fix: reasoning models

.claude/ledger/2026-05-19-MEMORY-vault-top-level.md

@@ -0,0 +1,11 @@
+# Memory Ledger — vault-top-level
+
+- **Goal:** Move Vault from `/settings/vault` (Settings sub-page) to top-level `/vault` page under SYSTEM sidebar category, below Sandbox. Hard cut (no redirect/alias). Success = `make verify` green + sidebar shows Vault below Sandbox + old route gone.
+- **Constraints/Assumptions:** Greenfield zero-legacy. `useSettingsPage` spread in vault hook is dead → remove. Icon=KeyRound. PageShell density="route". Test IDs hard-rename settings-page-vault-_ → vault-page-_, settings-vault-_ → vault-_. E2E consolidate into vault.spec.ts.
+- **Key decisions:** Plan approved (.claude/plans/we-need-to-move-optimized-yao.md). No RestartBanner. 4 MDX doc files prose update.
+- **State:**
+- **Done:** Plan approved.
+- **Now:** Implementing route + hook move.
+- **Next:** sidebar, settings types, tests, docs, verify.
+- **Open questions:** none
+- **Working set:** web/src/routes/\_app/vault.tsx, web/src/hooks/routes/use-vault-page.ts, web/src/systems/runtime/components/app-sidebar.tsx, web/src/systems/settings/types.ts + lib/sections.ts, web/src/routes/\_app/**tests**/-vault.test.tsx, web/e2e/**tests**/{vault,settings-hardening}.spec.ts, web/e2e/fixtures/browser-artifact-session.ts

.github/actions/setup-go/action.yml

@@ -43,4 +43,4 @@ runs:
       run: |-
         echo "Installing Go development tools..."
         go install gotest.tools/gotestsum@latest
-        curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/HEAD/install.sh | sh -s -- -b "$(go env GOPATH)/bin" v2.11.4
+        curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/HEAD/install.sh | sh -s -- -b "$(go env GOPATH)/bin" v2.12.2

internal/acp/client_test.go

@@ -2304,7 +2304,7 @@ func (a *helperACPAgent) Prompt(ctx context.Context, params acpsdk.PromptRequest
 			SessionId: params.SessionId,
 			Command:   "sh",
 			Args:      []string{"-c", "printf terminal-ok"},
-			Cwd:       acpsdk.Ptr(cwd),
+			Cwd:       new(cwd),
 		})
 		if err != nil {
 			return acpsdk.PromptResponse{}, err
@@ -2411,7 +2411,7 @@ func (a *helperACPAgent) Prompt(ctx context.Context, params acpsdk.PromptRequest
 			SessionId: params.SessionId,
 			Command:   "agh",
 			Args:      []string{"network", "status"},
-			Cwd:       acpsdk.Ptr(cwd),
+			Cwd:       new(cwd),
 		})
 		if err != nil {
 			return acpsdk.PromptResponse{}, err

internal/acp/handlers_test.go

@@ -227,8 +227,8 @@ func TestHandleInboundReadWriteFile(t *testing.T) {
 		mustMarshalJSON(acpsdk.ReadTextFileRequest{
 			SessionId: "sess-direct",
 			Path:      target,
-			Line:      acpsdk.Ptr(2),
-			Limit:     acpsdk.Ptr(1),
+			Line:      new(2),
+			Limit:     new(1),
 		}),
 	)
 	if reqErr != nil {
@@ -306,7 +306,7 @@ func TestHandleCreateTerminalBlocksNonAllowlistedCommandsForNetworkTurn(t *testi
 				SessionId: "sess-direct",
 				Command:   "sh",
 				Args:      []string{"-c", "printf nope"},
-				Cwd:       acpsdk.Ptr(proc.Cwd),
+				Cwd:       new(proc.Cwd),
 			},
 		},
 		{
@@ -315,7 +315,7 @@ func TestHandleCreateTerminalBlocksNonAllowlistedCommandsForNetworkTurn(t *testi
 				SessionId: "sess-direct",
 				Command:   "agh",
 				Args:      []string{"version"},
-				Cwd:       acpsdk.Ptr(proc.Cwd),
+				Cwd:       new(proc.Cwd),
 			},
 		},
 	}
@@ -905,7 +905,7 @@ func TestTerminalLifecycleHandlers(t *testing.T) {
 			SessionId: "sess-direct",
 			Command:   "sh",
 			Args:      []string{"-c", "printf hi"},
-			Cwd:       acpsdk.Ptr(proc.Cwd),
+			Cwd:       new(proc.Cwd),
 		}),
 	)
 	if reqErr != nil {
@@ -1002,7 +1002,7 @@ func TestNetworkTurnTerminalOwnershipGuards(t *testing.T) {
 		SessionId: "sess-direct",
 		Command:   "agh",
 		Args:      []string{"network", "status"},
-		Cwd:       acpsdk.Ptr(proc.Cwd),
+		Cwd:       new(proc.Cwd),
 		Env: []acpsdk.EnvVariable{
 			{Name: "AGH_HOME", Value: "/tmp/redirected"},
 			{Name: "SAFE_NETWORK_OVERRIDE", Value: "blocked"},
@@ -1062,7 +1062,7 @@ func TestNetworkTurnTerminalOwnershipGuards(t *testing.T) {
 		SessionId: "sess-direct",
 		Command:   "sh",
 		Args:      []string{"-c", "sleep 5"},
-		Cwd:       acpsdk.Ptr(proc.Cwd),
+		Cwd:       new(proc.Cwd),
 	})
 	if err != nil {
 		t.Fatalf("handleCreateTerminal(user shell) error = %v", err)
@@ -1205,7 +1205,7 @@ func TestHelperUtilities(t *testing.T) {
 		t.Fatalf("trimUTF8LeadingBytes() = %q, want %q", string(trimmed), "hi")
 	}
 
-	if sliceLines("a\nb\nc", acpsdk.Ptr(2), acpsdk.Ptr(2)) != "b\nc" {
+	if sliceLines("a\nb\nc", new(2), new(2)) != "b\nc" {
 		t.Fatalf("sliceLines() returned unexpected content")
 	}
 
@@ -1229,10 +1229,10 @@ func TestHelperUtilities(t *testing.T) {
 		t.Fatalf("lockedBuffer.String() = %q, want %q", buffer.String(), "stderr")
 	}
 
-	if chooseFloat64(nil, acpsdk.Ptr(1.2)) == nil {
+	if chooseFloat64(nil, new(1.2)) == nil {
 		t.Fatal("chooseFloat64(nil, fallback) = nil, want fallback")
 	}
-	if chooseString(nil, acpsdk.Ptr("usd")) == nil {
+	if chooseString(nil, new("usd")) == nil {
 		t.Fatal("chooseString(nil, fallback) = nil, want fallback")
 	}
 }
@@ -1688,7 +1688,7 @@ func TestHandleInboundCreateTerminalUsesRequestContext(t *testing.T) {
 			SessionId: "sess-direct",
 			Command:   "sh",
 			Args:      []string{"-c", "printf ready"},
-			Cwd:       acpsdk.Ptr(proc.Cwd),
+			Cwd:       new(proc.Cwd),
 		}),
 	)
 	if reqErr != nil {

internal/acp/launcher_tool_host_test.go

@@ -331,7 +331,7 @@ func TestLocalToolHostCreateTerminalUsesResolvedCwd(t *testing.T) {
 	response, err := host.CreateTerminal(testutil.Context(t), acpsdk.CreateTerminalRequest{
 		SessionId: "sess-terminal",
 		Command:   "pwd",
-		Cwd:       acpsdk.Ptr(cwd),
+		Cwd:       new(cwd),
 	})
 	if err != nil {
 		t.Fatalf("CreateTerminal() error = %v", err)

internal/acp/process_tree_test.go

@@ -65,7 +65,7 @@ func TestTerminalKillTerminatesWrappedProcessTree(t *testing.T) {
 				SessionId: "sess-direct",
 				Command:   "sh",
 				Args:      wrappedCommandArgs("sleep", "30"),
-				Cwd:       acpsdk.Ptr(proc.Cwd),
+				Cwd:       new(proc.Cwd),
 				Env: []acpsdk.EnvVariable{
 					{Name: testWrapperPIDFileEnvKey, Value: pidFile},
 				},

internal/acp/request_contract_test.go

@@ -99,7 +99,7 @@ func TestACPBehaviorContracts(t *testing.T) {
 			SessionId: "sess-additional-terminal",
 			Command:   "sh",
 			Args:      []string{"-c", "printf %s \"$PWD\""},
-			Cwd:       acpsdk.Ptr(additional),
+			Cwd:       new(additional),
 		})
 		if err != nil {
 			t.Fatalf("CreateTerminal(additional cwd) error = %v", err)
@@ -131,7 +131,7 @@ func TestACPBehaviorContracts(t *testing.T) {
 		response, err := host.CreateTerminal(ctx, acpsdk.CreateTerminalRequest{
 			SessionId: "sess-path",
 			Command:   "agh-path-tool",
-			Cwd:       acpsdk.Ptr(root),
+			Cwd:       new(root),
 			Env: []acpsdk.EnvVariable{
 				{Name: "PATH", Value: binDir},
 			},

internal/acp/terminal.go

@@ -305,10 +305,10 @@ func (p *AgentProcess) handleWaitForTerminalExit(
 	p.completeExternalTerminalProcess(
 		context.Background(),
 		request.TerminalId,
-		toolruntime.ProcessCompletion{ExitCode: acpsdk.Ptr(exitCode)},
+		toolruntime.ProcessCompletion{ExitCode: new(exitCode)},
 	)
 	return acpsdk.WaitForTerminalExitResponse{
-		ExitCode: acpsdk.Ptr(exitCode),
+		ExitCode: new(exitCode),
 	}, nil
 }
 
@@ -720,7 +720,7 @@ func (t *managedTerminal) wait(ctx context.Context) {
 	if t.cmd.ProcessState != nil {
 		exitCode := t.cmd.ProcessState.ExitCode()
 		if exitCode >= 0 {
-			exitStatus.ExitCode = acpsdk.Ptr(exitCode)
+			exitStatus.ExitCode = new(exitCode)
 		}
 	}
 	if err != nil && exitStatus.ExitCode == nil {

internal/api/contract/bridges_test.go

@@ -448,7 +448,7 @@ func TestBridgeRequestsRejectUnsupportedProviderConfigAndDeliveryDefaultsShapes(
 		t.Parallel()
 
 		badDefaults := contract.UpdateBridgeRequest{
-			DeliveryDefaults: ptr(contract.BridgeDeliveryDefaultsPayload(`{"mode":"reply","parse_mode":"markdown"}`)),
+			DeliveryDefaults: new(contract.BridgeDeliveryDefaultsPayload(`{"mode":"reply","parse_mode":"markdown"}`)),
 		}
 		if _, err := badDefaults.ToUpdateInstanceRequest("brg-1"); err == nil {
 			t.Fatal("ToUpdateInstanceRequest(delivery defaults extra field) error = nil, want non-nil")
@@ -747,7 +747,3 @@ func stringValue(payload *json.RawMessage) string {
 	}
 	return string(*payload)
 }
-
-func ptr[T any](value T) *T {
-	return &value
-}

internal/api/core/agent_channels.go

@@ -315,8 +315,9 @@ func agentChannelReplySendRequest(
 	return sendReq, nil
 }
 
+//go:fix inline
 func networkSurfacePtr(value network.Surface) *network.Surface {
-	return &value
+	return new(value)
 }
 
 func agentCallerPeerID(caller agentidentity.Caller) string {

internal/api/core/model_catalog_test.go

@@ -48,7 +48,7 @@ func TestProviderModelPayloadConversion(t *testing.T) {
 			AvailabilityState:      modelcatalog.AvailabilityStateUnknown,
 			Stale:                  true,
 			RefreshedAt:            time.Date(2026, 5, 7, 12, 0, 0, 0, time.UTC),
-			SupportsReasoning:      boolPtr(true),
+			SupportsReasoning:      new(true),
 			ReasoningEfforts:       []modelcatalog.ReasoningEffort{modelcatalog.ReasoningEffortHigh},
 			DefaultReasoningEffort: &effort,
 			Sources: []modelcatalog.SourceRef{
@@ -382,7 +382,3 @@ func assertRedactedModelCatalogPayload(t *testing.T, value string, secret string
 		t.Fatalf("payload value = %q, want redaction marker", value)
 	}
 }
-
-func boolPtr(value bool) *bool {
-	return &value
-}

internal/api/core/network_test.go

@@ -339,7 +339,7 @@ func TestNetworkConversionHelpersPreserveMetadata(t *testing.T) {
 			Kind:        network.KindSay,
 			Channel:     "builders",
 			Surface:     networkSurfacePtr(network.SurfaceDirect),
-			DirectID:    stringPtr("direct_0123456789abcdef0123456789abcdef"),
+			DirectID:    new("direct_0123456789abcdef0123456789abcdef"),
 			From:        "reviewer.sess-b",
 			ReplyTo:     &replyTo,
 			TraceID:     &traceID,
@@ -971,9 +971,9 @@ func TestBaseHandlersNetworkEndpoints(t *testing.T) {
 						"agh.capabilities_brief": json.RawMessage(`[{"id":"send","summary":"Send channel updates"}]`),
 					},
 				},
-				JoinedAt:  timePtr(fixedNow),
-				LastSeen:  timePtr(fixedNow),
-				ExpiresAt: timePtr(fixedNow.Add(time.Minute)),
+				JoinedAt:  new(fixedNow),
+				LastSeen:  new(fixedNow),
+				ExpiresAt: new(fixedNow.Add(time.Minute)),
 			}}
 			if channel == "" {
 				remoteDisplayName := "Coder"
@@ -985,8 +985,8 @@ func TestBaseHandlersNetworkEndpoints(t *testing.T) {
 						PeerID:      "coder.sess-remote",
 						DisplayName: &remoteDisplayName,
 					},
-					LastSeen:  timePtr(fixedNow),
-					ExpiresAt: timePtr(fixedNow.Add(time.Minute)),
+					LastSeen:  new(fixedNow),
+					ExpiresAt: new(fixedNow.Add(time.Minute)),
 				})
 			}
 			return peers, nil
@@ -1016,7 +1016,7 @@ func TestBaseHandlersNetworkEndpoints(t *testing.T) {
 				Kind:     network.KindSay,
 				Channel:  "builders",
 				Surface:  networkSurfacePtr(network.SurfaceDirect),
-				DirectID: stringPtr("direct_0123456789abcdef0123456789abcdef"),
+				DirectID: new("direct_0123456789abcdef0123456789abcdef"),
 				From:     "reviewer.sess-a",
 				ReplyTo:  &replyTo,
 				TraceID:  &traceID,
@@ -2446,7 +2446,7 @@ func TestBaseHandlersNetworkChannelsHideDirectedTrafficFromPublicTimeline(t *tes
 					recordedAt.Add(time.Minute),
 				)
 			}
-			if got, want := channelPayload.Channel.LastPresenceAt, timePtr(
+			if got, want := channelPayload.Channel.LastPresenceAt, new(
 				recordedAt,
 			); got == nil ||
 				!got.Equal(*want) {
@@ -3521,8 +3521,8 @@ func TestBaseHandlersNetworkChannelEndpointsIgnoreStoppedSessions(t *testing.T)
 							Channel:   "builders",
 							Local:     true,
 							PeerCard:  network.PeerCard{PeerID: "coder.sess-coder"},
-							JoinedAt:  timePtr(createdAt),
-							LastSeen:  timePtr(createdAt),
+							JoinedAt:  new(createdAt),
+							LastSeen:  new(createdAt),
 						},
 					}, nil
 				case "builders":
@@ -3533,8 +3533,8 @@ func TestBaseHandlersNetworkChannelEndpointsIgnoreStoppedSessions(t *testing.T)
 							Channel:   "builders",
 							Local:     true,
 							PeerCard:  network.PeerCard{PeerID: "coder.sess-coder"},
-							JoinedAt:  timePtr(createdAt),
-							LastSeen:  timePtr(createdAt),
+							JoinedAt:  new(createdAt),
+							LastSeen:  new(createdAt),
 						},
 					}, nil
 				case "retro":
@@ -4850,16 +4850,9 @@ func TestBaseHandlersNetworkPeerDetailUsesAuditMetrics(t *testing.T) {
 	})
 }
 
-func timePtr(value time.Time) *time.Time {
-	return &value
-}
-
+//go:fix inline
 func networkSurfacePtr(value network.Surface) *network.Surface {
-	return &value
-}
-
-func stringPtr(value string) *string {
-	return &value
+	return new(value)
 }
 
 func greetBodyJSON(peerID string, displayName string, capabilitySummary string, summary string) json.RawMessage {

internal/api/core/payload_helpers_test.go

@@ -472,8 +472,8 @@ func TestCoreConversionHelpers(t *testing.T) {
 			CacheWriteTokens: int64Ptr(5),
 			ContextUsed:      int64Ptr(6),
 			ContextSize:      int64Ptr(7),
-			CostAmount:       float64Ptr(1.23),
-			CostCurrency:     stringPtr("USD"),
+			CostAmount:       new(1.23),
+			CostCurrency:     new("USD"),
 			Timestamp:        now,
 		})
 		if usage == nil || usage.TotalTokens == nil || *usage.TotalTokens != 30 || usage.CostCurrency == nil ||
@@ -819,14 +819,7 @@ func TestObserveHealthPayloadIncludesRuntimeActivity(t *testing.T) {
 	})
 }
 
+//go:fix inline
 func int64Ptr(value int64) *int64 {
-	return &value
-}
-
-func float64Ptr(value float64) *float64 {
-	return &value
-}
-
-func stringPtr(value string) *string {
-	return &value
+	return new(value)
 }

internal/api/core/settings_test.go

@@ -1374,7 +1374,7 @@ func TestSettingsCollectionHandlersDelegateValidPayloads(t *testing.T) {
 							{
 								ID:                     "gpt-5.4",
 								DisplayName:            "GPT-5.4",
-								SupportsReasoning:      boolPointer(true),
+								SupportsReasoning:      new(true),
 								ReasoningEfforts:       []string{"low", "high"},
 								DefaultReasoningEffort: "high",
 							},
@@ -2317,10 +2317,6 @@ func decodeJSON(t *testing.T, body []byte, dest any) {
 	}
 }
 
-func boolPointer(value bool) *bool {
-	return &value
-}
-
 func appendLine(t *testing.T, path string, line string) {
 	t.Helper()
 

internal/api/spec/spec.go

@@ -5002,8 +5002,7 @@ func collectStructRequirements(schema *openapi3.Schema, t reflect.Type, required
 		return
 	}
 
-	for i := 0; i < t.NumField(); i++ {
-		field := t.Field(i)
+	for field := range t.Fields() {
 		if !field.IsExported() && !field.Anonymous {
 			continue
 		}

internal/api/udsapi/agent_channels_test.go

@@ -522,8 +522,9 @@ func agentChannelEnvelopeWithExt(
 	}
 }
 
+//go:fix inline
 func ptrNetworkSurface(value network.Surface) *network.Surface {
-	return &value
+	return new(value)
 }
 
 func misleadingCoordinationExt() network.ExtensionMap {