Big Smooth daemon epic: SEP extensions, daemon PWA, th OAuth login, search/crawl/knowledge, web push

.changeset/at-mention-search.md

@@ -0,0 +1,12 @@
+---
+'smooai-smooth-daemon': minor
+'smooai-smooth-web': minor
+---
+
+`@` mention search in the smooth-web composer, mirroring the th code TUI (th-58b5fe).
+Typing `@` opens an autocomplete popup (files + path expansion from the workspace),
+backed by a new ungated `GET /search?q=` endpoint on the daemon (workspace files via
+the pruned ripgrep walk, bounded by a walk budget). The endpoint is mounted via a new
+`LocalServer.serve_routes()` seam. `@` and the `/smooth-mode` slash popup coexist —
+exactly one shows, decided by which token the caret sits in. Pearls in mentions are a
+documented follow-up (the `kind` field already accepts "pearl").

.changeset/daemon-converges-on-operator.md

@@ -0,0 +1,11 @@
+---
+'smooai-smooth-daemon': patch
+---
+
+EPIC th-c89c2a: the daemon converges fully on the operator — no second agent loop.
+`th daemon` (default and `operator`) now runs only smooth-operator's local flavor,
+made durable by a new sqlite `StorageAdapter` (survives restart, no Postgres) wired
+through the operator's `.storage()` seam. Deleted the bespoke `serve_persistent`
+path and its 13 modules (server/wire/runner/coordinator/scheduler/permission/
+sqlite/approval/event/hook/session/messages) plus the dead `:4400` bind. The daemon
+is now just config (egress + LLM creds) + operator + durable storage.

.changeset/daemon-conversation-rename.md

@@ -0,0 +1,18 @@
+---
+"@smooai/smooth": patch
+---
+
+feat: rename conversations from the Big Smooth daemon PWA sidebar
+
+Each sidebar row gains a rename affordance (a hover pencil icon, or double-click
+the row) that opens an inline text input in place of the title. Enter commits,
+Esc (or blur) cancels. The rename is applied optimistically to the row, then the
+server's canonical (sanitized) title is reconciled onto it from the
+`rename_conversation` reply.
+
+Wires a new `renameConversation(id, title)` into the `useOperator` hook, which
+sends the server's `rename_conversation` WS action
+(`{action, requestId, conversationId, title}`) and reconciles the echoed
+`{conversationId, title}`. Pairs with the server-side auto-title + rename
+(pearl th-d5b446): auto-generated titles now appear in the sidebar, and users can
+override them.

.changeset/daemon-conversation-sidebar.md

@@ -0,0 +1,27 @@
+---
+"@smooai/smooth": minor
+---
+
+feat: conversation sidebar + resume + new-chat in the Big Smooth daemon PWA
+
+The smooth-web SPA (`crates/smooth-web/web`) was a single, ephemeral chat — one
+fresh session per load, no history. It now has a toggleable slide-in sidebar
+that lists your recent conversations and lets you jump between them. Pearl
+th-d5b446.
+
+- **operator.ts** speaks three more actions of the smooth-operator WS protocol:
+  `list_conversations` (populates `conversations` for the sidebar, refreshed
+  after every turn), `create_conversation_session` with a `conversationId` (to
+  **resume**), and `get_conversation_messages` (loads a resumed conversation's
+  history into `messages`). New hook surface: `conversations`,
+  `activeConversationId`, `refreshConversations()`, `resumeConversation(id)`,
+  `newConversation()`.
+- **App.tsx** gains a menu-toggle + Aurora-Glass `Sidebar`: overlays with a
+  backdrop on mobile, docks on desktop, highlights the active conversation, and
+  carries a prominent "New chat" button. The Smooth brand mark moved into the
+  sidebar header. No sidebar interaction leaves the current single-chat
+  behaviour unchanged.
+
+Back-compat: history is rendered as text-only (past tool chips aren't
+reconstructed), and the message/`updatedAt` shapes are read defensively pending
+final reconciliation with the server-side action.

.changeset/daemon-embed-operator-local-flavor.md

@@ -0,0 +1,17 @@
+---
+'smooai-smooth-daemon': minor
+'smooai-smooth-cli': patch
+---
+
+EPIC th-c89c2a: the daemon can host the OPERATOR's local deployment flavor
+in-process. New `smooth_daemon::serve_local_flavor(addr)` boots
+smooth-operator's `LocalServer` (lean build — `default-features = false` drops
+all cloud adapters: AWS SDK / tokio-postgres / redis / nats; in-memory storage +
+backplane), gated by an auto-provisioned local token (`SMOOTH_LOCAL_TOKEN` env →
+`~/.smooth/operator-token` mode 600, generated on first run). Because the daemon
+*runs the operator*, it speaks the canonical schema-driven WS protocol by
+construction — the official widget and the polyglot SDK clients work natively.
+Exposed as `th daemon operator [--addr 127.0.0.1:8787]`. Additive: runs
+alongside the bespoke `/ws` path while the embed is validated; that bespoke
+surface retires once parity lands. (Depends on two local-flavor seams added
+upstream in smooth-operator: `LocalTokenVerifier` + `LocalServerBuilder::auth`.)

.changeset/daemon-live-operator-e2e.md

@@ -0,0 +1,15 @@
+---
+'smooai-smooth-daemon': minor
+---
+
+EPIC th-c89c2a: integration + live-LLM E2E for the operator local flavor
+(`tests/live_operator_e2e.rs`). Boots the local flavor in-process the way
+`serve_local_flavor` does (LocalTokenVerifier + the exposed `local_tool_provider`
++ a real gateway config) and drives the canonical WS protocol with a real
+client. The gated test (`SMOOTH_AGENT_E2E=1` + `SMOOAI_GATEWAY_KEY`) runs a real
+LLM turn that makes the agent call the kernel-sandboxed `bash` tool and round-trips
+its output back — proving protocol + agent loop + sandboxed tool execution + the
+live gateway end-to-end. The always-on test documents a finding: the operator's
+`/ws` degrades a missing/invalid token to an **anonymous** connection rather than
+rejecting it, so `LocalTokenVerifier` does NOT gate connections (only ACL scope) —
+the loopback bind is the real gate today. Module docs corrected accordingly.

.changeset/daemon-logs-to-stderr.md

@@ -0,0 +1,10 @@
+---
+'smooai-smooth-cli': patch
+---
+
+`th daemon` subcommands (including `th daemon operator`) now log to **stderr**
+instead of the TUI's `~/.smooth/log/th.log`. Daemon subcommands are
+long-running services, so their tracing output should be visible in the
+foreground and captured by the service supervisor (launchd/systemd via
+`th service`) — not buried in the file the TUI shares. (EPIC th-c89c2a; closes
+th-9eb87d — the operator's info logs were never silent, just file-routed.)

.changeset/daemon-reachability-and-presence.md

@@ -0,0 +1,23 @@
+---
+'smooai-smooth-daemon': minor
+'smooai-smooth-web': minor
+---
+
+EPIC th-c89c2a: make the daemon trivially reachable and give it a face + a voice.
+
+- **Same-origin serve (th-a28904):** the daemon serves the smooth-web SPA at its
+  own origin via a new `LocalServer.serve_spa()` seam, injecting the auth token
+  into `index.html` (`window.__SMOOTH_TOKEN__`, read first by `operator.ts`), so
+  `http://127.0.0.1:8787/` works with no `?api`/`?token` query string.
+- **Tailscale auto-serve (th-ce286d):** on startup, when Tailscale is present and
+  the node is up, the daemon exposes itself over the *tailnet* via `tailscale
+  serve` (never `funnel` — tailnet-private), with a `SMOOTH_TAILSCALE_SERVE=0`
+  opt-out and shutdown teardown.
+- **Big Smooth persona (th-5f059b):** the daemon installs a personal-assistant
+  system prompt via the operator's new `.persona()` seam, replacing the stock
+  customer-support prompt.
+- **smooth-web Presence glow-up (th-f1a1f0, th-833b5f):** the reactive Big Smooth
+  face is now the room — a haloed greeting on the empty state, a sticky presence
+  bar in conversation, the approval HITL emanating from him in amber, the
+  Bricolage Grotesque wordmark, a green liveness dot, and parked tools reading
+  "awaiting your okay".

.changeset/daemon-repoint-operator-main.md

@@ -0,0 +1,11 @@
+---
+'smooai-smooth-daemon': patch
+---
+
+EPIC th-c89c2a: the local-flavor seams landed on smooth-operator `main` (#108),
+so the daemon's operator path-deps (`smooth-operator-server`,
+`smooth-operator-svc`) now point at the canonical `../smooth-operator` checkout
+instead of the temporary `smooth-local-flavor` worktree (now removed). Same
+local-dev two-repo path pattern as the engine dep. (Closes th-845d79; full
+CI-mergeability still needs git-rev/published deps for the engine + operator —
+th-d3537a.)

.changeset/daemon-strict-auth.md

@@ -0,0 +1,12 @@
+---
+'smooai-smooth-daemon': minor
+---
+
+EPIC th-c89c2a: the local flavor now enables the operator's **strict-auth** mode
+(`LocalServerBuilder::strict_auth(true)` in `serve_local_flavor`), so a `/ws`
+connection with a missing/invalid token is **rejected (HTTP 401)** instead of
+degrading to an anonymous connection. This closes the gap the live e2e surfaced
+(th-6d1863): `LocalTokenVerifier` now genuinely gates connections — a stray local
+process or tailnet peer can't drive the agent. The widget + SDK clients carry the
+token, so they're unaffected. The e2e test now asserts tokenless `/ws` is rejected
+and a valid token is accepted (and the live LLM turn still runs).

.changeset/daemon-token-iteration-headroom.md

@@ -0,0 +1,18 @@
+---
+"@smooai/smooth": patch
+---
+
+fix(daemon): give Big Smooth chat assistant-grade token/iteration headroom
+
+The daemon's chat path resolved config via `local_config()` →
+`ServerConfig::from_env()`, silently inheriting the customer-support **chat
+widget** defaults (`512` max_tokens / `6` max_iterations). A reasoning model
+like `deepseek-v4-flash` spends its entire 512-token budget on
+`reasoning_content` and gets cut off before emitting any `content` — the
+"Big Smooth seems hung" empty reply — while 6 iterations makes any
+read-a-few-files turn hit "Maximum iterations reached". `resolve_gateway_config`
+now gives the daemon `32768` tokens / `50` iterations unless
+`SMOOTH_AGENT_MAX_TOKENS` / `SMOOTH_AGENT_MAX_ITERATIONS` explicitly override.
+
+Also guards `BigSmoothFace` WebGL init so a GPU-unavailable browser degrades
+to no 3D face instead of crashing the whole SPA.

.changeset/daemon-tool-provider-rebase.md

@@ -0,0 +1,11 @@
+---
+'smooai-smooth-daemon': patch
+---
+
+EPIC th-c89c2a: the daemon now feeds its kernel-sandboxed tools to the operator
+local flavor through the operator's `#68` `ToolProvider` seam instead of the
+earlier bespoke `extra_tools` list (which collided with `#68` and has been
+dropped upstream). `SandboxedToolProvider::tools_for` returns
+`default_tools_with_proxy(workspace, proxy)` per turn; `serve_local_flavor`
+installs it via `LocalServerBuilder::tools(provider)`. Tracks the rebase of the
+`smooth-local-flavor` operator branch onto `main` (post-HITL, post-#68).

.changeset/fast-mode-groq.md

@@ -0,0 +1,8 @@
+---
+'smooai-smooth-daemon': minor
+---
+
+Fix the `SMOOTH_AGENT_MODEL` override (it was a no-op) and add `SMOOTH_FAST_MODE`
+— a fast mode that points Big Smooth at `groq-gpt-oss-120b` (current, fast,
+strong tool-caller, reasons on the harmony channel so thinking shows cleanly).
+Model priority: `SMOOTH_AGENT_MODEL` > fast-mode pin > coding route.

.changeset/fix-find-native-operative-test.md

@@ -0,0 +1,13 @@
+---
+'smooai-smooth-bigsmooth': patch
+---
+
+Fix `find_native_operative_finds_debug_or_release_build` to accept the
+`cargo install`ed binary location. `find_native_operative_binary()`
+deliberately falls back to `$CARGO_HOME/bin` / `~/.cargo/bin` (th-92dac3)
+when a `target/<profile>/` build isn't found near the manifest — which is
+exactly the case in a worktree using a shared target dir. The test
+asserted the path must be under `target/release|debug`, so it failed in
+that (valid) setup. The assertion now also accepts a `bin/` install dir
+while keeping the guard that the path must not be the
+`aarch64-unknown-linux-musl` cross-compile output.

.changeset/gate1-bash-enforcement.md

@@ -0,0 +1,12 @@
+---
+'smooai-smooth-tools': patch
+---
+
+EPIC th-c89c2a (th-515a13): Gate 1 deny is now enforced at the bash tool boundary.
+A new `permission` module loads deny/ask/allow rules from `~/.smooth/permissions.toml`
+(override `SMOOTH_PERMISSIONS_FILE`, process-global, best-effort) and the `bash`
+tool now blocks any command its **deny** rules match — compound-split, so
+`ls && rm -rf ~` is caught on the `rm`. A configurable complement to the hardcoded
+circuit-breaker; an unconfigured daemon is unchanged (empty rules never deny).
+Per-call `Ask`→HITL needs an operator host-hook seam (filed separately); `Ask`/
+`Allow` proceed for now, with the name-based operator HITL covering confirmation.

.changeset/gate1-permission-model.md

@@ -0,0 +1,11 @@
+---
+'smooai-smooth-policy': patch
+---
+
+EPIC th-c89c2a (th-515a13): Gate 1 — the deterministic deny/ask/allow permission
+rule model. `Decision` (Deny/Ask/Allow), `Matcher` (Claude-Code `Tool(pattern)`
+syntax with `:` as a word boundary, e.g. `Bash(rm:*)` ≡ `Bash(rm *)`), and
+`PermissionRules` with **deny > ask > allow** precedence and a **fail-safe `Ask`
+default** (an unmatched call never silently allows). Pure model + matcher,
+exhaustively tested incl. adversarial inputs. The intent layer above the kernel
+sandbox; wiring it as a ToolHook on the operator registry is a following slice.

.changeset/local-flavor-sandboxed-tools.md

@@ -0,0 +1,15 @@
+---
+'smooai-smooth-daemon': minor
+'smooai-smooth-tools': minor
+---
+
+EPIC th-c89c2a: the operator local flavor now runs with the daemon's
+kernel-sandboxed tools. `serve_local_flavor` builds the workspace-confined
+fs/grep set + an OS-sandboxed `bash` (egress routed through the goalie proxy
+when `SMOOTH_EGRESS_ALLOWLIST` is set) and installs them via the operator's
+`LocalServerBuilder::tools` seam — so the agent the operator runs per turn can
+act on the workspace under the same kernel-enforced security the bespoke daemon
+used. New `smooth_tools::default_tools_with_proxy(workspace, proxy) ->
+Vec<Arc<dyn Tool>>` (the registry helper now shares it via `register_arc`); the
+egress-proxy start is factored into a reusable `start_egress_proxy()`. Workspace
+defaults to the daemon's cwd, overridable with `SMOOTH_WORKSPACE`.

.changeset/nuke-bespoke-4400-glue.md

@@ -0,0 +1,12 @@
+---
+'smooai-smooth-cli': patch
+'smooai-smooth-code': patch
+'smooai-smooth-policy': patch
+---
+
+EPIC th-c89c2a: scrub the last bespoke `:4400` glue now that `th daemon` is the
+operator. Removed `BigSmoothClient` + the dead headless-capture/SSE paths from
+smooth-code (kept the `ServerEvent`/`PriorMessage` wire types the operator client
+maps onto); dropped `th access` and pointed `th model`/`th doctor` health checks at
+the operator (`:8787`); deleted the orphaned `smooth-credential-helper` crate and
+`smooth-policy`'s vestigial `AuthConfig.leader_url`. The tree is `:4400`-free.

.changeset/operator-hitl-approvals.md

@@ -0,0 +1,10 @@
+---
+'smooai-smooth-code': patch
+---
+
+EPIC th-c89c2a (th-1ea4f6): write-tool approvals (HITL) on the operator path. When
+the operator parks a turn on `write_confirmation_required` (opt-in via
+`SMOOTH_AGENT_CONFIRM_TOOLS`), `th code` now surfaces a `⚠ Approve <tool>? — [y]es/
+[n]o` prompt, and `y`/`n`/`Esc` resume or deny the parked turn via a new
+`confirm_tool_action` reply. This is the "ask" half of the permission model atop the
+operator's kernel-sandboxed tools — replacing the deleted bespoke `:4400` approval UI.

.changeset/operator-serves-official-widget.md

@@ -0,0 +1,11 @@
+---
+'smooai-smooth-daemon': minor
+---
+
+EPIC th-c89c2a: `th daemon operator` now serves the official
+`@smooai/smooth-operator` widget at `/`. `serve_local_flavor` enables the
+operator's `serve_widget` seam with the local token, so the browser loads the
+widget host page (token injected same-origin) and connects to the operator's own
+`/ws?token=…`. One process, one port: the canonical WS protocol **and** a usable
+chat UI. Additive — the bespoke control surface stays until the widget reaches
+parity (markdown / tool-confirm / session list, tracked upstream).

.changeset/permissions-check-cli.md

@@ -0,0 +1,8 @@
+---
+'smooai-smooth-daemon': patch
+---
+
+EPIC th-c89c2a (th-515a13): `smooth-daemon permissions check "<cmd>"` / `--write
+<path>` / `permissions path` — inspect what verdict (DENY/ASK/ALLOW) the Gate-1
+rules give a command or write, so users can author + verify `~/.smooth/
+permissions.toml` before relying on it. Reachable as `th daemon permissions …`.

.changeset/phase2-remember-tool.md

@@ -0,0 +1,15 @@
+---
+'smooai-smooth-tools': patch
+'smooai-smooth-daemon': patch
+---
+
+Phase 2 (EPIC th-c89c2a): close the memory loop with a `remember` tool. The
+agent can now persist its own salient facts (`RememberTool` in smooth-tools)
+— stable operator preferences, confirmed approaches, current project state,
+external references — choosing the `MemoryType` so recall can apply the right
+freshness treatment. The daemon registers it on every turn pointed at the same
+`Memory` backend the engine recalls from, so a fact the agent remembers is
+auto-surfaced on later turns and across restarts. The system prompt now tells
+the agent to use it. `run_task`'s tool wiring is extracted into a
+`build_tool_registry` helper. Tested: store→recall round-trip, type parsing,
+and required-content validation.

.changeset/phase2-sqlite-memory.md

@@ -0,0 +1,15 @@
+---
+'smooai-smooth-daemon': patch
+---
+
+Phase 2 (EPIC th-c89c2a): add durable, cross-session agent memory. A new
+`SqliteMemory` implements the engine's synchronous `Memory` trait against a
+`memories` table (sharing the daemon's existing SQLite connection), so an
+always-on agent's recall survives restarts — the hermes-style memory the
+in-memory engine backend can't persist. `store`/`forget` are direct
+row ops; `recall` mirrors `InMemoryMemory`'s keyword scoring (fraction of
+query words found in the content, highest first), with `MemoryType` +
+metadata round-tripped as JSON. Exposed on `Stores.memory`. Wiring it into
+the agent loop (`AgentConfig::with_memory`) is the next slice. Tested:
+persist-across-reopen, keyword recall ordering, metadata round-trip, empty
+query, and forget.

.changeset/phase2-wire-memory-into-agent.md

@@ -0,0 +1,14 @@
+---
+'smooai-smooth-daemon': patch
+---
+
+Phase 2 (EPIC th-c89c2a): wire durable memory into the agent loop. `AppState`
+now carries an `Arc<dyn Memory>` (the SQLite-backed store in `persistent`,
+in-memory in `new`), threaded into `run_task` and attached via
+`AgentConfig::with_memory`. The engine then auto-recalls relevant entries for
+each user message and injects them (with a freshness nudge for
+Project/Reference types) ahead of the prompt — so a cross-session fact stored
+once is recalled on later turns and across restarts. `run_task`'s growing
+parameter list is bundled into a `RunDeps` struct. Follow-up: a `remember`
+tool / extraction step so the agent populates its own memory. Tested:
+persistent state carries durable, recallable memory across a restart.

.changeset/phase3-bash-tool-egress-proxy.md

@@ -0,0 +1,12 @@
+---
+'smooai-smooth-tools': patch
+---
+
+Phase 3 (EPIC th-c89c2a): give the `bash` tool an optional egress proxy.
+`BashTool` gains a `proxy: Option<String>` field, and a new
+`register_default_tools_with_proxy(registry, workspace, proxy)` installs the
+default tool set with the shell's egress routed through a loopback proxy
+(`SandboxPolicy::with_proxy`) — direct off-box network kernel-denied, so the
+proxy's exact-host allowlist is the only way out. `register_default_tools`
+is unchanged (egress unrestricted). This is the injection point the daemon
+uses to wire its goalie proxy into agent shell commands.

.changeset/phase3-daemon-egress-capstone.md

@@ -0,0 +1,17 @@
+---
+'smooai-smooth-daemon': patch
+'smooai-smooth-goalie': patch
+---
+
+Phase 3 (EPIC th-c89c2a): wire the egress boundary into the daemon
+end-to-end. New `config::resolve_egress()` reads `SMOOTH_EGRESS_ALLOWLIST`
+(comma/space-separated exact hosts; opt-in like auth/sandbox) and
+`SMOOTH_EGRESS_PROXY_ADDR`. On startup the daemon spawns goalie's
+`run_proxy_local` on a loopback port, threads the proxy address onto
+`AppState`, and the runner registers tools via
+`register_default_tools_with_proxy` — so agent `bash` egress is forced
+through the proxy's allowlist (direct off-box network kernel-denied). goalie
+re-exports `run_proxy_local`/`run_proxy_with`/`NetworkDecider`. Invalid
+allowlist entries are dropped and logged. Verified live: with an allowlist
+set, the daemon logs `egress boundary ON`, the proxy listens, and a request
+to an unlisted host returns 403.

.changeset/phase3-deny-own-smooth-creds.md

@@ -0,0 +1,12 @@
+---
+'smooai-smooth-tools': patch
+---
+
+Phase 3 hardening (th-08e05a / EPIC th-c89c2a): the macOS Seatbelt bash
+sandbox now also kernel-denies reads of the daemon's *own* credentials in
+`~/.smooth` — `providers.json` (the LLM API key) and the `auth/` directory
+(the auth JWT). Previously a sandboxed shell tool could `cat
+~/.smooth/providers.json` and exfil exactly the secret that drives the
+agent. Project-scoped `<workspace>/.smooth` pearls stay readable (different
+path). Adds an adversarial test that plants a sentinel under `~/.smooth/auth`
+and proves the sandbox can't read it.