feat: harden unified memory and unify provider-aware thinking controls

[alcholiclg]

Change Summary

Unified memory reliability

• Prevent interrupted turns from marking unrelated history as ingested, and track in-flight ownership so background memory writes are never silently skipped or denied a retry.
• Share one memory instance per store instead of per model, allowing model switches to reuse the same embedded store without file-lock conflicts.
• Reconfigure shared memory instances in place when settings change:
  • apply recall_top_k and ingest_interval immediately;
  • safely drain and rebuild the backend for store-affecting changes;
  • preserve the shared instance so existing agents keep a valid reference.
• Make close() terminal: drain scheduled writes, release the backend safely, and prevent delayed tasks or later reads from reopening a retired store.
• Serialize reads, searches, writes, flushes, and teardown with a store lock scoped by event loop and path, avoiding dead-loop locks and search/write races.
• Forward search limits correctly to Mem0.
• Add dates to recalled memories so conflicting facts can be resolved in favor of the newer entry.
• Configure Mem0 to preserve the user’s language and script during extraction while allowing explicit custom instructions to override the default.

Provider-aware thinking controls

• Introduce a canonical reasoning_effort setting with auto, off, low, medium, high, and max levels.
• Detect the thinking dialect from the endpoint and protocol, then normalize and clamp the requested level for OpenAI, DashScope, ModelScope, DeepSeek, Zhipu, Moonshot, MiniMax, OpenRouter, and Anthropic-compatible APIs.
• Preserve manually supplied wire parameters as an escape hatch and avoid invalid combinations such as reasoning_effort with thinking_budget.
• Send both enable_thinking and reasoning_effort on DashScope because the switch and effort level control different behavior; translate max to DashScope’s xhigh.
• Apply lowering exactly once per request across the legacy OpenAI client, provider-router OpenAI transport, and Anthropic Messages transport, before signature filtering can discard the canonical setting.
• Retry once with thinking explicitly disabled when a model rejects thinking parameters, then memoize the endpoint/model result to prevent repeated failed requests.
• Handle models where reasoning is mandatory by removing the disabling parameters, retrying once, and remembering the constraint without suppressing later positive effort levels.
• Keep unrelated 400 responses unchanged.
• Read both reasoning_content and OpenRouter’s reasoning response field so proxied reasoning remains visible.
• Provide optional MSA_DEBUG_THINKING diagnostics for inspecting the lowered request.

Shell command permissions

• Confirm network-egress commands (curl, wget, ssh, scp, rsync, nc, netcat) instead of refusing them: as blacklist entries no mode or user answer could override them, and blocking by command name never stopped npm, pip, or git from reaching the network anyway — they are ask rules now, enforced on the ordinary permission path where ask_rules had been inert (allow_network: true opts out).
• Stop a bare * in dangerous_removal_paths from being applied as an fnmatch glob, which marked every path dangerous and had the non-bypassable safety layer refuse every rm, rm build/out.txt included; rm -rf /, rm *, and rm ~ stay refused.
• Remember the command that was approved rather than the bare tool name when the caller supplies no pattern, so one allow_always on ls -la no longer releases the whole shell, and match a bare <cmd> against its own <cmd> * pattern.

Multimodal image input

• Accept image attachments end to end — composer upload → message → session log → provider wire → history replay — widening the composer-to-SDK boundary, which previously carried text only. Multiple images are labelled Image N: <filename> so later turns can reference them, and are rescaled or transcoded to fit each provider's limits before sending.
• Carry images as references (workspace path + media type) rather than bytes, expanded into provider-native blocks inside each transport. Session logs stay free of base64, a mid-session model switch re-exposes images already in history, and encoding is recomputed per provider instead of frozen at write time.
• Add a per-model "image understanding" setting read as a tri-state — explicit choice, else provider capability, else an observed refusal — and surface it in the composer before sending when it is off.
• Retry once with images replaced by text when an endpoint rejects an image-carrying request, remembering the model only when that retry succeeds, so an unrelated 400 neither disables images on a capable model nor masks the real error. Write the result back to the model setting.
• Return a short status plus a structured image reference from file_system---read_file instead of base64 in the text channel — inline in tool_result for Anthropic, hoisted into a following user message for the OpenAI family, whose Chat Completions schema restricts tool message content to text parts. Charge image blocks a flat per-image cost in the context estimator, which previously measured base64 length and could let a single image exceed the whole context budget.
• Route multimodal content through a shared flatten_message_text in memory recall, compaction, hooks, session naming and history rendering so it cannot silently degrade, and add an optional image_reader tool that describes an image through a separately configured vision model.

Related issue number

Checklist

• The pull request title is a good summary of the changes - it will be used in the changelog
• Unit tests for the changes exist
• Run pre-commit install and pre-commit run --all-files before git commit, and passed lint check.
• Documentation reflects the changes where applicable