From ebd0248be25a1675bce29b580b046454074c344e Mon Sep 17 00:00:00 2001
From: Naiyuan Qing <145280634+NevilleQingNY@users.noreply.github.com>
Date: Mon, 6 Jul 2026 08:43:51 +0800
Subject: [PATCH 01/15] MUL-4016: fix mention tokenizer stacktrace backtracking
 (#4889)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* MUL-4016: fix mention tokenizer stacktrace backtracking

Co-authored-by: multica-agent <github@multica.ai>

* fix(editor): de-ambiguate escaped-label regexes to kill ReDoS (MUL-4016)

The mention/slash/file-card label regexes used `(?:\\.|[^\]])` where both
alternatives can consume a backslash. On an unterminated match, each `\x`
run is enumerated 2^n ways — pasting a Java stacktrace (`\~\[...\]`) or a
crafted ~50-char string freezes the main thread for seconds (GitHub #4881).

Exclude backslash from the char class (`[^\]\\]`) so a backslash can only be
consumed by `\\.`. The alternatives become disjoint and matching is linear;
legal escaped-bracket labels like `David\[TF\]` still parse unchanged.

Fixed in all four sites that shared the pattern:
- mention-extension.ts tokenize()
- slash-command-extension.ts start() + tokenize()
- file-card.tsx FILE_CARD_MARKDOWN_RE
- packages/ui/markdown/file-cards.ts NEW_FILE_CARD_RE (runs on every
  read-only comment/description render, not just the editor)

Adds adversarial regression tests (repeated `\a` + missing closing bracket)
that fail in ~10-40s against the old regexes and pass in <1ms after the fix.
Builds on #4889's marker-first mention start().

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-authored-by: multica-agent <github@multica.ai>

* fix(editor): escape backslash in mention/slash labels for round-trip (MUL-4016)

Follow-up to the de-ambiguation fix, addressing Howard's PR review.

The linear tokenizer now treats "\" as an escape lead (\\.), so a label whose
serialized form contains a bare "\" adjacent to the closing "]" no longer parses
back — the "\]" is consumed as an escaped bracket and swallows the boundary. The
old ambiguous regex tolerated this by chance; the de-ambiguation exposes it.

mention/slash renderMarkdown escaped only [ and ], not \. Switch both to the
shared escapeMarkdownLabel() (escapes [ ] \ ( )) and mirror it on parse with
replace(/\\([[\]\\()])/g, "$1"), matching what file-card already does. This also
converges the three tokenizers on one escape contract. file-card was already
correct and is unchanged.

Adds parameterized round-trip tests for labels containing "\" / "\]" / parens
(e.g. "A\\", "ends\\", "a\\]b"); these fail on the old serializer and pass now.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-authored-by: multica-agent <github@multica.ai>

---------

Co-authored-by: multica-agent <github@multica.ai>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
---
 packages/ui/markdown/file-cards.ts            |  9 ++-
 .../extensions/file-card-markdown.test.ts     | 27 ++++++++
 .../views/editor/extensions/file-card.tsx     |  5 +-
 .../extensions/mention-extension.test.ts      | 59 ++++++++++++++++
 .../editor/extensions/mention-extension.ts    | 69 +++++++++++++++----
 .../slash-command-extension.test.ts           | 35 ++++++++++
 .../extensions/slash-command-extension.ts     | 19 +++--
 7 files changed, 201 insertions(+), 22 deletions(-)

diff --git a/packages/ui/markdown/file-cards.ts b/packages/ui/markdown/file-cards.ts
index 35debcc8168..3be14a5b1b8 100644
--- a/packages/ui/markdown/file-cards.ts
+++ b/packages/ui/markdown/file-cards.ts
@@ -47,9 +47,14 @@ export function isAllowedFileCardHref(href: string): boolean {
   )
 }
 
-/** New syntax: !file[name](url) — unambiguous, no hostname matching needed. */
+/**
+ * New syntax: !file[name](url) — unambiguous, no hostname matching needed.
+ * Backslash is excluded from the label char class so "\x" runs can only be
+ * consumed by \\. — overlapping alternatives backtrack in 2^n ways (ReDoS,
+ * GitHub #4881). This runs on every comment/description render.
+ */
 const NEW_FILE_CARD_RE = new RegExp(
-  `^!file\\[((?:\\\\.|[^\\]])*)\\]\\((${FILE_CARD_URL_PATTERN.source})\\)$`,
+  `^!file\\[((?:\\\\.|[^\\]\\\\])*)\\]\\((${FILE_CARD_URL_PATTERN.source})\\)$`,
 )
 
 /** Legacy syntax: [name](cdnUrl) on its own line — matched by CDN hostname. */
diff --git a/packages/views/editor/extensions/file-card-markdown.test.ts b/packages/views/editor/extensions/file-card-markdown.test.ts
index 348b6250be6..17a20c93313 100644
--- a/packages/views/editor/extensions/file-card-markdown.test.ts
+++ b/packages/views/editor/extensions/file-card-markdown.test.ts
@@ -61,6 +61,20 @@ describe("file-card tokenizer", () => {
     expect(token).toBeDefined();
     expect(token!.attributes.filename).toBe("readme.md");
   });
+
+  it("rejects an unterminated file card with escape-pair runs in linear time", () => {
+    // Each "\a" pair is ambiguous under (?:\\.|[^\]]) — the pre-fix regex
+    // enumerates 2^28 backtrack paths (~10s) before failing. The disjoint
+    // char class must fail fast instead.
+    const src = `!file[${"\\a".repeat(28)}](/uploads/x`;
+
+    const t0 = performance.now();
+    const token = tokenize(src);
+    const elapsed = performance.now() - t0;
+
+    expect(token).toBeUndefined();
+    expect(elapsed).toBeLessThan(100);
+  });
 });
 
 // ---------------------------------------------------------------------------
@@ -81,4 +95,17 @@ describe("preprocessFileCards", () => {
     expect(result).toContain('data-type="fileCard"');
     expect(result).toContain('data-filename="readme.md"');
   });
+
+  it("rejects an unterminated file card with escape-pair runs in linear time", () => {
+    // This path runs on every read-only comment/description render, so a
+    // backtracking label regex here is reachable without opening the editor.
+    const input = `!file[${"\\a".repeat(28)}](/uploads/x`;
+
+    const t0 = performance.now();
+    const result = preprocessFileCards(input, "cdn.example.com");
+    const elapsed = performance.now() - t0;
+
+    expect(result).toBe(input);
+    expect(elapsed).toBeLessThan(100);
+  });
 });
diff --git a/packages/views/editor/extensions/file-card.tsx b/packages/views/editor/extensions/file-card.tsx
index acdf7b398e3..9e554f81b77 100644
--- a/packages/views/editor/extensions/file-card.tsx
+++ b/packages/views/editor/extensions/file-card.tsx
@@ -21,8 +21,11 @@ import { FILE_CARD_URL_PATTERN } from "@multica/ui/markdown";
 import { escapeMarkdownLabel } from "../utils/escape-markdown-label";
 import { Attachment } from "../attachment";
 
+// Backslash is excluded from the label char class so "\x" runs can only be
+// consumed by \\. — overlapping alternatives backtrack in 2^n ways (ReDoS,
+// GitHub #4881).
 const FILE_CARD_MARKDOWN_RE = new RegExp(
-  `^!file\\[((?:\\\\.|[^\\]])*)\\]\\((${FILE_CARD_URL_PATTERN.source})\\)`,
+  `^!file\\[((?:\\\\.|[^\\]\\\\])*)\\]\\((${FILE_CARD_URL_PATTERN.source})\\)`,
 );
 
 
diff --git a/packages/views/editor/extensions/mention-extension.test.ts b/packages/views/editor/extensions/mention-extension.test.ts
index 864655e5a95..478d0942405 100644
--- a/packages/views/editor/extensions/mention-extension.test.ts
+++ b/packages/views/editor/extensions/mention-extension.test.ts
@@ -14,6 +14,9 @@ const renderMarkdown = BaseMentionExtension.config.renderMarkdown as (
   node: { attrs: Record<string, string> },
 ) => string;
 
+const JAVA_STACKTRACE_SOURCE_MARKER =
+  "        at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:1006) \\~\\[spring-webmvc-5.3.39.jar!/:5.3.39\\]\n";
+
 function tokenize(src: string) {
   const start = startFn(src);
   if (start === -1) return undefined;
@@ -42,6 +45,23 @@ describe("mention tokenizer", () => {
     expect(token!.attributes.type).toBe("agent");
   });
 
+  it.each(["A\\", "ends\\", "a\\]b", "f(x)", "back\\slash"])(
+    "round-trips a label containing backslash/parens: %j",
+    (label) => {
+      // The linear tokenizer treats "\" as an escape lead, so renderMarkdown
+      // must escape "\" too — otherwise a trailing "\" swallows the closing "]"
+      // and the mention fails to parse back (regression guard for the
+      // de-ambiguation fix).
+      const md = renderMarkdown({
+        attrs: { id: "aaa-bbb", label, type: "member" },
+      });
+      const token = tokenize(md);
+      expect(token).toBeDefined();
+      expect(token!.attributes.label).toBe(label);
+      expect(token!.attributes.id).toBe("aaa-bbb");
+    },
+  );
+
   it("does not match an ordinary Markdown link before a mention", () => {
     const src =
       "Check [docs](https://example.com) - [@User](mention://agent/aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa)";
@@ -89,4 +109,43 @@ describe("mention tokenizer", () => {
     expect(token!.attributes.type).toBe("issue");
     expect(token!.attributes.id).toBe("aaa-bbb");
   });
+
+  it("does not start at escaped Java stacktrace source markers before a real mention", () => {
+    const prefix = JAVA_STACKTRACE_SOURCE_MARKER.repeat(3);
+    const src = `${prefix}[@Alice](mention://member/aaa-bbb)`;
+
+    const start = startFn(src);
+    expect(start).toBe(prefix.length);
+
+    const token = tokenizeFn(src.slice(start));
+    expect(token).toBeDefined();
+    expect(token!.attributes.label).toBe("Alice");
+    expect(token!.attributes.type).toBe("member");
+    expect(token!.attributes.id).toBe("aaa-bbb");
+  });
+
+  it("keeps escaped Java stacktrace source marker detection fast when no mention exists", () => {
+    const src = JAVA_STACKTRACE_SOURCE_MARKER.repeat(11);
+
+    const t0 = performance.now();
+    const start = startFn(src);
+    const elapsed = performance.now() - t0;
+
+    expect(start).toBe(-1);
+    expect(elapsed).toBeLessThan(50);
+  });
+
+  it("rejects an unterminated mention with escape-pair runs in linear time", () => {
+    // Each "\a" pair is ambiguous under (?:\\.|[^\]]) — the pre-fix regex
+    // enumerates 2^28 backtrack paths (~10s) before failing. The disjoint
+    // char class must fail fast instead.
+    const src = `[@${"\\a".repeat(28)}](mention://member/abc`;
+
+    const t0 = performance.now();
+    const token = tokenizeFn(src);
+    const elapsed = performance.now() - t0;
+
+    expect(token).toBeUndefined();
+    expect(elapsed).toBeLessThan(100);
+  });
 });
diff --git a/packages/views/editor/extensions/mention-extension.ts b/packages/views/editor/extensions/mention-extension.ts
index f285ab03440..40f7519aec1 100644
--- a/packages/views/editor/extensions/mention-extension.ts
+++ b/packages/views/editor/extensions/mention-extension.ts
@@ -2,6 +2,44 @@ import Mention from "@tiptap/extension-mention";
 import { mergeAttributes } from "@tiptap/core";
 import { ReactNodeViewRenderer } from "@tiptap/react";
 import { MentionView } from "./mention-view";
+import { escapeMarkdownLabel } from "../utils/escape-markdown-label";
+
+const MENTION_LINK_MARKER = "](mention://";
+
+function isEscaped(text: string, index: number): boolean {
+  let slashCount = 0;
+  for (let i = index - 1; i >= 0 && text[i] === "\\"; i--) {
+    slashCount++;
+  }
+  return slashCount % 2 === 1;
+}
+
+function findUnescapedMentionMarker(src: string, from = 0): number {
+  let marker = src.indexOf(MENTION_LINK_MARKER, from);
+
+  while (marker !== -1) {
+    if (!isEscaped(src, marker)) return marker;
+    marker = src.indexOf(MENTION_LINK_MARKER, marker + MENTION_LINK_MARKER.length);
+  }
+
+  return -1;
+}
+
+function findMentionStart(src: string): number {
+  let marker = findUnescapedMentionMarker(src);
+
+  while (marker !== -1) {
+    for (let i = marker - 1; i >= 0; i--) {
+      const char = src[i];
+      if (char === "\n" || char === "\r") break;
+      if (char === "[" && !isEscaped(src, i)) return i;
+    }
+
+    marker = findUnescapedMentionMarker(src, marker + MENTION_LINK_MARKER.length);
+  }
+
+  return -1;
+}
 
 export const BaseMentionExtension = Mention.extend({
   addNodeView() {
@@ -39,21 +77,24 @@ export const BaseMentionExtension = Mention.extend({
     name: "mention",
     level: "inline" as const,
     start(src: string) {
-      // Accept escaped brackets (\\[ \\]) and non-] chars in the label.
-      // This prevents matching ordinary Markdown links like [docs](url)
-      // that appear before a mention on the same line.
-      return src.search(/\[@?(?:\\.|[^\]])+\]\(mention:\/\//);
+      // Anchor on Multica's mention href first. Scanning forward from every
+      // "[" backtracks badly on escaped stacktrace markers like \~\[...\].
+      return findMentionStart(src);
     },
     tokenize(src: string) {
-      // Label accepts escaped chars (\\[ \\]) or any non-] character.
-      // This prevents the label from crossing a ]( Markdown link boundary
-      // while still supporting bracket-containing names like "David\[TF\]".
+      // Label accepts escaped chars (\\[ \\]) or any non-] non-backslash
+      // character. Excluding backslash from the char class keeps the two
+      // alternatives disjoint — otherwise "\x" runs backtrack in 2^n ways
+      // (ReDoS, GitHub #4881) — while still supporting bracket-containing
+      // names like "David\[TF\]".
       const match = src.match(
-        /^\[@?((?:\\.|[^\]])+)\]\(mention:\/\/(\w+)\/([^)]+)\)/,
+        /^\[@?((?:\\.|[^\]\\])+)\]\(mention:\/\/(\w+)\/([^)]+)\)/,
       );
       if (!match) return undefined;
-      // Unescape backslash-escaped brackets that renderMarkdown may produce.
-      const rawLabel = match[1]?.replace(/\\\[/g, "[").replace(/\\\]/g, "]");
+      // Reverse escapeMarkdownLabel: unescape \[ \] \\ \( \) that
+      // renderMarkdown produced. Must mirror the escaped set exactly, or a
+      // label containing "\" fails to round-trip through the linear tokenizer.
+      const rawLabel = match[1]?.replace(/\\([[\]\\()])/g, "$1");
       return {
         type: "mention",
         raw: match[0],
@@ -67,9 +108,11 @@ export const BaseMentionExtension = Mention.extend({
   renderMarkdown: (node: any) => {
     const { id, label, type = "member" } = node.attrs || {};
     const prefix = type === "issue" || type === "project" ? "" : "@";
-    // Escape square brackets in the label so the markdown link syntax
-    // is not broken when the name contains [ or ] (e.g. "David[TF]").
-    const safeLabel = (label ?? id).replace(/\[/g, "\\[").replace(/\]/g, "\\]");
+    // Escape [ ] \ ( ) in the label so the markdown link syntax is not broken
+    // and the label survives the linear tokenizer (which now treats "\" as an
+    // escape lead, not an ordinary char). Must stay in sync with the unescape
+    // in tokenize() above. Shared with file-card/slash via escapeMarkdownLabel.
+    const safeLabel = escapeMarkdownLabel(label ?? id);
     return `[${prefix}${safeLabel}](mention://${type}/${id})`;
   },
 });
diff --git a/packages/views/editor/extensions/slash-command-extension.test.ts b/packages/views/editor/extensions/slash-command-extension.test.ts
index e54660ada5f..a83c5b5d006 100644
--- a/packages/views/editor/extensions/slash-command-extension.test.ts
+++ b/packages/views/editor/extensions/slash-command-extension.test.ts
@@ -79,6 +79,16 @@ describe("slash command tokenizer", () => {
     expect(tokenize(md)?.attributes.label).toBe("deploy[prod]");
   });
 
+  it.each(["A\\", "ends\\", "a\\]b", "f(x)", "back\\slash"])(
+    "round-trips a label containing backslash/parens: %j",
+    (label) => {
+      // renderMarkdown must escape "\" so a trailing "\" does not swallow the
+      // closing "]" under the linear tokenizer (regression guard).
+      const md = renderMarkdown({ attrs: { id: "skill-1", label } });
+      expect(tokenize(md)?.attributes.label).toBe(label);
+    },
+  );
+
   it("does not match ordinary markdown links", () => {
     expect(tokenize("[docs](https://example.com)")).toBeUndefined();
   });
@@ -86,4 +96,29 @@ describe("slash command tokenizer", () => {
   it("does not match slash action links", () => {
     expect(tokenize("[/deploy](slash://action/deploy)")).toBeUndefined();
   });
+
+  it("rejects an unterminated slash link with escape-pair runs in linear time", () => {
+    // Each "\a" pair is ambiguous under (?:\\.|[^\]]) — the pre-fix regex
+    // enumerates 2^28 backtrack paths (~10s) before failing. The disjoint
+    // char class must fail fast instead.
+    const src = `[/${"\\a".repeat(28)}](slash://skill/abc`;
+
+    const t0 = performance.now();
+    const token = tokenizeFn(src);
+    const elapsed = performance.now() - t0;
+
+    expect(token).toBeUndefined();
+    expect(elapsed).toBeLessThan(100);
+  });
+
+  it("returns -1 fast from start() when escape-pair runs precede no slash link", () => {
+    const src = `[/${"\\a".repeat(28)}] plain text, no slash link`;
+
+    const t0 = performance.now();
+    const start = startFn(src);
+    const elapsed = performance.now() - t0;
+
+    expect(start).toBe(-1);
+    expect(elapsed).toBeLessThan(100);
+  });
 });
diff --git a/packages/views/editor/extensions/slash-command-extension.ts b/packages/views/editor/extensions/slash-command-extension.ts
index eb6147a6ece..b232d1892af 100644
--- a/packages/views/editor/extensions/slash-command-extension.ts
+++ b/packages/views/editor/extensions/slash-command-extension.ts
@@ -3,6 +3,7 @@ import { mergeAttributes } from "@tiptap/core";
 import { ReactNodeViewRenderer } from "@tiptap/react";
 import { SlashCommandView } from "./slash-command-view";
 import { formatSlashCommandLabel } from "./slash-command-utils";
+import { escapeMarkdownLabel } from "../utils/escape-markdown-label";
 
 export const SlashCommandExtension = Mention.extend({
   name: "slashCommand",
@@ -35,14 +36,20 @@ export const SlashCommandExtension = Mention.extend({
     name: "slashCommand",
     level: "inline" as const,
     start(src: string) {
-      return src.search(/\[\/(?:\\.|[^\]])+\]\(slash:\/\/skill\//);
+      // Backslash is excluded from the char class so "\x" runs can only be
+      // consumed by \\. — overlapping alternatives backtrack in 2^n ways
+      // (ReDoS, GitHub #4881).
+      return src.search(/\[\/(?:\\.|[^\]\\])+\]\(slash:\/\/skill\//);
     },
     tokenize(src: string) {
       const match = src.match(
-        /^\[\/((?:\\.|[^\]])+)\]\(slash:\/\/skill\/([^)]+)\)/,
+        /^\[\/((?:\\.|[^\]\\])+)\]\(slash:\/\/skill\/([^)]+)\)/,
       );
       if (!match) return undefined;
-      const rawLabel = match[1]?.replace(/\\\[/g, "[").replace(/\\\]/g, "]");
+      // Reverse escapeMarkdownLabel: unescape \[ \] \\ \( \). Must mirror the
+      // escaped set exactly, or a label containing "\" fails to round-trip
+      // through the linear tokenizer.
+      const rawLabel = match[1]?.replace(/\\([[\]\\()])/g, "$1");
       return {
         type: "slashCommand",
         raw: match[0],
@@ -57,9 +64,9 @@ export const SlashCommandExtension = Mention.extend({
 
   renderMarkdown: (node: any) => {
     const { id, label } = node.attrs || {};
-    const safeLabel = formatSlashCommandLabel(label)
-      .replace(/\[/g, "\\[")
-      .replace(/\]/g, "\\]");
+    // Escape [ ] \ ( ) so the label survives the linear tokenizer; must stay in
+    // sync with the unescape in tokenize() above.
+    const safeLabel = escapeMarkdownLabel(formatSlashCommandLabel(label));
     return `[/${safeLabel}](slash://skill/${id})`;
   },
 });

From c84a939c8324f16db554e8eb4bec21be0e138cc9 Mon Sep 17 00:00:00 2001
From: Naiyuan Qing <145280634+NevilleQingNY@users.noreply.github.com>
Date: Mon, 6 Jul 2026 09:43:03 +0800
Subject: [PATCH 02/15] fix(views): enable multi-file selection on all
 attachment upload buttons (#4962)

The FileUploadButton component already fans out per-file onSelect
callbacks and every editor surface already handles N concurrent
uploads (drag-drop and paste were multi-file all along), but five
call sites never passed the `multiple` prop, so the OS file dialog
capped picks at one file: chat composer, create-issue modal,
quick-create modal, issue description, and feedback modal.

Fixes MUL-4074.

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Co-authored-by: multica-agent <github@multica.ai>
---
 packages/views/chat/components/chat-input.tsx     | 1 +
 packages/views/issues/components/issue-detail.tsx | 1 +
 packages/views/modals/create-issue.tsx            | 1 +
 packages/views/modals/feedback.tsx                | 1 +
 packages/views/modals/quick-create-issue.tsx      | 1 +
 5 files changed, 5 insertions(+)

diff --git a/packages/views/chat/components/chat-input.tsx b/packages/views/chat/components/chat-input.tsx
index 43c9f77863a..332b50e34b1 100644
--- a/packages/views/chat/components/chat-input.tsx
+++ b/packages/views/chat/components/chat-input.tsx
@@ -398,6 +398,7 @@ export function ChatInput({
           {uploadEnabled && (
             <FileUploadButton
               size="sm"
+              multiple
               onSelect={(file) => editorRef.current?.uploadFile(file)}
             />
           )}
diff --git a/packages/views/issues/components/issue-detail.tsx b/packages/views/issues/components/issue-detail.tsx
index 20bd8403055..880db5af32f 100644
--- a/packages/views/issues/components/issue-detail.tsx
+++ b/packages/views/issues/components/issue-detail.tsx
@@ -1985,6 +1985,7 @@ export function IssueDetail({ issueId, onDelete, onDone, defaultSidebarOpen = tr
               />
               <FileUploadButton
                 size="sm"
+                multiple
                 onSelect={(file) => descEditorRef.current?.uploadFile(file)}
               />
             </div>
diff --git a/packages/views/modals/create-issue.tsx b/packages/views/modals/create-issue.tsx
index a3e20aba8f4..772806f8915 100644
--- a/packages/views/modals/create-issue.tsx
+++ b/packages/views/modals/create-issue.tsx
@@ -864,6 +864,7 @@ export function ManualCreatePanel({
             <div className="flex flex-col gap-2 border-t px-4 py-3 shrink-0 sm:flex-row sm:items-center sm:justify-between">
               <div className="flex min-h-7 items-center gap-2">
                 <FileUploadButton
+                  multiple
                   onSelect={(file) => descEditorRef.current?.uploadFile(file)}
                 />
               </div>
diff --git a/packages/views/modals/feedback.tsx b/packages/views/modals/feedback.tsx
index 028cf3954f8..7850e416790 100644
--- a/packages/views/modals/feedback.tsx
+++ b/packages/views/modals/feedback.tsx
@@ -164,6 +164,7 @@ export function FeedbackModal({
         <div className="flex items-center justify-between px-4 py-3 border-t shrink-0">
           <FileUploadButton
             size="sm"
+            multiple
             onSelect={(file) => editorRef.current?.uploadFile(file)}
           />
           <Button size="sm" onClick={handleSubmit} disabled={!canSubmit}>
diff --git a/packages/views/modals/quick-create-issue.tsx b/packages/views/modals/quick-create-issue.tsx
index e185f463c13..ed0673bc486 100644
--- a/packages/views/modals/quick-create-issue.tsx
+++ b/packages/views/modals/quick-create-issue.tsx
@@ -539,6 +539,7 @@ export function AgentCreatePanel({
           <div className="flex min-h-7 items-center gap-2">
             <FileUploadButton
               size="sm"
+              multiple
               disabled={uploading}
               onSelect={(file) => editorRef.current?.uploadFile(file)}
             />

From 359ef61dc3609ca5f1cd64cfacdd81e713884ab4 Mon Sep 17 00:00:00 2001
From: Multica Eve <eve@devv.ai>
Date: Mon, 6 Jul 2026 12:34:51 +0800
Subject: [PATCH 03/15] fix(search): pg_trgm index fallback + statement_timeout
 guard (MUL-4059) (#4925)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* fix(search): add pg_trgm index fallback + statement_timeout guard (MUL-4059)

Root cause of the "search freezes with no response" symptom reported in
MUL-4059: the search handler runs LOWER(col) LIKE '%pattern%' queries
that expect a pg_bigm GIN index (migrations 032, 033, 036), but every
migration wraps the CREATE EXTENSION + CREATE INDEX in a DO/EXCEPTION
handler that silently skips when pg_bigm is unavailable. The bundled
self-host / dev / CI Postgres image (pgvector/pgvector:pg17) does not
ship pg_bigm, so on every self-hosted deployment the migrations no-op
and no GIN indexes get built. Every /api/issues/search + /api/projects/search
request then falls back to a Seq Scan on `issue` + correlated Seq Scans
on `comment` — verified with EXPLAIN on the local dev DB, which has zero
title/description/comment search indexes before this change.

Two independent guardrails are added, either of which alone would have
prevented the reported hang:

1) Migration 134 installs pg_trgm (ships in all standard Postgres +
   pgvector images) and builds GIN indexes with gin_trgm_ops on
   `LOWER(title)`, `LOWER(COALESCE(description, ''))`, and
   `LOWER(content)`. The expression signatures match the search
   handler's WHERE clauses exactly, so the planner picks the index
   without further changes. The pg_bigm indexes from 036 are left
   intact — deployments on AWS RDS with pg_bigm 1.2 keep the CJK-friendly
   bigram path; deployments without it get the trigram fallback. Verified
   against a local 25k-row fixture: the description LIKE hits
   `Bitmap Index Scan on idx_issue_description_trgm` in 0.5 ms.

2) runSearchQuery wraps both search handlers in a short-lived read-only
   transaction with SET LOCAL statement_timeout = 3 s. In the pathological
   case where indexes are still missing or the query plan is bad, callers
   see a fast 503 with a descriptive error instead of a stalled request.
   Verified against a live Postgres: a deliberate pg_sleep(2) with the
   test override at 200 ms is cut off in 230 ms with SQLSTATE 57014, as
   asserted by TestRunSearchQuery_StatementTimeoutFires.

Non-goals: this change does not remove the pg_bigm code path, does not
change the SQL the handler builds, and does not change the API response
shape. It is the minimum diff to unblock production while preserving
the CJK-search advantage that pg_bigm provides where it is available.

Co-authored-by: multica-agent <github@multica.ai>

* fix(search): scope comment subqueries to workspace to unblock prd hang (MUL-4059)

Follow-up correction after PRD investigation: pg_bigm IS installed on
prd `multica-prod` and all five bigm indexes exist in the correct
`LOWER(...) gin_bigm_ops` form. The initial "missing index" hypothesis
was wrong; migration 134 (pg_trgm fallback) still helps self-host but
does not touch the production hang path.

Actual prd EXPLAIN (workspace with 60k issues, keyword "search"):

    Index Scan using idx_issue_workspace on issue i
    Rows Removed by Filter: 59123
    SubPlan 2
      Bitmap Heap Scan on comment c
        Rows Removed by Index Recheck: 1928275
        Heap Blocks: exact=48297 lossy=164696
      Bitmap Index Scan on idx_comment_content_bigm
        rows=536761
    Execution Time: 32345.002 ms

Root cause: the correlated `EXISTS` over `comment` gets rewritten by
the planner into a *hashed* subplan. Without a workspace_id filter in
the subquery, that hashed set covers every comment in every workspace
matching the LIKE — 536k rows for "search" — which spills work_mem
into a lossy bitmap and rechecks 1.9M rows.

Two-part fix:

1. Query rewrite. buildSearchQuery now emits
   `c.workspace_id = $wsParam` inside every comment subquery (WHERE
   phrase match, WHERE multi-term match, tier 7 rank, tier 8 rank, and
   the matched_comment_content COALESCE). The same $4 parameter is
   reused so Postgres treats it as a compile-time constant and pushes
   it into the hashed subplan's key, collapsing the set to this
   workspace's comments.

2. Supporting index (migration 135). New
   `idx_comment_workspace ON comment (workspace_id)`. Without it, the
   pushed-down filter still triggers a Seq Scan on `comment` because
   comment has no btree on workspace_id (only the FK constraint and
   composite (issue_id, ...) indexes).

Locally verified against a repro that mirrors prd (5k issues in the
target workspace, 100k comments in a sibling workspace all containing
"search"): the plan drops from 60 ms (hashed global scan, no support
index) to 3 ms (subplan uses idx_comment_workspace). Prd extrapolation
from the same shape: 32.3 s → tens of milliseconds.

Regression test TestBuildSearchQuery_CommentSubqueryWorkspaceScope
asserts every `FROM comment c` in the generated SQL is followed by a
`c.workspace_id = $4` filter, so a future refactor can't silently
regress the plan back to the global-hash pathology.

The statement_timeout guard from the earlier commit in this branch is
kept — it still bounds the worst case if any future query shape
regresses.

Co-authored-by: multica-agent <github@multica.ai>

* fix(search): address PR review — unwrap 135 + add project trigram indexes (MUL-4059)

Both must-fix items from GPT-Boy's review:

1. Migration 135 unwrapped. The previous version buried
   `CREATE INDEX idx_comment_workspace` inside `DO $$ ... EXCEPTION
   WHEN OTHERS $$` — exactly the anti-pattern that caused MUL-4059 in
   the first place. `idx_comment_workspace` is not a CJK-bonus fallback;
   it is the critical support that makes the query rewrite land on an
   Index Scan instead of a Seq Scan. A silent failure (lock timeout,
   disk full, permission denied, schema drift) MUST abort the migration
   and fail deployment, not slip through as green. The unwrapped
   `CREATE INDEX IF NOT EXISTS` now propagates real errors to the
   migration runner, which aborts and does NOT record the version as
   applied. IF NOT EXISTS keeps idempotency for the operator-precreated
   case (`CREATE INDEX CONCURRENTLY ...` before running migrations on
   large prd tables).

2. Migration 134 now covers project search too. SearchProjects reads
   `LOWER(project.title)` and `LOWER(COALESCE(project.description, ''))`,
   and the pg_bigm equivalents in migration 039 silently no-op on
   pg_bigm-less images just like 032/033/036. Without the trigram
   fallback, project searches on self-host would still Seq Scan and hit
   the 3 s statement_timeout guard as a 503 — technically bounded but
   not actually fixed. Added `idx_project_title_trgm` and
   `idx_project_description_trgm`; the down migration drops them too.

Also: fixed the search.go comment that said callers get a "standard
500" — they get a 503 with SQLSTATE-57014 mapping; the comment now
matches reality.

Verified: build clean, vet clean, existing search / timeout tests
still green. Migration 135 dry-run (dropping the index, re-applying
the unwrapped SQL under `ON_ERROR_STOP=1`) creates the index cleanly;
a deliberate `CREATE INDEX` on a non-existent column now aborts psql
with exit 3, confirming the migration runner would fail loudly on any
real error.

Co-authored-by: multica-agent <github@multica.ai>

---------

Co-authored-by: Eve <eve@multica-ai.local>
Co-authored-by: multica-agent <github@multica.ai>
---
 server/internal/handler/issue.go              | 133 +++++++++++-------
 server/internal/handler/project.go            |  66 +++++----
 server/internal/handler/search.go             | 121 ++++++++++++++++
 server/internal/handler/search_test.go        |  39 +++++
 .../internal/handler/search_timeout_test.go   |  83 +++++++++++
 .../134_search_index_trgm_fallback.down.sql   |  10 ++
 .../134_search_index_trgm_fallback.up.sql     |  85 +++++++++++
 .../135_comment_workspace_index.down.sql      |   8 ++
 .../135_comment_workspace_index.up.sql        |  48 +++++++
 9 files changed, 508 insertions(+), 85 deletions(-)
 create mode 100644 server/internal/handler/search.go
 create mode 100644 server/internal/handler/search_timeout_test.go
 create mode 100644 server/migrations/134_search_index_trgm_fallback.down.sql
 create mode 100644 server/migrations/134_search_index_trgm_fallback.up.sql
 create mode 100644 server/migrations/135_comment_workspace_index.down.sql
 create mode 100644 server/migrations/135_comment_workspace_index.up.sql

diff --git a/server/internal/handler/issue.go b/server/internal/handler/issue.go
index efcc1dd7662..cdf842631e3 100644
--- a/server/internal/handler/issue.go
+++ b/server/internal/handler/issue.go
@@ -16,6 +16,7 @@ import (
 	"unicode"
 
 	"github.com/go-chi/chi/v5"
+	"github.com/jackc/pgx/v5"
 	"github.com/jackc/pgx/v5/pgtype"
 	"github.com/multica-ai/multica/server/internal/issueguard"
 	"github.com/multica-ai/multica/server/internal/logger"
@@ -421,20 +422,34 @@ func buildSearchQuery(phrase string, terms []string, queryNum int, hasNum bool,
 	// --- WHERE clause ---
 	var whereParts []string
 
-	// Full phrase match: title, description, or comment
+	// Full phrase match: title, description, or comment.
+	//
+	// The comment EXISTS subquery is deliberately correlated on BOTH
+	// c.issue_id = i.id AND c.workspace_id = wsParam. The workspace_id
+	// filter is not strictly necessary for correctness (comment.workspace_id
+	// is FK-consistent with its issue's workspace), but it is critical for
+	// the planner. Without it, Postgres rewrites the correlated EXISTS
+	// into a hashed subplan that materializes every comment in the entire
+	// `comment` table matching the LIKE — for common tokens like "search"
+	// this can be hundreds of thousands of rows, blowing out work_mem into
+	// a lossy bitmap and taking 30+ seconds. With the workspace_id
+	// constant duplicated into the subquery, the hashed set collapses to
+	// this workspace's comments and the plan uses the supporting
+	// idx_comment_workspace (migration 135). See MUL-4059 EXPLAIN reports.
 	phraseMatch := fmt.Sprintf(
-		"(LOWER(i.title) LIKE %s OR LOWER(COALESCE(i.description, '')) LIKE %s OR EXISTS (SELECT 1 FROM comment c WHERE c.issue_id = i.id AND LOWER(c.content) LIKE %s))",
-		phraseContainsParam, phraseContainsParam, phraseContainsParam,
+		"(LOWER(i.title) LIKE %s OR LOWER(COALESCE(i.description, '')) LIKE %s OR EXISTS (SELECT 1 FROM comment c WHERE c.issue_id = i.id AND c.workspace_id = %s AND LOWER(c.content) LIKE %s))",
+		phraseContainsParam, phraseContainsParam, wsParam, phraseContainsParam,
 	)
 	whereParts = append(whereParts, phraseMatch)
 
-	// Multi-word AND match (each term must appear somewhere)
+	// Multi-word AND match (each term must appear somewhere). Same
+	// workspace_id-in-subquery contract as above.
 	if len(termContainsParams) > 1 {
 		var termConditions []string
 		for _, tp := range termContainsParams {
 			termConditions = append(termConditions, fmt.Sprintf(
-				"(LOWER(i.title) LIKE %s OR LOWER(COALESCE(i.description, '')) LIKE %s OR EXISTS (SELECT 1 FROM comment c WHERE c.issue_id = i.id AND LOWER(c.content) LIKE %s))",
-				tp, tp, tp,
+				"(LOWER(i.title) LIKE %s OR LOWER(COALESCE(i.description, '')) LIKE %s OR EXISTS (SELECT 1 FROM comment c WHERE c.issue_id = i.id AND c.workspace_id = %s AND LOWER(c.content) LIKE %s))",
+				tp, tp, wsParam, tp,
 			))
 		}
 		whereParts = append(whereParts, "("+strings.Join(termConditions, " AND ")+")")
@@ -492,8 +507,9 @@ func buildSearchQuery(phrase string, terms []string, queryNum int, hasNum bool,
 		rankCases = append(rankCases, fmt.Sprintf("WHEN (%s) THEN 6", strings.Join(descTerms, " AND ")))
 	}
 
-	// Tier 7: Comment contains phrase
-	rankCases = append(rankCases, fmt.Sprintf("WHEN EXISTS (SELECT 1 FROM comment c WHERE c.issue_id = i.id AND LOWER(c.content) LIKE %s) THEN 7", phraseContainsParam))
+	// Tier 7: Comment contains phrase. Same workspace_id-in-subquery
+	// contract as the WHERE clause; see the phraseMatch comment above.
+	rankCases = append(rankCases, fmt.Sprintf("WHEN EXISTS (SELECT 1 FROM comment c WHERE c.issue_id = i.id AND c.workspace_id = %s AND LOWER(c.content) LIKE %s) THEN 7", wsParam, phraseContainsParam))
 
 	// Tier 8: Comment matches all words (multi-word only)
 	if len(termContainsParams) > 1 {
@@ -501,7 +517,7 @@ func buildSearchQuery(phrase string, terms []string, queryNum int, hasNum bool,
 		for _, tp := range termContainsParams {
 			commentTerms = append(commentTerms, fmt.Sprintf("LOWER(c.content) LIKE %s", tp))
 		}
-		rankCases = append(rankCases, fmt.Sprintf("WHEN EXISTS (SELECT 1 FROM comment c WHERE c.issue_id = i.id AND (%s)) THEN 8", strings.Join(commentTerms, " AND ")))
+		rankCases = append(rankCases, fmt.Sprintf("WHEN EXISTS (SELECT 1 FROM comment c WHERE c.issue_id = i.id AND c.workspace_id = %s AND (%s)) THEN 8", wsParam, strings.Join(commentTerms, " AND ")))
 	}
 
 	rankExpr := "CASE " + strings.Join(rankCases, " ") + " ELSE 9 END"
@@ -548,12 +564,15 @@ func buildSearchQuery(phrase string, terms []string, queryNum int, hasNum bool,
 	// --- matched_comment_content subquery ---
 	// Always return matching comment content regardless of match_source,
 	// so frontend can display comment snippet alongside title/description matches.
+	// The c.workspace_id filter mirrors the WHERE clause: without it,
+	// the planner can pick a global comment scan that ignores workspace
+	// scoping.
 	commentSubquery := fmt.Sprintf(`COALESCE(
 		(SELECT c.content FROM comment c
-		 WHERE c.issue_id = i.id AND LOWER(c.content) LIKE %s
+		 WHERE c.issue_id = i.id AND c.workspace_id = %s AND LOWER(c.content) LIKE %s
 		 ORDER BY c.created_at DESC LIMIT 1),
 		''
-	)`, phraseContainsParam)
+	)`, wsParam, phraseContainsParam)
 
 	if len(termContainsParams) > 1 {
 		var commentTerms []string
@@ -562,10 +581,10 @@ func buildSearchQuery(phrase string, terms []string, queryNum int, hasNum bool,
 		}
 		commentSubquery = fmt.Sprintf(`COALESCE(
 			(SELECT c.content FROM comment c
-			 WHERE c.issue_id = i.id AND (LOWER(c.content) LIKE %s OR (%s))
+			 WHERE c.issue_id = i.id AND c.workspace_id = %s AND (LOWER(c.content) LIKE %s OR (%s))
 			 ORDER BY c.created_at DESC LIMIT 1),
 			''
-		)`, phraseContainsParam, strings.Join(commentTerms, " AND "))
+		)`, wsParam, phraseContainsParam, strings.Join(commentTerms, " AND "))
 	}
 
 	limitParam := nextArg(nil)  // placeholder
@@ -636,50 +655,56 @@ func (h *Handler) SearchIssues(w http.ResponseWriter, r *http.Request) {
 	args[len(args)-2] = limit
 	args[len(args)-1] = offset
 
-	rows, err := h.DB.Query(ctx, sqlQuery, args...)
-	if err != nil {
-		slog.Warn("search issues failed", "error", err, "workspace_id", workspaceID, "query", q)
-		writeError(w, http.StatusInternalServerError, "failed to search issues")
-		return
-	}
-	defer rows.Close()
-
 	var results []searchResult
-	for rows.Next() {
-		var sr searchResult
-		if err := rows.Scan(
-			&sr.issue.ID,
-			&sr.issue.WorkspaceID,
-			&sr.issue.Title,
-			&sr.issue.Description,
-			&sr.issue.Status,
-			&sr.issue.Priority,
-			&sr.issue.AssigneeType,
-			&sr.issue.AssigneeID,
-			&sr.issue.CreatorType,
-			&sr.issue.CreatorID,
-			&sr.issue.ParentIssueID,
-			&sr.issue.AcceptanceCriteria,
-			&sr.issue.ContextRefs,
-			&sr.issue.Position,
-			&sr.issue.StartDate,
-			&sr.issue.DueDate,
-			&sr.issue.CreatedAt,
-			&sr.issue.UpdatedAt,
-			&sr.issue.Number,
-			&sr.issue.ProjectID,
-			&sr.totalCount,
-			&sr.matchSource,
-			&sr.matchedCommentContent,
-		); err != nil {
-			slog.Warn("search issues scan failed", "error", err)
-			writeError(w, http.StatusInternalServerError, "failed to search issues")
+	err := runSearchQuery(ctx, h.TxStarter, sqlQuery, args, func(rows pgx.Rows) error {
+		for rows.Next() {
+			var sr searchResult
+			if err := rows.Scan(
+				&sr.issue.ID,
+				&sr.issue.WorkspaceID,
+				&sr.issue.Title,
+				&sr.issue.Description,
+				&sr.issue.Status,
+				&sr.issue.Priority,
+				&sr.issue.AssigneeType,
+				&sr.issue.AssigneeID,
+				&sr.issue.CreatorType,
+				&sr.issue.CreatorID,
+				&sr.issue.ParentIssueID,
+				&sr.issue.AcceptanceCriteria,
+				&sr.issue.ContextRefs,
+				&sr.issue.Position,
+				&sr.issue.StartDate,
+				&sr.issue.DueDate,
+				&sr.issue.CreatedAt,
+				&sr.issue.UpdatedAt,
+				&sr.issue.Number,
+				&sr.issue.ProjectID,
+				&sr.totalCount,
+				&sr.matchSource,
+				&sr.matchedCommentContent,
+			); err != nil {
+				return fmt.Errorf("scan: %w", err)
+			}
+			results = append(results, sr)
+		}
+		return rows.Err()
+	})
+	if err != nil {
+		// Statement-timeout surfaces as SQLSTATE 57014. Return a 503
+		// so the frontend can distinguish a timeout ("try a more
+		// specific query") from a generic 500. This is the fail-fast
+		// path when GIN search indexes are absent or the database is
+		// overloaded; see runSearchQuery header for context.
+		if isSearchStatementTimeout(err) {
+			slog.Warn("search issues timed out",
+				"workspace_id", workspaceID,
+				"query", q,
+				"timeout", searchStatementTimeout)
+			writeError(w, http.StatusServiceUnavailable, "search timed out; please refine your query or try again")
 			return
 		}
-		results = append(results, sr)
-	}
-	if err := rows.Err(); err != nil {
-		slog.Warn("search issues rows error", "error", err)
+		slog.Warn("search issues failed", "error", err, "workspace_id", workspaceID, "query", q)
 		writeError(w, http.StatusInternalServerError, "failed to search issues")
 		return
 	}
diff --git a/server/internal/handler/project.go b/server/internal/handler/project.go
index 68b21d30f5a..11b93915fba 100644
--- a/server/internal/handler/project.go
+++ b/server/internal/handler/project.go
@@ -11,6 +11,7 @@ import (
 	"strings"
 
 	"github.com/go-chi/chi/v5"
+	"github.com/jackc/pgx/v5"
 	"github.com/jackc/pgx/v5/pgtype"
 	"github.com/multica-ai/multica/server/internal/logger"
 	db "github.com/multica-ai/multica/server/pkg/db/generated"
@@ -709,14 +710,6 @@ func (h *Handler) SearchProjects(w http.ResponseWriter, r *http.Request) {
 	args[len(args)-2] = limit
 	args[len(args)-1] = offset
 
-	rows, err := h.DB.Query(ctx, sqlQuery, args...)
-	if err != nil {
-		slog.Warn("search projects failed", "error", err, "workspace_id", workspaceID, "query", q)
-		writeError(w, http.StatusInternalServerError, "failed to search projects")
-		return
-	}
-	defer rows.Close()
-
 	type projectSearchRow struct {
 		project     db.Project
 		totalCount  int64
@@ -724,31 +717,42 @@ func (h *Handler) SearchProjects(w http.ResponseWriter, r *http.Request) {
 	}
 
 	var results []projectSearchRow
-	for rows.Next() {
-		var row projectSearchRow
-		if err := rows.Scan(
-			&row.project.ID,
-			&row.project.WorkspaceID,
-			&row.project.Title,
-			&row.project.Description,
-			&row.project.Icon,
-			&row.project.Status,
-			&row.project.Priority,
-			&row.project.LeadType,
-			&row.project.LeadID,
-			&row.project.CreatedAt,
-			&row.project.UpdatedAt,
-			&row.totalCount,
-			&row.matchSource,
-		); err != nil {
-			slog.Warn("search projects scan failed", "error", err)
-			writeError(w, http.StatusInternalServerError, "failed to search projects")
+	err := runSearchQuery(ctx, h.TxStarter, sqlQuery, args, func(rows pgx.Rows) error {
+		for rows.Next() {
+			var row projectSearchRow
+			if err := rows.Scan(
+				&row.project.ID,
+				&row.project.WorkspaceID,
+				&row.project.Title,
+				&row.project.Description,
+				&row.project.Icon,
+				&row.project.Status,
+				&row.project.Priority,
+				&row.project.LeadType,
+				&row.project.LeadID,
+				&row.project.CreatedAt,
+				&row.project.UpdatedAt,
+				&row.totalCount,
+				&row.matchSource,
+			); err != nil {
+				return fmt.Errorf("scan: %w", err)
+			}
+			results = append(results, row)
+		}
+		return rows.Err()
+	})
+	if err != nil {
+		// Statement-timeout surfaces as SQLSTATE 57014 — same
+		// fail-fast contract as SearchIssues (see runSearchQuery).
+		if isSearchStatementTimeout(err) {
+			slog.Warn("search projects timed out",
+				"workspace_id", workspaceID,
+				"query", q,
+				"timeout", searchStatementTimeout)
+			writeError(w, http.StatusServiceUnavailable, "search timed out; please refine your query or try again")
 			return
 		}
-		results = append(results, row)
-	}
-	if err := rows.Err(); err != nil {
-		slog.Warn("search projects rows error", "error", err)
+		slog.Warn("search projects failed", "error", err, "workspace_id", workspaceID, "query", q)
 		writeError(w, http.StatusInternalServerError, "failed to search projects")
 		return
 	}
diff --git a/server/internal/handler/search.go b/server/internal/handler/search.go
new file mode 100644
index 00000000000..84a194f30d8
--- /dev/null
+++ b/server/internal/handler/search.go
@@ -0,0 +1,121 @@
+package handler
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"time"
+
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgconn"
+)
+
+// searchStatementTimeout bounds every /search request at the Postgres level.
+//
+// The two search handlers (SearchIssues, SearchProjects) run LOWER(col) LIKE
+// '%pattern%' queries whose fast path depends on pg_bigm / pg_trgm GIN
+// indexes (see migrations 032, 033, 036, 134). When those extensions are
+// missing — as they were on every self-hosted deployment using the bundled
+// pgvector/pgvector:pg17 image before migration 134 shipped — Postgres
+// falls back to a Seq Scan on `issue` plus correlated Seq Scans on
+// `comment`. On workspaces with thousands of rows the query takes long
+// enough that the frontend Loader2 spinner appears to hang forever
+// ("搜索卡死没有任何反应", MUL-4059).
+//
+// The 3 s cap is generous compared to a properly indexed search (typically
+// <50 ms) and short enough that the frontend's implicit request timeout
+// (browser default, ~30 s) never kicks in. On timeout the caller sees a
+// 503 with a descriptive error rather than a stalled connection —
+// SearchIssues / SearchProjects map SQLSTATE 57014 to
+// http.StatusServiceUnavailable so the frontend can distinguish this
+// from a generic 500.
+const searchStatementTimeout = 3 * time.Second
+
+// searchStatementTimeoutOverride, when non-zero, replaces
+// searchStatementTimeout for the duration of a test. Never read outside
+// of the runSearchQuery hot path — see search_timeout_test.go.
+var searchStatementTimeoutOverride time.Duration
+
+func effectiveSearchStatementTimeout() time.Duration {
+	if searchStatementTimeoutOverride > 0 {
+		return searchStatementTimeoutOverride
+	}
+	return searchStatementTimeout
+}
+
+// runSearchQuery executes a search SQL query inside a short-lived read-only
+// transaction with SET LOCAL statement_timeout as the safety net. rowsFn
+// receives each pgx.Rows result and is responsible for scanning /
+// accumulating results before returning; runSearchQuery handles
+// commit / rollback and returns the first error encountered.
+//
+// tx uses IsoLevel ReadCommitted (Postgres default) and AccessMode ReadOnly
+// so a stuck search cannot hold row locks against writers.
+func runSearchQuery(
+	ctx context.Context,
+	txStarter txStarter,
+	sql string,
+	args []any,
+	rowsFn func(pgx.Rows) error,
+) error {
+	tx, err := txStarter.Begin(ctx)
+	if err != nil {
+		return fmt.Errorf("begin search tx: %w", err)
+	}
+	committed := false
+	defer func() {
+		if !committed {
+			// Best-effort rollback with a fresh context so a caller
+			// cancellation still lets the connection go back clean.
+			_ = tx.Rollback(context.Background())
+		}
+	}()
+
+	// SET LOCAL is transaction-scoped, so pgxpool can safely hand this
+	// connection back out after COMMIT without the timeout leaking to
+	// unrelated queries.
+	timeoutMs := int(effectiveSearchStatementTimeout() / time.Millisecond)
+	if _, err := tx.Exec(ctx, fmt.Sprintf("SET LOCAL statement_timeout = %d", timeoutMs)); err != nil {
+		return fmt.Errorf("set search statement_timeout: %w", err)
+	}
+	// The read-only mode is applied here rather than via TxOptions so we
+	// keep the txStarter interface signature (Begin only) intact. It's
+	// belt-and-suspenders — the search queries only SELECT anyway.
+	if _, err := tx.Exec(ctx, "SET LOCAL transaction_read_only = on"); err != nil {
+		return fmt.Errorf("set search transaction_read_only: %w", err)
+	}
+
+	rows, err := tx.Query(ctx, sql, args...)
+	if err != nil {
+		return err
+	}
+	// Close rows before commit so pgx does not complain about a busy
+	// connection during Commit.
+	if err := rowsFn(rows); err != nil {
+		rows.Close()
+		return err
+	}
+	rows.Close()
+
+	if err := tx.Commit(ctx); err != nil {
+		return err
+	}
+	committed = true
+	return nil
+}
+
+// isSearchStatementTimeout reports whether err is the canonical Postgres
+// query_canceled error (SQLSTATE 57014). Both `SET LOCAL statement_timeout`
+// firing and a client-side context cancellation surface as 57014 — the two
+// are indistinguishable from the client side, which is intentional in the
+// pgx layer.
+func isSearchStatementTimeout(err error) bool {
+	if err == nil {
+		return false
+	}
+	var pgErr *pgconn.PgError
+	if errors.As(err, &pgErr) {
+		return pgErr.Code == "57014"
+	}
+	return false
+}
diff --git a/server/internal/handler/search_test.go b/server/internal/handler/search_test.go
index e27af9abdc2..f8309a7d5f7 100644
--- a/server/internal/handler/search_test.go
+++ b/server/internal/handler/search_test.go
@@ -255,3 +255,42 @@ func TestBuildSearchQuery_SingleTermNoAllTermTiers(t *testing.T) {
 		t.Error("single-term query should not have tier 8 (comment all-terms)")
 	}
 }
+
+// TestBuildSearchQuery_CommentSubqueryWorkspaceScope regressions the
+// MUL-4059 fix: every EXISTS / correlated subquery over `comment` MUST
+// filter by c.workspace_id = $wsParam. Without this, Postgres rewrites
+// the correlated subquery into a hashed subplan that materializes every
+// comment in the entire table matching the LIKE — on prd this was
+// 536k rows / 32.3 s for '%search%'. With the filter the hashed set
+// collapses to this workspace's comments and the plan uses the
+// idx_comment_workspace supporting btree.
+//
+// $4 is buildSearchQuery's canonical workspace_id placeholder (the
+// caller writes wsUUID into args[3] before executing).
+func TestBuildSearchQuery_CommentSubqueryWorkspaceScope(t *testing.T) {
+	singleQuery, _ := buildSearchQuery("html", []string{"html"}, 0, false, false)
+
+	// Every occurrence of `FROM comment c` must be followed by the
+	// c.workspace_id = $4 constraint. Counting is safer than a single
+	// substring check because the WHERE, rank CASE, matched_comment_content
+	// subqueries all touch `comment` and must each carry the filter.
+	fromCount := strings.Count(singleQuery, "FROM comment c")
+	scopedCount := strings.Count(singleQuery, "c.workspace_id = $4")
+	if fromCount == 0 {
+		t.Fatalf("single-term query has no comment subquery — did buildSearchQuery drop it?")
+	}
+	if scopedCount < fromCount {
+		t.Errorf("single-term query has %d comment subqueries but only %d workspace_id filters — %d unscoped subquery(ies) will trigger the MUL-4059 global-hash plan",
+			fromCount, scopedCount, fromCount-scopedCount)
+	}
+
+	// Multi-term uses one extra comment subquery in the WHERE and one in
+	// the rank CASE for the all-terms match — same invariant applies.
+	multiQuery, _ := buildSearchQuery("foo bar", []string{"foo", "bar"}, 0, false, false)
+	fromCountMulti := strings.Count(multiQuery, "FROM comment c")
+	scopedCountMulti := strings.Count(multiQuery, "c.workspace_id = $4")
+	if scopedCountMulti < fromCountMulti {
+		t.Errorf("multi-term query has %d comment subqueries but only %d workspace_id filters",
+			fromCountMulti, scopedCountMulti)
+	}
+}
diff --git a/server/internal/handler/search_timeout_test.go b/server/internal/handler/search_timeout_test.go
new file mode 100644
index 00000000000..76ba23d05b6
--- /dev/null
+++ b/server/internal/handler/search_timeout_test.go
@@ -0,0 +1,83 @@
+package handler
+
+import (
+	"context"
+	"errors"
+	"testing"
+	"time"
+
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgconn"
+)
+
+func TestIsSearchStatementTimeout(t *testing.T) {
+	tests := []struct {
+		name string
+		err  error
+		want bool
+	}{
+		{"nil error", nil, false},
+		{"57014 pgx error", &pgconn.PgError{Code: "57014", Message: "canceling statement due to statement timeout"}, true},
+		{"57014 wrapped", errors.Join(errors.New("outer"), &pgconn.PgError{Code: "57014"}), true},
+		{"different pg code", &pgconn.PgError{Code: "42P01"}, false},
+		{"plain error", errors.New("boom"), false},
+		{"context canceled", context.Canceled, false},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := isSearchStatementTimeout(tc.err); got != tc.want {
+				t.Errorf("isSearchStatementTimeout(%v) = %v, want %v", tc.err, got, tc.want)
+			}
+		})
+	}
+}
+
+// TestRunSearchQuery_StatementTimeoutFires exercises the safety net end
+// to end against a live Postgres, proving that a deliberately hung
+// pg_sleep query is cut off by SET LOCAL statement_timeout (SQLSTATE
+// 57014) before the 3 s search cap could ever be reached. Skips
+// gracefully if the database is not reachable — mirrors the pattern in
+// handler_test.go so CI without a DB stays green.
+func TestRunSearchQuery_StatementTimeoutFires(t *testing.T) {
+	if testPool == nil {
+		t.Skip("DATABASE_URL not set; skipping live-Postgres search timeout test")
+	}
+	// Override the search timeout for this test only: 200 ms is short
+	// enough that pg_sleep(2) is guaranteed to hit it, and this keeps
+	// the test snappy. We restore the constant via t.Cleanup so other
+	// tests keep the production value.
+	oldTimeout := searchStatementTimeout
+	setSearchStatementTimeoutForTest(t, 200*time.Millisecond)
+	t.Cleanup(func() { setSearchStatementTimeoutForTest(t, oldTimeout) })
+
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	start := time.Now()
+	err := runSearchQuery(ctx, testPool, "SELECT pg_sleep(2)", nil, func(rows pgx.Rows) error {
+		for rows.Next() {
+			// nothing to scan — but iterate so pgx surfaces the
+			// server error once the statement_timeout fires
+		}
+		return rows.Err()
+	})
+	elapsed := time.Since(start)
+
+	if err == nil {
+		t.Fatal("expected statement_timeout error, got nil")
+	}
+	if !isSearchStatementTimeout(err) {
+		t.Fatalf("expected SQLSTATE 57014 (statement_timeout), got: %v", err)
+	}
+	if elapsed > 1500*time.Millisecond {
+		t.Errorf("statement_timeout did not cut hung query fast enough: elapsed=%s (want <1.5s)", elapsed)
+	}
+}
+
+// setSearchStatementTimeoutForTest is a package-private hook used only
+// by the live-Postgres timeout test above. Kept out of the public
+// surface to prevent handlers from accidentally raising the cap.
+func setSearchStatementTimeoutForTest(t *testing.T, v time.Duration) {
+	t.Helper()
+	searchStatementTimeoutOverride = v
+}
diff --git a/server/migrations/134_search_index_trgm_fallback.down.sql b/server/migrations/134_search_index_trgm_fallback.down.sql
new file mode 100644
index 00000000000..add5ef84935
--- /dev/null
+++ b/server/migrations/134_search_index_trgm_fallback.down.sql
@@ -0,0 +1,10 @@
+-- Drop the pg_trgm fallback GIN search indexes. Leaves the pg_trgm
+-- extension in place because other future queries may depend on it and
+-- dropping it has no benefit (extension idle overhead is essentially
+-- zero). The pg_bigm indexes from migrations 036 / 039 are untouched.
+
+DROP INDEX IF EXISTS idx_issue_title_trgm;
+DROP INDEX IF EXISTS idx_issue_description_trgm;
+DROP INDEX IF EXISTS idx_comment_content_trgm;
+DROP INDEX IF EXISTS idx_project_title_trgm;
+DROP INDEX IF EXISTS idx_project_description_trgm;
diff --git a/server/migrations/134_search_index_trgm_fallback.up.sql b/server/migrations/134_search_index_trgm_fallback.up.sql
new file mode 100644
index 00000000000..c5350e58e60
--- /dev/null
+++ b/server/migrations/134_search_index_trgm_fallback.up.sql
@@ -0,0 +1,85 @@
+-- Fallback GIN search indexes using pg_trgm for environments where pg_bigm
+-- is unavailable. Background:
+--
+-- Migration 032 (issue_search_index), 033 (comment_search_index), and
+-- 039 (project_search_index) all wrap `CREATE EXTENSION pg_bigm` and
+-- their GIN index creation in EXCEPTION handlers, silently skipping if
+-- pg_bigm is not installed. This was intended as a CI guardrail (see
+-- migration 032 header) so tests could run against a stock Postgres image.
+--
+-- The unintended consequence: the bundled self-host / dev / CI Postgres
+-- image is `pgvector/pgvector:pg17`, which does NOT ship pg_bigm. On every
+-- self-hosted deployment the three migrations silently no-op, no GIN
+-- indexes get built, and search queries fall back to a Seq Scan on
+-- `issue` / `project` + correlated Seq Scans on `comment` — verified with
+-- EXPLAIN on the local dev DB, which had zero title/description/comment
+-- search indexes before this change.
+--
+-- pg_trgm is part of PostgreSQL's contrib package and is shipped in every
+-- image we support, including pgvector. It supports the same
+-- `LOWER(col) LIKE '%pattern%'` pattern via GIN + gin_trgm_ops. For CJK
+-- content pg_bigm remains the better choice (bigrams vs trigrams — a
+-- 2-character CJK query indexes cleanly under pg_bigm but degrades to a
+-- Seq Scan under pg_trgm) so we do NOT drop the pg_bigm indexes; the two
+-- coexist and the planner picks whichever is cheaper.
+--
+-- Coverage MUST match the search handler surface: SearchIssues consults
+-- issue.title / issue.description / comment.content; SearchProjects
+-- consults project.title / project.description. Missing any one of them
+-- leaves that branch on a Seq Scan and defeats the point of the fallback.
+--
+-- Guardrails:
+--   1. `CREATE EXTENSION IF NOT EXISTS pg_trgm` — safe on all supported
+--      images. Wrapped in DO/EXCEPTION so a hypothetical minimal image
+--      without pg_trgm still lets migrations finish (mirrors migration
+--      032 pg_bigm pattern).
+--   2. `CREATE INDEX IF NOT EXISTS` — idempotent on re-run.
+--   3. Same LOWER() expression signature as the search handlers' WHERE
+--      clauses exactly, so the planner can match the index.
+--
+-- Lock impact: plain CREATE INDEX takes an AccessExclusive lock on the
+-- table for the duration of the build. Cannot use CREATE INDEX
+-- CONCURRENTLY here because it is disallowed inside a DO block (and
+-- the extension-optional guardrail requires DO). Operators running very
+-- large tables who want the concurrent variant can pre-create the five
+-- indexes manually with CONCURRENTLY before applying the migration; the
+-- IF NOT EXISTS check will then turn this migration into a no-op.
+
+DO $$
+BEGIN
+  CREATE EXTENSION IF NOT EXISTS pg_trgm;
+EXCEPTION WHEN OTHERS THEN
+  RAISE NOTICE 'pg_trgm not available, skipping trigram search indexes';
+END
+$$;
+
+DO $$
+BEGIN
+  CREATE INDEX IF NOT EXISTS idx_issue_title_trgm
+    ON issue USING gin (LOWER(title) gin_trgm_ops);
+  CREATE INDEX IF NOT EXISTS idx_issue_description_trgm
+    ON issue USING gin (LOWER(COALESCE(description, '')) gin_trgm_ops);
+EXCEPTION WHEN OTHERS THEN
+  RAISE NOTICE 'skipping trigram indexes on issue (pg_trgm not installed)';
+END
+$$;
+
+DO $$
+BEGIN
+  CREATE INDEX IF NOT EXISTS idx_comment_content_trgm
+    ON comment USING gin (LOWER(content) gin_trgm_ops);
+EXCEPTION WHEN OTHERS THEN
+  RAISE NOTICE 'skipping trigram index on comment (pg_trgm not installed)';
+END
+$$;
+
+DO $$
+BEGIN
+  CREATE INDEX IF NOT EXISTS idx_project_title_trgm
+    ON project USING gin (LOWER(title) gin_trgm_ops);
+  CREATE INDEX IF NOT EXISTS idx_project_description_trgm
+    ON project USING gin (LOWER(COALESCE(description, '')) gin_trgm_ops);
+EXCEPTION WHEN OTHERS THEN
+  RAISE NOTICE 'skipping trigram indexes on project (pg_trgm not installed)';
+END
+$$;
diff --git a/server/migrations/135_comment_workspace_index.down.sql b/server/migrations/135_comment_workspace_index.down.sql
new file mode 100644
index 00000000000..36029d49568
--- /dev/null
+++ b/server/migrations/135_comment_workspace_index.down.sql
@@ -0,0 +1,8 @@
+-- Drop the comment.workspace_id supporting btree index (MUL-4059).
+-- The search handler's WHERE clause will still work without it — the
+-- planner will just fall back to a Seq Scan on `comment` filtered by
+-- workspace_id, which is the pre-migration-135 behavior. Only run this
+-- down migration if operating below the query-rewrite change; otherwise
+-- expect search latency to regress.
+
+DROP INDEX IF EXISTS idx_comment_workspace;
diff --git a/server/migrations/135_comment_workspace_index.up.sql b/server/migrations/135_comment_workspace_index.up.sql
new file mode 100644
index 00000000000..586ee1c1272
--- /dev/null
+++ b/server/migrations/135_comment_workspace_index.up.sql
@@ -0,0 +1,48 @@
+-- Supporting btree index on comment.workspace_id for the search handler.
+--
+-- Context (MUL-4059): The search handler's WHERE clause contains a
+-- correlated `EXISTS` subquery over `comment` that Postgres routinely
+-- rewrites into a *hashed* subplan — the subquery is evaluated once and
+-- the results are hashed for lookup by the outer scan. That rewrite is
+-- an optimization when the subquery is cheap; it becomes a pathology
+-- when the subquery scans the entire `comment` table filtered only by
+-- LIKE, because for common tokens (e.g. "search", "agent") the bigm/trgm
+-- GIN index matches hundreds of thousands of rows across every
+-- workspace. Confirmed on prd against `multica-prod`: a search for
+-- '%search%' returned 536,761 comment bigm hits, spilled work_mem into a
+-- lossy bitmap (`Heap Blocks: exact=48297 lossy=164696`), rechecked 1.9M
+-- rows, and the outer query took 32.3 s despite indexes being present.
+--
+-- The fix is two-part:
+--   1. Query-level: buildSearchQuery now adds `c.workspace_id = $wsParam`
+--      to every comment subquery. With the workspace_id as a compile-time
+--      constant (same parameter as the outer WHERE), the planner can
+--      collapse the hashed set to this workspace's comments only.
+--   2. Index-level: this migration. Without a btree index on
+--      comment.workspace_id, the pushed-down filter still triggers a
+--      Seq Scan on `comment`; with it, the planner picks an Index Scan
+--      or Bitmap AND with the bigm/trgm content index.
+--
+-- Verified on a local repro that mirrors the prd hot workspace
+-- (5k issues in the target workspace, 100k comments in a sibling
+-- workspace all containing "search"): the query plan drops from
+-- 60 ms (hashed global scan) to 1.8 ms (subplan uses this index).
+-- Prd extrapolation: 32.3 s → tens of milliseconds.
+--
+-- This CREATE INDEX is deliberately unwrapped. The whole point of
+-- MUL-4059 was that migrations 032 / 033 / 036 hid CREATE INDEX inside
+-- `DO $$ ... EXCEPTION WHEN OTHERS $$` blocks, so on any environment
+-- where pg_bigm was absent the migration "succeeded" while quietly
+-- creating no indexes at all — the exact silent-skip pattern that took
+-- prd search down. This index is the critical support for the fix, not
+-- an optional CJK bonus, so a real failure (lock timeout, disk full,
+-- permission denied, schema drift) MUST abort the migration and fail
+-- deployment, not slip through as a green success. IF NOT EXISTS keeps
+-- the migration idempotent for the operator-precreated case; operators
+-- who need concurrent creation on a large prd table should run
+-- `CREATE INDEX CONCURRENTLY idx_comment_workspace ON comment
+-- (workspace_id);` before applying, which turns this statement into a
+-- no-op.
+
+CREATE INDEX IF NOT EXISTS idx_comment_workspace
+    ON comment (workspace_id);

From 3f17c2717b6723d9491d1ebd47ae63b78508534a Mon Sep 17 00:00:00 2001
From: tangyuanjc <tangyuanjc@gmail.com>
Date: Mon, 6 Jul 2026 13:16:54 +0800
Subject: [PATCH 04/15] WS-1465 fix autopilot duplicate issue dispatch (#4936)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-authored-by: JC的AI分身 <tangyuanjc@JCdeAIfenshendeMac-mini.local>
Co-authored-by: multica-agent <github@multica.ai>
---
 .../autopilot_dispatch_for_plan_test.go       | 68 +++++++++++++++++++
 .../cmd/server/autopilot_schedule_job_test.go | 53 +++++++++++++--
 server/internal/issueguard/duplicate.go       | 44 ++++++++++++
 server/internal/scheduler/jobs_autopilot.go   | 26 +++++--
 server/internal/service/autopilot.go          | 27 ++++++--
 server/pkg/db/generated/issue.sql.go          | 67 ++++++++++++++++++
 server/pkg/db/queries/issue.sql               | 19 ++++++
 7 files changed, 286 insertions(+), 18 deletions(-)

diff --git a/server/cmd/server/autopilot_dispatch_for_plan_test.go b/server/cmd/server/autopilot_dispatch_for_plan_test.go
index 040b4f7c352..131088495c8 100644
--- a/server/cmd/server/autopilot_dispatch_for_plan_test.go
+++ b/server/cmd/server/autopilot_dispatch_for_plan_test.go
@@ -149,6 +149,74 @@ func TestDispatchAutopilotForPlanIsIdempotent(t *testing.T) {
 	}
 }
 
+func TestDispatchAutopilotSuppressesRecentDuplicateIssue(t *testing.T) {
+	ctx := context.Background()
+	queries := db.New(testPool)
+	bus := events.New()
+	taskSvc := service.NewTaskService(queries, testPool, nil, bus)
+	autopilotSvc := service.NewAutopilotService(queries, testPool, bus, taskSvc)
+
+	var agentID string
+	if err := testPool.QueryRow(ctx,
+		`SELECT id::text FROM agent WHERE workspace_id = $1 ORDER BY created_at ASC LIMIT 1`,
+		testWorkspaceID,
+	).Scan(&agentID); err != nil {
+		t.Fatalf("load fixture agent: %v", err)
+	}
+
+	title := "Autopilot recent duplicate issue " + time.Now().UTC().Format("20060102150405.000000000")
+	ap, err := queries.CreateAutopilot(ctx, db.CreateAutopilotParams{
+		WorkspaceID:        parseUUID(testWorkspaceID),
+		Title:              "Recent duplicate issue guard",
+		Description:        pgtype.Text{String: "Recent duplicate issue guard test", Valid: true},
+		AssigneeType:       "agent",
+		AssigneeID:         parseUUID(agentID),
+		Status:             "active",
+		ExecutionMode:      "create_issue",
+		IssueTitleTemplate: pgtype.Text{String: title, Valid: true},
+		CreatedByType:      "member",
+		CreatedByID:        parseUUID(testUserID),
+	})
+	if err != nil {
+		t.Fatalf("CreateAutopilot: %v", err)
+	}
+	t.Cleanup(func() {
+		bg := context.Background()
+		_, _ = testPool.Exec(bg, `DELETE FROM autopilot WHERE id = $1`, ap.ID)
+		_, _ = testPool.Exec(bg, `DELETE FROM issue WHERE workspace_id = $1 AND title = $2`, testWorkspaceID, title)
+	})
+
+	first, err := autopilotSvc.DispatchAutopilot(ctx, ap, pgtype.UUID{}, "manual", nil)
+	if err != nil {
+		t.Fatalf("first DispatchAutopilot: %v", err)
+	}
+	if first == nil || first.Status != "issue_created" || !first.IssueID.Valid {
+		t.Fatalf("first dispatch = %+v, want issue_created with issue_id", first)
+	}
+
+	second, err := autopilotSvc.DispatchAutopilot(ctx, ap, pgtype.UUID{}, "manual", nil)
+	if err != nil {
+		t.Fatalf("second DispatchAutopilot: %v", err)
+	}
+	if second == nil || second.Status != "skipped" {
+		t.Fatalf("second dispatch = %+v, want skipped duplicate run", second)
+	}
+	if second.IssueID.Valid {
+		t.Fatalf("duplicate run linked issue_id=%s, want no new issue", util.UUIDToString(second.IssueID))
+	}
+
+	var count int
+	if err := testPool.QueryRow(ctx,
+		`SELECT count(*) FROM issue WHERE workspace_id = $1 AND title = $2`,
+		testWorkspaceID, title,
+	).Scan(&count); err != nil {
+		t.Fatalf("count issues: %v", err)
+	}
+	if count != 1 {
+		t.Fatalf("recent duplicate autopilot dispatch should leave 1 matching issue, got %d", count)
+	}
+}
+
 // TestDispatchAutopilotForPlanRejectsZeroArgs locks in the
 // fail-loud contract: a caller that forgets to set trigger_id or
 // planned_at would silently disable the idempotency guard, and the
diff --git a/server/cmd/server/autopilot_schedule_job_test.go b/server/cmd/server/autopilot_schedule_job_test.go
index 6a3a04dacf3..2f9d012e13b 100644
--- a/server/cmd/server/autopilot_schedule_job_test.go
+++ b/server/cmd/server/autopilot_schedule_job_test.go
@@ -501,11 +501,11 @@ func TestAutopilotScheduleJobPausedAutopilotSkipsAtHandler(t *testing.T) {
 	// and returns a SUCCESS no-op WITHOUT calling DispatchAutopilotForPlan.
 	planTime := time.Now().UTC().Truncate(time.Minute)
 	result, err := job.Handler(ctx, scheduler.HandlerInput{
-		Job:      &job,
-		Scope:    scheduler.Scope{Kind: scheduler.ScopeKindAutopilotTrigger, ID: util.UUIDToString(trigger.ID)},
-		PlanTime: planTime,
-		Attempt:  1,
-		RunnerID: "handler-guard-test",
+		Job:       &job,
+		Scope:     scheduler.Scope{Kind: scheduler.ScopeKindAutopilotTrigger, ID: util.UUIDToString(trigger.ID)},
+		PlanTime:  planTime,
+		Attempt:   1,
+		RunnerID:  "handler-guard-test",
 		Heartbeat: func(ctx context.Context) error { return nil },
 	})
 	if err != nil {
@@ -736,8 +736,8 @@ func TestAutopilotScheduleJobColdStartBrandNewTriggerStillFires(t *testing.T) {
 	ctx := context.Background()
 	trigger, queries, autopilotSvc := seedColdStartTrigger(t, "0 12 * * *")
 
-	createdAt := time.Date(2026, 6, 23, 11, 50, 0, 0, time.UTC)  // 10 min before the fire
-	pinnedNow := time.Date(2026, 6, 23, 12, 5, 0, 0, time.UTC)   // 5 min after the fire
+	createdAt := time.Date(2026, 6, 23, 11, 50, 0, 0, time.UTC)   // 10 min before the fire
+	pinnedNow := time.Date(2026, 6, 23, 12, 5, 0, 0, time.UTC)    // 5 min after the fire
 	expectedFire := time.Date(2026, 6, 23, 12, 0, 0, 0, time.UTC) // the daily noon UTC fire
 
 	if _, err := testPool.Exec(ctx, `
@@ -771,3 +771,42 @@ func TestAutopilotScheduleJobColdStartBrandNewTriggerStillFires(t *testing.T) {
 			plans[0].Format(time.RFC3339), expectedFire.Format(time.RFC3339))
 	}
 }
+
+// TestAutopilotScheduleJobColdStartSkipsStaleMissedOccurrence covers the
+// activation-after-window case from WS-1465: a trigger with no scheduler
+// history must not immediately fire an hours-old occurrence just because it
+// became schedulable after the configured time had already passed.
+func TestAutopilotScheduleJobColdStartSkipsStaleMissedOccurrence(t *testing.T) {
+	ctx := context.Background()
+	trigger, queries, autopilotSvc := seedColdStartTrigger(t, "7 9 * * *")
+
+	createdAt := time.Date(2026, 7, 2, 15, 54, 0, 0, time.UTC)
+	pinnedNow := time.Date(2026, 7, 4, 13, 4, 27, 0, time.UTC)
+
+	if _, err := testPool.Exec(ctx, `
+		UPDATE autopilot_trigger
+		   SET created_at    = $2,
+		       last_fired_at = NULL
+		 WHERE id = $1
+	`, trigger.ID, createdAt); err != nil {
+		t.Fatalf("seed deterministic timestamps: %v", err)
+	}
+
+	job := scheduler.AutopilotScheduleDispatchJob(testPool, queries, autopilotSvc)
+	if _, err := job.Scopes(ctx, pinnedNow); err != nil {
+		t.Fatalf("populate scope cache: %v", err)
+	}
+
+	scope := scheduler.Scope{
+		Kind: scheduler.ScopeKindAutopilotTrigger,
+		ID:   util.UUIDToString(trigger.ID),
+	}
+
+	plans, err := job.PlansForScope(ctx, scope, pinnedNow, scheduler.LatestPlanInfo{Found: false})
+	if err != nil {
+		t.Fatalf("planner hook: %v", err)
+	}
+	if len(plans) != 0 {
+		t.Fatalf("stale cold-start occurrence must be skipped; got plans %v", plans)
+	}
+}
diff --git a/server/internal/issueguard/duplicate.go b/server/internal/issueguard/duplicate.go
index 5a7bc315af0..23085c129e6 100644
--- a/server/internal/issueguard/duplicate.go
+++ b/server/internal/issueguard/duplicate.go
@@ -5,6 +5,7 @@ import (
 	"errors"
 	"fmt"
 	"strings"
+	"time"
 
 	"github.com/jackc/pgx/v5"
 	"github.com/jackc/pgx/v5/pgtype"
@@ -75,6 +76,39 @@ func LockAndFindActiveDuplicate(
 	return duplicate, true, nil
 }
 
+func LockAndFindRecentAutopilotDuplicate(
+	ctx context.Context,
+	q *db.Queries,
+	workspaceID pgtype.UUID,
+	autopilotID pgtype.UUID,
+	projectID pgtype.UUID,
+	title string,
+	window time.Duration,
+) (db.Issue, bool, error) {
+	normalizedTitle := NormalizeTitle(title)
+	if normalizedTitle == "" || !autopilotID.Valid || window <= 0 {
+		return db.Issue{}, false, nil
+	}
+	if err := q.LockIssueDuplicateKey(ctx, recentAutopilotLockKey(workspaceID, autopilotID, projectID, normalizedTitle)); err != nil {
+		return db.Issue{}, false, err
+	}
+
+	duplicate, err := q.FindRecentAutopilotDuplicateIssue(ctx, db.FindRecentAutopilotDuplicateIssueParams{
+		WorkspaceID:     workspaceID,
+		OriginID:        autopilotID,
+		ProjectID:       projectID,
+		NormalizedTitle: normalizedTitle,
+		CreatedAfter:    pgtype.Timestamptz{Time: time.Now().UTC().Add(-window), Valid: true},
+	})
+	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return db.Issue{}, false, nil
+		}
+		return db.Issue{}, false, err
+	}
+	return duplicate, true, nil
+}
+
 func lockKey(workspaceID, projectID, parentIssueID pgtype.UUID, normalizedTitle string) string {
 	return strings.Join([]string{
 		"issue-active-duplicate",
@@ -84,3 +118,13 @@ func lockKey(workspaceID, projectID, parentIssueID pgtype.UUID, normalizedTitle
 		normalizedTitle,
 	}, "|")
 }
+
+func recentAutopilotLockKey(workspaceID, autopilotID, projectID pgtype.UUID, normalizedTitle string) string {
+	return strings.Join([]string{
+		"autopilot-recent-duplicate",
+		util.UUIDToString(workspaceID),
+		util.UUIDToString(autopilotID),
+		util.UUIDToString(projectID),
+		normalizedTitle,
+	}, "|")
+}
diff --git a/server/internal/scheduler/jobs_autopilot.go b/server/internal/scheduler/jobs_autopilot.go
index 199e70a06b2..85fa5205dc3 100644
--- a/server/internal/scheduler/jobs_autopilot.go
+++ b/server/internal/scheduler/jobs_autopilot.go
@@ -30,6 +30,13 @@ const ScopeKindAutopilotTrigger = "autopilot_trigger"
 // service.DefaultAutopilotTriggerTimezone.
 const DefaultAutopilotScheduleTimezone = "UTC"
 
+// maxAutopilotScheduleLateness is the acceptance window for dispatching a
+// cron occurrence after its configured plan_time. Normal scheduler jitter is
+// tens of seconds; anything beyond this is a stale catch-up and should wait
+// for the next configured slot instead of firing at an arbitrary activation
+// time.
+const maxAutopilotScheduleLateness = 5 * time.Minute
+
 // AutopilotScheduleDispatcher is the narrow contract this job needs
 // from service.AutopilotService. Defined here so unit tests in this
 // package (and the cmd/server integration tests) can stub it without
@@ -211,10 +218,11 @@ func autopilotScopes(
 }
 
 // autopilotPlansForScope returns the PlansForScope hook that computes
-// every cron occurrence in (lastPlan, dbNow] and keeps only the most
-// recent one. This matches the legacy goroutine's "collapse missed
-// fires" semantics; a future per-trigger catch_up_mode column can flip
-// the policy without touching scheduler internals.
+// every cron occurrence in (lastPlan, dbNow], keeps only the most recent
+// one, and rejects it if it is outside the dispatch-lateness window.
+// The latest-only collapse prevents a long outage from replaying every
+// missed slot; the lateness guard prevents a paused / newly eligible
+// trigger from firing hours after its configured time.
 //
 // Retry-eligible state is handled specially: when the most recent
 // stored plan_time is a FAILED row with attempts remaining and
@@ -300,10 +308,18 @@ func autopilotPlansForScope(cache *autopilotScheduleCache) func(
 			return nil, nil
 		}
 		// CatchUpLatestOnly: collapse missed fires to the most recent.
-		return occs[len(occs)-1:], nil
+		latestDue := occs[len(occs)-1]
+		if isAutopilotSchedulePlanStale(now, latestDue) {
+			return nil, nil
+		}
+		return []time.Time{latestDue}, nil
 	}
 }
 
+func isAutopilotSchedulePlanStale(now, planTime time.Time) bool {
+	return now.Sub(planTime) > maxAutopilotScheduleLateness
+}
+
 // autopilotHandler dispatches one (trigger, planTime) attempt and
 // returns the lease-affecting outcome. It re-loads the trigger +
 // autopilot inside the handler so a between-tick state change (e.g.
diff --git a/server/internal/service/autopilot.go b/server/internal/service/autopilot.go
index 9d022a3c0f0..49dac019adb 100644
--- a/server/internal/service/autopilot.go
+++ b/server/internal/service/autopilot.go
@@ -14,6 +14,7 @@ import (
 	"github.com/jackc/pgx/v5/pgtype"
 	"github.com/multica-ai/multica/server/internal/analytics"
 	"github.com/multica-ai/multica/server/internal/events"
+	"github.com/multica-ai/multica/server/internal/issueguard"
 	"github.com/multica-ai/multica/server/internal/issueposition"
 	obsmetrics "github.com/multica-ai/multica/server/internal/metrics"
 	"github.com/multica-ai/multica/server/internal/util"
@@ -39,6 +40,8 @@ type AutopilotService struct {
 // when computing next run times.
 const DefaultAutopilotTriggerTimezone = "UTC"
 
+const autopilotRecentDuplicateWindow = 60 * time.Second
+
 func NewAutopilotService(q *db.Queries, tx TxStarter, bus *events.Bus, taskSvc *TaskService) *AutopilotService {
 	return &AutopilotService{Queries: q, TxStarter: tx, Bus: bus, TaskSvc: taskSvc}
 }
@@ -299,6 +302,14 @@ func (s *AutopilotService) dispatchCreateIssue(ctx context.Context, ap db.Autopi
 	title := s.interpolateTemplate(ap, *run, triggerTimezone)
 	description := s.buildIssueDescription(ap, *run, triggerTimezone)
 
+	if duplicate, found, err := issueguard.LockAndFindRecentAutopilotDuplicate(
+		ctx, qtx, ap.WorkspaceID, ap.ID, ap.ProjectID, title, autopilotRecentDuplicateWindow,
+	); err != nil {
+		return fmt.Errorf("recent duplicate guard: %w", err)
+	} else if found {
+		return &errDispatchSkipped{reason: "recent duplicate autopilot issue: " + util.UUIDToString(duplicate.ID)}
+	}
+
 	issueNumber, err := qtx.IncrementIssueCounter(ctx, ap.WorkspaceID)
 	if err != nil {
 		return fmt.Errorf("increment issue counter: %w", err)
@@ -356,12 +367,11 @@ func (s *AutopilotService) dispatchCreateIssue(ctx context.Context, ap db.Autopi
 		}
 	}
 
-	if err := tx.Commit(ctx); err != nil {
-		return fmt.Errorf("commit tx: %w", err)
-	}
-
-	// Update run with the linked issue.
-	updatedRun, err := s.Queries.UpdateAutopilotRunIssueCreated(ctx, db.UpdateAutopilotRunIssueCreatedParams{
+	// Link the run inside the same tx as the issue insert. This makes the
+	// recent-duplicate guard count only fully observable autopilot issues and
+	// avoids a crash window where recovery would see an orphan issue but no
+	// linked run.
+	updatedRun, err := qtx.UpdateAutopilotRunIssueCreated(ctx, db.UpdateAutopilotRunIssueCreatedParams{
 		ID:      run.ID,
 		IssueID: issue.ID,
 	})
@@ -370,6 +380,10 @@ func (s *AutopilotService) dispatchCreateIssue(ctx context.Context, ap db.Autopi
 	}
 	*run = updatedRun
 
+	if err := tx.Commit(ctx); err != nil {
+		return fmt.Errorf("commit tx: %w", err)
+	}
+
 	// Publish issue:created so the existing event chain fires
 	// (subscriber listeners, activity listeners, notification listeners). For
 	// squad autopilots, this is what triggers shouldEnqueueSquadLeaderOnAssign
@@ -1381,6 +1395,7 @@ func (s *AutopilotService) getIssuePrefix(workspaceID pgtype.UUID) string {
 //   - public_to agent -> workspace target admits any workspace-member creator
 //     (and agent-created autopilots as workspace principals); member target
 //     admits the matching creator; team targets are inert.
+//
 // Fail-closed on any lookup error.
 func (s *AutopilotService) canCreatorInvokeAgent(ctx context.Context, ap db.Autopilot, agent db.Agent) bool {
 	creatorID := util.UUIDToString(ap.CreatedByID)
diff --git a/server/pkg/db/generated/issue.sql.go b/server/pkg/db/generated/issue.sql.go
index 31a1a1a6030..71ae4b84603 100644
--- a/server/pkg/db/generated/issue.sql.go
+++ b/server/pkg/db/generated/issue.sql.go
@@ -460,6 +460,73 @@ func (q *Queries) FindActiveDuplicateIssue(ctx context.Context, arg FindActiveDu
 	return i, err
 }
 
+const findRecentAutopilotDuplicateIssue = `-- name: FindRecentAutopilotDuplicateIssue :one
+SELECT i.id, i.workspace_id, i.title, i.description, i.status, i.priority, i.assignee_type, i.assignee_id, i.creator_type, i.creator_id, i.parent_issue_id, i.acceptance_criteria, i.context_refs, i.position, i.due_date, i.created_at, i.updated_at, i.number, i.project_id, i.origin_type, i.origin_id, i.first_executed_at, i.start_date, i.metadata, i.stage FROM issue i
+WHERE i.workspace_id = $1
+  AND i.status NOT IN ('done', 'cancelled')
+  AND i.origin_type = 'autopilot'
+  AND i.origin_id = $2
+  AND i.project_id IS NOT DISTINCT FROM $3::uuid
+  AND lower(btrim(regexp_replace(i.title, '[[:space:]]+', ' ', 'g'))) = $4
+  AND i.created_at >= $5::timestamptz
+  AND EXISTS (
+    SELECT 1
+    FROM autopilot_run r
+    WHERE r.issue_id = i.id
+      AND r.autopilot_id = i.origin_id
+      AND r.status IN ('issue_created', 'running', 'completed')
+  )
+ORDER BY i.created_at ASC
+LIMIT 1
+`
+
+type FindRecentAutopilotDuplicateIssueParams struct {
+	WorkspaceID     pgtype.UUID        `json:"workspace_id"`
+	OriginID        pgtype.UUID        `json:"origin_id"`
+	ProjectID       pgtype.UUID        `json:"project_id"`
+	NormalizedTitle string             `json:"normalized_title"`
+	CreatedAfter    pgtype.Timestamptz `json:"created_after"`
+}
+
+func (q *Queries) FindRecentAutopilotDuplicateIssue(ctx context.Context, arg FindRecentAutopilotDuplicateIssueParams) (Issue, error) {
+	row := q.db.QueryRow(ctx, findRecentAutopilotDuplicateIssue,
+		arg.WorkspaceID,
+		arg.OriginID,
+		arg.ProjectID,
+		arg.NormalizedTitle,
+		arg.CreatedAfter,
+	)
+	var i Issue
+	err := row.Scan(
+		&i.ID,
+		&i.WorkspaceID,
+		&i.Title,
+		&i.Description,
+		&i.Status,
+		&i.Priority,
+		&i.AssigneeType,
+		&i.AssigneeID,
+		&i.CreatorType,
+		&i.CreatorID,
+		&i.ParentIssueID,
+		&i.AcceptanceCriteria,
+		&i.ContextRefs,
+		&i.Position,
+		&i.DueDate,
+		&i.CreatedAt,
+		&i.UpdatedAt,
+		&i.Number,
+		&i.ProjectID,
+		&i.OriginType,
+		&i.OriginID,
+		&i.FirstExecutedAt,
+		&i.StartDate,
+		&i.Metadata,
+		&i.Stage,
+	)
+	return i, err
+}
+
 const getIssue = `-- name: GetIssue :one
 SELECT id, workspace_id, title, description, status, priority, assignee_type, assignee_id, creator_type, creator_id, parent_issue_id, acceptance_criteria, context_refs, position, due_date, created_at, updated_at, number, project_id, origin_type, origin_id, first_executed_at, start_date, metadata, stage FROM issue
 WHERE id = $1
diff --git a/server/pkg/db/queries/issue.sql b/server/pkg/db/queries/issue.sql
index 5e2146bac5e..1ae6c1c4be6 100644
--- a/server/pkg/db/queries/issue.sql
+++ b/server/pkg/db/queries/issue.sql
@@ -134,6 +134,25 @@ WHERE workspace_id = $1
 ORDER BY created_at ASC
 LIMIT 1;
 
+-- name: FindRecentAutopilotDuplicateIssue :one
+SELECT i.* FROM issue i
+WHERE i.workspace_id = $1
+  AND i.status NOT IN ('done', 'cancelled')
+  AND i.origin_type = 'autopilot'
+  AND i.origin_id = $2
+  AND i.project_id IS NOT DISTINCT FROM sqlc.arg('project_id')::uuid
+  AND lower(btrim(regexp_replace(i.title, '[[:space:]]+', ' ', 'g'))) = sqlc.arg('normalized_title')
+  AND i.created_at >= sqlc.arg('created_after')::timestamptz
+  AND EXISTS (
+    SELECT 1
+    FROM autopilot_run r
+    WHERE r.issue_id = i.id
+      AND r.autopilot_id = i.origin_id
+      AND r.status IN ('issue_created', 'running', 'completed')
+  )
+ORDER BY i.created_at ASC
+LIMIT 1;
+
 -- name: DeleteIssue :exec
 -- Defense-in-depth: the workspace_id predicate makes the tenant invariant a
 -- SQL-layer guarantee rather than a handler-layer one. Handler loaders

From 346f818206ea18da2a8f5394d2e1c22a4aee1a24 Mon Sep 17 00:00:00 2001
From: Bohan Jiang <52446949+Bohan-J@users.noreply.github.com>
Date: Mon, 6 Jul 2026 15:03:17 +0800
Subject: [PATCH 05/15] fix(runtime): add traecli to custom runtime profile
 whitelist (#4972)

Trae (traecli) already has a New() backend, launch header (traecli acp
serve) and provider branding, but was missing from every protocol_family
whitelist, so custom runtime profiles based on Trae were rejected and it
never appeared in the family picker.

Add traecli to SupportedTypes (Go), RUNTIME_PROFILE_PROTOCOL_FAMILIES
(TS), the lockstep test's want map, and a new migration 136 widening the
runtime_profile_protocol_family_check constraint.

MUL-4094, #4945

Co-authored-by: J <j@multica.ai>
Co-authored-by: multica-agent <github@multica.ai>
---
 packages/core/types/agent.ts                  |  1 +
 .../136_runtime_profile_add_traecli.down.sql  | 20 +++++++++++++++
 .../136_runtime_profile_add_traecli.up.sql    | 25 +++++++++++++++++++
 server/pkg/agent/agent.go                     | 12 ++++++---
 .../pkg/agent/agent_supported_types_test.go   |  2 +-
 5 files changed, 55 insertions(+), 5 deletions(-)
 create mode 100644 server/migrations/136_runtime_profile_add_traecli.down.sql
 create mode 100644 server/migrations/136_runtime_profile_add_traecli.up.sql

diff --git a/packages/core/types/agent.ts b/packages/core/types/agent.ts
index 58937541741..f7499249584 100644
--- a/packages/core/types/agent.ts
+++ b/packages/core/types/agent.ts
@@ -110,6 +110,7 @@ export const RUNTIME_PROFILE_PROTOCOL_FAMILIES = [
   "kiro",
   "antigravity",
   "qoder",
+  "traecli",
 ] as const;
 
 export type RuntimeProtocolFamily =
diff --git a/server/migrations/136_runtime_profile_add_traecli.down.sql b/server/migrations/136_runtime_profile_add_traecli.down.sql
new file mode 100644
index 00000000000..512047ba2bd
--- /dev/null
+++ b/server/migrations/136_runtime_profile_add_traecli.down.sql
@@ -0,0 +1,20 @@
+ALTER TABLE runtime_profile DROP CONSTRAINT IF EXISTS runtime_profile_protocol_family_check;
+
+-- Restore the pre-136 whitelist (migration 134 shape, without traecli). NOT VALID
+-- keeps the historical Gemini tolerance so the rollback cannot fail on old rows.
+ALTER TABLE runtime_profile ADD CONSTRAINT runtime_profile_protocol_family_check
+    CHECK (protocol_family IN (
+        'claude',
+        'codebuddy',
+        'codex',
+        'copilot',
+        'opencode',
+        'openclaw',
+        'hermes',
+        'pi',
+        'cursor',
+        'kimi',
+        'kiro',
+        'antigravity',
+        'qoder'
+    )) NOT VALID;
diff --git a/server/migrations/136_runtime_profile_add_traecli.up.sql b/server/migrations/136_runtime_profile_add_traecli.up.sql
new file mode 100644
index 00000000000..f375cb19313
--- /dev/null
+++ b/server/migrations/136_runtime_profile_add_traecli.up.sql
@@ -0,0 +1,25 @@
+ALTER TABLE runtime_profile DROP CONSTRAINT IF EXISTS runtime_profile_protocol_family_check;
+
+-- Widen the whitelist to include Trae (`traecli`). Trae already has a New()
+-- backend, launch header (`traecli acp serve`) and provider branding, but was
+-- missing from the protocol_family whitelist, so custom runtime profiles based
+-- on Trae were rejected and it never appeared in the family picker (#4945).
+-- NOT VALID mirrors migrations 126/134 so a historical Gemini row they
+-- intentionally tolerated does not block the upgrade.
+ALTER TABLE runtime_profile ADD CONSTRAINT runtime_profile_protocol_family_check
+    CHECK (protocol_family IN (
+        'claude',
+        'codebuddy',
+        'codex',
+        'copilot',
+        'opencode',
+        'openclaw',
+        'hermes',
+        'pi',
+        'cursor',
+        'kimi',
+        'kiro',
+        'antigravity',
+        'qoder',
+        'traecli'
+    )) NOT VALID;
diff --git a/server/pkg/agent/agent.go b/server/pkg/agent/agent.go
index 86d5584dfe2..f07a4a3f563 100644
--- a/server/pkg/agent/agent.go
+++ b/server/pkg/agent/agent.go
@@ -138,10 +138,13 @@ type Config struct {
 // SupportedTypes is the canonical whitelist of agent types eligible to back a
 // custom runtime profile. It MUST stay in lockstep with the
 // runtime_profile.protocol_family CHECK constraint (migration 120, widened by
-// migration 134 to add qoder): a custom runtime profile may only be based on a
-// backend Multica officially supports. qoder is exposed here so Qoder CN
-// (`qoderclicn`) users can point the Qoder backend at a non-default binary
-// instead of misrouting through Kiro/ACP with incompatible arguments (#4883).
+// migration 134 to add qoder and migration 136 to add traecli): a custom
+// runtime profile may only be based on a backend Multica officially supports.
+// qoder is exposed here so Qoder CN (`qoderclicn`) users can point the Qoder
+// backend at a non-default binary instead of misrouting through Kiro/ACP with
+// incompatible arguments (#4883). traecli (Trae) has a New backend, launch
+// header and provider branding but was previously missing from this whitelist,
+// so the family picker rejected it (#4945).
 var SupportedTypes = []string{
 	"claude",
 	"codebuddy",
@@ -156,6 +159,7 @@ var SupportedTypes = []string{
 	"kiro",
 	"antigravity",
 	"qoder",
+	"traecli",
 }
 
 // IsSupportedType reports whether agentType is in the SupportedTypes whitelist.
diff --git a/server/pkg/agent/agent_supported_types_test.go b/server/pkg/agent/agent_supported_types_test.go
index 4b1d54f6021..5e66013c956 100644
--- a/server/pkg/agent/agent_supported_types_test.go
+++ b/server/pkg/agent/agent_supported_types_test.go
@@ -40,7 +40,7 @@ func TestSupportedTypesMatchesMigrationWhitelist(t *testing.T) {
 		"claude": true, "codebuddy": true, "codex": true, "copilot": true,
 		"opencode": true, "openclaw": true, "hermes": true,
 		"pi": true, "cursor": true, "kimi": true, "kiro": true, "antigravity": true,
-		"qoder": true,
+		"qoder": true, "traecli": true,
 	}
 	if len(SupportedTypes) != len(want) {
 		t.Fatalf("SupportedTypes has %d entries, migration whitelist has %d; keep them in lockstep", len(SupportedTypes), len(want))

From a48b6f70ef2992e0960c2e6d8525b9668de80b1b Mon Sep 17 00:00:00 2001
From: Bohan Jiang <52446949+Bohan-J@users.noreply.github.com>
Date: Mon, 6 Jul 2026 15:11:41 +0800
Subject: [PATCH 06/15] fix(issues): replace nested "More" action submenu with
 "Relations" (MUL-3972) (#4847)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The issue action menu (3-dot / right-click) nested a "More" submenu inside the
already-open menu, so opening the menu surfaced yet another "More" — the first
level told you nothing about what was inside.

Rename that submenu to the semantically explicit "Relations" (关系 / 関係 / 관계)
with a Network icon, matching the noun-labelled pattern of the sibling submenus
(Status, Priority, Start date, Due date). Its contents are unchanged — create/add
sub-issue and set/remove parent — and stay grouped so future relation types
(blocks, duplicates, related) have a home.

- Rename i18n key actions.more -> actions.relations across en/zh-Hans/ja/ko
- Swap MoreHorizontal icon for Network
- Update the shared menu test

Co-authored-by: J <j@multica.ai>
Co-authored-by: multica-agent <github@multica.ai>
---
 .../actions/__tests__/issue-actions-menu.test.tsx    | 10 +++++-----
 .../issues/actions/issue-actions-menu-items.tsx      | 12 +++++++-----
 packages/views/locales/en/issues.json                |  2 +-
 packages/views/locales/ja/issues.json                |  2 +-
 packages/views/locales/ko/issues.json                |  2 +-
 packages/views/locales/zh-Hans/issues.json           |  2 +-
 6 files changed, 16 insertions(+), 14 deletions(-)

diff --git a/packages/views/issues/actions/__tests__/issue-actions-menu.test.tsx b/packages/views/issues/actions/__tests__/issue-actions-menu.test.tsx
index b30a905754e..684386cf766 100644
--- a/packages/views/issues/actions/__tests__/issue-actions-menu.test.tsx
+++ b/packages/views/issues/actions/__tests__/issue-actions-menu.test.tsx
@@ -163,9 +163,9 @@ describe("IssueActionsDropdown", () => {
     expect(screen.getByText("Assignee")).toBeInTheDocument();
     expect(screen.getByText("Due date")).toBeInTheDocument();
     expect(screen.getByText("Copy link")).toBeInTheDocument();
-    expect(screen.getByText("More")).toBeInTheDocument();
+    expect(screen.getByText("Relations")).toBeInTheDocument();
     expect(screen.getByText("Delete issue")).toBeInTheDocument();
-    // Relationship actions are hidden inside the "More" submenu by default.
+    // Relationship actions are hidden inside the "Relations" submenu by default.
     expect(screen.queryByText("Create sub-issue")).not.toBeInTheDocument();
     expect(screen.queryByText("Set parent issue...")).not.toBeInTheDocument();
     expect(screen.queryByText("Add sub-issue...")).not.toBeInTheDocument();
@@ -194,7 +194,7 @@ describe("IssueActionsDropdown", () => {
     expect(await screen.findByText("Test User")).toBeInTheDocument();
   });
 
-  it("shows 'Remove parent issue' in the More submenu only when the issue has a parent", async () => {
+  it("shows 'Remove parent issue' in the Relations submenu only when the issue has a parent", async () => {
     const childIssue = { ...mockIssue, parent_issue_id: "parent-1" } as Issue;
     render(
       wrap(
@@ -206,7 +206,7 @@ describe("IssueActionsDropdown", () => {
     );
 
     fireEvent.click(screen.getByTestId("trigger"));
-    fireEvent.click(await screen.findByText("More"));
+    fireEvent.click(await screen.findByText("Relations"));
 
     expect(await screen.findByText("Remove parent issue")).toBeInTheDocument();
   });
@@ -222,7 +222,7 @@ describe("IssueActionsDropdown", () => {
     );
 
     fireEvent.click(screen.getByTestId("trigger"));
-    fireEvent.click(await screen.findByText("More"));
+    fireEvent.click(await screen.findByText("Relations"));
 
     // The sibling "Set parent issue..." proves the submenu opened.
     expect(await screen.findByText("Set parent issue...")).toBeInTheDocument();
diff --git a/packages/views/issues/actions/issue-actions-menu-items.tsx b/packages/views/issues/actions/issue-actions-menu-items.tsx
index 1e6012cdd56..fe7a5396b66 100644
--- a/packages/views/issues/actions/issue-actions-menu-items.tsx
+++ b/packages/views/issues/actions/issue-actions-menu-items.tsx
@@ -10,7 +10,7 @@ import {
   CalendarClock,
   FolderOpen,
   Link2,
-  MoreHorizontal,
+  Network,
   Pin,
   PinOff,
   Plus,
@@ -270,12 +270,14 @@ export function IssueActionsMenuItems({
 
       <P.Separator />
 
-      {/* Relationship actions live under "More" — they're lower-frequency and
-          will grow (blocks, duplicates, related) as we add more relation types. */}
+      {/* Relationship actions live under "Relations" — a semantically explicit
+          label (unlike the old "More") so the first level tells you what the
+          submenu does. Holds parent/sub-issue links today, and will grow
+          (blocks, duplicates, related) as we add more relation types. */}
       <P.Sub>
         <P.SubTrigger>
-          <MoreHorizontal className="h-3.5 w-3.5" />
-          {t(($) => $.actions.more)}
+          <Network className="h-3.5 w-3.5" />
+          {t(($) => $.actions.relations)}
         </P.SubTrigger>
         <P.SubContent>
           <P.Item onClick={openCreateSubIssue}>
diff --git a/packages/views/locales/en/issues.json b/packages/views/locales/en/issues.json
index 0bef2071db1..3a441d989b5 100644
--- a/packages/views/locales/en/issues.json
+++ b/packages/views/locales/en/issues.json
@@ -432,7 +432,7 @@
     "unpin_from_sidebar": "Unpin from sidebar",
     "copy_link": "Copy link",
     "copy_workdir_path": "Copy local workdir path",
-    "more": "More",
+    "relations": "Relations",
     "create_sub_issue": "Create sub-issue",
     "set_parent_issue": "Set parent issue...",
     "remove_parent_issue": "Remove parent issue",
diff --git a/packages/views/locales/ja/issues.json b/packages/views/locales/ja/issues.json
index 5d6f53a8d5d..30fcaa7dd37 100644
--- a/packages/views/locales/ja/issues.json
+++ b/packages/views/locales/ja/issues.json
@@ -412,7 +412,7 @@
     "unpin_from_sidebar": "サイドバーのピン留めを解除",
     "copy_link": "リンクをコピー",
     "copy_workdir_path": "ローカルの作業ディレクトリのパスをコピー",
-    "more": "その他",
+    "relations": "関係",
     "create_sub_issue": "サブイシューを作成",
     "set_parent_issue": "親イシューを設定...",
     "remove_parent_issue": "親イシューを解除",
diff --git a/packages/views/locales/ko/issues.json b/packages/views/locales/ko/issues.json
index 3e38df83bb9..2ccb37d831e 100644
--- a/packages/views/locales/ko/issues.json
+++ b/packages/views/locales/ko/issues.json
@@ -412,7 +412,7 @@
     "unpin_from_sidebar": "사이드바 고정 해제",
     "copy_link": "링크 복사",
     "copy_workdir_path": "로컬 작업 디렉터리 경로 복사",
-    "more": "더 보기",
+    "relations": "관계",
     "create_sub_issue": "하위 이슈 만들기",
     "set_parent_issue": "상위 이슈 설정...",
     "remove_parent_issue": "상위 이슈 제거",
diff --git a/packages/views/locales/zh-Hans/issues.json b/packages/views/locales/zh-Hans/issues.json
index b1b853afc0d..afde482ab7d 100644
--- a/packages/views/locales/zh-Hans/issues.json
+++ b/packages/views/locales/zh-Hans/issues.json
@@ -412,7 +412,7 @@
     "unpin_from_sidebar": "从侧边栏取消固定",
     "copy_link": "复制链接",
     "copy_workdir_path": "复制本地 workdir 路径",
-    "more": "更多",
+    "relations": "关系",
     "create_sub_issue": "创建子 issue",
     "set_parent_issue": "设置父 issue...",
     "remove_parent_issue": "移除父 issue",

From e3de28ecd70f676cde9535e185f448f91ef05058 Mon Sep 17 00:00:00 2001
From: etern <jingxiaobing@gmail.com>
Date: Mon, 6 Jul 2026 15:34:22 +0800
Subject: [PATCH 07/15] fix(agent): pi agent final output excludes intermediate
 steps (#4894) (MUL-4030)

* fix(agent): pi agent final output excludes intermediate steps

Updated PI agent to only retain the final result in JSON output.

Previously, `text_delta` included both intermediate steps and final
content.

Now, output is reset on each `text_start` to concatenate only the
final text.

* fix(agent) Replace `message_update.text_start` with `turn_start` event. add test

`turn_start` begins a new turn, Reset output on it to exclude
intermediate texts.

https://github.com/earendil-works/pi/blob/a1b336d73e13b53949ff629800081185d3e4694e/packages/coding-agent/docs/rpc.md#events
---
 server/pkg/agent/pi.go      |  4 +++
 server/pkg/agent/pi_test.go | 66 +++++++++++++++++++++++++++++++++++++
 2 files changed, 70 insertions(+)

diff --git a/server/pkg/agent/pi.go b/server/pkg/agent/pi.go
index 93078585d95..f8284eccaa0 100644
--- a/server/pkg/agent/pi.go
+++ b/server/pkg/agent/pi.go
@@ -282,6 +282,10 @@ func (b *piBackend) Execute(ctx context.Context, prompt string, opts ExecOptions
 			case "agent_start":
 				trySend(msgCh, Message{Type: MessageStatus, Status: "running"})
 
+			case "turn_start":
+				output.Reset()
+				textBuffer.Reset()
+
 			case "message_update":
 				if evt.AssistantMessageEvent == nil {
 					continue
diff --git a/server/pkg/agent/pi_test.go b/server/pkg/agent/pi_test.go
index a8423d38e9e..e2f21c2e318 100644
--- a/server/pkg/agent/pi_test.go
+++ b/server/pkg/agent/pi_test.go
@@ -119,6 +119,72 @@ func TestPiExecuteAttachesStdinPipe(t *testing.T) {
 	}
 }
 
+// piEventStreamScript builds a sh script that prints each JSON event on
+// its own stdout line. Fixtures must not contain single quotes.
+func piEventStreamScript(events []string) string {
+	var b strings.Builder
+	b.WriteString("#!/bin/sh\n")
+	for _, e := range events {
+		b.WriteString("printf '%s\\n' '")
+		b.WriteString(e)
+		b.WriteString("'\n")
+	}
+	return b.String()
+}
+
+// TestPiExecuteRetainsOnlyLastTurnOutput verifies turn_start resets the
+// output buffer so Result.Output keeps only the final turn's text.
+func TestPiExecuteRetainsOnlyLastTurnOutput(t *testing.T) {
+	t.Parallel()
+	if runtime.GOOS == "windows" {
+		t.Skip("shell-script fixture is POSIX-only")
+	}
+
+	events := []string{
+		`{"type":"agent_start"}`,
+		`{"type":"turn_start"}`,
+		`{"type":"message_update","assistantMessageEvent":{"type":"text_delta","delta":"intermediate"}}`,
+		`{"type":"tool_execution_start","toolCallId":"call_1","toolName":"bash","args":{"command":"echo hi"}}`,
+		`{"type":"tool_execution_end","toolCallId":"call_1","toolName":"bash","result":{"content":[{"type":"text","text":"hi"}]},"isError":false}`,
+		`{"type":"turn_end","message":{"role":"assistant","model":"test","usage":{"input":1,"output":1}}}`,
+		`{"type":"turn_start"}`,
+		`{"type":"message_update","assistantMessageEvent":{"type":"text_delta","delta":"final"}}`,
+		`{"type":"message_update","assistantMessageEvent":{"type":"text_delta","delta":" "}}`,
+		`{"type":"message_update","assistantMessageEvent":{"type":"text_delta","delta":"answer"}}`,
+		`{"type":"turn_end","message":{"role":"assistant","model":"test","usage":{"input":2,"output":2}}}`,
+	}
+	fakePath := filepath.Join(t.TempDir(), "pi")
+	writeTestExecutable(t, fakePath, []byte(piEventStreamScript(events)))
+
+	backend, err := New("pi", Config{ExecutablePath: fakePath, Logger: slog.Default()})
+	if err != nil {
+		t.Fatalf("new pi backend: %v", err)
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+	session, err := backend.Execute(ctx, "prompt-ignored", ExecOptions{Timeout: 5 * time.Second})
+	if err != nil {
+		t.Fatalf("execute: %v", err)
+	}
+	go func() {
+		for range session.Messages {
+		}
+	}()
+
+	select {
+	case result := <-session.Result:
+		if result.Status != "completed" {
+			t.Fatalf("expected status=completed, got %q (error=%q)", result.Status, result.Error)
+		}
+		if result.Output != "final answer" {
+			t.Fatalf("Output: got %q, want %q", result.Output, "final answer")
+		}
+	case <-time.After(10 * time.Second):
+		t.Fatal("timeout waiting for result")
+	}
+}
+
 func TestStripPiToolCallMarkup(t *testing.T) {
 	tests := map[string]string{
 		`before call:bash{command:<|"|>cd repo/path && ls -F<|"|>}<tool_call|> after`:                           "before  after",

From 24f2923f2bb2b3cd3cfbb59905e815478a6dfb71 Mon Sep 17 00:00:00 2001
From: ZIce <39822906+vicksiyi@users.noreply.github.com>
Date: Mon, 6 Jul 2026 15:44:36 +0800
Subject: [PATCH 08/15] docs: list Qoder in runtime provider copy (#4952)

Update public docs and landing copy to the current 14-runtime list; add Qoder / Trae CLI across localized docs. Follow-up: finish JA tool counts (tasks.ja / skills.ja) and align localized Trae section anchors with the /providers#trae links.

Closes #4945

Co-authored-by: vicksiyi <zeroicework@163.com>
---
 apps/docs/content/docs/agents-create.ja.mdx   |  8 ++++----
 apps/docs/content/docs/agents-create.ko.mdx   |  8 ++++----
 apps/docs/content/docs/agents-create.mdx      |  4 ++--
 apps/docs/content/docs/agents-create.zh.mdx   |  8 ++++----
 .../docs/content/docs/cli/installation.zh.mdx | 10 ++++++++--
 apps/docs/content/docs/cli/reference.zh.mdx   | 16 +++++++++++++--
 .../docs/content/docs/cloud-quickstart.ja.mdx |  4 ++--
 .../docs/content/docs/cloud-quickstart.ko.mdx |  4 ++--
 apps/docs/content/docs/cloud-quickstart.mdx   |  2 +-
 .../docs/content/docs/cloud-quickstart.zh.mdx |  4 ++--
 apps/docs/content/docs/daemon-runtimes.ja.mdx |  4 ++--
 apps/docs/content/docs/daemon-runtimes.ko.mdx |  2 +-
 apps/docs/content/docs/daemon-runtimes.zh.mdx |  4 ++--
 .../getting-started/cloud-quickstart.zh.mdx   |  6 +++---
 .../docs/getting-started/self-hosting.zh.mdx  | 20 ++++++++++++++++---
 apps/docs/content/docs/guides/agents.zh.mdx   | 12 +++++++++--
 .../content/docs/guides/quickstart.zh.mdx     |  4 ++--
 .../content/docs/how-multica-works.ja.mdx     |  2 +-
 .../content/docs/how-multica-works.ko.mdx     |  2 +-
 apps/docs/content/docs/how-multica-works.mdx  |  2 +-
 .../content/docs/how-multica-works.zh.mdx     |  2 +-
 apps/docs/content/docs/index.ja.mdx           |  2 +-
 apps/docs/content/docs/index.ko.mdx           |  2 +-
 apps/docs/content/docs/index.mdx              |  2 +-
 apps/docs/content/docs/index.zh.mdx           |  2 +-
 .../content/docs/install-agent-runtime.ja.mdx | 18 +++++++++++++----
 .../content/docs/install-agent-runtime.ko.mdx | 18 +++++++++++++----
 .../content/docs/install-agent-runtime.zh.mdx | 18 +++++++++++++----
 apps/docs/content/docs/providers.ja.mdx       | 16 ++++++++++-----
 apps/docs/content/docs/providers.ko.mdx       | 16 ++++++++++-----
 apps/docs/content/docs/providers.zh.mdx       | 14 +++++++++----
 apps/docs/content/docs/skills.ja.mdx          |  2 +-
 apps/docs/content/docs/skills.ko.mdx          |  2 +-
 apps/docs/content/docs/skills.zh.mdx          |  2 +-
 apps/docs/content/docs/tasks.ja.mdx           |  2 +-
 apps/docs/content/docs/tasks.ko.mdx           |  2 +-
 apps/docs/content/docs/tasks.zh.mdx           |  2 +-
 apps/web/features/landing/i18n/en.ts          |  8 ++++----
 apps/web/features/landing/i18n/ja.ts          |  6 +++---
 apps/web/features/landing/i18n/ko.ts          |  4 ++--
 apps/web/features/landing/i18n/zh.ts          |  8 ++++----
 41 files changed, 181 insertions(+), 93 deletions(-)

diff --git a/apps/docs/content/docs/agents-create.ja.mdx b/apps/docs/content/docs/agents-create.ja.mdx
index bf56dcb7048..a2e4a60b024 100644
--- a/apps/docs/content/docs/agents-create.ja.mdx
+++ b/apps/docs/content/docs/agents-create.ja.mdx
@@ -21,7 +21,7 @@ multica agent create
 
 ## AI コーディングツールを選ぶ
 
-各ランタイムは特定の AI コーディングツールを基盤としています。Multica はそのうち 12 個をサポートします。最も一般的な選択肢は次のとおりです。
+各ランタイムは特定の AI コーディングツールを基盤としています。Multica はそのうち 14 個をサポートします。最も一般的な選択肢は次のとおりです。
 
 | ツール | 適している場合 |
 |---|---|
@@ -29,9 +29,9 @@ multica agent create
 | **Codex** | OpenAI 製で、主流の代替手段です |
 | **Cursor** | Cursor エディターのエコシステムを使うユーザー |
 | **Copilot** | GitHub アカウントの権限を活用するチーム |
-| **Gemini** | Google エコシステムのユーザー |
+| **CodeBuddy** | Tencent の Claude Code 互換 CLI を使うチーム |
 
-残りの 7 個（Antigravity、Hermes、Kimi、Kiro CLI、OpenCode、Pi、OpenClaw）と、各ツールの完全な機能比較表（セッション再開、MCP、スキル注入パス、モデル選択）は、[AI コーディングツール比較](/providers)で扱います。
+残りの 9 個（Antigravity、Hermes、Kimi、Kiro CLI、OpenCode、Pi、OpenClaw、Qoder、Trae CLI）と、各ツールの完全な機能比較表（セッション再開、MCP、スキル注入パス、モデル選択）は、[AI コーディングツール比較](/providers)で扱います。
 
 ## システム指示を書く
 
@@ -123,5 +123,5 @@ claude --model <model> --max-turns 100 --append-system-prompt "always respond in
 ## 次のステップ
 
 - [スキル](/skills) — エージェントにナレッジパックをアタッチする
-- [AI コーディングツール比較](/providers) — 12 個のツール全体の機能比較表
+- [AI コーディングツール比較](/providers) — 14 個のツール全体の機能比較表
 - [エージェントへのイシューの割り当て](/assigning-issues) — 新しく作ったエージェントを作業に投入する
diff --git a/apps/docs/content/docs/agents-create.ko.mdx b/apps/docs/content/docs/agents-create.ko.mdx
index 7762a93d57d..ecafce37fda 100644
--- a/apps/docs/content/docs/agents-create.ko.mdx
+++ b/apps/docs/content/docs/agents-create.ko.mdx
@@ -21,7 +21,7 @@ multica agent create
 
 ## AI 코딩 도구 선택
 
-각 런타임은 특정 AI 코딩 도구를 기반으로 합니다. Multica는 그중 12개를 지원합니다. 가장 일반적인 선택지는 다음과 같습니다.
+각 런타임은 특정 AI 코딩 도구를 기반으로 합니다. Multica는 그중 14개를 지원합니다. 가장 일반적인 선택지는 다음과 같습니다.
 
 | 도구 | 적합한 경우 |
 |---|---|
@@ -29,9 +29,9 @@ multica agent create
 | **Codex** | OpenAI 제품으로, 주류 대안입니다 |
 | **Cursor** | Cursor 에디터 생태계 사용자 |
 | **Copilot** | GitHub 계정 권한을 활용하는 팀 |
-| **Gemini** | Google 생태계 사용자 |
+| **CodeBuddy** | Tencent의 Claude Code 호환 CLI를 사용하는 팀 |
 
-나머지 7개(Antigravity, Hermes, Kimi, Kiro CLI, OpenCode, Pi, OpenClaw)와 각 도구의 전체 기능 비교표(세션 재개, MCP, 스킬 주입 경로, 모델 선택)는 [AI 코딩 도구 비교](/providers)에서 다룹니다.
+나머지 9개(Antigravity, Hermes, Kimi, Kiro CLI, OpenCode, Pi, OpenClaw, Qoder, Trae CLI)와 각 도구의 전체 기능 비교표(세션 재개, MCP, 스킬 주입 경로, 모델 선택)는 [AI 코딩 도구 비교](/providers)에서 다룹니다.
 
 ## 시스템 지침 작성
 
@@ -123,5 +123,5 @@ claude --model <model> --max-turns 100 --append-system-prompt "always respond in
 ## 다음 단계
 
 - [스킬](/skills) — 에이전트에 지식 팩 연결하기
-- [AI 코딩 도구 비교](/providers) — 12개 도구 전체의 기능 비교표
+- [AI 코딩 도구 비교](/providers) — 14개 도구 전체의 기능 비교표
 - [에이전트에게 이슈 할당하기](/assigning-issues) — 새로 만든 에이전트를 작업에 투입하기
diff --git a/apps/docs/content/docs/agents-create.mdx b/apps/docs/content/docs/agents-create.mdx
index 0e878738607..8ba73445a05 100644
--- a/apps/docs/content/docs/agents-create.mdx
+++ b/apps/docs/content/docs/agents-create.mdx
@@ -29,9 +29,9 @@ Each runtime is backed by a specific AI coding tool. Multica supports 14 of them
 | **Codex** | OpenAI, the mainstream alternative |
 | **Cursor** | Users in the Cursor editor ecosystem |
 | **Copilot** | Teams leveraging their GitHub account entitlements |
-| **Gemini** | Users in the Google ecosystem |
+| **CodeBuddy** | Teams using Tencent's Claude Code-compatible CLI |
 
-The other seven (Antigravity, Hermes, Kimi, Kiro CLI, OpenCode, Pi, OpenClaw), along with each tool's full capability matrix (session resume, MCP, skill injection path, model selection), are covered in [AI coding tools comparison](/providers).
+The other nine (Antigravity, Hermes, Kimi, Kiro CLI, OpenCode, Pi, OpenClaw, Qoder, Trae CLI), along with each tool's full capability matrix (session resume, MCP, skill injection path, model selection), are covered in [AI coding tools comparison](/providers).
 
 ## Writing system instructions
 
diff --git a/apps/docs/content/docs/agents-create.zh.mdx b/apps/docs/content/docs/agents-create.zh.mdx
index 857397971fa..ce850396530 100644
--- a/apps/docs/content/docs/agents-create.zh.mdx
+++ b/apps/docs/content/docs/agents-create.zh.mdx
@@ -21,7 +21,7 @@ multica agent create
 
 ## 选一款 AI 编程工具
 
-运行时背后是一款具体的 AI 编程工具。Multica 支持 12 款，最常用的几款：
+运行时背后是一款具体的 AI 编程工具。Multica 支持 14 款，最常用的几款：
 
 | 工具 | 适合 |
 |---|---|
@@ -29,9 +29,9 @@ multica agent create
 | **Codex** | OpenAI，主流替代 |
 | **Cursor** | Cursor 编辑器生态用户 |
 | **Copilot** | 用 GitHub 账号权益的团队 |
-| **Gemini** | Google 生态用户 |
+| **CodeBuddy** | 使用 Tencent Claude Code 兼容 CLI 的团队 |
 
-另外 7 款（Antigravity、Hermes、Kimi、Kiro CLI、OpenCode、Pi、OpenClaw）以及每款工具的完整能力差别（会话恢复、MCP、skill 注入路径、模型选择）见 [AI 编程工具对照](/providers)。
+另外 9 款（Antigravity、Hermes、Kimi、Kiro CLI、OpenCode、Pi、OpenClaw、Qoder、Trae CLI）以及每款工具的完整能力差别（会话恢复、MCP、skill 注入路径、模型选择）见 [AI 编程工具对照](/providers)。
 
 ## 写系统指令
 
@@ -123,5 +123,5 @@ claude --model <model> --max-turns 100 --append-system-prompt "always respond in
 ## 下一步
 
 - [Skills](/skills) —— 给智能体挂专业知识包
-- [AI 编程工具对照](/providers) —— 12 款工具的完整能力差别
+- [AI 编程工具对照](/providers) —— 14 款工具的完整能力差别
 - [把 issue 分配给智能体](/assigning-issues) —— 创建完之后怎么用起来
diff --git a/apps/docs/content/docs/cli/installation.zh.mdx b/apps/docs/content/docs/cli/installation.zh.mdx
index 81ae5bbada8..eeaf0f6a87b 100644
--- a/apps/docs/content/docs/cli/installation.zh.mdx
+++ b/apps/docs/content/docs/cli/installation.zh.mdx
@@ -78,18 +78,24 @@ multica daemon status
 
 Confirm:
 1. Status is `running`
-2. At least one agent is listed (e.g. `claude`, `codex`, `gemini`, `opencode`, `openclaw`, `hermes`, `kiro`, or `pi`)
+2. At least one agent is listed (e.g. `claude`, `codex`, `codebuddy`, `opencode`, `openclaw`, `hermes`, `kiro-cli`, `qodercli`, or `traecli`)
 3. At least one workspace is being watched
 
 If the agents list is empty, install at least one supported AI agent CLI:
 - [Claude Code](https://docs.anthropic.com/en/docs/claude-code) (`claude`)
+- Antigravity (`agy`)
+- CodeBuddy (`codebuddy`)
 - [Codex](https://github.com/openai/codex) (`codex`)
-- [Gemini CLI](https://github.com/google-gemini/gemini-cli) (`gemini`)
+- Copilot (`copilot`)
+- Cursor Agent (`cursor-agent`)
 - OpenCode (`opencode`)
 - OpenClaw (`openclaw`)
 - Hermes (`hermes`)
 - Kimi (`kimi`)
 - Kiro CLI (`kiro-cli`)
+- Pi (`pi`)
+- Qoder (`qodercli`)
+- Trae CLI (`traecli`)
 
 Then restart the daemon:
 
diff --git a/apps/docs/content/docs/cli/reference.zh.mdx b/apps/docs/content/docs/cli/reference.zh.mdx
index 7bc069ba6ab..542581975e9 100644
--- a/apps/docs/content/docs/cli/reference.zh.mdx
+++ b/apps/docs/content/docs/cli/reference.zh.mdx
@@ -87,15 +87,19 @@ The daemon auto-detects these AI CLIs on your PATH:
 | CLI | Command | Description |
 |-----|---------|-------------|
 | [Claude Code](https://docs.anthropic.com/en/docs/claude-code) | `claude` | Anthropic's coding agent |
+| Antigravity | `agy` | Google's coding agent |
+| CodeBuddy | `codebuddy` | Tencent's Claude Code-compatible coding agent |
 | [Codex](https://github.com/openai/codex) | `codex` | OpenAI's coding agent |
-| [Gemini CLI](https://github.com/google-gemini/gemini-cli) | `gemini` | Google's coding agent |
+| Copilot | `copilot` | GitHub's coding agent |
+| Cursor Agent | `cursor-agent` | Cursor coding agent |
 | OpenCode | `opencode` | Open-source coding agent |
 | OpenClaw | `openclaw` | Open-source coding agent |
 | Hermes | `hermes` | Nous Research coding agent |
 | Kimi | `kimi` | Moonshot coding agent |
 | Kiro CLI | `kiro-cli` | Kiro ACP coding agent |
 | Pi | `pi` | Inflection coding agent |
-| Cursor Agent | `cursor-agent` | Cursor coding agent |
+| Qoder | `qodercli` | Alibaba coding agent |
+| Trae CLI | `traecli` | ByteDance coding agent |
 
 You need at least one installed. The daemon registers each detected CLI as an available runtime.
 
@@ -130,6 +134,10 @@ Agent-specific overrides:
 | `MULTICA_CLAUDE_MODEL` | Override the Claude model used |
 | `MULTICA_CODEX_PATH` | Custom path to the `codex` binary |
 | `MULTICA_CODEX_MODEL` | Override the Codex model used |
+| `MULTICA_CODEBUDDY_PATH` | Custom path to the `codebuddy` binary |
+| `MULTICA_CODEBUDDY_MODEL` | Override the CodeBuddy model used |
+| `MULTICA_ANTIGRAVITY_PATH` | Custom path to the `agy` binary |
+| `MULTICA_ANTIGRAVITY_MODEL` | Override the Antigravity model used |
 | `MULTICA_OPENCODE_PATH` | Custom path to the `opencode` binary |
 | `MULTICA_OPENCODE_MODEL` | Override the OpenCode model used |
 | `MULTICA_OPENCLAW_PATH` | Custom path to the `openclaw` binary |
@@ -146,6 +154,10 @@ Agent-specific overrides:
 | `MULTICA_KIMI_MODEL` | Override the Kimi model used |
 | `MULTICA_KIRO_PATH` | Custom path to the `kiro-cli` binary |
 | `MULTICA_KIRO_MODEL` | Override the Kiro model used |
+| `MULTICA_QODER_PATH` | Custom path to the `qodercli` binary |
+| `MULTICA_QODER_MODEL` | Override the Qoder model used |
+| `MULTICA_TRAECLI_PATH` | Custom path to the `traecli` binary |
+| `MULTICA_TRAECLI_MODEL` | Override the Trae CLI model used |
 
 ### Self-Hosted Server
 
diff --git a/apps/docs/content/docs/cloud-quickstart.ja.mdx b/apps/docs/content/docs/cloud-quickstart.ja.mdx
index b81869b21d8..39f1ce668de 100644
--- a/apps/docs/content/docs/cloud-quickstart.ja.mdx
+++ b/apps/docs/content/docs/cloud-quickstart.ja.mdx
@@ -7,7 +7,7 @@ import { Callout } from "fumadocs-ui/components/callout";
 
 このページは Multica Cloud を最初から最後まで案内します — **サインアップ → [CLI](/cli) のインストール → [デーモン](/daemon-runtimes)の起動 → [エージェント](/agents)の作成 → 最初の[タスク](/tasks)の割り当て**。約 5 分かかります。
 
-前提条件は 1 つだけです: ローカルに [AI コーディングツール](/providers)（[Antigravity](/providers#antigravity)、[Claude Code](/providers#claude-code)、[CodeBuddy](/providers#codebuddy)、[Codex](/providers#codex)、[Cursor](/providers#cursor)、[Copilot](/providers#copilot)、[Hermes](/providers#hermes)、[Kimi](/providers#kimi)、[Kiro CLI](/providers#kiro-cli)、[OpenCode](/providers#opencode)、[OpenClaw](/providers#openclaw)、[Pi](/providers#pi) のいずれか）を少なくとも 1 つ、すでにインストールしておくこと。デーモンは起動時にこれらを自動検出し、1 つもなければ起動を拒否します。
+前提条件は 1 つだけです: ローカルに [AI コーディングツール](/providers)（[Antigravity](/providers#antigravity)、[Claude Code](/providers#claude-code)、[CodeBuddy](/providers#codebuddy)、[Codex](/providers#codex)、[Cursor](/providers#cursor)、[Copilot](/providers#copilot)、[Hermes](/providers#hermes)、[Kimi](/providers#kimi)、[Kiro CLI](/providers#kiro-cli)、[OpenCode](/providers#opencode)、[OpenClaw](/providers#openclaw)、[Pi](/providers#pi)、[Qoder](/providers#qoder)、[Trae CLI](/providers#trae) のいずれか）を少なくとも 1 つ、すでにインストールしておくこと。デーモンは起動時にこれらを自動検出し、1 つもなければ起動を拒否します。
 
 ## 1. アカウントを作成する
 
@@ -114,6 +114,6 @@ Web UI は**リアルタイムで**（WebSocket を通じて）更新されま
 
 - [デーモンとランタイム](/daemon-runtimes) — デーモンがどう動作するかとランタイムの意味
 - [タスク](/tasks) — タスクのライフサイクルとリトライルール
-- [AI コーディングツール比較](/providers) — 12 個のツール間の機能差
+- [AI コーディングツール比較](/providers) — 14 個のツール間の機能差
 - [デスクトップアプリ](/desktop-app) — デーモンを自分で実行したくない場合
 - [セルフホストクイックスタート](/self-host-quickstart) — 自前のバックエンドを実行する
diff --git a/apps/docs/content/docs/cloud-quickstart.ko.mdx b/apps/docs/content/docs/cloud-quickstart.ko.mdx
index cf2f9741bc1..ae5f169fb53 100644
--- a/apps/docs/content/docs/cloud-quickstart.ko.mdx
+++ b/apps/docs/content/docs/cloud-quickstart.ko.mdx
@@ -7,7 +7,7 @@ import { Callout } from "fumadocs-ui/components/callout";
 
 이 페이지는 Multica Cloud를 처음부터 끝까지 안내합니다 — **가입 → [CLI](/cli) 설치 → [데몬](/daemon-runtimes) 시작 → [에이전트](/agents) 생성 → 첫 [작업](/tasks) 할당**. 약 5분이 걸립니다.
 
-전제 조건은 하나뿐입니다: 로컬에 [AI 코딩 도구](/providers)([Antigravity](/providers#antigravity), [Claude Code](/providers#claude-code), [CodeBuddy](/providers#codebuddy), [Codex](/providers#codex), [Cursor](/providers#cursor), [Copilot](/providers#copilot), [Hermes](/providers#hermes), [Kimi](/providers#kimi), [Kiro CLI](/providers#kiro-cli), [OpenCode](/providers#opencode), [OpenClaw](/providers#openclaw), [Pi](/providers#pi) 중 하나)를 이미 최소 하나는 설치해 두어야 합니다. 데몬은 시작할 때 이들을 자동으로 감지하며, 하나도 없으면 시작을 거부합니다.
+전제 조건은 하나뿐입니다: 로컬에 [AI 코딩 도구](/providers)([Antigravity](/providers#antigravity), [Claude Code](/providers#claude-code), [CodeBuddy](/providers#codebuddy), [Codex](/providers#codex), [Cursor](/providers#cursor), [Copilot](/providers#copilot), [Hermes](/providers#hermes), [Kimi](/providers#kimi), [Kiro CLI](/providers#kiro-cli), [OpenCode](/providers#opencode), [OpenClaw](/providers#openclaw), [Pi](/providers#pi), [Qoder](/providers#qoder), [Trae CLI](/providers#trae) 중 하나)를 이미 최소 하나는 설치해 두어야 합니다. 데몬은 시작할 때 이들을 자동으로 감지하며, 하나도 없으면 시작을 거부합니다.
 
 ## 1. 계정 만들기
 
@@ -114,6 +114,6 @@ multica issue assign MUL-1 --to my-agent-name
 
 - [데몬과 런타임](/daemon-runtimes) — 데몬이 어떻게 동작하는지와 런타임의 의미
 - [작업](/tasks) — 작업 생명주기와 재시도 규칙
-- [AI 코딩 도구 비교](/providers) — 12개 도구 간의 기능 차이
+- [AI 코딩 도구 비교](/providers) — 14개 도구 간의 기능 차이
 - [데스크톱 앱](/desktop-app) — 데몬을 직접 실행하고 싶지 않은 경우
 - [자체 호스팅 빠른 시작](/self-host-quickstart) — 자체 백엔드 실행하기
diff --git a/apps/docs/content/docs/cloud-quickstart.mdx b/apps/docs/content/docs/cloud-quickstart.mdx
index a32d38a9631..c9411dee69c 100644
--- a/apps/docs/content/docs/cloud-quickstart.mdx
+++ b/apps/docs/content/docs/cloud-quickstart.mdx
@@ -7,7 +7,7 @@ import { Callout } from "fumadocs-ui/components/callout";
 
 This page walks you end-to-end through Multica Cloud — **sign up → install the [CLI](/cli) → start the [daemon](/daemon-runtimes) → create an [agent](/agents) → assign your first [task](/tasks)**. Takes about 5 minutes.
 
-One prerequisite: you already have at least one [AI coding tool](/providers) installed locally ([Antigravity](/providers#antigravity), [Claude Code](/providers#claude-code), [CodeBuddy](/providers#codebuddy), [Codex](/providers#codex), [Cursor](/providers#cursor), [Copilot](/providers#copilot), [Hermes](/providers#hermes), [Kimi](/providers#kimi), [Kiro CLI](/providers#kiro-cli), [OpenCode](/providers#opencode), [OpenClaw](/providers#openclaw), or [Pi](/providers#pi)). The daemon auto-detects them on startup and refuses to start if none are present.
+One prerequisite: you already have at least one [AI coding tool](/providers) installed locally ([Antigravity](/providers#antigravity), [Claude Code](/providers#claude-code), [CodeBuddy](/providers#codebuddy), [Codex](/providers#codex), [Cursor](/providers#cursor), [Copilot](/providers#copilot), [Hermes](/providers#hermes), [Kimi](/providers#kimi), [Kiro CLI](/providers#kiro-cli), [OpenCode](/providers#opencode), [OpenClaw](/providers#openclaw), [Pi](/providers#pi), [Qoder](/providers#qoder), or [Trae CLI](/providers#trae)). The daemon auto-detects them on startup and refuses to start if none are present.
 
 ## 1. Create an account
 
diff --git a/apps/docs/content/docs/cloud-quickstart.zh.mdx b/apps/docs/content/docs/cloud-quickstart.zh.mdx
index 5a9bac68ab1..55eaa3675dc 100644
--- a/apps/docs/content/docs/cloud-quickstart.zh.mdx
+++ b/apps/docs/content/docs/cloud-quickstart.zh.mdx
@@ -7,7 +7,7 @@ import { Callout } from "fumadocs-ui/components/callout";
 
 这一页带你走一遍 Multica Cloud 的端到端流程——**注册 → 装 [命令行工具](/cli) → 启动 [守护进程](/daemon-runtimes) → 创建 [智能体](/agents) → 分配第一个 [任务](/tasks)**，约 5 分钟完成。
 
-前置只有一个：你本地已经装了至少一款 [AI 编程工具](/providers)（[Antigravity](/providers#antigravity)、[Claude Code](/providers#claude-code)、[CodeBuddy](/providers#codebuddy)、[Codex](/providers#codex)、[Cursor](/providers#cursor)、[Copilot](/providers#copilot)、[Hermes](/providers#hermes)、[Kimi](/providers#kimi)、[Kiro CLI](/providers#kiro-cli)、[OpenCode](/providers#opencode)、[OpenClaw](/providers#openclaw)、[Pi](/providers#pi)）中的一款。守护进程启动时会自动探测它们，没装任何一个的话守护进程会直接拒绝启动。
+前置只有一个：你本地已经装了至少一款 [AI 编程工具](/providers)（[Antigravity](/providers#antigravity)、[Claude Code](/providers#claude-code)、[CodeBuddy](/providers#codebuddy)、[Codex](/providers#codex)、[Cursor](/providers#cursor)、[Copilot](/providers#copilot)、[Hermes](/providers#hermes)、[Kimi](/providers#kimi)、[Kiro CLI](/providers#kiro-cli)、[OpenCode](/providers#opencode)、[OpenClaw](/providers#openclaw)、[Pi](/providers#pi)、[Qoder](/providers#qoder) 或 [Trae CLI](/providers#trae)）中的一款。守护进程启动时会自动探测它们，没装任何一个的话守护进程会直接拒绝启动。
 
 ## 1. 注册账号
 
@@ -114,6 +114,6 @@ Web 界面会**实时**（通过 WebSocket）显示进度——不需要刷新
 
 - [守护进程与运行时](/daemon-runtimes) —— 守护进程怎么运作、运行时概念
 - [执行任务](/tasks) —— 任务生命周期、重试规则
-- [AI 编程工具对照](/providers) —— 12 款工具的能力差异
+- [AI 编程工具对照](/providers) —— 14 款工具的能力差异
 - [桌面应用](/desktop-app) —— 不想自己跑守护进程的话
 - [Self-Host 快速上手](/self-host-quickstart) —— 在自己服务器上跑一套
diff --git a/apps/docs/content/docs/daemon-runtimes.ja.mdx b/apps/docs/content/docs/daemon-runtimes.ja.mdx
index a0010b37069..2c2b7493122 100644
--- a/apps/docs/content/docs/daemon-runtimes.ja.mdx
+++ b/apps/docs/content/docs/daemon-runtimes.ja.mdx
@@ -21,7 +21,7 @@ multica daemon start
 起動時にデーモンは 4 つのことを行います。
 
 1. ログイン時に保存された認証情報を読み込みます
-2. `PATH` にインストールされた AI コーディングツールを検出します（内蔵 12 種: [Antigravity](/providers#antigravity)、[Claude Code](/providers#claude-code)、[CodeBuddy](/providers#codebuddy)、[Codex](/providers#codex)、[Cursor](/providers#cursor)、[Copilot](/providers#copilot)、[Hermes](/providers#hermes)、[Kimi](/providers#kimi)、[Kiro CLI](/providers#kiro-cli)、[OpenCode](/providers#opencode)、[OpenClaw](/providers#openclaw)、[Pi](/providers#pi)）
+2. `PATH` にインストールされた AI コーディングツールを検出します（内蔵 14 種: [Antigravity](/providers#antigravity)、[Claude Code](/providers#claude-code)、[CodeBuddy](/providers#codebuddy)、[Codex](/providers#codex)、[Cursor](/providers#cursor)、[Copilot](/providers#copilot)、[Hermes](/providers#hermes)、[Kimi](/providers#kimi)、[Kiro CLI](/providers#kiro-cli)、[OpenCode](/providers#opencode)、[OpenClaw](/providers#openclaw)、[Pi](/providers#pi)、[Qoder](/providers#qoder)、[Trae CLI](/providers#trae)）
 3. 検出した各ツールに対するランタイムとともに、自身をサーバーに登録します
 4. **3 秒ごと**に取得すべきタスクがないかポーリングし、**15 秒ごとにハートビートを送信**し続けます
 
@@ -131,4 +131,4 @@ Multica は 2 つの層で同時実行数の制限を適用します。
 ## 次へ
 
 - [タスク](/tasks) — デーモンがタスクを取得した後の全ライフサイクル
-- [プロバイダー対照表](/providers) — 12 種の AI コーディングツールの機能の違い
+- [プロバイダー対照表](/providers) — 14 種の AI コーディングツールの機能の違い
diff --git a/apps/docs/content/docs/daemon-runtimes.ko.mdx b/apps/docs/content/docs/daemon-runtimes.ko.mdx
index bf0b6a00d9c..7796edcbc3c 100644
--- a/apps/docs/content/docs/daemon-runtimes.ko.mdx
+++ b/apps/docs/content/docs/daemon-runtimes.ko.mdx
@@ -21,7 +21,7 @@ multica daemon start
 시작 시 데몬은 네 가지 일을 합니다.
 
 1. 로그인할 때 저장된 인증 정보를 읽습니다
-2. `PATH`에 설치된 AI 코딩 도구를 감지합니다(내장 12종: [Antigravity](/providers#antigravity), [Claude Code](/providers#claude-code), [CodeBuddy](/providers#codebuddy), [Codex](/providers#codex), [Cursor](/providers#cursor), [Copilot](/providers#copilot), [Hermes](/providers#hermes), [Kimi](/providers#kimi), [Kiro CLI](/providers#kiro-cli), [OpenCode](/providers#opencode), [OpenClaw](/providers#openclaw), [Pi](/providers#pi))
+2. `PATH`에 설치된 AI 코딩 도구를 감지합니다(내장 14종: [Antigravity](/providers#antigravity), [Claude Code](/providers#claude-code), [CodeBuddy](/providers#codebuddy), [Codex](/providers#codex), [Cursor](/providers#cursor), [Copilot](/providers#copilot), [Hermes](/providers#hermes), [Kimi](/providers#kimi), [Kiro CLI](/providers#kiro-cli), [OpenCode](/providers#opencode), [OpenClaw](/providers#openclaw), [Pi](/providers#pi), [Qoder](/providers#qoder), [Trae CLI](/providers#trae))
 3. 감지된 각 도구에 대한 런타임과 함께 자신을 서버에 등록합니다
 4. **3초마다** 가져올 작업이 있는지 폴링하고, **15초마다 하트비트를 전송**합니다
 
diff --git a/apps/docs/content/docs/daemon-runtimes.zh.mdx b/apps/docs/content/docs/daemon-runtimes.zh.mdx
index 1848a6e36dd..51cab0a75c5 100644
--- a/apps/docs/content/docs/daemon-runtimes.zh.mdx
+++ b/apps/docs/content/docs/daemon-runtimes.zh.mdx
@@ -21,7 +21,7 @@ multica daemon start
 启动后它会做四件事：
 
 1. 读取你登录时保存的凭证
-2. 探测本机 `PATH` 上已安装的 AI 编程工具（内置支持 12 款：[Antigravity](/providers#antigravity)、[Claude Code](/providers#claude-code)、[CodeBuddy](/providers#codebuddy)、[Codex](/providers#codex)、[Cursor](/providers#cursor)、[Copilot](/providers#copilot)、[Hermes](/providers#hermes)、[Kimi](/providers#kimi)、[Kiro CLI](/providers#kiro-cli)、[OpenCode](/providers#opencode)、[OpenClaw](/providers#openclaw)、[Pi](/providers#pi)）
+2. 探测本机 `PATH` 上已安装的 AI 编程工具（内置支持 14 款：[Antigravity](/providers#antigravity)、[Claude Code](/providers#claude-code)、[CodeBuddy](/providers#codebuddy)、[Codex](/providers#codex)、[Cursor](/providers#cursor)、[Copilot](/providers#copilot)、[Hermes](/providers#hermes)、[Kimi](/providers#kimi)、[Kiro CLI](/providers#kiro-cli)、[OpenCode](/providers#opencode)、[OpenClaw](/providers#openclaw)、[Pi](/providers#pi)、[Qoder](/providers#qoder)、[Trae CLI](/providers#trae)）
 3. 向服务器注册自己，以及每款检测到的工具对应的运行时
 4. 持续**每 3 秒轮询一次**是否有任务要领，**每 15 秒发一次心跳**
 
@@ -131,4 +131,4 @@ Multica 对并发有两层限额：
 ## 下一步
 
 - [执行任务](/tasks) —— 守护进程领到任务后，它的完整生命周期
-- [Providers Matrix](/providers) —— 12 款 AI 编程工具的能力差异对照
+- [Providers Matrix](/providers) —— 14 款 AI 编程工具的能力差异对照
diff --git a/apps/docs/content/docs/getting-started/cloud-quickstart.zh.mdx b/apps/docs/content/docs/getting-started/cloud-quickstart.zh.mdx
index a4cca9f5a5e..784fe1808f3 100644
--- a/apps/docs/content/docs/getting-started/cloud-quickstart.zh.mdx
+++ b/apps/docs/content/docs/getting-started/cloud-quickstart.zh.mdx
@@ -11,7 +11,7 @@ Go to [multica.ai](https://multica.ai) and create an account.
 
 ## 2. Install the CLI and start the daemon
 
-Give this instruction to your AI agent (Claude Code, Codex, Gemini CLI, OpenClaw, OpenCode, etc.):
+Give this instruction to your AI agent (Claude Code, Codex, Qoder, OpenClaw, OpenCode, etc.):
 
 ```
 Fetch https://github.com/multica-ai/multica/blob/main/CLI_INSTALL.md and follow the instructions to install Multica CLI, log in, and start the daemon on this machine.
@@ -45,7 +45,7 @@ Then configure, authenticate, and start the daemon:
 multica setup
 ```
 
-The daemon auto-detects available agent CLIs (`claude`, `codex`, `gemini`, `openclaw`, `opencode`, `hermes`, `pi`) on your PATH. When an agent is assigned a task, the daemon creates an isolated environment, runs the agent, and reports results back.
+The daemon auto-detects supported agent CLIs (`agy`, `claude`, `codebuddy`, `codex`, `copilot`, `cursor-agent`, `hermes`, `kimi`, `kiro-cli`, `opencode`, `openclaw`, `pi`, `qodercli`, `traecli`) on your PATH. When an agent is assigned a task, the daemon creates an isolated environment, runs the agent, and reports results back.
 
 ## 3. Verify your runtime
 
@@ -55,7 +55,7 @@ Open your workspace in the Multica web app. Navigate to **Settings → Runtimes*
 
 ## 4. Create an agent
 
-Go to **Settings → Agents** and click **New Agent**. Pick the runtime you just connected and choose a provider (Claude Code, Codex, Gemini CLI, OpenClaw, OpenCode, or Hermes). Give your agent a name — this is how it will appear on the board, in comments, and in assignments.
+Go to **Settings → Agents** and click **New Agent**. Pick the runtime you just connected and choose a provider (Antigravity, Claude Code, CodeBuddy, Codex, Copilot, Cursor, Hermes, Kimi, Kiro CLI, OpenCode, OpenClaw, Pi, Qoder, or Trae CLI). Give your agent a name — this is how it will appear on the board, in comments, and in assignments.
 
 ## 5. Assign your first task
 
diff --git a/apps/docs/content/docs/getting-started/self-hosting.zh.mdx b/apps/docs/content/docs/getting-started/self-hosting.zh.mdx
index 8088f629ade..380767f7451 100644
--- a/apps/docs/content/docs/getting-started/self-hosting.zh.mdx
+++ b/apps/docs/content/docs/getting-started/self-hosting.zh.mdx
@@ -92,11 +92,19 @@ brew install multica-ai/tap/multica
 
 You also need at least one AI agent CLI:
 - [Claude Code](https://docs.anthropic.com/en/docs/claude-code) (`claude` on PATH)
+- Antigravity (`agy` on PATH)
+- CodeBuddy (`codebuddy` on PATH)
 - [Codex](https://github.com/openai/codex) (`codex` on PATH)
-- [Gemini CLI](https://github.com/google-gemini/gemini-cli) (`gemini` on PATH)
+- Copilot (`copilot` on PATH)
+- Cursor Agent (`cursor-agent` on PATH)
 - OpenCode (`opencode` on PATH)
 - OpenClaw (`openclaw` on PATH)
 - Hermes (`hermes` on PATH)
+- Kimi (`kimi` on PATH)
+- Kiro CLI (`kiro-cli` on PATH)
+- Pi (`pi` on PATH)
+- Qoder (`qodercli` on PATH)
+- Trae CLI (`traecli` on PATH)
 
 ### b) One-command setup
 
@@ -310,14 +318,20 @@ Agent-specific overrides:
 | `MULTICA_CLAUDE_MODEL` | Override the Claude model used |
 | `MULTICA_CODEX_PATH` | Custom path to the `codex` binary |
 | `MULTICA_CODEX_MODEL` | Override the Codex model used |
+| `MULTICA_CODEBUDDY_PATH` | Custom path to the `codebuddy` binary |
+| `MULTICA_CODEBUDDY_MODEL` | Override the CodeBuddy model used |
+| `MULTICA_ANTIGRAVITY_PATH` | Custom path to the `agy` binary |
+| `MULTICA_ANTIGRAVITY_MODEL` | Override the Antigravity model used |
 | `MULTICA_OPENCODE_PATH` | Custom path to the `opencode` binary |
 | `MULTICA_OPENCODE_MODEL` | Override the OpenCode model used |
 | `MULTICA_OPENCLAW_PATH` | Custom path to the `openclaw` binary |
 | `MULTICA_OPENCLAW_MODEL` | Override the OpenClaw model used |
 | `MULTICA_HERMES_PATH` | Custom path to the `hermes` binary |
 | `MULTICA_HERMES_MODEL` | Override the Hermes model used |
-| `MULTICA_GEMINI_PATH` | Custom path to the `gemini` binary |
-| `MULTICA_GEMINI_MODEL` | Override the Gemini model used |
+| `MULTICA_QODER_PATH` | Custom path to the `qodercli` binary |
+| `MULTICA_QODER_MODEL` | Override the Qoder model used |
+| `MULTICA_TRAECLI_PATH` | Custom path to the `traecli` binary |
+| `MULTICA_TRAECLI_MODEL` | Override the Trae CLI model used |
 
 ## Database Setup
 
diff --git a/apps/docs/content/docs/guides/agents.zh.mdx b/apps/docs/content/docs/guides/agents.zh.mdx
index b489d644508..ab2f0aba27e 100644
--- a/apps/docs/content/docs/guides/agents.zh.mdx
+++ b/apps/docs/content/docs/guides/agents.zh.mdx
@@ -15,7 +15,7 @@ When an agent is assigned a task in Multica:
 
 1. The daemon detects the task assignment
 2. It creates an isolated workspace directory
-3. It spawns the appropriate agent CLI (Claude Code, Codex, Gemini CLI, OpenClaw, OpenCode, or Hermes)
+3. It spawns the appropriate agent CLI (Antigravity, Claude Code, CodeBuddy, Codex, Copilot, Cursor, Hermes, Kimi, Kiro CLI, OpenCode, OpenClaw, Pi, Qoder, or Trae CLI)
 4. The agent executes autonomously, streaming progress back to Multica
 5. Results are reported — success, failure, or blockers
 
@@ -29,10 +29,18 @@ Real-time progress is streamed via WebSocket so you can follow along in the Mult
 |----------|-------------|-------------|
 | Claude Code | `claude` | Anthropic's coding agent |
 | Codex | `codex` | OpenAI's coding agent |
-| Gemini CLI | `gemini` | Google's coding agent |
+| Antigravity | `agy` | Google's coding agent |
+| CodeBuddy | `codebuddy` | Tencent's Claude Code-compatible coding agent |
+| Copilot | `copilot` | GitHub's coding agent |
+| Cursor | `cursor-agent` | Anysphere's coding agent |
 | OpenClaw | `openclaw` | Open-source coding agent |
 | OpenCode | `opencode` | Open-source coding agent |
 | Hermes | `hermes` | Nous Research coding agent |
+| Kimi | `kimi` | Moonshot coding agent |
+| Kiro CLI | `kiro-cli` | Amazon coding agent |
+| Pi | `pi` | Inflection AI coding agent |
+| Qoder | `qodercli` | Alibaba coding agent |
+| Trae CLI | `traecli` | ByteDance coding agent |
 
 The daemon auto-detects which CLIs are available on your PATH and registers them as available runtimes.
 
diff --git a/apps/docs/content/docs/guides/quickstart.zh.mdx b/apps/docs/content/docs/guides/quickstart.zh.mdx
index 8fdfaf49ac6..cbf1298db7d 100644
--- a/apps/docs/content/docs/guides/quickstart.zh.mdx
+++ b/apps/docs/content/docs/guides/quickstart.zh.mdx
@@ -11,7 +11,7 @@ Once you have the CLI installed (or signed up for [Multica Cloud](https://multic
 multica setup           # Configure, authenticate, and start the daemon
 ```
 
-This configures the CLI, opens your browser for login, discovers your workspaces, and starts the agent daemon in the background. It auto-detects agent CLIs (`claude`, `codex`, `gemini`, `openclaw`, `opencode`, `hermes`, `pi`) available on your PATH.
+This configures the CLI, opens your browser for login, discovers your workspaces, and starts the agent daemon in the background. It auto-detects supported agent CLIs (`agy`, `claude`, `codebuddy`, `codex`, `copilot`, `cursor-agent`, `hermes`, `kimi`, `kiro-cli`, `opencode`, `openclaw`, `pi`, `qodercli`, `traecli`) available on your PATH.
 
 ## 2. Verify your runtime
 
@@ -21,7 +21,7 @@ Open your workspace in the Multica web app. Navigate to **Settings → Runtimes*
 
 ## 3. Create an agent
 
-Go to **Settings → Agents** and click **New Agent**. Pick the runtime you just connected and choose a provider (Claude Code, Codex, Gemini CLI, OpenClaw, OpenCode, or Hermes). Give your agent a name — this is how it will appear on the board, in comments, and in assignments.
+Go to **Settings → Agents** and click **New Agent**. Pick the runtime you just connected and choose a provider (Antigravity, Claude Code, CodeBuddy, Codex, Copilot, Cursor, Hermes, Kimi, Kiro CLI, OpenCode, OpenClaw, Pi, Qoder, or Trae CLI). Give your agent a name — this is how it will appear on the board, in comments, and in assignments.
 
 ## 4. Assign your first task
 
diff --git a/apps/docs/content/docs/how-multica-works.ja.mdx b/apps/docs/content/docs/how-multica-works.ja.mdx
index 6f29d22ef60..f82877c4e98 100644
--- a/apps/docs/content/docs/how-multica-works.ja.mdx
+++ b/apps/docs/content/docs/how-multica-works.ja.mdx
@@ -13,7 +13,7 @@ Multica は**分散型**プラットフォームです。あなたが目にす
 
 - **Multica サーバー** — あなたが目にするワークスペース、イシュー一覧、コメントスレッドは、すべてここのデータベースに保存されます。また、あなたと同僚の間でリアルタイム更新をプッシュする WebSocket ハブでもあります。エージェントのタスクは**実行しません**。
 - **デーモン** — Multica CLI の一部であり、あなた自身のマシンで実行されます。起動時にローカルにインストールされた AI コーディングツールを検出し、サーバーに登録したうえで、3 秒ごとにタスクをポーリングし、15 秒ごとにハートビートを送信し始めます。
-- **AI コーディングツール** — 次の 12 種類のうちの 1 つ（または複数を並列で）: [Antigravity](/providers#antigravity)、[Claude Code](/providers#claude-code)、[CodeBuddy](/providers#codebuddy)、[Codex](/providers#codex)、[Cursor](/providers#cursor)、[Copilot](/providers#copilot)、[Hermes](/providers#hermes)、[Kimi](/providers#kimi)、[Kiro CLI](/providers#kiro-cli)、[OpenCode](/providers#opencode)、[OpenClaw](/providers#openclaw)、[Pi](/providers#pi)。デーモンがタスクを取得した後は、これらのツールを使って実際の作業を行います。
+- **AI コーディングツール** — 次の 14 種類のうちの 1 つ（または複数を並列で）: [Antigravity](/providers#antigravity)、[Claude Code](/providers#claude-code)、[CodeBuddy](/providers#codebuddy)、[Codex](/providers#codex)、[Cursor](/providers#cursor)、[Copilot](/providers#copilot)、[Hermes](/providers#hermes)、[Kimi](/providers#kimi)、[Kiro CLI](/providers#kiro-cli)、[OpenCode](/providers#opencode)、[OpenClaw](/providers#openclaw)、[Pi](/providers#pi)、[Qoder](/providers#qoder)、[Trae CLI](/providers#trae)。デーモンがタスクを取得した後は、これらのツールを使って実際の作業を行います。
 
 ツールチェーンがローカルに留まるため、**あなたの API キー、コードディレクトリ、認可されたツール**は、あなたのマシン上でのみ使用されます。Multica サーバーはそのいずれも目にすることはありません。これはセルフホストでも Cloud でも同じように適用されます。
 
diff --git a/apps/docs/content/docs/how-multica-works.ko.mdx b/apps/docs/content/docs/how-multica-works.ko.mdx
index 2084f6d07ed..c7f1573bf06 100644
--- a/apps/docs/content/docs/how-multica-works.ko.mdx
+++ b/apps/docs/content/docs/how-multica-works.ko.mdx
@@ -13,7 +13,7 @@ Multica는 **분산형** 플랫폼입니다. 여러분이 보는 웹 인터페
 
 - **Multica 서버** — 여러분이 보는 워크스페이스, 이슈 목록, 댓글 스레드는 모두 이곳의 데이터베이스에 저장됩니다. 또한 여러분과 동료 사이의 실시간 업데이트를 푸시하는 WebSocket 허브이기도 합니다. 에이전트 작업은 **실행하지 않습니다.**
 - **데몬** — Multica CLI의 일부로, 여러분 자신의 기기에서 실행됩니다. 시작 시 로컬에 설치된 AI 코딩 도구를 감지하고, 서버에 등록한 다음, 3초마다 작업을 폴링하고 15초마다 하트비트를 전송하기 시작합니다.
-- **AI 코딩 도구** — 다음 열두 가지 중 하나(또는 여러 개를 병렬로): [Antigravity](/providers#antigravity), [Claude Code](/providers#claude-code), [CodeBuddy](/providers#codebuddy), [Codex](/providers#codex), [Cursor](/providers#cursor), [Copilot](/providers#copilot), [Hermes](/providers#hermes), [Kimi](/providers#kimi), [Kiro CLI](/providers#kiro-cli), [OpenCode](/providers#opencode), [OpenClaw](/providers#openclaw), [Pi](/providers#pi). 데몬이 작업을 가져온 뒤에는 이러한 도구를 사용해 실제 작업을 수행합니다.
+- **AI 코딩 도구** — 다음 14가지 중 하나(또는 여러 개를 병렬로): [Antigravity](/providers#antigravity), [Claude Code](/providers#claude-code), [CodeBuddy](/providers#codebuddy), [Codex](/providers#codex), [Cursor](/providers#cursor), [Copilot](/providers#copilot), [Hermes](/providers#hermes), [Kimi](/providers#kimi), [Kiro CLI](/providers#kiro-cli), [OpenCode](/providers#opencode), [OpenClaw](/providers#openclaw), [Pi](/providers#pi), [Qoder](/providers#qoder), [Trae CLI](/providers#trae). 데몬이 작업을 가져온 뒤에는 이러한 도구를 사용해 실제 작업을 수행합니다.
 
 도구 체인이 로컬에 유지되므로 **여러분의 API 키, 코드 디렉터리, 인증된 도구**는 오직 여러분의 기기에서만 사용됩니다. Multica 서버는 그중 어떤 것도 보지 못합니다. 이는 자체 호스팅을 하든 Cloud를 사용하든 동일하게 적용됩니다.
 
diff --git a/apps/docs/content/docs/how-multica-works.mdx b/apps/docs/content/docs/how-multica-works.mdx
index 8d6ff9335cc..7bdfcbac490 100644
--- a/apps/docs/content/docs/how-multica-works.mdx
+++ b/apps/docs/content/docs/how-multica-works.mdx
@@ -13,7 +13,7 @@ Multica is a **distributed** platform. The web interface you see is just the fro
 
 - **Multica server** — the workspaces, issue lists, and comment threads you see all live in its database. It's also a WebSocket hub that pushes real-time updates between you and your teammates. It does **not** execute any agent tasks.
 - **Daemon** — part of the Multica CLI, running on your own machine. On start it detects which AI coding tools are installed locally, registers with the server, and begins polling for tasks every 3 seconds and sending heartbeats every 15 seconds.
-- **AI coding tools** — one of the twelve (or several in parallel): [Antigravity](/providers#antigravity), [Claude Code](/providers#claude-code), [CodeBuddy](/providers#codebuddy), [Codex](/providers#codex), [Cursor](/providers#cursor), [Copilot](/providers#copilot), [Hermes](/providers#hermes), [Kimi](/providers#kimi), [Kiro CLI](/providers#kiro-cli), [OpenCode](/providers#opencode), [OpenClaw](/providers#openclaw), [Pi](/providers#pi). Once the daemon has picked up a task, it uses these tools to actually do the work.
+- **AI coding tools** — one of the fourteen (or several in parallel): [Antigravity](/providers#antigravity), [Claude Code](/providers#claude-code), [CodeBuddy](/providers#codebuddy), [Codex](/providers#codex), [Cursor](/providers#cursor), [Copilot](/providers#copilot), [Hermes](/providers#hermes), [Kimi](/providers#kimi), [Kiro CLI](/providers#kiro-cli), [OpenCode](/providers#opencode), [OpenClaw](/providers#openclaw), [Pi](/providers#pi), [Qoder](/providers#qoder), [Trae CLI](/providers#trae). Once the daemon has picked up a task, it uses these tools to actually do the work.
 
 Because the toolchain stays local, **your API keys, code directories, and authorized tools** are only ever used on your machine — the Multica server never sees any of them. This holds whether you self-host or use Cloud.
 
diff --git a/apps/docs/content/docs/how-multica-works.zh.mdx b/apps/docs/content/docs/how-multica-works.zh.mdx
index e78c4bfe130..77fbf3cc33c 100644
--- a/apps/docs/content/docs/how-multica-works.zh.mdx
+++ b/apps/docs/content/docs/how-multica-works.zh.mdx
@@ -13,7 +13,7 @@ Multica 是一个**分布式**平台。你看到的 Web 界面只是前台——
 
 - **Multica 服务器**——你看到的工作区、issue 列表、评论线都存在它的数据库里。它同时是 WebSocket hub，把你和同事之间的实时更新推送过去。它**不**执行任何智能体任务。
 - **守护进程**（daemon）——Multica CLI 的一部分，跑在你自己的机器上。启动后它探测本地装了哪些 AI 编程工具，注册到 server，开始每 3 秒领一次任务、每 15 秒发一次心跳。
-- **AI 编程工具**——[Antigravity](/providers#antigravity)、[Claude Code](/providers#claude-code)、[CodeBuddy](/providers#codebuddy)、[Codex](/providers#codex)、[Cursor](/providers#cursor)、[Copilot](/providers#copilot)、[Hermes](/providers#hermes)、[Kimi](/providers#kimi)、[Kiro CLI](/providers#kiro-cli)、[OpenCode](/providers#opencode)、[OpenClaw](/providers#openclaw)、[Pi](/providers#pi) 12 款之一（或多款并存）。守护进程领到任务后，用这些工具真正去写代码。
+- **AI 编程工具**——[Antigravity](/providers#antigravity)、[Claude Code](/providers#claude-code)、[CodeBuddy](/providers#codebuddy)、[Codex](/providers#codex)、[Cursor](/providers#cursor)、[Copilot](/providers#copilot)、[Hermes](/providers#hermes)、[Kimi](/providers#kimi)、[Kiro CLI](/providers#kiro-cli)、[OpenCode](/providers#opencode)、[OpenClaw](/providers#openclaw)、[Pi](/providers#pi)、[Qoder](/providers#qoder)、[Trae CLI](/providers#trae) 14 款之一（或多款并存）。守护进程领到任务后，用这些工具真正去写代码。
 
 工具链在本地的结果：**你的 API 密钥、代码目录、已授权的工具**都只在本地使用；Multica 服务器一个都看不到。自部署还是用 Cloud 都不改变这一点。
 
diff --git a/apps/docs/content/docs/index.ja.mdx b/apps/docs/content/docs/index.ja.mdx
index 2b63ca56b31..397007ca51a 100644
--- a/apps/docs/content/docs/index.ja.mdx
+++ b/apps/docs/content/docs/index.ja.mdx
@@ -13,7 +13,7 @@ Multica は、人間と AI [エージェント](/agents)が同じ[ワークス
 
 エージェントは Multica のサーバー上でタスクを実行**しません**。現在 Multica は 1 つのランタイムモデルをサポートしています。
 
-- **ローカル[デーモン](/daemon-runtimes)** — 自分のマシンで `multica daemon` を実行すると、デーモンがローカルにインストールされた [AI コーディングツール](/providers)を駆動します。現在 12 種類が標準で組み込まれています: [Antigravity](/providers#antigravity)、[Claude Code](/providers#claude-code)、[CodeBuddy](/providers#codebuddy)、[Codex](/providers#codex)、[Cursor](/providers#cursor)、[Copilot](/providers#copilot)、[Hermes](/providers#hermes)、[Kimi](/providers#kimi)、[Kiro CLI](/providers#kiro-cli)、[OpenCode](/providers#opencode)、[OpenClaw](/providers#openclaw)、[Pi](/providers#pi)。API キー、ツールチェーン、コードディレクトリはすべて自分のマシンに留まります。
+- **ローカル[デーモン](/daemon-runtimes)** — 自分のマシンで `multica daemon` を実行すると、デーモンがローカルにインストールされた [AI コーディングツール](/providers)を駆動します。現在 14 種類が標準で組み込まれています: [Antigravity](/providers#antigravity)、[Claude Code](/providers#claude-code)、[CodeBuddy](/providers#codebuddy)、[Codex](/providers#codex)、[Cursor](/providers#cursor)、[Copilot](/providers#copilot)、[Hermes](/providers#hermes)、[Kimi](/providers#kimi)、[Kiro CLI](/providers#kiro-cli)、[OpenCode](/providers#opencode)、[OpenClaw](/providers#openclaw)、[Pi](/providers#pi)、[Qoder](/providers#qoder)、[Trae CLI](/providers#trae)。API キー、ツールチェーン、コードディレクトリはすべて自分のマシンに留まります。
 
 <Callout type="info">
 **クラウドランタイムが近日提供予定です。** 現在はウェイトリストのみで運用されています。提供が開始されればローカルデーモンは不要になり、エージェントのタスクは Multica Cloud 上で直接実行されます。[ダウンロード](https://multica.ai/download)ページで登録すると通知を受け取れます。
diff --git a/apps/docs/content/docs/index.ko.mdx b/apps/docs/content/docs/index.ko.mdx
index 9354a271542..10ca027e34c 100644
--- a/apps/docs/content/docs/index.ko.mdx
+++ b/apps/docs/content/docs/index.ko.mdx
@@ -13,7 +13,7 @@ Multica는 인간과 AI [에이전트](/agents)가 같은 [워크스페이스](/
 
 에이전트는 Multica 서버에서 작업을 실행하지 **않습니다**. 현재 Multica는 하나의 런타임 모델을 지원합니다:
 
-- **로컬 [데몬](/daemon-runtimes)** — 자신의 기기에서 `multica daemon`을 실행하면, 데몬이 로컬에 설치된 [AI 코딩 도구](/providers)를 구동합니다. 현재 열두 가지가 기본 내장되어 있습니다: [Antigravity](/providers#antigravity), [Claude Code](/providers#claude-code), [CodeBuddy](/providers#codebuddy), [Codex](/providers#codex), [Cursor](/providers#cursor), [Copilot](/providers#copilot), [Hermes](/providers#hermes), [Kimi](/providers#kimi), [Kiro CLI](/providers#kiro-cli), [OpenCode](/providers#opencode), [OpenClaw](/providers#openclaw), [Pi](/providers#pi). API 키, 툴체인, 코드 디렉터리는 모두 자신의 기기에 머뭅니다.
+- **로컬 [데몬](/daemon-runtimes)** — 자신의 기기에서 `multica daemon`을 실행하면, 데몬이 로컬에 설치된 [AI 코딩 도구](/providers)를 구동합니다. 현재 14가지가 기본 내장되어 있습니다: [Antigravity](/providers#antigravity), [Claude Code](/providers#claude-code), [CodeBuddy](/providers#codebuddy), [Codex](/providers#codex), [Cursor](/providers#cursor), [Copilot](/providers#copilot), [Hermes](/providers#hermes), [Kimi](/providers#kimi), [Kiro CLI](/providers#kiro-cli), [OpenCode](/providers#opencode), [OpenClaw](/providers#openclaw), [Pi](/providers#pi), [Qoder](/providers#qoder), [Trae CLI](/providers#trae). API 키, 툴체인, 코드 디렉터리는 모두 자신의 기기에 머뭅니다.
 
 <Callout type="info">
 **클라우드 런타임이 곧 제공됩니다.** 현재는 대기 명단으로만 운영됩니다. 출시되면 로컬 데몬이 필요 없어지며 — 에이전트 작업이 Multica Cloud에서 직접 실행됩니다. [다운로드](https://multica.ai/download) 페이지에서 등록하면 알림을 받을 수 있습니다.
diff --git a/apps/docs/content/docs/index.mdx b/apps/docs/content/docs/index.mdx
index 94e7a05fca0..806133d4d7a 100644
--- a/apps/docs/content/docs/index.mdx
+++ b/apps/docs/content/docs/index.mdx
@@ -13,7 +13,7 @@ This page explains where agents run and the ways you can start using Multica.
 
 Agents do **not** execute tasks on Multica's servers. Multica currently supports one runtime model:
 
-- **Local [daemon](/daemon-runtimes)** — you run `multica daemon` on your own machine, and it drives the [AI coding tools](/providers) installed locally. Twelve are built in today: [Antigravity](/providers#antigravity), [Claude Code](/providers#claude-code), [CodeBuddy](/providers#codebuddy), [Codex](/providers#codex), [Cursor](/providers#cursor), [Copilot](/providers#copilot), [Hermes](/providers#hermes), [Kimi](/providers#kimi), [Kiro CLI](/providers#kiro-cli), [OpenCode](/providers#opencode), [OpenClaw](/providers#openclaw), [Pi](/providers#pi). Your API keys, toolchain, and code directories stay on your machine.
+- **Local [daemon](/daemon-runtimes)** — you run `multica daemon` on your own machine, and it drives the [AI coding tools](/providers) installed locally. Fourteen are built in today: [Antigravity](/providers#antigravity), [Claude Code](/providers#claude-code), [CodeBuddy](/providers#codebuddy), [Codex](/providers#codex), [Cursor](/providers#cursor), [Copilot](/providers#copilot), [Hermes](/providers#hermes), [Kimi](/providers#kimi), [Kiro CLI](/providers#kiro-cli), [OpenCode](/providers#opencode), [OpenClaw](/providers#openclaw), [Pi](/providers#pi), [Qoder](/providers#qoder), [Trae CLI](/providers#trae). Your API keys, toolchain, and code directories stay on your machine.
 
 <Callout type="info">
 **Cloud runtimes are coming**, currently waitlist-only. Once live, you won't need a local daemon — agent tasks will execute on Multica Cloud directly. Sign up on the [Downloads](https://multica.ai/download) page to get notified.
diff --git a/apps/docs/content/docs/index.zh.mdx b/apps/docs/content/docs/index.zh.mdx
index 789d4100819..6ec7ccada6d 100644
--- a/apps/docs/content/docs/index.zh.mdx
+++ b/apps/docs/content/docs/index.zh.mdx
@@ -15,7 +15,7 @@ Multica 是一个任务协作平台，让人类和 AI [智能体](/agents) 在
 
 智能体执行任务**不**发生在 Multica 服务器上。目前 Multica 支持一种运行方式：
 
-- **本地 [守护进程](/daemon-runtimes)** — 你在自己的机器上运行 `multica daemon`，由它调用本地安装的 [AI 编程工具](/providers)。目前内置 12 款：[Antigravity](/providers#antigravity)、[Claude Code](/providers#claude-code)、[CodeBuddy](/providers#codebuddy)、[Codex](/providers#codex)、[Cursor](/providers#cursor)、[Copilot](/providers#copilot)、[Hermes](/providers#hermes)、[Kimi](/providers#kimi)、[Kiro CLI](/providers#kiro-cli)、[OpenCode](/providers#opencode)、[OpenClaw](/providers#openclaw)、[Pi](/providers#pi)。你的 API 密钥、工具链、代码目录都保留在本地。
+- **本地 [守护进程](/daemon-runtimes)** — 你在自己的机器上运行 `multica daemon`，由它调用本地安装的 [AI 编程工具](/providers)。目前内置 14 款：[Antigravity](/providers#antigravity)、[Claude Code](/providers#claude-code)、[CodeBuddy](/providers#codebuddy)、[Codex](/providers#codex)、[Cursor](/providers#cursor)、[Copilot](/providers#copilot)、[Hermes](/providers#hermes)、[Kimi](/providers#kimi)、[Kiro CLI](/providers#kiro-cli)、[OpenCode](/providers#opencode)、[OpenClaw](/providers#openclaw)、[Pi](/providers#pi)、[Qoder](/providers#qoder)、[Trae CLI](/providers#trae)。你的 API 密钥、工具链、代码目录都保留在本地。
 
 <Callout type="info">
 **云端运行时即将开放**，目前处于等待名单阶段。上线后，你无需在本地运行守护进程，即可在 Multica Cloud 上直接执行智能体任务。在 [下载页面](https://multica.ai/download) 登记邮箱以获取通知。
diff --git a/apps/docs/content/docs/install-agent-runtime.ja.mdx b/apps/docs/content/docs/install-agent-runtime.ja.mdx
index 1e509cd2aad..ae6de7a534c 100644
--- a/apps/docs/content/docs/install-agent-runtime.ja.mdx
+++ b/apps/docs/content/docs/install-agent-runtime.ja.mdx
@@ -1,11 +1,11 @@
 ---
 title: エージェントランタイムをインストールする
-description: Multica はあなたのマシンにインストールされている AI コーディングツールを駆動します。このページでは、デーモンがそれらを検出できるように、サポートされている 13 種のツールをそれぞれインストールする方法を説明します。
+description: Multica はあなたのマシンにインストールされている AI コーディングツールを駆動します。このページでは、デーモンがそれらを検出できるように、サポートされている 14 種のツールをそれぞれインストールする方法を説明します。
 ---
 
 import { Callout } from "fumadocs-ui/components/callout";
 
-Multica における**ランタイム**とは、あなたのマシンのデーモンと、デーモンが `PATH` で見つけた AI コーディングツール 1 つが組になったものです。オンボーディングの「ランタイムを接続」ステップで **No supported tools detected** と表示される場合、それはデーモンが `PATH` をスキャンしたものの、駆動方法を知っている 13 種のツールのいずれも見つけられなかったことを意味します。以下のツールのいずれか（または複数）をインストールしてから、そのステップに戻って再スキャンしてください — 数秒以内にランタイムが表示されます。
+Multica における**ランタイム**とは、あなたのマシンのデーモンと、デーモンが `PATH` で見つけた AI コーディングツール 1 つが組になったものです。オンボーディングの「ランタイムを接続」ステップで **No supported tools detected** と表示される場合、それはデーモンが `PATH` をスキャンしたものの、駆動方法を知っている 14 種のツールのいずれも見つけられなかったことを意味します。以下のツールのいずれか（または複数）をインストールしてから、そのステップに戻って再スキャンしてください — 数秒以内にランタイムが表示されます。
 
 このページは次のドキュメントのインストール側の補完ドキュメントです。
 
@@ -31,9 +31,9 @@ multica daemon restart
 
 または、デスクトップアプリではアプリを再起動するだけで構いません。デーモンは起動するたびに `PATH` を再スキャンします。
 
-## サポートされている 13 種のツール
+## サポートされている 14 種のツール
 
-おおよそ利用者の多い順に並べています。すでに認証情報を持っているものを選んで使ってください — 13 種すべてをインストールする必要はありません。
+おおよそ利用者の多い順に並べています。すでに認証情報を持っているものを選んで使ってください — 14 種すべてをインストールする必要はありません。
 
 ### Claude Code (Anthropic)
 
@@ -157,6 +157,16 @@ stdio 上で ACP プロトコルを使用するエージェント型のコーデ
 | インストール | 公式 CLI ドキュメント [qoder.com/cli](https://qoder.com/cli) を参照してください。 |
 | 認証 | ベンダーのドキュメントに従います。 |
 
+### Trae CLI (ByteDance)
+
+ByteDance 公式の TRAE CLI（`traecli`、Trae IDE と組み合わせて使う製品で、**オープンソースの `bytedance/trae-agent` ではありません**）です。ACP ネイティブのため、Multica は stdio 上で `traecli acp serve --yolo` を通じて駆動し、Hermes、Kimi、Kiro CLI、Qoder とトランスポートを共有します。セッション再開は ACP `session/load`、MCP 構成は ACP `mcpServers`、モデル選択は動的探索で動作し、スキルは `.traecli/skills/` にコピーされます。
+
+| | |
+|---|---|
+| デーモンが探す名前 | `traecli` |
+| インストール | 公式 CLI ドキュメント [docs.trae.cn/cli](https://docs.trae.cn/cli) を参照してください。 |
+| 認証 | `traecli` を一度対話的に実行してブラウザベースの企業ログインを完了してください。Trae IDE へのログインと CLI へのログインは別です。 |
+
 ### Antigravity (Google)
 
 Google の Antigravity CLI（`agy`）です。Google の Antigravity サービスと組になり、Gemini ベースのモデルを実行します。セッション再開は `--conversation <id>` を通じて動作し、デーモンが CLI のログファイルからこれをキャプチャします。モデル選択は Antigravity CLI 自体の内部で管理されます — Multica はこのプロバイダーに対してエージェントごとのモデルピッカーを無効にします。スキルは `.agents/skills/` に書き込まれます（CLI が Gemini CLI のワークスペーススキルレイアウトを継承します — [Antigravity ドキュメント](https://antigravity.google/docs/gcli-migration)を参照）。
diff --git a/apps/docs/content/docs/install-agent-runtime.ko.mdx b/apps/docs/content/docs/install-agent-runtime.ko.mdx
index 4bd4556b75d..38078719e04 100644
--- a/apps/docs/content/docs/install-agent-runtime.ko.mdx
+++ b/apps/docs/content/docs/install-agent-runtime.ko.mdx
@@ -1,11 +1,11 @@
 ---
 title: 에이전트 런타임 설치하기
-description: Multica는 사용자 기기에 설치된 AI 코딩 도구를 구동합니다. 이 페이지에서는 데몬이 도구를 감지할 수 있도록 지원되는 13종의 도구를 각각 설치하는 방법을 설명합니다.
+description: Multica는 사용자 기기에 설치된 AI 코딩 도구를 구동합니다. 이 페이지에서는 데몬이 도구를 감지할 수 있도록 지원되는 14종의 도구를 각각 설치하는 방법을 설명합니다.
 ---
 
 import { Callout } from "fumadocs-ui/components/callout";
 
-Multica에서 **런타임**이란 사용자 기기의 데몬과, 데몬이 `PATH`에서 찾아낸 AI 코딩 도구 하나가 짝을 이룬 것입니다. 온보딩의 "런타임 연결" 단계에서 **지원되는 도구를 감지하지 못했습니다**라고 표시된다면, 데몬이 `PATH`를 스캔했지만 구동 방법을 아는 13종의 도구 중 어느 것도 찾지 못했다는 뜻입니다. 아래 도구 중 하나(또는 여러 개)를 설치한 다음 해당 단계로 돌아와 다시 스캔하세요. 몇 초 안에 런타임이 나타납니다.
+Multica에서 **런타임**이란 사용자 기기의 데몬과, 데몬이 `PATH`에서 찾아낸 AI 코딩 도구 하나가 짝을 이룬 것입니다. 온보딩의 "런타임 연결" 단계에서 **지원되는 도구를 감지하지 못했습니다**라고 표시된다면, 데몬이 `PATH`를 스캔했지만 구동 방법을 아는 14종의 도구 중 어느 것도 찾지 못했다는 뜻입니다. 아래 도구 중 하나(또는 여러 개)를 설치한 다음 해당 단계로 돌아와 다시 스캔하세요. 몇 초 안에 런타임이 나타납니다.
 
 이 페이지는 다음 문서의 설치 측면 동반 문서입니다.
 
@@ -31,9 +31,9 @@ multica daemon restart
 
 또는 데스크톱 앱에서는 앱을 다시 실행하기만 하면 됩니다. 데몬은 시작될 때마다 `PATH`를 다시 스캔합니다.
 
-## 지원되는 13종의 도구
+## 지원되는 14종의 도구
 
-대략 많이 쓰이는 순서대로 나열했습니다. 이미 자격 증명을 갖고 있는 것을 골라 사용하세요. 13종을 모두 설치할 필요는 없습니다.
+대략 많이 쓰이는 순서대로 나열했습니다. 이미 자격 증명을 갖고 있는 것을 골라 사용하세요. 14종을 모두 설치할 필요는 없습니다.
 
 ### Claude Code (Anthropic)
 
@@ -157,6 +157,16 @@ stdio 위에서 ACP 프로토콜을 사용하는 에이전트형 코딩 CLI입
 | 설치 | 공식 CLI 문서 [qoder.com/cli](https://qoder.com/cli)를 참고하세요. |
 | 인증 | 공급사 문서에 따릅니다. |
 
+### Trae CLI (ByteDance)
+
+ByteDance의 공식 TRAE CLI(`traecli`, Trae IDE와 함께 쓰는 제품이며 **오픈소스 `bytedance/trae-agent`가 아닙니다**)입니다. ACP 네이티브라서 Multica는 `traecli acp serve --yolo`로 stdio 위에서 구동하며 Hermes, Kimi, Kiro CLI, Qoder와 전송 계층을 공유합니다. 세션 재개는 ACP `session/load`로 동작하고, MCP 구성은 ACP `mcpServers`로 전달되며, 모델 선택은 동적으로 탐색되고, 스킬은 `.traecli/skills/`로 복사됩니다.
+
+| | |
+|---|---|
+| 데몬이 찾는 이름 | `traecli` |
+| 설치 | 공식 CLI 문서 [docs.trae.cn/cli](https://docs.trae.cn/cli)를 참고하세요. |
+| 인증 | `traecli`를 한 번 대화형으로 실행해 브라우저 기반 기업 로그인을 완료하세요. Trae IDE 로그인과 CLI 로그인은 별개입니다. |
+
 ### Antigravity (Google)
 
 Google의 Antigravity CLI(`agy`)입니다. Google의 Antigravity 서비스와 짝을 이루며 Gemini 기반 모델을 실행합니다. 세션 재개는 `--conversation <id>`를 통해 작동하며, 데몬이 CLI 로그 파일에서 이를 캡처합니다. 모델 선택은 Antigravity CLI 자체 내부에서 관리됩니다 — Multica는 이 제공자에 대해 에이전트별 모델 선택기를 비활성화합니다. 스킬은 `.agents/skills/`에 기록됩니다(CLI가 Gemini CLI의 워크스페이스 스킬 레이아웃을 상속함 — [Antigravity 문서](https://antigravity.google/docs/gcli-migration) 참고).
diff --git a/apps/docs/content/docs/install-agent-runtime.zh.mdx b/apps/docs/content/docs/install-agent-runtime.zh.mdx
index 8847d12388b..3984805a800 100644
--- a/apps/docs/content/docs/install-agent-runtime.zh.mdx
+++ b/apps/docs/content/docs/install-agent-runtime.zh.mdx
@@ -1,11 +1,11 @@
 ---
 title: 安装一个 Agent 运行时
-description: Multica 驱动本机上已安装的 AI 编程工具。这一页讲清楚怎么安装目前支持的 13 款工具，让守护进程能扫到。
+description: Multica 驱动本机上已安装的 AI 编程工具。这一页讲清楚怎么安装目前支持的 14 款工具，让守护进程能扫到。
 ---
 
 import { Callout } from "fumadocs-ui/components/callout";
 
-在 Multica 里，一个**运行时**（runtime）就是你机器上的守护进程，配上守护进程在 `PATH` 里扫到的某一款 AI 编程工具。如果 onboarding 的 "连接运行时" 这一步显示 **未检测到支持的工具**，说明守护进程扫了 `PATH`，但 13 款它认得的工具一个都没找到。装下面任意一款（或几款），回到这一步重新扫描，几秒内运行时就会出现。
+在 Multica 里，一个**运行时**（runtime）就是你机器上的守护进程，配上守护进程在 `PATH` 里扫到的某一款 AI 编程工具。如果 onboarding 的 "连接运行时" 这一步显示 **未检测到支持的工具**，说明守护进程扫了 `PATH`，但 14 款它认得的工具一个都没找到。装下面任意一款（或几款），回到这一步重新扫描，几秒内运行时就会出现。
 
 这一页是装机的入口，和它配套的是：
 
@@ -31,9 +31,9 @@ multica daemon restart
 
 桌面端的话，重启 app 即可。守护进程只在启动时扫一次 `PATH`。
 
-## 13 款支持的工具
+## 14 款支持的工具
 
-大致按常见程度排序。挑你已经有账号 / API key 的那几款就行 —— 不需要 13 个全装。
+大致按常见程度排序。挑你已经有账号 / API key 的那几款就行 —— 不需要 14 个全装。
 
 ### Claude Code（Anthropic）
 
@@ -157,6 +157,16 @@ ACP 协议 agent（和 Kimi 共享传输层）。会话续接可用，MCP 配置
 | 安装 | 看官方 CLI 文档 [qoder.com/cli](https://qoder.com/cli)。 |
 | 认证 | 按厂商文档。 |
 
+### Trae CLI（ByteDance）
+
+ByteDance 官方 TRAE CLI（`traecli`，搭配 Trae IDE，**不是**开源的 `bytedance/trae-agent`）。它是 ACP 原生工具，Multica 通过 `traecli acp serve --yolo` 在 stdio 上驱动它，和 Hermes、Kimi、Kiro CLI、Qoder 共享传输层。会话续接通过 ACP `session/load` 工作，MCP 配置通过 ACP `mcpServers` 传入，模型为动态发现，skill 复制到 `.traecli/skills/`。
+
+| | |
+|---|---|
+| 守护进程扫描 | `traecli` |
+| 安装 | 看官方 CLI 文档 [docs.trae.cn/cli](https://docs.trae.cn/cli)。 |
+| 认证 | 交互式跑一次 `traecli` 完成浏览器企业登录。Trae IDE 登录和 CLI 登录是分开的。 |
+
 ### Antigravity（Google）
 
 Google 的 Antigravity CLI（`agy`）。搭配 Google Antigravity 服务，默认走 Gemini 系列模型。Multica 使用 `agy -p` 启动它，这是适合 daemon 后台任务的一次性非交互模式；当前 Antigravity CLI 在这个模式下仍可执行工具，而 `agy -i` 需要连接 TTY，不适合 daemon 驱动。会话续接通过 `--conversation <id>` 工作——守护进程从 CLI 的日志文件里抓取 conversation UUID。模型选择保存在 Antigravity CLI 自己的设置里——Multica 里这款工具的「模型」选择项被禁用。Skill 文件写入 `.agents/skills/`（CLI 沿用 Gemini CLI 的 workspace 布局——见 [Antigravity 文档](https://antigravity.google/docs/gcli-migration)）。
diff --git a/apps/docs/content/docs/providers.ja.mdx b/apps/docs/content/docs/providers.ja.mdx
index 5aa08ebff21..e55ff221687 100644
--- a/apps/docs/content/docs/providers.ja.mdx
+++ b/apps/docs/content/docs/providers.ja.mdx
@@ -1,11 +1,11 @@
 ---
 title: AI コーディングツール対応表
-description: Multica は 13 個の AI コーディングツールをサポートしています。すべて同じインターフェースを実装していますが、機能の詳細は大きく異なります。
+description: Multica は 14 個の AI コーディングツールをサポートしています。すべて同じインターフェースを実装していますが、機能の詳細は大きく異なります。
 ---
 
 import { Callout } from "fumadocs-ui/components/callout";
 
-Multica は **13 個の AI コーディングツール**を標準でサポートしています。これらはすべて同じインターフェース（キューへの投入、ディスパッチ、実行、結果の返却）を実装しているため、同じ Multica ボードからどれでも動かすことができます。**しかし機能の詳細は大きく異なります**: セッション再開が実際に動作するか、MCP をサポートするか、スキルファイルがどこに置かれるか、モデルをどう選択するか。このページがその完全な対応表です。
+Multica は **14 個の AI コーディングツール**を標準でサポートしています。これらはすべて同じインターフェース（キューへの投入、ディスパッチ、実行、結果の返却）を実装しているため、同じ Multica ボードからどれでも動かすことができます。**しかし機能の詳細は大きく異なります**: セッション再開が実際に動作するか、MCP をサポートするか、スキルファイルがどこに置かれるか、モデルをどう選択するか。このページがその完全な対応表です。
 
 エージェントを作成するときにツールを選ぶ際のガイダンスは、[エージェントの作成と構成](/agents-create)を参照してください。
 
@@ -26,6 +26,7 @@ Multica は **13 個の AI コーディングツール**を標準でサポート
 | **OpenClaw** | オープンソース | ✅ | ✅ | `.agent_context/skills/`（フォールバック） | エージェントにバインドされ、タスクごとに切り替え不可 |
 | **Pi** | Inflection AI | ✅（セッションがファイルパス） | ❌ | `.pi/skills/` | 動的探索 |
 | **Qoder** | Alibaba | ✅ | ✅ | `.qoder/skills/` | 動的探索 |
+| **Trae CLI** | ByteDance | ✅（ACP `session/load`） | ✅ | `.traecli/skills/` | 動的探索 |
 
 ## 各ツールの用途
 
@@ -89,15 +90,19 @@ Inflection AI が提供し、ミニマルです。**セッション再開の方
 
 Alibaba が提供します。エージェント型のコーディング CLI です。stdio 上で ACP プロトコルを使用します（Hermes、Kimi、Kiro CLI とトランスポートを共有します）。セッション再開は ACP `session/resume` を通じて動作し、MCP 構成は ACP `mcpServers` として渡され、モデル選択は動的に探索され、スキルはネイティブ探索のために `.qoder/skills/` にコピーされます。
 
+### Trae
+
+ByteDance 公式の TRAE CLI（`traecli`、Trae IDE と組み合わせて使う製品で、オープンソースの `bytedance/trae-agent` ではありません）です。ACP ネイティブのため、Multica は `traecli acp serve --yolo` で stdio 経由で駆動します。Kiro や Qoder と同じトランスポートです。セッション再開は ACP `session/load` で動作し、MCP 構成は ACP `mcpServers` として渡され、モデルは動的に探索されて `session/set_model` でタスクごとに切り替えられます。スキルは `.traecli/skills/` にコピーされます。
+
 ## セッション再開: 実際にサポートするツール
 
 セッション再開のメカニズムは[タスク](/tasks#can-a-task-continue-from-the-previous-context)で扱います。**サポートされているすべてのツールがセッションを再開できます** — 再開 id を渡すと、タスクは以前のコンテキストから続行します。唯一の例外は Pi で、再開 id が文字列 ID ではなくディスク上のセッションファイルへのパスです（上記の [Pi](#pi) を参照）。
 
 ## MCP 構成: ツールごとの対応
 
-**13 個のツールのうち、`mcp_config` を実際に消費するのは 10 個です: Claude Code、CodeBuddy、Codex、Cursor、Hermes、Kimi、Kiro CLI、OpenCode、OpenClaw、Qoder**。残りの 3 個はこのフィールドを受け取りますが、**無視します** — エラーも警告もなく、構成はただ効果を発揮しません。
+**14 個のツールのうち、`mcp_config` を実際に消費するのは 11 個です: Claude Code、CodeBuddy、Codex、Cursor、Hermes、Kimi、Kiro CLI、OpenCode、OpenClaw、Qoder、Trae CLI**。残りの 3 個はこのフィールドを受け取りますが、**無視します** — エラーも警告もなく、構成はただ効果を発揮しません。
 
-接続方式はツールごとに異なります: Claude Code と CodeBuddy は `--mcp-config` と `--strict-mcp-config` で受け取り、Codex は daemon 管理の `mcp_servers` ブロックをタスクごとの `$CODEX_HOME/config.toml` に書き込み、Cursor は `.cursor/mcp.json` とタスクごとの `CURSOR_DATA_DIR` 配下のプロジェクト approval を書き込みます。Hermes、Kimi、Kiro CLI、Qoder は ACP `mcpServers` で受け取ります。OpenCode は `OPENCODE_CONFIG_CONTENT` 環境変数でインライン構成を受け取り、OpenClaw は Multica のタスクごとの config wrapper 経由で `mcp.servers` を受け取ります。OpenCode の経路はプロジェクトの `opencode.json` を書き換えません。
+接続方式はツールごとに異なります: Claude Code と CodeBuddy は `--mcp-config` と `--strict-mcp-config` で受け取り、Codex は daemon 管理の `mcp_servers` ブロックをタスクごとの `$CODEX_HOME/config.toml` に書き込み、Cursor は `.cursor/mcp.json` とタスクごとの `CURSOR_DATA_DIR` 配下のプロジェクト approval を書き込みます。Hermes、Kimi、Kiro CLI、Qoder、Trae CLI は ACP `mcpServers` で受け取ります。OpenCode は `OPENCODE_CONFIG_CONTENT` 環境変数でインライン構成を受け取り、OpenClaw は Multica のタスクごとの config wrapper 経由で `mcp.servers` を受け取ります。OpenCode の経路はプロジェクトの `opencode.json` を書き換えません。
 
 <Callout type="warning">
 エージェント構成で `mcp_config` を設定しても、MCP 列に ✅ がないツールを選んだ場合、MCP サーバーはそのエージェントに**何の効果**も及ぼしません。MCP 連携はツールごとに実装されています。
@@ -119,6 +124,7 @@ Alibaba が提供します。エージェント型のコーディング CLI で
 | OpenCode | `.opencode/skills/` | ✅ ネイティブ |
 | Pi | `.pi/skills/` | ✅ ネイティブ |
 | Qoder | `.qoder/skills/` | ✅ ネイティブ |
+| Trae CLI | `.traecli/skills/` | ✅ ネイティブ |
 | Antigravity | `.agents/skills/` | ✅ ネイティブ（Gemini CLI のワークスペースレイアウトを継承 — [Antigravity ドキュメント](https://antigravity.google/docs/gcli-migration)を参照） |
 | Hermes | `.agent_context/skills/` | ⚠️ 汎用フォールバック |
 | OpenClaw | `.agent_context/skills/` | ⚠️ 汎用フォールバック |
@@ -134,4 +140,4 @@ Alibaba が提供します。エージェント型のコーディング CLI で
 - [エージェントの作成と構成](/agents-create) — エージェントに使うツールを選ぶ
 - [タスク](/tasks) — タスクのライフサイクルとセッション再開のメカニズム
 - [デーモンとランタイム](/daemon-runtimes) — ツールが実行される場所と Multica への接続方法
-- [エージェントランタイムのインストール](/install-agent-runtime) — サポートされる 13 個のツールそれぞれのインストールと認証
+- [エージェントランタイムのインストール](/install-agent-runtime) — サポートされる 14 個のツールそれぞれのインストールと認証
diff --git a/apps/docs/content/docs/providers.ko.mdx b/apps/docs/content/docs/providers.ko.mdx
index 453d798e8ad..70058ee8d21 100644
--- a/apps/docs/content/docs/providers.ko.mdx
+++ b/apps/docs/content/docs/providers.ko.mdx
@@ -1,11 +1,11 @@
 ---
 title: AI 코딩 도구 대조표
-description: Multica는 13개의 AI 코딩 도구를 지원합니다. 모두 동일한 인터페이스를 구현하지만, 기능 세부사항은 크게 다릅니다.
+description: Multica는 14개의 AI 코딩 도구를 지원합니다. 모두 동일한 인터페이스를 구현하지만, 기능 세부사항은 크게 다릅니다.
 ---
 
 import { Callout } from "fumadocs-ui/components/callout";
 
-Multica는 **13개의 AI 코딩 도구**를 기본 지원합니다. 이들은 모두 동일한 인터페이스(대기열 적재, 디스패치, 실행, 결과 반환)를 구현하므로, 같은 Multica 보드에서 어느 것이든 구동할 수 있습니다. **하지만 기능 세부사항은 크게 다릅니다**: 세션 재개가 실제로 동작하는지, MCP를 지원하는지, 스킬 파일이 어디에 위치하는지, 모델을 어떻게 선택하는지. 이 페이지가 전체 대조표입니다.
+Multica는 **14개의 AI 코딩 도구**를 기본 지원합니다. 이들은 모두 동일한 인터페이스(대기열 적재, 디스패치, 실행, 결과 반환)를 구현하므로, 같은 Multica 보드에서 어느 것이든 구동할 수 있습니다. **하지만 기능 세부사항은 크게 다릅니다**: 세션 재개가 실제로 동작하는지, MCP를 지원하는지, 스킬 파일이 어디에 위치하는지, 모델을 어떻게 선택하는지. 이 페이지가 전체 대조표입니다.
 
 에이전트를 생성할 때 도구를 고르는 방법은 [에이전트 생성 및 구성](/agents-create)을 참고하세요.
 
@@ -26,6 +26,7 @@ Multica는 **13개의 AI 코딩 도구**를 기본 지원합니다. 이들은 
 | **OpenClaw** | 오픈소스 | ✅ | ✅ | `.agent_context/skills/` (fallback) | 에이전트에 바인딩되어 작업마다 전환 불가 |
 | **Pi** | Inflection AI | ✅ (세션이 파일 경로) | ❌ | `.pi/skills/` | 동적 탐색 |
 | **Qoder** | Alibaba | ✅ | ✅ | `.qoder/skills/` | 동적 탐색 |
+| **Trae CLI** | ByteDance | ✅ (ACP `session/load`) | ✅ | `.traecli/skills/` | 동적 탐색 |
 
 ## 각 도구의 용도
 
@@ -89,15 +90,19 @@ Inflection AI에서 제공하며, 미니멀합니다. **세션 재개 방식이
 
 Alibaba에서 제공합니다. 에이전트형 코딩 CLI입니다. stdio 위에서 ACP 프로토콜을 사용합니다(Hermes, Kimi, Kiro CLI와 전송 계층을 공유합니다). 세션 재개는 ACP `session/resume`를 통해 동작하고, MCP 구성은 ACP `mcpServers`로 전달되며, 모델 선택은 동적으로 탐색되고, 스킬은 네이티브 탐색을 위해 `.qoder/skills/`로 복사됩니다.
 
+### Trae
+
+ByteDance의 공식 TRAE CLI(`traecli`, Trae IDE와 함께 쓰는 제품이며 오픈소스 `bytedance/trae-agent`가 아닙니다)입니다. ACP 네이티브라서 Multica는 `traecli acp serve --yolo`로 stdio 위에서 구동하며, Kiro 및 Qoder와 같은 전송 계층을 사용합니다. 세션 재개는 ACP `session/load`로 동작하고, MCP 구성은 ACP `mcpServers`로 전달되며, 모델은 동적으로 탐색되어 작업별로 `session/set_model`로 전환됩니다. 스킬은 `.traecli/skills/`로 복사됩니다.
+
 ## 세션 재개: 실제로 지원하는 도구
 
 세션 재개 메커니즘은 [작업](/tasks#can-a-task-continue-from-the-previous-context)에서 다룹니다. **지원되는 모든 도구가 세션을 재개합니다** — 재개 id를 전달하면 작업이 이전 컨텍스트에서 이어집니다. 유일한 예외는 Pi로, 재개 id가 문자열 ID가 아니라 디스크상의 세션 파일 경로입니다(위의 [Pi](#pi) 참고).
 
 ## MCP 구성: 도구별 지원
 
-**13개 도구 중 `mcp_config`를 실제로 소비하는 것은 10개입니다: Claude Code, CodeBuddy, Codex, Cursor, Hermes, Kimi, Kiro CLI, OpenCode, OpenClaw, Qoder**. 나머지 3개는 이 필드를 받아들이지만 **무시합니다** — 오류도, 경고도 없으며, 구성이 그저 효과를 내지 못합니다.
+**14개 도구 중 `mcp_config`를 실제로 소비하는 것은 11개입니다: Claude Code, CodeBuddy, Codex, Cursor, Hermes, Kimi, Kiro CLI, OpenCode, OpenClaw, Qoder, Trae CLI**. 나머지 3개는 이 필드를 받아들이지만 **무시합니다** — 오류도, 경고도 없으며, 구성이 그저 효과를 내지 못합니다.
 
-각 도구의 연결 방식은 다릅니다: Claude Code와 CodeBuddy는 `--mcp-config`와 `--strict-mcp-config`로 받고, Codex는 데몬이 관리하는 `mcp_servers` 블록을 작업별 `$CODEX_HOME/config.toml`에 기록하며, Cursor는 `.cursor/mcp.json`과 작업별 `CURSOR_DATA_DIR` 아래의 프로젝트 approval을 기록합니다. Hermes/Kimi/Kiro CLI/Qoder는 ACP `mcpServers`로 받습니다. OpenCode는 `OPENCODE_CONFIG_CONTENT` 환경 변수로 인라인 구성을 받고, OpenClaw는 Multica의 작업별 config wrapper를 통해 `mcp.servers`를 받습니다. OpenCode 경로는 프로젝트의 `opencode.json`을 다시 쓰지 않습니다.
+각 도구의 연결 방식은 다릅니다: Claude Code와 CodeBuddy는 `--mcp-config`와 `--strict-mcp-config`로 받고, Codex는 데몬이 관리하는 `mcp_servers` 블록을 작업별 `$CODEX_HOME/config.toml`에 기록하며, Cursor는 `.cursor/mcp.json`과 작업별 `CURSOR_DATA_DIR` 아래의 프로젝트 approval을 기록합니다. Hermes/Kimi/Kiro CLI/Qoder/Trae CLI는 ACP `mcpServers`로 받습니다. OpenCode는 `OPENCODE_CONFIG_CONTENT` 환경 변수로 인라인 구성을 받고, OpenClaw는 Multica의 작업별 config wrapper를 통해 `mcp.servers`를 받습니다. OpenCode 경로는 프로젝트의 `opencode.json`을 다시 쓰지 않습니다.
 
 <Callout type="warning">
 에이전트 구성에서 `mcp_config`를 설정했더라도 MCP 열에 ✅가 없는 도구를 선택하면, MCP 서버가 해당 에이전트에 **아무런 효과**도 미치지 않습니다. MCP 연동은 도구별로 구현됩니다.
@@ -119,6 +124,7 @@ Alibaba에서 제공합니다. 에이전트형 코딩 CLI입니다. stdio 위에
 | OpenCode | `.opencode/skills/` | ✅ 기본 |
 | Pi | `.pi/skills/` | ✅ 기본 |
 | Qoder | `.qoder/skills/` | ✅ 기본 |
+| Trae CLI | `.traecli/skills/` | ✅ 기본 |
 | Antigravity | `.agents/skills/` | ✅ 기본 (Gemini CLI의 워크스페이스 레이아웃을 따름 — [Antigravity 문서](https://antigravity.google/docs/gcli-migration) 참고) |
 | Hermes | `.agent_context/skills/` | ⚠️ 범용 fallback |
 | OpenClaw | `.agent_context/skills/` | ⚠️ 범용 fallback |
@@ -134,4 +140,4 @@ fallback 경로를 쓰는 도구가 실제로 이 디렉터리를 읽는지는 
 - [에이전트 생성 및 구성](/agents-create) — 에이전트에 사용할 도구를 선택하세요
 - [작업](/tasks) — 작업 생명주기와 세션 재개 메커니즘
 - [데몬과 런타임](/daemon-runtimes) — 도구가 실행되는 곳과 Multica에 연결되는 방식
-- [에이전트 런타임 설치](/install-agent-runtime) — 지원되는 13개 도구 각각의 설치 및 인증
+- [에이전트 런타임 설치](/install-agent-runtime) — 지원되는 14개 도구 각각의 설치 및 인증
diff --git a/apps/docs/content/docs/providers.zh.mdx b/apps/docs/content/docs/providers.zh.mdx
index 7cdb1c91911..d2359a57add 100644
--- a/apps/docs/content/docs/providers.zh.mdx
+++ b/apps/docs/content/docs/providers.zh.mdx
@@ -1,11 +1,11 @@
 ---
 title: AI 编程工具对照
-description: Multica 支持 13 款 AI 编程工具；它们实现同一套接口，但能力细节差异很大。
+description: Multica 支持 14 款 AI 编程工具；它们实现同一套接口，但能力细节差异很大。
 ---
 
 import { Callout } from "fumadocs-ui/components/callout";
 
-Multica 内置支持 **13 款 AI 编程工具**。它们都实现了同一套接口——排队、派发、执行、结果回传，所以你可以从 Multica 的同一个看板上指挥任意一款。**但它们在能力细节上差异很大**：会话恢复是否真用、是否支持 MCP、skill 文件该放在哪里、模型怎么选。这一页是完整对照。
+Multica 内置支持 **14 款 AI 编程工具**。它们都实现了同一套接口——排队、派发、执行、结果回传，所以你可以从 Multica 的同一个看板上指挥任意一款。**但它们在能力细节上差异很大**：会话恢复是否真用、是否支持 MCP、skill 文件该放在哪里、模型怎么选。这一页是完整对照。
 
 创建智能体时挑选工具的指引见 [创建和配置智能体](/agents-create)。
 
@@ -26,6 +26,7 @@ Multica 内置支持 **13 款 AI 编程工具**。它们都实现了同一套接
 | **OpenClaw** | 开源项目 | ✅ | ✅ | `.agent_context/skills/` （fallback）| 绑定在智能体上，不能在任务里切换 |
 | **Pi** | Inflection AI | ✅（session 为文件路径）| ❌ | `.pi/skills/` | 动态发现 |
 | **Qoder** | Alibaba | ✅ | ✅ | `.qoder/skills/` | 动态发现 |
+| **Trae CLI** | ByteDance | ✅（ACP `session/load`）| ✅ | `.traecli/skills/` | 动态发现 |
 
 ## 每款工具的定位
 
@@ -89,15 +90,19 @@ Inflection AI 出品，极简主义。**会话恢复机制特殊**——session
 
 Alibaba 出品。一款 agentic 编程 CLI。使用 ACP 协议（和 Hermes、Kimi、Kiro CLI 共享传输层）。会话恢复通过 ACP `session/resume` 工作，MCP 配置通过 ACP `mcpServers` 传入，模型为动态发现，skill 复制到 `.qoder/skills/` 做原生发现。
 
+### Trae
+
+ByteDance 官方 TRAE CLI（`traecli`，搭配 Trae IDE，**不是**开源的 `bytedance/trae-agent`）。它是 ACP 原生工具，Multica 通过 `traecli acp serve --yolo` 在 stdio 上驱动它，传输层和 Kiro、Qoder 相同。会话恢复通过 ACP `session/load` 工作，MCP 配置通过 ACP `mcpServers` 传入，模型为动态发现并可通过 `session/set_model` 在任务中切换，skill 复制到 `.traecli/skills/`。
+
 ## 会话恢复：谁真的支持
 
 会话恢复的机制在 [执行任务](/tasks#任务能接着上次的上下文继续吗) 里讲过。**所有支持的工具都能恢复会话**——传 resume id，任务就会从上次的上下文接着继续。唯一的特例是 Pi：它的 resume id 是磁盘上的会话文件路径，而不是字符串 ID（见上文 [Pi](#pi)）。
 
 ## MCP 配置：按工具不同
 
-**13 款工具里有 10 款实际消费 `mcp_config`：Claude Code、CodeBuddy、Codex、Cursor、Hermes、Kimi、Kiro CLI、OpenCode、OpenClaw、Qoder**。其他 3 款会接收这个字段但**忽略**——不报错、不警告，只是配置不生效。
+**14 款工具里有 11 款实际消费 `mcp_config`：Claude Code、CodeBuddy、Codex、Cursor、Hermes、Kimi、Kiro CLI、OpenCode、OpenClaw、Qoder、Trae CLI**。其他 3 款会接收这个字段但**忽略**——不报错、不警告，只是配置不生效。
 
-各工具的接入方式不同：Claude Code 和 CodeBuddy 通过 `--mcp-config` 加 `--strict-mcp-config` 接收；Codex 会把 daemon 管理的 `mcp_servers` block 写入单次任务的 `$CODEX_HOME/config.toml`；Cursor 会写入 `.cursor/mcp.json`，并把项目 approval 写到单次任务的 `CURSOR_DATA_DIR`；Hermes、Kimi、Kiro CLI、Qoder 通过 ACP `mcpServers` 接收；OpenCode 通过 `OPENCODE_CONFIG_CONTENT` 环境变量内联接收；OpenClaw 通过 Multica 的单次任务配置 wrapper 接收 `mcp.servers`。OpenCode 这条路径**不会**改写项目里的 `opencode.json`。
+各工具的接入方式不同：Claude Code 和 CodeBuddy 通过 `--mcp-config` 加 `--strict-mcp-config` 接收；Codex 会把 daemon 管理的 `mcp_servers` block 写入单次任务的 `$CODEX_HOME/config.toml`；Cursor 会写入 `.cursor/mcp.json`，并把项目 approval 写到单次任务的 `CURSOR_DATA_DIR`；Hermes、Kimi、Kiro CLI、Qoder、Trae CLI 通过 ACP `mcpServers` 接收；OpenCode 通过 `OPENCODE_CONFIG_CONTENT` 环境变量内联接收；OpenClaw 通过 Multica 的单次任务配置 wrapper 接收 `mcp.servers`。OpenCode 这条路径**不会**改写项目里的 `opencode.json`。
 
 <Callout type="warning">
 如果你在智能体配置里设置了 `mcp_config`，但选了矩阵 MCP 列没有标 ✅ 的工具，你的 MCP server 对这个智能体**没有效果**。MCP 集成是按工具实现的。
@@ -119,6 +124,7 @@ Alibaba 出品。一款 agentic 编程 CLI。使用 ACP 协议（和 Hermes、Ki
 | OpenCode | `.opencode/skills/` | ✅ 原生 |
 | Pi | `.pi/skills/` | ✅ 原生 |
 | Qoder | `.qoder/skills/` | ✅ 原生 |
+| Trae CLI | `.traecli/skills/` | ✅ 原生 |
 | Antigravity | `.agents/skills/` | ✅ 原生（沿用 Gemini CLI 的 workspace 布局——见 [Antigravity 文档](https://antigravity.google/docs/gcli-migration)）|
 | Hermes | `.agent_context/skills/` | ⚠️ 通用 fallback |
 | OpenClaw | `.agent_context/skills/` | ⚠️ 通用 fallback |
diff --git a/apps/docs/content/docs/skills.ja.mdx b/apps/docs/content/docs/skills.ja.mdx
index decc464fe22..d2025abac4c 100644
--- a/apps/docs/content/docs/skills.ja.mdx
+++ b/apps/docs/content/docs/skills.ja.mdx
@@ -70,4 +70,4 @@ GitHub や ClawHub からインポートしたスキルには、スクリプト
 
 - [デーモンとランタイム](/daemon-runtimes) — エージェントが実際に実行される場所、そしてオンラインとオフラインの見分け方
 - [タスクの実行](/tasks) — 1 回の「エージェント作業セッション」の全ライフサイクル
-- [AI コーディングツール比較](/providers) — 12 ツール全体の比較（各ツールのスキル注入パスを含む）
+- [AI コーディングツール比較](/providers) — 14 ツール全体の比較（各ツールのスキル注入パスを含む）
diff --git a/apps/docs/content/docs/skills.ko.mdx b/apps/docs/content/docs/skills.ko.mdx
index c94aa798032..f6c9f2b0bb1 100644
--- a/apps/docs/content/docs/skills.ko.mdx
+++ b/apps/docs/content/docs/skills.ko.mdx
@@ -70,4 +70,4 @@ GitHub나 ClawHub에서 가져온 스킬에는 스크립트와 실행 가능한
 
 - [데몬과 런타임](/daemon-runtimes) — 에이전트가 실제로 실행되는 곳, 그리고 온라인과 오프라인을 구분하는 방법
 - [작업 실행하기](/tasks) — 한 번의 "에이전트 작업 세션"의 전체 수명 주기
-- [AI 코딩 도구 비교](/providers) — 12개 도구 전체 비교(각 도구의 스킬 주입 경로 포함)
+- [AI 코딩 도구 비교](/providers) — 14개 도구 전체 비교(각 도구의 스킬 주입 경로 포함)
diff --git a/apps/docs/content/docs/skills.zh.mdx b/apps/docs/content/docs/skills.zh.mdx
index 9f7626f87ad..722cd2cf3dc 100644
--- a/apps/docs/content/docs/skills.zh.mdx
+++ b/apps/docs/content/docs/skills.zh.mdx
@@ -70,4 +70,4 @@ Skill 导入后需要**挂载到具体的智能体**才会生效。一个智能
 
 - [守护进程与运行时](/daemon-runtimes) —— 智能体到底跑在哪、怎么判断在线 / 离线
 - [执行任务](/tasks) —— 一次"智能体工作"的完整生命周期
-- [AI 编程工具对照](/providers) —— 12 款工具的完整对比（含每款的 Skill 注入路径）
+- [AI 编程工具对照](/providers) —— 14 款工具的完整对比（含每款的 Skill 注入路径）
diff --git a/apps/docs/content/docs/tasks.ja.mdx b/apps/docs/content/docs/tasks.ja.mdx
index 89af56f20a3..7c68a8c532a 100644
--- a/apps/docs/content/docs/tasks.ja.mdx
+++ b/apps/docs/content/docs/tasks.ja.mdx
@@ -112,5 +112,5 @@ Multica はタスク中にセッション ID を**2 回**固定します: 開始
 
 ## 次へ
 
-- [プロバイダー対応表](/providers) — 12 個の AI コーディングツール間の機能差（正確なセッション再開の状態を含む）
+- [プロバイダー対応表](/providers) — 14 個の AI コーディングツール間の機能差（正確なセッション再開の状態を含む）
 - [エージェントへのイシューの割り当て](/assigning-issues) / [コメントでのエージェントの @-メンション](/mentioning-agents) / [チャット](/chat) / [オートパイロット](/autopilots) — タスクをトリガーする 4 つの方法
diff --git a/apps/docs/content/docs/tasks.ko.mdx b/apps/docs/content/docs/tasks.ko.mdx
index a83fb5b1288..c2bfe9c06fc 100644
--- a/apps/docs/content/docs/tasks.ko.mdx
+++ b/apps/docs/content/docs/tasks.ko.mdx
@@ -112,5 +112,5 @@ Multica는 작업 중에 세션 ID를 **두 번** 고정합니다: 시작 시 
 
 ## 다음
 
-- [제공자 매트릭스](/providers) — 12개 AI 코딩 도구 간의 기능 차이(정확한 세션 재개 상태 포함)
+- [제공자 매트릭스](/providers) — 14개 AI 코딩 도구 간의 기능 차이(정확한 세션 재개 상태 포함)
 - [에이전트에게 이슈 할당하기](/assigning-issues) / [댓글에서 에이전트 @-멘션하기](/mentioning-agents) / [채팅](/chat) / [오토파일럿](/autopilots) — 작업을 트리거하는 네 가지 방법
diff --git a/apps/docs/content/docs/tasks.zh.mdx b/apps/docs/content/docs/tasks.zh.mdx
index 2d40de6a720..0e2ecf1ee47 100644
--- a/apps/docs/content/docs/tasks.zh.mdx
+++ b/apps/docs/content/docs/tasks.zh.mdx
@@ -114,5 +114,5 @@ Multica 在任务过程中**两次**保存会话 ID——任务一开始（AI 
 
 ## 下一步
 
-- [Providers Matrix](/providers) —— 12 款 AI 编程工具的能力差异对照（包括会话恢复的精确状态）
+- [Providers Matrix](/providers) —— 14 款 AI 编程工具的能力差异对照（包括会话恢复的精确状态）
 - [分配 issue 给智能体](/assigning-issues) / [在评论里 @智能体](/mentioning-agents) / [聊天](/chat) / [Autopilots](/autopilots) —— 触发执行任务的四种方式
diff --git a/apps/web/features/landing/i18n/en.ts b/apps/web/features/landing/i18n/en.ts
index d4cf6bb63f7..5d8d13dfedc 100644
--- a/apps/web/features/landing/i18n/en.ts
+++ b/apps/web/features/landing/i18n/en.ts
@@ -101,7 +101,7 @@ export function createEnDict(allowSignup: boolean): LandingDict {
       label: "RUNTIMES",
       title: "One dashboard for all your compute",
       description:
-        "Local daemons and cloud runtimes, managed from a single panel. Real-time monitoring of online/offline status, usage charts, and activity heatmaps. Auto-detects 12 supported coding tools on your machine.",
+        "Local daemons and cloud runtimes, managed from a single panel. Real-time monitoring of online/offline status, usage charts, and activity heatmaps. Auto-detects 14 supported coding tools on your machine.",
       cards: [
         {
           title: "Unified runtime panel",
@@ -116,7 +116,7 @@ export function createEnDict(allowSignup: boolean): LandingDict {
         {
           title: "Auto-detection on first run",
           description:
-            "Multica scans for 12 supported coding tools \u2014 Antigravity, Claude Code, Codex, Cursor, Copilot, Gemini, Hermes, Kimi, Kiro CLI, OpenCode, OpenClaw, and Pi \u2014 and registers a runtime for each one it finds.",
+            "Multica scans for 14 supported coding tools \u2014 Antigravity, Claude Code, CodeBuddy, Codex, Cursor, Copilot, Hermes, Kimi, Kiro CLI, OpenCode, OpenClaw, Pi, Qoder, and Trae CLI \u2014 and registers a runtime for each one it finds.",
         },
       ],
     },
@@ -136,7 +136,7 @@ export function createEnDict(allowSignup: boolean): LandingDict {
       {
         title: "Install the CLI & connect your machine",
         description:
-          "Run multica setup \u2014 it walks you through OAuth, starts the daemon, and scans for the 12 supported coding tools (Antigravity, Claude Code, Codex, Cursor, Copilot, Gemini, Hermes, Kimi, Kiro CLI, OpenCode, OpenClaw, Pi). Whichever ones you already have installed get registered as runtimes automatically.",
+          "Run multica setup \u2014 it walks you through OAuth, starts the daemon, and scans for the 14 supported coding tools (Antigravity, Claude Code, CodeBuddy, Codex, Cursor, Copilot, Hermes, Kimi, Kiro CLI, OpenCode, OpenClaw, Pi, Qoder, Trae CLI). Whichever ones you already have installed get registered as runtimes automatically.",
       },
       {
         title: "Create your first agent",
@@ -192,7 +192,7 @@ export function createEnDict(allowSignup: boolean): LandingDict {
       {
         question: "What coding agents does Multica support?",
         answer:
-          "Multica supports 12 coding tools out of the box: Antigravity, Claude Code, Codex, Cursor, Copilot, Gemini, Hermes, Kimi, Kiro CLI, OpenCode, OpenClaw, and Pi. The daemon auto-detects whichever CLIs you already have installed and registers a runtime for each one. Since it's open source, you can also add your own backends.",
+          "Multica supports 14 coding tools out of the box: Antigravity, Claude Code, CodeBuddy, Codex, Cursor, Copilot, Hermes, Kimi, Kiro CLI, OpenCode, OpenClaw, Pi, Qoder, and Trae CLI. The daemon auto-detects whichever CLIs you already have installed and registers a runtime for each one. Since it's open source, you can also add your own backends.",
       },
       {
         question: "Do I need to self-host, or is there a cloud version?",
diff --git a/apps/web/features/landing/i18n/ja.ts b/apps/web/features/landing/i18n/ja.ts
index 1be6d9570fc..a2397251f20 100644
--- a/apps/web/features/landing/i18n/ja.ts
+++ b/apps/web/features/landing/i18n/ja.ts
@@ -118,7 +118,7 @@ export function createJaDict(allowSignup: boolean): LandingDict {
           {
             title: "初回起動時に自動検出",
             description:
-              "Multica は Antigravity、Claude Code、Codex、Cursor、Copilot、Gemini、Hermes、Kimi、Kiro CLI、OpenCode、OpenClaw、Pi という12種類の対応ツールをスキャンし、見つかったものをそれぞれランタイムとして登録します。",
+              "Multica は Antigravity、Claude Code、CodeBuddy、Codex、Cursor、Copilot、Hermes、Kimi、Kiro CLI、OpenCode、OpenClaw、Pi、Qoder、Trae CLI という14種類の対応ツールをスキャンし、見つかったものをそれぞれランタイムとして登録します。",
           },
         ],
       },
@@ -139,7 +139,7 @@ export function createJaDict(allowSignup: boolean): LandingDict {
         {
           title: "CLI をインストールしてマシンを接続",
           description:
-            "multica setup を実行すると、OAuth の手順を案内し、デーモンを起動し、12種類の対応コーディングツール(Antigravity、Claude Code、Codex、Cursor、Copilot、Gemini、Hermes、Kimi、Kiro CLI、OpenCode、OpenClaw、Pi)をスキャンします。すでにインストール済みのものは、自動的にランタイムとして登録されます。",
+            "multica setup を実行すると、OAuth の手順を案内し、デーモンを起動し、14種類の対応コーディングツール(Antigravity、Claude Code、CodeBuddy、Codex、Cursor、Copilot、Hermes、Kimi、Kiro CLI、OpenCode、OpenClaw、Pi、Qoder、Trae CLI)をスキャンします。すでにインストール済みのものは、自動的にランタイムとして登録されます。",
         },
         {
           title: "最初のエージェントを作成",
@@ -193,7 +193,7 @@ export function createJaDict(allowSignup: boolean): LandingDict {
         {
           question: "Multica はどのコーディングエージェントに対応していますか?",
           answer:
-            "Multica は、Antigravity、Claude Code、Codex、Cursor、Copilot、Gemini、Hermes、Kimi、Kiro CLI、OpenCode、OpenClaw、Pi の12種類のコーディングツールに標準対応しています。デーモンが、すでにインストール済みの CLI を自動検出し、それぞれをランタイムとして登録します。オープンソースなので、独自のバックエンドを追加することもできます。",
+            "Multica は、Antigravity、Claude Code、CodeBuddy、Codex、Cursor、Copilot、Hermes、Kimi、Kiro CLI、OpenCode、OpenClaw、Pi、Qoder、Trae CLI の14種類のコーディングツールに標準対応しています。デーモンが、すでにインストール済みの CLI を自動検出し、それぞれをランタイムとして登録します。オープンソースなので、独自のバックエンドを追加することもできます。",
         },
         {
           question: "セルフホストが必須ですか、それともクラウド版もありますか?",
diff --git a/apps/web/features/landing/i18n/ko.ts b/apps/web/features/landing/i18n/ko.ts
index 7fd1b7391dc..e408a0e7a6d 100644
--- a/apps/web/features/landing/i18n/ko.ts
+++ b/apps/web/features/landing/i18n/ko.ts
@@ -118,7 +118,7 @@ export function createKoDict(allowSignup: boolean): LandingDict {
           {
             title: "처음 실행할 때 자동 등록",
             description:
-              "Multica는 Claude Code, Codex, Cursor, Copilot, Gemini, Hermes, Kimi, Kiro CLI, OpenCode, OpenClaw, Pi 등 지원 도구를 스캔해 이미 설치된 것을 런타임으로 자동 등록합니다.",
+              "Multica는 Antigravity, Claude Code, CodeBuddy, Codex, Cursor, Copilot, Hermes, Kimi, Kiro CLI, OpenCode, OpenClaw, Pi, Qoder, Trae CLI 등 14개 지원 도구를 스캔해 이미 설치된 것을 런타임으로 자동 등록합니다.",
           },
         ],
       },
@@ -193,7 +193,7 @@ export function createKoDict(allowSignup: boolean): LandingDict {
         {
           question: "Multica는 어떤 코딩 에이전트를 지원하나요?",
           answer:
-            "Multica는 Claude Code, Codex, Cursor, Copilot, Gemini, Hermes, Kimi, Kiro CLI, OpenCode, OpenClaw, Pi 등 11개 코딩 도구를 기본 지원합니다. 데몬이 이미 설치된 CLI를 자동으로 찾아 각각 런타임으로 등록합니다. 오픈소스이므로 직접 백엔드를 추가할 수도 있습니다.",
+            "Multica는 Antigravity, Claude Code, CodeBuddy, Codex, Cursor, Copilot, Hermes, Kimi, Kiro CLI, OpenCode, OpenClaw, Pi, Qoder, Trae CLI 등 14개 코딩 도구를 기본 지원합니다. 데몬이 이미 설치된 CLI를 자동으로 찾아 각각 런타임으로 등록합니다. 오픈소스이므로 직접 백엔드를 추가할 수도 있습니다.",
         },
         {
           question: "셀프 호스팅만 가능한가요, 클라우드 버전도 있나요?",
diff --git a/apps/web/features/landing/i18n/zh.ts b/apps/web/features/landing/i18n/zh.ts
index ab15827deba..4d129dda3f0 100644
--- a/apps/web/features/landing/i18n/zh.ts
+++ b/apps/web/features/landing/i18n/zh.ts
@@ -101,7 +101,7 @@ export function createZhDict(allowSignup: boolean): LandingDict {
       label: "\u8fd0\u884c\u65f6",
       title: "\u4e00\u4e2a\u63a7\u5236\u53f0\u7ba1\u7406\u6240\u6709\u7b97\u529b",
       description:
-        "\u672c\u5730\u5b88\u62a4\u8fdb\u7a0b\u548c\u4e91\u7aef\u8fd0\u884c\u65f6\uff0c\u5728\u540c\u4e00\u4e2a\u9762\u677f\u4e2d\u7ba1\u7406\u3002\u5b9e\u65f6\u76d1\u63a7\u5728\u7ebf/\u79bb\u7ebf\u72b6\u6001\u3001\u4f7f\u7528\u91cf\u56fe\u8868\u548c\u6d3b\u52a8\u70ed\u529b\u56fe\u3002\u81ea\u52a8\u68c0\u6d4b\u672c\u673a\u5df2\u5b89\u88c5\u7684 12 \u6b3e\u652f\u6301\u7684 AI \u7f16\u7a0b\u5de5\u5177\u3002",
+        "\u672c\u5730\u5b88\u62a4\u8fdb\u7a0b\u548c\u4e91\u7aef\u8fd0\u884c\u65f6\uff0c\u5728\u540c\u4e00\u4e2a\u9762\u677f\u4e2d\u7ba1\u7406\u3002\u5b9e\u65f6\u76d1\u63a7\u5728\u7ebf/\u79bb\u7ebf\u72b6\u6001\u3001\u4f7f\u7528\u91cf\u56fe\u8868\u548c\u6d3b\u52a8\u70ed\u529b\u56fe\u3002\u81ea\u52a8\u68c0\u6d4b\u672c\u673a\u5df2\u5b89\u88c5\u7684 14 \u6b3e\u652f\u6301\u7684 AI \u7f16\u7a0b\u5de5\u5177\u3002",
       cards: [
         {
           title: "\u7edf\u4e00\u8fd0\u884c\u65f6\u9762\u677f",
@@ -116,7 +116,7 @@ export function createZhDict(allowSignup: boolean): LandingDict {
         {
           title: "\u9996\u6b21\u542f\u52a8\u81ea\u52a8\u6ce8\u518c",
           description:
-            "Multica \u626b\u63cf\u672c\u673a\u7684 12 \u6b3e\u652f\u6301\u7684 AI \u7f16\u7a0b\u5de5\u5177\u2014\u2014Antigravity\u3001Claude Code\u3001Codex\u3001Cursor\u3001Copilot\u3001Gemini\u3001Hermes\u3001Kimi\u3001Kiro CLI\u3001OpenCode\u3001OpenClaw\u3001Pi\u2014\u2014\u5e76\u4e3a\u6bcf\u6b3e\u5df2\u5b89\u88c5\u7684\u5de5\u5177\u6ce8\u518c\u4e00\u4e2a\u8fd0\u884c\u65f6\u3002",
+            "Multica \u626b\u63cf\u672c\u673a\u7684 14 \u6b3e\u652f\u6301\u7684 AI \u7f16\u7a0b\u5de5\u5177\u2014\u2014Antigravity\u3001Claude Code\u3001CodeBuddy\u3001Codex\u3001Cursor\u3001Copilot\u3001Hermes\u3001Kimi\u3001Kiro CLI\u3001OpenCode\u3001OpenClaw\u3001Pi\u3001Qoder\u3001Trae CLI\u2014\u2014\u5e76\u4e3a\u6bcf\u6b3e\u5df2\u5b89\u88c5\u7684\u5de5\u5177\u6ce8\u518c\u4e00\u4e2a\u8fd0\u884c\u65f6\u3002",
         },
       ],
     },
@@ -136,7 +136,7 @@ export function createZhDict(allowSignup: boolean): LandingDict {
       {
         title: "\u5b89\u88c5 CLI \u5e76\u8fde\u63a5\u4f60\u7684\u673a\u5668",
         description:
-          "运行 multica setup——它会引导你完成 OAuth 登录、启动守护进程、并扫描 12 款支持的 AI 编程工具（Antigravity、Claude Code、Codex、Cursor、Copilot、Gemini、Hermes、Kimi、Kiro CLI、OpenCode、OpenClaw、Pi）。本机已安装的工具会被自动注册成运行时。",
+          "运行 multica setup——它会引导你完成 OAuth 登录、启动守护进程、并扫描 14 款支持的 AI 编程工具（Antigravity、Claude Code、CodeBuddy、Codex、Cursor、Copilot、Hermes、Kimi、Kiro CLI、OpenCode、OpenClaw、Pi、Qoder、Trae CLI）。本机已安装的工具会被自动注册成运行时。",
       },
       {
         title: "\u521b\u5efa\u4f60\u7684\u7b2c\u4e00\u4e2a 智能体",
@@ -192,7 +192,7 @@ export function createZhDict(allowSignup: boolean): LandingDict {
       {
         question: "Multica \u652f\u6301\u54ea\u4e9b\u7f16\u7801 智能体\uff1f",
         answer:
-          "Multica \u5f00\u7bb1\u5373\u7528\u652f\u6301 12 \u6b3e AI \u7f16\u7a0b\u5de5\u5177\uff1aAntigravity\u3001Claude Code\u3001Codex\u3001Cursor\u3001Copilot\u3001Gemini\u3001Hermes\u3001Kimi\u3001Kiro CLI\u3001OpenCode\u3001OpenClaw\u3001Pi\u3002\u5b88\u62a4\u8fdb\u7a0b\u4f1a\u81ea\u52a8\u68c0\u6d4b\u672c\u673a\u5df2\u5b89\u88c5\u7684 CLI \u5e76\u4e3a\u6bcf\u6b3e\u6ce8\u518c\u4e00\u4e2a\u8fd0\u884c\u65f6\u3002\u56e0\u4e3a\u5f00\u6e90\uff0c\u4f60\u4e5f\u53ef\u4ee5\u81ea\u5df1\u6dfb\u52a0\u540e\u7aef\u3002",
+          "Multica \u5f00\u7bb1\u5373\u7528\u652f\u6301 14 \u6b3e AI \u7f16\u7a0b\u5de5\u5177\uff1aAntigravity\u3001Claude Code\u3001CodeBuddy\u3001Codex\u3001Cursor\u3001Copilot\u3001Hermes\u3001Kimi\u3001Kiro CLI\u3001OpenCode\u3001OpenClaw\u3001Pi\u3001Qoder\u3001Trae CLI\u3002\u5b88\u62a4\u8fdb\u7a0b\u4f1a\u81ea\u52a8\u68c0\u6d4b\u672c\u673a\u5df2\u5b89\u88c5\u7684 CLI \u5e76\u4e3a\u6bcf\u6b3e\u6ce8\u518c\u4e00\u4e2a\u8fd0\u884c\u65f6\u3002\u56e0\u4e3a\u5f00\u6e90\uff0c\u4f60\u4e5f\u53ef\u4ee5\u81ea\u5df1\u6dfb\u52a0\u540e\u7aef\u3002",
       },
       {
         question: "\u9700\u8981\u81ea\u6258\u7ba1\u5417\uff0c\u8fd8\u662f\u6709\u4e91\u7248\u672c\uff1f",

From f67f0bc9d8b87b67c7d4b995ece9e8c86d5e4a9c Mon Sep 17 00:00:00 2001
From: Multica Eve <eve@devv.ai>
Date: Mon, 6 Jul 2026 15:58:38 +0800
Subject: [PATCH 09/15] fix: block claude settings flag for antigravity (#4974)

Co-authored-by: Eve <eve@multica-ai.local>
Co-authored-by: multica-agent <github@multica.ai>
---
 server/pkg/agent/antigravity.go      |  1 +
 server/pkg/agent/antigravity_test.go | 10 +++++++++-
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/server/pkg/agent/antigravity.go b/server/pkg/agent/antigravity.go
index c3e3e578c95..af842309f13 100644
--- a/server/pkg/agent/antigravity.go
+++ b/server/pkg/agent/antigravity.go
@@ -420,6 +420,7 @@ var antigravityBlockedArgs = map[string]blockedArgMode{
 	"--print-timeout":                blockedWithValue,
 	"--dangerously-skip-permissions": blockedStandalone, // always-on in daemon mode
 	"--log-file":                     blockedWithValue,  // daemon needs it for session capture
+	"--settings":                     blockedWithValue,  // Claude Code-only flag; agy rejects it
 }
 
 // buildAntigravityArgs assembles the argv for a daemon-compatible one-shot agy
diff --git a/server/pkg/agent/antigravity_test.go b/server/pkg/agent/antigravity_test.go
index 4393d364e07..7e55df64f8f 100644
--- a/server/pkg/agent/antigravity_test.go
+++ b/server/pkg/agent/antigravity_test.go
@@ -214,9 +214,13 @@ func TestBuildAntigravityArgsFiltersBlockedCustomArgs(t *testing.T) {
 		"/tmp/agy.log",
 		time.Minute,
 		ExecOptions{
+			ExtraArgs: []string{
+				"--settings", "/tmp/biz-gate.json", // Claude Code-only daemon/profile arg; agy rejects it
+			},
 			// Each blocked flag below must be stripped silently — the daemon
 			// owns these because they're required for non-interactive,
-			// resume-aware operation.
+			// resume-aware operation, or because the flag is unsupported by
+			// Antigravity.
 			CustomArgs: []string{
 				"-p", "hijacked-prompt",
 				"-i",
@@ -228,6 +232,7 @@ func TestBuildAntigravityArgsFiltersBlockedCustomArgs(t *testing.T) {
 				"--dangerously-skip-permissions",
 				"--print-timeout", "1h",
 				"--log-file", "/elsewhere.log",
+				"--settings=/tmp/agent-settings.json",
 				"--add-dir", "/extra", // user-added workspace dir should survive
 			},
 		},
@@ -261,6 +266,9 @@ func TestBuildAntigravityArgsFiltersBlockedCustomArgs(t *testing.T) {
 	if strings.Contains(joined, "/elsewhere.log") {
 		t.Errorf("custom --log-file value leaked through filter: %v", args)
 	}
+	if strings.Contains(joined, "--settings") || strings.Contains(joined, "biz-gate.json") || strings.Contains(joined, "agent-settings.json") {
+		t.Errorf("Antigravity-incompatible --settings flag leaked through filter: %v", args)
+	}
 	if !strings.Contains(joined, "--add-dir /extra") {
 		t.Errorf("non-blocked --add-dir flag should pass through: %v", args)
 	}

From 083e045ec617b6c6117eed650207e98be24090d2 Mon Sep 17 00:00:00 2001
From: Multica Eve <eve@devv.ai>
Date: Mon, 6 Jul 2026 16:14:03 +0800
Subject: [PATCH 10/15] MUL-4103: harden Windows browser MCP config (#4976)

* fix: harden Windows browser MCP config

Co-authored-by: multica-agent <github@multica.ai>

* fix: address browser mcp review nits

Co-authored-by: multica-agent <github@multica.ai>

---------

Co-authored-by: Eve <eve@multica-ai.local>
Co-authored-by: multica-agent <github@multica.ai>
---
 server/pkg/agent/browser_mcp_config.go      | 205 ++++++++++++++++++++
 server/pkg/agent/browser_mcp_config_test.go | 189 ++++++++++++++++++
 server/pkg/agent/claude.go                  |  40 ++--
 server/pkg/agent/claude_test.go             |   6 +-
 server/pkg/agent/codebuddy.go               |   5 +-
 5 files changed, 425 insertions(+), 20 deletions(-)
 create mode 100644 server/pkg/agent/browser_mcp_config.go
 create mode 100644 server/pkg/agent/browser_mcp_config_test.go

diff --git a/server/pkg/agent/browser_mcp_config.go b/server/pkg/agent/browser_mcp_config.go
new file mode 100644
index 00000000000..a48ef162a4f
--- /dev/null
+++ b/server/pkg/agent/browser_mcp_config.go
@@ -0,0 +1,205 @@
+package agent
+
+import (
+	"encoding/json"
+	"fmt"
+	"os"
+	"path/filepath"
+	"runtime"
+	"strings"
+)
+
+var (
+	browserMcpGOOS = runtime.GOOS
+	browserMcpStat = os.Stat
+	browserMcpEnv  = os.Getenv
+)
+
+func hardenBrowserMcpConfig(raw json.RawMessage, tempDir string) ([]byte, error) {
+	if browserMcpGOOS != "windows" {
+		return raw, nil
+	}
+	return hardenWindowsBrowserMcpConfig(raw, tempDir)
+}
+
+func hardenWindowsBrowserMcpConfig(raw json.RawMessage, tempDir string) ([]byte, error) {
+	var top map[string]json.RawMessage
+	if err := json.Unmarshal(raw, &top); err != nil {
+		return raw, nil
+	}
+	serversRaw, ok := top["mcpServers"]
+	if !ok {
+		return raw, nil
+	}
+	var servers map[string]json.RawMessage
+	if err := json.Unmarshal(serversRaw, &servers); err != nil {
+		return raw, nil
+	}
+
+	changed := false
+	for name, serverRaw := range servers {
+		var entry map[string]any
+		if err := json.Unmarshal(serverRaw, &entry); err != nil {
+			continue
+		}
+		args, ok := stringSlice(entry["args"])
+		if !ok {
+			continue
+		}
+
+		lowerName := strings.ToLower(name)
+		switch {
+		case lowerName == "playwright" || argsContain(args, "@playwright/mcp") || argsContain(args, `@playwright\mcp`):
+			nextArgs, err := hardenWindowsPlaywrightMcpArgs(args, tempDir)
+			if err != nil {
+				return nil, err
+			}
+			if !sameStringSlice(args, nextArgs) {
+				entry["args"] = nextArgs
+				servers[name], changed = mustMarshalRaw(entry), true
+			}
+		case lowerName == "chrome-devtools" || argsContain(args, "chrome-devtools-mcp"):
+			if path, ok := windowsChromiumFallbackExecutable(); ok && shouldPinChromeDevToolsExecutable(args) {
+				entry["args"] = append(args, "--executablePath="+path)
+				servers[name], changed = mustMarshalRaw(entry), true
+			}
+		}
+	}
+	if !changed {
+		return raw, nil
+	}
+
+	top["mcpServers"] = mustMarshalRaw(servers)
+	data, err := json.Marshal(top)
+	if err != nil {
+		return nil, fmt.Errorf("marshal hardened mcp config: %w", err)
+	}
+	return data, nil
+}
+
+func hardenWindowsPlaywrightMcpArgs(args []string, tempDir string) ([]string, error) {
+	if hasFlag(args, "--config") || hasFlag(args, "--cdp-endpoint") || hasFlag(args, "--extension") {
+		return args, nil
+	}
+	configPath := filepath.Join(tempDir, "playwright-windows-browser.json")
+	config := map[string]any{
+		"browser": map[string]any{
+			"launchOptions": map[string]any{
+				"args": []string{"--disable-gpu"},
+			},
+		},
+	}
+	data, err := json.Marshal(config)
+	if err != nil {
+		return nil, fmt.Errorf("marshal playwright mcp browser config: %w", err)
+	}
+	if err := os.WriteFile(configPath, data, 0o600); err != nil {
+		return nil, fmt.Errorf("write playwright mcp browser config: %w", err)
+	}
+	return append(args, "--config", configPath), nil
+}
+
+func windowsChromiumFallbackExecutable() (string, bool) {
+	if path := strings.TrimSpace(browserMcpEnv("MULTICA_CHROME_DEVTOOLS_EXECUTABLE_PATH")); path != "" {
+		return path, true
+	}
+	for _, root := range []string{
+		browserMcpEnv("ProgramFiles(x86)"),
+		browserMcpEnv("ProgramFiles"),
+		browserMcpEnv("LocalAppData"),
+	} {
+		if strings.TrimSpace(root) == "" {
+			continue
+		}
+		path := windowsPathJoin(root, "Microsoft", "Edge", "Application", "msedge.exe")
+		if _, err := browserMcpStat(path); err == nil {
+			return path, true
+		}
+	}
+	return "", false
+}
+
+func windowsPathJoin(root string, elems ...string) string {
+	root = strings.TrimRight(root, `\/`)
+	if root == "" {
+		return ""
+	}
+	return root + `\` + strings.Join(elems, `\`)
+}
+
+func shouldPinChromeDevToolsExecutable(args []string) bool {
+	for _, flag := range []string{
+		"--executablePath",
+		"--executable-path",
+		"-e",
+		"--channel",
+		"--browserUrl",
+		"--browser-url",
+		"-u",
+		"--wsEndpoint",
+		"--ws-endpoint",
+		"-w",
+		"--autoConnect",
+		"--auto-connect",
+	} {
+		if hasFlag(args, flag) {
+			return false
+		}
+	}
+	return true
+}
+
+func stringSlice(v any) ([]string, bool) {
+	raw, ok := v.([]any)
+	if !ok {
+		return nil, false
+	}
+	out := make([]string, 0, len(raw))
+	for _, item := range raw {
+		s, ok := item.(string)
+		if !ok {
+			return nil, false
+		}
+		out = append(out, s)
+	}
+	return out, true
+}
+
+func argsContain(args []string, needle string) bool {
+	needle = strings.ToLower(needle)
+	for _, arg := range args {
+		if strings.Contains(strings.ToLower(arg), needle) {
+			return true
+		}
+	}
+	return false
+}
+
+func hasFlag(args []string, flag string) bool {
+	for _, arg := range args {
+		if arg == flag || strings.HasPrefix(arg, flag+"=") {
+			return true
+		}
+	}
+	return false
+}
+
+func sameStringSlice(a, b []string) bool {
+	if len(a) != len(b) {
+		return false
+	}
+	for i := range a {
+		if a[i] != b[i] {
+			return false
+		}
+	}
+	return true
+}
+
+func mustMarshalRaw(v any) json.RawMessage {
+	data, err := json.Marshal(v)
+	if err != nil {
+		panic(err)
+	}
+	return data
+}
diff --git a/server/pkg/agent/browser_mcp_config_test.go b/server/pkg/agent/browser_mcp_config_test.go
new file mode 100644
index 00000000000..91ad7cbdefa
--- /dev/null
+++ b/server/pkg/agent/browser_mcp_config_test.go
@@ -0,0 +1,189 @@
+package agent
+
+import (
+	"encoding/json"
+	"errors"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func withBrowserMcpTestHost(t *testing.T, goos string, env map[string]string, existing map[string]bool) {
+	t.Helper()
+	oldGOOS := browserMcpGOOS
+	oldEnv := browserMcpEnv
+	oldStat := browserMcpStat
+	browserMcpGOOS = goos
+	browserMcpEnv = func(key string) string { return env[key] }
+	browserMcpStat = func(path string) (os.FileInfo, error) {
+		if existing[path] {
+			return nil, nil
+		}
+		return nil, os.ErrNotExist
+	}
+	t.Cleanup(func() {
+		browserMcpGOOS = oldGOOS
+		browserMcpEnv = oldEnv
+		browserMcpStat = oldStat
+	})
+}
+
+func TestHardenBrowserMcpConfigNoopOffWindows(t *testing.T) {
+	t.Parallel()
+
+	raw := json.RawMessage(`{"mcpServers":{"playwright":{"command":"node","args":["@playwright/mcp","--headless"]}}}`)
+	got, err := hardenBrowserMcpConfig(raw, t.TempDir())
+	if err != nil {
+		t.Fatalf("hardenBrowserMcpConfig: %v", err)
+	}
+	if string(got) != string(raw) {
+		t.Fatalf("non-Windows config changed:\n got %s\nwant %s", got, raw)
+	}
+}
+
+func TestHardenWindowsBrowserMcpConfigAddsPlaywrightLaunchConfigAndEdgeFallback(t *testing.T) {
+	edgePath := `C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe`
+	withBrowserMcpTestHost(t, "windows", map[string]string{
+		"ProgramFiles(x86)": `C:\Program Files (x86)`,
+	}, map[string]bool{edgePath: true})
+
+	tempDir := t.TempDir()
+	raw := json.RawMessage(`{"mcpServers":{
+		"playwright":{"command":"node","args":["C:\\npm\\node_modules\\@playwright\\mcp\\cli.js","--headless","--isolated"]},
+		"chrome-devtools":{"command":"node","args":["C:\\npm\\node_modules\\chrome-devtools-mcp\\dist\\index.js","--headless","--isolated"]}
+	}}`)
+
+	got, err := hardenBrowserMcpConfig(raw, tempDir)
+	if err != nil {
+		t.Fatalf("hardenBrowserMcpConfig: %v", err)
+	}
+
+	servers := decodeMcpServers(t, got)
+	playwrightArgs := decodeArgs(t, servers["playwright"])
+	configIndex := indexOfString(playwrightArgs, "--config")
+	if configIndex < 0 || configIndex+1 >= len(playwrightArgs) {
+		t.Fatalf("playwright args missing --config path: %v", playwrightArgs)
+	}
+	configPath := playwrightArgs[configIndex+1]
+	if !strings.HasPrefix(configPath, tempDir) {
+		t.Fatalf("playwright config path %q is not under temp dir %q", configPath, tempDir)
+	}
+	configData, err := os.ReadFile(configPath)
+	if err != nil {
+		t.Fatalf("read playwright config: %v", err)
+	}
+	if !strings.Contains(string(configData), "--disable-gpu") {
+		t.Fatalf("playwright config missing --disable-gpu: %s", configData)
+	}
+
+	chromeArgs := decodeArgs(t, servers["chrome-devtools"])
+	if !contains(chromeArgs, "--executablePath="+edgePath) {
+		t.Fatalf("chrome-devtools args missing Edge executable fallback:\n%v", chromeArgs)
+	}
+}
+
+func TestHardenWindowsBrowserMcpConfigRespectsExplicitBrowserArgs(t *testing.T) {
+	withBrowserMcpTestHost(t, "windows", map[string]string{
+		"MULTICA_CHROME_DEVTOOLS_EXECUTABLE_PATH": `D:\Browsers\Chrome\chrome.exe`,
+	}, nil)
+
+	tempDir := t.TempDir()
+	raw := json.RawMessage(`{"mcpServers":{
+		"playwright":{"command":"npx","args":["@playwright/mcp@latest","--config=custom.json"]},
+		"chrome-devtools":{"command":"npx","args":["chrome-devtools-mcp@latest","-e","D:\\Browsers\\Chrome\\chrome.exe"]}
+	}}`)
+
+	got, err := hardenBrowserMcpConfig(raw, tempDir)
+	if err != nil {
+		t.Fatalf("hardenBrowserMcpConfig: %v", err)
+	}
+	if string(got) != string(raw) {
+		t.Fatalf("explicit browser args should not be changed:\n got %s\nwant %s", got, raw)
+	}
+	if entries, err := os.ReadDir(tempDir); err != nil {
+		t.Fatalf("read temp dir: %v", err)
+	} else if len(entries) != 0 {
+		t.Fatalf("explicit config should not create sidecar files: %v", entries)
+	}
+}
+
+func TestHardenWindowsBrowserMcpConfigKeepsRawOnMalformedInput(t *testing.T) {
+	withBrowserMcpTestHost(t, "windows", nil, nil)
+
+	raw := json.RawMessage(`not json`)
+	got, err := hardenBrowserMcpConfig(raw, t.TempDir())
+	if err != nil {
+		t.Fatalf("hardenBrowserMcpConfig: %v", err)
+	}
+	if string(got) != string(raw) {
+		t.Fatalf("malformed config changed: got %s want %s", got, raw)
+	}
+}
+
+func decodeMcpServers(t *testing.T, raw []byte) map[string]json.RawMessage {
+	t.Helper()
+	var top struct {
+		McpServers map[string]json.RawMessage `json:"mcpServers"`
+	}
+	if err := json.Unmarshal(raw, &top); err != nil {
+		t.Fatalf("unmarshal mcp config: %v\n%s", err, raw)
+	}
+	return top.McpServers
+}
+
+func decodeArgs(t *testing.T, raw json.RawMessage) []string {
+	t.Helper()
+	var entry struct {
+		Args []string `json:"args"`
+	}
+	if err := json.Unmarshal(raw, &entry); err != nil {
+		t.Fatalf("unmarshal mcp server: %v\n%s", err, raw)
+	}
+	return entry.Args
+}
+
+func indexOfString(items []string, item string) int {
+	for i, candidate := range items {
+		if candidate == item {
+			return i
+		}
+	}
+	return -1
+}
+
+func contains(items []string, item string) bool {
+	return indexOfString(items, item) >= 0
+}
+
+func TestWindowsChromiumFallbackExecutableSkipsMissingInstallDirs(t *testing.T) {
+	withBrowserMcpTestHost(t, "windows", map[string]string{
+		"ProgramFiles(x86)": "",
+		"ProgramFiles":      "",
+		"LocalAppData":      "",
+	}, nil)
+
+	if got, ok := windowsChromiumFallbackExecutable(); ok {
+		t.Fatalf("fallback executable = %q, want none", got)
+	}
+}
+
+func TestWindowsChromiumFallbackExecutablePropagatesOverride(t *testing.T) {
+	override := filepath.Clean(`D:\Browsers\Chromium\chrome.exe`)
+	withBrowserMcpTestHost(t, "windows", map[string]string{
+		"MULTICA_CHROME_DEVTOOLS_EXECUTABLE_PATH": override,
+	}, map[string]bool{})
+
+	got, ok := windowsChromiumFallbackExecutable()
+	if !ok || got != override {
+		t.Fatalf("fallback executable = %q, %v; want %q, true", got, ok, override)
+	}
+}
+
+func TestWithBrowserMcpTestHostUsesMissingStat(t *testing.T) {
+	withBrowserMcpTestHost(t, "windows", nil, nil)
+	_, err := browserMcpStat("missing")
+	if !errors.Is(err, os.ErrNotExist) {
+		t.Fatalf("browserMcpStat missing error = %v, want os.ErrNotExist", err)
+	}
+}
diff --git a/server/pkg/agent/claude.go b/server/pkg/agent/claude.go
index 88a05596407..e27c666c167 100644
--- a/server/pkg/agent/claude.go
+++ b/server/pkg/agent/claude.go
@@ -9,6 +9,7 @@ import (
 	"log/slog"
 	"os"
 	"os/exec"
+	"path/filepath"
 	"strings"
 	"sync"
 	"time"
@@ -46,7 +47,7 @@ func (b *claudeBackend) Execute(ctx context.Context, prompt string, opts ExecOpt
 			return nil, err
 		}
 		mcpConfigPath = path
-		mcpFileCleanup = func() { os.Remove(mcpConfigPath) }
+		mcpFileCleanup = func() { cleanupMcpConfigTemp(mcpConfigPath) }
 		args = append(args, "--mcp-config", mcpConfigPath)
 	}
 	// Clean up the temp file if we return before the goroutine takes ownership.
@@ -127,7 +128,7 @@ func (b *claudeBackend) Execute(ctx context.Context, prompt string, opts ExecOpt
 		defer close(msgCh)
 		defer close(resCh)
 		if mcpConfigPath != "" {
-			defer os.Remove(mcpConfigPath)
+			defer cleanupMcpConfigTemp(mcpConfigPath)
 		}
 
 		startTime := time.Now()
@@ -785,23 +786,36 @@ func stripSurroundingQuotes(s string) (string, bool) {
 	return s, false
 }
 
-// writeMcpConfigToTemp writes raw MCP config JSON to a temporary file and returns
-// its path. The caller is responsible for removing the file when done.
+// writeMcpConfigToTemp writes MCP config JSON to a temporary file and returns
+// its path. The caller is responsible for removing it via cleanupMcpConfigTemp.
 func writeMcpConfigToTemp(raw json.RawMessage) (string, error) {
-	f, err := os.CreateTemp("", "multica-mcp-*.json")
+	dir, err := os.MkdirTemp("", "multica-mcp-*")
 	if err != nil {
-		return "", fmt.Errorf("create mcp config temp file: %w", err)
+		return "", fmt.Errorf("create mcp config temp dir: %w", err)
 	}
-	if _, err := f.Write(raw); err != nil {
-		f.Close()
-		os.Remove(f.Name())
+	data, err := hardenBrowserMcpConfig(raw, dir)
+	if err != nil {
+		cleanupMcpConfigTemp(filepath.Join(dir, "mcp-config.json"))
+		return "", err
+	}
+	path := filepath.Join(dir, "mcp-config.json")
+	if err := os.WriteFile(path, data, 0o600); err != nil {
+		cleanupMcpConfigTemp(path)
 		return "", fmt.Errorf("write mcp config temp file: %w", err)
 	}
-	if err := f.Close(); err != nil {
-		os.Remove(f.Name())
-		return "", fmt.Errorf("close mcp config temp file: %w", err)
+	return path, nil
+}
+
+func cleanupMcpConfigTemp(path string) {
+	if path == "" {
+		return
+	}
+	dir := filepath.Dir(path)
+	if strings.HasPrefix(filepath.Base(dir), "multica-mcp-") {
+		_ = os.RemoveAll(dir)
+		return
 	}
-	return f.Name(), nil
+	_ = os.Remove(path)
 }
 
 // detectVersionTimeout bounds a single `<cli> --version` probe. Version
diff --git a/server/pkg/agent/claude_test.go b/server/pkg/agent/claude_test.go
index 40b7ebd68c5..a1f76e832ae 100644
--- a/server/pkg/agent/claude_test.go
+++ b/server/pkg/agent/claude_test.go
@@ -651,10 +651,8 @@ func TestWriteMcpConfigToTemp(t *testing.T) {
 		t.Fatalf("expected %s, got %s", raw, data)
 	}
 
-	// Cleanup should remove the file.
-	if err := os.Remove(path); err != nil {
-		t.Fatalf("remove temp file: %v", err)
-	}
+	// Cleanup should remove the temp directory and every related sidecar file.
+	cleanupMcpConfigTemp(path)
 	if _, err := os.Stat(path); !os.IsNotExist(err) {
 		t.Fatalf("expected temp file to be removed, but it still exists")
 	}
diff --git a/server/pkg/agent/codebuddy.go b/server/pkg/agent/codebuddy.go
index 8576d9febbc..876b03d8f59 100644
--- a/server/pkg/agent/codebuddy.go
+++ b/server/pkg/agent/codebuddy.go
@@ -7,7 +7,6 @@ import (
 	"fmt"
 	"io"
 	"log/slog"
-	"os"
 	"os/exec"
 	"strings"
 	"sync"
@@ -92,7 +91,7 @@ func (b *codebuddyBackend) Execute(ctx context.Context, prompt string, opts Exec
 			return nil, err
 		}
 		mcpConfigPath = path
-		mcpFileCleanup = func() { os.Remove(mcpConfigPath) }
+		mcpFileCleanup = func() { cleanupMcpConfigTemp(mcpConfigPath) }
 		args = append(args, "--mcp-config", mcpConfigPath)
 	}
 	// Clean up the temp file if we return before the goroutine takes ownership.
@@ -160,7 +159,7 @@ func (b *codebuddyBackend) Execute(ctx context.Context, prompt string, opts Exec
 		defer close(msgCh)
 		defer close(resCh)
 		if mcpConfigPath != "" {
-			defer os.Remove(mcpConfigPath)
+			defer cleanupMcpConfigTemp(mcpConfigPath)
 		}
 
 		startTime := time.Now()

From a69d969fb18216db365092a96c85e3d99389a3af Mon Sep 17 00:00:00 2001
From: Multica Eve <eve@devv.ai>
Date: Mon, 6 Jul 2026 16:29:02 +0800
Subject: [PATCH 11/15] fix(sweeper): gate running-task wall clock on runtime
 liveness (MUL-4107) (#4978)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The server-side running-task sweeper failed rows purely on `started_at >
now() - runningTimeoutSeconds` (2h30m). By its own comment the wall clock
is "mainly for runs whose daemon died without reporting" and "only needs
to sit generously above any realistic single run" — but the predicate
does not actually distinguish a healthy long-running task from an
orphaned one. On self-hosted deployments this kills multi-hour research
/ training runs mid-flight even though the daemon is still heartbeating
and the run is actively producing output.

The daemon side is intentionally unbounded (only inactivity watchdogs:
idle 30m, tool 2h); the server backstop was silently the only wall
clock. `FailStaleTasks` is now AND-gated on runtime liveness:

  * dispatched — unchanged; already excludes rows with a live
    `prepare_lease_expires_at` (renewed every 15s by the daemon between
    claim and StartTask).
  * running — new: excluded when the task's `agent_runtime` row is
    `online` AND `last_seen_at` is within the runtime stale window
    (staleThresholdSeconds = 150s, the same signal
    sweepStaleRuntimes already uses).

Healthy long-running tasks on live daemons are no longer killed by the
wall clock. The daemon-dead case remains primarily handled by
sweepStaleRuntimes in the same tick (Redis LivenessStore + DB stale +
FailTasksForOfflineRuntimes); the wall-clock branch is now a defensive
backstop for the pathological case where a runtime row lingers online
with a stale DB heartbeat for longer than the wall clock. `runtime_id
IS NULL` is treated as "not proving liveness" so the wall clock still
fires on that (rare / historical) shape.

The 2h30m default is unchanged — this is a gate, not a threshold
change. Tests updated: 4 existing running-task tests now age out the
runtime so they still exercise the wall clock; 2 new tests cover both
new invariants (healthy runtime → skipped; stale runtime → still
killed).

Fixes #4958

Co-authored-by: Eve <eve@multica-ai.local>
Co-authored-by: multica-agent <github@multica.ai>
---
 server/cmd/server/runtime_sweeper.go      |  37 ++++--
 server/cmd/server/runtime_sweeper_test.go | 136 ++++++++++++++++++++++
 server/pkg/db/generated/agent.sql.go      |  50 ++++++--
 server/pkg/db/queries/agent.sql           |  47 +++++++-
 4 files changed, 248 insertions(+), 22 deletions(-)

diff --git a/server/cmd/server/runtime_sweeper.go b/server/cmd/server/runtime_sweeper.go
index 87b4b17c478..f08c8db09cc 100644
--- a/server/cmd/server/runtime_sweeper.go
+++ b/server/cmd/server/runtime_sweeper.go
@@ -37,11 +37,19 @@ const (
 	// means something went wrong (e.g. StartTask API call failed silently).
 	dispatchTimeoutSeconds = 300.0
 	// runningTimeoutSeconds fails tasks stuck in 'running' beyond this. It is a
-	// coarse server-side backstop keyed on started_at (it does NOT look at task
-	// activity) — mainly for runs whose daemon died without reporting. The
-	// daemon itself decides stuck-vs-long-running by activity (idle/tool
-	// watchdog), so this only needs to sit generously above any realistic single
-	// run rather than track a per-run wall-clock cap (MUL-3064).
+	// coarse server-side backstop keyed on started_at, AND-gated by daemon
+	// liveness (agent_runtime.last_seen_at freshness within
+	// staleThresholdSeconds): a running task whose runtime is still
+	// heartbeating is NEVER killed by this wall clock, even after the timeout
+	// elapses. This is what lets healthy multi-hour research / training runs
+	// survive on self-hosted deployments (MUL-4107) — the daemon itself
+	// decides stuck-vs-long-running via its inactivity watchdogs (idle/tool),
+	// so the server-side wall clock is only a defensive backstop for the
+	// pathological case where a runtime row somehow retains status='online'
+	// with a stale DB heartbeat for longer than this timeout. The primary
+	// "daemon died" path is `sweepStaleRuntimes` in the same tick (Redis
+	// liveness + DB stale + FailTasksForOfflineRuntimes), which typically
+	// reclaims orphaned tasks within ~180s.
 	runningTimeoutSeconds = 9000.0
 	// queuedTTLSeconds expires tasks that have been sitting in 'queued'
 	// for longer than this without ever being claimed. This is the cleanup
@@ -239,14 +247,25 @@ func gcRuntimes(ctx context.Context, queries *db.Queries, bus *events.Bus) {
 }
 
 // sweepStaleTasks fails tasks stuck in dispatched/running for too long,
-// even when the runtime is still online. This handles cases where:
-// - The agent process hangs and the daemon is still heartbeating
-// - The daemon failed to report task completion/failure
-// - A server restart left tasks in a non-terminal state
+// even when the runtime is still online at the row level. Each branch pairs
+// the wall clock with a task-appropriate liveness signal so healthy long
+// runs are preserved:
+//   - dispatched: excludes rows with an active prepare_lease (renewed by
+//     the daemon between claim and StartTask).
+//   - running: excludes rows whose runtime is 'online' with a fresh
+//     last_seen_at (renewed by the daemon heartbeat ~every 15s).
+//
+// The daemon-dead case is primarily handled upstream by sweepStaleRuntimes
+// in the same tick; this function is a defensive backstop for the residual
+// edge where a runtime row lingers online-with-stale-heartbeat past the
+// wall clock (MUL-4107).
 func sweepStaleTasks(ctx context.Context, queries *db.Queries, taskSvc *service.TaskService, bus *events.Bus) {
 	failedTasks, err := queries.FailStaleTasks(ctx, db.FailStaleTasksParams{
 		DispatchTimeoutSecs: dispatchTimeoutSeconds,
 		RunningTimeoutSecs:  runningTimeoutSeconds,
+		// Reuse the runtime stale window so the running-task backstop
+		// exactly matches what sweepStaleRuntimes considers "not alive".
+		RuntimeStaleSecs: staleThresholdSeconds,
 	})
 	if err != nil {
 		slog.Warn("task sweeper: failed to clean up stale tasks", "error", err)
diff --git a/server/cmd/server/runtime_sweeper_test.go b/server/cmd/server/runtime_sweeper_test.go
index 45d8cfa2a78..050bd33e967 100644
--- a/server/cmd/server/runtime_sweeper_test.go
+++ b/server/cmd/server/runtime_sweeper_test.go
@@ -5,6 +5,7 @@ import (
 	"strings"
 	"sync"
 	"testing"
+	"time"
 
 	"github.com/multica-ai/multica/server/internal/events"
 	db "github.com/multica-ai/multica/server/pkg/db/generated"
@@ -78,6 +79,30 @@ func cleanupSweeperFixture(t *testing.T, issueID, agentID string) {
 	testPool.Exec(ctx, `UPDATE agent SET status = 'idle' WHERE id = $1`, agentID)
 }
 
+// ageOutAgentRuntime marks the agent's runtime as stale — old last_seen_at —
+// so the runtime-liveness gate on the running-task sweep predicate
+// (agent_runtime.last_seen_at within staleThresholdSeconds) does NOT protect
+// the test task from being killed by the wall clock. Register a cleanup that
+// restores last_seen_at so subsequent tests re-using this runtime see it as
+// fresh. Callers pass a `staleAgo` well beyond staleThresholdSeconds so tests
+// are insensitive to that constant's precise value.
+func ageOutAgentRuntime(t *testing.T, agentID string, staleAgo time.Duration) {
+	t.Helper()
+	ctx := context.Background()
+	if _, err := testPool.Exec(ctx, `
+		UPDATE agent_runtime SET last_seen_at = now() - make_interval(secs => $1)
+		WHERE id = (SELECT runtime_id FROM agent WHERE id = $2)
+	`, staleAgo.Seconds(), agentID); err != nil {
+		t.Fatalf("failed to age out agent runtime: %v", err)
+	}
+	t.Cleanup(func() {
+		testPool.Exec(context.Background(), `
+			UPDATE agent_runtime SET last_seen_at = now()
+			WHERE id = (SELECT runtime_id FROM agent WHERE id = $1)
+		`, agentID)
+	})
+}
+
 func TestRefreshAgentStatusFromTasks(t *testing.T) {
 	if testPool == nil {
 		t.Skip("no database connection")
@@ -132,6 +157,10 @@ func TestSweepStaleTasksBroadcastsWithWorkspaceID(t *testing.T) {
 
 	issueID, agentID, taskID := setupSweeperTestFixture(t, "running")
 	t.Cleanup(func() { cleanupSweeperFixture(t, issueID, agentID) })
+	// The running-task sweep now requires the task's runtime to be NOT
+	// heartbeating (MUL-4107). Age the runtime out so this test still
+	// exercises the sweeper wall clock rather than being silently skipped.
+	ageOutAgentRuntime(t, agentID, 10*time.Minute)
 
 	queries := db.New(testPool)
 	bus := events.New()
@@ -149,6 +178,7 @@ func TestSweepStaleTasksBroadcastsWithWorkspaceID(t *testing.T) {
 	failedTasks, err := queries.FailStaleTasks(context.Background(), db.FailStaleTasksParams{
 		DispatchTimeoutSecs: 300.0,
 		RunningTimeoutSecs:  1.0, // 1 second — our task is 3 hours old
+		RuntimeStaleSecs:    staleThresholdSeconds,
 	})
 	if err != nil {
 		t.Fatalf("FailStaleTasks query failed: %v", err)
@@ -213,6 +243,8 @@ func TestSweepStaleTasksReconcileAgentStatus(t *testing.T) {
 
 	issueID, agentID, _ := setupSweeperTestFixture(t, "running")
 	t.Cleanup(func() { cleanupSweeperFixture(t, issueID, agentID) })
+	// Runtime must be stale for the running-task wall clock to fire (MUL-4107).
+	ageOutAgentRuntime(t, agentID, 10*time.Minute)
 
 	queries := db.New(testPool)
 	bus := events.New()
@@ -230,6 +262,7 @@ func TestSweepStaleTasksReconcileAgentStatus(t *testing.T) {
 	failedTasks, err := queries.FailStaleTasks(context.Background(), db.FailStaleTasksParams{
 		DispatchTimeoutSecs: 300.0,
 		RunningTimeoutSecs:  1.0,
+		RuntimeStaleSecs:    staleThresholdSeconds,
 	})
 	if err != nil {
 		t.Fatalf("FailStaleTasks failed: %v", err)
@@ -291,6 +324,9 @@ func TestSweepDispatchedStaleTask(t *testing.T) {
 	failedTasks, err := queries.FailStaleTasks(context.Background(), db.FailStaleTasksParams{
 		DispatchTimeoutSecs: 1.0,
 		RunningTimeoutSecs:  9000.0,
+		// RuntimeStaleSecs only affects the running branch — irrelevant for
+		// this dispatched-timeout test, but wired for API consistency.
+		RuntimeStaleSecs: staleThresholdSeconds,
 	})
 	if err != nil {
 		t.Fatalf("FailStaleTasks failed: %v", err)
@@ -343,6 +379,98 @@ func TestSweepDispatchedStaleTask(t *testing.T) {
 	}
 }
 
+// TestSweepRunningTaskSkippedWhenRuntimeFresh is the MUL-4107 regression test:
+// a running task whose wall-clock deadline has already passed MUST NOT be
+// killed by the sweeper as long as its owning runtime is 'online' and its
+// last_seen_at is within the runtime stale window. This preserves healthy
+// multi-hour research / training runs — the primary motivation for the
+// liveness-keyed sweep predicate.
+func TestSweepRunningTaskSkippedWhenRuntimeFresh(t *testing.T) {
+	if testPool == nil {
+		t.Skip("no database connection")
+	}
+
+	issueID, agentID, taskID := setupSweeperTestFixture(t, "running")
+	t.Cleanup(func() { cleanupSweeperFixture(t, issueID, agentID) })
+
+	// Runtime heartbeat is fresh (integration fixture inserts last_seen_at=now()).
+	// Task started_at is 3h ago; RunningTimeoutSecs=1s would kill on wall clock
+	// alone — but the runtime is proving liveness, so the sweeper must skip it.
+	queries := db.New(testPool)
+	failedTasks, err := queries.FailStaleTasks(context.Background(), db.FailStaleTasksParams{
+		DispatchTimeoutSecs: 300.0,
+		RunningTimeoutSecs:  1.0,
+		RuntimeStaleSecs:    staleThresholdSeconds,
+	})
+	if err != nil {
+		t.Fatalf("FailStaleTasks failed: %v", err)
+	}
+
+	for _, ft := range failedTasks {
+		if ft.ID.Bytes == parseUUIDBytes(taskID) {
+			t.Fatalf("healthy long-running task on live daemon must NOT be swept — that was the MUL-4107 bug")
+		}
+	}
+
+	var status string
+	if err := testPool.QueryRow(context.Background(),
+		`SELECT status FROM agent_task_queue WHERE id = $1`, taskID,
+	).Scan(&status); err != nil {
+		t.Fatalf("failed to query task status: %v", err)
+	}
+	if status != "running" {
+		t.Fatalf("expected task to stay 'running', got %q", status)
+	}
+}
+
+// TestSweepRunningTaskKilledWhenRuntimeStale is the companion coverage: with
+// the same wall-clock deadline elapsed, a running task IS killed when its
+// runtime's DB heartbeat is stale (simulates the "runtime lingers online
+// with a stale heartbeat past the wall clock" pathological case that the
+// wall-clock branch is the defensive backstop for). Note that in production
+// the daemon-dead case is normally reclaimed sooner by sweepStaleRuntimes;
+// this test asserts the residual backstop still fires when it needs to.
+func TestSweepRunningTaskKilledWhenRuntimeStale(t *testing.T) {
+	if testPool == nil {
+		t.Skip("no database connection")
+	}
+
+	issueID, agentID, taskID := setupSweeperTestFixture(t, "running")
+	t.Cleanup(func() { cleanupSweeperFixture(t, issueID, agentID) })
+	ageOutAgentRuntime(t, agentID, 10*time.Minute)
+
+	queries := db.New(testPool)
+	failedTasks, err := queries.FailStaleTasks(context.Background(), db.FailStaleTasksParams{
+		DispatchTimeoutSecs: 300.0,
+		RunningTimeoutSecs:  1.0,
+		RuntimeStaleSecs:    staleThresholdSeconds,
+	})
+	if err != nil {
+		t.Fatalf("FailStaleTasks failed: %v", err)
+	}
+
+	found := false
+	for _, ft := range failedTasks {
+		if ft.ID.Bytes == parseUUIDBytes(taskID) {
+			found = true
+			break
+		}
+	}
+	if !found {
+		t.Fatalf("expected wall clock to fire when runtime heartbeat is stale, but task %s was not swept", taskID)
+	}
+
+	var status string
+	if err := testPool.QueryRow(context.Background(),
+		`SELECT status FROM agent_task_queue WHERE id = $1`, taskID,
+	).Scan(&status); err != nil {
+		t.Fatalf("failed to query task status: %v", err)
+	}
+	if status != "failed" {
+		t.Fatalf("expected task status 'failed', got %q", status)
+	}
+}
+
 // TestSweepResetsInProgressIssueToTodo verifies the core fix: when the sweeper
 // force-fails a stale task whose issue is still in_progress (because the daemon
 // crashed mid-run), the issue is reset back to todo so the daemon can re-queue it.
@@ -399,10 +527,14 @@ func TestSweepResetsInProgressIssueToTodo(t *testing.T) {
 	queries := db.New(testPool)
 	bus := events.New()
 
+	// Runtime must be stale for the running-task wall clock to fire (MUL-4107).
+	ageOutAgentRuntime(t, agentID, 10*time.Minute)
+
 	// Fail the stale task (running timeout of 1 second — our task is 3 hours old).
 	failedTasks, err := queries.FailStaleTasks(ctx, db.FailStaleTasksParams{
 		DispatchTimeoutSecs: 300.0,
 		RunningTimeoutSecs:  1.0,
+		RuntimeStaleSecs:    staleThresholdSeconds,
 	})
 	if err != nil {
 		t.Fatalf("FailStaleTasks failed: %v", err)
@@ -484,9 +616,13 @@ func TestSweepDoesNotResetIssueAlreadyInReview(t *testing.T) {
 	queries := db.New(testPool)
 	bus := events.New()
 
+	// Runtime must be stale for the running-task wall clock to fire (MUL-4107).
+	ageOutAgentRuntime(t, agentID, 10*time.Minute)
+
 	failedTasks, err := queries.FailStaleTasks(ctx, db.FailStaleTasksParams{
 		DispatchTimeoutSecs: 300.0,
 		RunningTimeoutSecs:  1.0,
+		RuntimeStaleSecs:    staleThresholdSeconds,
 	})
 	if err != nil {
 		t.Fatalf("FailStaleTasks failed: %v", err)
diff --git a/server/pkg/db/generated/agent.sql.go b/server/pkg/db/generated/agent.sql.go
index c84f9c7828b..4b6f4c83563 100644
--- a/server/pkg/db/generated/agent.sql.go
+++ b/server/pkg/db/generated/agent.sql.go
@@ -1746,28 +1746,64 @@ WHERE (
     AND dispatched_at < now() - make_interval(secs => $1::double precision)
     AND (prepare_lease_expires_at IS NULL OR prepare_lease_expires_at < now())
   )
-   OR (status = 'running' AND started_at < now() - make_interval(secs => $2::double precision))
+   OR (
+    status = 'running'
+    AND started_at < now() - make_interval(secs => $2::double precision)
+    AND NOT EXISTS (
+      SELECT 1 FROM agent_runtime r
+      WHERE r.id = agent_task_queue.runtime_id
+        AND r.status = 'online'
+        AND r.last_seen_at >= now() - make_interval(secs => $3::double precision)
+    )
+  )
 RETURNING id, agent_id, issue_id, status, priority, dispatched_at, started_at, completed_at, result, error, created_at, context, runtime_id, session_id, work_dir, trigger_comment_id, chat_session_id, autopilot_run_id, attempt, max_attempts, parent_task_id, failure_reason, trigger_summary, force_fresh_session, is_leader_task, wait_reason, initiator_user_id, handoff_note, prepare_lease_expires_at, squad_id, runtime_mcp_overlay, escalation_for_task_id, fire_at, originator_user_id, runtime_connected_apps
 `
 
 type FailStaleTasksParams struct {
 	DispatchTimeoutSecs float64 `json:"dispatch_timeout_secs"`
 	RunningTimeoutSecs  float64 `json:"running_timeout_secs"`
+	RuntimeStaleSecs    float64 `json:"runtime_stale_secs"`
 }
 
 // Fails tasks stuck in dispatched/running beyond the given thresholds.
-// Handles cases where the daemon is alive but the task is orphaned
-// (e.g. agent process hung, daemon failed to report completion).
-// Dispatched tasks with an active prepare lease are excluded because the
-// daemon is still proving liveness while resolving/cache/preparing startup
-// inputs before StartTask.
+//
+// Each branch pairs a wall-clock deadline with a task-appropriate liveness
+// signal, so the sweeper only kills tasks whose owning daemon is no longer
+// proving it is alive:
+//
+//   - Dispatched: `prepare_lease_expires_at` is refreshed every 15s by the
+//     daemon between claim and StartTask (see startTaskPrepareLeaseExtender).
+//     A live lease excludes the row.
+//
+//   - Running: no per-task lease is renewed once StartTask fires, so we key
+//     off the daemon-wide heartbeat instead — `agent_runtime.last_seen_at`,
+//     which the daemon bumps every ~15s while it is up. A running task whose
+//     runtime is `online` AND whose `last_seen_at` is within
+//     @runtime_stale_secs is treated as alive and is NOT killed by this
+//     wall-clock backstop, even after `started_at` exceeds the running
+//     timeout. This is what lets healthy multi-hour research / training runs
+//     survive on self-hosted deployments (MUL-4107): the daemon side is
+//     bounded only by inactivity watchdogs (idle / per-tool), so the
+//     server-side wall clock must not shadow that with a coarser cap.
+//
+// The daemon-dead case is the primary responsibility of `sweepStaleRuntimes`
+// (which mixes DB `last_seen_at` with the Redis LivenessStore and calls
+// `FailTasksForOfflineRuntimes` in the same tick). The wall-clock branch
+// here is a defensive backstop for pathological cases where a runtime row
+// somehow retains status='online' with a stale DB heartbeat for longer than
+// the wall clock allows.
+//
+// runtime_id IS NULL: a running row with no runtime is by definition not
+// proving liveness, so the wall clock is allowed to fire — same shape as
+// the legacy pure-wall-clock behavior for that (rare / historical) case.
+//
 // waiting_local_directory rows are intentionally excluded: the daemon owns
 // the wait (with its own ctx-driven timeout) and a legitimate queue ahead
 // of this task can exceed the dispatch / running timeouts without being
 // "stuck". If the daemon dies, RecoverOrphanedTasksForRuntime reclaims
 // those rows at restart.
 func (q *Queries) FailStaleTasks(ctx context.Context, arg FailStaleTasksParams) ([]AgentTaskQueue, error) {
-	rows, err := q.db.Query(ctx, failStaleTasks, arg.DispatchTimeoutSecs, arg.RunningTimeoutSecs)
+	rows, err := q.db.Query(ctx, failStaleTasks, arg.DispatchTimeoutSecs, arg.RunningTimeoutSecs, arg.RuntimeStaleSecs)
 	if err != nil {
 		return nil, err
 	}
diff --git a/server/pkg/db/queries/agent.sql b/server/pkg/db/queries/agent.sql
index 07c998ba1f3..c6a62a31bf9 100644
--- a/server/pkg/db/queries/agent.sql
+++ b/server/pkg/db/queries/agent.sql
@@ -568,11 +568,37 @@ RETURNING *;
 
 -- name: FailStaleTasks :many
 -- Fails tasks stuck in dispatched/running beyond the given thresholds.
--- Handles cases where the daemon is alive but the task is orphaned
--- (e.g. agent process hung, daemon failed to report completion).
--- Dispatched tasks with an active prepare lease are excluded because the
--- daemon is still proving liveness while resolving/cache/preparing startup
--- inputs before StartTask.
+--
+-- Each branch pairs a wall-clock deadline with a task-appropriate liveness
+-- signal, so the sweeper only kills tasks whose owning daemon is no longer
+-- proving it is alive:
+--
+--   * Dispatched: `prepare_lease_expires_at` is refreshed every 15s by the
+--     daemon between claim and StartTask (see startTaskPrepareLeaseExtender).
+--     A live lease excludes the row.
+--
+--   * Running: no per-task lease is renewed once StartTask fires, so we key
+--     off the daemon-wide heartbeat instead — `agent_runtime.last_seen_at`,
+--     which the daemon bumps every ~15s while it is up. A running task whose
+--     runtime is `online` AND whose `last_seen_at` is within
+--     @runtime_stale_secs is treated as alive and is NOT killed by this
+--     wall-clock backstop, even after `started_at` exceeds the running
+--     timeout. This is what lets healthy multi-hour research / training runs
+--     survive on self-hosted deployments (MUL-4107): the daemon side is
+--     bounded only by inactivity watchdogs (idle / per-tool), so the
+--     server-side wall clock must not shadow that with a coarser cap.
+--
+-- The daemon-dead case is the primary responsibility of `sweepStaleRuntimes`
+-- (which mixes DB `last_seen_at` with the Redis LivenessStore and calls
+-- `FailTasksForOfflineRuntimes` in the same tick). The wall-clock branch
+-- here is a defensive backstop for pathological cases where a runtime row
+-- somehow retains status='online' with a stale DB heartbeat for longer than
+-- the wall clock allows.
+--
+-- runtime_id IS NULL: a running row with no runtime is by definition not
+-- proving liveness, so the wall clock is allowed to fire — same shape as
+-- the legacy pure-wall-clock behavior for that (rare / historical) case.
+--
 -- waiting_local_directory rows are intentionally excluded: the daemon owns
 -- the wait (with its own ctx-driven timeout) and a legitimate queue ahead
 -- of this task can exceed the dispatch / running timeouts without being
@@ -587,7 +613,16 @@ WHERE (
     AND dispatched_at < now() - make_interval(secs => @dispatch_timeout_secs::double precision)
     AND (prepare_lease_expires_at IS NULL OR prepare_lease_expires_at < now())
   )
-   OR (status = 'running' AND started_at < now() - make_interval(secs => @running_timeout_secs::double precision))
+   OR (
+    status = 'running'
+    AND started_at < now() - make_interval(secs => @running_timeout_secs::double precision)
+    AND NOT EXISTS (
+      SELECT 1 FROM agent_runtime r
+      WHERE r.id = agent_task_queue.runtime_id
+        AND r.status = 'online'
+        AND r.last_seen_at >= now() - make_interval(secs => @runtime_stale_secs::double precision)
+    )
+  )
 RETURNING *;
 
 -- name: ExpireStaleQueuedTasks :many

From 5dfb0bec0690cc6a5b4c782d98ea93a05c3d7b03 Mon Sep 17 00:00:00 2001
From: ZIce <39822906+vicksiyi@users.noreply.github.com>
Date: Mon, 6 Jul 2026 16:49:29 +0800
Subject: [PATCH 12/15] Fix Codex MCP allowlist config rendering (#4949)

Co-authored-by: multica-agent <github@multica.ai>
---
 server/pkg/agent/codex.go      | 26 +++++++++--
 server/pkg/agent/codex_test.go | 80 ++++++++++++++++++++++++++++++++++
 2 files changed, 102 insertions(+), 4 deletions(-)

diff --git a/server/pkg/agent/codex.go b/server/pkg/agent/codex.go
index 42477cdbc45..6b688114eb3 100644
--- a/server/pkg/agent/codex.go
+++ b/server/pkg/agent/codex.go
@@ -380,15 +380,24 @@ func renderCodexMcpServersBlock(raw json.RawMessage) (string, bool, error) {
 
 func normalizeCodexMcpServerConfig(server map[string]any) map[string]any {
 	if !isCodexRemoteMcpServer(server) {
-		return server
+		normalized := make(map[string]any, len(server))
+		for k, v := range server {
+			if isMulticaMcpSelectorKey(k) {
+				continue
+			}
+			normalized[k] = v
+		}
+		return normalized
 	}
 
 	normalized := make(map[string]any, len(server)+1)
 	for k, v := range server {
-		switch k {
-		case "type":
+		switch {
+		case isMulticaMcpSelectorKey(k):
+			continue
+		case k == "type":
 			continue
-		case "headers":
+		case k == "headers":
 			if _, ok := server["http_headers"]; !ok {
 				normalized["http_headers"] = v
 			}
@@ -400,6 +409,15 @@ func normalizeCodexMcpServerConfig(server map[string]any) map[string]any {
 	return normalized
 }
 
+func isMulticaMcpSelectorKey(k string) bool {
+	switch k {
+	case "tools", "prompts", "resources":
+		return true
+	default:
+		return false
+	}
+}
+
 func isCodexRemoteMcpServer(server map[string]any) bool {
 	if typ, ok := server["type"].(string); ok && strings.EqualFold(typ, "http") {
 		return true
diff --git a/server/pkg/agent/codex_test.go b/server/pkg/agent/codex_test.go
index 2e650b4fc43..56ab464375b 100644
--- a/server/pkg/agent/codex_test.go
+++ b/server/pkg/agent/codex_test.go
@@ -2365,6 +2365,86 @@ func TestEnsureCodexMcpConfigTranslatesRemoteHTTPServer(t *testing.T) {
 	}
 }
 
+func TestEnsureCodexMcpConfigDropsInternalSelectors(t *testing.T) {
+	t.Parallel()
+
+	tmp := filepath.Join(t.TempDir(), "config.toml")
+	raw := json.RawMessage(`{"mcpServers":{"fetch":{"command":"uvx","args":["mcp-server-fetch"],"env":{"API_KEY":"secret"},"timeout":30,"tools":{"include":["kb_get"]},"prompts":{"include":["daily"]},"resources":{"include":["docs"]}}}}`)
+	if err := ensureCodexMcpConfig(tmp, raw, slog.Default()); err != nil {
+		t.Fatalf("ensure: %v", err)
+	}
+	data, err := os.ReadFile(tmp)
+	if err != nil {
+		t.Fatalf("read after: %v", err)
+	}
+	got := string(data)
+
+	for _, want := range []string{
+		`[mcp_servers.fetch]`,
+		`command = "uvx"`,
+		`args = ["mcp-server-fetch"]`,
+		`env = { API_KEY = "secret" }`,
+		`timeout = 30`,
+	} {
+		if !strings.Contains(got, want) {
+			t.Fatalf("expected %q in:\n%s", want, got)
+		}
+	}
+	for _, unexpected := range []string{
+		"\ntools = ",
+		"\nprompts = ",
+		"\nresources = ",
+		"kb_get",
+		"daily",
+		"docs",
+	} {
+		if strings.Contains(got, unexpected) {
+			t.Fatalf("internal MCP selector %q must not render into Codex config.toml:\n%s", unexpected, got)
+		}
+	}
+}
+
+func TestEnsureCodexMcpConfigDropsInternalSelectorsFromRemoteHTTPServer(t *testing.T) {
+	t.Parallel()
+
+	tmp := filepath.Join(t.TempDir(), "config.toml")
+	raw := json.RawMessage(`{"mcpServers":{"remote":{"type":"http","url":"https://mcp.example.test/session","headers":{"Authorization":"Bearer test-token"},"timeout":45,"tools":{"include":["kb_get"]},"prompts":{"include":["daily"]},"resources":{"include":["docs"]}}}}`)
+	if err := ensureCodexMcpConfig(tmp, raw, slog.Default()); err != nil {
+		t.Fatalf("ensure: %v", err)
+	}
+	data, err := os.ReadFile(tmp)
+	if err != nil {
+		t.Fatalf("read after: %v", err)
+	}
+	got := string(data)
+
+	for _, want := range []string{
+		`[mcp_servers.remote]`,
+		`url = "https://mcp.example.test/session"`,
+		`http_headers = { Authorization = "Bearer test-token" }`,
+		`timeout = 45`,
+		`experimental_use_rmcp_client = true`,
+	} {
+		if !strings.Contains(got, want) {
+			t.Fatalf("expected %q in:\n%s", want, got)
+		}
+	}
+	for _, unexpected := range []string{
+		"\ntools = ",
+		"\nprompts = ",
+		"\nresources = ",
+		"kb_get",
+		"daily",
+		"docs",
+		`type = "http"`,
+		"\nheaders = ",
+	} {
+		if strings.Contains(got, unexpected) {
+			t.Fatalf("internal or provider-incompatible key %q must not render into Codex config.toml:\n%s", unexpected, got)
+		}
+	}
+}
+
 func TestRenderCodexMcpServersBlockTreatsURLOnlyServerAsRemote(t *testing.T) {
 	t.Parallel()
 

From f9b7e5035a58bedf3a702099fc096efa690d6765 Mon Sep 17 00:00:00 2001
From: Naiyuan Qing <145280634+NevilleQingNY@users.noreply.github.com>
Date: Mon, 6 Jul 2026 17:00:57 +0800
Subject: [PATCH 13/15] fix(workspace): drop workspace from list cache while
 delete is pending (MUL-4129) (#4980)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The delete-workspace flow navigates away before awaiting the DELETE
(required ordering — see navigateAwayFromCurrentWorkspace's
CancelledError notes), but useDeleteWorkspace left the workspace in the
list cache until onSettled. During the pending window any list refetch
re-presented the deleting workspace as a selectable/current option.

Optimistically remove it in onMutate (after cancelling in-flight list
fetches), roll the snapshot back in onError so a failed delete restores
the workspace alongside the existing error toast, and keep the
onSettled invalidate as the server-truth reconcile.

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Co-authored-by: multica-agent <github@multica.ai>
---
 packages/core/workspace/mutations.test.tsx | 121 +++++++++++++++++++++
 packages/core/workspace/mutations.ts       |  24 ++++
 2 files changed, 145 insertions(+)
 create mode 100644 packages/core/workspace/mutations.test.tsx

diff --git a/packages/core/workspace/mutations.test.tsx b/packages/core/workspace/mutations.test.tsx
new file mode 100644
index 00000000000..d7e7965e8c3
--- /dev/null
+++ b/packages/core/workspace/mutations.test.tsx
@@ -0,0 +1,121 @@
+/**
+ * @vitest-environment jsdom
+ */
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { act, renderHook, waitFor } from "@testing-library/react";
+import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
+import type { ReactNode } from "react";
+import { setApiInstance } from "../api";
+import type { ApiClient } from "../api/client";
+import type { Workspace } from "../types";
+import { useDeleteWorkspace } from "./mutations";
+import { workspaceKeys } from "./queries";
+
+function createWrapper(qc: QueryClient) {
+  return function Wrapper({ children }: { children: ReactNode }) {
+    return <QueryClientProvider client={qc}>{children}</QueryClientProvider>;
+  };
+}
+
+const makeWorkspace = (id: string, slug: string): Workspace => ({
+  id,
+  name: slug,
+  slug,
+  description: null,
+  context: null,
+  settings: {},
+  repos: [],
+  issue_prefix: "MUL",
+  avatar_url: null,
+  created_at: "2026-01-01T00:00:00Z",
+  updated_at: "2026-01-01T00:00:00Z",
+});
+
+describe("useDeleteWorkspace", () => {
+  let qc: QueryClient;
+  let deleteWorkspace: ReturnType<typeof vi.fn<(id: string) => Promise<void>>>;
+
+  const seedList = () => {
+    qc.setQueryData<Workspace[]>(workspaceKeys.list(), [
+      makeWorkspace("ws-1", "keep-me"),
+      makeWorkspace("ws-2", "delete-me"),
+    ]);
+  };
+
+  const cachedList = () =>
+    qc.getQueryData<Workspace[]>(workspaceKeys.list()) ?? [];
+
+  beforeEach(() => {
+    qc = new QueryClient({ defaultOptions: { queries: { retry: false } } });
+    deleteWorkspace = vi.fn().mockResolvedValue(undefined);
+    setApiInstance({ deleteWorkspace } as unknown as ApiClient);
+  });
+
+  afterEach(() => {
+    qc.clear();
+    vi.restoreAllMocks();
+  });
+
+  it("removes the workspace from the list cache while the DELETE is pending", async () => {
+    seedList();
+    // Hold the DELETE open so we can observe the pending window — the bug
+    // was that during this window the list cache still contained the
+    // workspace, so any consumer re-presented it as selectable/current.
+    let resolveDelete!: () => void;
+    deleteWorkspace.mockReturnValue(
+      new Promise<void>((resolve) => {
+        resolveDelete = resolve;
+      }),
+    );
+
+    const { result } = renderHook(() => useDeleteWorkspace(), {
+      wrapper: createWrapper(qc),
+    });
+
+    let mutationDone: Promise<void>;
+    await act(async () => {
+      mutationDone = result.current.mutateAsync("ws-2");
+      // Let onMutate (cancelQueries + optimistic removal) run.
+      await Promise.resolve();
+    });
+
+    expect(deleteWorkspace).toHaveBeenCalledWith("ws-2");
+    expect(cachedList().map((w) => w.id)).toEqual(["ws-1"]);
+
+    await act(async () => {
+      resolveDelete();
+      await mutationDone;
+    });
+    expect(cachedList().map((w) => w.id)).toEqual(["ws-1"]);
+  });
+
+  it("invalidates the workspace list after a successful delete", async () => {
+    seedList();
+    const { result } = renderHook(() => useDeleteWorkspace(), {
+      wrapper: createWrapper(qc),
+    });
+
+    await act(async () => {
+      await result.current.mutateAsync("ws-2");
+    });
+
+    expect(qc.getQueryState(workspaceKeys.list())?.isInvalidated).toBe(true);
+  });
+
+  it("rolls the list back when the DELETE fails", async () => {
+    seedList();
+    deleteWorkspace.mockRejectedValue(new Error("boom"));
+
+    const { result } = renderHook(() => useDeleteWorkspace(), {
+      wrapper: createWrapper(qc),
+    });
+
+    await act(async () => {
+      await expect(result.current.mutateAsync("ws-2")).rejects.toThrow("boom");
+    });
+
+    await waitFor(() => {
+      expect(cachedList().map((w) => w.id)).toEqual(["ws-1", "ws-2"]);
+    });
+  });
+});
diff --git a/packages/core/workspace/mutations.ts b/packages/core/workspace/mutations.ts
index f23bb7f9649..32e9c70571c 100644
--- a/packages/core/workspace/mutations.ts
+++ b/packages/core/workspace/mutations.ts
@@ -39,6 +39,30 @@ export function useDeleteWorkspace() {
   const qc = useQueryClient();
   return useMutation({
     mutationFn: (workspaceId: string) => api.deleteWorkspace(workspaceId),
+    // Optimistically drop the workspace from the list cache while the
+    // DELETE is in flight. The delete flow navigates away BEFORE awaiting
+    // the mutation (see workspace-tab.tsx's navigateAwayFromCurrentWorkspace
+    // for the CancelledError race that forces that ordering), so during the
+    // pending window every list consumer — sidebar switcher, by-slug route
+    // resolution, post-auth destination — must already see the workspace as
+    // gone, or a concurrent list refetch re-presents it as selectable and
+    // it can be re-entered mid-delete.
+    onMutate: async (workspaceId) => {
+      // Cancel in-flight list fetches so a response that started before the
+      // delete can't land after the optimistic update and resurrect the row.
+      await qc.cancelQueries({ queryKey: workspaceKeys.list() });
+      const previous = qc.getQueryData<Workspace[]>(workspaceKeys.list());
+      qc.setQueryData<Workspace[]>(workspaceKeys.list(), (old) =>
+        old?.filter((w) => w.id !== workspaceId),
+      );
+      return { previous };
+    },
+    // Rollback: the server still has the workspace, so put it back in the
+    // list (the caller surfaces the error toast). onSettled's invalidate
+    // then reconciles against server truth either way.
+    onError: (_err, _workspaceId, ctx) => {
+      if (ctx?.previous) qc.setQueryData(workspaceKeys.list(), ctx.previous);
+    },
     onSettled: () => {
       qc.invalidateQueries({ queryKey: workspaceKeys.list() });
     },

From 152edab8d0fbb94d026a4eb8559b60d14be19ca8 Mon Sep 17 00:00:00 2001
From: Naiyuan Qing <145280634+NevilleQingNY@users.noreply.github.com>
Date: Mon, 6 Jul 2026 17:02:01 +0800
Subject: [PATCH 14/15] =?UTF-8?q?Revert=20"fix(workspace):=20drop=20worksp?=
 =?UTF-8?q?ace=20from=20list=20cache=20while=20delete=20is=20pendin?=
 =?UTF-8?q?=E2=80=A6"=20(#4982)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This reverts commit f9b7e5035a58bedf3a702099fc096efa690d6765.
---
 packages/core/workspace/mutations.test.tsx | 121 ---------------------
 packages/core/workspace/mutations.ts       |  24 ----
 2 files changed, 145 deletions(-)
 delete mode 100644 packages/core/workspace/mutations.test.tsx

diff --git a/packages/core/workspace/mutations.test.tsx b/packages/core/workspace/mutations.test.tsx
deleted file mode 100644
index d7e7965e8c3..00000000000
--- a/packages/core/workspace/mutations.test.tsx
+++ /dev/null
@@ -1,121 +0,0 @@
-/**
- * @vitest-environment jsdom
- */
-import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-import { act, renderHook, waitFor } from "@testing-library/react";
-import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
-import type { ReactNode } from "react";
-import { setApiInstance } from "../api";
-import type { ApiClient } from "../api/client";
-import type { Workspace } from "../types";
-import { useDeleteWorkspace } from "./mutations";
-import { workspaceKeys } from "./queries";
-
-function createWrapper(qc: QueryClient) {
-  return function Wrapper({ children }: { children: ReactNode }) {
-    return <QueryClientProvider client={qc}>{children}</QueryClientProvider>;
-  };
-}
-
-const makeWorkspace = (id: string, slug: string): Workspace => ({
-  id,
-  name: slug,
-  slug,
-  description: null,
-  context: null,
-  settings: {},
-  repos: [],
-  issue_prefix: "MUL",
-  avatar_url: null,
-  created_at: "2026-01-01T00:00:00Z",
-  updated_at: "2026-01-01T00:00:00Z",
-});
-
-describe("useDeleteWorkspace", () => {
-  let qc: QueryClient;
-  let deleteWorkspace: ReturnType<typeof vi.fn<(id: string) => Promise<void>>>;
-
-  const seedList = () => {
-    qc.setQueryData<Workspace[]>(workspaceKeys.list(), [
-      makeWorkspace("ws-1", "keep-me"),
-      makeWorkspace("ws-2", "delete-me"),
-    ]);
-  };
-
-  const cachedList = () =>
-    qc.getQueryData<Workspace[]>(workspaceKeys.list()) ?? [];
-
-  beforeEach(() => {
-    qc = new QueryClient({ defaultOptions: { queries: { retry: false } } });
-    deleteWorkspace = vi.fn().mockResolvedValue(undefined);
-    setApiInstance({ deleteWorkspace } as unknown as ApiClient);
-  });
-
-  afterEach(() => {
-    qc.clear();
-    vi.restoreAllMocks();
-  });
-
-  it("removes the workspace from the list cache while the DELETE is pending", async () => {
-    seedList();
-    // Hold the DELETE open so we can observe the pending window — the bug
-    // was that during this window the list cache still contained the
-    // workspace, so any consumer re-presented it as selectable/current.
-    let resolveDelete!: () => void;
-    deleteWorkspace.mockReturnValue(
-      new Promise<void>((resolve) => {
-        resolveDelete = resolve;
-      }),
-    );
-
-    const { result } = renderHook(() => useDeleteWorkspace(), {
-      wrapper: createWrapper(qc),
-    });
-
-    let mutationDone: Promise<void>;
-    await act(async () => {
-      mutationDone = result.current.mutateAsync("ws-2");
-      // Let onMutate (cancelQueries + optimistic removal) run.
-      await Promise.resolve();
-    });
-
-    expect(deleteWorkspace).toHaveBeenCalledWith("ws-2");
-    expect(cachedList().map((w) => w.id)).toEqual(["ws-1"]);
-
-    await act(async () => {
-      resolveDelete();
-      await mutationDone;
-    });
-    expect(cachedList().map((w) => w.id)).toEqual(["ws-1"]);
-  });
-
-  it("invalidates the workspace list after a successful delete", async () => {
-    seedList();
-    const { result } = renderHook(() => useDeleteWorkspace(), {
-      wrapper: createWrapper(qc),
-    });
-
-    await act(async () => {
-      await result.current.mutateAsync("ws-2");
-    });
-
-    expect(qc.getQueryState(workspaceKeys.list())?.isInvalidated).toBe(true);
-  });
-
-  it("rolls the list back when the DELETE fails", async () => {
-    seedList();
-    deleteWorkspace.mockRejectedValue(new Error("boom"));
-
-    const { result } = renderHook(() => useDeleteWorkspace(), {
-      wrapper: createWrapper(qc),
-    });
-
-    await act(async () => {
-      await expect(result.current.mutateAsync("ws-2")).rejects.toThrow("boom");
-    });
-
-    await waitFor(() => {
-      expect(cachedList().map((w) => w.id)).toEqual(["ws-1", "ws-2"]);
-    });
-  });
-});
diff --git a/packages/core/workspace/mutations.ts b/packages/core/workspace/mutations.ts
index 32e9c70571c..f23bb7f9649 100644
--- a/packages/core/workspace/mutations.ts
+++ b/packages/core/workspace/mutations.ts
@@ -39,30 +39,6 @@ export function useDeleteWorkspace() {
   const qc = useQueryClient();
   return useMutation({
     mutationFn: (workspaceId: string) => api.deleteWorkspace(workspaceId),
-    // Optimistically drop the workspace from the list cache while the
-    // DELETE is in flight. The delete flow navigates away BEFORE awaiting
-    // the mutation (see workspace-tab.tsx's navigateAwayFromCurrentWorkspace
-    // for the CancelledError race that forces that ordering), so during the
-    // pending window every list consumer — sidebar switcher, by-slug route
-    // resolution, post-auth destination — must already see the workspace as
-    // gone, or a concurrent list refetch re-presents it as selectable and
-    // it can be re-entered mid-delete.
-    onMutate: async (workspaceId) => {
-      // Cancel in-flight list fetches so a response that started before the
-      // delete can't land after the optimistic update and resurrect the row.
-      await qc.cancelQueries({ queryKey: workspaceKeys.list() });
-      const previous = qc.getQueryData<Workspace[]>(workspaceKeys.list());
-      qc.setQueryData<Workspace[]>(workspaceKeys.list(), (old) =>
-        old?.filter((w) => w.id !== workspaceId),
-      );
-      return { previous };
-    },
-    // Rollback: the server still has the workspace, so put it back in the
-    // list (the caller surfaces the error toast). onSettled's invalidate
-    // then reconciles against server truth either way.
-    onError: (_err, _workspaceId, ctx) => {
-      if (ctx?.previous) qc.setQueryData(workspaceKeys.list(), ctx.previous);
-    },
     onSettled: () => {
       qc.invalidateQueries({ queryKey: workspaceKeys.list() });
     },

From b2db309618a344bdbd659186ae571552b0d5f309 Mon Sep 17 00:00:00 2001
From: ZIce <39822906+vicksiyi@users.noreply.github.com>
Date: Mon, 6 Jul 2026 17:19:56 +0800
Subject: [PATCH 15/15] Skip local directory lock for squad leaders (#4951)

Co-authored-by: multica-agent <github@multica.ai>
---
 server/internal/daemon/daemon.go              | 12 +--
 server/internal/daemon/local_directory.go     | 11 +++
 .../internal/daemon/local_directory_test.go   | 77 +++++++++++++++++++
 server/internal/daemon/types.go               |  1 +
 server/internal/handler/agent.go              |  2 +
 5 files changed, 98 insertions(+), 5 deletions(-)

diff --git a/server/internal/daemon/daemon.go b/server/internal/daemon/daemon.go
index 0696fc04f7e..e3052fa3fd5 100644
--- a/server/internal/daemon/daemon.go
+++ b/server/internal/daemon/daemon.go
@@ -2977,7 +2977,7 @@ func (d *Daemon) handleTask(ctx context.Context, task Task, slot int) {
 			// sibling workdir (which is the user's path) or the envRoot
 			// itself (we want output/ and logs/ to linger for forensic
 			// access).
-			if assignment, _ := findLocalDirectoryAssignment(task.ProjectResources, d.cfg.DaemonID); assignment != nil {
+			if assignment, _ := localDirectoryAssignmentForTask(task, d.cfg.DaemonID); assignment != nil {
 				meta.LocalDirectory = true
 			}
 			if err := execenv.WriteGCMeta(result.EnvRoot, meta, taskLog); err != nil {
@@ -3008,7 +3008,7 @@ func (d *Daemon) acquireLocalDirectoryLockIfNeeded(ctx context.Context, task Tas
 	if len(task.ProjectResources) == 0 || d.cfg.DaemonID == "" {
 		return nil, false
 	}
-	assignment, err := findLocalDirectoryAssignment(task.ProjectResources, d.cfg.DaemonID)
+	assignment, err := localDirectoryAssignmentForTask(task, d.cfg.DaemonID)
 	if err != nil {
 		taskLog.Error("local_directory: resolve resource failed", "error", err)
 		if failErr := d.client.FailTask(ctx, task.ID, err.Error(), "", "", "local_directory_error"); failErr != nil {
@@ -3570,12 +3570,14 @@ func (d *Daemon) runTask(ctx context.Context, task Task, provider string, slot i
 	}
 	// Resolve any local_directory assignment again here so runTask can plumb
 	// LocalWorkDir into execenv. handleTask already validated + locked the
-	// path; this call is a pure JSON parse over the same task payload.
-	localAssignment, _ := findLocalDirectoryAssignment(task.ProjectResources, d.cfg.DaemonID)
+	// path for worker tasks; leader tasks intentionally skip the assignment.
+	localAssignment, _ := localDirectoryAssignmentForTask(task, d.cfg.DaemonID)
 	// Reuse intentionally skipped for local_directory tasks: the prior
 	// WorkDir is the user's own path (always present) but the reuse path
 	// loses the envRoot association the GC loop needs, and re-running
 	// Prepare against a stable user path is cheap (no clone, no copy).
+	// Squad-leader tasks also skip reuse so a pre-fix leader session recorded
+	// against the user's local_directory cannot be re-entered without a lock.
 	var agentMcpConfig json.RawMessage
 	if task.Agent != nil {
 		agentMcpConfig = task.Agent.McpConfig
@@ -3589,7 +3591,7 @@ func (d *Daemon) runTask(ctx context.Context, task Task, provider string, slot i
 	if task.Agent != nil && provider == "openclaw" {
 		openclawMode, openclawGateway = decodeOpenclawRuntimeConfig(task.Agent.RuntimeConfig, d.logger)
 	}
-	if task.PriorWorkDir != "" && localAssignment == nil {
+	if task.PriorWorkDir != "" && localAssignment == nil && !task.IsLeaderTask {
 		env = execenv.Reuse(execenv.ReuseParams{
 			WorkDir:         task.PriorWorkDir,
 			Provider:        provider,
diff --git a/server/internal/daemon/local_directory.go b/server/internal/daemon/local_directory.go
index 73b54387498..6e78e4266e9 100644
--- a/server/internal/daemon/local_directory.go
+++ b/server/internal/daemon/local_directory.go
@@ -40,6 +40,17 @@ type localDirectoryAssignment struct {
 	RealPath string // canonical key for the path mutex
 }
 
+// localDirectoryAssignmentForTask returns the local_directory assignment a task
+// should execute inside. Squad-leader tasks are coordinators: they may create
+// child issues or comments, but should not bind to the user's repo worktree or
+// hold the path mutex while downstream workers are ready to write.
+func localDirectoryAssignmentForTask(task Task, daemonID string) (*localDirectoryAssignment, error) {
+	if task.IsLeaderTask {
+		return nil, nil
+	}
+	return findLocalDirectoryAssignment(task.ProjectResources, daemonID)
+}
+
 // findLocalDirectoryAssignment scans the task's project resources for one of
 // type local_directory whose daemon_id matches this daemon. Returns nil
 // (without error) when no such resource exists — the task takes the regular
diff --git a/server/internal/daemon/local_directory_test.go b/server/internal/daemon/local_directory_test.go
index 5620de60257..a6d11171826 100644
--- a/server/internal/daemon/local_directory_test.go
+++ b/server/internal/daemon/local_directory_test.go
@@ -138,6 +138,83 @@ func TestFindLocalDirectoryAssignment(t *testing.T) {
 	})
 }
 
+func TestAcquireLocalDirectoryLockSkipsSquadLeaderTasks(t *testing.T) {
+	t.Parallel()
+
+	const daemonID = "d-mine"
+	tmp := t.TempDir()
+	raw, err := json.Marshal(localDirectoryRef{LocalPath: tmp, DaemonID: daemonID})
+	if err != nil {
+		t.Fatalf("marshal: %v", err)
+	}
+	resources := []ProjectResourceData{
+		{ID: "r1", ResourceType: localDirectoryResourceType, ResourceRef: raw},
+	}
+
+	worker := Task{
+		ID:               "worker-task",
+		ProjectResources: resources,
+	}
+	assignment, err := localDirectoryAssignmentForTask(worker, daemonID)
+	if err != nil {
+		t.Fatalf("worker assignment: %v", err)
+	}
+	if assignment == nil {
+		t.Fatal("worker assignment is nil")
+	}
+
+	d := &Daemon{
+		cfg:            Config{DaemonID: daemonID},
+		localPathLocks: NewLocalPathLocker(),
+		logger:         slog.Default(),
+	}
+	leader := Task{
+		ID:               "leader-task",
+		IsLeaderTask:     true,
+		ProjectResources: resources,
+	}
+	leaderAssignment, err := localDirectoryAssignmentForTask(leader, daemonID)
+	if err != nil {
+		t.Fatalf("leader assignment: %v", err)
+	}
+	if leaderAssignment != nil {
+		t.Fatalf("leader assignment = %+v, want nil", leaderAssignment)
+	}
+	leaderRelease, abort := d.acquireLocalDirectoryLockIfNeeded(context.Background(), leader, slog.Default())
+	if abort {
+		t.Fatal("leader lock acquisition aborted")
+	}
+	if leaderRelease != nil {
+		t.Fatal("leader lock acquisition returned a release callback")
+	}
+	if got := d.localPathLocks.Holder(assignment.RealPath); got != "" {
+		t.Fatalf("holder after leader skip = %q, want empty", got)
+	}
+
+	release, abort := d.acquireLocalDirectoryLockIfNeeded(context.Background(), worker, slog.Default())
+	if abort {
+		t.Fatal("worker lock acquisition aborted")
+	}
+	if release == nil {
+		t.Fatal("worker lock acquisition returned nil release")
+	}
+	defer release()
+	if got := d.localPathLocks.Holder(assignment.RealPath); got != worker.ID {
+		t.Fatalf("holder = %q, want %q", got, worker.ID)
+	}
+
+	leaderRelease, abort = d.acquireLocalDirectoryLockIfNeeded(context.Background(), leader, slog.Default())
+	if abort {
+		t.Fatal("leader lock acquisition aborted")
+	}
+	if leaderRelease != nil {
+		t.Fatal("leader lock acquisition returned a release callback")
+	}
+	if got := d.localPathLocks.Holder(assignment.RealPath); got != worker.ID {
+		t.Fatalf("holder after leader skip = %q, want %q", got, worker.ID)
+	}
+}
+
 func TestValidateLocalPath(t *testing.T) {
 	if runtime.GOOS == "windows" {
 		t.Skip("blacklist constants are POSIX-only in this test")
diff --git a/server/internal/daemon/types.go b/server/internal/daemon/types.go
index 20fe7987ab1..718eb9b7f2c 100644
--- a/server/internal/daemon/types.go
+++ b/server/internal/daemon/types.go
@@ -67,6 +67,7 @@ type Task struct {
 	ProjectTitle             string                `json:"project_title,omitempty"`               // human-readable project title for context injection
 	ProjectDescription       string                `json:"project_description,omitempty"`         // durable project-level context injected into the brief
 	ProjectResources         []ProjectResourceData `json:"project_resources,omitempty"`           // project-scoped resources to expose to the agent
+	IsLeaderTask             bool                  `json:"is_leader_task,omitempty"`              // true when executing in the squad-leader coordinator role
 	PriorSessionID           string                `json:"prior_session_id,omitempty"`            // Claude session ID from a previous task on this issue
 	PriorWorkDir             string                `json:"prior_work_dir,omitempty"`              // work_dir from a previous task on this issue
 	TriggerCommentID         string                `json:"trigger_comment_id,omitempty"`          // comment that triggered this task
diff --git a/server/internal/handler/agent.go b/server/internal/handler/agent.go
index 6277d6956cb..4df659e7baf 100644
--- a/server/internal/handler/agent.go
+++ b/server/internal/handler/agent.go
@@ -286,6 +286,7 @@ type AgentTaskResponse struct {
 	Attempt            int32                 `json:"attempt"`
 	MaxAttempts        int32                 `json:"max_attempts"`
 	ParentTaskID       *string               `json:"parent_task_id,omitempty"`
+	IsLeaderTask       bool                  `json:"is_leader_task,omitempty"`
 	Agent              *TaskAgentData        `json:"agent,omitempty"`
 	ConnectedApps      []ConnectedAppData    `json:"connected_apps,omitempty"` // daemon-claim only: per-run app capabilities mounted through runtime MCP overlays
 	Repos              []RepoData            `json:"repos,omitempty"`
@@ -444,6 +445,7 @@ func taskToResponse(t db.AgentTaskQueue, workspaceID string) AgentTaskResponse {
 		Attempt:          t.Attempt,
 		MaxAttempts:      t.MaxAttempts,
 		ParentTaskID:     uuidToPtr(t.ParentTaskID),
+		IsLeaderTask:     t.IsLeaderTask,
 		CreatedAt:        timestampToString(t.CreatedAt),
 		TriggerCommentID: uuidToPtr(t.TriggerCommentID),
 		TriggerSummary:   textToPtr(t.TriggerSummary),