменение конфигурации",
+    "config.enum.session_start": "старт сессии",
+    "config.enum.session_end": "конец сессии",
     "web.settings.title": "настройки",
     "web.settings.general": "Общие",
     "web.settings.model": "Модель и провайдер",
     "web.settings.context": "Контекст",
     "web.settings.reasoning": "Рассуждения",
     "web.settings.agent": "Агент",
+    "web.settings.network": "Сеть",
+    "web.settings.browser": "Браузер",
+    "web.settings.sessions": "Сессии",
     "web.settings.ui": "Интерфейс и тема",
     "web.settings.memory": "Память",
     "web.settings.skills": "Навыки",
     "web.settings.plugins": "Плагины · MCP",
     "web.settings.security": "Безопасность",
     "web.settings.advanced": "Дополнительно",
+    "web.settings.search_placeholder": "поиск по настройкам",
+    "web.settings.search_empty": "ничего не найдено",
+    "web.settings.table_invalid": "сначала заполните обязательные поля ({field})",
+    "web.settings.sec.general.interface": "Интерфейс",
+    "web.settings.sec.general.agent": "Цикл агента",
+    "web.settings.sec.general.agent.desc": "Как долго и настойчиво агент работает до остановки.",
+    "web.settings.sec.general.provider": "Провайдеры",
+    "web.settings.sec.model.tuning": "Производительность",
+    "web.settings.sec.model.tuning.desc": "Лимит токенов ответа и загрузка модели в память.",
+    "web.settings.sec.model.capabilities": "Возможности",
+    "web.settings.sec.model.capabilities.desc": "Ручные переопределения vision/tools, если определение модели ошибается.",
+    "web.settings.sec.context.window": "Окно контекста",
+    "web.settings.sec.context.window.desc": "Общее окно и его деление между системным промптом, ответом и историей.",
+    "web.settings.sec.context.compaction": "Сжатие",
+    "web.settings.sec.context.compaction.desc": "Когда старая история сворачивается в сводку для освобождения места.",
+    "web.settings.sec.context.instructions": "Инструкции",
+    "web.settings.sec.context.instructions.desc": "Что делать, если AGENTS.md или карта проекта не влезают в промпт.",
+    "web.settings.sec.context.log": "Журнал контекста",
+    "web.settings.sec.context.log.desc": "Записывать каждый промпт в файл диффов рядом с сессией.",
+    "web.settings.sec.reasoning.display": "Показ",
+    "web.settings.sec.reasoning.effort": "Глубина",
+    "web.settings.sec.reasoning.effort.desc": "Авто выбирает уровень на каждом шаге внутри диапазона; ручной режим его отключает.",
+    "web.settings.sec.agent.moe": "Смесь экспертов",
+    "web.settings.sec.agent.moe.desc": "Делит работу на подзадачи экспертов через планировщик; медленнее, но сильнее на многошаговых задачах.",
+    "web.settings.sec.agent.critic": "Критик",
+    "web.settings.sec.agent.critic.desc": "Второй проход, проверяющий работу агента перед ответом.",
+    "web.settings.sec.agent.tools": "Инструменты и навыки",
+    "web.settings.sec.agent.tools.desc": "Какие инструменты видны сразу и сколько промпта могут занять навыки.",
+    "web.settings.sec.agent.subagent": "Субагенты",
+    "web.settings.sec.agent.subagent.desc": "Как возвращаются результаты субагентов и как они распараллеливаются.",
+    "web.settings.sec.agent.hallucination": "Проверка галлюцинаций",
+    "web.settings.sec.agent.hallucination.desc": "Проверять ответ на связность перед показом.",
+    "web.settings.sec.network.web": "Веб-поиск",
+    "web.settings.sec.network.web.desc": "Главный выключатель инструмента web_search.",
+    "web.settings.sec.network.error": "Автопоиск по ошибке",
+    "web.settings.sec.network.error.desc": "Искать в интернете, когда одна и та же ошибка повторяется.",
+    "web.settings.sec.browser.main": "Браузер",
+    "web.settings.sec.browser.limits": "Лимиты",
+    "web.settings.sec.browser.limits.desc": "Ограничения, чтобы снимок страницы влезал в контекст.",
+    "web.settings.sec.browser.viewport": "Окно и таймауты",
+    "web.settings.sec.sessions.main": "Сессии",
+    "web.settings.sec.sessions.main.desc": "Сохранение, имена и сколько прошлых сессий хранить.",
+    "web.settings.sec.sessions.isolation": "Изоляция",
+    "web.settings.sec.sessions.isolation.desc": "Держать плагины и временные файлы отдельно для каждой сессии.",
+    "web.settings.sec.ui.chat": "Вывод в чат",
+    "web.settings.sec.ui.chat.desc": "Строки статуса, прогресс и метры контекста в ленте чата.",
+    "web.settings.sec.ui.theme": "Тема",
+    "web.settings.sec.ui.theme.desc": "Цветовая схема веб-интерфейса. Хранится в браузере, а не в файле конфигурации.",
+    "web.settings.sec.memory.add": "Добавить заметку",
+    "web.settings.memory_add_title": "новая запись памяти",
+    "config.field.name": "имя",
+    "config.field.model": "модель",
+    "config.field.tool_tags": "теги инструментов",
+    "config.field.max_attempts": "попытки",
+    "config.field.description": "описание",
+    "config.field.input": "вход $/1M",
+    "config.field.output": "выход $/1M",
+    "config.field.cachedInput": "кеш $/1M",
+    "config.field.cacheWrite": "запись $/1M",
+    "config.field.vision": "изображения",
+    "config.field.tools": "инструменты",
+    "web.settings.sec.security.switches": "Переключатели",
+    "web.settings.sec.security.switches.desc": "Главные выключатели по каждой защите. Выключение отключает всю группу ниже.",
+    "web.settings.sec.security.limits": "Лимиты",
+    "web.settings.sec.security.limits.desc": "Ограничения глубины, объёма и частоты для активности инструментов.",
+    "web.settings.sec.security.bash": "Правила bash",
+    "web.settings.sec.security.bash.desc": "Команды, флаги и операторы, которые bash-тул отклоняет.",
+    "web.settings.sec.security.paths": "Правила путей",
+    "web.settings.sec.security.paths.desc": "Glob-шаблоны запрещённых путей или, если задано, единственно разрешённых.",
+    "web.settings.sec.security.network": "Правила сети",
+    "web.settings.sec.security.network.desc": "Заблокированные домены или, если задано, единственно разрешённые.",
+    "web.settings.sec.security.scan": "Сканирование контента",
+    "web.settings.sec.security.scan.desc": "Шаблоны, которые ищутся в содержимом файлов перед записью.",
+    "web.settings.sec.security.audit": "Журнал аудита",
+    "web.settings.sec.security.audit.desc": "Отправлять события безопасности в файл или вебхук.",
+    "web.settings.sec.security.encryption": "Шифрование сессий",
+    "web.settings.sec.security.encryption.desc": "Шифровать историю чата и журнал сессии на диске.",
+    "web.settings.sec.security.access": "Доступ",
+    "web.settings.sec.advanced.diagnostics": "Диагностика",
+    "web.settings.sec.advanced.diagnostics.desc": "Подробность логов и установленная версия.",
+    "web.settings.sec.advanced.retry": "Повторы",
+    "web.settings.sec.advanced.retry.desc": "Пауза между повторами упавших или зависших запросов к провайдеру.",
+    "web.settings.sec.advanced.service": "Сервис",
+    "web.settings.sec.advanced.service.desc": "Учёт стоимости, цены и фоновая проверка обновлений.",
     "web.settings.add": "добавить",
     "web.settings.forget": "забыть",
     "web.settings.search": "поиск",
@@ -5082,6 +5480,11 @@ var init_ru = __esm(() => {
     "web.settings.provider_priority": "приоритет",
     "web.settings.provider_rpm": "запросов / мин",
     "web.settings.provider_parallel": "макс. параллельно",
+    "web.settings.provider_max_tokens": "макс. токенов ответа",
+    "web.settings.provider_cache_mechanism": "механизм кеша",
+    "web.settings.provider_cache_report": "формат отчёта кеша",
+    "web.settings.provider_cache_flags": "флаги кеша",
+    "web.settings.provider_retry": "повторы",
     "web.settings.provider_required": "тип и base URL обязательны",
     "web.settings.provider_invalid": "некорректное числовое значение",
     "web.settings.provider_active_guard": "нельзя удалить активного провайдера — сначала переключись",
@@ -5114,6 +5517,14 @@ var init_ru = __esm(() => {
     "web.settings.disabled": "отключён",
     "web.settings.mcp_servers": "MCP-серверы",
     "web.settings.no_mcp": "MCP-серверы не настроены",
+    "web.settings.mcp_add": "добавить MCP-сервер",
+    "web.settings.mcp_edit_title": "править MCP-сервер",
+    "web.settings.mcp_required": "нужны имя и command (stdio) или URL (sse/http)",
+    "web.settings.mcp_invalid": "неверное значение: timeout 1000–300000 мс, args/env/headers — JSON",
+    "web.settings.lsp_servers": "LSP-серверы",
+    "web.settings.no_lsp": "LSP-серверы не настроены",
+    "web.settings.lsp_note": "изменения LSP сохраняются в конфиг и применяются при следующем запуске.",
+    "web.settings.lsp_unavailable": "LSP недоступен",
     "web.settings.loading": "загрузка…",
     "web.input.placeholder": "ввод сообщения… (/ — команды)",
     "web.input.enter": "Enter — отправить",
@@ -5172,6 +5583,8 @@ var init_ru = __esm(() => {
     "web.command.reasoning": "показ рассуждений и уровень",
     "web.command.verbose": "уровень детализации UI",
     "web.command.context": "показать или задать окно контекста",
+    "web.command.security": "показать флаги безопасности или записать ключ",
+    "web.security.unknown_sub": "неизвестная подкоманда: security {sub}",
     "web.command.session": "показать сессии или активировать сессию",
     "web.command.export": "экспорт активной сессии в файл",
     "web.command.memory": "просмотр и правка глобальной памяти",
@@ -5230,7 +5643,7 @@ var init_ru = __esm(() => {
     "config.desc.critic.timeoutMs": "Таймаут вызова критика (fail-open).",
     "config.desc.logLevel": "Подробность диагностических логов.",
     "config.desc.locale": "Язык интерфейса и сообщений агента.",
-    "config.desc.version": "Установленная версия MMA (только чтение).",
+    "config.desc.version": "Установленная версия MMA.",
     "config.desc.security.enabled": "Главный выключатель модуля безопасности (проверки путей, сканы, лимиты).",
     "config.desc.security.paths.enabled": "Ограничивать файловые операции рабочей папкой и блокировать пути вне неё.",
     "config.desc.security.contentScan.enabled": "Проверять содержимое файлов на опасные паттерны перед записью.",
@@ -5301,7 +5714,192 @@ var init_ru = __esm(() => {
     "web.setup.finish": "Завершить настройку",
     "web.setup.saving": "Сохранение…",
     "web.setup.saved_warning": "Сохранено с предупреждениями: {warning}",
-    "web.setup.failed": "Не удалось завершить настройку. Проверьте значения и попробуйте снова."
+    "web.setup.failed": "Не удалось завершить настройку. Проверьте значения и попробуйте снова.",
+    "config.key.provider.fallback": "резервные провайдеры",
+    "config.desc.provider.fallback": "Переходить к следующей записи провайдера при сбое активного.",
+    "config.key.provider.maxCompletionTokens": "макс. токенов ответа",
+    "config.desc.provider.maxCompletionTokens": "Жесткий лимит токенов ответа на запрос (512-128000).",
+    "config.key.contextBudget.compactionThreshold": "порог компакции",
+    "config.desc.contextBudget.compactionThreshold": "Доля загрузки истории, разрешающая периодическую компакцию (0,05-0,9).",
+    "config.key.contextBudget.compactionMinLoad": "мин. загрузка компакции",
+    "config.desc.contextBudget.compactionMinLoad": "Минимальная загрузка истории для запуска компакции (0,05-0,9).",
+    "config.key.instructions.summarize": "суммировать инструкции",
+    "config.desc.instructions.summarize": "Суммировать переполненные блоки AGENTS.md/карты проекта вместо обрезки.",
+    "config.key.contextLog.enabled": "лог контекста",
+    "config.desc.contextLog.enabled": "Писать уходящий в LLM контекст каждой итерации в <session>/context.diff.",
+    "config.key.contextLog.redact": "чистить лог контекста",
+    "config.desc.contextLog.redact": "Вырезать опознаваемые секреты (токены, ключи) из лога контекста.",
+    "config.key.reasoning.min": "мин. рассуждения",
+    "config.desc.reasoning.min": "Нижняя граница диапазона усилий рассуждений.",
+    "config.key.reasoning.max": "макс. рассуждения",
+    "config.desc.reasoning.max": "Верхняя граница диапазона усилий рассуждений.",
+    "config.key.reasoning.baseline": "базовые рассуждения",
+    "config.desc.reasoning.baseline": "Усилия рассуждений по умолчанию, если модель не дала сигнала.",
+    "config.key.reasoning.overrideCooldown": "кулдаун переопределения",
+    "config.desc.reasoning.overrideCooldown": "Ходов до повторного принятия переопределения рассуждений (1-60).",
+    "config.key.autoPlan": "автоплан",
+    "config.desc.autoPlan": "Позволять агенту автоматически строить план для многошаговых задач.",
+    "config.key.tools.enableOnDemand": "тулы по требованию",
+    "config.desc.tools.enableOnDemand": "Подгружать узкие группы тулов по требованию вместо показа всех.",
+    "config.key.session.autoSave": "автосохранение сессии",
+    "config.desc.session.autoSave": "Сохранять лог сессии после каждого хода.",
+    "config.key.session.maxSessions": "макс. сессий",
+    "config.desc.session.maxSessions": "Сколько последних сессий хранить на диске (1-500).",
+    "config.key.session.isolateMemory": "изолировать память сессии",
+    "config.desc.session.isolateMemory": "Держать память сессии отдельно от глобальной.",
+    "config.key.session.autoName": "автоназвания сессий",
+    "config.desc.session.autoName": "Выводить имя сессии из первого сообщения (уточняется LLM).",
+    "config.key.sessionIsolation.enabled": "изоляция сессий",
+    "config.desc.sessionIsolation.enabled": "Главный выключатель изоляции сессий (плагины, временные файлы).",
+    "config.key.sessionIsolation.isolatePlugins": "изолировать плагины",
+    "config.desc.sessionIsolation.isolatePlugins": "Выдавать каждой сессии собственную песочницу плагинов.",
+    "config.key.sessionIsolation.isolateTempFiles": "изолировать временные файлы",
+    "config.desc.sessionIsolation.isolateTempFiles": "Выдавать каждой сессии отдельную папку временных файлов.",
+    "config.key.ui.spinner": "спиннер",
+    "config.desc.ui.spinner": "Показывать анимированный спиннер во время работы тулов.",
+    "config.key.ui.showContextStats": "статистика контекста",
+    "config.desc.ui.showContextStats": "Показывать статистику использования контекста после каждого хода.",
+    "config.key.ui.showCompaction": "уведомление о компакции",
+    "config.desc.ui.showCompaction": "Сообщать в чате о запуске компакции истории.",
+    "config.key.retry.maxRetries": "макс. повторов",
+    "config.desc.retry.maxRetries": "Максимум повторов упавших LLM-запросов (0-10).",
+    "config.key.retry.baseDelay": "базовая задержка повтора",
+    "config.desc.retry.baseDelay": "Базовая задержка между повторами в мс (0-60000).",
+    "config.key.retry.maxDelay": "макс. задержка повтора",
+    "config.desc.retry.maxDelay": "Потолок задержки между повторами в мс (0-300000).",
+    "config.key.retry.maxStreamRetries": "макс. повторов стрима",
+    "config.desc.retry.maxStreamRetries": "Максимум повторов зависших или прерванных стримов (0-10).",
+    "config.key.retry.noDataTimeoutMs": "таймаут застоя стрима (мс)",
+    "config.desc.retry.noDataTimeoutMs": "Сдаваться, если стрим молчит дольше этого времени, в мс (1000-600000).",
+    "config.key.pricing.enabled": "учет стоимости",
+    "config.desc.pricing.enabled": "Считать токены и примерную стоимость по сессиям.",
+    "config.key.updater.enabled": "автообновление",
+    "config.desc.updater.enabled": "Главный выключатель фоновой проверки обновлений.",
+    "config.key.updater.checkOnStart": "проверка при старте",
+    "config.desc.updater.checkOnStart": "Проверять обновления при старте агента.",
+    "config.key.updater.autoInstall": "автоустановка обновлений",
+    "config.desc.updater.autoInstall": "Устанавливать скачанные обновления без спроса.",
+    "config.key.updater.intervalMs": "интервал проверки (мс)",
+    "config.desc.updater.intervalMs": "Минимальный интервал между проверками, в мс (0-86400000).",
+    "config.key.skills.budget": "доля бюджета скиллов",
+    "config.desc.skills.budget": "Доля системного бюджета под определения скиллов (0,05-0,9).",
+    "config.key.hallucination.judge.enabled": "судья галлюцинаций",
+    "config.desc.hallucination.judge.enabled": "Оценивать уверенность ответа и помечать вероятные галлюцинации.",
+    "config.key.subagent.resultMode": "режим результата субагентов",
+    "config.desc.subagent.resultMode": "Как возвращать результаты субагентов: текстом или через файл.",
+    "config.key.subagent.maxSummaryChars": "лимит сводки субагента",
+    "config.desc.subagent.maxSummaryChars": "Максимум символов сводки субагента (100-50000).",
+    "config.key.subagent.maxParallelChunkQueries": "параллельные чанки субагента",
+    "config.desc.subagent.maxParallelChunkQueries": "Максимум параллельных запросов чанков за волну субагента (1-16).",
+    "config.key.subagent.stableSystemPrompt": "стабильный промпт субагента",
+    "config.desc.subagent.stableSystemPrompt": "Переиспользовать один замороженный системный промпт для всех субагентов прогона.",
+    "config.key.modelLoad.autoLoad": "автозагрузка модели",
+    "config.desc.modelLoad.autoLoad": "Автоматически загружать модель в бэкенд при старте.",
+    "config.key.modelLoad.flashAttention": "flash attention",
+    "config.desc.modelLoad.flashAttention": "Включать flash-attention ядра при загрузке модели.",
+    "config.key.modelLoad.offloadKvCacheToGpu": "выгружать KV-кэш в GPU",
+    "config.desc.modelLoad.offloadKvCacheToGpu": "Держать KV-кэш в памяти GPU при загрузке модели.",
+    "config.key.modelLoad.evalBatchSize": "размер eval-батча",
+    "config.desc.modelLoad.evalBatchSize": "Размер батча оценки промпта при загрузке (1-4096).",
+    "config.key.webSearch.enabled": "веб-поиск",
+    "config.desc.webSearch.enabled": "Разрешить агенту искать в интернете.",
+    "config.key.errorWebSearch.enabled": "поиск при ошибке",
+    "config.desc.errorWebSearch.enabled": "Автоматически искать в интернете при ошибке, похожей на гуглящуюся.",
+    "config.key.errorWebSearch.threshold": "порог поиска ошибок",
+    "config.desc.errorWebSearch.threshold": "Сколько совпадающих ошибок запускает поиск (1-20).",
+    "config.key.errorWebSearch.maxResults": "результатов поиска ошибок",
+    "config.desc.errorWebSearch.maxResults": "Максимум результатов поиска на запрос об ошибке (1-20).",
+    "config.key.errorWebSearch.maxQueryChars": "лимит запроса ошибки",
+    "config.desc.errorWebSearch.maxQueryChars": "Максимум символов текста ошибки на запрос (50-2000).",
+    "config.key.errorWebSearch.maxSearchesPerSession": "поисков ошибок за сессию",
+    "config.desc.errorWebSearch.maxSearchesPerSession": "Максимум автопоисков ошибок за сессию (0-20).",
+    "config.key.errorWebSearch.requestTimeoutMs": "таймаут поиска ошибок (мс)",
+    "config.desc.errorWebSearch.requestTimeoutMs": "Таймаут одного автопоиска ошибки, в мс (1000-120000).",
+    "config.key.browser.enabled": "тул браузера",
+    "config.desc.browser.enabled": "Разрешить агенту управлять браузером.",
+    "config.key.browser.headless": "безголовый браузер",
+    "config.desc.browser.headless": "Запускать браузер без видимого окна.",
+    "config.key.browser.maxElements": "макс. элементов страницы",
+    "config.desc.browser.maxElements": "Максимум элементов accessibility-дерева на снимок (1-200).",
+    "config.key.browser.maxContentChars": "макс. содержимого страницы",
+    "config.desc.browser.maxContentChars": "Максимум символов содержимого страницы на снимок (100-50000).",
+    "config.key.browser.maxConsoleEntries": "макс. записей консоли",
+    "config.desc.browser.maxConsoleEntries": "Максимум записей консоли браузера на снимок (1-200).",
+    "config.key.browser.maxConsoleLineChars": "макс. строки консоли",
+    "config.desc.browser.maxConsoleLineChars": "Максимум символов на строку консоли (50-5000).",
+    "config.key.browser.viewportWidth": "ширина вьюпорта",
+    "config.desc.browser.viewportWidth": "Ширина вьюпорта браузера в px (320-4096).",
+    "config.key.browser.viewportHeight": "высота вьюпорта",
+    "config.desc.browser.viewportHeight": "Высота вьюпорта браузера в px (200-2160).",
+    "config.key.browser.navigationTimeout": "таймаут навигации (мс)",
+    "config.desc.browser.navigationTimeout": "Таймаут одной навигации страницы, в мс (1000-120000).",
+    "config.key.security.maxRecursionDepth": "макс. глубина рекурсии",
+    "config.desc.security.maxRecursionDepth": "Макс. глубина вложенных вызовов тулов до отказа (0-20).",
+    "config.key.security.maxFileOperations": "макс. файловых операций",
+    "config.desc.security.maxFileOperations": "Максимум файловых операций за ход до отказа (0-10000).",
+    "config.key.security.rateLimits.maxRequestsPerMinute": "макс. запросов в минуту",
+    "config.desc.security.rateLimits.maxRequestsPerMinute": "Лимит LLM-запросов в минуту (1-1000).",
+    "config.key.security.rateLimits.maxParallelTasks": "макс. параллельных задач",
+    "config.desc.security.rateLimits.maxParallelTasks": "Лимит параллельных подзадач (1-50).",
+    "config.key.tools.defaultTags": "теги тулов по умолчанию",
+    "config.desc.tools.defaultTags": "Группы тулов, всегда загружаемые без gating по требованию.",
+    "config.key.security.bash.enabled": "проверка bash-команд",
+    "config.desc.security.bash.enabled": "Главный выключатель проверки bash-команд.",
+    "config.key.security.bash.blockDangerousFlags": "блокировать опасные флаги",
+    "config.desc.security.bash.blockDangerousFlags": "Отклонять рискованные флаги shell (например --force) в bash-туле.",
+    "config.key.security.network.enabled": "сетевые запросы",
+    "config.desc.security.network.enabled": "Главный выключатель проверок исходящих сетевых запросов (защита от SSRF).",
+    "config.key.security.bash.blacklist": "черный список bash",
+    "config.desc.security.bash.blacklist": "Команды, всегда блокируемые в bash-туле (список).",
+    "config.key.security.bash.whitelist": "белый список bash",
+    "config.desc.security.bash.whitelist": "Команды, всегда разрешенные в bash-туле (список).",
+    "config.key.security.bash.dangerousFlags": "опасные флаги",
+    "config.desc.security.bash.dangerousFlags": "Флаги команд, считающиеся опасными (список).",
+    "config.key.security.bash.dangerousOperators": "опасные операторы",
+    "config.desc.security.bash.dangerousOperators": "Шелл-операторы, считающиеся опасными (список).",
+    "config.key.security.paths.denied": "запрещенные пути",
+    "config.desc.security.paths.denied": "Пути, всегда закрытые для файловых тулов (список).",
+    "config.key.security.paths.allowed": "разрешенные пути",
+    "config.desc.security.paths.allowed": "Дополнительные пути, разрешенные вне workspace (список).",
+    "config.key.security.network.deniedDomains": "запрещенные домены",
+    "config.desc.security.network.deniedDomains": "Домены, к которым агенту нельзя обращаться (список).",
+    "config.key.security.network.allowedDomains": "разрешенные домены",
+    "config.desc.security.network.allowedDomains": "Домены, к которым можно обращаться (список; пусто - любые).",
+    "config.key.security.network.requestTimeout": "сетевой таймаут (мс)",
+    "config.desc.security.network.requestTimeout": "Таймаут одного исходящего запроса тула, в мс (1000-120000).",
+    "config.key.security.network.maxResponseSize": "макс. размер ответа",
+    "config.desc.security.network.maxResponseSize": "Максимум байт исходящего ответа (1024-1000000).",
+    "config.key.security.contentScan.dangerousPatterns": "опасные паттерны",
+    "config.desc.security.contentScan.dangerousPatterns": "Регулярные выражения, которые ищутся в содержимом файлов перед записью.",
+    "config.key.security.auditNotifier.enabled": "аудит-уведомитель",
+    "config.desc.security.auditNotifier.enabled": "Отправлять события аудита безопасности в файл или вебхук.",
+    "config.key.security.auditNotifier.filePath": "путь аудит-лога",
+    "config.desc.security.auditNotifier.filePath": "Файл, в который дописываются события аудита.",
+    "config.key.security.auditNotifier.webhookUrl": "URL аудит-вебхука",
+    "config.desc.security.auditNotifier.webhookUrl": "Вебхук, на который отправляются события аудита.",
+    "config.key.security.auditNotifier.webhookTimeout": "таймаут аудит-вебхука (мс)",
+    "config.desc.security.auditNotifier.webhookTimeout": "Таймаут одной отправки вебхука, в мс (1000-60000).",
+    "config.key.security.auditNotifier.minSeverity": "мин. серьезность аудита",
+    "config.desc.security.auditNotifier.minSeverity": "Низшая серьезность, при которой еще уведомлять (low/medium/high/critical).",
+    "config.key.security.auditNotifier.eventTypes": "типы событий аудита",
+    "config.desc.security.auditNotifier.eventTypes": "Какие типы событий аудита уведомляют; ничего не выбрано - все.",
+    "config.key.security.auditNotifier.maxRetries": "макс. повторов аудита",
+    "config.desc.security.auditNotifier.maxRetries": "Повторов одной упавшей отправки уведомления (0-10).",
+    "config.key.security.sessionEncryption.keyPath": "путь ключа шифрования",
+    "config.desc.security.sessionEncryption.keyPath": "Файл с ключом шифрования сессий.",
+    "config.key.security.sessionEncryption.encryptHistory": "шифровать историю чата",
+    "config.desc.security.sessionEncryption.encryptHistory": "Шифровать сохраненную историю чата на диске.",
+    "config.key.security.sessionEncryption.encryptSessionLog": "шифровать лог сессии",
+    "config.desc.security.sessionEncryption.encryptSessionLog": "Шифровать сохраненный лог session.jsonl на диске.",
+    "config.key.pricing.overrides": "переопределения цен",
+    "config.desc.pricing.overrides": "По-модельная таблица цен поверх встроенной.",
+    "config.key.modelCapabilities": "возможности моделей",
+    "config.desc.modelCapabilities": "Ручные переопределения vision/tools по id модели.",
+    "config.key.experts": "эксперты MoE",
+    "config.desc.experts": "Состав экспертов для MoE-оркестратора.",
+    "config.enum.text": "текст",
+    "config.enum.file": "файл",
+    "config.enum.critical": "критический"
   };
 });
 
@@ -33171,6 +33769,879 @@ var init_budget = __esm(() => {
   init_i18n();
 });
 
+// src/config/registry-extra.ts
+function bool(key, domain, reconfigure, get, set) {
+  return { key, aliases: [], domain, valueType: "bool", reconfigure, get, set };
+}
+function int(key, domain, min, max, step, reconfigure, get, set) {
+  return { key, aliases: [], domain, valueType: "int", min, max, step, reconfigure, get, set };
+}
+function share(key, domain, reconfigure, get, set) {
+  return { key, aliases: [], domain, valueType: "share", min: 0.05, max: 0.9, step: 0.01, reconfigure, get, set };
+}
+function enumOf(key, domain, values, reconfigure, get, set) {
+  return { key, aliases: [], domain, valueType: "enum", enumValues: values, reconfigure, get, set };
+}
+function list(key, domain, get, set, editor) {
+  return { key, aliases: [], domain, valueType: "list", reconfigure: false, editor, get, set };
+}
+function str(key, domain, get, set) {
+  return { key, aliases: [], domain, valueType: "string", reconfigure: false, get, set };
+}
+function strOpt(key, domain, get, set) {
+  return str(key, domain, get, set);
+}
+function json(key, domain, get, set, extraValidate, editor) {
+  return {
+    key,
+    aliases: [],
+    domain,
+    valueType: "json",
+    reconfigure: false,
+    editor,
+    get,
+    set,
+    extraValidate
+  };
+}
+function jsonShape(key, domain, get, set, check, editor) {
+  const extraValidate = (_c, v) => check(v) ? null : "invalid";
+  return json(key, domain, get, set, extraValidate, editor);
+}
+function sec(c) {
+  c.security ??= structuredClone(DEFAULT_SECURITY_CONFIG);
+  return c.security;
+}
+function isRecord2(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function isNonNegNum(v) {
+  return typeof v === "number" && Number.isFinite(v) && v >= 0;
+}
+var REASONING_BOUNDS, AUDIT_EVENT_TYPES, EXTRA_DEFS;
+var init_registry_extra = __esm(() => {
+  init_defaults();
+  init_security();
+  REASONING_BOUNDS = ["low", "medium", "high"];
+  AUDIT_EVENT_TYPES = [
+    "security_block",
+    "bash_command",
+    "file_operation",
+    "network_request",
+    "tool_call",
+    "authentication",
+    "configuration_change",
+    "session_start",
+    "session_end"
+  ];
+  EXTRA_DEFS = [
+    bool("provider.fallback", "provider", false, (c) => c.provider.fallback ?? false, (c, v) => {
+      c.provider.fallback = v;
+    }),
+    int("provider.maxCompletionTokens", "provider", 512, 128000, 1024, true, (c) => c.provider.maxCompletionTokens ?? 8192, (c, v) => {
+      c.provider.maxCompletionTokens = v;
+    }),
+    share("contextBudget.compactionThreshold", "budget", false, (c) => c.contextBudget.compactionThreshold, (c, v) => {
+      c.contextBudget.compactionThreshold = v;
+    }),
+    share("contextBudget.compactionMinLoad", "budget", false, (c) => c.contextBudget.compactionMinLoad ?? DEFAULTS.contextBudget.compactionMinLoad, (c, v) => {
+      c.contextBudget.compactionMinLoad = v;
+    }),
+    bool("instructions.summarize", "budget", true, (c) => c.instructions?.summarize ?? DEFAULTS.instructions.summarize, (c, v) => {
+      c.instructions ??= structuredClone(DEFAULTS.instructions);
+      c.instructions.summarize = v;
+    }),
+    bool("contextLog.enabled", "budget", false, (c) => c.contextLog?.enabled ?? DEFAULTS.contextLog.enabled, (c, v) => {
+      c.contextLog ??= structuredClone(DEFAULTS.contextLog);
+      c.contextLog.enabled = v;
+    }),
+    bool("contextLog.redact", "budget", false, (c) => c.contextLog?.redact ?? DEFAULTS.contextLog.redact, (c, v) => {
+      c.contextLog ??= structuredClone(DEFAULTS.contextLog);
+      c.contextLog.redact = v;
+    }),
+    enumOf("reasoning.min", "reasoning", REASONING_BOUNDS, true, (c) => c.reasoning?.min ?? DEFAULTS.reasoning.min, (c, v) => {
+      c.reasoning ??= structuredClone(DEFAULTS.reasoning);
+      c.reasoning.min = v;
+    }),
+    enumOf("reasoning.max", "reasoning", REASONING_BOUNDS, true, (c) => c.reasoning?.max ?? DEFAULTS.reasoning.max, (c, v) => {
+      c.reasoning ??= structuredClone(DEFAULTS.reasoning);
+      c.reasoning.max = v;
+    }),
+    enumOf("reasoning.baseline", "reasoning", REASONING_BOUNDS, true, (c) => c.reasoning?.baseline ?? DEFAULTS.reasoning.baseline, (c, v) => {
+      c.reasoning ??= structuredClone(DEFAULTS.reasoning);
+      c.reasoning.baseline = v;
+    }),
+    int("reasoning.overrideCooldown", "reasoning", 1, 60, 1, true, (c) => c.reasoning?.overrideCooldown ?? DEFAULTS.reasoning.overrideCooldown, (c, v) => {
+      c.reasoning ??= structuredClone(DEFAULTS.reasoning);
+      c.reasoning.overrideCooldown = v;
+    }),
+    bool("autoPlan", "agent", true, (c) => c.autoPlan, (c, v) => {
+      c.autoPlan = v;
+    }),
+    bool("tools.enableOnDemand", "agent", true, (c) => c.tools.enableOnDemand, (c, v) => {
+      c.tools.enableOnDemand = v;
+    }),
+    bool("session.autoSave", "session", false, (c) => c.session?.autoSave ?? DEFAULTS.session.autoSave, (c, v) => {
+      c.session ??= structuredClone(DEFAULTS.session);
+      c.session.autoSave = v;
+    }),
+    int("session.maxSessions", "session", 1, 500, 1, false, (c) => c.session?.maxSessions ?? DEFAULTS.session.maxSessions, (c, v) => {
+      c.session ??= structuredClone(DEFAULTS.session);
+      c.session.maxSessions = v;
+    }),
+    bool("session.isolateMemory", "session", false, (c) => c.session?.isolateMemory ?? DEFAULTS.session.isolateMemory, (c, v) => {
+      c.session ??= structuredClone(DEFAULTS.session);
+      c.session.isolateMemory = v;
+    }),
+    bool("session.autoName", "session", false, (c) => c.session?.autoName ?? DEFAULTS.session.autoName, (c, v) => {
+      c.session ??= structuredClone(DEFAULTS.session);
+      c.session.autoName = v;
+    }),
+    bool("sessionIsolation.enabled", "session", false, (c) => c.sessionIsolation?.enabled ?? DEFAULTS.sessionIsolation.enabled, (c, v) => {
+      c.sessionIsolation ??= structuredClone(DEFAULTS.sessionIsolation);
+      c.sessionIsolation.enabled = v;
+    }),
+    bool("sessionIsolation.isolatePlugins", "session", false, (c) => c.sessionIsolation?.isolatePlugins ?? DEFAULTS.sessionIsolation.isolatePlugins, (c, v) => {
+      c.sessionIsolation ??= structuredClone(DEFAULTS.sessionIsolation);
+      c.sessionIsolation.isolatePlugins = v;
+    }),
+    bool("sessionIsolation.isolateTempFiles", "session", false, (c) => c.sessionIsolation?.isolateTempFiles ?? DEFAULTS.sessionIsolation.isolateTempFiles, (c, v) => {
+      c.sessionIsolation ??= structuredClone(DEFAULTS.sessionIsolation);
+      c.sessionIsolation.isolateTempFiles = v;
+    }),
+    bool("ui.spinner", "ui", false, (c) => c.ui.spinner, (c, v) => {
+      c.ui.spinner = v;
+    }),
+    bool("ui.showContextStats", "ui", false, (c) => c.ui.showContextStats, (c, v) => {
+      c.ui.showContextStats = v;
+    }),
+    bool("ui.showCompaction", "ui", false, (c) => c.ui.showCompaction, (c, v) => {
+      c.ui.showCompaction = v;
+    }),
+    int("retry.maxRetries", "agent", 0, 10, 1, false, (c) => c.retry.maxRetries, (c, v) => {
+      c.retry.maxRetries = v;
+    }),
+    int("retry.baseDelay", "agent", 0, 60000, 100, false, (c) => c.retry.baseDelay, (c, v) => {
+      c.retry.baseDelay = v;
+    }),
+    int("retry.maxDelay", "agent", 0, 300000, 1000, false, (c) => c.retry.maxDelay, (c, v) => {
+      c.retry.maxDelay = v;
+    }),
+    int("retry.maxStreamRetries", "agent", 0, 10, 1, false, (c) => c.retry.maxStreamRetries ?? DEFAULTS.retry.maxStreamRetries, (c, v) => {
+      c.retry.maxStreamRetries = v;
+    }),
+    int("retry.noDataTimeoutMs", "agent", 1000, 600000, 1000, false, (c) => c.retry.noDataTimeoutMs ?? DEFAULTS.retry.noDataTimeoutMs, (c, v) => {
+      c.retry.noDataTimeoutMs = v;
+    }),
+    bool("pricing.enabled", "pricing", false, (c) => c.pricing?.enabled ?? DEFAULTS.pricing.enabled, (c, v) => {
+      c.pricing ??= structuredClone(DEFAULTS.pricing);
+      c.pricing.enabled = v;
+    }),
+    bool("updater.enabled", "updater", false, (c) => c.updater.enabled, (c, v) => {
+      c.updater.enabled = v;
+    }),
+    bool("updater.checkOnStart", "updater", false, (c) => c.updater.checkOnStart, (c, v) => {
+      c.updater.checkOnStart = v;
+    }),
+    bool("updater.autoInstall", "updater", false, (c) => c.updater.autoInstall, (c, v) => {
+      c.updater.autoInstall = v;
+    }),
+    int("updater.intervalMs", "updater", 0, 86400000, 60000, false, (c) => c.updater.intervalMs, (c, v) => {
+      c.updater.intervalMs = v;
+    }),
+    share("skills.budget", "agent", false, (c) => c.skills.budget, (c, v) => {
+      c.skills.budget = v;
+    }),
+    bool("hallucination.judge.enabled", "agent", true, (c) => c.hallucination?.judge.enabled ?? DEFAULTS.hallucination.judge.enabled, (c, v) => {
+      c.hallucination ??= structuredClone(DEFAULTS.hallucination);
+      c.hallucination.judge.enabled = v;
+    }),
+    enumOf("subagent.resultMode", "agent", ["text", "file"], true, (c) => c.subagent?.resultMode ?? DEFAULTS.subagent.resultMode, (c, v) => {
+      c.subagent ??= structuredClone(DEFAULTS.subagent);
+      c.subagent.resultMode = v;
+    }),
+    int("subagent.maxSummaryChars", "agent", 100, 50000, 100, false, (c) => c.subagent?.maxSummaryChars ?? DEFAULTS.subagent.maxSummaryChars, (c, v) => {
+      c.subagent ??= structuredClone(DEFAULTS.subagent);
+      c.subagent.maxSummaryChars = v;
+    }),
+    int("subagent.maxParallelChunkQueries", "agent", 1, 16, 1, false, (c) => c.subagent?.maxParallelChunkQueries ?? DEFAULTS.subagent.maxParallelChunkQueries, (c, v) => {
+      c.subagent ??= structuredClone(DEFAULTS.subagent);
+      c.subagent.maxParallelChunkQueries = v;
+    }),
+    bool("subagent.stableSystemPrompt", "agent", false, (c) => c.subagent?.stableSystemPrompt ?? DEFAULTS.subagent.stableSystemPrompt, (c, v) => {
+      c.subagent ??= structuredClone(DEFAULTS.subagent);
+      c.subagent.stableSystemPrompt = v;
+    }),
+    bool("modelLoad.autoLoad", "provider", true, (c) => c.modelLoad?.autoLoad ?? DEFAULTS.modelLoad.autoLoad, (c, v) => {
+      c.modelLoad ??= structuredClone(DEFAULTS.modelLoad);
+      c.modelLoad.autoLoad = v;
+    }),
+    bool("modelLoad.flashAttention", "provider", true, (c) => c.modelLoad?.flashAttention ?? DEFAULTS.modelLoad.flashAttention, (c, v) => {
+      c.modelLoad ??= structuredClone(DEFAULTS.modelLoad);
+      c.modelLoad.flashAttention = v;
+    }),
+    bool("modelLoad.offloadKvCacheToGpu", "provider", true, (c) => c.modelLoad?.offloadKvCacheToGpu ?? DEFAULTS.modelLoad.offloadKvCacheToGpu, (c, v) => {
+      c.modelLoad ??= structuredClone(DEFAULTS.modelLoad);
+      c.modelLoad.offloadKvCacheToGpu = v;
+    }),
+    int("modelLoad.evalBatchSize", "provider", 1, 4096, 1, true, (c) => c.modelLoad?.evalBatchSize ?? 512, (c, v) => {
+      c.modelLoad ??= structuredClone(DEFAULTS.modelLoad);
+      c.modelLoad.evalBatchSize = v;
+    }),
+    bool("webSearch.enabled", "research", false, (c) => c.webSearch?.enabled ?? DEFAULTS.webSearch.enabled, (c, v) => {
+      c.webSearch ??= structuredClone(DEFAULTS.webSearch);
+      c.webSearch.enabled = v;
+    }),
+    bool("errorWebSearch.enabled", "research", false, (c) => c.errorWebSearch?.enabled ?? DEFAULTS.errorWebSearch.enabled, (c, v) => {
+      c.errorWebSearch ??= structuredClone(DEFAULTS.errorWebSearch);
+      c.errorWebSearch.enabled = v;
+    }),
+    int("errorWebSearch.threshold", "research", 1, 20, 1, false, (c) => c.errorWebSearch?.threshold ?? DEFAULTS.errorWebSearch.threshold, (c, v) => {
+      c.errorWebSearch ??= structuredClone(DEFAULTS.errorWebSearch);
+      c.errorWebSearch.threshold = v;
+    }),
+    int("errorWebSearch.maxResults", "research", 1, 20, 1, false, (c) => c.errorWebSearch?.maxResults ?? DEFAULTS.errorWebSearch.maxResults, (c, v) => {
+      c.errorWebSearch ??= structuredClone(DEFAULTS.errorWebSearch);
+      c.errorWebSearch.maxResults = v;
+    }),
+    int("errorWebSearch.maxQueryChars", "research", 50, 2000, 10, false, (c) => c.errorWebSearch?.maxQueryChars ?? DEFAULTS.errorWebSearch.maxQueryChars, (c, v) => {
+      c.errorWebSearch ??= structuredClone(DEFAULTS.errorWebSearch);
+      c.errorWebSearch.maxQueryChars = v;
+    }),
+    int("errorWebSearch.maxSearchesPerSession", "research", 0, 20, 1, false, (c) => c.errorWebSearch?.maxSearchesPerSession ?? DEFAULTS.errorWebSearch.maxSearchesPerSession, (c, v) => {
+      c.errorWebSearch ??= structuredClone(DEFAULTS.errorWebSearch);
+      c.errorWebSearch.maxSearchesPerSession = v;
+    }),
+    int("errorWebSearch.requestTimeoutMs", "research", 1000, 120000, 1000, false, (c) => c.errorWebSearch?.requestTimeoutMs ?? DEFAULTS.errorWebSearch.requestTimeoutMs, (c, v) => {
+      c.errorWebSearch ??= structuredClone(DEFAULTS.errorWebSearch);
+      c.errorWebSearch.requestTimeoutMs = v;
+    }),
+    bool("browser.enabled", "browser", false, (c) => c.browser.enabled, (c, v) => {
+      c.browser.enabled = v;
+    }),
+    bool("browser.headless", "browser", false, (c) => c.browser.headless, (c, v) => {
+      c.browser.headless = v;
+    }),
+    int("browser.maxElements", "browser", 1, 200, 1, false, (c) => c.browser.maxElements, (c, v) => {
+      c.browser.maxElements = v;
+    }),
+    int("browser.maxContentChars", "browser", 100, 50000, 100, false, (c) => c.browser.maxContentChars, (c, v) => {
+      c.browser.maxContentChars = v;
+    }),
+    int("browser.maxConsoleEntries", "browser", 1, 200, 1, false, (c) => c.browser.maxConsoleEntries, (c, v) => {
+      c.browser.maxConsoleEntries = v;
+    }),
+    int("browser.maxConsoleLineChars", "browser", 50, 5000, 10, false, (c) => c.browser.maxConsoleLineChars, (c, v) => {
+      c.browser.maxConsoleLineChars = v;
+    }),
+    int("browser.viewportWidth", "browser", 320, 4096, 10, false, (c) => c.browser.viewportWidth, (c, v) => {
+      c.browser.viewportWidth = v;
+    }),
+    int("browser.viewportHeight", "browser", 200, 2160, 10, false, (c) => c.browser.viewportHeight, (c, v) => {
+      c.browser.viewportHeight = v;
+    }),
+    int("browser.navigationTimeout", "browser", 1000, 120000, 1000, false, (c) => c.browser.navigationTimeout, (c, v) => {
+      c.browser.navigationTimeout = v;
+    }),
+    int("security.maxRecursionDepth", "security", 0, 20, 1, false, (c) => c.security?.maxRecursionDepth ?? DEFAULT_SECURITY_CONFIG.maxRecursionDepth, (c, v) => {
+      c.security ??= structuredClone(DEFAULT_SECURITY_CONFIG);
+      c.security.maxRecursionDepth = v;
+    }),
+    int("security.maxFileOperations", "security", 0, 1e4, 10, false, (c) => c.security?.maxFileOperations ?? DEFAULT_SECURITY_CONFIG.maxFileOperations, (c, v) => {
+      c.security ??= structuredClone(DEFAULT_SECURITY_CONFIG);
+      c.security.maxFileOperations = v;
+    }),
+    int("security.rateLimits.maxRequestsPerMinute", "security", 1, 1000, 1, false, (c) => c.security?.rateLimits.maxRequestsPerMinute ?? DEFAULT_SECURITY_CONFIG.rateLimits.maxRequestsPerMinute, (c, v) => {
+      c.security ??= structuredClone(DEFAULT_SECURITY_CONFIG);
+      c.security.rateLimits.maxRequestsPerMinute = v;
+    }),
+    int("security.rateLimits.maxParallelTasks", "security", 1, 50, 1, false, (c) => c.security?.rateLimits.maxParallelTasks ?? DEFAULT_SECURITY_CONFIG.rateLimits.maxParallelTasks, (c, v) => {
+      c.security ??= structuredClone(DEFAULT_SECURITY_CONFIG);
+      c.security.rateLimits.maxParallelTasks = v;
+    }),
+    list("tools.defaultTags", "tools", (c) => c.tools.defaultTags, (c, v) => {
+      c.tools.defaultTags = v;
+    }, { kind: "tags", placeholder: "file" }),
+    list("security.bash.blacklist", "security", (c) => c.security?.bash.blacklist ?? DEFAULT_SECURITY_CONFIG.bash.blacklist, (c, v) => {
+      sec(c).bash.blacklist = v;
+    }, { kind: "tags", placeholder: "rm" }),
+    list("security.bash.whitelist", "security", (c) => c.security?.bash.whitelist ?? DEFAULT_SECURITY_CONFIG.bash.whitelist, (c, v) => {
+      sec(c).bash.whitelist = v;
+    }, { kind: "tags", placeholder: "bun" }),
+    list("security.bash.dangerousFlags", "security", (c) => c.security?.bash.dangerousFlags ?? DEFAULT_SECURITY_CONFIG.bash.dangerousFlags, (c, v) => {
+      sec(c).bash.dangerousFlags = v;
+    }, { kind: "tags", placeholder: "--force" }),
+    list("security.bash.dangerousOperators", "security", (c) => c.security?.bash.dangerousOperators ?? DEFAULT_SECURITY_CONFIG.bash.dangerousOperators, (c, v) => {
+      sec(c).bash.dangerousOperators = v;
+    }, { kind: "tags", placeholder: "&&" }),
+    list("security.paths.denied", "security", (c) => c.security?.paths.denied ?? DEFAULT_SECURITY_CONFIG.paths.denied, (c, v) => {
+      sec(c).paths.denied = v;
+    }, { kind: "tags", placeholder: ".git/" }),
+    list("security.paths.allowed", "security", (c) => c.security?.paths.allowed ?? DEFAULT_SECURITY_CONFIG.paths.allowed, (c, v) => {
+      sec(c).paths.allowed = v;
+    }, { kind: "tags", placeholder: "src/**" }),
+    list("security.network.deniedDomains", "security", (c) => c.security?.network.deniedDomains ?? DEFAULT_SECURITY_CONFIG.network.deniedDomains, (c, v) => {
+      sec(c).network.deniedDomains = v;
+    }, { kind: "tags", placeholder: "localhost" }),
+    list("security.network.allowedDomains", "security", (c) => c.security?.network.allowedDomains ?? DEFAULT_SECURITY_CONFIG.network.allowedDomains, (c, v) => {
+      sec(c).network.allowedDomains = v;
+    }, { kind: "tags", placeholder: "api.example.com" }),
+    int("security.network.requestTimeout", "security", 1000, 120000, 1000, false, (c) => c.security?.network.requestTimeout ?? DEFAULT_SECURITY_CONFIG.network.requestTimeout, (c, v) => {
+      sec(c).network.requestTimeout = v;
+    }),
+    int("security.network.maxResponseSize", "security", 1024, 1e6, 1024, false, (c) => c.security?.network.maxResponseSize ?? DEFAULT_SECURITY_CONFIG.network.maxResponseSize, (c, v) => {
+      sec(c).network.maxResponseSize = v;
+    }),
+    jsonShape("security.contentScan.dangerousPatterns", "security", (c) => (c.security?.contentScan.dangerousPatterns ?? DEFAULT_SECURITY_CONFIG.contentScan.dangerousPatterns).map((r) => r.source), (c, v) => {
+      sec(c).contentScan.dangerousPatterns = v.map((s) => new RegExp(s));
+    }, (v) => Array.isArray(v) && v.every((s) => {
+      if (typeof s !== "string")
+        return false;
+      try {
+        new RegExp(s);
+        return true;
+      } catch {
+        return false;
+      }
+    }), { kind: "tags", placeholder: "eval\\(" }),
+    bool("security.auditNotifier.enabled", "security", false, (c) => c.security?.auditNotifier.enabled ?? DEFAULT_SECURITY_CONFIG.auditNotifier.enabled, (c, v) => {
+      sec(c).auditNotifier.enabled = v;
+    }),
+    strOpt("security.auditNotifier.filePath", "security", (c) => c.security?.auditNotifier.filePath ?? "", (c, v) => {
+      const s = String(v).trim();
+      sec(c).auditNotifier.filePath = s.length === 0 ? undefined : s;
+    }),
+    strOpt("security.auditNotifier.webhookUrl", "security", (c) => c.security?.auditNotifier.webhookUrl ?? "", (c, v) => {
+      const s = String(v).trim();
+      sec(c).auditNotifier.webhookUrl = s.length === 0 ? undefined : s;
+    }),
+    int("security.auditNotifier.webhookTimeout", "security", 1000, 60000, 1000, false, (c) => c.security?.auditNotifier.webhookTimeout ?? DEFAULT_SECURITY_CONFIG.auditNotifier.webhookTimeout, (c, v) => {
+      sec(c).auditNotifier.webhookTimeout = v;
+    }),
+    enumOf("security.auditNotifier.minSeverity", "security", ["low", "medium", "high", "critical"], false, (c) => c.security?.auditNotifier.minSeverity ?? DEFAULT_SECURITY_CONFIG.auditNotifier.minSeverity, (c, v) => {
+      sec(c).auditNotifier.minSeverity = v;
+    }),
+    jsonShape("security.auditNotifier.eventTypes", "security", (c) => c.security?.auditNotifier.eventTypes ?? DEFAULT_SECURITY_CONFIG.auditNotifier.eventTypes, (c, v) => {
+      sec(c).auditNotifier.eventTypes = v;
+    }, (v) => Array.isArray(v) && v.every((e) => typeof e === "string" && AUDIT_EVENT_TYPES.includes(e)), { kind: "checkboxes", options: AUDIT_EVENT_TYPES }),
+    int("security.auditNotifier.maxRetries", "security", 0, 10, 1, false, (c) => c.security?.auditNotifier.maxRetries ?? DEFAULT_SECURITY_CONFIG.auditNotifier.maxRetries, (c, v) => {
+      sec(c).auditNotifier.maxRetries = v;
+    }),
+    strOpt("security.sessionEncryption.keyPath", "security", (c) => c.security?.sessionEncryption.keyPath ?? "", (c, v) => {
+      const s = String(v).trim();
+      sec(c).sessionEncryption.keyPath = s.length === 0 ? undefined : s;
+    }),
+    bool("security.sessionEncryption.encryptHistory", "security", false, (c) => c.security?.sessionEncryption.encryptHistory ?? DEFAULT_SECURITY_CONFIG.sessionEncryption.encryptHistory, (c, v) => {
+      sec(c).sessionEncryption.encryptHistory = v;
+    }),
+    bool("security.sessionEncryption.encryptSessionLog", "security", false, (c) => c.security?.sessionEncryption.encryptSessionLog ?? DEFAULT_SECURITY_CONFIG.sessionEncryption.encryptSessionLog, (c, v) => {
+      sec(c).sessionEncryption.encryptSessionLog = v;
+    }),
+    jsonShape("pricing.overrides", "pricing", (c) => c.pricing?.overrides ?? {}, (c, v) => {
+      c.pricing ??= structuredClone(DEFAULTS.pricing);
+      c.pricing.overrides = v;
+    }, (v) => isRecord2(v) && Object.values(v).every((e) => isRecord2(e) && isNonNegNum(e.input) && isNonNegNum(e.output) && (e.cachedInput === undefined || isNonNegNum(e.cachedInput)) && (e.cacheWrite === undefined || isNonNegNum(e.cacheWrite))), {
+      kind: "table",
+      columns: [
+        { key: "name" },
+        { key: "input", type: "number" },
+        { key: "output", type: "number" },
+        { key: "cachedInput", type: "number", optional: true },
+        { key: "cacheWrite", type: "number", optional: true }
+      ]
+    }),
+    jsonShape("modelCapabilities", "provider", (c) => c.modelCapabilities ?? {}, (c, v) => {
+      c.modelCapabilities = v;
+    }, (v) => isRecord2(v) && Object.values(v).every((e) => isRecord2(e) && (e.vision === undefined || typeof e.vision === "boolean") && (e.tools === undefined || typeof e.tools === "boolean")), {
+      kind: "table",
+      columns: [
+        { key: "name" },
+        { key: "vision", type: "bool", optional: true },
+        { key: "tools", type: "bool", optional: true }
+      ]
+    }),
+    jsonShape("experts", "agent", (c) => c.experts, (c, v) => {
+      c.experts = v;
+    }, (v) => isRecord2(v) && Object.values(v).every((e) => isRecord2(e) && typeof e.model === "string" && Array.isArray(e.tool_tags) && e.tool_tags.every((t2) => typeof t2 === "string") && (e.max_attempts === undefined || typeof e.max_attempts === "number" && Number.isFinite(e.max_attempts)) && (e.description === undefined || typeof e.description === "string")), {
+      kind: "table",
+      columns: [
+        { key: "name" },
+        { key: "model" },
+        { key: "tool_tags", array: true },
+        { key: "max_attempts", type: "number", optional: true },
+        { key: "description", optional: true }
+      ]
+    })
+  ];
+});
+
+// src/config/registry.ts
+function shareField(key, canonical) {
+  const field = key === "system" ? "systemPrompt" : "responseReserve";
+  const other = key === "system" ? "responseReserve" : "systemPrompt";
+  return {
+    key: canonical,
+    aliases: [`context.${key}`],
+    domain: "budget",
+    valueType: "share",
+    min: MIN_SHARE2,
+    max: MAX_SHARE2,
+    step: 0.01,
+    reconfigure: true,
+    get: (c) => c.contextBudget[field],
+    set: (c, v) => setBudgetShare(c, key, v),
+    extraValidate: (c, v) => {
+      const n = v;
+      const total = n + c.contextBudget[other];
+      return total > MAX_COMBINED2 ? "combined" : null;
+    }
+  };
+}
+function securityToggle(field, canonical) {
+  return {
+    key: canonical,
+    aliases: [],
+    domain: "security",
+    valueType: "bool",
+    reconfigure: false,
+    get: (c) => {
+      const sec2 = c.security;
+      if (!sec2)
+        return false;
+      return field === "enabled" ? sec2.enabled : sec2[field].enabled;
+    },
+    set: (c, v) => {
+      if (!c.security)
+        c.security = structuredClone(DEFAULT_SECURITY_CONFIG);
+      if (field === "enabled")
+        c.security.enabled = v;
+      else
+        c.security[field].enabled = v;
+    }
+  };
+}
+function resolveConfigKey(name) {
+  return BY_NAME.get(name) ?? null;
+}
+function configDefs() {
+  return DEFINITIONS;
+}
+function canonicalKeys() {
+  return DEFINITIONS.map((d) => d.key);
+}
+function keysForGroup(prefix) {
+  return DEFINITIONS.filter((d) => d.key.startsWith(`${prefix}.`));
+}
+function allConfigNames() {
+  const out = [];
+  for (const def of DEFINITIONS) {
+    out.push({ name: def.key, def, alias: false });
+    for (const a of def.aliases)
+      out.push({ name: a, def, alias: true });
+  }
+  return out;
+}
+function formatConfigValue(value) {
+  if (typeof value === "boolean")
+    return value ? "on" : "off";
+  if (Array.isArray(value))
+    return value.join(", ");
+  if (typeof value === "object" && value !== null)
+    return JSON.stringify(value);
+  return String(value);
+}
+function parseBool(raw) {
+  const v = raw.trim().toLowerCase();
+  if (["on", "true", "1", "yes", "y", "enable", "enabled"].includes(v))
+    return { ok: true, value: true };
+  if (["off", "false", "0", "no", "n", "disable", "disabled"].includes(v))
+    return { ok: true, value: false };
+  return { ok: false, reason: "invalid" };
+}
+function parseConfigValue(def, raw) {
+  const trimmed = raw.trim();
+  switch (def.valueType) {
+    case "string":
+      return trimmed.length > 0 ? { ok: true, value: trimmed } : { ok: false, reason: "invalid" };
+    case "bool":
+      return parseBool(trimmed);
+    case "enum": {
+      const v = trimmed.toLowerCase();
+      if (def.enumValues && !def.enumValues.includes(v))
+        return { ok: false, reason: "invalid" };
+      return { ok: true, value: v };
+    }
+    case "int": {
+      if (!/^-?\d+$/.test(trimmed))
+        return { ok: false, reason: "invalid" };
+      const n = Number(trimmed);
+      if (!Number.isFinite(n))
+        return { ok: false, reason: "invalid" };
+      if (def.min !== undefined && n < def.min)
+        return { ok: false, reason: "invalid" };
+      if (def.max !== undefined && n > def.max)
+        return { ok: false, reason: "invalid" };
+      return { ok: true, value: n };
+    }
+    case "share": {
+      const isPct = trimmed.endsWith("%");
+      const body = isPct ? trimmed.slice(0, -1).trim() : trimmed;
+      if (!/^-?\d+(\.\d+)?$/.test(body))
+        return { ok: false, reason: "invalid" };
+      let n = Number(body);
+      if (isPct)
+        n = n / 100;
+      if (!Number.isFinite(n) || n < MIN_SHARE2 || n > MAX_SHARE2)
+        return { ok: false, reason: "invalid" };
+      return { ok: true, value: n };
+    }
+    case "list": {
+      if (trimmed.length === 0)
+        return { ok: true, value: [] };
+      if (trimmed.startsWith("[")) {
+        try {
+          const parsed = JSON.parse(trimmed);
+          if (Array.isArray(parsed) && parsed.every((x) => typeof x === "string")) {
+            return { ok: true, value: parsed };
+          }
+        } catch {}
+      }
+      const items = trimmed.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
+      return { ok: true, value: items };
+    }
+    case "json": {
+      if (trimmed.length > 20000)
+        return { ok: false, reason: "invalid" };
+      try {
+        return { ok: true, value: JSON.parse(trimmed) };
+      } catch {
+        return { ok: false, reason: "invalid" };
+      }
+    }
+  }
+}
+function getConfigValue(config, name) {
+  const def = resolveConfigKey(name);
+  if (!def)
+    return { ok: false, reason: "unknown-key", input: name };
+  const value = def.get(config);
+  return { ok: true, key: def.key, def, value, display: formatConfigValue(value) };
+}
+function applyProviderModelMemory(config, key, value) {
+  const provider = config.provider;
+  const activeName = provider.active ?? provider.type;
+  if (key === "model") {
+    if (!activeName)
+      return;
+    provider.models = { ...provider.models ?? {}, [activeName]: String(value) };
+    return;
+  }
+  if (key === "provider.active") {
+    const remembered = provider.models?.[String(value)];
+    if (remembered)
+      config.model = remembered;
+  }
+}
+function setConfigValue(config, name, raw) {
+  const def = resolveConfigKey(name);
+  if (!def)
+    return { ok: false, reason: "unknown-key", input: name };
+  if (def.readOnly)
+    return { ok: false, reason: "read-only", input: name, key: def.key, def };
+  const parsed = parseConfigValue(def, raw);
+  if (!parsed.ok)
+    return { ok: false, reason: "invalid-value", input: name, key: def.key, def };
+  const extra = def.extraValidate?.(config, parsed.value);
+  if (extra)
+    return { ok: false, reason: extra, input: name, key: def.key, def };
+  def.set(config, parsed.value);
+  applyProviderModelMemory(config, def.key, parsed.value);
+  return {
+    ok: true,
+    key: def.key,
+    def,
+    value: parsed.value,
+    display: formatConfigValue(parsed.value),
+    reconfigure: def.reconfigure,
+    reasoningChanged: def.key === "reasoning.mode"
+  };
+}
+function captureConfigSnapshot(config) {
+  const snapshot = new Map;
+  for (const def of DEFINITIONS) {
+    try {
+      snapshot.set(def.key, structuredClone(def.get(config)));
+    } catch {}
+  }
+  return snapshot;
+}
+var REASONING_LEVELS, LOG_LEVELS, VERBOSITY_LEVELS, LOCALES, MIN_SHARE2 = 0.05, MAX_SHARE2 = 0.9, MAX_COMBINED2 = 0.95, DEFINITIONS, BY_NAME;
+var init_registry2 = __esm(() => {
+  init_defaults();
+  init_security();
+  init_budget();
+  init_version();
+  init_registry_extra();
+  REASONING_LEVELS = [
+    "auto",
+    "default",
+    "none",
+    "low",
+    "medium",
+    "high",
+    "max"
+  ];
+  LOG_LEVELS = ["silent", "error", "warn", "info", "debug"];
+  VERBOSITY_LEVELS = ["quiet", "normal", "verbose"];
+  LOCALES = ["en", "ru"];
+  DEFINITIONS = [
+    {
+      key: "model",
+      aliases: [],
+      domain: "agent",
+      valueType: "string",
+      reconfigure: true,
+      get: (c) => c.model,
+      set: (c, v) => {
+        c.model = String(v);
+      }
+    },
+    {
+      key: "provider.active",
+      aliases: [],
+      domain: "provider",
+      valueType: "string",
+      reconfigure: true,
+      get: (c) => c.provider.active ?? c.provider.type,
+      set: (c, v) => {
+        c.provider.active = String(v);
+      },
+      extraValidate: (c, v) => {
+        const entries = c.provider.entries ?? [];
+        if (entries.length === 0)
+          return null;
+        const name = String(v);
+        const found = entries.some((e) => e.label === name || e.type === name);
+        return found ? null : "invalid";
+      }
+    },
+    {
+      key: "contextWindow",
+      aliases: ["context.window"],
+      domain: "budget",
+      valueType: "int",
+      min: 1024,
+      step: 1024,
+      reconfigure: true,
+      get: (c) => c.contextWindow,
+      set: (c, v) => {
+        c.contextWindow = v;
+      }
+    },
+    shareField("system", "contextBudget.systemPrompt"),
+    shareField("reserve", "contextBudget.responseReserve"),
+    {
+      key: "showReasoning",
+      aliases: ["reasoning.show"],
+      domain: "reasoning",
+      valueType: "bool",
+      reconfigure: false,
+      get: (c) => c.showReasoning,
+      set: (c, v) => {
+        c.showReasoning = v;
+      }
+    },
+    {
+      key: "reasoning.mode",
+      aliases: ["reasoning.level"],
+      domain: "reasoning",
+      valueType: "enum",
+      enumValues: REASONING_LEVELS,
+      reconfigure: true,
+      get: (c) => c.reasoning?.mode ?? "auto",
+      set: (c, v) => {
+        const base = c.reasoning ?? structuredClone(DEFAULTS.reasoning);
+        c.reasoning = { ...base, mode: v };
+      }
+    },
+    {
+      key: "ui.verbosity",
+      aliases: ["verbosity"],
+      domain: "ui",
+      valueType: "enum",
+      enumValues: VERBOSITY_LEVELS,
+      reconfigure: false,
+      get: (c) => c.ui.verbosity ?? (c.ui.verbose ? "verbose" : "quiet"),
+      set: (c, v) => {
+        c.ui.verbosity = v;
+      }
+    },
+    {
+      key: "maxToolIterations",
+      aliases: [],
+      domain: "agent",
+      valueType: "int",
+      min: 1,
+      step: 1,
+      reconfigure: false,
+      get: (c) => c.maxToolIterations,
+      set: (c, v) => {
+        c.maxToolIterations = v;
+      }
+    },
+    {
+      key: "stuckThreshold",
+      aliases: [],
+      domain: "agent",
+      valueType: "int",
+      min: 1,
+      step: 1,
+      reconfigure: false,
+      get: (c) => c.stuckThreshold,
+      set: (c, v) => {
+        c.stuckThreshold = v;
+      }
+    },
+    {
+      key: "moe.enabled",
+      aliases: [],
+      domain: "agent",
+      valueType: "bool",
+      reconfigure: true,
+      get: (c) => c.moe?.enabled ?? DEFAULTS.moe.enabled,
+      set: (c, v) => {
+        c.moe = { ...c.moe ?? DEFAULTS.moe, enabled: v };
+      }
+    },
+    {
+      key: "moe.maxReplanCycles",
+      aliases: [],
+      domain: "agent",
+      valueType: "int",
+      min: 0,
+      max: 10,
+      step: 1,
+      reconfigure: true,
+      get: (c) => c.moe?.maxReplanCycles ?? DEFAULTS.moe.maxReplanCycles,
+      set: (c, v) => {
+        c.moe = { ...c.moe ?? DEFAULTS.moe, maxReplanCycles: v };
+      }
+    },
+    {
+      key: "critic.enabled",
+      aliases: [],
+      domain: "agent",
+      valueType: "bool",
+      reconfigure: true,
+      get: (c) => c.critic?.enabled ?? DEFAULTS.critic.enabled,
+      set: (c, v) => {
+        c.critic = { ...c.critic ?? DEFAULTS.critic, enabled: v };
+      }
+    },
+    {
+      key: "critic.maxCalls",
+      aliases: [],
+      domain: "agent",
+      valueType: "int",
+      min: 0,
+      max: 20,
+      step: 1,
+      reconfigure: true,
+      get: (c) => c.critic?.maxCalls ?? DEFAULTS.critic.maxCalls,
+      set: (c, v) => {
+        c.critic = { ...c.critic ?? DEFAULTS.critic, maxCalls: v };
+      }
+    },
+    {
+      key: "critic.maxRepairCycles",
+      aliases: [],
+      domain: "agent",
+      valueType: "int",
+      min: 0,
+      max: 5,
+      step: 1,
+      reconfigure: true,
+      get: (c) => c.critic?.maxRepairCycles ?? DEFAULTS.critic.maxRepairCycles,
+      set: (c, v) => {
+        c.critic = { ...c.critic ?? DEFAULTS.critic, maxRepairCycles: v };
+      }
+    },
+    {
+      key: "critic.timeoutMs",
+      aliases: [],
+      domain: "agent",
+      valueType: "int",
+      min: 1000,
+      max: 120000,
+      step: 1000,
+      reconfigure: true,
+      get: (c) => c.critic?.timeoutMs ?? DEFAULTS.critic.timeoutMs,
+      set: (c, v) => {
+        c.critic = { ...c.critic ?? DEFAULTS.critic, timeoutMs: v };
+      }
+    },
+    {
+      key: "logLevel",
+      aliases: [],
+      domain: "agent",
+      valueType: "enum",
+      enumValues: LOG_LEVELS,
+      reconfigure: false,
+      get: (c) => c.logLevel,
+      set: (c, v) => {
+        c.logLevel = String(v);
+      }
+    },
+    {
+      key: "locale",
+      aliases: [],
+      domain: "i18n",
+      valueType: "enum",
+      enumValues: LOCALES,
+      reconfigure: false,
+      get: (c) => c.locale,
+      set: (c, v) => {
+        c.locale = String(v);
+      }
+    },
+    {
+      key: "version",
+      aliases: [],
+      domain: "agent",
+      valueType: "string",
+      reconfigure: false,
+      readOnly: true,
+      get: () => readMmaVersion()
+    },
+    securityToggle("enabled", "security.enabled"),
+    securityToggle("bash", "security.bash.enabled"),
+    {
+      key: "security.bash.blockDangerousFlags",
+      aliases: [],
+      domain: "security",
+      valueType: "bool",
+      reconfigure: false,
+      get: (c) => c.security?.bash.blockDangerousFlags ?? true,
+      set: (c, v) => {
+        if (!c.security)
+          c.security = structuredClone(DEFAULT_SECURITY_CONFIG);
+        c.security.bash.blockDangerousFlags = v;
+      }
+    },
+    securityToggle("paths", "security.paths.enabled"),
+    securityToggle("contentScan", "security.contentScan.enabled"),
+    securityToggle("sessionEncryption", "security.sessionEncryption.enabled"),
+    securityToggle("network", "security.network.enabled"),
+    ...EXTRA_DEFS
+  ];
+  BY_NAME = new Map;
+  for (const def of DEFINITIONS) {
+    BY_NAME.set(def.key, def);
+    for (const alias of def.aliases)
+      BY_NAME.set(alias, def);
+  }
+});
+
 // node_modules/yaml/dist/nodes/identity.js
 var require_identity = __commonJS((exports) => {
   var ALIAS = Symbol.for("yaml.alias");
@@ -34032,16 +35503,16 @@ var require_Collection = __commonJS((exports) => {
 
 // node_modules/yaml/dist/stringify/stringifyComment.js
 var require_stringifyComment = __commonJS((exports) => {
-  var stringifyComment = (str) => str.replace(/^(?!$)(?: $)?/gm, "#");
+  var stringifyComment = (str2) => str2.replace(/^(?!$)(?: $)?/gm, "#");
   function indentComment(comment, indent) {
     if (/^\n+$/.test(comment))
       return comment.substring(1);
     return indent ? comment.replace(/^(?! *$)/gm, indent) : comment;
   }
-  var lineComment = (str, indent, comment) => str.endsWith(`
+  var lineComment = (str2, indent, comment) => str2.endsWith(`
 `) ? indentComment(comment, indent) : comment.includes(`
 `) ? `
-` + indentComment(comment, indent) : (str.endsWith(" ") ? "" : " ") + comment;
+` + indentComment(comment, indent) : (str2.endsWith(" ") ? "" : " ") + comment;
   exports.indentComment = indentComment;
   exports.lineComment = lineComment;
   exports.stringifyComment = stringifyComment;
@@ -34193,16 +35664,16 @@ var require_stringifyString = __commonJS((exports) => {
     lineWidth: ctx.options.lineWidth,
     minContentWidth: ctx.options.minContentWidth
   });
-  var containsDocumentMarker = (str) => /^(%|---|\.\.\.)/m.test(str);
-  function lineLengthOverLimit(str, lineWidth, indentLength) {
+  var containsDocumentMarker = (str2) => /^(%|---|\.\.\.)/m.test(str2);
+  function lineLengthOverLimit(str2, lineWidth, indentLength) {
     if (!lineWidth || lineWidth < 0)
       return false;
     const limit = lineWidth - indentLength;
-    const strLen = str.length;
+    const strLen = str2.length;
     if (strLen <= limit)
       return false;
     for (let i = 0, start = 0;i < strLen; ++i) {
-      if (str[i] === `
+      if (str2[i] === `
 `) {
         if (i - start > limit)
           return true;
@@ -34214,77 +35685,77 @@ var require_stringifyString = __commonJS((exports) => {
     return true;
   }
   function doubleQuotedString(value, ctx) {
-    const json = JSON.stringify(value);
+    const json2 = JSON.stringify(value);
     if (ctx.options.doubleQuotedAsJSON)
-      return json;
+      return json2;
     const { implicitKey } = ctx;
     const minMultiLineLength = ctx.options.doubleQuotedMinMultiLineLength;
     const indent = ctx.indent || (containsDocumentMarker(value) ? "  " : "");
-    let str = "";
+    let str2 = "";
     let start = 0;
-    for (let i = 0, ch = json[i];ch; ch = json[++i]) {
-      if (ch === " " && json[i + 1] === "\\" && json[i + 2] === "n") {
-        str += json.slice(start, i) + "\\ ";
+    for (let i = 0, ch = json2[i];ch; ch = json2[++i]) {
+      if (ch === " " && json2[i + 1] === "\\" && json2[i + 2] === "n") {
+        str2 += json2.slice(start, i) + "\\ ";
         i += 1;
         start = i;
         ch = "\\";
       }
       if (ch === "\\")
-        switch (json[i + 1]) {
+        switch (json2[i + 1]) {
           case "u":
             {
-              str += json.slice(start, i);
-              const code = json.substr(i + 2, 4);
+              str2 += json2.slice(start, i);
+              const code = json2.substr(i + 2, 4);
               switch (code) {
                 case "0000":
-                  str += "\\0";
+                  str2 += "\\0";
                   break;
                 case "0007":
-                  str += "\\a";
+                  str2 += "\\a";
                   break;
                 case "000b":
-                  str += "\\v";
+                  str2 += "\\v";
                   break;
                 case "001b":
-                  str += "\\e";
+                  str2 += "\\e";
                   break;
                 case "0085":
-                  str += "\\N";
+                  str2 += "\\N";
                   break;
                 case "00a0":
-                  str += "\\_";
+                  str2 += "\\_";
                   break;
                 case "2028":
-                  str += "\\L";
+                  str2 += "\\L";
                   break;
                 case "2029":
-                  str += "\\P";
+                  str2 += "\\P";
                   break;
                 default:
                   if (code.substr(0, 2) === "00")
-                    str += "\\x" + code.substr(2);
+                    str2 += "\\x" + code.substr(2);
                   else
-                    str += json.substr(i, 6);
+                    str2 += json2.substr(i, 6);
               }
               i += 5;
               start = i + 1;
             }
             break;
           case "n":
-            if (implicitKey || json[i + 2] === '"' || json.length < minMultiLineLength) {
+            if (implicitKey || json2[i + 2] === '"' || json2.length < minMultiLineLength) {
               i += 1;
             } else {
-              str += json.slice(start, i) + `
+              str2 += json2.slice(start, i) + `
 
 `;
-              while (json[i + 2] === "\\" && json[i + 3] === "n" && json[i + 4] !== '"') {
-                str += `
+              while (json2[i + 2] === "\\" && json2[i + 3] === "n" && json2[i + 4] !== '"') {
+                str2 += `
 `;
                 i += 2;
               }
-              str += indent;
-              if (json[i + 2] === " ")
-                str += "\\";
+              str2 += indent;
+              if (json2[i + 2] === " ")
+                str2 += "\\";
               i += 1;
               start = i + 1;
             }
@@ -34293,8 +35764,8 @@ var require_stringifyString = __commonJS((exports) => {
             i += 1;
         }
     }
-    str = start ? str + json.slice(start) : json;
-    return implicitKey ? str : foldFlowLines.foldFlowLines(str, indent, foldFlowLines.FOLD_QUOTED, getFoldOptions(ctx, false));
+    str2 = start ? str2 + json2.slice(start) : json2;
+    return implicitKey ? str2 : foldFlowLines.foldFlowLines(str2, indent, foldFlowLines.FOLD_QUOTED, getFoldOptions(ctx, false));
   }
   function singleQuotedString(value, ctx) {
     if (ctx.options.singleQuote === false || ctx.implicitKey && value.includes(`
@@ -34436,15 +35907,15 @@ ${indent}${start}${value}${end}`;
         return quotedString(value, ctx);
       }
     }
-    const str = value.replace(/\n+/g, `$&
+    const str2 = value.replace(/\n+/g, `$&
 ${indent}`);
     if (actualString) {
-      const test = (tag) => tag.default && tag.tag !== "tag:yaml.org,2002:str" && tag.test?.test(str);
+      const test = (tag) => tag.default && tag.tag !== "tag:yaml.org,2002:str" && tag.test?.test(str2);
       const { compat, tags } = ctx.doc.schema;
       if (tags.some(test) || compat?.some(test))
         return quotedString(value, ctx);
     }
-    return implicitKey ? str : foldFlowLines.foldFlowLines(str, indent, foldFlowLines.FOLD_FLOW, getFoldOptions(ctx, false));
+    return implicitKey ? str2 : foldFlowLines.foldFlowLines(str2, indent, foldFlowLines.FOLD_FLOW, getFoldOptions(ctx, false));
   }
   function stringifyString(item, ctx, onComment, onChompKeep) {
     const { implicitKey, inFlow } = ctx;
@@ -34593,11 +36064,11 @@ var require_stringify = __commonJS((exports) => {
     const props = stringifyProps(node, tagObj, ctx);
     if (props.length > 0)
       ctx.indentAtStart = (ctx.indentAtStart ?? 0) + props.length + 1;
-    const str = typeof tagObj.stringify === "function" ? tagObj.stringify(node, ctx, onComment, onChompKeep) : identity.isScalar(node) ? stringifyString.stringifyString(node, ctx, onComment, onChompKeep) : node.toString(ctx, onComment, onChompKeep);
+    const str2 = typeof tagObj.stringify === "function" ? tagObj.stringify(node, ctx, onComment, onChompKeep) : identity.isScalar(node) ? stringifyString.stringifyString(node, ctx, onComment, onChompKeep) : node.toString(ctx, onComment, onChompKeep);
     if (!props)
-      return str;
-    return identity.isScalar(node) || str[0] === "{" || str[0] === "[" ? `${props} ${str}` : `${props}
-${ctx.indent}${str}`;
+      return str2;
+    return identity.isScalar(node) || str2[0] === "{" || str2[0] === "[" ? `${props} ${str2}` : `${props}
+${ctx.indent}${str2}`;
   }
   exports.createStringifyContext = createStringifyContext;
   exports.stringify = stringify;
@@ -34629,8 +36100,8 @@ var require_stringifyPair = __commonJS((exports) => {
     });
     let keyCommentDone = false;
     let chompKeep = false;
-    let str = stringify.stringify(key, ctx, () => keyCommentDone = true, () => chompKeep = true);
-    if (!explicitKey && !ctx.inFlow && str.length > 1024) {
+    let str2 = stringify.stringify(key, ctx, () => keyCommentDone = true, () => chompKeep = true);
+    if (!explicitKey && !ctx.inFlow && str2.length > 1024) {
       if (simpleKeys)
         throw new Error("With simple keys, single line scalar must not span more than 1024 characters");
       explicitKey = true;
@@ -34639,27 +36110,27 @@ var require_stringifyPair = __commonJS((exports) => {
       if (allNullValues || value == null) {
         if (keyCommentDone && onComment)
           onComment();
-        return str === "" ? "?" : explicitKey ? `? ${str}` : str;
+        return str2 === "" ? "?" : explicitKey ? `? ${str2}` : str2;
       }
     } else if (allNullValues && !simpleKeys || value == null && explicitKey) {
-      str = `? ${str}`;
+      str2 = `? ${str2}`;
       if (keyComment && !keyCommentDone) {
-        str += stringifyComment.lineComment(str, ctx.indent, commentString(keyComment));
+        str2 += stringifyComment.lineComment(str2, ctx.indent, commentString(keyComment));
       } else if (chompKeep && onChompKeep)
         onChompKeep();
-      return str;
+      return str2;
     }
     if (keyCommentDone)
       keyComment = null;
     if (explicitKey) {
       if (keyComment)
-        str += stringifyComment.lineComment(str, ctx.indent, commentString(keyComment));
-      str = `? ${str}
+        str2 += stringifyComment.lineComment(str2, ctx.indent, commentString(keyComment));
+      str2 = `? ${str2}
 ${indent}:`;
     } else {
-      str = `${str}:`;
+      str2 = `${str2}:`;
       if (keyComment)
-        str += stringifyComment.lineComment(str, ctx.indent, commentString(keyComment));
+        str2 += stringifyComment.lineComment(str2, ctx.indent, commentString(keyComment));
     }
     let vsb, vcb, valueComment;
     if (identity.isNode(value)) {
@@ -34675,7 +36146,7 @@ ${indent}:`;
     }
     ctx.implicitKey = false;
     if (!explicitKey && !keyComment && identity.isScalar(value))
-      ctx.indentAtStart = str.length + 1;
+      ctx.indentAtStart = str2.length + 1;
     chompKeep = false;
     if (!indentSeq && indentStep.length >= 2 && !ctx.inFlow && !explicitKey && identity.isSeq(value) && !value.flow && !value.tag && !value.anchor) {
       ctx.indent = ctx.indent.substring(2);
@@ -34725,16 +36196,16 @@ ${ctx.indent}`;
 `) {
       ws = "";
     }
-    str += ws + valueStr;
+    str2 += ws + valueStr;
     if (ctx.inFlow) {
       if (valueCommentDone && onComment)
         onComment();
     } else if (valueComment && !valueCommentDone) {
-      str += stringifyComment.lineComment(str, ctx.indent, commentString(valueComment));
+      str2 += stringifyComment.lineComment(str2, ctx.indent, commentString(valueComment));
     } else if (chompKeep && onChompKeep) {
       onChompKeep();
     }
-    return str;
+    return str2;
   }
   exports.stringifyPair = stringifyPair;
 });
@@ -34947,33 +36418,33 @@ var require_stringifyCollection = __commonJS((exports) => {
         }
       }
       chompKeep = false;
-      let str2 = stringify.stringify(item, itemCtx, () => comment2 = null, () => chompKeep = true);
+      let str3 = stringify.stringify(item, itemCtx, () => comment2 = null, () => chompKeep = true);
       if (comment2)
-        str2 += stringifyComment.lineComment(str2, itemIndent, commentString(comment2));
+        str3 += stringifyComment.lineComment(str3, itemIndent, commentString(comment2));
       if (chompKeep && comment2)
         chompKeep = false;
-      lines.push(blockItemPrefix + str2);
+      lines.push(blockItemPrefix + str3);
     }
-    let str;
+    let str2;
     if (lines.length === 0) {
-      str = flowChars.start + flowChars.end;
+      str2 = flowChars.start + flowChars.end;
     } else {
-      str = lines[0];
+      str2 = lines[0];
       for (let i = 1;i < lines.length; ++i) {
         const line = lines[i];
-        str += line ? `
+        str2 += line ? `
 ${indent}${line}` : `
 `;
       }
     }
     if (comment) {
-      str += `
+      str2 += `
 ` + stringifyComment.indentComment(commentString(comment), indent);
       if (onComment)
         onComment();
     } else if (chompKeep && onChompKeep)
       onChompKeep();
-    return str;
+    return str2;
   }
   function stringifyFlowCollection({ items }, ctx, { flowChars, itemIndent }) {
     const { indent, indentStep, flowCollectionPadding: fcPadding, options: { commentString } } = ctx;
@@ -35016,22 +36487,22 @@ ${indent}${line}` : `
       }
       if (comment)
         reqNewline = true;
-      let str = stringify.stringify(item, itemCtx, () => comment = null);
-      reqNewline || (reqNewline = lines.length > linesAtValue || str.includes(`
+      let str2 = stringify.stringify(item, itemCtx, () => comment = null);
+      reqNewline || (reqNewline = lines.length > linesAtValue || str2.includes(`
 `));
       if (i < items.length - 1) {
-        str += ",";
+        str2 += ",";
       } else if (ctx.options.trailingComma) {
         if (ctx.options.lineWidth > 0) {
-          reqNewline || (reqNewline = lines.reduce((sum, line) => sum + line.length + 2, 2) + (str.length + 2) > ctx.options.lineWidth);
+          reqNewline || (reqNewline = lines.reduce((sum, line) => sum + line.length + 2, 2) + (str2.length + 2) > ctx.options.lineWidth);
         }
         if (reqNewline) {
-          str += ",";
+          str2 += ",";
         }
       }
       if (comment)
-        str += stringifyComment.lineComment(str, itemIndent, commentString(comment));
-      lines.push(str);
+        str2 += stringifyComment.lineComment(str2, itemIndent, commentString(comment));
+      lines.push(str2);
       linesAtValue = lines.length;
     }
     const { start, end } = flowChars;
@@ -35043,12 +36514,12 @@ ${indent}${line}` : `
         reqNewline = ctx.options.lineWidth > 0 && len > ctx.options.lineWidth;
       }
       if (reqNewline) {
-        let str = start;
+        let str2 = start;
         for (const line of lines)
-          str += line ? `
+          str2 += line ? `
 ${indentStep}${indent}${line}` : `
 `;
-        return `${str}
+        return `${str2}
 ${indent}${end}`;
       } else {
         return `${start}${fcPadding}${lines.join(" ")}${fcPadding}${end}`;
@@ -35331,7 +36802,7 @@ var require_string = __commonJS((exports) => {
     identify: (value) => typeof value === "string",
     default: true,
     tag: "tag:yaml.org,2002:str",
-    resolve: (str) => str,
+    resolve: (str2) => str2,
     stringify(item, ctx, onComment, onChompKeep) {
       ctx = Object.assign({ actualString: true }, ctx);
       return stringifyString.stringifyString(item, ctx, onComment, onChompKeep);
@@ -35363,7 +36834,7 @@ var require_bool = __commonJS((exports) => {
     default: true,
     tag: "tag:yaml.org,2002:bool",
     test: /^(?:[Tt]rue|TRUE|[Ff]alse|FALSE)$/,
-    resolve: (str) => new Scalar.Scalar(str[0] === "t" || str[0] === "T"),
+    resolve: (str2) => new Scalar.Scalar(str2[0] === "t" || str2[0] === "T"),
     stringify({ source, value }, ctx) {
       if (source && boolTag.test.test(source)) {
         const sv = source[0] === "t" || source[0] === "T";
@@ -35409,7 +36880,7 @@ var require_float = __commonJS((exports) => {
     default: true,
     tag: "tag:yaml.org,2002:float",
     test: /^(?:[-+]?\.(?:inf|Inf|INF)|\.nan|\.NaN|\.NAN)$/,
-    resolve: (str) => str.slice(-3).toLowerCase() === "nan" ? NaN : str[0] === "-" ? Number.NEGATIVE_INFINITY : Number.POSITIVE_INFINITY,
+    resolve: (str2) => str2.slice(-3).toLowerCase() === "nan" ? NaN : str2[0] === "-" ? Number.NEGATIVE_INFINITY : Number.POSITIVE_INFINITY,
     stringify: stringifyNumber.stringifyNumber
   };
   var floatExp = {
@@ -35418,7 +36889,7 @@ var require_float = __commonJS((exports) => {
     tag: "tag:yaml.org,2002:float",
     format: "EXP",
     test: /^[-+]?(?:\.[0-9]+|[0-9]+(?:\.[0-9]*)?)[eE][-+]?[0-9]+$/,
-    resolve: (str) => parseFloat(str),
+    resolve: (str2) => parseFloat(str2),
     stringify(node) {
       const num3 = Number(node.value);
       return isFinite(num3) ? num3.toExponential() : stringifyNumber.stringifyNumber(node);
@@ -35429,11 +36900,11 @@ var require_float = __commonJS((exports) => {
     default: true,
     tag: "tag:yaml.org,2002:float",
     test: /^[-+]?(?:\.[0-9]+|[0-9]+\.[0-9]*)$/,
-    resolve(str) {
-      const node = new Scalar.Scalar(parseFloat(str));
-      const dot = str.indexOf(".");
-      if (dot !== -1 && str[str.length - 1] === "0")
-        node.minFractionDigits = str.length - dot - 1;
+    resolve(str2) {
+      const node = new Scalar.Scalar(parseFloat(str2));
+      const dot = str2.indexOf(".");
+      if (dot !== -1 && str2[str2.length - 1] === "0")
+        node.minFractionDigits = str2.length - dot - 1;
       return node;
     },
     stringify: stringifyNumber.stringifyNumber
@@ -35447,7 +36918,7 @@ var require_float = __commonJS((exports) => {
 var require_int = __commonJS((exports) => {
   var stringifyNumber = require_stringifyNumber();
   var intIdentify = (value) => typeof value === "bigint" || Number.isInteger(value);
-  var intResolve = (str, offset, radix, { intAsBigInt }) => intAsBigInt ? BigInt(str) : parseInt(str.substring(offset), radix);
+  var intResolve = (str2, offset, radix, { intAsBigInt }) => intAsBigInt ? BigInt(str2) : parseInt(str2.substring(offset), radix);
   function intStringify(node, radix, prefix) {
     const { value } = node;
     if (intIdentify(value) && value >= 0)
@@ -35460,15 +36931,15 @@ var require_int = __commonJS((exports) => {
     tag: "tag:yaml.org,2002:int",
     format: "OCT",
     test: /^0o[0-7]+$/,
-    resolve: (str, _onError, opt) => intResolve(str, 2, 8, opt),
+    resolve: (str2, _onError, opt) => intResolve(str2, 2, 8, opt),
     stringify: (node) => intStringify(node, 8, "0o")
   };
-  var int = {
+  var int2 = {
     identify: intIdentify,
     default: true,
     tag: "tag:yaml.org,2002:int",
     test: /^[-+]?[0-9]+$/,
-    resolve: (str, _onError, opt) => intResolve(str, 0, 10, opt),
+    resolve: (str2, _onError, opt) => intResolve(str2, 0, 10, opt),
     stringify: stringifyNumber.stringifyNumber
   };
   var intHex = {
@@ -35477,10 +36948,10 @@ var require_int = __commonJS((exports) => {
     tag: "tag:yaml.org,2002:int",
     format: "HEX",
     test: /^0x[0-9a-fA-F]+$/,
-    resolve: (str, _onError, opt) => intResolve(str, 2, 16, opt),
+    resolve: (str2, _onError, opt) => intResolve(str2, 2, 16, opt),
     stringify: (node) => intStringify(node, 16, "0x")
   };
-  exports.int = int;
+  exports.int = int2;
   exports.intHex = intHex;
   exports.intOct = intOct;
 });
@@ -35491,18 +36962,18 @@ var require_schema = __commonJS((exports) => {
   var _null = require_null();
   var seq2 = require_seq();
   var string = require_string();
-  var bool = require_bool();
+  var bool2 = require_bool();
   var float = require_float();
-  var int = require_int();
+  var int2 = require_int();
   var schema = [
     map.map,
     seq2.seq,
     string.string,
     _null.nullTag,
-    bool.boolTag,
-    int.intOct,
-    int.int,
-    int.intHex,
+    bool2.boolTag,
+    int2.intOct,
+    int2.int,
+    int2.intHex,
     float.floatNaN,
     float.floatExp,
     float.float
@@ -35524,7 +36995,7 @@ var require_schema2 = __commonJS((exports) => {
       identify: (value) => typeof value === "string",
       default: true,
       tag: "tag:yaml.org,2002:str",
-      resolve: (str) => str,
+      resolve: (str2) => str2,
       stringify: stringifyJSON
     },
     {
@@ -35541,7 +37012,7 @@ var require_schema2 = __commonJS((exports) => {
       default: true,
       tag: "tag:yaml.org,2002:bool",
       test: /^true$|^false$/,
-      resolve: (str) => str === "true",
+      resolve: (str2) => str2 === "true",
       stringify: stringifyJSON
     },
     {
@@ -35549,7 +37020,7 @@ var require_schema2 = __commonJS((exports) => {
       default: true,
       tag: "tag:yaml.org,2002:int",
       test: /^-?(?:0|[1-9][0-9]*)$/,
-      resolve: (str, _onError, { intAsBigInt }) => intAsBigInt ? BigInt(str) : parseInt(str, 10),
+      resolve: (str2, _onError, { intAsBigInt }) => intAsBigInt ? BigInt(str2) : parseInt(str2, 10),
       stringify: ({ value }) => intIdentify(value) ? value.toString() : JSON.stringify(value)
     },
     {
@@ -35557,7 +37028,7 @@ var require_schema2 = __commonJS((exports) => {
       default: true,
       tag: "tag:yaml.org,2002:float",
       test: /^-?(?:0|[1-9][0-9]*)(?:\.[0-9]*)?(?:[eE][-+]?[0-9]+)?$/,
-      resolve: (str) => parseFloat(str),
+      resolve: (str2) => parseFloat(str2),
       stringify: stringifyJSON
     }
   ];
@@ -35565,9 +37036,9 @@ var require_schema2 = __commonJS((exports) => {
     default: true,
     tag: "",
     test: /^/,
-    resolve(str, onError) {
-      onError(`Unresolved plain scalar ${JSON.stringify(str)}`);
-      return str;
+    resolve(str2, onError) {
+      onError(`Unresolved plain scalar ${JSON.stringify(str2)}`);
+      return str2;
     }
   };
   var schema = [map.map, seq2.seq].concat(jsonScalars, jsonError);
@@ -35587,10 +37058,10 @@ var require_binary = __commonJS((exports) => {
       if (typeof node_buffer.Buffer === "function") {
         return node_buffer.Buffer.from(src, "base64");
       } else if (typeof atob === "function") {
-        const str = atob(src.replace(/[\n\r]/g, ""));
-        const buffer = new Uint8Array(str.length);
-        for (let i = 0;i < str.length; ++i)
-          buffer[i] = str.charCodeAt(i);
+        const str2 = atob(src.replace(/[\n\r]/g, ""));
+        const buffer = new Uint8Array(str2.length);
+        for (let i = 0;i < str2.length; ++i)
+          buffer[i] = str2.charCodeAt(i);
         return buffer;
       } else {
         onError("This environment does not support reading binary tags; either Buffer or atob is required");
@@ -35601,29 +37072,29 @@ var require_binary = __commonJS((exports) => {
       if (!value)
         return "";
       const buf = value;
-      let str;
+      let str2;
       if (typeof node_buffer.Buffer === "function") {
-        str = buf instanceof node_buffer.Buffer ? buf.toString("base64") : node_buffer.Buffer.from(buf.buffer).toString("base64");
+        str2 = buf instanceof node_buffer.Buffer ? buf.toString("base64") : node_buffer.Buffer.from(buf.buffer).toString("base64");
       } else if (typeof btoa === "function") {
         let s = "";
         for (let i = 0;i < buf.length; ++i)
           s += String.fromCharCode(buf[i]);
-        str = btoa(s);
+        str2 = btoa(s);
       } else {
         throw new Error("This environment does not support writing binary tags; either Buffer or btoa is required");
       }
       type2 ?? (type2 = Scalar.Scalar.BLOCK_LITERAL);
       if (type2 !== Scalar.Scalar.QUOTE_DOUBLE) {
         const lineWidth = Math.max(ctx.options.lineWidth - ctx.indent.length, ctx.options.minContentWidth);
-        const n = Math.ceil(str.length / lineWidth);
+        const n = Math.ceil(str2.length / lineWidth);
         const lines = new Array(n);
         for (let i = 0, o = 0;i < n; ++i, o += lineWidth) {
-          lines[i] = str.substr(o, lineWidth);
+          lines[i] = str2.substr(o, lineWidth);
         }
-        str = lines.join(type2 === Scalar.Scalar.BLOCK_LITERAL ? `
+        str2 = lines.join(type2 === Scalar.Scalar.BLOCK_LITERAL ? `
 ` : " ");
       }
-      return stringifyString.stringifyString({ comment, type: type2, value: str }, ctx, onComment, onChompKeep);
+      return stringifyString.stringifyString({ comment, type: type2, value: str2 }, ctx, onComment, onChompKeep);
     }
   };
   exports.binary = binary;
@@ -35814,7 +37285,7 @@ var require_float2 = __commonJS((exports) => {
     default: true,
     tag: "tag:yaml.org,2002:float",
     test: /^(?:[-+]?\.(?:inf|Inf|INF)|\.nan|\.NaN|\.NAN)$/,
-    resolve: (str) => str.slice(-3).toLowerCase() === "nan" ? NaN : str[0] === "-" ? Number.NEGATIVE_INFINITY : Number.POSITIVE_INFINITY,
+    resolve: (str2) => str2.slice(-3).toLowerCase() === "nan" ? NaN : str2[0] === "-" ? Number.NEGATIVE_INFINITY : Number.POSITIVE_INFINITY,
     stringify: stringifyNumber.stringifyNumber
   };
   var floatExp = {
@@ -35823,7 +37294,7 @@ var require_float2 = __commonJS((exports) => {
     tag: "tag:yaml.org,2002:float",
     format: "EXP",
     test: /^[-+]?(?:[0-9][0-9_]*)?(?:\.[0-9_]*)?[eE][-+]?[0-9]+$/,
-    resolve: (str) => parseFloat(str.replace(/_/g, "")),
+    resolve: (str2) => parseFloat(str2.replace(/_/g, "")),
     stringify(node) {
       const num3 = Number(node.value);
       return isFinite(num3) ? num3.toExponential() : stringifyNumber.stringifyNumber(node);
@@ -35834,11 +37305,11 @@ var require_float2 = __commonJS((exports) => {
     default: true,
     tag: "tag:yaml.org,2002:float",
     test: /^[-+]?(?:[0-9][0-9_]*)?\.[0-9_]*$/,
-    resolve(str) {
-      const node = new Scalar.Scalar(parseFloat(str.replace(/_/g, "")));
-      const dot = str.indexOf(".");
+    resolve(str2) {
+      const node = new Scalar.Scalar(parseFloat(str2.replace(/_/g, "")));
+      const dot = str2.indexOf(".");
       if (dot !== -1) {
-        const f = str.substring(dot + 1).replace(/_/g, "");
+        const f = str2.substring(dot + 1).replace(/_/g, "");
         if (f[f.length - 1] === "0")
           node.minFractionDigits = f.length;
       }
@@ -35855,34 +37326,34 @@ var require_float2 = __commonJS((exports) => {
 var require_int2 = __commonJS((exports) => {
   var stringifyNumber = require_stringifyNumber();
   var intIdentify = (value) => typeof value === "bigint" || Number.isInteger(value);
-  function intResolve(str, offset, radix, { intAsBigInt }) {
-    const sign = str[0];
+  function intResolve(str2, offset, radix, { intAsBigInt }) {
+    const sign = str2[0];
     if (sign === "-" || sign === "+")
       offset += 1;
-    str = str.substring(offset).replace(/_/g, "");
+    str2 = str2.substring(offset).replace(/_/g, "");
     if (intAsBigInt) {
       switch (radix) {
         case 2:
-          str = `0b${str}`;
+          str2 = `0b${str2}`;
           break;
         case 8:
-          str = `0o${str}`;
+          str2 = `0o${str2}`;
           break;
         case 16:
-          str = `0x${str}`;
+          str2 = `0x${str2}`;
           break;
       }
-      const n2 = BigInt(str);
+      const n2 = BigInt(str2);
       return sign === "-" ? BigInt(-1) * n2 : n2;
     }
-    const n = parseInt(str, radix);
+    const n = parseInt(str2, radix);
     return sign === "-" ? -1 * n : n;
   }
   function intStringify(node, radix, prefix) {
     const { value } = node;
     if (intIdentify(value)) {
-      const str = value.toString(radix);
-      return value < 0 ? "-" + prefix + str.substr(1) : prefix + str;
+      const str2 = value.toString(radix);
+      return value < 0 ? "-" + prefix + str2.substr(1) : prefix + str2;
     }
     return stringifyNumber.stringifyNumber(node);
   }
@@ -35892,7 +37363,7 @@ var require_int2 = __commonJS((exports) => {
     tag: "tag:yaml.org,2002:int",
     format: "BIN",
     test: /^[-+]?0b[0-1_]+$/,
-    resolve: (str, _onError, opt) => intResolve(str, 2, 2, opt),
+    resolve: (str2, _onError, opt) => intResolve(str2, 2, 2, opt),
     stringify: (node) => intStringify(node, 2, "0b")
   };
   var intOct = {
@@ -35901,15 +37372,15 @@ var require_int2 = __commonJS((exports) => {
     tag: "tag:yaml.org,2002:int",
     format: "OCT",
     test: /^[-+]?0[0-7_]+$/,
-    resolve: (str, _onError, opt) => intResolve(str, 1, 8, opt),
+    resolve: (str2, _onError, opt) => intResolve(str2, 1, 8, opt),
     stringify: (node) => intStringify(node, 8, "0")
   };
-  var int = {
+  var int2 = {
     identify: intIdentify,
     default: true,
     tag: "tag:yaml.org,2002:int",
     test: /^[-+]?[0-9][0-9_]*$/,
-    resolve: (str, _onError, opt) => intResolve(str, 0, 10, opt),
+    resolve: (str2, _onError, opt) => intResolve(str2, 0, 10, opt),
     stringify: stringifyNumber.stringifyNumber
   };
   var intHex = {
@@ -35918,10 +37389,10 @@ var require_int2 = __commonJS((exports) => {
     tag: "tag:yaml.org,2002:int",
     format: "HEX",
     test: /^[-+]?0x[0-9a-fA-F_]+$/,
-    resolve: (str, _onError, opt) => intResolve(str, 2, 16, opt),
+    resolve: (str2, _onError, opt) => intResolve(str2, 2, 16, opt),
     stringify: (node) => intStringify(node, 16, "0x")
   };
-  exports.int = int;
+  exports.int = int2;
   exports.intBin = intBin;
   exports.intHex = intHex;
   exports.intOct = intOct;
@@ -36013,9 +37484,9 @@ var require_set = __commonJS((exports) => {
 // node_modules/yaml/dist/schema/yaml-1.1/timestamp.js
 var require_timestamp = __commonJS((exports) => {
   var stringifyNumber = require_stringifyNumber();
-  function parseSexagesimal(str, asBigInt) {
-    const sign = str[0];
-    const parts = sign === "-" || sign === "+" ? str.substring(1) : str;
+  function parseSexagesimal(str2, asBigInt) {
+    const sign = str2[0];
+    const parts = sign === "-" || sign === "+" ? str2.substring(1) : str2;
     const num3 = (n) => asBigInt ? BigInt(n) : Number(n);
     const res = parts.replace(/_/g, "").split(":").reduce((res2, p) => res2 * num3(60) + num3(p), num3(0));
     return sign === "-" ? num3(-1) * res : res;
@@ -36052,7 +37523,7 @@ var require_timestamp = __commonJS((exports) => {
     tag: "tag:yaml.org,2002:int",
     format: "TIME",
     test: /^[-+]?[0-9][0-9_]*(?::[0-5]?[0-9])+$/,
-    resolve: (str, _onError, { intAsBigInt }) => parseSexagesimal(str, intAsBigInt),
+    resolve: (str2, _onError, { intAsBigInt }) => parseSexagesimal(str2, intAsBigInt),
     stringify: stringifySexagesimal
   };
   var floatTime = {
@@ -36061,7 +37532,7 @@ var require_timestamp = __commonJS((exports) => {
     tag: "tag:yaml.org,2002:float",
     format: "TIME",
     test: /^[-+]?[0-9][0-9_]*(?::[0-5]?[0-9])+\.[0-9_]*$/,
-    resolve: (str) => parseSexagesimal(str, false),
+    resolve: (str2) => parseSexagesimal(str2, false),
     stringify: stringifySexagesimal
   };
   var timestamp = {
@@ -36069,8 +37540,8 @@ var require_timestamp = __commonJS((exports) => {
     default: true,
     tag: "tag:yaml.org,2002:timestamp",
     test: RegExp("^([0-9]{4})-([0-9]{1,2})-([0-9]{1,2})" + "(?:" + "(?:t|T|[ \\t]+)" + "([0-9]{1,2}):([0-9]{1,2}):([0-9]{1,2}(\\.[0-9]+)?)" + "(?:[ \\t]*(Z|[-+][012]?[0-9](?::[0-9]{2})?))?" + ")?$"),
-    resolve(str) {
-      const match = str.match(timestamp.test);
+    resolve(str2) {
+      const match = str2.match(timestamp.test);
       if (!match)
         throw new Error("!!timestamp expects a date, starting with yyyy-mm-dd");
       const [, year, month, day, hour, minute, second] = match.map(Number);
@@ -36099,9 +37570,9 @@ var require_schema3 = __commonJS((exports) => {
   var seq2 = require_seq();
   var string = require_string();
   var binary = require_binary();
-  var bool = require_bool2();
+  var bool2 = require_bool2();
   var float = require_float2();
-  var int = require_int2();
+  var int2 = require_int2();
   var merge = require_merge();
   var omap = require_omap();
   var pairs = require_pairs();
@@ -36112,12 +37583,12 @@ var require_schema3 = __commonJS((exports) => {
     seq2.seq,
     string.string,
     _null.nullTag,
-    bool.trueTag,
-    bool.falseTag,
-    int.intBin,
-    int.intOct,
-    int.int,
-    int.intHex,
+    bool2.trueTag,
+    bool2.falseTag,
+    int2.intBin,
+    int2.intOct,
+    int2.int,
+    int2.intHex,
     float.floatNaN,
     float.floatExp,
     float.float,
@@ -36139,9 +37610,9 @@ var require_tags = __commonJS((exports) => {
   var _null = require_null();
   var seq2 = require_seq();
   var string = require_string();
-  var bool = require_bool();
+  var bool2 = require_bool();
   var float = require_float();
-  var int = require_int();
+  var int2 = require_int();
   var schema = require_schema();
   var schema$1 = require_schema2();
   var binary = require_binary();
@@ -36160,14 +37631,14 @@ var require_tags = __commonJS((exports) => {
   ]);
   var tagsByName = {
     binary: binary.binary,
-    bool: bool.boolTag,
+    bool: bool2.boolTag,
     float: float.float,
     floatExp: float.floatExp,
     floatNaN: float.floatNaN,
     floatTime: timestamp.floatTime,
-    int: int.int,
-    intHex: int.intHex,
-    intOct: int.intOct,
+    int: int2.int,
+    intHex: int2.intHex,
+    intOct: int2.intOct,
     intTime: timestamp.intTime,
     map: map.map,
     merge: merge.merge,
@@ -36533,11 +38004,11 @@ var require_Document = __commonJS((exports) => {
       else
         throw new Error(`With a null YAML version, the { schema: Schema } option is required`);
     }
-    toJS({ json, jsonArg, mapAsMap, maxAliasCount, onAnchor, reviver } = {}) {
+    toJS({ json: json2, jsonArg, mapAsMap, maxAliasCount, onAnchor, reviver } = {}) {
       const ctx = {
         anchors: new Map,
         doc: this,
-        keep: !json,
+        keep: !json2,
         mapAsMap: mapAsMap === true,
         mapKeyWarned: false,
         maxAliasCount: typeof maxAliasCount === "number" ? maxAliasCount : 100
@@ -39167,15 +40638,15 @@ var require_parser = __commonJS((exports) => {
   var node_process = __require("process");
   var cst = require_cst();
   var lexer = require_lexer();
-  function includesToken(list, type2) {
-    for (let i = 0;i < list.length; ++i)
-      if (list[i].type === type2)
+  function includesToken(list2, type2) {
+    for (let i = 0;i < list2.length; ++i)
+      if (list2[i].type === type2)
         return true;
     return false;
   }
-  function findNonEmptyIndex(list) {
-    for (let i = 0;i < list.length; ++i) {
-      switch (list[i].type) {
+  function findNonEmptyIndex(list2) {
+    for (let i = 0;i < list2.length; ++i) {
+      switch (list2[i].type) {
         case "space":
         case "comment":
         case "newline":
@@ -41302,508 +42773,86 @@ async function certList(projectDir) {
     return;
   }
   for (const e of m.certifications) {
-    const mark = isFullyPassed(e) ? pc.green("✔") : pc.red("✘");
-    getDefaultChannel().writeLine(`  ${mark} ${e.model}  ${pc.dim(e.providerUrl)}  ${e.mmaVersion}  ${e.certifiedAt.slice(0, 10)}  ${e.suite.passed}/${e.suite.total} pass`);
-  }
-}
-async function uncertify(name, config, projectDir) {
-  const removed = removeCertification(name, config.provider.baseUrl, {
-    projectDir
-  });
-  if (removed.global || removed.project)
-    getDefaultChannel().writeLine(t("cli.cert_uncertified", { model: name }));
-  else
-    getDefaultChannel().writeLine(t("cli.cert_not_found", { model: name }));
-}
-function summarize(results) {
-  return {
-    passed: results.filter((r) => r.status === "pass").length,
-    failed: results.filter((r) => r.status === "fail").length,
-    skipped: results.filter((r) => r.status === "skipped").length,
-    total: results.length
-  };
-}
-function mergePartialResults(fresh, previous, rerunIds) {
-  const preserved = previous.filter((r) => !rerunIds.has(r.id));
-  if (preserved.length > 0) {
-    getDefaultChannel().writeLine(pc.dim(t("cli.cert_partial_merge", { kept: String(preserved.length) })));
-  }
-  return [...fresh, ...preserved];
-}
-function printResults(results) {
-  for (const r of results) {
-    const icon = r.status === "pass" ? pc.green("✔") : r.status === "fail" ? pc.red("✘") : r.status === "skipped" ? pc.dim("–") : pc.yellow("!");
-    const detail = r.status === "skipped" ? pc.dim(r.title) : `${r.passed}/${r.of}`;
-    getDefaultChannel().writeLine(`  ${icon} ${r.id}  ${detail}`);
-    if (r.error)
-      getDefaultChannel().writeLine(`    ${pc.dim(r.error)}`);
-    if (r.diagnostics)
-      getDefaultChannel().writeLine(r.diagnostics);
-  }
-}
-function writeReport(entry, projectDir) {
-  const reportDir = join49(projectDir, "certification");
-  const ts = entry.certifiedAt.replace(/[:.]/g, "-").slice(0, 19);
-  const filename = `report-${entry.model.replace(/[/\\:]/g, "_")}-${ts}.json`;
-  const reportPath = join49(reportDir, filename);
-  const report = {
-    model: entry.model,
-    providerUrl: entry.providerUrl,
-    mmaVersion: entry.mmaVersion,
-    certifiedAt: entry.certifiedAt,
-    certified: isFullyPassed(entry),
-    suite: entry.suite,
-    results: entry.results.map((r) => ({
-      id: r.id,
-      title: r.title,
-      status: r.status,
-      passed: r.passed,
-      of: r.of,
-      error: r.error,
-      diagnostics: r.diagnostics
-    }))
-  };
-  try {
-    writeFileSync23(reportPath, JSON.stringify(report, null, 2), "utf-8");
-    getDefaultChannel().writeLine(pc.dim(`
-Report: ${reportPath}`));
-  } catch (e) {
-    getDefaultChannel().writeLine(pc.yellow(`  Failed to write report: ${e.message}`), "stderr");
-  }
-}
-var HERE, MMA_ROOT;
-var init_cli = __esm(() => {
-  init_paths();
-  init_i18n();
-  init_colors();
-  init_loader3();
-  init_runner2();
-  init_manifest();
-  init_output();
-  HERE = dirname24(fileURLToPath5(import.meta.url));
-  MMA_ROOT = findMmaRoot(HERE);
-});
-
-// src/config/registry.ts
-function shareField(key, canonical) {
-  const field = key === "system" ? "systemPrompt" : "responseReserve";
-  const other = key === "system" ? "responseReserve" : "systemPrompt";
-  return {
-    key: canonical,
-    aliases: [`context.${key}`],
-    domain: "budget",
-    valueType: "share",
-    min: MIN_SHARE2,
-    max: MAX_SHARE2,
-    step: 0.01,
-    reconfigure: true,
-    get: (c) => c.contextBudget[field],
-    set: (c, v) => setBudgetShare(c, key, v),
-    extraValidate: (c, v) => {
-      const n = v;
-      const total = n + c.contextBudget[other];
-      return total > MAX_COMBINED2 ? "combined" : null;
-    }
-  };
-}
-function securityToggle(field, canonical) {
-  return {
-    key: canonical,
-    aliases: [],
-    domain: "security",
-    valueType: "bool",
-    reconfigure: false,
-    get: (c) => {
-      const sec = c.security;
-      if (!sec)
-        return false;
-      return field === "enabled" ? sec.enabled : sec[field].enabled;
-    },
-    set: (c, v) => {
-      if (!c.security)
-        c.security = structuredClone(DEFAULT_SECURITY_CONFIG);
-      if (field === "enabled")
-        c.security.enabled = v;
-      else
-        c.security[field].enabled = v;
-    }
-  };
-}
-function resolveConfigKey(name) {
-  return BY_NAME.get(name) ?? null;
-}
-function configDefs() {
-  return DEFINITIONS;
-}
-function canonicalKeys() {
-  return DEFINITIONS.map((d) => d.key);
-}
-function keysForGroup(prefix) {
-  return DEFINITIONS.filter((d) => d.key.startsWith(`${prefix}.`));
-}
-function allConfigNames() {
-  const out = [];
-  for (const def of DEFINITIONS) {
-    out.push({ name: def.key, def, alias: false });
-    for (const a of def.aliases)
-      out.push({ name: a, def, alias: true });
-  }
-  return out;
-}
-function formatConfigValue(value) {
-  if (typeof value === "boolean")
-    return value ? "on" : "off";
-  return String(value);
-}
-function parseBool(raw) {
-  const v = raw.trim().toLowerCase();
-  if (["on", "true", "1", "yes", "y", "enable", "enabled"].includes(v))
-    return { ok: true, value: true };
-  if (["off", "false", "0", "no", "n", "disable", "disabled"].includes(v))
-    return { ok: true, value: false };
-  return { ok: false, reason: "invalid" };
-}
-function parseConfigValue(def, raw) {
-  const trimmed = raw.trim();
-  switch (def.valueType) {
-    case "string":
-      return trimmed.length > 0 ? { ok: true, value: trimmed } : { ok: false, reason: "invalid" };
-    case "bool":
-      return parseBool(trimmed);
-    case "enum": {
-      const v = trimmed.toLowerCase();
-      if (def.enumValues && !def.enumValues.includes(v))
-        return { ok: false, reason: "invalid" };
-      return { ok: true, value: v };
-    }
-    case "int": {
-      if (!/^-?\d+$/.test(trimmed))
-        return { ok: false, reason: "invalid" };
-      const n = Number(trimmed);
-      if (!Number.isFinite(n))
-        return { ok: false, reason: "invalid" };
-      if (def.min !== undefined && n < def.min)
-        return { ok: false, reason: "invalid" };
-      if (def.max !== undefined && n > def.max)
-        return { ok: false, reason: "invalid" };
-      return { ok: true, value: n };
-    }
-    case "share": {
-      const isPct = trimmed.endsWith("%");
-      const body = isPct ? trimmed.slice(0, -1).trim() : trimmed;
-      if (!/^-?\d+(\.\d+)?$/.test(body))
-        return { ok: false, reason: "invalid" };
-      let n = Number(body);
-      if (isPct)
-        n = n / 100;
-      if (!Number.isFinite(n) || n < MIN_SHARE2 || n > MAX_SHARE2)
-        return { ok: false, reason: "invalid" };
-      return { ok: true, value: n };
-    }
-  }
-}
-function getConfigValue(config, name) {
-  const def = resolveConfigKey(name);
-  if (!def)
-    return { ok: false, reason: "unknown-key", input: name };
-  const value = def.get(config);
-  return { ok: true, key: def.key, def, value, display: formatConfigValue(value) };
-}
-function applyProviderModelMemory(config, key, value) {
-  const provider = config.provider;
-  const activeName = provider.active ?? provider.type;
-  if (key === "model") {
-    if (!activeName)
-      return;
-    provider.models = { ...provider.models ?? {}, [activeName]: String(value) };
-    return;
-  }
-  if (key === "provider.active") {
-    const remembered = provider.models?.[String(value)];
-    if (remembered)
-      config.model = remembered;
-  }
-}
-function setConfigValue(config, name, raw) {
-  const def = resolveConfigKey(name);
-  if (!def)
-    return { ok: false, reason: "unknown-key", input: name };
-  if (def.readOnly)
-    return { ok: false, reason: "read-only", input: name, key: def.key, def };
-  const parsed = parseConfigValue(def, raw);
-  if (!parsed.ok)
-    return { ok: false, reason: "invalid-value", input: name, key: def.key, def };
-  const extra = def.extraValidate?.(config, parsed.value);
-  if (extra)
-    return { ok: false, reason: extra, input: name, key: def.key, def };
-  def.set(config, parsed.value);
-  applyProviderModelMemory(config, def.key, parsed.value);
+    const mark = isFullyPassed(e) ? pc.green("✔") : pc.red("✘");
+    getDefaultChannel().writeLine(`  ${mark} ${e.model}  ${pc.dim(e.providerUrl)}  ${e.mmaVersion}  ${e.certifiedAt.slice(0, 10)}  ${e.suite.passed}/${e.suite.total} pass`);
+  }
+}
+async function uncertify(name, config, projectDir) {
+  const removed = removeCertification(name, config.provider.baseUrl, {
+    projectDir
+  });
+  if (removed.global || removed.project)
+    getDefaultChannel().writeLine(t("cli.cert_uncertified", { model: name }));
+  else
+    getDefaultChannel().writeLine(t("cli.cert_not_found", { model: name }));
+}
+function summarize(results) {
   return {
-    ok: true,
-    key: def.key,
-    def,
-    value: parsed.value,
-    display: formatConfigValue(parsed.value),
-    reconfigure: def.reconfigure,
-    reasoningChanged: def.key === "reasoning.mode"
+    passed: results.filter((r) => r.status === "pass").length,
+    failed: results.filter((r) => r.status === "fail").length,
+    skipped: results.filter((r) => r.status === "skipped").length,
+    total: results.length
   };
 }
-function captureConfigSnapshot(config) {
-  const snapshot = new Map;
-  for (const def of DEFINITIONS) {
-    try {
-      snapshot.set(def.key, structuredClone(def.get(config)));
-    } catch {}
+function mergePartialResults(fresh, previous, rerunIds) {
+  const preserved = previous.filter((r) => !rerunIds.has(r.id));
+  if (preserved.length > 0) {
+    getDefaultChannel().writeLine(pc.dim(t("cli.cert_partial_merge", { kept: String(preserved.length) })));
   }
-  return snapshot;
+  return [...fresh, ...preserved];
 }
-var REASONING_LEVELS, LOG_LEVELS, VERBOSITY_LEVELS, LOCALES, MIN_SHARE2 = 0.05, MAX_SHARE2 = 0.9, MAX_COMBINED2 = 0.95, DEFINITIONS, BY_NAME;
-var init_registry2 = __esm(() => {
-  init_defaults();
-  init_security();
-  init_budget();
-  REASONING_LEVELS = [
-    "auto",
-    "default",
-    "none",
-    "low",
-    "medium",
-    "high",
-    "max"
-  ];
-  LOG_LEVELS = ["silent", "error", "warn", "info", "debug"];
-  VERBOSITY_LEVELS = ["quiet", "normal", "verbose"];
-  LOCALES = ["en", "ru"];
-  DEFINITIONS = [
-    {
-      key: "model",
-      aliases: [],
-      domain: "agent",
-      valueType: "string",
-      reconfigure: true,
-      get: (c) => c.model,
-      set: (c, v) => {
-        c.model = String(v);
-      }
-    },
-    {
-      key: "provider.active",
-      aliases: [],
-      domain: "provider",
-      valueType: "string",
-      reconfigure: true,
-      get: (c) => c.provider.active ?? c.provider.type,
-      set: (c, v) => {
-        c.provider.active = String(v);
-      },
-      extraValidate: (c, v) => {
-        const entries = c.provider.entries ?? [];
-        if (entries.length === 0)
-          return null;
-        const name = String(v);
-        const found = entries.some((e) => e.label === name || e.type === name);
-        return found ? null : "invalid";
-      }
-    },
-    {
-      key: "contextWindow",
-      aliases: ["context.window"],
-      domain: "budget",
-      valueType: "int",
-      min: 1024,
-      step: 1024,
-      reconfigure: true,
-      get: (c) => c.contextWindow,
-      set: (c, v) => {
-        c.contextWindow = v;
-      }
-    },
-    shareField("system", "contextBudget.systemPrompt"),
-    shareField("reserve", "contextBudget.responseReserve"),
-    {
-      key: "showReasoning",
-      aliases: ["reasoning.show"],
-      domain: "reasoning",
-      valueType: "bool",
-      reconfigure: false,
-      get: (c) => c.showReasoning,
-      set: (c, v) => {
-        c.showReasoning = v;
-      }
-    },
-    {
-      key: "reasoning.mode",
-      aliases: ["reasoning.level"],
-      domain: "reasoning",
-      valueType: "enum",
-      enumValues: REASONING_LEVELS,
-      reconfigure: true,
-      get: (c) => c.reasoning?.mode ?? "auto",
-      set: (c, v) => {
-        const base = c.reasoning ?? structuredClone(DEFAULTS.reasoning);
-        c.reasoning = { ...base, mode: v };
-      }
-    },
-    {
-      key: "ui.verbosity",
-      aliases: ["verbosity"],
-      domain: "ui",
-      valueType: "enum",
-      enumValues: VERBOSITY_LEVELS,
-      reconfigure: false,
-      get: (c) => c.ui.verbosity ?? (c.ui.verbose ? "verbose" : "quiet"),
-      set: (c, v) => {
-        c.ui.verbosity = v;
-      }
-    },
-    {
-      key: "maxToolIterations",
-      aliases: [],
-      domain: "agent",
-      valueType: "int",
-      min: 1,
-      step: 1,
-      reconfigure: false,
-      get: (c) => c.maxToolIterations,
-      set: (c, v) => {
-        c.maxToolIterations = v;
-      }
-    },
-    {
-      key: "stuckThreshold",
-      aliases: [],
-      domain: "agent",
-      valueType: "int",
-      min: 1,
-      step: 1,
-      reconfigure: false,
-      get: (c) => c.stuckThreshold,
-      set: (c, v) => {
-        c.stuckThreshold = v;
-      }
-    },
-    {
-      key: "moe.enabled",
-      aliases: [],
-      domain: "agent",
-      valueType: "bool",
-      reconfigure: true,
-      get: (c) => c.moe?.enabled ?? DEFAULTS.moe.enabled,
-      set: (c, v) => {
-        c.moe = { ...c.moe ?? DEFAULTS.moe, enabled: v };
-      }
-    },
-    {
-      key: "moe.maxReplanCycles",
-      aliases: [],
-      domain: "agent",
-      valueType: "int",
-      min: 0,
-      max: 10,
-      step: 1,
-      reconfigure: true,
-      get: (c) => c.moe?.maxReplanCycles ?? DEFAULTS.moe.maxReplanCycles,
-      set: (c, v) => {
-        c.moe = { ...c.moe ?? DEFAULTS.moe, maxReplanCycles: v };
-      }
-    },
-    {
-      key: "critic.enabled",
-      aliases: [],
-      domain: "agent",
-      valueType: "bool",
-      reconfigure: true,
-      get: (c) => c.critic?.enabled ?? DEFAULTS.critic.enabled,
-      set: (c, v) => {
-        c.critic = { ...c.critic ?? DEFAULTS.critic, enabled: v };
-      }
-    },
-    {
-      key: "critic.maxCalls",
-      aliases: [],
-      domain: "agent",
-      valueType: "int",
-      min: 0,
-      max: 20,
-      step: 1,
-      reconfigure: true,
-      get: (c) => c.critic?.maxCalls ?? DEFAULTS.critic.maxCalls,
-      set: (c, v) => {
-        c.critic = { ...c.critic ?? DEFAULTS.critic, maxCalls: v };
-      }
-    },
-    {
-      key: "critic.maxRepairCycles",
-      aliases: [],
-      domain: "agent",
-      valueType: "int",
-      min: 0,
-      max: 5,
-      step: 1,
-      reconfigure: true,
-      get: (c) => c.critic?.maxRepairCycles ?? DEFAULTS.critic.maxRepairCycles,
-      set: (c, v) => {
-        c.critic = { ...c.critic ?? DEFAULTS.critic, maxRepairCycles: v };
-      }
-    },
-    {
-      key: "critic.timeoutMs",
-      aliases: [],
-      domain: "agent",
-      valueType: "int",
-      min: 1000,
-      max: 120000,
-      step: 1000,
-      reconfigure: true,
-      get: (c) => c.critic?.timeoutMs ?? DEFAULTS.critic.timeoutMs,
-      set: (c, v) => {
-        c.critic = { ...c.critic ?? DEFAULTS.critic, timeoutMs: v };
-      }
-    },
-    {
-      key: "logLevel",
-      aliases: [],
-      domain: "agent",
-      valueType: "enum",
-      enumValues: LOG_LEVELS,
-      reconfigure: false,
-      get: (c) => c.logLevel,
-      set: (c, v) => {
-        c.logLevel = String(v);
-      }
-    },
-    {
-      key: "locale",
-      aliases: [],
-      domain: "i18n",
-      valueType: "enum",
-      enumValues: LOCALES,
-      reconfigure: false,
-      get: (c) => c.locale,
-      set: (c, v) => {
-        c.locale = String(v);
-      }
-    },
-    {
-      key: "version",
-      aliases: [],
-      domain: "agent",
-      valueType: "string",
-      reconfigure: false,
-      readOnly: true,
-      get: (c) => c.version
-    },
-    securityToggle("enabled", "security.enabled"),
-    securityToggle("paths", "security.paths.enabled"),
-    securityToggle("contentScan", "security.contentScan.enabled"),
-    securityToggle("sessionEncryption", "security.sessionEncryption.enabled")
-  ];
-  BY_NAME = new Map;
-  for (const def of DEFINITIONS) {
-    BY_NAME.set(def.key, def);
-    for (const alias of def.aliases)
-      BY_NAME.set(alias, def);
+function printResults(results) {
+  for (const r of results) {
+    const icon = r.status === "pass" ? pc.green("✔") : r.status === "fail" ? pc.red("✘") : r.status === "skipped" ? pc.dim("–") : pc.yellow("!");
+    const detail = r.status === "skipped" ? pc.dim(r.title) : `${r.passed}/${r.of}`;
+    getDefaultChannel().writeLine(`  ${icon} ${r.id}  ${detail}`);
+    if (r.error)
+      getDefaultChannel().writeLine(`    ${pc.dim(r.error)}`);
+    if (r.diagnostics)
+      getDefaultChannel().writeLine(r.diagnostics);
+  }
+}
+function writeReport(entry, projectDir) {
+  const reportDir = join49(projectDir, "certification");
+  const ts = entry.certifiedAt.replace(/[:.]/g, "-").slice(0, 19);
+  const filename = `report-${entry.model.replace(/[/\\:]/g, "_")}-${ts}.json`;
+  const reportPath = join49(reportDir, filename);
+  const report = {
+    model: entry.model,
+    providerUrl: entry.providerUrl,
+    mmaVersion: entry.mmaVersion,
+    certifiedAt: entry.certifiedAt,
+    certified: isFullyPassed(entry),
+    suite: entry.suite,
+    results: entry.results.map((r) => ({
+      id: r.id,
+      title: r.title,
+      status: r.status,
+      passed: r.passed,
+      of: r.of,
+      error: r.error,
+      diagnostics: r.diagnostics
+    }))
+  };
+  try {
+    writeFileSync23(reportPath, JSON.stringify(report, null, 2), "utf-8");
+    getDefaultChannel().writeLine(pc.dim(`
+Report: ${reportPath}`));
+  } catch (e) {
+    getDefaultChannel().writeLine(pc.yellow(`  Failed to write report: ${e.message}`), "stderr");
   }
+}
+var HERE, MMA_ROOT;
+var init_cli = __esm(() => {
+  init_paths();
+  init_i18n();
+  init_colors();
+  init_loader3();
+  init_runner2();
+  init_manifest();
+  init_output();
+  HERE = dirname24(fileURLToPath5(import.meta.url));
+  MMA_ROOT = findMmaRoot(HERE);
 });
 
 // src/ui/theme.ts
@@ -42574,8 +43623,8 @@ function rawFromValue(value) {
   return String(value);
 }
 function printConfigTable(ctx, defs) {
-  const list = defs ?? configDefs();
-  const rows = list.map((def) => [
+  const list2 = defs ?? configDefs();
+  const rows = list2.map((def) => [
     def.key,
     formatConfigValue(def.get(ctx.config)),
     def.domain,
@@ -42873,7 +43922,7 @@ function registerConfigCommands(ctx) {
   });
 }
 function registerProviderCommands(ctx) {
-  const list = () => {
+  const list2 = () => {
     const providers = ctx.agent.listProviders();
     if (providers.length === 0) {
       ctx.output.writeLine(`${t("repl.provider_current")}  ${ctx.config.provider.type}`);
@@ -42969,7 +44018,7 @@ function registerProviderCommands(ctx) {
     ctx.output.writeLine(t("repl.provider_switch_hint", { name }));
   };
   const handlers = {
-    list,
+    list: list2,
     use,
     add
   };
@@ -43105,6 +44154,30 @@ function registerProviderCommands(ctx) {
   });
 }
 function registerAgentCommands(ctx) {
+  const securityStatus = () => {
+    const s = ctx.config.security;
+    const flag = (v) => v ? t("reasoning.on") : t("reasoning.off");
+    const sep3 = pc.dim(" · ");
+    ctx.output.writeLine(`security${sep3}${flag(s?.enabled)}`);
+    ctx.output.writeLine(`↳ bash ${flag(s?.bash.enabled)}${sep3}paths ${flag(s?.paths.enabled)}${sep3}network ${flag(s?.network.enabled)}`);
+    ctx.output.writeLine(`↳ contentScan ${flag(s?.contentScan.enabled)}${sep3}encryption ${flag(s?.sessionEncryption.enabled)}`);
+  };
+  const securityHandlers = {
+    status: securityStatus
+  };
+  ctx.registerCommand({
+    name: "security",
+    description: t("repl.security"),
+    action: (args) => {
+      const sub = args[0]?.trim().toLowerCase();
+      const handler = sub ? securityHandlers[sub] : securityHandlers.status;
+      if (!handler) {
+        ctx.output.writeLine(pc.yellow(t("repl.unknown_sub", { cmd: "security", sub })));
+        return;
+      }
+      handler();
+    }
+  });
   ctx.registerCommand({
     name: "reload",
     description: t("repl.reload"),
@@ -43457,6 +44530,7 @@ var init_repl_commands = __esm(() => {
     sysprompt: "agent",
     map: "agent",
     lsp: "agent",
+    security: "agent",
     sessions: "session",
     new: "session",
     resume: "session",
@@ -44330,6 +45404,7 @@ function extractLatestChangelog(changelog) {
 
 // src/cli/commands.ts
 init_output();
+init_registry2();
 
 // src/config/redact.ts
 var SECRET_KEYS = new Set([
@@ -44408,29 +45483,39 @@ function buildAgentsCommand(program2) {
 }
 function buildConfigCommands(program2) {
   const configCmd = program2.command("config").description(t("cli.manage_config"));
-  configCmd.command("set").argument("<key>", t("cli.config_key")).argument("<value>", "Config value").description(t("cli.set_value")).action(async (key, value) => {
+  configCmd.command("set").argument("<key>", t("cli.config_key")).argument("<value>", "Config value").description(t("cli.set_value")).option("--force", t("cli.config_force")).action(async (key, value, opts) => {
     const configPath = globalConfigFile();
     const { config } = await bootstrap();
-    const keys = key.split(".");
-    let obj = config;
-    for (let i = 0;i < keys.length - 1; i++) {
-      if (!(keys[i] in obj))
-        obj[keys[i]] = {};
-      obj = obj[keys[i]];
-    }
-    const lastKey = keys[keys.length - 1];
-    if (value === "true")
-      obj[lastKey] = true;
-    else if (value === "false")
-      obj[lastKey] = false;
-    else if (/^\d+$/.test(value))
-      obj[lastKey] = parseInt(value, 10);
-    else if (/^\d+\.\d+$/.test(value))
-      obj[lastKey] = parseFloat(value);
-    else
-      obj[lastKey] = value;
+    if (opts.force) {
+      const keys = key.split(".");
+      let obj = config;
+      for (let i = 0;i < keys.length - 1; i++) {
+        if (!(keys[i] in obj))
+          obj[keys[i]] = {};
+        obj = obj[keys[i]];
+      }
+      const lastKey = keys[keys.length - 1];
+      if (value === "true")
+        obj[lastKey] = true;
+      else if (value === "false")
+        obj[lastKey] = false;
+      else if (/^\d+$/.test(value))
+        obj[lastKey] = parseInt(value, 10);
+      else if (/^\d+\.\d+$/.test(value))
+        obj[lastKey] = parseFloat(value);
+      else
+        obj[lastKey] = value;
+      saveConfig(config, configPath, dirname25(configPath));
+      getDefaultChannel().writeLine(t("cli.set_done", { key, value }));
+      return;
+    }
+    const r = setConfigValue(config, key, value);
+    if (!r.ok) {
+      getDefaultChannel().writeLine(pc.yellow(t("cli.config_invalid", { key: r.input, reason: r.reason })), "stderr");
+      return;
+    }
     saveConfig(config, configPath, dirname25(configPath));
-    getDefaultChannel().writeLine(t("cli.set_done", { key, value }));
+    getDefaultChannel().writeLine(t("cli.set_done", { key: r.key, value: r.display }));
   });
   configCmd.command("show").description(t("cli.show_config")).option("--show-secrets", "Print secrets (API keys, tokens) unredacted").action(async (opts) => {
     const { config } = await bootstrap();
@@ -45077,7 +46162,7 @@ class LineEditor {
       this.dsrDataHandler = (buf) => this.consumeDsrReplies(buf.toString("utf-8"));
       this.input.on("data", this.dsrDataHandler);
       readline2.emitKeypressEvents(this.input);
-      this.keypressHandler = (str, key) => this.onKey(str, key);
+      this.keypressHandler = (str2, key) => this.onKey(str2, key);
       this.input.on("keypress", this.keypressHandler);
       this.input.resume();
     } else {
@@ -45233,7 +46318,7 @@ class LineEditor {
       this.pendingLine = parts[i];
     }
   }
-  onKey(str, key) {
+  onKey(str2, key) {
     if (this.isDone)
       return;
     if (!this.inputEnabled) {
@@ -45243,7 +46328,7 @@ class LineEditor {
         return;
       }
       if (k2?.name === "escape") {
-        this.onKeyInput?.(str, key);
+        this.onKeyInput?.(str2, key);
         return;
       }
       return;
@@ -45269,11 +46354,11 @@ class LineEditor {
       }
       this.completionSession = null;
     }
-    if (this.onKeyInput?.(str, key))
+    if (this.onKeyInput?.(str2, key))
       return;
     const k = key;
     const name = k?.name ?? "undefined";
-    const seq2 = k?.sequence ?? str ?? "";
+    const seq2 = k?.sequence ?? str2 ?? "";
     if (name === "undefined" && /^\x1b\[\d+(?:;\d+)?u$/.test(seq2)) {
       const m = seq2.match(/^\x1b\[(\d+)(?:;(\d+))?u$/);
       if (m && Number(m[1]) === 13 && Number(m[2] ?? 0) !== 0) {
@@ -45313,9 +46398,9 @@ class LineEditor {
           this.pasteBuffer += `
 `;
         }
-      } else if (str) {
+      } else if (str2) {
         this.pasteLastWasCR = false;
-        this.pasteBuffer += str;
+        this.pasteBuffer += str2;
       }
       return;
     }
@@ -45441,9 +46526,9 @@ class LineEditor {
           return;
       }
     }
-    if (str && !/^[\u0000-\u001f\u007f]/.test(str)) {
+    if (str2 && !/^[\u0000-\u001f\u007f]/.test(str2)) {
       this.lastWasCR = false;
-      this.insertText(str);
+      this.insertText(str2);
     }
   }
   submit() {
@@ -46596,7 +47681,7 @@ var GENERIC_ARG_KEYS = [
   "value",
   "text"
 ];
-function str(value) {
+function str2(value) {
   if (typeof value === "string")
     return value;
   if (typeof value === "number")
@@ -46637,22 +47722,22 @@ function humanArgs(tool, args) {
     return truncateArg([args.action, ...extras].join(" "));
   }
   if (tool === "move_file") {
-    const from = str(args.from);
-    const to = str(args.to);
+    const from = str2(args.from);
+    const to = str2(args.to);
     if (from && to)
       return truncateArg(`${from} → ${to}`);
   }
   if (tool === "mcp_call") {
-    const server = str(args.server);
-    const name = str(args.tool);
+    const server = str2(args.server);
+    const name = str2(args.tool);
     if (server && name)
       return `${server}/${name}`;
   }
   if (tool === "remember") {
-    const category = str(args.category);
-    const key = str(args.key);
-    const entry = str(args.entry);
-    const body = key && args.value !== undefined ? `${key} = ${str(args.value)}` : key || entry;
+    const category = str2(args.category);
+    const key = str2(args.key);
+    const entry = str2(args.entry);
+    const body = key && args.value !== undefined ? `${key} = ${str2(args.value)}` : key || entry;
     const phrase = [category, body].filter(Boolean).join(" · ");
     if (phrase)
       return truncateArg(phrase);
@@ -46663,7 +47748,7 @@ function humanArgs(tool, args) {
       return tags.join(", ");
   }
   for (const key of GENERIC_ARG_KEYS) {
-    const value = str(args[key]);
+    const value = str2(args[key]);
     if (value)
       return truncateArg(value);
   }
@@ -47558,6 +48643,9 @@ class Repl {
       { name: "normal", description: t("verbose.sub_normal") },
       { name: "verbose", description: t("verbose.sub_verbose") }
     ]));
+    this.completer.registerProvider(new SubcommandProvider("security", [
+      { name: "status", description: t("cli.security.status") }
+    ]));
     this.completer.registerProvider(new ConfigKeyProvider);
     this.completer.registerProvider(new ConfigValueProvider);
     this.completer.registerProvider(new FlagProvider);
@@ -47673,7 +48761,7 @@ ${line}`;
       });
     }
     if (this.rl instanceof LineEditor) {
-      this.rl.onKeyInput = (str2, key) => this.handleSpecialKey(str2, key);
+      this.rl.onKeyInput = (str3, key) => this.handleSpecialKey(str3, key);
     }
     let forceExitTimer = null;
     const FORCE_EXIT_MS = 5000;
@@ -48461,6 +49549,7 @@ function overview(store) {
 
 // src/modules/webui/commands-settings.ts
 init_registry2();
+init_i18n();
 init_export();
 import { mkdirSync as mkdirSync29, writeFileSync as writeFileSync27 } from "node:fs";
 import { dirname as dirname29, join as join56 } from "node:path";
@@ -48522,11 +49611,13 @@ async function applyConfigWrite(cfg, name, value, out, state) {
 init_paths();
 var REASONING_USAGE = "/reasoning [show|hide|on|off|level <auto|default|none|low|medium|high|max>]";
 var CONTEXT_USAGE = "/context [<tokens> | system <share> | reserve <share>]";
+var SECURITY_USAGE = "/security [status|<key> [value]]";
 function makeSettingsHandlers(state) {
   return {
     reasoning: (args, o) => withConfig(state, o, (cfg) => reasoningCmd(cfg, args, o, state)),
     verbose: (args, o) => withConfig(state, o, (cfg) => verboseCmd(cfg, args, o, state)),
     context: (args, o) => withConfig(state, o, (cfg) => contextCmd(cfg, args, o, state)),
+    security: (args, o) => withConfig(state, o, (cfg) => securityCmd(cfg, args, o, state)),
     session: (args, o) => sessionCmd(state, args, o),
     export: (args, o) => exportCmd(state, args, o)
   };
@@ -48586,6 +49677,22 @@ function contextCmd(cfg, args, out, state) {
   }
   return applyConfigWrite(cfg, "contextWindow", args[0], out, state);
 }
+function securityCmd(cfg, args, out, state) {
+  const sub = args[0]?.trim().toLowerCase();
+  if (!sub || sub === "status") {
+    const flag = (v) => v ? t("reasoning.on") : t("reasoning.off");
+    const s = cfg.security;
+    out(`security · ${flag(s?.enabled)}`);
+    out(`↳ bash ${flag(s?.bash.enabled)} · paths ${flag(s?.paths.enabled)} · network ${flag(s?.network.enabled)}`);
+    out(`↳ contentScan ${flag(s?.contentScan.enabled)} · encryption ${flag(s?.sessionEncryption.enabled)}`);
+    return;
+  }
+  if (args.length >= 2) {
+    return applyConfigWrite(cfg, args[0], args.slice(1).join(" "), out, state);
+  }
+  out(`↳ ${t("web.security.unknown_sub", { sub: args[0] })}`);
+  out(`usage: ${SECURITY_USAGE}`);
+}
 function sessionCmd(state, args, out) {
   const mgr = state.sessionManager;
   if (!mgr) {
@@ -48756,6 +49863,7 @@ var HELP = [
   { usage: "/reasoning [show|hide|on|off|level <lvl>]", descKey: "web.command.reasoning" },
   { usage: "/verbose <quiet|normal|verbose>", descKey: "web.command.verbose" },
   { usage: "/context [<tokens>]", descKey: "web.command.context" },
+  { usage: "/security [status|<key> [value]]", descKey: "web.command.security" },
   { usage: "/session list | /session use <id>", descKey: "web.command.session" },
   { usage: "/export [md|json|jsonl]", descKey: "web.command.export" },
   { usage: "/memory [get|set|unset|find|forget]", descKey: "web.command.memory" },
@@ -49368,7 +50476,7 @@ async function persistAndReconfigure(s, config) {
 }
 
 // src/modules/webui/config-api.ts
-function buildConfigRegistry() {
+function buildConfigRegistry(config) {
   return configDefs().map((def) => {
     const entry = {
       key: def.key,
@@ -49384,8 +50492,13 @@ function buildConfigRegistry() {
       entry.max = def.max;
     if (def.step !== undefined)
       entry.step = def.step;
-    if (def.readOnly)
+    if (def.readOnly) {
       entry.readOnly = true;
+      if (config)
+        entry.value = def.get(config);
+    }
+    if (def.editor)
+      entry.editor = def.editor;
     return entry;
   });
 }
@@ -49401,7 +50514,7 @@ function handleConfigGet(res, s) {
   }
   sendJson(res, 200, {
     config: redactConfigSecrets(s.config),
-    registry: buildConfigRegistry(),
+    registry: buildConfigRegistry(s.config),
     webToken: maskToken(s.token)
   });
 }
@@ -49728,6 +50841,7 @@ function handleSessionsApi(req, res, reqUrl, s) {
 
 // src/modules/webui/settings-api.ts
 init_context_log();
+init_config();
 var MEMORY_CATEGORIES = ["conventions", "decisions", "errors", "facts"];
 function isCategory(value) {
   return MEMORY_CATEGORIES.includes(value);
@@ -49815,12 +50929,31 @@ function handleSkillsGet(res, s) {
   });
   sendJson(res, 200, { skills });
 }
+function mcpViewOptionals(cfg) {
+  const out = {};
+  if (cfg.transport)
+    out.transport = cfg.transport;
+  if (cfg.command)
+    out.command = cfg.command;
+  if (cfg.url)
+    out.url = cfg.url;
+  if (cfg.args)
+    out.args = [...cfg.args];
+  if (cfg.timeout !== undefined)
+    out.timeout = cfg.timeout;
+  if (cfg.enabled !== undefined)
+    out.enabled = cfg.enabled;
+  return out;
+}
 function mcpList(s) {
   const servers = s.config?.mcpServers ?? {};
   return Object.entries(servers).map(([key, cfg]) => ({
     id: key,
     name: cfg.name || key,
-    status: cfg.enabled === false ? "disabled" : "enabled"
+    status: cfg.enabled === false ? "disabled" : "enabled",
+    envKeys: cfg.env ? Object.keys(cfg.env) : [],
+    headerKeys: cfg.headers ? Object.keys(cfg.headers) : [],
+    ...mcpViewOptionals(cfg)
   }));
 }
 function handlePluginsGet(res, s) {
@@ -49875,38 +51008,349 @@ function handleMcpToggle(req, res, id, s) {
     readBodyError(req, res, err);
   });
 }
-function handleSettingsApi(req, res, reqUrl, s) {
-  const p = reqUrl.pathname;
-  if (p === "/api/memory" && req.method === "GET") {
-    handleMemoryGet(res, s);
-    return true;
+var MCP_TRANSPORTS = ["stdio", "sse", "http"];
+function isRecord3(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function asStringArray(value) {
+  if (!Array.isArray(value))
+    return null;
+  if (!value.every((x) => typeof x === "string"))
+    return null;
+  return [...value];
+}
+function asStringRecord(value) {
+  if (!isRecord3(value))
+    return null;
+  const out = {};
+  for (const [k, v] of Object.entries(value)) {
+    if (typeof v !== "string")
+      return null;
+    out[k] = v;
   }
-  if (p === "/api/memory" && req.method === "POST") {
-    handleMemoryPost(req, res, s);
-    return true;
+  return out;
+}
+function validTimeout(value) {
+  return typeof value === "number" && Number.isInteger(value) && value >= 1000 && value <= 300000;
+}
+function validateMcpEntry(entry) {
+  const transport = entry.transport ?? "stdio";
+  if (!MCP_TRANSPORTS.includes(transport))
+    return "invalid-transport";
+  if (transport === "stdio") {
+    if (!entry.command?.trim())
+      return "command-required";
+  } else if (!entry.url?.trim()) {
+    return "url-required";
+  }
+  if (entry.timeout !== undefined && !validTimeout(entry.timeout))
+    return "invalid-timeout";
+  return null;
+}
+function applyFields(target, patch, appliers) {
+  for (const [key, apply] of Object.entries(appliers)) {
+    const value = patch[key];
+    if (value === undefined)
+      continue;
+    const error = apply(target, value);
+    if (error)
+      return error;
   }
-  if (p.startsWith("/api/memory/") && req.method === "DELETE") {
-    const rest = p.slice("/api/memory/".length);
-    const slash = rest.indexOf("/");
-    const category = slash >= 0 ? decodeURIComponent(rest.slice(0, slash)) : "";
-    const nRaw = slash >= 0 ? decodeURIComponent(rest.slice(slash + 1)) : "";
-    handleMemoryDelete(res, category, nRaw, s);
-    return true;
+  return null;
+}
+function setTrimmed(value, code, set, clear) {
+  if (typeof value !== "string")
+    return code;
+  if (value.trim())
+    set(value.trim());
+  else
+    clear();
+  return null;
+}
+var MCP_FIELD_APPLIERS = {
+  name: (next, v) => {
+    if (typeof v !== "string" || !v.trim())
+      return "name-required";
+    next.name = v.trim();
+    return null;
+  },
+  transport: (next, v) => {
+    if (typeof v !== "string")
+      return "invalid-transport";
+    next.transport = v;
+    return null;
+  },
+  command: (next, v) => setTrimmed(v, "invalid-command", (t2) => {
+    next.command = t2;
+  }, () => {
+    delete next.command;
+  }),
+  url: (next, v) => setTrimmed(v, "invalid-url", (t2) => {
+    next.url = t2;
+  }, () => {
+    delete next.url;
+  }),
+  args: (next, v) => {
+    const args = asStringArray(v);
+    if (!args)
+      return "invalid-args";
+    next.args = args;
+    return null;
+  },
+  env: (next, v) => {
+    const env3 = asStringRecord(v);
+    if (!env3)
+      return "invalid-env";
+    next.env = env3;
+    return null;
+  },
+  headers: (next, v) => {
+    const headers = asStringRecord(v);
+    if (!headers)
+      return "invalid-headers";
+    next.headers = headers;
+    return null;
+  },
+  enabled: (next, v) => {
+    if (typeof v !== "boolean")
+      return "invalid-enabled";
+    next.enabled = v;
+    return null;
+  },
+  timeout: (next, v) => {
+    if (!validTimeout(v))
+      return "invalid-timeout";
+    next.timeout = v;
+    return null;
   }
-  if (p === "/api/skills" && req.method === "GET") {
-    handleSkillsGet(res, s);
-    return true;
+};
+function applyMcpPatch(next, patch) {
+  return applyFields(next, patch, MCP_FIELD_APPLIERS);
+}
+function createMcpServer(config, input) {
+  if (!isRecord3(input))
+    return { ok: false, error: "invalid-input" };
+  const name = typeof input.name === "string" ? input.name.trim() : "";
+  if (!name)
+    return { ok: false, error: "name-required" };
+  if (!config.mcpServers)
+    config.mcpServers = {};
+  if (config.mcpServers[name])
+    return { ok: false, error: "name-conflict" };
+  const next = { name };
+  const patchError = applyMcpPatch(next, { ...input, name });
+  if (patchError)
+    return { ok: false, error: patchError };
+  const coherent = validateMcpEntry(next);
+  if (coherent)
+    return { ok: false, error: coherent };
+  config.mcpServers[name] = next;
+  return { ok: true, id: name };
+}
+function updateMcpServer(config, id, patch) {
+  const current = config.mcpServers?.[id];
+  if (!current)
+    return { ok: false, error: "not_found" };
+  if (!isRecord3(patch))
+    return { ok: false, error: "invalid-input" };
+  const next = { ...current };
+  const patchError = applyMcpPatch(next, patch);
+  if (patchError)
+    return { ok: false, error: patchError };
+  const coherent = validateMcpEntry(next);
+  if (coherent)
+    return { ok: false, error: coherent };
+  config.mcpServers[id] = next;
+  return { ok: true, id };
+}
+function deleteMcpServer(config, id) {
+  if (!config.mcpServers?.[id])
+    return { ok: false, error: "not_found" };
+  delete config.mcpServers[id];
+  return { ok: true, id };
+}
+function listLspServers(config) {
+  const lsp = config.lsp ?? DEFAULT_LSP_CONFIG;
+  return Object.entries(lsp.servers).map(([lang, srv]) => {
+    const view = {
+      lang,
+      command: srv.command,
+      timeout: srv.timeout ?? lsp.timeout,
+      autoInstall: srv.autoInstall ?? false,
+      enabled: lsp.enabled !== false && srv.enabled !== false
+    };
+    if (srv.args)
+      view.args = [...srv.args];
+    return view;
+  });
+}
+var LSP_FIELD_APPLIERS = {
+  enabled: (srv, v) => {
+    if (typeof v !== "boolean")
+      return "invalid-enabled";
+    srv.enabled = v;
+    return null;
+  },
+  command: (srv, v) => {
+    if (typeof v !== "string" || !v.trim())
+      return "invalid-command";
+    srv.command = v.trim();
+    return null;
+  },
+  args: (srv, v) => {
+    const args = asStringArray(v);
+    if (!args)
+      return "invalid-args";
+    srv.args = args;
+    return null;
+  },
+  timeout: (srv, v) => {
+    if (!validTimeout(v))
+      return "invalid-timeout";
+    srv.timeout = v;
+    return null;
   }
-  if (p === "/api/plugins" && req.method === "GET") {
-    handlePluginsGet(res, s);
+};
+function applyLspPatch(srv, patch) {
+  return applyFields(srv, patch, LSP_FIELD_APPLIERS);
+}
+function updateLspServer(config, lang, patch) {
+  if (!isRecord3(patch))
+    return { ok: false, error: "invalid-input" };
+  if (!config.lsp)
+    config.lsp = structuredClone(DEFAULT_LSP_CONFIG);
+  const srv = config.lsp.servers[lang];
+  if (!srv)
+    return { ok: false, error: "not_found" };
+  const patchError = applyLspPatch(srv, patch);
+  if (patchError)
+    return { ok: false, error: patchError };
+  return { ok: true, lang };
+}
+function persistConfig2(s, config) {
+  try {
+    s.saveConfig?.(config);
     return true;
+  } catch {
+    return false;
+  }
+}
+function handleConfigWrite(req, res, s, mutate, view) {
+  if (!s.config) {
+    sendJson(res, 503, { error: "config_unavailable" });
+    return;
+  }
+  const config = s.config;
+  readJsonBody(req, s.maxBodyBytes).then((rec) => {
+    if (!rec) {
+      sendJson(res, 400, { ok: false, error: "invalid JSON" });
+      return;
+    }
+    const outcome = mutate(config, rec);
+    if (!outcome.ok) {
+      sendJson(res, outcome.status, { ok: false, error: outcome.error });
+      return;
+    }
+    const persisted = persistConfig2(s, config);
+    sendJson(res, 200, { ok: true, persisted, restartRequired: true, ...view(config, s) });
+  }).catch((err) => {
+    readBodyError(req, res, err);
+  });
+}
+function mcpOutcome(result) {
+  if (result.ok)
+    return { ok: true };
+  return { ok: false, status: result.error === "not_found" ? 404 : 400, error: result.error };
+}
+function handleMcpCreate(req, res, s) {
+  handleConfigWrite(req, res, s, (config, rec) => mcpOutcome(createMcpServer(config, rec)), (_config, state) => ({ mcp: mcpList(state) }));
+}
+function handleMcpUpdate(req, res, id, s) {
+  handleConfigWrite(req, res, s, (config, rec) => mcpOutcome(updateMcpServer(config, id, rec)), (_config, state) => ({ mcp: mcpList(state) }));
+}
+function handleMcpDelete(res, id, s) {
+  if (!s.config) {
+    sendJson(res, 503, { error: "config_unavailable" });
+    return;
+  }
+  const result = deleteMcpServer(s.config, id);
+  if (!result.ok) {
+    sendJson(res, 404, { ok: false, error: result.error });
+    return;
+  }
+  const persisted = persistConfig2(s, s.config);
+  sendJson(res, 200, { ok: true, persisted, restartRequired: true, mcp: mcpList(s) });
+}
+function handleLspGet(res, s) {
+  if (!s.config) {
+    sendJson(res, 503, { error: "config_unavailable" });
+    return;
+  }
+  sendJson(res, 200, { servers: listLspServers(s.config) });
+}
+function handleLspUpdate(req, res, lang, s) {
+  handleConfigWrite(req, res, s, (config, rec) => {
+    const result = updateLspServer(config, lang, rec);
+    if (result.ok)
+      return { ok: true };
+    return { ok: false, status: result.error === "not_found" ? 404 : 400, error: result.error };
+  }, (config) => ({ servers: listLspServers(config) }));
+}
+var SETTINGS_EXACT = {
+  "GET /api/memory": (_req, res, _param, s) => handleMemoryGet(res, s),
+  "POST /api/memory": (req, res, _param, s) => handleMemoryPost(req, res, s),
+  "GET /api/skills": (_req, res, _param, s) => handleSkillsGet(res, s),
+  "GET /api/plugins": (_req, res, _param, s) => handlePluginsGet(res, s)
+};
+var SETTINGS_PREFIX = [
+  {
+    method: "DELETE",
+    prefix: "/api/memory/",
+    handle: (_req, res, param, s) => {
+      const slash = param.indexOf("/");
+      handleMemoryDelete(res, slash >= 0 ? decodeURIComponent(param.slice(0, slash)) : "", slash >= 0 ? decodeURIComponent(param.slice(slash + 1)) : "", s);
+    }
+  },
+  {
+    method: "POST",
+    prefix: "/api/mcp/",
+    handle: (req, res, param, s) => handleMcpToggle(req, res, decodeURIComponent(param), s)
+  },
+  {
+    method: "PUT",
+    prefix: "/api/mcp/",
+    handle: (req, res, param, s) => handleMcpUpdate(req, res, decodeURIComponent(param), s)
+  },
+  {
+    method: "DELETE",
+    prefix: "/api/mcp/",
+    handle: (_req, res, param, s) => handleMcpDelete(res, decodeURIComponent(param), s)
+  },
+  {
+    method: "PUT",
+    prefix: "/api/lsp/",
+    handle: (req, res, param, s) => handleLspUpdate(req, res, decodeURIComponent(param), s)
   }
-  if (p.startsWith("/api/mcp/") && req.method === "POST") {
-    handleMcpToggle(req, res, decodeURIComponent(p.slice("/api/mcp/".length)), s);
+];
+function handleSettingsApi(req, res, reqUrl, s) {
+  const p = reqUrl.pathname;
+  const exact = SETTINGS_EXACT[`${req.method} ${p}`];
+  if (exact) {
+    exact(req, res, "", s);
     return true;
   }
+  for (const route of SETTINGS_PREFIX) {
+    if (req.method === route.method && p.startsWith(route.prefix)) {
+      route.handle(req, res, p.slice(route.prefix.length), s);
+      return true;
+    }
+  }
   return false;
 }
+
+// src/modules/webui/providers-api.ts
+init_defaults();
+
 // src/modules/webui/providers-view.ts
 init_presets();
 var LOCAL_PRESETS = [
@@ -49941,6 +51385,12 @@ function buildProviderViews(config) {
       view.contextWindow = e.contextWindow;
     if (e.priority !== undefined)
       view.priority = e.priority;
+    if (e.maxCompletionTokens !== undefined)
+      view.maxCompletionTokens = e.maxCompletionTokens;
+    if (e.cache !== undefined)
+      view.cache = { ...e.cache };
+    if (e.retry !== undefined)
+      view.retry = { ...e.retry };
     if (e.rateLimits) {
       view.rpm = e.rateLimits.maxRequestsPerMinute;
       view.parallel = e.rateLimits.maxParallelTasks;
@@ -49959,14 +51409,90 @@ function handleProvidersGet(res, s) {
   sendJson(res, 200, buildProviderViews(s.config));
 }
 function optionalInt(rec, key, min) {
+  return optionalIntRange(rec, key, min, Number.MAX_SAFE_INTEGER);
+}
+function optionalIntRange(rec, key, min, max) {
   const v = rec[key];
   if (v === undefined || v === null || v === "")
     return;
   const n = typeof v === "number" ? v : Number(v);
-  if (!Number.isFinite(n) || !Number.isInteger(n) || n < min)
+  if (!Number.isFinite(n) || !Number.isInteger(n) || n < min || n > max)
     return null;
   return n;
 }
+var CACHE_MECHANISMS = ["auto", "explicit", "local", "none"];
+var CACHE_REPORTS = ["openai", "deepseek", "anthropic", "ollama", "none"];
+var CACHE_FLAGS = [
+  "sessionHeader",
+  "requestCachePrompt",
+  "requestPromptCacheKey",
+  "requestSessionId",
+  "requestCacheControl",
+  "requestStreamUsage"
+];
+function coerceFlag(v) {
+  if (typeof v === "boolean")
+    return v;
+  if (v === 0 || v === 1)
+    return v === 1;
+  if (typeof v === "string") {
+    const s = v.trim().toLowerCase();
+    if (s === "true" || s === "1")
+      return true;
+    if (s === "false" || s === "0")
+      return false;
+  }
+  return null;
+}
+function parseCache(v) {
+  if (v === undefined || v === null)
+    return;
+  if (typeof v !== "object" || Array.isArray(v))
+    return null;
+  const rec = v;
+  const out = {};
+  if (rec.mechanism !== undefined) {
+    if (typeof rec.mechanism !== "string" || !CACHE_MECHANISMS.includes(rec.mechanism))
+      return null;
+    out.mechanism = rec.mechanism;
+  }
+  if (rec.report !== undefined) {
+    if (typeof rec.report !== "string" || !CACHE_REPORTS.includes(rec.report))
+      return null;
+    out.report = rec.report;
+  }
+  for (const flag of CACHE_FLAGS) {
+    const fv = rec[flag];
+    if (fv === undefined)
+      continue;
+    const b = coerceFlag(fv);
+    if (b === null)
+      return null;
+    out[flag] = b;
+  }
+  return out;
+}
+function parseRetry(v) {
+  if (v === undefined || v === null)
+    return;
+  if (typeof v !== "object" || Array.isArray(v))
+    return null;
+  const rec = v;
+  const specs = [
+    ["maxRetries", 0, 10],
+    ["baseDelay", 0, 60000],
+    ["maxDelay", 0, 300000]
+  ];
+  const out = {};
+  for (const [key, min, max] of specs) {
+    const n = optionalIntRange(rec, key, min, max);
+    if (n === null)
+      return null;
+    if (n !== undefined)
+      out[key] = n;
+  }
+  return out;
+}
 function parseProviderInput(rec) {
   const type2 = typeof rec.type === "string" ? rec.type.trim() : "";
   const baseUrl = typeof rec.baseUrl === "string" ? rec.baseUrl.trim() : "";
@@ -49985,6 +51511,15 @@ function parseProviderInput(rec) {
   const parallel = optionalInt(rec, "parallel", 1);
   if (contextWindow === null || priority === null || rpm === null || parallel === null)
     return null;
+  const maxCompletionTokens = optionalIntRange(rec, "maxCompletionTokens", 512, 128000);
+  if (maxCompletionTokens === null)
+    return null;
+  const cache = parseCache(rec.cache);
+  if (cache === null)
+    return null;
+  const retry = parseRetry(rec.retry);
+  if (retry === null)
+    return null;
   const input = { type: type2, baseUrl };
   if (typeof rec.label === "string" && rec.label.trim())
     input.label = rec.label.trim();
@@ -50001,6 +51536,12 @@ function parseProviderInput(rec) {
     input.rpm = rpm;
   if (parallel !== undefined)
     input.parallel = parallel;
+  if (maxCompletionTokens !== undefined)
+    input.maxCompletionTokens = maxCompletionTokens;
+  if (cache !== undefined)
+    input.cache = cache;
+  if (retry !== undefined)
+    input.retry = retry;
   return input;
 }
 function mirrorLegacy(config, entry) {
@@ -50008,6 +51549,9 @@ function mirrorLegacy(config, entry) {
   config.provider.baseUrl = entry.baseUrl;
   if (entry.apiKey !== undefined)
     config.provider.apiKey = entry.apiKey;
+  if (entry.maxCompletionTokens !== undefined) {
+    config.provider.maxCompletionTokens = entry.maxCompletionTokens;
+  }
 }
 function seededEntries(config) {
   const provider = config.provider;
@@ -50024,12 +51568,19 @@ function seededEntries(config) {
 }
 function upsertProvider(config, input) {
   const provider = config.provider;
+  const fromLegacySeed = !Array.isArray(provider.entries) || provider.entries.length === 0;
   const entries = seededEntries(config);
   const name = input.label || input.type;
   if (providerNameTaken(entries, name, input.originalName)) {
-    return { ok: false, error: "name-conflict" };
+    const loneSeeded = fromLegacySeed && entries.length === 1 && providerEntryName(entries[0]) === name;
+    if (!loneSeeded || input.originalName) {
+      return { ok: false, error: "name-conflict" };
+    }
+  }
+  let idx = input.originalName ? entries.findIndex((e) => providerEntryName(e) === input.originalName || e.type === input.originalName) : -1;
+  if (idx < 0 && fromLegacySeed && entries.length === 1 && providerEntryName(entries[0]) === name) {
+    idx = 0;
   }
-  const idx = input.originalName ? entries.findIndex((e) => providerEntryName(e) === input.originalName || e.type === input.originalName) : -1;
   const entry = idx >= 0 ? { ...entries[idx] } : { type: input.type, baseUrl: input.baseUrl };
   entry.type = input.type;
   entry.baseUrl = input.baseUrl;
@@ -50041,6 +51592,18 @@ function upsertProvider(config, input) {
     entry.contextWindow = input.contextWindow;
   if (input.priority !== undefined)
     entry.priority = input.priority;
+  if (input.maxCompletionTokens !== undefined)
+    entry.maxCompletionTokens = input.maxCompletionTokens;
+  if (input.cache !== undefined)
+    entry.cache = { ...entry.cache ?? {}, ...input.cache };
+  if (input.retry !== undefined) {
+    const prev = entry.retry ?? {};
+    entry.retry = {
+      maxRetries: input.retry.maxRetries ?? prev.maxRetries ?? DEFAULTS.retry.maxRetries,
+      baseDelay: input.retry.baseDelay ?? prev.baseDelay ?? DEFAULTS.retry.baseDelay,
+      maxDelay: input.retry.maxDelay ?? prev.maxDelay ?? DEFAULTS.retry.maxDelay
+    };
+  }
   if (input.rpm !== undefined || input.parallel !== undefined) {
     const prev = entry.rateLimits ?? { maxRequestsPerMinute: 60, maxParallelTasks: 1 };
     entry.rateLimits = {
@@ -50245,7 +51808,7 @@ init_i18n();
 init_apply();
 init_answers();
 init_discovery();
-function str2(rec, key) {
+function str3(rec, key) {
   const v = rec[key];
   return typeof v === "string" ? v.trim() : "";
 }
@@ -50255,16 +51818,16 @@ function positiveInt(rec, key) {
   return Number.isInteger(n) && n > 0 ? n : null;
 }
 function parseSetupAnswers(rec) {
-  const provider = str2(rec, "provider");
-  const apiBase = str2(rec, "apiBase");
-  const model = str2(rec, "model");
+  const provider = str3(rec, "provider");
+  const apiBase = str3(rec, "apiBase");
+  const model = str3(rec, "model");
   if (!provider || !apiBase || !model)
     return null;
   const contextWindow = positiveInt(rec, "contextWindow");
   const maxToolIterations = positiveInt(rec, "maxToolIterations");
   if (contextWindow === null || maxToolIterations === null)
     return null;
-  const locale = str2(rec, "locale");
+  const locale = str3(rec, "locale");
   if (!SETUP_LANGUAGES.some((l) => l.value === locale))
     return null;
   const flags = ["securityBashBlock", "securityFlagsBlock", "securityPathsRestrict"];
@@ -50308,12 +51871,12 @@ function handleSetupModels(req, res, s) {
       sendJson(res, 400, { ok: false, error: "invalid JSON" });
       return;
     }
-    const baseUrl = str2(rec, "baseUrl");
+    const baseUrl = str3(rec, "baseUrl");
     if (!baseUrl) {
       sendJson(res, 400, { ok: false, error: "invalid-base-url" });
       return;
     }
-    const models = await fetchProviderModels(baseUrl, str2(rec, "apiKey"));
+    const models = await fetchProviderModels(baseUrl, str3(rec, "apiKey"));
     sendJson(res, 200, { models });
   }).catch((err) => {
     readBodyError(req, res, err);
@@ -50325,13 +51888,13 @@ function handleSetupTest(req, res, s) {
       sendJson(res, 400, { ok: false, error: "invalid JSON" });
       return;
     }
-    const baseUrl = str2(rec, "baseUrl");
-    const model = str2(rec, "model");
+    const baseUrl = str3(rec, "baseUrl");
+    const model = str3(rec, "model");
     if (!baseUrl || !model) {
       sendJson(res, 400, { ok: false, error: "invalid-test-request" });
       return;
     }
-    const ok = await testProviderChat(baseUrl, str2(rec, "apiKey"), model);
+    const ok = await testProviderChat(baseUrl, str3(rec, "apiKey"), model);
     sendJson(res, 200, { ok });
   }).catch((err) => {
     readBodyError(req, res, err);
@@ -50343,7 +51906,7 @@ function handleSetupLocale(req, res, s) {
       sendJson(res, 400, { ok: false, error: "invalid JSON" });
       return;
     }
-    const locale = str2(rec, "locale");
+    const locale = str3(rec, "locale");
     if (!SETUP_LANGUAGES.some((l) => l.value === locale)) {
       sendJson(res, 400, { ok: false, error: "unsupported-locale" });
       return;
@@ -50484,7 +52047,9 @@ var API_ROUTES = {
   },
   "GET /api/models": (_req, res, s) => handleModelsGet(res, s),
   "POST /api/command": (req, res, s) => handleCommandPost(req, res, s),
-  "POST /api/interrupt": (_req, res, s) => handleInterruptPost(res, s)
+  "POST /api/interrupt": (_req, res, s) => handleInterruptPost(res, s),
+  "POST /api/mcp": (req, res, s) => handleMcpCreate(req, res, s),
+  "GET /api/lsp": (_req, res, s) => handleLspGet(res, s)
 };
 var API_GROUPS = [handleSetupApi, handleSessionsApi, handleSettingsApi, handleProvidersApi, handleFileApi];
 function handleApi(req, res, reqUrl, s) {