feat: add multi-feature batching for coding agents

Enable the orchestrator to assign 1-3 features per coding agent subprocess,
selected via dependency chain extension + same-category fill. This reduces
cold-start overhead and leverages shared context across related features.

Orchestrator (parallel_orchestrator.py):
- Add batch tracking: _batch_features and _feature_to_primary data structures
- Add build_feature_batches() with dependency chain + category fill algorithm
- Add start_feature_batch() and _spawn_coding_agent_batch() methods
- Update _on_agent_complete() for batch cleanup across all features
- Update stop_feature() with _feature_to_primary lookup
- Update get_ready_features() to exclude all batch feature IDs
- Update main loop to build batches then spawn per available slot

CLI and agent layer:
- Add --feature-ids (comma-separated) and --batch-size CLI args
- Add feature_ids parameter to run_autonomous_agent() with batch prompt selection
- Add get_batch_feature_prompt() with sequential workflow instructions

WebSocket layer (server/websocket.py):
- Add BATCH_CODING_AGENT_START_PATTERN and BATCH_FEATURES_COMPLETE_PATTERN
- Add _handle_batch_agent_start() and _handle_batch_agent_complete() methods
- Add featureIds field to all agent_update messages
- Track current_feature_id updates as agent moves through batch

Frontend (React UI):
- Add featureIds to ActiveAgent and WSAgentUpdateMessage types
- Update KanbanColumn and DependencyGraph agent-feature maps for batch
- Update AgentCard to show "Batch: #X, #Y, #Z" with active feature highlight
- Add "Features per Agent" segmented control (1-3) in SettingsModal

Settings integration (full stack):
- Add batch_size to schemas, settings router, agent router, process manager
- Default batch_size=3, user-configurable 1-3 via settings UI
- batch_size=1 is functionally identical to pre-batching behavior

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

.claude/commands/create-spec.md

@@ -8,7 +8,7 @@ This command **requires** the project directory as an argument via `$ARGUMENTS`.
 
 **Example:** `/create-spec generations/my-app`
 
-**Output location:** `$ARGUMENTS/prompts/app_spec.txt` and `$ARGUMENTS/prompts/initializer_prompt.md`
+**Output location:** `$ARGUMENTS/.autocoder/prompts/app_spec.txt` and `$ARGUMENTS/.autocoder/prompts/initializer_prompt.md`
 
 If `$ARGUMENTS` is empty, inform the user they must provide a project path and exit.
 
@@ -95,6 +95,27 @@ Ask the user about their involvement preference:
 
 **For Detailed Mode users**, ask specific tech questions about frontend, backend, database, etc.
 
+### Phase 3b: Database Requirements (MANDATORY)
+
+**Always ask this question regardless of mode:**
+
+> "One foundational question about data storage:
+>
+> **Does this application need to store user data persistently?**
+>
+> 1. **Yes, needs a database** - Users create, save, and retrieve data (most apps)
+> 2. **No, stateless** - Pure frontend, no data storage needed (calculators, static sites)
+> 3. **Not sure** - Let me describe what I need and you decide"
+
+**Branching logic:**
+
+- **If "Yes" or "Not sure"**: Continue normally. The spec will include database in tech stack and the initializer will create 5 mandatory Infrastructure features (indices 0-4) to verify database connectivity and persistence.
+
+- **If "No, stateless"**: Note this in the spec. Skip database from tech stack. Infrastructure features will be simplified (no database persistence tests). Mark this clearly:
+  ```xml
+  <database>none - stateless application</database>
+  ```
+
 ## Phase 4: Features (THE MAIN PHASE)
 
 This is where you spend most of your time. Ask questions in plain language that anyone can answer.
@@ -207,12 +228,23 @@ After gathering all features, **you** (the agent) should tally up the testable f
 
 **Typical ranges for reference:**
 
-- **Simple apps** (todo list, calculator, notes): ~20-50 features
-- **Medium apps** (blog, task manager with auth): ~100 features
-- **Advanced apps** (e-commerce, CRM, full SaaS): ~150-200 features
+- **Simple apps** (todo list, calculator, notes): ~25-55 features (includes 5 infrastructure)
+- **Medium apps** (blog, task manager with auth): ~105 features (includes 5 infrastructure)
+- **Advanced apps** (e-commerce, CRM, full SaaS): ~155-205 features (includes 5 infrastructure)
 
 These are just reference points - your actual count should come from the requirements discussed.
 
+**MANDATORY: Infrastructure Features**
+
+If the app requires a database (Phase 3b answer was "Yes" or "Not sure"), you MUST include 5 Infrastructure features (indices 0-4):
+1. Database connection established
+2. Database schema applied correctly
+3. Data persists across server restart
+4. No mock data patterns in codebase
+5. Backend API queries real database
+
+These features ensure the coding agent implements a real database, not mock data or in-memory storage.
+
 **How to count features:**
 For each feature area discussed, estimate the number of discrete, testable behaviors:
 
@@ -225,17 +257,20 @@ For each feature area discussed, estimate the number of discrete, testable behav
 
 > "Based on what we discussed, here's my feature breakdown:
 >
+> - **Infrastructure (required)**: 5 features (database setup, persistence verification)
 > - [Category 1]: ~X features
 > - [Category 2]: ~Y features
 > - [Category 3]: ~Z features
 > - ...
 >
-> **Total: ~N features**
+> **Total: ~N features** (including 5 infrastructure)
 >
 > Does this seem right, or should I adjust?"
 
 Let the user confirm or adjust. This becomes your `feature_count` for the spec.
 
+**Important:** The first 5 features (indices 0-4) created by the initializer MUST be the Infrastructure category with no dependencies. All other features depend on these.
+
 ## Phase 5: Technical Details (DERIVED OR DISCUSSED)
 
 **For Quick Mode users:**
@@ -312,13 +347,13 @@ First ask in conversation if they want to make changes.
 
 ## Output Directory
 
-The output directory is: `$ARGUMENTS/prompts/`
+The output directory is: `$ARGUMENTS/.autocoder/prompts/`
 
 Once the user approves, generate these files:
 
 ## 1. Generate `app_spec.txt`
 
-**Output path:** `$ARGUMENTS/prompts/app_spec.txt`
+**Output path:** `$ARGUMENTS/.autocoder/prompts/app_spec.txt`
 
 Create a new file using this XML structure:
 
@@ -454,7 +489,7 @@ Create a new file using this XML structure:
 
 ## 2. Update `initializer_prompt.md`
 
-**Output path:** `$ARGUMENTS/prompts/initializer_prompt.md`
+**Output path:** `$ARGUMENTS/.autocoder/prompts/initializer_prompt.md`
 
 If the output directory has an existing `initializer_prompt.md`, read it and update the feature count.
 If not, copy from `.claude/templates/initializer_prompt.template.md` first, then update.
@@ -477,7 +512,7 @@ After:  **CRITICAL:** You must create exactly **25** features using the `feature
 
 ## 3. Write Status File (REQUIRED - Do This Last)
 
-**Output path:** `$ARGUMENTS/prompts/.spec_status.json`
+**Output path:** `$ARGUMENTS/.autocoder/prompts/.spec_status.json`
 
 **CRITICAL:** After you have completed ALL requested file changes, write this status file to signal completion to the UI. This is required for the "Continue to Project" button to appear.
 
@@ -489,8 +524,8 @@ Write this JSON file:
   "version": 1,
   "timestamp": "[current ISO 8601 timestamp, e.g., 2025-01-15T14:30:00.000Z]",
   "files_written": [
-    "prompts/app_spec.txt",
-    "prompts/initializer_prompt.md"
+    ".autocoder/prompts/app_spec.txt",
+    ".autocoder/prompts/initializer_prompt.md"
   ],
   "feature_count": [the feature count from Phase 4L]
 }
@@ -504,9 +539,9 @@ Write this JSON file:
   "version": 1,
   "timestamp": "2025-01-15T14:30:00.000Z",
   "files_written": [
-    "prompts/app_spec.txt",
-    "prompts/initializer_prompt.md",
-    "prompts/coding_prompt.md"
+    ".autocoder/prompts/app_spec.txt",
+    ".autocoder/prompts/initializer_prompt.md",
+    ".autocoder/prompts/coding_prompt.md"
   ],
   "feature_count": 35
 }
@@ -524,11 +559,11 @@ Write this JSON file:
 
 Once files are generated, tell the user what to do next:
 
-> "Your specification files have been created in `$ARGUMENTS/prompts/`!
+> "Your specification files have been created in `$ARGUMENTS/.autocoder/prompts/`!
 >
 > **Files created:**
-> - `$ARGUMENTS/prompts/app_spec.txt`
-> - `$ARGUMENTS/prompts/initializer_prompt.md`
+> - `$ARGUMENTS/.autocoder/prompts/app_spec.txt`
+> - `$ARGUMENTS/.autocoder/prompts/initializer_prompt.md`
 >
 > The **Continue to Project** button should now appear. Click it to start the autonomous coding agent!
 >

.claude/commands/expand-project.md

@@ -42,7 +42,7 @@ You are the **Project Expansion Assistant** - an expert at understanding existin
 # FIRST: Read and Understand Existing Project
 
 **Step 1:** Read the existing specification:
-- Read `$ARGUMENTS/prompts/app_spec.txt`
+- Read `$ARGUMENTS/.autocoder/prompts/app_spec.txt`
 
 **Step 2:** Present a summary to the user:
 
@@ -231,4 +231,4 @@ If they want to add more, go back to Phase 1.
 
 # BEGIN
 
-Start by reading the app specification file at `$ARGUMENTS/prompts/app_spec.txt`, then greet the user with a summary of their existing project and ask what they want to add.
+Start by reading the app specification file at `$ARGUMENTS/.autocoder/prompts/app_spec.txt`, then greet the user with a summary of their existing project and ask what they want to add.

.claude/commands/gsd-to-autocoder-spec.md

@@ -5,6 +5,6 @@ description: Convert GSD codebase mapping to Autocoder app_spec.txt
 
 # GSD to Autocoder Spec
 
-Convert `.planning/codebase/*.md` (from `/gsd:map-codebase`) to Autocoder's `prompts/app_spec.txt`.
+Convert `.planning/codebase/*.md` (from `/gsd:map-codebase`) to Autocoder's `.autocoder/prompts/app_spec.txt`.
 
 @.claude/skills/gsd-to-autocoder-spec/SKILL.md

.claude/commands/review-pr.md

@@ -0,0 +1,75 @@
+---
+description: Review pull requests
+---
+
+Pull request(s): $ARGUMENTS
+
+- If no PR numbers are provided, ask the user to provide PR number(s).
+- At least 1 PR is required.
+
+## TASKS
+
+1. **Retrieve PR Details**
+   - Use the GH CLI tool to retrieve the details (descriptions, diffs, comments, feedback, reviews, etc)
+
+2. **Assess PR Complexity**
+
+   After retrieving PR details, assess complexity based on:
+   - Number of files changed
+   - Lines added/removed
+   - Number of contributors/commits
+   - Whether changes touch core/architectural files
+
+   ### Complexity Tiers
+
+   **Simple** (no deep dive agents needed):
+   - ≤5 files changed AND ≤100 lines changed AND single author
+   - Review directly without spawning agents
+
+   **Medium** (1-2 deep dive agents):
+   - 6-15 files changed, OR 100-500 lines, OR 2 contributors
+   - Spawn 1 agent for focused areas, 2 if changes span multiple domains
+
+   **Complex** (up to 3 deep dive agents):
+   - >15 files, OR >500 lines, OR >2 contributors, OR touches core architecture
+   - Spawn up to 3 agents to analyze different aspects (e.g., security, performance, architecture)
+
+3. **Analyze Codebase Impact**
+   - Based on the complexity tier determined above, spawn the appropriate number of deep dive subagents
+   - For Simple PRs: analyze directly without spawning agents
+   - For Medium PRs: spawn 1-2 agents focusing on the most impacted areas
+   - For Complex PRs: spawn up to 3 agents to cover security, performance, and architectural concerns
+
+4. **PR Scope & Title Alignment Check**
+   - Compare the PR title and description against the actual diff content
+   - Check whether the PR is focused on a single coherent change or contains multiple unrelated changes
+   - If the title/description describe one thing but the PR contains significantly more (e.g., title says "fix typo in README" but the diff touches 20 files across multiple domains), flag this as a **scope mismatch**
+   - A scope mismatch is a **merge blocker** — recommend the author split the PR into smaller, focused PRs
+   - Suggest specific ways to split the PR (e.g., "separate the refactor from the feature addition")
+   - Reviewing large, unfocused PRs is impractical and error-prone; the review cannot provide adequate assurance for such changes
+
+5. **Vision Alignment Check**
+   - Read the project's README.md and CLAUDE.md to understand the application's core purpose
+   - Assess whether this PR aligns with the application's intended functionality
+   - If the changes deviate significantly from the core vision or add functionality that doesn't serve the application's purpose, note this in the review
+   - This is not a blocker, but should be flagged for the reviewer's consideration
+
+6. **Safety Assessment**
+   - Provide a review on whether the PR is safe to merge as-is
+   - Provide any feedback in terms of risk level
+
+7. **Improvements**
+   - Propose any improvements in terms of importance and complexity
+
+8. **Merge Recommendation**
+   - Based on all findings, provide a clear merge/don't-merge recommendation
+   - If all concerns are minor (cosmetic issues, naming suggestions, small style nits, missing comments, etc.), recommend **merging the PR** and note that the reviewer can address these minor concerns themselves with a quick follow-up commit pushed directly to master
+   - If there are significant concerns (bugs, security issues, architectural problems, scope mismatch), recommend **not merging** and explain what needs to be resolved first
+
+9. **TLDR**
+   - End the review with a `## TLDR` section
+   - In 3-5 bullet points maximum, summarize:
+     - What this PR is actually about (one sentence)
+     - The key concerns, if any (or "no significant concerns")
+     - **Verdict: MERGE** / **MERGE (with minor follow-up)** / **DON'T MERGE** with a one-line reason
+   - This section should be scannable in under 10 seconds

.claude/skills/gsd-to-autocoder-spec/SKILL.md

@@ -9,7 +9,7 @@ description: |
 
 # GSD to Autocoder Spec Converter
 
-Converts `.planning/codebase/*.md` (GSD mapping output) to `prompts/app_spec.txt` (Autocoder format).
+Converts `.planning/codebase/*.md` (GSD mapping output) to `.autocoder/prompts/app_spec.txt` (Autocoder format).
 
 ## When to Use
 
@@ -84,7 +84,7 @@ Extract:
 
 Create `prompts/` directory:
 ```bash
-mkdir -p prompts
+mkdir -p .autocoder/prompts
 ```
 
 **Mapping GSD Documents to Autocoder Spec:**
@@ -114,7 +114,7 @@ mkdir -p prompts
 **Write the spec file** using the XML format from [references/app-spec-format.md](references/app-spec-format.md):
 
 ```bash
-cat > prompts/app_spec.txt << 'EOF'
+cat > .autocoder/prompts/app_spec.txt << 'EOF'
 <project_specification>
   <project_name>{from package.json or directory}</project_name>
 
@@ -173,9 +173,9 @@ EOF
 ### Step 5: Verify Generated Spec
 
 ```bash
-head -100 prompts/app_spec.txt
+head -100 .autocoder/prompts/app_spec.txt
 echo "---"
-grep -c "User can\|System\|API\|Feature" prompts/app_spec.txt || echo "0"
+grep -c "User can\|System\|API\|Feature" .autocoder/prompts/app_spec.txt || echo "0"
 ```
 
 **Validation checklist:**
@@ -194,7 +194,7 @@ Output:
 app_spec.txt generated from GSD codebase mapping.
 
 Source: .planning/codebase/*.md
-Output: prompts/app_spec.txt
+Output: .autocoder/prompts/app_spec.txt
 
 Next: Start Autocoder
 

.claude/templates/coding_prompt.template.md

@@ -49,51 +49,21 @@ Otherwise, start servers manually and document the process.
 
 #### TEST-DRIVEN DEVELOPMENT MINDSET (CRITICAL)
 
-Features are **test cases** that drive development. This is test-driven development:
+Features are **test cases** that drive development. If functionality doesn't exist, **BUILD IT** -- you are responsible for implementing ALL required functionality. Missing pages, endpoints, database tables, or components are NOT blockers; they are your job to create.
 
-- **If you can't test a feature because functionality doesn't exist → BUILD IT**
-- You are responsible for implementing ALL required functionality
-- Never assume another process will build it later
-- "Missing functionality" is NOT a blocker - it's your job to create it
-
-**Example:** Feature says "User can filter flashcards by difficulty level"
-- WRONG: "Flashcard page doesn't exist yet" → skip feature
-- RIGHT: "Flashcard page doesn't exist yet" → build flashcard page → implement filter → test feature
-
-**Note:** Your feature has been pre-assigned by the orchestrator. Use `feature_get_by_id` with your assigned feature ID to get the details.
-
-Once you've retrieved the feature, **mark it as in-progress** (if not already):
+**Note:** Your feature has been pre-assigned by the orchestrator. Use `feature_get_by_id` with your assigned feature ID to get the details. Then mark it as in-progress:
 
 ```
-# Mark feature as in-progress
 Use the feature_mark_in_progress tool with feature_id={your_assigned_id}
 ```
 
 If you get "already in-progress" error, that's OK - continue with implementation.
 
-Focus on completing one feature perfectly and completing its testing steps in this session before moving on to other features.
-It's ok if you only complete one feature in this session, as there will be more sessions later that continue to make progress.
+Focus on completing one feature perfectly in this session. It's ok if you only complete one feature, as more sessions will follow.
 
 #### When to Skip a Feature (EXTREMELY RARE)
 
-**Skipping should almost NEVER happen.** Only skip for truly external blockers you cannot control:
-
-- **External API not configured**: Third-party service credentials missing (e.g., Stripe keys, OAuth secrets)
-- **External service unavailable**: Dependency on service that's down or inaccessible
-- **Environment limitation**: Hardware or system requirement you cannot fulfill
-
-**NEVER skip because:**
-
-| Situation | Wrong Action | Correct Action |
-|-----------|--------------|----------------|
-| "Page doesn't exist" | Skip | Create the page |
-| "API endpoint missing" | Skip | Implement the endpoint |
-| "Database table not ready" | Skip | Create the migration |
-| "Component not built" | Skip | Build the component |
-| "No data to test with" | Skip | Create test data or build data entry flow |
-| "Feature X needs to be done first" | Skip | Build feature X as part of this feature |
-
-If a feature requires building other functionality first, **build that functionality**. You are the coding agent - your job is to make the feature work, not to defer it.
+Only skip for truly external blockers: missing third-party credentials (Stripe keys, OAuth secrets), unavailable external services, or unfulfillable environment requirements. **NEVER** skip because a page, endpoint, component, or data doesn't exist yet -- build it. If a feature requires other functionality first, build that functionality as part of this feature.
 
 If you must skip (truly external blocker only):
 
@@ -139,45 +109,22 @@ Use browser automation tools:
 
 ### STEP 5.5: MANDATORY VERIFICATION CHECKLIST (BEFORE MARKING ANY TEST PASSING)
 
-**You MUST complete ALL of these checks before marking any feature as "passes": true**
+**Complete ALL applicable checks before marking any feature as passing:**
 
-#### Security Verification (for protected features)
-
-- [ ] Feature respects user role permissions
-- [ ] Unauthenticated access is blocked (redirects to login)
-- [ ] API endpoint checks authorization (returns 401/403 appropriately)
-- [ ] Cannot access other users' data by manipulating URLs
-
-#### Real Data Verification (CRITICAL - NO MOCK DATA)
-
-- [ ] Created unique test data via UI (e.g., "TEST_12345_VERIFY_ME")
-- [ ] Verified the EXACT data I created appears in UI
-- [ ] Refreshed page - data persists (proves database storage)
-- [ ] Deleted the test data - verified it's gone everywhere
-- [ ] NO unexplained data appeared (would indicate mock data)
-- [ ] Dashboard/counts reflect real numbers after my changes
-
-#### Navigation Verification
-
-- [ ] All buttons on this page link to existing routes
-- [ ] No 404 errors when clicking any interactive element
-- [ ] Back button returns to correct previous page
-- [ ] Related links (edit, view, delete) have correct IDs in URLs
-
-#### Integration Verification
-
-- [ ] Console shows ZERO JavaScript errors
-- [ ] Network tab shows successful API calls (no 500s)
-- [ ] Data returned from API matches what UI displays
-- [ ] Loading states appeared during API calls
-- [ ] Error states handle failures gracefully
+- **Security:** Feature respects role permissions; unauthenticated access blocked; API checks auth (401/403); no cross-user data leaks via URL manipulation
+- **Real Data:** Create unique test data via UI, verify it appears, refresh to confirm persistence, delete and verify removal. No unexplained data (indicates mocks). Dashboard counts reflect real numbers
+- **Mock Data Grep:** Run STEP 5.6 grep checks - no hits in src/ (excluding tests). No globalThis, devStore, or dev-store patterns
+- **Server Restart:** For data features, run STEP 5.7 - data persists across server restart
+- **Navigation:** All buttons link to existing routes, no 404s, back button works, edit/view/delete links have correct IDs
+- **Integration:** Zero JS console errors, no 500s in network tab, API data matches UI, loading/error states work
 
 ### STEP 5.6: MOCK DATA DETECTION (Before marking passing)
 
-1. **Search code:** `grep -r "mockData\|fakeData\|TODO\|STUB" --include="*.ts" --include="*.tsx"`
-2. **Runtime test:** Create unique data (e.g., "TEST_12345") → verify in UI → delete → verify gone
-3. **Check database:** All displayed data must come from real DB queries
-4. If unexplained data appears, it's mock data - fix before marking passing.
+Before marking a feature passing, grep for mock/placeholder data patterns in src/ (excluding test files): `globalThis`, `devStore`, `dev-store`, `mockDb`, `mockData`, `fakeData`, `sampleData`, `dummyData`, `testData`, `TODO.*real`, `TODO.*database`, `STUB`, `MOCK`, `isDevelopment`, `isDev`. Any hits in production code must be investigated and fixed. Also create unique test data (e.g., "TEST_12345"), verify it appears in UI, then delete and confirm removal - unexplained data indicates mock implementations.
+
+### STEP 5.7: SERVER RESTART PERSISTENCE TEST (MANDATORY for data features)
+
+For any feature involving CRUD or data persistence: create unique test data (e.g., "RESTART_TEST_12345"), verify it exists, then fully stop and restart the dev server. After restart, verify the test data still exists. If data is gone, the implementation uses in-memory storage -- run STEP 5.6 greps, find the mock pattern, and replace with real database queries. Clean up test data after verification. This test catches in-memory stores like `globalThis.devStore` that pass all other tests but lose data on restart.
 
 ### STEP 6: UPDATE FEATURE STATUS (CAREFULLY!)
 
@@ -202,17 +149,23 @@ Use the feature_mark_passing tool with feature_id=42
 
 ### STEP 7: COMMIT YOUR PROGRESS
 
-Make a descriptive git commit:
+Make a descriptive git commit.
+
+**Git Commit Rules:**
+- ALWAYS use simple `-m` flag for commit messages
+- NEVER use heredocs (`cat <<EOF` or `<<'EOF'`) - they fail in sandbox mode with "can't create temp file for here document: operation not permitted"
+- For multi-line messages, use multiple `-m` flags:
 
 ```bash
 git add .
-git commit -m "Implement [feature name] - verified end-to-end
+git commit -m "Implement [feature name] - verified end-to-end" -m "- Added [specific changes]" -m "- Tested with browser automation" -m "- Marked feature #X as passing"
+```
 
-- Added [specific changes]
-- Tested with browser automation
-- Marked feature #X as passing
-- Screenshots in verification/ directory
-"
+Or use a single descriptive message:
+
+```bash
+git add .
+git commit -m "feat: implement [feature name] with browser verification"
 ```
 
 ### STEP 8: UPDATE PROGRESS NOTES

.claude/templates/initializer_prompt.template.md

@@ -36,9 +36,9 @@ Use the feature_create_bulk tool to add all features at once. You can create fea
 
 - Feature count must match the `feature_count` specified in app_spec.txt
 - Reference tiers for other projects:
-  - **Simple apps**: ~150 tests
-  - **Medium apps**: ~250 tests
-  - **Complex apps**: ~400+ tests
+  - **Simple apps**: ~165 tests (includes 5 infrastructure)
+  - **Medium apps**: ~265 tests (includes 5 infrastructure)
+  - **Advanced apps**: ~405+ tests (includes 5 infrastructure)
 - Both "functional" and "style" categories
 - Mix of narrow tests (2-5 steps) and comprehensive tests (10+ steps)
 - At least 25 tests MUST have 10+ steps each (more for complex apps)
@@ -60,8 +60,9 @@ Dependencies enable **parallel execution** of independent features. When specifi
 2. **Can only depend on EARLIER features** (index must be less than current position)
 3. **No circular dependencies** allowed
 4. **Maximum 20 dependencies** per feature
-5. **Foundation features (index 0-9)** should have NO dependencies
-6. **60% of features after index 10** should have at least one dependency
+5. **Infrastructure features (indices 0-4)** have NO dependencies - they run FIRST
+6. **ALL features after index 4** MUST depend on `[0, 1, 2, 3, 4]` (infrastructure)
+7. **60% of features after index 10** should have additional dependencies beyond infrastructure
 
 ### Dependency Types
 
@@ -82,30 +83,113 @@ Create WIDE dependency graphs, not linear chains:
 
 ```json
 [
-  // FOUNDATION TIER (indices 0-2, no dependencies) - run first
-  { "name": "App loads without errors", "category": "functional" },
-  { "name": "Navigation bar displays", "category": "style" },
-  { "name": "Homepage renders correctly", "category": "functional" },
+  // INFRASTRUCTURE TIER (indices 0-4, no dependencies) - MUST run first
+  { "name": "Database connection established", "category": "functional" },
+  { "name": "Database schema applied correctly", "category": "functional" },
+  { "name": "Data persists across server restart", "category": "functional" },
+  { "name": "No mock data patterns in codebase", "category": "functional" },
+  { "name": "Backend API queries real database", "category": "functional" },
 
-  // AUTH TIER (indices 3-5, depend on foundation) - run in parallel
-  { "name": "User can register", "depends_on_indices": [0] },
-  { "name": "User can login", "depends_on_indices": [0, 3] },
-  { "name": "User can logout", "depends_on_indices": [4] },
+  // FOUNDATION TIER (indices 5-7, depend on infrastructure)
+  { "name": "App loads without errors", "category": "functional", "depends_on_indices": [0, 1, 2, 3, 4] },
+  { "name": "Navigation bar displays", "category": "style", "depends_on_indices": [0, 1, 2, 3, 4] },
+  { "name": "Homepage renders correctly", "category": "functional", "depends_on_indices": [0, 1, 2, 3, 4] },
 
-  // CORE CRUD TIER (indices 6-9) - WIDE GRAPH: all 4 depend on login
-  // All 4 start as soon as login passes!
-  { "name": "User can create todo", "depends_on_indices": [4] },
-  { "name": "User can view todos", "depends_on_indices": [4] },
-  { "name": "User can edit todo", "depends_on_indices": [4, 6] },
-  { "name": "User can delete todo", "depends_on_indices": [4, 6] },
+  // AUTH TIER (indices 8-10, depend on foundation + infrastructure)
+  { "name": "User can register", "depends_on_indices": [0, 1, 2, 3, 4, 5] },
+  { "name": "User can login", "depends_on_indices": [0, 1, 2, 3, 4, 5, 8] },
+  { "name": "User can logout", "depends_on_indices": [0, 1, 2, 3, 4, 9] },
 
-  // ADVANCED TIER (indices 10-11) - both depend on view, not each other
-  { "name": "User can filter todos", "depends_on_indices": [7] },
-  { "name": "User can search todos", "depends_on_indices": [7] }
+  // CORE CRUD TIER (indices 11-14) - WIDE GRAPH: all 4 depend on login
+  { "name": "User can create todo", "depends_on_indices": [0, 1, 2, 3, 4, 9] },
+  { "name": "User can view todos", "depends_on_indices": [0, 1, 2, 3, 4, 9] },
+  { "name": "User can edit todo", "depends_on_indices": [0, 1, 2, 3, 4, 9, 11] },
+  { "name": "User can delete todo", "depends_on_indices": [0, 1, 2, 3, 4, 9, 11] },
+
+  // ADVANCED TIER (indices 15-16) - both depend on view, not each other
+  { "name": "User can filter todos", "depends_on_indices": [0, 1, 2, 3, 4, 12] },
+  { "name": "User can search todos", "depends_on_indices": [0, 1, 2, 3, 4, 12] }
 ]
 ```
 
-**Result:** With 3 parallel agents, this 12-feature project completes in ~5-6 cycles instead of 12 sequential cycles.
+**Result:** With 3 parallel agents, this project completes efficiently with proper database validation first.
+
+---
+
+## MANDATORY INFRASTRUCTURE FEATURES (Indices 0-4)
+
+**CRITICAL:** Create these FIRST, before any functional features. These features ensure the application uses a real database, not mock data or in-memory storage.
+
+| Index | Name | Test Steps |
+|-------|------|------------|
+| 0 | Database connection established | Start server → check logs for DB connection → health endpoint returns DB status |
+| 1 | Database schema applied correctly | Connect to DB directly → list tables → verify schema matches spec |
+| 2 | Data persists across server restart | Create via API → STOP server completely → START server → query API → data still exists |
+| 3 | No mock data patterns in codebase | Run grep for prohibited patterns → must return empty |
+| 4 | Backend API queries real database | Check server logs → SQL/DB queries appear for API calls |
+
+**ALL other features MUST depend on indices [0, 1, 2, 3, 4].**
+
+### Infrastructure Feature Descriptions
+
+**Feature 0 - Database connection established:**
+```text
+Steps:
+1. Start the development server
+2. Check server logs for database connection message
+3. Call health endpoint (e.g., GET /api/health)
+4. Verify response includes database status: connected
+```
+
+**Feature 1 - Database schema applied correctly:**
+```text
+Steps:
+1. Connect to database directly (sqlite3, psql, etc.)
+2. List all tables in the database
+3. Verify tables match what's defined in app_spec.txt
+4. Verify key columns exist on each table
+```
+
+**Feature 2 - Data persists across server restart (CRITICAL):**
+```text
+Steps:
+1. Create unique test data via API (e.g., POST /api/items with name "RESTART_TEST_12345")
+2. Verify data appears in API response (GET /api/items)
+3. STOP the server completely (kill by port to avoid killing unrelated Node processes):
+   - Unix/macOS: lsof -ti :$PORT | xargs kill -9 2>/dev/null || true && sleep 5
+   - Windows: FOR /F "tokens=5" %a IN ('netstat -aon ^| find ":$PORT"') DO taskkill /F /PID %a 2>nul
+   - Note: Replace $PORT with actual port (e.g., 3000)
+4. Verify server is stopped: lsof -ti :$PORT returns nothing (or netstat on Windows)
+5. RESTART the server: ./init.sh & sleep 15
+6. Query API again: GET /api/items
+7. Verify "RESTART_TEST_12345" still exists
+8. If data is GONE → CRITICAL FAILURE (in-memory storage detected)
+9. Clean up test data
+```
+
+**Feature 3 - No mock data patterns in codebase:**
+```text
+Steps:
+1. Run: grep -r "globalThis\." --include="*.ts" --include="*.tsx" --include="*.js" src/
+2. Run: grep -r "dev-store\|devStore\|DevStore\|mock-db\|mockDb" --include="*.ts" --include="*.tsx" --include="*.js" src/
+3. Run: grep -r "mockData\|testData\|fakeData\|sampleData\|dummyData" --include="*.ts" --include="*.tsx" --include="*.js" src/
+4. Run: grep -r "TODO.*real\|TODO.*database\|TODO.*API\|STUB\|MOCK" --include="*.ts" --include="*.tsx" --include="*.js" src/
+5. Run: grep -r "isDevelopment\|isDev\|process\.env\.NODE_ENV.*development" --include="*.ts" --include="*.tsx" --include="*.js" src/
+6. Run: grep -r "new Map\(\)\|new Set\(\)" --include="*.ts" --include="*.tsx" --include="*.js" src/ 2>/dev/null
+7. Run: grep -E "json-server|miragejs|msw" package.json
+8. ALL grep commands must return empty (exit code 1)
+9. If any returns results → investigate and fix before passing
+```
+
+**Feature 4 - Backend API queries real database:**
+```text
+Steps:
+1. Start server with verbose logging
+2. Make API call (e.g., GET /api/items)
+3. Check server logs
+4. Verify SQL query appears (SELECT, INSERT, etc.) or ORM query log
+5. If no DB queries in logs → implementation is using mock data
+```
 
 ---
 
@@ -115,8 +199,9 @@ The feature_list.json **MUST** include tests from ALL 20 categories. Minimum cou
 
 ### Category Distribution by Complexity Tier
 
-| Category                         | Simple  | Medium  | Complex  |
+| Category                         | Simple  | Medium  | Advanced |
 | -------------------------------- | ------- | ------- | -------- |
+| **0. Infrastructure (REQUIRED)** | 5       | 5       | 5        |
 | A. Security & Access Control     | 5       | 20      | 40       |
 | B. Navigation Integrity          | 15      | 25      | 40       |
 | C. Real Data Verification        | 20      | 30      | 50       |
@@ -137,12 +222,14 @@ The feature_list.json **MUST** include tests from ALL 20 categories. Minimum cou
 | R. Concurrency & Race Conditions | 5       | 8       | 15       |
 | S. Export/Import                 | 5       | 6       | 10       |
 | T. Performance                   | 5       | 5       | 10       |
-| **TOTAL**                        | **150** | **250** | **400+** |
+| **TOTAL**                        | **165** | **265** | **405+** |
 
 ---
 
 ### Category Descriptions
 
+**0. Infrastructure (REQUIRED - Priority 0)** - Database connectivity, schema existence, data persistence across server restart, absence of mock patterns. These features MUST pass before any functional features can begin. All tiers require exactly 5 infrastructure features (indices 0-4).
+
 **A. Security & Access Control** - Test unauthorized access blocking, permission enforcement, session management, role-based access, and data isolation between users.
 
 **B. Navigation Integrity** - Test all buttons, links, menus, breadcrumbs, deep links, back button behavior, 404 handling, and post-login/logout redirects.
@@ -205,6 +292,16 @@ The feature_list.json must include tests that **actively verify real data** and
 - `setTimeout` simulating API delays with static data
 - Static returns instead of database queries
 
+**Additional prohibited patterns (in-memory stores):**
+
+- `globalThis.` (in-memory storage pattern)
+- `dev-store`, `devStore`, `DevStore` (development stores)
+- `json-server`, `mirage`, `msw` (mock backends)
+- `Map()` or `Set()` used as primary data store
+- Environment checks like `if (process.env.NODE_ENV === 'development')` for data routing
+
+**Why this matters:** In-memory stores (like `globalThis.devStore`) will pass simple tests because data persists during a single server run. But data is LOST on server restart, which is unacceptable for production. The Infrastructure features (0-4) specifically test for this by requiring data to survive a full server restart.
+
 ---
 
 **CRITICAL INSTRUCTION:**

.claude/templates/testing_prompt.template.md

@@ -1,58 +1,29 @@
 ## YOUR ROLE - TESTING AGENT
 
-You are a **testing agent** responsible for **regression testing** previously-passing features.
+You are a **testing agent** responsible for **regression testing** previously-passing features. If you find a regression, you must fix it.
 
-Your job is to ensure that features marked as "passing" still work correctly. If you find a regression (a feature that no longer works), you must fix it.
+## ASSIGNED FEATURES FOR REGRESSION TESTING
 
-### STEP 1: GET YOUR BEARINGS (MANDATORY)
+You are assigned to test the following features: {{TESTING_FEATURE_IDS}}
 
-Start by orienting yourself:
+### Workflow for EACH feature:
+1. Call `feature_get_by_id` with the feature ID
+2. Read the feature's verification steps
+3. Test the feature in the browser
+4. Call `feature_mark_passing` or `feature_mark_failing`
+5. Move to the next feature
 
-```bash
-# 1. See your working directory
-pwd
+---
 
-# 2. List files to understand project structure
-ls -la
+### STEP 1: GET YOUR ASSIGNED FEATURE(S)
 
-# 3. Read progress notes from previous sessions (last 200 lines)
-tail -200 claude-progress.txt
-
-# 4. Check recent git history
-git log --oneline -10
-```
-
-Then use MCP tools to check feature status:
+Your features have been pre-assigned by the orchestrator. For each feature ID listed above, use `feature_get_by_id` to get the details:
 
 ```
-# 5. Get progress statistics
-Use the feature_get_stats tool
+Use the feature_get_by_id tool with feature_id=<ID>
 ```
 
-### STEP 2: START SERVERS (IF NOT RUNNING)
-
-If `init.sh` exists, run it:
-
-```bash
-chmod +x init.sh
-./init.sh
-```
-
-Otherwise, start servers manually.
-
-### STEP 3: GET YOUR ASSIGNED FEATURE
-
-Your feature has been pre-assigned by the orchestrator. Use `feature_get_by_id` to get the details:
-
-```
-Use the feature_get_by_id tool with feature_id={your_assigned_id}
-```
-
-The orchestrator has already claimed this feature for testing (set `testing_in_progress=true`).
-
-**CRITICAL:** You MUST call `feature_release_testing` when done, regardless of pass/fail.
-
-### STEP 4: VERIFY THE FEATURE
+### STEP 2: VERIFY THE FEATURE
 
 **CRITICAL:** You MUST verify the feature through the actual UI using browser automation.
 
@@ -81,21 +52,11 @@ Use browser automation tools:
 - browser_console_messages - Get browser console output (check for errors)
 - browser_network_requests - Monitor API calls
 
-### STEP 5: HANDLE RESULTS
+### STEP 3: HANDLE RESULTS
 
 #### If the feature PASSES:
 
-The feature still works correctly. Release the claim and end your session:
-
-```
-# Release the testing claim (tested_ok=true)
-Use the feature_release_testing tool with feature_id={id} and tested_ok=true
-
-# Log the successful verification
-echo "[Testing] Feature #{id} verified - still passing" >> claude-progress.txt
-```
-
-**DO NOT** call feature_mark_passing again - it's already passing.
+The feature still works correctly. **DO NOT** call feature_mark_passing again -- it's already passing. End your session.
 
 #### If the feature FAILS (regression found):
 
@@ -125,13 +86,7 @@ A regression has been introduced. You MUST fix it:
    Use the feature_mark_passing tool with feature_id={id}
    ```
 
-6. **Release the testing claim:**
-   ```
-   Use the feature_release_testing tool with feature_id={id} and tested_ok=false
-   ```
-   Note: tested_ok=false because we found a regression (even though we fixed it).
-
-7. **Commit the fix:**
+6. **Commit the fix:**
    ```bash
    git add .
    git commit -m "Fix regression in [feature name]
@@ -141,14 +96,6 @@ A regression has been introduced. You MUST fix it:
    - Verified with browser automation"
    ```
 
-### STEP 6: UPDATE PROGRESS AND END
-
-Update `claude-progress.txt`:
-
-```bash
-echo "[Testing] Session complete - verified/fixed feature #{id}" >> claude-progress.txt
-```
-
 ---
 
 ## AVAILABLE MCP TOOLS
@@ -156,12 +103,11 @@ echo "[Testing] Session complete - verified/fixed feature #{id}" >> claude-progr
 ### Feature Management
 - `feature_get_stats` - Get progress overview (passing/in_progress/total counts)
 - `feature_get_by_id` - Get your assigned feature details
-- `feature_release_testing` - **REQUIRED** - Release claim after testing (pass tested_ok=true/false)
 - `feature_mark_failing` - Mark a feature as failing (when you find a regression)
 - `feature_mark_passing` - Mark a feature as passing (after fixing a regression)
 
 ### Browser Automation (Playwright)
-All interaction tools have **built-in auto-wait** - no manual timeouts needed.
+All interaction tools have **built-in auto-wait** -- no manual timeouts needed.
 
 - `browser_navigate` - Navigate to URL
 - `browser_take_screenshot` - Capture screenshot
@@ -178,9 +124,7 @@ All interaction tools have **built-in auto-wait** - no manual timeouts needed.
 
 ## IMPORTANT REMINDERS
 
-**Your Goal:** Verify that passing features still work, and fix any regressions found.
-
-**This Session's Goal:** Test ONE feature thoroughly.
+**Your Goal:** Test each assigned feature thoroughly. Verify it still works, and fix any regression found. Process ALL features in your list before ending your session.
 
 **Quality Bar:**
 - Zero console errors
@@ -188,21 +132,15 @@ All interaction tools have **built-in auto-wait** - no manual timeouts needed.
 - Visual appearance correct
 - API calls succeed
 
-**CRITICAL - Always release your claim:**
-- Call `feature_release_testing` when done, whether pass or fail
-- Pass `tested_ok=true` if the feature passed
-- Pass `tested_ok=false` if you found a regression
-
 **If you find a regression:**
 1. Mark the feature as failing immediately
 2. Fix the issue
 3. Verify the fix with browser automation
 4. Mark as passing only after thorough verification
-5. Release the testing claim with `tested_ok=false`
-6. Commit the fix
+5. Commit the fix
 
-**You have one iteration.** Focus on testing ONE feature thoroughly.
+**You have one iteration.** Test all assigned features before ending.
 
 ---
 
-Begin by running Step 1 (Get Your Bearings).
+Begin by running Step 1 for the first feature in your assigned list.

.env.example

@@ -1,12 +1,38 @@
 # Optional: N8N webhook for progress notifications
 # PROGRESS_N8N_WEBHOOK_URL=https://your-n8n-instance.com/webhook/...
 
-# Playwright Browser Mode
-# Controls whether Playwright runs Chrome in headless mode (no visible browser window).
-# - true: Browser runs in background, invisible (recommended for using PC while agent works)
+# Playwright Browser Configuration
+#
+# PLAYWRIGHT_BROWSER: Which browser to use for testing
+# - firefox: Lower CPU usage, recommended (default)
+# - chrome: Google Chrome
+# - webkit: Safari engine
+# - msedge: Microsoft Edge
+# PLAYWRIGHT_BROWSER=firefox
+#
+# PLAYWRIGHT_HEADLESS: Run browser without visible window
+# - true: Browser runs in background, saves CPU (default)
 # - false: Browser opens a visible window (useful for debugging)
-# Defaults to 'false' if not specified
-# PLAYWRIGHT_HEADLESS=false
+# PLAYWRIGHT_HEADLESS=true
+
+# Extra Read Paths (Optional)
+# Comma-separated list of absolute paths for read-only access to external directories.
+# The agent can read files from these paths but cannot write to them.
+# Useful for referencing documentation, shared libraries, or other projects.
+# Example: EXTRA_READ_PATHS=/Volumes/Data/dev,/Users/shared/libs
+# EXTRA_READ_PATHS=
+
+# Google Cloud Vertex AI Configuration (Optional)
+# To use Claude via Vertex AI on Google Cloud Platform, uncomment and set these variables.
+# Requires: gcloud CLI installed and authenticated (run: gcloud auth application-default login)
+# Note: Use @ instead of - in model names (e.g., claude-opus-4-5@20251101)
+#
+# CLAUDE_CODE_USE_VERTEX=1
+# CLOUD_ML_REGION=us-east5
+# ANTHROPIC_VERTEX_PROJECT_ID=your-gcp-project-id
+# ANTHROPIC_DEFAULT_OPUS_MODEL=claude-opus-4-5@20251101
+# ANTHROPIC_DEFAULT_SONNET_MODEL=claude-sonnet-4-5@20250929
+# ANTHROPIC_DEFAULT_HAIKU_MODEL=claude-3-5-haiku@20241022
 
 # GLM/Alternative API Configuration (Optional)
 # To use Zhipu AI's GLM models instead of Claude, uncomment and set these variables.
@@ -19,3 +45,20 @@
 # ANTHROPIC_DEFAULT_SONNET_MODEL=glm-4.7
 # ANTHROPIC_DEFAULT_OPUS_MODEL=glm-4.7
 # ANTHROPIC_DEFAULT_HAIKU_MODEL=glm-4.5-air
+
+# Ollama Local Model Configuration (Optional)
+# To use local models via Ollama instead of Claude, uncomment and set these variables.
+# Requires Ollama v0.14.0+ with Anthropic API compatibility.
+# See: https://ollama.com/blog/claude
+#
+# ANTHROPIC_BASE_URL=http://localhost:11434
+# ANTHROPIC_AUTH_TOKEN=ollama
+# API_TIMEOUT_MS=3000000
+# ANTHROPIC_DEFAULT_SONNET_MODEL=qwen3-coder
+# ANTHROPIC_DEFAULT_OPUS_MODEL=qwen3-coder
+# ANTHROPIC_DEFAULT_HAIKU_MODEL=qwen3-coder
+#
+# Model recommendations:
+# - For best results, use a capable coding model like qwen3-coder or deepseek-coder-v2
+# - You can use the same model for all tiers, or different models per tier
+# - Larger models (70B+) work best for Opus tier, smaller (7B-20B) for Haiku

.gitignore

@@ -76,6 +76,13 @@ ui/playwright-report/
 .dmypy.json
 dmypy.json
 
+.ruff_cache/
+
+# ===================
+# Claude Code
+# ===================
+.claude/settings.local.json
+
 # ===================
 # IDE / Editors
 # ===================

CLAUDE.md

@@ -2,6 +2,12 @@
 
 This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
 
+## Prerequisites
+
+- Python 3.11+
+- Node.js 20+ (for UI development)
+- Claude Code CLI
+
 ## Project Overview
 
 This is an autonomous coding agent system with a React-based UI. It uses the Claude Agent SDK to build complete applications over multiple sessions using a two-agent pattern:
@@ -86,12 +92,40 @@ npm run lint     # Run ESLint
 
 **Note:** The `start_ui.bat` script serves the pre-built UI from `ui/dist/`. After making UI changes, run `npm run build` in the `ui/` directory.
 
+## Testing
+
+### Python
+
+```bash
+ruff check .                      # Lint
+mypy .                            # Type check
+python test_security.py           # Security unit tests (163 tests)
+python test_security_integration.py  # Integration tests (9 tests)
+```
+
+### React UI
+
+```bash
+cd ui
+npm run lint          # ESLint
+npm run build         # Type check + build
+npm run test:e2e      # Playwright end-to-end tests
+npm run test:e2e:ui   # Playwright tests with UI
+```
+
+### Code Quality
+
+Configuration in `pyproject.toml`:
+- ruff: Line length 120, Python 3.11 target
+- mypy: Strict return type checking, ignores missing imports
+
 ## Architecture
 
 ### Core Python Modules
 
 - `start.py` - CLI launcher with project creation/selection menu
 - `autonomous_agent_demo.py` - Entry point for running the agent
+- `autocoder_paths.py` - Central path resolution with dual-path backward compatibility and migration
 - `agent.py` - Agent session loop using Claude Agent SDK
 - `client.py` - ClaudeSDKClient configuration with security hooks and MCP servers
 - `security.py` - Bash command allowlist validation (ALLOWED_COMMANDS whitelist)
@@ -141,7 +175,7 @@ MCP tools available to the agent:
 
 ### React UI (ui/)
 
-- Tech stack: React 18, TypeScript, TanStack Query, Tailwind CSS v4, Radix UI, dagre (graph layout)
+- Tech stack: React 19, TypeScript, TanStack Query, Tailwind CSS v4, Radix UI, dagre (graph layout)
 - `src/App.tsx` - Main app with project selection, kanban board, agent controls
 - `src/hooks/useWebSocket.ts` - Real-time updates via WebSocket (progress, agent status, logs, agent updates)
 - `src/hooks/useProjects.ts` - React Query hooks for API calls
@@ -164,12 +198,17 @@ Keyboard shortcuts (press `?` for help):
 ### Project Structure for Generated Apps
 
 Projects can be stored in any directory (registered in `~/.autocoder/registry.db`). Each project contains:
-- `prompts/app_spec.txt` - Application specification (XML format)
-- `prompts/initializer_prompt.md` - First session prompt
-- `prompts/coding_prompt.md` - Continuation session prompt
-- `features.db` - SQLite database with feature test cases
-- `.agent.lock` - Lock file to prevent multiple agent instances
+- `.autocoder/prompts/app_spec.txt` - Application specification (XML format)
+- `.autocoder/prompts/initializer_prompt.md` - First session prompt
+- `.autocoder/prompts/coding_prompt.md` - Continuation session prompt
+- `.autocoder/features.db` - SQLite database with feature test cases
+- `.autocoder/.agent.lock` - Lock file to prevent multiple agent instances
 - `.autocoder/allowed_commands.yaml` - Project-specific bash command allowlist (optional)
+- `.autocoder/.gitignore` - Ignores runtime files
+- `CLAUDE.md` - Stays at project root (SDK convention)
+- `app_spec.txt` - Root copy for agent template compatibility
+
+Legacy projects with files at root level (e.g., `features.db`, `prompts/`) are auto-migrated to `.autocoder/` on next agent start. Dual-path resolution ensures old and new layouts work transparently.
 
 ### Security Model
 
@@ -178,6 +217,46 @@ Defense-in-depth approach configured in `client.py`:
 2. Filesystem restricted to project directory only
 3. Bash commands validated using hierarchical allowlist system
 
+#### Extra Read Paths (Cross-Project File Access)
+
+The agent can optionally read files from directories outside the project folder via the `EXTRA_READ_PATHS` environment variable. This enables referencing documentation, shared libraries, or other projects.
+
+**Configuration:**
+
+```bash
+# Single path
+EXTRA_READ_PATHS=/Users/me/docs
+
+# Multiple paths (comma-separated)
+EXTRA_READ_PATHS=/Users/me/docs,/opt/shared-libs,/Volumes/Data/reference
+```
+
+**Security Controls:**
+
+All paths are validated before being granted read access:
+- Must be absolute paths (not relative)
+- Must exist and be directories
+- Paths are canonicalized via `Path.resolve()` to prevent `..` traversal attacks
+- Sensitive directories are blocked (see blocklist below)
+- Only Read, Glob, and Grep operations are allowed (no Write/Edit)
+
+**Blocked Sensitive Directories:**
+
+The following directories (relative to home) are always blocked:
+- `.ssh`, `.aws`, `.azure`, `.kube` - Cloud/SSH credentials
+- `.gnupg`, `.gpg`, `.password-store` - Encryption keys
+- `.docker`, `.config/gcloud` - Container/cloud configs
+- `.npmrc`, `.pypirc`, `.netrc` - Package manager credentials
+
+**Example Output:**
+
+```
+Created security settings at /path/to/project/.claude_settings.json
+   - Sandbox enabled (OS-level bash isolation)
+   - Filesystem restricted to: /path/to/project
+   - Extra read paths (validated): /Users/me/docs, /opt/shared-libs
+```
+
 #### Per-Project Allowed Commands
 
 The agent's bash command access is controlled through a hierarchical configuration system:
@@ -237,15 +316,6 @@ blocked_commands:
 - Blocklisted commands (sudo, dd, shutdown, etc.) can NEVER be allowed
 - Org-level blocked commands cannot be overridden by project configs
 
-**Testing:**
-```bash
-# Unit tests (136 tests - fast)
-python test_security.py
-
-# Integration tests (9 tests - uses real hooks)
-python test_security_integration.py
-```
-
 **Files:**
 - `security.py` - Command validation logic and hardcoded blocklist
 - `test_security.py` - Unit tests for security system (136 tests)
@@ -254,7 +324,39 @@ python test_security_integration.py
 - `examples/project_allowed_commands.yaml` - Project config example (all commented by default)
 - `examples/org_config.yaml` - Org config example (all commented by default)
 - `examples/README.md` - Comprehensive guide with use cases, testing, and troubleshooting
-- `PHASE3_SPEC.md` - Specification for mid-session approval feature (future enhancement)
+
+### Ollama Local Models (Optional)
+
+Run coding agents using local models via Ollama v0.14.0+:
+
+1. Install Ollama: https://ollama.com
+2. Start Ollama: `ollama serve`
+3. Pull a coding model: `ollama pull qwen3-coder`
+4. Configure `.env`:
+   ```
+   ANTHROPIC_BASE_URL=http://localhost:11434
+   ANTHROPIC_AUTH_TOKEN=ollama
+   API_TIMEOUT_MS=3000000
+   ANTHROPIC_DEFAULT_SONNET_MODEL=qwen3-coder
+   ANTHROPIC_DEFAULT_OPUS_MODEL=qwen3-coder
+   ANTHROPIC_DEFAULT_HAIKU_MODEL=qwen3-coder
+   ```
+5. Run autocoder normally - it will use your local Ollama models
+
+**Recommended coding models:**
+- `qwen3-coder` - Good balance of speed and capability
+- `deepseek-coder-v2` - Strong coding performance
+- `codellama` - Meta's code-focused model
+
+**Model tier mapping:**
+- Use the same model for all tiers, or map different models per capability level
+- Larger models (70B+) work best for Opus tier
+- Smaller models (7B-20B) work well for Haiku tier
+
+**Known limitations:**
+- Smaller context windows than Claude (model-dependent)
+- Extended context beta disabled (not supported by Ollama)
+- Performance depends on local hardware (GPU recommended)
 
 ## Claude Code Integration
 
@@ -267,12 +369,12 @@ python test_security_integration.py
 
 ### Prompt Loading Fallback Chain
 
-1. Project-specific: `{project_dir}/prompts/{name}.md`
+1. Project-specific: `{project_dir}/.autocoder/prompts/{name}.md` (or legacy `{project_dir}/prompts/{name}.md`)
 2. Base template: `.claude/templates/{name}.template.md`
 
 ### Agent Session Flow
 
-1. Check if `features.db` has features (determines initializer vs coding agent)
+1. Check if `.autocoder/features.db` has features (determines initializer vs coding agent)
 2. Create ClaudeSDKClient with security settings
 3. Send prompt and stream response
 4. Auto-continue with 3-second delay between sessions
@@ -301,55 +403,7 @@ The orchestrator enforces strict bounds on concurrent processes:
 - `MAX_PARALLEL_AGENTS = 5` - Maximum concurrent coding agents
 - `MAX_TOTAL_AGENTS = 10` - Hard limit on total agents (coding + testing)
 - Testing agents are capped at `max_concurrency` (same as coding agents)
-
-**Expected process count during normal operation:**
-- 1 orchestrator process
-- Up to 5 coding agents
-- Up to 5 testing agents
-- Total: never exceeds 11 Python processes
-
-**Stress Test Verification:**
-
-```bash
-# Windows - verify process bounds
-# 1. Note baseline count
-tasklist | findstr python | find /c /v ""
-
-# 2. Start parallel agent (max concurrency)
-python autonomous_agent_demo.py --project-dir test --parallel --max-concurrency 5
-
-# 3. During run - should NEVER exceed baseline + 11
-tasklist | findstr python | find /c /v ""
-
-# 4. After stop via UI - should return to baseline
-tasklist | findstr python | find /c /v ""
-```
-
-```bash
-# macOS/Linux - verify process bounds
-# 1. Note baseline count
-pgrep -c python
-
-# 2. Start parallel agent
-python autonomous_agent_demo.py --project-dir test --parallel --max-concurrency 5
-
-# 3. During run - should NEVER exceed baseline + 11
-pgrep -c python
-
-# 4. After stop - should return to baseline
-pgrep -c python
-```
-
-**Log Verification:**
-
-```bash
-# Check spawn vs completion balance
-grep "Started testing agent" orchestrator_debug.log | wc -l
-grep "Testing agent.*completed\|failed" orchestrator_debug.log | wc -l
-
-# Watch for cap enforcement messages
-grep "at max testing agents\|At max total agents" orchestrator_debug.log
-```
+- Total process count never exceeds 11 Python processes (1 orchestrator + 5 coding + 5 testing)
 
 ### Design System
 

SAMPLE_PROMPT.md

@@ -1,22 +0,0 @@
-Let's call it Simple Todo. This is a really simple web app that I can use to track my to-do items using a Kanban
-board. I should be able to add to-dos and then drag and drop them through the Kanban board. The different columns in
-the Kanban board are:
-
-- To Do
-- In Progress
-- Done
-
-The app should use a neobrutalism design.
-
-There is no need for user authentication either. All the to-dos will be stored in local storage, so each user has
-access to all of their to-dos when they open their browser. So do not worry about implementing a backend with user
-authentication or a database. Simply store everything in local storage. As for the design, please try to avoid AI
-slop, so use your front-end design skills to design something beautiful and practical. As for the content of the
-to-dos, we should store:
-
-- The name or the title at the very least
-- Optionally, we can also set tags, due dates, and priorities which should be represented as beautiful little badges
-  on the to-do card Users should have the ability to easily clear out all the completed To-Dos. They should also be
-  able to filter and search for To-Dos as well.
-
-You choose the rest. Keep it simple. Should be 25 features.

agent.py

@@ -23,14 +23,27 @@ if sys.platform == "win32":
     sys.stderr = io.TextIOWrapper(sys.stderr.buffer, encoding="utf-8", errors="replace", line_buffering=True)
 
 from client import create_client
-from progress import count_passing_tests, has_features, print_progress_summary, print_session_header
+from progress import (
+    count_passing_tests,
+    has_features,
+    print_progress_summary,
+    print_session_header,
+)
 from prompts import (
     copy_spec_to_project,
+    get_batch_feature_prompt,
     get_coding_prompt,
     get_initializer_prompt,
     get_single_feature_prompt,
     get_testing_prompt,
 )
+from rate_limit_utils import (
+    calculate_error_backoff,
+    calculate_rate_limit_backoff,
+    clamp_retry_delay,
+    is_rate_limit_error,
+    parse_retry_after,
+)
 
 # Configuration
 AUTO_CONTINUE_DELAY_SECONDS = 3
@@ -106,8 +119,19 @@ async def run_agent_session(
         return "continue", response_text
 
     except Exception as e:
-        print(f"Error during agent session: {e}")
-        return "error", str(e)
+        error_str = str(e)
+        print(f"Error during agent session: {error_str}")
+
+        # Detect rate limit errors from exception message
+        if is_rate_limit_error(error_str):
+            # Try to extract retry-after time from error
+            retry_seconds = parse_retry_after(error_str)
+            if retry_seconds is not None:
+                return "rate_limit", str(retry_seconds)
+            else:
+                return "rate_limit", "unknown"
+
+        return "error", error_str
 
 
 async def run_autonomous_agent(
@@ -116,8 +140,10 @@ async def run_autonomous_agent(
     max_iterations: Optional[int] = None,
     yolo_mode: bool = False,
     feature_id: Optional[int] = None,
+    feature_ids: Optional[list[int]] = None,
     agent_type: Optional[str] = None,
     testing_feature_id: Optional[int] = None,
+    testing_feature_ids: Optional[list[int]] = None,
 ) -> None:
     """
     Run the autonomous agent loop.
@@ -128,8 +154,10 @@ async def run_autonomous_agent(
         max_iterations: Maximum number of iterations (None for unlimited)
         yolo_mode: If True, skip browser testing in coding agent prompts
         feature_id: If set, work only on this specific feature (used by orchestrator for coding agents)
+        feature_ids: If set, work on these features in batch (used by orchestrator for batch mode)
         agent_type: Type of agent: "initializer", "coding", "testing", or None (auto-detect)
-        testing_feature_id: For testing agents, the pre-claimed feature ID to test
+        testing_feature_id: For testing agents, the pre-claimed feature ID to test (legacy single mode)
+        testing_feature_ids: For testing agents, list of feature IDs to batch test
     """
     print("\n" + "=" * 70)
     print("  AUTONOMOUS CODING AGENT")
@@ -140,7 +168,9 @@ async def run_autonomous_agent(
         print(f"Agent type: {agent_type}")
     if yolo_mode:
         print("Mode: YOLO (testing agents disabled)")
-    if feature_id:
+    if feature_ids and len(feature_ids) > 1:
+        print(f"Feature batch: {', '.join(f'#{fid}' for fid in feature_ids)}")
+    elif feature_id:
         print(f"Feature assignment: #{feature_id}")
     if max_iterations:
         print(f"Max iterations: {max_iterations}")
@@ -183,6 +213,8 @@ async def run_autonomous_agent(
 
     # Main loop
     iteration = 0
+    rate_limit_retries = 0  # Track consecutive rate limit errors for exponential backoff
+    error_retries = 0  # Track consecutive non-rate-limit errors
 
     while True:
         iteration += 1
@@ -212,23 +244,29 @@ async def run_autonomous_agent(
         import os
         if agent_type == "testing":
             agent_id = f"testing-{os.getpid()}"  # Unique ID for testing agents
+        elif feature_ids and len(feature_ids) > 1:
+            agent_id = f"batch-{feature_ids[0]}"
         elif feature_id:
             agent_id = f"feature-{feature_id}"
         else:
             agent_id = None
-        client = create_client(project_dir, model, yolo_mode=yolo_mode, agent_id=agent_id)
+        client = create_client(project_dir, model, yolo_mode=yolo_mode, agent_id=agent_id, agent_type=agent_type)
 
         # Choose prompt based on agent type
         if agent_type == "initializer":
             prompt = get_initializer_prompt(project_dir)
         elif agent_type == "testing":
-            prompt = get_testing_prompt(project_dir, testing_feature_id)
-        elif feature_id:
+            prompt = get_testing_prompt(project_dir, testing_feature_id, testing_feature_ids)
+        elif feature_ids and len(feature_ids) > 1:
+            # Batch mode (used by orchestrator for multi-feature coding agents)
+            prompt = get_batch_feature_prompt(feature_ids, project_dir, yolo_mode)
+        elif feature_id or (feature_ids is not None and len(feature_ids) == 1):
             # Single-feature mode (used by orchestrator for coding agents)
-            prompt = get_single_feature_prompt(feature_id, project_dir, yolo_mode)
+            fid = feature_id if feature_id is not None else feature_ids[0]  # type: ignore[index]
+            prompt = get_single_feature_prompt(fid, project_dir, yolo_mode)
         else:
             # General coding prompt (legacy path)
-            prompt = get_coding_prompt(project_dir)
+            prompt = get_coding_prompt(project_dir, yolo_mode=yolo_mode)
 
         # Run session with async context manager
         # Wrap in try/except to handle MCP server startup failures gracefully
@@ -250,13 +288,28 @@ async def run_autonomous_agent(
 
         # Handle status
         if status == "continue":
+            # Reset error retries on success; rate-limit retries reset only if no signal
+            error_retries = 0
+            reset_rate_limit_retries = True
+
             delay_seconds = AUTO_CONTINUE_DELAY_SECONDS
             target_time_str = None
 
-            if "limit reached" in response.lower():
-                print("Claude Agent SDK indicated limit reached.")
+            # Check for rate limit indicators in response text
+            if is_rate_limit_error(response):
+                print("Claude Agent SDK indicated rate limit reached.")
+                reset_rate_limit_retries = False
 
-                # Try to parse reset time from response
+                # Try to extract retry-after from response text first
+                retry_seconds = parse_retry_after(response)
+                if retry_seconds is not None:
+                    delay_seconds = clamp_retry_delay(retry_seconds)
+                else:
+                    # Use exponential backoff when retry-after unknown
+                    delay_seconds = calculate_rate_limit_backoff(rate_limit_retries)
+                    rate_limit_retries += 1
+
+                # Try to parse reset time from response (more specific format)
                 match = re.search(
                     r"(?i)\bresets(?:\s+at)?\s+(\d+)(?::(\d+))?\s*(am|pm)\s*\(([^)]+)\)",
                     response,
@@ -285,9 +338,7 @@ async def run_autonomous_agent(
                             target += timedelta(days=1)
 
                         delta = target - now
-                        delay_seconds = min(
-                            delta.total_seconds(), 24 * 60 * 60
-                        )  # Clamp to 24 hours max
+                        delay_seconds = min(max(int(delta.total_seconds()), 1), 24 * 60 * 60)
                         target_time_str = target.strftime("%B %d, %Y at %I:%M %p %Z")
 
                     except Exception as e:
@@ -316,20 +367,56 @@ async def run_autonomous_agent(
                 print("The autonomous agent has finished its work.")
                 break
 
-            # Single-feature mode OR testing agent: exit after one session
-            if feature_id is not None or agent_type == "testing":
+            # Single-feature mode, batch mode, or testing agent: exit after one session
+            if feature_ids and len(feature_ids) > 1:
+                print(f"\nBatch mode: Features {', '.join(f'#{fid}' for fid in feature_ids)} session complete.")
+                break
+            elif feature_id is not None or (feature_ids is not None and len(feature_ids) == 1):
+                fid = feature_id if feature_id is not None else feature_ids[0]  # type: ignore[index]
                 if agent_type == "testing":
                     print("\nTesting agent complete. Terminating session.")
                 else:
-                    print(f"\nSingle-feature mode: Feature #{feature_id} session complete.")
+                    print(f"\nSingle-feature mode: Feature #{fid} session complete.")
                 break
+            elif agent_type == "testing":
+                print("\nTesting agent complete. Terminating session.")
+                break
+
+            # Reset rate limit retries only if no rate limit signal was detected
+            if reset_rate_limit_retries:
+                rate_limit_retries = 0
+
+            await asyncio.sleep(delay_seconds)
+
+        elif status == "rate_limit":
+            # Smart rate limit handling with exponential backoff
+            # Reset error counter so mixed events don't inflate delays
+            error_retries = 0
+            if response != "unknown":
+                try:
+                    delay_seconds = clamp_retry_delay(int(response))
+                except (ValueError, TypeError):
+                    # Malformed value - fall through to exponential backoff
+                    response = "unknown"
+            if response == "unknown":
+                # Use exponential backoff when retry-after unknown or malformed
+                delay_seconds = calculate_rate_limit_backoff(rate_limit_retries)
+                rate_limit_retries += 1
+                print(f"\nRate limit hit. Backoff wait: {delay_seconds} seconds (attempt #{rate_limit_retries})...")
+            else:
+                print(f"\nRate limit hit. Waiting {delay_seconds} seconds before retry...")
 
             await asyncio.sleep(delay_seconds)
 
         elif status == "error":
+            # Non-rate-limit errors: linear backoff capped at 5 minutes
+            # Reset rate limit counter so mixed events don't inflate delays
+            rate_limit_retries = 0
+            error_retries += 1
+            delay_seconds = calculate_error_backoff(error_retries)
             print("\nSession encountered an error")
-            print("Will retry with a fresh session...")
-            await asyncio.sleep(AUTO_CONTINUE_DELAY_SECONDS)
+            print(f"Will retry in {delay_seconds}s (attempt #{error_retries})...")
+            await asyncio.sleep(delay_seconds)
 
         # Small delay between sessions
         if max_iterations is None or iteration < max_iterations:

api/database.py

@@ -8,7 +8,7 @@ SQLite database schema for feature storage using SQLAlchemy.
 import sys
 from datetime import datetime, timezone
 from pathlib import Path
-from typing import Optional
+from typing import Generator, Optional
 
 
 def _utc_now() -> datetime:
@@ -26,13 +26,16 @@ from sqlalchemy import (
     String,
     Text,
     create_engine,
+    event,
     text,
 )
-from sqlalchemy.ext.declarative import declarative_base
-from sqlalchemy.orm import Session, relationship, sessionmaker
+from sqlalchemy.orm import DeclarativeBase, Session, relationship, sessionmaker
 from sqlalchemy.types import JSON
 
-Base = declarative_base()
+
+class Base(DeclarativeBase):
+    """SQLAlchemy 2.0 style declarative base."""
+    pass
 
 
 class Feature(Base):
@@ -180,7 +183,8 @@ class ScheduleOverride(Base):
 
 def get_database_path(project_dir: Path) -> Path:
     """Return the path to the SQLite database for a project."""
-    return project_dir / "features.db"
+    from autocoder_paths import get_features_db_path
+    return get_features_db_path(project_dir)
 
 
 def get_database_url(project_dir: Path) -> str:
@@ -307,11 +311,11 @@ def _migrate_add_schedules_tables(engine) -> None:
 
     # Create schedules table if missing
     if "schedules" not in existing_tables:
-        Schedule.__table__.create(bind=engine)
+        Schedule.__table__.create(bind=engine)  # type: ignore[attr-defined]
 
     # Create schedule_overrides table if missing
     if "schedule_overrides" not in existing_tables:
-        ScheduleOverride.__table__.create(bind=engine)
+        ScheduleOverride.__table__.create(bind=engine)  # type: ignore[attr-defined]
 
     # Add crash_count column if missing (for upgrades)
     if "schedules" in existing_tables:
@@ -332,32 +336,89 @@ def _migrate_add_schedules_tables(engine) -> None:
                 conn.commit()
 
 
+def _configure_sqlite_immediate_transactions(engine) -> None:
+    """Configure engine for IMMEDIATE transactions via event hooks.
+
+    Per SQLAlchemy docs: https://docs.sqlalchemy.org/en/20/dialects/sqlite.html
+
+    This replaces fragile pysqlite implicit transaction handling with explicit
+    BEGIN IMMEDIATE at transaction start. Benefits:
+    - Acquires write lock immediately, preventing stale reads
+    - Works correctly regardless of prior ORM operations
+    - Future-proof: won't break when pysqlite legacy mode is removed in Python 3.16
+    """
+    @event.listens_for(engine, "connect")
+    def do_connect(dbapi_connection, connection_record):
+        # Disable pysqlite's implicit transaction handling
+        dbapi_connection.isolation_level = None
+
+        # Set busy_timeout on raw connection before any transactions
+        cursor = dbapi_connection.cursor()
+        try:
+            cursor.execute("PRAGMA busy_timeout=30000")
+        finally:
+            cursor.close()
+
+    @event.listens_for(engine, "begin")
+    def do_begin(conn):
+        # Use IMMEDIATE for all transactions to prevent stale reads
+        conn.exec_driver_sql("BEGIN IMMEDIATE")
+
+
 def create_database(project_dir: Path) -> tuple:
     """
     Create database and return engine + session maker.
 
+    Uses a cache to avoid creating new engines for each request, which improves
+    performance by reusing database connections.
+
     Args:
         project_dir: Directory containing the project
 
     Returns:
         Tuple of (engine, SessionLocal)
     """
+    cache_key = project_dir.as_posix()
+
+    if cache_key in _engine_cache:
+        return _engine_cache[cache_key]
+
     db_url = get_database_url(project_dir)
-    engine = create_engine(db_url, connect_args={
-        "check_same_thread": False,
-        "timeout": 30  # Wait up to 30s for locks
-    })
-    Base.metadata.create_all(bind=engine)
+
+    # Ensure parent directory exists (for .autocoder/ layout)
+    db_path = get_database_path(project_dir)
+    db_path.parent.mkdir(parents=True, exist_ok=True)
 
     # Choose journal mode based on filesystem type
     # WAL mode doesn't work reliably on network filesystems and can cause corruption
     is_network = _is_network_path(project_dir)
     journal_mode = "DELETE" if is_network else "WAL"
 
+    engine = create_engine(db_url, connect_args={
+        "check_same_thread": False,
+        "timeout": 30  # Wait up to 30s for locks
+    })
+
+    # Set journal mode BEFORE configuring event hooks
+    # PRAGMA journal_mode must run outside of a transaction, and our event hooks
+    # start a transaction with BEGIN IMMEDIATE on every operation
     with engine.connect() as conn:
-        conn.execute(text(f"PRAGMA journal_mode={journal_mode}"))
-        conn.execute(text("PRAGMA busy_timeout=30000"))
-        conn.commit()
+        # Get raw DBAPI connection to execute PRAGMA outside transaction
+        raw_conn = conn.connection.dbapi_connection
+        if raw_conn is None:
+            raise RuntimeError("Failed to get raw DBAPI connection")
+        cursor = raw_conn.cursor()
+        try:
+            cursor.execute(f"PRAGMA journal_mode={journal_mode}")
+            cursor.execute("PRAGMA busy_timeout=30000")
+        finally:
+            cursor.close()
+
+    # Configure IMMEDIATE transactions via event hooks AFTER setting PRAGMAs
+    # This must happen before create_all() and migrations run
+    _configure_sqlite_immediate_transactions(engine)
+
+    Base.metadata.create_all(bind=engine)
 
     # Migrate existing databases
     _migrate_add_in_progress_column(engine)
@@ -369,12 +430,39 @@ def create_database(project_dir: Path) -> tuple:
     _migrate_add_schedules_tables(engine)
 
     SessionLocal = sessionmaker(autocommit=False, autoflush=False, bind=engine)
+
+    # Cache the engine and session maker
+    _engine_cache[cache_key] = (engine, SessionLocal)
+
     return engine, SessionLocal
 
 
+def dispose_engine(project_dir: Path) -> bool:
+    """Dispose of and remove the cached engine for a project.
+
+    This closes all database connections, releasing file locks on Windows.
+    Should be called before deleting the database file.
+
+    Returns:
+        True if an engine was disposed, False if no engine was cached.
+    """
+    cache_key = project_dir.as_posix()
+
+    if cache_key in _engine_cache:
+        engine, _ = _engine_cache.pop(cache_key)
+        engine.dispose()
+        return True
+
+    return False
+
+
 # Global session maker - will be set when server starts
 _session_maker: Optional[sessionmaker] = None
 
+# Engine cache to avoid creating new engines for each request
+# Key: project directory path (as posix string), Value: (engine, SessionLocal)
+_engine_cache: dict[str, tuple] = {}
+
 
 def set_session_maker(session_maker: sessionmaker) -> None:
     """Set the global session maker."""
@@ -382,7 +470,7 @@ def set_session_maker(session_maker: sessionmaker) -> None:
     _session_maker = session_maker
 
 
-def get_db() -> Session:
+def get_db() -> Generator[Session, None, None]:
     """
     Dependency for FastAPI to get database session.
 
@@ -394,5 +482,55 @@ def get_db() -> Session:
     db = _session_maker()
     try:
         yield db
+    except Exception:
+        db.rollback()
+        raise
     finally:
         db.close()
+
+
+# =============================================================================
+# Atomic Transaction Helpers for Parallel Mode
+# =============================================================================
+# These helpers prevent database corruption when multiple processes access the
+# same SQLite database concurrently. They use IMMEDIATE transactions which
+# acquire write locks at the start (preventing stale reads) and atomic
+# UPDATE ... WHERE clauses (preventing check-then-modify races).
+
+
+from contextlib import contextmanager
+
+
+@contextmanager
+def atomic_transaction(session_maker):
+    """Context manager for atomic SQLite transactions.
+
+    Acquires a write lock immediately via BEGIN IMMEDIATE (configured by
+    engine event hooks), preventing stale reads in read-modify-write patterns.
+    This is essential for preventing race conditions in parallel mode.
+
+    Args:
+        session_maker: SQLAlchemy sessionmaker
+
+    Yields:
+        SQLAlchemy session with automatic commit/rollback
+
+    Example:
+        with atomic_transaction(session_maker) as session:
+            # All reads in this block are protected by write lock
+            feature = session.query(Feature).filter(...).first()
+            feature.priority = new_priority
+            # Commit happens automatically on exit
+    """
+    session = session_maker()
+    try:
+        yield session
+        session.commit()
+    except Exception:
+        try:
+            session.rollback()
+        except Exception:
+            pass  # Don't let rollback failure mask original error
+        raise
+    finally:
+        session.close()

api/dependency_resolver.py

@@ -7,6 +7,7 @@ Includes cycle detection, validation, and helper functions for dependency manage
 """
 
 import heapq
+from collections import deque
 from typing import TypedDict
 
 # Security: Prevent DoS via excessive dependencies
@@ -300,15 +301,21 @@ def compute_scheduling_scores(features: list[dict]) -> dict[int, float]:
                 parents[f["id"]].append(dep_id)
 
     # Calculate depths via BFS from roots
+    # Use visited set to prevent infinite loops from circular dependencies
+    # Use deque for O(1) popleft instead of list.pop(0) which is O(n)
     depths: dict[int, int] = {}
+    visited: set[int] = set()
     roots = [f["id"] for f in features if not parents[f["id"]]]
-    queue = [(root, 0) for root in roots]
-    while queue:
-        node_id, depth = queue.pop(0)
-        if node_id not in depths or depth > depths[node_id]:
-            depths[node_id] = depth
+    bfs_queue: deque[tuple[int, int]] = deque((root, 0) for root in roots)
+    while bfs_queue:
+        node_id, depth = bfs_queue.popleft()
+        if node_id in visited:
+            continue  # Skip already visited nodes (handles cycles)
+        visited.add(node_id)
+        depths[node_id] = depth
         for child_id in children[node_id]:
-            queue.append((child_id, depth + 1))
+            if child_id not in visited:
+                bfs_queue.append((child_id, depth + 1))
 
     # Handle orphaned nodes (shouldn't happen but be safe)
     for f in features:

autocoder_paths.py

@@ -0,0 +1,290 @@
+"""
+Autocoder Path Resolution
+=========================
+
+Central module for resolving paths to autocoder-generated files within a project.
+
+Implements a dual-path resolution strategy for backward compatibility:
+
+    1. Check ``project_dir / ".autocoder" / X`` (new layout)
+    2. Check ``project_dir / X`` (legacy root-level layout)
+    3. Default to the new location for fresh projects
+
+This allows existing projects with root-level ``features.db``, ``.agent.lock``,
+etc. to keep working while new projects store everything under ``.autocoder/``.
+
+The ``migrate_project_layout`` function can move an old-layout project to the
+new layout safely, with full integrity checks for SQLite databases.
+"""
+
+import logging
+import shutil
+import sqlite3
+from pathlib import Path
+
+logger = logging.getLogger(__name__)
+
+# ---------------------------------------------------------------------------
+# .gitignore content written into every .autocoder/ directory
+# ---------------------------------------------------------------------------
+_GITIGNORE_CONTENT = """\
+# Autocoder runtime files
+features.db
+features.db-wal
+features.db-shm
+assistant.db
+assistant.db-wal
+assistant.db-shm
+.agent.lock
+.devserver.lock
+.claude_settings.json
+.claude_assistant_settings.json
+.claude_settings.expand.*.json
+.progress_cache
+"""
+
+
+# ---------------------------------------------------------------------------
+# Private helpers
+# ---------------------------------------------------------------------------
+
+def _resolve_path(project_dir: Path, filename: str) -> Path:
+    """Resolve a file path using dual-path strategy.
+
+    Checks the new ``.autocoder/`` location first, then falls back to the
+    legacy root-level location.  If neither exists, returns the new location
+    so that newly-created files land in ``.autocoder/``.
+    """
+    new = project_dir / ".autocoder" / filename
+    if new.exists():
+        return new
+    old = project_dir / filename
+    if old.exists():
+        return old
+    return new  # default for new projects
+
+
+def _resolve_dir(project_dir: Path, dirname: str) -> Path:
+    """Resolve a directory path using dual-path strategy.
+
+    Same logic as ``_resolve_path`` but intended for directories such as
+    ``prompts/``.
+    """
+    new = project_dir / ".autocoder" / dirname
+    if new.exists():
+        return new
+    old = project_dir / dirname
+    if old.exists():
+        return old
+    return new
+
+
+# ---------------------------------------------------------------------------
+# .autocoder directory management
+# ---------------------------------------------------------------------------
+
+def get_autocoder_dir(project_dir: Path) -> Path:
+    """Return the ``.autocoder`` directory path.  Does NOT create it."""
+    return project_dir / ".autocoder"
+
+
+def ensure_autocoder_dir(project_dir: Path) -> Path:
+    """Create the ``.autocoder/`` directory (if needed) and write its ``.gitignore``.
+
+    Returns:
+        The path to the ``.autocoder`` directory.
+    """
+    autocoder_dir = get_autocoder_dir(project_dir)
+    autocoder_dir.mkdir(parents=True, exist_ok=True)
+
+    gitignore_path = autocoder_dir / ".gitignore"
+    gitignore_path.write_text(_GITIGNORE_CONTENT, encoding="utf-8")
+
+    return autocoder_dir
+
+
+# ---------------------------------------------------------------------------
+# Dual-path file helpers
+# ---------------------------------------------------------------------------
+
+def get_features_db_path(project_dir: Path) -> Path:
+    """Resolve the path to ``features.db``."""
+    return _resolve_path(project_dir, "features.db")
+
+
+def get_assistant_db_path(project_dir: Path) -> Path:
+    """Resolve the path to ``assistant.db``."""
+    return _resolve_path(project_dir, "assistant.db")
+
+
+def get_agent_lock_path(project_dir: Path) -> Path:
+    """Resolve the path to ``.agent.lock``."""
+    return _resolve_path(project_dir, ".agent.lock")
+
+
+def get_devserver_lock_path(project_dir: Path) -> Path:
+    """Resolve the path to ``.devserver.lock``."""
+    return _resolve_path(project_dir, ".devserver.lock")
+
+
+def get_claude_settings_path(project_dir: Path) -> Path:
+    """Resolve the path to ``.claude_settings.json``."""
+    return _resolve_path(project_dir, ".claude_settings.json")
+
+
+def get_claude_assistant_settings_path(project_dir: Path) -> Path:
+    """Resolve the path to ``.claude_assistant_settings.json``."""
+    return _resolve_path(project_dir, ".claude_assistant_settings.json")
+
+
+def get_progress_cache_path(project_dir: Path) -> Path:
+    """Resolve the path to ``.progress_cache``."""
+    return _resolve_path(project_dir, ".progress_cache")
+
+
+def get_prompts_dir(project_dir: Path) -> Path:
+    """Resolve the path to the ``prompts/`` directory."""
+    return _resolve_dir(project_dir, "prompts")
+
+
+# ---------------------------------------------------------------------------
+# Non-dual-path helpers (always use new location)
+# ---------------------------------------------------------------------------
+
+def get_expand_settings_path(project_dir: Path, uuid_hex: str) -> Path:
+    """Return the path for an ephemeral expand-session settings file.
+
+    These files are short-lived and always stored in ``.autocoder/``.
+    """
+    return project_dir / ".autocoder" / f".claude_settings.expand.{uuid_hex}.json"
+
+
+# ---------------------------------------------------------------------------
+# Lock-file safety check
+# ---------------------------------------------------------------------------
+
+def has_agent_running(project_dir: Path) -> bool:
+    """Check whether any agent or dev-server lock file exists at either location.
+
+    Inspects both the legacy root-level paths and the new ``.autocoder/``
+    paths so that a running agent is detected regardless of project layout.
+
+    Returns:
+        ``True`` if any ``.agent.lock`` or ``.devserver.lock`` exists.
+    """
+    lock_names = (".agent.lock", ".devserver.lock")
+    for name in lock_names:
+        if (project_dir / name).exists():
+            return True
+        if (project_dir / ".autocoder" / name).exists():
+            return True
+    return False
+
+
+# ---------------------------------------------------------------------------
+# Migration
+# ---------------------------------------------------------------------------
+
+def migrate_project_layout(project_dir: Path) -> list[str]:
+    """Migrate a project from the legacy root-level layout to ``.autocoder/``.
+
+    The migration is incremental and safe:
+
+    * If the agent is running (lock files present) the migration is skipped
+      entirely to avoid corrupting in-use databases.
+    * Each file/directory is migrated independently.  If any single step
+      fails the error is logged and migration continues with the remaining
+      items.  Partial migration is safe because the dual-path resolution
+      strategy will find files at whichever location they ended up in.
+
+    Returns:
+        A list of human-readable descriptions of what was migrated, e.g.
+        ``["prompts/ -> .autocoder/prompts/", "features.db -> .autocoder/features.db"]``.
+        An empty list means nothing was migrated (either everything is
+        already migrated, or the agent is running).
+    """
+    # Safety: refuse to migrate while an agent is running
+    if has_agent_running(project_dir):
+        logger.warning("Migration skipped: agent or dev-server is running for %s", project_dir)
+        return []
+
+    autocoder_dir = ensure_autocoder_dir(project_dir)
+    migrated: list[str] = []
+
+    # --- 1. Migrate prompts/ directory -----------------------------------
+    try:
+        old_prompts = project_dir / "prompts"
+        new_prompts = autocoder_dir / "prompts"
+        if old_prompts.exists() and old_prompts.is_dir() and not new_prompts.exists():
+            shutil.copytree(str(old_prompts), str(new_prompts))
+            shutil.rmtree(str(old_prompts))
+            migrated.append("prompts/ -> .autocoder/prompts/")
+            logger.info("Migrated prompts/ -> .autocoder/prompts/")
+    except Exception:
+        logger.warning("Failed to migrate prompts/ directory", exc_info=True)
+
+    # --- 2. Migrate SQLite databases (features.db, assistant.db) ---------
+    db_names = ("features.db", "assistant.db")
+    for db_name in db_names:
+        try:
+            old_db = project_dir / db_name
+            new_db = autocoder_dir / db_name
+            if old_db.exists() and not new_db.exists():
+                # Flush WAL to ensure all data is in the main database file
+                conn = sqlite3.connect(str(old_db))
+                try:
+                    cursor = conn.cursor()
+                    cursor.execute("PRAGMA wal_checkpoint(TRUNCATE)")
+                finally:
+                    conn.close()
+
+                # Copy the main database file (WAL is now flushed)
+                shutil.copy2(str(old_db), str(new_db))
+
+                # Verify the copy is intact
+                verify_conn = sqlite3.connect(str(new_db))
+                try:
+                    verify_cursor = verify_conn.cursor()
+                    result = verify_cursor.execute("PRAGMA integrity_check").fetchone()
+                    if result is None or result[0] != "ok":
+                        logger.error(
+                            "Integrity check failed for migrated %s: %s",
+                            db_name, result,
+                        )
+                        # Remove the broken copy; old file stays in place
+                        new_db.unlink(missing_ok=True)
+                        continue
+                finally:
+                    verify_conn.close()
+
+                # Remove old database files (.db, .db-wal, .db-shm)
+                old_db.unlink(missing_ok=True)
+                for suffix in ("-wal", "-shm"):
+                    wal_file = project_dir / f"{db_name}{suffix}"
+                    wal_file.unlink(missing_ok=True)
+
+                migrated.append(f"{db_name} -> .autocoder/{db_name}")
+                logger.info("Migrated %s -> .autocoder/%s", db_name, db_name)
+        except Exception:
+            logger.warning("Failed to migrate %s", db_name, exc_info=True)
+
+    # --- 3. Migrate simple files -----------------------------------------
+    simple_files = (
+        ".agent.lock",
+        ".devserver.lock",
+        ".claude_settings.json",
+        ".claude_assistant_settings.json",
+        ".progress_cache",
+    )
+    for filename in simple_files:
+        try:
+            old_file = project_dir / filename
+            new_file = autocoder_dir / filename
+            if old_file.exists() and not new_file.exists():
+                shutil.move(str(old_file), str(new_file))
+                migrated.append(f"{filename} -> .autocoder/{filename}")
+                logger.info("Migrated %s -> .autocoder/%s", filename, filename)
+        except Exception:
+            logger.warning("Failed to migrate %s", filename, exc_info=True)
+
+    return migrated

autonomous_agent_demo.py

@@ -133,6 +133,13 @@ Authentication:
         help="Work on a specific feature ID only (used by orchestrator for coding agents)",
     )
 
+    parser.add_argument(
+        "--feature-ids",
+        type=str,
+        default=None,
+        help="Comma-separated feature IDs to implement in batch (e.g., '5,8,12')",
+    )
+
     # Agent type for subprocess mode
     parser.add_argument(
         "--agent-type",
@@ -145,7 +152,14 @@ Authentication:
         "--testing-feature-id",
         type=int,
         default=None,
-        help="Feature ID to regression test (used by orchestrator for testing agents)",
+        help="Feature ID to regression test (used by orchestrator for testing agents, legacy single mode)",
+    )
+
+    parser.add_argument(
+        "--testing-feature-ids",
+        type=str,
+        default=None,
+        help="Comma-separated feature IDs to regression test in batch (e.g., '5,12,18')",
     )
 
     # Testing agent configuration
@@ -156,6 +170,20 @@ Authentication:
         help="Testing agents per coding agent (0-3, default: 1). Set to 0 to disable testing agents.",
     )
 
+    parser.add_argument(
+        "--testing-batch-size",
+        type=int,
+        default=3,
+        help="Number of features per testing batch (1-5, default: 3)",
+    )
+
+    parser.add_argument(
+        "--batch-size",
+        type=int,
+        default=3,
+        help="Max features per coding agent batch (1-3, default: 3)",
+    )
+
     return parser.parse_args()
 
 
@@ -193,6 +221,30 @@ def main() -> None:
             print("Use an absolute path or register the project first.")
             return
 
+    # Migrate project layout to .autocoder/ if needed (idempotent, safe)
+    from autocoder_paths import migrate_project_layout
+    migrated = migrate_project_layout(project_dir)
+    if migrated:
+        print(f"Migrated project files to .autocoder/: {', '.join(migrated)}", flush=True)
+
+    # Parse batch testing feature IDs (comma-separated string -> list[int])
+    testing_feature_ids: list[int] | None = None
+    if args.testing_feature_ids:
+        try:
+            testing_feature_ids = [int(x.strip()) for x in args.testing_feature_ids.split(",") if x.strip()]
+        except ValueError:
+            print(f"Error: --testing-feature-ids must be comma-separated integers, got: {args.testing_feature_ids}")
+            return
+
+    # Parse batch coding feature IDs (comma-separated string -> list[int])
+    coding_feature_ids: list[int] | None = None
+    if args.feature_ids:
+        try:
+            coding_feature_ids = [int(x.strip()) for x in args.feature_ids.split(",") if x.strip()]
+        except ValueError:
+            print(f"Error: --feature-ids must be comma-separated integers, got: {args.feature_ids}")
+            return
+
     try:
         if args.agent_type:
             # Subprocess mode - spawned by orchestrator for a specific role
@@ -203,8 +255,10 @@ def main() -> None:
                     max_iterations=args.max_iterations or 1,
                     yolo_mode=args.yolo,
                     feature_id=args.feature_id,
+                    feature_ids=coding_feature_ids,
                     agent_type=args.agent_type,
                     testing_feature_id=args.testing_feature_id,
+                    testing_feature_ids=testing_feature_ids,
                 )
             )
         else:
@@ -223,6 +277,8 @@ def main() -> None:
                     model=args.model,
                     yolo_mode=args.yolo,
                     testing_agent_ratio=args.testing_ratio,
+                    testing_batch_size=args.testing_batch_size,
+                    batch_size=args.batch_size,
                 )
             )
     except KeyboardInterrupt:

client.py

@@ -7,6 +7,7 @@ Functions for creating and configuring the Claude Agent SDK client.
 
 import json
 import os
+import re
 import shutil
 import sys
 from pathlib import Path
@@ -15,67 +16,221 @@ from claude_agent_sdk import ClaudeAgentOptions, ClaudeSDKClient
 from claude_agent_sdk.types import HookContext, HookInput, HookMatcher, SyncHookJSONOutput
 from dotenv import load_dotenv
 
-from security import bash_security_hook
+from env_constants import API_ENV_VARS
+from security import SENSITIVE_DIRECTORIES, bash_security_hook
 
 # Load environment variables from .env file if present
 load_dotenv()
 
 # Default Playwright headless mode - can be overridden via PLAYWRIGHT_HEADLESS env var
-# When True, browser runs invisibly in background
-# When False, browser window is visible (default - useful for monitoring agent progress)
-DEFAULT_PLAYWRIGHT_HEADLESS = False
+# When True, browser runs invisibly in background (default - saves CPU)
+# When False, browser window is visible (useful for monitoring agent progress)
+DEFAULT_PLAYWRIGHT_HEADLESS = True
 
-# Environment variables to pass through to Claude CLI for API configuration
-# These allow using alternative API endpoints (e.g., GLM via z.ai) without
-# affecting the user's global Claude Code settings
-API_ENV_VARS = [
-    "ANTHROPIC_BASE_URL",              # Custom API endpoint (e.g., https://api.z.ai/api/anthropic)
-    "ANTHROPIC_AUTH_TOKEN",            # API authentication token
-    "API_TIMEOUT_MS",                  # Request timeout in milliseconds
-    "ANTHROPIC_DEFAULT_SONNET_MODEL",  # Model override for Sonnet
-    "ANTHROPIC_DEFAULT_OPUS_MODEL",    # Model override for Opus
-    "ANTHROPIC_DEFAULT_HAIKU_MODEL",   # Model override for Haiku
-]
+# Default browser for Playwright - can be overridden via PLAYWRIGHT_BROWSER env var
+# Options: chrome, firefox, webkit, msedge
+# Firefox is recommended for lower CPU usage
+DEFAULT_PLAYWRIGHT_BROWSER = "firefox"
+
+# Extra read paths for cross-project file access (read-only)
+# Set EXTRA_READ_PATHS environment variable with comma-separated absolute paths
+# Example: EXTRA_READ_PATHS=/Volumes/Data/dev,/Users/shared/libs
+EXTRA_READ_PATHS_VAR = "EXTRA_READ_PATHS"
+
+# Sensitive directories that should never be allowed via EXTRA_READ_PATHS.
+# Delegates to the canonical SENSITIVE_DIRECTORIES set in security.py so that
+# this blocklist and the filesystem browser API share a single source of truth.
+EXTRA_READ_PATHS_BLOCKLIST = SENSITIVE_DIRECTORIES
+
+def convert_model_for_vertex(model: str) -> str:
+    """
+    Convert model name format for Vertex AI compatibility.
+
+    Vertex AI uses @ to separate model name from version (e.g., claude-opus-4-5@20251101)
+    while the Anthropic API uses - (e.g., claude-opus-4-5-20251101).
+
+    Args:
+        model: Model name in Anthropic format (with hyphens)
+
+    Returns:
+        Model name in Vertex AI format (with @ before date) if Vertex AI is enabled,
+        otherwise returns the model unchanged.
+    """
+    # Only convert if Vertex AI is enabled
+    if os.getenv("CLAUDE_CODE_USE_VERTEX") != "1":
+        return model
+
+    # Pattern: claude-{name}-{version}-{date} -> claude-{name}-{version}@{date}
+    # Example: claude-opus-4-5-20251101 -> claude-opus-4-5@20251101
+    # The date is always 8 digits at the end
+    match = re.match(r'^(claude-.+)-(\d{8})$', model)
+    if match:
+        base_name, date = match.groups()
+        return f"{base_name}@{date}"
+
+    # If already in @ format or doesn't match expected pattern, return as-is
+    return model
 
 
 def get_playwright_headless() -> bool:
     """
     Get the Playwright headless mode setting.
 
-    Reads from PLAYWRIGHT_HEADLESS environment variable, defaults to False.
+    Reads from PLAYWRIGHT_HEADLESS environment variable, defaults to True.
     Returns True for headless mode (invisible browser), False for visible browser.
     """
-    value = os.getenv("PLAYWRIGHT_HEADLESS", "false").lower()
-    # Accept various truthy/falsy values
-    return value in ("true", "1", "yes", "on")
+    value = os.getenv("PLAYWRIGHT_HEADLESS", str(DEFAULT_PLAYWRIGHT_HEADLESS).lower()).strip().lower()
+    truthy = {"true", "1", "yes", "on"}
+    falsy = {"false", "0", "no", "off"}
+    if value not in truthy | falsy:
+        print(f"   - Warning: Invalid PLAYWRIGHT_HEADLESS='{value}', defaulting to {DEFAULT_PLAYWRIGHT_HEADLESS}")
+        return DEFAULT_PLAYWRIGHT_HEADLESS
+    return value in truthy
 
 
-# Feature MCP tools for feature/test management
-FEATURE_MCP_TOOLS = [
-    # Core feature operations
+# Valid browsers supported by Playwright MCP
+VALID_PLAYWRIGHT_BROWSERS = {"chrome", "firefox", "webkit", "msedge"}
+
+
+def get_playwright_browser() -> str:
+    """
+    Get the browser to use for Playwright.
+
+    Reads from PLAYWRIGHT_BROWSER environment variable, defaults to firefox.
+    Options: chrome, firefox, webkit, msedge
+    Firefox is recommended for lower CPU usage.
+    """
+    value = os.getenv("PLAYWRIGHT_BROWSER", DEFAULT_PLAYWRIGHT_BROWSER).strip().lower()
+    if value not in VALID_PLAYWRIGHT_BROWSERS:
+        print(f"   - Warning: Invalid PLAYWRIGHT_BROWSER='{value}', "
+              f"valid options: {', '.join(sorted(VALID_PLAYWRIGHT_BROWSERS))}. "
+              f"Defaulting to {DEFAULT_PLAYWRIGHT_BROWSER}")
+        return DEFAULT_PLAYWRIGHT_BROWSER
+    return value
+
+
+def get_extra_read_paths() -> list[Path]:
+    """
+    Get extra read-only paths from EXTRA_READ_PATHS environment variable.
+
+    Parses comma-separated absolute paths and validates each one:
+    - Must be an absolute path
+    - Must exist and be a directory
+    - Cannot be or contain sensitive directories (e.g., .ssh, .aws)
+
+    Returns:
+        List of validated, canonicalized Path objects.
+    """
+    raw_value = os.getenv(EXTRA_READ_PATHS_VAR, "").strip()
+    if not raw_value:
+        return []
+
+    validated_paths: list[Path] = []
+    home_dir = Path.home()
+
+    for path_str in raw_value.split(","):
+        path_str = path_str.strip()
+        if not path_str:
+            continue
+
+        # Parse and canonicalize the path
+        try:
+            path = Path(path_str).resolve()
+        except (OSError, ValueError) as e:
+            print(f"   - Warning: Invalid EXTRA_READ_PATHS path '{path_str}': {e}")
+            continue
+
+        # Must be absolute (resolve() makes it absolute, but check original input)
+        if not Path(path_str).is_absolute():
+            print(f"   - Warning: EXTRA_READ_PATHS requires absolute paths, skipping: {path_str}")
+            continue
+
+        # Must exist
+        if not path.exists():
+            print(f"   - Warning: EXTRA_READ_PATHS path does not exist, skipping: {path_str}")
+            continue
+
+        # Must be a directory
+        if not path.is_dir():
+            print(f"   - Warning: EXTRA_READ_PATHS path is not a directory, skipping: {path_str}")
+            continue
+
+        # Check against sensitive directory blocklist
+        is_blocked = False
+        for sensitive in EXTRA_READ_PATHS_BLOCKLIST:
+            sensitive_path = (home_dir / sensitive).resolve()
+            try:
+                # Block if path IS the sensitive dir or is INSIDE it
+                if path == sensitive_path or path.is_relative_to(sensitive_path):
+                    print(f"   - Warning: EXTRA_READ_PATHS blocked sensitive path: {path_str}")
+                    is_blocked = True
+                    break
+                # Also block if sensitive dir is INSIDE the requested path
+                if sensitive_path.is_relative_to(path):
+                    print(f"   - Warning: EXTRA_READ_PATHS path contains sensitive directory ({sensitive}): {path_str}")
+                    is_blocked = True
+                    break
+            except (OSError, ValueError):
+                # is_relative_to can raise on some edge cases
+                continue
+
+        if is_blocked:
+            continue
+
+        validated_paths.append(path)
+
+    return validated_paths
+
+
+# Per-agent-type MCP tool lists.
+# Only expose the tools each agent type actually needs, reducing tool schema
+# overhead and preventing agents from calling tools meant for other roles.
+#
+# Tools intentionally omitted from ALL agent lists (UI/orchestrator only):
+#   feature_get_ready, feature_get_blocked, feature_get_graph,
+#   feature_remove_dependency
+#
+# The ghost tool "feature_release_testing" was removed entirely -- it was
+# listed here but never implemented in mcp_server/feature_mcp.py.
+
+CODING_AGENT_TOOLS = [
     "mcp__features__feature_get_stats",
-    "mcp__features__feature_get_by_id",  # Get assigned feature details
-    "mcp__features__feature_get_summary",  # Lightweight: id, name, status, deps only
+    "mcp__features__feature_get_by_id",
+    "mcp__features__feature_get_summary",
+    "mcp__features__feature_claim_and_get",
     "mcp__features__feature_mark_in_progress",
-    "mcp__features__feature_claim_and_get",  # Atomic claim + get details
     "mcp__features__feature_mark_passing",
-    "mcp__features__feature_mark_failing",  # Mark regression detected
+    "mcp__features__feature_mark_failing",
     "mcp__features__feature_skip",
-    "mcp__features__feature_create_bulk",
-    "mcp__features__feature_create",
     "mcp__features__feature_clear_in_progress",
-    "mcp__features__feature_release_testing",  # Release testing claim
-    # Dependency management
-    "mcp__features__feature_add_dependency",
-    "mcp__features__feature_remove_dependency",
-    "mcp__features__feature_set_dependencies",
-    # Query tools
-    "mcp__features__feature_get_ready",
-    "mcp__features__feature_get_blocked",
-    "mcp__features__feature_get_graph",
 ]
 
-# Playwright MCP tools for browser automation
+TESTING_AGENT_TOOLS = [
+    "mcp__features__feature_get_stats",
+    "mcp__features__feature_get_by_id",
+    "mcp__features__feature_get_summary",
+    "mcp__features__feature_mark_passing",
+    "mcp__features__feature_mark_failing",
+]
+
+INITIALIZER_AGENT_TOOLS = [
+    "mcp__features__feature_get_stats",
+    "mcp__features__feature_create_bulk",
+    "mcp__features__feature_create",
+    "mcp__features__feature_add_dependency",
+    "mcp__features__feature_set_dependencies",
+]
+
+# Union of all agent tool lists -- used for permissions (all tools remain
+# *permitted* so the MCP server can respond, but only the agent-type-specific
+# list is included in allowed_tools, which controls what the LLM sees).
+ALL_FEATURE_MCP_TOOLS = sorted(
+    set(CODING_AGENT_TOOLS) | set(TESTING_AGENT_TOOLS) | set(INITIALIZER_AGENT_TOOLS)
+)
+
+# Playwright MCP tools for browser automation.
+# Full set of tools for comprehensive UI testing including drag-and-drop,
+# hover menus, file uploads, tab management, etc.
 PLAYWRIGHT_TOOLS = [
     # Core navigation & screenshots
     "mcp__playwright__browser_navigate",
@@ -88,9 +243,10 @@ PLAYWRIGHT_TOOLS = [
     "mcp__playwright__browser_type",
     "mcp__playwright__browser_fill_form",
     "mcp__playwright__browser_select_option",
-    "mcp__playwright__browser_hover",
-    "mcp__playwright__browser_drag",
     "mcp__playwright__browser_press_key",
+    "mcp__playwright__browser_drag",
+    "mcp__playwright__browser_hover",
+    "mcp__playwright__browser_file_upload",
 
     # JavaScript & debugging
     "mcp__playwright__browser_evaluate",
@@ -99,16 +255,17 @@ PLAYWRIGHT_TOOLS = [
     "mcp__playwright__browser_network_requests",
 
     # Browser management
-    "mcp__playwright__browser_close",
     "mcp__playwright__browser_resize",
-    "mcp__playwright__browser_tabs",
     "mcp__playwright__browser_wait_for",
     "mcp__playwright__browser_handle_dialog",
-    "mcp__playwright__browser_file_upload",
     "mcp__playwright__browser_install",
+    "mcp__playwright__browser_close",
+    "mcp__playwright__browser_tabs",
 ]
 
-# Built-in tools
+# Built-in tools available to agents.
+# WebFetch and WebSearch are included so coding agents can look up current
+# documentation for frameworks and libraries they are implementing.
 BUILTIN_TOOLS = [
     "Read",
     "Write",
@@ -126,6 +283,7 @@ def create_client(
     model: str,
     yolo_mode: bool = False,
     agent_id: str | None = None,
+    agent_type: str = "coding",
 ):
     """
     Create a Claude Agent SDK client with multi-layered security.
@@ -136,6 +294,8 @@ def create_client(
         yolo_mode: If True, skip Playwright MCP server for rapid prototyping
         agent_id: Optional unique identifier for browser isolation in parallel mode.
                   When provided, each agent gets its own browser profile.
+        agent_type: One of "coding", "testing", or "initializer". Controls which
+                    MCP tools are exposed and the max_turns limit.
 
     Returns:
         Configured ClaudeSDKClient (from claude_agent_sdk)
@@ -149,13 +309,34 @@ def create_client(
     Note: Authentication is handled by start.bat/start.sh before this runs.
     The Claude SDK auto-detects credentials from the Claude CLI configuration
     """
-    # Build allowed tools list based on mode
-    # In YOLO mode, exclude Playwright tools for faster prototyping
-    allowed_tools = [*BUILTIN_TOOLS, *FEATURE_MCP_TOOLS]
+    # Select the feature MCP tools appropriate for this agent type
+    feature_tools_map = {
+        "coding": CODING_AGENT_TOOLS,
+        "testing": TESTING_AGENT_TOOLS,
+        "initializer": INITIALIZER_AGENT_TOOLS,
+    }
+    feature_tools = feature_tools_map.get(agent_type, CODING_AGENT_TOOLS)
+
+    # Select max_turns based on agent type:
+    #   - coding/initializer: 300 turns (complex multi-step implementation)
+    #   - testing: 100 turns (focused verification of a single feature)
+    max_turns_map = {
+        "coding": 300,
+        "testing": 100,
+        "initializer": 300,
+    }
+    max_turns = max_turns_map.get(agent_type, 300)
+
+    # Build allowed tools list based on mode and agent type.
+    # In YOLO mode, exclude Playwright tools for faster prototyping.
+    allowed_tools = [*BUILTIN_TOOLS, *feature_tools]
     if not yolo_mode:
         allowed_tools.extend(PLAYWRIGHT_TOOLS)
 
-    # Build permissions list
+    # Build permissions list.
+    # We permit ALL feature MCP tools at the security layer (so the MCP server
+    # can respond if called), but the LLM only *sees* the agent-type-specific
+    # subset via allowed_tools above.
     permissions_list = [
         # Allow all file operations within the project directory
         "Read(./**)",
@@ -166,12 +347,22 @@ def create_client(
         # Bash permission granted here, but actual commands are validated
         # by the bash_security_hook (see security.py for allowed commands)
         "Bash(*)",
-        # Allow web tools for documentation lookup
-        "WebFetch",
-        "WebSearch",
+        # Allow web tools for looking up framework/library documentation
+        "WebFetch(*)",
+        "WebSearch(*)",
         # Allow Feature MCP tools for feature management
-        *FEATURE_MCP_TOOLS,
+        *ALL_FEATURE_MCP_TOOLS,
     ]
+
+    # Add extra read paths from environment variable (read-only access)
+    # Paths are validated, canonicalized, and checked against sensitive blocklist
+    extra_read_paths = get_extra_read_paths()
+    for path in extra_read_paths:
+        # Add read-only permissions for each validated path
+        permissions_list.append(f"Read({path}/**)")
+        permissions_list.append(f"Glob({path}/**)")
+        permissions_list.append(f"Grep({path}/**)")
+
     if not yolo_mode:
         # Allow Playwright MCP tools for browser automation (standard mode only)
         permissions_list.extend(PLAYWRIGHT_TOOLS)
@@ -191,13 +382,17 @@ def create_client(
     project_dir.mkdir(parents=True, exist_ok=True)
 
     # Write settings to a file in the project directory
-    settings_file = project_dir / ".claude_settings.json"
+    from autocoder_paths import get_claude_settings_path
+    settings_file = get_claude_settings_path(project_dir)
+    settings_file.parent.mkdir(parents=True, exist_ok=True)
     with open(settings_file, "w") as f:
         json.dump(security_settings, f, indent=2)
 
     print(f"Created security settings at {settings_file}")
     print("   - Sandbox enabled (OS-level bash isolation)")
     print(f"   - Filesystem restricted to: {project_dir.resolve()}")
+    if extra_read_paths:
+        print(f"   - Extra read paths (validated): {', '.join(str(p) for p in extra_read_paths)}")
     print("   - Bash commands restricted to allowlist (see security.py)")
     if yolo_mode:
         print("   - MCP servers: features (database) - YOLO MODE (no Playwright)")
@@ -228,10 +423,16 @@ def create_client(
     }
     if not yolo_mode:
         # Include Playwright MCP server for browser automation (standard mode only)
-        # Headless mode is configurable via PLAYWRIGHT_HEADLESS environment variable
-        playwright_args = ["@playwright/mcp@latest", "--viewport-size", "1280x720"]
+        # Browser and headless mode configurable via environment variables
+        browser = get_playwright_browser()
+        playwright_args = [
+            "@playwright/mcp@latest",
+            "--viewport-size", "1280x720",
+            "--browser", browser,
+        ]
         if get_playwright_headless():
             playwright_args.append("--headless")
+        print(f"   - Browser: {browser} (headless={get_playwright_headless()})")
 
         # Browser isolation for parallel execution
         # Each agent gets its own isolated browser context to prevent tab conflicts
@@ -257,9 +458,21 @@ def create_client(
         if value:
             sdk_env[var] = value
 
+    # Detect alternative API mode (Ollama, GLM, or Vertex AI)
+    base_url = sdk_env.get("ANTHROPIC_BASE_URL", "")
+    is_vertex = sdk_env.get("CLAUDE_CODE_USE_VERTEX") == "1"
+    is_alternative_api = bool(base_url) or is_vertex
+    is_ollama = "localhost:11434" in base_url or "127.0.0.1:11434" in base_url
+    model = convert_model_for_vertex(model)
     if sdk_env:
         print(f"   - API overrides: {', '.join(sdk_env.keys())}")
-        if "ANTHROPIC_BASE_URL" in sdk_env:
+        if is_vertex:
+            project_id = sdk_env.get("ANTHROPIC_VERTEX_PROJECT_ID", "unknown")
+            region = sdk_env.get("CLOUD_ML_REGION", "unknown")
+            print(f"   - Vertex AI Mode: Using GCP project '{project_id}' with model '{model}' in region '{region}'")
+        elif is_ollama:
+            print("   - Ollama Mode: Using local models")
+        elif "ANTHROPIC_BASE_URL" in sdk_env:
             print(f"   - GLM Mode: Using {sdk_env['ANTHROPIC_BASE_URL']}")
 
     # Create a wrapper for bash_security_hook that passes project_dir via context
@@ -270,9 +483,10 @@ def create_client(
         context["project_dir"] = str(project_dir.resolve())
         return await bash_security_hook(input_data, tool_use_id, context)
 
-    # PreCompact hook for logging and customizing context compaction
+    # PreCompact hook for logging and customizing context compaction.
     # Compaction is handled automatically by Claude Code CLI when context approaches limits.
-    # This hook allows us to log when compaction occurs and optionally provide custom instructions.
+    # This hook provides custom instructions that guide the summarizer to preserve
+    # critical workflow state while discarding verbose/redundant content.
     async def pre_compact_hook(
         input_data: HookInput,
         tool_use_id: str | None,
@@ -285,8 +499,9 @@ def create_client(
         - "auto": Automatic compaction when context approaches token limits
         - "manual": User-initiated compaction via /compact command
 
-        The hook can customize compaction via hookSpecificOutput:
-        - customInstructions: String with focus areas for summarization
+        Returns custom instructions that guide the compaction summarizer to:
+        1. Preserve critical workflow state (feature ID, modified files, test results)
+        2. Discard verbose content (screenshots, long grep outputs, repeated reads)
         """
         trigger = input_data.get("trigger", "auto")
         custom_instructions = input_data.get("custom_instructions")
@@ -297,18 +512,53 @@ def create_client(
             print("[Context] Manual compaction requested")
 
         if custom_instructions:
-            print(f"[Context] Custom instructions: {custom_instructions}")
+            print(f"[Context] Custom instructions provided: {custom_instructions}")
 
-        # Return empty dict to allow compaction to proceed with default behavior
-        # To customize, return:
-        # {
-        #     "hookSpecificOutput": {
-        #         "hookEventName": "PreCompact",
-        #         "customInstructions": "Focus on preserving file paths and test results"
-        #     }
-        # }
-        return SyncHookJSONOutput()
+        # Build compaction instructions that preserve workflow-critical context
+        # while discarding verbose content that inflates token usage.
+        #
+        # The summarizer receives these instructions and uses them to decide
+        # what to keep vs. discard during context compaction.
+        compaction_guidance = "\n".join([
+            "## PRESERVE (critical workflow state)",
+            "- Current feature ID, feature name, and feature status (pending/in_progress/passing/failing)",
+            "- List of all files created or modified during this session, with their paths",
+            "- Last test/lint/type-check results: command run, pass/fail status, and key error messages",
+            "- Current step in the workflow (e.g., implementing, testing, fixing lint errors)",
+            "- Any dependency information (which features block this one)",
+            "- Git operations performed (commits, branches created)",
+            "- MCP tool call results (feature_claim_and_get, feature_mark_passing, etc.)",
+            "- Key architectural decisions made during this session",
+            "",
+            "## DISCARD (verbose content safe to drop)",
+            "- Full screenshot base64 data (just note that a screenshot was taken and what it showed)",
+            "- Long grep/find/glob output listings (summarize to: searched for X, found Y relevant files)",
+            "- Repeated file reads of the same file (keep only the latest read or a summary of changes)",
+            "- Full file contents from Read tool (summarize to: read file X, key sections were Y)",
+            "- Verbose npm/pip install output (just note: dependencies installed successfully/failed)",
+            "- Full lint/type-check output when passing (just note: lint passed with no errors)",
+            "- Browser console message dumps (summarize to: N errors found, key error was X)",
+            "- Redundant tool result confirmations ([Done] markers)",
+        ])
 
+        print("[Context] Applying custom compaction instructions (preserve workflow state, discard verbose content)")
+
+        # The SDK's HookSpecificOutput union type does not yet include a
+        # PreCompactHookSpecificOutput variant, but the CLI protocol accepts
+        # {"hookEventName": "PreCompact", "customInstructions": "..."}.
+        # The dict is serialized to JSON and sent to the CLI process directly,
+        # so the runtime behavior is correct despite the type mismatch.
+        return SyncHookJSONOutput(
+            hookSpecificOutput={  # type: ignore[typeddict-item]
+                "hookEventName": "PreCompact",
+                "customInstructions": compaction_guidance,
+            }
+        )
+
+    # PROMPT CACHING: The Claude Code CLI applies cache_control breakpoints internally.
+    # Our system_prompt benefits from automatic caching without explicit configuration.
+    # If explicit cache_control is needed, the SDK would need to accept content blocks
+    # with cache_control fields (not currently supported in v0.1.x).
     return ClaudeSDKClient(
         options=ClaudeAgentOptions(
             model=model,
@@ -317,7 +567,7 @@ def create_client(
             setting_sources=["project"],  # Enable skills, commands, and CLAUDE.md from project dir
             max_buffer_size=10 * 1024 * 1024,  # 10MB for large Playwright screenshots
             allowed_tools=allowed_tools,
-            mcp_servers=mcp_servers,
+            mcp_servers=mcp_servers,  # type: ignore[arg-type]  # SDK accepts dict config at runtime
             hooks={
                 "PreToolUse": [
                     HookMatcher(matcher="Bash", hooks=[bash_hook_with_context]),
@@ -329,14 +579,15 @@ def create_client(
                     HookMatcher(hooks=[pre_compact_hook]),
                 ],
             },
-            max_turns=1000,
+            max_turns=max_turns,
             cwd=str(project_dir.resolve()),
             settings=str(settings_file.resolve()),  # Use absolute path
             env=sdk_env,  # Pass API configuration overrides to CLI subprocess
             # Enable extended context beta for better handling of long sessions.
             # This provides up to 1M tokens of context with automatic compaction.
             # See: https://docs.anthropic.com/en/api/beta-headers
-            betas=["context-1m-2025-08-07"],
+            # Disabled for alternative APIs (Ollama, GLM, Vertex AI) as they don't support this beta.
+            betas=[] if is_alternative_api else ["context-1m-2025-08-07"],
             # Note on context management:
             # The Claude Agent SDK handles context management automatically through the
             # underlying Claude Code CLI. When context approaches limits, the CLI
@@ -346,7 +597,7 @@ def create_client(
             # parameters. Instead, context is managed via:
             # 1. betas=["context-1m-2025-08-07"] - Extended context window
             # 2. PreCompact hook - Intercept and customize compaction behavior
-            # 3. max_turns - Limit conversation turns (set to 1000 for long sessions)
+            # 3. max_turns - Limit conversation turns (per agent type: coding=300, testing=100)
             #
             # Future SDK versions may add explicit compaction controls. When available,
             # consider adding:

env_constants.py

@@ -0,0 +1,27 @@
+"""
+Shared Environment Variable Constants
+======================================
+
+Single source of truth for environment variables forwarded to Claude CLI
+subprocesses.  Imported by both ``client.py`` (agent sessions) and
+``server/services/chat_constants.py`` (chat sessions) to avoid maintaining
+duplicate lists.
+
+These allow autocoder to use alternative API endpoints (Ollama, GLM,
+Vertex AI) without affecting the user's global Claude Code settings.
+"""
+
+API_ENV_VARS: list[str] = [
+    # Core API configuration
+    "ANTHROPIC_BASE_URL",              # Custom API endpoint (e.g., https://api.z.ai/api/anthropic)
+    "ANTHROPIC_AUTH_TOKEN",            # API authentication token
+    "API_TIMEOUT_MS",                  # Request timeout in milliseconds
+    # Model tier overrides
+    "ANTHROPIC_DEFAULT_SONNET_MODEL",  # Model override for Sonnet
+    "ANTHROPIC_DEFAULT_OPUS_MODEL",    # Model override for Opus
+    "ANTHROPIC_DEFAULT_HAIKU_MODEL",   # Model override for Haiku
+    # Vertex AI configuration
+    "CLAUDE_CODE_USE_VERTEX",          # Enable Vertex AI mode (set to "1")
+    "CLOUD_ML_REGION",                 # GCP region (e.g., us-east5)
+    "ANTHROPIC_VERTEX_PROJECT_ID",     # GCP project ID
+]

mcp_server/feature_mcp.py

@@ -30,18 +30,18 @@ orchestrator, not by agents. Agents receive pre-assigned feature IDs.
 import json
 import os
 import sys
-import threading
 from contextlib import asynccontextmanager
 from pathlib import Path
 from typing import Annotated
 
 from mcp.server.fastmcp import FastMCP
 from pydantic import BaseModel, Field
+from sqlalchemy import text
 
 # Add parent directory to path so we can import from api module
 sys.path.insert(0, str(Path(__file__).parent.parent))
 
-from api.database import Feature, create_database
+from api.database import Feature, atomic_transaction, create_database
 from api.dependency_resolver import (
     MAX_DEPENDENCIES_PER_FEATURE,
     compute_scheduling_scores,
@@ -96,8 +96,9 @@ class BulkCreateInput(BaseModel):
 _session_maker = None
 _engine = None
 
-# Lock for priority assignment to prevent race conditions
-_priority_lock = threading.Lock()
+# NOTE: The old threading.Lock() was removed because it only worked per-process,
+# not cross-process. In parallel mode, multiple MCP servers run in separate
+# processes, so the lock was useless. We now use atomic SQL operations instead.
 
 
 @asynccontextmanager
@@ -243,15 +244,25 @@ def feature_mark_passing(
     """
     session = get_session()
     try:
-        feature = session.query(Feature).filter(Feature.id == feature_id).first()
-
-        if feature is None:
-            return json.dumps({"error": f"Feature with ID {feature_id} not found"})
-
-        feature.passes = True
-        feature.in_progress = False
+        # Atomic update with state guard - prevents double-pass in parallel mode
+        result = session.execute(text("""
+            UPDATE features
+            SET passes = 1, in_progress = 0
+            WHERE id = :id AND passes = 0
+        """), {"id": feature_id})
         session.commit()
 
+        if result.rowcount == 0:
+            # Check why the update didn't match
+            feature = session.query(Feature).filter(Feature.id == feature_id).first()
+            if feature is None:
+                return json.dumps({"error": f"Feature with ID {feature_id} not found"})
+            if feature.passes:
+                return json.dumps({"error": f"Feature with ID {feature_id} is already passing"})
+            return json.dumps({"error": "Failed to mark feature passing for unknown reason"})
+
+        # Get the feature name for the response
+        feature = session.query(Feature).filter(Feature.id == feature_id).first()
         return json.dumps({"success": True, "feature_id": feature_id, "name": feature.name})
     except Exception as e:
         session.rollback()
@@ -284,14 +295,20 @@ def feature_mark_failing(
     """
     session = get_session()
     try:
+        # Check if feature exists first
         feature = session.query(Feature).filter(Feature.id == feature_id).first()
-
         if feature is None:
             return json.dumps({"error": f"Feature with ID {feature_id} not found"})
 
-        feature.passes = False
-        feature.in_progress = False
+        # Atomic update for parallel safety
+        session.execute(text("""
+            UPDATE features
+            SET passes = 0, in_progress = 0
+            WHERE id = :id
+        """), {"id": feature_id})
         session.commit()
+
+        # Refresh to get updated state
         session.refresh(feature)
 
         return json.dumps({
@@ -337,25 +354,28 @@ def feature_skip(
             return json.dumps({"error": "Cannot skip a feature that is already passing"})
 
         old_priority = feature.priority
+        name = feature.name
 
-        # Use lock to prevent race condition in priority assignment
-        with _priority_lock:
-            # Get max priority and set this feature to max + 1
-            max_priority_result = session.query(Feature.priority).order_by(Feature.priority.desc()).first()
-            new_priority = (max_priority_result[0] + 1) if max_priority_result else 1
-
-            feature.priority = new_priority
-            feature.in_progress = False
-            session.commit()
+        # Atomic update: set priority to max+1 in a single statement
+        # This prevents race conditions where two features get the same priority
+        session.execute(text("""
+            UPDATE features
+            SET priority = (SELECT COALESCE(MAX(priority), 0) + 1 FROM features),
+                in_progress = 0
+            WHERE id = :id
+        """), {"id": feature_id})
+        session.commit()
 
+        # Refresh to get new priority
         session.refresh(feature)
+        new_priority = feature.priority
 
         return json.dumps({
-            "id": feature.id,
-            "name": feature.name,
+            "id": feature_id,
+            "name": name,
             "old_priority": old_priority,
             "new_priority": new_priority,
-            "message": f"Feature '{feature.name}' moved to end of queue"
+            "message": f"Feature '{name}' moved to end of queue"
         })
     except Exception as e:
         session.rollback()
@@ -381,21 +401,27 @@ def feature_mark_in_progress(
     """
     session = get_session()
     try:
-        feature = session.query(Feature).filter(Feature.id == feature_id).first()
-
-        if feature is None:
-            return json.dumps({"error": f"Feature with ID {feature_id} not found"})
-
-        if feature.passes:
-            return json.dumps({"error": f"Feature with ID {feature_id} is already passing"})
-
-        if feature.in_progress:
-            return json.dumps({"error": f"Feature with ID {feature_id} is already in-progress"})
-
-        feature.in_progress = True
+        # Atomic claim: only succeeds if feature is not already claimed or passing
+        result = session.execute(text("""
+            UPDATE features
+            SET in_progress = 1
+            WHERE id = :id AND passes = 0 AND in_progress = 0
+        """), {"id": feature_id})
         session.commit()
-        session.refresh(feature)
 
+        if result.rowcount == 0:
+            # Check why the claim failed
+            feature = session.query(Feature).filter(Feature.id == feature_id).first()
+            if feature is None:
+                return json.dumps({"error": f"Feature with ID {feature_id} not found"})
+            if feature.passes:
+                return json.dumps({"error": f"Feature with ID {feature_id} is already passing"})
+            if feature.in_progress:
+                return json.dumps({"error": f"Feature with ID {feature_id} is already in-progress"})
+            return json.dumps({"error": "Failed to mark feature in-progress for unknown reason"})
+
+        # Fetch the claimed feature
+        feature = session.query(Feature).filter(Feature.id == feature_id).first()
         return json.dumps(feature.to_dict())
     except Exception as e:
         session.rollback()
@@ -421,24 +447,35 @@ def feature_claim_and_get(
     """
     session = get_session()
     try:
+        # First check if feature exists
         feature = session.query(Feature).filter(Feature.id == feature_id).first()
-
         if feature is None:
             return json.dumps({"error": f"Feature with ID {feature_id} not found"})
 
         if feature.passes:
             return json.dumps({"error": f"Feature with ID {feature_id} is already passing"})
 
-        # Idempotent: if already in-progress, just return details
-        already_claimed = feature.in_progress
-        if not already_claimed:
-            feature.in_progress = True
-            session.commit()
-            session.refresh(feature)
+        # Try atomic claim: only succeeds if not already claimed
+        result = session.execute(text("""
+            UPDATE features
+            SET in_progress = 1
+            WHERE id = :id AND passes = 0 AND in_progress = 0
+        """), {"id": feature_id})
+        session.commit()
 
-        result = feature.to_dict()
-        result["already_claimed"] = already_claimed
-        return json.dumps(result)
+        # Determine if we claimed it or it was already claimed
+        already_claimed = result.rowcount == 0
+        if already_claimed:
+            # Verify it's in_progress (not some other failure condition)
+            session.refresh(feature)
+            if not feature.in_progress:
+                return json.dumps({"error": f"Failed to claim feature {feature_id} for unknown reason"})
+
+        # Refresh to get current state
+        session.refresh(feature)
+        result_dict = feature.to_dict()
+        result_dict["already_claimed"] = already_claimed
+        return json.dumps(result_dict)
     except Exception as e:
         session.rollback()
         return json.dumps({"error": f"Failed to claim feature: {str(e)}"})
@@ -463,15 +500,20 @@ def feature_clear_in_progress(
     """
     session = get_session()
     try:
+        # Check if feature exists
         feature = session.query(Feature).filter(Feature.id == feature_id).first()
-
         if feature is None:
             return json.dumps({"error": f"Feature with ID {feature_id} not found"})
 
-        feature.in_progress = False
+        # Atomic update - idempotent, safe in parallel mode
+        session.execute(text("""
+            UPDATE features
+            SET in_progress = 0
+            WHERE id = :id
+        """), {"id": feature_id})
         session.commit()
-        session.refresh(feature)
 
+        session.refresh(feature)
         return json.dumps(feature.to_dict())
     except Exception as e:
         session.rollback()
@@ -506,13 +548,14 @@ def feature_create_bulk(
     Returns:
         JSON with: created (int) - number of features created, with_dependencies (int)
     """
-    session = get_session()
     try:
-        # Use lock to prevent race condition in priority assignment
-        with _priority_lock:
-            # Get the starting priority
-            max_priority_result = session.query(Feature.priority).order_by(Feature.priority.desc()).first()
-            start_priority = (max_priority_result[0] + 1) if max_priority_result else 1
+        # Use atomic transaction for bulk inserts to prevent priority conflicts
+        with atomic_transaction(_session_maker) as session:
+            # Get the starting priority atomically within the transaction
+            result = session.execute(text("""
+                SELECT COALESCE(MAX(priority), 0) FROM features
+            """)).fetchone()
+            start_priority = (result[0] or 0) + 1
 
             # First pass: validate all features and their index-based dependencies
             for i, feature_data in enumerate(features):
@@ -546,7 +589,7 @@ def feature_create_bulk(
                                 "error": f"Feature at index {i} cannot depend on feature at index {idx} (forward reference not allowed)"
                             })
 
-            # Second pass: create all features
+            # Second pass: create all features with reserved priorities
             created_features: list[Feature] = []
             for i, feature_data in enumerate(features):
                 db_feature = Feature(
@@ -571,20 +614,16 @@ def feature_create_bulk(
                 if indices:
                     # Convert indices to actual feature IDs
                     dep_ids = [created_features[idx].id for idx in indices]
-                    created_features[i].dependencies = sorted(dep_ids)
+                    created_features[i].dependencies = sorted(dep_ids)  # type: ignore[assignment]  # SQLAlchemy JSON Column accepts list at runtime
                     deps_count += 1
 
-            session.commit()
-
-        return json.dumps({
-            "created": len(created_features),
-            "with_dependencies": deps_count
-        })
+            # Commit happens automatically on context manager exit
+            return json.dumps({
+                "created": len(created_features),
+                "with_dependencies": deps_count
+            })
     except Exception as e:
-        session.rollback()
         return json.dumps({"error": str(e)})
-    finally:
-        session.close()
 
 
 @mcp.tool()
@@ -608,13 +647,14 @@ def feature_create(
     Returns:
         JSON with the created feature details including its ID
     """
-    session = get_session()
     try:
-        # Use lock to prevent race condition in priority assignment
-        with _priority_lock:
-            # Get the next priority
-            max_priority_result = session.query(Feature.priority).order_by(Feature.priority.desc()).first()
-            next_priority = (max_priority_result[0] + 1) if max_priority_result else 1
+        # Use atomic transaction to prevent priority collisions
+        with atomic_transaction(_session_maker) as session:
+            # Get the next priority atomically within the transaction
+            result = session.execute(text("""
+                SELECT COALESCE(MAX(priority), 0) + 1 FROM features
+            """)).fetchone()
+            next_priority = result[0]
 
             db_feature = Feature(
                 priority=next_priority,
@@ -626,20 +666,18 @@ def feature_create(
                 in_progress=False,
             )
             session.add(db_feature)
-            session.commit()
+            session.flush()  # Get the ID
 
-        session.refresh(db_feature)
+            feature_dict = db_feature.to_dict()
+            # Commit happens automatically on context manager exit
 
         return json.dumps({
             "success": True,
             "message": f"Created feature: {name}",
-            "feature": db_feature.to_dict()
+            "feature": feature_dict
         })
     except Exception as e:
-        session.rollback()
         return json.dumps({"error": str(e)})
-    finally:
-        session.close()
 
 
 @mcp.tool()
@@ -659,52 +697,49 @@ def feature_add_dependency(
     Returns:
         JSON with success status and updated dependencies list, or error message
     """
-    session = get_session()
     try:
-        # Security: Self-reference check
+        # Security: Self-reference check (can do before transaction)
         if feature_id == dependency_id:
             return json.dumps({"error": "A feature cannot depend on itself"})
 
-        feature = session.query(Feature).filter(Feature.id == feature_id).first()
-        dependency = session.query(Feature).filter(Feature.id == dependency_id).first()
+        # Use atomic transaction for consistent cycle detection
+        with atomic_transaction(_session_maker) as session:
+            feature = session.query(Feature).filter(Feature.id == feature_id).first()
+            dependency = session.query(Feature).filter(Feature.id == dependency_id).first()
 
-        if not feature:
-            return json.dumps({"error": f"Feature {feature_id} not found"})
-        if not dependency:
-            return json.dumps({"error": f"Dependency feature {dependency_id} not found"})
+            if not feature:
+                return json.dumps({"error": f"Feature {feature_id} not found"})
+            if not dependency:
+                return json.dumps({"error": f"Dependency feature {dependency_id} not found"})
 
-        current_deps = feature.dependencies or []
+            current_deps = feature.dependencies or []
 
-        # Security: Max dependencies limit
-        if len(current_deps) >= MAX_DEPENDENCIES_PER_FEATURE:
-            return json.dumps({"error": f"Maximum {MAX_DEPENDENCIES_PER_FEATURE} dependencies allowed per feature"})
+            # Security: Max dependencies limit
+            if len(current_deps) >= MAX_DEPENDENCIES_PER_FEATURE:
+                return json.dumps({"error": f"Maximum {MAX_DEPENDENCIES_PER_FEATURE} dependencies allowed per feature"})
 
-        # Check if already exists
-        if dependency_id in current_deps:
-            return json.dumps({"error": "Dependency already exists"})
+            # Check if already exists
+            if dependency_id in current_deps:
+                return json.dumps({"error": "Dependency already exists"})
 
-        # Security: Circular dependency check
-        # would_create_circular_dependency(features, source_id, target_id)
-        # source_id = feature gaining the dependency, target_id = feature being depended upon
-        all_features = [f.to_dict() for f in session.query(Feature).all()]
-        if would_create_circular_dependency(all_features, feature_id, dependency_id):
-            return json.dumps({"error": "Cannot add: would create circular dependency"})
+            # Security: Circular dependency check
+            # Within IMMEDIATE transaction, snapshot is protected by write lock
+            all_features = [f.to_dict() for f in session.query(Feature).all()]
+            if would_create_circular_dependency(all_features, feature_id, dependency_id):
+                return json.dumps({"error": "Cannot add: would create circular dependency"})
 
-        # Add dependency
-        current_deps.append(dependency_id)
-        feature.dependencies = sorted(current_deps)
-        session.commit()
+            # Add dependency atomically
+            new_deps = sorted(current_deps + [dependency_id])
+            feature.dependencies = new_deps
+            # Commit happens automatically on context manager exit
 
-        return json.dumps({
-            "success": True,
-            "feature_id": feature_id,
-            "dependencies": feature.dependencies
-        })
+            return json.dumps({
+                "success": True,
+                "feature_id": feature_id,
+                "dependencies": new_deps
+            })
     except Exception as e:
-        session.rollback()
         return json.dumps({"error": f"Failed to add dependency: {str(e)}"})
-    finally:
-        session.close()
 
 
 @mcp.tool()
@@ -721,30 +756,29 @@ def feature_remove_dependency(
     Returns:
         JSON with success status and updated dependencies list, or error message
     """
-    session = get_session()
     try:
-        feature = session.query(Feature).filter(Feature.id == feature_id).first()
-        if not feature:
-            return json.dumps({"error": f"Feature {feature_id} not found"})
+        # Use atomic transaction for consistent read-modify-write
+        with atomic_transaction(_session_maker) as session:
+            feature = session.query(Feature).filter(Feature.id == feature_id).first()
+            if not feature:
+                return json.dumps({"error": f"Feature {feature_id} not found"})
 
-        current_deps = feature.dependencies or []
-        if dependency_id not in current_deps:
-            return json.dumps({"error": "Dependency does not exist"})
+            current_deps = feature.dependencies or []
+            if dependency_id not in current_deps:
+                return json.dumps({"error": "Dependency does not exist"})
 
-        current_deps.remove(dependency_id)
-        feature.dependencies = current_deps if current_deps else None
-        session.commit()
+            # Remove dependency atomically
+            new_deps = [d for d in current_deps if d != dependency_id]
+            feature.dependencies = new_deps if new_deps else None
+            # Commit happens automatically on context manager exit
 
-        return json.dumps({
-            "success": True,
-            "feature_id": feature_id,
-            "dependencies": feature.dependencies or []
-        })
+            return json.dumps({
+                "success": True,
+                "feature_id": feature_id,
+                "dependencies": new_deps
+            })
     except Exception as e:
-        session.rollback()
         return json.dumps({"error": f"Failed to remove dependency: {str(e)}"})
-    finally:
-        session.close()
 
 
 @mcp.tool()
@@ -897,9 +931,8 @@ def feature_set_dependencies(
     Returns:
         JSON with success status and updated dependencies list, or error message
     """
-    session = get_session()
     try:
-        # Security: Self-reference check
+        # Security: Self-reference check (can do before transaction)
         if feature_id in dependency_ids:
             return json.dumps({"error": "A feature cannot depend on itself"})
 
@@ -911,45 +944,44 @@ def feature_set_dependencies(
         if len(dependency_ids) != len(set(dependency_ids)):
             return json.dumps({"error": "Duplicate dependencies not allowed"})
 
-        feature = session.query(Feature).filter(Feature.id == feature_id).first()
-        if not feature:
-            return json.dumps({"error": f"Feature {feature_id} not found"})
+        # Use atomic transaction for consistent cycle detection
+        with atomic_transaction(_session_maker) as session:
+            feature = session.query(Feature).filter(Feature.id == feature_id).first()
+            if not feature:
+                return json.dumps({"error": f"Feature {feature_id} not found"})
 
-        # Validate all dependencies exist
-        all_feature_ids = {f.id for f in session.query(Feature).all()}
-        missing = [d for d in dependency_ids if d not in all_feature_ids]
-        if missing:
-            return json.dumps({"error": f"Dependencies not found: {missing}"})
+            # Validate all dependencies exist
+            all_feature_ids = {f.id for f in session.query(Feature).all()}
+            missing = [d for d in dependency_ids if d not in all_feature_ids]
+            if missing:
+                return json.dumps({"error": f"Dependencies not found: {missing}"})
 
-        # Check for circular dependencies
-        all_features = [f.to_dict() for f in session.query(Feature).all()]
-        # Temporarily update the feature's dependencies for cycle check
-        test_features = []
-        for f in all_features:
-            if f["id"] == feature_id:
-                test_features.append({**f, "dependencies": dependency_ids})
-            else:
-                test_features.append(f)
+            # Check for circular dependencies
+            # Within IMMEDIATE transaction, snapshot is protected by write lock
+            all_features = [f.to_dict() for f in session.query(Feature).all()]
+            test_features = []
+            for f in all_features:
+                if f["id"] == feature_id:
+                    test_features.append({**f, "dependencies": dependency_ids})
+                else:
+                    test_features.append(f)
 
-        for dep_id in dependency_ids:
-            # source_id = feature_id (gaining dep), target_id = dep_id (being depended upon)
-            if would_create_circular_dependency(test_features, feature_id, dep_id):
-                return json.dumps({"error": f"Cannot add dependency {dep_id}: would create circular dependency"})
+            for dep_id in dependency_ids:
+                if would_create_circular_dependency(test_features, feature_id, dep_id):
+                    return json.dumps({"error": f"Cannot add dependency {dep_id}: would create circular dependency"})
 
-        # Set dependencies
-        feature.dependencies = sorted(dependency_ids) if dependency_ids else None
-        session.commit()
+            # Set dependencies atomically
+            sorted_deps = sorted(dependency_ids) if dependency_ids else None
+            feature.dependencies = sorted_deps
+            # Commit happens automatically on context manager exit
 
-        return json.dumps({
-            "success": True,
-            "feature_id": feature_id,
-            "dependencies": feature.dependencies or []
-        })
+            return json.dumps({
+                "success": True,
+                "feature_id": feature_id,
+                "dependencies": sorted_deps or []
+            })
     except Exception as e:
-        session.rollback()
         return json.dumps({"error": f"Failed to set dependencies: {str(e)}"})
-    finally:
-        session.close()
 
 
 if __name__ == "__main__":

progress.py

@@ -10,12 +10,21 @@ import json
 import os
 import sqlite3
 import urllib.request
+from contextlib import closing
 from datetime import datetime, timezone
 from pathlib import Path
 
 WEBHOOK_URL = os.environ.get("PROGRESS_N8N_WEBHOOK_URL")
 PROGRESS_CACHE_FILE = ".progress_cache"
 
+# SQLite connection settings for parallel mode safety
+SQLITE_TIMEOUT = 30  # seconds to wait for locks
+
+
+def _get_connection(db_file: Path) -> sqlite3.Connection:
+    """Get a SQLite connection with proper timeout settings for parallel mode."""
+    return sqlite3.connect(db_file, timeout=SQLITE_TIMEOUT)
+
 
 def has_features(project_dir: Path) -> bool:
     """
@@ -31,25 +40,23 @@ def has_features(project_dir: Path) -> bool:
 
     Returns False if no features exist (initializer needs to run).
     """
-    import sqlite3
-
     # Check legacy JSON file first
     json_file = project_dir / "feature_list.json"
     if json_file.exists():
         return True
 
     # Check SQLite database
-    db_file = project_dir / "features.db"
+    from autocoder_paths import get_features_db_path
+    db_file = get_features_db_path(project_dir)
     if not db_file.exists():
         return False
 
     try:
-        conn = sqlite3.connect(db_file)
-        cursor = conn.cursor()
-        cursor.execute("SELECT COUNT(*) FROM features")
-        count = cursor.fetchone()[0]
-        conn.close()
-        return count > 0
+        with closing(_get_connection(db_file)) as conn:
+            cursor = conn.cursor()
+            cursor.execute("SELECT COUNT(*) FROM features")
+            count: int = cursor.fetchone()[0]
+            return bool(count > 0)
     except Exception:
         # Database exists but can't be read or has no features table
         return False
@@ -65,41 +72,41 @@ def count_passing_tests(project_dir: Path) -> tuple[int, int, int]:
     Returns:
         (passing_count, in_progress_count, total_count)
     """
-    db_file = project_dir / "features.db"
+    from autocoder_paths import get_features_db_path
+    db_file = get_features_db_path(project_dir)
     if not db_file.exists():
         return 0, 0, 0
 
     try:
-        conn = sqlite3.connect(db_file)
-        cursor = conn.cursor()
-        # Single aggregate query instead of 3 separate COUNT queries
-        # Handle case where in_progress column doesn't exist yet (legacy DBs)
-        try:
-            cursor.execute("""
-                SELECT
-                    COUNT(*) as total,
-                    SUM(CASE WHEN passes = 1 THEN 1 ELSE 0 END) as passing,
-                    SUM(CASE WHEN in_progress = 1 THEN 1 ELSE 0 END) as in_progress
-                FROM features
-            """)
-            row = cursor.fetchone()
-            total = row[0] or 0
-            passing = row[1] or 0
-            in_progress = row[2] or 0
-        except sqlite3.OperationalError:
-            # Fallback for databases without in_progress column
-            cursor.execute("""
-                SELECT
-                    COUNT(*) as total,
-                    SUM(CASE WHEN passes = 1 THEN 1 ELSE 0 END) as passing
-                FROM features
-            """)
-            row = cursor.fetchone()
-            total = row[0] or 0
-            passing = row[1] or 0
-            in_progress = 0
-        conn.close()
-        return passing, in_progress, total
+        with closing(_get_connection(db_file)) as conn:
+            cursor = conn.cursor()
+            # Single aggregate query instead of 3 separate COUNT queries
+            # Handle case where in_progress column doesn't exist yet (legacy DBs)
+            try:
+                cursor.execute("""
+                    SELECT
+                        COUNT(*) as total,
+                        SUM(CASE WHEN passes = 1 THEN 1 ELSE 0 END) as passing,
+                        SUM(CASE WHEN in_progress = 1 THEN 1 ELSE 0 END) as in_progress
+                    FROM features
+                """)
+                row = cursor.fetchone()
+                total = row[0] or 0
+                passing = row[1] or 0
+                in_progress = row[2] or 0
+            except sqlite3.OperationalError:
+                # Fallback for databases without in_progress column
+                cursor.execute("""
+                    SELECT
+                        COUNT(*) as total,
+                        SUM(CASE WHEN passes = 1 THEN 1 ELSE 0 END) as passing
+                    FROM features
+                """)
+                row = cursor.fetchone()
+                total = row[0] or 0
+                passing = row[1] or 0
+                in_progress = 0
+            return passing, in_progress, total
     except Exception as e:
         print(f"[Database error in count_passing_tests: {e}]")
         return 0, 0, 0
@@ -115,22 +122,22 @@ def get_all_passing_features(project_dir: Path) -> list[dict]:
     Returns:
         List of dicts with id, category, name for each passing feature
     """
-    db_file = project_dir / "features.db"
+    from autocoder_paths import get_features_db_path
+    db_file = get_features_db_path(project_dir)
     if not db_file.exists():
         return []
 
     try:
-        conn = sqlite3.connect(db_file)
-        cursor = conn.cursor()
-        cursor.execute(
-            "SELECT id, category, name FROM features WHERE passes = 1 ORDER BY priority ASC"
-        )
-        features = [
-            {"id": row[0], "category": row[1], "name": row[2]}
-            for row in cursor.fetchall()
-        ]
-        conn.close()
-        return features
+        with closing(_get_connection(db_file)) as conn:
+            cursor = conn.cursor()
+            cursor.execute(
+                "SELECT id, category, name FROM features WHERE passes = 1 ORDER BY priority ASC"
+            )
+            features = [
+                {"id": row[0], "category": row[1], "name": row[2]}
+                for row in cursor.fetchall()
+            ]
+            return features
     except Exception:
         return []
 
@@ -140,7 +147,8 @@ def send_progress_webhook(passing: int, total: int, project_dir: Path) -> None:
     if not WEBHOOK_URL:
         return  # Webhook not configured
 
-    cache_file = project_dir / PROGRESS_CACHE_FILE
+    from autocoder_paths import get_progress_cache_path
+    cache_file = get_progress_cache_path(project_dir)
     previous = 0
     previous_passing_ids = set()
 

prompts.py

@@ -9,6 +9,7 @@ Fallback chain:
 2. Base template: .claude/templates/{name}.template.md
 """
 
+import re
 import shutil
 from pathlib import Path
 
@@ -18,7 +19,8 @@ TEMPLATES_DIR = Path(__file__).parent / ".claude" / "templates"
 
 def get_project_prompts_dir(project_dir: Path) -> Path:
     """Get the prompts directory for a specific project."""
-    return project_dir / "prompts"
+    from autocoder_paths import get_prompts_dir
+    return get_prompts_dir(project_dir)
 
 
 def load_prompt(name: str, project_dir: Path | None = None) -> str:
@@ -69,42 +71,119 @@ def get_initializer_prompt(project_dir: Path | None = None) -> str:
     return load_prompt("initializer_prompt", project_dir)
 
 
-def get_coding_prompt(project_dir: Path | None = None) -> str:
-    """Load the coding agent prompt (project-specific if available)."""
-    return load_prompt("coding_prompt", project_dir)
+def _strip_browser_testing_sections(prompt: str) -> str:
+    """Strip browser automation and Playwright testing instructions from prompt.
+
+    Used in YOLO mode where browser testing is skipped entirely. Replaces
+    browser-related sections with a brief YOLO-mode note while preserving
+    all non-testing instructions (implementation, git, progress notes, etc.).
+
+    Args:
+        prompt: The full coding prompt text.
+
+    Returns:
+        The prompt with browser testing sections replaced by YOLO guidance.
+    """
+    original_prompt = prompt
+
+    # Replace STEP 5 (browser automation verification) with YOLO note
+    prompt = re.sub(
+        r"### STEP 5: VERIFY WITH BROWSER AUTOMATION.*?(?=### STEP 5\.5:)",
+        "### STEP 5: VERIFY FEATURE (YOLO MODE)\n\n"
+        "**YOLO mode is active.** Skip browser automation testing. "
+        "Instead, verify your feature works by ensuring:\n"
+        "- Code compiles without errors (lint and type-check pass)\n"
+        "- Server starts without errors after your changes\n"
+        "- No obvious runtime errors in server logs\n\n",
+        prompt,
+        flags=re.DOTALL,
+    )
+
+    # Replace the screenshots-only marking rule with YOLO-appropriate wording
+    prompt = prompt.replace(
+        "**ONLY MARK A FEATURE AS PASSING AFTER VERIFICATION WITH SCREENSHOTS.**",
+        "**YOLO mode: Mark a feature as passing after lint/type-check succeeds and server starts cleanly.**",
+    )
+
+    # Replace the BROWSER AUTOMATION reference section
+    prompt = re.sub(
+        r"## BROWSER AUTOMATION\n\n.*?(?=---)",
+        "## VERIFICATION (YOLO MODE)\n\n"
+        "Browser automation is disabled in YOLO mode. "
+        "Verify features by running lint, type-check, and confirming the dev server starts without errors.\n\n",
+        prompt,
+        flags=re.DOTALL,
+    )
+
+    # In STEP 4, replace browser automation reference with YOLO guidance
+    prompt = prompt.replace(
+        "2. Test manually using browser automation (see Step 5)",
+        "2. Verify code compiles (lint and type-check pass)",
+    )
+
+    if prompt == original_prompt:
+        print("[YOLO] Warning: No browser testing sections found to strip. "
+              "Project-specific prompt may need manual YOLO adaptation.")
+
+    return prompt
 
 
-def get_testing_prompt(project_dir: Path | None = None, testing_feature_id: int | None = None) -> str:
-    """Load the testing agent prompt (project-specific if available).
+def get_coding_prompt(project_dir: Path | None = None, yolo_mode: bool = False) -> str:
+    """Load the coding agent prompt (project-specific if available).
 
     Args:
         project_dir: Optional project directory for project-specific prompts
-        testing_feature_id: If provided, the pre-assigned feature ID to test.
-            The orchestrator claims the feature before spawning the agent.
+        yolo_mode: If True, strip browser automation / Playwright testing
+            instructions and replace with YOLO-mode guidance. This reduces
+            prompt tokens since YOLO mode skips all browser testing anyway.
 
     Returns:
-        The testing prompt, with pre-assigned feature instructions if applicable.
+        The coding prompt, optionally stripped of testing instructions.
+    """
+    prompt = load_prompt("coding_prompt", project_dir)
+
+    if yolo_mode:
+        prompt = _strip_browser_testing_sections(prompt)
+
+    return prompt
+
+
+def get_testing_prompt(
+    project_dir: Path | None = None,
+    testing_feature_id: int | None = None,
+    testing_feature_ids: list[int] | None = None,
+) -> str:
+    """Load the testing agent prompt (project-specific if available).
+
+    Supports both single-feature and multi-feature testing modes. When
+    testing_feature_ids is provided, the template's {{TESTING_FEATURE_IDS}}
+    placeholder is replaced with the comma-separated list. Falls back to
+    the legacy single-feature header when only testing_feature_id is given.
+
+    Args:
+        project_dir: Optional project directory for project-specific prompts
+        testing_feature_id: If provided, the pre-assigned feature ID to test (legacy single mode).
+        testing_feature_ids: If provided, a list of feature IDs to test (batch mode).
+            Takes precedence over testing_feature_id when both are set.
+
+    Returns:
+        The testing prompt, with feature assignment instructions populated.
     """
     base_prompt = load_prompt("testing_prompt", project_dir)
 
+    # Batch mode: replace the {{TESTING_FEATURE_IDS}} placeholder in the template
+    if testing_feature_ids is not None and len(testing_feature_ids) > 0:
+        ids_str = ", ".join(str(fid) for fid in testing_feature_ids)
+        return base_prompt.replace("{{TESTING_FEATURE_IDS}}", ids_str)
+
+    # Legacy single-feature mode: prepend header and replace placeholder
     if testing_feature_id is not None:
-        # Prepend pre-assigned feature instructions
-        pre_assigned_header = f"""## ASSIGNED FEATURE
+        # Replace the placeholder with the single ID for template consistency
+        base_prompt = base_prompt.replace("{{TESTING_FEATURE_IDS}}", str(testing_feature_id))
+        return base_prompt
 
-**You are assigned to regression test Feature #{testing_feature_id}.**
-
-### Your workflow:
-1. Call `feature_get_by_id` with ID {testing_feature_id} to get the feature details
-2. Verify the feature through the UI using browser automation
-3. If regression found, call `feature_mark_failing` with feature_id={testing_feature_id}
-4. Exit when done (no cleanup needed)
-
----
-
-"""
-        return pre_assigned_header + base_prompt
-
-    return base_prompt
+    # No feature assignment -- return template with placeholder cleared
+    return base_prompt.replace("{{TESTING_FEATURE_IDS}}", "(none assigned)")
 
 
 def get_single_feature_prompt(feature_id: int, project_dir: Path | None = None, yolo_mode: bool = False) -> str:
@@ -117,13 +196,13 @@ def get_single_feature_prompt(feature_id: int, project_dir: Path | None = None,
     Args:
         feature_id: The specific feature ID to work on
         project_dir: Optional project directory for project-specific prompts
-        yolo_mode: Ignored (kept for backward compatibility). Testing is now
-                   handled by separate testing agents, not YOLO prompts.
+        yolo_mode: If True, strip browser testing instructions from the base
+            coding prompt for reduced token usage in YOLO mode.
 
     Returns:
         The prompt with single-feature header prepended
     """
-    base_prompt = get_coding_prompt(project_dir)
+    base_prompt = get_coding_prompt(project_dir, yolo_mode=yolo_mode)
 
     # Minimal header - the base prompt already contains the full workflow
     single_feature_header = f"""## ASSIGNED FEATURE: #{feature_id}
@@ -138,6 +217,52 @@ If blocked, use `feature_skip` and document the blocker.
     return single_feature_header + base_prompt
 
 
+def get_batch_feature_prompt(
+    feature_ids: list[int],
+    project_dir: Path | None = None,
+    yolo_mode: bool = False,
+) -> str:
+    """Prepend batch-feature assignment header to base coding prompt.
+
+    Used in parallel mode to assign multiple features to an agent.
+    Features should be implemented sequentially in the given order.
+
+    Args:
+        feature_ids: List of feature IDs to implement in order
+        project_dir: Optional project directory for project-specific prompts
+        yolo_mode: If True, strip browser testing instructions from the base prompt
+
+    Returns:
+        The prompt with batch-feature header prepended
+    """
+    base_prompt = get_coding_prompt(project_dir, yolo_mode=yolo_mode)
+    ids_str = ", ".join(f"#{fid}" for fid in feature_ids)
+
+    batch_header = f"""## ASSIGNED FEATURES (BATCH): {ids_str}
+
+You have been assigned {len(feature_ids)} features to implement sequentially.
+Process them IN ORDER: {ids_str}
+
+### Workflow for each feature:
+1. Call `feature_claim_and_get` with the feature ID to get its details
+2. Implement the feature fully
+3. Verify it works (browser testing if applicable)
+4. Call `feature_mark_passing` to mark it complete
+5. Git commit the changes
+6. Move to the next feature
+
+### Important:
+- Complete each feature fully before starting the next
+- Mark each feature passing individually as you go
+- If blocked on a feature, use `feature_skip` and move to the next one
+- Other agents are handling other features - focus only on yours
+
+---
+
+"""
+    return batch_header + base_prompt
+
+
 def get_app_spec(project_dir: Path) -> str:
     """
     Load the app spec from the project.
@@ -190,9 +315,9 @@ def scaffold_project_prompts(project_dir: Path) -> Path:
     project_prompts = get_project_prompts_dir(project_dir)
     project_prompts.mkdir(parents=True, exist_ok=True)
 
-    # Create .autocoder directory for configuration files
-    autocoder_dir = project_dir / ".autocoder"
-    autocoder_dir.mkdir(parents=True, exist_ok=True)
+    # Create .autocoder directory with .gitignore for runtime files
+    from autocoder_paths import ensure_autocoder_dir
+    autocoder_dir = ensure_autocoder_dir(project_dir)
 
     # Define template mappings: (source_template, destination_name)
     templates = [

rate_limit_utils.py

@@ -0,0 +1,132 @@
+"""
+Rate Limit Utilities
+====================
+
+Shared utilities for detecting and handling API rate limits.
+Used by both agent.py (production) and test_rate_limit_utils.py (tests).
+"""
+
+import random
+import re
+from typing import Optional
+
+# Regex patterns for rate limit detection (used in both exception messages and response text)
+# These patterns use word boundaries to avoid false positives like "PR #429" or "please wait while I..."
+RATE_LIMIT_REGEX_PATTERNS = [
+    r"\brate[_\s]?limit",         # "rate limit", "rate_limit", "ratelimit"
+    r"\btoo\s+many\s+requests",   # "too many requests"
+    r"\bhttp\s*429\b",            # "http 429", "http429"
+    r"\bstatus\s*429\b",          # "status 429", "status429"
+    r"\berror\s*429\b",           # "error 429", "error429"
+    r"\b429\s+too\s+many",        # "429 too many"
+    r"\b(?:server|api|system)\s+(?:is\s+)?overloaded\b",  # "server is overloaded", "api overloaded"
+    r"\bquota\s*exceeded\b",      # "quota exceeded"
+]
+
+# Compiled regex for efficient matching
+_RATE_LIMIT_REGEX = re.compile(
+    "|".join(RATE_LIMIT_REGEX_PATTERNS),
+    re.IGNORECASE
+)
+
+
+def parse_retry_after(error_message: str) -> Optional[int]:
+    """
+    Extract retry-after seconds from various error message formats.
+
+    Handles common formats:
+    - "Retry-After: 60"
+    - "retry after 60 seconds"
+    - "try again in 5 seconds"
+    - "30 seconds remaining"
+
+    Args:
+        error_message: The error message to parse
+
+    Returns:
+        Seconds to wait, or None if not parseable.
+    """
+    # Patterns require explicit "seconds" or "s" unit, OR no unit at all (end of string/sentence)
+    # This prevents matching "30 minutes" or "1 hour" since those have non-seconds units
+    patterns = [
+        r"retry.?after[:\s]+(\d+)\s*(?:seconds?|s\b)",  # Requires seconds unit
+        r"retry.?after[:\s]+(\d+)(?:\s*$|\s*[,.])",     # Or end of string/sentence
+        r"try again in\s+(\d+)\s*(?:seconds?|s\b)",     # Requires seconds unit
+        r"try again in\s+(\d+)(?:\s*$|\s*[,.])",        # Or end of string/sentence
+        r"(\d+)\s*seconds?\s*(?:remaining|left|until)",
+    ]
+
+    for pattern in patterns:
+        match = re.search(pattern, error_message, re.IGNORECASE)
+        if match:
+            return int(match.group(1))
+
+    return None
+
+
+def is_rate_limit_error(error_message: str) -> bool:
+    """
+    Detect if an error message indicates a rate limit.
+
+    Uses regex patterns with word boundaries to avoid false positives
+    like "PR #429", "please wait while I...", or "Node v14.29.0".
+
+    Args:
+        error_message: The error message to check
+
+    Returns:
+        True if the message indicates a rate limit, False otherwise.
+    """
+    return bool(_RATE_LIMIT_REGEX.search(error_message))
+
+
+def calculate_rate_limit_backoff(retries: int) -> int:
+    """
+    Calculate exponential backoff with jitter for rate limits.
+
+    Base formula: min(15 * 2^retries, 3600)
+    Jitter: adds 0-30% random jitter to prevent thundering herd.
+    Base sequence: ~15-20s, ~30-40s, ~60-78s, ~120-156s, ...
+
+    The lower starting delay (15s vs 60s) allows faster recovery from
+    transient rate limits, while jitter prevents synchronized retries
+    when multiple agents hit limits simultaneously.
+
+    Args:
+        retries: Number of consecutive rate limit retries (0-indexed)
+
+    Returns:
+        Delay in seconds (clamped to 1-3600 range, with jitter)
+    """
+    base = int(min(max(15 * (2 ** retries), 1), 3600))
+    jitter = random.uniform(0, base * 0.3)
+    return int(base + jitter)
+
+
+def calculate_error_backoff(retries: int) -> int:
+    """
+    Calculate linear backoff for non-rate-limit errors.
+
+    Formula: min(30 * retries, 300) - caps at 5 minutes
+    Sequence: 30s, 60s, 90s, 120s, ... 300s
+
+    Args:
+        retries: Number of consecutive error retries (1-indexed)
+
+    Returns:
+        Delay in seconds (clamped to 1-300 range)
+    """
+    return min(max(30 * retries, 1), 300)
+
+
+def clamp_retry_delay(delay_seconds: int) -> int:
+    """
+    Clamp a retry delay to a safe range (1-3600 seconds).
+
+    Args:
+        delay_seconds: The raw delay value
+
+    Returns:
+        Delay clamped to 1-3600 seconds
+    """
+    return min(max(delay_seconds, 1), 3600)

registry.py

@@ -16,9 +16,8 @@ from datetime import datetime
 from pathlib import Path
 from typing import Any
 
-from sqlalchemy import Column, DateTime, String, create_engine
-from sqlalchemy.ext.declarative import declarative_base
-from sqlalchemy.orm import sessionmaker
+from sqlalchemy import Column, DateTime, Integer, String, create_engine, text
+from sqlalchemy.orm import DeclarativeBase, sessionmaker
 
 # Module logger
 logger = logging.getLogger(__name__)
@@ -39,7 +38,17 @@ AVAILABLE_MODELS = [
 VALID_MODELS = [m["id"] for m in AVAILABLE_MODELS]
 
 # Default model and settings
-DEFAULT_MODEL = "claude-opus-4-5-20251101"
+# Respect ANTHROPIC_DEFAULT_OPUS_MODEL env var for Foundry/custom deployments
+# Guard against empty/whitespace values by trimming and falling back when blank
+_env_default_model = os.getenv("ANTHROPIC_DEFAULT_OPUS_MODEL")
+if _env_default_model is not None:
+    _env_default_model = _env_default_model.strip()
+DEFAULT_MODEL = _env_default_model or "claude-opus-4-5-20251101"
+
+# Ensure env-provided DEFAULT_MODEL is in VALID_MODELS for validation consistency
+# (idempotent: only adds if missing, doesn't alter AVAILABLE_MODELS semantics)
+if DEFAULT_MODEL and DEFAULT_MODEL not in VALID_MODELS:
+    VALID_MODELS.append(DEFAULT_MODEL)
 DEFAULT_YOLO_MODE = False
 
 # SQLite connection settings
@@ -75,7 +84,9 @@ class RegistryPermissionDenied(RegistryError):
 # SQLAlchemy Model
 # =============================================================================
 
-Base = declarative_base()
+class Base(DeclarativeBase):
+    """SQLAlchemy 2.0 style declarative base."""
+    pass
 
 
 class Project(Base):
@@ -85,6 +96,7 @@ class Project(Base):
     name = Column(String(50), primary_key=True, index=True)
     path = Column(String, nullable=False)  # POSIX format for cross-platform
     created_at = Column(DateTime, nullable=False)
+    default_concurrency = Column(Integer, nullable=False, default=3)
 
 
 class Settings(Base):
@@ -146,12 +158,26 @@ def _get_engine():
                     }
                 )
                 Base.metadata.create_all(bind=_engine)
+                _migrate_add_default_concurrency(_engine)
                 _SessionLocal = sessionmaker(autocommit=False, autoflush=False, bind=_engine)
                 logger.debug("Initialized registry database at: %s", db_path)
 
     return _engine, _SessionLocal
 
 
+def _migrate_add_default_concurrency(engine) -> None:
+    """Add default_concurrency column if missing (for existing databases)."""
+    with engine.connect() as conn:
+        result = conn.execute(text("PRAGMA table_info(projects)"))
+        columns = [row[1] for row in result.fetchall()]
+        if "default_concurrency" not in columns:
+            conn.execute(text(
+                "ALTER TABLE projects ADD COLUMN default_concurrency INTEGER DEFAULT 3"
+            ))
+            conn.commit()
+            logger.info("Migrated projects table: added default_concurrency column")
+
+
 @contextmanager
 def _get_session():
     """
@@ -307,7 +333,8 @@ def list_registered_projects() -> dict[str, dict[str, Any]]:
         return {
             p.name: {
                 "path": p.path,
-                "created_at": p.created_at.isoformat() if p.created_at else None
+                "created_at": p.created_at.isoformat() if p.created_at else None,
+                "default_concurrency": getattr(p, 'default_concurrency', 3) or 3
             }
             for p in projects
         }
@@ -333,7 +360,8 @@ def get_project_info(name: str) -> dict[str, Any] | None:
             return None
         return {
             "path": project.path,
-            "created_at": project.created_at.isoformat() if project.created_at else None
+            "created_at": project.created_at.isoformat() if project.created_at else None,
+            "default_concurrency": getattr(project, 'default_concurrency', 3) or 3
         }
     finally:
         session.close()
@@ -362,6 +390,55 @@ def update_project_path(name: str, new_path: Path) -> bool:
     return True
 
 
+def get_project_concurrency(name: str) -> int:
+    """
+    Get project's default concurrency (1-5).
+
+    Args:
+        name: The project name.
+
+    Returns:
+        The default concurrency value (defaults to 3 if not set or project not found).
+    """
+    _, SessionLocal = _get_engine()
+    session = SessionLocal()
+    try:
+        project = session.query(Project).filter(Project.name == name).first()
+        if project is None:
+            return 3
+        return getattr(project, 'default_concurrency', 3) or 3
+    finally:
+        session.close()
+
+
+def set_project_concurrency(name: str, concurrency: int) -> bool:
+    """
+    Set project's default concurrency (1-5).
+
+    Args:
+        name: The project name.
+        concurrency: The concurrency value (1-5).
+
+    Returns:
+        True if updated, False if project wasn't found.
+
+    Raises:
+        ValueError: If concurrency is not between 1 and 5.
+    """
+    if concurrency < 1 or concurrency > 5:
+        raise ValueError("concurrency must be between 1 and 5")
+
+    with _get_session() as session:
+        project = session.query(Project).filter(Project.name == name).first()
+        if not project:
+            return False
+
+        project.default_concurrency = concurrency
+
+    logger.info("Set project '%s' default_concurrency to %d", name, concurrency)
+    return True
+
+
 # =============================================================================
 # Validation Functions
 # =============================================================================

requirements.txt

@@ -15,3 +15,4 @@ pyyaml>=6.0.0
 ruff>=0.8.0
 mypy>=1.13.0
 pytest>=8.0.0
+types-PyYAML>=6.0.0

security.py

@@ -6,13 +6,22 @@ Pre-tool-use hooks that validate bash commands for security.
 Uses an allowlist approach - only explicitly permitted commands can run.
 """
 
+import logging
 import os
+import re
 import shlex
 from pathlib import Path
 from typing import Optional
 
 import yaml
 
+# Logger for security-related events (fallback parsing, validation failures, etc.)
+logger = logging.getLogger(__name__)
+
+# Regex pattern for valid pkill process names (no regex metacharacters allowed)
+# Matches alphanumeric names with dots, underscores, and hyphens
+VALID_PROCESS_NAME_PATTERN = re.compile(r"^[A-Za-z0-9._-]+$")
+
 # Allowed commands for development tasks
 # Minimal set needed for the autonomous coding demo
 ALLOWED_COMMANDS = {
@@ -88,6 +97,31 @@ BLOCKED_COMMANDS = {
     "ufw",
 }
 
+# Sensitive directories (relative to home) that should never be exposed.
+# Used by both the EXTRA_READ_PATHS validator (client.py) and the filesystem
+# browser API (server/routers/filesystem.py) to block credential/key directories.
+# This is the single source of truth -- import from here in both places.
+#
+# SENSITIVE_DIRECTORIES is the union of the previous filesystem browser blocklist
+# (filesystem.py) and the previous EXTRA_READ_PATHS blocklist (client.py).
+# Some entries are new to each consumer -- this is intentional for defense-in-depth.
+SENSITIVE_DIRECTORIES = {
+    ".ssh",
+    ".aws",
+    ".azure",
+    ".kube",
+    ".gnupg",
+    ".gpg",
+    ".password-store",
+    ".docker",
+    ".config/gcloud",
+    ".config/gh",
+    ".npmrc",
+    ".pypirc",
+    ".netrc",
+    ".terraform",
+}
+
 # Commands that trigger emphatic warnings but CAN be approved (Phase 3)
 # For now, these are blocked like BLOCKED_COMMANDS until Phase 3 implements approval
 DANGEROUS_COMMANDS = {
@@ -135,6 +169,45 @@ def split_command_segments(command_string: str) -> list[str]:
     return result
 
 
+def _extract_primary_command(segment: str) -> str | None:
+    """
+    Fallback command extraction when shlex fails.
+
+    Extracts the first word that looks like a command, handling cases
+    like complex docker exec commands with nested quotes.
+
+    Args:
+        segment: The command segment to parse
+
+    Returns:
+        The primary command name, or None if extraction fails
+    """
+    # Remove leading whitespace
+    segment = segment.lstrip()
+
+    if not segment:
+        return None
+
+    # Skip env var assignments at start (VAR=value cmd)
+    words = segment.split()
+    while words and "=" in words[0] and not words[0].startswith("="):
+        words = words[1:]
+
+    if not words:
+        return None
+
+    # Extract first token (the command)
+    first_word = words[0]
+
+    # Match valid command characters (alphanumeric, dots, underscores, hyphens, slashes)
+    match = re.match(r"^([a-zA-Z0-9_./-]+)", first_word)
+    if match:
+        cmd = match.group(1)
+        return os.path.basename(cmd)
+
+    return None
+
+
 def extract_commands(command_string: str) -> list[str]:
     """
     Extract command names from a shell command string.
@@ -151,7 +224,6 @@ def extract_commands(command_string: str) -> list[str]:
     commands = []
 
     # shlex doesn't treat ; as a separator, so we need to pre-process
-    import re
 
     # Split on semicolons that aren't inside quotes (simple heuristic)
     # This handles common cases like "echo hello; ls"
@@ -166,8 +238,21 @@ def extract_commands(command_string: str) -> list[str]:
             tokens = shlex.split(segment)
         except ValueError:
             # Malformed command (unclosed quotes, etc.)
-            # Return empty to trigger block (fail-safe)
-            return []
+            # Try fallback extraction instead of blocking entirely
+            fallback_cmd = _extract_primary_command(segment)
+            if fallback_cmd:
+                logger.debug(
+                    "shlex fallback used: segment=%r -> command=%r",
+                    segment,
+                    fallback_cmd,
+                )
+                commands.append(fallback_cmd)
+            else:
+                logger.debug(
+                    "shlex fallback failed: segment=%r (no command extracted)",
+                    segment,
+                )
+            continue
 
         if not tokens:
             continue
@@ -219,23 +304,37 @@ def extract_commands(command_string: str) -> list[str]:
     return commands
 
 
-def validate_pkill_command(command_string: str) -> tuple[bool, str]:
+# Default pkill process names (hardcoded baseline, always available)
+DEFAULT_PKILL_PROCESSES = {
+    "node",
+    "npm",
+    "npx",
+    "vite",
+    "next",
+}
+
+
+def validate_pkill_command(
+    command_string: str,
+    extra_processes: Optional[set[str]] = None
+) -> tuple[bool, str]:
     """
     Validate pkill commands - only allow killing dev-related processes.
 
     Uses shlex to parse the command, avoiding regex bypass vulnerabilities.
 
+    Args:
+        command_string: The pkill command to validate
+        extra_processes: Optional set of additional process names to allow
+                        (from org/project config pkill_processes)
+
     Returns:
         Tuple of (is_allowed, reason_if_blocked)
     """
-    # Allowed process names for pkill
-    allowed_process_names = {
-        "node",
-        "npm",
-        "npx",
-        "vite",
-        "next",
-    }
+    # Merge default processes with any extra configured processes
+    allowed_process_names = DEFAULT_PKILL_PROCESSES.copy()
+    if extra_processes:
+        allowed_process_names |= extra_processes
 
     try:
         tokens = shlex.split(command_string)
@@ -254,17 +353,19 @@ def validate_pkill_command(command_string: str) -> tuple[bool, str]:
     if not args:
         return False, "pkill requires a process name"
 
-    # The target is typically the last non-flag argument
-    target = args[-1]
+    # Validate every non-flag argument (pkill accepts multiple patterns on BSD)
+    # This defensively ensures no disallowed process can be targeted
+    targets = []
+    for arg in args:
+        # For -f flag (full command line match), take the first word as process name
+        # e.g., "pkill -f 'node server.js'" -> target is "node server.js", process is "node"
+        t = arg.split()[0] if " " in arg else arg
+        targets.append(t)
 
-    # For -f flag (full command line match), extract the first word as process name
-    # e.g., "pkill -f 'node server.js'" -> target is "node server.js", process is "node"
-    if " " in target:
-        target = target.split()[0]
-
-    if target in allowed_process_names:
+    disallowed = [t for t in targets if t not in allowed_process_names]
+    if not disallowed:
         return True, ""
-    return False, f"pkill only allowed for dev processes: {allowed_process_names}"
+    return False, f"pkill only allowed for processes: {sorted(allowed_process_names)}"
 
 
 def validate_chmod_command(command_string: str) -> tuple[bool, str]:
@@ -337,24 +438,6 @@ def validate_init_script(command_string: str) -> tuple[bool, str]:
     return False, f"Only ./init.sh is allowed, got: {script}"
 
 
-def get_command_for_validation(cmd: str, segments: list[str]) -> str:
-    """
-    Find the specific command segment that contains the given command.
-
-    Args:
-        cmd: The command name to find
-        segments: List of command segments
-
-    Returns:
-        The segment containing the command, or empty string if not found
-    """
-    for segment in segments:
-        segment_commands = extract_commands(segment)
-        if cmd in segment_commands:
-            return segment
-    return ""
-
-
 def matches_pattern(command: str, pattern: str) -> bool:
     """
     Check if a command matches a pattern.
@@ -396,6 +479,75 @@ def matches_pattern(command: str, pattern: str) -> bool:
     return False
 
 
+def _validate_command_list(commands: list, config_path: Path, field_name: str) -> bool:
+    """
+    Validate a list of command entries from a YAML config.
+
+    Each entry must be a dict with a non-empty string 'name' field.
+    Used by both load_org_config() and load_project_commands() to avoid
+    duplicating the same validation logic.
+
+    Args:
+        commands: List of command entries to validate
+        config_path: Path to the config file (for log messages)
+        field_name: Name of the YAML field being validated (e.g., 'allowed_commands', 'commands')
+
+    Returns:
+        True if all entries are valid, False otherwise
+    """
+    if not isinstance(commands, list):
+        logger.warning(f"Config at {config_path}: '{field_name}' must be a list")
+        return False
+    for i, cmd in enumerate(commands):
+        if not isinstance(cmd, dict):
+            logger.warning(f"Config at {config_path}: {field_name}[{i}] must be a dict")
+            return False
+        if "name" not in cmd:
+            logger.warning(f"Config at {config_path}: {field_name}[{i}] missing 'name'")
+            return False
+        if not isinstance(cmd["name"], str) or cmd["name"].strip() == "":
+            logger.warning(f"Config at {config_path}: {field_name}[{i}] has invalid 'name'")
+            return False
+    return True
+
+
+def _validate_pkill_processes(config: dict, config_path: Path) -> Optional[list[str]]:
+    """
+    Validate and normalize pkill_processes from a YAML config.
+
+    Each entry must be a non-empty string matching VALID_PROCESS_NAME_PATTERN
+    (alphanumeric, dots, underscores, hyphens only -- no regex metacharacters).
+    Used by both load_org_config() and load_project_commands().
+
+    Args:
+        config: Parsed YAML config dict that may contain 'pkill_processes'
+        config_path: Path to the config file (for log messages)
+
+    Returns:
+        Normalized list of process names, or None if validation fails.
+        Returns an empty list if 'pkill_processes' is not present.
+    """
+    if "pkill_processes" not in config:
+        return []
+
+    processes = config["pkill_processes"]
+    if not isinstance(processes, list):
+        logger.warning(f"Config at {config_path}: 'pkill_processes' must be a list")
+        return None
+
+    normalized = []
+    for i, proc in enumerate(processes):
+        if not isinstance(proc, str):
+            logger.warning(f"Config at {config_path}: pkill_processes[{i}] must be a string")
+            return None
+        proc = proc.strip()
+        if not proc or not VALID_PROCESS_NAME_PATTERN.fullmatch(proc):
+            logger.warning(f"Config at {config_path}: pkill_processes[{i}] has invalid value '{proc}'")
+            return None
+        normalized.append(proc)
+    return normalized
+
+
 def get_org_config_path() -> Path:
     """
     Get the organization-level config file path.
@@ -423,41 +575,48 @@ def load_org_config() -> Optional[dict]:
             config = yaml.safe_load(f)
 
         if not config:
+            logger.warning(f"Org config at {config_path} is empty")
             return None
 
         # Validate structure
         if not isinstance(config, dict):
+            logger.warning(f"Org config at {config_path} must be a YAML dictionary")
             return None
 
         if "version" not in config:
+            logger.warning(f"Org config at {config_path} missing required 'version' field")
             return None
 
         # Validate allowed_commands if present
         if "allowed_commands" in config:
-            allowed = config["allowed_commands"]
-            if not isinstance(allowed, list):
+            if not _validate_command_list(config["allowed_commands"], config_path, "allowed_commands"):
                 return None
-            for cmd in allowed:
-                if not isinstance(cmd, dict):
-                    return None
-                if "name" not in cmd:
-                    return None
-                # Validate that name is a non-empty string
-                if not isinstance(cmd["name"], str) or cmd["name"].strip() == "":
-                    return None
 
         # Validate blocked_commands if present
         if "blocked_commands" in config:
             blocked = config["blocked_commands"]
             if not isinstance(blocked, list):
+                logger.warning(f"Org config at {config_path}: 'blocked_commands' must be a list")
                 return None
-            for cmd in blocked:
+            for i, cmd in enumerate(blocked):
                 if not isinstance(cmd, str):
+                    logger.warning(f"Org config at {config_path}: blocked_commands[{i}] must be a string")
                     return None
 
+        # Validate pkill_processes if present
+        normalized = _validate_pkill_processes(config, config_path)
+        if normalized is None:
+            return None
+        if normalized:
+            config["pkill_processes"] = normalized
+
         return config
 
-    except (yaml.YAMLError, IOError, OSError):
+    except yaml.YAMLError as e:
+        logger.warning(f"Failed to parse org config at {config_path}: {e}")
+        return None
+    except (IOError, OSError) as e:
+        logger.warning(f"Failed to read org config at {config_path}: {e}")
         return None
 
 
@@ -471,7 +630,7 @@ def load_project_commands(project_dir: Path) -> Optional[dict]:
     Returns:
         Dict with parsed YAML config, or None if file doesn't exist or is invalid
     """
-    config_path = project_dir / ".autocoder" / "allowed_commands.yaml"
+    config_path = project_dir.resolve() / ".autocoder" / "allowed_commands.yaml"
 
     if not config_path.exists():
         return None
@@ -481,36 +640,43 @@ def load_project_commands(project_dir: Path) -> Optional[dict]:
             config = yaml.safe_load(f)
 
         if not config:
+            logger.warning(f"Project config at {config_path} is empty")
             return None
 
         # Validate structure
         if not isinstance(config, dict):
+            logger.warning(f"Project config at {config_path} must be a YAML dictionary")
             return None
 
         if "version" not in config:
+            logger.warning(f"Project config at {config_path} missing required 'version' field")
             return None
 
         commands = config.get("commands", [])
-        if not isinstance(commands, list):
-            return None
 
         # Enforce 100 command limit
-        if len(commands) > 100:
+        if isinstance(commands, list) and len(commands) > 100:
+            logger.warning(f"Project config at {config_path} exceeds 100 command limit ({len(commands)} commands)")
             return None
 
-        # Validate each command entry
-        for cmd in commands:
-            if not isinstance(cmd, dict):
-                return None
-            if "name" not in cmd:
-                return None
-            # Validate name is a string
-            if not isinstance(cmd["name"], str):
-                return None
+        # Validate each command entry using shared helper
+        if not _validate_command_list(commands, config_path, "commands"):
+            return None
+
+        # Validate pkill_processes if present
+        normalized = _validate_pkill_processes(config, config_path)
+        if normalized is None:
+            return None
+        if normalized:
+            config["pkill_processes"] = normalized
 
         return config
 
-    except (yaml.YAMLError, IOError, OSError):
+    except yaml.YAMLError as e:
+        logger.warning(f"Failed to parse project config at {config_path}: {e}")
+        return None
+    except (IOError, OSError) as e:
+        logger.warning(f"Failed to read project config at {config_path}: {e}")
         return None
 
 
@@ -518,8 +684,12 @@ def validate_project_command(cmd_config: dict) -> tuple[bool, str]:
     """
     Validate a single command entry from project config.
 
+    Checks that the command has a valid name and is not in any blocklist.
+    Called during hierarchy resolution to gate each project command before
+    it is added to the effective allowed set.
+
     Args:
-        cmd_config: Dict with command configuration (name, description, args)
+        cmd_config: Dict with command configuration (name, description)
 
     Returns:
         Tuple of (is_valid, error_message)
@@ -549,15 +719,6 @@ def validate_project_command(cmd_config: dict) -> tuple[bool, str]:
     if "description" in cmd_config and not isinstance(cmd_config["description"], str):
         return False, "Description must be a string"
 
-    # Args validation (Phase 1 - just check structure)
-    if "args" in cmd_config:
-        args = cmd_config["args"]
-        if not isinstance(args, list):
-            return False, "Args must be a list"
-        for arg in args:
-            if not isinstance(arg, str):
-                return False, "Each arg must be a string"
-
     return True, ""
 
 
@@ -628,6 +789,42 @@ def get_project_allowed_commands(project_dir: Optional[Path]) -> set[str]:
     return allowed
 
 
+def get_effective_pkill_processes(project_dir: Optional[Path]) -> set[str]:
+    """
+    Get effective pkill process names after hierarchy resolution.
+
+    Merges processes from:
+    1. DEFAULT_PKILL_PROCESSES (hardcoded baseline)
+    2. Org config pkill_processes
+    3. Project config pkill_processes
+
+    Args:
+        project_dir: Path to the project directory, or None
+
+    Returns:
+        Set of allowed process names for pkill
+    """
+    # Start with default processes
+    processes = DEFAULT_PKILL_PROCESSES.copy()
+
+    # Add org-level pkill_processes
+    org_config = load_org_config()
+    if org_config:
+        org_processes = org_config.get("pkill_processes", [])
+        if isinstance(org_processes, list):
+            processes |= {p for p in org_processes if isinstance(p, str) and p.strip()}
+
+    # Add project-level pkill_processes
+    if project_dir:
+        project_config = load_project_commands(project_dir)
+        if project_config:
+            proj_processes = project_config.get("pkill_processes", [])
+            if isinstance(proj_processes, list):
+                processes |= {p for p in proj_processes if isinstance(p, str) and p.strip()}
+
+    return processes
+
+
 def is_command_allowed(command: str, allowed_commands: set[str]) -> bool:
     """
     Check if a command is allowed (supports patterns).
@@ -692,6 +889,9 @@ async def bash_security_hook(input_data, tool_use_id=None, context=None):
     # Get effective commands using hierarchy resolution
     allowed_commands, blocked_commands = get_effective_commands(project_dir)
 
+    # Get effective pkill processes (includes org/project config)
+    pkill_processes = get_effective_pkill_processes(project_dir)
+
     # Split into segments for per-command validation
     segments = split_command_segments(command)
 
@@ -719,13 +919,20 @@ async def bash_security_hook(input_data, tool_use_id=None, context=None):
 
         # Additional validation for sensitive commands
         if cmd in COMMANDS_NEEDING_EXTRA_VALIDATION:
-            # Find the specific segment containing this command
-            cmd_segment = get_command_for_validation(cmd, segments)
+            # Find the specific segment containing this command by searching
+            # each segment's extracted commands for a match
+            cmd_segment = ""
+            for segment in segments:
+                if cmd in extract_commands(segment):
+                    cmd_segment = segment
+                    break
             if not cmd_segment:
                 cmd_segment = command  # Fallback to full command
 
             if cmd == "pkill":
-                allowed, reason = validate_pkill_command(cmd_segment)
+                # Pass configured extra processes (beyond defaults)
+                extra_procs = pkill_processes - DEFAULT_PKILL_PROCESSES
+                allowed, reason = validate_pkill_command(cmd_segment, extra_procs if extra_procs else None)
                 if not allowed:
                     return {"decision": "block", "reason": reason}
             elif cmd == "chmod":

server/main.py

@@ -7,6 +7,7 @@ Provides REST API, WebSocket, and static file serving.
 """
 
 import asyncio
+import logging
 import os
 import shutil
 import sys
@@ -42,6 +43,7 @@ from .routers import (
 )
 from .schemas import SetupStatus
 from .services.assistant_chat_session import cleanup_all_sessions as cleanup_assistant_sessions
+from .services.chat_constants import ROOT_DIR
 from .services.dev_server_manager import (
     cleanup_all_devservers,
     cleanup_orphaned_devserver_locks,
@@ -53,7 +55,6 @@ from .services.terminal_manager import cleanup_all_terminals
 from .websocket import project_websocket
 
 # Paths
-ROOT_DIR = Path(__file__).parent.parent
 UI_DIST_DIR = ROOT_DIR / "ui" / "dist"
 
 
@@ -88,35 +89,58 @@ app = FastAPI(
     lifespan=lifespan,
 )
 
-# CORS - allow only localhost origins for security
-app.add_middleware(
-    CORSMiddleware,
-    allow_origins=[
-        "http://localhost:5173",      # Vite dev server
-        "http://127.0.0.1:5173",
-        "http://localhost:8888",      # Production
-        "http://127.0.0.1:8888",
-    ],
-    allow_credentials=True,
-    allow_methods=["*"],
-    allow_headers=["*"],
-)
+# Module logger
+logger = logging.getLogger(__name__)
+
+# Check if remote access is enabled via environment variable
+# Set by start_ui.py when --host is not 127.0.0.1
+ALLOW_REMOTE = os.environ.get("AUTOCODER_ALLOW_REMOTE", "").lower() in ("1", "true", "yes")
+
+if ALLOW_REMOTE:
+    logger.warning(
+        "ALLOW_REMOTE is enabled. Terminal WebSocket is exposed without sandboxing. "
+        "Only use this in trusted network environments."
+    )
+
+# CORS - allow all origins when remote access is enabled, otherwise localhost only
+if ALLOW_REMOTE:
+    app.add_middleware(
+        CORSMiddleware,
+        allow_origins=["*"],  # Allow all origins for remote access
+        allow_credentials=True,
+        allow_methods=["*"],
+        allow_headers=["*"],
+    )
+else:
+    app.add_middleware(
+        CORSMiddleware,
+        allow_origins=[
+            "http://localhost:5173",      # Vite dev server
+            "http://127.0.0.1:5173",
+            "http://localhost:8888",      # Production
+            "http://127.0.0.1:8888",
+        ],
+        allow_credentials=True,
+        allow_methods=["*"],
+        allow_headers=["*"],
+    )
 
 
 # ============================================================================
 # Security Middleware
 # ============================================================================
 
-@app.middleware("http")
-async def require_localhost(request: Request, call_next):
-    """Only allow requests from localhost."""
-    client_host = request.client.host if request.client else None
+if not ALLOW_REMOTE:
+    @app.middleware("http")
+    async def require_localhost(request: Request, call_next):
+        """Only allow requests from localhost (disabled when AUTOCODER_ALLOW_REMOTE=1)."""
+        client_host = request.client.host if request.client else None
 
-    # Allow localhost connections
-    if client_host not in ("127.0.0.1", "::1", "localhost", None):
-        raise HTTPException(status_code=403, detail="Localhost access only")
+        # Allow localhost connections
+        if client_host not in ("127.0.0.1", "::1", "localhost", None):
+            raise HTTPException(status_code=403, detail="Localhost access only")
 
-    return await call_next(request)
+        return await call_next(request)
 
 
 # ============================================================================
@@ -208,7 +232,14 @@ if UI_DIST_DIR.exists():
             raise HTTPException(status_code=404)
 
         # Try to serve the file directly
-        file_path = UI_DIST_DIR / path
+        file_path = (UI_DIST_DIR / path).resolve()
+
+        # Ensure resolved path is within UI_DIST_DIR (prevent path traversal)
+        try:
+            file_path.relative_to(UI_DIST_DIR.resolve())
+        except ValueError:
+            raise HTTPException(status_code=404)
+
         if file_path.exists() and file_path.is_file():
             return FileResponse(file_path)
 

server/routers/agent.py

@@ -6,31 +6,22 @@ API endpoints for agent control (start/stop/pause/resume).
 Uses project registry for path lookups.
 """
 
-import re
 from pathlib import Path
 
 from fastapi import APIRouter, HTTPException
 
 from ..schemas import AgentActionResponse, AgentStartRequest, AgentStatus
+from ..services.chat_constants import ROOT_DIR
 from ..services.process_manager import get_manager
+from ..utils.project_helpers import get_project_path as _get_project_path
+from ..utils.validation import validate_project_name
 
 
-def _get_project_path(project_name: str) -> Path:
-    """Get project path from registry."""
-    import sys
-    root = Path(__file__).parent.parent.parent
-    if str(root) not in sys.path:
-        sys.path.insert(0, str(root))
-
-    from registry import get_project_path
-    return get_project_path(project_name)
-
-
-def _get_settings_defaults() -> tuple[bool, str, int]:
+def _get_settings_defaults() -> tuple[bool, str, int, bool, int]:
     """Get defaults from global settings.
 
     Returns:
-        Tuple of (yolo_mode, model, testing_agent_ratio)
+        Tuple of (yolo_mode, model, testing_agent_ratio, playwright_headless, batch_size)
     """
     import sys
     root = Path(__file__).parent.parent.parent
@@ -49,24 +40,18 @@ def _get_settings_defaults() -> tuple[bool, str, int]:
     except (ValueError, TypeError):
         testing_agent_ratio = 1
 
-    return yolo_mode, model, testing_agent_ratio
+    playwright_headless = (settings.get("playwright_headless") or "true").lower() == "true"
+
+    try:
+        batch_size = int(settings.get("batch_size", "3"))
+    except (ValueError, TypeError):
+        batch_size = 3
+
+    return yolo_mode, model, testing_agent_ratio, playwright_headless, batch_size
 
 
 router = APIRouter(prefix="/api/projects/{project_name}/agent", tags=["agent"])
 
-# Root directory for process manager
-ROOT_DIR = Path(__file__).parent.parent.parent
-
-
-def validate_project_name(name: str) -> str:
-    """Validate and sanitize project name to prevent path traversal."""
-    if not re.match(r'^[a-zA-Z0-9_-]{1,50}$', name):
-        raise HTTPException(
-            status_code=400,
-            detail="Invalid project name"
-        )
-    return name
-
 
 def get_project_manager(project_name: str):
     """Get the process manager for a project."""
@@ -93,7 +78,7 @@ async def get_agent_status(project_name: str):
     return AgentStatus(
         status=manager.status,
         pid=manager.pid,
-        started_at=manager.started_at,
+        started_at=manager.started_at.isoformat() if manager.started_at else None,
         yolo_mode=manager.yolo_mode,
         model=manager.model,
         parallel_mode=manager.parallel_mode,
@@ -111,18 +96,22 @@ async def start_agent(
     manager = get_project_manager(project_name)
 
     # Get defaults from global settings if not provided in request
-    default_yolo, default_model, default_testing_ratio = _get_settings_defaults()
+    default_yolo, default_model, default_testing_ratio, playwright_headless, default_batch_size = _get_settings_defaults()
 
     yolo_mode = request.yolo_mode if request.yolo_mode is not None else default_yolo
     model = request.model if request.model else default_model
     max_concurrency = request.max_concurrency or 1
     testing_agent_ratio = request.testing_agent_ratio if request.testing_agent_ratio is not None else default_testing_ratio
 
+    batch_size = default_batch_size
+
     success, message = await manager.start(
         yolo_mode=yolo_mode,
         model=model,
         max_concurrency=max_concurrency,
         testing_agent_ratio=testing_agent_ratio,
+        playwright_headless=playwright_headless,
+        batch_size=batch_size,
     )
 
     # Notify scheduler of manual start (to prevent auto-stop during scheduled window)

server/routers/assistant_chat.py

@@ -7,8 +7,6 @@ WebSocket and REST endpoints for the read-only project assistant.
 
 import json
 import logging
-import re
-from pathlib import Path
 from typing import Optional
 
 from fastapi import APIRouter, HTTPException, WebSocket, WebSocketDisconnect
@@ -27,30 +25,13 @@ from ..services.assistant_database import (
     get_conversation,
     get_conversations,
 )
+from ..utils.project_helpers import get_project_path as _get_project_path
+from ..utils.validation import is_valid_project_name as validate_project_name
 
 logger = logging.getLogger(__name__)
 
 router = APIRouter(prefix="/api/assistant", tags=["assistant-chat"])
 
-# Root directory
-ROOT_DIR = Path(__file__).parent.parent.parent
-
-
-def _get_project_path(project_name: str) -> Optional[Path]:
-    """Get project path from registry."""
-    import sys
-    root = Path(__file__).parent.parent.parent
-    if str(root) not in sys.path:
-        sys.path.insert(0, str(root))
-
-    from registry import get_project_path
-    return get_project_path(project_name)
-
-
-def validate_project_name(name: str) -> bool:
-    """Validate project name to prevent path traversal."""
-    return bool(re.match(r'^[a-zA-Z0-9_-]{1,50}$', name))
-
 
 # ============================================================================
 # Pydantic Models
@@ -145,9 +126,9 @@ async def create_project_conversation(project_name: str):
 
     conversation = create_conversation(project_dir, project_name)
     return ConversationSummary(
-        id=conversation.id,
-        project_name=conversation.project_name,
-        title=conversation.title,
+        id=int(conversation.id),
+        project_name=str(conversation.project_name),
+        title=str(conversation.title) if conversation.title else None,
         created_at=conversation.created_at.isoformat() if conversation.created_at else None,
         updated_at=conversation.updated_at.isoformat() if conversation.updated_at else None,
         message_count=0,

server/routers/devserver.py

@@ -6,7 +6,7 @@ API endpoints for dev server control (start/stop) and configuration.
 Uses project registry for path lookups and project_config for command detection.
 """
 
-import re
+import logging
 import sys
 from pathlib import Path
 
@@ -26,38 +26,22 @@ from ..services.project_config import (
     get_project_config,
     set_dev_command,
 )
+from ..utils.project_helpers import get_project_path as _get_project_path
+from ..utils.validation import validate_project_name
 
-# Add root to path for registry import
+# Add root to path for security module import
 _root = Path(__file__).parent.parent.parent
 if str(_root) not in sys.path:
     sys.path.insert(0, str(_root))
 
-from registry import get_project_path as registry_get_project_path
+from security import extract_commands, get_effective_commands, is_command_allowed
 
-
-def _get_project_path(project_name: str) -> Path | None:
-    """Get project path from registry."""
-    return registry_get_project_path(project_name)
+logger = logging.getLogger(__name__)
 
 
 router = APIRouter(prefix="/api/projects/{project_name}/devserver", tags=["devserver"])
 
 
-# ============================================================================
-# Helper Functions
-# ============================================================================
-
-
-def validate_project_name(name: str) -> str:
-    """Validate and sanitize project name to prevent path traversal."""
-    if not re.match(r'^[a-zA-Z0-9_-]{1,50}$', name):
-        raise HTTPException(
-            status_code=400,
-            detail="Invalid project name"
-        )
-    return name
-
-
 def get_project_dir(project_name: str) -> Path:
     """
     Get the validated project directory for a project name.
@@ -106,6 +90,45 @@ def get_project_devserver_manager(project_name: str):
     return get_devserver_manager(project_name, project_dir)
 
 
+def validate_dev_command(command: str, project_dir: Path) -> None:
+    """
+    Validate a dev server command against the security allowlist.
+
+    Extracts all commands from the shell string and checks each against
+    the effective allowlist (global + org + project). Raises HTTPException
+    if any command is blocked or not allowed.
+
+    Args:
+        command: The shell command string to validate
+        project_dir: Project directory for loading project-level allowlists
+
+    Raises:
+        HTTPException 400: If the command fails validation
+    """
+    commands = extract_commands(command)
+    if not commands:
+        raise HTTPException(
+            status_code=400,
+            detail="Could not parse command for security validation"
+        )
+
+    allowed_commands, blocked_commands = get_effective_commands(project_dir)
+
+    for cmd in commands:
+        if cmd in blocked_commands:
+            logger.warning("Blocked dev server command '%s' (in blocklist) for project dir %s", cmd, project_dir)
+            raise HTTPException(
+                status_code=400,
+                detail=f"Command '{cmd}' is blocked and cannot be used as a dev server command"
+            )
+        if not is_command_allowed(cmd, allowed_commands):
+            logger.warning("Rejected dev server command '%s' (not in allowlist) for project dir %s", cmd, project_dir)
+            raise HTTPException(
+                status_code=400,
+                detail=f"Command '{cmd}' is not in the allowed commands list"
+            )
+
+
 # ============================================================================
 # Endpoints
 # ============================================================================
@@ -129,7 +152,7 @@ async def get_devserver_status(project_name: str) -> DevServerStatus:
         pid=manager.pid,
         url=manager.detected_url,
         command=manager._command,
-        started_at=manager.started_at,
+        started_at=manager.started_at.isoformat() if manager.started_at else None,
     )
 
 
@@ -167,7 +190,10 @@ async def start_devserver(
             detail="No dev command available. Configure a custom command or ensure project type can be detected."
         )
 
-    # Now command is definitely str
+    # Validate command against security allowlist before execution
+    validate_dev_command(command, project_dir)
+
+    # Now command is definitely str and validated
     success, message = await manager.start(command)
 
     return DevServerActionResponse(
@@ -258,6 +284,9 @@ async def update_devserver_config(
         except ValueError as e:
             raise HTTPException(status_code=400, detail=str(e))
     else:
+        # Validate command against security allowlist before persisting
+        validate_dev_command(update.custom_command, project_dir)
+
         # Set the custom command
         try:
             set_dev_command(project_dir, update.custom_command)

server/routers/expand_project.py

@@ -8,7 +8,6 @@ Allows adding multiple features to existing projects via natural language.
 
 import json
 import logging
-from pathlib import Path
 from typing import Optional
 
 from fastapi import APIRouter, HTTPException, WebSocket, WebSocketDisconnect
@@ -22,27 +21,13 @@ from ..services.expand_chat_session import (
     list_expand_sessions,
     remove_expand_session,
 )
+from ..utils.project_helpers import get_project_path as _get_project_path
 from ..utils.validation import validate_project_name
 
 logger = logging.getLogger(__name__)
 
 router = APIRouter(prefix="/api/expand", tags=["expand-project"])
 
-# Root directory
-ROOT_DIR = Path(__file__).parent.parent.parent
-
-
-def _get_project_path(project_name: str) -> Path:
-    """Get project path from registry."""
-    import sys
-    root = Path(__file__).parent.parent.parent
-    if str(root) not in sys.path:
-        sys.path.insert(0, str(root))
-
-    from registry import get_project_path
-    return get_project_path(project_name)
-
-
 
 
 # ============================================================================
@@ -136,7 +121,8 @@ async def expand_project_websocket(websocket: WebSocket, project_name: str):
         return
 
     # Verify project has app_spec.txt
-    spec_path = project_dir / "prompts" / "app_spec.txt"
+    from autocoder_paths import get_prompts_dir
+    spec_path = get_prompts_dir(project_dir) / "app_spec.txt"
     if not spec_path.exists():
         await websocket.close(code=4004, reason="Project has no spec. Create spec first.")
         return

server/routers/features.py

@@ -8,10 +8,12 @@ API endpoints for feature/test case management.
 import logging
 from contextlib import contextmanager
 from pathlib import Path
+from typing import Literal
 
 from fastapi import APIRouter, HTTPException
 
 from ..schemas import (
+    DependencyGraphEdge,
     DependencyGraphNode,
     DependencyGraphResponse,
     DependencyUpdate,
@@ -22,6 +24,7 @@ from ..schemas import (
     FeatureResponse,
     FeatureUpdate,
 )
+from ..utils.project_helpers import get_project_path as _get_project_path
 from ..utils.validation import validate_project_name
 
 # Lazy imports to avoid circular dependencies
@@ -31,17 +34,6 @@ _Feature = None
 logger = logging.getLogger(__name__)
 
 
-def _get_project_path(project_name: str) -> Path:
-    """Get project path from registry."""
-    import sys
-    root = Path(__file__).parent.parent.parent
-    if str(root) not in sys.path:
-        sys.path.insert(0, str(root))
-
-    from registry import get_project_path
-    return get_project_path(project_name)
-
-
 def _get_db_classes():
     """Lazy import of database classes."""
     global _create_database, _Feature
@@ -71,6 +63,9 @@ def get_db_session(project_dir: Path):
     session = SessionLocal()
     try:
         yield session
+    except Exception:
+        session.rollback()
+        raise
     finally:
         session.close()
 
@@ -131,7 +126,8 @@ async def list_features(project_name: str):
     if not project_dir.exists():
         raise HTTPException(status_code=404, detail="Project directory not found")
 
-    db_file = project_dir / "features.db"
+    from autocoder_paths import get_features_db_path
+    db_file = get_features_db_path(project_dir)
     if not db_file.exists():
         return FeatureListResponse(pending=[], in_progress=[], done=[])
 
@@ -326,7 +322,8 @@ async def get_dependency_graph(project_name: str):
     if not project_dir.exists():
         raise HTTPException(status_code=404, detail="Project directory not found")
 
-    db_file = project_dir / "features.db"
+    from autocoder_paths import get_features_db_path
+    db_file = get_features_db_path(project_dir)
     if not db_file.exists():
         return DependencyGraphResponse(nodes=[], edges=[])
 
@@ -344,6 +341,7 @@ async def get_dependency_graph(project_name: str):
                 deps = f.dependencies or []
                 blocking = [d for d in deps if d not in passing_ids]
 
+                status: Literal["pending", "in_progress", "done", "blocked"]
                 if f.passes:
                     status = "done"
                 elif blocking:
@@ -363,7 +361,7 @@ async def get_dependency_graph(project_name: str):
                 ))
 
                 for dep_id in deps:
-                    edges.append({"source": dep_id, "target": f.id})
+                    edges.append(DependencyGraphEdge(source=dep_id, target=f.id))
 
             return DependencyGraphResponse(nodes=nodes, edges=edges)
     except HTTPException:
@@ -390,7 +388,8 @@ async def get_feature(project_name: str, feature_id: int):
     if not project_dir.exists():
         raise HTTPException(status_code=404, detail="Project directory not found")
 
-    db_file = project_dir / "features.db"
+    from autocoder_paths import get_features_db_path
+    db_file = get_features_db_path(project_dir)
     if not db_file.exists():
         raise HTTPException(status_code=404, detail="No features database found")
 
@@ -551,9 +550,9 @@ async def skip_feature(project_name: str, feature_id: int):
             if not feature:
                 raise HTTPException(status_code=404, detail=f"Feature {feature_id} not found")
 
-            # Set priority to max + 1000 to push to end
+            # Set priority to max + 1 to push to end (consistent with MCP server)
             max_priority = session.query(Feature).order_by(Feature.priority.desc()).first()
-            feature.priority = (max_priority.priority if max_priority else 0) + 1000
+            feature.priority = (max_priority.priority + 1) if max_priority else 1
 
             session.commit()
 

server/routers/filesystem.py

@@ -6,6 +6,7 @@ API endpoints for browsing the filesystem for project folder selection.
 Provides cross-platform support for Windows, macOS, and Linux.
 """
 
+import functools
 import logging
 import os
 import re
@@ -14,6 +15,8 @@ from pathlib import Path
 
 from fastapi import APIRouter, HTTPException, Query
 
+from security import SENSITIVE_DIRECTORIES
+
 # Module logger
 logger = logging.getLogger(__name__)
 
@@ -77,17 +80,10 @@ LINUX_BLOCKED = {
     "/opt",
 }
 
-# Universal blocked paths (relative to home directory)
-UNIVERSAL_BLOCKED_RELATIVE = {
-    ".ssh",
-    ".aws",
-    ".gnupg",
-    ".config/gh",
-    ".netrc",
-    ".docker",
-    ".kube",
-    ".terraform",
-}
+# Universal blocked paths (relative to home directory).
+# Delegates to the canonical SENSITIVE_DIRECTORIES set in security.py so that
+# the filesystem browser and the EXTRA_READ_PATHS validator share one source of truth.
+UNIVERSAL_BLOCKED_RELATIVE = SENSITIVE_DIRECTORIES
 
 # Patterns for files that should not be shown
 HIDDEN_PATTERNS = [
@@ -99,8 +95,14 @@ HIDDEN_PATTERNS = [
 ]
 
 
-def get_blocked_paths() -> set[Path]:
-    """Get the set of blocked paths for the current platform."""
+@functools.lru_cache(maxsize=1)
+def get_blocked_paths() -> frozenset[Path]:
+    """
+    Get the set of blocked paths for the current platform.
+
+    Cached because the platform and home directory do not change at runtime,
+    and this function is called once per directory entry in list_directory().
+    """
     home = Path.home()
     blocked = set()
 
@@ -119,7 +121,7 @@ def get_blocked_paths() -> set[Path]:
     for rel in UNIVERSAL_BLOCKED_RELATIVE:
         blocked.add((home / rel).resolve())
 
-    return blocked
+    return frozenset(blocked)
 
 
 def is_path_blocked(path: Path) -> bool:

server/routers/projects.py

@@ -10,6 +10,7 @@ import re
 import shutil
 import sys
 from pathlib import Path
+from typing import Any, Callable
 
 from fastapi import APIRouter, HTTPException
 
@@ -18,16 +19,18 @@ from ..schemas import (
     ProjectDetail,
     ProjectPrompts,
     ProjectPromptsUpdate,
+    ProjectSettingsUpdate,
     ProjectStats,
     ProjectSummary,
 )
 
 # Lazy imports to avoid circular dependencies
+# These are initialized by _init_imports() before first use.
 _imports_initialized = False
-_check_spec_exists = None
-_scaffold_project_prompts = None
-_get_project_prompts_dir = None
-_count_passing_tests = None
+_check_spec_exists: Callable[..., Any] | None = None
+_scaffold_project_prompts: Callable[..., Any] | None = None
+_get_project_prompts_dir: Callable[..., Any] | None = None
+_count_passing_tests: Callable[..., Any] | None = None
 
 
 def _init_imports():
@@ -63,13 +66,23 @@ def _get_registry_functions():
         sys.path.insert(0, str(root))
 
     from registry import (
+        get_project_concurrency,
         get_project_path,
         list_registered_projects,
         register_project,
+        set_project_concurrency,
         unregister_project,
         validate_project_path,
     )
-    return register_project, unregister_project, get_project_path, list_registered_projects, validate_project_path
+    return (
+        register_project,
+        unregister_project,
+        get_project_path,
+        list_registered_projects,
+        validate_project_path,
+        get_project_concurrency,
+        set_project_concurrency,
+    )
 
 
 router = APIRouter(prefix="/api/projects", tags=["projects"])
@@ -88,6 +101,7 @@ def validate_project_name(name: str) -> str:
 def get_project_stats(project_dir: Path) -> ProjectStats:
     """Get statistics for a project."""
     _init_imports()
+    assert _count_passing_tests is not None  # guaranteed by _init_imports()
     passing, in_progress, total = _count_passing_tests(project_dir)
     percentage = (passing / total * 100) if total > 0 else 0.0
     return ProjectStats(
@@ -102,7 +116,9 @@ def get_project_stats(project_dir: Path) -> ProjectStats:
 async def list_projects():
     """List all registered projects."""
     _init_imports()
-    _, _, _, list_registered_projects, validate_project_path = _get_registry_functions()
+    assert _check_spec_exists is not None  # guaranteed by _init_imports()
+    (_, _, _, list_registered_projects, validate_project_path,
+     get_project_concurrency, _) = _get_registry_functions()
 
     projects = list_registered_projects()
     result = []
@@ -123,6 +139,7 @@ async def list_projects():
             path=info["path"],
             has_spec=has_spec,
             stats=stats,
+            default_concurrency=info.get("default_concurrency", 3),
         ))
 
     return result
@@ -132,7 +149,9 @@ async def list_projects():
 async def create_project(project: ProjectCreate):
     """Create a new project at the specified path."""
     _init_imports()
-    register_project, _, get_project_path, list_registered_projects, _ = _get_registry_functions()
+    assert _scaffold_project_prompts is not None  # guaranteed by _init_imports()
+    (register_project, _, get_project_path, list_registered_projects,
+     _, _, _) = _get_registry_functions()
 
     name = validate_project_name(project.name)
     project_path = Path(project.path).resolve()
@@ -203,6 +222,7 @@ async def create_project(project: ProjectCreate):
         path=project_path.as_posix(),
         has_spec=False,  # Just created, no spec yet
         stats=ProjectStats(passing=0, total=0, percentage=0.0),
+        default_concurrency=3,
     )
 
 
@@ -210,7 +230,9 @@ async def create_project(project: ProjectCreate):
 async def get_project(name: str):
     """Get detailed information about a project."""
     _init_imports()
-    _, _, get_project_path, _, _ = _get_registry_functions()
+    assert _check_spec_exists is not None  # guaranteed by _init_imports()
+    assert _get_project_prompts_dir is not None  # guaranteed by _init_imports()
+    (_, _, get_project_path, _, _, get_project_concurrency, _) = _get_registry_functions()
 
     name = validate_project_name(name)
     project_dir = get_project_path(name)
@@ -231,6 +253,7 @@ async def get_project(name: str):
         has_spec=has_spec,
         stats=stats,
         prompts_dir=str(prompts_dir),
+        default_concurrency=get_project_concurrency(name),
     )
 
 
@@ -244,7 +267,7 @@ async def delete_project(name: str, delete_files: bool = False):
         delete_files: If True, also delete the project directory and files
     """
     _init_imports()
-    _, unregister_project, get_project_path, _, _ = _get_registry_functions()
+    (_, unregister_project, get_project_path, _, _, _, _) = _get_registry_functions()
 
     name = validate_project_name(name)
     project_dir = get_project_path(name)
@@ -253,8 +276,8 @@ async def delete_project(name: str, delete_files: bool = False):
         raise HTTPException(status_code=404, detail=f"Project '{name}' not found")
 
     # Check if agent is running
-    lock_file = project_dir / ".agent.lock"
-    if lock_file.exists():
+    from autocoder_paths import has_agent_running
+    if has_agent_running(project_dir):
         raise HTTPException(
             status_code=409,
             detail="Cannot delete project while agent is running. Stop the agent first."
@@ -280,7 +303,8 @@ async def delete_project(name: str, delete_files: bool = False):
 async def get_project_prompts(name: str):
     """Get the content of project prompt files."""
     _init_imports()
-    _, _, get_project_path, _, _ = _get_registry_functions()
+    assert _get_project_prompts_dir is not None  # guaranteed by _init_imports()
+    (_, _, get_project_path, _, _, _, _) = _get_registry_functions()
 
     name = validate_project_name(name)
     project_dir = get_project_path(name)
@@ -291,7 +315,7 @@ async def get_project_prompts(name: str):
     if not project_dir.exists():
         raise HTTPException(status_code=404, detail="Project directory not found")
 
-    prompts_dir = _get_project_prompts_dir(project_dir)
+    prompts_dir: Path = _get_project_prompts_dir(project_dir)
 
     def read_file(filename: str) -> str:
         filepath = prompts_dir / filename
@@ -313,7 +337,8 @@ async def get_project_prompts(name: str):
 async def update_project_prompts(name: str, prompts: ProjectPromptsUpdate):
     """Update project prompt files."""
     _init_imports()
-    _, _, get_project_path, _, _ = _get_registry_functions()
+    assert _get_project_prompts_dir is not None  # guaranteed by _init_imports()
+    (_, _, get_project_path, _, _, _, _) = _get_registry_functions()
 
     name = validate_project_name(name)
     project_dir = get_project_path(name)
@@ -343,7 +368,7 @@ async def update_project_prompts(name: str, prompts: ProjectPromptsUpdate):
 async def get_project_stats_endpoint(name: str):
     """Get current progress statistics for a project."""
     _init_imports()
-    _, _, get_project_path, _, _ = _get_registry_functions()
+    (_, _, get_project_path, _, _, _, _) = _get_registry_functions()
 
     name = validate_project_name(name)
     project_dir = get_project_path(name)
@@ -355,3 +380,145 @@ async def get_project_stats_endpoint(name: str):
         raise HTTPException(status_code=404, detail="Project directory not found")
 
     return get_project_stats(project_dir)
+
+
+@router.post("/{name}/reset")
+async def reset_project(name: str, full_reset: bool = False):
+    """
+    Reset a project to its initial state.
+
+    Args:
+        name: Project name to reset
+        full_reset: If True, also delete prompts/ directory (triggers setup wizard)
+
+    Returns:
+        Dictionary with list of deleted files and reset type
+    """
+    _init_imports()
+    (_, _, get_project_path, _, _, _, _) = _get_registry_functions()
+
+    name = validate_project_name(name)
+    project_dir = get_project_path(name)
+
+    if not project_dir:
+        raise HTTPException(status_code=404, detail=f"Project '{name}' not found")
+
+    if not project_dir.exists():
+        raise HTTPException(status_code=404, detail="Project directory not found")
+
+    # Check if agent is running
+    from autocoder_paths import has_agent_running
+    if has_agent_running(project_dir):
+        raise HTTPException(
+            status_code=409,
+            detail="Cannot reset project while agent is running. Stop the agent first."
+        )
+
+    # Dispose of database engines to release file locks (required on Windows)
+    # Import here to avoid circular imports
+    from api.database import dispose_engine as dispose_features_engine
+    from server.services.assistant_database import dispose_engine as dispose_assistant_engine
+
+    dispose_features_engine(project_dir)
+    dispose_assistant_engine(project_dir)
+
+    deleted_files: list[str] = []
+
+    from autocoder_paths import (
+        get_assistant_db_path,
+        get_claude_assistant_settings_path,
+        get_claude_settings_path,
+        get_features_db_path,
+    )
+
+    # Build list of files to delete using path helpers (finds files at current location)
+    # Plus explicit old-location fallbacks for backward compatibility
+    db_path = get_features_db_path(project_dir)
+    asst_path = get_assistant_db_path(project_dir)
+    reset_files: list[Path] = [
+        db_path,
+        db_path.with_suffix(".db-wal"),
+        db_path.with_suffix(".db-shm"),
+        asst_path,
+        asst_path.with_suffix(".db-wal"),
+        asst_path.with_suffix(".db-shm"),
+        get_claude_settings_path(project_dir),
+        get_claude_assistant_settings_path(project_dir),
+        # Also clean old root-level locations if they exist
+        project_dir / "features.db",
+        project_dir / "features.db-wal",
+        project_dir / "features.db-shm",
+        project_dir / "assistant.db",
+        project_dir / "assistant.db-wal",
+        project_dir / "assistant.db-shm",
+        project_dir / ".claude_settings.json",
+        project_dir / ".claude_assistant_settings.json",
+    ]
+
+    for file_path in reset_files:
+        if file_path.exists():
+            try:
+                relative = file_path.relative_to(project_dir)
+                file_path.unlink()
+                deleted_files.append(str(relative))
+            except Exception as e:
+                raise HTTPException(status_code=500, detail=f"Failed to delete {file_path.name}: {e}")
+
+    # Full reset: also delete prompts directory
+    if full_reset:
+        from autocoder_paths import get_prompts_dir
+        # Delete prompts from both possible locations
+        for prompts_dir in [get_prompts_dir(project_dir), project_dir / "prompts"]:
+            if prompts_dir.exists():
+                try:
+                    relative = prompts_dir.relative_to(project_dir)
+                    shutil.rmtree(prompts_dir)
+                    deleted_files.append(f"{relative}/")
+                except Exception as e:
+                    raise HTTPException(status_code=500, detail=f"Failed to delete prompts: {e}")
+
+    return {
+        "success": True,
+        "reset_type": "full" if full_reset else "quick",
+        "deleted_files": deleted_files,
+        "message": f"Project '{name}' has been reset" + (" (full reset)" if full_reset else " (quick reset)")
+    }
+
+
+@router.patch("/{name}/settings", response_model=ProjectDetail)
+async def update_project_settings(name: str, settings: ProjectSettingsUpdate):
+    """Update project-level settings (concurrency, etc.)."""
+    _init_imports()
+    assert _check_spec_exists is not None  # guaranteed by _init_imports()
+    assert _get_project_prompts_dir is not None  # guaranteed by _init_imports()
+    (_, _, get_project_path, _, _, get_project_concurrency,
+     set_project_concurrency) = _get_registry_functions()
+
+    name = validate_project_name(name)
+    project_dir = get_project_path(name)
+
+    if not project_dir:
+        raise HTTPException(status_code=404, detail=f"Project '{name}' not found")
+
+    if not project_dir.exists():
+        raise HTTPException(status_code=404, detail="Project directory not found")
+
+    # Update concurrency if provided
+    if settings.default_concurrency is not None:
+        success = set_project_concurrency(name, settings.default_concurrency)
+        if not success:
+            raise HTTPException(status_code=500, detail="Failed to update concurrency")
+
+    # Return updated project details
+    has_spec = _check_spec_exists(project_dir)
+    stats = get_project_stats(project_dir)
+    prompts_dir = _get_project_prompts_dir(project_dir)
+
+    return ProjectDetail(
+        name=name,
+        path=project_dir.as_posix(),
+        has_spec=has_spec,
+        stats=stats,
+        prompts_dir=str(prompts_dir),
+        default_concurrency=get_project_concurrency(name),
+    )

server/routers/schedules.py

@@ -6,12 +6,10 @@ API endpoints for managing agent schedules.
 Provides CRUD operations for time-based schedule configuration.
 """
 
-import re
-import sys
 from contextlib import contextmanager
 from datetime import datetime, timedelta, timezone
 from pathlib import Path
-from typing import Generator, Tuple
+from typing import TYPE_CHECKING, Generator, Tuple
 
 from fastapi import APIRouter, HTTPException
 from sqlalchemy.orm import Session
@@ -26,17 +24,21 @@ from ..schemas import (
     ScheduleResponse,
     ScheduleUpdate,
 )
+from ..utils.project_helpers import get_project_path as _get_project_path
+from ..utils.validation import validate_project_name
+
+if TYPE_CHECKING:
+    from api.database import Schedule as ScheduleModel
 
 
-def _get_project_path(project_name: str) -> Path:
-    """Get project path from registry."""
-    root = Path(__file__).parent.parent.parent
-    if str(root) not in sys.path:
-        sys.path.insert(0, str(root))
-
-    from registry import get_project_path
-    return get_project_path(project_name)
+def _schedule_to_response(schedule: "ScheduleModel") -> ScheduleResponse:
+    """Convert a Schedule ORM object to a ScheduleResponse Pydantic model.
 
+    SQLAlchemy Column descriptors resolve to Python types at instance access time,
+    but mypy sees the Column[T] descriptor type. Using model_validate with
+    from_attributes handles this conversion correctly.
+    """
+    return ScheduleResponse.model_validate(schedule, from_attributes=True)
 
 router = APIRouter(
     prefix="/api/projects/{project_name}/schedules",
@@ -44,16 +46,6 @@ router = APIRouter(
 )
 
 
-def validate_project_name(name: str) -> str:
-    """Validate and sanitize project name to prevent path traversal."""
-    if not re.match(r'^[a-zA-Z0-9_-]{1,50}$', name):
-        raise HTTPException(
-            status_code=400,
-            detail="Invalid project name"
-        )
-    return name
-
-
 @contextmanager
 def _get_db_session(project_name: str) -> Generator[Tuple[Session, Path], None, None]:
     """Get database session for a project as a context manager.
@@ -84,6 +76,9 @@ def _get_db_session(project_name: str) -> Generator[Tuple[Session, Path], None,
     db = SessionLocal()
     try:
         yield db, project_path
+    except Exception:
+        db.rollback()
+        raise
     finally:
         db.close()
 
@@ -99,21 +94,7 @@ async def list_schedules(project_name: str):
         ).order_by(Schedule.start_time).all()
 
         return ScheduleListResponse(
-            schedules=[
-                ScheduleResponse(
-                    id=s.id,
-                    project_name=s.project_name,
-                    start_time=s.start_time,
-                    duration_minutes=s.duration_minutes,
-                    days_of_week=s.days_of_week,
-                    enabled=s.enabled,
-                    yolo_mode=s.yolo_mode,
-                    model=s.model,
-                    crash_count=s.crash_count,
-                    created_at=s.created_at,
-                )
-                for s in schedules
-            ]
+            schedules=[_schedule_to_response(s) for s in schedules]
         )
 
 
@@ -187,18 +168,7 @@ async def create_schedule(project_name: str, data: ScheduleCreate):
                     except Exception as e:
                         logger.error(f"Failed to start agent for schedule {schedule.id}: {e}", exc_info=True)
 
-        return ScheduleResponse(
-            id=schedule.id,
-            project_name=schedule.project_name,
-            start_time=schedule.start_time,
-            duration_minutes=schedule.duration_minutes,
-            days_of_week=schedule.days_of_week,
-            enabled=schedule.enabled,
-            yolo_mode=schedule.yolo_mode,
-            model=schedule.model,
-            crash_count=schedule.crash_count,
-            created_at=schedule.created_at,
-        )
+        return _schedule_to_response(schedule)
 
 
 @router.get("/next", response_model=NextRunResponse)
@@ -277,18 +247,7 @@ async def get_schedule(project_name: str, schedule_id: int):
         if not schedule:
             raise HTTPException(status_code=404, detail="Schedule not found")
 
-        return ScheduleResponse(
-            id=schedule.id,
-            project_name=schedule.project_name,
-            start_time=schedule.start_time,
-            duration_minutes=schedule.duration_minutes,
-            days_of_week=schedule.days_of_week,
-            enabled=schedule.enabled,
-            yolo_mode=schedule.yolo_mode,
-            model=schedule.model,
-            crash_count=schedule.crash_count,
-            created_at=schedule.created_at,
-        )
+        return _schedule_to_response(schedule)
 
 
 @router.patch("/{schedule_id}", response_model=ScheduleResponse)
@@ -331,18 +290,7 @@ async def update_schedule(
             # Was enabled, now disabled - remove jobs
             scheduler.remove_schedule(schedule_id)
 
-        return ScheduleResponse(
-            id=schedule.id,
-            project_name=schedule.project_name,
-            start_time=schedule.start_time,
-            duration_minutes=schedule.duration_minutes,
-            days_of_week=schedule.days_of_week,
-            enabled=schedule.enabled,
-            yolo_mode=schedule.yolo_mode,
-            model=schedule.model,
-            crash_count=schedule.crash_count,
-            created_at=schedule.created_at,
-        )
+        return _schedule_to_response(schedule)
 
 
 @router.delete("/{schedule_id}", status_code=204)

server/routers/settings.py

@@ -9,17 +9,16 @@ Settings are stored in the registry database and shared across all projects.
 import mimetypes
 import os
 import sys
-from pathlib import Path
 
 from fastapi import APIRouter
 
 from ..schemas import ModelInfo, ModelsResponse, SettingsResponse, SettingsUpdate
+from ..services.chat_constants import ROOT_DIR
 
 # Mimetype fix for Windows - must run before StaticFiles is mounted
 mimetypes.add_type("text/javascript", ".js", True)
 
-# Add root to path for registry import
-ROOT_DIR = Path(__file__).parent.parent.parent
+# Ensure root is on sys.path for registry import
 if str(ROOT_DIR) not in sys.path:
     sys.path.insert(0, str(ROOT_DIR))
 
@@ -40,7 +39,15 @@ def _parse_yolo_mode(value: str | None) -> bool:
 
 def _is_glm_mode() -> bool:
     """Check if GLM API is configured via environment variables."""
-    return bool(os.getenv("ANTHROPIC_BASE_URL"))
+    base_url = os.getenv("ANTHROPIC_BASE_URL", "")
+    # GLM mode is when ANTHROPIC_BASE_URL is set but NOT pointing to Ollama
+    return bool(base_url) and not _is_ollama_mode()
+
+
+def _is_ollama_mode() -> bool:
+    """Check if Ollama API is configured via environment variables."""
+    base_url = os.getenv("ANTHROPIC_BASE_URL", "")
+    return "localhost:11434" in base_url or "127.0.0.1:11434" in base_url
 
 
 @router.get("/models", response_model=ModelsResponse)
@@ -82,7 +89,10 @@ async def get_settings():
         yolo_mode=_parse_yolo_mode(all_settings.get("yolo_mode")),
         model=all_settings.get("model", DEFAULT_MODEL),
         glm_mode=_is_glm_mode(),
+        ollama_mode=_is_ollama_mode(),
         testing_agent_ratio=_parse_int(all_settings.get("testing_agent_ratio"), 1),
+        playwright_headless=_parse_bool(all_settings.get("playwright_headless"), default=True),
+        batch_size=_parse_int(all_settings.get("batch_size"), 3),
     )
 
 
@@ -98,11 +108,20 @@ async def update_settings(update: SettingsUpdate):
     if update.testing_agent_ratio is not None:
         set_setting("testing_agent_ratio", str(update.testing_agent_ratio))
 
+    if update.playwright_headless is not None:
+        set_setting("playwright_headless", "true" if update.playwright_headless else "false")
+
+    if update.batch_size is not None:
+        set_setting("batch_size", str(update.batch_size))
+
     # Return updated settings
     all_settings = get_all_settings()
     return SettingsResponse(
         yolo_mode=_parse_yolo_mode(all_settings.get("yolo_mode")),
         model=all_settings.get("model", DEFAULT_MODEL),
         glm_mode=_is_glm_mode(),
+        ollama_mode=_is_ollama_mode(),
         testing_agent_ratio=_parse_int(all_settings.get("testing_agent_ratio"), 1),
+        playwright_headless=_parse_bool(all_settings.get("playwright_headless"), default=True),
+        batch_size=_parse_int(all_settings.get("batch_size"), 3),
     )

server/routers/spec_creation.py

@@ -7,8 +7,6 @@ WebSocket and REST endpoints for interactive spec creation with Claude.
 
 import json
 import logging
-import re
-from pathlib import Path
 from typing import Optional
 
 from fastapi import APIRouter, HTTPException, WebSocket, WebSocketDisconnect
@@ -22,30 +20,13 @@ from ..services.spec_chat_session import (
     list_sessions,
     remove_session,
 )
+from ..utils.project_helpers import get_project_path as _get_project_path
+from ..utils.validation import is_valid_project_name as validate_project_name
 
 logger = logging.getLogger(__name__)
 
 router = APIRouter(prefix="/api/spec", tags=["spec-creation"])
 
-# Root directory
-ROOT_DIR = Path(__file__).parent.parent.parent
-
-
-def _get_project_path(project_name: str) -> Path:
-    """Get project path from registry."""
-    import sys
-    root = Path(__file__).parent.parent.parent
-    if str(root) not in sys.path:
-        sys.path.insert(0, str(root))
-
-    from registry import get_project_path
-    return get_project_path(project_name)
-
-
-def validate_project_name(name: str) -> bool:
-    """Validate project name to prevent path traversal."""
-    return bool(re.match(r'^[a-zA-Z0-9_-]{1,50}$', name))
-
 
 # ============================================================================
 # REST Endpoints
@@ -124,7 +105,8 @@ async def get_spec_file_status(project_name: str):
     if not project_dir.exists():
         raise HTTPException(status_code=404, detail="Project directory not found")
 
-    status_file = project_dir / "prompts" / ".spec_status.json"
+    from autocoder_paths import get_prompts_dir
+    status_file = get_prompts_dir(project_dir) / ".spec_status.json"
 
     if not status_file.exists():
         return SpecFileStatus(

server/routers/terminal.py

@@ -12,8 +12,6 @@ import base64
 import json
 import logging
 import re
-import sys
-from pathlib import Path
 
 from fastapi import APIRouter, HTTPException, WebSocket, WebSocketDisconnect
 from pydantic import BaseModel
@@ -27,13 +25,8 @@ from ..services.terminal_manager import (
     rename_terminal,
     stop_terminal_session,
 )
-
-# Add project root to path for registry import
-_root = Path(__file__).parent.parent.parent
-if str(_root) not in sys.path:
-    sys.path.insert(0, str(_root))
-
-from registry import get_project_path as registry_get_project_path
+from ..utils.project_helpers import get_project_path as _get_project_path
+from ..utils.validation import is_valid_project_name as validate_project_name
 
 logger = logging.getLogger(__name__)
 
@@ -48,27 +41,6 @@ class TerminalCloseCode:
     FAILED_TO_START = 4500
 
 
-def _get_project_path(project_name: str) -> Path | None:
-    """Get project path from registry."""
-    return registry_get_project_path(project_name)
-
-
-def validate_project_name(name: str) -> bool:
-    """
-    Validate project name to prevent path traversal attacks.
-
-    Allows only alphanumeric characters, underscores, and hyphens.
-    Maximum length of 50 characters.
-
-    Args:
-        name: The project name to validate
-
-    Returns:
-        True if valid, False otherwise
-    """
-    return bool(re.match(r"^[a-zA-Z0-9_-]{1,50}$", name))
-
-
 def validate_terminal_id(terminal_id: str) -> bool:
     """
     Validate terminal ID format.

server/schemas.py

@@ -45,6 +45,7 @@ class ProjectSummary(BaseModel):
     path: str
     has_spec: bool
     stats: ProjectStats
+    default_concurrency: int = 3
 
 
 class ProjectDetail(BaseModel):
@@ -54,6 +55,7 @@ class ProjectDetail(BaseModel):
     has_spec: bool
     stats: ProjectStats
     prompts_dir: str
+    default_concurrency: int = 3
 
 
 class ProjectPrompts(BaseModel):
@@ -70,6 +72,18 @@ class ProjectPromptsUpdate(BaseModel):
     coding_prompt: str | None = None
 
 
+class ProjectSettingsUpdate(BaseModel):
+    """Request schema for updating project-level settings."""
+    default_concurrency: int | None = None
+
+    @field_validator('default_concurrency')
+    @classmethod
+    def validate_concurrency(cls, v: int | None) -> int | None:
+        if v is not None and (v < 1 or v > 5):
+            raise ValueError("default_concurrency must be between 1 and 5")
+        return v
+
+
 # ============================================================================
 # Feature Schemas
 # ============================================================================
@@ -382,7 +396,10 @@ class SettingsResponse(BaseModel):
     yolo_mode: bool = False
     model: str = DEFAULT_MODEL
     glm_mode: bool = False  # True if GLM API is configured via .env
+    ollama_mode: bool = False  # True if Ollama API is configured via .env
     testing_agent_ratio: int = 1  # Regression testing agents (0-3)
+    playwright_headless: bool = True
+    batch_size: int = 3  # Features per coding agent batch (1-3)
 
 
 class ModelsResponse(BaseModel):
@@ -396,6 +413,8 @@ class SettingsUpdate(BaseModel):
     yolo_mode: bool | None = None
     model: str | None = None
     testing_agent_ratio: int | None = None  # 0-3
+    playwright_headless: bool | None = None
+    batch_size: int | None = None  # Features per agent batch (1-3)
 
     @field_validator('model')
     @classmethod
@@ -411,6 +430,13 @@ class SettingsUpdate(BaseModel):
             raise ValueError("testing_agent_ratio must be between 0 and 3")
         return v
 
+    @field_validator('batch_size')
+    @classmethod
+    def validate_batch_size(cls, v: int | None) -> int | None:
+        if v is not None and (v < 1 or v > 3):
+            raise ValueError("batch_size must be between 1 and 3")
+        return v
+
 
 # ============================================================================
 # Dev Server Schemas

server/services/assistant_chat_session.py

@@ -25,25 +25,13 @@ from .assistant_database import (
     create_conversation,
     get_messages,
 )
+from .chat_constants import API_ENV_VARS, ROOT_DIR
 
 # Load environment variables from .env file if present
 load_dotenv()
 
 logger = logging.getLogger(__name__)
 
-# Root directory of the project
-ROOT_DIR = Path(__file__).parent.parent.parent
-
-# Environment variables to pass through to Claude CLI for API configuration
-API_ENV_VARS = [
-    "ANTHROPIC_BASE_URL",
-    "ANTHROPIC_AUTH_TOKEN",
-    "API_TIMEOUT_MS",
-    "ANTHROPIC_DEFAULT_SONNET_MODEL",
-    "ANTHROPIC_DEFAULT_OPUS_MODEL",
-    "ANTHROPIC_DEFAULT_HAIKU_MODEL",
-]
-
 # Read-only feature MCP tools
 READONLY_FEATURE_MCP_TOOLS = [
     "mcp__features__feature_get_stats",
@@ -76,7 +64,8 @@ def get_system_prompt(project_name: str, project_dir: Path) -> str:
     """Generate the system prompt for the assistant with project context."""
     # Try to load app_spec.txt for context
     app_spec_content = ""
-    app_spec_path = project_dir / "prompts" / "app_spec.txt"
+    from autocoder_paths import get_prompts_dir
+    app_spec_path = get_prompts_dir(project_dir) / "app_spec.txt"
     if app_spec_path.exists():
         try:
             app_spec_content = app_spec_path.read_text(encoding="utf-8")
@@ -90,6 +79,8 @@ def get_system_prompt(project_name: str, project_dir: Path) -> str:
 
 Your role is to help users understand the codebase, answer questions about features, and manage the project backlog. You can READ files and CREATE/MANAGE features, but you cannot modify source code.
 
+You have MCP tools available for feature management. Use them directly by calling the tool -- do not suggest CLI commands, bash commands, or curl commands to the user. You can create features yourself using the feature_create and feature_create_bulk tools.
+
 ## What You CAN Do
 
 **Codebase Analysis (Read-Only):**
@@ -134,17 +125,21 @@ If the user asks you to modify code, explain that you're a project assistant and
 
 ## Creating Features
 
-When a user asks to add a feature, gather the following information:
-1. **Category**: A grouping like "Authentication", "API", "UI", "Database"
-2. **Name**: A concise, descriptive name
-3. **Description**: What the feature should do
-4. **Steps**: How to verify/implement the feature (as a list)
+When a user asks to add a feature, use the `feature_create` or `feature_create_bulk` MCP tools directly:
+
+For a **single feature**, call `feature_create` with:
+- category: A grouping like "Authentication", "API", "UI", "Database"
+- name: A concise, descriptive name
+- description: What the feature should do
+- steps: List of verification/implementation steps
+
+For **multiple features**, call `feature_create_bulk` with an array of feature objects.
 
 You can ask clarifying questions if the user's request is vague, or make reasonable assumptions for simple requests.
 
 **Example interaction:**
 User: "Add a feature for S3 sync"
-You: I'll create that feature. Let me add it to the backlog...
+You: I'll create that feature now.
 [calls feature_create with appropriate parameters]
 You: Done! I've added "S3 Sync Integration" to your backlog. It's now visible on the kanban board.
 
@@ -208,7 +203,7 @@ class AssistantChatSession:
         # Create a new conversation if we don't have one
         if is_new_conversation:
             conv = create_conversation(self.project_dir, self.project_name)
-            self.conversation_id = conv.id
+            self.conversation_id = int(conv.id)  # type coercion: Column[int] -> int
             yield {"type": "conversation_created", "conversation_id": self.conversation_id}
 
         # Build permissions list for assistant access (read + feature management)
@@ -229,7 +224,9 @@ class AssistantChatSession:
                 "allow": permissions_list,
             },
         }
-        settings_file = self.project_dir / ".claude_assistant_settings.json"
+        from autocoder_paths import get_claude_assistant_settings_path
+        settings_file = get_claude_assistant_settings_path(self.project_dir)
+        settings_file.parent.mkdir(parents=True, exist_ok=True)
         with open(settings_file, "w") as f:
             json.dump(security_settings, f, indent=2)
 
@@ -261,7 +258,11 @@ class AssistantChatSession:
         system_cli = shutil.which("claude")
 
         # Build environment overrides for API configuration
-        sdk_env = {var: os.getenv(var) for var in API_ENV_VARS if os.getenv(var)}
+        sdk_env: dict[str, str] = {}
+        for var in API_ENV_VARS:
+            value = os.getenv(var)
+            if value:
+                sdk_env[var] = value
 
         # Determine model from environment or use default
         # This allows using alternative APIs (e.g., GLM via z.ai) that may not support Claude model names
@@ -277,7 +278,7 @@ class AssistantChatSession:
                     # This avoids Windows command line length limit (~8191 chars)
                     setting_sources=["project"],
                     allowed_tools=[*READONLY_BUILTIN_TOOLS, *ASSISTANT_FEATURE_TOOLS],
-                    mcp_servers=mcp_servers,
+                    mcp_servers=mcp_servers,  # type: ignore[arg-type]  # SDK accepts dict config at runtime
                     permission_mode="bypassPermissions",
                     max_turns=100,
                     cwd=str(self.project_dir.resolve()),
@@ -303,6 +304,8 @@ class AssistantChatSession:
                 greeting = f"Hello! I'm your project assistant for **{self.project_name}**. I can help you understand the codebase, explain features, and answer questions about the project. What would you like to know?"
 
                 # Store the greeting in the database
+                # conversation_id is guaranteed non-None here (set on line 206 above)
+                assert self.conversation_id is not None
                 add_message(self.project_dir, self.conversation_id, "assistant", greeting)
 
                 yield {"type": "text", "content": greeting}

server/services/assistant_database.py

@@ -7,20 +7,28 @@ Each project has its own assistant.db file in the project directory.
 """
 
 import logging
+import threading
 from datetime import datetime, timezone
 from pathlib import Path
 from typing import Optional
 
 from sqlalchemy import Column, DateTime, ForeignKey, Integer, String, Text, create_engine, func
-from sqlalchemy.orm import declarative_base, relationship, sessionmaker
+from sqlalchemy.engine import Engine
+from sqlalchemy.orm import DeclarativeBase, relationship, sessionmaker
 
 logger = logging.getLogger(__name__)
 
-Base = declarative_base()
+class Base(DeclarativeBase):
+    """SQLAlchemy 2.0 style declarative base."""
+    pass
 
 # Engine cache to avoid creating new engines for each request
 # Key: project directory path (as posix string), Value: SQLAlchemy engine
-_engine_cache: dict[str, object] = {}
+_engine_cache: dict[str, Engine] = {}
+
+# Lock for thread-safe access to the engine cache
+# Prevents race conditions when multiple threads create engines simultaneously
+_cache_lock = threading.Lock()
 
 
 def _utc_now() -> datetime:
@@ -56,7 +64,8 @@ class ConversationMessage(Base):
 
 def get_db_path(project_dir: Path) -> Path:
     """Get the path to the assistant database for a project."""
-    return project_dir / "assistant.db"
+    from autocoder_paths import get_assistant_db_path
+    return get_assistant_db_path(project_dir)
 
 
 def get_engine(project_dir: Path):
@@ -64,21 +73,57 @@ def get_engine(project_dir: Path):
 
     Uses a cache to avoid creating new engines for each request, which improves
     performance by reusing database connections.
+
+    Thread-safe: Uses a lock to prevent race conditions when multiple threads
+    try to create engines simultaneously for the same project.
     """
     cache_key = project_dir.as_posix()
 
-    if cache_key not in _engine_cache:
-        db_path = get_db_path(project_dir)
-        # Use as_posix() for cross-platform compatibility with SQLite connection strings
-        db_url = f"sqlite:///{db_path.as_posix()}"
-        engine = create_engine(db_url, echo=False)
-        Base.metadata.create_all(engine)
-        _engine_cache[cache_key] = engine
-        logger.debug(f"Created new database engine for {cache_key}")
+    # Double-checked locking for thread safety and performance
+    if cache_key in _engine_cache:
+        return _engine_cache[cache_key]
+
+    with _cache_lock:
+        # Check again inside the lock in case another thread created it
+        if cache_key not in _engine_cache:
+            db_path = get_db_path(project_dir)
+            # Use as_posix() for cross-platform compatibility with SQLite connection strings
+            db_url = f"sqlite:///{db_path.as_posix()}"
+            engine = create_engine(
+                db_url,
+                echo=False,
+                connect_args={
+                    "check_same_thread": False,
+                    "timeout": 30,  # Wait up to 30s for locks
+                }
+            )
+            Base.metadata.create_all(engine)
+            _engine_cache[cache_key] = engine
+            logger.debug(f"Created new database engine for {cache_key}")
 
     return _engine_cache[cache_key]
 
 
+def dispose_engine(project_dir: Path) -> bool:
+    """Dispose of and remove the cached engine for a project.
+
+    This closes all database connections, releasing file locks on Windows.
+    Should be called before deleting the database file.
+
+    Returns:
+        True if an engine was disposed, False if no engine was cached.
+    """
+    cache_key = project_dir.as_posix()
+
+    if cache_key in _engine_cache:
+        engine = _engine_cache.pop(cache_key)
+        engine.dispose()
+        logger.debug(f"Disposed database engine for {cache_key}")
+        return True
+
+    return False
+
+
 def get_session(project_dir: Path):
     """Get a new database session for a project."""
     engine = get_engine(project_dir)

server/services/chat_constants.py

@@ -0,0 +1,57 @@
+"""
+Chat Session Constants
+======================
+
+Shared constants for all chat session types (assistant, spec, expand).
+
+The canonical ``API_ENV_VARS`` list lives in ``env_constants.py`` at the
+project root and is re-exported here for convenience so that existing
+imports (``from .chat_constants import API_ENV_VARS``) continue to work.
+"""
+
+import sys
+from pathlib import Path
+from typing import AsyncGenerator
+
+# -------------------------------------------------------------------
+# Root directory of the autocoder project (repository root).
+# Used throughout the server package whenever the repo root is needed.
+# -------------------------------------------------------------------
+ROOT_DIR = Path(__file__).parent.parent.parent
+
+# Ensure the project root is on sys.path so we can import env_constants
+# from the root-level module without requiring a package install.
+_root_str = str(ROOT_DIR)
+if _root_str not in sys.path:
+    sys.path.insert(0, _root_str)
+
+# -------------------------------------------------------------------
+# Environment variables forwarded to Claude CLI subprocesses.
+# Single source of truth lives in env_constants.py at the project root.
+# Re-exported here so existing ``from .chat_constants import API_ENV_VARS``
+# imports continue to work unchanged.
+# -------------------------------------------------------------------
+from env_constants import API_ENV_VARS  # noqa: E402, F401
+
+
+async def make_multimodal_message(content_blocks: list[dict]) -> AsyncGenerator[dict, None]:
+    """Yield a single multimodal user message in Claude Agent SDK format.
+
+    The Claude Agent SDK's ``query()`` method accepts either a plain string
+    or an ``AsyncIterable[dict]`` for custom message formats.  This helper
+    wraps a list of content blocks (text and/or images) in the expected
+    envelope.
+
+    Args:
+        content_blocks: List of content-block dicts, e.g.
+            ``[{"type": "text", "text": "..."}, {"type": "image", ...}]``.
+
+    Yields:
+        A single dict representing the user message.
+    """
+    yield {
+        "type": "user",
+        "message": {"role": "user", "content": content_blocks},
+        "parent_tool_use_id": None,
+        "session_id": "default",
+    }

server/services/dev_server_manager.py

@@ -24,6 +24,7 @@ from typing import Awaitable, Callable, Literal, Set
 import psutil
 
 from registry import list_registered_projects
+from security import extract_commands, get_effective_commands, is_command_allowed
 from server.utils.process_utils import kill_process_tree
 
 logger = logging.getLogger(__name__)
@@ -114,7 +115,8 @@ class DevServerProcessManager:
         self._callbacks_lock = threading.Lock()
 
         # Lock file to prevent multiple instances (stored in project directory)
-        self.lock_file = self.project_dir / ".devserver.lock"
+        from autocoder_paths import get_devserver_lock_path
+        self.lock_file = get_devserver_lock_path(self.project_dir)
 
     @property
     def status(self) -> Literal["stopped", "running", "crashed"]:
@@ -304,6 +306,20 @@ class DevServerProcessManager:
         if not self.project_dir.exists():
             return False, f"Project directory does not exist: {self.project_dir}"
 
+        # Defense-in-depth: validate command against security allowlist
+        commands = extract_commands(command)
+        if not commands:
+            return False, "Could not parse command for security validation"
+
+        allowed_commands, blocked_commands = get_effective_commands(self.project_dir)
+        for cmd in commands:
+            if cmd in blocked_commands:
+                logger.warning("Blocked dev server command '%s' (in blocklist) for %s", cmd, self.project_name)
+                return False, f"Command '{cmd}' is blocked and cannot be used as a dev server command"
+            if not is_command_allowed(cmd, allowed_commands):
+                logger.warning("Rejected dev server command '%s' (not in allowlist) for %s", cmd, self.project_name)
+                return False, f"Command '{cmd}' is not in the allowed commands list"
+
         self._command = command
         self._detected_url = None  # Reset URL detection
 
@@ -428,7 +444,9 @@ class DevServerProcessManager:
 
 
 # Global registry of dev server managers per project with thread safety
-_managers: dict[str, DevServerProcessManager] = {}
+# Key is (project_name, resolved_project_dir) to prevent cross-project contamination
+# when different projects share the same name but have different paths
+_managers: dict[tuple[str, str], DevServerProcessManager] = {}
 _managers_lock = threading.Lock()
 
 
@@ -444,18 +462,11 @@ def get_devserver_manager(project_name: str, project_dir: Path) -> DevServerProc
         DevServerProcessManager instance for the project
     """
     with _managers_lock:
-        if project_name in _managers:
-            manager = _managers[project_name]
-            # Update project_dir in case project was moved
-            if manager.project_dir.resolve() != project_dir.resolve():
-                logger.info(
-                    f"Project {project_name} path updated: {manager.project_dir} -> {project_dir}"
-                )
-                manager.project_dir = project_dir
-                manager.lock_file = project_dir / ".devserver.lock"
-            return manager
-        _managers[project_name] = DevServerProcessManager(project_name, project_dir)
-        return _managers[project_name]
+        # Use composite key to prevent cross-project UI contamination (#71)
+        key = (project_name, str(project_dir.resolve()))
+        if key not in _managers:
+            _managers[key] = DevServerProcessManager(project_name, project_dir)
+        return _managers[key]
 
 
 async def cleanup_all_devservers() -> None:
@@ -492,8 +503,18 @@ def cleanup_orphaned_devserver_locks() -> int:
             if not project_path.exists():
                 continue
 
-            lock_file = project_path / ".devserver.lock"
-            if not lock_file.exists():
+            # Check both legacy and new locations for lock files
+            from autocoder_paths import get_autocoder_dir
+            lock_locations = [
+                project_path / ".devserver.lock",
+                get_autocoder_dir(project_path) / ".devserver.lock",
+            ]
+            lock_file = None
+            for candidate in lock_locations:
+                if candidate.exists():
+                    lock_file = candidate
+                    break
+            if lock_file is None:
                 continue
 
             try:

server/services/expand_chat_session.py

@@ -10,60 +10,41 @@ import asyncio
 import json
 import logging
 import os
-import re
 import shutil
+import sys
 import threading
 import uuid
 from datetime import datetime
 from pathlib import Path
-from typing import AsyncGenerator, Optional
+from typing import Any, AsyncGenerator, Optional
 
 from claude_agent_sdk import ClaudeAgentOptions, ClaudeSDKClient
 from dotenv import load_dotenv
 
 from ..schemas import ImageAttachment
+from .chat_constants import API_ENV_VARS, ROOT_DIR, make_multimodal_message
 
 # Load environment variables from .env file if present
 load_dotenv()
 
 logger = logging.getLogger(__name__)
 
-# Environment variables to pass through to Claude CLI for API configuration
-API_ENV_VARS = [
-    "ANTHROPIC_BASE_URL",
-    "ANTHROPIC_AUTH_TOKEN",
-    "API_TIMEOUT_MS",
-    "ANTHROPIC_DEFAULT_SONNET_MODEL",
-    "ANTHROPIC_DEFAULT_OPUS_MODEL",
-    "ANTHROPIC_DEFAULT_HAIKU_MODEL",
+# Feature MCP tools needed for expand session
+EXPAND_FEATURE_TOOLS = [
+    "mcp__features__feature_create",
+    "mcp__features__feature_create_bulk",
+    "mcp__features__feature_get_stats",
 ]
 
 
-async def _make_multimodal_message(content_blocks: list[dict]) -> AsyncGenerator[dict, None]:
-    """
-    Create an async generator that yields a properly formatted multimodal message.
-    """
-    yield {
-        "type": "user",
-        "message": {"role": "user", "content": content_blocks},
-        "parent_tool_use_id": None,
-        "session_id": "default",
-    }
-
-
-# Root directory of the project
-ROOT_DIR = Path(__file__).parent.parent.parent
-
-
 class ExpandChatSession:
     """
     Manages a project expansion conversation.
 
     Unlike SpecChatSession which writes spec files, this session:
     1. Reads existing app_spec.txt for context
-    2. Parses feature definitions from Claude's output
-    3. Creates features via REST API
-    4. Tracks which features were created during the session
+    2. Chats with the user to define new features
+    3. Claude creates features via the feature_create_bulk MCP tool
     """
 
     def __init__(self, project_name: str, project_dir: Path):
@@ -122,7 +103,8 @@ class ExpandChatSession:
             return
 
         # Verify project has existing spec
-        spec_path = self.project_dir / "prompts" / "app_spec.txt"
+        from autocoder_paths import get_prompts_dir
+        spec_path = get_prompts_dir(self.project_dir) / "app_spec.txt"
         if not spec_path.exists():
             yield {
                 "type": "error",
@@ -145,17 +127,24 @@ class ExpandChatSession:
             return
 
         # Create temporary security settings file (unique per session to avoid conflicts)
+        # Note: permission_mode="bypassPermissions" is safe here because:
+        # 1. Only Read/Glob file tools are allowed (no Write/Edit)
+        # 2. MCP tools are restricted to feature creation only
+        # 3. No Bash access - cannot execute arbitrary commands
         security_settings = {
             "sandbox": {"enabled": True},
             "permissions": {
-                "defaultMode": "acceptEdits",
+                "defaultMode": "bypassPermissions",
                 "allow": [
                     "Read(./**)",
                     "Glob(./**)",
+                    *EXPAND_FEATURE_TOOLS,
                 ],
             },
         }
-        settings_file = self.project_dir / f".claude_settings.expand.{uuid.uuid4().hex}.json"
+        from autocoder_paths import get_expand_settings_path
+        settings_file = get_expand_settings_path(self.project_dir, uuid.uuid4().hex)
+        settings_file.parent.mkdir(parents=True, exist_ok=True)
         self._settings_file = settings_file
         with open(settings_file, "w", encoding="utf-8") as f:
             json.dump(security_settings, f, indent=2)
@@ -165,12 +154,29 @@ class ExpandChatSession:
         system_prompt = skill_content.replace("$ARGUMENTS", project_path)
 
         # Build environment overrides for API configuration
-        sdk_env = {var: os.getenv(var) for var in API_ENV_VARS if os.getenv(var)}
+        # Filter to only include vars that are actually set (non-None)
+        sdk_env: dict[str, str] = {}
+        for var in API_ENV_VARS:
+            value = os.getenv(var)
+            if value:
+                sdk_env[var] = value
 
         # Determine model from environment or use default
         # This allows using alternative APIs (e.g., GLM via z.ai) that may not support Claude model names
         model = os.getenv("ANTHROPIC_DEFAULT_OPUS_MODEL", "claude-opus-4-5-20251101")
 
+        # Build MCP servers config for feature creation
+        mcp_servers = {
+            "features": {
+                "command": sys.executable,
+                "args": ["-m", "mcp_server.feature_mcp"],
+                "env": {
+                    "PROJECT_DIR": str(self.project_dir.resolve()),
+                    "PYTHONPATH": str(ROOT_DIR.resolve()),
+                },
+            },
+        }
+
         # Create Claude SDK client
         try:
             self.client = ClaudeSDKClient(
@@ -181,8 +187,13 @@ class ExpandChatSession:
                     allowed_tools=[
                         "Read",
                         "Glob",
+                        "Grep",
+                        "WebFetch",
+                        "WebSearch",
+                        *EXPAND_FEATURE_TOOLS,
                     ],
-                    permission_mode="acceptEdits",
+                    mcp_servers=mcp_servers,  # type: ignore[arg-type]  # SDK accepts dict config at runtime
+                    permission_mode="bypassPermissions",
                     max_turns=100,
                     cwd=str(self.project_dir.resolve()),
                     settings=str(settings_file.resolve()),
@@ -267,14 +278,15 @@ class ExpandChatSession:
         """
         Internal method to query Claude and stream responses.
 
-        Handles text responses and detects feature creation blocks.
+        Feature creation is handled by Claude calling the feature_create_bulk
+        MCP tool directly -- no text parsing needed.
         """
         if not self.client:
             return
 
         # Build the message content
         if attachments and len(attachments) > 0:
-            content_blocks = []
+            content_blocks: list[dict[str, Any]] = []
             if message:
                 content_blocks.append({"type": "text", "text": message})
             for att in attachments:
@@ -286,14 +298,11 @@ class ExpandChatSession:
                         "data": att.base64Data,
                     }
                 })
-            await self.client.query(_make_multimodal_message(content_blocks))
+            await self.client.query(make_multimodal_message(content_blocks))
             logger.info(f"Sent multimodal message with {len(attachments)} image(s)")
         else:
             await self.client.query(message)
 
-        # Accumulate full response to detect feature blocks
-        full_response = ""
-
         # Stream the response
         async for msg in self.client.receive_response():
             msg_type = type(msg).__name__
@@ -305,7 +314,6 @@ class ExpandChatSession:
                     if block_type == "TextBlock" and hasattr(block, "text"):
                         text = block.text
                         if text:
-                            full_response += text
                             yield {"type": "text", "content": text}
 
                             self.messages.append({
@@ -314,123 +322,6 @@ class ExpandChatSession:
                                 "timestamp": datetime.now().isoformat()
                             })
 
-        # Check for feature creation blocks in full response (handle multiple blocks)
-        features_matches = re.findall(
-            r'<features_to_create>\s*(\[[\s\S]*?\])\s*</features_to_create>',
-            full_response
-        )
-
-        if features_matches:
-            # Collect all features from all blocks, deduplicating by name
-            all_features: list[dict] = []
-            seen_names: set[str] = set()
-
-            for features_json in features_matches:
-                try:
-                    features_data = json.loads(features_json)
-
-                    if features_data and isinstance(features_data, list):
-                        for feature in features_data:
-                            name = feature.get("name", "")
-                            if name and name not in seen_names:
-                                seen_names.add(name)
-                                all_features.append(feature)
-                except json.JSONDecodeError as e:
-                    logger.error(f"Failed to parse features JSON block: {e}")
-                    # Continue processing other blocks
-
-            if all_features:
-                try:
-                    # Create all deduplicated features
-                    created = await self._create_features_bulk(all_features)
-
-                    if created:
-                        self.features_created += len(created)
-                        self.created_feature_ids.extend([f["id"] for f in created])
-
-                        yield {
-                            "type": "features_created",
-                            "count": len(created),
-                            "features": created
-                        }
-
-                        logger.info(f"Created {len(created)} features for {self.project_name}")
-                except Exception:
-                    logger.exception("Failed to create features")
-                    yield {
-                        "type": "error",
-                        "content": "Failed to create features"
-                    }
-
-    async def _create_features_bulk(self, features: list[dict]) -> list[dict]:
-        """
-        Create features directly in the database.
-
-        Args:
-            features: List of feature dictionaries with category, name, description, steps
-
-        Returns:
-            List of created feature dictionaries with IDs
-
-        Note:
-            Uses flush() to get IDs immediately without re-querying by priority range,
-            which could pick up rows from concurrent writers.
-        """
-        # Import database classes
-        import sys
-        root = Path(__file__).parent.parent.parent
-        if str(root) not in sys.path:
-            sys.path.insert(0, str(root))
-
-        from api.database import Feature, create_database
-
-        # Get database session
-        _, SessionLocal = create_database(self.project_dir)
-        session = SessionLocal()
-
-        try:
-            # Determine starting priority
-            max_priority_feature = session.query(Feature).order_by(Feature.priority.desc()).first()
-            current_priority = (max_priority_feature.priority + 1) if max_priority_feature else 1
-
-            created_rows: list = []
-
-            for f in features:
-                db_feature = Feature(
-                    priority=current_priority,
-                    category=f.get("category", "functional"),
-                    name=f.get("name", "Unnamed feature"),
-                    description=f.get("description", ""),
-                    steps=f.get("steps", []),
-                    passes=False,
-                    in_progress=False,
-                )
-                session.add(db_feature)
-                created_rows.append(db_feature)
-                current_priority += 1
-
-            # Flush to get IDs without relying on priority range query
-            session.flush()
-
-            # Build result from the flushed objects (IDs are now populated)
-            created_features = [
-                {
-                    "id": db_feature.id,
-                    "name": db_feature.name,
-                    "category": db_feature.category,
-                }
-                for db_feature in created_rows
-            ]
-
-            session.commit()
-            return created_features
-
-        except Exception:
-            session.rollback()
-            raise
-        finally:
-            session.close()
-
     def get_features_created(self) -> int:
         """Get the total number of features created in this session."""
         return self.features_created

server/services/process_manager.py

@@ -15,7 +15,7 @@ import sys
 import threading
 from datetime import datetime
 from pathlib import Path
-from typing import Awaitable, Callable, Literal, Set
+from typing import Any, Awaitable, Callable, Literal, Set
 
 import psutil
 
@@ -92,7 +92,8 @@ class AgentProcessManager:
         self._callbacks_lock = threading.Lock()
 
         # Lock file to prevent multiple instances (stored in project directory)
-        self.lock_file = self.project_dir / ".agent.lock"
+        from autocoder_paths import get_agent_lock_path
+        self.lock_file = get_agent_lock_path(self.project_dir)
 
     @property
     def status(self) -> Literal["stopped", "running", "paused", "crashed"]:
@@ -296,6 +297,8 @@ class AgentProcessManager:
         parallel_mode: bool = False,
         max_concurrency: int | None = None,
         testing_agent_ratio: int = 1,
+        playwright_headless: bool = True,
+        batch_size: int = 3,
     ) -> tuple[bool, str]:
         """
         Start the agent as a subprocess.
@@ -306,6 +309,7 @@ class AgentProcessManager:
             parallel_mode: DEPRECATED - ignored, always uses unified orchestrator
             max_concurrency: Max concurrent coding agents (1-5, default 1)
             testing_agent_ratio: Number of regression testing agents (0-3, default 1)
+            playwright_headless: If True, run browser in headless mode
 
         Returns:
             Tuple of (success, message)
@@ -346,17 +350,26 @@ class AgentProcessManager:
         # Add testing agent configuration
         cmd.extend(["--testing-ratio", str(testing_agent_ratio)])
 
+        # Add --batch-size flag for multi-feature batching
+        cmd.extend(["--batch-size", str(batch_size)])
+
         try:
             # Start subprocess with piped stdout/stderr
             # Use project_dir as cwd so Claude SDK sandbox allows access to project files
-            # IMPORTANT: Set PYTHONUNBUFFERED to ensure output isn't delayed
-            self.process = subprocess.Popen(
-                cmd,
-                stdout=subprocess.PIPE,
-                stderr=subprocess.STDOUT,
-                cwd=str(self.project_dir),
-                env={**os.environ, "PYTHONUNBUFFERED": "1"},
-            )
+            # stdin=DEVNULL prevents blocking if Claude CLI or child process tries to read stdin
+            # CREATE_NO_WINDOW on Windows prevents console window pop-ups
+            # PYTHONUNBUFFERED ensures output isn't delayed
+            popen_kwargs: dict[str, Any] = {
+                "stdin": subprocess.DEVNULL,
+                "stdout": subprocess.PIPE,
+                "stderr": subprocess.STDOUT,
+                "cwd": str(self.project_dir),
+                "env": {**os.environ, "PYTHONUNBUFFERED": "1", "PLAYWRIGHT_HEADLESS": "true" if playwright_headless else "false"},
+            }
+            if sys.platform == "win32":
+                popen_kwargs["creationflags"] = subprocess.CREATE_NO_WINDOW
+
+            self.process = subprocess.Popen(cmd, **popen_kwargs)
 
             # Atomic lock creation - if it fails, another process beat us
             if not self._create_lock():
@@ -510,7 +523,9 @@ class AgentProcessManager:
 
 
 # Global registry of process managers per project with thread safety
-_managers: dict[str, AgentProcessManager] = {}
+# Key is (project_name, resolved_project_dir) to prevent cross-project contamination
+# when different projects share the same name but have different paths
+_managers: dict[tuple[str, str], AgentProcessManager] = {}
 _managers_lock = threading.Lock()
 
 
@@ -523,9 +538,11 @@ def get_manager(project_name: str, project_dir: Path, root_dir: Path) -> AgentPr
         root_dir: Root directory of the autonomous-coding-ui project
     """
     with _managers_lock:
-        if project_name not in _managers:
-            _managers[project_name] = AgentProcessManager(project_name, project_dir, root_dir)
-        return _managers[project_name]
+        # Use composite key to prevent cross-project UI contamination (#71)
+        key = (project_name, str(project_dir.resolve()))
+        if key not in _managers:
+            _managers[key] = AgentProcessManager(project_name, project_dir, root_dir)
+        return _managers[key]
 
 
 async def cleanup_all_managers() -> None:
@@ -569,8 +586,18 @@ def cleanup_orphaned_locks() -> int:
             if not project_path.exists():
                 continue
 
-            lock_file = project_path / ".agent.lock"
-            if not lock_file.exists():
+            # Check both legacy and new locations for lock files
+            from autocoder_paths import get_autocoder_dir
+            lock_locations = [
+                project_path / ".agent.lock",
+                get_autocoder_dir(project_path) / ".agent.lock",
+            ]
+            lock_file = None
+            for candidate in lock_locations:
+                if candidate.exists():
+                    lock_file = candidate
+                    break
+            if lock_file is None:
                 continue
 
             try:

server/services/scheduler_service.py

@@ -92,8 +92,9 @@ class SchedulerService:
     async def _load_project_schedules(self, project_name: str, project_dir: Path) -> int:
         """Load schedules for a single project. Returns count of schedules loaded."""
         from api.database import Schedule, create_database
+        from autocoder_paths import get_features_db_path
 
-        db_path = project_dir / "features.db"
+        db_path = get_features_db_path(project_dir)
         if not db_path.exists():
             return 0
 
@@ -567,8 +568,9 @@ class SchedulerService:
     ):
         """Check if a project should be started on server startup."""
         from api.database import Schedule, ScheduleOverride, create_database
+        from autocoder_paths import get_features_db_path
 
-        db_path = project_dir / "features.db"
+        db_path = get_features_db_path(project_dir)
         if not db_path.exists():
             return
 

server/services/spec_chat_session.py

@@ -13,49 +13,19 @@ import shutil
 import threading
 from datetime import datetime
 from pathlib import Path
-from typing import AsyncGenerator, Optional
+from typing import Any, AsyncGenerator, Optional
 
 from claude_agent_sdk import ClaudeAgentOptions, ClaudeSDKClient
 from dotenv import load_dotenv
 
 from ..schemas import ImageAttachment
+from .chat_constants import API_ENV_VARS, ROOT_DIR, make_multimodal_message
 
 # Load environment variables from .env file if present
 load_dotenv()
 
 logger = logging.getLogger(__name__)
 
-# Environment variables to pass through to Claude CLI for API configuration
-API_ENV_VARS = [
-    "ANTHROPIC_BASE_URL",
-    "ANTHROPIC_AUTH_TOKEN",
-    "API_TIMEOUT_MS",
-    "ANTHROPIC_DEFAULT_SONNET_MODEL",
-    "ANTHROPIC_DEFAULT_OPUS_MODEL",
-    "ANTHROPIC_DEFAULT_HAIKU_MODEL",
-]
-
-
-async def _make_multimodal_message(content_blocks: list[dict]) -> AsyncGenerator[dict, None]:
-    """
-    Create an async generator that yields a properly formatted multimodal message.
-
-    The Claude Agent SDK's query() method accepts either:
-    - A string (simple text)
-    - An AsyncIterable[dict] (for custom message formats)
-
-    This function wraps content blocks in the expected message format.
-    """
-    yield {
-        "type": "user",
-        "message": {"role": "user", "content": content_blocks},
-        "parent_tool_use_id": None,
-        "session_id": "default",
-    }
-
-# Root directory of the project
-ROOT_DIR = Path(__file__).parent.parent.parent
-
 
 class SpecChatSession:
     """
@@ -125,7 +95,8 @@ class SpecChatSession:
         # Delete app_spec.txt so Claude can create it fresh
         # The SDK requires reading existing files before writing, but app_spec.txt is created new
         # Note: We keep initializer_prompt.md so Claude can read and update the template
-        prompts_dir = self.project_dir / "prompts"
+        from autocoder_paths import get_prompts_dir
+        prompts_dir = get_prompts_dir(self.project_dir)
         app_spec_path = prompts_dir / "app_spec.txt"
         if app_spec_path.exists():
             app_spec_path.unlink()
@@ -145,7 +116,9 @@ class SpecChatSession:
                 ],
             },
         }
-        settings_file = self.project_dir / ".claude_settings.json"
+        from autocoder_paths import get_claude_settings_path
+        settings_file = get_claude_settings_path(self.project_dir)
+        settings_file.parent.mkdir(parents=True, exist_ok=True)
         with open(settings_file, "w") as f:
             json.dump(security_settings, f, indent=2)
 
@@ -167,7 +140,12 @@ class SpecChatSession:
         system_cli = shutil.which("claude")
 
         # Build environment overrides for API configuration
-        sdk_env = {var: os.getenv(var) for var in API_ENV_VARS if os.getenv(var)}
+        # Filter to only include vars that are actually set (non-None)
+        sdk_env: dict[str, str] = {}
+        for var in API_ENV_VARS:
+            value = os.getenv(var)
+            if value:
+                sdk_env[var] = value
 
         # Determine model from environment or use default
         # This allows using alternative APIs (e.g., GLM via z.ai) that may not support Claude model names
@@ -289,7 +267,7 @@ class SpecChatSession:
         # Build the message content
         if attachments and len(attachments) > 0:
             # Multimodal message: build content blocks array
-            content_blocks = []
+            content_blocks: list[dict[str, Any]] = []
 
             # Add text block if there's text
             if message:
@@ -308,7 +286,7 @@ class SpecChatSession:
 
             # Send multimodal content to Claude using async generator format
             # The SDK's query() accepts AsyncIterable[dict] for custom message formats
-            await self.client.query(_make_multimodal_message(content_blocks))
+            await self.client.query(make_multimodal_message(content_blocks))
             logger.info(f"Sent multimodal message with {len(attachments)} image(s)")
         else:
             # Text-only message: use string format
@@ -317,7 +295,7 @@ class SpecChatSession:
         current_text = ""
 
         # Track pending writes for BOTH required files
-        pending_writes = {
+        pending_writes: dict[str, dict[str, Any] | None] = {
             "app_spec": None,      # {"tool_id": ..., "path": ...}
             "initializer": None,   # {"tool_id": ..., "path": ...}
         }
@@ -392,7 +370,8 @@ class SpecChatSession:
                             logger.warning(f"Tool error: {content}")
                             # Clear any pending writes that failed
                             for key in pending_writes:
-                                if pending_writes[key] and tool_use_id == pending_writes[key].get("tool_id"):
+                                pending_write = pending_writes[key]
+                                if pending_write is not None and tool_use_id == pending_write.get("tool_id"):
                                     logger.error(f"{key} write failed: {content}")
                                     pending_writes[key] = None
                         else:

server/services/terminal_manager.py

@@ -371,7 +371,7 @@ class TerminalSession:
             # Reap zombie if not already reaped
             if self._child_pid is not None:
                 try:
-                    os.waitpid(self._child_pid, os.WNOHANG)
+                    os.waitpid(self._child_pid, os.WNOHANG)  # type: ignore[attr-defined]  # Unix-only method, guarded by runtime platform selection
                 except ChildProcessError:
                     pass
                 except Exception:
@@ -736,7 +736,7 @@ async def cleanup_all_terminals() -> None:
     Called on server shutdown to ensure all PTY processes are terminated.
     """
     with _sessions_lock:
-        all_sessions = []
+        all_sessions: list[TerminalSession] = []
         for project_sessions in _sessions.values():
             all_sessions.extend(project_sessions.values())
 

server/utils/project_helpers.py

@@ -0,0 +1,32 @@
+"""
+Project Helper Utilities
+========================
+
+Shared project path lookup used across all server routers and websocket handlers.
+Consolidates the previously duplicated _get_project_path() function.
+"""
+
+import sys
+from pathlib import Path
+
+# Ensure the project root is on sys.path so `registry` can be imported.
+# This is necessary because `registry.py` lives at the repository root,
+# outside the `server` package.
+_root = Path(__file__).parent.parent.parent
+if str(_root) not in sys.path:
+    sys.path.insert(0, str(_root))
+
+from registry import get_project_path as _registry_get_project_path
+
+
+def get_project_path(project_name: str) -> Path | None:
+    """Look up a project's filesystem path from the global registry.
+
+    Args:
+        project_name: The registered name of the project.
+
+    Returns:
+        The resolved ``Path`` to the project directory, or ``None`` if the
+        project is not found in the registry.
+    """
+    return _registry_get_project_path(project_name)

server/utils/validation.py

@@ -1,26 +1,52 @@
 """
-Shared validation utilities for the server.
+Shared Validation Utilities
+============================
+
+Project name validation used across REST endpoints and WebSocket handlers.
+Two variants are provided:
+
+* ``is_valid_project_name`` -- returns ``bool``, suitable for WebSocket
+  handlers where raising an HTTPException is not appropriate.
+* ``validate_project_name`` -- raises ``HTTPException(400)`` on failure,
+  suitable for REST endpoint handlers.
 """
 
 import re
 
 from fastapi import HTTPException
 
+# Compiled once; reused by both variants.
+_PROJECT_NAME_RE = re.compile(r'^[a-zA-Z0-9_-]{1,50}$')
+
+
+def is_valid_project_name(name: str) -> bool:
+    """Check whether *name* is a valid project name.
+
+    Allows only ASCII letters, digits, hyphens, and underscores (1-50 chars).
+    Returns ``True`` if valid, ``False`` otherwise.
+
+    Use this in WebSocket handlers where you need to close the socket
+    yourself rather than raise an HTTP error.
+    """
+    return bool(_PROJECT_NAME_RE.match(name))
+
 
 def validate_project_name(name: str) -> str:
-    """
-    Validate and sanitize project name to prevent path traversal.
+    """Validate and return *name*, or raise ``HTTPException(400)``.
+
+    Suitable for REST endpoint handlers where FastAPI will convert the
+    exception into an HTTP 400 response automatically.
 
     Args:
-        name: Project name to validate
+        name: Project name to validate.
 
     Returns:
-        The validated project name
+        The validated project name (unchanged).
 
     Raises:
-        HTTPException: If name is invalid
+        HTTPException: If *name* is invalid.
     """
-    if not re.match(r'^[a-zA-Z0-9_-]{1,50}$', name):
+    if not _PROJECT_NAME_RE.match(name):
         raise HTTPException(
             status_code=400,
             detail="Invalid project name. Use only letters, numbers, hyphens, and underscores (1-50 chars)."

server/websocket.py

@@ -16,8 +16,11 @@ from typing import Set
 from fastapi import WebSocket, WebSocketDisconnect
 
 from .schemas import AGENT_MASCOTS
+from .services.chat_constants import ROOT_DIR
 from .services.dev_server_manager import get_devserver_manager
 from .services.process_manager import get_manager
+from .utils.project_helpers import get_project_path as _get_project_path
+from .utils.validation import is_valid_project_name as validate_project_name
 
 # Lazy imports
 _count_passing_tests = None
@@ -36,6 +39,14 @@ TESTING_AGENT_START_PATTERN = re.compile(r'Started testing agent for feature #(\
 # Matches: "Feature #123 testing completed" or "Feature #123 testing failed"
 TESTING_AGENT_COMPLETE_PATTERN = re.compile(r'Feature #(\d+) testing (completed|failed)')
 
+# Pattern to detect batch coding agent start message
+# Matches: "Started coding agent for features #5, #8, #12"
+BATCH_CODING_AGENT_START_PATTERN = re.compile(r'Started coding agent for features (#\d+(?:,\s*#\d+)*)')
+
+# Pattern to detect batch completion
+# Matches: "Features #5, #8, #12 completed" or "Features #5, #8, #12 failed"
+BATCH_FEATURES_COMPLETE_PATTERN = re.compile(r'Features (#\d+(?:,\s*#\d+)*)\s+(completed|failed)')
+
 # Patterns for detecting agent activity and thoughts
 THOUGHT_PATTERNS = [
     # Claude's tool usage patterns (actual format: [Tool: name])
@@ -61,9 +72,9 @@ ORCHESTRATOR_PATTERNS = {
     'capacity_check': re.compile(r'\[DEBUG\] Spawning loop: (\d+) ready, (\d+) slots'),
     'at_capacity': re.compile(r'At max capacity|at max testing agents|At max total agents'),
     'feature_start': re.compile(r'Starting feature \d+/\d+: #(\d+) - (.+)'),
-    'coding_spawn': re.compile(r'Started coding agent for feature #(\d+)'),
+    'coding_spawn': re.compile(r'Started coding agent for features? #(\d+)'),
     'testing_spawn': re.compile(r'Started testing agent for feature #(\d+)'),
-    'coding_complete': re.compile(r'Feature #(\d+) (completed|failed)'),
+    'coding_complete': re.compile(r'Features? #(\d+)(?:,\s*#\d+)* (completed|failed)'),
     'testing_complete': re.compile(r'Feature #(\d+) testing (completed|failed)'),
     'all_complete': re.compile(r'All features complete'),
     'blocked_features': re.compile(r'(\d+) blocked by dependencies'),
@@ -93,14 +104,26 @@ class AgentTracker:
         # Check for orchestrator status messages first
         # These don't have [Feature #X] prefix
 
-        # Coding agent start: "Started coding agent for feature #X"
-        if line.startswith("Started coding agent for feature #"):
+        # Batch coding agent start: "Started coding agent for features #5, #8, #12"
+        batch_start_match = BATCH_CODING_AGENT_START_PATTERN.match(line)
+        if batch_start_match:
             try:
-                feature_id = int(re.search(r'#(\d+)', line).group(1))
-                return await self._handle_agent_start(feature_id, line, agent_type="coding")
-            except (AttributeError, ValueError):
+                feature_ids = [int(x.strip().lstrip('#')) for x in batch_start_match.group(1).split(',')]
+                if feature_ids:
+                    return await self._handle_batch_agent_start(feature_ids, "coding")
+            except ValueError:
                 pass
 
+        # Single coding agent start: "Started coding agent for feature #X"
+        if line.startswith("Started coding agent for feature #"):
+            m = re.search(r'#(\d+)', line)
+            if m:
+                try:
+                    feature_id = int(m.group(1))
+                    return await self._handle_agent_start(feature_id, line, agent_type="coding")
+                except ValueError:
+                    pass
+
         # Testing agent start: "Started testing agent for feature #X (PID xxx)"
         testing_start_match = TESTING_AGENT_START_PATTERN.match(line)
         if testing_start_match:
@@ -114,14 +137,27 @@ class AgentTracker:
             is_success = testing_complete_match.group(2) == "completed"
             return await self._handle_agent_complete(feature_id, is_success, agent_type="testing")
 
+        # Batch features complete: "Features #5, #8, #12 completed/failed"
+        batch_complete_match = BATCH_FEATURES_COMPLETE_PATTERN.match(line)
+        if batch_complete_match:
+            try:
+                feature_ids = [int(x.strip().lstrip('#')) for x in batch_complete_match.group(1).split(',')]
+                is_success = batch_complete_match.group(2) == "completed"
+                if feature_ids:
+                    return await self._handle_batch_agent_complete(feature_ids, is_success, "coding")
+            except ValueError:
+                pass
+
         # Coding agent complete: "Feature #X completed/failed" (without "testing" keyword)
         if line.startswith("Feature #") and ("completed" in line or "failed" in line) and "testing" not in line:
-            try:
-                feature_id = int(re.search(r'#(\d+)', line).group(1))
-                is_success = "completed" in line
-                return await self._handle_agent_complete(feature_id, is_success, agent_type="coding")
-            except (AttributeError, ValueError):
-                pass
+            m = re.search(r'#(\d+)', line)
+            if m:
+                try:
+                    feature_id = int(m.group(1))
+                    is_success = "completed" in line
+                    return await self._handle_agent_complete(feature_id, is_success, agent_type="coding")
+                except ValueError:
+                    pass
 
         # Check for feature-specific output lines: [Feature #X] content
         # Both coding and testing agents use this format now
@@ -151,6 +187,7 @@ class AgentTracker:
                     'name': AGENT_MASCOTS[agent_index % len(AGENT_MASCOTS)],
                     'agent_index': agent_index,
                     'agent_type': 'coding',
+                    'feature_ids': [feature_id],
                     'state': 'thinking',
                     'feature_name': f'Feature #{feature_id}',
                     'last_thought': None,
@@ -158,6 +195,10 @@ class AgentTracker:
 
             agent = self.active_agents[key]
 
+            # Update current_feature_id for batch agents when output comes from a different feature
+            if 'current_feature_id' in agent and feature_id in agent.get('feature_ids', []):
+                agent['current_feature_id'] = feature_id
+
             # Detect state and thought from content
             state = 'working'
             thought = None
@@ -181,6 +222,7 @@ class AgentTracker:
                     'agentName': agent['name'],
                     'agentType': agent['agent_type'],
                     'featureId': feature_id,
+                    'featureIds': agent.get('feature_ids', [feature_id]),
                     'featureName': agent['feature_name'],
                     'state': state,
                     'thought': thought,
@@ -237,6 +279,7 @@ class AgentTracker:
                 'name': AGENT_MASCOTS[agent_index % len(AGENT_MASCOTS)],
                 'agent_index': agent_index,
                 'agent_type': agent_type,
+                'feature_ids': [feature_id],
                 'state': 'thinking',
                 'feature_name': feature_name,
                 'last_thought': 'Starting work...',
@@ -248,12 +291,55 @@ class AgentTracker:
                 'agentName': AGENT_MASCOTS[agent_index % len(AGENT_MASCOTS)],
                 'agentType': agent_type,
                 'featureId': feature_id,
+                'featureIds': [feature_id],
                 'featureName': feature_name,
                 'state': 'thinking',
                 'thought': 'Starting work...',
                 'timestamp': datetime.now().isoformat(),
             }
 
+    async def _handle_batch_agent_start(self, feature_ids: list[int], agent_type: str = "coding") -> dict | None:
+        """Handle batch agent start message from orchestrator."""
+        if not feature_ids:
+            return None
+        primary_id = feature_ids[0]
+        async with self._lock:
+            key = (primary_id, agent_type)
+            agent_index = self._next_agent_index
+            self._next_agent_index += 1
+
+            feature_name = f'Features {", ".join(f"#{fid}" for fid in feature_ids)}'
+
+            self.active_agents[key] = {
+                'name': AGENT_MASCOTS[agent_index % len(AGENT_MASCOTS)],
+                'agent_index': agent_index,
+                'agent_type': agent_type,
+                'feature_ids': list(feature_ids),
+                'current_feature_id': primary_id,
+                'state': 'thinking',
+                'feature_name': feature_name,
+                'last_thought': 'Starting batch work...',
+            }
+
+            # Register all feature IDs so output lines can find this agent
+            for fid in feature_ids:
+                secondary_key = (fid, agent_type)
+                if secondary_key != key:
+                    self.active_agents[secondary_key] = self.active_agents[key]
+
+            return {
+                'type': 'agent_update',
+                'agentIndex': agent_index,
+                'agentName': AGENT_MASCOTS[agent_index % len(AGENT_MASCOTS)],
+                'agentType': agent_type,
+                'featureId': primary_id,
+                'featureIds': list(feature_ids),
+                'featureName': feature_name,
+                'state': 'thinking',
+                'thought': 'Starting batch work...',
+                'timestamp': datetime.now().isoformat(),
+            }
+
     async def _handle_agent_complete(self, feature_id: int, is_success: bool, agent_type: str = "coding") -> dict | None:
         """Handle agent completion - ALWAYS emits a message, even if agent wasn't tracked.
 
@@ -275,6 +361,7 @@ class AgentTracker:
                     'agentName': agent['name'],
                     'agentType': agent.get('agent_type', agent_type),
                     'featureId': feature_id,
+                    'featureIds': agent.get('feature_ids', [feature_id]),
                     'featureName': agent['feature_name'],
                     'state': state,
                     'thought': 'Completed successfully!' if is_success else 'Failed to complete',
@@ -291,6 +378,7 @@ class AgentTracker:
                     'agentName': 'Unknown',
                     'agentType': agent_type,
                     'featureId': feature_id,
+                    'featureIds': [feature_id],
                     'featureName': f'Feature #{feature_id}',
                     'state': state,
                     'thought': 'Completed successfully!' if is_success else 'Failed to complete',
@@ -298,6 +386,49 @@ class AgentTracker:
                     'synthetic': True,
                 }
 
+    async def _handle_batch_agent_complete(self, feature_ids: list[int], is_success: bool, agent_type: str = "coding") -> dict | None:
+        """Handle batch agent completion."""
+        if not feature_ids:
+            return None
+        primary_id = feature_ids[0]
+        async with self._lock:
+            state = 'success' if is_success else 'error'
+            key = (primary_id, agent_type)
+
+            if key in self.active_agents:
+                agent = self.active_agents[key]
+                result = {
+                    'type': 'agent_update',
+                    'agentIndex': agent['agent_index'],
+                    'agentName': agent['name'],
+                    'agentType': agent.get('agent_type', agent_type),
+                    'featureId': primary_id,
+                    'featureIds': agent.get('feature_ids', list(feature_ids)),
+                    'featureName': agent['feature_name'],
+                    'state': state,
+                    'thought': 'Batch completed successfully!' if is_success else 'Batch failed to complete',
+                    'timestamp': datetime.now().isoformat(),
+                }
+                # Clean up all keys for this batch
+                for fid in feature_ids:
+                    self.active_agents.pop((fid, agent_type), None)
+                return result
+            else:
+                # Synthetic completion
+                return {
+                    'type': 'agent_update',
+                    'agentIndex': -1,
+                    'agentName': 'Unknown',
+                    'agentType': agent_type,
+                    'featureId': primary_id,
+                    'featureIds': list(feature_ids),
+                    'featureName': f'Features {", ".join(f"#{fid}" for fid in feature_ids)}',
+                    'state': state,
+                    'thought': 'Batch completed successfully!' if is_success else 'Batch failed to complete',
+                    'timestamp': datetime.now().isoformat(),
+                    'synthetic': True,
+                }
+
 
 class OrchestratorTracker:
     """Tracks orchestrator state for Mission Control observability.
@@ -444,7 +575,7 @@ class OrchestratorTracker:
         timestamp = datetime.now().isoformat()
 
         # Add to recent events (keep last 5)
-        event = {
+        event: dict[str, str | int] = {
             'eventType': event_type,
             'message': message,
             'timestamp': timestamp,
@@ -487,17 +618,6 @@ class OrchestratorTracker:
             self.recent_events.clear()
 
 
-def _get_project_path(project_name: str) -> Path:
-    """Get project path from registry."""
-    import sys
-    root = Path(__file__).parent.parent
-    if str(root) not in sys.path:
-        sys.path.insert(0, str(root))
-
-    from registry import get_project_path
-    return get_project_path(project_name)
-
-
 def _get_count_passing_tests():
     """Lazy import of count_passing_tests."""
     global _count_passing_tests
@@ -564,15 +684,6 @@ class ConnectionManager:
 # Global connection manager
 manager = ConnectionManager()
 
-# Root directory
-ROOT_DIR = Path(__file__).parent.parent
-
-
-def validate_project_name(name: str) -> bool:
-    """Validate project name to prevent path traversal."""
-    return bool(re.match(r'^[a-zA-Z0-9_-]{1,50}$', name))
-
-
 async def poll_progress(websocket: WebSocket, project_name: str, project_dir: Path):
     """Poll database for progress changes and send updates."""
     count_passing_tests = _get_count_passing_tests()
@@ -652,7 +763,7 @@ async def project_websocket(websocket: WebSocket, project_name: str):
                 agent_index, _ = await agent_tracker.get_agent_info(feature_id)
 
             # Send the raw log line with optional feature/agent attribution
-            log_msg = {
+            log_msg: dict[str, str | int] = {
                 "type": "log",
                 "line": line,
                 "timestamp": datetime.now().isoformat(),

start_ui.bat

@@ -39,5 +39,3 @@ pip install -r requirements.txt --quiet
 
 REM Run the Python launcher
 python "%~dp0start_ui.py" %*
-
-pause

start_ui.py

@@ -13,12 +13,16 @@ Automated launcher that handles all setup:
 7. Opens browser to the UI
 
 Usage:
-    python start_ui.py [--dev]
+    python start_ui.py [--dev] [--host HOST] [--port PORT]
 
 Options:
-    --dev    Run in development mode with Vite hot reload
+    --dev           Run in development mode with Vite hot reload
+    --host HOST     Host to bind to (default: 127.0.0.1)
+                    Use 0.0.0.0 for remote access (security warning will be shown)
+    --port PORT     Port to bind to (default: 8888)
 """
 
+import argparse
 import asyncio
 import os
 import shutil
@@ -133,10 +137,25 @@ def check_node() -> bool:
 
 
 def install_npm_deps() -> bool:
-    """Install npm dependencies if node_modules doesn't exist."""
+    """Install npm dependencies if node_modules doesn't exist or is stale."""
     node_modules = UI_DIR / "node_modules"
+    package_json = UI_DIR / "package.json"
+    package_lock = UI_DIR / "package-lock.json"
 
-    if node_modules.exists():
+    # Check if npm install is needed
+    needs_install = False
+
+    if not node_modules.exists():
+        needs_install = True
+    elif package_json.exists():
+        # If package.json or package-lock.json is newer than node_modules, reinstall
+        node_modules_mtime = node_modules.stat().st_mtime
+        if package_json.stat().st_mtime > node_modules_mtime:
+            needs_install = True
+        elif package_lock.exists() and package_lock.stat().st_mtime > node_modules_mtime:
+            needs_install = True
+
+    if not needs_install:
         print("  npm dependencies already installed")
         return True
 
@@ -183,7 +202,7 @@ def build_frontend() -> bool:
         trigger_file = "dist/ directory missing"
     elif src_dir.exists():
         # Find the newest file in dist/ directory
-        newest_dist_mtime = 0
+        newest_dist_mtime: float = 0
         for dist_file in dist_dir.rglob("*"):
             try:
                 if dist_file.is_file():
@@ -235,26 +254,31 @@ def build_frontend() -> bool:
     return run_command([npm_cmd, "run", "build"], cwd=UI_DIR)
 
 
-def start_dev_server(port: int) -> tuple:
+def start_dev_server(port: int, host: str = "127.0.0.1") -> tuple:
     """Start both Vite and FastAPI in development mode."""
     venv_python = get_venv_python()
 
     print("\n  Starting development servers...")
-    print(f"  - FastAPI backend: http://127.0.0.1:{port}")
+    print(f"  - FastAPI backend: http://{host}:{port}")
     print("  - Vite frontend:   http://127.0.0.1:5173")
 
+    # Set environment for remote access if needed
+    env = os.environ.copy()
+    if host != "127.0.0.1":
+        env["AUTOCODER_ALLOW_REMOTE"] = "1"
+
     # Start FastAPI
     backend = subprocess.Popen([
         str(venv_python), "-m", "uvicorn",
         "server.main:app",
-        "--host", "127.0.0.1",
+        "--host", host,
         "--port", str(port),
         "--reload"
-    ], cwd=str(ROOT))
+    ], cwd=str(ROOT), env=env)
 
     # Start Vite with API port env var for proxy configuration
     npm_cmd = "npm.cmd" if sys.platform == "win32" else "npm"
-    vite_env = os.environ.copy()
+    vite_env = env.copy()
     vite_env["VITE_API_PORT"] = str(port)
     frontend = subprocess.Popen([
         npm_cmd, "run", "dev"
@@ -263,15 +287,18 @@ def start_dev_server(port: int) -> tuple:
     return backend, frontend
 
 
-def start_production_server(port: int):
-    """Start FastAPI server in production mode with hot reload."""
+def start_production_server(port: int, host: str = "127.0.0.1"):
+    """Start FastAPI server in production mode."""
     venv_python = get_venv_python()
 
-    print(f"\n  Starting server at http://127.0.0.1:{port} (with hot reload)")
+    print(f"\n  Starting server at http://{host}:{port}")
 
-    # Set PYTHONASYNCIODEBUG to help with Windows subprocess issues
     env = os.environ.copy()
 
+    # Enable remote access in server if not localhost
+    if host != "127.0.0.1":
+        env["AUTOCODER_ALLOW_REMOTE"] = "1"
+
     # NOTE: --reload is NOT used because on Windows it breaks asyncio subprocess
     # support (uvicorn's reload worker doesn't inherit the ProactorEventLoop policy).
     # This affects Claude SDK which uses asyncio.create_subprocess_exec.
@@ -279,14 +306,34 @@ def start_production_server(port: int):
     return subprocess.Popen([
         str(venv_python), "-m", "uvicorn",
         "server.main:app",
-        "--host", "127.0.0.1",
+        "--host", host,
         "--port", str(port),
     ], cwd=str(ROOT), env=env)
 
 
 def main() -> None:
     """Main entry point."""
-    dev_mode = "--dev" in sys.argv
+    parser = argparse.ArgumentParser(description="AutoCoder UI Launcher")
+    parser.add_argument("--dev", action="store_true", help="Run in development mode with Vite hot reload")
+    parser.add_argument("--host", default="127.0.0.1", help="Host to bind to (default: 127.0.0.1)")
+    parser.add_argument("--port", type=int, default=None, help="Port to bind to (default: auto-detect from 8888)")
+    args = parser.parse_args()
+
+    dev_mode = args.dev
+    host = args.host
+
+    # Security warning for remote access
+    if host != "127.0.0.1":
+        print("\n" + "!" * 50)
+        print("  SECURITY WARNING")
+        print("!" * 50)
+        print(f"  Remote access enabled on host: {host}")
+        print("  The AutoCoder UI will be accessible from other machines.")
+        print("  Ensure you understand the security implications:")
+        print("  - The agent has file system access to project directories")
+        print("  - The API can start/stop agents and modify files")
+        print("  - Consider using a firewall or VPN for protection")
+        print("!" * 50 + "\n")
 
     print("=" * 50)
     print("  AutoCoder UI Setup")
@@ -335,18 +382,20 @@ def main() -> None:
     step = 5 if dev_mode else 6
     print_step(step, total_steps, "Starting server")
 
-    port = find_available_port()
+    port = args.port if args.port else find_available_port()
 
     try:
         if dev_mode:
-            backend, frontend = start_dev_server(port)
+            backend, frontend = start_dev_server(port, host)
 
-            # Open browser to Vite dev server
+            # Open browser to Vite dev server (always localhost for Vite)
             time.sleep(3)
             webbrowser.open("http://127.0.0.1:5173")
 
             print("\n" + "=" * 50)
             print("  Development mode active")
+            if host != "127.0.0.1":
+                print(f"  Backend accessible at: http://{host}:{port}")
             print("  Press Ctrl+C to stop")
             print("=" * 50)
 
@@ -362,14 +411,15 @@ def main() -> None:
                 backend.wait()
                 frontend.wait()
         else:
-            server = start_production_server(port)
+            server = start_production_server(port, host)
 
-            # Open browser
+            # Open browser (only if localhost)
             time.sleep(2)
-            webbrowser.open(f"http://127.0.0.1:{port}")
+            if host == "127.0.0.1":
+                webbrowser.open(f"http://127.0.0.1:{port}")
 
             print("\n" + "=" * 50)
-            print(f"  Server running at http://127.0.0.1:{port}")
+            print(f"  Server running at http://{host}:{port}")
             print("  Press Ctrl+C to stop")
             print("=" * 50)
 

test_client.py

@@ -0,0 +1,265 @@
+#!/usr/bin/env python3
+"""
+Client Utility Tests
+====================
+
+Tests for the client module utility functions.
+Run with: python test_client.py
+"""
+
+import os
+import sys
+import tempfile
+import unittest
+from pathlib import Path
+
+from client import (
+    EXTRA_READ_PATHS_BLOCKLIST,
+    EXTRA_READ_PATHS_VAR,
+    convert_model_for_vertex,
+    get_extra_read_paths,
+)
+
+
+class TestConvertModelForVertex(unittest.TestCase):
+    """Tests for convert_model_for_vertex function."""
+
+    def setUp(self):
+        """Save original env state."""
+        self._orig_vertex = os.environ.get("CLAUDE_CODE_USE_VERTEX")
+
+    def tearDown(self):
+        """Restore original env state."""
+        if self._orig_vertex is None:
+            os.environ.pop("CLAUDE_CODE_USE_VERTEX", None)
+        else:
+            os.environ["CLAUDE_CODE_USE_VERTEX"] = self._orig_vertex
+
+    # --- Vertex AI disabled (default) ---
+
+    def test_returns_model_unchanged_when_vertex_disabled(self):
+        os.environ.pop("CLAUDE_CODE_USE_VERTEX", None)
+        self.assertEqual(
+            convert_model_for_vertex("claude-opus-4-5-20251101"),
+            "claude-opus-4-5-20251101",
+        )
+
+    def test_returns_model_unchanged_when_vertex_set_to_zero(self):
+        os.environ["CLAUDE_CODE_USE_VERTEX"] = "0"
+        self.assertEqual(
+            convert_model_for_vertex("claude-opus-4-5-20251101"),
+            "claude-opus-4-5-20251101",
+        )
+
+    def test_returns_model_unchanged_when_vertex_set_to_empty(self):
+        os.environ["CLAUDE_CODE_USE_VERTEX"] = ""
+        self.assertEqual(
+            convert_model_for_vertex("claude-sonnet-4-5-20250929"),
+            "claude-sonnet-4-5-20250929",
+        )
+
+    # --- Vertex AI enabled: standard conversions ---
+
+    def test_converts_opus_model(self):
+        os.environ["CLAUDE_CODE_USE_VERTEX"] = "1"
+        self.assertEqual(
+            convert_model_for_vertex("claude-opus-4-5-20251101"),
+            "claude-opus-4-5@20251101",
+        )
+
+    def test_converts_sonnet_model(self):
+        os.environ["CLAUDE_CODE_USE_VERTEX"] = "1"
+        self.assertEqual(
+            convert_model_for_vertex("claude-sonnet-4-5-20250929"),
+            "claude-sonnet-4-5@20250929",
+        )
+
+    def test_converts_haiku_model(self):
+        os.environ["CLAUDE_CODE_USE_VERTEX"] = "1"
+        self.assertEqual(
+            convert_model_for_vertex("claude-3-5-haiku-20241022"),
+            "claude-3-5-haiku@20241022",
+        )
+
+    # --- Vertex AI enabled: already converted or non-matching ---
+
+    def test_already_vertex_format_unchanged(self):
+        os.environ["CLAUDE_CODE_USE_VERTEX"] = "1"
+        self.assertEqual(
+            convert_model_for_vertex("claude-opus-4-5@20251101"),
+            "claude-opus-4-5@20251101",
+        )
+
+    def test_non_claude_model_unchanged(self):
+        os.environ["CLAUDE_CODE_USE_VERTEX"] = "1"
+        self.assertEqual(
+            convert_model_for_vertex("gpt-4o"),
+            "gpt-4o",
+        )
+
+    def test_model_without_date_suffix_unchanged(self):
+        os.environ["CLAUDE_CODE_USE_VERTEX"] = "1"
+        self.assertEqual(
+            convert_model_for_vertex("claude-opus-4-5"),
+            "claude-opus-4-5",
+        )
+
+    def test_empty_string_unchanged(self):
+        os.environ["CLAUDE_CODE_USE_VERTEX"] = "1"
+        self.assertEqual(convert_model_for_vertex(""), "")
+
+
+class TestExtraReadPathsBlocklist(unittest.TestCase):
+    """Tests for EXTRA_READ_PATHS sensitive directory blocking in get_extra_read_paths()."""
+
+    def setUp(self):
+        """Save original environment and home directory state."""
+        self._orig_extra_read = os.environ.get(EXTRA_READ_PATHS_VAR)
+        self._orig_home = os.environ.get("HOME")
+        self._orig_userprofile = os.environ.get("USERPROFILE")
+        self._orig_homedrive = os.environ.get("HOMEDRIVE")
+        self._orig_homepath = os.environ.get("HOMEPATH")
+
+    def tearDown(self):
+        """Restore original environment state."""
+        restore_map = {
+            EXTRA_READ_PATHS_VAR: self._orig_extra_read,
+            "HOME": self._orig_home,
+            "USERPROFILE": self._orig_userprofile,
+            "HOMEDRIVE": self._orig_homedrive,
+            "HOMEPATH": self._orig_homepath,
+        }
+        for key, value in restore_map.items():
+            if value is None:
+                os.environ.pop(key, None)
+            else:
+                os.environ[key] = value
+
+    def _set_home(self, home_path: str):
+        """Set the home directory for both Unix and Windows."""
+        os.environ["HOME"] = home_path
+        if sys.platform == "win32":
+            os.environ["USERPROFILE"] = home_path
+            drive, path = os.path.splitdrive(home_path)
+            if drive:
+                os.environ["HOMEDRIVE"] = drive
+                os.environ["HOMEPATH"] = path
+
+    def test_sensitive_directory_is_blocked(self):
+        """Path that IS a sensitive directory (e.g., ~/.ssh) should be blocked."""
+        with tempfile.TemporaryDirectory() as tmpdir:
+            self._set_home(tmpdir)
+            # Create the sensitive directory so it exists
+            ssh_dir = Path(tmpdir) / ".ssh"
+            ssh_dir.mkdir()
+
+            os.environ[EXTRA_READ_PATHS_VAR] = str(ssh_dir)
+            result = get_extra_read_paths()
+            self.assertEqual(result, [], "Path that IS ~/.ssh should be blocked")
+
+    def test_path_inside_sensitive_directory_is_blocked(self):
+        """Path INSIDE a sensitive directory (e.g., ~/.ssh/keys) should be blocked."""
+        with tempfile.TemporaryDirectory() as tmpdir:
+            self._set_home(tmpdir)
+            ssh_dir = Path(tmpdir) / ".ssh"
+            keys_dir = ssh_dir / "keys"
+            keys_dir.mkdir(parents=True)
+
+            os.environ[EXTRA_READ_PATHS_VAR] = str(keys_dir)
+            result = get_extra_read_paths()
+            self.assertEqual(result, [], "Path inside ~/.ssh should be blocked")
+
+    def test_path_containing_sensitive_directory_is_blocked(self):
+        """Path that contains a sensitive directory inside it should be blocked.
+
+        For example, if the extra read path is the user's home directory, and
+        ~/.ssh exists inside it, the path should be blocked because granting
+        read access to the parent would expose the sensitive subdirectory.
+        """
+        with tempfile.TemporaryDirectory() as tmpdir:
+            self._set_home(tmpdir)
+            # Create a sensitive dir inside the home so it triggers the
+            # "sensitive dir is inside the requested path" check
+            ssh_dir = Path(tmpdir) / ".ssh"
+            ssh_dir.mkdir()
+
+            os.environ[EXTRA_READ_PATHS_VAR] = tmpdir
+            result = get_extra_read_paths()
+            self.assertEqual(result, [], "Home dir containing .ssh should be blocked")
+
+    def test_valid_non_sensitive_path_is_allowed(self):
+        """A valid directory that is NOT sensitive should be allowed."""
+        with tempfile.TemporaryDirectory() as tmpdir:
+            self._set_home(tmpdir)
+            # Create a non-sensitive directory under home
+            docs_dir = Path(tmpdir) / "Documents" / "myproject"
+            docs_dir.mkdir(parents=True)
+
+            os.environ[EXTRA_READ_PATHS_VAR] = str(docs_dir)
+            result = get_extra_read_paths()
+            self.assertEqual(len(result), 1, "Non-sensitive path should be allowed")
+            self.assertEqual(result[0], docs_dir.resolve())
+
+    def test_all_blocklist_entries_are_checked(self):
+        """Every directory in EXTRA_READ_PATHS_BLOCKLIST should actually be blocked."""
+        with tempfile.TemporaryDirectory() as tmpdir:
+            self._set_home(tmpdir)
+
+            for sensitive_name in sorted(EXTRA_READ_PATHS_BLOCKLIST):
+                sensitive_dir = Path(tmpdir) / sensitive_name
+                sensitive_dir.mkdir(parents=True, exist_ok=True)
+
+                os.environ[EXTRA_READ_PATHS_VAR] = str(sensitive_dir)
+                result = get_extra_read_paths()
+                self.assertEqual(
+                    result, [],
+                    f"Blocklist entry '{sensitive_name}' should be blocked"
+                )
+
+    def test_multiple_paths_mixed_sensitive_and_valid(self):
+        """When given multiple paths, only non-sensitive ones should pass."""
+        with tempfile.TemporaryDirectory() as tmpdir:
+            self._set_home(tmpdir)
+
+            # Create one sensitive and one valid directory
+            ssh_dir = Path(tmpdir) / ".ssh"
+            ssh_dir.mkdir()
+            valid_dir = Path(tmpdir) / "projects"
+            valid_dir.mkdir()
+
+            os.environ[EXTRA_READ_PATHS_VAR] = f"{ssh_dir},{valid_dir}"
+            result = get_extra_read_paths()
+            self.assertEqual(len(result), 1, "Only the non-sensitive path should be returned")
+            self.assertEqual(result[0], valid_dir.resolve())
+
+    def test_empty_extra_read_paths_returns_empty(self):
+        """Empty EXTRA_READ_PATHS should return empty list."""
+        os.environ[EXTRA_READ_PATHS_VAR] = ""
+        result = get_extra_read_paths()
+        self.assertEqual(result, [])
+
+    def test_unset_extra_read_paths_returns_empty(self):
+        """Unset EXTRA_READ_PATHS should return empty list."""
+        os.environ.pop(EXTRA_READ_PATHS_VAR, None)
+        result = get_extra_read_paths()
+        self.assertEqual(result, [])
+
+    def test_nonexistent_path_is_skipped(self):
+        """A path that does not exist should be skipped."""
+        with tempfile.TemporaryDirectory() as tmpdir:
+            self._set_home(tmpdir)
+            nonexistent = Path(tmpdir) / "does_not_exist"
+
+            os.environ[EXTRA_READ_PATHS_VAR] = str(nonexistent)
+            result = get_extra_read_paths()
+            self.assertEqual(result, [])
+
+    def test_relative_path_is_skipped(self):
+        """A relative path should be skipped."""
+        os.environ[EXTRA_READ_PATHS_VAR] = "relative/path"
+        result = get_extra_read_paths()
+        self.assertEqual(result, [])
+
+
+if __name__ == "__main__":
+    unittest.main()

test_dependency_resolver.py

@@ -0,0 +1,426 @@
+#!/usr/bin/env python3
+"""
+Dependency Resolver Tests
+=========================
+
+Tests for the dependency resolver functions including cycle detection.
+Run with: python test_dependency_resolver.py
+"""
+
+import sys
+import time
+from concurrent.futures import ThreadPoolExecutor
+from concurrent.futures import TimeoutError as FuturesTimeoutError
+
+from api.dependency_resolver import (
+    are_dependencies_satisfied,
+    compute_scheduling_scores,
+    get_blocked_features,
+    get_blocking_dependencies,
+    get_ready_features,
+    resolve_dependencies,
+    would_create_circular_dependency,
+)
+
+
+def test_compute_scheduling_scores_simple_chain():
+    """Test scheduling scores for a simple linear dependency chain."""
+    print("\nTesting compute_scheduling_scores with simple chain:")
+
+    features = [
+        {"id": 1, "priority": 1, "dependencies": []},
+        {"id": 2, "priority": 2, "dependencies": [1]},
+        {"id": 3, "priority": 3, "dependencies": [2]},
+    ]
+
+    scores = compute_scheduling_scores(features)
+
+    # All features should have scores
+    passed = True
+    for f in features:
+        if f["id"] not in scores:
+            print(f"  FAIL: Feature {f['id']} missing from scores")
+            passed = False
+
+    if passed:
+        # Root feature (1) should have highest score (unblocks most)
+        if scores[1] > scores[2] > scores[3]:
+            print("  PASS: Root feature has highest score, leaf has lowest")
+        else:
+            print(f"  FAIL: Expected scores[1] > scores[2] > scores[3], got {scores}")
+            passed = False
+
+    return passed
+
+
+def test_compute_scheduling_scores_with_cycle():
+    """Test that compute_scheduling_scores handles circular dependencies without hanging."""
+    print("\nTesting compute_scheduling_scores with circular dependencies:")
+
+    # Create a cycle: 1 -> 2 -> 3 -> 1
+    features = [
+        {"id": 1, "priority": 1, "dependencies": [3]},
+        {"id": 2, "priority": 2, "dependencies": [1]},
+        {"id": 3, "priority": 3, "dependencies": [2]},
+    ]
+
+    # Use timeout to detect infinite loop
+    def compute_with_timeout():
+        return compute_scheduling_scores(features)
+
+    start = time.time()
+    try:
+        with ThreadPoolExecutor(max_workers=1) as executor:
+            future = executor.submit(compute_with_timeout)
+            scores = future.result(timeout=5.0)  # 5 second timeout
+
+        elapsed = time.time() - start
+
+        # Should complete quickly (< 1 second for 3 features)
+        if elapsed > 1.0:
+            print(f"  FAIL: Took {elapsed:.2f}s (expected < 1s)")
+            return False
+
+        # All features should have scores (even cyclic ones)
+        if len(scores) == 3:
+            print(f"  PASS: Completed in {elapsed:.3f}s with {len(scores)} scores")
+            return True
+        else:
+            print(f"  FAIL: Expected 3 scores, got {len(scores)}")
+            return False
+
+    except FuturesTimeoutError:
+        print("  FAIL: Infinite loop detected (timed out after 5s)")
+        return False
+
+
+def test_compute_scheduling_scores_self_reference():
+    """Test scheduling scores with self-referencing dependency."""
+    print("\nTesting compute_scheduling_scores with self-reference:")
+
+    features = [
+        {"id": 1, "priority": 1, "dependencies": [1]},  # Self-reference
+        {"id": 2, "priority": 2, "dependencies": []},
+    ]
+
+    start = time.time()
+    try:
+        with ThreadPoolExecutor(max_workers=1) as executor:
+            future = executor.submit(lambda: compute_scheduling_scores(features))
+            scores = future.result(timeout=5.0)
+
+        elapsed = time.time() - start
+
+        if elapsed > 1.0:
+            print(f"  FAIL: Took {elapsed:.2f}s (expected < 1s)")
+            return False
+
+        if len(scores) == 2:
+            print(f"  PASS: Completed in {elapsed:.3f}s with {len(scores)} scores")
+            return True
+        else:
+            print(f"  FAIL: Expected 2 scores, got {len(scores)}")
+            return False
+
+    except FuturesTimeoutError:
+        print("  FAIL: Infinite loop detected (timed out after 5s)")
+        return False
+
+
+def test_compute_scheduling_scores_complex_cycle():
+    """Test scheduling scores with complex circular dependencies."""
+    print("\nTesting compute_scheduling_scores with complex cycle:")
+
+    # Features 1-3 form a cycle, feature 4 depends on 1
+    features = [
+        {"id": 1, "priority": 1, "dependencies": [3]},
+        {"id": 2, "priority": 2, "dependencies": [1]},
+        {"id": 3, "priority": 3, "dependencies": [2]},
+        {"id": 4, "priority": 4, "dependencies": [1]},  # Outside cycle
+    ]
+
+    start = time.time()
+    try:
+        with ThreadPoolExecutor(max_workers=1) as executor:
+            future = executor.submit(lambda: compute_scheduling_scores(features))
+            scores = future.result(timeout=5.0)
+
+        elapsed = time.time() - start
+
+        if elapsed > 1.0:
+            print(f"  FAIL: Took {elapsed:.2f}s (expected < 1s)")
+            return False
+
+        if len(scores) == 4:
+            print(f"  PASS: Completed in {elapsed:.3f}s with {len(scores)} scores")
+            return True
+        else:
+            print(f"  FAIL: Expected 4 scores, got {len(scores)}")
+            return False
+
+    except FuturesTimeoutError:
+        print("  FAIL: Infinite loop detected (timed out after 5s)")
+        return False
+
+
+def test_compute_scheduling_scores_diamond():
+    """Test scheduling scores with diamond dependency pattern."""
+    print("\nTesting compute_scheduling_scores with diamond pattern:")
+
+    #     1
+    #    / \
+    #   2   3
+    #    \ /
+    #     4
+    features = [
+        {"id": 1, "priority": 1, "dependencies": []},
+        {"id": 2, "priority": 2, "dependencies": [1]},
+        {"id": 3, "priority": 3, "dependencies": [1]},
+        {"id": 4, "priority": 4, "dependencies": [2, 3]},
+    ]
+
+    scores = compute_scheduling_scores(features)
+
+    # Feature 1 should have highest score (unblocks 2, 3, and transitively 4)
+    if scores[1] > scores[2] and scores[1] > scores[3] and scores[1] > scores[4]:
+        # Feature 4 should have lowest score (leaf, unblocks nothing)
+        if scores[4] < scores[2] and scores[4] < scores[3]:
+            print("  PASS: Root has highest score, leaf has lowest")
+            return True
+        else:
+            print(f"  FAIL: Leaf should have lowest score. Scores: {scores}")
+            return False
+    else:
+        print(f"  FAIL: Root should have highest score. Scores: {scores}")
+        return False
+
+
+def test_compute_scheduling_scores_empty():
+    """Test scheduling scores with empty feature list."""
+    print("\nTesting compute_scheduling_scores with empty list:")
+
+    scores = compute_scheduling_scores([])
+
+    if scores == {}:
+        print("  PASS: Returns empty dict for empty input")
+        return True
+    else:
+        print(f"  FAIL: Expected empty dict, got {scores}")
+        return False
+
+
+def test_would_create_circular_dependency():
+    """Test cycle detection for new dependencies."""
+    print("\nTesting would_create_circular_dependency:")
+
+    # Current dependencies: 2 depends on 1, 3 depends on 2
+    # Dependency chain: 3 -> 2 -> 1 (arrows mean "depends on")
+    features = [
+        {"id": 1, "priority": 1, "dependencies": []},
+        {"id": 2, "priority": 2, "dependencies": [1]},
+        {"id": 3, "priority": 3, "dependencies": [2]},
+    ]
+
+    passed = True
+
+    # source_id gains dependency on target_id
+    # Adding "1 depends on 3" would create cycle: 1 -> 3 -> 2 -> 1
+    if would_create_circular_dependency(features, 1, 3):
+        print("  PASS: Detected cycle when adding 1 depends on 3")
+    else:
+        print("  FAIL: Should detect cycle when adding 1 depends on 3")
+        passed = False
+
+    # Adding "3 depends on 1" would NOT create cycle (redundant but not circular)
+    if not would_create_circular_dependency(features, 3, 1):
+        print("  PASS: No false positive for 3 depends on 1")
+    else:
+        print("  FAIL: False positive for 3 depends on 1")
+        passed = False
+
+    # Self-reference should be detected
+    if would_create_circular_dependency(features, 1, 1):
+        print("  PASS: Detected self-reference")
+    else:
+        print("  FAIL: Should detect self-reference")
+        passed = False
+
+    return passed
+
+
+def test_resolve_dependencies_with_cycle():
+    """Test resolve_dependencies detects and reports cycles."""
+    print("\nTesting resolve_dependencies with cycle:")
+
+    # Create a cycle: 1 -> 2 -> 3 -> 1
+    features = [
+        {"id": 1, "priority": 1, "dependencies": [3]},
+        {"id": 2, "priority": 2, "dependencies": [1]},
+        {"id": 3, "priority": 3, "dependencies": [2]},
+    ]
+
+    result = resolve_dependencies(features)
+
+    # Should report circular dependencies
+    if result["circular_dependencies"]:
+        print(f"  PASS: Detected cycle: {result['circular_dependencies']}")
+        return True
+    else:
+        print("  FAIL: Should report circular dependencies")
+        return False
+
+
+def test_are_dependencies_satisfied():
+    """Test dependency satisfaction checking."""
+    print("\nTesting are_dependencies_satisfied:")
+
+    features = [
+        {"id": 1, "priority": 1, "dependencies": [], "passes": True},
+        {"id": 2, "priority": 2, "dependencies": [1], "passes": False},
+        {"id": 3, "priority": 3, "dependencies": [2], "passes": False},
+    ]
+
+    passed = True
+
+    # Feature 1 has no deps, should be satisfied
+    if are_dependencies_satisfied(features[0], features):
+        print("  PASS: Feature 1 (no deps) is satisfied")
+    else:
+        print("  FAIL: Feature 1 should be satisfied")
+        passed = False
+
+    # Feature 2 depends on 1 which passes, should be satisfied
+    if are_dependencies_satisfied(features[1], features):
+        print("  PASS: Feature 2 (dep on passing) is satisfied")
+    else:
+        print("  FAIL: Feature 2 should be satisfied")
+        passed = False
+
+    # Feature 3 depends on 2 which doesn't pass, should NOT be satisfied
+    if not are_dependencies_satisfied(features[2], features):
+        print("  PASS: Feature 3 (dep on non-passing) is not satisfied")
+    else:
+        print("  FAIL: Feature 3 should not be satisfied")
+        passed = False
+
+    return passed
+
+
+def test_get_blocking_dependencies():
+    """Test getting blocking dependency IDs."""
+    print("\nTesting get_blocking_dependencies:")
+
+    features = [
+        {"id": 1, "priority": 1, "dependencies": [], "passes": True},
+        {"id": 2, "priority": 2, "dependencies": [], "passes": False},
+        {"id": 3, "priority": 3, "dependencies": [1, 2], "passes": False},
+    ]
+
+    blocking = get_blocking_dependencies(features[2], features)
+
+    # Only feature 2 should be blocking (1 passes)
+    if blocking == [2]:
+        print("  PASS: Correctly identified blocking dependency")
+        return True
+    else:
+        print(f"  FAIL: Expected [2], got {blocking}")
+        return False
+
+
+def test_get_ready_features():
+    """Test getting ready features."""
+    print("\nTesting get_ready_features:")
+
+    features = [
+        {"id": 1, "priority": 1, "dependencies": [], "passes": True},
+        {"id": 2, "priority": 2, "dependencies": [], "passes": False, "in_progress": False},
+        {"id": 3, "priority": 3, "dependencies": [1], "passes": False, "in_progress": False},
+        {"id": 4, "priority": 4, "dependencies": [2], "passes": False, "in_progress": False},
+    ]
+
+    ready = get_ready_features(features)
+
+    # Features 2 and 3 should be ready
+    # Feature 1 passes, feature 4 blocked by 2
+    ready_ids = [f["id"] for f in ready]
+
+    if 2 in ready_ids and 3 in ready_ids:
+        if 1 not in ready_ids and 4 not in ready_ids:
+            print(f"  PASS: Ready features: {ready_ids}")
+            return True
+        else:
+            print(f"  FAIL: Should not include passing/blocked. Got: {ready_ids}")
+            return False
+    else:
+        print(f"  FAIL: Should include 2 and 3. Got: {ready_ids}")
+        return False
+
+
+def test_get_blocked_features():
+    """Test getting blocked features."""
+    print("\nTesting get_blocked_features:")
+
+    features = [
+        {"id": 1, "priority": 1, "dependencies": [], "passes": False},
+        {"id": 2, "priority": 2, "dependencies": [1], "passes": False},
+    ]
+
+    blocked = get_blocked_features(features)
+
+    # Feature 2 should be blocked by 1
+    if len(blocked) == 1 and blocked[0]["id"] == 2:
+        if blocked[0]["blocked_by"] == [1]:
+            print("  PASS: Correctly identified blocked feature")
+            return True
+        else:
+            print(f"  FAIL: Wrong blocked_by: {blocked[0]['blocked_by']}")
+            return False
+    else:
+        print(f"  FAIL: Expected feature 2 blocked, got: {blocked}")
+        return False
+
+
+def run_all_tests():
+    """Run all tests and report results."""
+    print("=" * 60)
+    print("Dependency Resolver Tests")
+    print("=" * 60)
+
+    tests = [
+        test_compute_scheduling_scores_simple_chain,
+        test_compute_scheduling_scores_with_cycle,
+        test_compute_scheduling_scores_self_reference,
+        test_compute_scheduling_scores_complex_cycle,
+        test_compute_scheduling_scores_diamond,
+        test_compute_scheduling_scores_empty,
+        test_would_create_circular_dependency,
+        test_resolve_dependencies_with_cycle,
+        test_are_dependencies_satisfied,
+        test_get_blocking_dependencies,
+        test_get_ready_features,
+        test_get_blocked_features,
+    ]
+
+    passed = 0
+    failed = 0
+
+    for test in tests:
+        try:
+            if test():
+                passed += 1
+            else:
+                failed += 1
+        except Exception as e:
+            print(f"  ERROR: {e}")
+            failed += 1
+
+    print("\n" + "=" * 60)
+    print(f"Results: {passed} passed, {failed} failed")
+    print("=" * 60)
+
+    return failed == 0
+
+
+if __name__ == "__main__":
+    success = run_all_tests()
+    sys.exit(0 if success else 1)

test_rate_limit_utils.py

@@ -0,0 +1,205 @@
+"""
+Unit tests for rate limit handling functions.
+
+Tests the parse_retry_after(), is_rate_limit_error(), and backoff calculation
+functions from rate_limit_utils.py (shared module).
+"""
+
+import unittest
+
+from rate_limit_utils import (
+    calculate_error_backoff,
+    calculate_rate_limit_backoff,
+    clamp_retry_delay,
+    is_rate_limit_error,
+    parse_retry_after,
+)
+
+
+class TestParseRetryAfter(unittest.TestCase):
+    """Tests for parse_retry_after() function."""
+
+    def test_retry_after_colon_format(self):
+        """Test 'Retry-After: 60' format."""
+        assert parse_retry_after("Retry-After: 60") == 60
+        assert parse_retry_after("retry-after: 120") == 120
+        assert parse_retry_after("retry after: 30 seconds") == 30
+
+    def test_retry_after_space_format(self):
+        """Test 'retry after 60 seconds' format."""
+        assert parse_retry_after("retry after 60 seconds") == 60
+        assert parse_retry_after("Please retry after 120 seconds") == 120
+        assert parse_retry_after("Retry after 30") == 30
+
+    def test_try_again_in_format(self):
+        """Test 'try again in X seconds' format."""
+        assert parse_retry_after("try again in 120 seconds") == 120
+        assert parse_retry_after("Please try again in 60s") == 60
+        assert parse_retry_after("Try again in 30 seconds") == 30
+
+    def test_seconds_remaining_format(self):
+        """Test 'X seconds remaining' format."""
+        assert parse_retry_after("30 seconds remaining") == 30
+        assert parse_retry_after("60 seconds left") == 60
+        assert parse_retry_after("120 seconds until reset") == 120
+
+    def test_retry_after_zero(self):
+        """Test 'Retry-After: 0' returns 0 (not None)."""
+        assert parse_retry_after("Retry-After: 0") == 0
+        assert parse_retry_after("retry after 0 seconds") == 0
+
+    def test_no_match(self):
+        """Test messages that don't contain retry-after info."""
+        assert parse_retry_after("no match here") is None
+        assert parse_retry_after("Connection refused") is None
+        assert parse_retry_after("Internal server error") is None
+        assert parse_retry_after("") is None
+
+    def test_minutes_not_supported(self):
+        """Test that minutes are not parsed (by design)."""
+        # We only support seconds to avoid complexity
+        # These patterns should NOT match when followed by minute/hour units
+        assert parse_retry_after("wait 5 minutes") is None
+        assert parse_retry_after("try again in 2 minutes") is None
+        assert parse_retry_after("retry after 5 minutes") is None
+        assert parse_retry_after("retry after 1 hour") is None
+        assert parse_retry_after("try again in 30 min") is None
+
+
+class TestIsRateLimitError(unittest.TestCase):
+    """Tests for is_rate_limit_error() function."""
+
+    def test_rate_limit_patterns(self):
+        """Test various rate limit error messages."""
+        assert is_rate_limit_error("Rate limit exceeded") is True
+        assert is_rate_limit_error("rate_limit_exceeded") is True
+        assert is_rate_limit_error("Too many requests") is True
+        assert is_rate_limit_error("HTTP 429 Too Many Requests") is True
+        assert is_rate_limit_error("API quota exceeded") is True
+        assert is_rate_limit_error("Server is overloaded") is True
+
+    def test_specific_429_patterns(self):
+        """Test that 429 is detected with proper context."""
+        assert is_rate_limit_error("http 429") is True
+        assert is_rate_limit_error("HTTP429") is True
+        assert is_rate_limit_error("status 429") is True
+        assert is_rate_limit_error("error 429") is True
+        assert is_rate_limit_error("429 too many requests") is True
+
+    def test_case_insensitive(self):
+        """Test that detection is case-insensitive."""
+        assert is_rate_limit_error("RATE LIMIT") is True
+        assert is_rate_limit_error("Rate Limit") is True
+        assert is_rate_limit_error("rate limit") is True
+        assert is_rate_limit_error("RaTe LiMiT") is True
+
+    def test_non_rate_limit_errors(self):
+        """Test non-rate-limit error messages."""
+        assert is_rate_limit_error("Connection refused") is False
+        assert is_rate_limit_error("Authentication failed") is False
+        assert is_rate_limit_error("Invalid API key") is False
+        assert is_rate_limit_error("Internal server error") is False
+        assert is_rate_limit_error("Network timeout") is False
+        assert is_rate_limit_error("") is False
+
+
+class TestFalsePositives(unittest.TestCase):
+    """Verify non-rate-limit messages don't trigger detection."""
+
+    def test_version_numbers_with_429(self):
+        """Version numbers should not trigger."""
+        assert is_rate_limit_error("Node v14.29.0") is False
+        assert is_rate_limit_error("Python 3.12.429") is False
+        assert is_rate_limit_error("Version 2.429 released") is False
+
+    def test_issue_and_pr_numbers(self):
+        """Issue/PR numbers should not trigger."""
+        assert is_rate_limit_error("See PR #429") is False
+        assert is_rate_limit_error("Fixed in issue 429") is False
+        assert is_rate_limit_error("Closes #429") is False
+
+    def test_line_numbers(self):
+        """Line numbers in errors should not trigger."""
+        assert is_rate_limit_error("Error at line 429") is False
+        assert is_rate_limit_error("See file.py:429") is False
+
+    def test_port_numbers(self):
+        """Port numbers should not trigger."""
+        assert is_rate_limit_error("port 4293") is False
+        assert is_rate_limit_error("localhost:4290") is False
+
+    def test_legitimate_wait_messages(self):
+        """Legitimate wait instructions should not trigger."""
+        # These would fail if "please wait" pattern still exists
+        assert is_rate_limit_error("Please wait for the build to complete") is False
+        assert is_rate_limit_error("Please wait while I analyze this") is False
+
+    def test_retry_discussion_messages(self):
+        """Messages discussing retry logic should not trigger."""
+        # These would fail if "try again later" pattern still exists
+        assert is_rate_limit_error("Try again later after maintenance") is False
+        assert is_rate_limit_error("The user should try again later") is False
+
+    def test_limit_discussion_messages(self):
+        """Messages discussing limits should not trigger (removed pattern)."""
+        # These would fail if "limit reached" pattern still exists
+        assert is_rate_limit_error("File size limit reached") is False
+        assert is_rate_limit_error("Memory limit reached, consider optimization") is False
+
+    def test_overloaded_in_programming_context(self):
+        """Method/operator overloading discussions should not trigger."""
+        assert is_rate_limit_error("I will create an overloaded constructor") is False
+        assert is_rate_limit_error("The + operator is overloaded") is False
+        assert is_rate_limit_error("Here is the overloaded version of the function") is False
+        assert is_rate_limit_error("The method is overloaded to accept different types") is False
+        # But actual API overload messages should still match
+        assert is_rate_limit_error("Server is overloaded") is True
+        assert is_rate_limit_error("API overloaded") is True
+        assert is_rate_limit_error("system is overloaded") is True
+
+
+class TestBackoffFunctions(unittest.TestCase):
+    """Test backoff calculation functions from rate_limit_utils."""
+
+    def test_rate_limit_backoff_sequence(self):
+        """Test that rate limit backoff follows expected exponential sequence with jitter.
+
+        Base formula: 15 * 2^retries with 0-30% jitter.
+        Base values: 15, 30, 60, 120, 240, 480, 960, 1920, 3600, 3600
+        With jitter the result should be in [base, base * 1.3].
+        """
+        base_values = [15, 30, 60, 120, 240, 480, 960, 1920, 3600, 3600]
+        for retries, base in enumerate(base_values):
+            delay = calculate_rate_limit_backoff(retries)
+            # Delay must be at least the base value (jitter is non-negative)
+            assert delay >= base, f"Retry {retries}: {delay} < base {base}"
+            # Delay must not exceed base + 30% jitter (int truncation means <= base * 1.3)
+            max_with_jitter = int(base * 1.3)
+            assert delay <= max_with_jitter, f"Retry {retries}: {delay} > max {max_with_jitter}"
+
+    def test_error_backoff_sequence(self):
+        """Test that error backoff follows expected linear sequence."""
+        expected = [30, 60, 90, 120, 150, 180, 210, 240, 270, 300, 300]  # Caps at 300
+        for retries in range(1, len(expected) + 1):
+            delay = calculate_error_backoff(retries)
+            expected_delay = expected[retries - 1]
+            assert delay == expected_delay, f"Retry {retries}: expected {expected_delay}, got {delay}"
+
+    def test_clamp_retry_delay(self):
+        """Test that retry delay is clamped to valid range."""
+        # Values within range stay the same
+        assert clamp_retry_delay(60) == 60
+        assert clamp_retry_delay(1800) == 1800
+        assert clamp_retry_delay(3600) == 3600
+
+        # Values below minimum get clamped to 1
+        assert clamp_retry_delay(0) == 1
+        assert clamp_retry_delay(-10) == 1
+
+        # Values above maximum get clamped to 3600
+        assert clamp_retry_delay(7200) == 3600
+        assert clamp_retry_delay(86400) == 3600
+
+
+if __name__ == "__main__":
+    unittest.main()

test_security.py

@@ -18,11 +18,13 @@ from security import (
     bash_security_hook,
     extract_commands,
     get_effective_commands,
+    get_effective_pkill_processes,
     load_org_config,
     load_project_commands,
     matches_pattern,
     validate_chmod_command,
     validate_init_script,
+    validate_pkill_command,
     validate_project_command,
 )
 
@@ -105,6 +107,8 @@ def test_extract_commands():
         ("/usr/bin/node script.js", ["node"]),
         ("VAR=value ls", ["ls"]),
         ("git status || git init", ["git", "git"]),
+        # Fallback parser test: complex nested quotes that break shlex
+        ('docker exec container php -r "echo \\"test\\";"', ["docker"]),
     ]
 
     for cmd, expected in test_cases:
@@ -451,6 +455,21 @@ commands:
             print("  FAIL: Non-allowed command 'rustc' should be blocked")
             failed += 1
 
+        # Test 4: Empty command name is rejected
+        config_path.write_text("""version: 1
+commands:
+  - name: ""
+    description: Empty name should be rejected
+""")
+        result = load_project_commands(project_dir)
+        if result is None:
+            print("  PASS: Empty command name rejected in project config")
+            passed += 1
+        else:
+            print("  FAIL: Empty command name should be rejected in project config")
+            print(f"         Got: {result}")
+            failed += 1
+
     return passed, failed
 
 
@@ -670,6 +689,240 @@ blocked_commands:
     return passed, failed
 
 
+def test_pkill_extensibility():
+    """Test that pkill processes can be extended via config."""
+    print("\nTesting pkill process extensibility:\n")
+    passed = 0
+    failed = 0
+
+    # Test 1: Default processes work without config
+    allowed, reason = validate_pkill_command("pkill node")
+    if allowed:
+        print("  PASS: Default process 'node' allowed")
+        passed += 1
+    else:
+        print(f"  FAIL: Default process 'node' should be allowed: {reason}")
+        failed += 1
+
+    # Test 2: Non-default process blocked without config
+    allowed, reason = validate_pkill_command("pkill python")
+    if not allowed:
+        print("  PASS: Non-default process 'python' blocked without config")
+        passed += 1
+    else:
+        print("  FAIL: Non-default process 'python' should be blocked without config")
+        failed += 1
+
+    # Test 3: Extra processes allowed when passed
+    allowed, reason = validate_pkill_command("pkill python", extra_processes={"python"})
+    if allowed:
+        print("  PASS: Extra process 'python' allowed when configured")
+        passed += 1
+    else:
+        print(f"  FAIL: Extra process 'python' should be allowed when configured: {reason}")
+        failed += 1
+
+    # Test 4: Default processes still work with extra processes
+    allowed, reason = validate_pkill_command("pkill npm", extra_processes={"python"})
+    if allowed:
+        print("  PASS: Default process 'npm' still works with extra processes")
+        passed += 1
+    else:
+        print(f"  FAIL: Default process should still work: {reason}")
+        failed += 1
+
+    # Test 5: Test get_effective_pkill_processes with org config
+    with tempfile.TemporaryDirectory() as tmphome:
+        with tempfile.TemporaryDirectory() as tmpproject:
+            with temporary_home(tmphome):
+                org_dir = Path(tmphome) / ".autocoder"
+                org_dir.mkdir()
+                org_config_path = org_dir / "config.yaml"
+
+                # Create org config with extra pkill processes
+                org_config_path.write_text("""version: 1
+pkill_processes:
+  - python
+  - uvicorn
+""")
+
+                project_dir = Path(tmpproject)
+                processes = get_effective_pkill_processes(project_dir)
+
+                # Should include defaults + org processes
+                if "node" in processes and "python" in processes and "uvicorn" in processes:
+                    print("  PASS: Org pkill_processes merged with defaults")
+                    passed += 1
+                else:
+                    print(f"  FAIL: Expected node, python, uvicorn in {processes}")
+                    failed += 1
+
+    # Test 6: Test get_effective_pkill_processes with project config
+    with tempfile.TemporaryDirectory() as tmphome:
+        with tempfile.TemporaryDirectory() as tmpproject:
+            with temporary_home(tmphome):
+                project_dir = Path(tmpproject)
+                project_autocoder = project_dir / ".autocoder"
+                project_autocoder.mkdir()
+                project_config = project_autocoder / "allowed_commands.yaml"
+
+                # Create project config with extra pkill processes
+                project_config.write_text("""version: 1
+commands: []
+pkill_processes:
+  - gunicorn
+  - flask
+""")
+
+                processes = get_effective_pkill_processes(project_dir)
+
+                # Should include defaults + project processes
+                if "node" in processes and "gunicorn" in processes and "flask" in processes:
+                    print("  PASS: Project pkill_processes merged with defaults")
+                    passed += 1
+                else:
+                    print(f"  FAIL: Expected node, gunicorn, flask in {processes}")
+                    failed += 1
+
+    # Test 7: Integration test - pkill python blocked by default
+    with tempfile.TemporaryDirectory() as tmphome:
+        with tempfile.TemporaryDirectory() as tmpproject:
+            with temporary_home(tmphome):
+                project_dir = Path(tmpproject)
+                input_data = {"tool_name": "Bash", "tool_input": {"command": "pkill python"}}
+                context = {"project_dir": str(project_dir)}
+                result = asyncio.run(bash_security_hook(input_data, context=context))
+
+                if result.get("decision") == "block":
+                    print("  PASS: pkill python blocked without config")
+                    passed += 1
+                else:
+                    print("  FAIL: pkill python should be blocked without config")
+                    failed += 1
+
+    # Test 8: Integration test - pkill python allowed with org config
+    with tempfile.TemporaryDirectory() as tmphome:
+        with tempfile.TemporaryDirectory() as tmpproject:
+            with temporary_home(tmphome):
+                org_dir = Path(tmphome) / ".autocoder"
+                org_dir.mkdir()
+                org_config_path = org_dir / "config.yaml"
+
+                org_config_path.write_text("""version: 1
+pkill_processes:
+  - python
+""")
+
+                project_dir = Path(tmpproject)
+                input_data = {"tool_name": "Bash", "tool_input": {"command": "pkill python"}}
+                context = {"project_dir": str(project_dir)}
+                result = asyncio.run(bash_security_hook(input_data, context=context))
+
+                if result.get("decision") != "block":
+                    print("  PASS: pkill python allowed with org config")
+                    passed += 1
+                else:
+                    print(f"  FAIL: pkill python should be allowed with org config: {result}")
+                    failed += 1
+
+    # Test 9: Regex metacharacters should be rejected in pkill_processes
+    with tempfile.TemporaryDirectory() as tmphome:
+        with tempfile.TemporaryDirectory() as tmpproject:
+            with temporary_home(tmphome):
+                org_dir = Path(tmphome) / ".autocoder"
+                org_dir.mkdir()
+                org_config_path = org_dir / "config.yaml"
+
+                # Try to register a regex pattern (should be rejected)
+                org_config_path.write_text("""version: 1
+pkill_processes:
+  - ".*"
+""")
+
+                config = load_org_config()
+                if config is None:
+                    print("  PASS: Regex pattern '.*' rejected in pkill_processes")
+                    passed += 1
+                else:
+                    print("  FAIL: Regex pattern '.*' should be rejected")
+                    failed += 1
+
+    # Test 10: Valid process names with dots/underscores/hyphens should be accepted
+    with tempfile.TemporaryDirectory() as tmphome:
+        with tempfile.TemporaryDirectory() as tmpproject:
+            with temporary_home(tmphome):
+                org_dir = Path(tmphome) / ".autocoder"
+                org_dir.mkdir()
+                org_config_path = org_dir / "config.yaml"
+
+                # Valid names with special chars
+                org_config_path.write_text("""version: 1
+pkill_processes:
+  - my-app
+  - app_server
+  - node.js
+""")
+
+                config = load_org_config()
+                if config is not None and config.get("pkill_processes") == ["my-app", "app_server", "node.js"]:
+                    print("  PASS: Valid process names with dots/underscores/hyphens accepted")
+                    passed += 1
+                else:
+                    print(f"  FAIL: Valid process names should be accepted: {config}")
+                    failed += 1
+
+    # Test 11: Names with spaces should be rejected
+    with tempfile.TemporaryDirectory() as tmphome:
+        with tempfile.TemporaryDirectory() as tmpproject:
+            with temporary_home(tmphome):
+                org_dir = Path(tmphome) / ".autocoder"
+                org_dir.mkdir()
+                org_config_path = org_dir / "config.yaml"
+
+                org_config_path.write_text("""version: 1
+pkill_processes:
+  - "my app"
+""")
+
+                config = load_org_config()
+                if config is None:
+                    print("  PASS: Process name with space rejected")
+                    passed += 1
+                else:
+                    print("  FAIL: Process name with space should be rejected")
+                    failed += 1
+
+    # Test 12: Multiple patterns - all must be allowed (BSD behavior)
+    # On BSD, "pkill node sshd" would kill both, so we must validate all patterns
+    allowed, reason = validate_pkill_command("pkill node npm")
+    if allowed:
+        print("  PASS: Multiple allowed patterns accepted")
+        passed += 1
+    else:
+        print(f"  FAIL: Multiple allowed patterns should be accepted: {reason}")
+        failed += 1
+
+    # Test 13: Multiple patterns - block if any is disallowed
+    allowed, reason = validate_pkill_command("pkill node sshd")
+    if not allowed:
+        print("  PASS: Multiple patterns blocked when one is disallowed")
+        passed += 1
+    else:
+        print("  FAIL: Should block when any pattern is disallowed")
+        failed += 1
+
+    # Test 14: Multiple patterns - only first allowed, second disallowed
+    allowed, reason = validate_pkill_command("pkill npm python")
+    if not allowed:
+        print("  PASS: Multiple patterns blocked (first allowed, second not)")
+        passed += 1
+    else:
+        print("  FAIL: Should block when second pattern is disallowed")
+        failed += 1
+
+    return passed, failed
+
+
 def main():
     print("=" * 70)
     print("  SECURITY HOOK TESTS")
@@ -733,32 +986,32 @@ def main():
     passed += org_block_passed
     failed += org_block_failed
 
+    # Test pkill process extensibility
+    pkill_passed, pkill_failed = test_pkill_extensibility()
+    passed += pkill_passed
+    failed += pkill_failed
+
     # Commands that SHOULD be blocked
+    # Note: blocklisted commands (sudo, shutdown, dd, aws) are tested in
+    # test_blocklist_enforcement(). chmod validation is tested in
+    # test_validate_chmod(). init.sh validation is tested in
+    # test_validate_init_script(). pkill validation is tested in
+    # test_pkill_extensibility(). The entries below focus on scenarios
+    # NOT covered by those dedicated tests.
     print("\nCommands that should be BLOCKED:\n")
     dangerous = [
         # Not in allowlist - dangerous system commands
-        "shutdown now",
         "reboot",
-        "dd if=/dev/zero of=/dev/sda",
         # Not in allowlist - common commands excluded from minimal set
         "wget https://example.com",
         "python app.py",
         "killall node",
-        # pkill with non-dev processes
+        # pkill with non-dev processes (pkill python tested in test_pkill_extensibility)
         "pkill bash",
         "pkill chrome",
-        "pkill python",
         # Shell injection attempts
         "$(echo pkill) node",
         'eval "pkill node"',
-        # chmod with disallowed modes
-        "chmod 777 file.sh",
-        "chmod 755 file.sh",
-        "chmod +w file.sh",
-        "chmod -R +x dir/",
-        # Non-init.sh scripts
-        "./setup.sh",
-        "./malicious.sh",
     ]
 
     for cmd in dangerous:
@@ -768,6 +1021,10 @@ def main():
             failed += 1
 
     # Commands that SHOULD be allowed
+    # Note: chmod +x variants are tested in test_validate_chmod().
+    # init.sh variants are tested in test_validate_init_script().
+    # The combined "chmod +x init.sh && ./init.sh" below serves as the
+    # integration test verifying the hook routes to both validators correctly.
     print("\nCommands that should be ALLOWED:\n")
     safe = [
         # File inspection
@@ -818,16 +1075,7 @@ def main():
         "ls | grep test",
         # Full paths
         "/usr/local/bin/node app.js",
-        # chmod +x (allowed)
-        "chmod +x init.sh",
-        "chmod +x script.sh",
-        "chmod u+x init.sh",
-        "chmod a+x init.sh",
-        # init.sh execution (allowed)
-        "./init.sh",
-        "./init.sh --production",
-        "/path/to/init.sh",
-        # Combined chmod and init.sh
+        # Combined chmod and init.sh (integration test for both validators)
         "chmod +x init.sh && ./init.sh",
     ]
 

ui/components.json

@@ -0,0 +1,22 @@
+{
+  "$schema": "https://ui.shadcn.com/schema.json",
+  "style": "new-york",
+  "rsc": false,
+  "tsx": true,
+  "tailwind": {
+    "config": "",
+    "css": "src/styles/globals.css",
+    "baseColor": "neutral",
+    "cssVariables": true,
+    "prefix": ""
+  },
+  "iconLibrary": "lucide",
+  "aliases": {
+    "components": "@/components",
+    "utils": "@/lib/utils",
+    "ui": "@/components/ui",
+    "lib": "@/lib",
+    "hooks": "@/hooks"
+  },
+  "registries": {}
+}

ui/index.html

@@ -7,7 +7,7 @@
     <title>AutoCoder</title>
     <link rel="preconnect" href="https://fonts.googleapis.com">
     <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
-    <link href="https://fonts.googleapis.com/css2?family=Archivo+Black&family=Work+Sans:wght@400;500;600;700&family=JetBrains+Mono:wght@400;500;600&display=swap" rel="stylesheet">
+    <link href="https://fonts.googleapis.com/css2?family=Archivo+Black&family=Work+Sans:wght@400;500;600;700&family=JetBrains+Mono:wght@400;500;600&family=DM+Sans:wght@400;500;700&family=Space+Mono:wght@400;700&family=Outfit:wght@400;500;600;700&family=Inter:wght@400;500;600;700&display=swap" rel="stylesheet">
   </head>
   <body>
     <div id="root"></div>

ui/package.json

@@ -12,37 +12,45 @@
     "test:e2e:ui": "playwright test --ui"
   },
   "dependencies": {
-    "@radix-ui/react-dialog": "^1.1.2",
-    "@radix-ui/react-dropdown-menu": "^2.1.2",
-    "@radix-ui/react-tooltip": "^1.1.3",
-    "@tanstack/react-query": "^5.60.0",
+    "@radix-ui/react-checkbox": "^1.3.3",
+    "@radix-ui/react-dialog": "^1.1.15",
+    "@radix-ui/react-dropdown-menu": "^2.1.16",
+    "@radix-ui/react-label": "^2.1.8",
+    "@radix-ui/react-separator": "^1.1.8",
+    "@radix-ui/react-slot": "^1.2.4",
+    "@radix-ui/react-switch": "^1.2.6",
+    "@tanstack/react-query": "^5.72.0",
     "@xterm/addon-fit": "^0.11.0",
     "@xterm/addon-web-links": "^0.12.0",
     "@xterm/xterm": "^6.0.0",
     "@xyflow/react": "^12.10.0",
     "canvas-confetti": "^1.9.4",
+    "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
     "dagre": "^0.8.5",
-    "lucide-react": "^0.460.0",
-    "react": "^18.3.1",
-    "react-dom": "^18.3.1"
+    "lucide-react": "^0.475.0",
+    "react": "^19.0.0",
+    "react-dom": "^19.0.0",
+    "tailwind-merge": "^3.4.0"
   },
   "devDependencies": {
-    "@eslint/js": "^9.13.0",
+    "@eslint/js": "^9.19.0",
     "@playwright/test": "^1.57.0",
-    "@tailwindcss/vite": "^4.0.0-beta.4",
+    "@tailwindcss/vite": "^4.1.0",
     "@types/canvas-confetti": "^1.9.0",
     "@types/dagre": "^0.7.53",
-    "@types/react": "^18.3.12",
-    "@types/react-dom": "^18.3.1",
-    "@vitejs/plugin-react": "^4.3.3",
-    "eslint": "^9.13.0",
-    "eslint-plugin-react-hooks": "^5.0.0",
-    "eslint-plugin-react-refresh": "^0.4.14",
-    "globals": "^15.11.0",
-    "tailwindcss": "^4.0.0-beta.4",
-    "typescript": "~5.6.2",
-    "typescript-eslint": "^8.11.0",
-    "vite": "^5.4.10"
+    "@types/node": "^22.12.0",
+    "@types/react": "^19.0.0",
+    "@types/react-dom": "^19.0.0",
+    "@vitejs/plugin-react": "^4.4.0",
+    "eslint": "^9.19.0",
+    "eslint-plugin-react-hooks": "^5.1.0",
+    "eslint-plugin-react-refresh": "^0.4.19",
+    "globals": "^15.14.0",
+    "tailwindcss": "^4.1.0",
+    "tw-animate-css": "^1.4.0",
+    "typescript": "~5.7.3",
+    "typescript-eslint": "^8.23.0",
+    "vite": "^7.3.0"
   }
 }

ui/src/App.tsx

@@ -4,6 +4,7 @@ import { useProjects, useFeatures, useAgentStatus, useSettings } from './hooks/u
 import { useProjectWebSocket } from './hooks/useWebSocket'
 import { useFeatureSound } from './hooks/useFeatureSound'
 import { useCelebration } from './hooks/useCelebration'
+import { useTheme } from './hooks/useTheme'
 import { ProjectSelector } from './components/ProjectSelector'
 import { KanbanBoard } from './components/KanbanBoard'
 import { AgentControl } from './components/AgentControl'
@@ -12,7 +13,6 @@ import { SetupWizard } from './components/SetupWizard'
 import { AddFeatureForm } from './components/AddFeatureForm'
 import { FeatureModal } from './components/FeatureModal'
 import { DebugLogViewer, type TabType } from './components/DebugLogViewer'
-import { AgentThought } from './components/AgentThought'
 import { AgentMissionControl } from './components/AgentMissionControl'
 import { CelebrationOverlay } from './components/CelebrationOverlay'
 import { AssistantFAB } from './components/AssistantFAB'
@@ -24,14 +24,24 @@ import { DevServerControl } from './components/DevServerControl'
 import { ViewToggle, type ViewMode } from './components/ViewToggle'
 import { DependencyGraph } from './components/DependencyGraph'
 import { KeyboardShortcutsHelp } from './components/KeyboardShortcutsHelp'
-import { getDependencyGraph } from './lib/api'
-import { Loader2, Settings, Moon, Sun } from 'lucide-react'
+import { ThemeSelector } from './components/ThemeSelector'
+import { ResetProjectModal } from './components/ResetProjectModal'
+import { ProjectSetupRequired } from './components/ProjectSetupRequired'
+import { getDependencyGraph, startAgent } from './lib/api'
+import { Loader2, Settings, Moon, Sun, RotateCcw } from 'lucide-react'
 import type { Feature } from './lib/types'
+import { Button } from '@/components/ui/button'
+import { Card, CardContent } from '@/components/ui/card'
+import { Badge } from '@/components/ui/badge'
 
 const STORAGE_KEY = 'autocoder-selected-project'
-const DARK_MODE_KEY = 'autocoder-dark-mode'
 const VIEW_MODE_KEY = 'autocoder-view-mode'
 
+// Bottom padding for main content when debug panel is collapsed (40px header + 8px margin)
+const COLLAPSED_DEBUG_PANEL_CLEARANCE = 48
+
+type InitializerStatus = 'idle' | 'starting' | 'error'
+
 function App() {
   // Initialize selected project from localStorage
   const [selectedProject, setSelectedProject] = useState<string | null>(() => {
@@ -52,14 +62,10 @@ function App() {
   const [showSettings, setShowSettings] = useState(false)
   const [showKeyboardHelp, setShowKeyboardHelp] = useState(false)
   const [isSpecCreating, setIsSpecCreating] = useState(false)
+  const [showResetModal, setShowResetModal] = useState(false)
   const [showSpecChat, setShowSpecChat] = useState(false)  // For "Create Spec" button in empty kanban
-  const [darkMode, setDarkMode] = useState(() => {
-    try {
-      return localStorage.getItem(DARK_MODE_KEY) === 'true'
-    } catch {
-      return false
-    }
-  })
+  const [specInitializerStatus, setSpecInitializerStatus] = useState<InitializerStatus>('idle')
+  const [specInitializerError, setSpecInitializerError] = useState<string | null>(null)
   const [viewMode, setViewMode] = useState<ViewMode>(() => {
     try {
       const stored = localStorage.getItem(VIEW_MODE_KEY)
@@ -75,6 +81,7 @@ function App() {
   const { data: settings } = useSettings()
   useAgentStatus(selectedProject) // Keep polling for status updates
   const wsState = useProjectWebSocket(selectedProject)
+  const { theme, setTheme, darkMode, toggleDarkMode, themes } = useTheme()
 
   // Get has_spec from the selected project
   const selectedProjectData = projects?.find(p => p.name === selectedProject)
@@ -88,20 +95,6 @@ function App() {
     refetchInterval: 5000, // Refresh every 5 seconds
   })
 
-  // Apply dark mode class to document
-  useEffect(() => {
-    if (darkMode) {
-      document.documentElement.classList.add('dark')
-    } else {
-      document.documentElement.classList.remove('dark')
-    }
-    try {
-      localStorage.setItem(DARK_MODE_KEY, String(darkMode))
-    } catch {
-      // localStorage not available
-    }
-  }, [darkMode])
-
   // Persist view mode to localStorage
   useEffect(() => {
     try {
@@ -216,10 +209,18 @@ function App() {
         setShowKeyboardHelp(true)
       }
 
+      // R : Open reset modal (when project selected and agent not running)
+      if ((e.key === 'r' || e.key === 'R') && selectedProject && wsState.agentStatus !== 'running') {
+        e.preventDefault()
+        setShowResetModal(true)
+      }
+
       // Escape : Close modals
       if (e.key === 'Escape') {
         if (showKeyboardHelp) {
           setShowKeyboardHelp(false)
+        } else if (showResetModal) {
+          setShowResetModal(false)
         } else if (showExpandProject) {
           setShowExpandProject(false)
         } else if (showSettings) {
@@ -238,7 +239,7 @@ function App() {
 
     window.addEventListener('keydown', handleKeyDown)
     return () => window.removeEventListener('keydown', handleKeyDown)
-  }, [selectedProject, showAddFeature, showExpandProject, selectedFeature, debugOpen, debugActiveTab, assistantOpen, features, showSettings, showKeyboardHelp, isSpecCreating, viewMode])
+  }, [selectedProject, showAddFeature, showExpandProject, selectedFeature, debugOpen, debugActiveTab, assistantOpen, features, showSettings, showKeyboardHelp, isSpecCreating, viewMode, showResetModal, wsState.agentStatus])
 
   // Combine WebSocket progress with feature data
   const progress = wsState.progress.total > 0 ? wsState.progress : {
@@ -256,9 +257,9 @@ function App() {
   }
 
   return (
-    <div className="min-h-screen bg-neo-bg">
+    <div className="min-h-screen bg-background">
       {/* Header */}
-      <header className="bg-neo-card text-neo-text border-b-4 border-neo-border">
+      <header className="sticky top-0 z-50 bg-card/80 backdrop-blur-md text-foreground border-b-2 border-border">
         <div className="max-w-7xl mx-auto px-4 py-4">
           <div className="flex items-center justify-between">
             {/* Logo and Title */}
@@ -281,6 +282,7 @@ function App() {
                   <AgentControl
                     projectName={selectedProject}
                     status={wsState.agentStatus}
+                    defaultConcurrency={selectedProjectData?.default_concurrency}
                   />
 
                   <DevServerControl
@@ -289,36 +291,67 @@ function App() {
                     url={wsState.devServerUrl}
                   />
 
-                  <button
+                  <Button
                     onClick={() => setShowSettings(true)}
-                    className="neo-btn text-sm py-2 px-3"
+                    variant="outline"
+                    size="sm"
                     title="Settings (,)"
                     aria-label="Open Settings"
                   >
                     <Settings size={18} />
-                  </button>
+                  </Button>
+
+                  <Button
+                    onClick={() => setShowResetModal(true)}
+                    variant="outline"
+                    size="sm"
+                    title="Reset Project (R)"
+                    aria-label="Reset Project"
+                    disabled={wsState.agentStatus === 'running'}
+                  >
+                    <RotateCcw size={18} />
+                  </Button>
+
+                  {/* Ollama Mode Indicator */}
+                  {settings?.ollama_mode && (
+                    <div
+                      className="flex items-center gap-1.5 px-2 py-1 bg-card rounded border-2 border-border shadow-sm"
+                      title="Using Ollama local models (configured via .env)"
+                    >
+                      <img src="/ollama.png" alt="Ollama" className="w-5 h-5" />
+                      <span className="text-xs font-bold text-foreground">Ollama</span>
+                    </div>
+                  )}
 
                   {/* GLM Mode Badge */}
                   {settings?.glm_mode && (
-                    <span
-                      className="px-2 py-1 text-xs font-bold bg-[var(--color-neo-glm)] text-white rounded border-2 border-neo-border shadow-neo-sm"
+                    <Badge
+                      className="bg-purple-500 text-white hover:bg-purple-600"
                       title="Using GLM API (configured via .env)"
                     >
                       GLM
-                    </span>
+                    </Badge>
                   )}
                 </>
               )}
 
+              {/* Theme selector */}
+              <ThemeSelector
+                themes={themes}
+                currentTheme={theme}
+                onThemeChange={setTheme}
+              />
+
               {/* Dark mode toggle - always visible */}
-              <button
-                onClick={() => setDarkMode(!darkMode)}
-                className="neo-btn text-sm py-2 px-3"
+              <Button
+                onClick={toggleDarkMode}
+                variant="outline"
+                size="sm"
                 title="Toggle dark mode"
                 aria-label="Toggle dark mode"
               >
                 {darkMode ? <Sun size={18} /> : <Moon size={18} />}
-              </button>
+              </Button>
             </div>
           </div>
         </div>
@@ -327,17 +360,27 @@ function App() {
       {/* Main Content */}
       <main
         className="max-w-7xl mx-auto px-4 py-8"
-        style={{ paddingBottom: debugOpen ? debugPanelHeight + 32 : undefined }}
+        style={{ paddingBottom: debugOpen ? debugPanelHeight + 32 : COLLAPSED_DEBUG_PANEL_CLEARANCE }}
       >
         {!selectedProject ? (
-          <div className="neo-empty-state mt-12">
+          <div className="text-center mt-12">
             <h2 className="font-display text-2xl font-bold mb-2">
               Welcome to AutoCoder
             </h2>
-            <p className="text-neo-text-secondary mb-4">
+            <p className="text-muted-foreground mb-4">
               Select a project from the dropdown above or create a new one to get started.
             </p>
           </div>
+        ) : !hasSpec ? (
+          <ProjectSetupRequired
+            projectName={selectedProject}
+            projectPath={selectedProjectData?.path}
+            onCreateWithClaude={() => setShowSpecChat(true)}
+            onEditManually={() => {
+              // Open debug panel for the user to see the project path
+              setDebugOpen(true)
+            }}
+          />
         ) : (
           <div className="space-y-8">
             {/* Progress Dashboard */}
@@ -346,6 +389,8 @@ function App() {
               total={progress.total}
               percentage={progress.percentage}
               isConnected={wsState.isConnected}
+              logs={wsState.activeAgents.length === 0 ? wsState.logs : undefined}
+              agentStatus={wsState.activeAgents.length === 0 ? wsState.agentStatus : undefined}
             />
 
             {/* Agent Mission Control - shows orchestrator status and active agents in parallel mode */}
@@ -356,13 +401,6 @@ function App() {
               getAgentLogs={wsState.getAgentLogs}
             />
 
-            {/* Agent Thought - shows latest agent narrative (single agent mode) */}
-            {wsState.activeAgents.length === 0 && (
-              <AgentThought
-                logs={wsState.logs}
-                agentStatus={wsState.agentStatus}
-              />
-            )}
 
             {/* Initializing Features State - show when agent is running but no features yet */}
             {features &&
@@ -370,15 +408,17 @@ function App() {
              features.in_progress.length === 0 &&
              features.done.length === 0 &&
              wsState.agentStatus === 'running' && (
-              <div className="neo-card p-8 text-center">
-                <Loader2 size={32} className="animate-spin mx-auto mb-4 text-neo-progress" />
-                <h3 className="font-display font-bold text-xl mb-2">
-                  Initializing Features...
-                </h3>
-                <p className="text-neo-text-secondary">
-                  The agent is reading your spec and creating features. This may take a moment.
-                </p>
-              </div>
+              <Card className="p-8 text-center">
+                <CardContent className="p-0">
+                  <Loader2 size={32} className="animate-spin mx-auto mb-4 text-primary" />
+                  <h3 className="font-display font-bold text-xl mb-2">
+                    Initializing Features...
+                  </h3>
+                  <p className="text-muted-foreground">
+                    The agent is reading your spec and creating features. This may take a moment.
+                  </p>
+                </CardContent>
+              </Card>
             )}
 
             {/* View Toggle - only show when there are features */}
@@ -400,7 +440,7 @@ function App() {
                 hasSpec={hasSpec}
               />
             ) : (
-              <div className="neo-card overflow-hidden" style={{ height: '600px' }}>
+              <Card className="overflow-hidden" style={{ height: '600px' }}>
                 {graphData ? (
                   <DependencyGraph
                     graphData={graphData}
@@ -409,10 +449,10 @@ function App() {
                   />
                 ) : (
                   <div className="h-full flex items-center justify-center">
-                    <Loader2 size={32} className="animate-spin text-neo-progress" />
+                    <Loader2 size={32} className="animate-spin text-primary" />
                   </div>
                 )}
-              </div>
+              </Card>
             )}
           </div>
         )}
@@ -450,17 +490,34 @@ function App() {
 
       {/* Spec Creation Chat - for creating spec from empty kanban */}
       {showSpecChat && selectedProject && (
-        <div className="fixed inset-0 z-50 bg-[var(--color-neo-bg)]">
+        <div className="fixed inset-0 z-50 bg-background">
           <SpecCreationChat
             projectName={selectedProject}
-            onComplete={() => {
-              setShowSpecChat(false)
-              // Refresh projects to update has_spec
-              queryClient.invalidateQueries({ queryKey: ['projects'] })
-              queryClient.invalidateQueries({ queryKey: ['features', selectedProject] })
+            onComplete={async (_specPath, yoloMode) => {
+              setSpecInitializerStatus('starting')
+              try {
+                await startAgent(selectedProject, {
+                  yoloMode: yoloMode ?? false,
+                  maxConcurrency: 3,
+                })
+                // Success — close chat and refresh
+                setShowSpecChat(false)
+                setSpecInitializerStatus('idle')
+                queryClient.invalidateQueries({ queryKey: ['projects'] })
+                queryClient.invalidateQueries({ queryKey: ['features', selectedProject] })
+              } catch (err) {
+                setSpecInitializerStatus('error')
+                setSpecInitializerError(err instanceof Error ? err.message : 'Failed to start agent')
+              }
+            }}
+            onCancel={() => { setShowSpecChat(false); setSpecInitializerStatus('idle') }}
+            onExitToProject={() => { setShowSpecChat(false); setSpecInitializerStatus('idle') }}
+            initializerStatus={specInitializerStatus}
+            initializerError={specInitializerError}
+            onRetryInitializer={() => {
+              setSpecInitializerError(null)
+              setSpecInitializerStatus('idle')
             }}
-            onCancel={() => setShowSpecChat(false)}
-            onExitToProject={() => setShowSpecChat(false)}
           />
         </div>
       )}
@@ -497,13 +554,24 @@ function App() {
       )}
 
       {/* Settings Modal */}
-      {showSettings && (
-        <SettingsModal onClose={() => setShowSettings(false)} />
-      )}
+      <SettingsModal isOpen={showSettings} onClose={() => setShowSettings(false)} />
 
       {/* Keyboard Shortcuts Help */}
-      {showKeyboardHelp && (
-        <KeyboardShortcutsHelp onClose={() => setShowKeyboardHelp(false)} />
+      <KeyboardShortcutsHelp isOpen={showKeyboardHelp} onClose={() => setShowKeyboardHelp(false)} />
+
+      {/* Reset Project Modal */}
+      {showResetModal && selectedProject && (
+        <ResetProjectModal
+          isOpen={showResetModal}
+          projectName={selectedProject}
+          onClose={() => setShowResetModal(false)}
+          onResetComplete={(wasFullReset) => {
+            // If full reset, the spec was deleted - show spec creation chat
+            if (wasFullReset) {
+              setShowSpecChat(true)
+            }
+          }}
+        />
       )}
 
       {/* Celebration Overlay - shows when a feature is completed by an agent */}

ui/src/components/ActivityFeed.tsx

@@ -1,6 +1,7 @@
 import { Activity } from 'lucide-react'
 import { AgentAvatar } from './AgentAvatar'
 import type { AgentMascot } from '../lib/types'
+import { Card, CardContent } from '@/components/ui/card'
 
 interface ActivityItem {
   agentName: string
@@ -38,8 +39,8 @@ export function ActivityFeed({ activities, maxItems = 5, showHeader = true }: Ac
     <div>
       {showHeader && (
         <div className="flex items-center gap-2 mb-2">
-          <Activity size={14} className="text-neo-text-secondary" />
-          <span className="text-xs font-bold text-neo-text-secondary uppercase tracking-wide">
+          <Activity size={14} className="text-muted-foreground" />
+          <span className="text-xs font-semibold text-muted-foreground uppercase tracking-wide">
             Recent Activity
           </span>
         </div>
@@ -47,34 +48,36 @@ export function ActivityFeed({ activities, maxItems = 5, showHeader = true }: Ac
 
       <div className="space-y-2">
         {displayedActivities.map((activity) => (
-          <div
+          <Card
             key={`${activity.featureId}-${activity.timestamp}-${activity.thought.slice(0, 20)}`}
-            className="flex items-start gap-2 py-1.5 px-2 rounded bg-[var(--color-neo-bg)] border border-neo-border/20"
+            className="py-1.5"
           >
-            <AgentAvatar
-              name={activity.agentName as AgentMascot}
-              state="working"
-              size="sm"
-            />
-            <div className="flex-1 min-w-0">
-              <div className="flex items-center gap-2">
-                <span className="text-xs font-bold" style={{
-                  color: getMascotColor(activity.agentName as AgentMascot)
-                }}>
-                  {activity.agentName}
-                </span>
-                <span className="text-[10px] text-neo-text-muted">
-                  #{activity.featureId}
-                </span>
-                <span className="text-[10px] text-neo-text-muted ml-auto">
-                  {formatTimestamp(activity.timestamp)}
-                </span>
+            <CardContent className="p-2 flex items-start gap-2">
+              <AgentAvatar
+                name={activity.agentName as AgentMascot}
+                state="working"
+                size="sm"
+              />
+              <div className="flex-1 min-w-0">
+                <div className="flex items-center gap-2">
+                  <span className="text-xs font-semibold" style={{
+                    color: getMascotColor(activity.agentName as AgentMascot)
+                  }}>
+                    {activity.agentName}
+                  </span>
+                  <span className="text-[10px] text-muted-foreground">
+                    #{activity.featureId}
+                  </span>
+                  <span className="text-[10px] text-muted-foreground ml-auto">
+                    {formatTimestamp(activity.timestamp)}
+                  </span>
+                </div>
+                <p className="text-xs text-muted-foreground truncate" title={activity.thought}>
+                  {activity.thought}
+                </p>
               </div>
-              <p className="text-xs text-neo-text-secondary truncate" title={activity.thought}>
-                {activity.thought}
-              </p>
-            </div>
-          </div>
+            </CardContent>
+          </Card>
         ))}
       </div>
     </div>

ui/src/components/AddFeatureForm.tsx

@@ -1,6 +1,18 @@
 import { useState, useId } from 'react'
 import { X, Plus, Trash2, Loader2, AlertCircle } from 'lucide-react'
 import { useCreateFeature } from '../hooks/useProjects'
+import {
+  Dialog,
+  DialogContent,
+  DialogHeader,
+  DialogTitle,
+  DialogFooter,
+} from '@/components/ui/dialog'
+import { Button } from '@/components/ui/button'
+import { Input } from '@/components/ui/input'
+import { Textarea } from '@/components/ui/textarea'
+import { Label } from '@/components/ui/label'
+import { Alert, AlertDescription } from '@/components/ui/alert'
 
 interface Step {
   id: string
@@ -65,149 +77,135 @@ export function AddFeatureForm({ projectName, onClose }: AddFeatureFormProps) {
   const isValid = category.trim() && name.trim() && description.trim()
 
   return (
-    <div className="neo-modal-backdrop" onClick={onClose}>
-      <div
-        className="neo-modal w-full max-w-2xl"
-        onClick={(e) => e.stopPropagation()}
-      >
-        {/* Header */}
-        <div className="flex items-center justify-between p-6 border-b-3 border-[var(--color-neo-border)]">
-          <h2 className="font-display text-2xl font-bold">
-            Add Feature
-          </h2>
-          <button
-            onClick={onClose}
-            className="neo-btn neo-btn-ghost p-2"
-          >
-            <X size={24} />
-          </button>
-        </div>
+    <Dialog open={true} onOpenChange={(open) => !open && onClose()}>
+      <DialogContent className="sm:max-w-2xl">
+        <DialogHeader>
+          <DialogTitle>Add Feature</DialogTitle>
+        </DialogHeader>
 
-        {/* Form */}
-        <form onSubmit={handleSubmit} className="p-6 space-y-4">
+        <form onSubmit={handleSubmit} className="space-y-4">
           {/* Error Message */}
           {error && (
-            <div className="flex items-center gap-3 p-4 bg-[var(--color-neo-error-bg)] text-[var(--color-neo-error-text)] border-3 border-[var(--color-neo-error-border)]">
-              <AlertCircle size={20} />
-              <span>{error}</span>
-              <button
-                type="button"
-                onClick={() => setError(null)}
-                className="ml-auto hover:opacity-70 transition-opacity"
-              >
-                <X size={16} />
-              </button>
-            </div>
+            <Alert variant="destructive">
+              <AlertCircle className="h-4 w-4" />
+              <AlertDescription className="flex items-center justify-between">
+                <span>{error}</span>
+                <Button
+                  type="button"
+                  variant="ghost"
+                  size="icon-xs"
+                  onClick={() => setError(null)}
+                >
+                  <X size={14} />
+                </Button>
+              </AlertDescription>
+            </Alert>
           )}
 
           {/* Category & Priority Row */}
           <div className="flex gap-4">
-            <div className="flex-1">
-              <label className="block font-display font-bold mb-2 uppercase text-sm">
-                Category
-              </label>
-              <input
+            <div className="flex-1 space-y-2">
+              <Label htmlFor="category">Category</Label>
+              <Input
+                id="category"
                 type="text"
                 value={category}
                 onChange={(e) => setCategory(e.target.value)}
                 placeholder="e.g., Authentication, UI, API"
-                className="neo-input"
                 required
               />
             </div>
-            <div className="w-32">
-              <label className="block font-display font-bold mb-2 uppercase text-sm">
-                Priority
-              </label>
-              <input
+            <div className="w-32 space-y-2">
+              <Label htmlFor="priority">Priority</Label>
+              <Input
+                id="priority"
                 type="number"
                 value={priority}
                 onChange={(e) => setPriority(e.target.value)}
                 placeholder="Auto"
                 min="1"
-                className="neo-input"
               />
             </div>
           </div>
 
           {/* Name */}
-          <div>
-            <label className="block font-display font-bold mb-2 uppercase text-sm">
-              Feature Name
-            </label>
-            <input
+          <div className="space-y-2">
+            <Label htmlFor="name">Feature Name</Label>
+            <Input
+              id="name"
               type="text"
               value={name}
               onChange={(e) => setName(e.target.value)}
               placeholder="e.g., User login form"
-              className="neo-input"
               required
             />
           </div>
 
           {/* Description */}
-          <div>
-            <label className="block font-display font-bold mb-2 uppercase text-sm">
-              Description
-            </label>
-            <textarea
+          <div className="space-y-2">
+            <Label htmlFor="description">Description</Label>
+            <Textarea
+              id="description"
               value={description}
               onChange={(e) => setDescription(e.target.value)}
               placeholder="Describe what this feature should do..."
-              className="neo-input min-h-[100px] resize-y"
+              className="min-h-[100px] resize-y"
               required
             />
           </div>
 
           {/* Steps */}
-          <div>
-            <label className="block font-display font-bold mb-2 uppercase text-sm">
-              Test Steps (Optional)
-            </label>
+          <div className="space-y-2">
+            <Label>Test Steps (Optional)</Label>
             <div className="space-y-2">
               {steps.map((step, index) => (
                 <div key={step.id} className="flex gap-2 items-center">
-                  <span
-                    className="w-10 h-10 flex-shrink-0 flex items-center justify-center font-mono font-bold text-sm border-3 border-[var(--color-neo-border)] bg-[var(--color-neo-bg)] text-[var(--color-neo-text-secondary)]"
-                    style={{ boxShadow: 'var(--shadow-neo-sm)' }}
-                  >
+                  <span className="w-10 h-10 flex-shrink-0 flex items-center justify-center font-mono font-semibold text-sm border rounded-md bg-muted text-muted-foreground">
                     {index + 1}
                   </span>
-                  <input
+                  <Input
                     type="text"
                     value={step.value}
                     onChange={(e) => handleStepChange(step.id, e.target.value)}
                     placeholder="Describe this step..."
-                    className="neo-input flex-1"
+                    className="flex-1"
                   />
                   {steps.length > 1 && (
-                    <button
+                    <Button
                       type="button"
+                      variant="ghost"
+                      size="icon"
                       onClick={() => handleRemoveStep(step.id)}
-                      className="neo-btn neo-btn-ghost p-2"
                     >
                       <Trash2 size={18} />
-                    </button>
+                    </Button>
                   )}
                 </div>
               ))}
             </div>
-            <button
+            <Button
               type="button"
+              variant="ghost"
+              size="sm"
               onClick={handleAddStep}
-              className="neo-btn neo-btn-ghost mt-2 text-sm"
             >
               <Plus size={16} />
               Add Step
-            </button>
+            </Button>
           </div>
 
           {/* Actions */}
-          <div className="flex gap-3 pt-4 border-t-3 border-[var(--color-neo-border)]">
-            <button
+          <DialogFooter className="pt-4 border-t">
+            <Button
+              type="button"
+              variant="outline"
+              onClick={onClose}
+            >
+              Cancel
+            </Button>
+            <Button
               type="submit"
               disabled={!isValid || createFeature.isPending}
-              className="neo-btn neo-btn-success flex-1"
             >
               {createFeature.isPending ? (
                 <Loader2 size={18} className="animate-spin" />
@@ -217,17 +215,10 @@ export function AddFeatureForm({ projectName, onClose }: AddFeatureFormProps) {
                   Create Feature
                 </>
               )}
-            </button>
-            <button
-              type="button"
-              onClick={onClose}
-              className="neo-btn neo-btn-ghost"
-            >
-              Cancel
-            </button>
-          </div>
+            </Button>
+          </DialogFooter>
         </form>
-      </div>
-    </div>
+      </DialogContent>
+    </Dialog>
   )
 }

ui/src/components/AgentAvatar.tsx

@@ -1,4 +1,10 @@
 import { type AgentMascot, type AgentState } from '../lib/types'
+import {
+  AVATAR_COLORS,
+  UNKNOWN_COLORS,
+  MASCOT_SVGS,
+  UnknownMascotSVG,
+} from './mascotData'
 
 interface AgentAvatarProps {
   name: AgentMascot | 'Unknown'
@@ -7,515 +13,12 @@ interface AgentAvatarProps {
   showName?: boolean
 }
 
-// Fallback colors for unknown agents (neutral gray)
-const UNKNOWN_COLORS = { primary: '#6B7280', secondary: '#9CA3AF', accent: '#F3F4F6' }
-
-const AVATAR_COLORS: Record<AgentMascot, { primary: string; secondary: string; accent: string }> = {
-  // Original 5
-  Spark: { primary: '#3B82F6', secondary: '#60A5FA', accent: '#DBEAFE' },  // Blue robot
-  Fizz: { primary: '#F97316', secondary: '#FB923C', accent: '#FFEDD5' },   // Orange fox
-  Octo: { primary: '#8B5CF6', secondary: '#A78BFA', accent: '#EDE9FE' },   // Purple octopus
-  Hoot: { primary: '#22C55E', secondary: '#4ADE80', accent: '#DCFCE7' },   // Green owl
-  Buzz: { primary: '#EAB308', secondary: '#FACC15', accent: '#FEF9C3' },   // Yellow bee
-  // Tech-inspired
-  Pixel: { primary: '#EC4899', secondary: '#F472B6', accent: '#FCE7F3' },  // Pink
-  Byte: { primary: '#06B6D4', secondary: '#22D3EE', accent: '#CFFAFE' },   // Cyan
-  Nova: { primary: '#F43F5E', secondary: '#FB7185', accent: '#FFE4E6' },   // Rose
-  Chip: { primary: '#84CC16', secondary: '#A3E635', accent: '#ECFCCB' },   // Lime
-  Bolt: { primary: '#FBBF24', secondary: '#FCD34D', accent: '#FEF3C7' },   // Amber
-  // Energetic
-  Dash: { primary: '#14B8A6', secondary: '#2DD4BF', accent: '#CCFBF1' },   // Teal
-  Zap: { primary: '#A855F7', secondary: '#C084FC', accent: '#F3E8FF' },    // Violet
-  Gizmo: { primary: '#64748B', secondary: '#94A3B8', accent: '#F1F5F9' },  // Slate
-  Turbo: { primary: '#EF4444', secondary: '#F87171', accent: '#FEE2E2' },  // Red
-  Blip: { primary: '#10B981', secondary: '#34D399', accent: '#D1FAE5' },   // Emerald
-  // Playful
-  Neon: { primary: '#D946EF', secondary: '#E879F9', accent: '#FAE8FF' },   // Fuchsia
-  Widget: { primary: '#6366F1', secondary: '#818CF8', accent: '#E0E7FF' }, // Indigo
-  Zippy: { primary: '#F59E0B', secondary: '#FBBF24', accent: '#FEF3C7' },  // Orange-yellow
-  Quirk: { primary: '#0EA5E9', secondary: '#38BDF8', accent: '#E0F2FE' },  // Sky
-  Flux: { primary: '#7C3AED', secondary: '#8B5CF6', accent: '#EDE9FE' },   // Purple
-}
-
 const SIZES = {
   sm: { svg: 32, font: 'text-xs' },
   md: { svg: 48, font: 'text-sm' },
   lg: { svg: 64, font: 'text-base' },
 }
 
-// SVG mascot definitions - simple cute characters
-function SparkSVG({ colors, size }: { colors: typeof AVATAR_COLORS.Spark; size: number }) {
-  return (
-    <svg width={size} height={size} viewBox="0 0 64 64" fill="none">
-      {/* Robot body */}
-      <rect x="16" y="20" width="32" height="28" rx="4" fill={colors.primary} />
-      {/* Robot head */}
-      <rect x="12" y="8" width="40" height="24" rx="4" fill={colors.secondary} />
-      {/* Antenna */}
-      <circle cx="32" cy="4" r="4" fill={colors.primary} className="animate-pulse" />
-      <rect x="30" y="4" width="4" height="8" fill={colors.primary} />
-      {/* Eyes */}
-      <circle cx="24" cy="18" r="4" fill="white" />
-      <circle cx="40" cy="18" r="4" fill="white" />
-      <circle cx="25" cy="18" r="2" fill={colors.primary} />
-      <circle cx="41" cy="18" r="2" fill={colors.primary} />
-      {/* Mouth */}
-      <rect x="26" y="24" width="12" height="2" rx="1" fill="white" />
-      {/* Arms */}
-      <rect x="6" y="24" width="8" height="4" rx="2" fill={colors.primary} />
-      <rect x="50" y="24" width="8" height="4" rx="2" fill={colors.primary} />
-    </svg>
-  )
-}
-
-function FizzSVG({ colors, size }: { colors: typeof AVATAR_COLORS.Fizz; size: number }) {
-  return (
-    <svg width={size} height={size} viewBox="0 0 64 64" fill="none">
-      {/* Ears */}
-      <polygon points="12,12 20,28 4,28" fill={colors.primary} />
-      <polygon points="52,12 60,28 44,28" fill={colors.primary} />
-      <polygon points="14,14 18,26 8,26" fill={colors.accent} />
-      <polygon points="50,14 56,26 44,26" fill={colors.accent} />
-      {/* Head */}
-      <ellipse cx="32" cy="36" rx="24" ry="22" fill={colors.primary} />
-      {/* Face */}
-      <ellipse cx="32" cy="40" rx="18" ry="14" fill={colors.accent} />
-      {/* Eyes */}
-      <ellipse cx="24" cy="32" rx="4" ry="5" fill="white" />
-      <ellipse cx="40" cy="32" rx="4" ry="5" fill="white" />
-      <circle cx="25" cy="33" r="2" fill="#1a1a1a" />
-      <circle cx="41" cy="33" r="2" fill="#1a1a1a" />
-      {/* Nose */}
-      <ellipse cx="32" cy="42" rx="4" ry="3" fill={colors.primary} />
-      {/* Whiskers */}
-      <line x1="8" y1="38" x2="18" y2="40" stroke={colors.primary} strokeWidth="2" />
-      <line x1="8" y1="44" x2="18" y2="44" stroke={colors.primary} strokeWidth="2" />
-      <line x1="46" y1="40" x2="56" y2="38" stroke={colors.primary} strokeWidth="2" />
-      <line x1="46" y1="44" x2="56" y2="44" stroke={colors.primary} strokeWidth="2" />
-    </svg>
-  )
-}
-
-function OctoSVG({ colors, size }: { colors: typeof AVATAR_COLORS.Octo; size: number }) {
-  return (
-    <svg width={size} height={size} viewBox="0 0 64 64" fill="none">
-      {/* Tentacles */}
-      <path d="M12,48 Q8,56 12,60 Q16,64 20,58" fill={colors.secondary} />
-      <path d="M22,50 Q20,58 24,62" fill={colors.secondary} />
-      <path d="M32,52 Q32,60 36,62" fill={colors.secondary} />
-      <path d="M42,50 Q44,58 40,62" fill={colors.secondary} />
-      <path d="M52,48 Q56,56 52,60 Q48,64 44,58" fill={colors.secondary} />
-      {/* Head */}
-      <ellipse cx="32" cy="32" rx="22" ry="24" fill={colors.primary} />
-      {/* Eyes */}
-      <ellipse cx="24" cy="28" rx="6" ry="8" fill="white" />
-      <ellipse cx="40" cy="28" rx="6" ry="8" fill="white" />
-      <ellipse cx="25" cy="30" rx="3" ry="4" fill={colors.primary} />
-      <ellipse cx="41" cy="30" rx="3" ry="4" fill={colors.primary} />
-      {/* Smile */}
-      <path d="M24,42 Q32,48 40,42" stroke={colors.accent} strokeWidth="2" fill="none" strokeLinecap="round" />
-    </svg>
-  )
-}
-
-function HootSVG({ colors, size }: { colors: typeof AVATAR_COLORS.Hoot; size: number }) {
-  return (
-    <svg width={size} height={size} viewBox="0 0 64 64" fill="none">
-      {/* Ear tufts */}
-      <polygon points="14,8 22,24 6,20" fill={colors.primary} />
-      <polygon points="50,8 58,20 42,24" fill={colors.primary} />
-      {/* Body */}
-      <ellipse cx="32" cy="40" rx="20" ry="18" fill={colors.primary} />
-      {/* Head */}
-      <circle cx="32" cy="28" r="20" fill={colors.secondary} />
-      {/* Eye circles */}
-      <circle cx="24" cy="26" r="10" fill={colors.accent} />
-      <circle cx="40" cy="26" r="10" fill={colors.accent} />
-      {/* Eyes */}
-      <circle cx="24" cy="26" r="6" fill="white" />
-      <circle cx="40" cy="26" r="6" fill="white" />
-      <circle cx="25" cy="27" r="3" fill="#1a1a1a" />
-      <circle cx="41" cy="27" r="3" fill="#1a1a1a" />
-      {/* Beak */}
-      <polygon points="32,32 28,40 36,40" fill="#F97316" />
-      {/* Belly */}
-      <ellipse cx="32" cy="46" rx="10" ry="8" fill={colors.accent} />
-    </svg>
-  )
-}
-
-function BuzzSVG({ colors, size }: { colors: typeof AVATAR_COLORS.Buzz; size: number }) {
-  return (
-    <svg width={size} height={size} viewBox="0 0 64 64" fill="none">
-      {/* Wings */}
-      <ellipse cx="14" cy="32" rx="10" ry="14" fill={colors.accent} opacity="0.8" className="animate-pulse" />
-      <ellipse cx="50" cy="32" rx="10" ry="14" fill={colors.accent} opacity="0.8" className="animate-pulse" />
-      {/* Body stripes */}
-      <ellipse cx="32" cy="36" rx="14" ry="20" fill={colors.primary} />
-      <ellipse cx="32" cy="30" rx="12" ry="6" fill="#1a1a1a" />
-      <ellipse cx="32" cy="44" rx="12" ry="6" fill="#1a1a1a" />
-      {/* Head */}
-      <circle cx="32" cy="16" r="12" fill={colors.primary} />
-      {/* Antennae */}
-      <line x1="26" y1="8" x2="22" y2="2" stroke="#1a1a1a" strokeWidth="2" />
-      <line x1="38" y1="8" x2="42" y2="2" stroke="#1a1a1a" strokeWidth="2" />
-      <circle cx="22" cy="2" r="2" fill="#1a1a1a" />
-      <circle cx="42" cy="2" r="2" fill="#1a1a1a" />
-      {/* Eyes */}
-      <circle cx="28" cy="14" r="4" fill="white" />
-      <circle cx="36" cy="14" r="4" fill="white" />
-      <circle cx="29" cy="15" r="2" fill="#1a1a1a" />
-      <circle cx="37" cy="15" r="2" fill="#1a1a1a" />
-      {/* Smile */}
-      <path d="M28,20 Q32,24 36,20" stroke="#1a1a1a" strokeWidth="1.5" fill="none" strokeLinecap="round" />
-    </svg>
-  )
-}
-
-// Pixel - cute pixel art style character
-function PixelSVG({ colors, size }: { colors: typeof AVATAR_COLORS.Pixel; size: number }) {
-  return (
-    <svg width={size} height={size} viewBox="0 0 64 64" fill="none">
-      {/* Blocky body */}
-      <rect x="20" y="28" width="24" height="28" fill={colors.primary} />
-      <rect x="16" y="32" width="8" height="20" fill={colors.secondary} />
-      <rect x="40" y="32" width="8" height="20" fill={colors.secondary} />
-      {/* Head */}
-      <rect x="16" y="8" width="32" height="24" fill={colors.primary} />
-      {/* Eyes */}
-      <rect x="20" y="14" width="8" height="8" fill="white" />
-      <rect x="36" y="14" width="8" height="8" fill="white" />
-      <rect x="24" y="16" width="4" height="4" fill="#1a1a1a" />
-      <rect x="38" y="16" width="4" height="4" fill="#1a1a1a" />
-      {/* Mouth */}
-      <rect x="26" y="26" width="12" height="4" fill={colors.accent} />
-    </svg>
-  )
-}
-
-// Byte - data cube character
-function ByteSVG({ colors, size }: { colors: typeof AVATAR_COLORS.Byte; size: number }) {
-  return (
-    <svg width={size} height={size} viewBox="0 0 64 64" fill="none">
-      {/* 3D cube body */}
-      <polygon points="32,8 56,20 56,44 32,56 8,44 8,20" fill={colors.primary} />
-      <polygon points="32,8 56,20 32,32 8,20" fill={colors.secondary} />
-      <polygon points="32,32 56,20 56,44 32,56" fill={colors.accent} opacity="0.6" />
-      {/* Face */}
-      <circle cx="24" cy="28" r="4" fill="white" />
-      <circle cx="40" cy="28" r="4" fill="white" />
-      <circle cx="25" cy="29" r="2" fill="#1a1a1a" />
-      <circle cx="41" cy="29" r="2" fill="#1a1a1a" />
-      <path d="M26,38 Q32,42 38,38" stroke="white" strokeWidth="2" fill="none" strokeLinecap="round" />
-    </svg>
-  )
-}
-
-// Nova - star character
-function NovaSVG({ colors, size }: { colors: typeof AVATAR_COLORS.Nova; size: number }) {
-  return (
-    <svg width={size} height={size} viewBox="0 0 64 64" fill="none">
-      {/* Star points */}
-      <polygon points="32,2 38,22 58,22 42,36 48,56 32,44 16,56 22,36 6,22 26,22" fill={colors.primary} />
-      <circle cx="32" cy="32" r="14" fill={colors.secondary} />
-      {/* Face */}
-      <circle cx="27" cy="30" r="3" fill="white" />
-      <circle cx="37" cy="30" r="3" fill="white" />
-      <circle cx="28" cy="31" r="1.5" fill="#1a1a1a" />
-      <circle cx="38" cy="31" r="1.5" fill="#1a1a1a" />
-      <path d="M28,37 Q32,40 36,37" stroke="#1a1a1a" strokeWidth="1.5" fill="none" strokeLinecap="round" />
-    </svg>
-  )
-}
-
-// Chip - circuit board character
-function ChipSVG({ colors, size }: { colors: typeof AVATAR_COLORS.Chip; size: number }) {
-  return (
-    <svg width={size} height={size} viewBox="0 0 64 64" fill="none">
-      {/* Chip body */}
-      <rect x="16" y="16" width="32" height="32" rx="4" fill={colors.primary} />
-      {/* Pins */}
-      <rect x="20" y="10" width="4" height="8" fill={colors.secondary} />
-      <rect x="30" y="10" width="4" height="8" fill={colors.secondary} />
-      <rect x="40" y="10" width="4" height="8" fill={colors.secondary} />
-      <rect x="20" y="46" width="4" height="8" fill={colors.secondary} />
-      <rect x="30" y="46" width="4" height="8" fill={colors.secondary} />
-      <rect x="40" y="46" width="4" height="8" fill={colors.secondary} />
-      {/* Face */}
-      <circle cx="26" cy="28" r="4" fill={colors.accent} />
-      <circle cx="38" cy="28" r="4" fill={colors.accent} />
-      <circle cx="26" cy="28" r="2" fill="#1a1a1a" />
-      <circle cx="38" cy="28" r="2" fill="#1a1a1a" />
-      <rect x="26" y="38" width="12" height="3" rx="1" fill={colors.accent} />
-    </svg>
-  )
-}
-
-// Bolt - lightning character
-function BoltSVG({ colors, size }: { colors: typeof AVATAR_COLORS.Bolt; size: number }) {
-  return (
-    <svg width={size} height={size} viewBox="0 0 64 64" fill="none">
-      {/* Lightning bolt body */}
-      <polygon points="36,4 20,28 30,28 24,60 48,32 36,32 44,4" fill={colors.primary} />
-      <polygon points="34,8 24,26 32,26 28,52 42,34 34,34 40,8" fill={colors.secondary} />
-      {/* Face */}
-      <circle cx="30" cy="30" r="3" fill="white" />
-      <circle cx="38" cy="26" r="3" fill="white" />
-      <circle cx="31" cy="31" r="1.5" fill="#1a1a1a" />
-      <circle cx="39" cy="27" r="1.5" fill="#1a1a1a" />
-    </svg>
-  )
-}
-
-// Dash - speedy character
-function DashSVG({ colors, size }: { colors: typeof AVATAR_COLORS.Dash; size: number }) {
-  return (
-    <svg width={size} height={size} viewBox="0 0 64 64" fill="none">
-      {/* Speed lines */}
-      <rect x="4" y="28" width="12" height="3" rx="1" fill={colors.accent} opacity="0.6" />
-      <rect x="8" y="34" width="10" height="3" rx="1" fill={colors.accent} opacity="0.4" />
-      {/* Aerodynamic body */}
-      <ellipse cx="36" cy="32" rx="20" ry="16" fill={colors.primary} />
-      <ellipse cx="40" cy="32" rx="14" ry="12" fill={colors.secondary} />
-      {/* Face */}
-      <circle cx="38" cy="28" r="4" fill="white" />
-      <circle cx="48" cy="28" r="4" fill="white" />
-      <circle cx="39" cy="29" r="2" fill="#1a1a1a" />
-      <circle cx="49" cy="29" r="2" fill="#1a1a1a" />
-      <path d="M40,36 Q44,39 48,36" stroke="#1a1a1a" strokeWidth="1.5" fill="none" strokeLinecap="round" />
-    </svg>
-  )
-}
-
-// Zap - electric orb
-function ZapSVG({ colors, size }: { colors: typeof AVATAR_COLORS.Zap; size: number }) {
-  return (
-    <svg width={size} height={size} viewBox="0 0 64 64" fill="none">
-      {/* Electric sparks */}
-      <path d="M12,32 L20,28 L16,32 L22,30" stroke={colors.secondary} strokeWidth="2" className="animate-pulse" />
-      <path d="M52,32 L44,28 L48,32 L42,30" stroke={colors.secondary} strokeWidth="2" className="animate-pulse" />
-      {/* Orb */}
-      <circle cx="32" cy="32" r="18" fill={colors.primary} />
-      <circle cx="32" cy="32" r="14" fill={colors.secondary} />
-      {/* Face */}
-      <circle cx="26" cy="30" r="4" fill="white" />
-      <circle cx="38" cy="30" r="4" fill="white" />
-      <circle cx="27" cy="31" r="2" fill={colors.primary} />
-      <circle cx="39" cy="31" r="2" fill={colors.primary} />
-      <path d="M28,40 Q32,44 36,40" stroke="white" strokeWidth="2" fill="none" strokeLinecap="round" />
-    </svg>
-  )
-}
-
-// Gizmo - gear character
-function GizmoSVG({ colors, size }: { colors: typeof AVATAR_COLORS.Gizmo; size: number }) {
-  return (
-    <svg width={size} height={size} viewBox="0 0 64 64" fill="none">
-      {/* Gear teeth */}
-      <rect x="28" y="4" width="8" height="8" fill={colors.primary} />
-      <rect x="28" y="52" width="8" height="8" fill={colors.primary} />
-      <rect x="4" y="28" width="8" height="8" fill={colors.primary} />
-      <rect x="52" y="28" width="8" height="8" fill={colors.primary} />
-      {/* Gear body */}
-      <circle cx="32" cy="32" r="20" fill={colors.primary} />
-      <circle cx="32" cy="32" r="14" fill={colors.secondary} />
-      {/* Face */}
-      <circle cx="26" cy="30" r="4" fill="white" />
-      <circle cx="38" cy="30" r="4" fill="white" />
-      <circle cx="27" cy="31" r="2" fill="#1a1a1a" />
-      <circle cx="39" cy="31" r="2" fill="#1a1a1a" />
-      <path d="M28,40 Q32,43 36,40" stroke="#1a1a1a" strokeWidth="2" fill="none" strokeLinecap="round" />
-    </svg>
-  )
-}
-
-// Turbo - rocket character
-function TurboSVG({ colors, size }: { colors: typeof AVATAR_COLORS.Turbo; size: number }) {
-  return (
-    <svg width={size} height={size} viewBox="0 0 64 64" fill="none">
-      {/* Flames */}
-      <ellipse cx="32" cy="58" rx="8" ry="6" fill="#FBBF24" className="animate-pulse" />
-      <ellipse cx="32" cy="56" rx="5" ry="4" fill="#FCD34D" />
-      {/* Rocket body */}
-      <ellipse cx="32" cy="32" rx="14" ry="24" fill={colors.primary} />
-      {/* Nose cone */}
-      <ellipse cx="32" cy="12" rx="8" ry="10" fill={colors.secondary} />
-      {/* Fins */}
-      <polygon points="18,44 10,56 18,52" fill={colors.secondary} />
-      <polygon points="46,44 54,56 46,52" fill={colors.secondary} />
-      {/* Window/Face */}
-      <circle cx="32" cy="28" r="8" fill={colors.accent} />
-      <circle cx="29" cy="27" r="2" fill="#1a1a1a" />
-      <circle cx="35" cy="27" r="2" fill="#1a1a1a" />
-      <path d="M29,32 Q32,34 35,32" stroke="#1a1a1a" strokeWidth="1" fill="none" />
-    </svg>
-  )
-}
-
-// Blip - radar dot character
-function BlipSVG({ colors, size }: { colors: typeof AVATAR_COLORS.Blip; size: number }) {
-  return (
-    <svg width={size} height={size} viewBox="0 0 64 64" fill="none">
-      {/* Radar rings */}
-      <circle cx="32" cy="32" r="28" stroke={colors.accent} strokeWidth="2" fill="none" opacity="0.3" />
-      <circle cx="32" cy="32" r="22" stroke={colors.accent} strokeWidth="2" fill="none" opacity="0.5" />
-      {/* Main dot */}
-      <circle cx="32" cy="32" r="14" fill={colors.primary} />
-      <circle cx="32" cy="32" r="10" fill={colors.secondary} />
-      {/* Face */}
-      <circle cx="28" cy="30" r="3" fill="white" />
-      <circle cx="36" cy="30" r="3" fill="white" />
-      <circle cx="29" cy="31" r="1.5" fill="#1a1a1a" />
-      <circle cx="37" cy="31" r="1.5" fill="#1a1a1a" />
-      <path d="M29,37 Q32,40 35,37" stroke="white" strokeWidth="1.5" fill="none" strokeLinecap="round" />
-    </svg>
-  )
-}
-
-// Neon - glowing character
-function NeonSVG({ colors, size }: { colors: typeof AVATAR_COLORS.Neon; size: number }) {
-  return (
-    <svg width={size} height={size} viewBox="0 0 64 64" fill="none">
-      {/* Glow effect */}
-      <circle cx="32" cy="32" r="26" fill={colors.accent} opacity="0.3" />
-      <circle cx="32" cy="32" r="22" fill={colors.accent} opacity="0.5" />
-      {/* Body */}
-      <circle cx="32" cy="32" r="18" fill={colors.primary} />
-      {/* Inner glow */}
-      <circle cx="32" cy="32" r="12" fill={colors.secondary} />
-      {/* Face */}
-      <circle cx="27" cy="30" r="4" fill="white" />
-      <circle cx="37" cy="30" r="4" fill="white" />
-      <circle cx="28" cy="31" r="2" fill={colors.primary} />
-      <circle cx="38" cy="31" r="2" fill={colors.primary} />
-      <path d="M28,38 Q32,42 36,38" stroke="white" strokeWidth="2" fill="none" strokeLinecap="round" />
-    </svg>
-  )
-}
-
-// Widget - UI component character
-function WidgetSVG({ colors, size }: { colors: typeof AVATAR_COLORS.Widget; size: number }) {
-  return (
-    <svg width={size} height={size} viewBox="0 0 64 64" fill="none">
-      {/* Window frame */}
-      <rect x="8" y="12" width="48" height="40" rx="4" fill={colors.primary} />
-      {/* Title bar */}
-      <rect x="8" y="12" width="48" height="10" rx="4" fill={colors.secondary} />
-      <circle cx="16" cy="17" r="2" fill="#EF4444" />
-      <circle cx="24" cy="17" r="2" fill="#FBBF24" />
-      <circle cx="32" cy="17" r="2" fill="#22C55E" />
-      {/* Content area / Face */}
-      <rect x="12" y="26" width="40" height="22" rx="2" fill={colors.accent} />
-      <circle cx="24" cy="34" r="4" fill="white" />
-      <circle cx="40" cy="34" r="4" fill="white" />
-      <circle cx="25" cy="35" r="2" fill={colors.primary} />
-      <circle cx="41" cy="35" r="2" fill={colors.primary} />
-      <rect x="28" y="42" width="8" height="3" rx="1" fill={colors.primary} />
-    </svg>
-  )
-}
-
-// Zippy - fast bunny-like character
-function ZippySVG({ colors, size }: { colors: typeof AVATAR_COLORS.Zippy; size: number }) {
-  return (
-    <svg width={size} height={size} viewBox="0 0 64 64" fill="none">
-      {/* Ears */}
-      <ellipse cx="22" cy="14" rx="6" ry="14" fill={colors.primary} />
-      <ellipse cx="42" cy="14" rx="6" ry="14" fill={colors.primary} />
-      <ellipse cx="22" cy="14" rx="3" ry="10" fill={colors.accent} />
-      <ellipse cx="42" cy="14" rx="3" ry="10" fill={colors.accent} />
-      {/* Head */}
-      <circle cx="32" cy="38" r="20" fill={colors.primary} />
-      {/* Face */}
-      <circle cx="24" cy="34" r="5" fill="white" />
-      <circle cx="40" cy="34" r="5" fill="white" />
-      <circle cx="25" cy="35" r="2.5" fill="#1a1a1a" />
-      <circle cx="41" cy="35" r="2.5" fill="#1a1a1a" />
-      {/* Nose and mouth */}
-      <ellipse cx="32" cy="44" rx="3" ry="2" fill={colors.secondary} />
-      <path d="M32,46 L32,50 M28,52 Q32,56 36,52" stroke="#1a1a1a" strokeWidth="1.5" fill="none" />
-    </svg>
-  )
-}
-
-// Quirk - question mark character
-function QuirkSVG({ colors, size }: { colors: typeof AVATAR_COLORS.Quirk; size: number }) {
-  return (
-    <svg width={size} height={size} viewBox="0 0 64 64" fill="none">
-      {/* Question mark body */}
-      <path d="M24,20 Q24,8 32,8 Q44,8 44,20 Q44,28 32,32 L32,40"
-            stroke={colors.primary} strokeWidth="8" fill="none" strokeLinecap="round" />
-      <circle cx="32" cy="52" r="6" fill={colors.primary} />
-      {/* Face on the dot */}
-      <circle cx="29" cy="51" r="1.5" fill="white" />
-      <circle cx="35" cy="51" r="1.5" fill="white" />
-      <circle cx="29" cy="51" r="0.75" fill="#1a1a1a" />
-      <circle cx="35" cy="51" r="0.75" fill="#1a1a1a" />
-      {/* Decorative swirl */}
-      <circle cx="32" cy="20" r="4" fill={colors.secondary} />
-    </svg>
-  )
-}
-
-// Flux - flowing wave character
-function FluxSVG({ colors, size }: { colors: typeof AVATAR_COLORS.Flux; size: number }) {
-  return (
-    <svg width={size} height={size} viewBox="0 0 64 64" fill="none">
-      {/* Wave body */}
-      <path d="M8,32 Q16,16 32,32 Q48,48 56,32" stroke={colors.primary} strokeWidth="16" fill="none" strokeLinecap="round" />
-      <path d="M8,32 Q16,16 32,32 Q48,48 56,32" stroke={colors.secondary} strokeWidth="10" fill="none" strokeLinecap="round" />
-      {/* Face */}
-      <circle cx="28" cy="28" r="4" fill="white" />
-      <circle cx="40" cy="36" r="4" fill="white" />
-      <circle cx="29" cy="29" r="2" fill="#1a1a1a" />
-      <circle cx="41" cy="37" r="2" fill="#1a1a1a" />
-      {/* Sparkles */}
-      <circle cx="16" cy="24" r="2" fill={colors.accent} className="animate-pulse" />
-      <circle cx="48" cy="40" r="2" fill={colors.accent} className="animate-pulse" />
-    </svg>
-  )
-}
-
-// Unknown agent fallback - simple question mark icon
-function UnknownSVG({ colors, size }: { colors: typeof UNKNOWN_COLORS; size: number }) {
-  return (
-    <svg width={size} height={size} viewBox="0 0 64 64" fill="none" xmlns="http://www.w3.org/2000/svg">
-      {/* Circle background */}
-      <circle cx="32" cy="32" r="28" fill={colors.primary} />
-      <circle cx="32" cy="32" r="24" fill={colors.secondary} />
-      {/* Question mark */}
-      <text x="32" y="44" textAnchor="middle" fontSize="32" fontWeight="bold" fill="white">?</text>
-    </svg>
-  )
-}
-
-const MASCOT_SVGS: Record<AgentMascot, typeof SparkSVG> = {
-  // Original 5
-  Spark: SparkSVG,
-  Fizz: FizzSVG,
-  Octo: OctoSVG,
-  Hoot: HootSVG,
-  Buzz: BuzzSVG,
-  // Tech-inspired
-  Pixel: PixelSVG,
-  Byte: ByteSVG,
-  Nova: NovaSVG,
-  Chip: ChipSVG,
-  Bolt: BoltSVG,
-  // Energetic
-  Dash: DashSVG,
-  Zap: ZapSVG,
-  Gizmo: GizmoSVG,
-  Turbo: TurboSVG,
-  Blip: BlipSVG,
-  // Playful
-  Neon: NeonSVG,
-  Widget: WidgetSVG,
-  Zippy: ZippySVG,
-  Quirk: QuirkSVG,
-  Flux: FluxSVG,
-}
-
 // Animation classes based on state
 function getStateAnimation(state: AgentState): string {
   switch (state) {
@@ -581,7 +84,7 @@ export function AgentAvatar({ name, state, size = 'md', showName = false }: Agen
   const isUnknown = name === 'Unknown'
   const colors = isUnknown ? UNKNOWN_COLORS : AVATAR_COLORS[name]
   const { svg: svgSize, font } = SIZES[size]
-  const SvgComponent = isUnknown ? UnknownSVG : MASCOT_SVGS[name]
+  const SvgComponent = isUnknown ? UnknownMascotSVG : MASCOT_SVGS[name]
   const stateDesc = getStateDescription(state)
   const ariaLabel = `Agent ${name} is ${stateDesc}`
 
@@ -606,7 +109,7 @@ export function AgentAvatar({ name, state, size = 'md', showName = false }: Agen
         <SvgComponent colors={colors} size={svgSize} />
       </div>
       {showName && (
-        <span className={`${font} font-bold text-neo-text`} style={{ color: colors.primary }}>
+        <span className={`${font} font-bold text-foreground`} style={{ color: colors.primary }}>
           {name}
         </span>
       )}

ui/src/components/AgentCard.tsx

@@ -3,6 +3,9 @@ import { useState } from 'react'
 import { createPortal } from 'react-dom'
 import { AgentAvatar } from './AgentAvatar'
 import type { ActiveAgent, AgentLogEntry, AgentType } from '../lib/types'
+import { Card, CardContent } from '@/components/ui/card'
+import { Button } from '@/components/ui/button'
+import { Badge } from '@/components/ui/badge'
 
 interface AgentCardProps {
   agent: ActiveAgent
@@ -31,22 +34,22 @@ function getStateText(state: ActiveAgent['state']): string {
   }
 }
 
-// Get state color
+// Get state color class
 function getStateColor(state: ActiveAgent['state']): string {
   switch (state) {
     case 'success':
-      return 'text-neo-done'
+      return 'text-primary'
     case 'error':
-      return 'text-neo-pending'  // Yellow - just pivoting, not a real error
+      return 'text-yellow-600'
     case 'struggling':
-      return 'text-orange-500'   // Orange - working hard, being persistent
+      return 'text-orange-500'
     case 'working':
     case 'testing':
-      return 'text-neo-progress'
+      return 'text-primary'
     case 'thinking':
-      return 'text-neo-pending'
+      return 'text-yellow-600'
     default:
-      return 'text-neo-text-secondary'
+      return 'text-muted-foreground'
   }
 }
 
@@ -55,14 +58,13 @@ function getAgentTypeBadge(agentType: AgentType): { label: string; className: st
   if (agentType === 'testing') {
     return {
       label: 'TEST',
-      className: 'bg-purple-100 text-purple-700 border-purple-300',
+      className: 'bg-purple-100 text-purple-700 dark:bg-purple-900/30 dark:text-purple-300',
       icon: FlaskConical,
     }
   }
-  // Default to coding
   return {
     label: 'CODE',
-    className: 'bg-blue-100 text-blue-700 border-blue-300',
+    className: 'bg-blue-100 text-blue-700 dark:bg-blue-900/30 dark:text-blue-300',
     icon: Code,
   }
 }
@@ -74,75 +76,79 @@ export function AgentCard({ agent, onShowLogs }: AgentCardProps) {
   const TypeIcon = typeBadge.icon
 
   return (
-    <div
-      className={`
-        neo-card p-3 min-w-[180px] max-w-[220px]
-        ${isActive ? 'animate-pulse-neo' : ''}
-        transition-all duration-300
-      `}
-    >
-      {/* Agent type badge */}
-      <div className="flex justify-end mb-1">
-        <span
-          className={`
-            inline-flex items-center gap-1 px-1.5 py-0.5 text-[10px] font-bold
-            uppercase tracking-wide rounded border
-            ${typeBadge.className}
-          `}
-        >
-          <TypeIcon size={10} />
-          {typeBadge.label}
-        </span>
-      </div>
+    <Card className={`min-w-[180px] max-w-[220px] py-3 ${isActive ? 'animate-pulse' : ''}`}>
+      <CardContent className="p-3 space-y-2">
+        {/* Agent type badge */}
+        <div className="flex justify-end">
+          <Badge variant="outline" className={`text-[10px] ${typeBadge.className}`}>
+            <TypeIcon size={10} />
+            {typeBadge.label}
+          </Badge>
+        </div>
 
-      {/* Header with avatar and name */}
-      <div className="flex items-center gap-2 mb-2">
-        <AgentAvatar name={agent.agentName} state={agent.state} size="sm" />
-        <div className="flex-1 min-w-0">
-          <div className="font-display font-bold text-sm truncate">
-            {agent.agentName}
+        {/* Header with avatar and name */}
+        <div className="flex items-center gap-2">
+          <AgentAvatar name={agent.agentName} state={agent.state} size="sm" />
+          <div className="flex-1 min-w-0">
+            <div className="font-semibold text-sm truncate">
+              {agent.agentName}
+            </div>
+            <div className={`text-xs ${getStateColor(agent.state)}`}>
+              {getStateText(agent.state)}
+            </div>
           </div>
-          <div className={`text-xs ${getStateColor(agent.state)}`}>
-            {getStateText(agent.state)}
-          </div>
-        </div>
-        {/* Log button */}
-        {hasLogs && onShowLogs && (
-          <button
-            onClick={() => onShowLogs(agent.agentIndex)}
-            className="p-1 hover:bg-neo-bg-secondary rounded transition-colors"
-            title={`View logs (${agent.logs?.length || 0} entries)`}
-          >
-            <ScrollText size={14} className="text-neo-text-secondary" />
-          </button>
-        )}
-      </div>
-
-      {/* Feature info */}
-      <div className="mb-2">
-        <div className="text-xs text-neo-text-secondary mb-0.5">
-          Feature #{agent.featureId}
-        </div>
-        <div className="text-sm font-medium truncate" title={agent.featureName}>
-          {agent.featureName}
-        </div>
-      </div>
-
-      {/* Thought bubble */}
-      {agent.thought && (
-        <div className="relative mt-2 pt-2 border-t-2 border-neo-border/30">
-          <div className="flex items-start gap-1.5">
-            <MessageCircle size={14} className="text-neo-progress shrink-0 mt-0.5" />
-            <p
-              className="text-xs text-neo-text-secondary line-clamp-2 italic"
-              title={agent.thought}
+          {/* Log button */}
+          {hasLogs && onShowLogs && (
+            <Button
+              variant="ghost"
+              size="icon-xs"
+              onClick={() => onShowLogs(agent.agentIndex)}
+              title={`View logs (${agent.logs?.length || 0} entries)`}
             >
-              {agent.thought}
-            </p>
-          </div>
+              <ScrollText size={14} className="text-muted-foreground" />
+            </Button>
+          )}
         </div>
-      )}
-    </div>
+
+        {/* Feature info */}
+        <div>
+          {agent.featureIds && agent.featureIds.length > 1 ? (
+            <>
+              <div className="text-xs text-muted-foreground mb-0.5">
+                Batch: {agent.featureIds.map(id => `#${id}`).join(', ')}
+              </div>
+              <div className="text-sm font-bold truncate">
+                Active: Feature #{agent.featureId}
+              </div>
+            </>
+          ) : (
+            <>
+              <div className="text-xs text-muted-foreground mb-0.5">
+                Feature #{agent.featureId}
+              </div>
+              <div className="text-sm font-medium truncate" title={agent.featureName}>
+                {agent.featureName}
+              </div>
+            </>
+          )}
+        </div>
+
+        {/* Thought bubble */}
+        {agent.thought && (
+          <div className="pt-2 border-t border-border/50">
+            <div className="flex items-start gap-1.5">
+              <MessageCircle size={14} className="text-primary shrink-0 mt-0.5" />
+              <p
+                className="text-xs text-muted-foreground line-clamp-2 italic"
+                title={agent.thought}
+              >
+                {agent.thought}
+              </p>
+            </div>
+          </div>
+        )}
+      </CardContent>
+    </Card>
   )
 }
 
@@ -170,91 +176,79 @@ export function AgentLogModal({ agent, logs, onClose }: AgentLogModalProps) {
   const getLogColor = (type: AgentLogEntry['type']) => {
     switch (type) {
       case 'error':
-        return 'text-neo-danger'
+        return 'text-destructive'
       case 'state_change':
-        return 'text-neo-progress'
+        return 'text-primary'
       default:
-        return 'text-neo-text'
+        return 'text-foreground'
     }
   }
 
-  // Use portal to render modal at document body level (avoids overflow:hidden issues)
   return createPortal(
     <div
       className="fixed inset-0 flex items-center justify-center p-4 bg-black/50"
       style={{ zIndex: 9999 }}
       onClick={(e) => {
-        // Close when clicking backdrop
         if (e.target === e.currentTarget) onClose()
       }}
     >
-      <div className="neo-card w-full max-w-4xl max-h-[80vh] flex flex-col bg-neo-bg">
+      <Card className="w-full max-w-4xl max-h-[80vh] flex flex-col py-0">
         {/* Header */}
-        <div className="flex items-center justify-between p-4 border-b-3 border-neo-border">
+        <div className="flex items-center justify-between p-4 border-b">
           <div className="flex items-center gap-3">
             <AgentAvatar name={agent.agentName} state={agent.state} size="sm" />
             <div>
               <div className="flex items-center gap-2">
-                <h2 className="font-display font-bold text-lg">
+                <h2 className="font-semibold text-lg">
                   {agent.agentName} Logs
                 </h2>
-                <span
-                  className={`
-                    inline-flex items-center gap-1 px-1.5 py-0.5 text-[10px] font-bold
-                    uppercase tracking-wide rounded border
-                    ${typeBadge.className}
-                  `}
-                >
+                <Badge variant="outline" className={`text-[10px] ${typeBadge.className}`}>
                   <TypeIcon size={10} />
                   {typeBadge.label}
-                </span>
+                </Badge>
               </div>
-              <p className="text-sm text-neo-text-secondary">
-                Feature #{agent.featureId}: {agent.featureName}
+              <p className="text-sm text-muted-foreground">
+                {agent.featureIds && agent.featureIds.length > 1
+                  ? `Batch: ${agent.featureIds.map(id => `#${id}`).join(', ')}`
+                  : `Feature #${agent.featureId}: ${agent.featureName}`
+                }
               </p>
             </div>
           </div>
           <div className="flex items-center gap-2">
-            <button
-              onClick={handleCopy}
-              className="neo-button neo-button-sm flex items-center gap-1"
-              title="Copy all logs"
-            >
+            <Button variant="outline" size="sm" onClick={handleCopy}>
               {copied ? <Check size={14} /> : <Copy size={14} />}
               {copied ? 'Copied!' : 'Copy'}
-            </button>
-            <button
-              onClick={onClose}
-              className="p-2 hover:bg-neo-bg-secondary rounded transition-colors"
-            >
+            </Button>
+            <Button variant="ghost" size="icon-sm" onClick={onClose}>
               <X size={20} />
-            </button>
+            </Button>
           </div>
         </div>
 
         {/* Log content */}
-        <div className="flex-1 overflow-auto p-4 bg-neo-bg-secondary font-mono text-xs">
-          {logs.length === 0 ? (
-            <p className="text-neo-text-secondary italic">No logs available</p>
-          ) : (
-            <div className="space-y-1">
-              {logs.map((log, idx) => (
+        <div className="flex-1 min-h-0 overflow-y-auto p-4 bg-muted/50">
+          <div className="font-mono text-xs space-y-1">
+            {logs.length === 0 ? (
+              <p className="text-muted-foreground italic">No logs available</p>
+            ) : (
+              logs.map((log, idx) => (
                 <div key={idx} className={`${getLogColor(log.type)} whitespace-pre-wrap break-all`}>
-                  <span className="text-neo-muted">
+                  <span className="text-muted-foreground">
                     [{new Date(log.timestamp).toLocaleTimeString()}]
                   </span>{' '}
                   {log.line}
                 </div>
-              ))}
-            </div>
-          )}
+              ))
+            )}
+          </div>
         </div>
 
         {/* Footer */}
-        <div className="p-3 border-t-2 border-neo-border/30 text-xs text-neo-text-secondary">
+        <div className="p-3 border-t text-xs text-muted-foreground">
           {logs.length} log entries
         </div>
-      </div>
+      </Card>
     </div>,
     document.body
   )

ui/src/components/AgentControl.tsx

@@ -1,26 +1,62 @@
-import { useState } from 'react'
+import { useState, useEffect, useRef, useCallback } from 'react'
 import { Play, Square, Loader2, GitBranch, Clock } from 'lucide-react'
 import {
   useStartAgent,
   useStopAgent,
   useSettings,
+  useUpdateProjectSettings,
 } from '../hooks/useProjects'
 import { useNextScheduledRun } from '../hooks/useSchedules'
 import { formatNextRun, formatEndTime } from '../lib/timeUtils'
 import { ScheduleModal } from './ScheduleModal'
 import type { AgentStatus } from '../lib/types'
+import { Button } from '@/components/ui/button'
+import { Badge } from '@/components/ui/badge'
 
 interface AgentControlProps {
   projectName: string
   status: AgentStatus
+  defaultConcurrency?: number
 }
 
-export function AgentControl({ projectName, status }: AgentControlProps) {
+export function AgentControl({ projectName, status, defaultConcurrency = 3 }: AgentControlProps) {
   const { data: settings } = useSettings()
   const yoloMode = settings?.yolo_mode ?? false
 
   // Concurrency: 1 = single agent, 2-5 = parallel
-  const [concurrency, setConcurrency] = useState(3)
+  const [concurrency, setConcurrency] = useState(defaultConcurrency)
+
+  // Sync concurrency when project changes or defaultConcurrency updates
+  useEffect(() => {
+    setConcurrency(defaultConcurrency)
+  }, [defaultConcurrency])
+
+  // Debounced save for concurrency changes
+  const updateProjectSettings = useUpdateProjectSettings(projectName)
+  const saveTimeoutRef = useRef<ReturnType<typeof setTimeout> | null>(null)
+
+  const handleConcurrencyChange = useCallback((newConcurrency: number) => {
+    setConcurrency(newConcurrency)
+
+    // Clear previous timeout
+    if (saveTimeoutRef.current) {
+      clearTimeout(saveTimeoutRef.current)
+    }
+
+    // Debounce save (500ms)
+    saveTimeoutRef.current = setTimeout(() => {
+      updateProjectSettings.mutate({ default_concurrency: newConcurrency })
+    }, 500)
+  }, [updateProjectSettings])
+
+  // Cleanup timeout on unmount
+  useEffect(() => {
+    return () => {
+      if (saveTimeoutRef.current) {
+        clearTimeout(saveTimeoutRef.current)
+      }
+    }
+  }, [])
 
   const startAgent = useStartAgent(projectName)
   const stopAgent = useStopAgent(projectName)
@@ -30,18 +66,17 @@ export function AgentControl({ projectName, status }: AgentControlProps) {
 
   const isLoading = startAgent.isPending || stopAgent.isPending
   const isRunning = status === 'running' || status === 'paused'
-  const isLoadingStatus = status === 'loading'  // Status unknown, waiting for WebSocket
+  const isLoadingStatus = status === 'loading'
   const isParallel = concurrency > 1
 
   const handleStart = () => startAgent.mutate({
     yoloMode,
     parallelMode: isParallel,
-    maxConcurrency: concurrency,  // Always pass concurrency (1-5)
+    maxConcurrency: concurrency,
     testingAgentRatio: settings?.testing_agent_ratio,
   })
   const handleStop = () => stopAgent.mutate()
 
-  // Simplified: either show Start (when stopped/crashed), Stop (when running/paused), or loading spinner
   const isStopped = status === 'stopped' || status === 'crashed'
 
   return (
@@ -50,19 +85,19 @@ export function AgentControl({ projectName, status }: AgentControlProps) {
         {/* Concurrency slider - visible when stopped */}
         {isStopped && (
           <div className="flex items-center gap-2">
-            <GitBranch size={16} className={isParallel ? 'text-[var(--color-neo-primary)]' : 'text-gray-400'} />
+            <GitBranch size={16} className={isParallel ? 'text-primary' : 'text-muted-foreground'} />
             <input
               type="range"
               min={1}
               max={5}
               value={concurrency}
-              onChange={(e) => setConcurrency(Number(e.target.value))}
+              onChange={(e) => handleConcurrencyChange(Number(e.target.value))}
               disabled={isLoading}
-              className="w-16 h-2 accent-[var(--color-neo-primary)] cursor-pointer"
+              className="w-16 h-2 accent-primary cursor-pointer"
               title={`${concurrency} concurrent agent${concurrency > 1 ? 's' : ''}`}
               aria-label="Set number of concurrent agents"
             />
-            <span className="text-xs font-bold min-w-[1.5rem] text-center">
+            <span className="text-xs font-semibold min-w-[1.5rem] text-center">
               {concurrency}x
             </span>
           </div>
@@ -70,80 +105,71 @@ export function AgentControl({ projectName, status }: AgentControlProps) {
 
         {/* Show concurrency indicator when running with multiple agents */}
         {isRunning && isParallel && (
-          <div className="flex items-center gap-1 text-xs text-[var(--color-neo-primary)] font-bold">
+          <Badge variant="secondary" className="gap-1">
             <GitBranch size={14} />
-            <span>{concurrency}x</span>
-          </div>
+            {concurrency}x
+          </Badge>
         )}
 
         {/* Schedule status display */}
         {nextRun?.is_currently_running && nextRun.next_end && (
-          <div className="flex items-center gap-2 text-sm text-[var(--color-neo-done)] font-bold">
-            <Clock size={16} className="flex-shrink-0" />
-            <span>Running until {formatEndTime(nextRun.next_end)}</span>
-          </div>
+          <Badge variant="default" className="gap-1">
+            <Clock size={14} />
+            Running until {formatEndTime(nextRun.next_end)}
+          </Badge>
         )}
 
         {!nextRun?.is_currently_running && nextRun?.next_start && (
-          <div className="flex items-center gap-2 text-sm text-gray-900 dark:text-white font-bold">
-            <Clock size={16} className="flex-shrink-0" />
-            <span>Next: {formatNextRun(nextRun.next_start)}</span>
-          </div>
+          <Badge variant="secondary" className="gap-1">
+            <Clock size={14} />
+            Next: {formatNextRun(nextRun.next_start)}
+          </Badge>
         )}
 
         {/* Start/Stop button */}
         {isLoadingStatus ? (
-          <button
-            disabled
-            className="neo-btn text-sm py-2 px-3 opacity-50 cursor-not-allowed"
-            title="Loading agent status..."
-            aria-label="Loading agent status"
-          >
+          <Button disabled variant="outline" size="sm">
             <Loader2 size={18} className="animate-spin" />
-          </button>
+          </Button>
         ) : isStopped ? (
-          <button
+          <Button
             onClick={handleStart}
             disabled={isLoading}
-            className={`neo-btn text-sm py-2 px-3 ${
-              yoloMode ? 'neo-btn-yolo' : 'neo-btn-success'
-            }`}
+            variant={yoloMode ? 'secondary' : 'default'}
+            size="sm"
             title={yoloMode ? 'Start Agent (YOLO Mode)' : 'Start Agent'}
-            aria-label={yoloMode ? 'Start Agent in YOLO Mode' : 'Start Agent'}
           >
             {isLoading ? (
               <Loader2 size={18} className="animate-spin" />
             ) : (
               <Play size={18} />
             )}
-          </button>
+          </Button>
         ) : (
-          <button
+          <Button
             onClick={handleStop}
             disabled={isLoading}
-            className={`neo-btn text-sm py-2 px-3 ${
-              yoloMode ? 'neo-btn-yolo' : 'neo-btn-danger'
-            }`}
+            variant="destructive"
+            size="sm"
             title={yoloMode ? 'Stop Agent (YOLO Mode)' : 'Stop Agent'}
-            aria-label={yoloMode ? 'Stop Agent in YOLO Mode' : 'Stop Agent'}
           >
             {isLoading ? (
               <Loader2 size={18} className="animate-spin" />
             ) : (
               <Square size={18} />
             )}
-          </button>
+          </Button>
         )}
 
         {/* Clock button to open schedule modal */}
-        <button
+        <Button
+          variant="outline"
+          size="sm"
           onClick={() => setShowScheduleModal(true)}
-          className="neo-btn text-sm py-2 px-3"
           title="Manage schedules"
-          aria-label="Manage agent schedules"
         >
           <Clock size={18} />
-        </button>
+        </Button>
       </div>
 
       {/* Schedule Modal */}

ui/src/components/AgentMissionControl.tsx

@@ -4,6 +4,9 @@ import { AgentCard, AgentLogModal } from './AgentCard'
 import { ActivityFeed } from './ActivityFeed'
 import { OrchestratorStatusCard } from './OrchestratorStatusCard'
 import type { ActiveAgent, AgentLogEntry, OrchestratorStatus } from '../lib/types'
+import { Card, CardContent } from '@/components/ui/card'
+import { Badge } from '@/components/ui/badge'
+import { Button } from '@/components/ui/button'
 
 const ACTIVITY_COLLAPSED_KEY = 'autocoder-activity-collapsed'
 
@@ -35,7 +38,6 @@ export function AgentMissionControl({
       return false
     }
   })
-  // State for log modal
   const [selectedAgentForLogs, setSelectedAgentForLogs] = useState<ActiveAgent | null>(null)
 
   const toggleActivityCollapsed = () => {
@@ -54,18 +56,18 @@ export function AgentMissionControl({
   }
 
   return (
-    <div className="neo-card mb-6 overflow-hidden">
+    <Card className="mb-6 overflow-hidden py-0">
       {/* Header */}
       <button
         onClick={() => setIsExpanded(!isExpanded)}
-        className="w-full flex items-center justify-between px-4 py-3 bg-[var(--color-neo-progress)] hover:brightness-105 transition-all"
+        className="w-full flex items-center justify-between px-4 py-3 bg-primary hover:bg-primary/90 transition-colors"
       >
         <div className="flex items-center gap-2">
-          <Rocket size={20} className="text-neo-text-on-bright" />
-          <span className="font-display font-bold text-neo-text-on-bright uppercase tracking-wide">
+          <Rocket size={20} className="text-primary-foreground" />
+          <span className="font-semibold text-primary-foreground uppercase tracking-wide">
             Mission Control
           </span>
-          <span className="neo-badge neo-badge-sm bg-white text-neo-text ml-2">
+          <Badge variant="secondary" className="ml-2">
             {agents.length > 0
               ? `${agents.length} ${agents.length === 1 ? 'agent' : 'agents'} active`
               : orchestratorStatus?.state === 'initializing'
@@ -74,12 +76,12 @@ export function AgentMissionControl({
                   ? 'Complete'
                   : 'Orchestrating'
             }
-          </span>
+          </Badge>
         </div>
         {isExpanded ? (
-          <ChevronUp size={20} className="text-neo-text-on-bright" />
+          <ChevronUp size={20} className="text-primary-foreground" />
         ) : (
-          <ChevronDown size={20} className="text-neo-text-on-bright" />
+          <ChevronDown size={20} className="text-primary-foreground" />
         )}
       </button>
 
@@ -90,7 +92,7 @@ export function AgentMissionControl({
           ${isExpanded ? 'max-h-[600px] opacity-100' : 'max-h-0 opacity-0'}
         `}
       >
-        <div className="p-4">
+        <CardContent className="p-4">
           {/* Orchestrator Status Card */}
           {orchestratorStatus && (
             <OrchestratorStatusCard status={orchestratorStatus} />
@@ -98,7 +100,7 @@ export function AgentMissionControl({
 
           {/* Agent Cards Row */}
           {agents.length > 0 && (
-            <div className="flex gap-4 overflow-x-auto pb-4 scrollbar-thin">
+            <div className="flex gap-4 overflow-x-auto pb-4">
               {agents.map((agent) => (
                 <AgentCard
                   key={`agent-${agent.agentIndex}`}
@@ -116,24 +118,26 @@ export function AgentMissionControl({
 
           {/* Collapsible Activity Feed */}
           {recentActivity.length > 0 && (
-            <div className="mt-4 pt-4 border-t-2 border-neo-border/30">
-              <button
+            <div className="mt-4 pt-4 border-t">
+              <Button
+                variant="ghost"
+                size="sm"
                 onClick={toggleActivityCollapsed}
-                className="flex items-center gap-2 mb-2 hover:opacity-80 transition-opacity"
+                className="gap-2 mb-2 h-auto p-1"
               >
-                <Activity size={14} className="text-neo-text-secondary" />
-                <span className="text-xs font-bold text-neo-text-secondary uppercase tracking-wide">
+                <Activity size={14} className="text-muted-foreground" />
+                <span className="text-xs font-semibold text-muted-foreground uppercase tracking-wide">
                   Recent Activity
                 </span>
-                <span className="text-xs text-neo-muted">
+                <span className="text-xs text-muted-foreground">
                   ({recentActivity.length})
                 </span>
                 {activityCollapsed ? (
-                  <ChevronDown size={14} className="text-neo-text-secondary" />
+                  <ChevronDown size={14} className="text-muted-foreground" />
                 ) : (
-                  <ChevronUp size={14} className="text-neo-text-secondary" />
+                  <ChevronUp size={14} className="text-muted-foreground" />
                 )}
-              </button>
+              </Button>
               <div
                 className={`
                   transition-all duration-200 ease-out overflow-hidden
@@ -144,7 +148,7 @@ export function AgentMissionControl({
               </div>
             </div>
           )}
-        </div>
+        </CardContent>
       </div>
 
       {/* Log Modal */}
@@ -155,6 +159,6 @@ export function AgentMissionControl({
           onClose={() => setSelectedAgentForLogs(null)}
         />
       )}
-    </div>
+    </Card>
   )
 }

ui/src/components/AgentThought.tsx

@@ -1,6 +1,7 @@
 import { useMemo, useState, useEffect } from 'react'
 import { Brain, Sparkles } from 'lucide-react'
 import type { AgentStatus } from '../lib/types'
+import { Card } from '@/components/ui/card'
 
 interface AgentThoughtProps {
   logs: Array<{ line: string; timestamp: string }>
@@ -105,38 +106,25 @@ export function AgentThought({ logs, agentStatus }: AgentThoughtProps) {
         ${shouldShow ? 'opacity-100 max-h-20' : 'opacity-0 max-h-0'}
       `}
     >
-      <div
-        className={`
-          relative
-          bg-[var(--color-neo-card)]
-          border-3 border-[var(--color-neo-border)]
-          shadow-[var(--shadow-neo-sm)]
-          px-4 py-3
-          flex items-center gap-3
-          ${isRunning ? 'animate-pulse-neo' : ''}
-        `}
-      >
+      <Card className={`relative px-4 py-3 flex items-center gap-3 ${isRunning ? 'animate-pulse' : ''}`}>
         {/* Brain Icon with subtle glow */}
         <div className="relative shrink-0">
           <Brain
             size={22}
-            className="text-[var(--color-neo-progress)]"
+            className="text-primary"
             strokeWidth={2.5}
           />
           {isRunning && (
             <Sparkles
               size={10}
-              className="absolute -top-1 -right-1 text-[var(--color-neo-pending)] animate-pulse"
+              className="absolute -top-1 -right-1 text-yellow-500 animate-pulse"
             />
           )}
         </div>
 
-        {/* Thought text with fade transition + shimmer effect when running */}
+        {/* Thought text with fade transition */}
         <p
-          className={`
-            font-mono text-sm truncate transition-all duration-150 ease-out
-            ${isRunning ? 'animate-shimmer' : 'text-[var(--color-neo-text)]'}
-          `}
+          className="font-mono text-sm truncate transition-all duration-150 ease-out text-foreground"
           style={{
             opacity: textVisible ? 1 : 0,
             transform: textVisible ? 'translateY(0)' : 'translateY(-4px)',
@@ -147,14 +135,11 @@ export function AgentThought({ logs, agentStatus }: AgentThoughtProps) {
 
         {/* Subtle running indicator bar */}
         {isRunning && (
-          <div className="absolute bottom-0 left-0 right-0 h-0.5 bg-[var(--color-neo-progress)] opacity-50">
-            <div
-              className="h-full bg-[var(--color-neo-progress)] animate-pulse"
-              style={{ width: '100%' }}
-            />
+          <div className="absolute bottom-0 left-0 right-0 h-0.5 bg-primary/50">
+            <div className="h-full bg-primary animate-pulse" style={{ width: '100%' }} />
           </div>
         )}
-      </div>
+      </Card>
     </div>
   )
 }

ui/src/components/AssistantChat.tsx

@@ -12,6 +12,9 @@ import { useAssistantChat } from '../hooks/useAssistantChat'
 import { ChatMessage as ChatMessageComponent } from './ChatMessage'
 import { ConversationHistory } from './ConversationHistory'
 import type { ChatMessage } from '../lib/types'
+import { isSubmitEnter } from '../lib/keyboard'
+import { Button } from '@/components/ui/button'
+import { Textarea } from '@/components/ui/textarea'
 
 interface AssistantChatProps {
   projectName: string
@@ -132,7 +135,7 @@ export function AssistantChat({
   }
 
   const handleKeyDown = (e: React.KeyboardEvent<HTMLTextAreaElement>) => {
-    if (e.key === 'Enter' && !e.shiftKey) {
+    if (isSubmitEnter(e)) {
       e.preventDefault()
       handleSend()
     }
@@ -167,28 +170,28 @@ export function AssistantChat({
   return (
     <div className="flex flex-col h-full">
       {/* Header with actions and connection status */}
-      <div className="flex items-center justify-between px-4 py-2 border-b-2 border-[var(--color-neo-border)] bg-[var(--color-neo-bg)]">
+      <div className="flex items-center justify-between px-4 py-2 border-b border-border bg-background">
         {/* Action buttons */}
         <div className="flex items-center gap-1 relative">
-          <button
+          <Button
+            variant="ghost"
+            size="icon"
             onClick={handleNewChat}
-            className="neo-btn neo-btn-ghost p-1.5 text-[var(--color-neo-text-secondary)] hover:text-[var(--color-neo-text)]"
+            className="h-8 w-8"
             title="New conversation"
             disabled={isLoading}
           >
             <Plus size={16} />
-          </button>
-          <button
+          </Button>
+          <Button
+            variant={showHistory ? 'secondary' : 'ghost'}
+            size="icon"
             onClick={() => setShowHistory(!showHistory)}
-            className={`neo-btn neo-btn-ghost p-1.5 ${
-              showHistory
-                ? 'text-[var(--color-neo-text)] bg-[var(--color-neo-pending)]'
-                : 'text-[var(--color-neo-text-secondary)] hover:text-[var(--color-neo-text)]'
-            }`}
+            className="h-8 w-8"
             title="Conversation history"
           >
             <History size={16} />
-          </button>
+          </Button>
 
           {/* History dropdown */}
           <ConversationHistory
@@ -204,34 +207,34 @@ export function AssistantChat({
         <div className="flex items-center gap-2">
           {connectionStatus === 'connected' ? (
             <>
-              <Wifi size={14} className="text-[var(--color-neo-done)]" />
-              <span className="text-xs text-[var(--color-neo-text-secondary)]">Connected</span>
+              <Wifi size={14} className="text-green-500" />
+              <span className="text-xs text-muted-foreground">Connected</span>
             </>
           ) : connectionStatus === 'connecting' ? (
             <>
-              <Loader2 size={14} className="text-[var(--color-neo-progress)] animate-spin" />
-              <span className="text-xs text-[var(--color-neo-text-secondary)]">Connecting...</span>
+              <Loader2 size={14} className="text-primary animate-spin" />
+              <span className="text-xs text-muted-foreground">Connecting...</span>
             </>
           ) : (
             <>
-              <WifiOff size={14} className="text-[var(--color-neo-danger)]" />
-              <span className="text-xs text-[var(--color-neo-text-secondary)]">Disconnected</span>
+              <WifiOff size={14} className="text-destructive" />
+              <span className="text-xs text-muted-foreground">Disconnected</span>
             </>
           )}
         </div>
       </div>
 
       {/* Messages area */}
-      <div className="flex-1 overflow-y-auto bg-[var(--color-neo-bg)]">
+      <div className="flex-1 overflow-y-auto bg-background">
         {isLoadingConversation ? (
-          <div className="flex items-center justify-center h-full text-[var(--color-neo-text-secondary)] text-sm">
+          <div className="flex items-center justify-center h-full text-muted-foreground text-sm">
             <div className="flex items-center gap-2">
               <Loader2 size={16} className="animate-spin" />
               <span>Loading conversation...</span>
             </div>
           </div>
         ) : displayMessages.length === 0 ? (
-          <div className="flex items-center justify-center h-full text-[var(--color-neo-text-secondary)] text-sm">
+          <div className="flex items-center justify-center h-full text-muted-foreground text-sm">
             {isLoading ? (
               <div className="flex items-center gap-2">
                 <Loader2 size={16} className="animate-spin" />
@@ -253,12 +256,12 @@ export function AssistantChat({
 
       {/* Loading indicator */}
       {isLoading && displayMessages.length > 0 && (
-        <div className="px-4 py-2 border-t-2 border-[var(--color-neo-border)] bg-[var(--color-neo-bg)]">
-          <div className="flex items-center gap-2 text-[var(--color-neo-text-secondary)] text-sm">
+        <div className="px-4 py-2 border-t border-border bg-background">
+          <div className="flex items-center gap-2 text-muted-foreground text-sm">
             <div className="flex gap-1">
-              <span className="w-2 h-2 bg-[var(--color-neo-progress)] rounded-full animate-bounce" style={{ animationDelay: '0ms' }} />
-              <span className="w-2 h-2 bg-[var(--color-neo-progress)] rounded-full animate-bounce" style={{ animationDelay: '150ms' }} />
-              <span className="w-2 h-2 bg-[var(--color-neo-progress)] rounded-full animate-bounce" style={{ animationDelay: '300ms' }} />
+              <span className="w-2 h-2 bg-primary rounded-full animate-bounce" style={{ animationDelay: '0ms' }} />
+              <span className="w-2 h-2 bg-primary rounded-full animate-bounce" style={{ animationDelay: '150ms' }} />
+              <span className="w-2 h-2 bg-primary rounded-full animate-bounce" style={{ animationDelay: '300ms' }} />
             </div>
             <span>Thinking...</span>
           </div>
@@ -266,33 +269,21 @@ export function AssistantChat({
       )}
 
       {/* Input area */}
-      <div className="border-t-3 border-[var(--color-neo-border)] p-4 bg-[var(--color-neo-card)]">
+      <div className="border-t border-border p-4 bg-card">
         <div className="flex gap-2">
-          <textarea
+          <Textarea
             ref={inputRef}
             value={inputValue}
             onChange={(e) => setInputValue(e.target.value)}
             onKeyDown={handleKeyDown}
             placeholder="Ask about the codebase..."
             disabled={isLoading || isLoadingConversation || connectionStatus !== 'connected'}
-            className="
-              flex-1
-              neo-input
-              resize-none
-              min-h-[44px]
-              max-h-[120px]
-              py-2.5
-            "
+            className="flex-1 resize-none min-h-[44px] max-h-[120px]"
             rows={1}
           />
-          <button
+          <Button
             onClick={handleSend}
             disabled={!inputValue.trim() || isLoading || isLoadingConversation || connectionStatus !== 'connected'}
-            className="
-              neo-btn neo-btn-primary
-              px-4
-              disabled:opacity-50 disabled:cursor-not-allowed
-            "
             title="Send message"
           >
             {isLoading ? (
@@ -300,9 +291,9 @@ export function AssistantChat({
             ) : (
               <Send size={18} />
             )}
-          </button>
+          </Button>
         </div>
-        <p className="text-xs text-[var(--color-neo-text-secondary)] mt-2">
+        <p className="text-xs text-muted-foreground mt-2">
           Press Enter to send, Shift+Enter for new line
         </p>
       </div>

ui/src/components/AssistantFAB.tsx

@@ -3,6 +3,7 @@
  */
 
 import { MessageCircle, X } from 'lucide-react'
+import { Button } from '@/components/ui/button'
 
 interface AssistantFABProps {
   onClick: () => void
@@ -11,24 +12,14 @@ interface AssistantFABProps {
 
 export function AssistantFAB({ onClick, isOpen }: AssistantFABProps) {
   return (
-    <button
+    <Button
       onClick={onClick}
-      className={`
-        fixed bottom-6 right-6 z-50
-        w-14 h-14
-        flex items-center justify-center
-        bg-[var(--color-neo-progress)] text-[var(--color-neo-text-on-bright)]
-        border-3 border-[var(--color-neo-border)]
-        shadow-neo-md
-        transition-all duration-200
-        hover:shadow-neo-lg hover:-translate-y-0.5
-        active:shadow-neo-sm active:translate-y-0.5
-        ${isOpen ? 'rotate-0' : ''}
-      `}
+      size="icon"
+      className="fixed bottom-6 right-6 z-50 w-14 h-14 rounded-full shadow-lg hover:shadow-xl transition-all duration-200 hover:-translate-y-0.5 active:translate-y-0.5"
       title={isOpen ? 'Close Assistant (Press A)' : 'Open Assistant (Press A)'}
       aria-label={isOpen ? 'Close Assistant' : 'Open Assistant'}
     >
       {isOpen ? <X size={24} /> : <MessageCircle size={24} />}
-    </button>
+    </Button>
   )
 }

ui/src/components/AssistantPanel.tsx

@@ -11,6 +11,7 @@ import { X, Bot } from 'lucide-react'
 import { AssistantChat } from './AssistantChat'
 import { useConversation } from '../hooks/useConversations'
 import type { ChatMessage } from '../lib/types'
+import { Button } from '@/components/ui/button'
 
 interface AssistantPanelProps {
   projectName: string
@@ -49,11 +50,23 @@ export function AssistantPanel({ projectName, isOpen, onClose }: AssistantPanelP
   )
 
   // Fetch conversation details when we have an ID
-  const { data: conversationDetail, isLoading: isLoadingConversation } = useConversation(
+  const { data: conversationDetail, isLoading: isLoadingConversation, error: conversationError } = useConversation(
     projectName,
     conversationId
   )
 
+  // Clear stored conversation ID if it no longer exists (404 error)
+  useEffect(() => {
+    if (conversationError && conversationId) {
+      const message = conversationError.message.toLowerCase()
+      // Only clear for 404 errors, not transient network issues
+      if (message.includes('not found') || message.includes('404')) {
+        console.warn(`Conversation ${conversationId} not found, clearing stored ID`)
+        setConversationId(null)
+      }
+    }
+  }, [conversationError, conversationId])
+
   // Convert API messages to ChatMessage format for the chat component
   const initialMessages: ChatMessage[] | undefined = conversationDetail?.messages.map((msg) => ({
     id: `db-${msg.id}`,
@@ -103,45 +116,37 @@ export function AssistantPanel({ projectName, isOpen, onClose }: AssistantPanelP
         className={`
           fixed right-0 top-0 bottom-0 z-50
           w-[400px] max-w-[90vw]
-          bg-neo-card
-          border-l-4 border-[var(--color-neo-border)]
+          bg-card
+          border-l border-border
           transform transition-transform duration-300 ease-out
-          flex flex-col
+          flex flex-col shadow-xl
           ${isOpen ? 'translate-x-0' : 'translate-x-full'}
         `}
-        style={{ boxShadow: 'var(--shadow-neo-left-lg)' }}
         role="dialog"
         aria-label="Project Assistant"
         aria-hidden={!isOpen}
       >
         {/* Header */}
-        <div className="flex items-center justify-between px-4 py-3 border-b-3 border-neo-border bg-neo-progress">
+        <div className="flex items-center justify-between px-4 py-3 border-b border-border bg-primary text-primary-foreground">
           <div className="flex items-center gap-2">
-            <div
-              className="bg-neo-card border-2 border-neo-border p-1.5"
-              style={{ boxShadow: 'var(--shadow-neo-sm)' }}
-            >
+            <div className="bg-card text-foreground border border-border p-1.5 rounded">
               <Bot size={18} />
             </div>
             <div>
-              <h2 className="font-display font-bold text-neo-text-on-bright">Project Assistant</h2>
-              <p className="text-xs text-neo-text-on-bright opacity-80 font-mono">{projectName}</p>
+              <h2 className="font-semibold">Project Assistant</h2>
+              <p className="text-xs opacity-80 font-mono">{projectName}</p>
             </div>
           </div>
-          <button
+          <Button
+            variant="ghost"
+            size="icon"
             onClick={onClose}
-            className="
-              neo-btn neo-btn-ghost
-              p-2
-              bg-[var(--color-neo-card)] border-[var(--color-neo-border)]
-              hover:bg-[var(--color-neo-bg)]
-              text-[var(--color-neo-text)]
-            "
+            className="text-primary-foreground hover:bg-primary-foreground/20"
             title="Close Assistant (Press A)"
             aria-label="Close Assistant"
           >
             <X size={18} />
-          </button>
+          </Button>
         </div>
 
         {/* Chat area */}

ui/src/components/CelebrationOverlay.tsx

@@ -2,6 +2,7 @@ import { useCallback, useEffect, useState } from 'react'
 import { Sparkles, PartyPopper } from 'lucide-react'
 import { AgentAvatar } from './AgentAvatar'
 import type { AgentMascot } from '../lib/types'
+import { Card, CardContent } from '@/components/ui/card'
 
 interface CelebrationOverlayProps {
   agentName: AgentMascot | 'Unknown'
@@ -80,17 +81,18 @@ export function CelebrationOverlay({ agentName, featureName, onComplete }: Celeb
       </div>
 
       {/* Celebration card - click to dismiss */}
-      <button
-        type="button"
+      <Card
         onClick={dismiss}
-        className="neo-card p-6 bg-[var(--color-neo-done)] animate-bounce-in pointer-events-auto cursor-pointer hover:scale-105 transition-transform focus:outline-none focus:ring-2 focus:ring-neo-accent"
+        className="p-6 bg-green-500 border-green-600 animate-bounce-in pointer-events-auto cursor-pointer hover:scale-105 transition-transform focus:outline-none focus:ring-2 focus:ring-primary"
+        role="button"
+        tabIndex={0}
       >
-        <div className="flex flex-col items-center gap-4">
+        <CardContent className="p-0 flex flex-col items-center gap-4">
           {/* Icons */}
           <div className="flex items-center gap-2">
-            <Sparkles size={24} className="text-neo-pending animate-pulse" />
-            <PartyPopper size={28} className="text-neo-accent" />
-            <Sparkles size={24} className="text-neo-pending animate-pulse" />
+            <Sparkles size={24} className="text-yellow-300 animate-pulse" />
+            <PartyPopper size={28} className="text-white" />
+            <Sparkles size={24} className="text-yellow-300 animate-pulse" />
           </div>
 
           {/* Avatar celebrating */}
@@ -98,23 +100,23 @@ export function CelebrationOverlay({ agentName, featureName, onComplete }: Celeb
 
           {/* Message */}
           <div className="text-center">
-            <h3 className="font-display text-lg font-bold text-neo-text-on-bright mb-1">
+            <h3 className="font-display text-lg font-bold text-white mb-1">
               Feature Complete!
             </h3>
-            <p className="text-sm text-neo-text-on-bright/80 max-w-[200px] truncate">
+            <p className="text-sm text-white/80 max-w-[200px] truncate">
               {featureName}
             </p>
-            <p className="text-xs text-neo-text-on-bright/60 mt-2">
+            <p className="text-xs text-white/60 mt-2">
               Great job, {agentName}!
             </p>
           </div>
 
           {/* Dismiss hint */}
-          <p className="text-xs text-neo-text-on-bright/40 mt-1">
+          <p className="text-xs text-white/40 mt-1">
             Click or press Esc to dismiss
           </p>
-        </div>
-      </button>
+        </CardContent>
+      </Card>
     </div>
   )
 }

ui/src/components/ChatMessage.tsx

@@ -2,12 +2,13 @@
  * Chat Message Component
  *
  * Displays a single message in the spec creation chat.
- * Supports user, assistant, and system messages with neobrutalism styling.
+ * Supports user, assistant, and system messages with clean styling.
  */
 
 import { memo } from 'react'
 import { Bot, User, Info } from 'lucide-react'
 import type { ChatMessage as ChatMessageType } from '../lib/types'
+import { Card } from '@/components/ui/card'
 
 interface ChatMessageProps {
   message: ChatMessageType
@@ -25,37 +26,34 @@ export const ChatMessage = memo(function ChatMessage({ message }: ChatMessagePro
     minute: '2-digit',
   })
 
-  // Role-specific styling using CSS variables for theme consistency
+  // Role-specific styling
   const roleConfig = {
     user: {
       icon: User,
-      bgColor: 'bg-[var(--color-neo-pending)]',
-      textColor: 'text-[var(--color-neo-text-on-bright)]',
-      borderColor: 'border-[var(--color-neo-border)]',
+      bgColor: 'bg-primary',
+      textColor: 'text-primary-foreground',
       align: 'justify-end',
       bubbleAlign: 'items-end',
-      iconBg: 'bg-[var(--color-neo-pending)]',
-      shadow: 'var(--shadow-neo-md)',
+      iconBg: 'bg-primary',
+      iconColor: 'text-primary-foreground',
     },
     assistant: {
       icon: Bot,
-      bgColor: 'bg-[var(--color-neo-card)]',
-      textColor: 'text-[var(--color-neo-text)]',
-      borderColor: 'border-[var(--color-neo-border)]',
+      bgColor: 'bg-muted',
+      textColor: 'text-foreground',
       align: 'justify-start',
       bubbleAlign: 'items-start',
-      iconBg: 'bg-[var(--color-neo-progress)]',
-      shadow: 'var(--shadow-neo-md)',
+      iconBg: 'bg-secondary',
+      iconColor: 'text-secondary-foreground',
     },
     system: {
       icon: Info,
-      bgColor: 'bg-[var(--color-neo-done)]',
-      textColor: 'text-[var(--color-neo-text-on-bright)]',
-      borderColor: 'border-[var(--color-neo-border)]',
+      bgColor: 'bg-green-100 dark:bg-green-900/30',
+      textColor: 'text-green-900 dark:text-green-100',
       align: 'justify-center',
       bubbleAlign: 'items-center',
-      iconBg: 'bg-[var(--color-neo-done)]',
-      shadow: 'var(--shadow-neo-sm)',
+      iconBg: 'bg-green-500',
+      iconColor: 'text-white',
     },
   }
 
@@ -66,15 +64,7 @@ export const ChatMessage = memo(function ChatMessage({ message }: ChatMessagePro
   if (role === 'system') {
     return (
       <div className={`flex ${config.align} px-4 py-2`}>
-        <div
-          className={`
-            ${config.bgColor}
-            border-2 ${config.borderColor}
-            px-4 py-2
-            text-sm font-mono text-[var(--color-neo-text-on-bright)]
-          `}
-          style={{ boxShadow: 'var(--shadow-neo-sm)' }}
-        >
+        <div className={`${config.bgColor} border border-border rounded-lg px-4 py-2 text-sm font-mono ${config.textColor}`}>
           <span className="flex items-center gap-2">
             <Icon size={14} />
             {content}
@@ -90,28 +80,12 @@ export const ChatMessage = memo(function ChatMessage({ message }: ChatMessagePro
         {/* Message bubble */}
         <div className="flex items-start gap-2">
           {role === 'assistant' && (
-            <div
-              className={`
-                ${config.iconBg}
-                border-2 border-[var(--color-neo-border)]
-                p-1.5
-                flex-shrink-0
-              `}
-              style={{ boxShadow: 'var(--shadow-neo-sm)' }}
-            >
-              <Icon size={16} className="text-[var(--color-neo-text-on-bright)]" />
+            <div className={`${config.iconBg} p-1.5 rounded flex-shrink-0`}>
+              <Icon size={16} className={config.iconColor} />
             </div>
           )}
 
-          <div
-            className={`
-              ${config.bgColor}
-              border-3 ${config.borderColor}
-              px-4 py-3
-              ${isStreaming ? 'animate-pulse-neo' : ''}
-            `}
-            style={{ boxShadow: config.shadow }}
-          >
+          <Card className={`${config.bgColor} px-4 py-3 border ${isStreaming ? 'animate-pulse' : ''}`}>
             {/* Parse content for basic markdown-like formatting */}
             {content && (
               <div className={`whitespace-pre-wrap text-sm leading-relaxed ${config.textColor}`}>
@@ -152,19 +126,15 @@ export const ChatMessage = memo(function ChatMessage({ message }: ChatMessagePro
             {attachments && attachments.length > 0 && (
               <div className={`flex flex-wrap gap-2 ${content ? 'mt-3' : ''}`}>
                 {attachments.map((attachment) => (
-                  <div
-                    key={attachment.id}
-                    className="border-2 border-[var(--color-neo-border)] p-1 bg-[var(--color-neo-card)]"
-                    style={{ boxShadow: 'var(--shadow-neo-sm)' }}
-                  >
+                  <div key={attachment.id} className="border border-border rounded p-1 bg-card">
                     <img
                       src={attachment.previewUrl}
                       alt={attachment.filename}
-                      className="max-w-48 max-h-48 object-contain cursor-pointer hover:opacity-90 transition-opacity"
+                      className="max-w-48 max-h-48 object-contain cursor-pointer hover:opacity-90 transition-opacity rounded"
                       onClick={() => window.open(attachment.previewUrl, '_blank')}
                       title={`${attachment.filename} (click to enlarge)`}
                     />
-                    <span className="text-xs text-[var(--color-neo-text-secondary)] block mt-1 text-center">
+                    <span className="text-xs text-muted-foreground block mt-1 text-center">
                       {attachment.filename}
                     </span>
                   </div>
@@ -174,27 +144,19 @@ export const ChatMessage = memo(function ChatMessage({ message }: ChatMessagePro
 
             {/* Streaming indicator */}
             {isStreaming && (
-              <span className="inline-block w-2 h-4 bg-[var(--color-neo-accent)] ml-1 animate-pulse" />
+              <span className="inline-block w-2 h-4 bg-primary ml-1 animate-pulse rounded" />
             )}
-          </div>
+          </Card>
 
           {role === 'user' && (
-            <div
-              className={`
-                ${config.iconBg}
-                border-2 border-[var(--color-neo-border)]
-                p-1.5
-                flex-shrink-0
-              `}
-              style={{ boxShadow: 'var(--shadow-neo-sm)' }}
-            >
-              <Icon size={16} className="text-[var(--color-neo-text-on-bright)]" />
+            <div className={`${config.iconBg} p-1.5 rounded flex-shrink-0`}>
+              <Icon size={16} className={config.iconColor} />
             </div>
           )}
         </div>
 
         {/* Timestamp */}
-        <span className="text-xs text-[var(--color-neo-text-secondary)] font-mono px-2">
+        <span className="text-xs text-muted-foreground font-mono px-2">
           {timeString}
         </span>
       </div>

ui/src/components/ConfirmDialog.tsx

@@ -1,12 +1,21 @@
 /**
  * ConfirmDialog Component
  *
- * A reusable confirmation dialog following the neobrutalism design system.
+ * A reusable confirmation dialog using ShadCN Dialog components.
  * Used to confirm destructive actions like deleting projects.
  */
 
 import type { ReactNode } from 'react'
-import { AlertTriangle, X } from 'lucide-react'
+import { AlertTriangle } from 'lucide-react'
+import {
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle,
+} from '@/components/ui/dialog'
+import { Button } from '@/components/ui/button'
 
 interface ConfirmDialogProps {
   isOpen: boolean
@@ -31,74 +40,39 @@ export function ConfirmDialog({
   onConfirm,
   onCancel,
 }: ConfirmDialogProps) {
-  if (!isOpen) return null
-
-  const variantColors = {
-    danger: {
-      icon: 'var(--color-neo-danger)',
-      button: 'neo-btn-danger',
-    },
-    warning: {
-      icon: 'var(--color-neo-pending)',
-      button: 'neo-btn-warning',
-    },
-  }
-
-  const colors = variantColors[variant]
-
   return (
-    <div className="neo-modal-backdrop" onClick={onCancel}>
-      <div
-        className="neo-modal w-full max-w-md"
-        onClick={(e) => e.stopPropagation()}
-      >
-        {/* Header */}
-        <div className="flex items-center justify-between p-4 border-b-3 border-[var(--color-neo-border)]">
+    <Dialog open={isOpen} onOpenChange={(open) => !open && onCancel()}>
+      <DialogContent className="sm:max-w-md">
+        <DialogHeader>
           <div className="flex items-center gap-3">
             <div
-              className="p-2 border-2 border-[var(--color-neo-border)]"
-              style={{ boxShadow: 'var(--shadow-neo-sm)', backgroundColor: colors.icon }}
+              className={`p-2 rounded-lg ${
+                variant === 'danger'
+                  ? 'bg-destructive/10 text-destructive'
+                  : 'bg-primary/10 text-primary'
+              }`}
             >
-              <AlertTriangle size={20} className="text-[var(--color-neo-text-on-bright)]" />
+              <AlertTriangle size={20} />
             </div>
-            <h2 className="font-display font-bold text-lg text-[var(--color-neo-text)]">
-              {title}
-            </h2>
+            <DialogTitle>{title}</DialogTitle>
           </div>
-          <button
-            onClick={onCancel}
-            className="neo-btn neo-btn-ghost p-2"
+        </DialogHeader>
+        <DialogDescription asChild>
+          <div className="text-muted-foreground">{message}</div>
+        </DialogDescription>
+        <DialogFooter className="gap-2 sm:gap-0">
+          <Button variant="outline" onClick={onCancel} disabled={isLoading}>
+            {cancelLabel}
+          </Button>
+          <Button
+            variant={variant === 'danger' ? 'destructive' : 'default'}
+            onClick={onConfirm}
             disabled={isLoading}
           >
-            <X size={20} />
-          </button>
-        </div>
-
-        {/* Content */}
-        <div className="p-6">
-          <div className="text-[var(--color-neo-text-secondary)] mb-6">
-            {message}
-          </div>
-
-          {/* Actions */}
-          <div className="flex justify-end gap-3">
-            <button
-              onClick={onCancel}
-              className="neo-btn"
-              disabled={isLoading}
-            >
-              {cancelLabel}
-            </button>
-            <button
-              onClick={onConfirm}
-              className={`neo-btn ${colors.button}`}
-              disabled={isLoading}
-            >
-              {isLoading ? 'Deleting...' : confirmLabel}
-            </button>
-          </div>
-        </div>
-      </div>
-    </div>
+            {isLoading ? 'Deleting...' : confirmLabel}
+          </Button>
+        </DialogFooter>
+      </DialogContent>
+    </Dialog>
   )
 }

ui/src/components/ConversationHistory.tsx

@@ -10,6 +10,8 @@ import { MessageSquare, Trash2, Loader2, AlertCircle } from 'lucide-react'
 import { useConversations, useDeleteConversation } from '../hooks/useConversations'
 import { ConfirmDialog } from './ConfirmDialog'
 import type { AssistantConversation } from '../lib/types'
+import { Button } from '@/components/ui/button'
+import { Card, CardContent, CardHeader } from '@/components/ui/card'
 
 interface ConversationHistoryProps {
   projectName: string
@@ -116,78 +118,73 @@ export function ConversationHistory({
       />
 
       {/* Dropdown */}
-      <div
-        className="absolute top-full left-0 mt-2 neo-dropdown z-50 w-[320px] max-w-[calc(100vw-2rem)]"
-        style={{ boxShadow: 'var(--shadow-neo)' }}
-      >
+      <Card className="absolute top-full left-0 mt-2 z-50 w-[320px] max-w-[calc(100vw-2rem)] shadow-lg">
         {/* Header */}
-        <div className="px-3 py-2 border-b-2 border-[var(--color-neo-border)] bg-[var(--color-neo-bg)]">
+        <CardHeader className="p-3 border-b border-border">
           <h3 className="font-bold text-sm">Conversation History</h3>
-        </div>
+        </CardHeader>
 
         {/* Content */}
-        {isLoading ? (
-          <div className="p-4 flex items-center justify-center">
-            <Loader2 size={20} className="animate-spin text-[var(--color-neo-text-secondary)]" />
-          </div>
-        ) : !conversations || conversations.length === 0 ? (
-          <div className="p-4 text-center text-[var(--color-neo-text-secondary)] text-sm">
-            No conversations yet
-          </div>
-        ) : (
-          <div className="max-h-[300px] overflow-auto">
-            {conversations.map((conversation) => {
-              const isCurrent = conversation.id === currentConversationId
+        <CardContent className="p-0">
+          {isLoading ? (
+            <div className="p-4 flex items-center justify-center">
+              <Loader2 size={20} className="animate-spin text-muted-foreground" />
+            </div>
+          ) : !conversations || conversations.length === 0 ? (
+            <div className="p-4 text-center text-muted-foreground text-sm">
+              No conversations yet
+            </div>
+          ) : (
+            <div className="max-h-[300px] overflow-y-auto">
+              {conversations.map((conversation) => {
+                const isCurrent = conversation.id === currentConversationId
 
-              return (
-                <div
-                  key={conversation.id}
-                  className={`flex items-center group ${
-                    isCurrent
-                      ? 'bg-[var(--color-neo-pending)] text-[var(--color-neo-text-on-bright)]'
-                      : ''
-                  }`}
-                >
-                  <button
-                    onClick={() => handleSelectConversation(conversation.id)}
-                    className="flex-1 neo-dropdown-item text-left"
-                    disabled={isCurrent}
+                return (
+                  <div
+                    key={conversation.id}
+                    className={`flex items-center group ${
+                      isCurrent ? 'bg-primary/10' : 'hover:bg-muted'
+                    }`}
                   >
-                    <div className="flex items-start gap-2">
-                      <MessageSquare size={16} className="mt-0.5 flex-shrink-0" />
-                      <div className="flex-1 min-w-0">
-                        <div className="font-medium truncate">
-                          {conversation.title || 'Untitled conversation'}
-                        </div>
-                        <div className={`text-xs flex items-center gap-2 ${
-                          isCurrent
-                            ? 'text-[var(--color-neo-text-on-bright)] opacity-80'
-                            : 'text-[var(--color-neo-text-secondary)]'
-                        }`}>
-                          <span>{conversation.message_count} messages</span>
-                          <span>|</span>
-                          <span>{formatRelativeTime(conversation.updated_at)}</span>
+                    <button
+                      onClick={() => handleSelectConversation(conversation.id)}
+                      className="flex-1 px-3 py-2 text-left"
+                      disabled={isCurrent}
+                    >
+                      <div className="flex items-start gap-2">
+                        <MessageSquare size={16} className="mt-0.5 flex-shrink-0 text-muted-foreground" />
+                        <div className="flex-1 min-w-0">
+                          <div className="font-medium truncate text-foreground">
+                            {conversation.title || 'Untitled conversation'}
+                          </div>
+                          <div className="text-xs flex items-center gap-2 text-muted-foreground">
+                            <span>{conversation.message_count} messages</span>
+                            <span>|</span>
+                            <span>{formatRelativeTime(conversation.updated_at)}</span>
+                          </div>
                         </div>
                       </div>
-                    </div>
-                  </button>
-                  <button
-                    onClick={(e) => handleDeleteClick(e, conversation)}
-                    className={`p-2 mr-2 transition-colors rounded ${
-                      isCurrent
-                        ? 'text-[var(--color-neo-text-on-bright)] opacity-60 hover:opacity-100 hover:bg-[var(--color-neo-danger)]/20'
-                        : 'text-[var(--color-neo-text-secondary)] opacity-0 group-hover:opacity-100 hover:text-[var(--color-neo-danger)] hover:bg-[var(--color-neo-danger)]/10'
-                    }`}
-                    title="Delete conversation"
-                  >
-                    <Trash2 size={14} />
-                  </button>
-                </div>
-              )
-            })}
-          </div>
-        )}
-      </div>
+                    </button>
+                    <Button
+                      variant="ghost"
+                      size="icon"
+                      onClick={(e: React.MouseEvent) => handleDeleteClick(e, conversation)}
+                      className={`h-8 w-8 mr-2 ${
+                        isCurrent
+                          ? 'opacity-60 hover:opacity-100'
+                          : 'opacity-0 group-hover:opacity-100'
+                      } hover:text-destructive hover:bg-destructive/10`}
+                      title="Delete conversation"
+                    >
+                      <Trash2 size={14} />
+                    </Button>
+                  </div>
+                )
+              })}
+            </div>
+          )}
+        </CardContent>
+      </Card>
 
       {/* Delete Confirmation Dialog */}
       <ConfirmDialog
@@ -197,7 +194,7 @@ export function ConversationHistory({
           deleteError ? (
             <div className="space-y-3">
               <p>{`Are you sure you want to delete "${conversationToDelete?.title || 'this conversation'}"? This action cannot be undone.`}</p>
-              <div className="flex items-center gap-2 p-2 bg-[var(--color-neo-danger)]/10 border border-[var(--color-neo-danger)] rounded text-sm text-[var(--color-neo-danger)]">
+              <div className="flex items-center gap-2 p-2 bg-destructive/10 border border-destructive rounded text-sm text-destructive">
                 <AlertCircle size={16} className="flex-shrink-0" />
                 <span>{deleteError}</span>
               </div>

ui/src/components/DebugLogViewer.tsx

@@ -12,6 +12,8 @@ import { Terminal } from './Terminal'
 import { TerminalTabs } from './TerminalTabs'
 import { listTerminals, createTerminal, renameTerminal, deleteTerminal } from '@/lib/api'
 import type { TerminalInfo } from '@/lib/types'
+import { Button } from '@/components/ui/button'
+import { Badge } from '@/components/ui/badge'
 
 const MIN_HEIGHT = 150
 const MAX_HEIGHT = 600
@@ -273,18 +275,18 @@ export function DebugLogViewer({
     return 'info'
   }
 
-  // Get color class for log level using theme CSS variables
+  // Get color class for log level
   const getLogColor = (level: LogLevel): string => {
     switch (level) {
       case 'error':
-        return 'text-[var(--color-neo-log-error)]'
+        return 'text-red-500'
       case 'warn':
-        return 'text-[var(--color-neo-log-warning)]'
+        return 'text-yellow-500'
       case 'debug':
-        return 'text-[var(--color-neo-log-debug)]'
+        return 'text-blue-400'
       case 'info':
       default:
-        return 'text-[var(--color-neo-log-info)]'
+        return 'text-foreground'
     }
   }
 
@@ -316,89 +318,83 @@ export function DebugLogViewer({
           className="absolute top-0 left-0 right-0 h-2 cursor-ns-resize group flex items-center justify-center -translate-y-1/2 z-50"
           onMouseDown={handleResizeStart}
         >
-          <div className="w-16 h-1.5 bg-[var(--color-neo-border)] rounded-full group-hover:bg-[var(--color-neo-text-secondary)] transition-colors flex items-center justify-center">
-            <GripHorizontal size={12} className="text-[var(--color-neo-text-muted)] group-hover:text-[var(--color-neo-text-secondary)]" />
+          <div className="w-16 h-1.5 bg-border rounded-full group-hover:bg-muted-foreground transition-colors flex items-center justify-center">
+            <GripHorizontal size={12} className="text-muted-foreground group-hover:text-foreground" />
           </div>
         </div>
       )}
 
       {/* Header bar */}
       <div
-        className="flex items-center justify-between h-10 px-4 bg-[var(--color-neo-border)] border-t-3 border-[var(--color-neo-text)]"
+        className="flex items-center justify-between h-10 px-4 bg-muted border-t border-border"
       >
         <div className="flex items-center gap-2">
           {/* Collapse/expand toggle */}
           <button
             onClick={onToggle}
-            className="flex items-center gap-2 hover:bg-[var(--color-neo-hover-subtle)] px-2 py-1 rounded transition-colors cursor-pointer"
+            className="flex items-center gap-2 hover:bg-accent px-2 py-1 rounded transition-colors cursor-pointer"
           >
-            <TerminalIcon size={16} className="text-[var(--color-neo-done)]" />
-            <span className="font-mono text-sm text-[var(--color-neo-bg)] font-bold">
+            <TerminalIcon size={16} className="text-green-500" />
+            <span className="font-mono text-sm text-foreground font-bold">
               Debug
             </span>
-            <span className="px-1.5 py-0.5 text-xs font-mono bg-[var(--color-neo-card)] text-[var(--color-neo-text-muted)] rounded" title="Toggle debug panel">
+            <Badge variant="secondary" className="text-xs font-mono" title="Toggle debug panel">
               D
-            </span>
+            </Badge>
           </button>
 
           {/* Tabs - only visible when open */}
           {isOpen && (
             <div className="flex items-center gap-1 ml-4">
-              <button
-                onClick={(e) => {
+              <Button
+                variant={activeTab === 'agent' ? 'secondary' : 'ghost'}
+                size="sm"
+                onClick={(e: React.MouseEvent) => {
                   e.stopPropagation()
                   setActiveTab('agent')
                 }}
-                className={`flex items-center gap-1.5 px-3 py-1 text-xs font-mono rounded transition-colors ${
-                  activeTab === 'agent'
-                    ? 'bg-[var(--color-neo-card)] text-[var(--color-neo-text)]'
-                    : 'text-[var(--color-neo-text-muted)] hover:text-[var(--color-neo-text)] hover:bg-[var(--color-neo-hover-subtle)]'
-                }`}
+                className="h-7 text-xs font-mono gap-1.5"
               >
                 <Cpu size={12} />
                 Agent
                 {logs.length > 0 && (
-                  <span className="px-1.5 py-0.5 text-[10px] bg-[var(--color-neo-text-secondary)] text-[var(--color-neo-bg)] rounded">
+                  <Badge variant="default" className="h-4 px-1.5 text-[10px]">
                     {logs.length}
-                  </span>
+                  </Badge>
                 )}
-              </button>
-              <button
-                onClick={(e) => {
+              </Button>
+              <Button
+                variant={activeTab === 'devserver' ? 'secondary' : 'ghost'}
+                size="sm"
+                onClick={(e: React.MouseEvent) => {
                   e.stopPropagation()
                   setActiveTab('devserver')
                 }}
-                className={`flex items-center gap-1.5 px-3 py-1 text-xs font-mono rounded transition-colors ${
-                  activeTab === 'devserver'
-                    ? 'bg-[var(--color-neo-card)] text-[var(--color-neo-text)]'
-                    : 'text-[var(--color-neo-text-muted)] hover:text-[var(--color-neo-text)] hover:bg-[var(--color-neo-hover-subtle)]'
-                }`}
+                className="h-7 text-xs font-mono gap-1.5"
               >
                 <Server size={12} />
                 Dev Server
                 {devLogs.length > 0 && (
-                  <span className="px-1.5 py-0.5 text-[10px] bg-[var(--color-neo-text-secondary)] text-[var(--color-neo-bg)] rounded">
+                  <Badge variant="default" className="h-4 px-1.5 text-[10px]">
                     {devLogs.length}
-                  </span>
+                  </Badge>
                 )}
-              </button>
-              <button
-                onClick={(e) => {
+              </Button>
+              <Button
+                variant={activeTab === 'terminal' ? 'secondary' : 'ghost'}
+                size="sm"
+                onClick={(e: React.MouseEvent) => {
                   e.stopPropagation()
                   setActiveTab('terminal')
                 }}
-                className={`flex items-center gap-1.5 px-3 py-1 text-xs font-mono rounded transition-colors ${
-                  activeTab === 'terminal'
-                    ? 'bg-[var(--color-neo-card)] text-[var(--color-neo-text)]'
-                    : 'text-[var(--color-neo-text-muted)] hover:text-[var(--color-neo-text)] hover:bg-[var(--color-neo-hover-subtle)]'
-                }`}
+                className="h-7 text-xs font-mono gap-1.5"
               >
                 <TerminalIcon size={12} />
                 Terminal
-                <span className="px-1.5 py-0.5 text-[10px] bg-[var(--color-neo-text-secondary)] text-[var(--color-neo-text-muted)] rounded" title="Toggle terminal">
+                <Badge variant="outline" className="h-4 px-1.5 text-[10px]" title="Toggle terminal">
                   T
-                </span>
-              </button>
+                </Badge>
+              </Button>
             </div>
           )}
 
@@ -406,14 +402,14 @@ export function DebugLogViewer({
           {isOpen && activeTab !== 'terminal' && (
             <>
               {getCurrentLogCount() > 0 && (
-                <span className="px-2 py-0.5 text-xs font-mono bg-[var(--color-neo-card)] text-[var(--color-neo-text-secondary)] rounded ml-2">
+                <Badge variant="secondary" className="ml-2 font-mono">
                   {getCurrentLogCount()}
-                </span>
+                </Badge>
               )}
               {isAutoScrollPaused() && (
-                <span className="px-2 py-0.5 text-xs font-mono bg-[var(--color-neo-pending)] text-[var(--color-neo-text-on-bright)] rounded">
+                <Badge variant="default" className="bg-yellow-500 text-yellow-950">
                   Paused
-                </span>
+                </Badge>
               )}
             </>
           )}
@@ -422,22 +418,24 @@ export function DebugLogViewer({
         <div className="flex items-center gap-2">
           {/* Clear button - only for log tabs */}
           {isOpen && activeTab !== 'terminal' && (
-            <button
-              onClick={(e) => {
+            <Button
+              variant="ghost"
+              size="icon"
+              onClick={(e: React.MouseEvent) => {
                 e.stopPropagation()
                 handleClear()
               }}
-              className="p-1.5 hover:bg-[var(--color-neo-hover-subtle)] rounded transition-colors"
+              className="h-7 w-7"
               title="Clear logs"
             >
-              <Trash2 size={14} className="text-[var(--color-neo-text-muted)]" />
-            </button>
+              <Trash2 size={14} className="text-muted-foreground" />
+            </Button>
           )}
           <div className="p-1">
             {isOpen ? (
-              <ChevronDown size={16} className="text-[var(--color-neo-text-muted)]" />
+              <ChevronDown size={16} className="text-muted-foreground" />
             ) : (
-              <ChevronUp size={16} className="text-[var(--color-neo-text-muted)]" />
+              <ChevronUp size={16} className="text-muted-foreground" />
             )}
           </div>
         </div>
@@ -445,7 +443,7 @@ export function DebugLogViewer({
 
       {/* Content area */}
       {isOpen && (
-        <div className="h-[calc(100%-2.5rem)] bg-[var(--color-neo-border)]">
+        <div className="h-[calc(100%-2.5rem)] bg-card">
           {/* Agent Logs Tab */}
           {activeTab === 'agent' && (
             <div
@@ -454,7 +452,7 @@ export function DebugLogViewer({
               className="h-full overflow-y-auto p-2 font-mono text-sm"
             >
               {logs.length === 0 ? (
-                <div className="flex items-center justify-center h-full text-[var(--color-neo-text-muted)]">
+                <div className="flex items-center justify-center h-full text-muted-foreground">
                   No logs yet. Start the agent to see output.
                 </div>
               ) : (
@@ -467,9 +465,9 @@ export function DebugLogViewer({
                     return (
                       <div
                         key={`${log.timestamp}-${index}`}
-                        className="flex gap-2 hover:bg-[var(--color-neo-hover-subtle)] px-1 py-0.5 rounded"
+                        className="flex gap-2 hover:bg-muted px-1 py-0.5 rounded"
                       >
-                        <span className="text-[var(--color-neo-text-muted)] select-none shrink-0">
+                        <span className="text-muted-foreground select-none shrink-0">
                           {timestamp}
                         </span>
                         <span className={`${colorClass} whitespace-pre-wrap break-all`}>
@@ -491,7 +489,7 @@ export function DebugLogViewer({
               className="h-full overflow-y-auto p-2 font-mono text-sm"
             >
               {devLogs.length === 0 ? (
-                <div className="flex items-center justify-center h-full text-[var(--color-neo-text-muted)]">
+                <div className="flex items-center justify-center h-full text-muted-foreground">
                   No dev server logs yet.
                 </div>
               ) : (
@@ -504,9 +502,9 @@ export function DebugLogViewer({
                     return (
                       <div
                         key={`${log.timestamp}-${index}`}
-                        className="flex gap-2 hover:bg-[var(--color-neo-hover-subtle)] px-1 py-0.5 rounded"
+                        className="flex gap-2 hover:bg-muted px-1 py-0.5 rounded"
                       >
-                        <span className="text-[var(--color-neo-text-muted)] select-none shrink-0">
+                        <span className="text-muted-foreground select-none shrink-0">
                           {timestamp}
                         </span>
                         <span className={`${colorClass} whitespace-pre-wrap break-all`}>
@@ -538,11 +536,11 @@ export function DebugLogViewer({
               {/* Terminal content - render all terminals and show/hide to preserve buffers */}
               <div className="flex-1 min-h-0 relative">
                 {isLoadingTerminals ? (
-                  <div className="h-full flex items-center justify-center text-[var(--color-neo-text-muted)] font-mono text-sm">
+                  <div className="h-full flex items-center justify-center text-muted-foreground font-mono text-sm">
                     Loading terminals...
                   </div>
                 ) : terminals.length === 0 ? (
-                  <div className="h-full flex items-center justify-center text-[var(--color-neo-text-muted)] font-mono text-sm">
+                  <div className="h-full flex items-center justify-center text-muted-foreground font-mono text-sm">
                     No terminal available
                   </div>
                 ) : (

ui/src/components/DependencyBadge.tsx

@@ -1,5 +1,6 @@
 import { AlertTriangle, GitBranch, Check } from 'lucide-react'
 import type { Feature } from '../lib/types'
+import { Badge } from '@/components/ui/badge'
 
 interface DependencyBadgeProps {
   feature: Feature
@@ -38,14 +39,13 @@ export function DependencyBadge({ feature, allFeatures = [], compact = false }:
   if (compact) {
     // Compact view for card displays
     return (
-      <div
-        className={`
-          inline-flex items-center gap-1 text-xs px-2 py-0.5 rounded-full font-mono
-          ${isBlocked
-            ? 'bg-neo-danger/20 text-neo-danger'
-            : 'bg-neo-neutral-200 text-neo-text-secondary'
-          }
-        `}
+      <Badge
+        variant="outline"
+        className={`gap-1 font-mono text-xs ${
+          isBlocked
+            ? 'bg-destructive/10 text-destructive border-destructive/30'
+            : 'bg-muted text-muted-foreground'
+        }`}
         title={isBlocked
           ? `Blocked by ${blockingCount} ${blockingCount === 1 ? 'dependency' : 'dependencies'}`
           : `${satisfiedCount}/${dependencies.length} dependencies satisfied`
@@ -62,7 +62,7 @@ export function DependencyBadge({ feature, allFeatures = [], compact = false }:
             <span>{satisfiedCount}/{dependencies.length}</span>
           </>
         )}
-      </div>
+      </Badge>
     )
   }
 
@@ -70,15 +70,15 @@ export function DependencyBadge({ feature, allFeatures = [], compact = false }:
   return (
     <div className="flex items-center gap-2">
       {isBlocked ? (
-        <div className="flex items-center gap-1.5 text-sm text-neo-danger">
+        <div className="flex items-center gap-1.5 text-sm text-destructive">
           <AlertTriangle size={14} />
           <span className="font-medium">
             Blocked by {blockingCount} {blockingCount === 1 ? 'dependency' : 'dependencies'}
           </span>
         </div>
       ) : (
-        <div className="flex items-center gap-1.5 text-sm text-neo-text-secondary">
-          <Check size={14} className="text-neo-done" />
+        <div className="flex items-center gap-1.5 text-sm text-muted-foreground">
+          <Check size={14} className="text-primary" />
           <span>
             All {dependencies.length} {dependencies.length === 1 ? 'dependency' : 'dependencies'} satisfied
           </span>
@@ -102,7 +102,7 @@ export function DependencyIndicator({ feature }: { feature: Feature }) {
   if (isBlocked) {
     return (
       <span
-        className="inline-flex items-center justify-center w-5 h-5 rounded-full bg-neo-danger/20 text-neo-danger"
+        className="inline-flex items-center justify-center w-5 h-5 rounded-full bg-destructive/10 text-destructive"
         title={`Blocked by ${feature.blocking_dependencies?.length || 0} dependencies`}
       >
         <AlertTriangle size={12} />
@@ -112,7 +112,7 @@ export function DependencyIndicator({ feature }: { feature: Feature }) {
 
   return (
     <span
-      className="inline-flex items-center justify-center w-5 h-5 rounded-full bg-neo-neutral-200 text-neo-text-secondary"
+      className="inline-flex items-center justify-center w-5 h-5 rounded-full bg-muted text-muted-foreground"
       title={`${dependencies.length} dependencies (all satisfied)`}
     >
       <GitBranch size={12} />

ui/src/components/DependencyGraph.tsx

@@ -18,6 +18,8 @@ import dagre from 'dagre'
 import { CheckCircle2, Circle, Loader2, AlertTriangle, RefreshCw } from 'lucide-react'
 import type { DependencyGraph as DependencyGraphData, GraphNode, ActiveAgent, AgentMascot, AgentState } from '../lib/types'
 import { AgentAvatar } from './AgentAvatar'
+import { Button } from '@/components/ui/button'
+import { Card, CardContent } from '@/components/ui/card'
 import '@xyflow/react/dist/style.css'
 
 // Node dimensions
@@ -69,20 +71,17 @@ class GraphErrorBoundary extends Component<ErrorBoundaryProps, ErrorBoundaryStat
   render() {
     if (this.state.hasError) {
       return (
-        <div className="h-full w-full flex items-center justify-center bg-neo-neutral-100">
+        <div className="h-full w-full flex items-center justify-center bg-muted">
           <div className="text-center p-6">
-            <AlertTriangle size={48} className="mx-auto mb-4 text-neo-warning" />
-            <div className="text-neo-text font-bold mb-2">Graph rendering error</div>
-            <div className="text-sm text-neo-text-secondary mb-4">
+            <AlertTriangle size={48} className="mx-auto mb-4 text-yellow-500" />
+            <div className="text-foreground font-bold mb-2">Graph rendering error</div>
+            <div className="text-sm text-muted-foreground mb-4">
               The dependency graph encountered an issue.
             </div>
-            <button
-              onClick={this.handleReset}
-              className="inline-flex items-center gap-2 px-4 py-2 bg-neo-accent text-white rounded border-2 border-neo-border shadow-neo-sm hover:shadow-neo-md transition-all"
-            >
+            <Button onClick={this.handleReset} className="gap-2">
               <RefreshCw size={16} />
               Reload Graph
-            </button>
+            </Button>
           </div>
         </div>
       )
@@ -95,32 +94,39 @@ class GraphErrorBoundary extends Component<ErrorBoundaryProps, ErrorBoundaryStat
 // Custom node component
 function FeatureNode({ data }: { data: GraphNode & { onClick?: () => void; agent?: NodeAgentInfo } }) {
   const statusColors = {
-    pending: 'bg-neo-pending border-neo-border',
-    in_progress: 'bg-neo-progress border-neo-border',
-    done: 'bg-neo-done border-neo-border',
-    blocked: 'bg-neo-danger/20 border-neo-danger',
+    pending: 'bg-yellow-100 border-yellow-300 dark:bg-yellow-900/30 dark:border-yellow-700',
+    in_progress: 'bg-cyan-100 border-cyan-300 dark:bg-cyan-900/30 dark:border-cyan-700',
+    done: 'bg-green-100 border-green-300 dark:bg-green-900/30 dark:border-green-700',
+    blocked: 'bg-red-50 border-red-300 dark:bg-red-900/20 dark:border-red-700',
+  }
+
+  const textColors = {
+    pending: 'text-yellow-900 dark:text-yellow-100',
+    in_progress: 'text-cyan-900 dark:text-cyan-100',
+    done: 'text-green-900 dark:text-green-100',
+    blocked: 'text-red-900 dark:text-red-100',
   }
 
   const StatusIcon = () => {
     switch (data.status) {
       case 'done':
-        return <CheckCircle2 size={16} className="text-neo-text-on-bright" />
+        return <CheckCircle2 size={16} className={textColors[data.status]} />
       case 'in_progress':
-        return <Loader2 size={16} className="text-neo-text-on-bright animate-spin" />
+        return <Loader2 size={16} className={`${textColors[data.status]} animate-spin`} />
       case 'blocked':
-        return <AlertTriangle size={16} className="text-neo-danger" />
+        return <AlertTriangle size={16} className="text-destructive" />
       default:
-        return <Circle size={16} className="text-neo-text-on-bright" />
+        return <Circle size={16} className={textColors[data.status]} />
     }
   }
 
   return (
     <>
-      <Handle type="target" position={Position.Left} className="!bg-neo-border !w-2 !h-2" />
+      <Handle type="target" position={Position.Left} className="!bg-border !w-2 !h-2" />
       <div
         className={`
           px-4 py-3 rounded-lg border-2 cursor-pointer
-          transition-all hover:shadow-neo-md relative
+          transition-all hover:shadow-md relative
           ${statusColors[data.status]}
         `}
         onClick={data.onClick}
@@ -129,31 +135,31 @@ function FeatureNode({ data }: { data: GraphNode & { onClick?: () => void; agent
         {/* Agent avatar badge - positioned at top right */}
         {data.agent && (
           <div className="absolute -top-3 -right-3 z-10">
-            <div className="rounded-full border-2 border-neo-border bg-white shadow-neo-sm">
+            <div className="rounded-full border-2 border-border bg-background shadow-sm">
               <AgentAvatar name={data.agent.name} state={data.agent.state} size="sm" />
             </div>
           </div>
         )}
         <div className="flex items-center gap-2 mb-1">
           <StatusIcon />
-          <span className="text-xs font-mono text-neo-text-on-bright/70">
+          <span className={`text-xs font-mono ${textColors[data.status]} opacity-70`}>
             #{data.priority}
           </span>
           {/* Show agent name inline if present */}
           {data.agent && (
-            <span className="text-xs font-bold text-neo-text-on-bright ml-auto">
+            <span className={`text-xs font-bold ${textColors[data.status]} ml-auto`}>
               {data.agent.name}
             </span>
           )}
         </div>
-        <div className="font-bold text-sm text-neo-text-on-bright truncate" title={data.name}>
+        <div className={`font-bold text-sm ${textColors[data.status]} truncate`} title={data.name}>
           {data.name}
         </div>
-        <div className="text-xs text-neo-text-on-bright/70 truncate" title={data.category}>
+        <div className={`text-xs ${textColors[data.status]} opacity-70 truncate`} title={data.category}>
           {data.category}
         </div>
       </div>
-      <Handle type="source" position={Position.Right} className="!bg-neo-border !w-2 !h-2" />
+      <Handle type="source" position={Position.Right} className="!bg-border !w-2 !h-2" />
     </>
   )
 }
@@ -221,10 +227,14 @@ function DependencyGraphInner({ graphData, onNodeClick, activeAgents = [] }: Dep
   }, [])
 
   // Create a map of featureId to agent info for quick lookup
+  // Maps ALL batch feature IDs to the same agent
   const agentByFeatureId = useMemo(() => {
     const map = new Map<number, NodeAgentInfo>()
     for (const agent of activeAgents) {
-      map.set(agent.featureId, { name: agent.agentName, state: agent.state })
+      const ids = agent.featureIds || [agent.featureId]
+      for (const fid of ids) {
+        map.set(fid, { name: agent.agentName, state: agent.state })
+      }
     }
     return map
   }, [activeAgents])
@@ -249,10 +259,10 @@ function DependencyGraphInner({ graphData, onNodeClick, activeAgents = [] }: Dep
       target: String(edge.target),
       type: 'smoothstep',
       animated: false,
-      style: { stroke: 'var(--color-neo-border)', strokeWidth: 2 },
+      style: { stroke: '#a1a1aa', strokeWidth: 2 },
       markerEnd: {
         type: MarkerType.ArrowClosed,
-        color: 'var(--color-neo-border)',
+        color: '#a1a1aa',
       },
     }))
 
@@ -308,22 +318,22 @@ function DependencyGraphInner({ graphData, onNodeClick, activeAgents = [] }: Dep
     const status = (node.data as unknown as GraphNode).status
     switch (status) {
       case 'done':
-        return 'var(--color-neo-done)'
+        return '#22c55e' // green-500
       case 'in_progress':
-        return 'var(--color-neo-progress)'
+        return '#06b6d4' // cyan-500
       case 'blocked':
-        return 'var(--color-neo-danger)'
+        return '#ef4444' // red-500
       default:
-        return 'var(--color-neo-pending)'
+        return '#eab308' // yellow-500
     }
   }, [])
 
   if (graphData.nodes.length === 0) {
     return (
-      <div className="h-full w-full flex items-center justify-center bg-neo-neutral-100">
+      <div className="h-full w-full flex items-center justify-center bg-muted">
         <div className="text-center">
-          <div className="text-neo-text-secondary mb-2">No features to display</div>
-          <div className="text-sm text-neo-text-muted">
+          <div className="text-muted-foreground mb-2">No features to display</div>
+          <div className="text-sm text-muted-foreground/70">
             Create features to see the dependency graph
           </div>
         </div>
@@ -332,57 +342,49 @@ function DependencyGraphInner({ graphData, onNodeClick, activeAgents = [] }: Dep
   }
 
   return (
-    <div className="h-full w-full relative bg-neo-neutral-50">
+    <div className="h-full w-full relative bg-background">
       {/* Layout toggle */}
       <div className="absolute top-4 left-4 z-10 flex gap-2">
-        <button
+        <Button
+          variant={direction === 'LR' ? 'default' : 'outline'}
+          size="sm"
           onClick={() => onLayout('LR')}
-          className={`
-            px-3 py-1.5 text-sm font-medium rounded border-2 border-neo-border transition-all
-            ${direction === 'LR'
-              ? 'bg-neo-accent text-white shadow-neo-sm'
-              : 'bg-white text-neo-text hover:bg-neo-neutral-100'
-            }
-          `}
         >
           Horizontal
-        </button>
-        <button
+        </Button>
+        <Button
+          variant={direction === 'TB' ? 'default' : 'outline'}
+          size="sm"
           onClick={() => onLayout('TB')}
-          className={`
-            px-3 py-1.5 text-sm font-medium rounded border-2 border-neo-border transition-all
-            ${direction === 'TB'
-              ? 'bg-neo-accent text-white shadow-neo-sm'
-              : 'bg-white text-neo-text hover:bg-neo-neutral-100'
-            }
-          `}
         >
           Vertical
-        </button>
+        </Button>
       </div>
 
       {/* Legend */}
-      <div className="absolute top-4 right-4 z-10 bg-white border-2 border-neo-border rounded-lg p-3 shadow-neo-sm">
-        <div className="text-xs font-bold mb-2">Status</div>
-        <div className="space-y-1.5">
-          <div className="flex items-center gap-2 text-xs">
-            <div className="w-3 h-3 rounded bg-neo-pending border border-neo-border" />
-            <span>Pending</span>
+      <Card className="absolute top-4 right-4 z-10">
+        <CardContent className="p-3">
+          <div className="text-xs font-bold mb-2">Status</div>
+          <div className="space-y-1.5">
+            <div className="flex items-center gap-2 text-xs">
+              <div className="w-3 h-3 rounded bg-yellow-400 border border-yellow-500" />
+              <span>Pending</span>
+            </div>
+            <div className="flex items-center gap-2 text-xs">
+              <div className="w-3 h-3 rounded bg-cyan-400 border border-cyan-500" />
+              <span>In Progress</span>
+            </div>
+            <div className="flex items-center gap-2 text-xs">
+              <div className="w-3 h-3 rounded bg-green-400 border border-green-500" />
+              <span>Done</span>
+            </div>
+            <div className="flex items-center gap-2 text-xs">
+              <div className="w-3 h-3 rounded bg-red-100 border border-red-400" />
+              <span>Blocked</span>
+            </div>
           </div>
-          <div className="flex items-center gap-2 text-xs">
-            <div className="w-3 h-3 rounded bg-neo-progress border border-neo-border" />
-            <span>In Progress</span>
-          </div>
-          <div className="flex items-center gap-2 text-xs">
-            <div className="w-3 h-3 rounded bg-neo-done border border-neo-border" />
-            <span>Done</span>
-          </div>
-          <div className="flex items-center gap-2 text-xs">
-            <div className="w-3 h-3 rounded bg-neo-danger/20 border border-neo-danger" />
-            <span>Blocked</span>
-          </div>
-        </div>
-      </div>
+        </CardContent>
+      </Card>
 
       <ReactFlow
         nodes={nodes}
@@ -397,14 +399,14 @@ function DependencyGraphInner({ graphData, onNodeClick, activeAgents = [] }: Dep
         minZoom={0.1}
         maxZoom={2}
       >
-        <Background color="var(--color-neo-neutral-300)" gap={20} size={1} />
+        <Background color="#d4d4d8" gap={20} size={1} />
         <Controls
-          className="!bg-white !border-2 !border-neo-border !rounded-lg !shadow-neo-sm"
+          className="!bg-card !border !border-border !rounded-lg !shadow-sm"
           showInteractive={false}
         />
         <MiniMap
           nodeColor={nodeColor}
-          className="!bg-white !border-2 !border-neo-border !rounded-lg !shadow-neo-sm"
+          className="!bg-card !border !border-border !rounded-lg !shadow-sm"
           maskColor="rgba(0, 0, 0, 0.1)"
         />
       </ReactFlow>

ui/src/components/DevServerControl.tsx

@@ -2,6 +2,7 @@ import { Globe, Square, Loader2, ExternalLink, AlertTriangle } from 'lucide-reac
 import { useMutation, useQueryClient } from '@tanstack/react-query'
 import type { DevServerStatus } from '../lib/types'
 import { startDevServer, stopDevServer } from '../lib/api'
+import { Button } from '@/components/ui/button'
 
 // Re-export DevServerStatus from lib/types for consumers that import from here
 export type { DevServerStatus }
@@ -86,14 +87,11 @@ export function DevServerControl({ projectName, status, url }: DevServerControlP
   return (
     <div className="flex items-center gap-2">
       {isStopped ? (
-        <button
+        <Button
           onClick={handleStart}
           disabled={isLoading}
-          className="neo-btn text-sm py-2 px-3"
-          style={isCrashed ? {
-            backgroundColor: 'var(--color-neo-danger)',
-            color: 'var(--color-neo-text-on-bright)',
-          } : undefined}
+          variant={isCrashed ? "destructive" : "outline"}
+          size="sm"
           title={isCrashed ? "Dev Server Crashed - Click to Restart" : "Start Dev Server"}
           aria-label={isCrashed ? "Restart Dev Server (crashed)" : "Start Dev Server"}
         >
@@ -104,16 +102,13 @@ export function DevServerControl({ projectName, status, url }: DevServerControlP
           ) : (
             <Globe size={18} />
           )}
-        </button>
+        </Button>
       ) : (
-        <button
+        <Button
           onClick={handleStop}
           disabled={isLoading}
-          className="neo-btn text-sm py-2 px-3"
-          style={{
-            backgroundColor: 'var(--color-neo-progress)',
-            color: 'var(--color-neo-text-on-bright)',
-          }}
+          size="sm"
+          className="bg-primary text-primary-foreground hover:bg-primary/90"
           title="Stop Dev Server"
           aria-label="Stop Dev Server"
         >
@@ -122,31 +117,31 @@ export function DevServerControl({ projectName, status, url }: DevServerControlP
           ) : (
             <Square size={18} />
           )}
-        </button>
+        </Button>
       )}
 
       {/* Show URL as clickable link when server is running */}
       {isRunning && url && (
-        <a
-          href={url}
-          target="_blank"
-          rel="noopener noreferrer"
-          className="neo-btn text-sm py-2 px-3 gap-1"
-          style={{
-            backgroundColor: 'var(--color-neo-progress)',
-            color: 'var(--color-neo-text-on-bright)',
-            textDecoration: 'none',
-          }}
-          title={`Open ${url} in new tab`}
+        <Button
+          asChild
+          size="sm"
+          className="bg-primary text-primary-foreground hover:bg-primary/90 gap-1"
         >
-          <span className="font-mono text-xs">{url}</span>
-          <ExternalLink size={14} />
-        </a>
+          <a
+            href={url}
+            target="_blank"
+            rel="noopener noreferrer"
+            title={`Open ${url} in new tab`}
+          >
+            <span className="font-mono text-xs">{url}</span>
+            <ExternalLink size={14} />
+          </a>
+        </Button>
       )}
 
       {/* Error display */}
       {(startDevServerMutation.error || stopDevServerMutation.error) && (
-        <span className="text-xs font-mono text-[var(--color-neo-danger)] ml-2">
+        <span className="text-xs font-mono text-destructive ml-2">
           {String((startDevServerMutation.error || stopDevServerMutation.error)?.message || 'Operation failed')}
         </span>
       )}

ui/src/components/EditFeatureForm.tsx

@@ -2,6 +2,18 @@ import { useState, useId } from 'react'
 import { X, Save, Plus, Trash2, Loader2, AlertCircle } from 'lucide-react'
 import { useUpdateFeature } from '../hooks/useProjects'
 import type { Feature } from '../lib/types'
+import {
+  Dialog,
+  DialogContent,
+  DialogHeader,
+  DialogTitle,
+  DialogFooter,
+} from '@/components/ui/dialog'
+import { Button } from '@/components/ui/button'
+import { Input } from '@/components/ui/input'
+import { Textarea } from '@/components/ui/textarea'
+import { Label } from '@/components/ui/label'
+import { Alert, AlertDescription } from '@/components/ui/alert'
 
 interface Step {
   id: string
@@ -83,149 +95,135 @@ export function EditFeatureForm({ feature, projectName, onClose, onSaved }: Edit
     JSON.stringify(currentSteps) !== JSON.stringify(feature.steps)
 
   return (
-    <div className="neo-modal-backdrop" onClick={onClose}>
-      <div
-        className="neo-modal w-full max-w-2xl"
-        onClick={(e) => e.stopPropagation()}
-      >
-        {/* Header */}
-        <div className="flex items-center justify-between p-6 border-b-3 border-[var(--color-neo-border)]">
-          <h2 className="font-display text-2xl font-bold">
-            Edit Feature
-          </h2>
-          <button
-            onClick={onClose}
-            className="neo-btn neo-btn-ghost p-2"
-          >
-            <X size={24} />
-          </button>
-        </div>
+    <Dialog open={true} onOpenChange={(open) => !open && onClose()}>
+      <DialogContent className="sm:max-w-2xl">
+        <DialogHeader>
+          <DialogTitle>Edit Feature</DialogTitle>
+        </DialogHeader>
 
-        {/* Form */}
-        <form onSubmit={handleSubmit} className="p-6 space-y-4">
+        <form onSubmit={handleSubmit} className="space-y-4">
           {/* Error Message */}
           {error && (
-            <div className="flex items-center gap-3 p-4 bg-[var(--color-neo-error-bg)] text-[var(--color-neo-error-text)] border-3 border-[var(--color-neo-error-border)]">
-              <AlertCircle size={20} />
-              <span>{error}</span>
-              <button
-                type="button"
-                onClick={() => setError(null)}
-                className="ml-auto hover:opacity-70 transition-opacity"
-              >
-                <X size={16} />
-              </button>
-            </div>
+            <Alert variant="destructive">
+              <AlertCircle className="h-4 w-4" />
+              <AlertDescription className="flex items-center justify-between">
+                <span>{error}</span>
+                <Button
+                  type="button"
+                  variant="ghost"
+                  size="icon-xs"
+                  onClick={() => setError(null)}
+                >
+                  <X size={14} />
+                </Button>
+              </AlertDescription>
+            </Alert>
           )}
 
           {/* Category & Priority Row */}
           <div className="flex gap-4">
-            <div className="flex-1">
-              <label className="block font-display font-bold mb-2 uppercase text-sm">
-                Category
-              </label>
-              <input
+            <div className="flex-1 space-y-2">
+              <Label htmlFor="category">Category</Label>
+              <Input
+                id="category"
                 type="text"
                 value={category}
                 onChange={(e) => setCategory(e.target.value)}
                 placeholder="e.g., Authentication, UI, API"
-                className="neo-input"
                 required
               />
             </div>
-            <div className="w-32">
-              <label className="block font-display font-bold mb-2 uppercase text-sm">
-                Priority
-              </label>
-              <input
+            <div className="w-32 space-y-2">
+              <Label htmlFor="priority">Priority</Label>
+              <Input
+                id="priority"
                 type="number"
                 value={priority}
                 onChange={(e) => setPriority(e.target.value)}
                 min="1"
-                className="neo-input"
                 required
               />
             </div>
           </div>
 
           {/* Name */}
-          <div>
-            <label className="block font-display font-bold mb-2 uppercase text-sm">
-              Feature Name
-            </label>
-            <input
+          <div className="space-y-2">
+            <Label htmlFor="name">Feature Name</Label>
+            <Input
+              id="name"
               type="text"
               value={name}
               onChange={(e) => setName(e.target.value)}
               placeholder="e.g., User login form"
-              className="neo-input"
               required
             />
           </div>
 
           {/* Description */}
-          <div>
-            <label className="block font-display font-bold mb-2 uppercase text-sm">
-              Description
-            </label>
-            <textarea
+          <div className="space-y-2">
+            <Label htmlFor="description">Description</Label>
+            <Textarea
+              id="description"
               value={description}
               onChange={(e) => setDescription(e.target.value)}
               placeholder="Describe what this feature should do..."
-              className="neo-input min-h-[100px] resize-y"
+              className="min-h-[100px] resize-y"
               required
             />
           </div>
 
           {/* Steps */}
-          <div>
-            <label className="block font-display font-bold mb-2 uppercase text-sm">
-              Test Steps
-            </label>
+          <div className="space-y-2">
+            <Label>Test Steps</Label>
             <div className="space-y-2">
               {steps.map((step, index) => (
                 <div key={step.id} className="flex gap-2 items-center">
-                  <span
-                    className="w-10 h-10 flex-shrink-0 flex items-center justify-center font-mono font-bold text-sm border-3 border-[var(--color-neo-border)] bg-[var(--color-neo-bg)] text-[var(--color-neo-text-secondary)]"
-                    style={{ boxShadow: 'var(--shadow-neo-sm)' }}
-                  >
+                  <span className="w-10 h-10 flex-shrink-0 flex items-center justify-center font-mono font-semibold text-sm border rounded-md bg-muted text-muted-foreground">
                     {index + 1}
                   </span>
-                  <input
+                  <Input
                     type="text"
                     value={step.value}
                     onChange={(e) => handleStepChange(step.id, e.target.value)}
                     placeholder="Describe this step..."
-                    className="neo-input flex-1"
+                    className="flex-1"
                   />
                   {steps.length > 1 && (
-                    <button
+                    <Button
                       type="button"
+                      variant="ghost"
+                      size="icon"
                       onClick={() => handleRemoveStep(step.id)}
-                      className="neo-btn neo-btn-ghost p-2"
                     >
                       <Trash2 size={18} />
-                    </button>
+                    </Button>
                   )}
                 </div>
               ))}
             </div>
-            <button
+            <Button
               type="button"
+              variant="ghost"
+              size="sm"
               onClick={handleAddStep}
-              className="neo-btn neo-btn-ghost mt-2 text-sm"
             >
               <Plus size={16} />
               Add Step
-            </button>
+            </Button>
           </div>
 
           {/* Actions */}
-          <div className="flex gap-3 pt-4 border-t-3 border-[var(--color-neo-border)]">
-            <button
+          <DialogFooter className="pt-4 border-t">
+            <Button
+              type="button"
+              variant="outline"
+              onClick={onClose}
+            >
+              Cancel
+            </Button>
+            <Button
               type="submit"
               disabled={!isValid || !hasChanges || updateFeature.isPending}
-              className="neo-btn neo-btn-success flex-1"
             >
               {updateFeature.isPending ? (
                 <Loader2 size={18} className="animate-spin" />
@@ -235,17 +233,10 @@ export function EditFeatureForm({ feature, projectName, onClose, onSaved }: Edit
                   Save Changes
                 </>
               )}
-            </button>
-            <button
-              type="button"
-              onClick={onClose}
-              className="neo-btn neo-btn-ghost"
-            >
-              Cancel
-            </button>
-          </div>
+            </Button>
+          </DialogFooter>
         </form>
-      </div>
-    </div>
+      </DialogContent>
+    </Dialog>
   )
 }

ui/src/components/ExpandProjectChat.tsx

@@ -11,6 +11,11 @@ import { useExpandChat } from '../hooks/useExpandChat'
 import { ChatMessage } from './ChatMessage'
 import { TypingIndicator } from './TypingIndicator'
 import type { ImageAttachment } from '../lib/types'
+import { isSubmitEnter } from '../lib/keyboard'
+import { Button } from '@/components/ui/button'
+import { Input } from '@/components/ui/input'
+import { Card, CardContent } from '@/components/ui/card'
+import { Alert, AlertDescription } from '@/components/ui/alert'
 
 // Image upload validation constants
 const MAX_FILE_SIZE = 5 * 1024 * 1024 // 5 MB
@@ -84,7 +89,7 @@ export function ExpandProjectChat({
   }
 
   const handleKeyDown = (e: React.KeyboardEvent) => {
-    if (e.key === 'Enter' && !e.shiftKey) {
+    if (isSubmitEnter(e)) {
       e.preventDefault()
       handleSendMessage()
     }
@@ -152,28 +157,28 @@ export function ExpandProjectChat({
     switch (connectionStatus) {
       case 'connected':
         return (
-          <span className="flex items-center gap-1 text-xs text-neo-done">
+          <span className="flex items-center gap-1 text-xs text-green-500">
             <Wifi size={12} />
             Connected
           </span>
         )
       case 'connecting':
         return (
-          <span className="flex items-center gap-1 text-xs text-neo-pending">
+          <span className="flex items-center gap-1 text-xs text-yellow-500">
             <Wifi size={12} className="animate-pulse" />
             Connecting...
           </span>
         )
       case 'error':
         return (
-          <span className="flex items-center gap-1 text-xs text-neo-danger">
+          <span className="flex items-center gap-1 text-xs text-destructive">
             <WifiOff size={12} />
             Error
           </span>
         )
       default:
         return (
-          <span className="flex items-center gap-1 text-xs text-neo-text-secondary">
+          <span className="flex items-center gap-1 text-xs text-muted-foreground">
             <WifiOff size={12} />
             Disconnected
           </span>
@@ -182,16 +187,16 @@ export function ExpandProjectChat({
   }
 
   return (
-    <div className="flex flex-col h-full bg-neo-bg">
+    <div className="flex flex-col h-full bg-background">
       {/* Header */}
-      <div className="flex items-center justify-between p-4 border-b-3 border-neo-border bg-neo-card">
+      <div className="flex items-center justify-between p-4 border-b-2 border-border bg-card">
         <div className="flex items-center gap-3">
-          <h2 className="font-display font-bold text-lg text-neo-text">
+          <h2 className="font-display font-bold text-lg text-foreground">
             Expand Project: {projectName}
           </h2>
           <ConnectionIndicator />
           {featuresCreated > 0 && (
-            <span className="flex items-center gap-1 text-sm text-neo-done font-bold">
+            <span className="flex items-center gap-1 text-sm text-green-500 font-bold">
               <Plus size={14} />
               {featuresCreated} added
             </span>
@@ -200,57 +205,63 @@ export function ExpandProjectChat({
 
         <div className="flex items-center gap-2">
           {isComplete && (
-            <span className="flex items-center gap-1 text-sm text-neo-done font-bold">
+            <span className="flex items-center gap-1 text-sm text-green-500 font-bold">
               <CheckCircle2 size={16} />
               Complete
             </span>
           )}
 
-          <button
+          <Button
             onClick={onCancel}
-            className="neo-btn neo-btn-ghost p-2"
+            variant="ghost"
+            size="icon"
             title="Close"
           >
             <X size={20} />
-          </button>
+          </Button>
         </div>
       </div>
 
       {/* Error banner */}
       {error && (
-        <div className="flex items-center gap-2 p-3 bg-neo-error-bg text-neo-error-text border-b-3 border-neo-error-border">
+        <Alert variant="destructive" className="rounded-none border-x-0 border-t-0">
           <AlertCircle size={16} />
-          <span className="flex-1 text-sm">{error}</span>
-          <button
+          <AlertDescription className="flex-1">{error}</AlertDescription>
+          <Button
             onClick={() => setError(null)}
-            className="p-1 hover:opacity-70 transition-opacity rounded"
+            variant="ghost"
+            size="icon"
+            className="h-6 w-6"
           >
             <X size={14} />
-          </button>
-        </div>
+          </Button>
+        </Alert>
       )}
 
       {/* Messages area */}
       <div className="flex-1 overflow-y-auto py-4">
         {messages.length === 0 && !isLoading && (
           <div className="flex flex-col items-center justify-center h-full text-center p-8">
-            <div className="neo-card p-6 max-w-md">
-              <h3 className="font-display font-bold text-lg mb-2">
-                Starting Project Expansion
-              </h3>
-              <p className="text-sm text-neo-text-secondary">
-                Connecting to Claude to help you add new features to your project...
-              </p>
-              {connectionStatus === 'error' && (
-                <button
-                  onClick={start}
-                  className="neo-btn neo-btn-primary mt-4 text-sm"
-                >
-                  <RotateCcw size={14} />
-                  Retry Connection
-                </button>
-              )}
-            </div>
+            <Card className="p-6 max-w-md">
+              <CardContent className="p-0">
+                <h3 className="font-display font-bold text-lg mb-2">
+                  Starting Project Expansion
+                </h3>
+                <p className="text-sm text-muted-foreground">
+                  Connecting to Claude to help you add new features to your project...
+                </p>
+                {connectionStatus === 'error' && (
+                  <Button
+                    onClick={start}
+                    className="mt-4"
+                    size="sm"
+                  >
+                    <RotateCcw size={14} />
+                    Retry Connection
+                  </Button>
+                )}
+              </CardContent>
+            </Card>
           </div>
         )}
 
@@ -268,7 +279,7 @@ export function ExpandProjectChat({
       {/* Input area */}
       {!isComplete && (
         <div
-          className="p-4 border-t-3 border-neo-border bg-neo-card"
+          className="p-4 border-t-2 border-border bg-card"
           onDrop={handleDrop}
           onDragOver={handleDragOver}
         >
@@ -278,22 +289,21 @@ export function ExpandProjectChat({
               {pendingAttachments.map((attachment) => (
                 <div
                   key={attachment.id}
-                  className="relative group border-2 border-neo-border p-1 bg-neo-card"
-                  style={{ boxShadow: 'var(--shadow-neo-sm)' }}
+                  className="relative group border-2 border-border p-1 bg-card rounded shadow-sm"
                 >
                   <img
                     src={attachment.previewUrl}
                     alt={attachment.filename}
-                    className="w-16 h-16 object-cover"
+                    className="w-16 h-16 object-cover rounded"
                   />
                   <button
                     onClick={() => handleRemoveAttachment(attachment.id)}
-                    className="absolute -top-2 -right-2 bg-neo-danger text-neo-text-on-bright rounded-full p-0.5 border-2 border-neo-border hover:scale-110 transition-transform"
+                    className="absolute -top-2 -right-2 bg-destructive text-destructive-foreground rounded-full p-0.5 border-2 border-border hover:scale-110 transition-transform"
                     title="Remove attachment"
                   >
                     <X size={12} />
                   </button>
-                  <span className="text-xs truncate block max-w-16 mt-1 text-center">
+                  <span className="text-xs truncate block max-w-16 mt-1 text-center text-muted-foreground">
                     {attachment.filename.length > 10
                       ? `${attachment.filename.substring(0, 7)}...`
                       : attachment.filename}
@@ -315,16 +325,17 @@ export function ExpandProjectChat({
             />
 
             {/* Attach button */}
-            <button
+            <Button
               onClick={() => fileInputRef.current?.click()}
               disabled={connectionStatus !== 'connected'}
-              className="neo-btn neo-btn-ghost p-3"
+              variant="ghost"
+              size="icon"
               title="Attach image (JPEG, PNG - max 5MB)"
             >
               <Paperclip size={18} />
-            </button>
+            </Button>
 
-            <input
+            <Input
               ref={inputRef}
               type="text"
               value={input}
@@ -335,24 +346,24 @@ export function ExpandProjectChat({
                   ? 'Add a message with your image(s)...'
                   : 'Describe the features you want to add...'
               }
-              className="neo-input flex-1"
+              className="flex-1"
               disabled={isLoading || connectionStatus !== 'connected'}
             />
-            <button
+            <Button
               onClick={handleSendMessage}
               disabled={
                 (!input.trim() && pendingAttachments.length === 0) ||
                 isLoading ||
                 connectionStatus !== 'connected'
               }
-              className="neo-btn neo-btn-primary px-6"
+              className="px-6"
             >
               <Send size={18} />
-            </button>
+            </Button>
           </div>
 
           {/* Help text */}
-          <p className="text-xs text-neo-text-secondary mt-2">
+          <p className="text-xs text-muted-foreground mt-2">
             Press Enter to send. Drag & drop or click <Paperclip size={12} className="inline" /> to attach images.
           </p>
         </div>
@@ -360,7 +371,7 @@ export function ExpandProjectChat({
 
       {/* Completion footer */}
       {isComplete && (
-        <div className="p-4 border-t-3 border-neo-border bg-neo-done text-neo-text-on-bright">
+        <div className="p-4 border-t-2 border-border bg-green-500 text-white">
           <div className="flex items-center justify-between">
             <div className="flex items-center gap-2">
               <CheckCircle2 size={20} />
@@ -368,12 +379,12 @@ export function ExpandProjectChat({
                 Added {featuresCreated} new feature{featuresCreated !== 1 ? 's' : ''}!
               </span>
             </div>
-            <button
+            <Button
               onClick={() => onComplete(featuresCreated)}
-              className="neo-btn bg-neo-card"
+              variant="secondary"
             >
               Close
-            </button>
+            </Button>
           </div>
         </div>
       )}

ui/src/components/ExpandProjectModal.tsx

@@ -30,7 +30,7 @@ export function ExpandProjectModal({
   }
 
   return (
-    <div className="fixed inset-0 z-50 bg-[var(--color-neo-bg)]">
+    <div className="fixed inset-0 z-50 bg-background">
       <ExpandProjectChat
         projectName={projectName}
         onComplete={handleComplete}

ui/src/components/FeatureCard.tsx

@@ -2,26 +2,27 @@ import { CheckCircle2, Circle, Loader2, MessageCircle } from 'lucide-react'
 import type { Feature, ActiveAgent } from '../lib/types'
 import { DependencyBadge } from './DependencyBadge'
 import { AgentAvatar } from './AgentAvatar'
+import { Card, CardContent } from '@/components/ui/card'
+import { Badge } from '@/components/ui/badge'
 
 interface FeatureCardProps {
   feature: Feature
   onClick: () => void
   isInProgress?: boolean
   allFeatures?: Feature[]
-  activeAgent?: ActiveAgent // Agent working on this feature
+  activeAgent?: ActiveAgent
 }
 
-// Generate consistent color for category using CSS variable references
-// These map to the --color-neo-category-* variables defined in globals.css
+// Generate consistent color for category
 function getCategoryColor(category: string): string {
   const colors = [
-    'var(--color-neo-category-pink)',
-    'var(--color-neo-category-cyan)',
-    'var(--color-neo-category-green)',
-    'var(--color-neo-category-yellow)',
-    'var(--color-neo-category-orange)',
-    'var(--color-neo-category-purple)',
-    'var(--color-neo-category-blue)',
+    'bg-pink-500',
+    'bg-cyan-500',
+    'bg-green-500',
+    'bg-yellow-500',
+    'bg-orange-500',
+    'bg-purple-500',
+    'bg-blue-500',
   ]
 
   let hash = 0
@@ -38,86 +39,85 @@ export function FeatureCard({ feature, onClick, isInProgress, allFeatures = [],
   const hasActiveAgent = !!activeAgent
 
   return (
-    <button
+    <Card
       onClick={onClick}
       className={`
-        w-full text-left neo-card p-4 cursor-pointer relative
-        ${isInProgress ? 'animate-pulse-neo' : ''}
-        ${feature.passes ? 'border-neo-done' : ''}
-        ${isBlocked && !feature.passes ? 'border-neo-danger opacity-80' : ''}
-        ${hasActiveAgent ? 'ring-2 ring-neo-progress ring-offset-2' : ''}
+        cursor-pointer transition-all hover:border-primary py-3
+        ${isInProgress ? 'animate-pulse' : ''}
+        ${feature.passes ? 'border-primary/50' : ''}
+        ${isBlocked && !feature.passes ? 'border-destructive/50 opacity-80' : ''}
+        ${hasActiveAgent ? 'ring-2 ring-primary ring-offset-2' : ''}
       `}
     >
-      {/* Header */}
-      <div className="flex items-start justify-between gap-2 mb-2">
-        <div className="flex items-center gap-2">
-          <span
-            className="neo-badge"
-            style={{ backgroundColor: categoryColor, color: 'var(--color-neo-text-on-bright)' }}
-          >
-            {feature.category}
-          </span>
-          <DependencyBadge feature={feature} allFeatures={allFeatures} compact />
-        </div>
-        <span className="font-mono text-sm text-neo-text-secondary">
-          #{feature.priority}
-        </span>
-      </div>
-
-      {/* Name */}
-      <h3 className="font-display font-bold mb-1 line-clamp-2">
-        {feature.name}
-      </h3>
-
-      {/* Description */}
-      <p className="text-sm text-neo-text-secondary line-clamp-2 mb-3">
-        {feature.description}
-      </p>
-
-      {/* Agent working on this feature */}
-      {activeAgent && (
-        <div className="flex items-center gap-2 mb-3 py-2 px-2 rounded bg-[var(--color-neo-progress)]/10 border border-[var(--color-neo-progress)]/30">
-          <AgentAvatar name={activeAgent.agentName} state={activeAgent.state} size="sm" />
-          <div className="flex-1 min-w-0">
-            <div className="text-xs font-bold text-neo-progress">
-              {activeAgent.agentName} is working on this!
-            </div>
-            {activeAgent.thought && (
-              <div className="flex items-center gap-1 mt-0.5">
-                <MessageCircle size={10} className="text-neo-text-secondary shrink-0" />
-                <p className="text-[10px] text-neo-text-secondary truncate italic">
-                  {activeAgent.thought}
-                </p>
-              </div>
-            )}
+      <CardContent className="p-4 space-y-3">
+        {/* Header */}
+        <div className="flex items-start justify-between gap-2">
+          <div className="flex items-center gap-2">
+            <Badge className={`${categoryColor} text-white`}>
+              {feature.category}
+            </Badge>
+            <DependencyBadge feature={feature} allFeatures={allFeatures} compact />
           </div>
+          <span className="font-mono text-sm text-muted-foreground">
+            #{feature.priority}
+          </span>
         </div>
-      )}
 
-      {/* Status */}
-      <div className="flex items-center gap-2 text-sm">
-        {isInProgress ? (
-          <>
-            <Loader2 size={16} className="animate-spin text-neo-progress" />
-            <span className="text-neo-progress font-bold">Processing...</span>
-          </>
-        ) : feature.passes ? (
-          <>
-            <CheckCircle2 size={16} className="text-neo-done" />
-            <span className="text-neo-done font-bold">Complete</span>
-          </>
-        ) : isBlocked ? (
-          <>
-            <Circle size={16} className="text-neo-danger" />
-            <span className="text-neo-danger">Blocked</span>
-          </>
-        ) : (
-          <>
-            <Circle size={16} className="text-neo-text-secondary" />
-            <span className="text-neo-text-secondary">Pending</span>
-          </>
+        {/* Name */}
+        <h3 className="font-semibold line-clamp-2">
+          {feature.name}
+        </h3>
+
+        {/* Description */}
+        <p className="text-sm text-muted-foreground line-clamp-2">
+          {feature.description}
+        </p>
+
+        {/* Agent working on this feature */}
+        {activeAgent && (
+          <div className="flex items-center gap-2 py-2 px-2 rounded-md bg-primary/10 border border-primary/30">
+            <AgentAvatar name={activeAgent.agentName} state={activeAgent.state} size="sm" />
+            <div className="flex-1 min-w-0">
+              <div className="text-xs font-semibold text-primary">
+                {activeAgent.agentName} is working on this!
+              </div>
+              {activeAgent.thought && (
+                <div className="flex items-center gap-1 mt-0.5">
+                  <MessageCircle size={10} className="text-muted-foreground shrink-0" />
+                  <p className="text-[10px] text-muted-foreground truncate italic">
+                    {activeAgent.thought}
+                  </p>
+                </div>
+              )}
+            </div>
+          </div>
         )}
-      </div>
-    </button>
+
+        {/* Status */}
+        <div className="flex items-center gap-2 text-sm">
+          {isInProgress ? (
+            <>
+              <Loader2 size={16} className="animate-spin text-primary" />
+              <span className="text-primary font-medium">Processing...</span>
+            </>
+          ) : feature.passes ? (
+            <>
+              <CheckCircle2 size={16} className="text-primary" />
+              <span className="text-primary font-medium">Complete</span>
+            </>
+          ) : isBlocked ? (
+            <>
+              <Circle size={16} className="text-destructive" />
+              <span className="text-destructive">Blocked</span>
+            </>
+          ) : (
+            <>
+              <Circle size={16} className="text-muted-foreground" />
+              <span className="text-muted-foreground">Pending</span>
+            </>
+          )}
+        </div>
+      </CardContent>
+    </Card>
   )
 }

ui/src/components/FeatureModal.tsx

@@ -3,17 +3,28 @@ import { X, CheckCircle2, Circle, SkipForward, Trash2, Loader2, AlertCircle, Pen
 import { useSkipFeature, useDeleteFeature, useFeatures } from '../hooks/useProjects'
 import { EditFeatureForm } from './EditFeatureForm'
 import type { Feature } from '../lib/types'
+import {
+  Dialog,
+  DialogContent,
+  DialogHeader,
+  DialogTitle,
+  DialogFooter,
+} from '@/components/ui/dialog'
+import { Button } from '@/components/ui/button'
+import { Badge } from '@/components/ui/badge'
+import { Alert, AlertDescription } from '@/components/ui/alert'
+import { Separator } from '@/components/ui/separator'
 
-// Generate consistent color for category (matches FeatureCard pattern)
+// Generate consistent color for category
 function getCategoryColor(category: string): string {
   const colors = [
-    '#ff006e', // pink (accent)
-    '#00b4d8', // cyan (progress)
-    '#70e000', // green (done)
-    '#ffd60a', // yellow (pending)
-    '#ff5400', // orange (danger)
-    '#8338ec', // purple
-    '#3a86ff', // blue
+    'bg-pink-500',
+    'bg-cyan-500',
+    'bg-green-500',
+    'bg-yellow-500',
+    'bg-orange-500',
+    'bg-purple-500',
+    'bg-blue-500',
   ]
 
   let hash = 0
@@ -90,109 +101,91 @@ export function FeatureModal({ feature, projectName, onClose }: FeatureModalProp
   }
 
   return (
-    <div className="neo-modal-backdrop" onClick={onClose}>
-      <div
-        className="neo-modal w-full max-w-2xl p-0"
-        onClick={(e) => e.stopPropagation()}
-      >
+    <Dialog open={true} onOpenChange={(open) => !open && onClose()}>
+      <DialogContent className="sm:max-w-2xl p-0 gap-0">
         {/* Header */}
-        <div className="flex items-start justify-between p-6 border-b-3 border-[var(--color-neo-border)]">
-          <div>
-            <span
-              className="neo-badge mb-2"
-              style={{ backgroundColor: getCategoryColor(feature.category), color: 'var(--color-neo-text-on-bright)' }}
-            >
+        <DialogHeader className="p-6 pb-4">
+          <div className="flex items-start gap-3">
+            <Badge className={`${getCategoryColor(feature.category)} text-white`}>
               {feature.category}
-            </span>
-            <h2 className="font-display text-2xl font-bold">
-              {feature.name}
-            </h2>
+            </Badge>
           </div>
-          <button
-            onClick={onClose}
-            className="neo-btn neo-btn-ghost p-2"
-          >
-            <X size={24} />
-          </button>
-        </div>
+          <DialogTitle className="text-xl mt-2">{feature.name}</DialogTitle>
+        </DialogHeader>
+
+        <Separator />
 
         {/* Content */}
-        <div className="p-6 space-y-6">
+        <div className="p-6 space-y-6 max-h-[60vh] overflow-y-auto">
           {/* Error Message */}
           {error && (
-            <div className="flex items-center gap-3 p-4 bg-[var(--color-neo-error-bg)] text-[var(--color-neo-error-text)] border-3 border-[var(--color-neo-error-border)]">
-              <AlertCircle size={20} />
-              <span>{error}</span>
-              <button
-                onClick={() => setError(null)}
-                className="ml-auto hover:opacity-70 transition-opacity"
-              >
-                <X size={16} />
-              </button>
-            </div>
+            <Alert variant="destructive">
+              <AlertCircle className="h-4 w-4" />
+              <AlertDescription className="flex items-center justify-between">
+                <span>{error}</span>
+                <Button
+                  variant="ghost"
+                  size="icon-xs"
+                  onClick={() => setError(null)}
+                >
+                  <X size={14} />
+                </Button>
+              </AlertDescription>
+            </Alert>
           )}
 
           {/* Status */}
-          <div className="flex items-center gap-3 p-4 bg-[var(--color-neo-bg)] border-3 border-[var(--color-neo-border)]">
+          <div className="flex items-center gap-3 p-4 bg-muted rounded-lg">
             {feature.passes ? (
               <>
-                <CheckCircle2 size={24} className="text-[var(--color-neo-done)]" />
-                <span className="font-display font-bold text-[var(--color-neo-done)]">
-                  COMPLETE
-                </span>
+                <CheckCircle2 size={24} className="text-primary" />
+                <span className="font-semibold text-primary">COMPLETE</span>
               </>
             ) : (
               <>
-                <Circle size={24} className="text-[var(--color-neo-text-secondary)]" />
-                <span className="font-display font-bold text-[var(--color-neo-text-secondary)]">
-                  PENDING
-                </span>
+                <Circle size={24} className="text-muted-foreground" />
+                <span className="font-semibold text-muted-foreground">PENDING</span>
               </>
             )}
-            <span className="ml-auto font-mono text-sm">
+            <span className="ml-auto font-mono text-sm text-muted-foreground">
               Priority: #{feature.priority}
             </span>
           </div>
 
           {/* Description */}
           <div>
-            <h3 className="font-display font-bold mb-2 uppercase text-sm">
+            <h3 className="font-semibold mb-2 text-sm uppercase tracking-wide text-muted-foreground">
               Description
             </h3>
-            <p className="text-[var(--color-neo-text-secondary)]">
-              {feature.description}
-            </p>
+            <p className="text-foreground">{feature.description}</p>
           </div>
 
           {/* Blocked By Warning */}
           {blockingDeps.length > 0 && (
-            <div className="p-4 bg-[var(--color-neo-warning-bg)] border-3 border-[var(--color-neo-warning-border)]">
-              <h3 className="font-display font-bold mb-2 uppercase text-sm flex items-center gap-2 text-[var(--color-neo-warning-text)]">
-                <AlertTriangle size={16} />
-                Blocked By
-              </h3>
-              <p className="text-sm text-[var(--color-neo-warning-text)] mb-2">
-                This feature cannot start until the following dependencies are complete:
-              </p>
-              <ul className="space-y-1">
-                {blockingDeps.map(dep => (
-                  <li
-                    key={dep.id}
-                    className="flex items-center gap-2 text-sm"
-                  >
-                    <Circle size={14} className="text-[var(--color-neo-warning-text)]" />
-                    <span className="font-mono text-xs text-[var(--color-neo-warning-text)]">#{dep.id}</span>
-                    <span className="text-[var(--color-neo-warning-text)]">{dep.name}</span>
-                  </li>
-                ))}
-              </ul>
-            </div>
+            <Alert variant="destructive" className="border-orange-500 bg-orange-50 dark:bg-orange-950/20">
+              <AlertTriangle className="h-4 w-4 text-orange-600" />
+              <AlertDescription>
+                <h4 className="font-semibold mb-1 text-orange-700 dark:text-orange-400">Blocked By</h4>
+                <p className="text-sm text-orange-600 dark:text-orange-300 mb-2">
+                  This feature cannot start until the following dependencies are complete:
+                </p>
+                <ul className="space-y-1">
+                  {blockingDeps.map(dep => (
+                    <li key={dep.id} className="flex items-center gap-2 text-sm text-orange-600 dark:text-orange-300">
+                      <Circle size={14} />
+                      <span className="font-mono text-xs">#{dep.id}</span>
+                      <span>{dep.name}</span>
+                    </li>
+                  ))}
+                </ul>
+              </AlertDescription>
+            </Alert>
           )}
 
           {/* Dependencies */}
           {dependencies.length > 0 && (
             <div>
-              <h3 className="font-display font-bold mb-2 uppercase text-sm flex items-center gap-2">
+              <h3 className="font-semibold mb-2 text-sm uppercase tracking-wide text-muted-foreground flex items-center gap-2">
                 <Link2 size={16} />
                 Depends On
               </h3>
@@ -200,15 +193,15 @@ export function FeatureModal({ feature, projectName, onClose }: FeatureModalProp
                 {dependencies.map(dep => (
                   <li
                     key={dep.id}
-                    className="flex items-center gap-2 p-2 bg-[var(--color-neo-bg)] border-2 border-[var(--color-neo-border)]"
+                    className="flex items-center gap-2 p-2 bg-muted rounded-md text-sm"
                   >
                     {dep.passes ? (
-                      <CheckCircle2 size={16} className="text-[var(--color-neo-done)]" />
+                      <CheckCircle2 size={16} className="text-primary" />
                     ) : (
-                      <Circle size={16} className="text-[var(--color-neo-text-secondary)]" />
+                      <Circle size={16} className="text-muted-foreground" />
                     )}
-                    <span className="font-mono text-xs text-[var(--color-neo-text-secondary)]">#{dep.id}</span>
-                    <span className={dep.passes ? 'text-[var(--color-neo-done)]' : ''}>{dep.name}</span>
+                    <span className="font-mono text-xs text-muted-foreground">#{dep.id}</span>
+                    <span className={dep.passes ? 'text-primary' : ''}>{dep.name}</span>
                   </li>
                 ))}
               </ul>
@@ -218,14 +211,14 @@ export function FeatureModal({ feature, projectName, onClose }: FeatureModalProp
           {/* Steps */}
           {feature.steps.length > 0 && (
             <div>
-              <h3 className="font-display font-bold mb-2 uppercase text-sm">
+              <h3 className="font-semibold mb-2 text-sm uppercase tracking-wide text-muted-foreground">
                 Test Steps
               </h3>
               <ol className="list-decimal list-inside space-y-2">
                 {feature.steps.map((step, index) => (
                   <li
                     key={index}
-                    className="p-3 bg-[var(--color-neo-bg)] border-3 border-[var(--color-neo-border)]"
+                    className="p-3 bg-muted rounded-md text-sm"
                   >
                     {step}
                   </li>
@@ -237,69 +230,76 @@ export function FeatureModal({ feature, projectName, onClose }: FeatureModalProp
 
         {/* Actions */}
         {!feature.passes && (
-          <div className="p-6 border-t-3 border-[var(--color-neo-border)] bg-[var(--color-neo-bg)]">
-            {showDeleteConfirm ? (
-              <div className="space-y-4">
-                <p className="font-bold text-center">
-                  Are you sure you want to delete this feature?
-                </p>
-                <div className="flex gap-3">
-                  <button
-                    onClick={handleDelete}
-                    disabled={deleteFeature.isPending}
-                    className="neo-btn neo-btn-danger flex-1"
+          <>
+            <Separator />
+            <DialogFooter className="p-4 bg-muted/50">
+              {showDeleteConfirm ? (
+                <div className="w-full space-y-4">
+                  <p className="font-medium text-center">
+                    Are you sure you want to delete this feature?
+                  </p>
+                  <div className="flex gap-3">
+                    <Button
+                      variant="destructive"
+                      onClick={handleDelete}
+                      disabled={deleteFeature.isPending}
+                      className="flex-1"
+                    >
+                      {deleteFeature.isPending ? (
+                        <Loader2 size={18} className="animate-spin" />
+                      ) : (
+                        'Yes, Delete'
+                      )}
+                    </Button>
+                    <Button
+                      variant="outline"
+                      onClick={() => setShowDeleteConfirm(false)}
+                      disabled={deleteFeature.isPending}
+                      className="flex-1"
+                    >
+                      Cancel
+                    </Button>
+                  </div>
+                </div>
+              ) : (
+                <div className="flex gap-3 w-full">
+                  <Button
+                    onClick={() => setShowEdit(true)}
+                    disabled={skipFeature.isPending}
+                    className="flex-1"
                   >
-                    {deleteFeature.isPending ? (
+                    <Pencil size={18} />
+                    Edit
+                  </Button>
+                  <Button
+                    variant="secondary"
+                    onClick={handleSkip}
+                    disabled={skipFeature.isPending}
+                    className="flex-1"
+                  >
+                    {skipFeature.isPending ? (
                       <Loader2 size={18} className="animate-spin" />
                     ) : (
-                      'Yes, Delete'
+                      <>
+                        <SkipForward size={18} />
+                        Skip
+                      </>
                     )}
-                  </button>
-                  <button
-                    onClick={() => setShowDeleteConfirm(false)}
-                    disabled={deleteFeature.isPending}
-                    className="neo-btn neo-btn-ghost flex-1"
+                  </Button>
+                  <Button
+                    variant="destructive"
+                    size="icon"
+                    onClick={() => setShowDeleteConfirm(true)}
+                    disabled={skipFeature.isPending}
                   >
-                    Cancel
-                  </button>
+                    <Trash2 size={18} />
+                  </Button>
                 </div>
-              </div>
-            ) : (
-              <div className="flex gap-3">
-                <button
-                  onClick={() => setShowEdit(true)}
-                  disabled={skipFeature.isPending}
-                  className="neo-btn neo-btn-primary flex-1"
-                >
-                  <Pencil size={18} />
-                  Edit
-                </button>
-                <button
-                  onClick={handleSkip}
-                  disabled={skipFeature.isPending}
-                  className="neo-btn neo-btn-warning flex-1"
-                >
-                  {skipFeature.isPending ? (
-                    <Loader2 size={18} className="animate-spin" />
-                  ) : (
-                    <>
-                      <SkipForward size={18} />
-                      Skip
-                    </>
-                  )}
-                </button>
-                <button
-                  onClick={() => setShowDeleteConfirm(true)}
-                  disabled={skipFeature.isPending}
-                  className="neo-btn neo-btn-danger"
-                >
-                  <Trash2 size={18} />
-                </button>
-              </div>
-            )}
-          </div>
+              )}
+            </DialogFooter>
+          </>
         )}
-      </div>
-    </div>
+      </DialogContent>
+    </Dialog>
   )
 }

ui/src/components/FolderBrowser.tsx

@@ -18,7 +18,11 @@ import {
   ArrowLeft,
 } from 'lucide-react'
 import * as api from '../lib/api'
+import { isSubmitEnter } from '../lib/keyboard'
 import type { DirectoryEntry, DriveInfo } from '../lib/types'
+import { Button } from '@/components/ui/button'
+import { Input } from '@/components/ui/input'
+import { Card, CardContent } from '@/components/ui/card'
 
 interface FolderBrowserProps {
   onSelect: (path: string) => void
@@ -139,37 +143,36 @@ export function FolderBrowser({ onSelect, onCancel, initialPath }: FolderBrowser
   return (
     <div className="flex flex-col h-full max-h-[70vh]">
       {/* Header with breadcrumb navigation */}
-      <div className="flex-shrink-0 p-4 border-b-3 border-[var(--color-neo-border)] bg-[var(--color-neo-card)]">
+      <div className="flex-shrink-0 p-4 border-b bg-card">
         <div className="flex items-center gap-2 mb-3">
-          <Folder size={20} className="text-[var(--color-neo-progress)]" />
-          <span className="font-bold text-[var(--color-neo-text)]">Select Project Folder</span>
+          <Folder size={20} className="text-primary" />
+          <span className="font-semibold">Select Project Folder</span>
         </div>
 
         {/* Breadcrumb navigation */}
         <div className="flex items-center gap-1 flex-wrap text-sm">
           {directoryData?.parent_path && (
-            <button
+            <Button
+              variant="ghost"
+              size="icon-sm"
               onClick={handleNavigateUp}
-              className="neo-btn neo-btn-ghost p-1"
               title="Go up"
             >
               <ArrowLeft size={16} />
-            </button>
+            </Button>
           )}
 
           {breadcrumbs.map((crumb, index) => (
             <div key={crumb.path} className="flex items-center">
-              {index > 0 && <ChevronRight size={14} className="text-[var(--color-neo-text-muted)] mx-1" />}
-              <button
+              {index > 0 && <ChevronRight size={14} className="text-muted-foreground mx-1" />}
+              <Button
+                variant="ghost"
+                size="sm"
                 onClick={() => handleNavigate(crumb.path)}
-                className={`
-                  px-2 py-1 rounded text-[var(--color-neo-text)]
-                  hover:bg-[var(--color-neo-bg)]
-                  ${index === breadcrumbs.length - 1 ? 'font-bold' : ''}
-                `}
+                className={index === breadcrumbs.length - 1 ? 'font-semibold' : ''}
               >
                 {crumb.name}
-              </button>
+              </Button>
             </div>
           ))}
         </div>
@@ -177,162 +180,161 @@ export function FolderBrowser({ onSelect, onCancel, initialPath }: FolderBrowser
 
       {/* Drive selector (Windows only) */}
       {directoryData?.drives && directoryData.drives.length > 0 && (
-        <div className="flex-shrink-0 p-3 border-b-3 border-[var(--color-neo-border)] bg-[var(--color-neo-bg)]">
+        <div className="flex-shrink-0 p-3 border-b bg-muted/50">
           <div className="flex items-center gap-2 flex-wrap">
-            <span className="text-sm font-medium text-[var(--color-neo-text-secondary)]">Drives:</span>
+            <span className="text-sm font-medium text-muted-foreground">Drives:</span>
             {directoryData.drives.map((drive) => (
-              <button
+              <Button
                 key={drive.letter}
+                variant={currentPath?.startsWith(drive.letter) ? 'default' : 'outline'}
+                size="sm"
                 onClick={() => handleDriveSelect(drive)}
-                className={`
-                  neo-btn neo-btn-ghost py-1 px-2 text-sm
-                  flex items-center gap-1
-                  ${currentPath?.startsWith(drive.letter) ? 'bg-[var(--color-neo-progress)] text-[var(--color-neo-text-on-bright)]' : ''}
-                `}
               >
                 <HardDrive size={14} />
                 {drive.letter}: {drive.label && `(${drive.label})`}
-              </button>
+              </Button>
             ))}
           </div>
         </div>
       )}
 
       {/* Directory listing */}
-      <div className="flex-1 overflow-y-auto p-2 bg-[var(--color-neo-card)]">
-        {isLoading ? (
-          <div className="flex items-center justify-center p-8">
-            <Loader2 size={24} className="animate-spin text-[var(--color-neo-progress)]" />
-          </div>
-        ) : error ? (
-          <div className="p-4 text-center">
-            <AlertCircle size={32} className="mx-auto mb-2 text-[var(--color-neo-danger)]" />
-            <p className="text-[var(--color-neo-danger)]">
-              {error instanceof Error ? error.message : 'Failed to load directory'}
-            </p>
-            <button onClick={() => refetch()} className="neo-btn neo-btn-ghost mt-2">
-              Retry
-            </button>
-          </div>
-        ) : (
-          <div className="grid grid-cols-1 gap-1">
-            {/* Directory entries - only show directories */}
-            {directoryData?.entries
-              .filter((entry) => entry.is_directory)
-              .map((entry) => (
-                <button
-                  key={entry.path}
-                  onClick={() => handleEntryClick(entry)}
-                  onDoubleClick={() => handleNavigate(entry.path)}
-                  className={`
-                    w-full text-left p-2 rounded
-                    flex items-center gap-2
-                    hover:bg-[var(--color-neo-bg)]
-                    border-2 border-transparent
-                    text-[var(--color-neo-text)]
-                    ${selectedPath === entry.path ? 'bg-[var(--color-neo-progress)] bg-opacity-10 border-[var(--color-neo-progress)]' : ''}
-                  `}
-                >
-                  {selectedPath === entry.path ? (
-                    <FolderOpen size={18} className="text-[var(--color-neo-progress)] flex-shrink-0" />
-                  ) : (
-                    <Folder size={18} className="text-[var(--color-neo-pending)] flex-shrink-0" />
-                  )}
-                  <span className="truncate flex-1 text-[var(--color-neo-text)]">{entry.name}</span>
-                  {entry.has_children && (
-                    <ChevronRight size={14} className="ml-auto text-[var(--color-neo-text-muted)] flex-shrink-0" />
-                  )}
-                </button>
-              ))}
-
-            {/* Empty state */}
-            {directoryData?.entries.filter((e) => e.is_directory).length === 0 && (
-              <div className="p-4 text-center text-[var(--color-neo-text-secondary)]">
-                <Folder size={32} className="mx-auto mb-2 opacity-50" />
-                <p>No subfolders</p>
-                <p className="text-sm">You can create a new folder or select this directory.</p>
-              </div>
-            )}
-          </div>
-        )}
-
-        {/* New folder creation */}
-        {isCreatingFolder && (
-          <div className="mt-2 p-3 bg-[var(--color-neo-bg)] border-2 border-[var(--color-neo-border)] rounded">
-            <div className="flex items-center gap-2">
-              <FolderPlus size={18} className="text-[var(--color-neo-progress)]" />
-              <input
-                type="text"
-                value={newFolderName}
-                onChange={(e) => setNewFolderName(e.target.value)}
-                placeholder="New folder name"
-                className="neo-input flex-1 py-1"
-                autoFocus
-                onKeyDown={(e) => {
-                  if (e.key === 'Enter') handleCreateFolder()
-                  if (e.key === 'Escape') {
-                    setIsCreatingFolder(false)
-                    setNewFolderName('')
-                    setCreateError(null)
-                  }
-                }}
-              />
-              <button onClick={handleCreateFolder} className="neo-btn neo-btn-primary py-1 px-3">
-                Create
-              </button>
-              <button
-                onClick={() => {
-                  setIsCreatingFolder(false)
-                  setNewFolderName('')
-                  setCreateError(null)
-                }}
-                className="neo-btn neo-btn-ghost py-1 px-2"
-              >
-                Cancel
-              </button>
+      <div className="flex-1 min-h-0 overflow-y-auto bg-card">
+        <div className="p-2">
+          {isLoading ? (
+            <div className="flex items-center justify-center p-8">
+              <Loader2 size={24} className="animate-spin text-primary" />
             </div>
-            {createError && (
-              <p className="text-sm text-[var(--color-neo-danger)] mt-1">{createError}</p>
-            )}
-          </div>
-        )}
+          ) : error ? (
+            <div className="p-4 text-center">
+              <AlertCircle size={32} className="mx-auto mb-2 text-destructive" />
+              <p className="text-destructive">
+                {error instanceof Error ? error.message : 'Failed to load directory'}
+              </p>
+              <Button variant="outline" size="sm" onClick={() => refetch()} className="mt-2">
+                Retry
+              </Button>
+            </div>
+          ) : (
+            <div className="grid grid-cols-1 gap-1">
+              {/* Directory entries - only show directories */}
+              {directoryData?.entries
+                .filter((entry) => entry.is_directory)
+                .map((entry) => (
+                  <button
+                    key={entry.path}
+                    onClick={() => handleEntryClick(entry)}
+                    onDoubleClick={() => handleNavigate(entry.path)}
+                    className={`
+                      w-full text-left p-2 rounded-md
+                      flex items-center gap-2
+                      hover:bg-muted
+                      border-2 border-transparent transition-colors
+                      ${selectedPath === entry.path ? 'bg-primary/10 border-primary' : ''}
+                    `}
+                  >
+                    {selectedPath === entry.path ? (
+                      <FolderOpen size={18} className="text-primary flex-shrink-0" />
+                    ) : (
+                      <Folder size={18} className="text-muted-foreground flex-shrink-0" />
+                    )}
+                    <span className="truncate flex-1">{entry.name}</span>
+                    {entry.has_children && (
+                      <ChevronRight size={14} className="ml-auto text-muted-foreground flex-shrink-0" />
+                    )}
+                  </button>
+                ))}
+
+              {/* Empty state */}
+              {directoryData?.entries.filter((e) => e.is_directory).length === 0 && (
+                <div className="p-4 text-center text-muted-foreground">
+                  <Folder size={32} className="mx-auto mb-2 opacity-50" />
+                  <p>No subfolders</p>
+                  <p className="text-sm">You can create a new folder or select this directory.</p>
+                </div>
+              )}
+            </div>
+          )}
+
+          {/* New folder creation */}
+          {isCreatingFolder && (
+            <Card className="mt-2">
+              <CardContent className="p-3">
+                <div className="flex items-center gap-2">
+                  <FolderPlus size={18} className="text-primary" />
+                  <Input
+                    type="text"
+                    value={newFolderName}
+                    onChange={(e) => setNewFolderName(e.target.value)}
+                    placeholder="New folder name"
+                    className="flex-1"
+                    autoFocus
+                    onKeyDown={(e) => {
+                      if (isSubmitEnter(e, false)) handleCreateFolder()
+                      if (e.key === 'Escape') {
+                        setIsCreatingFolder(false)
+                        setNewFolderName('')
+                        setCreateError(null)
+                      }
+                    }}
+                  />
+                  <Button onClick={handleCreateFolder} size="sm">
+                    Create
+                  </Button>
+                  <Button
+                    variant="ghost"
+                    size="sm"
+                    onClick={() => {
+                      setIsCreatingFolder(false)
+                      setNewFolderName('')
+                      setCreateError(null)
+                    }}
+                  >
+                    Cancel
+                  </Button>
+                </div>
+                {createError && (
+                  <p className="text-sm text-destructive mt-1">{createError}</p>
+                )}
+              </CardContent>
+            </Card>
+          )}
+        </div>
       </div>
 
       {/* Footer with selected path and actions */}
-      <div className="flex-shrink-0 p-4 border-t-3 border-[var(--color-neo-border)] bg-[var(--color-neo-card)]">
+      <div className="flex-shrink-0 p-4 border-t bg-card">
         {/* Selected path display */}
-        <div className="mb-3 p-2 bg-[var(--color-neo-bg)] rounded border-2 border-[var(--color-neo-border)]">
-          <div className="text-xs text-[var(--color-neo-text-secondary)] mb-1">Selected path:</div>
-          <div className="font-mono text-sm truncate text-[var(--color-neo-text)]">{selectedPath || 'No folder selected'}</div>
-          {selectedPath && (
-            <div className="text-xs text-[var(--color-neo-text-secondary)] mt-2 italic">
-              This folder will contain all project files
-            </div>
-          )}
-        </div>
+        <Card className="mb-3">
+          <CardContent className="p-2">
+            <div className="text-xs text-muted-foreground mb-1">Selected path:</div>
+            <div className="font-mono text-sm truncate">{selectedPath || 'No folder selected'}</div>
+            {selectedPath && (
+              <div className="text-xs text-muted-foreground mt-2 italic">
+                This folder will contain all project files
+              </div>
+            )}
+          </CardContent>
+        </Card>
 
         {/* Actions */}
         <div className="flex items-center justify-between">
-          <button
+          <Button
+            variant="outline"
             onClick={() => setIsCreatingFolder(true)}
-            className="neo-btn neo-btn-ghost"
             disabled={isCreatingFolder}
           >
             <FolderPlus size={16} />
             New Folder
-          </button>
+          </Button>
 
           <div className="flex items-center gap-2">
-            <button onClick={onCancel} className="neo-btn neo-btn-ghost">
+            <Button variant="outline" onClick={onCancel}>
               Cancel
-            </button>
-            <button
-              onClick={handleSelect}
-              className="neo-btn neo-btn-primary"
-              disabled={!selectedPath}
-            >
+            </Button>
+            <Button onClick={handleSelect} disabled={!selectedPath}>
               Select This Folder
-            </button>
+            </Button>
           </div>
         </div>
       </div>

ui/src/components/KanbanBoard.tsx

@@ -1,5 +1,6 @@
 import { KanbanColumn } from './KanbanColumn'
 import type { Feature, FeatureListResponse, ActiveAgent } from '../lib/types'
+import { Card, CardContent } from '@/components/ui/card'
 
 interface KanbanBoardProps {
   features: FeatureListResponse | undefined
@@ -7,8 +8,8 @@ interface KanbanBoardProps {
   onAddFeature?: () => void
   onExpandProject?: () => void
   activeAgents?: ActiveAgent[]
-  onCreateSpec?: () => void  // Callback to start spec creation
-  hasSpec?: boolean          // Whether the project has a spec
+  onCreateSpec?: () => void
+  hasSpec?: boolean
 }
 
 export function KanbanBoard({ features, onFeatureClick, onAddFeature, onExpandProject, activeAgents = [], onCreateSpec, hasSpec = true }: KanbanBoardProps) {
@@ -23,14 +24,16 @@ export function KanbanBoard({ features, onFeatureClick, onAddFeature, onExpandPr
     return (
       <div className="grid grid-cols-1 md:grid-cols-3 gap-6">
         {['Pending', 'In Progress', 'Done'].map(title => (
-          <div key={title} className="neo-card p-4">
-            <div className="h-8 bg-[var(--color-neo-bg)] animate-pulse mb-4" />
-            <div className="space-y-3">
-              {[1, 2, 3].map(i => (
-                <div key={i} className="h-24 bg-[var(--color-neo-bg)] animate-pulse" />
-              ))}
-            </div>
-          </div>
+          <Card key={title} className="py-4">
+            <CardContent className="p-4">
+              <div className="h-8 bg-muted animate-pulse rounded mb-4" />
+              <div className="space-y-3">
+                {[1, 2, 3].map(i => (
+                  <div key={i} className="h-24 bg-muted animate-pulse rounded" />
+                ))}
+              </div>
+            </CardContent>
+          </Card>
         ))}
       </div>
     )

ui/src/components/KanbanColumn.tsx

@@ -1,26 +1,29 @@
 import { FeatureCard } from './FeatureCard'
 import { Plus, Sparkles, Wand2 } from 'lucide-react'
 import type { Feature, ActiveAgent } from '../lib/types'
+import { Card, CardContent, CardHeader, CardTitle } from '@/components/ui/card'
+import { Button } from '@/components/ui/button'
+import { Badge } from '@/components/ui/badge'
 
 interface KanbanColumnProps {
   title: string
   count: number
   features: Feature[]
-  allFeatures?: Feature[]  // For dependency status calculation
-  activeAgents?: ActiveAgent[]  // Active agents for showing which agent is working on a feature
+  allFeatures?: Feature[]
+  activeAgents?: ActiveAgent[]
   color: 'pending' | 'progress' | 'done'
   onFeatureClick: (feature: Feature) => void
   onAddFeature?: () => void
   onExpandProject?: () => void
   showExpandButton?: boolean
-  onCreateSpec?: () => void  // Callback to start spec creation
-  showCreateSpec?: boolean   // Show "Create Spec" button when project has no spec
+  onCreateSpec?: () => void
+  showCreateSpec?: boolean
 }
 
 const colorMap = {
-  pending: 'var(--color-neo-pending)',
-  progress: 'var(--color-neo-progress)',
-  done: 'var(--color-neo-done)',
+  pending: 'border-t-4 border-t-muted',
+  progress: 'border-t-4 border-t-primary',
+  done: 'border-t-4 border-t-primary',
 }
 
 export function KanbanColumn({
@@ -38,86 +41,86 @@ export function KanbanColumn({
   showCreateSpec,
 }: KanbanColumnProps) {
   // Create a map of feature ID to active agent for quick lookup
-  const agentByFeatureId = new Map(
-    activeAgents.map(agent => [agent.featureId, agent])
-  )
-  return (
-    <div
-      className="neo-card overflow-hidden"
-      style={{ borderColor: colorMap[color] }}
-    >
-      {/* Header */}
-      <div
-        className="px-4 py-3 border-b-3 border-[var(--color-neo-border)]"
-        style={{ backgroundColor: colorMap[color] }}
-      >
-        <div className="flex items-center justify-between">
-          <h2 className="font-display text-lg font-bold uppercase flex items-center gap-2 text-[var(--color-neo-text-on-bright)]">
-            {title}
-            <span className="neo-badge bg-[var(--color-neo-card)] text-[var(--color-neo-text)]">{count}</span>
-          </h2>
-          {(onAddFeature || onExpandProject) && (
-            <div className="flex items-center gap-2">
-              {onAddFeature && (
-                <button
-                  onClick={onAddFeature}
-                  className="neo-btn neo-btn-primary text-sm py-1.5 px-2"
-                  title="Add new feature (N)"
-                >
-                  <Plus size={16} />
-                </button>
-              )}
-              {onExpandProject && showExpandButton && (
-                <button
-                  onClick={onExpandProject}
-                  className="neo-btn bg-[var(--color-neo-progress)] text-[var(--color-neo-text-on-bright)] text-sm py-1.5 px-2"
-                  title="Expand project with AI (E)"
-                >
-                  <Sparkles size={16} />
-                </button>
-              )}
-            </div>
-          )}
-        </div>
-      </div>
+  // Maps ALL batch feature IDs to the same agent
+  const agentByFeatureId = new Map<number, ActiveAgent>()
+  for (const agent of activeAgents) {
+    const ids = agent.featureIds || [agent.featureId]
+    for (const fid of ids) {
+      agentByFeatureId.set(fid, agent)
+    }
+  }
 
-      {/* Cards */}
-      <div className="p-4 space-y-3 max-h-[600px] overflow-y-auto bg-[var(--color-neo-bg)]">
-        {features.length === 0 ? (
-          <div className="text-center py-8 text-[var(--color-neo-text-secondary)]">
-            {showCreateSpec && onCreateSpec ? (
-              <div className="space-y-4">
-                <p>No spec created yet</p>
-                <button
-                  onClick={onCreateSpec}
-                  className="neo-btn neo-btn-primary inline-flex items-center gap-2"
-                >
-                  <Wand2 size={18} />
-                  Create Spec with AI
-                </button>
-              </div>
-            ) : (
-              'No features'
+  return (
+    <Card className={`overflow-hidden ${colorMap[color]} py-0`}>
+      {/* Header */}
+      <CardHeader className="px-4 py-3 border-b flex-row items-center justify-between space-y-0">
+        <CardTitle className="text-lg font-semibold flex items-center gap-2">
+          {title}
+          <Badge variant="secondary">{count}</Badge>
+        </CardTitle>
+        {(onAddFeature || onExpandProject) && (
+          <div className="flex items-center gap-2">
+            {onAddFeature && (
+              <Button
+                onClick={onAddFeature}
+                size="icon-sm"
+                title="Add new feature (N)"
+              >
+                <Plus size={16} />
+              </Button>
+            )}
+            {onExpandProject && showExpandButton && (
+              <Button
+                onClick={onExpandProject}
+                size="icon-sm"
+                variant="secondary"
+                title="Expand project with AI (E)"
+              >
+                <Sparkles size={16} />
+              </Button>
             )}
           </div>
-        ) : (
-          features.map((feature, index) => (
-            <div
-              key={feature.id}
-              className="animate-slide-in"
-              style={{ animationDelay: `${index * 50}ms` }}
-            >
-              <FeatureCard
-                feature={feature}
-                onClick={() => onFeatureClick(feature)}
-                isInProgress={color === 'progress'}
-                allFeatures={allFeatures}
-                activeAgent={agentByFeatureId.get(feature.id)}
-              />
-            </div>
-          ))
         )}
-      </div>
-    </div>
+      </CardHeader>
+
+      {/* Cards */}
+      <CardContent className="p-0">
+        <div className="h-[600px] overflow-y-auto">
+          <div className="p-4 space-y-3">
+            {features.length === 0 ? (
+              <div className="text-center py-8 text-muted-foreground">
+                {showCreateSpec && onCreateSpec ? (
+                  <div className="space-y-4">
+                    <p>No spec created yet</p>
+                    <Button onClick={onCreateSpec}>
+                      <Wand2 size={18} />
+                      Create Spec with AI
+                    </Button>
+                  </div>
+                ) : (
+                  'No features'
+                )}
+              </div>
+            ) : (
+              features.map((feature, index) => (
+                <div
+                  key={feature.id}
+                  className="animate-slide-in"
+                  style={{ animationDelay: `${index * 50}ms` }}
+                >
+                  <FeatureCard
+                    feature={feature}
+                    onClick={() => onFeatureClick(feature)}
+                    isInProgress={color === 'progress'}
+                    allFeatures={allFeatures}
+                    activeAgent={agentByFeatureId.get(feature.id)}
+                  />
+                </div>
+              ))
+            )}
+          </div>
+        </div>
+      </CardContent>
+    </Card>
   )
 }

ui/src/components/KeyboardShortcutsHelp.tsx

@@ -1,5 +1,12 @@
 import { useEffect, useCallback } from 'react'
-import { X, Keyboard } from 'lucide-react'
+import { Keyboard } from 'lucide-react'
+import {
+  Dialog,
+  DialogContent,
+  DialogHeader,
+  DialogTitle,
+} from '@/components/ui/dialog'
+import { Badge } from '@/components/ui/badge'
 
 interface Shortcut {
   key: string
@@ -20,10 +27,11 @@ const shortcuts: Shortcut[] = [
 ]
 
 interface KeyboardShortcutsHelpProps {
+  isOpen: boolean
   onClose: () => void
 }
 
-export function KeyboardShortcutsHelp({ onClose }: KeyboardShortcutsHelpProps) {
+export function KeyboardShortcutsHelp({ isOpen, onClose }: KeyboardShortcutsHelpProps) {
   const handleKeyDown = useCallback(
     (e: KeyboardEvent) => {
       if (e.key === 'Escape' || e.key === '?') {
@@ -35,59 +43,49 @@ export function KeyboardShortcutsHelp({ onClose }: KeyboardShortcutsHelpProps) {
   )
 
   useEffect(() => {
-    window.addEventListener('keydown', handleKeyDown)
-    return () => window.removeEventListener('keydown', handleKeyDown)
-  }, [handleKeyDown])
+    if (isOpen) {
+      window.addEventListener('keydown', handleKeyDown)
+      return () => window.removeEventListener('keydown', handleKeyDown)
+    }
+  }, [isOpen, handleKeyDown])
 
   return (
-    <div
-      className="fixed inset-0 z-50 flex items-center justify-center bg-black/50"
-      onClick={onClose}
-    >
-      <div
-        className="neo-card p-6 max-w-md w-full mx-4"
-        onClick={(e) => e.stopPropagation()}
-      >
-        {/* Header */}
-        <div className="flex items-center justify-between mb-6">
-          <div className="flex items-center gap-2">
-            <Keyboard size={20} className="text-neo-accent" />
-            <h2 className="font-display text-lg font-bold">Keyboard Shortcuts</h2>
-          </div>
-          <button
-            onClick={onClose}
-            className="neo-btn p-1.5"
-            aria-label="Close"
-          >
-            <X size={16} />
-          </button>
-        </div>
+    <Dialog open={isOpen} onOpenChange={(open) => !open && onClose()}>
+      <DialogContent className="sm:max-w-md">
+        <DialogHeader>
+          <DialogTitle className="flex items-center gap-2">
+            <Keyboard size={20} className="text-primary" />
+            Keyboard Shortcuts
+          </DialogTitle>
+        </DialogHeader>
 
         {/* Shortcuts list */}
-        <ul className="space-y-2">
+        <ul className="space-y-1">
           {shortcuts.map((shortcut) => (
             <li
               key={shortcut.key}
-              className="flex items-center justify-between py-2 border-b border-neo-border/30 last:border-0"
+              className="flex items-center justify-between py-2 border-b border-border/50 last:border-0"
             >
-              <div className="flex items-center gap-2">
-                <kbd className="px-2 py-1 text-sm font-mono bg-neo-bg rounded border border-neo-border shadow-neo-sm min-w-[2rem] text-center">
+              <div className="flex items-center gap-3">
+                <kbd className="px-2 py-1 text-xs font-mono bg-muted rounded border border-border min-w-[2rem] text-center">
                   {shortcut.key}
                 </kbd>
-                <span className="text-neo-text">{shortcut.description}</span>
+                <span className="text-sm">{shortcut.description}</span>
               </div>
               {shortcut.context && (
-                <span className="text-xs text-neo-muted">{shortcut.context}</span>
+                <Badge variant="secondary" className="text-xs">
+                  {shortcut.context}
+                </Badge>
               )}
             </li>
           ))}
         </ul>
 
         {/* Footer */}
-        <p className="text-xs text-neo-muted text-center mt-6">
+        <p className="text-xs text-muted-foreground text-center pt-2">
           Press ? or Esc to close
         </p>
-      </div>
-    </div>
+      </DialogContent>
+    </Dialog>
   )
 }

ui/src/components/NewProjectModal.tsx

@@ -10,11 +10,26 @@
  */
 
 import { useState } from 'react'
-import { X, Bot, FileEdit, ArrowRight, ArrowLeft, Loader2, CheckCircle2, Folder } from 'lucide-react'
+import { createPortal } from 'react-dom'
+import { Bot, FileEdit, ArrowRight, ArrowLeft, Loader2, CheckCircle2, Folder } from 'lucide-react'
 import { useCreateProject } from '../hooks/useProjects'
 import { SpecCreationChat } from './SpecCreationChat'
 import { FolderBrowser } from './FolderBrowser'
 import { startAgent } from '../lib/api'
+import {
+  Dialog,
+  DialogContent,
+  DialogHeader,
+  DialogTitle,
+  DialogDescription,
+  DialogFooter,
+} from '@/components/ui/dialog'
+import { Button } from '@/components/ui/button'
+import { Input } from '@/components/ui/input'
+import { Label } from '@/components/ui/label'
+import { Alert, AlertDescription } from '@/components/ui/alert'
+import { Badge } from '@/components/ui/badge'
+import { Card, CardContent } from '@/components/ui/card'
 
 type InitializerStatus = 'idle' | 'starting' | 'error'
 
@@ -75,7 +90,7 @@ export function NewProjectModal({
   }
 
   const handleFolderSelect = (path: string) => {
-    setProjectPath(path)  // Use selected path directly - no subfolder creation
+    setProjectPath(path)
     changeStep('method')
   }
 
@@ -186,10 +201,10 @@ export function NewProjectModal({
     }
   }
 
-  // Full-screen chat view
+  // Full-screen chat view - use portal to render at body level
   if (step === 'chat') {
-    return (
-      <div className="fixed inset-0 z-50 bg-[var(--color-neo-bg)]">
+    return createPortal(
+      <div className="fixed inset-0 z-50 bg-background flex flex-col">
         <SpecCreationChat
           projectName={projectName.trim()}
           onComplete={handleSpecComplete}
@@ -199,38 +214,28 @@ export function NewProjectModal({
           initializerError={initializerError}
           onRetryInitializer={handleRetryInitializer}
         />
-      </div>
+      </div>,
+      document.body
     )
   }
 
   // Folder step uses larger modal
   if (step === 'folder') {
     return (
-      <div className="neo-modal-backdrop" onClick={handleClose}>
-        <div
-          className="neo-modal w-full max-w-3xl max-h-[85vh] flex flex-col"
-          onClick={(e) => e.stopPropagation()}
-        >
+      <Dialog open={true} onOpenChange={(open) => !open && handleClose()}>
+        <DialogContent className="sm:max-w-3xl max-h-[85vh] flex flex-col p-0">
           {/* Header */}
-          <div className="flex items-center justify-between p-4 border-b-3 border-[var(--color-neo-border)]">
+          <DialogHeader className="p-6 pb-4 border-b">
             <div className="flex items-center gap-3">
-              <Folder size={24} className="text-[var(--color-neo-progress)]" />
+              <Folder size={24} className="text-primary" />
               <div>
-                <h2 className="font-display font-bold text-xl text-[var(--color-neo-text)]">
-                  Select Project Location
-                </h2>
-                <p className="text-sm text-[var(--color-neo-text-secondary)]">
-                  Select the folder to use for project <span className="font-bold font-mono">{projectName}</span>. Create a new folder or choose an existing one.
-                </p>
+                <DialogTitle>Select Project Location</DialogTitle>
+                <DialogDescription>
+                  Select the folder to use for project <span className="font-semibold font-mono">{projectName}</span>. Create a new folder or choose an existing one.
+                </DialogDescription>
               </div>
             </div>
-            <button
-              onClick={handleClose}
-              className="neo-btn neo-btn-ghost p-2"
-            >
-              <X size={20} />
-            </button>
-          </div>
+          </DialogHeader>
 
           {/* Folder Browser */}
           <div className="flex-1 overflow-hidden">
@@ -239,193 +244,151 @@ export function NewProjectModal({
               onCancel={handleFolderCancel}
             />
           </div>
-        </div>
-      </div>
+        </DialogContent>
+      </Dialog>
     )
   }
 
   return (
-    <div className="neo-modal-backdrop" onClick={handleClose}>
-      <div
-        className="neo-modal w-full max-w-lg"
-        onClick={(e) => e.stopPropagation()}
-      >
-        {/* Header */}
-        <div className="flex items-center justify-between p-4 border-b-3 border-[var(--color-neo-border)]">
-          <h2 className="font-display font-bold text-xl text-[var(--color-neo-text)]">
+    <Dialog open={true} onOpenChange={(open) => !open && handleClose()}>
+      <DialogContent className="sm:max-w-lg">
+        <DialogHeader>
+          <DialogTitle>
             {step === 'name' && 'Create New Project'}
             {step === 'method' && 'Choose Setup Method'}
             {step === 'complete' && 'Project Created!'}
-          </h2>
-          <button
-            onClick={handleClose}
-            className="neo-btn neo-btn-ghost p-2"
-          >
-            <X size={20} />
-          </button>
-        </div>
+          </DialogTitle>
+        </DialogHeader>
 
-        {/* Content */}
-        <div className="p-6">
-          {/* Step 1: Project Name */}
-          {step === 'name' && (
-            <form onSubmit={handleNameSubmit}>
-              <div className="mb-6">
-                <label className="block font-bold mb-2 text-[var(--color-neo-text)]">
-                  Project Name
-                </label>
-                <input
-                  type="text"
-                  value={projectName}
-                  onChange={(e) => setProjectName(e.target.value)}
-                  placeholder="my-awesome-app"
-                  className="neo-input"
-                  pattern="^[a-zA-Z0-9_-]+$"
-                  autoFocus
-                />
-                <p className="text-sm text-[var(--color-neo-text-secondary)] mt-2">
-                  Use letters, numbers, hyphens, and underscores only.
-                </p>
-              </div>
-
-              {error && (
-                <div className="mb-4 p-3 bg-[var(--color-neo-error-bg)] text-[var(--color-neo-error-text)] text-sm border-3 border-[var(--color-neo-error-border)]">
-                  {error}
-                </div>
-              )}
-
-              <div className="flex justify-end">
-                <button
-                  type="submit"
-                  className="neo-btn neo-btn-primary"
-                  disabled={!projectName.trim()}
-                >
-                  Next
-                  <ArrowRight size={16} />
-                </button>
-              </div>
-            </form>
-          )}
-
-          {/* Step 2: Spec Method */}
-          {step === 'method' && (
-            <div>
-              <p className="text-[var(--color-neo-text-secondary)] mb-6">
-                How would you like to define your project?
+        {/* Step 1: Project Name */}
+        {step === 'name' && (
+          <form onSubmit={handleNameSubmit} className="space-y-4">
+            <div className="space-y-2">
+              <Label htmlFor="project-name">Project Name</Label>
+              <Input
+                id="project-name"
+                type="text"
+                value={projectName}
+                onChange={(e) => setProjectName(e.target.value)}
+                placeholder="my-awesome-app"
+                pattern="^[a-zA-Z0-9_-]+$"
+                autoFocus
+              />
+              <p className="text-sm text-muted-foreground">
+                Use letters, numbers, hyphens, and underscores only.
               </p>
+            </div>
 
-              <div className="space-y-4">
-                {/* Claude option */}
-                <button
-                  onClick={() => handleMethodSelect('claude')}
-                  disabled={createProject.isPending}
-                  className="
-                    w-full text-left p-4
-                    hover:translate-x-[-2px] hover:translate-y-[-2px]
-                    transition-all duration-150
-                    disabled:opacity-50 disabled:cursor-not-allowed
-                    neo-card
-                  "
-                >
+            {error && (
+              <Alert variant="destructive">
+                <AlertDescription>{error}</AlertDescription>
+              </Alert>
+            )}
+
+            <DialogFooter>
+              <Button type="submit" disabled={!projectName.trim()}>
+                Next
+                <ArrowRight size={16} />
+              </Button>
+            </DialogFooter>
+          </form>
+        )}
+
+        {/* Step 2: Spec Method */}
+        {step === 'method' && (
+          <div className="space-y-4">
+            <DialogDescription>
+              How would you like to define your project?
+            </DialogDescription>
+
+            <div className="space-y-3">
+              {/* Claude option */}
+              <Card
+                className="cursor-pointer hover:border-primary transition-colors"
+                onClick={() => !createProject.isPending && handleMethodSelect('claude')}
+              >
+                <CardContent className="p-4">
                   <div className="flex items-start gap-4">
-                    <div
-                      className="p-2 bg-[var(--color-neo-progress)] border-2 border-[var(--color-neo-border)]"
-                      style={{ boxShadow: 'var(--shadow-neo-sm)' }}
-                    >
-                      <Bot size={24} className="text-[var(--color-neo-text-on-bright)]" />
+                    <div className="p-2 bg-primary/10 rounded-lg">
+                      <Bot size={24} className="text-primary" />
                     </div>
                     <div className="flex-1">
                       <div className="flex items-center gap-2">
-                        <span className="font-bold text-lg text-[var(--color-neo-text)]">Create with Claude</span>
-                        <span className="neo-badge bg-[var(--color-neo-done)] text-[var(--color-neo-text-on-bright)] text-xs">
-                          Recommended
-                        </span>
+                        <span className="font-semibold">Create with Claude</span>
+                        <Badge>Recommended</Badge>
                       </div>
-                      <p className="text-sm text-[var(--color-neo-text-secondary)] mt-1">
+                      <p className="text-sm text-muted-foreground mt-1">
                         Interactive conversation to define features and generate your app specification automatically.
                       </p>
                     </div>
                   </div>
-                </button>
+                </CardContent>
+              </Card>
 
-                {/* Manual option */}
-                <button
-                  onClick={() => handleMethodSelect('manual')}
-                  disabled={createProject.isPending}
-                  className="
-                    w-full text-left p-4
-                    hover:translate-x-[-2px] hover:translate-y-[-2px]
-                    transition-all duration-150
-                    disabled:opacity-50 disabled:cursor-not-allowed
-                    neo-card
-                  "
-                >
+              {/* Manual option */}
+              <Card
+                className="cursor-pointer hover:border-primary transition-colors"
+                onClick={() => !createProject.isPending && handleMethodSelect('manual')}
+              >
+                <CardContent className="p-4">
                   <div className="flex items-start gap-4">
-                    <div
-                      className="p-2 bg-[var(--color-neo-pending)] border-2 border-[var(--color-neo-border)]"
-                      style={{ boxShadow: 'var(--shadow-neo-sm)' }}
-                    >
-                      <FileEdit size={24} className="text-[var(--color-neo-text-on-bright)]" />
+                    <div className="p-2 bg-secondary rounded-lg">
+                      <FileEdit size={24} className="text-secondary-foreground" />
                     </div>
                     <div className="flex-1">
-                      <span className="font-bold text-lg text-[var(--color-neo-text)]">Edit Templates Manually</span>
-                      <p className="text-sm text-[var(--color-neo-text-secondary)] mt-1">
+                      <span className="font-semibold">Edit Templates Manually</span>
+                      <p className="text-sm text-muted-foreground mt-1">
                         Edit the template files directly. Best for developers who want full control.
                       </p>
                     </div>
                   </div>
-                </button>
-              </div>
-
-              {error && (
-                <div className="mt-4 p-3 bg-[var(--color-neo-error-bg)] text-[var(--color-neo-error-text)] text-sm border-3 border-[var(--color-neo-error-border)]">
-                  {error}
-                </div>
-              )}
-
-              {createProject.isPending && (
-                <div className="mt-4 flex items-center justify-center gap-2 text-[var(--color-neo-text-secondary)]">
-                  <Loader2 size={16} className="animate-spin" />
-                  <span>Creating project...</span>
-                </div>
-              )}
-
-              <div className="flex justify-start mt-6">
-                <button
-                  onClick={handleBack}
-                  className="neo-btn neo-btn-ghost"
-                  disabled={createProject.isPending}
-                >
-                  <ArrowLeft size={16} />
-                  Back
-                </button>
-              </div>
+                </CardContent>
+              </Card>
             </div>
-          )}
 
-          {/* Step 3: Complete */}
-          {step === 'complete' && (
-            <div className="text-center py-8">
-              <div
-                className="inline-flex items-center justify-center w-16 h-16 bg-[var(--color-neo-done)] border-3 border-[var(--color-neo-border)] mb-4"
-                style={{ boxShadow: 'var(--shadow-neo-md)' }}
-              >
-                <CheckCircle2 size={32} className="text-[var(--color-neo-text-on-bright)]" />
-              </div>
-              <h3 className="font-display font-bold text-xl mb-2">
-                {projectName}
-              </h3>
-              <p className="text-[var(--color-neo-text-secondary)]">
-                Your project has been created successfully!
-              </p>
-              <div className="mt-4 flex items-center justify-center gap-2">
+            {error && (
+              <Alert variant="destructive">
+                <AlertDescription>{error}</AlertDescription>
+              </Alert>
+            )}
+
+            {createProject.isPending && (
+              <div className="flex items-center justify-center gap-2 text-muted-foreground">
                 <Loader2 size={16} className="animate-spin" />
-                <span className="text-sm">Redirecting...</span>
+                <span>Creating project...</span>
               </div>
+            )}
+
+            <DialogFooter className="sm:justify-start">
+              <Button
+                variant="ghost"
+                onClick={handleBack}
+                disabled={createProject.isPending}
+              >
+                <ArrowLeft size={16} />
+                Back
+              </Button>
+            </DialogFooter>
+          </div>
+        )}
+
+        {/* Step 3: Complete */}
+        {step === 'complete' && (
+          <div className="text-center py-8">
+            <div className="inline-flex items-center justify-center w-16 h-16 bg-primary/10 rounded-full mb-4">
+              <CheckCircle2 size={32} className="text-primary" />
             </div>
-          )}
-        </div>
-      </div>
-    </div>
+            <h3 className="font-semibold text-xl mb-2">{projectName}</h3>
+            <p className="text-muted-foreground">
+              Your project has been created successfully!
+            </p>
+            <div className="mt-4 flex items-center justify-center gap-2">
+              <Loader2 size={16} className="animate-spin" />
+              <span className="text-sm text-muted-foreground">Redirecting...</span>
+            </div>
+          </div>
+        )}
+      </DialogContent>
+    </Dialog>
   )
 }

ui/src/components/OrchestratorStatusCard.tsx

@@ -2,6 +2,9 @@ import { useState } from 'react'
 import { ChevronDown, ChevronUp, Code, FlaskConical, Clock, Lock, Sparkles } from 'lucide-react'
 import { OrchestratorAvatar } from './OrchestratorAvatar'
 import type { OrchestratorStatus, OrchestratorState } from '../lib/types'
+import { Card, CardContent } from '@/components/ui/card'
+import { Button } from '@/components/ui/button'
+import { Badge } from '@/components/ui/badge'
 
 interface OrchestratorStatusCardProps {
   status: OrchestratorStatus
@@ -31,16 +34,16 @@ function getStateText(state: OrchestratorState): string {
 function getStateColor(state: OrchestratorState): string {
   switch (state) {
     case 'complete':
-      return 'text-neo-done'
+      return 'text-primary'
     case 'spawning':
-      return 'text-[#7C3AED]'  // Violet
+      return 'text-primary'
     case 'scheduling':
     case 'monitoring':
-      return 'text-neo-progress'
+      return 'text-primary'
     case 'initializing':
-      return 'text-neo-pending'
+      return 'text-yellow-600 dark:text-yellow-400'
     default:
-      return 'text-neo-text-secondary'
+      return 'text-muted-foreground'
   }
 }
 
@@ -62,91 +65,95 @@ export function OrchestratorStatusCard({ status }: OrchestratorStatusCardProps)
   const [showEvents, setShowEvents] = useState(false)
 
   return (
-    <div className="neo-card p-4 bg-gradient-to-r from-[#EDE9FE] to-[#F3E8FF] border-[#7C3AED]/30 mb-4">
-      <div className="flex items-start gap-4">
-        {/* Avatar */}
-        <OrchestratorAvatar state={status.state} size="md" />
+    <Card className="mb-4 bg-primary/10 border-primary/30 py-4">
+      <CardContent className="p-4">
+        <div className="flex items-start gap-4">
+          {/* Avatar */}
+          <OrchestratorAvatar state={status.state} size="md" />
 
-        {/* Main content */}
-        <div className="flex-1 min-w-0">
-          {/* Header row */}
-          <div className="flex items-center gap-2 mb-1">
-            <span className="font-display font-bold text-lg text-[#7C3AED]">
-              Maestro
-            </span>
-            <span className={`text-sm font-medium ${getStateColor(status.state)}`}>
-              {getStateText(status.state)}
-            </span>
+          {/* Main content */}
+          <div className="flex-1 min-w-0">
+            {/* Header row */}
+            <div className="flex items-center gap-2 mb-1">
+              <span className="font-semibold text-lg text-primary">
+                Maestro
+              </span>
+              <span className={`text-sm font-medium ${getStateColor(status.state)}`}>
+                {getStateText(status.state)}
+              </span>
+            </div>
+
+            {/* Current message */}
+            <p className="text-sm text-foreground mb-3 line-clamp-2">
+              {status.message}
+            </p>
+
+            {/* Status badges row */}
+            <div className="flex flex-wrap items-center gap-2">
+              {/* Coding agents badge */}
+              <Badge variant="outline" className="bg-blue-100 text-blue-700 border-blue-300 dark:bg-blue-900/30 dark:text-blue-300 dark:border-blue-700">
+                <Code size={12} />
+                Coding: {status.codingAgents}
+              </Badge>
+
+              {/* Testing agents badge */}
+              <Badge variant="outline" className="bg-purple-100 text-purple-700 border-purple-300 dark:bg-purple-900/30 dark:text-purple-300 dark:border-purple-700">
+                <FlaskConical size={12} />
+                Testing: {status.testingAgents}
+              </Badge>
+
+              {/* Ready queue badge */}
+              <Badge variant="outline" className="bg-green-100 text-green-700 border-green-300 dark:bg-green-900/30 dark:text-green-300 dark:border-green-700">
+                <Clock size={12} />
+                Ready: {status.readyCount}
+              </Badge>
+
+              {/* Blocked badge (only show if > 0) */}
+              {status.blockedCount > 0 && (
+                <Badge variant="outline" className="bg-amber-100 text-amber-700 border-amber-300 dark:bg-amber-900/30 dark:text-amber-300 dark:border-amber-700">
+                  <Lock size={12} />
+                  Blocked: {status.blockedCount}
+                </Badge>
+              )}
+            </div>
           </div>
 
-          {/* Current message */}
-          <p className="text-sm text-neo-text mb-3 line-clamp-2">
-            {status.message}
-          </p>
-
-          {/* Status badges row */}
-          <div className="flex flex-wrap items-center gap-2">
-            {/* Coding agents badge */}
-            <div className="inline-flex items-center gap-1.5 px-2 py-1 bg-blue-100 text-blue-700 rounded border border-blue-300 text-xs font-bold">
-              <Code size={12} />
-              <span>Coding: {status.codingAgents}</span>
-            </div>
-
-            {/* Testing agents badge */}
-            <div className="inline-flex items-center gap-1.5 px-2 py-1 bg-purple-100 text-purple-700 rounded border border-purple-300 text-xs font-bold">
-              <FlaskConical size={12} />
-              <span>Testing: {status.testingAgents}</span>
-            </div>
-
-            {/* Ready queue badge */}
-            <div className="inline-flex items-center gap-1.5 px-2 py-1 bg-green-100 text-green-700 rounded border border-green-300 text-xs font-bold">
-              <Clock size={12} />
-              <span>Ready: {status.readyCount}</span>
-            </div>
-
-            {/* Blocked badge (only show if > 0) */}
-            {status.blockedCount > 0 && (
-              <div className="inline-flex items-center gap-1.5 px-2 py-1 bg-amber-100 text-amber-700 rounded border border-amber-300 text-xs font-bold">
-                <Lock size={12} />
-                <span>Blocked: {status.blockedCount}</span>
-              </div>
-            )}
-          </div>
+          {/* Recent events toggle */}
+          {status.recentEvents.length > 0 && (
+            <Button
+              variant="ghost"
+              size="sm"
+              onClick={() => setShowEvents(!showEvents)}
+              className="text-primary hover:bg-primary/10"
+            >
+              <Sparkles size={12} />
+              Activity
+              {showEvents ? <ChevronUp size={14} /> : <ChevronDown size={14} />}
+            </Button>
+          )}
         </div>
 
-        {/* Recent events toggle */}
-        {status.recentEvents.length > 0 && (
-          <button
-            onClick={() => setShowEvents(!showEvents)}
-            className="flex items-center gap-1 px-2 py-1 text-xs font-medium text-[#7C3AED] hover:bg-[#7C3AED]/10 rounded transition-colors"
-          >
-            <Sparkles size={12} />
-            <span>Activity</span>
-            {showEvents ? <ChevronUp size={14} /> : <ChevronDown size={14} />}
-          </button>
+        {/* Collapsible recent events */}
+        {showEvents && status.recentEvents.length > 0 && (
+          <div className="mt-3 pt-3 border-t border-primary/20">
+            <div className="space-y-1.5">
+              {status.recentEvents.map((event, idx) => (
+                <div
+                  key={`${event.timestamp}-${idx}`}
+                  className="flex items-start gap-2 text-xs"
+                >
+                  <span className="text-primary shrink-0 font-mono">
+                    {formatRelativeTime(event.timestamp)}
+                  </span>
+                  <span className="text-foreground">
+                    {event.message}
+                  </span>
+                </div>
+              ))}
+            </div>
+          </div>
         )}
-      </div>
-
-      {/* Collapsible recent events */}
-      {showEvents && status.recentEvents.length > 0 && (
-        <div className="mt-3 pt-3 border-t border-[#7C3AED]/20">
-          <div className="space-y-1.5">
-            {status.recentEvents.map((event, idx) => (
-              <div
-                key={`${event.timestamp}-${idx}`}
-                className="flex items-start gap-2 text-xs"
-              >
-                <span className="text-[#A78BFA] shrink-0 font-mono">
-                  {formatRelativeTime(event.timestamp)}
-                </span>
-                <span className="text-neo-text">
-                  {event.message}
-                </span>
-              </div>
-            ))}
-          </div>
-        </div>
-      )}
-    </div>
+      </CardContent>
+    </Card>
   )
 }

ui/src/components/ProgressDashboard.tsx

@@ -1,10 +1,40 @@
-import { Wifi, WifiOff } from 'lucide-react'
+import { useMemo, useState, useEffect } from 'react'
+import { Wifi, WifiOff, Brain, Sparkles } from 'lucide-react'
+import { Card, CardContent, CardHeader, CardTitle } from '@/components/ui/card'
+import { Badge } from '@/components/ui/badge'
+import type { AgentStatus } from '../lib/types'
 
 interface ProgressDashboardProps {
   passing: number
   total: number
   percentage: number
   isConnected: boolean
+  logs?: Array<{ line: string; timestamp: string }>
+  agentStatus?: AgentStatus
+}
+
+const IDLE_TIMEOUT = 30000
+
+function isAgentThought(line: string): boolean {
+  const trimmed = line.trim()
+  if (/^\[Tool:/.test(trimmed)) return false
+  if (/^\s*Input:\s*\{/.test(trimmed)) return false
+  if (/^\[(Done|Error)\]/.test(trimmed)) return false
+  if (/^Output:/.test(trimmed)) return false
+  if (/^[[{]/.test(trimmed)) return false
+  if (trimmed.length < 10) return false
+  if (/^[A-Za-z]:\\/.test(trimmed)) return false
+  if (/^\/[a-z]/.test(trimmed)) return false
+  return true
+}
+
+function getLatestThought(logs: Array<{ line: string; timestamp: string }>): string | null {
+  for (let i = logs.length - 1; i >= 0; i--) {
+    if (isAgentThought(logs[i].line)) {
+      return logs[i].line.trim()
+    }
+  }
+  return null
 }
 
 export function ProgressDashboard({
@@ -12,68 +42,112 @@ export function ProgressDashboard({
   total,
   percentage,
   isConnected,
+  logs = [],
+  agentStatus,
 }: ProgressDashboardProps) {
+  const thought = useMemo(() => getLatestThought(logs), [logs])
+  const [displayedThought, setDisplayedThought] = useState<string | null>(null)
+  const [textVisible, setTextVisible] = useState(true)
+
+  const lastLogTimestamp = logs.length > 0
+    ? new Date(logs[logs.length - 1].timestamp).getTime()
+    : 0
+
+  const showThought = useMemo(() => {
+    if (!thought) return false
+    if (agentStatus === 'running') return true
+    if (agentStatus === 'paused') {
+      return Date.now() - lastLogTimestamp < IDLE_TIMEOUT
+    }
+    return false
+  }, [thought, agentStatus, lastLogTimestamp])
+
+  useEffect(() => {
+    if (thought !== displayedThought && thought) {
+      setTextVisible(false)
+      const timeout = setTimeout(() => {
+        setDisplayedThought(thought)
+        setTextVisible(true)
+      }, 150)
+      return () => clearTimeout(timeout)
+    }
+  }, [thought, displayedThought])
+
+  const isRunning = agentStatus === 'running'
+
   return (
-    <div className="neo-card p-6">
-      <div className="flex items-center justify-between mb-4">
-        <h2 className="font-display text-xl font-bold uppercase">
-          Progress
-        </h2>
-        <div className="flex items-center gap-2">
-          {isConnected ? (
-            <>
-              <Wifi size={16} className="text-[var(--color-neo-done)]" />
-              <span className="text-sm text-[var(--color-neo-done)]">Live</span>
-            </>
-          ) : (
-            <>
-              <WifiOff size={16} className="text-[var(--color-neo-danger)]" />
-              <span className="text-sm text-[var(--color-neo-danger)]">Offline</span>
-            </>
-          )}
+    <Card>
+      <CardHeader className="flex-row items-center justify-between space-y-0 pb-0">
+        <div className="flex items-center gap-3">
+          <CardTitle className="text-xl uppercase tracking-wide">
+            Progress
+          </CardTitle>
+          <Badge variant={isConnected ? 'default' : 'destructive'} className="gap-1">
+            {isConnected ? (
+              <>
+                <Wifi size={14} />
+                Live
+              </>
+            ) : (
+              <>
+                <WifiOff size={14} />
+                Offline
+              </>
+            )}
+          </Badge>
         </div>
-      </div>
-
-      {/* Large Percentage */}
-      <div className="text-center mb-6">
-        <span className="inline-flex items-baseline">
-          <span className="font-display text-6xl font-bold">
-            {percentage.toFixed(1)}
-          </span>
-          <span className="font-display text-3xl font-bold text-[var(--color-neo-text-secondary)]">
-            %
-          </span>
-        </span>
-      </div>
-
-      {/* Progress Bar */}
-      <div className="neo-progress mb-4">
-        <div
-          className="neo-progress-fill"
-          style={{ width: `${percentage}%` }}
-        />
-      </div>
-
-      {/* Stats */}
-      <div className="flex justify-center gap-8 text-center">
-        <div>
-          <span className="font-mono text-3xl font-bold text-[var(--color-neo-done)]">
+        <div className="flex items-baseline gap-1">
+          <span className="font-mono text-lg font-bold text-primary">
             {passing}
           </span>
-          <span className="block text-sm text-[var(--color-neo-text-secondary)] uppercase">
-            Passing
-          </span>
-        </div>
-        <div className="text-4xl text-[var(--color-neo-text-secondary)]">/</div>
-        <div>
-          <span className="font-mono text-3xl font-bold">
+          <span className="text-sm text-muted-foreground">/</span>
+          <span className="font-mono text-lg font-bold">
             {total}
           </span>
-          <span className="block text-sm text-[var(--color-neo-text-secondary)] uppercase">
-            Total
+        </div>
+      </CardHeader>
+
+      <CardContent className="pt-3 pb-3">
+        <div className="flex items-center gap-4">
+          {/* Progress Bar */}
+          <div className="h-2.5 bg-muted rounded-full overflow-hidden flex-1">
+            <div
+              className="h-full bg-primary rounded-full transition-all duration-500 ease-out"
+              style={{ width: `${percentage}%` }}
+            />
+          </div>
+          {/* Percentage */}
+          <span className="text-sm font-bold tabular-nums text-muted-foreground w-12 text-right">
+            {percentage.toFixed(1)}%
           </span>
         </div>
-      </div>
-    </div>
+
+        {/* Agent Thought */}
+        <div
+          className={`
+            transition-all duration-300 ease-out overflow-hidden
+            ${showThought && displayedThought ? 'opacity-100 max-h-10 mt-3' : 'opacity-0 max-h-0 mt-0'}
+          `}
+        >
+          <div className="flex items-center gap-2">
+            <div className="relative shrink-0">
+              <Brain size={16} className="text-primary" strokeWidth={2.5} />
+              {isRunning && (
+                <Sparkles size={8} className="absolute -top-1 -right-1 text-yellow-500 animate-pulse" />
+              )}
+            </div>
+            <p
+              className="font-mono text-sm truncate text-muted-foreground transition-all duration-150 ease-out"
+              style={{
+                opacity: textVisible ? 1 : 0,
+                transform: textVisible ? 'translateY(0)' : 'translateY(-4px)',
+              }}
+            >
+              {displayedThought?.replace(/:$/, '')}
+            </p>
+          </div>
+        </div>
+      </CardContent>
+    </Card>
   )
 }

ui/src/components/ProjectSelector.tsx

@@ -4,6 +4,15 @@ import type { ProjectSummary } from '../lib/types'
 import { NewProjectModal } from './NewProjectModal'
 import { ConfirmDialog } from './ConfirmDialog'
 import { useDeleteProject } from '../hooks/useProjects'
+import { Button } from '@/components/ui/button'
+import { Badge } from '@/components/ui/badge'
+import {
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuSeparator,
+  DropdownMenuTrigger,
+} from '@/components/ui/dropdown-menu'
 
 interface ProjectSelectorProps {
   projects: ProjectSummary[]
@@ -32,8 +41,8 @@ export function ProjectSelector({
   }
 
   const handleDeleteClick = (e: React.MouseEvent, projectName: string) => {
-    // Prevent the click from selecting the project
     e.stopPropagation()
+    e.preventDefault()
     setProjectToDelete(projectName)
   }
 
@@ -42,13 +51,11 @@ export function ProjectSelector({
 
     try {
       await deleteProject.mutateAsync(projectToDelete)
-      // If the deleted project was selected, clear the selection
       if (selectedProject === projectToDelete) {
         onSelectProject(null)
       }
       setProjectToDelete(null)
     } catch (error) {
-      // Error is handled by the mutation, just close the dialog
       console.error('Failed to delete project:', error)
       setProjectToDelete(null)
     }
@@ -62,106 +69,86 @@ export function ProjectSelector({
 
   return (
     <div className="relative">
-      {/* Dropdown Trigger */}
-      <button
-        onClick={() => setIsOpen(!isOpen)}
-        className="neo-btn bg-[var(--color-neo-card)] text-[var(--color-neo-text)] min-w-[200px] justify-between"
-        disabled={isLoading}
-      >
-        {isLoading ? (
-          <Loader2 size={18} className="animate-spin" />
-        ) : selectedProject ? (
-          <>
-            <span className="flex items-center gap-2">
-              <FolderOpen size={18} />
-              {selectedProject}
-            </span>
-            {selectedProjectData && selectedProjectData.stats.total > 0 && (
-              <span className="neo-badge bg-[var(--color-neo-done)] ml-2">
-                {selectedProjectData.stats.percentage}%
-              </span>
-            )}
-          </>
-        ) : (
-          <span className="text-[var(--color-neo-text-secondary)]">
-            Select Project
-          </span>
-        )}
-        <ChevronDown size={18} className={`transition-transform ${isOpen ? 'rotate-180' : ''}`} />
-      </button>
-
-      {/* Dropdown Menu */}
-      {isOpen && (
-        <>
-          {/* Backdrop */}
-          <div
-            className="fixed inset-0 z-40"
-            onClick={() => setIsOpen(false)}
-          />
-
-          {/* Menu */}
-          <div className="absolute top-full left-0 mt-2 w-full neo-dropdown z-50 min-w-[280px]">
-            {projects.length > 0 ? (
-              <div className="max-h-[300px] overflow-auto">
-                {projects.map(project => (
-                  <div
-                    key={project.name}
-                    className={`flex items-center ${
-                      project.name === selectedProject
-                        ? 'bg-[var(--color-neo-pending)] text-[var(--color-neo-text-on-bright)]'
-                        : ''
-                    }`}
-                  >
-                    <button
-                      onClick={() => {
-                        onSelectProject(project.name)
-                        setIsOpen(false)
-                      }}
-                      className="flex-1 neo-dropdown-item flex items-center justify-between"
-                    >
-                      <span className="flex items-center gap-2">
-                        <FolderOpen size={16} />
-                        {project.name}
-                      </span>
-                      {project.stats.total > 0 && (
-                        <span className="text-sm font-mono">
-                          {project.stats.passing}/{project.stats.total}
-                        </span>
-                      )}
-                    </button>
-                    <button
-                      onClick={(e) => handleDeleteClick(e, project.name)}
-                      className="p-2 mr-2 text-[var(--color-neo-text-secondary)] hover:text-[var(--color-neo-danger)] hover:bg-[var(--color-neo-danger)]/10 transition-colors rounded"
-                      title={`Delete ${project.name}`}
-                    >
-                      <Trash2 size={16} />
-                    </button>
-                  </div>
-                ))}
-              </div>
+      <DropdownMenu open={isOpen} onOpenChange={setIsOpen}>
+        <DropdownMenuTrigger asChild>
+          <Button
+            variant="outline"
+            className="min-w-[200px] justify-between"
+            disabled={isLoading}
+          >
+            {isLoading ? (
+              <Loader2 size={18} className="animate-spin" />
+            ) : selectedProject ? (
+              <>
+                <span className="flex items-center gap-2">
+                  <FolderOpen size={18} />
+                  {selectedProject}
+                </span>
+                {selectedProjectData && selectedProjectData.stats.total > 0 && (
+                  <Badge className="ml-2">{selectedProjectData.stats.percentage}%</Badge>
+                )}
+              </>
             ) : (
-              <div className="p-4 text-center text-[var(--color-neo-text-secondary)]">
-                No projects yet
-              </div>
+              <span className="text-muted-foreground">Select Project</span>
             )}
+            <ChevronDown size={18} className={`transition-transform ${isOpen ? 'rotate-180' : ''}`} />
+          </Button>
+        </DropdownMenuTrigger>
 
-            {/* Divider */}
-            <div className="border-t-3 border-[var(--color-neo-border)]" />
+        <DropdownMenuContent align="start" className="w-[280px] p-0 flex flex-col">
+          {projects.length > 0 ? (
+            <div className="max-h-[300px] overflow-y-auto p-1">
+              {projects.map(project => (
+                <DropdownMenuItem
+                  key={project.name}
+                  className={`flex items-center justify-between cursor-pointer ${
+                    project.name === selectedProject ? 'bg-primary/10' : ''
+                  }`}
+                  onSelect={() => {
+                    onSelectProject(project.name)
+                  }}
+                >
+                  <span className="flex items-center gap-2 flex-1">
+                    <FolderOpen size={16} />
+                    {project.name}
+                    {project.stats.total > 0 && (
+                      <span className="text-sm font-mono text-muted-foreground ml-auto">
+                        {project.stats.passing}/{project.stats.total}
+                      </span>
+                    )}
+                  </span>
+                  <Button
+                    variant="ghost"
+                    size="icon-xs"
+                    onClick={(e: React.MouseEvent) => handleDeleteClick(e, project.name)}
+                    className="text-muted-foreground hover:text-destructive"
+                  >
+                    <Trash2 size={14} />
+                  </Button>
+                </DropdownMenuItem>
+              ))}
+            </div>
+          ) : (
+            <div className="p-4 text-center text-muted-foreground">
+              No projects yet
+            </div>
+          )}
 
-            {/* Create New */}
-            <button
-              onClick={() => {
+          <DropdownMenuSeparator className="my-0" />
+
+          <div className="p-1">
+            <DropdownMenuItem
+              onSelect={() => {
                 setShowNewProjectModal(true)
-                setIsOpen(false)
               }}
-              className="w-full neo-dropdown-item flex items-center gap-2 font-bold"
+              className="cursor-pointer font-semibold"
             >
               <Plus size={16} />
               New Project
-            </button>
+            </DropdownMenuItem>
           </div>
-        </>
-      )}
+        </DropdownMenuContent>
+      </DropdownMenu>
 
       {/* New Project Modal */}
       <NewProjectModal

ui/src/components/ProjectSetupRequired.tsx

@@ -0,0 +1,90 @@
+import { Sparkles, FileEdit, FolderOpen } from 'lucide-react'
+import { Button } from '@/components/ui/button'
+import { Card, CardContent, CardDescription, CardHeader, CardTitle } from '@/components/ui/card'
+
+interface ProjectSetupRequiredProps {
+  projectName: string
+  projectPath?: string
+  onCreateWithClaude: () => void
+  onEditManually: () => void
+}
+
+export function ProjectSetupRequired({
+  projectName,
+  projectPath,
+  onCreateWithClaude,
+  onEditManually,
+}: ProjectSetupRequiredProps) {
+  return (
+    <div className="max-w-2xl mx-auto mt-8">
+      <Card className="border-2">
+        <CardHeader className="text-center">
+          <CardTitle className="text-2xl font-display">
+            Project Setup Required
+          </CardTitle>
+          <CardDescription className="text-base">
+            <span className="font-semibold">{projectName}</span> needs an app spec to get started
+          </CardDescription>
+          {projectPath && (
+            <div className="flex items-center justify-center gap-2 text-sm text-muted-foreground mt-2">
+              <FolderOpen size={14} />
+              <code className="bg-muted px-2 py-0.5 rounded text-xs">{projectPath}</code>
+            </div>
+          )}
+        </CardHeader>
+        <CardContent className="space-y-4">
+          <p className="text-center text-muted-foreground">
+            Choose how you want to create your app specification:
+          </p>
+
+          <div className="grid gap-4 md:grid-cols-2">
+            {/* Create with Claude Option */}
+            <Card
+              className="cursor-pointer border-2 transition-all hover:border-primary hover:shadow-md"
+              onClick={onCreateWithClaude}
+            >
+              <CardContent className="pt-6 text-center space-y-3">
+                <div className="w-12 h-12 mx-auto bg-primary/10 rounded-full flex items-center justify-center">
+                  <Sparkles className="text-primary" size={24} />
+                </div>
+                <h3 className="font-semibold text-lg">Create with Claude</h3>
+                <p className="text-sm text-muted-foreground">
+                  Describe your app idea and Claude will help create a detailed specification
+                </p>
+                <Button className="w-full">
+                  <Sparkles size={16} className="mr-2" />
+                  Start Chat
+                </Button>
+              </CardContent>
+            </Card>
+
+            {/* Edit Manually Option */}
+            <Card
+              className="cursor-pointer border-2 transition-all hover:border-primary hover:shadow-md"
+              onClick={onEditManually}
+            >
+              <CardContent className="pt-6 text-center space-y-3">
+                <div className="w-12 h-12 mx-auto bg-muted rounded-full flex items-center justify-center">
+                  <FileEdit className="text-muted-foreground" size={24} />
+                </div>
+                <h3 className="font-semibold text-lg">Edit Templates Manually</h3>
+                <p className="text-sm text-muted-foreground">
+                  Create the prompts directory and edit template files yourself
+                </p>
+                <Button variant="outline" className="w-full">
+                  <FileEdit size={16} className="mr-2" />
+                  View Templates
+                </Button>
+              </CardContent>
+            </Card>
+          </div>
+
+          <p className="text-center text-xs text-muted-foreground pt-4">
+            The app spec tells the agent what to build. It includes the application name,
+            description, tech stack, and feature requirements.
+          </p>
+        </CardContent>
+      </Card>
+    </div>
+  )
+}

ui/src/components/QuestionOptions.tsx

@@ -2,12 +2,16 @@
  * Question Options Component
  *
  * Renders structured questions from AskUserQuestion tool.
- * Shows clickable option buttons in neobrutalism style.
+ * Shows clickable option buttons.
  */
 
 import { useState } from 'react'
 import { Check } from 'lucide-react'
 import type { SpecQuestion } from '../lib/types'
+import { Button } from '@/components/ui/button'
+import { Input } from '@/components/ui/input'
+import { Card, CardContent } from '@/components/ui/card'
+import { Badge } from '@/components/ui/badge'
 
 interface QuestionOptionsProps {
   questions: SpecQuestion[]
@@ -91,165 +95,126 @@ export function QuestionOptions({
   return (
     <div className="space-y-6 p-4">
       {questions.map((q, questionIdx) => (
-        <div
-          key={questionIdx}
-          className="neo-card p-4 bg-[var(--color-neo-card)]"
-        >
-          {/* Question header */}
-          <div className="flex items-center gap-3 mb-4">
-            <span className="neo-badge bg-[var(--color-neo-accent)] text-[var(--color-neo-text-on-bright)]">
-              {q.header}
-            </span>
-            <span className="font-bold text-[var(--color-neo-text)]">
-              {q.question}
-            </span>
-            {q.multiSelect && (
-              <span className="text-xs text-[var(--color-neo-text-secondary)] font-mono">
-                (select multiple)
+        <Card key={questionIdx}>
+          <CardContent className="p-4">
+            {/* Question header */}
+            <div className="flex items-center gap-3 mb-4">
+              <Badge>{q.header}</Badge>
+              <span className="font-bold text-foreground">
+                {q.question}
               </span>
-            )}
-          </div>
-
-          {/* Options grid */}
-          <div className="grid grid-cols-1 md:grid-cols-2 gap-3">
-            {q.options.map((opt, optIdx) => {
-              const isSelected = isOptionSelected(questionIdx, opt.label, q.multiSelect)
-
-              return (
-                <button
-                  key={optIdx}
-                  onClick={() => handleOptionClick(questionIdx, opt.label, q.multiSelect)}
-                  disabled={disabled}
-                  className={`
-                    text-left p-4
-                    border-3 border-[var(--color-neo-border)]
-                    transition-all duration-150
-                    ${
-                      isSelected
-                        ? 'bg-[var(--color-neo-pending)] translate-x-[1px] translate-y-[1px]'
-                        : 'bg-[var(--color-neo-card)] hover:translate-x-[-1px] hover:translate-y-[-1px]'
-                    }
-                    disabled:opacity-50 disabled:cursor-not-allowed
-                  `}
-                  style={{
-                    boxShadow: isSelected ? 'var(--shadow-neo-sm)' : 'var(--shadow-neo-md)',
-                  }}
-                  onMouseEnter={(e) => {
-                    if (!isSelected && !disabled) {
-                      e.currentTarget.style.boxShadow = 'var(--shadow-neo-lg)'
-                    }
-                  }}
-                  onMouseLeave={(e) => {
-                    if (!isSelected && !disabled) {
-                      e.currentTarget.style.boxShadow = 'var(--shadow-neo-md)'
-                    }
-                  }}
-                >
-                  <div className="flex items-start gap-2">
-                    {/* Checkbox/Radio indicator */}
-                    <div
-                      className={`
-                        w-5 h-5 flex-shrink-0 mt-0.5
-                        border-2 border-[var(--color-neo-border)]
-                        flex items-center justify-center
-                        ${q.multiSelect ? '' : 'rounded-full'}
-                        ${isSelected ? 'bg-[var(--color-neo-done)]' : 'bg-[var(--color-neo-card)]'}
-                      `}
-                    >
-                      {isSelected && <Check size={12} strokeWidth={3} />}
-                    </div>
-
-                    <div className="flex-1">
-                      <div className="font-bold text-[var(--color-neo-text)]">
-                        {opt.label}
-                      </div>
-                      <div className="text-sm text-[var(--color-neo-text-secondary)] mt-1">
-                        {opt.description}
-                      </div>
-                    </div>
-                  </div>
-                </button>
-              )
-            })}
-
-            {/* "Other" option */}
-            <button
-              onClick={() => handleOptionClick(questionIdx, 'Other', q.multiSelect)}
-              disabled={disabled}
-              className={`
-                text-left p-4
-                border-3 border-[var(--color-neo-border)]
-                transition-all duration-150
-                ${
-                  showCustomInput[String(questionIdx)]
-                    ? 'bg-[var(--color-neo-pending)] translate-x-[1px] translate-y-[1px]'
-                    : 'bg-[var(--color-neo-card)] hover:translate-x-[-1px] hover:translate-y-[-1px]'
-                }
-                disabled:opacity-50 disabled:cursor-not-allowed
-              `}
-              style={{
-                boxShadow: showCustomInput[String(questionIdx)] ? 'var(--shadow-neo-sm)' : 'var(--shadow-neo-md)',
-              }}
-              onMouseEnter={(e) => {
-                if (!showCustomInput[String(questionIdx)] && !disabled) {
-                  e.currentTarget.style.boxShadow = 'var(--shadow-neo-lg)'
-                }
-              }}
-              onMouseLeave={(e) => {
-                if (!showCustomInput[String(questionIdx)] && !disabled) {
-                  e.currentTarget.style.boxShadow = 'var(--shadow-neo-md)'
-                }
-              }}
-            >
-              <div className="flex items-start gap-2">
-                <div
-                  className={`
-                    w-5 h-5 flex-shrink-0 mt-0.5
-                    border-2 border-[var(--color-neo-border)]
-                    flex items-center justify-center
-                    ${q.multiSelect ? '' : 'rounded-full'}
-                    ${showCustomInput[String(questionIdx)] ? 'bg-[var(--color-neo-done)]' : 'bg-[var(--color-neo-card)]'}
-                  `}
-                >
-                  {showCustomInput[String(questionIdx)] && <Check size={12} strokeWidth={3} />}
-                </div>
-
-                <div className="flex-1">
-                  <div className="font-bold text-[var(--color-neo-text)]">Other</div>
-                  <div className="text-sm text-[var(--color-neo-text-secondary)] mt-1">
-                    Provide a custom answer
-                  </div>
-                </div>
-              </div>
-            </button>
-          </div>
-
-          {/* Custom input field */}
-          {showCustomInput[String(questionIdx)] && (
-            <div className="mt-4">
-              <input
-                type="text"
-                value={customInputs[String(questionIdx)] || ''}
-                onChange={(e) => handleCustomInputChange(questionIdx, e.target.value)}
-                placeholder="Type your answer..."
-                className="neo-input"
-                autoFocus
-                disabled={disabled}
-              />
+              {q.multiSelect && (
+                <span className="text-xs text-muted-foreground font-mono">
+                  (select multiple)
+                </span>
+              )}
             </div>
-          )}
-        </div>
+
+            {/* Options grid */}
+            <div className="grid grid-cols-1 md:grid-cols-2 gap-3">
+              {q.options.map((opt, optIdx) => {
+                const isSelected = isOptionSelected(questionIdx, opt.label, q.multiSelect)
+
+                return (
+                  <button
+                    key={optIdx}
+                    onClick={() => handleOptionClick(questionIdx, opt.label, q.multiSelect)}
+                    disabled={disabled}
+                    className={`
+                      text-left p-4 rounded-lg border-2 transition-all duration-150
+                      ${
+                        isSelected
+                          ? 'bg-primary/10 border-primary'
+                          : 'bg-card border-border hover:border-primary/50 hover:bg-muted'
+                      }
+                      disabled:opacity-50 disabled:cursor-not-allowed
+                    `}
+                  >
+                    <div className="flex items-start gap-2">
+                      {/* Checkbox/Radio indicator */}
+                      <div
+                        className={`
+                          w-5 h-5 flex-shrink-0 mt-0.5 border-2 flex items-center justify-center
+                          ${q.multiSelect ? 'rounded' : 'rounded-full'}
+                          ${isSelected ? 'bg-primary border-primary text-primary-foreground' : 'border-border bg-background'}
+                        `}
+                      >
+                        {isSelected && <Check size={12} strokeWidth={3} />}
+                      </div>
+
+                      <div className="flex-1">
+                        <div className="font-bold text-foreground">
+                          {opt.label}
+                        </div>
+                        <div className="text-sm text-muted-foreground mt-1">
+                          {opt.description}
+                        </div>
+                      </div>
+                    </div>
+                  </button>
+                )
+              })}
+
+              {/* "Other" option */}
+              <button
+                onClick={() => handleOptionClick(questionIdx, 'Other', q.multiSelect)}
+                disabled={disabled}
+                className={`
+                  text-left p-4 rounded-lg border-2 transition-all duration-150
+                  ${
+                    showCustomInput[String(questionIdx)]
+                      ? 'bg-primary/10 border-primary'
+                      : 'bg-card border-border hover:border-primary/50 hover:bg-muted'
+                  }
+                  disabled:opacity-50 disabled:cursor-not-allowed
+                `}
+              >
+                <div className="flex items-start gap-2">
+                  <div
+                    className={`
+                      w-5 h-5 flex-shrink-0 mt-0.5 border-2 flex items-center justify-center
+                      ${q.multiSelect ? 'rounded' : 'rounded-full'}
+                      ${showCustomInput[String(questionIdx)] ? 'bg-primary border-primary text-primary-foreground' : 'border-border bg-background'}
+                    `}
+                  >
+                    {showCustomInput[String(questionIdx)] && <Check size={12} strokeWidth={3} />}
+                  </div>
+
+                  <div className="flex-1">
+                    <div className="font-bold text-foreground">Other</div>
+                    <div className="text-sm text-muted-foreground mt-1">
+                      Provide a custom answer
+                    </div>
+                  </div>
+                </div>
+              </button>
+            </div>
+
+            {/* Custom input field */}
+            {showCustomInput[String(questionIdx)] && (
+              <div className="mt-4">
+                <Input
+                  type="text"
+                  value={customInputs[String(questionIdx)] || ''}
+                  onChange={(e) => handleCustomInputChange(questionIdx, e.target.value)}
+                  placeholder="Type your answer..."
+                  autoFocus
+                  disabled={disabled}
+                />
+              </div>
+            )}
+          </CardContent>
+        </Card>
       ))}
 
       {/* Submit button */}
       <div className="flex justify-end">
-        <button
+        <Button
           onClick={handleSubmit}
           disabled={disabled || !allQuestionsAnswered}
-          className="neo-btn neo-btn-primary"
         >
           Continue
-        </button>
+        </Button>
       </div>
     </div>
   )

ui/src/components/ResetProjectModal.tsx

@@ -0,0 +1,194 @@
+import { useState } from 'react'
+import { Loader2, AlertTriangle, RotateCcw, Trash2, Check, X } from 'lucide-react'
+import { useResetProject } from '../hooks/useProjects'
+import {
+  Dialog,
+  DialogContent,
+  DialogHeader,
+  DialogTitle,
+  DialogDescription,
+  DialogFooter,
+} from '@/components/ui/dialog'
+import { Button } from '@/components/ui/button'
+import { Alert, AlertDescription } from '@/components/ui/alert'
+
+interface ResetProjectModalProps {
+  isOpen: boolean
+  projectName: string
+  onClose: () => void
+  onResetComplete?: (wasFullReset: boolean) => void
+}
+
+export function ResetProjectModal({
+  isOpen,
+  projectName,
+  onClose,
+  onResetComplete,
+}: ResetProjectModalProps) {
+  const [resetType, setResetType] = useState<'quick' | 'full'>('quick')
+  const resetProject = useResetProject(projectName)
+
+  const handleReset = async () => {
+    const isFullReset = resetType === 'full'
+    try {
+      await resetProject.mutateAsync(isFullReset)
+      onResetComplete?.(isFullReset)
+      onClose()
+    } catch {
+      // Error is handled by the mutation state
+    }
+  }
+
+  const handleClose = () => {
+    if (!resetProject.isPending) {
+      resetProject.reset()
+      setResetType('quick')
+      onClose()
+    }
+  }
+
+  return (
+    <Dialog open={isOpen} onOpenChange={(open) => !open && handleClose()}>
+      <DialogContent className="sm:max-w-md">
+        <DialogHeader>
+          <DialogTitle className="flex items-center gap-2">
+            <RotateCcw size={20} />
+            Reset Project
+          </DialogTitle>
+          <DialogDescription>
+            Reset <span className="font-semibold">{projectName}</span> to start fresh
+          </DialogDescription>
+        </DialogHeader>
+
+        <div className="space-y-4 py-4">
+          {/* Reset Type Toggle */}
+          <div className="flex rounded-lg border-2 border-border overflow-hidden">
+            <button
+              onClick={() => setResetType('quick')}
+              disabled={resetProject.isPending}
+              className={`flex-1 py-3 px-4 text-sm font-medium transition-colors flex items-center justify-center gap-2 ${
+                resetType === 'quick'
+                  ? 'bg-primary text-primary-foreground'
+                  : 'bg-background text-foreground hover:bg-muted'
+              } ${resetProject.isPending ? 'opacity-50 cursor-not-allowed' : ''}`}
+            >
+              <RotateCcw size={16} />
+              Quick Reset
+            </button>
+            <button
+              onClick={() => setResetType('full')}
+              disabled={resetProject.isPending}
+              className={`flex-1 py-3 px-4 text-sm font-medium transition-colors flex items-center justify-center gap-2 ${
+                resetType === 'full'
+                  ? 'bg-destructive text-destructive-foreground'
+                  : 'bg-background text-foreground hover:bg-muted'
+              } ${resetProject.isPending ? 'opacity-50 cursor-not-allowed' : ''}`}
+            >
+              <Trash2 size={16} />
+              Full Reset
+            </button>
+          </div>
+
+          {/* Warning Box */}
+          <Alert variant={resetType === 'full' ? 'destructive' : 'default'} className="border-2">
+            <AlertTriangle className="h-4 w-4" />
+            <AlertDescription>
+              <div className="font-semibold mb-2">
+                {resetType === 'quick' ? 'What will be deleted:' : 'What will be deleted:'}
+              </div>
+              <ul className="list-none space-y-1 text-sm">
+                <li className="flex items-center gap-2">
+                  <X size={14} className="text-destructive" />
+                  All features and progress
+                </li>
+                <li className="flex items-center gap-2">
+                  <X size={14} className="text-destructive" />
+                  Assistant chat history
+                </li>
+                <li className="flex items-center gap-2">
+                  <X size={14} className="text-destructive" />
+                  Agent settings
+                </li>
+                {resetType === 'full' && (
+                  <li className="flex items-center gap-2">
+                    <X size={14} className="text-destructive" />
+                    App spec and prompts
+                  </li>
+                )}
+              </ul>
+            </AlertDescription>
+          </Alert>
+
+          {/* What will be preserved */}
+          <div className="bg-muted/50 rounded-lg border-2 border-border p-3">
+            <div className="font-semibold mb-2 text-sm">
+              {resetType === 'quick' ? 'What will be preserved:' : 'What will be preserved:'}
+            </div>
+            <ul className="list-none space-y-1 text-sm text-muted-foreground">
+              {resetType === 'quick' ? (
+                <>
+                  <li className="flex items-center gap-2">
+                    <Check size={14} className="text-green-600" />
+                    App spec and prompts
+                  </li>
+                  <li className="flex items-center gap-2">
+                    <Check size={14} className="text-green-600" />
+                    Project code and files
+                  </li>
+                </>
+              ) : (
+                <>
+                  <li className="flex items-center gap-2">
+                    <Check size={14} className="text-green-600" />
+                    Project code and files
+                  </li>
+                  <li className="flex items-center gap-2 text-muted-foreground/70">
+                    <AlertTriangle size={14} />
+                    Setup wizard will appear
+                  </li>
+                </>
+              )}
+            </ul>
+          </div>
+
+          {/* Error Message */}
+          {resetProject.isError && (
+            <Alert variant="destructive">
+              <AlertDescription>
+                {resetProject.error instanceof Error
+                  ? resetProject.error.message
+                  : 'Failed to reset project. Please try again.'}
+              </AlertDescription>
+            </Alert>
+          )}
+        </div>
+
+        <DialogFooter className="gap-2">
+          <Button
+            variant="outline"
+            onClick={handleClose}
+            disabled={resetProject.isPending}
+          >
+            Cancel
+          </Button>
+          <Button
+            variant={resetType === 'full' ? 'destructive' : 'default'}
+            onClick={handleReset}
+            disabled={resetProject.isPending}
+          >
+            {resetProject.isPending ? (
+              <>
+                <Loader2 className="animate-spin mr-2" size={16} />
+                Resetting...
+              </>
+            ) : (
+              <>
+                {resetType === 'quick' ? 'Quick Reset' : 'Full Reset'}
+              </>
+            )}
+          </Button>
+        </DialogFooter>
+      </DialogContent>
+    </Dialog>
+  )
+}

ui/src/components/ScheduleModal.tsx

@@ -2,11 +2,10 @@
  * Schedule Modal Component
  *
  * Modal for managing agent schedules (create, edit, delete).
- * Follows neobrutalism design patterns from SettingsModal.
  */
 
 import { useState, useEffect, useRef } from 'react'
-import { Clock, GitBranch, Trash2, X } from 'lucide-react'
+import { Clock, GitBranch, Trash2 } from 'lucide-react'
 import {
   useSchedules,
   useCreateSchedule,
@@ -23,6 +22,20 @@ import {
   toggleDay,
 } from '../lib/timeUtils'
 import type { ScheduleCreate } from '../lib/types'
+import {
+  Dialog,
+  DialogContent,
+  DialogHeader,
+  DialogTitle,
+  DialogFooter,
+} from '@/components/ui/dialog'
+import { Button } from '@/components/ui/button'
+import { Input } from '@/components/ui/input'
+import { Label } from '@/components/ui/label'
+import { Alert, AlertDescription } from '@/components/ui/alert'
+import { Card, CardContent } from '@/components/ui/card'
+import { Checkbox } from '@/components/ui/checkbox'
+import { Separator } from '@/components/ui/separator'
 
 interface ScheduleModalProps {
   projectName: string
@@ -60,38 +73,6 @@ export function ScheduleModal({ projectName, isOpen, onClose }: ScheduleModalPro
     }
   }, [isOpen])
 
-  // Keyboard navigation
-  useEffect(() => {
-    const handleKeyDown = (e: KeyboardEvent) => {
-      if (!isOpen) return
-
-      if (e.key === 'Escape') {
-        onClose()
-      }
-
-      if (e.key === 'Tab' && modalRef.current) {
-        const focusableElements = modalRef.current.querySelectorAll<HTMLElement>(
-          'button, input, select, textarea, [tabindex]:not([tabindex="-1"])'
-        )
-        const firstElement = focusableElements[0]
-        const lastElement = focusableElements[focusableElements.length - 1]
-
-        if (e.shiftKey && document.activeElement === firstElement) {
-          e.preventDefault()
-          lastElement?.focus()
-        } else if (!e.shiftKey && document.activeElement === lastElement) {
-          e.preventDefault()
-          firstElement?.focus()
-        }
-      }
-    }
-
-    document.addEventListener('keydown', handleKeyDown)
-    return () => document.removeEventListener('keydown', handleKeyDown)
-  }, [isOpen, onClose])
-
-  if (!isOpen) return null
-
   const schedules = schedulesData?.schedules || []
 
   const handleCreateSchedule = async () => {
@@ -114,8 +95,6 @@ export function ScheduleModal({ projectName, isOpen, onClose }: ScheduleModalPro
       const { time: utcTime, dayShift } = localToUTCWithDayShift(newSchedule.start_time)
 
       // Adjust days_of_week based on day shift
-      // If UTC is on the next day (dayShift = 1), shift days forward
-      // If UTC is on the previous day (dayShift = -1), shift days backward
       const adjustedDays = adjustDaysForDayShift(newSchedule.days_of_week, dayShift)
 
       const scheduleToCreate = {
@@ -169,287 +148,256 @@ export function ScheduleModal({ projectName, isOpen, onClose }: ScheduleModalPro
   }
 
   return (
-    <div
-      className="neo-modal-backdrop"
-      onClick={(e) => {
-        if (e.target === e.currentTarget) {
-          onClose()
-        }
-      }}
-    >
-      <div ref={modalRef} className="neo-modal p-6" style={{ maxWidth: '650px', maxHeight: '80vh' }}>
+    <Dialog open={isOpen} onOpenChange={(open) => !open && onClose()}>
+      <DialogContent ref={modalRef} className="sm:max-w-[650px] max-h-[80vh] flex flex-col p-0">
         {/* Header */}
-        <div className="flex items-center justify-between mb-6">
-          <div className="flex items-center gap-2">
-            <Clock size={24} className="text-[var(--color-neo-progress)]" />
-            <h2 className="text-xl font-bold text-gray-900 dark:text-white">Agent Schedules</h2>
-          </div>
-          <button
-            ref={firstFocusableRef}
-            onClick={onClose}
-            className="neo-btn neo-btn-ghost p-2"
-            aria-label="Close modal"
-          >
-            <X size={20} />
-          </button>
-        </div>
+        <DialogHeader className="p-6 pb-4">
+          <DialogTitle className="flex items-center gap-2">
+            <Clock size={24} className="text-primary" />
+            Agent Schedules
+          </DialogTitle>
+        </DialogHeader>
 
-        {/* Error display */}
-        {error && (
-          <div className="mb-4 p-3 border-2 border-red-500 bg-red-50 dark:bg-red-900/20 text-red-800 dark:text-red-200 rounded">
-            {error}
-          </div>
-        )}
+        <div className="flex-1 min-h-0 overflow-y-auto px-6">
+          {/* Error display */}
+          {error && (
+            <Alert variant="destructive" className="mb-4">
+              <AlertDescription>{error}</AlertDescription>
+            </Alert>
+          )}
 
-        {/* Loading state */}
-        {isLoading && (
-          <div className="text-center py-8 text-gray-600 dark:text-gray-300">
-            Loading schedules...
-          </div>
-        )}
-
-        {/* Existing schedules */}
-        {!isLoading && schedules.length > 0 && (
-          <div className="space-y-3 mb-6 max-h-[300px] overflow-y-auto">
-            {schedules.map((schedule) => {
-              // Convert UTC time to local and get day shift for display
-              const { time: localTime, dayShift } = utcToLocalWithDayShift(schedule.start_time)
-              const duration = formatDuration(schedule.duration_minutes)
-              // Adjust displayed days: if local is next day (dayShift=1), shift forward
-              // if local is prev day (dayShift=-1), shift backward
-              const displayDays = adjustDaysForDayShift(schedule.days_of_week, dayShift)
-
-              return (
-                <div
-                  key={schedule.id}
-                  className="neo-card p-4 flex items-start justify-between gap-4"
-                >
-                  <div className="flex-1">
-                    {/* Time and duration */}
-                    <div className="flex items-baseline gap-2 mb-2">
-                      <span className="text-lg font-bold text-gray-900 dark:text-white">{localTime}</span>
-                      <span className="text-sm text-gray-600 dark:text-gray-300">
-                        for {duration}
-                      </span>
-                    </div>
-
-                    {/* Days */}
-                    <div className="flex gap-1 mb-2">
-                      {DAYS.map((day) => {
-                        const isActive = isDayActive(displayDays, day.bit)
-                        return (
-                          <span
-                            key={day.label}
-                            className={`text-xs px-2 py-1 rounded border-2 ${
-                              isActive
-                                ? 'border-[var(--color-neo-progress)] bg-[var(--color-neo-progress)] text-white font-bold'
-                                : 'border-gray-300 dark:border-gray-600 text-gray-400 dark:text-gray-500'
-                            }`}
-                          >
-                            {day.label}
-                          </span>
-                        )
-                      })}
-                    </div>
-
-                    {/* Metadata */}
-                    <div className="flex gap-3 text-xs text-gray-600 dark:text-gray-300">
-                      {schedule.yolo_mode && (
-                        <span className="font-bold text-yellow-600">⚡ YOLO mode</span>
-                      )}
-                      <span className="flex items-center gap-1">
-                        <GitBranch size={12} />
-                        {schedule.max_concurrency}x
-                      </span>
-                      {schedule.model && <span>Model: {schedule.model}</span>}
-                      {schedule.crash_count > 0 && (
-                        <span className="text-red-600">Crashes: {schedule.crash_count}</span>
-                      )}
-                    </div>
-                  </div>
-
-                  {/* Actions */}
-                  <div className="flex items-center gap-2">
-                    {/* Enable/disable toggle */}
-                    <button
-                      onClick={() => handleToggleSchedule(schedule.id, schedule.enabled)}
-                      className={`neo-btn neo-btn-ghost px-3 py-1 text-xs font-bold ${
-                        schedule.enabled
-                          ? 'text-[var(--color-neo-done)]'
-                          : 'text-[var(--color-neo-text-secondary)]'
-                      }`}
-                      disabled={toggleSchedule.isPending}
-                    >
-                      {schedule.enabled ? 'Enabled' : 'Disabled'}
-                    </button>
-
-                    {/* Delete button */}
-                    <button
-                      onClick={() => handleDeleteSchedule(schedule.id)}
-                      className="neo-btn neo-btn-ghost p-2 text-red-600 hover:bg-red-50"
-                      disabled={deleteSchedule.isPending}
-                      aria-label="Delete schedule"
-                    >
-                      <Trash2 size={16} />
-                    </button>
-                  </div>
-                </div>
-              )
-            })}
-          </div>
-        )}
-
-        {/* Empty state */}
-        {!isLoading && schedules.length === 0 && (
-          <div className="text-center py-6 text-gray-600 dark:text-gray-300 mb-6">
-            <Clock size={48} className="mx-auto mb-2 opacity-50 text-gray-400 dark:text-gray-500" />
-            <p>No schedules configured yet</p>
-          </div>
-        )}
-
-        {/* Divider */}
-        <div className="border-t-2 border-gray-200 dark:border-gray-700 my-6"></div>
-
-        {/* Add new schedule form */}
-        <div>
-          <h3 className="text-lg font-bold text-gray-900 dark:text-white mb-4">Add New Schedule</h3>
-
-          {/* Time and duration */}
-          <div className="grid grid-cols-2 gap-4 mb-4">
-            <div>
-              <label className="block text-sm font-bold text-gray-700 dark:text-gray-200 mb-2">Start Time (Local)</label>
-              <input
-                type="time"
-                value={newSchedule.start_time}
-                onChange={(e) =>
-                  setNewSchedule((prev) => ({ ...prev, start_time: e.target.value }))
-                }
-                className="neo-input w-full"
-              />
+          {/* Loading state */}
+          {isLoading && (
+            <div className="text-center py-8 text-muted-foreground">
+              Loading schedules...
             </div>
-            <div>
-              <label className="block text-sm font-bold text-gray-700 dark:text-gray-200 mb-2">Duration (minutes)</label>
-              <input
-                type="number"
-                min="1"
-                max="1440"
-                value={newSchedule.duration_minutes}
-                onChange={(e) => {
-                  const parsed = parseInt(e.target.value, 10)
-                  const value = isNaN(parsed) ? 1 : Math.max(1, Math.min(1440, parsed))
-                  setNewSchedule((prev) => ({
-                    ...prev,
-                    duration_minutes: value,
-                  }))
-                }}
-                className="neo-input w-full"
-              />
-              <div className="text-xs text-gray-600 dark:text-gray-400 mt-1">
-                {formatDuration(newSchedule.duration_minutes)}
-              </div>
-            </div>
-          </div>
+          )}
+
+          {/* Existing schedules */}
+          {!isLoading && schedules.length > 0 && (
+            <div className="space-y-3 mb-6">
+              {schedules.map((schedule) => {
+                // Convert UTC time to local and get day shift for display
+                const { time: localTime, dayShift } = utcToLocalWithDayShift(schedule.start_time)
+                const duration = formatDuration(schedule.duration_minutes)
+                const displayDays = adjustDaysForDayShift(schedule.days_of_week, dayShift)
 
-          {/* Days of week */}
-          <div className="mb-4">
-            <label className="block text-sm font-bold text-gray-700 dark:text-gray-200 mb-2">Days</label>
-            <div className="flex gap-2">
-              {DAYS.map((day) => {
-                const isActive = isDayActive(newSchedule.days_of_week, day.bit)
                 return (
-                  <button
-                    key={day.label}
-                    onClick={() => handleToggleDay(day.bit)}
-                    className={`neo-btn px-3 py-2 text-sm ${
-                      isActive
-                        ? 'bg-[var(--color-neo-progress)] text-white border-[var(--color-neo-progress)]'
-                        : 'neo-btn-ghost'
-                    }`}
-                  >
-                    {day.label}
-                  </button>
+                  <Card key={schedule.id}>
+                    <CardContent className="p-4">
+                      <div className="flex items-start justify-between gap-4">
+                        <div className="flex-1">
+                          {/* Time and duration */}
+                          <div className="flex items-baseline gap-2 mb-2">
+                            <span className="text-lg font-semibold">{localTime}</span>
+                            <span className="text-sm text-muted-foreground">
+                              for {duration}
+                            </span>
+                          </div>
+
+                          {/* Days */}
+                          <div className="flex gap-1 mb-2">
+                            {DAYS.map((day) => {
+                              const isActive = isDayActive(displayDays, day.bit)
+                              return (
+                                <span
+                                  key={day.label}
+                                  className={`text-xs px-2 py-1 rounded border ${
+                                    isActive
+                                      ? 'border-primary bg-primary text-primary-foreground font-medium'
+                                      : 'border-border text-muted-foreground'
+                                  }`}
+                                >
+                                  {day.label}
+                                </span>
+                              )
+                            })}
+                          </div>
+
+                          {/* Metadata */}
+                          <div className="flex gap-3 text-xs text-muted-foreground">
+                            {schedule.yolo_mode && (
+                              <span className="font-semibold text-yellow-600">YOLO mode</span>
+                            )}
+                            <span className="flex items-center gap-1">
+                              <GitBranch size={12} />
+                              {schedule.max_concurrency}x
+                            </span>
+                            {schedule.model && <span>Model: {schedule.model}</span>}
+                            {schedule.crash_count > 0 && (
+                              <span className="text-destructive">Crashes: {schedule.crash_count}</span>
+                            )}
+                          </div>
+                        </div>
+
+                        {/* Actions */}
+                        <div className="flex items-center gap-2">
+                          {/* Enable/disable toggle */}
+                          <Button
+                            variant="ghost"
+                            size="sm"
+                            onClick={() => handleToggleSchedule(schedule.id, schedule.enabled)}
+                            disabled={toggleSchedule.isPending}
+                            className={schedule.enabled ? 'text-primary' : 'text-muted-foreground'}
+                          >
+                            {schedule.enabled ? 'Enabled' : 'Disabled'}
+                          </Button>
+
+                          {/* Delete button */}
+                          <Button
+                            variant="ghost"
+                            size="icon-sm"
+                            onClick={() => handleDeleteSchedule(schedule.id)}
+                            disabled={deleteSchedule.isPending}
+                            className="text-destructive hover:text-destructive"
+                          >
+                            <Trash2 size={16} />
+                          </Button>
+                        </div>
+                      </div>
+                    </CardContent>
+                  </Card>
                 )
               })}
             </div>
-          </div>
+          )}
 
-          {/* YOLO mode toggle */}
-          <div className="mb-4">
-            <label className="flex items-center gap-2 cursor-pointer">
-              <input
-                type="checkbox"
+          {/* Empty state */}
+          {!isLoading && schedules.length === 0 && (
+            <div className="text-center py-6 text-muted-foreground mb-6">
+              <Clock size={48} className="mx-auto mb-2 opacity-50" />
+              <p>No schedules configured yet</p>
+            </div>
+          )}
+
+          <Separator className="my-6" />
+
+          {/* Add new schedule form */}
+          <div className="pb-6">
+            <h3 className="text-lg font-semibold mb-4">Add New Schedule</h3>
+
+            {/* Time and duration */}
+            <div className="grid grid-cols-2 gap-4 mb-4">
+              <div className="space-y-2">
+                <Label>Start Time (Local)</Label>
+                <Input
+                  type="time"
+                  value={newSchedule.start_time}
+                  onChange={(e) =>
+                    setNewSchedule((prev) => ({ ...prev, start_time: e.target.value }))
+                  }
+                />
+              </div>
+              <div className="space-y-2">
+                <Label>Duration (minutes)</Label>
+                <Input
+                  type="number"
+                  min="1"
+                  max="1440"
+                  value={newSchedule.duration_minutes}
+                  onChange={(e) => {
+                    const parsed = parseInt(e.target.value, 10)
+                    const value = isNaN(parsed) ? 1 : Math.max(1, Math.min(1440, parsed))
+                    setNewSchedule((prev) => ({
+                      ...prev,
+                      duration_minutes: value,
+                    }))
+                  }}
+                />
+                <p className="text-xs text-muted-foreground">
+                  {formatDuration(newSchedule.duration_minutes)}
+                </p>
+              </div>
+            </div>
+
+            {/* Days of week */}
+            <div className="mb-4 space-y-2">
+              <Label>Days</Label>
+              <div className="flex gap-2">
+                {DAYS.map((day) => {
+                  const isActive = isDayActive(newSchedule.days_of_week, day.bit)
+                  return (
+                    <Button
+                      key={day.label}
+                      variant={isActive ? 'default' : 'outline'}
+                      size="sm"
+                      onClick={() => handleToggleDay(day.bit)}
+                    >
+                      {day.label}
+                    </Button>
+                  )
+                })}
+              </div>
+            </div>
+
+            {/* YOLO mode toggle */}
+            <div className="mb-4 flex items-center space-x-2">
+              <Checkbox
+                id="yolo-mode"
                 checked={newSchedule.yolo_mode}
-                onChange={(e) =>
-                  setNewSchedule((prev) => ({ ...prev, yolo_mode: e.target.checked }))
+                onCheckedChange={(checked: boolean | 'indeterminate') =>
+                  setNewSchedule((prev) => ({ ...prev, yolo_mode: checked === true }))
                 }
-                className="w-4 h-4"
               />
-              <span className="text-sm font-bold text-gray-700 dark:text-gray-200">YOLO Mode (skip testing)</span>
-            </label>
-          </div>
+              <Label htmlFor="yolo-mode" className="font-normal">
+                YOLO Mode (skip testing)
+              </Label>
+            </div>
 
-          {/* Concurrency slider */}
-          <div className="mb-4">
-            <label className="block text-sm font-bold text-gray-700 dark:text-gray-200 mb-2">
-              Concurrent Agents (1-5)
-            </label>
-            <div className="flex items-center gap-3">
-              <GitBranch
-                size={16}
-                className={newSchedule.max_concurrency > 1 ? 'text-[var(--color-neo-primary)]' : 'text-gray-400'}
-              />
-              <input
-                type="range"
-                min={1}
-                max={5}
-                value={newSchedule.max_concurrency}
+            {/* Concurrency slider */}
+            <div className="mb-4 space-y-2">
+              <Label>Concurrent Agents (1-5)</Label>
+              <div className="flex items-center gap-3">
+                <GitBranch
+                  size={16}
+                  className={newSchedule.max_concurrency > 1 ? 'text-primary' : 'text-muted-foreground'}
+                />
+                <input
+                  type="range"
+                  min={1}
+                  max={5}
+                  value={newSchedule.max_concurrency}
+                  onChange={(e) =>
+                    setNewSchedule((prev) => ({ ...prev, max_concurrency: Number(e.target.value) }))
+                  }
+                  className="flex-1 h-2 accent-primary cursor-pointer"
+                />
+                <span className="text-sm font-medium min-w-[2rem] text-center">
+                  {newSchedule.max_concurrency}x
+                </span>
+              </div>
+              <p className="text-xs text-muted-foreground">
+                Run {newSchedule.max_concurrency} agent{newSchedule.max_concurrency > 1 ? 's' : ''} in parallel for faster feature completion
+              </p>
+            </div>
+
+            {/* Model selection (optional) */}
+            <div className="mb-4 space-y-2">
+              <Label>Model (optional, defaults to global setting)</Label>
+              <Input
+                placeholder="e.g., claude-3-5-sonnet-20241022"
+                value={newSchedule.model || ''}
                 onChange={(e) =>
-                  setNewSchedule((prev) => ({ ...prev, max_concurrency: Number(e.target.value) }))
+                  setNewSchedule((prev) => ({ ...prev, model: e.target.value || null }))
                 }
-                className="flex-1 h-2 accent-[var(--color-neo-primary)] cursor-pointer"
-                title={`${newSchedule.max_concurrency} concurrent agent${newSchedule.max_concurrency > 1 ? 's' : ''}`}
-                aria-label="Set number of concurrent agents"
               />
-              <span className="text-sm font-bold min-w-[2rem] text-center text-gray-900 dark:text-white">
-                {newSchedule.max_concurrency}x
-              </span>
             </div>
-            <div className="text-xs text-gray-600 dark:text-gray-400 mt-1">
-              Run {newSchedule.max_concurrency} agent{newSchedule.max_concurrency > 1 ? 's' : ''} in parallel for faster feature completion
-            </div>
-          </div>
-
-          {/* Model selection (optional) */}
-          <div className="mb-6">
-            <label className="block text-sm font-bold text-gray-700 dark:text-gray-200 mb-2">
-              Model (optional, defaults to global setting)
-            </label>
-            <input
-              type="text"
-              placeholder="e.g., claude-3-5-sonnet-20241022"
-              value={newSchedule.model || ''}
-              onChange={(e) =>
-                setNewSchedule((prev) => ({ ...prev, model: e.target.value || null }))
-              }
-              className="neo-input w-full"
-            />
-          </div>
-
-          {/* Actions */}
-          <div className="flex justify-end gap-3">
-            <button onClick={onClose} className="neo-btn neo-btn-ghost">
-              Close
-            </button>
-            <button
-              onClick={handleCreateSchedule}
-              disabled={createSchedule.isPending || newSchedule.days_of_week === 0}
-              className="neo-btn neo-btn-primary"
-            >
-              {createSchedule.isPending ? 'Creating...' : 'Create Schedule'}
-            </button>
           </div>
         </div>
-      </div>
-    </div>
+
+        {/* Actions */}
+        <DialogFooter className="p-6 pt-4 border-t">
+          <Button variant="outline" onClick={onClose}>
+            Close
+          </Button>
+          <Button
+            onClick={handleCreateSchedule}
+            disabled={createSchedule.isPending || newSchedule.days_of_week === 0}
+          >
+            {createSchedule.isPending ? 'Creating...' : 'Create Schedule'}
+          </Button>
+        </DialogFooter>
+      </DialogContent>
+    </Dialog>
   )
 }