v0.11.3

Loads of little fixes, model modality detection improvements, polishing on the webui now that I'm using it more heavily.

• question tool - a pending question survives a tab refresh. A question blocked when the webui reconnects now re-renders its card after history instead of hanging with no UI to answer. Replay moved from the SessionManager's QUESTION-event buffer to the question bridge itself: on attach or session switch the server peeks the live pending question.

• webui - wss:// on https pages. The chat socket URL hardcoded ws://, which browsers block as mixed content on an https page.

• webui - dropped the pulsing glow on the connection indicator

• evals - added independent evals runner and a first easy series kielbasa-1

• webui - attachments render inside the user bubble. @-ref uploads echoed as an extra SYSTEM_MESSAGE per file while the bubble itself showed the file-include part's raw JSON. The user-message event now carries the text plus a files[] view, rendered as collapsible boxes in the bubble -- live, session replay, and cold log replay. SystemMessageEvent loses its files field.

• Removed --no-stream / stream config (breaking). The flag only gated display -- the request path always streamed -- so --no-stream runs silently dropped the answer. Output is now always streamed; --no-stream fails fast as an unknown flag and "stream" in defaults.json surfaces as an unknown key in hotdog rescue.

• fetch tool returns images. A fetched PNG/JPEG/WebP/GIF now attaches to the tool result as a base64 image_url, exactly like read -- a vision model can look at a chart or screenshot straight from a URL. Gated by modelAcceptsImages before any bytes are read (fail-closed on text-only models), capped at the shared 10MB image limit with a streaming byte cap so endless streams get cancelled, not buffered. Other image/* types (e.g. svg) keep the text path; HEAD still returns headers only.

• @-ref image attachments get their own size budget. fileAttachment.maxFileSize (100KB) gated text and images alike, so screenshots over 100KB were silently dropped from @-refs even on a vision model -- while read saw them fine under its 10MB cap. New fileAttachment.maxImageSize (default 10MB, matching read) applies to images; text budget unchanged. The webui Attach button shares the split: image/* uploads over the websocket are sized against maxImageSize.

• llama.cpp model-modality detection. fetchModels now understands plain llama.cpp's /v1/models shape, not just llama-swap: context from data[].meta.n_ctx, vision from the ollama-style capabilities list, aliases expand. When the payload has no modality data it falls back to /props. Vision models on bare llama.cpp now report inputModalities: ["text","image"] without hand-editing provider config; non-llama.cpp providers see no extra requests.

• --disable-env-scrubbing CLI flag: turns off env scrubbing for agent-spawned subprocesses (bash tool, MCP stdio); children inherit the full environment. Default stays scrubbed.

• provider health tracking. A dead provider looks idle -- the preferred placement target -- until a task locks onto it and burns its retries on connection-refused. Placement now consults reachability verdicts: a sweep every providerHealthCheckIntervalSecs (default 30, 0 disables the timer) probes each provider with a resolvable url -- /v1/models for fetchModels: true providers, which doubles as a live catalog refresh upserted into the running registry, /health otherwise -- and connection-level task failures (refused/DNS/reset) demote a provider immediately, active even at 0. Reachability is status-agnostic: a 500 or a stalled generation still proves the socket answers. Recovery clears through a successful probe or any task completing a turn, so demotion is never process-permanent. A down provider is skipped during multi-candidate placement unless every candidate is down (fail-open); pins are never rerouted. hotdog info shows the per-provider up/down verdict.

• fix tool-result blindness on strict chat templates. Since the tool-result part refactor, role: "tool" messages rode the wire as part arrays; llama.cpp/Ollama templates interpolate tool content as a raw string and choke, so some models effectively never saw tool results. Text-only tool content now collapses back to a plain \n-joined string on the wire; arrays with non-text parts (images) stay arrays.

• marker-mangler - chatML tokens are escaped too. ChatML control tokens (<|im_start|>) in untrusted text are rewritten to a safe form and reversed on output -- chatML markers survive enough model templates to be common breakage.

Full Changelog: v0.11.2...v0.11.3