Queue WebSocket sends until connected

Add Android WebView client (android-client/) ...

Thin Android shell that loads the Navi web interface from a configured
server URL. All UI served from the server — no local assets, no rebuild
needed for interface updates.

Features:
- First-launch setup screen to enter server URL (stored in SharedPreferences)
- On connection error: clears saved URL so next launch re-asks
- Full-screen WebView, no toolbar
- Camera + gallery + file picker via WebChromeClient.onShowFileChooser
- HTTP cleartext enabled for local network access
- targetSdk 34 to avoid forced edge-to-edge on Android 15
- Adaptive icon: logo SVG converted to Android vector drawable

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Agent improvements: mandatory planning, tool cleanup, smart_edit fixes ...

- Planning now mandatory on first message of every session (force_plan)
- RESOURCES, COMMITMENTS, ATOMICITY fields added to planning phase 1
- Todo auto-injected at iteration 0 so model tracks steps immediately
- Execution trigger injected after plan to prevent model treating plan as response
- Split developer profile: tool_developer (Navi tools) vs developer (general code)
- Simplified persona.txt: trimmed redundant content now handled by mechanics
- AIHelper.ask(): 120s timeout via asyncio.wait_for to prevent smart_edit hangs
- filesystem._smart_edit(): atomic write via temp file + os.replace()
- Removed 5 junk user tools (game project artifacts, trivial utilities)
- Removed instagram tools (to be rewritten); cleaned enabled.json

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Restructure persona: concrete information gathering protocol ...

- Replace abstract CONTEXT FIRST principle with explicit numbered protocol
  (check summary → memory_search → NAVI.md → ask user)
- Move protocol to top of persona (after identity) so it has maximum weight
- NAVI.md section: remove READ instructions (now in protocol), keep only WRITE
- LONG-TERM MEMORY: remove "search proactively" line (now in protocol),
  keep only save/forget instructions
- memory_search description: remove misleading "call at start of each session"
  (summary is already auto-injected); clarify when to actually call it

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Improve memory search: normalize query, AND-first, relevance scoring ...

- _normalize_query(): hyphens/underscores/slashes/dots → word boundaries,
  strip all other punctuation, lowercase — fixes comma-separated keyword bug
- Auto-dump: if ≤ 60 facts in DB, skip search and return all (no false negatives
  in a small personal memory store)
- AND-first: try matching all terms; fall back to OR only when AND returns nothing
- OR-fallback with scoring: facts matching more terms rank higher (score DESC),
  ties broken by recency

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Comprehensive documentation update ...

- websocket.md: add heartbeat, session_sync, replay_start/end, planning_status,
  plan_ready (with is_subagent), stream_end extra fields, context_compressed summary,
  updated _AgentRun.events replay buffer, corrected reconnect section
- sessions.md: add name, planning_logs fields; message flags (is_plan, is_compression,
  is_summary, thinking); set_name store op; debug endpoints section
- api.md: full rewrite — add generate-name, planning, file download endpoints;
  all missing WS events; correct message field table with is_plan/is_compression
- tools.md: update user tools list with all current tools
- index.md: fix profiles list (smart_home → developer)
- CLAUDE.md: add Documentation section with table of all docs files
- NAVI.md: add architecture.md entry, improve websocket description

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Add NAVI.md navigation hub and update core docs ...

NAVI.md: lightweight project entry point for Navi — server command,
key paths, doc map with query instructions, tool manual index.
All profiles read this; detailed content stays in docs/.

docs/agent.md: rewrite to cover 3-phase planning, all 10 thinking
mechanics flags, adaptive replan, anti-stall, goal anchoring.

docs/profiles.md: update AgentProfile fields (all flags), correct
profile list (secretary/server_admin/developer), JSON config format,
auto-discovery instead of manual registration.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Add instagram_engine and instagram_viewer tools (Navi-generated) ...

Browser automation tools for scraping public Instagram profiles using
Playwright + stealth. Registered in enabled.json and developer profile.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Remove code-specific scoping rules from planning prompt ...

Keep only the universal comma test heuristic — code-specific rules
were too narrow and cluttered the prompt.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Tighten AGENT step scoping in planning prompt ...

Added comma test heuristic: if a step description lists things with
'and' or commas, each item is a separate step. Added code-specific
guidance: one step = one file or one focused feature addition, never
scaffold + logic + helpers combined. Replaced abstract good/bad
examples with concrete code implementation examples.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Fix session switch race: connect WS after REST fetch completes ...

loadSession was setting currentId before the REST fetch, which triggered
ws.connect() immediately. If WS replay arrived before the REST response,
onStreamStart() would push a streaming message, then the REST response
would overwrite messages.value entirely — leaving streamingMsg pointing
to an orphaned object no longer in the array.

Fix: move currentId and location.hash assignment to after the REST fetch
so the WS connection is established only once messages are populated.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

WebSocket event replay buffer for disconnect resilience ...

On reconnect to an active agent run the server now replays all events
emitted since the turn started, then switches to live forwarding.
This eliminates the gap where tool cards, thinking blocks and stream
deltas were permanently lost after a network blip.

Server (_AgentRun):
- events: list[dict] buffers every serialised agent event
- broadcast() serialises and appends before putting in subscriber queues
- reconnect flow: subscribe → replay_count snapshot → stream_start →
  replay events[0:replay_count] → live _stream_to_client

Client:
- onStreamStart() removes the frozen ghost message instead of marking
  done=true, so replay cleanly rebuilds the message from scratch
- replayMode flag suppresses animations during replay
- onReplayStart/onReplayEnd handlers set/clear the flag and restore
  animate on the message once live events resume

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Add CONTEXT FIRST principle to persona ...

Navi should proactively gather context before asking the user for
anything — credentials, preferences, environment. Strengthens the
LONG-TERM MEMORY instruction from reactive ("when referenced") to
proactive ("before asking").

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Remove hello_world test tool and incomplete instagram_scraper ...

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Adaptive re-plan on todo step failure ...

When a todo step is newly marked failed, queue a targeted system message
for the next iteration prompting the model to revise its remaining pending
steps before continuing. Enabled by adaptive_replan_enabled flag (on by
default in developer profile). Zero overhead when no failure occurs.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Autonomous reasoning improvements: budget, anchoring, anti-stall, validation ...

- AgentProfile: per-profile thinking mechanics flags (think_enabled,
  iteration_budget_enabled, goal_anchoring, anti_stall, step_validation,
  planning_reflect, adaptive_replan) — all profiles updated in config.json
- Iteration budget: inject remaining iterations into context so model knows
  when to wrap up; urgency levels at ≤7 and ≤3 remaining
- Goal anchoring: inject original goal + todo state every N iterations to
  prevent drift on long tasks
- Anti-stall: two signals — no todo progress for N iterations, or identical
  tool calls repeated N times; warning injected into context
- Todo step validation: marking done requires a validation field describing
  how result was verified; failed gets a soft nudge with tip for re-planning
- stream_complete: add think param to base class, ollama and openai backends
- Summarizer: raise max_tokens 1024→3000, expand system prompt with
  user-preferences section and verbatim-value instructions
- Compression card: persist to session.messages (is_compression flag on
  Message), show expandable summary in webclient with markdown body
- ToolResult.to_message_content: always include output on failure so
  tracebacks and error details reach the model (fixes silent Error: None)
- Developer profile: fix subagent profile secretary→developer, add write_tool
  to subagent_tools, clarify write_tool vs filesystem in system prompt

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Fix code block copy button on HTTP — same execCommand fallback ...

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Fix clipboard copy on HTTP — fallback to execCommand ...

navigator.clipboard is only available in secure contexts (HTTPS/localhost).
Added textarea+execCommand fallback for plain HTTP deployments.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Planning debug panel, todo auto-populate, scratchpad/persona improvements ...

- Planning debug panel: new Planning tab in debug/index.html shows raw
  phase 1/2 outputs and token counts per planning run, stored in
  session.planning_logs (new column in both SQLite and PostgreSQL)
- New GET /sessions/{id}/planning API endpoint
- PlanningDebugData internal event wires _run_planning() output into
  session storage; never forwarded to WebSocket clients
- Phase 3 (plan critic) disabled — to be reworked with reflect integration
- Todo tool: auto-populated from plan steps after phase 2; model only
  needs to call update/view, not set
- Scratchpad: clarified description and persona instructions; removed
  context_transfer from user-facing docs (internal mechanism only)
- web_search: switched to ddgs package, SearXNG as primary backend,
  DDG html-only fallback; added find_up action to filesystem tool
- Persona: added SCRATCHPAD and TODO sections with clear usage rules;
  added NAVI.md project context instructions
- chat.js: fixed subagent planning event fallthrough into parent UI;
  statusLabel cleared on first stream delta

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Strip spurious separator rows from GFM tables in markdown renderer ...

Model often emits | --- | --- | --- | rows as visual dividers between
table body rows. fixTables() now tracks whether the header separator has
been seen; any subsequent all-separator pipe row is dropped rather than
passed through to marked.js where it renders as a data row with --- content.

Existing fixes (missing separator injection, mixed row repair) are preserved.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Route subagent planning events into spawn_agent card in the UI ...

Previously PlanningStatus/PlanReady had no is_subagent flag, so subagent
planning spinners and plan cards rendered as top-level Navi planning UI.

Backend:
- Add is_subagent field to PlanningStatus and PlanReady events
- _run_planning accepts is_subagent param, passes it through all yields
- run_ephemeral calls _run_planning with is_subagent=True
- websocket.py forwards is_subagent in planning_status and plan_ready messages

Frontend (chat.js):
- onPlanningStatus: if is_subagent, set planningLabel on the last spawn_agent
  card instead of msg.statusLabel
- onPlanReady: if is_subagent, push plan into spawn card steps and clear
  planningLabel; otherwise behave as before

Frontend (ToolCard.vue):
- Render subagent-planning-indicator (spinner + label) when planningLabel set
- Render plan cards inside subagent steps using the same plan-card pattern

Also includes leftover session changes: spawn_agent default 40 in description
and manual, updated manual content.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Fix subagent planning isolation and raise default max_iterations to 40 ...

- run_ephemeral signature default: max_iterations=20 → 40 (consistent
  with spawn_agent's explicit default)
- _run_planning accepts system_prompt_override; when called from
  run_ephemeral, passes the subagent's isolated system prompt instead of
  _build_system_prompt(profile) which includes the full orchestrator
  persona and profiles block — subagents now plan with only their own
  executor context

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Remove context_transfer from all user-facing prompts — internal mechanism only ...

context_transfer is the scratchpad section name used internally by spawn_agent
to auto-inject parent state. Navi doesn't control it and doesn't need to know
about it. Removed from: persona, secretary, server_admin, spawn_agent description,
manual. Internal code (spawn_agent.py) still reads the section transparently.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Fix core subagent misuse: enforce 1 plan step = 1 spawn_agent call ...

Root cause: nowhere was it stated that each AGENT step in the plan
maps to a separate spawn_agent call. Navi was bundling all AGENT steps
into a single call, dumping the full plan on one subagent.

spawn_agent description:
- Lead with: "Delegate EXACTLY ONE step of your plan"
- Explicit: "3 AGENT steps = 3 spawn_agent calls"
- Remove "multi-step sub-task" wording that invited bundling
- briefing: clarify as static context only (credentials, paths, instructions)
  Dynamic findings from prior steps → context_transfer, not briefing

Planning Phase 2 prompt:
- Add AGENT scoping rules: each step = one focused unit, not "do everything"
- Add good/bad examples of AGENT step granularity
- Show multiple AGENT steps in the format example

Secretary & server_admin system prompts:
- Add explicit 1:1 rule with counter-example
- Show correct multi-agent execution pattern with code example
- Clarify briefing vs context_transfer boundary everywhere

Persona:
- "ONE PLAN STEP = ONE spawn_agent CALL" as first sentence in SUB-AGENTS
- Field descriptions tightened: briefing = static, context_transfer = dynamic

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Fix subagent instruction conflicts across persona and profiles ...

Persona:
- Fix [STATUS: completed|limit_reached] reference (format was removed)
- Clarify three fields: task / briefing / system_prompt with distinct roles
- Clarify context_transfer vs briefing: transfer = working state, briefing = credentials

Secretary system_prompt:
- Replace vague "write all context to context_transfer" with explicit field breakdown
- task / briefing / system_prompt each described with their purpose
- context_transfer correctly limited to intermediate findings, not credentials

Server admin system_prompt:
- Same fix: explicit field breakdown for spawn_agent
- Remove dangling "see persona" reference for briefing ending

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Subagent system prompt rework: separate from parent, briefing as system context ...

run_ephemeral:
- Add briefing param (passed from spawn_agent, injected into system prompt)
- Subagent system prompt is now completely separate from parent's system_prompt:
    1. profile.subagent_system_prompt  (executor persona)
    2. custom_system_prompt            (role specialisation for this task)
    3. briefing                        (task context as system-level instruction)
  Fallback to profile.system_prompt only if subagent_system_prompt is not defined

spawn_agent:
- task → user message only (the goal)
- briefing → system prompt (credentials, context, instructions)
- system_prompt → role specialisation injected alongside briefing
- Removed old user-message composition (## Context / ## Task split)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Fix spawn_agent: restore briefing, fix status leakage, enable subagent planning ...

spawn_agent:
- Restore briefing param (task = goal, briefing = context — good separation)
- Add system_prompt as third param for role specialisation per task
- Remove [STATUS: ...] prefix that was leaking into Navi's responses and
  causing hallucination — replaced with natural-language headers that are
  less likely to be regurgitated verbatim
- completed → neutral header; limit_reached → explicit warning about incompleteness

Profiles:
- subagent_planning_enabled: false → true in all three profiles
  (planning is on by default, disable per-profile if needed)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Strengthen orchestration mandate: spawn first, inline last ...

secretary/server_admin system prompts:
- Explicit spawning rule: MUST spawn for any sub-task requiring 3+ tool calls
- Additional mandatory triggers listed (research, file processing, remote ops, large output)
- "If in doubt — spawn" as explicit fallback
- AGENT steps: "MANDATORY, never execute inline — defeats the orchestrator model"
- context_transfer pattern: write to scratchpad before spawning, injected automatically

persona.txt:
- Updated SUB-AGENT BRIEFING section: renamed to SUB-AGENTS
- Reflects new context_transfer automatic injection (no longer needs to be in task)
- Added: check [STATUS: ...] in result before deciding next action

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Fix NameError in _run_planning: session.context → context after refactor ...

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Improve subagent system: isolated tools, custom prompts, context transfer, timeout ...

AgentProfile:
- New fields: subagent_tools, subagent_planning_enabled, subagent_system_prompt
- loader.py: loads subagent_tools/subagent_planning_enabled from config.json,
  reads optional subagent_system_prompt.txt per profile

Profiles:
- Each profile now has a dedicated subagent_tools list (focused subset, no admin tools)
- subagent_planning_enabled: false (configurable per profile)
- New subagent_system_prompt.txt per profile with executor-focused instructions

run_ephemeral:
- Uses profile.subagent_tools instead of enabled_tools
- Builds subagent context without persona or profiles block (focused executor)
- Injects subagent_system_prompt after profile.system_prompt
- Accepts context_transfer: priming exchange injected before task message
- Wall-clock timeout (default 5 min) checked per iteration
- Returns (result_text, completed: bool) instead of bare string
- Optionally runs planning phase if profile.subagent_planning_enabled

spawn_agent:
- Removed briefing param; task is now fully self-contained
- Added system_prompt param: custom injected prompt for this specific task
- Auto-reads parent scratchpad context_transfer section via get_section()
- Result prefixed with [STATUS: completed|limit_reached]
- Timeout 300s

scratchpad:
- Added get_section(session_id, section) helper for cross-session reads

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>