Add arXiv badge to README (#642 )

Add a red arXiv badge linking to the OpenJarvis paper (2605.17172) as the first item in the header badge row, matching the style used on the Intelligence-Per-Watt repo. Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Fix leaderboard savings lookup after provider-key rename (#635 )
2026-08-14 17:02:01 +00:00 · 2026-07-16 17:42:20 -07:00 · 2026-07-16 17:33:38 -07:00 · 2026-07-16 17:23:27 -07:00 · 2026-07-16 17:10:51 -07:00 · 2026-07-16 17:09:45 -07:00
192 changed files with 9100 additions and 5531 deletions
@@ -1,7 +1,7 @@
 {
  "schemaVersion": 1,
  "label": "Git Clones",
-  "message": "128,077",
+  "message": "159,322",
  "color": "green",
  "namedLogo": "git"
 }
@@ -1,6 +1,6 @@
 {
-  "total_clones": 128077,
-  "last_updated": "2026-06-22T08:05:29Z",
+  "total_clones": 159322,
+  "last_updated": "2026-07-16T08:08:14Z",
  "daily": {
    "2026-03-27": 2189,
    "2026-03-28": 1874,
@@ -88,6 +88,30 @@
    "2026-06-18": 1408,
    "2026-06-19": 1350,
    "2026-06-20": 1437,
-    "2026-06-21": 1426
+    "2026-06-21": 1426,
+    "2026-06-22": 1350,
+    "2026-06-23": 1468,
+    "2026-06-24": 1635,
+    "2026-06-25": 1640,
+    "2026-06-26": 1338,
+    "2026-06-27": 1338,
+    "2026-06-28": 1028,
+    "2026-06-29": 765,
+    "2026-06-30": 951,
+    "2026-07-01": 1134,
+    "2026-07-02": 593,
+    "2026-07-03": 537,
+    "2026-07-04": 411,
+    "2026-07-05": 485,
+    "2026-07-06": 555,
+    "2026-07-07": 905,
+    "2026-07-08": 1171,
+    "2026-07-09": 1857,
+    "2026-07-10": 1181,
+    "2026-07-11": 2185,
+    "2026-07-12": 1917,
+    "2026-07-13": 2102,
+    "2026-07-14": 2337,
+    "2026-07-15": 2362
  }
 }
@@ -32,6 +32,9 @@ jobs:
      - name: Ruff check
        run: uv run ruff check src/ tests/

+      - name: Ruff format check
+        run: uv run ruff format --check src/ tests/
+
  test:
    runs-on: ubuntu-latest
    steps:
@@ -40,7 +40,8 @@ jobs:
            libappindicator3-dev \
            librsvg2-dev \
            patchelf \
-            libxdo-dev
+            libxdo-dev \
+            libdbus-1-dev

      - name: Setup Node.js
        uses: actions/setup-node@v6
@@ -130,7 +131,8 @@ jobs:
            libappindicator3-dev \
            librsvg2-dev \
            patchelf \
-            libxdo-dev
+            libxdo-dev \
+            libdbus-1-dev

      - name: Install Rust stable
        uses: dtolnay/rust-toolchain@stable
@@ -252,6 +254,10 @@ jobs:
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
          TAURI_CONFIG: '{"version":"${{ steps.release-info.outputs.tauri_version }}","bundle":{"externalBin":["binaries/ollama"]}}'
+          # tauri-action runs beforeBuildCommand (npm run build:tauri -> vite
+          # build), which requires this at build time (#587). Strict for
+          # releases: a missing/empty secret fails the build by design.
+          VITE_SUPABASE_ANON_KEY: ${{ secrets.VITE_SUPABASE_ANON_KEY }}
        with:
          projectPath: frontend
          tauriScript: npx tauri
@@ -41,6 +41,26 @@ jobs:
      - name: Install dependencies
        run: uv sync --extra docs

+      # Inject the public Supabase anon key so the savings leaderboard works on
+      # the published docs site. Missing/empty (e.g. fork PRs) leaves the
+      # leaderboard gracefully disabled. The key is read from env (not inlined)
+      # and JSON-encoded into a JS string literal to avoid any injection.
+      - name: Inject leaderboard Supabase anon key
+        env:
+          OPENJARVIS_LEADERBOARD_ANON: ${{ secrets.VITE_SUPABASE_ANON_KEY }}
+        run: |
+          python3 - <<'PY'
+          import json, os, pathlib
+
+          key = os.environ.get("OPENJARVIS_LEADERBOARD_ANON", "")
+          pathlib.Path("docs/javascripts/leaderboard-config.js").write_text(
+              "// Generated at docs-build time from the VITE_SUPABASE_ANON_KEY secret.\n"
+              "window.OPENJARVIS_SUPABASE_ANON_KEY = " + json.dumps(key) + ";\n",
+              encoding="utf-8",
+          )
+          print("leaderboard anon key:", "set" if key else "empty (leaderboard disabled)")
+          PY
+
      - name: Build documentation
        run: uv run mkdocs build

@@ -35,3 +35,8 @@ jobs:
      - run: npm ci
      - run: npx tsc --noEmit
      - run: npm run build
+        env:
+          # Optional: when the secret is unset the build still succeeds and the
+          # leaderboard is disabled (see src/lib/supabase.ts). No placeholder,
+          # so a keyless CI build doesn't bake in a bogus anon key.
+          VITE_SUPABASE_ANON_KEY: ${{ secrets.VITE_SUPABASE_ANON_KEY }}
@@ -55,6 +55,8 @@ jobs:
          cache-dependency-path: frontend/package-lock.json

      - name: Build frontend and bundle into package
+        env:
+          VITE_SUPABASE_ANON_KEY: ${{ secrets.VITE_SUPABASE_ANON_KEY }}
        run: |
          set -euo pipefail
          cd frontend
@@ -0,0 +1,19 @@
+.PHONY: setup build test lint format
+
+# Mirrors .github/workflows/ci.yml so `make test` matches CI locally.
+
+setup:
+	uv sync --extra dev --extra framework-comparison --extra server
+
+build:
+	uv run maturin develop --manifest-path rust/crates/openjarvis-python/Cargo.toml
+
+test: build
+	uv run pytest tests/ -n auto -q --tb=short -m "not live and not cloud and not hub"
+
+lint:
+	uv run ruff check src/ tests/
+	uv run ruff format --check src/ tests/
+
+format:
+	uv run ruff format src/ tests/
@@ -4,7 +4,8 @@
  <p><i>Personal AI, On Personal Devices.</i></p>

  <p>
-    <a href="https://scalingintelligence.stanford.edu/blogs/openjarvis/"><img src="https://img.shields.io/badge/project-OpenJarvis-blue" alt="Project"></a>
+    <a href="https://arxiv.org/abs/2605.17172"><img src="https://img.shields.io/badge/arXiv-2605.17172-b31b1b.svg" alt="arXiv"></a>
+    <a href="https://openjarvis.stanford.edu/"><img src="https://img.shields.io/badge/project-OpenJarvis-blue" alt="Project"></a>
    <a href="https://open-jarvis.github.io/OpenJarvis/"><img src="https://img.shields.io/badge/docs-mkdocs-blue" alt="Docs"></a>
    <img src="https://img.shields.io/badge/python-%3E%3D3.10-blue" alt="Python">
    <img src="https://img.shields.io/badge/license-Apache%202.0-green" alt="License">
@@ -23,7 +24,7 @@

 > **[Documentation](https://open-jarvis.github.io/OpenJarvis/)**
 >
-> **[Project Site](https://scalingintelligence.stanford.edu/blogs/openjarvis/)**
+> **[Project Site](https://openjarvis.stanford.edu/)**
 >
 > **[Paper](https://arxiv.org/abs/2605.17172)**
 >
@@ -1,34 +1,83 @@
+# Base images are pinned to an immutable digest (in addition to a human-readable
+# tag) so every build resolves the exact same layers — reproducible builds and
+# safe rollbacks (#563).
+
 # Stage 1: Build frontend SPA
-FROM node:22-slim AS frontend
+FROM node:22.23.0-slim@sha256:d9f850096136edbc402debdd8729579a288aac64574ada0ff4db26b6ae58b0b2 AS frontend
+# Public Supabase anon key for the savings leaderboard; empty by default so
+# the image's leaderboard stays disabled (#589). Pass --build-arg to enable.
+ARG OPENJARVIS_LEADERBOARD_PUBLIC_ANON=

 WORKDIR /frontend
 COPY frontend/package.json frontend/package-lock.json* ./
 RUN npm ci --ignore-scripts 2>/dev/null || npm install
 COPY frontend/ .
-RUN npm run build
+RUN VITE_SUPABASE_ANON_KEY="${OPENJARVIS_LEADERBOARD_PUBLIC_ANON}" npm run build

 # Stage 2: Build Python package
-FROM python:3.12-slim-bookworm AS builder
+FROM python:3.12.13-slim-bookworm@sha256:76d4b7b6305788c6b4c6a19d6a22a3921bf802e9af4d5e1e5bd771208dba74bf AS builder
+
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends build-essential ca-certificates curl && \
+    rm -rf /var/lib/apt/lists/*
+
+ENV PATH="/root/.cargo/bin:${PATH}"
+
+RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | \
+        sh -s -- -y --profile minimal --default-toolchain none && \
+    rustup toolchain install 1.88 --profile minimal && \
+    rustup default 1.88

 WORKDIR /app
-COPY pyproject.toml README.md ./
+
+# Install dependencies from the committed lockfile (#567). `uv export --frozen`
+# reads uv.lock as-is (no re-resolution) and emits a fully pinned, hash-verified
+# requirements set; `--no-deps` then installs exactly that set. This is a
+# separate layer from the source copy so dependency installs stay cached when
+# only application code changes.
+COPY pyproject.toml uv.lock README.md ./
+RUN pip install --no-cache-dir uv && \
+    uv export --frozen --no-dev --extra server --no-emit-project > requirements.txt && \
+    uv pip install --system --no-deps -r requirements.txt && \
+    uv pip install --system --no-deps "maturin>=1.12.6,<2"
+
+# Copy the source and the non-src force-include paths (see pyproject
+# [tool.hatch.build.targets.wheel.force-include]) before building the project.
 COPY src/ src/
+COPY rust/ rust/
 COPY scripts/install scripts/install
 COPY deploy/windows deploy/windows

 # Copy built frontend into the server static directory
 COPY --from=frontend /src/openjarvis/server/static src/openjarvis/server/static/

-RUN pip install --no-cache-dir uv && \
-    uv pip install --system ".[server]"
+# Install the project itself without re-resolving dependencies.
+RUN uv pip install --system --no-deps . && \
+    maturin build --release \
+        --manifest-path rust/crates/openjarvis-python/Cargo.toml \
+        --interpreter python3 \
+        --out /tmp/openjarvis-rust-wheel && \
+    uv pip install --system --no-deps /tmp/openjarvis-rust-wheel/*.whl && \
+    python3 -c "import openjarvis_rust; print('openjarvis_rust ok')" && \
+    python3 -m pip uninstall -y maturin && \
+    rm -rf /tmp/openjarvis-rust-wheel rust

 # Stage 3: Runtime
-FROM python:3.12-slim-bookworm
+FROM python:3.12.13-slim-bookworm@sha256:76d4b7b6305788c6b4c6a19d6a22a3921bf802e9af4d5e1e5bd771208dba74bf

 COPY --from=builder /usr/local /usr/local
 COPY --from=builder /app /app
 WORKDIR /app

+# Run as an unprivileged user — the server needs no root privileges, so dropping
+# them limits the blast radius of a compromise (#565). The app writes only to
+# $HOME (config/cache/state), which is owned by this user.
+RUN groupadd --system --gid 10001 openjarvis && \
+    useradd --system --uid 10001 --gid openjarvis \
+        --create-home --home-dir /home/openjarvis openjarvis
+ENV HOME=/home/openjarvis
+USER openjarvis
+
 EXPOSE 8000

 ENTRYPOINT ["jarvis"]
@@ -1,32 +1,69 @@
+# Base images are pinned to an immutable digest (in addition to a human-readable
+# tag) so every build resolves the exact same layers — reproducible builds and
+# safe rollbacks (#563).
+
 # Stage 1: Build frontend SPA
-FROM node:22-slim AS frontend
+FROM node:22.23.0-slim@sha256:d9f850096136edbc402debdd8729579a288aac64574ada0ff4db26b6ae58b0b2 AS frontend
+# Public Supabase anon key for the savings leaderboard; empty by default so
+# the image's leaderboard stays disabled (#589). Pass --build-arg to enable.
+ARG OPENJARVIS_LEADERBOARD_PUBLIC_ANON=

 WORKDIR /frontend
 COPY frontend/package.json frontend/package-lock.json* ./
 RUN npm ci --ignore-scripts 2>/dev/null || npm install
 COPY frontend/ .
-RUN npm run build
+RUN VITE_SUPABASE_ANON_KEY="${OPENJARVIS_LEADERBOARD_PUBLIC_ANON}" npm run build

 # Stage 2: Build Python package (NVIDIA CUDA 12.4)
-FROM nvidia/cuda:12.4.0-runtime-ubuntu22.04 AS builder
+FROM nvidia/cuda:12.4.0-runtime-ubuntu22.04@sha256:af8bd179ed3bf69d4b63b19a763662a6141f0f62ef099283f68d0b14b4bab0e3 AS builder

 RUN apt-get update && \
-    apt-get install -y --no-install-recommends python3 python3-pip python3-venv && \
+    apt-get install -y --no-install-recommends \
+        build-essential \
+        ca-certificates \
+        curl \
+        python3 \
+        python3-dev \
+        python3-pip \
+        python3-venv && \
    rm -rf /var/lib/apt/lists/*

+ENV PATH="/root/.cargo/bin:${PATH}"
+
+RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | \
+        sh -s -- -y --profile minimal --default-toolchain none && \
+    rustup toolchain install 1.88 --profile minimal && \
+    rustup default 1.88
+
 WORKDIR /app
-COPY pyproject.toml README.md ./
+
+# Install dependencies from the committed lockfile (#567). See deploy/docker/Dockerfile
+# for the rationale behind the frozen export + --no-deps install.
+COPY pyproject.toml uv.lock README.md ./
+RUN pip install --no-cache-dir uv && \
+    uv export --frozen --no-dev --extra server --no-emit-project > requirements.txt && \
+    uv pip install --system --no-deps -r requirements.txt && \
+    uv pip install --system --no-deps "maturin>=1.12.6,<2"
+
 COPY src/ src/
+COPY rust/ rust/
 COPY scripts/install scripts/install
 COPY deploy/windows deploy/windows

 COPY --from=frontend /src/openjarvis/server/static src/openjarvis/server/static/

-RUN pip install --no-cache-dir uv && \
-    uv pip install --system ".[server]"
+RUN uv pip install --system --no-deps . && \
+    maturin build --release \
+        --manifest-path rust/crates/openjarvis-python/Cargo.toml \
+        --interpreter python3 \
+        --out /tmp/openjarvis-rust-wheel && \
+    uv pip install --system --no-deps /tmp/openjarvis-rust-wheel/*.whl && \
+    python3 -c "import openjarvis_rust; print('openjarvis_rust ok')" && \
+    python3 -m pip uninstall -y maturin && \
+    rm -rf /tmp/openjarvis-rust-wheel rust

 # Stage 3: Runtime
-FROM nvidia/cuda:12.4.0-runtime-ubuntu22.04
+FROM nvidia/cuda:12.4.0-runtime-ubuntu22.04@sha256:af8bd179ed3bf69d4b63b19a763662a6141f0f62ef099283f68d0b14b4bab0e3

 RUN apt-get update && \
    apt-get install -y --no-install-recommends python3 python3-pip && \
@@ -36,6 +73,14 @@ COPY --from=builder /usr/local /usr/local
 COPY --from=builder /app /app
 WORKDIR /app

+# Run as an unprivileged user (#565). NVIDIA device nodes (/dev/nvidia*) are
+# world-accessible, so GPU workloads do not require root.
+RUN groupadd --system --gid 10001 openjarvis && \
+    useradd --system --uid 10001 --gid openjarvis \
+        --create-home --home-dir /home/openjarvis openjarvis
+ENV HOME=/home/openjarvis
+USER openjarvis
+
 EXPOSE 8000

 ENTRYPOINT ["jarvis"]
@@ -1,32 +1,69 @@
+# Base images are pinned to an immutable digest (in addition to a human-readable
+# tag) so every build resolves the exact same layers — reproducible builds and
+# safe rollbacks (#563).
+
 # Stage 1: Build frontend SPA
-FROM node:22-slim AS frontend
+FROM node:22.23.0-slim@sha256:d9f850096136edbc402debdd8729579a288aac64574ada0ff4db26b6ae58b0b2 AS frontend
+# Public Supabase anon key for the savings leaderboard; empty by default so
+# the image's leaderboard stays disabled (#589). Pass --build-arg to enable.
+ARG OPENJARVIS_LEADERBOARD_PUBLIC_ANON=

 WORKDIR /frontend
 COPY frontend/package.json frontend/package-lock.json* ./
 RUN npm ci --ignore-scripts 2>/dev/null || npm install
 COPY frontend/ .
-RUN npm run build
+RUN VITE_SUPABASE_ANON_KEY="${OPENJARVIS_LEADERBOARD_PUBLIC_ANON}" npm run build

 # Stage 2: Build Python package (AMD ROCm 7.2)
-FROM rocm/dev-ubuntu-22.04:7.2 AS builder
+FROM rocm/dev-ubuntu-22.04:7.2@sha256:05af5f04a06b04676d4c7438997d0deadaeb7478961ad621376e199bf3aeb644 AS builder

 RUN apt-get update && \
-    apt-get install -y --no-install-recommends python3 python3-pip python3-venv && \
+    apt-get install -y --no-install-recommends \
+        build-essential \
+        ca-certificates \
+        curl \
+        python3 \
+        python3-dev \
+        python3-pip \
+        python3-venv && \
    rm -rf /var/lib/apt/lists/*

+ENV PATH="/root/.cargo/bin:${PATH}"
+
+RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | \
+        sh -s -- -y --profile minimal --default-toolchain none && \
+    rustup toolchain install 1.88 --profile minimal && \
+    rustup default 1.88
+
 WORKDIR /app
-COPY pyproject.toml README.md ./
+
+# Install dependencies from the committed lockfile (#567). See deploy/docker/Dockerfile
+# for the rationale behind the frozen export + --no-deps install.
+COPY pyproject.toml uv.lock README.md ./
+RUN pip install --no-cache-dir uv && \
+    uv export --frozen --no-dev --extra server --no-emit-project > requirements.txt && \
+    uv pip install --system --no-deps -r requirements.txt && \
+    uv pip install --system --no-deps "maturin>=1.12.6,<2"
+
 COPY src/ src/
+COPY rust/ rust/
 COPY scripts/install scripts/install
 COPY deploy/windows deploy/windows

 COPY --from=frontend /src/openjarvis/server/static src/openjarvis/server/static/

-RUN pip install --no-cache-dir uv && \
-    uv pip install --system ".[server]"
+RUN uv pip install --system --no-deps . && \
+    maturin build --release \
+        --manifest-path rust/crates/openjarvis-python/Cargo.toml \
+        --interpreter python3 \
+        --out /tmp/openjarvis-rust-wheel && \
+    uv pip install --system --no-deps /tmp/openjarvis-rust-wheel/*.whl && \
+    python3 -c "import openjarvis_rust; print('openjarvis_rust ok')" && \
+    python3 -m pip uninstall -y maturin && \
+    rm -rf /tmp/openjarvis-rust-wheel rust

 # Stage 3: Runtime
-FROM rocm/dev-ubuntu-22.04:7.2
+FROM rocm/dev-ubuntu-22.04:7.2@sha256:05af5f04a06b04676d4c7438997d0deadaeb7478961ad621376e199bf3aeb644

 RUN apt-get update && \
    apt-get install -y --no-install-recommends python3 python3-pip && \
@@ -36,6 +73,18 @@ COPY --from=builder /usr/local /usr/local
 COPY --from=builder /app /app
 WORKDIR /app

+# Run as an unprivileged user (#565). ROCm GPU access is gated by the `video` and
+# `render` groups (see group_add in docker-compose.gpu.rocm.yml), so the user is
+# added to both; root is not required.
+RUN groupadd --system --gid 10001 openjarvis && \
+    useradd --system --uid 10001 --gid openjarvis \
+        --create-home --home-dir /home/openjarvis openjarvis && \
+    (getent group video  >/dev/null || groupadd --system video) && \
+    (getent group render >/dev/null || groupadd --system render) && \
+    usermod -aG video,render openjarvis
+ENV HOME=/home/openjarvis
+USER openjarvis
+
 EXPOSE 8000

 ENTRYPOINT ["jarvis"]
@@ -1,15 +1,69 @@
-FROM python:3.12-slim
+# Base images are pinned to an immutable digest (in addition to a human-readable
+# tag) so every build resolves the exact same layers (#563).

-# Install Node.js 22
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    curl ca-certificates && \
-    curl -fsSL https://deb.nodesource.com/setup_22.x | bash - && \
-    apt-get install -y nodejs && \
+# Node.js is sourced from the official, digest-pinned image rather than piping a
+# remote setup script into bash (`curl ... | bash -`), which performed no
+# checksum or signature verification of the downloaded installer (#566). The
+# image digest is the integrity check, and the copy is architecture-agnostic.
+FROM node:22.23.0-slim@sha256:d9f850096136edbc402debdd8729579a288aac64574ada0ff4db26b6ae58b0b2 AS node
+
+FROM python:3.12.13-slim-bookworm@sha256:76d4b7b6305788c6b4c6a19d6a22a3921bf802e9af4d5e1e5bd771208dba74bf AS builder
+
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends build-essential ca-certificates curl && \
    rm -rf /var/lib/apt/lists/*

+ENV PATH="/root/.cargo/bin:${PATH}"
+
+RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | \
+        sh -s -- -y --profile minimal --default-toolchain none && \
+    rustup toolchain install 1.88 --profile minimal && \
+    rustup default 1.88
+
 WORKDIR /app
+
+# Install dependencies from the committed lockfile (#567): `uv export --frozen`
+# reads uv.lock as-is and emits a pinned, hash-verified set installed with
+# --no-deps (no re-resolution). Copied first so this layer caches independently
+# of application source.
+COPY pyproject.toml uv.lock README.md ./
+RUN pip install --no-cache-dir uv && \
+    uv export --frozen --no-dev --extra server --no-emit-project > requirements.txt && \
+    uv pip install --system --no-deps -r requirements.txt && \
+    uv pip install --system --no-deps "maturin>=1.12.6,<2"
+
 COPY . .
-RUN pip install --no-cache-dir ".[server]"
+
+# Install the project itself without re-resolving dependencies.
+RUN uv pip install --system --no-deps . && \
+    maturin build --release \
+        --manifest-path rust/crates/openjarvis-python/Cargo.toml \
+        --interpreter python3 \
+        --out /tmp/openjarvis-rust-wheel && \
+    uv pip install --system --no-deps /tmp/openjarvis-rust-wheel/*.whl && \
+    python3 -c "import openjarvis_rust; print('openjarvis_rust ok')" && \
+    python3 -m pip uninstall -y maturin && \
+    rm -rf /tmp/openjarvis-rust-wheel rust/target
+
+FROM python:3.12.13-slim-bookworm@sha256:76d4b7b6305788c6b4c6a19d6a22a3921bf802e9af4d5e1e5bd771208dba74bf
+
+# libstdc++6 + ca-certificates are the only runtime requirements of the Node
+# binary copied below (the python slim image already provides libc/libgcc).
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends ca-certificates libstdc++6 && \
+    rm -rf /var/lib/apt/lists/*
+
+COPY --from=builder /usr/local /usr/local
+COPY --from=builder /app /app
+
+# Transplant the Node.js runtime from the official image. Both images are Debian
+# bookworm, so the glibc/libstdc++ ABI matches.
+COPY --from=node /usr/local/bin/node /usr/local/bin/node
+COPY --from=node /usr/local/lib/node_modules /usr/local/lib/node_modules
+RUN ln -sf /usr/local/lib/node_modules/npm/bin/npm-cli.js /usr/local/bin/npm && \
+    ln -sf /usr/local/lib/node_modules/npm/bin/npx-cli.js /usr/local/bin/npx
+
+WORKDIR /app

 LABEL openjarvis-sandbox=true

@@ -18,7 +18,9 @@ services:
              capabilities: [gpu]

  ollama:
-    image: ollama/ollama:latest
+    # Pinned to a fixed version + digest for reproducible deployments (#563);
+    # must match the tag in docker-compose.yml.
+    image: ollama/ollama:0.30.10@sha256:bfc9c6d53cc6989aa5131a6fde6b162b2802d4d337657f3253b5f69579bddeee
    environment:
      - NVIDIA_VISIBLE_DEVICES=all
      - NVIDIA_DRIVER_CAPABILITIES=compute,utility
@@ -18,7 +18,9 @@ services:
    restart: unless-stopped

  ollama:
-    image: ollama/ollama:latest
+    # Pinned to a fixed version + digest for reproducible deployments and
+    # predictable rollbacks (#563). Bump deliberately, not implicitly via :latest.
+    image: ollama/ollama:0.30.10@sha256:bfc9c6d53cc6989aa5131a6fde6b162b2802d4d337657f3253b5f69579bddeee
    ports:
      - "11434:11434"
    volumes:
@@ -14,7 +14,27 @@ Environment=HOME=/opt/openjarvis
 #   OPENJARVIS_API_KEY=<key>      (generate one: `jarvis auth generate-key`)
 # It is not prefixed with "-", so the unit fails to start if the file is
 # missing — preventing an accidentally unauthenticated public server.
+# Keep secrets here (mode 0600, owned by root) rather than inline Environment=
+# lines, which leak into `systemctl show` and the journal.
 EnvironmentFile=/etc/openjarvis/env

+# --- Sandboxing / hardening (#564) ---
+# Conservative set: tightens the unit without blocking the server's normal I/O
+# or local GPU inference. ProtectSystem=strict makes the whole filesystem
+# read-only except ReadWritePaths, so $HOME (config/cache/state under
+# /opt/openjarvis) stays writable.
+NoNewPrivileges=true
+ProtectSystem=strict
+ReadWritePaths=/opt/openjarvis
+ProtectHome=true
+PrivateTmp=true
+ProtectControlGroups=true
+ProtectKernelLogs=true
+ProtectKernelModules=true
+ProtectKernelTunables=true
+RestrictRealtime=true
+RestrictSUIDSGID=true
+LockPersonality=true
+
 [Install]
 WantedBy=multi-user.target
@@ -20,8 +20,8 @@ What it does:
 4. Installs `uv` (https://astral.sh/uv) if absent.
 5. Clones the OpenJarvis repository to `%LOCALAPPDATA%\OpenJarvis`
   (override with `$env:OPENJARVIS_HOME`).
-6. Runs `uv sync --extra desktop` so the FastAPI server and speech backend are
-   importable.
+6. Runs `uv sync --extra desktop --group desktop-native` so the FastAPI server,
+   speech backend, and native extension are importable.
 7. Optionally prompts to register a scheduled task that auto-starts the
   server at logon.

@@ -105,7 +105,7 @@ To pull the latest:
 ```powershell
 cd "$env:LOCALAPPDATA\OpenJarvis\src"
 git pull --ff-only
-uv sync --extra desktop
+uv sync --extra desktop --group desktop-native
 ```

 Or re-run the installer with `-Force`:
@@ -16,8 +16,8 @@
      4. Install uv (https://astral.sh/uv) if absent.
      5. Clone the OpenJarvis repository to $env:LOCALAPPDATA\OpenJarvis
         (override with $env:OPENJARVIS_HOME).
-      6. Run `uv sync --extra desktop` so the FastAPI server and speech
-         backend are importable.
+      6. Run `uv sync --extra desktop --group desktop-native` so the FastAPI
+         server, speech backend, and native extension are importable.
      7. Optionally register the scheduled-task service (see
         deploy/windows/jarvis-service.ps1).

@@ -279,13 +279,13 @@ if (Test-Path (Join-Path $srcDir '.git')) {
 }

 # ---------------------------------------------------------------------------
-# 6. uv sync --extra desktop
+# 6. uv sync --extra desktop --group desktop-native
 # ---------------------------------------------------------------------------

-Write-Info "Running 'uv sync --extra desktop' in $srcDir (this can take a few minutes)..."
+Write-Info "Running 'uv sync --extra desktop --group desktop-native' in $srcDir (this can take a few minutes)..."
 Push-Location $srcDir
 try {
-    & $uvExe sync --extra desktop
+    & $uvExe sync --extra desktop --group desktop-native
    if ($LASTEXITCODE -ne 0) {
        Write-Fail "uv sync failed with exit code $LASTEXITCODE. Check the output above."
    }
@@ -8,7 +8,7 @@ avoid a Linux VM; WSL2 remains the smoother experience for most users.
 ## What you get

 - A PowerShell installer that probes prerequisites, installs `uv`,
-  clones the repo, and runs `uv sync --extra desktop`.
+  clones the repo, and runs `uv sync --extra desktop --group desktop-native`.
 - An optional Windows scheduled-task service equivalent to the systemd
  unit and launchd plist.
 - Loopback default — the service binds `127.0.0.1` so no API key is
@@ -38,7 +38,7 @@ The installer will:
 4. Install `uv` if absent (via the official `astral.sh/uv` PowerShell
   installer).
 5. Clone the repo to `%LOCALAPPDATA%\OpenJarvis\src`.
-6. Run `uv sync --extra desktop`.
+6. Run `uv sync --extra desktop --group desktop-native`.
 7. Prompt to register the scheduled-task service (skip with
   `-SkipService`).

@@ -215,7 +215,7 @@ OpenJarvis is built around five composable layers. Each has a clean interface an

 OpenJarvis is part of [Intelligence Per Watt](https://www.intelligence-per-watt.ai/), a research initiative studying the efficiency of on-device AI systems. Developed at [Hazy Research](https://hazyresearch.stanford.edu/) and the [Scaling Intelligence Lab](https://scalingintelligence.stanford.edu/) at [Stanford SAIL](https://ai.stanford.edu/).

-Read the [blog post](https://scalingintelligence.stanford.edu/blogs/openjarvis/) for the full research motivation, architecture details, and experimental results.
+Read the [blog post](https://openjarvis.stanford.edu/) for the full research motivation, architecture details, and experimental results.

 ## Citation

@@ -0,0 +1,12 @@
+// Public Supabase config for the savings leaderboard.
+//
+// This file is loaded *before* leaderboard.js and supplies the anon key it
+// reads from `window.OPENJARVIS_SUPABASE_ANON_KEY`. The key is injected at
+// docs-build time from the VITE_SUPABASE_ANON_KEY repo secret (see
+// .github/workflows/docs.yml). It is intentionally empty here so that local
+// `mkdocs build` and fork pull requests — which have no secret — render the
+// graceful "Leaderboard not configured yet" message instead of failing.
+//
+// The anon key is public by design: Supabase Row-Level Security protects the
+// data, so shipping it in the public docs bundle is expected.
+window.OPENJARVIS_SUPABASE_ANON_KEY = "";
@@ -1,9 +1,9 @@
 (function () {
  "use strict";

-  var SUPABASE_URL = "https://mtbtgpwzrbostweaanpr.supabase.co";
-  var SUPABASE_ANON_KEY =
-    "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6Im10YnRncHd6cmJvc3R3ZWFhbnByIiwicm9sZSI6ImFub24iLCJpYXQiOjE3NzMxODk0OTQsImV4cCI6MjA4ODc2NTQ5NH0._xMlqCfljtXpwPj54H-ghxfLFO-jiq4W2WhpU8vVL1c";
+  var SUPABASE_URL =
+    window.OPENJARVIS_SUPABASE_URL || "https://mtbtgpwzrbostweaanpr.supabase.co";
+  var SUPABASE_ANON_KEY = window.OPENJARVIS_SUPABASE_ANON_KEY || "";

  var PAGE_SIZE = 50;
  var allRows = [];
@@ -55,5 +55,5 @@ See how the OpenJarvis community saves money, energy, and compute by running AI
 <div id="leaderboard-pagination" class="lb-pagination"></div>

 <p style="font-size:12px;opacity:0.6;margin-top:12px">
-*Dollar savings estimated vs. Claude Opus 4.6 API pricing ($5/1M input, $25/1M output tokens). Assumes local open-source models produce roughly the same number of tokens per request as cloud models.
+*Dollar savings estimated vs. Claude Fable 5 API pricing ($10/1M input, $50/1M output tokens). Assumes local open-source models produce roughly the same number of tokens per request as cloud models.
 </p>
@@ -19,6 +19,71 @@ Agents are the agentic logic layer of OpenJarvis. They determine how a query is

 ---

+## Persistent Persona: SOUL.md, MEMORY.md, USER.md
+
+Every agent's system prompt is assembled at conversation start by the `SystemPromptBuilder`, which injects up to three optional Markdown files -- the **persistent persona**. They are plain text you own and edit, loaded at the start of each conversation. There is no vector database or embedding cache behind them.
+
+| File | What it holds | Example line |
+|------|---------------|--------------|
+| `SOUL.md` | How the agent should behave -- tone, length, what to push back on | `Be concise. Challenge weak assumptions.` |
+| `MEMORY.md` | Facts about you, your projects, your preferences | `I deploy to Postgres, never MySQL.` |
+| `USER.md` | Who you are -- role, team, context | `Backend engineer at Acme, on the payments team.` |
+
+This persona is distinct from the retrieval [memory backend](memory.md): the persona is always-on Markdown context loaded into the prompt, while the memory backend is searchable long-term storage the agent queries on demand.
+
+### Where they live
+
+By default the files are read from the config directory:
+
+```
+~/.openjarvis/SOUL.md
+~/.openjarvis/MEMORY.md
+~/.openjarvis/USER.md
+```
+
+(The config directory honors `$OPENJARVIS_HOME` / `$XDG_DATA_HOME` when set.) The paths are configurable under `[memory_files]`:
+
+```toml
+[memory_files]
+soul_path    = "~/.openjarvis/SOUL.md"
+memory_path  = "~/.openjarvis/MEMORY.md"
+user_path    = "~/.openjarvis/USER.md"
+persona_name = ""    # optional named persona -- see below
+```
+
+### How they're loaded
+
+At the start of each conversation, `SystemPromptBuilder` reads each file as UTF-8 and adds its contents as a section of the system prompt, after the agent template and before the skill catalog:
+
+- **All three are optional.** A missing or empty file is skipped, so any subset works and an install with no persona files behaves exactly as before.
+- **Edits apply to the next conversation.** The files are read once when a conversation's prompt is built, so there is no restart or re-indexing -- edit or delete a line and it takes effect the next time you start a conversation.
+- **Each section is length-capped.** Files are truncated to a per-section character budget so a large `MEMORY.md` cannot crowd out the rest of the prompt.
+
+### Named personas
+
+A single install can answer as different personas without changing global config. A named persona lives in its own directory:
+
+```
+~/.openjarvis/personas/<name>/SOUL.md
+~/.openjarvis/personas/<name>/MEMORY.md
+~/.openjarvis/personas/<name>/USER.md
+```
+
+Select one per invocation, or opt out entirely:
+
+```bash
+jarvis ask --persona work  "summarize my open PRs"
+jarvis ask --persona none  "what is 2 + 2?"     # inject no persona
+```
+
+Set `persona_name` under `[memory_files]` to make a named persona the default. `persona_name = "none"` (equivalently `--persona none`) disables persona injection for that run.
+
+### Editing them
+
+`SOUL.md`, `MEMORY.md`, and `USER.md` are plain Markdown -- open them in any editor. `MEMORY.md` and `USER.md` can also be updated by the agent itself through the `memory_manage` and `user_profile_manage` tools when those are enabled, so the agent can record a new fact mid-conversation. These tools always target the default `MEMORY.md` and `USER.md` (under `~/.openjarvis/`), never a named persona's copies -- edit those by hand.
+
+---
+
 ## BaseAgent ABC

 All agents extend the abstract `BaseAgent` class.
@@ -11,7 +11,7 @@
        "@base-ui/react": "^1.3.0",
        "@fontsource-variable/geist": "^5.2.8",
        "@tailwindcss/vite": "^4.2.1",
-        "@tauri-apps/api": "^2",
+        "@tauri-apps/api": "^2.11.1",
        "@tauri-apps/plugin-autostart": "^2",
        "@tauri-apps/plugin-dialog": "^2.7.0",
        "@tauri-apps/plugin-global-shortcut": "^2",
@@ -42,7 +42,7 @@
        "zustand": "^5.0.11"
      },
      "devDependencies": {
-        "@tauri-apps/cli": "^2",
+        "@tauri-apps/cli": "^2.11.4",
        "@types/react": "^19.0.0",
        "@types/react-dom": "^19.0.0",
        "@vitejs/plugin-react": "^4.3.4",
@@ -3720,9 +3720,9 @@
      }
    },
    "node_modules/@tauri-apps/api": {
-      "version": "2.10.1",
-      "resolved": "https://registry.npmjs.org/@tauri-apps/api/-/api-2.10.1.tgz",
-      "integrity": "sha512-hKL/jWf293UDSUN09rR69hrToyIXBb8CjGaWC7gfinvnQrBVvnLr08FeFi38gxtugAVyVcTa5/FD/Xnkb1siBw==",
+      "version": "2.11.1",
+      "resolved": "https://registry.npmjs.org/@tauri-apps/api/-/api-2.11.1.tgz",
+      "integrity": "sha512-M2FPuYND2m+wh5hfW9ZpSdxMPdEJovPBWwoHJmwUpysTYNHaOkVFN419m/K0LIgjb/7KU2vBgsUepJWugQCvAA==",
      "license": "Apache-2.0 OR MIT",
      "funding": {
        "type": "opencollective",
@@ -3730,9 +3730,9 @@
      }
    },
    "node_modules/@tauri-apps/cli": {
-      "version": "2.10.1",
-      "resolved": "https://registry.npmjs.org/@tauri-apps/cli/-/cli-2.10.1.tgz",
-      "integrity": "sha512-jQNGF/5quwORdZSSLtTluyKQ+o6SMa/AUICfhf4egCGFdMHqWssApVgYSbg+jmrZoc8e1DscNvjTnXtlHLS11g==",
+      "version": "2.11.4",
+      "resolved": "https://registry.npmjs.org/@tauri-apps/cli/-/cli-2.11.4.tgz",
+      "integrity": "sha512-R8xGtMpwyetawSqm9kYOuMmEqkhUbvcUy8n0aNXIxollKBLESUu5f4Fx+64hgASYm1H+jSWq6jCW6zqTnH6hqQ==",
      "dev": true,
      "license": "Apache-2.0 OR MIT",
      "bin": {
@@ -3746,23 +3746,23 @@
        "url": "https://opencollective.com/tauri"
      },
      "optionalDependencies": {
-        "@tauri-apps/cli-darwin-arm64": "2.10.1",
-        "@tauri-apps/cli-darwin-x64": "2.10.1",
-        "@tauri-apps/cli-linux-arm-gnueabihf": "2.10.1",
-        "@tauri-apps/cli-linux-arm64-gnu": "2.10.1",
-        "@tauri-apps/cli-linux-arm64-musl": "2.10.1",
-        "@tauri-apps/cli-linux-riscv64-gnu": "2.10.1",
-        "@tauri-apps/cli-linux-x64-gnu": "2.10.1",
-        "@tauri-apps/cli-linux-x64-musl": "2.10.1",
-        "@tauri-apps/cli-win32-arm64-msvc": "2.10.1",
-        "@tauri-apps/cli-win32-ia32-msvc": "2.10.1",
-        "@tauri-apps/cli-win32-x64-msvc": "2.10.1"
+        "@tauri-apps/cli-darwin-arm64": "2.11.4",
+        "@tauri-apps/cli-darwin-x64": "2.11.4",
+        "@tauri-apps/cli-linux-arm-gnueabihf": "2.11.4",
+        "@tauri-apps/cli-linux-arm64-gnu": "2.11.4",
+        "@tauri-apps/cli-linux-arm64-musl": "2.11.4",
+        "@tauri-apps/cli-linux-riscv64-gnu": "2.11.4",
+        "@tauri-apps/cli-linux-x64-gnu": "2.11.4",
+        "@tauri-apps/cli-linux-x64-musl": "2.11.4",
+        "@tauri-apps/cli-win32-arm64-msvc": "2.11.4",
+        "@tauri-apps/cli-win32-ia32-msvc": "2.11.4",
+        "@tauri-apps/cli-win32-x64-msvc": "2.11.4"
      }
    },
    "node_modules/@tauri-apps/cli-darwin-arm64": {
-      "version": "2.10.1",
-      "resolved": "https://registry.npmjs.org/@tauri-apps/cli-darwin-arm64/-/cli-darwin-arm64-2.10.1.tgz",
-      "integrity": "sha512-Z2OjCXiZ+fbYZy7PmP3WRnOpM9+Fy+oonKDEmUE6MwN4IGaYqgceTjwHucc/kEEYZos5GICve35f7ZiizgqEnQ==",
+      "version": "2.11.4",
+      "resolved": "https://registry.npmjs.org/@tauri-apps/cli-darwin-arm64/-/cli-darwin-arm64-2.11.4.tgz",
+      "integrity": "sha512-1ryOF3ZhpZ/nemHV5zVwBQBz9jDGKmKPvWPADOhc83ig0P4bMc2iER4NbC6r9sjeIZ6RVQ4g3RZIYvezhcl4TQ==",
      "cpu": [
        "arm64"
      ],
@@ -3777,9 +3777,9 @@
      }
    },
    "node_modules/@tauri-apps/cli-darwin-x64": {
-      "version": "2.10.1",
-      "resolved": "https://registry.npmjs.org/@tauri-apps/cli-darwin-x64/-/cli-darwin-x64-2.10.1.tgz",
-      "integrity": "sha512-V/irQVvjPMGOTQqNj55PnQPVuH4VJP8vZCN7ajnj+ZS8Kom1tEM2hR3qbbIRoS3dBKs5mbG8yg1WC+97dq17Pw==",
+      "version": "2.11.4",
+      "resolved": "https://registry.npmjs.org/@tauri-apps/cli-darwin-x64/-/cli-darwin-x64-2.11.4.tgz",
+      "integrity": "sha512-uFsGQAAfuyz1k/yGLmkWfkBlgKAqZfxqlHmLWx81QU27RJWfmbNHCIq8T8w1e+VClleIuZUjpHWfoE4E3DLo3A==",
      "cpu": [
        "x64"
      ],
@@ -3794,9 +3794,9 @@
      }
    },
    "node_modules/@tauri-apps/cli-linux-arm-gnueabihf": {
-      "version": "2.10.1",
-      "resolved": "https://registry.npmjs.org/@tauri-apps/cli-linux-arm-gnueabihf/-/cli-linux-arm-gnueabihf-2.10.1.tgz",
-      "integrity": "sha512-Hyzwsb4VnCWKGfTw+wSt15Z2pLw2f0JdFBfq2vHBOBhvg7oi6uhKiF87hmbXOBXUZaGkyRDkCHsdzJcIfoJC2w==",
+      "version": "2.11.4",
+      "resolved": "https://registry.npmjs.org/@tauri-apps/cli-linux-arm-gnueabihf/-/cli-linux-arm-gnueabihf-2.11.4.tgz",
+      "integrity": "sha512-IaHZn5CdBL21oUmjiVOS1ctw6Ip1O0pjp70FwOWmYz1myWe0SY96ZIj2FYf7pT0m8bI2h/hrs5ZbEXXh44/MkQ==",
      "cpu": [
        "arm"
      ],
@@ -3811,13 +3811,16 @@
      }
    },
    "node_modules/@tauri-apps/cli-linux-arm64-gnu": {
-      "version": "2.10.1",
-      "resolved": "https://registry.npmjs.org/@tauri-apps/cli-linux-arm64-gnu/-/cli-linux-arm64-gnu-2.10.1.tgz",
-      "integrity": "sha512-OyOYs2t5GkBIvyWjA1+h4CZxTcdz1OZPCWAPz5DYEfB0cnWHERTnQ/SLayQzncrT0kwRoSfSz9KxenkyJoTelA==",
+      "version": "2.11.4",
+      "resolved": "https://registry.npmjs.org/@tauri-apps/cli-linux-arm64-gnu/-/cli-linux-arm64-gnu-2.11.4.tgz",
+      "integrity": "sha512-N41/ukTRVe6XSuUTESuFdGeOW2i7k62tK+6gHK5Kd5/q5RPvvi19GaWAVPPb9u95HSGmTChSolBfzynUsssFaA==",
      "cpu": [
        "arm64"
      ],
      "dev": true,
+      "libc": [
+        "glibc"
+      ],
      "license": "Apache-2.0 OR MIT",
      "optional": true,
      "os": [
@@ -3828,13 +3831,16 @@
      }
    },
    "node_modules/@tauri-apps/cli-linux-arm64-musl": {
-      "version": "2.10.1",
-      "resolved": "https://registry.npmjs.org/@tauri-apps/cli-linux-arm64-musl/-/cli-linux-arm64-musl-2.10.1.tgz",
-      "integrity": "sha512-MIj78PDDGjkg3NqGptDOGgfXks7SYJwhiMh8SBoZS+vfdz7yP5jN18bNaLnDhsVIPARcAhE1TlsZe/8Yxo2zqg==",
+      "version": "2.11.4",
+      "resolved": "https://registry.npmjs.org/@tauri-apps/cli-linux-arm64-musl/-/cli-linux-arm64-musl-2.11.4.tgz",
+      "integrity": "sha512-v277UnT/fB64xAfSroL5N3Km3tLmvATWqJJw/wRI+g6o+HkeD0slyE7gOhNs1MbjE41R7bQOTxMVoL3aomUJmw==",
      "cpu": [
        "arm64"
      ],
      "dev": true,
+      "libc": [
+        "musl"
+      ],
      "license": "Apache-2.0 OR MIT",
      "optional": true,
      "os": [
@@ -3845,13 +3851,16 @@
      }
    },
    "node_modules/@tauri-apps/cli-linux-riscv64-gnu": {
-      "version": "2.10.1",
-      "resolved": "https://registry.npmjs.org/@tauri-apps/cli-linux-riscv64-gnu/-/cli-linux-riscv64-gnu-2.10.1.tgz",
-      "integrity": "sha512-X0lvOVUg8PCVaoEtEAnpxmnkwlE1gcMDTqfhbefICKDnOTJ5Est3qL0SrWxizDackIOKBcvtpejrSiVpuJI1kw==",
+      "version": "2.11.4",
+      "resolved": "https://registry.npmjs.org/@tauri-apps/cli-linux-riscv64-gnu/-/cli-linux-riscv64-gnu-2.11.4.tgz",
+      "integrity": "sha512-qqgNkQ2u1yZHxjhxsZaxUtRDW8dIqIYm33rx/mzwQv0SfY9x1B+iraj8vWeFiXjjSVVhEMepXSOts1TqPzvXNQ==",
      "cpu": [
        "riscv64"
      ],
      "dev": true,
+      "libc": [
+        "glibc"
+      ],
      "license": "Apache-2.0 OR MIT",
      "optional": true,
      "os": [
@@ -3862,13 +3871,16 @@
      }
    },
    "node_modules/@tauri-apps/cli-linux-x64-gnu": {
-      "version": "2.10.1",
-      "resolved": "https://registry.npmjs.org/@tauri-apps/cli-linux-x64-gnu/-/cli-linux-x64-gnu-2.10.1.tgz",
-      "integrity": "sha512-2/12bEzsJS9fAKybxgicCDFxYD1WEI9kO+tlDwX5znWG2GwMBaiWcmhGlZ8fi+DMe9CXlcVarMTYc0L3REIRxw==",
+      "version": "2.11.4",
+      "resolved": "https://registry.npmjs.org/@tauri-apps/cli-linux-x64-gnu/-/cli-linux-x64-gnu-2.11.4.tgz",
+      "integrity": "sha512-2VRNWl84FOH0m2giiDkO2h0QXlcMJeX+zJDpI5kDIQAx6s+geF3v48F4DXfJez4GS/FdoDGnPnw1C2iYGbQ7bQ==",
      "cpu": [
        "x64"
      ],
      "dev": true,
+      "libc": [
+        "glibc"
+      ],
      "license": "Apache-2.0 OR MIT",
      "optional": true,
      "os": [
@@ -3879,13 +3891,16 @@
      }
    },
    "node_modules/@tauri-apps/cli-linux-x64-musl": {
-      "version": "2.10.1",
-      "resolved": "https://registry.npmjs.org/@tauri-apps/cli-linux-x64-musl/-/cli-linux-x64-musl-2.10.1.tgz",
-      "integrity": "sha512-Y8J0ZzswPz50UcGOFuXGEMrxbjwKSPgXftx5qnkuMs2rmwQB5ssvLb6tn54wDSYxe7S6vlLob9vt0VKuNOaCIQ==",
+      "version": "2.11.4",
+      "resolved": "https://registry.npmjs.org/@tauri-apps/cli-linux-x64-musl/-/cli-linux-x64-musl-2.11.4.tgz",
+      "integrity": "sha512-o9GyhYor/nc7xarmwDE3ka2szuW3uuZzXjHWh64Q8YX5AtSgxdQkFWzrY4O8KiGtVNvFBI14H3Q49Qj5TOIP/A==",
      "cpu": [
        "x64"
      ],
      "dev": true,
+      "libc": [
+        "musl"
+      ],
      "license": "Apache-2.0 OR MIT",
      "optional": true,
      "os": [
@@ -3896,9 +3911,9 @@
      }
    },
    "node_modules/@tauri-apps/cli-win32-arm64-msvc": {
-      "version": "2.10.1",
-      "resolved": "https://registry.npmjs.org/@tauri-apps/cli-win32-arm64-msvc/-/cli-win32-arm64-msvc-2.10.1.tgz",
-      "integrity": "sha512-iSt5B86jHYAPJa/IlYw++SXtFPGnWtFJriHn7X0NFBVunF6zu9+/zOn8OgqIWSl8RgzhLGXQEEtGBdR4wzpVgg==",
+      "version": "2.11.4",
+      "resolved": "https://registry.npmjs.org/@tauri-apps/cli-win32-arm64-msvc/-/cli-win32-arm64-msvc-2.11.4.tgz",
+      "integrity": "sha512-ld5Ehb598m0VkYyylRPNeCFsBe/km0jxis6KgMpl3IGY6I/i1RwQXO05I1AsXUXO2WC6AvB/Lw4qTf/asiuEiQ==",
      "cpu": [
        "arm64"
      ],
@@ -3913,9 +3928,9 @@
      }
    },
    "node_modules/@tauri-apps/cli-win32-ia32-msvc": {
-      "version": "2.10.1",
-      "resolved": "https://registry.npmjs.org/@tauri-apps/cli-win32-ia32-msvc/-/cli-win32-ia32-msvc-2.10.1.tgz",
-      "integrity": "sha512-gXyxgEzsFegmnWywYU5pEBURkcFN/Oo45EAwvZrHMh+zUSEAvO5E8TXsgPADYm31d1u7OQU3O3HsYfVBf2moHw==",
+      "version": "2.11.4",
+      "resolved": "https://registry.npmjs.org/@tauri-apps/cli-win32-ia32-msvc/-/cli-win32-ia32-msvc-2.11.4.tgz",
+      "integrity": "sha512-12Hxi0XX/H5VFxO/bGgHkFWhml9VMgEOu9CidjeCeTNQ1l6fpUlbiGgSP7CLI3PFtW9/FfbeHieZ+kyWK5H7CA==",
      "cpu": [
        "ia32"
      ],
@@ -3930,9 +3945,9 @@
      }
    },
    "node_modules/@tauri-apps/cli-win32-x64-msvc": {
-      "version": "2.10.1",
-      "resolved": "https://registry.npmjs.org/@tauri-apps/cli-win32-x64-msvc/-/cli-win32-x64-msvc-2.10.1.tgz",
-      "integrity": "sha512-6Cn7YpPFwzChy0ERz6djKEmUehWrYlM+xTaNzGPgZocw3BD7OfwfWHKVWxXzdjEW2KfKkHddfdxK1XXTYqBRLg==",
+      "version": "2.11.4",
+      "resolved": "https://registry.npmjs.org/@tauri-apps/cli-win32-x64-msvc/-/cli-win32-x64-msvc-2.11.4.tgz",
+      "integrity": "sha512-+vDiqBIU5dMISg/wNvX3sF+ZHfgJGJ5T0AcO+EHNXV9GGAG+P5fzodlDXD3QdKCRgZxMoCm5PPvj3BqLNjBthw==",
      "cpu": [
        "x64"
      ],
@@ -18,7 +18,7 @@
    "@base-ui/react": "^1.3.0",
    "@fontsource-variable/geist": "^5.2.8",
    "@tailwindcss/vite": "^4.2.1",
-    "@tauri-apps/api": "^2",
+    "@tauri-apps/api": "^2.11.1",
    "@tauri-apps/plugin-autostart": "^2",
    "@tauri-apps/plugin-dialog": "^2.7.0",
    "@tauri-apps/plugin-global-shortcut": "^2",
@@ -49,7 +49,7 @@
    "zustand": "^5.0.11"
  },
  "devDependencies": {
-    "@tauri-apps/cli": "^2",
+    "@tauri-apps/cli": "^2.11.4",
    "@types/react": "^19.0.0",
    "@types/react-dom": "^19.0.0",
    "@vitejs/plugin-react": "^4.3.4",
@@ -24,9 +24,22 @@ serde_json = "1"
 reqwest = { version = "0.12", features = ["json", "multipart"] }
 tokio = { version = "1", features = ["full"] }

+# Cloud API keys are stored in the OS credential store via `keyring`. keyring v3
+# enables NO backend by default — without an explicit per-platform feature it
+# silently falls back to a non-persistent in-memory mock, so keys would not
+# survive an app restart. Each desktop target opts into its native store.
 [target.'cfg(target_os = "macos")'.dependencies]
 objc = "0.2"
 dispatch = "0.2"
+keyring = { version = "3", features = ["apple-native"] }
+
+[target.'cfg(target_os = "windows")'.dependencies]
+keyring = { version = "3", features = ["windows-native"] }
+
+[target.'cfg(target_os = "linux")'.dependencies]
+# Blocking Secret Service backend (no internal async runtime, so it is safe to
+# call from the tokio-driven Tauri commands). Needs libdbus-1-dev at build time.
+keyring = { version = "3", features = ["sync-secret-service", "crypto-rust"] }

 [features]
 default = ["custom-protocol"]
@@ -8,8 +8,10 @@ use tokio::sync::Mutex;

 const OLLAMA_PORT: u16 = 11434;
 const JARVIS_PORT: u16 = 8000;
+const DESKTOP_UV_SYNC_COMMAND: &str =
+    "uv sync --extra desktop --extra inference-cloud --extra inference-google --group desktop-native";

-/// Small, fast model pulled at startup so the app opens quickly.
+/// Small, fast model used when startup needs a default Ollama tag.
 const STARTUP_MODEL: &str = "qwen3.5:4b";

 /// Tiny fallback model if even the startup model can't be pulled.
@@ -104,7 +106,7 @@ fn default_local_model(ram_gb: f64) -> &'static str {
 struct BootPlan {
    /// Whether to start and wait for the bundled Ollama.
    launch_ollama: bool,
-    /// The single Ollama model to pull (None for custom endpoints).
+    /// The preferred Ollama model (None for custom endpoints).
    model_to_pull: Option<String>,
    /// Optional `(engine_key, bare_host)` override for a custom endpoint,
    /// e.g. `("lmstudio", "http://localhost:1234")`. Written into
@@ -608,6 +610,69 @@ async fn wait_for_jarvis_health(
 }

 async fn ollama_has_model(model: &str) -> bool {
+    let models = ollama_model_names().await;
+    matching_installed_model(&models, model).is_some()
+}
+
+fn parse_ollama_model_names(body: &serde_json::Value) -> Vec<String> {
+    body.get("models")
+        .and_then(|m| m.as_array())
+        .map(|models| {
+            models
+                .iter()
+                .filter_map(|m| {
+                    m.get("name")
+                        .or_else(|| m.get("model"))
+                        .and_then(|n| n.as_str())
+                })
+                .filter(|name| !name.trim().is_empty())
+                .map(|name| name.to_string())
+                .collect()
+        })
+        .unwrap_or_default()
+}
+
+fn model_names_match(installed: &str, requested: &str) -> bool {
+    installed == requested
+        || installed.strip_suffix(":latest") == Some(requested)
+        || requested.strip_suffix(":latest") == Some(installed)
+}
+
+fn matching_installed_model(models: &[String], requested: &str) -> Option<String> {
+    models
+        .iter()
+        .find(|model| model_names_match(model, requested))
+        .cloned()
+}
+
+fn model_name_looks_embedding_only(model: &str) -> bool {
+    let name = model.to_ascii_lowercase();
+    ["embed", "embedding", "rerank", "minilm", "bge-", "bge_", "e5-", "e5_"]
+        .iter()
+        .any(|marker| name.contains(marker))
+}
+
+fn preferred_installed_model(models: &[String]) -> Option<String> {
+    models
+        .iter()
+        .find(|model| !model.trim().is_empty() && !model_name_looks_embedding_only(model))
+        .or_else(|| models.iter().find(|model| !model.trim().is_empty()))
+        .cloned()
+}
+
+fn startup_installed_model(requested_model: &str, installed_models: &[String]) -> Option<String> {
+    matching_installed_model(installed_models, requested_model)
+        .or_else(|| preferred_installed_model(installed_models))
+}
+
+fn should_persist_resolved_model(cfg: &InferenceConfig) -> bool {
+    cfg.model
+        .as_deref()
+        .map(|model| model.trim().is_empty())
+        .unwrap_or(true)
+}
+
+async fn ollama_model_names() -> Vec<String> {
    let url = format!("http://127.0.0.1:{}/api/tags", OLLAMA_PORT);
    let client = reqwest::Client::builder()
        .timeout(Duration::from_secs(5))
@@ -615,21 +680,10 @@ async fn ollama_has_model(model: &str) -> bool {
        .unwrap();
    if let Ok(resp) = client.get(&url).send().await {
        if let Ok(body) = resp.json::<serde_json::Value>().await {
-            if let Some(models) = body.get("models").and_then(|m| m.as_array()) {
-                return models.iter().any(|m| {
-                    m.get("name")
-                        .and_then(|n| n.as_str())
-                        .map(|n| {
-                            n == model
-                                || n.strip_suffix(":latest") == Some(model)
-                                || model.strip_suffix(":latest") == Some(n)
-                        })
-                        .unwrap_or(false)
-                });
-            }
+            return parse_ollama_model_names(&body);
        }
    }
-    false
+    Vec::new()
 }

 async fn pull_model(model: &str) -> Result<(), String> {
@@ -679,13 +733,21 @@ fn format_uv_sync_failure(
    let code = exit_code
        .map(|c| c.to_string())
        .unwrap_or_else(|| "unknown".to_string());
+    let tail = uv_sync_stderr_tail(stderr, 800);
+    let rust_hint = if looks_like_rust_extension_build_error(stderr) {
+        format!("\n\n{}", rust_toolchain_install_hint())
+    } else {
+        String::new()
+    };
    format!(
        "`uv sync` failed in {} (exit {}). Last output:\n\n{}\n\n\
         Try opening a terminal in that directory and running \
-         `uv sync --extra desktop` manually for the full output.",
+         `{}` manually for the full output.{}",
        root.display(),
        code,
-        uv_sync_stderr_tail(stderr, 800),
+        tail,
+        DESKTOP_UV_SYNC_COMMAND,
+        rust_hint,
    )
 }

@@ -734,6 +796,122 @@ fn format_uv_sync_spawn_error(root: &std::path::Path, uv_bin: &str, err: &str) -
    )
 }

+fn rust_toolchain_install_hint() -> &'static str {
+    "The desktop app needs the Rust toolchain to build `openjarvis_rust`. \
+     Install Rust from https://rustup.rs. On Windows, also install Visual Studio \
+     Build Tools with the C++ workload, then relaunch."
+}
+
+fn looks_like_rust_extension_build_error(stderr: &str) -> bool {
+    let lower = stderr.to_ascii_lowercase();
+    [
+        "openjarvis-rust",
+        "openjarvis_rust",
+        "maturin",
+        "cargo",
+        "rustc",
+        "link.exe",
+        "visual studio",
+    ]
+    .iter()
+    .any(|marker| lower.contains(marker))
+}
+
+fn format_missing_rust_toolchain() -> String {
+    format!(
+        "Could not find Rust's `cargo` command. {}\n\n\
+         If Rust is already installed, close and relaunch the desktop app so \
+         PATH includes `~/.cargo/bin`.",
+        rust_toolchain_install_hint(),
+    )
+}
+
+fn format_extension_import_failure(root: &std::path::Path, stderr: &str) -> String {
+    let tail = uv_sync_stderr_tail(stderr, 4000);
+    format!(
+        "`openjarvis_rust` is still not importable after building. Last output:\n\n{}\n\n\
+         Run these manually for the full build log:\n\n\
+           cd {}\n\
+           {}\n\
+           uv run python -c \"import openjarvis_rust\"",
+        if tail.is_empty() {
+            "(no stderr output)"
+        } else {
+            &tail
+        },
+        root.display(),
+        DESKTOP_UV_SYNC_COMMAND,
+    )
+}
+
+fn add_cargo_bin_to_path(cmd: &mut tokio::process::Command) {
+    let mut paths: Vec<std::path::PathBuf> = std::env::var_os("PATH")
+        .map(|path| std::env::split_paths(&path).collect())
+        .unwrap_or_default();
+    paths.insert(
+        0,
+        std::path::PathBuf::from(home_dir())
+            .join(".cargo")
+            .join("bin"),
+    );
+    if let Ok(joined) = std::env::join_paths(paths) {
+        cmd.env("PATH", joined);
+    }
+}
+
+async fn verify_openjarvis_rust_extension(
+    root: &std::path::Path,
+    uv_bin: &str,
+) -> Result<(), String> {
+    let mut cmd = tokio::process::Command::new(uv_bin);
+    cmd.args(["run", "python", "-c", "import openjarvis_rust"])
+        .stdout(std::process::Stdio::null())
+        .stderr(std::process::Stdio::piped())
+        .current_dir(root);
+    prepare_subprocess_for_appimage(&mut cmd);
+    add_cargo_bin_to_path(&mut cmd);
+
+    match cmd.output().await {
+        Ok(out) if out.status.success() => Ok(()),
+        Ok(out) => {
+            let stderr = String::from_utf8_lossy(&out.stderr);
+            Err(format_extension_import_failure(root, &stderr))
+        }
+        Err(e) => Err(format!(
+            "Could not verify `openjarvis_rust`: {}. Verify uv is installed at `{}`.",
+            e, uv_bin
+        )),
+    }
+}
+
+fn port_owner_hint() -> String {
+    if cfg!(target_os = "windows") {
+        format!("netstat -ano | findstr :{}", JARVIS_PORT)
+    } else {
+        format!("lsof -i :{}", JARVIS_PORT)
+    }
+}
+
+fn format_port_unavailable(port: u16, reason: &str) -> String {
+    format!(
+        "Port {} is not available: {}. Stop the process using that port or \
+         change the OpenJarvis port, then relaunch.\n\nTo identify it:\n  {}",
+        port,
+        reason,
+        port_owner_hint(),
+    )
+}
+
+fn check_jarvis_port_available() -> Result<(), String> {
+    match std::net::TcpListener::bind(("127.0.0.1", JARVIS_PORT)) {
+        Ok(listener) => {
+            drop(listener);
+            Ok(())
+        }
+        Err(err) => Err(format_port_unavailable(JARVIS_PORT, &err.to_string())),
+    }
+}
+
 // ---------------------------------------------------------------------------
 // Backend boot sequence (runs in background after app launch)
 // ---------------------------------------------------------------------------
@@ -751,7 +929,7 @@ async fn boot_backend(backend: SharedBackend, status: SharedStatus) {
        .into();
    }

-    // For the Ollama path, the model pull may fall back to FALLBACK_MODEL; we
+    // For the Ollama path, model resolution may fall back to FALLBACK_MODEL; we
    // record what is actually available here so the serve command below uses
    // it instead of the originally-planned tag. None on the custom path.
    let mut serve_model_override: Option<String> = None;
@@ -798,8 +976,8 @@ async fn boot_backend(backend: SharedBackend, status: SharedStatus) {
            s.detail = "Inference engine ready.".into();
        }

-        // Phase 2: Pull the single default model (see default_local_model /
-        // boot_plan). We deliberately do NOT pull any others.
+        // Phase 2: Resolve one model to serve. Prefer an installed model on
+        // first run so startup does not depend on a download succeeding.
        let model = plan
            .model_to_pull
            .clone()
@@ -810,41 +988,63 @@ async fn boot_backend(backend: SharedBackend, status: SharedStatus) {
            s.detail = format!("Checking for {}...", model);
        }

-        if !ollama_has_model(&model).await {
+        let installed_models = ollama_model_names().await;
+        let resolved_model = if let Some(installed) = startup_installed_model(&model, &installed_models) {
+            installed
+        } else {
            {
                let mut s = status.lock().await;
                s.detail = format!("Downloading {}... (this may take a minute)", model);
            }
-            if let Err(e) = pull_model(&model).await {
-                // If the chosen model fails, try the tiny fallback
-                eprintln!("Warning: failed to pull {}: {}", model, e);
-                if !ollama_has_model(FALLBACK_MODEL).await {
-                    {
-                        let mut s = status.lock().await;
-                        s.detail = format!("Downloading {}...", FALLBACK_MODEL);
-                    }
-                    if let Err(e2) = pull_model(FALLBACK_MODEL).await {
-                        let mut s = status.lock().await;
-                        s.error = Some(format!("Failed to download model: {}", e2));
-                        return;
+            match pull_model(&model).await {
+                Ok(()) => model.clone(),
+                Err(e) => {
+                    eprintln!("Warning: failed to pull {}: {}", model, e);
+
+                    // If a local model appeared while pulling, use it instead of
+                    // making startup depend on another network pull.
+                    if let Some(installed) = preferred_installed_model(&ollama_model_names().await) {
+                        installed
+                    } else if ollama_has_model(FALLBACK_MODEL).await {
+                        FALLBACK_MODEL.to_string()
+                    } else {
+                        {
+                            let mut s = status.lock().await;
+                            s.detail = format!("Downloading {}...", FALLBACK_MODEL);
+                        }
+                        if let Err(e2) = pull_model(FALLBACK_MODEL).await {
+                            if let Some(installed) =
+                                preferred_installed_model(&ollama_model_names().await)
+                            {
+                                installed
+                            } else {
+                                let mut s = status.lock().await;
+                                s.error = Some(format!("Failed to download model: {}", e2));
+                                return;
+                            }
+                        } else {
+                            FALLBACK_MODEL.to_string()
+                        }
                    }
                }
            }
+        };
+
+        if resolved_model != model {
+            let mut s = status.lock().await;
+            s.detail = format!("Using installed model {}.", resolved_model);
        }

-        // The pull may have fallen back to FALLBACK_MODEL; serve and persist
-        // whatever is actually available now, not the originally-planned tag.
-        let resolved_model = if ollama_has_model(&model).await {
-            model
-        } else {
-            FALLBACK_MODEL.to_string()
-        };
        serve_model_override = Some(resolved_model.clone());

-        // Persist the resolved model so Settings shows it and future boots reuse it.
-        let mut persisted = cfg.clone();
-        persisted.model = Some(resolved_model);
-        let _ = write_inference_config(&persisted);
+        // Persist only first-run/default resolution. If the user explicitly
+        // configured a model, do not overwrite that choice with a temporary
+        // fallback selected just to keep startup nonfatal.
+        if should_persist_resolved_model(&cfg) {
+            let mut persisted = cfg.clone();
+            persisted.model = Some(resolved_model);
+            let _ = write_inference_config(&persisted);
+        }

        {
            let mut s = status.lock().await;
@@ -1097,11 +1297,6 @@ async fn boot_backend(backend: SharedBackend, status: SharedStatus) {
                // Something else (a different web server, a stale process,
                // a 4xx-returning instance) is on our port. Don't kill it —
                // give the user actionable info instead.
-                let lsof_hint = if cfg!(target_os = "windows") {
-                    format!("netstat -ano | findstr :{}", JARVIS_PORT)
-                } else {
-                    format!("lsof -i :{}", JARVIS_PORT)
-                };
                let mut s = status.lock().await;
                s.error = Some(format!(
                    "Port {} is already in use by another service (it answered \
@@ -1109,7 +1304,7 @@ async fn boot_backend(backend: SharedBackend, status: SharedStatus) {
                     OpenJarvis port, then relaunch.\n\nTo identify it:\n  {}",
                    JARVIS_PORT,
                    resp.status(),
-                    lsof_hint,
+                    port_owner_hint(),
                ));
                return;
            }
@@ -1119,8 +1314,21 @@ async fn boot_backend(backend: SharedBackend, status: SharedStatus) {
        }
    }

+    if let Err(err) = check_jarvis_port_available() {
+        let mut s = status.lock().await;
+        s.error = Some(err);
+        return;
+    }
+
    let root = project_root.as_ref().unwrap();

+    let cargo_bin = resolve_bin("cargo");
+    if !std::path::Path::new(&cargo_bin).exists() && cargo_bin == "cargo" {
+        let mut s = status.lock().await;
+        s.error = Some(format_missing_rust_toolchain());
+        return;
+    }
+
    // Install dependencies automatically (handles fresh clones).
    //
    // Previously we ran `uv sync` with both stdout AND stderr piped to
@@ -1146,12 +1354,16 @@ async fn boot_backend(backend: SharedBackend, status: SharedStatus) {
            "--extra", "desktop",
            "--extra", "inference-cloud",
            "--extra", "inference-google",
+            // openjarvis_rust lives in a uv dependency group (not the published
+            // `desktop` extra) so pip installs from PyPI don't require it (#584).
+            "--group", "desktop-native",
        ])
        .stdout(std::process::Stdio::null())
        .stderr(std::process::Stdio::piped())
        .current_dir(root);
    // Avoid LD_LIBRARY_PATH leak when running inside an AppImage (#455).
    prepare_subprocess_for_appimage(&mut sync_cmd);
+    add_cargo_bin_to_path(&mut sync_cmd);
    let sync_output = sync_cmd.output().await;
    match sync_output {
        Ok(out) if !out.status.success() => {
@@ -1168,6 +1380,16 @@ async fn boot_backend(backend: SharedBackend, status: SharedStatus) {
        Ok(_) => {} // success — fall through
    }

+    {
+        let mut s = status.lock().await;
+        s.detail = "Verifying Rust extension (openjarvis_rust)...".into();
+    }
+    if let Err(err) = verify_openjarvis_rust_extension(root, &uv_bin).await {
+        let mut s = status.lock().await;
+        s.error = Some(err);
+        return;
+    }
+
    {
        let mut s = status.lock().await;
        s.detail = format!("Starting API server from {}...", root.display());
@@ -1204,7 +1426,7 @@ async fn boot_backend(backend: SharedBackend, status: SharedStatus) {
    // additions aren't accidentally stripped.
    prepare_subprocess_for_appimage(&mut cmd);

-    // Inject cloud API keys from ~/.openjarvis/cloud-keys.env
+    // Inject cloud API keys from secure desktop storage.
    for (key, value) in read_cloud_keys() {
        cmd.env(&key, &value);
    }
@@ -1720,17 +1942,111 @@ async fn submit_savings(
 // Cloud API key management
 // ---------------------------------------------------------------------------

-/// Path to the cloud keys file (~/.openjarvis/cloud-keys.env).
-fn cloud_keys_path() -> std::path::PathBuf {
+const SECURE_KEY_SERVICE: &str = "OpenJarvis Cloud Keys";
+const MANAGED_CLOUD_KEY_NAMES: &[&str] = &[
+    "OPENAI_API_KEY",
+    "ANTHROPIC_API_KEY",
+    "GEMINI_API_KEY",
+    "GOOGLE_API_KEY",
+    "OPENROUTER_API_KEY",
+    "MINIMAX_API_KEY",
+    "TAVILY_API_KEY",
+];
+
+/// Legacy path used by older desktop builds. New saves never write here.
+fn legacy_cloud_keys_path() -> std::path::PathBuf {
    let home = home_dir();
    std::path::PathBuf::from(home)
        .join(".openjarvis")
        .join("cloud-keys.env")
 }

-/// Read cloud keys from disk and return as key=value pairs.
-fn read_cloud_keys() -> Vec<(String, String)> {
-    let path = cloud_keys_path();
+fn validate_cloud_key_name(key_name: &str) -> Result<(), String> {
+    let valid = !key_name.is_empty()
+        && key_name.len() <= 128
+        && key_name.ends_with("_API_KEY")
+        && key_name
+            .chars()
+            .all(|ch| ch.is_ascii_uppercase() || ch.is_ascii_digit() || ch == '_');
+    if valid {
+        Ok(())
+    } else {
+        Err(format!("Invalid API key name: {}", key_name))
+    }
+}
+
+fn engine_api_key_name(engine: &str) -> String {
+    let normalized: String = engine
+        .chars()
+        .map(|ch| {
+            if ch.is_ascii_alphanumeric() {
+                ch.to_ascii_uppercase()
+            } else {
+                '_'
+            }
+        })
+        .collect();
+    let trimmed = normalized.trim_matches('_');
+    let engine_name = if trimmed.is_empty() {
+        CUSTOM_FALLBACK_ENGINE.to_ascii_uppercase()
+    } else {
+        trimmed.to_string()
+    };
+    format!("{}_API_KEY", engine_name)
+}
+
+fn managed_cloud_key_names() -> Vec<String> {
+    let mut names: Vec<String> = MANAGED_CLOUD_KEY_NAMES
+        .iter()
+        .map(|name| (*name).to_string())
+        .collect();
+
+    let cfg = read_inference_config();
+    if matches!(&cfg.kind, SourceKind::Custom) {
+        let engine = cfg.engine.unwrap_or_else(|| CUSTOM_FALLBACK_ENGINE.to_string());
+        let key_name = engine_api_key_name(&engine);
+        if validate_cloud_key_name(&key_name).is_ok() {
+            names.push(key_name);
+        }
+    }
+
+    names.sort();
+    names.dedup();
+    names
+}
+
+fn secure_store_get(key_name: &str) -> Result<Option<String>, String> {
+    validate_cloud_key_name(key_name)?;
+    let entry = keyring::Entry::new(SECURE_KEY_SERVICE, key_name)
+        .map_err(|err| format!("Failed to open secure key storage for {}: {}", key_name, err))?;
+    match entry.get_password() {
+        Ok(value) => Ok(Some(value)),
+        Err(keyring::Error::NoEntry) => Ok(None),
+        Err(err) => Err(format!("Failed to read {} from secure key storage: {}", key_name, err)),
+    }
+}
+
+fn secure_store_set(key_name: &str, key_value: &str) -> Result<(), String> {
+    validate_cloud_key_name(key_name)?;
+    let entry = keyring::Entry::new(SECURE_KEY_SERVICE, key_name)
+        .map_err(|err| format!("Failed to open secure key storage for {}: {}", key_name, err))?;
+    if key_value.is_empty() {
+        return match entry.delete_credential() {
+            Ok(()) => Ok(()),
+            Err(keyring::Error::NoEntry) => Ok(()),
+            Err(err) => Err(format!(
+                "Failed to remove {} from secure key storage: {}",
+                key_name, err
+            )),
+        };
+    }
+    entry
+        .set_password(key_value)
+        .map_err(|err| format!("Failed to save {} in secure key storage: {}", key_name, err))
+}
+
+fn read_legacy_cloud_keys() -> Vec<(String, String)> {
+    let path = legacy_cloud_keys_path();
    let mut keys = Vec::new();
    if let Ok(contents) = std::fs::read_to_string(&path) {
        for line in contents.lines() {
@@ -1746,47 +2062,68 @@ fn read_cloud_keys() -> Vec<(String, String)> {
    keys
 }

-/// Save a single cloud API key to the keys file.
-#[tauri::command]
-async fn save_cloud_key(key_name: String, key_value: String) -> Result<(), String> {
-    let path = cloud_keys_path();
-    // Ensure directory exists
-    if let Some(parent) = path.parent() {
-        let _ = std::fs::create_dir_all(parent);
+fn migrate_legacy_cloud_keys() {
+    let path = legacy_cloud_keys_path();
+    if !path.exists() {
+        return;
    }

-    // Read existing keys, update/add the one being saved
-    let mut keys: Vec<(String, String)> = read_cloud_keys()
+    let legacy_keys = read_legacy_cloud_keys();
+    if legacy_keys.is_empty() {
+        let _ = std::fs::remove_file(&path);
+        return;
+    }
+
+    let mut migrated_all = true;
+    for (key, value) in legacy_keys {
+        if value.is_empty() {
+            continue;
+        }
+        if secure_store_set(&key, &value).is_err() {
+            migrated_all = false;
+        }
+    }
+
+    if migrated_all {
+        let _ = std::fs::remove_file(path);
+    }
+}
+
+/// Read cloud keys from secure desktop storage and return key=value pairs.
+fn read_cloud_keys() -> Vec<(String, String)> {
+    migrate_legacy_cloud_keys();
+    managed_cloud_key_names()
        .into_iter()
-        .filter(|(k, _)| k != &key_name)
-        .collect();
-    if !key_value.is_empty() {
-        keys.push((key_name, key_value));
-    }
+        .filter_map(|key| match secure_store_get(&key) {
+            Ok(Some(value)) if !value.is_empty() => Some((key, value)),
+            _ => None,
+        })
+        .collect()
+}

-    // Write back
-    let content: String = keys
-        .iter()
-        .map(|(k, v)| format!("{}={}", k, v))
-        .collect::<Vec<_>>()
-        .join("\n");
-    std::fs::write(&path, content + "\n").map_err(|e| format!("Failed to save key: {}", e))?;
-
-    // Set permissions to owner-only (chmod 600)
-    #[cfg(unix)]
-    {
-        use std::os::unix::fs::PermissionsExt;
-        let _ = std::fs::set_permissions(&path, std::fs::Permissions::from_mode(0o600));
-    }
-
-    // Tell the running server to hot-reload its cloud engine so the user
-    // doesn't need to restart the app after entering an API key.
+async fn reload_cloud_keys(keys: Vec<(String, String)>) {
    let reload_url = format!("http://127.0.0.1:{}/v1/cloud/reload", JARVIS_PORT);
+    let key_map: serde_json::Map<String, serde_json::Value> = keys
+        .into_iter()
+        .map(|(key, value)| (key, serde_json::Value::String(value)))
+        .collect();
    let _ = reqwest::Client::new()
        .post(&reload_url)
+        .json(&serde_json::json!({ "keys": key_map }))
        .timeout(std::time::Duration::from_secs(10))
        .send()
        .await;
+}
+
+/// Save a single cloud API key to secure desktop storage.
+#[tauri::command]
+async fn save_cloud_key(key_name: String, key_value: String) -> Result<(), String> {
+    let key_value = key_value.trim().to_string();
+    secure_store_set(&key_name, &key_value)?;
+
+    // Tell the running server to hot-reload its cloud engine so the user
+    // doesn't need to restart the app after entering an API key.
+    reload_cloud_keys(vec![(key_name, key_value)]).await;

    Ok(())
 }
@@ -1794,10 +2131,13 @@ async fn save_cloud_key(key_name: String, key_value: String) -> Result<(), Strin
 /// Get which cloud providers have keys configured (without exposing values).
 #[tauri::command]
 async fn get_cloud_key_status() -> Result<serde_json::Value, String> {
-    let keys = read_cloud_keys();
-    let status: Vec<serde_json::Value> = keys
-        .iter()
-        .map(|(k, v)| serde_json::json!({ "key": k, "set": !v.is_empty() }))
+    migrate_legacy_cloud_keys();
+    let status: Vec<serde_json::Value> = managed_cloud_key_names()
+        .into_iter()
+        .map(|key| {
+            let set = matches!(secure_store_get(&key), Ok(Some(value)) if !value.is_empty());
+            serde_json::json!({ "key": key, "set": set })
+        })
        .collect();
    Ok(serde_json::json!(status))
 }
@@ -1809,8 +2149,8 @@ async fn get_inference_source() -> Result<InferenceConfig, String> {
 }

 /// Persist the chosen inference source. `host` is normalized to a bare base
-/// URL. For custom endpoints, an optional API key is stored in cloud-keys.env
-/// under `<ENGINE>_API_KEY`. Applies on next app launch.
+/// URL. For custom endpoints, an optional API key is stored in secure desktop
+/// storage under `<ENGINE>_API_KEY`. Applies on next app launch.
 #[tauri::command]
 async fn set_inference_source(
    kind: String,
@@ -1842,7 +2182,7 @@ async fn set_inference_source(
                .engine
                .clone()
                .unwrap_or_else(|| CUSTOM_FALLBACK_ENGINE.to_string());
-            let key_name = format!("{}_API_KEY", engine.to_ascii_uppercase());
+            let key_name = engine_api_key_name(&engine);
            // Save the key before persisting the config: if the key can't be
            // written, surface it and DON'T record a custom source whose
            // credential is missing (which would fail confusingly at runtime).
@@ -2528,9 +2868,12 @@ pub fn run() {
 #[cfg(test)]
 mod tests {
    use super::{
-        boot_plan, default_local_model, format_uv_sync_failure, format_uv_sync_spawn_error,
-        normalize_host, parse_inference_config, upsert_engine_host, uv_sync_stderr_tail,
-        InferenceConfig, SourceKind,
+        boot_plan, default_local_model, format_extension_import_failure,
+        format_missing_rust_toolchain, format_port_unavailable, format_uv_sync_failure,
+        format_uv_sync_spawn_error, matching_installed_model, model_names_match, normalize_host,
+        parse_inference_config, parse_ollama_model_names, preferred_installed_model,
+        should_persist_resolved_model, startup_installed_model, upsert_engine_host,
+        uv_sync_stderr_tail, InferenceConfig, SourceKind, DESKTOP_UV_SYNC_COMMAND,
    };
    use std::path::Path;

@@ -2574,7 +2917,7 @@ mod tests {
        assert!(msg.contains("exit 2"));
        assert!(msg.contains("/home/u/.openjarvis/src"));
        assert!(msg.contains("failed to resolve numpy==2.1.3"));
-        assert!(msg.contains("uv sync --extra desktop")); // actionable next step
+        assert!(msg.contains(DESKTOP_UV_SYNC_COMMAND)); // actionable next step
    }

    #[test]
@@ -2597,6 +2940,49 @@ mod tests {
        assert!(msg.contains("No such file or directory"));
    }

+    #[test]
+    fn missing_rust_toolchain_message_names_cargo_and_installer() {
+        let msg = format_missing_rust_toolchain();
+        assert!(msg.contains("cargo"));
+        assert!(msg.contains("https://rustup.rs"));
+        assert!(msg.contains("openjarvis_rust"));
+        assert!(msg.contains("Visual Studio Build Tools"));
+    }
+
+    #[test]
+    fn uv_sync_rust_failure_mentions_toolchain() {
+        let msg = format_uv_sync_failure(
+            Path::new("C:\\Users\\me\\OpenJarvis"),
+            Some(1),
+            "maturin failed: linker `link.exe` not found while building openjarvis-rust",
+        );
+        assert!(msg.contains("exit 1"));
+        assert!(msg.contains("link.exe"));
+        assert!(msg.contains("https://rustup.rs"));
+        assert!(msg.contains("Visual Studio Build Tools"));
+    }
+
+    #[test]
+    fn extension_import_failure_names_verification_command() {
+        let msg = format_extension_import_failure(
+            Path::new("C:\\Users\\me\\OpenJarvis"),
+            "ModuleNotFoundError: No module named 'openjarvis_rust'",
+        );
+        assert!(msg.contains("openjarvis_rust"));
+        assert!(msg.contains(DESKTOP_UV_SYNC_COMMAND));
+        assert!(msg.contains("uv run python -c \"import openjarvis_rust\""));
+        assert!(msg.contains("ModuleNotFoundError"));
+    }
+
+    #[test]
+    fn port_unavailable_message_names_port_and_owner_hint() {
+        let msg = format_port_unavailable(8000, "address already in use");
+        assert!(msg.contains("Port 8000 is not available"));
+        assert!(msg.contains("address already in use"));
+        assert!(msg.contains("To identify it"));
+        assert!(msg.contains("8000"));
+    }
+
    #[test]
    fn default_local_model_picks_second_largest_that_fits() {
        // QWEN35_MODELS min_ram ladder: 4,6,8,12,24,32,96 GB
@@ -2612,6 +2998,97 @@ mod tests {
        assert_eq!(default_local_model(1.0), super::FALLBACK_MODEL);
    }

+    #[test]
+    fn parse_ollama_model_names_reads_nonempty_names() {
+        let body = serde_json::json!({
+            "models": [
+                {"name": "llama3.2:latest"},
+                {"name": ""},
+                {"name": "qwen3.5:4b"},
+                {"model": "mistral:latest"}
+            ]
+        });
+        assert_eq!(
+            parse_ollama_model_names(&body),
+            vec![
+                "llama3.2:latest".to_string(),
+                "qwen3.5:4b".to_string(),
+                "mistral:latest".to_string()
+            ]
+        );
+    }
+
+    #[test]
+    fn model_names_match_treats_latest_as_optional() {
+        assert!(model_names_match("llama3.2:latest", "llama3.2"));
+        assert!(model_names_match("llama3.2", "llama3.2:latest"));
+        assert!(model_names_match("qwen3.5:4b", "qwen3.5:4b"));
+        assert!(!model_names_match("llama3.2:latest", "qwen3.5:4b"));
+    }
+
+    #[test]
+    fn installed_model_helpers_pick_matching_or_first_model() {
+        let models = vec!["llama3.2:latest".to_string(), "qwen3.5:4b".to_string()];
+        assert_eq!(
+            matching_installed_model(&models, "llama3.2"),
+            Some("llama3.2:latest".to_string())
+        );
+        assert_eq!(
+            preferred_installed_model(&models),
+            Some("llama3.2:latest".to_string())
+        );
+    }
+
+    #[test]
+    fn preferred_installed_model_skips_embedding_names_when_chat_model_exists() {
+        let models = vec![
+            "nomic-embed-text:latest".to_string(),
+            "llama3.2:latest".to_string(),
+        ];
+        assert_eq!(
+            preferred_installed_model(&models),
+            Some("llama3.2:latest".to_string())
+        );
+    }
+
+    #[test]
+    fn startup_installed_model_uses_existing_model_for_defaults() {
+        let models = vec!["llama3.2:latest".to_string()];
+        assert_eq!(
+            startup_installed_model("qwen3.5:4b", &models),
+            Some("llama3.2:latest".to_string())
+        );
+    }
+
+    #[test]
+    fn startup_installed_model_uses_existing_model_when_configured_model_missing() {
+        let models = vec!["llama3.2:latest".to_string()];
+        assert_eq!(
+            startup_installed_model("qwen3.5:4b", &models),
+            Some("llama3.2:latest".to_string())
+        );
+    }
+
+    #[test]
+    fn resolved_model_is_only_persisted_when_no_model_was_configured() {
+        let default_cfg = InferenceConfig { kind: SourceKind::Ollama, ..Default::default() };
+        assert!(should_persist_resolved_model(&default_cfg));
+
+        let empty_cfg = InferenceConfig {
+            kind: SourceKind::Ollama,
+            model: Some(" ".into()),
+            ..Default::default()
+        };
+        assert!(should_persist_resolved_model(&empty_cfg));
+
+        let user_cfg = InferenceConfig {
+            kind: SourceKind::Ollama,
+            model: Some("qwen3.5:9b".into()),
+            ..Default::default()
+        };
+        assert!(!should_persist_resolved_model(&user_cfg));
+    }
+
    #[test]
    fn parse_defaults_to_ollama_when_file_missing_or_garbage() {
        assert!(matches!(parse_inference_config("").kind, SourceKind::Ollama));
@@ -89,7 +89,7 @@ export default function App() {
          setSavings(data);
          if (optInEnabled && optInDisplayName && data) {
            const claudeEntry = data.per_provider.find(
-              (p) => p.provider === 'claude-opus-4.6',
+              (p) => p.provider === 'claude-fable-5',
            );
            const dollarSavings = claudeEntry ? claudeEntry.total_cost : 0;
            const energySaved = data.per_provider.reduce(
@@ -243,7 +243,11 @@ export function InputArea() {

    try {
      if (deepResearch) {
-        for await (const ev of streamResearch(content, controller.signal)) {
+        for await (const ev of streamResearch(
+          content,
+          selectedModel,
+          controller.signal,
+        )) {
          if (ev.type === 'search_call') {
            const trace: ResearchSearchTrace = {
              id: generateId(),
@@ -29,8 +29,8 @@ interface TelemetryStats {
 }

 const CLOUD_PRICING = [
-  { name: 'GPT-5.3', input: 2.00, output: 10.00, primary: true },
-  { name: 'Claude Opus 4.6', input: 5.00, output: 25.00, primary: false },
+  { name: 'GPT-5.6 Sol', input: 5.00, output: 30.00, primary: true },
+  { name: 'Claude Fable 5', input: 10.00, output: 50.00, primary: false },
  { name: 'Gemini 3.1 Pro', input: 2.00, output: 12.00, primary: false },
 ];

@@ -1,7 +1,15 @@
-import { useState, useRef, useEffect } from 'react';
+import { useState, useRef, useEffect, useCallback } from 'react';
 import { Search, Cpu, X, Download, Loader2, Trash2, Check, Cloud, Key, Eye, EyeOff } from 'lucide-react';
 import { useAppStore } from '../lib/store';
-import { pullModel, deleteModel, fetchModels, preloadModel, isTauri } from '../lib/api';
+import {
+  pullModel,
+  deleteModel,
+  fetchModels,
+  preloadModel,
+  isTauri,
+  getCloudKeyStatus,
+  saveCloudKey,
+} from '../lib/api';

 /** Popular models that users can download from the catalogue. */
 const CATALOGUE_MODELS = [
@@ -23,7 +31,6 @@ const CATALOGUE_MODELS = [
 interface CloudProvider {
  name: string;
  envKey: string;
-  storageKey: string;
  models: Array<{ id: string; desc: string }>;
 }

@@ -31,7 +38,6 @@ const CLOUD_PROVIDERS: CloudProvider[] = [
  {
    name: 'OpenAI',
    envKey: 'OPENAI_API_KEY',
-    storageKey: 'openjarvis-openai-key',
    models: [
      { id: 'gpt-4o', desc: 'GPT-4o — fast, multimodal' },
      { id: 'gpt-4o-mini', desc: 'GPT-4o Mini — cheap, fast' },
@@ -41,7 +47,6 @@ const CLOUD_PROVIDERS: CloudProvider[] = [
  {
    name: 'Anthropic',
    envKey: 'ANTHROPIC_API_KEY',
-    storageKey: 'openjarvis-anthropic-key',
    models: [
      { id: 'claude-sonnet-4-6', desc: 'Claude Sonnet 4.6 — balanced' },
      { id: 'claude-opus-4-6', desc: 'Claude Opus 4.6 — most capable' },
@@ -51,7 +56,6 @@ const CLOUD_PROVIDERS: CloudProvider[] = [
  {
    name: 'Google',
    envKey: 'GEMINI_API_KEY',
-    storageKey: 'openjarvis-gemini-key',
    models: [
      { id: 'gemini-2.5-pro', desc: 'Gemini 2.5 Pro — flagship' },
      { id: 'gemini-2.5-flash', desc: 'Gemini 2.5 Flash — fast' },
@@ -61,7 +65,6 @@ const CLOUD_PROVIDERS: CloudProvider[] = [
  {
    name: 'OpenRouter',
    envKey: 'OPENROUTER_API_KEY',
-    storageKey: 'openjarvis-openrouter-key',
    models: [
      { id: 'openrouter/auto', desc: 'Auto — best model for the task' },
      { id: 'openrouter/anthropic/claude-sonnet-4', desc: 'Claude Sonnet 4 via OpenRouter' },
@@ -70,16 +73,6 @@ const CLOUD_PROVIDERS: CloudProvider[] = [
  },
 ];

-function getStoredKey(storageKey: string): string {
-  try { return localStorage.getItem(storageKey) || ''; } catch { return ''; }
-}
-function setStoredKey(storageKey: string, value: string): void {
-  try {
-    if (value) localStorage.setItem(storageKey, value);
-    else localStorage.removeItem(storageKey);
-  } catch {}
-}
-
 type Tab = 'installed' | 'catalogue' | 'cloud';

 export function CommandPalette() {
@@ -92,11 +85,10 @@ export function CommandPalette() {
  const [deleting, setDeleting] = useState<string | null>(null);
  const [customModel, setCustomModel] = useState('');
  const [showKeys, setShowKeys] = useState<Record<string, boolean>>({});
-  const [apiKeys, setApiKeys] = useState<Record<string, string>>(() => {
-    const keys: Record<string, string> = {};
-    for (const p of CLOUD_PROVIDERS) keys[p.storageKey] = getStoredKey(p.storageKey);
-    return keys;
-  });
+  const [apiKeys, setApiKeys] = useState<Record<string, string>>({});
+  const [cloudKeyStatus, setCloudKeyStatus] = useState<Record<string, boolean>>({});
+  const [cloudKeyError, setCloudKeyError] = useState<string | null>(null);
+  const [savingKey, setSavingKey] = useState<string | null>(null);
  const inputRef = useRef<HTMLInputElement>(null);

  const models = useAppStore((s) => s.models);
@@ -106,6 +98,20 @@ export function CommandPalette() {
  const setCommandPaletteOpen = useAppStore((s) => s.setCommandPaletteOpen);

  const installedIds = new Set(models.map((m) => m.id));
+  const desktopKeyStorage = isTauri();
+
+  const refreshCloudKeyStatus = useCallback(async () => {
+    if (!desktopKeyStorage) {
+      setCloudKeyStatus({});
+      return;
+    }
+    try {
+      setCloudKeyStatus(await getCloudKeyStatus());
+      setCloudKeyError(null);
+    } catch (e: any) {
+      setCloudKeyError(e?.message || 'Failed to read cloud key status');
+    }
+  }, [desktopKeyStorage]);

  const filtered = tab === 'installed'
    ? (query
@@ -122,6 +128,10 @@ export function CommandPalette() {
    inputRef.current?.focus();
  }, []);

+  useEffect(() => {
+    void refreshCloudKeyStatus();
+  }, [refreshCloudKeyStatus]);
+
  useEffect(() => {
    setSelectedIdx(0);
  }, [query, tab]);
@@ -210,24 +220,29 @@ export function CommandPalette() {
  };

  const handleSaveKey = async (provider: CloudProvider, value: string) => {
-    setStoredKey(provider.storageKey, value);
-    setApiKeys((prev) => ({ ...prev, [provider.storageKey]: value }));
+    const keyValue = value.trim();
+    setSavingKey(provider.envKey);
+    setCloudKeyError(null);

-    // Also save to Tauri backend so the server process picks up the key
-    if (isTauri()) {
-      try {
-        const { invoke } = await import('@tauri-apps/api/core');
-        await invoke('save_cloud_key', { keyName: provider.envKey, keyValue: value });
-      } catch {}
+    try {
+      await saveCloudKey(provider.envKey, keyValue);
+      setApiKeys((prev) => ({ ...prev, [provider.envKey]: '' }));
+      await refreshCloudKeyStatus();
+      useAppStore.getState().addLogEntry({
+        timestamp: Date.now(), level: 'info', category: 'model',
+        message: `${provider.name} API key ${keyValue ? 'saved' : 'removed'}. Refreshing model list...`,
+      });
+      await refreshModels();
+    } catch (e: any) {
+      setCloudKeyError(e?.message || `Failed to save ${provider.name} API key`);
+    } finally {
+      setSavingKey(null);
    }
+  };

-    useAppStore.getState().addLogEntry({
-      timestamp: Date.now(), level: 'info', category: 'model',
-      message: `${provider.name} API key ${value ? 'saved' : 'removed'}. Refreshing model list…`,
-    });
-
-    // Refresh the model list so cloud models appear immediately.
-    await refreshModels();
+  const handleKeyBlur = (provider: CloudProvider) => {
+    const draft = apiKeys[provider.envKey] || '';
+    if (draft.trim()) void handleSaveKey(provider, draft);
  };

  const handleKeyDown = (e: React.KeyboardEvent) => {
@@ -323,6 +338,11 @@ export function CommandPalette() {
            <Check size={12} /> Downloaded {pullSuccess} successfully
          </div>
        )}
+        {tab === 'cloud' && cloudKeyError && (
+          <div className="px-4 py-2 text-xs" style={{ color: 'var(--color-error)', background: 'rgba(220,38,38,0.05)' }}>
+            {cloudKeyError}
+          </div>
+        )}

        {/* Results */}
        <div className="max-h-[400px] overflow-y-auto py-2">
@@ -431,13 +451,17 @@ export function CommandPalette() {
            /* ── Cloud Models tab ── */
            <div className="px-4 py-2">
              <div className="text-[11px] mb-3" style={{ color: 'var(--color-text-tertiary)' }}>
-                Add your API keys to use cloud models. Keys are stored locally on your device only.
+                {desktopKeyStorage
+                  ? 'Add your API keys to use cloud models. Keys are stored in secure desktop storage.'
+                  : 'Configure cloud provider keys in the server environment to use cloud models.'}
              </div>

              {CLOUD_PROVIDERS.map((provider) => {
-                const key = apiKeys[provider.storageKey] || '';
-                const hasKey = !!key;
-                const isVisible = showKeys[provider.storageKey];
+                const key = apiKeys[provider.envKey] || '';
+                const hasSavedKey = !!cloudKeyStatus[provider.envKey];
+                const hasKey = hasSavedKey || !!key.trim();
+                const isVisible = showKeys[provider.envKey];
+                const isSaving = savingKey === provider.envKey;

                return (
                  <div key={provider.name} className="mb-4">
@@ -458,26 +482,28 @@ export function CommandPalette() {
                        <input
                          type={isVisible ? 'text' : 'password'}
                          value={key}
-                          onChange={(e) => setApiKeys((prev) => ({ ...prev, [provider.storageKey]: e.target.value }))}
-                          onBlur={() => handleSaveKey(provider, apiKeys[provider.storageKey] || '')}
-                          placeholder={`${provider.envKey}`}
+                          onChange={(e) => setApiKeys((prev) => ({ ...prev, [provider.envKey]: e.target.value }))}
+                          onBlur={() => handleKeyBlur(provider)}
+                          placeholder={hasSavedKey ? 'Saved in secure storage' : provider.envKey}
+                          disabled={!desktopKeyStorage || isSaving}
                          className="flex-1 text-xs px-2 py-1.5 bg-transparent outline-none font-mono"
                          style={{ color: 'var(--color-text)' }}
                        />
                        <button
-                          onClick={() => setShowKeys((prev) => ({ ...prev, [provider.storageKey]: !prev[provider.storageKey] }))}
+                          onClick={() => setShowKeys((prev) => ({ ...prev, [provider.envKey]: !prev[provider.envKey] }))}
                          className="px-2 cursor-pointer" style={{ color: 'var(--color-text-tertiary)' }}
                        >
                          {isVisible ? <EyeOff size={12} /> : <Eye size={12} />}
                        </button>
                      </div>
-                      {hasKey && (
+                      {hasSavedKey && (
                        <button
                          onClick={() => handleSaveKey(provider, '')}
+                          disabled={isSaving}
                          className="px-2 py-1 rounded-lg text-[10px] cursor-pointer"
-                          style={{ color: 'var(--color-error)', border: '1px solid var(--color-error)' }}
+                          style={{ color: 'var(--color-error)', border: '1px solid var(--color-error)', opacity: isSaving ? 0.5 : 1 }}
                        >
-                          Remove
+                          {isSaving ? 'Saving' : 'Remove'}
                        </button>
                      )}
                    </div>
@@ -2,8 +2,8 @@ import { DollarSign, TrendingDown, Cloud, HardDrive } from 'lucide-react';
 import { useAppStore } from '../../lib/store';

 const CLOUD_PRICING = [
-  { name: 'GPT-5.3', input: 2.00, output: 10.00 },
-  { name: 'Claude Opus 4.6', input: 5.00, output: 25.00 },
+  { name: 'GPT-5.6 Sol', input: 5.00, output: 30.00 },
+  { name: 'Claude Fable 5', input: 10.00, output: 50.00 },
  { name: 'Gemini 3.1 Pro', input: 2.00, output: 12.00 },
 ];

@@ -1,6 +1,7 @@
 import { useState, useEffect, useCallback } from 'react';
 import type React from 'react';
 import { invoke } from '@tauri-apps/api/core';
+import { LEADERBOARD_ENABLED, SUPABASE_ANON_KEY, SUPABASE_URL } from '../../lib/supabase';

 // ---------------------------------------------------------------------------
 // Types
@@ -221,8 +222,8 @@ const styles: Record<string, React.CSSProperties> = {
 };

 const PROVIDER_COLORS: Record<string, string> = {
-  'gpt-5.3': colors.green,
-  'claude-opus-4.6': colors.yellow,
+  'gpt-5.6-sol': colors.green,
+  'claude-fable-5': colors.yellow,
  'gemini-3.1-pro': colors.accent,
 };

@@ -279,9 +280,6 @@ function getOrCreateAnonId(): string {
  return id;
 }

-const SUPABASE_URL = 'https://mtbtgpwzrbostweaanpr.supabase.co';
-const SUPABASE_KEY = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6Im10YnRncHd6cmJvc3R3ZWFhbnByIiwicm9sZSI6ImFub24iLCJpYXQiOjE3NzMxODk0OTQsImV4cCI6MjA4ODc2NTQ5NH0._xMlqCfljtXpwPj54H-ghxfLFO-jiq4W2WhpU8vVL1c';
-
 const REFRESH_INTERVAL_MS = 5000;

 export function SavingsDashboard({ apiUrl }: { apiUrl: string }) {
@@ -318,15 +316,16 @@ export function SavingsDashboard({ apiUrl }: { apiUrl: string }) {
    return () => clearInterval(timer);
  }, [fetchData]);

-  // Share savings to Supabase when opted in and data changes
+  // Share savings to Supabase when opted in and data changes. Skipped entirely
+  // when no anon key was built in (leaderboard disabled).
  useEffect(() => {
-    if (!optInEnabled || !displayName || !data) return;
+    if (!LEADERBOARD_ENABLED || !optInEnabled || !displayName || !data) return;
    const dollarSavings = data.per_provider.reduce((s, p) => s + p.total_cost, 0);
    const energySaved = data.per_provider.reduce((s, p) => s + (p.energy_wh || 0), 0);
    const flopsSaved = data.per_provider.reduce((s, p) => s + (p.flops || 0), 0);
    invoke('submit_savings', {
      supabaseUrl: SUPABASE_URL,
-      supabaseKey: SUPABASE_KEY,
+      supabaseKey: SUPABASE_ANON_KEY,
      payload: {
        anon_id: anonId,
        display_name: displayName,
@@ -1,4 +1,4 @@
-import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';

 // Regression for #266: the frontend must send the local API key as a Bearer
 // token on /v1 + /api requests, or `jarvis serve` with a key configured 401s
@@ -26,11 +26,14 @@ class MemoryStorage {
 }

 beforeEach(() => {
+  vi.resetModules();
+  vi.stubEnv('VITE_SUPABASE_ANON_KEY', 'test-anon-key');
  (globalThis as unknown as { localStorage: MemoryStorage }).localStorage =
    new MemoryStorage();
 });

 afterEach(() => {
+  vi.unstubAllEnvs();
  (globalThis as unknown as { localStorage?: MemoryStorage }).localStorage =
    undefined;
 });
@@ -1,12 +1,10 @@
 import type { ModelInfo, SavingsData, ServerInfo } from '../types';
+import { SUPABASE_ANON_KEY, SUPABASE_URL } from './supabase';

 // ---------------------------------------------------------------------------
-// Supabase config — safe to embed (RLS protects writes)
+// Supabase config
 // ---------------------------------------------------------------------------

-const SUPABASE_URL = import.meta.env.VITE_SUPABASE_URL || 'https://mtbtgpwzrbostweaanpr.supabase.co';
-const SUPABASE_ANON_KEY = import.meta.env.VITE_SUPABASE_ANON_KEY || 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6Im10YnRncHd6cmJvc3R3ZWFhbnByIiwicm9sZSI6ImFub24iLCJpYXQiOjE3NzMxODk0OTQsImV4cCI6MjA4ODc2NTQ5NH0._xMlqCfljtXpwPj54H-ghxfLFO-jiq4W2WhpU8vVL1c';
-
 declare global {
  interface Window {
    __TAURI_INTERNALS__?: unknown;
@@ -15,6 +13,31 @@ declare global {

 export const isTauri = () => typeof window !== 'undefined' && !!window.__TAURI_INTERNALS__;

+export type CloudKeyStatus = Record<string, boolean>;
+
+export async function getCloudKeyStatus(): Promise<CloudKeyStatus> {
+  if (!isTauri()) return {};
+  try {
+    const { invoke } = await import('@tauri-apps/api/core');
+    const rows = await invoke<Array<{ key: string; set: boolean }>>('get_cloud_key_status');
+    return Object.fromEntries(rows.map((row) => [row.key, row.set]));
+  } catch (e: any) {
+    throw new Error(e?.message ?? e ?? 'Failed to read cloud key status');
+  }
+}
+
+export async function saveCloudKey(keyName: string, keyValue: string): Promise<void> {
+  if (!isTauri()) {
+    throw new Error('Cloud API keys can be saved in the desktop app only.');
+  }
+  try {
+    const { invoke } = await import('@tauri-apps/api/core');
+    await invoke('save_cloud_key', { keyName, keyValue });
+  } catch (e: any) {
+    throw new Error(e?.message ?? e ?? 'Failed to save cloud key');
+  }
+}
+
 // Cached API base URL fetched from the Tauri backend at startup.
 // This avoids hardcoding the port — the Rust backend is the single
 // source of truth for JARVIS_PORT.
@@ -60,6 +60,7 @@ export async function* streamChat(

 export async function* streamResearch(
  query: string,
+  model?: string,
  signal?: AbortSignal,
 ): AsyncGenerator<ResearchEvent> {
  // /api/research is mounted at the server root — strip any trailing /v1
@@ -68,7 +69,7 @@ export async function* streamResearch(
  const response = await fetch(`${base}/api/research`, {
    method: 'POST',
    headers: authHeaders({ 'Content-Type': 'application/json' }),
-    body: JSON.stringify({ query }),
+    body: JSON.stringify({ query, ...(model ? { model } : {}) }),
    signal,
  });

@@ -106,4 +107,3 @@ export async function* streamResearch(
    reader.releaseLock();
  }
 }
-
@@ -0,0 +1,11 @@
+export const SUPABASE_URL =
+  import.meta.env.VITE_SUPABASE_URL || 'https://mtbtgpwzrbostweaanpr.supabase.co';
+
+// The Supabase anon key is optional at build time. When it is unset the public
+// savings leaderboard is disabled rather than failing the build — this keeps
+// the `openjarvis` package and desktop app buildable without coupling
+// publishability to a leaderboard credential. Set VITE_SUPABASE_ANON_KEY at
+// build time (from a repo secret) to enable the leaderboard.
+export const SUPABASE_ANON_KEY = import.meta.env.VITE_SUPABASE_ANON_KEY ?? '';
+
+export const LEADERBOARD_ENABLED = SUPABASE_ANON_KEY.length > 0;
@@ -3740,8 +3740,8 @@ export function AgentsPage() {
              const paramsB = paramMatch ? parseFloat(paramMatch[1]) : 9;
              const flops = 2 * paramsB * 1e9 * (inTok + outTok);
              const providers = [
-                { label: 'GPT-5.3', inPer1M: 2.0, outPer1M: 10.0 },
-                { label: 'Claude Opus 4.6', inPer1M: 5.0, outPer1M: 25.0 },
+                { label: 'GPT-5.6 Sol', inPer1M: 5.0, outPer1M: 30.0 },
+                { label: 'Claude Fable 5', inPer1M: 10.0, outPer1M: 50.0 },
                { label: 'Gemini 3.1 Pro', inPer1M: 2.0, outPer1M: 12.0 },
              ];
              const energyWh = (inTok + outTok) / 1000 * 0.4;
@@ -19,9 +19,21 @@ import {
  RefreshCw,
 } from 'lucide-react';
 import { useAppStore, type ThemeMode } from '../lib/store';
-import { checkHealth, fetchSpeechHealth, getMemoryStats, getInferenceSource, setInferenceSource, type InferenceSource } from '../lib/api';
+import {
+  checkHealth,
+  fetchSpeechHealth,
+  getMemoryStats,
+  getInferenceSource,
+  setInferenceSource,
+  getCloudKeyStatus,
+  saveCloudKey,
+  isTauri,
+  type InferenceSource,
+} from '../lib/api';
 import { isAutoUpdateDisabled, setAutoUpdateDisabled } from '../components/Desktop/UpdateChecker';

+const CLOUD_KEY_STATUS_CHANGED = 'openjarvis-cloud-key-status-changed';
+
 function OllamaModelList() {
  const [models, setModels] = useState<Array<{ name: string; size: number }>>([]);
  useEffect(() => {
@@ -44,32 +56,111 @@ function OllamaModelList() {
  );
 }

-function ApiKeyInput({ storageKey, placeholder }: { storageKey: string; placeholder: string }) {
-  const [value, setValue] = useState(() => {
-    try { return localStorage.getItem(storageKey) || ''; } catch { return ''; }
-  });
+function ApiKeyInput({ keyName, placeholder }: { keyName: string; placeholder: string }) {
+  const [value, setValue] = useState('');
  const [saved, setSaved] = useState(false);
-  const save = (v: string) => {
-    setValue(v);
-    try { if (v) localStorage.setItem(storageKey, v); else localStorage.removeItem(storageKey); } catch {}
-    setSaved(true);
-    setTimeout(() => setSaved(false), 2000);
+  const [hasKey, setHasKey] = useState(false);
+  const [error, setError] = useState('');
+  const desktopKeyStorage = isTauri();
+
+  const refresh = useCallback(async () => {
+    if (!desktopKeyStorage) {
+      setHasKey(false);
+      return;
+    }
+    try {
+      const status = await getCloudKeyStatus();
+      setHasKey(!!status[keyName]);
+    } catch {
+      setHasKey(false);
+    }
+  }, [desktopKeyStorage, keyName]);
+
+  useEffect(() => {
+    void refresh();
+    window.addEventListener(CLOUD_KEY_STATUS_CHANGED, refresh);
+    return () => window.removeEventListener(CLOUD_KEY_STATUS_CHANGED, refresh);
+  }, [refresh]);
+
+  const save = async (v: string) => {
+    const next = v.trim();
+    if (!next) return;
+    setError('');
+    try {
+      await saveCloudKey(keyName, next);
+      setValue('');
+      setHasKey(true);
+      setSaved(true);
+      window.dispatchEvent(new Event(CLOUD_KEY_STATUS_CHANGED));
+      setTimeout(() => setSaved(false), 2000);
+    } catch (e: any) {
+      setError(e?.message || 'Failed to save API key');
+    }
  };
+
+  const remove = async () => {
+    setError('');
+    try {
+      await saveCloudKey(keyName, '');
+      setValue('');
+      setHasKey(false);
+      setSaved(true);
+      window.dispatchEvent(new Event(CLOUD_KEY_STATUS_CHANGED));
+      setTimeout(() => setSaved(false), 2000);
+    } catch (e: any) {
+      setError(e?.message || 'Failed to remove API key');
+    }
+  };
+
  return (
    <div className="flex items-center gap-2">
-      <input type="password" value={value} onChange={e => save(e.target.value)} placeholder={placeholder}
+      <input
+        type="password"
+        value={value}
+        onChange={e => setValue(e.target.value)}
+        onBlur={() => { if (value.trim()) void save(value); }}
+        placeholder={hasKey ? 'Saved in secure storage' : placeholder}
+        disabled={!desktopKeyStorage}
        className="w-48 px-2 py-1 rounded text-xs"
        style={{ background: 'var(--color-bg)', border: '1px solid var(--color-border)', color: 'var(--color-text)' }} />
+      {hasKey && (
+        <button
+          onClick={() => void remove()}
+          className="px-2 py-1 rounded text-[10px] cursor-pointer"
+          style={{ color: 'var(--color-error)', border: '1px solid var(--color-error)' }}
+        >
+          Remove
+        </button>
+      )}
      {saved && <span className="text-[10px]" style={{ color: 'var(--color-success)' }}>Saved</span>}
+      {error && <span className="text-[10px]" style={{ color: 'var(--color-error)' }}>{error}</span>}
    </div>
  );
 }

-function CloudProviderStatus({ label, storageKey }: { label: string; storageKey: string }) {
+function CloudProviderStatus({ label, keyName }: { label: string; keyName: string }) {
  const [hasKey, setHasKey] = useState(false);
+  const desktopKeyStorage = isTauri();
+
+  const refresh = useCallback(async () => {
+    if (!desktopKeyStorage) {
+      setHasKey(false);
+      return;
+    }
+    try {
+      const status = await getCloudKeyStatus();
+      setHasKey(!!status[keyName]);
+    } catch {
+      setHasKey(false);
+    }
+  }, [desktopKeyStorage, keyName]);
+
  useEffect(() => {
-    try { setHasKey(!!localStorage.getItem(storageKey)); } catch { setHasKey(false); }
-  }, [storageKey]);
+    void refresh();
+    window.addEventListener(CLOUD_KEY_STATUS_CHANGED, refresh);
+    return () => window.removeEventListener(CLOUD_KEY_STATUS_CHANGED, refresh);
+  }, [refresh]);
+
  return (
    <span className="flex items-center gap-1 text-xs" style={{ color: 'var(--color-text-secondary)' }}>
      <span style={{
@@ -424,10 +515,10 @@ export function SettingsPage() {
            </div>
            <SettingRow label="Cloud providers" description="Green dot means API key is configured">
              <div className="flex flex-wrap gap-3">
-                <CloudProviderStatus label="OpenAI" storageKey="openjarvis-openai-key" />
-                <CloudProviderStatus label="Anthropic" storageKey="openjarvis-anthropic-key" />
-                <CloudProviderStatus label="Google" storageKey="openjarvis-gemini-key" />
-                <CloudProviderStatus label="OpenRouter" storageKey="openjarvis-openrouter-key" />
+                <CloudProviderStatus label="OpenAI" keyName="OPENAI_API_KEY" />
+                <CloudProviderStatus label="Anthropic" keyName="ANTHROPIC_API_KEY" />
+                <CloudProviderStatus label="Google" keyName="GEMINI_API_KEY" />
+                <CloudProviderStatus label="OpenRouter" keyName="OPENROUTER_API_KEY" />
              </div>
            </SettingRow>
          </Section>
@@ -435,23 +526,23 @@ export function SettingsPage() {
          {/* API Keys */}
          <Section title="API Keys">
            <SettingRow label="OpenAI" description="GPT-4, GPT-3.5, etc.">
-              <ApiKeyInput storageKey="openjarvis-openai-key" placeholder="sk-..." />
+              <ApiKeyInput keyName="OPENAI_API_KEY" placeholder="sk-..." />
            </SettingRow>
            <SettingRow label="Anthropic" description="Claude models">
-              <ApiKeyInput storageKey="openjarvis-anthropic-key" placeholder="sk-ant-..." />
+              <ApiKeyInput keyName="ANTHROPIC_API_KEY" placeholder="sk-ant-..." />
            </SettingRow>
            <SettingRow label="Google" description="Gemini models">
-              <ApiKeyInput storageKey="openjarvis-gemini-key" placeholder="AI..." />
+              <ApiKeyInput keyName="GEMINI_API_KEY" placeholder="AI..." />
            </SettingRow>
            <SettingRow label="OpenRouter" description="Multi-provider routing">
-              <ApiKeyInput storageKey="openjarvis-openrouter-key" placeholder="sk-or-..." />
+              <ApiKeyInput keyName="OPENROUTER_API_KEY" placeholder="sk-or-..." />
            </SettingRow>
          </Section>

          {/* Tools */}
          <Section title="Tools">
-            <SettingRow label="Web Search" description="SerpAPI or Tavily key for web search tool">
-              <ApiKeyInput storageKey="openjarvis-search-key" placeholder="API key..." />
+            <SettingRow label="Web Search" description="Tavily key for web search tool">
+              <ApiKeyInput keyName="TAVILY_API_KEY" placeholder="tvly-..." />
            </SettingRow>
          </Section>

@@ -714,7 +805,7 @@ export function SettingsPage() {
              </p>
              <div className="flex gap-3 mt-3 text-xs">
                <a
-                  href="https://scalingintelligence.stanford.edu/blogs/openjarvis/"
+                  href="https://openjarvis.stanford.edu/"
                  target="_blank"
                  rel="noopener noreferrer"
                  style={{ color: 'var(--color-accent)' }}
@@ -1,7 +1,9 @@
 /// <reference types="vite/client" />

 interface ImportMetaEnv {
-  readonly VITE_API_URL: string;
+  readonly VITE_API_URL?: string;
+  readonly VITE_SUPABASE_URL?: string;
+  readonly VITE_SUPABASE_ANON_KEY?: string;
 }

 interface ImportMeta {
@@ -4,6 +4,9 @@ import react from '@vitejs/plugin-react';
 import tailwindcss from '@tailwindcss/vite';
 import { VitePWA } from 'vite-plugin-pwa';

+// VITE_SUPABASE_ANON_KEY is intentionally NOT required here: a missing key
+// disables the savings leaderboard at runtime (see src/lib/supabase.ts) rather
+// than failing the build, so the package/app stays publishable without it.
 export default defineConfig({
  resolve: {
    alias: {
@@ -127,6 +127,7 @@ markdown_extensions:
  - pymdownx.tilde

 extra_javascript:
+  - javascripts/leaderboard-config.js
  - javascripts/leaderboard.js
  - https://cdn.jsdelivr.net/npm/@docsearch/js@3
  - javascripts/docsearch-init.js
@@ -186,6 +186,9 @@ git_describe_command = [
 # Such builds can inject the real version via SETUPTOOLS_SCM_PRETEND_VERSION.
 fallback_version = "0.0.0+unknown"

+[tool.uv.sources]
+openjarvis-rust = { path = "rust/crates/openjarvis-python" }
+
 [tool.hatch.build.targets.wheel]
 packages = ["src/openjarvis"]

@@ -235,3 +238,12 @@ select = ["E", "F", "I", "W"]
 dev = [
    "maturin>=1.12.6",
 ]
+# openjarvis_rust is the native PyO3 extension, built from the local Rust
+# workspace. It lives in a uv dependency group (PEP 735) — not the published
+# `desktop` extra — so `uv sync --group desktop-native` builds it from source
+# for the desktop app, while `pip install openjarvis[desktop]` from PyPI does
+# NOT try to resolve openjarvis-rust from PyPI, where it isn't published
+# (dependency groups are excluded from wheel metadata). See #584 / #615.
+desktop-native = [
+    "openjarvis-rust",
+]
@@ -144,16 +144,21 @@ impl MemoryBackend for SQLiteMemory {
    ) -> Result<Vec<RetrievalResult>, OpenJarvisError> {
        let conn = self.conn.lock();

+        // Split on any non-alphanumeric character (not just whitespace) so
+        // internal punctuation — apostrophes in particular ("user's") — never
+        // reaches the FTS5 MATCH string. FTS5's query grammar treats an
+        // unescaped `'` as a string delimiter, so passing a raw token like
+        // `user's` through silently fails to parse and yields zero rows with
+        // no visible error. Splitting fully avoids needing to escape anything.
        let words: Vec<String> = query
-            .split_whitespace()
-            .map(|w| w.trim_matches(|c: char| "?.,!;:'\"()[]{}/ ".contains(c)).to_string())
+            .split(|c: char| !c.is_alphanumeric())
+            .map(|w| w.to_string())
            .filter(|w| !w.is_empty())
            .collect();
-        let fts_query = if words.len() == 1 {
-            words[0].clone()
-        } else {
-            words.join(" OR ")
-        };
+        if words.is_empty() {
+            return Ok(Vec::new());
+        }
+        let fts_query = words.join(" OR ");

        let mut stmt = conn
            .prepare(
@@ -320,6 +325,27 @@ mod tests {
        assert_eq!(mixed.len(), 2, "mixed-case query should find both documents");
    }

+    #[test]
+    fn test_sqlite_apostrophe_in_query() {
+        let mem = SQLiteMemory::in_memory().unwrap();
+        mem.store("The user's name is Trev.", "identity", None).unwrap();
+
+        // A query containing an internal apostrophe must not break FTS5's
+        // MATCH syntax (an unescaped `'` is a string delimiter in FTS5's
+        // query grammar), which previously caused this to silently return
+        // zero results instead of matching or erroring.
+        let multi_word = mem.retrieve("what is the user's name", 5).unwrap();
+        assert!(
+            !multi_word.is_empty(),
+            "query with an internal apostrophe should not silently return zero results"
+        );
+
+        // Bare single-word possessive: exercises the (former) single-word
+        // bypass path that skipped the OR-join entirely.
+        let bare = mem.retrieve("user's", 5).unwrap();
+        assert!(!bare.is_empty(), "single-word possessive query should still match");
+    }
+
    #[test]
    fn test_sqlite_scores_are_positive() {
        let mem = SQLiteMemory::in_memory().unwrap();
@@ -2,6 +2,8 @@

 from __future__ import annotations

+from openjarvis.engine._base import looks_like_context_length_error
+

 class AgentTickError(Exception):
    """Base class for agent tick errors."""
@@ -64,6 +66,14 @@ def classify_error(exc: Exception) -> AgentTickError:

    msg = str(exc).lower()

+    # A context-window overflow is deterministic: retrying the identical
+    # over-length request can never succeed, so fail fast instead of burning
+    # the retry budget on it.
+    if getattr(exc, "is_context_length_error", False) or (
+        looks_like_context_length_error(msg)
+    ):
+        return FatalError(str(exc))
+
    # Check fatal patterns first (more specific)
    if isinstance(exc, PermissionError):
        return FatalError(str(exc))
@@ -90,6 +100,11 @@ def retry_delay(attempt: int) -> int:
 def suggest_action(error: AgentTickError) -> str:
    """Return a human-readable suggested action for the given error."""
    msg = str(error).lower()
+    if looks_like_context_length_error(msg):
+        return (
+            "Conversation too long for the model's context window \u2014 "
+            "start a new chat or shorten the conversation"
+        )
    if any(p in msg for p in ("rate limit", "rate_limit", "429", "too many requests")):
        return "Rate limited \u2014 agent will auto-retry on next tick"
    if any(p in msg for p in ("timeout", "timed out", "connection", "unavailable")):
@@ -102,9 +102,7 @@ class AgentExecutor:
        )
        return agent.run(input_text)

-    def execute_tick(
-        self, agent_id: str, *, lock_already_held: bool = False
-    ) -> None:
+    def execute_tick(self, agent_id: str, *, lock_already_held: bool = False) -> None:
        """Run one tick for the given agent.

        1. Acquire concurrency guard (start_tick)
@@ -126,9 +124,7 @@ class AgentExecutor:
                self._manager.start_tick(agent_id)
                self._set_activity(agent_id, "Preparing tick...")
            except ValueError:
-                logger.warning(
-                    "Agent %s already running, skipping tick", agent_id
-                )
+                logger.warning("Agent %s already running, skipping tick", agent_id)
                return

        agent = self._manager.get_agent(agent_id)
@@ -412,18 +408,14 @@ class AgentExecutor:
                from openjarvis.prompt.builder import SystemPromptBuilder

                state_kwargs["prompt_builder"] = SystemPromptBuilder(
-                    agent_template=getattr(
-                        cfg.agent, "default_system_prompt", ""
-                    )
+                    agent_template=getattr(cfg.agent, "default_system_prompt", "")
                    or "",
                    memory_files_config=cfg.memory_files,
                    system_prompt_config=cfg.system_prompt,
                )

        try:
-            agent_instance = agent_cls(
-                engine, model, **agent_kwargs, **state_kwargs
-            )
+            agent_instance = agent_cls(engine, model, **agent_kwargs, **state_kwargs)
        except TypeError:
            try:
                agent_instance = agent_cls(engine, model, **agent_kwargs)
@@ -474,9 +466,7 @@ class AgentExecutor:
                tick_note = f"Previous tick: {first_sentence}"

        if instruction:
-            input_text = (
-                f"Current date: {today}\n\nStanding instruction: {instruction}"
-            )
+            input_text = f"Current date: {today}\n\nStanding instruction: {instruction}"
            if tick_note:
                input_text += f"\n\n{tick_note}"
        else:
@@ -303,7 +303,9 @@ def _openrouter_limiter() -> _OpenRouterLimiter:
    if _OPENROUTER_LIMITER is None:
        with _OPENROUTER_LIMITER_LOCK:
            if _OPENROUTER_LIMITER is None:
-                max_concurrent = int(os.environ.get("OJ_OPENROUTER_MAX_CONCURRENT", "20") or 20)
+                max_concurrent = int(
+                    os.environ.get("OJ_OPENROUTER_MAX_CONCURRENT", "20") or 20
+                )
                rpm = int(os.environ.get("OJ_OPENROUTER_RPM", "60") or 60)
                _OPENROUTER_LIMITER = _OpenRouterLimiter(max_concurrent, rpm)
    return _OPENROUTER_LIMITER
@@ -319,8 +321,14 @@ def _serialize_block(block: Any) -> Dict[str, Any]:
    """
    out: Dict[str, Any] = {"type": getattr(block, "type", type(block).__name__)}
    for attr in (
-        "id", "name", "input", "text", "thinking", "signature",
-        "tool_use_id", "content",
+        "id",
+        "name",
+        "input",
+        "text",
+        "thinking",
+        "signature",
+        "tool_use_id",
+        "content",
    ):
        if hasattr(block, attr):
            val = getattr(block, attr)
@@ -341,14 +349,16 @@ def _serialize_openai_tool_calls(tool_calls: Any) -> List[Dict[str, Any]]:
        return out
    for tc in tool_calls:
        fn = getattr(tc, "function", None)
-        out.append({
-            "id": getattr(tc, "id", None),
-            "type": getattr(tc, "type", "function"),
-            "function": {
-                "name": getattr(fn, "name", None) if fn else None,
-                "arguments": getattr(fn, "arguments", None) if fn else None,
-            },
-        })
+        out.append(
+            {
+                "id": getattr(tc, "id", None),
+                "type": getattr(tc, "type", "function"),
+                "function": {
+                    "name": getattr(fn, "name", None) if fn else None,
+                    "arguments": getattr(fn, "arguments", None) if fn else None,
+                },
+            }
+        )
    return out


@@ -473,32 +483,46 @@ class LocalCloudAgent(BaseAgent):
        srv = getattr(msg.usage, "server_tool_use", None)
        n_searches = getattr(srv, "web_search_requests", 0) if srv else 0
        content_blocks = [_serialize_block(b) for b in msg.content]
-        tool_use_blocks = [b for b in content_blocks if b.get("type") in (
-            "tool_use", "server_tool_use",
-        )]
-        tool_result_blocks = [b for b in content_blocks if b.get("type") in (
-            "web_search_tool_result", "tool_result",
-        )]
-        _record_event({
-            "kind": "anthropic",
-            "role": trace_role,
-            "model": model,
-            "system": system,
-            "user": user,
-            "response": text,
-            "content_blocks": content_blocks,
-            "tool_calls": tool_use_blocks,
-            "tool_results": tool_result_blocks,
-            "tokens_in": msg.usage.input_tokens,
-            "tokens_out": msg.usage.output_tokens,
-            "n_web_searches": n_searches,
-            "tools_declared": tools,
-            "tool_choice": tool_choice,
-            "output_config": output_config,
-            "stop_reason": getattr(msg, "stop_reason", None),
-            "latency_s": latency,
-            "ts": time.time(),
-        })
+        tool_use_blocks = [
+            b
+            for b in content_blocks
+            if b.get("type")
+            in (
+                "tool_use",
+                "server_tool_use",
+            )
+        ]
+        tool_result_blocks = [
+            b
+            for b in content_blocks
+            if b.get("type")
+            in (
+                "web_search_tool_result",
+                "tool_result",
+            )
+        ]
+        _record_event(
+            {
+                "kind": "anthropic",
+                "role": trace_role,
+                "model": model,
+                "system": system,
+                "user": user,
+                "response": text,
+                "content_blocks": content_blocks,
+                "tool_calls": tool_use_blocks,
+                "tool_results": tool_result_blocks,
+                "tokens_in": msg.usage.input_tokens,
+                "tokens_out": msg.usage.output_tokens,
+                "n_web_searches": n_searches,
+                "tools_declared": tools,
+                "tool_choice": tool_choice,
+                "output_config": output_config,
+                "stop_reason": getattr(msg, "stop_reason", None),
+                "latency_s": latency,
+                "ts": time.time(),
+            }
+        )
        return text, msg.usage.input_tokens, msg.usage.output_tokens, n_searches

    @staticmethod
@@ -550,24 +574,26 @@ class LocalCloudAgent(BaseAgent):
        u = resp.usage
        p = getattr(u, "prompt_tokens", 0) if u else 0
        c = getattr(u, "completion_tokens", 0) if u else 0
-        _record_event({
-            "kind": "openai",
-            "role": trace_role,
-            "model": model,
-            "system": system,
-            "user": user,
-            "response": text,
-            "tool_calls": tool_calls,
-            "reasoning_content": reasoning,
-            "tokens_in": p,
-            "tokens_out": c,
-            "response_format": response_format,
-            "tools_declared": tools,
-            "tool_choice": tool_choice,
-            "finish_reason": getattr(choice, "finish_reason", None),
-            "latency_s": latency,
-            "ts": time.time(),
-        })
+        _record_event(
+            {
+                "kind": "openai",
+                "role": trace_role,
+                "model": model,
+                "system": system,
+                "user": user,
+                "response": text,
+                "tool_calls": tool_calls,
+                "reasoning_content": reasoning,
+                "tokens_in": p,
+                "tokens_out": c,
+                "response_format": response_format,
+                "tools_declared": tools,
+                "tool_choice": tool_choice,
+                "finish_reason": getattr(choice, "finish_reason", None),
+                "latency_s": latency,
+                "ts": time.time(),
+            }
+        )
        return text, p, c

    @staticmethod
@@ -614,12 +640,10 @@ class LocalCloudAgent(BaseAgent):
        from openai import OpenAI

        if model.startswith("openrouter/"):
-            model = model[len("openrouter/"):]
+            model = model[len("openrouter/") :]
        api_key = os.environ.get("OPENROUTER_API_KEY")
        if not api_key:
-            raise RuntimeError(
-                "OPENROUTER_API_KEY is not set; cannot call OpenRouter."
-            )
+            raise RuntimeError("OPENROUTER_API_KEY is not set; cannot call OpenRouter.")
        client = OpenAI(
            base_url="https://openrouter.ai/api/v1",
            api_key=api_key,
@@ -658,21 +682,23 @@ class LocalCloudAgent(BaseAgent):
        u = resp.usage
        p = getattr(u, "prompt_tokens", 0) if u else 0
        c = getattr(u, "completion_tokens", 0) if u else 0
-        _record_event({
-            "kind": "openrouter",
-            "role": trace_role,
-            "model": model,
-            "system": system,
-            "user": user,
-            "response": text,
-            "tool_calls": tool_calls,
-            "reasoning_content": reasoning,
-            "tokens_in": p,
-            "tokens_out": c,
-            "finish_reason": getattr(choice, "finish_reason", None),
-            "latency_s": latency,
-            "ts": time.time(),
-        })
+        _record_event(
+            {
+                "kind": "openrouter",
+                "role": trace_role,
+                "model": model,
+                "system": system,
+                "user": user,
+                "response": text,
+                "tool_calls": tool_calls,
+                "reasoning_content": reasoning,
+                "tokens_in": p,
+                "tokens_out": c,
+                "finish_reason": getattr(choice, "finish_reason", None),
+                "latency_s": latency,
+                "ts": time.time(),
+            }
+        )
        return text, p, c

    @staticmethod
@@ -701,7 +727,9 @@ class LocalCloudAgent(BaseAgent):
        from google import genai
        from google.genai import types

-        client = genai.Client(http_options=types.HttpOptions(timeout=int(timeout * 1000)))
+        client = genai.Client(
+            http_options=types.HttpOptions(timeout=int(timeout * 1000))
+        )
        cfg = types.GenerateContentConfig(
            temperature=temperature,
            max_output_tokens=max_tokens,
@@ -728,21 +756,23 @@ class LocalCloudAgent(BaseAgent):
            finish_reason = str(resp.candidates[0].finish_reason)
        except Exception:
            pass
-        _record_event({
-            "kind": "gemini",
-            "role": trace_role,
-            "model": model,
-            "system": system,
-            "user": user,
-            "response": text,
-            "tokens_in": p,
-            "tokens_out": c,
-            "temperature": temperature,
-            "max_tokens": max_tokens,
-            "finish_reason": finish_reason,
-            "latency_s": latency,
-            "ts": time.time(),
-        })
+        _record_event(
+            {
+                "kind": "gemini",
+                "role": trace_role,
+                "model": model,
+                "system": system,
+                "user": user,
+                "response": text,
+                "tokens_in": p,
+                "tokens_out": c,
+                "temperature": temperature,
+                "max_tokens": max_tokens,
+                "finish_reason": finish_reason,
+                "latency_s": latency,
+                "ts": time.time(),
+            }
+        )
        return text, p, c

    @staticmethod
@@ -797,27 +827,29 @@ class LocalCloudAgent(BaseAgent):
        u = resp.usage
        p = getattr(u, "prompt_tokens", 0) if u else 0
        c = getattr(u, "completion_tokens", 0) if u else 0
-        _record_event({
-            "kind": "vllm",
-            "role": trace_role,
-            "model": model,
-            "endpoint": endpoint,
-            "system": system,
-            "user": user,
-            "response": text,
-            "tool_calls": tool_calls,
-            "reasoning_content": reasoning,
-            "tokens_in": p,
-            "tokens_out": c,
-            "temperature": temperature,
-            "max_tokens": max_tokens,
-            "enable_thinking": enable_thinking,
-            "tools_declared": tools,
-            "tool_choice": tool_choice,
-            "finish_reason": getattr(choice, "finish_reason", None),
-            "latency_s": latency,
-            "ts": time.time(),
-        })
+        _record_event(
+            {
+                "kind": "vllm",
+                "role": trace_role,
+                "model": model,
+                "endpoint": endpoint,
+                "system": system,
+                "user": user,
+                "response": text,
+                "tool_calls": tool_calls,
+                "reasoning_content": reasoning,
+                "tokens_in": p,
+                "tokens_out": c,
+                "temperature": temperature,
+                "max_tokens": max_tokens,
+                "enable_thinking": enable_thinking,
+                "tools_declared": tools,
+                "tool_choice": tool_choice,
+                "finish_reason": getattr(choice, "finish_reason", None),
+                "latency_s": latency,
+                "ts": time.time(),
+            }
+        )
        return text, p, c

    @staticmethod
@@ -884,33 +916,37 @@ class LocalCloudAgent(BaseAgent):
            n_searches = getattr(srv, "web_search_requests", 0) if srv else 0
            content_blocks = [_serialize_block(b) for b in msg.content]
            tool_use_blocks = [
-                b for b in content_blocks
+                b
+                for b in content_blocks
                if b.get("type") in ("tool_use", "server_tool_use")
            ]
            tool_result_blocks = [
-                b for b in content_blocks
+                b
+                for b in content_blocks
                if b.get("type") in ("web_search_tool_result", "tool_result")
            ]
            stop_reason = getattr(msg, "stop_reason", None)
-            _record_event({
-                "kind": "anthropic",
-                "role": trace_role,
-                "model": model,
-                "system": system if turn == 0 else None,
-                "user": user if turn == 0 else None,
-                "turn": turn,
-                "response": text,
-                "content_blocks": content_blocks,
-                "tool_calls": tool_use_blocks,
-                "tool_results": tool_result_blocks,
-                "tokens_in": msg.usage.input_tokens,
-                "tokens_out": msg.usage.output_tokens,
-                "n_web_searches": n_searches,
-                "tools_declared": tools,
-                "stop_reason": stop_reason,
-                "latency_s": latency,
-                "ts": time.time(),
-            })
+            _record_event(
+                {
+                    "kind": "anthropic",
+                    "role": trace_role,
+                    "model": model,
+                    "system": system if turn == 0 else None,
+                    "user": user if turn == 0 else None,
+                    "turn": turn,
+                    "response": text,
+                    "content_blocks": content_blocks,
+                    "tool_calls": tool_use_blocks,
+                    "tool_results": tool_result_blocks,
+                    "tokens_in": msg.usage.input_tokens,
+                    "tokens_out": msg.usage.output_tokens,
+                    "n_web_searches": n_searches,
+                    "tools_declared": tools,
+                    "stop_reason": stop_reason,
+                    "latency_s": latency,
+                    "ts": time.time(),
+                }
+            )
            p_total += msg.usage.input_tokens
            c_total += msg.usage.output_tokens
            n_searches_total += n_searches
@@ -920,9 +956,7 @@ class LocalCloudAgent(BaseAgent):
            # here — break and let the caller (or future loop variant)
            # handle it. Only ``server_tool_use`` blocks (web_search)
            # are auto-continued by Anthropic itself.
-            client_tool_use = any(
-                b.get("type") == "tool_use" for b in content_blocks
-            )
+            client_tool_use = any(b.get("type") == "tool_use" for b in content_blocks)
            if client_tool_use:
                break
            if stop_reason == "end_turn" or stop_reason is None:
@@ -931,10 +965,12 @@ class LocalCloudAgent(BaseAgent):
            # (server side) — Anthropic returned mid-thought. Append the
            # assistant turn and ask it to continue.
            messages.append({"role": "assistant", "content": msg.content})
-            messages.append({
-                "role": "user",
-                "content": "Continue.",
-            })
+            messages.append(
+                {
+                    "role": "user",
+                    "content": "Continue.",
+                }
+            )
        return last_text, p_total, c_total, n_searches_total, turns

    @staticmethod
@@ -1008,8 +1044,12 @@ class LocalCloudAgent(BaseAgent):
                    continue
                raise
        if resp is None:
-            raise last_exc if last_exc is not None else RuntimeError(
-                "openai responses.create failed for all web_search tool names"
+            raise (
+                last_exc
+                if last_exc is not None
+                else RuntimeError(
+                    "openai responses.create failed for all web_search tool names"
+                )
            )
        _bump_cloud_calls()
        latency = time.time() - t0
@@ -1033,30 +1073,35 @@ class LocalCloudAgent(BaseAgent):
            text = "".join(chunks)

        n_searches = sum(
-            1 for item in output_items
-            if getattr(item, "type", None) in (
-                "web_search_call", "web_search_tool_call",
+            1
+            for item in output_items
+            if getattr(item, "type", None)
+            in (
+                "web_search_call",
+                "web_search_tool_call",
            )
        )
        u = getattr(resp, "usage", None)
        p = int(getattr(u, "input_tokens", 0) or 0) if u else 0
        c = int(getattr(u, "output_tokens", 0) or 0) if u else 0
-        _record_event({
-            "kind": "openai_agent",
-            "role": trace_role,
-            "model": model,
-            "system": system,
-            "user": user,
-            "response": text,
-            "output_items": _jsonable(output_items),
-            "tokens_in": p,
-            "tokens_out": c,
-            "n_web_searches": n_searches,
-            "tools_declared": [{"type": used_tool_name}],
-            "stop_reason": getattr(resp, "status", None),
-            "latency_s": latency,
-            "ts": time.time(),
-        })
+        _record_event(
+            {
+                "kind": "openai_agent",
+                "role": trace_role,
+                "model": model,
+                "system": system,
+                "user": user,
+                "response": text,
+                "output_items": _jsonable(output_items),
+                "tokens_in": p,
+                "tokens_out": c,
+                "n_web_searches": n_searches,
+                "tools_declared": [{"type": used_tool_name}],
+                "stop_reason": getattr(resp, "status", None),
+                "latency_s": latency,
+                "ts": time.time(),
+            }
+        )
        return text, p, c, n_searches, 1

    @staticmethod
@@ -1129,23 +1174,25 @@ class LocalCloudAgent(BaseAgent):
                n_searches = len(web_search_queries)
        except Exception:  # noqa: BLE001
            pass
-        _record_event({
-            "kind": "gemini_agent",
-            "role": trace_role,
-            "model": model,
-            "system": system,
-            "user": user,
-            "response": text,
-            "tokens_in": p,
-            "tokens_out": c,
-            "n_web_searches": n_searches,
-            "web_search_queries": web_search_queries,
-            "temperature": temperature,
-            "max_tokens": max_tokens,
-            "finish_reason": finish_reason,
-            "latency_s": latency,
-            "ts": time.time(),
-        })
+        _record_event(
+            {
+                "kind": "gemini_agent",
+                "role": trace_role,
+                "model": model,
+                "system": system,
+                "user": user,
+                "response": text,
+                "tokens_in": p,
+                "tokens_out": c,
+                "n_web_searches": n_searches,
+                "web_search_queries": web_search_queries,
+                "temperature": temperature,
+                "max_tokens": max_tokens,
+                "finish_reason": finish_reason,
+                "latency_s": latency,
+                "ts": time.time(),
+            }
+        )
        return text, p, c, n_searches, 1

    def _call_cloud(
@@ -1269,8 +1316,13 @@ class LocalCloudAgent(BaseAgent):
            # Persist the trace before the trace state is closed (and even on
            # hard failure, so we get a record of what we did before it broke).
            self._write_trace_log(
-                context, input, answer, meta if "meta" in locals() else {},
-                events, soft_reason, exc_obj,
+                context,
+                input,
+                answer,
+                meta if "meta" in locals() else {},
+                events,
+                soft_reason,
+                exc_obj,
            )
            _close_trace()
            _close_call_counts()
@@ -1326,9 +1378,7 @@ class LocalCloudAgent(BaseAgent):
                "metadata": meta,
                "events": events,
                "soft_error": soft_reason,
-                "error": (
-                    f"{type(exc).__name__}: {exc}" if exc is not None else None
-                ),
+                "error": (f"{type(exc).__name__}: {exc}" if exc is not None else None),
            }
            (out_dir / f"{task_id}.json").write_text(
                json.dumps(blob, indent=2, default=str)
@@ -96,6 +96,7 @@ class EnergyCollector:
            return self
        try:
            import pynvml  # type: ignore[import-not-found]
+
            pynvml.nvmlInit()
            total = pynvml.nvmlDeviceGetCount()
            self.gpu_indices = _resolve_gpu_indices(total)
@@ -174,12 +174,15 @@ def _is_retryable(exc: BaseException) -> bool:
        import openai
    except ImportError:
        return False
-    if isinstance(exc, (
-        openai.RateLimitError,
-        openai.APITimeoutError,
-        openai.APIConnectionError,
-        openai.InternalServerError,
-    )):
+    if isinstance(
+        exc,
+        (
+            openai.RateLimitError,
+            openai.APITimeoutError,
+            openai.APIConnectionError,
+            openai.InternalServerError,
+        ),
+    ):
        return True
    if isinstance(exc, openai.APIStatusError):
        status = getattr(exc, "status_code", None)
@@ -196,7 +199,7 @@ def _sleep_for(attempt: int, exc: BaseException) -> float:
        # Respect a server-provided hint, but clamp to our cap so a
        # pathological header can't stall the run for hours.
        return min(_RETRY_CAP, hinted) + random.uniform(0, 0.5)
-    base = min(_RETRY_CAP, _RETRY_BASE * (2 ** attempt))
+    base = min(_RETRY_CAP, _RETRY_BASE * (2**attempt))
    # Full jitter — better tail behavior than equal jitter when many
    # workers wake at the same moment.
    return random.uniform(0.0, base)
@@ -237,16 +240,19 @@ def _wrap_create(orig: Callable[..., Any]) -> Callable[..., Any]:
                        import openai
                    except ImportError:
                        raise
-                    if not isinstance(exc, (
-                        openai.APIConnectionError,
-                        openai.APITimeoutError,
-                        openai.InternalServerError,
-                    )):
+                    if not isinstance(
+                        exc,
+                        (
+                            openai.APIConnectionError,
+                            openai.APITimeoutError,
+                            openai.InternalServerError,
+                        ),
+                    ):
                        raise
                    local_last_exc = exc
                    if attempt >= 2:
                        break
-                    time.sleep(2 ** attempt)
+                    time.sleep(2**attempt)
            assert local_last_exc is not None
            raise local_last_exc

@@ -266,6 +272,7 @@ def _wrap_create(orig: Callable[..., Any]) -> Callable[..., Any]:
                # stay parseable in the runner log.
                try:
                    import sys
+
                    print(
                        f"[openai-retry] attempt {attempt + 1}/{_MAX_RETRIES} "
                        f"{type(exc).__name__}: {str(exc)[:120]} — "
@@ -333,9 +340,7 @@ def patch_openai_globally() -> None:
            from openai.resources.chat import completions as _comp_mod_async

            cls = getattr(_comp_mod_async, "AsyncCompletions", None)
-            if cls is not None and not getattr(
-                cls.create, "_hybrid_patched", False
-            ):
+            if cls is not None and not getattr(cls.create, "_hybrid_patched", False):
                # Async wrapper is structurally different — only patch
                # the bumped defaults via __init__; full retry loop on
                # async would need an async wrapper. Leave that for the
@@ -11,27 +11,27 @@ from __future__ import annotations

 # USD per million tokens, (input, output). Local models = 0.
 PRICES: dict[str, tuple[float, float]] = {
-    "claude-opus-4-7":             (5.00, 25.0),
-    "claude-sonnet-4-6":           (3.00, 15.0),
-    "claude-haiku-4-5":            (1.00, 5.00),
-    "claude-haiku-4-5-20251001":   (1.00, 5.00),
-    "gpt-5.5":                     (5.00, 30.0),
-    "gpt-5":                       (1.25, 10.0),
-    "gpt-5-mini":                  (0.25, 2.00),
-    "gpt-5-mini-2025-08-07":       (0.25, 2.00),
-    "gpt-4o":                      (0.15, 0.60),
+    "claude-opus-4-7": (5.00, 25.0),
+    "claude-sonnet-4-6": (3.00, 15.0),
+    "claude-haiku-4-5": (1.00, 5.00),
+    "claude-haiku-4-5-20251001": (1.00, 5.00),
+    "gpt-5.5": (5.00, 30.0),
+    "gpt-5": (1.25, 10.0),
+    "gpt-5-mini": (0.25, 2.00),
+    "gpt-5-mini-2025-08-07": (0.25, 2.00),
+    "gpt-4o": (0.15, 0.60),
    # Gemini Developer API prices (USD per 1M tokens). Pro models use tiered
    # pricing above 200K prompt tokens; GAIA prompts stay under that tier, so
    # charge the low-context standard rate.
-    "gemini-3.1-pro-preview":       (2.00, 12.0),
+    "gemini-3.1-pro-preview": (2.00, 12.0),
    "gemini-3.1-pro-preview-customtools": (2.00, 12.0),
-    "gemini-2.5-pro":              (1.25, 10.0),
-    "gemini-2.5-flash":            (0.30, 2.50),
-    "gemini-2.5-flash-lite":       (0.10, 0.40),
+    "gemini-2.5-pro": (1.25, 10.0),
+    "gemini-2.5-flash": (0.30, 2.50),
+    "gemini-2.5-flash-lite": (0.10, 0.40),
    # OpenRouter slugs (used by toolorchestra paper-match pool).
    # Prices are OpenRouter list (USD/1M tokens), 2026-05 snapshot.
-    "qwen/qwen-2.5-coder-32b-instruct":  (0.08, 0.18),
-    "qwen/qwen3-32b":                    (0.10, 0.30),
+    "qwen/qwen-2.5-coder-32b-instruct": (0.08, 0.18),
+    "qwen/qwen3-32b": (0.10, 0.30),
    "meta-llama/llama-3.3-70b-instruct": (0.13, 0.39),
 }

@@ -64,11 +64,7 @@ def is_reasoning_model(model: str) -> bool:
    before emitting visible answer text. At max_tokens=4096 these silently
    truncate with empty answers on GAIA (26/100 GPT-5, 18/100 Gemini Pro)."""
    m = (model or "").lower()
-    return (
-        is_gpt5_family(model)
-        or "gemini-2.5-pro" in m
-        or "gemini-3.1-pro" in m
-    )
+    return is_gpt5_family(model) or "gemini-2.5-pro" in m or "gemini-3.1-pro" in m


 def default_max_output_tokens(model: str) -> int:
@@ -80,9 +80,7 @@ def _resolve_local_model(endpoint: str, registry_model: str) -> str:
    a model id (e.g. ``Qwen3.5-9B``) that's different from what's loaded.
    """
    try:
-        with urllib.request.urlopen(
-            endpoint.rstrip("/") + "/models", timeout=5
-        ) as r:
+        with urllib.request.urlopen(endpoint.rstrip("/") + "/models", timeout=5) as r:
            data = json.loads(r.read())
        served = [m["id"] for m in data.get("data", [])]
    except Exception:
@@ -158,14 +156,15 @@ class AdvisorsAgent(LocalCloudAgent):
        # only the cloud executor passes do. With web_search on, dispatch
        # to the search-capable agent loop for the configured provider.
        if use_ws:
-            (initial_resp, e1_in, e1_out, n_s1, e1_turns,
-             e1_search_cost) = self._executor_search(
-                user=f"Question:\n{question}",
-                system=EXECUTOR_INITIAL_SYS,
-                max_tokens=executor_max_tokens,
-                ws_max_uses=ws_max_uses,
-                max_turns=gaia_max_turns,
-                query=question,
+            (initial_resp, e1_in, e1_out, n_s1, e1_turns, e1_search_cost) = (
+                self._executor_search(
+                    user=f"Question:\n{question}",
+                    system=EXECUTOR_INITIAL_SYS,
+                    max_tokens=executor_max_tokens,
+                    ws_max_uses=ws_max_uses,
+                    max_turns=gaia_max_turns,
+                    query=question,
+                )
            )
            n_searches_total += n_s1
            search_cost_total += e1_search_cost
@@ -186,7 +185,8 @@ class AdvisorsAgent(LocalCloudAgent):
            )
        local_model = _resolve_local_model(self._local_endpoint, self._local_model)
        advisor_prompt = ADVISOR_TEMPLATE.format(
-            question=question, initial_response=initial_resp,
+            question=question,
+            initial_response=initial_resp,
        )
        advisor_text, adv_in, adv_out = self._call_vllm(
            local_model,
@@ -206,14 +206,15 @@ class AdvisorsAgent(LocalCloudAgent):
            f"answer-format rules."
        )
        if use_ws:
-            (final_answer, e2_in, e2_out, n_s2, e2_turns,
-             e2_search_cost) = self._executor_search(
-                user=final_user,
-                system=EXECUTOR_FINAL_SYS,
-                max_tokens=executor_max_tokens,
-                ws_max_uses=ws_max_uses,
-                max_turns=gaia_max_turns,
-                query=question,
+            (final_answer, e2_in, e2_out, n_s2, e2_turns, e2_search_cost) = (
+                self._executor_search(
+                    user=final_user,
+                    system=EXECUTOR_FINAL_SYS,
+                    max_tokens=executor_max_tokens,
+                    ws_max_uses=ws_max_uses,
+                    max_turns=gaia_max_turns,
+                    query=question,
+                )
            )
            n_searches_total += n_s2
            search_cost_total += e2_search_cost
@@ -424,8 +425,10 @@ class AdvisorsAgent(LocalCloudAgent):

        tokens_local = adv_in + adv_out
        tokens_cloud = (
-            initial_out["tokens_in"] + initial_out["tokens_out"]
-            + final_out["tokens_in"] + final_out["tokens_out"]
+            initial_out["tokens_in"]
+            + initial_out["tokens_out"]
+            + final_out["tokens_in"]
+            + final_out["tokens_out"]
        )
        cost = initial_out["cost_usd"] + final_out["cost_usd"]
        meta: Dict[str, Any] = {
@@ -73,6 +73,7 @@ ARCHON_SWE_RANKER_SYS = (

 # ---------- Stubs for Archon's eager-imported heavy deps we don't need ----------

+
 def _stub_archon_imports() -> None:
    """``utils.py`` imports groq/google/litellm/dotenv at module load. Stub
    the ones we don't use so the import chain doesn't fail when those
@@ -97,6 +98,7 @@ def _add_archon_to_path() -> None:

 # ---------- Anthropic patch for Opus 4.7 ----------

+
 def _patch_anthropic_for_opus() -> None:
    from anthropic.resources.messages import messages as _msgs_mod

@@ -129,8 +131,10 @@ def _tally() -> Dict[str, int]:
    counts = getattr(_TALLY_LOCAL, "counts", None)
    if counts is None:
        counts = {
-            "cloud_prompt": 0, "cloud_completion": 0,
-            "local_prompt": 0, "local_completion": 0,
+            "cloud_prompt": 0,
+            "cloud_completion": 0,
+            "local_prompt": 0,
+            "local_completion": 0,
            "n_web_searches": 0,
        }
        _TALLY_LOCAL.counts = counts
@@ -141,8 +145,10 @@ def _tally() -> Dict[str, int]:

 def _reset_tally() -> None:
    _TALLY_LOCAL.counts = {
-        "cloud_prompt": 0, "cloud_completion": 0,
-        "local_prompt": 0, "local_completion": 0,
+        "cloud_prompt": 0,
+        "cloud_completion": 0,
+        "local_prompt": 0,
+        "local_completion": 0,
        "n_web_searches": 0,
    }

@@ -169,6 +175,7 @@ def _make_local_generator(local_endpoint: str, local_model: str):

    def local_gen(model, messages, max_tokens=2048, temperature=0.7, **_kw):  # type: ignore[no-untyped-def]
        import time as _time
+
        t0 = _time.time()
        try:
            resp = client.chat.completions.create(
@@ -179,31 +186,35 @@ def _make_local_generator(local_endpoint: str, local_model: str):
            )
            _bump_local_calls()
        except Exception as e:
-            _record_event({
-                "kind": "archon_local_gen_error",
-                "model": local_model,
-                "messages": messages,
-                "error": f"{type(e).__name__}: {e}",
-                "ts": _time.time(),
-            })
+            _record_event(
+                {
+                    "kind": "archon_local_gen_error",
+                    "model": local_model,
+                    "messages": messages,
+                    "error": f"{type(e).__name__}: {e}",
+                    "ts": _time.time(),
+                }
+            )
            return f"[local-vllm error: {e!r}]"
        u = resp.usage
        if u:
            _tally()["local_prompt"] += getattr(u, "prompt_tokens", 0) or 0
            _tally()["local_completion"] += getattr(u, "completion_tokens", 0) or 0
        text = (resp.choices[0].message.content or "").strip()
-        _record_event({
-            "kind": "archon_local_gen",
-            "model": local_model,
-            "messages": messages,
-            "response": text,
-            "tokens_in": getattr(u, "prompt_tokens", 0) if u else 0,
-            "tokens_out": getattr(u, "completion_tokens", 0) if u else 0,
-            "temperature": temperature,
-            "max_tokens": max_tokens,
-            "latency_s": _time.time() - t0,
-            "ts": _time.time(),
-        })
+        _record_event(
+            {
+                "kind": "archon_local_gen",
+                "model": local_model,
+                "messages": messages,
+                "response": text,
+                "tokens_in": getattr(u, "prompt_tokens", 0) if u else 0,
+                "tokens_out": getattr(u, "completion_tokens", 0) if u else 0,
+                "temperature": temperature,
+                "max_tokens": max_tokens,
+                "latency_s": _time.time() - t0,
+                "ts": _time.time(),
+            }
+        )
        return text

    return local_gen
@@ -218,10 +229,13 @@ def _wrap_archon_cloud_generators() -> None:

    def gen_openai(model, messages, max_tokens=2048, temperature=0.7, **_kw):  # type: ignore[no-untyped-def]
        import time as _time
+
        client = _OAI()
        kwargs: Dict[str, Any] = dict(
-            model=model, messages=messages,
-            max_tokens=max_tokens, temperature=temperature,
+            model=model,
+            messages=messages,
+            max_tokens=max_tokens,
+            temperature=temperature,
        )
        # GPT-5/o1/o3 reject non-default temperature and use max_completion_tokens.
        if model.startswith(("gpt-5", "o1", "o3")):
@@ -236,20 +250,23 @@ def _wrap_archon_cloud_generators() -> None:
            _tally()["cloud_prompt"] += getattr(u, "prompt_tokens", 0) or 0
            _tally()["cloud_completion"] += getattr(u, "completion_tokens", 0) or 0
        text = (resp.choices[0].message.content or "").strip()
-        _record_event({
-            "kind": "archon_cloud_openai",
-            "model": model,
-            "messages": messages,
-            "response": text,
-            "tokens_in": getattr(u, "prompt_tokens", 0) if u else 0,
-            "tokens_out": getattr(u, "completion_tokens", 0) if u else 0,
-            "latency_s": _time.time() - t0,
-            "ts": _time.time(),
-        })
+        _record_event(
+            {
+                "kind": "archon_cloud_openai",
+                "model": model,
+                "messages": messages,
+                "response": text,
+                "tokens_in": getattr(u, "prompt_tokens", 0) if u else 0,
+                "tokens_out": getattr(u, "completion_tokens", 0) if u else 0,
+                "latency_s": _time.time() - t0,
+                "ts": _time.time(),
+            }
+        )
        return text

    def gen_anthropic(model, messages, max_tokens=2048, temperature=0.7, **_kw):  # type: ignore[no-untyped-def]
        import time as _time
+
        client = _anth.Anthropic(timeout=600.0)
        system = ""
        msgs = []
@@ -259,7 +276,10 @@ def _wrap_archon_cloud_generators() -> None:
            else:
                msgs.append(m)
        kwargs: Dict[str, Any] = dict(
-            model=model, system=system, messages=msgs, max_tokens=max_tokens,
+            model=model,
+            system=system,
+            messages=msgs,
+            max_tokens=max_tokens,
        )
        if not model.startswith(NO_TEMP_PREFIXES):
            kwargs["temperature"] = temperature
@@ -277,24 +297,27 @@ def _wrap_archon_cloud_generators() -> None:
        srv = getattr(u, "server_tool_use", None) if u else None
        n_searches = getattr(srv, "web_search_requests", 0) if srv else 0
        _tally()["n_web_searches"] += int(n_searches)
-        _record_event({
-            "kind": "archon_cloud_anthropic",
-            "model": model,
-            "system": system,
-            "messages": msgs,
-            "response": text.strip(),
-            "tokens_in": getattr(u, "input_tokens", 0) if u else 0,
-            "tokens_out": getattr(u, "output_tokens", 0) if u else 0,
-            "n_web_searches": int(n_searches),
-            "tools_declared": kwargs.get("tools"),
-            "latency_s": _time.time() - t0,
-            "ts": _time.time(),
-        })
+        _record_event(
+            {
+                "kind": "archon_cloud_anthropic",
+                "model": model,
+                "system": system,
+                "messages": msgs,
+                "response": text.strip(),
+                "tokens_in": getattr(u, "input_tokens", 0) if u else 0,
+                "tokens_out": getattr(u, "output_tokens", 0) if u else 0,
+                "n_web_searches": int(n_searches),
+                "tools_declared": kwargs.get("tools"),
+                "latency_s": _time.time() - t0,
+                "ts": _time.time(),
+            }
+        )
        return text.strip()

    from archon.completions.components.Generator import (
        GENERATE_MAP as _GMAP,  # type: ignore[import-not-found]
    )
+
    _GMAP["OpenAI_API"] = gen_openai
    _GMAP["Anthropic_API"] = gen_anthropic

@@ -330,7 +353,9 @@ def _patch_archon_prompts() -> None:
    orig = _p.make_fuser_prompt

    def patched(conv, references, critiques=None, length_control=False):  # type: ignore[no-untyped-def]
-        base = orig(conv, references, critiques=critiques, length_control=length_control)
+        base = orig(
+            conv, references, critiques=critiques, length_control=length_control
+        )
        return base + _FUSER_FORMAT_REMINDER

    patched._hybrid_format_patched = True  # type: ignore[attr-defined]
@@ -339,6 +364,7 @@ def _patch_archon_prompts() -> None:
    from archon.completions.components import (
        Fuser as _F,  # type: ignore[import-not-found]
    )
+
    _F.make_fuser_prompt = patched


@@ -354,6 +380,7 @@ def _apply_patches_once() -> None:
    _patch_anthropic_for_opus()
    # Trigger Archon imports so GENERATE_MAP exists.
    import archon.completions.components.Generator  # type: ignore[import-not-found]  # noqa: F401
+
    _wrap_archon_cloud_generators()
    _patch_archon_prompts()
    _PATCHES_APPLIED = True
@@ -361,49 +388,62 @@ def _apply_patches_once() -> None:

 # ---------- Architecture presets ----------

+
 def _presets():
    return {
        "ensemble_rank_fuse": lambda K, local_model, ranker_model, fuser_model, max_tokens, temperature: [
-            [{
-                "type": "generator",
-                "model": local_model,
-                "model_type": "vllm_local",
-                "top_k": 1,
-                "temperature": temperature,
-                "max_tokens": max_tokens,
-                "samples": K,
-            }],
-            [{
-                "type": "ranker",
-                "model": ranker_model,
-                "model_type": "Anthropic_API" if ranker_model.startswith("claude") else "OpenAI_API",
-                "top_k": min(K, 5),
-                "temperature": 0.0,
-                "max_tokens": max_tokens,
-            }],
-            [{
-                "type": "fuser",
-                "model": fuser_model,
-                "model_type": "Anthropic_API" if fuser_model.startswith("claude") else "OpenAI_API",
-                "temperature": 0.0,
-                "max_tokens": max_tokens,
-                "samples": 1,
-            }],
+            [
+                {
+                    "type": "generator",
+                    "model": local_model,
+                    "model_type": "vllm_local",
+                    "top_k": 1,
+                    "temperature": temperature,
+                    "max_tokens": max_tokens,
+                    "samples": K,
+                }
+            ],
+            [
+                {
+                    "type": "ranker",
+                    "model": ranker_model,
+                    "model_type": "Anthropic_API"
+                    if ranker_model.startswith("claude")
+                    else "OpenAI_API",
+                    "top_k": min(K, 5),
+                    "temperature": 0.0,
+                    "max_tokens": max_tokens,
+                }
+            ],
+            [
+                {
+                    "type": "fuser",
+                    "model": fuser_model,
+                    "model_type": "Anthropic_API"
+                    if fuser_model.startswith("claude")
+                    else "OpenAI_API",
+                    "temperature": 0.0,
+                    "max_tokens": max_tokens,
+                    "samples": 1,
+                }
+            ],
        ],
        # ``single_local`` honors the cfg ``max_tokens`` (passed positionally
        # like ``ensemble_rank_fuse``). Previously it hard-coded 2048, which
        # cut Qwen off mid-reasoning before it could emit the GAIA
        # ``FINAL ANSWER:`` line — the scorer then had nothing to extract.
        "single_local": lambda K, local_model, ranker_model, fuser_model, max_tokens, temperature: [
-            [{
-                "type": "generator",
-                "model": local_model,
-                "model_type": "vllm_local",
-                "top_k": 1,
-                "temperature": 0.0,
-                "max_tokens": max_tokens,
-                "samples": 1,
-            }],
+            [
+                {
+                    "type": "generator",
+                    "model": local_model,
+                    "model_type": "vllm_local",
+                    "top_k": 1,
+                    "temperature": 0.0,
+                    "max_tokens": max_tokens,
+                    "samples": 1,
+                }
+            ],
        ],
    }

@@ -464,7 +504,12 @@ class ArchonAgent(LocalCloudAgent):
        )

        layers = presets[arch](
-            K, self._local_model, ranker_model, fuser_model, max_tokens, temperature,
+            K,
+            self._local_model,
+            ranker_model,
+            fuser_model,
+            max_tokens,
+            temperature,
        )
        archon_cfg = {"name": f"hybrid-archon-{arch}", "layers": layers}

@@ -480,10 +525,12 @@ class ArchonAgent(LocalCloudAgent):
        archon = Archon(archon_cfg)

        try:
-            answer = archon.generate([
-                {"role": "system", "content": "You are a helpful assistant."},
-                {"role": "user", "content": input},
-            ])
+            answer = archon.generate(
+                [
+                    {"role": "system", "content": "You are a helpful assistant."},
+                    {"role": "user", "content": input},
+                ]
+            )
        except Exception:
            # Re-raise so the base ``run()`` / runner's ``_run_one_inner``
            # records this in the row's ``error`` field instead of stashing
@@ -518,10 +565,10 @@ class ArchonAgent(LocalCloudAgent):
            "tool_calls": int(n_searches),
            "traces": {
                "architecture": arch,
-                "n_samples":    K,
+                "n_samples": K,
                "ranker_model": ranker_model,
-                "fuser_model":  fuser_model,
-                "local_model":  self._local_model,
+                "fuser_model": fuser_model,
+                "local_model": self._local_model,
                "tokens_breakdown": dict(_tally()),
                "web_search_enabled": ws_enabled,
                "n_web_searches": n_searches,
@@ -568,26 +615,30 @@ class ArchonAgent(LocalCloudAgent):
                turn_max_tokens=turn_max_tokens,
                trace_prefix=f"archon_gen{k}",
            )
-            candidates.append({
-                "idx": k,
-                "summary": out["final_summary"],
-                "patch": out["patch"],
-                "framed": out["answer"],
-                "tokens_in": out["tokens_in"],
-                "tokens_out": out["tokens_out"],
-                "turns": out["turns"],
-            })
+            candidates.append(
+                {
+                    "idx": k,
+                    "summary": out["final_summary"],
+                    "patch": out["patch"],
+                    "framed": out["answer"],
+                    "tokens_in": out["tokens_in"],
+                    "tokens_out": out["tokens_out"],
+                    "turns": out["turns"],
+                }
+            )
            total_tokens_local += out["tokens_in"] + out["tokens_out"]
-            self.record_trace_event({
-                "kind": "archon_swe_candidate",
-                "idx": k,
-                "patch_chars": len(out["patch"]),
-                "summary": out["final_summary"],
-            })
+            self.record_trace_event(
+                {
+                    "kind": "archon_swe_candidate",
+                    "idx": k,
+                    "patch_chars": len(out["patch"]),
+                    "summary": out["final_summary"],
+                }
+            )

        # Ranker: cloud picks the best candidate.
        ranker_user = (
-            f"Issue:\n{task.get('problem_statement','')}\n\n"
+            f"Issue:\n{task.get('problem_statement', '')}\n\n"
            f"K = {K} candidate patches:\n\n"
            + "\n\n".join(
                f"=== Candidate {c['idx']} ===\nSummary: {c['summary']}\n"
@@ -615,13 +666,15 @@ class ArchonAgent(LocalCloudAgent):
            chosen_idx = 0
        chosen = candidates[chosen_idx]

-        self.record_trace_event({
-            "kind": "archon_swe_rank",
-            "chosen_idx": chosen_idx,
-            "ranker_raw": ranker_text,
-            "tokens_in": r_in,
-            "tokens_out": r_out,
-        })
+        self.record_trace_event(
+            {
+                "kind": "archon_swe_rank",
+                "chosen_idx": chosen_idx,
+                "ranker_raw": ranker_text,
+                "tokens_in": r_in,
+                "tokens_out": r_out,
+            }
+        )

        meta = {
            "tokens_local": total_tokens_local,
@@ -635,8 +688,12 @@ class ArchonAgent(LocalCloudAgent):
                "swe_mode": True,
                "K": K,
                "candidates": [
-                    {"idx": c["idx"], "summary": c["summary"],
-                     "patch_chars": len(c["patch"]), "turns": c["turns"]}
+                    {
+                        "idx": c["idx"],
+                        "summary": c["summary"],
+                        "patch_chars": len(c["patch"]),
+                        "turns": c["turns"],
+                    }
                    for c in candidates
                ],
                "chosen_idx": chosen_idx,
@@ -82,7 +82,11 @@ class BaselineCloudAgent(LocalCloudAgent):
                max_turns=int(cfg.get("swe_max_turns", 30)),
                bash_timeout=int(cfg.get("swe_bash_timeout_s", 120)),
                output_cap=int(cfg.get("swe_output_cap", 10_000)),
-                turn_max_tokens=int(cfg.get("cloud_max_tokens", default_max_output_tokens(self._cloud_model))),
+                turn_max_tokens=int(
+                    cfg.get(
+                        "cloud_max_tokens", default_max_output_tokens(self._cloud_model)
+                    )
+                ),
                trace_prefix="baseline_cloud",
            )
            meta = {
@@ -112,7 +116,11 @@ class BaselineCloudAgent(LocalCloudAgent):
            text, p_tok, c_tok, n_searches, turns = self._call_anthropic_agent(
                self._cloud_model,
                user=input,
-                max_tokens=int(cfg.get("cloud_max_tokens", default_max_output_tokens(self._cloud_model))),
+                max_tokens=int(
+                    cfg.get(
+                        "cloud_max_tokens", default_max_output_tokens(self._cloud_model)
+                    )
+                ),
                temperature=0.0,
                tools=[build_web_search_tool(ws_max_uses)],
                max_turns=gaia_max_turns,
@@ -145,17 +153,23 @@ class BaselineCloudAgent(LocalCloudAgent):
            # wired here. Skip cleanly rather than fake one. Cells that
            # want web_search must run on Anthropic until those backends
            # are wired.
-            self.record_trace_event({
-                "kind": "web_search_skipped",
-                "reason": "non_anthropic_endpoint",
-                "endpoint": self._cloud_endpoint,
-            })
+            self.record_trace_event(
+                {
+                    "kind": "web_search_skipped",
+                    "reason": "non_anthropic_endpoint",
+                    "endpoint": self._cloud_endpoint,
+                }
+            )

        # One-shot direct cloud call. GAIA only — SWE goes through the
        # mini-SWE-agent loop above (now supports anthropic/openai/gemini).
        text, p_tok, c_tok = self._call_cloud(
            user=input,
-            max_tokens=int(cfg.get("cloud_max_tokens", default_max_output_tokens(self._cloud_model))),
+            max_tokens=int(
+                cfg.get(
+                    "cloud_max_tokens", default_max_output_tokens(self._cloud_model)
+                )
+            ),
            temperature=0.0,
        )
        meta = {
@@ -89,19 +89,20 @@ CONDUCTOR_STRICTER = (
    "Your previous response was not valid JSON or was missing required fields. "
    "Reply with ONLY a single JSON object — no prose, no code fences, no commentary "
    "— containing exactly the three keys model_id (list[int]), subtasks (list[str]), "
-    "and access_list (list[list[int] or \"all\"]) of equal length, at most 5 entries, "
+    'and access_list (list[list[int] or "all"]) of equal length, at most 5 entries, '
    "and access_list[0] must be [] (an empty list)."
 )


 # ---------- Plan parsing ----------

+
 def _strip_fences(s: str) -> str:
    s = s.strip()
    if s.startswith("```"):
        first_nl = s.find("\n")
        if first_nl != -1:
-            s = s[first_nl + 1:]
+            s = s[first_nl + 1 :]
        if s.endswith("```"):
            s = s[:-3]
        s = s.strip()
@@ -119,9 +120,7 @@ def _try_literal(s: str):
    """Fallback for the paper's literal Python-list output style."""
    out = {}
    for key in ("model_id", "subtasks", "access_list"):
-        m = re.search(
-            rf"{key}\s*=\s*(\[[^\]]*\](?:\s*\+\s*\[[^\]]*\])*)", s, re.DOTALL
-        )
+        m = re.search(rf"{key}\s*=\s*(\[[^\]]*\](?:\s*\+\s*\[[^\]]*\])*)", s, re.DOTALL)
        if not m:
            return None
        try:
@@ -154,7 +153,7 @@ def _validate_plan(plan: Any, n_workers: int) -> Optional[str]:
        if a == "all":
            continue
        if not isinstance(a, list):
-            return f"access_list[{i}] must be list or \"all\""
+            return f'access_list[{i}] must be list or "all"'
        for j in a:
            if not isinstance(j, int) or not (0 <= j < i):
                return f"access_list[{i}] has bad ref {j!r}"
@@ -174,17 +173,18 @@ def _parse_plan(text: str, n_workers: int):

 # ---------- Worker pool ----------

+
 def _vllm_alive(base_url: str) -> bool:
    try:
-        with urllib.request.urlopen(
-            base_url.rstrip("/") + "/models", timeout=3
-        ) as r:
+        with urllib.request.urlopen(base_url.rstrip("/") + "/models", timeout=3) as r:
            return r.status == 200
    except Exception:
        return False


-def _default_pool(local_model: Optional[str], local_endpoint: Optional[str]) -> List[Dict[str, Any]]:
+def _default_pool(
+    local_model: Optional[str], local_endpoint: Optional[str]
+) -> List[Dict[str, Any]]:
    """Default worker pool — faithful to the Sakana Conductor paper (arXiv 2512.04388).

    The paper composes a heterogeneous 7-worker pool spanning three frontier
@@ -206,98 +206,112 @@ def _default_pool(local_model: Optional[str], local_endpoint: Optional[str]) ->
    del local_model, local_endpoint  # paper default carries no local worker
    pool: List[Dict[str, Any]] = []
    if not os.environ.get("OJ_CONDUCTOR_DISABLE_GEMINI"):
-        pool.append({
-            "id": len(pool),
-            "name": "gemini-pro",
-            "endpoint": "gemini",
-            "model": "gemini-2.5-pro",
-            "description": (
-                "Google Gemini 2.5 Pro. Frontier multimodal reasoner with a "
-                "very large context window. Strong at long-document synthesis, "
-                "multi-hop factual reasoning, and tasks that benefit from "
-                "wide retrieval. Slower and pricier than mid-tier workers."
-            ),
-        })
+        pool.append(
+            {
+                "id": len(pool),
+                "name": "gemini-pro",
+                "endpoint": "gemini",
+                "model": "gemini-2.5-pro",
+                "description": (
+                    "Google Gemini 2.5 Pro. Frontier multimodal reasoner with a "
+                    "very large context window. Strong at long-document synthesis, "
+                    "multi-hop factual reasoning, and tasks that benefit from "
+                    "wide retrieval. Slower and pricier than mid-tier workers."
+                ),
+            }
+        )
    if not os.environ.get("OJ_CONDUCTOR_DISABLE_ANTHROPIC"):
-        pool.append({
-            "id": len(pool),
-            "name": "claude-sonnet-4",
-            "endpoint": "anthropic",
-            "model": "claude-sonnet-4-6",
-            "description": (
-                "Anthropic Claude Sonnet 4. Strong general-purpose reasoner "
-                "with careful instruction following and reliable formatting. "
-                "Good default for code, structured writing, and decisive "
-                "steps where accuracy matters more than raw throughput."
-            ),
-        })
+        pool.append(
+            {
+                "id": len(pool),
+                "name": "claude-sonnet-4",
+                "endpoint": "anthropic",
+                "model": "claude-sonnet-4-6",
+                "description": (
+                    "Anthropic Claude Sonnet 4. Strong general-purpose reasoner "
+                    "with careful instruction following and reliable formatting. "
+                    "Good default for code, structured writing, and decisive "
+                    "steps where accuracy matters more than raw throughput."
+                ),
+            }
+        )
    if not os.environ.get("OJ_CONDUCTOR_DISABLE_OPENAI"):
-        pool.append({
-            "id": len(pool),
-            "name": "gpt-5",
-            "endpoint": "openai",
-            "model": "gpt-5",
-            "description": (
-                "OpenAI GPT-5. Frontier-tier broad-knowledge model. Best for "
-                "open-domain factual recall, creative generation, and "
-                "ambiguous questions where coverage matters. Expensive; use "
-                "for steps where breadth of world knowledge is the bottleneck."
-            ),
-        })
+        pool.append(
+            {
+                "id": len(pool),
+                "name": "gpt-5",
+                "endpoint": "openai",
+                "model": "gpt-5",
+                "description": (
+                    "OpenAI GPT-5. Frontier-tier broad-knowledge model. Best for "
+                    "open-domain factual recall, creative generation, and "
+                    "ambiguous questions where coverage matters. Expensive; use "
+                    "for steps where breadth of world knowledge is the bottleneck."
+                ),
+            }
+        )
    if not os.environ.get("OJ_CONDUCTOR_DISABLE_OPENROUTER"):
-        pool.append({
-            "id": len(pool),
-            "name": "deepseek-r1-distill-qwen-32b",
-            "endpoint": "openrouter",
-            "model": "deepseek/deepseek-r1-distill-qwen-32b",
-            "description": (
-                "DeepSeek R1 distilled into Qwen-32B (open weights via "
-                "OpenRouter). Specialized for chain-of-thought math, logic, "
-                "and competitive-programming-style problems. Verbose; "
-                "produces extensive reasoning traces before the final answer."
-            ),
-        })
-        pool.append({
-            "id": len(pool),
-            "name": "gemma3-27b-it",
-            "endpoint": "openrouter",
-            "model": "google/gemma-3-27b-it",
-            "description": (
-                "Google Gemma 3 27B Instruct (open weights via OpenRouter). "
-                "Mid-size instruction-tuned model. Cheap and fast; solid at "
-                "concise summarization, extraction, and short-form Q&A on "
-                "given context. Weaker than the frontier workers on multi-step "
-                "reasoning."
-            ),
-        })
-        pool.append({
-            "id": len(pool),
-            "name": "qwen3-32b",
-            "endpoint": "openrouter",
-            "model": "qwen/qwen3-32b",
-            "description": (
-                "Qwen3-32B in non-thinking mode (open weights via OpenRouter). "
-                "Fast general-purpose dialogue and instruction following. "
-                "Use when the step is straightforward generation, "
-                "summarization, or formatting — does NOT spend tokens on "
-                "internal reasoning."
-            ),
-        })
-        pool.append({
-            "id": len(pool),
-            "name": "qwen3-32b-thinking",
-            "endpoint": "openrouter",
-            "model": "qwen/qwen3-32b",
-            "extra_body": {"reasoning": {"effort": "medium"}},
-            "description": (
-                "Qwen3-32B with reasoning enabled (open weights via "
-                "OpenRouter). Same backbone as 'qwen3-32b' but spends tokens "
-                "on an internal chain of thought before answering. Stronger "
-                "on math, code, and multi-step logic; slower and consumes "
-                "more completion tokens. Prefer this for hard reasoning "
-                "steps; prefer the non-thinking variant for plain dialogue."
-            ),
-        })
+        pool.append(
+            {
+                "id": len(pool),
+                "name": "deepseek-r1-distill-qwen-32b",
+                "endpoint": "openrouter",
+                "model": "deepseek/deepseek-r1-distill-qwen-32b",
+                "description": (
+                    "DeepSeek R1 distilled into Qwen-32B (open weights via "
+                    "OpenRouter). Specialized for chain-of-thought math, logic, "
+                    "and competitive-programming-style problems. Verbose; "
+                    "produces extensive reasoning traces before the final answer."
+                ),
+            }
+        )
+        pool.append(
+            {
+                "id": len(pool),
+                "name": "gemma3-27b-it",
+                "endpoint": "openrouter",
+                "model": "google/gemma-3-27b-it",
+                "description": (
+                    "Google Gemma 3 27B Instruct (open weights via OpenRouter). "
+                    "Mid-size instruction-tuned model. Cheap and fast; solid at "
+                    "concise summarization, extraction, and short-form Q&A on "
+                    "given context. Weaker than the frontier workers on multi-step "
+                    "reasoning."
+                ),
+            }
+        )
+        pool.append(
+            {
+                "id": len(pool),
+                "name": "qwen3-32b",
+                "endpoint": "openrouter",
+                "model": "qwen/qwen3-32b",
+                "description": (
+                    "Qwen3-32B in non-thinking mode (open weights via OpenRouter). "
+                    "Fast general-purpose dialogue and instruction following. "
+                    "Use when the step is straightforward generation, "
+                    "summarization, or formatting — does NOT spend tokens on "
+                    "internal reasoning."
+                ),
+            }
+        )
+        pool.append(
+            {
+                "id": len(pool),
+                "name": "qwen3-32b-thinking",
+                "endpoint": "openrouter",
+                "model": "qwen/qwen3-32b",
+                "extra_body": {"reasoning": {"effort": "medium"}},
+                "description": (
+                    "Qwen3-32B with reasoning enabled (open weights via "
+                    "OpenRouter). Same backbone as 'qwen3-32b' but spends tokens "
+                    "on an internal chain of thought before answering. Stronger "
+                    "on math, code, and multi-step logic; slower and consumes "
+                    "more completion tokens. Prefer this for hard reasoning "
+                    "steps; prefer the non-thinking variant for plain dialogue."
+                ),
+            }
+        )
    # Reassign ids contiguously in case env-gates skipped some entries.
    for new_id, entry in enumerate(pool):
        entry["id"] = new_id
@@ -363,16 +377,17 @@ def _resolve_worker_pool(
                f"Invalid worker_pool entry [{wid_repr}]: 'id' must be an int"
            )
        if wid in seen_ids:
-            raise ValueError(
-                f"Invalid worker_pool entry [{wid}]: duplicate id"
-            )
+            raise ValueError(f"Invalid worker_pool entry [{wid}]: duplicate id")
        seen_ids.add(wid)
        if not entry.get("name") or not isinstance(entry["name"], str):
            raise ValueError(
                f"Invalid worker_pool entry [{wid}]: 'name' must be a non-empty string"
            )
        endpoint = entry.get("endpoint") or entry.get("type")
-        if not isinstance(endpoint, str) or endpoint.lower() not in _CONDUCTOR_VALID_ENDPOINTS:
+        if (
+            not isinstance(endpoint, str)
+            or endpoint.lower() not in _CONDUCTOR_VALID_ENDPOINTS
+        ):
            raise ValueError(
                f"Invalid worker_pool entry [{wid}]: 'endpoint' must be one of "
                f"{_CONDUCTOR_VALID_ENDPOINTS} (got {endpoint!r})"
@@ -466,9 +481,9 @@ def _search_capable_indices(
    if search_backend == "tavily":
        return [w["id"] for w in workers]
    return [
-        w["id"] for w in workers
-        if (w.get("endpoint") or "openai").lower()
-        in _SEARCH_CAPABLE_WORKER_ENDPOINTS
+        w["id"]
+        for w in workers
+        if (w.get("endpoint") or "openai").lower() in _SEARCH_CAPABLE_WORKER_ENDPOINTS
    ]


@@ -497,7 +512,9 @@ def _build_conductor_prompt(
    if capable:
        cap_str = ", ".join(str(i) for i in capable)
        if search_backend == "tavily":
-            capability = "External Tavily search results will be prepended to worker prompts"
+            capability = (
+                "External Tavily search results will be prepended to worker prompts"
+            )
        else:
            capability = "Only these model indices can perform live web search"
        constraint = (
@@ -687,12 +704,18 @@ def _swe_worker_step(
    ep = (worker.get("endpoint") or "openai").lower()
    if ep == "vllm":
        backbone, model, endpoint, is_local = (
-            "local", worker["model"], worker.get("base_url"), True,
+            "local",
+            worker["model"],
+            worker.get("base_url"),
+            True,
        )
        cloud_endpoint = "anthropic"  # unused on the local path
    elif ep == "anthropic":
        backbone, model, endpoint, is_local = (
-            "cloud", worker["model"], None, False,
+            "cloud",
+            worker["model"],
+            None,
+            False,
        )
        cloud_endpoint = "anthropic"
    else:
@@ -718,7 +741,11 @@ def _swe_worker_step(
    )
    return (
        out["final_summary"] or out["answer"],
-        out["tokens_in"], out["tokens_out"], is_local, 0, int(out["turns"]),
+        out["tokens_in"],
+        out["tokens_out"],
+        is_local,
+        0,
+        int(out["turns"]),
    )


@@ -819,21 +846,22 @@ class ConductorAgent(LocalCloudAgent):
        if plan is None:
            fallback_used = True
            plan = {
-                "model_id":    [len(workers) - 1],
-                "subtasks":    [question],
+                "model_id": [len(workers) - 1],
+                "subtasks": [question],
                "access_list": [[]],
            }

-        self.record_trace_event({
-            "kind": "conductor_plan",
-            "plan": plan,
-            "fallback_used": fallback_used,
-            "parse_attempts": parse_attempts,
-            "workers": [
-                {k: v for k, v in w.items() if k != "api_key"}
-                for w in workers
-            ],
-        })
+        self.record_trace_event(
+            {
+                "kind": "conductor_plan",
+                "plan": plan,
+                "fallback_used": fallback_used,
+                "parse_attempts": parse_attempts,
+                "workers": [
+                    {k: v for k, v in w.items() if k != "api_key"} for w in workers
+                ],
+            }
+        )

        # 2. Execute
        # If we're on a SWE-bench task AND cfg["swe_use_agent_loop"] is on,
@@ -867,14 +895,15 @@ class ConductorAgent(LocalCloudAgent):
        # constraint — reuse them here.
        if ws_enabled and search_backend != "tavily" and not swe_mode:
            search_workers = [
-                w for w in workers
+                w
+                for w in workers
                if (w.get("endpoint") or "openai").lower()
                in _SEARCH_CAPABLE_WORKER_ENDPOINTS
            ]
            if not search_workers:
-                endpoints = sorted({
-                    (w.get("endpoint") or "openai").lower() for w in workers
-                })
+                endpoints = sorted(
+                    {(w.get("endpoint") or "openai").lower() for w in workers}
+                )
                raise ValueError(
                    f"web_search.enabled=true but the worker pool has no "
                    f"search-capable worker (endpoints present: {endpoints}); "
@@ -885,39 +914,43 @@ class ConductorAgent(LocalCloudAgent):
                )
        # ``ws_tool`` doubles as the enable marker passed to `_call_worker`
        # (truthy => route search-capable workers through their agent loop).
-        ws_tool = (
-            build_web_search_tool(ws_max_uses) if ws_enabled else None
-        )
+        ws_tool = build_web_search_tool(ws_max_uses) if ws_enabled else None

        try:
            if swe_mode:
-                shared_workdir = Path(tempfile.mkdtemp(
-                    prefix=f"conductor-swe-{task_meta.get('task_id','x')}-"
-                ))
+                shared_workdir = Path(
+                    tempfile.mkdtemp(
+                        prefix=f"conductor-swe-{task_meta.get('task_id', 'x')}-"
+                    )
+                )
                _clone_repo(task_meta["repo"], task_meta["base_commit"], shared_workdir)
-                self.record_trace_event({
-                    "kind": "conductor_swe_workdir",
-                    "workdir": str(shared_workdir),
-                    "repo": task_meta["repo"],
-                    "base_commit": task_meta["base_commit"],
-                })
+                self.record_trace_event(
+                    {
+                        "kind": "conductor_swe_workdir",
+                        "workdir": str(shared_workdir),
+                        "repo": task_meta["repo"],
+                        "base_commit": task_meta["base_commit"],
+                    }
+                )

            for i, (mid, subtask, access) in enumerate(
                zip(plan["model_id"], plan["subtasks"], plan["access_list"])
            ):
                worker = workers[mid]
                prompt = _build_step_prompt(question, subtask, steps, access)
-                self.record_trace_event({
-                    "kind": "conductor_step_dispatch",
-                    "step_idx": i,
-                    "worker_id": mid,
-                    "worker_name": worker["name"],
-                    "worker_model": worker["model"],
-                    "subtask": subtask,
-                    "access": access,
-                    "prompt": prompt,
-                    "swe_mode": swe_mode,
-                })
+                self.record_trace_event(
+                    {
+                        "kind": "conductor_step_dispatch",
+                        "step_idx": i,
+                        "worker_id": mid,
+                        "worker_name": worker["name"],
+                        "worker_model": worker["model"],
+                        "subtask": subtask,
+                        "access": access,
+                        "prompt": prompt,
+                        "swe_mode": swe_mode,
+                    }
+                )

                worker_ep = (worker.get("endpoint") or "openai").lower()
                # Post-hoc routing check: if web_search is on but the
@@ -926,38 +959,49 @@ class ConductorAgent(LocalCloudAgent):
                # may legitimately not need search; see Task-3 planner
                # constraint that tries to prevent this upfront).
                if (
-                    ws_enabled and search_backend != "tavily" and not swe_mode
+                    ws_enabled
+                    and search_backend != "tavily"
+                    and not swe_mode
                    and worker_ep not in _SEARCH_CAPABLE_WORKER_ENDPOINTS
                ):
-                    self.record_trace_event({
-                        "kind": "conductor_search_routing_warning",
-                        "step_idx": i,
-                        "worker_id": mid,
-                        "worker_name": worker["name"],
-                        "worker_endpoint": worker_ep,
-                        "warning": (
-                            f"web_search enabled but step {i} routed to "
-                            f"search-incapable worker {worker['name']!r} "
-                            f"(endpoint {worker_ep!r}); this step cannot "
-                            "ground and may answer blind."
-                        ),
-                    })
+                    self.record_trace_event(
+                        {
+                            "kind": "conductor_search_routing_warning",
+                            "step_idx": i,
+                            "worker_id": mid,
+                            "worker_name": worker["name"],
+                            "worker_endpoint": worker_ep,
+                            "warning": (
+                                f"web_search enabled but step {i} routed to "
+                                f"search-incapable worker {worker['name']!r} "
+                                f"(endpoint {worker_ep!r}); this step cannot "
+                                "ground and may answer blind."
+                            ),
+                        }
+                    )

                extra_cost = 0.0
                if swe_mode:
                    text, w_in, w_out, is_local, n_searches, bash_turns = (
                        _swe_worker_step(
-                            worker, task_meta, prompt, cfg, shared_workdir, i,
+                            worker,
+                            task_meta,
+                            prompt,
+                            cfg,
+                            shared_workdir,
+                            i,
                        )
                    )
                    tool_calls += bash_turns
                else:
-                    (
-                        text, w_in, w_out, is_local, n_searches, extra_cost
-                    ) = _call_worker(
-                        worker, prompt, cfg,
-                        web_search_tool=ws_tool,
-                        web_search_max_uses=ws_max_uses,
+                    (text, w_in, w_out, is_local, n_searches, extra_cost) = (
+                        _call_worker(
+                            worker,
+                            prompt,
+                            cfg,
+                            web_search_tool=ws_tool,
+                            web_search_max_uses=ws_max_uses,
+                        )
                    )

                if is_local:
@@ -971,17 +1015,19 @@ class ConductorAgent(LocalCloudAgent):
                    cost += extra_cost
                n_web_searches_total += n_searches
                tool_calls += n_searches
-                steps.append({
-                    "step_idx": i,
-                    "model_id": mid,
-                    "worker_name": worker["name"],
-                    "worker_model": worker["model"],
-                    "subtask": subtask,
-                    "access": access,
-                    "output": text,
-                    "tokens_in": w_in,
-                    "tokens_out": w_out,
-                })
+                steps.append(
+                    {
+                        "step_idx": i,
+                        "model_id": mid,
+                        "worker_name": worker["name"],
+                        "worker_model": worker["model"],
+                        "subtask": subtask,
+                        "access": access,
+                        "output": text,
+                        "tokens_in": w_in,
+                        "tokens_out": w_out,
+                    }
+                )
                final_answer = text

            # For SWE mode, the authoritative patch is whatever lives in
@@ -992,7 +1038,8 @@ class ConductorAgent(LocalCloudAgent):
                if patch.strip():
                    final_answer = (
                        f"{final_answer}\n\n```diff\n{patch}```"
-                        if final_answer else f"```diff\n{patch}```"
+                        if final_answer
+                        else f"```diff\n{patch}```"
                    )
        finally:
            if shared_workdir is not None:
@@ -1003,8 +1050,7 @@ class ConductorAgent(LocalCloudAgent):
        tokens_cloud += conductor_p_in + conductor_p_out

        traces = [
-            (s["step_idx"], s["model_id"], s["subtask"], s["output"])
-            for s in steps
+            (s["step_idx"], s["model_id"], s["subtask"], s["output"]) for s in steps
        ]

        meta = {
@@ -1023,8 +1069,7 @@ class ConductorAgent(LocalCloudAgent):
                "n_web_searches": n_web_searches_total,
                "parse_attempts": parse_attempts,
                "workers": [
-                    {k: v for k, v in w.items() if k != "api_key"}
-                    for w in workers
+                    {k: v for k, v in w.items() if k != "api_key"} for w in workers
                ],
            },
        }
@@ -172,11 +172,16 @@ def _clone_repo(repo: str, base_commit: str, dest: Path) -> None:
    url = f"https://github.com/{repo}.git"
    subprocess.run(
        ["git", "clone", "--quiet", url, str(dest)],
-        check=True, timeout=300, capture_output=True,
+        check=True,
+        timeout=300,
+        capture_output=True,
    )
    subprocess.run(
        ["git", "checkout", "--quiet", base_commit],
-        cwd=str(dest), check=True, timeout=120, capture_output=True,
+        cwd=str(dest),
+        check=True,
+        timeout=120,
+        capture_output=True,
    )


@@ -265,10 +270,14 @@ def _run_bash(
    stderr = _decode_bash_output(stderr_b, exit_code)
    truncated = False
    if len(stdout) > output_cap:
-        stdout = stdout[:output_cap] + f"\n…[+{len(stdout) - output_cap} chars truncated]"
+        stdout = (
+            stdout[:output_cap] + f"\n…[+{len(stdout) - output_cap} chars truncated]"
+        )
        truncated = True
    if len(stderr) > output_cap:
-        stderr = stderr[:output_cap] + f"\n…[+{len(stderr) - output_cap} chars truncated]"
+        stderr = (
+            stderr[:output_cap] + f"\n…[+{len(stderr) - output_cap} chars truncated]"
+        )
        truncated = True
    return {
        "stdout": stdout,
@@ -297,7 +306,10 @@ def _extract_diff(workdir: Path) -> str:
    """``git diff`` against the base commit — the final SWE-bench patch."""
    proc = subprocess.run(
        ["git", "diff", "--no-color"],
-        cwd=str(workdir), capture_output=True, text=True, timeout=60,
+        cwd=str(workdir),
+        capture_output=True,
+        text=True,
+        timeout=60,
    )
    return proc.stdout

@@ -320,10 +332,11 @@ def _anthropic_assistant_block(block: Any) -> Dict[str, Any]:

 # ---------- Reusable agent-loop entry point ----------

+
 def run_swe_agent_loop(
    task: Dict[str, Any],
    *,
-    backbone: str,                          # "cloud" or "local"
+    backbone: str,  # "cloud" or "local"
    backbone_model: str,
    cloud_endpoint: str = "anthropic",
    local_endpoint: Optional[str] = None,
@@ -387,32 +400,33 @@ def run_swe_agent_loop(

    own_workdir = workdir is None
    if own_workdir:
-        workdir = Path(tempfile.mkdtemp(
-            prefix=f"mini-swe-{task.get('task_id','x')}-"
-        ))
+        workdir = Path(tempfile.mkdtemp(prefix=f"mini-swe-{task.get('task_id', 'x')}-"))
        try:
            _clone_repo(repo, base_commit, workdir)
        except Exception:
            shutil.rmtree(workdir, ignore_errors=True)
            raise

-    _record_event({
-        "kind": f"{trace_prefix}_setup",
-        "repo": repo,
-        "base_commit": base_commit,
-        "workdir": str(workdir),
-        "owns_workdir": own_workdir,
-        "backbone": backbone,
-        "backbone_model": backbone_model,
-        "ts": time.time(),
-    })
+    _record_event(
+        {
+            "kind": f"{trace_prefix}_setup",
+            "repo": repo,
+            "base_commit": base_commit,
+            "workdir": str(workdir),
+            "owns_workdir": own_workdir,
+            "backbone": backbone,
+            "backbone_model": backbone_model,
+            "ts": time.time(),
+        }
+    )

    user_prompt = initial_prompt or task.get("problem_statement") or ""

    try:
        if backbone == "cloud":
            result = _loop_cloud(
-                user_prompt, workdir,
+                user_prompt,
+                workdir,
                model=backbone_model,
                cloud_endpoint=cloud_endpoint,
                max_turns=max_turns,
@@ -423,9 +437,12 @@ def run_swe_agent_loop(
            )
        elif backbone == "local":
            if not local_endpoint:
-                raise ValueError("run_swe_agent_loop(backbone='local') needs local_endpoint")
+                raise ValueError(
+                    "run_swe_agent_loop(backbone='local') needs local_endpoint"
+                )
            result = _loop_local(
-                user_prompt, workdir,
+                user_prompt,
+                workdir,
                model=backbone_model,
                endpoint=local_endpoint,
                max_turns=max_turns,
@@ -440,7 +457,7 @@ def run_swe_agent_loop(
            raise ValueError(f"unsupported backbone: {backbone!r}")

        patch = _extract_diff(workdir)
-        framed = (result["final_summary"] or "[mini-swe-agent produced no summary text]")
+        framed = result["final_summary"] or "[mini-swe-agent produced no summary text]"
        if patch.strip():
            framed = f"{framed}\n\n```diff\n{patch}```"

@@ -450,11 +467,16 @@ def run_swe_agent_loop(
            "final_summary": result["final_summary"],
            "tokens_in": result["tokens_in"],
            "tokens_out": result["tokens_out"],
-            "tokens_local": result["tokens_in"] + result["tokens_out"] if backbone == "local" else 0,
-            "tokens_cloud": result["tokens_in"] + result["tokens_out"] if backbone == "cloud" else 0,
+            "tokens_local": result["tokens_in"] + result["tokens_out"]
+            if backbone == "local"
+            else 0,
+            "tokens_cloud": result["tokens_in"] + result["tokens_out"]
+            if backbone == "cloud"
+            else 0,
            "cost_usd": (
                estimate_cost(backbone_model, result["tokens_in"], result["tokens_out"])
-                if backbone == "cloud" else 0.0
+                if backbone == "cloud"
+                else 0.0
            ),
            "turns": result["turns"],
            "max_turns_hit": result["max_turns_hit"],
@@ -467,6 +489,7 @@ def run_swe_agent_loop(

 # ---------- Cloud loop (dispatcher → per-endpoint multi-turn tool loops) ----------

+
 def _loop_cloud(
    problem: str,
    workdir: Path,
@@ -485,24 +508,36 @@ def _loop_cloud(
    to unblock the 8 SWE cells that were stuck on Anthropic-only support."""
    if cloud_endpoint == "anthropic":
        return _loop_cloud_anthropic(
-            problem, workdir,
-            model=model, max_turns=max_turns,
-            bash_timeout=bash_timeout, output_cap=output_cap,
-            turn_max_tokens=turn_max_tokens, trace_prefix=trace_prefix,
+            problem,
+            workdir,
+            model=model,
+            max_turns=max_turns,
+            bash_timeout=bash_timeout,
+            output_cap=output_cap,
+            turn_max_tokens=turn_max_tokens,
+            trace_prefix=trace_prefix,
        )
    if cloud_endpoint == "openai":
        return _loop_cloud_openai(
-            problem, workdir,
-            model=model, max_turns=max_turns,
-            bash_timeout=bash_timeout, output_cap=output_cap,
-            turn_max_tokens=turn_max_tokens, trace_prefix=trace_prefix,
+            problem,
+            workdir,
+            model=model,
+            max_turns=max_turns,
+            bash_timeout=bash_timeout,
+            output_cap=output_cap,
+            turn_max_tokens=turn_max_tokens,
+            trace_prefix=trace_prefix,
        )
    if cloud_endpoint == "gemini":
        return _loop_cloud_gemini(
-            problem, workdir,
-            model=model, max_turns=max_turns,
-            bash_timeout=bash_timeout, output_cap=output_cap,
-            turn_max_tokens=turn_max_tokens, trace_prefix=trace_prefix,
+            problem,
+            workdir,
+            model=model,
+            max_turns=max_turns,
+            bash_timeout=bash_timeout,
+            output_cap=output_cap,
+            turn_max_tokens=turn_max_tokens,
+            trace_prefix=trace_prefix,
        )
    raise ValueError(
        f"mini-SWE-agent cloud backbone unsupported endpoint: {cloud_endpoint!r}"
@@ -521,6 +556,7 @@ def _loop_cloud_anthropic(
    trace_prefix: str,
 ) -> Dict[str, Any]:
    import anthropic
+
    client = anthropic.Anthropic(timeout=600.0, max_retries=5)
    messages: List[Dict[str, Any]] = [{"role": "user", "content": problem}]

@@ -553,30 +589,39 @@ def _loop_cloud_anthropic(
            btype = getattr(block, "type", None)
            if btype == "tool_use":
                tool_uses.append((block.id, block.name, dict(block.input or {})))
-                content_blocks.append({
-                    "type": "tool_use", "id": block.id, "name": block.name,
-                    "input": dict(block.input or {}),
-                })
+                content_blocks.append(
+                    {
+                        "type": "tool_use",
+                        "id": block.id,
+                        "name": block.name,
+                        "input": dict(block.input or {}),
+                    }
+                )
            elif hasattr(block, "text"):
                text_parts.append(block.text)
                content_blocks.append({"type": "text", "text": block.text})
            else:
                content_blocks.append({"type": btype or "unknown"})

-        _record_event({
-            "kind": f"{trace_prefix}_turn",
-            "turn": turn,
-            "stop_reason": msg.stop_reason,
-            "tokens_in": msg.usage.input_tokens,
-            "tokens_out": msg.usage.output_tokens,
-            "latency_s": latency,
-            "content_blocks": content_blocks,
-            "ts": time.time(),
-        })
+        _record_event(
+            {
+                "kind": f"{trace_prefix}_turn",
+                "turn": turn,
+                "stop_reason": msg.stop_reason,
+                "tokens_in": msg.usage.input_tokens,
+                "tokens_out": msg.usage.output_tokens,
+                "latency_s": latency,
+                "content_blocks": content_blocks,
+                "ts": time.time(),
+            }
+        )

-        messages.append({"role": "assistant", "content": [
-            _anthropic_assistant_block(b) for b in msg.content
-        ]})
+        messages.append(
+            {
+                "role": "assistant",
+                "content": [_anthropic_assistant_block(b) for b in msg.content],
+            }
+        )

        if not tool_uses:
            final_text = "\n".join(text_parts).strip()
@@ -586,28 +631,40 @@ def _loop_cloud_anthropic(
        for tu_id, tu_name, tu_input in tool_uses:
            if tu_name != "bash":
                obs = f"unknown tool: {tu_name!r}"
-                _record_event({
-                    "kind": f"{trace_prefix}_unknown_tool",
-                    "turn": turn, "name": tu_name, "input": tu_input,
-                    "ts": time.time(),
-                })
+                _record_event(
+                    {
+                        "kind": f"{trace_prefix}_unknown_tool",
+                        "turn": turn,
+                        "name": tu_name,
+                        "input": tu_input,
+                        "ts": time.time(),
+                    }
+                )
            else:
                command = str(tu_input.get("command", ""))
                result = _run_bash(
-                    command, workdir,
-                    timeout=bash_timeout, output_cap=output_cap,
+                    command,
+                    workdir,
+                    timeout=bash_timeout,
+                    output_cap=output_cap,
+                )
+                _record_event(
+                    {
+                        "kind": f"{trace_prefix}_bash",
+                        "turn": turn,
+                        "command": command,
+                        **result,
+                        "ts": time.time(),
+                    }
                )
-                _record_event({
-                    "kind": f"{trace_prefix}_bash",
-                    "turn": turn, "command": command,
-                    **result, "ts": time.time(),
-                })
                obs = _format_observation(result)
-            tool_result_blocks.append({
-                "type": "tool_result",
-                "tool_use_id": tu_id,
-                "content": obs,
-            })
+            tool_result_blocks.append(
+                {
+                    "type": "tool_result",
+                    "tool_use_id": tu_id,
+                    "content": obs,
+                }
+            )
        messages.append({"role": "user", "content": tool_result_blocks})

    return {
@@ -621,6 +678,7 @@ def _loop_cloud_anthropic(

 # ---------- Cloud loop (OpenAI multi-turn with function tools) ----------

+
 def _loop_cloud_openai(
    problem: str,
    workdir: Path,
@@ -646,6 +704,7 @@ def _loop_cloud_openai(
      ``_loop_local`` behavior).
    """
    from openai import OpenAI
+
    client = OpenAI(timeout=600.0)

    messages: List[Dict[str, Any]] = [
@@ -681,21 +740,27 @@ def _loop_cloud_openai(
        tool_calls = list(getattr(message, "tool_calls", None) or [])
        text = message.content or ""

-        _record_event({
-            "kind": f"{trace_prefix}_turn",
-            "turn": turn,
-            "endpoint": "openai",
-            "finish_reason": choice.finish_reason,
-            "tokens_in": getattr(u, "prompt_tokens", 0) if u else 0,
-            "tokens_out": getattr(u, "completion_tokens", 0) if u else 0,
-            "latency_s": latency,
-            "text": text,
-            "tool_calls": [
-                {"id": tc.id, "name": tc.function.name, "arguments": tc.function.arguments}
-                for tc in tool_calls
-            ],
-            "ts": time.time(),
-        })
+        _record_event(
+            {
+                "kind": f"{trace_prefix}_turn",
+                "turn": turn,
+                "endpoint": "openai",
+                "finish_reason": choice.finish_reason,
+                "tokens_in": getattr(u, "prompt_tokens", 0) if u else 0,
+                "tokens_out": getattr(u, "completion_tokens", 0) if u else 0,
+                "latency_s": latency,
+                "text": text,
+                "tool_calls": [
+                    {
+                        "id": tc.id,
+                        "name": tc.function.name,
+                        "arguments": tc.function.arguments,
+                    }
+                    for tc in tool_calls
+                ],
+                "ts": time.time(),
+            }
+        )

        # Append the assistant turn (including any tool_calls) so the
        # follow-up tool messages have the right call ids to reference.
@@ -711,7 +776,8 @@ def _loop_cloud_openai(
        if tool_calls:
            assistant_msg["tool_calls"] = [
                {
-                    "id": tc.id, "type": "function",
+                    "id": tc.id,
+                    "type": "function",
                    "function": {
                        "name": tc.function.name,
                        "arguments": tc.function.arguments,
@@ -734,21 +800,26 @@ def _loop_cloud_openai(
                and not text.strip()
                and turn < max_turns
            ):
-                messages.append({
-                    "role": "user",
-                    "content": (
-                        "Your previous response was truncated by the token limit "
-                        "before producing a tool call or final summary. Retry: "
-                        "either issue ONE bash tool call (short command, no large "
-                        "output) or send a brief one-line final summary with no "
-                        "tool calls to end the loop."
-                    ),
-                })
-                _record_event({
-                    "kind": f"{trace_prefix}_recover",
-                    "turn": turn, "reason": "length_truncation_no_tool_call",
-                    "ts": time.time(),
-                })
+                messages.append(
+                    {
+                        "role": "user",
+                        "content": (
+                            "Your previous response was truncated by the token limit "
+                            "before producing a tool call or final summary. Retry: "
+                            "either issue ONE bash tool call (short command, no large "
+                            "output) or send a brief one-line final summary with no "
+                            "tool calls to end the loop."
+                        ),
+                    }
+                )
+                _record_event(
+                    {
+                        "kind": f"{trace_prefix}_recover",
+                        "turn": turn,
+                        "reason": "length_truncation_no_tool_call",
+                        "ts": time.time(),
+                    }
+                )
                continue
            # No tool call → the model is done. Same termination rule as
            # the Anthropic branch.
@@ -762,28 +833,40 @@ def _loop_cloud_openai(
                args = {}
            if tc.function.name != "bash":
                obs = f"unknown tool: {tc.function.name!r}"
-                _record_event({
-                    "kind": f"{trace_prefix}_unknown_tool",
-                    "turn": turn, "name": tc.function.name, "input": args,
-                    "ts": time.time(),
-                })
+                _record_event(
+                    {
+                        "kind": f"{trace_prefix}_unknown_tool",
+                        "turn": turn,
+                        "name": tc.function.name,
+                        "input": args,
+                        "ts": time.time(),
+                    }
+                )
            else:
                command = str(args.get("command", ""))
                result = _run_bash(
-                    command, workdir,
-                    timeout=bash_timeout, output_cap=output_cap,
+                    command,
+                    workdir,
+                    timeout=bash_timeout,
+                    output_cap=output_cap,
+                )
+                _record_event(
+                    {
+                        "kind": f"{trace_prefix}_bash",
+                        "turn": turn,
+                        "command": command,
+                        **result,
+                        "ts": time.time(),
+                    }
                )
-                _record_event({
-                    "kind": f"{trace_prefix}_bash",
-                    "turn": turn, "command": command,
-                    **result, "ts": time.time(),
-                })
                obs = _format_observation(result)
-            messages.append({
-                "role": "tool",
-                "tool_call_id": tc.id,
-                "content": obs,
-            })
+            messages.append(
+                {
+                    "role": "tool",
+                    "tool_call_id": tc.id,
+                    "content": obs,
+                }
+            )

    return {
        "tokens_in": tokens_in,
@@ -796,6 +879,7 @@ def _loop_cloud_openai(

 # ---------- Cloud loop (Gemini multi-turn with function tools) ----------

+
 def _loop_cloud_gemini(
    problem: str,
    workdir: Path,
@@ -831,13 +915,15 @@ def _loop_cloud_gemini(
    from google.genai import types

    client = genai.Client(http_options=types.HttpOptions(timeout=600_000))
-    bash_tool = types.Tool(function_declarations=[
-        types.FunctionDeclaration(
-            name="bash",
-            description=BASH_TOOL_ANTHROPIC["description"],
-            parameters=BASH_TOOL_GEMINI_PARAMETERS,
-        ),
-    ])
+    bash_tool = types.Tool(
+        function_declarations=[
+            types.FunctionDeclaration(
+                name="bash",
+                description=BASH_TOOL_ANTHROPIC["description"],
+                parameters=BASH_TOOL_GEMINI_PARAMETERS,
+            ),
+        ]
+    )

    contents: List[types.Content] = [
        types.Content(role="user", parts=[types.Part(text=problem)]),
@@ -859,7 +945,9 @@ def _loop_cloud_gemini(
        )
        t0 = time.time()
        resp = client.models.generate_content(
-            model=model, contents=contents, config=cfg,
+            model=model,
+            contents=contents,
+            config=cfg,
        )
        _bump_cloud_calls()
        latency = time.time() - t0
@@ -896,21 +984,22 @@ def _loop_cloud_gemini(
        except Exception:
            pass

-        _record_event({
-            "kind": f"{trace_prefix}_turn",
-            "turn": turn,
-            "endpoint": "gemini",
-            "finish_reason": finish_reason,
-            "tokens_in": p,
-            "tokens_out": c,
-            "latency_s": latency,
-            "text": "\n".join(text_parts),
-            "tool_calls": [
-                {"name": name, "arguments": args}
-                for name, args in function_calls
-            ],
-            "ts": time.time(),
-        })
+        _record_event(
+            {
+                "kind": f"{trace_prefix}_turn",
+                "turn": turn,
+                "endpoint": "gemini",
+                "finish_reason": finish_reason,
+                "tokens_in": p,
+                "tokens_out": c,
+                "latency_s": latency,
+                "text": "\n".join(text_parts),
+                "tool_calls": [
+                    {"name": name, "arguments": args} for name, args in function_calls
+                ],
+                "ts": time.time(),
+            }
+        )

        # Append the model's content as-is so the next turn sees its own
        # prior function_call parts (Gemini requires this for the
@@ -934,28 +1023,37 @@ def _loop_cloud_gemini(
            # treat genuine ``STOP`` with text as a final answer.
            fr_str = str(finish_reason or "")
            empty_text = not any(t.strip() for t in text_parts)
-            recoverable = empty_text and turn < max_turns and (
-                "MALFORMED_FUNCTION_CALL" in fr_str
-                or "MAX_TOKENS" in fr_str
+            recoverable = (
+                empty_text
+                and turn < max_turns
+                and ("MALFORMED_FUNCTION_CALL" in fr_str or "MAX_TOKENS" in fr_str)
            )
            if recoverable:
-                contents.append(types.Content(
-                    role="user",
-                    parts=[types.Part(text=(
-                        "Your previous response had no parsable function call "
-                        "and no final text (finish_reason="
-                        f"{fr_str}). Retry: either issue ONE well-formed "
-                        "`bash` function call (short command, valid JSON-ish "
-                        "args) or send a brief final text message with no "
-                        "function call to end the loop."
-                    ))],
-                ))
-                _record_event({
-                    "kind": f"{trace_prefix}_recover",
-                    "turn": turn,
-                    "reason": f"empty_response_{fr_str}",
-                    "ts": time.time(),
-                })
+                contents.append(
+                    types.Content(
+                        role="user",
+                        parts=[
+                            types.Part(
+                                text=(
+                                    "Your previous response had no parsable function call "
+                                    "and no final text (finish_reason="
+                                    f"{fr_str}). Retry: either issue ONE well-formed "
+                                    "`bash` function call (short command, valid JSON-ish "
+                                    "args) or send a brief final text message with no "
+                                    "function call to end the loop."
+                                )
+                            )
+                        ],
+                    )
+                )
+                _record_event(
+                    {
+                        "kind": f"{trace_prefix}_recover",
+                        "turn": turn,
+                        "reason": f"empty_response_{fr_str}",
+                        "ts": time.time(),
+                    }
+                )
                continue
            final_text = "\n".join(text_parts).strip()
            break
@@ -964,26 +1062,39 @@ def _loop_cloud_gemini(
        for name, args in function_calls:
            if name != "bash":
                obs = f"unknown tool: {name!r}"
-                _record_event({
-                    "kind": f"{trace_prefix}_unknown_tool",
-                    "turn": turn, "name": name, "input": args,
-                    "ts": time.time(),
-                })
+                _record_event(
+                    {
+                        "kind": f"{trace_prefix}_unknown_tool",
+                        "turn": turn,
+                        "name": name,
+                        "input": args,
+                        "ts": time.time(),
+                    }
+                )
            else:
                command = str(args.get("command", ""))
                result = _run_bash(
-                    command, workdir,
-                    timeout=bash_timeout, output_cap=output_cap,
+                    command,
+                    workdir,
+                    timeout=bash_timeout,
+                    output_cap=output_cap,
+                )
+                _record_event(
+                    {
+                        "kind": f"{trace_prefix}_bash",
+                        "turn": turn,
+                        "command": command,
+                        **result,
+                        "ts": time.time(),
+                    }
                )
-                _record_event({
-                    "kind": f"{trace_prefix}_bash",
-                    "turn": turn, "command": command,
-                    **result, "ts": time.time(),
-                })
                obs = _format_observation(result)
-            response_parts.append(types.Part.from_function_response(
-                name=name, response={"output": obs},
-            ))
+            response_parts.append(
+                types.Part.from_function_response(
+                    name=name,
+                    response={"output": obs},
+                )
+            )
        contents.append(types.Content(role="user", parts=response_parts))

    return {
@@ -1013,10 +1124,14 @@ def _get_tiktoken_enc() -> Any:
        return _TIKTOKEN_ENC
    try:
        import tiktoken
+
        _TIKTOKEN_ENC = tiktoken.get_encoding("cl100k_base")
    except Exception as exc:
        if not _TIKTOKEN_WARNED:
-            print(f"[mini_swe_agent] tiktoken unavailable ({exc!r}); falling back to len(s)//4", flush=True)
+            print(
+                f"[mini_swe_agent] tiktoken unavailable ({exc!r}); falling back to len(s)//4",
+                flush=True,
+            )
            _TIKTOKEN_WARNED = True
        _TIKTOKEN_ENC = False
    return _TIKTOKEN_ENC
@@ -1038,7 +1153,7 @@ def _estimate_prompt_tokens(messages: List[Dict[str, Any]]) -> int:
            s = "\n".join(parts)
        else:
            s = ""
-        for tc in (m.get("tool_calls") or []):
+        for tc in m.get("tool_calls") or []:
            try:
                s += "\n" + (tc["function"]["arguments"] or "")
                s += "\n" + (tc["function"].get("name") or "")
@@ -1119,7 +1234,7 @@ def _compact_local_messages(
    before_tokens = _estimate_prompt_tokens(messages)
    new_messages: List[Dict[str, Any]] = list(messages)
    n_tool_elided = 0
-    for (s, e) in old_turns:
+    for s, e in old_turns:
        for k in range(s, e):
            m = new_messages[k]
            if m.get("role") != "tool":
@@ -1140,17 +1255,19 @@ def _compact_local_messages(
            n_tool_elided += 1

    after_stage1_tokens = _estimate_prompt_tokens(new_messages)
-    _record_event({
-        "kind": f"{trace_prefix}_compact",
-        "stage": "1",
-        "msgs_before": len(messages),
-        "msgs_after": len(new_messages),
-        "before_tokens": before_tokens,
-        "after_tokens": after_stage1_tokens,
-        "n_tool_elided": n_tool_elided,
-        "n_turns_folded": 0,
-        "ts": time.time(),
-    })
+    _record_event(
+        {
+            "kind": f"{trace_prefix}_compact",
+            "stage": "1",
+            "msgs_before": len(messages),
+            "msgs_after": len(new_messages),
+            "before_tokens": before_tokens,
+            "after_tokens": after_stage1_tokens,
+            "n_tool_elided": n_tool_elided,
+            "n_turns_folded": 0,
+            "ts": time.time(),
+        }
+    )

    if after_stage1_tokens <= compact_at_tokens:
        return new_messages
@@ -1163,12 +1280,21 @@ def _compact_local_messages(

    summary_input = [
        {"role": "system", "content": _COMPACT_PROMPT},
-        {"role": "user", "content": json.dumps(
-            [{"role": m.get("role"),
-              "content": m.get("content") if isinstance(m.get("content"), str) else str(m.get("content"))[:4000]}
-             for m in middle],
-            default=str,
-        )[:60_000]},
+        {
+            "role": "user",
+            "content": json.dumps(
+                [
+                    {
+                        "role": m.get("role"),
+                        "content": m.get("content")
+                        if isinstance(m.get("content"), str)
+                        else str(m.get("content"))[:4000],
+                    }
+                    for m in middle
+                ],
+                default=str,
+            )[:60_000],
+        },
    ]
    summary = ""
    try:
@@ -1194,18 +1320,20 @@ def _compact_local_messages(
    }
    folded = [system_msg, initial_user, synthetic, *tail]
    after_stage2_tokens = _estimate_prompt_tokens(folded)
-    _record_event({
-        "kind": f"{trace_prefix}_compact",
-        "stage": "2",
-        "msgs_before": len(new_messages),
-        "msgs_after": len(folded),
-        "before_tokens": after_stage1_tokens,
-        "after_tokens": after_stage2_tokens,
-        "n_tool_elided": n_tool_elided,
-        "n_turns_folded": n_turns_folded,
-        "summary_chars": len(summary),
-        "ts": time.time(),
-    })
+    _record_event(
+        {
+            "kind": f"{trace_prefix}_compact",
+            "stage": "2",
+            "msgs_before": len(new_messages),
+            "msgs_after": len(folded),
+            "before_tokens": after_stage1_tokens,
+            "after_tokens": after_stage2_tokens,
+            "n_tool_elided": n_tool_elided,
+            "n_turns_folded": n_turns_folded,
+            "summary_chars": len(summary),
+            "ts": time.time(),
+        }
+    )
    return folded


@@ -1231,6 +1359,7 @@ def _loop_local(
    # but still saw 28k-input 400s on the n=100 SWE sweep (the keep window
    # alone routinely exceeded the budget once bash outputs piled up).
    from openai import OpenAI
+
    client = OpenAI(base_url=endpoint, api_key="EMPTY", timeout=600.0)

    messages: List[Dict[str, Any]] = [
@@ -1243,10 +1372,16 @@ def _loop_local(
    turns = 0
    for turn in range(1, max_turns + 1):
        turns = turn
-        if compact_at_tokens > 0 and _estimate_prompt_tokens(messages) > compact_at_tokens:
+        if (
+            compact_at_tokens > 0
+            and _estimate_prompt_tokens(messages) > compact_at_tokens
+        ):
            messages = _compact_local_messages(
-                messages, client=client, model=model,
-                keep_last=compact_keep_last, trace_prefix=trace_prefix,
+                messages,
+                client=client,
+                model=model,
+                keep_last=compact_keep_last,
+                trace_prefix=trace_prefix,
                compact_at_tokens=compact_at_tokens,
            )
        t0 = time.time()
@@ -1268,23 +1403,27 @@ def _loop_local(
            # server walled the call. Compact aggressively (keep_last=1)
            # and retry once. Re-raise on anything else or on a second
            # failure — the runner records the row as errored.
+            from openjarvis.engine._base import looks_like_context_length_error
+
            msg = str(exc)
-            is_ctx = (
-                "maximum context length" in msg
-                or "context length" in msg.lower() and "exceed" in msg.lower()
-            )
+            is_ctx = looks_like_context_length_error(msg)
            if not is_ctx:
                raise
-            _record_event({
-                "kind": f"{trace_prefix}_emergency_compact",
-                "turn": turn,
-                "error": msg[:300],
-                "tokens_before": _estimate_prompt_tokens(messages),
-                "ts": time.time(),
-            })
+            _record_event(
+                {
+                    "kind": f"{trace_prefix}_emergency_compact",
+                    "turn": turn,
+                    "error": msg[:300],
+                    "tokens_before": _estimate_prompt_tokens(messages),
+                    "ts": time.time(),
+                }
+            )
            messages = _compact_local_messages(
-                messages, client=client, model=model,
-                keep_last=1, trace_prefix=trace_prefix,
+                messages,
+                client=client,
+                model=model,
+                keep_last=1,
+                trace_prefix=trace_prefix,
                compact_at_tokens=max(8_000, compact_at_tokens // 2),
            )
            resp = client.chat.completions.create(
@@ -1306,20 +1445,26 @@ def _loop_local(
        tool_calls = list(getattr(message, "tool_calls", None) or [])
        text = message.content or ""

-        _record_event({
-            "kind": f"{trace_prefix}_turn",
-            "turn": turn,
-            "finish_reason": choice.finish_reason,
-            "tokens_in": getattr(u, "prompt_tokens", 0) if u else 0,
-            "tokens_out": getattr(u, "completion_tokens", 0) if u else 0,
-            "latency_s": latency,
-            "text": text,
-            "tool_calls": [
-                {"id": tc.id, "name": tc.function.name, "arguments": tc.function.arguments}
-                for tc in tool_calls
-            ],
-            "ts": time.time(),
-        })
+        _record_event(
+            {
+                "kind": f"{trace_prefix}_turn",
+                "turn": turn,
+                "finish_reason": choice.finish_reason,
+                "tokens_in": getattr(u, "prompt_tokens", 0) if u else 0,
+                "tokens_out": getattr(u, "completion_tokens", 0) if u else 0,
+                "latency_s": latency,
+                "text": text,
+                "tool_calls": [
+                    {
+                        "id": tc.id,
+                        "name": tc.function.name,
+                        "arguments": tc.function.arguments,
+                    }
+                    for tc in tool_calls
+                ],
+                "ts": time.time(),
+            }
+        )

        # Match the OpenAI cloud branch: content="" (not None) when only
        # tool_calls are present; omit ``tool_calls`` entirely when there
@@ -1333,7 +1478,8 @@ def _loop_local(
        if tool_calls:
            assistant_local_msg["tool_calls"] = [
                {
-                    "id": tc.id, "type": "function",
+                    "id": tc.id,
+                    "type": "function",
                    "function": {
                        "name": tc.function.name,
                        "arguments": tc.function.arguments,
@@ -1357,20 +1503,28 @@ def _loop_local(
            else:
                command = str(args.get("command", ""))
                result = _run_bash(
-                    command, workdir,
-                    timeout=bash_timeout, output_cap=output_cap,
+                    command,
+                    workdir,
+                    timeout=bash_timeout,
+                    output_cap=output_cap,
+                )
+                _record_event(
+                    {
+                        "kind": f"{trace_prefix}_bash",
+                        "turn": turn,
+                        "command": command,
+                        **result,
+                        "ts": time.time(),
+                    }
                )
-                _record_event({
-                    "kind": f"{trace_prefix}_bash",
-                    "turn": turn, "command": command,
-                    **result, "ts": time.time(),
-                })
                obs = _format_observation(result)
-            messages.append({
-                "role": "tool",
-                "tool_call_id": tc.id,
-                "content": obs,
-            })
+            messages.append(
+                {
+                    "role": "tool",
+                    "tool_call_id": tc.id,
+                    "content": obs,
+                }
+            )

    return {
        "tokens_in": tokens_in,
@@ -1383,6 +1537,7 @@ def _loop_local(

 # ---------- Standalone agent ----------

+
@AgentRegistry.register("mini_swe_agent")
 class MiniSWEAgent(LocalCloudAgent):
    """Single-model bash-loop agent for SWE-bench-shaped tasks.
@@ -1410,10 +1565,7 @@ class MiniSWEAgent(LocalCloudAgent):
            task = context.metadata.get("task") or {}

        backbone = cfg.get("backbone", "cloud")
-        model = (
-            self._cloud_model if backbone == "cloud"
-            else (self._local_model or "")
-        )
+        model = self._cloud_model if backbone == "cloud" else (self._local_model or "")

        out = run_swe_agent_loop(
            task,
@@ -87,7 +87,7 @@ MINIONS_FIRST_TURN_SCHEMA = {
            "type": "object",
            "properties": {
                "reasoning": {"type": "string"},
-                "message":   {"type": "string"},
+                "message": {"type": "string"},
            },
            "required": ["reasoning", "message"],
            "additionalProperties": False,
@@ -104,7 +104,7 @@ MINIONS_CONVERSATION_SCHEMA = {
                    "type": "object",
                    "properties": {
                        "decision": {"const": "request_additional_info"},
-                        "message":  {"type": "string"},
+                        "message": {"type": "string"},
                    },
                    "required": ["decision", "message"],
                    "additionalProperties": False,
@@ -113,7 +113,7 @@ MINIONS_CONVERSATION_SCHEMA = {
                    "type": "object",
                    "properties": {
                        "decision": {"const": "provide_final_answer"},
-                        "answer":   {"type": "string"},
+                        "answer": {"type": "string"},
                    },
                    "required": ["decision", "answer"],
                    "additionalProperties": False,
@@ -126,8 +126,8 @@ MINIONS_CONVERSATION_SCHEMA = {
 # Markers from Minions's supervisor prompts (prompts/minion.py). Any one
 # being present in the call's messages/system is a strong Minions signal.
 MINIONS_PROMPT_MARKERS = (
-    "small language model that has read",   # SUPERVISOR_INITIAL_PROMPT
-    "provide_final_answer",                  # SUPERVISOR_CONVERSATION_PROMPT
+    "small language model that has read",  # SUPERVISOR_INITIAL_PROMPT
+    "provide_final_answer",  # SUPERVISOR_CONVERSATION_PROMPT
    "request_additional_info",
 )

@@ -171,6 +171,7 @@ def _stub_missing_imports() -> None:
    """
    try:
        import mistralai
+
        if not hasattr(mistralai, "Mistral"):
            mistralai.Mistral = type("Mistral", (), {})  # type: ignore[attr-defined]
    except ImportError:
@@ -215,12 +216,12 @@ def _patch_anthropic_globally() -> None:
                model = kwargs.get("model", "")
                if model.startswith(NO_TEMP_PREFIXES):
                    kwargs.pop("temperature", None)
-                    if (
-                        "output_config" not in kwargs
-                        and _looks_like_minions_call(kwargs)
+                    if "output_config" not in kwargs and _looks_like_minions_call(
+                        kwargs
                    ):
                        kwargs["output_config"] = _minions_turn_schema(kwargs)
                return orig(self, **kwargs)
+
            patched._hybrid_patched = True  # type: ignore[attr-defined]
            return patched

@@ -358,6 +359,7 @@ def _apply_patches_once() -> None:

 # ---------- Pre-fetch helper (GAIA only) ----------

+
 def _prefetch_context(
    question: str,
    cloud_endpoint: str,
@@ -376,7 +378,10 @@ def _prefetch_context(
    and zeros — the protocol still runs.
    """
    out: Dict[str, Any] = {
-        "text": "", "tokens": 0, "cost_usd": 0.0, "n_searches": 0,
+        "text": "",
+        "tokens": 0,
+        "cost_usd": 0.0,
+        "n_searches": 0,
    }
    if search_backend == "tavily":
        try:
@@ -412,10 +417,12 @@ def _prefetch_context(
            tool_choice={"type": "any"},
        )
        from openjarvis.agents.hybrid._prices import cost as _cost_usd
+
        out.update(
            text=text,
            tokens=p + c,
-            cost_usd=_cost_usd(cloud_model, p, c) + n_searches * WEB_SEARCH_COST_PER_CALL,
+            cost_usd=_cost_usd(cloud_model, p, c)
+            + n_searches * WEB_SEARCH_COST_PER_CALL,
            n_searches=n_searches,
        )
    except Exception as e:
@@ -423,9 +430,7 @@ def _prefetch_context(
    return out


-def _context_for(
-    task: Optional[Dict[str, Any]], prefetched: str = ""
-) -> List[str]:
+def _context_for(task: Optional[Dict[str, Any]], prefetched: str = "") -> List[str]:
    """Minions wants a context list."""
    bits: List[str] = []
    task = task or {}
@@ -440,6 +445,7 @@ def _context_for(

 # ---------- Main agent ----------

+
@AgentRegistry.register("minions")
 class MinionsAgent(LocalCloudAgent):
    """HazyResearch Minions supervisor/worker protocol. See module docstring."""
@@ -451,6 +457,7 @@ class MinionsAgent(LocalCloudAgent):
        # 400/529, KeyError on missing schema fields.
        try:
            import anthropic
+
            if isinstance(exc, anthropic.BadRequestError):
                return f"{type(exc).__name__}: {str(exc)[:120]}"
        except Exception:
@@ -518,8 +525,7 @@ class MinionsAgent(LocalCloudAgent):
            local=True,
        )
        cloud_max_tokens = int(
-            cfg.get("cloud_max_tokens")
-            or default_max_output_tokens(self._cloud_model)
+            cfg.get("cloud_max_tokens") or default_max_output_tokens(self._cloud_model)
        )
        if self._cloud_endpoint == "openai":
            cloud_client = OpenAIClient(
@@ -566,9 +572,14 @@ class MinionsAgent(LocalCloudAgent):
        #   - enabled = false  → prefetch OFF
        #   - enabled = true   → prefetch ON (honors max_uses)
        prefetch: Dict[str, Any] = {
-            "text": "", "tokens": 0, "cost_usd": 0.0, "n_searches": 0,
+            "text": "",
+            "tokens": 0,
+            "cost_usd": 0.0,
+            "n_searches": 0,
        }
-        ws_block = cfg.get("web_search") if isinstance(cfg.get("web_search"), dict) else None
+        ws_block = (
+            cfg.get("web_search") if isinstance(cfg.get("web_search"), dict) else None
+        )
        ws_enabled, ws_max_uses = web_search_cfg(cfg)
        # If the cell explicitly set web_search.enabled = false, honor that.
        # If it set web_search.enabled = true, honor max_uses. If it didn't
@@ -588,14 +599,16 @@ class MinionsAgent(LocalCloudAgent):
            )

        if prefetch.get("text"):
-            self.record_trace_event({
-                "kind": "minions_prefetch",
-                "n_searches": prefetch["n_searches"],
-                "tokens": prefetch["tokens"],
-                "cost_usd": prefetch["cost_usd"],
-                "text": prefetch["text"],
-                "error": prefetch.get("error"),
-            })
+            self.record_trace_event(
+                {
+                    "kind": "minions_prefetch",
+                    "n_searches": prefetch["n_searches"],
+                    "tokens": prefetch["tokens"],
+                    "cost_usd": prefetch["cost_usd"],
+                    "text": prefetch["text"],
+                    "error": prefetch.get("error"),
+                }
+            )

        out = protocol(
            task=input,  # full formatted prompt (with bench instruction)
@@ -607,15 +620,17 @@ class MinionsAgent(LocalCloudAgent):
        # The Minions library doesn't go through our SDK helpers, so the
        # auto-trace missed every turn. Record the protocol output directly —
        # supervisor_messages + worker_messages contain the full conversation.
-        self.record_trace_event({
-            "kind": "minions_protocol",
-            "mode": mode,
-            "supervisor_messages": out.get("supervisor_messages"),
-            "worker_messages": out.get("worker_messages"),
-            "timing": out.get("timing"),
-            "log_file": out.get("log_file"),
-            "final_answer": out.get("final_answer", ""),
-        })
+        self.record_trace_event(
+            {
+                "kind": "minions_protocol",
+                "mode": mode,
+                "supervisor_messages": out.get("supervisor_messages"),
+                "worker_messages": out.get("worker_messages"),
+                "timing": out.get("timing"),
+                "log_file": out.get("log_file"),
+                "final_answer": out.get("final_answer", ""),
+            }
+        )

        local_usage = out.get("local_usage")
        remote_usage = out.get("remote_usage")
@@ -650,7 +665,6 @@ class MinionsAgent(LocalCloudAgent):
        }
        return out.get("final_answer", ""), meta

-
    # ------------------------------------------------------------------
    # SWE-bench variant
    # ------------------------------------------------------------------
@@ -668,21 +682,23 @@ class MinionsAgent(LocalCloudAgent):
        # 1. Cloud supervisor writes a high-level plan (no tools).
        plan_text, p_in, p_out = self._call_cloud(
            user=(
-                f"Issue:\n{task.get('problem_statement','')}\n\n"
-                f"Repo: {task.get('repo','')}\n"
-                f"Base commit: {task.get('base_commit','')}\n\n"
-                f"{task.get('hints_text','')}"
+                f"Issue:\n{task.get('problem_statement', '')}\n\n"
+                f"Repo: {task.get('repo', '')}\n"
+                f"Base commit: {task.get('base_commit', '')}\n\n"
+                f"{task.get('hints_text', '')}"
            ),
            system=MINIONS_SWE_PLANNER_SYS,
            max_tokens=int(cfg.get("supervisor_max_tokens", 1024)),
            temperature=0.0,
        )
-        self.record_trace_event({
-            "kind": "minions_swe_plan",
-            "plan": plan_text,
-            "tokens_in": p_in,
-            "tokens_out": p_out,
-        })
+        self.record_trace_event(
+            {
+                "kind": "minions_swe_plan",
+                "plan": plan_text,
+                "tokens_in": p_in,
+                "tokens_out": p_out,
+            }
+        )
        supervisor_cost = self.cost_usd(self._cloud_model, p_in, p_out)

        # 2. Local worker runs mini-SWE-agent with the plan as context.
@@ -47,33 +47,33 @@ from openjarvis.core.registry import AgentRegistry
 # would seed before any oracle update.

 SKILL_CATALOG: Dict[str, str] = {
-    "factual_recall":     "Recall named entities, dates, places, well-known facts from training data without external lookup.",
+    "factual_recall": "Recall named entities, dates, places, well-known facts from training data without external lookup.",
    "multi_step_reasoning": "Chain several inference steps together (e.g. compose dates, traverse relationships, decompose then aggregate).",
-    "arithmetic":         "Exact numeric computation on values already given in the question.",
-    "web_grounding":      "Question needs information likely NOT in a small model's parametric memory (rare facts, recent events, niche sources).",
+    "arithmetic": "Exact numeric computation on values already given in the question.",
+    "web_grounding": "Question needs information likely NOT in a small model's parametric memory (rare facts, recent events, niche sources).",
    "long_text_extraction": "Read a long supplied document/context and extract a specific piece.",
-    "format_compliance":  "Strict output formatting (e.g. GAIA's `FINAL ANSWER: <answer>` rule, comma-separated lists with no units).",
-    "code_or_logic":      "Write or trace code, or apply logical/symbolic constraints precisely.",
+    "format_compliance": "Strict output formatting (e.g. GAIA's `FINAL ANSWER: <answer>` rule, comma-separated lists with no units).",
+    "code_or_logic": "Write or trace code, or apply logical/symbolic constraints precisely.",
 }

 DEFAULT_AGENT_COMPETENCE: Dict[str, Dict[str, float]] = {
    "local-qwen-27b": {
-        "factual_recall":       0.25,
+        "factual_recall": 0.25,
        "multi_step_reasoning": 0.30,
-        "arithmetic":           0.55,
-        "web_grounding":        0.10,
+        "arithmetic": 0.55,
+        "web_grounding": 0.10,
        "long_text_extraction": 0.55,
-        "format_compliance":    0.65,
-        "code_or_logic":        0.45,
+        "format_compliance": 0.65,
+        "code_or_logic": 0.45,
    },
    "cloud-opus-4-7": {
-        "factual_recall":       0.85,
+        "factual_recall": 0.85,
        "multi_step_reasoning": 0.88,
-        "arithmetic":           0.85,
-        "web_grounding":        0.70,
+        "arithmetic": 0.85,
+        "web_grounding": 0.70,
        "long_text_extraction": 0.90,
-        "format_compliance":    0.92,
-        "code_or_logic":        0.90,
+        "format_compliance": 0.92,
+        "code_or_logic": 0.90,
    },
 }

@@ -189,9 +189,7 @@ def _score_agents(
    lam = 0.5
    scores: Dict[str, Dict[str, float]] = {}
    for aid, comps in competence.items():
-        comp = sum(
-            skill_weights.get(sid, 0.0) * comps[sid] for sid in SKILL_CATALOG
-        )
+        comp = sum(skill_weights.get(sid, 0.0) * comps[sid] for sid in SKILL_CATALOG)
        cost_pen = lam * cost.get(aid, 0.0)
        scores[aid] = {
            "competence": comp,
@@ -313,14 +311,16 @@ class SkillOrchestraAgent(LocalCloudAgent):
        if chosen not in competence:
            chosen = max(scored, key=lambda a: scored[a]["final_score"])

-        self.record_trace_event({
-            "kind": "skillorchestra_route",
-            "chosen_agent": chosen,
-            "skill_weights": skill_weights,
-            "agent_scores": scored,
-            "reasoning": decision.get("reasoning", ""),
-            "router_raw": router_text,
-        })
+        self.record_trace_event(
+            {
+                "kind": "skillorchestra_route",
+                "chosen_agent": chosen,
+                "skill_weights": skill_weights,
+                "agent_scores": scored,
+                "reasoning": decision.get("reasoning", ""),
+                "router_raw": router_text,
+            }
+        )

        tokens_local = 0
        tokens_cloud = r_in + r_out
@@ -41,8 +41,12 @@ from .orchestrator import run_orchestrator
 from .stage_router import StageSkillHandbook

 _VALID_STRATEGIES = {
-    "none", "router_decides", "analyze_model_decide",
-    "weighted_avg", "weakest_skill", "strongest_skill",
+    "none",
+    "router_decides",
+    "analyze_model_decide",
+    "weighted_avg",
+    "weakest_skill",
+    "strongest_skill",
 }


@@ -146,7 +150,11 @@ class SkillOrchestraAgent(LocalCloudAgent):
            strategy = "none"

        return run_orchestrator(
-            self, input, cfg=cfg, handbook=handbook, strategy=strategy,
+            self,
+            input,
+            cfg=cfg,
+            handbook=handbook,
+            strategy=strategy,
        )


@@ -58,6 +58,7 @@ _STAGE_DEFAULT_ALIAS = {
 # Orchestrator decision step (raw SDK — needs tool_use blocks back)
 # ---------------------------------------------------------------------------

+
 def _orchestrate_step(
    agent: Any,
    *,
@@ -126,9 +127,7 @@ def _orchestrate_step(
        from google import genai
        from google.genai import types

-        client = genai.Client(
-            http_options=types.HttpOptions(timeout=600_000)
-        )
+        client = genai.Client(http_options=types.HttpOptions(timeout=600_000))
        cfg = types.GenerateContentConfig(
            temperature=1.0,
            max_output_tokens=max_tokens,
@@ -169,16 +168,18 @@ def _orchestrate_step(
        )

    cost = agent.cost_usd(model, p, c)
-    agent.record_trace_event({
-        "kind": "skillorchestra_orchestrate",
-        "model": model,
-        "endpoint": endpoint,
-        "prompt": user,
-        "response": text,
-        "tool_calls": tool_calls,
-        "tokens_in": p,
-        "tokens_out": c,
-    })
+    agent.record_trace_event(
+        {
+            "kind": "skillorchestra_orchestrate",
+            "model": model,
+            "endpoint": endpoint,
+            "prompt": user,
+            "response": text,
+            "tool_calls": tool_calls,
+            "tokens_in": p,
+            "tokens_out": c,
+        }
+    )
    return text, tool_calls, p, c, cost


@@ -186,6 +187,7 @@ def _orchestrate_step(
 # Context assembly  —  eval_frames.py:1305-1351
 # ---------------------------------------------------------------------------

+
 def _build_context(
    doc_list: List[Tuple[str, str]],
    code_list: List[Tuple[str, str]],
@@ -223,6 +225,7 @@ def _build_context(
 # Main loop  —  eval_frames.py:run_single
 # ---------------------------------------------------------------------------

+
 def run_orchestrator(
    agent: Any,
    problem: str,
@@ -245,12 +248,14 @@ def run_orchestrator(
    # MODEL_NAME). Defaults to the cell's cloud model when that endpoint
    # supports tool calls, else Opus. ``router_model`` / ``router_endpoint``
    # are accepted as back-compat aliases (pre-restructure cfg key names).
-    orch_endpoint = (cfg.get("orchestrator_endpoint")
-                     or cfg.get("router_endpoint")
-                     or agent._cloud_endpoint).lower()
-    orch_model = (cfg.get("orchestrator_model")
-                  or cfg.get("router_model")
-                  or agent._cloud_model)
+    orch_endpoint = (
+        cfg.get("orchestrator_endpoint")
+        or cfg.get("router_endpoint")
+        or agent._cloud_endpoint
+    ).lower()
+    orch_model = (
+        cfg.get("orchestrator_model") or cfg.get("router_model") or agent._cloud_model
+    )
    if orch_endpoint not in ("anthropic", "openai", "gemini"):
        orch_endpoint, orch_model = "anthropic", "claude-opus-4-7"
    orch_max_tokens = int(cfg.get("orchestrator_max_tokens", 4096))
@@ -281,7 +286,9 @@ def run_orchestrator(
        if handbook is not None and strategy != "none":
            sa = parse_skill_analysis(orch_text)
            rr = get_routing_strategy(strategy, handbook).select_model(
-                stage, sa, tool_call_model=tool_alias,
+                stage,
+                sa,
+                tool_call_model=tool_alias,
            )
            return rr.model_alias
        return tool_alias or _STAGE_DEFAULT_ALIAS[stage]
@@ -290,7 +297,10 @@ def run_orchestrator(
        used_rounds = step + 1
        is_last = step == max_rounds - 1
        context_str = _build_context(
-            doc_list, code_list, attempt_list, char_cap=char_cap,
+            doc_list,
+            code_list,
+            attempt_list,
+            char_cap=char_cap,
        )

        if handbook is not None and strategy != "none":
@@ -301,14 +311,14 @@ def run_orchestrator(
                handbook=handbook,
            )
        else:
-            user = (
-                f"Problem: {problem}\n\n{context_str}\n\n"
-                "Choose an appropriate tool."
-            )
+            user = f"Problem: {problem}\n\n{context_str}\n\nChoose an appropriate tool."

        text, tcalls, p, c, ocost = _orchestrate_step(
-            agent, user=user, model=orch_model,
-            endpoint=orch_endpoint, max_tokens=orch_max_tokens,
+            agent,
+            user=user,
+            model=orch_model,
+            endpoint=orch_endpoint,
+            max_tokens=orch_max_tokens,
        )
        tokens_cloud += p + c
        cost_usd += ocost
@@ -337,23 +347,29 @@ def run_orchestrator(
            tool_alias = (tc.get("input") or {}).get("model")
            stage = _TOOL_STAGE.get(tool, "answer")
            chosen_alias = _route(stage, tool_alias, text)
-            spec: ModelSpec = pool.get(chosen_alias) or pool[
-                _STAGE_DEFAULT_ALIAS[stage]
-            ]
-            route_log.append({
-                "step": step,
-                "tool": tool,
-                "orchestrator_alias": tool_alias,
-                "routed_alias": chosen_alias,
-                "routed_model": spec.model,
-                "is_local": spec.is_local,
-            })
+            spec: ModelSpec = (
+                pool.get(chosen_alias) or pool[_STAGE_DEFAULT_ALIAS[stage]]
+            )
+            route_log.append(
+                {
+                    "step": step,
+                    "tool": tool,
+                    "orchestrator_alias": tool_alias,
+                    "routed_alias": chosen_alias,
+                    "routed_model": spec.model,
+                    "is_local": spec.is_local,
+                }
+            )
            tool_calls_n += 1

            if tool == "search":
                res = run_search(
-                    agent, spec, context_str=context_str, problem=problem,
-                    retriever_url=retriever_url, web_search_max_uses=ws_max_uses,
+                    agent,
+                    spec,
+                    context_str=context_str,
+                    problem=problem,
+                    retriever_url=retriever_url,
+                    web_search_max_uses=ws_max_uses,
                    search_backend=search_backend,
                    tavily_max_results=tavily_max_results,
                )
@@ -363,13 +379,19 @@ def run_orchestrator(
                web_uses += res.get("web_search_uses", 0)
            elif tool in ("enhance_reasoning", "code"):
                res = run_code(
-                    agent, spec, context_str=context_str, problem=problem,
+                    agent,
+                    spec,
+                    context_str=context_str,
+                    problem=problem,
                    bash_timeout_s=code_timeout,
                )
                code_list.append((res["generated_code"], res["exec_result"]))
            else:  # answer
                res = run_answer(
-                    agent, spec, context_str=context_str, problem=problem,
+                    agent,
+                    spec,
+                    context_str=context_str,
+                    problem=problem,
                    max_tokens=answer_max_tokens,
                )
                final_pred = res["pred"]
@@ -385,12 +407,14 @@ def run_orchestrator(
        if finish:
            break

-    agent.record_trace_event({
-        "kind": "skillorchestra_route_log",
-        "strategy": strategy,
-        "rounds_used": used_rounds,
-        "routes": route_log,
-    })
+    agent.record_trace_event(
+        {
+            "kind": "skillorchestra_route_log",
+            "strategy": strategy,
+            "rounds_used": used_rounds,
+            "routes": route_log,
+        }
+    )

    meta = {
        "tokens_local": tokens_local,
@@ -32,8 +32,14 @@ from typing import Any, Dict, List, Optional, Tuple
 STAGE_ALIASES: Dict[str, List[str]] = {
    "search": ["search-1", "search-2", "search-3"],
    "reasoning": ["reasoner-1", "reasoner-2", "reasoner-3"],
-    "answer": ["answer-1", "answer-2", "answer-3", "answer-4",
-               "answer-math-1", "answer-math-2"],
+    "answer": [
+        "answer-1",
+        "answer-2",
+        "answer-3",
+        "answer-4",
+        "answer-math-1",
+        "answer-math-2",
+    ],
 }

 # Every alias the orchestrator can emit, flat.
@@ -42,9 +48,13 @@ ALL_ALIASES: List[str] = [a for aliases in STAGE_ALIASES.values() for a in alias
 # Default tier: which aliases collapse onto the cloud model vs the local
 # model. Dearer ``-1``/``-2`` (+ answer-math-1) -> cloud; cheaper -> local.
 _CLOUD_ALIASES = {
-    "search-1", "search-2",
-    "reasoner-1", "reasoner-2",
-    "answer-1", "answer-2", "answer-math-1",
+    "search-1",
+    "search-2",
+    "reasoner-1",
+    "reasoner-2",
+    "answer-1",
+    "answer-2",
+    "answer-math-1",
 }


@@ -54,8 +64,8 @@ class ModelSpec:

    alias: str
    model: str
-    endpoint: str          # "anthropic" | "openai" | "gemini" | "http://..."
-    kind: str              # "cloud" | "local"
+    endpoint: str  # "anthropic" | "openai" | "gemini" | "http://..."
+    kind: str  # "cloud" | "local"

    @property
    def is_local(self) -> bool:
@@ -87,7 +97,10 @@ def build_pool(
            pool[alias] = ModelSpec(alias, cloud_model, cloud_endpoint, "cloud")
        else:
            pool[alias] = ModelSpec(
-                alias, local_model, local_endpoint, "local"  # type: ignore[arg-type]
+                alias,
+                local_model,
+                local_endpoint,
+                "local",  # type: ignore[arg-type]
            )

    for alias, spec in (overrides or {}).items():
@@ -133,18 +146,30 @@ def call_alias(
    ep = spec.endpoint.lower()
    if ep == "anthropic":
        text, p, c, _ = agent._call_anthropic(
-            spec.model, user=user, system=system,
-            max_tokens=max_tokens, temperature=temperature, trace_role="cloud",
+            spec.model,
+            user=user,
+            system=system,
+            max_tokens=max_tokens,
+            temperature=temperature,
+            trace_role="cloud",
        )
    elif ep == "openai":
        text, p, c = agent._call_openai(
-            spec.model, user=user, system=system,
-            max_tokens=max_tokens, temperature=temperature, trace_role="cloud",
+            spec.model,
+            user=user,
+            system=system,
+            max_tokens=max_tokens,
+            temperature=temperature,
+            trace_role="cloud",
        )
    elif ep == "gemini":
        text, p, c = agent._call_gemini(
-            spec.model, user=user, system=system,
-            max_tokens=max_tokens, temperature=temperature, trace_role="cloud",
+            spec.model,
+            user=user,
+            system=system,
+            max_tokens=max_tokens,
+            temperature=temperature,
+            trace_role="cloud",
        )
    else:
        raise ValueError(f"unsupported pool endpoint: {spec.endpoint!r}")
@@ -94,7 +94,12 @@ class StageSkillHandbook:
            "answer": {},
        }
        self.model_profiles: Dict[str, ModelProfile] = {}
-        self.usage_patterns: Dict[str, Any] = {"stages": {}, "guidelines": {}, "models": {}, "raw": {}}
+        self.usage_patterns: Dict[str, Any] = {
+            "stages": {},
+            "guidelines": {},
+            "models": {},
+            "raw": {},
+        }
        self.routing_insights: List[str] = []
        self.learning_history: List[Dict[str, Any]] = []
        self.version = "1.0.0"
@@ -102,7 +107,10 @@ class StageSkillHandbook:
        self.updated_at = ""

    def get_model_skill_scores(self) -> Dict[str, Dict[str, float]]:
-        return {alias: profile.skill_scores for alias, profile in self.model_profiles.items()}
+        return {
+            alias: profile.skill_scores
+            for alias, profile in self.model_profiles.items()
+        }

    def get_models_for_stage(self, stage: str) -> List[ModelProfile]:
        return [p for p in self.model_profiles.values() if p.stage == stage]
@@ -135,19 +143,29 @@ class StageSkillHandbook:

    def format_model_performance(self, stage: str) -> str:
        profiles = self.get_models_for_stage(stage)
-        valid_prefixes = {"search": ["search-"], "code": ["reasoner-", "code-"], "answer": ["answer-"]}
+        valid_prefixes = {
+            "search": ["search-"],
+            "code": ["reasoner-", "code-"],
+            "answer": ["answer-"],
+        }
        prefixes = valid_prefixes.get(stage, [])

        lines = []
        for p in profiles:
            if not any(p.model_alias.startswith(prefix) for prefix in prefixes):
                continue
-            has_data = (p.skill_scores and len(p.skill_scores) > 0) or p.strengths or p.weaknesses
+            has_data = (
+                (p.skill_scores and len(p.skill_scores) > 0)
+                or p.strengths
+                or p.weaknesses
+            )
            if p.total_attempts > 0 or has_data:
                lines.append(f"\n### {p.model_alias} ({p.actual_model})")
                if p.total_attempts > 0:
                    rate = p.total_successes / p.total_attempts
-                    lines.append(f"Overall: {rate:.0%} success ({p.total_successes}/{p.total_attempts})")
+                    lines.append(
+                        f"Overall: {rate:.0%} success ({p.total_successes}/{p.total_attempts})"
+                    )
                else:
                    lines.append("Overall: 0% overall")
                if p.skill_scores:
@@ -157,7 +175,9 @@ class StageSkillHandbook:
                        for sid, s in p.skill_scores.items()
                        if (sid.split(".")[0] if "." in sid else sid) in ("code", stage)
                    }
-                    for skill_id, score in sorted(stage_skill_scores.items(), key=lambda x: x[1], reverse=True):
+                    for skill_id, score in sorted(
+                        stage_skill_scores.items(), key=lambda x: x[1], reverse=True
+                    ):
                        lines.append(f"  - {skill_id}: {score:.0%}")
                if p.strengths:
                    lines.append(f"Strengths: {', '.join(p.strengths[:3])}")
@@ -220,7 +240,9 @@ def parse_skill_analysis(output: str) -> Optional[SkillAnalysis]:
    try:
        data = json.loads(match.group(1).strip())
        required_skills = [
-            SkillWeight(skill_id=s.get("skill_id", ""), percentage=float(s.get("percentage", 0)))
+            SkillWeight(
+                skill_id=s.get("skill_id", ""), percentage=float(s.get("percentage", 0))
+            )
            for s in data.get("required_skills", [])
        ]
        return SkillAnalysis(
@@ -272,7 +294,14 @@ class RoutingStrategy:
        if stage == "reasoning":
            return ["reasoner-1", "reasoner-2", "reasoner-3"]
        if stage == "answer":
-            return ["answer-1", "answer-2", "answer-3", "answer-4", "answer-math-1", "answer-math-2"]
+            return [
+                "answer-1",
+                "answer-2",
+                "answer-3",
+                "answer-4",
+                "answer-math-1",
+                "answer-math-2",
+            ]
        return []

    def select_model(
@@ -292,9 +321,17 @@ class RouterDecidesStrategy(RoutingStrategy):
        tool_call_model: Optional[str] = None,
    ) -> ModelRoutingResult:
        if tool_call_model:
-            return ModelRoutingResult(tool_call_model, "router_decides_from_tool_call", 1.0)
-        defaults = {"search": "search-1", "reasoning": "reasoner-1", "answer": "answer-1"}
-        return ModelRoutingResult(defaults.get(stage, "answer-1"), "router_decides_fallback", 0.5)
+            return ModelRoutingResult(
+                tool_call_model, "router_decides_from_tool_call", 1.0
+            )
+        defaults = {
+            "search": "search-1",
+            "reasoning": "reasoner-1",
+            "answer": "answer-1",
+        }
+        return ModelRoutingResult(
+            defaults.get(stage, "answer-1"), "router_decides_fallback", 0.5
+        )


 class AnalyzeModelDecideStrategy(RoutingStrategy):
@@ -305,17 +342,33 @@ class AnalyzeModelDecideStrategy(RoutingStrategy):
        tool_call_model: Optional[str] = None,
    ) -> ModelRoutingResult:
        if tool_call_model:
-            return ModelRoutingResult(tool_call_model, "analyze_model_decide_with_skill_analysis", 1.0)
-        defaults = {"search": "search-1", "reasoning": "reasoner-1", "answer": "answer-1"}
-        return ModelRoutingResult(defaults.get(stage, "answer-1"), "analyze_model_decide_fallback", 0.5)
+            return ModelRoutingResult(
+                tool_call_model, "analyze_model_decide_with_skill_analysis", 1.0
+            )
+        defaults = {
+            "search": "search-1",
+            "reasoning": "reasoner-1",
+            "answer": "answer-1",
+        }
+        return ModelRoutingResult(
+            defaults.get(stage, "answer-1"), "analyze_model_decide_fallback", 0.5
+        )


 class WeightedAverageStrategy(RoutingStrategy):
    COST_TIERS = {
-        "search-3": 1, "search-2": 2, "search-1": 3,
-        "reasoner-3": 1, "reasoner-2": 2, "reasoner-1": 3,
-        "answer-math-2": 1, "answer-4": 1, "answer-3": 2,
-        "answer-math-1": 2, "answer-2": 3, "answer-1": 4,
+        "search-3": 1,
+        "search-2": 2,
+        "search-1": 3,
+        "reasoner-3": 1,
+        "reasoner-2": 2,
+        "reasoner-1": 3,
+        "answer-math-2": 1,
+        "answer-4": 1,
+        "answer-3": 2,
+        "answer-math-1": 2,
+        "answer-2": 3,
+        "answer-1": 4,
    }

    def select_model(
@@ -326,9 +379,17 @@ class WeightedAverageStrategy(RoutingStrategy):
    ) -> ModelRoutingResult:
        if not skill_analysis or not skill_analysis.required_skills:
            if tool_call_model:
-                return ModelRoutingResult(tool_call_model, "weighted_avg_no_skills_use_tool_call", 0.7)
-            defaults = {"search": "search-1", "reasoning": "reasoner-1", "answer": "answer-1"}
-            return ModelRoutingResult(defaults.get(stage, "answer-1"), "weighted_avg_no_skills_fallback", 0.5)
+                return ModelRoutingResult(
+                    tool_call_model, "weighted_avg_no_skills_use_tool_call", 0.7
+                )
+            defaults = {
+                "search": "search-1",
+                "reasoning": "reasoner-1",
+                "answer": "answer-1",
+            }
+            return ModelRoutingResult(
+                defaults.get(stage, "answer-1"), "weighted_avg_no_skills_fallback", 0.5
+            )

        models = self._get_models_for_stage(stage)
        model_scores = {}
@@ -341,15 +402,25 @@ class WeightedAverageStrategy(RoutingStrategy):
                score = scores.get(sid, 0.0)
                weighted_sum += weight * score
                total_weight += weight
-            model_scores[model] = weighted_sum / total_weight if total_weight > 0 else 0.5
+            model_scores[model] = (
+                weighted_sum / total_weight if total_weight > 0 else 0.5
+            )

        if not model_scores:
-            defaults = {"search": "search-1", "reasoning": "reasoner-1", "answer": "answer-1"}
-            return ModelRoutingResult(defaults.get(stage, "answer-1"), "weighted_avg_no_model_scores", 0.5)
+            defaults = {
+                "search": "search-1",
+                "reasoning": "reasoner-1",
+                "answer": "answer-1",
+            }
+            return ModelRoutingResult(
+                defaults.get(stage, "answer-1"), "weighted_avg_no_model_scores", 0.5
+            )
        max_score = max(model_scores.values())
        best = [m for m, s in model_scores.items() if abs(s - max_score) < 0.001]
        best.sort(key=lambda m: self.COST_TIERS.get(m, 999))
-        return ModelRoutingResult(best[0], "weighted_avg_from_skill_analysis", max_score, model_scores)
+        return ModelRoutingResult(
+            best[0], "weighted_avg_from_skill_analysis", max_score, model_scores
+        )


 class WeakestSkillStrategy(RoutingStrategy):
@@ -361,18 +432,36 @@ class WeakestSkillStrategy(RoutingStrategy):
    ) -> ModelRoutingResult:
        if not skill_analysis or not skill_analysis.required_skills:
            if tool_call_model:
-                return ModelRoutingResult(tool_call_model, "weakest_skill_no_skills_use_tool_call", 0.7)
-            defaults = {"search": "search-1", "reasoning": "reasoner-1", "answer": "answer-1"}
-            return ModelRoutingResult(defaults.get(stage, "answer-1"), "weakest_skill_no_skills_fallback", 0.5)
+                return ModelRoutingResult(
+                    tool_call_model, "weakest_skill_no_skills_use_tool_call", 0.7
+                )
+            defaults = {
+                "search": "search-1",
+                "reasoning": "reasoner-1",
+                "answer": "answer-1",
+            }
+            return ModelRoutingResult(
+                defaults.get(stage, "answer-1"), "weakest_skill_no_skills_fallback", 0.5
+            )
        weakest = min(skill_analysis.required_skills, key=lambda s: s.percentage)
        sid = self._find_skill_id(stage, weakest.skill_id) or weakest.skill_id
        models = self._get_models_for_stage(stage)
-        model_scores = {m: self._model_skill_scores.get(m, {}).get(sid, 0.5) for m in models}
+        model_scores = {
+            m: self._model_skill_scores.get(m, {}).get(sid, 0.5) for m in models
+        }
        if not model_scores:
-            defaults = {"search": "search-1", "reasoning": "reasoner-1", "answer": "answer-1"}
-            return ModelRoutingResult(defaults.get(stage, "answer-1"), "weakest_skill_no_model_scores", 0.5)
+            defaults = {
+                "search": "search-1",
+                "reasoning": "reasoner-1",
+                "answer": "answer-1",
+            }
+            return ModelRoutingResult(
+                defaults.get(stage, "answer-1"), "weakest_skill_no_model_scores", 0.5
+            )
        best = max(model_scores, key=model_scores.get)
-        return ModelRoutingResult(best, f"weakest_skill_{weakest.skill_id}", model_scores[best], model_scores)
+        return ModelRoutingResult(
+            best, f"weakest_skill_{weakest.skill_id}", model_scores[best], model_scores
+        )


 class StrongestSkillStrategy(RoutingStrategy):
@@ -384,18 +473,41 @@ class StrongestSkillStrategy(RoutingStrategy):
    ) -> ModelRoutingResult:
        if not skill_analysis or not skill_analysis.required_skills:
            if tool_call_model:
-                return ModelRoutingResult(tool_call_model, "strongest_skill_no_skills_use_tool_call", 0.7)
-            defaults = {"search": "search-1", "reasoning": "reasoner-1", "answer": "answer-1"}
-            return ModelRoutingResult(defaults.get(stage, "answer-1"), "strongest_skill_no_skills_fallback", 0.5)
+                return ModelRoutingResult(
+                    tool_call_model, "strongest_skill_no_skills_use_tool_call", 0.7
+                )
+            defaults = {
+                "search": "search-1",
+                "reasoning": "reasoner-1",
+                "answer": "answer-1",
+            }
+            return ModelRoutingResult(
+                defaults.get(stage, "answer-1"),
+                "strongest_skill_no_skills_fallback",
+                0.5,
+            )
        strongest = max(skill_analysis.required_skills, key=lambda s: s.percentage)
        sid = self._find_skill_id(stage, strongest.skill_id) or strongest.skill_id
        models = self._get_models_for_stage(stage)
-        model_scores = {m: self._model_skill_scores.get(m, {}).get(sid, 0.5) for m in models}
+        model_scores = {
+            m: self._model_skill_scores.get(m, {}).get(sid, 0.5) for m in models
+        }
        if not model_scores:
-            defaults = {"search": "search-1", "reasoning": "reasoner-1", "answer": "answer-1"}
-            return ModelRoutingResult(defaults.get(stage, "answer-1"), "strongest_skill_no_model_scores", 0.5)
+            defaults = {
+                "search": "search-1",
+                "reasoning": "reasoner-1",
+                "answer": "answer-1",
+            }
+            return ModelRoutingResult(
+                defaults.get(stage, "answer-1"), "strongest_skill_no_model_scores", 0.5
+            )
        best = max(model_scores, key=model_scores.get)
-        return ModelRoutingResult(best, f"strongest_skill_{strongest.skill_id}", model_scores[best], model_scores)
+        return ModelRoutingResult(
+            best,
+            f"strongest_skill_{strongest.skill_id}",
+            model_scores[best],
+            model_scores,
+        )


 ROUTING_STRATEGIES = {
@@ -41,8 +41,7 @@ _SEARCH_CAPABLE_ENDPOINTS = ("anthropic", "openai", "gemini")

 _SEARCH_DESC = "Search for missing information."
 _CODE_DESC = (
-    "Write and execute Python code to compute intermediate results for "
-    "the problem."
+    "Write and execute Python code to compute intermediate results for the problem."
 )
 _ANSWER_DESC = (
    "Extract the final answer when you have gathered enough information "
@@ -52,8 +51,14 @@ _ANSWER_DESC = (
 _ENUMS = {
    "search": ["search-1", "search-2", "search-3"],
    "enhance_reasoning": ["reasoner-1", "reasoner-2", "reasoner-3"],
-    "answer": ["answer-1", "answer-2", "answer-3", "answer-4",
-               "answer-math-1", "answer-math-2"],
+    "answer": [
+        "answer-1",
+        "answer-2",
+        "answer-3",
+        "answer-4",
+        "answer-math-1",
+        "answer-math-2",
+    ],
 }


@@ -76,15 +81,17 @@ def anthropic_tools() -> List[Dict[str, Any]]:
        ("enhance_reasoning", _CODE_DESC),
        ("answer", _ANSWER_DESC),
    ):
-        out.append({
-            "name": name,
-            "description": desc,
-            "input_schema": {
-                "type": "object",
-                "properties": {"model": _model_prop(name)},
-                "required": ["model"],
-            },
-        })
+        out.append(
+            {
+                "name": name,
+                "description": desc,
+                "input_schema": {
+                    "type": "object",
+                    "properties": {"model": _model_prop(name)},
+                    "required": ["model"],
+                },
+            }
+        )
    return out


@@ -96,18 +103,20 @@ def openai_tools() -> List[Dict[str, Any]]:
        ("enhance_reasoning", _CODE_DESC),
        ("answer", _ANSWER_DESC),
    ):
-        out.append({
-            "type": "function",
-            "function": {
-                "name": name,
-                "description": desc,
-                "parameters": {
-                    "type": "object",
-                    "properties": {"model": _model_prop(name)},
-                    "required": ["model"],
+        out.append(
+            {
+                "type": "function",
+                "function": {
+                    "name": name,
+                    "description": desc,
+                    "parameters": {
+                        "type": "object",
+                        "properties": {"model": _model_prop(name)},
+                        "required": ["model"],
+                    },
                },
-            },
-        })
+            }
+        )
    return out


@@ -119,15 +128,17 @@ def gemini_tools() -> List[Dict[str, Any]]:
        ("enhance_reasoning", _CODE_DESC),
        ("answer", _ANSWER_DESC),
    ):
-        out.append({
-            "name": name,
-            "description": desc,
-            "parameters": {
-                "type": "object",
-                "properties": {"model": _model_prop(name)},
-                "required": ["model"],
-            },
-        })
+        out.append(
+            {
+                "name": name,
+                "description": desc,
+                "parameters": {
+                    "type": "object",
+                    "properties": {"model": _model_prop(name)},
+                    "required": ["model"],
+                },
+            }
+        )
    return out


@@ -135,6 +146,7 @@ def gemini_tools() -> List[Dict[str, Any]]:
 # enhance_reasoning / code  —  eval_frames.py:659-812
 # ---------------------------------------------------------------------------

+
 def run_code(
    agent: Any,
    spec: ModelSpec,
@@ -150,7 +162,8 @@ def run_code(
    rather than raising — the orchestrator learns the model can't code.
    """
    prompt = (
-        context_str.strip() + "\n\n"
+        context_str.strip()
+        + "\n\n"
        + f"Question: {problem}\nInstead of directly answering the question, "
        "please write additional python code that will give intermidiate "
        "results after execution. Wrap the code within ```python and ```. "
@@ -158,7 +171,11 @@ def run_code(
        "initialization."
    )
    text, p, c, cost = call_alias(
-        agent, spec, user=prompt, max_tokens=8000, temperature=1.0,
+        agent,
+        spec,
+        user=prompt,
+        max_tokens=8000,
+        temperature=1.0,
    )
    generated_code = ""
    if "```python" in text:
@@ -197,6 +214,7 @@ def run_code(
 # answer  —  eval_frames.py:814-997
 # ---------------------------------------------------------------------------

+
 def run_answer(
    agent: Any,
    spec: ModelSpec,
@@ -219,11 +237,15 @@ def run_answer(
    boxed = False

    if "qwen3" in model_l and "235" not in model_l:
-        system = "Please reason step by step, and put your final answer within \\boxed{}."
+        system = (
+            "Please reason step by step, and put your final answer within \\boxed{}."
+        )
        user = base
        boxed = True
    elif "qwen2.5-math" in model_l or "qwen-2.5-math" in model_l:
-        system = "Please reason step by step, and put your final answer within \\boxed{}."
+        system = (
+            "Please reason step by step, and put your final answer within \\boxed{}."
+        )
        user = base
        boxed = True
    else:
@@ -236,8 +258,12 @@ def run_answer(
        )

    text, p, c, cost = call_alias(
-        agent, spec, user=user, system=system,
-        max_tokens=max_tokens, temperature=1.0,
+        agent,
+        spec,
+        user=user,
+        system=system,
+        max_tokens=max_tokens,
+        temperature=1.0,
    )

    pred = ""
@@ -268,6 +294,7 @@ def run_answer(
 # search  —  eval_frames.py:999-1096
 # ---------------------------------------------------------------------------

+
 def run_search(
    agent: Any,
    spec: ModelSpec,
@@ -288,13 +315,18 @@ def run_search(
    OpenJarvis substitution for the missing FAISS wiki index).
    """
    prompt = (
-        context_str.strip() + "\n\n"
+        context_str.strip()
+        + "\n\n"
        + f"Question: {problem}\nInstead of directly answering the question, "
        "please think hard and write a concise query to search Wikipedia. "
        "Wrap the query within <query> and </query>."
    )
    text, p, c, cost = call_alias(
-        agent, spec, user=prompt, max_tokens=8000, temperature=1.0,
+        agent,
+        spec,
+        user=prompt,
+        max_tokens=8000,
+        temperature=1.0,
    )
    if "<query>" in text:
        query = text.split("<query>")[-1].split("</query>")[0].strip()
@@ -322,7 +354,9 @@ def run_search(
        }
        try:
            results = requests.post(
-                f"{retriever_url.rstrip('/')}/retrieve", json=payload, timeout=120,
+                f"{retriever_url.rstrip('/')}/retrieve",
+                json=payload,
+                timeout=120,
            ).json()
            for r in results[0]:
                doc = r.get("document", {})
@@ -20,6 +20,7 @@ from typing import Any, Dict, List, Optional
 # BetaCompetence
 # ---------------------------------------------------------------------------

+
@dataclass
 class BetaCompetence:
    """Bayesian competence estimate for an agent on a specific skill.
@@ -80,6 +81,7 @@ class BetaCompetence:
 # CostStats
 # ---------------------------------------------------------------------------

+
@dataclass
 class CostStats:
    """Execution cost statistics for an agent under a specific mode.
@@ -110,11 +112,17 @@ class CostStats:
        """Incremental running-average update."""
        n = self.total_executions
        self.avg_prompt_tokens = (self.avg_prompt_tokens * n + prompt_tokens) / (n + 1)
-        self.avg_completion_tokens = (self.avg_completion_tokens * n + completion_tokens) / (n + 1)
+        self.avg_completion_tokens = (
+            self.avg_completion_tokens * n + completion_tokens
+        ) / (n + 1)
        self.avg_latency_s = (self.avg_latency_s * n + latency_s) / (n + 1)
        self.avg_cost_usd = (self.avg_cost_usd * n + cost_usd) / (n + 1)
-        self.avg_completion_cost_usd = (self.avg_completion_cost_usd * n + completion_cost_usd) / (n + 1)
-        self.avg_prompt_cost_usd = (self.avg_prompt_cost_usd * n + prompt_cost_usd) / (n + 1)
+        self.avg_completion_cost_usd = (
+            self.avg_completion_cost_usd * n + completion_cost_usd
+        ) / (n + 1)
+        self.avg_prompt_cost_usd = (self.avg_prompt_cost_usd * n + prompt_cost_usd) / (
+            n + 1
+        )
        self.total_executions = n + 1

    def to_dict(self) -> Dict[str, Any]:
@@ -137,6 +145,7 @@ class CostStats:
 # RoutingInsight
 # ---------------------------------------------------------------------------

+
@dataclass
 class RoutingInsight:
    """A single routing insight learned from execution traces"""
@@ -165,6 +174,7 @@ class RoutingInsight:
 # ModeMetadata
 # ---------------------------------------------------------------------------

+
@dataclass
 class ModeMetadata:
    """Mode-level routing metadata."""
@@ -197,6 +207,7 @@ class ModeMetadata:
 # Skill
 # ---------------------------------------------------------------------------

+
@dataclass
 class SkillProvenance:
    """Tracks how and why a skill was discovered."""
@@ -231,7 +242,7 @@ class Skill:
    indicators: List[str] = field(default_factory=list)
    examples: List[str] = field(default_factory=list)
    mode: str = ""
-    parent_skill_id: Optional[str] = None # for hierarchical skills
+    parent_skill_id: Optional[str] = None  # for hierarchical skills
    provenance: SkillProvenance = field(default_factory=SkillProvenance)

    def to_dict(self) -> Dict[str, Any]:
@@ -273,6 +284,7 @@ class Skill:
 # AgentProfile
 # ---------------------------------------------------------------------------

+
@dataclass
 class AgentProfile:
    """Agent profile for skill-aware orchestration."""
@@ -309,9 +321,7 @@ class AgentProfile:
        """Update competence estimate for a skill."""
        self.get_competence_dist(skill_id).update(success)

-    def weighted_competence(
-        self, skill_weights: Dict[str, float]
-    ) -> float:
+    def weighted_competence(self, skill_weights: Dict[str, float]) -> float:
        """Compute weighted competence: sum w_{t,sigma} * alpha/(alpha+beta)."""
        if not skill_weights:
            return 0.5
@@ -334,9 +344,7 @@ class AgentProfile:
        ]
        return sum(scores) / len(scores) if scores else 0.0

-    def category_competence_for_skills(
-        self, active_skill_ids: List[str]
-    ) -> float:
+    def category_competence_for_skills(self, active_skill_ids: List[str]) -> float:
        """Category-level competence for hierarchical tie-breaking.

        Extracts parent categories from active_skill_ids (e.g. 'entertainment_knowledge'
@@ -349,7 +357,9 @@ class AgentProfile:
            categories.add(cat)
        if not categories:
            return 0.0
-        return sum(self.category_competence(cat) for cat in categories) / len(categories)
+        return sum(self.category_competence(cat) for cat in categories) / len(
+            categories
+        )

    @property
    def overall_success_rate(self) -> float:
@@ -390,8 +400,12 @@ class AgentProfile:
            "skill_scores": skill_scores,
            "skill_attempts": skill_attempts,
            "skill_successes": skill_successes,
-            "total_attempts": self.total_attempts if self.total_attempts > 0 else skill_total_attempts,
-            "total_successes": self.total_successes if self.total_attempts > 0 else skill_total_successes,
+            "total_attempts": self.total_attempts
+            if self.total_attempts > 0
+            else skill_total_attempts,
+            "total_successes": self.total_successes
+            if self.total_attempts > 0
+            else skill_total_successes,
            "cost_stats": self.cost_stats.to_dict(),
            "routing_signals": self.routing_signals,
            "strengths": self.strengths,
@@ -172,8 +172,12 @@ RL_ALL_TOOLS: Dict[str, Dict[str, List[str]]] = {
    "enhance_reasoning": {"model": ["reasoner-1", "reasoner-2", "reasoner-3"]},
    "answer": {
        "model": [
-            "answer-1", "answer-2", "answer-3", "answer-4",
-            "answer-math-1", "answer-math-2",
+            "answer-1",
+            "answer-2",
+            "answer-3",
+            "answer-4",
+            "answer-math-1",
+            "answer-math-2",
        ],
    },
    "search": {"model": ["search-1", "search-2", "search-3"]},
@@ -188,10 +192,14 @@ RL_ALL_TOOLS: Dict[str, Dict[str, List[str]]] = {
 # so the substitution is deferred until we know the cell's resolved local/cloud
 # pair. Worker dicts share the schema validated by `_resolve_worker_pool`.

-def _expert_for(slot: str, local_model: Optional[str],
-                local_endpoint: Optional[str],
-                cloud_model: str,
-                cloud_endpoint: str = "anthropic") -> Dict[str, Any]:
+
+def _expert_for(
+    slot: str,
+    local_model: Optional[str],
+    local_endpoint: Optional[str],
+    cloud_model: str,
+    cloud_endpoint: str = "anthropic",
+) -> Dict[str, Any]:
    """Map an upstream model slot (`answer-1`, `search-3`, …) to a worker spec.

    Routing policy:
@@ -357,6 +365,7 @@ def _paper_expert_for(

 # ---- Tavily + Modal helpers -------------------------------------------------

+
 def _call_tavily_search(
    query: str,
    max_results: int = 5,
@@ -390,7 +399,9 @@ def _call_modal_python(code: str, timeout_s: int = 60) -> Tuple[str, int]:
        # Python image too. We rely on stdlib only — no extra pip installs.
        image = modal.Image.debian_slim(python_version="3.12")
        sb = modal.Sandbox.create(
-            "python", "-c", code,
+            "python",
+            "-c",
+            code,
            app=app,
            image=image,
            timeout=int(timeout_s),
@@ -485,53 +496,77 @@ def _paper_pool(
    """
    pool: List[Dict[str, Any]] = []
    if local_model and local_endpoint:
-        pool.append({
+        pool.append(
+            {
+                "id": len(pool),
+                "name": "local-qwen",
+                "type": "vllm",
+                "model": local_model,
+                "base_url": local_endpoint,
+                "description": "Local Qwen vLLM (paper uses Qwen3-32B).",
+            }
+        )
+    pool.append(
+        {
            "id": len(pool),
-            "name": "local-qwen",
-            "type": "vllm",
-            "model": local_model,
-            "base_url": local_endpoint,
-            "description": "Local Qwen vLLM (paper uses Qwen3-32B).",
-        })
-    pool.append({
-        "id": len(pool), "name": "tavily-search",
-        "type": "tavily-search", "model": "tavily",
-        "description": "Tavily web search.",
-    })
-    pool.append({
-        "id": len(pool), "name": "modal-python",
-        "type": "modal-python", "model": "modal-python",
-        "description": "Modal Sandbox for one-shot Python exec.",
-    })
-    pool.append({
-        "id": len(pool), "name": "code-specialist",
-        "type": "openrouter", "model": _PAPER_CODER_OPENROUTER,
-        "description": "Qwen-2.5-Coder-32B via OpenRouter (paper).",
-    })
-    pool.append({
-        "id": len(pool), "name": "generalist-llama",
-        "type": "openrouter", "model": _PAPER_GENERALIST_TIER3_OPENROUTER,
-        "description": "Llama-3.3-70B-Instruct via OpenRouter (paper tier-3).",
-    })
-    pool.append({
-        "id": len(pool), "name": "generalist-gpt5",
-        "type": "openai", "model": "gpt-5",
-        "description": "GPT-5 frontier generalist.",
-    })
-    pool.append({
-        "id": len(pool), "name": "generalist-gpt5-mini",
-        "type": "openai", "model": "gpt-5-mini",
-        "description": "GPT-5-mini mid generalist.",
-    })
+            "name": "tavily-search",
+            "type": "tavily-search",
+            "model": "tavily",
+            "description": "Tavily web search.",
+        }
+    )
+    pool.append(
+        {
+            "id": len(pool),
+            "name": "modal-python",
+            "type": "modal-python",
+            "model": "modal-python",
+            "description": "Modal Sandbox for one-shot Python exec.",
+        }
+    )
+    pool.append(
+        {
+            "id": len(pool),
+            "name": "code-specialist",
+            "type": "openrouter",
+            "model": _PAPER_CODER_OPENROUTER,
+            "description": "Qwen-2.5-Coder-32B via OpenRouter (paper).",
+        }
+    )
+    pool.append(
+        {
+            "id": len(pool),
+            "name": "generalist-llama",
+            "type": "openrouter",
+            "model": _PAPER_GENERALIST_TIER3_OPENROUTER,
+            "description": "Llama-3.3-70B-Instruct via OpenRouter (paper tier-3).",
+        }
+    )
+    pool.append(
+        {
+            "id": len(pool),
+            "name": "generalist-gpt5",
+            "type": "openai",
+            "model": "gpt-5",
+            "description": "GPT-5 frontier generalist.",
+        }
+    )
+    pool.append(
+        {
+            "id": len(pool),
+            "name": "generalist-gpt5-mini",
+            "type": "openai",
+            "model": "gpt-5-mini",
+            "description": "GPT-5-mini mid generalist.",
+        }
+    )
    return pool


 # Regex for ``<tool_call>{...}</tool_call>`` blocks emitted by Orchestrator-8B
 # when the vLLM tool parser doesn't catch them (e.g. `qwen3_xml` parser on a
 # hermes-style template). Captures the JSON payload.
-_TOOL_CALL_TAG_RE = re.compile(
-    r"<tool_call>\s*(\{.*?\})\s*</tool_call>", re.DOTALL
-)
+_TOOL_CALL_TAG_RE = re.compile(r"<tool_call>\s*(\{.*?\})\s*</tool_call>", re.DOTALL)


 def _parse_rl_tool_call(content: str, sdk_tool_calls: Any) -> Optional[Dict[str, Any]]:
@@ -608,7 +643,7 @@ def _strip_fences(s: str) -> str:
    if s.startswith("```"):
        first_nl = s.find("\n")
        if first_nl != -1:
-            s = s[first_nl + 1:]
+            s = s[first_nl + 1 :]
        if s.endswith("```"):
            s = s[:-3]
        s = s.strip()
@@ -660,6 +695,7 @@ def _extract_final_answer_text(text: str) -> str:

 # ---------- Worker pool ----------

+
 def _default_pool(
    local_model: Optional[str],
    local_endpoint: Optional[str],
@@ -677,17 +713,19 @@ def _default_pool(
        ep = "anthropic"
    pool: List[Dict[str, Any]] = []
    if local_model and local_endpoint:
-        pool.append({
-            "id": len(pool),
-            "name": "local-qwen",
-            "type": "vllm",
-            "model": local_model,
-            "base_url": local_endpoint,
-            "description": (
-                "Open-weights Qwen3.5 served locally. Cheap and fast. Good at "
-                "concise extraction, formatting, arithmetic on given data."
-            ),
-        })
+        pool.append(
+            {
+                "id": len(pool),
+                "name": "local-qwen",
+                "type": "vllm",
+                "model": local_model,
+                "base_url": local_endpoint,
+                "description": (
+                    "Open-weights Qwen3.5 served locally. Cheap and fast. Good at "
+                    "concise extraction, formatting, arithmetic on given data."
+                ),
+            }
+        )
    if ep == "openai":
        search_type = "openai-web-search"
        search_model = cloud_model
@@ -700,36 +738,42 @@ def _default_pool(
        search_type = "anthropic-web-search"
        search_model = _DEFAULT_WEB_SEARCH_MODEL
        search_desc = "Anthropic server-side web_search."
-    pool.append({
-        "id": len(pool),
-        "name": "web-search",
-        "type": search_type,
-        "model": search_model,
-        "description": (
-            f"{search_desc} Use for facts that need a lookup "
-            "(recent events, rare names/dates, niche sources). Returns a digest."
-        ),
-    })
-    pool.append({
-        "id": len(pool),
-        "name": f"frontier-{ep}",
-        "type": ep,
-        "model": cloud_model,
-        "description": (
-            "Frontier reasoning model. Use for hard multi-step reasoning, "
-            "code review, or a final synthesis pass. Expensive — use sparingly."
-        ),
-    })
-    pool.append({
-        "id": len(pool),
-        "name": "frontier-openai-mini",
-        "type": "openai",
-        "model": "gpt-5-mini",
-        "description": (
-            "Mid-tier OpenAI model. Solid general knowledge and reasoning at a "
-            "fraction of frontier cost."
-        ),
-    })
+    pool.append(
+        {
+            "id": len(pool),
+            "name": "web-search",
+            "type": search_type,
+            "model": search_model,
+            "description": (
+                f"{search_desc} Use for facts that need a lookup "
+                "(recent events, rare names/dates, niche sources). Returns a digest."
+            ),
+        }
+    )
+    pool.append(
+        {
+            "id": len(pool),
+            "name": f"frontier-{ep}",
+            "type": ep,
+            "model": cloud_model,
+            "description": (
+                "Frontier reasoning model. Use for hard multi-step reasoning, "
+                "code review, or a final synthesis pass. Expensive — use sparingly."
+            ),
+        }
+    )
+    pool.append(
+        {
+            "id": len(pool),
+            "name": "frontier-openai-mini",
+            "type": "openai",
+            "model": "gpt-5-mini",
+            "description": (
+                "Mid-tier OpenAI model. Solid general knowledge and reasoning at a "
+                "fraction of frontier cost."
+            ),
+        }
+    )
    return pool


@@ -743,12 +787,21 @@ def _default_pool(
 #   `modal-python`   — One-shot Python exec in a fresh Modal Sandbox (the
 #                      paper's "Python sandbox" inside `enhance_reasoning`).
 _TOOLORCH_VALID_TYPES = (
-    "vllm", "openai", "anthropic", "anthropic-web-search",
-    "openai-web-search", "gemini", "gemini-web-search", "tavily-search",
-    "openrouter", "modal-python",
+    "vllm",
+    "openai",
+    "anthropic",
+    "anthropic-web-search",
+    "openai-web-search",
+    "gemini",
+    "gemini-web-search",
+    "tavily-search",
+    "openrouter",
+    "modal-python",
 )
 _TOOLORCH_SEARCH_TYPES = (
-    "anthropic-web-search", "openai-web-search", "gemini-web-search",
+    "anthropic-web-search",
+    "openai-web-search",
+    "gemini-web-search",
    "tavily-search",
 )

@@ -808,9 +861,7 @@ def _resolve_worker_pool(
                f"Invalid worker_pool entry [{wid_repr}]: 'id' must be an int"
            )
        if wid in seen_ids:
-            raise ValueError(
-                f"Invalid worker_pool entry [{wid}]: duplicate id"
-            )
+            raise ValueError(f"Invalid worker_pool entry [{wid}]: duplicate id")
        seen_ids.add(wid)
        if not entry.get("name") or not isinstance(entry["name"], str):
            raise ValueError(
@@ -850,7 +901,10 @@ def _resolve_worker_pool(
                raise ValueError(
                    f"Invalid worker_pool entry [{wid}]: 'model' must be a string when set"
                )
-            if wtype in ("openai-web-search", "gemini-web-search") and model not in PRICES:
+            if (
+                wtype in ("openai-web-search", "gemini-web-search")
+                and model not in PRICES
+            ):
                raise ValueError(
                    f"Invalid worker_pool entry [{wid}]: model {model!r} "
                    f"is not in PRICES (known: {sorted(PRICES)})"
@@ -958,7 +1012,9 @@ def _call_worker(
        text, p, c, n_searches, _ = LocalCloudAgent._call_openai_agent(
            worker["model"],
            user=prompt,
-            max_tokens=max(max_tok, 16384) if is_gpt5_family(worker["model"]) else max_tok,
+            max_tokens=max(max_tok, 16384)
+            if is_gpt5_family(worker["model"])
+            else max_tok,
            temperature=eff_temp,
        )
        extra = n_searches * OPENAI_WEB_SEARCH_COST_PER_CALL
@@ -975,7 +1031,8 @@ def _call_worker(
    if wtype == "tavily-search":
        max_results = int(cfg.get("tavily_max_results", 5))
        text, p, c, extra, n_searches = _call_tavily_search(
-            str(prompt), max_results=max_results,
+            str(prompt),
+            max_results=max_results,
        )
        return text, p, c, False, extra, n_searches
    if wtype == "openrouter":
@@ -1045,8 +1102,12 @@ def _swe_call_worker(
    is_local = backbone == "local"
    return (
        out["final_summary"] or out["answer"],
-        out["tokens_in"], out["tokens_out"],
-        is_local, 0.0, 0, int(out["turns"]),
+        out["tokens_in"],
+        out["tokens_out"],
+        is_local,
+        0.0,
+        0,
+        int(out["turns"]),
    )


@@ -1134,20 +1195,24 @@ class ToolOrchestraAgent(LocalCloudAgent):
        )
        shared_workdir: Optional[Path] = None
        if swe_mode:
-            shared_workdir = Path(tempfile.mkdtemp(
-                prefix=f"toolorch-swe-{task_meta.get('task_id','x')}-"
-            ))
+            shared_workdir = Path(
+                tempfile.mkdtemp(
+                    prefix=f"toolorch-swe-{task_meta.get('task_id', 'x')}-"
+                )
+            )
            try:
                _clone_repo(task_meta["repo"], task_meta["base_commit"], shared_workdir)
            except Exception:
                shutil.rmtree(shared_workdir, ignore_errors=True)
                raise
-            self.record_trace_event({
-                "kind": "toolorchestra_swe_workdir",
-                "workdir": str(shared_workdir),
-                "repo": task_meta["repo"],
-                "base_commit": task_meta["base_commit"],
-            })
+            self.record_trace_event(
+                {
+                    "kind": "toolorchestra_swe_workdir",
+                    "workdir": str(shared_workdir),
+                    "repo": task_meta["repo"],
+                    "base_commit": task_meta["base_commit"],
+                }
+            )

        # try/finally guards ``shared_workdir`` against exceptions raised
        # anywhere in the turn loop, the worker calls, the fallback, or
@@ -1185,15 +1250,22 @@ class ToolOrchestraAgent(LocalCloudAgent):
                cost += self.cost_usd(self._cloud_model, o_in, o_out)

                action = _parse_action(text)
-                history.append({
-                    "role": "orchestrator", "turn": turn, "raw": text, "action": action,
-                })
-                self.record_trace_event({
-                    "kind": "toolorchestra_action",
-                    "turn": turn,
-                    "action": action,
-                    "raw": text,
-                })
+                history.append(
+                    {
+                        "role": "orchestrator",
+                        "turn": turn,
+                        "raw": text,
+                        "action": action,
+                    }
+                )
+                self.record_trace_event(
+                    {
+                        "kind": "toolorchestra_action",
+                        "turn": turn,
+                        "action": action,
+                        "raw": text,
+                    }
+                )

                if action is None:
                    parse_failures += 1
@@ -1217,12 +1289,21 @@ class ToolOrchestraAgent(LocalCloudAgent):
                        continue
                    worker = workers[wid]
                    if swe_mode and shared_workdir is not None:
-                        (w_text, w_in, w_out, is_local, extra_cost,
-                         n_searches, bash_turns) = (
-                            _swe_call_worker(
-                                worker, str(w_input), cfg, task_meta,
-                                shared_workdir, turn,
-                            )
+                        (
+                            w_text,
+                            w_in,
+                            w_out,
+                            is_local,
+                            extra_cost,
+                            n_searches,
+                            bash_turns,
+                        ) = _swe_call_worker(
+                            worker,
+                            str(w_input),
+                            cfg,
+                            task_meta,
+                            shared_workdir,
+                            turn,
                        )
                        tool_calls += bash_turns
                    else:
@@ -1236,17 +1317,19 @@ class ToolOrchestraAgent(LocalCloudAgent):
                        cost += self.cost_usd(worker["model"], w_in, w_out) + extra_cost
                    n_web_searches_total += n_searches
                    tool_calls += n_searches
-                    history.append({
-                        "role": "worker",
-                        "turn": turn,
-                        "worker_id": wid,
-                        "worker_name": worker["name"],
-                        "worker_model": worker["model"],
-                        "output": w_text,
-                        "tokens_in": w_in,
-                        "tokens_out": w_out,
-                        "n_web_searches": n_searches,
-                    })
+                    history.append(
+                        {
+                            "role": "worker",
+                            "turn": turn,
+                            "worker_id": wid,
+                            "worker_name": worker["name"],
+                            "worker_model": worker["model"],
+                            "output": w_text,
+                            "tokens_in": w_in,
+                            "tokens_out": w_out,
+                            "n_web_searches": n_searches,
+                        }
+                    )
                    continue
                # Unknown action kind — treat as parse failure.
                parse_failures += 1
@@ -1258,18 +1341,22 @@ class ToolOrchestraAgent(LocalCloudAgent):
                # Search workers are excluded — they answer fact-lookup
                # questions, not synthesis.
                non_search = [
-                    w for w in workers
-                    if w.get("type") not in _TOOLORCH_SEARCH_TYPES
+                    w for w in workers if w.get("type") not in _TOOLORCH_SEARCH_TYPES
                ] or workers
                worker = max(
                    non_search,
                    key=lambda w: PRICES.get(w.get("model", ""), (0.0, 0.0))[1],
                )
                if swe_mode and shared_workdir is not None:
-                    (ans, w_in, w_out, is_local, extra_cost, _,
-                     bash_turns) = _swe_call_worker(
-                        worker, question, cfg, task_meta,
-                        shared_workdir, max_turns + 1,
+                    (ans, w_in, w_out, is_local, extra_cost, _, bash_turns) = (
+                        _swe_call_worker(
+                            worker,
+                            question,
+                            cfg,
+                            task_meta,
+                            shared_workdir,
+                            max_turns + 1,
+                        )
                    )
                    tool_calls += bash_turns
                else:
@@ -1281,17 +1368,19 @@ class ToolOrchestraAgent(LocalCloudAgent):
                else:
                    tokens_cloud += w_in + w_out
                    cost += self.cost_usd(worker["model"], w_in, w_out) + extra_cost
-                history.append({
-                    "role": "worker",
-                    "turn": max_turns + 1,
-                    "worker_id": worker["id"],
-                    "worker_name": worker["name"],
-                    "worker_model": worker["model"],
-                    "output": ans,
-                    "tokens_in": w_in,
-                    "tokens_out": w_out,
-                    "fallback": True,
-                })
+                history.append(
+                    {
+                        "role": "worker",
+                        "turn": max_turns + 1,
+                        "worker_id": worker["id"],
+                        "worker_name": worker["name"],
+                        "worker_model": worker["model"],
+                        "output": ans,
+                        "tokens_in": w_in,
+                        "tokens_out": w_out,
+                        "fallback": True,
+                    }
+                )
                final_answer = ans

            # In SWE mode, the authoritative output is the working-tree diff —
@@ -1301,7 +1390,8 @@ class ToolOrchestraAgent(LocalCloudAgent):
                if patch.strip():
                    final_answer = (
                        f"{final_answer}\n\n```diff\n{patch}```"
-                        if final_answer else f"```diff\n{patch}```"
+                        if final_answer
+                        else f"```diff\n{patch}```"
                    )

            meta = {
@@ -1371,20 +1461,24 @@ class ToolOrchestraAgent(LocalCloudAgent):
        )
        shared_workdir: Optional[Path] = None
        if swe_mode:
-            shared_workdir = Path(tempfile.mkdtemp(
-                prefix=f"toolorch-rl-swe-{task_meta.get('task_id','x')}-"
-            ))
+            shared_workdir = Path(
+                tempfile.mkdtemp(
+                    prefix=f"toolorch-rl-swe-{task_meta.get('task_id', 'x')}-"
+                )
+            )
            try:
                _clone_repo(task_meta["repo"], task_meta["base_commit"], shared_workdir)
            except Exception:
                shutil.rmtree(shared_workdir, ignore_errors=True)
                raise
-            self.record_trace_event({
-                "kind": "toolorchestra_rl_swe_workdir",
-                "workdir": str(shared_workdir),
-                "repo": task_meta["repo"],
-                "base_commit": task_meta["base_commit"],
-            })
+            self.record_trace_event(
+                {
+                    "kind": "toolorchestra_rl_swe_workdir",
+                    "workdir": str(shared_workdir),
+                    "repo": task_meta["repo"],
+                    "base_commit": task_meta["base_commit"],
+                }
+            )

        # ``context_str`` mirrors the upstream's running context — accumulates
        # search documents and code/exec snippets across turns. We keep this
@@ -1433,40 +1527,53 @@ class ToolOrchestraAgent(LocalCloudAgent):
                    temperature=orch_temp,
                    tools=RL_TOOLS_SPEC,
                )
-                self.record_trace_event({
-                    "kind": "vllm",
-                    "role": "orchestrator",
-                    "model": orch_model,
-                    "endpoint": orch_endpoint,
-                    "system": RL_ORCHESTRATOR_SYS,
-                    "user": user,
-                    "response": text,
-                    "tool_calls": [
-                        {
-                            "id": getattr(tc, "id", None),
-                            "type": getattr(tc, "type", None),
-                            "function": {
-                                "name": getattr(getattr(tc, "function", None), "name", None),
-                                "arguments": getattr(getattr(tc, "function", None), "arguments", None),
-                            },
-                        }
-                        for tc in (sdk_tool_calls or [])
-                    ],
-                    "tokens_in": o_in,
-                    "tokens_out": o_out,
-                })
+                self.record_trace_event(
+                    {
+                        "kind": "vllm",
+                        "role": "orchestrator",
+                        "model": orch_model,
+                        "endpoint": orch_endpoint,
+                        "system": RL_ORCHESTRATOR_SYS,
+                        "user": user,
+                        "response": text,
+                        "tool_calls": [
+                            {
+                                "id": getattr(tc, "id", None),
+                                "type": getattr(tc, "type", None),
+                                "function": {
+                                    "name": getattr(
+                                        getattr(tc, "function", None), "name", None
+                                    ),
+                                    "arguments": getattr(
+                                        getattr(tc, "function", None), "arguments", None
+                                    ),
+                                },
+                            }
+                            for tc in (sdk_tool_calls or [])
+                        ],
+                        "tokens_in": o_in,
+                        "tokens_out": o_out,
+                    }
+                )
                tokens_local += o_in + o_out

                action = _parse_rl_tool_call(text, sdk_tool_calls)
-                history.append({
-                    "role": "orchestrator", "turn": turn, "raw": text, "action": action,
-                })
-                self.record_trace_event({
-                    "kind": "toolorchestra_rl_action",
-                    "turn": turn,
-                    "action": action,
-                    "raw": text,
-                })
+                history.append(
+                    {
+                        "role": "orchestrator",
+                        "turn": turn,
+                        "raw": text,
+                        "action": action,
+                    }
+                )
+                self.record_trace_event(
+                    {
+                        "kind": "toolorchestra_rl_action",
+                        "turn": turn,
+                        "action": action,
+                        "raw": text,
+                    }
+                )

                if action is None:
                    parse_failures += 1
@@ -1479,8 +1586,10 @@ class ToolOrchestraAgent(LocalCloudAgent):
                slot = args.get("model", "")

                # Validate against the upstream tool/arg schema.
-                valid = name in RL_ALL_TOOLS and isinstance(slot, str) and (
-                    slot in RL_ALL_TOOLS[name]["model"]
+                valid = (
+                    name in RL_ALL_TOOLS
+                    and isinstance(slot, str)
+                    and (slot in RL_ALL_TOOLS[name]["model"])
                )
                if not valid:
                    parse_failures += 1
@@ -1501,8 +1610,11 @@ class ToolOrchestraAgent(LocalCloudAgent):
                # framing).
                if paper_mode:
                    worker = _paper_expert_for(
-                        slot, self._local_model, self._local_endpoint,
-                        self._cloud_model, self._cloud_endpoint,
+                        slot,
+                        self._local_model,
+                        self._local_endpoint,
+                        self._cloud_model,
+                        self._cloud_endpoint,
                    )
                    # In paper mode, `enhance_reasoning` is always the coder
                    # specialist regardless of the orchestrator's chosen tier.
@@ -1516,7 +1628,10 @@ class ToolOrchestraAgent(LocalCloudAgent):
                        }
                else:
                    worker = _expert_for(
-                        slot, self._local_model, self._local_endpoint, self._cloud_model,
+                        slot,
+                        self._local_model,
+                        self._local_endpoint,
+                        self._cloud_model,
                        self._cloud_endpoint,
                    )

@@ -1572,13 +1687,25 @@ class ToolOrchestraAgent(LocalCloudAgent):
                # bash_turns=0; vllm/anthropic-typed workers run the loop.
                bash_turns = 0
                if swe_mode and shared_workdir is not None and name != "search":
-                    (w_text, w_in, w_out, is_local, extra_cost,
-                     n_searches, bash_turns) = _swe_call_worker(
-                        worker, w_input, cfg, task_meta, shared_workdir, turn,
+                    (
+                        w_text,
+                        w_in,
+                        w_out,
+                        is_local,
+                        extra_cost,
+                        n_searches,
+                        bash_turns,
+                    ) = _swe_call_worker(
+                        worker,
+                        w_input,
+                        cfg,
+                        task_meta,
+                        shared_workdir,
+                        turn,
                    )
                else:
-                    w_text, w_in, w_out, is_local, extra_cost, n_searches = _call_worker(
-                        worker, w_input, cfg
+                    w_text, w_in, w_out, is_local, extra_cost, n_searches = (
+                        _call_worker(worker, w_input, cfg)
                    )
                if is_local:
                    tokens_local += w_in + w_out
@@ -1597,13 +1724,13 @@ class ToolOrchestraAgent(LocalCloudAgent):
                # when no python block is found.
                modal_exec_output: Optional[str] = None
                modal_exec_rc: Optional[int] = None
-                if (paper_mode and name == "enhance_reasoning"
-                        and not swe_mode):
+                if paper_mode and name == "enhance_reasoning" and not swe_mode:
                    code = _extract_first_python_block(w_text)
                    if code:
                        timeout_s = int(cfg.get("modal_python_timeout_s", 60))
                        modal_exec_output, modal_exec_rc = _call_modal_python(
-                            code, timeout_s=timeout_s,
+                            code,
+                            timeout_s=timeout_s,
                        )
                        tool_calls += 1
                        w_text = (
@@ -1611,27 +1738,29 @@ class ToolOrchestraAgent(LocalCloudAgent):
                            f"(rc={modal_exec_rc})]\n{modal_exec_output}"
                        )

-                history.append({
-                    "role": "worker",
-                    "turn": turn,
-                    "tool": name,
-                    "slot": slot,
-                    "worker_model": worker["model"],
-                    "worker_type": worker["type"],
-                    "output": w_text,
-                    "tokens_in": w_in,
-                    "tokens_out": w_out,
-                    "n_web_searches": n_searches,
-                    "bash_turns": bash_turns,
-                    "modal_exec_rc": modal_exec_rc,
-                })
+                history.append(
+                    {
+                        "role": "worker",
+                        "turn": turn,
+                        "tool": name,
+                        "slot": slot,
+                        "worker_model": worker["model"],
+                        "worker_type": worker["type"],
+                        "output": w_text,
+                        "tokens_in": w_in,
+                        "tokens_out": w_out,
+                        "n_web_searches": n_searches,
+                        "bash_turns": bash_turns,
+                        "modal_exec_rc": modal_exec_rc,
+                    }
+                )

                # Update accumulated context for the next turn.
                if name == "search":
                    # Treat the search worker's response as a document.
                    doc_list.append(w_text)
                    ctx_docs = "\n\n".join(
-                        f"Doc {i+1}: {d}" for i, d in enumerate(doc_list)
+                        f"Doc {i + 1}: {d}" for i, d in enumerate(doc_list)
                    )
                    # Crude char-level cap mirrors the upstream's ~24k token cap.
                    context_str = ("Documents:\n" + ctx_docs)[-24000:]
@@ -1648,15 +1777,23 @@ class ToolOrchestraAgent(LocalCloudAgent):
                # it can still touch the workdir and emit a diff.
                expert_fn = _paper_expert_for if paper_mode else _expert_for
                worker = expert_fn(
-                    "answer-1", self._local_model, self._local_endpoint,
-                    self._cloud_model, self._cloud_endpoint,
+                    "answer-1",
+                    self._local_model,
+                    self._local_endpoint,
+                    self._cloud_model,
+                    self._cloud_endpoint,
                )
                fb_bash_turns = 0
                if swe_mode and shared_workdir is not None:
-                    (ans, w_in, w_out, is_local, extra_cost,
-                     _, fb_bash_turns) = _swe_call_worker(
-                        worker, question, cfg, task_meta,
-                        shared_workdir, max_turns + 1,
+                    (ans, w_in, w_out, is_local, extra_cost, _, fb_bash_turns) = (
+                        _swe_call_worker(
+                            worker,
+                            question,
+                            cfg,
+                            task_meta,
+                            shared_workdir,
+                            max_turns + 1,
+                        )
                    )
                    tool_calls += fb_bash_turns
                else:
@@ -1668,19 +1805,21 @@ class ToolOrchestraAgent(LocalCloudAgent):
                else:
                    tokens_cloud += w_in + w_out
                    cost += self.cost_usd(worker["model"], w_in, w_out) + extra_cost
-                history.append({
-                    "role": "worker",
-                    "turn": max_turns + 1,
-                    "tool": "answer",
-                    "slot": "answer-1",
-                    "worker_model": worker["model"],
-                    "worker_type": worker["type"],
-                    "output": ans,
-                    "tokens_in": w_in,
-                    "tokens_out": w_out,
-                    "bash_turns": fb_bash_turns,
-                    "fallback": True,
-                })
+                history.append(
+                    {
+                        "role": "worker",
+                        "turn": max_turns + 1,
+                        "tool": "answer",
+                        "slot": "answer-1",
+                        "worker_model": worker["model"],
+                        "worker_type": worker["type"],
+                        "output": ans,
+                        "tokens_in": w_in,
+                        "tokens_out": w_out,
+                        "bash_turns": fb_bash_turns,
+                        "fallback": True,
+                    }
+                )
                final_answer = ans

            # In SWE mode, the authoritative output is the working-tree diff —
@@ -1690,7 +1829,8 @@ class ToolOrchestraAgent(LocalCloudAgent):
                if patch.strip():
                    final_answer = (
                        f"{final_answer}\n\n```diff\n{patch}```"
-                        if final_answer else f"```diff\n{patch}```"
+                        if final_answer
+                        else f"```diff\n{patch}```"
                    )

            meta = {
@@ -19,6 +19,7 @@ from openjarvis.agents.prompt_loader import (
 from openjarvis.core.events import EventBus
 from openjarvis.core.registry import AgentRegistry
 from openjarvis.core.types import Message, Role, ToolCall, ToolResult
+from openjarvis.engine._base import estimate_prompt_tokens
 from openjarvis.engine._stubs import InferenceEngine
 from openjarvis.tools._stubs import BaseTool, build_tool_descriptions

@@ -116,8 +117,7 @@ class NativeOpenHandsAgent(ToolUsingAgent):
        max_prompt_tokens: int = 3000,
    ) -> list[Message]:
        """Truncate messages if estimated token count exceeds limit."""
-        total_chars = sum(len(m.content) for m in messages)
-        estimated_tokens = total_chars // 4
+        estimated_tokens = estimate_prompt_tokens(messages)
        if estimated_tokens <= max_prompt_tokens:
            return messages
        # Find the last user message and truncate its content
@@ -125,7 +125,7 @@ class NativeOpenHandsAgent(ToolUsingAgent):
            if messages[i].role == Role.USER:
                excess_tokens = estimated_tokens - max_prompt_tokens
                excess_chars = excess_tokens * 4
-                original = messages[i].content
+                original = messages[i].content or ""
                if len(original) > excess_chars + 200:
                    truncated = original[: len(original) - excess_chars]
                    messages[i] = Message(
@@ -258,7 +258,7 @@ class NativeOpenHandsAgent(ToolUsingAgent):
                # still emitted before re-raising.
                self._emit_turn_end(turns=1, error=True)
                raise
-            content = self._strip_think_tags(result.get("content", ""))
+            content = self._strip_think_tags(result.get("content") or "")
            usage = result.get("usage", {})
            self._emit_turn_end(turns=1)
            return AgentResult(
@@ -315,7 +315,7 @@ class NativeOpenHandsAgent(ToolUsingAgent):
            for k in total_usage:
                total_usage[k] += usage.get(k, 0)

-            content = result.get("content", "")
+            content = result.get("content") or ""
            # Strip think tags so they don't interfere with parsing
            content = self._strip_think_tags(content)
            last_content = content
@@ -327,9 +327,7 @@ class OpenCodeAgent(BaseAgent):
            self._ensure_server()
        except RuntimeError as exc:
            self._emit_turn_end(turns=1, error=True)
-            return AgentResult(
-                content=str(exc), turns=1, metadata={"error": True}
-            )
+            return AgentResult(content=str(exc), turns=1, metadata={"error": True})

        data: dict = {}
        turn_parts: List[dict] = []
@@ -2,7 +2,8 @@

 A small, self-contained planner-executor loop:

-* the planner is a local Ollama chat model (default ``gemma4:31b``),
+* the planner is supplied by the caller (the web endpoint resolves it from
+  config, falling back to ``gemma4:31b`` on Ollama for legacy installs),
 * the only tool it can call is :meth:`HybridSearch.search`,
 * it gets up to ``max_iterations`` tool calls,
 * tool results are trimmed before re-entering the context window, and
@@ -105,8 +106,8 @@ SEARCH_TOOL_SPEC: Dict[str, Any] = {
                    "type": "array",
                    "description": (
                        "Restrict the search to one or more connectors. Use this "
-                        "whenever the user names a data source (e.g. \"in my "
-                        "Granola notes\" → ['granola']; \"check Slack and Gmail\" "
+                        'whenever the user names a data source (e.g. "in my '
+                        'Granola notes" → [\'granola\']; "check Slack and Gmail" '
                        "→ ['slack', 'gmail']). Valid IDs include: gmail, slack, "
                        "granola, notion, obsidian, gcalendar, gdrive, gmail_imap, "
                        "outlook, imessage, whatsapp, apple_notes, apple_contacts, "
@@ -142,10 +143,11 @@ Strategy:
  3. The `time_range` argument is a JSON object: `{{"start": "<ISO 8601>", "end": "<ISO 8601>"}}`. Either bound may be omitted, but pass at least one whenever the user gave you a temporal cue.
  4. When the user names a specific data source — "my Granola notes", "in Slack", "from my email" — you MUST pass `sources=[...]` with the matching connector ID. Only use IDs that appear in the connected-sources list above; do NOT invent or assume sources that are not connected. Common synonyms: "meeting notes"/"meetings"/"transcripts" → granola; "email"/"inbox" → gmail; "DMs"/"channels" → slack. Without this filter the search returns mail/messages ABOUT a tool instead of records FROM that tool.
  4a. Never apologize about sources that aren't in the connected-sources list — if the user asks about "Notion" but Notion isn't connected, just say "Notion isn't connected, but here's what I found in {available_sources}" and answer from what is available.
-  5. If the first structured search returns nothing useful, broaden with a semantic query and drop filters one at a time.
-  6. You have a clarify tool. Only use it AFTER at least one search attempt. Use it when: you found multiple ambiguous matches (e.g. 3 different people named John), search returned zero results and the query might need reframing, or the scope is too broad to synthesize meaningfully. Never use clarify before searching — always try first.
-  7. After receiving a clarify response, use the information to construct a precise search with the correct person, time_range, sources, and query parameters. Never send an empty query or a query with no parameters — extract every concrete signal from the user's reply (names, dates, topics, sources) and put it on the call.
-  8. Tool calls — search AND clarify — share a budget of 5 total. Spend wisely.
+  5. When the user asks for "next", "upcoming", "future", or "soon" calendar events/meetings/appointments, use `sources=["gcalendar"]` if gcalendar is connected, set `time_range={{"start": "{today}"}}`, and use `query=""` unless the user gave a specific topic such as "dentist" or "music lesson". This returns the nearest upcoming calendar items across calendars instead of keyword-matching only birthdays or event titles.
+  6. If the first structured search returns nothing useful, broaden with a semantic query and drop filters one at a time.
+  7. You have a clarify tool. Only use it AFTER at least one search attempt. Use it when: you found multiple ambiguous matches (e.g. 3 different people named John), search returned zero results and the query might need reframing, or the scope is too broad to synthesize meaningfully. Never use clarify before searching — always try first.
+  8. After receiving a clarify response, use the information to construct a precise search with the correct person, time_range, sources, and query parameters. Only use an empty query when structured filters carry the request; never send a search with no concrete parameters. Extract every concrete signal from the user's reply (names, dates, topics, sources) and put it on the call.
+  9. Tool calls — search AND clarify — share a budget of 5 total. Spend wisely.

 Synthesis rules:
  - Cite sources as individual numbers in square brackets. Always separate — write [4] [7] [20], never [4, 7, 20]. Never format citations as markdown links. Just the number in brackets: [1]. The `ref` field on each hit is the citation number.
@@ -204,7 +206,9 @@ def shape_results_for_model(
        if i < detailed_top:
            base["snippet"] = h.content_snippet
            if h.thread_context:
-                base["thread"] = _trim_thread_context(h.thread_context, thread_ctx_per_hit)
+                base["thread"] = _trim_thread_context(
+                    h.thread_context, thread_ctx_per_hit
+                )
        out_hits.append(base)
    return {
        "num_results": len(hits),
@@ -219,7 +223,9 @@ def _hit_date(timestamp: str) -> str:
    if not timestamp:
        return ""
    try:
-        return datetime.fromisoformat(timestamp.replace("Z", "+00:00")).date().isoformat()
+        return (
+            datetime.fromisoformat(timestamp.replace("Z", "+00:00")).date().isoformat()
+        )
    except (ValueError, AttributeError):
        return str(timestamp)[:10]

@@ -237,7 +243,7 @@ def _bare_doc_id(source: str, document_id: str) -> str:
        return ""
    prefix = f"{source}:"
    if source and document_id.startswith(prefix):
-        return document_id[len(prefix):]
+        return document_id[len(prefix) :]
    return document_id


@@ -518,6 +524,7 @@ class ResearchAgent:
    def _parse_time_range(raw: Any):
        if not raw or not isinstance(raw, dict):
            return None
+
        def _maybe(v):
            if not v:
                return None
@@ -525,6 +532,7 @@ class ResearchAgent:
                return datetime.fromisoformat(str(v).replace("Z", "+00:00"))
            except ValueError:
                return None
+
        start = _maybe(raw.get("start"))
        end = _maybe(raw.get("end"))
        if start is None and end is None:
@@ -555,9 +563,16 @@ class ResearchAgent:
                "query": query,
                "person": person,
                "time_range": (
-                    {"start": time_range[0].isoformat() if time_range and time_range[0] else None,
-                     "end": time_range[1].isoformat() if time_range and time_range[1] else None}
-                    if time_range else None
+                    {
+                        "start": time_range[0].isoformat()
+                        if time_range and time_range[0]
+                        else None,
+                        "end": time_range[1].isoformat()
+                        if time_range and time_range[1]
+                        else None,
+                    }
+                    if time_range
+                    else None
                ),
                "sources": sources,
                "limit": limit,
@@ -688,9 +703,7 @@ class ResearchAgent:
                    )
                    continue
                fallback = "(model returned no content and no tool calls)"
-                self._emit(
-                    {"type": "final_answer", "text": fallback, "sources": []}
-                )
+                self._emit({"type": "final_answer", "text": fallback, "sources": []})
                return ResearchResult(
                    answer=fallback,
                    iterations=iterations,
@@ -716,7 +729,11 @@ class ResearchAgent:
                name = tc.get("name", "")
                raw_args = tc.get("arguments", "{}") or "{}"
                try:
-                    args = json.loads(raw_args) if isinstance(raw_args, str) else dict(raw_args)
+                    args = (
+                        json.loads(raw_args)
+                        if isinstance(raw_args, str)
+                        else dict(raw_args)
+                    )
                except json.JSONDecodeError:
                    args = {}

@@ -764,7 +781,10 @@ class ResearchAgent:
                        )
                    else:
                        self._emit(
-                            {"type": "clarify_call", "question": str(args.get("question", ""))}
+                            {
+                                "type": "clarify_call",
+                                "question": str(args.get("question", "")),
+                            }
                        )
                        inv = self._execute_clarify(args)
                        invocations.append(inv)
@@ -843,9 +863,7 @@ class ResearchAgent:
                "and the model returned no text response)"
            )
        answer, final_sources = _finalize(answer)
-        self._emit(
-            {"type": "final_answer", "text": answer, "sources": final_sources}
-        )
+        self._emit({"type": "final_answer", "text": answer, "sources": final_sources})
        return ResearchResult(
            answer=answer,
            iterations=iterations,
@@ -72,15 +72,16 @@ class _OAuth1Auth:
            all_params[key] = value

        param_str = "&".join(
-            f"{_pct(k)}={_pct(v)}"
-            for k, v in sorted(all_params.items())
+            f"{_pct(k)}={_pct(v)}" for k, v in sorted(all_params.items())
        )
        base_string = f"{method}&{_pct(base_url)}&{_pct(param_str)}"

        signing_key = f"{_pct(self._consumer_secret)}&{_pct(self._access_secret)}"
        signature = base64.b64encode(
            hmac.new(
-                signing_key.encode(), base_string.encode(), hashlib.sha1,
+                signing_key.encode(),
+                base_string.encode(),
+                hashlib.sha1,
            ).digest(),
        ).decode()

@@ -146,7 +147,8 @@ class TwitterChannel(BaseChannel):
        self._api_secret = api_secret or os.environ.get("TWITTER_API_SECRET", "")
        self._access_token = access_token or os.environ.get("TWITTER_ACCESS_TOKEN", "")
        self._access_secret = access_secret or os.environ.get(
-            "TWITTER_ACCESS_SECRET", "",
+            "TWITTER_ACCESS_SECRET",
+            "",
        )
        self._bot_user_id = bot_user_id or os.environ.get("TWITTER_BOT_USER_ID", "")
        self._poll_interval = poll_interval
@@ -162,8 +164,10 @@ class TwitterChannel(BaseChannel):

    def _oauth(self) -> _OAuth1Auth:
        return _OAuth1Auth(
-            self._api_key, self._api_secret,
-            self._access_token, self._access_secret,
+            self._api_key,
+            self._api_secret,
+            self._access_token,
+            self._access_secret,
        )

    # -- connection lifecycle -----------------------------------------------
@@ -179,7 +183,8 @@ class TwitterChannel(BaseChannel):
        self._status = ChannelStatus.CONNECTING

        self._listener_thread = threading.Thread(
-            target=self._poll_mentions, daemon=True,
+            target=self._poll_mentions,
+            daemon=True,
        )
        self._listener_thread.start()
        self._status = ChannelStatus.CONNECTED
@@ -276,7 +281,10 @@ class TwitterChannel(BaseChannel):
                    params["since_id"] = self._since_id

                resp = httpx.get(
-                    url, headers=headers, params=params, timeout=10.0,
+                    url,
+                    headers=headers,
+                    params=params,
+                    timeout=10.0,
                )
                if resp.status_code < 300:
                    data = resp.json()
@@ -9,12 +9,12 @@ from __future__ import annotations
 # readable capital J (the bottom-left \___/ hook), unlike the cramped prior
 # art where the J read as an I.
 _WORDMARK = (
-    '  ___                       _                  _     ',
-    ' / _ \\ _ __   ___ _ __     | | __ _ _ ____   _(_)___ ',
+    "  ___                       _                  _     ",
+    " / _ \\ _ __   ___ _ __     | | __ _ _ ____   _(_)___ ",
    "| | | | '_ \\ / _ \\ '_ \\ _  | |/ _` | '__\\ \\ / / / __|",
-    '| |_| | |_) |  __/ | | | |_| | (_| | |   \\ V /| \\__ \\',
-    ' \\___/| .__/ \\___|_| |_|\\___/ \\__,_|_|    \\_/ |_|___/',
-    '      |_|                                            ',
+    "| |_| | |_) |  __/ | | | |_| | (_| | |   \\ V /| \\__ \\",
+    " \\___/| .__/ \\___|_| |_|\\___/ \\__,_|_|    \\_/ |_|___/",
+    "      |_|                                            ",
 )

 _TAGLINE = "Personal AI, On Personal Devices"
@@ -20,6 +20,7 @@ from openjarvis.core.events import EventBus, EventType
 from openjarvis.core.types import Message, Role
 from openjarvis.engine import (
    EngineConnectionError,
+    EngineContextLengthError,
    discover_engines,
    discover_models,
    get_engine,
@@ -881,6 +882,11 @@ def ask(
                capability_policy=sec.capability_policy,
                memory_files_config=effective_mf,
            )
+        except EngineContextLengthError as exc:
+            # Not a reachability problem — pointing the user at server/host
+            # config (hint_no_engine) would be misleading here.
+            console.print(f"[red]{exc}[/red]")
+            sys.exit(1)
        except EngineConnectionError as exc:
            console.print(f"[red]Engine error:[/red] {exc}")
            console.print(hint_no_engine())
@@ -990,6 +996,11 @@ def ask(
                temperature=temperature,
                max_tokens=max_tokens,
            )
+    except EngineContextLengthError as exc:
+        # Not a reachability problem — pointing the user at server/host
+        # config (hint_no_engine) would be misleading here.
+        console.print(f"[red]{exc}[/red]")
+        sys.exit(1)
    except EngineConnectionError as exc:
        console.print(f"[red]Engine error:[/red] {exc}")
        console.print(hint_no_engine())
@@ -11,7 +11,9 @@ from rich.markdown import Markdown

 from openjarvis.cli._tool_names import resolve_tool_names
 from openjarvis.core.config import load_config
+from openjarvis.core.events import EventBus
 from openjarvis.core.types import Message, Role
+from openjarvis.memory import publish_completed_exchange


 def _read_input(prompt: str = "You> ") -> Optional[str]:
@@ -57,6 +59,7 @@ def chat(
    console = Console(stderr=True)

    config = load_config()
+    bus = EventBus(record_history=False)

    import dataclasses as _dc

@@ -97,12 +100,11 @@ def chat(
    if agent_key and agent_key != "none":
        try:
            import openjarvis.agents  # noqa: F401 — trigger registration
-            from openjarvis.core.events import EventBus
            from openjarvis.core.registry import AgentRegistry

            if AgentRegistry.contains(agent_key):
                agent_cls = AgentRegistry.get(agent_key)
-                kwargs: dict = {"bus": EventBus()}
+                kwargs: dict = {"bus": bus}

                if getattr(agent_cls, "accepts_tools", False):
                    tool_names_list = resolve_tool_names(
@@ -184,7 +186,7 @@ def chat(
    try:
        from openjarvis.memory import build_memory_service

-        memory_service = build_memory_service(config, engine, model)
+        memory_service = build_memory_service(config, engine, model, event_bus=bus)
        if memory_service is not None:
            memory_service.start()
            console.print("[dim]  Memory: active[/dim]")
@@ -280,9 +282,12 @@ def chat(
            console.print(Markdown(content))
            console.print()

-            # Hand the exchange to the memory service (non-blocking).
-            if memory_service is not None:
-                memory_service.submit(user_input, content)
+            publish_completed_exchange(
+                bus,
+                user_input,
+                content,
+                source="cli.chat",
+            )
        except KeyboardInterrupt:
            console.print("\n[dim]Generation interrupted.[/dim]")
        except Exception as exc:
@@ -498,7 +498,12 @@ def serve(
    try:
        from openjarvis.memory import build_memory_service

-        memory_service = build_memory_service(config, engine, model_name)
+        memory_service = build_memory_service(
+            config,
+            engine,
+            model_name,
+            event_bus=bus,
+        )
        if memory_service is not None:
            memory_service.start()
            console.print("  Memory svc: [cyan]active[/cyan]")
@@ -199,7 +199,16 @@ def _get_resolver(source: str, url: str = ""):
    default="",
    help="Repo URL (required when source is 'github').",
 )
-def install(query: str, with_scripts: bool, force: bool, url: str):
+@click.option(
+    "--yes-dangerous",
+    is_flag=True,
+    default=False,
+    help=(
+        "Confirm installing an unreviewed skill that requests dangerous "
+        "capabilities (shell/network-listen/filesystem-write)."
+    ),
+)
+def install(query: str, with_scripts: bool, force: bool, url: str, yes_dangerous: bool):
    """Install a skill from a source.

    Example: ``jarvis skill install hermes:apple-notes``
@@ -233,7 +242,12 @@ def install(query: str, with_scripts: bool, force: bool, url: str):
    from openjarvis.skills.tool_translator import ToolTranslator

    importer = SkillImporter(parser=SkillParser(), tool_translator=ToolTranslator())
-    result = importer.import_skill(matches[0], with_scripts=with_scripts, force=force)
+    result = importer.import_skill(
+        matches[0],
+        with_scripts=with_scripts,
+        force=force,
+        confirm_dangerous=yes_dangerous,
+    )

    if result.success:
        if result.skipped:
@@ -270,6 +284,15 @@ def install(query: str, with_scripts: bool, force: bool, url: str):
    help="Import scripts/ directories.",
 )
@click.option("--force", is_flag=True, default=False, help="Re-import existing skills.")
+@click.option(
+    "--yes-dangerous",
+    is_flag=True,
+    default=False,
+    help=(
+        "Confirm installing unreviewed skills that request dangerous "
+        "capabilities (shell/network-listen/filesystem-write)."
+    ),
+)
 def sync(
    source: str,
    category: str,
@@ -277,6 +300,7 @@ def sync(
    search: str,
    with_scripts: bool,
    force: bool,
+    yes_dangerous: bool,
 ):
    """Bulk install + update from a source (or all configured sources)."""
    console = Console()
@@ -343,9 +367,20 @@ def sync(

        installed_count = 0
        for resolved in skills_to_import:
-            r = importer.import_skill(resolved, with_scripts=with_scripts, force=force)
+            r = importer.import_skill(
+                resolved,
+                with_scripts=with_scripts,
+                force=force,
+                confirm_dangerous=yes_dangerous,
+            )
            if r.success and not r.skipped:
                installed_count += 1
+            elif not r.success and r.requires_confirmation:
+                console.print(
+                    f"  [yellow]Skipped {resolved.name}: requests dangerous "
+                    f"capabilities {r.dangerous_capabilities} "
+                    "(re-run with --yes-dangerous to install)[/yellow]"
+                )
        console.print(f"  Imported {installed_count}/{len(skills_to_import)} skills")
        total_installed += installed_count

@@ -124,7 +124,8 @@ class OllamaEmbedder:
        elif arr.shape[0] != self._dim:
            logger.warning(
                "OllamaEmbedder.embed: dim drift (expected %d, got %d)",
-                self._dim, arr.shape[0],
+                self._dim,
+                arr.shape[0],
            )
            return None
        return arr.tobytes()
@@ -143,9 +144,7 @@ class OllamaEmbedder:
 # ---------------------------------------------------------------------------


-def decode_embedding(
-    blob: Optional[bytes], *, dtype=None
-) -> Optional[np.ndarray]:
+def decode_embedding(blob: Optional[bytes], *, dtype=None) -> Optional[np.ndarray]:
    """Reconstruct a 1-D vector from a BLOB written by ``OllamaEmbedder.embed``.

    Returns ``None`` when the input is missing or zero-length so callers can
@@ -213,12 +213,13 @@ def _parse_event_timestamp(event: Dict[str, Any]) -> datetime:
    """
    start = event.get("start", {})
    date_time_str: str = start.get("dateTime", "")
-    if not date_time_str:
+    date_str: str = start.get("date", "")
+    if not date_time_str and not date_str:
        return datetime.now()
    try:
        # RFC3339 — Python 3.11+ fromisoformat handles the trailing 'Z'.
        # For older versions we replace 'Z' with '+00:00'.
-        normalized = date_time_str.replace("Z", "+00:00")
+        normalized = (date_time_str or date_str).replace("Z", "+00:00")
        return datetime.fromisoformat(normalized)
    except (ValueError, TypeError):
        return datetime.now()
@@ -345,9 +345,7 @@ class GranolaConnector(BaseConnector):

                attendees: List[Dict[str, Any]] = note.get("attendees") or []
                participants: List[str] = [
-                    (a.get("email") or "").lower()
-                    for a in attendees
-                    if a.get("email")
+                    (a.get("email") or "").lower() for a in attendees if a.get("email")
                ]
                participants_raw: List[str] = [
                    a.get("name") or a.get("email") or ""
@@ -20,8 +20,9 @@ from __future__ import annotations

 import json
 import logging
+import re
 from dataclasses import dataclass, field
-from datetime import datetime
+from datetime import date, datetime, timedelta, timezone
 from typing import Any, Dict, List, Optional, Sequence, Tuple

 # numpy imported lazily inside _vector_recall (see embeddings.py) so importing
@@ -32,6 +33,65 @@ from openjarvis.connectors.store import KnowledgeStore
 logger = logging.getLogger(__name__)


+_UPCOMING_TERMS = {
+    "next",
+    "upcoming",
+    "future",
+    "forthcoming",
+    "coming",
+    "soon",
+}
+_CALENDAR_TERMS = {
+    "calendar",
+    "calendars",
+    "event",
+    "events",
+}
+_CALENDAR_REQUEST_TERMS = _CALENDAR_TERMS | {
+    "appointment",
+    "appointments",
+    "meeting",
+    "meetings",
+    "schedule",
+}
+_GCALENDAR_GENERIC_TERMS = (
+    _UPCOMING_TERMS
+    | _CALENDAR_TERMS
+    | {
+        "appointment",
+        "appointments",
+        "meeting",
+        "meetings",
+        "schedule",
+    }
+)
+_QUERY_STOPWORDS = {
+    "a",
+    "all",
+    "am",
+    "are",
+    "do",
+    "for",
+    "have",
+    "i",
+    "in",
+    "is",
+    "list",
+    "me",
+    "my",
+    "on",
+    "s",
+    "show",
+    "tell",
+    "the",
+    "there",
+    "to",
+    "what",
+    "whats",
+    "when",
+}
+
+
 # ---------------------------------------------------------------------------
 # Result types
 # ---------------------------------------------------------------------------
@@ -120,6 +180,101 @@ def _snippet(content: str, max_chars: int = 500) -> str:
    return flat[:max_chars].rstrip() + "…"


+def _query_tokens(query: str) -> set[str]:
+    return set(re.findall(r"[a-z0-9_]+", query.lower()))
+
+
+def _sources_include_gcalendar(sources: Optional[Sequence[str]]) -> bool:
+    return any(str(source).lower() == "gcalendar" for source in sources or [])
+
+
+def _has_upcoming_calendar_intent(
+    query: str,
+    sources: Optional[Sequence[str]],
+) -> bool:
+    tokens = _query_tokens(query)
+    if not tokens or not (tokens & _UPCOMING_TERMS):
+        return False
+    if _sources_include_gcalendar(sources):
+        return True
+    if sources:
+        return False
+    return bool(tokens & _CALENDAR_REQUEST_TERMS)
+
+
+def _is_generic_calendar_timeline_query(query: str) -> bool:
+    tokens = _query_tokens(query)
+    if not tokens:
+        return True
+    topic_tokens = tokens - _GCALENDAR_GENERIC_TERMS - _QUERY_STOPWORDS
+    return not topic_tokens
+
+
+def _start_is_nowish_or_future(start: Optional[datetime]) -> bool:
+    if start is None:
+        return False
+    now = datetime.now(tz=start.tzinfo) if start.tzinfo else datetime.now()
+    return start >= now - timedelta(days=1)
+
+
+def _start_of_day(ts: datetime) -> datetime:
+    return ts.replace(hour=0, minute=0, second=0, microsecond=0)
+
+
+def _as_utc(ts: Optional[datetime]) -> Optional[datetime]:
+    if ts is None:
+        return None
+    if ts.tzinfo is None:
+        return ts.replace(tzinfo=timezone.utc)
+    return ts.astimezone(timezone.utc)
+
+
+def _parse_timestamp_for_timeline(
+    raw: Any,
+) -> Tuple[Optional[datetime], Optional[date]]:
+    if raw is None:
+        return None, None
+    text = str(raw).strip()
+    if not text:
+        return None, None
+    try:
+        parsed = datetime.fromisoformat(text.replace("Z", "+00:00"))
+    except ValueError:
+        return None, None
+    is_naive_midnight = (
+        parsed.tzinfo is None
+        and parsed.hour == 0
+        and parsed.minute == 0
+        and parsed.second == 0
+        and parsed.microsecond == 0
+    )
+    return _as_utc(parsed), parsed.date() if is_naive_midnight else None
+
+
+def _timestamp_in_range(
+    timestamp: Optional[datetime],
+    time_range: Optional[Tuple[Optional[datetime], Optional[datetime]]],
+    *,
+    all_day_date: Optional[date] = None,
+) -> bool:
+    if timestamp is None or time_range is None:
+        return timestamp is not None
+    start, end = time_range
+    if all_day_date is not None:
+        if start is not None and all_day_date < start.date():
+            return False
+        if end is not None and all_day_date > end.date():
+            return False
+        return True
+    start_utc = _as_utc(start)
+    end_utc = _as_utc(end)
+    if start_utc is not None and timestamp < start_utc:
+        return False
+    if end_utc is not None and timestamp > end_utc:
+        return False
+    return True
+
+
 # ---------------------------------------------------------------------------
 # HybridSearch
 # ---------------------------------------------------------------------------
@@ -377,6 +532,127 @@ class HybridSearch:
            for r in rows
        ]

+    def _normalise_calendar_timeline_scope(
+        self,
+        query: str,
+        time_range: Optional[Tuple[Optional[datetime], Optional[datetime]]],
+        sources: Optional[Sequence[str]],
+    ) -> Tuple[
+        Optional[Tuple[Optional[datetime], Optional[datetime]]],
+        Optional[Sequence[str]],
+        bool,
+        bool,
+    ]:
+        """Fill in structured filters for generic upcoming-calendar requests.
+
+        Queries like "what are my next calendar events?" often have no useful
+        lexical terms in the stored event text, so BM25/vector ranking can miss
+        nearby events. Treat that shape as a source-filtered timeline request.
+        """
+        scoped_sources = list(sources) if sources else None
+        has_upcoming_intent = _has_upcoming_calendar_intent(query, scoped_sources)
+
+        if has_upcoming_intent and (
+            scoped_sources is None or _sources_include_gcalendar(scoped_sources)
+        ):
+            scoped_sources = ["gcalendar"]
+
+        if not _sources_include_gcalendar(scoped_sources):
+            return time_range, scoped_sources, False, False
+
+        if has_upcoming_intent:
+            if time_range is None:
+                time_range = (_start_of_day(datetime.now(timezone.utc)), None)
+            else:
+                start, end = time_range
+                if start is None:
+                    time_range = (_start_of_day(datetime.now(timezone.utc)), end)
+                else:
+                    time_range = (_start_of_day(start), end)
+
+        chronological = has_upcoming_intent or (
+            time_range is not None
+            and time_range[1] is None
+            and _start_is_nowish_or_future(time_range[0])
+        )
+        metadata_only = chronological and _is_generic_calendar_timeline_query(query)
+        return time_range, scoped_sources, chronological, metadata_only
+
+    def _calendar_timeline_ids(
+        self,
+        *,
+        person: Optional[str],
+        time_range: Optional[Tuple[Optional[datetime], Optional[datetime]]],
+        sources: Optional[Sequence[str]],
+        limit: int,
+    ) -> List[str]:
+        """Return gcalendar rows sorted by normalized event start time."""
+        filter_sql, filter_params = self._build_filters(
+            person=person,
+            time_range=None,
+            sources=sources,
+        )
+        rows = self._store._conn.execute(
+            f"""
+            SELECT id, timestamp, created_at
+            FROM knowledge_chunks
+            WHERE {filter_sql}
+            """,
+            filter_params,
+        ).fetchall()
+
+        candidates: List[Tuple[str, datetime, float]] = []
+        for row in rows:
+            timestamp, all_day_date = _parse_timestamp_for_timeline(row["timestamp"])
+            if not _timestamp_in_range(
+                timestamp,
+                time_range,
+                all_day_date=all_day_date,
+            ):
+                continue
+            candidates.append(
+                (
+                    row["id"],
+                    timestamp or datetime.max.replace(tzinfo=timezone.utc),
+                    float(row["created_at"] or 0.0),
+                )
+            )
+
+        candidates.sort(key=lambda item: (item[1], item[2]))
+        return [chunk_id for chunk_id, *_ in candidates[:limit]]
+
+    def _filter_calendar_timeline_fused(
+        self,
+        fused: List[Tuple[str, float, float, float]],
+        time_range: Optional[Tuple[Optional[datetime], Optional[datetime]]],
+    ) -> List[Tuple[str, float, float, float]]:
+        """Apply normalized timestamp filtering to ranked calendar candidates."""
+        if not fused:
+            return fused
+        ids = [chunk_id for chunk_id, *_ in fused]
+        placeholders = ",".join("?" for _ in ids)
+        rows = self._store._conn.execute(
+            f"""
+            SELECT id, timestamp
+            FROM knowledge_chunks
+            WHERE id IN ({placeholders})
+            """,
+            ids,
+        ).fetchall()
+        timestamps = {
+            row["id"]: _parse_timestamp_for_timeline(row["timestamp"]) for row in rows
+        }
+
+        def _keeps_item(item: Tuple[str, float, float, float]) -> bool:
+            timestamp, all_day_date = timestamps.get(item[0], (None, None))
+            return _timestamp_in_range(
+                timestamp,
+                time_range,
+                all_day_date=all_day_date,
+            )
+
+        return [item for item in fused if _keeps_item(item)]
+
    # ------------------------------------------------------------------
    # Public entry point
    # ------------------------------------------------------------------
@@ -396,42 +672,65 @@ class HybridSearch:
        when callers want a pure metadata filter (e.g. "all mail from X in
        May") — in that case only the vector leg runs (and only if an
        embedder is configured); if neither leg yields anything the
-        structured filter is applied directly and the most recent rows are
-        returned.
+        structured filter is applied directly. Upcoming calendar timelines are
+        returned nearest-first; other fallbacks return the most recent rows.
        """
+        time_range, sources, chronological_order, metadata_only = (
+            self._normalise_calendar_timeline_scope(query, time_range, sources)
+        )
+        rank_query = "" if metadata_only else query
+        calendar_timeline = chronological_order and _sources_include_gcalendar(sources)
+        recall_time_range = None if calendar_timeline else time_range
+
        bm25_filter_sql, bm25_filter_params = self._build_filters(
-            person=person, time_range=time_range, sources=sources, alias="kc"
+            person=person, time_range=recall_time_range, sources=sources, alias="kc"
        )
        unaliased_filter_sql, unaliased_filter_params = self._build_filters(
-            person=person, time_range=time_range, sources=sources
+            person=person, time_range=recall_time_range, sources=sources
        )

        bm25 = (
-            self._bm25_recall(query, bm25_filter_sql, bm25_filter_params)
-            if query.strip()
+            self._bm25_recall(rank_query, bm25_filter_sql, bm25_filter_params)
+            if rank_query.strip()
            else []
        )
        vector = (
-            self._vector_recall(query, unaliased_filter_sql, unaliased_filter_params)
-            if query.strip()
+            self._vector_recall(
+                rank_query,
+                unaliased_filter_sql,
+                unaliased_filter_params,
+            )
+            if rank_query.strip()
            else []
        )
        fused = self._fuse(bm25, vector)
+        if calendar_timeline:
+            fused = self._filter_calendar_timeline_fused(fused, time_range)

        # Metadata-only fallback: empty query, or both legs produced nothing
-        # despite a non-empty query. Return the most recent rows matching the
-        # filter so the agent still gets a useful corpus snapshot.
+        # despite a non-empty query. Calendar timeline requests use start-time
+        # ascending; other searches use recency so the agent still gets a
+        # useful corpus snapshot.
        if not fused:
-            sql = f"""
-                SELECT id FROM knowledge_chunks
-                WHERE {unaliased_filter_sql}
-                ORDER BY timestamp DESC, created_at DESC
-                LIMIT ?
-            """
-            rows = self._store._conn.execute(
-                sql, [*unaliased_filter_params, limit]
-            ).fetchall()
-            fused = [(row["id"], 0.0, 0.0, 0.0) for row in rows]
+            if calendar_timeline:
+                chunk_ids = self._calendar_timeline_ids(
+                    person=person,
+                    time_range=time_range,
+                    sources=sources,
+                    limit=limit,
+                )
+                fused = [(chunk_id, 0.0, 0.0, 0.0) for chunk_id in chunk_ids]
+            else:
+                sql = f"""
+                    SELECT id FROM knowledge_chunks
+                    WHERE {unaliased_filter_sql}
+                    ORDER BY timestamp DESC, created_at DESC
+                    LIMIT ?
+                """
+                rows = self._store._conn.execute(
+                    sql, [*unaliased_filter_params, limit]
+                ).fetchall()
+                fused = [(row["id"], 0.0, 0.0, 0.0) for row in rows]

        # Materialise the top-N rows in one IN-clause round trip.
        top = fused[:limit]
@@ -48,7 +48,7 @@ def _derive_source_id(doc: Document) -> str:
        return doc.source_id
    prefix = f"{doc.source}:"
    if doc.doc_id.startswith(prefix):
-        return doc.doc_id[len(prefix):]
+        return doc.doc_id[len(prefix) :]
    return doc.doc_id


@@ -56,6 +56,7 @@ def _content_hash(text: str) -> str:
    """SHA-256 hex digest of UTF-8-encoded chunk content."""
    return hashlib.sha256(text.encode("utf-8")).hexdigest()

+
 if TYPE_CHECKING:
    from openjarvis.connectors.attachment_store import AttachmentStore

@@ -205,8 +205,7 @@ def _validate_user_token(token: str) -> None:
        raise SlackTokenError("Slack token is empty.")
    if token.startswith(_BOT_TOKEN_PREFIX):
        raise SlackTokenError(
-            "Bot tokens (xoxb-) can't read DMs. "
-            "Use a User OAuth Token (xoxp-) instead."
+            "Bot tokens (xoxb-) can't read DMs. Use a User OAuth Token (xoxp-) instead."
        )
    if not token.startswith(_USER_TOKEN_PREFIX):
        raise SlackTokenError(
@@ -436,9 +435,7 @@ class SlackConnector(BaseConnector):
        all_channels: List[Dict[str, Any]] = []
        channels_cursor = ""
        while True:
-            channels_resp = _slack_api_conversations_list(
-                token, cursor=channels_cursor
-            )
+            channels_resp = _slack_api_conversations_list(token, cursor=channels_cursor)
            if not channels_resp.get("ok", True):
                err = str(channels_resp.get("error", "list_failed"))
                self._last_error = f"Slack conversations.list failed: {err}"
@@ -446,8 +443,7 @@ class SlackConnector(BaseConnector):
                return
            all_channels.extend(channels_resp.get("channels", []))
            channels_cursor = (
-                channels_resp.get("response_metadata", {}).get("next_cursor", "")
-                or ""
+                channels_resp.get("response_metadata", {}).get("next_cursor", "") or ""
            )
            if not channels_cursor:
                break
@@ -593,6 +593,14 @@ class IntelligenceConfig:
    stop_sequences: str = ""  # Comma-separated stop strings


+@dataclass(slots=True)
+class DeepResearchConfig:
+    """Planner settings for the web Deep Research endpoint."""
+
+    engine: str = ""  # Empty means use the active chat engine.
+    model: str = ""  # Empty means use the active chat model.
+
+
@dataclass(slots=True)
 class RoutingLearningConfig:
    """Routing sub-policy config within Learning."""
@@ -932,7 +940,9 @@ class StorageConfig:
    backend: str = "local"  # fact-store backend ("local" = on-disk JSONL)
    extraction_model: str = ""  # model for fact extraction ("" = active model)
    max_facts: int = 1000  # cap on stored facts (oldest evicted past the cap)
-    facts_path: str = str(DEFAULT_CONFIG_DIR / "memory_facts.jsonl")
+    facts_path: str = field(
+        default_factory=lambda: str(get_config_dir() / "memory_facts.jsonl")
+    )


 # Backward-compatibility alias
@@ -1576,6 +1586,7 @@ class JarvisConfig:
    hardware: HardwareInfo = field(default_factory=HardwareInfo)
    engine: EngineConfig = field(default_factory=EngineConfig)
    intelligence: IntelligenceConfig = field(default_factory=IntelligenceConfig)
+    deep_research: DeepResearchConfig = field(default_factory=DeepResearchConfig)
    learning: LearningConfig = field(default_factory=LearningConfig)
    tools: ToolsConfig = field(default_factory=ToolsConfig)
    agent: AgentConfig = field(default_factory=AgentConfig)
@@ -1837,6 +1848,7 @@ def load_config(path: Optional[Path] = None) -> JarvisConfig:
        top_sections = (
            "engine",
            "intelligence",
+            "deep_research",
            "learning",
            "agent",
            "server",
@@ -2005,6 +2017,10 @@ max_tokens = 1024
 # repetition_penalty = 1.0
 # stop_sequences = ""

+# [deep_research]
+# engine = ""                  # empty = use [engine].default
+# model = ""                   # empty = use [intelligence].default_model
+
 [agent]
 default_agent = "simple"
 max_turns = 10
@@ -2175,6 +2191,7 @@ __all__ = [
    "DEFAULT_CONFIG_DIR",
    "DEFAULT_CONFIG_PATH",
    "DiscordChannelConfig",
+    "DeepResearchConfig",
    "get_cache_dir",
    "get_config_dir",
    "get_config_path",
@@ -27,6 +27,7 @@ class EventType(str, Enum):
    TOOL_CALL_END = "tool_call_end"
    MEMORY_STORE = "memory_store"
    MEMORY_RETRIEVE = "memory_retrieve"
+    CHAT_EXCHANGE_COMPLETED = "chat_exchange_completed"
    AGENT_TURN_START = "agent_turn_start"
    AGENT_TURN_END = "agent_turn_end"
    TELEMETRY_RECORD = "telemetry_record"
@@ -11,6 +11,7 @@ from typing import TYPE_CHECKING, Any, Callable, Dict, Generic, Tuple, Type, Typ
 if TYPE_CHECKING:
    from openjarvis.agents._stubs import BaseAgent
    from openjarvis.engine._stubs import InferenceEngine
+    from openjarvis.memory.store import FactStore
    from openjarvis.tools.storage._stubs import MemoryBackend

 T = TypeVar("T")
@@ -109,6 +110,10 @@ class MemoryRegistry(RegistryBase[Type["MemoryBackend"]]):
    """Registry for memory / retrieval backends."""


+class FactStoreRegistry(RegistryBase[Type["FactStore"]]):
+    """Registry for automatic-memory fact store backends."""
+
+
 class AgentRegistry(RegistryBase[Type["BaseAgent"]]):
    """Registry for agent implementations."""

@@ -170,6 +175,7 @@ __all__ = [
    "CompressionRegistry",
    "ConnectorRegistry",
    "EngineRegistry",
+    "FactStoreRegistry",
    "LearningRegistry",
    "MemoryRegistry",
    "MinerRegistry",
@@ -63,7 +63,7 @@ class Message:
    """A single chat message (OpenAI-compatible structure)."""

    role: Role
-    content: str = ""
+    content: str | None = ""
    name: Optional[str] = None
    tool_calls: Optional[List[ToolCall]] = None
    tool_call_id: Optional[str] = None
@@ -73,6 +73,11 @@ class Message:
    # empty for text-only messages (the common case).
    images: Optional[List[str]] = None

+    @property
+    def text(self) -> str:
+        """Return message content as text, treating ``None`` as empty."""
+        return self.content or ""
+

@dataclass(slots=True)
 class Conversation:
@@ -9,7 +9,9 @@ import openjarvis.engine.ollama  # noqa: F401
 import openjarvis.engine.openai_compat_engines  # noqa: F401
 from openjarvis.engine._base import (
    EngineConnectionError,
+    EngineContextLengthError,
    InferenceEngine,
+    looks_like_context_length_error,
    messages_to_dicts,
 )
 from openjarvis.engine._discovery import discover_engines, discover_models, get_engine
@@ -23,9 +25,11 @@ for _optional in ("cloud", "litellm", "gemma_cpp"):

 __all__ = [
    "EngineConnectionError",
+    "EngineContextLengthError",
    "InferenceEngine",
    "discover_engines",
    "discover_models",
    "get_engine",
+    "looks_like_context_length_error",
    "messages_to_dicts",
 ]
@@ -13,6 +13,62 @@ class EngineConnectionError(Exception):
    """Raised when an engine is unreachable."""


+class EngineContextLengthError(EngineConnectionError):
+    """The prompt exceeds the served model's maximum context window.
+
+    Subclasses ``EngineConnectionError`` so existing ``except
+    EngineConnectionError`` handlers keep catching it, while callers that want a
+    distinct, user-facing "conversation too long" message can branch on this type
+    (or the ``is_context_length_error`` marker) instead of surfacing a generic
+    engine failure.
+    """
+
+    is_context_length_error: bool = True
+
+
+# Substrings that identify an error body as a context-window overflow (vLLM,
+# SGLang, and OpenAI-compatible servers phrase this a few different ways).
+# Every marker is anchored on "context" on purpose: generic phrases like
+# "please reduce" or "too many tokens" also appear in unrelated 400 bodies
+# (max_tokens validation, rate limiting, oversized images) and would
+# misclassify those as "conversation too long".
+CONTEXT_LENGTH_MARKERS = (
+    "context length",
+    "maximum context",
+    "context window",
+    "maximum_context",
+    "context_length_exceeded",
+)
+
+
+def looks_like_context_length_error(text: str) -> bool:
+    """True when *text* reads like a context-window overflow error.
+
+    The single shared heuristic for recognizing vendor context-overflow
+    phrasings — used by the engine layer (typing upstream 400s), agent error
+    classification, and the server stream bridge, so a new vendor phrasing
+    only ever needs to be added here.
+    """
+    low = (text or "").lower()
+    return any(marker in low for marker in CONTEXT_LENGTH_MARKERS)
+
+
+_REASONING_METADATA_KEYS = ("reasoning_content", "thinking")
+
+
+def _message_estimated_chars(message: Message) -> int:
+    parts = [message.text]
+    for key in _REASONING_METADATA_KEYS:
+        value = message.metadata.get(key)
+        if isinstance(value, str):
+            parts.append(value)
+    for tc in message.tool_calls or []:
+        parts.extend((tc.id, tc.name, tc.arguments))
+    if message.tool_call_id:
+        parts.append(message.tool_call_id)
+    return sum(len(part) for part in parts)
+
+
 def messages_to_dicts(messages: Sequence[Message]) -> List[Dict[str, Any]]:
    """Convert ``Message`` objects to OpenAI-format dicts."""
    out: List[Dict[str, Any]] = []
@@ -53,17 +109,22 @@ def estimate_prompt_tokens(messages: Sequence[Message]) -> int:
    provider would charge.

    Uses ~4 characters per token (standard BPE average for English) plus
-    a small per-message overhead for role markers and separators.
+    a small per-message overhead for role markers and separators. Counts
+    content, reasoning metadata, tool-call payloads, and tool result IDs
+    because all are replayed into later prompt turns when present.
    """
-    total_chars = sum(len(m.content) for m in messages)
+    total_chars = sum(_message_estimated_chars(m) for m in messages)
    # ~4 tokens overhead per message for role markers / separators
    overhead = len(messages) * 4
    return max(1, total_chars // 4 + overhead)


 __all__ = [
+    "CONTEXT_LENGTH_MARKERS",
    "EngineConnectionError",
+    "EngineContextLengthError",
    "InferenceEngine",
    "estimate_prompt_tokens",
+    "looks_like_context_length_error",
    "messages_to_dicts",
 ]
@@ -0,0 +1,128 @@
+"""Shared async-HTTP plumbing for engines that stream over httpx.
+
+Home of the pieces the OpenAI-compat and Ollama engines were each hand-rolling:
+the async-client factory (with the configured timeout applied), a cached
+long-lived client so consecutive streams reuse pooled connections instead of
+paying a fresh TCP/TLS handshake per turn, the transport-error set that maps to
+``EngineConnectionError``, and the non-2xx → engine-error translation.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import logging
+from typing import NoReturn
+
+import httpx
+
+from openjarvis.engine._base import (
+    EngineConnectionError,
+    EngineContextLengthError,
+    looks_like_context_length_error,
+)
+
+logger = logging.getLogger(__name__)
+
+# Transport failures that map to EngineConnectionError on the streaming paths.
+# ``RemoteProtocolError``/``ReadError`` cover a server dying MID-STREAM (peer
+# closed between tokens); a wedged read trips the configured timeout
+# (TimeoutException). Kept exactly this narrow on purpose:
+# ``asyncio.CancelledError``/``GeneratorExit`` are NOT ``httpx.TransportError``
+# subclasses and must keep propagating for correct cancellation.
+STREAM_TRANSPORT_ERRORS = (
+    httpx.ConnectError,
+    httpx.TimeoutException,
+    httpx.RemoteProtocolError,
+    httpx.ReadError,
+)
+
+_CONTEXT_LENGTH_USER_MESSAGE = (
+    "The conversation is too long for the model's context window. "
+    "Start a new chat or shorten the conversation, then try again."
+)
+
+
+class AsyncHTTPEngineMixin:
+    """Async streaming plumbing shared by httpx-backed engines.
+
+    Expects the engine to provide ``engine_id``, ``_host``, ``_timeout``, an
+    ``_async_transport`` test seam (``httpx.MockTransport`` in tests, ``None``
+    in production), and optionally ``_headers``.
+    """
+
+    engine_id: str
+    _host: str
+    _timeout: float
+    _async_transport: httpx.AsyncBaseTransport | None
+
+    # Set True by engines whose upstream reports context-window overflows in
+    # 400 bodies (OpenAI-compat servers). Ollama has no such signal.
+    _stream_400_signals_context_length: bool = False
+
+    # Lazily-created shared client (and the loop it belongs to). Class-level
+    # ``None`` defaults keep engine ``__init__``s free of mixin bookkeeping.
+    _async_client: httpx.AsyncClient | None = None
+    _async_client_loop: asyncio.AbstractEventLoop | None = None
+
+    def _make_async_client(self) -> httpx.AsyncClient:
+        """Build an async client that honours the configured timeout."""
+        return httpx.AsyncClient(
+            base_url=self._host,
+            timeout=self._timeout,
+            headers=getattr(self, "_headers", None),
+            transport=self._async_transport,
+        )
+
+    def _get_async_client(self) -> httpx.AsyncClient:
+        """Return the shared async client for the running event loop.
+
+        Reusing one client across calls preserves connection pooling — without
+        it every conversation turn pays a fresh TCP (and TLS) handshake. The
+        client is cached per event loop: pooled connections die with their
+        loop, so CLI flows that run ``asyncio.run()`` per turn transparently
+        get a fresh client while a long-lived server loop keeps one pool.
+        """
+        loop = asyncio.get_running_loop()
+        client = self._async_client
+        if client is None or client.is_closed or self._async_client_loop is not loop:
+            # Any previous client belonged to a finished loop; its pooled
+            # connections are already dead, so just drop the reference.
+            client = self._make_async_client()
+            self._async_client = client
+            self._async_client_loop = loop
+        return client
+
+    def _close_async_client(self) -> None:
+        """Best-effort close of the shared async client (for ``close()``)."""
+        client = self._async_client
+        loop = self._async_client_loop
+        self._async_client = None
+        self._async_client_loop = None
+        if client is None or client.is_closed:
+            return
+        try:
+            if loop is not None and not loop.is_closed():
+                if loop.is_running():
+                    loop.create_task(client.aclose())
+                else:
+                    loop.run_until_complete(client.aclose())
+        except Exception:  # noqa: BLE001 — cleanup must never mask the close
+            logger.debug("Async client did not close cleanly", exc_info=True)
+
+    def _raise_stream_http_error(self, status: int, detail: str) -> NoReturn:
+        """Map a non-success streaming HTTP response to a clean engine error."""
+        detail = (detail or "").strip()
+        if (
+            status == 400
+            and self._stream_400_signals_context_length
+            and looks_like_context_length_error(detail)
+        ):
+            raise EngineContextLengthError(_CONTEXT_LENGTH_USER_MESSAGE)
+        detail_suffix = f": {detail}" if detail else ""
+        raise EngineConnectionError(
+            f"{self.engine_id} engine at {self._host} returned HTTP "
+            f"{status}{detail_suffix}"
+        )
+
+
+__all__ = ["AsyncHTTPEngineMixin", "STREAM_TRANSPORT_ERRORS"]
@@ -12,18 +12,27 @@ import httpx
 from openjarvis.core.types import Message
 from openjarvis.engine._base import (
    EngineConnectionError,
+    EngineContextLengthError,
    InferenceEngine,
    estimate_prompt_tokens,
    messages_to_dicts,
 )
+from openjarvis.engine._http_async import (
+    STREAM_TRANSPORT_ERRORS,
+    AsyncHTTPEngineMixin,
+)
 from openjarvis.engine._stubs import StreamChunk

 logger = logging.getLogger(__name__)


-class _OpenAICompatibleEngine(InferenceEngine):
+class _OpenAICompatibleEngine(AsyncHTTPEngineMixin, InferenceEngine):
    """Base for engines that serve the OpenAI ``/v1/chat/completions`` API."""

+    # vLLM/SGLang report context-window overflows in 400 bodies; the shared
+    # ``_raise_stream_http_error`` types those as ``EngineContextLengthError``.
+    _stream_400_signals_context_length = True
+
    engine_id: str = ""
    _default_host: str = "http://localhost:8000"
    _api_prefix: str = "/v1"
@@ -50,6 +59,16 @@ class _OpenAICompatibleEngine(InferenceEngine):
        headers = (
            {"Authorization": f"Bearer {self._api_key}"} if self._api_key else None
        )
+        # Used by the shared async streaming plumbing (AsyncHTTPEngineMixin) so
+        # the bounded request timeout is applied to streaming reads, not just
+        # the synchronous methods (a wedged token read fails at ``timeout``
+        # rather than hanging the caller for the httpx default).
+        self._timeout = timeout
+        self._headers = headers
+        # Injection seam for tests: an ``httpx.MockTransport`` swapped in here lets
+        # the async stream path be exercised with a mocked transport and no real
+        # server. ``None`` in production so httpx uses its default networking.
+        self._async_transport: httpx.AsyncBaseTransport | None = None
        self._client = httpx.Client(
            base_url=self._host, timeout=timeout, headers=headers
        )
@@ -168,11 +187,26 @@ class _OpenAICompatibleEngine(InferenceEngine):
        # Default to tool_choice=auto when tools are provided
        if "tools" in payload and "tool_choice" not in payload:
            payload["tool_choice"] = "auto"
+        url = f"{self._api_prefix}/chat/completions"
        try:
-            url = f"{self._api_prefix}/chat/completions"
-            with self._client.stream("POST", url, json=payload) as resp:
-                resp.raise_for_status()
-                for line in resp.iter_lines():
+            # ASYNC streaming: ``httpx.AsyncClient`` + ``aiter_lines`` never
+            # blocks the event loop between tokens (the previous SYNC
+            # ``httpx.Client`` + ``iter_lines`` inside this ``async def`` blocked
+            # the single uvicorn worker on every inter-token wait, serializing all
+            # concurrent chats and letting one wedged read freeze the whole API).
+            # The shared client keeps pooled connections across turns.
+            client = self._get_async_client()
+            async with client.stream("POST", url, json=payload) as resp:
+                # ``not is_success`` covers 3xx as well as 4xx/5xx. With
+                # ``follow_redirects`` off (the default) an unexpected redirect
+                # would otherwise fall through to ``aiter_lines`` and surface as
+                # a silent EMPTY stream instead of a clean engine error.
+                if not resp.is_success:
+                    # Load the (short) error body before touching ``.text``:
+                    # a streaming response is otherwise unread.
+                    await resp.aread()
+                    self._raise_stream_http_error(resp.status_code, resp.text)
+                async for line in resp.aiter_lines():
                    if not line.startswith("data:"):
                        continue
                    data_str = line[len("data:") :].strip()
@@ -186,7 +220,11 @@ class _OpenAICompatibleEngine(InferenceEngine):
                    content = delta.get("content")
                    if content:
                        yield content
-        except (httpx.ConnectError, httpx.TimeoutException) as exc:
+        except STREAM_TRANSPORT_ERRORS as exc:
+            # A wedged upstream read trips ``timeout`` (ReadTimeout) and is mapped
+            # here, so the request fails cleanly at the configured bound instead
+            # of hanging indefinitely (see STREAM_TRANSPORT_ERRORS for why the
+            # set is exactly this narrow).
            raise EngineConnectionError(
                f"{self.engine_id} engine not reachable at {self._host}"
            ) from exc
@@ -212,11 +250,20 @@ class _OpenAICompatibleEngine(InferenceEngine):
        }
        if "tools" in payload and "tool_choice" not in payload:
            payload["tool_choice"] = "auto"
+        url = f"{self._api_prefix}/chat/completions"
        try:
-            url = f"{self._api_prefix}/chat/completions"
-            with self._client.stream("POST", url, json=payload) as resp:
-                resp.raise_for_status()
-                for line in resp.iter_lines():
+            # ASYNC streaming (see ``stream``): non-blocking shared client so
+            # rich streaming never stalls the event loop and honours ``timeout``.
+            client = self._get_async_client()
+            async with client.stream("POST", url, json=payload) as resp:
+                # ``not is_success`` covers 3xx as well as 4xx/5xx. With
+                # ``follow_redirects`` off (the default) an unexpected redirect
+                # would otherwise fall through to ``aiter_lines`` and surface as
+                # a silent EMPTY stream instead of a clean engine error.
+                if not resp.is_success:
+                    await resp.aread()
+                    self._raise_stream_http_error(resp.status_code, resp.text)
+                async for line in resp.aiter_lines():
                    if not line.startswith("data:"):
                        continue
                    data_str = line[len("data:") :].strip()
@@ -240,7 +287,10 @@ class _OpenAICompatibleEngine(InferenceEngine):
                            finish_reason=finish,
                            usage=usage,
                        )
-        except (httpx.ConnectError, httpx.TimeoutException) as exc:
+        except STREAM_TRANSPORT_ERRORS as exc:
+            # See ``stream``: transport failures (incl. a mid-stream server
+            # disconnect) map to a clean error; the set is kept narrow so
+            # cancellation still propagates.
            raise EngineConnectionError(
                f"{self.engine_id} engine not reachable at {self._host}"
            ) from exc
@@ -279,6 +329,9 @@ class _OpenAICompatibleEngine(InferenceEngine):

    def close(self) -> None:
        self._client.close()
+        self._close_async_client()


-__all__ = ["_OpenAICompatibleEngine"]
+# ``EngineContextLengthError`` moved to ``openjarvis.engine._base``; re-exported
+# here for callers/tests that import it from this module.
+__all__ = ["_OpenAICompatibleEngine", "EngineContextLengthError"]
@@ -123,8 +123,12 @@ class LiteLLMEngine(InferenceEngine):
            call_kwargs["api_base"] = self._api_base
        call_kwargs.update(kwargs)

-        resp = litellm.completion(**call_kwargs)
-        for chunk in resp:
+        # ``acompletion`` + ``async for``: the sync ``litellm.completion`` used
+        # before made a blocking network call (and blocking per-chunk reads)
+        # inside this ``async def``, stalling the whole event loop between
+        # tokens — the same bug the httpx engines' streaming paths had.
+        resp = await litellm.acompletion(**call_kwargs)
+        async for chunk in resp:
            delta = chunk.choices[0].delta if chunk.choices else None
            if delta and delta.content:
                yield delta.content
@@ -18,6 +18,10 @@ from openjarvis.engine._base import (
    estimate_prompt_tokens,
    messages_to_dicts,
 )
+from openjarvis.engine._http_async import (
+    STREAM_TRANSPORT_ERRORS,
+    AsyncHTTPEngineMixin,
+)
 from openjarvis.engine._stubs import StreamChunk

 logger = logging.getLogger(__name__)
@@ -80,11 +84,15 @@ def _default_num_ctx() -> int:


@EngineRegistry.register("ollama")
-class OllamaEngine(InferenceEngine):
+class OllamaEngine(AsyncHTTPEngineMixin, InferenceEngine):
    """Ollama backend via its native HTTP API."""

    engine_id = "ollama"

+    # Ollama has no context-length overflow signal in its 400 bodies, so the
+    # shared ``_raise_stream_http_error`` keeps its default (no
+    # ``EngineContextLengthError`` branch, unlike the OpenAI-compat engines).
+
    _DEFAULT_HOST = "http://localhost:11434"

    def __init__(
@@ -98,6 +106,14 @@ class OllamaEngine(InferenceEngine):
            env_host = os.environ.get("OLLAMA_HOST")
            host = env_host or self._DEFAULT_HOST
        self._host = host.rstrip("/")
+        # Used by the shared async streaming plumbing (AsyncHTTPEngineMixin) so a
+        # wedged token read is bounded by ``timeout`` instead of hanging the
+        # single event loop for the httpx default.
+        self._timeout = timeout
+        # Injection seam for tests: an ``httpx.MockTransport`` swapped in here drives
+        # the async stream path with no real Ollama server. ``None`` in production so
+        # httpx uses its default networking.
+        self._async_transport: httpx.AsyncBaseTransport | None = None
        self._client = httpx.Client(base_url=self._host, timeout=timeout)
        # Last stream usage — captured from Ollama's final chunk
        self._last_stream_usage: Dict[str, int] = {}
@@ -263,9 +279,26 @@ class OllamaEngine(InferenceEngine):
        elif kwargs["think"] is not None:
            payload["think"] = kwargs["think"]
        try:
-            with self._client.stream("POST", "/api/chat", json=payload) as resp:
-                resp.raise_for_status()
-                for line in resp.iter_lines():
+            # ASYNC streaming: ``httpx.AsyncClient`` + ``aiter_lines`` never
+            # blocks the event loop between tokens (the previous SYNC
+            # ``self._client`` + ``iter_lines`` inside this ``async def`` blocked
+            # the single uvicorn worker on every inter-token wait, serializing all
+            # concurrent chats and letting one wedged read freeze the whole API).
+            # The shared client keeps pooled connections across turns.
+            client = self._get_async_client()
+            async with client.stream("POST", "/api/chat", json=payload) as resp:
+                # ``not is_success`` covers 3xx as well as 4xx/5xx and maps
+                # to ``EngineConnectionError`` (matching the OpenAI-compat
+                # path) instead of leaking a raw ``httpx.HTTPStatusError``.
+                # With redirects off (the default) an unexpected 3xx would
+                # otherwise fall through to ``aiter_lines`` and surface as a
+                # silent EMPTY stream rather than a clean engine error.
+                if not resp.is_success:
+                    # Read the (short) error body before touching ``.text``:
+                    # a streaming response is otherwise unread.
+                    await resp.aread()
+                    self._raise_stream_http_error(resp.status_code, resp.text)
+                async for line in resp.aiter_lines():
                    if not line.strip():
                        continue
                    try:
@@ -290,7 +323,10 @@ class OllamaEngine(InferenceEngine):
                            "total_tokens": full_prompt + comp,
                        }
                        break
-        except (httpx.ConnectError, httpx.TimeoutException) as exc:
+        except STREAM_TRANSPORT_ERRORS as exc:
+            # Transport failures (incl. a mid-stream server disconnect) map to a
+            # clean error; the set is kept narrow (see STREAM_TRANSPORT_ERRORS)
+            # so cancellation still propagates.
            raise EngineConnectionError(
                f"Ollama not reachable at {self._host}"
            ) from exc
@@ -356,19 +392,34 @@ class OllamaEngine(InferenceEngine):
    ) -> AsyncIterator[StreamChunk]:
        """Execute the streaming request and yield parsed StreamChunks."""
        try:
-            with self._client.stream("POST", "/api/chat", json=payload) as resp:
+            # ASYNC streaming (see ``stream``): shared ``AsyncClient`` +
+            # ``aiter_lines`` so rich streaming never stalls the event loop and
+            # honours ``timeout``.
+            client = self._get_async_client()
+            async with client.stream("POST", "/api/chat", json=payload) as resp:
                if resp.status_code == 400 and retry_without_tools:
                    # Model doesn't support tools — retry without them.
+                    # PRESERVED: this specific 400 path must still trigger the
+                    # tools-less retry; only OTHER non-2xx responses map to
+                    # EngineConnectionError below.
                    payload.pop("tools", None)
                    async for c in self._run_stream(
                        payload, messages, retry_without_tools=False
                    ):
                        yield c
                    return
-                resp.raise_for_status()
+                # ``not is_success`` covers 3xx as well as 4xx/5xx and maps
+                # to ``EngineConnectionError`` (matching the OpenAI-compat
+                # path) instead of leaking a raw ``httpx.HTTPStatusError``.
+                # With redirects off (the default) an unexpected 3xx would
+                # otherwise fall through to ``aiter_lines`` and surface as a
+                # silent EMPTY stream rather than a clean engine error.
+                if not resp.is_success:
+                    await resp.aread()
+                    self._raise_stream_http_error(resp.status_code, resp.text)

                finish_reason: str | None = None
-                for line in resp.iter_lines():
+                async for line in resp.aiter_lines():
                    if not line.strip():
                        continue
                    try:
@@ -441,7 +492,10 @@ class OllamaEngine(InferenceEngine):
                            usage=dict(self._last_stream_usage),
                        )
                        break
-        except (httpx.ConnectError, httpx.TimeoutException) as exc:
+        except STREAM_TRANSPORT_ERRORS as exc:
+            # See ``stream``: transport failures (incl. a mid-stream server
+            # disconnect) map to a clean error; the set is kept narrow so
+            # cancellation still propagates.
            raise EngineConnectionError(
                f"Ollama not reachable at {self._host}"
            ) from exc
@@ -474,6 +528,7 @@ class OllamaEngine(InferenceEngine):

    def close(self) -> None:
        self._client.close()
+        self._close_async_client()


 __all__ = ["OllamaEngine"]
@@ -203,6 +203,7 @@ def _try_start_nvml() -> Optional[_Sampler]:
    try:
        # Suppress legacy pynvml deprecation FutureWarning (#389).
        import warnings as _warnings
+
        with _warnings.catch_warnings():
            _warnings.filterwarnings(
                "ignore",
@@ -175,8 +175,7 @@ class EvalRunner:
            before = len(records)
            records = [r for r in records if r.record_id in wanted]
            LOGGER.info(
-                "Filtering %s to %d/%d records via record_ids "
-                "(first 3: %s)",
+                "Filtering %s to %d/%d records via record_ids (first 3: %s)",
                cfg.benchmark,
                len(records),
                before,
@@ -324,8 +323,7 @@ class EvalRunner:
                energy_joules=energy_j,
                power_watts=power_w,
                gpu_utilization_pct=full.get("gpu_utilization_pct", 0.0) or 0.0,
-                throughput_tok_per_sec=full.get("throughput_tok_per_sec", 0.0)
-                or 0.0,
+                throughput_tok_per_sec=full.get("throughput_tok_per_sec", 0.0) or 0.0,
                trace_data=full.get("trace_data"),
                framework=full.get(
                    "framework",
@@ -960,9 +958,7 @@ class EvalRunner:

        # Continuous-score reporting: skip None (errored) entries; clamp values
        # outside [0,1] are already handled in _extract_continuous_score.
-        cont_scores = [
-            float(r.score) for r in results if r.score is not None
-        ]
+        cont_scores = [float(r.score) for r in results if r.score is not None]
        if cont_scores:
            mean_cont = sum(cont_scores) / len(cont_scores)
            median_cont = statistics.median(cont_scores)
@@ -85,7 +85,12 @@ class TerminalBenchV21Dataset(DatasetProvider):
                "git binary not found. Install git to clone TerminalBench V2.1 tasks."
            )
        self._repo_dir.parent.mkdir(parents=True, exist_ok=True)
-        LOGGER.info("Cloning %s (branch %s) into %s", self._repo_url, self._branch, self._repo_dir)
+        LOGGER.info(
+            "Cloning %s (branch %s) into %s",
+            self._repo_url,
+            self._branch,
+            self._repo_dir,
+        )
        subprocess.run(
            [
                "git",
@@ -110,9 +115,7 @@ class TerminalBenchV21Dataset(DatasetProvider):
    ) -> None:
        repo = self._ensure_repo()
        task_dirs = sorted(
-            d
-            for d in repo.iterdir()
-            if d.is_dir() and (d / "task.toml").exists()
+            d for d in repo.iterdir() if d.is_dir() and (d / "task.toml").exists()
        )

        if self._task_ids:
@@ -49,8 +49,7 @@ class TerminalBenchV21TaskEnv:
        task_dir = self._metadata.get("task_dir")
        if not docker_image or not task_dir:
            raise ValueError(
-                "TerminalBenchV21TaskEnv missing 'docker_image' or 'task_dir' "
-                "metadata"
+                "TerminalBenchV21TaskEnv missing 'docker_image' or 'task_dir' metadata"
            )

        tests_dir = Path(task_dir) / "tests"
@@ -90,9 +89,7 @@ class TerminalBenchV21TaskEnv:
        )
        if start.returncode != 0:
            self._metadata["tbv21_env_error"] = start.stderr[:500]
-            raise RuntimeError(
-                f"docker run failed for {task_id}: {start.stderr[:300]}"
-            )
+            raise RuntimeError(f"docker run failed for {task_id}: {start.stderr[:300]}")

        self._started = True
        self._metadata["tbv21_container"] = name
@@ -120,7 +120,6 @@ Be a rigorous evaluator. Reserve scores of 9-10 for genuinely excellent work.
 A score of 5 represents adequate but unremarkable quality."""


-
 # Optional permissive JSON parser (json5 if available; fallback otherwise).
 try:
    import json5 as _json5  # type: ignore[import-not-found]
@@ -147,7 +146,7 @@ def _escape_newlines_inside_strings(text: str) -> str:
                out.append(ch)
                escape_next = True
                continue
-            if ch == "\"":
+            if ch == '"':
                out.append(ch)
                in_string = False
                continue
@@ -162,7 +161,7 @@ def _escape_newlines_inside_strings(text: str) -> str:
                continue
            out.append(ch)
        else:
-            if ch == "\"":
+            if ch == '"':
                in_string = True
            out.append(ch)
    return "".join(out)
@@ -217,7 +216,7 @@ def _parse_judge_response(raw: str) -> Dict[str, Any]:
                esc = False
            elif char == "\\":
                esc = True
-            elif char == "\"":
+            elif char == '"':
                in_str = False
            continue
        if char == "{":
@@ -226,7 +225,7 @@ def _parse_judge_response(raw: str) -> Dict[str, Any]:
            depth += 1
        if depth > 0:
            current.append(char)
-        if char == "\"" and depth > 0:
+        if char == '"' and depth > 0:
            in_str = True
        elif char == "}":
            depth -= 1
@@ -82,9 +82,7 @@ def load_mcp_tools_from_config(

    for server_cfg in server_list:
        try:
-            cfg = (
-                json.loads(server_cfg) if isinstance(server_cfg, str) else server_cfg
-            )
+            cfg = json.loads(server_cfg) if isinstance(server_cfg, str) else server_cfg
            name = cfg.get("name", "<unnamed>")
            url = cfg.get("url")
            token = cfg.get("token")
@@ -9,7 +9,11 @@ and configured via the ``[memory]`` section of ``config.toml``.
 from __future__ import annotations

 from openjarvis.memory.extractor import FactExtractor
-from openjarvis.memory.service import MemoryService, build_memory_service
+from openjarvis.memory.service import (
+    MemoryService,
+    build_memory_service,
+    publish_completed_exchange,
+)
 from openjarvis.memory.store import (
    Fact,
    FactStore,
@@ -25,4 +29,5 @@ __all__ = [
    "MemoryService",
    "build_memory_service",
    "create_fact_store",
+    "publish_completed_exchange",
 ]
@@ -20,6 +20,7 @@ import queue
 import threading
 from typing import Any, List, Optional

+from openjarvis.core.events import Event, EventBus, EventType
 from openjarvis.memory.extractor import FactExtractor
 from openjarvis.memory.store import Fact, FactStore, create_fact_store

@@ -37,10 +38,13 @@ class MemoryService:
        store: FactStore,
        extractor: FactExtractor,
        *,
+        event_bus: EventBus | None = None,
        max_queue: int = 256,
    ) -> None:
        self._store = store
        self._extractor = extractor
+        self._event_bus = event_bus
+        self._subscribed = False
        self._queue: "queue.Queue[Any]" = queue.Queue(maxsize=max(1, max_queue))
        self._thread: Optional[threading.Thread] = None
        self._running = threading.Event()
@@ -52,6 +56,7 @@ class MemoryService:
        if self._running.is_set():
            return
        self._running.set()
+        self._subscribe_events()
        self._thread = threading.Thread(
            target=self._loop,
            name="memory-service",
@@ -73,6 +78,7 @@ class MemoryService:
        if thread is not None:
            thread.join(timeout=timeout)
        self._thread = None
+        self._unsubscribe_events()
        logger.debug("Memory service stopped")

    @property
@@ -99,6 +105,34 @@ class MemoryService:
            logger.debug("Memory service queue full; dropping exchange")
            return False

+    def _subscribe_events(self) -> None:
+        """Subscribe to lifecycle events that feed automatic memory."""
+        if self._event_bus is None or self._subscribed:
+            return
+        self._event_bus.subscribe(
+            EventType.CHAT_EXCHANGE_COMPLETED,
+            self._on_completed_exchange,
+        )
+        self._subscribed = True
+
+    def _unsubscribe_events(self) -> None:
+        """Unsubscribe from lifecycle events (idempotent)."""
+        if self._event_bus is None or not self._subscribed:
+            return
+        self._event_bus.unsubscribe(
+            EventType.CHAT_EXCHANGE_COMPLETED,
+            self._on_completed_exchange,
+        )
+        self._subscribed = False
+
+    def _on_completed_exchange(self, event: Event) -> None:
+        """Queue a completed chat exchange published on the event bus."""
+        data = event.data or {}
+        self.submit(
+            str(data.get("user_text", "") or ""),
+            str(data.get("assistant_text", "") or ""),
+        )
+
    # -- worker -------------------------------------------------------------

    def _loop(self) -> None:
@@ -145,6 +179,8 @@ def build_memory_service(
    config: Any,
    engine: Any,
    default_model: str = "",
+    *,
+    event_bus: EventBus | None = None,
 ) -> Optional[MemoryService]:
    """Build a :class:`MemoryService` from config, or ``None`` if disabled.

@@ -170,11 +206,32 @@ def build_memory_service(

    store = create_fact_store(
        getattr(mem, "backend", "local"),
-        path=getattr(mem, "facts_path", "~/.openjarvis/memory_facts.jsonl"),
+        path=getattr(mem, "facts_path", None),
        max_facts=getattr(mem, "max_facts", 1000),
    )
    extractor = FactExtractor(engine, model)
-    return MemoryService(store, extractor)
+    return MemoryService(store, extractor, event_bus=event_bus)


-__all__ = ["MemoryService", "build_memory_service"]
+def publish_completed_exchange(
+    bus: EventBus | None,
+    user_text: str,
+    assistant_text: str = "",
+    *,
+    source: str = "",
+) -> bool:
+    """Publish a completed chat exchange for lifecycle subscribers."""
+    if bus is None or not user_text or not user_text.strip():
+        return False
+    bus.publish(
+        EventType.CHAT_EXCHANGE_COMPLETED,
+        {
+            "user_text": user_text,
+            "assistant_text": assistant_text or "",
+            "source": source,
+        },
+    )
+    return True
+
+
+__all__ = ["MemoryService", "build_memory_service", "publish_completed_exchange"]
@@ -18,6 +18,14 @@ from dataclasses import asdict, dataclass
 from pathlib import Path
 from typing import Iterable, List

+from openjarvis.core.paths import get_config_dir
+from openjarvis.core.registry import FactStoreRegistry
+
+
+def _default_fact_path() -> Path:
+    """Return the env-aware default JSONL path for automatic memory facts."""
+    return get_config_dir() / "memory_facts.jsonl"
+

@dataclass(slots=True)
 class Fact:
@@ -56,6 +64,7 @@ class FactStore(ABC):
        """Return the number of stored facts."""


+@FactStoreRegistry.register("local")
 class LocalFactStore(FactStore):
    """Append-only JSONL fact store on the local filesystem.

@@ -67,11 +76,13 @@ class LocalFactStore(FactStore):

    def __init__(
        self,
-        path: str | Path = "~/.openjarvis/memory_facts.jsonl",
+        path: str | Path | None = None,
        *,
        max_facts: int = 1000,
    ) -> None:
-        self._path = Path(path).expanduser()
+        self._path = (
+            Path(path).expanduser() if path is not None else _default_fact_path()
+        )
        self._max_facts = max(0, int(max_facts))
        self._lock = threading.Lock()
        self._facts: List[Fact] = self._load()
@@ -116,6 +127,10 @@ class LocalFactStore(FactStore):
        tmp.write_text(payload, encoding="utf-8")
        os.replace(tmp, self._path)

+    def _sync_from_disk_locked(self) -> None:
+        """Refresh in-memory facts from disk while holding ``self._lock``."""
+        self._facts = self._load()
+
    # -- FactStore API ------------------------------------------------------

    def add(self, text: str, source: str = "") -> bool:
@@ -123,6 +138,7 @@ class LocalFactStore(FactStore):
        if not text:
            return False
        with self._lock:
+            self._sync_from_disk_locked()
            lowered = text.lower()
            if any(f.text.lower() == lowered for f in self._facts):
                return False  # dedupe
@@ -135,10 +151,12 @@ class LocalFactStore(FactStore):

    def list(self) -> List[Fact]:
        with self._lock:
+            self._sync_from_disk_locked()
            return list(self._facts)

    def clear(self) -> int:
        with self._lock:
+            self._sync_from_disk_locked()
            removed = len(self._facts)
            self._facts = []
            if self._path.exists():
@@ -150,6 +168,7 @@ class LocalFactStore(FactStore):

    def count(self) -> int:
        with self._lock:
+            self._sync_from_disk_locked()
            return len(self._facts)

    @property
@@ -158,22 +177,32 @@ class LocalFactStore(FactStore):
        return self._path


+def _ensure_fact_store_backends_registered() -> None:
+    """Restore built-in fact-store registrations if a test cleared registries."""
+    if not FactStoreRegistry.contains("local"):
+        FactStoreRegistry.register_value("local", LocalFactStore)
+
+
 def create_fact_store(
    backend: str = "local",
    *,
-    path: str | Path = "~/.openjarvis/memory_facts.jsonl",
+    path: str | Path | None = None,
    max_facts: int = 1000,
 ) -> FactStore:
    """Construct a fact store for the configured *backend*.

    Only the ``"local"`` (on-disk JSONL) backend is supported today; the
-    factory exists so additional backends can be added without changing the
-    service or CLI wiring.
+    registry-backed constructor exists so additional backends can be added
+    without changing the service or CLI wiring.
    """
+    _ensure_fact_store_backends_registered()
    key = (backend or "local").strip().lower()
-    if key == "local":
-        return LocalFactStore(path, max_facts=max_facts)
-    raise ValueError(f"Unknown memory backend '{backend}'. Supported backends: local")
+    if not FactStoreRegistry.contains(key):
+        supported = ", ".join(FactStoreRegistry.keys())
+        raise ValueError(
+            f"Unknown memory backend '{backend}'. Supported backends: {supported}"
+        )
+    return FactStoreRegistry.create(key, path, max_facts=max_facts)


 __all__ = ["Fact", "FactStore", "LocalFactStore", "create_fact_store"]
--- a/Show More
+++ b/Show More