Fix ssh_exec error reporting + circular import in switch_profile ...

ssh_exec:
- Non-zero exit status: output (stdout/stderr) now included in error
  field so model can actually see why the command failed
- All error cases: error field now contains human-readable message
  instead of short code (no_target, permission_denied, timeout)
- Named connections from ssh_hosts.json: default known_hosts=none
  same as ad-hoc connections (was missing, caused host key failures)

switch_profile:
- Move ProfileSwitched import inside execute() to break circular
  import: tools.__init__ → switch_profile → core.events → core.agent
  → core.registry → tools

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Profile switch: emit WS event so client updates UI immediately ...

ProfileSwitched event emitted by switch_profile tool via current_event_sink.
Client handles profile_switched: updates chat header, profile selector,
and local sessions[] — no page refresh needed.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Add switch_profile tool for automatic profile switching ...

Navi can now switch her own profile mid-session when the task domain
changes. The new profile (tools + system prompt) takes effect from the
next user message. Injected with session_store + profile_registry like
SpawnAgentTool. Added to all profiles' enabled_tools and persona.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Major feature batch: visibility, planning, file uploads, streaming ...

- stream_complete(): streaming with tools for all LLM turns — thinking
  now streams as ThinkingDelta/ThinkingEnd in real-time during tool-
  selection turns, not just on the final response
- todo built-in tool: session-scoped plan manager (set/view/update/clear);
  persona + all profiles updated with mandatory planning instructions
- TurnThinking event: sub-agent thinking forwarded to parent sink as a
  collapsible block in the spawn_agent card
- File uploads: non-image files uploaded via XHR, shown as badges in
  message bubble; SVG treated as regular file (not base64 image)
- session_files: POST /sessions/{id}/files, TTL cleanup, forbidden exts
- WebSocket reconnect: _AgentRun broadcast pattern, re-attach mid-stream
- UI: favicon, sidebar logo, turn-thinking cards, subagent thinking blocks,
  token counter, draft persistence, file progress bar
- Removed AgentNote (content is always None alongside tool_calls)
- Ollama stream_complete: tool_calls captured from non-final chunk (done=False)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Live tool visibility: pending cards, sub-agent step log ...

Backend:
- ToolStarted event: emitted before tool execution begins so client
  can render a pending card with spinner immediately
- ToolEvent gains is_subagent flag; ToolStarted same
- current_event_sink ContextVar in tools/base.py — run_stream() sets it
  to an asyncio.Queue before create_task(); run_ephemeral() reads it and
  puts ToolStarted/ToolEvent into the queue as each sub-agent step runs
- run_stream() tool loop: sequential execution via create_task() +
  polling drain loop (20ms sleep); yields ToolStarted → sub-agent events
  from sink → ToolEvent (completed) for each tool call
- run_ephemeral() rewritten to inline sequential tool execution with
  sink emission (replaces _execute_tool_calls gather)
- _run_single_tool() helper extracted for run_stream()
- websocket.py handles tool_started and adds is_subagent to tool_call

Frontend:
- appendPendingToolCard(): creates card with spinner; spawn_agent opens
  body immediately to show sub-agent log as it fills
- finalizeToolCard(): fills result, removes spinner, adds toggle; strips
  "[Sub-agent result — ...]" reminder prefix from displayed text
- appendSubagentStep() / finalizeSubagentStep(): live step log inside
  spawn_agent card — each sub-agent tool call gets a ↳ row
- app.js: tool_started → pending card; tool_call → finalize card;
  is_subagent routing to sub-step vs main card; abandonStream() resets
  pendingToolCard/pendingSubStep
- CSS: .spinner-inline for card headers; .subagent-log / .subagent-step
  for nested step display; .tool-body-open for always-open spawn_agent
  body; .tool-card.pending suppresses chevron

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

spawn_agent: fix model behavior — synthesis reminder + lower delegation threshold ...

- ToolResult.output now prefixed with explicit reminder that the user
  cannot see sub-agent output and the orchestrator must present findings
  in its own final response; reminder appears adjacent to the result so
  the model reads it in context
- spawn_agent description updated: lowers threshold from "3+" to "2+"
  tool calls, makes USER CANNOT SEE warning prominent, tightens wording
- persona.txt DELEGATION section: clearer rule (default to spawning for
  multi-step sub-tasks), explicit "never end turn after spawn results",
  removed abstract threshold in favour of concrete examples

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Add spawn_agent: sub-agent delegation with isolated context ...

- Agent.run_ephemeral() — runs a sub-agent loop without a persistent
  session; accepts exclude_tools to block recursion; logs start/complete
- session_store made Optional in Agent.__init__ (None for ephemeral runs)
- SpawnAgentTool (navi/tools/spawn_agent.py): spawns an isolated Agent
  for a focused task; resolves profile from parent session via ContextVar;
  blocks spawn_agent recursion via exclude_tools=["spawn_agent"]
- build_default_registries() accepts session_store param; registers
  SpawnAgentTool after BackendRegistry is built (patches _backend_registry)
- deps.py passes _session_store to build_default_registries
- All profiles: spawn_agent added to enabled_tools, max_iterations 10→30
- persona.txt: DELEGATION section — when/how to use spawn_agent

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

SSH connection pooling: per-session, 20-minute TTL ...

- Pool keyed by session_id:host:port:username — parallel sessions share
  no state even when targeting the same server
- Per-key asyncio.Lock prevents concurrent connection creation races
- TTL (20 min) and is_closing() checked on every access; expired/closed
  connections are evicted and replaced transparently
- On disconnect error during command execution: evict + retry once with
  fresh connection
- current_session_id ContextVar (set by Agent before tool calls) is read
  in ssh_exec to build the pool key without changing tool signatures

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Fix naive/aware datetime comparison in session store and memory extraction ...

Old sessions stored datetimes without timezone offset. _row_to_session now
always returns timezone-aware datetimes via _parse_dt() helper, fixing the
TypeError when comparing session.last_active against timezone.utc cutoffs.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Add long-term user memory system ...

Architecture:
- navi/memory/store.py: MemoryStore backed by SQLite (memory_facts,
  memory_summary, session_memory_state tables in navi.db)
- navi/memory/extractor.py: LLM-based fact extraction from sessions +
  summary regeneration (triggered after session goes idle >30 min)
- Fact upsert uses UNIQUE(category, key) — same key always overwrites,
  no duplicates or stale contradictions
- Keyword search across category + key + value (LIKE-based, no extra deps)

Context injection:
- Memory summary injected as an ephemeral system message on every LLM call
  via Agent._with_memory() — never persisted to session.context

Tools (all profiles):
- memory_search(query): keyword search against fact DB; persona instructs
  model to call it at session start and before personal-context questions
- memory_forget(key, category?): delete a specific fact on user request

Extraction trigger:
- On new session creation, fire-and-forget background task checks all
  sessions idle >30 min with unprocessed messages → runs extraction

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Add web_view tool: headless browser with text extraction and screenshot ...

- New built-in tool web_view: opens URL in headless Chromium via Playwright,
  strips nav/footer/scripts, returns clean readable text (capped at 20k chars).
  Optional screenshot=true returns a PNG injected into context as an image.
  Handles JS-rendered pages and SPAs (waits for networkidle by default).
- http_request description updated: explicitly says to use web_view for human-
  readable pages, http_request for APIs/JSON/custom auth.
- web_view added to all three profiles.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Add /debug page: inspect LLM context by session ID ...

- GET /sessions/{id}/context — returns session.context (what the model sees)
  with message count and total char count
- /debug — standalone HTML page, session ID from URL hash
  Shows each context message: role badge, full content, tool calls as JSON,
  images as thumbnails, per-message and total char/token estimates

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Fix NAVI_PERSONA not loading: move persona to persona.txt ...

python-dotenv cannot parse multi-line env values that contain blank lines or
lines resembling key=value assignments (like the write_tool code examples).
The persona was silently dropped, leaving Navi with no identity.

Solution: navi_persona_file setting (default empty) — if set, the persona is
read from the specified file at startup via a model_validator. The .env now
points to persona.txt instead of embedding the multi-line string.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Fix context loss: ensure system prompt is always present in LLM context ...

Replaced `if not session.context:` with a role-based check so the system
message is inserted whenever it is absent — not just for brand-new sessions.

Root cause: backward-compat sessions (context column was empty) had their
context initialised from session.messages, which never contains a system
message. The old check (`if not session.context:`) saw a non-empty list and
skipped the system prompt, so every subsequent request ran without it —
Navi had no persona and no profile instructions.

Also add context_token_count field to Session (follow-up for token counter
fix — persistence wiring comes in next commit).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Review fixes: events module, circular imports, deps, vision-aware compression ...

- Extract all AgentEvent dataclasses to navi/core/events.py; import from
  there in agent.py and __init__.py — eliminates circular import between
  workers and core
- workers/compressor.py: remove runtime import hack, use navi.core.events
- workers/base.py: WorkerResult.events typed as list[AgentEvent] (was Any)
- api/deps.py: replace @lru_cache on mutable list with module-level
  singletons (_registries, _workers)
- core/compressor.py: _format_for_summary returns (text, images); images
  passed to summarization LLM so vision models describe them in summary;
  non-vision models silently ignore the images field; docstring updated
- client/js/app.js: add comment explaining is_summary backward compat branch

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Switch all profiles to gemma4:e4b-it-q8_0 ...

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Separate display history from LLM context; formalize worker system ...

Architecture change:
- session.messages: full display history, never modified by compression
- session.context: what the LLM sees, may be compressed by workers
- System messages go only into context (not display history)
- Image injections (synthetic) go only into context
- User/assistant/tool messages go into both

SQLite: add context column with backward-compat migration
(empty context → initialized from messages on load)

Workers (navi/workers/):
- Worker ABC + WorkerContext + WorkerResult (base.py)
- CompressionWorker: compresses session.context when above threshold
- build_default_workers() returns [CompressionWorker()]
- Agent accepts workers list, runs them after StreamEnd
- Workers injected via deps.py get_workers() (lru_cached singleton)
- WebSocket agent construction also receives workers

Compressor: compress_context() now takes context[], not messages[]
Config: context_keep_recent 6 → 10
Agent: _run_workers() collects events from all workers and yields them

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Add context compression: rolling summarization when context fills up ...

Mechanism:
- After streaming ends, if context_tokens >= threshold (80% of num_ctx),
  compress old turns into a summary message using the same LLM
- Partition: keep system msg + last N turns verbatim (default 6);
  everything older goes to the summarizer
- Tool call groups (assistant + tool results) never split across boundary
- Existing summary messages folded into new compression pass — no stack growth
- Summary stored as Message(role=user, is_summary=True) after system msg
- On failure: logged, session left unchanged (non-fatal)

New files:
- navi/core/compressor.py: should_compress, partition_messages,
  compress_session (pure logic, testable without agent)

New config (navi/config.py):
- context_compression_enabled: bool = True
- context_compression_threshold: float = 0.80
- context_keep_recent: int = 6
- context_summary_temperature: float = 0.3

New agent event: ContextCompressed(messages_before, messages_after)
Message.is_summary: bool field marks compressed history blocks

Client:
- context_compressed WS event → subtle inline notice in message list
- loadHistory: is_summary messages rendered as collapsible summary cards
- style.css: .summary-card, .compression-notice

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Add context token counter: 64k default, live UI display ...

- config: ollama_num_ctx default 8192 → 65536
- LLMChunk: add prompt_tokens / completion_tokens fields
- OllamaBackend.stream: populate token counts from final chunk
  (prompt_eval_count + eval_count when chunk.done)
- StreamEnd: add context_tokens and max_context_tokens
- Agent.run_stream: capture token counts, pass to StreamEnd
- websocket: include context_tokens / max_context_tokens in stream_end
- index.html: split chat-header into title span + token-counter span
- sidebar.js: updateChatHeader targets #chat-header-title, not innerHTML
- app.js: updateTokenCounter() shows "X/Y (Z%) tokens", colors:
  gray <50%, amber 50–79%, red ≥80%
- style.css: .token-counter, .warn, .danger styles

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Server review fixes: profile model routing, sorting, datetime, cleanup ...

- LLMBackend.complete/stream: add model param; OllamaBackend uses it
  over self.model, enabling per-profile model selection
- BackendRegistry.get(): remove unused model param
- Agent: pass profile.model to complete() and stream()
- Profiles: correct model to gemma4:e2b-it-q8_0 (was leftover e4b)
- InMemorySessionStore.list_all(): fix sort (pinned+newest first,
  was pinned+oldest) — now consistent with SQLite ORDER BY
- session.py, sqlite_session_store.py: datetime.utcnow() →
  datetime.now(timezone.utc) (deprecated since Python 3.12)
- _base_options(): accept temperature param, remove dead default
- deps.py: rename _registries → get_registries (public API)
- websocket.py: update import accordingly

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Wire self-extension tools into all profiles; improve tool descriptions ...

All profiles now include write_tool, list_tools, tool_manual, reload_tools.
User tools from enabled.json merged in at runtime via Agent._tool_list().
Built-in tool descriptions rewritten to be more LLM-actionable.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Add self-extension tool system: write_tool, list_tools, tool_manual ...

- loader.py: module-level format (name/description/parameters/execute)
  preferred, class-based as fallback; isolated errors per file
- write_tool: validates + writes tools/name.py, reloads registry,
  adds to tools/enabled.json in one call
- list_tools: live tool list from registry (prevents hallucination)
- tool_manual: serves manuals/*.md or auto-generates from schema
- reload_tools: hot-reload without server restart
- registry: registry injection pattern for tools that need it;
  _builtin_names set to guard against reload overwriting builtins

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Add thinking/reasoning streaming support ...

Enable Ollama think param and stream reasoning chunks to client.
New agent events: ThinkingDelta, ThinkingEnd. Config gains ollama_think
and ollama_num_ctx settings. WebSocket protocol updated accordingly.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Add multimodal image support and client UX improvements ...

Server:
- Add ImageViewTool (load image from file/URL, returns base64)
- Add images field to Message model with created_at timestamp
- Agent run/run_stream accept images param; inject image messages after image_view tool calls
- WebSocket handler accepts images array from client, strips data URI prefix
- All profiles include image_view tool
- Fix tool call serialization (model_dump mode=json for datetime)
- Add no-store cache headers for static files

Client:
- Image attachment: file picker button + clipboard paste + preview strip with remove
- Images rendered in chat bubbles; loaded from history
- Tool cards rebuilt as div+CSS toggle (fixes details/overflow-hidden collapse bug)
- Tool cards appear before response bubble (lazy bubble creation on first stream_delta)
- Typing indicator persists through tool calls, removed only when text starts streaming
- Tool cards restored from history on page reload
- Message timestamps stored via created_at field, shown correctly in history
- Session ID reflected in URL hash for bookmarking; restored on page load
- Remove localStorage session tracking (server last_active used instead)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Pin sessions + larger code font ...

Server:
- Session.pinned field (bool, default False)
- SqliteSessionStore: ALTER TABLE migration for existing DBs, set_pinned(),
  ORDER BY pinned DESC, last_active DESC
- PATCH /sessions/{id}/pin endpoint

Client:
- Pin/unpin button appears on hover (📌/📍)
- Pinned sessions get blue left border and always-visible pin icon
- Local sort mirrors server sort (pinned first)
- Code blocks font-size bumped from 0.82em to 0.9em

sessions list: include preview from last message

Persistent sessions and client module refactor ...

Server:
- SqliteSessionStore replaces InMemorySessionStore as default backend
- Sessions survive server restarts (stored in navi.db)
- DB_PATH configurable via .env

Client:
- Split monolithic app.js into ES modules:
  js/api.js    — REST calls
  js/ws.js     — WebSocket wrapper (WsClient class)
  js/chat.js   — message area DOM helpers
  js/sidebar.js — session list and header helpers
  js/app.js    — state, wiring, boot
- Active session persisted in localStorage — restored on page reload

ssh_exec: accept credentials directly as tool parameters ...

host, username, password, port, key_path are now first-class parameters.
No config file needed — user can pass creds in the chat message.
Ad-hoc connections skip host key verification by default.
Named connections in ssh_hosts.json still work as a shortcut.

Fix SSH password auth: disable key lookup when password is configured ...

asyncssh tried ~/.ssh/* keys before the password, causing PermissionDenied
on hosts that only accept password auth. Now when 'password' is set and no
'client_keys', key auth is disabled entirely.

Fix system prompts: explicitly instruct model to use ssh_exec tool ...

Without explicit mention in the prompt the model assumed it had to
establish SSH connections itself and refused. Now each tool is listed
with a direct instruction to use it without hesitation.