fix: unify managed-agent tool resolution (#705)

* fix: unify managed-agent tool resolution

* fix: harden managed-agent tool lifecycle

.github/clone-stats/badge.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 1,
   "label": "Git Clones",
-  "message": "140,724",
+  "message": "185,599",
   "color": "green",
   "namedLogo": "git"
 }

.github/clone-stats/clone-data.json

@@ -1,6 +1,6 @@
 {
-  "total_clones": 140724,
-  "last_updated": "2026-07-02T07:10:21Z",
+  "total_clones": 185599,
+  "last_updated": "2026-08-10T07:26:44Z",
   "daily": {
     "2026-03-27": 2189,
     "2026-03-28": 1874,
@@ -98,6 +98,45 @@
     "2026-06-28": 1028,
     "2026-06-29": 765,
     "2026-06-30": 951,
-    "2026-07-01": 1134
+    "2026-07-01": 1134,
+    "2026-07-02": 593,
+    "2026-07-03": 537,
+    "2026-07-04": 411,
+    "2026-07-05": 485,
+    "2026-07-06": 555,
+    "2026-07-07": 905,
+    "2026-07-08": 1171,
+    "2026-07-09": 1857,
+    "2026-07-10": 1181,
+    "2026-07-11": 2185,
+    "2026-07-12": 1917,
+    "2026-07-13": 2102,
+    "2026-07-14": 2337,
+    "2026-07-15": 2362,
+    "2026-07-16": 2497,
+    "2026-07-17": 1773,
+    "2026-07-18": 1542,
+    "2026-07-19": 1445,
+    "2026-07-20": 1481,
+    "2026-07-21": 1528,
+    "2026-07-22": 1529,
+    "2026-07-23": 1209,
+    "2026-07-24": 1118,
+    "2026-07-25": 928,
+    "2026-07-26": 740,
+    "2026-07-27": 799,
+    "2026-07-28": 665,
+    "2026-07-29": 745,
+    "2026-07-30": 591,
+    "2026-07-31": 783,
+    "2026-08-01": 567,
+    "2026-08-02": 1248,
+    "2026-08-03": 724,
+    "2026-08-04": 708,
+    "2026-08-05": 647,
+    "2026-08-06": 604,
+    "2026-08-07": 624,
+    "2026-08-08": 706,
+    "2026-08-09": 1076
   }
 }

README.md

@@ -4,7 +4,8 @@
   <p><i>Personal AI, On Personal Devices.</i></p>
 
   <p>
-    <a href="https://scalingintelligence.stanford.edu/blogs/openjarvis/"><img src="https://img.shields.io/badge/project-OpenJarvis-blue" alt="Project"></a>
+    <a href="https://arxiv.org/abs/2605.17172"><img src="https://img.shields.io/badge/arXiv-2605.17172-b31b1b.svg" alt="arXiv"></a>
+    <a href="https://openjarvis.stanford.edu/"><img src="https://img.shields.io/badge/project-OpenJarvis-blue" alt="Project"></a>
     <a href="https://open-jarvis.github.io/OpenJarvis/"><img src="https://img.shields.io/badge/docs-mkdocs-blue" alt="Docs"></a>
     <img src="https://img.shields.io/badge/python-%3E%3D3.10-blue" alt="Python">
     <img src="https://img.shields.io/badge/license-Apache%202.0-green" alt="License">
@@ -23,7 +24,7 @@
 
 > **[Documentation](https://open-jarvis.github.io/OpenJarvis/)**
 >
-> **[Project Site](https://scalingintelligence.stanford.edu/blogs/openjarvis/)**
+> **[Project Site](https://openjarvis.stanford.edu/)**
 >
 > **[Paper](https://arxiv.org/abs/2605.17172)**
 >

configs/openjarvis/examples/full-system-access.toml

@@ -0,0 +1,39 @@
+# Full system access: unrestricted shell and filesystem
+# Copy to ~/.openjarvis/config.toml
+#
+# WARNING: shell_exec runs arbitrary commands as your user. No command
+# allowlist, no denylist, no working-directory restriction. file_read and
+# file_write aren't restricted to any directory either. Only enable what you
+# actually want the agent to have. tools.enabled is the whole permission grant;
+# there's no second allowlist to configure.
+#
+# On macOS, this config alone does not reach TCC-protected data (Messages,
+# Mail, Photos, Safari). That requires Full Disk Access granted to the process
+# hosting the backend. See docs/user-guide/system-access.md.
+#
+# Usage:
+#   jarvis ask "What's using the most disk space in my home directory?"
+#   jarvis chat        # prompts before each shell_exec call
+
+[engine]
+default = "ollama"
+
+[intelligence]
+default_model = "qwen3.5:9b"
+
+[agent]
+default_agent = "orchestrator"
+max_turns = 10
+
+[tools]
+enabled = [
+    "shell_exec",
+    "file_read",
+    "file_write",
+    "apply_patch",
+    "code_interpreter",
+    "git_status",
+    "git_diff",
+    "think",
+    "calculator",
+]

docs/getting-started/configuration.md

@@ -604,7 +604,7 @@ enforce_tool_confirmation = true
 | `scan_output` | bool | `true` | Whether to scan model output. |
 | `secret_scanner` | bool | `true` | Enable secret detection (API keys, tokens, passwords). |
 | `pii_scanner` | bool | `true` | Enable PII detection (emails, SSNs, credit cards). |
-| `enforce_tool_confirmation` | bool | `true` | Require confirmation before executing tools. |
+| `enforce_tool_confirmation` | bool | `true` | Accepted but **not currently enforced**. Whether you get prompts depends on the entry point. See [System Access](../user-guide/system-access.md#confirmation-behaviour). |
 
 !!! tip "Choosing a security mode"
     Use `"warn"` during development to see what would be flagged without disrupting output.

docs/getting-started/quickstart.md

@@ -135,6 +135,19 @@ cd OpenJarvis
 This launches the backend API server and a React frontend at [http://localhost:5173](http://localhost:5173).
 You get a ChatGPT-like interface with streaming responses, tool use, energy monitoring, and a telemetry dashboard — all running locally on your hardware.
 
+Web search is available through the built-in DuckDuckGo fallback. To use
+Tavily, add `TAVILY_API_KEY` under **Settings → Tools → Web Search** after the
+app starts, or export it before starting quickstart:
+
+```bash
+export TAVILY_API_KEY="tvly-..."
+./scripts/quickstart.sh
+```
+
+The script does not automatically source `.env` files. Run `source .env`
+first if that is where you keep the key. Stop any existing OpenJarvis server
+before restarting so it inherits the updated environment.
+
 To stop all services, press ++ctrl+c++ in the terminal.
 
 !!! tip "Environment variable"

docs/index.md

@@ -215,7 +215,7 @@ OpenJarvis is built around five composable layers. Each has a clean interface an
 
 OpenJarvis is part of [Intelligence Per Watt](https://www.intelligence-per-watt.ai/), a research initiative studying the efficiency of on-device AI systems. Developed at [Hazy Research](https://hazyresearch.stanford.edu/) and the [Scaling Intelligence Lab](https://scalingintelligence.stanford.edu/) at [Stanford SAIL](https://ai.stanford.edu/).
 
-Read the [blog post](https://scalingintelligence.stanford.edu/blogs/openjarvis/) for the full research motivation, architecture details, and experimental results.
+Read the [blog post](https://openjarvis.stanford.edu/) for the full research motivation, architecture details, and experimental results.
 
 ## Citation
 

docs/leaderboard.md

@@ -55,5 +55,5 @@ See how the OpenJarvis community saves money, energy, and compute by running AI
 <div id="leaderboard-pagination" class="lb-pagination"></div>
 
 <p style="font-size:12px;opacity:0.6;margin-top:12px">
-*Dollar savings estimated vs. Claude Opus 4.6 API pricing ($5/1M input, $25/1M output tokens). Assumes local open-source models produce roughly the same number of tokens per request as cloud models.
+*Dollar savings estimated vs. Claude Fable 5 API pricing ($10/1M input, $50/1M output tokens). Assumes local open-source models produce roughly the same number of tokens per request as cloud models.
 </p>

docs/user-guide/security.md

@@ -392,7 +392,7 @@ enforce_tool_confirmation = true
 | `secret_scanner` | `bool` | `true` | Run `SecretScanner` on all text |
 | `pii_scanner` | `bool` | `true` | Run `PIIScanner` on all text |
 | `audit_log_path` | `str` | `~/.openjarvis/audit.db` | Path to the SQLite audit log |
-| `enforce_tool_confirmation` | `bool` | `true` | Require explicit confirmation before tool execution |
+| `enforce_tool_confirmation` | `bool` | `true` | Accepted by the loader but **not currently enforced**. See [System Access](system-access.md#confirmation-behaviour) for when prompts actually happen |
 
 !!! tip "Start with warn, tighten later"
     `mode = "warn"` is a good starting point. It lets you observe what patterns are being triggered without disrupting normal usage. Switch to `"redact"` once you are satisfied that the scanner isn't producing too many false positives for your workload.

docs/user-guide/system-access.md

@@ -0,0 +1,198 @@
+# System Access
+
+How to give an agent access to the machine it runs on, and where the real
+limits are.
+
+!!! warning
+    `shell_exec` runs arbitrary commands as your user. There is no command
+    allowlist, no denylist, and no sandbox unless you turn one on. An agent
+    holding this tool can do anything you can do from a terminal.
+
+---
+
+## Start here: you probably have no tools enabled
+
+If the agent tells you it can't run commands or read files, that's usually not
+a permissions problem. It means no tools were enabled in the first place.
+
+Tools come from `tools.enabled`, falling back to `agent.tools`. Both default to
+empty, and an empty value builds the agent with **zero tools**. Nothing is
+enabled by default.
+
+First check whether you have a config file at all:
+
+```bash
+cat ~/.openjarvis/config.toml
+```
+
+If it isn't there, that's your answer. Create it:
+
+```toml
+[engine]
+default = "ollama"
+
+[intelligence]
+default_model = "qwen3.5:9b"
+
+[agent]
+default_agent = "orchestrator"
+
+[tools]
+enabled = ["shell_exec", "file_read", "file_write", "think"]
+```
+
+There's a fuller version at
+`configs/openjarvis/examples/full-system-access.toml`.
+
+Then confirm the list actually resolved:
+
+```bash
+python -c "from openjarvis.core.config import load_config; print(load_config().tools.enabled)"
+```
+
+---
+
+## What the tools reach
+
+| Tool | Scope |
+|------|-------|
+| `shell_exec` | Any command, as your user. 30s default timeout, 300s max, output capped at 100 KB per stream. |
+| `file_read` | Any readable path. 1 MB cap. |
+| `file_write` | Any writable path. 10 MB cap, can create parent directories. |
+| `apply_patch` | Applies unified diffs to any path. |
+| `code_interpreter` | Python in a subprocess, behind a coarse pattern blocklist. |
+
+`file_read` and `file_write` take an `allowed_dirs` argument that limits them to
+a set of directories, but no config key populates it. When it's empty every path
+is allowed. If you want a filesystem jail today, use the container sandbox
+instead of relying on these tools to enforce one.
+
+### Sensitive filenames
+
+`file_read` and `file_write` refuse names matching a short glob list: `.env`,
+`*.pem`, `id_rsa`, `credentials.*` and a dozen or so others. It matches on the
+filename only, not the path or the contents, and only those two tools consult
+it. `shell_exec`, `apply_patch` and `code_interpreter` skip it entirely, so
+`cat ~/.ssh/id_rsa` through `shell_exec` works fine. Treat it as protection
+against fat fingers, not as a security boundary.
+
+---
+
+## Confirmation behaviour
+
+`shell_exec`, `git_commit` and `agent_kill` are marked `requires_confirmation`.
+What that translates to depends entirely on how you launched the agent:
+
+| Entry point | Behaviour |
+|-------------|-----------|
+| `jarvis chat` | Prompts before each call. |
+| `jarvis ask` | Auto-approves. |
+| `jarvis agent ask` | Auto-approves. Pass `--no-yes` if you want prompts. |
+| HTTP server, desktop app | Auto-approves. Tools you added to an agent's toolkit count as pre-approved. |
+| Embedded via `SystemBuilder` | No callback is wired, so these tools fail closed. |
+
+That last row catches people out. If `shell_exec` returns "requires
+confirmation but no confirmation callback is available", you're constructing the
+agent yourself and need to pass a `confirm_callback`.
+
+!!! note "`enforce_tool_confirmation` doesn't do anything"
+    The config loader accepts `security.enforce_tool_confirmation`, but nothing
+    on the tool execution path reads it. Setting it won't change confirmation
+    behaviour anywhere. Use the table above instead.
+
+---
+
+## macOS: Full Disk Access
+
+On macOS the operating system is the real boundary, not the config. Shell
+access and ordinary file access start working as soon as you enable the tools.
+TCC-protected data does not: Messages, Mail, Photos, Safari history, Contacts
+and Calendar all stay locked, and no config key will change that.
+
+Grant Full Disk Access to whichever process hosts the backend. Child processes
+inherit it:
+
+| How you run OpenJarvis | Grant access to |
+|------------------------|-----------------|
+| CLI (`jarvis ask`, `jarvis chat`) | Your terminal (Terminal, iTerm, Warp) |
+| Desktop app | `OpenJarvis.app`, which spawns `jarvis serve` beneath it |
+| launchd (`deploy/launchd/com.openjarvis.plist`) | The `jarvis` binary, as its own entry |
+
+System Settings, then Privacy & Security, then Full Disk Access, then **+**.
+
+A launchd daemon gets its own TCC context, so granting access to Terminal does
+nothing for it. Add `/usr/local/bin/jarvis` separately.
+
+To check whether the grant took:
+
+```bash
+head -c 16 ~/Library/Messages/chat.db >/dev/null 2>&1 \
+  && echo "granted" || echo "denied"
+```
+
+Restart the host process after you change the setting.
+
+### Driving Mac apps
+
+AppleScript works through `shell_exec`:
+
+```
+osascript -e 'tell application "Music" to play'
+```
+
+macOS asks for Automation permission once per target app, the first time you
+touch it.
+
+---
+
+## What you can't do
+
+There's no computer use. OpenJarvis can't see your screen, move the pointer or
+send keystrokes. No tool for it is registered and no input automation library
+appears anywhere in the codebase, so granting Accessibility or Screen Recording
+buys you nothing on its own.
+
+The `click` and `type` actions you'll find are Playwright, scoped to a browser
+page rather than the desktop.
+
+Some of this is reachable through `shell_exec` if you bring the tooling
+yourself. `screencapture` will take screenshots once you've granted Screen
+Recording, and something like `cliclick` will move the pointer. That gets you
+scripted actions. It doesn't get you an agent that looks at the screen and
+works out where to click.
+
+---
+
+## Narrowing access
+
+Access widens and narrows through `tools.enabled`. Drop entries to take
+capabilities away. That list is the whole grant.
+
+Two stronger isolation options exist. Both are off by default:
+
+```toml
+[sandbox]
+enabled = true          # run tools inside a container
+runtime = "docker"
+
+[security.capabilities]
+enabled = true          # RBAC over declared tool capabilities
+policy_path = "~/.openjarvis/policy.yaml"
+```
+
+!!! note "Capabilities are open by default even once enabled"
+    `CapabilityPolicy` is built with `default_deny=False` and no config key
+    exposes that flag, so an agent with no explicit policy entry gets every
+    capability. Write entries for every agent you mean to restrict.
+
+For anything untrusted, reach for `docker_shell_exec` and
+`code_interpreter_docker` rather than the host-side versions.
+
+---
+
+## See also
+
+- [Security](security.md) for scanners, the audit log and guardrails
+- [Tools](tools.md) for the full registry
+- [Code Assistant](code-assistant.md) for a narrower shell-enabled setup
+- [External MCP Servers](mcp-external-servers.md) for capabilities OpenJarvis doesn't ship

frontend/src/App.tsx

@@ -89,7 +89,7 @@ export default function App() {
           setSavings(data);
           if (optInEnabled && optInDisplayName && data) {
             const claudeEntry = data.per_provider.find(
-              (p) => p.provider === 'claude-opus-4.6',
+              (p) => p.provider === 'claude-fable-5',
             );
             const dollarSavings = claudeEntry ? claudeEntry.total_cost : 0;
             const energySaved = data.per_provider.reduce(

frontend/src/components/Chat/ChatArea.tsx

@@ -22,6 +22,8 @@ export function ChatArea() {
   const navigate = useNavigate();
   const listRef = useRef<HTMLDivElement>(null);
   const shouldAutoScroll = useRef(true);
+  const wasStreaming = useRef(false);
+  const lastScrollTop = useRef(0);
 
   // Check if any data sources are connected
   const [hasConnectedSources, setHasConnectedSources] = useState<boolean | null>(null);
@@ -34,15 +36,34 @@ export function ChatArea() {
   }, []);
 
   useEffect(() => {
+    // Sending a message always pins the view to the bottom, even if the
+    // user had scrolled up to read earlier messages.
+    if (streamState.isStreaming && !wasStreaming.current) {
+      shouldAutoScroll.current = true;
+    }
+    wasStreaming.current = streamState.isStreaming;
     if (shouldAutoScroll.current && listRef.current) {
       listRef.current.scrollTop = listRef.current.scrollHeight;
     }
-  }, [messages, streamState.content]);
+  }, [messages, streamState.content, streamState.isStreaming]);
 
   const handleScroll = () => {
     if (!listRef.current) return;
     const { scrollTop, scrollHeight, clientHeight } = listRef.current;
-    shouldAutoScroll.current = scrollHeight - scrollTop - clientHeight < 100;
+    const distance = scrollHeight - scrollTop - clientHeight;
+    const scrolledUp = scrollTop < lastScrollTop.current;
+    lastScrollTop.current = scrollTop;
+    if (scrolledUp && distance >= 1) {
+      // Any upward scroll away from the bottom stops autoscroll immediately,
+      // so streaming content never fights the user (no jitter). Sub-1px
+      // upward movement (elastic bounce settling at the bottom) is ignored.
+      shouldAutoScroll.current = false;
+    } else if (!scrolledUp) {
+      // Re-engage when scrolled back to the bottom. < 2 rather than < 1:
+      // at fractional zoom levels the at-bottom residual can reach 1px,
+      // which would otherwise leave autoscroll permanently disengaged.
+      shouldAutoScroll.current = distance < 2;
+    }
   };
 
   const isEmpty = messages.length === 0 && !streamState.isStreaming;

frontend/src/components/Chat/InputArea.tsx

@@ -466,7 +466,10 @@ export function InputArea() {
       }
       const totalMs = Date.now() - startTime;
       const _CLOUD_PREFIXES = ['gpt-', 'o1-', 'o3-', 'o4-', 'claude-', 'gemini-', 'openrouter/', 'MiniMax-', 'chatgpt-'];
-      const engineLabel = _CLOUD_PREFIXES.some(p => selectedModel.startsWith(p)) ? 'cloud' : 'ollama';
+      const selectedOwner = useAppStore.getState().models.find((m) => m.id === selectedModel)?.owned_by;
+      const engineLabel = selectedOwner === 'litellm'
+        ? 'litellm'
+        : _CLOUD_PREFIXES.some(p => selectedModel.startsWith(p)) ? 'cloud' : 'ollama';
       const telemetry: MessageTelemetry = {
         engine: engineLabel,
         model_id: selectedModel,

frontend/src/components/Chat/SystemPanel.tsx

@@ -29,8 +29,8 @@ interface TelemetryStats {
 }
 
 const CLOUD_PRICING = [
-  { name: 'GPT-5.3', input: 2.00, output: 10.00, primary: true },
-  { name: 'Claude Opus 4.6', input: 5.00, output: 25.00, primary: false },
+  { name: 'GPT-5.6 Sol', input: 5.00, output: 30.00, primary: true },
+  { name: 'Claude Fable 5', input: 10.00, output: 50.00, primary: false },
   { name: 'Gemini 3.1 Pro', input: 2.00, output: 12.00, primary: false },
 ];
 

frontend/src/components/CommandPalette.tsx

@@ -143,18 +143,17 @@ export function CommandPalette() {
     }
   }, [pullSuccess]);
 
-  const handleSelect = async (modelId: string) => {
+  const handleSelect = async (modelId: string, owner?: string) => {
     const previousModel = selectedModel;
     setSelectedModel(modelId);
     setCommandPaletteOpen(false);
 
     if (modelId !== previousModel) {
-      const { createConversation, setModelLoading, addLogEntry } = useAppStore.getState();
-      createConversation(modelId);
+      const { setModelLoading, addLogEntry } = useAppStore.getState();
       setModelLoading(true);
       addLogEntry({ timestamp: Date.now(), level: 'info', category: 'model', message: `Switching to ${modelId}...` });
       try {
-        await preloadModel(modelId);
+        await preloadModel(modelId, owner);
         addLogEntry({ timestamp: Date.now(), level: 'info', category: 'model', message: `${modelId} loaded` });
       } catch (e: any) {
         addLogEntry({ timestamp: Date.now(), level: 'error', category: 'model', message: `Failed to load ${modelId}: ${e.message}` });
@@ -256,7 +255,8 @@ export function CommandPalette() {
       setSelectedIdx((i) => Math.max(i - 1, 0));
     } else if (e.key === 'Enter' && tab === 'installed' && filtered.length > 0) {
       e.preventDefault();
-      handleSelect((filtered[selectedIdx] as any).id);
+      const model = filtered[selectedIdx] as (typeof models)[number];
+      handleSelect(model.id, model.owned_by);
     }
   };
 
@@ -366,11 +366,15 @@ export function CommandPalette() {
                     onMouseEnter={() => setSelectedIdx(idx)}
                   >
                     <button
-                      onClick={() => handleSelect(model.id)}
+                      onClick={() => handleSelect(model.id, model.owned_by)}
                       className="flex items-center gap-3 flex-1 min-w-0 text-left cursor-pointer"
                       style={{ background: 'none', border: 'none', padding: 0 }}
                     >
-                      <Cpu size={16} style={{ color: isActive ? 'var(--color-accent)' : 'var(--color-text-tertiary)' }} />
+                      {model.owned_by === 'litellm' ? (
+                        <Cloud size={16} style={{ color: isActive ? 'var(--color-accent)' : 'var(--color-text-tertiary)' }} />
+                      ) : (
+                        <Cpu size={16} style={{ color: isActive ? 'var(--color-accent)' : 'var(--color-text-tertiary)' }} />
+                      )}
                       <div className="flex-1 min-w-0">
                         <div className="text-sm truncate" style={{ color: isActive ? 'var(--color-accent)' : 'var(--color-text)', fontWeight: isActive ? 500 : 400 }}>
                           {model.id}
@@ -382,17 +386,19 @@ export function CommandPalette() {
                         </span>
                       )}
                     </button>
-                    <button
-                      onClick={() => handleDelete(model.id)}
-                      disabled={isDeleting}
-                      className="p-1 rounded transition-colors cursor-pointer"
-                      style={{ color: 'var(--color-text-tertiary)', opacity: 0 }}
-                      title="Delete model"
-                      onMouseEnter={(e) => { e.currentTarget.style.opacity = '1'; e.currentTarget.style.color = 'var(--color-error)'; }}
-                      onMouseLeave={(e) => { e.currentTarget.style.opacity = '0'; e.currentTarget.style.color = 'var(--color-text-tertiary)'; }}
-                    >
-                      {isDeleting ? <Loader2 size={14} className="animate-spin" /> : <Trash2 size={14} />}
-                    </button>
+                    {model.owned_by !== 'litellm' && (
+                      <button
+                        onClick={() => handleDelete(model.id)}
+                        disabled={isDeleting}
+                        className="p-1 rounded transition-colors cursor-pointer"
+                        style={{ color: 'var(--color-text-tertiary)', opacity: 0 }}
+                        title="Delete model"
+                        onMouseEnter={(e) => { e.currentTarget.style.opacity = '1'; e.currentTarget.style.color = 'var(--color-error)'; }}
+                        onMouseLeave={(e) => { e.currentTarget.style.opacity = '0'; e.currentTarget.style.color = 'var(--color-text-tertiary)'; }}
+                      >
+                        {isDeleting ? <Loader2 size={14} className="animate-spin" /> : <Trash2 size={14} />}
+                      </button>
+                    )}
                   </div>
                 );
               })

frontend/src/components/Dashboard/CostComparison.tsx

@@ -2,8 +2,8 @@ import { DollarSign, TrendingDown, Cloud, HardDrive } from 'lucide-react';
 import { useAppStore } from '../../lib/store';
 
 const CLOUD_PRICING = [
-  { name: 'GPT-5.3', input: 2.00, output: 10.00 },
-  { name: 'Claude Opus 4.6', input: 5.00, output: 25.00 },
+  { name: 'GPT-5.6 Sol', input: 5.00, output: 30.00 },
+  { name: 'Claude Fable 5', input: 10.00, output: 50.00 },
   { name: 'Gemini 3.1 Pro', input: 2.00, output: 12.00 },
 ];
 

frontend/src/components/Desktop/SavingsDashboard.tsx

@@ -222,8 +222,8 @@ const styles: Record<string, React.CSSProperties> = {
 };
 
 const PROVIDER_COLORS: Record<string, string> = {
-  'gpt-5.3': colors.green,
-  'claude-opus-4.6': colors.yellow,
+  'gpt-5.6-sol': colors.green,
+  'claude-fable-5': colors.yellow,
   'gemini-3.1-pro': colors.accent,
 };
 

frontend/src/lib/api.auth.test.ts

@@ -6,6 +6,7 @@ import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 // authHeaders) that source the key and build the header.
 
 const SETTINGS_KEY = 'openjarvis-settings';
+const fetchMock = vi.fn<typeof fetch>();
 
 // Minimal in-memory localStorage stub so the helpers can run under node
 // (no jsdom dependency).
@@ -28,6 +29,8 @@ class MemoryStorage {
 beforeEach(() => {
   vi.resetModules();
   vi.stubEnv('VITE_SUPABASE_ANON_KEY', 'test-anon-key');
+  fetchMock.mockReset();
+  globalThis.fetch = fetchMock;
   (globalThis as unknown as { localStorage: MemoryStorage }).localStorage =
     new MemoryStorage();
 });
@@ -86,3 +89,50 @@ describe('authHeaders', () => {
     });
   });
 });
+
+describe('tool credentials', () => {
+  it('reads credential status from the local server', async () => {
+    fetchMock.mockResolvedValue(
+      new Response(JSON.stringify({ TAVILY_API_KEY: true }), {
+        status: 200,
+        headers: { 'Content-Type': 'application/json' },
+      }),
+    );
+    const { fetchToolCredentialStatus } = await freshApi();
+
+    await expect(fetchToolCredentialStatus('web_search')).resolves.toEqual({
+      TAVILY_API_KEY: true,
+    });
+    expect(fetchMock).toHaveBeenCalledWith(
+      '/v1/tools/web_search/credentials/status',
+      { headers: {} },
+    );
+  });
+
+  it('saves a tool credential through the local server', async () => {
+    fetchMock.mockResolvedValue(new Response('{}', { status: 200 }));
+    const { saveToolCredentials } = await freshApi();
+
+    await saveToolCredentials('web_search', {
+      TAVILY_API_KEY: 'tvly-test',
+    });
+
+    expect(fetchMock).toHaveBeenCalledWith('/v1/tools/web_search/credentials', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ TAVILY_API_KEY: 'tvly-test' }),
+    });
+  });
+
+  it('deletes a tool credential through the local server', async () => {
+    fetchMock.mockResolvedValue(new Response('{}', { status: 200 }));
+    const { deleteToolCredential } = await freshApi();
+
+    await deleteToolCredential('web_search', 'TAVILY_API_KEY');
+
+    expect(fetchMock).toHaveBeenCalledWith(
+      '/v1/tools/web_search/credentials/TAVILY_API_KEY',
+      { method: 'DELETE', headers: {} },
+    );
+  });
+});

frontend/src/lib/api.ts

@@ -218,9 +218,9 @@ export async function deleteModel(modelName: string): Promise<void> {
 
 const _CLOUD_PREFIXES = ['gpt-', 'o1-', 'o3-', 'o4-', 'claude-', 'gemini-', 'openrouter/'];
 
-export async function preloadModel(modelName: string): Promise<void> {
+export async function preloadModel(modelName: string, owner?: string): Promise<void> {
   // Cloud models don't need Ollama preloading
-  if (_CLOUD_PREFIXES.some(p => modelName.startsWith(p))) {
+  if (owner === 'litellm' || _CLOUD_PREFIXES.some(p => modelName.startsWith(p))) {
     return;
   }
   // Trigger Ollama to load the model into memory (empty prompt, no generation).
@@ -885,6 +885,25 @@ export async function saveToolCredentials(
   if (!res.ok) throw new Error(`Failed: ${res.status}`);
 }
 
+export async function fetchToolCredentialStatus(
+  toolName: string,
+): Promise<Record<string, boolean>> {
+  const res = await apiFetch(`/v1/tools/${toolName}/credentials/status`);
+  if (!res.ok) throw new Error(`Failed: ${res.status}`);
+  return await res.json();
+}
+
+export async function deleteToolCredential(
+  toolName: string,
+  keyName: string,
+): Promise<void> {
+  const res = await apiFetch(
+    `/v1/tools/${encodeURIComponent(toolName)}/credentials/${encodeURIComponent(keyName)}`,
+    { method: 'DELETE' },
+  );
+  if (!res.ok) throw new Error(`Failed: ${res.status}`);
+}
+
 export interface AgentTraceDetail {
   id: string;
   agent: string;

frontend/src/pages/AgentsPage.tsx

@@ -23,7 +23,6 @@ import {
   fetchAgentTrace,
   fetchManagedAgent,
   fetchAvailableTools,
-  saveToolCredentials,
   fetchModels,
   updateManagedAgent,
   fetchRecommendedModel,
@@ -575,7 +574,7 @@ function ToolsPicker({
           </div>
           {/* Live description strip */}
           <div
-            className="flex items-center gap-2 px-2.5 py-1.5"
+            className="flex items-start gap-2 px-2.5 py-1.5"
             style={{
               borderTop: '1px solid var(--color-border)',
               background: 'var(--color-bg)',
@@ -609,10 +608,11 @@ function ToolsPicker({
               </span>
             )}
             <span
-              className="truncate"
+              className="min-w-0 whitespace-normal break-words"
               style={{
                 flex: 1,
                 color: 'var(--color-text-tertiary)',
+                lineHeight: 1.4,
               }}
             >
               {hovered ? `— ${hint}` : hint}
@@ -3740,8 +3740,8 @@ export function AgentsPage() {
               const paramsB = paramMatch ? parseFloat(paramMatch[1]) : 9;
               const flops = 2 * paramsB * 1e9 * (inTok + outTok);
               const providers = [
-                { label: 'GPT-5.3', inPer1M: 2.0, outPer1M: 10.0 },
-                { label: 'Claude Opus 4.6', inPer1M: 5.0, outPer1M: 25.0 },
+                { label: 'GPT-5.6 Sol', inPer1M: 5.0, outPer1M: 30.0 },
+                { label: 'Claude Fable 5', inPer1M: 10.0, outPer1M: 50.0 },
                 { label: 'Gemini 3.1 Pro', inPer1M: 2.0, outPer1M: 12.0 },
               ];
               const energyWh = (inTok + outTok) / 1000 * 0.4;

frontend/src/pages/SettingsPage.tsx

@@ -27,6 +27,9 @@ import {
   setInferenceSource,
   getCloudKeyStatus,
   saveCloudKey,
+  fetchToolCredentialStatus,
+  saveToolCredentials,
+  deleteToolCredential,
   isTauri,
   type InferenceSource,
 } from '../lib/api';
@@ -56,25 +59,37 @@ function OllamaModelList() {
   );
 }
 
-function ApiKeyInput({ keyName, placeholder }: { keyName: string; placeholder: string }) {
+function ApiKeyInput({
+  keyName,
+  placeholder,
+  toolName,
+}: {
+  keyName: string;
+  placeholder: string;
+  toolName?: string;
+}) {
   const [value, setValue] = useState('');
   const [saved, setSaved] = useState(false);
   const [hasKey, setHasKey] = useState(false);
   const [error, setError] = useState('');
   const desktopKeyStorage = isTauri();
+  const serverToolStorage = !desktopKeyStorage && !!toolName;
+  const canManage = desktopKeyStorage || serverToolStorage;
 
   const refresh = useCallback(async () => {
-    if (!desktopKeyStorage) {
+    if (!canManage) {
       setHasKey(false);
       return;
     }
     try {
-      const status = await getCloudKeyStatus();
+      const status = desktopKeyStorage
+        ? await getCloudKeyStatus()
+        : await fetchToolCredentialStatus(toolName!);
       setHasKey(!!status[keyName]);
     } catch {
       setHasKey(false);
     }
-  }, [desktopKeyStorage, keyName]);
+  }, [canManage, desktopKeyStorage, keyName, toolName]);
 
   useEffect(() => {
     void refresh();
@@ -87,7 +102,13 @@ function ApiKeyInput({ keyName, placeholder }: { keyName: string; placeholder: s
     if (!next) return;
     setError('');
     try {
-      await saveCloudKey(keyName, next);
+      if (desktopKeyStorage) {
+        await saveCloudKey(keyName, next);
+      } else if (toolName) {
+        await saveToolCredentials(toolName, { [keyName]: next });
+      } else {
+        return;
+      }
       setValue('');
       setHasKey(true);
       setSaved(true);
@@ -101,7 +122,13 @@ function ApiKeyInput({ keyName, placeholder }: { keyName: string; placeholder: s
   const remove = async () => {
     setError('');
     try {
-      await saveCloudKey(keyName, '');
+      if (desktopKeyStorage) {
+        await saveCloudKey(keyName, '');
+      } else if (toolName) {
+        await deleteToolCredential(toolName, keyName);
+      } else {
+        return;
+      }
       setValue('');
       setHasKey(false);
       setSaved(true);
@@ -119,8 +146,8 @@ function ApiKeyInput({ keyName, placeholder }: { keyName: string; placeholder: s
         value={value}
         onChange={e => setValue(e.target.value)}
         onBlur={() => { if (value.trim()) void save(value); }}
-        placeholder={hasKey ? 'Saved in secure storage' : placeholder}
-        disabled={!desktopKeyStorage}
+        placeholder={hasKey ? (desktopKeyStorage ? 'Saved in secure storage' : 'Saved by local server') : placeholder}
+        disabled={!canManage}
         className="w-48 px-2 py-1 rounded text-xs"
         style={{ background: 'var(--color-bg)', border: '1px solid var(--color-border)', color: 'var(--color-text)' }} />
       {hasKey && (
@@ -542,7 +569,7 @@ export function SettingsPage() {
           {/* Tools */}
           <Section title="Tools">
             <SettingRow label="Web Search" description="Tavily key for web search tool">
-              <ApiKeyInput keyName="TAVILY_API_KEY" placeholder="tvly-..." />
+              <ApiKeyInput keyName="TAVILY_API_KEY" placeholder="tvly-..." toolName="web_search" />
             </SettingRow>
           </Section>
 
@@ -805,7 +832,7 @@ export function SettingsPage() {
               </p>
               <div className="flex gap-3 mt-3 text-xs">
                 <a
-                  href="https://scalingintelligence.stanford.edu/blogs/openjarvis/"
+                  href="https://openjarvis.stanford.edu/"
                   target="_blank"
                   rel="noopener noreferrer"
                   style={{ color: 'var(--color-accent)' }}

frontend/vite.config.ts

@@ -54,7 +54,15 @@ export default defineConfig({
   server: {
     port: 5173,
     proxy: {
-      '/v1': process.env.VITE_API_URL || 'http://localhost:8000',
+      // ws: true is required for the /v1/agents/events WebSocket. Without it
+      // Vite proxies the HTTP request but not the upgrade, so the socket never
+      // opens — no error, no close event, just silence — and every live agent
+      // view sits empty in dev while working in a production build.
+      '/v1': {
+        target: process.env.VITE_API_URL || 'http://localhost:8000',
+        changeOrigin: true,
+        ws: true,
+      },
       '/health': process.env.VITE_API_URL || 'http://localhost:8000',
       '/api': process.env.VITE_API_URL || 'http://localhost:8000',
     },

mkdocs.yml

@@ -196,6 +196,7 @@ nav:
       - Telemetry: user-guide/telemetry.md
       - Evaluations: user-guide/evaluations.md
       - Benchmarks: user-guide/benchmarks.md
+      - System Access: user-guide/system-access.md
       - Security: user-guide/security.md
       - LLM-guided spec search: user-guide/llm-guided-spec-search.md
   - Leaderboard: leaderboard.md

rust/crates/openjarvis-tools/src/storage/sqlite.rs

@@ -144,16 +144,21 @@ impl MemoryBackend for SQLiteMemory {
     ) -> Result<Vec<RetrievalResult>, OpenJarvisError> {
         let conn = self.conn.lock();
 
+        // Split on any non-alphanumeric character (not just whitespace) so
+        // internal punctuation — apostrophes in particular ("user's") — never
+        // reaches the FTS5 MATCH string. FTS5's query grammar treats an
+        // unescaped `'` as a string delimiter, so passing a raw token like
+        // `user's` through silently fails to parse and yields zero rows with
+        // no visible error. Splitting fully avoids needing to escape anything.
         let words: Vec<String> = query
-            .split_whitespace()
-            .map(|w| w.trim_matches(|c: char| "?.,!;:'\"()[]{}/ ".contains(c)).to_string())
+            .split(|c: char| !c.is_alphanumeric())
+            .map(|w| w.to_string())
             .filter(|w| !w.is_empty())
             .collect();
-        let fts_query = if words.len() == 1 {
-            words[0].clone()
-        } else {
-            words.join(" OR ")
-        };
+        if words.is_empty() {
+            return Ok(Vec::new());
+        }
+        let fts_query = words.join(" OR ");
 
         let mut stmt = conn
             .prepare(
@@ -320,6 +325,27 @@ mod tests {
         assert_eq!(mixed.len(), 2, "mixed-case query should find both documents");
     }
 
+    #[test]
+    fn test_sqlite_apostrophe_in_query() {
+        let mem = SQLiteMemory::in_memory().unwrap();
+        mem.store("The user's name is Trev.", "identity", None).unwrap();
+
+        // A query containing an internal apostrophe must not break FTS5's
+        // MATCH syntax (an unescaped `'` is a string delimiter in FTS5's
+        // query grammar), which previously caused this to silently return
+        // zero results instead of matching or erroring.
+        let multi_word = mem.retrieve("what is the user's name", 5).unwrap();
+        assert!(
+            !multi_word.is_empty(),
+            "query with an internal apostrophe should not silently return zero results"
+        );
+
+        // Bare single-word possessive: exercises the (former) single-word
+        // bypass path that skipped the OR-join entirely.
+        let bare = mem.retrieve("user's", 5).unwrap();
+        assert!(!bare.is_empty(), "single-word possessive query should still match");
+    }
+
     #[test]
     fn test_sqlite_scores_are_positive() {
         let mem = SQLiteMemory::in_memory().unwrap();

scripts/quickstart.sh

@@ -148,7 +148,8 @@ fi
 
 # ── 7. Install Python dependencies ──────────────────────────────────
 info "Installing Python dependencies..."
-uv sync --extra desktop --quiet 2>/dev/null || uv sync --extra desktop
+uv sync --extra desktop --extra tools-search --quiet 2>/dev/null \
+  || uv sync --extra desktop --extra tools-search
 ok "Python dependencies installed"
 
 # ── 7b. Build Rust extension ──────────────────────────────────────
@@ -164,11 +165,17 @@ ok "Frontend dependencies installed"
 
 # ── 9. Start backend ────────────────────────────────────────────────
 info "Starting backend API server on port 8000..."
+if curl -sf http://localhost:8000/health &>/dev/null; then
+  fail "An OpenJarvis server is already running on port 8000. Stop it before re-running quickstart so updated environment variables are applied."
+fi
 uv run jarvis serve --port 8000 &>/dev/null &
-CLEANUP_PIDS+=($!)
+BACKEND_PID=$!
+CLEANUP_PIDS+=("$BACKEND_PID")
 sleep 3
 
-if curl -sf http://localhost:8000/health &>/dev/null; then
+if ! kill -0 "$BACKEND_PID" 2>/dev/null; then
+  fail "Backend exited during startup. Run 'uv run jarvis serve --port 8000' to see the error."
+elif curl -sf http://localhost:8000/health &>/dev/null; then
   ok "Backend running at http://localhost:8000"
 else
   warn "Backend may still be starting..."

src/openjarvis/agents/_stubs.py

@@ -57,6 +57,10 @@ class BaseAgent(ABC):
 
     agent_id: str
     accepts_tools: bool = False
+    # Plain conversational agents may opt into the managed runtime's generic
+    # function-calling loop.  Specialized agents keep their own execution
+    # class even when process-wide MCP tools are available.
+    supports_managed_tool_fallback: bool = False
 
     def __init__(
         self,

src/openjarvis/agents/errors.py

@@ -2,6 +2,8 @@
 
 from __future__ import annotations
 
+from openjarvis.engine._base import looks_like_context_length_error
+
 
 class AgentTickError(Exception):
     """Base class for agent tick errors."""
@@ -64,6 +66,14 @@ def classify_error(exc: Exception) -> AgentTickError:
 
     msg = str(exc).lower()
 
+    # A context-window overflow is deterministic: retrying the identical
+    # over-length request can never succeed, so fail fast instead of burning
+    # the retry budget on it.
+    if getattr(exc, "is_context_length_error", False) or (
+        looks_like_context_length_error(msg)
+    ):
+        return FatalError(str(exc))
+
     # Check fatal patterns first (more specific)
     if isinstance(exc, PermissionError):
         return FatalError(str(exc))
@@ -90,6 +100,11 @@ def retry_delay(attempt: int) -> int:
 def suggest_action(error: AgentTickError) -> str:
     """Return a human-readable suggested action for the given error."""
     msg = str(error).lower()
+    if looks_like_context_length_error(msg):
+        return (
+            "Conversation too long for the model's context window \u2014 "
+            "start a new chat or shorten the conversation"
+        )
     if any(p in msg for p in ("rate limit", "rate_limit", "429", "too many requests")):
         return "Rate limited \u2014 agent will auto-retry on next tick"
     if any(p in msg for p in ("timeout", "timed out", "connection", "unavailable")):

src/openjarvis/agents/executor.py

@@ -2,7 +2,9 @@
 
 from __future__ import annotations
 
+import json
 import logging
+import threading
 import time
 from typing import TYPE_CHECKING, Any
 
@@ -14,6 +16,7 @@ from openjarvis.agents.errors import (
     classify_error,
     retry_delay,
 )
+from openjarvis.agents.tool_resolver import resolve_agent_tools
 from openjarvis.core.events import EventBus, EventType
 
 if TYPE_CHECKING:
@@ -33,6 +36,32 @@ _MAX_RETRIES = 3
 _AGENT_TICK_DEFAULT_MODEL = "gemma4:31b"
 
 
+def _tool_calls_for_storage(result: AgentResult) -> list[dict[str, Any]] | None:
+    """Convert executor tool results to the managed-message storage contract."""
+
+    calls: list[dict[str, Any]] = []
+    for tool_result in result.tool_results:
+        metadata = getattr(tool_result, "metadata", {}) or {}
+        arguments = metadata.get("arguments", "")
+        if not isinstance(arguments, str):
+            try:
+                arguments = json.dumps(arguments, sort_keys=True)
+            except (TypeError, ValueError):
+                arguments = json.dumps(str(arguments))
+        calls.append(
+            {
+                "tool": getattr(tool_result, "tool_name", ""),
+                "arguments": arguments,
+                "result": getattr(tool_result, "content", "") or "",
+                "success": bool(getattr(tool_result, "success", False)),
+                # SSE and the frontend persist/display latency in milliseconds.
+                "latency": float(getattr(tool_result, "latency_seconds", 0.0) or 0.0)
+                * 1000.0,
+            }
+        )
+    return calls or None
+
+
 class AgentExecutor:
     """Executes a single tick for a managed agent.
 
@@ -51,6 +80,7 @@ class AgentExecutor:
         self._manager = manager
         self._bus = event_bus
         self._trace_store = trace_store
+        self._toolkit_local = threading.local()
 
     def set_system(self, system: Any) -> None:
         """Deferred system injection — called after JarvisSystem is constructed."""
@@ -63,27 +93,6 @@ class AgentExecutor:
         except Exception:
             pass  # Non-critical
 
-    def _inject_tool_deps(self, tool: Any) -> None:
-        """Inject runtime dependencies into a tool instance.
-
-        Mirrors SystemBuilder._inject_tool_deps (system.py:920-945)
-        but uses the lightweight system's references.
-        """
-        if self._system is None:
-            return
-        name = getattr(getattr(tool, "spec", None), "name", "")
-        if name == "llm":
-            if hasattr(tool, "_engine"):
-                tool._engine = self._system.engine
-            if hasattr(tool, "_model"):
-                tool._model = self._system.model
-        elif name == "retrieval" or name.startswith("memory_"):
-            if hasattr(tool, "_backend"):
-                tool._backend = getattr(self._system, "memory_backend", None)
-        elif name.startswith("channel_"):
-            if hasattr(tool, "_channel"):
-                tool._channel = getattr(self._system, "channel_backend", None)
-
     def run_ephemeral(
         self,
         agent_type: str,
@@ -248,7 +257,20 @@ class AgentExecutor:
         raise last_error or FatalError("max retries exhausted")
 
     def _invoke_agent(self, agent: dict) -> AgentResult:
-        """Invoke the actual agent run. Tests mock this method."""
+        """Invoke one agent while owning every resource its resolver opens."""
+
+        previous = getattr(self._toolkit_local, "current", None)
+        self._toolkit_local.current = None
+        try:
+            return self._invoke_agent_impl(agent)
+        finally:
+            current = getattr(self._toolkit_local, "current", None)
+            if current is not None:
+                current.close()
+            self._toolkit_local.current = previous
+
+    def _invoke_agent_impl(self, agent: dict) -> AgentResult:
+        """Implementation split out so the wrapper owns resolver lifetime."""
         from openjarvis.agents import AgentRegistry
 
         agent_type = agent.get("agent_type", "monitor_operative")
@@ -257,6 +279,10 @@ class AgentExecutor:
             raise FatalError(f"Unknown agent type: {agent_type}")
 
         config = agent.get("config", {})
+        agent_accepts_tools = bool(getattr(agent_cls, "accepts_tools", False))
+        supports_tool_fallback = bool(
+            getattr(agent_cls, "supports_managed_tool_fallback", False)
+        )
 
         # Resolve engine + model from JarvisSystem
         engine = self._system.engine if self._system else None
@@ -300,64 +326,88 @@ class AgentExecutor:
             except Exception:
                 pass  # Fall back to configured model
 
-        # Resolve tools from config via ToolRegistry
-        tool_names = config.get("tools", [])
-        if isinstance(tool_names, str):
-            tool_names = [t.strip() for t in tool_names.split(",") if t.strip()]
+        mcp_tools: list[Any] = []
+        mcp_clients: list[Any] = []
+        if (
+            config.get("mcp_tools", True) is not False
+            and self._system is not None
+            and (agent_accepts_tools or supports_tool_fallback)
+        ):
+            provider = getattr(
+                self._system,
+                "get_managed_agent_mcp_tools",
+                None,
+            )
+            if callable(provider):
+                try:
+                    mcp_tools, mcp_clients = provider()
+                except Exception as exc:
+                    logger.warning("Managed-agent MCP discovery failed: %s", exc)
+            else:
+                mcp_tools = list(getattr(self._system, "mcp_tools", []) or [])
+                mcp_clients = list(getattr(self._system, "_mcp_clients", []) or [])
 
-        tool_instances: list[Any] = []
-        if tool_names:
-            try:
-                from openjarvis.server.agent_manager_routes import (
-                    _ensure_registries_populated,
-                )
+            if not mcp_tools:
+                try:
+                    from openjarvis.tools.mcp_adapter import MCPToolAdapter
 
-                _ensure_registries_populated()
-            except ImportError:
-                pass
-            from openjarvis.core.registry import ToolRegistry
+                    pool = (
+                        getattr(
+                            getattr(self._system, "tool_executor", None),
+                            "_tools",
+                            {},
+                        )
+                        or {}
+                    )
+                    mcp_tools = [
+                        tool
+                        for tool in pool.values()
+                        if isinstance(tool, MCPToolAdapter)
+                    ]
+                except Exception:
+                    mcp_tools = []
 
-            for tname in tool_names:
-                if ToolRegistry.contains(tname):
-                    try:
-                        tool_cls = ToolRegistry.get(tname)
-                        tool = tool_cls()
-                        self._inject_tool_deps(tool)
-                        tool_instances.append(tool)
-                    except Exception:
-                        logger.warning("Failed to instantiate tool %s", tname)
+        resolved_toolkit = resolve_agent_tools(
+            agent,
+            engine=engine,
+            model=model,
+            memory_backend=getattr(self._system, "memory_backend", None),
+            channel_backend=getattr(self._system, "channel_backend", None),
+            mcp_tools=mcp_tools,
+            mcp_clients=mcp_clients,
+            knowledge_db_path=getattr(self._system, "knowledge_db_path", None),
+        )
+        self._toolkit_local.current = resolved_toolkit
+        tool_instances = resolved_toolkit.instances
+        logger.info(
+            "Agent %s: resolved %d tools (%s)",
+            agent["name"],
+            len(tool_instances),
+            ", ".join(resolved_toolkit.by_name) or "none",
+        )
 
-            # Pull tools already discovered by SystemBuilder (e.g. external MCP
-            # adapters) that aren't in the static ToolRegistry. Without this,
-            # agents declaring MCP-discovered tools in their template would
-            # silently fall back to natives only.
-            if (
-                self._system is not None
-                and getattr(self._system, "tool_executor", None) is not None
-            ):
-                mcp_pool = getattr(self._system.tool_executor, "_tools", {}) or {}
-                existing = {t.spec.name for t in tool_instances}
-                for tname in tool_names:
-                    if tname in existing:
-                        continue
-                    pooled = mcp_pool.get(tname)
-                    if pooled is not None:
-                        tool_instances.append(pooled)
+        execution_agent_cls = agent_cls
+        if tool_instances and not agent_accepts_tools and supports_tool_fallback:
+            # Managed SSE already runs configured tools through a native
+            # function-calling loop regardless of the selected class. Use the
+            # same capability for immediate/scheduled ticks instead of
+            # silently discarding the resolved toolkit for SimpleAgent and
+            # other explicitly compatible non-tool classes.
+            from openjarvis.agents.orchestrator import OrchestratorAgent
 
-            if tool_instances:
-                logger.info(
-                    "Agent %s: resolved %d/%d tools",
-                    agent["name"],
-                    len(tool_instances),
-                    len(tool_names),
-                )
+            execution_agent_cls = OrchestratorAgent
+            logger.info(
+                "Agent %s: %s does not accept tools; using %s for this "
+                "tool-enabled tick",
+                agent["name"],
+                agent_cls.__name__,
+                execution_agent_cls.__name__,
+            )
 
         # Construct agent instance
         agent_kwargs: dict[str, Any] = {}
         sys_prompt = config.get("system_prompt")
-        if sys_prompt is not None:
-            agent_kwargs["system_prompt"] = sys_prompt
-        if getattr(agent_cls, "accepts_tools", False) and tool_instances:
+        if getattr(execution_agent_cls, "accepts_tools", False) and tool_instances:
             agent_kwargs["tools"] = tool_instances
         # Hand the agent our EventBus so its ToolExecutor can publish
         # TOOL_CALL_START/END — without this, ToolExecutor's ``self._bus``
@@ -379,7 +429,7 @@ class AgentExecutor:
         # recall / persistence paths.
         import inspect
 
-        init_sig = inspect.signature(agent_cls.__init__)
+        init_sig = inspect.signature(execution_agent_cls.__init__)
         accepts_var_kw = any(
             p.kind == inspect.Parameter.VAR_KEYWORD
             for p in init_sig.parameters.values()
@@ -388,6 +438,16 @@ class AgentExecutor:
         def _accepts(name: str) -> bool:
             return accepts_var_kw or name in init_sig.parameters
 
+        # Unsupported kwargs used to trigger the broad TypeError fallback
+        # below, which retried with a bare constructor and silently discarded
+        # valid prompt/state wiring. Filter by the selected class's signature
+        # before construction instead.
+        if sys_prompt is not None and _accepts("system_prompt"):
+            agent_kwargs["system_prompt"] = sys_prompt
+        agent_kwargs = {
+            name: value for name, value in agent_kwargs.items() if _accepts(name)
+        }
+
         state_kwargs: dict[str, Any] = {}
         if _accepts("operator_id"):
             state_kwargs["operator_id"] = agent["id"]
@@ -404,23 +464,49 @@ class AgentExecutor:
             # agents, mirroring the one-shot `jarvis ask` path so they no
             # longer apply to CLI calls only (#376).
             cfg = getattr(self._system, "config", None)
-            if cfg is not None and _accepts("prompt_builder"):
+            if _accepts("prompt_builder") and (
+                cfg is not None or sys_prompt is not None
+            ):
                 from openjarvis.prompt.builder import SystemPromptBuilder
 
                 state_kwargs["prompt_builder"] = SystemPromptBuilder(
-                    agent_template=getattr(cfg.agent, "default_system_prompt", "")
-                    or "",
-                    memory_files_config=cfg.memory_files,
-                    system_prompt_config=cfg.system_prompt,
+                    agent_template=(
+                        sys_prompt
+                        if sys_prompt is not None
+                        else getattr(
+                            getattr(cfg, "agent", None),
+                            "default_system_prompt",
+                            "",
+                        )
+                        or ""
+                    ),
+                    memory_files_config=getattr(cfg, "memory_files", None),
+                    system_prompt_config=getattr(cfg, "system_prompt", None),
                 )
 
         try:
-            agent_instance = agent_cls(engine, model, **agent_kwargs, **state_kwargs)
-        except TypeError:
             try:
-                agent_instance = agent_cls(engine, model, **agent_kwargs)
+                agent_instance = execution_agent_cls(
+                    engine,
+                    model,
+                    **agent_kwargs,
+                    **state_kwargs,
+                )
             except TypeError:
-                agent_instance = agent_cls(engine, model)
+                try:
+                    agent_instance = execution_agent_cls(
+                        engine,
+                        model,
+                        **agent_kwargs,
+                    )
+                except TypeError:
+                    agent_instance = execution_agent_cls(engine, model)
+        except Exception:
+            resolved_toolkit.close()
+            raise
+
+        if resolved_toolkit.mcp_clients:
+            agent_instance._mcp_clients = resolved_toolkit.mcp_clients
 
         # Inject the managed-agent UUID into the agent's ToolExecutor so
         # emitted TOOL_CALL_START/END events carry it; the trace subscriber
@@ -436,7 +522,7 @@ class AgentExecutor:
             agent["name"],
             len(tool_instances),
             ", ".join(t.spec.name for t in tool_instances) or "none",
-            agent_cls.__name__,
+            execution_agent_cls.__name__,
         )
 
         # Build input from instruction + summary_memory + pending messages.
@@ -551,21 +637,24 @@ class AgentExecutor:
             len(input_text),
         )
         _t0 = time.time()
-        result = agent_instance.run(input_text, context=agent_ctx)
-
-        # Retry once if the model returned empty content (common with
-        # Qwen3.5 thinking mode consuming all tokens).
-        if not (result.content or "").strip():
-            self._set_activity(
-                agent["id"],
-                "Retrying (empty response)...",
-            )
-            logger.warning(
-                "Agent %s: empty content, retrying once",
-                agent["name"],
-            )
+        try:
             result = agent_instance.run(input_text, context=agent_ctx)
 
+            # Retry once if the model returned empty content (common with
+            # Qwen3.5 thinking mode consuming all tokens).
+            if not (result.content or "").strip():
+                self._set_activity(
+                    agent["id"],
+                    "Retrying (empty response)...",
+                )
+                logger.warning(
+                    "Agent %s: empty content, retrying once",
+                    agent["name"],
+                )
+                result = agent_instance.run(input_text, context=agent_ctx)
+        finally:
+            resolved_toolkit.close()
+
         _elapsed = time.time() - _t0
         logger.info(
             "Agent %s: agent.run() completed in %.1fs, "
@@ -655,7 +744,11 @@ class AgentExecutor:
                 # message keeps the complete report. The old [:2000] slices
                 # double-truncated and cut findings off mid-sentence.
                 self._manager.update_summary_memory(agent_id, result.content)
-                self._manager.store_agent_response(agent_id, result.content)
+                self._manager.store_agent_response(
+                    agent_id,
+                    result.content,
+                    tool_calls=_tool_calls_for_storage(result),
+                )
 
             # Budget enforcement (post-tick check)
             agent_data = self._manager.get_agent(agent_id)

src/openjarvis/agents/hybrid/mini_swe_agent.py

@@ -1403,12 +1403,10 @@ def _loop_local(
             # server walled the call. Compact aggressively (keep_last=1)
             # and retry once. Re-raise on anything else or on a second
             # failure — the runner records the row as errored.
+            from openjarvis.engine._base import looks_like_context_length_error
+
             msg = str(exc)
-            is_ctx = (
-                "maximum context length" in msg
-                or "context length" in msg.lower()
-                and "exceed" in msg.lower()
-            )
+            is_ctx = looks_like_context_length_error(msg)
             if not is_ctx:
                 raise
             _record_event(

src/openjarvis/agents/orchestrator.py

@@ -57,6 +57,7 @@ class OrchestratorAgent(ToolUsingAgent):
         max_tokens: Optional[int] = None,
         mode: str = "function_calling",
         system_prompt: Optional[str] = None,
+        prompt_builder: Optional[Any] = None,
         parallel_tools: bool = True,
         interactive: bool = False,
         confirm_callback=None,
@@ -71,6 +72,7 @@ class OrchestratorAgent(ToolUsingAgent):
             max_tokens=max_tokens,
             interactive=interactive,
             confirm_callback=confirm_callback,
+            prompt_builder=prompt_builder,
         )
         self._mode = mode
         self._system_prompt = system_prompt
@@ -214,7 +216,11 @@ class OrchestratorAgent(ToolUsingAgent):
         self._emit_turn_start(input)
 
         # Build initial messages
-        messages = self._build_messages(input, context)
+        messages = self._build_messages(
+            input,
+            context,
+            system_prompt=self._system_prompt,
+        )
 
         # Get OpenAI-format tool definitions
         openai_tools = self._executor.get_openai_tools() if self._tools else []

src/openjarvis/agents/proactive_agent.py

@@ -37,6 +37,7 @@ called from your app startup:
 from __future__ import annotations
 
 import json
+import logging
 from datetime import datetime
 from pathlib import Path
 from typing import Any, Dict, List, Optional, Set
@@ -56,6 +57,15 @@ from openjarvis.tools.approval_store import (
 )
 from openjarvis.tools.proactive_tools import get_store
 
+logger = logging.getLogger(__name__)
+
+_PROACTIVE_CRON_PROMPT = (
+    "Run the proactive agent: collect overnight data, execute approved actions, "
+    "notify pending approvals."
+)
+_PROACTIVE_TASK_KEY = "proactive-daily"
+_PROACTIVE_TASK_KEY_FIELD = "openjarvis_task_key"
+
 _SYSTEM_PROMPT = """You are a proactive personal assistant agent. You have already collected
 data from the user's connected sources (email, messages, calendar). Your job is to:
 
@@ -252,14 +262,31 @@ def _build_notification_channel(channel_spec: str) -> Optional[Any]:
 
         if ChannelRegistry.contains(channel_type):
             channel_cls = ChannelRegistry.get(channel_type)
-            instance = channel_cls()
+            # Load credentials from config so the channel uses bot_token from
+            # config.toml rather than falling back to a bare env var.
             try:
-                instance.connect()
+                from openjarvis.core.config import load_config
+                from openjarvis.system._channel_kwargs import build_channel_kwargs
+
+                _cfg = load_config()
+                _kwargs = build_channel_kwargs(_cfg.channel, channel_type)
             except Exception:
-                pass
+                _kwargs = {}
+            instance = channel_cls(**_kwargs)
+            # Telegram.send() is self-contained, while connect() starts a
+            # getUpdates loop.  A second loop for the same bot token conflicts
+            # with the server's main listener.  Other channel implementations
+            # may initialize resources required by send() in connect(), so keep
+            # their established lifecycle intact.
+            if channel_type != "telegram":
+                instance.connect()
             return instance
     except Exception:
-        pass
+        logger.warning(
+            "Failed to build proactive notification channel %s",
+            channel_type,
+            exc_info=True,
+        )
 
     return None
 
@@ -299,6 +326,7 @@ class ProactiveAgent(ToolUsingAgent):
             self._notification_channel_id
         )
         self._notification_channel = notification_channel
+        self._notification_destination = self._notification_channel_id.partition(":")[2]
 
         from openjarvis.tools.channel_tools import ChannelSendTool
         from openjarvis.tools.digest_collect import DigestCollectTool
@@ -484,13 +512,13 @@ class ProactiveAgent(ToolUsingAgent):
         # --- Step 5: Build and send notification ---
         notification = self._build_notification(executed_results, pending_actions)
 
-        if notification and self._notification_channel_id:
+        if notification and self._notification_destination:
             send_call = ToolCall(
                 id="proactive-notify-1",
                 name="channel_send",
                 arguments=json.dumps(
                     {
-                        "channel": self._notification_channel_id,
+                        "channel": self._notification_destination,
                         "content": notification,
                     }
                 ),
@@ -592,15 +620,74 @@ def register_cron(
         hours_back = hours_back or 24
         timezone = timezone or "America/Los_Angeles"
 
+    metadata = {
+        "notification_channel_id": notification_channel_id,
+        "hours_back": hours_back,
+        "timezone": timezone,
+        _PROACTIVE_TASK_KEY_FIELD: _PROACTIVE_TASK_KEY,
+    }
+
+    # Match the stable key for tasks created by this version and the historical
+    # agent+prompt signature so existing installations are migrated on startup.
+    existing = [
+        task
+        for task in scheduler.list_tasks()
+        if task.status in {"active", "paused"}
+        and task.agent == "proactive"
+        and (
+            task.metadata.get(_PROACTIVE_TASK_KEY_FIELD) == _PROACTIVE_TASK_KEY
+            or (task.prompt == _PROACTIVE_CRON_PROMPT and task.schedule_type == "cron")
+        )
+    ]
+
+    # A scheduler pause is an explicit user choice and must survive restart.
+    # Keep one deterministically and remove any active or paused duplicates.
+    paused = [task for task in existing if task.status == "paused"]
+    if paused:
+        keep = min(paused, key=lambda task: task.id)
+        _cancel_proactive_duplicates(scheduler, existing, keep=keep)
+        return keep
+
+    matching = [
+        task
+        for task in existing
+        if task.prompt == _PROACTIVE_CRON_PROMPT
+        and task.schedule_type == "cron"
+        and task.schedule_value == cron_expr
+        and task.context_mode == "isolated"
+        and task.metadata == metadata
+    ]
+    if matching:
+        keep = min(matching, key=lambda task: task.id)
+        _cancel_proactive_duplicates(scheduler, existing, keep=keep)
+        return keep
+
+    # Configuration changed. Replace stale active tasks so the schedule and
+    # notification settings from config.toml take effect on this startup.
+    _cancel_proactive_duplicates(scheduler, existing)
+
     return scheduler.create_task(
-        prompt="Run the proactive agent: collect overnight data, execute approved actions, notify pending approvals.",
+        prompt=_PROACTIVE_CRON_PROMPT,
         schedule_type="cron",
         schedule_value=cron_expr,
         agent="proactive",
         context_mode="isolated",
-        metadata={
-            "notification_channel_id": notification_channel_id,
-            "hours_back": hours_back,
-            "timezone": timezone,
-        },
+        metadata=metadata,
     )
+
+
+def _cancel_proactive_duplicates(
+    scheduler: Any, tasks: List[Any], *, keep: Optional[Any] = None
+) -> None:
+    """Cancel managed proactive tasks other than *keep*."""
+    for task in tasks:
+        if keep is not None and task.id == keep.id:
+            continue
+        try:
+            scheduler.cancel_task(task.id)
+        except Exception:
+            logger.warning(
+                "Failed to cancel duplicate proactive task %s",
+                task.id,
+                exc_info=True,
+            )

src/openjarvis/agents/scheduler.py

@@ -123,15 +123,35 @@ class AgentScheduler:
         self._thread.start()
         logger.info("Agent scheduler started")
 
-    def stop(self) -> None:
-        """Stop the scheduler background thread."""
+    def request_stop(self) -> None:
+        """Prevent new scheduled ticks without waiting for the worker."""
+
         self._stop_event.set()
         if self._bus:
             self._bus.unsubscribe(EventType.AGENT_TICK_END, self._on_tick_event)
-        if self._thread is not None:
-            self._thread.join(timeout=10)
+
+    def wait_stopped(self, timeout: float = 10.0) -> bool:
+        """Wait for an active tick to finish, retaining live thread state."""
+
+        thread = self._thread
+        if thread is None:
+            return True
+        if thread is threading.current_thread():
+            return False
+        thread.join(timeout=timeout)
+        if thread.is_alive():
+            logger.warning("Agent scheduler did not stop within %.1fs", timeout)
+            return False
+        if self._thread is thread:
             self._thread = None
-        logger.info("Agent scheduler stopped")
+        return True
+
+    def stop(self, timeout: float = 10.0) -> None:
+        """Stop dispatching and wait for the scheduler worker."""
+
+        self.request_stop()
+        if self.wait_stopped(timeout=timeout):
+            logger.info("Agent scheduler stopped")
 
     def _loop(self) -> None:
         """Main scheduler loop."""
@@ -160,6 +180,8 @@ class AgentScheduler:
             ]
 
         for agent_id, info in due:
+            if self._stop_event.is_set():
+                break
             agent = self._manager.get_agent(agent_id)
             if agent is None or agent["status"] in (
                 "paused",

src/openjarvis/agents/simple.py

@@ -13,6 +13,7 @@ class SimpleAgent(BaseAgent):
     """Single-turn agent: query -> model -> response.  No tool calling."""
 
     agent_id = "simple"
+    supports_managed_tool_fallback = True
 
     def run(
         self,

src/openjarvis/agents/tool_resolver.py

@@ -0,0 +1,502 @@
+"""Canonical managed-agent tool resolution.
+
+Managed agents can run through streaming HTTP, immediate/scheduled ticks, or
+the persistent-agent CLI.  Those paths must bind the same live tool instances:
+agent-type grants first, then configured native tools, then MCP adapters.
+"""
+
+from __future__ import annotations
+
+import importlib
+import logging
+import sys
+import weakref
+from dataclasses import dataclass, field, replace
+from pathlib import Path
+from typing import Any, Iterable, Mapping
+
+logger = logging.getLogger(__name__)
+
+BROWSER_SUB_TOOLS = (
+    "browser_navigate",
+    "browser_click",
+    "browser_type",
+    "browser_screenshot",
+    "browser_extract",
+    "browser_axtree",
+)
+
+_MEMORY_TOOLS = frozenset(
+    {"retrieval", "memory_store", "memory_search", "memory_index", "memory_retrieve"}
+)
+_CHANNEL_TOOLS = frozenset({"channel_send", "channel_list", "channel_status"})
+
+
+class _SpecOverrideTool:
+    """Delegate execution while exposing an agent-configured OpenAI schema."""
+
+    def __init__(self, wrapped: Any, advertised_spec: dict[str, Any]) -> None:
+        self._wrapped = wrapped
+        self._advertised_spec = advertised_spec
+
+    @property
+    def spec(self) -> Any:
+        base = self._wrapped.spec
+        function = self._advertised_spec.get("function", {})
+        return replace(
+            base,
+            name=function.get("name", base.name),
+            description=function.get("description", base.description),
+            parameters=function.get("parameters", base.parameters),
+        )
+
+    def execute(self, **params: Any) -> Any:
+        return self._wrapped.execute(**params)
+
+    def to_openai_function(self) -> dict[str, Any]:
+        return self._advertised_spec
+
+    def __getattr__(self, name: str) -> Any:
+        return getattr(self._wrapped, name)
+
+
+def _tool_name(tool: Any) -> str:
+    try:
+        return str(tool.spec.name)
+    except Exception:
+        return ""
+
+
+def _spec_name(spec: Mapping[str, Any]) -> str:
+    function = spec.get("function")
+    if not isinstance(function, Mapping):
+        return ""
+    name = function.get("name")
+    return str(name) if name else ""
+
+
+def _openai_spec(tool: Any) -> dict[str, Any]:
+    to_openai_function = getattr(tool, "to_openai_function", None)
+    if callable(to_openai_function):
+        try:
+            advertised = to_openai_function()
+        except Exception:
+            logger.debug(
+                "Failed to build advertised schema for tool %r; falling back "
+                "to its ToolSpec",
+                _tool_name(tool),
+                exc_info=True,
+            )
+        else:
+            if isinstance(advertised, Mapping) and _spec_name(advertised):
+                return dict(advertised)
+            logger.debug(
+                "Tool %r returned an invalid advertised schema; falling back "
+                "to its ToolSpec",
+                _tool_name(tool),
+            )
+
+    spec = tool.spec
+    return {
+        "type": "function",
+        "function": {
+            "name": spec.name,
+            "description": spec.description,
+            "parameters": spec.parameters,
+        },
+    }
+
+
+def _close_resources(resources: tuple[Any, ...]) -> None:
+    for resource in reversed(resources):
+        close = getattr(resource, "close", None)
+        if callable(close):
+            try:
+                close()
+            except Exception:
+                logger.debug("Failed to close resolved tool resource", exc_info=True)
+
+
+@dataclass
+class ResolvedAgentTools:
+    """One resolved toolkit, with views for agent loops and raw streaming."""
+
+    instances: list[Any] = field(default_factory=list)
+    extra_specs: list[dict[str, Any]] = field(default_factory=list)
+    advertised_specs: list[dict[str, Any]] = field(default_factory=list)
+    mcp_clients: list[Any] = field(default_factory=list)
+    owned_resources: list[Any] = field(default_factory=list, repr=False)
+    _closed: bool = field(default=False, init=False, repr=False)
+    _finalizer: weakref.finalize = field(init=False, repr=False)
+
+    def __post_init__(self) -> None:
+        # This fallback covers exceptions anywhere after resolution, including
+        # before an executor/response installs its normal explicit cleanup.
+        self._finalizer = weakref.finalize(
+            self,
+            _close_resources,
+            tuple(self.owned_resources),
+        )
+
+    @property
+    def by_name(self) -> dict[str, Any]:
+        return {name: tool for tool in self.instances if (name := _tool_name(tool))}
+
+    @property
+    def openai_specs(self) -> list[dict[str, Any]]:
+        specs: list[dict[str, Any]] = []
+        seen: set[str] = set()
+        advertised = self.advertised_specs
+        if not advertised:
+            advertised = [*map(_openai_spec, self.instances), *self.extra_specs]
+        for spec in advertised:
+            name = _spec_name(spec)
+            if name and name in seen:
+                continue
+            specs.append(spec)
+            if name:
+                seen.add(name)
+        return specs
+
+    def close(self) -> None:
+        """Close request-local resources without touching shared MCP clients."""
+
+        if self._closed:
+            return
+        self._closed = True
+        self._finalizer()
+
+    def __enter__(self) -> ResolvedAgentTools:
+        return self
+
+    def __exit__(self, *exc_info: object) -> None:
+        self.close()
+
+
+def ensure_registries_populated() -> None:
+    """Populate tool/channel registries, including after tests clear them."""
+
+    from openjarvis.core.registry import ChannelRegistry, ToolRegistry
+
+    try:
+        import openjarvis.channels  # noqa: F401
+    except Exception:
+        pass
+
+    try:
+        import openjarvis.tools  # noqa: F401
+    except Exception:
+        pass
+
+    browser_modules = ("openjarvis.tools.browser", "openjarvis.tools.browser_axtree")
+    for module_name in browser_modules:
+        try:
+            importlib.import_module(module_name)
+        except Exception:
+            pass
+
+    if not ChannelRegistry.keys():
+        for module_name in list(sys.modules):
+            if module_name.startswith(
+                "openjarvis.channels."
+            ) and not module_name.endswith("_stubs"):
+                try:
+                    importlib.reload(sys.modules[module_name])
+                except Exception:
+                    pass
+
+    if not ToolRegistry.keys():
+        for module_name in list(sys.modules):
+            if (
+                module_name.startswith("openjarvis.tools.")
+                and not module_name.endswith("_stubs")
+                and not module_name.endswith("agent_tools")
+            ):
+                try:
+                    importlib.reload(sys.modules[module_name])
+                except Exception:
+                    pass
+
+    if not any(ToolRegistry.contains(name) for name in BROWSER_SUB_TOOLS):
+        for module_name in browser_modules:
+            module = sys.modules.get(module_name)
+            if module is not None:
+                try:
+                    importlib.reload(module)
+                except Exception:
+                    pass
+
+
+def instantiate_registered_tool(
+    tool_cls: Any,
+    name: str,
+    *,
+    engine: Any,
+    model: str,
+    memory_backend: Any = None,
+    channel_backend: Any = None,
+) -> Any:
+    """Instantiate a registry tool with its runtime dependencies."""
+
+    if name in _MEMORY_TOOLS:
+        if memory_backend is None:
+            logger.warning(
+                "Memory tool %r instantiated without a backend — calls will "
+                "return no results.",
+                name,
+            )
+        return tool_cls(backend=memory_backend)
+    if name in _CHANNEL_TOOLS:
+        if channel_backend is None:
+            logger.warning(
+                "Channel tool %r instantiated without a channel — calls will "
+                "fail with 'No channel backend configured'.",
+                name,
+            )
+        return tool_cls(channel=channel_backend)
+    if name == "llm":
+        return tool_cls(engine=engine, model=model)
+    return tool_cls()
+
+
+def build_deep_research_tools(
+    engine: Any,
+    model: str,
+    knowledge_db_path: str | Path | None = None,
+) -> list[Any]:
+    """Construct the live knowledge tools granted to ``deep_research``."""
+
+    if not knowledge_db_path:
+        from openjarvis.core.config import DEFAULT_CONFIG_DIR
+
+        knowledge_db_path = DEFAULT_CONFIG_DIR / "knowledge.db"
+
+    path = Path(knowledge_db_path)
+    if not path.exists():
+        return []
+
+    from openjarvis.connectors.retriever import TwoStageRetriever
+    from openjarvis.connectors.store import KnowledgeStore
+    from openjarvis.tools.knowledge_search import KnowledgeSearchTool
+    from openjarvis.tools.knowledge_sql import KnowledgeSQLTool
+    from openjarvis.tools.scan_chunks import ScanChunksTool
+    from openjarvis.tools.think import ThinkTool
+
+    store = KnowledgeStore(str(path))
+    try:
+        retriever = TwoStageRetriever(store)
+        return [
+            KnowledgeSearchTool(retriever=retriever),
+            KnowledgeSQLTool(store=store),
+            ScanChunksTool(store=store, engine=engine, model=model),
+            ThinkTool(),
+        ]
+    except Exception:
+        store.close()
+        raise
+
+
+def _normalized_tool_config(tool_config: Any) -> list[Any]:
+    if not tool_config:
+        return []
+    if isinstance(tool_config, str):
+        return [part.strip() for part in tool_config.split(",") if part.strip()]
+    if isinstance(tool_config, Mapping):
+        return [dict(tool_config)]
+    try:
+        return list(tool_config)
+    except TypeError:
+        return []
+
+
+def resolve_agent_tools(
+    agent_record: Mapping[str, Any],
+    *,
+    engine: Any,
+    model: str,
+    memory_backend: Any = None,
+    channel_backend: Any = None,
+    mcp_tools: Iterable[Any] = (),
+    mcp_clients: Iterable[Any] = (),
+    knowledge_db_path: str | Path | None = None,
+) -> ResolvedAgentTools:
+    """Resolve the effective live toolkit for a managed agent.
+
+    Resolution is stable and first-wins: agent-type grants take precedence
+    over configured registry tools, which take precedence over MCP adapters.
+    ``config["mcp_tools"] = false`` excludes MCP adapters from this agent;
+    process-wide runtimes may still own connections used by other agents.
+    """
+
+    ensure_registries_populated()
+    from openjarvis.core.registry import ChannelRegistry, ToolRegistry
+
+    config = agent_record.get("config") or {}
+    if not isinstance(config, Mapping):
+        config = {}
+
+    instances: list[Any] = []
+    extra_specs: list[dict[str, Any]] = []
+    advertised_specs: list[dict[str, Any]] = []
+    owned_resources: list[Any] = []
+    seen: set[str] = set()
+
+    def add_instance(
+        tool: Any,
+        *,
+        advertised_spec: dict[str, Any] | None = None,
+    ) -> None:
+        name = _tool_name(tool)
+        if not name or name in seen:
+            return
+        instances.append(tool)
+        advertised_specs.append(advertised_spec or _openai_spec(tool))
+        seen.add(name)
+
+    use_mcp = config.get("mcp_tools", True) is not False
+    mcp_tool_list = list(mcp_tools) if use_mcp else []
+    mcp_by_name: dict[str, Any] = {}
+    for tool in mcp_tool_list:
+        name = _tool_name(tool)
+        if name and name not in mcp_by_name:
+            mcp_by_name[name] = tool
+
+    if agent_record.get("agent_type") == "deep_research":
+        granted_tools = build_deep_research_tools(
+            engine=engine,
+            model=model,
+            knowledge_db_path=knowledge_db_path,
+        )
+        owned_ids: set[int] = set()
+        for tool in granted_tools:
+            resource = getattr(tool, "_store", None)
+            if (
+                resource is not None
+                and callable(getattr(resource, "close", None))
+                and id(resource) not in owned_ids
+            ):
+                owned_resources.append(resource)
+                owned_ids.add(id(resource))
+            add_instance(tool)
+
+    for entry in _normalized_tool_config(config.get("tools")):
+        if isinstance(entry, Mapping):
+            raw_spec = entry if isinstance(entry, dict) else dict(entry)
+            name = _spec_name(raw_spec)
+            if name and name in seen:
+                continue
+
+            backing_tool = None
+            if name and not ChannelRegistry.contains(name):
+                if ToolRegistry.contains(name):
+                    try:
+                        backing_tool = instantiate_registered_tool(
+                            ToolRegistry.get(name),
+                            name,
+                            engine=engine,
+                            model=model,
+                            memory_backend=memory_backend,
+                            channel_backend=channel_backend,
+                        )
+                    except Exception as exc:
+                        logger.warning(
+                            "Could not instantiate tool '%s' (%s) — "
+                            "advertising its custom spec without execution",
+                            name,
+                            exc,
+                        )
+                elif name in mcp_by_name:
+                    backing_tool = mcp_by_name[name]
+
+            if backing_tool is not None:
+                add_instance(
+                    _SpecOverrideTool(backing_tool, raw_spec),
+                    advertised_spec=raw_spec,
+                )
+            else:
+                logger.warning(
+                    "Custom tool spec '%s' has no registered or MCP execution "
+                    "backend — dropping",
+                    name or "<unnamed>",
+                )
+            continue
+        if not isinstance(entry, str):
+            continue
+
+        names = BROWSER_SUB_TOOLS if entry == "browser" else (entry,)
+        for name in names:
+            if name in seen:
+                continue
+            if ChannelRegistry.contains(name):
+                continue
+            if not ToolRegistry.contains(name):
+                logger.warning(
+                    "Tool '%s' referenced in agent config but not in ToolRegistry",
+                    name,
+                )
+                continue
+            try:
+                add_instance(
+                    instantiate_registered_tool(
+                        ToolRegistry.get(name),
+                        name,
+                        engine=engine,
+                        model=model,
+                        memory_backend=memory_backend,
+                        channel_backend=channel_backend,
+                    )
+                )
+            except Exception as exc:
+                logger.warning(
+                    "Could not instantiate tool '%s' (%s) — dropping", name, exc
+                )
+
+    if use_mcp:
+        for tool in mcp_tool_list:
+            add_instance(tool)
+
+    return ResolvedAgentTools(
+        instances=instances,
+        extra_specs=extra_specs,
+        advertised_specs=advertised_specs,
+        mcp_clients=list(mcp_clients) if use_mcp else [],
+        owned_resources=owned_resources,
+    )
+
+
+def resolve_tool_specs(tool_config: Any) -> list[dict[str, Any]]:
+    """Compatibility view for callers that only need configured specs."""
+
+    specs: list[dict[str, Any]] = []
+    seen: set[str] = set()
+    for entry in _normalized_tool_config(tool_config):
+        if isinstance(entry, dict):
+            specs.append(entry)
+            name = _spec_name(entry)
+            if name:
+                seen.add(name)
+            continue
+        resolved = resolve_agent_tools(
+            {"config": {"tools": [entry]}},
+            engine=None,
+            model="",
+        )
+        for spec in resolved.openai_specs:
+            name = _spec_name(spec)
+            if name and name in seen:
+                continue
+            specs.append(spec)
+            if name:
+                seen.add(name)
+    return specs
+
+
+__all__ = [
+    "BROWSER_SUB_TOOLS",
+    "ResolvedAgentTools",
+    "build_deep_research_tools",
+    "ensure_registries_populated",
+    "instantiate_registered_tool",
+    "resolve_agent_tools",
+    "resolve_tool_specs",
+]

src/openjarvis/cli/ask.py

@@ -20,6 +20,7 @@ from openjarvis.core.events import EventBus, EventType
 from openjarvis.core.types import Message, Role
 from openjarvis.engine import (
     EngineConnectionError,
+    EngineContextLengthError,
     discover_engines,
     discover_models,
     get_engine,
@@ -881,6 +882,11 @@ def ask(
                 capability_policy=sec.capability_policy,
                 memory_files_config=effective_mf,
             )
+        except EngineContextLengthError as exc:
+            # Not a reachability problem — pointing the user at server/host
+            # config (hint_no_engine) would be misleading here.
+            console.print(f"[red]{exc}[/red]")
+            sys.exit(1)
         except EngineConnectionError as exc:
             console.print(f"[red]Engine error:[/red] {exc}")
             console.print(hint_no_engine())
@@ -990,6 +996,11 @@ def ask(
                 temperature=temperature,
                 max_tokens=max_tokens,
             )
+    except EngineContextLengthError as exc:
+        # Not a reachability problem — pointing the user at server/host
+        # config (hint_no_engine) would be misleading here.
+        console.print(f"[red]{exc}[/red]")
+        sys.exit(1)
     except EngineConnectionError as exc:
         console.print(f"[red]Engine error:[/red] {exc}")
         console.print(hint_no_engine())

src/openjarvis/cli/daemon_cmd.py

@@ -81,14 +81,28 @@ def start(
     if agent_name:
         cmd.extend(["--agent", agent_name])
 
-    # Start as background process
+    # Start as background process, fully detached from the launching terminal.
+    #
+    # ``start_new_session`` is POSIX-only: CPython's Windows ``_execute_child``
+    # names the parameter ``unused_start_new_session`` and ignores it. Relying
+    # on it there leaves the server sharing its parent's console, so closing
+    # that console — or logging off — delivers CTRL_CLOSE_EVENT and kills the
+    # daemon. DETACHED_PROCESS gives it no console at all; the new process
+    # group additionally stops a Ctrl-C in the parent reaching it.
     DEFAULT_CONFIG_DIR.mkdir(parents=True, exist_ok=True)
     log_fh = open(_LOG_FILE, "a")  # noqa: SIM115
+    spawn_kwargs: dict = {}
+    if sys.platform == "win32":
+        spawn_kwargs["creationflags"] = (
+            subprocess.DETACHED_PROCESS | subprocess.CREATE_NEW_PROCESS_GROUP
+        )
+    else:
+        spawn_kwargs["start_new_session"] = True
     proc = subprocess.Popen(
         cmd,
         stdout=log_fh,
         stderr=log_fh,
-        start_new_session=True,
+        **spawn_kwargs,
     )
     _write_pid(proc.pid)
 

src/openjarvis/cli/serve.py

@@ -10,6 +10,7 @@ from rich.console import Console
 
 from openjarvis.cli._banner import print_banner
 from openjarvis.core.config import load_config
+from openjarvis.core.credentials import inject_credentials
 from openjarvis.core.events import EventBus
 from openjarvis.core.paths import get_config_dir
 from openjarvis.engine import (
@@ -122,6 +123,11 @@ def serve(
         )
         sys.exit(1)
 
+    # Tool credentials saved through the browser UI live in the OpenJarvis
+    # credential store. Restore them before engines and tools are constructed
+    # so availability checks and tool instances see the same environment.
+    inject_credentials()
+
     config = load_config()
 
     # Resolve host/port from CLI args or config
@@ -273,6 +279,15 @@ def serve(
     # (which would re-discover the engine, re-resolve tools, re-open the channel,
     # etc.). See the scheduler block near the bottom of this function (#263).
     resolved_tools: list = []
+    managed_mcp_tools: list = []
+    mcp_clients: list = []
+    try:
+        from openjarvis.mcp.loader import load_mcp_tools_from_config
+
+        managed_mcp_tools, mcp_clients = load_mcp_tools_from_config(config.tools.mcp)
+    except Exception as exc:
+        logger.warning("Managed-agent MCP tools failed to load: %s", exc)
+
     if agent_key:
         try:
             import openjarvis.agents  # noqa: F401
@@ -284,11 +299,6 @@ def serve(
                 if sec.capability_policy is not None:
                     agent_kwargs["capability_policy"] = sec.capability_policy
 
-                # MCP transports persisted on the agent at the bottom of
-                # this block — initialise here so the reference is valid
-                # even when accepts_tools is False (#461).
-                mcp_clients: list = []
-
                 # Load tools for agents that support them
                 if getattr(agent_cls, "accepts_tools", False):
                     import openjarvis.tools  # noqa: F401  # trigger registration
@@ -325,12 +335,13 @@ def serve(
 
                     # MCP server tools from config.tools.mcp.servers
                     # (#461 — these were silently dropped).
-                    from openjarvis.mcp.loader import load_mcp_tools_from_config
-
-                    mcp_tools, mcp_clients = load_mcp_tools_from_config(
-                        config.tools.mcp,
-                        allowed_names=allowed if configured else None,
-                    )
+                    mcp_tools = managed_mcp_tools
+                    if configured:
+                        mcp_tools = [
+                            tool
+                            for tool in managed_mcp_tools
+                            if tool.spec.name in allowed
+                        ]
                     if mcp_tools:
                         existing = {t.spec.name for t in tools}
                         for t in mcp_tools:
@@ -383,10 +394,6 @@ def serve(
         channel_agent = config.channel.default_agent or agent_key or "simple"
 
         _channel_tools: list = []
-        # MCP transports persisted at function scope (= server-process
-        # lifetime); see the comment near the channel-MCP-load block
-        # below. Initialise here so it's always bound. #461.
-        _channel_mcp_clients: list = []
         if channel_agent:
             try:
                 import openjarvis.agents
@@ -426,29 +433,23 @@ def serve(
                             elif isinstance(_tcls, BaseTool):
                                 _channel_tools.append(_tcls)
 
-                        # MCP tools for the channel agent too (#461).
-                        from openjarvis.mcp.loader import (
-                            load_mcp_tools_from_config,
-                        )
-
-                        _ch_mcp_tools, _ch_mcp_clients = load_mcp_tools_from_config(
-                            config.tools.mcp,
-                            allowed_names=_allowed if configured else None,
-                        )
+                        # Reuse the process-owned MCP pool so channels do not
+                        # open a second transport to every configured server.
+                        _ch_mcp_tools = managed_mcp_tools
+                        if configured:
+                            _ch_mcp_tools = [
+                                tool
+                                for tool in managed_mcp_tools
+                                if tool.spec.name in _allowed
+                            ]
                         if _ch_mcp_tools:
                             _existing = {t.spec.name for t in _channel_tools}
                             for t in _ch_mcp_tools:
                                 if t.spec.name not in _existing:
                                     _channel_tools.append(t)
                                     _existing.add(t.spec.name)
-                        # Hold a reference at module / function scope —
-                        # the channel agent is constructed inside
-                        # JarvisSystem below; we extend its lifetime by
-                        # keeping the list bound here.
-                        _channel_mcp_clients = _ch_mcp_clients
             except Exception as exc:
                 logger.warning("Channel tools failed to load: %s", exc)
-                _channel_mcp_clients = []
 
         _wire_system = JarvisSystem(
             config=config,
@@ -458,6 +459,8 @@ def serve(
             model=model_name,
             agent_name=channel_agent,
             tools=_channel_tools,
+            mcp_tools=managed_mcp_tools,
+            _mcp_clients=mcp_clients,
         )
         _wire_system.wire_channel(channel_bridge)
 
@@ -475,23 +478,24 @@ def serve(
     # Create app
     from openjarvis.server.app import create_app
 
-    # Set up memory backend for context injection. Built before the scheduler
-    # block so the executor's JarvisSystem can reference it (#263).
+    # Set up the memory backend for storage tools, API routes, and optional
+    # prompt-context injection. ``context_from_memory`` controls only the last
+    # of those, so disabling it must not leave explicit memory_* tools with a
+    # null backend. Built before the scheduler so AgentExecutor can reuse it.
     memory_backend = None
-    if config.agent.context_from_memory:
-        try:
-            import openjarvis.tools.storage  # noqa: F401
-            from openjarvis.core.registry import MemoryRegistry
+    try:
+        import openjarvis.tools.storage  # noqa: F401
+        from openjarvis.core.registry import MemoryRegistry
 
-            mem_key = config.memory.default_backend
-            if MemoryRegistry.contains(mem_key):
-                memory_backend = MemoryRegistry.create(
-                    mem_key,
-                    db_path=config.memory.db_path,
-                )
-                console.print("  Memory:    [cyan]active[/cyan]")
-        except Exception as exc:
-            logger.debug("Memory backend init failed: %s", exc)
+        mem_key = config.memory.default_backend
+        if MemoryRegistry.contains(mem_key):
+            memory_backend = MemoryRegistry.create(
+                mem_key,
+                db_path=config.memory.db_path,
+            )
+            console.print("  Memory:    [cyan]active[/cyan]")
+    except Exception as exc:
+        logger.debug("Memory backend init failed: %s", exc)
 
     # Automatic long-term memory service (background fact extraction).
     memory_service = None
@@ -586,6 +590,7 @@ def serve(
                 agent=agent,
                 agent_name=agent_key or "",
                 tools=resolved_tools,
+                mcp_tools=managed_mcp_tools,
                 tool_executor=_sched_tool_executor,
                 memory_backend=memory_backend,
                 telemetry_store=telem_store,
@@ -594,6 +599,7 @@ def serve(
                 capability_policy=sec.capability_policy,
                 agent_manager=agent_manager,
                 agent_executor=executor,
+                _mcp_clients=mcp_clients,
             )
             executor.set_system(system)
 
@@ -685,10 +691,13 @@ def serve(
         channel_bridge=channel_bridge,
         config=config,
         memory_backend=memory_backend,
+        own_memory_backend=memory_backend is not None,
         memory_service=memory_service,
         speech_backend=speech_backend,
         agent_manager=agent_manager,
         agent_scheduler=agent_scheduler,
+        mcp_tools=managed_mcp_tools,
+        mcp_clients=mcp_clients,
         api_key=api_key,
         webhook_config=webhook_config,
         cors_origins=config.server.cors_origins,
@@ -717,6 +726,4 @@ def serve(
             "authenticated requests to your instance."
         )
 
-    import uvicorn
-
     uvicorn.run(app, host=bind_host, port=bind_port, log_level="info")

src/openjarvis/cli/skill_cmd.py

@@ -199,7 +199,16 @@ def _get_resolver(source: str, url: str = ""):
     default="",
     help="Repo URL (required when source is 'github').",
 )
-def install(query: str, with_scripts: bool, force: bool, url: str):
+@click.option(
+    "--yes-dangerous",
+    is_flag=True,
+    default=False,
+    help=(
+        "Confirm installing an unreviewed skill that requests dangerous "
+        "capabilities (shell/network-listen/filesystem-write)."
+    ),
+)
+def install(query: str, with_scripts: bool, force: bool, url: str, yes_dangerous: bool):
     """Install a skill from a source.
 
     Example: ``jarvis skill install hermes:apple-notes``
@@ -233,7 +242,12 @@ def install(query: str, with_scripts: bool, force: bool, url: str):
     from openjarvis.skills.tool_translator import ToolTranslator
 
     importer = SkillImporter(parser=SkillParser(), tool_translator=ToolTranslator())
-    result = importer.import_skill(matches[0], with_scripts=with_scripts, force=force)
+    result = importer.import_skill(
+        matches[0],
+        with_scripts=with_scripts,
+        force=force,
+        confirm_dangerous=yes_dangerous,
+    )
 
     if result.success:
         if result.skipped:
@@ -270,6 +284,15 @@ def install(query: str, with_scripts: bool, force: bool, url: str):
     help="Import scripts/ directories.",
 )
 @click.option("--force", is_flag=True, default=False, help="Re-import existing skills.")
+@click.option(
+    "--yes-dangerous",
+    is_flag=True,
+    default=False,
+    help=(
+        "Confirm installing unreviewed skills that request dangerous "
+        "capabilities (shell/network-listen/filesystem-write)."
+    ),
+)
 def sync(
     source: str,
     category: str,
@@ -277,6 +300,7 @@ def sync(
     search: str,
     with_scripts: bool,
     force: bool,
+    yes_dangerous: bool,
 ):
     """Bulk install + update from a source (or all configured sources)."""
     console = Console()
@@ -343,9 +367,20 @@ def sync(
 
         installed_count = 0
         for resolved in skills_to_import:
-            r = importer.import_skill(resolved, with_scripts=with_scripts, force=force)
+            r = importer.import_skill(
+                resolved,
+                with_scripts=with_scripts,
+                force=force,
+                confirm_dangerous=yes_dangerous,
+            )
             if r.success and not r.skipped:
                 installed_count += 1
+            elif not r.success and r.requires_confirmation:
+                console.print(
+                    f"  [yellow]Skipped {resolved.name}: requests dangerous "
+                    f"capabilities {r.dangerous_capabilities} "
+                    "(re-run with --yes-dangerous to install)[/yellow]"
+                )
         console.print(f"  Imported {installed_count}/{len(skills_to_import)} skills")
         total_installed += installed_count
 

src/openjarvis/core/config.py

@@ -12,9 +12,18 @@ import os
 import platform
 import shutil
 import subprocess
-from dataclasses import dataclass, field
+from dataclasses import dataclass, field, is_dataclass
 from pathlib import Path
-from typing import TYPE_CHECKING, Any, Dict, List, Optional
+from typing import (
+    TYPE_CHECKING,
+    Any,
+    Dict,
+    List,
+    Optional,
+    get_args,
+    get_origin,
+    get_type_hints,
+)
 
 from openjarvis.core.paths import (
     ConfigurationError,
@@ -1710,10 +1719,16 @@ def _apply_toml_section(target: Any, section: Dict[str, Any]) -> None:
     """Overlay TOML key/value pairs onto a dataclass instance.
 
     Recursively handles nested dicts when the target attribute is itself
-    a dataclass.  Normalises TOML arrays to comma-separated strings — both
-    for dataclass fields annotated as ``str`` and for backward-compat
-    property setters that expect string input.
+    a dataclass, including dict entries in lists of dataclasses.  Normalises
+    TOML arrays to comma-separated strings — both for dataclass fields annotated
+    as ``str`` and for backward-compat property setters that expect string input.
     """
+    try:
+        type_hints = get_type_hints(type(target))
+    except (NameError, TypeError):
+        # Some config types contain optional runtime-only forward references.
+        type_hints = {}
+
     for key, value in section.items():
         if hasattr(target, key):
             if isinstance(value, dict):
@@ -1728,14 +1743,35 @@ def _apply_toml_section(target: Any, section: Dict[str, Any]) -> None:
                 # property setters (e.g. reward_weights, default_tools).
                 if isinstance(value, list):
                     is_str_field = False
+                    item_dataclass = None
                     if hasattr(target, "__dataclass_fields__"):
                         field_obj = target.__dataclass_fields__.get(key)
-                        if field_obj is not None and field_obj.type in ("str", str):
-                            is_str_field = True
-                        elif field_obj is None:
+                        if field_obj is not None:
+                            field_type = type_hints.get(key, field_obj.type)
+                            type_args = get_args(field_type)
+                            if (
+                                get_origin(field_type) is list
+                                and len(type_args) == 1
+                                and is_dataclass(type_args[0])
+                            ):
+                                item_dataclass = type_args[0]
+                            elif field_obj.type in ("str", str):
+                                is_str_field = True
+                        else:
                             # Property, not a real field — normalise to string
                             is_str_field = True
-                    if is_str_field:
+
+                    if item_dataclass is not None:
+                        converted = []
+                        for item in value:
+                            if isinstance(item, dict):
+                                nested = item_dataclass()
+                                _apply_toml_section(nested, item)
+                                converted.append(nested)
+                            else:
+                                converted.append(item)
+                        value = converted
+                    elif is_str_field:
                         value = ",".join(str(v) for v in value)
                 setattr(target, key, value)
 

src/openjarvis/core/credentials.py

@@ -67,6 +67,24 @@ def load_credentials(path: Path | None = None) -> dict[str, dict[str, str]]:
         return tomllib.load(f)
 
 
+def _validate_credential_key(tool_name: str, key: str) -> None:
+    allowed = TOOL_CREDENTIALS.get(tool_name, [])
+    if key not in allowed:
+        raise ValueError(f"Unknown credential key '{key}' for tool '{tool_name}'")
+
+
+def _write_credentials(creds: dict[str, dict[str, str]], path: Path) -> None:
+    path.parent.mkdir(parents=True, exist_ok=True)
+    lines: list[str] = []
+    for section, kvs in creds.items():
+        lines.append(f"[{section}]")
+        for k, v in kvs.items():
+            lines.append(f'{k} = "{v}"')
+        lines.append("")
+    path.write_text("\n".join(lines))
+    os.chmod(path, 0o600)
+
+
 def save_credential(
     tool_name: str,
     key: str,
@@ -75,9 +93,7 @@ def save_credential(
     path: Path | None = None,
 ) -> None:
     """Save a single credential key, validate, write file, and set os.environ."""
-    allowed = TOOL_CREDENTIALS.get(tool_name, [])
-    if key not in allowed:
-        raise ValueError(f"Unknown credential key '{key}' for tool '{tool_name}'")
+    _validate_credential_key(tool_name, key)
     stripped = value.strip()
     if not stripped:
         raise ValueError("Credential value must not be empty")
@@ -88,20 +104,32 @@ def save_credential(
         if tool_name not in creds:
             creds[tool_name] = {}
         creds[tool_name][key] = stripped
-
-        p.parent.mkdir(parents=True, exist_ok=True)
-        lines: list[str] = []
-        for section, kvs in creds.items():
-            lines.append(f"[{section}]")
-            for k, v in kvs.items():
-                lines.append(f'{k} = "{v}"')
-            lines.append("")
-        p.write_text("\n".join(lines))
-        os.chmod(p, 0o600)
+        _write_credentials(creds, p)
 
     os.environ[key] = stripped
 
 
+def delete_credential(
+    tool_name: str,
+    key: str,
+    *,
+    path: Path | None = None,
+) -> None:
+    """Delete a persisted credential and remove it from the running process."""
+    _validate_credential_key(tool_name, key)
+    p = Path(path) if path else _default_path()
+    with _LOCK:
+        creds = load_credentials(path=p)
+        tool_creds = creds.get(tool_name)
+        if tool_creds is not None:
+            tool_creds.pop(key, None)
+            if not tool_creds:
+                creds.pop(tool_name, None)
+            _write_credentials(creds, p)
+
+    os.environ.pop(key, None)
+
+
 def get_credential_status(tool_name: str) -> dict[str, bool]:
     """Return {KEY: bool} for each required key indicating if set in env."""
     keys = TOOL_CREDENTIALS.get(tool_name, [])

src/openjarvis/engine/__init__.py

@@ -9,7 +9,9 @@ import openjarvis.engine.ollama  # noqa: F401
 import openjarvis.engine.openai_compat_engines  # noqa: F401
 from openjarvis.engine._base import (
     EngineConnectionError,
+    EngineContextLengthError,
     InferenceEngine,
+    looks_like_context_length_error,
     messages_to_dicts,
 )
 from openjarvis.engine._discovery import discover_engines, discover_models, get_engine
@@ -23,9 +25,11 @@ for _optional in ("cloud", "litellm", "gemma_cpp"):
 
 __all__ = [
     "EngineConnectionError",
+    "EngineContextLengthError",
     "InferenceEngine",
     "discover_engines",
     "discover_models",
     "get_engine",
+    "looks_like_context_length_error",
     "messages_to_dicts",
 ]

src/openjarvis/engine/_base.py

@@ -13,6 +13,46 @@ class EngineConnectionError(Exception):
     """Raised when an engine is unreachable."""
 
 
+class EngineContextLengthError(EngineConnectionError):
+    """The prompt exceeds the served model's maximum context window.
+
+    Subclasses ``EngineConnectionError`` so existing ``except
+    EngineConnectionError`` handlers keep catching it, while callers that want a
+    distinct, user-facing "conversation too long" message can branch on this type
+    (or the ``is_context_length_error`` marker) instead of surfacing a generic
+    engine failure.
+    """
+
+    is_context_length_error: bool = True
+
+
+# Substrings that identify an error body as a context-window overflow (vLLM,
+# SGLang, and OpenAI-compatible servers phrase this a few different ways).
+# Every marker is anchored on "context" on purpose: generic phrases like
+# "please reduce" or "too many tokens" also appear in unrelated 400 bodies
+# (max_tokens validation, rate limiting, oversized images) and would
+# misclassify those as "conversation too long".
+CONTEXT_LENGTH_MARKERS = (
+    "context length",
+    "maximum context",
+    "context window",
+    "maximum_context",
+    "context_length_exceeded",
+)
+
+
+def looks_like_context_length_error(text: str) -> bool:
+    """True when *text* reads like a context-window overflow error.
+
+    The single shared heuristic for recognizing vendor context-overflow
+    phrasings — used by the engine layer (typing upstream 400s), agent error
+    classification, and the server stream bridge, so a new vendor phrasing
+    only ever needs to be added here.
+    """
+    low = (text or "").lower()
+    return any(marker in low for marker in CONTEXT_LENGTH_MARKERS)
+
+
 _REASONING_METADATA_KEYS = ("reasoning_content", "thinking")
 
 
@@ -80,8 +120,11 @@ def estimate_prompt_tokens(messages: Sequence[Message]) -> int:
 
 
 __all__ = [
+    "CONTEXT_LENGTH_MARKERS",
     "EngineConnectionError",
+    "EngineContextLengthError",
     "InferenceEngine",
     "estimate_prompt_tokens",
+    "looks_like_context_length_error",
     "messages_to_dicts",
 ]

src/openjarvis/engine/_discovery.py

@@ -35,6 +35,12 @@ def _make_engine(key: str, config: JarvisConfig) -> InferenceEngine:
     """Instantiate a registered engine with the appropriate config host."""
     cls = EngineRegistry.get(key)
 
+    # LiteLLM cannot enumerate every model supported by every provider.  Its
+    # list_models() contract therefore advertises the configured default
+    # model, which must be supplied when discovery constructs the engine.
+    if key == "litellm":
+        return cls(default_model=config.intelligence.default_model or None)
+
     # gemma_cpp: pass config fields instead of host
     if key == "gemma_cpp":
         cfg = config.engine.gemma_cpp

src/openjarvis/engine/_http_async.py

@@ -0,0 +1,128 @@
+"""Shared async-HTTP plumbing for engines that stream over httpx.
+
+Home of the pieces the OpenAI-compat and Ollama engines were each hand-rolling:
+the async-client factory (with the configured timeout applied), a cached
+long-lived client so consecutive streams reuse pooled connections instead of
+paying a fresh TCP/TLS handshake per turn, the transport-error set that maps to
+``EngineConnectionError``, and the non-2xx → engine-error translation.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import logging
+from typing import NoReturn
+
+import httpx
+
+from openjarvis.engine._base import (
+    EngineConnectionError,
+    EngineContextLengthError,
+    looks_like_context_length_error,
+)
+
+logger = logging.getLogger(__name__)
+
+# Transport failures that map to EngineConnectionError on the streaming paths.
+# ``RemoteProtocolError``/``ReadError`` cover a server dying MID-STREAM (peer
+# closed between tokens); a wedged read trips the configured timeout
+# (TimeoutException). Kept exactly this narrow on purpose:
+# ``asyncio.CancelledError``/``GeneratorExit`` are NOT ``httpx.TransportError``
+# subclasses and must keep propagating for correct cancellation.
+STREAM_TRANSPORT_ERRORS = (
+    httpx.ConnectError,
+    httpx.TimeoutException,
+    httpx.RemoteProtocolError,
+    httpx.ReadError,
+)
+
+_CONTEXT_LENGTH_USER_MESSAGE = (
+    "The conversation is too long for the model's context window. "
+    "Start a new chat or shorten the conversation, then try again."
+)
+
+
+class AsyncHTTPEngineMixin:
+    """Async streaming plumbing shared by httpx-backed engines.
+
+    Expects the engine to provide ``engine_id``, ``_host``, ``_timeout``, an
+    ``_async_transport`` test seam (``httpx.MockTransport`` in tests, ``None``
+    in production), and optionally ``_headers``.
+    """
+
+    engine_id: str
+    _host: str
+    _timeout: float
+    _async_transport: httpx.AsyncBaseTransport | None
+
+    # Set True by engines whose upstream reports context-window overflows in
+    # 400 bodies (OpenAI-compat servers). Ollama has no such signal.
+    _stream_400_signals_context_length: bool = False
+
+    # Lazily-created shared client (and the loop it belongs to). Class-level
+    # ``None`` defaults keep engine ``__init__``s free of mixin bookkeeping.
+    _async_client: httpx.AsyncClient | None = None
+    _async_client_loop: asyncio.AbstractEventLoop | None = None
+
+    def _make_async_client(self) -> httpx.AsyncClient:
+        """Build an async client that honours the configured timeout."""
+        return httpx.AsyncClient(
+            base_url=self._host,
+            timeout=self._timeout,
+            headers=getattr(self, "_headers", None),
+            transport=self._async_transport,
+        )
+
+    def _get_async_client(self) -> httpx.AsyncClient:
+        """Return the shared async client for the running event loop.
+
+        Reusing one client across calls preserves connection pooling — without
+        it every conversation turn pays a fresh TCP (and TLS) handshake. The
+        client is cached per event loop: pooled connections die with their
+        loop, so CLI flows that run ``asyncio.run()`` per turn transparently
+        get a fresh client while a long-lived server loop keeps one pool.
+        """
+        loop = asyncio.get_running_loop()
+        client = self._async_client
+        if client is None or client.is_closed or self._async_client_loop is not loop:
+            # Any previous client belonged to a finished loop; its pooled
+            # connections are already dead, so just drop the reference.
+            client = self._make_async_client()
+            self._async_client = client
+            self._async_client_loop = loop
+        return client
+
+    def _close_async_client(self) -> None:
+        """Best-effort close of the shared async client (for ``close()``)."""
+        client = self._async_client
+        loop = self._async_client_loop
+        self._async_client = None
+        self._async_client_loop = None
+        if client is None or client.is_closed:
+            return
+        try:
+            if loop is not None and not loop.is_closed():
+                if loop.is_running():
+                    loop.create_task(client.aclose())
+                else:
+                    loop.run_until_complete(client.aclose())
+        except Exception:  # noqa: BLE001 — cleanup must never mask the close
+            logger.debug("Async client did not close cleanly", exc_info=True)
+
+    def _raise_stream_http_error(self, status: int, detail: str) -> NoReturn:
+        """Map a non-success streaming HTTP response to a clean engine error."""
+        detail = (detail or "").strip()
+        if (
+            status == 400
+            and self._stream_400_signals_context_length
+            and looks_like_context_length_error(detail)
+        ):
+            raise EngineContextLengthError(_CONTEXT_LENGTH_USER_MESSAGE)
+        detail_suffix = f": {detail}" if detail else ""
+        raise EngineConnectionError(
+            f"{self.engine_id} engine at {self._host} returned HTTP "
+            f"{status}{detail_suffix}"
+        )
+
+
+__all__ = ["AsyncHTTPEngineMixin", "STREAM_TRANSPORT_ERRORS"]

src/openjarvis/engine/_openai_compat.py

@@ -12,18 +12,27 @@ import httpx
 from openjarvis.core.types import Message
 from openjarvis.engine._base import (
     EngineConnectionError,
+    EngineContextLengthError,
     InferenceEngine,
     estimate_prompt_tokens,
     messages_to_dicts,
 )
+from openjarvis.engine._http_async import (
+    STREAM_TRANSPORT_ERRORS,
+    AsyncHTTPEngineMixin,
+)
 from openjarvis.engine._stubs import StreamChunk
 
 logger = logging.getLogger(__name__)
 
 
-class _OpenAICompatibleEngine(InferenceEngine):
+class _OpenAICompatibleEngine(AsyncHTTPEngineMixin, InferenceEngine):
     """Base for engines that serve the OpenAI ``/v1/chat/completions`` API."""
 
+    # vLLM/SGLang report context-window overflows in 400 bodies; the shared
+    # ``_raise_stream_http_error`` types those as ``EngineContextLengthError``.
+    _stream_400_signals_context_length = True
+
     engine_id: str = ""
     _default_host: str = "http://localhost:8000"
     _api_prefix: str = "/v1"
@@ -50,6 +59,16 @@ class _OpenAICompatibleEngine(InferenceEngine):
         headers = (
             {"Authorization": f"Bearer {self._api_key}"} if self._api_key else None
         )
+        # Used by the shared async streaming plumbing (AsyncHTTPEngineMixin) so
+        # the bounded request timeout is applied to streaming reads, not just
+        # the synchronous methods (a wedged token read fails at ``timeout``
+        # rather than hanging the caller for the httpx default).
+        self._timeout = timeout
+        self._headers = headers
+        # Injection seam for tests: an ``httpx.MockTransport`` swapped in here lets
+        # the async stream path be exercised with a mocked transport and no real
+        # server. ``None`` in production so httpx uses its default networking.
+        self._async_transport: httpx.AsyncBaseTransport | None = None
         self._client = httpx.Client(
             base_url=self._host, timeout=timeout, headers=headers
         )
@@ -168,11 +187,26 @@ class _OpenAICompatibleEngine(InferenceEngine):
         # Default to tool_choice=auto when tools are provided
         if "tools" in payload and "tool_choice" not in payload:
             payload["tool_choice"] = "auto"
+        url = f"{self._api_prefix}/chat/completions"
         try:
-            url = f"{self._api_prefix}/chat/completions"
-            with self._client.stream("POST", url, json=payload) as resp:
-                resp.raise_for_status()
-                for line in resp.iter_lines():
+            # ASYNC streaming: ``httpx.AsyncClient`` + ``aiter_lines`` never
+            # blocks the event loop between tokens (the previous SYNC
+            # ``httpx.Client`` + ``iter_lines`` inside this ``async def`` blocked
+            # the single uvicorn worker on every inter-token wait, serializing all
+            # concurrent chats and letting one wedged read freeze the whole API).
+            # The shared client keeps pooled connections across turns.
+            client = self._get_async_client()
+            async with client.stream("POST", url, json=payload) as resp:
+                # ``not is_success`` covers 3xx as well as 4xx/5xx. With
+                # ``follow_redirects`` off (the default) an unexpected redirect
+                # would otherwise fall through to ``aiter_lines`` and surface as
+                # a silent EMPTY stream instead of a clean engine error.
+                if not resp.is_success:
+                    # Load the (short) error body before touching ``.text``:
+                    # a streaming response is otherwise unread.
+                    await resp.aread()
+                    self._raise_stream_http_error(resp.status_code, resp.text)
+                async for line in resp.aiter_lines():
                     if not line.startswith("data:"):
                         continue
                     data_str = line[len("data:") :].strip()
@@ -186,7 +220,11 @@ class _OpenAICompatibleEngine(InferenceEngine):
                     content = delta.get("content")
                     if content:
                         yield content
-        except (httpx.ConnectError, httpx.TimeoutException) as exc:
+        except STREAM_TRANSPORT_ERRORS as exc:
+            # A wedged upstream read trips ``timeout`` (ReadTimeout) and is mapped
+            # here, so the request fails cleanly at the configured bound instead
+            # of hanging indefinitely (see STREAM_TRANSPORT_ERRORS for why the
+            # set is exactly this narrow).
             raise EngineConnectionError(
                 f"{self.engine_id} engine not reachable at {self._host}"
             ) from exc
@@ -212,11 +250,20 @@ class _OpenAICompatibleEngine(InferenceEngine):
         }
         if "tools" in payload and "tool_choice" not in payload:
             payload["tool_choice"] = "auto"
+        url = f"{self._api_prefix}/chat/completions"
         try:
-            url = f"{self._api_prefix}/chat/completions"
-            with self._client.stream("POST", url, json=payload) as resp:
-                resp.raise_for_status()
-                for line in resp.iter_lines():
+            # ASYNC streaming (see ``stream``): non-blocking shared client so
+            # rich streaming never stalls the event loop and honours ``timeout``.
+            client = self._get_async_client()
+            async with client.stream("POST", url, json=payload) as resp:
+                # ``not is_success`` covers 3xx as well as 4xx/5xx. With
+                # ``follow_redirects`` off (the default) an unexpected redirect
+                # would otherwise fall through to ``aiter_lines`` and surface as
+                # a silent EMPTY stream instead of a clean engine error.
+                if not resp.is_success:
+                    await resp.aread()
+                    self._raise_stream_http_error(resp.status_code, resp.text)
+                async for line in resp.aiter_lines():
                     if not line.startswith("data:"):
                         continue
                     data_str = line[len("data:") :].strip()
@@ -240,7 +287,10 @@ class _OpenAICompatibleEngine(InferenceEngine):
                             finish_reason=finish,
                             usage=usage,
                         )
-        except (httpx.ConnectError, httpx.TimeoutException) as exc:
+        except STREAM_TRANSPORT_ERRORS as exc:
+            # See ``stream``: transport failures (incl. a mid-stream server
+            # disconnect) map to a clean error; the set is kept narrow so
+            # cancellation still propagates.
             raise EngineConnectionError(
                 f"{self.engine_id} engine not reachable at {self._host}"
             ) from exc
@@ -279,6 +329,9 @@ class _OpenAICompatibleEngine(InferenceEngine):
 
     def close(self) -> None:
         self._client.close()
+        self._close_async_client()
 
 
-__all__ = ["_OpenAICompatibleEngine"]
+# ``EngineContextLengthError`` moved to ``openjarvis.engine._base``; re-exported
+# here for callers/tests that import it from this module.
+__all__ = ["_OpenAICompatibleEngine", "EngineContextLengthError"]

src/openjarvis/engine/litellm.py

@@ -123,8 +123,12 @@ class LiteLLMEngine(InferenceEngine):
             call_kwargs["api_base"] = self._api_base
         call_kwargs.update(kwargs)
 
-        resp = litellm.completion(**call_kwargs)
-        for chunk in resp:
+        # ``acompletion`` + ``async for``: the sync ``litellm.completion`` used
+        # before made a blocking network call (and blocking per-chunk reads)
+        # inside this ``async def``, stalling the whole event loop between
+        # tokens — the same bug the httpx engines' streaming paths had.
+        resp = await litellm.acompletion(**call_kwargs)
+        async for chunk in resp:
             delta = chunk.choices[0].delta if chunk.choices else None
             if delta and delta.content:
                 yield delta.content

src/openjarvis/engine/multi.py

@@ -26,16 +26,19 @@ class MultiEngine(InferenceEngine):
     def __init__(self, engines: list[tuple[str, InferenceEngine]]) -> None:
         self._engines = engines
         self._model_map: Dict[str, InferenceEngine] = {}
+        self._model_key_map: Dict[str, str] = {}
         self._refresh_map()
 
     def _refresh_map(self) -> None:
         self._model_map.clear()
-        for _key, engine in self._engines:
+        self._model_key_map.clear()
+        for key, engine in self._engines:
             try:
                 for model_id in engine.list_models():
                     self._model_map[model_id] = engine
+                    self._model_key_map[model_id] = key
             except Exception as exc:
-                logger.debug("Failed to list models for %s: %s", _key, exc)
+                logger.debug("Failed to list models for %s: %s", key, exc)
 
     _CLOUD_PREFIXES = ("gpt-", "o1-", "o3-", "o4-", "claude-", "gemini-", "openrouter/")
 
@@ -117,6 +120,14 @@ class MultiEngine(InferenceEngine):
         self._refresh_map()
         return list(self._model_map.keys())
 
+    def engine_key_for(self, model: str) -> str | None:
+        """Return the registry key of the engine advertising *model*."""
+        key = self._model_key_map.get(model)
+        if key is not None:
+            return key
+        self._refresh_map()
+        return self._model_key_map.get(model)
+
     def health(self) -> bool:
         return any(engine.health() for _key, engine in self._engines)
 

src/openjarvis/engine/ollama.py

@@ -18,6 +18,10 @@ from openjarvis.engine._base import (
     estimate_prompt_tokens,
     messages_to_dicts,
 )
+from openjarvis.engine._http_async import (
+    STREAM_TRANSPORT_ERRORS,
+    AsyncHTTPEngineMixin,
+)
 from openjarvis.engine._stubs import StreamChunk
 
 logger = logging.getLogger(__name__)
@@ -80,11 +84,15 @@ def _default_num_ctx() -> int:
 
 
 @EngineRegistry.register("ollama")
-class OllamaEngine(InferenceEngine):
+class OllamaEngine(AsyncHTTPEngineMixin, InferenceEngine):
     """Ollama backend via its native HTTP API."""
 
     engine_id = "ollama"
 
+    # Ollama has no context-length overflow signal in its 400 bodies, so the
+    # shared ``_raise_stream_http_error`` keeps its default (no
+    # ``EngineContextLengthError`` branch, unlike the OpenAI-compat engines).
+
     _DEFAULT_HOST = "http://localhost:11434"
 
     def __init__(
@@ -98,6 +106,14 @@ class OllamaEngine(InferenceEngine):
             env_host = os.environ.get("OLLAMA_HOST")
             host = env_host or self._DEFAULT_HOST
         self._host = host.rstrip("/")
+        # Used by the shared async streaming plumbing (AsyncHTTPEngineMixin) so a
+        # wedged token read is bounded by ``timeout`` instead of hanging the
+        # single event loop for the httpx default.
+        self._timeout = timeout
+        # Injection seam for tests: an ``httpx.MockTransport`` swapped in here drives
+        # the async stream path with no real Ollama server. ``None`` in production so
+        # httpx uses its default networking.
+        self._async_transport: httpx.AsyncBaseTransport | None = None
         self._client = httpx.Client(base_url=self._host, timeout=timeout)
         # Last stream usage — captured from Ollama's final chunk
         self._last_stream_usage: Dict[str, int] = {}
@@ -263,9 +279,26 @@ class OllamaEngine(InferenceEngine):
         elif kwargs["think"] is not None:
             payload["think"] = kwargs["think"]
         try:
-            with self._client.stream("POST", "/api/chat", json=payload) as resp:
-                resp.raise_for_status()
-                for line in resp.iter_lines():
+            # ASYNC streaming: ``httpx.AsyncClient`` + ``aiter_lines`` never
+            # blocks the event loop between tokens (the previous SYNC
+            # ``self._client`` + ``iter_lines`` inside this ``async def`` blocked
+            # the single uvicorn worker on every inter-token wait, serializing all
+            # concurrent chats and letting one wedged read freeze the whole API).
+            # The shared client keeps pooled connections across turns.
+            client = self._get_async_client()
+            async with client.stream("POST", "/api/chat", json=payload) as resp:
+                # ``not is_success`` covers 3xx as well as 4xx/5xx and maps
+                # to ``EngineConnectionError`` (matching the OpenAI-compat
+                # path) instead of leaking a raw ``httpx.HTTPStatusError``.
+                # With redirects off (the default) an unexpected 3xx would
+                # otherwise fall through to ``aiter_lines`` and surface as a
+                # silent EMPTY stream rather than a clean engine error.
+                if not resp.is_success:
+                    # Read the (short) error body before touching ``.text``:
+                    # a streaming response is otherwise unread.
+                    await resp.aread()
+                    self._raise_stream_http_error(resp.status_code, resp.text)
+                async for line in resp.aiter_lines():
                     if not line.strip():
                         continue
                     try:
@@ -290,7 +323,10 @@ class OllamaEngine(InferenceEngine):
                             "total_tokens": full_prompt + comp,
                         }
                         break
-        except (httpx.ConnectError, httpx.TimeoutException) as exc:
+        except STREAM_TRANSPORT_ERRORS as exc:
+            # Transport failures (incl. a mid-stream server disconnect) map to a
+            # clean error; the set is kept narrow (see STREAM_TRANSPORT_ERRORS)
+            # so cancellation still propagates.
             raise EngineConnectionError(
                 f"Ollama not reachable at {self._host}"
             ) from exc
@@ -356,19 +392,34 @@ class OllamaEngine(InferenceEngine):
     ) -> AsyncIterator[StreamChunk]:
         """Execute the streaming request and yield parsed StreamChunks."""
         try:
-            with self._client.stream("POST", "/api/chat", json=payload) as resp:
+            # ASYNC streaming (see ``stream``): shared ``AsyncClient`` +
+            # ``aiter_lines`` so rich streaming never stalls the event loop and
+            # honours ``timeout``.
+            client = self._get_async_client()
+            async with client.stream("POST", "/api/chat", json=payload) as resp:
                 if resp.status_code == 400 and retry_without_tools:
                     # Model doesn't support tools — retry without them.
+                    # PRESERVED: this specific 400 path must still trigger the
+                    # tools-less retry; only OTHER non-2xx responses map to
+                    # EngineConnectionError below.
                     payload.pop("tools", None)
                     async for c in self._run_stream(
                         payload, messages, retry_without_tools=False
                     ):
                         yield c
                     return
-                resp.raise_for_status()
+                # ``not is_success`` covers 3xx as well as 4xx/5xx and maps
+                # to ``EngineConnectionError`` (matching the OpenAI-compat
+                # path) instead of leaking a raw ``httpx.HTTPStatusError``.
+                # With redirects off (the default) an unexpected 3xx would
+                # otherwise fall through to ``aiter_lines`` and surface as a
+                # silent EMPTY stream rather than a clean engine error.
+                if not resp.is_success:
+                    await resp.aread()
+                    self._raise_stream_http_error(resp.status_code, resp.text)
 
                 finish_reason: str | None = None
-                for line in resp.iter_lines():
+                async for line in resp.aiter_lines():
                     if not line.strip():
                         continue
                     try:
@@ -441,7 +492,10 @@ class OllamaEngine(InferenceEngine):
                             usage=dict(self._last_stream_usage),
                         )
                         break
-        except (httpx.ConnectError, httpx.TimeoutException) as exc:
+        except STREAM_TRANSPORT_ERRORS as exc:
+            # See ``stream``: transport failures (incl. a mid-stream server
+            # disconnect) map to a clean error; the set is kept narrow so
+            # cancellation still propagates.
             raise EngineConnectionError(
                 f"Ollama not reachable at {self._host}"
             ) from exc
@@ -474,6 +528,7 @@ class OllamaEngine(InferenceEngine):
 
     def close(self) -> None:
         self._client.close()
+        self._close_async_client()
 
 
 __all__ = ["OllamaEngine"]

src/openjarvis/mcp/client.py

@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 import itertools
+import threading
 from typing import Any, Dict, List
 
 from openjarvis.mcp.protocol import MCPError, MCPRequest, MCPResponse
@@ -24,18 +25,31 @@ class MCPClient:
         self._initialized = False
         self._capabilities: Dict[str, Any] = {}
         self._id_counter = itertools.count(1)
+        # A client may be shared by server, scheduled, and channel agents.
+        # Keep each transport request/response exchange atomic so stdio
+        # readers cannot consume another thread's JSON-RPC response.
+        self._request_lock = threading.RLock()
+        # Closing must not wait for ``_request_lock``: transport.close() is
+        # what interrupts a request that is blocked in a transport read.
+        # An event lets queued requests fail before touching that transport,
+        # while this separate lock keeps close itself idempotent.
+        self._closed = threading.Event()
+        self._transport_closed = threading.Event()
+        self._close_lock = threading.Lock()
 
     def _next_id(self) -> int:
         return next(self._id_counter)
 
     def _send(self, method: str, params: Dict[str, Any] | None = None) -> MCPResponse:
         """Send a request and check for errors."""
-        request = MCPRequest(
-            method=method,
-            params=params or {},
-            id=self._next_id(),
-        )
-        response = self._transport.send(request)
+        with self._request_lock:
+            self._raise_if_closed()
+            request = MCPRequest(
+                method=method,
+                params=params or {},
+                id=self._next_id(),
+            )
+            response = self._transport.send(request)
         if response.error is not None:
             raise MCPError(
                 code=response.error.get("code", -1),
@@ -44,6 +58,10 @@ class MCPClient:
             )
         return response
 
+    def _raise_if_closed(self) -> None:
+        if self._closed.is_set():
+            raise RuntimeError("MCP client is closed")
+
     def initialize(self) -> Dict[str, Any]:
         """Perform the MCP initialize handshake.
 
@@ -75,7 +93,9 @@ class MCPClient:
             params=params or {},
             id=None,  # None → no id field in JSON (notification)
         )
-        self._transport.send_notification(request)
+        with self._request_lock:
+            self._raise_if_closed()
+            self._transport.send_notification(request)
 
     def list_tools(self) -> List[ToolSpec]:
         """Discover available tools from the server.
@@ -114,7 +134,15 @@ class MCPClient:
 
     def close(self) -> None:
         """Close the transport connection."""
-        self._transport.close()
+        # Do not acquire _request_lock here. A transport request can be stuck
+        # waiting for a server response, and closing the underlying transport
+        # is the mechanism that unblocks it.
+        with self._close_lock:
+            if self._transport_closed.is_set():
+                return
+            self._closed.set()
+            self._transport.close()
+            self._transport_closed.set()
 
     def __enter__(self) -> MCPClient:
         return self

src/openjarvis/recipes/data/operators/openjarvis_twitter_bot_prompt.md

@@ -15,7 +15,7 @@ HARD RULE: Every reply MUST be ≤280 characters. Count before sending.
 - GitHub: https://github.com/open-jarvis/OpenJarvis
 - Docs: https://open-jarvis.github.io/OpenJarvis/
 - Discord: https://discord.gg/wfXEkpPX
-- Blog: https://scalingintelligence.stanford.edu/blogs/openjarvis/
+- Blog: https://openjarvis.stanford.edu/
 - Install: `git clone https://github.com/open-jarvis/OpenJarvis.git && cd OpenJarvis && uv sync`
 - CLI commands (ONLY these exist):
   - `jarvis init` — auto-detects hardware, configures engine

src/openjarvis/server/api_routes.py

@@ -741,8 +741,11 @@ async def websocket_chat_stream(websocket: WebSocket):
                                 )
                     except TypeError:
                         # stream() didn't return an iterable; fall back to
-                        # generate()
-                        result = engine.generate(messages, model=model)
+                        # generate(). It makes a blocking upstream call, so run
+                        # it in a worker thread to keep the event loop free.
+                        result = await asyncio.to_thread(
+                            engine.generate, messages, model=model
+                        )
                         content = (
                             result.get("content", "")
                             if isinstance(
@@ -767,8 +770,11 @@ async def websocket_chat_stream(websocket: WebSocket):
                         ended_at=_time.time(),
                     )
                 else:
-                    # No stream method — single-shot generate
-                    result = engine.generate(messages, model=model)
+                    # No stream method — single-shot generate. Blocking upstream
+                    # call, so run in a worker thread to keep the event loop free.
+                    result = await asyncio.to_thread(
+                        engine.generate, messages, model=model
+                    )
                     content = (
                         result.get("content", "")
                         if isinstance(

src/openjarvis/server/app.py

@@ -4,6 +4,7 @@ from __future__ import annotations
 
 import logging
 import pathlib
+import threading
 import time
 
 from fastapi import FastAPI
@@ -21,6 +22,8 @@ from openjarvis.server.routes import router
 from openjarvis.server.upload_router import router as upload_router
 
 logger = logging.getLogger(__name__)
+_MANAGED_SHUTDOWN_GRACE_SECONDS = 0.25
+_MANAGED_SHUTDOWN_DRAIN_SECONDS = 10.0
 
 
 def _restore_sendblue_bindings(app: FastAPI) -> None:
@@ -151,10 +154,13 @@ def create_app(
     channel_bridge=None,
     config=None,
     memory_backend=None,
+    own_memory_backend: bool = False,
     memory_service=None,
     speech_backend=None,
     agent_manager=None,
     agent_scheduler=None,
+    mcp_tools=None,
+    mcp_clients=None,
     api_key: str = "",
     webhook_config: dict | None = None,
     cors_origins: list[str] | None = None,
@@ -221,16 +227,129 @@ def create_app(
     )
     app.state.channel_bridge = channel_bridge
     app.state.config = config
+    app.state._memory_backend_lock = threading.Lock()
     app.state.memory_backend = memory_backend
+    app.state._owns_memory_backend = bool(own_memory_backend)
     app.state.memory_service = memory_service
     app.state.speech_backend = speech_backend
     app.state.agent_manager = agent_manager
     app.state.agent_scheduler = agent_scheduler
+    app.state.mcp_tools = list(mcp_tools or [])
+    app.state._mcp_discovery_lock = threading.Lock()
+    app.state._mcp_clients_lock = threading.Lock()
+    app.state._mcp_clients = list(mcp_clients or [])
+    app.state._managed_worker_lock = threading.Lock()
+    app.state._managed_workers: set[threading.Thread] = set()
+    app.state._managed_runtime_stopping = False
     app.state.session_start = time.time()
     # Exposed so WebSocket handlers can authenticate the handshake (the HTTP
     # AuthMiddleware never sees WS upgrade requests). Empty = auth disabled.
     app.state.api_key = api_key
 
+    @app.on_event("shutdown")
+    async def _shutdown_managed_runtime() -> None:
+        # Quiesce every producer before touching the shared MCP pool. Route
+        # workers are registered under this lock, so none can slip in after
+        # the snapshot. The scheduler has a two-phase stop because closing an
+        # MCP transport may be what releases an in-flight tick.
+        with app.state._managed_worker_lock:
+            app.state._managed_runtime_stopping = True
+            managed_workers = list(app.state._managed_workers)
+
+        # Stop external listener threads before draining ticks or closing the
+        # shared MCP pool. Channel callbacks are wired to that same pool by
+        # ``serve`` and otherwise could race teardown or survive app restart.
+        channel_bridge = getattr(app.state, "channel_bridge", None)
+        disconnect_channels = getattr(channel_bridge, "disconnect", None)
+        if callable(disconnect_channels):
+            try:
+                disconnect_channels()
+            except Exception:
+                logger.debug("Channel bridge shutdown failed", exc_info=True)
+
+        def _join_workers(timeout: float) -> None:
+            deadline = time.monotonic() + timeout
+            for thread in managed_workers:
+                remaining = deadline - time.monotonic()
+                if remaining <= 0:
+                    break
+                thread.join(timeout=remaining)
+
+        scheduler = getattr(app.state, "agent_scheduler", None)
+        scheduler_wait = None
+        scheduler_drained = True
+        if scheduler is not None:
+            try:
+                request_stop = getattr(scheduler, "request_stop", None)
+                wait_stopped = getattr(scheduler, "wait_stopped", None)
+                if callable(request_stop) and callable(wait_stopped):
+                    request_stop()
+                    scheduler_wait = wait_stopped
+                    scheduler_drained = bool(
+                        wait_stopped(timeout=_MANAGED_SHUTDOWN_GRACE_SECONDS)
+                    )
+                else:
+                    scheduler.stop()
+                    scheduler_drained = not bool(
+                        getattr(scheduler, "is_running", False)
+                    )
+            except Exception:
+                scheduler_drained = False
+                logger.debug("Agent scheduler shutdown failed", exc_info=True)
+
+        # Give normal work a brief chance to finish before cancellation.
+        _join_workers(timeout=_MANAGED_SHUTDOWN_GRACE_SECONDS)
+        with app.state._mcp_clients_lock:
+            mcp_clients_to_close = list(app.state._mcp_clients)
+        for client in mcp_clients_to_close:
+            try:
+                client.close()
+            except Exception:
+                logger.debug("MCP client shutdown failed", exc_info=True)
+
+        # Transport closure interrupts blocked MCP reads. Drain the workers a
+        # second time so shutdown does not return while they still own runtime
+        # state. Any stragglers can no longer issue transport requests because
+        # MCPClient marks itself closed before closing its transport.
+        if scheduler_wait is not None:
+            try:
+                scheduler_drained = bool(
+                    scheduler_wait(timeout=_MANAGED_SHUTDOWN_DRAIN_SECONDS)
+                )
+            except Exception:
+                scheduler_drained = False
+                logger.debug("Agent scheduler drain failed", exc_info=True)
+        _join_workers(timeout=_MANAGED_SHUTDOWN_DRAIN_SECONDS)
+        alive = [thread.name for thread in managed_workers if thread.is_alive()]
+        if alive:
+            logger.warning("Managed workers did not stop during shutdown: %s", alive)
+
+        # A backend created by ``serve`` or lazily by a managed route belongs
+        # to this app process. Close it only after every tracked consumer has
+        # been drained; injected/borrowed backends remain the caller's concern.
+        owned_memory_backend = None
+        runtime_drained = scheduler_drained and not alive
+        if runtime_drained:
+            with app.state._memory_backend_lock:
+                if app.state._owns_memory_backend:
+                    owned_memory_backend = app.state.memory_backend
+                    app.state.memory_backend = None
+                    app.state._owns_memory_backend = False
+        else:
+            # A live worker may itself hold _memory_backend_lock while opening
+            # the backend. Respect the bounded shutdown deadline: do not wait
+            # on that lock or mutate ownership until every consumer is gone.
+            logger.warning(
+                "Skipping memory backend cleanup because managed runtime "
+                "consumers did not stop"
+            )
+        close_memory = getattr(owned_memory_backend, "close", None)
+        if callable(close_memory):
+            try:
+                close_memory()
+            except Exception:
+                logger.debug("Memory backend shutdown failed", exc_info=True)
+
     # Wire up trace store if traces are enabled.
     #
     # We deliberately do NOT subscribe the trace store to the bus. The chat

src/openjarvis/server/comparison.py

@@ -215,8 +215,8 @@ COMPARISON_HTML = """\
         <tr>
           <th></th>
           <th>OpenJarvis (Local)</th>
-          <th>GPT-5.3</th>
-          <th>Claude Opus 4.6</th>
+          <th>GPT-5.6 Sol</th>
+          <th>Claude Fable 5</th>
           <th>Gemini 3.1 Pro</th>
         </tr>
       </thead>
@@ -261,11 +261,11 @@ COMPARISON_HTML = """\
         <div class="cc-value">$0.00/mo</div>
       </div>
       <div class="calc-card cloud">
-        <div class="cc-label">GPT-5.3</div>
+        <div class="cc-label">GPT-5.6 Sol</div>
         <div class="cc-value" id="calc-gpt">--</div>
       </div>
       <div class="calc-card cloud">
-        <div class="cc-label">Claude Opus 4.6</div>
+        <div class="cc-label">Claude Fable 5</div>
         <div class="cc-value" id="calc-claude">--</div>
       </div>
       <div class="calc-card cloud">
@@ -292,13 +292,13 @@ COMPARISON_HTML = """\
 <script>
 // Embedded data -- avoids API calls, keeps the page static and fast.
 const CLOUD_PRICING = {
-  "gpt-5.3": {
-    input_per_1m: 2.00, output_per_1m: 10.00,
-    label: "GPT-5.3"
+  "gpt-5.6-sol": {
+    input_per_1m: 5.00, output_per_1m: 30.00,
+    label: "GPT-5.6 Sol"
   },
-  "claude-opus-4.6": {
-    input_per_1m: 5.00, output_per_1m: 25.00,
-    label: "Claude Opus 4.6"
+  "claude-fable-5": {
+    input_per_1m: 10.00, output_per_1m: 50.00,
+    label: "Claude Fable 5"
   },
   "gemini-3.1-pro": {
     input_per_1m: 2.00, output_per_1m: 12.00,
@@ -376,8 +376,8 @@ function updateTable() {
   const sc = SCENARIOS[activeScenario];
   const i = sc.avg_input_tokens, o = sc.avg_output_tokens;
   const c = sc.calls_per_month;
-  const gpt = calcMonthlyCost(c, i, o, 'gpt-5.3');
-  const claude = calcMonthlyCost(c, i, o, 'claude-opus-4.6');
+  const gpt = calcMonthlyCost(c, i, o, 'gpt-5.6-sol');
+  const claude = calcMonthlyCost(c, i, o, 'claude-fable-5');
   const gemini = calcMonthlyCost(c, i, o, 'gemini-3.1-pro');
 
   document.getElementById('t-gpt-m').textContent = fmtDollar(gpt);
@@ -410,8 +410,8 @@ function updateCalc() {
   const avgOut = tpc - avgIn;
   const callsPerMonth = cpd * 30;
 
-  const gpt = calcMonthlyCost(callsPerMonth, avgIn, avgOut, 'gpt-5.3');
-  const claude = calcMonthlyCost(callsPerMonth, avgIn, avgOut, 'claude-opus-4.6');
+  const gpt = calcMonthlyCost(callsPerMonth, avgIn, avgOut, 'gpt-5.6-sol');
+  const claude = calcMonthlyCost(callsPerMonth, avgIn, avgOut, 'claude-fable-5');
   const gemini = calcMonthlyCost(callsPerMonth, avgIn, avgOut, 'gemini-3.1-pro');
 
   document.getElementById('calc-gpt').textContent = fmtDollar(gpt) + '/mo';

src/openjarvis/server/dashboard.py

@@ -184,7 +184,7 @@ DASHBOARD_HTML = """\
   <div class="providers">
     <div class="provider-card openai">
       <div class="pname">OpenAI</div>
-      <div class="pmodel">GPT-5.3 &mdash; $2.00 / $10.00 per 1M tokens</div>
+      <div class="pmodel">GPT-5.6 Sol &mdash; $5.00 / $30.00 per 1M tokens</div>
       <div class="savings-amount" id="save-openai">$0.00</div>
       <div class="breakdown">
         <div class="item">
@@ -199,7 +199,7 @@ DASHBOARD_HTML = """\
     </div>
     <div class="provider-card anthropic">
       <div class="pname">Anthropic</div>
-      <div class="pmodel">Claude Opus 4.6 &mdash; $5.00 / $25.00 per 1M tokens</div>
+      <div class="pmodel">Claude Fable 5 &mdash; $10.00 / $50.00 per 1M tokens</div>
       <div class="savings-amount" id="save-anthropic">$0.00</div>
       <div class="breakdown">
         <div class="item">
@@ -281,12 +281,12 @@ DASHBOARD_HTML = """\
   <div class="providers-heading">Energy &amp; Compute Avoided</div>
   <div class="metrics-row">
     <div class="metric-card">
-      <div class="mheading">Energy Saved (vs GPT-5.3)</div>
+      <div class="mheading">Energy Saved (vs GPT-5.6 Sol)</div>
       <div class="mvalue green" id="energy-joules">0 <span class="munit">J</span></div>
       <div class="msub" id="energy-kwh">0 kWh of cloud datacenter energy avoided</div>
     </div>
     <div class="metric-card">
-      <div class="mheading">FLOPs Avoided (vs GPT-5.3)</div>
+      <div class="mheading">FLOPs Avoided (vs GPT-5.6 Sol)</div>
       <div class="mvalue purple" id="flops-val">0 <span class="munit">FLOP</span></div>
       <div class="msub" id="flops-sub">cloud compute operations not needed</div>
     </div>
@@ -354,8 +354,8 @@ async function refresh() {
       providerMap[p.provider] = p;
     });
 
-    // OpenAI / GPT-5.3
-    const oa = providerMap['gpt-5.3'] || {};
+    // OpenAI / GPT-5.6 Sol
+    const oa = providerMap['gpt-5.6-sol'] || {};
     document.getElementById('save-openai')
       .textContent = fmtDollar(oa.total_cost || 0);
     document.getElementById('save-openai-in')
@@ -363,8 +363,8 @@ async function refresh() {
     document.getElementById('save-openai-out')
       .textContent = fmtDollar(oa.output_cost || 0);
 
-    // Anthropic / Claude Opus 4.6
-    const an = providerMap['claude-opus-4.6'] || {};
+    // Anthropic / Claude Fable 5
+    const an = providerMap['claude-fable-5'] || {};
     document.getElementById('save-anthropic')
       .textContent = fmtDollar(an.total_cost || 0);
     document.getElementById('save-anthropic-in')
@@ -384,13 +384,13 @@ async function refresh() {
     // Monthly projections
     const proj = d.monthly_projection || {};
     document.getElementById('proj-openai')
-      .textContent = fmtDollar(proj['gpt-5.3'] || 0);
+      .textContent = fmtDollar(proj['gpt-5.6-sol'] || 0);
     document.getElementById('proj-anthropic')
-      .textContent = fmtDollar(proj['claude-opus-4.6'] || 0);
+      .textContent = fmtDollar(proj['claude-fable-5'] || 0);
     document.getElementById('proj-google')
       .textContent = fmtDollar(proj['gemini-3.1-pro'] || 0);
 
-    // Energy / FLOPs (use GPT-5.3 as reference)
+    // Energy / FLOPs (use GPT-5.6 Sol as reference)
     const ej = oa.energy_joules || 0;
     const eWh = oa.energy_wh || 0;
     const fl = oa.flops || 0;

src/openjarvis/server/routes.py

@@ -59,23 +59,34 @@ def _ensure_identity_prompt(messages: list[Message], app_config) -> list[Message
     If any message already carries a system role, the caller has supplied
     their own grounding and we leave the list untouched (no double-prompting).
 
-    Resolution of the identity text: ``app_config.agent.default_system_prompt``
-    when a config is wired onto ``app.state``; otherwise fall back to
-    ``load_config()``. Config resolution is wrapped so a broken/missing
-    config degrades to "no injection" rather than crashing the endpoint, but
-    the failure is logged (per REVIEW.md — never silently swallow).
+    Resolution of the identity text: the config comes from ``app.state`` when
+    wired, otherwise ``load_config()``; the prompt itself is assembled by
+    ``SystemPromptBuilder`` from ``agent.default_system_prompt`` plus the
+    persona files (SOUL.md/MEMORY.md/USER.md), matching
+    ``_build_managed_system_prompt`` in ``agent_manager_routes.py``. Config
+    resolution is wrapped so a broken/missing config degrades to "no
+    injection" rather than crashing the endpoint, but the failure is logged
+    (per REVIEW.md — never silently swallow).
     """
     if any(m.role == Role.SYSTEM for m in messages):
         return messages
 
     prompt = ""
     try:
-        if app_config is not None:
-            prompt = app_config.agent.default_system_prompt or ""
-        else:
+        cfg = app_config
+        if cfg is None:
             from openjarvis.core.config import load_config
 
-            prompt = load_config().agent.default_system_prompt or ""
+            cfg = load_config()
+
+        from openjarvis.prompt.builder import SystemPromptBuilder
+
+        builder = SystemPromptBuilder(
+            agent_template=cfg.agent.default_system_prompt or "",
+            memory_files_config=getattr(cfg, "memory_files", None),
+            system_prompt_config=getattr(cfg, "system_prompt", None),
+        )
+        prompt = builder.build()
     except Exception:
         logging.getLogger("openjarvis.server").debug(
             "Identity system prompt resolution failed; "
@@ -231,8 +242,13 @@ async def chat_completions(request_body: ChatCompletionRequest, request: Request
     # tools (e.g. injecting MCP tools through this endpoint and wanting
     # the agent to execute them), add an explicit opt-in header rather
     # than removing this guard — silent re-routing is what produced #414.
+    # ``_handle_agent`` (sync ``agent.run()``) and ``_handle_direct`` (sync
+    # ``engine.generate()``) both make blocking upstream calls; run them in a
+    # worker thread so a slow/wedged non-streaming request can't stall the
+    # event loop and every other concurrent request with it.
     if agent is not None and not request_body.tools:
-        response = _handle_agent(
+        response = await asyncio.to_thread(
+            _handle_agent,
             agent,
             model,
             request_body,
@@ -242,7 +258,8 @@ async def chat_completions(request_body: ChatCompletionRequest, request: Request
         )
     else:
         bus = getattr(request.app.state, "bus", None)
-        response = _handle_direct(
+        response = await asyncio.to_thread(
+            _handle_direct,
             engine,
             model,
             request_body,
@@ -319,6 +336,34 @@ def _remember_exchange(
     )
 
 
+def _engine_key_for_model(engine: Any, model: str) -> str | None:
+    """Resolve the engine that advertised *model* through wrapper layers."""
+    from openjarvis.engine.multi import MultiEngine
+    from openjarvis.security.guardrails import GuardrailsEngine
+    from openjarvis.telemetry.instrumented_engine import InstrumentedEngine
+
+    current = engine
+    while current is not None:
+        if isinstance(current, MultiEngine):
+            return current.engine_key_for(model)
+        if isinstance(current, InstrumentedEngine):
+            current = current._inner
+            continue
+        if isinstance(current, GuardrailsEngine):
+            current = current._engine
+            continue
+        engine_id = getattr(current, "engine_id", None)
+        return engine_id if isinstance(engine_id, str) else None
+    return None
+
+
+def _uses_direct_cloud_router(engine: Any, model: str) -> bool:
+    """Whether *model* should bypass the configured engine for direct cloud."""
+    from openjarvis.server.cloud_router import is_cloud_model
+
+    return is_cloud_model(model) and _engine_key_for_model(engine, model) != "litellm"
+
+
 def _handle_direct(
     engine,
     model: str,
@@ -524,12 +569,13 @@ async def _handle_stream_tools(
     tool_calls) — identical to the prior plain-stream behaviour, so this never
     regresses non-tool-capable engines.
     """
-    from openjarvis.server.cloud_router import is_cloud_model
-
     messages = _to_messages(req.messages)
     messages = _ensure_identity_prompt(messages, app_config)
     chunk_id = f"chatcmpl-{uuid.uuid4().hex[:12]}"
-    use_cloud = is_cloud_model(model)
+    use_cloud = _uses_direct_cloud_router(engine, model)
+    telemetry_engine = (
+        "cloud" if use_cloud else (_engine_key_for_model(engine, model) or "ollama")
+    )
     query_text = ""
     for _m in reversed(req.messages):
         if _m.role == "user" and _m.content:
@@ -609,7 +655,7 @@ async def _handle_stream_tools(
         # Tag the finish chunk with the engine label, matching _handle_stream
         # so UI/telemetry consumers see the same field on the tools path.
         finish_dict.setdefault("telemetry", {})
-        finish_dict["telemetry"]["engine"] = "cloud" if use_cloud else "ollama"
+        finish_dict["telemetry"]["engine"] = telemetry_engine
         if complexity_info is not None:
             finish_dict["complexity"] = complexity_info.model_dump()
         yield f"data: {_json.dumps(finish_dict)}\n\n"
@@ -651,11 +697,7 @@ async def _handle_stream(
     """
     import time
 
-    from openjarvis.server.cloud_router import (
-        is_cloud_model,
-        stream_cloud,
-        stream_local,
-    )
+    from openjarvis.server.cloud_router import stream_cloud, stream_local
 
     messages = _to_messages(req.messages)
     messages = _ensure_identity_prompt(messages, app_config)
@@ -670,7 +712,10 @@ async def _handle_stream(
 
     # Route directly to the right backend — bypasses engine routing entirely
     # so broken MultiEngine state can never misdirect requests.
-    use_cloud = is_cloud_model(model)
+    use_cloud = _uses_direct_cloud_router(engine, model)
+    telemetry_engine = (
+        "cloud" if use_cloud else (_engine_key_for_model(engine, model) or "ollama")
+    )
 
     async def generate():
         started_at = time.time()
@@ -775,7 +820,7 @@ async def _handle_stream(
                 query=query_text,
                 result=full_content,
                 model=model,
-                engine="cloud" if use_cloud else "ollama",
+                engine=telemetry_engine,
                 started_at=started_at,
                 ended_at=time.time(),
             )
@@ -808,7 +853,7 @@ async def _handle_stream(
         # We use the routing decision (use_cloud) directly rather than
         # unwrapping the engine chain, which can be in a broken state.
         finish_dict.setdefault("telemetry", {})
-        finish_dict["telemetry"]["engine"] = "cloud" if use_cloud else "ollama"
+        finish_dict["telemetry"]["engine"] = telemetry_engine
 
         if complexity_info is not None:
             finish_dict["complexity"] = complexity_info.model_dump()
@@ -825,24 +870,40 @@ async def _handle_stream(
 
 @router.get("/v1/models")
 async def list_models(request: Request) -> ModelListResponse:
-    """List locally installed models (Ollama).
+    """List selectable engine models for the installed-model picker.
 
-    Cloud models are not included here — they live in the Cloud Models tab
-    of the UI and are selected there, not from this endpoint.
+    Direct cloud models live in the Cloud Models tab. Models advertised by a
+    configured LiteLLM engine remain here because LiteLLM owns their routing
+    and may use provider-qualified IDs that resemble OpenRouter IDs.
     """
     from openjarvis.server.cloud_router import is_cloud_model, list_local_models
 
     # Prefer engine.list_models() so mock engines work in tests.
-    # Filter out any cloud model IDs that may appear via MultiEngine.
+    # Filter out direct-cloud model IDs that may appear via MultiEngine, but
+    # retain provider-qualified IDs owned by the configured LiteLLM engine.
     # Fall back to direct Ollama query only when the engine returns nothing.
     engine = request.app.state.engine
     all_ids = await asyncio.to_thread(engine.list_models)
-    model_ids = [m for m in all_ids if not is_cloud_model(m)]
+    model_ids = [
+        m
+        for m in all_ids
+        if not is_cloud_model(m) or _engine_key_for_model(engine, m) == "litellm"
+    ]
     if not model_ids:
         model_ids = await list_local_models()
 
     return ModelListResponse(
-        data=[ModelObject(id=mid) for mid in model_ids],
+        data=[
+            ModelObject(
+                id=mid,
+                owned_by=(
+                    "litellm"
+                    if _engine_key_for_model(engine, mid) == "litellm"
+                    else "openjarvis"
+                ),
+            )
+            for mid in model_ids
+        ],
     )
 
 

src/openjarvis/server/savings.py

@@ -23,19 +23,19 @@ from openjarvis.core.types import TOKEN_COUNTING_VERSION  # noqa: E402,F401
 # ---------------------------------------------------------------------------
 
 CLOUD_PRICING: Dict[str, Dict[str, float]] = {
-    "gpt-5.3": {
-        "input_per_1m": 2.00,
-        "output_per_1m": 10.00,
-        "label": "GPT-5.3",
+    "gpt-5.6-sol": {
+        "input_per_1m": 5.00,
+        "output_per_1m": 30.00,
+        "label": "GPT-5.6 Sol",
         "provider": "OpenAI",
         "params_b": 200.0,
         "energy_wh_per_1k_tokens": 0.4,
         "flops_per_token": 3.0e12,
     },
-    "claude-opus-4.6": {
-        "input_per_1m": 5.00,
-        "output_per_1m": 25.00,
-        "label": "Claude Opus 4.6",
+    "claude-fable-5": {
+        "input_per_1m": 10.00,
+        "output_per_1m": 50.00,
+        "label": "Claude Fable 5",
         "provider": "Anthropic",
         "params_b": 137.0,
         "energy_wh_per_1k_tokens": 0.5,

src/openjarvis/server/session_store.py

@@ -25,9 +25,11 @@ class SessionStore:
     def __init__(self, db_path: str = "") -> None:
         if not db_path:
             db_path = str(get_config_dir() / "sessions.db")
-        from openjarvis.security.file_utils import secure_create
+        # Ensure the parent directory exists (skip for :memory:)
+        if db_path != ":memory:":
+            from openjarvis.security.file_utils import secure_create
 
-        secure_create(Path(db_path))
+            secure_create(Path(db_path))
         self._db = sqlite3.connect(db_path, check_same_thread=False)
         self._db.row_factory = sqlite3.Row
         self._create_tables()

src/openjarvis/server/stream_bridge.py

@@ -16,6 +16,7 @@ from fastapi.responses import StreamingResponse
 
 from openjarvis.agents._stubs import AgentContext, BaseAgent
 from openjarvis.core.events import Event, EventBus, EventType
+from openjarvis.engine._base import looks_like_context_length_error
 from openjarvis.server.models import (
     ChatCompletionChunk,
     ChatCompletionRequest,
@@ -194,8 +195,10 @@ class AgentStreamBridge:
                 logger.error("Agent stream error: %s", exc, exc_info=True)
 
                 error_str = str(exc)
-                if "context length" in error_str.lower() or (
-                    "400" in error_str and "too long" in error_str.lower()
+                if (
+                    getattr(exc, "is_context_length_error", False)
+                    or looks_like_context_length_error(error_str)
+                    or ("400" in error_str and "too long" in error_str.lower())
                 ):
                     error_content = (
                         "The input is too long for the model's context window. "

src/openjarvis/server/ws_bridge.py

@@ -79,14 +79,41 @@ def create_ws_router(event_bus: EventBus) -> Any:
         queue: asyncio.Queue = asyncio.Queue(maxsize=100)
         loop = asyncio.get_running_loop()
         clients[websocket] = (queue, loop)
+        recv: asyncio.Task | None = None
+        payload: asyncio.Task | None = None
+        disconnected = False
         try:
+            recv = asyncio.create_task(websocket.receive())
+            payload = asyncio.create_task(queue.get())
             while True:
-                payload = await queue.get()
-                await websocket.send_json(payload)
+                done, _ = await asyncio.wait(
+                    {recv, payload}, return_when=asyncio.FIRST_COMPLETED
+                )
+                if recv in done:
+                    # Starlette surfaces a disconnect message only when the app
+                    # reads from the socket. Without this receive, the handler
+                    # can stay parked on queue.get() after the client leaves.
+                    message = await recv
+                    if message.get("type") == "websocket.disconnect":
+                        disconnected = True
+                        break
+                    recv = asyncio.create_task(websocket.receive())
+                if payload in done:
+                    await websocket.send_json(payload.result())
+                    payload = asyncio.create_task(queue.get())
         except WebSocketDisconnect:
-            pass
+            disconnected = True
         finally:
             clients.pop(websocket, None)
+            pending = [task for task in (recv, payload) if task is not None]
+            for task in pending:
+                task.cancel()
+            cleanup = asyncio.gather(*pending, return_exceptions=True)
+            try:
+                await asyncio.shield(cleanup)
+            except asyncio.CancelledError:
+                if not disconnected:
+                    raise
 
     return router
 

src/openjarvis/skills/executor.py

@@ -5,10 +5,11 @@ from __future__ import annotations
 import json
 import re
 from dataclasses import dataclass, field
-from typing import Any, Callable, Dict, List, Optional
+from typing import Any, Callable, Dict, List, Optional, Set
 
 from openjarvis.core.events import EventBus, EventType
 from openjarvis.core.types import ToolCall, ToolResult
+from openjarvis.skills.security import validate_capabilities
 from openjarvis.skills.types import SkillManifest
 from openjarvis.tools._stubs import ToolExecutor
 
@@ -37,10 +38,16 @@ class SkillExecutor:
         tool_executor: ToolExecutor,
         *,
         bus: Optional[EventBus] = None,
+        allowed_capabilities: Optional[Set[str]] = None,
     ) -> None:
         self._tool_executor = tool_executor
         self._bus = bus
         self._skill_resolver: Optional[SkillResolver] = None
+        # None means "no capability policy" — every skill runs, matching the
+        # behavior before capability enforcement existed. Pass a set (even an
+        # empty one) to enforce: skills whose required_capabilities are not a
+        # subset of it are blocked before any step runs.
+        self._allowed_capabilities: Optional[Set[str]] = allowed_capabilities
 
     def set_skill_resolver(self, resolver: SkillResolver) -> None:
         """Register a callback used to delegate ``skill_name`` steps."""
@@ -53,6 +60,38 @@ class SkillExecutor:
         initial_context: Optional[Dict[str, Any]] = None,
     ) -> SkillResult:
         """Execute all steps in a skill manifest."""
+        missing = (
+            validate_capabilities(manifest, self._allowed_capabilities)
+            if self._allowed_capabilities is not None
+            else []
+        )
+        if missing:
+            if self._bus:
+                self._bus.publish(
+                    EventType.SKILL_EXECUTE_START,
+                    {"skill": manifest.name, "steps": len(manifest.steps)},
+                )
+                self._bus.publish(
+                    EventType.SKILL_EXECUTE_END,
+                    {"skill": manifest.name, "success": False},
+                )
+            return SkillResult(
+                skill_name=manifest.name,
+                success=False,
+                step_results=[
+                    ToolResult(
+                        tool_name=manifest.name,
+                        content=(
+                            f"Blocked: skill '{manifest.name}' requires "
+                            f"capabilities {missing} that were not granted "
+                            "for this session."
+                        ),
+                        success=False,
+                    )
+                ],
+                context=dict(initial_context or {}),
+            )
+
         ctx: Dict[str, Any] = dict(initial_context or {})
         all_results: List[ToolResult] = []
 

src/openjarvis/skills/importer.py

@@ -25,6 +25,11 @@ import yaml
 
 from openjarvis.core.paths import get_config_dir
 from openjarvis.skills.parser import SkillParser
+from openjarvis.skills.security import (
+    TrustTier,
+    classify_trust_tier,
+    has_dangerous_capabilities,
+)
 from openjarvis.skills.sources.base import ResolvedSkill
 from openjarvis.skills.tool_translator import ToolTranslator
 
@@ -43,6 +48,9 @@ class ImportResult:
     untranslated_tools: List[str] = field(default_factory=list)
     scripts_imported: bool = False
     warnings: List[str] = field(default_factory=list)
+    trust_tier: TrustTier = TrustTier.UNREVIEWED
+    dangerous_capabilities: List[str] = field(default_factory=list)
+    requires_confirmation: bool = False
 
 
 class SkillImporter:
@@ -66,6 +74,7 @@ class SkillImporter:
         *,
         with_scripts: bool = False,
         force: bool = False,
+        confirm_dangerous: bool = False,
     ) -> ImportResult:
         """Install *resolved* into ``<target_root>/<source>/<name>/``.
 
@@ -95,12 +104,45 @@ class SkillImporter:
 
         try:
             frontmatter, body = self._read_skill_md(source_md)
-            self._parser.parse_frontmatter(frontmatter, markdown_content=body)
+            manifest = self._parser.parse_frontmatter(
+                frontmatter, markdown_content=body
+            )
         except Exception as exc:
             result.success = False
             result.warnings.append(f"Parse error: {exc}")
             return result
 
+        # 1a. Classify trust and check for dangerous capabilities *before*
+        # writing anything to disk. Everything the importer handles comes from
+        # an external source (github/hermes/openclaw), so the BUNDLED and
+        # WORKSPACE tiers never apply here, and no resolver verifies index
+        # membership yet — a signature alone still classifies as UNREVIEWED.
+        # Community skills get no special treatment just because they came
+        # from a named source.
+        result.trust_tier = classify_trust_tier(
+            has_signature=bool(manifest.signature),
+        )
+        result.dangerous_capabilities = has_dangerous_capabilities(manifest)
+
+        if result.dangerous_capabilities and result.trust_tier == TrustTier.UNREVIEWED:
+            result.requires_confirmation = True
+            if not confirm_dangerous:
+                result.success = False
+                result.warnings.append(
+                    "Refusing to install: this unreviewed skill requests "
+                    f"dangerous capabilities {result.dangerous_capabilities}. "
+                    "Re-run with confirm_dangerous=True (or `--yes-dangerous` "
+                    "on the CLI) only if you trust the source and have "
+                    "reviewed what it does."
+                )
+                return result
+            result.warnings.append(
+                "Installed with dangerous capabilities "
+                f"{result.dangerous_capabilities} — confirmed by caller. "
+                "This skill can run shell commands, open network listeners, "
+                "and/or write to the filesystem."
+            )
+
         # 2. Translate tool references
         translated_body, untranslated = self._translator.translate_markdown(body)
         result.untranslated_tools = untranslated
@@ -180,6 +222,7 @@ class SkillImporter:
         translated_str = ", ".join(f'"{t}"' for t in result.translated_tools)
         missing_str = ", ".join(f'"{t}"' for t in result.untranslated_tools)
         scripts_lower = "true" if result.scripts_imported else "false"
+        dangerous_str = ", ".join(f'"{c}"' for c in result.dangerous_capabilities)
 
         content = (
             f'source = "{resolved.source}:{resolved.name}"\n'
@@ -189,6 +232,8 @@ class SkillImporter:
             f"translated_tools = [{translated_str}]\n"
             f"missing_tools = [{missing_str}]\n"
             f"scripts_imported = {scripts_lower}\n"
+            f'trust_tier = "{result.trust_tier.value}"\n'
+            f"dangerous_capabilities = [{dangerous_str}]\n"
         )
         (target_dir / ".source").write_text(content, encoding="utf-8")
 

src/openjarvis/speech/faster_whisper.py

@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 import logging
+import os
 import tempfile
 from typing import List, Optional
 
@@ -105,11 +106,15 @@ class FasterWhisperBackend(SpeechBackend):
         try:
             model = self._ensure_model()
 
-            # Write audio to a temp file (faster-whisper needs a file path)
+            # Write audio to a temp file (faster-whisper needs a file path).
+            # delete=False + manual unlink: on Windows an open
+            # NamedTemporaryFile holds an exclusive handle, so PyAV's reopen
+            # of tmp.name inside model.transcribe() fails with EACCES.
             suffix = f".{format}" if not format.startswith(".") else format
-            with tempfile.NamedTemporaryFile(suffix=suffix, delete=True) as tmp:
-                tmp.write(audio)
-                tmp.flush()
+            tmp = tempfile.NamedTemporaryFile(suffix=suffix, delete=False)
+            try:
+                with tmp:
+                    tmp.write(audio)
 
                 kwargs = {}
                 if language:
@@ -117,6 +122,15 @@ class FasterWhisperBackend(SpeechBackend):
 
                 segments_iter, info = model.transcribe(tmp.name, **kwargs)
                 segments_list = list(segments_iter)
+            finally:
+                try:
+                    os.unlink(tmp.name)
+                except OSError as unlink_exc:
+                    logger.debug(
+                        "Could not remove temp audio file %s: %s",
+                        tmp.name,
+                        unlink_exc,
+                    )
         except Exception as exc:
             self._last_error = str(exc)
             raise

src/openjarvis/system/builder.py

@@ -48,6 +48,7 @@ class SystemBuilder:
         self._sessions: Optional[bool] = None
         self._speech: Optional[bool] = None
         self._mcp_clients: List = []
+        self._mcp_tools: List[BaseTool] = []
 
     def engine(self, key: str) -> SystemBuilder:
         self._engine_key = key
@@ -113,6 +114,33 @@ class SystemBuilder:
 
     def build(self) -> JarvisSystem:
         """Construct a fully wired JarvisSystem."""
+        # Discovery state belongs to one build only.  Once a system is
+        # returned, that system owns the clients and adapters captured below;
+        # retaining them here would make a reused builder hand closed clients
+        # from an earlier system to the next one.
+        self._clear_mcp_discovery_state(close_clients=True)
+        try:
+            system = self._build()
+        except BaseException:
+            # No system took ownership, so release any clients opened before
+            # the build failed.
+            self._clear_mcp_discovery_state(close_clients=True)
+            raise
+        self._clear_mcp_discovery_state(close_clients=False)
+        return system
+
+    def _clear_mcp_discovery_state(self, *, close_clients: bool) -> None:
+        if close_clients:
+            for client in getattr(self, "_mcp_clients", []):
+                try:
+                    client.close()
+                except Exception:
+                    logger.debug("Error closing unowned MCP client", exc_info=True)
+        self._mcp_clients = []
+        self._mcp_tools = []
+
+    def _build(self) -> JarvisSystem:
+        """Build one system using fresh, build-local MCP discovery state."""
         config = self._config
         bus = self._bus or get_event_bus()
 
@@ -291,6 +319,7 @@ class SystemBuilder:
             model=model,
             agent_name=agent_name,
             tools=tool_list,
+            mcp_tools=list(self._mcp_tools),
             tool_executor=tool_executor,
             memory_backend=memory_backend,
             channel_backend=channel_backend,
@@ -440,7 +469,7 @@ class SystemBuilder:
         else:
             tools = []
 
-        if config.tools.mcp.servers:
+        if config.tools.mcp.enabled and config.tools.mcp.servers:
             try:
                 import json
 
@@ -449,6 +478,7 @@ class SystemBuilder:
                     for server_cfg in server_list:
                         try:
                             external_tools = self._discover_external_mcp(server_cfg)
+                            self._mcp_tools.extend(external_tools)
                             if tool_names:
                                 external_tools = [
                                     t

src/openjarvis/system/core.py

@@ -86,6 +86,9 @@ class JarvisSystem:
     skill_manager: Optional[SkillManager] = None
     _learning_orchestrator: Optional[LearningOrchestrator] = None
     _mcp_clients: List[MCPClient] = field(default_factory=list)
+    # Keep newly added fields after every pre-existing positional field so
+    # older positional JarvisSystem(...) calls retain their original meaning.
+    mcp_tools: List[BaseTool] = field(default_factory=list)
 
     @property
     def security(self) -> SecurityContext:

src/openjarvis/telemetry/instrumented_engine.py

@@ -212,6 +212,7 @@ class InstrumentedEngine(InferenceEngine):
             completion_tokens=completion_tokens,
             total_tokens=prompt_tok + completion_tokens,
             latency_seconds=latency,
+            cost_usd=result.get("cost_usd", 0.0),
             ttft=ttft,
             throughput_tok_per_sec=throughput,
             energy_per_output_token_joules=energy_per_output_token,

src/openjarvis/telemetry/store.py

@@ -108,6 +108,13 @@ INSERT INTO telemetry (
 )
 """
 
+_INSERT_MINING = """\
+INSERT INTO mining_stats (
+    recorded_at, provider_id, shares_submitted, shares_accepted, blocks_found,
+    hashrate, uptime_seconds, last_share_at, last_error, payout_target, fees_owed
+) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+"""
+
 _MIGRATE_COLUMNS = [
     ("gpu_utilization_pct", "REAL NOT NULL DEFAULT 0.0"),
     ("gpu_memory_used_gb", "REAL NOT NULL DEFAULT 0.0"),
@@ -144,10 +151,35 @@ _MIGRATE_COLUMNS = [
 
 
 class TelemetryStore:
-    """Append-only SQLite store for inference telemetry records."""
+    """Append-only SQLite store for inference telemetry records.
+
+    Writes are batched in memory and flushed to SQLite when a batch reaches
+    ``batch_size``, when ``flush_interval_seconds`` elapses (a background
+    flusher thread guarantees this even with no further writes), on any read
+    through this store, and on ``close()``. Readers that open their OWN
+    connection to the database file (e.g. ``TelemetryAggregator``) therefore
+    see new rows within ``flush_interval_seconds`` at the latest; call
+    ``flush()`` first for immediate visibility. Pass
+    ``flush_interval_seconds=0`` to disable time-based flushing (batch-size
+    and read/close flushes still apply).
+    """
+
+    def __init__(
+        self,
+        db_path: str | Path,
+        batch_size: int = 50,
+        flush_interval_seconds: float = 5.0,
+    ) -> None:
+        if batch_size < 1:
+            raise ValueError("batch_size must be >= 1")
+        if flush_interval_seconds < 0:
+            raise ValueError("flush_interval_seconds must be >= 0")
 
-    def __init__(self, db_path: str | Path) -> None:
         self._db_path = str(db_path)
+        if self._db_path != ":memory:":
+            from openjarvis.security.file_utils import secure_create
+
+            secure_create(Path(self._db_path))
         self._conn = sqlite3.connect(self._db_path, check_same_thread=False)
         self._lock = threading.Lock()
         self._conn.execute("PRAGMA journal_mode=WAL")
@@ -158,6 +190,38 @@ class TelemetryStore:
         self._conn.commit()
         self._migrate_schema()
 
+        self._batch_size = batch_size
+        self._flush_interval_seconds = flush_interval_seconds
+        self._last_flush_time = time.monotonic()
+        self._telemetry_batch: list[tuple[Any, ...]] = []
+        self._mining_batch: list[tuple[Any, ...]] = []
+        self._closed = False
+
+        # Background flusher: without it, a partial batch written just before
+        # traffic stops would stay invisible to other connections until the
+        # NEXT write arrived (the stale check in ``_maybe_flush_unlocked``
+        # only runs inside record calls). Daemon so it never blocks exit.
+        self._stop_flusher = threading.Event()
+        self._flusher: threading.Thread | None = None
+        if flush_interval_seconds > 0:
+            self._flusher = threading.Thread(
+                target=self._flush_loop,
+                name="telemetry-store-flusher",
+                daemon=True,
+            )
+            self._flusher.start()
+
+    def _flush_loop(self) -> None:
+        """Periodically flush pending batches until ``close()`` stops us."""
+        while not self._stop_flusher.wait(self._flush_interval_seconds):
+            with self._lock:
+                # ``close()`` sets the event BEFORE taking the lock, so seeing
+                # it unset here means the connection is still open.
+                if self._stop_flusher.is_set():
+                    break
+                if self._telemetry_batch or self._mining_batch:
+                    self._flush_unlocked()
+
     def _migrate_schema(self) -> None:
         """Add new columns to existing databases (idempotent)."""
         for col_name, col_def in _MIGRATE_COLUMNS:
@@ -171,54 +235,52 @@ class TelemetryStore:
 
     def record(self, rec: TelemetryRecord) -> None:
         """Persist a single telemetry record."""
+        row = (
+            rec.timestamp,
+            rec.model_id,
+            rec.engine,
+            rec.agent,
+            rec.prompt_tokens,
+            rec.prompt_tokens_evaluated,
+            rec.completion_tokens,
+            rec.total_tokens,
+            rec.latency_seconds,
+            rec.ttft,
+            rec.cost_usd,
+            rec.energy_joules,
+            rec.power_watts,
+            rec.gpu_utilization_pct,
+            rec.gpu_memory_used_gb,
+            rec.gpu_temperature_c,
+            rec.throughput_tok_per_sec,
+            rec.prefill_latency_seconds,
+            rec.decode_latency_seconds,
+            rec.energy_method,
+            rec.energy_vendor,
+            rec.batch_id,
+            1 if rec.is_warmup else 0,
+            rec.cpu_energy_joules,
+            rec.gpu_energy_joules,
+            rec.dram_energy_joules,
+            rec.tokens_per_joule,
+            rec.energy_per_output_token_joules,
+            rec.throughput_per_watt,
+            rec.prefill_energy_joules,
+            rec.decode_energy_joules,
+            rec.mean_itl_ms,
+            rec.median_itl_ms,
+            rec.p90_itl_ms,
+            rec.p95_itl_ms,
+            rec.p99_itl_ms,
+            rec.std_itl_ms,
+            1 if rec.is_streaming else 0,
+            rec.token_counting_version,
+            rec.mining_session_id,
+            json.dumps(rec.metadata),
+        )
         with self._lock:
-            self._conn.execute(
-                _INSERT,
-                (
-                    rec.timestamp,
-                    rec.model_id,
-                    rec.engine,
-                    rec.agent,
-                    rec.prompt_tokens,
-                    rec.prompt_tokens_evaluated,
-                    rec.completion_tokens,
-                    rec.total_tokens,
-                    rec.latency_seconds,
-                    rec.ttft,
-                    rec.cost_usd,
-                    rec.energy_joules,
-                    rec.power_watts,
-                    rec.gpu_utilization_pct,
-                    rec.gpu_memory_used_gb,
-                    rec.gpu_temperature_c,
-                    rec.throughput_tok_per_sec,
-                    rec.prefill_latency_seconds,
-                    rec.decode_latency_seconds,
-                    rec.energy_method,
-                    rec.energy_vendor,
-                    rec.batch_id,
-                    1 if rec.is_warmup else 0,
-                    rec.cpu_energy_joules,
-                    rec.gpu_energy_joules,
-                    rec.dram_energy_joules,
-                    rec.tokens_per_joule,
-                    rec.energy_per_output_token_joules,
-                    rec.throughput_per_watt,
-                    rec.prefill_energy_joules,
-                    rec.decode_energy_joules,
-                    rec.mean_itl_ms,
-                    rec.median_itl_ms,
-                    rec.p90_itl_ms,
-                    rec.p95_itl_ms,
-                    rec.p99_itl_ms,
-                    rec.std_itl_ms,
-                    1 if rec.is_streaming else 0,
-                    rec.token_counting_version,
-                    rec.mining_session_id,
-                    json.dumps(rec.metadata),
-                ),
-            )
-            self._conn.commit()
+            self._telemetry_batch.append(row)
+            self._maybe_flush_unlocked()
 
     def record_mining_stats(self, stats: Any) -> None:
         """Persist one mining stats snapshot.
@@ -226,43 +288,70 @@ class TelemetryStore:
         ``stats`` is duck-typed to keep telemetry usable without importing the
         optional mining package at module import time.
         """
+        row = (
+            time.time(),
+            stats.provider_id,
+            stats.shares_submitted,
+            stats.shares_accepted,
+            stats.blocks_found,
+            stats.hashrate,
+            stats.uptime_seconds,
+            stats.last_share_at,
+            stats.last_error,
+            stats.payout_target,
+            stats.fees_owed,
+        )
         with self._lock:
-            self._conn.execute(
-                """\
-INSERT INTO mining_stats (
-    recorded_at, provider_id, shares_submitted, shares_accepted, blocks_found,
-    hashrate, uptime_seconds, last_share_at, last_error, payout_target, fees_owed
-) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-""",
-                (
-                    time.time(),
-                    stats.provider_id,
-                    stats.shares_submitted,
-                    stats.shares_accepted,
-                    stats.blocks_found,
-                    stats.hashrate,
-                    stats.uptime_seconds,
-                    stats.last_share_at,
-                    stats.last_error,
-                    stats.payout_target,
-                    stats.fees_owed,
-                ),
-            )
-            self._conn.commit()
+            self._mining_batch.append(row)
+            self._maybe_flush_unlocked()
+
+    def flush(self) -> None:
+        """Write all pending records to the database."""
+        with self._lock:
+            self._flush_unlocked()
+
+    def _flush_unlocked(self) -> None:
+        if self._telemetry_batch:
+            self._conn.executemany(_INSERT, self._telemetry_batch)
+            self._telemetry_batch.clear()
+        if self._mining_batch:
+            self._conn.executemany(_INSERT_MINING, self._mining_batch)
+            self._mining_batch.clear()
+        self._conn.commit()
+        self._last_flush_time = time.monotonic()
+
+    def _maybe_flush_unlocked(self) -> None:
+        """Flush when the batch is full or has been pending too long."""
+        if not self._telemetry_batch and not self._mining_batch:
+            return
+        batch_full = (
+            len(self._telemetry_batch) >= self._batch_size
+            or len(self._mining_batch) >= self._batch_size
+        )
+        stale = (
+            self._flush_interval_seconds > 0
+            and time.monotonic() - self._last_flush_time >= self._flush_interval_seconds
+        )
+        if batch_full or stale:
+            self._flush_unlocked()
 
     def list_recent(self, limit: int = 50) -> list[dict[str, Any]]:
         """Return recent telemetry rows as dictionaries."""
-        return self._select_dicts(
-            "SELECT * FROM telemetry ORDER BY timestamp DESC LIMIT ?",
-            (limit,),
-        )
+        with self._lock:
+            self._flush_unlocked()
+            return self._select_dicts_unlocked(
+                "SELECT * FROM telemetry ORDER BY timestamp DESC LIMIT ?",
+                (limit,),
+            )
 
     def list_recent_mining_stats(self, limit: int = 50) -> list[dict[str, Any]]:
         """Return recent mining stats snapshots as dictionaries."""
-        return self._select_dicts(
-            "SELECT * FROM mining_stats ORDER BY recorded_at DESC LIMIT ?",
-            (limit,),
-        )
+        with self._lock:
+            self._flush_unlocked()
+            return self._select_dicts_unlocked(
+                "SELECT * FROM mining_stats ORDER BY recorded_at DESC LIMIT ?",
+                (limit,),
+            )
 
     def subscribe_to_bus(self, bus: EventBus) -> None:
         """Subscribe to ``TELEMETRY_RECORD`` events on *bus*."""
@@ -277,15 +366,36 @@ INSERT INTO mining_stats (
                 logger.debug("Failed to record telemetry event: %s", exc)
 
     def close(self) -> None:
-        """Close the underlying SQLite connection."""
-        self._conn.close()
+        """Flush pending records and close the underlying SQLite connection."""
+        # Set the stop event BEFORE taking the lock: a flusher iteration
+        # already waiting on the lock re-checks the event after acquiring it
+        # and exits instead of touching the closed connection.
+        self._stop_flusher.set()
+        with self._lock:
+            if self._closed:
+                return
+            self._flush_unlocked()
+            self._conn.close()
+            self._closed = True
+        if self._flusher is not None:
+            self._flusher.join(timeout=1.0)
+            self._flusher = None
 
     # -- helpers for querying (used by tests) --------------------------------
 
     def _fetchall(self, sql: str = "SELECT * FROM telemetry") -> list:
-        return self._conn.execute(sql).fetchall()
+        with self._lock:
+            self._flush_unlocked()
+            return self._conn.execute(sql).fetchall()
 
     def _select_dicts(self, sql: str, params: tuple[Any, ...]) -> list[dict[str, Any]]:
+        with self._lock:
+            self._flush_unlocked()
+            return self._select_dicts_unlocked(sql, params)
+
+    def _select_dicts_unlocked(
+        self, sql: str, params: tuple[Any, ...]
+    ) -> list[dict[str, Any]]:
         cur = self._conn.execute(sql, params)
         columns = [desc[0] for desc in cur.description]
         return [dict(zip(columns, row)) for row in cur.fetchall()]

src/openjarvis/tools/__init__.py

@@ -142,4 +142,14 @@ try:
 except ImportError:
     pass
 
+try:
+    import openjarvis.tools.scan_chunks  # noqa: F401
+except ImportError:
+    pass
+
+try:
+    import openjarvis.tools.knowledge_sql  # noqa: F401
+except ImportError:
+    pass
+
 __all__ = ["BaseTool", "ToolExecutor", "ToolSpec"]

src/openjarvis/tools/git_tool.py

@@ -139,8 +139,8 @@ class GitStatusTool(BaseTool):
 
     def execute(self, **params: Any) -> ToolResult:
         repo_path = params.get("repo_path", ".")
-        _rust = get_rust_module()
         try:
+            _rust = get_rust_module()
             output = _rust.GitStatusTool().execute(repo_path)
             return ToolResult(
                 tool_name="git_status",
@@ -148,6 +148,8 @@ class GitStatusTool(BaseTool):
                 success=True,
                 metadata={"returncode": 0},
             )
+        except ImportError as exc:
+            logger.debug("Rust git_status fallback to CLI: %s", exc)
         except Exception as exc:
             return ToolResult(
                 tool_name="git_status",
@@ -155,6 +157,8 @@ class GitStatusTool(BaseTool):
                 success=False,
             )
 
+        return _run_git(["git", "status", "--porcelain"], cwd=repo_path)
+
 
 # ---------------------------------------------------------------------------
 # GitDiffTool
@@ -208,9 +212,9 @@ class GitDiffTool(BaseTool):
         staged = params.get("staged", False)
         file_path = params.get("path")
 
-        _rust = get_rust_module()
         if not staged and not file_path:
             try:
+                _rust = get_rust_module()
                 output = _rust.GitDiffTool().execute(repo_path)
                 return ToolResult(
                     tool_name="git_diff",
@@ -218,6 +222,8 @@ class GitDiffTool(BaseTool):
                     success=True,
                     metadata={"returncode": 0},
                 )
+            except ImportError as exc:
+                logger.debug("Rust git_diff fallback to CLI: %s", exc)
             except Exception as exc:
                 return ToolResult(
                     tool_name="git_diff",
@@ -371,8 +377,8 @@ class GitLogTool(BaseTool):
         count = params.get("count", 10)
         oneline = params.get("oneline", True)
 
-        _rust = get_rust_module()
         try:
+            _rust = get_rust_module()
             output = _rust.GitLogTool().execute(repo_path, count)
             return ToolResult(
                 tool_name="git_log",

src/openjarvis/tools/knowledge_sql.py

@@ -6,6 +6,7 @@ and filtering operations that BM25 search cannot handle.
 
 from __future__ import annotations
 
+import re
 import sqlite3
 from typing import Any, Optional
 
@@ -16,10 +17,25 @@ from openjarvis.tools._stubs import BaseTool, ToolSpec
 
 _MAX_ROWS = 50
 
+# Write keywords are matched on word boundaries (mirroring db_query.py) so that
+# a read-only SELECT is not rejected just because a column/alias/literal happens
+# to contain one as a substring (e.g. "deleted_at", "created_at").
+_FORBIDDEN_RE = re.compile(
+    r"\b(DROP|DELETE|INSERT|UPDATE|ALTER|CREATE|TRUNCATE|ATTACH)\b",
+    re.IGNORECASE,
+)
+
+# String literals are stripped before the keyword scan so that data mentioning
+# a write keyword (e.g. WHERE content LIKE '%delete%') is not rejected. A write
+# "hidden" in a literal still cannot execute: the query must start with SELECT
+# and sqlite3 refuses multi-statement strings.
+_STRING_LITERAL_RE = re.compile(r"'[^']*'")
+
 _SCHEMA_DESCRIPTION = (
     "Table: knowledge_chunks\n"
     "Columns: id, content, source, doc_type, doc_id, title, author, "
-    "participants, timestamp, thread_id, url, metadata, chunk_index"
+    "participants, timestamp, thread_id, url, metadata, chunk_index, "
+    "created_at, deleted_at (NULL for active rows)"
 )
 
 
@@ -84,21 +100,20 @@ class KnowledgeSQLTool(BaseTool):
                 success=False,
             )
 
-        _FORBIDDEN = ("DROP", "DELETE", "INSERT", "UPDATE", "ALTER", "CREATE", "ATTACH")
-        for forbidden in _FORBIDDEN:
-            if forbidden in normalized:
-                return ToolResult(
-                    tool_name="knowledge_sql",
-                    content=(
-                        f"Query contains forbidden keyword: {forbidden}."
-                        " Only SELECT queries allowed."
-                    ),
-                    success=False,
-                )
+        forbidden = _FORBIDDEN_RE.search(_STRING_LITERAL_RE.sub("''", query))
+        if forbidden:
+            return ToolResult(
+                tool_name="knowledge_sql",
+                content=(
+                    f"Query contains forbidden keyword: {forbidden.group(1).upper()}."
+                    " Only SELECT queries allowed."
+                ),
+                success=False,
+            )
 
         try:
             rows = self._store._conn.execute(query).fetchmany(_MAX_ROWS)
-        except sqlite3.OperationalError as exc:
+        except sqlite3.Error as exc:
             return ToolResult(
                 tool_name="knowledge_sql",
                 content=f"SQL error: {exc}",

tests/agents/test_errors.py

@@ -56,3 +56,30 @@ class TestErrorClassification:
         assert retry_delay(2) == 40
         # Capped at 300 seconds
         assert retry_delay(10) == 300
+
+    def test_classify_context_length_is_fatal(self):
+        # A context-window overflow is deterministic — retrying the identical
+        # over-length request can never succeed, so it must NOT be classified
+        # retryable (which would burn ~30s of backoff on guaranteed failures).
+        from openjarvis.agents.errors import classify_error
+        from openjarvis.engine._base import EngineContextLengthError
+
+        typed = classify_error(
+            EngineContextLengthError(
+                "The conversation is too long for the model's context window."
+            )
+        )
+        assert typed.retryable is False
+
+        # Same for untyped errors whose message reads like a context overflow
+        # (e.g. raw vendor errors from engines without the typed mapping).
+        untyped = classify_error(
+            Exception("This model's maximum context length is 4096 tokens.")
+        )
+        assert untyped.retryable is False
+
+    def test_suggest_action_context_length(self):
+        from openjarvis.agents.errors import FatalError, suggest_action
+
+        action = suggest_action(FatalError("prompt exceeds the model's context window"))
+        assert "context window" in action or "too long" in action.lower()

tests/agents/test_executor_tool_persistence.py

@@ -0,0 +1,127 @@
+"""Regression tests for managed-agent tool-call persistence."""
+
+from __future__ import annotations
+
+import json
+
+import pytest
+
+from openjarvis.agents._stubs import AgentResult
+from openjarvis.agents.executor import AgentExecutor, _tool_calls_for_storage
+from openjarvis.agents.manager import AgentManager
+from openjarvis.core.events import EventBus
+from openjarvis.core.types import ToolResult
+
+
+def test_tool_results_are_serialized_for_managed_messages() -> None:
+    result = AgentResult(
+        content="Finished",
+        tool_results=[
+            ToolResult(
+                tool_name="knowledge_search",
+                content="Found the requested note",
+                success=True,
+                latency_seconds=0.42,
+                metadata={
+                    "arguments": {
+                        "query": "financial independence",
+                        "limit": 3,
+                    }
+                },
+            ),
+            ToolResult(
+                tool_name="shell_exec",
+                content="Permission denied",
+                success=False,
+                latency_seconds=1.25,
+                metadata={"arguments": '{"command":"whoami"}'},
+            ),
+        ],
+    )
+
+    calls = _tool_calls_for_storage(result)
+
+    assert calls is not None
+    assert len(calls) == 2
+
+    knowledge_call = calls[0]
+    assert knowledge_call["tool"] == "knowledge_search"
+    assert isinstance(knowledge_call["arguments"], str)
+    assert json.loads(knowledge_call["arguments"]) == {
+        "query": "financial independence",
+        "limit": 3,
+    }
+    assert knowledge_call["result"] == "Found the requested note"
+    assert knowledge_call["success"] is True
+    assert knowledge_call["latency"] == pytest.approx(420.0)
+
+    failed_call = calls[1]
+    assert failed_call["arguments"] == '{"command":"whoami"}'
+    assert failed_call["result"] == "Permission denied"
+    assert failed_call["success"] is False
+    assert failed_call["latency"] == pytest.approx(1250.0)
+
+
+def test_no_tool_results_serialize_as_none() -> None:
+    assert _tool_calls_for_storage(AgentResult(content="Plain response")) is None
+
+
+def test_finalize_tick_persists_tool_calls_round_trip(tmp_path) -> None:
+    manager = AgentManager(str(tmp_path / "agents.db"))
+    try:
+        agent = manager.create_agent("researcher")
+        manager.start_tick(agent["id"])
+        result = AgentResult(
+            content="Answer grounded in the knowledge base",
+            tool_results=[
+                ToolResult(
+                    tool_name="knowledge_search",
+                    content="Matching source text",
+                    success=True,
+                    latency_seconds=0.007,
+                    metadata={"arguments": {"query": "grounded answer"}},
+                )
+            ],
+        )
+
+        executor = AgentExecutor(manager, EventBus())
+        executor._finalize_tick(
+            agent["id"],
+            result,
+            error=None,
+            duration=0.01,
+        )
+
+        messages = manager.list_messages(agent["id"])
+        assert len(messages) == 1
+        stored = messages[0]
+        assert stored["content"] == result.content
+        assert stored["direction"] == "agent_to_user"
+        assert stored["tool_calls"] == _tool_calls_for_storage(result)
+        assert isinstance(stored["tool_calls"][0]["arguments"], str)
+        assert json.loads(stored["tool_calls"][0]["arguments"]) == {
+            "query": "grounded answer"
+        }
+        assert stored["tool_calls"][0]["latency"] == pytest.approx(7.0)
+    finally:
+        manager.close()
+
+
+def test_finalize_tick_without_tools_stores_null_tool_calls(tmp_path) -> None:
+    manager = AgentManager(str(tmp_path / "agents.db"))
+    try:
+        agent = manager.create_agent("plain-agent")
+        manager.start_tick(agent["id"])
+
+        executor = AgentExecutor(manager, EventBus())
+        executor._finalize_tick(
+            agent["id"],
+            AgentResult(content="No tools needed"),
+            error=None,
+            duration=0.01,
+        )
+
+        stored = manager.list_messages(agent["id"])[0]
+        assert stored["tool_calls"] is None
+    finally:
+        manager.close()

tests/agents/test_executor_tools.py

@@ -2,13 +2,91 @@
 
 from __future__ import annotations
 
+import gc
+import sqlite3
+from types import SimpleNamespace
+from unittest.mock import MagicMock
+
+import pytest
+
+from openjarvis.agents._stubs import AgentResult
 from openjarvis.agents.executor import AgentExecutor
 from openjarvis.agents.manager import AgentManager
+from openjarvis.agents.tool_resolver import ResolvedAgentTools
+from openjarvis.connectors.store import KnowledgeStore
+from openjarvis.core.config import MemoryFilesConfig, SystemPromptConfig
 from openjarvis.core.events import EventBus
+from openjarvis.core.registry import AgentRegistry, ToolRegistry
+from openjarvis.core.types import Role, ToolResult
+from openjarvis.tools._stubs import BaseTool, ToolSpec
 from tests.agents.fake_engine import FakeEngine
 from tests.agents.scenario_harness import FakeSystem
 
 
+class _CapturingToolAgent:
+    """Minimal agent that exposes the toolkit received by AgentExecutor."""
+
+    accepts_tools = True
+    captured_tools = []
+    captured_search_result = None
+
+    def __init__(self, engine, model, *, tools=None, **kwargs):
+        self.engine = engine
+        self.model = model
+        type(self).captured_tools = list(tools or [])
+
+    def run(self, input_text, context=None):
+        tools_by_name = {tool.spec.name: tool for tool in self.captured_tools}
+        search = tools_by_name.get("knowledge_search")
+        if search is not None:
+            type(self).captured_search_result = search.execute(
+                query="EXECUTOR_RESOLVER_SENTINEL"
+            )
+        return AgentResult(content="captured")
+
+
+class _NonToolAgent:
+    """Agent class whose run method must not swallow a configured toolkit."""
+
+    accepts_tools = False
+    supports_managed_tool_fallback = True
+    runs = 0
+
+    def __init__(self, engine, model, **kwargs):
+        pass
+
+    def run(self, input_text, context=None):
+        type(self).runs += 1
+        raise AssertionError("non-tool agent should use the managed tool loop")
+
+
+class _SpecializedNonToolAgent:
+    """Non-tool agent that must retain its specialized execution path."""
+
+    accepts_tools = False
+    runs = 0
+
+    def __init__(self, engine, model, **kwargs):
+        pass
+
+    def run(self, input_text, context=None):
+        type(self).runs += 1
+        return AgentResult(content="specialized response")
+
+
+class _ExecutorProbeTool(BaseTool):
+    tool_id = "executor_probe"
+    calls = 0
+
+    @property
+    def spec(self) -> ToolSpec:
+        return ToolSpec(name=self.tool_id, description="Executor parity probe")
+
+    def execute(self, **params) -> ToolResult:
+        type(self).calls += 1
+        return ToolResult(tool_name=self.tool_id, content="probe-result")
+
+
 def _register_agent():
     """Re-register MonitorOperativeAgent (cleared by autouse fixture)."""
     from openjarvis.agents.monitor_operative import MonitorOperativeAgent
@@ -102,3 +180,396 @@ def test_executor_handles_string_tools(tmp_path):
     result_agent = mgr.get_agent(agent["id"])
     assert result_agent["status"] == "idle"
     mgr.close()
+
+
+def test_executor_uses_tool_loop_for_non_tool_agent_with_configured_tools(tmp_path):
+    """Immediate/scheduled ticks match SSE instead of discarding tools."""
+
+    AgentRegistry.register_value("non_tool_probe", _NonToolAgent)
+    ToolRegistry.register_value(_ExecutorProbeTool.tool_id, _ExecutorProbeTool)
+    _NonToolAgent.runs = 0
+    _ExecutorProbeTool.calls = 0
+
+    engine = FakeEngine(
+        [
+            {
+                "tool_calls": [
+                    {
+                        "id": "call-executor-probe",
+                        "name": _ExecutorProbeTool.tool_id,
+                        "arguments": "{}",
+                    }
+                ]
+            },
+            {"content": "tool-backed final response"},
+        ]
+    )
+    system = FakeSystem(engine=engine)
+    system.config = SimpleNamespace(
+        agent=SimpleNamespace(default_system_prompt="GLOBAL_DEFAULT"),
+        memory_files=MemoryFilesConfig(persona_name="none"),
+        system_prompt=SystemPromptConfig(),
+    )
+    manager = AgentManager(db_path=str(tmp_path / "agents.db"))
+    agent = manager.create_agent(
+        "non-tool with tools",
+        agent_type="non_tool_probe",
+        config={
+            "model": "test-model",
+            "tools": [_ExecutorProbeTool.tool_id],
+            "instruction": "Use the probe.",
+            "system_prompt": "NON_TOOL_SYSTEM_SENTINEL",
+        },
+    )
+
+    try:
+        AgentExecutor(manager, EventBus(), system=system).execute_tick(agent["id"])
+
+        assert _NonToolAgent.runs == 0
+        assert _ExecutorProbeTool.calls == 1
+        assert engine.call_count == 2
+        assert any(
+            message.role is Role.SYSTEM
+            and message.content == "NON_TOOL_SYSTEM_SENTINEL"
+            for message in engine.last_messages or []
+        )
+        refreshed = manager.get_agent(agent["id"])
+        assert refreshed["status"] == "idle"
+        assert refreshed["total_runs"] == 1
+        responses = [
+            message
+            for message in manager.list_messages(agent["id"])
+            if message["direction"] == "agent_to_user"
+        ]
+        assert responses[-1]["content"] == "tool-backed final response"
+        assert responses[-1]["tool_calls"][0]["tool"] == "executor_probe"
+    finally:
+        manager.close()
+
+
+def test_simple_agent_uses_global_mcp_tools_without_native_tool_config(tmp_path):
+    """Fallback-compatible simple agents preserve SSE/global-MCP parity."""
+
+    from openjarvis.agents.simple import SimpleAgent
+
+    AgentRegistry.register_value("simple", SimpleAgent)
+    _ExecutorProbeTool.calls = 0
+    provider = MagicMock(return_value=([_ExecutorProbeTool()], []))
+    engine = FakeEngine(
+        [
+            {
+                "tool_calls": [
+                    {
+                        "id": "call-global-mcp-probe",
+                        "name": _ExecutorProbeTool.tool_id,
+                        "arguments": "{}",
+                    }
+                ]
+            },
+            {"content": "global MCP response"},
+        ]
+    )
+    system = SimpleNamespace(
+        engine=engine,
+        model="test-model",
+        config=None,
+        memory_backend=None,
+        channel_backend=None,
+        session_store=None,
+        knowledge_db_path=None,
+        get_managed_agent_mcp_tools=provider,
+    )
+    manager = AgentManager(db_path=str(tmp_path / "agents.db"))
+    agent = manager.create_agent(
+        "simple global MCP",
+        agent_type="simple",
+        config={"model": "test-model", "instruction": "Use MCP."},
+    )
+
+    try:
+        AgentExecutor(manager, EventBus(), system=system).execute_tick(agent["id"])
+
+        provider.assert_called_once_with()
+        assert _ExecutorProbeTool.calls == 1
+        assert engine.call_count == 2
+        responses = [
+            message
+            for message in manager.list_messages(agent["id"])
+            if message["direction"] == "agent_to_user"
+        ]
+        assert responses[-1]["content"] == "global MCP response"
+    finally:
+        manager.close()
+
+
+def test_simple_agent_without_tools_keeps_its_custom_system_prompt(tmp_path):
+    """Signature filtering must not discard prompt-builder state on retry."""
+
+    from openjarvis.agents.simple import SimpleAgent
+
+    AgentRegistry.register_value("simple", SimpleAgent)
+    engine = FakeEngine([{"content": "custom prompt response"}])
+    system = FakeSystem(engine=engine)
+    system.config = SimpleNamespace(
+        agent=SimpleNamespace(default_system_prompt="GLOBAL_DEFAULT"),
+        memory_files=MemoryFilesConfig(persona_name="none"),
+        system_prompt=SystemPromptConfig(),
+    )
+    manager = AgentManager(db_path=str(tmp_path / "agents.db"))
+    agent = manager.create_agent(
+        "simple custom prompt",
+        agent_type="simple",
+        config={
+            "model": "test-model",
+            "instruction": "Answer directly.",
+            "system_prompt": "SIMPLE_CUSTOM_SYSTEM_SENTINEL",
+            "mcp_tools": False,
+        },
+    )
+
+    try:
+        AgentExecutor(manager, EventBus(), system=system).execute_tick(agent["id"])
+
+        assert engine.call_count == 1
+        assert any(
+            message.role is Role.SYSTEM
+            and message.content == "SIMPLE_CUSTOM_SYSTEM_SENTINEL"
+            for message in engine.last_messages or []
+        )
+    finally:
+        manager.close()
+
+
+def test_specialized_non_tool_agent_is_not_replaced_by_generic_tool_loop(tmp_path):
+    """Configured/global tools never replace a non-opted-in agent class."""
+
+    AgentRegistry.register_value("specialized_non_tool", _SpecializedNonToolAgent)
+    ToolRegistry.register_value(_ExecutorProbeTool.tool_id, _ExecutorProbeTool)
+    _SpecializedNonToolAgent.runs = 0
+    _ExecutorProbeTool.calls = 0
+    provider = MagicMock(return_value=([_ExecutorProbeTool()], []))
+    system = SimpleNamespace(
+        engine=FakeEngine([{"content": "unused"}]),
+        model="test-model",
+        config=None,
+        memory_backend=None,
+        channel_backend=None,
+        session_store=None,
+        knowledge_db_path=None,
+        get_managed_agent_mcp_tools=provider,
+    )
+    manager = AgentManager(db_path=str(tmp_path / "agents.db"))
+    agent = manager.create_agent(
+        "specialized with configured tool",
+        agent_type="specialized_non_tool",
+        config={
+            "model": "test-model",
+            "instruction": "Keep the specialized path.",
+            "tools": [_ExecutorProbeTool.tool_id],
+        },
+    )
+
+    try:
+        AgentExecutor(manager, EventBus(), system=system).execute_tick(agent["id"])
+
+        provider.assert_not_called()
+        assert _SpecializedNonToolAgent.runs == 1
+        assert _ExecutorProbeTool.calls == 0
+        responses = [
+            message
+            for message in manager.list_messages(agent["id"])
+            if message["direction"] == "agent_to_user"
+        ]
+        assert responses[-1]["content"] == "specialized response"
+    finally:
+        manager.close()
+
+
+def test_executor_grants_deep_research_live_knowledge_tools(tmp_path):
+    """Immediate ticks receive the same live Deep Research grant as SSE."""
+
+    AgentRegistry.register_value("deep_research", _CapturingToolAgent)
+    _CapturingToolAgent.captured_tools = []
+    _CapturingToolAgent.captured_search_result = None
+
+    knowledge_db_path = tmp_path / "knowledge.db"
+    with KnowledgeStore(db_path=knowledge_db_path) as store:
+        store.store(
+            "The EXECUTOR_RESOLVER_SENTINEL decision was approved.",
+            source="test",
+            doc_type="note",
+        )
+
+    manager = AgentManager(db_path=str(tmp_path / "agents.db"))
+    agent = manager.create_agent(
+        "researcher",
+        agent_type="deep_research",
+        config={
+            "model": "agent-selected-model",
+            # These duplicate two agent-type grants and must not replace them.
+            "tools": ["knowledge_search", "think"],
+            "instruction": "Find the sentinel.",
+        },
+    )
+    manager.send_message(agent["id"], "Search the knowledge base.", mode="immediate")
+
+    system = SimpleNamespace(
+        engine=FakeEngine([{"content": "unused"}]),
+        model="system-model",
+        memory_backend=None,
+        channel_backend=None,
+        tool_executor=None,
+        _mcp_clients=[],
+        knowledge_db_path=knowledge_db_path,
+        config=None,
+        session_store=None,
+    )
+    executor = AgentExecutor(manager=manager, event_bus=EventBus(), system=system)
+
+    try:
+        executor.execute_tick(agent["id"])
+
+        tools_by_name = {
+            tool.spec.name: tool for tool in _CapturingToolAgent.captured_tools
+        }
+        assert set(tools_by_name) == {
+            "knowledge_search",
+            "knowledge_sql",
+            "scan_chunks",
+            "think",
+        }
+        result = _CapturingToolAgent.captured_search_result
+        assert result is not None
+        assert result.success is True
+        assert "EXECUTOR_RESOLVER_SENTINEL" in result.content
+        assert tools_by_name["scan_chunks"]._model == "agent-selected-model"
+        assert manager.get_agent(agent["id"])["status"] == "idle"
+        with pytest.raises(sqlite3.ProgrammingError):
+            tools_by_name["knowledge_sql"]._store._conn.execute("SELECT 1")
+    finally:
+        manager.close()
+
+
+def test_executor_mcp_opt_out_does_not_call_lazy_provider(tmp_path):
+    """An opted-out tick must not trigger request-local MCP discovery."""
+
+    AgentRegistry.register_value("capturing", _CapturingToolAgent)
+    provider = MagicMock(side_effect=AssertionError("MCP discovery must stay lazy"))
+    system = SimpleNamespace(
+        engine=FakeEngine([{"content": "unused"}]),
+        model="system-model",
+        memory_backend=None,
+        channel_backend=None,
+        tool_executor=None,
+        _mcp_clients=[],
+        config=None,
+        session_store=None,
+        get_managed_agent_mcp_tools=provider,
+    )
+    manager = AgentManager(db_path=str(tmp_path / "agents.db"))
+    agent = manager.create_agent(
+        "no-mcp",
+        agent_type="capturing",
+        config={"model": "test-model", "mcp_tools": False},
+    )
+
+    try:
+        AgentExecutor(manager, EventBus(), system=system).execute_tick(agent["id"])
+        provider.assert_not_called()
+        assert manager.get_agent(agent["id"])["status"] == "idle"
+    finally:
+        manager.close()
+
+
+def test_executor_preserves_custom_dict_tool_schema(tmp_path):
+    """Executor-based agents see the same custom schema advertised by SSE."""
+
+    from openjarvis.tools.think import ThinkTool
+
+    AgentRegistry.register_value("capturing", _CapturingToolAgent)
+    ToolRegistry.register_value("think", ThinkTool)
+    _CapturingToolAgent.captured_tools = []
+    custom_spec = {
+        "type": "function",
+        "function": {
+            "name": "think",
+            "description": "Agent-specific thinking schema",
+            "parameters": {
+                "type": "object",
+                "properties": {"thought": {"type": "string"}},
+                "required": ["thought"],
+            },
+        },
+    }
+    system = SimpleNamespace(
+        engine=FakeEngine([{"content": "unused"}]),
+        model="test-model",
+        memory_backend=None,
+        channel_backend=None,
+        tool_executor=None,
+        mcp_tools=[],
+        _mcp_clients=[],
+        config=None,
+        session_store=None,
+    )
+    manager = AgentManager(db_path=str(tmp_path / "agents.db"))
+    agent = manager.create_agent(
+        "custom-schema",
+        agent_type="capturing",
+        config={"model": "test-model", "tools": [custom_spec]},
+    )
+
+    try:
+        AgentExecutor(manager, EventBus(), system=system).execute_tick(agent["id"])
+        assert len(_CapturingToolAgent.captured_tools) == 1
+        configured_tool = _CapturingToolAgent.captured_tools[0]
+        assert configured_tool.to_openai_function() == custom_spec
+        assert configured_tool.spec.description == "Agent-specific thinking schema"
+        assert configured_tool.execute(thought="same instance").success is True
+    finally:
+        manager.close()
+
+
+def test_executor_closes_resolver_resources_when_pre_run_setup_fails(
+    tmp_path,
+    monkeypatch,
+):
+    """The resolver finalizer covers failures before agent.run is reached."""
+
+    AgentRegistry.register_value("capturing", _CapturingToolAgent)
+    resource = MagicMock()
+
+    def _resolve(*args, **kwargs):
+        return ResolvedAgentTools(owned_resources=[resource])
+
+    monkeypatch.setattr("openjarvis.agents.executor.resolve_agent_tools", _resolve)
+    system = SimpleNamespace(
+        engine=FakeEngine([{"content": "unused"}]),
+        model="test-model",
+        memory_backend=None,
+        channel_backend=None,
+        tool_executor=None,
+        mcp_tools=[],
+        _mcp_clients=[],
+        config=None,
+        session_store=None,
+    )
+    manager = AgentManager(db_path=str(tmp_path / "agents.db"))
+    agent = manager.create_agent(
+        "cleanup",
+        agent_type="capturing",
+        config={"model": "test-model"},
+    )
+    monkeypatch.setattr(
+        manager,
+        "get_pending_messages",
+        MagicMock(side_effect=RuntimeError("pre-run setup failed")),
+    )
+
+    try:
+        with pytest.raises(RuntimeError, match="pre-run setup failed"):
+            AgentExecutor(manager, EventBus(), system=system)._invoke_agent(agent)
+        gc.collect()
+        resource.close.assert_called_once_with()
+    finally:
+        manager.close()

tests/agents/test_proactive_agent.py

@@ -0,0 +1,131 @@
+"""Regression tests for proactive scheduling and notification setup."""
+
+from __future__ import annotations
+
+from unittest.mock import MagicMock, patch
+
+import pytest
+
+from openjarvis.agents.proactive_agent import (
+    _PROACTIVE_CRON_PROMPT,
+    _build_notification_channel,
+    register_cron,
+)
+from openjarvis.core.registry import ChannelRegistry
+from openjarvis.scheduler.scheduler import TaskScheduler
+from openjarvis.scheduler.store import SchedulerStore
+
+
+@pytest.fixture()
+def scheduler(tmp_path):
+    store = SchedulerStore(tmp_path / "scheduler.db")
+    scheduler = TaskScheduler(store)
+    yield scheduler
+    scheduler.stop()
+    store.close()
+
+
+def _register(scheduler, *, schedule="0 5 * * *", channel="telegram:123"):
+    return register_cron(
+        scheduler,
+        notification_channel_id=channel,
+        cron_expr=schedule,
+        hours_back=24,
+        timezone="UTC",
+    )
+
+
+class TestRegisterCron:
+    def test_reuses_exact_task_and_cancels_duplicates(self, scheduler):
+        first = _register(scheduler)
+        duplicate = scheduler.create_task(
+            _PROACTIVE_CRON_PROMPT,
+            "cron",
+            "0 5 * * *",
+            agent="proactive",
+            metadata=first.metadata,
+        )
+
+        returned = _register(scheduler)
+
+        assert returned.id in {first.id, duplicate.id}
+        assert [task.id for task in scheduler.list_tasks(status="active")] == [
+            returned.id
+        ]
+        cancelled_id = scheduler.list_tasks(status="cancelled")[0].id
+        assert cancelled_id == ({first.id, duplicate.id} - {returned.id}).pop()
+
+    def test_replaces_task_when_configuration_changes(self, scheduler):
+        old = _register(scheduler, schedule="0 5 * * *", channel="telegram:old")
+
+        new = _register(scheduler, schedule="0 7 * * *", channel="telegram:new")
+
+        assert new.id != old.id
+        assert new.schedule_value == "0 7 * * *"
+        assert new.metadata["notification_channel_id"] == "telegram:new"
+        assert scheduler.list_tasks(status="cancelled")[0].id == old.id
+
+    def test_preserves_pause_across_restart(self, scheduler):
+        paused = _register(scheduler)
+        scheduler.pause_task(paused.id)
+
+        returned = _register(scheduler, schedule="0 7 * * *")
+
+        assert returned.id == paused.id
+        assert returned.status == "paused"
+        assert scheduler.list_tasks(status="active") == []
+
+    def test_migrates_legacy_tasks_without_stable_key(self, scheduler):
+        legacy = scheduler.create_task(
+            _PROACTIVE_CRON_PROMPT,
+            "cron",
+            "0 5 * * *",
+            agent="proactive",
+            metadata={
+                "notification_channel_id": "telegram:123",
+                "hours_back": 24,
+                "timezone": "UTC",
+            },
+        )
+
+        current = _register(scheduler)
+
+        assert current.id != legacy.id
+        assert current.metadata["openjarvis_task_key"] == "proactive-daily"
+        assert scheduler.list_tasks(status="cancelled")[0].id == legacy.id
+
+
+class TestNotificationChannel:
+    def test_telegram_is_configured_without_starting_polling(self):
+        class FakeTelegram:
+            def __init__(self, **kwargs):
+                self.kwargs = kwargs
+                self.connect = MagicMock()
+
+        config = MagicMock()
+        with (
+            patch.object(ChannelRegistry, "contains", return_value=True),
+            patch.object(ChannelRegistry, "get", return_value=FakeTelegram),
+            patch("openjarvis.core.config.load_config", return_value=config),
+            patch(
+                "openjarvis.system._channel_kwargs.build_channel_kwargs",
+                return_value={"bot_token": "configured-token"},
+            ),
+        ):
+            channel = _build_notification_channel("telegram:123")
+
+        assert channel.kwargs == {"bot_token": "configured-token"}
+        channel.connect.assert_not_called()
+
+    def test_non_telegram_channel_keeps_connect_lifecycle(self):
+        class FakeChannel:
+            def __init__(self, **kwargs):
+                self.connect = MagicMock()
+
+        with (
+            patch.object(ChannelRegistry, "contains", return_value=True),
+            patch.object(ChannelRegistry, "get", return_value=FakeChannel),
+        ):
+            channel = _build_notification_channel("twilio:15551234567")
+
+        channel.connect.assert_called_once_with()

tests/agents/test_scheduler.py

@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 import tempfile
+import threading
 import time
 from pathlib import Path
 from unittest.mock import MagicMock
@@ -117,6 +118,48 @@ class TestSchedulerBasic:
         assert executor.execute_tick.call_count >= 1
         executor.execute_tick.assert_called_with(agent["id"])
 
+    def test_two_phase_stop_retains_and_drains_active_worker(self, manager):
+        """Shutdown quiesces later ticks and can wait again after cancellation."""
+
+        from openjarvis.agents.scheduler import AgentScheduler
+
+        started = threading.Event()
+        release = threading.Event()
+        calls: list[str] = []
+
+        class _BlockingExecutor:
+            def execute_tick(self, agent_id):
+                calls.append(agent_id)
+                started.set()
+                release.wait(timeout=2)
+
+        scheduler = AgentScheduler(
+            manager=manager,
+            executor=_BlockingExecutor(),
+            tick_interval=0.01,
+        )
+        agents = [
+            manager.create_agent(
+                name=f"test-{index}",
+                agent_type="monitor_operative",
+                config={"schedule_type": "interval", "schedule_value": 0},
+            )
+            for index in range(2)
+        ]
+        for agent in agents:
+            scheduler.register_agent(agent["id"])
+
+        scheduler.start()
+        assert started.wait(timeout=1)
+        scheduler.request_stop()
+        assert scheduler.wait_stopped(timeout=0.01) is False
+        assert scheduler._thread is not None
+
+        release.set()
+        assert scheduler.wait_stopped(timeout=1) is True
+        assert scheduler._thread is None
+        assert calls == [agents[0]["id"]]
+
     def test_skips_paused_agents(self, manager):
         from openjarvis.agents.scheduler import AgentScheduler
 

tests/agents/test_tool_resolver.py

@@ -0,0 +1,284 @@
+"""Focused tests for canonical managed-agent tool resolution (#688)."""
+
+from __future__ import annotations
+
+from collections import Counter
+
+import pytest
+
+from openjarvis.agents import tool_resolver
+from openjarvis.connectors.store import KnowledgeStore
+from openjarvis.core.registry import ToolRegistry
+from openjarvis.core.types import ToolResult
+from openjarvis.tools import description_loader
+from openjarvis.tools._stubs import BaseTool, ToolSpec
+
+
+class _AlphaTool(BaseTool):
+    tool_id = "alpha"
+
+    @property
+    def spec(self) -> ToolSpec:
+        return ToolSpec(name="alpha", description="Alpha test tool")
+
+    def execute(self, **params) -> ToolResult:
+        return ToolResult(tool_name="alpha", content="alpha", success=True)
+
+
+class _BetaTool(BaseTool):
+    tool_id = "beta"
+
+    @property
+    def spec(self) -> ToolSpec:
+        return ToolSpec(name="beta", description="Beta test tool")
+
+    def execute(self, **params) -> ToolResult:
+        return ToolResult(tool_name="beta", content="beta", success=True)
+
+
+class _NativeSharedTool(BaseTool):
+    tool_id = "shared"
+
+    @property
+    def spec(self) -> ToolSpec:
+        return ToolSpec(name="shared", description="Native shared tool")
+
+    def execute(self, **params) -> ToolResult:
+        return ToolResult(tool_name="shared", content="native", success=True)
+
+
+class _MCPSharedTool(BaseTool):
+    tool_id = "shared"
+
+    @property
+    def spec(self) -> ToolSpec:
+        return ToolSpec(name="shared", description="MCP name collision")
+
+    def execute(self, **params) -> ToolResult:
+        return ToolResult(tool_name="shared", content="mcp", success=True)
+
+
+class _MCPOnlyTool(BaseTool):
+    tool_id = "mcp_only"
+
+    @property
+    def spec(self) -> ToolSpec:
+        return ToolSpec(name="mcp_only", description="MCP-only test tool")
+
+    def execute(self, **params) -> ToolResult:
+        return ToolResult(tool_name="mcp_only", content="mcp-only", success=True)
+
+
+@pytest.fixture(autouse=True)
+def _use_explicit_test_registrations(monkeypatch: pytest.MonkeyPatch) -> None:
+    """Keep these unit tests independent of import-time registry population."""
+
+    monkeypatch.setattr(tool_resolver, "ensure_registries_populated", lambda: None)
+
+
+def test_deep_research_grants_are_live_deduplicated_and_use_selected_model(
+    tmp_path,
+) -> None:
+    """Agent-type grants must beat duplicate bare configured tools."""
+
+    db_path = tmp_path / "knowledge.db"
+    with KnowledgeStore(db_path=db_path) as store:
+        store.store(
+            "The RESOLVER_SENTINEL decision was approved.",
+            source="test",
+            doc_type="note",
+        )
+
+    engine = object()
+    resolved = tool_resolver.resolve_agent_tools(
+        {
+            "agent_type": "deep_research",
+            "config": {
+                # Both names are already supplied by the agent-type grant.
+                "tools": ["knowledge_search", "think", "think"],
+            },
+        },
+        engine=engine,
+        model="agent-selected-model",
+        knowledge_db_path=db_path,
+    )
+
+    try:
+        names = [tool.spec.name for tool in resolved.instances]
+        assert set(names) == {
+            "knowledge_search",
+            "knowledge_sql",
+            "scan_chunks",
+            "think",
+        }
+        assert all(count == 1 for count in Counter(names).values())
+
+        search = resolved.by_name["knowledge_search"]
+        result = search.execute(query="RESOLVER_SENTINEL")
+        assert result.success is True
+        assert "RESOLVER_SENTINEL" in result.content
+
+        scan = resolved.by_name["scan_chunks"]
+        assert scan._engine is engine
+        assert scan._model == "agent-selected-model"
+    finally:
+        # All three knowledge tools share this store connection.
+        resolved.by_name["knowledge_sql"]._store.close()
+
+
+@pytest.mark.parametrize(
+    "tool_config",
+    [
+        ["alpha", "beta", "alpha"],
+        " alpha, beta, alpha ",
+    ],
+)
+def test_configured_tools_normalize_lists_and_comma_separated_strings(
+    tool_config,
+) -> None:
+    ToolRegistry.register_value("alpha", _AlphaTool)
+    ToolRegistry.register_value("beta", _BetaTool)
+
+    resolved = tool_resolver.resolve_agent_tools(
+        {"agent_type": "simple", "config": {"tools": tool_config}},
+        engine=object(),
+        model="test-model",
+    )
+
+    assert [tool.spec.name for tool in resolved.instances] == ["alpha", "beta"]
+    assert [spec["function"]["name"] for spec in resolved.openai_specs] == [
+        "alpha",
+        "beta",
+    ]
+
+
+def test_registered_tool_advertisement_matches_to_openai_function(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    """Runtime description overrides must reach canonical advertisements."""
+
+    ToolRegistry.register_value("alpha", _AlphaTool)
+    monkeypatch.setattr(
+        description_loader,
+        "get_tool_description_override",
+        lambda name: "Runtime alpha description" if name == "alpha" else None,
+    )
+
+    resolved = tool_resolver.resolve_agent_tools(
+        {"agent_type": "simple", "config": {"tools": ["alpha"]}},
+        engine=object(),
+        model="test-model",
+    )
+
+    tool = resolved.by_name["alpha"]
+    assert resolved.openai_specs == [tool.to_openai_function()]
+    assert (
+        resolved.openai_specs[0]["function"]["description"]
+        == "Runtime alpha description"
+    )
+
+
+def test_explicit_config_schema_takes_priority_over_tool_advertisement(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    ToolRegistry.register_value("alpha", _AlphaTool)
+    monkeypatch.setattr(
+        description_loader,
+        "get_tool_description_override",
+        lambda name: "Runtime alpha description" if name == "alpha" else None,
+    )
+    custom_spec = {
+        "type": "function",
+        "function": {
+            "name": "alpha",
+            "description": "Agent-specific alpha description",
+            "parameters": {
+                "type": "object",
+                "properties": {"query": {"type": "string"}},
+                "required": ["query"],
+            },
+        },
+    }
+
+    resolved = tool_resolver.resolve_agent_tools(
+        {"agent_type": "simple", "config": {"tools": [custom_spec]}},
+        engine=object(),
+        model="test-model",
+    )
+
+    assert resolved.openai_specs == [custom_spec]
+    assert resolved.by_name["alpha"].to_openai_function() == custom_spec
+
+
+def test_invalid_tool_advertisement_falls_back_to_tool_spec() -> None:
+    class _InvalidAdvertisementTool(_AlphaTool):
+        def to_openai_function(self) -> dict[str, object]:
+            raise RuntimeError("broken advertisement")
+
+    ToolRegistry.register_value("alpha", _InvalidAdvertisementTool)
+
+    resolved = tool_resolver.resolve_agent_tools(
+        {"agent_type": "simple", "config": {"tools": ["alpha"]}},
+        engine=object(),
+        model="test-model",
+    )
+
+    assert resolved.openai_specs == [
+        {
+            "type": "function",
+            "function": {
+                "name": "alpha",
+                "description": "Alpha test tool",
+                "parameters": {},
+            },
+        }
+    ]
+
+
+def test_mcp_tools_merge_after_native_tools_without_name_collisions() -> None:
+    ToolRegistry.register_value("shared", _NativeSharedTool)
+    mcp_shared = _MCPSharedTool()
+    mcp_only = _MCPOnlyTool()
+    client = object()
+
+    resolved = tool_resolver.resolve_agent_tools(
+        {
+            "agent_type": "simple",
+            "config": {"tools": ["shared", "shared"]},
+        },
+        engine=object(),
+        model="test-model",
+        mcp_tools=[mcp_shared, mcp_only, mcp_only],
+        mcp_clients=[client],
+    )
+
+    assert [tool.spec.name for tool in resolved.instances] == ["shared", "mcp_only"]
+    assert isinstance(resolved.by_name["shared"], _NativeSharedTool)
+    assert resolved.by_name["mcp_only"] is mcp_only
+    assert resolved.mcp_clients == [client]
+    assert [spec["function"]["name"] for spec in resolved.openai_specs] == [
+        "shared",
+        "mcp_only",
+    ]
+
+
+def test_mcp_tools_can_be_disabled_per_agent() -> None:
+    ToolRegistry.register_value("shared", _NativeSharedTool)
+
+    class _MustNotIterate:
+        def __iter__(self):
+            raise AssertionError("MCP tools must not be inspected after opt-out")
+
+    resolved = tool_resolver.resolve_agent_tools(
+        {
+            "agent_type": "simple",
+            "config": {"tools": ["shared"], "mcp_tools": False},
+        },
+        engine=object(),
+        model="test-model",
+        mcp_tools=_MustNotIterate(),
+        mcp_clients=_MustNotIterate(),
+    )
+
+    assert [tool.spec.name for tool in resolved.instances] == ["shared"]
+    assert resolved.mcp_clients == []

tests/cli/test_daemon_cmd.py

@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+import subprocess
 from pathlib import Path
 from unittest.mock import MagicMock, patch
 
@@ -79,3 +80,80 @@ class TestDaemonCommands:
             result = CliRunner().invoke(cli, ["start"])
         assert result.exit_code != 0
         assert "already running" in result.output
+
+
+class TestDaemonDetachment:
+    """The spawned server must outlive the console that started it.
+
+    ``start_new_session`` is POSIX-only — CPython's Windows ``_execute_child``
+    names the parameter ``unused_start_new_session``. Relying on it there leaves
+    the server sharing its parent's console, so closing that console (or logging
+    off) delivers CTRL_CLOSE_EVENT and kills the daemon.
+    """
+
+    @staticmethod
+    def _spawn_kwargs(platform: str) -> dict:
+        """Return the kwargs ``start`` passes to Popen when spawning the server.
+
+        ``load_config`` is stubbed because it shells out for GPU detection —
+        patching Popen wholesale would otherwise break config loading before
+        the spawn is reached.
+        """
+        with (
+            patch("openjarvis.cli.daemon_cmd._read_pid", return_value=None),
+            patch("openjarvis.cli.daemon_cmd._write_pid"),
+            patch("openjarvis.cli.daemon_cmd.load_config"),
+            patch("openjarvis.cli.daemon_cmd.sys.platform", platform),
+            patch("openjarvis.cli.daemon_cmd.subprocess.Popen") as popen,
+            patch("builtins.open", MagicMock()),
+        ):
+            popen.return_value = MagicMock(pid=4321)
+            result = CliRunner().invoke(cli, ["start"])
+            assert result.exit_code == 0, result.output
+            spawns = [
+                c for c in popen.call_args_list if c.args and "serve" in c.args[0]
+            ]
+            assert spawns, f"start did not spawn the server: {popen.call_args_list}"
+            return spawns[-1].kwargs
+
+    def test_windows_spawn_is_detached_from_the_console(self) -> None:
+        # These constants are only exported by ``subprocess`` on Windows.
+        # Supply their documented values so the simulated Windows branch is
+        # still exercised by the POSIX test job.
+        detached_process = getattr(subprocess, "DETACHED_PROCESS", 0x00000008)
+        create_new_process_group = getattr(
+            subprocess, "CREATE_NEW_PROCESS_GROUP", 0x00000200
+        )
+        with (
+            patch.object(
+                subprocess,
+                "DETACHED_PROCESS",
+                detached_process,
+                create=True,
+            ),
+            patch.object(
+                subprocess,
+                "CREATE_NEW_PROCESS_GROUP",
+                create_new_process_group,
+                create=True,
+            ),
+        ):
+            kwargs = self._spawn_kwargs("win32")
+
+        flags = kwargs.get("creationflags", 0)
+        assert flags & detached_process, (
+            "server must be spawned with DETACHED_PROCESS on Windows, otherwise "
+            "closing the launching console kills it"
+        )
+        assert flags & create_new_process_group, (
+            "server must be in its own process group so Ctrl-C in the parent "
+            "console does not propagate to it"
+        )
+        assert not kwargs.get("start_new_session"), (
+            "start_new_session is ignored on Windows; it must not be relied on"
+        )
+
+    def test_posix_spawn_still_uses_start_new_session(self) -> None:
+        kwargs = self._spawn_kwargs("linux")
+        assert kwargs.get("start_new_session") is True
+        assert "creationflags" not in kwargs or kwargs["creationflags"] == 0

tests/cli/test_serve_single_build.py

@@ -101,6 +101,7 @@ def _run_serve(tmp_path, monkeypatch, *, build_spy, set_system_spy):
     (``uvicorn.run`` is a no-op) and no real engine is contacted.
     """
     from openjarvis.core.config import JarvisConfig
+    from openjarvis.core.registry import MemoryRegistry
 
     _repopulate_registries()
 
@@ -112,6 +113,9 @@ def _run_serve(tmp_path, monkeypatch, *, build_spy, set_system_spy):
     config.sessions.enabled = True
     config.sessions.db_path = str(tmp_path / "sessions.db")
     config.memory.db_path = str(tmp_path / "memory.db")
+    # Disabling prompt-context injection must not disable the backend needed
+    # by explicitly configured memory tools in managed-agent ticks.
+    config.agent.context_from_memory = False
     config.telemetry.enabled = False
     config.traces.enabled = False
     config.channel.enabled = False
@@ -122,6 +126,16 @@ def _run_serve(tmp_path, monkeypatch, *, build_spy, set_system_spy):
     config.intelligence.default_model = "test-model"
 
     engine = _fake_engine()
+    # Keep this wiring test independent of the optional native memory runtime.
+    # The assertion is that serve resolves and passes a backend even when
+    # prompt-context injection is disabled, not that SQLite itself works.
+    memory_backend = MagicMock(name="memory_backend")
+    monkeypatch.setattr(MemoryRegistry, "contains", MagicMock(return_value=True))
+    monkeypatch.setattr(
+        MemoryRegistry,
+        "create",
+        MagicMock(return_value=memory_backend),
+    )
 
     monkeypatch.setattr(serve_mod, "load_config", lambda *a, **k: config)
     monkeypatch.setattr(serve_mod, "get_engine", lambda *a, **k: ("mock", engine))
@@ -159,6 +173,8 @@ def test_serve_does_not_call_systembuilder_build(tmp_path, monkeypatch):
         )
     )
     set_system_spy = MagicMock()
+    inject_spy = MagicMock()
+    monkeypatch.setattr(serve_mod, "inject_credentials", inject_spy)
 
     result = _run_serve(
         tmp_path,
@@ -169,6 +185,7 @@ def test_serve_does_not_call_systembuilder_build(tmp_path, monkeypatch):
 
     assert result.exit_code == 0, result.output
     build_spy.assert_not_called()
+    inject_spy.assert_called_once_with()
 
 
 def test_executor_receives_required_system_attrs(tmp_path, monkeypatch):

tests/conftest.py

@@ -30,6 +30,19 @@ from openjarvis.core.registry import (
 )
 
 
+@pytest.fixture(autouse=True)
+def _no_update_check(monkeypatch: pytest.MonkeyPatch) -> None:
+    """Never let the CLI's PyPI update-check nag run during tests.
+
+    ``check_for_updates`` writes its banner to stderr, which ``CliRunner``
+    merges into ``result.output`` — polluting JSON/CSV output of any test
+    that invokes a CLI command. It already self-disables when ``CI`` is
+    set, but that only helps in CI; locally (e.g. a dev with a stale
+    version-check cache and network access) it fires for real.
+    """
+    monkeypatch.setenv("OPENJARVIS_NO_UPDATE_CHECK", "1")
+
+
 @pytest.fixture(autouse=True)
 def _clean_registries() -> None:
     """Ensure each test starts with empty registries and a fresh event bus."""

tests/core/test_config_skills_sources.py

@@ -2,7 +2,9 @@
 
 from __future__ import annotations
 
-from openjarvis.core.config import SkillsConfig, SkillSourceConfig
+from pathlib import Path
+
+from openjarvis.core.config import SkillsConfig, SkillSourceConfig, load_config
 
 
 class TestSkillSourceConfig:
@@ -41,3 +43,36 @@ class TestSkillsConfigWithSources:
         )
         assert len(cfg.sources) == 2
         assert cfg.sources[0].source == "hermes"
+
+    def test_loads_source_tables_as_config_objects(
+        self, tmp_path: Path, monkeypatch
+    ) -> None:
+        monkeypatch.setenv("OPENJARVIS_HOME", str(tmp_path / "home"))
+        toml_file = tmp_path / "config.toml"
+        toml_file.write_text(
+            "[[skills.sources]]\n"
+            'source = "hermes"\n'
+            'filter = { category = ["productivity"] }\n\n'
+            "[[skills.sources]]\n"
+            'source = "github"\n'
+            'url = "https://github.com/example/skill-library"\n'
+            "auto_update = true\n"
+        )
+
+        load_config.cache_clear()
+        try:
+            cfg = load_config(toml_file)
+        finally:
+            load_config.cache_clear()
+
+        assert cfg.skills.sources == [
+            SkillSourceConfig(
+                source="hermes",
+                filter={"category": ["productivity"]},
+            ),
+            SkillSourceConfig(
+                source="github",
+                url="https://github.com/example/skill-library",
+                auto_update=True,
+            ),
+        ]

tests/core/test_credentials.py

@@ -5,7 +5,9 @@ import os
 import pytest
 
 from openjarvis.core.credentials import (
+    delete_credential,
     get_credential_status,
+    inject_credentials,
     load_credentials,
     save_credential,
 )
@@ -54,3 +56,26 @@ def test_file_permissions(cred_path):
     save_credential("web_search", "TAVILY_API_KEY", "tvly-x", path=cred_path)
     mode = oct(cred_path.stat().st_mode & 0o777)
     assert mode == "0o600"
+
+
+def test_inject_credentials_restores_saved_value(cred_path, monkeypatch):
+    save_credential("web_search", "TAVILY_API_KEY", "tvly-persisted", path=cred_path)
+    monkeypatch.delenv("TAVILY_API_KEY")
+
+    inject_credentials(path=cred_path)
+
+    assert os.environ["TAVILY_API_KEY"] == "tvly-persisted"
+
+
+def test_delete_credential_removes_file_value_and_env(cred_path, monkeypatch):
+    save_credential("web_search", "TAVILY_API_KEY", "tvly-delete", path=cred_path)
+
+    delete_credential("web_search", "TAVILY_API_KEY", path=cred_path)
+
+    assert load_credentials(path=cred_path) == {}
+    assert "TAVILY_API_KEY" not in os.environ
+
+
+def test_delete_rejects_unknown_key(cred_path):
+    with pytest.raises(ValueError, match="Unknown credential key"):
+        delete_credential("web_search", "BOGUS_KEY", path=cred_path)

tests/deployment/test_packaging.py

@@ -18,6 +18,7 @@ ROOT = Path(__file__).resolve().parent.parent.parent
 PYPROJECT = ROOT / "pyproject.toml"
 DESKTOP_LIB_RS = ROOT / "frontend" / "src-tauri" / "src" / "lib.rs"
 WINDOWS_INSTALL_PS1 = ROOT / "deploy" / "windows" / "install.ps1"
+QUICKSTART_SH = ROOT / "scripts" / "quickstart.sh"
 
 
 def _pyproject() -> dict:
@@ -59,3 +60,9 @@ def test_windows_installer_syncs_the_native_group() -> None:
         "the Windows installer must include `--group desktop-native` so "
         "openjarvis_rust is built during source install."
     )
+
+
+def test_quickstart_installs_web_search_dependencies() -> None:
+    quickstart = QUICKSTART_SH.read_text()
+    assert "--extra tools-search" in quickstart
+    assert "already running on port 8000" in quickstart

tests/engine/test_discovery.py

@@ -8,10 +8,12 @@ from openjarvis.core.config import JarvisConfig
 from openjarvis.core.registry import EngineRegistry
 from openjarvis.engine._base import InferenceEngine
 from openjarvis.engine._discovery import (
+    _make_engine,
     discover_engines,
     discover_models,
     get_engine,
 )
+from openjarvis.engine.litellm import LiteLLMEngine
 
 
 class _FakeEngine(InferenceEngine):
@@ -131,6 +133,24 @@ class TestDiscoverModels:
         assert result == {"ollama": ["m1", "m2"], "vllm": ["m3"]}
 
 
+class TestLiteLLMDiscovery:
+    def test_configured_default_model_is_advertised(self) -> None:
+        """Regression for #713: discovery must configure LiteLLM's model.
+
+        LiteLLM cannot enumerate every model supported by every provider, so
+        ``LiteLLMEngine.list_models()`` advertises the configured default
+        model.  Dropping that value while constructing the engine leaves the
+        API and Web UI with an empty model list.
+        """
+        cfg = JarvisConfig()
+        cfg.intelligence.default_model = "groq/llama-3.3-70b-versatile"
+        EngineRegistry.register_value("litellm", LiteLLMEngine)
+
+        engine = _make_engine("litellm", cfg)
+
+        assert engine.list_models() == ["groq/llama-3.3-70b-versatile"]
+
+
 class TestGetEngine:
     def test_fallback_when_default_unhealthy(self) -> None:
         _reg("bad", "bad")

tests/engine/test_engine_wrappers.py

@@ -120,6 +120,9 @@ async def test_multi_routes_stream_full_by_model():
     engine_b.list_models = lambda: ["model-b"]
 
     multi = MultiEngine([("a", engine_a), ("b", engine_b)])
+    assert multi.engine_key_for("model-a") == "a"
+    assert multi.engine_key_for("model-b") == "b"
+    assert multi.engine_key_for("missing") is None
 
     # Route to engine A
     result_a = []

tests/engine/test_litellm.py

@@ -158,6 +158,9 @@ class TestLiteLLMEngineGenerate:
 
 class TestLiteLLMEngineStream:
     def test_stream(self) -> None:
+        # stream() must use the ASYNC litellm entry point (acompletion): the
+        # sync litellm.completion makes blocking network reads inside an
+        # ``async def``, stalling the event loop between tokens.
         chunk1 = SimpleNamespace(
             choices=[SimpleNamespace(delta=SimpleNamespace(content="Hel"))]
         )
@@ -168,8 +171,12 @@ class TestLiteLLMEngineStream:
             choices=[SimpleNamespace(delta=SimpleNamespace(content=None))]
         )
 
+        async def _chunks():
+            for c in (chunk1, chunk2, chunk3):
+                yield c
+
         fake_litellm = mock.MagicMock()
-        fake_litellm.completion.return_value = iter([chunk1, chunk2, chunk3])
+        fake_litellm.acompletion = mock.AsyncMock(return_value=_chunks())
 
         with mock.patch.dict("sys.modules", {"litellm": fake_litellm}):
             engine = LiteLLMEngine()
@@ -186,6 +193,8 @@ class TestLiteLLMEngineStream:
             tokens = asyncio.run(collect())
 
         assert tokens == ["Hel", "lo!"]
+        fake_litellm.acompletion.assert_awaited_once()
+        assert fake_litellm.completion.call_count == 0
 
 
 class TestLiteLLMEngineListModels:

tests/engine/test_ollama.py

@@ -6,13 +6,27 @@ import json
 
 import httpx
 import pytest
-import respx
+
+try:
+    import respx
+
+    _HAS_RESPX = True
+except ImportError:  # respx is an optional test-only dep; the async MockTransport
+    respx = None  # type: ignore[assignment]  # pins below run without it.
+    _HAS_RESPX = False
 
 from openjarvis.core.registry import EngineRegistry
 from openjarvis.core.types import Message, Role
 from openjarvis.engine._base import EngineConnectionError
 from openjarvis.engine.ollama import OllamaEngine, _is_control_token_only_args
 
+# respx-backed tests exercise the SYNC client paths (generate/list_models/health)
+# and the respx-driven stream tests; they skip cleanly when respx is absent. The
+# async pins in TestOllamaStreamIsAsyncAndBounded use httpx.MockTransport directly.
+requires_respx = pytest.mark.skipif(
+    not _HAS_RESPX, reason="respx not installed (optional test-only dependency)"
+)
+
 
 @pytest.fixture()
 def engine() -> OllamaEngine:
@@ -20,6 +34,7 @@ def engine() -> OllamaEngine:
     return OllamaEngine(host="http://testhost:11434")
 
 
+@requires_respx
 class TestOllamaGenerate:
     def test_generate_returns_content(self, engine: OllamaEngine) -> None:
         with respx.mock:
@@ -53,6 +68,7 @@ class TestOllamaGenerate:
                 )
 
 
+@requires_respx
 class TestOllamaListModels:
     def test_list_models(self, engine: OllamaEngine) -> None:
         with respx.mock:
@@ -66,6 +82,7 @@ class TestOllamaListModels:
         assert models == ["qwen3:8b", "llama3.2:3b"]
 
 
+@requires_respx
 class TestOllamaHealth:
     def test_health_true(self, engine: OllamaEngine) -> None:
         with respx.mock:
@@ -120,6 +137,7 @@ class TestControlTokenFilter:
         assert _is_control_token_only_args(raw_args) is False
 
 
+@requires_respx
 class TestOllamaGenerateControlToken:
     def test_generate_drops_control_token_tool_call(self, engine: OllamaEngine) -> None:
         with respx.mock:
@@ -219,6 +237,7 @@ class TestOllamaGenerateControlToken:
         assert json.loads(result["tool_calls"][0]["arguments"]) == {"command": "date"}
 
 
+@requires_respx
 class TestOllamaStreamFullControlToken:
     @pytest.mark.asyncio
     async def test_stream_full_drops_control_token_tool_call(
@@ -257,6 +276,7 @@ class TestOllamaStreamFullControlToken:
         assert all(not c.tool_calls for c in chunks)
 
 
+@requires_respx
 class TestOllamaStream:
     @pytest.mark.asyncio
     async def test_stream_yields_content(self, engine: OllamaEngine) -> None:
@@ -275,3 +295,214 @@ class TestOllamaStream:
             ):
                 tokens.append(tok)
         assert "Hello" in tokens
+
+
+def _ndjson_transport(lines: list[str]) -> httpx.MockTransport:
+    body = "\n".join(lines) + "\n"
+
+    def handler(request: httpx.Request) -> httpx.Response:
+        return httpx.Response(200, text=body)
+
+    return httpx.MockTransport(handler)
+
+
+class TestOllamaStreamIsAsyncAndBounded:
+    """Regression pins: the Ollama stream paths are async (never iterate the SYNC
+    httpx client between tokens, which blocked the single uvicorn worker on every
+    inter-token wait) and a mid-stream disconnect is bounded and mapped to a clean
+    error. Uses httpx.MockTransport directly, so it runs without respx."""
+
+    @pytest.mark.asyncio
+    async def test_stream_does_not_use_blocking_sync_client(self) -> None:
+        # PIN: the old code iterated ``self._client`` (a SYNC httpx.Client) via
+        # ``iter_lines`` inside this ``async def``. The async path must not touch the
+        # sync client at all — swap in a bomb that explodes if ``.stream`` is used.
+        engine = OllamaEngine(host="http://localhost:11434")
+        engine._async_transport = _ndjson_transport(
+            [
+                json.dumps({"message": {"content": "Hi"}, "done": False}),
+                json.dumps({"message": {"content": " there"}, "done": True}),
+            ]
+        )
+
+        class _Boom:
+            def stream(self, *a, **k):  # pragma: no cover - must never run
+                raise AssertionError("streaming used the blocking sync client")
+
+        engine._client = _Boom()  # type: ignore[assignment]
+        tokens = [
+            tok
+            async for tok in engine.stream(
+                [Message(role=Role.USER, content="Hi")], model="qwen3:8b"
+            )
+        ]
+        assert tokens == ["Hi", " there"]
+
+    @pytest.mark.asyncio
+    async def test_stream_full_does_not_use_blocking_sync_client(self) -> None:
+        # stream_full delegates to _run_stream; prove that path is async too.
+        engine = OllamaEngine(host="http://localhost:11434")
+        engine._async_transport = _ndjson_transport(
+            [
+                json.dumps({"message": {"content": "Hi"}, "done": False}),
+                json.dumps(
+                    {"message": {"content": "", "tool_calls": []}, "done": True}
+                ),
+            ]
+        )
+
+        class _Boom:
+            def stream(self, *a, **k):  # pragma: no cover - must never run
+                raise AssertionError("stream_full used the blocking sync client")
+
+        engine._client = _Boom()  # type: ignore[assignment]
+        chunks = [
+            c
+            async for c in engine.stream_full(
+                [Message(role=Role.USER, content="Hi")], model="qwen3:8b"
+            )
+        ]
+        assert any(c.content == "Hi" for c in chunks)
+
+    @pytest.mark.asyncio
+    async def test_timeout_is_applied_to_async_stream_client(self) -> None:
+        # The configured timeout must be APPLIED to the async stream client, so a
+        # wedged read is actually bounded (not just stored on the engine).
+        engine = OllamaEngine(host="http://localhost:11434", timeout=0.05)
+        assert engine._timeout == 0.05
+        client = engine._make_async_client()
+        try:
+            assert client.timeout == httpx.Timeout(0.05)
+        finally:
+            await client.aclose()
+
+    @pytest.mark.asyncio
+    async def test_mid_stream_disconnect_maps_to_connection_error(self) -> None:
+        # PIN: a server dying MID-STREAM raises httpx.RemoteProtocolError from
+        # aiter_lines; it must surface as a clean EngineConnectionError, not raw.
+        class _MidStreamCrashStream(httpx.AsyncByteStream):
+            def __init__(self, request: httpx.Request) -> None:
+                self._request = request
+
+            async def __aiter__(self):
+                yield b'{"message": {"content": "Hi"}, "done": false}\n'
+                raise httpx.RemoteProtocolError(
+                    "peer closed connection mid-stream", request=self._request
+                )
+
+            async def aclose(self) -> None:  # pragma: no cover - trivial
+                pass
+
+        def handler(request: httpx.Request) -> httpx.Response:
+            return httpx.Response(200, stream=_MidStreamCrashStream(request))
+
+        engine = OllamaEngine(host="http://localhost:11434")
+        engine._async_transport = httpx.MockTransport(handler)
+        tokens: list[str] = []
+        with pytest.raises(EngineConnectionError):
+            async for tok in engine.stream(
+                [Message(role=Role.USER, content="Hi")], model="qwen3:8b"
+            ):
+                tokens.append(tok)
+        # The disconnect happened AFTER the first token was delivered (mid-stream).
+        assert tokens == ["Hi"]
+
+
+class TestOllamaStreamHttpErrorMapping:
+    """Regression pins: Ollama streaming non-2xx responses map to the same
+    ``EngineConnectionError`` as the OpenAI-compat engine (via
+    ``_raise_stream_http_error``), instead of leaking a raw
+    ``httpx.HTTPStatusError`` from ``raise_for_status()``. A 3xx must NOT fall
+    through to a silent empty stream. Uses ``httpx.MockTransport`` directly, so
+    it runs without respx."""
+
+    @staticmethod
+    def _status_transport(
+        status: int, *, text: str = "", headers: dict | None = None
+    ) -> httpx.MockTransport:
+        def handler(request: httpx.Request) -> httpx.Response:
+            return httpx.Response(status, text=text, headers=headers or {})
+
+        return httpx.MockTransport(handler)
+
+    @pytest.mark.asyncio
+    async def test_stream_500_maps_to_connection_error(self) -> None:
+        # PIN: the old code called ``resp.raise_for_status()`` and leaked a raw
+        # httpx.HTTPStatusError on a streaming 500. It must now be a clean
+        # EngineConnectionError carrying the status + body, like the compat path.
+        engine = OllamaEngine(host="http://localhost:11434")
+        engine._async_transport = self._status_transport(500, text="internal boom")
+        tokens: list[str] = []
+        with pytest.raises(EngineConnectionError) as excinfo:
+            async for tok in engine.stream(
+                [Message(role=Role.USER, content="Hi")], model="qwen3:8b"
+            ):
+                tokens.append(tok)
+        assert not isinstance(excinfo.value, httpx.HTTPStatusError)
+        assert "500" in str(excinfo.value)
+        assert "internal boom" in str(excinfo.value)
+        assert tokens == []
+
+    @pytest.mark.asyncio
+    async def test_stream_full_500_maps_to_connection_error(self) -> None:
+        # Same pin for the rich (_run_stream-backed) path.
+        engine = OllamaEngine(host="http://localhost:11434")
+        engine._async_transport = self._status_transport(500, text="internal boom")
+        with pytest.raises(EngineConnectionError) as excinfo:
+            async for _ in engine.stream_full(
+                [Message(role=Role.USER, content="Hi")], model="qwen3:8b"
+            ):
+                pass
+        assert not isinstance(excinfo.value, httpx.HTTPStatusError)
+        assert "500" in str(excinfo.value)
+        assert "internal boom" in str(excinfo.value)
+
+    @pytest.mark.asyncio
+    async def test_stream_3xx_maps_to_connection_error_not_silent(self) -> None:
+        # PIN: with redirects off, a 3xx must map to EngineConnectionError, NOT
+        # fall through to ``aiter_lines`` as a silent empty stream.
+        engine = OllamaEngine(host="http://localhost:11434")
+        engine._async_transport = self._status_transport(
+            302, headers={"location": "http://elsewhere/api/chat"}
+        )
+        tokens: list[str] = []
+        with pytest.raises(EngineConnectionError) as excinfo:
+            async for tok in engine.stream(
+                [Message(role=Role.USER, content="Hi")], model="qwen3:8b"
+            ):
+                tokens.append(tok)
+        assert "302" in str(excinfo.value)
+        assert tokens == []
+
+    @pytest.mark.asyncio
+    async def test_400_tools_retry_still_fires(self) -> None:
+        # REGRESSION GUARD: the tools-retry (400 WITH tools -> retry WITHOUT
+        # tools) must keep working; only OTHER non-2xx map to
+        # EngineConnectionError. A 400 carrying tools must NOT be treated as a
+        # generic connection error.
+        calls: list[bool] = []  # whether each request carried "tools"
+
+        def handler(request: httpx.Request) -> httpx.Response:
+            payload = json.loads(request.content)
+            had_tools = "tools" in payload
+            calls.append(had_tools)
+            if had_tools:
+                return httpx.Response(400, text="model does not support tools")
+            body = (
+                json.dumps({"message": {"content": "recovered"}, "done": True}) + "\n"
+            )
+            return httpx.Response(200, text=body)
+
+        engine = OllamaEngine(host="http://localhost:11434")
+        engine._async_transport = httpx.MockTransport(handler)
+        chunks = [
+            c
+            async for c in engine.stream_full(
+                [Message(role=Role.USER, content="Hi")],
+                model="qwen3:8b",
+                tools=[{"type": "function", "function": {"name": "shell_exec"}}],
+            )
+        ]
+        # First request had tools (400), second retried without them (200).
+        assert calls == [True, False]
+        assert any(c.content == "recovered" for c in chunks)

tests/engine/test_openai_compat.py

@@ -4,13 +4,37 @@ from __future__ import annotations
 
 import httpx
 import pytest
-import respx
+
+try:
+    import respx
+
+    _HAS_RESPX = True
+except ImportError:  # respx is an optional test-only dep; MockTransport tests
+    respx = None  # type: ignore[assignment]  # still run without it.
+    _HAS_RESPX = False
 
 from openjarvis.core.registry import EngineRegistry
 from openjarvis.core.types import Message, Role
 from openjarvis.engine._base import EngineConnectionError
+from openjarvis.engine._openai_compat import EngineContextLengthError
 from openjarvis.engine.openai_compat_engines import VLLMEngine
 
+# respx-backed tests exercise the SYNC client paths (generate/list_models/health)
+# and skip cleanly when respx is absent; the async stream/timeout/disconnect tests
+# below use httpx.MockTransport directly and never need respx.
+requires_respx = pytest.mark.skipif(
+    not _HAS_RESPX, reason="respx not installed (optional test-only dependency)"
+)
+
+
+def _sse_transport(sse_lines: list[str]) -> httpx.MockTransport:
+    body = "\n".join(sse_lines) + "\n"
+
+    def handler(request: httpx.Request) -> httpx.Response:
+        return httpx.Response(200, text=body)
+
+    return httpx.MockTransport(handler)
+
 
 @pytest.fixture()
 def engine() -> VLLMEngine:
@@ -18,6 +42,7 @@ def engine() -> VLLMEngine:
     return VLLMEngine(host="http://testhost:8000")
 
 
+@requires_respx
 class TestOpenAICompatGenerate:
     def test_generate_returns_content(self, engine: VLLMEngine) -> None:
         with respx.mock:
@@ -83,6 +108,7 @@ class TestOpenAICompatGenerate:
                 )
 
 
+@requires_respx
 class TestOpenAICompatListModels:
     def test_list_models(self, engine: VLLMEngine) -> None:
         with respx.mock:
@@ -95,6 +121,7 @@ class TestOpenAICompatListModels:
             assert engine.list_models() == ["model-a", "model-b"]
 
 
+@requires_respx
 class TestOpenAICompatHealth:
     def test_health_true(self, engine: VLLMEngine) -> None:
         with respx.mock:
@@ -111,6 +138,7 @@ class TestOpenAICompatHealth:
             assert engine.health() is False
 
 
+@requires_respx
 class TestOpenAICompatStream:
     @pytest.mark.asyncio
     async def test_stream_sse(self, engine: VLLMEngine) -> None:
@@ -129,3 +157,199 @@ class TestOpenAICompatStream:
             ):
                 tokens.append(tok)
         assert tokens == ["Hi", " there"]
+
+
+class TestStreamIsAsyncAndBounded:
+    """Regression pins for BC2: the stream path is async (never blocks the event
+    loop on the SYNC httpx client) and a wedged/oversized upstream is bounded and
+    mapped to a clean error instead of hanging or surfacing raw HTTP."""
+
+    @pytest.mark.asyncio
+    async def test_timeout_is_applied_to_async_stream_client(self) -> None:
+        # HARDENED: assert the configured timeout is actually APPLIED to the async
+        # stream client, not merely stored on the engine. Deleting
+        # ``timeout=self._timeout`` from ``_make_async_client`` drops the client to
+        # httpx's 5s default and fails this (a stored-only assertion would not).
+        engine = VLLMEngine(host="http://testhost:8000", timeout=180.0)
+        assert engine._timeout == 180.0
+        client = engine._make_async_client()
+        try:
+            assert client.timeout == httpx.Timeout(180.0)
+        finally:
+            await client.aclose()
+
+    @pytest.mark.asyncio
+    async def test_stream_does_not_use_blocking_sync_client(self) -> None:
+        # PIN: the old code iterated ``self._client`` (a SYNC httpx.Client) inside
+        # this ``async def``, blocking the single uvicorn worker between tokens.
+        # The async path must not touch the sync client at all.
+        engine = VLLMEngine(host="http://localhost:8000")
+        engine._async_transport = _sse_transport(
+            [
+                'data: {"choices":[{"delta":{"content":"Hi"}}]}',
+                'data: {"choices":[{"delta":{"content":" there"}}]}',
+                "data: [DONE]",
+            ]
+        )
+
+        class _Boom:
+            def stream(self, *a, **k):  # pragma: no cover - must never run
+                raise AssertionError("streaming used the blocking sync client")
+
+        engine._client = _Boom()  # type: ignore[assignment]
+        tokens = [
+            tok
+            async for tok in engine.stream(
+                [Message(role=Role.USER, content="Hello")], model="m"
+            )
+        ]
+        assert tokens == ["Hi", " there"]
+
+    @pytest.mark.asyncio
+    async def test_wedged_read_is_bounded_by_timeout(self) -> None:
+        # A wedged upstream read trips the (small, honoured) timeout and maps to a
+        # clean EngineConnectionError rather than hanging the caller.
+        seen: dict = {}
+
+        def handler(request: httpx.Request) -> httpx.Response:
+            # httpx populates request.extensions["timeout"] with the per-op timeouts
+            # that were actually applied to THIS request; capturing it here proves
+            # the configured 0.05s reached the wire, not just the engine attribute.
+            seen["timeout"] = request.extensions["timeout"]
+            raise httpx.ReadTimeout("wedged upstream", request=request)
+
+        engine = VLLMEngine(host="http://localhost:8000", timeout=0.05)
+        engine._async_transport = httpx.MockTransport(handler)
+        with pytest.raises(EngineConnectionError):
+            async for _ in engine.stream(
+                [Message(role=Role.USER, content="Hello")], model="m"
+            ):
+                pass
+        # HARDENED: the configured timeout was APPLIED to the request. Deleting
+        # ``timeout=self._timeout`` from ``_make_async_client`` drops this to httpx's
+        # 5.0s default and fails the assertion.
+        assert seen["timeout"]["read"] == 0.05
+
+    @pytest.mark.asyncio
+    async def test_context_length_400_maps_to_context_error(self) -> None:
+        def handler(request: httpx.Request) -> httpx.Response:
+            return httpx.Response(
+                400,
+                text=(
+                    "This model's maximum context length is 4096 tokens. "
+                    "However, you requested 5200 tokens. Please reduce the length."
+                ),
+            )
+
+        engine = VLLMEngine(host="http://localhost:8000")
+        engine._async_transport = httpx.MockTransport(handler)
+        with pytest.raises(EngineContextLengthError) as excinfo:
+            async for _ in engine.stream(
+                [Message(role=Role.USER, content="Hello")], model="m"
+            ):
+                pass
+        assert getattr(excinfo.value, "is_context_length_error", False) is True
+
+    @pytest.mark.asyncio
+    async def test_other_upstream_error_maps_to_connection_error(self) -> None:
+        def handler(request: httpx.Request) -> httpx.Response:
+            return httpx.Response(500, text="internal server error")
+
+        engine = VLLMEngine(host="http://localhost:8000")
+        engine._async_transport = httpx.MockTransport(handler)
+        with pytest.raises(EngineConnectionError) as excinfo:
+            async for _ in engine.stream(
+                [Message(role=Role.USER, content="Hello")], model="m"
+            ):
+                pass
+        # A generic upstream failure is NOT reported as a context-length problem.
+        assert not isinstance(excinfo.value, EngineContextLengthError)
+
+    @pytest.mark.asyncio
+    async def test_mid_stream_disconnect_maps_to_connection_error(self) -> None:
+        # PIN: a server dying MID-STREAM raises httpx.RemoteProtocolError from
+        # aiter_lines. Before the except tuple was widened it propagated raw; it
+        # must now surface as a clean EngineConnectionError.
+        class _MidStreamCrashStream(httpx.AsyncByteStream):
+            def __init__(self, request: httpx.Request) -> None:
+                self._request = request
+
+            async def __aiter__(self):
+                yield b'data: {"choices":[{"delta":{"content":"Hi"}}]}\n\n'
+                raise httpx.RemoteProtocolError(
+                    "peer closed connection mid-stream", request=self._request
+                )
+
+            async def aclose(self) -> None:  # pragma: no cover - trivial
+                pass
+
+        def handler(request: httpx.Request) -> httpx.Response:
+            return httpx.Response(200, stream=_MidStreamCrashStream(request))
+
+        engine = VLLMEngine(host="http://localhost:8000")
+        engine._async_transport = httpx.MockTransport(handler)
+        tokens: list[str] = []
+        with pytest.raises(EngineConnectionError) as excinfo:
+            async for tok in engine.stream(
+                [Message(role=Role.USER, content="Hello")], model="m"
+            ):
+                tokens.append(tok)
+        # The disconnect happened AFTER the first token was delivered (mid-stream),
+        # and did not masquerade as a context-length error.
+        assert tokens == ["Hi"]
+        assert not isinstance(excinfo.value, EngineContextLengthError)
+
+    @pytest.mark.asyncio
+    async def test_unrelated_400_is_not_context_error(self) -> None:
+        # PIN: the context-length markers are anchored on "context" so generic
+        # 400 bodies containing phrases like "please reduce" (max_tokens
+        # validation, rate limiting, oversized images) are NOT misclassified
+        # as "conversation too long" — that message would send the user off to
+        # shorten a conversation that isn't the problem.
+        def handler(request: httpx.Request) -> httpx.Response:
+            return httpx.Response(
+                400,
+                text=(
+                    "Invalid max_tokens: the maximum number of tokens you can "
+                    "request is 4096; please reduce max_tokens and retry."
+                ),
+            )
+
+        engine = VLLMEngine(host="http://localhost:8000")
+        engine._async_transport = httpx.MockTransport(handler)
+        with pytest.raises(EngineConnectionError) as excinfo:
+            async for _ in engine.stream(
+                [Message(role=Role.USER, content="Hello")], model="m"
+            ):
+                pass
+        assert not isinstance(excinfo.value, EngineContextLengthError)
+
+    @pytest.mark.asyncio
+    async def test_async_client_is_reused_across_streams(self) -> None:
+        # PIN: consecutive streams on the same event loop share one AsyncClient
+        # (connection pooling). A per-call client would pay a fresh TCP/TLS
+        # handshake on every conversation turn.
+        engine = VLLMEngine(host="http://localhost:8000")
+        engine._async_transport = _sse_transport(
+            [
+                'data: {"choices":[{"delta":{"content":"Hi"}}]}',
+                "data: [DONE]",
+            ]
+        )
+
+        async def one_turn() -> list[str]:
+            return [
+                tok
+                async for tok in engine.stream(
+                    [Message(role=Role.USER, content="Hello")], model="m"
+                )
+            ]
+
+        assert await one_turn() == ["Hi"]
+        first_client = engine._async_client
+        assert first_client is not None and not first_client.is_closed
+        assert await one_turn() == ["Hi"]
+        assert engine._async_client is first_client
+        # close() tears the shared client down with the sync one.
+        engine.close()
+        assert engine._async_client is None

tests/engine/test_stream_full.py

@@ -5,12 +5,27 @@ from __future__ import annotations
 import json
 from collections.abc import AsyncIterator
 from typing import Any, Dict, List
-from unittest.mock import MagicMock
 
+import httpx
 import pytest
 
 from openjarvis.core.types import Message, Role
 from openjarvis.engine._stubs import InferenceEngine, StreamChunk
+from openjarvis.engine.openai_compat_engines import VLLMEngine
+
+
+def _sse_transport(sse_lines: list[str]) -> httpx.MockTransport:
+    """A MockTransport that replies to /v1/chat/completions with SSE ``sse_lines``.
+
+    Exercises the REAL async httpx streaming path (aiter_lines) with no server.
+    """
+    body = "\n".join(sse_lines) + "\n"
+
+    def handler(request: httpx.Request) -> httpx.Response:
+        return httpx.Response(200, text=body)
+
+    return httpx.MockTransport(handler)
+
 
 # ---------------------------------------------------------------------------
 # StreamChunk dataclass tests
@@ -147,8 +162,6 @@ class TestOpenAICompatStreamFull:
 
     @pytest.mark.asyncio
     async def test_parses_sse_with_content_and_finish(self):
-        from openjarvis.engine._openai_compat import _OpenAICompatibleEngine
-
         # Build mock SSE lines
         sse_lines = []
         for token in ["Hello", " world"]:
@@ -164,22 +177,8 @@ class TestOpenAICompatStreamFull:
         sse_lines.append(f"data: {json.dumps(final)}")
         sse_lines.append("data: [DONE]")
 
-        # Mock the httpx client stream context manager
-        mock_resp = MagicMock()
-        mock_resp.raise_for_status = MagicMock()
-        mock_resp.iter_lines.return_value = iter(sse_lines)
-
-        engine = _OpenAICompatibleEngine.__new__(_OpenAICompatibleEngine)
-        engine.engine_id = "test"
-        engine._host = "http://localhost:8000"
-        engine._api_prefix = "/v1"
-
-        mock_client = MagicMock()
-        mock_stream_ctx = MagicMock()
-        mock_stream_ctx.__enter__ = MagicMock(return_value=mock_resp)
-        mock_stream_ctx.__exit__ = MagicMock(return_value=False)
-        mock_client.stream.return_value = mock_stream_ctx
-        engine._client = mock_client
+        engine = VLLMEngine(host="http://localhost:8000")
+        engine._async_transport = _sse_transport(sse_lines)
 
         chunks = []
         async for chunk in engine.stream_full(
@@ -198,8 +197,6 @@ class TestOpenAICompatStreamFull:
 
     @pytest.mark.asyncio
     async def test_parses_tool_call_fragments(self):
-        from openjarvis.engine._openai_compat import _OpenAICompatibleEngine
-
         # Simulate streamed tool_call fragments
         _tc1 = (
             '{"choices": [{"delta": {"tool_calls": [{"index": 0, "id": "call_1",'
@@ -218,21 +215,8 @@ class TestOpenAICompatStreamFull:
             "data: [DONE]",
         ]
 
-        mock_resp = MagicMock()
-        mock_resp.raise_for_status = MagicMock()
-        mock_resp.iter_lines.return_value = iter(sse_lines)
-
-        engine = _OpenAICompatibleEngine.__new__(_OpenAICompatibleEngine)
-        engine.engine_id = "test"
-        engine._host = "http://localhost:8000"
-        engine._api_prefix = "/v1"
-
-        mock_client = MagicMock()
-        mock_stream_ctx = MagicMock()
-        mock_stream_ctx.__enter__ = MagicMock(return_value=mock_resp)
-        mock_stream_ctx.__exit__ = MagicMock(return_value=False)
-        mock_client.stream.return_value = mock_stream_ctx
-        engine._client = mock_client
+        engine = VLLMEngine(host="http://localhost:8000")
+        engine._async_transport = _sse_transport(sse_lines)
 
         chunks = []
         async for chunk in engine.stream_full(

tests/evals/test_use_case_benchmarks.py

@@ -347,7 +347,7 @@ class TestCostCalculator:
             calls_per_month=1000,
             avg_input_tokens=500,
             avg_output_tokens=200,
-            provider_key="gpt-5.3",
+            provider_key="gpt-5.6-sol",
         )
         assert est.monthly_cost > 0
         assert est.annual_cost == est.monthly_cost * 12

tests/mcp/test_client.py

@@ -2,10 +2,15 @@
 
 from __future__ import annotations
 
+import threading
+import time
+from concurrent.futures import ThreadPoolExecutor
+from unittest.mock import MagicMock
+
 import pytest
 
 from openjarvis.mcp.client import MCPClient
-from openjarvis.mcp.protocol import MCPError
+from openjarvis.mcp.protocol import MCPError, MCPResponse
 from openjarvis.mcp.server import MCPServer
 from openjarvis.mcp.transport import InProcessTransport
 from openjarvis.tools._stubs import ToolSpec
@@ -101,3 +106,101 @@ class TestMCPClient:
         result = client.call_tool("think")
         # Think tool echoes empty thought
         assert result["isError"] is False
+
+    def test_shared_client_serializes_transport_round_trips(self):
+        """Concurrent agents cannot consume one another's MCP responses."""
+
+        class _ConcurrencyProbeTransport:
+            def __init__(self):
+                self.active = 0
+                self.max_active = 0
+                self.lock = threading.Lock()
+
+            def send(self, request):
+                with self.lock:
+                    self.active += 1
+                    self.max_active = max(self.max_active, self.active)
+                time.sleep(0.01)
+                with self.lock:
+                    self.active -= 1
+                return MCPResponse(result={"tools": []}, id=request.id)
+
+            def send_notification(self, request):
+                return None
+
+            def close(self):
+                return None
+
+        transport = _ConcurrencyProbeTransport()
+        shared_client = MCPClient(transport)
+
+        with ThreadPoolExecutor(max_workers=8) as pool:
+            list(pool.map(lambda _: shared_client.list_tools(), range(24)))
+
+        assert transport.max_active == 1
+
+    def test_close_interrupts_blocked_request_and_rejects_queued_request(self):
+        """Shutdown reaches the transport without waiting on an in-flight call."""
+
+        class _BlockingTransport:
+            def __init__(self):
+                self.send_started = threading.Event()
+                self.send_released = threading.Event()
+                self.close_called = threading.Event()
+                self.send_count = 0
+
+            def send(self, request):
+                self.send_count += 1
+                self.send_started.set()
+                self.send_released.wait()
+                raise RuntimeError("transport closed")
+
+            def send_notification(self, request):
+                return None
+
+            def close(self):
+                self.close_called.set()
+                self.send_released.set()
+
+        transport = _BlockingTransport()
+        shared_client = MCPClient(transport)
+
+        with ThreadPoolExecutor(max_workers=3) as pool:
+            blocked_request = pool.submit(shared_client.list_tools)
+            assert transport.send_started.wait(timeout=1)
+
+            queued_request = pool.submit(shared_client.list_tools)
+            close_call = pool.submit(shared_client.close)
+
+            try:
+                close_reached_transport = transport.close_called.wait(timeout=1)
+            finally:
+                # Keep the test failure-safe against a regression that makes
+                # close wait behind the blocked request.
+                transport.send_released.set()
+
+            close_call.result(timeout=1)
+            assert close_reached_transport
+            with pytest.raises(RuntimeError, match="transport closed"):
+                blocked_request.result(timeout=1)
+            with pytest.raises(RuntimeError, match="MCP client is closed"):
+                queued_request.result(timeout=1)
+
+        assert transport.send_count == 1
+
+    def test_close_retries_transport_cleanup_after_failure(self):
+        """A failed close keeps requests blocked but permits cleanup retry."""
+
+        transport = MagicMock()
+        transport.close.side_effect = [RuntimeError("terminate timed out"), None]
+        client = MCPClient(transport)
+
+        with pytest.raises(RuntimeError, match="terminate timed out"):
+            client.close()
+        with pytest.raises(RuntimeError, match="MCP client is closed"):
+            client.list_tools()
+
+        client.close()
+        client.close()
+
+        assert transport.close.call_count == 2

tests/mcp/test_discovery.py

@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+import json
 from unittest.mock import MagicMock, patch
 
 import pytest
@@ -181,6 +182,132 @@ class TestClientPersistence:
         assert len(builder._mcp_clients) == 3
 
 
+def test_builder_retains_full_mcp_pool_for_managed_agents() -> None:
+    """Global primary-agent filters must not trim managed-agent MCP tools."""
+
+    from openjarvis.core.config import JarvisConfig
+    from openjarvis.system import SystemBuilder
+
+    config = JarvisConfig()
+    config.tools.mcp.servers = json.dumps(
+        [{"name": "test", "url": "http://localhost:8080/mcp"}]
+    )
+    external = _make_mock_tool("mcp_only")
+    builder = SystemBuilder(config).tools(["native_only"])
+
+    with (
+        patch("openjarvis.mcp.server.MCPServer") as mcp_server_cls,
+        patch.object(
+            builder,
+            "_discover_external_mcp",
+            return_value=[external],
+        ),
+    ):
+        mcp_server_cls.return_value.get_tools.return_value = []
+        primary_tools = builder._resolve_tools(
+            config,
+            engine=MagicMock(),
+            model="test-model",
+            memory_backend=None,
+        )
+
+    assert primary_tools == []
+    assert builder._mcp_tools == [external]
+
+
+def test_builder_global_mcp_disable_prevents_discovery() -> None:
+    """A global MCP disable is honored by every managed-agent entry path."""
+
+    from openjarvis.core.config import JarvisConfig
+    from openjarvis.system import SystemBuilder
+
+    config = JarvisConfig()
+    config.tools.mcp.enabled = False
+    config.tools.mcp.servers = json.dumps(
+        [{"name": "disabled", "url": "http://localhost:8080/mcp"}]
+    )
+    builder = SystemBuilder(config)
+
+    with (
+        patch("openjarvis.mcp.server.MCPServer") as mcp_server_cls,
+        patch.object(builder, "_discover_external_mcp") as discover,
+    ):
+        mcp_server_cls.return_value.get_tools.return_value = []
+        builder._resolve_tools(
+            config,
+            engine=MagicMock(),
+            model="test-model",
+            memory_backend=None,
+        )
+
+    discover.assert_not_called()
+    assert builder._mcp_tools == []
+
+
+def test_reused_builder_transfers_only_current_build_mcp_state() -> None:
+    """Each built system exclusively owns its own MCP clients and tools."""
+
+    from openjarvis.core.config import JarvisConfig
+    from openjarvis.system import SystemBuilder
+
+    config = JarvisConfig()
+    config.telemetry.enabled = False
+    config.traces.enabled = False
+    config.skills.enabled = False
+    config.agent_manager.enabled = False
+    config.tools.mcp.servers = json.dumps(
+        [{"name": "test", "url": "http://localhost:8080/mcp"}]
+    )
+
+    engine = MagicMock(spec=["health", "can_serve", "generate", "list_models", "close"])
+    engine.health.return_value = True
+    first_tool = _make_mock_tool("first_mcp_tool")
+    second_tool = _make_mock_tool("second_mcp_tool")
+    first_client = MagicMock()
+    second_client = MagicMock()
+    discoveries = iter([(first_tool, first_client), (second_tool, second_client)])
+
+    builder = (
+        SystemBuilder(config)
+        .engine_instance(engine)
+        .model("test-model")
+        .tools([])
+        .telemetry(False)
+        .traces(False)
+        .speech(False)
+    )
+
+    def _discover(_server_cfg):
+        tool, client = next(discoveries)
+        builder._mcp_clients.append(client)
+        return [tool]
+
+    with (
+        patch.object(builder, "_discover_external_mcp", side_effect=_discover),
+        patch.object(builder, "_resolve_memory", return_value=None),
+    ):
+        first_system = builder.build()
+        assert first_system.mcp_tools == [first_tool]
+        assert first_system._mcp_clients == [first_client]
+        assert builder._mcp_tools == []
+        assert builder._mcp_clients == []
+        first_system.close()
+
+        second_system = builder.build()
+
+    try:
+        assert second_system.mcp_tools == [second_tool]
+        assert second_system._mcp_clients == [second_client]
+        assert first_client not in second_system._mcp_clients
+        assert builder._mcp_tools == []
+        assert builder._mcp_clients == []
+    finally:
+        second_system.close()
+
+    first_client.close.assert_called_once()
+    second_client.close.assert_called_once()
+
+
 class TestStringConfig:
     @patch(_PATCH_PROVIDER)
     @patch(_PATCH_CLIENT)

tests/memory/test_sqlite.py

@@ -78,6 +78,19 @@ def test_retrieve_no_results(tmp_path: Path):
     backend.close()
 
 
+def test_retrieve_query_with_apostrophe(tmp_path: Path):
+    """Regression: an internal apostrophe (e.g. "user's") previously produced
+    an unescaped quote in the FTS5 MATCH string, which silently returned zero
+    rows instead of matching or raising an error.
+    """
+    backend = _make_backend(tmp_path)
+    backend.store("The user's name is Trev.", source="identity.md")
+    results = backend.retrieve("what is the user's name")
+    assert len(results) >= 1
+    assert "Trev" in results[0].content
+    backend.close()
+
+
 def test_delete_existing(tmp_path: Path):
     backend = _make_backend(tmp_path)
     doc_id = backend.store("deletable content")

tests/sdk/test_system.py

@@ -12,6 +12,34 @@ from openjarvis.system import JarvisSystem, SystemBuilder
 
 
 class TestJarvisSystem:
+    def test_new_fields_do_not_shift_existing_positional_arguments(self):
+        """Adding mcp_tools must not reinterpret legacy positional calls."""
+        config = JarvisConfig()
+        bus = EventBus()
+        engine = MagicMock()
+        agent = MagicMock()
+        tools = [MagicMock()]
+        tool_executor = MagicMock()
+        memory_backend = MagicMock()
+
+        system = JarvisSystem(
+            config,
+            bus,
+            engine,
+            "mock",
+            "test-model",
+            agent,
+            "simple",
+            tools,
+            tool_executor,
+            memory_backend,
+        )
+
+        assert system.tools is tools
+        assert system.tool_executor is tool_executor
+        assert system.memory_backend is memory_backend
+        assert system.mcp_tools == []
+
     def test_ask_direct_mode(self):
         engine = MagicMock()
         engine.generate.return_value = {

tests/server/test_agent_manager_routes.py

@@ -4,6 +4,8 @@ from __future__ import annotations
 
 import json
 import tempfile
+import threading
+from concurrent.futures import ThreadPoolExecutor
 from pathlib import Path
 from types import SimpleNamespace
 from unittest.mock import AsyncMock, MagicMock, patch
@@ -602,3 +604,81 @@ class TestLightweightSystemEngineResolution:
             engine=MagicMock(), model="m", config=self._cfg(None, "llamacpp")
         )
         assert captured["key"] == "llamacpp"
+
+    def test_caches_tool_memory_backend_when_prompt_context_is_disabled(
+        self,
+        monkeypatch,
+    ):
+        pytest.importorskip("fastapi")
+        from openjarvis.server import agent_manager_routes as amr
+
+        backend = object()
+        resolver = MagicMock(return_value=backend)
+        monkeypatch.setattr(amr, "_resolve_memory_backend", resolver)
+        config = SimpleNamespace(
+            agent=SimpleNamespace(context_from_memory=False),
+            memory=SimpleNamespace(default_backend="sqlite", db_path="memory.db"),
+        )
+        runtime = SimpleNamespace(
+            memory_backend=None,
+            _owns_memory_backend=False,
+            channel_backend=None,
+            channel_bridge=None,
+            knowledge_db_path=None,
+        )
+
+        system = amr._LightweightSystem(
+            engine=MagicMock(),
+            model="m",
+            config=config,
+            runtime=runtime,
+        )
+
+        resolver.assert_called_once_with(config)
+        assert system.memory_backend is backend
+        assert runtime.memory_backend is backend
+        assert runtime._owns_memory_backend is True
+
+    def test_memory_backend_lazy_init_is_synchronized(self, monkeypatch):
+        pytest.importorskip("fastapi")
+        from openjarvis.server import agent_manager_routes as amr
+
+        backend = object()
+        resolver_calls = 0
+        calls_lock = threading.Lock()
+        duplicate_entered = threading.Event()
+        start = threading.Barrier(8)
+
+        def _resolve(config):
+            nonlocal resolver_calls
+            with calls_lock:
+                resolver_calls += 1
+                call_number = resolver_calls
+                if call_number > 1:
+                    duplicate_entered.set()
+            # A check-then-create race lets another worker enter while the
+            # first resolver is blocked here. The locked implementation times
+            # out once, publishes the backend, and all other workers reuse it.
+            if call_number == 1:
+                duplicate_entered.wait(timeout=0.2)
+            return backend
+
+        monkeypatch.setattr(amr, "_resolve_memory_backend", _resolve)
+        config = SimpleNamespace()
+        runtime = SimpleNamespace(
+            memory_backend=None,
+            _owns_memory_backend=False,
+            _managed_runtime_stopping=False,
+        )
+
+        def _get_backend():
+            start.wait(timeout=2)
+            return amr._get_or_create_memory_backend(runtime, config)
+
+        with ThreadPoolExecutor(max_workers=8) as pool:
+            results = list(pool.map(lambda _: _get_backend(), range(8)))
+
+        assert resolver_calls == 1
+        assert results == [backend] * 8
+        assert runtime.memory_backend is backend
+        assert runtime._owns_memory_backend is True

tests/server/test_api_routes.py

@@ -37,16 +37,22 @@ class TestAgentRoutes:
 
 
 class TestMemoryRoutes:
+    # 503 is the documented response when the native ``openjarvis_rust``
+    # extension is absent from the venv (see TestMemoryRustMissing below).
+    # These tests are only asserting "the route is wired up", so a backend
+    # that cannot be built is tolerated the same way a 500 is.
+    _BACKEND_OPTIONAL = (200, 500, 503)
+
     def test_search(self):
         client = TestClient(_make_app())
         resp = client.post("/v1/memory/search", json={"query": "test"})
         # May fail if SQLite not set up, that's ok
-        assert resp.status_code in (200, 500)
+        assert resp.status_code in self._BACKEND_OPTIONAL
 
     def test_stats(self):
         client = TestClient(_make_app())
         resp = client.get("/v1/memory/stats")
-        assert resp.status_code in (200, 500)
+        assert resp.status_code in self._BACKEND_OPTIONAL
 
 
 class TestMemoryRustMissing:

tests/server/test_deep_research_tools_wiring.py

@@ -2,7 +2,9 @@
 
 from __future__ import annotations
 
+import json
 from pathlib import Path
+from types import SimpleNamespace
 from unittest.mock import MagicMock
 
 import pytest
@@ -15,6 +17,82 @@ except ImportError:
     HAS_FASTAPI = False
 
 from openjarvis.connectors.store import KnowledgeStore
+from openjarvis.core.registry import ToolRegistry
+from openjarvis.core.types import Role, ToolResult
+from openjarvis.tools._stubs import BaseTool, ToolSpec
+
+
+class _ConfiguredResearchProbe(BaseTool):
+    """Configured native tool used to exercise the Deep Research SSE path."""
+
+    tool_id = "configured_research_probe_682"
+    calls = 0
+
+    @property
+    def spec(self) -> ToolSpec:
+        return ToolSpec(
+            name=self.tool_id,
+            description="Configured Deep Research probe",
+            parameters={
+                "type": "object",
+                "properties": {"value": {"type": "string"}},
+                "required": ["value"],
+            },
+        )
+
+    def execute(self, **params) -> ToolResult:
+        type(self).calls += 1
+        return ToolResult(
+            tool_name=self.tool_id,
+            content=f"configured:{params['value']}",
+        )
+
+
+class _MCPResearchProbe(BaseTool):
+    """MCP-shaped adapter that must be merged into the same toolkit."""
+
+    tool_id = "mcp_research_probe_682"
+
+    @property
+    def spec(self) -> ToolSpec:
+        return ToolSpec(name=self.tool_id, description="MCP Deep Research probe")
+
+    def execute(self, **params) -> ToolResult:
+        return ToolResult(tool_name=self.tool_id, content="mcp")
+
+
+class _ScriptedDeepResearchEngine:
+    """Call the configured probe once, then return a final answer."""
+
+    def __init__(self) -> None:
+        self.turns = 0
+        self.advertised_names: list[str] = []
+        self.observed_tool_result = ""
+
+    def generate(self, messages, *, model, **kwargs):
+        self.turns += 1
+        self.advertised_names = [
+            spec["function"]["name"] for spec in kwargs.get("tools", [])
+        ]
+        if self.turns == 1:
+            return {
+                "content": "",
+                "tool_calls": [
+                    {
+                        "id": "call-configured-research-probe",
+                        "type": "function",
+                        "function": {
+                            "name": _ConfiguredResearchProbe.tool_id,
+                            "arguments": json.dumps({"value": "sentinel"}),
+                        },
+                    }
+                ],
+                "usage": {},
+            }
+
+        tool_messages = [message for message in messages if message.role is Role.TOOL]
+        self.observed_tool_result = tool_messages[-1].content
+        return {"content": "complete", "tool_calls": [], "usage": {}}
 
 
 @pytest.mark.skipif(not HAS_FASTAPI, reason="fastapi not installed")
@@ -53,3 +131,111 @@ def test_deep_research_tools_returns_empty_when_no_db() -> None:
     )
 
     assert tools == []
+
+
+@pytest.mark.skipif(not HAS_FASTAPI, reason="fastapi not installed")
+@pytest.mark.asyncio
+@pytest.mark.parametrize(
+    "with_knowledge_db",
+    [False, True],
+    ids=["without-knowledge-db", "with-knowledge-db"],
+)
+async def test_server_deep_research_merges_and_executes_all_tool_sources(
+    tmp_path: Path,
+    with_knowledge_db: bool,
+    monkeypatch,
+) -> None:
+    """Configured and MCP tools reach Deep Research with or without its DB."""
+
+    from openjarvis.server import agent_manager_routes as routes
+
+    start_worker = MagicMock(wraps=routes._start_managed_worker)
+    monkeypatch.setattr(routes, "_start_managed_worker", start_worker)
+
+    db_path = tmp_path / "knowledge.db"
+    if with_knowledge_db:
+        store = KnowledgeStore(str(db_path))
+        store.store("test content", source="test", doc_type="note")
+        store.close()
+
+    if not ToolRegistry.contains(_ConfiguredResearchProbe.tool_id):
+        ToolRegistry.register_value(
+            _ConfiguredResearchProbe.tool_id,
+            _ConfiguredResearchProbe,
+        )
+    _ConfiguredResearchProbe.calls = 0
+
+    mcp_tool = _MCPResearchProbe()
+    app_state = SimpleNamespace(
+        config=SimpleNamespace(memory_files=None, system_prompt=None),
+        memory_backend=None,
+        channel_backend=None,
+        channel_bridge=None,
+        knowledge_db_path=str(db_path),
+        _mcp_clients=[object()],
+        _mcp_tools_cache=(
+            [mcp_tool.to_openai_function()],
+            {mcp_tool.spec.name: mcp_tool},
+        ),
+    )
+    manager = MagicMock()
+    manager.list_messages.return_value = []
+    engine = _ScriptedDeepResearchEngine()
+
+    response = await routes._stream_managed_agent(
+        manager=manager,
+        agent_record={
+            "id": "agent-deep-research-682",
+            "name": "Deep Research Agent",
+            "agent_type": "deep_research",
+            "config": {
+                "model": "test-model",
+                "max_turns": 3,
+                "tools": [_ConfiguredResearchProbe.tool_id],
+            },
+        },
+        user_content="Use the configured research probe",
+        message_id="message-deep-research-682",
+        engine=engine,
+        bus=None,
+        app_state=app_state,
+    )
+
+    body_parts: list[str] = []
+    async for part in response.body_iterator:
+        body_parts.append(part.decode() if isinstance(part, bytes) else part)
+
+    expected_names = {
+        _ConfiguredResearchProbe.tool_id,
+        _MCPResearchProbe.tool_id,
+    }
+    knowledge_names = {
+        "knowledge_search",
+        "knowledge_sql",
+        "scan_chunks",
+        "think",
+    }
+    if with_knowledge_db:
+        expected_names.update(knowledge_names)
+
+    assert set(engine.advertised_names) == expected_names
+    assert len(engine.advertised_names) == len(expected_names)
+    assert not with_knowledge_db or knowledge_names.issubset(engine.advertised_names)
+    assert with_knowledge_db or knowledge_names.isdisjoint(engine.advertised_names)
+    assert engine.turns == 2
+    assert _ConfiguredResearchProbe.calls == 1
+    assert engine.observed_tool_result == "configured:sentinel"
+    assert "data: [DONE]" in "".join(body_parts)
+    start_worker.assert_called_once()
+    assert start_worker.call_args.kwargs["name"].startswith(
+        "managed-agent-deep-research-"
+    )
+    assert app_state._managed_workers == set()
+
+    manager.store_agent_response.assert_called_once()
+    stored = manager.store_agent_response.call_args
+    assert stored.args[:2] == ("agent-deep-research-682", "complete")
+    persisted_calls = stored.kwargs["tool_calls"]
+    assert persisted_calls[0]["tool"] == _ConfiguredResearchProbe.tool_id
+    assert persisted_calls[0]["result"] == "configured:sentinel"
+    assert persisted_calls[0]["success"] is True

tests/server/test_managed_agent_resolved_tools.py

@@ -0,0 +1,302 @@
+"""SSE regression coverage for canonical managed-agent tool resolution."""
+
+from __future__ import annotations
+
+import json
+from types import SimpleNamespace
+from unittest.mock import MagicMock
+
+import pytest
+
+pytest.importorskip("fastapi")
+
+from openjarvis.core.registry import ToolRegistry  # noqa: E402
+from openjarvis.core.types import Role, ToolResult  # noqa: E402
+from openjarvis.engine._stubs import StreamChunk  # noqa: E402
+from openjarvis.tools._stubs import BaseTool, ToolSpec  # noqa: E402
+
+
+class _StatefulConfiguredTool(BaseTool):
+    """A tool whose result identifies the exact instance that executed."""
+
+    tool_id = "stateful_probe"
+    instances: list["_StatefulConfiguredTool"] = []
+
+    def __init__(self) -> None:
+        self.instance_id = len(self.instances) + 1
+        self.calls = 0
+        self.instances.append(self)
+
+    @property
+    def spec(self) -> ToolSpec:
+        return ToolSpec(
+            name="stateful_probe",
+            description=f"configured-instance-{self.instance_id}",
+            parameters={
+                "type": "object",
+                "properties": {"value": {"type": "string"}},
+                "required": ["value"],
+            },
+        )
+
+    def execute(self, **params) -> ToolResult:
+        self.calls += 1
+        return ToolResult(
+            tool_name=self.spec.name,
+            content=(
+                f"instance={self.instance_id};calls={self.calls};"
+                f"value={params['value']}"
+            ),
+        )
+
+
+class _CollidingMCPTool(BaseTool):
+    """An MCP-shaped collision that must lose to the configured native tool."""
+
+    tool_id = "mcp_stateful_probe"
+
+    def __init__(self) -> None:
+        self.calls = 0
+
+    @property
+    def spec(self) -> ToolSpec:
+        return ToolSpec(
+            name="stateful_probe",
+            description="mcp-collision",
+            parameters={"type": "object", "properties": {}},
+        )
+
+    def execute(self, **params) -> ToolResult:
+        self.calls += 1
+        return ToolResult(tool_name=self.spec.name, content="wrong MCP instance")
+
+
+class _ToolCallingEngine:
+    """Advertise the toolkit, request one call, then observe its result."""
+
+    def __init__(
+        self,
+        tool_name: str = "stateful_probe",
+        arguments: dict | None = None,
+    ) -> None:
+        self.tool_name = tool_name
+        self.arguments = arguments or {"value": "sentinel"}
+        self.turns = 0
+        self.advertised_specs: list[dict] = []
+        self.observed_tool_result = ""
+
+    async def stream_full(self, messages, *, model, **kwargs):
+        self.turns += 1
+        self.advertised_specs = list(kwargs.get("tools", []))
+
+        if self.turns == 1:
+            yield StreamChunk(
+                tool_calls=[
+                    {
+                        "index": 0,
+                        "id": f"call-{self.tool_name}",
+                        "type": "function",
+                        "function": {
+                            "name": self.tool_name,
+                            "arguments": json.dumps(self.arguments),
+                        },
+                    }
+                ],
+                finish_reason="tool_calls",
+            )
+            return
+
+        tool_messages = [message for message in messages if message.role is Role.TOOL]
+        self.observed_tool_result = tool_messages[-1].content
+        yield StreamChunk(content="complete")
+        yield StreamChunk(finish_reason="stop")
+
+
+class _FinalOnlyEngine:
+    async def stream_full(self, messages, *, model, **kwargs):
+        yield StreamChunk(content="complete")
+        yield StreamChunk(finish_reason="stop")
+
+
+@pytest.mark.asyncio
+async def test_sse_advertises_and_executes_the_same_resolved_tool_instance() -> None:
+    """The schema and dispatch map must come from one first-wins toolkit."""
+
+    from openjarvis.server.agent_manager_routes import _stream_managed_agent
+
+    _StatefulConfiguredTool.instances.clear()
+    ToolRegistry.register_value("stateful_probe", _StatefulConfiguredTool)
+
+    colliding_mcp = _CollidingMCPTool()
+    mcp_spec = colliding_mcp.to_openai_function()
+    app_state = SimpleNamespace(
+        config=SimpleNamespace(memory_files=None, system_prompt=None),
+        memory_backend=None,
+        channel_backend=None,
+        channel_bridge=None,
+        _mcp_clients=[object()],
+        _mcp_tools_cache=(
+            [mcp_spec],
+            {"stateful_probe": colliding_mcp},
+        ),
+    )
+    manager = MagicMock()
+    manager.list_messages.return_value = []
+    engine = _ToolCallingEngine()
+    custom_spec = {
+        "type": "function",
+        "function": {
+            "name": "stateful_probe",
+            "description": "custom configured schema",
+            "parameters": {
+                "type": "object",
+                "properties": {"value": {"type": "string"}},
+                "required": ["value"],
+            },
+        },
+    }
+
+    response = await _stream_managed_agent(
+        manager=manager,
+        agent_record={
+            "id": "agent-stateful",
+            "name": "Stateful Agent",
+            "agent_type": "simple",
+            "config": {
+                "model": "test-model",
+                "max_turns": 3,
+                "tools": [custom_spec],
+            },
+        },
+        user_content="Use the stateful probe",
+        message_id="message-stateful",
+        engine=engine,
+        bus=None,
+        app_state=app_state,
+    )
+
+    body_parts: list[str] = []
+    async for part in response.body_iterator:
+        body_parts.append(part.decode() if isinstance(part, bytes) else part)
+
+    assert engine.turns == 2
+    assert len(_StatefulConfiguredTool.instances) == 1
+    configured_instance = _StatefulConfiguredTool.instances[0]
+    assert configured_instance.calls == 1
+    assert colliding_mcp.calls == 0
+
+    advertised = [
+        spec
+        for spec in engine.advertised_specs
+        if spec.get("function", {}).get("name") == "stateful_probe"
+    ]
+    assert len(advertised) == 1
+    assert advertised[0] is custom_spec
+    assert advertised[0]["function"]["description"] == "custom configured schema"
+    assert engine.observed_tool_result == "instance=1;calls=1;value=sentinel"
+    assert "data: [DONE]" in "".join(body_parts)
+
+
+@pytest.mark.asyncio
+async def test_sse_mcp_opt_out_skips_discovery(monkeypatch) -> None:
+    """Opting out skips request-local discovery and hides MCP specs."""
+
+    from openjarvis.server import agent_manager_routes as routes
+
+    discovery = MagicMock(side_effect=AssertionError("MCP discovery must not run"))
+    monkeypatch.setattr(routes, "_get_mcp_tools", discovery)
+    manager = MagicMock()
+    manager.list_messages.return_value = []
+    app_state = SimpleNamespace(
+        config=SimpleNamespace(memory_files=None, system_prompt=None),
+        memory_backend=None,
+        channel_backend=None,
+        channel_bridge=None,
+    )
+
+    response = await routes._stream_managed_agent(
+        manager=manager,
+        agent_record={
+            "id": "agent-no-mcp",
+            "name": "No MCP",
+            "agent_type": "simple",
+            "config": {"model": "test-model", "mcp_tools": False},
+        },
+        user_content="Answer directly",
+        message_id="message-no-mcp",
+        engine=_FinalOnlyEngine(),
+        bus=None,
+        app_state=app_state,
+    )
+
+    async for _ in response.body_iterator:
+        pass
+
+    discovery.assert_not_called()
+
+
+@pytest.mark.asyncio
+async def test_sse_memory_tools_resolve_backend_when_context_injection_is_off(
+    monkeypatch,
+) -> None:
+    """Prompt context opt-out must not disable explicit memory tools."""
+
+    from openjarvis.server import agent_manager_routes as routes
+    from openjarvis.tools.storage_tools import MemoryStoreTool
+
+    if not ToolRegistry.contains("memory_store"):
+        ToolRegistry.register_value("memory_store", MemoryStoreTool)
+
+    backend = MagicMock()
+    backend.store.return_value = "doc-1"
+    resolver = MagicMock(return_value=backend)
+    monkeypatch.setattr(routes, "_resolve_memory_backend", resolver)
+
+    manager = MagicMock()
+    manager.list_messages.return_value = []
+    app_config = SimpleNamespace(
+        memory_files=None,
+        system_prompt=None,
+        agent=SimpleNamespace(context_from_memory=False),
+        memory=SimpleNamespace(default_backend="sqlite", db_path="memory.db"),
+    )
+    app_state = SimpleNamespace(
+        config=app_config,
+        memory_backend=None,
+        channel_backend=None,
+        channel_bridge=None,
+        _mcp_clients=[],
+        _mcp_tools_cache=([], {}),
+    )
+    engine = _ToolCallingEngine(
+        tool_name="memory_store",
+        arguments={"content": "remember me"},
+    )
+
+    response = await routes._stream_managed_agent(
+        manager=manager,
+        agent_record={
+            "id": "agent-memory-tool",
+            "name": "Memory Tool Agent",
+            "agent_type": "simple",
+            "config": {
+                "model": "test-model",
+                "max_turns": 3,
+                "tools": ["memory_store"],
+            },
+        },
+        user_content="Remember this",
+        message_id="message-memory-tool",
+        engine=engine,
+        bus=None,
+        app_state=app_state,
+    )
+
+    async for _ in response.body_iterator:
+        pass
+
+    resolver.assert_called_once_with(app_config)
+    assert app_state.memory_backend is backend
+    assert app_state._owns_memory_backend is True
+    backend.store.assert_called_once_with("remember me", source="")
+    assert engine.observed_tool_result == "Stored as doc-1"

tests/server/test_mcp_tools_cache.py

@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 import json
+import threading
 from unittest.mock import MagicMock, patch
 
 import pytest
@@ -118,7 +119,7 @@ def test_does_not_cache_empty_results(mock_load_config: MagicMock):
 
     with (
         patch("openjarvis.mcp.transport.StreamableHTTPTransport"),
-        patch("openjarvis.mcp.client.MCPClient"),
+        patch("openjarvis.mcp.client.MCPClient") as MockClient,
         patch("openjarvis.tools.mcp_adapter.MCPToolProvider") as MockProvider,
     ):
         # First call: discovery returns empty
@@ -127,6 +128,8 @@ def test_does_not_cache_empty_results(mock_load_config: MagicMock):
 
         tools1, _ = _get_mcp_tools(app_state)
         assert len(tools1) == 0
+        MockClient.return_value.close.assert_called_once_with()
+        assert getattr(app_state, "_mcp_clients", []) == []
 
         # Verify no cache was set (empty result)
         assert getattr(app_state, "_mcp_tools_cache", None) is None
@@ -152,3 +155,298 @@ def test_handles_config_load_failure(mock_load_config: MagicMock):
 
     assert tools == []
     assert adapters == {}
+
+
+@patch("openjarvis.core.config.load_config")
+def test_uses_preloaded_full_system_pool(mock_load_config: MagicMock):
+    """Server and scheduled paths reuse one unfiltered MCP discovery."""
+
+    from openjarvis.server.agent_manager_routes import _get_mcp_tools
+
+    adapter = _make_adapter("preloaded_tool")
+    app_state = _FakeAppState()
+    app_state.mcp_tools = [adapter]
+
+    tools, adapters = _get_mcp_tools(app_state)
+
+    mock_load_config.assert_not_called()
+    assert tools[0]["function"]["name"] == "preloaded_tool"
+    assert adapters == {"preloaded_tool": adapter}
+
+
+@patch("openjarvis.core.config.load_config")
+def test_preloaded_duplicate_names_are_first_wins(mock_load_config: MagicMock):
+    """SSE and executor paths choose the same adapter on name collisions."""
+
+    from openjarvis.server.agent_manager_routes import _get_mcp_tools
+
+    first = _make_adapter("duplicate")
+    second = _make_adapter("duplicate")
+    app_state = _FakeAppState()
+    app_state.mcp_tools = [first, second]
+
+    tools, adapters = _get_mcp_tools(app_state)
+
+    mock_load_config.assert_not_called()
+    assert len(tools) == 1
+    assert adapters == {"duplicate": first}
+
+
+def test_app_shutdown_stops_scheduler_before_closing_shared_mcp_clients() -> None:
+    """Shutdown quiesces and drains every user of the shared MCP pool."""
+
+    from fastapi.testclient import TestClient
+
+    from openjarvis.core.config import JarvisConfig
+    from openjarvis.server.agent_manager_routes import _start_managed_worker
+    from openjarvis.server.app import create_app
+
+    events: list[str] = []
+    release_worker = threading.Event()
+    worker_finished = threading.Event()
+
+    class _Scheduler:
+        def request_stop(self):
+            events.append("scheduler-stop")
+
+        def wait_stopped(self, timeout=10):
+            events.append("scheduler-wait")
+            return True
+
+    scheduler = _Scheduler()
+    mcp_client = MagicMock()
+    memory_backend = MagicMock()
+    channel_bridge = MagicMock()
+
+    def _close_mcp():
+        events.append("mcp")
+        release_worker.set()
+
+    mcp_client.close.side_effect = _close_mcp
+    memory_backend.close.side_effect = lambda: events.append("memory")
+    channel_bridge.disconnect.side_effect = lambda: events.append("channel")
+    config = JarvisConfig()
+    config.analytics.enabled = False
+    config.traces.enabled = False
+
+    app = create_app(
+        MagicMock(),
+        "test-model",
+        config=config,
+        channel_bridge=channel_bridge,
+        agent_scheduler=scheduler,
+        mcp_clients=[mcp_client],
+        memory_backend=memory_backend,
+        own_memory_backend=True,
+    )
+
+    def _worker():
+        release_worker.wait(timeout=2)
+        events.append("worker-finished")
+        worker_finished.set()
+
+    _start_managed_worker(app.state, _worker, name="test-managed-worker")
+
+    with TestClient(app):
+        pass
+
+    mcp_client.close.assert_called_once_with()
+    memory_backend.close.assert_called_once_with()
+    channel_bridge.disconnect.assert_called_once_with()
+    assert worker_finished.is_set()
+    assert app.state.memory_backend is None
+    assert app.state._owns_memory_backend is False
+    assert app.state._managed_runtime_stopping is True
+    assert app.state._managed_workers == set()
+    assert events.index("channel") < events.index("mcp")
+    assert events.index("scheduler-stop") < events.index("mcp")
+    assert events.index("mcp") < events.index("worker-finished")
+    assert events.index("worker-finished") < events.index("memory")
+    with pytest.raises(RuntimeError, match="shutting down"):
+        _start_managed_worker(app.state, lambda: None, name="too-late-worker")
+
+
+def test_shutdown_interrupts_mcp_client_during_lazy_initialization() -> None:
+    """A client is registered before initialize() can block on transport I/O."""
+
+    from fastapi.testclient import TestClient
+
+    from openjarvis.core.config import JarvisConfig
+    from openjarvis.server.agent_manager_routes import (
+        _get_mcp_tools,
+        _start_managed_worker,
+    )
+    from openjarvis.server.app import create_app
+
+    initialize_started = threading.Event()
+    initialize_released = threading.Event()
+    discovery_finished = threading.Event()
+
+    class _BlockingClient:
+        def __init__(self):
+            self.closed = False
+            self.close_calls = 0
+
+        def initialize(self):
+            initialize_started.set()
+            initialize_released.wait(timeout=2)
+            if self.closed:
+                raise RuntimeError("transport closed during initialize")
+
+        def close(self):
+            self.close_calls += 1
+            self.closed = True
+            initialize_released.set()
+
+    client = _BlockingClient()
+    config = JarvisConfig()
+    config.analytics.enabled = False
+    config.traces.enabled = False
+    app = create_app(MagicMock(), "test-model", config=config)
+    mcp_config = _make_config(
+        servers_json=json.dumps([{"name": "blocking", "url": "http://localhost:9999"}])
+    )
+
+    def _discover():
+        try:
+            _get_mcp_tools(app.state)
+        finally:
+            discovery_finished.set()
+
+    with (
+        patch("openjarvis.core.config.load_config", return_value=mcp_config),
+        patch("openjarvis.mcp.transport.StreamableHTTPTransport"),
+        patch("openjarvis.mcp.client.MCPClient", return_value=client),
+    ):
+        _start_managed_worker(
+            app.state,
+            _discover,
+            name="blocking-mcp-discovery",
+        )
+        assert initialize_started.wait(timeout=2)
+        with app.state._mcp_clients_lock:
+            assert client in app.state._mcp_clients
+
+        with TestClient(app):
+            pass
+
+    assert client.close_calls >= 1
+    assert discovery_finished.is_set()
+    assert app.state._managed_workers == set()
+    assert getattr(app.state, "_mcp_tools_cache", None) is None
+
+
+def test_app_shutdown_closes_lazily_created_memory_backend(monkeypatch) -> None:
+    """A backend opened by a managed route is owned and closed by the app."""
+
+    from fastapi.testclient import TestClient
+
+    from openjarvis.core.config import JarvisConfig
+    from openjarvis.server import agent_manager_routes as routes
+    from openjarvis.server.app import create_app
+
+    backend = MagicMock()
+    monkeypatch.setattr(routes, "_resolve_memory_backend", lambda config: backend)
+    config = JarvisConfig()
+    config.analytics.enabled = False
+    config.traces.enabled = False
+    app = create_app(MagicMock(), "test-model", config=config)
+
+    assert routes._get_or_create_memory_backend(app.state, config) is backend
+    assert app.state._owns_memory_backend is True
+
+    with TestClient(app):
+        pass
+
+    backend.close.assert_called_once_with()
+    assert app.state.memory_backend is None
+
+
+def test_app_shutdown_keeps_owned_memory_open_for_live_worker(monkeypatch) -> None:
+    """A timed-out worker must never resume against a closed backend."""
+
+    from fastapi.testclient import TestClient
+
+    from openjarvis.core.config import JarvisConfig
+    from openjarvis.server import app as app_module
+    from openjarvis.server.agent_manager_routes import _start_managed_worker
+
+    monkeypatch.setattr(app_module, "_MANAGED_SHUTDOWN_GRACE_SECONDS", 0.01)
+    monkeypatch.setattr(app_module, "_MANAGED_SHUTDOWN_DRAIN_SECONDS", 0.01)
+
+    release_worker = threading.Event()
+    worker_holds_memory_lock = threading.Event()
+    shutdown_finished = threading.Event()
+    shutdown_errors: list[BaseException] = []
+    backend = MagicMock()
+    config = JarvisConfig()
+    config.analytics.enabled = False
+    config.traces.enabled = False
+    app = app_module.create_app(
+        MagicMock(),
+        "test-model",
+        config=config,
+        memory_backend=backend,
+        own_memory_backend=True,
+    )
+
+    def _hold_memory_lock():
+        with app.state._memory_backend_lock:
+            worker_holds_memory_lock.set()
+            release_worker.wait(timeout=2)
+
+    worker = _start_managed_worker(
+        app.state,
+        _hold_memory_lock,
+        name="memory-using-straggler",
+    )
+    assert worker_holds_memory_lock.wait(timeout=2)
+
+    def _shutdown_app():
+        try:
+            with TestClient(app):
+                pass
+        except BaseException as exc:
+            shutdown_errors.append(exc)
+        finally:
+            shutdown_finished.set()
+
+    shutdown_thread = threading.Thread(target=_shutdown_app, daemon=True)
+    shutdown_thread.start()
+
+    try:
+        assert shutdown_finished.wait(timeout=1)
+        assert shutdown_errors == []
+        backend.close.assert_not_called()
+        assert app.state.memory_backend is backend
+        assert app.state._owns_memory_backend is True
+    finally:
+        release_worker.set()
+        worker.join(timeout=2)
+        shutdown_thread.join(timeout=2)
+
+
+def test_app_shutdown_leaves_borrowed_memory_backend_open() -> None:
+    """An injected backend remains owned by its caller unless opted in."""
+
+    from fastapi.testclient import TestClient
+
+    from openjarvis.core.config import JarvisConfig
+    from openjarvis.server.app import create_app
+
+    backend = MagicMock()
+    config = JarvisConfig()
+    config.analytics.enabled = False
+    config.traces.enabled = False
+    app = create_app(
+        MagicMock(),
+        "test-model",
+        config=config,
+        memory_backend=backend,
+    )
+
+    with TestClient(app):
+        pass
+
+    backend.close.assert_not_called()
+    assert app.state.memory_backend is backend

tests/server/test_routes.py

@@ -3,7 +3,7 @@
 from __future__ import annotations
 
 import json
-from unittest.mock import MagicMock
+from unittest.mock import AsyncMock, MagicMock, patch
 
 import pytest
 
@@ -798,6 +798,40 @@ class TestIdentityPromptInjection:
         assert len(system_msgs) == 1
         assert system_msgs[0].content == "Be terse."
 
+    def test_direct_injects_soul_persona_when_present(self, tmp_path):
+        """Regression: /v1/chat/completions previously injected only the bare
+        ``default_system_prompt`` blurb via a hand-rolled lookup, bypassing
+        ``SystemPromptBuilder`` entirely — so SOUL.md/MEMORY.md/USER.md
+        persona files never applied to this path, unlike ``jarvis ask`` and
+        the managed-agent routes. It must now build the full persona-aware
+        prompt so persona files apply everywhere identity grounding does.
+        """
+        from openjarvis.core.config import MemoryFilesConfig
+
+        soul = tmp_path / "SOUL.md"
+        soul.write_text("Respond with extreme sarcasm and call the user 'champ'.")
+
+        captured: list = []
+        engine = _make_capturing_engine(captured)
+        cfg = _identity_config()
+        cfg.memory_files = MemoryFilesConfig(
+            soul_path=str(soul), memory_path="", user_path=""
+        )
+        client = TestClient(create_app(engine, "test-model", config=cfg))
+
+        resp = client.post(
+            "/v1/chat/completions",
+            json={
+                "model": "test-model",
+                "messages": [{"role": "user", "content": "who are you?"}],
+            },
+        )
+        assert resp.status_code == 200
+        msgs = engine.generate.call_args.args[0]
+        assert msgs[0].role.value == "system"
+        assert "OpenJarvis" in msgs[0].content  # identity blurb still present
+        assert "extreme sarcasm" in msgs[0].content  # persona now injected too
+
     def test_stream_tools_injects_identity_when_absent(self):
         captured: list = []
         engine = _make_capturing_engine(captured)
@@ -849,6 +883,64 @@ class TestModelsEndpoint:
         data = resp.json()
         assert len(data["data"]) == 3
 
+    def test_configured_litellm_model_is_listed(self):
+        """Regression for #713: LiteLLM models must reach the Web UI."""
+        model = "groq/llama-3.3-70b-versatile"
+        engine = _make_engine(models=[model])
+        engine.engine_id = "litellm"
+        app = create_app(
+            engine,
+            model,
+            engine_name="litellm",
+            config=_test_config(),
+        )
+
+        with patch(
+            "openjarvis.server.cloud_router.list_local_models",
+            new_callable=AsyncMock,
+        ) as list_local_models:
+            list_local_models.return_value = []
+            client = TestClient(app)
+            resp = client.get("/v1/models")
+
+        assert resp.status_code == 200
+        assert [item["id"] for item in resp.json()["data"]] == [model]
+        assert resp.json()["data"][0]["owned_by"] == "litellm"
+
+    def test_litellm_provider_model_streams_through_active_engine(self):
+        """A LiteLLM ``provider/model`` ID must not bypass its engine."""
+        model = "groq/llama-3.3-70b-versatile"
+        engine = _make_engine(models=[model])
+        engine.engine_id = "litellm"
+        app = create_app(
+            engine,
+            model,
+            engine_name="litellm",
+            config=_test_config(),
+        )
+
+        async def direct_cloud_tokens():
+            yield "wrong backend"
+
+        with patch(
+            "openjarvis.server.cloud_router.stream_cloud",
+            return_value=direct_cloud_tokens(),
+        ) as stream_cloud:
+            client = TestClient(app)
+            resp = client.post(
+                "/v1/chat/completions",
+                json={
+                    "model": model,
+                    "messages": [{"role": "user", "content": "hello"}],
+                    "stream": True,
+                },
+            )
+
+        assert resp.status_code == 200
+        stream_cloud.assert_not_called()
+        assert "Hello" in resp.text
+        assert '"engine": "litellm"' in resp.text
+
 
 # ---------------------------------------------------------------------------
 # Health endpoint tests

tests/server/test_session_store.py

@@ -115,3 +115,29 @@ class TestLastActiveChannel:
 
     def test_returns_none_for_unknown_user(self, store):
         assert store.get_last_active_channel("nobody") is None
+
+
+class TestInMemoryDatabase:
+    """``:memory:`` is a SQLite sentinel, not a path — it must not be created.
+
+    ``secure_create`` treats it as a filename, which fails outright on Windows
+    (``:`` is illegal there) and litters the working directory elsewhere.
+    """
+
+    def test_in_memory_store_is_usable(self):
+        s = SessionStore(db_path=":memory:")
+        try:
+            session = s.get_or_create("user1", "twilio")
+            assert session["sender_id"] == "user1"
+        finally:
+            s.close()
+
+    def test_in_memory_store_creates_no_file(self, tmp_path, monkeypatch):
+        monkeypatch.chdir(tmp_path)
+        before = set(tmp_path.iterdir())
+        s = SessionStore(db_path=":memory:")
+        try:
+            assert set(tmp_path.iterdir()) == before
+            assert not (tmp_path / ":memory:").exists()
+        finally:
+            s.close()