fix(tasks): render daily brief calendars in local time (#6926 )

fix(models): honor visible pinned IDs in route selection (#6922 )
fix(models): skip non-chat models when resolving chat defaults (#6907 )
2026-10-31 18:22:22 +01:00 · 2026-10-31 13:54:14 +00:00 · 2026-10-31 13:51:59 +00:00 · 2026-10-31 13:49:26 +00:00 · 2026-10-31 13:47:30 +00:00 · 2026-10-31 13:45:02 +00:00
139 changed files with 6539 additions and 1205 deletions
@@ -1,17 +0,0 @@
 """Reject skipped/empty native CI runs without conflating driver child counts."""
 import argparse
 from pathlib import Path
 import xml.etree.ElementTree as ET
 parser = argparse.ArgumentParser(description=__doc__)
 parser.add_argument('report', type=Path)
 parser.add_argument('--minimum', type=int, required=True)
 args = parser.parse_args()
 root = ET.parse(args.report).getroot()
 cases = list(root.iter('testcase'))
 if len(cases) < args.minimum:
    raise SystemExit(f'Incomplete execution: {len(cases)} cases, expected at least {args.minimum}')
 for case in cases:
    if any(case.find(tag) is not None for tag in ('skipped', 'failure', 'error')):
        raise SystemExit(f'Case did not pass: {case.get("classname")}::{case.get("name")}')
 print(f'Verified {len(cases)} executed cases; no skipped, failed or errored cases')
@@ -1,46 +0,0 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { spawnSync } from 'node:child_process';
 import { parse } from 'acorn';
 const root = fileURLToPath(new URL('../../', import.meta.url));
 const manifest = JSON.parse(fs.readFileSync(path.join(root, 'tests/native-ci-manifest.json'), 'utf8'));
 function files(directory) {
  return fs.readdirSync(directory, { withFileTypes: true }).flatMap(entry => {
    const target = path.join(directory, entry.name);
    return entry.isDirectory() ? files(target) : /\.(?:mjs|cjs|js)$/.test(entry.name) ? [target] : [];
  });
 }
 function importsNativeTest(node) {
  if (!node || typeof node !== 'object') return false;
  if (node.type === 'ImportDeclaration' && node.source.value === 'node:test') return true;
  if (node.type === 'CallExpression' && node.callee.name === 'require' && node.arguments[0]?.value === 'node:test') return true;
  return Object.values(node).some(value => Array.isArray(value) ? value.some(importsNativeTest) : importsNativeTest(value));
 }
 const discovered = files(path.join(root, 'tests')).filter(file => {
  const source = fs.readFileSync(file, 'utf8');
  return source.includes('node:test') && importsNativeTest(parse(source, { ecmaVersion: 'latest', sourceType: 'module' }));
 }).map(file => path.relative(root, file).split(path.sep).join('/')).sort();
 const assigned = Object.values(manifest).flatMap(group => Array.isArray(group) ? group : Object.keys(group));
 if (new Set(assigned).size !== assigned.length || JSON.stringify([...assigned].sort()) !== JSON.stringify(discovered)) {
  throw new Error('Native test coverage must be exhaustive and disjoint; update tests/native-ci-manifest.json for added, removed or duplicated files');
 }
 for (const wrappers of Object.values(manifest['python-ci'])) {
  for (const wrapper of wrappers) if (!fs.existsSync(path.join(root, wrapper))) throw new Error(`Missing pytest wrapper: ${wrapper}`);
 }
 if (process.argv.includes('--list')) {
  console.log(JSON.stringify({ discovered, runners: manifest }, null, 2));
 } else {
  const reports = path.join(root, 'test-results/native-node');
  fs.mkdirSync(reports, { recursive: true });
  const result = spawnSync(process.execPath, ['--test', '--test-concurrency=1',
    '--test-reporter=spec', '--test-reporter-destination=stdout',
    '--test-reporter=junit', `--test-reporter-destination=${path.join(reports, 'junit.xml')}`,
    ...manifest['native-ci']], {
    cwd: root, stdio: 'inherit',
    env: { ...process.env, ENDPOINT_URL: 'http://127.0.0.1:1' },
  });
  if (result.error) throw result.error;
  process.exitCode = result.status ?? 1;
 }
@@ -1,74 +0,0 @@
 name: Brush diagnostic (non-authoritative)
 on:
  push:
    branches: [test/remediation-brush-diagnostic-ubuntu]
 permissions:
  contents: read
 jobs:
  browser-diagnostic:
    name: Chromium application regressions
    runs-on: ubuntu-24.04
    timeout-minutes: 45
    env:
      ODYSSEUS_E2E_DISPOSABLE_ARTIFACTS: '1'
      ODYSSEUS_TEST_PYTHON: python
      CHROMADB_HOST: 127.0.0.1
      CHROMADB_PORT: '1'
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: '3.11'
      - name: Install FFmpeg and establish system trust
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends ffmpeg ca-certificates
          python scripts/check_ca_trust.py --system
      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
        with:
          version: '0.13.5'
          enable-cache: true
          cache-dependency-glob: requirements.txt
          prune-cache: false
      - run: |
          uv pip install --system --require-hashes --only-binary=:all: --no-deps -r requirements-bootstrap.txt
          python scripts/check_ca_trust.py --python
          uv pip install --system -r requirements.txt
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: '22.23.4'
          cache: npm
      - run: npm ci --ignore-scripts --no-audit --no-fund
      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: ~/.cache/ms-playwright
          key: ms-playwright-${{ runner.os }}-${{ hashFiles('package-lock.json') }}
      - run: npx playwright install --with-deps chromium
      - name: Compare trace modes and preserve exact threshold
        shell: bash
        run: |
          lscpu | head -30
          python --version
          node --version
          for mode in retain-on-failure off on; do
            for sample in 1 2 3; do
              echo "DIAGNOSTIC_MODE=$mode SAMPLE=$sample"
              BRUSH_DIAGNOSTIC_MODE="$mode-$sample" npx playwright test --config tests/e2e/playwright.config.js --grep 'long sampled strokes' --trace "$mode" --reporter=line || true
            done
          done
      - name: Run normal prefix through brush case
        shell: bash
        run: |
          BRUSH_DIAGNOSTIC_MODE=normal-prefix npx playwright test --config tests/e2e/playwright.config.js tests/e2e/photo-editor/adjustment-layers.spec.js tests/e2e/photo-editor/app-compare-mobile.spec.js tests/e2e/photo-editor/brush-cursor.spec.js tests/e2e/photo-editor/brush-engine.spec.js --grep-invert 'eyedropper and retouch' --reporter=line || true
      - name: Six-second main-thread stall negative control
        shell: bash
        run: |
          if BRUSH_DIAGNOSTIC_STALL=1 BRUSH_DIAGNOSTIC_MODE=stall npx playwright test --config tests/e2e/playwright.config.js --grep 'long sampled strokes' --trace off --reporter=line; then
            echo 'ERROR: negative control was not detected'
            exit 1
          fi
@@ -256,3 +256,10 @@ jobs:
        env:
          PYTEST_SHARD: ${{ matrix.shard }}
        run: python -m pytest -q -rs --durations=25 --shard "$PYTEST_SHARD"
      - name: Playwright mobile layout checks (shard 1/4 only)
        if: steps.docs-check.outputs.docs_only != 'true' && matrix.shard == '1/4'
        run: |
          ODYSSEUS_TEST_PYTHON=python ODYSSEUS_LAYOUT_BROWSER=chromium npx --no-install playwright test \
            --config tests/e2e/ios-layout.config.cjs \
            --reporter=line
@@ -1,119 +0,0 @@
 name: Native test suites
 on:
  pull_request:
  push:
    branches: [main, dev]
  workflow_dispatch:
 permissions:
  contents: read
 concurrency:
  group: native-tests-${{ github.ref }}
  cancel-in-progress: true
 jobs:
  native-node:
    name: Native Node regressions
    runs-on: ubuntu-24.04
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: '3.11'
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: '22.23.4'
          cache: npm
      - run: npm ci --ignore-scripts --no-audit --no-fund
      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: ~/.cache/ms-playwright
          key: ms-playwright-${{ runner.os }}-${{ hashFiles('package-lock.json') }}
      - run: npx playwright install --with-deps chromium
      - name: Validate exhaustive disjoint runner mapping and execute omitted suites
        run: |
          node .github/scripts/run_native_tests.mjs
          python .github/scripts/check_test_execution.py test-results/native-node/junit.xml --minimum 43
      - name: Save native test identities and results
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: native-node-results
          path: test-results/native-node/
          retention-days: 7
          if-no-files-found: warn
  browser:
    name: Chromium application regressions
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    env:
      ODYSSEUS_E2E_DISPOSABLE_ARTIFACTS: '1'
      ODYSSEUS_TEST_PYTHON: python
      CHROMADB_HOST: 127.0.0.1
      CHROMADB_PORT: '1'
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: '3.11'
      - name: Install FFmpeg and establish system trust
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends ffmpeg ca-certificates
          python scripts/check_ca_trust.py --system
      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
        with:
          version: '0.13.5'
          enable-cache: true
          cache-dependency-glob: requirements.txt
          prune-cache: false
      - run: |
          uv pip install --system --require-hashes --only-binary=:all: --no-deps -r requirements-bootstrap.txt
          python scripts/check_ca_trust.py --python
          uv pip install --system -r requirements.txt
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: '22.23.4'
          cache: npm
      - run: npm ci --ignore-scripts --no-audit --no-fund
      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: ~/.cache/ms-playwright
          key: ms-playwright-${{ runner.os }}-${{ hashFiles('package-lock.json') }}
      - run: npx playwright install --with-deps chromium
      - name: Run complete Chromium suite against a fresh authenticated app
        env:
          PLAYWRIGHT_JUNIT_OUTPUT_FILE: test-results/browser-junit.xml
        run: |
          npm run test:photo-editor -- --reporter=line,junit
          python .github/scripts/check_test_execution.py test-results/browser-junit.xml --minimum 130
      - name: Save per-test results and sanitized failure diagnostics
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: chromium-regression-results
          path: test-results/
          retention-days: 7
          if-no-files-found: warn
  authoritative-native-suites:
    name: Authoritative native suites
    if: always()
    needs: [native-node, browser]
    runs-on: ubuntu-24.04
    steps:
      - name: Require both complete suites to succeed
        env:
          NODE_RESULT: ${{ needs.native-node.result }}
          BROWSER_RESULT: ${{ needs.browser.result }}
        run: |
          test "$NODE_RESULT" = success
          test "$BROWSER_RESULT" = success
@@ -31,21 +31,43 @@ for spec in $SPECS; do
  name="${spec%%==*}"
  ver="${spec##*==}"
  # pip download builds metadata (and trips the same bug), so fetch the raw
-  # sdist URL from the PyPI JSON API instead.
+  # sdist URL from the PyPI JSON API instead.  Use curl with retries to
-  url="$(python - "$name" "$ver" <<'PY'
+  # survive transient TLS / network failures that urllib cannot recover from.
-import json, sys, urllib.request
+  metadata="${name}-${ver}.json"
-name, ver = sys.argv[1], sys.argv[2]
+  curl --fail --silent --show-error --location \
-data = json.load(urllib.request.urlopen(f"https://pypi.org/pypi/{name}/{ver}/json"))
+    --retry 8 \
-for f in data["urls"]:
+    --retry-delay 3 \
-    if f["packagetype"] == "sdist":
+    --retry-max-time 120 \
-        print(f["url"]); break
+    --retry-all-errors \
    "https://pypi.org/pypi/${name}/${ver}/json" \
    -o "$metadata"
  url="$(python - "$metadata" <<'PY'
 import json, sys
 with open(sys.argv[1], encoding="utf-8") as f:
    data = json.load(f)
 for item in data["urls"]:
    if item["packagetype"] == "sdist":
        print(item["url"])
        break
 else:
-    sys.exit(f"no sdist found for {name}=={ver}")
+    raise SystemExit("no sdist found")
 PY
-)"
+  )"
  rm -f "$metadata"
  echo ">> fetching ${name} ${ver}: ${url}"
-  curl -fsSL "$url" -o "${name}.tar.gz"
+  curl --fail --silent --show-error --location \
    --retry 8 \
    --retry-delay 3 \
    --retry-max-time 120 \
    --retry-all-errors \
    "$url" \
    -o "${name}.tar.gz"
  tar xzf "${name}.tar.gz"
  rm -f "${name}.tar.gz"
 done
 echo ">> patching get_version()"
@@ -1,38 +0,0 @@
 # Native test merge gate
 `Native test suites` runs on pull requests, dev/main pushes and manual dispatch.
 `Authoritative native suites` fails unless both the native Node and complete
 Chromium jobs succeed; it has no continue-on-error, retries or path bypass.
 Repository administrators must require this check alongside the four pytest
 checks in branch protection. The audited public dev branch had no protection or
 ruleset, so merely adding workflow jobs cannot prevent a manual merge.
 `tests/native-ci-manifest.json` exhaustively partitions all native Node files:
 16 run in the native job,14 through existing pytest wrappers, one through the
 existing frontend architecture CI step, and the formerly live email-reply file
 through an explicitly identified Playwright driver. The manifest validator fails
 for omitted/duplicate/unreachable entries. Node emits individual JUnit identities
 and propagates its failure exit. No native file is newly run in each pytest shard.
 The browser job uses the existing one-worker Chromium config and all original129
 cases, plus one driver for the native email-reply contract. Its ephemeral account,
 SQLite DB and server are created by the config/setup; reuseExistingServer remains
 false. NPX startup is offline/cache-only in a private cache; Notes/editor behavior
 and Python MCP services remain real. No developer app or external account is used.
 Default CI trace suppression remains intact. Only this job's explicit opt-in plus
 a newly generated authenticated synthetic fixture marker permits failure traces.
 The existing structured sanitizer runs before artifacts are uploaded; invalid
 ownership, failed sanitization and missing tooling purge sensitive artifacts.
 Never upload the fixture directory, database or browser storage state.
 The stroke budget now excludes measured synthetic event-delivery pacing and also
 bounds actual Chromium main-thread work at the original5s. All240 samples and
 pixel/thumbnail/undo/redo assertions remain. Per-case timing attachments expose
 both clocks rather than treating driver frame cadence as application work.
 Three Bombadil properties remain opt-in: they require a Bombadil/browser scenario
 and bounded fuzz campaign; no authoritative execution is claimed. The two model
 smoke scripts require supplied model endpoints/models and remain explicit live
 operations. No credentials or live-service authorization are implied by CI setup.
 Firefox/WebKit alternatives remain opt-in and are not certified by Chromium CI.
@@ -33,7 +33,7 @@ async def list_tools() -> list[Tool]:
                    "prompt": {"type": "string", "description": "Image description prompt"},
                    "model": {"type": "string", "description": "Model name (auto-detects if omitted)"},
                    "size": {"type": "string", "description": "Image size (default 1024x1024)"},
-                    "quality": {"type": "string", "description": "Quality: low, medium, high, auto (default medium)"},
+                    "quality": {"type": "string", "description": "Quality: low, medium, high, auto (default configured quality, otherwise medium)"},
                },
                "required": ["prompt"],
            },
@@ -66,7 +66,7 @@ async def call_tool(name: str, arguments: dict) -> list[TextContent]:
        if not model_spec:
            model_spec = _settings.get("image_model", "")
-        if quality == "medium" and _settings.get("image_quality"):
+        if "quality" not in arguments and _settings.get("image_quality"):
            quality = _settings["image_quality"]
        # Auto-detect best available image model
@@ -9,7 +9,11 @@
    "test:photo-editor": "playwright test --config tests/e2e/playwright.config.js",
    "test:photo-editor:install": "playwright install chromium firefox webkit",
    "test:photo-editor:firefox": "PHOTO_EDITOR_E2E_BROWSER=firefox playwright test --config tests/e2e/playwright.config.js",
-    "test:photo-editor:webkit": "PHOTO_EDITOR_E2E_BROWSER=webkit playwright test --config tests/e2e/playwright.config.js"
+    "test:photo-editor:webkit": "PHOTO_EDITOR_E2E_BROWSER=webkit playwright test --config tests/e2e/playwright.config.js",
    "test:ios-layout": "playwright test --config tests/e2e/ios-layout.config.cjs",
    "test:ios-layout:chromium": "ODYSSEUS_LAYOUT_BROWSER=chromium playwright test --config tests/e2e/ios-layout.config.cjs",
    "test:ios-layout:webkit": "ODYSSEUS_LAYOUT_BROWSER=webkit playwright test --config tests/e2e/ios-layout.config.cjs",
    "test:ios-layout:install": "playwright install chromium webkit"
  },
  "devDependencies": {
    "@antithesishq/bombadil": "^0.7.0",
@@ -887,6 +887,8 @@ def setup_auth_routes(auth_manager: AuthManager) -> APIRouter:
        """Create a new integration (admin only)."""
        _require_admin_user(request)
        body = await request.json()
        if not isinstance(body, dict):
            raise HTTPException(400, "Request body must be a JSON object")
        item = add_integration(body)
        return {"ok": True, "integration": mask_integration_secret(item)}
@@ -895,6 +897,8 @@ def setup_auth_routes(auth_manager: AuthManager) -> APIRouter:
        """Update an existing integration (admin only)."""
        _require_admin_user(request)
        body = await request.json()
        if not isinstance(body, dict):
            raise HTTPException(400, "Request body must be a JSON object")
        item = update_integration(integration_id, body)
        if not item:
            raise HTTPException(404, "Integration not found")
@@ -80,6 +80,18 @@ def _require_user(request: Request) -> str:
    return FALLBACK_OWNER
 async def _json_object_body(request: Request) -> dict:
    """Parse a JSON object body. An unreadable body counts as empty; a body
    that is valid JSON but not an object (a list, string or number) is a 400."""
    try:
        body = await request.json()
    except Exception:
        return {}
    if not isinstance(body, dict):
        raise HTTPException(400, "Request body must be a JSON object")
    return body
 def _get_or_404_calendar(db, cal_id: str, owner: str) -> CalendarCal:
    cal = db.query(CalendarCal).filter(CalendarCal.id == cal_id).first()
    if not cal:
@@ -994,10 +1006,7 @@ def setup_calendar_routes(upload_handler=None) -> APIRouter:
    async def save_config(request: Request):
        """Legacy single-account endpoint — upserts the first account."""
        owner = _require_user(request)
-        try:
+        body = await _json_object_body(request)
            body = await request.json()
        except Exception:
            body = {}
        accounts = _get_caldav_accounts(owner)
        if not (body.get("url") or "").strip():
            _save_caldav_accounts(owner, [])
@@ -1052,10 +1061,7 @@ def setup_calendar_routes(upload_handler=None) -> APIRouter:
        """Add a new CalDAV account."""
        import uuid as _uuid
        owner = _require_user(request)
-        try:
+        body = await _json_object_body(request)
            body = await request.json()
        except Exception:
            body = {}
        from src.caldav_sync import validate_caldav_url
        try:
            url = validate_caldav_url(body.get("url", ""))
@@ -1080,10 +1086,7 @@ def setup_calendar_routes(upload_handler=None) -> APIRouter:
    async def update_caldav_account(account_id: str, request: Request):
        """Update an existing CalDAV account by id."""
        owner = _require_user(request)
-        try:
+        body = await _json_object_body(request)
            body = await request.json()
        except Exception:
            body = {}
        accounts = _get_caldav_accounts(owner)
        idx = next((i for i, a in enumerate(accounts) if a.get("id") == account_id), None)
        if idx is None:
@@ -1124,10 +1127,7 @@ def setup_calendar_routes(upload_handler=None) -> APIRouter:
        test an already-saved account. Falls back to the first saved account
        when nothing is provided."""
        owner = _require_user(request)
-        try:
+        body = await _json_object_body(request)
            body = await request.json()
        except Exception:
            body = {}
        url = (body.get("url") or "").strip()
        user = (body.get("username") or "").strip()
        pw = body.get("password") or ""
@@ -1901,7 +1901,7 @@ def _ts_or_zero(value) -> float:
 def _recover_empty_session_model(sess, session_id: str, owner: str | None = None) -> bool:
-    """Re-populate sess.model from the matching endpoint's cached models.
+    """Recover sess.model from the endpoint's visible cached and pinned models.
    Covers the window between endpoint setup and the first chat send: the
    picker showed a model in the dropdown but the session record never got
@@ -1965,6 +1965,9 @@ def _recover_empty_session_model(sess, session_id: str, owner: str | None = None
                visible = _visible_models(cached, getattr(ep, "hidden_models", None))
            except Exception:
                visible = cached
        if not is_chatgpt_subscription:
            from src.endpoint_resolver import _endpoint_enabled_models
            visible = _endpoint_enabled_models(ep)
        if current_model and current_model in {str(item).strip() for item in visible}:
            return False
        if is_chatgpt_subscription:
@@ -14,6 +14,7 @@ from fastapi import HTTPException
 from pydantic import BaseModel
 from routes._validators import validate_remote_host, validate_ssh_port
 from routes.cookbook_output import HF_PARTIAL_BLOB_HELPER
 from core.platform_compat import _ssh_exec_argv
 logger = logging.getLogger(__name__)
@@ -378,6 +379,7 @@ def _cached_model_scan_script(model_dirs: list[str] | None = None, add_hf_cache:
    """
    lines = [
        "import json, os, re, shutil, subprocess, urllib.request",
        *HF_PARTIAL_BLOB_HELPER.splitlines(),
        "models = []",
        "seen = set()",
        "BLOCKED_ROOTS = ('/sys', '/proc', '/dev', '/run', '/var/run')",
@@ -436,8 +438,10 @@ def _cached_model_scan_script(model_dirs: list[str] | None = None, add_hf_cache:
        "        sz, nf, ic = 0, 0, False",
        "        if os.path.isdir(blobs):",
        "            for f in os.scandir(blobs):",
        "                if f.name.endswith('.incomplete'):",
        "                    if not is_partial_blob(f.path): continue",
        "                    ic = True",
        "                if f.is_file(): nf += 1; sz += f.stat().st_size",
        "                if f.name.endswith('.incomplete'): ic = True",
        "        snap = os.path.join(cache, d, 'snapshots')",
        "        def snapshot_size():",
        "            total, count, incomplete = 0, 0, False",
@@ -1030,6 +1034,166 @@ def _append_llama_cpp_linux_accel_build_lines(runner_lines: list[str]) -> None:
    runner_lines.append('  fi  # end _odysseus_have_prebuilt guard')
 ODYSSEUS_LLAMA_SHIM_MARKER = "# Auto-generated by Odysseus Cookbook: a `llama-server` lookalike"
 def _append_llama_server_resolution_definition_lines(runner_lines: list[str]) -> None:
    """Define the helper shell function that discovers, reconciles and prioritizes llama-server."""
    marker = f"'{_bash_squote(ODYSSEUS_LLAMA_SHIM_MARKER)}'"
    runner_lines.append('_odysseus_resolve_llama_server() {')
    runner_lines.append('  _odysseus_llama_bin=""')
    runner_lines.append(f'  local _marker={marker}')
    runner_lines.append('  local _saved_ifs="$IFS"')
    runner_lines.append("  IFS=':'")
    runner_lines.append('  local -a _parts')
    runner_lines.append('  read -r -a _parts <<< "$PATH"')
    runner_lines.append('  IFS="$_saved_ifs"')
    runner_lines.append('  local _dir _cand')
    runner_lines.append('  for _dir in "${_parts[@]}"; do')
    runner_lines.append('    [ -n "$_dir" ] || continue')
    runner_lines.append('    _cand="$_dir/llama-server"')
    runner_lines.append('    [ -x "$_cand" ] || continue')
    runner_lines.append('    if [ -f "$_cand" ] && [ ! -L "$_cand" ] && grep -Fxq "$_marker" "$_cand" 2>/dev/null; then')
    runner_lines.append('      continue')
    runner_lines.append('    fi')
    runner_lines.append('    if "$_cand" --version >/dev/null 2>&1; then')
    runner_lines.append('      _odysseus_llama_bin="$_cand"')
    runner_lines.append('      break')
    runner_lines.append('    fi')
    runner_lines.append('  done')
    runner_lines.append('  if [ -f "$HOME/bin/llama-server" ] && [ ! -L "$HOME/bin/llama-server" ] && grep -Fxq "$_marker" "$HOME/bin/llama-server" 2>/dev/null; then')
    runner_lines.append('    if [ -n "$_odysseus_llama_bin" ]; then')
    runner_lines.append('      echo "[odysseus] Native llama-server detected — retiring Odysseus compatibility shim in ~/bin"')
    runner_lines.append('      rm -f "$HOME/bin/llama-server"')
    runner_lines.append('      hash -r')
    runner_lines.append('    elif python3 -c "import llama_cpp.server" 2>/dev/null; then')
    runner_lines.append('      _odysseus_llama_bin="$HOME/bin/llama-server"')
    runner_lines.append('    else')
    runner_lines.append('      echo "[odysseus] Removing stale Odysseus llama-server shim (python3 -m llama_cpp.server unavailable)"')
    runner_lines.append('      rm -f "$HOME/bin/llama-server"')
    runner_lines.append('      hash -r')
    runner_lines.append('    fi')
    runner_lines.append('  fi')
    runner_lines.append('  if [ -n "$_odysseus_llama_bin" ]; then')
    runner_lines.append('    local _cand_dir')
    runner_lines.append('    _cand_dir="$(dirname "$_odysseus_llama_bin")"')
    runner_lines.append('    if [ "${PATH%%:*}" != "$_cand_dir" ]; then')
    runner_lines.append('      export PATH="$_cand_dir:$PATH"')
    runner_lines.append('    fi')
    runner_lines.append('    hash -r')
    runner_lines.append('    return 0')
    runner_lines.append('  fi')
    runner_lines.append('  return 1')
    runner_lines.append('}')
 def _append_llama_server_shim_definition_lines(runner_lines: list[str]) -> None:
    """Define the helper shell function that generates the Odysseus compatibility shim."""
    _append_llama_server_resolution_definition_lines(runner_lines)
    marker = f"'{_bash_squote(ODYSSEUS_LLAMA_SHIM_MARKER)}'"
    runner_lines.append('_odysseus_create_llama_shim() {')
    runner_lines.append('  local _target="$HOME/bin/llama-server"')
    runner_lines.append(f'  local _marker={marker}')
    runner_lines.append('  if [ -e "$_target" ] || [ -L "$_target" ]; then')
    runner_lines.append('    if [ -f "$_target" ] && [ ! -L "$_target" ] && grep -Fxq "$_marker" "$_target" 2>/dev/null; then')
    runner_lines.append('      : # existing Odysseus shim — safe to replace')
    runner_lines.append('    else')
    runner_lines.append('      echo "[odysseus] WARNING: $_target already exists and is not an Odysseus-managed shim; leaving untouched." >&2')
    runner_lines.append('      return 1')
    runner_lines.append('    fi')
    runner_lines.append('  fi')
    runner_lines.append('  mkdir -p "$HOME/bin" || return 1')
    runner_lines.append('  local _tmp')
    runner_lines.append('  _tmp="$(mktemp "$HOME/bin/.llama-server.odysseus.tmp.XXXXXX")" || {')
    runner_lines.append('    echo "[odysseus] ERROR: unable to create secure temporary llama-server shim in $HOME/bin" >&2')
    runner_lines.append('    return 1')
    runner_lines.append('  }')
    runner_lines.append("  if ! cat > \"$_tmp\" <<'_ODY_LLAMA_SHIM_EOF'")
    runner_lines.append('#!/usr/bin/env bash')
    runner_lines.append(ODYSSEUS_LLAMA_SHIM_MARKER)
    runner_lines.append('# that translates the native CLI to `python -m llama_cpp.server`.')
    runner_lines.append('# Lets cookbook-generated launch commands run unchanged on hosts')
    runner_lines.append('# where only the pip llama-cpp-python package is installed.')
    runner_lines.append('ARGS=()')
    runner_lines.append('while [ $# -gt 0 ]; do')
    runner_lines.append('  case "$1" in')
    runner_lines.append('    -ngl|--gpu-layers|--n-gpu-layers) ARGS+=(--n_gpu_layers "$2"); shift 2 ;;')
    runner_lines.append('    -c|--ctx-size) ARGS+=(--n_ctx "$2"); shift 2 ;;')
    runner_lines.append('    -b|--batch-size) ARGS+=(--n_batch "$2"); shift 2 ;;')
    runner_lines.append('    -ub|--ubatch-size) shift 2 ;;  # llama-cpp-python has no separate ubatch')
    runner_lines.append('    --flash-attn) ARGS+=(--flash_attn true); shift 2 ;;')
    runner_lines.append('    --cache-type-k) ARGS+=(--type_k "$2"); shift 2 ;;')
    runner_lines.append('    --cache-type-v) ARGS+=(--type_v "$2"); shift 2 ;;')
    runner_lines.append('    --n-cpu-moe) ARGS+=(--n_cpu_moe "$2"); shift 2 ;;')
    runner_lines.append('    --mmproj) ARGS+=(--clip_model_path "$2"); shift 2 ;;')
    runner_lines.append('    --image-max-tokens) shift 2 ;;  # native-only')
    runner_lines.append('    --no-mmap) ARGS+=(--no_mmap true); shift ;;')
    runner_lines.append('    --no-warmup) shift ;;  # native-only')
    runner_lines.append('    --chat-template) ARGS+=(--chat_format "$2"); shift 2 ;;')
    runner_lines.append('    --fit|--split-mode|--tensor-split|--main-gpu|--parallel) shift 2 ;;  # native-only')
    runner_lines.append('    --mlock) ARGS+=(--use_mlock true); shift ;;')
    runner_lines.append('    *) ARGS+=("$1"); shift ;;')
    runner_lines.append('  esac')
    runner_lines.append('done')
    runner_lines.append('exec python3 -m llama_cpp.server "${ARGS[@]}"')
    runner_lines.append('_ODY_LLAMA_SHIM_EOF')
    runner_lines.append('  then')
    runner_lines.append('    rm -f -- "$_tmp"')
    runner_lines.append('    return 1')
    runner_lines.append('  fi')
    runner_lines.append('  chmod +x "$_tmp" || { rm -f -- "$_tmp"; return 1; }')
    runner_lines.append('  mv -f -- "$_tmp" "$_target" || { rm -f -- "$_tmp"; return 1; }')
    runner_lines.append('  hash -r')
    runner_lines.append('  echo "[odysseus] Created llama-server shim → python -m llama_cpp.server (no native binary needed)"')
    runner_lines.append('}')
 def _append_llama_server_shim_reconciliation_lines(runner_lines: list[str]) -> None:
    """Reconcile an existing ~/bin/llama-server if it is owned by Odysseus Cookbook.
    Invariants:
    - Never touch an arbitrary user-owned executable or symlink.
    - If ~/bin/llama-server is an Odysseus generated shim:
        - If a native llama-server is present and healthy elsewhere on PATH, remove the shim
          so the native binary is used.
        - If python3 -m llama_cpp.server is unavailable, remove the stale shim
          and hash -r so the fallback/build path is triggered.
        - If no healthy native server exists and llama_cpp.server is working, preserve it.
    - If a healthy native candidate exists on PATH (even later in PATH), prioritize it and
      ensure the launched executable is the validated candidate.
    """
    runner_lines.append('[ -r ~/.config/odysseus-llama-cpp-env ] && . ~/.config/odysseus-llama-cpp-env')
    runner_lines.append('if ! declare -F _odysseus_resolve_llama_server >/dev/null 2>&1; then')
    _append_llama_server_resolution_definition_lines(runner_lines)
    runner_lines.append('fi')
    runner_lines.append('_odysseus_resolve_llama_server || true')
 def _append_llama_server_finalization_lines(runner_lines: list[str], platform_hint: str = "") -> None:
    """Reconcile post-install launcher availability and enforce fail-closed invariant.
    Guarantees that if python3 -m llama_cpp.server is usable but the `llama-server`
    command is unresolvable, the compatibility launcher is created. If no usable
    launcher exists after all build/install attempts, sets ODYSSEUS_PREFLIGHT_EXIT=127.
    """
    err_msg = (
        f"ERROR: llama.cpp serving is not available on {platform_hint} after install attempts."
        if platform_hint
        else "ERROR: llama.cpp serving is not available after install/build attempts."
    )
    runner_lines.append('if ! declare -F _odysseus_resolve_llama_server >/dev/null 2>&1; then')
    _append_llama_server_resolution_definition_lines(runner_lines)
    runner_lines.append('fi')
    runner_lines.append('if [ -z "$_odysseus_llama_bin" ] && python3 -c "import llama_cpp.server" 2>/dev/null; then')
    runner_lines.append('  _odysseus_create_llama_shim')
    runner_lines.append('  _odysseus_resolve_llama_server || true')
    runner_lines.append('fi')
    runner_lines.append('if [ -z "$_odysseus_llama_bin" ]; then')
    runner_lines.append(f'  echo "{err_msg}"')
    runner_lines.append('  ODYSSEUS_PREFLIGHT_EXIT=127')
    runner_lines.append('fi')
 def _llama_cpp_rebuild_cmd(update_source: bool = False) -> str:
    """Shell command that clears the Cookbook-managed llama.cpp build.
@@ -1327,6 +1491,20 @@ def _diagnose_serve_output(text: str) -> dict | None:
            "Port is already in use.",
            [{"label": "retry on port 8001", "op": "replace", "flag": "--port", "value": "8001"}],
        ),
        (
            # PyPI torch/vLLM wheels now target CUDA 13, which needs driver 580+.
            # torch: "The NVIDIA driver on your system is too old (found version 12080)";
            # vLLM kernels: "CUDA driver version is insufficient for CUDA runtime version".
            r"NVIDIA driver on your system is too old|CUDA driver version is insufficient",
            "The installed PyTorch/vLLM build needs a newer NVIDIA driver than this server has.",
            [
                {
                    "label": "install builds for the driver's CUDA version, e.g. vLLM's +cu129 wheel from its GitHub release with uv pip install … --torch-backend cu129",
                    "op": "manual",
                },
                {"label": "or update the NVIDIA driver (CUDA 13 builds need driver 580 or newer)", "op": "manual"},
            ],
        ),
        (
            r"No CUDA GPUs are available|no GPU.*found|CUDA_VISIBLE_DEVICES.*invalid",
            "No GPUs are visible to the serve process.",
@@ -8,6 +8,20 @@ import re
 _FETCHING_ZERO_FILES_RE = re.compile(r"Fetching\s+0\s+files", re.IGNORECASE)
 # Shared source embedded in local/remote inventory and status probes. A blank
 # retry marker beside its completed, nonempty content-addressed blob is stale;
 # a blank marker alone may be a download that has not received its first byte.
 HF_PARTIAL_BLOB_HELPER = """def is_partial_blob(path):
    if not path.endswith('.incomplete'):
        return False
    try:
        completed = path[:-len('.incomplete')]
        return (os.path.getsize(path) != 0 or not os.path.isfile(completed)
                or os.path.getsize(completed) == 0)
    except OSError:
        return True
 """
 # Probe scripts for the dead-session download check, run as
 # `python3 -c <PROBE> <repo_id> <cache_root>` (locally or over SSH).
 # cache_root is the task's custom download dir, '' for the default HF cache.
@@ -15,7 +29,7 @@ _FETCHING_ZERO_FILES_RE = re.compile(r"Fetching\s+0\s+files", re.IGNORECASE)
 # HF_HOME=<local_dir>, so that task's cache lives under <local_dir>/hub, and
 # the probe process's own environment knows nothing about it.
 HF_CACHE_COMPLETE_PROBE = (
-    "import os,sys;"
+    "import os,sys\n" + HF_PARTIAL_BLOB_HELPER +
    "repo=sys.argv[1];"
    "root=os.path.expanduser(sys.argv[2]) if len(sys.argv)>2 and sys.argv[2] else '';"
    "base=os.path.join(root,'hub') if root else (os.environ.get('HUGGINGFACE_HUB_CACHE') or os.path.join(os.environ.get('HF_HOME', os.path.expanduser('~/.cache/huggingface')), 'hub'));"
@@ -24,18 +38,18 @@ HF_CACHE_COMPLETE_PROBE = (
    "ok=os.path.isdir(snap) and any(os.path.isdir(os.path.join(snap,x)) and os.listdir(os.path.join(snap,x)) for x in os.listdir(snap));"
    "inc=False;"
    "blobs=os.path.join(d,'blobs');"
-    "inc=os.path.isdir(blobs) and any(x.endswith('.incomplete') for x in os.listdir(blobs));"
+    "inc=os.path.isdir(blobs) and any(is_partial_blob(os.path.join(blobs,x)) for x in os.listdir(blobs));"
    "sys.exit(0 if ok and not inc else 1)"
 )
 HF_CACHE_INCOMPLETE_PROBE = (
-    "import os,sys;"
+    "import os,sys\n" + HF_PARTIAL_BLOB_HELPER +
    "repo=sys.argv[1];"
    "root=os.path.expanduser(sys.argv[2]) if len(sys.argv)>2 and sys.argv[2] else '';"
    "base=os.path.join(root,'hub') if root else (os.environ.get('HUGGINGFACE_HUB_CACHE') or os.path.join(os.environ.get('HF_HOME', os.path.expanduser('~/.cache/huggingface')), 'hub'));"
    "d=os.path.join(base,'models--'+repo.replace('/','--'));"
    "blobs=os.path.join(d,'blobs');"
-    "inc=os.path.isdir(blobs) and any(x.endswith('.incomplete') for x in os.listdir(blobs));"
+    "inc=os.path.isdir(blobs) and any(is_partial_blob(os.path.join(blobs,x)) for x in os.listdir(blobs));"
    "sys.exit(0 if inc else 1)"
 )
@@ -57,9 +57,11 @@ from routes.cookbook_helpers import (
    _pip_install_no_cache, _user_shell_path_bootstrap, _venv_safe_local_pip_install_cmd,
    _diagnose_serve_output, run_ssh_command_async,
    _ollama_bind_from_cmd, _pip_install_fallback_chain, _pip_install_no_cache,
    _user_shell_path_bootstrap, _venv_safe_local_pip_install_cmd,
    _append_pip_install_runner_lines, _pip_install_command_without_break_system_packages,
    _normalize_llama_cpp_python_cache_types,
    _append_llama_server_shim_definition_lines,
    _append_llama_server_shim_reconciliation_lines,
    _append_llama_server_finalization_lines,
    ModelDownloadRequest, ServeRequest,
 )
@@ -466,175 +468,6 @@ def setup_cookbook_routes() -> APIRouter:
                    task["payload"].pop("hf_token", None)
        return state
    def _diagnose_serve_output(text: str) -> dict | None:
        """Server-side mirror of the Cookbook UI's common serve diagnoses.
        The browser uses cookbook-diagnosis.js for clickable fixes. This gives
        the agent/tool path the same structured signal so it can retry with an
        adjusted command instead of guessing from raw tmux output.
        """
        if not text:
            return None
        tail = text[-6000:]
        patterns = [
            (
                r"No available memory for the cache blocks|Available KV cache memory:.*-",
                "No GPU memory left for KV cache after loading model.",
                [
                    {"label": "retry with GPU memory utilization 0.95", "op": "replace", "flag": "--gpu-memory-utilization", "value": "0.95"},
                    {"label": "retry with context 2048", "op": "replace", "flag": "--max-model-len", "value": "2048"},
                ],
            ),
            (
                r"CUDA out of memory|torch\.cuda\.OutOfMemoryError|CUDA error: out of memory|warming up sampler|max_num_seqs.*gpu_memory_utilization",
                "GPU ran out of memory during startup or warmup.",
                [
                    {"label": "retry with context 4096", "op": "replace", "flag": "--max-model-len", "value": "4096"},
                    {"label": "retry with GPU memory utilization 0.80", "op": "replace", "flag": "--gpu-memory-utilization", "value": "0.80"},
                    {"label": "retry with --enforce-eager", "op": "append", "arg": "--enforce-eager"},
                ],
            ),
            (
                r"not divisib|must be divisible|attention heads.*divisible",
                "Tensor parallel size is incompatible with the model.",
                [
                    {"label": "retry with tensor parallel size 1", "op": "replace", "flag": "--tensor-parallel-size", "value": "1"},
                    {"label": "retry with tensor parallel size 2", "op": "replace", "flag": "--tensor-parallel-size", "value": "2"},
                ],
            ),
            (
                r"KV cache.*too (small|large)|max_model_len.*exceeds|maximum.*context",
                "Context length is too large for available GPU memory.",
                [
                    {"label": "retry with context 8192", "op": "replace", "flag": "--max-model-len", "value": "8192"},
                    {"label": "retry with context 4096", "op": "replace", "flag": "--max-model-len", "value": "4096"},
                ],
            ),
            (
                r"enable-auto-tool-choice requires --tool-call-parser",
                "Auto tool choice requires an explicit tool call parser.",
                [{"label": "retry with Hermes tool parser", "op": "append", "arg": "--tool-call-parser hermes"}],
            ),
            (
                r"Please pass.*trust.remote.code=True|contains custom code which must be executed to correctly load|does not recognize this architecture|model type.*but Transformers does not",
                "Model requires custom code or newer model support.",
                [{"label": "retry with --trust-remote-code", "op": "append", "arg": "--trust-remote-code"}],
            ),
            (
                r"Either a revision or a version must be specified|transformers\.integrations\.hub_kernels|kernels/layer",
                "vLLM/Transformers kernel package mismatch.",
                [{"label": "update vLLM, Transformers, and kernels on this server", "op": "dependency", "package": "vllm transformers kernels"}],
            ),
            (
                r"Address already in use|bind.*address.*in use",
                "Port is already in use.",
                [{"label": "retry on port 8001", "op": "replace", "flag": "--port", "value": "8001"}],
            ),
            (
                r"No CUDA GPUs are available|no GPU.*found|CUDA_VISIBLE_DEVICES.*invalid",
                "No GPUs are visible to the serve process.",
                [{"label": "clear Cookbook GPU selection or choose available GPUs", "op": "settings", "field": "gpus", "value": ""}],
            ),
            (
                r"Failed to infer device type|NVML Shared Library Not Found|No module named 'amdsmi'|platform is not available",
                "vLLM could not find a supported GPU (CUDA or ROCm). "
                "This machine may have integrated or unsupported graphics only.",
                [
                    {"label": "switch to llama.cpp (CPU/Metal, works without a discrete GPU)", "op": "manual"},
                    {"label": "switch to Ollama (CPU/Metal, works without a discrete GPU)", "op": "manual"},
                ],
            ),
            (
                r"vllm.*command not found|No module named vllm|ERROR: vLLM is not installed",
                "vLLM is not installed or not in PATH on this server.",
                [{"label": "install vLLM in Cookbook Dependencies", "op": "dependency", "package": "vllm"}],
            ),
            (
                r"sgl_kernel[\s\S]*(Python\.h|libnuma\.so\.1|common_ops|libnvrtc\.so)|"
                r"(Python\.h|libnuma\.so\.1|common_ops|libnvrtc\.so)[\s\S]*sgl_kernel|"
                r"Could not load any common_ops library|"
                r"Please ensure sgl_kernel is properly installed",
                "SGLang native kernel/runtime is missing or mismatched on this server.",
                [
                    {"label": "repair sglang-kernel in this Python environment", "op": "dependency", "package": "sglang-kernel"},
                    {"label": "if libnvrtc is still missing, install the matching CUDA/NVRTC runtime on this host", "op": "manual"},
                ],
            ),
            (
                r"sglang.*command not found|No module named sglang|SGLang is not installed",
                "SGLang is not installed or not in PATH on this server.",
                [{"label": "install SGLang in Cookbook Dependencies", "op": "dependency", "package": "sglang[all]"}],
            ),
            (
                r"No module named ['\"]?mlx_lm|mlx_lm.*command not found|MLX is not installed|MLX LM is not installed",
                "MLX LM is not installed on this server.",
                [{"label": "install mlx-lm in Cookbook Dependencies", "op": "dependency", "package": "mlx-lm"}],
            ),
            (
                r"OmniGen2Pipeline|module diffusers has no attribute .*Pipeline|custom_pipeline=.*failed",
                "This image model uses a custom Diffusers pipeline that the launch environment does not know yet.",
                [{"label": "update Diffusers image dependencies", "op": "dependency", "package": "diffusers transformers accelerate"}],
            ),
            (
                r"Unable to quantize model of type <class ['\"]mlx_lm\.models\.switch_layers\.QuantizedSwitchLinear['\"]>|QuantizedSwitchLinear",
                "MLX-LM tried to quantize an already-quantized DeepSeek switch layer.",
                [
                    {"label": "relaunch from the cached local Hugging Face snapshot path on this Mac", "op": "manual"},
                    {"label": "Odysseus now rewrites MLX repo-id launches to a cached snapshot when one exists", "op": "manual"},
                ],
            ),
            # System build deps come BEFORE the generic llama.cpp catch-all
            # so cmake / build-essential / git missing → a specific OS-package
            # remediation instead of "install llama-cpp-python[server]" (which
            # itself fails to compile when cmake is absent).
            (
                r"cmake: command not found|cmake.*not found.*[Cc]ould not",
                "cmake is required to build llama.cpp from source but isn't installed on this server.",
                [{"label": "install build deps for llama.cpp (apt: cmake build-essential git / pacman: cmake base-devel git / dnf: cmake gcc-c++ make git / brew: cmake git)", "op": "dependency", "package": "llama-cpp-python[server]"}],
            ),
            (
                r"^(make|g\+\+|gcc): command not found|Could not find C\+\+ compiler",
                "A C/C++ compiler (build-essential) is required to build llama.cpp from source.",
                [{"label": "install build deps for llama.cpp on this server", "op": "dependency", "package": "llama-cpp-python[server]"}],
            ),
            (
                r"^git: command not found",
                "git is required to clone the llama.cpp source tree.",
                [{"label": "install build deps for llama.cpp on this server", "op": "dependency", "package": "llama-cpp-python[server]"}],
            ),
            (
                r"llama-server.*command not found|llama\.cpp.*not found|No module named.*llama_cpp|No module named 'starlette_context'",
                "llama.cpp / llama-cpp-python dependencies are missing.",
                [{"label": "install llama.cpp dependencies or llama-cpp-python[server]", "op": "dependency", "package": "llama-cpp-python[server]"}],
            ),
            (
                r"No GGUF found on this host|no \.gguf file|No GGUF file found",
                "No GGUF file found for this model on this host. The llama.cpp backend needs a .gguf file.",
                [{"label": "download a GGUF build of this model (repo name usually ends in -GGUF, file like Q4_K_M.gguf)", "op": "manual"}],
            ),
            (
                r"No module named 'torch'|No module named torch|No module named 'torchvision'|No module named torchvision|No module named 'diffusers'|No module named diffusers|No module named 'scipy'|No module named scipy|install scipy if you want to use beta sigmas|requires the Torchvision library",
                "Diffusion serving requires PyTorch, Torchvision, Diffusers, Accelerate, and SciPy.",
                [{"label": "install Diffusers image deps in Cookbook Dependencies", "op": "dependency", "package": "diffusers[torch] torchvision accelerate scipy python-multipart"}],
            ),
            (
                r"403 Forbidden|401 Unauthorized|Access to model.*is restricted|gated repo|not in the authorized list|awaiting a review",
                "Model access is gated or unauthorized.",
                [{"label": "set HF token and request model access on HuggingFace", "op": "manual"}],
            ),
        ]
        for pattern, message, suggestions in patterns:
            if re.search(pattern, tail, re.I):
                return {"message": message, "suggestions": suggestions}
        if re.search(r"Traceback \(most recent call last\)", tail, re.I) and not re.search(
            r"Application startup complete|GET /v1/|Uvicorn running on", tail, re.I
        ):
            return {
                "message": "Python traceback detected during serve startup.",
                "suggestions": [{"label": "inspect traceback and retry with adjusted backend/settings", "op": "manual"}],
            }
        return None
    def _state_for_client(state):
        """Return cookbook state without raw secrets for browser clients."""
        _strip_task_secrets(state)
@@ -2161,7 +1994,7 @@ def setup_cookbook_routes() -> APIRouter:
                ps_lines.append('}')
            elif "llama_cpp" in req.cmd or "llama-server" in req.cmd:
                ps_lines.append('# Auto-install llama-cpp-python if missing')
-                ps_lines.append('try { python -c "import llama_cpp" 2>$null } catch {}')
+                ps_lines.append('try { python -c "import llama_cpp.server" 2>$null } catch {}')
                ps_lines.append('if ($LASTEXITCODE -ne 0) {')
                ps_lines.append('  Write-Host "Installing llama-cpp-python..."')
                ps_lines.append('  python -m pip install llama-cpp-python[server]')
@@ -2247,14 +2080,17 @@ def setup_cookbook_routes() -> APIRouter:
                # ollama is found (otherwise macOS falls back to a slow source build).
                # /opt/homebrew = Apple Silicon, /usr/local = Intel; harmless on Linux.
                runner_lines.append('export PATH="$HOME/.local/bin:$HOME/bin:$HOME/llama.cpp/build/bin:/opt/homebrew/bin:/usr/local/bin:$PATH"')
                _append_llama_server_shim_definition_lines(runner_lines)
                _append_llama_server_shim_reconciliation_lines(runner_lines)
                runner_lines.append('if [ -d /data/data/com.termux ]; then')
                runner_lines.append('  # Termux: no native build — use the Python bindings (CPU).')
-                runner_lines.append('  if ! python3 -c "import llama_cpp" 2>/dev/null; then')
+                runner_lines.append('  if ! python3 -c "import llama_cpp.server" 2>/dev/null; then')
                runner_lines.append('    pkg install -y cmake 2>/dev/null')
                runner_lines.append('    pip install numpy diskcache jinja2 2>/dev/null')
                runner_lines.append('    CMAKE_ARGS="-DGGML_BLAS=OFF -DGGML_LLAMAFILE=OFF" pip install \'llama-cpp-python[server]\' --no-build-isolation --no-cache-dir 2>&1 || true')
                runner_lines.append('  fi')
-                runner_lines.append('elif ! command -v llama-server &>/dev/null; then')
+                _append_llama_server_finalization_lines(runner_lines, platform_hint="Termux")
                runner_lines.append('elif [ -z "$_odysseus_llama_bin" ]; then')
                runner_lines.append('  echo "Native llama-server not found — building from source (one-time, may take a few minutes)..."')
                runner_lines.append('  mkdir -p ~/bin')
                runner_lines.append('  cd ~ && [ -d llama.cpp ] || git clone --depth 1 https://github.com/ggml-org/llama.cpp')
@@ -2271,8 +2107,7 @@ def setup_cookbook_routes() -> APIRouter:
                # would reuse the bad settings and fail again. CMAKE_BUILD_TYPE is
                # explicit so the binary is optimized (Metal auto-enables on macOS).
                runner_lines.append('    cd ~/llama.cpp && rm -rf build && cmake -B build -DCMAKE_BUILD_TYPE=Release \\')
-                runner_lines.append('      && cmake --build build -j"$NPROC" --target llama-server \\')
+                runner_lines.append('      && cmake --build build -j"$NPROC" --target llama-server')
                runner_lines.append('      && ln -sf ~/llama.cpp/build/bin/llama-server ~/bin/llama-server')
                runner_lines.append('  else')
                _append_llama_cpp_linux_accel_build_lines(runner_lines)
                runner_lines.append('  fi')
@@ -2296,58 +2131,13 @@ def setup_cookbook_routes() -> APIRouter:
                runner_lines.append('      fi')
                runner_lines.append('    fi')
                runner_lines.append('  fi')
-                # SHORT-CIRCUIT before the build/pip fallback: if the
+                runner_lines.append('  _odysseus_resolve_llama_server || true')
-                # native binary is missing but llama_cpp Python is already
+                # If the native build failed, fall back to the Python bindings.
-                # installed, drop a wrapper at ~/bin/llama-server that
+                runner_lines.append('  if [ -z "$_odysseus_llama_bin" ] && ! python3 -c "import llama_cpp.server" 2>/dev/null; then')
                # translates llama-server CLI args to llama_cpp.server's
                # underscore-style flags. The user's serve command stays
                # `llama-server ...` and "just works" — no build, no cmake,
                # no second install. This is the path that unblocks every
                # remote where pip-installed llama-cpp-python is already
                # working but Cookbook used to insist on a native binary.
                runner_lines.append('  if ! command -v llama-server >/dev/null 2>&1 && python3 -c "import llama_cpp" 2>/dev/null; then')
                runner_lines.append('    mkdir -p ~/bin')
                runner_lines.append('    cat > ~/bin/llama-server <<\'_ODY_LLAMA_SHIM_EOF\'')
                runner_lines.append('#!/usr/bin/env bash')
                runner_lines.append('# Auto-generated by Odysseus Cookbook: a `llama-server` lookalike')
                runner_lines.append('# that translates the native CLI to `python -m llama_cpp.server`.')
                runner_lines.append('# Lets cookbook-generated launch commands run unchanged on hosts')
                runner_lines.append('# where only the pip llama-cpp-python package is installed.')
                runner_lines.append('ARGS=()')
                runner_lines.append('while [ $# -gt 0 ]; do')
                runner_lines.append('  case "$1" in')
                runner_lines.append('    -ngl|--gpu-layers|--n-gpu-layers) ARGS+=(--n_gpu_layers "$2"); shift 2 ;;')
                runner_lines.append('    -c|--ctx-size) ARGS+=(--n_ctx "$2"); shift 2 ;;')
                runner_lines.append('    -b|--batch-size) ARGS+=(--n_batch "$2"); shift 2 ;;')
                runner_lines.append('    -ub|--ubatch-size) shift 2 ;;  # llama-cpp-python has no separate ubatch')
                runner_lines.append('    --flash-attn) ARGS+=(--flash_attn true); shift 2 ;;')
                runner_lines.append('    --cache-type-k) ARGS+=(--type_k "$2"); shift 2 ;;')
                runner_lines.append('    --cache-type-v) ARGS+=(--type_v "$2"); shift 2 ;;')
                runner_lines.append('    --n-cpu-moe) ARGS+=(--n_cpu_moe "$2"); shift 2 ;;')
                runner_lines.append('    --mmproj) ARGS+=(--clip_model_path "$2"); shift 2 ;;')
                runner_lines.append('    --image-max-tokens) shift 2 ;;  # native-only')
                runner_lines.append('    --no-mmap) ARGS+=(--no_mmap true); shift ;;')
                runner_lines.append('    --no-warmup) shift ;;  # native-only')
                runner_lines.append('    --chat-template) ARGS+=(--chat_format "$2"); shift 2 ;;')
                runner_lines.append('    --fit|--split-mode|--tensor-split|--main-gpu|--parallel) shift 2 ;;  # native-only')
                runner_lines.append('    --mlock) ARGS+=(--use_mlock true); shift ;;')
                runner_lines.append('    *) ARGS+=("$1"); shift ;;')
                runner_lines.append('  esac')
                runner_lines.append('done')
                runner_lines.append('exec python3 -m llama_cpp.server "${ARGS[@]}"')
                runner_lines.append('_ODY_LLAMA_SHIM_EOF')
                runner_lines.append('    chmod +x ~/bin/llama-server')
                runner_lines.append('    echo "[odysseus] Created llama-server shim → python -m llama_cpp.server (no native binary needed)"')
                runner_lines.append('  fi')
                runner_lines.append('  # If the native build failed, fall back to the Python bindings.')
                runner_lines.append('  if ! command -v llama-server &>/dev/null && ! python3 -c "import llama_cpp" 2>/dev/null; then')
                runner_lines.append('    echo "llama-server build failed — installing Python bindings as fallback..."')
                runner_lines.append(f"    {_pip_install_fallback_chain('llama-cpp-python[server]', python_cmd='pip')} || true")
                runner_lines.append('  fi')
-                runner_lines.append('  if ! command -v llama-server &>/dev/null && ! python3 -c "import llama_cpp" 2>/dev/null; then')
+                _append_llama_server_finalization_lines(runner_lines)
                runner_lines.append('    echo "ERROR: llama.cpp serving is not available after install/build attempts."')
                runner_lines.append('    ODYSSEUS_PREFLIGHT_EXIT=127')
                runner_lines.append('  fi')
                runner_lines.append('fi')
            elif re.search(r"\bollama\s+serve\b", req.cmd):
                handled_ollama_serve = True
@@ -3971,7 +3761,7 @@ def setup_cookbook_routes() -> APIRouter:
                    return {"ok": False, "files": [], "error": f"HF API HTTP {resp.status_code}"}
                data = resp.json()
        except Exception:
-            logger.exception("HF GGUF file scan failed for %s", repo)
+            logger.exception("HF GGUF file scan failed for %s", repo_id)
            return {"ok": False, "files": [], "error": "HF API request failed"}
        files = [
            str(s.get("rfilename") or "")
@@ -4343,7 +4133,7 @@ def setup_cookbook_routes() -> APIRouter:
            tmux output can stop at a stale progress line if the pane/session
            disappears before Cookbook captures the final DOWNLOAD_OK marker.
            In that case, trust the cache shape: a snapshot directory with files
-            and no *.incomplete blobs means HuggingFace finished materializing the
+            and no unfinished blobs means HuggingFace finished materializing the
            model. cache_root is the task's custom download dir — the runner
            pointed HF_HOME there, so the cache lives under <cache_root>/hub,
            not wherever this probe's environment says.
@@ -4368,7 +4158,8 @@ def setup_cookbook_routes() -> APIRouter:
            """Best-effort check for resumable HF partial blobs.
            A lost SSH/tmux session can leave a real download still incomplete.
-            Treat any *.incomplete blob as stronger evidence than stale
+            Treat unfinished blobs (excluding empty markers paired with a
            completed blob) as stronger evidence than stale
            "100%" lines in the captured pane output.
            """
            if not repo_id or "/" not in repo_id:
@@ -4486,7 +4277,9 @@ def setup_cookbook_routes() -> APIRouter:
                # fills the visible tail. Without this, output_tail ends up
                # as just "Locale: C / Ubuntu_Odysseus ❯" and the agent
                # can't diagnose the actual error.
-                capture_cmd = ssh_base + [remote, _remote_tmux_command("capture-pane", "-t", session_id, "-p", "-S", "-500")]
+                # -J joins lines tmux wrapped at the pane width, so an error
                # split mid-word still matches the serve diagnosis patterns.
                capture_cmd = ssh_base + [remote, _remote_tmux_command("capture-pane", "-t", session_id, "-p", "-J", "-S", "-500")]
            elif IS_WINDOWS:
                # LOCAL Windows task: launched as a detached process (no tmux).
                # Liveness comes from the <session>.pid file, output from the
@@ -4495,7 +4288,7 @@ def setup_cookbook_routes() -> APIRouter:
                capture_cmd = None
            else:
                check_cmd = ["tmux", "has-session", "-t", session_id]
-                capture_cmd = ["tmux", "capture-pane", "-t", session_id, "-p", "-S", "-500"]
+                capture_cmd = ["tmux", "capture-pane", "-t", session_id, "-p", "-J", "-S", "-500"]
            local_win_task = (not remote) and IS_WINDOWS
@@ -16,6 +16,7 @@ from core.database import SessionLocal, Document, DocumentVersion
 from core.database import Session as DbSession
 from src.auth_helpers import get_current_user, _auth_disabled
 from src.constants import MAIL_ATTACHMENTS_DIR
 from src.session_search import _escape_like
 from src.upload_handler import reserve_upload_references
 logger = logging.getLogger(__name__)
@@ -571,9 +572,10 @@ def setup_document_routes(session_manager, upload_handler=None) -> APIRouter:
            # match docs containing both words regardless of position/order.
            if search:
                for tok in search.split():
-                    term = f"%{tok}%"
+                    term = f"%{_escape_like(tok)}%"
                    q = q.filter(
-                        Document.title.ilike(term) | Document.current_content.ilike(term)
+                        Document.title.ilike(term, escape="\\")
                        | Document.current_content.ilike(term, escape="\\")
                    )
            # Language filter. "pdf" is a display language derived from the
@@ -781,9 +783,11 @@ def setup_document_routes(session_manager, upload_handler=None) -> APIRouter:
        except Exception as e:
            logger.warning("Failed to parse export request body, defaulting to empty", exc_info=e)
            data = {}
-        ids = data.get("ids") or []
+        ids = data.get("ids") if isinstance(data, dict) else None
        if not ids:
            raise HTTPException(400, "No documents specified")
        if not isinstance(ids, list) or not all(isinstance(i, str) for i in ids):
            raise HTTPException(400, "ids must be a list of document ids")
        _ext = {
            "javascript": ".js", "python": ".py", "html": ".html", "css": ".css",
            "markdown": ".md", "json": ".json", "yaml": ".yml", "bash": ".sh",
@@ -810,10 +814,13 @@ def setup_document_routes(session_manager, upload_handler=None) -> APIRouter:
                    ext = _ext.get(doc.language or "text", ".txt")
                    base = (doc.title or "document").strip() or "document"
                    base = re.sub(r"[^\w\-. ]+", "", base)[:60].strip() or doc.id
-                    name = base if "." in base else base + ext
+                    has_ext = base.lower().endswith(ext)
                    stem = base[:-len(ext)] if has_ext else base
                    suffix = base[-len(ext):] if has_ext else ext
                    name = stem + suffix
                    i = 1
                    while name in used:
-                        name = f"{base}-{i}" + ("" if "." in base else ext)
+                        name = f"{stem}-{i}{suffix}"
                        i += 1
                    used.add(name)
                    content = doc.current_content or ""
@@ -19,9 +19,10 @@ def _split_family_token(token):
 def _derive_family(filename):
    """Derive a font-family name from a filename like 'JetBrainsMono-Regular.woff2' → 'JetBrains Mono'."""
    name = os.path.splitext(filename)[0]
-    # Strip common weight/style suffixes
+    # Strip weight/style suffixes, including BoldItalic and Bold-Italic.
    name = re.sub(
-        r'[-_ ]?(Thin|ExtraLight|UltraLight|Light|Regular|Medium|SemiBold|DemiBold|Bold|ExtraBold|UltraBold|Black|Heavy|Italic|Oblique|Variable|VF)$',
+        r'[-_ ]?(Thin|ExtraLight|UltraLight|Light|Regular|Medium|SemiBold|DemiBold|Bold|ExtraBold|UltraBold|Black|Heavy|Italic|Oblique|Variable|VF)'
        r'(?:[-_ ]?(?:Italic|Oblique))?$',
        '', name, flags=re.IGNORECASE
    )
    # Replace dashes/underscores with spaces
@@ -18,6 +18,7 @@ from fastapi import APIRouter, HTTPException, Query, Request
 from core.database import SessionLocal, GalleryImage, GalleryAlbum, ModelEndpoint
 from core.database import Session as DbSession
 from src.auth_helpers import get_current_user, owner_filter, require_privilege
 from src.session_search import escape_like_pattern
 from src.upload_limits import (
    read_upload_limited,
    GALLERY_UPLOAD_MAX_BYTES,
@@ -305,6 +306,23 @@ def _b64_bytes(value: str, *, label: str = "image") -> bytes:
        raise HTTPException(400, f"Invalid {label}") from exc
 async def _json_object(request: Request) -> dict:
    try:
        data = await request.json()
    except ValueError:
        raise HTTPException(400, "Invalid JSON body")
    if not isinstance(data, dict):
        raise HTTPException(400, "JSON object body required")
    return data
 async def _image_ids(request: Request) -> list:
    ids = (await _json_object(request)).get("image_ids", [])
    if not isinstance(ids, list) or not all(isinstance(i, str) for i in ids):
        raise HTTPException(400, "image_ids must be a list of image ids")
    return ids
 def _pil_image_to_b64(img, *, fmt: str = "PNG") -> str:
    buf = io.BytesIO()
    img.save(buf, format=fmt)
@@ -1184,15 +1202,18 @@ def setup_gallery_routes() -> APIRouter:
            )
            q = _owner_filter(q, user)
-            # Search filter (prompt + tags + ai_tags)
+            # Per-term AND search: a single `%foo bar%` LIKE only matched the
            # exact phrase, so "red car" missed "a car that is red".
            # LIKE wildcards are escaped per token.
            if search:
                term = f"%{search}%"
                from sqlalchemy import or_
-                q = q.filter(or_(
+                for tok in search.split():
-                    GalleryImage.prompt.ilike(term),
+                    term = f"%{escape_like_pattern(tok)}%"
-                    GalleryImage.tags.ilike(term),
+                    q = q.filter(or_(
-                    GalleryImage.ai_tags.ilike(term),
+                        GalleryImage.prompt.ilike(term, escape="\\"),
-                ))
+                        GalleryImage.tags.ilike(term, escape="\\"),
                        GalleryImage.ai_tags.ilike(term, escape="\\"),
                    ))
            # Tag filter. The UI stacks multiple tag pills by passing them
            # comma-separated — each tag adds a separate AND-filter so the
@@ -1203,9 +1224,10 @@ def setup_gallery_routes() -> APIRouter:
                for one in (t.strip() for t in tag.split(",")):
                    if not one:
                        continue
                    safe_tag = f"%{escape_like_pattern(one)}%"
                    q = q.filter(_or(
-                        GalleryImage.tags.ilike(f"%{one}%"),
+                        GalleryImage.tags.ilike(safe_tag, escape="\\"),
-                        GalleryImage.ai_tags.ilike(f"%{one}%"),
+                        GalleryImage.ai_tags.ilike(safe_tag, escape="\\"),
                    ))
            # Model filter
@@ -2433,11 +2455,10 @@ def setup_gallery_routes() -> APIRouter:
        image_b64 = body.get("image")
        amount = body.get("amount", 50) / 100.0
-        from PIL import Image, ImageFilter
+        from PIL import ImageFilter
        import base64, io
-        img_bytes = _b64_bytes(image_b64)
+        img = _b64_to_pil_image(image_b64, mode="RGB")
        img = Image.open(io.BytesIO(img_bytes)).convert("RGB")
        # Unsharp mask: radius=2, percent=amount*200, threshold=3
        sharpened = img.filter(ImageFilter.UnsharpMask(radius=2, percent=int(amount * 200), threshold=3))
@@ -2472,8 +2493,7 @@ def setup_gallery_routes() -> APIRouter:
        except ImportError:
            raise HTTPException(500, "Server missing a required dependency")
        # Decode source image (RGB; Real-ESRGAN doesn't preserve alpha).
-        img_bytes = _b64_bytes(image_b64)
+        src = _b64_to_pil_image(image_b64, mode="RGB")
        src = Image.open(io.BytesIO(img_bytes)).convert("RGB")
        try:
            patch_realesrgan_torchvision_compat()
            from realesrgan import RealESRGANer
@@ -2525,8 +2545,7 @@ def setup_gallery_routes() -> APIRouter:
            import numpy as np
        except ImportError:
            raise HTTPException(500, "Server missing a required dependency")
-        img_bytes = _b64_bytes(image_b64)
+        src = _b64_to_pil_image(image_b64, mode="RGB")
        src = Image.open(io.BytesIO(img_bytes)).convert("RGB")
        try:
            patch_realesrgan_torchvision_compat()
            from basicsr.archs.rrdbnet_arch import RRDBNet
@@ -2778,8 +2797,7 @@ def setup_gallery_routes() -> APIRouter:
        from PIL import Image
        import base64, io
-        img_bytes = _b64_bytes(image_b64)
+        img = _b64_to_pil_image(image_b64)
        img = Image.open(io.BytesIO(img_bytes)).convert("RGBA")
        W, H = img.size
        hint = None
@@ -2868,8 +2886,7 @@ def setup_gallery_routes() -> APIRouter:
        from PIL import Image, ImageFilter, ImageEnhance
        import numpy as np
-        img_bytes = _b64_bytes(image_b64)
+        img = _b64_to_pil_image(image_b64, mode="RGB")
        img = Image.open(io.BytesIO(img_bytes)).convert("RGB")
        # Try GFPGAN first (AI face restoration)
        try:
@@ -2944,14 +2961,22 @@ def setup_gallery_routes() -> APIRouter:
    @router.put("/api/gallery/albums/{album_id}")
    async def update_album(request: Request, album_id: str):
        user = get_current_user(request)
-        data = await request.json()
+        data = await _json_object(request)
        name = data.get("name")
        if name is not None:
            if not isinstance(name, str) or not name.strip():
                raise HTTPException(400, "Album name required")
            name = name.strip()
        description = data.get("description")
        if description is not None and not isinstance(description, str):
            raise HTTPException(400, "Album description must be a string")
        db = SessionLocal()
        try:
            album = _get_or_404_album(db, album_id, user)
-            if data.get("name") is not None:
+            if name is not None:
-                album.name = data["name"]
+                album.name = name
-            if data.get("description") is not None:
+            if description is not None:
-                album.description = data["description"]
+                album.description = description
            if data.get("cover_id") is not None:
                cover_id = data["cover_id"] or None
                if cover_id:
@@ -2981,8 +3006,7 @@ def setup_gallery_routes() -> APIRouter:
    @router.post("/api/gallery/albums/{album_id}/add")
    async def add_to_album(request: Request, album_id: str):
        user = get_current_user(request)
-        data = await request.json()
+        ids = await _image_ids(request)
        ids = data.get("image_ids", [])
        db = SessionLocal()
        try:
            _get_or_404_album(db, album_id, user)
@@ -2999,8 +3023,7 @@ def setup_gallery_routes() -> APIRouter:
    @router.post("/api/gallery/albums/{album_id}/remove")
    async def remove_from_album(request: Request, album_id: str):
        user = get_current_user(request)
-        data = await request.json()
+        ids = await _image_ids(request)
        ids = data.get("image_ids", [])
        db = SessionLocal()
        try:
            _get_or_404_album(db, album_id, user)
@@ -659,7 +659,7 @@ _NON_CHAT_CONTAINS = (
    "gliner", "riva", "-parse", "-embedqa", "-nemoretriever",
    "topic-control", "calibration",
    "ai-synthetic-video", "cosmos-reason2",
-    "bge", "llama-guard",
+    "bge", "llama-guard", "-embed", "rerank",
 )
 _NON_CHAT_EXACT_PREFIXES = (
    "gpt-audio",  # gpt-audio, gpt-audio-mini etc. (not gpt-4o-audio-preview which is chat)
@@ -2846,11 +2846,12 @@ def setup_model_routes(model_discovery):
                return {"endpoint_id": "", "endpoint_url": "", "model": ""}
            base = _normalize_base(ep.base_url)
            chat_url = build_chat_url(base)
            if model and not _is_chat_model(model):
                model = ""
            if not model and (getattr(ep, "cached_models", None) or getattr(ep, "pinned_models", None)):
                try:
                    visible = _visible_models(ep.cached_models, getattr(ep, "hidden_models", None), getattr(ep, "pinned_models", None))
-                    if visible:
+                    model = next((mid for mid in visible if _is_chat_model(mid)), "")
                        model = visible[0]
                except Exception:
                    pass
            return {"endpoint_id": ep.id, "endpoint_url": chat_url, "model": model}
@@ -728,32 +728,35 @@ def setup_note_routes(task_scheduler=None, upload_handler=None):
            )
            if body.title is not None:
                note.title = body.title
-            if body.content is not None:
+            # Omitted fields preserve their values; explicit null clears the
            # nullable fields used by the editor's removal controls.
            supplied = body.model_fields_set
            if "content" in supplied:
                note.content = body.content
-            if body.items is not None:
+            if "items" in supplied:
-                note.items = json.dumps(body.items)
+                note.items = json.dumps(body.items) if body.items is not None else None
                flag_modified(note, "items")
            if body.note_type is not None:
                note.note_type = body.note_type
-            if body.color is not None:
+            if "color" in supplied:
                note.color = body.color
-            if body.label is not None:
+            if "label" in supplied:
                note.label = body.label
            if body.pinned is not None:
                note.pinned = body.pinned
            if body.archived is not None:
                note.archived = body.archived
-            if body.due_date is not None:
+            if "due_date" in supplied:
                note.due_date = body.due_date
-            if body.image_url is not None:
+            if "image_url" in supplied:
                note.image_url = body.image_url
-            if body.gallery_id is not None:
+            if "gallery_id" in supplied:
                note.gallery_id = body.gallery_id
            if body.repeat is not None:
                note.repeat = body.repeat
            if body.sort_order is not None:
                note.sort_order = body.sort_order
-            if body.agent_session_id is not None:
+            if "agent_session_id" in supplied:
                note.agent_session_id = body.agent_session_id
            db.commit()
@@ -183,6 +183,7 @@ def _resolve_endpoint_runtime(ep, owner=None, model: Optional[str] = None):
    OAuth tokens in ProviderAuthSession, so ep.api_key is intentionally empty.
    """
    from src.endpoint_resolver import (
        _endpoint_enabled_models,
        build_chat_url,
        build_headers,
        resolve_endpoint_runtime as resolve_model_endpoint_runtime,
@@ -197,7 +198,7 @@ def _resolve_endpoint_runtime(ep, owner=None, model: Optional[str] = None):
    ep_model = (model or "").strip()
    if not ep_model:
        try:
-            models = json.loads(ep.cached_models) if ep.cached_models else []
+            models = _endpoint_enabled_models(ep)
            if models:
                ep_model = _first_chat_model(models)
        except Exception:
@@ -824,23 +825,13 @@ def setup_research_routes(research_handler, session_manager=None) -> APIRouter:
        if not ep_url or not ep_model:
            # Last resort: this user's enabled endpoint, plus legacy shared rows.
            from src.database import SessionLocal
            from src.endpoint_resolver import normalize_base, build_chat_url, build_headers
            db = SessionLocal()
            try:
                ep = _owned_enabled_endpoint(db, user)
                if ep:
-                    base = normalize_base(ep.base_url)
+                    resolved = _resolve_endpoint_runtime(ep, owner=user)
-                    fallback_url = build_chat_url(base)
+                    if resolved:
-                    fallback_headers = build_headers(ep.api_key, base)
+                        _merge(*resolved)
                    fallback_model = ""
                    if ep.cached_models:
                        try:
                            models = json.loads(ep.cached_models)
                            if models:
                                fallback_model = _first_chat_model(models)
                        except Exception:
                            pass
                    _merge(fallback_url, fallback_model, fallback_headers)
            finally:
                db.close()
@@ -1315,7 +1315,7 @@ def setup_session_routes(
    def auto_sort_sessions(request: Request, skip_llm: bool = False):
        """Use AI to categorize all sessions into folders.
-        Phase 1 deletes empty/throwaway sessions and Phase 2 asks the LLM
+        Phase 1 deletes empty/Incognito sessions and Phase 2 asks the LLM
        to assign folders. When `skip_llm=true` the endpoint returns
        after Phase 1 — used by the "Tidy (no AI)" UI affordance so
        users can clean junk without spending tokens.
@@ -1326,21 +1326,11 @@ def setup_session_routes(
        single_user_mode = not user and _auth_disabled()
        user_sessions = session_manager.get_sessions_for_user(user)
-        # Delete empty and throwaway sessions before sorting
+        # Saved conversations are never disposable based on their title or prompt.
        from core.database import ChatMessage as DbMsg
        db = SessionLocal()
        deleted_empty = 0
        deleted_throwaway = 0
        # Names that indicate a throwaway/test session (case-insensitive exact or prefix match)
        _THROWAWAY_NAMES = {
            "test", "testing", "asdf", "asd", "hello", "hi", "hey",
            "yo", "sup", "hola", "hii", "hiii", "heyo",
            "foo", "bar", "baz", "tmp", "temp", "scratch", "untitled",
            "new chat", "delete", "remove", "junk", "trash", "xxx",
            "abc", "qwerty", "blah", "stuff", "whatever", "idk",
            "ok", "lol", "bruh", "hmm", "hm", "meh",
        }
        _THROWAWAY_MAX_MESSAGES = 4  # only delete if <= this many messages
        try:
            rows_q = db.query(DbSession).filter(DbSession.archived == False)
            if user:
@@ -1349,15 +1339,11 @@ def setup_session_routes(
                rows_q = rows_q.filter(DbSession.owner == user)
            rows = rows_q.limit(2000).all()
            folder_map = {r.id: r.folder for r in rows}
-            # Precompute per-session message counts in TWO aggregate queries
+            # Precompute per-session message counts in one aggregate query
            # instead of 1–3 queries PER session — with many chats the per-row
            # loop was doing thousands of round-trips and blowing the timeout.
            from sqlalchemy import func as _sa_func
            _counts = dict(db.query(DbMsg.session_id, _sa_func.count(DbMsg.id)).group_by(DbMsg.session_id).all())
            _asst_counts = dict(
                db.query(DbMsg.session_id, _sa_func.count(DbMsg.id))
                .filter(DbMsg.role == "assistant").group_by(DbMsg.session_id).all()
            )
            cleanup_now = utcnow_naive()
            for row in rows:
                # Never delete important sessions
@@ -1367,9 +1353,10 @@ def setup_session_routes(
                if (row.name or "").strip() == "Incognito":
                    should_delete = True
                    deleted_throwaway += 1
                    db.delete(row)
                    if hasattr(session_manager, 'delete_session'):
                        session_manager.delete_session(row.id)
                    else:
                        db.delete(row)
                    continue
                if is_session_recently_active(row, now=cleanup_now):
                    continue
@@ -1378,31 +1365,11 @@ def setup_session_routes(
                if msg_count == 0:
                    should_delete = True
                    deleted_empty += 1
                elif msg_count <= _THROWAWAY_MAX_MESSAGES:
                    name = (row.name or "").strip().lower()
                    # Check first user message content (AI renames sessions, so
                    # "hi" becomes "Casual Greeting Exchange" — name alone won't match)
                    first_msg = db.query(DbMsg.content).filter(
                        DbMsg.session_id == row.id, DbMsg.role == "user"
                    ).order_by(DbMsg.timestamp).first()
                    first_text = (first_msg[0] or "").strip().lower() if first_msg else ""
                    # Count assistant messages — if user sent something but AI never replied, it's dead
                    assistant_count = _asst_counts.get(row.id, 0)
                    if name in _THROWAWAY_NAMES or name.startswith("chat:") or first_text in _THROWAWAY_NAMES:
                        should_delete = True
                        deleted_throwaway += 1
                    # Single user message with no AI response = dead session
                    elif msg_count == 1 and assistant_count == 0:
                        should_delete = True
                        deleted_throwaway += 1
                    # Short phrase (1-3 words) with no real AI conversation (<=2 msgs)
                    elif msg_count <= 2 and first_text and len(first_text.split()) <= 3 and len(first_text) <= 40:
                        should_delete = True
                        deleted_throwaway += 1
                if should_delete:
                    db.delete(row)
                    if hasattr(session_manager, 'delete_session'):
                        session_manager.delete_session(row.id)
                    else:
                        db.delete(row)
            if deleted_empty or deleted_throwaway:
                db.commit()
                logger.info(f"Auto-sort: deleted {deleted_empty} empty + {deleted_throwaway} throwaway sessions")
@@ -15,6 +15,7 @@ import httpx
 from fastapi import APIRouter, HTTPException, Request
 from pydantic import BaseModel, Field
 from services.memory.skill_format import slugify
 from services.memory.skills import SkillsManager
 from src.auth_helpers import get_current_user
 from services.skills import evaluation as _evaluation
@@ -836,6 +837,10 @@ def setup_skills_routes(skills_manager: SkillsManager) -> APIRouter:
        updates = body.dict(exclude_none=True)
        if not updates:
            return {"ok": True}
        if "name" in updates:
            new_name = slugify(updates["name"] or match.get("name"))
            if new_name != match.get("name") and skills_manager.has_skill(new_name, owner=user):
                raise HTTPException(409, f"A skill named '{new_name}' already exists")
        ok = skills_manager.update_skill(match.get("name"), updates, owner=user)
        if not ok:
            raise HTTPException(404, "Skill not found")
@@ -20,7 +20,7 @@ from src.task_action_policy import (
    is_admin_only_task_action,
    owner_has_admin_task_privileges,
 )
-from src.task_scheduler import compute_next_run, HOUSEKEEPING_DEFAULTS
+from src.task_scheduler import compute_next_run, is_valid_cron, HOUSEKEEPING_DEFAULTS
 from routes.prefs_routes import _load_for_user, _save_for_user
 logger = logging.getLogger(__name__)
@@ -289,15 +289,15 @@ def _resolve_run_endpoint(db, task: ScheduledTask, run: TaskRun) -> str:
    try:
        from core.database import ModelEndpoint
-        eps = db.query(ModelEndpoint).filter(ModelEndpoint.is_enabled == True).all()
+        from src.auth_helpers import owner_filter
        from src.endpoint_resolver import _endpoint_enabled_models
        eps = owner_filter(
            db.query(ModelEndpoint).filter(ModelEndpoint.is_enabled == True),
            ModelEndpoint, getattr(task, "owner", None),
        ).all()
        for ep in eps:
-            cached = []
+            if model in _endpoint_enabled_models(ep):
            if ep.cached_models:
                try:
                    cached = json.loads(ep.cached_models) or []
                except Exception:
                    cached = []
            if model in cached:
                return ep.base_url or ""
    except Exception:
        pass
@@ -475,10 +475,7 @@ def setup_task_routes(task_scheduler) -> APIRouter:
        if req.trigger_type == "schedule" and req.schedule == "cron" and not req.cron_expression:
            raise HTTPException(400, "Cron expression is required for cron schedule")
        if req.trigger_type == "schedule" and req.schedule == "cron" and req.cron_expression:
-            try:
+            if not is_valid_cron(req.cron_expression):
                from croniter import croniter
                croniter(req.cron_expression)
            except Exception:
                raise HTTPException(400, "Invalid cron expression")
        if req.trigger_type == "event" and not req.trigger_event:
            raise HTTPException(400, "Event name is required for event-triggered tasks")
@@ -788,10 +785,7 @@ def setup_task_routes(task_scheduler) -> APIRouter:
                task.character_id = req.character_id or None
            if req.cron_expression is not None:
                if req.cron_expression:
-                    try:
+                    if not is_valid_cron(req.cron_expression):
                        from croniter import croniter
                        croniter(req.cron_expression)
                    except Exception:
                        raise HTTPException(400, "Invalid cron expression")
                task.cron_expression = req.cron_expression or None
@@ -6,6 +6,7 @@ that are awkward at the shell). Filters images by tag, prompt, favorite,
 album, and surfaces EXIF metadata.
    odysseus-gallery list --limit 20 --favorites
    odysseus-gallery list --tag "sunset,beach"  # all tags, manual or AI
    odysseus-gallery show IMAGE_ID
    odysseus-gallery albums | jq -r '.[] | .name'
    odysseus-gallery search "sunset"          # matches prompt + tags
@@ -83,7 +84,13 @@ def cmd_list(args):
                fail(f"no album named {args.album!r}")
            q = q.filter(GalleryImage.album_id == al.id)
        if args.tag:
-            q = q.filter(GalleryImage.tags.ilike(f"%{args.tag}%"))
+            for tag in (value.strip() for value in args.tag.split(",")):
                if not tag:
                    continue
                q = q.filter(
                    GalleryImage.tags.ilike(f"%{tag}%") |
                    GalleryImage.ai_tags.ilike(f"%{tag}%")
                )
        q = q.order_by(GalleryImage.created_at.desc()).limit(args.limit)
        emit([_serialize_image(i) for i in q.all()], args)
    finally:
@@ -159,7 +166,7 @@ def _build_parser():
    pl.add_argument("--limit", type=int, default=50)
    pl.add_argument("--favorites", action="store_true")
    pl.add_argument("--album", help="filter by album name")
-    pl.add_argument("--tag", help="substring match against tags column")
+    pl.add_argument("--tag", help="comma-separated tags; each matches manual or AI tags by substring")
    pl.set_defaults(func=cmd_list)
    psh = sub.add_parser("show", parents=[common])
@@ -43,7 +43,7 @@ import logging
 import os
 import re
 import sys
-from datetime import datetime
+from datetime import datetime, timezone
 from pathlib import Path
 # Anchor the path so the script works when invoked from anywhere.
@@ -136,7 +136,7 @@ def cmd_list(args) -> None:
            emit([], args)
            return
        all_uids = data[0].split()
-        # Newest first, limit
+        # Keep a bounded arrival batch; order its decoded rows by Date below.
        uids = list(reversed(all_uids))[: args.limit]
        out = []
        for uid in uids:
@@ -165,10 +165,15 @@ def cmd_list(args) -> None:
                sender_name, sender_addr = parseaddr(sender)
                date_raw = msg.get("Date", "")
                try:
-                    iso = parsedate_to_datetime(date_raw).isoformat() if date_raw else ""
+                    parsed_date = parsedate_to_datetime(date_raw) if date_raw else None
                    iso = parsed_date.isoformat() if parsed_date else ""
                    if parsed_date is not None and parsed_date.tzinfo is None:
                        parsed_date = parsed_date.replace(tzinfo=timezone.utc)
                    date_epoch = parsed_date.timestamp() if parsed_date else float("-inf")
                except Exception:
                    iso = ""
-                out.append({
+                    date_epoch = float("-inf")
                out.append((date_epoch, {
                    "uid": uid.decode(),
                    "date": iso,
                    "from_addr": sender_addr,
@@ -176,10 +181,11 @@ def cmd_list(args) -> None:
                    "subject": subject,
                    "is_read": "\\Seen" in flags,
                    "is_answered": "\\Answered" in flags,
-                })
+                }))
            except Exception as e:
                sys.stderr.write(f"warn: skipping uid {uid!r}: {e}\n")
-        emit(out, args)
+        out.sort(key=lambda item: item[0], reverse=True)
        emit([row for _, row in out], args)
 # ─── read ────────────────────────────────────────────────────────────
@@ -11,6 +11,38 @@ import time
 from urllib.request import urlopen
 ROOT = Path(__file__).resolve().parents[1]
 if str(ROOT) not in sys.path:
    sys.path.insert(0, str(ROOT))
 def _stop_owned_server(server, identity):
    """Close only identity-bound descendants, including MCP's new sessions.
    Capture before signalling the parent: an orphaned stderr holder can no
    longer be attributed by ancestry. Never search by executable name or kill
    the caller's process group.
    """
    from src import process_lifecycle as lifecycle
    descendants = (lifecycle.bind_descendants([identity.pid])
                   if identity.verdict() == lifecycle.OWNED else [])
    if os.name == "nt":
        if identity.verdict() == lifecycle.OWNED:
            lifecycle.taskkill_tree(identity.pid)
    else:
        outcome = lifecycle.terminate_identities(
            [*(entry.identity for entry in reversed(descendants)), identity],
            steps=lifecycle.term_kill_steps(10),
        )
        if outcome.survivors or outcome.unverified:
            raise RuntimeError(f"Disposable Notes cleanup could not verify exit: {outcome}")
    try:
        logs, _ = server.communicate(timeout=2)
    except subprocess.TimeoutExpired as error:
        # Do not turn an unidentified pipe holder into an unbounded wait.
        server.stdout.close()
        raise RuntimeError("Disposable Notes output pipe remained open after owned cleanup") from error
    return logs
 def main():
@@ -36,7 +68,10 @@ def main():
        server = subprocess.Popen(
            [sys.executable, "-m", "uvicorn", "app:app", "--host", "127.0.0.1", "--port", str(port)],
            cwd=target, env=env, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True,
            start_new_session=(os.name != "nt"),
        )
        from src.process_lifecycle import ProcessIdentity
        server_identity = ProcessIdentity.capture(server.pid)
        result = None
        try:
            origin = f"http://127.0.0.1:{port}"
@@ -62,12 +97,7 @@ def main():
                print(result.stderr, file=sys.stderr)
            return result.returncode
        finally:
-            server.terminate()
+            logs = _stop_owned_server(server, server_identity)
            try:
                logs, _ = server.communicate(timeout=10)
            except subprocess.TimeoutExpired:
                server.kill()
                logs, _ = server.communicate()
            if result is None or result.returncode:
                print(logs[-8000:], file=sys.stderr)
@@ -202,17 +202,35 @@ def _infer_use_case(repo_id, pipeline_tag):
    return "general"
 # HF collections mix in models no Cookbook LLM backend can serve (vision
 # encoders, time-series forecasters, image/video generators). Image models
 # have their own registry, so keep these out of the LLM catalog.
 _NON_LLM_PIPELINE_TAGS = frozenset({
    "time-series-forecasting",
    "zero-shot-image-classification",
    "image-classification",
    "image-feature-extraction",
    "text-to-image",
    "image-to-video",
    "text-to-video",
 })
 def _entry_from_collection_item(collection, item, source):
    repo_id = item.get("id") or ""
    if item.get("type") != "model" or not repo_id:
        return None
    if (item.get("pipeline_tag") or "").strip().lower() in _NON_LLM_PIPELINE_TAGS:
        return None
    repo_prefix = source.get("repo_prefix")
    if repo_prefix and not repo_id.startswith(repo_prefix):
        return None
    raw_params = item.get("numParameters") or 0
-    active = None
+    # Read the name even when HF gives a total: it is the only source of the
    # MoE active size (e.g. "-35B-A3B"), which the speed estimate depends on.
    name_params, active = _parse_params_from_name(repo_id)
    if not raw_params:
-        raw_params, active = _parse_params_from_name(repo_id)
+        raw_params = name_params
    param_label, raw_params = _format_params(raw_params)
    if not raw_params:
        return None
@@ -84,10 +84,14 @@ _FM_KEY_RE = re.compile(r"^([a-z_][a-z0-9_]*):\s*(.*)$", re.IGNORECASE)
 _FM_BLOCK_LIST_RE = re.compile(r"^\s*-\s*(.*)$")
-def _parse_scalar(raw: str) -> Any:
+def _parse_scalar(raw: str, *, string_only: bool = False) -> Any:
    raw = raw.strip()
    if raw == "":
        return ""
    # String fields keep their spelling; quoted values still use the decoder
    # below so existing escapes round-trip as before.
    if string_only and not (raw[0] == raw[-1] and raw[0] in ("'", '"')):
        return raw
    if raw.startswith("[") and raw.endswith("]"):
        inner = raw[1:-1].strip()
        if not inner:
@@ -126,10 +130,15 @@ def _parse_scalar(raw: str) -> Any:
 def _split_top_level(s: str, sep: str) -> List[str]:
    """Split `s` on `sep` ignoring separators inside [] or quotes."""
    out, buf, depth, quote = [], [], 0, None
    escaped = False
    for ch in s:
        if quote:
            buf.append(ch)
-            if ch == quote:
+            if escaped:
                escaped = False
            elif ch == "\\" and quote == '"':
                escaped = True
            elif ch == quote:
                quote = None
            continue
        if ch in ("'", '"'):
@@ -171,7 +180,7 @@ def parse_frontmatter(text: str) -> tuple[Dict[str, Any], str]:
                pending_key = key
                fm[key] = []
            else:
-                fm[key] = _parse_scalar(val)
+                fm[key] = _parse_scalar(val, string_only=(key == "version"))
                pending_key = None
            continue
        m2 = _FM_BLOCK_LIST_RE.match(line)
@@ -500,6 +500,19 @@ class SkillsManager:
        sk.path = self._skill_file(cat, nm)
        return sk.to_dict()
    def has_skill(self, name: str, owner: Optional[str] = None) -> bool:
        """Whether `owner` already has a skill called `name`, in any category.
        Update and delete find a skill by name within its owner, so two of
        one owner's skills sharing a name would make them act on whichever
        file is walked first.
        """
        for path in self._iter_skill_files():
            sk = self._read_skill(path)
            if sk and sk.name == name and (sk.owner or "") == (owner or ""):
                return True
        return False
    def update_skill(self, skill_id: str, updates: Dict, owner: Optional[str] = None) -> bool:
        """`skill_id` is the slug name. Allows updating any field plus
        renames if `name` changes (file is moved on disk).
@@ -551,6 +564,9 @@ class SkillsManager:
            # Rename
            new_name = slugify(updates.get("name") or sk.name)
            if new_name != sk.name:
                if self.has_skill(new_name, owner=owner):
                    logger.warning(f"Skill rename target name in use: {new_name}")
                    return False
                sk.name = new_name
            # Write to potentially new path
@@ -24193,11 +24193,14 @@ async def stream_agent_loop(
                budget_is_explicit,
                hard_max=hard_max,
            )
-            if candidate_context <= 8192:
+            if 0 < candidate_context <= 8192:
                # Small local servers often tokenize chat wrappers and tool
                # results much more generously than our rough estimator. Keep
                # substantial headroom for those wrappers and generation so a
                # follow-up tool round cannot exceed the server's n_ctx.
                # 0 means the window is unknown, which already gets the
                # conservative default budget; clamping it as well cut every
                # request to 1200 tokens and dropped open documents (#6678).
                effective_budget = min(
                    effective_budget,
                    max(1200, int(candidate_context * 0.40)),
@@ -27833,16 +27836,25 @@ async def stream_agent_loop(
                                if _streamed_tool_markup or _streamed_tool_markup_starts(_delta_text):
                                    _streamed_tool_markup += _delta_text
                                    if not _streamed_tool_markup_complete(_streamed_tool_markup):
-                                        continue
+                                        if _streamed_tool_markup_starts(_streamed_tool_markup):
-                                    _visible_markup_tail = strip_tool_blocks(
+                                            continue
-                                        _streamed_tool_markup,
+                                        # False alarm: a bare "<" (e.g. ``x < 2``) looked like
-                                        skip_fenced=True,
+                                        # a tag prefix, but the buffer can no longer become a
-                                    ).strip()
+                                        # tool tag. Release it as prose instead of holding the
-                                    _streamed_tool_markup = ""
+                                        # rest of the answer forever.
-                                    if not _visible_markup_tail:
+                                        _delta_text = _streamed_tool_markup
-                                        continue
+                                        _streamed_tool_markup = ""
-                                    _delta_text = _visible_markup_tail
+                                        data["delta"] = _delta_text
-                                    data["delta"] = _delta_text
+                                    else:
                                        _visible_markup_tail = strip_tool_blocks(
                                            _streamed_tool_markup,
                                            skip_fenced=True,
                                        ).strip()
                                        _streamed_tool_markup = ""
                                        if not _visible_markup_tail:
                                            continue
                                        _delta_text = _visible_markup_tail
                                        data["delta"] = _delta_text
                            full_response += _delta_text
                        if not _suppress_unavailable_web_delta:
                            _qwen_buffered_route = bool(
@@ -1207,7 +1207,7 @@ async def do_generate_image(content: str, session_id: Optional[str] = None, owne
      Line 1: prompt describing the image
      Line 2: model name (optional, default auto-detects: prefers gpt-image-1.5 > gpt-image-1)
      Line 3: size (optional, defaults to 1024x1024)
-      Line 4: quality (optional, defaults to medium — options: low, medium, high, auto)
+      Line 4: quality (optional, defaults to configured quality or medium — low, medium, high, auto)
    """
    import base64
    import httpx
@@ -1225,13 +1225,13 @@ async def do_generate_image(content: str, session_id: Optional[str] = None, owne
        prompt = str(args.get('prompt') or '').strip()
        model_spec = str(args.get('model') or '').strip()
        size = str(args.get('size') or '1024x1024')
-        quality = str(args.get('quality') or 'medium')
+        quality = str(args.get('quality') or '')
    else:
        lines = content.strip().split("\n")
        prompt = lines[0].strip() if lines else ""
        model_spec = lines[1].strip() if len(lines) > 1 and lines[1].strip() else ""
        size = lines[2].strip() if len(lines) > 2 and lines[2].strip() else "1024x1024"
-        quality = lines[3].strip() if len(lines) > 3 and lines[3].strip() else "medium"
+        quality = lines[3].strip() if len(lines) > 3 and lines[3].strip() else ""
    if not prompt:
        return {"error": "Image prompt is required (line 1)"}
@@ -1249,8 +1249,8 @@ async def do_generate_image(content: str, session_id: Optional[str] = None, owne
    # Use admin-configured model/quality if not specified by the tool call
    if not model_spec:
        model_spec = _settings.get("image_model", "")
-    if quality == "medium" and _settings.get("image_quality"):
+    if not quality:
-        quality = _settings["image_quality"]
+        quality = _settings.get("image_quality") or "medium"
    # Auto-detect best available image model if still not set
    if not model_spec:
@@ -1482,7 +1482,7 @@ async def do_edit_image(
    session_id: Optional[str] = None,
    owner: Optional[str] = None,
    size: str = "auto",
-    quality: str = "medium",
+    quality: Optional[str] = None,
    progress_callback: Optional[Callable[[Dict[str, Any]], Awaitable[None]]] = None,
    incognito: bool = False,
 ) -> Dict:
@@ -1509,8 +1509,8 @@ async def do_edit_image(
    if not model_spec:
        model_spec = _settings.get("image_model", "")
-    if quality == "medium" and _settings.get("image_quality"):
+    if quality is None:
-        quality = _settings["image_quality"]
+        quality = _settings.get("image_quality") or "medium"
    if not model_spec:
        return {"error": "No image model selected for image editing"}
@@ -25,7 +25,7 @@ def compact_browser_observation(value, budget=8000):
                # Snapshot text already contains labels and refs in DOM order.
                # The refs mapping repeats them and buries menus in raw JSON.
                lines = [line for line in snapshot.splitlines()
-                         if not re.fullmatch(r'\s*-?\s*generic(?:\s+\[ref=e\d+\])?:?\s*', line)]
+                         if not re.fullmatch(r'\s*(?:-\s*)?generic(?:\s+\[ref=e\d+\])?:?\s*', line)]
                pages.append(('URL: ' + str(url) + '\n' if url else '') + '\n'.join(lines))
            elif url:
                notices.append('URL: ' + str(url))
@@ -37,7 +37,8 @@ def compact_browser_observation(value, budget=8000):
                parsed = json.loads(item)
            except (ValueError, TypeError):
                # CLI status text precedes the JSON post-interaction state.
-                parts = re.split(r'\n\n\[(?:post-[^\]]+|page state after failed [^\]]+)\]\n', item)
+                # Labels are one line; stopping at \n keeps the split linear.
                parts = re.split(r'\n\n\[(?:post-[^\]\n]+|page state after failed [^\]\n]+)\]\n', item)
                if len(parts) > 1:
                    for part in parts:
                        visit(part)
@@ -10,7 +10,7 @@ import os
 import json
 import re
 import time
-from datetime import datetime
+from datetime import datetime, timezone
 from typing import Tuple
 from src.auth_helpers import owner_filter
@@ -1957,6 +1957,23 @@ async def action_learn_sender_signatures(owner: str, **kwargs) -> Tuple[str, boo
        return str(e), False
 def _daily_brief_utc_boundary(local_dt, tz=None):
    """Convert a local wall-clock boundary using the offset at that boundary."""
    if local_dt.tzinfo is None and tz is not None:
        local_dt = local_dt.replace(tzinfo=tz)
    return local_dt.astimezone(timezone.utc).replace(tzinfo=None)
 def _daily_brief_local_start(event, tz=None):
    """Keep date-only/floating rows local; convert only stored UTC instants."""
    start = event.dtstart
    if event.is_utc and not event.all_day:
        if start.tzinfo is None:
            start = start.replace(tzinfo=timezone.utc)
        return start.astimezone(tz).replace(tzinfo=None)
    return start
 async def action_daily_brief(owner: str, **kwargs) -> Tuple[str, bool]:
    """Build a short morning digest: today's calendar events, unread email count
    + top-N senders/subjects, active todos."""
@@ -1966,10 +1983,13 @@ async def action_daily_brief(owner: str, **kwargs) -> Tuple[str, bool]:
        from core.database import SessionLocal, CalendarEvent, CalendarCal, Note
        from routes.email_helpers import _imap_connect, _decode_header
        from sqlalchemy import and_, or_
        # ----- Calendar: today's events -----
        today = _dt.now().replace(hour=0, minute=0, second=0, microsecond=0)
        tomorrow = today + _td(days=1)
        utc_today = _daily_brief_utc_boundary(today)
        utc_tomorrow = _daily_brief_utc_boundary(tomorrow)
        # v2 review HIGH-12: gate the OR-null branch on single-user
        # (unconfigured) deploys only. In a multi-user deploy, one
        # user's daily brief must not include another user's notes or
@@ -1982,13 +2002,25 @@ async def action_daily_brief(owner: str, **kwargs) -> Tuple[str, bool]:
        db = SessionLocal()
        try:
            ev_q = db.query(CalendarEvent).join(CalendarCal).filter(
-                CalendarEvent.dtstart < tomorrow,
+                or_(
-                CalendarEvent.dtend > today,
+                    and_(
                        CalendarEvent.is_utc.is_(True),
                        CalendarEvent.all_day.is_not(True),
                        CalendarEvent.dtstart < utc_tomorrow,
                        CalendarEvent.dtend > utc_today,
                    ),
                    and_(
                        or_(CalendarEvent.is_utc.is_not(True), CalendarEvent.all_day.is_(True)),
                        CalendarEvent.dtstart < tomorrow,
                        CalendarEvent.dtend > today,
                    ),
                ),
                CalendarEvent.status != "cancelled",
            )
            if owner:
                ev_q = owner_filter(ev_q, CalendarCal, owner, include_shared=_allow_null)
-            events = ev_q.order_by(CalendarEvent.dtstart).all()
+            events = ev_q.all()
            events.sort(key=_daily_brief_local_start)
            # ----- Notes: pinned + non-archived todos with at least one undone item -----
            n_q = db.query(Note).filter(Note.archived == False)  # noqa: E712
            if owner:
@@ -2058,7 +2090,7 @@ async def action_daily_brief(owner: str, **kwargs) -> Tuple[str, bool]:
        if events:
            plain.append("Calendar:")
            for e in events:
-                t = e.dtstart.strftime("%H:%M") if not e.all_day else "all day"
+                t = _daily_brief_local_start(e).strftime("%H:%M") if not e.all_day else "all day"
                loc = f" @ {e.location}" if e.location else ""
                plain.append(f"  {t}  {e.summary}{loc}")
            plain.append("")
@@ -282,7 +282,13 @@ class ChatHandler:
                                    _sync_upload_vision_to_gallery(file_info, owner, vl_desc)
                                except Exception:
                                    pass
-                        enhanced_message = f"{enhanced_message}\n\n[Image: {file_info['name']}]\n{vl_desc}"
+                        enhanced_message = f"{enhanced_message}\n\n[Image: {file_info['name']}]\n"
                        if vl_desc:
                            # A separate vision call wrote this, but the chat model sees
                            # one message and answers the prose as if the user wrote it
                            # (#5573). Label it below the marker line — the client strips
                            # the block by matching `[Image: <name>]\n`.
                            enhanced_message += f"[Image description — context only, not part of the user's message]:\n{vl_desc}"
                        # Surface the description to the client live so it renders as a
                        # collapsible "image description" on the user bubble (not just
                        # after a refresh that re-parses the stored message).
@@ -1229,7 +1229,7 @@ def tasks_terminal_response(raw, *, user_text='', max_items=20):
    text = str(payload or '').strip()
    rows = []
    for line in text.splitlines():
-        match = re.match(r'^\s*\d+\.\s+(.*?)\s+\(([^)]+)\)\s+—\s+(.+)$', line)
+        match = re.match(r'^\s*\d+\.\s(.*?)\s\(([^()]+)\)\s+—\s+(.+)$', line)
        if match:
            details = match[3].strip()
            rows.append({
@@ -1346,7 +1346,7 @@ def skills_terminal_response(raw, *, user_text='', max_items=20):
            continue
        match = re.match(r'^\s*-\s+\*\*([^*]+)\*\*(?:\s+\(([^)]+)\))?', line)
        if not match:
-            match = re.match(r'^\s*-\s+([^:]+?)(?:\s+\(([^)]+)\))?(?:\s*:|$)', line)
+            match = re.match(r'^\s*-\s+([^\s:][^:]*?)(?:\s\(([^()]+)\)(?:\s*:|$)|:|$)', line)
        if match and status:
            rows.append((status, match.group(1).strip(), (match.group(2) or '').strip()))
    if not rows:
@@ -5065,7 +5065,7 @@ def email_search_result_empty(value):
        try:
            decoded = json.loads(value)
        except (TypeError, ValueError):
-            return bool(re.fullmatch(r'\s*No emails matched [^\n]+\.?\s*', value, re.I))
+            return bool(re.fullmatch(r'\s*No emails matched [^\n]+(?:\n\s*)?', value, re.I))
        if decoded == value:
            return False
        value = decoded
@@ -5339,6 +5339,16 @@ def private_browser_effective_url(result):
    return urls[-1] if urls else ''
 def is_google_sorry_url(url):
    """Recognize Google's rate-limit interstitial."""
    # Matching the host separately keeps this linear; one combined pattern
    # rescans the host from every dot.
    return any(
        re.fullmatch(r'(?:[^/]+\.)?google\.[^/]+', host[1], re.I)
        for host in re.finditer(r'https?://([^/]+)/sorry/', url, re.I)
    )
 def browser_observation_page_missing(raw):
    """Recognize a rendered error page, rather than an article mentioning 404."""
    text = str(raw or '')
@@ -8213,11 +8223,7 @@ async def stream_preview(*, endpoint_url, model, messages, headers, turn_contrac
                        browser_search_url = requested_browser_url or effective_browser_url
                        is_search_engine_navigation = contains_search_engine_navigation(
                            browser_search_url
-                        ) or bool(re.search(
+                        ) or is_google_sorry_url(effective_browser_url)
                            r'https?://(?:[^/]+\.)?google\.[^/]+/sorry/',
                            effective_browser_url,
                            re.I,
                        ))
                        has_native_search = any(
                            canonical(schema['function']['name']) == 'web_search'
                            for schema in offered
@@ -142,7 +142,10 @@ def _process_pdf(
                        with tempfile.NamedTemporaryFile(suffix=".png", delete=False) as tmp:
                            temp_img_path = tmp.name
                        try:
-                            img.image.save(temp_img_path, "PNG")  # pypdf -> PIL image
+                            image = img.image
                            if image.mode == "CMYK":
                                image = image.convert("RGB")
                            image.save(temp_img_path, "PNG")
                            ocr_text = analyze_image_with_vl(temp_img_path, owner=owner)
                            if ocr_text and "unavailable" not in ocr_text.lower():
                                pdf_text += f"\n\n[Page {page_num + 1} image {img_index + 1} text]: {ocr_text}"
@@ -422,7 +422,18 @@ def _stream_delta_event(text: str, *, thinking: bool = False) -> str:
    return f"data: {json.dumps(payload)}\n\n"
-_DEGENERATE_WORD_RE = re.compile(r"[A-Za-z0-9_\u0370-\u03ff\u0400-\u04ff]+")
+_WORD_CHARS = r"A-Za-z0-9_\u0370-\u03ff\u0400-\u04ff"
 _DELIM_RE = re.compile(rf"[^{_WORD_CHARS}+\-.]")
 _NUMERIC_PATTERN = rf"(?<![{_WORD_CHARS}])[+-]?(?:[0-9]+\.[0-9]+|\.[0-9]+|[0-9]+)(?:[eE][+-]?[0-9]+)?(?![{_WORD_CHARS}])"
 _NUMERIC_FULLMATCH_RE = re.compile(rf"^[+-]?(?:[0-9]+\.[0-9]+|\.[0-9]+|[0-9]+)(?:[eE][+-]?[0-9]+)?$")
 _DEGENERATE_WORD_RE = re.compile(rf"[{_WORD_CHARS}]+")
 _TOKEN_RE = re.compile(rf"(?P<NUM>{_NUMERIC_PATTERN})|(?P<WORD>[{_WORD_CHARS}]+)")
 def _is_numeric_token(token: str) -> bool:
    if token.isdigit():
        return True
    return _NUMERIC_FULLMATCH_RE.fullmatch(token) is not None
 class _DegenerateStreamGuard:
@@ -432,32 +443,50 @@ class _DegenerateStreamGuard:
    "Summer Summer ..."). This is not a useful response and can burn context,
    browser memory, and GPU time. Keep the guard conservative: only fire on long
    same-token runs or a very dominant repeated token in the recent window.
    Repetition made only of numbers is data (a zero or identity matrix, a
    padded buffer), so it only stops at a long all-numeric backstop.
    """
    def __init__(self, model: str):
        self.model = model or "model"
        self.last_token = ""
        self.same_run = 0
        self.numeric_run = 0
        self.recent_tokens: List[str] = []
        self.periodic_tokens: List[str] = []
        self.total_chars = 0
        self._buffer = ""
    def check(self, text: str) -> Optional[str]:
        if not text:
            return None
        self.total_chars += len(text)
-        # Keep one-character tokens. Structured output often varies through
+        self._buffer += text
-        # numeric selectors or coordinates; dropping those tokens can make
+
-        # valid CSS/SVG rows look like an exact repeated phrase.
+        m_delims = list(_DELIM_RE.finditer(self._buffer))
-        tokens = [t.lower() for t in _DEGENERATE_WORD_RE.findall(text)]
+        if m_delims:
            split_idx = m_delims[-1].end()
            head = self._buffer[:split_idx]
            self._buffer = self._buffer[split_idx:]
        elif len(self._buffer) >= 256:
            head = self._buffer
            self._buffer = ""
        else:
            return None
        tokens = []
        for m in _TOKEN_RE.finditer(head):
            tokens.append((m.group(0).lower(), m.lastgroup == "NUM"))
        if not tokens:
            return None
-        for token in tokens:
+
        for token, is_num in tokens:
            if token == self.last_token:
                self.same_run += 1
            else:
                self.last_token = token
                self.same_run = 1
            self.numeric_run = self.numeric_run + 1 if is_num else 0
            self.recent_tokens.append(token)
            self.periodic_tokens.append(token)
        if len(self.recent_tokens) > 96:
@@ -466,14 +495,20 @@ class _DegenerateStreamGuard:
            self.periodic_tokens = self.periodic_tokens[-2048:]
        reason = None
-        if self.same_run >= 28 and self.total_chars >= 100:
+        if self.same_run >= 28 and self.total_chars >= 100 and not _is_numeric_token(self.last_token):
            reason = f"repeated '{self.last_token}' {self.same_run} times"
        elif len(self.recent_tokens) >= 72:
            top = max(set(self.recent_tokens), key=self.recent_tokens.count)
            count = self.recent_tokens.count(top)
-            if count >= 60 and count / max(len(self.recent_tokens), 1) >= 0.78:
+            if count >= 60 and count / max(len(self.recent_tokens), 1) >= 0.78 and not _is_numeric_token(top):
                reason = f"repeated '{top}' {count}/{len(self.recent_tokens)} recent tokens"
-        if not reason and len(self.recent_tokens) >= 48:
+        if (
            not reason
            and len(self.recent_tokens) >= 48
            # A window that is mostly numbers is matrix/table data; its
            # periodicity is real. Mixed loops still hit the exact-block check.
            and sum(_is_numeric_token(t) for t in self.recent_tokens) * 2 < len(self.recent_tokens)
        ):
            # Detect a periodic suffix instead of counting repeated n-grams.
            # Reused property names are normal in CSS/SVG/JSON; a collapsed
            # generation repeats nearly every token at a short fixed period.
@@ -508,12 +543,15 @@ class _DegenerateStreamGuard:
                if history[previous:previous + anchor_size] != anchor:
                    continue
                period = current_anchor - previous
-                if period < 24 or len(history) < period * 2:
+                if period < 24 or len(history) < period * 2 or self.numeric_run >= period:
                    continue
-                if history[-2 * period:-period] == history[-period:]:
+                if history[-2 * period:-period] == history[-period:] and not all(_is_numeric_token(t) for t in history[-period:]):
                    reason = f"repeated an exact {period}-token block twice"
                    break
        if not reason and self.numeric_run >= 2048:
            reason = f"emitted {self.numeric_run} numbers in a row"
        if not reason:
            return None
@@ -10,6 +10,7 @@ import logging
 import os
 import re
 import asyncio 
 import contextlib
 from typing import Any, Dict, List, Optional, Set, Tuple
 from src.database import McpServer, SessionLocal
@@ -383,12 +384,21 @@ class McpManager:
            provider = build_provider(server_id, url, on_redirect=_on_redirect)
            stack = AsyncExitStack()
-            transport = await stack.enter_async_context(streamablehttp_client(url, auth=provider))
+            try:
-            read_stream, write_stream, _get_session_id = transport
+                transport = await stack.enter_async_context(streamablehttp_client(url, auth=provider))
-            session = await stack.enter_async_context(ClientSession(read_stream, write_stream))
+                read_stream, write_stream, _get_session_id = transport
-            await session.initialize()
+                session = await stack.enter_async_context(ClientSession(read_stream, write_stream))
                await session.initialize()
-            tools_result = await session.list_tools()
+                tools_result = await session.list_tools()
            except BaseException:
                # Close the half-open transport here, in the task that entered
                # it. Left for the garbage collector, its AnyIO cancel scope is
                # exited from the wrong task and the event loop keeps spinning
                # (#5518). Its own teardown error would only mask the real one.
                with contextlib.suppress(Exception):
                    await stack.aclose()
                raise
            tools = []
            for tool in tools_result.tools:
                tools.append({
@@ -193,7 +193,10 @@ class ModelDiscovery:
            data = r.json()
            # Some OpenAI-compatible servers return a bare list, not {"data": [...]}.
            items = data if isinstance(data, list) else ((data or {}).get("data") or [])
-            ids = [m.get("id") for m in items if isinstance(m, dict) and m.get("id")]
+            ids = [
                m["id"] for m in items
                if isinstance(m, dict) and isinstance(m.get("id"), str) and m["id"]
            ]
            if ids:
                return {
                    "host": host,
@@ -102,8 +102,10 @@ _PLAIN_FRONT_MATTER_RE = re.compile(
 #   - **label:** value <!-- field=NAME-ENC type=text -->
 #   - **label** [opts]: value <!-- field=NAME-ENC type=choice -->
 #   - [x] **label** <!-- field=NAME-ENC type=checkbox -->
 # Accept Unicode word characters for older saved markers, whose encoder left
 # non-ASCII letters/numbers literal. Newly rendered names are ASCII-safe.
 _FIELD_BULLET_RE = re.compile(
-    r'^\s*-\s+(?P<body>.*?)\s*<!--\s*field=(?P<name>[A-Za-z0-9_.%-]+)\s+type=(?P<type>\w+)\s*-->\s*$'
+    r'^\s*-\s+(?P<body>.*?)\s*<!--\s*field=(?P<name>[\w.%-]+)\s+type=(?P<type>\w+)\s*-->\s*$'
 )
@@ -115,7 +117,7 @@ def _encode_name(name: str) -> str:
    """
    out = []
    for ch in name or "":
-        if ch.isalnum() or ch in ("_", ".", "-"):
+        if (ch.isascii() and ch.isalnum()) or ch in ("_", ".", "-"):
            out.append(ch)
        else:
            for b in ch.encode("utf-8"):
@@ -76,9 +76,23 @@ _ERROR_DETAIL = {
    "auth_or_protocol_error": "authentication or protocol error",
    "no_models": "endpoint returned no models",
    "no_host": "no host configured",
    "config_source_error": "configuration source could not be read",
    "error": "probe failed",
 }
 # Config/inventory source behind each network subsystem. `_gather_inputs()`
 # fails soft, so a source that could not be read hands its probe an empty
 # inventory — indistinguishable from "nothing configured", which every probe
 # answers with `disabled`. The collector therefore reports the source failure
 # instead of running a probe whose verdict would be a lie.
 CONFIG_SOURCE_ERROR = "config_source_error"
 _SUBSYSTEM_SOURCE = {
    "searxng": "settings",
    "ntfy": "integrations",
    "email": "accounts",
    "providers": "endpoints",
 }
 def _svc(name: str, status: str, detail: str, **meta: Any) -> Dict[str, Any]:
    return {"name": name, "status": status, "detail": detail, "meta": dict(meta)}
@@ -411,26 +425,33 @@ def _gather_inputs() -> Dict[str, Any]:
    """Pull live config/account/endpoint lists from the app's data sources.
    Each lookup fails soft: a broken source yields an empty/neutral value so a
-    single failure can't take down the whole health report.
+    single failure can't take down the whole health report. The failure is also
    *recorded* under `failed` (source -> controlled category), because the empty
    value alone cannot be told apart from a source that loaded and is genuinely
    empty — and the probes read empty as `disabled`.
    """
    settings: Dict[str, Any] = {}
    integrations: List[Dict[str, Any]] = []
    accounts: List[Dict[str, Any]] = []
    endpoints: List[Dict[str, Any]] = []
    failed: Dict[str, str] = {}
    try:
        from src.settings import load_settings
        settings = load_settings() or {}
    except Exception as e:
        failed["settings"] = _classify_error(e)
        logger.debug(f"service_health: settings load failed: {e}")
    try:
        from src.integrations import load_integrations
        integrations = load_integrations() or []
    except Exception as e:
        failed["integrations"] = _classify_error(e)
        logger.debug(f"service_health: integrations load failed: {e}")
    try:
        from routes.email_helpers import _list_email_accounts
        accounts = _list_email_accounts() or []
    except Exception as e:
        failed["accounts"] = _classify_error(e)
        logger.debug(f"service_health: email accounts load failed: {e}")
    try:
        from core.database import SessionLocal, ModelEndpoint
@@ -443,9 +464,10 @@ def _gather_inputs() -> Dict[str, Any]:
        finally:
            db.close()
    except Exception as e:
        failed["endpoints"] = _classify_error(e)
        logger.debug(f"service_health: endpoint load failed: {e}")
    return {"settings": settings, "integrations": integrations,
-            "accounts": accounts, "endpoints": endpoints}
+            "accounts": accounts, "endpoints": endpoints, "failed": failed}
 async def _run_subsystem(name: str, fn: Callable, *args: Any) -> Dict[str, Any]:
@@ -464,6 +486,24 @@ async def _run_subsystem(name: str, fn: Callable, *args: Any) -> Dict[str, Any]:
        return _svc(name, DOWN, _detail_for(category), error=category)
 async def _source_unavailable(name: str, source: str,
                              category: str) -> Dict[str, Any]:
    """Controlled entry for a subsystem whose config source could not be read.
    Deliberately not `disabled`: the configured state is *unknown*, not known to
    be off. `degraded` rather than `down` because the failure is in reading the
    inventory, not a probe that reached the subsystem and failed — but it still
    carries non-zero severity, so a report containing one can never roll up to
    `ok`. `meta` names the source and the controlled category of the underlying
    exception; never its text.
    """
    return _svc(name, DEGRADED,
                f"Could not read configuration "
                f"({_detail_for(CONFIG_SOURCE_ERROR)}).",
                error=CONFIG_SOURCE_ERROR, source=source,
                source_error=category)
 async def collect_service_health(rag_manager: Any = None,
                                 memory_vector: Any = None) -> Dict[str, Any]:
    """Run every probe and return {overall, services, timestamp}.
@@ -472,6 +512,10 @@ async def collect_service_health(rag_manager: Any = None,
    four network subsystems run concurrently, each under `_SUBSYSTEM_DEADLINE`,
    with an overall `_AGGREGATE_DEADLINE` backstop. Per-item probes inside
    providers/email are themselves bounded by `_FANOUT_BUDGET`.
    A subsystem whose config/inventory source failed to load is reported via
    `_source_unavailable()` instead of being probed with an empty inventory,
    which every probe would otherwise report as `disabled`.
    """
    from datetime import datetime, timezone
@@ -482,12 +526,23 @@ async def collect_service_health(rag_manager: Any = None,
    chroma = chromadb_health(rag_manager, memory_vector)
    names = ["searxng", "ntfy", "email", "providers"]
-    coros = [
+    probes = {
-        _run_subsystem("searxng", searxng_health, settings),
+        "searxng": (searxng_health, (settings,)),
-        _run_subsystem("ntfy", ntfy_health, inputs["integrations"], settings),
+        "ntfy": (ntfy_health, (inputs["integrations"], settings)),
-        _run_subsystem("email", email_health, inputs["accounts"]),
+        "email": (email_health, (inputs["accounts"],)),
-        _run_subsystem("providers", providers_health, inputs["endpoints"]),
+        "providers": (providers_health, (inputs["endpoints"],)),
-    ]
+    }
    # A subsystem whose inventory could not be read is reported as such. The
    # others are still probed normally — one broken source degrades one entry.
    failed = inputs.get("failed") or {}
    coros = []
    for name in names:
        source = _SUBSYSTEM_SOURCE[name]
        if source in failed:
            coros.append(_source_unavailable(name, source, failed[source]))
        else:
            fn, args = probes[name]
            coros.append(_run_subsystem(name, fn, *args))
    try:
        results = await asyncio.wait_for(asyncio.gather(*coros),
                                         timeout=_AGGREGATE_DEADLINE)
@@ -12,16 +12,6 @@ from datetime import datetime, timedelta, timezone
 logger = logging.getLogger(__name__)
 # Names that indicate a throwaway/test session
 _THROWAWAY_NAMES = {
    "test", "testing", "asdf", "asd", "hello", "hi", "hey",
    "yo", "sup", "hola", "hii", "hiii", "heyo",
    "foo", "bar", "baz", "tmp", "temp", "scratch", "untitled",
    "new chat", "delete", "remove", "junk", "trash", "xxx",
    "abc", "qwerty", "blah", "stuff", "whatever", "idk",
    "ok", "lol", "bruh", "hmm", "hm", "meh",
 }
 _THROWAWAY_MAX_MESSAGES = 4
 _FRESH_EMPTY_SESSION_GRACE = timedelta(minutes=10)
 _FRESH_SESSION_GRACE = _FRESH_EMPTY_SESSION_GRACE
@@ -54,14 +44,15 @@ def is_session_recently_active(row, now=None, grace=_FRESH_SESSION_GRACE) -> boo
 async def run_auto_sort(owner: str, skip_llm: bool = False, delete_throwaway: bool = True) -> str:
-    """Run session cleanup + (optional) AI folder sort for the given owner.
+    """Remove empty/Incognito sessions and optionally organize saved chats.
    Args:
        owner: user whose sessions to process
-        skip_llm: when True, do only Phase 1 (delete empty/throwaway sessions);
+        skip_llm: when True, do only Phase 1 (delete empty/Incognito sessions);
            skip Phase 2 (AI folder assignment). Used by the built-in daily
            background sweep so it never burns LLM tokens.
-        delete_throwaway: when False, only empty/incognito sessions are deleted.
+        delete_throwaway: retained for caller compatibility. Ordinary sessions
            with saved messages are always preserved, regardless of this flag.
    Returns a human-readable summary of what was done.
    """
@@ -71,7 +62,7 @@ async def run_auto_sort(owner: str, skip_llm: bool = False, delete_throwaway: bo
    db = SessionLocal()
    try:
-        # ── Phase 1: Delete empty/throwaway sessions ──
+        # ── Phase 1: Delete only empty and explicitly Incognito sessions ──
        deleted_empty = 0
        deleted_throwaway = 0
@@ -93,47 +84,13 @@ async def run_auto_sort(owner: str, skip_llm: bool = False, delete_throwaway: bo
            if is_session_recently_active(row, now=cleanup_now):
                continue
-            msg_count = db.query(DbMsg.id).filter(
+            has_messages = db.query(DbMsg.id).filter(
                DbMsg.session_id == row.id
-            ).limit(_THROWAWAY_MAX_MESSAGES + 1).count()
+            ).first() is not None
-            should_delete = False
+            if not has_messages:
            if msg_count == 0:
                if is_fresh:
                    continue
                should_delete = True
                deleted_empty += 1
            elif delete_throwaway and msg_count <= _THROWAWAY_MAX_MESSAGES:
                name = (row.name or "").strip().lower()
                first_msg = db.query(DbMsg.content).filter(
                    DbMsg.session_id == row.id, DbMsg.role == "user"
                ).order_by(DbMsg.timestamp).first()
                first_text = (first_msg[0] or "").strip().lower() if first_msg else ""
                assistant_count = db.query(DbMsg.id).filter(
                    DbMsg.session_id == row.id, DbMsg.role == "assistant"
                ).limit(1).count()
                if name in _THROWAWAY_NAMES or name.startswith("chat:") or first_text in _THROWAWAY_NAMES:
                    should_delete = True
                    deleted_throwaway += 1
                elif msg_count == 1 and assistant_count == 0:
                    should_delete = True
                    deleted_throwaway += 1
                elif msg_count <= 4 and first_text and len(first_text.split()) <= 8 and len(first_text) <= 80:
                    # Short trivial chats — e.g. "write hi to a friend" → "Hi!"
                    should_delete = True
                    deleted_throwaway += 1
                else:
                    # Aggressive: total message text under 250 chars combined = trivial
                    msg_rows = db.query(DbMsg.content).filter(
                        DbMsg.session_id == row.id
                    ).all()
                    total_chars = sum(len(m[0] or "") for m in msg_rows)
                    if total_chars <= 250:
                        should_delete = True
                        deleted_throwaway += 1
            if should_delete:
                db.delete(row)
        if deleted_empty or deleted_throwaway:
@@ -57,25 +57,53 @@ def _message_to_context(msg: DBChatMessage) -> dict[str, Any]:
    }
-def _escape_like(value: str) -> str:
+def escape_like_pattern(value: str) -> str:
    """Escape SQL LIKE wildcards (``%``, ``_``) and the escape char itself.
    Public shared helper for building ``ilike(f"%{...}%", escape="\\\\")``
    patterns from user input. Must escape backslash first.
    """
    return value.replace("\\", "\\\\").replace("%", "\\%").replace("_", "\\_")
 def _escape_like(value: str) -> str:
    return escape_like_pattern(value)
 def _snippet(content: str, query: str, radius: int = 60) -> str:
    content = content or ""
    query = query or ""
    if not query:
        return content[: radius * 2]
-    idx = content.lower().find(query.lower())
+    match_start = -1
-    if idx == -1:
+    match_length = 0
    lowered_content = content.lower()
    for candidate in _query_terms(query):
        idx = lowered_content.find(candidate.lower())
        if idx != -1 and (match_start == -1 or idx < match_start):
            match_start = idx
            match_length = len(candidate)
    if match_start == -1:
        return content[: radius * 2]
-    start = max(0, idx - radius)
+    start = max(0, match_start - radius)
-    end = min(len(content), idx + len(query) + radius)
+    end = min(len(content), match_start + match_length + radius)
    return ("..." if start > 0 else "") + content[start:end] + ("..." if end < len(content) else "")
 def _query_terms(query: str) -> list[str]:
    """Return meaningful quoted phrases and tokens in user-entered order."""
    terms: list[str] = []
    for match in re.finditer(r'"([^"]+)"|[\w][\w._-]*', query, flags=re.UNICODE):
        term = match.group(1) if match.group(1) is not None else match.group(0).strip("._-")
        term = term.strip()
        if term:
            terms.append(term)
    return terms
 def _sanitize_fts_query(query: str) -> str | None:
    """Convert free text into a conservative FTS5 MATCH query.
@@ -132,6 +132,23 @@ async def _cached(key: Tuple, ttl: float, fetch: Callable[[], Awaitable[Any]]) -
            _shared_cache_pending.pop(key, None)
 def is_valid_cron(cron_expression: str) -> bool:
    """True for a standard 5-field cron expression that croniter can parse.
    croniter also accepts 6- and 7-field expressions with a seconds field, but
    the scheduler works at one-minute resolution and would run such a task
    every second.
    """
    if len((cron_expression or "").split()) != 5:
        return False
    try:
        from croniter import croniter
        croniter(cron_expression)
    except Exception:
        return False
    return True
 def compute_next_run(schedule: str, scheduled_time: str,
                     scheduled_day: int = None,
                     scheduled_date: datetime = None,
@@ -175,6 +192,9 @@ def compute_next_run(schedule: str, scheduled_time: str,
        return dt.astimezone(timezone.utc).replace(tzinfo=None)
    if schedule == "cron" and cron_expression:
        if not is_valid_cron(cron_expression):
            logger.warning(f"Invalid cron expression '{cron_expression}'")
            return None
        try:
            from croniter import croniter
            cron = croniter(cron_expression, now)
@@ -306,7 +326,7 @@ def _digest_windows(now):
 def _checkin_calendar_events(db, owner, start, end):
-    """Calendar events in [start, end] for ONE owner, for the check-in digest.
+    """Calendar events in [start, end) for ONE owner, for the check-in digest.
    Ownership lives on CalendarCal.owner; events inherit it via calendar_id.
    The digest query had no owner scope, so it pulled EVERY user's events into
@@ -320,7 +340,7 @@ def _checkin_calendar_events(db, owner, start, end):
        .filter(
            _CC.owner == owner,
            _CE.dtstart >= start,
-            _CE.dtstart <= end,
+            _CE.dtstart < end,
            _CE.status != "cancelled",
        )
        .order_by(_CE.dtstart)
@@ -41,6 +41,7 @@ _REQUIRED_NATIVE_TOOL_ARGS = {
    "write_file": ("path",),
    "edit_file": ("path",),
    "apply_patch": ("patch_text", "patchText", "patch"),
    "generate_image": ("prompt",),
    "host_shell": ("command",),
 }
@@ -4592,7 +4592,9 @@ body.bg-pattern-ascii-fireflies {
      width:100%; background:var(--bg); color:var(--fg);
      border:1px solid var(--border); border-radius:6px;
      padding:8px; font-family:inherit; font-size:0.95rem;
-      resize:vertical; outline:none;
+      resize:both; outline:none;
      field-sizing:content;
      max-width:100%; box-sizing:border-box;
      min-height:80px;
    }
    .edit-textarea:focus { border-color:var(--red); }
@@ -2690,11 +2690,14 @@ body.theme-frosted .modal {
    max-height: 95dvh !important;
  }
  /* Notes and Documents must respect the same viewport and safe-area
     top as other mobile full-height sheets. Keep these authoritative rules
     consistent with 05-documents.css and 14-email.css. */
  body.doc-view .doc-editor-pane,
  body.notes-view .notes-pane {
-    inset: auto 0 0 !important;
+    inset: var(--sheet-top) 0 0 !important;
-    height: 95dvh !important;
+    height: calc(var(--app-height) - var(--sheet-top)) !important;
-    max-height: 95dvh !important;
+    max-height: calc(var(--app-height) - var(--sheet-top)) !important;
  }
 }
@@ -16,13 +16,6 @@
  <link rel="apple-touch-icon" href="/static/icons/icon-192.png">
  <script nonce="{{CSP_NONCE}}">
  window._odysseusLoadTime = Date.now();
  // Stops iOS focus-zoom on every field; iOS still allows pinch-zoom, other platforms would not.
  (function(){
    var ua = navigator.userAgent || '';
    var isIOS = /iPad|iPhone|iPod/.test(ua) || (/Macintosh/.test(ua) && navigator.maxTouchPoints > 1);
    var vp = document.querySelector('meta[name="viewport"]');
    if (isIOS && vp) vp.setAttribute('content', vp.getAttribute('content') + ', maximum-scale=1');
  })();
  (function(){
    try {
      var t = JSON.parse(localStorage.getItem('odysseus-theme'));
@@ -771,7 +771,13 @@ function _getModal() {
      <button class="cal-side-nav cal-side-nav-next" id="cal-side-next" title="Next" aria-label="Next">&rsaquo;</button>
    </div>`;
  document.body.appendChild(_modal);
-  _modal.querySelector('#cal-close').addEventListener('click', closeCalendar);
+  _modal.querySelector('#cal-close').addEventListener('click', () => {
    if (_modal.querySelector('.cal-form')) {
      _render();
      return;
    }
    closeCalendar();
  });
  _modal.querySelector('#cal-side-prev')?.addEventListener('click', (e) => {
    e.preventDefault();
    e.stopPropagation();
@@ -0,0 +1,65 @@
 function streamError(payload) {
  const detail = payload?.data ?? payload;
  const candidates = [detail?.message, detail?.text, detail?.error?.message,
    detail?.error, payload?.message, payload?.text, payload?.error?.message,
    payload?.error, typeof payload === 'string' ? payload : null];
  const message = candidates.find(value => typeof value === 'string' && value.trim());
  return new Error(message || 'Model request failed.');
 }
 /** Decode complete SSE frames, requiring the backend's terminal DONE event. */
 export async function consumeCompareEvents(response, onEvent, onActivity) {
  const reader = response.body.getReader();
  const decoder = new TextDecoder();
  let line = '', event = 'message', data = [], skipLF = false;
  try {
    while (true) {
      const { done, value } = await reader.read();
      if (!done) onActivity?.();
      let chunk = decoder.decode(value, { stream: !done });
      if (skipLF && chunk.length) {
        if (chunk.startsWith('\n')) chunk = chunk.slice(1);
        skipLF = false;
      }
      const separators = /\r\n|\r|\n/g;
      let start = 0, separator;
      while ((separator = separators.exec(chunk))) {
        line += chunk.slice(start, separator.index);
        start = separator.index + separator[0].length;
        skipLF = separator[0] === '\r' && start === chunk.length;
        if (!line) {
          if (data.length || event === 'error') {
            const raw = data.join('\n');
            if (event !== 'error' && raw === '[DONE]') return;
            let payload;
            try { payload = JSON.parse(raw); }
            catch (_) {
              if (event === 'error') throw streamError(raw);
              throw new Error('Invalid model stream data.');
            }
            if (event === 'error' || payload?.type === 'error') throw streamError(payload);
            if (!payload || typeof payload !== 'object' || Array.isArray(payload)) {
              throw new Error('Invalid model stream data.');
            }
            await onEvent(payload);
          }
          event = 'message';
          data = [];
        } else if (!line.startsWith(':')) {
          const colon = line.indexOf(':');
          const field = colon < 0 ? line : line.slice(0, colon);
          let value = colon < 0 ? '' : line.slice(colon + 1);
          if (value.startsWith(' ')) value = value.slice(1);
          if (field === 'data') data.push(value);
          else if (field === 'event') event = value || 'message';
        }
        line = '';
      }
      line += chunk.slice(start);
      if (done) throw new Error('Stream ended before completion.');
    }
  } finally {
    try { await reader.cancel(); } catch (_) {}
    reader.releaseLock();
  }
 }
@@ -1,5 +1,6 @@
 // compare/stream.js — SSE streaming to panes
 import state from './state.js';
 import { consumeCompareEvents } from './sse.js';
 import { addFinishBadge } from './vote.js?v=20260828resendcaldrag1';
 import { getModelCost, renderAskUserCard, safeDisplayImageSrc } from '../chatRenderer.js?v=20260914metricssummary1';
 import markdownModule from '../markdown.js';
@@ -472,25 +473,9 @@ async function streamToPane(paneIdx, sessionId, message, aiMsgEl, opts) {
    });
    if (!response.ok) throw new Error(`HTTP ${response.status}`);
-    const reader = response.body.getReader();
+    await consumeCompareEvents(response,
-    const decoder = new TextDecoder();
+      (json) => {
    let buffer = '';
    while (true) {
      const { done, value } = await reader.read();
      if (done) break;
      _resetIdleTimeout();  // any chunk = stream is alive
      buffer += decoder.decode(value, { stream: true });
      const lines = buffer.split('\n');
      buffer = lines.pop() || '';
      for (const line of lines) {
        if (!line.startsWith('data: ')) continue;
        const data = line.slice(6);
        if (data === '[DONE]') break;
        try {
          const json = JSON.parse(data);
          if (json.type === 'metrics') {
            metrics = json.data;
@@ -672,7 +657,7 @@ async function streamToPane(paneIdx, sessionId, message, aiMsgEl, opts) {
            if (hist) hist.scrollTop = hist.scrollHeight;
          } else if (json.delta) {
            // Skip text deltas if we already rendered an image
-            if (aiMsgEl._imageData) continue;
+            if (aiMsgEl._imageData) return;
            // Capture TTFT on very first text delta
            if (!accumulated && !_ttft) _ttft = performance.now() - _timerStart;
            // On first delta, destroy spinner and prepare text area
@@ -701,8 +686,7 @@ async function streamToPane(paneIdx, sessionId, message, aiMsgEl, opts) {
            _scheduleLiveRender(target);
          }
        } catch (e) { console.warn('Compare stream render error:', e); }
-      }
+      }, _resetIdleTimeout);
    }
    streamOk = true;
    // Destroy any remaining spinner
@@ -900,9 +884,15 @@ async function streamToPane(paneIdx, sessionId, message, aiMsgEl, opts) {
      }
    } else {
      console.error('Compare stream error:', error);
-      aiBody.innerHTML = '<span style="color:var(--color-error);">Error: ' + escapeHtml(error.message) + '</span>';
+      awaitingChoice = false;
      const message = state._blindMode ? 'Model request failed. Try again.' : error.message;
      aiBody.innerHTML = '<span style="color:var(--color-error);">Error: ' + escapeHtml(message) + '</span>';
    }
  } finally {
    if (aiMsgEl._spinner) {
      aiMsgEl._spinner.destroy();
      aiMsgEl._spinner = null;
    }
    clearTimeout(timeoutId);
    _timerDone = true;
    cancelAnimationFrame(_rafId);
@@ -1195,11 +1195,12 @@ async function _fetchDependencies() {
      // For backends with a recipe catalog (vllm / sglang / llama_cpp),
      // append a caret button that toggles a per-row recipe panel below.
      const hasRecipe = RECIPE_BACKENDS.has(pkg.name);
-      // Standalone recipe-caret button removed — the "Pick install
+      // The caret is the only way to open the recipe panel (the Installed ▾
-      // command" action lives inside the Installed ▾ dropdown menu
+      // menu has no recipe item), and the HW Fit / serve-card deep links
-      // (see _showDepMenu) so each row only has ONE caret to click.
+      // open it by clicking this caret (#6747).
-      // Kept the variable so downstream concat code stays the same.
+      const recipeCaret = hasRecipe
-      const recipeCaret = '';
+        ? `<button class="cookbook-dep-tag cookbook-dep-recipe-caret" data-dep-recipe-toggle="${esc(pkg.name)}" title="Pick a model to see the exact install commands" aria-expanded="false" style="background:none;border:1px solid var(--border);padding:2px 6px;display:inline-flex;align-items:center;cursor:pointer;"><svg width="11" height="11" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round" style="transition:transform 0.15s"><polyline points="6 9 12 15 18 9"/></svg></button>`
        : '';
      const recipePanel = hasRecipe ? _recipePanelHtml(pkg.name) : '';
      // When llama_cpp (or any future engine) reports build_deps_missing
      // from its system_prereqs probe, surface a one-tap install button
@@ -5232,7 +5232,7 @@ import { attachColorPicker } from './colorPicker.js?v=20260910eyedropper1';
  }
  async function _handleAttachUpload(e) {
-    const files = e.target.files;
+    const files = Array.from(e.target.files || []);
    e.target.value = ''; // reset for next upload
    await _uploadComposeFiles(files);
  }
@@ -5963,7 +5963,7 @@ import { attachColorPicker } from './colorPicker.js?v=20260910eyedropper1';
  }
  async function _handleMarkdownImageUpload(e) {
-    const files = e.target.files;
+    const files = Array.from(e.target.files || []);
    e.target.value = '';
    await _uploadMarkdownImages(files);
  }
@@ -2650,7 +2650,14 @@ export function openEmailLibrary(opts = {}) {
  }
  // Wire events
-  document.getElementById('email-lib-close').addEventListener('click', closeEmailLibrary);
+  document.getElementById('email-lib-close').addEventListener('click', () => {
    const modal = document.getElementById('email-lib-modal');
    if (modal?.classList.contains('email-reading') || modal?.querySelector('.doclib-card-expanded')) {
      _exitEmailReaderModeForList();
      return;
    }
    closeEmailLibrary();
  });
  document.getElementById('email-settings-header-back')?.addEventListener('click', _hideEmailSettingsPage);
  // Clicking the modal header (anywhere except buttons/inputs) collapses
@@ -73,16 +73,24 @@ function _isDangerousSrcset(value) {
 // Escape + linkify URLs and email addresses. Returns innerHTML-safe markup.
 export function _escLinkify(text) {
-  const escaped = _esc(text);
+  const raw = String(text || '');
-  // URLs: http(s)://... or www....
+  // Match raw text once so generated anchors are never linkified again.
-  const urlRe = /\b((?:https?:\/\/|www\.)[^\s<>"']+[^\s<>"'.,;:!?)\]])/g;
+  const tokenRe = /\b((?:https?:\/\/|www\.)[^\s<>"']+[^\s<>"'.,;:!?)\]])|\b([A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,})\b/g;
-  const mailRe = /\b([A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,})\b/g;
+  const parts = [];
-  return escaped
+  let offset = 0;
-    .replace(urlRe, (m) => {
+  for (const match of raw.matchAll(tokenRe)) {
-      const href = m.startsWith('www.') ? `https://${m}` : m;
+    parts.push(_esc(raw.slice(offset, match.index)));
-      return `<a href="${_attrEsc(href)}" target="_blank" rel="noopener noreferrer">${m}</a>`;
+    const token = match[0];
-    })
+    const isUrl = !!match[1];
-    .replace(mailRe, (m) => `<a href="${_attrEsc(`mailto:${m}`)}">${m}</a>`);
+    const href = isUrl
      ? (token.startsWith('www.') ? `https://${token}` : token)
      : `mailto:${token}`;
    const attrs = isUrl ? ' target="_blank" rel="noopener noreferrer"' : '';
    parts.push(`<a href="${_attrEsc(_esc(href))}"${attrs}>${_esc(token)}</a>`);
    offset = match.index + token.length;
  }
  parts.push(_esc(raw.slice(offset)));
  return parts.join('');
 }
 // Pull display name out of "Name <email@x>"; fallback to local-part of
@@ -5759,7 +5759,20 @@ function _updateBrushCursor(e) {
    state.cursorEl.style.height = diameterY + 'px';
  }
  state.cursorEl.classList.toggle('ge-brush-cursor--pixel', pixelBrush);
-  state.cursorEl.style.transform = `translate3d(${clientX - diameterX / 2}px, ${clientY - diameterY / 2}px, 0)`;
+  // Updating an inline style on every move invalidates document-wide :has()
  // selectors. A paused animation keeps the same transform in the rendering
  // pipeline without mutating the cursor's style attribute on every frame.
  const cursorTransform = `translate3d(${clientX - diameterX / 2}px, ${clientY - diameterY / 2}px, 0)`;
  if (!state.cursorEl._positionAnimation || state.cursorEl._positionAnimation.playState === 'idle') {
    state.cursorEl._positionAnimation = state.cursorEl.animate(
      [{ transform: cursorTransform }, { transform: cursorTransform }],
      { duration: 1, fill: 'both' },
    );
    state.cursorEl._positionAnimation.pause();
    state.cursorEl._positionAnimation.currentTime = 0;
  } else {
    state.cursorEl._positionAnimation.effect.setKeyframes([{ transform: cursorTransform }, { transform: cursorTransform }]);
  }
  if (state.cursorEl.style.display !== 'block') {
    state.cursorEl.style.display = 'block';
  }
@@ -14061,7 +14074,20 @@ export function closeEditor(options = {}) {
    const h = state.editorDocClickHandlers.pop();
    try { document.removeEventListener('click', h); } catch {}
  }
-  if (state.cursorEl) { state.cursorEl.remove(); state.cursorEl = null; }
+  if (_cursorRaf) { cancelAnimationFrame(_cursorRaf); _cursorRaf = null; }
  _pendingCursorEvent = null;
  _lastCursorRect = null;
  state._lastCursorDiameterX = null;
  state._lastCursorDiameterY = null;
  state._lastCursorBorderColor = null;
  if (state.cursorEl) {
    if (state.cursorEl._positionAnimation) {
      try { state.cursorEl._positionAnimation.cancel(); } catch {}
      state.cursorEl._positionAnimation = null;
    }
    state.cursorEl.remove();
    state.cursorEl = null;
  }
  try { document.getElementById('ge-cursor-layer')?.remove(); } catch {}
  // Tear down all floating popups + the dock so closing the editor
  // doesn't leave stale chips/panels behind on top of the gallery.
@@ -801,7 +801,8 @@ async function _sendRoundRobin(msg, box) {
            headers: { 'Content-Type': 'application/json' },
            body: JSON.stringify({ messages: [{
              role: 'user',
-              content: `[${m._groupName || m.display}]: ${response}`
+              content: `[${m._groupName || m.display}]: ${response}`,
              metadata: { group_peer: true, group_model: m._groupName || m.display, model: m.mid }
            }]}),
          });
        } catch (e) { console.warn('[group] sync failed:', e); }
@@ -828,7 +829,8 @@ async function _syncAllResponses(holders) {
          headers: { 'Content-Type': 'application/json' },
          body: JSON.stringify({ messages: [{
            role: 'user',
-            content: `[${model._groupName || model.display}]: ${response}`
+            content: `[${model._groupName || model.display}]: ${response}`,
            metadata: { group_peer: true, group_model: model._groupName || model.display, model: model.mid }
          }]}),
        });
      } catch (e) { /* silent */ }
@@ -379,7 +379,6 @@ document.addEventListener('DOMContentLoaded', markComposerUserEdited, { once: tr
      root.classList.toggle('keyboard-open', keyboardOpen);
      if (keyboardOpen) root.style.setProperty('--keyboard-viewport-height', vv.height + 'px');
      else root.style.removeProperty('--keyboard-viewport-height');
      if (window.scrollY) window.scrollTo(0, 0);
    };
    // iOS fires visualViewport resize only once, mid-animation, and no focusin when
    // the tapped field already had focus (e.g. the composer after a new chat)
@@ -392,7 +391,6 @@ document.addEventListener('DOMContentLoaded', markComposerUserEdited, { once: tr
    window.visualViewport.addEventListener('scroll', _syncKeyboardViewport);
    document.addEventListener('focusin', _syncThroughKeyboardAnimation);
    document.addEventListener('focusout', _syncThroughKeyboardAnimation);
    window.addEventListener('scroll', () => { if (window.scrollY) window.scrollTo(0, 0); }, { passive: true });
    let _lastVVHeight = window.visualViewport.height;
    window.visualViewport.addEventListener('resize', function() {
@@ -163,11 +163,13 @@ function buildCategoryChips() {
  const container = document.getElementById('memory-category-filters');
  if (!container) return;
  const cats = new Set(memories.map(m => m.category || 'fact'));
  if (activeCategory !== 'all' && !cats.has(activeCategory)) activeCategory = 'all';
  // Hide the chip row entirely when there are no memories — no point showing
  // an "all" chip with nothing to filter.
  if (!memories.length) { container.innerHTML = ''; return; }
  const cats = new Set(memories.map(m => m.category || 'fact'));
  const sorted = ['all', ...Array.from(cats).sort()];
  const counts = memories.reduce((result, memory) => {
    const category = memory.category || 'fact';
@@ -277,6 +279,7 @@ export function openMemoryModal(tabName = 'browse') {
      else if (m.default?.loadSkills) m.default.loadSkills(true);
    });
  }
  if (mode === 'memory') return loadMemories();
 }
 function _decodeMemoryAnchorId(memoryId) {
@@ -297,9 +300,8 @@ function _resetMemoryDeepLinkFilters() {
 // Memory search output may expose a shortened id, so prefix matching is
 // intentional here.
 export async function openMemory(memoryId, attempt = 0) {
  openMemoryModal('browse');
  _resetMemoryDeepLinkFilters();
-  await loadMemories();
+  await openMemoryModal('browse');
  if (renderMemoryList) renderMemoryList();
  const wanted = _decodeMemoryAnchorId(memoryId);
  if (!wanted) return;
@@ -299,7 +299,18 @@ function _renderHistoryMessage(msg, modelName) {
  } else {
    displayContent = '';
  }
-  if (msg.role === 'user') {
+  let displayRole = msg.role;
  // Peer turns remain user-role context for the model, but are agent replies
  // in history. Only explicit identity plus its exact prefix can opt in.
  if (displayRole === 'user' && meta?.group_peer === true
      && typeof meta.group_model === 'string' && meta.group_model) {
    const prefix = `[${meta.group_model}]: `;
    if (displayContent.startsWith(prefix)) {
      displayRole = 'assistant';
      displayContent = displayContent.slice(prefix.length);
    }
  }
  if (displayRole === 'user') {
    displayContent = _stripUserVisionBlocks(displayContent);
    const trimmed = displayContent.trim();
    if (
@@ -316,7 +327,7 @@ function _renderHistoryMessage(msg, modelName) {
      displayContent = `[Doc edit: ${docEditMatch[1]}] ${docEditMatch[3]}`;
    }
  }
-  return _addHistoryMessageWithFullRenderer(msg.role, displayContent, modelName, meta);
+  return _addHistoryMessageWithFullRenderer(displayRole, displayContent, modelName, meta);
 }
 function _clearHistoryPager() {
@@ -1260,6 +1260,9 @@ async function _expandSkillCard(card, name) {
      card._md = md || '';
    } else {
      pre.textContent = 'Loading…';
      const editBtn = [...card.querySelectorAll('.skill-card-preview button')]
        .find(button => button.textContent.trim() === 'Edit');
      if (editBtn) editBtn.disabled = true;
      try {
        const md = await _fetchSkillMarkdown(name);
        pre.textContent = md || '(empty)';
@@ -1267,6 +1270,8 @@ async function _expandSkillCard(card, name) {
        card._md = md;
      } catch (e) {
        pre.textContent = `Failed to load SKILL.md: ${e.message || 'Unknown error'}`;
      } finally {
        if (editBtn) editBtn.disabled = !card._mdLoaded;
      }
    }
  }
@@ -1275,6 +1280,9 @@ async function _expandSkillCard(card, name) {
 // Swap the read-only <pre> for an editable <textarea> (and back). The
 // Edit button toggles; a Save button commits via the markdown endpoint.
 function _toggleSkillEdit(card, name) {
  // A loading/error preview is not source text. Menu entry points must obey
  // the same readiness gate as the disabled footer control.
  if (!card._mdLoaded) return;
  const preview = card.querySelector('.skill-card-preview');
  if (!preview) return;
  const existing = preview.querySelector('.skill-md-editor');
@@ -1288,6 +1296,9 @@ function _toggleSkillEdit(card, name) {
  ta.className = 'skill-md-editor';
  ta.spellcheck = false;
  ta.value = (card._md != null ? card._md : (pre ? pre.textContent : '')) || '';
  // Let the source set the intrinsic height; the card's existing flex/max
  // height keeps long files bounded and the Save footer reachable.
  ta.rows = Math.max(ta.rows, ta.value.split(/\r\n|\r|\n/).length);
  ta.addEventListener('click', (e) => e.stopPropagation());
  if (pre) pre.style.display = 'none';
  preview.insertBefore(ta, preview.querySelector('.doclib-card-expanded-actions'));
@@ -267,8 +267,9 @@ export function makeWindowResizable(content, options = {}) {
          content.style.maxWidth = 'none';
          content.style.maxHeight = 'none';
          const left = parseFloat(content.style.left);
-          if (Number.isFinite(left) && left + w > window.innerWidth - padRight) {
+          if (Number.isFinite(left)) {
-            content.style.left = Math.max(padLeft, window.innerWidth - padRight - w) + 'px';
+            const rightmostLeft = Math.max(padLeft, window.innerWidth - padRight - w);
            content.style.left = Math.max(padLeft, Math.min(left, rightmostLeft)) + 'px';
          }
        }
      } catch (_) {}
@@ -7,7 +7,7 @@
 //   - Other static assets (images/fonts/libs): cache-first with bg refresh.
 //   - API / non-GET: never cached.
 // Bump CACHE_NAME whenever the precache list or SW logic changes.
-const CACHE_NAME = 'odysseus-v1114-pr40-editor-precache';
+const CACHE_NAME = 'odysseus-v1115-pr40-editor-precache';
 // KaTeX resolves these from its own stylesheet, so caching the CSS without them
 // gives offline math fallback glyphs instead of proper typesetting.
@@ -38,6 +38,7 @@ const KATEX_FONTS = [
 // Both are fetched at install time, in the background. Entries must match the
 // exact URL the browser requests, query string included.
 const PRECACHE = [
  '/static/js/compare/sse.js',
  '/',
  '/static/css/00-tokens.css?v=20260929csssplit',
  '/static/css/01-agent-chat.css?v=20260929csssplit',
@@ -99,8 +99,10 @@ cleanup. Specifically:
  `os.environ[...] = ...` that outlives the test.
 - **Current working directory** - never `chdir` without restoring; never assert
  against cwd-relative paths like `./data`. Use a temp workspace helper instead.
- **Database** - the root `conftest.py` defaults `DATABASE_URL` to an in-memory
+- **Database** - the root `conftest.py` defaults `DATABASE_URL` to a private,
-  SQLite for collection safety. A test that needs a real file-backed DB must opt
+  worker-owned SQLite file for collection safety and consistent schema across
  TestClient threads. This fallback is not a per-test data fixture. A test that
  writes or depends on particular rows must opt
  in explicitly via `tests.helpers.sqlite_db.make_temp_sqlite` and bind its
  `SessionLocal` onto the module under test. Do not rely on a persistent
  on-disk DB existing.
@@ -0,0 +1,67 @@
 """Gallery CLI tag filters match both sources and stack like the web library."""
 from datetime import datetime, timedelta
 import pytest
 from sqlalchemy import create_engine
 from sqlalchemy.orm import sessionmaker
 from core.database import Base, GalleryAlbum, GalleryImage
 from tests.helpers.cli_loader import load_script
@pytest.fixture
 def gallery_cli(monkeypatch, tmp_path):
    engine = create_engine(f"sqlite:///{tmp_path / 'gallery.db'}")
    Base.metadata.create_all(engine)
    sessions = sessionmaker(bind=engine)
    with sessions() as db:
        db.add(GalleryAlbum(id='sea', name='Sea'))
        for index, (uid, tags, ai_tags, favorite, album) in enumerate([
            ('manual', 'sunset,beach', '', True, 'sea'),
            ('ai', '', 'Beach,sunset', False, 'sea'),
            ('split', 'sunset', 'beach', True, None),
            ('one', 'sunset', '', False, None),
            ('other', 'forest', 'moss', False, None),
            ('inactive', 'sunset,beach', 'sunset,beach', True, 'sea'),
        ]):
            db.add(GalleryImage(id=uid, filename=uid+'.png', tags=tags, ai_tags=ai_tags,
                                favorite=favorite, album_id=album, is_active=uid!='inactive',
                                created_at=datetime(2026, 1, 1) + timedelta(minutes=index)))
        db.commit()
    cli = load_script('odysseus-gallery')
    monkeypatch.setattr(cli, 'SessionLocal', sessions)
    output = []
    monkeypatch.setattr(cli, 'emit', lambda rows, args: output.extend(rows))
    def run(*argv):
        output.clear()
        args = cli._build_parser().parse_args(['list', *argv])
        args.func(args)
        return [row['id'] for row in output]
    yield run
    engine.dispose()
@pytest.mark.parametrize('tag,expected', [
    ('sunset', ['one', 'split', 'ai', 'manual']),
    ('beach,sunset', ['split', 'ai', 'manual']),
    ('sunset,beach', ['split', 'ai', 'manual']),
    (', sunset, , BEACH ,', ['split', 'ai', 'manual']),
    ('forest', ['other']),
    ('no-match', []),
    (' , ', ['other', 'one', 'split', 'ai', 'manual']),
    ('sun', ['one', 'split', 'ai', 'manual']),
 ])
 def test_tag_sources_and_stacking(gallery_cli, tag, expected):
    assert gallery_cli('--tag', tag) == expected
@pytest.mark.parametrize('options,expected', [
    ([], ['other', 'one', 'split', 'ai', 'manual']),
    (['--tag', 'beach,sunset', '--favorites'], ['split', 'manual']),
    (['--tag', 'beach,sunset', '--album', 'Sea'], ['ai', 'manual']),
    (['--tag', 'beach', '--limit', '1'], ['split']),
 ])
 def test_tag_filters_preserve_other_list_options(gallery_cli, options, expected):
    assert gallery_cli(*options) == expected
@@ -0,0 +1,66 @@
 """The bounded arrival batch is displayed by Date, rather than arrival ID."""
 from contextlib import contextmanager
 from types import SimpleNamespace
 import pytest
 from tests.cli.test_mail_cli_read_empty_fetch import _load_mail_cli
@pytest.mark.parametrize('dates,expected', [
    (['Wed, 03 Jun 2026 12:00:00 +0000', 'Mon, 01 Jun 2026 09:00:00 +0000'], ['1', '2']),
    (['Wed, 03 Jun 2026 12:00:00 +0000', 'Wed, 03 Jun 2026 13:00:00 +0200'], ['1', '2']),
    (['Wed, 03 Jun 2026 12:00:00', 'Wed, 03 Jun 2026 11:00:00 +0000'], ['1', '2']),
    (['Wed, 03 Jun 2026 12:00:00 +0000', None, 'not a date'], ['1', '3', '2']),
    (['Wed, 03 Jun 2026 12:00:00 +0000', 'Wed, 03 Jun 2026 14:00:00 +0200'], ['2', '1']),
    (['Wed, 03 Jun 2026 12:00:00 +0000', 'Thu, 04 Jun 2026 12:00:00 +0000'], ['2', '1']),
    (['Wed, 31 Dec 1969 12:00:00 +0000', None], ['1', '2']),
 ])
 def test_list_sorts_parsed_dates_without_changing_row_schema(monkeypatch, dates, expected):
    cli = _load_mail_cli(monkeypatch)
    fetched = []
    class Connection:
        def select(self, folder, readonly=True):
            assert readonly is True
            return 'OK', [str(len(dates)).encode()]
        def search(self, *_):
            return 'OK', [' '.join(str(i+1) for i in range(len(dates))).encode()]
        def fetch(self, uid, _):
            fetched.append(uid.decode())
            date = dates[int(uid)-1]
            raw = 'From: Sender <sender@example.com>\r\nSubject: Item '+uid.decode()+'\r\n'
            if date is not None:
                raw += 'Date: '+date+'\r\n'
            return 'OK', [(b'1 (FLAGS (\\Seen) RFC822.HEADER)', (raw+'\r\n').encode())]
    @contextmanager
    def imap(_):
        yield Connection()
    rows = []
    monkeypatch.setattr(cli, '_imap', imap)
    monkeypatch.setattr(cli, 'emit', lambda value, args: rows.extend(value))
    cli.cmd_list(SimpleNamespace(account='fixture', folder='INBOX', limit=20))
    assert [row['uid'] for row in rows] == expected
    assert fetched == [str(i) for i in range(len(dates), 0, -1)]
    assert all(set(row) == {'uid', 'date', 'from_addr', 'from_name', 'subject', 'is_read', 'is_answered'} for row in rows)
    assert all(row['is_read'] and not row['is_answered'] for row in rows)
 def test_list_still_limits_the_arrival_batch(monkeypatch):
    cli = _load_mail_cli(monkeypatch)
    fetched = []
    class Connection:
        def select(self, *_args, **_kwargs):return 'OK', []
        def search(self, *_):return 'OK', [b'1 2 3']
        def fetch(self, uid, _):
            fetched.append(uid)
            return 'OK', [(b'3 (FLAGS () RFC822.HEADER)', b'From: x@example.com\r\nSubject: bounded\r\n\r\n')]
    @contextmanager
    def imap(_):yield Connection()
    monkeypatch.setattr(cli, '_imap', imap)
    monkeypatch.setattr(cli, 'emit', lambda *_:None)
    cli.cmd_list(SimpleNamespace(account='fixture', folder='INBOX', limit=1))
    assert fetched == [b'3']
@@ -12,9 +12,17 @@ sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
 # File-backed databases remain fixture-owned. Cleanup restores the caller.
 # Keep the existing generated environment-reference locations stable.
 _database_environment = pytest.MonkeyPatch()
 _database_environment.setenv("DATABASE_URL", "sqlite:///:memory:")
 from tests.helpers.worker_runtime import bootstrap_runtime, configure_runtime
 _runtime_environment = bootstrap_runtime()
 # A file keeps the collection schema consistent across TestClient threads;
 # SingletonThreadPool can evict the populated in-memory main-thread database.
 # One patcher owns this variable, including restoration of an inherited URL.
 _database_environment.setenv(
    "DATABASE_URL",
    f"sqlite:///{_runtime_environment.root / 'collection.db'}"
    if _runtime_environment is not None else "sqlite:///:memory:",
 )
 _collection_database_engine = None
 # Pre-import real heavy modules BEFORE any test file's module-level stubs can
 # replace them with MagicMock. Some test files (e.g. test_llm_core_sanitize_*)
@@ -26,6 +34,7 @@ try:
    import sqlalchemy.orm  # noqa: F401
    import core.database  # noqa: F401
    import src.database
    _collection_database_engine = core.database.engine
 except ImportError:
    pass  # not installed - the stubs below will handle it
@@ -100,6 +109,10 @@ def pytest_configure(config):
    only registers marker names; it imports no production module.
    """
    config.add_cleanup(_database_environment.undo)
    if _collection_database_engine is not None:
        # Registered after runtime cleanup, so connections close before the
        # owned file is removed (also required on Windows).
        config.add_cleanup(_collection_database_engine.dispose)
    import pathlib
    from tests._taxonomy import discover_markers
@@ -1,5 +1,7 @@
 # Browser End-to-End Tests
 ## Photo Editor Release Gate
 The photo editor release gate launches an isolated Odysseus server on port
 `7013` with a temporary SQLite database and disposable authenticated account.
@@ -18,3 +20,53 @@ The disposable account is created in the temporary data directory and exercises
 owner-scoped draft and notification routes without using an existing account.
 `PHOTO_EDITOR_E2E_AUTH=0` selects the legacy unauthenticated configuration for
 investigating it; offline-upgrade coverage requires the authenticated mode.
 ## Mobile and iOS Layout Suite
 The dedicated mobile and iOS layout suite exercises viewport behavior,
 accessibility zoom, scrolling, mobile safe-area geometry (Notes and Documents
 panes), and floating window restoration against an isolated local Odysseus server
 running on port `17739`.
 ```bash
 npm install
 npm run test:ios-layout:chromium
 ```
 ### Profiles and Browser Prerequisites
 - **Chromium profiles** (`desktop-chromium`, `phone-chromium-portrait`, `phone-chromium-landscape`, `tablet-chromium`):
  Provide automated baseline coverage in CI and local development without requiring
  WebKit dependencies.
 - **WebKit profiles** (`phone-webkit-portrait`, `phone-webkit-landscape`, `tablet-webkit`):
  Used for platform-oriented WebKit rendering validation. WebKit requires browser binaries:
 ```bash
 npm run test:ios-layout:install
 # or: npx playwright install webkit
 npm run test:ios-layout:webkit
 ```
 To run all installed profiles:
 ```bash
 npm run test:ios-layout
 ```
 ### Evidence and Cleanup
 - **Evidence artifacts**: Screenshots are written to `test-results/ios-layout/` by
  default and traces are written to `test-results/ios-layout-traces/`. Both paths
  are git-ignored. Set `ODYSSEUS_LAYOUT_EVIDENCE_DIR` to override the screenshot
  output path.
 - **Teardown**: Disposable application state and database files created in the
  OS temporary directory are automatically cleaned up on both normal and failure
  teardown, preserving diagnostic screenshots and failure traces.
 ### Platform Considerations
 Emulated Chromium and WebKit viewports validate deterministic CSS cascade,
 computed layout geometry, viewport meta tags, and JavaScript restoration. However,
 browser emulation is not a physical device substitute: physical iOS Safari and
 standalone installed PWAs should still be verified separately for native gesture
 pinch-zoom, software keyboard dismissal transitions, and dynamic hardware notch/island insets.
@@ -1,19 +0,0 @@
 const fs = require('node:fs');
 const os = require('node:os');
 const path = require('node:path');
 const marker = '.disposable-ci-fixture.json';
 function disposableCIArtifacts() {
  if (!(process.env.CI || process.env.GITHUB_ACTIONS) || process.env.ODYSSEUS_E2E_DISPOSABLE_ARTIFACTS !== '1') return false;
  const directory = process.env.PHOTO_EDITOR_E2E_DATA_DIR;
  if (!directory || process.env.PHOTO_EDITOR_E2E_AUTH === '0') return false;
  const resolved = path.resolve(directory);
  if (!path.basename(resolved).startsWith('odysseus-photo-editor-e2e-')) return false;
  if (![os.tmpdir(), '/tmp', '/var/tmp'].some(base => resolved.startsWith(path.resolve(base) + path.sep))) return false;
  if (process.env.PHOTO_EDITOR_E2E_DB_PATH !== path.join(resolved, 'app.db')) return false;
  try {
    const fixture = JSON.parse(fs.readFileSync(path.join(resolved, marker), 'utf8'));
    return fixture.synthetic === true && fixture.authenticated === true && fixture.database === path.join(resolved, 'app.db');
  } catch { return false; }
 }
 module.exports = { disposableCIArtifacts, marker };
@@ -0,0 +1,28 @@
 const fs = require('node:fs');
 const os = require('node:os');
 const path = require('node:path');
 /**
 * Global teardown for the iOS/mobile layout Playwright test suite.
 * Cleans up only disposable temporary application data directories,
 * preserving diagnostic artifacts (screenshots and failure traces) in test-results/.
 */
 module.exports = async () => {
  const dataDirectory = process.env.ODYSSEUS_LAYOUT_DATA_DIR;
  if (!dataDirectory || typeof dataDirectory !== 'string') return;
  try {
    const resolvedData = path.resolve(dataDirectory);
    const allowedTmpBases = [os.tmpdir(), '/var/tmp', '/tmp'].map(b => path.resolve(b));
    const isTmp = allowedTmpBases.some(base => resolvedData.startsWith(base + path.sep));
    const baseName = path.basename(resolvedData);
    if (isTmp && (baseName.startsWith('odysseus-ios-layout-') || baseName.startsWith('odysseus-pr6396-'))) {
      if (fs.existsSync(resolvedData)) {
        fs.rmSync(resolvedData, { recursive: true, force: true });
      }
    }
  } catch (err) {
    console.warn(`[ios-layout-teardown] Warning: failed to clean temporary runtime dir: ${err.message}`);
  }
 };
@@ -0,0 +1,148 @@
 // Tests against the running Odysseus app, not a static mock page.
 const fs = require('node:fs');
 const os = require('node:os');
 const path = require('node:path');
 const { defineConfig } = require('@playwright/test');
 const repositoryRoot = path.resolve(__dirname, '../..');
 const port = Number(process.env.ODYSSEUS_LAYOUT_PORT || '17739');
 const baseURL = `http://127.0.0.1:${port}`;
 const defaultPython = process.platform === 'win32'
  ? path.join(repositoryRoot, '.venv', 'Scripts', 'python.exe')
  : path.join(repositoryRoot, '.venv', 'bin', 'python');
 const python = process.env.ODYSSEUS_TEST_PYTHON
  || (fs.existsSync(defaultPython) ? defaultPython : 'python3');
 const dataDirectory = process.env.ODYSSEUS_LAYOUT_DATA_DIR
  || fs.mkdtempSync(path.join(os.tmpdir(), 'odysseus-ios-layout-'));
 process.env.ODYSSEUS_LAYOUT_DATA_DIR = dataDirectory;
 // Default evidence directory to repository-relative test-results/ios-layout
 // while preserving the environment-variable override if provided.
 const evidenceDir = process.env.ODYSSEUS_LAYOUT_EVIDENCE_DIR
  || path.join(repositoryRoot, 'test-results', 'ios-layout');
 const outputDir = path.join(repositoryRoot, 'test-results', 'ios-layout-traces');
 // Emergency process-exit cleanup for disposable application runtime state
 const cleanDataDirSync = () => {
  const dir = process.env.ODYSSEUS_LAYOUT_DATA_DIR;
  if (!dir || typeof dir !== 'string') return;
  try {
    const resolved = path.resolve(dir);
    const allowed = [os.tmpdir(), '/var/tmp', '/tmp'].map(b => path.resolve(b));
    if (allowed.some(base => resolved.startsWith(base + path.sep))) {
      const baseName = path.basename(resolved);
      if (baseName.startsWith('odysseus-ios-layout-') || baseName.startsWith('odysseus-pr6396-')) {
        if (fs.existsSync(resolved)) {
          fs.rmSync(resolved, { recursive: true, force: true });
        }
      }
    }
  } catch (_) {}
 };
 process.once('SIGINT', () => { cleanDataDirSync(); process.exit(130); });
 process.once('SIGTERM', () => { cleanDataDirSync(); process.exit(143); });
 function isWebKitInstalled() {
  try {
    const { webkit } = require('@playwright/test');
    return fs.existsSync(webkit.executablePath());
  } catch (_) {
    return false;
  }
 }
 const chromiumProjects = [
  {
    name: 'desktop-chromium',
    use: { browserName: 'chromium', viewport: { width: 1440, height: 900 } },
  },
  {
    name: 'phone-chromium-portrait',
    use: { browserName: 'chromium', viewport: { width: 390, height: 844 }, hasTouch: true, isMobile: true },
  },
  {
    name: 'phone-chromium-landscape',
    use: { browserName: 'chromium', viewport: { width: 844, height: 390 }, hasTouch: true, isMobile: true },
  },
  {
    name: 'tablet-chromium',
    use: { browserName: 'chromium', viewport: { width: 820, height: 1000 }, hasTouch: true, isMobile: true },
  },
 ];
 const webkitProjects = [
  {
    name: 'phone-webkit-portrait',
    use: { browserName: 'webkit', viewport: { width: 390, height: 844 }, hasTouch: true, isMobile: true },
  },
  {
    name: 'phone-webkit-landscape',
    use: { browserName: 'webkit', viewport: { width: 844, height: 390 }, hasTouch: true, isMobile: true },
  },
  {
    name: 'tablet-webkit',
    use: { browserName: 'webkit', viewport: { width: 820, height: 1000 }, hasTouch: true, isMobile: true },
  },
 ];
 // Determine active projects based on environment and local browser availability
 const requestedBrowser = (process.env.ODYSSEUS_LAYOUT_BROWSER || 'all').toLowerCase();
 let selectedProjects = [];
 if (requestedBrowser === 'chromium') {
  selectedProjects = chromiumProjects;
 } else if (requestedBrowser === 'webkit') {
  selectedProjects = webkitProjects;
 } else {
  // 'all': Include chromium always; include webkit if installed or if explicitly targeted via cli args
  const hasCliWebKitTarget = process.argv.some(arg => arg.toLowerCase().includes('webkit'));
  if (isWebKitInstalled() || hasCliWebKitTarget) {
    selectedProjects = [...chromiumProjects, ...webkitProjects];
  } else {
    // Only Chromium is available locally (e.g. standard CI / default runner)
    selectedProjects = chromiumProjects;
  }
 }
 module.exports = defineConfig({
  testDir: path.join(__dirname, 'ios-layout'),
  testMatch: ['**/*.spec.cjs'],
  outputDir,
  timeout: 90_000,
  expect: { timeout: 15_000 },
  retries: 0,
  workers: 1,
  reporter: [['line']],
  globalTeardown: require.resolve('./ios-layout-teardown.cjs'),
  use: {
    baseURL,
    headless: true,
    serviceWorkers: 'block',
    screenshot: 'only-on-failure',
    trace: 'retain-on-failure',
  },
  projects: selectedProjects,
  metadata: { evidenceDir },
  webServer: {
    command: `${JSON.stringify(python)} -m uvicorn app:app --host 127.0.0.1 --port ${port}`,
    cwd: repositoryRoot,
    url: baseURL,
    timeout: 120_000,
    reuseExistingServer: false,
    env: {
      ...process.env,
      AUTH_ENABLED: 'false',
      // Never connect the disposable app to the host's real ChromaDB.
      CHROMADB_HOST: '127.0.0.1',
      CHROMADB_PORT: String(port + 1),
      LLM_HOST: '127.0.0.1',
      EMBEDDING_URL: `http://127.0.0.1:${port + 1}/v1/embeddings`,
      DATABASE_URL: `sqlite:///${path.join(dataDirectory, 'app.db')}`,
      ODYSSEUS_DATA_DIR: dataDirectory,
      ODYSSEUS_STARTUP_WARMUPS: '0',
      RESPONSE_COMPRESSION_ENABLED: 'false',
    },
  },
 });
@@ -0,0 +1,313 @@
 const { test, expect } = require('@playwright/test');
 const fs = require('node:fs');
 const path = require('node:path');
 async function openApp(page) {
  const response = await page.goto('/', { waitUntil: 'domcontentloaded' });
  expect(response?.ok()).toBeTruthy();
  // The runtime currently produces two #message nodes. Select the
  // initialized composer while diagnosing whether both are visible.
  const composers = await page.locator('textarea#message').evaluateAll(nodes =>
    nodes.map((el, index) => ({
      index,
      initialized: el.dataset.startupPreserveBound === '1',
      visible: !!el.getClientRects().length &&
        getComputedStyle(el).visibility !== 'hidden',
      parent: el.parentElement?.className || '',
    }))
  );
  if (composers.length !== 1) {
    console.log('Composer DOM diagnostic:', JSON.stringify(composers));
  }
  const activeComposer = page.locator(
    'textarea#message[data-startup-preserve-bound="1"]'
  );
  await expect(activeComposer).toHaveCount(1);
  await expect(activeComposer).toBeVisible();
  expect(
    composers.filter(composer => composer.visible).length,
    'Exactly one composer should be visible'
  ).toBe(1);
 }
 function isMobileViewport(testInfo) {
  const width = testInfo.project.use?.viewport?.width || 0;
  return width > 0 && width <= 768;
 }
 /**
 * Reach Settings through genuine UI controls on either desktop or mobile viewports.
 * On mobile (<=768px), the rail is hidden and the sidebar must be opened via hamburger.
 */
 async function openSettings(page, isMobile) {
  let settingsButton;
  if (isMobile) {
    const hamburger = page.locator('#hamburger-btn:visible').first();
    await expect(hamburger, 'Hamburger button must be visible on mobile').toBeVisible({ timeout: 5000 });
    await hamburger.click();
    const sidebar = page.locator('#sidebar:not(.hidden)');
    await expect(sidebar, 'Sidebar must open upon hamburger tap').toBeVisible({ timeout: 5000 });
    await page.waitForTimeout(300);
    settingsButton = sidebar.locator('#user-bar-settings');
  } else {
    settingsButton = page.locator('#rail-settings:visible, #user-bar-settings:visible').first();
  }
  await expect(settingsButton, 'Settings button must be reachable and visible').toBeVisible({ timeout: 5000 });
  await settingsButton.click();
  const dialog = page.locator('#settings-modal');
  await expect(dialog, 'Settings modal must become visible').toBeVisible({ timeout: 5000 });
  return dialog;
 }
 /**
 * Reach Notes through genuine UI controls on either desktop or mobile viewports.
 */
 async function openNotes(page, isMobile) {
  let notesButton;
  if (isMobile) {
    const hamburger = page.locator('#hamburger-btn:visible').first();
    await expect(hamburger, 'Hamburger button must be visible on mobile').toBeVisible({ timeout: 5000 });
    await hamburger.click();
    const sidebar = page.locator('#sidebar:not(.hidden)');
    await expect(sidebar, 'Sidebar must open upon hamburger tap').toBeVisible({ timeout: 5000 });
    await page.waitForTimeout(300);
    notesButton = sidebar.locator('#tool-notes-btn');
  } else {
    notesButton = page.locator('#rail-notes:visible, #tool-notes-btn:visible').first();
  }
  await expect(notesButton, 'Notes button must be reachable and visible').toBeVisible({ timeout: 5000 });
  await notesButton.click();
  const realNotes = page.locator('.notes-pane').first();
  await expect(realNotes, 'Notes pane must become visible').toBeVisible({ timeout: 5000 });
  return realNotes;
 }
 /**
 * Reach Document editor through genuine UI controls on either desktop or mobile viewports.
 */
 async function openDocument(page, isMobile) {
  let docButton;
  if (isMobile) {
    const hamburger = page.locator('#hamburger-btn:visible').first();
    await expect(hamburger, 'Hamburger button must be visible on mobile').toBeVisible({ timeout: 5000 });
    await hamburger.click();
    const sidebar = page.locator('#sidebar:not(.hidden)');
    await expect(sidebar, 'Sidebar must open upon hamburger tap').toBeVisible({ timeout: 5000 });
    await page.waitForTimeout(300);
    docButton = sidebar.locator('#library-new-doc-btn');
  } else {
    docButton = page.locator('#library-new-doc-btn:visible').first();
    if (!(await docButton.count())) {
      const hamburger = page.locator('#hamburger-btn:visible').first();
      if (await hamburger.count()) {
        await hamburger.click();
        await page.waitForTimeout(300);
        docButton = page.locator('#sidebar:not(.hidden) #library-new-doc-btn');
      }
    }
  }
  await expect(docButton, 'Document creation button must be reachable and visible').toBeVisible({ timeout: 5000 });
  await docButton.click();
  const docPane = page.locator('.doc-editor-pane').first();
  await expect(docPane, 'Document editor pane must become visible').toBeVisible({ timeout: 10000 });
  return docPane;
 }
 test('renders actual Odysseus UI and captures review screenshots', async ({ page }, testInfo) => {
  await openApp(page);
  const out = testInfo.config.metadata.evidenceDir;
  fs.mkdirSync(out, { recursive: true });
  const name = testInfo.project.name;
  const isMobile = isMobileViewport(testInfo);
  // 1. Chat screenshot (default view)
  await page.screenshot({ path: path.join(out, `${name}-chat.png`), fullPage: false, animations: 'disabled' });
  // 2. Settings screenshot via actual user-visible navigation
  await openApp(page);
  await openSettings(page, isMobile);
  await page.screenshot({ path: path.join(out, `${name}-settings.png`), fullPage: false, animations: 'disabled' });
  // 3. Notes screenshot via actual user-visible navigation
  await openApp(page);
  await openNotes(page, isMobile);
  await page.screenshot({ path: path.join(out, `${name}-notes.png`), fullPage: false, animations: 'disabled' });
  testInfo.annotations.push({ type: 'evidence', description: out });
 });
 test('viewport meta does not restrict user zoom', async ({ page }) => {
  await openApp(page);
  const meta = await page.locator('meta[name="viewport"]').getAttribute('content');
  expect(meta || '').not.toMatch(/maximum-scale\s*=\s*1(?:\b|\.)/i);
  expect(meta || '').not.toMatch(/user-scalable\s*=\s*no/i);
 });
 test('browser-owned window scrolling is not globally reset', async ({ page }) => {
  await openApp(page);
  const value = await page.evaluate(async () => {
    document.documentElement.style.overflowY = 'auto';
    document.body.style.overflowY = 'auto';
    document.body.style.height = 'auto';
    document.body.style.minHeight = '3200px';
    const spacer = document.createElement('div');
    spacer.style.cssText = 'position:absolute;top:3100px;width:1px;height:10px;pointer-events:none;';
    document.body.appendChild(spacer);
    window.scrollTo(0, 250);
    await new Promise(resolve => setTimeout(resolve, 150));
    return window.scrollY;
  });
  expect(value).toBeGreaterThan(100);
 });
 test('CSS cascade rules for mobile Notes and Documents respect safe areas', async ({ page }, testInfo) => {
  test.skip(!isMobileViewport(testInfo), 'Only mobile viewports <=768px');
  await openApp(page);
  const results = await page.evaluate(() => {
    document.documentElement.style.setProperty('--safe-top', '44px');
    document.documentElement.style.setProperty('--sheet-top', '68px');
    document.documentElement.style.setProperty('--app-height', '844px');
    const values = {};
    for (const [key, bodyClass, paneClass] of [
      ['notes', 'notes-view', 'notes-pane'],
      ['document', 'doc-view', 'doc-editor-pane'],
    ]) {
      const pane = document.createElement('section');
      pane.className = paneClass;
      pane.style.opacity = '0'; // CSS cascade regression check
      document.body.appendChild(pane);
      document.body.classList.add(bodyClass);
      const style = window.getComputedStyle(pane);
      values[key] = {
        top: style.top,
        height: style.height,
        insetTop: pane.getBoundingClientRect().top,
      };
      pane.remove();
      document.body.classList.remove(bodyClass);
    }
    return values;
  });
  for (const key of ['notes', 'document']) {
    expect(results[key].top, key).toBe('68px');
    expect(parseFloat(results[key].height), key).toBeGreaterThanOrEqual(770);
  }
 });
 test('real Notes and Document panes honor safe-area geometry in the live application', async ({ page }, testInfo) => {
  const isMobile = isMobileViewport(testInfo);
  test.skip(!isMobile, 'Only mobile viewports <=768px');
  await openApp(page);
  // Configure simulated safe-area insets (e.g. iPhone notch / Dynamic Island)
  await page.evaluate(() => {
    document.documentElement.style.setProperty('--safe-top', '44px');
    document.documentElement.style.setProperty('--sheet-top', '68px');
    document.documentElement.style.setProperty('--app-height', '844px');
  });
  // 1. Verify actual Notes UI
  const realNotes = await openNotes(page, isMobile);
  const notesMetrics = await realNotes.evaluate(el => {
    const style = window.getComputedStyle(el);
    const rect = el.getBoundingClientRect();
    return {
      top: style.top,
      height: style.height,
      maxHeight: style.maxHeight,
      rectTop: rect.top,
      rectHeight: rect.height,
    };
  });
  expect(notesMetrics.top, 'Real Notes pane top must match --sheet-top').toBe('68px');
  expect(parseFloat(notesMetrics.height), 'Real Notes pane height must respect safe area').toBeGreaterThanOrEqual(770);
  expect(notesMetrics.rectTop, 'Real Notes pane must not overlap the 44px safe-area top notch').toBeGreaterThanOrEqual(44);
  // 2. Verify actual Document UI
  await openApp(page);
  await page.evaluate(() => {
    document.documentElement.style.setProperty('--safe-top', '44px');
    document.documentElement.style.setProperty('--sheet-top', '68px');
    document.documentElement.style.setProperty('--app-height', '844px');
  });
  const realDoc = await openDocument(page, isMobile);
  const docMetrics = await realDoc.evaluate(el => {
    const style = window.getComputedStyle(el);
    const rect = el.getBoundingClientRect();
    return {
      top: style.top,
      height: style.height,
      maxHeight: style.maxHeight,
      rectTop: rect.top,
      rectHeight: rect.height,
    };
  });
  expect(docMetrics.top, 'Real Document pane top must match --sheet-top').toBe('68px');
  expect(parseFloat(docMetrics.height), 'Real Document pane height must respect safe area').toBeGreaterThanOrEqual(770);
  expect(docMetrics.rectTop, 'Real Document pane must not overlap the 44px safe-area top notch').toBeGreaterThanOrEqual(44);
 });
 test('restored floating windows clamp away from a left safe area', async ({ page }, testInfo) => {
  test.skip(isMobileViewport(testInfo), 'Geometry test uses desktop resizable windows');
  await openApp(page);
  const value = await page.evaluate(async () => {
    document.documentElement.style.setProperty('--safe-left', '58px');
    document.body.style.setProperty('padding-left', '58px', 'important');
    const probe = document.createElement('div');
    probe.style.cssText = 'position:fixed;left:10px;top:80px;width:420px;height:250px;z-index:999999;';
    document.body.appendChild(probe);
    const key = 'odysseus-layout-restore-test';
    localStorage.setItem(key, JSON.stringify({ w: 480, h: 280 }));
    try {
      // Body horizontal padding transitions over 160ms. Wait for the
      // simulated safe-area change to settle before restoring geometry.
      await new Promise(resolve => setTimeout(resolve, 300));
      const padAtRestore = parseFloat(
        getComputedStyle(document.body).paddingLeft
      );
      if (Math.abs(padAtRestore - 58) > 0.5) {
        throw new Error(
          `Safe-area fixture did not settle: ${padAtRestore}px`
        );
      }
      // Verify the running server actually serves the patched module.
      const response = await fetch(
        '/static/js/windowResize.js',
        { cache: 'no-store' }
      );
      if (!response.ok) {
        throw new Error('Cannot fetch windowResize.js');
      }
      const moduleSource = await response.text();
      if (!moduleSource.includes('const rightmostLeft = Math.max(padLeft')) {
        throw new Error('Running server is serving unpatched windowResize.js');
      }
      const { makeWindowResizable } = await import('/static/js/windowResize.js');
      makeWindowResizable(probe, { storageKey: key, mobileSkip: 768 });
      await new Promise(resolve => setTimeout(resolve, 300));
      return {
        left: parseFloat(probe.style.left),
        width: parseFloat(probe.style.width),
        paddingLeft: parseFloat(getComputedStyle(document.body).paddingLeft),
        viewportWidth: window.innerWidth,
      };
    } finally {
      localStorage.removeItem(key);
      probe.remove();
    }
  });
  expect(value.paddingLeft).toBeGreaterThanOrEqual(58);
  expect(value.width).toBe(480);
  expect(value.left).toBeGreaterThanOrEqual(value.paddingLeft);
 });
@@ -46,3 +46,480 @@ test('brush cursor matches the rendered brush diameter and replaces the crosshai
  await expect.poll(async () => (await cursor.boundingBox()).width)
    .toBeCloseTo(measurements.expectedWidth * 2, 1);
 });
 test('brush cursor follows the pointer before, during, and after a stroke and cancels animations on close', async ({ page }) => {
  await openBlankEditor(page, { width: 400, height: 300 });
  await selectTool(page, 'brush');
  const canvas = await page.locator('.ge-main-canvas').boundingBox();
  const cursor = page.locator('.ge-brush-cursor');
  const checkCenter = async (x, y) => {
    await expect.poll(async () => {
      const box = await cursor.boundingBox();
      return box ? Math.max(Math.abs(box.x + box.width / 2 - x), Math.abs(box.y + box.height / 2 - y)) : Infinity;
    }).toBeLessThan(1);
  };
  const a = { x: canvas.x + canvas.width * 0.3, y: canvas.y + canvas.height * 0.4 };
  const b = { x: canvas.x + canvas.width * 0.7, y: canvas.y + canvas.height * 0.6 };
  await page.mouse.move(a.x, a.y);
  await checkCenter(a.x, a.y);
  await page.mouse.down();
  await page.mouse.move(b.x, b.y, { steps: 8 });
  await checkCenter(b.x, b.y);
  await page.mouse.up();
  await page.mouse.move(a.x, a.y);
  await checkCenter(a.x, a.y);
  // 1. Ensure at least one animation exists before checking cancellation
  // 2. Verify the actual cursor-position animation is paused while active
  const activeAnimation = await page.evaluate(() => {
    const cursorEl = document.querySelector('.ge-brush-cursor');
    const anims = cursorEl ? cursorEl.getAnimations() : [];
    return {
      count: anims.length,
      hasPositionAnim: Boolean(cursorEl?._positionAnimation),
      positionAnimPaused: cursorEl?._positionAnimation?.playState === 'paused',
      positionAnimCurrentTime: cursorEl?._positionAnimation?.currentTime,
      allPaused: anims.length > 0 && anims.every(a => a.playState === 'paused'),
    };
  });
  expect(activeAnimation.count).toBeGreaterThanOrEqual(1);
  expect(activeAnimation.hasPositionAnim).toBe(true);
  expect(activeAnimation.positionAnimPaused).toBe(true);
  expect(activeAnimation.positionAnimCurrentTime).toBe(0);
  expect(activeAnimation.allPaused).toBe(true);
  // 3. Verify it is canceled when the editor closes
  // 4. Ensure temporary test-only references are cleaned up
  const closeOutcome = await page.evaluate(async () => {
    const cursorEl = document.querySelector('.ge-brush-cursor');
    const anims = cursorEl ? cursorEl.getAnimations() : [];
    const editor = await window.__photoEditorImport('/static/js/galleryEditor.js');
    editor.closeEditor({ force: true });
    return {
      trackedCount: anims.length,
      allIdle: anims.length > 0 && anims.every(a => a.playState === 'idle'),
      states: anims.map(a => a.playState),
    };
  });
  await expect(cursor).toHaveCount(0);
  expect(closeOutcome.trackedCount).toBeGreaterThanOrEqual(1);
  expect(closeOutcome.allIdle).toBe(true);
  expect(closeOutcome.states.every(s => s === 'idle')).toBe(true);
  // Verify no temporary references linger on window
  const windowClean = await page.evaluate(() => {
    return !('__cursorAnimationsForTest' in window) && !('__styleTransformMutations' in window);
  });
  expect(windowClean).toBe(true);
 });
 test('steady pointer movement does not perform repeated inline style-transform writes', async ({ page }) => {
  await openBlankEditor(page, { width: 400, height: 300 });
  await selectTool(page, 'brush');
  const canvas = await page.locator('.ge-main-canvas').boundingBox();
  const cursor = page.locator('.ge-brush-cursor');
  // Warm up the cursor first: move pointer onto canvas
  const startX = canvas.x + canvas.width * 0.25;
  const startY = canvas.y + canvas.height * 0.25;
  await page.mouse.move(startX, startY);
  await expect(cursor).toBeVisible();
  // Observe style attribute mutations during steady pointer movement.
  // Brush size, color, and mode remain unchanged throughout.
  await page.evaluate(() => {
    const el = document.querySelector('.ge-brush-cursor');
    window.__styleMutationRecords = [];
    const observer = new MutationObserver((mutations) => {
      for (const m of mutations) {
        if (m.type === 'attributes' && m.attributeName === 'style') {
          const oldStyle = m.oldValue || '';
          const currentStyle = el.getAttribute('style') || '';
          // Track mutations where style-transform was written inline
          if (el.style.transform || currentStyle.includes('transform:') || oldStyle.includes('transform:')) {
            window.__styleMutationRecords.push({
              oldStyle,
              currentStyle,
              inlineTransform: el.style.transform,
            });
          }
        }
      }
    });
    observer.observe(el, { attributes: true, attributeFilter: ['style'], attributeOldValue: true });
    window.__styleMutationObserver = observer;
  });
  // Preserve actual mouse interactions: steady movement across 10 steps
  const endX = canvas.x + canvas.width * 0.75;
  const endY = canvas.y + canvas.height * 0.75;
  await page.mouse.move(endX, endY, { steps: 10 });
  // Confirm the cursor accurately tracked the pointer
  await expect.poll(async () => {
    const box = await cursor.boundingBox();
    return box ? Math.max(Math.abs(box.x + box.width / 2 - endX), Math.abs(box.y + box.height / 2 - endY)) : Infinity;
  }).toBeLessThan(1);
  // Collect observation results and clean up observer and globals
  const { mutationCount, inlineTransform, animCount } = await page.evaluate(() => {
    window.__styleMutationObserver?.disconnect();
    delete window.__styleMutationObserver;
    const records = window.__styleMutationRecords || [];
    delete window.__styleMutationRecords;
    const el = document.querySelector('.ge-brush-cursor');
    return {
      mutationCount: records.length,
      inlineTransform: el?.style.transform || '',
      animCount: el?.getAnimations?.().length || 0,
    };
  });
  // The optimized implementation uses paused Web Animations keyframes, avoiding repeated
  // inline style-transform writes that trigger expensive :has() document invalidations.
  expect(mutationCount).toBe(0);
  expect(inlineTransform).toBe('');
  expect(animCount).toBeGreaterThanOrEqual(1);
 });
 test('cross-tool cursor positioning, sizing, and styling across brush, eraser, pixel, lasso, inpaint, liquify, and clone', async ({ page }) => {
  await openBlankEditor(page, { width: 400, height: 300 });
  const canvas = await page.locator('.ge-main-canvas').boundingBox();
  const cursor = page.locator('.ge-brush-cursor');
  const checkCenter = async (x, y) => {
    await expect.poll(async () => {
      const box = await cursor.boundingBox();
      return box ? Math.max(Math.abs(box.x + box.width / 2 - x), Math.abs(box.y + box.height / 2 - y)) : Infinity;
    }).toBeLessThan(1);
  };
  const midX = canvas.x + canvas.width / 2;
  const midY = canvas.y + canvas.height / 2;
  // 1. Brush tool
  await selectTool(page, 'brush');
  await page.mouse.move(midX, midY);
  await expect(cursor).toBeVisible();
  await checkCenter(midX, midY);
  let props = await page.evaluate(() => {
    const el = document.querySelector('.ge-brush-cursor');
    return {
      isPixel: el.classList.contains('ge-brush-cursor--pixel'),
      display: el.style.display,
      borderStyle: el.style.borderStyle,
    };
  });
  expect(props.isPixel).toBe(false);
  expect(props.display).toBe('block');
  // 2. Eraser tool
  await selectTool(page, 'eraser');
  await page.mouse.move(midX + 10, midY + 10);
  await checkCenter(midX + 10, midY + 10);
  props = await page.evaluate(() => {
    const el = document.querySelector('.ge-brush-cursor');
    return {
      borderColor: el.style.borderColor,
      isPixel: el.classList.contains('ge-brush-cursor--pixel'),
    };
  });
  expect(props.borderColor).toBe('rgba(255, 255, 255, 0.6)');
  expect(props.isPixel).toBe(false);
  // 3. Pixel brush (via tool / preset)
  await page.evaluate(async () => {
    const { state } = await import('/static/js/editor/state.js');
    state.tool = 'pixel';
    state.brushPixel = true;
    state.brushSize = 16;
  });
  await page.mouse.move(midX - 10, midY - 10);
  await checkCenter(midX - 10, midY - 10);
  props = await page.evaluate(() => {
    const el = document.querySelector('.ge-brush-cursor');
    return {
      isPixel: el.classList.contains('ge-brush-cursor--pixel'),
      width: parseFloat(el.style.width),
    };
  });
  expect(props.isPixel).toBe(true);
  // 4. Lasso tool
  await page.evaluate(async () => {
    const { state } = await import('/static/js/editor/state.js');
    state.tool = 'lasso';
    state.brushPixel = false;
  });
  await page.mouse.move(midX + 20, midY - 10);
  await checkCenter(midX + 20, midY - 10);
  props = await page.evaluate(() => {
    const el = document.querySelector('.ge-brush-cursor');
    return {
      borderColor: el.style.borderColor,
      background: el.style.background,
    };
  });
  expect(props.borderColor).toBe('rgba(255, 255, 255, 0.85)');
  expect(props.background).toBe('rgba(0, 0, 0, 0.15)');
  // 5. Inpaint tool (paint mode and erase mode)
  await page.evaluate(async () => {
    const { state } = await import('/static/js/editor/state.js');
    state.tool = 'inpaint';
    state.inpaintEraseMode = false;
  });
  await page.mouse.move(midX, midY);
  await checkCenter(midX, midY);
  props = await page.evaluate(() => {
    const el = document.querySelector('.ge-brush-cursor');
    return {
      borderColor: el.style.borderColor,
      background: el.style.background,
      borderStyle: el.style.borderStyle,
    };
  });
  expect(props.borderColor).toBe('rgba(255, 80, 80, 0.8)');
  expect(props.borderStyle).toBe('solid');
  // Inpaint erase mode
  await page.evaluate(async () => {
    const { state } = await import('/static/js/editor/state.js');
    state.inpaintEraseMode = true;
  });
  await page.mouse.move(midX + 5, midY + 5);
  props = await page.evaluate(() => {
    const el = document.querySelector('.ge-brush-cursor');
    return {
      borderColor: el.style.borderColor,
      borderStyle: el.style.borderStyle,
    };
  });
  expect(props.borderColor).toBe('rgba(255, 255, 255, 0.9)');
  expect(props.borderStyle).toBe('dashed');
  // 6. Liquify tool
  await page.evaluate(async () => {
    const { state } = await import('/static/js/editor/state.js');
    state.tool = 'liquify';
    state.liquifySize = 100;
  });
  await page.mouse.move(midX - 15, midY + 15);
  await checkCenter(midX - 15, midY + 15);
  props = await page.evaluate(() => {
    const el = document.querySelector('.ge-brush-cursor');
    return {
      width: parseFloat(el.style.width),
      height: parseFloat(el.style.height),
      display: el.style.display,
    };
  });
  expect(props.display).toBe('block');
  expect(props.width).toBeGreaterThan(0);
  // 7. Clone tool
  await page.evaluate(async () => {
    const { state } = await import('/static/js/editor/state.js');
    state.tool = 'clone';
    state.brushSize = 50;
  });
  await page.mouse.move(midX, midY);
  await checkCenter(midX, midY);
  await expect(cursor).toBeVisible();
  // Clean close
  await page.evaluate(async () => {
    const editor = await window.__photoEditorImport('/static/js/galleryEditor.js');
    editor.closeEditor({ force: true });
  });
  await expect(cursor).toHaveCount(0);
 });
 test('canvas boundaries, pointer exit and re-entry, and viewport resize', async ({ page }) => {
  await openBlankEditor(page, { width: 400, height: 300 });
  await selectTool(page, 'brush');
  const canvas = await page.locator('.ge-main-canvas').boundingBox();
  const cursor = page.locator('.ge-brush-cursor');
  const checkCenter = async (x, y) => {
    await expect.poll(async () => {
      const box = await cursor.boundingBox();
      return box ? Math.max(Math.abs(box.x + box.width / 2 - x), Math.abs(box.y + box.height / 2 - y)) : Infinity;
    }).toBeLessThan(1);
  };
  // 1. Enter canvas
  const insideX = canvas.x + canvas.width * 0.5;
  const insideY = canvas.y + canvas.height * 0.5;
  await page.mouse.move(insideX, insideY);
  await expect(cursor).toBeVisible();
  await checkCenter(insideX, insideY);
  // 2. Exit canvas boundary: cursor should hide
  const outsideX = canvas.x - 50;
  const outsideY = canvas.y - 50;
  await page.mouse.move(outsideX, outsideY);
  await expect(cursor).toBeHidden();
  // 3. Re-enter canvas: cursor should restore visibility and position
  await page.mouse.move(insideX, insideY);
  await expect(cursor).toBeVisible();
  await checkCenter(insideX, insideY);
  // 4. Viewport resize
  await page.setViewportSize({ width: 1280, height: 800 });
  await page.waitForTimeout(100);
  const newCanvas = await page.locator('.ge-main-canvas').boundingBox();
  const newInsideX = newCanvas.x + newCanvas.width * 0.5;
  const newInsideY = newCanvas.y + newCanvas.height * 0.5;
  await page.mouse.move(newInsideX, newInsideY);
  await expect(cursor).toBeVisible();
  await checkCenter(newInsideX, newInsideY);
  // Clean close
  await page.evaluate(async () => {
    const editor = await window.__photoEditorImport('/static/js/galleryEditor.js');
    editor.closeEditor({ force: true });
  });
  await expect(cursor).toHaveCount(0);
 });
 for (const view of ['2x zoom', 'fit-to-view']) {
  test(`zoom and fit-to-view cursor scaling and positioning: ${view}`, async ({ page }) => {
    const size = view === '2x zoom' ? { width: 400, height: 300 } : { width: 1600, height: 1200 };
    await openBlankEditor(page, size);
    await selectTool(page, 'brush');
    await page.evaluate(async () => {
      const { state } = await import('/static/js/editor/state.js');
      state.brushSize = 50;
      // The zoom-in control applies 1.25x through the real zoom handler.
      state.zoom = 1.6;
      state.zoomViewMode = 'scale';
    });
    await page.locator('#ge-zoom-in').click();
    await expect.poll(() => page.evaluate(async () => {
      const { state } = await import('/static/js/editor/state.js');
      return { zoom: state.zoom, mode: state.zoomViewMode };
    })).toEqual({ zoom: 2, mode: 'scale' });
    if (view === 'fit-to-view') {
      await page.locator('#ge-zoom-100').click();
      const fitted = await page.evaluate(async () => {
        const { state } = await import('/static/js/editor/state.js');
        const area = document.querySelector('.ge-canvas-area');
        const pad = state._footerDocked ? 0 : 20;
        const rulerPad = state.rulersVisible ? 18 : 0;
        return {
          zoom: state.zoom,
          mode: state.zoomViewMode,
          expectedZoom: Math.min(1,
            (area.clientWidth - 2 * pad - rulerPad) / state.imgWidth,
            (area.clientHeight - 2 * pad - rulerPad) / state.imgHeight),
        };
      });
      expect(fitted.mode).toBe('fit');
      expect(fitted.zoom).toBeGreaterThan(0);
      expect(fitted.zoom).toBeLessThan(1);
      expect(fitted.zoom).toBeCloseTo(fitted.expectedZoom, 6);
    }
    const canvas = page.locator('.ge-main-canvas');
    const canvasBox = await canvas.boundingBox();
    const cursor = page.locator('.ge-brush-cursor');
    if (view === '2x zoom') {
      expect(canvasBox.width).toBeCloseTo(size.width * 2, 1);
      expect(canvasBox.height).toBeCloseTo(size.height * 2, 1);
    }
    const targetX = canvasBox.x + canvasBox.width * 0.4;
    const targetY = canvasBox.y + canvasBox.height * 0.4;
    await page.mouse.move(targetX, targetY);
    await expect(cursor).toBeVisible();
    // Pointer coordinates can be rounded to device pixels; keep the existing
    // subpixel alignment tolerance separate from the stricter diameter check.
    await expect.poll(async () => {
      const box = await cursor.boundingBox();
      return box ? Math.max(
        Math.abs(box.x + box.width / 2 - targetX),
        Math.abs(box.y + box.height / 2 - targetY),
      ) : Infinity;
    }).toBeLessThan(1);
    await expect.poll(() => page.evaluate(() => {
      const canvasEl = document.querySelector('.ge-main-canvas');
      const canvasRect = canvasEl.getBoundingClientRect();
      const cursorRect = document.querySelector('.ge-brush-cursor').getBoundingClientRect();
      return Math.max(
        Math.abs(cursorRect.width - 50 * canvasRect.width / canvasEl.width),
        Math.abs(cursorRect.height - 50 * canvasRect.height / canvasEl.height),
      );
    })).toBeLessThan(0.1);
    await page.evaluate(async () => {
      const editor = await window.__photoEditorImport('/static/js/galleryEditor.js');
      editor.closeEditor({ force: true });
    });
    await expect(cursor).toHaveCount(0);
  });
 }
 test('memory and lifecycle: repeated editor open/close cycles retain no detached cursors or active animations', async ({ page }) => {
  for (let cycle = 0; cycle < 5; cycle++) {
    await openBlankEditor(page, { width: 400, height: 300 });
    await selectTool(page, 'brush');
    const canvas = await page.locator('.ge-main-canvas').boundingBox();
    await page.mouse.move(canvas.x + canvas.width * 0.5, canvas.y + canvas.height * 0.5);
    const cursor = page.locator('.ge-brush-cursor');
    await expect(cursor).toBeVisible();
    // Verify cursor layer and animation are active
    const cycleState = await page.evaluate(() => {
      const el = document.querySelector('.ge-brush-cursor');
      window.__lastCycleAnim = el?._positionAnimation;
      return {
        cursorCount: document.querySelectorAll('.ge-brush-cursor').length,
        layerCount: document.querySelectorAll('#ge-cursor-layer').length,
        hasAnim: Boolean(el?._positionAnimation),
        animPaused: el?._positionAnimation?.playState === 'paused',
      };
    });
    expect(cycleState.cursorCount).toBe(1);
    expect(cycleState.layerCount).toBe(1);
    expect(cycleState.animPaused).toBe(true);
    // Close editor
    await page.evaluate(async () => {
      const editor = await window.__photoEditorImport('/static/js/galleryEditor.js');
      editor.closeEditor({ force: true });
    });
    // Verify complete cleanup after close
    await expect(cursor).toHaveCount(0);
    const postClose = await page.evaluate(() => {
      const anim = window.__lastCycleAnim;
      delete window.__lastCycleAnim;
      return {
        cursorCount: document.querySelectorAll('.ge-brush-cursor').length,
        layerCount: document.querySelectorAll('#ge-cursor-layer').length,
        animIdle: anim ? anim.playState === 'idle' : true,
        activeAnims: document.getAnimations().filter(a => {
          const target = a.effect?.target;
          return target && (target.classList?.contains('ge-brush-cursor') || target.id === 'ge-cursor-layer');
        }).length,
      };
    });
    expect(postClose.cursorCount).toBe(0);
    expect(postClose.layerCount).toBe(0);
    expect(postClose.animIdle).toBe(true);
    expect(postClose.activeAnims).toBe(0);
  }
 });
@@ -35,7 +35,7 @@ test('brush presets and shared stroke controls remain reusable', async ({ page }
  await expect(page.locator('#ge-brush-preset option', { hasText: 'My Detail Brush' })).toHaveCount(0);
 });
-test('long sampled strokes stay responsive and undo atomically', async ({ page, browserName }, testInfo) => {
+test('long sampled strokes stay responsive and undo atomically', async ({ page }) => {
  await openBlankEditor(page);
  await selectTool(page, 'brush');
  await page.locator('.ge-size-slider').fill('700');
@@ -49,45 +49,13 @@ test('long sampled strokes stay responsive and undo atomically', async ({ page,
  const before = await flattenedPixelDigest(page);
  const start = await canvasPoint(page, 0.08, 0.5);
  const end = await canvasPoint(page, 0.92, 0.5);
  // Playwright delivers stepped moves at frame cadence: 240 events already
  // cost ~4s on an inert page. Measure that transport cost with the same input,
  // and separately bound real Chromium main-thread work at the original5s.
  const control = await page.context().newPage();
  let controlDuration;
  try {
    await control.setContent('<canvas style="position:fixed;inset:0;width:100vw;height:100vh"></canvas>');
    const started = Date.now();
    await control.mouse.move(start.x, start.y);
    await control.mouse.down();
    await control.mouse.move(end.x, end.y, { steps: 240 });
    await control.mouse.up();
    controlDuration = Date.now() - started;
  } finally {
    await control.close();
    await page.bringToFront();
  }
  const metrics = browserName === 'chromium' ? await page.context().newCDPSession(page) : null;
  if (metrics) await metrics.send('Performance.enable');
  const taskTime = async () => (await metrics.send('Performance.getMetrics')).metrics.find(item => item.name === 'TaskDuration').value *1000;
  const metricSnapshot = async () => Object.fromEntries((await metrics.send('Performance.getMetrics')).metrics.filter(x => ['TaskDuration','ScriptDuration','LayoutDuration','RecalcStyleDuration'].includes(x.name)).map(x => [x.name, x.value * 1000]));
  const beforeMetrics = metrics ? await metricSnapshot() : {};
  const beforeTask = metrics ? await taskTime() : null;
  const startedAt = Date.now();
  await page.mouse.move(start.x, start.y);
  await page.mouse.down();
  await page.mouse.move(end.x, end.y, { steps: 240 });
  await page.mouse.up();
  const strokeDuration = Date.now() - startedAt;
-  if (process.env.BRUSH_DIAGNOSTIC_STALL === '1') await page.evaluate(() => { const until = performance.now() + 6000; while (performance.now() < until) {} });
+  expect(strokeDuration).toBeLessThan(5000);
  const mainThreadDuration = metrics ? (await taskTime()) - beforeTask : null;
  const afterMetrics = metrics ? await metricSnapshot() : {};
  console.log('BRUSH_DIAGNOSTIC ' + JSON.stringify({mode: process.env.BRUSH_DIAGNOSTIC_MODE, samples: 240, strokeDuration, controlDuration, mainThreadDuration, breakdown: Object.fromEntries(Object.keys(beforeMetrics).map(k => [k, afterMetrics[k] - beforeMetrics[k]]))}));
  if (metrics) await metrics.detach();
  await testInfo.attach('stroke-timing', { body: Buffer.from(JSON.stringify({
    samples: 240, strokeDuration, controlDuration, mainThreadDuration,
  })), contentType: 'application/json' });
  expect(strokeDuration - controlDuration).toBeLessThan(5000);
  if (mainThreadDuration !== null) expect(mainThreadDuration).toBeLessThan(5000);
  const after = await flattenedPixelDigest(page);
  expect(after).not.toEqual(before);
  await expect(thumb).toHaveAttribute('width', '68');
@@ -1,21 +0,0 @@
 const { test, expect } = require('@playwright/test');
 const { spawnSync } = require('node:child_process');
 const path = require('node:path');
 // The previously opt-in node:test now uses only this config's owned app/account.
 // Its native JUnit report retains its authored identity; this case is a driver.
 test('native email reply regression on the disposable authenticated app', async ({ context, baseURL }, testInfo) => {
  const origin = new URL(baseURL);
  expect(origin.hostname).toBe('127.0.0.1');
  const cookie = (await context.cookies(baseURL)).find(item => item.name === 'odysseus_session');
  expect(cookie?.value).toBeTruthy();
  const report = testInfo.outputPath('native-email-junit.xml');
  const result = spawnSync(process.execPath, ['--test', '--test-reporter=spec', '--test-reporter-destination=stdout',
    '--test-reporter=junit', `--test-reporter-destination=${report}`, 'tests/emailReplyBrowser.test.mjs'], {
    cwd: path.resolve(__dirname, '../../..'), encoding: 'utf8', timeout: 80_000,
    env: { ...process.env, ODYSSEUS_UI_TEST_URL: baseURL, ODYSSEUS_UI_TEST_COOKIE: cookie.value },
  });
  console.log(result.stdout);
  expect(result.error, String(result.error)).toBeUndefined();
  expect(result.status, result.stdout + result.stderr).toBe(0);
 });
@@ -2,12 +2,6 @@ const fs = require('node:fs');
 const os = require('node:os');
 const path = require('node:path');
 const { defineConfig } = require('@playwright/test');
 const { disposableCIArtifacts, marker } = require('./artifact-policy');
 const isCI = Boolean(process.env.CI) || Boolean(process.env.GITHUB_ACTIONS);
 const disposableOptIn = isCI && process.env.ODYSSEUS_E2E_DISPOSABLE_ARTIFACTS === '1';
 if (disposableOptIn && (process.env.PHOTO_EDITOR_E2E_DATA_DIR || process.env.PHOTO_EDITOR_E2E_DB_PATH || process.env.PHOTO_EDITOR_E2E_AUTH === '0') && !disposableCIArtifacts()) {
  throw new Error('CI artifact opt-in requires fresh authenticated fixture paths');
 }
 const port = Number(process.env.PHOTO_EDITOR_E2E_PORT || 7013);
 const baseURL = `http://127.0.0.1:${port}`;
@@ -30,9 +24,7 @@ if (!['chromium', 'firefox', 'webkit'].includes(browserName)) {
  throw new Error(`Unsupported PHOTO_EDITOR_E2E_BROWSER: ${browserName}`);
 }
-if (disposableOptIn) {
+const isCI = Boolean(process.env.CI) || Boolean(process.env.GITHUB_ACTIONS);
  fs.writeFileSync(path.join(dataDirectory, marker), JSON.stringify({ synthetic: true, authenticated: true, database: databasePath }));
 }
 const traceOptIn = !isCI && ['1', 'true'].includes(String(process.env.PLAYWRIGHT_ENABLE_TRACE || '').toLowerCase());
 module.exports = defineConfig({
@@ -40,8 +32,6 @@ module.exports = defineConfig({
  outputDir: path.join(__dirname, '..', '..', 'test-results', 'photo-editor'),
  timeout: 90_000,
  expect: { timeout: 10_000 },
  forbidOnly: isCI,
  retries: 0,
  fullyParallel: false,
  workers: 1,
  reporter: isCI ? 'line' : 'line',
@@ -59,9 +49,9 @@ module.exports = defineConfig({
    serviceWorkers: 'block',
    ...(authenticated ? { storageState: path.join(dataDirectory, 'browser-auth.json') } : {}),
    screenshot: 'only-on-failure',
-    // Default CI suppression remains; only the fresh synthetic fixture opts in.
+    // Unconditional CI trace suppression: Playwright traces are NEVER recorded in CI.
    // Local developer tracing requires explicit PLAYWRIGHT_ENABLE_TRACE=1.
-    trace: (traceOptIn || disposableCIArtifacts()) ? 'retain-on-failure' : 'off',
+    trace: traceOptIn ? 'retain-on-failure' : 'off',
  },
  webServer: {
    command: `${JSON.stringify(python)} -m uvicorn app:app --host 127.0.0.1 --port ${port}`,
@@ -75,10 +65,6 @@ module.exports = defineConfig({
      DATABASE_URL: `sqlite:///${databasePath}`,
      ODYSSEUS_DATA_DIR: dataDirectory,
      ODYSSEUS_STARTUP_WARMUPS: '0',
      ODYSSEUS_TOOL_INDEX_PREWARM: '0',
      ODYSSEUS_BROWSER_MCP_REQUIRE_CACHE: '1',
      npm_config_offline: 'true',
      npm_config_cache: path.join(dataDirectory, 'npm-cache'),
      RESPONSE_COMPRESSION_ENABLED: 'false',
    },
  },
@@ -2,7 +2,6 @@ const fs = require('node:fs');
 const os = require('node:os');
 const path = require('node:path');
 const { execFileSync } = require('node:child_process');
 const { disposableCIArtifacts } = require('./artifact-policy');
 const repoRoot = path.resolve(__dirname, '..', '..');
 const defaultResultsDir = path.join(repoRoot, 'test-results');
@@ -30,9 +29,6 @@ module.exports = async (options = {}) => {
  const isPlaywrightConfig = options && (options.configFile || options.rootDir);
  const testOpts = (!isPlaywrightConfig && typeof options === 'object') ? options : {};
  // Validate fixture ownership before removing its temporary directory.
  const disposableCI = disposableCIArtifacts();
  // Confine cleanup of PHOTO_EDITOR_E2E_DATA_DIR:
  // Strictly require it to be within an OS temporary directory and match the expected test prefix
  const dataDirectory = process.env.PHOTO_EDITOR_E2E_DATA_DIR;
@@ -104,7 +100,7 @@ module.exports = async (options = {}) => {
    const isCI = Boolean(process.env.CI) || Boolean(process.env.GITHUB_ACTIONS);
    const traceOptIn = !isCI && ['1', 'true'].includes(String(process.env.PLAYWRIGHT_ENABLE_TRACE || '').toLowerCase());
-    if ((isCI && !disposableCI) || (!traceOptIn && !disposableCI)) {
+    if (isCI || !traceOptIn) {
      // In CI or default local runs, purge all sensitive trace archives and artifacts
      purgeSensitiveArtifacts(resultsDir);
    } else {
@@ -128,8 +124,7 @@ module.exports = async (options = {}) => {
      if (!sanitizerSucceeded) {
        // Fail closed: purge all remaining zip or tmp archives
-        if (disposableCI) purgeSensitiveArtifacts(resultsDir);
+        purgeZipAndTmp(resultsDir);
        else purgeZipAndTmp(resultsDir);
      }
    }
  }
@@ -1,71 +0,0 @@
 {
  "native-ci": [
    "tests/backgroundToolJobs.test.mjs",
    "tests/chatEditorProgress.test.mjs",
    "tests/chatImageDeletion.test.mjs",
    "tests/chatPhotoEditorIntegrity.test.mjs",
    "tests/chatProcessingHandoff.test.mjs",
    "tests/copyChatHeader.test.mjs",
    "tests/emailReplyStream.test.mjs",
    "tests/galleryModelPickerSync.test.mjs",
    "tests/generatedImageResult.test.mjs",
    "tests/researchMobileButtons.test.mjs",
    "tests/schemaThinkingProbe.test.mjs",
    "tests/sidebarNewChat.test.mjs",
    "tests/skillsApproval.test.mjs",
    "tests/streamingRendererRaf.test.mjs",
    "tests/toolFollowupOracle.test.mjs",
    "tests/tool_followup_oracle.test.mjs"
  ],
  "browser-ci": [
    "tests/emailReplyBrowser.test.mjs"
  ],
  "python-ci": {
    "tests/historyResumeRendering.test.mjs": [
      "tests/test_history_resume_rendering_js.py",
      "tests/test_live_fallback_round_attribution.py"
    ],
    "tests/live_thinking_scheduler.test.mjs": [
      "tests/test_live_thinking_scheduler_js.py"
    ],
    "tests/noteTestOracle.test.mjs": [
      "tests/test_notes_reference_contracts_js.py"
    ],
    "tests/notesApplication.test.mjs": [
      "tests/test_notes_reference_contracts_js.py"
    ],
    "tests/notesCharacterization.test.mjs": [
      "tests/test_notes_reference_contracts_js.py"
    ],
    "tests/notesDraftAutosave.test.mjs": [
      "tests/test_notes_reference_contracts_js.py"
    ],
    "tests/notesInfrastructure.test.mjs": [
      "tests/test_notes_reference_contracts_js.py"
    ],
    "tests/notesRecurrence.test.mjs": [
      "tests/test_notes_reference_contracts_js.py"
    ],
    "tests/notesReminders.test.mjs": [
      "tests/test_notes_reference_contracts_js.py"
    ],
    "tests/notesWorkflows.test.mjs": [
      "tests/test_notes_reference_contracts_js.py"
    ],
    "tests/selectedNotesContext.test.mjs": [
      "tests/test_notes_reference_contracts_js.py"
    ],
    "tests/streaming/invariant.test.mjs": [
      "tests/test_streaming_segmenter_js.py"
    ],
    "tests/streaming/segmenter.test.mjs": [
      "tests/test_streaming_segmenter_js.py"
    ],
    "tests/turnRendering.test.mjs": [
      "tests/test_turn_rendering_js.py"
    ]
  },
  "architecture-ci": [
    "tests/frontendArchitecture.test.mjs"
  ]
 }
@@ -14,12 +14,22 @@ from routes.auth_routes import SESSION_COOKIE
 from tests.helpers.database import disposable_database
-@pytest.fixture
+@pytest.fixture(scope="module")
-def authenticated_app(tmp_path, monkeypatch):
+def auth_configuration(tmp_path_factory):
-    monkeypatch.setenv("AUTH_ENABLED", "true")
+    """Hash real fixture passwords once; only immutable bytes are reused."""
-    auth = AuthManager(str(tmp_path / "auth.json"))
+    path = tmp_path_factory.mktemp("admin-auth-seed") / "auth.json"
    auth = AuthManager(str(path))
    for user, admin in (("member", False), ("admin", True)):
        assert auth.create_user(user, "disposable-test-password", is_admin=admin)
    return path.read_bytes()
@pytest.fixture
 def authenticated_app(tmp_path, monkeypatch, auth_configuration):
    monkeypatch.setenv("AUTH_ENABLED", "true")
    path = tmp_path / "auth.json"
    path.write_bytes(auth_configuration)
    auth = AuthManager(str(path))
    app = FastAPI()
    app.state.auth_manager = auth
@@ -133,3 +143,17 @@ def test_diagnostics_require_real_admin_before_sensitive_work(
        for operation in (stats, rag.get_stats, research.call_research_service,
                          extract_id, transcript, collect, read_log):
            operation.assert_not_called()
@pytest.mark.parametrize("instance", [0, 1])
 def test_authenticated_fixture_has_private_users_sessions_and_file(authenticated_app, instance):
    app, client_for = authenticated_app
    auth = app.state.auth_manager
    assert set(auth.users) == {"member", "admin"}
    assert not auth._sessions
    with client_for("member") as client:
        assert auth.get_username_for_token(client.cookies.get(SESSION_COOKIE)) == "member"
    assert auth.create_user("fixture-local", "disposable-test-password")
    # Both parameter cases mutate their own file. Any shared manager, mutable
    # users/sessions or written-back seed makes the next case fail, in any order.
    assert "fixture-local" in auth.users
@@ -1929,23 +1929,60 @@ def test_place_layer_reports_false_on_queued_response(monkeypatch):
    assert placed is False
-def test_bridge_await_cancellation_handled_cleanly():
+def test_bridge_await_cancellation_handled_cleanly(monkeypatch):
    import asyncio
    from contextlib import suppress
    from httpx import ASGITransport, AsyncClient
    app = _bridge_app()
    async def scenario():
        entered_wait = asyncio.Event()
        real_wait_for = asyncio.wait_for
        waits = []
        async def observe_wait(awaitable, timeout):
            # Observe the real wait; do not replace its result or cancellation.
            waits.append(awaitable)
            entered_wait.set()
            return await real_wait_for(awaitable, timeout)
        monkeypatch.setattr(eaar.asyncio, "wait_for", observe_wait)
        async with AsyncClient(transport=ASGITransport(app=app), base_url="http://test") as c:
            cmd_resp = await c.post("/api/editor/bridge/command", json={"session": "cancel-sess", "op": "document.info", "wait": False})
            assert cmd_resp.status_code == 200
            assert cmd_resp.json()["completed"] is False
            cid = cmd_resp.json()["queued"][0]
            await_task = asyncio.create_task(c.post("/api/editor/bridge/await", json={"id": cid, "timeout": 30}))
            await asyncio.sleep(0.05)
            await_task.cancel()
            try:
-                await await_task
+                await real_wait_for(entered_wait.wait(), 5)
-            except asyncio.CancelledError:
+                assert len(waits) == 1
-                pass
+                assert not waits[0].done()
                assert not await_task.done(), "await returned without a queued result"
                await_task.cancel()
                response = await real_wait_for(await_task, 5)
                assert response.status_code == 200
                assert response.json() == {
                    "ok": False, "error": "cancelled", "status": "cancelled",
                    "completed": False, "id": cid,
                }
            finally:
                if not await_task.done():
                    await_task.cancel()
                    with suppress(asyncio.CancelledError):
                        await await_task
            # Cancelling the waiter must not cancel the queued command itself.
            payload = {"width": 137, "height": 251}
            delivered = await c.post("/api/editor/bridge/result", json={"id": cid, "ok": True, "result": payload})
            assert delivered.status_code == 200
            completed = await c.post("/api/editor/bridge/await", json={"id": cid, "timeout": 1})
            assert completed.status_code == 200
            assert completed.json()["status"] == "completed"
            assert completed.json()["completed"] is True
            assert completed.json()["ok"] is True
            assert completed.json()["result"] == payload
            assert len(waits) == 2
    asyncio.run(scenario())
@@ -0,0 +1,71 @@
 """An unknown context window must not be budgeted like a tiny local server (#6678).
 ``budget_context_for_model`` returns 0 when the endpoint does not prove its
 window, and ``compute_input_token_budget`` answers 0 with the conservative
 default budget. The agent loop's small-server clamp (``<= 8192``) also caught
 0 and cut the request to 1200 tokens, so an open document or earlier context
 of a few thousand tokens was trimmed away before the model saw it.
 """
 import inspect
 import json
 import pytest
 DONE = 'data: [DONE]\n\n'
 MARKER = 'NIGHTJAR-7'
 # ~3000 estimated tokens: over the old 1200 clamp, under the 6000 default.
 CONTEXT = ''.join(
    f'## Project-{n}\nOwner: team {n}. Status: active. Notes: routine maintenance '
    'and quarterly review scheduled for every workstream in this registry.\n\n'
    for n in range(60)
 ) + f'## Project-Alpha\nAlias: {MARKER}\n'
 def _event(payload):
    return 'data: ' + json.dumps(payload) + '\n\n'
 async def _first_request(monkeypatch, tmp_path, context_window):
    import src.agent_loop as al
    from tests.test_agent_runtime_context import _patch_fake_skills
    _patch_fake_skills(monkeypatch)
    monkeypatch.setattr('src.tool_index.get_tool_index', lambda: None)
    monkeypatch.setattr('src.model_context.budget_context_for_model',
                        lambda *args, **kwargs: context_window)
    seen = []
    async def provider(candidates, messages, **kwargs):
        # Like llm_core: the per-candidate factory shapes and trims the request.
        url, model, headers = candidates[0][:3]
        request = kwargs['candidate_request_factory'](0, url, model, headers)
        if inspect.isawaitable(request):
            request = await request
        seen.append((request or {}).get('messages', messages))
        yield _event({'delta': 'ok'})
        yield DONE
    monkeypatch.setattr(al, 'stream_llm_with_fallback', provider)
    history = [
        {'role': 'user', 'content': 'Keep this registry for later:\n\n' + CONTEXT},
        {'role': 'assistant', 'content': 'Saved.'},
        {'role': 'user', 'content': 'What is the alias of Project-Alpha?'},
    ]
    async for _ in al.stream_agent_loop('http://127.0.0.1:9/v1', 'model', history,
                                        max_rounds=1, workspace=str(tmp_path)):
        pass
    assert seen, 'the provider was never called'
    return json.dumps(seen[0])
@pytest.mark.asyncio
 async def test_unknown_context_window_keeps_earlier_context(monkeypatch, tmp_path):
    request = await _first_request(monkeypatch, tmp_path, 0)
    assert MARKER in request
@pytest.mark.asyncio
 async def test_known_small_window_is_still_clamped(monkeypatch, tmp_path):
    # The clamp exists for small local servers whose window is known (n_ctx
    # 2048 here); it must keep protecting them.
    request = await _first_request(monkeypatch, tmp_path, 2048)
    assert MARKER not in request
@@ -206,35 +206,50 @@ class TestDiskConsistency:
    @pytest.mark.slow
    def test_file_always_valid_json_during_concurrent_ops(self, tmp_path):
        mgr = _fresh_auth_manager(tmp_path)
-        mgr.create_user("admin", "adminpw", is_admin=True)
+        assert mgr.create_user("admin", "adminpw", is_admin=True)
        stop_event = threading.Event()
        reader_ready = threading.Event()
        corruption_found = []
        observations = {"reads": 0, "with_writes": 0}
        def reader():
            while not stop_event.is_set():
                try:
                    with open(mgr.auth_path, "r") as f:
                        content = f.read()
-                    json.loads(content)
+                    data = json.loads(content)
                    observations["reads"] += 1
                    if any(name.startswith("stress") for name in data["users"]):
                        observations["with_writes"] += 1
                    reader_ready.set()
                except json.JSONDecodeError as e:
                    corruption_found.append(str(e))
                    break
                except FileNotFoundError:
                    pass
                time.sleep(0.001)
        def writer():
            assert reader_ready.wait(5), "reader never observed the initial file"
            results = []
            for i in range(50):
-                mgr.create_user(f"stress{i}", f"pw{i}")
+                results.append(mgr.create_user(f"stress{i}", f"pw{i}"))
            return results
-        reader_thread = threading.Thread(target=reader)
+        # Futures propagate reader/writer exceptions to the test thread.
-        writer_thread = threading.Thread(target=writer)
+        with ThreadPoolExecutor(max_workers=2) as pool:
-
+            reading = pool.submit(reader)
-        reader_thread.start()
+            writing = pool.submit(writer)
-        writer_thread.start()
+            try:
-        writer_thread.join()
+                results = writing.result(timeout=120)
-        stop_event.set()
+            finally:
-        reader_thread.join()
+                stop_event.set()
            reading.result(timeout=5)
        assert not corruption_found, f"Corrupt JSON detected: {corruption_found[0]}"
        assert len(results) == 50 and all(results), "writer operations did not succeed"
        assert observations["reads"] > 0
        assert observations["with_writes"] > 0, "reader saw no persisted writer activity"
        expected = {"admin"} | {f"stress{i}" for i in range(50)}
        with open(mgr.auth_path) as persisted:
            assert set(json.load(persisted)["users"]) == expected
        assert set(_fresh_auth_manager(tmp_path).users) == expected
@@ -13,6 +13,7 @@ import socketserver
 import threading
 import pytest
 import requests
 from src import caldav_sync, caldav_writeback
@@ -26,12 +27,13 @@ def test_build_dav_client_disables_redirects():
 def test_dav_client_does_not_follow_redirect_to_internal_host():
    """End-to-end through the real DAVClient: a 302 toward an internal host
-    must NOT be followed. Without the fix the sink is contacted (SSRF); with it
+    must NOT be followed. Exercise the session limit separately because some
-    the redirect is refused and the sink is never reached."""
+    caldav versions independently refuse cross-origin PROPFIND redirects."""
    pytest.importorskip("caldav")
    sink_hits: list[str] = []
    public_methods: list[str] = []
    same_origin_hits: list[str] = []
    class _Internal(http.server.BaseHTTPRequestHandler):
        # Stand-in for an internal service the attacker redirects toward.
@@ -48,9 +50,15 @@ def test_dav_client_does_not_follow_redirect_to_internal_host():
    class _Public(http.server.BaseHTTPRequestHandler):
        # The "validated" public CalDAV server that redirects everything inward.
        def do_GET(self):  # noqa: N802
            if self.path == "/landing":
                same_origin_hits.append(self.path)
                self.send_response(200)
                self.end_headers()
                return
            public_methods.append(self.command)
            self.send_response(302)
-            self.send_header("Location", f"http://127.0.0.1:{internal_port}/leak")
+            location = "/landing" if self.path == "/same" else f"http://127.0.0.1:{internal_port}/leak"
            self.send_header("Location", location)
            self.end_headers()
        do_PROPFIND = do_GET
@@ -62,8 +70,10 @@ def test_dav_client_does_not_follow_redirect_to_internal_host():
    internal_port = internal.server_address[1]
    public = socketserver.TCPServer(("127.0.0.1", 0), _Public)
    public_port = public.server_address[1]
-    threading.Thread(target=internal.serve_forever, daemon=True).start()
+    internal_thread = threading.Thread(target=internal.serve_forever, daemon=True)
-    threading.Thread(target=public.serve_forever, daemon=True).start()
+    public_thread = threading.Thread(target=public.serve_forever, daemon=True)
    internal_thread.start()
    public_thread.start()
    try:
        public_url = f"http://127.0.0.1:{public_port}/dav"
        client = caldav_sync._build_dav_client(public_url, "u", "p")
@@ -82,17 +92,35 @@ def test_dav_client_does_not_follow_redirect_to_internal_host():
        assert public_methods in (["PROPFIND"], ["PROPFIND", "GET"]), public_methods
        assert sink_hits == [], "redirect toward an internal host must not be followed"
-        # Positive control: demonstrate that the sink would see the redirect
+        # GET redirects are handled by the HTTP session even in caldav 3.7.
-        # if the session's redirect protection were removed.
+        # This makes the cross-port SSRF assertion sensitive to our own limit.
        with pytest.raises(Exception, match="Exceeded 0 redirects"):
            client.request(public_url, "GET", "")
        assert sink_hits == [], "GET redirect toward the internal sink must be blocked"
        # requests can reach the cross-port sink when redirects are enabled,
        # even if DAVClient independently rejects cross-origin PROPFIND redirects.
        with requests.Session() as session:
            response = session.get(public_url, timeout=5)
            assert response.status_code == 207
        assert sink_hits == ["/leak"], "the cross-port redirect must reach the sink"
        # GET follows redirects at the HTTP session layer across these caldav
        # versions. Check the application's limit on a same-origin redirect too.
        same_url = f"http://127.0.0.1:{public_port}/same"
        with pytest.raises(Exception, match="Exceeded 0 redirects"):
            client.request(same_url, "GET", "")
        assert same_origin_hits == []
        client.session.max_redirects = 30
-        try:
+        client.request(same_url, "GET", "")
-            client.request(public_url, "PROPFIND", "")
+        assert same_origin_hits == ["/landing"]
        except Exception:
            pass  # The sink's response is intentionally not a valid DAV body.
        assert sink_hits == ["/leak"], "the test must detect a followed redirect"
    finally:
        internal.shutdown()
        public.shutdown()
        internal_thread.join()
        public_thread.join()
        internal.server_close()
        public.server_close()
 def test_sync_and_writeback_construct_clients_through_the_helper():
@@ -0,0 +1,35 @@
 """The CalDAV config routes answer 400 for a body that is JSON but not an object."""
 import asyncio
 import json
 from types import SimpleNamespace
 import pytest
 from fastapi import HTTPException
 from routes.calendar_routes import _json_object_body
 def _request(raw: bytes):
    async def _json():
        return json.loads(raw)
    return SimpleNamespace(json=_json)
 def _parse(raw: bytes):
    return asyncio.run(_json_object_body(_request(raw)))
 def test_object_body_is_returned():
    assert _parse(b'{"url": "https://dav.example/"}') == {"url": "https://dav.example/"}
@pytest.mark.parametrize("raw", [b"", b"not json"])
 def test_unreadable_body_counts_as_empty(raw):
    assert _parse(raw) == {}
@pytest.mark.parametrize("raw", [b"[]", b'"x"', b"5", b"null"])
 def test_non_object_body_is_a_400(raw):
    with pytest.raises(HTTPException) as exc:
        _parse(raw)
    assert exc.value.status_code == 400
@@ -0,0 +1,148 @@
 """Both chat tidy entry points retain saved conversations and still remove empties."""
 import asyncio
 from datetime import datetime, timedelta, timezone
 import pytest
 from fastapi import APIRouter, FastAPI
 from fastapi.testclient import TestClient
 from sqlalchemy import create_engine
 from sqlalchemy.orm import sessionmaker
 import core.database as database
 import core.session_manager as manager_module
 import routes.session_routes as routes
 import src.session_actions as actions
@pytest.fixture
 def tidy_api(tmp_path, monkeypatch):
    engine = create_engine(
        f"sqlite:///{(tmp_path / 'tidy.db').as_posix()}",
        connect_args={"check_same_thread": False},
    )
    database.Base.metadata.create_all(engine)
    factory = sessionmaker(bind=engine, autoflush=False)
    monkeypatch.setattr(database, "SessionLocal", factory)
    monkeypatch.setattr(manager_module, "SessionLocal", factory)
    monkeypatch.setattr(routes, "SessionLocal", factory)
    monkeypatch.setattr(routes, "router", APIRouter(prefix="/api"))
    monkeypatch.setattr(routes, "effective_user", lambda request: "alice")
    manager = manager_module.SessionManager.__new__(manager_module.SessionManager)
    manager.sessions = {}
    manager.upload_handler = None
    monkeypatch.setattr(manager, "get_sessions_for_user", lambda owner: {})
    app = FastAPI()
    app.include_router(routes.setup_session_routes(manager, {}))
    with TestClient(app) as client:
        yield client, factory, manager
    engine.dispose()
 def run_tidy(client, entrypoint):
    if entrypoint == "action":
        return asyncio.run(actions.run_auto_sort("alice", skip_llm=True))
    response = client.post("/api/sessions/auto-sort?skip_llm=true")
    assert response.status_code == 200, response.text
    return response.json()
@pytest.mark.parametrize("entrypoint", ["route", "action"])
@pytest.mark.parametrize("title,prompt", [
    ("New chat", "Please analyze the following contract and retain all details. " * 20),
    ("Contract analysis", "Review contract"),
    ("Chat: analysis", "Explain these results and retain the full answer"),
    ("Test", "Here is a large input that should be analyzed and retained"),
 ], ids=["generic-title", "short-prompt", "title-prefix", "test-title"])
 def test_tidy_preserves_nontrivial_saved_answer(tidy_api, title, prompt, entrypoint):
    client, factory, manager = tidy_api
    old = datetime.now(timezone.utc).replace(tzinfo=None) - timedelta(hours=2)
    answer = "Clause analysis and recommended changes.\n" * 2000
    with factory() as db:
        db.add(database.Session(
            id="valuable-chat", name=title, owner="alice", endpoint_url="", model="",
            archived=False, is_important=False, message_count=2,
            created_at=old, updated_at=old, last_accessed=old, last_message_at=old,
        ))
        db.commit()
        db.add_all([
            database.ChatMessage(id="prompt", session_id="valuable-chat", role="user",
                                 content=prompt, timestamp=old),
            database.ChatMessage(id="answer", session_id="valuable-chat", role="assistant",
                                 content=answer, timestamp=old + timedelta(seconds=1)),
        ])
        db.commit()
    run_tidy(client, entrypoint)
    with factory() as db:
        remaining = db.query(database.ChatMessage).filter_by(session_id="valuable-chat").count()
        survives = db.get(database.Session, "valuable-chat") is not None
    assert survives and remaining == 2, "Title/prompt heuristics must not erase saved answers"
    with factory() as db:
        assert db.get(database.ChatMessage, "answer").content == answer
@pytest.mark.parametrize("entrypoint", ["route", "action"])
@pytest.mark.parametrize("kind", ["unanswered", "greeting", "empty", "fresh-empty", "starred-empty", "archived", "other-owner", "incognito"])
 def test_tidy_cleanup_boundaries(tidy_api, entrypoint, kind):
    client, factory, manager = tidy_api
    now = datetime.now(timezone.utc).replace(tzinfo=None)
    timestamp = now if kind == "fresh-empty" else now - timedelta(hours=2)
    message = kind in {"unanswered", "greeting", "archived", "other-owner", "incognito"}
    with factory() as db:
        db.add(database.Session(
            id="boundary-chat", name="Incognito" if kind == "incognito" else "New chat",
            owner="bob" if kind == "other-owner" else "alice", endpoint_url="", model="",
            archived=kind == "archived", is_important=kind == "starred-empty",
            # Deliberately inaccurate metadata: cleanup must use message rows.
            message_count=0 if message else 40,
            created_at=timestamp, updated_at=timestamp, last_accessed=timestamp, last_message_at=timestamp,
        ))
        db.commit()
        if message:
            db.add(database.ChatMessage(id="boundary-message", session_id="boundary-chat", role="user",
                                        content="hi" if kind == "greeting" else "Pending question " * 100,
                                        timestamp=timestamp))
            db.commit()
    run_tidy(client, entrypoint)
    deleted = kind in {"empty", "incognito"}
    with factory() as db:
        assert (db.get(database.Session, "boundary-chat") is None) == deleted
        assert db.query(database.ChatMessage).filter_by(session_id="boundary-chat").count() == int(message and not deleted)
@pytest.mark.parametrize("entrypoint", ["route", "action"])
 def test_tidy_keeps_folder_assignment_working(tidy_api, monkeypatch, entrypoint):
    from types import SimpleNamespace
    import src.llm_core as llm
    import src.task_endpoint as endpoints
    client, factory, manager = tidy_api
    old = datetime.now(timezone.utc).replace(tzinfo=None) - timedelta(hours=2)
    for sid in ["chat-one-long-id", "chat-two-long-id"]:
        with factory() as db:
            db.add(database.Session(id=sid, name="New chat", owner="alice", endpoint_url="", model="",
                                    archived=False, created_at=old, updated_at=old,
                                    last_accessed=old, last_message_at=old))
            db.commit()
            db.add(database.ChatMessage(id=f"{sid}-message", session_id=sid, role="user",
                                        content="Saved question", timestamp=old))
            db.commit()
        manager.sessions[sid] = SimpleNamespace(id=sid, name="New chat", archived=False,
                                                updated_at=old.isoformat(), created_at=old.isoformat())
    monkeypatch.setattr(manager, "get_sessions_for_user", lambda owner: manager.sessions)
    monkeypatch.setattr(endpoints, "resolve_task_endpoint", lambda *args, **kwargs: ("http://model.invalid", "test", {}))
    response_text = '{"folders":{"Projects":["chat-one","chat-two"]}}'
    monkeypatch.setattr(llm, "llm_call", lambda *args, **kwargs: response_text)
    async def async_response(*args, **kwargs):
        return response_text
    monkeypatch.setattr(llm, "llm_call_async", async_response)
    if entrypoint == "action":
        result = asyncio.run(actions.run_auto_sort("alice"))
        assert "Sorted 2 sessions" in result
    else:
        response = client.post("/api/sessions/auto-sort")
        assert response.status_code == 200, response.text
        assert response.json()["updated"] == 2
    with factory() as db:
        assert db.query(database.ChatMessage).count() == 2
        assert {row.folder for row in db.query(database.Session).all()} == {"Projects"}
@@ -7,13 +7,13 @@ CalendarCal.owner; the query must join it, like routes/calendar_routes.
 """
 import uuid
 import sys
-from datetime import datetime
+from datetime import datetime, timedelta
 import pytest
 from tests.helpers.database import disposable_database
 from core.database import CalendarEvent, CalendarCal
-from src.task_scheduler import _checkin_calendar_events
+from src.task_scheduler import _checkin_calendar_events, _digest_windows
@pytest.fixture(autouse=True)
@@ -68,3 +68,44 @@ def test_cancelled_excluded_and_window_respected():
        assert "cancelled" not in [ev.summary for ev in out]
    finally:
        db.close()
@pytest.mark.parametrize("days, expected_label", [(2, "this_week"), (7, "next_30_days")])
 def test_boundary_event_appears_in_only_one_digest_window(days, expected_label):
    now = datetime(2026, 6, 1, 9)
    boundary = now + timedelta(days=days)
    with _TS() as db:
        db.add(CalendarCal(id="boundary-cal", owner="alice", name="Boundary"))
        db.add(CalendarEvent(
            uid="boundary-event", calendar_id="boundary-cal", summary="Boundary meeting",
            dtstart=boundary, dtend=boundary + timedelta(hours=1), status="confirmed",
        ))
        db.commit()
        buckets = [
            label for label, start, end in _digest_windows(now)
            if _checkin_calendar_events(db, "alice", start, end)
        ]
        assert buckets == [expected_label]
 def test_digest_includes_start_and_excludes_end():
    start = datetime(2026, 6, 1, 9)
    end = start + timedelta(days=2)
    with _TS() as db:
        db.add(CalendarCal(id="bounds-cal", owner="alice", name="Bounds"))
        for uid, when in [
            ("before", start - timedelta(seconds=1)),
            ("start", start),
            ("inside", end - timedelta(seconds=1)),
            ("end", end),
        ]:
            db.add(CalendarEvent(
                uid=uid, calendar_id="bounds-cal", summary=uid, dtstart=when,
                dtend=when + timedelta(hours=1), status="confirmed",
            ))
        db.commit()
        assert [ev.uid for ev in _checkin_calendar_events(db, "alice", start, end)] == [
            "start", "inside",
        ]
@@ -0,0 +1,70 @@
 """Compare's actual stream consumer must preserve evidence and terminal state."""
 import json
 import shutil
 import subprocess
 from pathlib import Path
 import pytest
 ROOT = Path(__file__).resolve().parents[1]
 CASES = [
    ("lf", 'data: {"delta":"Hello"}\n\ndata: [DONE]\n\n', False, True, "Hello"),
    ("crlf", 'data:{"delta":"Héllö"}\r\n\r\ndata:[DONE]\r\n\r\n', False, True, "Héllö"),
    ("multiline", 'data: {"delta":\ndata: "Hello"}\n\ndata: [DONE]\n\n', False, True, "Hello"),
    ("eof", 'data: {"delta":"Partial"}\n\n', False, False, "ended before completion"),
    ("named-error", 'event: error\ndata: {"text":"Provider Z private-model failed"}\n\n', False, False, "Provider Z private-model failed"),
    ("typed-error", 'data: {"type":"error","data":{"message":"Provider Z <img src=x onerror=alert(1)>"}}\n\ndata: [DONE]\n\n', False, False, "Provider Z <img"),
    ("blind-error", 'event:error\ndata:{"message":"Provider Z private-model failed"}\n\n', True, False, "request failed"),
    ("empty-error", 'event:error\ndata:\n\n', False, False, "request failed"),
    ("done-open", 'data: {"delta":"Hello"}\n\ndata: [DONE]\n\n', False, True, "Hello"),
    ("heartbeat", 'data: {"delta":"Hello"}\n\ndata: [DONE]\n\n', False, True, "Hello"),
    ("cr", 'data: {"delta":"Hello"}\r\rdata:[DONE]\r\r', False, True, "Hello"),
    ("invalid", 'data: not-json\n\ndata: [DONE]\n\n', False, False, "Invalid model stream data"),
 ]
@pytest.mark.parametrize("kind,wire,blind,success,text", CASES)
 def test_compare_stream_contract(kind, wire, blind, success, text):
    if not shutil.which("node"):
        pytest.skip("node not installed")
    script = r"""
 const assert=require('node:assert/strict');
 let chromium;try{({chromium}=require('playwright'));}catch(e){if(e.code==='MODULE_NOT_FOUND')process.exit(77);throw e;}
 (async()=>{
 const browser=await chromium.launch({headless:true});
 try{
  const page=await browser.newPage();
  await page.goto(process.env.ODYSSEUS_TEST_STATIC_ORIGIN+'/static/js/storage.js');
  await page.setContent('<div class="compare-pane" data-pane="0"><div id="cmp-badge-0"></div><div id="cmp-history-0"><div class="msg msg-ai"><div class="body"></div></div></div></div>');
  const result=await page.evaluate(async(data)=>{
   const {default:state}=await import('/static/js/compare/state.js');
   const {streamToPane}=await import('/static/js/compare/stream.js');
   Object.assign(state,{isActive:true,_selectedModels:[{model:'fixture',name:'Fixture'}],_paneSessionIds:['session'],_compareMode:'chat',_parallel:true,_blindMode:data.blind,_timeout:data.kind==='heartbeat'?1:5});
   const nativeFetch=window.fetch,bytes=new TextEncoder().encode(data.wire);let index=0,cancelled=false,context=null;
   window.fetch=async(url,options)=>{
    if(!String(url).endsWith('/api/chat_stream'))return nativeFetch(url,options);
    context=options.body.get('search_context');
    const heartbeats=[...Array(6).fill(': ping\n\n'),data.wire];
    return new Response(new ReadableStream({start(controller){options.signal.addEventListener('abort',()=>controller.error(new DOMException('Stopped','AbortError')),{once:true});},async pull(controller){if(data.kind==='heartbeat'){if(index<heartbeats.length){await new Promise(r=>setTimeout(r,200));controller.enqueue(new TextEncoder().encode(heartbeats[index++]));}else controller.close();}else if(index<bytes.length)controller.enqueue(bytes.slice(index,index+=1));else if(data.kind!=='done-open')controller.close();},cancel(){cancelled=true;}}),{headers:{'Content-Type':'text/event-stream'}});
   };
   const message=document.querySelector('.msg-ai'),spinner=document.createElement('span');let spinnerDestroyed=false;spinner.textContent='Loading';message.querySelector('.body').appendChild(spinner);message._spinner={element:spinner,destroy(){spinnerDestroyed=true;spinner.remove();}};
   await Promise.race([streamToPane(0,'session','Prompt',message,{skipBadge:true}),new Promise((_,reject)=>setTimeout(()=>reject(Error('Consumer did not finish at DONE')),data.kind==='heartbeat'?6000:1500))]);
   const pane=document.querySelector('.compare-pane');
   return {done:pane.classList.contains('is-done'),failed:pane.classList.contains('is-failed'),text:pane.innerText,images:pane.querySelectorAll('img').length,cancelled,spinnerDestroyed,spinnerOwned:!!message._spinner};
  },JSON.parse(process.argv[1]));
  const expected=JSON.parse(process.argv[1]);
  assert.equal(result.done,expected.success);assert.equal(result.failed,!expected.success);assert(result.text.includes(expected.text),JSON.stringify(result));assert.equal(result.images,0);
  assert(result.spinnerDestroyed);assert(!result.spinnerOwned);
  if(expected.blind)assert(!/Provider Z|private-model/.test(result.text),JSON.stringify(result));
  if(expected.kind==='done-open')assert(result.cancelled);
  console.log(JSON.stringify(result));
 }finally{await browser.close();}
 })().catch(e=>{console.error(e);process.exitCode=1;});
 """
    data = dict(kind=kind, wire=wire, blind=blind, success=success, text=text)
    result = subprocess.run(["node", "-e", script, json.dumps(data)], cwd=ROOT,
                            capture_output=True, text=True, timeout=30)
    if result.returncode == 77:
        pytest.skip("playwright not installed")
    assert result.returncode == 0, result.stdout + result.stderr
@@ -1,4 +1,14 @@
 import os
 import subprocess
 from pathlib import Path
 import pytest
 from core.platform_compat import find_bash, git_bash_path
 from routes.cookbook_helpers import (
    ODYSSEUS_LLAMA_SHIM_MARKER,
    _append_llama_server_shim_definition_lines,
    _append_llama_server_shim_reconciliation_lines,
    _append_llama_server_finalization_lines,
 )
 from tests.helpers.stylesheets import app_css
@@ -615,3 +625,730 @@ def test_local_dependency_probe_refreshes_user_site_visibility():
    # deps (realesrgan) probe as not-installed until a restart. See #4810.
    assert "if user_site and os.path.isdir(user_site):" in source
    assert "site.addsitedir(user_site)" in source
 def test_llama_runner_path_preserves_standard_user_bin_order():
    """The runner PATH must preserve standard user $HOME/bin precedence while
    relying on ownership-aware reconciliation to retire Odysseus shims when
    native builds exist."""
    source = _read("routes/cookbook_routes.py")
    assert (
        'export PATH="$HOME/.local/bin:$HOME/bin:$HOME/llama.cpp/build/bin:/opt/homebrew/bin:/usr/local/bin:$PATH"'
        in source
    )
 def _run_shell(tmp_path, lines, cwd=None, path=None, extra_env=None):
    from core.platform_compat import find_bash, git_bash_path
    bash = find_bash() or "bash"
    env = dict(os.environ, HOME=git_bash_path(tmp_path))
    if path is not None:
        env["PATH"] = path
    if extra_env:
        env.update(extra_env)
    return subprocess.run(
        [bash, "-c", "\n".join(lines)],
        cwd=str(cwd) if cwd else None,
        env=env,
        capture_output=True,
        text=True,
    )
 def _write_odysseus_shim(path: Path) -> None:
    path.parent.mkdir(parents=True, exist_ok=True)
    path.write_text(
        f"#!/usr/bin/env bash\n{ODYSSEUS_LLAMA_SHIM_MARKER}\nexec python3 -m llama_cpp.server \"$@\"\n",
        encoding="utf-8",
    )
    path.chmod(0o755)
 def _write_mock_native(path: Path, succeeds: bool = True) -> None:
    path.parent.mkdir(parents=True, exist_ok=True)
    if succeeds:
        content = '#!/usr/bin/env bash\nif [ "$1" = "--version" ]; then echo "version: 0.1.0-dev"; exit 0; fi\necho "RUN_NATIVE: $@"\nexit 0\n'
    else:
        content = '#!/usr/bin/env bash\necho "error: missing libllama.so" >&2\nexit 127\n'
    path.write_text(content, encoding="utf-8")
    path.chmod(0o755)
 def _write_mock_python3(path: Path, succeeds: bool = True) -> None:
    path.parent.mkdir(parents=True, exist_ok=True)
    path.write_text(f"#!/usr/bin/env bash\nexit {0 if succeeds else 1}\n", encoding="utf-8")
    path.chmod(0o755)
 def test_odysseus_create_llama_shim_never_overwrites_user_regular_file(tmp_path):
    """Creation boundary: never overwrite a non-executable user-owned regular file."""
    user_file = tmp_path / "bin/llama-server"
    user_file.parent.mkdir(parents=True, exist_ok=True)
    original_content = "user configuration or binary data without marker"
    user_file.write_text(original_content, encoding="utf-8")
    lines = []
    _append_llama_server_shim_definition_lines(lines)
    lines.append('_odysseus_create_llama_shim')
    res = _run_shell(tmp_path, lines)
    assert res.returncode != 0, "Creation should return non-zero when target is a user file"
    assert user_file.read_text(encoding="utf-8") == original_content, "User file must remain byte-for-byte unchanged"
 def test_odysseus_create_llama_shim_never_overwrites_user_symlink(tmp_path):
    """Creation boundary: never follow or overwrite a user-owned symlink."""
    bin_dir = tmp_path / "bin"
    bin_dir.mkdir(parents=True, exist_ok=True)
    target_file = tmp_path / "user_target.txt"
    target_file.write_text("precious user target content", encoding="utf-8")
    user_symlink = bin_dir / "llama-server"
    user_symlink.symlink_to(target_file)
    lines = []
    _append_llama_server_shim_definition_lines(lines)
    lines.append('_odysseus_create_llama_shim')
    res = _run_shell(tmp_path, lines)
    assert res.returncode != 0, "Creation should return non-zero when target is a user symlink"
    assert user_symlink.is_symlink(), "Symlink must remain intact"
    assert target_file.read_text(encoding="utf-8") == "precious user target content", "Target file must not be modified"
 def test_odysseus_create_llama_shim_never_overwrites_dangling_symlink(tmp_path):
    """Creation boundary: never overwrite a dangling user-owned symlink."""
    bin_dir = tmp_path / "bin"
    bin_dir.mkdir(parents=True, exist_ok=True)
    dangling_symlink = bin_dir / "llama-server"
    dangling_symlink.symlink_to(tmp_path / "nonexistent_target")
    lines = []
    _append_llama_server_shim_definition_lines(lines)
    lines.append('_odysseus_create_llama_shim')
    res = _run_shell(tmp_path, lines)
    assert res.returncode != 0, "Creation should return non-zero when target is a dangling symlink"
    assert dangling_symlink.is_symlink(), "Dangling symlink must remain intact"
 def test_odysseus_create_llama_shim_safely_replaces_existing_odysseus_shim(tmp_path):
    """Creation boundary: safely replace an existing Odysseus-owned compatibility shim."""
    shim_file = tmp_path / "bin/llama-server"
    shim_file.parent.mkdir(parents=True, exist_ok=True)
    shim_file.write_text(f"#!/bin/bash\n{ODYSSEUS_LLAMA_SHIM_MARKER}\n# old shim body\n", encoding="utf-8")
    lines = []
    _append_llama_server_shim_definition_lines(lines)
    lines.append('_odysseus_create_llama_shim')
    res = _run_shell(tmp_path, lines)
    assert res.returncode == 0
    new_content = shim_file.read_text(encoding="utf-8")
    assert ODYSSEUS_LLAMA_SHIM_MARKER in new_content
    assert "exec python3 -m llama_cpp.server" in new_content
 def test_odysseus_create_llama_shim_secure_temp_prevents_symlink_attack(tmp_path):
    """Creation boundary: secure mktemp prevents predictable $$ temp symlink attacks.
    Given:
    - A victim file at ~/victim containing DO_NOT_TOUCH
    - A pre-created symlink at ~/bin/.llama-server.odysseus.tmp.$$ pointing to ~/victim
    - _odysseus_create_llama_shim executed within that exact same bash PID ($$)
    Prove:
    - ~/victim remains unmodified
    - Pre-existing crafted symlink is NOT followed or overwritten
    - Legitimate shim is successfully created at ~/bin/llama-server via secure temp path
    """
    lines = [
        'victim="$HOME/victim"',
        'printf "DO_NOT_TOUCH\\n" > "$victim"',
        'mkdir -p "$HOME/bin"',
        'old_tmp="$HOME/bin/.llama-server.odysseus.tmp.$$";',
        'ln -s "$victim" "$old_tmp"',
    ]
    _append_llama_server_shim_definition_lines(lines)
    lines.append('_odysseus_create_llama_shim')
    lines.append('res=$?')
    lines.append('echo "CREATION_RES=$res"')
    res = _run_shell(tmp_path, lines)
    assert res.returncode == 0
    assert "CREATION_RES=0" in res.stdout
    victim_file = tmp_path / "victim"
    assert victim_file.exists()
    assert victim_file.read_text(encoding="utf-8") == "DO_NOT_TOUCH\n", "Victim file must remain untouched"
    target_shim = tmp_path / "bin/llama-server"
    assert target_shim.exists()
    assert ODYSSEUS_LLAMA_SHIM_MARKER in target_shim.read_text(encoding="utf-8")
    assert target_shim.stat().st_mode & 0o111 != 0, "Shim must be executable"
 def test_stale_odysseus_shim_removed_when_python_server_unusable(tmp_path):
    """Scenario 1: Stale Odysseus shim + missing Python server -> owned shim removed."""
    shim_file = tmp_path / "bin/llama-server"
    _write_odysseus_shim(shim_file)
    lines = []
    _append_llama_server_shim_reconciliation_lines(lines)
    res = _run_shell(tmp_path, lines)
    assert res.returncode == 0
    assert not shim_file.exists(), "Stale Odysseus shim must be removed when python server is unavailable"
 def test_healthy_odysseus_shim_retained_when_no_native_server(tmp_path):
    """Scenario 2: Healthy Odysseus shim + no native server -> shim preserved."""
    shim_file = tmp_path / "bin/llama-server"
    _write_odysseus_shim(shim_file)
    mock_py_dir = tmp_path / "mock_bin"
    _write_mock_python3(mock_py_dir / "python3", succeeds=True)
    lines = []
    _append_llama_server_shim_reconciliation_lines(lines)
    res = _run_shell(tmp_path, lines, path=f"{git_bash_path(mock_py_dir)}:{os.environ.get('PATH', '')}")
    assert res.returncode == 0
    assert shim_file.exists(), "Healthy Odysseus shim must be preserved when no native server is present"
 def test_reconciliation_does_not_retire_healthy_shim_for_broken_native_binary(tmp_path):
    """Reconciliation health check: a broken native candidate executable must NOT retire
    a healthy Odysseus Python shim."""
    shim_file = tmp_path / "bin/llama-server"
    _write_odysseus_shim(shim_file)
    _write_mock_native(tmp_path / "llama.cpp/build/bin/llama-server", succeeds=False)
    mock_py_dir = tmp_path / "mock_bin"
    _write_mock_python3(mock_py_dir / "python3", succeeds=True)
    lines = [f'export PATH="$HOME/llama.cpp/build/bin:{git_bash_path(mock_py_dir)}:$PATH"']
    _append_llama_server_shim_reconciliation_lines(lines)
    res = _run_shell(tmp_path, lines)
    assert res.returncode == 0
    assert shim_file.exists(), "Healthy Odysseus shim must NOT be retired when native binary is broken"
 def test_odysseus_shim_retired_when_native_server_healthy(tmp_path):
    """Scenario 3: Odysseus shim + healthy native server available -> native server wins."""
    shim_file = tmp_path / "bin/llama-server"
    _write_odysseus_shim(shim_file)
    _write_mock_native(tmp_path / "llama.cpp/build/bin/llama-server", succeeds=True)
    lines = ['export PATH="$HOME/bin:$HOME/llama.cpp/build/bin:$PATH"']
    _append_llama_server_shim_reconciliation_lines(lines)
    res = _run_shell(tmp_path, lines)
    assert res.returncode == 0
    assert not shim_file.exists(), "Odysseus shim must be retired when healthy native server is available"
 def test_user_owned_bin_llama_server_never_touched(tmp_path):
    """Scenario 4: Arbitrary user ~/bin/llama-server -> untouched and not deprioritized."""
    user_bin = tmp_path / "bin/llama-server"
    user_bin.parent.mkdir(parents=True, exist_ok=True)
    user_bin.write_text("#!/bin/bash\n# Custom user build script\nexec /opt/custom/llama-server\n", encoding="utf-8")
    user_bin.chmod(0o755)
    _write_mock_native(tmp_path / "llama.cpp/build/bin/llama-server", succeeds=True)
    lines = ['export PATH="$HOME/bin:$HOME/llama.cpp/build/bin:$PATH"']
    _append_llama_server_shim_reconciliation_lines(lines)
    res = _run_shell(tmp_path, lines)
    assert res.returncode == 0
    assert user_bin.exists(), "User-owned ~/bin/llama-server must never be deleted"
    assert "Custom user build script" in user_bin.read_text(encoding="utf-8")
 def test_reconciliation_ignores_native_binary_outside_effective_path(tmp_path):
    """Native candidate outside effective PATH must NOT be considered."""
    shim_file = tmp_path / "bin/llama-server"
    _write_odysseus_shim(shim_file)
    # Native binary placed in /usr_custom/bin which is NOT in PATH
    _write_mock_native(tmp_path / "usr_custom/bin/llama-server", succeeds=True)
    mock_py_dir = tmp_path / "mock_bin"
    _write_mock_python3(mock_py_dir / "python3", succeeds=True)
    lines = []
    _append_llama_server_shim_reconciliation_lines(lines)
    # PATH only contains ~/bin and mock_py_dir — usr_custom is omitted
    path = f"{git_bash_path(tmp_path / 'bin')}:{git_bash_path(mock_py_dir)}"
    res = _run_shell(tmp_path, lines, path=path)
    assert res.returncode == 0
    assert shim_file.exists(), "Shim must NOT be retired by native binary outside effective PATH"
 def test_reconciliation_skips_home_bin_with_or_without_trailing_slash(tmp_path):
    """Reconciliation must exclude $HOME/bin and $HOME/bin/ from native candidate discovery."""
    shim_file = tmp_path / "bin/llama-server"
    _write_odysseus_shim(shim_file)
    mock_py_dir = tmp_path / "mock_bin"
    _write_mock_python3(mock_py_dir / "python3", succeeds=True)
    lines = []
    _append_llama_server_shim_reconciliation_lines(lines)
    # PATH has ~/bin/ with trailing slash
    path = f"{git_bash_path(tmp_path / 'bin')}/:{git_bash_path(mock_py_dir)}"
    res = _run_shell(tmp_path, lines, path=path)
    assert res.returncode == 0
    assert shim_file.exists(), "Shim must NOT rediscover itself when PATH has trailing slash in $HOME/bin/"
 def test_reconciliation_does_not_discover_cwd_executable_when_path_omits_dot(tmp_path):
    """Reconciliation must NOT synthesize an empty/trailing PATH element that searches cwd.
    Given:
    - Current working directory contains an executable `llama-server`
    - Healthy Odysseus Python shim in ~/bin/llama-server
    - PATH does NOT contain '.' or cwd
    - No other healthy native binary on PATH
    Prove:
    - Reconciliation does not discover ./llama-server
    - The healthy Odysseus shim in ~/bin/llama-server is preserved
    """
    shim_file = tmp_path / "bin/llama-server"
    _write_odysseus_shim(shim_file)
    mock_py_dir = tmp_path / "mock_bin"
    _write_mock_python3(mock_py_dir / "python3", succeeds=True)
    cwd_dir = tmp_path / "workdir"
    _write_mock_native(cwd_dir / "llama-server", succeeds=True)
    lines = []
    _append_llama_server_shim_reconciliation_lines(lines)
    path = f"{git_bash_path(tmp_path / 'bin')}:{git_bash_path(mock_py_dir)}:/usr/bin:/bin"
    res = _run_shell(tmp_path, lines, cwd=cwd_dir, path=path)
    assert res.returncode == 0
    assert shim_file.exists(), "Healthy Odysseus shim must NOT be retired by finding ./llama-server in cwd"
 def test_reconciliation_discovers_healthy_native_on_explicit_other_path_entry(tmp_path):
    """Reconciliation must discover healthy native binaries placed on explicit PATH entries."""
    shim_file = tmp_path / "bin/llama-server"
    _write_odysseus_shim(shim_file)
    custom_opt_bin = tmp_path / "custom_opt/bin"
    _write_mock_native(custom_opt_bin / "llama-server", succeeds=True)
    lines = []
    _append_llama_server_shim_reconciliation_lines(lines)
    path = f"{git_bash_path(tmp_path / 'bin')}:{git_bash_path(custom_opt_bin)}:/usr/bin:/bin"
    res = _run_shell(tmp_path, lines, path=path)
    assert res.returncode == 0
    assert not shim_file.exists(), "Odysseus shim must be retired when healthy native server is on explicit PATH entry"
 def test_reconciliation_safely_iterates_path_with_glob_metacharacters(tmp_path):
    """Reconciliation must not perform pathname expansion / globbing on PATH components.
    Given:
    - A directory path containing shell glob characters: ~/custom[dir]/bin
    - A native binary ~/custom[dir]/bin/llama-server
    - A working directory containing matching glob entries
    - An existing Odysseus shim in ~/bin/llama-server
    Prove:
    - Reconciliation correctly parses the literal path without expanding [dir]
    - Discovers the healthy native server and retires the Odysseus shim
    """
    shim_file = tmp_path / "bin/llama-server"
    _write_odysseus_shim(shim_file)
    glob_dir = tmp_path / "custom[dir]/bin"
    _write_mock_native(glob_dir / "llama-server", succeeds=True)
    cwd_dir = tmp_path / "cwd"
    cwd_dir.mkdir(parents=True, exist_ok=True)
    (cwd_dir / "customd").mkdir(parents=True, exist_ok=True)
    (cwd_dir / "customi").mkdir(parents=True, exist_ok=True)
    lines = []
    _append_llama_server_shim_reconciliation_lines(lines)
    path = f"{git_bash_path(tmp_path / 'bin')}:{git_bash_path(glob_dir)}:/usr/bin:/bin"
    res = _run_shell(tmp_path, lines, cwd=cwd_dir, path=path)
    assert res.returncode == 0
    assert not shim_file.exists(), "Reconciliation must discover literal bracketed PATH without globbing"
 def test_fallback_install_success_creates_usable_launcher(tmp_path):
    """Scenario 5: No native + no Python server -> fallback install succeeds
    -> usable compatibility launcher exists and resolves command -v llama-server."""
    mock_py_dir = tmp_path / "mock_bin"
    _write_mock_python3(mock_py_dir / "python3", succeeds=True)
    lines = [f'export PATH="$HOME/bin:{git_bash_path(mock_py_dir)}:$PATH"']
    _append_llama_server_shim_definition_lines(lines)
    _append_llama_server_finalization_lines(lines)
    lines.append('command -v llama-server')
    res = _run_shell(tmp_path, lines)
    assert res.returncode == 0
    created_shim = tmp_path / "bin/llama-server"
    assert created_shim.exists()
    assert ODYSSEUS_LLAMA_SHIM_MARKER in created_shim.read_text(encoding="utf-8")
    assert str(tmp_path / "bin/llama-server") in res.stdout
 def test_failed_fallback_sets_preflight_exit_127(tmp_path):
    """Scenario 6: No native + failed fallback installation -> ODYSSEUS_PREFLIGHT_EXIT=127."""
    lines = [
        'ODYSSEUS_PREFLIGHT_EXIT=""',
        'export PATH="$HOME/bin:$PATH"',
    ]
    _append_llama_server_shim_definition_lines(lines)
    _append_llama_server_finalization_lines(lines)
    lines.append('echo "EXIT=$ODYSSEUS_PREFLIGHT_EXIT"')
    res = _run_shell(tmp_path, lines)
    assert res.returncode == 0
    assert "EXIT=127" in res.stdout
 def test_python_server_readiness_requires_llama_cpp_server_module():
    """Scenario 7 & 8: Python server readiness requires `import llama_cpp.server`,
    while GPU offload capability checks still use base `import llama_cpp`."""
    routes_source = _read("routes/cookbook_routes.py")
    helpers_source = _read("routes/cookbook_helpers.py")
    # Windows fallback readiness check requires .server
    assert 'try { python -c "import llama_cpp.server" 2>$null } catch {}' in routes_source
    # Termux fallback readiness check requires .server
    assert 'if ! python3 -c "import llama_cpp.server" 2>/dev/null; then' in routes_source
    # Build-failure fallback pip check requires .server
    assert 'if [ -z "$_odysseus_llama_bin" ] && ! python3 -c "import llama_cpp.server" 2>/dev/null; then' in routes_source
    # Shim reconciliation and post-install finalization require .server
    assert 'elif python3 -c "import llama_cpp.server" 2>/dev/null; then' in helpers_source
    assert 'if [ -z "$_odysseus_llama_bin" ] && python3 -c "import llama_cpp.server" 2>/dev/null; then' in helpers_source
    # GPU offload support checks still intentionally inspect base llama_cpp
    assert 'llama_cpp.llama_supports_gpu_offload()' in routes_source
 def test_darwin_native_build_does_not_force_write_bin_symlink():
    """Darwin source build must not overwrite ~/bin/llama-server with a forced symlink."""
    source = _read("routes/cookbook_routes.py")
    assert "&& ln -sf ~/llama.cpp/build/bin/llama-server ~/bin/llama-server" not in source
    assert 'cmake --build build -j"$NPROC" --target llama-server' in source
@pytest.mark.asyncio
 async def test_generated_runner_preflight_retires_stale_shim_before_backend_selection(monkeypatch, tmp_path):
    """Integration regression: The actual generated Cookbook runner must execute
    ownership reconciliation BEFORE evaluating the backend selection (`if Termux ... elif ! command -v llama-server`).
    Given:
    - Executable stale Odysseus shim in ~/bin/llama-server (with canonical marker)
    - Healthy native llama-server in ~/llama.cpp/build/bin/llama-server
    - ~/bin before ~/llama.cpp/build/bin on PATH
    Prove:
    1. Generated runner contains reconciliation shell lines strictly before the backend branching
    2. Executing the generated runner script retires the stale ~/bin/llama-server shim
    3. Resolves to the healthy native binary without attempting source build or pip fallback.
    """
    from unittest.mock import AsyncMock, MagicMock
    from routes.cookbook_helpers import ServeRequest
    import routes.cookbook_routes as cookbook_routes
    from starlette.requests import Request
    fake_home = tmp_path / "fake_home"
    stale_shim = fake_home / "bin/llama-server"
    _write_odysseus_shim(stale_shim)
    native_bin = fake_home / "llama.cpp/build/bin/llama-server"
    _write_mock_native(native_bin, succeeds=True)
    # Mock environment to generate the real runner file with isolated DB
    tmux_log_dir = tmp_path / "tmux_logs"
    tmux_log_dir.mkdir(parents=True)
    monkeypatch.setattr(cookbook_routes, "TMUX_LOG_DIR", tmux_log_dir)
    monkeypatch.setattr(cookbook_routes, "require_admin", lambda request: None)
    monkeypatch.setattr(cookbook_routes, "_binary_available", AsyncMock(return_value=True))
    monkeypatch.setattr(cookbook_routes, "load_stored_hf_token", lambda **kwargs: "")
    monkeypatch.setattr("core.database.SessionLocal", MagicMock())
    class _Proc:
        returncode = 0
        stderr = None
        async def wait(self):
            return 0
    monkeypatch.setattr(cookbook_routes.asyncio, "create_subprocess_shell", AsyncMock(return_value=_Proc()))
    router = cookbook_routes.setup_cookbook_routes()
    endpoint = None
    for route in router.routes:
        if route.path == "/api/model/serve" and "POST" in route.methods:
            endpoint = route.endpoint
            break
    assert endpoint is not None
    from types import SimpleNamespace
    http_req = Request({
        "type": "http",
        "method": "POST",
        "path": "/api/model/serve",
        "headers": [],
        "app": SimpleNamespace(state=SimpleNamespace(auth_manager=SimpleNamespace(
            is_configured=True, is_admin=lambda user: user == "admin"))),
    })
    http_req.state.current_user = "admin"
    http_req.state.local_model_authority = True
    req = ServeRequest(
        repo_id="test/repo",
        cmd="llama-server -m /dummy/model.gguf --port 8085",
        remote_host=None,
    )
    resp = await endpoint(http_req, req)
    assert resp["ok"] is True
    session_id = resp["session_id"]
    runner_file = tmux_log_dir / f"{session_id}_run.sh"
    assert runner_file.exists()
    runner_script = runner_file.read_text(encoding="utf-8")
    # Assert structural ordering in the generated script:
    # Reconciliation must appear strictly BEFORE the Termux/backend check
    recon_idx = runner_script.find("Native llama-server detected — retiring Odysseus compatibility shim in ~/bin")
    termux_idx = runner_script.find("if [ -d /data/data/com.termux ]; then")
    backend_idx = runner_script.find('elif [ -z "$_odysseus_llama_bin" ]; then')
    assert recon_idx != -1, "Reconciliation block missing from generated runner"
    assert termux_idx != -1, "Termux check missing from generated runner"
    assert backend_idx != -1, "Backend selection missing from generated runner"
    assert recon_idx < termux_idx < backend_idx, "Reconciliation must execute strictly before backend selection"
    # Execute the generated runner preflight in a real subshell
    res = _run_shell(fake_home, [str(runner_file)], path=f"{git_bash_path(fake_home / 'bin')}:{git_bash_path(fake_home / 'llama.cpp/build/bin')}:/usr/bin:/bin")
    assert res.returncode == 0
    assert not stale_shim.exists(), "Stale ~/bin/llama-server must have been retired by the generated preflight"
    assert "RUN_NATIVE: -m /dummy/model.gguf --port 8085" in res.stdout
    assert "Native llama-server not found — building from source" not in res.stdout
 def test_broken_first_native_candidate_healthy_second_candidate_executes_healthy(tmp_path):
    """Regression finding P2: When PATH contains an earlier broken candidate followed by a
    healthy candidate, reconciliation and launch must select and execute the healthy candidate."""
    from core.platform_compat import git_bash_path
    broken_dir = tmp_path / "broken_bin"
    _write_mock_native(broken_dir / "llama-server", succeeds=False)
    healthy_dir = tmp_path / "healthy_bin"
    _write_mock_native(healthy_dir / "llama-server", succeeds=True)
    shim_file = tmp_path / "bin/llama-server"
    _write_odysseus_shim(shim_file)
    lines = [
        f'export PATH="$HOME/bin:{git_bash_path(broken_dir)}:{git_bash_path(healthy_dir)}:/usr/bin:/bin"',
    ]
    _append_llama_server_shim_reconciliation_lines(lines)
    lines.append('echo "RESOLVED=$_odysseus_llama_bin"')
    lines.append('command -v llama-server')
    lines.append('llama-server -m /dummy/model.gguf --port 8080')
    res = _run_shell(tmp_path, lines)
    assert res.returncode == 0
    assert not shim_file.exists(), "Stale Odysseus shim must be retired"
    assert f"RESOLVED={git_bash_path(healthy_dir / 'llama-server')}" in res.stdout
    assert str(healthy_dir / "llama-server") in res.stdout
    assert "RUN_NATIVE: -m /dummy/model.gguf --port 8080" in res.stdout
    assert "error: missing libllama.so" not in res.stdout
 def test_paths_with_spaces_broken_first_healthy_second_launch(tmp_path):
    """Regression: Paths containing spaces must be safely resolved, prioritized and launched."""
    from core.platform_compat import git_bash_path
    broken_dir = tmp_path / "broken path with spaces/bin"
    _write_mock_native(broken_dir / "llama-server", succeeds=False)
    healthy_dir = tmp_path / "healthy path with spaces/bin"
    _write_mock_native(healthy_dir / "llama-server", succeeds=True)
    shim_file = tmp_path / "bin/llama-server"
    _write_odysseus_shim(shim_file)
    model_dir = tmp_path / "models with spaces"
    model_dir.mkdir(parents=True, exist_ok=True)
    model_file = model_dir / "my model.gguf"
    model_file.write_text("dummy", encoding="utf-8")
    lines = [
        f'export PATH="$HOME/bin:{git_bash_path(broken_dir)}:{git_bash_path(healthy_dir)}:/usr/bin:/bin"',
    ]
    _append_llama_server_shim_reconciliation_lines(lines)
    lines.append(f'llama-server -m "{git_bash_path(model_file)}" --port 8080')
    res = _run_shell(tmp_path, lines)
    assert res.returncode == 0
    assert not shim_file.exists(), "Stale shim must be retired"
    assert f"RUN_NATIVE: -m {git_bash_path(model_file)} --port 8080" in res.stdout
    assert "error: missing libllama.so" not in res.stdout
 def test_command_hash_invalidation_switches_from_cached_broken_to_healthy(tmp_path):
    """Regression: Command cache invalidation (`hash -r`) must prevent bash from reusing a
    previously cached lookup to an earlier broken executable."""
    from core.platform_compat import git_bash_path
    broken_dir = tmp_path / "broken_bin"
    _write_mock_native(broken_dir / "llama-server", succeeds=False)
    healthy_dir = tmp_path / "healthy_bin"
    _write_mock_native(healthy_dir / "llama-server", succeeds=True)
    lines = [
        # Populate bash hash cache with broken binary
        f'export PATH="{git_bash_path(broken_dir)}:/usr/bin:/bin"',
        'llama-server >/dev/null 2>&1 || true',
        'hash',
        # Now add healthy candidate later in PATH and run reconciliation
        f'export PATH="$HOME/bin:{git_bash_path(broken_dir)}:{git_bash_path(healthy_dir)}:/usr/bin:/bin"',
    ]
    _append_llama_server_shim_reconciliation_lines(lines)
    lines.append('llama-server -m /dummy/test.gguf')
    lines.append('hash')
    res = _run_shell(tmp_path, lines)
    assert res.returncode == 0
    assert "RUN_NATIVE: -m /dummy/test.gguf" in res.stdout
    # Verify hash table ended with healthy binary, not broken
    assert str(healthy_dir / "llama-server") in res.stdout
 def test_broken_native_candidate_falls_back_to_healthy_python_compatibility_shim(tmp_path):
    """Regression: A broken native candidate must not shadow or retire a healthy Python shim."""
    from core.platform_compat import git_bash_path
    broken_dir = tmp_path / "broken_bin"
    _write_mock_native(broken_dir / "llama-server", succeeds=False)
    shim_file = tmp_path / "bin/llama-server"
    _write_odysseus_shim(shim_file)
    mock_py_dir = tmp_path / "mock_bin"
    _write_mock_python3(mock_py_dir / "python3", succeeds=True)
    lines = [
        f'export PATH="$HOME/bin:{git_bash_path(broken_dir)}:{git_bash_path(mock_py_dir)}:/usr/bin:/bin"',
    ]
    _append_llama_server_shim_reconciliation_lines(lines)
    lines.append('echo "RESOLVED=$_odysseus_llama_bin"')
    lines.append('command -v llama-server')
    res = _run_shell(tmp_path, lines)
    assert res.returncode == 0
    assert shim_file.exists(), "Healthy Python compatibility shim must be preserved"
    assert f"RESOLVED={git_bash_path(shim_file)}" in res.stdout
    assert str(shim_file) in res.stdout
 def test_broken_native_and_missing_python_backend_sets_preflight_127(tmp_path):
    """Regression: When the only native candidates are broken and Python server is unavailable,
    finalization must fail closed with ODYSSEUS_PREFLIGHT_EXIT=127 rather than claiming readiness."""
    from core.platform_compat import git_bash_path
    broken_dir = tmp_path / "broken_bin"
    _write_mock_native(broken_dir / "llama-server", succeeds=False)
    mock_py_dir = tmp_path / "mock_bin"
    _write_mock_python3(mock_py_dir / "python3", succeeds=False)
    lines = [
        'ODYSSEUS_PREFLIGHT_EXIT=""',
        f'export PATH="$HOME/bin:{git_bash_path(broken_dir)}:{git_bash_path(mock_py_dir)}:/usr/bin:/bin"',
    ]
    _append_llama_server_shim_definition_lines(lines)
    _append_llama_server_shim_reconciliation_lines(lines)
    _append_llama_server_finalization_lines(lines)
    lines.append('echo "EXIT=$ODYSSEUS_PREFLIGHT_EXIT"')
    res = _run_shell(tmp_path, lines)
    assert res.returncode == 0
    assert "EXIT=127" in res.stdout
@pytest.mark.asyncio
 async def test_generated_runner_broken_first_healthy_second_e2e(monkeypatch, tmp_path):
    """Integration regression: The full generated Cookbook runner script must launch the healthy
    native candidate even when an earlier broken candidate exists on PATH."""
    from unittest.mock import AsyncMock, MagicMock
    from types import SimpleNamespace
    from routes.cookbook_helpers import ServeRequest
    import routes.cookbook_routes as cookbook_routes
    from starlette.requests import Request
    from core.platform_compat import git_bash_path
    fake_home = tmp_path / "fake_home"
    stale_shim = fake_home / "bin/llama-server"
    _write_odysseus_shim(stale_shim)
    broken_bin = fake_home / "broken/bin/llama-server"
    _write_mock_native(broken_bin, succeeds=False)
    healthy_bin = fake_home / "healthy/bin/llama-server"
    _write_mock_native(healthy_bin, succeeds=True)
    tmux_log_dir = tmp_path / "tmux_logs"
    tmux_log_dir.mkdir(parents=True)
    monkeypatch.setattr(cookbook_routes, "TMUX_LOG_DIR", tmux_log_dir)
    monkeypatch.setattr(cookbook_routes, "require_admin", lambda request: None)
    monkeypatch.setattr(cookbook_routes, "_binary_available", AsyncMock(return_value=True))
    monkeypatch.setattr(cookbook_routes, "load_stored_hf_token", lambda **kwargs: "")
    monkeypatch.setattr("core.database.SessionLocal", MagicMock())
    class _Proc:
        returncode = 0
        stderr = None
        async def wait(self):
            return 0
    monkeypatch.setattr(cookbook_routes.asyncio, "create_subprocess_shell", AsyncMock(return_value=_Proc()))
    router = cookbook_routes.setup_cookbook_routes()
    endpoint = None
    for route in router.routes:
        if route.path == "/api/model/serve" and "POST" in route.methods:
            endpoint = route.endpoint
            break
    assert endpoint is not None
    http_req = Request({
        "type": "http",
        "method": "POST",
        "path": "/api/model/serve",
        "headers": [],
        "app": SimpleNamespace(state=SimpleNamespace(auth_manager=SimpleNamespace(
            is_configured=True, is_admin=lambda user: user == "admin"))),
    })
    http_req.state.current_user = "admin"
    http_req.state.local_model_authority = True
    req = ServeRequest(
        repo_id="test/repo",
        cmd="llama-server -m /dummy/model.gguf --port 8090",
        remote_host=None,
    )
    resp = await endpoint(http_req, req)
    assert resp["ok"] is True
    session_id = resp["session_id"]
    runner_file = tmux_log_dir / f"{session_id}_run.sh"
    assert runner_file.exists()
    # Broken is earlier on PATH than healthy
    res = _run_shell(
        fake_home,
        [str(runner_file)],
        path=f"{git_bash_path(fake_home / 'bin')}:{git_bash_path(broken_bin.parent)}:{git_bash_path(healthy_bin.parent)}:/usr/bin:/bin",
    )
    assert res.returncode == 0
    assert not stale_shim.exists(), "Stale shim must have been retired"
    assert "RUN_NATIVE: -m /dummy/model.gguf --port 8090" in res.stdout
    assert "error: missing libllama.so" not in res.stdout
    assert "Native llama-server not found — building from source" not in res.stdout
@@ -70,3 +70,63 @@ def test_no_gguf_found_pattern():
    result = _diagnose_serve_output(out)
    assert result is not None
    assert "GGUF" in result["message"]
 def test_cookbook_routes_uses_shared_diagnosis_helper():
    # /api/cookbook/tasks/status must use the maintained helper. A nested copy in
    # cookbook_routes.py shadowed the import and silently drifted (missing the
    # ModelOpt, mflux and MLX bridge diagnoses).
    import ast
    from pathlib import Path
    source = (Path(__file__).resolve().parents[1] / "routes" / "cookbook_routes.py").read_text(encoding="utf-8")
    local_defs = [
        node.lineno
        for node in ast.walk(ast.parse(source))
        if isinstance(node, (ast.FunctionDef, ast.AsyncFunctionDef)) and node.name == "_diagnose_serve_output"
    ]
    assert local_defs == []
 def test_modelopt_lm_head_checkpoint_returns_diagnosis():
    out = "ValueError: There is no module or parameter named 'lm_head.input_scale' in Qwen3ForCausalLM"
    result = _diagnose_serve_output(out)
    assert result is not None
    assert "ModelOpt" in result["message"]
 def test_nvidia_driver_too_old_for_torch_returns_diagnosis():
    # vLLM 0.31 from PyPI ships torch cu130; on driver 570 (CUDA 12.8) the engine dies here.
    out = (
        "(EngineCore pid=1) ERROR [core.py:1433]     self.driver_worker.init_device()\n"
        "(EngineCore pid=1) ERROR [core.py:1433] RuntimeError: The NVIDIA driver on your system is too old "
        "(found version 12080). Please update your GPU driver by downloading and installing a new version\n"
        "Traceback (most recent call last):\n"
        "RuntimeError: Engine core initialization failed. See root cause above. Failed core proc(s): {}\n"
    )
    result = _diagnose_serve_output(out)
    assert result is not None
    assert "driver" in result["message"].lower()
    assert any("cu129" in s["label"] for s in result["suggestions"])
 def test_cuda_runtime_newer_than_driver_returns_diagnosis():
    # torch switched to cu128 but the vLLM wheel's own kernels still need CUDA 13.
    out = (
        "RuntimeError: get_cuda_view_from_cpu_tensor, /workspace/csrc/libtorch_stable/cuda_view.cu:38, "
        "cudaHostGetDevicePointer failed: CUDA driver version is insufficient for CUDA runtime version\n"
        "Traceback (most recent call last):\n"
    )
    result = _diagnose_serve_output(out)
    assert result is not None
    assert "driver" in result["message"].lower()
 def test_tasks_status_capture_joins_wrapped_tmux_lines():
    # tmux wraps at the pane width (often mid-word), which hid errors like
    # "insufficie|nt for CUDA runtime version" from the diagnosis patterns.
    from pathlib import Path
    source = (Path(__file__).resolve().parents[1] / "routes" / "cookbook_routes.py").read_text(encoding="utf-8")
    assert '_remote_tmux_command("capture-pane", "-t", session_id, "-p", "-J", "-S", "-500")' in source
    assert '["tmux", "capture-pane", "-t", session_id, "-p", "-J", "-S", "-500"]' in source
@@ -0,0 +1,62 @@
 import pytest
 import httpx
 from unittest.mock import patch, AsyncMock
 from fastapi import FastAPI
 from fastapi.testclient import TestClient
 from routes.cookbook_routes import setup_cookbook_routes
 from src.auth_helpers import require_user
 app = FastAPI()
 router = setup_cookbook_routes()
 app.include_router(router)
 app.dependency_overrides[require_user] = lambda: "test_user"
 client = TestClient(app)
 def test_hf_gguf_files_success():
    mock_resp = httpx.Response(
        200,
        json={
            "siblings": [
                {"rfilename": "model-q4_k_m.gguf"},
                {"rfilename": "model-q8_0.gguf"},
                {"rfilename": "README.md"},
            ]
        },
        request=httpx.Request("GET", "https://huggingface.co/api/models/TheBloke/Llama-2-7B-GGUF"),
    )
    with patch("httpx.AsyncClient.get", new_callable=AsyncMock, return_value=mock_resp):
        response = client.get("/api/cookbook/hf-gguf-files?repo_id=TheBloke/Llama-2-7B-GGUF")
        assert response.status_code == 200
        data = response.json()
        assert data["ok"] is True
        assert data["repo_id"] == "TheBloke/Llama-2-7B-GGUF"
        assert data["files"] == ["model-q4_k_m.gguf", "model-q8_0.gguf"]
 def test_hf_gguf_files_http_error():
    mock_resp = httpx.Response(
        404,
        json={"error": "Model not found"},
        request=httpx.Request("GET", "https://huggingface.co/api/models/invalid/repo"),
    )
    with patch("httpx.AsyncClient.get", new_callable=AsyncMock, return_value=mock_resp):
        response = client.get("/api/cookbook/hf-gguf-files?repo_id=invalid/repo")
        assert response.status_code == 200
        data = response.json()
        assert data["ok"] is False
        assert "HF API HTTP 404" in data["error"]
 def test_hf_gguf_files_exception_handling():
    with patch("httpx.AsyncClient.get", new_callable=AsyncMock, side_effect=httpx.ConnectError("Network unreachable")):
        response = client.get("/api/cookbook/hf-gguf-files?repo_id=TheBloke/Llama-2-7B-GGUF")
        # Should gracefully return JSON error payload, not raise NameError / 500
        assert response.status_code == 200
        data = response.json()
        assert data["ok"] is False
        assert data["error"] == "HF API request failed"
@@ -0,0 +1,38 @@
 """Guard the only entry point to the Cookbook → Dependencies recipe panel.
 The recipe panel (model picker, Pip/Docker toggle, commands and Run) is
 rendered hidden, and only the `[data-dep-recipe-toggle]` caret shows it.
 The HW Fit and serve-card deep links (`openCookbookDependencies(..., {
 expandRecipe })`) open it by clicking that same caret. When the caret was
 dropped from the row markup, nothing could open the panel (#6747).
 """
 import re
 from pathlib import Path
 JS_DIR = Path(__file__).resolve().parent.parent / "static" / "js"
 COOKBOOK_JS = JS_DIR / "cookbook.js"
 DIAGNOSIS_JS = JS_DIR / "cookbook-diagnosis.js"
 def _row_renderer(source: str) -> str:
    start = source.index("const hasRecipe = RECIPE_BACKENDS.has(pkg.name);")
    end = source.index("+ recipePanel;", start)
    return source[start:end]
 def test_recipe_rows_render_the_panel_toggle():
    row = _row_renderer(COOKBOOK_JS.read_text(encoding="utf-8"))
    caret = re.search(r"const recipeCaret = hasRecipe\s*\?\s*`([^`]*)`\s*:\s*'';", row)
    assert caret, "recipe rows must render a caret, or the recipe panel cannot be opened"
    assert 'data-dep-recipe-toggle="${esc(pkg.name)}"' in caret.group(1)
    assert 'aria-expanded="false"' in caret.group(1)
    assert "+ recipeCaret" in row
 def test_toggle_handler_and_deep_link_use_the_rendered_attribute():
    cookbook = COOKBOOK_JS.read_text(encoding="utf-8")
    diagnosis = DIAGNOSIS_JS.read_text(encoding="utf-8")
    assert "list.querySelectorAll('[data-dep-recipe-toggle]')" in cookbook
    assert "row.querySelector('[data-dep-recipe-toggle]')" in diagnosis
@@ -0,0 +1,83 @@
 """A completed blob's empty retry marker must not keep its model stalled."""
 import json
 import os
 import subprocess
 import sys
 import pytest
 from routes.cookbook_helpers import _cached_model_scan_script
 from routes.cookbook_output import HF_CACHE_COMPLETE_PROBE, HF_CACHE_INCOMPLETE_PROBE
 _REPO = "fixture/stale-marker"
 _STATES = ["complete", "stale", "empty-unpaired", "partial", "partial-paired", "empty-paired-empty"]
@pytest.fixture(params=["custom", "hf-home", "hub-env"])
 def cache(request, tmp_path):
    root = tmp_path / "cache with spaces"
    model = root / "hub" / ("models--" + _REPO.replace("/", "--"))
    blobs = model / "blobs"
    blobs.mkdir(parents=True)
    snapshot = model / "snapshots" / "revision"
    snapshot.mkdir(parents=True)
    (snapshot / "config.json").write_text("{}")
    env = {key: value for key, value in os.environ.items()
           if key not in {"HF_HOME", "HUGGINGFACE_HUB_CACHE", "HF_HUB_CACHE"}}
    if request.param == "custom":
        argument = str(root)
        scan = _cached_model_scan_script(add_hf_cache=str(root / "hub"))
    else:
        argument = ""
        env["HF_HOME" if request.param == "hf-home" else "HUGGINGFACE_HUB_CACHE"] = str(
            root if request.param == "hf-home" else root / "hub"
        )
        scan = _cached_model_scan_script()
    return blobs, argument, env, scan
 def _seed(blobs, state):
    if state in {"complete", "stale", "partial-paired"}:
        (blobs / "sha").write_bytes(b"completed model data")
    elif state == "empty-paired-empty":
        (blobs / "sha").touch()
    if state != "complete":
        (blobs / "sha.incomplete").write_bytes(b"partial" if state.startswith("partial") else b"")
@pytest.mark.parametrize("state", _STATES)
@pytest.mark.parametrize("probe", [HF_CACHE_COMPLETE_PROBE, HF_CACHE_INCOMPLETE_PROBE], ids=["complete", "incomplete"])
 def test_cache_status_probes_distinguish_stale_and_partial(cache, state, probe):
    blobs, argument, env, _ = cache
    _seed(blobs, state)
    before = {path.name: path.read_bytes() for path in blobs.iterdir()}
    result = subprocess.run([sys.executable, "-c", probe, _REPO, argument],
                            env=env, capture_output=True, text=True, timeout=15)
    complete = state in {"complete", "stale"}
    expected = complete if probe == HF_CACHE_COMPLETE_PROBE else not complete
    assert result.returncode == (0 if expected else 1), result.stderr
    assert {path.name: path.read_bytes() for path in blobs.iterdir()} == before
@pytest.mark.parametrize("state", _STATES)
 def test_generated_inventory_agrees_without_mutating_cache(cache, state):
    blobs, _, env, scan = cache
    _seed(blobs, state)
    before = {path.name: path.read_bytes() for path in blobs.iterdir()}
    # Inventory's unrelated Ollama discovery stays off the network. Execute
    # the actual generated scanner, including its cache-root resolution.
    harness = (
        "import urllib.request,shutil\n"
        "def offline(*args,**kwargs): raise OSError('Ollama outside this fixture')\n"
        "urllib.request.urlopen=offline\nshutil.which=lambda name: None\n"
        + scan
    )
    result = subprocess.run([sys.executable, "-c", harness], env=env,
                            capture_output=True, text=True, timeout=15)
    assert result.returncode == 0, result.stderr
    row = next(item for item in json.loads(result.stdout) if item["repo_id"] == _REPO)
    assert row["has_incomplete"] == (state not in {"complete", "stale"})
    if state in {"complete", "stale"}:
        assert row["nb_files"] == 1
        assert row["size_bytes"] == len(b"completed model data")
    assert {path.name: path.read_bytes() for path in blobs.iterdir()} == before
@@ -0,0 +1,103 @@
 """Daily brief must query and display each calendar storage kind in local time."""
 import asyncio
 import os
 import time
 from contextlib import contextmanager
 from datetime import datetime, timedelta, timezone
 from types import SimpleNamespace
 from zoneinfo import ZoneInfo
 import pytest
 from sqlalchemy import create_engine
 from sqlalchemy.orm import sessionmaker
 from sqlalchemy.pool import StaticPool
 from core import database
 from src import builtin_actions
@contextmanager
 def system_timezone(name):
    previous = os.environ.get('TZ')
    os.environ['TZ'] = name
    time.tzset()
    try:
        yield
    finally:
        if previous is None:
            os.environ.pop('TZ', None)
        else:
            os.environ['TZ'] = previous
        time.tzset()
@pytest.mark.skipif(not hasattr(time, 'tzset'), reason='requires changing the process local timezone')
@pytest.mark.parametrize('zone', ['Europe/Berlin', 'America/Los_Angeles'])
 def test_daily_brief_selects_local_day_and_orders_mixed_storage(monkeypatch, zone):
    engine = create_engine('sqlite://', poolclass=StaticPool)
    for model in [database.CalendarCal, database.CalendarEvent, database.Note]:
        model.__table__.create(engine)
    sessions = sessionmaker(bind=engine)
    monkeypatch.setattr(database, 'SessionLocal', sessions)
    from core.auth import AuthManager
    monkeypatch.setattr(AuthManager, 'is_configured', property(lambda self: True))
    from routes import email_helpers
    def no_email(*args):
        raise RuntimeError('No email account in this calendar-only test')
    monkeypatch.setattr(email_helpers, '_imap_connect', no_email)
    try:
        with system_timezone(zone):
            today = datetime.now().replace(hour=0, minute=0, second=0, microsecond=0)
            def utc(value):
                return value.astimezone(timezone.utc).replace(tzinfo=None)
            with sessions() as db:
                for owner in ['alice', 'bob', None]:
                    db.add(database.CalendarCal(id=owner or 'shared', owner=owner, name=owner or 'shared'))
                db.flush()
                def add(uid, start, end, *, utc_row=False, all_day=False, owner='alice', status='confirmed'):
                    db.add(database.CalendarEvent(uid=uid, calendar_id=owner or 'shared', summary=uid,
                        dtstart=utc(start) if utc_row and not all_day else start,
                        dtend=utc(end) if utc_row and not all_day else end,
                        is_utc=utc_row, all_day=all_day, status=status))
                add('early', today+timedelta(minutes=30), today+timedelta(hours=1), utc_row=True)
                add('utc-ten', today+timedelta(hours=10), today+timedelta(hours=11), utc_row=True)
                add('local-nine', today+timedelta(hours=9), today+timedelta(hours=10))
                add('all-day', today, today+timedelta(days=1), utc_row=True, all_day=True)
                add('next-day', today+timedelta(days=1,minutes=30), today+timedelta(days=1,hours=1), utc_row=True)
                add('ended', today-timedelta(hours=1), today, utc_row=True)
                add('cancelled', today+timedelta(hours=12), today+timedelta(hours=13), utc_row=True, status='cancelled')
                add('foreign', today+timedelta(hours=12), today+timedelta(hours=13), utc_row=True, owner='bob')
                add('unowned', today+timedelta(hours=12), today+timedelta(hours=13), owner=None)
                db.commit()
            text, success = asyncio.run(builtin_actions.action_daily_brief('alice'))
            assert success, text
            lines = ['all day  all-day', '00:30  early', '09:00  local-nine', '10:00  utc-ten']
            assert all(line in text for line in lines), text
            assert [text.index(line) for line in lines] == sorted(text.index(line) for line in lines), text
            for excluded in ['next-day', 'ended', 'cancelled', 'foreign', 'unowned']:
                assert excluded not in text, text
    finally:
        engine.dispose()
@pytest.mark.parametrize('day, hours', [('2026-03-29', 23), ('2026-10-25', 25)])
 def test_utc_day_window_uses_offset_at_each_boundary(day, hours):
    start = datetime.fromisoformat(day)
    zone = ZoneInfo('Europe/Berlin')
    begin = builtin_actions._daily_brief_utc_boundary(start, zone)
    end = builtin_actions._daily_brief_utc_boundary(start+timedelta(days=1), zone)
    assert end-begin == timedelta(hours=hours)
    if hasattr(time, 'tzset'):
        with system_timezone('Europe/Berlin'):
            assert builtin_actions._daily_brief_utc_boundary(start) == begin
            assert builtin_actions._daily_brief_utc_boundary(start+timedelta(days=1)) == end
@pytest.mark.parametrize('utc_row, all_day, expected', [
    (True, False, datetime(2026, 6, 1, 10)),
    (False, False, datetime(2026, 6, 1, 8)),
    (True, True, datetime(2026, 6, 1, 8)),
 ])
 def test_local_start_preserves_floating_and_date_only_values(utc_row, all_day, expected):
    event = SimpleNamespace(dtstart=datetime(2026,6,1,8), is_utc=utc_row, all_day=all_day)
    assert builtin_actions._daily_brief_local_start(event, ZoneInfo('Europe/Berlin')) == expected
@@ -85,6 +85,9 @@ def test_actual_tests_restore_process_state_and_ignore_inherited_database(tmp_pa
        import os
        import sys
        import pytest
        import tempfile
        from pathlib import Path
        from sqlalchemy.engine import make_url
        def snapshot():
            import core
@@ -107,7 +110,11 @@ def test_actual_tests_restore_process_state_and_ignore_inherited_database(tmp_pa
        class StateGuard:
            def pytest_sessionstart(self):
                self.initial = snapshot()
-                assert self.initial[0] == "sqlite:///:memory:"
+                assert self.initial[0] != inherited_url
                self.default_path = Path(make_url(self.initial[0]).database)
                assert self.default_path.is_file()
                assert self.default_path.name == "collection.db"
                assert self.default_path.parent == Path(tempfile.gettempdir()).parent
            def pytest_collection_finish(self):
                assert snapshot() == self.initial, "collection changed database bindings"
@@ -118,9 +125,11 @@ def test_actual_tests_restore_process_state_and_ignore_inherited_database(tmp_pa
                assert snapshot() == self.initial, "test leaked database or module state"
        inherited_url = os.environ["DATABASE_URL"]
        guard = StateGuard()
        result = pytest.main(["-q", "-p", "no:cacheprovider", *sys.argv[1:]],
-                             plugins=[StateGuard()])
+                             plugins=[guard])
        assert os.environ["DATABASE_URL"] == inherited_url
        assert not guard.default_path.exists(), "collection database outlived its runtime"
        raise SystemExit(result)
    ''')
    result = subprocess.run(
@@ -0,0 +1,86 @@
 """Issue #2137: never preselect an embedding or other non-chat model."""
 import json
 from types import SimpleNamespace
 import pytest
 from fastapi import FastAPI
 from fastapi.testclient import TestClient
 from core.database import ModelEndpoint
 from routes import model_routes, prefs_routes
 from tests.helpers.database import disposable_database
@pytest.fixture
 def defaults_api(monkeypatch, tmp_path):
    defaults = {}
    with disposable_database(tmp_path) as factory:
        monkeypatch.setattr(model_routes, "SessionLocal", factory)
        monkeypatch.setattr(model_routes, "_load_settings", lambda: {})
        monkeypatch.setattr(prefs_routes, "_load_for_user", lambda owner: defaults)
        app = FastAPI()
        app.state.auth_manager = SimpleNamespace(is_admin=lambda owner: False)
        @app.middleware("http")
        async def owner(request, call_next):
            request.state.current_user = "alice"
            return await call_next(request)
        app.include_router(model_routes.setup_model_routes(model_discovery=None))
        with TestClient(app) as client:
            yield client, factory, defaults
 def _endpoint(factory, *, cached=(), pinned=(), hidden=(), owner="alice", endpoint_id="ep"):
    with factory() as db:
        db.add(ModelEndpoint(
            id=endpoint_id, name="Fixture", base_url="http://model.invalid/v1", owner=owner,
            is_enabled=True, cached_models=json.dumps(cached),
            pinned_models=json.dumps(pinned), hidden_models=json.dumps(hidden),
        ))
        db.commit()
@pytest.mark.parametrize("non_chat", [
    "text-embedding-3-small", "nomic-embed-text:latest", "jina-reranker-v2-base",
    "tts-1", "whisper-1", "gpt-image-1",
 ])
 def test_automatic_default_skips_non_chat_models(defaults_api, non_chat):
    client, factory, _ = defaults_api
    _endpoint(factory, cached=[non_chat, "chat-model"])
    assert client.get("/api/default-chat").json()["model"] == "chat-model"
 def test_non_chat_saved_default_falls_back_to_visible_pinned_chat(defaults_api):
    client, factory, defaults = defaults_api
    _endpoint(factory, cached=["text-embedding-3-small", "hidden-chat"],
              pinned=["jina-reranker-v2-base", "pinned-chat"], hidden=["hidden-chat"])
    defaults.update(default_endpoint_id="ep", default_model="text-embedding-3-small")
    assert client.get("/api/default-chat").json()["model"] == "pinned-chat"
 def test_no_chat_candidate_leaves_model_empty(defaults_api):
    client, factory, defaults = defaults_api
    _endpoint(factory, cached=["text-embedding-3-small", "hidden-chat"],
              pinned=["jina-reranker-v2-base"], hidden=["hidden-chat"])
    defaults.update(default_endpoint_id="ep", default_model="text-embedding-3-small")
    result = client.get("/api/default-chat").json()
    assert result == {"endpoint_id": "ep", "endpoint_url": "http://model.invalid/v1/chat/completions", "model": ""}
 def test_valid_explicit_model_survives_stale_catalog(defaults_api):
    client, factory, defaults = defaults_api
    _endpoint(factory, cached=["text-embedding-3-small", "other-chat"])
    defaults.update(default_endpoint_id="ep", default_model="my-custom-chat")
    assert client.get("/api/default-chat").json()["model"] == "my-custom-chat"
 def test_model_filter_preserves_owner_scope(defaults_api):
    client, factory, defaults = defaults_api
    _endpoint(factory, owner="bob", endpoint_id="bobs-endpoint", cached=["bobs-chat"])
    _endpoint(factory, cached=["text-embedding-3-small", "alices-chat"])
    defaults.update(default_endpoint_id="bobs-endpoint")
    result = client.get("/api/default-chat").json()
    assert result["endpoint_id"] == "ep"
    assert result["model"] == "alices-chat"
@@ -11,6 +11,8 @@ cache from the DB, where the rows are already gone, and the token is rejected.
 """
 import asyncio
 import types
 import pytest
 from fastapi import HTTPException
 from routes.auth_routes import setup_auth_routes, DeleteUserRequest
@@ -60,12 +62,9 @@ def test_refused_delete_does_not_invalidate_cache():
    invalidations = []
    router = setup_auth_routes(_auth_manager(delete_result=False))
    handler = _handler(router)
-    try:
+    with pytest.raises(HTTPException) as refused:
        asyncio.run(handler(DeleteUserRequest(username="admin"), _fake_request(invalidations)))
-        raised = False
+    assert refused.value.status_code == 400
    except Exception:
        raised = True
    assert raised, "a refused delete should raise (HTTP 400)"
    assert invalidations == [], "a refused delete must not touch the token cache"
@@ -0,0 +1,96 @@
 """ZIP exports keep language extensions and place collision suffixes before them."""
 import io
 import zipfile
 import pytest
 from fastapi import FastAPI, Request
 from fastapi.testclient import TestClient
 from sqlalchemy import create_engine
 from sqlalchemy.orm import sessionmaker
 from core.database import Base, Document
 from routes.document import document_routes
@pytest.fixture
 def exports(tmp_path, monkeypatch):
    engine = create_engine(f"sqlite:///{tmp_path / 'documents.db'}", connect_args={"check_same_thread": False})
    Base.metadata.create_all(engine)
    factory = sessionmaker(bind=engine)
    monkeypatch.setattr(document_routes, "SessionLocal", factory)
    monkeypatch.setenv("AUTH_ENABLED", "true")
    app = FastAPI()
    @app.middleware("http")
    async def fixture_user(request: Request, call_next):
        request.state.current_user = "alice"
        return await call_next(request)
    app.include_router(document_routes.setup_document_routes(None))
    def add(doc_id, title, language, content="body\n", owner="alice"):
        with factory() as db:
            db.add(Document(id=doc_id, title=title, language=language,
                            current_content=content, owner=owner, is_active=True))
            db.commit()
    with TestClient(app) as client:
        yield client, add
    engine.dispose()
@pytest.mark.parametrize("title,language,filename", [
    ("config.local", "python", "config.local.py"),
    ("report.v2", "markdown", "report.v2.md"),
    ("data.2024", "json", "data.2024.json"),
    ("module.ts", "typescript", "module.ts"),
    ("SCRIPT.PY", "python", "SCRIPT.PY"),
    ("résumé.v2", "text", "résumé.v2.txt"),
    ("unknown.v2", "unknown", "unknown.v2.txt"),
    ("draft", None, "draft.txt"),
    ("project/report.v2", "markdown", "projectreport.v2.md"),
 ])
 def test_export_uses_the_language_extension_even_for_dotted_titles(exports, title, language, filename):
    client, add = exports
    body = "Original text: α\n"
    add("doc", title, language, body)
    response = client.post("/api/documents/export-zip", json={"ids": ["doc"]})
    assert response.status_code == 200
    assert response.headers["content-type"] == "application/zip"
    with zipfile.ZipFile(io.BytesIO(response.content)) as archive:
        assert archive.namelist() == [filename]
        assert archive.read(filename).decode() == body
@pytest.mark.parametrize("title", ["config.local", "config.local.py"])
 def test_duplicate_names_keep_the_extension_at_the_end(exports, title):
    client, add = exports
    for i in range(3):
        add(str(i), title, "python", f"body {i}")
    response = client.post("/api/documents/export-zip", json={"ids": ["0", "1", "2"]})
    assert response.status_code == 200
    with zipfile.ZipFile(io.BytesIO(response.content)) as archive:
        assert set(archive.namelist()) == {"config.local.py", "config.local-1.py", "config.local-2.py"}
        assert {archive.read(name).decode() for name in archive.namelist()} == {"body 0", "body 1", "body 2"}
 def test_added_extension_collides_safely_with_an_existing_extension(exports):
    client, add = exports
    add("a", "report.v2", "markdown", "first")
    add("b", "report.v2.md", "markdown", "second")
    response = client.post("/api/documents/export-zip", json={"ids": ["a", "b"]})
    assert response.status_code == 200
    with zipfile.ZipFile(io.BytesIO(response.content)) as archive:
        assert set(archive.namelist()) == {"report.v2.md", "report.v2-1.md"}
        assert {archive.read(name) for name in archive.namelist()} == {b"first", b"second"}
 def test_foreign_documents_are_still_excluded_and_email_body_is_preserved(exports):
    client, add = exports
    add("owned", "reply.v2", "email", "Subject: Hello\n---\nBody")
    add("foreign", "private", "python", "secret", owner="bob")
    response = client.post("/api/documents/export-zip", json={"ids": ["owned", "foreign"]})
    assert response.status_code == 200
    with zipfile.ZipFile(io.BytesIO(response.content)) as archive:
        assert archive.namelist() == ["reply.v2.eml"]
        assert archive.read("reply.v2.eml") == b"Subject: Hello\r\n\r\nBody"
@@ -0,0 +1,47 @@
 """POST /api/documents/export-zip answers 400 for ids that are not a list of document ids."""
 import json
 from types import SimpleNamespace
 from unittest.mock import MagicMock
 import pytest
 from fastapi import HTTPException
 from tests.helpers.import_state import clear_fake_database_modules
 clear_fake_database_modules()
 import routes.document_routes as droutes
 class _Req:
    def __init__(self, body):
        self.state = SimpleNamespace(current_user="tester")
        self._body = body
    async def json(self):
        return self._body
 def _export_zip():
    router = droutes.setup_document_routes(MagicMock(), None)
    for r in router.routes:
        if getattr(r, "path", None) == "/api/documents/export-zip":
            return r.endpoint
    raise RuntimeError("export-zip route not found")
@pytest.mark.parametrize("body", [[], "x", 5, {}, {"ids": []}, {"ids": None}])
 async def test_missing_ids_is_a_400(body):
    with pytest.raises(HTTPException) as exc:
        await _export_zip()(_Req(body))
    assert exc.value.status_code == 400
    assert exc.value.detail == "No documents specified"
@pytest.mark.parametrize("ids", [5, "abc", {"a": 1}, [1, 2], [["a"]], ["a", None]])
 async def test_ids_that_are_not_a_list_of_strings_is_a_400(ids):
    with pytest.raises(HTTPException) as exc:
        await _export_zip()(_Req({"ids": ids}))
    assert exc.value.status_code == 400
    assert exc.value.detail == "ids must be a list of document ids"
@@ -0,0 +1,74 @@
 """Literal punctuation in library queries must not become SQL wildcards."""
 from types import SimpleNamespace
 from unittest.mock import MagicMock
 import pytest
 from core.database import Document
 from routes.document import document_routes
 from tests.helpers.database import disposable_database
 CASES = [
    ("100%", "100% complete", "1000 complete"),
    ("a_b", "a_b", "axb"),
    ("%", "price 10%", "price 100"),
    ("_", "a_b", "axb"),
    (r"path\notes", r"path\notes", "pathnotes"),
    (r"path\_tag", r"path\_tag", r"path\Xtag"),
    ("50%_done", "50%_done", "500Xdone"),
    ("can't", "can't stop", "cannot stop"),
    ("mixed case", "Case ordered Mixed", "Mixed without"),
 ]
@pytest.mark.parametrize("column", ["title", "current_content"])
@pytest.mark.parametrize("query,literal,lookalike", CASES)
@pytest.mark.asyncio
 async def test_library_search_matches_literal_tokens(tmp_path, monkeypatch, column, query, literal, lookalike):
    with disposable_database(tmp_path) as factory:
        monkeypatch.setattr(document_routes, "SessionLocal", factory)
        with factory() as db:
            for doc_id, text, owner, active, archived in [
                ("literal", literal, "alice", True, False),
                ("lookalike", lookalike, "alice", True, False),
                ("foreign", literal, "bob", True, False),
                ("inactive", literal, "alice", False, False),
                ("archived", literal, "alice", True, True),
            ]:
                fields = {"title": "Document", "current_content": "Body", column: text}
                db.add(Document(id=doc_id, owner=owner, is_active=active, archived=archived,
                                language="text", version_count=1, **fields))
            db.commit()
        router = document_routes.setup_document_routes(MagicMock())
        endpoint = next(r.endpoint for r in router.routes if r.path == "/api/documents/library")
        request = SimpleNamespace(state=SimpleNamespace(current_user="alice"))
        result = await endpoint(request, search=query, language=None, sort="recent", offset=0, limit=20, archived=False)
        assert result["total"] == 1
        assert [row["id"] for row in result["documents"]] == ["literal"]
        archived = await endpoint(request, search=query, language=None, sort="recent", offset=0, limit=20, archived=True)
        assert [row["id"] for row in archived["documents"]] == ["archived"]
@pytest.mark.asyncio
 async def test_literal_search_keeps_cross_field_and_pagination_behavior(tmp_path, monkeypatch):
    with disposable_database(tmp_path) as factory:
        monkeypatch.setattr(document_routes, "SessionLocal", factory)
        with factory() as db:
            for doc_id, title, content in [
                ("first", "100% ready", "done"),
                ("second", "done", "100% ready"),
                ("lookalike", "1000 ready", "done"),
                ("missing-term", "100% ready", "waiting"),
            ]:
                db.add(Document(id=doc_id, owner="alice", title=title, current_content=content,
                                is_active=True, archived=False, language="text", version_count=1))
            db.commit()
        router = document_routes.setup_document_routes(MagicMock())
        endpoint = next(r.endpoint for r in router.routes if r.path == "/api/documents/library")
        request = SimpleNamespace(state=SimpleNamespace(current_user="alice"))
        results = [await endpoint(request, search="100% done", language="text", sort="alpha",
                                  offset=offset, limit=1, archived=False) for offset in [0, 1]]
        assert all(result["total"] == 2 for result in results)
        assert {row["id"] for result in results for row in result["documents"]} == {"first", "second"}
--- a/Show More
+++ b/Show More