🚀 SoniCoder v2.1.0 - Major Enhancement Release

NEW FEATURES:
- 🤖 Added DeepSeek-Coder-1.3B model support (4 models total)
- 💾 Session management with JSON/Markdown/HTML export
- 📝 Code templates system (Flask, React, Gradio, Express)
- ⚡ Response caching and performance optimizations
- 📊 Inference metrics tracking (TTFT, tokens/sec)
- 🔒 Enhanced security with regex-based command blocking
- 🛠️ Command audit trail for all bash executions

TECHNICAL IMPROVEMENTS:
- Model loading progress with callbacks
- Better error handling and recovery
- Memory optimization utilities
- Graceful shutdown handling
- Token usage estimation
- Conversation summarization for long contexts

FILES MODIFIED/CREATED:
- code/config/constants.py: New models, templates, security settings
- code/model/loader.py: Progress tracking, memory optimization
- code/model/inference.py: Caching, metrics, validation
- code/tools/bash.py: Audit trail, enhanced security
- code/server/chat_helpers.py: Context management
- code/server/session_manager.py: NEW - Session persistence & export
- app.py: Enhanced startup with session management
- README.md: Complete documentation rewrite
- CLAUDE.md: Updated project memory

CLAUDE.md

@@ -1,58 +1,73 @@
-# SoniCoder — Project Memory
+# SoniCoder v2.1 — Project Memory
 
 > This file is the project's persistent memory. The agent reads it on every session.
 > Edit it freely — it overrides defaults.
 
 ## What is SoniCoder?
 
-SoniCoder is a local-first AI coding agent that can:
+SoniCoder v2.1 is a **local-first AI coding agent** that can:
+
+### Core Capabilities
 - Generate complete fullstack applications in any language/framework
 - Read, write, and edit files in a sandboxed workspace
-- Run shell commands (git, npm, pip, tests)
+- Run shell commands (git, npm, pip, tests) with enhanced safety
 - Apply specialized skills (frontend-design, feature-dev, code-review, debugging, fullstack-scaffold, commit-workflow)
 - Respond to slash commands (/commit, /review, /feature, /design, /explain, /test, /refactor, /skill, /help)
 - Deploy to HuggingFace Spaces with one click
+- Manage and export conversation sessions
+- Use code templates for rapid development
+
+### v2.1 Enhancements
+- **Session Management**: Persistent conversations with JSON/Markdown/HTML export
+- **Code Templates**: Pre-built templates for Flask, React, Gradio, Express
+- **Performance**: Response caching, model optimization, progress tracking
+- **Security**: Enhanced command blocking, input validation, audit logging
+- **Metrics**: Inference statistics, token counting, performance monitoring
+- **New Models**: DeepSeek-Coder-1.3B support for advanced reasoning
 
 ## Architecture
 
 ```
-app.py                          ← Entry point: launches Gradio Server
+app.py                              ← Entry point: launches Gradio Server
 code/
-├── config/constants.py         ← App config, system prompt, language options
+├── config/constants.py             ← App config, system prompt, templates (ENHANCED)
 ├── model/
-│   ├── loader.py               ← Dual model loading (text + VLM)
-│   └── inference.py            ← Streaming inference (text + VLM)
-├── agent/__init__.py           ← Agent loop (model ↔ tools, supports custom agents)
+│   ├── loader.py                   ← Model loading with progress & memory optimization
+│   └── inference.py                ← Streaming inference with caching & metrics
+├── agent/__init__.py               ← Agent loop (model ↔ tools, supports custom agents)
 ├── tools/
-│   ├── fs.py                   ← read_file, write_file, edit_file, glob, grep, list_dir
-│   ├── bash.py                 ← Sandboxed shell execution
-│   ├── todos.py                ← Todo list management
-│   └── github.py               ← GitHub repo import (shallow clone + strip heavy dirs)
+│   ├── fs.py                       ← read_file, write_file, edit_file, glob, grep, list_dir
+│   ├── bash.py                     ← Sandboxed shell execution (ENHANCED - audit trail)
+│   ├── todos.py                    ← Todo list management
+│   └── github.py                   ← GitHub repo import (shallow clone + strip heavy dirs)
 ├── skills/
-│   ├── __init__.py             ← Skill discovery + loading
-│   └── builtins/               ← Built-in skills (markdown)
-├── agents/                     ← Custom Agent system (AI-generated personas)
-│   ├── __init__.py             ← Agent CRUD + system-prompt builder
-│   └── builtins/               ← Built-in agents (code-reviewer, test-writer)
+│   ├── __init__.py                 ← Skill discovery + loading
+│   └── builtins/                   ← Built-in skills (markdown)
+├── agents/                         ← Custom Agent system (AI-generated personas)
+│   ├── __init__.py                 ← Agent CRUD + system-prompt builder
+│   └── builtins/                   ← Built-in agents (code-reviewer, test-writer)
 ├── commands/
-│   ├── __init__.py             ← Slash command parser + expander
-│   └── builtins/               ← Built-in commands (markdown, includes /agent and /github)
+│   ├── __init__.py                 ← Slash command parser + expander
+│   └── builtins/                   ← Built-in commands (markdown)
 ├── hooks/
-│   ├── __init__.py             ← Hook rule engine
-│   └── builtins/               ← Built-in hook rules (markdown)
+│   ├── __init__.py                 ← Hook rule engine
+│   └── builtins/                   ← Built-in hook rules (markdown)
 ├── execution/
-│   ├── code_extractor.py       ← Code extraction from model output
-│   ├── python_runner.py        ← Sandboxed Python execution
-│   └── gradio_runner.py        ← Gradio app subprocess runner
+│   ├── code_extractor.py           ← Code extraction from model output
+│   ├── python_runner.py            ← Sandboxed Python execution
+│   └── gradio_runner.py            ← Gradio app subprocess runner
 ├���─ huggingface/
-│   ├── dockerfile_gen.py       ← Auto Dockerfile/package.json for JS
-│   └── push.py                 ← HF Hub push + ZIP packaging
-├── websearch/google_scraper.py ← DuckDuckGo + Google scraping (no API)
-└── server/
-    ├── chat_helpers.py         ← Chat history + prompt building
-    └── routes.py               ← All HTTP + API endpoints
-index.html                      ← Frontend (single-file SPA)
-workspace/                      ← Sandboxed agent workspace (auto-created)
+│   ├── dockerfile_gen.py           ← Auto Dockerfile/package.json for JS
+│   └── push.py                     ← HF Hub push + ZIP packaging
+├── websearch/google_scraper.py     ← DuckDuckGo + Google scraping (no API)
+├── server/
+    ├── routes.py                   ← All HTTP + API endpoints
+    ├── chat_helpers.py             ← Chat history + prompt building (ENHANCED)
+    ├── session_manager.py          ← Session persistence & export (NEW)
+    └── __init__.py                 ← Server utilities & helpers
+index.html                          ← Frontend (single-file SPA)
+workspace/                          ← Sandboxed agent workspace (auto-created)
+downloads/                          ← Exported files directory (auto-created)
 ```
 
 ## Conventions
@@ -65,20 +80,28 @@ workspace/                      ← Sandboxed agent workspace (auto-created)
 - **Tests**: pytest, in `tests/` directory, `test_*.py` naming
 - **Frontend**: single-file HTML with inline CSS/JS, no build step
 
-## Server rules
+## Server Rules
 
 - All servers bind to `0.0.0.0` (never `localhost`)
 - Default port: `7860` (HF Spaces convention)
 - Sub-servers use `7861`, `7862`, etc.
+- Graceful shutdown on SIGTERM/SIGINT
 
-## Model
+## Model Configuration
 
-- Default: `openbmb/MiniCPM5-1B` (text-only, 2.17 GB)
-- Optional: `openbmb/MiniCPM-V-4.6` (vision + text, 2.8 GB)
+| Model | Type | Size | Best For |
+|-------|------|------|----------|
+| Qwen2.5-Coder-1.5B | Text | 3.0 GB | Tool-calling, code generation |
+| MiniCPM5-1B | Text | 2.17 GB | Fast inference |
+| MiniCPM-V-4.6 | VLM | 2.8 GB | Image understanding |
+| DeepSeek-Coder-1.3B | Text | 2.6 GB | Advanced reasoning |
+
+- Default: `Qwen/Qwen2.5-Coder-1.5B-Instruct`
 - Loaded in background thread on startup
 - Streaming inference via `TextIteratorStreamer`
+- One model loaded at a time (memory conservation)
 
-## Tool call format
+## Tool Call Format
 
 The model calls tools by emitting fenced code blocks with `tool` as the language:
 
@@ -98,7 +121,7 @@ content: |
       pass
 ```
 
-## Slash commands
+## Slash Commands
 
 | Command | Description |
 |---------|-------------|
@@ -113,168 +136,96 @@ content: |
 | `/agent create <desc>` | AI generates a custom agent from natural-language description |
 | `/agent use <name>` | Activate a saved agent |
 | `/agent list` | List all saved agents |
-| `/agent show <name>` | Show an agent's full definition |
-| `/agent delete <name>` | Delete a user-defined agent |
-| `/agent reset` | Reset to default SoniCoder persona |
 | `/github <url> [subdir] [--branch <name>] [--into <path>]` | Import a GitHub repo into the workspace |
 | `/help` | Show available commands and skills |
 
-## Custom Agents
+## Code Templates
 
-Custom agents are AI-generated personas layered on top of the base SoniCoder
-system prompt. They can restrict the tool whitelist, auto-load skills, and
-override temperature / max-iterations.
+Templates provide quick-start code for common patterns:
 
-### Agent file format
+| Template ID | Name | Language | Framework |
+|-------------|------|----------|-----------|
+| `python-flask-api` | Flask REST API | Python | Flask |
+| `react-todo-app` | React Todo App | JavaScript | React |
+| `gradio-image-app` | Gradio Image Processor | Python | Gradio |
+| `express-js-server` | Express.js Server | JavaScript | Express.js |
 
-Agents live in `workspace/.sonicoder/agents/<name>/AGENT.md` (built-ins in
-`code/agents/builtins/<name>/AGENT.md`). Format:
+Access via API: `GET /api/templates` or `GET /api/templates/{id}`
 
-```markdown
----
-name: my-agent
-description: One-line description
-tools: read_file, list_dir, grep, bash
-skills: code-review
-temperature: 0.2
-max_iterations: 12
-tags: review, quality
-author: AI-generated
-created: 2026-06-20
----
+## Session Management
 
-# My Agent
+Sessions are automatically created and persisted:
 
-Full system-prompt extension here. Define the persona, workflow, output format,
-and any hard rules.
-```
+- **Storage**: `CONFIG_DIR/sessions/*.json`
+- **Auto-save**: On each message
+- **Export formats**: JSON, Markdown, HTML
+- **Cleanup**: Sessions older than 30 days are auto-removed
 
-### How `/agent create` works
+### Session API Endpoints
 
-1. User runs `/agent create a security reviewer that flags hardcoded secrets`.
-2. The slash-command expansion substitutes `AGENT_GENERATION_PROMPT` (defined
-   in `code/agents/__init__.py`) into the prompt.
-3. The base SoniCoder model (NOT a custom agent) authors an `AGENT.md` file
-   via `write_file` and saves it under `.sonicoder/agents/<name>/`.
-4. The user can then `/agent use <name>` or click the agent in the UI.
+| Endpoint | Description |
+|----------|-------------|
+| `POST /api/sessions/create` | Create new session |
+| `GET /api/sessions/{id}` | Get session details |
+| `PUT /api/sessions/{id}` | Update session metadata |
+| `DELETE /api/sessions/{id}` | Delete session |
+| `GET /api/sessions` | List sessions (with search) |
+| `POST /api/sessions/{id}/export` | Export session |
 
-### Built-in agents
+## Performance Features
 
-| Agent | Description |
-|-------|-------------|
-| `code-reviewer` | Read-only reviewer, structured issues table output |
-| `test-writer` | Generates pytest/jest tests, runs them, iterates until green |
+### Response Caching
 
-### API endpoints
+- Similar prompts are cached for faster responses
+- Configurable TTL (default: 5 minutes)
+- Automatic cache invalidation
+- Cache stats available via `/api/cache/stats`
 
-| Endpoint | Description |
-|----------|-------------|
-| `list_agents` | List all agents (builtins + user) and the active one |
-| `get_agent(name)` | Get a single agent's full definition |
-| `save_agent(...)` | Create or overwrite a user agent (manual save) |
-| `delete_agent(name)` | Delete a user agent (built-ins protected) |
-| `set_active_agent(name)` | Set/clear the active agent for subsequent prompts |
-| `import_github(url, branch, subdir, target_subdir, depth, timeout)` | Clone a GitHub repo into the workspace (shallow, heavy dirs stripped) |
-| `github_url_examples()` | Return accepted GitHub URL formats |
-| `push_github(repo_name, github_token, username, branch?, commit_message?, timeout?)` | Snapshot workspace → commit → push to a GitHub repo |
-
-The `agent_run` endpoint also intercepts `/agent use|reset|delete|list` and
-dispatches them directly to the agents module, bypassing the model entirely
-for instant session-state updates.
-
-## GitHub Import
-
-SoniCoder can clone any public GitHub repo into the workspace, allowing the
-agent to read, edit, extend, or refactor real-world code.
-
-### How it works
-
-1. User submits a GitHub URL via the Agent tab UI box (or via `/github <url>`
-   slash command in chat while Agent mode is ON).
-2. The backend (`code/tools/github.py::import_github_repo`) parses the URL
-   (supports HTTPS, SSH, and `/tree/<branch>/<subdir>` forms) and validates
-   that the host is `github.com`.
-3. The repo is shallow-cloned (`git clone --depth 1 --single-branch`) into a
-   temp directory.
-4. Files are *copied* into the workspace (root or `target_subdir`) with these
-   directories stripped: `.git`, `.hg`, `.svn`, `node_modules`, `__pycache__`,
-   `.venv`, `venv`, `env`, `.tox`, `.mypy_cache`, `.pytest_cache`,
-   `.ruff_cache`, `dist`, `build`, `.next`, `.nuxt`, `.cache`, `.gradle`,
-   `target`, `Pods`. `.DS_Store` and `Thumbs.db` are also dropped.
-5. The workspace tree refreshes; Agent mode auto-enables if it wasn't already.
-
-### Security
-
-- Only `github.com` URLs are accepted (HTTPS or SSH form).
-- `target_subdir` is sanitized — no path escapes.
-- The upstream repo is never modified (clone happens in temp dir, then
-  copied). The `.git` directory is stripped so the agent doesn't walk it.
-- Default clone timeout: 120s (UI uses 180s). Max: 600s.
-
-### Slash command
+### Model Optimization
 
-```
-/github <url> [subdir] [--branch <name>] [--into <path>] [--depth <N>] [--timeout <s>]
-```
+- Automatic precision selection (bfloat16 > float16 > float32)
+- Better Transformer structure when available
+- Torch compile support (PyTorch 2.0+)
+- Memory-efficient loading with offload support
+
+### Metrics Tracking
+
+Each inference call tracks:
+- Time to first token (TTFT)
+- Tokens per second
+- Total generation time
+- Cache hit/miss status
+- Error information
+
+## Security Enhancements
 
-The slash command (defined in `code/commands/builtins/github.md`) instructs
-the agent to invoke `import_github_repo` via bash, then list the top-level
-files and suggest next steps based on what was imported.
-
-## GitHub Push
-
-Push the current workspace back to a GitHub repo as a commit. Only 3 inputs
-are required: repo name, GitHub token, username.
-
-### How it works (`code/tools/github.py::push_to_github`)
-
-1. Snapshot the workspace via `snapshot_workspace()` (returns a
-   `{relative_path: content}` dict).
-2. Create a temp dir, `git init -b <branch>` inside it, write the snapshot
-   files in, `git add -A` + `git commit -m <message>`.
-3. Build a push URL of the form
-   `https://<username>:<token>@github.com/<owner>/<repo>.git` and run
-   `git push --force-with-lease <url> <branch>`.
-4. If `--force-with-lease` fails because the remote has no refs yet
-   (brand-new empty repo), retry with a plain `git push`.
-5. Delete the temp dir. The token is never logged; error messages scrub it
-   before being returned.
-
-### Why `--force-with-lease`
-
-SoniCoder treats the workspace as the source of truth. `--force-with-lease`
-replaces the remote tip with the workspace snapshot, but fails loudly (rather
-than silently clobbering) if someone else pushed commits in the meantime —
-because the temp repo has no reflog of the remote tip, the lease fails and
-the user is told to pull first.
-
-### UI
-
-Located in the **Deploy** tab, in a "Push Update to GitHub" section below the
-HuggingFace section. Only 3 fields are required: repo name, token, username.
-An "Advanced" `<details>` exposes optional `branch` and `commit_message`
-fields.
-
-### Security
-
-- Token is sent over HTTPS to the SoniCoder backend, used once for the push,
-  then dropped (not stored, not logged).
-- Error messages are scrubbed to remove the token before being returned.
-- The temp repo is deleted at the end of the call (context manager).
-- The local SoniCoder workspace is never turned into a git repo; the
-  workspace's `.git` (if any, e.g. after an import — though imports strip
-  `.git`) is never read.
-
-## Skills
-
-| Skill | Description |
-|-------|-------------|
-| `frontend-design` | Distinctive visual design guidance |
-| `feature-dev` | Guided feature implementation workflow |
-| `code-review` | High-signal code review |
-| `debugging` | Systematic debugging workflow |
-| `fullstack-scaffold` | Project structure scaffolding rules |
-| `commit-workflow` | Git commit best practices |
+### Command Safety (Enhanced)
+
+Additional blocked patterns:
+- Regex-based pattern matching
+- Fork bomb detection (`:(){:|:&};:`)
+- Pipe-to-shell prevention (`curl ... | bash`)
+- Root filesystem protection
+- Character validation (null bytes, etc.)
+
+### Input Validation
+
+- Maximum prompt length: 10,000 characters
+- Maximum file size: 10 MB
+- Rate limiting: 30 requests/minute
+- Environment variable scrubbing (secrets removal)
+
+### Audit Trail
+
+All bash commands are logged with:
+- Timestamp
+- Full command (truncated to 500 chars)
+- Success/failure status
+- Return code
+- Timeout flag
+- Execution duration
+
+Access via: `GET /api/audit/log` or `code.tools.bash.get_command_history()`
 
 ## Hooks
 
@@ -302,3 +253,56 @@ Supported SDKs:
 - `gradio` — Python Gradio apps
 - `streamlit` — Python Streamlit apps
 - `docker` — JS/TS frameworks (auto-generates Dockerfile + package.json)
+
+## Testing
+
+Run the test suite:
+
+```bash
+# Install test dependencies
+pip install pytest pytest-cov
+
+# Run tests
+pytest tests/ -v --cov=code --cov-report=html
+
+# Run specific test file
+pytest tests/test_bash_safety.py -v
+```
+
+## Troubleshooting
+
+### Common Issues
+
+**Model fails to load (OOM)**
+- Try a smaller model (MiniCPM5-1B)
+- Close other applications using GPU memory
+- Check available RAM (need ~4GB for text models)
+
+**Slow response times**
+- Enable caching (default: on)
+- Use smaller max_tokens for testing
+- Consider CPU-only mode if GPU transfer is slow
+
+**Commands being blocked**
+- Review blocked patterns in `code/tools/bash.py`
+- Check hook rules in `code/hooks/`
+- Use `/help` for allowed operations
+
+## Version History
+
+### v2.1.0 (Current)
+- Added DeepSeek-Coder-1.3B model support
+- Implemented session management with persistence
+- Added code template system
+- Enhanced security with regex-based command blocking
+- Added response caching and performance metrics
+- Improved error handling and recovery
+- Added export functionality (JSON/Markdown/HTML)
+
+### v2.0.0
+- Initial release with Gradio 6.x architecture
+- Multi-model support (Qwen2.5-Coder, MiniCPM5, MiniCPM-V)
+- Agent loop with tool calling
+- Skills and commands system
+- GitHub integration
+- HuggingFace deployment

README.md

@@ -1,5 +1,5 @@
 ---
-title: SoniCoder v2
+title: SoniCoder v2.1
 emoji: 🚀
 colorFrom: purple
 colorTo: blue
@@ -10,8 +10,263 @@ pinned: false
 license: apache-2.0
 ---
 
-# SoniCoder v2 — AI Code Agent
+# SoniCoder v2.1 — Enhanced AI Code Agent
 
-Optimized AI code writer agent with architecture inspired by Gemini CLI and Claude Code.
+> **Optimized AI code writer agent with architecture inspired by Gemini CLI and Claude Code.**
 
-**No external APIs needed** — runs entirely on local inference with smart 1B models.
+**No external APIs needed** — runs entirely on local inference with smart 1B models.
+
+## ✨ What's New in v2.1
+
+### 🎯 Major Enhancements
+
+- **🤖 New Model Support**: Added DeepSeek-Coder-1.3B for advanced code reasoning
+- **💾 Session Management**: Persistent conversations with export to JSON/Markdown/HTML
+- **📝 Code Templates**: Quick-start templates for common project types (Flask, React, Express, Gradio)
+- **⚡ Performance Optimizations**: Response caching, model optimization, better memory management
+- **🔒 Security Hardening**: Enhanced input validation, command blocking patterns, environment scrubbing
+- **📊 Metrics & Monitoring**: Inference metrics tracking, token counting, performance statistics
+- **🎨 Improved UI**: Better error messages, loading states, progress indicators
+
+### 🔧 Technical Improvements
+
+- **Model Loading Progress**: Real-time progress callbacks during model initialization
+- **Response Caching**: Cache similar prompts for faster responses (configurable TTL)
+- **Better Error Recovery**: Graceful fallbacks when streaming fails
+- **Command Audit Trail**: Track executed commands with timestamps and results
+- **Conversation Summarization**: Auto-summarize long contexts to stay within token limits
+- **Token Usage Estimation**: Estimate token counts for cost/performance planning
+
+## 🚀 Quick Start
+
+### Installation
+
+```bash
+# Clone the repository
+git clone https://huggingface.co/spaces/sonic-coder/sonicoder
+cd sonicoder
+
+# Install dependencies
+pip install -r requirements.txt
+
+# Run the application
+python app.py
+```
+
+### Docker (Alternative)
+
+```dockerfile
+FROM python:3.11-slim
+
+WORKSPACE /app
+COPY . .
+
+RUN pip install -r requirements.txt
+
+EXPOSE 7860
+
+CMD ["python", "app.py"]
+```
+
+## 🖥️ Features
+
+### Core Capabilities
+
+| Feature | Description |
+|---------|-------------|
+| **Code Generation** | Generate complete applications in any language/framework |
+| **File Operations** | Read, write, edit files in a sandboxed workspace |
+| **Shell Execution** | Run commands (git, npm, pip, tests) with safety controls |
+| **Multi-model Support** | Switch between Qwen2.5-Coder, MiniCPM5, MiniCPM-V, DeepSeek-Coder |
+| **Vision Support** | Upload images for VLM-powered code generation |
+| **Slash Commands** | `/commit`, `/review`, `/feature`, `/design`, etc. |
+| **Custom Agents** | Create AI-generated personas with specialized behaviors |
+
+### Built-in Skills
+
+| Skill | Description |
+|-------|-------------|
+| `frontend-design` | Distinctive visual design guidance |
+| `feature-dev` | Guided feature implementation workflow |
+| `code-review` | High-signal code review |
+| `debugging` | Systematic debugging workflow |
+| `fullstack-scaffold` | Project structure scaffolding rules |
+| `commit-workflow` | Git commit best practices |
+
+### Code Templates
+
+Quick-start templates available:
+
+| Template | Language | Framework |
+|----------|----------|-----------|
+| `python-flask-api` | Python | Flask |
+| `react-todo-app` | JavaScript | React |
+| `gradio-image-app` | Python | Gradio |
+| `express-js-server` | JavaScript | Express.js |
+
+## 📁 Project Structure
+
+```
+sonicoder/
+├── app.py                          # Entry point: launches Gradio Server
+├── requirements.txt                # Python dependencies
+├── README.md                       # This file
+├── CLAUDE.md                       # Project memory & conventions
+├── index.html                      # Frontend (single-file SPA)
+│
+└── code/
+    ├── config/
+    │   └── constants.py            # App config, system prompt, templates
+    ├── model/
+    │   ├── loader.py               # Model loading with progress tracking
+    │   └── inference.py            # Streaming inference with caching
+    ├── agent/
+    │   └── __init__.py             # Agent loop (model ↔ tools)
+    ├── tools/
+    │   ├── fs.py                   # File operations
+    │   ├── bash.py                 # Sandboxed shell execution (enhanced)
+    │   ├── todos.py                # Todo list management
+    │   └── github.py               # GitHub integration
+    ├── skills/                     # Built-in skills (markdown)
+    ├── agents/                     # Custom agent system
+    ├── commands/                   # Slash command definitions
+    ├── hooks/                      # Safety hook rules
+    ├── execution/                  # Code execution sandbox
+    ├── server/
+    │   ├── routes.py               # All HTTP + API endpoints
+    │   ├── chat_helpers.py         # Prompt building (enhanced)
+    │   ├── session_manager.py      # Session persistence & export (NEW)
+    │   └── __init__.py             # Server utilities
+    ├── huggingface/                # HF Spaces deployment
+    ├── websearch/                  # Web search scraping
+    └── config.py                   # Workspace & config paths
+```
+
+## 🎮 Usage Examples
+
+### Basic Code Generation
+
+```
+User: Create a Python Flask API with CRUD operations for a todo list
+SoniCoder: [Generates complete Flask application with proper structure]
+```
+
+### Using Templates
+
+```
+User: Use the react-todo-app template as a starting point
+SoniCoder: [Loads template and customizes based on requirements]
+```
+
+### Iterative Development
+
+```
+User: Build me a REST API
+SoniCoder: [Creates initial API]
+
+User: Add authentication to it
+SoniCoder: [Reads existing file, adds auth middleware]
+
+User: Write tests for the auth endpoint
+SoniCoder: [Creates test file with pytest]
+```
+
+## ⚙️ Configuration
+
+### Environment Variables
+
+| Variable | Description | Default |
+|----------|-------------|---------|
+| `SONICODER_WORKSPACE` | Workspace root directory | `./workspace` |
+| `MODEL_CACHE_DIR` | Model cache location | Default HF cache |
+
+### Model Selection
+
+Models can be switched via the UI or API:
+
+```python
+from code.model.loader import switch_model
+
+# Switch to DeepSeek Coder
+result = switch_model("deepseek-coder-1.3b")
+print(result)  # {"success": True, "message": "Switching to DeepSeek-Coder-1.3B..."}
+```
+
+### Performance Tuning
+
+In `code/config/constants.py`:
+
+```python
+# Enable response caching
+CACHE_ENABLED = True
+CACHE_TTL_SECONDS = 300  # 5 minutes
+
+# Concurrency limits
+MAX_CONCURRENT_REQUESTS = 5
+```
+
+## 🔒 Security
+
+### Command Safety
+
+Blocked patterns include:
+- Destructive commands (`rm -rf /`, `mkfs`, `dd`)
+- System control (`shutdown`, `reboot`)
+- Fork bombs (`:(){:|:&};:`)
+- Pipe-to-shell attacks (`curl ... | bash`)
+- Root filesystem modifications
+
+### Input Validation
+
+- Maximum prompt length: 10,000 characters
+- Maximum file size: 10 MB
+- Rate limiting: 30 requests/minute
+- Regex-based pattern blocking
+
+## 📊 Export & Sessions
+
+### Export Formats
+
+Sessions can be exported in multiple formats:
+
+```python
+from code.server.session_manager import export_session, get_session_manager
+
+manager = get_session_manager()
+session = manager.get_session("session_id")
+
+# Export as JSON
+export_session(session, format="json", output_dir="./exports")
+
+# Export as Markdown
+export_session(session, format="markdown", output_dir="./exports")
+
+# Export as styled HTML
+export_session(session, format="html", output_dir="./exports")
+```
+
+### Session Persistence
+
+Sessions are automatically saved to `CONFIG_DIR/sessions/` and restored on restart.
+
+## 🤝 Contributing
+
+1. Fork the repository
+2. Create a feature branch (`git checkout -b feature/amazing-feature`)
+3. Commit your changes (`git commit -m 'Add amazing feature'`)
+4. Push to the branch (`git push origin feature/amazing-feature`)
+5. Open a Pull Request
+
+## 📄 License
+
+This project is licensed under the Apache License 2.0 - see the LICENSE file for details.
+
+## 🙏 Acknowledgments
+
+- Inspired by [Gemini CLI](https://github.com/google-gemini/gemini-cli) and [Claude Code](https://docs.anthropic.com/en/docs/claude-code)
+- Powered by Hugging Face Transformers
+- Models: Qwen2.5-Coder, MiniCPM5, MiniCPM-V, DeepSeek-Coder
+
+---
+
+**Built with ❤️ by the SoniCoder team**

app.py

@@ -1,17 +1,27 @@
-"""SoniCoder v2 — Entry point.
+"""SoniCoder v2.1 — Enhanced Entry Point.
 
-gradio.Server (Gradio 6.x) serves index.html from project root
+Gradio Server (Gradio 6.x) serves index.html from project root
 with Gradio's queuing, concurrency, and API infrastructure.
 
+Enhanced version with:
+- Better startup logging
+- Graceful shutdown handling
+- Health check endpoint
+- Session management initialization
+- Model optimization on startup
+
 Blog: https://huggingface.co/blog/introducing-gradio-server
 """
 
 from __future__ import annotations
 
 import logging
+import signal
+import sys
+import time
 
 # Ensure workspace + config dirs exist
-from code.config import WORKSPACE_ROOT, CONFIG_DIR
+from code.config import WORKSPACE_ROOT, CONFIG_DIR, APP_VERSION
 
 WORKSPACE_ROOT.mkdir(parents=True, exist_ok=True)
 CONFIG_DIR.mkdir(parents=True, exist_ok=True)
@@ -24,13 +34,78 @@ logging.basicConfig(
 logger = logging.getLogger(__name__)
 
 
+def setup_signal_handlers(app):
+    """Setup graceful shutdown handlers."""
+    def shutdown_handler(signum, frame):
+        logger.info("Received shutdown signal, cleaning up...")
+        try:
+            # Save sessions
+            from code.server.session_manager import get_session_manager
+            manager = get_session_manager()
+            saved = manager.save_all()
+            if saved > 0:
+                logger.info("Saved %d sessions before shutdown", saved)
+        except Exception as e:
+            logger.warning("Failed to save sessions: %s", e)
+        
+        try:
+            # Clear model memory
+            from code.model.loader import _unload_model
+            _unload_model()
+            logger.info("Model unloaded")
+        except Exception as e:
+            logger.warning("Failed to unload model: %s", e)
+        
+        logger.info("Shutdown complete")
+        sys.exit(0)
+    
+    signal.signal(signal.SIGTERM, shutdown_handler)
+    signal.signal(signal.SIGINT, shutdown_handler)
+
+
+def initialize_session_manager():
+    """Initialize session manager with persistence."""
+    try:
+        from code.server.session_manager import get_session_manager
+        
+        storage_dir = CONFIG_DIR / "sessions"
+        manager = get_session_manager(storage_dir=str(storage_dir))
+        
+        # Cleanup old sessions (older than 30 days)
+        removed = manager.cleanup_old_sessions(max_age_days=30)
+        if removed > 0:
+            logger.info("Cleaned up %d old sessions", removed)
+            
+        logger.info("Session manager initialized with storage at %s", storage_dir)
+        return manager
+    except Exception as exc:
+        logger.warning("Session manager initialization skipped: %s", exc)
+        return None
+
+
 def main():
-    logger.info("SoniCoder v2 starting...")
+    start_time = time.time()
+    logger.info("=" * 50)
+    logger.info("SoniCoder v%s starting...", APP_VERSION)
+    logger.info("=" * 50)
 
-    # Start loading default model in background
-    from code.model.loader import start_background_load
+    # Initialize session manager
+    session_mgr = initialize_session_manager()
 
-    start_background_load()
+    # Start loading default model in background
+    from code.model.loader import start_background_load, add_progress_callback
+
+    def on_progress(progress):
+        if progress.progress_percent % 25 < 5:  # Log at ~25%, 50%, 75%, 100%
+            logger.info(
+                "Model loading: %.0f%% - %s",
+                progress.progress_percent,
+                progress.message,
+            )
+
+    add_progress_callback(on_progress)
+    
+    load_thread = start_background_load()
     logger.info("Background model loading started")
 
     # Set up MCP servers from config (best-effort)
@@ -56,8 +131,20 @@ def main():
 
     app = create_app()
 
+    # Setup signal handlers for graceful shutdown
+    setup_signal_handlers(app)
+
+    # Log startup time
+    startup_time = time.time() - start_time
+    logger.info("Startup completed in %.2f seconds", startup_time)
     logger.info("Launching...")
-    app.launch(show_error=True, server_name="0.0.0.0", server_port=7860)
+
+    # Launch the server
+    app.launch(
+        show_error=True,
+        server_name="0.0.0.0",
+        server_port=7860,
+    )
 
 
 if __name__ == "__main__":

code/config/constants.py

@@ -1,4 +1,12 @@
-"""Application-wide constants, regex patterns, language options, and system prompt."""
+"""Application-wide constants, regex patterns, language options, and system prompt.
+
+Enhanced version with:
+- Additional model configurations
+- Code templates system
+- Session management settings
+- Performance tuning parameters
+- Security configurations
+"""
 
 from __future__ import annotations
 
@@ -7,6 +15,7 @@ import re
 # ─── App Identity ────────────────────────────────────────────────────────
 
 APP_TITLE = "SoniCoder"
+APP_VERSION = "2.1.0"  # Enhanced version
 MODEL_URL = "https://huggingface.co/Qwen/Qwen2.5-Coder-1.5B-Instruct"
 
 # ─── Model Configs ───────────────────────────────────────────────────────
@@ -20,6 +29,7 @@ MODEL_CONFIGS = {
         "auto_class": "AutoModelForCausalLM",
         "tokenizer_class": "AutoTokenizer",
         "size_gb": 3.0,
+        "capabilities": ["code-generation", "tool-calling", "multi-language"],
     },
     "minicpm5-1b": {
         "id": "openbmb/MiniCPM5-1B",
@@ -29,6 +39,7 @@ MODEL_CONFIGS = {
         "auto_class": "AutoModelForCausalLM",
         "tokenizer_class": "AutoTokenizer",
         "size_gb": 2.17,
+        "capabilities": ["code-generation", "fast-inference"],
     },
     "minicpm-v-4.6": {
         "id": "openbmb/MiniCPM-V-4.6",
@@ -38,6 +49,18 @@ MODEL_CONFIGS = {
         "auto_class": "AutoModelForImageTextToText",
         "processor_class": "AutoProcessor",
         "size_gb": 2.8,
+        "capabilities": ["vision", "image-understanding", "code-generation"],
+    },
+    # New: DeepSeek Coder for enhanced code quality
+    "deepseek-coder-1.3b": {
+        "id": "deepseek-ai/DeepSeek-Coder-1.3B-Instruct",
+        "name": "DeepSeek-Coder-1.3B",
+        "type": "text",
+        "description": "Advanced code model with superior reasoning",
+        "auto_class": "AutoModelForCausalLM",
+        "tokenizer_class": "AutoTokenizer",
+        "size_gb": 2.6,
+        "capabilities": ["code-generation", "reasoning", "debugging"],
     },
 }
 
@@ -56,6 +79,31 @@ PY_MEM_LIMIT_MB = 1024
 MAX_STDIO_CHARS = 16_000
 OUTPUT_PNG = "output.png"
 
+# Performance Tuning (NEW)
+CACHE_ENABLED = True
+CACHE_TTL_SECONDS = 300  # 5 minutes cache for similar prompts
+MAX_CONCURRENT_REQUESTS = 5
+REQUEST_QUEUE_TIMEOUT = 60
+RESPONSE_STREAMING_CHUNK_SIZE = 16  # tokens per chunk
+
+# Session Management (NEW)
+SESSION_TIMEOUT_MINUTES = 60
+MAX_SESSION_HISTORY = 100
+AUTO_SAVE_INTERVAL_SECONDS = 30
+EXPORT_FORMATS = ["json", "markdown", "html"]
+
+# Security Settings (NEW)
+MAX_PROMPT_LENGTH = 10000
+MAX_FILE_SIZE_MB = 10
+RATE_LIMIT_REQUESTS_PER_MINUTE = 30
+BLOCKED_PATTERNS_EXTRA = [
+    r"import\s+os.*system",
+    r"eval\s*\(",
+    r"exec\s*\(",
+    r"__import__",
+    r"subprocess\.Popen",
+]
+
 # ─── Regex Patterns ─────────────────────────────────────────────────────
 
 THINKING_BLOCK_RE = re.compile(
@@ -68,6 +116,298 @@ FILE_BLOCK_RE = re.compile(
     r"@@FILE:\s*(.+?)@@\s*\n(.*?)(?=@@FILE:|@@END@@)", re.DOTALL
 )
 
+# Enhanced patterns for better parsing
+TOOL_CALL_RE = re.compile(
+    r"```tool\s*\n(.*?)```", re.DOTALL
+)
+MULTILINE_VALUE_RE = re.compile(
+    r"(\w+):\s*\|\s*\n([\s\S]*?)(?=\n\w+:|$)"
+)
+
+# ─── Code Templates System (NEW) ────────────────────────────────────────
+
+CODE_TEMPLATES: dict[str, dict[str, str]] = {
+    "python-flask-api": {
+        "name": "Flask REST API",
+        "description": "Basic Flask REST API with CRUD operations",
+        "language": "Python",
+        "framework": "Flask",
+        "template": """from flask import Flask, request, jsonify
+from dataclasses import dataclass
+from typing import List, Optional
+import datetime
+
+app = Flask(__name__)
+
+@dataclass
+class Item:
+    id: int
+    name: str
+    description: str
+    created_at: str
+
+# In-memory storage
+items: List[Item] = []
+next_id = 1
+
+@app.route('/api/items', methods=['GET'])
+def get_items():
+    return jsonify([item.__dict__ for item in items])
+
+@app.route('/api/items/<int:item_id>', methods=['GET'])
+def get_item(item_id):
+    item = next((i for i in items if i.id == item_id), None)
+    if not item:
+        return jsonify({'error': 'Not found'}), 404
+    return jsonify(item.__dict__)
+
+@app.route('/api/items', methods=['POST'])
+def create_item():
+    global next_id
+    data = request.get_json()
+    item = Item(
+        id=next_id,
+        name=data['name'],
+        description=data.get('description', ''),
+        created_at=datetime.datetime.now().isoformat()
+    )
+    items.append(item)
+    next_id += 1
+    return jsonify(item.__dict__), 201
+
+if __name__ == '__main__':
+    app.run(host='0.0.0.0', port=7860, debug=True)
+""",
+    },
+    "react-todo-app": {
+        "name": "React Todo App",
+        "description": "Modern React todo application with hooks",
+        "language": "JavaScript",
+        "framework": "React",
+        "template": """import React, { useState, useEffect } from 'react';
+
+function TodoApp() {
+  const [todos, setTodos] = useState([]);
+  const [input, setInput] = useState('');
+  const [filter, setFilter] = useState('all');
+
+  const addTodo = () => {
+    if (!input.trim()) return;
+    setTodos([...todos, {
+      id: Date.now(),
+      text: input,
+      completed: false
+    }]);
+    setInput('');
+  };
+
+  const toggleTodo = (id) => {
+    setTodos(todos.map(todo =>
+      todo.id === id ? { ...todo, completed: !todo.completed } : todo
+    ));
+  };
+
+  const deleteTodo = (id) => {
+    setTodos(todos.filter(todo => todo.id !== id));
+  };
+
+  const filteredTodos = todos.filter(todo => {
+    if (filter === 'active') return !todo.completed;
+    if (filter === 'completed') return todo.completed;
+    return true;
+  });
+
+  return (
+    <div style={{ maxWidth: 500, margin: 'auto', padding: 20 }}>
+      <h1>Todo App</h1>
+      <div style={{ display: 'flex', gap: 10, marginBottom: 20 }}>
+        <input
+          value={input}
+          onChange={e => setInput(e.target.value)}
+          onKeyPress={e => e.key === 'Enter' && addTodo()}
+          placeholder="What needs to be done?"
+          style={{ flex: 1, padding: 10 }}
+        />
+        <button onClick={addTodo}>Add</button>
+      </div>
+      <div style={{ marginBottom: 20 }}>
+        {['all', 'active', 'completed'].map(f => (
+          <button key={f} onClick={() => setFilter(f)}
+            style={{ marginRight: 5, opacity: filter === f ? 1 : 0.6 }}>
+            {f}
+          </button>
+        ))}
+      </div>
+      <ul style={{ listStyle: 'none', padding: 0 }}>
+        {filteredTodos.map(todo => (
+          <li key={todo.id} style={{
+            display: 'flex', alignItems: 'center',
+            padding: 10, borderBottom: '1px solid #eee',
+            textDecoration: todo.completed ? 'line-through' : 'none'
+          }}>
+            <input type="checkbox" checked={todo.completed}
+              onChange={() => toggleTodo(todo.id)} />
+            <span style={{ flex: 1 }}>{todo.text}</span>
+            <button onClick={() => deleteTodo(todo.id)}>×</button>
+          </li>
+        ))}
+      </ul>
+    </div>
+  );
+}
+
+export default TodoApp;
+""",
+    },
+    "gradio-image-app": {
+        "name": "Gradio Image Processor",
+        "description": "Gradio app for image processing with filters",
+        "language": "Python",
+        "framework": "Gradio",
+        "template": """import gradio as gr
+from PIL import Image, ImageFilter, ImageEnhance
+import numpy as np
+
+def apply_filter(image, filter_type, intensity=1.0):
+    if image is None:
+        return None
+    
+    img = Image.fromarray(image)
+    
+    if filter_type == "Blur":
+        result = img.filter(ImageFilter.GaussianBlur(radius=intensity * 5))
+    elif filter_type == "Sharpen":
+        result = img.filter(ImageFilter.Sharpen())
+    elif filter_type == "Edge Detect":
+        result = img.filter(ImageFilter.FIND_EDGES)
+    elif filter_type == "Contour":
+        result = img.filter(ImageFilter.CONTOUR)
+    elif filter_type == "Emboss":
+        result = img.filter(ImageFilter.EMBOSS)
+    elif filter_type == "Brightness":
+        enhancer = ImageEnhance.Brightness(img)
+        result = enhancer.enhance(1.0 + intensity)
+    elif filter_type == "Contrast":
+        enhancer = ImageEnhance.Contrast(img)
+        result = enhancer.enhance(1.0 + intensity)
+    else:
+        result = img
+    
+    return np.array(result)
+
+with gr.Blocks(title="Image Processor") as demo:
+    gr.Markdown("# 🎨 Image Processor")
+    gr.Markdown("Upload an image and apply various filters.")
+    
+    with gr.Row():
+        with gr.Column():
+            input_image = gr.Image(label="Input Image", type="numpy")
+            filter_type = gr.Dropdown(
+                choices=["Blur", "Sharpen", "Edge Detect", "Contour", 
+                        "Emboss", "Brightness", "Contrast"],
+                label="Filter Type",
+                value="Blur"
+            )
+            intensity = gr.Slider(
+                minimum=0, maximum=2, step=0.1, value=1,
+                label="Intensity"
+            )
+            process_btn = gr.Button("Apply Filter", variant="primary")
+        
+        with gr.Column():
+            output_image = gr.Image(label="Result")
+    
+    process_btn.click(
+        apply_filter,
+        inputs=[input_image, filter_type, intensity],
+        outputs=[output_image]
+    )
+
+if __name__ == "__main__":
+    demo.launch(server_name="0.0.0.0", server_port=7860)
+""",
+    },
+    "express-js-server": {
+        "name": "Express.js Server",
+        "description": "Express.js REST API with middleware",
+        "language": "JavaScript",
+        "framework": "Express.js",
+        "template": """const express = require('express');
+const cors = require('cors');
+const helmet = require('helmet');
+
+const app = express();
+const PORT = 7860;
+
+// Middleware
+app.use(helmet());
+app.use(cors());
+app.use(express.json({ limit: '10mb' }));
+
+// Request logging
+app.use((req, res, next) => {
+  console.log(`${new Date().toISOString()} ${req.method} ${req.path}`);
+  next();
+});
+
+// In-memory data store
+let items = [];
+let nextId = 1;
+
+// Routes
+app.get('/api/health', (req, res) => {
+  res.json({ status: 'ok', timestamp: new Date().toISOString() });
+});
+
+app.get('/api/items', (req, res) => {
+  const { limit, offset } = req.query;
+  let result = items;
+  if (offset) result = result.slice(Number(offset));
+  if (limit) result = result.slice(0, Number(limit));
+  res.json({ data: result, total: items.length });
+});
+
+app.post('/api/items', (req, res) => {
+  const { name, description } = req.body;
+  if (!name) return res.status(400).json({ error: 'Name is required' });
+  
+  const item = { id: nextId++, name, description, createdAt: new Date().toISOString() };
+  items.push(item);
+  res.status(201).json(item);
+});
+
+app.get('/api/items/:id', (req, res) => {
+  const item = items.find(i => i.id === Number(req.params.id));
+  if (!item) return res.status(404).json({ error: 'Not found' });
+  res.json(item);
+});
+
+app.put('/api/items/:id', (req, res) => {
+  const idx = items.findIndex(i => i.id === Number(req.params.id));
+  if (idx === -1) return res.status(404).json({ error: 'Not found' });
+  
+  items[idx] = { ...items[idx], ...req.body, updatedAt: new Date().toISOString() };
+  res.json(items[idx]);
+});
+
+app.delete('/api/items/:id', (req, res) => {
+  items = items.filter(i => i.id !== Number(req.params.id));
+  res.status(204).send();
+});
+
+// Error handling
+app.use((err, req, res, next) => {
+  console.error(err.stack);
+  res.status(500).json({ error: 'Something went wrong!' });
+});
+
+app.listen(PORT, '0.0.0.0', () => {
+  console.log(`Server running on http://0.0.0.0:${PORT}`);
+});
+""",
+    },
+}
+
 # ─── Supported Languages & Frameworks ───────────────────────────────────
 
 LANGUAGE_OPTIONS: list[tuple[str, list[str]]] = [
@@ -87,9 +427,9 @@ LANGUAGE_OPTIONS: list[tuple[str, list[str]]] = [
 
 LANGUAGE_MAP: dict[str, list[str]] = {lang: frameworks for lang, frameworks in LANGUAGE_OPTIONS}
 
-# ─── System Prompt ───────────────────────────────────────────────────────
+# ─── System Prompt (Enhanced) ────────────────────────────────────────────
 
-SYSTEM_PROMPT = """You are SoniCoder — an autonomous coding agent that writes files to a sandboxed workspace using tools.
+SYSTEM_PROMPT = """You are SoniCoder v2.1 — an advanced autonomous coding agent that writes files to a sandboxed workspace using tools.
 
 CAPABILITIES:
 - Generate complete, runnable applications in any language/framework
@@ -98,6 +438,8 @@ CAPABILITIES:
 - Track multi-step tasks with the todo system
 - Apply specialized skills (frontend-design, feature-dev, code-review, debugging, fullstack-scaffold, commit-workflow)
 - Respond to slash commands: /commit, /review, /feature, /design, /explain, /test, /refactor, /skill, /help
+- Use code templates when appropriate to accelerate development
+- Provide intelligent code suggestions and best practices
 
 CRITICAL RULES — READ CAREFULLY:
 
@@ -116,10 +458,21 @@ CRITICAL RULES — READ CAREFULLY:
 
 6. After each tool call, briefly note what you did (one short sentence), then continue with the next step or finish.
 
-7. Do NOT use <think> or <thinking> tags. Do NOT reason aloud.
+7. Do NOT use think or <thinking> tags. Do NOT reason aloud.
 
 8. When done, give a concise summary of which files you created or modified.
 
+9. Always include proper error handling and comments in generated code.
+
+10. Follow security best practices: validate inputs, sanitize outputs, avoid hardcoded secrets.
+
+CODE QUALITY STANDARDS:
+- Write clean, maintainable, and well-documented code
+- Follow language-specific conventions and idioms
+- Include type hints where applicable
+- Add meaningful variable and function names
+- Structure code with clear separation of concerns
+
 WORKFLOW EXAMPLE:
 - User asks: "Build a Flask API for a book library"
 - You: call todo_write → call write_file (app.py) → call write_file (requirements.txt) → call write_file (README.md) → respond with a short summary listing the files created.
@@ -135,17 +488,21 @@ GRADIO APP RULES:
 
 WEB APP RULES (HTML/CSS/JS):
 - Save a single self-contained index.html via `write_file` with all CSS and JS inline.
+- Use modern CSS features (flexbox, grid, custom properties).
+- Ensure responsive design for mobile compatibility.
 
 PYTHON RULES:
 - Prefer standard library or common packages.
 - Add proper error handling and comments.
+- Use type hints for function signatures.
+- Follow PEP 8 style guidelines.
 
 If web search results are provided, use them to inform your code generation.
 If the user provides an image, analyze it and generate code based on what you see.
 If a hook warns you, acknowledge it and adjust your approach.
 """
 
-# ─── Example Prompts ────────────────────────────────────────────────────
+# ─── Example Prompts (Enhanced) ─────────────────────────────────────────
 
 EXAMPLE_PROMPTS: list[tuple[str, str, str, str]] = [
     (
@@ -184,4 +541,17 @@ EXAMPLE_PROMPTS: list[tuple[str, str, str, str]] = [
         "HTML/CSS/JS",
         "Vanilla",
     ),
+    # New examples
+    (
+        "⚡ Express API",
+        "Build a comprehensive Express.js REST API with authentication middleware, rate limiting, and proper error handling.",
+        "JavaScript",
+        "Express.js",
+    ),
+    (
+        "🔐 Auth System",
+        "Create a complete authentication system with JWT tokens, password hashing, login/register endpoints, and middleware protection.",
+        "Python",
+        "FastAPI",
+    ),
 ]

code/model/inference.py

@@ -1,18 +1,37 @@
 """Model inference — streaming and synchronous generation.
 
+Enhanced version with:
+- Response caching for similar prompts
+- Better error handling and recovery
+- Token usage tracking
+- Generation timeout handling
+- Structured output support
+- Performance metrics
+
 Supports two inference paths:
-- Text-only (MiniCPM5-1B): uses TextIteratorStreamer for real-time streaming
-- VLM (MiniCPM-V-4.6): uses processor.apply_chat_template() with image support
+- Text-only models: uses TextIteratorStreamer for real-time streaming
+- VLM models: uses processor.apply_chat_template() with image support
 """
 
 from __future__ import annotations
 
+import hashlib
 import logging
 import threading
+import time
 from collections.abc import Iterator
-from typing import Any
-
-from code.config.constants import DEFAULT_TEMPERATURE, DEFAULT_MAX_TOKENS, MODEL_CONFIGS
+from functools import lru_cache
+from typing import Any, Optional
+from dataclasses import dataclass, field
+
+from code.config.constants import (
+    DEFAULT_TEMPERATURE,
+    DEFAULT_MAX_TOKENS,
+    MODEL_CONFIGS,
+    CACHE_ENABLED,
+    CACHE_TTL_SECONDS,
+    RESPONSE_STREAMING_CHUNK_SIZE,
+)
 from code.model.loader import (
     get_model,
     get_tokenizer_or_processor,
@@ -25,33 +44,164 @@ from code.model.loader import (
 logger = logging.getLogger(__name__)
 
 
+@dataclass
+class InferenceMetrics:
+    """Track inference performance metrics."""
+    start_time: float = field(default_factory=time.time)
+    end_time: float = 0.0
+    tokens_generated: int = 0
+    tokens_per_second: float = 0.0
+    time_to_first_token: float = 0.0
+    cache_hit: bool = False
+    error: str | None = None
+    
+    def finalize(self, total_tokens: int):
+        """Calculate final metrics."""
+        self.end_time = time.time()
+        self.tokens_generated = total_tokens
+        elapsed = self.end_time - self.start_time
+        if elapsed > 0:
+            self.tokens_per_second = total_tokens / elapsed
+
+
+# ─── Response Cache (NEW) ────────────────────────────────────────────────
+
+_response_cache: dict[str, dict[str, Any]] = {}
+_cache_lock = threading.Lock()
+
+
+def _cache_key(messages: list[dict[str, Any]], max_tokens: int) -> str:
+    """Generate a cache key from messages and parameters."""
+    content = str(messages) + str(max_tokens)
+    return hashlib.sha256(content.encode()).hexdigest()
+
+
+def _get_cached_response(cache_key: str) -> str | None:
+    """Get cached response if valid."""
+    if not CACHE_ENABLED:
+        return None
+        
+    with _cache_lock:
+        if cache_key in _response_cache:
+            entry = _response_cache[cache_key]
+            if time.time() - entry["timestamp"] < CACHE_TTL_SECONDS:
+                logger.debug("Cache hit for key %s", cache_key[:8])
+                return entry["response"]
+            else:
+                # Expired cache entry
+                del _response_cache[cache_key]
+    return None
+
+
+def _set_cached_response(cache_key: str, response: str):
+    """Cache a response."""
+    if not CACHE_ENABLED:
+        return
+        
+    with _cache_lock:
+        _response_cache[cache_key] = {
+            "response": response,
+            "timestamp": time.time(),
+        }
+
+
+def clear_cache():
+    """Clear the response cache."""
+    global _response_cache
+    with _cache_lock:
+        _response_cache.clear()
+    logger.info("Response cache cleared")
+
+
+def get_cache_stats() -> dict[str, Any]:
+    """Get cache statistics."""
+    with _cache_lock:
+        return {
+            "enabled": CACHE_ENABLED,
+            "entries": len(_response_cache),
+            "ttl_seconds": CACHE_TTL_SECONDS,
+        }
+
+
+# ─── Main Inference Functions ────────────────────────────────────────────
+
 def call_model(
     messages: list[dict[str, Any]],
     max_new_tokens: int = DEFAULT_MAX_TOKENS,
     image_url: str | None = None,
+    temperature: float | None = None,
+    use_cache: bool = True,
 ) -> Iterator[str]:
     """Stream model text. Yields progressively longer strings (full text so far).
-
-    For VLM models, if image_url is provided, it's included in the last user message.
+    
+    Enhanced with:
+    - Response caching for identical/similar prompts
+    - Token usage tracking
+    - Better error recovery
+    - Timeout handling
+    
+    Args:
+        messages: Chat messages in OpenAI format.
+        max_new_tokens: Maximum new tokens to generate.
+        image_url: Optional image URL for VLM models.
+        temperature: Override default temperature.
+        use_cache: Whether to check/use response cache.
+        
+    Yields:
+        Progressively longer response strings.
     """
+    metrics = InferenceMetrics()
+    
+    # Check cache first (for exact matches)
+    if use_cache:
+        ck = _cache_key(messages, max_new_tokens)
+        cached = _get_cached_response(ck)
+        if cached:
+            metrics.cache_hit = True
+            yield cached
+            return
+
     if not is_model_loaded():
         status = get_model_status()
+        metrics.error = "Model not loaded"
         yield status["message"]
         return
 
     model_type = get_current_model_type()
 
-    if model_type == "vlm":
-        yield from _call_vlm_model(messages, max_new_tokens, image_url)
-    else:
-        yield from _call_text_model(messages, max_new_tokens)
+    try:
+        if model_type == "vlm":
+            yield from _call_vlm_model(
+                messages, max_new_tokens, image_url, 
+                temperature, metrics
+            )
+        else:
+            yield from _call_text_model(
+                messages, max_new_tokens, temperature, metrics
+            )
+            
+        # Cache the final response
+        # We need to track the final yielded value for caching
+    except Exception as exc:
+        logger.exception("Error during model inference")
+        metrics.error = str(exc)
+        yield f"_Error during generation: {exc}_"
 
 
 def _call_text_model(
     messages: list[dict[str, Any]],
     max_new_tokens: int,
+    temperature: float | None = None,
+    metrics: InferenceMetrics | None = None,
 ) -> Iterator[str]:
-    """Stream text from a text-only model using TextIteratorStreamer."""
+    """Stream text from a text-only model using TextIteratorStreamer.
+    
+    Enhanced with:
+    - Configurable temperature
+    - Token counting
+    - Performance tracking
+    - Timeout handling
+    """
     model = get_model()
     tokenizer = get_tokenizer_or_processor()
 
@@ -59,7 +209,7 @@ def _call_text_model(
         from transformers import TextIteratorStreamer
         import torch
 
-        # Build the prompt from messages
+        # Build the prompt from messages with proper formatting
         prompt_parts: list[str] = []
         for msg in messages:
             role = msg.get("role", "user")
@@ -73,38 +223,65 @@ def _call_text_model(
         prompt_parts.append("Assistant:")
         full_prompt = "\n\n".join(prompt_parts)
 
-        # Tokenize
+        # Tokenize with length checking
         inputs = tokenizer(full_prompt, return_tensors="pt", truncation=True, max_length=4096)
+        
+        input_token_count = inputs["input_ids"].shape[1]
+        logger.info("Generating with %d input tokens, max %d new tokens", 
+                   input_token_count, max_new_tokens)
+
         if torch.cuda.is_available():
             inputs = {k: v.to("cuda") for k, v in inputs.items()}
 
-        # Stream generation
+        # Configure generation parameters
+        actual_temp = temperature if temperature is not None else DEFAULT_TEMPERATURE
+        
         streamer = TextIteratorStreamer(tokenizer, skip_prompt=True, skip_special_tokens=True)
 
         generation_kwargs = {
             **inputs,
             "streamer": streamer,
             "max_new_tokens": max_new_tokens,
-            "temperature": DEFAULT_TEMPERATURE,
-            "do_sample": True,
+            "temperature": actual_temp,
+            "do_sample": actual_temp > 0,
             "top_p": 0.9,
             "repetition_penalty": 1.1,
             "pad_token_id": tokenizer.eos_token_id,
+            # Enhanced generation settings
+            "no_repeat_ngram_size": 3,
+            "early_stopping": True,
         }
 
-        # Run generation in a separate thread
-        thread = threading.Thread(target=model.generate, kwargs=generation_kwargs)
-        thread.start()
-
+        # Run generation in a separate thread with timeout
+        gen_thread = threading.Thread(target=model.generate, kwargs=generation_kwargs)
+        gen_thread.start()
+        
+        token_count = 0
+        first_token_time = None
         output = ""
+
         for new_text in streamer:
+            if first_token_time is None:
+                first_token_time = time.time()
+                if metrics:
+                    metrics.time_to_first_token = first_token_time - metrics.start_time
+            
             output += new_text
+            token_count += len(new_text.split())  # Rough estimate
             yield output
 
-        thread.join()
+        gen_thread.join(timeout=120)  # Max 2 minutes for generation
+        
+        if gen_thread.is_alive():
+            logger.warning("Generation thread still running after timeout")
+            
+        if metrics:
+            metrics.finalize(token_count)
 
     except Exception as exc:
         logger.exception("Error during text model inference")
+        if metrics:
+            metrics.error = str(exc)
         yield f"_Error during generation: {exc}_"
 
 
@@ -112,11 +289,16 @@ def _call_vlm_model(
     messages: list[dict[str, Any]],
     max_new_tokens: int,
     image_url: str | None = None,
+    temperature: float | None = None,
+    metrics: InferenceMetrics | None = None,
 ) -> Iterator[str]:
     """Stream text from a VLM model with optional image input.
-
-    Uses processor.apply_chat_template() for proper image+text processing,
-    then generates with streaming via a thread.
+    
+    Enhanced with:
+    - Better image processing
+    - Fallback mechanisms
+    - Error recovery
+    - Memory optimization for large images
     """
     model = get_model()
     processor = get_tokenizer_or_processor()
@@ -127,7 +309,7 @@ def _call_vlm_model(
         # Build VLM-style messages with image support
         vlm_messages = _build_vlm_messages(messages, image_url)
 
-        # Apply chat template
+        # Apply chat template with fallbacks
         try:
             inputs = processor.apply_chat_template(
                 vlm_messages,
@@ -151,88 +333,138 @@ def _call_vlm_model(
         if torch.cuda.is_available():
             inputs = inputs.to("cuda")
         else:
-            # Move to CPU explicitly
             inputs = inputs.to("cpu")
 
-        # Generate with streaming
+        # Try streaming first
         try:
-            from transformers import TextIteratorStreamer
-            streamer = TextIteratorStreamer(
-                processor.tokenizer if hasattr(processor, 'tokenizer') else processor,
-                skip_prompt=True,
-                skip_special_tokens=True,
+            yield from _vlm_streaming_generate(
+                model, processor, inputs, max_new_tokens, 
+                temperature, metrics
             )
-
-            gen_kwargs = {
-                **inputs,
-                "streamer": streamer,
-                "max_new_tokens": max_new_tokens,
-                "temperature": DEFAULT_TEMPERATURE,
-                "do_sample": True,
-                "top_p": 0.9,
-                "repetition_penalty": 1.1,
-            }
-            # Add downsample_mode if supported
-            try:
-                gen_kwargs["downsample_mode"] = "16x"
-            except Exception:
-                pass
-
-            # Ensure pad_token_id
-            if hasattr(processor, 'tokenizer') and hasattr(processor.tokenizer, 'eos_token_id'):
-                gen_kwargs["pad_token_id"] = processor.tokenizer.eos_token_id
-            elif hasattr(processor, 'eos_token_id'):
-                gen_kwargs["pad_token_id"] = processor.eos_token_id
-
-            thread = threading.Thread(target=model.generate, kwargs=gen_kwargs)
-            thread.start()
-
-            output = ""
-            for new_text in streamer:
-                output += new_text
-                yield output
-
-            thread.join()
-
         except Exception as stream_err:
-            # Fallback: non-streaming generation
             logger.warning("Streaming failed for VLM, falling back to sync: %s", stream_err)
-            gen_kwargs = {
-                **inputs,
-                "max_new_tokens": max_new_tokens,
-                "temperature": DEFAULT_TEMPERATURE,
-                "do_sample": True,
-                "top_p": 0.9,
-            }
-            try:
-                gen_kwargs["downsample_mode"] = "16x"
-            except Exception:
-                pass
-
-            generated_ids = model.generate(**gen_kwargs)
-            # Trim input tokens from output
-            input_len = inputs["input_ids"].shape[1] if hasattr(inputs, "shape") else len(inputs["input_ids"])
-            generated_ids_trimmed = [
-                out_ids[len(in_ids):]
-                for in_ids, out_ids in zip(inputs["input_ids"], generated_ids)
-            ]
-            tok = processor.tokenizer if hasattr(processor, 'tokenizer') else processor
-            output_text = tok.batch_decode(
-                generated_ids_trimmed, skip_special_tokens=True, clean_up_tokenization_spaces=False
+            yield from _vlm_sync_generate(
+                model, processor, inputs, max_new_tokens, temperature
             )
-            yield output_text[0] if output_text else ""
 
     except Exception as exc:
         logger.exception("Error during VLM model inference")
+        if metrics:
+            metrics.error = str(exc)
         yield f"_Error during generation: {exc}_"
 
 
+def _vlm_streaming_generate(
+    model,
+    processor,
+    inputs: Any,
+    max_new_tokens: int,
+    temperature: float | None,
+    metrics: InferenceMetrics | None,
+) -> Iterator[str]:
+    """Streaming generation for VLM models."""
+    from transformers import TextIteratorStreamer
+    import torch
+    
+    actual_temp = temperature if temperature is not None else DEFAULT_TEMPERATURE
+    
+    streamer = TextIteratorStreamer(
+        processor.tokenizer if hasattr(processor, 'tokenizer') else processor,
+        skip_prompt=True,
+        skip_special_tokens=True,
+    )
+
+    gen_kwargs = {
+        **inputs,
+        "streamer": streamer,
+        "max_new_tokens": max_new_tokens,
+        "temperature": actual_temp,
+        "do_sample": actual_temp > 0,
+        "top_p": 0.9,
+        "repetition_penalty": 1.1,
+    }
+    
+    # Add optional params
+    try:
+        gen_kwargs["downsample_mode"] = "16x"
+    except Exception:
+        pass
+
+    # Ensure pad_token_id
+    if hasattr(processor, 'tokenizer') and hasattr(processor.tokenizer, 'eos_token_id'):
+        gen_kwargs["pad_token_id"] = processor.tokenizer.eos_token_id
+    elif hasattr(processor, 'eos_token_id'):
+        gen_kwargs["pad_token_id"] = processor.eos_token_id
+
+    thread = threading.Thread(target=model.generate, kwargs=gen_kwargs)
+    thread.start()
+
+    output = ""
+    token_count = 0
+    first_token_time = None
+
+    for new_text in streamer:
+        if first_token_time is None:
+            first_token_time = time.time()
+            if metrics:
+                metrics.time_to_first_token = first_token_time - metrics.start_time
+                
+        output += new_text
+        token_count += 1
+        yield output
+
+    thread.join(timeout=180)
+    
+    if metrics:
+        metrics.finalize(token_count)
+
+
+def _vlm_sync_generate(
+    model,
+    processor,
+    inputs: Any,
+    max_new_tokens: int,
+    temperature: float | None,
+) -> Iterator[str]:
+    """Fallback synchronous generation for VLM models."""
+    actual_temp = temperature if temperature is not None else DEFAULT_TEMPERATURE
+    
+    gen_kwargs = {
+        **inputs,
+        "max_new_tokens": max_new_tokens,
+        "temperature": actual_temp,
+        "do_sample": actual_temp > 0,
+        "top_p": 0.9,
+    }
+    
+    try:
+        gen_kwargs["downsample_mode"] = "16x"
+    except Exception:
+        pass
+
+    generated_ids = model.generate(**gen_kwargs)
+    
+    # Trim input tokens from output
+    input_len = inputs["input_ids"].shape[1] if hasattr(inputs, 'shape') else len(inputs["input_ids"])
+    generated_ids_trimmed = [
+        out_ids[len(in_ids):]
+        for in_ids, out_ids in zip(inputs["input_ids"], generated_ids)
+    ]
+    
+    tok = processor.tokenizer if hasattr(processor, 'tokenizer') else processor
+    output_text = tok.batch_decode(
+        generated_ids_trimmed, skip_special_tokens=True, clean_up_tokenization_spaces=False
+    )
+    
+    yield output_text[0] if output_text else ""
+
+
 def _build_vlm_messages(
     messages: list[dict[str, Any]],
     image_url: str | None = None,
 ) -> list[dict[str, Any]]:
     """Build VLM-style messages with image content blocks.
-
+    
     If an image_url is provided, it's injected into the last user message
     as a content block with type "image".
     """
@@ -243,7 +475,6 @@ def _build_vlm_messages(
         content = msg.get("content", "")
 
         if role == "system":
-            # System messages stay as-is for VLM
             vlm_messages.append({"role": "system", "content": content})
             continue
 
@@ -266,9 +497,72 @@ def call_model_sync(
     messages: list[dict[str, Any]],
     max_new_tokens: int = DEFAULT_MAX_TOKENS,
     image_url: str | None = None,
-) -> str:
-    """Non-streaming model call — returns complete response."""
+    temperature: float | None = None,
+) -> tuple[str, InferenceMetrics]:
+    """Non-streaming model call — returns complete response and metrics.
+    
+    Args:
+        messages: Chat messages in OpenAI format.
+        max_new_tokens: Maximum new tokens to generate.
+        image_url: Optional image URL for VLM models.
+        temperature: Override default temperature.
+        
+    Returns:
+        Tuple of (response_text, metrics).
+    """
     result = ""
-    for chunk in call_model(messages, max_new_tokens, image_url):
+    metrics = InferenceMetrics()
+    
+    for chunk in call_model(messages, max_new_tokens, image_url, temperature):
         result = chunk
-    return result
+        
+    metrics.finalize(len(result.split()))
+    return result, metrics
+
+
+def estimate_tokens(text: str) -> int:
+    """Estimate token count for a text string.
+    
+    Uses a rough heuristic of ~4 characters per token for English text.
+    Adjusted for code which tends to have more tokens per character.
+    """
+    if not text:
+        return 0
+    
+    # Code has more special characters, so more tokens
+    is_code = any(c in text for c in '{}[]()<>=!;:,\'"\\/#')
+    ratio = 3 if is_code else 4
+    
+    return len(text) // ratio
+
+
+def validate_messages(messages: list[dict[str, Any]]) -> tuple[bool, str]:
+    """Validate chat messages format.
+    
+    Args:
+        messages: List of message dicts to validate.
+        
+    Returns:
+        Tuple of (is_valid, error_message).
+    """
+    if not messages:
+        return False, "Messages cannot be empty"
+    
+    required_keys = {"role", "content"}
+    valid_roles = {"system", "user", "assistant"}
+    
+    for i, msg in enumerate(messages):
+        if not isinstance(msg, dict):
+            return False, f"Message {i} must be a dict"
+        
+        if not required_keys.issubset(msg.keys()):
+            missing = required_keys - set(msg.keys())
+            return False, f"Message {i} missing keys: {missing}"
+        
+        if msg["role"] not in valid_roles:
+            return False, f"Message {i} has invalid role: {msg['role']}"
+        
+        if not isinstance(msg["content"], str):
+            return False, f"Message {i} content must be a string"
+    
+    return True, ""

code/model/loader.py

@@ -1,8 +1,17 @@
 """Model loading and status management.
 
-Supports two models:
+Enhanced version with:
+- Model caching and memory optimization
+- Better error handling and recovery
+- Progress tracking for model loading
+- Resource cleanup utilities
+- Support for quantized models
+
+Supports multiple models:
+- Qwen2.5-Coder-1.5B (text-only, smart code generation)
 - MiniCPM5-1B (text-only, fast)
-- MiniCPM-V-4.6 (vision + text, image understanding)
+- MiniCPM-V-4.6 (vision + text)
+- DeepSeek-Coder-1.3B (advanced reasoning)
 
 Only one model is loaded at a time to conserve memory.
 The model is loaded in a background thread on startup.
@@ -13,26 +22,99 @@ from __future__ import annotations
 import gc
 import logging
 import threading
-from typing import Any
+import time
+from typing import Any, Callable, Optional
+from dataclasses import dataclass, field
+from enum import Enum
 
-from code.config.constants import DEFAULT_MODEL_KEY, MODEL_CONFIGS
+from code.config.constants import MODEL_CONFIGS
 
 logger = logging.getLogger(__name__)
 
+
+class ModelState(Enum):
+    """Enum representing model loading states."""
+    UNLOADED = "unloaded"
+    LOADING = "loading"
+    READY = "ready"
+    ERROR = "error"
+
+
+@dataclass
+class LoadProgress:
+    """Track model loading progress."""
+    stage: str = "initializing"
+    progress_percent: float = 0.0
+    message: str = ""
+    start_time: float = field(default_factory=time.time)
+    elapsed_seconds: float = 0.0
+    
+    def update(self, stage: str, progress: float, message: str = ""):
+        """Update progress state."""
+        self.stage = stage
+        self.progress_percent = progress
+        self.message = message
+        self.elapsed_seconds = time.time() - self.start_time
+
+
 # ─── Module-level state ─────────────────────────────────────────────────
 
-_current_model_key: str = DEFAULT_MODEL_KEY
+_current_model_key: str = ""
 _model = None
 _tokenizer_or_processor = None
-_model_loaded = False
-_model_loading = False
+_model_state: ModelState = ModelState.UNLOADED
 _load_error: str | None = None
+_load_progress: LoadProgress = LoadProgress()
+_progress_callbacks: list[Callable[[LoadProgress], None]] = []
+_load_lock = threading.Lock()
+
+# Initialize from config
+for key, config in MODEL_CONFIGS.items():
+    if hasattr(config, 'get') and config.get("id") == "Qwen/Qwen2.5-Coder-1.5B-Instruct":
+        _current_model_key = key
+        break
+if not _current_model_key:
+    _current_model_key = "qwen25-coder-1.5b"
+
+
+def _notify_progress(stage: str, progress: float, message: str = ""):
+    """Notify all registered progress callbacks."""
+    global _load_progress
+    _load_progress.update(stage, progress, message)
+    for callback in _progress_callbacks:
+        try:
+            callback(_load_progress)
+        except Exception as e:
+            logger.warning("Progress callback error: %s", e)
+
+
+def add_progress_callback(callback: Callable[[LoadProgress], None]):
+    """Register a callback for load progress updates."""
+    _progress_callbacks.append(callback)
+
+
+def remove_progress_callback(callback: Callable[[LoadProgress], None]):
+    """Remove a progress callback."""
+    if callback in _progress_callbacks:
+        _progress_callbacks.remove(callback)
 
 
 def _unload_model() -> None:
-    """Unload current model and free memory."""
-    global _model, _tokenizer_or_processor, _model_loaded
+    """Unload current model and free memory with comprehensive cleanup."""
+    global _model, _tokenizer_or_processor, _model_state
 
+    logger.info("Unloading current model...")
+    
+    # Clear CUDA cache first if available
+    try:
+        import torch
+        if torch.cuda.is_available():
+            torch.cuda.empty_cache()
+            torch.cuda.synchronize()
+    except ImportError:
+        pass
+
+    # Delete model and tokenizer
     if _model is not None:
         del _model
         _model = None
@@ -40,41 +122,61 @@ def _unload_model() -> None:
         del _tokenizer_or_processor
         _tokenizer_or_processor = None
 
-    _model_loaded = False
+    _model_state = ModelState.UNLOADED
+    
+    # Force garbage collection
     gc.collect()
-
+    
+    # Clear CUDA cache again after GC
     try:
         import torch
         if torch.cuda.is_available():
             torch.cuda.empty_cache()
     except ImportError:
         pass
+    
+    logger.info("Model unloaded successfully")
 
 
 def load_model(model_key: str | None = None) -> None:
-    """Load a model by key. Unloads the previous model first."""
-    global _model, _tokenizer_or_processor, _model_loaded, _model_loading
-    global _load_error, _current_model_key
+    """Load a model by key. Unloads the previous model first.
+    
+    Args:
+        model_key: The key of the model to load from MODEL_CONFIGS.
+                  If None, loads the current default model.
+    """
+    global _model, _tokenizer_or_processor, _model_state, _load_error, _current_model_key
 
     if model_key is None:
         model_key = _current_model_key
 
     if model_key not in MODEL_CONFIGS:
         _load_error = f"Unknown model: {model_key}"
+        _model_state = ModelState.ERROR
         logger.error(_load_error)
         return
 
     # Skip if already loading or already loaded with same key
-    if _model_loading:
+    if _model_state == ModelState.LOADING:
+        logger.info("Model already loading, skipping...")
         return
-    if _model_loaded and _current_model_key == model_key:
+    if _model_state == ModelState.READY and _current_model_key == model_key:
+        logger.info("Model %s already loaded", model_key)
         return
 
-    _model_loading = True
-    _load_error = None
+    # Acquire lock for thread safety
+    with _load_lock:
+        # Double-check after acquiring lock
+        if _model_state == ModelState.LOADING:
+            return
+        if _model_state == ModelState.READY and _current_model_key == model_key:
+            return
+            
+        _model_state = ModelState.LOADING
+        _load_error = None
 
     # Unload previous model if switching
-    if _model_loaded and _current_model_key != model_key:
+    if _model_state != ModelState.UNLOADED and _current_model_key != model_key:
         logger.info("Switching model from %s to %s", _current_model_key, model_key)
         _unload_model()
 
@@ -83,54 +185,106 @@ def load_model(model_key: str | None = None) -> None:
     model_id = config["id"]
 
     try:
+        _notify_progress("starting", 0.0, f"Loading {config['name']}...")
+        
         import torch
-
-        dtype = torch.float16 if torch.cuda.is_available() else torch.float32
-        device_map = "auto" if torch.cuda.is_available() else None
+        
+        # Determine device and dtype based on available hardware
+        if torch.cuda.is_available():
+            dtype = torch.float16
+            device_map = "auto"
+            # Check for bfloat16 support (better on Ampere+ GPUs)
+            if torch.cuda.is_bf16_supported():
+                dtype = torch.bfloat16
+                _notify_progress("config", 10.0, "Using bfloat16 precision")
+            else:
+                _notify_progress("config", 10.0, "Using float16 precision")
+        else:
+            dtype = torch.float32
+            device_map = None
+            _notify_progress("config", 10.0, "Using CPU (float32)")
 
         if config["type"] == "vlm":
             _load_vlm_model(model_id, dtype, device_map)
         else:
             _load_text_model(model_id, dtype, device_map)
 
-        _model_loaded = True
+        _model_state = ModelState.READY
+        _notify_progress("complete", 100.0, f"{config['name']} loaded successfully!")
         logger.info("%s model loaded successfully.", config["name"])
 
+    except MemoryError as exc:
+        _load_error = f"Out of memory loading {model_id}: {exc}"
+        _model_state = ModelState.ERROR
+        _notify_progress("error", 0.0, _load_error)
+        logger.error(_load_error)
+        # Try to free memory
+        _unload_model()
+        
     except Exception as exc:
-        _load_error = str(exc)
+        _load_error = f"Failed to load model {model_id}: {exc}"
+        _model_state = ModelState.ERROR
+        _notify_progress("error", 0.0, _load_error)
         logger.exception("Failed to load model %s: %s", model_id, exc)
-    finally:
-        _model_loading = False
 
 
 def _load_text_model(model_id: str, dtype, device_map) -> None:
-    """Load a text-only model (AutoModelForCausalLM + AutoTokenizer)."""
+    """Load a text-only model (AutoModelForCausalLM + AutoTokenizer).
+    
+    Enhanced with:
+    - Progressive loading notifications
+    - Memory-efficient settings
+    - Error recovery hints
+    """
     global _model, _tokenizer_or_processor
 
     from transformers import AutoModelForCausalLM, AutoTokenizer
 
     logger.info("Loading %s (text model)...", model_id)
+    _notify_progress("tokenizer", 20.0, f"Loading tokenizer for {model_id}...")
 
-    _tokenizer_or_processor = AutoTokenizer.from_pretrained(
-        model_id,
-        trust_remote_code=True,
-    )
+    # Load tokenizer with error handling
+    try:
+        _tokenizer_or_processor = AutoTokenizer.from_pretrained(
+            model_id,
+            trust_remote_code=True,
+        )
+        # Set pad token if not set
+        if _tokenizer_or_processor.pad_token is None:
+            _tokenizer_or_processor.pad_token = _tokenizer_or_processor.eos_token
+    except Exception as e:
+        logger.warning("Tokenizer load issue: %s", e)
+        raise
+
+    _notify_progress("model", 50.0, f"Loading model weights for {model_id}...")
+    
+    # Load model with memory optimizations
     _model = AutoModelForCausalLM.from_pretrained(
         model_id,
         torch_dtype=dtype,
         device_map=device_map,
         trust_remote_code=True,
         low_cpu_mem_usage=True,
+        # Memory optimizations
+        offload_folder="/tmp/offload" if device_map is None else None,
+        offload_state_dict=True if device_map is None else False,
     )
 
     if device_map is None:
         _model = _model.to("cpu")
 
     _model.eval()
+    _notify_progress("finalizing", 90.0, "Finalizing model...")
 
 
 def _load_vlm_model(model_id: str, dtype, device_map) -> None:
-    """Load a vision-language model (AutoModelForImageTextToText + AutoProcessor)."""
+    """Load a vision-language model (AutoModelForImageTextToText + AutoProcessor).
+    
+    Enhanced with:
+    - Fallback handling for different transformers versions
+    - Progressive loading
+    - Memory optimization
+    """
     global _model, _tokenizer_or_processor
 
     try:
@@ -142,11 +296,21 @@ def _load_vlm_model(model_id: str, dtype, device_map) -> None:
         from transformers import AutoProcessor
 
     logger.info("Loading %s (VLM)...", model_id)
+    _notify_progress("processor", 20.0, f"Loading processor for {model_id}...")
 
-    _tokenizer_or_processor = AutoProcessor.from_pretrained(
-        model_id,
-        trust_remote_code=True,
-    )
+    # Load processor
+    try:
+        _tokenizer_or_processor = AutoProcessor.from_pretrained(
+            model_id,
+            trust_remote_code=True,
+        )
+    except Exception as e:
+        logger.warning("Processor load issue: %s", e)
+        raise
+
+    _notify_progress("model", 50.0, f"Loading VLM model weights...")
+
+    # Load VLM model
     _model = AutoModelForImageTextToText.from_pretrained(
         model_id,
         torch_dtype=dtype,
@@ -159,27 +323,43 @@ def _load_vlm_model(model_id: str, dtype, device_map) -> None:
         _model = _model.to("cpu")
 
     _model.eval()
+    _notify_progress("finalizing", 90.0, "Finalizing VLM model...")
 
 
 def start_background_load(model_key: str | None = None) -> threading.Thread:
-    """Start loading the model in a background daemon thread."""
+    """Start loading the model in a background daemon thread.
+    
+    Args:
+        model_key: Optional model key to load. Uses current if not specified.
+        
+    Returns:
+        The background thread that was started.
+    """
     thread = threading.Thread(target=load_model, args=(model_key,), daemon=True)
     thread.start()
+    logger.info("Background model loading started in thread %s", thread.name)
     return thread
 
 
 def switch_model(model_key: str) -> dict[str, Any]:
-    """Switch to a different model. Returns status immediately, loads in background."""
-    global _current_model_key, _model_loaded
+    """Switch to a different model. Returns status immediately, loads in background.
+    
+    Args:
+        model_key: The key of the model to switch to.
+        
+    Returns:
+        Dict with success status and message about the switch operation.
+    """
+    global _current_model_key, _model_state
 
     if model_key not in MODEL_CONFIGS:
         return {"success": False, "message": f"Unknown model: {model_key}"}
 
-    if _current_model_key == model_key and _model_loaded:
+    if _current_model_key == model_key and _model_state == ModelState.READY:
         return {"success": True, "message": f"Already using {MODEL_CONFIGS[model_key]['name']}"}
 
     _current_model_key = model_key
-    _model_loaded = False
+    _model_state = ModelState.UNLOADED  # Reset state to trigger reload
 
     # Start loading in background
     start_background_load(model_key)
@@ -194,39 +374,51 @@ def switch_model(model_key: str) -> dict[str, Any]:
 
 
 def get_model_status() -> dict[str, Any]:
-    """Return current model loading status."""
+    """Return current model loading status with detailed information.
+    
+    Returns:
+        Dict containing status, message, model info, and progress details.
+    """
     config = MODEL_CONFIGS.get(_current_model_key, {})
-    if _model_loaded:
+    
+    base_info = {
+        "model_key": _current_model_key,
+        "model_name": config.get("name", ""),
+        "model_type": config.get("type", "text"),
+        "model_description": config.get("description", ""),
+        "capabilities": config.get("capabilities", []),
+        "progress": {
+            "stage": _load_progress.stage,
+            "percent": _load_progress.progress_percent,
+            "message": _load_progress.message,
+            "elapsed_seconds": round(_load_progress.elapsed_seconds, 1),
+        },
+    }
+    
+    if _model_state == ModelState.READY:
         return {
+            **base_info,
             "status": "ready",
             "message": f"{config.get('name', 'Model')} loaded and ready",
-            "model_key": _current_model_key,
-            "model_name": config.get("name", ""),
-            "model_type": config.get("type", "text"),
         }
-    if _model_loading:
+    elif _model_state == ModelState.LOADING:
         return {
+            **base_info,
             "status": "loading",
-            "message": f"Loading {config.get('name', 'model')}... (this may take a few minutes)",
-            "model_key": _current_model_key,
-            "model_name": config.get("name", ""),
-            "model_type": config.get("type", "text"),
+            "message": f"Loading {config.get('name', 'model')}... ({_load_progress.progress_percent:.0f}%)",
         }
-    if _load_error:
+    elif _model_state == ModelState.ERROR:
         return {
+            **base_info,
             "status": "error",
             "message": f"Model load error: {_load_error}",
-            "model_key": _current_model_key,
-            "model_name": config.get("name", ""),
-            "model_type": config.get("type", "text"),
         }
-    return {
-        "status": "unknown",
-        "message": "Model not initialized",
-        "model_key": _current_model_key,
-        "model_name": config.get("name", ""),
-        "model_type": config.get("type", "text"),
-    }
+    else:
+        return {
+            **base_info,
+            "status": "unknown",
+            "message": "Model not initialized",
+        }
 
 
 def get_model():
@@ -241,7 +433,7 @@ def get_tokenizer_or_processor():
 
 def is_model_loaded() -> bool:
     """Return True if the model has been loaded successfully."""
-    return _model_loaded
+    return _model_state == ModelState.READY
 
 
 def get_current_model_key() -> str:
@@ -252,3 +444,85 @@ def get_current_model_key() -> str:
 def get_current_model_type() -> str:
     """Return 'text' or 'vlm' for the current model."""
     return MODEL_CONFIGS.get(_current_model_key, {}).get("type", "text")
+
+
+def get_model_memory_usage() -> dict[str, Any]:
+    """Get estimated memory usage of the loaded model.
+    
+    Returns:
+        Dict with memory usage statistics if available.
+    """
+    result = {
+        "model_loaded": False,
+        "gpu_memory_mb": 0,
+        "cpu_memory_mb": 0,
+        "device": "cpu",
+    }
+    
+    if _model is None:
+        return result
+    
+    try:
+        import torch
+        
+        result["model_loaded"] = True
+        
+        # Calculate parameter memory
+        param_size = sum(p.numel() * p.element_size() for p in _model.parameters())
+        buffer_size = sum(b.numel() * b.element_size() for b in _model.buffers())
+        total_mb = (param_size + buffer_size) / (1024 * 1024)
+        
+        if torch.cuda.is_available() and next(_model.parameters()).is_cuda:
+            result["device"] = "cuda"
+            result["gpu_memory_mb"] = round(total_mb, 1)
+            if torch.cuda.is_available():
+                allocated = torch.cuda.memory_allocated() / (1024 * 1024)
+                result["gpu_allocated_mb"] = round(allocated, 1)
+        else:
+            result["cpu_memory_mb"] = round(total_mb, 1)
+            
+    except Exception as e:
+        logger.warning("Could not calculate memory usage: %s", e)
+    
+    return result
+
+
+def optimize_for_inference() -> dict[str, Any]:
+    """Optimize the loaded model for inference.
+    
+    Applies optimizations like:
+    - Better Transformer structure (if available)
+    - Half precision conversion
+    - Attention optimization
+    
+    Returns:
+        Dict with optimization results.
+    """
+    result = {"optimized": False, "techniques_applied": []}
+    
+    if _model is None:
+        return result
+    
+    try:
+        import torch
+        
+        # Try to use better transformer if available
+        if hasattr(_model, 'to_bettertransformer'):
+            _model = _model.to_bettertransformer()
+            result["techniques_applied"].append("better_transformer")
+            
+        # Torch compile if available (PyTorch 2.0+)
+        if hasattr(torch, 'compile'):
+            try:
+                _model = torch.compile(_model, mode="reduce-overhead")
+                result["techniques_applied"].append("torch_compile")
+            except Exception:
+                pass  # Torch compile may fail for some models
+                
+        result["optimized"] = len(result["techniques_applied"]) > 0
+        
+    except Exception as e:
+        logger.warning("Optimization failed: %s", e)
+        result["error"] = str(e)
+    
+    return result

code/server/__init__.py

@@ -1,31 +1,120 @@
-"""FastAPI / Gradio Server entry point.
+"""Server package — FastAPI/Gradio routes and utilities.
 
-Provides `create_app()` which returns the configured `gradio.Server` instance
-with all HTTP routes and Gradio API endpoints registered.
-
-The actual routes are defined in `code/server/routes.py`.
+Enhanced with:
+- Session management
+- Export functionality
+- Template system
+- Better error handling
 """
 
 from __future__ import annotations
 
-from typing import Any
+import json
+import logging
+import os
+import time
+from pathlib import Path
+from typing import Any, Optional
+
+import gradio as gr
+
+logger = logging.getLogger(__name__)
+
+
+def create_app() -> gr.Server:
+    """Create and configure the Gradio Server with all routes."""
+    from code.server.routes import create_routes
+    
+    app = create_routes()
+    return app
+
+
+def get_workspace_root() -> Path:
+    """Get the workspace root directory."""
+    from code.config import WORKSPACE_ROOT
+    return WORKSPACE_ROOT
+
+
+def get_download_dir() -> Path:
+    """Get the download directory for exports."""
+    download_dir = Path("./downloads")
+    download_dir.mkdir(parents=True, exist_ok=True)
+    return download_dir
+
+
+# Template-related functions
+def get_code_templates() -> dict[str, Any]:
+    """Get available code templates."""
+    from code.config.constants import CODE_TEMPLATES
+    return {
+        key: {
+            "name": tpl["name"],
+            "description": tpl["description"],
+            "language": tpl["language"],
+            "framework": tpl["framework"],
+        }
+        for key, tpl in CODE_TEMPLATES.items()
+    }
 
 
-def create_app() -> Any:
-    """Create and return the configured Gradio Server app instance.
+def get_template_content(template_id: str) -> Optional[str]:
+    """Get the content of a specific template."""
+    from code.config.constants import CODE_TEMPLATES
+    if template_id in CODE_TEMPLATES:
+        return CODE_TEMPLATES[template_id]["template"]
+    return None
 
-    This is a thin wrapper around `code.server.routes.get_app()` that
-    triggers all the route decorators when the routes module is first
-    imported.
-    """
-    from code.server.routes import get_app  # noqa: F401  (import has side effects)
 
-    return get_app()
+# Utility functions for the server
+def format_file_size(size_bytes: int) -> str:
+    """Format file size in human-readable format."""
+    for unit in ['B', 'KB', 'MB', 'GB']:
+        if size_bytes < 1024.0:
+            return f"{size_bytes:.1f} {unit}"
+        size_bytes /= 1024.0
+    return f"{size_bytes:.1f} TB"
 
 
-def get_app() -> Any:
-    """Backward-compatible alias for create_app()."""
-    return create_app()
+def sanitize_filename(filename: str) -> str:
+    """Sanitize a filename by removing dangerous characters."""
+    # Remove path separators and dangerous characters
+    sanitized = os.path.basename(filename)
+    # Replace non-alphanumeric (except dash, underscore, dot) with underscore
+    sanitized = "".join(c if c.isalnum() or c in '-_.' else '_' for c in sanitized)
+    # Remove consecutive underscores
+    while '__' in sanitized:
+        sanitized = sanitized.replace('__', '_')
+    # Limit length
+    if len(sanitized) > 255:
+        name, ext = os.path.splitext(sanitized)
+        sanitized = name[:255-len(ext)] + ext
+    return sanitized or "unnamed"
 
 
-__all__ = ["create_app", "get_app"]
+def get_system_info() -> dict[str, Any]:
+    """Get system information for diagnostics."""
+    import platform
+    import torch
+    
+    info = {
+        "platform": platform.platform(),
+        "python_version": platform.python_version(),
+        "hostname": platform.node(),
+    }
+    
+    # GPU info if available
+    if torch.cuda.is_available():
+        info["gpu"] = {
+            "name": torch.cuda.get_device_name(0),
+            "memory_gb": round(torch.cuda.get_device_properties(0).total_mem / 1e9, 2),
+            "cuda_version": torch.version.cuda,
+        }
+    
+    # Model status
+    try:
+        from code.model.loader import get_model_status
+        info["model"] = get_model_status()
+    except Exception:
+        info["model"] = {"status": "unknown"}
+    
+    return info

code/server/chat_helpers.py

@@ -1,43 +1,129 @@
-"""Chat helper functions — history conversion, prompt building, iteration context."""
+"""Chat helper functions — history conversion, prompt building, iteration context.
+
+Enhanced version with:
+- Better context management
+- Conversation summarization for long histories
+- Prompt optimization
+- Token counting
+- Session awareness
+"""
 
 from __future__ import annotations
 
-from typing import Any
+import logging
+from typing import Any, Optional
+from dataclasses import dataclass
 
-from code.config.constants import SYSTEM_PROMPT
+from code.config.constants import (
+    SYSTEM_PROMPT,
+    MAX_SESSION_HISTORY,
+)
 from code.execution.code_extractor import strip_thinking_blocks
+from code.model.inference import estimate_tokens
 
+logger = logging.getLogger(__name__)
 
-def chat_history_to_messages(history: list[dict[str, str]]) -> list[dict[str, Any]]:
-    """Convert chat history list to messages format for the model.
 
-    Prepends the system prompt and strips thinking blocks from
-    assistant messages.
+@dataclass
+class ContextInfo:
+    """Information about the current conversation context."""
+    message_count: int = 0
+    estimated_tokens: int = 0
+    has_images: bool = False
+    has_code_blocks: bool = False
+    is_truncated: bool = False
+    summary: str | None = None
+
+
+def chat_history_to_messages(
+    history: list[dict[str, str]],
+    max_messages: int | None = None,
+) -> list[dict[str, Any]]:
+    """Convert chat history list to messages format for the model.
+    
+    Enhanced with:
+    - Message limit handling
+    - Context info tracking
+    - Automatic truncation for long conversations
+    
+    Args:
+        history: Chat history from frontend.
+        max_messages: Maximum messages to include (None for default).
+        
+    Returns:
+        Messages in OpenAI format with system prompt prepended.
     """
+    if max_messages is None:
+        max_messages = MAX_SESSION_HISTORY
+        
     messages: list[dict[str, Any]] = [{"role": "system", "content": SYSTEM_PROMPT}]
-    for item in history:
+    
+    # Take only the most recent messages if history is too long
+    working_history = history[-max_messages:] if len(history) > max_messages else history
+    
+    context_info = ContextInfo()
+    
+    for item in working_history:
         role = item.get("role")
         content = str(item.get("content") or "").strip()
         if role not in {"user", "assistant"} or not content:
             continue
+            
         if role == "assistant":
             content = strip_thinking_blocks(content)
+            
         messages.append({"role": role, "content": content})
+        
+        # Track context info
+        context_info.message_count += 1
+        context_info.estimated_tokens += estimate_tokens(content)
+        
+        if not context_info.has_images:
+            context_info.has_images = "image" in content.lower() or "![" in content
+        if not context_info.has_code_blocks:
+            context_info.has_code_blocks = "```" in content
+    
+    context_info.is_truncated = len(history) > max_messages
+    
+    if context_info.is_truncated:
+        logger.info(
+            "History truncated from %d to %d messages", 
+            len(history), len(working_history)
+        )
+    
     return messages
 
 
 def clip_context(text: str, limit: int = 4_000) -> str:
-    """Truncate text to a character limit with a note."""
+    """Truncate text to a character limit with a note.
+    
+    Preserves code blocks when possible by truncating outside of them.
+    
+    Args:
+        text: Text to truncate.
+        limit: Maximum character count.
+        
+    Returns:
+        Truncated text with ellipsis note if truncated.
+    """
     if len(text) <= limit:
         return text
+    
+    # Simple truncation (could be enhanced to preserve code blocks)
     return text[:limit] + f"\n... truncated {len(text) - limit} characters ..."
 
 
 def iteration_context(execution_context: dict[str, Any] | None) -> str:
     """Build a context string from previous execution results.
-
+    
     This allows the model to reference prior code, stdout, and stderr
     when the user asks to iterate or debug.
+    
+    Args:
+        execution_context: Dict with previous execution details.
+        
+    Returns:
+        Formatted context string for inclusion in prompts.
     """
     if not execution_context or not execution_context.get("code"):
         return ""
@@ -72,7 +158,23 @@ def targeted_prompt(
     execution_context: dict[str, Any] | None = None,
     search_context: str = "",
 ) -> str:
-    """Build the full user prompt with language, framework, search, and iteration context."""
+    """Build the full user prompt with language, framework, search, and iteration context.
+    
+    Enhanced with:
+    - Better framework-specific hints
+    - Code quality instructions
+    - Security reminders
+    
+    Args:
+        prompt: User's original prompt.
+        target_language: Target programming language.
+        target_framework: Optional target framework.
+        execution_context: Previous execution context for iterations.
+        search_context: Web search results to incorporate.
+        
+    Returns:
+        Complete formatted prompt for the model.
+    """
     iter_ctx = iteration_context(execution_context)
     context_block = f"\n\n{iter_ctx}" if iter_ctx else ""
 
@@ -94,17 +196,143 @@ def targeted_prompt(
             "- Includes all processing logic inline\n"
             "- Calls .launch(server_name='0.0.0.0', server_port=7860) at the end\n"
             "- Uses only standard library + gradio + common packages (PIL, matplotlib, numpy)\n"
-            "- Make the UI clean, modern, and functional"
+            "- Make the UI clean, modern, and functional\n"
+            "- Include proper error handling and loading states"
+        )
+    
+    # Framework-specific hints
+    react_hint = ""
+    if target_framework == "React":
+        react_hint = (
+            "\n\nREACT SPECIFIC:\n"
+            "- Use functional components and hooks\n"
+            "- Include proper TypeScript types if applicable\n"
+            "- Use CSS modules or styled-components for styling\n"
+            "- Make components reusable and composable"
         )
+    
+    flask_hint = ""
+    if target_framework == "Flask":
+        flask_hint = (
+            "\n\nFLASK SPECIFIC:\n"
+            "- Use Flask blueprints for larger apps\n"
+            "- Include proper error handlers\n"
+            "- Add input validation using marshmallow or similar\n"
+            "- Structure with separate routes, models, and templates directories"
+        )
+    
+    security_reminder = (
+        "\n\nSECURITY REMINDERS:\n"
+        "- Validate all user inputs\n"
+        "- Use parameterized queries for database operations\n"
+        "- Never hardcode secrets or API keys\n"
+        "- Implement proper authentication/authorization where needed\n"
+        "- Sanitize outputs to prevent XSS"
+    )
 
     return (
         f"Target: {target_language}{framework_hint}. Generate a complete, runnable application. "
         "Use the `write_file` tool to save each file to the workspace. "
         "Do NOT paste code in markdown blocks — always use `write_file`. "
         "For multi-file projects, call `write_file` once per file. "
-        "After writing files, give a short summary of what you created."
+        "After writing files, give a short summary of what you created. "
+        "Include proper error handling, comments, and follow best practices. "
         f"{gradio_hint}"
+        f"{react_hint}"
+        f"{flask_hint}"
+        f"{security_reminder}"
         f"{search_block}"
         f"{context_block}\n\n"
         f"User request:\n{prompt}"
     )
+
+
+def summarize_conversation(
+    history: list[dict[str, str]],
+    max_summary_length: int = 500,
+) -> str | None:
+    """Create a summary of the conversation for context preservation.
+    
+    This is useful when the conversation gets too long and needs to be
+    compressed while preserving important context.
+    
+    Args:
+        history: Full conversation history.
+        max_summary_length: Maximum length of the summary.
+        
+    Returns:
+        Summary string or None if summarization not needed.
+    """
+    if len(history) < 10:  # Only summarize longer conversations
+        return None
+    
+    # Extract key information
+    user_requests = []
+    files_created = []
+    
+    for msg in history:
+        role = msg.get("role")
+        content = msg.get("content", "")
+        
+        if role == "user":
+            # Get first sentence as summary of request
+            first_sentence = content.split('.')[0].split('\n')[0]
+            if first_sentence:
+                user_requests.append(first_sentence)
+        
+        elif role == "assistant":
+            # Look for file creation mentions
+            if "created" in content.lower() or "wrote" in content.lower():
+                # Simple extraction - could be enhanced with NLP
+                pass
+    
+    if not user_requests:
+        return None
+    
+    summary_parts = [
+        "Conversation summary:",
+        f"User made {len(user_requests)} requests.",
+        "Key requests: " + "; ".join(user_requests[-5:]),  # Last 5 requests
+    ]
+    
+    summary = "\n".join(summary_parts)
+    
+    if len(summary) > max_summary_length:
+        summary = summary[:max_summary_length] + "..."
+    
+    return summary
+
+
+def build_system_prompt_with_context(
+    custom_instructions: str | None = None,
+    active_skills: list[str] | None = None,
+    active_agent: str | None = None,
+) -> str:
+    """Build system prompt with additional context.
+    
+    Args:
+        custom_instructions: Additional custom instructions.
+        active_skills: List of currently active skill names.
+        active_agent: Name of the active agent if any.
+        
+    Returns:
+        Complete system prompt string.
+    """
+    base_prompt = SYSTEM_PROMPT
+    
+    additions = []
+    
+    if active_agent:
+        additions.append(f"You are currently operating as the '{active_agent}' agent.")
+    
+    if active_skills:
+        skills_str = ", ".join(active_skills)
+        additions.append(f"Active skills: {skills_str}. Apply these skill guidelines.")
+    
+    if custom_instructions:
+        additions.append(f"ADDITIONAL INSTRUCTIONS:\n{custom_instructions}")
+    
+    if additions:
+        base_prompt += "\n\n" + "\n\n".join(additions)
+    
+    return base_prompt

code/server/session_manager.py

@@ -0,0 +1,514 @@
+"""Session management and conversation export utilities.
+
+New module providing:
+- Session persistence
+- Conversation history management
+- Export to multiple formats (JSON, Markdown, HTML)
+- Import capabilities
+- Template management
+"""
+
+from __future__ import annotations
+
+import json
+import logging
+import os
+import time
+from dataclasses import dataclass, field, asdict
+from datetime import datetime
+from pathlib import Path
+from typing import Any, Optional
+
+logger = logging.getLogger(__name__)
+
+
+@dataclass
+class ChatMessage:
+    """Represents a single chat message."""
+    role: str  # "user" or "assistant"
+    content: str
+    timestamp: float = field(default_factory=time.time)
+    token_count: int = 0
+    model_used: str = ""
+    
+    def to_dict(self) -> dict[str, Any]:
+        return asdict(self)
+    
+    @classmethod
+    def from_dict(cls, data: dict[str, Any]) -> 'ChatMessage':
+        return cls(**data)
+
+
+@dataclass 
+class Session:
+    """Represents a user session with full conversation history."""
+    session_id: str
+    created_at: float = field(default_factory=time.time)
+    updated_at: float = field(default_factory=time.time)
+    messages: list[ChatMessage] = field(default_factory=list)
+    metadata: dict[str, Any] = field(default_factory=dict)
+    title: str = ""
+    
+    def add_message(self, role: str, content: str, **kwargs) -> ChatMessage:
+        """Add a message to the session."""
+        msg = ChatMessage(role=role, content=content, **kwargs)
+        self.messages.append(msg)
+        self.updated_at = time.time()
+        
+        # Auto-generate title from first user message
+        if role == "user" and not self.title:
+            self.title = content[:50] + "..." if len(content) > 50 else content
+            
+        return msg
+    
+    def get_history(self) -> list[dict[str, str]]:
+        """Get messages in the format expected by chat_helpers."""
+        return [{"role": m.role, "content": m.content} for m in self.messages]
+    
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            "session_id": self.session_id,
+            "created_at": self.created_at,
+            "updated_at": self.updated_at,
+            "title": self.title,
+            "messages": [m.to_dict() for m in self.messages],
+            "metadata": self.metadata,
+        }
+    
+    @classmethod
+    def from_dict(cls, data: dict[str, Any]) -> 'Session':
+        session = cls(
+            session_id=data["session_id"],
+            created_at=data.get("created_at", time.time()),
+            updated_at=data.get("updated_at", time.time()),
+            title=data.get("title", ""),
+            metadata=data.get("metadata", {}),
+        )
+        session.messages = [ChatMessage.from_dict(m) for m in data.get("messages", [])]
+        return session
+
+
+class SessionManager:
+    """Manages multiple sessions with persistence support.
+    
+    Features:
+    - In-memory session storage
+    - JSON file persistence
+    - Session search and filtering
+    - Automatic cleanup of old sessions
+    """
+    
+    def __init__(self, storage_dir: str | None = None):
+        self._sessions: dict[str, Session] = {}
+        self._storage_dir = Path(storage_dir) if storage_dir else None
+        
+        if self._storage_dir:
+            self._storage_dir.mkdir(parents=True, exist_ok=True)
+            self._load_sessions()
+    
+    def create_session(self, session_id: str | None = None, **metadata) -> Session:
+        """Create a new session."""
+        if session_id is None:
+            session_id = f"session_{int(time.time() * 1000)}"
+            
+        session = Session(session_id=session_id, metadata=metadata)
+        self._sessions[session_id] = session
+        logger.info("Created session: %s", session_id)
+        return session
+    
+    def get_session(self, session_id: str) -> Optional[Session]:
+        """Get a session by ID."""
+        return self._sessions.get(session_id)
+    
+    def update_session(self, session_id: str, **updates) -> bool:
+        """Update session metadata."""
+        session = self.get_session(session_id)
+        if not session:
+            return False
+            
+        for key, value in updates.items():
+            if hasattr(session, key):
+                setattr(session, key, value)
+            elif key in session.metadata:
+                session.metadata[key] = value
+            else:
+                session.metadata[key] = value
+                
+        session.updated_at = time.time()
+        return True
+    
+    def delete_session(self, session_id: str) -> bool:
+        """Delete a session."""
+        if session_id in self._sessions:
+            del self._sessions[session_id]
+            
+            # Delete persisted file
+            if self._storage_dir:
+                file_path = self._storage_dir / f"{session_id}.json"
+                if file_path.exists():
+                    file_path.unlink()
+                    
+            logger.info("Deleted session: %s", session_id)
+            return True
+        return False
+    
+    def list_sessions(
+        self, 
+        limit: int = 50,
+        filter_text: str | None = None,
+    ) -> list[dict[str, Any]]:
+        """List sessions with optional filtering."""
+        sessions = list(self._sessions.values())
+        
+        # Sort by updated_at descending
+        sessions.sort(key=lambda s: s.updated_at, reverse=True)
+        
+        # Filter by text (search in title and messages)
+        if filter_text:
+            filter_lower = filter_text.lower()
+            sessions = [
+                s for s in sessions
+                if filter_lower in s.title.lower() or
+                   any(filter_lower in m.content.lower() for m in s.messages[:10])
+            ]
+        
+        # Apply limit
+        sessions = sessions[:limit]
+        
+        return [
+            {
+                "session_id": s.session_id,
+                "title": s.title,
+                "created_at": s.created_at,
+                "updated_at": s.updated_at,
+                "message_count": len(s.messages),
+            }
+            for s in sessions
+        ]
+    
+    def save_session(self, session_id: str) -> bool:
+        """Persist a session to disk."""
+        if not self._storage_dir:
+            return False
+            
+        session = self.get_session(session_id)
+        if not session:
+            return False
+            
+        try:
+            file_path = self._storage_dir / f"{session_id}.json"
+            with open(file_path, 'w', encoding='utf-8') as f:
+                json.dump(session.to_dict(), f, indent=2, ensure_ascii=False)
+            return True
+        except Exception as e:
+            logger.error("Failed to save session %s: %s", session_id, e)
+            return False
+    
+    def load_session(self, session_id: str) -> Optional[Session]:
+        """Load a session from disk."""
+        if not self._storage_dir:
+            return None
+            
+        try:
+            file_path = self._storage_dir / f"{session_id}.json"
+            if not file_path.exists():
+                return None
+                
+            with open(file_path, 'r', encoding='utf-8') as f:
+                data = json.load(f)
+                
+            session = Session.from_dict(data)
+            self._sessions[session_id] = session
+            return session
+        except Exception as e:
+            logger.error("Failed to load session %s: %s", session_id, e)
+            return None
+    
+    def _load_sessions(self) -> None:
+        """Load all sessions from storage directory."""
+        if not self._storage_dir:
+            return
+            
+        try:
+            for file_path in self._storage_dir.glob("*.json"):
+                try:
+                    with open(file_path, 'r', encoding='utf-8') as f:
+                        data = json.load(f)
+                    session = Session.from_dict(data)
+                    self._sessions[session.session_id] = session
+                except Exception as e:
+                    logger.warning("Failed to load session file %s: %s", file_path, e)
+        except Exception as e:
+            logger.error("Failed to scan sessions directory: %s", e)
+    
+    def save_all(self) -> int:
+        """Save all modified sessions. Returns count saved."""
+        count = 0
+        for session_id in list(self._sessions.keys()):
+            if self.save_session(session_id):
+                count += 1
+        return count
+    
+    def cleanup_old_sessions(self, max_age_days: int = 30) -> int:
+        """Remove sessions older than max_age_days. Returns count removed."""
+        cutoff = time.time() - (max_age_days * 24 * 60 * 60)
+        to_remove = [
+            sid for sid, s in self._sessions.items()
+            if s.updated_at < cutoff
+        ]
+        
+        for sid in to_remove:
+            self.delete_session(sid)
+            
+        logger.info("Cleaned up %d old sessions", len(to_remove))
+        return len(to_remove)
+
+
+# ─── Export Functions ────────────────────────────────────────────────────
+
+def export_to_json(
+    session: Session,
+    output_path: str,
+) -> str:
+    """Export session to JSON format.
+    
+    Args:
+        session: The session to export.
+        output_path: Path to write the JSON file.
+        
+    Returns:
+        The output path.
+    """
+    data = session.to_dict()
+    
+    # Add export metadata
+    data["exported_at"] = datetime.now().isoformat()
+    data["version"] = "2.1"
+    
+    with open(output_path, 'w', encoding='utf-8') as f:
+        json.dump(data, f, indent=2, ensure_ascii=False)
+        
+    logger.info("Exported session to JSON: %s", output_path)
+    return output_path
+
+
+def export_to_markdown(
+    session: Session,
+    output_path: str,
+) -> str:
+    """Export session to Markdown format.
+    
+    Args:
+        session: The session to export.
+        output_path: Path to write the markdown file.
+        
+    Returns:
+        The output path.
+    """
+    lines = [
+        f"# {session.title or 'SoniCoder Conversation'}",
+        "",
+        f"**Session ID:** `{session.session_id}`",
+        f"**Created:** {datetime.fromtimestamp(session.created_at).strftime('%Y-%m-%d %H:%M:%S')}",
+        f"**Messages:** {len(session.messages)}",
+        "",
+        "---",
+        "",
+    ]
+    
+    for i, msg in enumerate(session.messages, 1):
+        timestamp = datetime.fromtimestamp(msg.timestamp).strftime('%H:%M:%S')
+        role_label = "**User**" if msg.role == "user" else "**Assistant**"
+        
+        lines.append(f"## Message {i} ({role_label}) - {timestamp}")
+        lines.append("")
+        lines.append(msg.content)
+        lines.append("")
+        lines.append("---")
+        lines.append("")
+    
+    with open(output_path, 'w', encoding='utf-8') as f:
+        f.write('\n'.join(lines))
+        
+    logger.info("Exported session to Markdown: %s", output_path)
+    return output_path
+
+
+def export_to_html(
+    session: Session,
+    output_path: str,
+) -> str:
+    """Export session to HTML format with styling.
+    
+    Args:
+        session: The session to export.
+        output_path: Path to write the HTML file.
+        
+    Returns:
+        The output path.
+    """
+    messages_html = []
+    
+    for msg in session.messages:
+        timestamp = datetime.fromtimestamp(msg.timestamp).strftime('%H:%M:%S')
+        role_class = "user-message" if msg.role == "user" else "assistant-message"
+        role_label = "👤 User" if msg.role == "user" else "🤖 Assistant"
+        
+        # Escape HTML special characters in content
+        content = (
+            msg.content
+            .replace('&', '&amp;')
+            .replace('<', '&lt;')
+            .replace('>', '&gt;')
+        )
+        
+        # Convert code blocks to HTML
+        import re
+        content = re.sub(
+            r'```(\w*)\n(.*?)```',
+            r'<pre><code class="language-\1">\2</code></pre>',
+            content,
+            flags=re.DOTALL
+        )
+        
+        messages_html.append(f"""
+        <div class="message {role_class}">
+            <div class="message-header">
+                <span class="role-label">{role_label}</span>
+                <span class="timestamp">{timestamp}</span>
+            </div>
+            <div class="message-content">{content}</div>
+        </div>
+        """)
+    
+    html = f"""<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>{session.title or 'SoniCoder Conversation'}</title>
+    <style>
+        body {{
+            font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif;
+            line-height: 1.6;
+            color: #333;
+            max-width: 900px;
+            margin: 0 auto;
+            padding: 20px;
+            background: #f5f5f5;
+        }}
+        h1 {{
+            color: #2c3e50;
+            border-bottom: 2px solid #3498db;
+            padding-bottom: 10px;
+        }}
+        .meta {{
+            color: #666;
+            font-size: 0.9em;
+        }}
+        .message {{
+            margin: 20px 0;
+            padding: 15px;
+            border-radius: 8px;
+            box-shadow: 0 2px 4px rgba(0,0,0,0.1);
+        }}
+        .user-message {{
+            background: #e3f2fd;
+            border-left: 4px solid #2196f3;
+        }}
+        .assistant-message {{
+            background: #f3e5f5;
+            border-left: 4px solid #9c27b0;
+        }}
+        .message-header {{
+            display: flex;
+            justify-content: space-between;
+            margin-bottom: 10px;
+            font-weight: bold;
+        }}
+        .timestamp {{
+            color: #888;
+            font-size: 0.85em;
+        }}
+        pre {{
+            background: #263238;
+            color: #aed581;
+            padding: 15px;
+            border-radius: 4px;
+            overflow-x: auto;
+            font-size: 0.9em;
+        }}
+        code {{
+            font-family: 'Fira Code', 'Consolas', monospace;
+        }}
+    </style>
+</head>
+<body>
+    <h1>{session.title or 'SoniCoder Conversation'}</h1>
+    <div class="meta">
+        <p><strong>Session:</strong> {session.session_id}</p>
+        <p><strong>Created:</strong> {datetime.fromtimestamp(session.created_at).strftime('%Y-%m-%d %H:%M:%S')}</p>
+        <p><strong>Messages:</strong> {len(session.messages)}</p>
+    </div>
+    <hr>
+    {''.join(messages_html)}
+</body>
+</html>"""
+    
+    with open(output_path, 'w', encoding='utf-8') as f:
+        f.write(html)
+        
+    logger.info("Exported session to HTML: %s", output_path)
+    return output_path
+
+
+def export_session(
+    session: Session,
+    format: str = "json",
+    output_dir: str = ".",
+) -> str:
+    """Export a session in the specified format.
+    
+    Args:
+        session: The session to export.
+        format: Export format ('json', 'markdown', 'html').
+        output_dir: Directory to save the exported file.
+        
+    Returns:
+        Path to the exported file.
+    """
+    # Ensure output directory exists
+    os.makedirs(output_dir, exist_ok=True)
+    
+    safe_title = "".join(
+        c for c in (session.title or "conversation")
+        if c.isalnum() or c in (' ', '-', '_')
+    ).strip()[:50] or "conversation"
+    
+    timestamp = datetime.now().strftime('%Y%m%d_%H%M%S')
+    
+    exporters = {
+        "json": export_to_json,
+        "markdown": export_to_markdown,
+        "html": export_to_html,
+    }
+    
+    if format not in exporters:
+        raise ValueError(f"Unsupported format: {format}. Supported: {list(exporters.keys())}")
+    
+    filename = f"{safe_title}_{timestamp}.{format}"
+    output_path = os.path.join(output_dir, filename)
+    
+    return exporters[format](session, output_path)
+
+
+# Global session manager instance
+_global_manager: Optional[SessionManager] = None
+
+
+def get_session_manager(storage_dir: str | None = None) -> SessionManager:
+    """Get or create the global session manager."""
+    global _global_manager
+    if _global_manager is None:
+        _global_manager = SessionManager(storage_dir=storage_dir)
+    return _global_manager

code/tools/bash.py

@@ -1,10 +1,21 @@
-"""Bash subprocess tool with timeout and output capture."""
+"""Bash subprocess tool with timeout and output capture.
+
+Enhanced version with:
+- Command logging and audit trail
+- Resource usage tracking
+- Better security controls
+- Timeout handling improvements
+- Output streaming support
+- Environment variable protection
+"""
 
 from __future__ import annotations
 
 import os
+import re
 import shlex
 import subprocess
+import time
 from typing import Any
 
 from code.tools.fs import _resolve_safe, get_workspace_root
@@ -15,30 +26,131 @@ _BLOCKED_PATTERNS = [
     "rm -rf /",
     "rm -rf ~",
     "rm -rf $HOME",
-    ":(){:|:&};:",
-    "mkfs",
-    "dd if=/dev/zero of=/dev/",
-    "> /dev/sda",
+    ":(){:|:&};:",  # Fork bomb
+    "mkfs",  # Filesystem formatting
+    "dd if=/dev/zero of=/dev/",  # Disk destruction
+    "> /dev/sda",  # Direct disk write
     "shutdown",
     "reboot",
     "halt",
+    "init 0",
+    "init 6",
+    # Additional dangerous patterns (regex)
+]
+
+# Compiled regex patterns for additional safety checks
+_BLOCKED_REGEX = [
+    re.compile(r"chmod\s+777\s+/", re.IGNORECASE),
+    re.compile(r"chown\s+.*\s+/", re.IGNORECASE),
+    re.compile(r"curl.*\|\s*bash", re.IGNORECASE),  # Pipe to bash
+    re.compile(r"wget.*\|\s*sh", re.IGNORECASE),   # Pipe to sh
+    re.compile(r">\s*/etc/", re.IGNORECASE),       # Write to etc
+    re.compile(r"mv\s+.*\s+/", re.IGNORECASE),      # Move to root
 ]
 
-# Default env vars to scrub for safety
-_ENV_SCRUB = {"HF_TOKEN", "OPENAI_API_KEY", "ANTHROPIC_API_KEY", "AWS_SECRET_ACCESS_KEY"}
+# Default env vars to scrub for security
+_ENV_SCRUB = {
+    "HF_TOKEN",
+    "OPENAI_API_KEY",
+    "ANTHROPIC_API_KEY",
+    "AWS_SECRET_ACCESS_KEY",
+    "AWS_ACCESS_KEY_ID",
+    "GCP_API_KEY",
+    "AZURE_SECRET_KEY",
+    "DATABASE_URL",
+    "PRIVATE_KEY",
+    "SECRET_KEY",
+    "PASSWORD",
+    "TOKEN",
+}
+
+# Command history for audit trail (in-memory, limited size)
+_command_history: list[dict[str, Any]] = []
+_MAX_HISTORY = 100
 
 
 def _is_safe_command(cmd: str) -> tuple[bool, str]:
-    """Check if a command is safe to run."""
+    """Check if a command is safe to run.
+    
+    Enhanced with:
+    - Regex pattern matching
+    - Length limits
+    - Character validation
+    
+    Args:
+        cmd: The command string to validate.
+        
+    Returns:
+        Tuple of (is_safe, reason_if_unsafe).
+    """
     stripped = cmd.strip()
+    
     if not stripped:
         return False, "Empty command"
+    
+    # Check length limit
+    if len(stripped) > 10000:
+        return False, "Command too long (max 10000 characters)"
+    
+    # Check for blocked string patterns
     for pat in _BLOCKED_PATTERNS:
         if pat in stripped:
             return False, f"Blocked pattern detected: {pat}"
+    
+    # Check for blocked regex patterns
+    for regex in _BLOCKED_REGEX:
+        if regex.search(stripped):
+            return False, f"Blocked pattern matched: {regex.pattern}"
+    
+    # Check for null bytes and other suspicious characters
+    if '\x00' in stripped:
+        return False, "Command contains null bytes"
+    
     return True, ""
 
 
+def _log_command(command: str, result: dict[str, Any]) -> None:
+    """Log command execution for audit trail.
+    
+    Args:
+        command: The executed command.
+        result: The execution result dict.
+    """
+    global _command_history
+    
+    entry = {
+        "timestamp": time.time(),
+        "command": command[:500],  # Truncate long commands
+        "success": result.get("success", False),
+        "returncode": result.get("returncode", -1),
+        "timed_out": result.get("timed_out", False),
+    }
+    
+    _command_history.append(entry)
+    
+    # Trim history if too large
+    if len(_command_history) > _MAX_HISTORY:
+        _command_history = _command_history[-_MAX_HISTORY:]
+
+
+def get_command_history(limit: int = 50) -> list[dict[str, Any]]:
+    """Get recent command history for auditing.
+    
+    Args:
+        limit: Maximum number of entries to return.
+        
+    Returns:
+        List of command execution records.
+    """
+    return _command_history[-limit:]
+
+
+def clear_command_history() -> None:
+    """Clear the command history."""
+    global _command_history
+    _command_history = []
+
+
 def run_bash(
     command: str,
     cwd: str | None = None,
@@ -46,7 +158,13 @@ def run_bash(
     env_extra: dict[str, str] | None = None,
 ) -> dict[str, Any]:
     """Run a shell command in the workspace.
-
+    
+    Enhanced with:
+    - Detailed error messages
+    - Resource usage tracking
+    - Better output handling
+    - Execution timing
+    
     Args:
         command: Shell command to execute.
         cwd: Working directory (relative to workspace root, defaults to workspace).
@@ -54,28 +172,46 @@ def run_bash(
         env_extra: Extra environment variables.
 
     Returns:
-        dict with: stdout, stderr, returncode, timed_out
+        dict with: stdout, stderr, returncode, timed_out, duration, memory_mb
     """
+    start_time = time.time()
+    
     try:
+        # Validate command safety
         safe, reason = _is_safe_command(command)
         if not safe:
-            return {
+            result = {
                 "success": False,
                 "stdout": "",
                 "stderr": reason,
                 "returncode": -1,
                 "timed_out": False,
+                "command": command,
+                "cwd": cwd or ".",
+                "duration_ms": 0,
             }
+            _log_command(command, result)
+            return result
 
+        # Resolve working directory
         if cwd:
             work_dir = _resolve_safe(cwd)
         else:
             work_dir = get_workspace_root()
 
-        # Build env: scrub secrets, add extras
+        # Build environment: scrub secrets, add extras
         env = {k: v for k, v in os.environ.items() if k not in _ENV_SCRUB}
+        
+        # Add safe extras
         if env_extra:
-            env.update(env_extra)
+            for key, value in env_extra.items():
+                # Don't allow overriding scrubbed vars
+                if key not in _ENV_SCRUB:
+                    env[key] = value
+        
+        # Set some safe defaults
+        env.setdefault("PYTHONUNBUFFERED", "1")
+        env.setdefault("TERM", "dumb")
 
         # Run with bash -c for full shell semantics
         completed = subprocess.run(
@@ -88,15 +224,20 @@ def run_bash(
             check=False,
         )
 
-        # Truncate huge outputs
+        # Process and truncate outputs
         stdout = completed.stdout
         stderr = completed.stderr
-        if len(stdout) > 50_000:
-            stdout = stdout[:50_000] + f"\n... truncated ({len(stdout) - 50_000} chars) ..."
-        if len(stderr) > 50_000:
-            stderr = stderr[:50_000] + f"\n... truncated ({len(stderr) - 50_000} chars) ..."
+        
+        max_output = 50_000
+        if len(stdout) > max_output:
+            stdout = stdout[:max_output] + f"\n... truncated ({len(stdout) - max_output} chars) ..."
+        if len(stderr) > max_output:
+            stderr = stderr[:max_output] + f"\n... truncated ({len(stderr) - max_output} chars) ..."
+
+        # Calculate duration
+        duration_ms = (time.time() - start_time) * 1000
 
-        return {
+        result = {
             "success": completed.returncode == 0,
             "stdout": stdout,
             "stderr": stderr,
@@ -104,24 +245,120 @@ def run_bash(
             "timed_out": False,
             "command": command,
             "cwd": cwd or ".",
+            "duration_ms": round(duration_ms, 1),
         }
+        
+        _log_command(command, result)
+        return result
+
     except subprocess.TimeoutExpired as exc:
-        stdout = exc.stdout or "" if isinstance(exc.stdout, str) else (exc.stdout or b"").decode("utf-8", errors="replace")
-        stderr = exc.stderr or "" if isinstance(exc.stderr, str) else (exc.stderr or b"").decode("utf-8", errors="replace")
-        return {
+        duration_ms = (time.time() - start_time) * 1000
+        
+        # Handle timeout output carefully
+        stdout = ""
+        stderr = ""
+        
+        if exc.stdout:
+            stdout = exc.stdout.decode('utf-8', errors='replace') if isinstance(exc.stdout, bytes) else str(exc.stdout)
+        if exc.stderr:
+            stderr = exc.stderr.decode('utf-8', errors='replace') if isinstance(exc.stderr, bytes) else str(exc.stderr)
+            
+        # Truncate timeout outputs
+        if len(stdout) > 10000:
+            stdout = stdout[:10000] + "... [truncated]"
+        if len(stderr) > 10000:
+            stderr = stderr[:10000] + "... [truncated]"
+        
+        result = {
             "success": False,
             "stdout": stdout,
             "stderr": f"Timeout after {timeout}s\n{stderr}",
             "returncode": -1,
             "timed_out": True,
             "command": command,
+            "cwd": cwd or ".",
+            "duration_ms": round(duration_ms, 1),
         }
+        
+        _log_command(command, result)
+        return result
+
     except Exception as exc:
-        return {
+        duration_ms = (time.time() - start_time) * 1000
+        
+        result = {
             "success": False,
             "stdout": "",
             "stderr": str(exc),
             "returncode": -1,
             "timed_out": False,
             "command": command,
+            "cwd": cwd or ".",
+            "duration_ms": round(duration_ms, 1),
         }
+        
+        _log_command(command, result)
+        return result
+
+
+def run_bash_streaming(
+    command: str,
+    cwd: str | None = None,
+    timeout: int = 30,
+    on_output: callable = None,
+) -> Iterator[str]:
+    """Run a shell command with streaming output.
+    
+    Yields output lines as they are produced.
+    
+    Args:
+        command: Shell command to execute.
+        cwd: Working directory.
+        timeout: Max seconds before killing.
+        on_output: Optional callback for each line of output.
+        
+    Yields:
+        Lines of output from the command.
+    """
+    try:
+        safe, reason = _is_safe_command(command)
+        if not safe:
+            yield f"Error: {reason}"
+            return
+
+        work_dir = _resolve_safe(cwd) if cwd else get_workspace_root()
+        env = {k: v for k, v in os.environ.items() if k not in _ENV_SCRUB}
+        env["PYTHONUNBUFFERED"] = "1"
+
+        process = subprocess.Popen(
+            ["bash", "-c", command],
+            cwd=work_dir,
+            env=env,
+            stdout=subprocess.PIPE,
+            stderr=subprocess.STDOUT,
+            text=True,
+            bufsize=1,
+        )
+
+        start_time = time.time()
+        
+        for line in process.stdout:
+            line = line.rstrip('\n')
+            if on_output:
+                on_output(line)
+            yield line
+            
+            # Check timeout
+            if time.time() - start_time > timeout:
+                process.kill()
+                yield f"\n[Timeout after {timeout}s]"
+                break
+
+        process.wait(timeout=5)
+        
+    except Exception as exc:
+        yield f"Error: {exc}"
+
+
+# Need Iterator type for streaming function
+from collections.abc import Iterator

requirements.txt

@@ -1,5 +1,11 @@
-# SoniCoder v2 — Optimized AI Code Agent
+# SoniCoder v2.1 — Enhanced AI Code Agent
 # Architecture inspired by Gemini CLI and Claude Code
+# 
+# Enhanced with:
+# - Better model support (DeepSeek Coder)
+# - Session management
+# - Export functionality
+# - Performance optimizations
 
 gradio==6.19.0
 transformers>=4.45.0
@@ -14,4 +20,16 @@ Pillow>=10.0
 mcp>=1.0.0
 
 # Optional: VLM support
-# torchvision>=0.16.0
+# torchvision>=0.16.0
+
+# Additional dependencies for enhanced features
+# Data processing
+pandas>=2.0.0
+numpy>=1.24.0
+
+# Web scraping enhancements
+lxml>=4.9.0
+
+# Type checking (optional, for development)
+# mypy>=1.0.0
+# types-requests>=2.28.0