From a6c209a84f03a8c2d6a2b8981dcb5f15744c9db1 Mon Sep 17 00:00:00 2001 From: Viet Tran Date: Fri, 10 Apr 2026 20:50:50 +0700 Subject: [PATCH] Release: vault improvements, MCP reconnect, cron fixes, Facebook/Pancake channels (#822) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * fix(ci): skip CI condition in semantic-release for main branch go-semantic-release auto-detects the default branch from GitHub API (which is dev), but releases are cut from main. The CI condition rejects runs on non-default branches. Use --no-ci to bypass this check since the workflow already gates on push to main. * docs: document CI/CD pipelines, release flow, and v2.66.0 changelog - CLAUDE.md: add CI/CD & Releases section with workflow table, tag patterns, Docker variants, beta/desktop release commands - CONTRIBUTING.md: expand Releases section with standard (auto), beta (manual tag), and desktop release workflows - docs/17-changelog.md: add v2.66.0 entry covering IDOR fix, BytePlus provider, per-agent grants, beta pipeline, and CI fixes * fix(telegram): handle group-to-supergroup migration seamlessly When a Telegram group upgrades to a supergroup, the chat ID changes and all existing references become stale. This caused send failures (400), orphaned sessions, and required manual re-pairing. Add dual-path migration handling: - Proactive: intercept inbound MigrateToChatID before isServiceMessage - Reactive: detect 400 + MigrateToChatID on send, migrate DB, retry DB migration updates in a single transaction (scoped by tenant + channel): - paired_devices: sender_id, chat_id - sessions: session_key, user_id - channel_contacts: sender_id - channel_pending_messages: history_key Also invalidates in-memory caches (approvedGroups, pairingReplySent, groupHistory) and handles media sends via migration retry in Send(). * fix(tools): quote-aware shell operator detection in credentialed exec (#700) (#702) * fix(tools): quote-aware shell operator detection in credentialed exec (#700) - Replace detectShellOperators with detectUnquotedShellOperators in credentialed exec path — respects single/double quoting so that characters like | inside argument values (e.g. --jq '.[0] | .name') are not falsely flagged as shell operators - Pass raw command string (preserving quotes) to executeCredentialed instead of reconstructing from parsed args - Downgrade "no credential found" log from Warn to Debug (fires for every non-credentialed command, too noisy at Warn) - Add extractUnquotedSegments() helper with comprehensive tests * fix(tools): handle backslash escape outside quotes in shell operator detection extractUnquotedSegments did not handle \ as an escape character outside of quotes, causing \" to incorrectly enter double-quote mode. This hid subsequent shell operators from detection (e.g. gh \"arg\" | env would not detect the unquoted pipe). Add backslash escape handling in the unquoted state to match go-shellwords parsing behavior. Both \ and the escaped character are emitted as unquoted content so operator detection still catches them. --------- Co-authored-by: viettranx * feat(infra): tracing recovery, browser cleanup, CLI fixes, UI workspace split (#709) - Tracing: recover stale running traces/spans on startup (PG + SQLite) - Browser: Chrome orphan cleanup via launcher PID, timeouts, Leakless - Claude CLI: WaitDelay 5s + context-cancel early exit - Agent loop: safety-net defer to finalize orphan root traces - UI: split workspace sharing into separate Memory and KG toggles - Minor: for-range idiom, min() builtin * fix(prompt): skip credentialed CLI context when exec tool is denied Agents with exec in their deny list cannot run CLI commands, so injecting wrangler/gh credential context is misleading — the LLM sees instructions for tools it cannot use. Gate the section on exec being present in the filtered tool list. * fix(ui): improve traces table layout and readability Compact columns: status as icon-only, merge time+duration into one column. Truncate long user IDs, clean tags from preview, move badges to second line. * fix(security): harden exec path exemption matching - Add absolute path exemption for dataDir/skills-store/ (fixes skill scripts using absolute paths like /app/data/skills-store/ being denied) - Strip surrounding quotes before prefix matching (LLMs often quote paths) - Reject path traversal ("..") in exempt fields to prevent escape - Switch from "any field exempt → skip" to per-field matching: only exempt if ALL fields that match the deny pattern are individually exempt - Closes pipe/comment bypass vectors where an exempt path in one argument would exempt the entire command including non-exempt paths Includes 27 test cases covering: legitimate access, quoted paths, path traversal, unicode bypass, pipe/comment bypass, mixed args. * feat(whatsapp): add native WhatsApp channel with whatsmeow (#720) Replace Node.js Baileys bridge with native go.mau.fi/whatsmeow — zero external dependencies. QR auth, media support, markdown formatting, typing indicators, dual JID/LID identity, group policies, pairing. Resolves #703 * fix(chat): load message history on first conversation click (#730) * fix(chat): load message history when selecting existing conversation from clean state The skipNextHistoryRef was unconditionally set when sessionKey transitioned from empty to non-empty. This prevented loadHistory() from running when clicking an existing conversation from the initial /chat page. The skip was only intended for the new-chat send flow where the optimistic message is already displayed. Guard the skip with expectingRunRef so it only activates when a message send is in flight. Closes #729 * docs: add UI diff evidence for PR #730 Before/after screenshots and HTML comparison report showing first conversation click behavior fix. * fix(permissions): use cron-specific permission check for cron tool (#725) * fix(security): harden exec path exemption matching (#721) - Add absolute path exemption for dataDir/skills-store/ (fixes skill scripts using absolute paths like /app/data/skills-store/ being denied) - Strip surrounding quotes before prefix matching (LLMs often quote paths) - Reject path traversal ("..") in exempt fields to prevent escape - Switch from "any field exempt → skip" to per-field matching: only exempt if ALL fields that match the deny pattern are individually exempt - Closes pipe/comment bypass vectors where an exempt path in one argument would exempt the entire command including non-exempt paths Includes 27 test cases covering: legitimate access, quoted paths, path traversal, unicode bypass, pipe/comment bypass, mixed args. * fix(permissions): use cron-specific permission check for cron tool Cron tool was hardcoded to check `file_writer` configType via CheckFileWriterPermission(), ignoring the `cron` configType that the UI actually saves when granting cron permissions. This caused agents in group chats to be denied cron access even with correct permission configured. Add ConfigTypeCron constant and CheckCronPermission() that checks `cron` configType first, falling back to `file_writer`. --------- Co-authored-by: Viet Tran * fix(exec): allow uploaded files in active workspaces (#748) Shell-aware command parsing, dynamic workspace exemptions, and symlink canonicalization for exec path denial. Fixes #739. * refactor(exec): extract path exemption logic to separate file Move shell-aware parsing, dynamic workspace exemptions, path alias variants, and canonicalization functions from shell.go (688 LOC) to shell_path_exemption.go (284 LOC) for maintainability. * feat(agent): centralized tenant user identity resolution for credentials Add CredentialUserID context key that resolves channel contacts to merged tenant users for credential lookups (SecureCLI, MCP). Keeps UserID unchanged for session/workspace scoping. Resolves group senders, group contacts, and unresolved DMs via ContactStore with 60s TTL cache. * fix(ui): improve traces table column layout Add width constraints and whitespace-nowrap to prevent column wrapping on narrow viewports. Cherry-picked from dev-v3. * fix(ui): enable search filtering on knowledge graph view (#758) Search box on /knowledge-graph only filtered table view. Add useMemo client-side filtering of graph entities by name/type/description, only show relations where both endpoints match. Closes #759 * feat: add zoom controls to knowledge graph (#757) Add +/- buttons and percentage display to the knowledge graph stats bar so users can zoom without relying solely on mouse wheel. Uses existing react-force-graph-2D zoom() API with 1.5x step and 300ms animation. Closes #755 Co-authored-by: Claude Opus 4.6 * fix(providers): use DB name for ClaudeCLI, ACP, and Anthropic registration Provider Name() methods returned hardcoded strings, so DB-registered providers with custom names got wrong registry key — causing "provider not found" fallback. Add WithClaudeCLIName/WithACPName/WithAnthropicName options, pass p.Name from DB registration paths. Config-based paths keep hardcoded defaults. Closes #742 * fix(agent): correct soft-trim head/tail budget allocation when tail is important (#723) Co-authored-by: quxy5 * feat(v3): core architecture redesign — pipeline, memory, vault, evolution, providers, orchestration (#790) * feat(v3): add core interface contracts and migration for v3 redesign Foundation interfaces: TokenCounter, WorkspaceContext, DomainEventBus, ProviderAdapter/Capabilities. Pipeline: Stage, RunState, MessageBuffer, substates, Pipeline orchestrator. Memory: EpisodicStore, AutoInjector, KG temporal extensions, consolidation workers. System integration: PromptConfig, ToolCapability, Retriever. Orchestration: OrchestrationMode, EvolutionMetrics/SuggestionStore. Migration 000037: episodic_summaries, evolution tables, KG temporal columns. Schema version 36→37. * refactor(plans): mark all v3 design phases complete with file references * fix(v3): address code review findings on design contracts - C1: add missing l0_abstract column to episodic_summaries migration - C2: align EpisodicSummary ID/TenantID/AgentID to uuid.UUID - H1: document tenant_id scoping requirement on EpisodicStore - H2: add UNIQUE constraint on (agent_id, user_id, source_id) for dedup - H4: clarify ProviderAdapter vs Provider relationship in doc - M3: set state.ExitCode on BreakLoop/AbortRun in pipeline - M6: store full PipelineConfig in Pipeline struct - Edge: add WHERE embedding IS NOT NULL on HNSW index * fix(v3): second-pass review fixes - H1: use context.WithoutCancel for finalize + set ExitCode on ctx cancel - H2: use utf8.RuneCountInString consistently in FallbackCounter - H3: longest-prefix-match in ModelContextWindow (prevents wrong tokenizer) - H4: return unsubscribe cleanup func from consolidation.Register * feat(v3): implement DomainEventBus with worker pool, dedup, and retry Worker pool processes events from buffered channel. SourceID-based dedup prevents duplicate processing. Exponential backoff retry on handler error. Panic recovery per handler. Graceful shutdown via Drain(). 8/8 tests pass with race detector. * feat(v3): implement ProviderAdapter for Anthropic, OpenAI, DashScope, Codex Add CapabilitiesAware to all 6 providers. Create ProviderAdapter implementations that delegate to existing buildRequestBody/parseResponse for DRY. ClaudeCLI and ACP get capabilities only (subprocess transport). DashScope wraps OpenAI adapter with StreamWithTools=false override. * feat(v3): implement WorkspaceContext Resolver for 6 scenarios Stateless resolver produces immutable WorkspaceContext at run start. Handles personal/group/predefined/team-shared/team-isolated/delegation. Wired into loop_context.go behind v3PipelineEnabled flag (additive, v2 path unchanged). Includes delegation path boundary check, master tenant bypass, and tenant slug path composition. * feat(v3): implement tiktoken TokenCounter with BPE encoding + cache Adds tiktoken-go for accurate cl100k_base/o200k_base token counting. Per-message FNV-1a hash cache avoids re-encoding unchanged history. Falls back to rune/3 heuristic for unknown models. NewTokenCounter factory selects implementation at build time. * feat(v3): promote 12 other_config JSONB fields to dedicated agent columns Extract emoji, agent_description, thinking_level, max_tokens, self_evolve, skill_evolve, skill_nudge_interval, reasoning_config, workspace_sharing, chatgpt_oauth_routing, shell_deny_groups, and kg_dedup_config from the catch-all other_config JSONB into proper columns with DB-level types and defaults. - Migration: PG (000037) + SQLite (schema v6→7) with backfill - Go: AgentData struct + simplified Parse* methods - Store: SELECT/INSERT/scan updated for both PG and SQLite - Gateway: create/update handlers accept promoted fields - HTTP: export/import with legacy backward compat - Web UI: all 15 frontend files read/write from top level * feat(v3): implement Knowledge Vault with unified search, wikilinks, and FS sync Migration 000038 adds vault_documents (FTS+pgvector), vault_links, vault_versions tables. VaultStore interface with PG implementation for document CRUD, hybrid FTS+vector search, and bidirectional link management. All queries enforce tenant_id isolation including JOIN-based scoping on link operations. FS sync layer: SHA-256 content hashing, VaultInterceptor hooks into write_file/ read_file for auto-registration and lazy sync, fsnotify watcher with 500ms debounce. Wikilink engine parses [[target]] syntax, resolves targets via 3-step strategy, and maintains vault_links on write. VaultSearchService fans out queries across vault, episodic, and KG stores in parallel with per-source score normalization and weighted merge. AutoInjector and Retriever implementations for pipeline integration. Three agent tools: vault_search (unified discovery), vault_link (explicit linking), vault_backlinks (dependency tracing). Feature-flagged via v3_vault_enabled agent setting. * feat(v3): wire vault into gateway startup + add unit tests Wire VaultStore embedding provider, VaultSearchService, VaultInterceptor on read/write tools, and register vault_search/vault_link/vault_backlinks tools in gateway_vault_wiring.go. All wiring gated by stores.Vault != nil. Add 28 unit tests for ContentHash, ContentHashFile, and ExtractWikilinks covering edge cases, unicode, display text, context windows, and offsets. * feat(v3): implement stage-based pipeline loop with 8 pluggable stages Decompose monolithic agent loop into internal/pipeline/ package: - 6 stages: Context, Think, Prune+MemoryFlush, Tool, Observe+Checkpoint, Finalize - Foundation types: Stage interface, RunState with 7 typed substates, MessageBuffer - Pipeline orchestrator with setup/iteration/finalize 3-phase execution - Callback-based PipelineDeps avoids circular import with agent package - Feature-flagged via v3PipelineEnabled in Loop.Run() - All 7 exit conditions preserved (no tools, max iter, truncation, loop kill, read-only streak, tool budget, ctx cancel) * feat(v3): wire pipeline callbacks to Loop methods + add 71 unit tests Wire 15 of 17 PipelineDeps callbacks from Loop methods via closures: - Context: LoadContextFiles, BuildMessages, EnrichMedia, InjectReminders - Think: BuildFilteredTools, CallLLM (stream/sync) - Prune: PruneMessages, CompactMessages - Memory: RunMemoryFlush - Finalize: SanitizeContent, FlushMessages, UpdateMetadata, BootstrapCleanup, MaybeSummarize - Remaining: ExecuteToolCall, CheckReadOnly (deep loop.go integration) Add comprehensive test suite (71 tests, all passing with -race): - MessageBuffer: 10 tests (append, flush, replace, counts) - Pipeline.Run: 14 tests (3-phase flow, exit conditions, ctx cancel) - Stage tests: 47 tests (ThinkStage nudges/truncation, PruneStage budget, ToolStage parallel/exit, ObserveStage content, CheckpointStage interval, FinalizeStage cleanup) * feat(v3): wire remaining 2 callbacks (ExecuteToolCall, CheckReadOnly) Complete callback wiring — 17/17 PipelineDeps callbacks now active: - ExecuteToolCall: resolves tool name, executes via registry, processes result via existing processToolResult with loop detection bridge - CheckReadOnly: delegates to checkReadOnlyStreak via bridge runState - Bridge runState shares loop detection state between pipeline and agent * fix(v3): eliminate data race in tool execution + capture injected messages - Remove parallel tool execution path — serialize all tool calls to avoid data races on shared bridgeRS (loop detector, media results, deliverables) - Loop kill checked after each tool (mid-batch early exit) - BuildFilteredTools: capture and append injected tool-awareness messages - Rename test to reflect sequential execution * feat(v3): wire ResolveWorkspace, safe parallel tools, ContextStage tests - Wire ResolveWorkspace callback via workspace.NewResolver() with ResolveParams from Loop fields (no longer a nil stub) - Re-add safe parallel tool execution: split into ExecuteToolRaw (parallel I/O) + ProcessToolResult (sequential state mutation) with opaque rawData pass-through (no double execution) - Add 12 unit tests for ContextStage (8) + MemoryFlushStage (3) - Split tool callbacks to loop_pipeline_tool_callbacks.go (under 200 lines) - Capture buildFilteredTools injected messages * feat(v3): add episodic memory store + temporal KG columns Phase 1 — Episodic Store: - Migration 000039: episodic_summaries table with pgvector, FTS, L0 abstracts - EpisodicStore PG impl: CRUD, hybrid FTS+vector search, ExistsBySourceID, PruneExpired. Idempotent via source_id UNIQUE constraint. Phase 2 — Temporal KG: - Migration 000040: valid_from/valid_until on kg_entities + kg_relations, partial indexes for current-facts queries, epoch→timestamptz backfill - ListEntitiesTemporal: current-only, point-in-time, or include-expired modes - SupersedeEntity: atomic expire-old + insert-new in single transaction Schema version bumped to 40. * fix(v3): review fixes for episodic store + temporal KG - C1: Fix column name mismatch turn_count vs message_count in Go SQL - C2: Remove redundant migration 000040 (000037 already adds temporal KG columns) - H1: Use time.Time not int64 for TIMESTAMPTZ columns in SupersedeEntity - H2: Add tenant_id scoping to Get/Delete for tenant isolation - M2: Fix scanEntityTemporal to convert TIMESTAMPTZ→UnixMilli correctly - L1: Remove unused uuid import from episodic_search.go - Schema version corrected to 39 (only 000039 is new) * feat(v3): implement consolidation pipeline with 3 event-driven workers Event chain: session.completed → EpisodicWorker → episodic.created → SemanticWorker → entity.upserted → DedupWorker - EpisodicWorker: reuses compaction summary or calls LLM, generates L0 abstract (extractive), idempotent via source_id check - SemanticWorker: extracts KG facts from episodic summary via existing Extractor, sets temporal valid_from, publishes entity.upserted - DedupWorker: runs DedupAfterExtraction on new entity IDs (terminal) - L0 abstract: sentence-based extraction (~50 tokens), no LLM needed - All workers registered via DomainEventBus.Subscribe() * feat(v3): implement progressive loading with L0 auto-inject + unified search - AutoInjector: searches episodic store, builds L0 prompt section (~200 tokens), skips trivial messages via stopword filter - L1Cache: in-memory LRU (500 entries, 1h TTL) for structured overviews - UnifiedSearch: cross-tier search merging episodic + document results by score - ContextStage integration: AutoInject callback appends memory section to system prompt - MemorySection field added to ContextState for observability * feat(v3): add memory_expand tool for L2 episodic retrieval New tool: memory_expand(id) returns full episodic summary with metadata. Complements memory_search L0/L1 results with deep L2 access. Nil-safe: returns error message when episodic store not available. Gateway wiring + memory_search depth param + kg_search temporal param deferred to runtime integration phase. * feat(v3): complete Phase 5 — tool extensions + gateway wiring - memory_search: add depth param + episodic tier search merged with docs - kg_search: add as_of temporal param, use ListEntitiesTemporal - memory_expand: registered in gateway startup - Gateway: Episodic field in Stores, PGEpisodicStore in factory, embedding provider wired, tools connected to episodic store * fix(v3): Phase 3 review fixes — tenant isolation + AutoInject args - C1: Add tenant_id filter to ftsSearch, vectorSearch, List queries (prevents cross-tenant episodic memory leaks) - C2: Fix AutoInject callback signature — agent/tenant captured by closure, only userMessage + userID passed explicitly - H1: Add tenant_id to List query * feat(v3): wire per-agent v3 flags from DB into dual-mode gate Parse v3_pipeline_enabled, v3_memory_enabled, v3_retrieval_enabled from agent other_config JSONB via ParseV3Flags(). Resolver now sets all flags on LoopConfig so the existing gate in loop_run.go reads from DB. - V3Flags struct + ParseV3Flags() + ValidateV3Flags() in store layer - v3MemoryEnabled/v3RetrievalEnabled added to Loop, LoopConfig, PipelineConfig - Auto-inject gated on V3RetrievalEnabled (was unconditional) - Structured perf logging for v3 pipeline runs - v3 flag validation on both WS agent.update and HTTP PUT endpoints * feat(v3): wire AutoInjector into pipeline for L0 memory auto-inject Create AutoInjector at gateway startup from episodic store, pass through ResolverDeps → LoopConfig → Loop. Pipeline adapter builds AutoInject callback capturing agent/tenant context via closure. ContextStage already gates on V3RetrievalEnabled + AutoInject != nil. * feat(v3): add tool metadata map + capability-based deny rules Registry gains per-tool ToolMetadata map with RegisterWithMetadata() and GetMetadata() (infers defaults from tool name when not explicit). PolicyEngine gains DenyCapability() for RBAC integration — tools with denied capabilities filtered at step 8 after existing 7-step pipeline. * fix(v3): add RWMutex to PolicyEngine capability deny fields DenyCapability() and SetRegistry() now guarded by sync.RWMutex. FilterTools reads snapshot under RLock. Prevents data race when capability rules are modified concurrently with tool filtering. * feat(v3): implement delegate tool for inter-agent task delegation New `delegate` tool wraps existing agent_links infrastructure (CanDelegate, DelegateTargets). Supports async (fire-and-forget) and sync (block with timeout) modes. Permission checked via AgentLinkStore. Events emitted: delegate.sent/completed/failed. DelegateRunFunc injected by gateway to avoid circular dependency. * feat(v3): complete 3 deferred implementations 1. OrchestrationMode resolution: ResolveOrchestrationMode() checks team membership → delegate links → spawn (priority order). 2. PG EvolutionMetricsStore: RecordMetric, QueryMetrics, aggregate tool/retrieval metrics, TTL cleanup. All queries tenant-scoped. 3. BridgePromptBuilder: implements PromptBuilder interface by delegating to existing BuildSystemPrompt(). Appends v3 memory L0 section when enabled. Ready for template engine swap later. * fix(v3): address code review findings on commits 5-6 - C1: CanDelegate now tenant-scoped (fail-closed on missing tenant) - H1: Sync delegate timeout capped at 600s - H2: Async goroutine gets 10min deadline (prevents leaks) - H3: JSONB casts use COALESCE/NULLIF guards (handles missing fields) - M1/M2: Remove dead code (formatVaultSection, memoryL0ToStrings) * fix(teams): stop auto-creating agent_links for team members Teams use agent_team_members table directly — agent_links caused context confusion between team dispatch and delegation systems. - Remove autoCreateTeamLinks() calls from team create + member add - Remove link cleanup from member remove - Remove dead autoCreateTeamLinks() function - Append DELETE to migration 000039: clear team-created agent_links * fix(v3): tenant isolation for all agent_links queries + PromptBuilder Instructions - DelegateTargets, GetLinkBetween, SearchDelegateTargets, SearchDelegateTargetsByEmbedding, DeleteTeamLinksForAgent all now scoped by tenant_id (fail-closed on missing tenant) - BridgePromptBuilder now maps Instructions/InstructionContent to AGENTS.md context file (was silently dropped) * feat(v3): wire orchestration mode + evolution metrics into agent loop - Orchestration mode: resolver resolves mode from team/links, tool filter hides delegate/team_tasks based on mode, prompt builder injects delegation targets section - Evolution metrics: non-blocking goroutine records tool execution metrics (name, success, duration) via EvolutionMetricsStore in both v2 loop and v3 pipeline paths (sequential + parallel) - Fix review findings: tenant ID propagated via store.WithTenantID in background goroutine, 5s timeout prevents goroutine leak * feat(v3): implement suggestion engine with pluggable analysis rules - PG EvolutionSuggestionStore: CRUD for agent_evolution_suggestions table - SuggestionEngine: aggregates 7-day metrics, runs rules, deduplicates pending suggestions per type before creating new ones - 3 initial rules: LowRetrievalUsage (usage_rate<0.2), ToolFailure (success_rate<0.1), RepeatedTool (>100 calls/week → suggest skill) - EventSuggestionCreated event type added to eventbus - Cron wiring deferred to gateway startup integration pass * feat(v3): implement auto-adapt guardrails with apply/rollback - AdaptationGuardrails: max delta per cycle, min data points, locked params, rollback-on-drop percentage - ApplySuggestion: applies threshold suggestions to agent other_config JSONB, stores baseline for rollback - RollbackSuggestion: restores baseline values from suggestion params - EvaluateApplied: compares post-apply metrics to baseline, auto-rolls back when quality drops beyond threshold - Scope limited to retrieval params only (never security settings) * feat(v3): wire evolution stores + daily/weekly cron for suggestions - Add EvolutionMetrics + EvolutionSuggestions to Stores struct + PG factory - Wire EvolutionMetricsStore into ResolverDeps (cmd/gateway_managed.go) - Add gateway_evolution_cron.go: daily suggestion analysis + weekly evaluation/rollback for applied suggestions - Cron runs as background goroutine with 5-min timeout per cycle * fix(v3): address code review findings on evolution engine - C1: persist baseline parameters before marking suggestion as applied (was building map but never saving — rollback would always fail) - H1: add tenant_id isolation to UpdateSuggestionStatus, GetSuggestion, and new UpdateSuggestionParameters method * test(v3): add unit tests for orchestration, suggestions, guardrails, prompt - orchestration_mode_test: orchModeDenyTools (4 modes) + ResolveOrchestrationMode (4 scenarios with mock stores) - suggestion_rules_test: LowRetrievalUsage, ToolFailure, RepeatedTool with threshold boundary tests (at/below/above min data points) - evolution_guardrails_test: DefaultGuardrails values + CheckGuardrails (insufficient data, locked params, zero-min fallback) - prompt_builder_orchestration_test: BridgePromptBuilder orchestration section presence/absence across 4 scenarios + target content verification * test(v3): add integration tests for evolution metrics + suggestions - Test helper: shared PG connection with sync.Once migration, per-test tenant+agent seed with cleanup - Evolution metrics: RecordMetric, AggregateToolMetrics (success rate), Cleanup (TTL deletion) - Evolution suggestions: full CRUD, UpdateSuggestionParameters (baseline persist), tenant isolation (cross-tenant read blocked) - Pipeline E2E: seed 25 failed tools + 55 low-usage retrievals, verify SuggestionEngine creates suggestions, verify dedup on second run - Fix: migration 039 de-duped (episodic_summaries already in 037) - Fix: NULL reviewed_by scan via sql.NullString * feat(v3): add HTTP API handlers for evolution, vault, episodic, orchestration, v3-flags 5 new handler files exposing v3 backend stores as REST endpoints: - evolution_handlers.go: metrics query/aggregate + suggestions CRUD - vault_handlers.go: cross-agent document listing + search + links - episodic_handlers.go: episodic summaries list + hybrid search - orchestration_handlers.go: computed mode + delegate targets (read-only) - v3_flags_handlers.go: per-agent v3 feature flag get/toggle Store fixes from code review: - episodic FTS: use inline to_tsvector (no stored tsv column) - episodic: conditional user_id filter in List + Search (admin view) - episodic: add tenant_id to ExistsBySourceID + PruneExpired - evolution: require tenant_id in context (no struct fallback) - evolution: check RowsAffected on suggestion updates - vault: optional agent_id filter in ListDocuments (cross-agent) * feat(v3): add web UI for evolution tab, v3 settings, vault page, episodic memory Agent Detail enhancements: - V3 Settings section: pipeline/memory/retrieval flag toggles - Orchestration section: mode badge + delegate targets display - Evolution section: added metrics + suggestions v3 flag toggles - Evolution tab: Recharts metrics charts + suggestion review table with approve/reject/rollback actions + guardrails card New pages: - /vault: Knowledge Vault document registry with cross-agent listing, hybrid search dialog, document detail with wikilinks - Memory page: added Episodic Memory tab with summary cards, expandable details, key topic badges, and hybrid search Infrastructure: - HttpClient: added patch() method - Query keys: v3Flags, orchestration, evolution namespaces - 4 new hooks: use-v3-flags, use-orchestration, use-evolution-metrics, use-evolution-suggestions, use-vault, use-episodic - i18n: vault namespace (en/vi/zh), agents + memory keys updated - Reused formatRelativeTime from lib/format.ts (eliminated 3 duplicates) * refactor(http): add bindJSON helper and migrate all decode call sites Replace 36 json.NewDecoder(r.Body).Decode + error blocks with bindJSON across 20 HTTP handler files. Standardizes decode error responses to structured writeError format. Fixes unchecked decode in handleIndexAll. * refactor(store): adopt sqlx for PG scan operations (Phase 1+2) Add jmoiron/sqlx v1.4.0 with camelToSnake json tag mapper. Migrate scan-heavy PG store methods to sqlx Get/Select: - tracing.go: GetTrace, ListTraces, ListChildTraces, GetTraceSpans, GetCostSummary - heartbeat.go: Get, ListDue, ListLogs - providers.go: GetProvider, GetProviderByName, ListProviders, ListAllProviders - mcp_servers.go: GetServer, GetServerByName, ListServers - pairing.go: ListPending, ListPaired - agents_export_queries.go: 5 export functions - agents_export_team_queries.go: exportTeamMembers, ExportAgentLinks All writes (INSERT/UPDATE/DELETE), execMapUpdate, and dynamic WHERE builders remain raw SQL. Zero behavior change. * refactor(store): adopt sqlx for SQLite scan operations (Phase 3) Migrate SQLite store scan methods to sqlx Get/Select: - providers.go: GetProvider, GetProviderByName, ListProviders, ListAllProviders - tenants.go: GetTenant, GetTenantBySlug, ListTenants, GetTenantUser, ListUsers, ListUserTenants - mcp_servers.go: GetServer, GetServerByName, ListServers Create sqlx_scan_structs.go with sqliteTime-aware scan structs (providerRow, tenantRow, tenantUserRow, mcpServerRow) to handle SQLite TEXT timestamp parsing via StructScan. * refactor(store): migrate PG bulk scan operations to sqlx (Phase 4) Migrate scan-heavy methods across 6 PG store files: - tenant_store.go: GetTenant, GetTenantBySlug, ListTenants, GetTenantUser, ListUsers, ListUserTenants — removed 3 scan helpers - teams.go: ListTeams, GetTeam, ListMembers, ListMembersByTenant - teams_tasks_activity.go: ListComments, ListEvents, ListFollowUps - pending_message_store.go: ListPending, ListByHistoryKey - skills_grants.go: ListAgentGrants - config_permissions.go: CheckPermission ~20 scan ops converted. Files with encryption post-processing, pq.Array, pgvector, or dynamic SQL kept raw. * refactor(store): extract shared CamelToSnake mapper, add UUIDArray usage note - Move camelToSnake to internal/store/column_mapper.go (DRY) - Both pg and sqlitestore packages now import shared CamelToSnake - Add planned-use comment on UUIDArray type * refactor(cli): migrate commands from config.json to HTTP API, add providers/setup/TUI - Add unified HTTP client (gateway_http_client.go) with auth, error parsing, typed generics - Rewrite agent list/add/delete to use gateway HTTP API instead of config.json - Rewrite channels list to HTTP API, add channels add/delete subcommands - Replace models command with full providers CRUD (list/add/update/delete/verify) - Add setup wizard command (provider → agent → channel post-onboard flow) - Add Bubble Tea TUI behind build tag (tui/!tui with noop fallback) - Update onboard next-steps to mention goclaw setup - Add build-tui Makefile target - Fix URL path injection (url.PathEscape on all user-supplied path segments) - Fix UTF-8 truncation in skills description display * refactor(store): add explicit db struct tags, fix sqlx mapper for heartbeat scan error Switch sqlx mapper from NewMapperFunc (which only applies CamelToSnake to field names, not tag values) to NewMapperFunc("db", CamelToSnake) with explicit db:"column_name" tags on all store structs. Root cause: NewMapperFunc("json", fn) sets mapFunc but not tagMapFunc, so camelCase json tags like "agentId" were used as-is instead of being converted to "agent_id", causing "missing destination name" scan errors. Fix: use db struct tags as the source of truth for column mapping. Every DB entity field gets db:"column_name", nested JSON configs and runtime-only structs get db:"-". * test(store): add integration tests for 13 store interfaces (70 tests) Cover Tier 1 (critical) + Tier 2 (security) stores with integration tests running against pgvector pg18. Coverage from 2.4% to ~54%. Stores tested: Session, Agent, Team/Task, Memory, KnowledgeGraph, Vault, MCP Server, API Key, ConfigPermission, Contact. Infrastructure: fixture builders (seedTeam, seedMCPServer, etc.), mock EmbeddingProvider, multi-tenant helpers, expanded cleanup. * fix(store): resolve NULL scan bugs in MCP server and task metadata - mcp_servers: COALESCE nullable TEXT columns (display_name, command, url, api_key, tool_prefix) to prevent sqlx scan failures - mcp_servers_access: COALESCE nullable JSONB columns in ListAgentGrants (tool_allow, tool_deny, config_overrides) to prevent silent row drops - teams_tasks: default task metadata to '{}' instead of nil to satisfy NOT NULL constraint on CreateTask - sqlx_helpers: export InitSqlx for integration test setup * feat(pipeline): fix v3 pipeline context injection, tracing, KG temporal filters - Pipeline context: add InjectContext + LoadSessionHistory callbacks to ContextStage, propagate enriched ctx via state.Ctx for iteration stages - Pipeline tracing: wrap makeCallLLM with emitLLMSpanStart/End, wrap makeExecuteToolCall/Raw with emitToolSpanStart/End - Token counter: switch pipeline from FallbackCounter to TiktokenCounter - KG temporal: add valid_until IS NULL filter to all entity/relation queries (list, search, vector, FTS, traversal CTE, stats) - Skills: add SkillEmbedder interface for future hybrid BM25+vector search - Cache: remove unused tenantResolve dead code from PermissionCache - Store: fix NULL scan bugs in tracing metadata and agent skill_nudge - Test: add TestStoreKG_TemporalFilter integration test - UI: add v3 version badge, evolution section, memory/traces improvements * refactor(store): migrate KG store from raw sql.Rows to sqlx StructScan Migrate 6 knowledge graph store files from manual rows.Scan() to pkgSqlxDB.GetContext/SelectContext with intermediate scan row structs. - Add entityRow, relationRow, traversalRow, dedupCandidateRow structs with json.RawMessage for jsonb and time.Time for timestamptz columns - Add toEntity()/toRelation() converters (UnixMilli + json.Unmarshal) - Add sqlxTx() helper for wrapping *sql.Tx with sqlx mapper - Fix ScanDuplicates passing time.Now().Unix() to TIMESTAMPTZ column - Fix ListEntitiesTemporal missing tenant scope (scopeClause) - Fix SupersedeEntity missing tenant scope and tenant_id on INSERT - Fix DedupCandidate.CreatedAt using Unix() instead of UnixMilli() - Update agents_export_queries.go to reuse new scan row structs - Net -160 lines of manual scan boilerplate removed * refactor(store): migrate memory, skills, agents, sessions, mcp, cron, vault stores to sqlx Batch migration of 19 store files from raw rows.Scan() to pkgSqlxDB.GetContext/SelectContext with intermediate scan row structs. Groups migrated: - Memory: memory_docs, memory_admin, memory_search, memory_embedding_cache - Episodic: episodic_search, episodic_summaries - Skills: skills, skills_admin, skills_embedding, skills_export_queries - Agents: agents (backfill+shares), agents_context, agents_export_team_standalone - Sessions: sessions_list (List, ListPaged, ListPagedRich) - MCP: mcp_servers_access, mcp_export_queries - Cron: cron_exec (GetRunLog) - Vault: vault_documents (ListDocuments, ftsSearch, vectorSearch) - Tenant: tenant_configs (ListDisabled, ListAll) 7 new scan row files created. Net -510 lines of manual scan boilerplate. INSERT/UPDATE/DELETE and scalar COUNT queries kept as raw SQL. * fix(store): fix 3 sqlx scan struct db tag issues found by audit - Fix vault FTS alias mismatch: `AS rank` → `AS score` (critical: runtime scan error) - Fix episodic key_topics type: json.RawMessage → pq.StringArray (TEXT[] column) - Fix agentShareRow.CreatedAt: string → time.Time, wire to output struct * feat(providers): implement Wave 2 provider resilience and intelligence 9-phase implementation covering: - Request middleware chain with composable body transformers - OpenAI prompt caching, service tier, and fast mode middlewares - Error classification (9 categories) with two-tier failover - Model registry with forward-compat resolvers (Anthropic + OpenAI) - Embedding providers (OpenAI + Voyage) with 1536-dim validation - Cooldown/probe system with per-provider:model state tracking - Markdown-aware chunking shared across 5 channels - Session recall via FTS + pgvector on episodic summaries - Dreaming/promotion pipeline for long-term memory consolidation Migrations: 000040 (episodic search index), 000041 (promoted_at column) Schema version: 39 → 41 * feat(providers): wire model registry into gateway provider construction Create InMemoryRegistry with Anthropic + OpenAI forward-compat resolvers at gateway startup. Pass to all Anthropic and OpenAI providers created from both config and DB sources. * feat(consolidation): wire DomainEventBus and consolidation pipeline Create DomainEventBus at gateway startup, thread through resolver → LoopConfig → Loop → PipelineDeps. Emit session.completed event after each run finalization. Register consolidation pipeline (episodic → semantic → KG dedup → dreaming) with event bus subscriptions. * fix(store): fix episodic key_topics pq.Array, ON CONFLICT, and migration 040 immutability - episodic_summaries.go Create: json.Marshal(KeyTopics) → pq.Array (text[] column) - episodic_search.go scanEpisodic/scanEpisodicRow: json.RawMessage → pq.StringArray - episodic_summaries.go Create: ON CONFLICT add WHERE source_id IS NOT NULL for partial index - migration 040: add immutable_array_to_string wrapper (array_to_string is STABLE in PG) * test(store): add 17 integration tests for skills, cron, episodic, tenant configs - Skills store: 6 tests (CRUD, grants, tenant isolation) - Cron store: 4 tests (job CRUD, run log sqlx scan, pagination, tenant isolation) - Episodic store: 4 tests (summary CRUD, list, FTS search, tenant isolation) - Tenant configs: 3 tests (tool/skill disable, list, tenant isolation) - Test helper: add cleanup for skills, cron, episodic tables * fix(permissions): use cron-specific permission check for cron tool (#725) * fix(security): harden exec path exemption matching (#721) - Add absolute path exemption for dataDir/skills-store/ (fixes skill scripts using absolute paths like /app/data/skills-store/ being denied) - Strip surrounding quotes before prefix matching (LLMs often quote paths) - Reject path traversal ("..") in exempt fields to prevent escape - Switch from "any field exempt → skip" to per-field matching: only exempt if ALL fields that match the deny pattern are individually exempt - Closes pipe/comment bypass vectors where an exempt path in one argument would exempt the entire command including non-exempt paths Includes 27 test cases covering: legitimate access, quoted paths, path traversal, unicode bypass, pipe/comment bypass, mixed args. * fix(permissions): use cron-specific permission check for cron tool Cron tool was hardcoded to check `file_writer` configType via CheckFileWriterPermission(), ignoring the `cron` configType that the UI actually saves when granting cron permissions. This caused agents in group chats to be denied cron access even with correct permission configured. Add ConfigTypeCron constant and CheckCronPermission() that checks `cron` configType first, falling back to `file_writer`. --------- Co-authored-by: Viet Tran * fix(chat): load message history on first conversation click (#730) * fix(chat): load message history when selecting existing conversation from clean state The skipNextHistoryRef was unconditionally set when sessionKey transitioned from empty to non-empty. This prevented loadHistory() from running when clicking an existing conversation from the initial /chat page. The skip was only intended for the new-chat send flow where the optimistic message is already displayed. Guard the skip with expectingRunRef so it only activates when a message send is in flight. Closes #729 * docs: add UI diff evidence for PR #730 Before/after screenshots and HTML comparison report showing first conversation click behavior fix. * feat(whatsapp): port native WhatsApp channel with whatsmeow from dev Cherry-pick 0db1e93a with manual conflict resolution: - cmd/channels_cmd.go: kept dev-v3 HTTP API approach (not config-based) - go.mod/go.sum: merged deps, ran go mod tidy * feat(ui): v3 web UI enhancement — branded loading, rich markdown, vault graph, sidebar polish - Branded loading: HTML pre-loader with logo pulse/shimmer, fade-out on app ready, PageLoader logo swap - Rich markdown: wikilinks, mermaid (lazy-loaded), math/KaTeX, callouts/admonitions plugins - Vault graph: force-directed document graph view with table/graph toggle - Agent filters: type filter (open/predefined) on agents page - Sidebar: tenant name + role badge in footer - Query keys: add vault + episodic entries * fix(ui): address code review — mermaid XSS, Safari compat, cache key - Change mermaid securityLevel from "loose" to "strict" (XSS prevention) - Add requestIdleCallback fallback for Safari < 17 - Fix vault all-links query key to use sorted doc IDs (stale cache fix) - Remove dead abortRef from MermaidBlock - Add prefers-reduced-motion to loader animation * docs: update CLAUDE.md with v3 architecture + complete changelog - Add 10 new v3 internal modules to project structure (pipeline, eventbus, consolidation, tokencount, vault, workspace, etc.) - Add native WhatsApp channel, edition system, providerresolve, updater to structure - Update Key Patterns with 8 v3-specific patterns (pipeline, eventbus, 3-tier memory, vault, evolution, orchestration, middleware) - Add comprehensive V3 Redesign section to changelog covering: - 8-stage pipeline with dual-mode gate - DomainEventBus + consolidation workers - 3-tier memory (working/episodic/semantic) - Knowledge Vault with wikilinks - Self-evolution engine - Orchestration + delegate tool - WorkspaceContext resolver - ModelRegistry + provider adapter - Feature flags - Request middleware - sqlx migration + 70+ integration tests * fix(security): harden file path validation, tenant isolation, and tool access - handleSign: validate path within workspace/dataDir before signing HMAC token - handleSign: enforce tenant-scoped restriction for RBAC-enabled editions - handleServe: add workspace/dataDir boundary check for ft= signed requests - handleServe: remove cross-tenant findInWorkspace fallback for ft= requests - TenantDataDir/TenantWorkspace: guard against empty slug resolving to parent - exec tool: add tenants/ to AllowPathExemptions for tenant skill execution - list_files: add AllowPaths support and wire skills directory access * docs(v3): update 16 docs + add 2 new docs for v3 architecture Update all docs/ to reflect v3 implementation (64 commits, 31K insertions): - 00: architecture overview with 7 new packages - 01: agent loop with pipeline, orchestration, evolution - 02: providers with Wave 2 resilience (middleware, failover, registry) - 03: tools with delegate, vault_search, vault_link, memory_expand - 04,08,10,11,14,23: targeted v3 additions - 06: store with 6 new tables, promoted columns, sqlx - 07: memory with 3-tier architecture, consolidation pipeline - 18,19: HTTP/WS API with v3 endpoints and methods - 21: evolution system (metrics, suggestions, auto-adapt) - model-steering: model registry relationship New docs: - 22-v3-http-endpoints.md: 12 v3 HTTP endpoints - 24-knowledge-vault.md: vault architecture, wikilinks, search * feat(v3): wire delegate tool, fix pipeline callbacks, clean dead code Wire delegate tool end-to-end: - Register DelegateTool in gateway with DelegateRunFunc - Implement runFn: resolve target agent, build session key, propagate tracing - Add async announce via msgBus (reuses subagent announce handler) - Populate context fields (TenantID, Channel, ChatID) for routing - Set DelegationID + ParentAgentID on RunRequest for event correlation Fix pipeline callbacks: - BreakLoop now completes remaining stages in current iteration - EnrichMedia signature updated to use RunState for message buffer access - Add non-streaming event emission for channel compatibility - Fix user message flush tracking in v3 pipeline Clean dead code (510 LOC removed): - Delete memory/l1_cache.go, unified_search.go (superseded by vault search) - Delete vault/auto_injector_impl.go, retriever_impl.go (never wired) - Delete vault/sync_worker.go (never started) - Remove orphaned EventMemoryLint, EventSuggestionCreated constants * feat(v3): finalize stage — emit session.completed, NO_REPLY, strip directives - Emit session.completed event for consolidation pipeline (episodic → semantic → dreaming) - Detect NO_REPLY before flush so silent content is persisted for context - Strip [[...]] message directives from user-facing content (v2 parity) - Wire StripMessageDirectives, IsSilentReply, EmitSessionCompleted callbacks * feat(vault): full CRUD — backend endpoints, UI dialogs, content preview Backend (5 new HTTP endpoints): - POST/PUT/DELETE /v1/agents/{id}/vault/documents — create, update, delete - POST/DELETE /v1/agents/{id}/vault/links — create, delete - Server-side validation for doc_type and scope enums - Agent ownership verification on link creation - FK cascade handles link cleanup on document delete Frontend (React): - Create document dialog (title, path, type, scope) - Edit mode in detail dialog (inline title/type/scope editing) - Delete document with confirmation - Create link dialog (from/to doc, link type, context) - Delete link with inline confirmation on badges - Content preview (collapsible, lazy-loads via /v1/storage/files/) - Mutation hooks with query invalidation - i18n keys for en/vi/zh * fix(v3): critical pipeline parity fixes — ChatRequest, reasoning, passback, media - Enrich ChatRequest with all provider options (temperature, sessionKey, agentID, userID, channel, workspace, tenantID) matching v2 - Add ResolveReasoningDecision for thinking models (o3, DeepSeek-R1, Kimi) - Wire uniquifyToolCallIDs to prevent OpenAI 400 on duplicate IDs - Add assistant message passback (Phase, RawAssistantContent) for Anthropic - Emit block.reply for intermediate content (non-streaming channels) - Add ContentSuffix append + ForwardMedia merge in FinalizeStage - Build final assistant message with MediaRefs for session persistence - Use effectiveMaxTokens() + OptMaxTokens constant - Guard truncation retry on len(ToolCalls) > 0 + parseError check - Accumulate ThinkingTokens in usage - Deduplicate emitRun closure (shared from callbackSet) - Fix EnrichMedia to receive RunState with actual messages - Persist user message in makeFlushMessages (matching v2) * fix(store): coerce NOT NULL JSONB columns to empty object on agent update When switching provider away from ChatGPT OAuth, the UI sends chatgpt_oauth_routing: null which violates the NOT NULL constraint. Coerce null → '{}' for all NOT NULL JSONB promoted columns: chatgpt_oauth_routing, reasoning_config, workspace_sharing, shell_deny_groups, kg_dedup_config. * feat(v3): v3 info modal redesign, agent links CRUD tab, sidebar rename - Rewrite v3 info modal with 8 feature cards (pipeline, memory, retrieval, vault, evolution, orchestration, resilience, registry) with v2→v3 comparisons, stat badges, full i18n (en/vi/zh) - Add tabbed layout to teams page: Agent Teams | Agent Links tabs - Agent Links tab with full CRUD via existing WS RPC methods (list/create/edit/delete) with Radix Select, Combobox, mutual agent exclusion in create dialog - Sidebar menu renamed to "Agent Link & Team" - Backend: add source_display_name, source_emoji, target_emoji to agent link joined queries for consistent display * fix(store): include personal chats in cron delivery targets Add 'user' contact_type to ListDeliveryTargets SQL filter in both PG and SQLite stores. Previously only group/topic contacts appeared in cron channel/chat dropdowns. * fix(v3): duplicate messages, missing thinking, span numbering - ThinkStage: skip AppendPending for final answer (no tool calls), let FinalizeStage build the definitive message with sanitization and MediaRefs — fixes duplicate assistant messages in session history - RunResult: add Thinking field, propagate through v2 finalizeRun, v3 convertRunResult, run.completed event, and chat.send response - UI: capture thinkingRef before clearing on run.completed, include in final message object so thinking renders without page refresh - Span numbering: pass Iteration+1 in v3 callback to match v2's 1-based iteration display in trace span names * fix(v3): wire delegation targets into BuildSystemPrompt buildOrchestrationSection() was implemented and tested but never wired into the actual BuildSystemPrompt() flow. Only the unused BridgePromptBuilder had it. Add DelegateTargets + OrchMode fields to SystemPromptConfig and inject "## Delegation Targets" section so agents with agent_links see their delegation targets in prompt. * fix(v3): sync mediaResults from bridgeRS to pipeline state syncBridgeToState copied loopKilled, asyncToolCalls, deliverables from the v2 bridgeRS but missed mediaResults. Tool results with MEDIA: prefix were extracted by processToolResult into bridgeRS but never propagated to state.Tool.MediaResults — causing FinalizeStage to produce empty MediaRefs and RunResult.Media. * fix(v3): populate SessionCompletedPayload in session.completed events Both v2 loop and v3 pipeline emitted session.completed events with nil Payload, causing episodicWorker type assertion to fail silently. Episodic summaries were never created. - Expand EmitSessionCompleted callback to pass msgCount, tokensUsed, compactionCount from pipeline state - V3 path: build payload from state.Messages.TotalLen(), state.Think.TotalUsage, state.Compact.CompactionCount - V2 path: build payload from history + rs.totalUsage + sessions.GetCompactionCount() * fix(v3): remaining pipeline parity gaps — skill postscript, team task count - Add SkillPostscript callback to PipelineDeps + FinalizeStage, matching v2's skill evolution nudge after complex tool runs - Wire makeSkillPostscript() in adapter with same logic as v2 (skillEvolve + skillNudgeInterval + totalToolCalls threshold) - Sync teamTaskCreates from bridgeRS to pipeline EvolutionState (was already syncing teamTaskSpawns but missed creates) * fix(evolution): add JSON struct tags to metric aggregates ToolAggregate and RetrievalAggregate had no JSON tags, causing Go to marshal field names as PascalCase (ToolName, CallCount) while the UI expects snake_case (tool_name, call_count). Charts rendered empty containers with no data bars. Also change AvgDuration (time.Duration) to AvgDurationMs (float64) for JSON-friendly serialization — time.Duration marshals as nanoseconds which is unusable in frontend. * fix(v3): add debug logging to episodic worker for consolidation pipeline Add INFO/WARN logs at entry, summary decision, and creation points to diagnose why episodic_summaries table stays empty in production. * chore: silence noisy tenant_cache debug logs * refactor(ui): replace v3 settings section with engine version picker + tabbed info modal Replace flat toggle list with radio-style version cards (v2/v3) and feature mini-cards. Redesign v3 info modal from single scroll to 3-tab layout (Core Engine, Memory & Knowledge, Orchestration) with Lucide icons and v2→v3 comparison cards. - Add batchUpdate to use-v3-flags hook for atomic v2 switch - Create engine-version-section with VersionCard + FeatureMiniCard - Create v3-info-modal/ with 5 modular components (<45 LOC each) - Add i18n keys (detail.engine + v3Info.tabs) for en/vi/zh - Wire into agent-overview-tab, agent-header, agent-card - Delete v3-settings-section.tsx + agent-v3-info-modal.tsx * feat(v3): pass media files through delegate tool results Delegate tool now carries media files (images, audio, etc.) produced by the delegatee back to the parent agent. DelegateRunFunc returns DelegateResult{Content, Media} instead of plain string. - Add DelegateResult struct with Content + Media fields - Convert agent.MediaResult to bus.MediaFile in gateway wire - Attach media to sync result and async announce message - Add MediaCount to DelegateCompletedPayload for observability - Set MetaParentAgent in async announce metadata * merge: bring main bug fixes into dev-v3 Cherry-pick 8 commits from origin/main: - fix(telegram): handle group-to-supergroup migration (#698) - feat(providers): add OpenRouter identification headers (#705) - fix: deterministic prompt ordering for LLM cache hit (#719) - fix(security): harden exec path exemption matching (#721) - fix: invalidate storage size cache on delete and move (#726) - fix: use errors.Is() for sentinel comparisons (#727) - fix(desktop): add defaultValues to form dialogs (#737) - Release: credential resolver, WhatsApp native, exec hardening (#754) Conflict resolution: - store/pg exports: accept main's errors.Is() additions - shell.go: accept main's extracted matchesAnyPathExemption helper - gateway_providers: merge both WithAnthropicName + WithAnthropicRegistry - loop_types + resolver: merge v3 fields (OrchMode, DelegateTargets, EvolutionMetricsStore) with main's new UserResolver/ContactStore - gateway_setup: keep dev-v3's tenant-scoped path exemptions - channels_cmd: keep dev-v3's HTTP API approach * feat(v3): add foundation packages for architecture refactor (Phase 1) Purely additive — zero changes to existing files. Creates shared types and helpers that Phase 2-4 will migrate callers to: - internal/store/base/: Dialect interface, BuildMapUpdate, nullable/JSON helpers, scope clause builder, table metadata (44 tests) - internal/orchestration/: ChildResult capture from v2/v3, media type conversion with round-trip tests (10 tests) - internal/providers/sse_reader.go: Shared SSE scanner replacing inline bufio.Scanner boilerplate in 3 providers (8 tests) * refactor(store): unify pg/ and sqlitestore/ helpers via base/ package (Phase 2) - Create PG and SQLite dialect implementations (base.Dialect interface) - Replace 15 duplicate helpers in pg/helpers.go with aliases to base.* - Replace 13 duplicate helpers in sqlitestore/helpers.go with aliases - Rewrite execMapUpdate and execMapUpdateWhereTenant to use base.BuildMapUpdate with dialect-specific placeholders - Rewrite scopeClause/scopeClauseAlias as thin wrappers around base.BuildScopeClause - Remove duplicate execMapUpdateWhereTenant from pg/agents.go pg/helpers.go: 267→175 LOC, sqlitestore/helpers.go: 226→130 LOC * refactor(orch): extract BatchQueue[T] generic for announce queues (Phase 3) - Create internal/orchestration/batch_queue.go: generic producer-consumer queue replacing duplicated sync.Map+mutex pattern (10 tests, race-safe) - Simplify cmd/gateway_announce_queue.go: team queue uses BatchQueue, removes announceQueueState/getOrCreate/drain/tryFinish (~40 LOC saved) - Simplify cmd/gateway_subagent_announce_queue.go: subagent queue uses BatchQueue, same pattern reduction (~40 LOC saved) - Update cmd/gateway_consumer_handlers.go: callers use new signatures * fix: remove defer accumulation in announce loop, clean comment tombstone - Remove `defer ptd.ReleaseTeamLock()` inside for loop that accumulated deferred calls per iteration (explicit ReleaseTeamLock already called) - Remove dead comment tombstone in pg/agents.go * fix: scope defer in announce loop via closure for panic safety Wrap announce processing in closure so defer ptd.ReleaseTeamLock() runs once per iteration instead of accumulating. Explicit release still called for normal path; defer catches panics. * refactor(providers): wire shared SSEScanner into 3 providers (Phase 4b) Replace inline bufio.Scanner+SSE parsing boilerplate with shared SSEScanner from sse_reader.go in: - openai.go: data-only SSE (OpenAI, DashScope, Kimi) - codex.go: data-only SSE (OpenAI Codex) - anthropic_stream.go: event+data SSE (uses EventType() for switch) Removes ~24 LOC of duplicated scanner setup + manual line parsing. * refactor(agent): force v3 pipeline, remove v2 runLoop (Phase 4A) - Delete runLoop() from loop.go (~745 LOC removed), keep shared helpers (resolveToolCallName, hasParseErrors, truncateToolArgs) - Remove v2/v3 gate in loop_run.go: always call runViaPipeline() - Remove v3PipelineEnabled field from Loop struct + LoopConfig + resolver - Always resolve workspace in loop_context.go (was behind v3 gate) - Deprecate PipelineEnabled in V3Flags (kept for backward compat parsing) All agents now always use v3 pipeline. No behavioral change for agents that already had v3_pipeline_enabled=true (which was all production agents). * refactor(gateway): decompose gateway.go from 1295 to 476 LOC (Phase 4B) Extract sections of runGateway() into focused files: - gateway_deps.go: gatewayDeps struct for shared state - gateway_http_wiring.go: wireHTTPHandlersOnServer (~207 LOC) - gateway_events.go: event subscribers + teamTaskEventType (~367 LOC) - gateway_lifecycle.go: signal handling, shutdown, server start (~222 LOC) - gateway_tools_wiring.go: cron/heartbeat/session tool wiring (~116 LOC) Also extracted: startCronAndHeartbeat, makeDelegateAnnounceCallback. Pure structural refactoring — no behavior change. * test(agent): add v3 force migration guard tests Verify v2 runLoop is deleted, V3PipelineEnabled field removed from LoopConfig, and V3Flags backward compat parsing still works. Compile-time guards prevent accidental re-introduction of v2 code. * feat(delegate): wire ChildResult + fix media passthrough (Phase 3 gap) - Use orchestration.CaptureFromRunResult in delegate run callback to standardize result capture via ChildResult - Use MediaResultToBusFiles in CaptureFromRunResult (DRY) - Fix delegate_tool.go metadata key: delegate_id → delegation_id * refactor(ui): remove v2/v3 pipeline toggle, always show V3 (Phase 4E) - engine-version-section.tsx: remove pipeline toggle, show V3 read-only - use-agent-version.ts: always return "v3" (no flag check) - use-v3-flags.ts: remove v3_pipeline_enabled from toggleable flags - Update i18n strings (en/vi/zh): remove v2-specific tooltip text * test: add Phase 5 test infrastructure for v3 architecture refactor - pg/pg_dialect_test.go: 4 tests for PG Dialect (placeholder, transform, returning, interface compliance) - sse_reader_test.go: 4 edge case tests (empty data, scanner error, event type persistence, no data after [DONE]) - gateway_announce_format_test.go: 10 tests for team + subagent announce formatting (single/batch, success/failure, snapshot) Coverage: base/ 96%, orchestration/ 100%, providers/ 57% * chore: remove stale runLoop references + apply go fix (Phase 6) - Update comments referencing deleted runLoop in pipeline callbacks, loop_types, stage.go - go fix: reflect.TypeFor, range over int, strings.Builder * docs: update architecture docs for v3 refactor completion (Phase 6) - CLAUDE.md: add store/base/, orchestration/ to project structure; remove v2 runLoop and dual-mode gate references; rename Pipeline (v3) to Pipeline; add SSEScanner and BatchQueue to key patterns - docs/00-architecture-overview.md: update module map with new packages, remove [V3] markers (now standard) - docs/17-changelog.md: add V3 Architecture Refactor entry (6 phases) * feat(evolution): skill draft auto-generation + go fix cleanup - Add skill draft template generation from evolution suggestions - Wire skill apply endpoint in evolution HTTP handlers - Apply go fix across codebase (range-over-int, reflect.TypeFor, etc.) - Minor refactors: simplify switch/case, reduce string builder allocs - Gateway deps: add skills loader field * perf(prompt): deterministic tool order + Anthropic cache boundary split Sort tool names in buildToolingSection for cache-stable output. Insert GOCLAW_CACHE_BOUNDARY marker before Time section; Anthropic provider splits system prompt into 2 blocks (stable cached, dynamic not). Backward compat: no marker → single cached block. * perf(prompt): optimize cache boundary position + add Execution Bias Move Memory Recall and stable context files (AGENTS.md, TOOLS.md, USER_PREDEFINED.md) above cache boundary. Dynamic per-user files (USER.md, BOOTSTRAP.md) stay below. Add Execution Bias section (full mode only) forcing action-oriented tool use. Fix duplicate header when Project Context split across boundary. * feat(prompt): add PromptMode task/none + 3-layer resolution Expand PromptMode from full|minimal to full|task|minimal|none. Task mode = enterprise automation: keeps Tooling, Execution Bias, Safety-slim, Persona-slim, Skills-search, MCP-search, Memory-slim, Workspace, Runtime, Delegation. Drops verbose sections (Tool Call Style, Self-Evolution, Spawning, Recency, etc.). None mode returns identity line only. 3-layer mode resolution: runtime override > auto-detect (subagent/cron) > agent config (other_config.prompt_mode) > default (full). * feat(prompt): provider prompt contributions (stable/dynamic/overrides) Add PromptContribution struct + PromptContributor interface for provider-specific prompt customizations. Providers can inject StablePrefix (before cache boundary), DynamicSuffix (after boundary), or override sections by ID (e.g. execution_bias). Nil-safe: providers that don't implement the interface get default behavior. * feat(prompt): pinned skills with hybrid inline+search mode Add per-agent pinned_skills config (max 10, from other_config JSONB). Pinned skills always inline in prompt via BuildPinnedSummary. Non-pinned discovered via skill_search. Hybrid section shows both pinned XML and search instructions. Works in full and task modes. * fix(prompt): validate prompt_mode from DB before cast Reject unknown prompt_mode values from OtherConfig JSONB (e.g. typos like "taks") by checking against validPromptModes set. Invalid values default to "" (full mode). Prevents broken prompts where no mode flags match. * fix(prompt): wire SectionIDToolCallStyle for provider override Tool Call Style section now uses sectionContent() like Execution Bias, allowing providers to override it via PromptContribution.SectionOverrides. * feat(store): implement 9 SQLite store backends for v3 parity Close feature gap between PostgreSQL and SQLite (desktop/lite) editions. 96 methods across 9 stores: AgentLinks, SubagentTasks, SecureCLI, SecureCLIGrants, EvolutionMetrics, EvolutionSuggestions, Episodic, KnowledgeGraph, Vault. Schema v8→v9 adds 4 tables. Key design decisions: - LIKE-based search replaces tsvector/FTS5 (unavailable in modernc.org/sqlite) - Go-side StringSimilarity for KG dedup (replaces pgvector cosine) - Recursive CTE traversal with comma-delimited path cycle detection - AES-256-GCM encryption on all SecureCLI read/write paths - F15: SecureCLI disabled when EncryptionKey empty - ON CONFLICT DO UPDATE (never INSERT OR REPLACE) to preserve FK cascades * docs(store): add SQLite parity section to store data model docs Document 9 new SQLite store implementations, schema v9, and feature parity gaps (LIKE vs FTS, Jaro-Winkler vs vector dedup). * fix(docker): skip web-builder stage when ENABLE_EMBEDUI=false Use BuildKit conditional stage pattern so web-builder is not executed when embedding is disabled. Also update pnpm-lock.yaml for 6 new deps that were missing from the lockfile (markdown/math/mermaid packages). * feat(vault): embed metadata.summary for richer vector search Include summary from metadata JSONB in embedding text (title + path + summary) for better semantic search. Update tsvector generated column to include summary in FTS index. Zero new columns — summary stored in existing metadata JSONB field. Backward compat: docs without summary still embed title+path only. * fix(vault-ui): wider detail dialog, markdown rendering, create tooltip - Detail dialog: sm:max-w-lg → sm:max-w-2xl, content area 200→300px - Content preview: render markdown via MarkdownRenderer instead of 
- Create button: add tooltip explaining "select agent first" when disabled

* feat(ui): prompt_mode dropdown + pinned_skills multi-select

Add PromptSettingsSection to agent overview tab:
- prompt_mode: Select dropdown (full/task/minimal/none)
- pinned_skills: Tag input with max 10, click to remove
Both save to agent other_config JSONB via existing onUpdate flow.
Self-contained save button appears only when values change.

* fix(vault-ui): enlarge dialog to max-w-4xl, constrain markdown heading sizes

Dialog sm:max-w-2xl → sm:max-w-4xl. Markdown headings capped at
text-base/text-sm via Tailwind child selectors to prevent oversized
h1/h2 in content preview. Content area raised to 400px.

* refactor(ui): move pinned skills to dedicated section with skill select

Split pinned_skills out of PromptSettingsSection into PinnedSkillsSection.
Uses useAgentSkills hook for proper dropdown with granted skills list.
Placed right below SkillsSection in agent overview tab. Badge chips
with X to remove, Select dropdown to add. Max 10 enforced.

* fix(ui): add border wrap to capabilities section for visual consistency

* feat(ui): redesign prompt mode as compact cards, replace v3 badge

- Rewrite prompt settings from select dropdown to 2×2 compact cards
  with lucide icons (Zap/Wrench/Package/CircleOff) and ring selection
- Move prompt settings to top of agent overview tab
- Replace v3 badge with prompt mode badge in header, card, and list row
- Add i18n keys for prompt mode labels/descriptions (en/vi/zh)
- Extract readPromptMode() to shared agent-display-utils
- Remove dead useAgentVersion hook and v3Tooltip/v2Tooltip i18n keys
- Remove v3 badge from EngineVersionSection (keep feature toggles)
- Use cn() for badge class composition with twMerge safety

* feat(ui): add section tags and token estimates to prompt mode cards

Each card now shows which system prompt sections are included
(Persona, Tools, Safety, Skills, MCP, Memory, etc.) as compact
tags, plus estimated base token range (~2-4K for full, ~10 for none).
Helps users understand the impact of each mode at a glance.

* fix(ui): correct token estimates with actual tiktoken measurements

Measured via tiktoken (cl100k) on realistic config:
full=~1.7K+, task=~1.1K+, minimal=~660, none=~6 base tokens.
The "+" suffix indicates context files/skills/MCP add more.

* fix(ui): use tiktoken-measured token ranges for prompt mode cards

Measured across 3 scenarios (bare/typical/heavy) via tiktoken cl100k:
full=~500-2.9K, task=~350-1.2K, minimal=~350-820, none=~6 tokens.
Ranges reflect real configs from minimal (3 tools) to heavy
(10 tools, long persona, MCP, sandbox, pinned skills).

* fix(ui): use production-measured token counts for prompt mode cards

Measured via tiktoken on real production agent (tieu-ho) with
4 context files (AGENTS.md, SOUL.md, IDENTITY.md, USER_PREDEFINED.md),
14 tools, memory, KG, skills, Telegram channel:
full=~3.1K, task=~2.2K, minimal=~1.9K, none=~6 tokens.

* refactor(ui): accurate section tags per prompt mode from systemprompt.go

Section tags now match exact gating logic in BuildSystemPrompt():
- full: persona, tools, exec bias, call style, safety, skills,
  MCP, memory, sandbox, evolution, channel hints (11 sections)
- task: style echo, tools, exec bias, safety (slim), skills (search),
  MCP (search), memory (slim) (7 sections)
- minimal: tools, safety (2 sections + shared context files)
- none: no tags shown, no token count (trivially ~6 tokens)

Removed workspace/identityOnly tags (shared across all modes).

* feat(ui): replace engine version toggles with V3 capabilities modal

- Remove 3 toggle switches (Pipeline, Memory, Retrieval) from agent
  detail — all features are now always-on for v3 agents
- Replace with compact static badges layout
- New V3 Capabilities modal with 4 tabs:
  Pipeline (8-stage flow), Memory (L0/L1/L2 tiers),
  Knowledge (KG, Vault, Dreaming), Orchestration (Delegate, Evolution)
- Each tab has Lucide icons and technical descriptions of how
  features actually work
- Separate i18n namespace v3-capabilities in en/vi/zh locales

* refactor(ui): move V3 badge to agent header, remove engine version section

- Add clickable V3 badge next to agent name in header
- Clicking opens V3 Capabilities modal
- Remove Engine Version section from overview tab entirely
- Remove unused EngineVersionSection import

* feat: v3 prompt engine overhaul — 7-phase restructuring

Phase 1: Fix mode resolution — subagent/cron cap at task (not minimal),
heartbeat stays minimal, pinned skills injected in all modes, USER_PREDEFINED
added to minimal allowlist.

Phase 2: Context file restructuring — new CAPABILITIES.md (domain expertise,
separated from SOUL.md), AGENTS_MINIMAL.md for heartbeat sessions, both added
to stable context files and minimal allowlist.

Phase 3: Summoner update — all 4 prompt builders generate CAPABILITIES.md,
fallback 2-call stores capabilities alongside SOUL.md.

Phase 4: Open agent deprecation — creation silently upgrades open→predefined
in both HTTP and WS endpoints.

Phase 5: Bootstrap auto-contact — sender name from channel metadata injected
into bootstrap context for 1-turn onboarding (DM only).

Phase 6: System prompt preview — GET /v1/agents/{id}/system-prompt-preview
endpoint with mode param, token counting, section parsing.

Phase 7: Agent creation UX — removed open agent type toggle, schema simplified,
description always required, prompt mode cards updated with v3 token estimates.

* fix(vault-ui): redesign detail dialog and link dialog UX

- Vault detail: show content preview by default (not collapsed),
  move type/scope to header badges, hash to subtle footer
- Link dialog: replace native  onNodeLimitChange(Number(e.target.value))}
+        className="h-5 rounded border bg-background px-1 text-base md:text-2xs"
+        aria-label="Node limit"
+      >
+        {NODE_LIMIT_OPTIONS.map((n) => (
+          
+        ))}
+      
+      
+    
+  );
+}
diff --git a/ui/web/src/components/graph/sigma-graph-filters.tsx b/ui/web/src/components/graph/sigma-graph-filters.tsx
new file mode 100644
index 00000000..1f949c3b
--- /dev/null
+++ b/ui/web/src/components/graph/sigma-graph-filters.tsx
@@ -0,0 +1,122 @@
+import { useCallback, useMemo, useEffect, useRef } from "react";
+import type Graph from "graphology";
+import { Filter, ChevronDown, ChevronUp } from "lucide-react";
+import { Button } from "@/components/ui/button";
+
+interface TypeCount {
+  type: string;
+  color: string;
+  count: number;
+}
+
+interface SigmaGraphFiltersProps {
+  graph: Graph;
+  /** Map of type → color for the legend dots */
+  typeColors: Record;
+  defaultColor?: string;
+  /** Currently hidden types (controlled state) */
+  hiddenTypes: Set;
+  onHiddenTypesChange: (types: Set) => void;
+  collapsed: boolean;
+  onCollapsedChange: (collapsed: boolean) => void;
+}
+
+export function SigmaGraphFilters({
+  graph, typeColors, defaultColor = "#9ca3af",
+  hiddenTypes, onHiddenTypesChange,
+  collapsed, onCollapsedChange,
+}: SigmaGraphFiltersProps) {
+  const containerRef = useRef(null);
+
+  // Memoize type counts to avoid iterating all nodes on every render
+  const typeCounts = useMemo(() => {
+    if (graph.order === 0) return [];
+    const counts = new Map();
+    graph.forEachNode((_node, attrs) => {
+      const t = (attrs.docType || attrs.entityType || "other") as string;
+      counts.set(t, (counts.get(t) ?? 0) + 1);
+    });
+    const result: TypeCount[] = [];
+    for (const [type, count] of counts) {
+      result.push({ type, color: typeColors[type] ?? defaultColor, count });
+    }
+    return result.sort((a, b) => b.count - a.count);
+  }, [graph, typeColors, defaultColor]);
+
+  const toggleType = useCallback((type: string) => {
+    const next = new Set(hiddenTypes);
+    if (next.has(type)) next.delete(type);
+    else next.add(type);
+    onHiddenTypesChange(next);
+  }, [hiddenTypes, onHiddenTypesChange]);
+
+  // Close dropdown on outside click OR Escape key
+  useEffect(() => {
+    if (collapsed) return;
+    const handleClick = (e: MouseEvent) => {
+      if (containerRef.current && !containerRef.current.contains(e.target as Node)) {
+        onCollapsedChange(true);
+      }
+    };
+    const handleKeyDown = (e: KeyboardEvent) => {
+      if (e.key === "Escape") {
+        onCollapsedChange(true);
+      }
+    };
+    document.addEventListener("mousedown", handleClick);
+    document.addEventListener("keydown", handleKeyDown);
+    return () => {
+      document.removeEventListener("mousedown", handleClick);
+      document.removeEventListener("keydown", handleKeyDown);
+    };
+  }, [collapsed, onCollapsedChange]);
+
+  if (typeCounts.length === 0) return null;
+
+  return (
+    

+      
+
+      {!collapsed && (
+        

+          {typeCounts.map(({ type, color, count }) => {
+            const hidden = hiddenTypes.has(type);
+            return (
+              
+            );
+          })}
+        

+      )}
+    

+  );
+}
diff --git a/ui/web/src/components/graph/sigma-graph-keyboard-help.tsx b/ui/web/src/components/graph/sigma-graph-keyboard-help.tsx
new file mode 100644
index 00000000..c86a693a
--- /dev/null
+++ b/ui/web/src/components/graph/sigma-graph-keyboard-help.tsx
@@ -0,0 +1,106 @@
+import { useState, useEffect, useRef } from "react";
+import { Keyboard, X } from "lucide-react";
+import { Button } from "@/components/ui/button";
+
+interface Shortcut {
+  keys: string[];
+  description: string;
+}
+
+const SHORTCUTS: Shortcut[] = [
+  { keys: ["+"], description: "Zoom in" },
+  { keys: ["-"], description: "Zoom out" },
+  { keys: ["R"], description: "Reset view (fit all)" },
+  { keys: ["F"], description: "Focus selected node" },
+  { keys: ["Esc"], description: "Deselect" },
+  { keys: ["/"], description: "Focus search" },
+  { keys: ["?"], description: "Show this help" },
+];
+
+/**
+ * Keyboard shortcuts help popover.
+ * Triggered by `?` key or by clicking the keyboard icon.
+ */
+export function SigmaGraphKeyboardHelp() {
+  const [open, setOpen] = useState(false);
+  const containerRef = useRef(null);
+
+  // Global `?` key handler to open help (when not typing in input)
+  useEffect(() => {
+    const handler = (e: KeyboardEvent) => {
+      const tag = (e.target as HTMLElement)?.tagName;
+      if (tag === "INPUT" || tag === "TEXTAREA" || tag === "SELECT") return;
+      if (e.key === "?") {
+        e.preventDefault();
+        setOpen((prev) => !prev);
+      } else if (e.key === "Escape" && open) {
+        setOpen(false);
+      }
+    };
+    document.addEventListener("keydown", handler);
+    return () => document.removeEventListener("keydown", handler);
+  }, [open]);
+
+  // Outside click to dismiss
+  useEffect(() => {
+    if (!open) return;
+    const handler = (e: MouseEvent) => {
+      if (containerRef.current && !containerRef.current.contains(e.target as Node)) {
+        setOpen(false);
+      }
+    };
+    document.addEventListener("mousedown", handler);
+    return () => document.removeEventListener("mousedown", handler);
+  }, [open]);
+
+  return (
+    

+      
+
+      {open && (
+        

+          

+            
Keyboard shortcuts

+            
+          

+          

+            {SHORTCUTS.map(({ keys, description }) => (
+              

+                
{description}

+                

+                  {keys.map((k) => (
+                    
+                      {k}
+                    
+                  ))}
+                

+              

+            ))}
+          

+        

+      )}
+    

+  );
+}
diff --git a/ui/web/src/components/graph/sigma-graph-minimap.tsx b/ui/web/src/components/graph/sigma-graph-minimap.tsx
new file mode 100644
index 00000000..b53a2555
--- /dev/null
+++ b/ui/web/src/components/graph/sigma-graph-minimap.tsx
@@ -0,0 +1,177 @@
+import { useRef, useEffect, useCallback } from "react";
+import type Sigma from "sigma";
+import type Graph from "graphology";
+
+interface SigmaGraphMinimapProps {
+  sigma: Sigma | null;
+  graph: Graph;
+  /** Minimap canvas size in pixels */
+  size?: number;
+}
+
+/**
+ * Lightweight canvas-overlay minimap.
+ * Draws all nodes as small dots + a viewport rectangle showing the current camera view.
+ * Click to jump, no drag (KISS).
+ */
+export function SigmaGraphMinimap({ sigma, graph, size = 140 }: SigmaGraphMinimapProps) {
+  const canvasRef = useRef(null);
+  const rafRef = useRef(0);
+
+  // Compute graph bounding box from node positions
+  const getBounds = useCallback(() => {
+    let minX = Infinity, minY = Infinity, maxX = -Infinity, maxY = -Infinity;
+    graph.forEachNode((_node, attrs) => {
+      const x = attrs.x as number;
+      const y = attrs.y as number;
+      if (x < minX) minX = x;
+      if (x > maxX) maxX = x;
+      if (y < minY) minY = y;
+      if (y > maxY) maxY = y;
+    });
+    // Add padding
+    const padX = (maxX - minX) * 0.1 || 50;
+    const padY = (maxY - minY) * 0.1 || 50;
+    return { minX: minX - padX, minY: minY - padY, maxX: maxX + padX, maxY: maxY + padY };
+  }, [graph]);
+
+  // Draw minimap
+  const draw = useCallback(() => {
+    const canvas = canvasRef.current;
+    const ctx = canvas?.getContext("2d");
+    if (!canvas || !ctx || !sigma || graph.order === 0) return;
+
+    const dpr = window.devicePixelRatio || 1;
+    canvas.width = size * dpr;
+    canvas.height = size * dpr;
+    ctx.scale(dpr, dpr);
+
+    const bounds = getBounds();
+    const bw = bounds.maxX - bounds.minX;
+    const bh = bounds.maxY - bounds.minY;
+    const scale = Math.min(size / bw, size / bh);
+    const offsetX = (size - bw * scale) / 2;
+    const offsetY = (size - bh * scale) / 2;
+
+    // Clear
+    ctx.clearRect(0, 0, size, size);
+
+    // Background
+    ctx.fillStyle = "rgba(0,0,0,0.03)";
+    ctx.fillRect(0, 0, size, size);
+
+    // Draw nodes as 1.5px dots
+    graph.forEachNode((_node, attrs) => {
+      const x = ((attrs.x as number) - bounds.minX) * scale + offsetX;
+      const y = ((attrs.y as number) - bounds.minY) * scale + offsetY;
+      ctx.beginPath();
+      ctx.arc(x, y, 1.5, 0, Math.PI * 2);
+      ctx.fillStyle = (attrs.color as string) || "#9ca3af";
+      ctx.fill();
+    });
+
+    // Draw viewport rectangle — use viewportToGraph to derive the 4 corners
+    // in graph space, then map to minimap space
+    const { width, height } = sigma.getDimensions();
+    const topLeft = sigma.viewportToGraph({ x: 0, y: 0 });
+    const bottomRight = sigma.viewportToGraph({ x: width, y: height });
+
+    const vx1 = (topLeft.x - bounds.minX) * scale + offsetX;
+    const vy1 = (topLeft.y - bounds.minY) * scale + offsetY;
+    const vx2 = (bottomRight.x - bounds.minX) * scale + offsetX;
+    const vy2 = (bottomRight.y - bounds.minY) * scale + offsetY;
+    const vw = vx2 - vx1;
+    const vh = vy2 - vy1;
+
+    ctx.strokeStyle = "rgba(59, 130, 246, 0.7)";
+    ctx.lineWidth = 1.5;
+    ctx.strokeRect(vx1, vy1, vw, vh);
+    ctx.fillStyle = "rgba(59, 130, 246, 0.08)";
+    ctx.fillRect(vx1, vy1, vw, vh);
+  }, [sigma, graph, size, getBounds]);
+
+  // Redraw on camera changes
+  useEffect(() => {
+    if (!sigma) return;
+    const camera = sigma.getCamera();
+
+    // Throttled redraw — skip if already scheduled
+    let scheduled = false;
+    const scheduleRedraw = () => {
+      if (scheduled) return;
+      scheduled = true;
+      rafRef.current = requestAnimationFrame(() => {
+        scheduled = false;
+        draw();
+      });
+    };
+
+    // Initial draw
+    scheduleRedraw();
+
+    // Redraw on camera updates (pan/zoom) AND after every sigma render
+    // (so FA2 layout position updates are reflected)
+    camera.on("updated", scheduleRedraw);
+    sigma.on("afterRender", scheduleRedraw);
+
+    return () => {
+      camera.off("updated", scheduleRedraw);
+      sigma.off("afterRender", scheduleRedraw);
+      cancelAnimationFrame(rafRef.current);
+    };
+  }, [sigma, draw]);
+
+  // Click to jump: find nearest node to click position and center camera on it
+  const handleClick = useCallback(
+    (e: React.MouseEvent) => {
+      if (!sigma || graph.order === 0) return;
+      const rect = canvasRef.current?.getBoundingClientRect();
+      if (!rect) return;
+
+      const bounds = getBounds();
+      const bw = bounds.maxX - bounds.minX;
+      const bh = bounds.maxY - bounds.minY;
+      const scale = Math.min(size / bw, size / bh);
+      const offsetX = (size - bw * scale) / 2;
+      const offsetY = (size - bh * scale) / 2;
+
+      // Convert click position to graph coordinates
+      const clickX = e.clientX - rect.left;
+      const clickY = e.clientY - rect.top;
+      const targetGraphX = (clickX - offsetX) / scale + bounds.minX;
+      const targetGraphY = (clickY - offsetY) / scale + bounds.minY;
+
+      // Find nearest node (avoids coordinate-system issues with camera.animate)
+      let nearestId: string | null = null;
+      let minDist = Infinity;
+      graph.forEachNode((id, attrs) => {
+        const dx = (attrs.x as number) - targetGraphX;
+        const dy = (attrs.y as number) - targetGraphY;
+        const d = dx * dx + dy * dy;
+        if (d < minDist) { minDist = d; nearestId = id; }
+      });
+
+      if (nearestId) {
+        const display = sigma.getNodeDisplayData(nearestId);
+        if (display) {
+          sigma.getCamera().animate(
+            { x: display.x, y: display.y },
+            { duration: 300 },
+          );
+        }
+      }
+    },
+    [sigma, graph, size, getBounds],
+  );
+
+  if (graph.order === 0) return null;
+
+  return (
+    
+  );
+}
diff --git a/ui/web/src/components/graph/sigma-graph-search.tsx b/ui/web/src/components/graph/sigma-graph-search.tsx
new file mode 100644
index 00000000..f6260645
--- /dev/null
+++ b/ui/web/src/components/graph/sigma-graph-search.tsx
@@ -0,0 +1,162 @@
+import { useState, useRef, useCallback, useEffect } from "react";
+import type Sigma from "sigma";
+import type Graph from "graphology";
+import { Search, X } from "lucide-react";
+import { Input } from "@/components/ui/input";
+
+interface SigmaGraphSearchProps {
+  sigma: Sigma | null;
+  graph: Graph;
+  onNodeSelect?: (nodeId: string | null) => void;
+  placeholder?: string;
+}
+
+interface SearchResult {
+  id: string;
+  label: string;
+  color: string;
+}
+
+export function SigmaGraphSearch({ sigma, graph, onNodeSelect, placeholder = "Search nodes..." }: SigmaGraphSearchProps) {
+  const [query, setQuery] = useState("");
+  const [results, setResults] = useState([]);
+  const [open, setOpen] = useState(false);
+  const [activeIndex, setActiveIndex] = useState(0);
+  const inputRef = useRef(null);
+  const containerRef = useRef(null);
+
+  // Search graph nodes by label
+  const handleSearch = useCallback(
+    (q: string) => {
+      setQuery(q);
+      if (!q.trim() || graph.order === 0) {
+        setResults([]);
+        setOpen(false);
+        return;
+      }
+      const lower = q.toLowerCase();
+      const matches: SearchResult[] = [];
+      graph.forEachNode((node, attrs) => {
+        if (matches.length >= 10) return;
+        const label = (attrs.label as string) || "";
+        if (label.toLowerCase().includes(lower)) {
+          matches.push({ id: node, label, color: attrs.color as string });
+        }
+      });
+      setResults(matches);
+      setOpen(matches.length > 0);
+      setActiveIndex(0);
+    },
+    [graph],
+  );
+
+  // Select a result: highlight + camera zoom
+  const selectResult = useCallback(
+    (nodeId: string) => {
+      onNodeSelect?.(nodeId);
+      if (sigma && graph.hasNode(nodeId)) {
+        // Use getNodeDisplayData for correct stage coords (not raw graph coords).
+        // Only zoom in if currently zoomed out (don't force zoom level if already zoomed in).
+        const nodeDisplay = sigma.getNodeDisplayData(nodeId);
+        if (nodeDisplay) {
+          const currentRatio = sigma.getCamera().ratio;
+          sigma.getCamera().animate(
+            { x: nodeDisplay.x, y: nodeDisplay.y, ratio: Math.min(currentRatio, 0.5) },
+            { duration: 400 },
+          );
+        }
+      }
+      setOpen(false);
+      setQuery("");
+    },
+    [sigma, graph, onNodeSelect],
+  );
+
+  // Keyboard navigation in dropdown
+  const handleKeyDown = useCallback(
+    (e: React.KeyboardEvent) => {
+      if (!open || results.length === 0) return;
+      if (e.key === "ArrowDown") {
+        e.preventDefault();
+        setActiveIndex((i) => Math.min(i + 1, results.length - 1));
+      } else if (e.key === "ArrowUp") {
+        e.preventDefault();
+        setActiveIndex((i) => Math.max(i - 1, 0));
+      } else if (e.key === "Enter") {
+        e.preventDefault();
+        const r = results[activeIndex];
+        if (r) selectResult(r.id);
+      } else if (e.key === "Escape") {
+        setOpen(false);
+        inputRef.current?.blur();
+      }
+    },
+    [open, results, activeIndex, selectResult],
+  );
+
+  // Close dropdown on outside click
+  useEffect(() => {
+    const handleClick = (e: MouseEvent) => {
+      if (containerRef.current && !containerRef.current.contains(e.target as Node)) {
+        setOpen(false);
+      }
+    };
+    document.addEventListener("mousedown", handleClick);
+    return () => document.removeEventListener("mousedown", handleClick);
+  }, []);
+
+  return (
+    

+      

+        
+         handleSearch(e.target.value)}
+          onKeyDown={handleKeyDown}
+          onFocus={() => query && results.length > 0 && setOpen(true)}
+          placeholder={placeholder}
+          className="h-7 pl-7 pr-7 text-base md:text-xs"
+          role="combobox"
+          aria-expanded={open}
+          aria-autocomplete="list"
+          aria-controls="graph-search-listbox"
+          aria-label={placeholder}
+        />
+        {query && (
+          
+        )}
+      

+
+      {/* Dropdown results */}
+      {open && (
+        

+          {results.map((r, i) => (
+            
+          ))}
+        

+      )}
+    

+  );
+}
diff --git a/ui/web/src/components/graph/use-sigma-keyboard.ts b/ui/web/src/components/graph/use-sigma-keyboard.ts
new file mode 100644
index 00000000..c1f8c589
--- /dev/null
+++ b/ui/web/src/components/graph/use-sigma-keyboard.ts
@@ -0,0 +1,88 @@
+import { useEffect, type RefObject } from "react";
+import type Sigma from "sigma";
+import type Graph from "graphology";
+
+interface UseSigmaKeyboardOptions {
+  sigma: Sigma | null;
+  graph: Graph;
+  /** Container element — shortcuts only fire when this element or its children are focused */
+  containerRef: RefObject;
+  selectedNodeId?: string | null;
+  onNodeSelect?: (nodeId: string | null) => void;
+  /** Ref to search input — "/" focuses it */
+  searchInputRef?: RefObject;
+}
+
+/**
+ * Keyboard shortcuts for Sigma graph views.
+ * Only active when the graph container (or a child) is focused.
+ *
+ * | Key     | Action              |
+ * |---------|---------------------|
+ * | + / =   | Zoom in             |
+ * | -       | Zoom out            |
+ * | R       | Reset view (fit all)|
+ * | F       | Focus selected node |
+ * | Escape  | Deselect all        |
+ * | /       | Focus search input  |
+ */
+export function useSigmaKeyboard({
+  sigma,
+  graph,
+  containerRef,
+  selectedNodeId,
+  onNodeSelect,
+  searchInputRef,
+}: UseSigmaKeyboardOptions) {
+  useEffect(() => {
+    const container = containerRef.current;
+    if (!container || !sigma) return;
+
+    const handler = (e: KeyboardEvent) => {
+      // Ignore if typing in an input/textarea
+      const tag = (e.target as HTMLElement).tagName;
+      if (tag === "INPUT" || tag === "TEXTAREA" || tag === "SELECT") return;
+
+      switch (e.key) {
+        case "+":
+        case "=":
+          e.preventDefault();
+          sigma.getCamera().animatedZoom({ duration: 200 });
+          break;
+        case "-":
+          e.preventDefault();
+          sigma.getCamera().animatedUnzoom({ duration: 200 });
+          break;
+        case "r":
+        case "R":
+          e.preventDefault();
+          sigma.getCamera().animatedReset({ duration: 300 });
+          break;
+        case "f":
+        case "F":
+          if (selectedNodeId && graph.hasNode(selectedNodeId)) {
+            e.preventDefault();
+            const nodeDisplay = sigma.getNodeDisplayData(selectedNodeId);
+            if (nodeDisplay) {
+              const currentRatio = sigma.getCamera().ratio;
+              sigma.getCamera().animate(
+                { x: nodeDisplay.x, y: nodeDisplay.y, ratio: Math.min(currentRatio, 0.5) },
+                { duration: 400 },
+              );
+            }
+          }
+          break;
+        case "Escape":
+          onNodeSelect?.(null);
+          break;
+        case "/":
+          e.preventDefault();
+          searchInputRef?.current?.focus();
+          break;
+      }
+    };
+
+    container.addEventListener("keydown", handler);
+    return () => container.removeEventListener("keydown", handler);
+  }, [sigma, graph, containerRef, selectedNodeId, onNodeSelect, searchInputRef]);
+}
diff --git a/ui/web/src/components/layout/system-settings-constants.ts b/ui/web/src/components/layout/system-settings-constants.ts
index 504310ea..3bb1226c 100644
--- a/ui/web/src/components/layout/system-settings-constants.ts
+++ b/ui/web/src/components/layout/system-settings-constants.ts
@@ -42,6 +42,8 @@ export interface InitState {
   kgProvider: string;
   kgModel: string;
   kgMinConfidence: string;
+  bgProvider: string;
+  bgModel: string;
 }
 
 export const DEFAULTS: InitState = {
@@ -51,6 +53,7 @@ export const DEFAULTS: InitState = {
   compProvider: "", compModel: "",
   compThreshold: "", compKeepRecent: "", compMaxTokens: "",
   kgProvider: "", kgModel: "", kgMinConfidence: "0.75",
+  bgProvider: "", bgModel: "",
 };
 
 export function parseBool(v: string | undefined, fallback: boolean): boolean {
diff --git a/ui/web/src/components/layout/system-settings-modal.tsx b/ui/web/src/components/layout/system-settings-modal.tsx
index ce36a27c..01cc4815 100644
--- a/ui/web/src/components/layout/system-settings-modal.tsx
+++ b/ui/web/src/components/layout/system-settings-modal.tsx
@@ -1,6 +1,6 @@
 import { useState, useEffect, useCallback } from "react";
 import { useTranslation } from "react-i18next";
-import { Settings2, Loader2, Save, AlertTriangle, Info, ExternalLink, Network } from "lucide-react";
+import { Settings2, Loader2, Save, AlertTriangle, Info, ExternalLink, Network, Cog } from "lucide-react";
 import { Link } from "react-router";
 import { Dialog, DialogContent, DialogHeader, DialogTitle } from "@/components/ui/dialog";
 import { Button } from "@/components/ui/button";
@@ -57,6 +57,10 @@ export function SystemSettingsModal({ open, onOpenChange }: SystemSettingsModalP
   const [kgModel, setKgModel] = useState("");
   const [kgMinConfidence, setKgMinConfidence] = useState("0.75");
 
+  // Background Workers
+  const [bgProvider, setBgProvider] = useState("");
+  const [bgModel, setBgModel] = useState("");
+
   const applyConfigs = useCallback((
     configs: Record,
     kgSettings?: { extraction_provider?: string; extraction_model?: string; min_confidence?: number },
@@ -71,12 +75,14 @@ export function SystemSettingsModal({ open, onOpenChange }: SystemSettingsModalP
       compMaxTokens: configs["compaction.max_tokens"] ?? "",
       kgProvider: kgSettings?.extraction_provider ?? "", kgModel: kgSettings?.extraction_model ?? "",
       kgMinConfidence: String(kgSettings?.min_confidence ?? 0.75),
+      bgProvider: configs["background.provider"] ?? "", bgModel: configs["background.model"] ?? "",
     };
     setInit(s);
     setEmbProvider(s.embProvider); setEmbModel(s.embModel); setEmbMaxChunkLen(s.embMaxChunkLen); setEmbChunkOverlap(s.embChunkOverlap);
     setToolStatus(s.toolStatus); setBlockReply(s.blockReply); setIntentClassify(s.intentClassify);
     setCompProvider(s.compProvider); setCompModel(s.compModel); setCompThreshold(s.compThreshold); setCompKeepRecent(s.compKeepRecent); setCompMaxTokens(s.compMaxTokens);
     setKgProvider(s.kgProvider); setKgModel(s.kgModel); setKgMinConfidence(s.kgMinConfidence);
+    setBgProvider(s.bgProvider); setBgModel(s.bgModel);
     resetEmb();
   }, [resetEmb]);
 
@@ -118,6 +124,8 @@ export function SystemSettingsModal({ open, onOpenChange }: SystemSettingsModalP
       if (compThreshold !== init.compThreshold) updates["compaction.threshold"] = compThreshold;
       if (compKeepRecent !== init.compKeepRecent) updates["compaction.keep_recent"] = compKeepRecent;
       if (compMaxTokens !== init.compMaxTokens) updates["compaction.max_tokens"] = compMaxTokens;
+      if (bgProvider !== init.bgProvider) updates["background.provider"] = bgProvider;
+      if (bgModel !== init.bgModel) updates["background.model"] = bgModel;
       for (const [key, value] of Object.entries(updates)) await http.put(`/v1/system-configs/${key}`, { value });
       const kgChanged = kgProvider !== init.kgProvider || kgModel !== init.kgModel || kgMinConfidence !== init.kgMinConfidence;
       if (kgChanged) {
@@ -179,6 +187,20 @@ export function SystemSettingsModal({ open, onOpenChange }: SystemSettingsModalP
               
             
 
+            {/* Background Workers */}
+            
+              
+                {t("bg.title")}
+                {t("bg.description")}
+              
+              
+                 { setBgProvider(v); setBgModel(""); }} model={bgModel} onModelChange={setBgModel} allowEmpty providerLabel={t("bg.provider")} modelLabel={t("bg.model")} providerTip={t("bg.providerTip")} modelTip={t("bg.modelTip")} providerPlaceholder={t("bg.providerPlaceholder")} modelPlaceholder={t("bg.modelPlaceholder")} />
+                

+                  {t("bg.info")}
+                

+              
+            
+
             
 
              c.value === configType)?.descKey ?? "";
 
   return (
-    

+    

       {/* Header */}
       

         

@@ -305,6 +305,6 @@ export function AgentPermissionsTab({ agentId }: AgentPermissionsTabProps) {
           )}
         

       )}
-    

+    

   );
 }
diff --git a/ui/web/src/pages/agents/agent-detail/config-sections/memory-section.tsx b/ui/web/src/pages/agents/agent-detail/config-sections/memory-section.tsx
index c8487f72..42d2ff61 100644
--- a/ui/web/src/pages/agents/agent-detail/config-sections/memory-section.tsx
+++ b/ui/web/src/pages/agents/agent-detail/config-sections/memory-section.tsx
@@ -1,7 +1,7 @@
 import { useTranslation } from "react-i18next";
 import { Input } from "@/components/ui/input";
 import { Switch } from "@/components/ui/switch";
-import type { MemoryConfig } from "@/types/agent";
+import type { MemoryConfig, DreamingConfig } from "@/types/agent";
 import { InfoLabel, numOrUndef } from "./config-section";
 
 interface MemorySectionProps {
@@ -12,6 +12,10 @@ interface MemorySectionProps {
 export function MemorySection({ value, onChange }: MemorySectionProps) {
   const { t } = useTranslation("agents");
   const s = "configSections.memory";
+  const ds = "configSections.dreaming";
+  const dreaming: DreamingConfig = value.dreaming ?? {};
+  const setDreaming = (patch: Partial) =>
+    onChange({ ...value, dreaming: { ...dreaming, ...patch } });
   return (
     

       

@@ -95,6 +99,51 @@ export function MemorySection({ value, onChange }: MemorySectionProps) {
             />
           

         

+        {/* Phase 8 — Dreaming worker per-agent overrides.
+            Nested inside memory since dreaming is memory consolidation.
+            All fields optional; nil = use backend defaults. */}
+        

+          

+            
{t(`${ds}.title`)}

+            
{t(`${ds}.description`)}

+          

+          

+             setDreaming({ enabled: v })}
+            />
+            {t(`${ds}.enabled`)}
+          

+          

+            

+              {t(`${ds}.threshold`)}
+               setDreaming({ threshold: numOrUndef(e.target.value) })}
+                className="text-base md:text-sm"
+              />
+            

+            

+              {t(`${ds}.debounceMs`)}
+               setDreaming({ debounce_ms: numOrUndef(e.target.value) })}
+                className="text-base md:text-sm"
+              />
+            

+          

+          

+             setDreaming({ verbose_log: v })}
+            />
+            {t(`${ds}.verboseLog`)}
+          

+        

       
     
   );
diff --git a/ui/web/src/pages/agents/agent-detail/evolution-tab/evolution-metrics-charts.tsx b/ui/web/src/pages/agents/agent-detail/evolution-tab/evolution-metrics-charts.tsx
index 821ee035..abedc644 100644
--- a/ui/web/src/pages/agents/agent-detail/evolution-tab/evolution-metrics-charts.tsx
+++ b/ui/web/src/pages/agents/agent-detail/evolution-tab/evolution-metrics-charts.tsx
@@ -18,16 +18,20 @@ export function EvolutionMetricsCharts({ toolAggs, retrievalAggs, loading }: Evo
     return 
;
   }
 
+  // API returns rates as 0-1 fractions; convert to 0-100 for chart display.
+  const toolData = toolAggs.map((a) => ({ ...a, success_rate: a.success_rate * 100 }));
+  const retrievalData = retrievalAggs.map((a) => ({ ...a, usage_rate: a.usage_rate * 100 }));
+
   return (
     

       {/* Tool Success Rate */}
       

         
{t("detail.evolution.toolSuccess")}

-        {toolAggs.length === 0 ? (
+        {toolData.length === 0 ? (
           
{t("detail.evolution.noMetrics")}

         ) : (
           
-            
+            
               
               
                `${v}%`} />
@@ -35,12 +39,12 @@ export function EvolutionMetricsCharts({ toolAggs, retrievalAggs, loading }: Evo
                 formatter={(value, _name, props) => {
                   const v = Number(value ?? 0);
                   const p = props?.payload as ToolAggregate | undefined;
-                  return [`${v.toFixed(1)}%`, p ? `${p.call_count} calls, ${p.avg_duration_ms.toFixed(0)}ms avg` : ""];
+                  return [`${v.toFixed(1)}%`, p ? t("detail.evolution.tooltipCalls", { count: p.call_count, ms: p.avg_duration_ms.toFixed(0) }) : ""];
                 }}
               />
               
         
{t("detail.evolution.retrievalQuality")}

-        {retrievalAggs.length === 0 ? (
+        {retrievalData.length === 0 ? (
           
{t("detail.evolution.noMetrics")}

         ) : (
           
-            
+            
               
               
                `${v}%`} />
@@ -65,12 +69,12 @@ export function EvolutionMetricsCharts({ toolAggs, retrievalAggs, loading }: Evo
                 formatter={(value, _name, props) => {
                   const v = Number(value ?? 0);
                   const p = props?.payload as RetrievalAggregate | undefined;
-                  return [`${v.toFixed(1)}%`, p ? `${p.query_count} queries, score ${p.avg_score.toFixed(2)}` : ""];
+                  return [`${v.toFixed(1)}%`, p ? t("detail.evolution.tooltipQueries", { count: p.query_count, score: p.avg_score.toFixed(2) }) : ""];
                 }}
               />
                = {
   threshold: "bg-blue-100 text-blue-700 dark:bg-blue-900 dark:text-blue-300",
   tool_order: "bg-orange-100 text-orange-700 dark:bg-orange-900 dark:text-orange-300",
   skill_add: "bg-green-100 text-green-700 dark:bg-green-900 dark:text-green-300",
-  memory_prune: "bg-gray-100 text-gray-700 dark:bg-gray-800 dark:text-gray-300",
 };
 
 const STATUS_COLORS: Record = {
@@ -62,11 +61,11 @@ export function EvolutionSuggestionsTable({ suggestions, loading, onUpdateStatus
           
-                
-                
-                
-                
-                
+                
+                
+                
+                
+                
@@ -145,10 +144,10 @@ export function EvolutionSuggestionsTable({ suggestions, loading, onUpdateStatus
           
             
             
           
diff --git a/ui/web/src/pages/channels/channel-schemas.ts b/ui/web/src/pages/channels/channel-schemas.ts
index ba92f452..3dc65d4d 100644
--- a/ui/web/src/pages/channels/channel-schemas.ts
+++ b/ui/web/src/pages/channels/channel-schemas.ts
@@ -69,6 +69,16 @@ export const credentialsSchema: Record = {
   ],
   zalo_personal: [],
   whatsapp: [],
+  facebook: [
+    { key: "page_access_token", label: "Page Access Token", type: "password", required: true, help: "From Facebook Developer Console → Your App → Messenger → Page Access Token" },
+    { key: "app_secret", label: "App Secret", type: "password", required: true, help: "From Facebook Developer Console → Your App → Settings → Basic" },
+    { key: "verify_token", label: "Webhook Verify Token", type: "password", required: true, help: "A secret string you choose, used to verify the webhook URL" },
+  ],
+  pancake: [
+    { key: "api_key", label: "API Key", type: "password", required: true, help: "Pancake user-level API key from pages.fm account settings" },
+    { key: "page_access_token", label: "Page Access Token", type: "password", required: true, help: "Page-level token from Pancake dashboard → Page Settings" },
+    { key: "webhook_secret", label: "Webhook Secret (Optional)", type: "password", help: "HMAC-SHA256 secret for webhook signature verification. Leave empty to skip verification." },
+  ],
 };
 
 // --- Config schemas ---
@@ -153,6 +163,27 @@ export const configSchema: Record = {
     { key: "allow_from", label: "Allowed Users", type: "tags", help: "WhatsApp user IDs" },
     { key: "block_reply", label: "Block Reply", type: "select", options: blockReplyOptions, defaultValue: "inherit", help: "Deliver intermediate text during tool iterations" },
   ],
+  facebook: [
+    { key: "page_id", label: "Page ID", type: "text", required: true, help: "Facebook Page numeric ID" },
+    { key: "features.comment_reply", label: "Comment Auto-Reply", type: "boolean", defaultValue: false },
+    { key: "features.messenger_auto_reply", label: "Messenger Auto-Reply", type: "boolean", defaultValue: false },
+    { key: "features.first_inbox", label: "First Inbox DM", type: "boolean", defaultValue: false, help: "Send a one-time DM to commenters after their first comment reply" },
+    { key: "comment_reply_options.include_post_context", label: "Include Post Context", type: "boolean", defaultValue: false, help: "Fetch original post content for comment context" },
+    { key: "comment_reply_options.max_thread_depth", label: "Max Thread Depth", type: "number", defaultValue: 10 },
+    { key: "messenger_options.session_timeout", label: "Messenger Session Timeout", type: "text", placeholder: "e.g. 30m" },
+    { key: "post_context_cache_ttl", label: "Post Cache TTL", type: "text", placeholder: "e.g. 15m" },
+    { key: "first_inbox_message", label: "First Inbox DM Text", type: "textarea", help: "Custom DM sent to first-time commenters. Defaults to Vietnamese if empty." },
+    { key: "allow_from", label: "Allowed Users", type: "tags", help: "Facebook user IDs" },
+    { key: "block_reply", label: "Block Reply", type: "select", options: blockReplyOptions, defaultValue: "inherit" },
+  ],
+  pancake: [
+    { key: "page_id", label: "Page ID", type: "text", required: true, help: "Pancake page ID (numeric, from Pancake dashboard)" },
+    { key: "platform", label: "Platform (auto-detected)", type: "text", placeholder: "Leave empty — resolved at startup", help: "facebook / zalo / instagram / tiktok / whatsapp / line. Auto-detected if empty." },
+    { key: "features.inbox_reply", label: "Inbox Auto-Reply", type: "boolean", defaultValue: true },
+    { key: "features.comment_reply", label: "Comment Reply", type: "boolean", defaultValue: false },
+    { key: "allow_from", label: "Allowed Users", type: "tags", help: "Sender IDs to whitelist. Empty = accept all." },
+    { key: "block_reply", label: "Block Reply", type: "select", options: blockReplyOptions, defaultValue: "inherit" },
+  ],
 };
 
 // --- Group override schema (Telegram per-group/topic overrides) ---
diff --git a/ui/web/src/pages/chat/chat-page.tsx b/ui/web/src/pages/chat/chat-page.tsx
index 36fbf612..5cf0ab5c 100644
--- a/ui/web/src/pages/chat/chat-page.tsx
+++ b/ui/web/src/pages/chat/chat-page.tsx
@@ -81,8 +81,8 @@ export function ChatPage() {
   const isOwn = !sessionKey || isOwnSession(sessionKey, userId);
 
   const handleMessageAdded = useCallback(
-    (msg: { role: "user" | "assistant" | "tool"; content: string; timestamp?: number }) => {
-      addLocalMessage(msg);
+    (msg: { role: "user" | "assistant" | "tool"; content: string; timestamp?: number }, key?: string) => {
+      addLocalMessage(msg, key);
     },
     [addLocalMessage],
   );
@@ -234,7 +234,16 @@ export function ChatPage() {
         )}
 
         

-           setTaskPanelOpen((v) => !v)} taskPanelOpen={taskPanelOpen} />
+           setTaskPanelOpen((v) => !v)}
+            taskPanelOpen={taskPanelOpen}
+            session={sessions.find((s) => s.key === sessionKey) ?? null}
+          />
         

 
         {sendError && (
diff --git a/ui/web/src/pages/chat/hooks/use-chat-messages.ts b/ui/web/src/pages/chat/hooks/use-chat-messages.ts
index 5f11f15a..f59fa420 100644
--- a/ui/web/src/pages/chat/hooks/use-chat-messages.ts
+++ b/ui/web/src/pages/chat/hooks/use-chat-messages.ts
@@ -7,6 +7,11 @@ import type { ChatMessage, AgentEventPayload, ToolStreamEntry, RunActivity, Acti
 import { toFileUrl, mediaKindFromMime } from "@/lib/file-helpers";
 import { transformHistoryMessages } from "@/adapters/chat-message.adapter";
 import { useChatTeamTasks } from "./use-chat-team-tasks";
+import { useChatMessagesStore } from "@/stores/use-chat-messages-store";
+
+// Stable empty array — avoids creating a new reference on every render inside
+// Zustand selectors, which would trigger an infinite re-render loop (React #185).
+const EMPTY_MESSAGES: ChatMessage[] = [];
 
 /**
  * Manages chat message history and real-time streaming for a session.
@@ -14,11 +19,19 @@ import { useChatTeamTasks } from "./use-chat-team-tasks";
  */
 export function useChatMessages(sessionKey: string, agentId: string) {
   const ws = useWs();
-  const [messages, setMessages] = useState([]);
-  const [streamText, setStreamText] = useState(null);
-  const [thinkingText, setThinkingText] = useState(null);
+  const messages = useChatMessagesStore((s) => sessionKey ? (s.sessions[sessionKey]?.messages ?? EMPTY_MESSAGES) : EMPTY_MESSAGES);
+  const streamText = useChatMessagesStore((s) => sessionKey ? (s.sessions[sessionKey]?.streamText ?? null) : null);
+  const thinkingText = useChatMessagesStore((s) => sessionKey ? (s.sessions[sessionKey]?.thinkingText ?? null) : null);
+  const isRunning = useChatMessagesStore((s) => sessionKey ? (s.sessions[sessionKey]?.isRunning ?? false) : false);
+
+  const setSessionMessages = useChatMessagesStore((s) => s.setSessionMessages);
+  const updateSessionMessages = useChatMessagesStore((s) => s.updateSessionMessages);
+  const setSessionStream = useChatMessagesStore((s) => s.setSessionStream);
+  const setSessionThinking = useChatMessagesStore((s) => s.setSessionThinking);
+  const setSessionRunning = useChatMessagesStore((s) => s.setSessionRunning);
+
+  // Local state for non-persistent UI elements
   const [toolStream, setToolStream] = useState([]);
-  const [isRunning, setIsRunning] = useState(false);
   const [loading, setLoading] = useState(false);
   const [activity, setActivity] = useState(null);
   const [blockReplies, setBlockReplies] = useState([]);
@@ -38,10 +51,15 @@ export function useChatMessages(sessionKey: string, agentId: string) {
   const rafPendingRef = useRef(false);
   const rafHandleRef = useRef(0);
 
-  // Add a local message optimistically
-  const addLocalMessage = useCallback((msg: ChatMessage) => {
-    setMessages((prev) => [...prev, msg]);
-  }, []);
+  // Add a local message optimistically.
+  // `key` is optional: callers that know the target session key (e.g. new-chat
+  // send flow, where the URL hasn't navigated yet) should pass it explicitly.
+  const addLocalMessage = useCallback((msg: ChatMessage, key?: string) => {
+    const targetKey = key ?? sessionKey;
+    if (targetKey) {
+      updateSessionMessages(targetKey, (prev) => [...prev, msg]);
+    }
+  }, [sessionKey, updateSessionMessages]);
 
   // Team task handling (extracted hook)
   const { teamTasks, setTeamTasks } = useChatTeamTasks(addLocalMessage);
@@ -67,23 +85,32 @@ export function useChatMessages(sessionKey: string, agentId: string) {
       return;
     }
 
-    setStreamText(null); setThinkingText(null); setToolStream([]);
-    setIsRunning(false); setActivity(null); setBlockReplies([]); setTeamTasks([]);
-    runIdRef.current = null; expectingRunRef.current = false;
-    streamRef.current = ""; thinkingRef.current = "";
-    toolStreamRef.current = []; activityRef.current = null; blockRepliesRef.current = [];
-    cancelAnimationFrame(rafHandleRef.current); rafPendingRef.current = false;
-    if (!sessionKey) setMessages([]);
-  }, [sessionKey, setTeamTasks]);
+    setSessionStream(sessionKey, null);
+    setSessionThinking(sessionKey, null);
+    setSessionRunning(sessionKey, false);
+    setToolStream([]);
+    setActivity(null);
+    setBlockReplies([]);
+    setTeamTasks([]);
+    runIdRef.current = null;
+    expectingRunRef.current = false;
+    streamRef.current = "";
+    thinkingRef.current = "";
+    toolStreamRef.current = [];
+    activityRef.current = null;
+    blockRepliesRef.current = [];
+    cancelAnimationFrame(rafHandleRef.current);
+    rafPendingRef.current = false;
+  }, [sessionKey, setTeamTasks, setSessionStream, setSessionThinking, setSessionRunning]);
 
   // Load history
   const loadHistory = useCallback(async (mediaItems?: MediaItem[]) => {
     if (!ws.isConnected || !sessionKey) { setLoading(false); return; }
     try {
       const res = await ws.call<{ messages: Message[] }>(Methods.CHAT_HISTORY, { agentId, sessionKey });
-      setMessages(transformHistoryMessages(res.messages ?? [], mediaItems));
+      setSessionMessages(sessionKey, transformHistoryMessages(res.messages ?? [], mediaItems));
     } catch { /* will retry */ } finally { setLoading(false); }
-  }, [ws, agentId, sessionKey]);
+  }, [ws, agentId, sessionKey, setSessionMessages]);
 
   // Load history + restore running state when session changes
   useEffect(() => {
@@ -99,7 +126,7 @@ export function useChatMessages(sessionKey: string, agentId: string) {
       ws.call<{ isRunning?: boolean; runId?: string; activity?: RunActivity }>(Methods.CHAT_SESSION_STATUS, { sessionKey })
         .then((res) => {
           if (cancelled) return;
-          if (res.isRunning) { setIsRunning(true); if (res.runId) runIdRef.current = res.runId; }
+          if (res.isRunning) { setSessionRunning(sessionKey, true); if (res.runId) runIdRef.current = res.runId; }
           if (res.activity) { setActivity(res.activity); activityRef.current = res.activity; }
         }).catch((err) => console.error("[useChatMessages] session status failed:", err));
       ws.call<{ tasks?: ActiveTeamTask[] }>(Methods.TEAMS_TASK_ACTIVE_BY_SESSION, { sessionKey })
@@ -107,7 +134,7 @@ export function useChatMessages(sessionKey: string, agentId: string) {
         .catch((err) => console.error("[useChatMessages] active tasks failed:", err));
     }
     return () => { cancelled = true; };
-  }, [sessionKey, loadHistory, ws, setTeamTasks]);
+  }, [sessionKey, loadHistory, ws, setTeamTasks, setSessionRunning]);
 
   // Called before sending so event handler captures run.started
   const expectRun = useCallback(() => { expectingRunRef.current = true; }, []);
@@ -123,9 +150,15 @@ export function useChatMessages(sessionKey: string, agentId: string) {
       // Capture run.started
       if (event.type === "run.started" && event.agentId === agentIdRef.current) {
         if (expectingRunRef.current || event.runKind === "announce") {
-          runIdRef.current = event.runId; expectingRunRef.current = false;
-          setIsRunning(true); setStreamText(null); setThinkingText(null); setToolStream([]);
-          streamRef.current = ""; thinkingRef.current = ""; toolStreamRef.current = [];
+          runIdRef.current = event.runId;
+          expectingRunRef.current = false;
+          setSessionRunning(sessionKeyRef.current, true);
+          setSessionStream(sessionKeyRef.current, null);
+          setSessionThinking(sessionKeyRef.current, null);
+          setToolStream([]);
+          streamRef.current = "";
+          thinkingRef.current = "";
+          toolStreamRef.current = [];
         }
         return;
       }
@@ -139,7 +172,8 @@ export function useChatMessages(sessionKey: string, agentId: string) {
             rafPendingRef.current = true;
             rafHandleRef.current = requestAnimationFrame(() => {
               rafPendingRef.current = false;
-              setThinkingText(thinkingRef.current); setStreamText(streamRef.current);
+              setSessionThinking(sessionKeyRef.current, thinkingRef.current);
+              setSessionStream(sessionKeyRef.current, streamRef.current);
             });
           }
           break;
@@ -150,7 +184,8 @@ export function useChatMessages(sessionKey: string, agentId: string) {
             rafPendingRef.current = true;
             rafHandleRef.current = requestAnimationFrame(() => {
               rafPendingRef.current = false;
-              setStreamText(streamRef.current); setThinkingText(thinkingRef.current);
+              setSessionStream(sessionKeyRef.current, streamRef.current);
+              setSessionThinking(sessionKeyRef.current, thinkingRef.current);
             });
           }
           break;
@@ -201,48 +236,69 @@ export function useChatMessages(sessionKey: string, agentId: string) {
         }
         case "run.completed": {
           cancelAnimationFrame(rafHandleRef.current); rafPendingRef.current = false;
-          setIsRunning(false); runIdRef.current = null;
+          setSessionRunning(sessionKeyRef.current, false);
+          runIdRef.current = null;
           const hadTools = toolStreamRef.current.length > 0;
           const streamed = streamRef.current;
           const thinking = thinkingRef.current || undefined;
-          setStreamText(null); setThinkingText(null); setToolStream([]);
-          streamRef.current = ""; thinkingRef.current = ""; toolStreamRef.current = [];
-          activityRef.current = null; setActivity(null);
-          blockRepliesRef.current = []; setBlockReplies([]);
+          setSessionStream(sessionKeyRef.current, null);
+          setSessionThinking(sessionKeyRef.current, null);
+          setToolStream([]);
+          streamRef.current = "";
+          thinkingRef.current = "";
+          toolStreamRef.current = [];
+          activityRef.current = null;
+          setActivity(null);
+          blockRepliesRef.current = [];
+          setBlockReplies([]);
           const rawMedia = event.payload?.media;
           const mediaItems: MediaItem[] | undefined = rawMedia?.length
             ? rawMedia.map((m) => ({ path: toFileUrl(m.path), mimeType: m.content_type ?? "application/octet-stream", fileName: m.path.split("?")[0]?.split("/").pop() ?? "file", size: m.size, kind: mediaKindFromMime(m.content_type ?? "") }))
             : undefined;
           if (streamed && !hadTools) {
-            setMessages((prev) => [...prev, { role: "assistant", content: streamed, thinking, timestamp: Date.now(), mediaItems }]);
+            updateSessionMessages(sessionKeyRef.current, (prev) => [...prev, { role: "assistant", content: streamed, thinking, timestamp: Date.now(), mediaItems }]);
           } else { loadHistory(mediaItems); }
           break;
         }
         case "run.failed": {
           cancelAnimationFrame(rafHandleRef.current); rafPendingRef.current = false;
-          setIsRunning(false); runIdRef.current = null;
-          setStreamText(null); setThinkingText(null); setToolStream([]);
-          streamRef.current = ""; thinkingRef.current = "";
-          activityRef.current = null; setActivity(null);
-          blockRepliesRef.current = []; setBlockReplies([]);
-          setMessages((prev) => [...prev, { role: "assistant", content: `Error: ${event.payload?.error ?? "Unknown error"}`, timestamp: Date.now() }]);
+          setSessionRunning(sessionKeyRef.current, false);
+          runIdRef.current = null;
+          setSessionStream(sessionKeyRef.current, null);
+          setSessionThinking(sessionKeyRef.current, null);
+          setToolStream([]);
+          streamRef.current = "";
+          thinkingRef.current = "";
+          activityRef.current = null;
+          setActivity(null);
+          blockRepliesRef.current = [];
+          setBlockReplies([]);
+          updateSessionMessages(sessionKeyRef.current, (prev) => [...prev, { role: "assistant", content: `Error: ${event.payload?.error ?? "Unknown error"}`, timestamp: Date.now() }]);
           break;
         }
         case "run.cancelled": {
           cancelAnimationFrame(rafHandleRef.current); rafPendingRef.current = false;
-          setIsRunning(false); runIdRef.current = null;
+          setSessionRunning(sessionKeyRef.current, false);
+          runIdRef.current = null;
           const streamed = streamRef.current;
-          setStreamText(null); setThinkingText(null); setToolStream([]);
-          streamRef.current = ""; thinkingRef.current = ""; toolStreamRef.current = [];
-          activityRef.current = null; setActivity(null);
-          blockRepliesRef.current = []; setBlockReplies([]);
-          if (streamed) { setMessages((prev) => [...prev, { role: "assistant", content: streamed, timestamp: Date.now() }]); }
-          else { loadHistory(); }
+          setSessionStream(sessionKeyRef.current, null);
+          setSessionThinking(sessionKeyRef.current, null);
+          setToolStream([]);
+          streamRef.current = "";
+          thinkingRef.current = "";
+          toolStreamRef.current = [];
+          activityRef.current = null;
+          setActivity(null);
+          blockRepliesRef.current = [];
+          setBlockReplies([]);
+          if (streamed) {
+            updateSessionMessages(sessionKeyRef.current, (prev) => [...prev, { role: "assistant", content: streamed, timestamp: Date.now() }]);
+          } else { loadHistory(); }
           break;
         }
       }
     },
-    [loadHistory],
+    [loadHistory, setSessionRunning, setSessionStream, setSessionThinking, updateSessionMessages],
   );
 
   useWsEvent(Events.AGENT, handleAgentEvent);
diff --git a/ui/web/src/pages/chat/hooks/use-chat-send.ts b/ui/web/src/pages/chat/hooks/use-chat-send.ts
index 5bdc2d43..2e54d6ef 100644
--- a/ui/web/src/pages/chat/hooks/use-chat-send.ts
+++ b/ui/web/src/pages/chat/hooks/use-chat-send.ts
@@ -7,7 +7,7 @@ import type { AttachedFile } from "@/components/chat/chat-input";
 
 interface UseChatSendOptions {
   agentId: string;
-  onMessageAdded: (msg: ChatMessage) => void;
+  onMessageAdded: (msg: ChatMessage, sessionKey?: string) => void;
   onExpectRun: () => void;
 }
 
@@ -58,7 +58,7 @@ export function useChatSend({
         role: "user",
         content: displayContent,
         timestamp: Date.now(),
-      });
+      }, sessionKey);
 
       try {
         // Upload files first, then pass path+filename to chat.send
diff --git a/ui/web/src/pages/memory/knowledge-graph/kg-entity-detail-dialog.tsx b/ui/web/src/pages/memory/knowledge-graph/kg-entity-detail-dialog.tsx
index ad7d70e1..8bf85358 100644
--- a/ui/web/src/pages/memory/knowledge-graph/kg-entity-detail-dialog.tsx
+++ b/ui/web/src/pages/memory/knowledge-graph/kg-entity-detail-dialog.tsx
@@ -239,7 +239,7 @@ export function KGEntityDetailDialog({ open, onOpenChange, agentId, entity, getE
                   
                 ) : graphData ? (
                   

-                    
+                    
                   

                 ) : (
                   

diff --git a/ui/web/src/pages/memory/knowledge-graph/kg-graph-view.tsx b/ui/web/src/pages/memory/knowledge-graph/kg-graph-view.tsx
index 8b4e1204..283725a7 100644
--- a/ui/web/src/pages/memory/knowledge-graph/kg-graph-view.tsx
+++ b/ui/web/src/pages/memory/knowledge-graph/kg-graph-view.tsx
@@ -1,286 +1,164 @@
-import { useRef, useMemo, useCallback, useState, useEffect, useLayoutEffect } from "react";
-import ForceGraph2D, { type ForceGraphMethods } from "react-force-graph-2d";
-import { Maximize2, ZoomIn, ZoomOut } from "lucide-react";
-import { Button } from "@/components/ui/button";
+import { useRef, useMemo, useState, useCallback } from "react";
+import type Sigma from "sigma";
 import { useTranslation } from "react-i18next";
-import { useUiStore } from "@/stores/use-ui-store";
 import type { KGEntity, KGRelation } from "@/types/knowledge-graph";
-import { buildGraphData, limitEntitiesByDegree } from "@/adapters/kg-graph.adapter";
-import type { GraphNode, GraphLink } from "@/adapters/kg-graph.adapter";
+import { buildKGGraph, limitEntitiesByDegree, KG_TYPE_COLORS } from "@/adapters/kg-graph.adapter";
+import { SigmaGraphContainer } from "@/components/graph/sigma-graph-container";
+import { SigmaGraphControls } from "@/components/graph/sigma-graph-controls";
+import { SigmaGraphSearch } from "@/components/graph/sigma-graph-search";
+import { SigmaGraphFilters } from "@/components/graph/sigma-graph-filters";
+import { SigmaGraphMinimap } from "@/components/graph/sigma-graph-minimap";
+import { SigmaGraphKeyboardHelp } from "@/components/graph/sigma-graph-keyboard-help";
+import { useSigmaKeyboard } from "@/components/graph/use-sigma-keyboard";
 
-const NODE_LIMIT_OPTIONS = [100, 200, 300, 500] as const;
 const DEFAULT_NODE_LIMIT = 200;
-const NODE_R = 5;
-const DOUBLE_CLICK_MS = 280;
 
 interface KGGraphViewProps {
   entities: KGEntity[];
   relations: KGRelation[];
   onEntityClick?: (entity: KGEntity) => void;
+  /** Compact mode for embedded mini-graphs (entity detail dialog) */
+  compact?: boolean;
 }
 
-export function KGGraphView({ entities: allEntities, relations: allRelations, onEntityClick }: KGGraphViewProps) {
+export function KGGraphView({ entities: allEntities, relations: allRelations, onEntityClick, compact = false }: KGGraphViewProps) {
   const { t } = useTranslation("memory");
-  const theme = useUiStore((s) => s.theme);
-  const isDark = theme === "dark" || (theme === "system" && window.matchMedia("(prefers-color-scheme: dark)").matches);
-
-  const graphRef = useRef>(undefined);
   const containerRef = useRef(null);
-  const [dimensions, setDimensions] = useState({ width: 600, height: 400 });
+  const searchInputRef = useRef(null);
+  const [sigma, setSigma] = useState(null);
   const [selectedNodeId, setSelectedNodeId] = useState(null);
   const [nodeLimit, setNodeLimit] = useState(DEFAULT_NODE_LIMIT);
-  const [ready, setReady] = useState(false);
-  const [zoomLevel, setZoomLevel] = useState(1);
+  const [hiddenTypes, setHiddenTypes] = useState>(new Set());
+  const [filtersOpen, setFiltersOpen] = useState(false);
 
-  const ZOOM_STEP = 1.5;
-
-  const handleZoomIn = useCallback(() => {
-    const fg = graphRef.current;
-    if (!fg) return;
-    fg.zoom(Math.min((fg.zoom() ?? 1) * ZOOM_STEP, 8), 300);
-  }, []);
-
-  const handleZoomOut = useCallback(() => {
-    const fg = graphRef.current;
-    if (!fg) return;
-    fg.zoom(Math.max((fg.zoom() ?? 1) / ZOOM_STEP, 0.1), 300);
-  }, []);
-
-  // Double-click detection refs
-  const clickTimerRef = useRef | null>(null);
-  const lastClickRef = useRef(null);
-
-  // --- Container sizing ---
-  // 1. Synchronous initial read before first paint to avoid wrong-size flash
-  useLayoutEffect(() => {
-    const el = containerRef.current;
-    if (el && el.clientWidth > 0 && el.clientHeight > 0) {
-      setDimensions({ width: el.clientWidth, height: el.clientHeight });
-      setReady(true);
-    }
-  }, []);
-
-  // 2. ResizeObserver for ongoing size changes (window resize, sidebar toggle)
-  useEffect(() => {
-    const el = containerRef.current;
-    if (!el) return;
-    const ro = new ResizeObserver(([entry]) => {
-      if (!entry) return;
-      const { width, height } = entry.contentRect;
-      if (width > 0 && height > 0) {
-        setDimensions({ width, height });
-        setReady(true);
-      }
-    });
-    ro.observe(el);
-    return () => ro.disconnect();
-  }, []);
-
-  // --- Limit entities by degree centrality ---
   const totalCount = allEntities.length;
   const isLimited = totalCount > nodeLimit;
   const entities = useMemo(
     () => limitEntitiesByDegree(allEntities, allRelations, nodeLimit),
     [allEntities, allRelations, nodeLimit],
   );
-
   const entityMap = useMemo(() => new Map(entities.map((e) => [e.id, e])), [entities]);
+  const graph = useMemo(() => buildKGGraph(entities, allRelations), [entities, allRelations]);
 
-  // --- Build graph data for react-force-graph ---
-  const graphData = useMemo(
-    () => buildGraphData(entities, allRelations),
-    [entities, allRelations],
-  );
+  const handleNodeDoubleClick = useCallback((nodeId: string) => {
+    const entity = entityMap.get(nodeId);
+    if (entity) onEntityClick?.(entity);
+  }, [entityMap, onEntityClick]);
 
-  // --- Highlight sets derived from selected node ---
-  const { highlightNodes, highlightLinks } = useMemo(() => {
-    if (!selectedNodeId) return { highlightNodes: new Set(), highlightLinks: new Set() };
-    const node = graphData.nodes.find((n) => n.id === selectedNodeId);
-    if (!node) return { highlightNodes: new Set(), highlightLinks: new Set() };
-    return {
-      highlightNodes: new Set([selectedNodeId, ...node.neighbors]),
-      highlightLinks: new Set(node.linkIds),
-    };
-  }, [selectedNodeId, graphData.nodes]);
-
-  // --- Node Canvas rendering: colored circle + name label ---
-  const nodeCanvasObject = useCallback(
-    (node: GraphNode, ctx: CanvasRenderingContext2D, globalScale: number) => {
-      const x = node.x ?? 0;
-      const y = node.y ?? 0;
-      const isSelected = node.id === selectedNodeId;
-      const isNeighbor = highlightNodes.has(node.id);
-      const isDimmed = !!selectedNodeId && !isSelected && !isNeighbor;
-      const r = NODE_R + (node.degree >= 4 ? 2 : 0);
-
-      // Circle fill
-      ctx.beginPath();
-      ctx.arc(x, y, r, 0, 2 * Math.PI);
-      ctx.fillStyle = isDimmed ? `${node.color}30` : node.color;
-      ctx.fill();
-
-      // Selection glow ring
-      if (isSelected) {
-        ctx.strokeStyle = node.color;
-        ctx.lineWidth = 2.5 / globalScale;
-        ctx.shadowColor = node.color;
-        ctx.shadowBlur = 8 / globalScale;
-        ctx.stroke();
-        ctx.shadowBlur = 0;
-      } else if (isNeighbor) {
-        ctx.strokeStyle = node.color;
-        ctx.lineWidth = 1.5 / globalScale;
-        ctx.stroke();
-      }
-
-      // Name label — show when zoomed enough or highlighted
-      if (globalScale > 0.5 || isSelected || isNeighbor) {
-        const fontSize = Math.max(11 / globalScale, 2);
-        ctx.font = `${isSelected ? "bold " : ""}${fontSize}px Inter, system-ui, sans-serif`;
-        ctx.textAlign = "center";
-        ctx.textBaseline = "top";
-        ctx.fillStyle = isDimmed
-          ? (isDark ? "rgba(255,255,255,0.12)" : "rgba(0,0,0,0.12)")
-          : (isDark ? "#e2e8f0" : "#1e293b");
-        ctx.fillText(node.name, x, y + r + 2 / globalScale);
-      }
-    },
-    [selectedNodeId, highlightNodes, isDark],
-  );
-
-  // --- Link canvas overlay: draw label text only for highlighted links ---
-  const linkCanvasObject = useCallback(
-    (link: any, ctx: CanvasRenderingContext2D, globalScale: number) => {
-      if (!highlightLinks.has(link.id)) return;
-      const src = link.source;
-      const tgt = link.target;
-      if (!src?.x || !tgt?.x) return;
-      const midX = (src.x + tgt.x) / 2;
-      const midY = (src.y + tgt.y) / 2;
-      const fontSize = Math.max(9 / globalScale, 2);
-      ctx.font = `${fontSize}px Inter, system-ui, sans-serif`;
-      ctx.textAlign = "center";
-      ctx.textBaseline = "middle";
-      // Background pill for readability
-      const text = link.label || "";
-      const metrics = ctx.measureText(text);
-      const pad = 2 / globalScale;
-      ctx.fillStyle = isDark ? "rgba(15,23,42,0.85)" : "rgba(255,255,255,0.9)";
-      ctx.fillRect(midX - metrics.width / 2 - pad, midY - fontSize / 2 - pad, metrics.width + pad * 2, fontSize + pad * 2);
-      // Text
-      ctx.fillStyle = isDark ? "#94a3b8" : "#64748b";
-      ctx.fillText(text, midX, midY);
-    },
-    [highlightLinks, isDark],
-  );
-
-  // --- Click handlers: single (highlight) vs double (open detail) ---
-  const handleNodeClick = useCallback(
-    (node: GraphNode) => {
-      if (clickTimerRef.current && lastClickRef.current === node.id) {
-        // Double click → open detail modal
-        clearTimeout(clickTimerRef.current);
-        clickTimerRef.current = null;
-        lastClickRef.current = null;
-        const entity = entityMap.get(node.id);
-        if (entity && onEntityClick) onEntityClick(entity);
-        return;
-      }
-      // Single click → highlight (after delay to distinguish from double)
-      if (clickTimerRef.current) clearTimeout(clickTimerRef.current);
-      lastClickRef.current = node.id;
-      clickTimerRef.current = setTimeout(() => {
-        setSelectedNodeId((prev) => (prev === node.id ? null : node.id));
-        clickTimerRef.current = null;
-      }, DOUBLE_CLICK_MS);
-    },
-    [entityMap, onEntityClick],
-  );
-
-  const handleBackgroundClick = useCallback(() => {
-    setSelectedNodeId(null);
-  }, []);
-
-  const handleEngineStop = useCallback(() => {
-    // No auto zoom — initial view from warmupTicks is already good
-  }, []);
+  useSigmaKeyboard({
+    sigma: compact ? null : sigma,
+    graph,
+    containerRef,
+    selectedNodeId,
+    onNodeSelect: setSelectedNodeId,
+    searchInputRef,
+  });
 
   const hasEntities = allEntities.length > 0;
 
+  // Compact mode: simple graph only
+  if (compact) {
+    return (
+      

+        

+          {!hasEntities ? (
+            

+              {t("kg.graphView.empty")}
+            

+          ) : (
+            
+          )}
+        

+      

+    );
+  }
+
   return (
-    

-      

+    

+      {/* Top bar — responsive: legend stacks on mobile */}
+      {hasEntities && (
+        

+          {/* KG type legend */}
+          

+            {Object.entries(KG_TYPE_COLORS).map(([type, color]) => (
+              
+                
+                {type}
+              
+            ))}
+          

+          

+            
+             setFiltersOpen(!c)}
+            />
+            
+          

+        

+      )}
+
+      {/* Graph canvas + minimap overlay */}
+      

         {!hasEntities ? (
-          
{t("kg.graphView.empty")}

-        ) : ready ?  "replace"}
-          nodePointerAreaPaint={(node: GraphNode, color, ctx) => {
-            const r = NODE_R + (node.degree >= 4 ? 2 : 0) + 3;
-            ctx.beginPath();
-            ctx.arc(node.x ?? 0, node.y ?? 0, r, 0, 2 * Math.PI);
-            ctx.fillStyle = color;
-            ctx.fill();
-          }}
-          linkColor={(link: any) =>
-            highlightLinks.has(link.id) ? "#64748b" : (isDark ? "#334155" : "#cbd5e1")
-          }
-          linkWidth={(link: any) => (highlightLinks.has(link.id) ? 2 : 0.5)}
-          linkCanvasObject={linkCanvasObject}
-          linkCanvasObjectMode={(link: any) => (highlightLinks.has(link.id) ? "after" : undefined)}
-          linkDirectionalParticles={(link: any) => (highlightLinks.has(link.id) ? 2 : 0)}
-          linkDirectionalParticleWidth={3}
-          linkDirectionalParticleSpeed={0.004}
-          onNodeClick={handleNodeClick}
-          onBackgroundClick={handleBackgroundClick}
-          onZoom={(transform) => setZoomLevel(transform.k)}
-          onEngineStop={handleEngineStop}
-          backgroundColor="transparent"
-          d3AlphaDecay={0.04}
-          d3VelocityDecay={0.3}
-          warmupTicks={40}
-          cooldownTime={4000}
-          enableNodeDrag={true}
-          minZoom={0.1}
-          maxZoom={8}
-        /> : null}
+          

+            {t("kg.graphView.empty")}
+          

+        ) : (
+          <>
+            
+            

+              
+            

+          
+        )}
       

 
       {/* Stats bar */}
-      

-        {t("kg.graphView.nodes", { count: totalCount })}
-        {t("kg.graphView.edges", { count: allRelations.length })}
-        {isLimited && (
-          · {t("kg.graphView.limitNote", { limit: nodeLimit, total: totalCount })}
-        )}
-        

-        

-          
-          {Math.round(zoomLevel * 100)}%
-          
-        

-        
-        
-      

+      
     

   );
 }
diff --git a/ui/web/src/pages/vault/hooks/use-enrichment-progress.ts b/ui/web/src/pages/vault/hooks/use-enrichment-progress.ts
new file mode 100644
index 00000000..6f85794d
--- /dev/null
+++ b/ui/web/src/pages/vault/hooks/use-enrichment-progress.ts
@@ -0,0 +1,27 @@
+import { useState } from "react";
+import { useWsEvent } from "@/hooks/use-ws-event";
+
+export interface EnrichmentEvent {
+  phase: string;   // enriching, complete
+  done: number;
+  total: number;
+  running: boolean;
+}
+
+/**
+ * Listens to vault.enrich.progress WS events and returns current enrichment state.
+ * Progress auto-clears 3s after completion.
+ */
+export function useEnrichmentProgress() {
+  const [event, setEvent] = useState(null);
+
+  useWsEvent("vault.enrich.progress", (payload) => {
+    const data = payload as EnrichmentEvent;
+    setEvent(data);
+    if (!data.running) {
+      setTimeout(() => setEvent(null), 3000);
+    }
+  });
+
+  return event;
+}
diff --git a/ui/web/src/pages/vault/hooks/use-vault-mutations.ts b/ui/web/src/pages/vault/hooks/use-vault-mutations.ts
index 9f00687b..3773344b 100644
--- a/ui/web/src/pages/vault/hooks/use-vault-mutations.ts
+++ b/ui/web/src/pages/vault/hooks/use-vault-mutations.ts
@@ -1,21 +1,33 @@
 import { useCallback } from "react";
+import { useState } from "react";
 import { useQueryClient } from "@tanstack/react-query";
 import { useHttp } from "@/hooks/use-ws";
 import { toast } from "@/stores/use-toast-store";
 import i18n from "@/i18n";
 import type { VaultDocument, VaultLink } from "@/types/vault";
 
+interface RescanResult {
+  scanned: number;
+  new: number;
+  updated: number;
+  unchanged: number;
+  skipped: number;
+  errors: number;
+  truncated: boolean;
+}
+
 const VAULT_KEY = "vault";
 
-/** Create a new vault document. */
+/** Create a new vault document. Agent-scoped or cross-agent (empty agentId). */
 export function useCreateDocument(agentId: string) {
   const http = useHttp();
   const queryClient = useQueryClient();
 
   const create = useCallback(
-    async (body: { path: string; title: string; doc_type: string; scope: string; metadata?: Record }) => {
+    async (body: { path: string; title: string; doc_type: string; scope: string; team_id?: string; metadata?: Record }) => {
       try {
-        const doc = await http.post(`/v1/agents/${agentId}/vault/documents`, body);
+        const url = agentId ? `/v1/agents/${agentId}/vault/documents` : `/v1/vault/documents`;
+        const doc = await http.post(url, body);
         await queryClient.invalidateQueries({ queryKey: [VAULT_KEY] });
         toast.success(i18n.t("vault:toast.docCreated"));
         return doc;
@@ -31,14 +43,14 @@ export function useCreateDocument(agentId: string) {
 }
 
 /** Update a vault document. */
-export function useUpdateDocument(agentId: string, docId: string) {
+export function useUpdateDocument(docId: string) {
   const http = useHttp();
   const queryClient = useQueryClient();
 
   const update = useCallback(
     async (body: { title?: string; doc_type?: string; scope?: string; metadata?: Record }) => {
       try {
-        const doc = await http.put(`/v1/agents/${agentId}/vault/documents/${docId}`, body);
+        const doc = await http.put(`/v1/vault/documents/${docId}`, body);
         await queryClient.invalidateQueries({ queryKey: [VAULT_KEY] });
         toast.success(i18n.t("vault:toast.docUpdated"));
         return doc;
@@ -47,40 +59,40 @@ export function useUpdateDocument(agentId: string, docId: string) {
         throw err;
       }
     },
-    [http, agentId, docId, queryClient],
+    [http, docId, queryClient],
   );
 
   return { update };
 }
 
 /** Delete a vault document. */
-export function useDeleteDocument(agentId: string, docId: string) {
+export function useDeleteDocument(docId: string) {
   const http = useHttp();
   const queryClient = useQueryClient();
 
   const remove = useCallback(async () => {
     try {
-      await http.delete(`/v1/agents/${agentId}/vault/documents/${docId}`);
+      await http.delete(`/v1/vault/documents/${docId}`);
       await queryClient.invalidateQueries({ queryKey: [VAULT_KEY] });
       toast.success(i18n.t("vault:toast.docDeleted"));
     } catch (err) {
       toast.error(i18n.t("vault:toast.docDeleteFailed"), err instanceof Error ? err.message : "");
       throw err;
     }
-  }, [http, agentId, docId, queryClient]);
+  }, [http, docId, queryClient]);
 
   return { remove };
 }
 
 /** Create a link between two vault documents. */
-export function useCreateLink(agentId: string) {
+export function useCreateLink() {
   const http = useHttp();
   const queryClient = useQueryClient();
 
   const create = useCallback(
     async (body: { from_doc_id: string; to_doc_id: string; link_type: string; context?: string }) => {
       try {
-        const link = await http.post(`/v1/agents/${agentId}/vault/links`, body);
+        const link = await http.post(`/v1/vault/links`, body);
         await queryClient.invalidateQueries({ queryKey: [VAULT_KEY, "links"] });
         await queryClient.invalidateQueries({ queryKey: [VAULT_KEY, "all-links"] });
         toast.success(i18n.t("vault:toast.linkCreated"));
@@ -90,20 +102,57 @@ export function useCreateLink(agentId: string) {
         throw err;
       }
     },
-    [http, agentId, queryClient],
+    [http, queryClient],
   );
 
   return { create };
 }
 
+/** Rescan workspace to sync vault documents from filesystem (tenant-wide). */
+export function useRescanWorkspace() {
+  const http = useHttp();
+  const queryClient = useQueryClient();
+  const [isPending, setIsPending] = useState(false);
+
+  const rescan = useCallback(async () => {
+    setIsPending(true);
+    try {
+      const result = await http.post(`/v1/vault/rescan`, {});
+      await queryClient.invalidateQueries({ queryKey: [VAULT_KEY] });
+
+      const parts: string[] = [];
+      if (result.new > 0) parts.push(i18n.t("vault:rescanNew", { count: result.new }));
+      if (result.updated > 0) parts.push(i18n.t("vault:rescanUpdated", { count: result.updated }));
+      if (result.unchanged > 0) parts.push(i18n.t("vault:rescanUnchanged", { count: result.unchanged }));
+
+      const title = parts.length > 0 ? parts.join(", ") : i18n.t("vault:rescanNoFiles");
+      const desc = result.truncated ? i18n.t("vault:rescanTruncated") : undefined;
+      toast.success(title, desc);
+      return result;
+    } catch (err) {
+      const status = (err as { status?: number })?.status;
+      if (status === 409) {
+        toast.warning(i18n.t("vault:rescanBusy"));
+      } else {
+        toast.error(i18n.t("vault:rescanError"), err instanceof Error ? err.message : "");
+      }
+      throw err;
+    } finally {
+      setIsPending(false);
+    }
+  }, [http, queryClient]);
+
+  return { rescan, isPending };
+}
+
 /** Delete a vault link. */
-export function useDeleteLink(agentId: string, linkId: string) {
+export function useDeleteLink(linkId: string) {
   const http = useHttp();
   const queryClient = useQueryClient();
 
   const remove = useCallback(async () => {
     try {
-      await http.delete(`/v1/agents/${agentId}/vault/links/${linkId}`);
+      await http.delete(`/v1/vault/links/${linkId}`);
       await queryClient.invalidateQueries({ queryKey: [VAULT_KEY, "links"] });
       await queryClient.invalidateQueries({ queryKey: [VAULT_KEY, "all-links"] });
       toast.success(i18n.t("vault:toast.linkDeleted"));
@@ -111,7 +160,7 @@ export function useDeleteLink(agentId: string, linkId: string) {
       toast.error(i18n.t("vault:toast.linkDeleteFailed"), err instanceof Error ? err.message : "");
       throw err;
     }
-  }, [http, agentId, linkId, queryClient]);
+  }, [http, linkId, queryClient]);
 
   return { remove };
 }
diff --git a/ui/web/src/pages/vault/hooks/use-vault-upload.ts b/ui/web/src/pages/vault/hooks/use-vault-upload.ts
new file mode 100644
index 00000000..f98d1892
--- /dev/null
+++ b/ui/web/src/pages/vault/hooks/use-vault-upload.ts
@@ -0,0 +1,45 @@
+import { useCallback, useState } from "react";
+import { useQueryClient } from "@tanstack/react-query";
+import { useHttp } from "@/hooks/use-ws";
+import { toast } from "@/stores/use-toast-store";
+import i18n from "@/i18n";
+import type { VaultDocument } from "@/types/vault";
+
+const VAULT_KEY = "vault";
+
+interface UploadResult {
+  documents: Array<{ document?: VaultDocument; error?: string }>;
+  count: number;
+}
+
+/** Upload files to vault via multipart POST /v1/vault/upload. */
+export function useVaultUpload() {
+  const http = useHttp();
+  const queryClient = useQueryClient();
+  const [isPending, setIsPending] = useState(false);
+
+  const upload = useCallback(
+    async (files: File[], opts?: { agentId?: string; teamId?: string }) => {
+      setIsPending(true);
+      try {
+        const form = new FormData();
+        if (opts?.agentId) form.append("agent_id", opts.agentId);
+        if (opts?.teamId) form.append("team_id", opts.teamId);
+        for (const f of files) form.append("files", f);
+
+        const result = await http.upload("/v1/vault/upload", form);
+        await queryClient.invalidateQueries({ queryKey: [VAULT_KEY] });
+        toast.success(i18n.t("vault:toast.uploadSuccess", { count: result.count }));
+        return result;
+      } catch (err) {
+        toast.error(i18n.t("vault:toast.uploadFailed"), err instanceof Error ? err.message : "");
+        throw err;
+      } finally {
+        setIsPending(false);
+      }
+    },
+    [http, queryClient],
+  );
+
+  return { upload, isPending };
+}
diff --git a/ui/web/src/pages/vault/hooks/use-vault.ts b/ui/web/src/pages/vault/hooks/use-vault.ts
index 154a2819..7b72c323 100644
--- a/ui/web/src/pages/vault/hooks/use-vault.ts
+++ b/ui/web/src/pages/vault/hooks/use-vault.ts
@@ -1,4 +1,4 @@
-import { useCallback, useMemo } from "react";
+import { useCallback, useEffect, useMemo, useState } from "react";
 import { useQuery, useQueryClient } from "@tanstack/react-query";
 import { useHttp } from "@/hooks/use-ws";
 import type { VaultDocument, VaultLink, VaultSearchResult } from "@/types/vault";
@@ -72,39 +72,35 @@ export function useVaultSearch(agentId: string) {
   return { search, invalidate };
 }
 
-/** Fetch all links for a set of vault documents (for graph view). */
-export function useVaultAllLinks(agentId: string, documents: { id: string }[]) {
+/** Tenant-wide vault search (agent_id optional). */
+export function useVaultSearchAll() {
   const http = useHttp();
 
+  const search = useCallback(
+    async (query: string, opts?: { agentId?: string; docTypes?: string[]; teamId?: string; maxResults?: number }) => {
+      return http.post("/v1/vault/search", {
+        query,
+        agent_id: opts?.agentId || undefined,
+        doc_types: opts?.docTypes,
+        team_id: opts?.teamId || undefined,
+        max_results: opts?.maxResults ?? 20,
+      });
+    },
+    [http],
+  );
+
+  return { search };
+}
+
+/** Fetch all links for a set of vault documents (single batch query). */
+export function useVaultAllLinks(agentId: string, documents: { id: string }[]) {
+  const http = useHttp();
   const docIds = useMemo(() => documents.map((d) => d.id), [documents]);
 
   const { data, isLoading } = useQuery({
     queryKey: [VAULT_KEY, "all-links", agentId, [...docIds].sort().join(",")],
-    queryFn: async () => {
-      if (docIds.length === 0) return [];
-      const allLinks: VaultLink[] = [];
-      const batchSize = 10;
-      for (let i = 0; i < docIds.length; i += batchSize) {
-        const batch = docIds.slice(i, i + batchSize);
-        const results = await Promise.all(
-          batch.map((id) =>
-            http.get<{ outlinks: VaultLink[]; backlinks: VaultLink[] }>(
-              `/v1/agents/${agentId}/vault/documents/${id}/links`,
-            ).catch(() => ({ outlinks: [], backlinks: [] })),
-          ),
-        );
-        for (const r of results) {
-          allLinks.push(...r.outlinks);
-        }
-      }
-      const seen = new Set();
-      return allLinks.filter((l) => {
-        if (seen.has(l.id)) return false;
-        seen.add(l.id);
-        return true;
-      });
-    },
-    enabled: !!agentId && docIds.length > 0,
+    queryFn: () => http.post("/v1/vault/links/batch", { doc_ids: docIds }),
+    enabled: docIds.length > 0,
     staleTime: 60_000,
   });
 
@@ -137,43 +133,11 @@ export function useVaultGraphData(agentId: string, opts?: { teamId?: string }) {
     [documents],
   );
 
-  // Fetch links grouped by agent_id — works for both single-agent and all-agents mode.
+  // Fetch all links in one batch query (single SQL, no N+1).
+  const docIds = useMemo(() => documents.map((d) => d.id), [documents]);
   const { data: linksData, isLoading: linksLoading } = useQuery({
     queryKey: [VAULT_KEY, "graph-links", docIdKey],
-    queryFn: async () => {
-      if (documents.length === 0) return [];
-      // Group doc IDs by agent_id
-      const byAgent = new Map();
-      for (const doc of documents) {
-        const aid = doc.agent_id;
-        if (!aid) continue;
-        if (!byAgent.has(aid)) byAgent.set(aid, []);
-        byAgent.get(aid)!.push(doc.id);
-      }
-
-      const allLinks: VaultLink[] = [];
-      for (const [aid, ids] of byAgent) {
-        const batchSize = 10;
-        for (let i = 0; i < ids.length; i += batchSize) {
-          const batch = ids.slice(i, i + batchSize);
-          const results = await Promise.all(
-            batch.map((id) =>
-              http.get<{ outlinks: VaultLink[]; backlinks: VaultLink[] }>(
-                `/v1/agents/${aid}/vault/documents/${id}/links`,
-              ).catch(() => ({ outlinks: [], backlinks: [] })),
-            ),
-          );
-          for (const r of results) allLinks.push(...r.outlinks);
-        }
-      }
-      // Dedup
-      const seen = new Set();
-      return allLinks.filter((l) => {
-        if (seen.has(l.id)) return false;
-        seen.add(l.id);
-        return true;
-      });
-    },
+    queryFn: () => http.post("/v1/vault/links/batch", { doc_ids: docIds }),
     enabled: documents.length > 0,
     staleTime: 60_000,
   });
@@ -181,22 +145,34 @@ export function useVaultGraphData(agentId: string, opts?: { teamId?: string }) {
   return { documents, links: linksData ?? [], loading: docsLoading || linksLoading };
 }
 
+/** Enriched backlink with source doc metadata (from backend JOIN). */
+export interface VaultBacklink {
+  from_doc_id: string;
+  context: string;
+  title: string;
+  path: string;
+  team_id?: string;
+}
+
 /** Get links (outlinks + backlinks) for a vault document. */
-export function useVaultLinks(agentId: string, docId: string | null) {
+export function useVaultLinks(docId: string | null) {
   const http = useHttp();
 
   const { data, isLoading } = useQuery({
-    queryKey: [VAULT_KEY, "links", agentId, docId],
-    queryFn: () => http.get<{ outlinks: VaultLink[]; backlinks: VaultLink[] }>(
-      `/v1/agents/${agentId}/vault/documents/${docId}/links`,
-    ),
-    enabled: !!docId && !!agentId,
+    queryKey: [VAULT_KEY, "links", docId],
+    queryFn: () => http.get<{
+      outlinks: VaultLink[];
+      backlinks: VaultBacklink[];
+      doc_names: Record;
+    }>(`/v1/vault/documents/${docId}/links`),
+    enabled: !!docId,
     placeholderData: (prev) => prev,
   });
 
   return {
     outlinks: data?.outlinks ?? [],
     backlinks: data?.backlinks ?? [],
+    docNames: data?.doc_names ?? {},
     loading: isLoading,
   };
 }
@@ -219,6 +195,25 @@ export function useVaultFileContent(path: string | null) {
   return { content: data?.content ?? null, size: data?.size ?? 0, loading: isLoading, error: !!error };
 }
 
+/** Fetch an image file as blob URL for authenticated rendering in  tags. */
+export function useVaultImageUrl(path: string | null): { url: string | null; error: boolean } {
+  const http = useHttp();
+  const [url, setUrl] = useState(null);
+  const [error, setError] = useState(false);
+
+  useEffect(() => {
+    if (!path) { setUrl(null); setError(false); return; }
+    let revoke: string | null = null;
+    setError(false);
+    http.downloadBlob(`/v1/storage/files/${encodeURIComponent(path)}?raw=true`)
+      .then((blob) => { revoke = URL.createObjectURL(blob); setUrl(revoke); })
+      .catch(() => { setUrl(null); setError(true); });
+    return () => { if (revoke) URL.revokeObjectURL(revoke); };
+  }, [path, http]);
+
+  return { url, error };
+}
+
 // Re-export mutations for convenience — consumers can import from this single file
 export {
   useCreateDocument,
@@ -226,4 +221,5 @@ export {
   useDeleteDocument,
   useCreateLink,
   useDeleteLink,
+  useRescanWorkspace,
 } from "./use-vault-mutations";
diff --git a/ui/web/src/pages/vault/vault-create-dialog.tsx b/ui/web/src/pages/vault/vault-create-dialog.tsx
index 1daa852f..1c7657ad 100644
--- a/ui/web/src/pages/vault/vault-create-dialog.tsx
+++ b/ui/web/src/pages/vault/vault-create-dialog.tsx
@@ -1,142 +1,215 @@
-import { useState } from "react";
-import { useForm } from "react-hook-form";
-import { zodResolver } from "@hookform/resolvers/zod";
+import { useState, useEffect, useCallback, useRef, type ChangeEvent, type DragEvent } from "react";
 import { useTranslation } from "react-i18next";
+import { Upload, X, FileText } from "lucide-react";
 import { Button } from "@/components/ui/button";
-import { Input } from "@/components/ui/input";
 import { Label } from "@/components/ui/label";
 import {
   Dialog, DialogContent, DialogHeader, DialogTitle, DialogFooter,
 } from "@/components/ui/dialog";
-import { useCreateDocument } from "./hooks/use-vault";
-import { vaultCreateSchema, type VaultCreateFormData } from "@/schemas/vault.schema";
+import { useAgents } from "@/pages/agents/hooks/use-agents";
+import { useTeams } from "@/pages/teams/hooks/use-teams";
+import { useVaultUpload } from "./hooks/use-vault-upload";
 
-const DOC_TYPES = ["context", "memory", "note", "skill"] as const;
-const SCOPES = ["personal", "team", "shared"] as const;
+const ACCEPTED_EXTS = new Set([
+  ".md", ".txt", ".json", ".yaml", ".yml", ".csv", ".toml", ".xml", ".html", ".htm",
+  ".go", ".py", ".js", ".ts", ".tsx", ".jsx", ".rs", ".java", ".rb", ".sh", ".sql",
+  ".swift", ".kt", ".c", ".cpp", ".h",
+]);
+const ACCEPT_ATTR = Array.from(ACCEPTED_EXTS).join(",");
 
-interface Props {
-  agentId: string;
-  open: boolean;
-  onOpenChange: (open: boolean) => void;
-  onCreated?: () => void;
+function isAllowedExt(name: string): boolean {
+  const dot = name.lastIndexOf(".");
+  if (dot < 0) return false;
+  return ACCEPTED_EXTS.has(name.slice(dot).toLowerCase());
 }
 
-export function VaultCreateDialog({ agentId, open, onOpenChange, onCreated }: Props) {
+function formatBytes(bytes: number): string {
+  if (bytes < 1024) return `${bytes} B`;
+  if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)} KB`;
+  return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
+}
+
+type Destination = "shared" | "agent" | "team";
+
+interface Props {
+  open: boolean;
+  onOpenChange: (open: boolean) => void;
+  onUploaded?: () => void;
+  defaultAgentId?: string;
+  defaultTeamId?: string;
+}
+
+export function VaultCreateDialog({ open, onOpenChange, onUploaded, defaultAgentId, defaultTeamId }: Props) {
   const { t } = useTranslation("vault");
-  const { create } = useCreateDocument(agentId);
-  const [saving, setSaving] = useState(false);
+  const { agents } = useAgents();
+  const { teams, load: loadTeams } = useTeams();
+  const { upload, isPending } = useVaultUpload();
+  const inputRef = useRef(null);
 
-  const {
-    register,
-    handleSubmit,
-    watch,
-    setValue,
-    reset,
-    formState: { errors },
-  } = useForm({
-    resolver: zodResolver(vaultCreateSchema),
-    defaultValues: {
-      title: "",
-      path: "",
-      docType: "note",
-      scope: "personal",
-    },
-  });
+  const [destination, setDestination] = useState("shared");
+  const [agentId, setAgentId] = useState("");
+  const [teamId, setTeamId] = useState("");
+  const [files, setFiles] = useState([]);
+  const [dragging, setDragging] = useState(false);
 
-  const docType = watch("docType");
-  const scope = watch("scope");
+  // Load teams on first open
+  useEffect(() => { if (open) loadTeams(); }, [open, loadTeams]);
 
-  const onValid = async (data: VaultCreateFormData) => {
-    setSaving(true);
+  // Reset state when dialog opens; pre-select destination from parent filters
+  useEffect(() => {
+    if (!open) return;
+    setFiles([]);
+    setDragging(false);
+    if (defaultAgentId) {
+      setDestination("agent");
+      setAgentId(defaultAgentId);
+    } else if (defaultTeamId) {
+      setDestination("team");
+      setTeamId(defaultTeamId);
+    } else {
+      setDestination("shared");
+    }
+  }, [open, defaultAgentId, defaultTeamId]);
+
+  const addFiles = useCallback((incoming: File[]) => {
+    const valid = incoming.filter((f) => isAllowedExt(f.name));
+    setFiles((prev) => {
+      const names = new Set(prev.map((f) => f.name));
+      return [...prev, ...valid.filter((f) => !names.has(f.name))];
+    });
+  }, []);
+
+  const onDrop = useCallback((e: DragEvent) => {
+    e.preventDefault();
+    setDragging(false);
+    addFiles(Array.from(e.dataTransfer.files));
+  }, [addFiles]);
+
+  const onFileInput = useCallback((e: ChangeEvent) => {
+    addFiles(Array.from(e.target.files ?? []));
+    e.target.value = "";
+  }, [addFiles]);
+
+  const removeFile = (idx: number) => setFiles((prev) => prev.filter((_, i) => i !== idx));
+
+  const handleUpload = async () => {
+    const opts = destination === "agent" ? { agentId }
+      : destination === "team" ? { teamId }
+        : {};
     try {
-      await create({ title: data.title.trim(), path: data.path.trim(), doc_type: data.docType, scope: data.scope });
-      reset();
-      onCreated?.();
+      await upload(files, opts);
       onOpenChange(false);
+      onUploaded?.();
     } catch {
       // error toasted in hook
-    } finally {
-      setSaving(false);
     }
   };
 
-  const handleClose = (v: boolean) => {
-    if (!saving) { reset(); onOpenChange(v); }
-  };
+  const canUpload = files.length > 0
+    && !isPending
+    && (destination !== "agent" || agentId)
+    && (destination !== "team" || teamId);
+
+  const handleClose = (v: boolean) => { if (!isPending) onOpenChange(v); };
 
   return (
     
       
         
-          {t("createDoc")}
+          {t("upload.title", "Upload to Vault")}
         
 
-        

-          

-            
-            
-            {errors.title && (
-              
{errors.title.message}

-            )}
-          

+        

+          {/* Destination radio group */}
+          

+            
+            

+              
 
-          

-            
-            
-            {errors.path && (
-              
{errors.path.message}

-            )}
-          

+              
+              {destination === "agent" && (
+                
+              )}
 
-          

-            

-              
-              
+              
+              {destination === "team" && (
+                
+              )}
             

+          

 
-            

-              
-              
-            

+          {/* Drop zone */}
+          
 { e.preventDefault(); setDragging(true); }}
+            onDragLeave={() => setDragging(false)}
+            onDrop={onDrop}
+            onClick={() => inputRef.current?.click()}
+            className={`flex flex-col items-center justify-center gap-2 rounded-lg border-2 border-dashed p-6 cursor-pointer transition-colors ${
+              dragging ? "border-primary bg-primary/5" : "border-muted-foreground/25 hover:border-primary/50"
+            }`}
+          >
+            
+            
{t("upload.dropzone", "Drop files here or click to browse")}

+            
{t("upload.dropzoneHint", "Text files only (.md, .txt, .json, .yaml, .csv, ...)")}

+            
           

 
-          
-            
-            
-          
-        
+          {/* File list */}
+          {files.length > 0 && (
+            

+              
+              

+                {files.map((f, i) => (
+                  

+                    
+                    {f.name}
+                    {formatBytes(f.size)}
+                    
+                  

+                ))}
+              

+            

+          )}
+        

+
+        
+          
+          
+        
       
     
   );
diff --git a/ui/web/src/pages/vault/vault-detail-dialog.tsx b/ui/web/src/pages/vault/vault-detail-dialog.tsx
index 102a0092..a5adfbcf 100644
--- a/ui/web/src/pages/vault/vault-detail-dialog.tsx
+++ b/ui/web/src/pages/vault/vault-detail-dialog.tsx
@@ -1,6 +1,6 @@
-import { useState } from "react";
+import { useState, useMemo } from "react";
 import { useTranslation } from "react-i18next";
-import { Pencil, Plus, FileText, Link2 } from "lucide-react";
+import { Pencil, Plus, FileText, Link2, FileQuestion } from "lucide-react";
 import { Badge } from "@/components/ui/badge";
 import { Button } from "@/components/ui/button";
 import { Input } from "@/components/ui/input";
@@ -8,7 +8,7 @@ import {
   Dialog, DialogContent, DialogHeader, DialogTitle,
 } from "@/components/ui/dialog";
 import { MarkdownRenderer } from "@/components/shared/markdown-renderer";
-import { useVaultLinks, useVaultFileContent, useUpdateDocument, useDeleteDocument } from "./hooks/use-vault";
+import { useVaultLinks, useVaultFileContent, useVaultImageUrl, useUpdateDocument, useDeleteDocument } from "./hooks/use-vault";
 import { VaultLinkDialog } from "./vault-link-dialog";
 import {
   VaultEditControls, DocTypeSelect, ScopeSelect, LinkBadge,
@@ -24,7 +24,7 @@ interface Props {
 
 export function VaultDetailDialog({ doc, open, onOpenChange, onDeleted }: Props) {
   const { t } = useTranslation("vault");
-  const { outlinks, backlinks, loading } = useVaultLinks(doc?.agent_id ?? "", doc?.id ?? null);
+  const { outlinks, backlinks, docNames, loading } = useVaultLinks(doc?.id ?? null);
 
   const [editMode, setEditMode] = useState(false);
   const [editTitle, setEditTitle] = useState("");
@@ -34,12 +34,24 @@ export function VaultDetailDialog({ doc, open, onOpenChange, onDeleted }: Props)
   const [confirmDelete, setConfirmDelete] = useState(false);
   const [linkDialogOpen, setLinkDialogOpen] = useState(false);
 
-  // Content always loaded when dialog is open
+  // Determine if this is an image that can be rendered.
+  const isImage = useMemo(() => {
+    const mime = doc?.metadata?.mime_type as string | undefined;
+    if (mime?.startsWith("image/")) return true;
+    const ext = doc?.path.split(".").pop()?.toLowerCase() ?? "";
+    return ["png", "jpg", "jpeg", "gif", "webp", "svg", "bmp", "ico"].includes(ext);
+  }, [doc?.metadata, doc?.path]);
+
+  const isMedia = doc?.doc_type === "media";
+
+  // Only fetch text content for non-media files (media/binary cannot be rendered as markdown).
   const { content: fileContent, loading: contentLoading, error: contentError } = useVaultFileContent(
-    open && doc ? doc.path : null,
+    open && doc && !isMedia ? doc.path : null,
   );
-  const { update } = useUpdateDocument(doc?.agent_id ?? "", doc?.id ?? "");
-  const { remove: removeDoc } = useDeleteDocument(doc?.agent_id ?? "", doc?.id ?? "");
+  // Fetch image as authenticated blob URL for  rendering.
+  const { url: imageUrl, error: imageError } = useVaultImageUrl(open && isMedia && isImage && doc ? doc.path : null);
+  const { update } = useUpdateDocument(doc?.id ?? "");
+  const { remove: removeDoc } = useDeleteDocument(doc?.id ?? "");
 
   if (!doc) return null;
 
@@ -149,7 +161,37 @@ export function VaultDetailDialog({ doc, open, onOpenChange, onDeleted }: Props)
 
           {/* Content preview — always visible, scrollable */}
           

-            {contentLoading ? (
+            {isMedia ? (
+              isImage ? (
+                

+                  {imageUrl ? (
+                    {doc.title
+                  ) : imageError ? (
+                    

+                      
+                      {t("detail.fileNotFound")}
+                    

+                  ) : (
+                    

+                  )}
+                

+              ) : (
+                

+                  
+                  

+                    
{t("detail.binaryFile")}

+                    
{(doc.metadata?.mime_type as string) || doc.path.split(".").pop()?.toUpperCase()}

+                  

+                  {doc.summary && (
+                    
{doc.summary}

+                  )}
+                

+              )
+            ) : contentLoading ? (
               

                 

                 

@@ -185,38 +227,40 @@ export function VaultDetailDialog({ doc, open, onOpenChange, onDeleted }: Props)
                   {t("detail.outlinks")} ({outlinks.length})
                 

                 {outlinks.length > 0 ? (
-                  

+                  

                     {outlinks.map((l) => (
-                      
+                      
                     ))}
                   

                 ) : (
                   {t("detail.noLinks")}
                 )}
-                
               

             )}
 
             {!loading && backlinks.length > 0 && (
-              

+              

                 {t("detail.backlinks")} ({backlinks.length})
-                

+                

                   {backlinks.map((l) => (
-                    
-                      {l.link_type}: {l.from_doc_id.slice(0, 8)}
+                    
+                      {l.title || l.from_doc_id.slice(0, 8)}
                     
                   ))}
                 

               

             )}
 
-            {/* Hash + link count as subtle footer */}
+            {/* Bottom bar: hash + add link */}
             

-              SHA-256: {doc.content_hash.length > 16 ? `${doc.content_hash.slice(0, 8)}...${doc.content_hash.slice(-8)}` : doc.content_hash}
-              {linkCount > 0 && {linkCount} link{linkCount !== 1 ? "s" : ""}}
+              

+                SHA-256: {doc.content_hash.length > 16 ? `${doc.content_hash.slice(0, 8)}...${doc.content_hash.slice(-8)}` : doc.content_hash}
+                {linkCount > 0 && {linkCount} link{linkCount !== 1 ? "s" : ""}}
+              

+              
             

 
             {/* Metadata JSON (if present) */}
@@ -236,7 +280,7 @@ export function VaultDetailDialog({ doc, open, onOpenChange, onDeleted }: Props)
 
       {linkDialogOpen && (
          string }) {
+export function LinkBadge({ link, docNames, t }: { link: VaultLink; docNames?: Record; t: (k: string) => string }) {
   const [confirmDelete, setConfirmDelete] = useState(false);
-  const { remove } = useDeleteLink(agentId, link.id);
+  const { remove } = useDeleteLink(link.id);
 
   const handleDelete = async () => {
     try {
@@ -123,8 +123,8 @@ export function LinkBadge({ link, agentId, t }: { link: VaultLink; agentId: stri
   }
 
   return (
-    
-      {link.link_type}: {link.to_doc_id.slice(0, 8)}
+    
+      {link.link_type}: {docNames?.[link.to_doc_id] || link.to_doc_id.slice(0, 8)}
       

               {outlinks.length > 0 && (
                 

-                  {outlinks.map((l) => )}
+                  {outlinks.map((l) => )}
                 

               )}
             

@@ -162,7 +162,9 @@ export function VaultDetailPanel({ doc, open, onClose, onDeleted }: Props) {
                 {t("detail.backlinks")} ({backlinks.length})
                 

                   {backlinks.map((l) => (
-                    {l.from_doc_id.slice(0, 8)}
+                    
+                      {l.title || l.from_doc_id.slice(0, 8)}
+                    
                   ))}
                 

               

@@ -172,7 +174,7 @@ export function VaultDetailPanel({ doc, open, onClose, onDeleted }: Props) {
       

 
       {linkDialogOpen && (
-        
       )}
     
diff --git a/ui/web/src/pages/vault/vault-document-sidebar.tsx b/ui/web/src/pages/vault/vault-document-sidebar.tsx
index 380864b1..ae1a154e 100644
--- a/ui/web/src/pages/vault/vault-document-sidebar.tsx
+++ b/ui/web/src/pages/vault/vault-document-sidebar.tsx
@@ -1,24 +1,26 @@
-import { useEffect, useRef } from "react";
+import { useState, useEffect, useRef, useCallback } from "react";
 import { useTranslation } from "react-i18next";
 import {
-  Link2, ChevronLeft, ChevronRight,
+  Link2, ChevronLeft, ChevronRight, Search, X, Loader2,
   FileText, Brain, StickyNote, Sparkles, Clock, Image,
 } from "lucide-react";
 import { Badge } from "@/components/ui/badge";
 import { Button } from "@/components/ui/button";
 import { formatRelativeTime } from "@/lib/format";
-import type { VaultDocument } from "@/types/vault";
+import type { VaultDocument, VaultSearchResult } from "@/types/vault";
+import { useVaultSearchAll } from "./hooks/use-vault";
 
-const DOC_TYPE_CONFIG: Record = {
-  context: { color: "text-blue-600 dark:text-blue-400", bg: "bg-blue-500/10", icon: FileText },
-  memory: { color: "text-purple-600 dark:text-purple-400", bg: "bg-purple-500/10", icon: Brain },
-  note: { color: "text-amber-600 dark:text-amber-400", bg: "bg-amber-500/10", icon: StickyNote },
-  skill: { color: "text-emerald-600 dark:text-emerald-400", bg: "bg-emerald-500/10", icon: Sparkles },
-  episodic: { color: "text-orange-600 dark:text-orange-400", bg: "bg-orange-500/10", icon: Clock },
-  media: { color: "text-rose-600 dark:text-rose-400", bg: "bg-rose-500/10", icon: Image },
+const DOC_TYPE_CONFIG: Record = {
+  context:  { color: "text-blue-600 dark:text-blue-400",    bg: "bg-blue-500/10",    icon: FileText, dotColor: "bg-blue-500" },
+  memory:   { color: "text-purple-600 dark:text-purple-400", bg: "bg-purple-500/10",  icon: Brain,    dotColor: "bg-purple-500" },
+  note:     { color: "text-amber-600 dark:text-amber-400",   bg: "bg-amber-500/10",   icon: StickyNote, dotColor: "bg-amber-500" },
+  skill:    { color: "text-emerald-600 dark:text-emerald-400", bg: "bg-emerald-500/10", icon: Sparkles, dotColor: "bg-emerald-500" },
+  episodic: { color: "text-orange-600 dark:text-orange-400", bg: "bg-orange-500/10",  icon: Clock,    dotColor: "bg-orange-500" },
+  media:    { color: "text-rose-600 dark:text-rose-400",     bg: "bg-rose-500/10",    icon: Image,    dotColor: "bg-rose-500" },
 };
 
-const DEFAULT_CONFIG = { color: "text-muted-foreground", bg: "bg-muted", icon: FileText };
+const DEFAULT_CONFIG = { color: "text-muted-foreground", bg: "bg-muted", icon: FileText, dotColor: "bg-muted-foreground" };
+const DOC_TYPES = ["context", "memory", "note", "skill", "episodic", "media"] as const;
 
 interface Props {
   documents: VaultDocument[];
@@ -30,6 +32,10 @@ interface Props {
   totalPages: number;
   total: number;
   onPageChange: (page: number) => void;
+  docType: string;
+  onDocTypeChange: (type: string) => void;
+  agentId: string;
+  teamId: string;
 }
 
 function DocCard({ doc, selected, linkCount, onClick }: {
@@ -54,17 +60,13 @@ function DocCard({ doc, selected, linkCount, onClick }: {
       }`}
       onClick={onClick}
     >
-      {/* Type icon */}
       

         
       

-
-      {/* Content */}
       

         
           {doc.title || doc.path.split("/").pop()}
         
-
         

           {t(`type.${doc.doc_type}`)}
           ·
@@ -87,21 +89,125 @@ function DocCard({ doc, selected, linkCount, onClick }: {
 }
 
 export function VaultDocumentSidebar({
-  documents, selectedId, linkCounts, onSelect, loading, page, totalPages, total, onPageChange,
+  documents, selectedId, linkCounts, onSelect, loading,
+  page, totalPages, total, onPageChange,
+  docType, onDocTypeChange, agentId, teamId,
 }: Props) {
   const { t } = useTranslation("vault");
+  const [query, setQuery] = useState("");
+  const [searchResults, setSearchResults] = useState(null);
+  const [searching, setSearching] = useState(false);
+  const inputRef = useRef(null);
+  const debounceRef = useRef>(null);
+  const { search } = useVaultSearchAll();
+
+  const doSearch = useCallback(
+    async (q: string) => {
+      if (!q.trim()) {
+        setSearchResults(null);
+        return;
+      }
+      setSearching(true);
+      try {
+        const results = await search(q, {
+          agentId: agentId || undefined,
+          docTypes: docType ? [docType] : undefined,
+          teamId: teamId || undefined,
+          maxResults: 30,
+        });
+        setSearchResults(results);
+      } catch {
+        setSearchResults([]);
+      } finally {
+        setSearching(false);
+      }
+    },
+    [search, agentId, docType, teamId],
+  );
+
+  const handleQueryChange = (value: string) => {
+    setQuery(value);
+    if (debounceRef.current) clearTimeout(debounceRef.current);
+    if (!value.trim()) {
+      setSearchResults(null);
+      return;
+    }
+    debounceRef.current = setTimeout(() => doSearch(value), 300);
+  };
+
+  const clearSearch = () => {
+    setQuery("");
+    setSearchResults(null);
+    inputRef.current?.focus();
+  };
+
+  // Show search results or regular document list
+  const isSearchMode = query.trim().length > 0;
+  const displayDocs = isSearchMode && searchResults
+    ? searchResults.map((r) => r.document)
+    : documents;
 
   return (
     

-      {/* Header */}
-      

-        {t("title")}
-        {total}
+      {/* Filter bar: type chips + search */}
+      

+        {/* Type filter chips — horizontal scroll */}
+        

+          
+          {DOC_TYPES.map((dt) => {
+            const cfg = DOC_TYPE_CONFIG[dt] ?? DEFAULT_CONFIG;
+            const active = docType === dt;
+            return (
+              
+            );
+          })}
+          {total}
+        

+
+        {/* Search input */}
+        

+          {searching
+            ? 
+            : 
+          }
+           handleQueryChange(e.target.value)}
+            placeholder={t("searchPlaceholder")}
+            className="w-full rounded-md border bg-background pl-7 pr-7 py-1 text-base md:text-xs placeholder:text-muted-foreground focus:outline-none focus:ring-1 focus:ring-ring"
+          />
+          {query && (
+            
+          )}
+        

       

 
       {/* Doc list */}
       

-        {loading && documents.length === 0 ? (
+        {(loading || searching) && displayDocs.length === 0 ? (
           Array.from({ length: 6 }).map((_, i) => (
             

               

@@ -111,13 +217,13 @@ export function VaultDocumentSidebar({
               

             

           ))
-        ) : documents.length === 0 ? (
+        ) : displayDocs.length === 0 ? (
           

             
-            {t("noDocuments")}
+            {isSearchMode ? t("noResults") : t("noDocuments")}
           

         ) : (
-          documents.map((doc) => (
+          displayDocs.map((doc) => (
             
 
-      {/* Pagination footer */}
-      {totalPages > 1 && (
+      {/* Pagination footer — hidden during search */}
+      {!isSearchMode && totalPages > 1 && (
         

           

             
               
TypeSuggestionStatusCreatedActions{t("detail.evolution.colType")}{t("detail.evolution.colSuggestion")}{t("detail.evolution.colStatus")}{t("detail.evolution.colCreated")}{t("detail.evolution.colActions")}
               

             
             
           
         

-                  {agentMap.get(doc.agent_id) ?? doc.agent_id.slice(0, 8)}
+                  {doc.agent_id ? (agentMap.get(doc.agent_id) ?? doc.agent_id.slice(0, 8)) : t("scope.shared")}
                 
                 
                   {truncatePath(doc.path)}
diff --git a/ui/web/src/pages/vault/vault-graph-controls.tsx b/ui/web/src/pages/vault/vault-graph-controls.tsx
deleted file mode 100644
index cd7994db..00000000
--- a/ui/web/src/pages/vault/vault-graph-controls.tsx
+++ /dev/null
@@ -1,57 +0,0 @@
-import type { RefObject } from "react";
-import { ZoomIn, ZoomOut, Maximize2 } from "lucide-react";
-import { Button } from "@/components/ui/button";
-import { useTranslation } from "react-i18next";
-
-const NODE_LIMIT_OPTIONS = [100, 200, 300, 500] as const;
-
-interface Props {
-  docCount: number;
-  linkCount: number;
-  nodeLimit: number;
-  isLimited: boolean;
-  zoomDisplayRef: RefObject;
-  onNodeLimitChange: (limit: number) => void;
-  onZoomIn: () => void;
-  onZoomOut: () => void;
-  onFitToView: () => void;
-}
-
-export function VaultGraphControls({
-  docCount, linkCount, nodeLimit, isLimited, zoomDisplayRef,
-  onNodeLimitChange, onZoomIn, onZoomOut, onFitToView,
-}: Props) {
-  const { t } = useTranslation("vault");
-
-  return (
-    

-      {t("graphDocs", { count: docCount, defaultValue: "{{count}} docs" })}
-      {t("graphLinks", { count: linkCount, defaultValue: "{{count}} links" })}
-      {isLimited && (
-        · {t("graphLimitNote", { limit: nodeLimit, total: docCount, defaultValue: "showing {{limit}} of {{total}}" })}
-      )}
-      

-      

-        
-        100%
-        
-      

-      
-      
-    

-  );
-}
diff --git a/ui/web/src/pages/vault/vault-graph-view.tsx b/ui/web/src/pages/vault/vault-graph-view.tsx
index 261f82df..922c904a 100644
--- a/ui/web/src/pages/vault/vault-graph-view.tsx
+++ b/ui/web/src/pages/vault/vault-graph-view.tsx
@@ -1,14 +1,17 @@
-import { useRef, useMemo, useEffect, useLayoutEffect, useCallback, useState } from "react";
-import ForceGraph2D, { type ForceGraphMethods } from "react-force-graph-2d";
-import { useUiStore } from "@/stores/use-ui-store";
-import { buildVaultGraphData, limitVaultDocsByDegree, VAULT_TYPE_COLORS } from "@/adapters/vault-graph-adapter";
-import type { VaultGraphNode, VaultGraphLink } from "@/adapters/vault-graph-adapter";
+import { useRef, useMemo, useState, useCallback } from "react";
+import type Sigma from "sigma";
+import { useTranslation } from "react-i18next";
+import { buildVaultGraph, limitVaultDocsByDegree, VAULT_TYPE_COLORS } from "@/adapters/vault-graph-adapter";
+import { SigmaGraphContainer } from "@/components/graph/sigma-graph-container";
+import { SigmaGraphControls } from "@/components/graph/sigma-graph-controls";
+import { SigmaGraphSearch } from "@/components/graph/sigma-graph-search";
+import { SigmaGraphFilters } from "@/components/graph/sigma-graph-filters";
+import { SigmaGraphMinimap } from "@/components/graph/sigma-graph-minimap";
+import { SigmaGraphKeyboardHelp } from "@/components/graph/sigma-graph-keyboard-help";
+import { useSigmaKeyboard } from "@/components/graph/use-sigma-keyboard";
 import type { VaultDocument } from "@/types/vault";
 import { useVaultGraphData } from "./hooks/use-vault";
-import { VaultGraphControls } from "./vault-graph-controls";
 
-const NODE_R = 5;
-const DOUBLE_CLICK_MS = 280;
 const DEFAULT_NODE_LIMIT = 200;
 
 interface Props {
@@ -20,192 +23,119 @@ interface Props {
 }
 
 export function VaultGraphView({ agentId, teamId, selectedDocId, onNodeSelect, onNodeDoubleClick }: Props) {
-  const theme = useUiStore((s) => s.theme);
-  const isDark = theme === "dark" || (theme === "system" && window.matchMedia("(prefers-color-scheme: dark)").matches);
+  const { t } = useTranslation("vault");
+  const containerRef = useRef(null);
+  const searchInputRef = useRef(null);
+  const [sigma, setSigma] = useState(null);
+  const [nodeLimit, setNodeLimit] = useState(DEFAULT_NODE_LIMIT);
+  const [hiddenTypes, setHiddenTypes] = useState>(new Set());
+  const [filtersOpen, setFiltersOpen] = useState(false);
 
   const { documents: allDocs, links, loading } = useVaultGraphData(agentId, { teamId });
 
-  const graphRef = useRef>(undefined);
-  const containerRef = useRef(null);
-  const [dimensions, setDimensions] = useState({ width: 600, height: 400 });
-  const [ready, setReady] = useState(false);
-  const [nodeLimit, setNodeLimit] = useState(DEFAULT_NODE_LIMIT);
-  const zoomRef = useRef(1);
-  const zoomDisplayRef = useRef(null);
-  const clickTimerRef = useRef | null>(null);
-  const lastClickRef = useRef(null);
-
-  // Container sizing
-  useLayoutEffect(() => {
-    const el = containerRef.current;
-    if (el && el.clientWidth > 0 && el.clientHeight > 0) {
-      setDimensions({ width: el.clientWidth, height: el.clientHeight });
-      setReady(true);
-    }
-  }, []);
-
-  useEffect(() => {
-    const el = containerRef.current;
-    if (!el) return;
-    const ro = new ResizeObserver(([entry]) => {
-      if (!entry) return;
-      const { width, height } = entry.contentRect;
-      if (width > 0 && height > 0) { setDimensions({ width, height }); setReady(true); }
-    });
-    ro.observe(el);
-    return () => ro.disconnect();
-  }, []);
-
-  // Pan camera to externally-selected node
-  useEffect(() => {
-    if (!selectedDocId || !graphRef.current) return;
-    const node = graphData.nodes.find((n) => n.id === selectedDocId);
-    if (node?.x != null && node?.y != null) {
-      graphRef.current.centerAt(node.x, node.y, 300);
-    }
-  }, [selectedDocId]);
-
   const totalCount = allDocs.length;
   const isLimited = totalCount > nodeLimit;
   const documents = useMemo(() => limitVaultDocsByDegree(allDocs, links, nodeLimit), [allDocs, links, nodeLimit]);
   const docMap = useMemo(() => new Map(documents.map((d) => [d.id, d])), [documents]);
-  const graphData = useMemo(() => buildVaultGraphData(documents, links), [documents, links]);
-
-  // Highlight sets from selectedDocId (controlled by parent)
-  const { highlightNodes, highlightLinks } = useMemo(() => {
-    if (!selectedDocId) return { highlightNodes: new Set(), highlightLinks: new Set() };
-    const node = graphData.nodes.find((n) => n.id === selectedDocId);
-    if (!node) return { highlightNodes: new Set(), highlightLinks: new Set() };
-    return { highlightNodes: new Set([selectedDocId, ...node.neighbors]), highlightLinks: new Set(node.linkIds) };
-  }, [selectedDocId, graphData.nodes]);
-
-  const nodeCanvasObject = useCallback(
-    (node: VaultGraphNode, ctx: CanvasRenderingContext2D, globalScale: number) => {
-      const x = node.x ?? 0, y = node.y ?? 0;
-      const isSelected = node.id === selectedDocId;
-      const isNeighbor = highlightNodes.has(node.id);
-      const isDimmed = !!selectedDocId && !isSelected && !isNeighbor;
-      const r = NODE_R + Math.min(node.degree, 10);
-
-      ctx.beginPath();
-      ctx.arc(x, y, r, 0, 2 * Math.PI);
-      ctx.fillStyle = isDimmed ? `${node.color}30` : node.color;
-      ctx.fill();
-
-      if (isSelected) {
-        ctx.strokeStyle = node.color; ctx.lineWidth = 2.5 / globalScale;
-        ctx.shadowColor = node.color; ctx.shadowBlur = 8 / globalScale;
-        ctx.stroke(); ctx.shadowBlur = 0;
-      } else if (isNeighbor) {
-        ctx.strokeStyle = node.color; ctx.lineWidth = 1.5 / globalScale; ctx.stroke();
-      }
-
-      if (globalScale > 0.5 || isSelected || isNeighbor) {
-        const fontSize = Math.max(11 / globalScale, 2);
-        ctx.font = `${isSelected ? "bold " : ""}${fontSize}px Inter, system-ui, sans-serif`;
-        ctx.textAlign = "center"; ctx.textBaseline = "top";
-        ctx.fillStyle = isDimmed
-          ? (isDark ? "rgba(255,255,255,0.12)" : "rgba(0,0,0,0.12)")
-          : (isDark ? "#e2e8f0" : "#1e293b");
-        ctx.fillText(node.title.slice(0, 24), x, y + r + 2 / globalScale);
-      }
-    },
-    [selectedDocId, highlightNodes, isDark],
+  // Only build graph when ALL data loaded — prevents double-render
+  // (orphan-only layout → with-links layout) that causes visual chaos.
+  const graph = useMemo(
+    () => loading ? buildVaultGraph([], []) : buildVaultGraph(documents, links),
+    [documents, links, loading],
   );
 
-  const linkCanvasObject = useCallback(
-    (link: any, ctx: CanvasRenderingContext2D, globalScale: number) => {
-      if (!highlightLinks.has(link.id)) return;
-      const src = link.source, tgt = link.target;
-      if (!src?.x || !tgt?.x) return;
-      const midX = (src.x + tgt.x) / 2, midY = (src.y + tgt.y) / 2;
-      const fontSize = Math.max(9 / globalScale, 2);
-      const text = link.label || "";
-      ctx.font = `${fontSize}px Inter, system-ui, sans-serif`;
-      ctx.textAlign = "center"; ctx.textBaseline = "middle";
-      const metrics = ctx.measureText(text);
-      const pad = 2 / globalScale;
-      ctx.fillStyle = isDark ? "rgba(15,23,42,0.85)" : "rgba(255,255,255,0.9)";
-      ctx.fillRect(midX - metrics.width / 2 - pad, midY - fontSize / 2 - pad, metrics.width + pad * 2, fontSize + pad * 2);
-      ctx.fillStyle = isDark ? "#94a3b8" : "#64748b";
-      ctx.fillText(text, midX, midY);
-    },
-    [highlightLinks, isDark],
-  );
+  const handleNodeDoubleClick = useCallback((nodeId: string) => {
+    const doc = docMap.get(nodeId);
+    if (doc) onNodeDoubleClick?.(doc);
+  }, [docMap, onNodeDoubleClick]);
 
-  // Single-click = highlight (notify parent), double-click = open detail
-  const handleNodeClick = useCallback(
-    (node: VaultGraphNode) => {
-      if (clickTimerRef.current && lastClickRef.current === node.id) {
-        clearTimeout(clickTimerRef.current); clickTimerRef.current = null; lastClickRef.current = null;
-        const doc = docMap.get(node.id);
-        if (doc) onNodeDoubleClick?.(doc);
-        return;
-      }
-      if (clickTimerRef.current) clearTimeout(clickTimerRef.current);
-      lastClickRef.current = node.id;
-      clickTimerRef.current = setTimeout(() => {
-        onNodeSelect?.(node.id === selectedDocId ? null : node.id);
-        clickTimerRef.current = null;
-      }, DOUBLE_CLICK_MS);
-    },
-    [docMap, selectedDocId, onNodeSelect, onNodeDoubleClick],
-  );
+  useSigmaKeyboard({
+    sigma,
+    graph,
+    containerRef,
+    selectedNodeId: selectedDocId,
+    onNodeSelect,
+    searchInputRef,
+  });
 
-  const handleZoomIn = useCallback(() => { const fg = graphRef.current; if (fg) fg.zoom(Math.min((fg.zoom() ?? 1) * 1.5, 8), 300); }, []);
-  const handleZoomOut = useCallback(() => { const fg = graphRef.current; if (fg) fg.zoom(Math.max((fg.zoom() ?? 1) / 1.5, 0.1), 300); }, []);
-  const handleFitToView = useCallback(() => graphRef.current?.zoomToFit(300, 20), []);
+  const hasData = allDocs.length > 0;
 
   return (
-    

-      {/* Legend */}
-      

-        {Object.entries(VAULT_TYPE_COLORS).map(([type, color]) => (
-          
-            
-            {type}
-          
-        ))}
+    

+      {/* Top bar — responsive: stacks on narrow screens */}
+      

+        

+          {Object.entries(VAULT_TYPE_COLORS).map(([type, color]) => (
+            
+              
+              {type}
+            
+          ))}
+        

+        {hasData && (
+          

+            
+             setFiltersOpen(!c)}
+            />
+            
+          

+        )}
       

 
-      {/* Graph canvas */}
-      

+      {/* Graph canvas + minimap overlay */}
+      

         {loading && allDocs.length === 0 ? (
           

-        ) : allDocs.length === 0 ? (
+        ) : !hasData ? (
           
No documents

-        ) : ready ? (
-           "replace"}
-            nodePointerAreaPaint={(node, color, ctx) => {
-              const r = NODE_R + Math.min((node as VaultGraphNode).degree, 10) + 3;
-              ctx.beginPath(); ctx.arc(node.x ?? 0, node.y ?? 0, r, 0, 2 * Math.PI); ctx.fillStyle = color; ctx.fill();
-            }}
-            onNodeClick={handleNodeClick}
-            onBackgroundClick={() => onNodeSelect?.(null)}
-            onZoom={(transform) => {
-              zoomRef.current = transform.k;
-              if (zoomDisplayRef.current) zoomDisplayRef.current.textContent = `${Math.round(transform.k * 100)}%`;
-            }}
-            linkColor={(link: any) => highlightLinks.has(link.id) ? "#64748b" : (isDark ? "#334155" : "#cbd5e1")}
-            linkWidth={(link: any) => (highlightLinks.has(link.id) ? 2 : 0.5)}
-            linkCanvasObject={linkCanvasObject}
-            linkCanvasObjectMode={(link: any) => (highlightLinks.has(link.id) ? "after" : undefined)}
-            linkDirectionalParticles={(link: any) => (highlightLinks.has(link.id) ? 2 : 0)}
-            linkDirectionalParticleWidth={3} linkDirectionalParticleSpeed={0.004}
-            linkDirectionalArrowLength={4} linkDirectionalArrowRelPos={1}
-            backgroundColor="transparent" d3AlphaDecay={0.04} d3VelocityDecay={0.3}
-            warmupTicks={40} cooldownTime={4000} enableNodeDrag minZoom={0.1} maxZoom={8}
-          />
-        ) : null}
+        ) : (
+          <>
+            
+            

+              
+            

+          
+        )}
       

 
       {/* Stats bar */}
-      
     

   );
diff --git a/ui/web/src/pages/vault/vault-link-dialog.tsx b/ui/web/src/pages/vault/vault-link-dialog.tsx
index 277ac4d0..4c71aeeb 100644
--- a/ui/web/src/pages/vault/vault-link-dialog.tsx
+++ b/ui/web/src/pages/vault/vault-link-dialog.tsx
@@ -31,7 +31,7 @@ interface Props {
 
 export function VaultLinkDialog({ agentId, fromDoc, open, onOpenChange, onCreated }: Props) {
   const { t } = useTranslation("vault");
-  const { create } = useCreateLink(agentId);
+  const { create } = useCreateLink();
   const { documents } = useVaultDocuments(agentId, { limit: 100 });
   const [saving, setSaving] = useState(false);
 
diff --git a/ui/web/src/pages/vault/vault-page.tsx b/ui/web/src/pages/vault/vault-page.tsx
index d0e8a3ca..057a67aa 100644
--- a/ui/web/src/pages/vault/vault-page.tsx
+++ b/ui/web/src/pages/vault/vault-page.tsx
@@ -1,12 +1,13 @@
-import { useState, useEffect, useMemo, lazy, Suspense } from "react";
+import { useState, useEffect, useMemo, useCallback, lazy, Suspense } from "react";
 import { useTranslation } from "react-i18next";
-import { Search, FileArchive, Plus, PanelLeftOpen } from "lucide-react";
+import { Search, FileArchive, Plus, PanelLeftOpen, FolderSync, Loader2 } from "lucide-react";
 import { Button } from "@/components/ui/button";
 import { Tooltip, TooltipContent, TooltipProvider, TooltipTrigger } from "@/components/ui/tooltip";
 import { useAgents } from "@/pages/agents/hooks/use-agents";
 import { useTeams } from "@/pages/teams/hooks/use-teams";
 import { useIsMobile } from "@/hooks/use-media-query";
-import { useVaultDocuments, useVaultGraphData } from "./hooks/use-vault";
+import { useVaultDocuments, useVaultGraphData, useRescanWorkspace } from "./hooks/use-vault";
+import { useEnrichmentProgress } from "./hooks/use-enrichment-progress";
 import { VaultDocumentSidebar } from "./vault-document-sidebar";
 import { VaultSearchDialog } from "./vault-search-dialog";
 import { VaultCreateDialog } from "./vault-create-dialog";
@@ -31,6 +32,7 @@ export function VaultPage() {
 
   const [selectedAgent, setSelectedAgent] = useState("");
   const [selectedTeam, setSelectedTeam] = useState("");
+  const [docType, setDocType] = useState("");
   const [detailDoc, setDetailDoc] = useState(null);
   const [selectedDocId, setSelectedDocId] = useState(null);
   const [searchOpen, setSearchOpen] = useState(false);
@@ -38,8 +40,13 @@ export function VaultPage() {
   const [sidebarOpen, setSidebarOpen] = useState(false);
   const [page, setPage] = useState(0);
 
+  const { rescan, isPending: rescanPending } = useRescanWorkspace();
+  const enrichment = useEnrichmentProgress();
+  const enriching = enrichment?.running ?? false;
+
   const { documents, total, loading } = useVaultDocuments(selectedAgent, {
     teamId: selectedTeam || undefined,
+    docType: docType || undefined,
     limit: PAGE_SIZE,
     offset: page * PAGE_SIZE,
   });
@@ -58,6 +65,7 @@ export function VaultPage() {
 
   const handleAgentChange = (v: string) => { setSelectedAgent(v); setPage(0); };
   const handleTeamChange = (v: string) => { setSelectedTeam(v); setPage(0); };
+  const handleDocTypeChange = (v: string) => { setDocType(v); setPage(0); };
 
   // Sidebar click → open detail modal + highlight graph node
   const handleSidebarSelect = (doc: VaultDocument) => {
@@ -67,15 +75,15 @@ export function VaultPage() {
   };
 
   // Graph single-click → highlight only
-  const handleNodeSelect = (docId: string | null) => {
+  const handleNodeSelect = useCallback((docId: string | null) => {
     setSelectedDocId(docId);
-  };
+  }, []);
 
   // Graph double-click → open detail modal + highlight
-  const handleNodeDoubleClick = (doc: VaultDocument) => {
+  const handleNodeDoubleClick = useCallback((doc: VaultDocument) => {
     setDetailDoc(doc);
     setSelectedDocId(doc.id);
-  };
+  }, []);
 
   const handleCloseDetail = () => { setDetailDoc(null); };
 
@@ -102,6 +110,10 @@ export function VaultPage() {
           totalPages={totalPages}
           total={total}
           onPageChange={setPage}
+          docType={docType}
+          onDocTypeChange={handleDocTypeChange}
+          agentId={selectedAgent}
+          teamId={selectedTeam}
         />
       

 
@@ -131,20 +143,46 @@ export function VaultPage() {
           
+          
+            
+              
+                
+              
+              {enriching ? t("enriching", "Enriching documents...") : t("rescanTooltip", "Rescan workspace")}
+            
+          
           
             
               
                 
-                  
                 
               
-              {!selectedAgent && {t("selectAgentFirst", "Select an agent first")}}
             
           
         

 
+        {/* Enrichment progress bar */}
+        {enrichment && enrichment.total > 0 && (
+          

+            

+              

+            

+            
+              {enrichment.running
+                ? `${t("enriching", "Enriching")} ${enrichment.done}/${enrichment.total}`
+                : t("enrichComplete", "Enrichment complete")}
+            
+          

+        )}
+
         {/* Graph — takes full remaining height */}
         

           }>
@@ -166,7 +204,7 @@ export function VaultPage() {
           onSelectResult={(doc) => { setDetailDoc(doc); setSelectedDocId(doc.id); }}
         />
       )}
-      {selectedAgent && }
+      
 
       {/* Detail dialog for all document views */}
       
diff --git a/ui/web/src/schemas/vault.schema.ts b/ui/web/src/schemas/vault.schema.ts
index d335f72a..95c23d3e 100644
--- a/ui/web/src/schemas/vault.schema.ts
+++ b/ui/web/src/schemas/vault.schema.ts
@@ -1,17 +1,9 @@
 import { z } from "zod";
 
-export const vaultCreateSchema = z.object({
-  title: z.string().min(1, "Required"),
-  path: z.string().min(1, "Required"),
-  docType: z.string().min(1),
-  scope: z.string().min(1),
-});
-
 export const vaultLinkSchema = z.object({
   toDocId: z.string().min(1, "Required"),
   linkType: z.string().min(1, "Required"),
   context: z.string().max(500).optional(),
 });
 
-export type VaultCreateFormData = z.infer;
 export type VaultLinkFormData = z.infer;
diff --git a/ui/web/src/stores/use-chat-messages-store.ts b/ui/web/src/stores/use-chat-messages-store.ts
new file mode 100644
index 00000000..bc271a9d
--- /dev/null
+++ b/ui/web/src/stores/use-chat-messages-store.ts
@@ -0,0 +1,101 @@
+import { create } from "zustand";
+import type { ChatMessage } from "@/types/chat";
+
+const MAX_CACHED_SESSIONS = 25;
+
+interface SessionMessages {
+  messages: ChatMessage[];
+  streamText: string | null;
+  thinkingText: string | null;
+  isRunning: boolean;
+  lastAccessedAt: number;
+}
+
+interface ChatMessagesState {
+  sessions: Record;
+  setSessionMessages: (sessionKey: string, messages: ChatMessage[]) => void;
+  updateSessionMessages: (sessionKey: string, updater: (prev: ChatMessage[]) => ChatMessage[]) => void;
+  setSessionStream: (sessionKey: string, streamText: string | null) => void;
+  setSessionThinking: (sessionKey: string, thinkingText: string | null) => void;
+  setSessionRunning: (sessionKey: string, isRunning: boolean) => void;
+}
+
+// Evict oldest idle sessions when cache exceeds limit.
+// Never evict sessions with an active run (isRunning).
+function evictStale(sessions: Record): Record {
+  const keys = Object.keys(sessions);
+  if (keys.length <= MAX_CACHED_SESSIONS) return sessions;
+
+  const evictable = keys
+    .filter((k) => !sessions[k]?.isRunning)
+    .sort((a, b) => (sessions[a]?.lastAccessedAt ?? 0) - (sessions[b]?.lastAccessedAt ?? 0));
+
+  const toRemove = evictable.slice(0, keys.length - MAX_CACHED_SESSIONS);
+  if (toRemove.length === 0) return sessions;
+
+  const next = { ...sessions };
+  for (const k of toRemove) delete next[k];
+  return next;
+}
+
+function touchSession(existing: SessionMessages | undefined, patch: Partial): SessionMessages {
+  return {
+    messages: patch.messages ?? existing?.messages ?? [],
+    streamText: patch.streamText !== undefined ? patch.streamText : (existing?.streamText ?? null),
+    thinkingText: patch.thinkingText !== undefined ? patch.thinkingText : (existing?.thinkingText ?? null),
+    isRunning: patch.isRunning !== undefined ? patch.isRunning : (existing?.isRunning ?? false),
+    lastAccessedAt: Date.now(),
+  };
+}
+
+export const useChatMessagesStore = create((set) => ({
+  sessions: {},
+
+  setSessionMessages: (sessionKey, messages) => {
+    set((state) => ({
+      sessions: evictStale({
+        ...state.sessions,
+        [sessionKey]: touchSession(state.sessions[sessionKey], { messages }),
+      }),
+    }));
+  },
+
+  updateSessionMessages: (sessionKey, updater) => {
+    set((state) => {
+      const current = state.sessions[sessionKey]?.messages ?? [];
+      return {
+        sessions: evictStale({
+          ...state.sessions,
+          [sessionKey]: touchSession(state.sessions[sessionKey], { messages: updater(current) }),
+        }),
+      };
+    });
+  },
+
+  setSessionStream: (sessionKey, streamText) => {
+    set((state) => ({
+      sessions: {
+        ...state.sessions,
+        [sessionKey]: touchSession(state.sessions[sessionKey], { streamText }),
+      },
+    }));
+  },
+
+  setSessionThinking: (sessionKey, thinkingText) => {
+    set((state) => ({
+      sessions: {
+        ...state.sessions,
+        [sessionKey]: touchSession(state.sessions[sessionKey], { thinkingText }),
+      },
+    }));
+  },
+
+  setSessionRunning: (sessionKey, isRunning) => {
+    set((state) => ({
+      sessions: {
+        ...state.sessions,
+        [sessionKey]: touchSession(state.sessions[sessionKey], { isRunning }),
+      },
+    }));
+  },
+}));
diff --git a/ui/web/src/types/agent.ts b/ui/web/src/types/agent.ts
index 6dd89160..038f491f 100644
--- a/ui/web/src/types/agent.ts
+++ b/ui/web/src/types/agent.ts
@@ -67,6 +67,20 @@ export interface MemoryConfig {
   vector_weight?: number;
   text_weight?: number;
   min_score?: number;
+  dreaming?: DreamingConfig | null;
+}
+
+/**
+ * DreamingConfig mirrors Go internal/config.DreamingConfig — per-agent
+ * overrides for the consolidation dreaming worker. Pointer fields stay
+ * undefined when the operator hasn't set them so partial overrides merge
+ * cleanly with backend defaults.
+ */
+export interface DreamingConfig {
+  enabled?: boolean;
+  debounce_ms?: number;
+  threshold?: number;
+  verbose_log?: boolean;
 }
 
 export interface WorkspaceSharingConfig {
diff --git a/ui/web/src/types/evolution.ts b/ui/web/src/types/evolution.ts
index 9150e73e..0637a705 100644
--- a/ui/web/src/types/evolution.ts
+++ b/ui/web/src/types/evolution.ts
@@ -18,7 +18,7 @@ export interface RetrievalAggregate {
 export interface EvolutionSuggestion {
   id: string;
   agent_id: string;
-  suggestion_type: "threshold" | "tool_order" | "skill_add" | "memory_prune";
+  suggestion_type: "threshold" | "tool_order" | "skill_add";
   suggestion: string;
   rationale: string;
   parameters: Record | null;
diff --git a/ui/web/src/types/vault.ts b/ui/web/src/types/vault.ts
index c725c597..9ea805f5 100644
--- a/ui/web/src/types/vault.ts
+++ b/ui/web/src/types/vault.ts
@@ -2,7 +2,7 @@
 export interface VaultDocument {
   id: string;
   tenant_id: string;
-  agent_id: string;
+  agent_id?: string | null;
   team_id?: string;
   scope: "personal" | "team" | "shared";
   custom_scope?: string;