Ask Cmdr: review and apply natural-language bulk renames

[vdavid]

Summary

Adds natural-language bulk rename to Ask Cmdr with an explicit, reviewable proposal workflow. The agent can inspect the focused pane and propose filename changes, but cannot approve or apply them. Only a frontend user action can send approved rows through the existing operation engine.

This also improves OpenAI-compatible provider setup so the feature works with Qwen/DashScope and custom endpoints, and addresses the pane-context, streaming, copyability, and activity-state issues discovered during end-to-end QA.

Why this shape

Renaming is a destructive-looking action even when it stays within one folder, so the design keeps authority at a hard boundary:

• The agent receives Access::Read tools for context and one Access::Propose tool for staging a plan.
• Access::Propose cannot mutate the filesystem.
• There is no agent tool that approves a proposal.
• Approval comes only from explicit frontend user actions.
• The backend owns proposal identities, source fingerprints, preflight results, and the accepted execution subset.
• Applying approved rows reuses the managed operation engine and journal instead of creating a second write path.

This keeps the useful natural-language workflow while preserving Cmdr's core data-safety invariant.

Natural-language bulk rename

• Adds the first Access::Propose MCP tool, propose_rename_plan.
• Hand-approves the tool through EXPECTED_PROPOSE_TOOL_NAMES while keeping all structural no-write assertions intact.
• Limits plans to renames within one folder: no moves, folder creation, or reorganization.
• Caps proposal payloads at 200 rows.
• Adds list_pane_files, an agent-only read tool backed by the focused pane's existing listing cache.
• Returns the pane, shared path, exact volume ID, selection/folder scope, counts, truncation state, and compact file metadata.
• Uses selected rows when present, otherwise the current folder.
• Refuses stale or incomplete selections instead of silently dropping rows.
• Does not require image indexing for ordinary filename/date-based renames.
• Keeps OCR and image-content inspection dependent on image indexing.
• Adds a scrollable review dialog with per-row Allow/Deny, Allow all/Deny all, Cancel, and Apply.
• Preflights approved rows again before applying them and rejects stale sources or new conflicts.
• Routes accepted rows through the existing managed operation and journal infrastructure.
• Handles chains, cycles, swaps, and case-only renames using collision-safe same-directory temporary staging.
• Restores staged sources after cancellation or an intermediate problem.
• Handles local and volume-backed rename paths without granting the agent write access.

Agent context and reliability

• Synchronizes the restored focused pane to the backend at startup, fixing cases where Ask Cmdr inspected the left pane while the right pane was active.
• Makes the system prompt prefer the compact focused-pane listing for rename requests.
• Adds a 12,000-token per-call output allowance for reasoning-heavy OpenAI-compatible models.
• Raises the whole agent-loop deadline from 60 to 120 seconds while retaining the eight-tool-turn runaway guard.
• Preserves provider reasoning blocks across compatible tool-call continuations.
• Removes unfinished Thinking/tool rows on every terminal outcome, including success, cancellation, token limits, watchdog timeout, and rejected provider sends.
• Preserves completed tool history while retiring stale activity.
• Adds stalled-stream feedback and automatic stop behavior.
• Aligns and evenly spaces tool/thinking activity rows.
• Makes chat text selectable and copyable without triggering reactive rerender loops or duplicate clipboard content.
• Adds localized labels for proposal and stalled-stream states.

AI provider setup

• Adds a Qwen preset using DashScope's OpenAI-compatible endpoint.
• Makes Custom an API-key-backed OpenAI-compatible provider with an editable base URL.
• Supports the same provider configuration in Settings and onboarding.
• Keeps API keys in the existing OS secret store.
• Validates editable endpoints only when the provider has the required key.
• Updates provider tests and documentation for the shared configuration behavior.

Internationalization and documentation

• Adds and translates the new Ask Cmdr, review-dialog, provider, and stalled-stream copy across all supported locales.
• Updates generated localization keys and IPC bindings.
• Adds the reviewed implementation spec.
• Documents the proposal boundary, pane-listing contract, bulk operation behavior, provider configuration, and terminal UI lifecycle.
• Updates colocated CLAUDE.md/DETAILS.md guidance for the affected subsystems.

Validation

• Full Svelte suite: 6,811 tests passed.
• Normal repository lane: 73 checks passed.
• Local Rust suite passed.
• Final fast lane: 51 checks passed.
• git diff --check is clean.
• The slow run passed all 273 Linux E2E tests, with seven duration warnings.
• The desktop Playwright shard passed 128 of 129 tests; one unrelated mixed copy-conflict test exceeded its dialog-close timeout.
• The Linux Rust run initially passed 4,142 of 4,143 tests and exposed a case-only rename identity issue on a macOS-backed Docker mount. The conflict check was corrected afterward. Per request, the slow Linux and E2E suites were not rerun.

Remaining advisory warning

The checker reports file-length growth in two existing integration hubs:

• apps/desktop/src-tauri/src/commands/agent.rs
• apps/desktop/src/routes/(main)/+page.svelte

The feature-specific business logic remains in the colocated agent tool, proposal, review-dialog, and bulk-rename modules.