From 5a9bcb7542e2d7d9693213435c8aab3c63669fba Mon Sep 17 00:00:00 2001
From: Mickael Farina <farina.mickael@gmail.com>
Date: Tue, 9 Jun 2026 22:46:49 +0200
Subject: [PATCH] feat(voice): flash / default / think modes + consent-gated
 gmail send
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Three modes on the live voice-to-voice chat, same interface
(docs/VOICE-MODES-DESIGN.md, operator-approved):

- flash: prefill-surgery for snappy turns — context trim 20→8 turns, skip
  per-turn memory + observer injections, max_tokens 2000→400, one-sentence
  rule, TTS 1.25x. Same local Qwen 35B.
- default: byte-identical to previous behavior.
- think: live multi-step tool calling — utterances route through a
  voice-scoped codec_agents.Agent over a curated allowlist (hue, music,
  chrome, web search/fetch, calendar, gmail, imessage, timers, reminders,
  weather, notes). Each tool call is narrated over TTS (extended-wait
  keepalive); speaking interrupts the loop; 6-tool + 120s budgets. Terminal/
  python_exec/file_write etc. are hard-excluded and config-immune. The
  single-skill fast path still fires first.

Switching: voice command ("flash/think/normal mode", terse-utterance guard so
"i think mode collapse…" can't hijack) + three UI pills on /voice + additive
WS {"type":"mode"} protocol. Kill switch VOICE_MODES_ENABLED. New audit event
voice_mode_changed (AGENTS.md §6 updated); think tool calls ride the existing
run_with_hooks audit chokepoint.

gmail: new consent-gated `send` action (think-mode "send an email" demo).
Strict Step-3 consent — CODEC reads the draft, only the literal spoken word
"send" sends; timeout/disabled/generic-yes fail CLOSED. gmail.modify scope
already covers send (no re-auth). Manifest regenerated (PR-1A).

Tests (TDD red-then-green): tests/test_voice_modes.py (11) +
tests/test_gmail_send.py (6). Full suite 2391 passed.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 AGENTS.md                  |   8 ++
 codec_voice.html           |  45 +++++++
 codec_voice.py             | 268 ++++++++++++++++++++++++++++++++-----
 docs/VOICE-MODES-DESIGN.md |  91 +++++++++++++
 skills/.manifest.json      |   2 +-
 skills/google_gmail.py     |  64 ++++++++-
 tests/test_gmail_send.py   | 121 +++++++++++++++++
 tests/test_voice_modes.py  | 199 +++++++++++++++++++++++++++
 8 files changed, 758 insertions(+), 40 deletions(-)
 create mode 100644 docs/VOICE-MODES-DESIGN.md
 create mode 100644 tests/test_gmail_send.py
 create mode 100644 tests/test_voice_modes.py

diff --git a/AGENTS.md b/AGENTS.md
index 48f2126..037ce9b 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -562,6 +562,14 @@ Three event names, all info-level. `agent_message_sent` and `agent_message_recei
 
 `PHASE3_STEP10_EVENTS` frozenset exposed.
 
+#### Voice modes event (flash / default / think — docs/VOICE-MODES-DESIGN.md)
+
+| Event | Source | level | extra fields |
+|---|---|---|---|
+| `voice_mode_changed` | `codec-voice` | info | `mode` (`flash` \| `default` \| `think`), `via` (`voice` \| `ui`) |
+
+Single-emit, fresh or session cid. Think-mode tool calls need no new events — they route through the skill `Tool` wrappers → `run_with_hooks` → existing `tool_call`/`tool_result` envelope.
+
 ### Notifications (`~/.codec/notifications.json`)
 Four sources can produce notifications: scheduler (crew completion), heartbeat (threshold alert), autopilot (ambient trigger), and Phase 1 Step 3's AskUserQuestion (`type="question"`). All write through `routes/_shared.py:51-127` except AskUserQuestion which writes via `codec_ask_user._write_question_notification`.
 
diff --git a/codec_voice.html b/codec_voice.html
index 69489bf..9d81075 100644
--- a/codec_voice.html
+++ b/codec_voice.html
@@ -455,6 +455,20 @@
         .modal-overlay.show { display:flex; }
         .modal-overlay img { max-width:100%; max-height:90vh; border-radius:var(--radius); border:1px solid var(--border); }
         .modal-close { position:fixed; top:16px; right:16px; background:var(--surface); color:var(--text); border:1px solid var(--border); width:32px; height:32px; border-radius:50%; font-size:18px; cursor:pointer; z-index:101; display:flex; align-items:center; justify-content:center; }
+        /* ── Voice mode pills (flash / default / think) ── */
+        .mode-row { display:flex; gap:8px; justify-content:center; margin:10px 0 2px; }
+        .mode-pill {
+            background:var(--surface-2,#1f1f22); border:1px solid var(--border,#2a2a2f);
+            color:var(--text-dim,#6a6a70); font-size:11px; font-weight:700;
+            letter-spacing:1px; padding:5px 14px; border-radius:999px; cursor:pointer;
+            transition:all .15s; text-transform:uppercase;
+        }
+        .mode-pill:hover { color:var(--text,#ececec); border-color:var(--border-hover,#3a3a40); }
+        .mode-pill.active {
+            color:#fff; background:var(--accent,#E8711A); border-color:var(--accent,#E8711A);
+            box-shadow:0 0 12px rgba(232,113,26,.35);
+        }
+        .mode-pill.think.active { box-shadow:0 0 12px rgba(232,113,26,.5); }
     </style>
 </head>
 <body id="body">
@@ -514,6 +528,13 @@ <h1><a href="/" style="color:inherit;text-decoration:none">CODEC</a></h1>
         <div class="status" id="statusLabel">Tap to start voice call</div>
         <div class="interrupt-hint" id="interruptHint"></div>
 
+        <!-- Voice mode: flash / default / think (docs/VOICE-MODES-DESIGN.md) -->
+        <div class="mode-row" id="modeRow">
+            <button class="mode-pill" id="modeFlash" onclick="setVoiceMode('flash')" title="Fastest replies — trimmed context, one-sentence answers">⚡ Flash</button>
+            <button class="mode-pill active" id="modeDefault" onclick="setVoiceMode('default')" title="Standard voice chat">Normal</button>
+            <button class="mode-pill think" id="modeThink" onclick="setVoiceMode('think')" title="Live tool calling — lights, music, web, calendar, email — with spoken progress">🧠 Think</button>
+        </div>
+
         <!-- Action row: your turn + nudge -->
         <div class="action-row" id="actionRow">
             <button class="action-btn your-turn" id="yourTurnBtn" onclick="sendYourTurn()">
@@ -859,9 +880,16 @@ <h1><a href="/" style="color:inherit;text-decoration:none">CODEC</a></h1>
                     } else if (msg.type === 'hint') {
                         var hint = document.getElementById('interruptHint');
                         if (hint) hint.textContent = msg.text || '';
+                    } else if (msg.type === 'mode') {
+                        updateModePills(msg.mode);
                     } else if (msg.type === 'status') {
                         if (msg.status === 'processing') setState('processing');
                         else if (msg.status === 'analyzing_screen') setState('analyzing_screen');
+                        else if (msg.status === 'tool_running') {
+                            setState('processing');
+                            var sl = document.getElementById('statusLabel');
+                            if (sl) sl.textContent = '🛠 Running tools…';
+                        }
                         else if (msg.status === 'listening') {
                             if (!isPlaying) setState('listening');
                             var hint = document.getElementById('interruptHint');
@@ -1026,6 +1054,23 @@ <h1><a href="/" style="color:inherit;text-decoration:none">CODEC</a></h1>
     }
 
     /* ── "Your Turn" — force-send current audio buffer as utterance ── */
+    /* ── Voice modes (flash / default / think) ── */
+    var voiceMode = 'default';
+    function updateModePills(m) {
+        voiceMode = m || 'default';
+        var ids = { flash: 'modeFlash', 'default': 'modeDefault', think: 'modeThink' };
+        Object.keys(ids).forEach(function(k) {
+            var el = document.getElementById(ids[k]);
+            if (el) el.classList.toggle('active', k === voiceMode);
+        });
+    }
+    function setVoiceMode(m) {
+        updateModePills(m);  /* optimistic — server ack confirms */
+        if (ws && ws.readyState === WebSocket.OPEN) {
+            try { ws.send(JSON.stringify({ type: 'mode', mode: m })); } catch (e) {}
+        }
+    }
+
     function sendYourTurn() {
         if (!ws || ws.readyState !== WebSocket.OPEN || !isInCall) return;
         ws.send(JSON.stringify({ type: 'your_turn' }));
diff --git a/codec_voice.py b/codec_voice.py
index 4ec7dc2..2e30da7 100644
--- a/codec_voice.py
+++ b/codec_voice.py
@@ -275,6 +275,49 @@ def _clear_voice_session_marker() -> None:
 # Max conversation turns to keep in context (prevents bloat → keeps LLM fast)
 MAX_CONTEXT_TURNS = 20
 
+# ── Voice modes (flash / default / think) — docs/VOICE-MODES-DESIGN.md ──────
+try:
+    _voice_mode_cfg = _cfg.get("voice", {}) if isinstance(_cfg, dict) else {}
+except NameError:
+    _voice_mode_cfg = {}
+VOICE_MODES_ENABLED = os.environ.get("VOICE_MODES_ENABLED", "true").lower() != "false"
+VOICE_DEFAULT_MODE = _voice_mode_cfg.get("default_mode", "default")
+if VOICE_DEFAULT_MODE not in ("flash", "default", "think"):
+    VOICE_DEFAULT_MODE = "default"
+FLASH_CFG = {"max_tokens": 400, "context_turns": 8, "tts_speed": 1.25,
+             **_voice_mode_cfg.get("flash", {})}
+THINK_CFG = {"max_tool_calls": 6, "max_seconds": 120,
+             **_voice_mode_cfg.get("think", {})}
+
+# Curated think-mode skill allowlist. config.json:voice.think.skills may
+# override the LIST, but the hard exclusions below always win.
+VOICE_THINK_SKILLS = [
+    "philips_hue", "music", "chrome_open", "web_search", "web_fetch",
+    "weather", "time", "timer", "reminders", "notes",
+    "google_calendar", "google_gmail", "imessage_send",
+]
+# NEVER tool-callable from live voice, regardless of config:
+_THINK_HARD_EXCLUDE = {
+    "terminal", "shell", "python_exec", "file_write", "file_ops", "system",
+    "process_manager", "pm2_control", "ax_control", "pilot", "create_skill",
+    "skill_forge", "delegate", "file_read", "google_docs_create",
+}
+
+_MODE_WORDS = {"flash": "flash", "think": "think", "thinking": "think",
+               "normal": "default", "default": "default", "regular": "default"}
+_MODE_SWITCH_RE = re.compile(
+    r"\b(flash|thinking|think|normal|default|regular)\s+mode\b", re.IGNORECASE)
+
+
+def parse_mode_switch(text: str):
+    """Return 'flash'|'think'|'default' when the utterance is a terse
+    mode-switch command, else None. Utterances over 6 words never switch —
+    keeps 'i think mode collapse is interesting' from hijacking the session."""
+    if not text or len(text.split()) > 6:
+        return None
+    m = _MODE_SWITCH_RE.search(text)
+    return _MODE_WORDS[m.group(1).lower()] if m else None
+
 # ── System Prompt ─────────────────────────────────────────────────────────
 def _build_system_prompt() -> str:
     import datetime as _dt
@@ -399,6 +442,9 @@ def __init__(self, websocket, resume_session_id: str | None = None):
         self.skills = {}
         self._http  = httpx.AsyncClient(timeout=120.0)
         self._warmed_up = False
+        # Voice mode (flash / default / think) — per-session, switchable by
+        # voice command or WS control message. docs/VOICE-MODES-DESIGN.md.
+        self.mode = VOICE_DEFAULT_MODE if VOICE_MODES_ENABLED else "default"
         self._load_skills()
 
     @classmethod
@@ -579,12 +625,14 @@ async def transcribe(self, pcm: bytes) -> str:
     # ── LLM ───────────────────────────────────────────────────────────────
 
     def _trimmed_messages(self) -> list:
-        """Keep system prompt + last MAX_CONTEXT_TURNS message pairs."""
+        """Keep system prompt + last N message pairs (flash trims harder —
+        smaller prefill is the main latency lever on the local 35B)."""
         system = [m for m in self.messages if m["role"] == "system"]
         convo  = [m for m in self.messages if m["role"] != "system"]
+        turns = (FLASH_CFG["context_turns"]
+                 if getattr(self, "mode", "default") == "flash" else MAX_CONTEXT_TURNS)
         # Each turn = 2 messages (user + assistant)
-        max_msgs = MAX_CONTEXT_TURNS * 2
-        return system + convo[-max_msgs:]
+        return system + convo[-turns * 2:]
 
     async def _stream_qwen(self, messages: list, max_tokens: int = 2000):
         # A-12 (PR-3E-async): codec_llm.astream owns the SSE POST + parsing and
@@ -669,39 +717,51 @@ async def _analyze_screenshot(self, image_b64: str, user_text: str) -> str:
     async def generate_response(self, user_text: str):
         self.messages.append({"role": "user", "content": user_text})
         self._warmed_up = False  # reset so next speech start can warm up again
-        # Inject targeted memory context for this specific question
-        try:
-            from codec_memory import CodecMemory
-            cm = CodecMemory()
-            targeted = cm.get_context(user_text, n=3)
-            if targeted:
-                self.messages[0] = {
-                    "role": "system",
-                    "content": _build_system_prompt() + f"\n\n[MEMORY — RELEVANT CONTEXT]\n{targeted}\n[END MEMORY]"
-                }
-        except Exception:
-            log.debug("voice: targeted-memory injection skipped", exc_info=True)
-        # Phase 2 Step 5 — Observer summary injection (gated per §X).
-        # Voice always uses local Qwen by default (transport="local"); if
-        # the user has cloud-routed voice configured (vision_provider=
-        # "gemini"), pass transport="voice" so the cloud-transport gate
-        # applies. Audit emit fires inside the helper.
-        try:
-            from codec_observer import maybe_inject_observation_summary
-            _voice_transport = "voice" if VISION_PROVIDER == "gemini" else "local"
-            _obs_summary, _obs_reason = maybe_inject_observation_summary(
-                user_prompt=user_text or "",
-                transport=_voice_transport,
-                skill_name=None,
-                skill_module=None,
-            )
-            if _obs_summary and self.messages and self.messages[0].get("role") == "system":
-                # Append after memory block, before next user turn
-                self.messages[0]["content"] += f"\n\n{_obs_summary}"
-        except Exception as _e:
-            log.debug(f"observer injection failed (non-fatal): {_e}")
+        _flash = getattr(self, "mode", "default") == "flash"
+        # FLASH: skip per-turn memory + observer injections entirely — both add
+        # prefill tokens and a SQLite/FTS query on every turn. Warmup memory
+        # (warmup_llm) still applies once per session.
+        if not _flash:
+            # Inject targeted memory context for this specific question
+            try:
+                from codec_memory import CodecMemory
+                cm = CodecMemory()
+                targeted = cm.get_context(user_text, n=3)
+                if targeted:
+                    self.messages[0] = {
+                        "role": "system",
+                        "content": _build_system_prompt() + f"\n\n[MEMORY — RELEVANT CONTEXT]\n{targeted}\n[END MEMORY]"
+                    }
+            except Exception:
+                log.debug("voice: targeted-memory injection skipped", exc_info=True)
+            # Phase 2 Step 5 — Observer summary injection (gated per §X).
+            # Voice always uses local Qwen by default (transport="local"); if
+            # the user has cloud-routed voice configured (vision_provider=
+            # "gemini"), pass transport="voice" so the cloud-transport gate
+            # applies. Audit emit fires inside the helper.
+            try:
+                from codec_observer import maybe_inject_observation_summary
+                _voice_transport = "voice" if VISION_PROVIDER == "gemini" else "local"
+                _obs_summary, _obs_reason = maybe_inject_observation_summary(
+                    user_prompt=user_text or "",
+                    transport=_voice_transport,
+                    skill_name=None,
+                    skill_module=None,
+                )
+                if _obs_summary and self.messages and self.messages[0].get("role") == "system":
+                    # Append after memory block, before next user turn
+                    self.messages[0]["content"] += f"\n\n{_obs_summary}"
+            except Exception as _e:
+                log.debug(f"observer injection failed (non-fatal): {_e}")
+        msgs = self._trimmed_messages()
+        if _flash and msgs and msgs[0].get("role") == "system":
+            msgs = ([{"role": "system",
+                      "content": msgs[0]["content"] +
+                      "\n\nFLASH MODE: reply in ONE short conversational sentence."}]
+                    + msgs[1:])
+        max_tok = FLASH_CFG["max_tokens"] if _flash else 2000
         full = ""
-        async for chunk in self._stream_qwen(self._trimmed_messages()):
+        async for chunk in self._stream_qwen(msgs, max_tokens=max_tok):
             full += chunk
             yield chunk
         # L2 / SR-62: don't persist the spoken error sentinel as a real
@@ -718,10 +778,12 @@ async def synthesize(self, text: str) -> Optional[bytes]:
         if not text:
             return None
         try:
+            _speed = (FLASH_CFG["tts_speed"]
+                      if getattr(self, "mode", "default") == "flash" else 1.15)
             r = await self._http.post(
                 KOKORO_URL,
                 json={"model": KOKORO_MODEL, "input": text,
-                      "voice": KOKORO_VOICE, "speed": 1.15},
+                      "voice": KOKORO_VOICE, "speed": _speed},
             )
             if r.status_code == 200:
                 return r.content
@@ -1065,6 +1127,96 @@ async def voice_cb(update):
 
         return None
 
+    # ── THINK mode: live tool-calling agent loop ─────────────────────────
+    # docs/VOICE-MODES-DESIGN.md §3.3 — multi-step actions by voice ("kill the
+    # lights and put on some jazz") with narrated progress while the user
+    # waits. Tools are the curated allowlist only; destructive skills hit the
+    # Step-3 strict-consent voice flow inside their own implementations.
+
+    _THINK_ROLE = (
+        "You are CODEC running in live voice THINK mode on the user's Mac. "
+        "You can call tools to act in the real world: lights, music, web, "
+        "calendar, email, messages, timers, reminders. Use tools one at a "
+        "time as needed, then answer. Your FINAL answer is SPOKEN aloud: "
+        "1-3 plain conversational sentences, no markdown, no lists. "
+        "If no tool is needed, just answer directly."
+    )
+
+    def _think_tools(self):
+        """Curated tool set for the voice agent. Config may swap the list
+        (voice.think.skills) but _THINK_HARD_EXCLUDE always wins."""
+        from codec_agents import load_skill_tools
+        allowed = set(THINK_CFG.get("skills") or VOICE_THINK_SKILLS)
+        allowed -= _THINK_HARD_EXCLUDE
+        return [t for t in load_skill_tools() if t.name in allowed]
+
+    def _emit_mode_change(self, mode: str, via: str):
+        try:
+            from codec_audit import log_event
+            log_event("voice_mode_changed", "codec-voice",
+                      f"voice mode -> {mode}",
+                      extra={"mode": mode, "via": via},
+                      transport="voice",
+                      correlation_id=getattr(self, "_cid", None))
+        except Exception:
+            log.debug("voice_mode_changed emit failed", exc_info=True)
+
+    async def dispatch_think_agent(self, user_text: str) -> Optional[str]:
+        """Run the think-mode agent loop. Returns the spoken result, a stop
+        message on interrupt/timeout, or None to fall through to plain LLM."""
+        try:
+            from codec_agents import Agent
+
+            async def think_cb(update):
+                # Narrate each tool call — this IS the extended-wait keepalive.
+                if not isinstance(update, dict):
+                    return
+                if update.get("status") == "tool_call" and update.get("tool"):
+                    msg = f"Using {str(update['tool']).replace('_', ' ')}…"
+                    if not await self._safe_send_json(
+                            {"type": "transcript", "role": "system", "text": msg}):
+                        return
+                    a = await self.synthesize(msg)
+                    if a and await self._safe_send_bytes(a):
+                        self.last_tts_end = self._tts_playback_end_time(a)
+
+            agent = Agent(name="CODEC", role=self._THINK_ROLE,
+                          tools=self._think_tools(),
+                          max_tool_calls=int(THINK_CFG.get("max_tool_calls", 6)),
+                          verbose=False)
+            # Recent turns as context so "turn them off" resolves pronouns.
+            recent = "\n".join(
+                f"{m['role']}: {m['content'][:200]}"
+                for m in self.messages[-6:] if m.get("role") != "system")
+
+            run_task = asyncio.ensure_future(
+                agent.run(user_text, context=recent, callback=think_cb))
+            started = time.monotonic()
+            max_s = float(THINK_CFG.get("max_seconds", 120))
+            try:
+                while not run_task.done():
+                    if self.interrupted.is_set():
+                        run_task.cancel()
+                        return "Stopped."
+                    if time.monotonic() - started > max_s:
+                        run_task.cancel()
+                        return ("That was taking too long, so I stopped it. "
+                                "Want me to try a simpler version?")
+                    await asyncio.sleep(0.2)
+                result = (run_task.result() or "").strip()
+            finally:
+                if run_task.cancelled() or not run_task.done():
+                    try:
+                        await run_task
+                    except (asyncio.CancelledError, Exception):
+                        pass
+            return result or None
+        except asyncio.CancelledError:
+            raise
+        except Exception as e:
+            log.error(f"Think-agent error: {e}")
+            return None
+
     # ── Memory ────────────────────────────────────────────────────────────
 
     def save_to_memory(self):
@@ -1212,6 +1364,15 @@ async def _audio_receiver(self):
                         elif ctrl_type == "hold_start":
                             # User started hold-to-talk — ensure we're in listening mode
                             log.info("Hold-to-talk started")
+
+                        elif ctrl_type == "mode":
+                            # UI mode pill — docs/VOICE-MODES-DESIGN.md
+                            _m = str(ctrl.get("mode", "")).lower()
+                            if VOICE_MODES_ENABLED and _m in ("flash", "default", "think"):
+                                self.mode = _m
+                                self._emit_mode_change(_m, via="ui")
+                                await self.ws.send_json({"type": "mode", "mode": _m})
+                                log.info(f"Voice mode → {_m} (via UI)")
                     except Exception as e:
                         log.warning(f"WS text parse warning: {e}")
                     continue
@@ -1381,6 +1542,24 @@ async def _pipeline(self):
                     await self.ws.send_json({"type": "status", "status": "listening"})
                     continue
 
+                # 2a0. Mode switch by voice command ("flash mode" / "think
+                # mode" / "normal mode") — terse commands only, see
+                # parse_mode_switch. docs/VOICE-MODES-DESIGN.md.
+                if VOICE_MODES_ENABLED:
+                    _new_mode = parse_mode_switch(user_text)
+                    if _new_mode:
+                        self.mode = _new_mode
+                        self._emit_mode_change(_new_mode, via="voice")
+                        ack = {"flash": "Flash mode.",
+                               "think": "Think mode. I can run tools while we talk.",
+                               "default": "Normal mode."}[_new_mode]
+                        await self._safe_send_json({"type": "mode", "mode": _new_mode})
+                        await self.ws.send_json({"type": "transcript", "role": "assistant", "text": ack})
+                        await self._speak(ack)
+                        self.processing = False
+                        await self.ws.send_json({"type": "status", "status": "listening"})
+                        continue
+
                 # 2a. Crew dispatch
                 crew_result = await self.dispatch_crew_from_voice(user_text)
                 if crew_result:
@@ -1407,6 +1586,21 @@ async def _pipeline(self):
                         continue
                     # skill returned nothing → fall through to LLM
 
+                # 2c. THINK mode — live tool-calling agent loop (after the
+                # single-skill fast path, before plain chat). Falls through to
+                # the LLM if the agent declines or errors.
+                if VOICE_MODES_ENABLED and self.mode == "think":
+                    await self.ws.send_json({"type": "status", "status": "tool_running"})
+                    think_result = await self.dispatch_think_agent(user_text)
+                    if think_result:
+                        self.messages.append({"role": "user",      "content": user_text})
+                        self.messages.append({"role": "assistant", "content": think_result})
+                        await self.ws.send_json({"type": "transcript", "role": "assistant", "text": think_result})
+                        await self._speak(think_result)
+                        self.processing = False
+                        await self.ws.send_json({"type": "status", "status": "listening"})
+                        continue
+
                 # 3. LLM streaming path
                 sentence_buf = ""
                 full_text    = ""
@@ -1486,6 +1680,8 @@ async def run(self):
 
         # Send session ID so client can reconnect to this session
         await self.ws.send_json({"type": "session", "session_id": self.session_id})
+        if VOICE_MODES_ENABLED:
+            await self.ws.send_json({"type": "mode", "mode": self.mode})
 
         if is_resumed:
             # Reconnected — short acknowledgement, no full greeting
diff --git a/docs/VOICE-MODES-DESIGN.md b/docs/VOICE-MODES-DESIGN.md
new file mode 100644
index 0000000..7abc9d9
--- /dev/null
+++ b/docs/VOICE-MODES-DESIGN.md
@@ -0,0 +1,91 @@
+# CODEC Voice Modes — Flash / Default / Think
+
+**Date:** 2026-06-09 · **Status:** APPROVED + IMPLEMENTED (operator decisions §8: 1=email-send in v1, 2=keep fast path, 3=voice+UI pills). Tests: tests/test_voice_modes.py (11) + tests/test_gmail_send.py (6).
+
+## 1. What & why
+
+CODEC's live voice-to-voice chat gets three modes, same interface:
+
+| Mode | Promise | How |
+|---|---|---|
+| **Flash** ⚡ | Snappiest possible turn-around for quick back-and-forth | Trim everything that adds prefill/decode latency |
+| **Default** | Exactly today's behavior | Untouched code path — zero regression |
+| **Think** 🧠 | Live multi-step tool-calling while you talk: lights, music, web, calendar, email — with spoken progress while you wait | Route through a voice-scoped `codec_agents.Agent` loop with a curated skill allowlist |
+
+Why: the live demo ("CODEC, kill the lights and put on some jazz" → both happen, narrated) and real daily utility (calendar+email+web by voice). The interface stays the current `/voice` page; think mode just *extends the wait* with spoken/visual progress — the exact pattern `dispatch_crew_from_voice` already uses (`codec_voice.py:1025-1044`).
+
+## 2. Current facts this design builds on (verified, file:line)
+
+- LLM call is hardcoded: `max_tokens=2000, temperature=0.7, enable_thinking=False` at `codec_voice.py:600-605`; `enable_thinking` stripped from `llm_kwargs` at `:209`.
+- Per-turn injections: targeted memory `:674-683`, observer summary `:689-702`, context trim keeps 20 turns `:276,581-587`.
+- Voice fires **one skill per utterance** (`dispatch_skill` `:920-955`); the only multi-step path is crews, which already stream spoken progress via `voice_cb` (`:1025-1044`) — the think-mode template.
+- `Agent.run(task, context, callback)` fires callback on every `tool_call` + `complete` (`codec_agents.py:501,610-614,670`); tools come from `load_skill_tools()`; `max_tool_calls` per agent.
+- Voice strict-consent exists: `_announce_pending_question` + `_resolve_voice_option_choice` with fuzzy match BYPASSED when strict (`codec_voice.py:94-154,847-918`).
+- WS protocol has no mode field; client control messages are additive-friendly (`:1179-1214`).
+- `google_gmail` is **read-only** today. `imessage_send` sends. `philips_hue`, `music`, `chrome_open`, `web_search`, `web_fetch`, `google_calendar` (read+create), `timer`, `reminders`, `weather`, `notes` all exist.
+- Step budget `step_budget.voice=5` is configured but **not enforced** in the voice path.
+
+## 3. Design
+
+### 3.1 Mode state & switching (same interface)
+- `VoicePipeline.mode ∈ {"flash","default","think"}`, initialized from `config.json:voice.default_mode` (default `"default"`).
+- **Voice command switch** (primary): "flash mode" / "think mode" / "normal mode" matched pre-LLM in `_pipeline`; speaks a one-word confirm ("Flash."), persists for the session.
+- **WS control message** (additive): client→server `{"type":"mode","mode":"think"}`; server acks `{"type":"mode","mode":...}` so the UI can show a small mode chip. Three tiny pills added to `codec_voice.html` header — no layout redesign.
+
+### 3.2 Flash mode ⚡
+All changes are per-call parameters inside `generate_response`/`_stream_qwen` when `mode=="flash"` (the 35B model stays — prefill size is the lever):
+- `max_tokens` 2000 → **400** (voice rule is 1–3 sentences anyway; caps worst-case decode)
+- **Skip observer injection** (`:689-702`) and **skip per-turn targeted-memory injection** (`:674-683`; warmup memory from `warmup_llm` stays)
+- Context trim 20 → **8 turns** (smaller prefill on every turn)
+- Flash system-prompt variant: same identity, rule tightened to "reply in ONE short sentence"
+- TTS speed 1.15 → **1.25**
+- Skill dispatch unchanged (it's already the fastest path).
+
+### 3.3 Think mode 🧠
+- Utterance flow: crew triggers → single-skill trigger match (existing fast path, kept) → **voice agent loop** (new) instead of plain LLM chat.
+- The loop: `Agent(name="CODEC", role=<voice-think prompt>, tools=think_tools, max_tool_calls=6).run(user_text, callback=voice_progress_cb)` — `voice_progress_cb` mirrors `voice_cb`: on each `tool_call` it sends a transcript line **and speaks** a short narration ("Turning off the lights…"), which doubles as the keep-alive during the extended wait.
+- **Curated allowlist `VOICE_THINK_SKILLS`** (config-overridable at `voice.think.skills`):
+  `philips_hue, music, chrome_open, web_search, web_fetch, weather, time, timer, reminders, notes, google_calendar, google_gmail, imessage_send` (+ `gmail send` per §3.4 decision).
+  **Hard exclusions, not configurable around:** `terminal, python_exec, file_write, file_ops, system, process_manager, pm2_control, ax_control, pilot, create_skill` — the same class `_HTTP_BLOCKED` protects.
+- **Destructive gating:** `imessage_send`, calendar-create, email-send route through the existing Step-3 strict-consent voice flow (literal verb spoken to confirm; fuzzy bypassed). Read/lookup tools run free.
+- **Budgets:** `max_tool_calls=6` + wall-clock guard 120s (config `voice.think.max_seconds`) + the user can interrupt — existing `interrupted` event (`:1179`) is checked between tool calls and aborts the loop with a spoken "Stopped."
+- `enable_thinking` stays **False** even in think mode — "think" = tool reasoning via the agent loop, not Qwen `<think>` tags (which would add tens of seconds on the 35B). Listed as a future tunable.
+- Plugin hooks + audit: tool execution goes through the skill `Tool` wrappers → existing `run_with_hooks` chokepoint in `Agent._execute_tool_with_hooks` — every action audited + vetoable, nothing new to build.
+
+### 3.4 Email send (decision pending)
+`google_gmail` is read-only. To satisfy "send an email by voice": add a `send` action to `skills/google_gmail.py` (Gmail API `users.messages.send`, scope already authed? — verify token scopes; if scope missing, re-auth flow documented in PR). Voice path: compose → CODEC reads the draft aloud → strict consent ("say 'send' to confirm") → send → audit. Built-in skill edit ⇒ **manifest regen required** (PR-1A).
+
+## 4. Schema / API changes
+- **config.json — additive only, safe defaults ⇒ NO config_version bump (A-15):**
+  `voice.default_mode`, `voice.flash.{max_tokens,context_turns,tts_speed}`, `voice.think.{max_tool_calls,max_seconds,skills}`.
+- **WS protocol — additive message types only:** client `{"type":"mode",...}`; server `{"type":"mode",...}` ack; think-mode progress reuses existing `transcript`/`status` types (new status value `"tool_running"`).
+- **Audit:** one new event name `voice_mode_changed` (info, single-emit). AGENTS.md §6 updated in the PR.
+- No memory-db, no identity-file, no `_HTTP_BLOCKED` changes.
+
+## 5. Files touched
+| File | Change |
+|---|---|
+| `codec_voice.py` | mode state + switch, flash params, think agent loop + progress cb + consent + budgets |
+| `codec_voice.html` | 3 mode pills + current-mode chip; send mode over WS |
+| `routes/websocket.py` | pass `voice.default_mode` into pipeline ctor |
+| `skills/google_gmail.py` (+ manifest) | optional `send` action per §3.4 decision |
+| `tests/test_voice_modes.py` | new — see §6 |
+| `AGENTS.md` §6 | `voice_mode_changed` event row |
+
+## 6. Test plan (TDD; heal-loop riding along)
+- Mode-switch phrase parsing (flash/think/normal, embedded in sentences, wake-word noise).
+- Flash: monkeypatch `codec_llm.astream`, assert `max_tokens=400`, no observer/memory injection calls, 8-turn trim.
+- Think: agent constructed with ONLY allowlisted tools (assert `terminal` etc. absent even if config tries to add them); callback narration emitted per tool call; interrupt event aborts between calls; wall-clock guard.
+- Consent: destructive tool in think mode raises the ask_user flow; generic "yes" rejected under strict.
+- Gmail send (if approved): unit-mocked API call + consent gate; manifest regen in CI check.
+- Live: scripted demo run — "kill the lights and put on jazz" two-tool chain.
+
+## 7. Migration & rollback
+- Defaults make this invisible: `voice.default_mode="default"` ⇒ behavior is byte-identical until a mode is switched.
+- Kill switch: `VOICE_MODES_ENABLED=false` env (pattern of Step-3 flags) — forces default mode, hides pills.
+- Rollback = flip the env var or revert the PR; no state files, no schema migrations.
+
+## 8. Open decisions (operator)
+1. Email-send in v1 vs fast-follow (§3.4).
+2. Think routing: keep single-skill fast path before the agent loop (recommended) vs everything through the agent.
+3. Mode pills in UI + voice command (recommended) vs voice command only.
diff --git a/skills/.manifest.json b/skills/.manifest.json
index 1e32d5d..bdf4f96 100644
--- a/skills/.manifest.json
+++ b/skills/.manifest.json
@@ -43,7 +43,7 @@
     "google_calendar.py": "7ef8c9a7fd02a5c2b52c7ad09094bda0c15851360345c5cb110cfd032ef9a562",
     "google_docs.py": "75980457cb9304e970e9dcaaa12e2acca51559344d2f022896260a6a884f8318",
     "google_drive.py": "af70de60bb98e2ce2aa6ac4522349b56b2932ed831b182453a22e5f96edd246c",
-    "google_gmail.py": "d0050ae711e7caf08b4701c84ee7f2dce483d020f43bde4076fa14da20a01834",
+    "google_gmail.py": "f172d91c8a59e9a80654016a67b949c5b2a26f3b4f66848e2286285a8345c5a5",
     "google_keep.py": "0f7f9c6a117f4a9ce2aac96da683e23a1e37a05b4c786a45d5cb15d511921f9d",
     "google_sheets.py": "d9b67b7e46ac835f4ef6d171d161b962c93c1916837f1b6aa5f4ec2804a36e69",
     "google_slides.py": "30193598c0214305c03412911781dd32794e6c9d6349ed6a242753c38eb49101",
diff --git a/skills/google_gmail.py b/skills/google_gmail.py
index 0496d71..d06c2f3 100644
--- a/skills/google_gmail.py
+++ b/skills/google_gmail.py
@@ -1,19 +1,77 @@
-"""Google Gmail — Check emails, search inbox"""
+"""Google Gmail — Check emails, search inbox, send (consent-gated)"""
 SKILL_NAME = "google_gmail"
-SKILL_TRIGGERS = ["check email", "check my email", "my emails", "inbox", "unread emails", "new emails", "any emails", "latest emails", "email from", "search email"]
-SKILL_DESCRIPTION = "Check your Gmail inbox, search for emails, and view recent messages"
+SKILL_TRIGGERS = ["check email", "check my email", "my emails", "inbox", "unread emails", "new emails", "any emails", "latest emails", "email from", "search email", "send email", "send an email"]
+SKILL_DESCRIPTION = "Check your Gmail inbox, search emails, and send emails (sending always requires an explicit spoken/PWA confirmation)"
 SKILL_MCP_EXPOSE = True
 
 import os
+import re
 
 TOKEN_PATH = os.path.expanduser("~/.codec/google_token.json")
 
+# Matches an explicit send intent ("send email…", "send an email…", or a task
+# starting with send). \b keeps "sender"/"unsend" out of the send path.
+_SEND_RE = re.compile(r"^\s*send\b|\bsend\b[^.]*\bemail\b|\bemail\b[^.]*\bsend\b", re.IGNORECASE)
+
+_USAGE = ("To send, repeat with explicit fields: "
+          "send email to: someone@example.com subject: <subject> body: <message>")
+
+
 def _get_service():
     import sys; sys.path.insert(0, os.path.expanduser("~/codec-repo"))
     from codec_google_auth import build_service
     return build_service("gmail", "v1")
 
+
+def _parse_send(task):
+    """Extract (to, subject, body). to/body required; subject optional."""
+    to = re.search(r"to:\s*([^\s,;<>]+@[^\s,;<>]+)", task, re.IGNORECASE)
+    if not to:
+        to = re.search(r"\bto\s+([^\s,;<>]+@[^\s,;<>]+)", task, re.IGNORECASE)
+    subject = re.search(r"subject:\s*(.+?)(?=\s+body:|$)", task, re.IGNORECASE | re.DOTALL)
+    body = re.search(r"body:\s*(.+)$", task, re.IGNORECASE | re.DOTALL)
+    return (to.group(1).strip() if to else None,
+            subject.group(1).strip() if subject else "",
+            body.group(1).strip() if body else None)
+
+
+def _send_email(task):
+    """Consent-gated send (Phase-1 Step-3 strict consent, verb='send').
+    Fails CLOSED: no confirmation → no send, ever."""
+    to, subject, body = _parse_send(task)
+    if not to or not body:
+        return _USAGE
+    try:
+        import sys; sys.path.insert(0, os.path.expanduser("~/codec-repo"))
+        import codec_ask_user
+        preview = body[:140] + ("…" if len(body) > 140 else "")
+        answer = codec_ask_user.ask(
+            f"Send this email? To {to} — subject \"{subject or '(no subject)'}\" — "
+            f"\"{preview}\". Say 'send' to confirm.",
+            destructive=True, destructive_verb="send", tool_name="google_gmail")
+    except Exception as e:
+        return f"Couldn't get send confirmation ({e}) — email NOT sent."
+    sentinels = {getattr(codec_ask_user, "TIMEOUT_SENTINEL", ""),
+                 getattr(codec_ask_user, "DISABLED_SENTINEL", "")}
+    if not answer or answer in sentinels or "send" not in answer.lower():
+        return "Okay — email not sent."
+    try:
+        import base64
+        from email.mime.text import MIMEText
+        service = _get_service()
+        msg = MIMEText(body)
+        msg["to"] = to
+        msg["subject"] = subject or "(no subject)"
+        raw = base64.urlsafe_b64encode(msg.as_bytes()).decode()
+        service.users().messages().send(userId="me", body={"raw": raw}).execute()
+        return f"Email sent to {to}: {subject or '(no subject)'}."
+    except Exception as e:
+        return f"Gmail send error: {e}"
+
+
 def run(task, app="", ctx=""):
+    if _SEND_RE.search(task or ""):
+        return _send_email(task)
     try:
         service = _get_service()
         low = task.lower()
diff --git a/tests/test_gmail_send.py b/tests/test_gmail_send.py
new file mode 100644
index 0000000..ff364b0
--- /dev/null
+++ b/tests/test_gmail_send.py
@@ -0,0 +1,121 @@
+"""Tests for the google_gmail `send` action (voice think-mode v1).
+
+Contract (docs/VOICE-MODES-DESIGN.md §3.4):
+- "send email …" routes to the send path; reading stays untouched.
+- Sending ALWAYS goes through codec_ask_user strict consent
+  (destructive_verb="send"); timeout / disabled / non-verb answers ⇒ NOT sent.
+- Missing to/body ⇒ usage hint (agent-friendly), no consent prompt, no send.
+"""
+import os
+import sys
+
+sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", "skills"))
+sys.path.insert(0, os.path.join(os.path.dirname(__file__), ".."))
+
+import codec_ask_user  # noqa: E402
+import google_gmail  # noqa: E402
+
+
+class _FakeSend:
+    def __init__(self, store):
+        self.store = store
+
+    def execute(self):
+        return {"id": "m1"}
+
+
+class _FakeMessages:
+    def __init__(self, store):
+        self.store = store
+
+    def send(self, userId=None, body=None):
+        self.store.append(body)
+        return _FakeSend(self.store)
+
+
+class _FakeUsers:
+    def __init__(self, store):
+        self._m = _FakeMessages(store)
+
+    def messages(self):
+        return self._m
+
+
+class _FakeService:
+    def __init__(self, store):
+        self._u = _FakeUsers(store)
+
+    def users(self):
+        return self._u
+
+
+def _wire(monkeypatch, answer):
+    sent = []
+    monkeypatch.setattr(google_gmail, "_get_service", lambda: _FakeService(sent))
+    asked = {}
+
+    def fake_ask(question, **kw):
+        asked.update(kw, question=question)
+        return answer
+
+    monkeypatch.setattr(codec_ask_user, "ask", fake_ask)
+    return sent, asked
+
+
+def test_send_with_consent(monkeypatch):
+    sent, asked = _wire(monkeypatch, "send")
+    out = google_gmail.run(
+        "send email to: bob@example.com subject: Dinner body: See you at 8.")
+    assert len(sent) == 1, "exactly one send API call"
+    assert asked["destructive"] is True
+    assert asked["destructive_verb"] == "send"
+    assert "sent" in out.lower()
+    import base64
+    raw = base64.urlsafe_b64decode(sent[0]["raw"]).decode()
+    assert "bob@example.com" in raw
+    assert "Dinner" in raw
+    assert "See you at 8." in raw
+
+
+def test_send_refused_without_verb(monkeypatch):
+    sent, _ = _wire(monkeypatch, "no thanks")
+    out = google_gmail.run(
+        "send email to: bob@example.com subject: Hi body: Yo")
+    assert sent == [], "must NOT send without the spoken verb"
+    assert "not sent" in out.lower()
+
+
+def test_send_timeout_sentinel_fails_closed(monkeypatch):
+    sent, _ = _wire(monkeypatch, codec_ask_user.TIMEOUT_SENTINEL)
+    out = google_gmail.run(
+        "send email to: bob@example.com subject: Hi body: Yo")
+    assert sent == []
+    assert "not sent" in out.lower()
+
+
+def test_send_askuser_disabled_fails_closed(monkeypatch):
+    sent, _ = _wire(monkeypatch, codec_ask_user.DISABLED_SENTINEL)
+    out = google_gmail.run(
+        "send email to: bob@example.com subject: Hi body: Yo")
+    assert sent == []
+    assert "not sent" in out.lower()
+
+
+def test_send_missing_fields_returns_usage(monkeypatch):
+    sent, asked = _wire(monkeypatch, "send")
+    out = google_gmail.run("send an email to my brother about dinner")
+    assert sent == []
+    assert "question" not in asked, "no consent prompt for unparseable send"
+    assert "to:" in out and "body:" in out  # agent-friendly usage hint
+
+
+def test_read_path_untouched(monkeypatch):
+    # "check email" must NOT hit the send path or consent.
+    called = {"send_path": False}
+    monkeypatch.setattr(google_gmail, "_send_email",
+                        lambda t: called.__setitem__("send_path", True) or "x")
+    monkeypatch.setattr(google_gmail, "_get_service",
+                        lambda: (_ for _ in ()).throw(RuntimeError("offline")))
+    out = google_gmail.run("check email")
+    assert called["send_path"] is False
+    assert "error" in out.lower()  # read path attempted the (offline) service
diff --git a/tests/test_voice_modes.py b/tests/test_voice_modes.py
new file mode 100644
index 0000000..ce2145a
--- /dev/null
+++ b/tests/test_voice_modes.py
@@ -0,0 +1,199 @@
+"""Tests for CODEC Voice modes (flash / default / think).
+
+Design: docs/VOICE-MODES-DESIGN.md. Three modes on the live voice pipeline:
+- flash:  trimmed prompt + small max_tokens + no per-turn injections
+- default: byte-identical to pre-mode behavior
+- think:  agent loop over a curated skill allowlist with narrated progress
+"""
+import asyncio
+import os
+import sys
+import types
+
+
+sys.path.insert(0, os.path.join(os.path.dirname(__file__), ".."))
+
+import codec_voice  # noqa: E402
+
+
+# ── helpers ──────────────────────────────────────────────────────────────────
+def _mk_pipeline(mode="default"):
+    """Bare VoicePipeline without a websocket / registry scan."""
+    p = object.__new__(codec_voice.VoicePipeline)
+    p.mode = mode
+    p.messages = [{"role": "system", "content": "sys"}]
+    p._warmed_up = True
+    p._stream_error = False
+    p._http = None
+    p.interrupted = asyncio.Event()
+    return p
+
+
+# ── mode-switch phrase parsing ───────────────────────────────────────────────
+def test_parse_flash_mode():
+    assert codec_voice.parse_mode_switch("flash mode") == "flash"
+    assert codec_voice.parse_mode_switch("switch to flash mode") == "flash"
+    assert codec_voice.parse_mode_switch("Flash mode please") == "flash"
+
+
+def test_parse_think_mode():
+    assert codec_voice.parse_mode_switch("think mode") == "think"
+    assert codec_voice.parse_mode_switch("thinking mode") == "think"
+    assert codec_voice.parse_mode_switch("go to think mode") == "think"
+
+
+def test_parse_default_mode():
+    assert codec_voice.parse_mode_switch("normal mode") == "default"
+    assert codec_voice.parse_mode_switch("regular mode") == "default"
+    assert codec_voice.parse_mode_switch("default mode") == "default"
+
+
+def test_parse_no_false_positive_in_long_sentences():
+    # "think mode" inside a real sentence must NOT switch modes
+    assert codec_voice.parse_mode_switch(
+        "i think mode collapse is a fascinating ai failure case to study") is None
+    assert codec_voice.parse_mode_switch("what's the weather like") is None
+    assert codec_voice.parse_mode_switch("") is None
+
+
+# ── flash mode: per-call parameters ──────────────────────────────────────────
+def test_flash_trims_context_harder():
+    p = _mk_pipeline("flash")
+    for i in range(30):
+        p.messages.append({"role": "user", "content": f"u{i}"})
+        p.messages.append({"role": "assistant", "content": f"a{i}"})
+    flash_msgs = p._trimmed_messages()
+    p.mode = "default"
+    default_msgs = p._trimmed_messages()
+    assert len(flash_msgs) == 1 + codec_voice.FLASH_CFG["context_turns"] * 2
+    assert len(default_msgs) == 1 + codec_voice.MAX_CONTEXT_TURNS * 2
+    assert len(flash_msgs) < len(default_msgs)
+
+
+def test_flash_uses_small_max_tokens_and_skips_injections(monkeypatch):
+    captured = {}
+
+    async def fake_astream(messages, **kw):
+        captured.update(kw)
+        captured["messages"] = messages
+        yield "ok."
+
+    import codec_llm
+    monkeypatch.setattr(codec_llm, "astream", fake_astream)
+
+    touched = {"memory": False, "observer": False}
+    import codec_memory
+    monkeypatch.setattr(codec_memory.CodecMemory, "get_context",
+                        lambda self, *a, **k: touched.__setitem__("memory", True) or "ctx")
+    import codec_observer
+    monkeypatch.setattr(codec_observer, "maybe_inject_observation_summary",
+                        lambda **k: touched.__setitem__("observer", True) or (None, ""))
+
+    p = _mk_pipeline("flash")
+
+    async def consume():
+        async for _ in p.generate_response("hello"):
+            pass
+    asyncio.run(consume())
+
+    assert captured["max_tokens"] == codec_voice.FLASH_CFG["max_tokens"]
+    assert touched["memory"] is False, "flash must skip per-turn memory injection"
+    assert touched["observer"] is False, "flash must skip observer injection"
+    # flash brevity rule lands in the system prompt actually sent
+    assert "FLASH" in captured["messages"][0]["content"]
+
+
+def test_default_keeps_2000_tokens(monkeypatch):
+    captured = {}
+
+    async def fake_astream(messages, **kw):
+        captured.update(kw)
+        yield "ok."
+
+    import codec_llm
+    monkeypatch.setattr(codec_llm, "astream", fake_astream)
+
+    p = _mk_pipeline("default")
+
+    async def consume():
+        async for _ in p.generate_response("hello"):
+            pass
+    asyncio.run(consume())
+    assert captured["max_tokens"] == 2000
+
+
+# ── think mode: tool allowlist ───────────────────────────────────────────────
+def _fake_tools(names):
+    return [types.SimpleNamespace(name=n) for n in names]
+
+
+def test_think_tools_enforce_allowlist(monkeypatch):
+    import codec_agents
+    monkeypatch.setattr(codec_agents, "load_skill_tools", lambda: _fake_tools([
+        "philips_hue", "music", "terminal", "shell", "file_write",
+        "web_search", "python_exec", "google_calendar",
+    ]))
+    p = _mk_pipeline("think")
+    names = {t.name for t in p._think_tools()}
+    assert "philips_hue" in names and "music" in names and "web_search" in names
+    assert "terminal" not in names
+    assert "shell" not in names
+    assert "file_write" not in names
+    assert "python_exec" not in names
+
+
+def test_think_hard_exclusions_beat_config(monkeypatch):
+    # Even if config tries to allowlist terminal, the hard-exclusion wins.
+    import codec_agents
+    monkeypatch.setattr(codec_agents, "load_skill_tools",
+                        lambda: _fake_tools(["terminal", "philips_hue"]))
+    monkeypatch.setitem(codec_voice.THINK_CFG, "skills",
+                        ["terminal", "philips_hue"])
+    try:
+        p = _mk_pipeline("think")
+        names = {t.name for t in p._think_tools()}
+        assert "terminal" not in names
+        assert "philips_hue" in names
+    finally:
+        codec_voice.THINK_CFG.pop("skills", None)
+
+
+# ── think mode: interrupt + wall-clock guards ────────────────────────────────
+class _SlowAgent:
+    def __init__(self, *a, **k):
+        pass
+
+    async def run(self, task, context="", callback=None):
+        await asyncio.sleep(30)
+        return "never"
+
+
+def test_think_interrupt_aborts_quickly(monkeypatch):
+    import codec_agents
+    monkeypatch.setattr(codec_agents, "Agent", _SlowAgent)
+    monkeypatch.setattr(codec_agents, "load_skill_tools", lambda: [])
+    p = _mk_pipeline("think")
+
+    async def go():
+        async def trip():
+            await asyncio.sleep(0.15)
+            p.interrupted.set()
+        asyncio.get_event_loop().create_task(trip())
+        return await asyncio.wait_for(p.dispatch_think_agent("do things"), timeout=5)
+
+    out = asyncio.run(go())
+    assert out is not None and "stopp" in out.lower()  # "Stopped."
+
+
+def test_think_wall_clock_guard(monkeypatch):
+    import codec_agents
+    monkeypatch.setattr(codec_agents, "Agent", _SlowAgent)
+    monkeypatch.setattr(codec_agents, "load_skill_tools", lambda: [])
+    monkeypatch.setitem(codec_voice.THINK_CFG, "max_seconds", 0.3)
+    try:
+        p = _mk_pipeline("think")
+        out = asyncio.run(asyncio.wait_for(
+            p.dispatch_think_agent("do things"), timeout=5))
+        assert out is not None and ("long" in out.lower() or "time" in out.lower())
+    finally:
+        codec_voice.THINK_CFG["max_seconds"] = 120