wotann 0.5.0 → 0.5.39

package/dist/ui/App.js

@@ -14,12 +14,15 @@ import { Box, Text, useApp, useInput } from "ink";
 import { StartupScreen } from "./components/StartupScreen.js";
 import { ChatView } from "./components/ChatView.js";
 import { PromptInput } from "./components/PromptInput.js";
+import { ThemeProvider } from "./theme/context.js";
+import { AGENT_TOOL_DEFINITIONS, executeAgentTool } from "./agent-tools.js";
 import { UnifiedStatusBar } from "./components/UnifiedStatusBar.js";
 import { DiffViewer } from "./components/DiffViewer.js";
 import { AgentStatusPanel } from "./components/AgentStatusPanel.js";
 import { HistoryPicker } from "./components/HistoryPicker.js";
 import { CommandPalette } from "./components/CommandPalette.js";
 import { ModelPicker } from "./components/ModelPicker.js";
+import { ProviderSetupOverlay } from "./components/ProviderSetupOverlay.js";
 import { OptionPicker } from "./components/OptionPicker.js";
 import { CommandRegistry } from "./command-registry.js";
 // V9 Wave 2-M (R-09) — TUI palette command set. `registerR09Commands`
@@ -40,17 +43,22 @@ import { AuditLogPanel } from "./components/AuditLogPanel.js";
 import { AutomationsPanel } from "./components/AutomationsPanel.js";
 import { BlockBuffer } from "./terminal-blocks/block.js";
 import { Osc133Parser } from "./terminal-blocks/osc-133-parser.js";
+import { MarkdownStreamState } from "./markdown-stream.js";
 import { makeMessageQueue } from "../core/message-queue.js";
 import { SkillRegistry } from "../skills/loader.js";
 import { execFileSync } from "node:child_process";
 import { join } from "node:path";
-import { existsSync } from "node:fs";
+import { existsSync, readFileSync } from "node:fs";
+import { whichBinary, nodeToolBinary } from "../utils/platform.js";
 import { KeybindingManager } from "./keybindings.js";
+import { detectKeyboardProtocolSupport, enableKeyboardProtocol, } from "./terminal-keyboard-protocol.js";
 import { ThemeManager, cycleNorseTheme } from "./themes.js";
 import { TUIVoiceController } from "./voice-controller.js";
 import { buildPrimaryAgentStatuses, cycleModel, cyclePanel, cycleThinkingEffort, readWorkspaceDiff, resolveFileAttachments, } from "./helpers.js";
 import { parseReferences, resolveReferences, expandPromptWithReferences, } from "./context-references.js";
 import { parseDeepLink, executeDeepLink } from "../core/deep-link.js";
+import { parseComputerActionCommand } from "./computer-action-parser.js";
+import { detectAvailableTools, executeDesktopAction, listDesktopActions, } from "../computer-use/platform-bindings.js";
 // ── Types ──────────────────────────────────────────────────
 const VALID_MODES = [
     "default",
@@ -66,6 +74,71 @@ const VALID_MODES = [
     "review",
     "exploit",
 ];
+function chooseProviderCredentialMethod(providerId, token, spec) {
+    if (!spec)
+        throw new Error(`Unknown provider: ${providerId}`);
+    const supported = spec.supportedMethods;
+    const normalizedToken = token.trim();
+    if (supported.includes("apiKey")) {
+        if (providerId === "copilot" && supported.includes("oauth"))
+            return "oauth";
+        if (supported.includes("subscription") &&
+            (normalizedToken.startsWith("sk-ant-oat") ||
+                (providerId === "codex" && !normalizedToken.startsWith("sk-")))) {
+            return "subscription";
+        }
+        return "apiKey";
+    }
+    if (supported.includes("oauth"))
+        return "oauth";
+    if (supported.includes("subscription"))
+        return "subscription";
+    if (supported.includes("cli"))
+        return "cli";
+    if (supported.includes("local"))
+        return "local";
+    throw new Error(`${spec.name} has no supported credential flow`);
+}
+function providerServiceMethodToStatusMethod(method) {
+    switch (method) {
+        case "apiKey":
+            return "api-key";
+        case "oauth":
+            return "oauth-token";
+        case "subscription":
+            return "subscription-direct";
+        case "local":
+            return "local";
+        case "cli":
+            return "local";
+    }
+}
+function providerServiceBilling(state, previous) {
+    const method = state.credential?.method;
+    if (method === "subscription")
+        return "subscription";
+    if (method === "local" || method === "cli" || state.tier === "local" || state.tier === "free") {
+        return "free";
+    }
+    if (state.credential)
+        return "api-key";
+    return previous.billing;
+}
+function mergeProviderState(previous, state) {
+    return {
+        ...previous,
+        label: state.name,
+        available: state.configured,
+        authMethod: state.credential
+            ? providerServiceMethodToStatusMethod(state.credential.method)
+            : state.tier === "local" || state.tier === "free"
+                ? "local"
+                : previous.authMethod,
+        billing: providerServiceBilling(state, previous),
+        models: state.models.map((model) => model.id),
+        error: state.lastError,
+    };
+}
 // ── V9 T14.1 — Flicker-free TUI mode ───────────────────────
 //
 // Ink's default reconciliation is React's full virtual-DOM diff per render.
@@ -119,12 +192,14 @@ const NO_FLICKER_MODE = (() => {
  * matters more than skip-paint cost.
  */
 const MainScene = memo(function MainScene(props) {
-    const { messages, isStreaming, streamingContent, currentModel, activePanel, diffPanel, agentStatuses, thinkingEffort, history, currentThemeBorder, currentThemePrimary, currentThemeInfo, } = props;
-    return (_jsxs(Box, { flexGrow: 1, children: [_jsx(Box, { flexGrow: 1, flexBasis: 0, children: _jsx(ChatView, { messages: messages, isStreaming: isStreaming, streamingContent: streamingContent, currentModel: currentModel }) }), _jsxs(Box, { width: 44, marginLeft: 1, borderStyle: "round", borderColor: currentThemeBorder, flexDirection: "column", paddingX: 1, children: [_jsxs(Box, { justifyContent: "space-between", marginBottom: 1, children: [_jsx(Text, { bold: true, color: currentThemePrimary, children: activePanel === "diff"
-                                    ? "◆ Diff"
-                                    : activePanel === "agents"
-                                        ? "◆ Agents"
-                                        : "◆ Tasks" }), _jsx(Text, { color: currentThemeInfo, children: "tab to cycle" })] }), activePanel === "diff" && diffPanel && (_jsx(DiffViewer, { filePath: diffPanel.filePath, hunks: diffPanel.hunks, compact: true, maxLines: 40 })), activePanel === "diff" && !diffPanel && (_jsxs(Box, { flexDirection: "column", gap: 1, children: [_jsx(Text, { color: currentThemePrimary, bold: true, children: "Quick keys" }), _jsxs(Box, { gap: 1, children: [_jsx(Text, { color: currentThemeInfo, bold: true, children: "Ctrl+M" }), _jsx(Text, { dimColor: true, children: "switch model" })] }), _jsxs(Box, { gap: 1, children: [_jsx(Text, { color: currentThemeInfo, bold: true, children: "Ctrl+P" }), _jsx(Text, { dimColor: true, children: "command palette" })] }), _jsxs(Box, { gap: 1, children: [_jsx(Text, { color: currentThemeInfo, bold: true, children: "Ctrl+R" }), _jsx(Text, { dimColor: true, children: "history search" })] }), _jsxs(Box, { gap: 1, children: [_jsx(Text, { color: currentThemeInfo, bold: true, children: "Ctrl+T" }), _jsx(Text, { dimColor: true, children: "thinking depth" })] }), _jsxs(Box, { gap: 1, children: [_jsx(Text, { color: currentThemeInfo, bold: true, children: "Tab" }), _jsx(Text, { dimColor: true, children: "cycle panel" })] }), _jsxs(Box, { gap: 1, children: [_jsx(Text, { color: currentThemeInfo, bold: true, children: "/" }), _jsx(Text, { dimColor: true, children: "slash menu" })] }), _jsxs(Box, { gap: 1, children: [_jsx(Text, { color: currentThemeInfo, bold: true, children: "Esc Esc" }), _jsx(Text, { dimColor: true, children: "edit prev" })] }), _jsx(Box, { marginTop: 1, children: _jsx(Text, { dimColor: true, children: "Edits land here as they happen." }) })] })), activePanel === "agents" && _jsx(AgentStatusPanel, { agents: agentStatuses }), activePanel === "tasks" && (_jsxs(Box, { flexDirection: "column", gap: 1, children: [_jsxs(Box, { gap: 1, children: [_jsx(Text, { color: currentThemeInfo, bold: true, children: "Thinking" }), _jsx(Text, { dimColor: true, children: thinkingEffort })] }), _jsxs(Box, { gap: 1, children: [_jsx(Text, { color: currentThemeInfo, bold: true, children: "Panel" }), _jsx(Text, { dimColor: true, children: activePanel })] }), _jsx(Text, { bold: true, dimColor: true, children: "Recent prompts" }), history.length === 0 && _jsx(Text, { dimColor: true, children: "(none yet \u2014 type to begin)" }), history.slice(0, 5).map((entry, index) => (_jsxs(Box, { gap: 1, children: [_jsxs(Text, { color: currentThemePrimary, children: [index + 1, "."] }), _jsxs(Text, { dimColor: true, children: [entry.slice(0, 36), entry.length > 36 ? "..." : ""] })] }, `task-${index}`)))] }))] })] }));
+    const { messages, isStreaming, streamingContent, streamingThinking, currentModel, activePanel, diffPanel, agentStatuses, thinkingEffort, history, computerTools, computerActions, currentThemeBorder, currentThemePrimary, currentThemeInfo, } = props;
+    return (_jsxs(Box, { flexGrow: 1, children: [_jsx(Box, { flexGrow: 1, flexBasis: 0, children: _jsx(ChatView, { messages: messages, isStreaming: isStreaming, streamingContent: streamingContent, streamingThinking: streamingThinking, currentModel: currentModel }) }), _jsxs(Box, { width: 36, marginLeft: 1, borderStyle: "single", borderColor: currentThemeBorder, flexDirection: "column", paddingX: 1, children: [_jsxs(Box, { justifyContent: "space-between", marginBottom: 1, children: [_jsxs(Box, { gap: 1, children: [_jsx(Text, { color: currentThemePrimary, bold: true, children: "\u258D" }), _jsx(Text, { bold: true, color: currentThemePrimary, children: activePanel === "diff"
+                                            ? "Diff"
+                                            : activePanel === "agents"
+                                                ? "Agents"
+                                                : activePanel === "computer"
+                                                    ? "Computer"
+                                                    : "Tasks" })] }), _jsx(Text, { color: currentThemeInfo, dimColor: true, children: "\u21B5 tab" })] }), activePanel === "diff" && diffPanel && (_jsx(DiffViewer, { filePath: diffPanel.filePath, hunks: diffPanel.hunks, compact: true, maxLines: 40 })), activePanel === "diff" && !diffPanel && (_jsxs(Box, { flexDirection: "column", gap: 1, children: [_jsx(Text, { color: currentThemePrimary, bold: true, children: "Quick keys" }), _jsxs(Box, { gap: 1, children: [_jsx(Text, { color: currentThemeInfo, bold: true, children: "Ctrl+O" }), _jsx(Text, { dimColor: true, children: "switch model" })] }), _jsxs(Box, { gap: 1, children: [_jsx(Text, { color: currentThemeInfo, bold: true, children: "Ctrl+P" }), _jsx(Text, { dimColor: true, children: "command palette" })] }), _jsxs(Box, { gap: 1, children: [_jsx(Text, { color: currentThemeInfo, bold: true, children: "Ctrl+R" }), _jsx(Text, { dimColor: true, children: "history search" })] }), _jsxs(Box, { gap: 1, children: [_jsx(Text, { color: currentThemeInfo, bold: true, children: "Ctrl+T" }), _jsx(Text, { dimColor: true, children: "thinking depth" })] }), _jsxs(Box, { gap: 1, children: [_jsx(Text, { color: currentThemeInfo, bold: true, children: "Tab" }), _jsx(Text, { dimColor: true, children: "cycle panel" })] }), _jsxs(Box, { gap: 1, children: [_jsx(Text, { color: currentThemeInfo, bold: true, children: "/" }), _jsx(Text, { dimColor: true, children: "slash menu" })] }), _jsxs(Box, { gap: 1, children: [_jsx(Text, { color: currentThemeInfo, bold: true, children: "Esc Esc" }), _jsx(Text, { dimColor: true, children: "edit prev" })] }), _jsx(Box, { marginTop: 1, children: _jsx(Text, { dimColor: true, children: "Edits land here as they happen." }) })] })), activePanel === "agents" && _jsx(AgentStatusPanel, { agents: agentStatuses }), activePanel === "tasks" && (_jsxs(Box, { flexDirection: "column", gap: 1, children: [_jsxs(Box, { gap: 1, children: [_jsx(Text, { color: currentThemeInfo, bold: true, children: "Thinking" }), _jsx(Text, { dimColor: true, children: thinkingEffort })] }), _jsxs(Box, { gap: 1, children: [_jsx(Text, { color: currentThemeInfo, bold: true, children: "Panel" }), _jsx(Text, { dimColor: true, children: activePanel })] }), _jsx(Text, { bold: true, dimColor: true, children: "Recent prompts" }), history.length === 0 && _jsx(Text, { dimColor: true, children: "(none yet \u2014 type to begin)" }), history.slice(0, 5).map((entry, index) => (_jsxs(Box, { gap: 1, children: [_jsxs(Text, { color: currentThemePrimary, children: [index + 1, "."] }), _jsxs(Text, { dimColor: true, children: [entry.slice(0, 36), entry.length > 36 ? "..." : ""] })] }, `task-${index}`)))] })), activePanel === "computer" && (_jsxs(Box, { flexDirection: "column", gap: 1, children: [_jsx(Text, { color: currentThemePrimary, bold: true, children: "Desktop control" }), _jsxs(Box, { gap: 1, children: [_jsx(Text, { color: computerTools.length > 0 ? "green" : "yellow", bold: true, children: computerTools.length > 0 ? "Ready" : "Setup" }), _jsx(Text, { dimColor: true, children: computerTools.length > 0 ? computerTools.join(", ") : "install cliclick/xdotool" })] }), _jsx(Text, { bold: true, dimColor: true, children: "Actions" }), computerActions.slice(0, 10).map((action) => (_jsxs(Box, { gap: 1, children: [_jsx(Text, { color: currentThemeInfo, children: "\u2022" }), _jsx(Text, { children: action })] }, action))), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsx(Text, { color: currentThemeInfo, children: "/computer click 420 320" }), _jsx(Text, { color: currentThemeInfo, children: "/computer type hello from WOTANN" }), _jsx(Text, { color: currentThemeInfo, children: "/computer key command+c" }), _jsx(Text, { dimColor: true, children: "iOS Desktop Control uses the same shared route table." })] })] }))] })] }));
 }, 
 // Custom equality: skip re-render if every prop reference is unchanged
 // AND messages.length matches. We use length + last-message identity as
@@ -137,6 +212,8 @@ const MainScene = memo(function MainScene(props) {
         return false;
     if (prev.streamingContent !== next.streamingContent)
         return false;
+    if (prev.streamingThinking !== next.streamingThinking)
+        return false;
     if (prev.currentModel !== next.currentModel)
         return false;
     if (prev.activePanel !== next.activePanel)
@@ -149,6 +226,10 @@ const MainScene = memo(function MainScene(props) {
         return false;
     if (prev.history !== next.history)
         return false;
+    if (prev.computerTools !== next.computerTools)
+        return false;
+    if (prev.computerActions !== next.computerActions)
+        return false;
     if (prev.currentThemeBorder !== next.currentThemeBorder)
         return false;
     if (prev.currentThemePrimary !== next.currentThemePrimary)
@@ -176,6 +257,14 @@ export function WotannApp({ version, providers, initialModel = "gemma4:e4b", ini
     const [messages, setMessages] = useState(() => [...initialMessages]);
     const [isStreaming, setIsStreaming] = useState(false);
     const [streamingContent, setStreamingContent] = useState("");
+    const [streamingThinking, setStreamingThinking] = useState("");
+    // Synchronous guard against React state-update races: setIsStreaming
+    // is async, so a second Enter pressed within a render window sees the
+    // old false value and takes the regular path again — pushing a duplicate
+    // user message AND opening a parallel runtime.query. The ref flips
+    // synchronously inside handleSubmit so subsequent calls in the same
+    // tick see the in-flight state and route to the queue path.
+    const streamingGuardRef = useRef(false);
     const [promptValue, setPromptValue] = useState("");
     const [history, setHistory] = useState(() => [...initialMessages]
         .filter((msg) => msg.role === "user")
@@ -183,13 +272,28 @@ export function WotannApp({ version, providers, initialModel = "gemma4:e4b", ini
         .reverse());
     const [currentMode, setCurrentMode] = useState(runtime?.getCurrentMode() ?? "default");
     const [currentModel, setCurrentModel] = useState(initialModel);
+    // Mirror of runtime.session.provider so the picker, status bar, and
+    // routing all agree on which provider is active. Initialized to the
+    // bootstrap-detected provider; updated in lock-step with currentModel
+    // whenever the user picks a new provider/model pair.
+    const [currentProvider, setCurrentProvider] = useState(initialProvider);
+    const [liveProviders, setLiveProviders] = useState(providers);
+    useEffect(() => {
+        setLiveProviders(providers);
+    }, [providers]);
     const [thinkingEffort, setThinkingEffort] = useState(runtime?.getThinkingEffort() ?? "medium");
     const themeManagerRef = useRef(new ThemeManager("default", uiStatePath));
     const [themeName, setThemeName] = useState(themeManagerRef.current.getCurrent().name);
     const [activePanel, setActivePanel] = useState(() => {
         const persistedPanel = themeManagerRef.current.readPersistedState().panel;
-        return persistedPanel === "agents" || persistedPanel === "tasks" ? persistedPanel : "diff";
+        return persistedPanel === "agents" ||
+            persistedPanel === "tasks" ||
+            persistedPanel === "computer"
+            ? persistedPanel
+            : "diff";
     });
+    const [computerTools, setComputerTools] = useState(() => detectAvailableTools());
+    const [computerActions] = useState(() => listDesktopActions());
     const [diffEntries, setDiffEntries] = useState(() => readWorkspaceDiff(workingDir));
     const [agentStatuses, setAgentStatuses] = useState(() => buildPrimaryAgentStatuses({
         model: initialModel,
@@ -207,7 +311,7 @@ export function WotannApp({ version, providers, initialModel = "gemma4:e4b", ini
     });
     const abortRef = useRef(null);
     const skillRegistryRef = useRef(null);
-    const keybindingManagerRef = useRef(new KeybindingManager());
+    const keybindingManagerRef = useRef(new KeybindingManager(undefined, detectKeyboardProtocolSupport()));
     const voiceControllerRef = useRef(new TUIVoiceController());
     const [voiceBusy, setVoiceBusy] = useState(false);
     // Mid-stream message queue (per-session, never module-global per QB#7).
@@ -219,10 +323,11 @@ export function WotannApp({ version, providers, initialModel = "gemma4:e4b", ini
     const [queueDepth, setQueueDepth] = useState(0);
     const [showHistoryPicker, setShowHistoryPicker] = useState(false);
     const [showCommandPalette, setShowCommandPalette] = useState(false);
-    // Ctrl+M opens an interactive provider/model picker (replaces the
+    // Ctrl+O opens an interactive provider/model picker (replaces the
     // prior round-robin cycleModel pattern that was unusable past 2-3
     // providers). Modeled after OpenClaw's modal-overlay picker.
     const [showModelPicker, setShowModelPicker] = useState(false);
+    const [showProviderSetup, setShowProviderSetup] = useState(false);
     // Generic option picker — driven by `optionPicker` (null when closed).
     // Used by `/mode`, `/theme`, `/thinking` to give users an interactive
     // selector instead of a static list with "type the next arg" hint.
@@ -265,6 +370,18 @@ export function WotannApp({ version, providers, initialModel = "gemma4:e4b", ini
         if (messages.length > 0 && showStartup)
             setShowStartup(false);
     }, [messages.length, showStartup]);
+    // Opt into the kitty keyboard protocol on supported terminals so
+    // Ctrl+M / Ctrl+I / Ctrl+H / Ctrl+J become distinguishable from
+    // Enter/Tab/Backspace/LF. Cleanup on unmount restores the parent's
+    // keyboard mode. No-op on unsupported terminals — Ctrl+O / Ctrl+X
+    // remain the portable bindings.
+    useEffect(() => {
+        const mode = detectKeyboardProtocolSupport();
+        const restore = enableKeyboardProtocol(mode);
+        return () => {
+            restore();
+        };
+    }, []);
     // Wire the TUI-owned MessageQueue into the runtime so the runtime's
     // pre-model drain reads from the same queue the submit handler
     // enqueues to. Inspired by langchain-ai/open-swe
@@ -331,6 +448,38 @@ export function WotannApp({ version, providers, initialModel = "gemma4:e4b", ini
             turnCount,
         }));
     }, [currentModel, currentMode, isStreaming, turnCount]);
+    // Startup auth-expiry sweep — runs once on mount. For each provider
+    // that has a known expiry timestamp (codex OAuth, anthropic
+    // subscription tokens), warn the user if it's in the past or expiring
+    // within an hour. Catches stale credentials BEFORE the user spends
+    // 30s on a doomed query and the watchdog has to clean up.
+    useEffect(() => {
+        void (async () => {
+            try {
+                const { detectExistingCodexCredential } = await import("../providers/codex-detector.js");
+                const codex = detectExistingCodexCredential();
+                if (codex.found && codex.expiresAt) {
+                    const expiresInMs = codex.expiresAt * 1000 - Date.now();
+                    if (expiresInMs < 0) {
+                        appendSystemMessage(`⚠ Codex token expired ${Math.abs(Math.round(expiresInMs / 60000))}m ago. ` +
+                            `Run \`codex login\` in another shell, then \`wotann login codex\` to refresh.`);
+                    }
+                    else if (expiresInMs < 60 * 60 * 1000) {
+                        appendSystemMessage(`⚠ Codex token expires in ${Math.round(expiresInMs / 60000)}m. ` +
+                            `Refresh now via \`codex login\` to avoid mid-session auth failures.`);
+                    }
+                }
+            }
+            catch {
+                // Detection is best-effort; never block startup on it.
+            }
+        })();
+        // Mount-only — no deps. Re-running on every render would spam the
+        // chat with the same warning. The `react-hooks/exhaustive-deps`
+        // rule isn't loaded in eslint.config.js, so a disable-comment for
+        // it is itself a lint error ("rule not found") — see CI failure
+        // 25271249471. Closures here are mount-stable by design.
+    }, []);
     // Sync stats from runtime after each query
     const syncStatsFromRuntime = useCallback(() => {
         if (!runtime)
@@ -402,8 +551,8 @@ export function WotannApp({ version, providers, initialModel = "gemma4:e4b", ini
                 // pressing the bound key still cycles linearly for users who
                 // rely on muscle memory — but the default is now a proper
                 // searchable list so the 19-provider stack is navigable.
-                // The cycle path remains accessible via the `Ctrl+Shift+M`
-                // chord and the `/model next` command.
+                // The cycle path remains accessible via the `/model next`
+                // command.
                 setShowModelPicker((prev) => !prev);
                 break;
             }
@@ -559,7 +708,7 @@ export function WotannApp({ version, providers, initialModel = "gemma4:e4b", ini
     // across renders while still reflecting live app state.
     const paletteStateRef = useRef({
         currentModel,
-        providers,
+        providers: liveProviders,
         themeName,
         history,
         runtime,
@@ -567,7 +716,7 @@ export function WotannApp({ version, providers, initialModel = "gemma4:e4b", ini
     });
     paletteStateRef.current = {
         currentModel,
-        providers,
+        providers: liveProviders,
         themeName,
         history,
         runtime,
@@ -629,7 +778,7 @@ export function WotannApp({ version, providers, initialModel = "gemma4:e4b", ini
             {
                 id: "palette.toggle-context-inspector",
                 label: "Toggle Context Inspector",
-                description: "Show context source panel (Ctrl+I)",
+                description: "Show context source panel (Ctrl+X)",
                 keywords: ["context", "inspect", "sources"],
                 handler: () => {
                     setShowContextPanel((prev) => !prev);
@@ -698,6 +847,7 @@ export function WotannApp({ version, providers, initialModel = "gemma4:e4b", ini
             onVoiceCapture: () => void handleVoiceCapture(),
             onCycleMode: cycleMode,
             onOpenMagic: openMagic,
+            onOpenProviderSetup: () => setShowProviderSetup(true),
         });
         // Wave 4 — admin overlay commands (trust, gdpr, audit, automations).
         // These are registered alongside R-09 so the same Cmd+P fuzzy search
@@ -816,13 +966,237 @@ export function WotannApp({ version, providers, initialModel = "gemma4:e4b", ini
                     runtime.close();
                 exit();
                 return true;
-            case "/clear":
-                setMessages([]);
-                setShowStartup(true);
-                setTurnCount(0);
-                setPromptValue("");
-                setStats({ cost: 0, contextPercent: 0, reads: 0, edits: 0, bashCalls: 0 });
+            case "/clear": {
+                // Confirmation picker — wiping the conversation is destructive
+                // (no undo path) and a stray /clear costs the user the entire
+                // turn history. Skip the picker when the user types
+                // "/clear yes" or the message list is already empty.
+                if (arg === "yes" || arg === "force" || messages.length === 0) {
+                    setMessages([]);
+                    setShowStartup(true);
+                    setTurnCount(0);
+                    setPromptValue("");
+                    setStats({ cost: 0, contextPercent: 0, reads: 0, edits: 0, bashCalls: 0 });
+                    return true;
+                }
+                setOptionPicker({
+                    title: `Clear ${messages.length} message${messages.length === 1 ? "" : "s"}?`,
+                    options: [
+                        {
+                            value: "cancel",
+                            label: "Cancel",
+                            description: "Keep the conversation",
+                        },
+                        {
+                            value: "confirm",
+                            label: "Clear conversation",
+                            description: "Delete all turns. Cost + edit stats also reset.",
+                        },
+                    ],
+                    currentValue: "cancel",
+                    onSelect: (value) => {
+                        setOptionPicker(null);
+                        if (value === "confirm") {
+                            setMessages([]);
+                            setShowStartup(true);
+                            setTurnCount(0);
+                            setPromptValue("");
+                            setStats({
+                                cost: 0,
+                                contextPercent: 0,
+                                reads: 0,
+                                edits: 0,
+                                bashCalls: 0,
+                            });
+                            appendSystemMessage("Conversation cleared.");
+                        }
+                    },
+                });
+                return true;
+            }
+            case "/save": {
+                // Save the current conversation to ~/.wotann/conversations/<name>.md
+                // for later /recall. Uses the user-supplied name (slug-cleaned) or
+                // the active session id when no name given.
+                (async () => {
+                    try {
+                        const slug = arg
+                            ? arg
+                                .toLowerCase()
+                                .replace(/[^a-z0-9]+/g, "-")
+                                .replace(/^-+|-+$/g, "")
+                                .slice(0, 60)
+                            : `session-${Date.now()}`;
+                        const fs = await import("node:fs/promises");
+                        const fsSync = await import("node:fs");
+                        const { resolveWotannHomeSubdir } = await import("../utils/wotann-home.js");
+                        const dir = resolveWotannHomeSubdir("conversations");
+                        if (!fsSync.existsSync(dir)) {
+                            fsSync.mkdirSync(dir, { recursive: true, mode: 0o700 });
+                        }
+                        const path = `${dir}/${slug}.md`;
+                        const lines = [
+                            `# WOTANN conversation: ${slug}`,
+                            ``,
+                            `Saved: ${new Date().toISOString()}`,
+                            `Provider: ${currentProvider} · Model: ${currentModel} · Mode: ${currentMode}`,
+                            ``,
+                            ...messages.map((m) => {
+                                const role = m.role === "user" ? "You" : m.role === "assistant" ? "WOTANN" : "System";
+                                return `## ${role}\n\n${m.content}\n`;
+                            }),
+                        ];
+                        await fs.writeFile(path, lines.join("\n"), "utf-8");
+                        sysMsg(`Saved ${messages.length} message${messages.length === 1 ? "" : "s"} to ${path}`);
+                    }
+                    catch (err) {
+                        sysMsg(`/save failed: ${err instanceof Error ? err.message : String(err)}`);
+                    }
+                })();
+                return true;
+            }
+            case "/recall": {
+                // List or fuzzy-search saved conversations from
+                // ~/.wotann/conversations/. With no arg, opens an inline picker
+                // of every saved file. With an arg, fuzzy-matches names and
+                // opens that file (read-only — replays into the chat as
+                // historical context, doesn't resume the live session).
+                (async () => {
+                    try {
+                        const fs = await import("node:fs/promises");
+                        const fsSync = await import("node:fs");
+                        const { resolveWotannHomeSubdir } = await import("../utils/wotann-home.js");
+                        const dir = resolveWotannHomeSubdir("conversations");
+                        if (!fsSync.existsSync(dir)) {
+                            sysMsg("No saved conversations yet. /save [name] to create one.");
+                            return;
+                        }
+                        const files = (await fs.readdir(dir))
+                            .filter((f) => f.endsWith(".md"))
+                            .sort()
+                            .reverse();
+                        if (files.length === 0) {
+                            sysMsg("No saved conversations. /save [name] to create one.");
+                            return;
+                        }
+                        if (arg) {
+                            const match = files.find((f) => f === `${arg}.md` || f.includes(arg)) ?? null;
+                            if (!match) {
+                                sysMsg(`No conversation matching "${arg}". Available: ${files.slice(0, 5).join(", ")}`);
+                                return;
+                            }
+                            const body = await fs.readFile(`${dir}/${match}`, "utf-8");
+                            sysMsg(`── ${match} ──\n${body.slice(0, 4000)}${body.length > 4000 ? "\n[truncated]" : ""}`);
+                            return;
+                        }
+                        setOptionPicker({
+                            title: `Recall conversation (${files.length} saved)`,
+                            options: files.slice(0, 20).map((f) => ({
+                                value: f,
+                                label: f.replace(/\.md$/, ""),
+                                description: `${dir}/${f}`,
+                            })),
+                            onSelect: (value) => {
+                                setOptionPicker(null);
+                                void (async () => {
+                                    try {
+                                        const body = await (await import("node:fs/promises")).readFile(`${dir}/${value}`, "utf-8");
+                                        appendSystemMessage(`── ${value} ──\n${body.slice(0, 4000)}${body.length > 4000 ? "\n[truncated]" : ""}`);
+                                    }
+                                    catch (err) {
+                                        appendSystemMessage(`Failed to read ${value}: ${err instanceof Error ? err.message : String(err)}`);
+                                    }
+                                })();
+                            },
+                        });
+                    }
+                    catch (err) {
+                        sysMsg(`/recall failed: ${err instanceof Error ? err.message : String(err)}`);
+                    }
+                })();
+                return true;
+            }
+            case "/share": {
+                // Copy the conversation as markdown to the clipboard. macOS
+                // pbcopy is the only platform we can rely on without adding a
+                // dep — Linux users can paste from the system message preview.
+                if (messages.length === 0) {
+                    sysMsg("No conversation to share.");
+                    return true;
+                }
+                const md = [
+                    `# WOTANN conversation`,
+                    ``,
+                    `${new Date().toISOString()} · ${currentProvider}/${currentModel} · mode: ${currentMode}`,
+                    ``,
+                    ...messages.map((m) => {
+                        const role = m.role === "user" ? "You" : m.role === "assistant" ? "WOTANN" : "System";
+                        return `## ${role}\n\n${m.content}\n`;
+                    }),
+                ].join("\n");
+                try {
+                    execFileSync("pbcopy", [], { input: md, timeout: 2000 });
+                    sysMsg(`Copied ${messages.length} message${messages.length === 1 ? "" : "s"} (${md.length} chars) to clipboard.`);
+                }
+                catch {
+                    // pbcopy unavailable — paste a preview into the chat so the
+                    // user can copy from the terminal's scrollback.
+                    sysMsg(`pbcopy unavailable. Markdown preview:\n${md.slice(0, 2000)}${md.length > 2000 ? "\n[truncated — /save to write to disk]" : ""}`);
+                }
                 return true;
+            }
+            case "/agents": {
+                // List or pick from registered orchestration agents. The
+                // registry is populated at runtime startup with planning /
+                // implementation / utility / specialist tiers; /agents
+                // surfaces them without forcing the user to remember the
+                // catalog. Selecting a row prints a short profile (tier,
+                // model, description) — actual dispatch goes through
+                // /dispatch since it needs a task arg.
+                if (!runtime) {
+                    sysMsg("Agents require WotannRuntime.");
+                    return true;
+                }
+                const registry = runtime.getAgentRegistry();
+                const all = registry.getAll();
+                if (all.length === 0) {
+                    sysMsg("No agents registered. Add YAML in .wotann/agents/ to populate.");
+                    return true;
+                }
+                if (arg === "list") {
+                    sysMsg([
+                        `${all.length} registered agents:`,
+                        ...all.map((a) => `  ${a.id.padEnd(28)} ${a.model.padEnd(10)} ${a.name}`),
+                    ].join("\n"));
+                    return true;
+                }
+                setOptionPicker({
+                    title: `Agent registry (${all.length} agents)`,
+                    options: all.slice(0, 30).map((a) => ({
+                        value: a.id,
+                        label: a.id,
+                        description: `${a.model} · ${a.name}`,
+                    })),
+                    onSelect: (value) => {
+                        setOptionPicker(null);
+                        const def = registry.get(value);
+                        if (!def) {
+                            appendSystemMessage(`Agent "${value}" not found.`);
+                            return;
+                        }
+                        appendSystemMessage([
+                            `╭─ Agent: ${def.id} ─`,
+                            `│  Name:           ${def.name}`,
+                            `│  Model:          ${def.model}`,
+                            `│  Allowed tools:  ${def.allowedTools.length}`,
+                            `│  Denied tools:   ${def.deniedTools.length}`,
+                            `│  Max turns:      ${def.maxTurns}`,
+                            `╰─ Use /dispatch ${def.id} <task> to invoke ─`,
+                        ].join("\n"));
+                    },
+                });
+                return true;
+            }
             case "/help":
                 sysMsg([
                     "╭─ WOTANN Commands ──────────────────────────────────────────╮",
@@ -830,22 +1204,30 @@ export function WotannApp({ version, providers, initialModel = "gemma4:e4b", ini
                     "│  ── Session ──                                           │",
                     "│  /help               Show this help                      │",
                     "│  /clear              Clear conversation + reset           │",
+                    "│  /save [name]        Save conversation to .wotann/         │",
+                    "│  /recall [name]      Pick a saved conversation to view     │",
+                    "│  /share              Copy current conversation to clipboard│",
+                    "│  /agents             Browse registered agents (picker)     │",
                     "│  /exit               Exit WOTANN                           │",
                     "│  /history            Show recent prompts                  │",
                     "│  /compact            Compact context window               │",
                     "│                                                          │",
                     "│  ── Configuration ──                                     │",
                     "│  /config [key=val]   View/edit configuration              │",
+                    "│  /login <prov> [key] Configure provider auth in daemon    │",
                     "│  /providers          List providers + auth status         │",
-                    "│  /model [name]       Show or switch model                 │",
+                    "│  /provider [name]    Switch provider (keeps model)        │",
+                    "│  /model [name]       Open picker / switch model           │",
+                    "│  /remote [set|clear] Configure iOS off-WiFi endpoint      │",
                     "│  /mode [name]        Show or switch behavioral mode       │",
                     "│  /thinking [level]   Set reasoning effort (low/med/high)  │",
                     "│  /theme [name]       Show or switch persisted theme       │",
-                    "│  /permission [mode]  Switch approval mode                 │",
+                    "│  /permission [mode]  Approval mode (autonomous available) │",
+                    "│  /verifier [on|off]  Toggle secondary-AI judge            │",
                     "│                                                          │",
                     "│  ── Intelligence ──                                      │",
                     "│  /context            Show context window budget           │",
-                    "│  /inspect            Context source inspector (Ctrl+I)    │",
+                    "│  /inspect            Context source inspector (Ctrl+X)    │",
                     "│  /skills [query]     List/search skills                   │",
                     "│  /memory [query]     Search memory (FTS5 + semantic)      │",
                     "│  /learnings          Show cross-session patterns          │",
@@ -896,21 +1278,204 @@ export function WotannApp({ version, providers, initialModel = "gemma4:e4b", ini
                     "│  /context-panel    Toggle context source panel             │",
                     "│                                                          │",
                     "│  ── Shortcuts ──                                         │",
-                    "│  Ctrl+C  Abort streaming    Ctrl+M  Cycle model           │",
-                    "│  Ctrl+R  Search history     Ctrl+I  Context panel         │",
+                    "│  Ctrl+C  Abort streaming    Ctrl+O  Cycle model           │",
+                    "│  Ctrl+R  Search history     Ctrl+X  Context panel         │",
                     "│  Ctrl+T  Thinking depth     Ctrl+/  Memory search         │",
                     "│  Tab     Cycle right panel  Esc     Close overlay         │",
                     "╰──────────────────────────────────────────────────────────╯",
                 ].join("\n"));
                 return true;
+            case "/remote": {
+                const parts = arg.trim().split(/\s+/).filter(Boolean);
+                const action = parts[0] ?? "status";
+                const targetUrl = action === "set" || action === "configure"
+                    ? parts.slice(1).join(" ")
+                    : action !== "status" && action !== "clear"
+                        ? arg.trim()
+                        : "";
+                if ((action === "set" || action === "configure") && !targetUrl) {
+                    appendSystemMessage("Usage: /remote set wss://your-host.example");
+                    return true;
+                }
+                sysMsg("Checking remote access through KAIROS daemon...");
+                void (async () => {
+                    try {
+                        const { KairosIPCClient } = await import("../daemon/kairos-ipc.js");
+                        const client = new KairosIPCClient(undefined, { requestTimeoutMs: 5_000 });
+                        try {
+                            const ok = await client.connect();
+                            if (!ok) {
+                                appendSystemMessage([
+                                    "KAIROS daemon IPC is not reachable.",
+                                    "Run `wotann daemon start`, then retry `/remote`.",
+                                ].join("\n"));
+                                return;
+                            }
+                            const remote = (await (action === "clear"
+                                ? client.call("remote.access.clear")
+                                : targetUrl
+                                    ? client.call("remote.access.configure", { url: targetUrl })
+                                    : client.call("remote.access.status")));
+                            const endpointLines = (remote.endpoints ?? []).map((endpoint) => {
+                                const scheme = endpoint.scheme ?? "ws";
+                                const port = endpoint.port ?? (scheme === "wss" ? 443 : 3849);
+                                return `  ${endpoint.label ?? "Remote"}: ${scheme}://${endpoint.host ?? "unknown"}:${port}`;
+                            });
+                            const configured = remote.setupOptions?.find((option) => option.id === "configured-url");
+                            appendSystemMessage([
+                                "Remote Access",
+                                "",
+                                `  Status: ${remote.status ?? "unknown"}`,
+                                `  Mode:   ${remote.mode ?? "unknown"}`,
+                                remote.message ? `  ${remote.message}` : "",
+                                ...endpointLines,
+                                endpointLines.length === 0 && configured?.command
+                                    ? `  Configure: ${configured.command}`
+                                    : "",
+                                endpointLines.length === 0 ? "  TUI: /remote set wss://your-host.example" : "",
+                            ]
+                                .filter(Boolean)
+                                .join("\n"));
+                        }
+                        finally {
+                            client.disconnect();
+                        }
+                    }
+                    catch (err) {
+                        appendSystemMessage(`Remote access command failed: ${err.message ?? "unknown error"}`);
+                    }
+                })();
+                return true;
+            }
+            case "/reauth": {
+                const [providerIdRaw = "", ...tokenParts] = arg.trim().split(/\s+/);
+                const providerId = providerIdRaw.toLowerCase();
+                const token = tokenParts.join(" ").trim();
+                if (!providerId) {
+                    setShowProviderSetup(true);
+                    return true;
+                }
+                void (async () => {
+                    try {
+                        const { getProviderService } = await import("../providers/provider-service.js");
+                        const service = getProviderService();
+                        const snapshot = await service.getSnapshot({ force: false });
+                        const known = snapshot.providers.find((provider) => provider.id === providerId);
+                        const spec = service.getSpec(providerId);
+                        if (!known) {
+                            appendSystemMessage(`Unknown provider "${providerId}". Run /providers to inspect the daemon catalog.`);
+                            return;
+                        }
+                        if (providerId === "ollama" && !token) {
+                            appendSystemMessage("Ollama uses the local desktop daemon and does not need an API key. Start Ollama on the Mac, then run /providers or Ctrl+O.");
+                            return;
+                        }
+                        if (!token) {
+                            appendSystemMessage([
+                                `Paste a credential to save ${known.name}: /login ${providerId} <token>`,
+                                providerId === "copilot"
+                                    ? "Use a GitHub token with Copilot access; WOTANN stores it as the Copilot OAuth credential."
+                                    : "",
+                            ]
+                                .filter(Boolean)
+                                .join("\n"));
+                            return;
+                        }
+                        const method = chooseProviderCredentialMethod(providerId, token, spec);
+                        const state = await service.saveCredential(providerId, {
+                            method,
+                            token,
+                            label: `${known.name} from TUI`,
+                        });
+                        const refreshed = await service.getSnapshot({ force: true });
+                        setLiveProviders((prev) => prev.map((provider) => {
+                            const fresh = refreshed.providers.find((candidate) => candidate.id === provider.provider);
+                            return fresh ? mergeProviderState(provider, fresh) : provider;
+                        }));
+                        const model = state?.defaultModel ?? state?.models[0]?.id ?? currentModel;
+                        if (state?.configured && model) {
+                            setCurrentProvider(providerId);
+                            setCurrentModel(model);
+                            runtime?.setActiveProvider(providerId, model);
+                        }
+                        appendSystemMessage(`${known.name} ${method} credential saved. ${model ? `Active model: ${model}` : "Refresh providers to discover models."}`);
+                    }
+                    catch (err) {
+                        appendSystemMessage(`/login failed: ${err instanceof Error ? err.message : String(err)}`);
+                    }
+                })();
+                return true;
+            }
+            case "/provider":
             case "/providers": {
-                const lines = providers.map((p) => {
-                    const icon = p.available ? "●" : "○";
-                    const models = p.available && p.models.length > 0 ? `  ${p.models.slice(0, 3).join(", ")}` : "";
-                    return `  ${icon} ${p.provider}${p.available ? "" : " (not configured)"}${models}`;
+                // Unified provider command. Pre-2026-05-03 there were TWO
+                // commands (/provider for switch, /providers for status);
+                // duplicate surface area. Now one command does both:
+                //   /provider               → inline picker
+                //   /provider <name>        → switch immediately
+                //   /provider status        → list all providers + auth state
+                //   /providers              → alias of /provider status (legacy)
+                const availableProviders = providers.filter((p) => p.available);
+                const showStatus = cmd === "/providers" || arg === "status" || arg === "ls" || arg === "list";
+                if (showStatus) {
+                    const lines = providers.map((p) => {
+                        const icon = p.available ? "●" : "○";
+                        const active = p.provider === currentProvider ? " ← active" : "";
+                        const models = p.available && p.models.length > 0 ? `  ${p.models.slice(0, 3).join(", ")}` : "";
+                        return `  ${icon} ${p.provider}${p.available ? "" : " (not configured)"}${active}${models}`;
+                    });
+                    const activeCount = availableProviders.length;
+                    sysMsg(`Providers: ${activeCount}/${providers.length} active\n\n${lines.join("\n")}\n\n` +
+                        `Switch: \`/provider <name>\` or just \`/provider\` for picker.`);
+                    return true;
+                }
+                if (availableProviders.length === 0) {
+                    sysMsg("No providers configured. Run `wotann onboard` to set one up.");
+                    return true;
+                }
+                if (arg) {
+                    const target = availableProviders.find((p) => p.provider === arg);
+                    if (!target) {
+                        sysMsg(`Provider "${arg}" not authed. Available: ${availableProviders
+                            .map((p) => p.provider)
+                            .join(", ")}`);
+                        return true;
+                    }
+                    const nextModel = target.models.includes(currentModel)
+                        ? currentModel
+                        : (target.models[0] ?? currentModel);
+                    setCurrentProvider(target.provider);
+                    setCurrentModel(nextModel);
+                    runtime?.setActiveProvider(target.provider, nextModel);
+                    sysMsg(`Provider switched to: ${target.provider} (model: ${nextModel})`);
+                    return true;
+                }
+                setOptionPicker({
+                    title: "Switch provider",
+                    options: availableProviders.map((p) => ({
+                        value: p.provider,
+                        label: p.provider,
+                        description: p.billing === "subscription"
+                            ? `subscription · ${p.models.length} models`
+                            : p.billing === "free"
+                                ? `free · ${p.models.length} models`
+                                : `API key · ${p.models.length} models`,
+                    })),
+                    currentValue: currentProvider,
+                    onSelect: (value) => {
+                        setOptionPicker(null);
+                        const target = availableProviders.find((p) => p.provider === value);
+                        if (!target)
+                            return;
+                        const nextModel = target.models.includes(currentModel)
+                            ? currentModel
+                            : (target.models[0] ?? currentModel);
+                        setCurrentProvider(target.provider);
+                        setCurrentModel(nextModel);
+                        runtime?.setActiveProvider(target.provider, nextModel);
+                        appendSystemMessage(`Provider switched to: ${target.provider} (model: ${nextModel})`);
+                    },
                 });
-                const active = providers.filter((p) => p.available).length;
-                sysMsg(`Providers: ${active}/${providers.length} active\n\n${lines.join("\n")}`);
                 return true;
             }
             case "/skills": {
@@ -1062,19 +1627,20 @@ export function WotannApp({ version, providers, initialModel = "gemma4:e4b", ini
                         }
                     }
                     lines.push("");
-                    lines.push("Open the picker with Ctrl+M to switch.");
+                    lines.push("Open the picker with Ctrl+O to switch.");
                     sysMsg(lines.join("\n"));
                     return true;
                 }
                 if (!arg) {
-                    // Condensed system message — the picker is the primary path
-                    // for switching models, so the slash command's job here is
-                    // to point at Ctrl+M and surface the current model in one
-                    // tight line. Long enumerations of every provider's model
-                    // list belong in /model status, not the bare command output.
-                    sysMsg(providerModels.size === 0
-                        ? `Current: ${currentModel} (no providers configured — run \`wotann login <provider>\`)`
-                        : `Current: ${currentModel}. Press Ctrl+M to switch · /model <name> · /model status`);
+                    // Open the searchable model picker inline. Skips the static
+                    // hint text the user complained about — typing /model now
+                    // does the same thing as Ctrl+O, no extra keystroke.
+                    if (providerModels.size === 0) {
+                        sysMsg(`Current: ${currentModel} (no providers configured — run \`wotann login <provider>\`)`);
+                    }
+                    else {
+                        setShowModelPicker(true);
+                    }
                 }
                 else {
                     // Validate model is available on some provider
@@ -1596,7 +2162,7 @@ export function WotannApp({ version, providers, initialModel = "gemma4:e4b", ini
                         }, async () => {
                             const tsc = await new Promise((resolve) => {
                                 try {
-                                    execFileSync("npx", ["tsc", "--noEmit"], {
+                                    execFileSync(nodeToolBinary("npx"), ["tsc", "--noEmit"], {
                                         cwd: runtime.getWorkingDir(),
                                         timeout: 60000,
                                     });
@@ -1609,7 +2175,7 @@ export function WotannApp({ version, providers, initialModel = "gemma4:e4b", ini
                             });
                             const tests = await new Promise((resolve) => {
                                 try {
-                                    execFileSync("npx", ["vitest", "run", "--reporter=dot"], {
+                                    execFileSync(nodeToolBinary("npx"), ["vitest", "run", "--reporter=dot"], {
                                         cwd: runtime.getWorkingDir(),
                                         timeout: 120000,
                                     });
@@ -1786,7 +2352,7 @@ export function WotannApp({ version, providers, initialModel = "gemma4:e4b", ini
                     .map((s) => `  ${s.source.padEnd(28)} ${String(s.tokens).padStart(7)} tokens  ${s.percent.toFixed(1)}%`);
                 const utilPct = snapshot.utilizationPercent;
                 sysMsg([
-                    "╭─ Context Source Inspector (Ctrl+I) ─────────────────────╮",
+                    "╭─ Context Source Inspector (Ctrl+X) ─────────────────────╮",
                     `│  Total: ${snapshot.totalTokens.toLocaleString().padStart(9)} / ${snapshot.maxTokens.toLocaleString()} tokens`,
                     `│  Usage: ${utilPct.toFixed(1)}%  ${utilPct > 75 ? "⚠ HIGH" : "✓ OK"}`,
                     "├──────────────────────────────────────────────────────────┤",
@@ -1806,36 +2372,100 @@ export function WotannApp({ version, providers, initialModel = "gemma4:e4b", ini
                 void (async () => {
                     const { MCPRegistry } = await import("../marketplace/registry.js");
                     const registry = new MCPRegistry({ projectDir: workingDir });
+                    const loaded = registry.loadFromDisk();
                     registry.registerBuiltins();
-                    registry.importFromClaudeCode();
+                    const persistRegistry = () => {
+                        try {
+                            return { path: registry.persistToDisk() };
+                        }
+                        catch (err) {
+                            return {
+                                error: err instanceof Error ? err.message : String(err),
+                            };
+                        }
+                    };
                     switch (mcpAction) {
                         case "list": {
                             const servers = registry.getAllServers();
                             if (servers.length === 0) {
-                                appendSystemMessage("No MCP servers registered. Import with: /mcp import");
+                                appendSystemMessage("No MCP servers registered. Import with: /mcp import claude|cursor|windsurf|codex|vscode|all");
                             }
                             else {
-                                const lines = servers.map((s) => `│  ${s.enabled ? "✓" : "✗"} ${s.name.padEnd(14)} ${s.command.padEnd(20)} ${s.transport}`);
+                                const lines = servers.map((s) => `│  ${s.enabled ? "✓" : "✗"} ${s.name.padEnd(14)} ${s.command.padEnd(20)} ${s.transport.padEnd(6)} ${s.autoStart === false ? "manual" : "auto"}`);
                                 appendSystemMessage([
                                     "╭─ MCP Server Registry ────────────────────────────────────╮",
-                                    `│  ${servers.length} server(s) registered                                 │`,
+                                    `│  ${servers.length} server(s) registered · ${loaded} persisted loaded`,
                                     "├──────────────────────────────────────────────────────────┤",
                                     ...lines,
                                     "├──────────────────────────────────────────────────────────┤",
-                                    "│  Commands: /mcp list | /mcp install <name>              │",
+                                    "│  Commands: /mcp list | /mcp inspect <name>              │",
+                                    "│            /mcp import <source> | /mcp install <name>   │",
                                     "│            /mcp remove <name> | /mcp audit <name>       │",
                                     "╰──────────────────────────────────────────────────────────╯",
                                 ].join("\n"));
                             }
                             break;
                         }
+                        case "import": {
+                            const source = (sub[1] ?? "all").toLowerCase();
+                            const importers = {
+                                claude: () => registry.importFromClaudeCode(),
+                                "claude-code": () => registry.importFromClaudeCode(),
+                                cursor: () => registry.importFromTool("cursor"),
+                                windsurf: () => registry.importFromTool("windsurf"),
+                                codex: () => registry.importFromTool("codex"),
+                                vscode: () => registry.importFromTool("vscode"),
+                            };
+                            const sources = source === "all"
+                                ? ["claude", "cursor", "windsurf", "codex", "vscode"]
+                                : [source];
+                            const invalid = sources.find((s) => !(s in importers));
+                            if (invalid) {
+                                appendSystemMessage("Usage: /mcp import claude|cursor|windsurf|codex|vscode|all");
+                                break;
+                            }
+                            const counts = sources.map((s) => ({ source: s, count: importers[s]() }));
+                            const total = counts.reduce((sum, item) => sum + item.count, 0);
+                            const persisted = persistRegistry();
+                            if ("error" in persisted) {
+                                appendSystemMessage(`MCP import failed while writing config: ${persisted.error}`);
+                                break;
+                            }
+                            appendSystemMessage([
+                                "╭─ MCP Import ─────────────────────────────────────────────╮",
+                                ...counts.map((item) => `│  ${item.source.padEnd(10)} ${String(item.count).padStart(3)} server${item.count === 1 ? " " : "s"}`),
+                                "├──────────────────────────────────────────────────────────┤",
+                                `│  Imported ${total} server${total === 1 ? "" : "s"} · wrote ${persisted.path}`,
+                                "╰──────────────────────────────────────────────────────────╯",
+                            ].join("\n"));
+                            break;
+                        }
                         case "install": {
                             const serverName = sub[1];
                             if (!serverName) {
                                 appendSystemMessage("Usage: /mcp install <name>");
                                 break;
                             }
-                            appendSystemMessage(`Installing MCP server: ${serverName}\nUse /mcp list to see registered servers.`);
+                            const existing = registry.getServer(serverName);
+                            if (!existing) {
+                                appendSystemMessage(`MCP server "${serverName}" is not known yet. Run /mcp import all, then /mcp list to choose a server.`);
+                                break;
+                            }
+                            if (!existing.command) {
+                                appendSystemMessage(`MCP server "${serverName}" has no command configured, so it cannot be installed.`);
+                                break;
+                            }
+                            registry.register({
+                                ...existing,
+                                enabled: true,
+                                autoStart: existing.autoStart ?? true,
+                            });
+                            const persisted = persistRegistry();
+                            if ("error" in persisted) {
+                                appendSystemMessage(`MCP server "${serverName}" was enabled in-memory, but config persistence failed: ${persisted.error}`);
+                                break;
+                            }
+                            appendSystemMessage(`Enabled MCP server "${serverName}" and persisted it to ${persisted.path}. Use /mcp inspect ${serverName} to verify health.`);
                             break;
                         }
                         case "remove": {
@@ -1850,7 +2480,12 @@ export function WotannApp({ version, providers, initialModel = "gemma4:e4b", ini
                             }
                             else {
                                 registry.unregister(serverName);
-                                appendSystemMessage(`Removed MCP server: ${serverName}`);
+                                const persisted = persistRegistry();
+                                if ("error" in persisted) {
+                                    appendSystemMessage(`MCP server "${serverName}" was removed in-memory, but config persistence failed: ${persisted.error}`);
+                                    break;
+                                }
+                                appendSystemMessage(`Removed MCP server "${serverName}" and persisted ${persisted.path}.`);
                             }
                             break;
                         }
@@ -1876,8 +2511,65 @@ export function WotannApp({ version, providers, initialModel = "gemma4:e4b", ini
                             }
                             break;
                         }
+                        case "inspect":
+                        case "status": {
+                            const serverName = sub[1];
+                            if (!serverName) {
+                                const servers = registry.getAllServers();
+                                appendSystemMessage([
+                                    "╭─ MCP Inspector ──────────────────────────────────────────╮",
+                                    "│  Pick a server to inspect:                               │",
+                                    ...servers.map((s) => `│  ${s.enabled ? "✓" : "○"} ${s.name.padEnd(18)} ${s.transport.padEnd(6)} ${s.command.slice(0, 22).padEnd(22)}│`),
+                                    "├──────────────────────────────────────────────────────────┤",
+                                    "│  Usage: /mcp inspect <name>                              │",
+                                    "╰──────────────────────────────────────────────────────────╯",
+                                ].join("\n"));
+                                break;
+                            }
+                            const server = registry.getServer(serverName);
+                            if (!server) {
+                                appendSystemMessage(`MCP server "${serverName}" not found.`);
+                                break;
+                            }
+                            const envNames = Object.keys(server.env ?? {});
+                            const envLine = envNames.length === 0
+                                ? "(none)"
+                                : envNames.map((name) => `${name}=••••`).join(", ");
+                            let commandHealth = "not checked";
+                            if (server.transport === "stdio" &&
+                                server.command &&
+                                !server.command.includes("/")) {
+                                try {
+                                    execFileSync(whichBinary(), [server.command], { stdio: "ignore" });
+                                    commandHealth = "binary found";
+                                }
+                                catch {
+                                    commandHealth = "binary missing";
+                                }
+                            }
+                            else if (server.transport === "http") {
+                                commandHealth = "http endpoint configured";
+                            }
+                            else if (server.command) {
+                                commandHealth = existsSync(server.command) ? "path exists" : "path missing";
+                            }
+                            appendSystemMessage([
+                                "╭─ MCP Inspector ──────────────────────────────────────────╮",
+                                `│  Name:       ${server.name}`,
+                                `│  Status:     ${server.enabled ? "enabled" : "disabled"} · ${server.autoStart === false ? "manual start" : "auto start"}`,
+                                `│  Health:     ${commandHealth}`,
+                                `│  Transport:  ${server.transport}`,
+                                `│  Command:    ${server.command}`,
+                                `│  Args:       ${server.args.join(" ") || "(none)"}`,
+                                `│  Env:        ${envLine}`,
+                                "├──────────────────────────────────────────────────────────┤",
+                                "│  Actions: /mcp audit <name> | /mcp remove <name>        │",
+                                "╰──────────────────────────────────────────────────────────╯",
+                            ].join("\n"));
+                            break;
+                        }
                         default:
-                            appendSystemMessage("Usage: /mcp [list|install|remove|audit] [name]");
+                            appendSystemMessage("Usage: /mcp [list|import|inspect|install|remove|audit] [name/source]");
                     }
                 })();
                 return true;
@@ -1915,25 +2607,101 @@ export function WotannApp({ version, providers, initialModel = "gemma4:e4b", ini
                         ? `Loaded personas (${personas.length}):\n${personas.map((p) => `  • ${p}`).join("\n")}`
                         : "No personas loaded. Create YAML files in .wotann/identity/personas/ or run /persona init.");
                 }
+                else if (personaSub === "switch" || personaSub.startsWith("switch ")) {
+                    const manager = runtime.getPersonaManager();
+                    const personas = manager.list();
+                    const argName = personaSub.startsWith("switch ")
+                        ? personaSub.slice("switch ".length).trim()
+                        : "";
+                    if (personas.length === 0) {
+                        sysMsg("No personas to switch to. Create YAML files in .wotann/identity/personas/ first.");
+                        return true;
+                    }
+                    if (argName) {
+                        if (!personas.includes(argName)) {
+                            sysMsg(`Persona "${argName}" not found. Available: ${personas.join(", ")}`);
+                            return true;
+                        }
+                        const setActive = manager
+                            .setActive;
+                        if (typeof setActive === "function") {
+                            setActive.call(manager, argName);
+                            sysMsg(`Persona switched to: ${argName}`);
+                        }
+                        else {
+                            sysMsg(`Persona switching not supported by this build.`);
+                        }
+                        return true;
+                    }
+                    // Inline picker — same pattern as /mode, /theme, /thinking,
+                    // /permission. Lists every loaded persona; selecting applies.
+                    setOptionPicker({
+                        title: "Switch persona",
+                        options: personas.map((p) => ({
+                            value: p,
+                            description: `.wotann/identity/personas/${p}`,
+                        })),
+                        onSelect: (value) => {
+                            setOptionPicker(null);
+                            const setActive = manager
+                                .setActive;
+                            if (typeof setActive === "function") {
+                                setActive.call(manager, value);
+                                appendSystemMessage(`Persona switched to: ${value}`);
+                            }
+                            else {
+                                appendSystemMessage(`Persona switching not supported by this build.`);
+                            }
+                        },
+                    });
+                }
                 else {
-                    sysMsg(`Persona command: ${personaSub}`);
+                    sysMsg(`Unknown persona sub-command: ${personaSub}\nUsage: /persona [list|init|switch [name]]`);
                 }
                 return true;
             }
             case "/permission": {
                 const permMode = rest.trim();
-                const validModes = ["auto-approve", "ask-always", "smart"];
-                if (!permMode || !validModes.includes(permMode)) {
-                    const currentPerm = runtime?.getPermissionMode() ?? "smart";
-                    sysMsg([
-                        "╭─ Permission Mode ─────────────────────────────────────────╮",
-                        `│  Current: ${currentPerm.padEnd(45)}│`,
-                        "├──────────────────────────────────────────────────────────┤",
-                        "│  auto-approve   Skip all approval prompts               │",
-                        "│  ask-always     Ask before every tool call               │",
-                        "│  smart          Ask for destructive ops only (default)   │",
-                        "╰──────────────────────────────────────────────────────────╯",
-                    ].join("\n"));
+                const validModes = ["ask-always", "smart", "auto-approve", "autonomous"];
+                const currentPerm = runtime?.getPermissionMode() ?? "smart";
+                if (!permMode) {
+                    // Inline picker — same pattern as /mode, /theme, /thinking.
+                    // Selecting a row applies the mode immediately + appends a
+                    // confirmation system message; Esc cancels with no change.
+                    // Ordered safest → most autonomous, top to bottom.
+                    setOptionPicker({
+                        title: "Permission mode",
+                        options: [
+                            {
+                                value: "ask-always",
+                                description: "Ask before every tool call (max safety)",
+                            },
+                            {
+                                value: "smart",
+                                description: "Ask for destructive ops only (default)",
+                            },
+                            {
+                                value: "auto-approve",
+                                description: "Skip approval prompts; still escalate on errors",
+                            },
+                            {
+                                value: "autonomous",
+                                description: "Full autonomy — skip prompts, auto-retry, escalate only on hard blocks",
+                            },
+                        ],
+                        currentValue: currentPerm,
+                        onSelect: (value) => {
+                            setOptionPicker(null);
+                            if (validModes.includes(value)) {
+                                runtime?.setPermissionMode(value);
+                                appendSystemMessage(`Permission mode set to: ${value}`);
+                            }
+                        },
+                    });
+                    return true;
+                }
+                if (!validModes.includes(permMode)) {
+                    sysMsg(`Unknown permission mode: ${permMode}\nValid: ${validModes.join(", ")}`);
                     return true;
                 }
                 if (runtime) {
@@ -1942,6 +2710,65 @@ export function WotannApp({ version, providers, initialModel = "gemma4:e4b", ini
                 sysMsg(`Permission mode set to: ${permMode}`);
                 return true;
             }
+            case "/verifier": {
+                // Toggle the secondary AI judge that audits primary responses
+                // before they land in the user's chat. Doubles per-turn provider
+                // spend but catches hallucinations / wrong-answers / silent
+                // failures the primary missed. Off by default.
+                if (!runtime) {
+                    sysMsg("Verifier requires WotannRuntime.");
+                    return true;
+                }
+                const sub = rest.trim();
+                const current = runtime.isVerifierEnabled();
+                if (!sub) {
+                    setOptionPicker({
+                        title: `Secondary AI verifier (currently ${current ? "ON" : "OFF"})`,
+                        options: [
+                            {
+                                value: "off",
+                                label: "Off",
+                                description: "Single-model responses (default; lowest cost)",
+                            },
+                            {
+                                value: "on",
+                                label: "On",
+                                description: "Run a second model to judge primary responses — catches hallucinations, doubles cost",
+                            },
+                        ],
+                        currentValue: current ? "on" : "off",
+                        onSelect: (value) => {
+                            setOptionPicker(null);
+                            runtime.setVerifierEnabled(value === "on");
+                            appendSystemMessage(`Verifier ${value === "on" ? "enabled" : "disabled"}.`);
+                        },
+                    });
+                    return true;
+                }
+                if (sub === "on" || sub === "enable" || sub === "true") {
+                    runtime.setVerifierEnabled(true);
+                    sysMsg("Verifier enabled.");
+                }
+                else if (sub === "off" || sub === "disable" || sub === "false") {
+                    runtime.setVerifierEnabled(false);
+                    sysMsg("Verifier disabled.");
+                }
+                else if (sub === "status") {
+                    const history = runtime.getVerifierHistory();
+                    sysMsg([
+                        `Verifier: ${current ? "ENABLED" : "DISABLED"}`,
+                        `Last ${Math.min(history.length, 5)} verdicts:`,
+                        ...history.slice(-5).map((v) => {
+                            const decision = v.decision ?? "?";
+                            return `  ${decision}`;
+                        }),
+                    ].join("\n"));
+                }
+                else {
+                    sysMsg(`Usage: /verifier [on|off|status]`);
+                }
+                return true;
+            }
             case "/healing": {
                 if (!runtime) {
                     sysMsg("Self-healing requires WotannRuntime.");
@@ -2350,24 +3177,157 @@ export function WotannApp({ version, providers, initialModel = "gemma4:e4b", ini
                 }
                 return true;
             }
+            case "/link":
+            case "/pair":
             case "/deeplink": {
-                const link = parseDeepLink(arg);
-                if (!link) {
-                    sysMsg("Invalid deep link. Format: wotann://action?params");
+                // Primary use: pair the iOS app to this WOTANN session.
+                // Mirrors the `wotann link` CLI command (src/index.ts:296)
+                // which calls into KAIROS daemon → companion.pairing → returns
+                // QR data URL + PIN + host/port + expiry. Surfacing this in
+                // the TUI lets the user pair without leaving the running
+                // session.
+                //
+                // Secondary use: when called with a `wotann://...` URL,
+                // execute the deep-link (mode/theme/channel-pair branches).
+                // Backwards-compat with the prior /deeplink semantics so
+                // muscle-memory and external triggers keep working.
+                const trimmed = arg.trim();
+                if (trimmed.startsWith("wotann://")) {
+                    const link = parseDeepLink(trimmed);
+                    if (!link) {
+                        sysMsg(`Invalid deep link "${trimmed}". Expected: wotann://<action>?<params>.`);
+                        return true;
+                    }
+                    const ctx = {
+                        workingDir,
+                        setMode: (mode) => {
+                            if (runtime)
+                                runtime.setMode(mode);
+                            setCurrentMode(mode);
+                        },
+                        setTheme: (theme) => themeManagerRef.current.setTheme(theme),
+                        verifyPairingCode: (code) => runtime?.getDispatchPlane()?.verifyPairingCode(code) ?? false,
+                    };
+                    const result = executeDeepLink(link, ctx);
+                    sysMsg(result.success ? `✓ ${result.message}` : `✗ ${result.message}`);
                     return true;
                 }
-                const ctx = {
-                    workingDir,
-                    setMode: (mode) => {
-                        if (runtime)
-                            runtime.setMode(mode);
-                        setCurrentMode(mode);
-                    },
-                    setTheme: (theme) => themeManagerRef.current.setTheme(theme),
-                    verifyPairingCode: (code) => runtime?.getDispatchPlane()?.verifyPairingCode(code) ?? false,
-                };
-                const result = executeDeepLink(link, ctx);
-                sysMsg(result.success ? `✓ ${result.message}` : `✗ ${result.message}`);
+                sysMsg("Generating pairing details from KAIROS daemon...");
+                void (async () => {
+                    try {
+                        const { KairosIPCClient } = await import("../daemon/kairos-ipc.js");
+                        const client = new KairosIPCClient(undefined, { requestTimeoutMs: 5_000 });
+                        const ok = await client.connect();
+                        if (!ok) {
+                            const { resolveWotannHomeSubdir } = await import("../utils/wotann-home.js");
+                            const pidPath = resolveWotannHomeSubdir("daemon.pid");
+                            const pidHint = existsSync(pidPath)
+                                ? `Daemon PID file exists (${readFileSync(pidPath, "utf-8").trim()}), but the IPC socket is not reachable.`
+                                : "No daemon PID file was found.";
+                            appendSystemMessage([
+                                "KAIROS daemon IPC is not reachable.",
+                                pidHint,
+                                "",
+                                "  1. Open the WOTANN desktop app (auto-starts the daemon)",
+                                "  2. Or run: wotann daemon start",
+                                "  3. Then re-run /link",
+                            ].join("\n"));
+                            return;
+                        }
+                        try {
+                            const pairing = (await client.call("companion.pairing"));
+                            const expiresMs = Date.parse(pairing.expiresAt);
+                            const expiresIn = Number.isFinite(expiresMs)
+                                ? `${Math.max(0, Math.round((expiresMs - Date.now()) / 1000))}s`
+                                : pairing.expiresAt;
+                            const remoteLines = (pairing.remoteEndpoints ?? []).map((endpoint) => {
+                                const scheme = endpoint.scheme ?? "ws";
+                                const port = endpoint.port ?? (scheme === "wss" ? 443 : 3849);
+                                return `  Remote:   ${endpoint.label ?? "Remote"} ${scheme}://${endpoint.host ?? "unknown"}:${port}`;
+                            });
+                            const remoteSetupLines = remoteLines.length > 0
+                                ? remoteLines
+                                : [
+                                    `  Remote:   ${pairing.remoteAccess?.status ?? "missing-endpoint"}`,
+                                    `            ${pairing.remoteAccess?.message ?? "Same network only."}`,
+                                    ...(pairing.remoteAccess?.setupOptions
+                                        ?.filter((option) => option.id === "tailscale" || option.id === "configured-url")
+                                        .slice(0, 2)
+                                        .map((option) => `            ${option.label ?? option.id}: ${option.command ?? option.detail ?? ""}`) ?? []),
+                                ];
+                            appendSystemMessage([
+                                "WOTANN ↔ iOS pairing",
+                                "",
+                                `  PIN:      ${pairing.pin}`,
+                                `  Host:     ${pairing.host ?? "unknown"}`,
+                                `  Port:     ${pairing.port ?? 3849}`,
+                                ...remoteSetupLines,
+                                `  Expires:  in ${expiresIn}`,
+                                "",
+                                `  Deep-link URL (paste / scan):`,
+                                `  ${pairing.qrData}`,
+                                "",
+                                "  In the WOTANN iOS app: Settings → Pair Device → scan QR or enter PIN.",
+                                "  Run `wotann link` from a separate shell for an inline ASCII QR.",
+                            ].join("\n"));
+                        }
+                        finally {
+                            client.disconnect();
+                        }
+                    }
+                    catch (err) {
+                        appendSystemMessage(`Pairing failed: ${err.message ?? "unknown error"}`);
+                    }
+                })();
+                return true;
+            }
+            case "/computer": {
+                const refreshedTools = detectAvailableTools();
+                setComputerTools(refreshedTools);
+                setActivePanel("computer");
+                const actionInput = arg.trim();
+                if (actionInput && actionInput !== "status" && actionInput !== "help") {
+                    const parsed = parseComputerActionCommand(actionInput);
+                    if (!parsed) {
+                        sysMsg([
+                            "Unknown desktop action.",
+                            "Try: /computer click 420 320",
+                            "     /computer type hello from WOTANN",
+                            "     /computer key command+c",
+                            "     /computer scroll down 4",
+                            "     /computer screenshot ~/Desktop/wotann-screen.png",
+                        ].join("\n"));
+                        return true;
+                    }
+                    const result = executeDesktopAction(parsed);
+                    if (!result) {
+                        sysMsg([
+                            `Desktop action not available: ${parsed.action}`,
+                            `Available: ${computerActions.join(", ")}`,
+                        ].join("\n"));
+                        return true;
+                    }
+                    sysMsg([
+                        `Desktop action: ${parsed.action}`,
+                        `Status: ${result.success ? "ok" : "failed"}`,
+                        result.output ? `Output: ${result.output}` : "",
+                    ]
+                        .filter(Boolean)
+                        .join("\n"));
+                    return true;
+                }
+                sysMsg([
+                    "Computer-use panel opened.",
+                    `Tools: ${refreshedTools.length > 0 ? refreshedTools.join(", ") : "none detected"}`,
+                    `Actions: ${computerActions.join(", ")}`,
+                    "",
+                    "Run actions directly:",
+                    "  /computer click 420 320",
+                    "  /computer type hello from WOTANN",
+                    "  /computer key command+c",
+                    "  /computer scroll down 4",
+                    "  /computer screenshot ~/Desktop/wotann-screen.png",
+                ].join("\n"));
                 return true;
             }
             case "/roe": {
@@ -2944,8 +3904,167 @@ export function WotannApp({ version, providers, initialModel = "gemma4:e4b", ini
                 })();
                 return true;
             }
+            // ── CLI parity: commands that mirror `wotann <verb>` ──────
+            // Each handler wraps the same module the CLI command does so
+            // power users don't have to drop to a shell mid-session.
+            case "/stuck": {
+                // Mirrors `wotann stuck` — diagnose why a model is stuck
+                // (recent traces, hook denials, file freezes, doom-loop
+                // fingerprints). Runs the same module the CLI invokes.
+                sysMsg("Running stuck diagnostic...");
+                void (async () => {
+                    try {
+                        const { runStuck, formatStuckReport } = await import("../cli/commands/stuck.js");
+                        const report = await runStuck();
+                        appendSystemMessage(formatStuckReport(report));
+                    }
+                    catch (err) {
+                        appendSystemMessage(`Stuck diagnostic failed: ${err instanceof Error ? err.message : "unknown"}`);
+                    }
+                })();
+                return true;
+            }
+            case "/git": {
+                // Mirrors `wotann git <verb>` — pass-through to git in the
+                // working directory. Args are split on whitespace and passed
+                // to execFile directly (no shell), so command-injection
+                // is impossible.
+                const verb = rest.trim();
+                if (!verb) {
+                    sysMsg("Usage: /git <verb> [args]\nExamples: /git status, /git log -5, /git diff HEAD");
+                    return true;
+                }
+                sysMsg(`Running: git ${verb}`);
+                void (async () => {
+                    try {
+                        // Direct execFile (NOT shell) — args split on whitespace,
+                        // passed as array → no shell interpretation, no injection
+                        // surface.
+                        const { execFile } = await import("node:child_process");
+                        const { promisify } = await import("node:util");
+                        const exec = promisify(execFile);
+                        const args = verb.split(/\s+/).filter(Boolean);
+                        const result = await exec("git", args, {
+                            cwd: workingDir,
+                            timeout: 30_000,
+                            maxBuffer: 8 * 1024 * 1024,
+                        });
+                        const out = (result.stdout || "").toString().trim();
+                        appendSystemMessage(out.slice(0, 4000) || "(no output)");
+                    }
+                    catch (err) {
+                        const e = err;
+                        const out = (e.stdout?.toString() || "").trim();
+                        const errOut = (e.stderr?.toString() || "").trim();
+                        appendSystemMessage(`git ${verb} → exit ${e.code ?? "?"}\n${(errOut || out).slice(0, 2000)}`);
+                    }
+                })();
+                return true;
+            }
+            case "/worktree": {
+                // Mirrors `wotann worktree <action> [taskId]`. Heads-up:
+                // creating a worktree changes filesystem state outside the
+                // current cwd, so we surface the CLI command rather than
+                // exec it silently.
+                const sub = (parts[1] ?? "").toLowerCase();
+                if (!sub || !["create", "list", "abandon", "accept"].includes(sub)) {
+                    sysMsg("Usage: /worktree <create|list|abandon|accept> [taskId]\n" +
+                        "Run from a separate shell — worktree create alters filesystem state outside the TUI's cwd.");
+                    return true;
+                }
+                sysMsg(`Run from a separate shell: \`wotann worktree ${sub}${parts[2] ? ` ${parts[2]}` : ""}\``);
+                return true;
+            }
+            case "/architect": {
+                // `wotann architect <prompt>` runs an architecture-mode
+                // session. In the TUI we set the mode pill + forward the
+                // prompt so the rest of the streaming UX stays consistent.
+                const prompt = rest.trim();
+                if (!prompt) {
+                    sysMsg("Usage: /architect <prompt>\nSwitches to plan mode + asks the model to design an architecture.");
+                    return true;
+                }
+                if (runtime)
+                    runtime.setMode("plan");
+                setCurrentMode("plan");
+                sysMsg("Architect mode enabled — switched to plan mode for this turn.");
+                void handleSubmitRef.current(`Design the architecture for: ${prompt}`);
+                return true;
+            }
+            case "/init": {
+                // `wotann init` is interactive — running it inside Ink would
+                // corrupt the screen. Surface guidance instead.
+                sysMsg([
+                    "/init runs the interactive setup wizard, which conflicts with the TUI.",
+                    "",
+                    "Open a separate terminal and run:",
+                    "  wotann init        # interactive (default)",
+                    "  wotann init --free # free-tier setup (Ollama + free APIs)",
+                    "  wotann init --reset # reset workspace to defaults",
+                    "",
+                    "After init completes, re-launch `wotann` to see new providers.",
+                ].join("\n"));
+                return true;
+            }
+            case "/sizes":
+            case "/size": {
+                // Diagnostic: show current system prompt + tool count + skill
+                // count so the user can see WHY a turn might be slow. Codex
+                // gpt-5.5 prefill at ~5K tokens/sec → 50KB request = ~3s,
+                // 200KB = ~12s. The watchdog firing at 30s with no content
+                // usually means we're sending way more than expected.
+                if (!runtime) {
+                    sysMsg("Runtime not initialised — sizes unavailable.");
+                    return true;
+                }
+                const sysPrompt = runtime.getSystemPrompt?.() ?? "";
+                const sysKB = (sysPrompt.length / 1024).toFixed(1);
+                const skillCount = getSkillRegistry().getSummaries().length;
+                sysMsg([
+                    `System prompt: ${sysKB}KB (~${Math.round(sysPrompt.length / 4)} tokens)`,
+                    `Skills loaded: ${skillCount}`,
+                    ``,
+                    `On a slow first turn, also try:`,
+                    `  WOTANN_DEBUG_REQUEST=1 wotann 2>~/wotann-diag.log`,
+                    `then check ~/wotann-diag.log for actual codex request size + TTFT.`,
+                ].join("\n"));
+                return true;
+            }
             case "/login": {
-                sysMsg("Run `wotann login [provider]` from your shell. Supported: anthropic, openai, codex, copilot, gemini, ollama, deepseek, etc.");
+                // Provider-aware re-auth instructions. The TUI can't spawn an
+                // interactive OAuth/PKCE flow without breaking Ink's screen,
+                // so we direct the user to run the login in another terminal
+                // — but the runtime auto-picks-up the new credentials on the
+                // very next request (the codex adapter re-reads
+                // ~/.codex/auth.json per query; anthropic/copilot/gemini
+                // similarly re-read their token stores). No restart needed.
+                const target = (arg.trim() || currentProvider).toLowerCase();
+                const instructions = {
+                    codex: "1. Open a new terminal\n" +
+                        "2. Run: `codex login`  (or `wotann login codex` for guided flow)\n" +
+                        "3. Complete the browser flow\n" +
+                        "4. Come back here — your next message will use the refreshed token automatically.",
+                    anthropic: "1. Open a new terminal\n" +
+                        "2. Run: `wotann login anthropic`\n" +
+                        "3. Complete the browser flow\n" +
+                        "4. Come back here — your next message will use the refreshed credentials.",
+                    copilot: "1. Open a new terminal\n" +
+                        "2. Run: `wotann login copilot`\n" +
+                        "3. Enter the device code at github.com\n" +
+                        "4. Come back here — your next message uses the new token.",
+                    gemini: "1. Open a new terminal\n" +
+                        "2. Run: `wotann login gemini`\n" +
+                        "3. Paste your AI Studio API key when prompted\n" +
+                        "4. Come back here — your next message uses the new key.",
+                    ollama: "Ollama is local — no login required. Just run `ollama serve` and `ollama pull <model>`.",
+                    openai: "1. Open a new terminal\n" +
+                        "2. Run: `wotann login openai`\n" +
+                        "3. Paste your OpenAI API key (sk-...)\n" +
+                        "4. Come back here — your next message uses the new key.",
+                };
+                const text = instructions[target] ??
+                    `Run \`wotann login ${target}\` from your shell. Supported: anthropic, openai, codex, copilot, gemini, ollama. The runtime picks up new credentials on the next request — no restart needed.`;
+                sysMsg(`Re-auth ${target}:\n${text}`);
                 return true;
             }
             default:
@@ -2987,7 +4106,12 @@ export function WotannApp({ version, providers, initialModel = "gemma4:e4b", ini
         // Slash commands and deep links remain immediate even mid-stream:
         // they're local TUI affordances, not model input, so queuing them
         // would be surprising.
-        if (isStreaming && !input.startsWith("/") && !input.trimStart().startsWith("wotann://")) {
+        // Use BOTH the React state and the synchronous ref so a second
+        // Enter pressed within the same render tick still routes to the
+        // queue (state alone has a 1-frame delay).
+        if ((isStreaming || streamingGuardRef.current) &&
+            !input.startsWith("/") &&
+            !input.trimStart().startsWith("wotann://")) {
             const trimmed = input.trim();
             if (trimmed.length === 0)
                 return;
@@ -3045,8 +4169,14 @@ export function WotannApp({ version, providers, initialModel = "gemma4:e4b", ini
             ]);
         }
         setHistory((prev) => [input, ...prev.slice(0, 49)]);
+        // Synchronous flip — the ref is the FIRST guard subsequent submits
+        // see, even before React's re-render. Without this, two Enter presses
+        // within a render window both take the regular path and emit
+        // duplicate user messages + parallel runtime.query calls.
+        streamingGuardRef.current = true;
         setIsStreaming(true);
         setStreamingContent("");
+        setStreamingThinking("");
         setPromptValue("");
         setTurnCount((t) => t + 1);
         // Queued messages are drained inside `runtime.query()` BEFORE the
@@ -3057,41 +4187,345 @@ export function WotannApp({ version, providers, initialModel = "gemma4:e4b", ini
             setQueueDepth(0);
         if (runtime) {
             // ═══════════════════════════════════════════════════════════
-            // FULL HARNESS INTELLIGENCE PATH (via WotannRuntime)
+            // FULL HARNESS INTELLIGENCE PATH (via WotannRuntime) + AGENT LOOP
             // This goes through: WASM bypass → Hooks → 16 Middleware layers
             // → DoomLoop → Amplifier → Reasoning Sandwich → TTSR → Provider
             // → After-hooks → Memory capture → Cost tracking
+            //
+            // Pre-2026-05-03 the TUI was a CHAT interface only — when the
+            // model emitted a tool_use chunk, App.tsx showed a breadcrumb
+            // and never executed the tool. The model would say things like
+            // "I attempted to start the daemon" with no real result.
+            //
+            // The agent loop below closes that gap:
+            //   1. Pass AGENT_TOOL_DEFINITIONS (Bash/Read/Write/Edit/Grep/Glob)
+            //      so the model has real tools available, not just
+            //      computer_use + web_fetch + plan_*.
+            //   2. Capture every tool_use into pendingToolCalls during the
+            //      streaming phase.
+            //   3. After streaming, execute each tool client-side and
+            //      append a `tool` message to the agent's context.
+            //   4. Re-call runtime.query with the grown context. Loop until
+            //      no tool_use chunks arrive (or MAX_AGENT_ITERATIONS).
+            //   5. The FINAL iteration runs the post-stream UI cleanup
+            //      (assistant message, watchdog tips, fallback hints).
             // ═══════════════════════════════════════════════════════════
+            const MAX_AGENT_ITERATIONS = 8;
+            let agentMessages = [...messages, userMsg];
+            let agentIteration = 0;
+            let shouldContinueAgentLoop = true;
+            // Shared state across iterations (final stats / accumulators)
             let fullContent = "";
+            let fullThinking = "";
             let tokensUsed = 0;
             const errors = [];
             let responseModel = currentModel;
-            let responseProvider = initialProvider;
+            let responseProvider = currentProvider;
+            const queryStartedAt = Date.now();
+            let lastChunkAt = Date.now();
+            // Tracks whether the *provider* has produced visible content
+            // (text or thinking). The runtime middleware can yield its own
+            // metadata chunks (TTSR retry banners, context-pressure hints,
+            // tool_use breadcrumbs) which we need to NOT count toward "the
+            // provider responded". Otherwise the 30s no-content timeout
+            // never fires because the runtime "spoke" first. The user's
+            // 54s-no-output screenshot was hitting exactly this gap.
+            let receivedAnyContent = false;
             const abort = new AbortController();
             abortRef.current = abort;
+            // Two watchdogs, both provider-agnostic:
+            //
+            //  1. Initial-chunk timeout (30s) — if the provider hasn't
+            //     emitted a single chunk by then, that's almost always a
+            //     hard failure: stale auth, network drop, mis-routed
+            //     request, provider returned 200 with empty SSE. Bail
+            //     fast with a recovery hint so the user isn't stuck
+            //     staring at "Thinking..."
+            //
+            //  2. Stale-chunk timeout (90s) — once chunks ARE flowing,
+            //     but the next one is taking too long, the SSE connection
+            //     has likely stalled mid-stream. Abort so we don't hang
+            //     forever.
+            //
+            // Both push to a watchdog-error array (separate from the
+            // adapter `errors` list) so we can surface them via the
+            // post-abort branch — the prior implementation gated error
+            // display on `!abort.signal.aborted` and silently swallowed
+            // every watchdog message.
+            const watchdogErrors = [];
+            const watchdog = setInterval(() => {
+                const elapsed = Date.now() - lastChunkAt;
+                const totalElapsed = Date.now() - queryStartedAt;
+                if (!receivedAnyContent && totalElapsed > 30_000) {
+                    watchdogErrors.push(`${currentProvider}/${currentModel} produced no content in 30s. ` +
+                        `Likely a stale auth token, network issue, or provider stall. ` +
+                        `Try \`/provider\` to switch providers, or \`wotann login ${currentProvider}\` to re-authenticate.`);
+                    abort.abort();
+                    clearInterval(watchdog);
+                }
+                else if (receivedAnyContent && elapsed > 90_000) {
+                    watchdogErrors.push(`${currentProvider} stream stalled for 90s mid-response. ` +
+                        `Aborting. Try \`/provider\` to switch.`);
+                    abort.abort();
+                    clearInterval(watchdog);
+                }
+            }, 5_000);
+            let pendingToolCalls = [];
             try {
-                for await (const chunk of runtime.query({
-                    prompt: runtimePrompt,
-                    context: messages,
-                    model: currentModel,
-                    provider: initialProvider,
-                })) {
-                    if (abort.signal.aborted)
+                while (shouldContinueAgentLoop && agentIteration < MAX_AGENT_ITERATIONS) {
+                    agentIteration++;
+                    // Reset per-iteration accumulators. Streaming UI starts
+                    // fresh for each agent loop cycle so the user sees each
+                    // round's output rather than a stale concatenation.
+                    fullContent = "";
+                    fullThinking = "";
+                    pendingToolCalls = [];
+                    setStreamingContent("");
+                    setStreamingThinking("");
+                    // Fence-aware streamed-render buffer (per-stream).
+                    //
+                    // Why: LLM tokens arrive in tiny deltas. When the model is
+                    // mid-fence — e.g. it has emitted ```ts\nconst x  but the
+                    // closing ``` is still in flight — naive
+                    // setStreamingContent(fullContent) flashes a partial fence
+                    // through ChatView's `(```[\\s\\S]*?```)` segmenter as
+                    // unstyled inline text, then redraws as a styled code block
+                    // once the closer lands. The flicker reads like a UI bug.
+                    //
+                    // MarkdownStreamState holds tokens back at fence-safe
+                    // boundaries (closed fences / blank lines outside fences),
+                    // releasing only `readyToFlush` chunks the renderer can paint
+                    // without mid-fence flicker. The raw `fullContent`
+                    // accumulator is preserved for downstream consumers —
+                    // message commit, codex round-trip, voice TTS — that need
+                    // the unbuffered text.
+                    const markdownStream = new MarkdownStreamState();
+                    let safeFlushedContent = "";
+                    for await (const chunk of runtime.query({
+                        // Subsequent iterations use a tiny anchor prompt so the
+                        // model knows tool results are fresh. The full user
+                        // request is already in `agentMessages` context.
+                        prompt: agentIteration === 1 ? runtimePrompt : "(tool results above — continue)",
+                        context: agentMessages,
+                        model: currentModel,
+                        // Pass currentProvider so a Ctrl+O picker switch is honoured
+                        // immediately. The runtime's options.provider takes precedence
+                        // over session.provider, so without this update the routing
+                        // layer would still hit the bootstrap provider's adapter even
+                        // after setActiveProvider() updated the session.
+                        provider: currentProvider,
+                        allowProviderFallback: false,
+                        // Real agent tools — see src/ui/agent-tools.ts. Without
+                        // these the model can only chat; with them it can read
+                        // files, run bash, edit code, search the repo, etc.
+                        tools: AGENT_TOOL_DEFINITIONS,
+                    })) {
+                        if (abort.signal.aborted)
+                            break;
+                        lastChunkAt = Date.now();
+                        if (chunk.type === "text") {
+                            fullContent += chunk.content;
+                            // Route the delta through the fence-aware boundary
+                            // detector. `readyToFlush` is the slice that crossed a
+                            // safe boundary on THIS push — it can be appended to
+                            // the rendered surface without risk of mid-fence flash.
+                            // `pending` (anything still mid-fence or mid-line) stays
+                            // inside markdownStream and surfaces on the next safe
+                            // push or the post-stream flush().
+                            const released = markdownStream.push(chunk.content);
+                            if (released.readyToFlush.length > 0) {
+                                safeFlushedContent = safeFlushedContent + released.readyToFlush;
+                                setStreamingContent(safeFlushedContent);
+                            }
+                            // Only flip the receivedAnyContent gate on REAL content —
+                            // whitespace-only middleware preambles (TTSR retry markers,
+                            // empty newlines) shouldn't suppress the 30s no-content
+                            // watchdog. The user's repeated "75s with nothing visible"
+                            // hits were the runtime emitting empty/whitespace text
+                            // chunks, flipping the gate true, and silencing the
+                            // diagnostic. Gated on the raw delta (not on what the
+                            // fence buffer chose to flush) so an in-fence stream
+                            // still counts as live activity.
+                            if (chunk.content.trim().length > 0) {
+                                receivedAnyContent = true;
+                            }
+                        }
+                        else if (chunk.type === "thinking") {
+                            // Reasoning-tier providers (codex/gpt-5.5, anthropic
+                            // extended thinking, etc.) stream reasoning deltas BEFORE
+                            // any text. Render them so the user sees progress instead
+                            // of a blank "Thinking..." spinner; without this, the UI
+                            // looks identical to a hang for the entire 5–15s reasoning
+                            // window the model spends thinking through "who are you?".
+                            fullThinking += chunk.content;
+                            setStreamingThinking(fullThinking);
+                            if (chunk.content.trim().length > 0) {
+                                receivedAnyContent = true;
+                            }
+                        }
+                        else if (chunk.type === "error") {
+                            // NEVER mix errors into content — show as separate system message
+                            errors.push(chunk.content);
+                        }
+                        else if (chunk.type === "tool_use") {
+                            // Tool calls land here — capture the request so we can
+                            // execute it AFTER the stream finishes (the model may
+                            // chain multiple tool_use chunks per turn). Show the
+                            // breadcrumb immediately so the user sees activity.
+                            const argSummary = typeof chunk.toolInput === "object"
+                                ? JSON.stringify(chunk.toolInput).slice(0, 80)
+                                : String(chunk.content).slice(0, 80);
+                            setMessages((prev) => [
+                                ...prev,
+                                {
+                                    role: "system",
+                                    content: `🔧 ${chunk.toolName ?? "tool"}(${argSummary})`,
+                                },
+                            ]);
+                            if (chunk.toolName && chunk.toolCallId) {
+                                pendingToolCalls.push({
+                                    toolName: chunk.toolName,
+                                    toolCallId: chunk.toolCallId,
+                                    toolInput: (chunk.toolInput ?? {}),
+                                });
+                            }
+                        }
+                        if (chunk.tokensUsed)
+                            tokensUsed = chunk.tokensUsed;
+                        if (chunk.model)
+                            responseModel = chunk.model;
+                        if (chunk.provider)
+                            responseProvider = chunk.provider;
+                    }
+                    // Stream ended — drain whatever the fence buffer still holds
+                    // so the closing ``` of the final code block (or any
+                    // trailing prose held back by an open boundary) reaches the
+                    // renderer. flush() returns "" when only whitespace was
+                    // buffered, which keeps a clean tail.
+                    const finalChunk = markdownStream.flush();
+                    if (finalChunk.length > 0) {
+                        safeFlushedContent = safeFlushedContent + finalChunk;
+                        setStreamingContent(safeFlushedContent);
+                    }
+                    // ── Agent-loop continuation gate ──
+                    // After the iteration's stream ends, decide whether to run
+                    // another runtime.query turn:
+                    //   - If pendingToolCalls is empty → done; fall through to
+                    //     post-stream cleanup outside the while.
+                    //   - If non-empty AND we haven't hit MAX_AGENT_ITERATIONS →
+                    //     execute tools, append assistant + tool messages to
+                    //     `agentMessages`, and continue the loop.
+                    if (pendingToolCalls.length === 0 || abort.signal.aborted) {
+                        shouldContinueAgentLoop = false;
                         break;
-                    if (chunk.type === "text") {
-                        fullContent += chunk.content;
-                        setStreamingContent(fullContent);
                     }
-                    else if (chunk.type === "error") {
-                        // NEVER mix errors into content — show as separate system message
-                        errors.push(chunk.content);
+                    // Stash this turn's assistant text + tool_use calls into the
+                    // conversation so the next runtime.query sees the full
+                    // history. Each codex tool_call also needs to round-trip as
+                    // a function_call item with its call_id, which the codex
+                    // adapter handles when it sees `role: "assistant"` +
+                    // `toolCallId` on the AgentMessage.
+                    if (fullContent.trim()) {
+                        agentMessages = [
+                            ...agentMessages,
+                            {
+                                role: "assistant",
+                                content: fullContent,
+                                model: responseModel,
+                                provider: responseProvider,
+                            },
+                        ];
                     }
-                    if (chunk.tokensUsed)
-                        tokensUsed = chunk.tokensUsed;
-                    if (chunk.model)
-                        responseModel = chunk.model;
-                    if (chunk.provider)
-                        responseProvider = chunk.provider;
+                    // Codex Responses API requires every tool result to be
+                    // preceded by the assistant function_call item that created
+                    // that call_id. The UI used to append only the tool-role
+                    // result below; Codex then rejected the next request with
+                    // "No tool call found for function call output". Preserve
+                    // each requested call as an assistant message with
+                    // toolCallId/toolName so codex-adapter serializes it back
+                    // as a matching `function_call` item before the
+                    // `function_call_output`.
+                    agentMessages = [
+                        ...agentMessages,
+                        ...pendingToolCalls.map((call) => ({
+                            role: "assistant",
+                            content: JSON.stringify(call.toolInput ?? {}),
+                            toolCallId: call.toolCallId,
+                            toolName: call.toolName,
+                            model: responseModel,
+                            provider: responseProvider,
+                        })),
+                    ];
+                    // Execute tools sequentially. (Parallel execution is doable
+                    // but most tool sequences depend on prior results; serial
+                    // is the safer default.)
+                    for (const call of pendingToolCalls) {
+                        const result = await executeAgentTool(call.toolName, call.toolInput, {
+                            workingDir,
+                            permissionMode: runtime?.getPermissionMode?.(),
+                        });
+                        // Surface a compact result preview as a system message
+                        // so the user sees what the tool did. Long results get
+                        // truncated in the UI; the FULL result still goes into
+                        // the model's context.
+                        const preview = result.length > 240 ? result.slice(0, 240) + "…" : result;
+                        setMessages((prev) => [
+                            ...prev,
+                            {
+                                role: "system",
+                                content: `↳ ${call.toolName} → ${preview}`,
+                            },
+                        ]);
+                        // Push as a tool-role message so the codex adapter
+                        // serialises it back as a `function_call_output` item
+                        // (see codex-adapter.ts:218 — tool messages with
+                        // toolCallId become function_call_output).
+                        agentMessages = [
+                            ...agentMessages,
+                            {
+                                role: "tool",
+                                content: result,
+                                toolCallId: call.toolCallId,
+                                toolName: call.toolName,
+                            },
+                        ];
+                    }
+                    // Per-iteration accumulators get cleared at the top of the
+                    // next loop turn. No need to clear here.
+                }
+                clearInterval(watchdog);
+                // Watchdog errors ALWAYS surface — even when the abort fires
+                // *because* of the watchdog. The prior gate
+                // (`!abort.signal.aborted`) silently swallowed every
+                // watchdog message, leaving the user staring at a closed
+                // spinner with no diagnostic.
+                for (const err of watchdogErrors) {
+                    setMessages((prev) => [...prev, { role: "system", content: `⚠ ${err}` }]);
+                }
+                // Auto-suggest fast recovery options when the active provider
+                // produced zero output. Two-prong: (1) drop reasoning effort
+                // — most "stalled" cases on codex/gpt-5.5 are actually 60-90s
+                // of `xhigh` reasoning that we never see deltas for, and
+                // dropping to `low`/`minimal` returns instantly; (2) switch
+                // provider as the fallback if the user is on a different
+                // provider that still works.
+                if (!receivedAnyContent && watchdogErrors.length > 0) {
+                    const tips = [];
+                    // Always offer the effort drop first — it's the most common
+                    // root cause and the cheapest to try (one slash command).
+                    tips.push(`Try \`/thinking low\` (or \`/thinking medium\`) — most ${currentProvider} stalls are over-eager reasoning, not auth or network.`);
+                    const fallback = providers.find((p) => p.available && p.provider !== currentProvider);
+                    if (fallback) {
+                        tips.push(`Or \`/provider ${fallback.provider}\` to switch providers; your last message stays in scrollback so you can re-send.`);
+                    }
+                    tips.push(`Or \`wotann login ${currentProvider}\` to re-authenticate (rare; usually the issue above).`);
+                    setMessages((prev) => [
+                        ...prev,
+                        {
+                            role: "system",
+                            content: tips.join("\n"),
+                        },
+                    ]);
                 }
                 if (!abort.signal.aborted) {
                     // Show errors as system messages (not mixed into assistant response)
@@ -3115,12 +4549,29 @@ export function WotannApp({ version, providers, initialModel = "gemma4:e4b", ini
                         ]);
                         void voiceControllerRef.current.speakAssistantReply(fullContent);
                     }
+                    else if (fullThinking.trim() && errors.length === 0) {
+                        // Reasoning-only response — provider thought but never
+                        // emitted a text answer (codex sometimes does this for
+                        // overlong reasoning chains). Surface the thinking so
+                        // the user has something rather than a silent close.
+                        setMessages((prev) => [
+                            ...prev,
+                            {
+                                role: "assistant",
+                                content: `[reasoning, no answer]\n${fullThinking.slice(0, 2000)}`,
+                                model: responseModel,
+                                provider: responseProvider,
+                                tokensUsed,
+                            },
+                        ]);
+                    }
                     else if (errors.length === 0) {
                         setMessages((prev) => [
                             ...prev,
                             {
                                 role: "system",
-                                content: "No response received from provider.",
+                                content: `Empty response from ${responseProvider}/${responseModel}. ` +
+                                    `Try /provider to switch or re-send.`,
                             },
                         ]);
                     }
@@ -3128,6 +4579,7 @@ export function WotannApp({ version, providers, initialModel = "gemma4:e4b", ini
                 }
             }
             catch (error) {
+                clearInterval(watchdog);
                 if (!abort.signal.aborted) {
                     const msg = error instanceof Error ? error.message : "Unknown error";
                     setMessages((prev) => [...prev, { role: "system", content: `Error: ${msg}` }]);
@@ -3154,10 +4606,12 @@ export function WotannApp({ version, providers, initialModel = "gemma4:e4b", ini
         }
         setIsStreaming(false);
         setStreamingContent("");
+        setStreamingThinking("");
+        streamingGuardRef.current = false;
         abortRef.current = null;
     }, [
         currentModel,
-        initialProvider,
+        currentProvider,
         runtime,
         messages,
         handleSlashCommand,
@@ -3187,7 +4641,14 @@ export function WotannApp({ version, providers, initialModel = "gemma4:e4b", ini
             });
         return sources;
     }, [runtime, messages.length]);
-    const activeProvider = providers.find((p) => p.available);
+    // Prefer the user's explicit pick (currentProvider) over a "first
+    // available" fallback. If currentProvider isn't (yet) in the providers
+    // array (e.g. bootstrap is still detecting it), fall back to the
+    // initialProvider record; finally fall back to first-available so the
+    // status bar always has something to show.
+    const activeProvider = liveProviders.find((p) => p.provider === currentProvider) ??
+        liveProviders.find((p) => p.provider === initialProvider) ??
+        liveProviders.find((p) => p.available);
     const runtimeStatus = runtime?.getStatus();
     const currentTheme = themeManagerRef.current.getCurrent();
     // contextUsagePercent removed — UnifiedStatusBar derives the percent
@@ -3195,54 +4656,105 @@ export function WotannApp({ version, providers, initialModel = "gemma4:e4b", ini
     // (legacy from when the StatusBar at the bottom of the layout took
     // a precomputed contextPercent prop) is no longer needed.
     const diffPanel = diffEntries[0];
-    return (_jsxs(Box, { flexDirection: "column", height: "100%", children: [showStartup && (_jsx(StartupScreen, { version: version, providers: providers, palette: currentTheme.colors })), needsOnboarding && (_jsxs(Box, { flexDirection: "column", paddingX: 2, paddingY: 1, borderStyle: "round", borderColor: currentTheme.colors.warning, marginBottom: 1, children: [_jsx(Text, { bold: true, color: currentTheme.colors.warning, children: "\u26A0 No providers configured" }), _jsx(Text, { color: currentTheme.colors.muted, children: "Run `wotann init` to set up a provider, or run `wotann login <provider>` to add one. Free options: Ollama (local), Google Gemini (free tier), Groq (free tier)." })] })), _jsx(UnifiedStatusBar, { model: currentModel, provider: activeProvider?.provider ?? initialProvider, mode: currentMode, usedTokens: runtimeStatus?.totalTokens ?? 0, maxTokens: runtime?.getMaxContextTokens() ?? 200_000, costUsd: runtimeStatus?.totalCost ?? stats.cost, reads: stats.reads, edits: stats.edits, bashCalls: stats.bashCalls, turnCount: turnCount, skillCount: runtimeStatus?.skillCount, isStreaming: isStreaming, roeSessionActive: runtime?.getActiveROESessionId() !== undefined }), _jsx(MainScene, { messages: messages, isStreaming: isStreaming, streamingContent: streamingContent, currentModel: currentModel, activePanel: activePanel, diffPanel: diffPanel ? { filePath: diffPanel.filePath, hunks: diffPanel.hunks } : undefined, agentStatuses: agentStatuses, thinkingEffort: thinkingEffort, history: history, currentThemeBorder: currentTheme.colors.border, 
-                // `accent` is the canonical brand-tint slot; `primary` is its
-                // deprecated alias (see src/ui/themes.ts ThemeColors). Use
-                // accent so theme-cycle keeps working when palettes drop the
-                // legacy property entirely.
-                currentThemePrimary: currentTheme.colors.accent, currentThemeInfo: currentTheme.colors.info }), showHistoryPicker && (_jsx(HistoryPicker, { history: history, onSelect: handleHistorySelect, onCancel: handleHistoryCancel })), showCommandPalette && (_jsx(CommandPalette, { registry: commandRegistryRef.current, onClose: handleCommandPaletteClose, onError: handleCommandPaletteError, palette: currentTheme.colors })), optionPicker && (_jsx(OptionPicker, { title: optionPicker.title, options: optionPicker.options, currentValue: optionPicker.currentValue, onSelect: optionPicker.onSelect, onCancel: () => setOptionPicker(null) })), showModelPicker && (_jsx(ModelPicker, { providers: providers, currentProvider: activeProvider?.provider ?? initialProvider, currentModel: currentModel, onSelect: (provider, model) => {
-                    setShowModelPicker(false);
-                    setCurrentModel(model);
-                    // Note: provider is captured for completeness (the routing
-                    // layer infers provider from model id, but a future
-                    // setActiveProvider hook can use it directly without
-                    // touching this call site).
-                    setMessages((prev) => [
-                        ...prev,
-                        {
-                            role: "system",
-                            content: `Switched to ${provider}/${model}.`,
-                        },
-                    ]);
-                }, onCancel: () => setShowModelPicker(false), onRefresh: () => {
-                    // Force-refresh every provider's model catalog. Lazy-load
-                    // the discoverer so the import isn't paid on first render.
-                    void import("../providers/model-discovery.js").then(({ discoverModelsForProvider }) => {
-                        for (const auth of providers) {
-                            if (!auth.available)
-                                continue;
-                            void discoverModelsForProvider({
-                                provider: auth.provider,
-                                fallback: auth.models,
-                                forceRefresh: true,
-                            });
-                        }
+    return (_jsx(ThemeProvider, { palette: currentTheme.colors, children: _jsxs(Box, { flexDirection: "column", height: "100%", children: [showStartup && (_jsx(StartupScreen, { version: version, providers: providers, palette: currentTheme.colors })), needsOnboarding && (_jsxs(Box, { flexDirection: "column", paddingX: 2, paddingY: 1, borderStyle: "round", borderColor: currentTheme.colors.warning, marginBottom: 1, children: [_jsx(Text, { bold: true, color: currentTheme.colors.warning, children: "\u26A0 No providers configured" }), _jsx(Text, { color: currentTheme.colors.muted, children: "Run `wotann init` to set up a provider, or run `wotann login <provider>` to add one. Free options: Ollama (local), Google Gemini (free tier), Groq (free tier)." })] })), _jsx(UnifiedStatusBar, { model: currentModel, provider: activeProvider?.provider ?? initialProvider, mode: currentMode, usedTokens: runtimeStatus?.totalTokens ?? 0, maxTokens: runtime?.getMaxContextTokens() ?? 200_000, costUsd: runtimeStatus?.totalCost ?? stats.cost, reads: stats.reads, edits: stats.edits, bashCalls: stats.bashCalls, turnCount: turnCount, skillCount: runtimeStatus?.skillCount, isStreaming: isStreaming, roeSessionActive: runtime?.getActiveROESessionId() !== undefined }), _jsx(MainScene, { messages: messages, isStreaming: isStreaming, streamingContent: streamingContent, streamingThinking: streamingThinking, currentModel: currentModel, activePanel: activePanel, diffPanel: diffPanel ? { filePath: diffPanel.filePath, hunks: diffPanel.hunks } : undefined, agentStatuses: agentStatuses, thinkingEffort: thinkingEffort, history: history, computerTools: computerTools, computerActions: computerActions, currentThemeBorder: currentTheme.colors.border, 
+                    // `accent` is the canonical brand-tint slot; `primary` is its
+                    // deprecated alias (see src/ui/themes.ts ThemeColors). Use
+                    // accent so theme-cycle keeps working when palettes drop the
+                    // legacy property entirely.
+                    currentThemePrimary: currentTheme.colors.accent, currentThemeInfo: currentTheme.colors.info }), showHistoryPicker && (_jsx(HistoryPicker, { history: history, onSelect: handleHistorySelect, onCancel: handleHistoryCancel })), showCommandPalette && (_jsx(CommandPalette, { registry: commandRegistryRef.current, onClose: handleCommandPaletteClose, onError: handleCommandPaletteError, palette: currentTheme.colors })), optionPicker && (_jsx(OptionPicker, { title: optionPicker.title, options: optionPicker.options, currentValue: optionPicker.currentValue, onSelect: optionPicker.onSelect, onCancel: () => setOptionPicker(null) })), showModelPicker && (_jsx(ModelPicker, { providers: liveProviders, currentProvider: activeProvider?.provider ?? initialProvider, currentModel: currentModel, onSelect: (provider, model) => {
+                        setShowModelPicker(false);
+                        // Provider-agnostic atomic switch: the runtime's
+                        // setActiveProvider updates session.provider AND session.model
+                        // together AND refits context-intelligence + system-prompt
+                        // resending. Without this, picking e.g. "codex/gpt-5.5" only
+                        // updates currentModel — the runtime keeps routing through
+                        // the previously-active provider's adapter, producing
+                        // "unknown model" errors on the next turn.
+                        setCurrentProvider(provider);
+                        setCurrentModel(model);
+                        runtime?.setActiveProvider(provider, model);
                         setMessages((prev) => [
                             ...prev,
                             {
                                 role: "system",
-                                content: "Model catalogs refreshing in the background. The picker " +
-                                    "will reflect new entries on the next open (cache TTL: 5 min).",
+                                content: `Switched to ${provider}/${model}.`,
                             },
                         ]);
-                    });
-                } })), showTrustPanel && (_jsx(TrustPanel, { workingDir: workingDir, onClose: () => setShowTrustPanel(false) })), showGdprPanel && _jsx(GdprPanel, { onClose: () => setShowGdprPanel(false) }), showAuditPanel && _jsx(AuditLogPanel, { onClose: () => setShowAuditPanel(false) }), showAutomationsPanel && _jsx(AutomationsPanel, { onClose: () => setShowAutomationsPanel(false) }), showContextPanel && runtime && (_jsx(ContextSourcePanel, { sources: contextSources, totalTokens: runtimeStatus?.totalTokens ?? 0, maxTokens: runtime.getMaxContextTokens() })), showTerminalBlocks && _jsx(TerminalBlocksView, { blocks: terminalBlocks }), showMessageActions &&
-                messages.length > 0 &&
-                (() => {
-                    const lastIdx = messages.length - 1;
-                    const lastMsg = messages[lastIdx];
-                    const role = lastMsg.role === "user" || lastMsg.role === "assistant" ? lastMsg.role : "assistant";
-                    return (_jsx(MessageActions, { messageId: String(lastIdx), content: lastMsg.content, role: role, onAction: handleMessageAction }));
-                })(), isIncognito && (_jsxs(Box, { paddingX: 1, gap: 1, children: [_jsx(Text, { color: currentTheme.colors.warning, bold: true, children: "\u25D0 INCOGNITO" }), _jsx(Text, { color: currentTheme.colors.muted, children: "\u00B7 memory capture paused \u00B7 all messages local" })] })), queueDepth > 0 && (_jsxs(Box, { paddingX: 1, gap: 1, children: [_jsxs(Text, { color: currentTheme.colors.info, bold: true, children: ["\uD83D\uDCE8 ", queueDepth, " message", queueDepth === 1 ? "" : "s", " queued"] }), _jsx(Text, { color: currentTheme.colors.muted, children: "\u00B7 will prepend on next turn" })] })), _jsx(PromptInput, { onSubmit: handleSubmit, onChange: setPromptValue, onAbort: handleAbort, disabled: isStreaming, isStreaming: isStreaming, history: history, mode: currentMode, value: promptValue })] }));
+                    }, onCancel: () => setShowModelPicker(false), onRefresh: () => {
+                        if (!runtime) {
+                            setMessages((prev) => [
+                                ...prev,
+                                {
+                                    role: "system",
+                                    content: "Model refresh requires the local runtime to be active.",
+                                },
+                            ]);
+                            return;
+                        }
+                        void runtime.refreshProviderModelCatalogs().then((catalog) => {
+                            setLiveProviders((prev) => prev.map((provider) => {
+                                const models = catalog[provider.provider];
+                                return models && models.length > 0 ? { ...provider, models } : provider;
+                            }));
+                            setMessages((prev) => [
+                                ...prev,
+                                {
+                                    role: "system",
+                                    content: Object.keys(catalog).length > 0
+                                        ? "Model catalogs refreshed from the active daemon adapters."
+                                        : "No live model catalog updates were available.",
+                                },
+                            ]);
+                        });
+                    } })), showProviderSetup && (_jsx(ProviderSetupOverlay, { providers: liveProviders, onCancel: () => setShowProviderSetup(false), onOpenModelPicker: () => {
+                        setShowProviderSetup(false);
+                        setShowModelPicker(true);
+                    }, onSave: async (providerId, token) => {
+                        const { getProviderService } = await import("../providers/provider-service.js");
+                        const service = getProviderService();
+                        const snapshot = await service.getSnapshot({ force: false });
+                        const known = snapshot.providers.find((provider) => provider.id === providerId);
+                        const spec = service.getSpec(providerId);
+                        if (!known)
+                            throw new Error(`Unknown provider "${providerId}"`);
+                        if (providerId === "ollama" && token.length === 0) {
+                            const catalog = await runtime?.refreshProviderModelCatalogs();
+                            if (catalog) {
+                                setLiveProviders((prev) => prev.map((provider) => {
+                                    const models = catalog[provider.provider];
+                                    return models && models.length > 0
+                                        ? { ...provider, available: true, models }
+                                        : provider;
+                                }));
+                            }
+                            appendSystemMessage("Ollama checked. Start Ollama locally if no models appear.");
+                            return;
+                        }
+                        const method = chooseProviderCredentialMethod(providerId, token, spec);
+                        const state = await service.saveCredential(providerId, {
+                            method,
+                            token,
+                            label: `${known.name} from TUI Provider Forge`,
+                        });
+                        const refreshed = await service.getSnapshot({ force: true });
+                        setLiveProviders((prev) => prev.map((provider) => {
+                            const fresh = refreshed.providers.find((candidate) => candidate.id === provider.provider);
+                            return fresh ? mergeProviderState(provider, fresh) : provider;
+                        }));
+                        const model = state?.defaultModel ?? state?.models[0]?.id ?? currentModel;
+                        if (state?.configured && model) {
+                            setCurrentProvider(providerId);
+                            setCurrentModel(model);
+                            runtime?.setActiveProvider(providerId, model);
+                        }
+                        appendSystemMessage(`${known.name} ${method} credential saved. ${model ? `Active model: ${model}` : "Refresh providers to discover models."}`);
+                    } })), showTrustPanel && (_jsx(TrustPanel, { workingDir: workingDir, onClose: () => setShowTrustPanel(false) })), showGdprPanel && _jsx(GdprPanel, { onClose: () => setShowGdprPanel(false) }), showAuditPanel && _jsx(AuditLogPanel, { onClose: () => setShowAuditPanel(false) }), showAutomationsPanel && (_jsx(AutomationsPanel, { onClose: () => setShowAutomationsPanel(false) })), showContextPanel && runtime && (_jsx(ContextSourcePanel, { sources: contextSources, totalTokens: runtimeStatus?.totalTokens ?? 0, maxTokens: runtime.getMaxContextTokens() })), showTerminalBlocks && _jsx(TerminalBlocksView, { blocks: terminalBlocks }), showMessageActions &&
+                    messages.length > 0 &&
+                    (() => {
+                        const lastIdx = messages.length - 1;
+                        const lastMsg = messages[lastIdx];
+                        const role = lastMsg.role === "user" || lastMsg.role === "assistant" ? lastMsg.role : "assistant";
+                        return (_jsx(MessageActions, { messageId: String(lastIdx), content: lastMsg.content, role: role, onAction: handleMessageAction }));
+                    })(), isIncognito && (_jsxs(Box, { paddingX: 1, gap: 1, children: [_jsx(Text, { color: currentTheme.colors.warning, bold: true, children: "\u25D0 INCOGNITO" }), _jsx(Text, { color: currentTheme.colors.muted, children: "\u00B7 memory capture paused \u00B7 all messages local" })] })), queueDepth > 0 && (_jsxs(Box, { paddingX: 1, gap: 1, children: [_jsxs(Text, { color: currentTheme.colors.info, bold: true, children: ["\uD83D\uDCE8 ", queueDepth, " message", queueDepth === 1 ? "" : "s", " queued"] }), _jsx(Text, { color: currentTheme.colors.muted, children: "\u00B7 will prepend on next turn" })] })), _jsx(PromptInput, { onSubmit: handleSubmit, onChange: setPromptValue, onAbort: handleAbort, disabled: isStreaming, isStreaming: isStreaming, history: history, mode: currentMode, value: promptValue })] }) }));
 }
 //# sourceMappingURL=App.js.map