SafeRL-Lab · chauncygu · May 31, 2026 · May 31, 2026 · May 31, 2026 · May 31, 2026
diff --git a/LICENSE b/LICENSE
@@ -186,7 +186,7 @@
       same "printed page" as the copyright notice for easier
       identification within third-party archives.
 
-   Copyright [yyyy] [name of copyright owner]
+   Copyright 2026 SAIL Lab at UC Berkeley
 
    Licensed under the Apache License, Version 2.0 (the "License");
    you may not use this file except in compliance with the License.

diff --git a/NOTICE b/NOTICE
@@ -0,0 +1,13 @@
+CheetahClaws
+Copyright 2026 SAIL Lab at UC Berkeley
+
+This product includes software developed by SAIL Lab at UC Berkeley
+(https://github.com/SafeRL-Lab/cheetahclaws).
+
+Licensed under the Apache License, Version 2.0. Redistributions and
+derivative works must retain this NOTICE and the accompanying LICENSE,
+and must state any significant changes made.
+
+If you use this software in academic work, please cite:
+  Gu, Shangding. "From Model Scaling to System Scaling: Scaling the
+  Harness in Agentic AI." arXiv preprint arXiv:2605.26112, 2026.
diff --git a/README.md b/README.md
@@ -99,13 +99,13 @@ CheetahClaws: **A Lightweight** and **Easy-to-Use** Python Reimplementation of C
 
 Claude Code is a powerful, production-grade AI coding assistant — but its source is a compiled ~12 MB TypeScript/Node bundle (~1,300 files, ~283K lines), tightly coupled to the Anthropic API, hard to modify, and impossible to run against a local or alternative model.
 
-**CheetahClaws** reimplements the same core loop in ~40K lines of readable Python — keeping what you need, dropping what you don't, and adding multi-provider + local-model support. Full comparison: [docs/guides/comparison.md](docs/guides/comparison.md).
+**CheetahClaws** reimplements the same core loop in ~90K lines of readable Python — keeping what you need, dropping what you don't, and adding multi-provider + local-model support. Full comparison: [docs/guides/comparison.md](docs/guides/comparison.md).
 
 | Dimension | Claude Code (TypeScript) | CheetahClaws (Python) |
 |---|---|---|
 | Language | TypeScript + React/Ink | Python 3.8+ |
-| Source files / LoC | ~1,332 files / ~283K | ~85 files / ~40K |
-| Built-in tools / commands | 44+ / 88 | 27 / 36 |
+| Source files / LoC | ~1,332 files / ~283K | ~315 files / ~90K (core; ~127K with tests) |
+| Built-in tools / commands | 44+ / 88 | 27 / 50+ |
 | Model providers | Anthropic only | 8+ (Anthropic · OpenAI · Gemini · Kimi · Qwen · DeepSeek · MiniMax · …) |
 | Local models | No | Yes — Ollama, LM Studio, vLLM, any OpenAI-compatible endpoint |
 | Build step | Yes (Bun + esbuild) | No — `python cheetahclaws.py` |
@@ -114,7 +114,7 @@ Claude Code is a powerful, production-grade AI coding assistant — but its sour
 
 **Where Claude Code wins:** richer React/Ink UI, more built-in tools, enterprise features (MDM, team permission sync, OAuth/keychain), AI-driven memory extraction, single-binary production reliability.
 
-**Where CheetahClaws wins:** any-model switching (`--model`/`/model`, no recompile) incl. full local/offline support; a readable ~174-line agent loop (`agent.py`); zero build; runtime tool registration + MCP + git plugins + Markdown skills; task dependency graph (`blocks`/`blocked_by`); two-layer context compression; offline voice; cloud session sync; bridges to Telegram/WeChat/Slack/QQ.
+**Where CheetahClaws wins:** any-model switching (`--model`/`/model`, no recompile) incl. full local/offline support; a readable agent loop in one file (`agent.py`, ~740 lines); zero build; runtime tool registration + MCP + git plugins + Markdown skills; task dependency graph (`blocks`/`blocked_by`); two-layer context compression; offline voice; cloud session sync; bridges to Telegram/WeChat/Slack/QQ.
 
 **Who it's for:** developers who want a local/non-Anthropic coding assistant, researchers studying how agentic assistants work, and teams who need a hackable baseline — without a Node.js build chain.
 
@@ -126,15 +126,15 @@ Claude Code is a powerful, production-grade AI coding assistant — but its sour
 
 | Dimension | OpenClaw (TypeScript) | CheetahClaws (Python) |
 |---|---|---|
-| Lines of code | ~245K (~10,349 files) | ~12K (~85 files) |
+| Lines of code | ~245K (~10,349 files) | ~90K core (~315 files) |
 | Primary focus | Personal assistant across channels | AI coding assistant / dev tool |
 | Architecture | Always-on Gateway daemon + apps | Zero-install terminal REPL |
 | Messaging channels | 20+ (WhatsApp · Signal · iMessage · Discord · Matrix · …) | Terminal + Telegram · WeChat · Slack · QQ bridges |
 | Local / offline models | Limited | Full — Ollama · vLLM · LM Studio · any OpenAI-compatible |
 | Code editing tools | Browser control, Canvas | Read · Write · Edit · Bash · Glob · Grep · NotebookEdit · GetDiagnostics |
 | Mobile / Live Canvas | Yes (menu bar + iOS/Android, A2UI) | — |
 | MCP support | — | Yes (stdio/SSE/HTTP) |
-| Hackability | 245K lines, harder to modify | ~12K lines — agent loop in one file |
+| Hackability | 245K lines, harder to modify | ~90K lines — agent loop in one file |
 
 | If you want… | Use |
 |---|---|
@@ -160,7 +160,7 @@ Claude Code is a powerful, production-grade AI coding assistant — but its sour
 | Multi-agent | Spawn typed sub-agents (coder/reviewer/researcher/…), git-worktree isolation, background mode |
 | Permission system | `auto` / `accept-all` / `manual` / `plan` modes |
 | Checkpoints & plan mode | Auto-snapshot conversation + files each turn (`/checkpoint`, `/rewind`); `/plan` read-only analysis mode |
-| Slash commands & themes | 37 slash commands with Tab-complete; `/theme` offers 15 curated palettes |
+| Slash commands & themes | 50+ slash commands with Tab-complete; `/theme` offers 15 curated palettes |
 | Brainstorm → Worker | `/brainstorm` runs an N-persona debate → `todo_list.txt`; `/worker` auto-implements the pending tasks |
 | SSJ Developer Mode | `/ssj` — persistent power menu chaining Brainstorm, Worker, Review, Trading, Agent, Video/TTS, Monitor, etc. |
 | Trading agent | `/trading` multi-agent analysis, backtesting, paper-trade calibration, MV portfolios. [Guide](docs/guides/trading.md) |
@@ -350,7 +350,7 @@ A built-in AI trading analysis + backtesting module (`pip install "cheetahclaws[
 
 ## Web UI
 
-A production-ready browser interface — real user accounts (bcrypt + JWT), SQLite-backed history, ops endpoints — served by Python stdlib + nine vanilla-JS modules (no Node.js / React / build step).
+A production-ready browser interface — real user accounts (bcrypt + JWT), SQLite-backed history, ops endpoints — served by Python stdlib + ten vanilla-JS modules (no Node.js / React / build step).
 
 ```bash
 pip install 'cheetahclaws[web]'
@@ -375,7 +375,7 @@ Detailed guides live in [`docs/guides/`](docs/guides/) to keep this README focus
 | [**Usage (all providers)**](docs/guides/usage.md) | Per-provider setup + example commands: Anthropic/OpenAI/Gemini/Kimi/Qwen/Zhipu/DeepSeek/MiniMax/litellm, and local Ollama/LM Studio/vLLM |
 | [**Web UI**](docs/guides/web-ui.md) | Chat UI, PTY terminal, API endpoints, settings, auth, SSE streaming |
 | [**Docker / Home Server**](docs/guides/docker.md) | Dockerfile + compose: web UI + bridges in one container, host Ollama, workspace mount |
-| [**Reference**](docs/guides/reference.md) | CLI, 36+ commands, 33 built-in tools, session search, error classification, tool cache |
+| [**Reference**](docs/guides/reference.md) | CLI, 50+ commands, 33 built-in tools, session search, error classification, tool cache |
 | [**Extensions**](docs/guides/extensions.md) | Memory, Skills, Sub-Agents, MCP servers, Plugins, Monitor, Autonomous Agents |
 | [**Bridges**](docs/guides/bridges.md) | Telegram, WeChat, Slack, QQ setup + remote control from your phone |
 | [**Security & env vars**](docs/guides/security.md) | Threat model, `CHEETAHCLAWS_*` vars, bot-token handling, Bash denylist, fs sandbox, CSRF |
@@ -416,7 +416,7 @@ cheetahclaws --accept-all -p "Init a pyproject.toml"  # CI / automation
 cheetahclaws --web --port 8008 --no-auth              # browser chat + terminal
 ```
 
-See the [Reference Guide](docs/guides/reference.md) for all 37+ slash commands, tools, and config options.
+See the [Reference Guide](docs/guides/reference.md) for all 50+ slash commands, tools, and config options.
 
 ---
 
@@ -500,7 +500,7 @@ If you find the repository useful, please cite the study
 }
 
 @article{cheetahclaws2026,
-  title={CheetahClaws: Agent Infrastructure for Long-Horizon, Multi-Model, Tool-Using AI Systems},
+  title={CheetahClaws: Agent Infrastructure for Long-Horizon, Multi-Model and Tool-Using AI Systems},
   author={CheetahClaws Team},
   journal={github},
   year={2026}

diff --git a/docs/guides/comparison.md b/docs/guides/comparison.md
@@ -7,17 +7,17 @@ The full positioning analysis. The [README](../../README.md) carries a condensed
 
 Claude Code is a powerful, production-grade AI coding assistant — but its source code is a compiled, 12 MB TypeScript/Node.js bundle (~1,300 files, ~283K lines). It is tightly coupled to the Anthropic API, hard to modify, and impossible to run against a local or alternative model.
 
-**CheetahClaws** reimplements the same core loop in ~40K lines of readable Python, keeping everything you need and dropping what you don't.
+**CheetahClaws** reimplements the same core loop in ~90K lines of readable Python (core, excluding tests), keeping everything you need and dropping what you don't.
 
 ### At a glance
 
 | Dimension | Claude Code (TypeScript) | CheetahClaws (Python) |
 |-----------|--------------------------|---------------------------|
 | Language | TypeScript + React/Ink | Python 3.8+ |
-| Source files | ~1,332 TS/TSX files | ~85 Python files |
-| Lines of code | ~283K | ~40K |
+| Source files | ~1,332 TS/TSX files | ~315 Python files (core; ~445 with tests) |
+| Lines of code | ~283K | ~90K (core; ~127K with tests) |
 | Built-in tools | 44+ | 27 |
-| Slash commands | 88 | 36 |
+| Slash commands | 88 | 50+ |
 | Voice input | Proprietary Anthropic WebSocket (OAuth required) | Local Whisper / OpenAI API — works offline, no subscription |
 | Model providers | Anthropic only | 8+ (Anthropic · OpenAI · Gemini · Kimi · Qwen · DeepSeek · MiniMax · Ollama · …) |
 | Local models | No | Yes — Ollama, LM Studio, vLLM, any OpenAI-compatible endpoint |
@@ -37,7 +37,7 @@ Claude Code is a powerful, production-grade AI coding assistant — but its sour
 
 - **Multi-provider** — switch between Claude, GPT-4o, Gemini 2.5 Pro, DeepSeek, Qwen, MiniMax, or a local Llama model with `--model` or `/model` — no recompile needed.
 - **Local model support** — run entirely offline with Ollama, LM Studio, or any vLLM-hosted model.
-- **Readable source** — the full agent loop is 174 lines (`agent.py`). Any Python developer can read, fork, and extend it in minutes.
+- **Readable source** — the agent loop lives in one readable file (`agent.py`, ~740 lines). Any Python developer can read, fork, and extend it in minutes.
 - **Zero build** — `pip install -r requirements.txt` and you're running. Changes take effect immediately.
 - **Dynamic extensibility** — register new tools at runtime with `register_tool(ToolDef(...))`, install skill packs from git URLs, or wire in any MCP server.
 - **Task dependency graph** — `TaskCreate` / `TaskUpdate` support `blocks` / `blocked_by` edges for structured multi-step planning (not available in Claude Code).
@@ -57,7 +57,7 @@ Claude Code is a powerful, production-grade AI coding assistant — but its sour
 - **Rich Live streaming rendering** — When `rich` is installed, responses stream as live-updating Markdown in place (no duplicate raw text), with clean tool-call interleaving.
 - **Native Ollama reasoning** — Local reasoning models (deepseek-r1, qwen3, gemma4) stream their `<think>` tokens directly to the terminal via `ThinkingChunk` events; enable with `/verbose` and `/thinking`.
 - **Native Ollama vision** — `/image [prompt]` captures the clipboard and sends it to local vision models (llava, gemma4, llama3.2-vision) via Ollama's native image API. No cloud required.
-- **Built-in Web UI** — `--web` launches a production-ready browser interface: multi-user accounts (bcrypt + JWT), SQLite-backed session history that survives restarts, rich Chat UI at `/chat` with streaming messages, tool cards, permission approval, sidebar session CRUD + search + markdown export, light/dark/system theme, settings panel with per-provider API keys. Full xterm.js PTY terminal at `/` keeps 100% CLI parity. Ops endpoints (`/health`, `/metrics`) + structured JSON logs + 21 pytest end-to-end tests. Nine tiny vanilla-JS modules under `web/static/js/` — no Node.js, no React, no build step. `cheetahclaws --web` auto-picks a free port if 8080 is taken.
+- **Built-in Web UI** — `--web` launches a production-ready browser interface: multi-user accounts (bcrypt + JWT), SQLite-backed session history that survives restarts, rich Chat UI at `/chat` with streaming messages, tool cards, permission approval, sidebar session CRUD + search + markdown export, light/dark/system theme, settings panel with per-provider API keys. Full xterm.js PTY terminal at `/` keeps 100% CLI parity. Ops endpoints (`/health`, `/metrics`) + structured JSON logs + 21 pytest end-to-end tests. Ten tiny vanilla-JS modules under `web/static/js/` — no Node.js, no React, no build step. `cheetahclaws --web` auto-picks a free port if 8080 is taken.
 - **Reliable multi-line paste** — Bracketed Paste Mode (`ESC[?2004h`) collects any pasted text — code blocks, multi-paragraph prompts, long diffs — as a single turn with zero latency and no blank-line artifacts.
 - **Rich Tab completion** — Tab after `/` shows all commands with one-line descriptions and subcommand hints; subcommand Tab-complete works for `/mcp`, `/plugin`, `/tasks`, `/cloudsave`, and more.
 - **Checkpoint & rewind** — `/checkpoint` lists all auto-snapshots of conversation + file state; `/checkpoint <id>` rewinds both files and history to any earlier point in the session.
@@ -74,8 +74,8 @@ Claude Code is a powerful, production-grade AI coding assistant — but its sour
 | Dimension | OpenClaw (TypeScript) | CheetahClaws (Python) |
 |-----------|----------------------|---------------------|
 | Language | TypeScript + Node.js | Python 3.8+ |
-| Source files | ~10,349 TS/JS files | ~85 Python files |
-| Lines of code | ~245K | ~12K |
+| Source files | ~10,349 TS/JS files | ~315 Python files (core) |
+| Lines of code | ~245K | ~90K (core) |
 | Primary focus | Personal life assistant across messaging channels | AI **coding** assistant / developer tool |
 | Architecture | Always-on Gateway daemon + companion apps | Zero-install terminal REPL |
 | Messaging channels | 20+ (WhatsApp · Telegram · Slack · Discord · Signal · iMessage · Matrix · WeChat · …) | Terminal + Telegram bridge + WeChat bridge (iLink) + Slack bridge (Web API) + QQ bridge (botpy) |
@@ -88,7 +88,7 @@ Claude Code is a powerful, production-grade AI coding assistant — but its sour
 | Live Canvas / UI | Yes (A2UI agent-driven visual workspace) | — |
 | MCP support | — | Yes (stdio/SSE/HTTP) |
 | Runtime extensibility | Skills platform (bundled/managed/workspace) | `register_tool()` at runtime, MCP, git plugins, Markdown skills |
-| Hackability | Large codebase (245K lines), harder to modify | ~12K lines — full agent loop visible in one file |
+| Hackability | Large codebase (245K lines), harder to modify | ~90K lines — agent loop visible in one file |
 
 ### Where OpenClaw wins
 
@@ -104,7 +104,7 @@ Claude Code is a powerful, production-grade AI coding assistant — but its sour
 - **Coding toolset** — Read/Write/Edit/Bash/Glob/Grep/NotebookEdit/GetDiagnostics are purpose-built for software development; CheetahClaws understands diffs, file trees, and code structure.
 - **True local model support** — full Ollama/vLLM/LM Studio integration with streaming, tool-calling, and vision — no cloud required.
 - **8+ model providers** — switch between Claude, GPT-4o, Gemini, DeepSeek, Qwen, MiniMax, and local models with a single `--model` flag.
-- **Hackable in minutes** — 12K lines of readable Python; the entire agent loop is in `agent.py`; extend with `register_tool()` at runtime without rebuilding.
+- **Hackable in minutes** — ~90K lines of readable Python; the entire agent loop is in one file (`agent.py`); extend with `register_tool()` at runtime without rebuilding.
 - **Zero setup** — `pip install cheetahclaws` and run `cheetahclaws`; no daemon, no pairing, no onboarding wizard.
 - **MCP support** — connect any MCP server (stdio/SSE/HTTP); tools auto-registered.
 - **SSJ Developer Mode** — `/ssj` power menu chains Brainstorm → TODO → Worker → Debate in a persistent interactive session; automates entire dev workflows.

diff --git a/docs/guides/features.md b/docs/guides/features.md
@@ -25,7 +25,7 @@ and indexed in the [README Documentation section](../../README.md#documentation)
 | Permission system | `auto` / `accept-all` / `manual` / `plan` modes |
 | Checkpoints | Auto-snapshot conversation + file state after each turn; `/checkpoint` to list, `/checkpoint <id>` to rewind; `/rewind` alias; 100-snapshot sliding window |
 | Plan mode | `/plan <desc>` enters read-only analysis mode; Claude writes only to the plan file; `EnterPlanMode` / `ExitPlanMode` agent tools for autonomous planning |
-| 37 slash commands | `/model` · `/config` · `/save` · `/cost` · `/memory` · `/skills` · `/agents` · `/voice` · `/proactive` · `/checkpoint` · `/plan` · `/compact` · `/status` · `/doctor` · `/theme` · … |
+| 50+ slash commands | `/model` · `/config` · `/save` · `/cost` · `/memory` · `/skills` · `/agents` · `/voice` · `/proactive` · `/checkpoint` · `/plan` · `/compact` · `/status` · `/doctor` · `/theme` · … |
 | Console themes | `/theme` lists 15 curated palettes (default · dracula · nord · gruvbox · solarized · tokyo-night · catppuccin · matrix · synthwave · midnight · ocean · monokai · cheetah · mono · none); each row shows a live `info / ok / warn / err` swatch in the theme's own colors. `/theme <name>` applies and persists the choice — also drives Rich's Markdown code-block style. |
 | Voice input | Record → transcribe → auto-submit. Backends: `sounddevice` / `arecord` / SoX + `faster-whisper` / `openai-whisper` / OpenAI API. Works fully offline. |
 | Brainstorm | `/brainstorm [topic]` generates N expert personas suited to the topic (2–100, default 5, chosen interactively), runs an iterative debate, saves results to `brainstorm_outputs/`, and synthesizes a Master Plan + auto-generates `brainstorm_outputs/todo_list.txt`. |

diff --git a/docs/guides/web-ui.md b/docs/guides/web-ui.md
@@ -1,6 +1,6 @@
 # Web UI Guide
 
-CheetahClaws ships with a production-ready browser UI built on a pure Python stdlib HTTP server plus nine small vanilla-JS modules — no Node.js, no bundler, no build step. This guide covers installation, accounts, the Chat UI, the PTY terminal, the full HTTP API, observability, and how the pieces fit together.
+CheetahClaws ships with a production-ready browser UI built on a pure Python stdlib HTTP server plus ten small vanilla-JS modules — no Node.js, no bundler, no build step. This guide covers installation, accounts, the Chat UI, the PTY terminal, the full HTTP API, observability, and how the pieces fit together.
 
 <div align="center">
  <img src="../media/demos/web_demo.gif" width="850" alt="Web UI demo — sidebar, tool cards, approval prompts, markdown streaming"/>
@@ -133,9 +133,10 @@ Schema is bootstrapped on first run via `Base.metadata.create_all`. **In-place m
 
 ## The Chat UI (`/chat`)
 
-The thin `chat.html` (~550 lines of HTML + CSS) loads nine small JS modules in order:
+The thin `chat.html` (~550 lines of HTML + CSS) loads ten small JS modules in order:
 
 ```
+web/static/js/csrf.js       — patches window.fetch to echo the CSRF cookie on writes (loaded first)
 web/static/js/chat.js       — ChatApp class, constructor, send(), WS, SSE, event dispatch
 web/static/js/util.js       — _escapeHtml, _fmtRelTime, _renderMd (with XSS strip), _scrollBottom
 web/static/js/auth.js       — bootstrap, doAuth, whoami, logout, _fetchAuth

diff --git a/docs/i18n/README.CN.MD b/docs/i18n/README.CN.MD
@@ -1,5 +1,7 @@
 English | [中文](README.CN.MD) | [Français](README.FR.MD) | [한국어](README.KO.MD) | [日本語](README.JP.MD) | [Deutsch](README.DE.MD) | [Português](README.ES.MD)
 
+> ⚠️ 此翻译可能已过时。最新、最准确的内容请以英文 [README](../../README.md) 为准。
+
 <br>
 
 <div align="center">