chore(release): 1.19.4 [skip ci]

## [1.19.4](https://github.com/asepharyana/zesdex/compare/v1.19.3...v1.19.4) (2026-08-27)

### Bug Fixes

* **api:** model claude selalu pakai Opus dari settings.json, bukan deepseek ([9aca45c](https://github.com/asepharyana/zesdex/commit/9aca45cb65d6913d14fecc10d70c180934f69d74))

CHANGELOG.md

@@ -1,3 +1,24 @@
+## [1.19.4](https://github.com/asepharyana/zesdex/compare/v1.19.3...v1.19.4) (2026-08-27)
+
+
+### Bug Fixes
+
+* **api:** model claude selalu pakai Opus dari settings.json, bukan deepseek ([9aca45c](https://github.com/asepharyana/zesdex/commit/9aca45cb65d6913d14fecc10d70c180934f69d74))
+
+## [1.19.3](https://github.com/asepharyana/zesdex/compare/v1.19.2...v1.19.3) (2026-08-27)
+
+
+### Bug Fixes
+
+* **api:** model Opus pakai URL + API custom dari ~/.claude/settings.json ([1f91b44](https://github.com/asepharyana/zesdex/commit/1f91b447080e7106201d77585edb7d38b74e34bb))
+
+## [1.19.2](https://github.com/asepharyana/zesdex/compare/v1.19.1...v1.19.2) (2026-08-27)
+
+
+### Performance Improvements
+
+* **agent:** stabilkan async & parallel — satu runtime, bounded concurrency, isolasi error ([6a98d52](https://github.com/asepharyana/zesdex/commit/6a98d52d54a69f78710d852a69dda3ac0a4ead31))
+
 ## [1.19.1](https://github.com/asepharyana/zesdex/compare/v1.19.0...v1.19.1) (2026-08-27)
 
 

Cargo.lock

@@ -4862,7 +4862,7 @@ dependencies = [
 
 [[package]]
 name = "zesdex-api"
-version = "1.18.4"
+version = "1.19.2"
 dependencies = [
  "anyhow",
  "argon2",
@@ -4885,7 +4885,7 @@ dependencies = [
 
 [[package]]
 name = "zesdex-application"
-version = "1.18.4"
+version = "1.19.2"
 dependencies = [
  "anyhow",
  "base64",
@@ -4902,7 +4902,7 @@ dependencies = [
 
 [[package]]
 name = "zesdex-bootstrap"
-version = "1.18.4"
+version = "1.19.2"
 dependencies = [
  "anyhow",
  "chrono",
@@ -4919,7 +4919,7 @@ dependencies = [
 
 [[package]]
 name = "zesdex-daemon"
-version = "1.18.4"
+version = "1.19.2"
 dependencies = [
  "anyhow",
  "base64",
@@ -4943,7 +4943,7 @@ dependencies = [
 
 [[package]]
 name = "zesdex-domain"
-version = "1.18.4"
+version = "1.19.2"
 dependencies = [
  "anyhow",
  "base64",
@@ -4959,7 +4959,7 @@ dependencies = [
 
 [[package]]
 name = "zesdex-gateway"
-version = "1.18.4"
+version = "1.19.2"
 dependencies = [
  "anyhow",
  "axum",
@@ -4986,7 +4986,7 @@ dependencies = [
 
 [[package]]
 name = "zesdex-grpc"
-version = "1.18.4"
+version = "1.19.2"
 dependencies = [
  "anyhow",
  "axum",
@@ -5003,7 +5003,7 @@ dependencies = [
 
 [[package]]
 name = "zesdex-infrastructure"
-version = "1.18.4"
+version = "1.19.2"
 dependencies = [
  "anyhow",
  "argon2",
@@ -5051,7 +5051,7 @@ dependencies = [
 
 [[package]]
 name = "zesdex-tui"
-version = "1.18.4"
+version = "1.19.2"
 dependencies = [
  "anyhow",
  "base64",
@@ -5077,7 +5077,7 @@ dependencies = [
 
 [[package]]
 name = "zesdex-web"
-version = "1.18.4"
+version = "1.19.2"
 dependencies = [
  "anyhow",
  "axum",
@@ -5097,7 +5097,7 @@ dependencies = [
 
 [[package]]
 name = "zesdex-ws"
-version = "1.18.4"
+version = "1.19.2"
 dependencies = [
  "anyhow",
  "axum",

Cargo.toml

@@ -15,7 +15,7 @@ members = [
 ]
 
 [workspace.package]
-version = "1.19.1"
+version = "1.19.4"
 edition = "2021"
 authors = ["asepharyana <superaseph@gmail.com>"]
 

apps/domain/src/cms/mod.rs

@@ -47,6 +47,7 @@ pub use repository::SettingsRepository;
 pub use service::ConversationService;
 pub use service::MemoryService;
 pub use service::SettingsService;
+pub use settings::resolve_effective_model;
 pub use settings::InternetMode;
 pub use settings::Settings;
 pub use settings::SettingsFlags;

apps/domain/src/cms/settings.rs

@@ -23,6 +23,8 @@ use std::collections::HashMap;
 
 use serde::{Deserialize, Serialize};
 
+use super::app_config::AppConfig;
+
 /// Controls how much network access the agent is permitted during a session.
 ///
 /// ## Variants
@@ -112,3 +114,86 @@ impl Default for Settings {
         }
     }
 }
+
+/// Pick the effective model name for the main agent.
+///
+/// When `settings.provider` is `"claude"` (auto-detected from
+/// `~/.claude/settings.json`), the provider's `default_model` (or the
+/// app-level `default_model`) wins over a possibly-stale persisted
+/// `settings.model`. Otherwise the user's explicit `settings.model` is used.
+///
+/// Why: the user's custom Claude endpoint (URL + API key from
+/// `~/.claude/settings.json`) implies Opus as the model; a stale
+/// `settings.json` (e.g. "deepseek-v4-flash-free") must not override it.
+pub fn resolve_effective_model(settings: &Settings, app_config: &AppConfig) -> String {
+    if settings.provider == "claude" {
+        if let Some(m) = app_config
+            .providers
+            .get("claude")
+            .and_then(|p| p.default_model.clone())
+        {
+            return m;
+        }
+        return app_config.default_model.clone();
+    }
+    settings.model.clone()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::cms::app_config::AppConfig;
+
+    fn claude_app_config() -> AppConfig {
+        let mut cfg = AppConfig::default();
+        cfg.providers.insert(
+            "claude".to_string(),
+            crate::cms::ProviderConfig {
+                api_base: "https://9router.example/v1".to_string(),
+                api_key_env: Some("ANTHROPIC_API_KEY".to_string()),
+                default_model: Some("claude-opus-4-8".to_string()),
+                default_api_key: Some("sk-test".to_string()),
+            },
+        );
+        cfg.default_provider = "claude".to_string();
+        cfg.default_model = "claude-opus-4-8".to_string();
+        cfg
+    }
+
+    #[test]
+    fn claude_provider_uses_opus_model_over_stale_settings_model() {
+        let settings = Settings {
+            provider: "claude".to_string(),
+            model: "deepseek-v4-flash-free".to_string(), // stale persisted
+            ..Settings::default()
+        };
+
+        let model = resolve_effective_model(&settings, &claude_app_config());
+        assert_eq!(model, "claude-opus-4-8");
+    }
+
+    #[test]
+    fn non_claude_provider_uses_settings_model() {
+        let settings = Settings {
+            provider: "zen".to_string(),
+            model: "my-model".to_string(),
+            ..Settings::default()
+        };
+
+        let model = resolve_effective_model(&settings, &AppConfig::default());
+        assert_eq!(model, "my-model");
+    }
+
+    #[test]
+    fn claude_falls_back_to_app_default() {
+        let settings = Settings {
+            provider: "claude".to_string(),
+            model: String::new(),
+            ..Settings::default()
+        };
+
+        let cfg = AppConfig::default();
+        let model = resolve_effective_model(&settings, &cfg);
+        assert_eq!(model, cfg.default_model);
+    }
+}

apps/infrastructure/src/best_practice/explore.rs

@@ -15,7 +15,7 @@
 //!    read of up to 3 relevant files).
 //! 4. Join the result and return a concise bullet summary as a tool message.
 
-use anyhow::{Context, Result};
+use anyhow::Result;
 use serde_json::{json, Value};
 use tracing::{info, warn};
 
@@ -118,7 +118,7 @@ impl Tool for ExploreCodebase {
             model,
         );
 
-        let rt = tokio::runtime::Runtime::new().context("create explore tokio runtime")?;
+        let rt = crate::runtime::runtime();
         let result = rt.block_on(run_agent(
             subagent_ctx,
             &directive,

apps/infrastructure/src/lib.rs

@@ -34,6 +34,7 @@ pub mod llm;
 pub mod mcp;
 pub mod middleware;
 pub mod persistence;
+pub mod runtime;
 pub mod subagent;
 pub mod tools;
 pub mod utils;

apps/infrastructure/src/persistence/cms/app_config_repo.rs

@@ -72,6 +72,55 @@ fn detect_claude_settings_provider() -> Option<(ProviderConfig, Option<String>)>
     ))
 }
 
+/// Apply a detected Claude provider + custom model onto an `AppConfig`.
+///
+/// Pure (no I/O) so it can be unit-tested. Flow:
+///   1. Always `insert`s the "claude" provider (refreshing a possibly stale
+///      persisted entry with the current base URL + key from settings.json).
+///   2. Registers known Claude model roles if missing.
+///   3. Always sets `default_provider = "claude"` and
+///      `default_model = custom_model.unwrap_or("claude-opus-4-8")` so Opus
+///      is the default whenever `~/.claude/settings.json` is present.
+fn apply_claude_provider(
+    cfg: &mut AppConfig,
+    claude_provider: ProviderConfig,
+    custom_model: Option<String>,
+) {
+    cfg.providers.insert("claude".to_string(), claude_provider);
+
+    let claude_models: [(&str, &str); 3] = [
+        ("claude-opus-4-8", "claude-opus-4-8"),
+        ("claude-sonnet-5", "claude-sonnet-5"),
+        ("claude-haiku-4-5", "claude-haiku-4-5-20251001"),
+    ];
+    for (role_name, model_name) in &claude_models {
+        cfg.model_roles
+            .entry(role_name.to_string())
+            .or_insert(ModelRole {
+                provider: "claude".to_string(),
+                model: model_name.to_string(),
+                max_tokens: Some(8192),
+                context_window: Some(200_000),
+                temperature: Some(0.7),
+            });
+    }
+
+    if let Some(custom) = &custom_model {
+        cfg.model_roles.entry(custom.clone()).or_insert(ModelRole {
+            provider: "claude".to_string(),
+            model: custom.clone(),
+            max_tokens: Some(8192),
+            context_window: Some(200_000),
+            temperature: Some(0.7),
+        });
+    }
+
+    // Always prefer the Claude provider + Opus model when settings.json
+    // is present — this is the user's explicit custom endpoint choice.
+    cfg.default_provider = "claude".to_string();
+    cfg.default_model = custom_model.unwrap_or_else(|| "claude-opus-4-8".to_string());
+}
+
 impl AppConfigRepository for JsonAppConfigRepository {
     fn load(&self, base_dir: &Path) -> Result<AppConfig, RepositoryError> {
         let path = base_dir.join("app_config.json");
@@ -87,41 +136,7 @@ impl AppConfigRepository for JsonAppConfigRepository {
         }
 
         if let Some((claude_provider, custom_model)) = detect_claude_settings_provider() {
-            cfg.providers
-                .entry("claude".to_string())
-                .or_insert(claude_provider);
-
-            let claude_models: [(&str, &str); 3] = [
-                ("claude-opus-4-8", "claude-opus-4-8"),
-                ("claude-sonnet-5", "claude-sonnet-5"),
-                ("claude-haiku-4-5", "claude-haiku-4-5-20251001"),
-            ];
-            for (role_name, model_name) in &claude_models {
-                cfg.model_roles
-                    .entry(role_name.to_string())
-                    .or_insert(ModelRole {
-                        provider: "claude".to_string(),
-                        model: model_name.to_string(),
-                        max_tokens: Some(8192),
-                        context_window: Some(200_000),
-                        temperature: Some(0.7),
-                    });
-            }
-
-            if let Some(custom) = &custom_model {
-                cfg.model_roles.entry(custom.clone()).or_insert(ModelRole {
-                    provider: "claude".to_string(),
-                    model: custom.clone(),
-                    max_tokens: Some(8192),
-                    context_window: Some(200_000),
-                    temperature: Some(0.7),
-                });
-            }
-
-            if cfg.default_provider == defaults.default_provider {
-                cfg.default_provider = "claude".to_string();
-                cfg.default_model = custom_model.unwrap_or_else(|| "claude-opus-4-8".to_string());
-            }
+            apply_claude_provider(&mut cfg, claude_provider, custom_model);
         }
 
         Ok(cfg)
@@ -134,3 +149,106 @@ impl AppConfigRepository for JsonAppConfigRepository {
         Ok(())
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::collections::HashMap;
+
+    fn claude_provider(base: &str, key: Option<&str>) -> ProviderConfig {
+        ProviderConfig {
+            api_base: base.to_string(),
+            api_key_env: Some("ANTHROPIC_API_KEY".to_string()),
+            default_model: Some("claude-opus-4-8".to_string()),
+            default_api_key: key.map(|s| s.to_string()),
+        }
+    }
+
+    #[test]
+    fn claude_settings_parse_env() {
+        let parsed: ClaudeSettings = serde_json::from_str(
+            r#"{"env":{"ANTHROPIC_BASE_URL":"https://9router.example/v1","ANTHROPIC_API_KEY":"sk-test"}}"#,
+        )
+        .unwrap();
+        let env = parsed.env.unwrap();
+        assert_eq!(
+            env.anthropic_base_url.as_deref(),
+            Some("https://9router.example/v1")
+        );
+        assert_eq!(env.anthropic_api_key.as_deref(), Some("sk-test"));
+    }
+
+    #[test]
+    fn apply_claude_refreshes_stale_provider_and_sets_opus_default() {
+        // Simulate a previously-persisted app_config.json with a STALE claude
+        // provider + non-opus default (e.g. user had switched provider).
+        let mut cfg = AppConfig {
+            providers: {
+                let mut m = HashMap::new();
+                m.insert(
+                    "claude".to_string(),
+                    claude_provider("https://old.example/v1", Some("sk-old")),
+                );
+                m
+            },
+            model_roles: HashMap::new(),
+            default_provider: "router".to_string(),
+            default_model: "other-model".to_string(),
+            default_context_window: 256_000,
+        };
+
+        // Detect returned a fresh provider from ~/.claude/settings.json.
+        apply_claude_provider(
+            &mut cfg,
+            claude_provider("https://9router.example/v1", Some("sk-new")),
+            None,
+        );
+
+        let claude = cfg.providers.get("claude").unwrap();
+        assert_eq!(claude.api_base, "https://9router.example/v1");
+        assert_eq!(claude.default_api_key.as_deref(), Some("sk-new"));
+        // Insert (not or_insert) → stale entry refreshed.
+        assert_eq!(cfg.default_provider, "claude");
+        assert_eq!(cfg.default_model, "claude-opus-4-8");
+
+        // Claude model roles registered.
+        assert!(cfg.model_roles.contains_key("claude-opus-4-8"));
+        assert!(cfg.model_roles.contains_key("claude-sonnet-5"));
+        assert!(cfg.model_roles.contains_key("claude-haiku-4-5"));
+    }
+
+    #[test]
+    fn apply_claude_honors_custom_model_from_settings() {
+        let mut cfg = AppConfig::default();
+        apply_claude_provider(
+            &mut cfg,
+            claude_provider("https://9router.example/v1", Some("sk-new")),
+            Some("claude-opus-4-8".to_string()),
+        );
+        assert_eq!(cfg.default_model, "claude-opus-4-8");
+        assert!(cfg.model_roles.contains_key("claude-opus-4-8"));
+    }
+
+    #[test]
+    fn detect_uses_env_creds_as_fallback() {
+        // When ~/.claude/settings.json is absent/unreadable, the env-var
+        // fallback should produce a "claude" provider. Set env vars, call
+        // detect, and assert the resulting provider uses them.
+        std::env::set_var("ANTHROPIC_BASE_URL", "https://env.example/v1");
+        std::env::set_var("ANTHROPIC_API_KEY", "sk-env");
+        match detect_claude_settings_provider() {
+            Some((provider, _custom)) => {
+                // If the real settings.json exists it wins (base could be the
+                // real 9router URL); otherwise env creds are used. Either way,
+                // the provider must have api_key_env pointing at ANTHROPIC_API_KEY.
+                assert_eq!(provider.api_key_env.as_deref(), Some("ANTHROPIC_API_KEY"));
+            }
+            None => {
+                // No file + no env (shouldn't happen since we just set env).
+                panic!("expected env fallback to produce a provider");
+            }
+        }
+        std::env::remove_var("ANTHROPIC_BASE_URL");
+        std::env::remove_var("ANTHROPIC_API_KEY");
+    }
+}

apps/infrastructure/src/runtime.rs

@@ -0,0 +1,62 @@
+//! Process-wide shared Tokio runtime for sync → async bridging.
+//!
+//! Many `Tool::run` implementations are synchronous but need to drive async
+//! work (LLM calls, subagent execution). Creating a fresh
+//! [`tokio::runtime::Runtime`] on every call is expensive (spawns a thread
+//! pool + runtime each time) and can fail randomly under thread pressure.
+//!
+//! # Flow
+//!
+//! [`runtime()`] returns a lazily-initialised process-wide runtime created
+//! exactly once via [`std::sync::OnceLock`]. Callers use
+//! `runtime().block_on(...)` exactly like they would with a local runtime —
+//! the only difference is the runtime is shared, so the cost is paid once per
+//! process instead of once per tool call.
+//!
+//! # Safety
+//!
+//! `block_on` panics if called from within a running Tokio runtime. The
+//! tools that use this helper are synchronous (`Tool::run`), so this is safe
+//! in practice. Async code should never call `runtime().block_on`.
+
+use std::sync::OnceLock;
+
+/// Maximum worker threads for the shared runtime. Kept modest — tools are
+/// mostly I/O-bound and rarely need more concurrency than this.
+const RUNTIME_WORKER_THREADS: usize = 8;
+
+static SHARED_RUNTIME: OnceLock<tokio::runtime::Runtime> = OnceLock::new();
+
+/// Return the process-wide shared Tokio runtime, initialising it on first use.
+///
+/// The runtime is configured with `worker_threads = 8` and
+/// `enable_all()` (time + IO drivers) so streams, timers, and network calls
+/// all work. If initialisation fails (extremely rare — resource exhaustion at
+/// startup), the process aborts with a clear message rather than returning
+/// an error on every subsequent call.
+pub fn runtime() -> &'static tokio::runtime::Runtime {
+    SHARED_RUNTIME.get_or_init(|| {
+        tokio::runtime::Builder::new_multi_thread()
+            .worker_threads(RUNTIME_WORKER_THREADS)
+            .thread_name("zesdex-shared-rt")
+            .enable_all()
+            .build()
+            .expect("failed to create shared tokio runtime")
+    })
+}
+
+#[cfg(test)]
+mod tests {
+    use super::runtime;
+
+    #[test]
+    fn runtime_is_singleton() {
+        assert!(std::ptr::eq(runtime(), runtime()));
+    }
+
+    #[test]
+    fn runtime_blocks_and_resolves() {
+        let val = runtime().block_on(async { 6 * 7 });
+        assert_eq!(val, 42);
+    }
+}

apps/infrastructure/src/subagent/engine.rs

@@ -23,6 +23,37 @@ use zesdex_domain::subagent_directive;
 /// Maximum number of tool-call iterations before the engine gives up.
 const MAX_ITERATIONS: u32 = 25;
 
+/// A single tool-result message is truncated before entering the subagent's
+/// context so it cannot blow the window (matches the main turn service).
+const TOOL_OUTPUT_MAX_CHARS: usize = 12_000;
+
+/// Maximum consecutive identical tool errors before the engine injects a
+/// recovery note steering the model to a different approach.
+const MAX_CONSECUTIVE_TOOL_ERRORS: usize = 3;
+
+/// Pick a `max_tokens` budget proportional to the directive's length.
+fn adaptive_max_tokens(directive_len: usize) -> u32 {
+    if directive_len <= 80 {
+        800
+    } else if directive_len <= 400 {
+        1600
+    } else {
+        4096
+    }
+}
+
+fn truncate_tool_output(output: String) -> String {
+    if output.len() <= TOOL_OUTPUT_MAX_CHARS {
+        return output;
+    }
+    let mut result: String = output.chars().take(TOOL_OUTPUT_MAX_CHARS).collect();
+    result.push_str(&format!(
+        "\n...[truncated {} chars]",
+        output.len() - TOOL_OUTPUT_MAX_CHARS
+    ));
+    result
+}
+
 /// Emit an `AgentProgress` event onto the turn-event queue, if one is
 /// configured in the `ToolCtx`.
 fn report_progress(tool_ctx: &ToolCtx, progress: AgentProgress) {
@@ -85,11 +116,17 @@ pub async fn run_agent(
         Some(ctx.base_url.clone()),
     );
 
+    let max_tokens = adaptive_max_tokens(directive.len());
+
+    // Track repeated tool errors so the agent can recover from a dead end.
+    let mut consecutive_errors = 0usize;
+    let mut last_tool = String::new();
+
     // Limited iteration loop so we don't run forever
     for iteration in 0..MAX_ITERATIONS {
         use zesdex_application::ports::ProviderService;
         let (response_msg, _usage) = client
-            .chat(&messages, Some(defs.clone()), Some(4096), None)
+            .chat(&messages, Some(defs.clone()), Some(max_tokens), Some(0.2))
             .await?;
 
         let content = response_msg.content.clone().unwrap_or_default();
@@ -113,7 +150,7 @@ pub async fn run_agent(
                 &tool_ctx,
                 AgentProgress::running(
                     "subagent",
-                    format!("{}:{}", directive, tool_name),
+                    format!("{}:{tool_name}", directive),
                     Some(tool_name.clone()),
                 ),
             );
@@ -127,7 +164,29 @@ pub async fn run_agent(
                 format!("Unknown tool: {tool_name}")
             };
 
-            messages.push(ChatMessage::tool(tc.id.clone(), result));
+            // Error-recovery: if the same tool keeps failing, inject a
+            // system note steering the model to a different approach.
+            if result.starts_with("Error:") {
+                if last_tool.as_str() == tool_name.as_str() {
+                    consecutive_errors += 1;
+                } else {
+                    consecutive_errors = 1;
+                    last_tool = tool_name.to_string();
+                }
+                if consecutive_errors >= MAX_CONSECUTIVE_TOOL_ERRORS {
+                    messages.push(ChatMessage::system(
+                        zesdex_domain::agent::prompt::error_recovery_note(tool_name, &result),
+                    ));
+                    consecutive_errors = 0;
+                }
+            } else {
+                consecutive_errors = 0;
+            }
+
+            messages.push(ChatMessage::tool(
+                tc.id.clone(),
+                truncate_tool_output(result),
+            ));
         }
 
         // Add assistant response if there was text content

apps/infrastructure/src/subagent/provider.rs

@@ -63,15 +63,21 @@ impl SubagentProvider {
 
 /// Resolve subagent provider and model from settings.
 ///
-/// Flow: reads `settings.provider` and `settings.model` → if model is empty,
+/// Flow: reads `settings.provider` and `settings.model` → if provider is
+/// empty, falls back to `app_config.default_provider` → if model is empty,
 /// falls back to the provider config's `default_model` → if that is also
-/// empty, uses the domain default model constant.
+/// empty, uses `app_config.default_model` → finally the domain default model
+/// constant.
 #[instrument]
 pub fn resolve_subagent_provider(
     settings: &zesdex_domain::cms::Settings,
     app_config: &zesdex_domain::cms::AppConfig,
 ) -> (String, String) {
-    let provider = settings.provider.clone();
+    let provider = if settings.provider.is_empty() {
+        app_config.default_provider.clone()
+    } else {
+        settings.provider.clone()
+    };
     let model = settings.model.clone();
 
     // Use the default model from the provider config if available
@@ -80,6 +86,7 @@ pub fn resolve_subagent_provider(
             .providers
             .get(&provider)
             .and_then(|p| p.default_model.clone())
+            .or_else(|| Some(app_config.default_model.clone()))
             .unwrap_or_else(|| zesdex_domain::agent::defaults::DEFAULT_MODEL.to_string())
     } else {
         model

apps/infrastructure/src/subagent/spawn.rs

@@ -32,7 +32,6 @@ pub fn spawn_subagent(
 ) -> thread::JoinHandle<Result<String>> {
     info!("Spawning subagent: {directive}");
     thread::spawn(move || {
-        let rt = tokio::runtime::Runtime::new()?;
-        rt.block_on(run_agent(ctx, &directive, access, tool_ctx))
+        crate::runtime::runtime().block_on(run_agent(ctx, &directive, access, tool_ctx))
     })
 }

apps/infrastructure/src/tools/parallel_delegate.rs

@@ -123,7 +123,7 @@ impl Tool for ParallelDelegate {
                 .collect()
         } else {
             // Auto-split using LLM
-            let rt = tokio::runtime::Runtime::new()?;
+            let rt = crate::runtime::runtime();
             let directives = rt.block_on(auto_split_task(
                 &task,
                 max_parallel,
@@ -146,49 +146,53 @@ impl Tool for ParallelDelegate {
             "parallel delegation: starting subagents"
         );
 
-        // Spawn agents in parallel
-        let mut handles = Vec::new();
-        for (i, (directive, access)) in directives.iter().enumerate() {
-            let subagent_ctx = SubagentContext::new(
-                directive.clone(),
-                ctx.clone(),
-                format!("{access:?}"),
-                base_url.clone(),
-                api_key.clone(),
-                model.clone(),
-            );
-
-            debug!(agent_index = i, access = ?access, "spawning parallel agent");
-            let handle = spawn_subagent(subagent_ctx, directive.clone(), *access, ctx.clone());
-            handles.push((i, handle));
-        }
-
-        // Join all results
+        // Spawn agents in parallel — bounded: never more than `max_parallel`
+        // subagent threads in flight at once (Claude Code-style isolation).
         let mut results: Vec<(usize, String, String)> = Vec::new();
-        for (i, handle) in handles {
-            match handle.join() {
-                Ok(Ok(output)) => {
-                    info!(agent_index = i, "parallel agent completed");
-                    results.push((i, directives[i].0.clone(), output));
-                }
-                Ok(Err(e)) => {
-                    warn!(agent_index = i, error = %e, "parallel agent failed");
-                    results.push((i, directives[i].0.clone(), format!("[ERROR] {e}")));
-                }
-                Err(e) => {
-                    warn!(agent_index = i, error = ?e, "parallel agent panicked");
-                    results.push((
-                        i,
-                        directives[i].0.clone(),
-                        "[ERROR] Agent panicked".to_string(),
-                    ));
+        for batch in directives.chunks(max_parallel) {
+            let mut handles = Vec::with_capacity(batch.len());
+            for (i, (directive, access)) in batch.iter().enumerate() {
+                let global_idx = results.len() + i;
+                let subagent_ctx = SubagentContext::new(
+                    directive.clone(),
+                    ctx.clone(),
+                    format!("{access:?}"),
+                    base_url.clone(),
+                    api_key.clone(),
+                    model.clone(),
+                );
+
+                debug!(agent_index = global_idx, access = ?access, "spawning parallel agent");
+                let handle = spawn_subagent(subagent_ctx, directive.clone(), *access, ctx.clone());
+                handles.push((global_idx, handle));
+            }
+
+            // Join this batch before spawning the next.
+            for (i, handle) in handles {
+                match handle.join() {
+                    Ok(Ok(output)) => {
+                        info!(agent_index = i, "parallel agent completed");
+                        results.push((i, directives[i].0.clone(), output));
+                    }
+                    Ok(Err(e)) => {
+                        warn!(agent_index = i, error = %e, "parallel agent failed");
+                        results.push((i, directives[i].0.clone(), format!("[ERROR] {e}")));
+                    }
+                    Err(e) => {
+                        warn!(agent_index = i, error = ?e, "parallel agent panicked");
+                        results.push((
+                            i,
+                            directives[i].0.clone(),
+                            "[ERROR] Agent panicked".to_string(),
+                        ));
+                    }
                 }
             }
         }
 
         // Consolidate results
         if synthesize && results.len() > 1 {
-            let rt = tokio::runtime::Runtime::new()?;
+            let rt = crate::runtime::runtime();
             let consolidated =
                 rt.block_on(consolidate_results(&results, &base_url, &api_key, &model))?;
             Ok(format!(

apps/infrastructure/src/tools/utility/dir_cache_update.rs

@@ -63,7 +63,7 @@ impl crate::tools::Tool for DirCacheUpdate {
         // Persist the resolved paths into the shared DirCache so the TUI
         // and other tools can read the cached listing without re-scanning.
         let dc = ctx.dir_cache.clone();
-        let rt = tokio::runtime::Runtime::new()?;
+        let rt = crate::runtime::runtime();
         rt.block_on(async { dc.write().await.set(resolved).await });
 
         info!(count, "directory cache updated");

apps/infrastructure/src/tools/workflow.rs

@@ -65,7 +65,7 @@ impl Tool for WorkflowRun {
             zesdex_domain::agent::defaults::DEFAULT_MODEL.to_string(),
             None,
         );
-        let rt = tokio::runtime::Runtime::new()?;
+        let rt = crate::runtime::runtime();
         let result: Vec<String> =
             rt.block_on(async { execute_workflow(&script, ctx, &llm_client).await })?;
 
@@ -229,7 +229,7 @@ impl Tool for HiveMind {
             .ok_or_else(|| anyhow::anyhow!("missing 'cycles' array"))?;
 
         info!("Hive mind starting with {} cycles", cycles_val.len());
-        let rt = tokio::runtime::Runtime::new()?;
+        let rt = crate::runtime::runtime();
         let mut all_node_outputs = Vec::new();
 
         for (cycle_idx, cycle_val) in cycles_val.iter().enumerate() {

apps/infrastructure/src/workflow/hive_mind/cycle.rs

@@ -1,11 +1,15 @@
 //! Hive-mind cycle execution — run one cycle of parallel nodes.
 //!
 //! Flow: load settings → resolve LLM credentials → run all directives in the
-//! cycle concurrently via try_join_all → collect Vec<NodeOutput>.
+//! cycle concurrently via a BOUNDED buffer (`buffer_unordered(MAX)`) → collect
+//! `Vec<NodeOutput>`. Unlike `try_join_all`, a single failing node does NOT
+//! fail the whole cycle — failed nodes are logged and replaced with an
+//! `[ERROR]` output so the remaining results are preserved (like Claude
+//! Code's isolated subagents).
 
 use anyhow::Result;
-use futures_util::future::try_join_all;
-use tracing::info;
+use futures_util::stream::StreamExt;
+use tracing::{info, warn};
 
 use zesdex_domain::cms::{AppConfigRepository, SettingsRepository};
 use zesdex_domain::core::Store;
@@ -15,16 +19,21 @@ use crate::subagent::context::SubagentContext;
 use crate::subagent::division::AccessTier;
 use crate::subagent::engine::run_agent;
 use crate::tools::ToolCtx;
-use zesdex_domain::workflow::{CognitiveCycle, NodeOutput};
+use zesdex_domain::workflow::{CognitiveCycle, NodeDirective, NodeOutput};
+
+/// Maximum number of hive-mind nodes running concurrently per cycle.
+/// Keeps thread/runtime pressure bounded (Claude Code-style).
+const MAX_CONCURRENT_NODES: usize = 8;
 
 /// Execute one cycle: run each node directive and collect outputs.
 ///
 /// Flow:
 ///   1. Load `Settings` and `AppConfig` from the store directory.
 ///   2. Resolve provider, model, base_url, and api_key.
-///   3. Spawn all directives concurrently — each builds a `SubagentContext`
-///      and calls `run_agent` (Full access).
-///   4. `try_join_all` waits for all to complete, then collect `NodeOutput`s.
+///   3. Spawn directives with bounded concurrency — each builds a
+///      `SubagentContext` and calls `run_agent`.
+///   4. Collect `NodeOutput`s; failed nodes are logged and replaced with an
+///      `[ERROR]` placeholder so the cycle still completes.
 pub async fn execute_cycle(cycle: &CognitiveCycle, tool_ctx: &ToolCtx) -> Result<Vec<NodeOutput>> {
     info!(
         "Executing cycle {} with {} directives",
@@ -53,10 +62,9 @@ pub async fn execute_cycle(cycle: &CognitiveCycle, tool_ctx: &ToolCtx) -> Result
 
     let cycle_index = cycle.index;
 
-    use zesdex_domain::workflow::NodeDirective;
-
-    // Run all directives in this cycle concurrently.
-    let handles: Vec<_> = cycle
+    // Run all directives with bounded concurrency. Each node is its own
+    // future; failures are collected, not propagated (isolated errors).
+    let tasks: Vec<_> = cycle
         .directives
         .iter()
         .enumerate()
@@ -79,18 +87,33 @@ pub async fn execute_cycle(cycle: &CognitiveCycle, tool_ctx: &ToolCtx) -> Result
                 _ => AccessTier::Read,
             };
 
+            let node_id = format!("Node-{}-{}", cycle_index, i);
             async move {
-                let result = run_agent(ctx, &dir, access, tc).await?;
-                Ok::<NodeOutput, anyhow::Error>(NodeOutput {
-                    id: format!("Node-{}-{}", cycle_index, i),
-                    directive: dir,
-                    output: result,
-                })
+                match run_agent(ctx, &dir, access, tc).await {
+                    Ok(output) => Ok::<NodeOutput, anyhow::Error>(NodeOutput {
+                        id: node_id.clone(),
+                        directive: dir,
+                        output,
+                    }),
+                    Err(e) => {
+                        warn!(node = %node_id, error = %e, "hive-mind node failed (isolated)");
+                        Ok::<NodeOutput, anyhow::Error>(NodeOutput {
+                            id: node_id,
+                            directive: dir,
+                            output: format!("[ERROR] {e}"),
+                        })
+                    }
+                }
             }
         })
         .collect();
 
-    let results = try_join_all(handles).await?;
+    // Bounded concurrency: run at most MAX_CONCURRENT_NODES futures at once.
+    let mut stream = futures_util::stream::iter(tasks).buffer_unordered(MAX_CONCURRENT_NODES);
+    let mut results = Vec::with_capacity(cycle.directives.len());
+    while let Some(node) = stream.next().await {
+        results.push(node?);
+    }
 
     Ok(results)
 }

apps/interfaces/daemon/src/handler.rs

@@ -316,13 +316,13 @@ fn handle_submit_input(state: &mut AppStateRest, text: String) {
         in_flight: std::sync::Arc::new(std::sync::atomic::AtomicBool::new(false)),
         abort: state.abort_flag.clone(),
         api_key: api_key.clone(),
-        model: state.settings.model.clone(),
+        model: zesdex_domain::cms::resolve_effective_model(&state.settings, &state.app_config),
         api_base: provider_cfg.as_ref().map(|cfg| cfg.api_base.clone()),
     };
 
     let client = std::sync::Arc::new(zesdex_infrastructure::llm::provider::LlmClient::new(
         api_key,
-        state.settings.model.clone(),
+        zesdex_domain::cms::resolve_effective_model(&state.settings, &state.app_config),
         provider_cfg.map(|cfg| cfg.api_base.clone()),
     ));
 
@@ -465,14 +465,13 @@ fn handle_compact(state: &mut AppStateRest) {
         .get(provider_name)
         .cloned()
         .unwrap_or_default();
-    let model = state.settings.model.clone();
+    let model = zesdex_domain::cms::resolve_effective_model(&state.settings, &state.app_config);
     let api_base = provider_cfg.map(|cfg| cfg.api_base.clone());
 
     let client = zesdex_infrastructure::llm::provider::LlmClient::new(api_key, model, api_base);
 
     if let Some(ref mut rt) = state.session_runtime {
-        let tokio_rt =
-            tokio::runtime::Runtime::new().expect("create tokio runtime for AI compaction");
+        let tokio_rt = zesdex_infrastructure::runtime::runtime();
         if let Ok(()) = tokio_rt.block_on(
             zesdex_application::agent::turn_service::compact_messages_with_ai(
                 &mut rt.messages,

apps/interfaces/tui/src/turn.rs

@@ -80,7 +80,7 @@ pub fn spawn_agent_turn(state: &mut AppStateRest, text: String) {
     // ── Resolve provider configuration ─────────────────────────────────
     let provider_name = &state.settings.provider;
     let api_key = resolve_api_key(state, provider_name);
-    let model = state.settings.model.clone();
+    let model = zesdex_domain::cms::resolve_effective_model(&state.settings, &state.app_config);
     let api_base = resolve_api_base(state, provider_name);
 
     // ── Build message list ─────────────────────────────────────────────