reasonix 0.11.2 → 0.12.6

package/dist/cli/index.js

@@ -4,13 +4,15 @@ import {
   MemoryStore,
   NEGATIVE_CLAIM_RULE,
   PROJECT_MEMORY_FILE,
+  SKILLS_DIRNAME,
+  SKILL_FILE,
   SkillStore,
   TUI_FORMATTING_RULES,
   applyMemoryStack,
   memoryEnabled,
   readProjectMemory,
   sanitizeMemoryName
-} from "./chunk-JDVY4JDU.js";
+} from "./chunk-PKPWI33U.js";
 
 // src/cli/index.ts
 import { Command } from "commander";
@@ -70,6 +72,29 @@ function addProjectShellAllowed(rootDir, prefix, path5 = defaultConfigPath()) {
   cfg.projects[rootDir].shellAllowed = [...existing, trimmed];
   writeConfig(cfg, path5);
 }
+function removeProjectShellAllowed(rootDir, prefix, path5 = defaultConfigPath()) {
+  const trimmed = prefix.trim();
+  if (!trimmed) return false;
+  const cfg = readConfig(path5);
+  const existing = cfg.projects?.[rootDir]?.shellAllowed ?? [];
+  if (!existing.includes(trimmed)) return false;
+  const next = existing.filter((p) => p !== trimmed);
+  if (!cfg.projects) cfg.projects = {};
+  if (!cfg.projects[rootDir]) cfg.projects[rootDir] = {};
+  cfg.projects[rootDir].shellAllowed = next;
+  writeConfig(cfg, path5);
+  return true;
+}
+function clearProjectShellAllowed(rootDir, path5 = defaultConfigPath()) {
+  const cfg = readConfig(path5);
+  const existing = cfg.projects?.[rootDir]?.shellAllowed ?? [];
+  if (existing.length === 0) return 0;
+  if (!cfg.projects) cfg.projects = {};
+  if (!cfg.projects[rootDir]) cfg.projects[rootDir] = {};
+  cfg.projects[rootDir].shellAllowed = [];
+  writeConfig(cfg, path5);
+  return existing.length;
+}
 function loadEditMode(path5 = defaultConfigPath()) {
   const v = readConfig(path5).editMode;
   return v === "auto" ? "auto" : "review";
@@ -156,8 +181,8 @@ function computeWait(attempt, initial, cap, retryAfter) {
 }
 function sleep(ms, signal) {
   if (ms <= 0) return Promise.resolve();
-  return new Promise((resolve12, reject) => {
-    const timer = setTimeout(resolve12, ms);
+  return new Promise((resolve13, reject) => {
+    const timer = setTimeout(resolve13, ms);
     if (signal) {
       const onAbort = () => {
         clearTimeout(timer);
@@ -642,7 +667,7 @@ function matchesTool(hook, toolName) {
   }
 }
 function defaultSpawner(input) {
-  return new Promise((resolve12) => {
+  return new Promise((resolve13) => {
     const child = spawn(input.command, {
       cwd: input.cwd,
       shell: true,
@@ -669,7 +694,7 @@ function defaultSpawner(input) {
     });
     child.once("error", (err) => {
       clearTimeout(timer);
-      resolve12({
+      resolve13({
         exitCode: null,
         stdout: stdout3,
         stderr,
@@ -679,7 +704,7 @@ function defaultSpawner(input) {
     });
     child.once("close", (code) => {
       clearTimeout(timer);
-      resolve12({
+      resolve13({
         exitCode: code,
         stdout: stdout3.trim(),
         stderr: stderr.trim(),
@@ -1467,25 +1492,32 @@ function coerceToToolCall(candidateJson, allowedNames) {
 var StormBreaker = class {
   windowSize;
   threshold;
+  isMutating;
   recent = [];
-  constructor(windowSize = 6, threshold = 3) {
+  constructor(windowSize = 6, threshold = 3, isMutating) {
     this.windowSize = windowSize;
     this.threshold = threshold;
+    this.isMutating = isMutating;
   }
   inspect(call) {
-    const sig = signature(call);
-    if (!sig) return { suppress: false };
-    const count = this.recent.reduce(
-      (n, [name, args]) => name === sig[0] && args === sig[1] ? n + 1 : n,
-      0
-    );
+    const name = call.function?.name;
+    if (!name) return { suppress: false };
+    const args = call.function?.arguments ?? "";
+    const mutating = this.isMutating ? this.isMutating(call) : false;
+    const readOnly = !mutating;
+    if (mutating) {
+      for (let i = this.recent.length - 1; i >= 0; i--) {
+        if (this.recent[i].readOnly) this.recent.splice(i, 1);
+      }
+    }
+    const count = this.recent.reduce((n, e) => e.name === name && e.args === args ? n + 1 : n, 0);
     if (count >= this.threshold - 1) {
       return {
         suppress: true,
-        reason: `call-storm suppressed: ${sig[0]} called with identical args ${count + 1} times within window=${this.windowSize}`
+        reason: `call-storm suppressed: ${name} called with identical args ${count + 1} times within window=${this.windowSize}`
       };
     }
-    this.recent.push(sig);
+    this.recent.push({ name, args, readOnly });
     while (this.recent.length > this.windowSize) this.recent.shift();
     return { suppress: false };
   }
@@ -1493,11 +1525,6 @@ var StormBreaker = class {
     this.recent.length = 0;
   }
 };
-function signature(call) {
-  const name = call.function?.name;
-  if (!name) return null;
-  return [name, call.function?.arguments ?? ""];
-}
 
 // src/repair/truncation.ts
 function repairTruncatedJson(input) {
@@ -1575,7 +1602,7 @@ var ToolCallRepair = class {
   opts;
   constructor(opts) {
     this.opts = opts;
-    this.storm = new StormBreaker(opts.stormWindow ?? 6, opts.stormThreshold ?? 3);
+    this.storm = new StormBreaker(opts.stormWindow ?? 6, opts.stormThreshold ?? 3, opts.isMutating);
   }
   /**
    * Drop the StormBreaker's sliding window of recent (name, args)
@@ -1599,13 +1626,13 @@ var ToolCallRepair = class {
       allowedNames: this.opts.allowedToolNames,
       maxCalls: this.opts.maxScavenge ?? 4
     });
-    const seenSignatures = new Set(declaredCalls.map(signature2));
+    const seenSignatures = new Set(declaredCalls.map(signature));
     const merged = [...declaredCalls];
     for (const sc of scavenged.calls) {
-      if (!seenSignatures.has(signature2(sc))) {
+      if (!seenSignatures.has(signature(sc))) {
         merged.push(sc);
         report.scavenged++;
-        seenSignatures.add(signature2(sc));
+        seenSignatures.add(signature(sc));
       }
     }
     report.notes.push(...scavenged.notes);
@@ -1631,7 +1658,7 @@ var ToolCallRepair = class {
     return { calls: filtered, report };
   }
 };
-function signature2(call) {
+function signature(call) {
   return `${call.function?.name ?? ""}::${call.function?.arguments ?? ""}`;
 }
 
@@ -1770,6 +1797,12 @@ function outputCostUsd(model2, usage) {
   if (!p) return 0;
   return usage.completionTokens * p.output / 1e6;
 }
+function cacheSavingsUsd(model2, hitTokens) {
+  if (hitTokens <= 0) return 0;
+  const p = DEEPSEEK_PRICING[model2];
+  if (!p) return 0;
+  return hitTokens * (p.inputCacheMiss - p.inputCacheHit) / 1e6;
+}
 function claudeEquivalentCost(usage) {
   return (usage.promptTokens * CLAUDE_SONNET_PRICING.input + usage.completionTokens * CLAUDE_SONNET_PRICING.output) / 1e6;
 }
@@ -1860,6 +1893,13 @@ var CacheFirstLoop = class {
   branchOptions;
   /** See ReconfigurableOptions — mutable so `/effort` can flip mid-session. */
   reasoningEffort;
+  /**
+   * Auto-escalation toggle. `true` lets the loop self-promote to pro
+   * mid-turn (NEEDS_PRO marker / failure threshold); `false` keeps it
+   * pinned to `model`. Mutable so the dashboard's preset switcher can
+   * flip it live alongside `model`.
+   */
+  autoEscalate = true;
   sessionName;
   /**
    * Hook list, mutable so `/hooks reload` can swap it without
@@ -1924,6 +1964,7 @@ var CacheFirstLoop = class {
     this.tools = opts.tools ?? new ToolRegistry();
     this.model = opts.model ?? "deepseek-v4-flash";
     this.reasoningEffort = opts.reasoningEffort ?? "max";
+    if (opts.autoEscalate !== void 0) this.autoEscalate = opts.autoEscalate;
     this.maxToolIters = opts.maxToolIters ?? 64;
     this.hooks = opts.hooks ?? [];
     this.hookCwd = opts.hookCwd ?? process.cwd();
@@ -1941,7 +1982,26 @@ var CacheFirstLoop = class {
     this._streamPreference = opts.stream ?? true;
     this.stream = this.branchEnabled ? false : this._streamPreference;
     const allowedNames = /* @__PURE__ */ new Set([...this.prefix.toolSpecs.map((s) => s.function.name)]);
-    this.repair = new ToolCallRepair({ allowedToolNames: allowedNames });
+    const registry = this.tools;
+    const isMutating = (call) => {
+      const name = call.function?.name;
+      if (!name) return false;
+      const def = registry.get(name);
+      if (!def) return false;
+      if (def.readOnlyCheck) {
+        let args = {};
+        try {
+          args = JSON.parse(call.function?.arguments ?? "{}") ?? {};
+        } catch {
+        }
+        try {
+          if (def.readOnlyCheck(args)) return false;
+        } catch {
+        }
+      }
+      return def.readOnly !== true;
+    };
+    this.repair = new ToolCallRepair({ allowedToolNames: allowedNames, isMutating });
     this.sessionName = opts.session ?? null;
     if (this.sessionName) {
       const prior = loadSessionMessages(this.sessionName);
@@ -2122,6 +2182,7 @@ var CacheFirstLoop = class {
     if (opts.model !== void 0) this.model = opts.model;
     if (opts.stream !== void 0) this._streamPreference = opts.stream;
     if (opts.reasoningEffort !== void 0) this.reasoningEffort = opts.reasoningEffort;
+    if (opts.autoEscalate !== void 0) this.autoEscalate = opts.autoEscalate;
     if (opts.branch !== void 0) {
       if (typeof opts.branch === "number") {
         this.branchOptions = { budget: opts.branch };
@@ -2237,7 +2298,7 @@ var CacheFirstLoop = class {
       if (repair.truncationsFixed > 0) bump("truncated", repair.truncationsFixed);
       if (repair.stormsBroken > 0) bump("storm-broken", repair.stormsBroken);
     }
-    if (bumped && !this._escalateThisTurn && this._turnFailureCount >= FAILURE_ESCALATION_THRESHOLD) {
+    if (bumped && !this._escalateThisTurn && this.autoEscalate && this._turnFailureCount >= FAILURE_ESCALATION_THRESHOLD) {
       this._escalateThisTurn = true;
       return true;
     }
@@ -2442,8 +2503,8 @@ var CacheFirstLoop = class {
             }
           );
           for (let k = 0; k < budget; k++) {
-            const sample = queue.shift() ?? await new Promise((resolve12) => {
-              waiter = resolve12;
+            const sample = queue.shift() ?? await new Promise((resolve13) => {
+              waiter = resolve13;
             });
             yield {
               turn: this._turn,
@@ -2482,7 +2543,7 @@ var CacheFirstLoop = class {
           const callBuf = /* @__PURE__ */ new Map();
           const readyIndices = /* @__PURE__ */ new Set();
           const callModel = this.modelForCurrentCall();
-          const bufferForEscalation = callModel !== ESCALATION_MODEL;
+          const bufferForEscalation = this.autoEscalate && callModel !== ESCALATION_MODEL;
           let escalationBuf = "";
           let escalationBufFlushed = false;
           for await (const chunk of this.client.stream({
@@ -2594,7 +2655,7 @@ var CacheFirstLoop = class {
         };
         return;
       }
-      if (this.modelForCurrentCall() !== ESCALATION_MODEL && this.isEscalationRequest(assistantContent)) {
+      if (this.autoEscalate && this.modelForCurrentCall() !== ESCALATION_MODEL && this.isEscalationRequest(assistantContent)) {
         const { reason } = this.parseEscalationMarker(assistantContent);
         this._escalateThisTurn = true;
         const reasonSuffix = reason ? ` \u2014 ${reason}` : "";
@@ -3176,6 +3237,9 @@ var DEFAULT_PICKER_IGNORE_DIRS = [
   "venv",
   "__pycache__"
 ];
+function listFilesSync(root, opts = {}) {
+  return listFilesWithStatsSync(root, opts).map((e) => e.path);
+}
 function listFilesWithStatsSync(root, opts = {}) {
   const maxResults = Math.max(1, opts.maxResults ?? 500);
   const ignore = new Set(opts.ignoreDirs ?? DEFAULT_PICKER_IGNORE_DIRS);
@@ -5173,7 +5237,7 @@ async function runCommand(cmd, opts) {
   };
   const { bin, args, spawnOverrides } = prepareSpawn(argv);
   const effectiveSpawnOpts = { ...spawnOpts, ...spawnOverrides };
-  return await new Promise((resolve12, reject) => {
+  return await new Promise((resolve13, reject) => {
     let child;
     try {
       child = spawn3(bin, args, effectiveSpawnOpts);
@@ -5218,7 +5282,7 @@ async function runCommand(cmd, opts) {
       const output = buf.length > maxChars ? `${buf.slice(0, maxChars)}
 
 [\u2026 truncated ${buf.length - maxChars} chars \u2026]` : buf;
-      resolve12({ exitCode: code, output, timedOut });
+      resolve13({ exitCode: code, output, timedOut });
     });
   });
 }
@@ -6422,7 +6486,7 @@ var McpClient = class {
     const id = this.nextId++;
     const frame = { jsonrpc: "2.0", id, method, params };
     let abortHandler = null;
-    const promise = new Promise((resolve12, reject) => {
+    const promise = new Promise((resolve13, reject) => {
       const timeout = setTimeout(() => {
         this.pending.delete(id);
         if (abortHandler && signal) signal.removeEventListener("abort", abortHandler);
@@ -6431,7 +6495,7 @@ var McpClient = class {
         );
       }, this.requestTimeoutMs);
       this.pending.set(id, {
-        resolve: resolve12,
+        resolve: resolve13,
         reject,
         timeout
       });
@@ -6554,12 +6618,12 @@ var StdioTransport = class {
   }
   async send(message) {
     if (this.closed) throw new Error("MCP transport is closed");
-    return new Promise((resolve12, reject) => {
+    return new Promise((resolve13, reject) => {
       const line = `${JSON.stringify(message)}
 `;
       this.child.stdin.write(line, "utf8", (err) => {
         if (err) reject(err);
-        else resolve12();
+        else resolve13();
       });
     });
   }
@@ -6570,8 +6634,8 @@ var StdioTransport = class {
         continue;
       }
       if (this.closed) return;
-      const next = await new Promise((resolve12) => {
-        this.waiters.push(resolve12);
+      const next = await new Promise((resolve13) => {
+        this.waiters.push(resolve13);
       });
       if (next === null) return;
       yield next;
@@ -6637,8 +6701,8 @@ var SseTransport = class {
   constructor(opts) {
     this.url = opts.url;
     this.headers = opts.headers ?? {};
-    this.endpointReady = new Promise((resolve12, reject) => {
-      this.resolveEndpoint = resolve12;
+    this.endpointReady = new Promise((resolve13, reject) => {
+      this.resolveEndpoint = resolve13;
       this.rejectEndpoint = reject;
     });
     this.endpointReady.catch(() => void 0);
@@ -6665,8 +6729,8 @@ var SseTransport = class {
         continue;
       }
       if (this.closed) return;
-      const next = await new Promise((resolve12) => {
-        this.waiters.push(resolve12);
+      const next = await new Promise((resolve13) => {
+        this.waiters.push(resolve13);
       });
       if (next === null) return;
       yield next;
@@ -6760,6 +6824,159 @@ var SseTransport = class {
   }
 };
 
+// src/mcp/streamable-http.ts
+import { createParser as createParser3 } from "eventsource-parser";
+var SESSION_HEADER = "mcp-session-id";
+var StreamableHttpTransport = class {
+  url;
+  extraHeaders;
+  queue = [];
+  waiters = [];
+  controller = new AbortController();
+  /** Session id minted by server on (typically) the initialize response. */
+  sessionId = null;
+  closed = false;
+  /** Background SSE read-loops kicked off by send(); awaited on close(). */
+  streams = /* @__PURE__ */ new Set();
+  constructor(opts) {
+    this.url = opts.url;
+    this.extraHeaders = opts.headers ?? {};
+  }
+  async send(message) {
+    if (this.closed) throw new Error("MCP Streamable HTTP transport is closed");
+    const headers = {
+      "content-type": "application/json",
+      // Both accepted — server picks. application/json first signals a
+      // mild preference for the simpler shape when the response is a
+      // single message.
+      accept: "application/json, text/event-stream",
+      ...this.extraHeaders
+    };
+    if (this.sessionId !== null) headers["mcp-session-id"] = this.sessionId;
+    let res;
+    try {
+      res = await fetch(this.url, {
+        method: "POST",
+        headers,
+        body: JSON.stringify(message),
+        signal: this.controller.signal
+      });
+    } catch (err) {
+      throw new Error(`MCP Streamable HTTP POST ${this.url} failed: ${err.message}`);
+    }
+    const serverSessionId = res.headers.get(SESSION_HEADER);
+    if (serverSessionId && this.sessionId === null) {
+      this.sessionId = serverSessionId;
+    }
+    if (res.status === 404 && this.sessionId !== null) {
+      await res.body?.cancel().catch(() => void 0);
+      throw new Error(
+        `MCP Streamable HTTP session expired (server returned 404 with Mcp-Session-Id "${this.sessionId}"). Reinitialize the client.`
+      );
+    }
+    if (!res.ok) {
+      const body = await res.text().catch(() => "");
+      throw new Error(
+        `MCP Streamable HTTP POST ${this.url} \u2192 ${res.status} ${res.statusText}${body ? `: ${body}` : ""}`
+      );
+    }
+    if (res.status === 202) {
+      await res.body?.cancel().catch(() => void 0);
+      return;
+    }
+    const ct = (res.headers.get("content-type") ?? "").toLowerCase();
+    if (ct.includes("application/json")) {
+      let parsed;
+      try {
+        parsed = await res.json();
+      } catch (err) {
+        throw new Error(`MCP Streamable HTTP body wasn't valid JSON: ${err.message}`);
+      }
+      if (Array.isArray(parsed)) {
+        for (const item of parsed) this.pushMessage(item);
+      } else {
+        this.pushMessage(parsed);
+      }
+      return;
+    }
+    if (ct.includes("text/event-stream")) {
+      if (!res.body) {
+        throw new Error("MCP Streamable HTTP SSE response had no body");
+      }
+      const stream = this.consumeStream(res.body);
+      this.streams.add(stream);
+      stream.finally(() => this.streams.delete(stream));
+      return;
+    }
+    await res.body?.cancel().catch(() => void 0);
+  }
+  async *messages() {
+    while (true) {
+      if (this.queue.length > 0) {
+        yield this.queue.shift();
+        continue;
+      }
+      if (this.closed) return;
+      const next = await new Promise((resolve13) => {
+        this.waiters.push(resolve13);
+      });
+      if (next === null) return;
+      yield next;
+    }
+  }
+  async close() {
+    if (this.closed) return;
+    this.closed = true;
+    while (this.waiters.length > 0) this.waiters.shift()(null);
+    try {
+      this.controller.abort();
+    } catch {
+    }
+    await Promise.allSettled(Array.from(this.streams));
+  }
+  /** Visible for tests — confirm session header round-trip. */
+  getSessionId() {
+    return this.sessionId;
+  }
+  // ---------- internals ----------
+  async consumeStream(body) {
+    const parser = createParser3({
+      onEvent: (ev) => {
+        const type = ev.event ?? "message";
+        if (type !== "message") return;
+        try {
+          const parsed = JSON.parse(ev.data);
+          this.pushMessage(parsed);
+        } catch {
+        }
+      }
+    });
+    const decoder = new TextDecoder();
+    try {
+      for await (const chunk of body) {
+        if (this.closed) break;
+        parser.feed(decoder.decode(chunk, { stream: true }));
+      }
+    } catch (err) {
+      if (!this.closed) {
+        this.pushMessage({
+          jsonrpc: "2.0",
+          id: null,
+          error: {
+            code: -32e3,
+            message: `Streamable HTTP stream error: ${err.message}`
+          }
+        });
+      }
+    }
+  }
+  pushMessage(msg) {
+    const waiter = this.waiters.shift();
+    if (waiter) waiter(msg);
+    else this.queue.push(msg);
+  }
+};
+
 // src/mcp/shell-split.ts
 function shellSplit(input) {
   const tokens = [];
@@ -6812,6 +7029,7 @@ function shellSplit(input) {
 // src/mcp/spec.ts
 var NAME_PREFIX = /^([a-zA-Z_][a-zA-Z0-9_]*)=(.*)$/;
 var HTTP_URL = /^https?:\/\//i;
+var STREAMABLE_PREFIX = /^streamable\+(https?:\/\/.+)$/i;
 function parseMcpSpec(input) {
   const trimmed = input.trim();
   if (!trimmed) {
@@ -6823,6 +7041,10 @@ function parseMcpSpec(input) {
   if (!body) {
     throw new Error(`MCP spec has name but no command: ${input}`);
   }
+  const streamMatch = STREAMABLE_PREFIX.exec(body);
+  if (streamMatch) {
+    return { transport: "streamable-http", name, url: streamMatch[1] };
+  }
   if (HTTP_URL.test(body)) {
     return { transport: "sse", name, url: body };
   }
@@ -7173,7 +7395,8 @@ function emptyBucket(label, since) {
     cacheHitTokens: 0,
     cacheMissTokens: 0,
     costUsd: 0,
-    claudeEquivUsd: 0
+    claudeEquivUsd: 0,
+    cacheSavingsUsd: 0
   };
 }
 function addToBucket(b, r) {
@@ -7184,6 +7407,7 @@ function addToBucket(b, r) {
   b.cacheMissTokens += r.cacheMissTokens;
   b.costUsd += r.costUsd;
   b.claudeEquivUsd += r.claudeEquivUsd;
+  b.cacheSavingsUsd += cacheSavingsUsd(r.model, r.cacheHitTokens);
 }
 function aggregateUsage(records, opts = {}) {
   const now = opts.now ?? Date.now();
@@ -7254,7 +7478,7 @@ function formatLogSize(path5 = defaultUsageLogPath()) {
 }
 
 // src/cli/commands/chat.tsx
-import { existsSync as existsSync16, statSync as statSync9 } from "fs";
+import { existsSync as existsSync22, statSync as statSync13 } from "fs";
 import { render } from "ink";
 import React27, { useState as useState12 } from "react";
 
@@ -7457,22 +7681,1660 @@ function listPlanArchives(sessionName) {
     } catch {
     }
   }
-  summaries.sort((a, b) => b.completedAt.localeCompare(a.completedAt));
-  return summaries;
-}
-function relativeTime(updatedAt, now = Date.now()) {
-  const t2 = Date.parse(updatedAt);
-  if (Number.isNaN(t2)) return updatedAt;
-  const diffMs = Math.max(0, now - t2);
-  const sec = Math.floor(diffMs / 1e3);
-  if (sec < 60) return `${sec}s ago`;
-  const min = Math.floor(sec / 60);
-  if (min < 60) return `${min}m ago`;
-  const hr = Math.floor(min / 60);
-  if (hr < 24) return `${hr}h ago`;
-  const day = Math.floor(hr / 24);
-  if (day < 7) return `${day}d ago`;
-  return updatedAt.slice(0, 10);
+  summaries.sort((a, b) => b.completedAt.localeCompare(a.completedAt));
+  return summaries;
+}
+function relativeTime(updatedAt, now = Date.now()) {
+  const t2 = Date.parse(updatedAt);
+  if (Number.isNaN(t2)) return updatedAt;
+  const diffMs = Math.max(0, now - t2);
+  const sec = Math.floor(diffMs / 1e3);
+  if (sec < 60) return `${sec}s ago`;
+  const min = Math.floor(sec / 60);
+  if (min < 60) return `${min}m ago`;
+  const hr = Math.floor(min / 60);
+  if (hr < 24) return `${hr}h ago`;
+  const day = Math.floor(hr / 24);
+  if (day < 7) return `${day}d ago`;
+  return updatedAt.slice(0, 10);
+}
+
+// src/server/index.ts
+import { randomBytes } from "crypto";
+import { createServer } from "http";
+
+// src/server/api/events.ts
+var PING_INTERVAL_MS = 25e3;
+function handleEvents(req, res, ctx) {
+  if (!ctx.subscribeEvents) {
+    res.writeHead(503, { "content-type": "application/json" });
+    res.end(JSON.stringify({ error: "event stream requires an attached dashboard session." }));
+    return;
+  }
+  res.writeHead(200, {
+    "content-type": "text/event-stream",
+    "cache-control": "no-cache",
+    connection: "keep-alive",
+    "x-accel-buffering": "no"
+    // disable Nginx-style buffering if anything proxies us
+  });
+  const writeEvent = (event) => {
+    if (res.writableEnded) return;
+    try {
+      res.write(`data: ${JSON.stringify(event)}
+
+`);
+    } catch {
+    }
+  };
+  if (ctx.isBusy) writeEvent({ kind: "busy-change", busy: ctx.isBusy() });
+  const unsubscribe = ctx.subscribeEvents(writeEvent);
+  const ping = setInterval(() => writeEvent({ kind: "ping" }), PING_INTERVAL_MS);
+  ping.unref?.();
+  const cleanup = () => {
+    clearInterval(ping);
+    try {
+      unsubscribe();
+    } catch {
+    }
+    if (!res.writableEnded) {
+      try {
+        res.end();
+      } catch {
+      }
+    }
+  };
+  req.on("close", cleanup);
+  req.on("error", cleanup);
+  res.on("close", cleanup);
+}
+
+// src/server/assets.ts
+import { readFileSync as readFileSync13 } from "fs";
+import { dirname as dirname10, join as join11 } from "path";
+import { fileURLToPath as fileURLToPath3 } from "url";
+function resolveAssetDir() {
+  const here = dirname10(fileURLToPath3(import.meta.url));
+  const candidates = [
+    join11(here, "..", "..", "dashboard"),
+    join11(here, "..", "dashboard"),
+    join11(here, "dashboard")
+  ];
+  for (const c of candidates) {
+    try {
+      readFileSync13(join11(c, "index.html"), "utf8");
+      return c;
+    } catch {
+    }
+  }
+  return candidates[0];
+}
+var ASSET_DIR = resolveAssetDir();
+var cachedIndex = null;
+var cachedApp = null;
+var cachedCss = null;
+var cachedCm = null;
+function loadIndexTemplate() {
+  if (cachedIndex) return cachedIndex;
+  cachedIndex = readFileSync13(join11(ASSET_DIR, "index.html"), "utf8");
+  return cachedIndex;
+}
+function loadApp() {
+  if (cachedApp) return cachedApp;
+  cachedApp = readFileSync13(join11(ASSET_DIR, "app.js"), "utf8");
+  return cachedApp;
+}
+function loadCss() {
+  if (cachedCss) return cachedCss;
+  cachedCss = readFileSync13(join11(ASSET_DIR, "app.css"), "utf8");
+  return cachedCss;
+}
+function loadCm() {
+  if (cachedCm) return cachedCm;
+  cachedCm = readFileSync13(join11(ASSET_DIR, "codemirror.js"), "utf8");
+  return cachedCm;
+}
+function renderIndexHtml(token, mode2) {
+  const tpl = loadIndexTemplate();
+  const safeToken = token.replace(/[^a-zA-Z0-9]/g, "");
+  return tpl.replaceAll("__REASONIX_TOKEN__", safeToken).replaceAll("__REASONIX_MODE__", mode2);
+}
+function serveAsset(name) {
+  if (name === "app.js") {
+    return { body: loadApp(), contentType: "application/javascript; charset=utf-8" };
+  }
+  if (name === "app.css") {
+    return { body: loadCss(), contentType: "text/css; charset=utf-8" };
+  }
+  if (name === "codemirror.js") {
+    return { body: loadCm(), contentType: "application/javascript; charset=utf-8" };
+  }
+  return null;
+}
+
+// src/server/api/abort.ts
+async function handleAbort(method, _rest, _body, ctx) {
+  if (method !== "POST") {
+    return { status: 405, body: { error: "POST only" } };
+  }
+  if (!ctx.abortTurn) {
+    return {
+      status: 503,
+      body: { error: "abort requires an attached dashboard session." }
+    };
+  }
+  ctx.abortTurn();
+  ctx.audit?.({ ts: Date.now(), action: "abort-turn" });
+  return { status: 202, body: { aborted: true } };
+}
+
+// src/server/api/edit-mode.ts
+function parseBody(raw) {
+  if (!raw) return {};
+  try {
+    const parsed = JSON.parse(raw);
+    return typeof parsed === "object" && parsed !== null ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+var VALID = /* @__PURE__ */ new Set(["review", "auto", "yolo"]);
+async function handleEditMode(method, _rest, body, ctx) {
+  if (method === "GET") {
+    return {
+      status: 200,
+      body: { mode: ctx.getEditMode?.() ?? null }
+    };
+  }
+  if (method === "POST") {
+    if (!ctx.setEditMode) {
+      return {
+        status: 503,
+        body: { error: "edit-mode mutation requires an attached `reasonix code` session." }
+      };
+    }
+    const { mode: mode2 } = parseBody(body);
+    if (typeof mode2 !== "string" || !VALID.has(mode2)) {
+      return { status: 400, body: { error: "mode must be review | auto | yolo" } };
+    }
+    const resolved = ctx.setEditMode(mode2);
+    ctx.audit?.({ ts: Date.now(), action: "set-edit-mode", payload: { mode: resolved } });
+    return { status: 200, body: { mode: resolved } };
+  }
+  return { status: 405, body: { error: "GET or POST only" } };
+}
+
+// src/server/api/file.ts
+import {
+  closeSync,
+  existsSync as existsSync11,
+  mkdirSync as mkdirSync8,
+  openSync,
+  readFileSync as readFileSync14,
+  readSync,
+  statSync as statSync6,
+  writeFileSync as writeFileSync7
+} from "fs";
+import { dirname as dirname11, isAbsolute as isAbsolute4, resolve as resolve7, sep as sep2 } from "path";
+var MAX_BYTES = 4 * 1024 * 1024;
+var BINARY_PROBE_BYTES = 8 * 1024;
+function parseBody2(raw) {
+  if (!raw) return {};
+  try {
+    const parsed = JSON.parse(raw);
+    return typeof parsed === "object" && parsed !== null ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+function safeResolve(root, requested) {
+  const rootAbs = resolve7(root);
+  const target = isAbsolute4(requested) ? resolve7(requested) : resolve7(rootAbs, requested);
+  if (target !== rootAbs && !target.startsWith(rootAbs + sep2)) return null;
+  return target;
+}
+function looksBinary(path5) {
+  let fd = null;
+  try {
+    fd = openSync(path5, "r");
+    const buf = Buffer.alloc(BINARY_PROBE_BYTES);
+    const len = readSync(fd, buf, 0, BINARY_PROBE_BYTES, 0);
+    for (let i = 0; i < len; i++) {
+      if (buf[i] === 0) return true;
+    }
+    return false;
+  } catch {
+    return false;
+  } finally {
+    if (fd !== null) {
+      try {
+        closeSync(fd);
+      } catch {
+      }
+    }
+  }
+}
+async function handleFiles(method, _rest, _body, ctx) {
+  if (method !== "GET") {
+    return { status: 405, body: { error: "GET only" } };
+  }
+  const cwd2 = ctx.getCurrentCwd?.();
+  if (!cwd2) {
+    return {
+      status: 503,
+      body: { error: "no project root \u2014 open `/dashboard` from `reasonix code`" }
+    };
+  }
+  const files = listFilesSync(cwd2, { maxResults: 5e3 });
+  return {
+    status: 200,
+    body: {
+      root: cwd2,
+      count: files.length,
+      truncated: files.length === 5e3,
+      files
+    }
+  };
+}
+async function handleFile(method, rest, body, ctx) {
+  const cwd2 = ctx.getCurrentCwd?.();
+  if (!cwd2) {
+    return { status: 503, body: { error: "no project root" } };
+  }
+  const requested = rest.map((s) => decodeURIComponent(s)).join("/");
+  if (!requested) {
+    return { status: 400, body: { error: "path required (use /api/file/<path>)" } };
+  }
+  const target = safeResolve(cwd2, requested);
+  if (!target) {
+    return { status: 403, body: { error: "path escapes project root" } };
+  }
+  if (method === "GET") {
+    if (!existsSync11(target)) {
+      return { status: 404, body: { error: "file not found" } };
+    }
+    const stat = statSync6(target);
+    if (stat.isDirectory()) {
+      return { status: 400, body: { error: "path is a directory" } };
+    }
+    if (stat.size > MAX_BYTES) {
+      return {
+        status: 413,
+        body: { error: `file too large (${stat.size} bytes; cap ${MAX_BYTES})` }
+      };
+    }
+    if (looksBinary(target)) {
+      return {
+        status: 415,
+        body: { error: "file appears to be binary \u2014 editor refuses to load." }
+      };
+    }
+    const content = readFileSync14(target, "utf8");
+    return {
+      status: 200,
+      body: {
+        path: requested,
+        absolute: target,
+        size: stat.size,
+        mtime: stat.mtime.getTime(),
+        content
+      }
+    };
+  }
+  if (method === "POST") {
+    const { content } = parseBody2(body);
+    if (typeof content !== "string") {
+      return { status: 400, body: { error: "content (string) required" } };
+    }
+    if (Buffer.byteLength(content, "utf8") > MAX_BYTES) {
+      return { status: 413, body: { error: "content exceeds 4 MB cap" } };
+    }
+    if (existsSync11(target) && statSync6(target).isDirectory()) {
+      return { status: 400, body: { error: "path is a directory" } };
+    }
+    const parent = dirname11(target);
+    if (!existsSync11(parent)) {
+      mkdirSync8(parent, { recursive: true });
+    }
+    writeFileSync7(target, content, "utf8");
+    ctx.audit?.({
+      ts: Date.now(),
+      action: "save-file",
+      payload: { path: requested, bytes: Buffer.byteLength(content, "utf8") }
+    });
+    const stat = statSync6(target);
+    return {
+      status: 200,
+      body: {
+        saved: true,
+        path: requested,
+        size: stat.size,
+        mtime: stat.mtime.getTime()
+      }
+    };
+  }
+  return { status: 405, body: { error: "GET or POST only" } };
+}
+
+// src/server/api/health.ts
+import { existsSync as existsSync12, readdirSync as readdirSync4, statSync as statSync7 } from "fs";
+import { homedir as homedir6 } from "os";
+import { join as join12 } from "path";
+function dirSize(path5) {
+  if (!existsSync12(path5)) return { path: path5, exists: false, fileCount: 0, totalBytes: 0 };
+  let fileCount = 0;
+  let totalBytes = 0;
+  try {
+    const entries = readdirSync4(path5);
+    for (const name of entries) {
+      const full = join12(path5, name);
+      try {
+        const s = statSync7(full);
+        if (s.isFile()) {
+          fileCount++;
+          totalBytes += s.size;
+        } else if (s.isDirectory()) {
+          try {
+            const inner = readdirSync4(full);
+            for (const child of inner) {
+              try {
+                const cs = statSync7(join12(full, child));
+                if (cs.isFile()) {
+                  fileCount++;
+                  totalBytes += cs.size;
+                }
+              } catch {
+              }
+            }
+          } catch {
+          }
+        }
+      } catch {
+      }
+    }
+  } catch {
+    return { path: path5, exists: true, fileCount: 0, totalBytes: 0 };
+  }
+  return { path: path5, exists: true, fileCount, totalBytes };
+}
+async function handleHealth(method, _rest, _body, ctx) {
+  if (method !== "GET") {
+    return { status: 405, body: { error: "GET only" } };
+  }
+  const home = homedir6();
+  const reasonixHome = join12(home, ".reasonix");
+  const sessionsStat = dirSize(join12(reasonixHome, "sessions"));
+  const memoryStat = dirSize(join12(reasonixHome, "memory"));
+  const semanticStat = dirSize(join12(reasonixHome, "semantic"));
+  let usageBytes = 0;
+  if (existsSync12(ctx.usageLogPath)) {
+    try {
+      usageBytes = statSync7(ctx.usageLogPath).size;
+    } catch {
+    }
+  }
+  const sessions2 = listSessions();
+  return {
+    status: 200,
+    body: {
+      version: VERSION,
+      latestVersion: ctx.getLatestVersion?.() ?? null,
+      reasonixHome,
+      sessions: {
+        path: sessionsStat.path,
+        count: sessions2.length,
+        totalBytes: sessionsStat.totalBytes
+      },
+      memory: {
+        path: memoryStat.path,
+        fileCount: memoryStat.fileCount,
+        totalBytes: memoryStat.totalBytes
+      },
+      semantic: {
+        path: semanticStat.path,
+        exists: semanticStat.exists,
+        fileCount: semanticStat.fileCount,
+        totalBytes: semanticStat.totalBytes
+      },
+      usageLog: {
+        path: ctx.usageLogPath,
+        bytes: usageBytes
+      },
+      jobs: ctx.jobs ? ctx.jobs.list().length : null
+    }
+  };
+}
+
+// src/server/api/hooks.ts
+import { existsSync as existsSync13, mkdirSync as mkdirSync9, readFileSync as readFileSync15, writeFileSync as writeFileSync8 } from "fs";
+import { dirname as dirname12 } from "path";
+function parseBody3(raw) {
+  if (!raw) return {};
+  try {
+    const parsed = JSON.parse(raw);
+    return typeof parsed === "object" && parsed !== null ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+function readSettingsFile2(path5) {
+  if (!existsSync13(path5)) return {};
+  try {
+    const raw = readFileSync15(path5, "utf8");
+    const parsed = JSON.parse(raw);
+    return typeof parsed === "object" && parsed !== null ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+function writeSettingsFile(path5, hooksBlock) {
+  const existing = readSettingsFile2(path5);
+  existing.hooks = hooksBlock;
+  mkdirSync9(dirname12(path5), { recursive: true });
+  writeFileSync8(path5, `${JSON.stringify(existing, null, 2)}
+`, "utf8");
+}
+async function handleHooks(method, rest, body, ctx) {
+  if (method === "GET" && rest.length === 0) {
+    const projectPath = ctx.getCurrentCwd ? projectSettingsPath(ctx.getCurrentCwd() ?? "") : null;
+    const globalPath = globalSettingsPath();
+    const projectFile = projectPath ? readSettingsFile2(projectPath) : {};
+    const globalFile = readSettingsFile2(globalPath);
+    const resolved = loadHooks({ projectRoot: ctx.getCurrentCwd?.() });
+    return {
+      status: 200,
+      body: {
+        project: {
+          path: projectPath,
+          hooks: projectFile.hooks ?? {}
+        },
+        global: {
+          path: globalPath,
+          hooks: globalFile.hooks ?? {}
+        },
+        resolved,
+        events: HOOK_EVENTS
+      }
+    };
+  }
+  if (method === "POST" && rest[0] === "save") {
+    const { scope, hooks: hooks2 } = parseBody3(body);
+    if (scope !== "project" && scope !== "global") {
+      return { status: 400, body: { error: "scope must be project | global" } };
+    }
+    if (typeof hooks2 !== "object" || hooks2 === null) {
+      return { status: 400, body: { error: "hooks must be an object keyed by event name" } };
+    }
+    let path5;
+    if (scope === "project") {
+      const cwd2 = ctx.getCurrentCwd?.();
+      if (!cwd2) {
+        return {
+          status: 503,
+          body: { error: "no active project \u2014 open `/dashboard` from inside `reasonix code`" }
+        };
+      }
+      path5 = projectSettingsPath(cwd2);
+    } else {
+      path5 = globalSettingsPath();
+    }
+    if (!path5) {
+      return { status: 500, body: { error: "could not resolve settings path" } };
+    }
+    writeSettingsFile(path5, hooks2);
+    ctx.audit?.({ ts: Date.now(), action: "save-hooks", payload: { scope, path: path5 } });
+    return { status: 200, body: { saved: true, path: path5 } };
+  }
+  if (method === "POST" && rest[0] === "reload") {
+    if (!ctx.reloadHooks) {
+      return {
+        status: 503,
+        body: { error: "reload requires an attached session \u2014 App.tsx wires the callback" }
+      };
+    }
+    const count = ctx.reloadHooks();
+    ctx.audit?.({ ts: Date.now(), action: "reload-hooks", payload: { count } });
+    return { status: 200, body: { reloaded: true, count } };
+  }
+  return { status: 405, body: { error: `method ${method} not supported on this path` } };
+}
+
+// src/server/api/mcp.ts
+function parseBody4(raw) {
+  if (!raw) return {};
+  try {
+    const parsed = JSON.parse(raw);
+    return typeof parsed === "object" && parsed !== null ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+async function handleMcp(method, rest, body, ctx) {
+  if (method === "GET" && rest.length === 0) {
+    const servers = (ctx.mcpServers ?? []).map((s) => ({
+      label: s.label,
+      spec: s.spec,
+      toolCount: s.toolCount,
+      protocolVersion: s.report.protocolVersion,
+      serverInfo: s.report.serverInfo,
+      capabilities: s.report.capabilities,
+      tools: s.report.tools.supported ? s.report.tools.items : [],
+      resources: s.report.resources.supported ? s.report.resources.items : [],
+      prompts: s.report.prompts.supported ? s.report.prompts.items : [],
+      instructions: s.report.instructions ?? null
+    }));
+    return {
+      status: 200,
+      body: {
+        servers,
+        canHotReload: Boolean(ctx.reloadMcp),
+        canInvoke: Boolean(ctx.invokeMcpTool)
+      }
+    };
+  }
+  if (method === "GET" && rest[0] === "specs") {
+    const cfg = readConfig(ctx.configPath);
+    return { status: 200, body: { specs: cfg.mcp ?? [] } };
+  }
+  if (method === "POST" && rest[0] === "specs") {
+    const { spec } = parseBody4(body);
+    if (typeof spec !== "string" || !spec.trim()) {
+      return { status: 400, body: { error: "spec (non-empty string) required" } };
+    }
+    const cfg = readConfig(ctx.configPath);
+    const list = cfg.mcp ?? [];
+    if (list.includes(spec)) {
+      return { status: 200, body: { added: false, alreadyPresent: true } };
+    }
+    cfg.mcp = [...list, spec.trim()];
+    writeConfig(cfg, ctx.configPath);
+    ctx.audit?.({ ts: Date.now(), action: "add-mcp-spec", payload: { spec } });
+    return { status: 200, body: { added: true, requiresRestart: !ctx.reloadMcp } };
+  }
+  if (method === "DELETE" && rest[0] === "specs") {
+    const { spec } = parseBody4(body);
+    if (typeof spec !== "string") {
+      return { status: 400, body: { error: "spec (string) required" } };
+    }
+    const cfg = readConfig(ctx.configPath);
+    const list = cfg.mcp ?? [];
+    if (!list.includes(spec)) {
+      return { status: 200, body: { removed: false } };
+    }
+    cfg.mcp = list.filter((s) => s !== spec);
+    writeConfig(cfg, ctx.configPath);
+    ctx.audit?.({ ts: Date.now(), action: "remove-mcp-spec", payload: { spec } });
+    return { status: 200, body: { removed: true, requiresRestart: !ctx.reloadMcp } };
+  }
+  if (method === "POST" && rest[0] === "reload") {
+    if (!ctx.reloadMcp) {
+      return {
+        status: 503,
+        body: {
+          error: "live MCP reload not wired in this session \u2014 restart `reasonix code` to apply spec edits."
+        }
+      };
+    }
+    const count = await ctx.reloadMcp();
+    return { status: 200, body: { reloaded: true, count } };
+  }
+  if (method === "POST" && rest[0] === "invoke") {
+    if (!ctx.invokeMcpTool) {
+      return {
+        status: 503,
+        body: { error: "MCP invocation requires an attached session." }
+      };
+    }
+    const { server, tool: tool2, args } = parseBody4(body);
+    if (typeof server !== "string" || typeof tool2 !== "string") {
+      return { status: 400, body: { error: "server + tool (strings) required" } };
+    }
+    try {
+      const result = await ctx.invokeMcpTool(
+        server,
+        tool2,
+        typeof args === "object" && args !== null ? args : {}
+      );
+      return { status: 200, body: { result } };
+    } catch (err) {
+      return { status: 500, body: { error: err.message } };
+    }
+  }
+  return { status: 405, body: { error: `method ${method} not supported on this path` } };
+}
+
+// src/server/api/memory.ts
+import { createHash as createHash2 } from "crypto";
+import {
+  existsSync as existsSync14,
+  mkdirSync as mkdirSync10,
+  readFileSync as readFileSync16,
+  readdirSync as readdirSync5,
+  statSync as statSync8,
+  unlinkSync as unlinkSync5,
+  writeFileSync as writeFileSync9
+} from "fs";
+import { homedir as homedir7 } from "os";
+import { dirname as dirname13, join as join13, resolve as resolvePath } from "path";
+function projectHash2(rootDir) {
+  return createHash2("sha1").update(resolvePath(rootDir)).digest("hex").slice(0, 16);
+}
+function globalMemoryDir() {
+  return join13(homedir7(), ".reasonix", "memory", "global");
+}
+function projectMemoryDir(rootDir) {
+  return join13(homedir7(), ".reasonix", "memory", projectHash2(rootDir));
+}
+function parseBody5(raw) {
+  if (!raw) return {};
+  try {
+    const parsed = JSON.parse(raw);
+    return typeof parsed === "object" && parsed !== null ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+var SAFE_NAME = /^[a-zA-Z0-9][a-zA-Z0-9._-]{0,63}$/;
+function listMemoryFiles(dir) {
+  if (!existsSync14(dir)) return [];
+  try {
+    return readdirSync5(dir).filter((f) => f.endsWith(".md")).map((f) => {
+      const stat = statSync8(join13(dir, f));
+      return {
+        name: f.replace(/\.md$/, ""),
+        size: stat.size,
+        mtime: stat.mtime.getTime()
+      };
+    }).sort((a, b) => b.mtime - a.mtime);
+  } catch {
+    return [];
+  }
+}
+async function handleMemory(method, rest, body, ctx) {
+  const cwd2 = ctx.getCurrentCwd?.();
+  const globalDir = globalMemoryDir();
+  const projectMemDir = cwd2 ? projectMemoryDir(cwd2) : "";
+  if (method === "GET" && rest.length === 0) {
+    const projectMemoryPath = cwd2 ? join13(cwd2, PROJECT_MEMORY_FILE) : null;
+    const projectMemoryExists = projectMemoryPath ? existsSync14(projectMemoryPath) : false;
+    return {
+      status: 200,
+      body: {
+        project: {
+          path: projectMemoryPath,
+          exists: projectMemoryExists,
+          file: PROJECT_MEMORY_FILE
+        },
+        global: {
+          path: globalDir,
+          files: listMemoryFiles(globalDir)
+        },
+        projectMem: {
+          path: projectMemDir,
+          files: projectMemDir ? listMemoryFiles(projectMemDir) : []
+        }
+      }
+    };
+  }
+  const [scope, ...nameParts] = rest;
+  const name = nameParts.join("/");
+  if (method === "GET") {
+    if (scope === "project") {
+      if (!cwd2) return { status: 503, body: { error: "no active project" } };
+      const path5 = join13(cwd2, PROJECT_MEMORY_FILE);
+      if (!existsSync14(path5)) return { status: 404, body: { error: "REASONIX.md not found" } };
+      return { status: 200, body: { path: path5, body: readFileSync16(path5, "utf8") } };
+    }
+    if ((scope === "global" || scope === "project-mem") && name && SAFE_NAME.test(name)) {
+      const dir = scope === "global" ? globalDir : projectMemDir;
+      if (!dir) return { status: 503, body: { error: "no project root for project-mem" } };
+      const path5 = join13(dir, `${name}.md`);
+      if (!existsSync14(path5)) return { status: 404, body: { error: "not found" } };
+      return { status: 200, body: { path: path5, body: readFileSync16(path5, "utf8") } };
+    }
+    return { status: 400, body: { error: "bad scope or name" } };
+  }
+  if (method === "POST") {
+    const { body: contents } = parseBody5(body);
+    if (typeof contents !== "string") {
+      return { status: 400, body: { error: "body (string) required" } };
+    }
+    if (scope === "project") {
+      if (!cwd2) return { status: 503, body: { error: "no active project" } };
+      const path5 = join13(cwd2, PROJECT_MEMORY_FILE);
+      mkdirSync10(dirname13(path5), { recursive: true });
+      writeFileSync9(path5, contents, "utf8");
+      ctx.audit?.({ ts: Date.now(), action: "save-memory", payload: { scope, path: path5 } });
+      return { status: 200, body: { saved: true, path: path5 } };
+    }
+    if ((scope === "global" || scope === "project-mem") && name && SAFE_NAME.test(name)) {
+      const dir = scope === "global" ? globalDir : projectMemDir;
+      if (!dir) return { status: 503, body: { error: "no project root for project-mem" } };
+      mkdirSync10(dir, { recursive: true });
+      const path5 = join13(dir, `${name}.md`);
+      writeFileSync9(path5, contents, "utf8");
+      ctx.audit?.({ ts: Date.now(), action: "save-memory", payload: { scope, name, path: path5 } });
+      return { status: 200, body: { saved: true, path: path5 } };
+    }
+    return { status: 400, body: { error: "bad scope or name" } };
+  }
+  if (method === "DELETE") {
+    if ((scope === "global" || scope === "project-mem") && name && SAFE_NAME.test(name)) {
+      const dir = scope === "global" ? globalDir : projectMemDir;
+      if (!dir) return { status: 503, body: { error: "no project root for project-mem" } };
+      const path5 = join13(dir, `${name}.md`);
+      if (existsSync14(path5)) {
+        unlinkSync5(path5);
+        ctx.audit?.({ ts: Date.now(), action: "delete-memory", payload: { scope, name, path: path5 } });
+        return { status: 200, body: { deleted: true } };
+      }
+      return { status: 404, body: { error: "not found" } };
+    }
+    if (scope === "project") {
+      if (!cwd2) return { status: 503, body: { error: "no active project" } };
+      const path5 = join13(cwd2, PROJECT_MEMORY_FILE);
+      if (existsSync14(path5)) {
+        unlinkSync5(path5);
+        ctx.audit?.({ ts: Date.now(), action: "delete-memory", payload: { scope, path: path5 } });
+        return { status: 200, body: { deleted: true } };
+      }
+      return { status: 404, body: { error: "not found" } };
+    }
+    return { status: 400, body: { error: "bad scope or name" } };
+  }
+  return { status: 405, body: { error: `method ${method} not supported` } };
+}
+
+// src/server/api/messages.ts
+async function handleMessages(method, _rest, _body, ctx) {
+  if (method !== "GET") {
+    return { status: 405, body: { error: "GET only" } };
+  }
+  const messages = ctx.getMessages ? ctx.getMessages() : [];
+  return {
+    status: 200,
+    body: {
+      messages,
+      busy: ctx.isBusy ? ctx.isBusy() : false
+    }
+  };
+}
+
+// src/server/api/modal.ts
+function parseBody6(raw) {
+  if (!raw) return {};
+  try {
+    const parsed = JSON.parse(raw);
+    return typeof parsed === "object" && parsed !== null ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+async function handleModal(method, rest, body, ctx) {
+  if (method === "GET" && rest.length === 0) {
+    return {
+      status: 200,
+      body: { modal: ctx.getActiveModal ? ctx.getActiveModal() : null }
+    };
+  }
+  if (method === "POST" && rest[0] === "resolve") {
+    const { kind, choice, text } = parseBody6(body);
+    if (kind === "shell") {
+      if (!ctx.resolveShellConfirm) {
+        return { status: 503, body: { error: "shell modal resolution not wired" } };
+      }
+      if (choice !== "run_once" && choice !== "always_allow" && choice !== "deny") {
+        return {
+          status: 400,
+          body: { error: "shell choice must be run_once / always_allow / deny" }
+        };
+      }
+      ctx.resolveShellConfirm(choice);
+      return { status: 200, body: { resolved: true } };
+    }
+    if (kind === "choice") {
+      if (!ctx.resolveChoiceConfirm) {
+        return { status: 503, body: { error: "choice modal resolution not wired" } };
+      }
+      const c = choice;
+      if (!c || typeof c !== "object") {
+        return { status: 400, body: { error: "choice must be an object with a kind field" } };
+      }
+      if (c.kind === "pick" && typeof c.optionId === "string") {
+        ctx.resolveChoiceConfirm({ kind: "pick", optionId: c.optionId });
+        return { status: 200, body: { resolved: true } };
+      }
+      if (c.kind === "custom" && typeof c.text === "string") {
+        ctx.resolveChoiceConfirm({ kind: "custom", text: c.text });
+        return { status: 200, body: { resolved: true } };
+      }
+      if (c.kind === "cancel") {
+        ctx.resolveChoiceConfirm({ kind: "cancel" });
+        return { status: 200, body: { resolved: true } };
+      }
+      return { status: 400, body: { error: "unknown choice resolution shape" } };
+    }
+    if (kind === "plan") {
+      if (!ctx.resolvePlanConfirm) {
+        return { status: 503, body: { error: "plan modal resolution not wired" } };
+      }
+      if (choice !== "approve" && choice !== "refine" && choice !== "cancel") {
+        return { status: 400, body: { error: "plan choice must be approve / refine / cancel" } };
+      }
+      ctx.resolvePlanConfirm(choice, typeof text === "string" && text.trim() ? text : void 0);
+      return { status: 200, body: { resolved: true } };
+    }
+    if (kind === "edit-review") {
+      if (!ctx.resolveEditReview) {
+        return { status: 503, body: { error: "edit-review modal resolution not wired" } };
+      }
+      if (choice !== "apply" && choice !== "reject" && choice !== "apply-rest-of-turn" && choice !== "flip-to-auto") {
+        return { status: 400, body: { error: "edit-review choice invalid" } };
+      }
+      ctx.resolveEditReview(choice);
+      return { status: 200, body: { resolved: true } };
+    }
+    return { status: 400, body: { error: `unknown modal kind: ${String(kind)}` } };
+  }
+  return { status: 405, body: { error: `method ${method} not supported on this path` } };
+}
+
+// src/server/api/overview.ts
+async function handleOverview(method, _rest, _body, ctx) {
+  if (method !== "GET") {
+    return { status: 405, body: { error: "GET only" } };
+  }
+  const cfg = readConfig(ctx.configPath);
+  const overview = {
+    version: VERSION,
+    mode: ctx.mode,
+    latestVersion: ctx.getLatestVersion?.() ?? null,
+    session: ctx.getSessionName?.() ?? null,
+    cwd: ctx.getCurrentCwd?.() ?? null,
+    model: ctx.loop?.model ?? null,
+    editMode: ctx.getEditMode?.() ?? null,
+    planMode: ctx.getPlanMode?.() ?? null,
+    pendingEdits: ctx.getPendingEditCount?.() ?? null,
+    mcpServerCount: ctx.mcpServers?.length ?? null,
+    toolCount: ctx.tools ? ctx.tools.size : null,
+    preset: cfg.preset ?? "auto",
+    reasoningEffort: cfg.reasoningEffort ?? "max",
+    stats: ctx.getStats?.() ?? null
+  };
+  return { status: 200, body: overview };
+}
+
+// src/server/api/permissions.ts
+function parseBody7(raw) {
+  if (!raw) return {};
+  try {
+    const parsed = JSON.parse(raw);
+    return typeof parsed === "object" && parsed !== null ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+async function handlePermissions(method, rest, body, ctx) {
+  if (method === "GET" && rest.length === 0) {
+    const cwd3 = ctx.getCurrentCwd?.();
+    return {
+      status: 200,
+      body: {
+        currentCwd: cwd3 ?? null,
+        editMode: ctx.getEditMode?.() ?? null,
+        builtin: [...BUILTIN_ALLOWLIST],
+        project: cwd3 ? loadProjectShellAllowed(cwd3, ctx.configPath) : []
+      }
+    };
+  }
+  const cwd2 = ctx.getCurrentCwd?.();
+  if (!cwd2) {
+    return {
+      status: 503,
+      body: {
+        error: "no active project \u2014 mutations require an attached dashboard session (run `/dashboard` from inside `reasonix code`)."
+      }
+    };
+  }
+  if (method === "POST" && rest.length === 0) {
+    const { prefix } = parseBody7(body);
+    if (typeof prefix !== "string" || !prefix.trim()) {
+      return { status: 400, body: { error: "prefix (string) required" } };
+    }
+    const trimmed = prefix.trim();
+    if (BUILTIN_ALLOWLIST.includes(trimmed)) {
+      return {
+        status: 409,
+        body: {
+          error: `\`${trimmed}\` is already in the builtin allowlist \u2014 no project entry needed.`
+        }
+      };
+    }
+    const before = loadProjectShellAllowed(cwd2, ctx.configPath);
+    if (before.includes(trimmed)) {
+      return { status: 200, body: { added: false, prefix: trimmed, alreadyPresent: true } };
+    }
+    addProjectShellAllowed(cwd2, trimmed, ctx.configPath);
+    ctx.audit?.({
+      ts: Date.now(),
+      action: "add-allowlist",
+      payload: { prefix: trimmed, project: cwd2 }
+    });
+    return { status: 200, body: { added: true, prefix: trimmed } };
+  }
+  if (method === "DELETE" && rest.length === 0) {
+    const { prefix } = parseBody7(body);
+    if (typeof prefix !== "string" || !prefix.trim()) {
+      return { status: 400, body: { error: "prefix (string) required" } };
+    }
+    const trimmed = prefix.trim();
+    if (BUILTIN_ALLOWLIST.includes(trimmed)) {
+      return {
+        status: 409,
+        body: {
+          error: `\`${trimmed}\` is in the builtin allowlist (read-only); builtin entries can't be removed at runtime.`
+        }
+      };
+    }
+    const removed = removeProjectShellAllowed(cwd2, trimmed, ctx.configPath);
+    if (removed) {
+      ctx.audit?.({
+        ts: Date.now(),
+        action: "remove-allowlist",
+        payload: { prefix: trimmed, project: cwd2 }
+      });
+    }
+    return { status: 200, body: { removed, prefix: trimmed } };
+  }
+  if (method === "POST" && rest[0] === "clear") {
+    const { confirm: confirm2 } = parseBody7(body);
+    if (confirm2 !== true) {
+      return {
+        status: 400,
+        body: {
+          error: "clear requires { confirm: true } in the body \u2014 guards against accidental wipe."
+        }
+      };
+    }
+    const dropped = clearProjectShellAllowed(cwd2, ctx.configPath);
+    if (dropped > 0) {
+      ctx.audit?.({
+        ts: Date.now(),
+        action: "clear-allowlist",
+        payload: { dropped, project: cwd2 }
+      });
+    }
+    return { status: 200, body: { dropped } };
+  }
+  return { status: 405, body: { error: `method ${method} not supported on this path` } };
+}
+
+// src/server/api/plans.ts
+async function handlePlans(method, _rest, _body, _ctx) {
+  if (method !== "GET") {
+    return { status: 405, body: { error: "GET only" } };
+  }
+  const out = [];
+  for (const session of listSessions()) {
+    const archives = listPlanArchives(session.name);
+    for (const a of archives) {
+      const total = a.steps.length;
+      const done = a.completedStepIds.length;
+      const row2 = {
+        session: session.name,
+        path: a.path,
+        completedAt: a.completedAt,
+        totalSteps: total,
+        completedSteps: done,
+        completionRatio: total > 0 ? done / total : 0,
+        steps: a.steps,
+        completedStepIds: a.completedStepIds
+      };
+      if (a.summary) row2.summary = a.summary;
+      out.push(row2);
+    }
+  }
+  out.sort((a, b) => b.completedAt.localeCompare(a.completedAt));
+  return { status: 200, body: { plans: out } };
+}
+
+// src/server/api/sessions.ts
+import { existsSync as existsSync15, readFileSync as readFileSync17 } from "fs";
+function parseTranscript2(path5, maxBytes = 4 * 1024 * 1024) {
+  let raw;
+  try {
+    raw = readFileSync17(path5, "utf8");
+  } catch {
+    return [];
+  }
+  if (raw.length > maxBytes) raw = raw.slice(0, maxBytes);
+  const out = [];
+  for (const line of raw.split(/\r?\n/)) {
+    if (!line.trim()) continue;
+    try {
+      const rec = JSON.parse(line);
+      const role = typeof rec.role === "string" ? rec.role : "unknown";
+      const msg = { role };
+      if (typeof rec.content === "string") msg.content = rec.content;
+      else if (rec.content !== void 0) msg.content = JSON.stringify(rec.content);
+      if (typeof rec.tool_name === "string") msg.toolName = rec.tool_name;
+      if (typeof rec.toolName === "string") msg.toolName = rec.toolName;
+      out.push(msg);
+    } catch {
+    }
+  }
+  return out;
+}
+async function handleSessions(method, rest, _body, _ctx) {
+  if (method !== "GET") {
+    return { status: 405, body: { error: "GET only" } };
+  }
+  if (rest.length === 0) {
+    const sessions2 = listSessions();
+    return {
+      status: 200,
+      body: {
+        sessions: sessions2.map((s) => ({
+          name: s.name,
+          path: s.path,
+          size: s.size,
+          messageCount: s.messageCount,
+          mtime: s.mtime.getTime()
+        }))
+      }
+    };
+  }
+  const name = decodeURIComponent(rest[0]);
+  const path5 = sessionPath(name);
+  if (!existsSync15(path5)) {
+    return { status: 404, body: { error: `no such session: ${name}` } };
+  }
+  const messages = parseTranscript2(path5);
+  return {
+    status: 200,
+    body: {
+      name,
+      path: path5,
+      messages,
+      messageCount: messages.length
+    }
+  };
+}
+
+// src/server/api/settings.ts
+function parseBody8(raw) {
+  if (!raw) return {};
+  try {
+    const parsed = JSON.parse(raw);
+    return typeof parsed === "object" && parsed !== null ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+var VALID_PRESETS = /* @__PURE__ */ new Set(["auto", "flash", "pro", "fast", "smart", "max"]);
+var VALID_EFFORTS = /* @__PURE__ */ new Set(["high", "max"]);
+async function handleSettings(method, _rest, body, ctx) {
+  if (method === "GET") {
+    const cfg = readConfig(ctx.configPath);
+    return {
+      status: 200,
+      body: {
+        apiKey: cfg.apiKey ? redactKey(cfg.apiKey) : null,
+        apiKeySet: Boolean(cfg.apiKey),
+        baseUrl: cfg.baseUrl ?? null,
+        preset: cfg.preset ?? "auto",
+        reasoningEffort: cfg.reasoningEffort ?? "max",
+        search: cfg.search !== false,
+        editMode: cfg.editMode ?? "review",
+        session: cfg.session ?? null,
+        model: ctx.loop?.model ?? null,
+        // Hint to the SPA which fields require restart.
+        appliesAt: {
+          apiKey: "next-session",
+          baseUrl: "next-session",
+          preset: "next-session",
+          reasoningEffort: "next-turn",
+          search: "next-session"
+        }
+      }
+    };
+  }
+  if (method === "POST") {
+    const fields = parseBody8(body);
+    const cfg = readConfig(ctx.configPath);
+    const changed = [];
+    if (fields.apiKey !== void 0) {
+      if (typeof fields.apiKey !== "string" || !isPlausibleKey(fields.apiKey)) {
+        return { status: 400, body: { error: "apiKey must be a plausible sk- token" } };
+      }
+      saveApiKey(fields.apiKey, ctx.configPath);
+      changed.push("apiKey");
+    }
+    if (fields.baseUrl !== void 0) {
+      if (typeof fields.baseUrl !== "string" || !fields.baseUrl.trim()) {
+        return { status: 400, body: { error: "baseUrl must be a non-empty string" } };
+      }
+      cfg.baseUrl = fields.baseUrl.trim();
+      writeConfig(cfg, ctx.configPath);
+      changed.push("baseUrl");
+    }
+    if (fields.preset !== void 0) {
+      if (typeof fields.preset !== "string" || !VALID_PRESETS.has(fields.preset)) {
+        return { status: 400, body: { error: "preset must be auto | flash | pro" } };
+      }
+      cfg.preset = fields.preset;
+      writeConfig(cfg, ctx.configPath);
+      ctx.applyPresetLive?.(fields.preset);
+      changed.push("preset");
+    }
+    if (fields.reasoningEffort !== void 0) {
+      if (typeof fields.reasoningEffort !== "string" || !VALID_EFFORTS.has(fields.reasoningEffort)) {
+        return { status: 400, body: { error: "reasoningEffort must be high | max" } };
+      }
+      saveReasoningEffort(fields.reasoningEffort, ctx.configPath);
+      ctx.applyEffortLive?.(fields.reasoningEffort);
+      changed.push("reasoningEffort");
+    }
+    if (fields.search !== void 0) {
+      if (typeof fields.search !== "boolean") {
+        return { status: 400, body: { error: "search must be a boolean" } };
+      }
+      cfg.search = fields.search;
+      writeConfig(cfg, ctx.configPath);
+      changed.push("search");
+    }
+    if (changed.length > 0) {
+      ctx.audit?.({ ts: Date.now(), action: "set-settings", payload: { fields: changed } });
+    }
+    return { status: 200, body: { changed } };
+  }
+  return { status: 405, body: { error: "GET or POST only" } };
+}
+
+// src/server/api/skills.ts
+import {
+  existsSync as existsSync16,
+  mkdirSync as mkdirSync11,
+  readFileSync as readFileSync18,
+  readdirSync as readdirSync6,
+  rmSync,
+  statSync as statSync9,
+  writeFileSync as writeFileSync10
+} from "fs";
+import { homedir as homedir8 } from "os";
+import { dirname as dirname14, join as join14 } from "path";
+function parseBody9(raw) {
+  if (!raw) return {};
+  try {
+    const parsed = JSON.parse(raw);
+    return typeof parsed === "object" && parsed !== null ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+var SAFE_NAME2 = /^[a-zA-Z0-9][a-zA-Z0-9._-]{0,63}$/;
+function globalSkillsDir() {
+  return join14(homedir8(), ".reasonix", SKILLS_DIRNAME);
+}
+function projectSkillsDir(rootDir) {
+  return join14(rootDir, ".reasonix", SKILLS_DIRNAME);
+}
+function parseFrontmatterDescription(raw) {
+  const lines = raw.split(/\r?\n/);
+  if (lines[0] !== "---") return void 0;
+  for (let i = 1; i < lines.length; i++) {
+    if (lines[i] === "---") break;
+    const m = lines[i].match(/^description:\s*(.*)$/);
+    if (m) return m[1].trim();
+  }
+  return void 0;
+}
+function listSkills(dir, scope) {
+  if (!existsSync16(dir)) return [];
+  const out = [];
+  try {
+    for (const entry of readdirSync6(dir)) {
+      if (!SAFE_NAME2.test(entry)) continue;
+      const skillPath = join14(dir, entry, SKILL_FILE);
+      if (!existsSync16(skillPath)) continue;
+      try {
+        const stat = statSync9(skillPath);
+        const raw = readFileSync18(skillPath, "utf8");
+        const item = {
+          name: entry,
+          scope,
+          path: skillPath,
+          size: stat.size,
+          mtime: stat.mtime.getTime()
+        };
+        const desc = parseFrontmatterDescription(raw);
+        if (desc) item.description = desc;
+        out.push(item);
+      } catch {
+      }
+    }
+  } catch {
+  }
+  return out.sort((a, b) => a.name.localeCompare(b.name));
+}
+async function handleSkills(method, rest, body, ctx) {
+  const cwd2 = ctx.getCurrentCwd?.();
+  if (method === "GET" && rest.length === 0) {
+    return {
+      status: 200,
+      body: {
+        global: listSkills(globalSkillsDir(), "global"),
+        project: cwd2 ? listSkills(projectSkillsDir(cwd2), "project") : [],
+        builtin: [
+          { name: "explore", scope: "builtin", description: "subagent \u2014 broad codebase survey" },
+          {
+            name: "research",
+            scope: "builtin",
+            description: "subagent \u2014 deep web + repo research"
+          }
+        ],
+        paths: {
+          global: globalSkillsDir(),
+          project: cwd2 ? projectSkillsDir(cwd2) : null
+        }
+      }
+    };
+  }
+  const [scope, ...nameParts] = rest;
+  const name = nameParts.join("/");
+  if (!scope || !name || !SAFE_NAME2.test(name)) {
+    return { status: 400, body: { error: "expected /api/skills/<scope>/<name>" } };
+  }
+  if (scope !== "project" && scope !== "global") {
+    return {
+      status: 400,
+      body: { error: "scope must be project | global (builtin is read-only)" }
+    };
+  }
+  let dir;
+  if (scope === "project") {
+    if (!cwd2) {
+      return {
+        status: 503,
+        body: { error: "no active project \u2014 open `/dashboard` from `reasonix code`" }
+      };
+    }
+    dir = projectSkillsDir(cwd2);
+  } else {
+    dir = globalSkillsDir();
+  }
+  const skillPath = join14(dir, name, SKILL_FILE);
+  if (method === "GET") {
+    if (!existsSync16(skillPath)) return { status: 404, body: { error: "skill not found" } };
+    return { status: 200, body: { path: skillPath, body: readFileSync18(skillPath, "utf8") } };
+  }
+  if (method === "POST") {
+    const { body: contents } = parseBody9(body);
+    if (typeof contents !== "string") {
+      return { status: 400, body: { error: "body (string) required" } };
+    }
+    mkdirSync11(dirname14(skillPath), { recursive: true });
+    writeFileSync10(skillPath, contents, "utf8");
+    ctx.audit?.({
+      ts: Date.now(),
+      action: "save-skill",
+      payload: { scope, name, path: skillPath }
+    });
+    return { status: 200, body: { saved: true, path: skillPath } };
+  }
+  if (method === "DELETE") {
+    if (!existsSync16(skillPath)) return { status: 404, body: { error: "skill not found" } };
+    rmSync(dirname14(skillPath), { recursive: true, force: true });
+    ctx.audit?.({ ts: Date.now(), action: "delete-skill", payload: { scope, name } });
+    return { status: 200, body: { deleted: true } };
+  }
+  return { status: 405, body: { error: `method ${method} not supported` } };
+}
+
+// src/server/api/submit.ts
+function parseBody10(raw) {
+  if (!raw) return {};
+  try {
+    const parsed = JSON.parse(raw);
+    return typeof parsed === "object" && parsed !== null ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+async function handleSubmit(method, _rest, body, ctx) {
+  if (method !== "POST") {
+    return { status: 405, body: { error: "POST only" } };
+  }
+  if (!ctx.submitPrompt) {
+    return {
+      status: 503,
+      body: {
+        error: "submit requires an attached dashboard session \u2014 open `/dashboard` from inside `reasonix code` or `reasonix chat`."
+      }
+    };
+  }
+  const { prompt } = parseBody10(body);
+  if (typeof prompt !== "string" || !prompt.trim()) {
+    return { status: 400, body: { error: "prompt (non-empty string) required" } };
+  }
+  const result = ctx.submitPrompt(prompt);
+  if (!result.accepted) {
+    return {
+      status: 409,
+      body: { accepted: false, reason: result.reason ?? "loop is busy" }
+    };
+  }
+  ctx.audit?.({
+    ts: Date.now(),
+    action: "submit-prompt",
+    payload: { length: prompt.length }
+  });
+  return { status: 202, body: { accepted: true } };
+}
+
+// src/server/api/tools.ts
+async function handleTools(method, _rest, _body, ctx) {
+  if (method !== "GET") {
+    return { status: 405, body: { error: "GET only" } };
+  }
+  if (!ctx.tools) {
+    return {
+      status: 503,
+      body: {
+        error: "live tools view requires an attached session \u2014 run `/dashboard` from inside `reasonix code` instead of standalone `reasonix dashboard`.",
+        available: false
+      }
+    };
+  }
+  const specs = ctx.tools.specs();
+  const items = specs.map((s) => {
+    const def = ctx.tools.get(s.function.name);
+    return {
+      name: s.function.name,
+      description: s.function.description,
+      schema: s.function.parameters,
+      readOnly: Boolean(def?.readOnly),
+      flattened: ctx.tools.wasFlattened(s.function.name)
+    };
+  });
+  return {
+    status: 200,
+    body: {
+      planMode: ctx.tools.planMode,
+      total: items.length,
+      tools: items
+    }
+  };
+}
+
+// src/server/api/usage.ts
+function dayKey(ts) {
+  return new Date(ts).toISOString().slice(0, 10);
+}
+function buildSeries(records) {
+  const map = /* @__PURE__ */ new Map();
+  for (const r of records) {
+    const day = dayKey(r.ts);
+    let b = map.get(day);
+    if (!b) {
+      b = {
+        day,
+        turns: 0,
+        promptTokens: 0,
+        completionTokens: 0,
+        cacheHitTokens: 0,
+        cacheMissTokens: 0,
+        costUsd: 0,
+        cacheSavingsUsd: 0
+      };
+      map.set(day, b);
+    }
+    b.turns += 1;
+    b.promptTokens += r.promptTokens;
+    b.completionTokens += r.completionTokens;
+    b.cacheHitTokens += r.cacheHitTokens;
+    b.cacheMissTokens += r.cacheMissTokens;
+    b.costUsd += r.costUsd;
+    b.cacheSavingsUsd += cacheSavingsUsd(r.model, r.cacheHitTokens);
+  }
+  return Array.from(map.values()).sort((a, b) => a.day.localeCompare(b.day));
+}
+async function handleUsage(method, rest, _body, ctx) {
+  if (method !== "GET") {
+    return { status: 405, body: { error: "GET only" } };
+  }
+  const records = readUsageLog(ctx.usageLogPath);
+  if (rest[0] === "series") {
+    return {
+      status: 200,
+      body: {
+        days: buildSeries(records),
+        recordCount: records.length
+      }
+    };
+  }
+  const agg = aggregateUsage(records);
+  return {
+    status: 200,
+    body: {
+      logPath: ctx.usageLogPath,
+      logSize: formatLogSize(ctx.usageLogPath),
+      recordCount: records.length,
+      buckets: agg.buckets,
+      byModel: agg.byModel,
+      bySession: agg.bySession,
+      firstSeen: agg.firstSeen,
+      lastSeen: agg.lastSeen,
+      subagents: agg.subagents ?? null
+    }
+  };
+}
+
+// src/server/router.ts
+async function handleApi(pathTail, method, body, ctx) {
+  const normalized = pathTail.replace(/\/+$/, "");
+  const [head, ...rest] = normalized.split("/");
+  try {
+    switch (head) {
+      case "overview":
+        return await handleOverview(method, rest, body, ctx);
+      case "usage":
+        return await handleUsage(method, rest, body, ctx);
+      case "tools":
+        return await handleTools(method, rest, body, ctx);
+      case "permissions":
+        return await handlePermissions(method, rest, body, ctx);
+      case "messages":
+        return await handleMessages(method, rest, body, ctx);
+      case "submit":
+        return await handleSubmit(method, rest, body, ctx);
+      case "abort":
+        return await handleAbort(method, rest, body, ctx);
+      case "health":
+        return await handleHealth(method, rest, body, ctx);
+      case "sessions":
+        return await handleSessions(method, rest, body, ctx);
+      case "plans":
+        return await handlePlans(method, rest, body, ctx);
+      case "modal":
+        return await handleModal(method, rest, body, ctx);
+      case "edit-mode":
+        return await handleEditMode(method, rest, body, ctx);
+      case "settings":
+        return await handleSettings(method, rest, body, ctx);
+      case "hooks":
+        return await handleHooks(method, rest, body, ctx);
+      case "memory":
+        return await handleMemory(method, rest, body, ctx);
+      case "skills":
+        return await handleSkills(method, rest, body, ctx);
+      case "mcp":
+        return await handleMcp(method, rest, body, ctx);
+      case "files":
+        return await handleFiles(method, rest, body, ctx);
+      case "file":
+        return await handleFile(method, rest, body, ctx);
+      default:
+        return { status: 404, body: { error: `no such endpoint: /${head}` } };
+    }
+  } catch (err) {
+    return {
+      status: 500,
+      body: { error: `handler crashed: ${err.message}` }
+    };
+  }
+}
+
+// src/server/index.ts
+function mintToken() {
+  return randomBytes(32).toString("hex");
+}
+function constantTimeEquals(a, b) {
+  if (a.length !== b.length) return false;
+  let mismatch = 0;
+  for (let i = 0; i < a.length; i++) {
+    mismatch |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  }
+  return mismatch === 0;
+}
+function checkAuth(req, expectedToken, isMutation) {
+  const url = new URL(req.url ?? "/", "http://localhost");
+  const queryToken = url.searchParams.get("token") ?? "";
+  const headerToken = typeof req.headers["x-reasonix-token"] === "string" ? req.headers["x-reasonix-token"] : "";
+  if (isMutation) {
+    if (!headerToken || !constantTimeEquals(headerToken, expectedToken)) {
+      return {
+        status: 403,
+        body: JSON.stringify({
+          error: "mutation requires X-Reasonix-Token header (CSRF defence \u2014 query token alone is rejected for POST/DELETE)."
+        })
+      };
+    }
+    return null;
+  }
+  if (queryToken && constantTimeEquals(queryToken, expectedToken) || headerToken && constantTimeEquals(headerToken, expectedToken)) {
+    return null;
+  }
+  return {
+    status: 401,
+    body: JSON.stringify({ error: "missing or invalid token" })
+  };
+}
+var MAX_BODY_BYTES = 256 * 1024;
+async function readBody(req) {
+  let total = 0;
+  const chunks = [];
+  return new Promise((resolve13, reject) => {
+    req.on("data", (chunk) => {
+      total += chunk.length;
+      if (total > MAX_BODY_BYTES) {
+        reject(new Error(`body exceeds ${MAX_BODY_BYTES} bytes`));
+        req.destroy();
+        return;
+      }
+      chunks.push(chunk);
+    });
+    req.on("end", () => resolve13(Buffer.concat(chunks).toString("utf8")));
+    req.on("error", reject);
+  });
+}
+async function dispatch(req, res, ctx, expectedToken) {
+  const url = new URL(req.url ?? "/", "http://localhost");
+  const path5 = url.pathname;
+  const method = (req.method ?? "GET").toUpperCase();
+  const isMutation = method === "POST" || method === "DELETE" || method === "PUT";
+  if (path5 === "/" || path5 === "/index.html") {
+    const fail = checkAuth(req, expectedToken, false);
+    if (fail) {
+      res.writeHead(fail.status, { "content-type": "text/plain" });
+      res.end("unauthorized \u2014 open the URL printed by /dashboard, including ?token=\u2026");
+      return;
+    }
+    const html = renderIndexHtml(expectedToken, ctx.mode);
+    res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
+    res.end(html);
+    return;
+  }
+  if (path5.startsWith("/assets/")) {
+    const fail = checkAuth(req, expectedToken, false);
+    if (fail) {
+      res.writeHead(fail.status);
+      res.end();
+      return;
+    }
+    const asset = serveAsset(path5.slice("/assets/".length));
+    if (!asset) {
+      res.writeHead(404);
+      res.end("not found");
+      return;
+    }
+    res.writeHead(200, { "content-type": asset.contentType });
+    res.end(asset.body);
+    return;
+  }
+  if (path5 === "/api/events") {
+    const fail = checkAuth(req, expectedToken, false);
+    if (fail) {
+      res.writeHead(fail.status, { "content-type": "application/json" });
+      res.end(fail.body);
+      return;
+    }
+    handleEvents(req, res, ctx);
+    return;
+  }
+  if (path5.startsWith("/api/")) {
+    const fail = checkAuth(req, expectedToken, isMutation);
+    if (fail) {
+      res.writeHead(fail.status, { "content-type": "application/json" });
+      res.end(fail.body);
+      return;
+    }
+    let body = "";
+    if (isMutation) {
+      try {
+        body = await readBody(req);
+      } catch (err) {
+        res.writeHead(413, { "content-type": "application/json" });
+        res.end(JSON.stringify({ error: err.message }));
+        return;
+      }
+    }
+    const result = await handleApi(path5.slice("/api/".length), method, body, ctx);
+    res.writeHead(result.status, { "content-type": "application/json" });
+    res.end(JSON.stringify(result.body));
+    return;
+  }
+  res.writeHead(404, { "content-type": "text/plain" });
+  res.end("not found");
+}
+function startDashboardServer(ctx, opts = {}) {
+  const token = opts.token ?? mintToken();
+  const host = opts.host ?? "127.0.0.1";
+  const port = opts.port ?? 0;
+  return new Promise((resolve13, reject) => {
+    const server = createServer((req, res) => {
+      dispatch(req, res, ctx, token).catch((err) => {
+        if (!res.headersSent) {
+          res.writeHead(500, { "content-type": "application/json" });
+        }
+        res.end(JSON.stringify({ error: err.message }));
+      });
+    });
+    server.on("error", reject);
+    server.listen(port, host, () => {
+      const addr = server.address();
+      const finalPort = addr.port;
+      const url = `http://${host}:${finalPort}/?token=${token}`;
+      let closed = false;
+      const close = () => new Promise((doneResolve) => {
+        if (closed) return doneResolve();
+        closed = true;
+        server.close(() => doneResolve());
+        setTimeout(() => server.closeAllConnections?.(), 1e3).unref();
+      });
+      resolve13({ url, token, port: finalPort, close });
+    });
+  });
 }
 
 // src/tools/skills.ts
@@ -7554,7 +9416,7 @@ ${skill2.body}${argsBlock}`;
 }
 
 // src/tools/workspace.ts
-import { existsSync as existsSync11, statSync as statSync6 } from "fs";
+import { existsSync as existsSync17, statSync as statSync10 } from "fs";
 import * as pathMod4 from "path";
 var WorkspaceConfirmationError = class extends Error {
   path;
@@ -7588,11 +9450,11 @@ function registerWorkspaceTool(registry) {
       const home = process.env.HOME ?? process.env.USERPROFILE ?? "";
       const expanded = args.path.startsWith("~") && home ? pathMod4.join(home, args.path.slice(1)) : args.path;
       const abs = pathMod4.resolve(expanded);
-      if (!existsSync11(abs)) {
+      if (!existsSync17(abs)) {
         throw new Error(`change_workspace: path does not exist \u2014 ${abs}`);
       }
       try {
-        if (!statSync6(abs).isDirectory()) {
+        if (!statSync10(abs).isDirectory()) {
           throw new Error(`change_workspace: not a directory \u2014 ${abs}`);
         }
       } catch (err) {
@@ -8401,8 +10263,8 @@ function RiskLegend() {
 var PlanStepList = React8.memo(PlanStepListInner);
 
 // src/cli/ui/markdown.tsx
-import { readFileSync as readFileSync13, statSync as statSync7 } from "fs";
-import { isAbsolute as isAbsolute4, join as join12 } from "path";
+import { readFileSync as readFileSync19, statSync as statSync11 } from "fs";
+import { isAbsolute as isAbsolute5, join as join16 } from "path";
 import { Box as Box8, Text as Text7 } from "ink";
 import React9 from "react";
 var SUPERSCRIPT = {
@@ -8643,7 +10505,7 @@ function validateCitation(url, projectRoot) {
   const parts = parseCitationUrl(url);
   if (!parts || !parts.path) return { ok: false, reason: "empty path" };
   const normalized = parts.path.replace(/^[/\\]+/, "");
-  const baseFullPath = isAbsolute4(normalized) ? normalized : join12(projectRoot, normalized);
+  const baseFullPath = isAbsolute5(normalized) ? normalized : join16(projectRoot, normalized);
   const siblings = SIBLING_EXTENSIONS.get(extOf(baseFullPath)) ?? [];
   const candidates = [
     baseFullPath,
@@ -8653,7 +10515,7 @@ function validateCitation(url, projectRoot) {
   let stat = null;
   for (const candidate of candidates) {
     try {
-      stat = statSync7(candidate);
+      stat = statSync11(candidate);
       fullPath = candidate;
       break;
     } catch {
@@ -8664,7 +10526,7 @@ function validateCitation(url, projectRoot) {
   if (parts.startLine === void 0) return { ok: true };
   let lineCount;
   try {
-    lineCount = readFileSync13(fullPath, "utf8").split("\n").length;
+    lineCount = readFileSync19(fullPath, "utf8").split("\n").length;
   } catch {
     return { ok: false, reason: "unreadable" };
   }
@@ -11182,9 +13044,9 @@ function describeRepair(repair) {
 }
 
 // src/cli/ui/hash-memory.ts
-import { appendFileSync as appendFileSync3, existsSync as existsSync12, mkdirSync as mkdirSync8, readFileSync as readFileSync14, writeFileSync as writeFileSync7 } from "fs";
-import { homedir as homedir6 } from "os";
-import { dirname as dirname10, join as join13 } from "path";
+import { appendFileSync as appendFileSync3, existsSync as existsSync18, mkdirSync as mkdirSync12, readFileSync as readFileSync20, writeFileSync as writeFileSync11 } from "fs";
+import { homedir as homedir9 } from "os";
+import { dirname as dirname15, join as join17 } from "path";
 var PROJECT_HEADER = `# Reasonix project memory
 
 Notes the user pinned via the \`#\` prompt prefix. The whole file is
@@ -11216,12 +13078,12 @@ function detectHashMemory(text) {
   return { kind: "memory", note: body };
 }
 function appendProjectMemory(rootDir, note) {
-  return appendBulletToFile(join13(rootDir, PROJECT_MEMORY_FILE), note, PROJECT_HEADER);
+  return appendBulletToFile(join17(rootDir, PROJECT_MEMORY_FILE), note, PROJECT_HEADER);
 }
 var GLOBAL_MEMORY_DIR = ".reasonix";
 var GLOBAL_MEMORY_FILE = "REASONIX.md";
-function globalMemoryPath(homeDir = homedir6()) {
-  return join13(homeDir, GLOBAL_MEMORY_DIR, GLOBAL_MEMORY_FILE);
+function globalMemoryPath(homeDir = homedir9()) {
+  return join17(homeDir, GLOBAL_MEMORY_DIR, GLOBAL_MEMORY_FILE);
 }
 function appendGlobalMemory(note, homeDir) {
   return appendBulletToFile(globalMemoryPath(homeDir), note, GLOBAL_HEADER);
@@ -11231,14 +13093,14 @@ function appendBulletToFile(path5, note, newFileHeader) {
   if (!trimmed) throw new Error("note body cannot be empty");
   const bullet = `- ${trimmed}
 `;
-  if (!existsSync12(path5)) {
-    mkdirSync8(dirname10(path5), { recursive: true });
-    writeFileSync7(path5, `${newFileHeader}${bullet}`, "utf8");
+  if (!existsSync18(path5)) {
+    mkdirSync12(dirname15(path5), { recursive: true });
+    writeFileSync11(path5, `${newFileHeader}${bullet}`, "utf8");
     return { path: path5, created: true };
   }
   let prefix = "";
   try {
-    const existing = readFileSync14(path5, "utf8");
+    const existing = readFileSync20(path5, "utf8");
     if (existing.length > 0 && !existing.endsWith("\n")) prefix = "\n";
   } catch {
   }
@@ -11509,6 +13371,61 @@ function formatBytes2(n) {
   return `${mb.toFixed(mb >= 10 ? 0 : 1)} MB`;
 }
 
+// src/cli/ui/presets.ts
+var PRESETS = {
+  // auto — flash baseline + auto-escalate to pro when the model emits
+  // <<<NEEDS_PRO>>> OR after 3+ tool failure signals in one turn.
+  // The default: cheap when easy, smart when hard.
+  auto: {
+    model: "deepseek-v4-flash",
+    reasoningEffort: "max",
+    autoEscalate: true,
+    harvest: false,
+    branch: 1
+  },
+  // flash — always flash, never escalate. `/pro` still arms a single
+  // manual turn; auto-promotion is the thing this disables. Use when
+  // you want predictable cost per turn.
+  flash: {
+    model: "deepseek-v4-flash",
+    reasoningEffort: "max",
+    autoEscalate: false,
+    harvest: false,
+    branch: 1
+  },
+  // pro — always pro. Hard pin; the model never downgrades. Use for
+  // multi-turn architecture work where flash is just going to keep
+  // escalating anyway and the back-and-forth wastes turns.
+  pro: {
+    model: "deepseek-v4-pro",
+    reasoningEffort: "max",
+    autoEscalate: false,
+    harvest: false,
+    branch: 1
+  }
+};
+var PRESET_DESCRIPTIONS = {
+  auto: {
+    headline: "flash \u2192 pro on hard turns",
+    cost: "default \xB7 ~96% turns stay on flash \xB7 pro kicks in only when needed"
+  },
+  flash: {
+    headline: "v4-flash always",
+    cost: "cheapest \xB7 predictable \xB7 /pro still works for a one-turn bump"
+  },
+  pro: {
+    headline: "v4-pro always",
+    cost: "~3\xD7 flash (5/31 discount) / ~12\xD7 full price \xB7 for hard multi-turn work"
+  }
+};
+function resolvePreset(name) {
+  if (name === "auto" || name === "flash" || name === "pro") return PRESETS[name];
+  if (name === "fast") return { ...PRESETS.flash, reasoningEffort: "high" };
+  if (name === "smart") return PRESETS.auto;
+  if (name === "max") return PRESETS.pro;
+  return PRESETS.auto;
+}
+
 // src/cli/ui/slash/commands.ts
 var SLASH_COMMANDS = [
   { cmd: "help", summary: "show the full command reference" },
@@ -11579,6 +13496,18 @@ var SLASH_COMMANDS = [
     argsHint: "[reload]",
     summary: "list active hooks (settings.json under .reasonix/) \xB7 reload re-reads from disk"
   },
+  {
+    cmd: "permissions",
+    argsHint: "[list|add <prefix>|remove <prefix|N>|clear confirm]",
+    summary: "show / edit shell allowlist (builtin read-only \xB7 per-project: ~/.reasonix/config.json)",
+    argCompleter: ["list", "add", "remove", "clear"]
+  },
+  {
+    cmd: "dashboard",
+    argsHint: "[stop]",
+    summary: "launch the embedded web dashboard (127.0.0.1, token-gated)",
+    argCompleter: ["stop"]
+  },
   {
     cmd: "cwd",
     argsHint: "<path>",
@@ -11738,11 +13667,11 @@ function parseSlash(text) {
 }
 
 // src/cli/ui/slash/handlers/admin.ts
-import { existsSync as existsSync14, statSync as statSync8 } from "fs";
+import { existsSync as existsSync20, statSync as statSync12 } from "fs";
 import * as pathMod5 from "path";
 
 // src/cli/commands/stats.ts
-import { existsSync as existsSync13, readFileSync as readFileSync15 } from "fs";
+import { existsSync as existsSync19, readFileSync as readFileSync21 } from "fs";
 function statsCommand(opts) {
   if (opts.transcript) {
     transcriptSummary(opts.transcript);
@@ -11751,11 +13680,11 @@ function statsCommand(opts) {
   dashboard(opts);
 }
 function transcriptSummary(path5) {
-  if (!existsSync13(path5)) {
+  if (!existsSync19(path5)) {
     console.error(`no such transcript: ${path5}`);
     process.exit(1);
   }
-  const lines = readFileSync15(path5, "utf8").split(/\r?\n/).filter(Boolean);
+  const lines = readFileSync21(path5, "utf8").split(/\r?\n/).filter(Boolean);
   let assistantTurns = 0;
   let toolCalls = 0;
   let lastTurn = 0;
@@ -11844,12 +13773,13 @@ function header() {
     pad("turns", 8, "right"),
     pad("cache hit", 10, "right"),
     pad("cost (USD)", 14, "right"),
+    pad("cache saved", 14, "right"),
     pad("vs Claude", 14, "right"),
     pad("saved", 10, "right")
   ].join("  ");
 }
 function divider() {
-  return "-".repeat(70);
+  return "-".repeat(86);
 }
 function bucketRow(b) {
   const hit = bucketCacheHitRatio(b);
@@ -11859,6 +13789,11 @@ function bucketRow(b) {
     pad(b.turns.toString(), 8, "right"),
     pad(b.turns > 0 ? `${(hit * 100).toFixed(1)}%` : "\u2014", 10, "right"),
     pad(b.turns > 0 ? `$${b.costUsd.toFixed(6)}` : "\u2014", 14, "right"),
+    pad(
+      b.turns > 0 && b.cacheSavingsUsd > 0 ? `$${b.cacheSavingsUsd.toFixed(4)}` : "\u2014",
+      14,
+      "right"
+    ),
     pad(b.turns > 0 ? `$${b.claudeEquivUsd.toFixed(4)}` : "\u2014", 14, "right"),
     pad(b.turns > 0 && savings > 0 ? `${(savings * 100).toFixed(1)}%` : "\u2014", 10, "right")
   ].join("  ");
@@ -11990,12 +13925,12 @@ var cwd = (args, _loop, ctx) => {
   const home = process.env.HOME ?? process.env.USERPROFILE ?? "";
   const expanded = raw.startsWith("~") && home ? pathMod5.join(home, raw.slice(1)) : raw;
   const abs = pathMod5.resolve(expanded);
-  if (!existsSync14(abs)) {
+  if (!existsSync20(abs)) {
     return { info: `\u25B8 /cwd: path does not exist \u2014 ${abs}` };
   }
   let isDir = false;
   try {
-    isDir = statSync8(abs).isDirectory();
+    isDir = statSync12(abs).isDirectory();
   } catch {
   }
   if (!isDir) {
@@ -12225,6 +14160,50 @@ var handlers2 = {
   loop
 };
 
+// src/cli/ui/slash/handlers/dashboard.ts
+var dashboard2 = (args, _loop, ctx) => {
+  if (!ctx.startDashboard || !ctx.getDashboardUrl) {
+    return {
+      info: "/dashboard is not available in this context (no startDashboard callback wired)."
+    };
+  }
+  const sub = (args[0] ?? "").toLowerCase();
+  if (sub === "stop" || sub === "off") {
+    if (!ctx.stopDashboard) {
+      return { info: "/dashboard stop: no stop callback wired." };
+    }
+    const url = ctx.getDashboardUrl();
+    if (!url) return { info: "\u25B8 dashboard is not running." };
+    ctx.stopDashboard();
+    return { info: "\u25B8 dashboard stopping\u2026" };
+  }
+  const existing = ctx.getDashboardUrl();
+  if (existing) {
+    return {
+      info: [
+        "\u25B8 dashboard is already running:",
+        `  ${existing}`,
+        "",
+        "Open it in any browser. Type `/dashboard stop` to tear it down."
+      ].join("\n")
+    };
+  }
+  ctx.startDashboard().then((url) => {
+    ctx.postInfo?.(
+      [
+        "\u25B8 dashboard ready:",
+        `  ${url}`,
+        "",
+        "127.0.0.1 only \xB7 token-gated. Type `/dashboard stop` to shut down."
+      ].join("\n")
+    );
+  }).catch((err) => {
+    ctx.postInfo?.(`\u25B8 dashboard failed to start: ${err.message}`);
+  });
+  return { info: "\u25B8 starting dashboard server\u2026" };
+};
+var handlers3 = { dashboard: dashboard2 };
+
 // src/cli/ui/slash/helpers.ts
 import { spawnSync } from "child_process";
 function resolveMemoryTarget(store, raw) {
@@ -12453,7 +14432,7 @@ var walk2 = (_args, _loop, ctx) => {
   }
   return { info: ctx.startWalkthrough() };
 };
-var handlers3 = {
+var handlers4 = {
   undo,
   history,
   show,
@@ -12468,7 +14447,7 @@ var handlers3 = {
 };
 
 // src/cli/ui/slash/handlers/init.ts
-import { existsSync as existsSync15 } from "fs";
+import { existsSync as existsSync21 } from "fs";
 import * as pathMod6 from "path";
 var INIT_PROMPT = [
   "# Task: Initialize REASONIX.md",
@@ -12540,7 +14519,7 @@ var init = (args, _loop, ctx) => {
   }
   const force = (args[0] ?? "").toLowerCase() === "force";
   const target = pathMod6.join(ctx.codeRoot, "REASONIX.md");
-  if (existsSync15(target) && !force) {
+  if (existsSync21(target) && !force) {
     return {
       info: [
         `\u25B8 REASONIX.md already exists at ${target}`,
@@ -12560,7 +14539,7 @@ var init = (args, _loop, ctx) => {
     resubmit: INIT_PROMPT
   };
 };
-var handlers4 = {
+var handlers5 = {
   init
 };
 
@@ -12619,7 +14598,7 @@ $ ${out.command}`;
   return { info: out.output ? `${header2}
 ${out.output}` : header2 };
 };
-var handlers5 = {
+var handlers6 = {
   jobs,
   kill,
   logs
@@ -12680,7 +14659,7 @@ var mcp = (_args, loop2, ctx) => {
   lines.push("To change this set, exit and run `reasonix setup`.");
   return { info: lines.join("\n") };
 };
-var handlers6 = { mcp };
+var handlers7 = { mcp };
 
 // src/cli/ui/slash/handlers/memory.ts
 var memory = (args, _loop, ctx) => {
@@ -12815,7 +14794,7 @@ var memory = (args, _loop, ctx) => {
   );
   return { info: parts.join("\n") };
 };
-var handlers7 = { memory };
+var handlers8 = { memory };
 
 // src/cli/ui/slash/handlers/model.ts
 var model = (args, loop2, ctx) => {
@@ -12968,7 +14947,7 @@ var pro = (args, loop2, ctx) => {
   };
 };
 var ESCALATION_MODEL_ID = "deepseek-v4-pro";
-var handlers8 = {
+var handlers9 = {
   model,
   models,
   harvest: harvest2,
@@ -13121,7 +15100,7 @@ var compact = (args, loop2) => {
     info: `\u25B8 compacted ${healedCount} payload(s) to ${cap.toLocaleString()} tokens each (tool results + tool-call args), saved ${tokensSaved.toLocaleString()} tokens (${charsSaved.toLocaleString()} chars). Session file rewritten.`
   };
 };
-var handlers9 = {
+var handlers10 = {
   think,
   reasoning: think,
   tool,
@@ -13130,6 +15109,150 @@ var handlers9 = {
   compact
 };
 
+// src/cli/ui/slash/handlers/permissions.ts
+var permissions = (args, _loop, ctx) => {
+  const sub = (args[0] ?? "").toLowerCase();
+  const root = ctx.codeRoot;
+  const mode2 = ctx.editMode ?? null;
+  if (sub === "" || sub === "list" || sub === "ls") {
+    return { info: renderListing(root, mode2) };
+  }
+  if (!root) {
+    return {
+      info: "/permissions add / remove / clear are only available inside `reasonix code` \u2014 they edit the project-scoped allowlist (`~/.reasonix/config.json` projects[<root>].shellAllowed)."
+    };
+  }
+  if (sub === "add") {
+    const prefix = args.slice(1).join(" ").trim();
+    if (!prefix) {
+      return {
+        info: 'usage: /permissions add <prefix>   (multi-token OK: /permissions add "git push origin")'
+      };
+    }
+    const before = loadProjectShellAllowed(root);
+    if (before.includes(prefix)) {
+      return { info: `\u25B8 already allowed: ${prefix}` };
+    }
+    if (BUILTIN_ALLOWLIST.includes(prefix)) {
+      return {
+        info: `\u25B8 \`${prefix}\` is already in the builtin allowlist \u2014 no per-project entry needed. (Builtin entries are always on.)`
+      };
+    }
+    addProjectShellAllowed(root, prefix);
+    return {
+      info: `\u25B8 added: ${prefix}
+  \u2192 next \`${prefix}\` invocation runs without prompting in this project.`
+    };
+  }
+  if (sub === "remove" || sub === "rm" || sub === "delete") {
+    const target = args.slice(1).join(" ").trim();
+    if (!target) {
+      return {
+        info: "usage: /permissions remove <prefix-or-index>   (e.g. /permissions remove 3, or /permissions remove npm)"
+      };
+    }
+    const existing = loadProjectShellAllowed(root);
+    let prefix = null;
+    if (/^\d+$/.test(target)) {
+      const idx = Number.parseInt(target, 10);
+      if (idx < 1 || idx > existing.length) {
+        return {
+          info: existing.length === 0 ? "\u25B8 no project allowlist entries to remove." : `\u25B8 index out of range: ${idx} (project list has ${existing.length} entries)`
+        };
+      }
+      prefix = existing[idx - 1] ?? null;
+    } else {
+      prefix = target;
+    }
+    if (prefix === null) return { info: "\u25B8 nothing to remove." };
+    if (BUILTIN_ALLOWLIST.includes(prefix) && !existing.includes(prefix)) {
+      return {
+        info: `\u25B8 \`${prefix}\` is in the builtin allowlist (read-only). Builtin entries can't be removed at runtime \u2014 they're baked into the binary.`
+      };
+    }
+    const ok = removeProjectShellAllowed(root, prefix);
+    return {
+      info: ok ? `\u25B8 removed: ${prefix}` : `\u25B8 no such project entry: ${prefix}   (try /permissions list to see what's stored)`
+    };
+  }
+  if (sub === "clear") {
+    if ((args[1] ?? "").toLowerCase() !== "confirm") {
+      const count = loadProjectShellAllowed(root).length;
+      return {
+        info: count === 0 ? "\u25B8 project allowlist is already empty." : `about to drop ${count} project allowlist entr${count === 1 ? "y" : "ies"} for ${root}. Re-run with the word 'confirm' to proceed: /permissions clear confirm`
+      };
+    }
+    const dropped = clearProjectShellAllowed(root);
+    return {
+      info: dropped === 0 ? "\u25B8 project allowlist was already empty \u2014 nothing changed." : `\u25B8 cleared ${dropped} project allowlist entr${dropped === 1 ? "y" : "ies"}.`
+    };
+  }
+  return {
+    info: [
+      "usage: /permissions [list]                   show current state",
+      '       /permissions add <prefix>            persist (e.g. "npm run build")',
+      "       /permissions remove <prefix-or-N>    drop one entry",
+      "       /permissions clear confirm           wipe every project entry"
+    ].join("\n")
+  };
+};
+function renderListing(root, mode2) {
+  const lines = [];
+  if (mode2 === "yolo") {
+    lines.push(
+      "\u25B8 edit mode: YOLO  \u2014 every shell command auto-runs, allowlist is bypassed. /mode review to re-enable prompts."
+    );
+  } else if (mode2 === "auto") {
+    lines.push(
+      "\u25B8 edit mode: auto  \u2014 edits auto-apply, shell still gated by allowlist (or ShellConfirm prompt for non-allowlisted)."
+    );
+  } else if (mode2 === "review") {
+    lines.push(
+      "\u25B8 edit mode: review \u2014 both edits and non-allowlisted shell commands ask before running."
+    );
+  }
+  lines.push("");
+  if (root) {
+    const project = loadProjectShellAllowed(root);
+    lines.push(`Project allowlist (${project.length}) \u2014 ${root}`);
+    if (project.length === 0) {
+      lines.push('  (none \u2014 pick "always allow" on a ShellConfirm prompt to add one,');
+      lines.push("   or `/permissions add <prefix>` directly.)");
+    } else {
+      project.forEach((p, i) => {
+        lines.push(`  ${String(i + 1).padStart(2)}. ${p}`);
+      });
+    }
+  } else {
+    lines.push("Project allowlist \u2014 (no project root; chat mode shows builtin entries only)");
+  }
+  lines.push("");
+  lines.push(`Builtin allowlist (${BUILTIN_ALLOWLIST.length}) \u2014 read-only, baked in`);
+  const grouped = /* @__PURE__ */ new Map();
+  for (const entry of BUILTIN_ALLOWLIST) {
+    const head = entry.split(" ")[0] ?? entry;
+    if (!grouped.has(head)) grouped.set(head, []);
+    grouped.get(head).push(entry);
+  }
+  for (const [head, items] of grouped) {
+    if (items.length === 1 && items[0] === head) {
+      lines.push(`  \xB7 ${head}`);
+    } else {
+      const tail = items.map((i) => i.slice(head.length).trim() || "(bare)").join(", ");
+      lines.push(`  \xB7 ${head}: ${tail}`);
+    }
+  }
+  lines.push("");
+  lines.push(
+    "Subcommands: /permissions add <prefix> \xB7 /permissions remove <prefix-or-N> \xB7 /permissions clear confirm"
+  );
+  return lines.join("\n");
+}
+var handlers11 = {
+  permissions,
+  perms: permissions
+};
+
 // src/cli/ui/slash/handlers/plans.ts
 import { basename } from "path";
 var plans = (_args, loop2) => {
@@ -13209,7 +15332,7 @@ var replay = (args, loop2) => {
     }
   };
 };
-var handlers10 = {
+var handlers12 = {
   plans,
   replay
 };
@@ -13472,7 +15595,7 @@ async function startOllamaDaemon(opts = {}) {
   return { ready: false, pid };
 }
 async function pullOllamaModel(modelName, opts = {}) {
-  return new Promise((resolve12) => {
+  return new Promise((resolve13) => {
     const child = spawn5("ollama", ["pull", modelName], {
       stdio: ["ignore", "pipe", "pipe"],
       windowsHide: true
@@ -13484,8 +15607,8 @@ async function pullOllamaModel(modelName, opts = {}) {
     }
     streamLines(child.stdout, (l) => opts.onLine?.(l, "stdout"));
     streamLines(child.stderr, (l) => opts.onLine?.(l, "stderr"));
-    child.once("exit", (code) => resolve12(code ?? -1));
-    child.once("error", () => resolve12(-1));
+    child.once("exit", (code) => resolve13(code ?? -1));
+    child.once("error", () => resolve13(-1));
   });
 }
 function streamLines(stream, cb) {
@@ -13582,7 +15705,7 @@ async function readIndexMeta(rootDir) {
     return null;
   }
 }
-var handlers11 = {
+var handlers13 = {
   semantic
 };
 
@@ -13617,7 +15740,7 @@ var forget = (_args, loop2) => {
     info: ok ? `\u25B8 deleted session "${name}" \u2014 current screen still shows the conversation, but next launch starts fresh` : `could not delete session "${name}" (already gone?)`
   };
 };
-var handlers12 = {
+var handlers14 = {
   sessions,
   forget
 };
@@ -13693,7 +15816,7 @@ ${found.body}${argsLine}`;
     resubmit: payload
   };
 };
-var handlers13 = {
+var handlers15 = {
   skill,
   skills: skill
 };
@@ -13712,7 +15835,9 @@ var HANDLERS = {
   ...handlers10,
   ...handlers11,
   ...handlers12,
-  ...handlers13
+  ...handlers13,
+  ...handlers14,
+  ...handlers15
 };
 function handleSlash(cmd, args, loop2, ctx = {}) {
   const h = HANDLERS[cmd];
@@ -14296,6 +16421,9 @@ function App({
     editModeRef.current = editMode;
     if (codeMode) saveEditMode(editMode);
   }, [editMode, codeMode]);
+  const planModeRef = useRef6(false);
+  const currentRootDirRef = useRef6("");
+  const latestVersionRef = useRef6(null);
   const [pendingEditReview, setPendingEditReview] = useState10(null);
   const [walkthroughActive, setWalkthroughActive] = useState10(false);
   const [pendingTick, setPendingTick] = useState10(0);
@@ -14341,6 +16469,9 @@ function App({
     activeLoopRef.current = activeLoop;
   }, [activeLoop]);
   const toolHistoryRef = useRef6([]);
+  const dashboardRef = useRef6(null);
+  const eventSubscribersRef = useRef6(/* @__PURE__ */ new Set());
+  const historicalRef = useRef6([]);
   const planStepsRef = useRef6(null);
   const completedStepIdsRef = useRef6(/* @__PURE__ */ new Set());
   const planBodyRef = useRef6(null);
@@ -14490,6 +16621,91 @@ function App({
     refreshModels,
     refreshLatestVersion
   } = useSessionInfo(loop2);
+  useEffect6(() => {
+    planModeRef.current = planMode;
+  }, [planMode]);
+  useEffect6(() => {
+    currentRootDirRef.current = currentRootDir;
+  }, [currentRootDir]);
+  useEffect6(() => {
+    latestVersionRef.current = latestVersion ?? null;
+  }, [latestVersion]);
+  const balanceRef = useRef6(null);
+  useEffect6(() => {
+    balanceRef.current = balance;
+  }, [balance]);
+  useEffect6(() => {
+    historicalRef.current = historical;
+  }, [historical]);
+  const broadcastDashboardEvent = useCallback4((ev) => {
+    const subs = eventSubscribersRef.current;
+    if (subs.size === 0) return;
+    for (const h of subs) {
+      try {
+        h(ev);
+      } catch {
+      }
+    }
+  }, []);
+  useEffect6(() => {
+    broadcastDashboardEvent({ kind: "busy-change", busy });
+  }, [busy, broadcastDashboardEvent]);
+  useEffect6(() => {
+    if (!pendingShell) return;
+    const modal = {
+      kind: "shell",
+      command: pendingShell.command,
+      allowPrefix: derivePrefix(pendingShell.command),
+      shellKind: pendingShell.kind
+    };
+    broadcastDashboardEvent({ kind: "modal-up", modal });
+    return () => {
+      broadcastDashboardEvent({ kind: "modal-down", modalKind: "shell" });
+    };
+  }, [pendingShell, broadcastDashboardEvent]);
+  useEffect6(() => {
+    if (!pendingChoice) return;
+    const modal = {
+      kind: "choice",
+      question: pendingChoice.question,
+      options: pendingChoice.options,
+      allowCustom: pendingChoice.allowCustom
+    };
+    broadcastDashboardEvent({ kind: "modal-up", modal });
+    return () => {
+      broadcastDashboardEvent({ kind: "modal-down", modalKind: "choice" });
+    };
+  }, [pendingChoice, broadcastDashboardEvent]);
+  useEffect6(() => {
+    if (!pendingPlan) return;
+    broadcastDashboardEvent({
+      kind: "modal-up",
+      modal: { kind: "plan", body: pendingPlan }
+    });
+    return () => {
+      broadcastDashboardEvent({ kind: "modal-down", modalKind: "plan" });
+    };
+  }, [pendingPlan, broadcastDashboardEvent]);
+  useEffect6(() => {
+    if (!pendingEditReview) return;
+    const previewLines = (pendingEditReview.search || pendingEditReview.replace || "").split("\n").slice(0, 12);
+    const preview = previewLines.join("\n");
+    broadcastDashboardEvent({
+      kind: "modal-up",
+      modal: {
+        kind: "edit-review",
+        path: pendingEditReview.path,
+        search: pendingEditReview.search ?? "",
+        replace: pendingEditReview.replace ?? "",
+        preview,
+        total: pendingEdits.current.length,
+        remaining: pendingEdits.current.length
+      }
+    });
+    return () => {
+      broadcastDashboardEvent({ kind: "modal-down", modalKind: "edit-review" });
+    };
+  }, [pendingEditReview, broadcastDashboardEvent]);
   const {
     slashMatches,
     slashSelected,
@@ -14632,11 +16848,11 @@ function App({
     if (key.escape && busy) {
       if (abortedThisTurn.current) return;
       abortedThisTurn.current = true;
-      const resolve12 = editReviewResolveRef.current;
-      if (resolve12) {
+      const resolve13 = editReviewResolveRef.current;
+      if (resolve13) {
         editReviewResolveRef.current = null;
         setPendingEditReview(null);
-        resolve12("reject");
+        resolve13("reject");
       }
       if (activeLoopRef.current) stopLoop();
       loop2.abort();
@@ -14924,6 +17140,211 @@ function App({
     setWalkthroughActive(true);
     return `\u25B8 walking ${pendingEdits.current.length} edit block(s) \u2014 y apply \xB7 n reject \xB7 a apply rest \xB7 A flip to AUTO \xB7 Esc cancels (keeps remaining queued).`;
   }, [codeMode]);
+  const startDashboard = useCallback4(async () => {
+    if (dashboardRef.current) return dashboardRef.current.url;
+    const handle = await startDashboardServer({
+      mode: "attached",
+      configPath: defaultConfigPath(),
+      usageLogPath: defaultUsageLogPath(),
+      loop: loop2,
+      tools,
+      mcpServers,
+      getCurrentCwd: () => codeMode ? currentRootDirRef.current : void 0,
+      getEditMode: () => codeMode ? editModeRef.current : void 0,
+      getPlanMode: () => planModeRef.current,
+      getPendingEditCount: () => pendingEdits.current.length,
+      getLatestVersion: () => latestVersionRef.current,
+      getSessionName: () => session ?? null,
+      setEditMode: (m) => {
+        setEditMode(m);
+        editModeRef.current = m;
+        saveEditMode(m);
+        return m;
+      },
+      setPlanMode: (on) => {
+        if (codeMode) togglePlanMode(on);
+      },
+      applyPresetLive: (name) => {
+        const settings = resolvePreset(name);
+        loop2.configure({
+          model: settings.model,
+          autoEscalate: settings.autoEscalate,
+          reasoningEffort: settings.reasoningEffort
+        });
+      },
+      applyEffortLive: (effort2) => {
+        loop2.configure({ reasoningEffort: effort2 });
+      },
+      // ---------- Chat bridge ----------
+      getMessages: () => {
+        const out = [];
+        for (const ev of historicalRef.current) {
+          if (ev.role === "user" || ev.role === "assistant" || ev.role === "info" || ev.role === "warning") {
+            const msg = { id: ev.id, role: ev.role, text: ev.text };
+            if (ev.reasoning) msg.reasoning = ev.reasoning;
+            out.push(msg);
+          } else if (ev.role === "tool") {
+            const msg = {
+              id: ev.id,
+              role: "tool",
+              text: ev.text,
+              toolName: ev.toolName
+            };
+            if (ev.toolArgs) msg.toolArgs = ev.toolArgs;
+            out.push(msg);
+          }
+        }
+        return out;
+      },
+      subscribeEvents: (handler) => {
+        eventSubscribersRef.current.add(handler);
+        return () => {
+          eventSubscribersRef.current.delete(handler);
+        };
+      },
+      submitPrompt: (text) => {
+        if (busyRef.current) {
+          return { accepted: false, reason: "loop is busy with a turn" };
+        }
+        const fn = handleSubmitRef.current;
+        if (!fn) return { accepted: false, reason: "TUI not ready" };
+        fn(text).catch(() => void 0);
+        return { accepted: true };
+      },
+      abortTurn: () => {
+        if (busyRef.current) loop2.abort();
+      },
+      isBusy: () => busyRef.current,
+      getStats: () => {
+        const s = loop2.stats.summary();
+        const ctxCap = DEEPSEEK_CONTEXT_TOKENS[loop2.model] ?? DEFAULT_CONTEXT_TOKENS;
+        return {
+          turns: s.turns,
+          totalCostUsd: s.totalCostUsd,
+          lastTurnCostUsd: s.lastTurnCostUsd,
+          totalInputCostUsd: s.totalInputCostUsd,
+          totalOutputCostUsd: s.totalOutputCostUsd,
+          cacheHitRatio: s.cacheHitRatio,
+          lastPromptTokens: s.lastPromptTokens,
+          contextCapTokens: ctxCap,
+          // useSessionInfo's Balance is a flat { currency, total }; the
+          // dashboard wire shape is the richer DeepSeek BalanceInfo
+          // array (granted / topped_up split). Convert as a single-
+          // entry array so the SPA always reads `balance[0]` shape.
+          balance: balanceRef.current ? [
+            {
+              currency: balanceRef.current.currency,
+              total_balance: String(balanceRef.current.total)
+            }
+          ] : null
+        };
+      },
+      // ---------- Modal mirroring ----------
+      getActiveModal: () => {
+        const ps = pendingShell;
+        if (ps) {
+          return {
+            kind: "shell",
+            command: ps.command,
+            allowPrefix: derivePrefix(ps.command),
+            shellKind: ps.kind
+          };
+        }
+        const pc = pendingChoice;
+        if (pc) {
+          return {
+            kind: "choice",
+            question: pc.question,
+            options: pc.options,
+            allowCustom: pc.allowCustom
+          };
+        }
+        if (pendingPlanRef.current) {
+          return { kind: "plan", body: pendingPlanRef.current };
+        }
+        const er = pendingEditReview;
+        if (er) {
+          return {
+            kind: "edit-review",
+            path: er.path,
+            search: er.search ?? "",
+            replace: er.replace ?? "",
+            preview: (er.search || er.replace || "").split("\n").slice(0, 12).join("\n"),
+            total: pendingEdits.current.length,
+            remaining: pendingEdits.current.length
+          };
+        }
+        return null;
+      },
+      resolveShellConfirm: (choice) => {
+        const fn = handleShellConfirmRef.current;
+        if (fn) fn(choice).catch(() => void 0);
+      },
+      resolveChoiceConfirm: (choice) => {
+        const fn = handleChoiceConfirmRef.current;
+        if (fn) fn(choice).catch(() => void 0);
+      },
+      resolvePlanConfirm: (choice, text) => {
+        if (choice === "cancel") {
+          handlePlanConfirmRef.current("cancel").catch(() => void 0);
+          return;
+        }
+        const plan2 = pendingPlanRef.current ?? "";
+        handleStagedInputSubmitRef.current(text ?? "", { plan: plan2, mode: choice }).catch(() => void 0);
+      },
+      resolveEditReview: (choice) => {
+        const resolve13 = editReviewResolveRef.current;
+        if (resolve13) {
+          editReviewResolveRef.current = null;
+          setPendingEditReview(null);
+          resolve13(choice);
+        }
+      },
+      // ---------- v0.14 mutation surface ----------
+      reloadHooks: () => {
+        const fresh = loadHooks({ projectRoot: codeMode ? currentRootDirRef.current : void 0 });
+        setHookList(fresh);
+        return fresh.length;
+      }
+    });
+    dashboardRef.current = handle;
+    return handle.url;
+  }, [
+    loop2,
+    tools,
+    mcpServers,
+    codeMode,
+    session,
+    togglePlanMode,
+    pendingShell,
+    pendingChoice,
+    pendingEditReview
+  ]);
+  const stopDashboard = useCallback4(async () => {
+    const h = dashboardRef.current;
+    if (!h) return;
+    dashboardRef.current = null;
+    try {
+      await h.close();
+    } catch {
+    }
+    setHistorical((prev) => [
+      ...prev,
+      { id: `dash-stop-${Date.now()}`, role: "info", text: "\u25B8 dashboard stopped." }
+    ]);
+  }, []);
+  const getDashboardUrl = useCallback4(() => {
+    return dashboardRef.current?.url ?? null;
+  }, []);
+  useEffect6(() => {
+    return () => {
+      const h = dashboardRef.current;
+      if (h) {
+        dashboardRef.current = null;
+        h.close().catch(() => void 0);
+      }
+    };
+  }, []);
   const handleWalkChoice = useCallback4(
     (choice) => {
       if (choice === "apply") {
@@ -14967,7 +17388,7 @@ function App({
       nextFireMs: Math.max(0, cur.nextFireAt - Date.now())
     };
   }, []);
-  const handleSubmit = useCallback4(
+  const handleSubmit2 = useCallback4(
     async (raw) => {
       let text = raw.trim();
       if (!text) return;
@@ -15125,6 +17546,9 @@ function App({
           stopLoop,
           getLoopStatus,
           startWalkthrough: codeMode ? startWalkthrough : void 0,
+          startDashboard,
+          stopDashboard,
+          getDashboardUrl,
           jobs: codeMode?.jobs,
           postInfo: (text2) => setHistorical((prev) => [
             ...prev,
@@ -15245,6 +17669,8 @@ function App({
           leadSeparator: prev.length > 0
         }
       ]);
+      const userId = `u-${Date.now()}`;
+      broadcastDashboardEvent({ kind: "user", id: userId, text });
       const assistantId = `a-${Date.now()}`;
       const streamRef = { id: assistantId, text: "", reasoning: "" };
       const contentBuf = { current: "" };
@@ -15343,6 +17769,38 @@ function App({
       try {
         for await (const ev of loop2.step(modelInput)) {
           writeTranscript(ev);
+          if (eventSubscribersRef.current.size > 0) {
+            const id = `${assistantId}-${ev.role}-${Date.now()}`;
+            if (ev.role === "assistant_delta") {
+              broadcastDashboardEvent({
+                kind: "assistant_delta",
+                id: assistantId,
+                contentDelta: ev.content || void 0,
+                reasoningDelta: ev.reasoningDelta
+              });
+            } else if (ev.role === "tool_start" && ev.toolName) {
+              broadcastDashboardEvent({
+                kind: "tool_start",
+                id,
+                toolName: ev.toolName,
+                args: ev.toolArgs
+              });
+            } else if (ev.role === "tool" && ev.toolName) {
+              broadcastDashboardEvent({
+                kind: "tool",
+                id,
+                toolName: ev.toolName,
+                content: ev.content,
+                args: ev.toolArgs
+              });
+            } else if (ev.role === "warning") {
+              broadcastDashboardEvent({ kind: "warning", id, text: ev.content });
+            } else if (ev.role === "error") {
+              broadcastDashboardEvent({ kind: "error", id, text: ev.content });
+            } else if (ev.role === "status") {
+              broadcastDashboardEvent({ kind: "status", text: ev.content });
+            }
+          }
           if (ev.role !== "status") {
             setStatusLine((cur) => cur ? null : cur);
           }
@@ -15381,6 +17839,12 @@ function App({
             flush();
             const repairNote = ev.repair ? describeRepair(ev.repair) : "";
             setStreaming(null);
+            broadcastDashboardEvent({
+              kind: "assistant_final",
+              id: assistantId,
+              text: ev.content || streamRef.text,
+              reasoning: streamRef.reasoning || void 0
+            });
             setSummary(loop2.stats.summary());
             if (ev.stats?.usage) {
               appendUsage({
@@ -15486,6 +17950,7 @@ function App({
                   role: "tool",
                   text: ev.content,
                   toolName: ev.toolName,
+                  toolArgs: ev.toolArgs,
                   toolIndex,
                   durationMs
                 }
@@ -15712,12 +18177,16 @@ function App({
       startLoop,
       getLoopStatus,
       startWalkthrough,
+      startDashboard,
+      stopDashboard,
+      getDashboardUrl,
+      broadcastDashboardEvent,
       applyCwdChange
     ]
   );
   useEffect6(() => {
-    handleSubmitRef.current = handleSubmit;
-  }, [handleSubmit]);
+    handleSubmitRef.current = handleSubmit2;
+  }, [handleSubmit2]);
   useEffect6(() => {
     if (!activeLoop) return;
     const delay = Math.max(0, activeLoop.nextFireAt - Date.now());
@@ -15845,18 +18314,18 @@ ${body}`;
         loop2.abort();
         setQueuedSubmit(synthetic);
       } else {
-        await handleSubmit(synthetic);
+        await handleSubmit2(synthetic);
       }
     },
-    [pendingShell, codeMode, currentRootDir, handleSubmit, busy, loop2]
+    [pendingShell, codeMode, currentRootDir, handleSubmit2, busy, loop2]
   );
   useEffect6(() => {
     if (!busy && queuedSubmit !== null) {
       const text = queuedSubmit;
       setQueuedSubmit(null);
-      void handleSubmit(text);
+      void handleSubmit2(text);
     }
-  }, [busy, queuedSubmit, handleSubmit]);
+  }, [busy, queuedSubmit, handleSubmit2]);
   const handleWorkspaceConfirm = useCallback4(
     async (choice) => {
       const pending = pendingWorkspace;
@@ -15886,10 +18355,10 @@ ${body}`;
         loop2.abort();
         setQueuedSubmit(synthetic);
       } else {
-        await handleSubmit(synthetic);
+        await handleSubmit2(synthetic);
       }
     },
-    [pendingWorkspace, applyCwdChange, busy, loop2, handleSubmit]
+    [pendingWorkspace, applyCwdChange, busy, loop2, handleSubmit2]
   );
   const handlePlanConfirm = useCallback4(
     async (choice) => {
@@ -15923,10 +18392,10 @@ ${body}`;
         loop2.abort();
         setQueuedSubmit(synthetic);
       } else {
-        await handleSubmit(synthetic);
+        await handleSubmit2(synthetic);
       }
     },
-    [pendingPlan, togglePlanMode, busy, loop2, handleSubmit, persistPlanState]
+    [pendingPlan, togglePlanMode, busy, loop2, handleSubmit2, persistPlanState]
   );
   const handlePlanConfirmRef = useRef6(handlePlanConfirm);
   useEffect6(() => {
@@ -15937,9 +18406,13 @@ ${body}`;
     []
   );
   const handleStagedInputSubmit = useCallback4(
-    async (feedback) => {
-      const staged = stagedInput;
-      setStagedInput(null);
+    async (feedback, override) => {
+      const staged = override ?? stagedInput;
+      if (override) {
+        setPendingPlan(null);
+      } else {
+        setStagedInput(null);
+      }
       if (!staged) return;
       const trimmed = feedback.trim();
       let synthetic;
@@ -15980,11 +18453,15 @@ Stay in plan mode \u2014 address the feedback (explore more if needed), then sub
         loop2.abort();
         setQueuedSubmit(synthetic);
       } else {
-        await handleSubmit(synthetic);
+        await handleSubmit2(synthetic);
       }
     },
-    [stagedInput, togglePlanMode, busy, loop2, handleSubmit]
+    [stagedInput, togglePlanMode, busy, loop2, handleSubmit2]
   );
+  const handleStagedInputSubmitRef = useRef6(handleStagedInputSubmit);
+  useEffect6(() => {
+    handleStagedInputSubmitRef.current = handleStagedInputSubmit;
+  }, [handleStagedInputSubmit]);
   const handleStagedInputCancel = useCallback4(() => {
     if (stagedInput?.plan) setPendingPlan(stagedInput.plan);
     setStagedInput(null);
@@ -16015,10 +18492,10 @@ Stay in plan mode \u2014 address the feedback (explore more if needed), then sub
         loop2.abort();
         setQueuedSubmit(synthetic);
       } else {
-        await handleSubmit(synthetic);
+        await handleSubmit2(synthetic);
       }
     },
-    [pendingCheckpoint, busy, loop2, handleSubmit]
+    [pendingCheckpoint, busy, loop2, handleSubmit2]
   );
   const handleCheckpointConfirmRef = useRef6(handleCheckpointConfirm);
   useEffect6(() => {
@@ -16049,10 +18526,10 @@ If the feedback only tweaks how you execute (extra constraints, style preference
         loop2.abort();
         setQueuedSubmit(synthetic);
       } else {
-        await handleSubmit(synthetic);
+        await handleSubmit2(synthetic);
       }
     },
-    [stagedCheckpointRevise, busy, loop2, handleSubmit]
+    [stagedCheckpointRevise, busy, loop2, handleSubmit2]
   );
   const handleCheckpointReviseCancel = useCallback4(() => {
     const snap = stagedCheckpointRevise;
@@ -16078,7 +18555,7 @@ If the feedback only tweaks how you execute (extra constraints, style preference
           loop2.abort();
           setQueuedSubmit(synthetic2);
         } else {
-          await handleSubmit(synthetic2);
+          await handleSubmit2(synthetic2);
         }
         return;
       }
@@ -16093,11 +18570,19 @@ If the feedback only tweaks how you execute (extra constraints, style preference
         loop2.abort();
         setQueuedSubmit(synthetic);
       } else {
-        await handleSubmit(synthetic);
+        await handleSubmit2(synthetic);
       }
     },
-    [pendingChoice, busy, loop2, handleSubmit]
+    [pendingChoice, busy, loop2, handleSubmit2]
   );
+  const handleShellConfirmRef = useRef6(handleShellConfirm);
+  useEffect6(() => {
+    handleShellConfirmRef.current = handleShellConfirm;
+  }, [handleShellConfirm]);
+  const pendingPlanRef = useRef6(null);
+  useEffect6(() => {
+    pendingPlanRef.current = pendingPlan;
+  }, [pendingPlan]);
   const handleChoiceConfirmRef = useRef6(handleChoiceConfirm);
   useEffect6(() => {
     handleChoiceConfirmRef.current = handleChoiceConfirm;
@@ -16124,10 +18609,10 @@ Read it carefully and proceed \u2014 don't snap back to the options you listed u
         loop2.abort();
         setQueuedSubmit(synthetic);
       } else {
-        await handleSubmit(synthetic);
+        await handleSubmit2(synthetic);
       }
     },
-    [busy, loop2, handleSubmit]
+    [busy, loop2, handleSubmit2]
   );
   const handleChoiceCustomCancel = useCallback4(() => {
     const snap = stagedChoiceCustom;
@@ -16149,7 +18634,7 @@ Read it carefully and proceed \u2014 don't snap back to the options you listed u
           loop2.abort();
           setQueuedSubmit(synthetic2);
         } else {
-          await handleSubmit(synthetic2);
+          await handleSubmit2(synthetic2);
         }
         return;
       }
@@ -16184,10 +18669,10 @@ Continue executing from the next pending step. Call mark_step_complete after eac
         loop2.abort();
         setQueuedSubmit(synthetic);
       } else {
-        await handleSubmit(synthetic);
+        await handleSubmit2(synthetic);
       }
     },
-    [pendingRevision, busy, loop2, handleSubmit, persistPlanState]
+    [pendingRevision, busy, loop2, handleSubmit2, persistPlanState]
   );
   const handleReviseConfirmRef = useRef6(handleReviseConfirm);
   useEffect6(() => {
@@ -16300,10 +18785,10 @@ Continue executing from the next pending step. Call mark_step_complete after eac
       {
         block: pendingEditReview,
         onChoose: (choice) => {
-          const resolve12 = editReviewResolveRef.current;
-          if (resolve12) {
+          const resolve13 = editReviewResolveRef.current;
+          if (resolve13) {
             editReviewResolveRef.current = null;
-            resolve12(choice);
+            resolve13(choice);
           }
         }
       }
@@ -16329,7 +18814,7 @@ Continue executing from the next pending step. Call mark_step_complete after eac
       {
         value: input,
         onChange: setInput,
-        onSubmit: handleSubmit,
+        onSubmit: handleSubmit2,
         disabled: busy,
         onHistoryPrev: recallPrev,
         onHistoryNext: recallNext
@@ -16409,7 +18894,7 @@ function Setup({ onReady }) {
   const [value, setValue] = useState11("");
   const [error, setError] = useState11(null);
   const { exit: exit2 } = useApp2();
-  const handleSubmit = (raw) => {
+  const handleSubmit2 = (raw) => {
     const trimmed = raw.trim();
     if (trimmed === "/exit" || trimmed === "/quit") {
       exit2();
@@ -16433,7 +18918,7 @@ function Setup({ onReady }) {
     {
       value,
       onChange: setValue,
-      onSubmit: handleSubmit,
+      onSubmit: handleSubmit2,
       mask: "\u2022",
       placeholder: "sk-..."
     }
@@ -16513,7 +18998,7 @@ async function chatCommand(opts) {
       try {
         const spec = parseMcpSpec(raw);
         const prefix = spec.name ? `${spec.name}_` : requestedSpecs.length === 1 && opts.mcpPrefix ? opts.mcpPrefix : "";
-        const transport = spec.transport === "sse" ? new SseTransport({ url: spec.url }) : new StdioTransport({ command: spec.command, args: spec.args });
+        const transport = spec.transport === "sse" ? new SseTransport({ url: spec.url }) : spec.transport === "streamable-http" ? new StreamableHttpTransport({ url: spec.url }) : new StdioTransport({ command: spec.command, args: spec.args });
         const mcp3 = new McpClient({ transport });
         await mcp3.initialize();
         const bridge = await bridgeMcpTools(mcp3, {
@@ -16535,7 +19020,7 @@ async function chatCommand(opts) {
           };
         }
         const label = spec.name ?? "anon";
-        const source = spec.transport === "sse" ? spec.url : `${spec.command} ${spec.args.join(" ")}`;
+        const source = spec.transport === "sse" || spec.transport === "streamable-http" ? spec.url : `${spec.command} ${spec.args.join(" ")}`;
         process.stderr.write(
           `\u25B8 MCP[${label}]: ${bridge.registeredNames.length} tool(s) from ${source}
 `
@@ -16578,7 +19063,7 @@ async function chatCommand(opts) {
     const prior = loadSessionMessages(opts.session);
     if (prior.length > 0) {
       const p = sessionPath(opts.session);
-      const mtime = existsSync16(p) ? statSync9(p).mtime : /* @__PURE__ */ new Date();
+      const mtime = existsSync22(p) ? statSync13(p).mtime : /* @__PURE__ */ new Date();
       sessionPreview = { messageCount: prior.length, lastActive: mtime };
     }
   } else if (opts.session && opts.forceNew) {
@@ -16609,7 +19094,7 @@ async function chatCommand(opts) {
 }
 
 // src/cli/commands/code.tsx
-import { basename as basename2, resolve as resolve10 } from "path";
+import { basename as basename2, resolve as resolve11 } from "path";
 
 // src/index/semantic/builder.ts
 import { promises as fs5 } from "fs";
@@ -17256,8 +19741,8 @@ async function bootstrapSemanticSearchInCodeMode(registry, rootDir, opts = {}) {
 
 // src/cli/commands/code.tsx
 async function codeCommand(opts = {}) {
-  const { codeSystemPrompt: codeSystemPrompt2 } = await import("./prompt-YRY4HPMZ.js");
-  const rootDir = resolve10(opts.dir ?? process.cwd());
+  const { codeSystemPrompt: codeSystemPrompt2 } = await import("./prompt-HNDDXDRH.js");
+  const rootDir = resolve11(opts.dir ?? process.cwd());
   const session = opts.noSession ? void 0 : `code-${sanitizeName(basename2(rootDir))}`;
   const tools = new ToolRegistry();
   const jobs2 = new JobRegistry();
@@ -17304,7 +19789,7 @@ async function codeCommand(opts = {}) {
 }
 
 // src/cli/commands/diff.ts
-import { writeFileSync as writeFileSync8 } from "fs";
+import { writeFileSync as writeFileSync12 } from "fs";
 import { basename as basename3 } from "path";
 import { render as render2 } from "ink";
 import React30 from "react";
@@ -17451,7 +19936,7 @@ async function diffCommand(opts) {
   if (wantMarkdown) {
     console.log(renderSummaryTable(report));
     const md = renderMarkdown(report);
-    writeFileSync8(opts.mdPath, md, "utf8");
+    writeFileSync12(opts.mdPath, md, "utf8");
     console.log(`
 markdown report written to ${opts.mdPath}`);
     return;
@@ -17468,7 +19953,7 @@ markdown report written to ${opts.mdPath}`);
 }
 
 // src/cli/commands/index.ts
-import { resolve as resolve11 } from "path";
+import { resolve as resolve12 } from "path";
 
 // src/index/semantic/preflight.ts
 import { stdin as stdin2, stdout } from "process";
@@ -17542,7 +20027,7 @@ async function confirm(question, defaultYes) {
 
 // src/cli/commands/index.ts
 async function indexCommand(opts = {}) {
-  const root = resolve11(opts.dir ?? process.cwd());
+  const root = resolve12(opts.dir ?? process.cwd());
   const tty = process.stderr.isTTY === true && process.stdin.isTTY === true;
   const model2 = opts.model ?? process.env.REASONIX_EMBED_MODEL ?? "nomic-embed-text";
   const preflightOk = await ollamaPreflight({
@@ -17664,7 +20149,7 @@ function makeTtyWriter() {
 // src/cli/commands/mcp-inspect.ts
 async function mcpInspectCommand(opts) {
   const spec = parseMcpSpec(opts.spec);
-  const transport = spec.transport === "sse" ? new SseTransport({ url: spec.url }) : new StdioTransport({ command: spec.command, args: spec.args });
+  const transport = spec.transport === "sse" ? new SseTransport({ url: spec.url }) : spec.transport === "streamable-http" ? new StreamableHttpTransport({ url: spec.url }) : new StdioTransport({ command: spec.command, args: spec.args });
   const client = new McpClient({ transport });
   try {
     await client.initialize();
@@ -17996,11 +20481,11 @@ async function runCommand2(opts) {
       try {
         const spec = parseMcpSpec(raw);
         const prefix2 = spec.name ? `${spec.name}_` : requestedSpecs.length === 1 && opts.mcpPrefix ? opts.mcpPrefix : "";
-        const transport = spec.transport === "sse" ? new SseTransport({ url: spec.url }) : new StdioTransport({ command: spec.command, args: spec.args });
+        const transport = spec.transport === "sse" ? new SseTransport({ url: spec.url }) : spec.transport === "streamable-http" ? new StreamableHttpTransport({ url: spec.url }) : new StdioTransport({ command: spec.command, args: spec.args });
         const mcp3 = new McpClient({ transport });
         await mcp3.initialize();
         const bridge = await bridgeMcpTools(mcp3, { registry: tools, namePrefix: prefix2 });
-        const source = spec.transport === "sse" ? spec.url : `${spec.command} ${spec.args.join(" ")}`;
+        const source = spec.transport === "sse" || spec.transport === "streamable-http" ? spec.url : `${spec.command} ${spec.args.join(" ")}`;
         process.stderr.write(
           `\u25B8 MCP[${spec.name ?? "anon"}]: ${bridge.registeredNames.length} tool(s) from ${source}
 `
@@ -18166,38 +20651,6 @@ import React34 from "react";
 import { Box as Box28, Text as Text26, useApp as useApp5, useInput as useInput3 } from "ink";
 import TextInput2 from "ink-text-input";
 import React33, { useState as useState15 } from "react";
-
-// src/cli/ui/presets.ts
-var PRESETS = {
-  // fast — flash + effort=high. Quick Q&A, one-line tweaks, anything
-  // where shallow reasoning is enough. Cheapest turn possible.
-  fast: { model: "deepseek-v4-flash", reasoningEffort: "high", harvest: false, branch: 1 },
-  // smart — flash + effort=max. Full thinking budget on the cheap
-  // model. The default: handles 90%+ of coding work at a fraction
-  // of pro's cost.
-  smart: { model: "deepseek-v4-flash", reasoningEffort: "max", harvest: false, branch: 1 },
-  // max — pro + effort=max. Frontier model for hard tasks: cross-
-  // file architecture, subtle bug hunts, anything where flash's
-  // reasoning has measurably failed. ~12× per-token vs flash; save
-  // for when you need it, or use `/pro` to escalate a single turn.
-  max: { model: "deepseek-v4-pro", reasoningEffort: "max", harvest: false, branch: 1 }
-};
-var PRESET_DESCRIPTIONS = {
-  fast: {
-    headline: "v4-flash \xB7 effort=high",
-    cost: "cheapest \xB7 quick Q&A, one-line edits"
-  },
-  smart: {
-    headline: "v4-flash \xB7 effort=max",
-    cost: "~1.5\xD7 fast \xB7 default \xB7 day-to-day coding"
-  },
-  max: {
-    headline: "v4-pro \xB7 effort=max",
-    cost: "~12\xD7 fast \xB7 hard single-shots \xB7 use /pro for a single-turn bump"
-  }
-};
-
-// src/cli/ui/Wizard.tsx
 var CATALOG_BY_NAME = new Map(MCP_CATALOG.map((e) => [e.name, e]));
 function Wizard({ onComplete, onCancel, existingApiKey, initial }) {
   const { exit: exit2 } = useApp5();
@@ -18394,7 +20847,7 @@ function SummaryLine({ label, value }) {
   return /* @__PURE__ */ React33.createElement(Box28, null, /* @__PURE__ */ React33.createElement(Text26, null, label.padEnd(12)), /* @__PURE__ */ React33.createElement(Text26, { bold: true }, value));
 }
 function presetItems() {
-  return ["fast", "smart", "max"].map((name) => ({
+  return ["auto", "flash", "pro"].map((name) => ({
     value: name,
     label: `${name} \u2014 ${PRESET_DESCRIPTIONS[name].headline}`,
     hint: PRESET_DESCRIPTIONS[name].cost
@@ -18495,13 +20948,13 @@ function planUpdate(input) {
   };
 }
 function defaultSpawn(argv) {
-  return new Promise((resolve12, reject) => {
+  return new Promise((resolve13, reject) => {
     const child = spawn6(argv[0], argv.slice(1), {
       stdio: "inherit",
       shell: process.platform === "win32"
     });
     child.once("error", reject);
-    child.once("exit", (code) => resolve12(code ?? 1));
+    child.once("exit", (code) => resolve13(code ?? 1));
   });
 }
 async function updateCommand(opts = {}) {
@@ -18551,7 +21004,7 @@ function versionCommand() {
 function resolveDefaults(flags) {
   const cfg = flags.noConfig ? {} : readConfig();
   const preset2 = pickPreset(flags.preset, cfg.preset);
-  const presetSettings = PRESETS[preset2];
+  const presetSettings = resolvePreset(preset2);
   const model2 = flags.model ?? presetSettings.model;
   const reasoningEffort = presetSettings.reasoningEffort;
   const harvest3 = flags.harvest === true ? true : presetSettings.harvest;
@@ -18564,10 +21017,12 @@ function resolveDefaults(flags) {
 function pickPreset(flagPreset, configPreset) {
   if (flagPreset && isPresetName(flagPreset)) return flagPreset;
   if (configPreset) return configPreset;
-  return "smart";
+  return "auto";
 }
 function isPresetName(s) {
-  return s === "fast" || s === "smart" || s === "max";
+  return s === "auto" || s === "flash" || s === "pro" || // Legacy names — kept callable so old `--preset smart` invocations
+  // and stale config.json entries don't error out.
+  s === "fast" || s === "smart" || s === "max";
 }
 function normalizeBranch(raw) {
   if (raw === void 0) return void 0;