From d7af2d0a465c682ff39121030c7552ff27da69be Mon Sep 17 00:00:00 2001
From: Ruslan Bakiev <572431+veikab@users.noreply.github.com>
Date: Wed, 18 Feb 2026 19:41:34 +0700
Subject: [PATCH] feat(chat): threads UI + graphql flow + qwen/gigachat
 integration

---
 Frontend/app.vue                              | 866 ++++++++++++-----
 .../operations/chat-conversations.graphql     |  10 +
 .../graphql/operations/chat-messages.graphql  |  18 +
 .../operations/create-calendar-event.graphql  |  10 +
 .../create-chat-conversation.graphql          |  10 +
 .../operations/create-communication.graphql   |   6 +
 Frontend/graphql/operations/dashboard.graphql |  73 ++
 .../graphql/operations/log-pilot-note.graphql |   5 +
 Frontend/graphql/operations/login.graphql     |   5 +
 Frontend/graphql/operations/logout.graphql    |   5 +
 Frontend/graphql/operations/me.graphql        |  17 +
 .../select-chat-conversation.graphql          |   5 +
 .../operations/send-pilot-message.graphql     |   5 +
 .../operations/update-feed-decision.graphql   |   6 +
 Frontend/server/agent/crmAgent.ts             |  59 +-
 Frontend/server/agent/langgraphCrmAgent.ts    | 900 +++++++++++++-----
 Frontend/server/api/graphql.post.ts           |  39 +
 Frontend/server/graphql/schema.ts             | 781 +++++++++++++++
 Frontend/server/utils/auth.ts                 |  17 +-
 Frontend/server/utils/password.ts             |  29 +
 compose.yaml                                  |   3 +
 21 files changed, 2432 insertions(+), 437 deletions(-)
 create mode 100644 Frontend/graphql/operations/chat-conversations.graphql
 create mode 100644 Frontend/graphql/operations/chat-messages.graphql
 create mode 100644 Frontend/graphql/operations/create-calendar-event.graphql
 create mode 100644 Frontend/graphql/operations/create-chat-conversation.graphql
 create mode 100644 Frontend/graphql/operations/create-communication.graphql
 create mode 100644 Frontend/graphql/operations/dashboard.graphql
 create mode 100644 Frontend/graphql/operations/log-pilot-note.graphql
 create mode 100644 Frontend/graphql/operations/login.graphql
 create mode 100644 Frontend/graphql/operations/logout.graphql
 create mode 100644 Frontend/graphql/operations/me.graphql
 create mode 100644 Frontend/graphql/operations/select-chat-conversation.graphql
 create mode 100644 Frontend/graphql/operations/send-pilot-message.graphql
 create mode 100644 Frontend/graphql/operations/update-feed-decision.graphql
 create mode 100644 Frontend/server/api/graphql.post.ts
 create mode 100644 Frontend/server/graphql/schema.ts
 create mode 100644 Frontend/server/utils/password.ts

diff --git a/Frontend/app.vue b/Frontend/app.vue
index ec9a171..7c84fd9 100644
--- a/Frontend/app.vue
+++ b/Frontend/app.vue
@@ -1,5 +1,18 @@
 <script setup lang="ts">
 import { onMounted } from "vue";
+import meQuery from "./graphql/operations/me.graphql?raw";
+import chatMessagesQuery from "./graphql/operations/chat-messages.graphql?raw";
+import dashboardQuery from "./graphql/operations/dashboard.graphql?raw";
+import loginMutation from "./graphql/operations/login.graphql?raw";
+import logoutMutation from "./graphql/operations/logout.graphql?raw";
+import sendPilotMessageMutation from "./graphql/operations/send-pilot-message.graphql?raw";
+import logPilotNoteMutation from "./graphql/operations/log-pilot-note.graphql?raw";
+import createCalendarEventMutation from "./graphql/operations/create-calendar-event.graphql?raw";
+import createCommunicationMutation from "./graphql/operations/create-communication.graphql?raw";
+import updateFeedDecisionMutation from "./graphql/operations/update-feed-decision.graphql?raw";
+import chatConversationsQuery from "./graphql/operations/chat-conversations.graphql?raw";
+import createChatConversationMutation from "./graphql/operations/create-chat-conversation.graphql?raw";
+import selectChatConversationMutation from "./graphql/operations/select-chat-conversation.graphql?raw";
 type TabId = "communications" | "documents";
 type CalendarView = "day" | "week" | "month" | "year" | "agenda";
 type SortMode = "name" | "lastContact";
@@ -167,41 +180,187 @@ type PilotMessage = {
   role: "user" | "assistant" | "system";
   text: string;
   plan?: string[] | null;
+  thinking?: string[] | null;
   tools?: string[] | null;
+  toolRuns?: Array<{
+    name: string;
+    status: "ok" | "error";
+    input: string;
+    output: string;
+    at: string;
+  }> | null;
   createdAt?: string;
+  pending?: boolean;
+};
+
+type ChatConversation = {
+  id: string;
+  title: string;
+  createdAt: string;
+  updatedAt: string;
+  lastMessageAt?: string | null;
+  lastMessageText?: string | null;
 };
 
 const pilotMessages = ref<PilotMessage[]>([]);
 const pilotInput = ref("");
 const pilotSending = ref(false);
-const authMe = ref<{ user: { id: string; email: string; name: string }; team: { id: string; name: string } } | null>(
+const authMe = ref<{
+  user: { id: string; phone: string; name: string };
+  team: { id: string; name: string };
+  conversation: { id: string; title: string };
+} | null>(
   null,
 );
-const loginEmail = ref("");
-const loginName = ref("");
-const loginTeamName = ref("My Team");
+const chatConversations = ref<ChatConversation[]>([]);
+const chatThreadsLoading = ref(false);
+const chatSwitching = ref(false);
+const chatCreating = ref(false);
+const selectedChatId = ref("");
+const loginPhone = ref("");
+const loginPassword = ref("");
 const loginError = ref<string | null>(null);
 const loginBusy = ref(false);
 
+const pilotTimeline = computed<PilotMessage[]>(() => {
+  if (!pilotSending.value) return pilotMessages.value;
+  return [
+    ...pilotMessages.value,
+    {
+      id: "__pilot_pending__",
+      role: "assistant",
+      text: "Working on it...",
+      thinking: ["Reading your request", "Planning the next actions", "Preparing the final answer"],
+      tools: [],
+      toolRuns: [],
+      createdAt: new Date().toISOString(),
+      pending: true,
+    },
+  ];
+});
+
+const activeChatConversation = computed<ChatConversation | null>(() => {
+  const activeId = authMe.value?.conversation.id;
+  if (!activeId) return null;
+  const fromList = chatConversations.value.find((item) => item.id === activeId);
+  if (fromList) return fromList;
+  return {
+    id: activeId,
+    title: authMe.value?.conversation.title ?? "Current chat",
+    createdAt: "",
+    updatedAt: "",
+    lastMessageAt: null,
+    lastMessageText: null,
+  };
+});
+
+watch(
+  () => authMe.value?.conversation.id,
+  (id) => {
+    if (id) selectedChatId.value = id;
+  },
+  { immediate: true },
+);
+
+function pilotRoleName(role: PilotMessage["role"]) {
+  if (role === "user") return authMe.value?.user.name ?? "You";
+  if (role === "system") return "System";
+  return "Pilot";
+}
+
+function pilotRoleBadge(role: PilotMessage["role"]) {
+  if (role === "user") return "You";
+  if (role === "system") return "SYS";
+  return "AI";
+}
+
+function formatPilotStamp(iso?: string) {
+  if (!iso) return "";
+  return new Intl.DateTimeFormat("en-GB", {
+    day: "2-digit",
+    month: "short",
+    hour: "2-digit",
+    minute: "2-digit",
+  }).format(new Date(iso));
+}
+
+async function gqlFetch<TData>(query: string, variables?: Record<string, unknown>) {
+  const result = await $fetch<{ data?: TData; errors?: Array<{ message: string }> }>("/api/graphql", {
+    method: "POST",
+    body: { query, variables },
+  });
+
+  if (result.errors?.length) {
+    throw new Error(result.errors[0].message || "GraphQL request failed");
+  }
+
+  if (!result.data) {
+    throw new Error("GraphQL returned empty payload");
+  }
+
+  return result.data;
+}
+
 async function loadPilotMessages() {
-  const res = await $fetch<{ items: PilotMessage[] }>("/api/chat");
-  pilotMessages.value = res.items ?? [];
+  const data = await gqlFetch<{ chatMessages: PilotMessage[] }>(chatMessagesQuery);
+  pilotMessages.value = data.chatMessages ?? [];
+}
+
+async function loadChatConversations() {
+  chatThreadsLoading.value = true;
+  try {
+    const data = await gqlFetch<{ chatConversations: ChatConversation[] }>(chatConversationsQuery);
+    chatConversations.value = data.chatConversations ?? [];
+  } finally {
+    chatThreadsLoading.value = false;
+  }
 }
 
 async function loadMe() {
-  authMe.value = await $fetch("/api/auth/me");
+  const data = await gqlFetch<{
+    me: {
+      user: { id: string; phone: string; name: string };
+      team: { id: string; name: string };
+      conversation: { id: string; title: string };
+    };
+  }>(
+    meQuery,
+  );
+  authMe.value = data.me;
+}
+
+async function createNewChatConversation() {
+  if (chatCreating.value) return;
+  chatCreating.value = true;
+  try {
+    await gqlFetch<{ createChatConversation: ChatConversation }>(createChatConversationMutation);
+    await Promise.all([loadMe(), loadPilotMessages(), loadChatConversations()]);
+  } finally {
+    chatCreating.value = false;
+  }
+}
+
+async function switchChatConversation(id: string) {
+  if (!id || chatSwitching.value || authMe.value?.conversation.id === id) return;
+  chatSwitching.value = true;
+  try {
+    await gqlFetch<{ selectChatConversation: { ok: boolean } }>(selectChatConversationMutation, { id });
+    await Promise.all([loadMe(), loadPilotMessages(), loadChatConversations()]);
+  } finally {
+    chatSwitching.value = false;
+  }
 }
 
 async function login() {
   loginError.value = null;
   loginBusy.value = true;
   try {
-    await $fetch("/api/auth/login", {
-      method: "POST",
-      body: { email: loginEmail.value, name: loginName.value, teamName: loginTeamName.value },
+    await gqlFetch<{ login: { ok: boolean } }>(loginMutation, {
+      phone: loginPhone.value,
+      password: loginPassword.value,
     });
     await loadMe();
-    await Promise.all([loadPilotMessages(), refreshCrmData()]);
+    await Promise.all([loadPilotMessages(), loadChatConversations(), refreshCrmData()]);
   } catch (e: any) {
     loginError.value = e?.data?.message || e?.message || "Login failed";
   } finally {
@@ -210,34 +369,32 @@ async function login() {
 }
 
 async function logout() {
-  await $fetch("/api/auth/logout", { method: "POST" });
+  await gqlFetch<{ logout: { ok: boolean } }>(logoutMutation);
   authMe.value = null;
-}
-
-async function useDemo() {
-  await $fetch("/api/auth/demo", { method: "POST" });
-  await loadMe();
-  await Promise.all([loadPilotMessages(), refreshCrmData()]);
+  pilotMessages.value = [];
+  chatConversations.value = [];
 }
 
 async function refreshCrmData() {
-  const [contactsRes, commRes, calRes, dealsRes, feedRes, pinsRes, docsRes] = await Promise.all([
-    $fetch<{ items: Contact[] }>("/api/contacts"),
-    $fetch<{ items: CommItem[] }>("/api/communications"),
-    $fetch<{ items: CalendarEvent[] }>("/api/calendar"),
-    $fetch<{ items: Deal[] }>("/api/deals"),
-    $fetch<{ items: FeedCard[] }>("/api/feed"),
-    $fetch<{ items: CommPin[] }>("/api/pins"),
-    $fetch<{ items: WorkspaceDocument[] }>("/api/documents"),
-  ]);
+  const data = await gqlFetch<{
+    dashboard: {
+      contacts: Contact[];
+      communications: CommItem[];
+      calendar: CalendarEvent[];
+      deals: Deal[];
+      feed: FeedCard[];
+      pins: CommPin[];
+      documents: WorkspaceDocument[];
+    };
+  }>(dashboardQuery);
 
-  contacts.value = contactsRes.items ?? [];
-  commItems.value = commRes.items ?? [];
-  calendarEvents.value = calRes.items ?? [];
-  deals.value = dealsRes.items ?? [];
-  feedCards.value = feedRes.items ?? [];
-  commPins.value = pinsRes.items ?? [];
-  documents.value = docsRes.items ?? [];
+  contacts.value = data.dashboard.contacts ?? [];
+  commItems.value = data.dashboard.communications ?? [];
+  calendarEvents.value = data.dashboard.calendar ?? [];
+  deals.value = data.dashboard.deals ?? [];
+  feedCards.value = data.dashboard.feed ?? [];
+  commPins.value = data.dashboard.pins ?? [];
+  documents.value = data.dashboard.documents ?? [];
 
   // Derive channels per contact from communication items.
   const byName = new Map<string, Set<string>>();
@@ -256,10 +413,12 @@ async function sendPilotMessage() {
   if (!text || pilotSending.value) return;
 
   pilotSending.value = true;
+  pilotInput.value = "";
   try {
-    await $fetch("/api/chat", { method: "POST", body: { text } });
-    pilotInput.value = "";
-    await loadPilotMessages();
+    await gqlFetch<{ sendPilotMessage: { ok: boolean } }>(sendPilotMessageMutation, { text });
+    await Promise.all([loadPilotMessages(), loadChatConversations()]);
+  } catch {
+    pilotInput.value = text;
   } finally {
     pilotSending.value = false;
   }
@@ -267,7 +426,7 @@ async function sendPilotMessage() {
 
 onMounted(() => {
   loadMe()
-    .then(() => Promise.all([loadPilotMessages(), refreshCrmData()]))
+    .then(() => Promise.all([loadPilotMessages(), loadChatConversations(), refreshCrmData()]))
     .catch(() => {});
 });
 
@@ -592,6 +751,12 @@ const peopleLeftMode = ref<PeopleLeftMode>("contacts");
 const peopleListMode = ref<"contacts" | "deals">("contacts");
 const peopleSearch = ref("");
 const peopleSortMode = ref<PeopleSortMode>("lastContact");
+const peopleSortOptions: Array<{ value: PeopleSortMode; label: string }> = [
+  { value: "lastContact", label: "Last contact" },
+  { value: "name", label: "Name" },
+  { value: "company", label: "Company" },
+  { value: "country", label: "Country" },
+];
 const selectedDealId = ref(deals.value[0]?.id ?? "");
 
 const commThreads = computed(() => {
@@ -674,13 +839,11 @@ const selectedCommThread = computed(() =>
 );
 
 const selectedCommChannel = ref<"All" | CommItem["channel"]>("All");
-const showCommPinsOverlay = ref(false);
-const selectedPinnedIndex = ref(0);
+const rightSidebarMode = ref<"summary" | "pinned">("summary");
 
 watch(selectedCommThreadId, () => {
   selectedCommChannel.value = "All";
-  showCommPinsOverlay.value = false;
-  selectedPinnedIndex.value = 0;
+  rightSidebarMode.value = "summary";
 });
 
 const commChannelTabs = computed(() => {
@@ -797,10 +960,12 @@ const selectedCommPinnedStream = computed(() => {
   return [...pins, ...events];
 });
 
-const currentPinnedItem = computed(() => {
-  if (!selectedCommPinnedStream.value.length) return null;
-  const index = Math.max(0, Math.min(selectedPinnedIndex.value, selectedCommPinnedStream.value.length - 1));
-  return selectedCommPinnedStream.value[index];
+const latestPinnedItem = computed(() => selectedCommPinnedStream.value[0] ?? null);
+
+const latestPinnedLabel = computed(() => {
+  if (!latestPinnedItem.value) return "No pinned items yet";
+  if (latestPinnedItem.value.kind === "pin") return latestPinnedItem.value.text;
+  return `${latestPinnedItem.value.event.title} · ${formatDay(latestPinnedItem.value.event.start)}`;
 });
 
 const selectedWorkspaceContact = computed(() => {
@@ -820,12 +985,6 @@ const selectedWorkspaceDeal = computed(() => {
 
 const openCallTranscripts = ref<Record<string, boolean>>({});
 
-function shiftPinned(direction: -1 | 1) {
-  if (!selectedCommPinnedStream.value.length) return;
-  const total = selectedCommPinnedStream.value.length;
-  selectedPinnedIndex.value = (selectedPinnedIndex.value + direction + total) % total;
-}
-
 function toggleCallTranscript(itemId: string) {
   openCallTranscripts.value[itemId] = !openCallTranscripts.value[itemId];
 }
@@ -855,7 +1014,6 @@ function threadTone(thread: { contact: string; items: CommItem[] }) {
 }
 
 function openEventFromCommunication(event: CalendarEvent) {
-  showCommPinsOverlay.value = false;
   selectedTab.value = "communications";
   peopleLeftMode.value = "calendar";
   pickDate(event.start.slice(0, 10));
@@ -876,8 +1034,8 @@ function makeId(prefix: string) {
 
 function pushPilotNote(text: string) {
   // Fire-and-forget: log assistant note to the same conversation.
-  $fetch("/api/chat/log", { method: "POST", body: { text } })
-    .then(loadPilotMessages)
+  gqlFetch<{ logPilotNote: { ok: boolean } }>(logPilotNoteMutation, { text })
+    .then(() => Promise.all([loadPilotMessages(), loadChatConversations()]))
     .catch(() => {});
 }
 
@@ -929,9 +1087,8 @@ async function executeFeedAction(card: FeedCard) {
     const end = new Date(start);
     end.setMinutes(end.getMinutes() + 30);
 
-    const res = await $fetch<{ item: CalendarEvent }>("/api/calendar", {
-      method: "POST",
-      body: {
+    const res = await gqlFetch<{ createCalendarEvent: CalendarEvent }>(createCalendarEventMutation, {
+      input: {
         title: `Follow-up: ${card.contact.split(" ")[0] ?? "Contact"}`,
         start: start.toISOString(),
         end: end.toISOString(),
@@ -940,7 +1097,7 @@ async function executeFeedAction(card: FeedCard) {
         status: "planned",
       },
     });
-    calendarEvents.value = [res.item, ...calendarEvents.value];
+    calendarEvents.value = [res.createCalendarEvent, ...calendarEvents.value];
 
     selectedDateKey.value = dayKey(start);
     calendarCursor.value = new Date(start.getFullYear(), start.getMonth(), 1);
@@ -955,9 +1112,8 @@ async function executeFeedAction(card: FeedCard) {
   }
 
   if (key === "call") {
-    await $fetch("/api/communications", {
-      method: "POST",
-      body: {
+    await gqlFetch<{ createCommunication: { ok: boolean; id: string } }>(createCommunicationMutation, {
+      input: {
         contact: card.contact,
         channel: "Phone",
         kind: "call",
@@ -972,9 +1128,8 @@ async function executeFeedAction(card: FeedCard) {
   }
 
   if (key === "draft_message") {
-    await $fetch("/api/communications", {
-      method: "POST",
-      body: {
+    await gqlFetch<{ createCommunication: { ok: boolean; id: string } }>(createCommunicationMutation, {
+      input: {
         contact: card.contact,
         channel: "Email",
         kind: "message",
@@ -992,9 +1147,8 @@ async function executeFeedAction(card: FeedCard) {
   }
 
   if (key === "prepare_question") {
-    await $fetch("/api/communications", {
-      method: "POST",
-      body: {
+    await gqlFetch<{ createCommunication: { ok: boolean; id: string } }>(createCommunicationMutation, {
+      input: {
         contact: card.contact,
         channel: "Telegram",
         kind: "message",
@@ -1016,14 +1170,22 @@ async function decideFeedCard(card: FeedCard, decision: "accepted" | "rejected")
   if (decision === "rejected") {
     const note = "Rejected. Nothing created.";
     card.decisionNote = note;
-    await $fetch(`/api/feed/${card.id}`, { method: "PUT", body: { decision: "rejected", decisionNote: note } });
+    await gqlFetch<{ updateFeedDecision: { ok: boolean; id: string } }>(updateFeedDecisionMutation, {
+      id: card.id,
+      decision: "rejected",
+      decisionNote: note,
+    });
     pushPilotNote(`[${card.contact}] recommendation rejected: ${card.proposal.title}`);
     return;
   }
 
   const result = await executeFeedAction(card);
   card.decisionNote = result;
-  await $fetch(`/api/feed/${card.id}`, { method: "PUT", body: { decision: "accepted", decisionNote: result } });
+  await gqlFetch<{ updateFeedDecision: { ok: boolean; id: string } }>(updateFeedDecisionMutation, {
+    id: card.id,
+    decision: "accepted",
+    decisionNote: result,
+  });
   pushPilotNote(`[${card.contact}] ${result}`);
 }
 
@@ -1031,91 +1193,148 @@ async function decideFeedCard(card: FeedCard, decision: "accepted" | "rejected")
 
 <template>
   <div class="min-h-screen p-3 md:p-5">
-    <div class="grid gap-3 lg:grid-cols-12 lg:gap-4">
-      <aside class="card min-h-0 border border-base-300 bg-base-100 shadow-sm lg:col-span-3 lg:sticky lg:top-5 lg:h-[calc(100vh-2.5rem)]">
-        <div class="card-body h-full min-h-0 p-3 md:p-4">
-          <div class="mb-2 flex items-start justify-between gap-2">
-            <div>
-              <h2 class="text-sm font-semibold uppercase tracking-wide text-base-content/70">Pilot</h2>
-              <p v-if="authMe" class="mt-1 text-xs text-base-content/60">
-                {{ authMe.team.name }} · {{ authMe.user.name }}
-              </p>
-            </div>
-            <button v-if="authMe" class="btn btn-ghost btn-xs" @click="logout">Logout</button>
+    <div v-if="!authMe" class="flex min-h-[calc(100vh-2.5rem)] items-center justify-center">
+      <div class="card w-full max-w-sm border border-base-300 bg-base-100 shadow-sm">
+        <div class="card-body p-5">
+          <h1 class="text-lg font-semibold">Login</h1>
+          <p class="mt-1 text-xs text-base-content/65">Sign in with phone and password.</p>
+          <div class="mt-4 space-y-2">
+            <input
+              v-model="loginPhone"
+              type="tel"
+              class="input input-bordered w-full"
+              placeholder="+1 555 000 0001"
+              @keyup.enter="login"
+            >
+            <input
+              v-model="loginPassword"
+              type="password"
+              class="input input-bordered w-full"
+              placeholder="Password"
+              @keyup.enter="login"
+            >
+            <p v-if="loginError" class="text-xs text-error">{{ loginError }}</p>
+            <button class="btn w-full" :disabled="loginBusy" @click="login">
+              {{ loginBusy ? "Logging in..." : "Login" }}
+            </button>
           </div>
+        </div>
+      </div>
+    </div>
 
-          <div v-if="!authMe" class="space-y-3">
-            <div class="rounded-xl border border-base-300 bg-base-100 p-3">
-              <p class="text-sm font-semibold">Login</p>
-              <p class="mt-1 text-xs text-base-content/60">MVP: email + name. Потом подключим нормальную auth.</p>
+    <template v-else>
+      <div class="grid gap-3 lg:grid-cols-12 lg:gap-4">
+        <aside class="pilot-shell card min-h-0 border border-base-300 shadow-sm lg:col-span-3 lg:sticky lg:top-5 lg:h-[calc(100vh-2.5rem)]">
+          <div class="card-body h-full min-h-0 p-0">
+            <div class="pilot-header">
+              <div>
+                <h2 class="text-sm font-semibold uppercase tracking-wide text-white/75">Pilot Chat</h2>
+                <p class="mt-1 text-xs text-white/60">
+                  {{ authMe.team.name }} · {{ authMe.user.name }} · {{ authMe.conversation.title }}
+                </p>
+              </div>
+              <button class="btn btn-ghost btn-xs text-white/80 hover:bg-white/10" @click="logout">Logout</button>
+            </div>
 
-              <div class="mt-3 space-y-2">
-                <input v-model="loginEmail" type="email" class="input input-bordered input-sm w-full" placeholder="Email" />
-                <input v-model="loginName" type="text" class="input input-bordered input-sm w-full" placeholder="Name" />
-                <input v-model="loginTeamName" type="text" class="input input-bordered input-sm w-full" placeholder="Team name" />
-                <p v-if="loginError" class="text-xs text-error">{{ loginError }}</p>
-                <button class="btn btn-sm w-full" :disabled="loginBusy" @click="login">
-                  {{ loginBusy ? "Logging in..." : "Login" }}
-                </button>
-                <button class="btn btn-ghost btn-sm w-full" :disabled="loginBusy" @click="useDemo">
-                  Use demo
+            <div class="pilot-threads">
+              <div class="pilot-threads-head">
+                <span class="text-[11px] uppercase tracking-wide text-white/60">Thread</span>
+                <button class="btn btn-xs border-0 bg-[#5865f2] text-white hover:bg-[#4752c4]" :disabled="chatCreating" @click="createNewChatConversation">
+                  {{ chatCreating ? "..." : "New chat" }}
                 </button>
               </div>
+              <div class="pilot-thread-current">
+                <p class="truncate text-xs font-semibold text-white/90">{{ activeChatConversation?.title || "Current chat" }}</p>
+                <p class="truncate text-[11px] text-white/55">{{ activeChatConversation?.lastMessageText || "No messages yet" }}</p>
+              </div>
+              <div class="mt-2">
+                <select
+                  v-model="selectedChatId"
+                  class="select select-sm w-full border-white/15 bg-[#1e2230] text-white"
+                  :disabled="chatSwitching || chatThreadsLoading || chatConversations.length === 0"
+                  @change="switchChatConversation(selectedChatId)"
+                >
+                  <option v-for="thread in chatConversations" :key="`thread-option-${thread.id}`" :value="thread.id">
+                    {{ thread.title }}
+                  </option>
+                </select>
+                <p v-if="chatThreadsLoading" class="mt-1 text-[11px] text-white/50">Loading threads...</p>
+              </div>
             </div>
-          </div>
 
-          <template v-else>
-            <div class="min-h-0 flex-1 space-y-2 overflow-y-auto rounded-xl border border-base-300 p-2">
+            <div class="pilot-timeline min-h-0 flex-1 overflow-y-auto">
               <div
-                v-for="message in pilotMessages"
+                v-for="message in pilotTimeline"
                 :key="message.id"
-                class="chat"
-                :class="message.role === 'assistant' ? 'chat-start' : 'chat-end'"
+                class="pilot-row"
               >
-                <div class="space-y-2">
-                  <div class="chat-bubble text-sm" :class="message.role === 'assistant' ? 'chat-bubble-neutral' : ''">
+                <div class="pilot-avatar" :class="message.role === 'user' ? 'pilot-avatar-user' : ''">
+                  {{ pilotRoleBadge(message.role) }}
+                </div>
+
+                <div class="pilot-body">
+                  <div class="pilot-meta">
+                    <span class="pilot-author">{{ pilotRoleName(message.role) }}</span>
+                    <span class="pilot-time">{{ formatPilotStamp(message.createdAt) }}</span>
+                    <span v-if="message.pending" class="pilot-live-dot">Live</span>
+                  </div>
+
+                  <div class="pilot-message-text">
                     {{ message.text }}
                   </div>
 
-                  <details
-                    v-if="message.role === 'assistant' && ((message.plan && message.plan.length) || (message.tools && message.tools.length))"
-                    class="rounded-lg border border-base-300 bg-base-100 p-2 text-xs"
+                  <div
+                    v-if="message.role !== 'user' && ((message.thinking && message.thinking.length) || (message.toolRuns && message.toolRuns.length) || (message.tools && message.tools.length))"
+                    class="pilot-debug mt-2"
                   >
-                    <summary class="cursor-pointer select-none font-semibold text-base-content/70">Plan & tools</summary>
-                    <div class="mt-2 space-y-2">
-                      <div v-if="message.plan && message.plan.length">
-                        <div class="font-semibold text-base-content/70">Plan</div>
-                        <ul class="list-disc pl-4">
-                          <li v-for="(step, idx) in message.plan" :key="`plan-${message.id}-${idx}`">{{ step }}</li>
-                        </ul>
-                      </div>
-                      <div v-if="message.tools && message.tools.length">
-                        <div class="font-semibold text-base-content/70">Tools</div>
-                        <ul class="list-disc pl-4">
-                          <li v-for="(tool, idx) in message.tools" :key="`tools-${message.id}-${idx}`">{{ tool }}</li>
-                        </ul>
-                      </div>
+                    <div v-if="message.thinking && message.thinking.length" class="pilot-debug-block">
+                      <p class="pilot-debug-title">Thinking</p>
+                      <ol class="pilot-debug-list">
+                        <li v-for="(step, idx) in message.thinking" :key="`thinking-${message.id}-${idx}`">{{ step }}</li>
+                      </ol>
                     </div>
-                  </details>
+
+                    <div v-if="message.toolRuns && message.toolRuns.length" class="pilot-debug-block">
+                      <p class="pilot-debug-title">Tool Runs</p>
+                      <ul class="pilot-tool-list">
+                        <li v-for="(run, idx) in message.toolRuns" :key="`toolrun-${message.id}-${idx}`" class="pilot-tool-row">
+                          <div class="pilot-tool-head">
+                            <code>{{ run.name }}</code>
+                            <span :class="run.status === 'error' ? 'pilot-tool-status-error' : 'pilot-tool-status-ok'">{{ run.status }}</span>
+                          </div>
+                          <p class="pilot-tool-io"><strong>Input:</strong> {{ run.input }}</p>
+                          <p class="pilot-tool-io"><strong>Output:</strong> {{ run.output }}</p>
+                        </li>
+                      </ul>
+                    </div>
+
+                    <div v-else-if="message.tools && message.tools.length" class="pilot-debug-block">
+                      <p class="pilot-debug-title">Tools</p>
+                      <ul class="pilot-debug-list">
+                        <li v-for="(tool, idx) in message.tools" :key="`tools-${message.id}-${idx}`">{{ tool }}</li>
+                      </ul>
+                    </div>
+                  </div>
                 </div>
               </div>
             </div>
 
-            <div class="mt-2 flex gap-2">
+            <div class="pilot-input-wrap">
               <input
                 v-model="pilotInput"
                 type="text"
-                class="input input-bordered input-sm w-full"
-                placeholder="Write a message..."
+                class="input input-sm w-full border-white/15 bg-[#1e2230] text-white placeholder:text-white/40"
+                placeholder="Type a message for Pilot..."
                 @keyup.enter="sendPilotMessage"
               >
-              <button class="btn btn-sm" :disabled="pilotSending" @click="sendPilotMessage">Send</button>
+              <button class="btn btn-sm border-0 bg-[#5865f2] text-white hover:bg-[#4752c4]" :disabled="pilotSending" @click="sendPilotMessage">
+                {{ pilotSending ? "..." : "Send" }}
+              </button>
             </div>
-          </template>
-        </div>
-      </aside>
+          </div>
+        </aside>
 
-      <main class="card border border-base-300 bg-base-100 shadow-sm lg:col-span-9">
+        <main class="card border border-base-300 bg-base-100 shadow-sm lg:col-span-9">
         <div class="card-body flex flex-col p-3 pb-20 md:p-4 md:pb-24">
           <div class="flex-1">
             <section v-if="selectedTab === 'communications' && peopleLeftMode === 'calendar'" class="space-y-3">
@@ -1437,12 +1656,42 @@ async function decideFeedCard(card: FeedCard, decision: "accepted" | "rejected")
                       Deals
                     </button>
                   </div>
-                  <input
-                    v-model="peopleSearch"
-                    type="text"
-                    class="input input-bordered input-sm w-full"
-                    :placeholder="peopleListMode === 'contacts' ? 'Search contacts' : 'Search deals'"
-                  >
+                  <div class="flex items-center gap-1">
+                    <input
+                      v-model="peopleSearch"
+                      type="text"
+                      class="input input-bordered input-sm w-full"
+                      :placeholder="peopleListMode === 'contacts' ? 'Search contacts' : 'Search deals'"
+                    >
+
+                    <div class="dropdown dropdown-end">
+                      <button
+                        tabindex="0"
+                        class="btn btn-ghost btn-sm btn-square"
+                        :title="peopleListMode === 'contacts' ? 'Sort contacts' : 'Sort deals'"
+                      >
+                        <svg viewBox="0 0 24 24" class="h-4 w-4 fill-current">
+                          <path d="M3 5h18v2H3zm3 6h12v2H6zm4 6h4v2h-4z" />
+                        </svg>
+                      </button>
+
+                      <div tabindex="0" class="dropdown-content z-20 mt-2 w-52 rounded-xl border border-base-300 bg-base-100 p-2 shadow-lg">
+                        <template v-if="peopleListMode === 'contacts'">
+                          <p class="px-2 pb-1 text-[11px] font-semibold uppercase tracking-wide text-base-content/55">Sort contacts</p>
+                          <button
+                            v-for="option in peopleSortOptions"
+                            :key="`people-sort-${option.value}`"
+                            class="btn btn-ghost btn-sm w-full justify-between"
+                            @click="peopleSortMode = option.value"
+                          >
+                            <span>{{ option.label }}</span>
+                            <span v-if="peopleSortMode === option.value">✓</span>
+                          </button>
+                        </template>
+                        <p v-else class="px-2 py-1 text-xs text-base-content/60">Deals are sorted by title.</p>
+                      </div>
+                    </div>
+                  </div>
                 </div>
 
                 <div class="min-h-0 space-y-1.5 overflow-y-auto p-2">
@@ -1682,67 +1931,13 @@ async function decideFeedCard(card: FeedCard, decision: "accepted" | "rejected")
                       </button>
                     </div>
 
-                    <div class="flex min-w-0 items-center gap-1 rounded-lg border border-base-300 bg-base-100 px-1 py-1">
-                      <button class="btn btn-ghost btn-xs btn-square" title="Previous pinned" @click="shiftPinned(-1)">↑</button>
-
-                      <div class="min-w-0 px-1 text-xs">
-                        <p v-if="currentPinnedItem?.kind === 'pin'" class="truncate text-base-content/85">
-                          {{ currentPinnedItem.text }}
-                        </p>
-                        <p v-else-if="currentPinnedItem?.kind === 'event'" class="truncate text-base-content/85">
-                          {{ currentPinnedItem.event.title }}
-                        </p>
-                        <p v-else class="truncate text-base-content/50">No pinned yet</p>
-                      </div>
-
-                      <button class="btn btn-ghost btn-xs btn-square" title="Next pinned" @click="shiftPinned(1)">↓</button>
-                      <button class="btn btn-ghost btn-xs btn-square" title="Pinned and events" @click="showCommPinsOverlay = !showCommPinsOverlay">⋯</button>
-                      <button class="btn btn-ghost btn-xs" @click="showCommPinsOverlay = !showCommPinsOverlay">Expand</button>
-                    </div>
-                  </div>
-
-                  <div
-                    v-if="showCommPinsOverlay"
-                    class="absolute inset-0 z-20 bg-base-100/55 backdrop-blur-[1px]"
-                    @click="showCommPinsOverlay = false"
-                  >
-                    <aside
-                      class="absolute right-3 top-16 w-[340px] rounded-xl border border-base-300 bg-base-100 shadow-xl"
-                      @click.stop
+                    <button
+                      class="btn btn-ghost btn-sm max-w-[320px] justify-start rounded-lg border border-base-300"
+                      @click="rightSidebarMode = 'pinned'"
                     >
-                      <div class="flex items-center justify-between border-b border-base-300 px-3 py-2">
-                        <p class="text-xs font-semibold uppercase tracking-wide text-base-content/60">Pinned</p>
-                        <button class="btn btn-ghost btn-xs btn-square" @click="showCommPinsOverlay = false">×</button>
-                      </div>
-
-                      <div class="max-h-[66vh] space-y-1 overflow-y-auto p-2">
-                        <article
-                          v-for="(item, index) in selectedCommPinnedStream"
-                          :key="item.id"
-                          class="rounded-lg border border-base-300 px-2.5 py-2"
-                          :class="selectedPinnedIndex === index ? 'border-primary bg-primary/5' : ''"
-                          @click="selectedPinnedIndex = index"
-                        >
-                          <template v-if="item.kind === 'pin'">
-                            <p class="text-[11px] uppercase tracking-wide text-base-content/55">Note</p>
-                            <p class="mt-1 text-xs leading-relaxed text-base-content/85">{{ item.text }}</p>
-                          </template>
-                          <template v-else>
-                            <p class="text-[11px] uppercase tracking-wide text-base-content/55">Event</p>
-                            <button class="mt-1 w-full text-left" @click="openEventFromCommunication(item.event)">
-                              <p class="text-sm font-medium">{{ item.event.title }}</p>
-                              <p class="text-xs text-base-content/65">
-                                {{ formatDay(item.event.start) }} · {{ formatTime(item.event.start) }}
-                              </p>
-                            </button>
-                          </template>
-                        </article>
-
-                        <p v-if="selectedCommPinnedStream.length === 0" class="px-1 py-2 text-xs text-base-content/55">
-                          No pinned notes or events.
-                        </p>
-                      </div>
-                    </aside>
+                      <span class="shrink-0 text-xs font-semibold">Pinned {{ selectedCommPinnedStream.length }}</span>
+                      <span class="truncate text-xs text-base-content/70">{{ latestPinnedLabel }}</span>
+                    </button>
                   </div>
 
                   <div class="space-y-2 pr-1">
@@ -1850,32 +2045,74 @@ async function decideFeedCard(card: FeedCard, decision: "accepted" | "rejected")
 
               <aside class="min-h-0 rounded-xl border border-base-300">
                 <div v-if="selectedWorkspaceContact" class="h-full p-3">
-                  <div class="border-b border-base-300 pb-2">
-                    <p class="font-medium">{{ selectedWorkspaceContact.name }}</p>
-                    <p class="text-xs text-base-content/60">
-                      {{ selectedWorkspaceContact.company }} · {{ selectedWorkspaceContact.location }}, {{ selectedWorkspaceContact.country }}
+                  <div class="mb-3 flex items-start justify-between gap-2 border-b border-base-300 pb-2">
+                    <div>
+                      <p class="font-medium">{{ selectedWorkspaceContact.name }}</p>
+                      <p class="text-xs text-base-content/60">
+                        {{ selectedWorkspaceContact.company }} · {{ selectedWorkspaceContact.location }}, {{ selectedWorkspaceContact.country }}
+                      </p>
+                      <p v-if="rightSidebarMode === 'pinned'" class="mt-1 text-xs text-base-content/55">
+                        Pinned {{ selectedCommPinnedStream.length }}
+                      </p>
+                    </div>
+                    <button
+                      v-if="rightSidebarMode === 'pinned'"
+                      class="btn btn-ghost btn-xs btn-square"
+                      title="Close pinned"
+                      @click="rightSidebarMode = 'summary'"
+                    >
+                      ×
+                    </button>
+                  </div>
+
+                  <div v-if="rightSidebarMode === 'pinned'" class="space-y-2">
+                    <article
+                      v-for="item in selectedCommPinnedStream"
+                      :key="item.id"
+                      class="rounded-lg border border-base-300 px-3 py-2"
+                    >
+                      <template v-if="item.kind === 'pin'">
+                        <p class="text-[11px] uppercase tracking-wide text-base-content/55">Note</p>
+                        <p class="mt-1 text-xs leading-relaxed text-base-content/85">{{ item.text }}</p>
+                      </template>
+                      <template v-else>
+                        <p class="text-[11px] uppercase tracking-wide text-base-content/55">Event</p>
+                        <button class="mt-1 w-full text-left" @click="openEventFromCommunication(item.event)">
+                          <p class="text-sm font-medium">{{ item.event.title }}</p>
+                          <p class="text-xs text-base-content/65">
+                            {{ formatDay(item.event.start) }} · {{ formatTime(item.event.start) }}
+                          </p>
+                        </button>
+                      </template>
+                    </article>
+
+                    <p v-if="selectedCommPinnedStream.length === 0" class="text-xs text-base-content/55">
+                      No pinned notes or events.
                     </p>
-                    <p class="mt-1 text-xs text-base-content/55">
+                  </div>
+
+                  <template v-else>
+                    <p class="text-xs text-base-content/55">
                       Last contact · {{ formatStamp(selectedWorkspaceContact.lastContactAt) }}
                     </p>
-                  </div>
 
-                  <div v-if="selectedWorkspaceDeal" class="mt-3 rounded-xl border border-base-300 bg-base-200/30 p-2.5">
-                    <p class="text-[10px] font-semibold uppercase tracking-wide text-base-content/55">Deal</p>
-                    <p class="mt-1 text-sm font-medium">{{ selectedWorkspaceDeal.title }}</p>
-                    <p class="mt-1 text-[11px] text-base-content/65">{{ selectedWorkspaceDeal.company }} · {{ selectedWorkspaceDeal.stage }}</p>
-                    <p class="mt-1 text-[11px] text-base-content/80">{{ selectedWorkspaceDeal.nextStep }}</p>
-                  </div>
+                    <div v-if="selectedWorkspaceDeal" class="mt-3 rounded-xl border border-base-300 bg-base-200/30 p-2.5">
+                      <p class="text-[10px] font-semibold uppercase tracking-wide text-base-content/55">Deal</p>
+                      <p class="mt-1 text-sm font-medium">{{ selectedWorkspaceDeal.title }}</p>
+                      <p class="mt-1 text-[11px] text-base-content/65">{{ selectedWorkspaceDeal.company }} · {{ selectedWorkspaceDeal.stage }}</p>
+                      <p class="mt-1 text-[11px] text-base-content/80">{{ selectedWorkspaceDeal.nextStep }}</p>
+                    </div>
 
-                  <div class="mt-3">
-                    <p class="mb-2 text-xs font-semibold uppercase tracking-wide text-base-content/60">Summary</p>
-                    <ContactCollaborativeEditor
-                      :key="`contact-summary-${selectedWorkspaceContact.id}`"
-                      v-model="selectedWorkspaceContact.description"
-                      :room="`crm-contact-${selectedWorkspaceContact.id}`"
-                      placeholder="Contact summary..."
-                    />
-                  </div>
+                    <div class="mt-3">
+                      <p class="mb-2 text-xs font-semibold uppercase tracking-wide text-base-content/60">Summary</p>
+                      <ContactCollaborativeEditor
+                        :key="`contact-summary-${selectedWorkspaceContact.id}`"
+                        v-model="selectedWorkspaceContact.description"
+                        :room="`crm-contact-${selectedWorkspaceContact.id}`"
+                        placeholder="Contact summary..."
+                      />
+                    </div>
+                  </template>
                 </div>
 
                 <div v-else class="flex h-full items-center justify-center text-sm text-base-content/60">
@@ -1980,10 +2217,207 @@ async function decideFeedCard(card: FeedCard, decision: "accepted" | "rejected")
         </button>
       </div>
     </nav>
+    </template>
   </div>
 </template>
 
 <style scoped>
+.pilot-shell {
+  background:
+    radial-gradient(circle at 10% -10%, rgba(124, 144, 255, 0.25), transparent 40%),
+    radial-gradient(circle at 85% 110%, rgba(88, 101, 242, 0.2), transparent 45%),
+    #151821;
+  color: #f5f7ff;
+}
+
+.pilot-header {
+  display: flex;
+  justify-content: space-between;
+  gap: 12px;
+  padding: 12px;
+  border-bottom: 1px solid rgba(255, 255, 255, 0.08);
+  background: rgba(8, 10, 16, 0.2);
+}
+
+.pilot-threads {
+  padding: 10px 10px 8px;
+  border-bottom: 1px solid rgba(255, 255, 255, 0.08);
+}
+
+.pilot-threads-head {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 8px;
+  margin-bottom: 8px;
+}
+
+.pilot-thread-current {
+  border-radius: 8px;
+  border: 1px solid rgba(255, 255, 255, 0.08);
+  padding: 8px;
+  background: rgba(255, 255, 255, 0.02);
+}
+
+.pilot-timeline {
+  padding: 10px 8px;
+}
+
+.pilot-row {
+  display: flex;
+  align-items: flex-start;
+  gap: 10px;
+  padding: 8px 6px;
+  border-radius: 10px;
+}
+
+.pilot-row:hover {
+  background: rgba(255, 255, 255, 0.04);
+}
+
+.pilot-avatar {
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  min-width: 30px;
+  width: 30px;
+  height: 30px;
+  border-radius: 999px;
+  font-size: 10px;
+  font-weight: 700;
+  letter-spacing: 0.05em;
+  color: #e6ebff;
+  background: linear-gradient(135deg, #5865f2, #7c90ff);
+}
+
+.pilot-avatar-user {
+  background: linear-gradient(135deg, #2a9d8f, #38b2a7);
+}
+
+.pilot-body {
+  min-width: 0;
+  width: 100%;
+}
+
+.pilot-meta {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+}
+
+.pilot-author {
+  font-size: 13px;
+  font-weight: 700;
+  color: #f8f9ff;
+}
+
+.pilot-time {
+  font-size: 11px;
+  color: rgba(255, 255, 255, 0.45);
+}
+
+.pilot-live-dot {
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  font-size: 10px;
+  font-weight: 700;
+  color: #c6ceff;
+  border-radius: 999px;
+  border: 1px solid rgba(124, 144, 255, 0.55);
+  padding: 1px 7px;
+}
+
+.pilot-message-text {
+  margin-top: 2px;
+  font-size: 13px;
+  line-height: 1.5;
+  white-space: pre-wrap;
+  color: rgba(255, 255, 255, 0.92);
+}
+
+.pilot-debug {
+  display: grid;
+  gap: 8px;
+}
+
+.pilot-debug-block {
+  border-radius: 10px;
+  border: 1px solid rgba(255, 255, 255, 0.08);
+  background: rgba(9, 11, 19, 0.52);
+  padding: 8px;
+}
+
+.pilot-debug-title {
+  margin: 0 0 6px;
+  font-size: 11px;
+  text-transform: uppercase;
+  letter-spacing: 0.08em;
+  color: rgba(172, 187, 255, 0.95);
+}
+
+.pilot-debug-list {
+  margin: 0;
+  padding-left: 18px;
+  display: grid;
+  gap: 4px;
+  font-size: 12px;
+  color: rgba(255, 255, 255, 0.82);
+}
+
+.pilot-tool-list {
+  margin: 0;
+  padding: 0;
+  list-style: none;
+  display: grid;
+  gap: 8px;
+}
+
+.pilot-tool-row {
+  border-radius: 8px;
+  background: rgba(255, 255, 255, 0.03);
+  border: 1px solid rgba(255, 255, 255, 0.06);
+  padding: 7px;
+}
+
+.pilot-tool-head {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 10px;
+  margin-bottom: 4px;
+  font-size: 11px;
+}
+
+.pilot-tool-head code {
+  color: #cfd7ff;
+}
+
+.pilot-tool-status-ok {
+  color: #6be2a1;
+  font-weight: 700;
+}
+
+.pilot-tool-status-error {
+  color: #ff8f8f;
+  font-weight: 700;
+}
+
+.pilot-tool-io {
+  margin: 0;
+  font-size: 11px;
+  line-height: 1.35;
+  color: rgba(255, 255, 255, 0.74);
+}
+
+.pilot-input-wrap {
+  display: flex;
+  gap: 8px;
+  padding: 10px;
+  border-top: 1px solid rgba(255, 255, 255, 0.08);
+  background: rgba(11, 13, 21, 0.65);
+}
+
 .feed-chart-wrap {
   display: flex;
   align-items: center;
diff --git a/Frontend/graphql/operations/chat-conversations.graphql b/Frontend/graphql/operations/chat-conversations.graphql
new file mode 100644
index 0000000..bac58c5
--- /dev/null
+++ b/Frontend/graphql/operations/chat-conversations.graphql
@@ -0,0 +1,10 @@
+query ChatConversationsQuery {
+  chatConversations {
+    id
+    title
+    createdAt
+    updatedAt
+    lastMessageAt
+    lastMessageText
+  }
+}
diff --git a/Frontend/graphql/operations/chat-messages.graphql b/Frontend/graphql/operations/chat-messages.graphql
new file mode 100644
index 0000000..1b49e8a
--- /dev/null
+++ b/Frontend/graphql/operations/chat-messages.graphql
@@ -0,0 +1,18 @@
+query ChatMessagesQuery {
+  chatMessages {
+    id
+    role
+    text
+    plan
+    thinking
+    tools
+    toolRuns {
+      name
+      status
+      input
+      output
+      at
+    }
+    createdAt
+  }
+}
diff --git a/Frontend/graphql/operations/create-calendar-event.graphql b/Frontend/graphql/operations/create-calendar-event.graphql
new file mode 100644
index 0000000..3146c8b
--- /dev/null
+++ b/Frontend/graphql/operations/create-calendar-event.graphql
@@ -0,0 +1,10 @@
+mutation CreateCalendarEventMutation($input: CreateCalendarEventInput!) {
+  createCalendarEvent(input: $input) {
+    id
+    title
+    start
+    end
+    contact
+    note
+  }
+}
diff --git a/Frontend/graphql/operations/create-chat-conversation.graphql b/Frontend/graphql/operations/create-chat-conversation.graphql
new file mode 100644
index 0000000..9704aeb
--- /dev/null
+++ b/Frontend/graphql/operations/create-chat-conversation.graphql
@@ -0,0 +1,10 @@
+mutation CreateChatConversationMutation($title: String) {
+  createChatConversation(title: $title) {
+    id
+    title
+    createdAt
+    updatedAt
+    lastMessageAt
+    lastMessageText
+  }
+}
diff --git a/Frontend/graphql/operations/create-communication.graphql b/Frontend/graphql/operations/create-communication.graphql
new file mode 100644
index 0000000..facaea0
--- /dev/null
+++ b/Frontend/graphql/operations/create-communication.graphql
@@ -0,0 +1,6 @@
+mutation CreateCommunicationMutation($input: CreateCommunicationInput!) {
+  createCommunication(input: $input) {
+    ok
+    id
+  }
+}
diff --git a/Frontend/graphql/operations/dashboard.graphql b/Frontend/graphql/operations/dashboard.graphql
new file mode 100644
index 0000000..e67ef1a
--- /dev/null
+++ b/Frontend/graphql/operations/dashboard.graphql
@@ -0,0 +1,73 @@
+query DashboardQuery {
+  dashboard {
+    contacts {
+      id
+      name
+      avatar
+      company
+      country
+      location
+      channels
+      lastContactAt
+      description
+    }
+    communications {
+      id
+      at
+      contactId
+      contact
+      channel
+      kind
+      direction
+      text
+      duration
+      transcript
+    }
+    calendar {
+      id
+      title
+      start
+      end
+      contact
+      note
+    }
+    deals {
+      id
+      contact
+      title
+      company
+      stage
+      amount
+      nextStep
+      summary
+    }
+    feed {
+      id
+      at
+      contact
+      text
+      proposal {
+        title
+        details
+        key
+      }
+      decision
+      decisionNote
+    }
+    pins {
+      id
+      contact
+      text
+    }
+    documents {
+      id
+      title
+      type
+      owner
+      scope
+      updatedAt
+      summary
+      body
+    }
+  }
+}
diff --git a/Frontend/graphql/operations/log-pilot-note.graphql b/Frontend/graphql/operations/log-pilot-note.graphql
new file mode 100644
index 0000000..268f176
--- /dev/null
+++ b/Frontend/graphql/operations/log-pilot-note.graphql
@@ -0,0 +1,5 @@
+mutation LogPilotNoteMutation($text: String!) {
+  logPilotNote(text: $text) {
+    ok
+  }
+}
diff --git a/Frontend/graphql/operations/login.graphql b/Frontend/graphql/operations/login.graphql
new file mode 100644
index 0000000..37e66fe
--- /dev/null
+++ b/Frontend/graphql/operations/login.graphql
@@ -0,0 +1,5 @@
+mutation LoginMutation($phone: String!, $password: String!) {
+  login(phone: $phone, password: $password) {
+    ok
+  }
+}
diff --git a/Frontend/graphql/operations/logout.graphql b/Frontend/graphql/operations/logout.graphql
new file mode 100644
index 0000000..074475d
--- /dev/null
+++ b/Frontend/graphql/operations/logout.graphql
@@ -0,0 +1,5 @@
+mutation LogoutMutation {
+  logout {
+    ok
+  }
+}
diff --git a/Frontend/graphql/operations/me.graphql b/Frontend/graphql/operations/me.graphql
new file mode 100644
index 0000000..fbd9e43
--- /dev/null
+++ b/Frontend/graphql/operations/me.graphql
@@ -0,0 +1,17 @@
+query MeQuery {
+  me {
+    user {
+      id
+      phone
+      name
+    }
+    team {
+      id
+      name
+    }
+    conversation {
+      id
+      title
+    }
+  }
+}
diff --git a/Frontend/graphql/operations/select-chat-conversation.graphql b/Frontend/graphql/operations/select-chat-conversation.graphql
new file mode 100644
index 0000000..feef2f3
--- /dev/null
+++ b/Frontend/graphql/operations/select-chat-conversation.graphql
@@ -0,0 +1,5 @@
+mutation SelectChatConversationMutation($id: ID!) {
+  selectChatConversation(id: $id) {
+    ok
+  }
+}
diff --git a/Frontend/graphql/operations/send-pilot-message.graphql b/Frontend/graphql/operations/send-pilot-message.graphql
new file mode 100644
index 0000000..c5e8403
--- /dev/null
+++ b/Frontend/graphql/operations/send-pilot-message.graphql
@@ -0,0 +1,5 @@
+mutation SendPilotMessageMutation($text: String!) {
+  sendPilotMessage(text: $text) {
+    ok
+  }
+}
diff --git a/Frontend/graphql/operations/update-feed-decision.graphql b/Frontend/graphql/operations/update-feed-decision.graphql
new file mode 100644
index 0000000..874b114
--- /dev/null
+++ b/Frontend/graphql/operations/update-feed-decision.graphql
@@ -0,0 +1,6 @@
+mutation UpdateFeedDecisionMutation($id: ID!, $decision: String!, $decisionNote: String) {
+  updateFeedDecision(id: $id, decision: $decision, decisionNote: $decisionNote) {
+    ok
+    id
+  }
+}
diff --git a/Frontend/server/agent/crmAgent.ts b/Frontend/server/agent/crmAgent.ts
index f576089..38e44a1 100644
--- a/Frontend/server/agent/crmAgent.ts
+++ b/Frontend/server/agent/crmAgent.ts
@@ -19,6 +19,14 @@ export type AgentReply = {
   text: string;
   plan: string[];
   tools: string[];
+  thinking?: string[];
+  toolRuns?: Array<{
+    name: string;
+    status: "ok" | "error";
+    input: string;
+    output: string;
+    at: string;
+  }>;
   dbWrites?: Array<{ kind: string; detail: string }>;
 };
 
@@ -76,7 +84,14 @@ export async function runCrmAgentFor(
   input: { teamId: string; userId: string; userText: string },
 ): Promise<AgentReply> {
   const mode = (process.env.CF_AGENT_MODE ?? "langgraph").toLowerCase();
-  if (mode !== "rule" && process.env.OPENAI_API_KEY) {
+  const llmApiKey =
+    process.env.LLM_API_KEY ||
+    process.env.OPENAI_API_KEY ||
+    process.env.DASHSCOPE_API_KEY ||
+    process.env.QWEN_API_KEY;
+  const hasGigachat = Boolean((process.env.GIGACHAT_AUTH_KEY ?? "").trim() && (process.env.GIGACHAT_SCOPE ?? "").trim());
+
+  if (mode !== "rule" && (llmApiKey || hasGigachat)) {
     return runLangGraphCrmAgentFor(input);
   }
 
@@ -109,6 +124,15 @@ export async function runCrmAgentFor(
         "Отсортировать и показать топ",
       ],
       tools: ["read index/contacts.json", "read messages/{contactId}.jsonl", "read events/{contactId}.jsonl"],
+      toolRuns: [
+        {
+          name: "dataset:index_contacts",
+          status: "ok",
+          input: "index/contacts.json",
+          output: "Loaded contacts index",
+          at: new Date().toISOString(),
+        },
+      ],
       text:
         `Топ-10 по активности (сообщения + события):\n` +
         top.map(formatContactLine).join("\n") +
@@ -163,6 +187,15 @@ export async function runCrmAgentFor(
         "Сформировать короткий список действий",
       ],
       tools: ["read index/contacts.json", "read events/{contactId}.jsonl"],
+      toolRuns: [
+        {
+          name: "dataset:query_events",
+          status: "ok",
+          input: "events/*.jsonl (today)",
+          output: `Found ${todayEvents.length} events`,
+          at: new Date().toISOString(),
+        },
+      ],
       text: lines.join("\n"),
     };
   }
@@ -171,6 +204,7 @@ export async function runCrmAgentFor(
   return {
     plan: ["Уточнить цель", "Выбрать данные для анализа", "Предложить план действий и, если нужно, изменения в CRM"],
     tools: ["read index/contacts.json (по необходимости)", "search messages/events (по необходимости)"],
+    toolRuns: [],
     text:
       "Ок. Скажи, что нужно сделать.\n" +
       "Примеры:\n" +
@@ -185,17 +219,38 @@ export async function persistChatMessage(input: {
   text: string;
   plan?: string[];
   tools?: string[];
+  thinking?: string[];
+  toolRuns?: Array<{
+    name: string;
+    status: "ok" | "error";
+    input: string;
+    output: string;
+    at: string;
+  }>;
   teamId: string;
   conversationId: string;
   authorUserId?: string | null;
 }) {
+  const hasDebugPayload = Boolean(
+    (input.plan && input.plan.length) ||
+      (input.tools && input.tools.length) ||
+      (input.thinking && input.thinking.length) ||
+      (input.toolRuns && input.toolRuns.length),
+  );
   const data: Prisma.ChatMessageCreateInput = {
     team: { connect: { id: input.teamId } },
     conversation: { connect: { id: input.conversationId } },
     authorUser: input.authorUserId ? { connect: { id: input.authorUserId } } : undefined,
     role: input.role,
     text: input.text,
-    planJson: input.plan || input.tools ? ({ steps: input.plan ?? [], tools: input.tools ?? [] } as any) : undefined,
+    planJson: hasDebugPayload
+      ? ({
+          steps: input.plan ?? [],
+          tools: input.tools ?? [],
+          thinking: input.thinking ?? input.plan ?? [],
+          toolRuns: input.toolRuns ?? [],
+        } as any)
+      : undefined,
   };
   return prisma.chatMessage.create({ data });
 }
diff --git a/Frontend/server/agent/langgraphCrmAgent.ts b/Frontend/server/agent/langgraphCrmAgent.ts
index 83d6cb0..3cca67b 100644
--- a/Frontend/server/agent/langgraphCrmAgent.ts
+++ b/Frontend/server/agent/langgraphCrmAgent.ts
@@ -1,3 +1,4 @@
+import { randomUUID } from "node:crypto";
 import type { AgentReply } from "./crmAgent";
 import { prisma } from "../utils/prisma";
 import { ensureDataset } from "../dataset/exporter";
@@ -10,18 +11,192 @@ function iso(d: Date) {
   return d.toISOString();
 }
 
-async function buildCrmSnapshot(input: { teamId: string }) {
+type GigachatTokenCache = {
+  token: string;
+  expiresAtSec: number;
+};
+
+let gigachatTokenCache: GigachatTokenCache | null = null;
+
+function normalizeAuthHeader(authKey: string, scheme: "Basic" | "Bearer") {
+  const key = authKey.trim();
+  if (!key) return "";
+  if (key.startsWith("Basic ") || key.startsWith("Bearer ")) return key;
+  return `${scheme} ${key}`;
+}
+
+async function requestGigachatToken(input: {
+  authKey: string;
+  scope: string;
+  oauthUrl: string;
+  authScheme: "Basic" | "Bearer";
+}) {
+  const body = new URLSearchParams();
+  body.set("scope", input.scope);
+
+  const res = await fetch(input.oauthUrl, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/x-www-form-urlencoded",
+      Accept: "application/json",
+      RqUID: randomUUID(),
+      Authorization: normalizeAuthHeader(input.authKey, input.authScheme),
+    },
+    body: body.toString(),
+  });
+
+  if (!res.ok) {
+    const text = await res.text().catch(() => "");
+    throw new Error(`GigaChat oauth failed: ${res.status} ${text.slice(0, 240)}`);
+  }
+
+  const payload = (await res.json()) as { access_token?: string; expires_at?: number };
+  if (!payload?.access_token) {
+    throw new Error("GigaChat oauth failed: access_token is missing");
+  }
+
+  return {
+    token: payload.access_token,
+    expiresAtSec: typeof payload.expires_at === "number" ? payload.expires_at : Math.floor(Date.now() / 1000) + 25 * 60,
+  };
+}
+
+async function getGigachatAccessToken(input: {
+  authKey: string;
+  scope: string;
+  oauthUrl: string;
+}) {
+  const nowSec = Math.floor(Date.now() / 1000);
+  if (gigachatTokenCache && gigachatTokenCache.expiresAtSec - nowSec > 60) {
+    return gigachatTokenCache.token;
+  }
+
+  try {
+    const token = await requestGigachatToken({ ...input, authScheme: "Basic" });
+    gigachatTokenCache = token;
+    return token.token;
+  } catch {
+    const token = await requestGigachatToken({ ...input, authScheme: "Bearer" });
+    gigachatTokenCache = token;
+    return token.token;
+  }
+}
+
+type SnapshotOptions = {
+  teamId: string;
+  contact?: string;
+  contactsLimit?: number;
+};
+
+type PendingChange =
+  | {
+      id: string;
+      type: "update_contact_note";
+      createdAt: string;
+      contactId: string;
+      contactName: string;
+      content: string;
+    }
+  | {
+      id: string;
+      type: "create_event";
+      createdAt: string;
+      contactId: string | null;
+      contactName: string | null;
+      title: string;
+      start: string;
+      end: string | null;
+      note: string | null;
+      status: string | null;
+    }
+  | {
+      id: string;
+      type: "create_message";
+      createdAt: string;
+      contactId: string;
+      contactName: string;
+      text: string;
+      kind: "message" | "call";
+      direction: "in" | "out";
+      channel: "Telegram" | "WhatsApp" | "Instagram" | "Phone" | "Email";
+      at: string;
+      durationSec: number | null;
+      transcript: string[] | null;
+    }
+  | {
+      id: string;
+      type: "update_deal_stage";
+      createdAt: string;
+      dealId: string;
+      stage: string;
+      dealTitle: string;
+    };
+
+function makeId(prefix: string) {
+  return `${prefix}_${Date.now()}_${Math.random().toString(16).slice(2, 10)}`;
+}
+
+function toChannel(channel: "Telegram" | "WhatsApp" | "Instagram" | "Phone" | "Email") {
+  if (channel === "Telegram") return "TELEGRAM" as const;
+  if (channel === "WhatsApp") return "WHATSAPP" as const;
+  if (channel === "Instagram") return "INSTAGRAM" as const;
+  if (channel === "Email") return "EMAIL" as const;
+  return "PHONE" as const;
+}
+
+async function resolveContact(teamId: string, contactRef: string) {
+  const contact = contactRef.trim();
+  if (!contact) return null;
+
+  const exact = await prisma.contact.findFirst({
+    where: { teamId, OR: [{ id: contact }, { name: contact }] },
+    select: { id: true, name: true },
+  });
+  if (exact) return exact;
+
+  return prisma.contact.findFirst({
+    where: { teamId, name: { contains: contact } },
+    orderBy: { updatedAt: "desc" },
+    select: { id: true, name: true },
+  });
+}
+
+async function buildCrmSnapshot(input: SnapshotOptions) {
   const now = new Date();
   const in7 = new Date(now.getTime() + 7 * 24 * 60 * 60 * 1000);
+  const contactLimit = Math.max(1, Math.min(input.contactsLimit ?? 25, 80));
 
-  const [contacts, upcoming, deals] = await Promise.all([
+  const selectedContact = input.contact ? await resolveContact(input.teamId, input.contact) : null;
+  const contactWhere = selectedContact ? { teamId: input.teamId, id: selectedContact.id } : { teamId: input.teamId };
+
+  const [contacts, upcoming, deals, docs, totalContacts, totalDeals, totalEvents] = await Promise.all([
     prisma.contact.findMany({
-      where: { teamId: input.teamId },
+      where: contactWhere,
       orderBy: { updatedAt: "desc" },
-      take: 25,
+      take: selectedContact ? 1 : contactLimit,
       include: {
-        messages: { select: { occurredAt: true, channel: true, direction: true }, orderBy: { occurredAt: "desc" }, take: 1 },
-        deals: { select: { stage: true, amount: true, updatedAt: true }, orderBy: { updatedAt: "desc" }, take: 1 },
+        note: { select: { content: true, updatedAt: true } },
+        messages: {
+          select: { id: true, occurredAt: true, channel: true, direction: true, kind: true, content: true },
+          orderBy: { occurredAt: "desc" },
+          take: 4,
+        },
+        events: {
+          select: { id: true, title: true, startsAt: true, endsAt: true, status: true },
+          orderBy: { startsAt: "asc" },
+          where: { startsAt: { gte: new Date(now.getTime() - 30 * 24 * 60 * 60 * 1000) } },
+          take: 4,
+        },
+        deals: {
+          select: { id: true, title: true, stage: true, amount: true, updatedAt: true, nextStep: true, summary: true },
+          orderBy: { updatedAt: "desc" },
+          take: 3,
+        },
+        pins: {
+          select: { id: true, text: true, updatedAt: true },
+          orderBy: { updatedAt: "desc" },
+          take: 3,
+        },
       },
     }),
     prisma.calendarEvent.findMany({
@@ -36,44 +211,111 @@ async function buildCrmSnapshot(input: { teamId: string }) {
       take: 20,
       include: { contact: { select: { name: true, company: true } } },
     }),
+    prisma.workspaceDocument.findMany({
+      where: { teamId: input.teamId },
+      orderBy: { updatedAt: "desc" },
+      take: 12,
+      select: { id: true, type: true, title: true, summary: true, updatedAt: true, owner: true, scope: true },
+    }),
+    prisma.contact.count({ where: { teamId: input.teamId } }),
+    prisma.deal.count({ where: { teamId: input.teamId } }),
+    prisma.calendarEvent.count({ where: { teamId: input.teamId, startsAt: { gte: now } } }),
   ]);
 
   const byStage = new Map<string, number>();
   for (const d of deals) byStage.set(d.stage, (byStage.get(d.stage) ?? 0) + 1);
 
-  const lines: string[] = [];
-  lines.push(`Snapshot time: ${iso(now)}`);
-  lines.push(`Contacts: ${await prisma.contact.count({ where: { teamId: input.teamId } })}`);
-  lines.push(`Deals: ${await prisma.deal.count({ where: { teamId: input.teamId } })}`);
-  lines.push(`Upcoming events (7d): ${upcoming.length}`);
-  lines.push("");
-
-  if (upcoming.length) {
-    lines.push("Upcoming events:");
-    for (const e of upcoming) {
-      lines.push(`- ${e.startsAt.toISOString()} · ${e.title} · ${e.contact?.name ?? "No contact"}`);
-    }
-    lines.push("");
-  }
-
-  if (byStage.size) {
-    lines.push("Deals by stage:");
-    for (const [stage, n] of [...byStage.entries()].sort((a, b) => b[1] - a[1])) {
-      lines.push(`- ${stage}: ${n}`);
-    }
-    lines.push("");
-  }
-
-  if (contacts.length) {
-    lines.push("Recently updated contacts:");
-    for (const c of contacts.slice(0, 12)) {
-      const last = c.messages[0]?.occurredAt ? c.messages[0].occurredAt.toISOString() : c.updatedAt.toISOString();
-      const deal = c.deals[0] ? `${c.deals[0].stage}${c.deals[0].amount ? ` $${c.deals[0].amount}` : ""}` : "no deal";
-      lines.push(`- ${c.name}${c.company ? ` (${c.company})` : ""} · last touch ${last} · ${deal}`);
-    }
-  }
-
-  return lines.join("\n");
+  return {
+    meta: {
+      generatedAt: iso(now),
+      focusContactId: selectedContact?.id ?? null,
+      contactsIncluded: contacts.length,
+      mode: selectedContact ? "focused" : "team",
+    },
+    totals: {
+      contacts: totalContacts,
+      deals: totalDeals,
+      upcomingEvents: totalEvents,
+    },
+    stats: {
+      dealsByStage: [...byStage.entries()]
+        .sort((a, b) => b[1] - a[1])
+        .map(([stage, count]) => ({ stage, count })),
+    },
+    upcomingEvents: upcoming.map((e) => ({
+      id: e.id,
+      title: e.title,
+      startsAt: iso(e.startsAt),
+      endsAt: iso(e.endsAt ?? e.startsAt),
+      status: e.status,
+      note: e.note,
+      contact: e.contact?.name ?? null,
+    })),
+    deals: deals.map((d) => ({
+      id: d.id,
+      title: d.title,
+      stage: d.stage,
+      amount: d.amount,
+      nextStep: d.nextStep,
+      summary: d.summary,
+      updatedAt: iso(d.updatedAt),
+      contact: {
+        name: d.contact.name,
+        company: d.contact.company,
+      },
+    })),
+    contacts: contacts.map((c) => ({
+      id: c.id,
+      name: c.name,
+      company: c.company,
+      country: c.country,
+      location: c.location,
+      email: c.email,
+      phone: c.phone,
+      avatarUrl: c.avatarUrl,
+      updatedAt: iso(c.updatedAt),
+      summary: c.note?.content ?? null,
+      summaryUpdatedAt: c.note?.updatedAt ? iso(c.note.updatedAt) : null,
+      latestMessages: c.messages.map((m) => ({
+        id: m.id,
+        occurredAt: iso(m.occurredAt),
+        channel: m.channel,
+        direction: m.direction,
+        kind: m.kind,
+        content: m.content,
+      })),
+      latestEvents: c.events.map((e) => ({
+        id: e.id,
+        title: e.title,
+        startsAt: iso(e.startsAt),
+        endsAt: iso(e.endsAt ?? e.startsAt),
+        status: e.status,
+      })),
+      deals: c.deals.map((d) => ({
+        id: d.id,
+        title: d.title,
+        stage: d.stage,
+        amount: d.amount,
+        nextStep: d.nextStep,
+        summary: d.summary,
+        updatedAt: iso(d.updatedAt),
+      })),
+      pins: c.pins.map((p) => ({
+        id: p.id,
+        text: p.text,
+        updatedAt: iso(p.updatedAt),
+      })),
+    })),
+    documents: docs.map((d) => ({
+      id: d.id,
+      type: d.type,
+      title: d.title,
+      summary: d.summary,
+      owner: d.owner,
+      scope: d.scope,
+      updatedAt: iso(d.updatedAt),
+    })),
+  };
 }
 
 export async function runLangGraphCrmAgentFor(input: {
@@ -81,11 +323,60 @@ export async function runLangGraphCrmAgentFor(input: {
   userId: string;
   userText: string;
 }): Promise<AgentReply> {
-  if (!process.env.OPENAI_API_KEY) {
+  const genericApiKey =
+    process.env.LLM_API_KEY ||
+    process.env.OPENAI_API_KEY ||
+    process.env.DASHSCOPE_API_KEY ||
+    process.env.QWEN_API_KEY;
+  const genericBaseURL =
+    process.env.LLM_BASE_URL ||
+    process.env.OPENAI_BASE_URL ||
+    process.env.DASHSCOPE_BASE_URL ||
+    process.env.QWEN_BASE_URL;
+  const genericModel =
+    process.env.LLM_MODEL ||
+    process.env.OPENAI_MODEL ||
+    process.env.DASHSCOPE_MODEL ||
+    process.env.QWEN_MODEL ||
+    "gpt-4o-mini";
+  const gigachatAuthKey = (process.env.GIGACHAT_AUTH_KEY ?? "").trim();
+  const gigachatModel = (process.env.GIGACHAT_MODEL ?? "").trim();
+  const gigachatScope = (process.env.GIGACHAT_SCOPE ?? "").trim();
+  const gigachatOauthUrl = (process.env.GIGACHAT_OAUTH_URL ?? "https://ngw.devices.sberbank.ru:9443/api/v2/oauth").trim();
+  const gigachatBaseUrl = (process.env.GIGACHAT_BASE_URL ?? "https://gigachat.devices.sberbank.ru/api/v1").trim();
+  const useGigachat = Boolean(gigachatAuthKey && gigachatScope);
+
+  let llmApiKey = genericApiKey;
+  let llmBaseURL = genericBaseURL;
+  let llmModel = genericModel;
+
+  if (useGigachat) {
+    try {
+      llmApiKey = await getGigachatAccessToken({
+        authKey: gigachatAuthKey,
+        scope: gigachatScope,
+        oauthUrl: gigachatOauthUrl,
+      });
+      llmBaseURL = gigachatBaseUrl;
+      llmModel = gigachatModel || "GigaChat-2-Max";
+    } catch (e: any) {
+      return {
+        text: `Не удалось получить токен GigaChat: ${String(e?.message || e)}`,
+        plan: ["Проверить GIGACHAT_AUTH_KEY", "Проверить GIGACHAT_SCOPE", "Проверить сетевой доступ до OAuth endpoint и перезапустить dev-сервер"],
+        tools: [],
+        thinking: ["Провайдер GigaChat настроен, но OAuth не прошел."],
+        toolRuns: [],
+      };
+    }
+  }
+
+  if (!llmApiKey) {
     return {
-      text: "OPENAI_API_KEY не задан. Сейчас включен fallback-агент без LLM.",
-      plan: ["Проверить .env", "Добавить OPENAI_API_KEY", "Перезапустить dev-сервер"],
+      text: "LLM API key не задан. Сейчас включен fallback-агент без LLM.",
+      plan: ["Проверить .env", "Добавить LLM_API_KEY (или OPENAI_API_KEY / DASHSCOPE_API_KEY / QWEN_API_KEY / GIGACHAT_AUTH_KEY+GIGACHAT_SCOPE)", "Перезапустить dev-сервер"],
       tools: [],
+      thinking: ["LLM недоступна, возвращен fallback-ответ."],
+      toolRuns: [],
     };
   }
 
@@ -94,12 +385,24 @@ export async function runLangGraphCrmAgentFor(input: {
 
   const toolsUsed: string[] = [];
   const dbWrites: Array<{ kind: string; detail: string }> = [];
+  const toolRuns: NonNullable<AgentReply["toolRuns"]> = [];
+  const pendingChanges: PendingChange[] = [];
+
+  function compact(value: unknown, max = 240) {
+    const text = typeof value === "string" ? value : JSON.stringify(value);
+    if (!text) return "";
+    return text.length > max ? `${text.slice(0, max)}...` : text;
+  }
 
   const CrmToolSchema = z.object({
     action: z.enum([
+      "get_snapshot",
       "query_contacts",
       "query_deals",
       "query_events",
+      "pending_changes",
+      "discard_changes",
+      "commit_changes",
       "update_contact_note",
       "create_event",
       "create_message",
@@ -111,6 +414,7 @@ export async function runLangGraphCrmAgentFor(input: {
     from: z.string().optional(),
     to: z.string().optional(),
     limit: z.number().int().optional(),
+    mode: z.enum(["stage", "apply"]).optional(),
     // writes
     contact: z.string().optional(),
     content: z.string().optional(),
@@ -129,196 +433,344 @@ export async function runLangGraphCrmAgentFor(input: {
     dealId: z.string().optional(),
   });
 
+  const applyPendingChanges = async () => {
+    const queue = pendingChanges.splice(0, pendingChanges.length);
+    if (!queue.length) {
+      return { ok: true, applied: 0, changes: [] as Array<{ id: string; type: string; detail: string }> };
+    }
+
+    const applied: Array<{ id: string; type: string; detail: string }> = [];
+
+    await prisma.$transaction(async (tx) => {
+      for (const change of queue) {
+        if (change.type === "update_contact_note") {
+          await tx.contactNote.upsert({
+            where: { contactId: change.contactId },
+            update: { content: change.content },
+            create: { contactId: change.contactId, content: change.content },
+          });
+          applied.push({ id: change.id, type: change.type, detail: `${change.contactName}: summary updated` });
+          continue;
+        }
+
+        if (change.type === "create_event") {
+          const created = await tx.calendarEvent.create({
+            data: {
+              teamId: input.teamId,
+              contactId: change.contactId,
+              title: change.title,
+              startsAt: new Date(change.start),
+              endsAt: change.end ? new Date(change.end) : null,
+              note: change.note,
+              status: change.status,
+            },
+          });
+          applied.push({ id: change.id, type: change.type, detail: `created event ${created.id}` });
+          continue;
+        }
+
+        if (change.type === "create_message") {
+          const created = await tx.contactMessage.create({
+            data: {
+              contactId: change.contactId,
+              kind: change.kind === "call" ? "CALL" : "MESSAGE",
+              direction: change.direction === "in" ? "IN" : "OUT",
+              channel: toChannel(change.channel),
+              content: change.text,
+              durationSec: change.durationSec,
+              transcriptJson: Array.isArray(change.transcript) ? change.transcript : null,
+              occurredAt: new Date(change.at),
+            },
+          });
+          applied.push({ id: change.id, type: change.type, detail: `created message ${created.id}` });
+          continue;
+        }
+
+        if (change.type === "update_deal_stage") {
+          const updated = await tx.deal.updateMany({
+            where: { id: change.dealId, teamId: input.teamId },
+            data: { stage: change.stage },
+          });
+          if (updated.count === 0) throw new Error(`deal not found: ${change.dealId}`);
+          applied.push({ id: change.id, type: change.type, detail: `${change.dealTitle}: stage -> ${change.stage}` });
+          continue;
+        }
+      }
+    });
+
+    for (const item of applied) {
+      dbWrites.push({ kind: item.type, detail: item.detail });
+    }
+
+    return { ok: true, applied: applied.length, changes: applied };
+  };
+
   const crmTool = tool(
     async (raw: z.infer<typeof CrmToolSchema>) => {
-      toolsUsed.push(`crm:${raw.action}`);
+      const toolName = `crm:${raw.action}`;
+      const startedAt = new Date().toISOString();
+      toolsUsed.push(toolName);
 
-      if (raw.action === "query_contacts") {
-        const q = (raw.query ?? "").trim();
-        const items = await prisma.contact.findMany({
-          where: {
+      const executeAction = async () => {
+        if (raw.action === "get_snapshot") {
+          const snapshot = await buildCrmSnapshot({
             teamId: input.teamId,
-            ...(q
-              ? {
-                  OR: [
-                    { name: { contains: q } },
-                    { company: { contains: q } },
-                    { email: { contains: q } },
-                    { phone: { contains: q } },
-                  ],
-                }
-              : {}),
-          },
-          orderBy: { updatedAt: "desc" },
-          take: Math.max(1, Math.min(raw.limit ?? 20, 100)),
-          include: { note: { select: { content: true, updatedAt: true } } },
-        });
-        return JSON.stringify(
-          items.map((c) => ({
-            id: c.id,
-            name: c.name,
-            company: c.company,
-            country: c.country,
-            location: c.location,
-            email: c.email,
-            phone: c.phone,
-            note: c.note?.content ?? null,
-          })),
-          null,
-          2,
-        );
-      }
+            contact: raw.contact,
+            contactsLimit: raw.limit,
+          });
+          return JSON.stringify(snapshot, null, 2);
+        }
 
-      if (raw.action === "query_deals") {
-        const items = await prisma.deal.findMany({
-          where: { teamId: input.teamId, ...(raw.stage ? { stage: raw.stage } : {}) },
-          orderBy: { updatedAt: "desc" },
-          take: Math.max(1, Math.min(raw.limit ?? 20, 100)),
-          include: { contact: { select: { name: true, company: true } } },
-        });
-        return JSON.stringify(
-          items.map((d) => ({
-            id: d.id,
-            title: d.title,
-            stage: d.stage,
-            amount: d.amount,
-            nextStep: d.nextStep,
-            summary: d.summary,
-            contact: d.contact.name,
-            company: d.contact.company,
-          })),
-          null,
-          2,
-        );
-      }
+        if (raw.action === "query_contacts") {
+          const q = (raw.query ?? "").trim();
+          const items = await prisma.contact.findMany({
+            where: {
+              teamId: input.teamId,
+              ...(q
+                ? {
+                    OR: [
+                      { name: { contains: q } },
+                      { company: { contains: q } },
+                      { email: { contains: q } },
+                      { phone: { contains: q } },
+                    ],
+                  }
+                : {}),
+            },
+            orderBy: { updatedAt: "desc" },
+            take: Math.max(1, Math.min(raw.limit ?? 20, 100)),
+            include: { note: { select: { content: true, updatedAt: true } } },
+          });
+          return JSON.stringify(
+            items.map((c) => ({
+              id: c.id,
+              name: c.name,
+              company: c.company,
+              country: c.country,
+              location: c.location,
+              email: c.email,
+              phone: c.phone,
+              note: c.note?.content ?? null,
+            })),
+            null,
+            2,
+          );
+        }
 
-      if (raw.action === "query_events") {
-        const from = raw.from ? new Date(raw.from) : new Date(Date.now() - 30 * 24 * 60 * 60 * 1000);
-        const to = raw.to ? new Date(raw.to) : new Date(Date.now() + 60 * 24 * 60 * 60 * 1000);
-        const items = await prisma.calendarEvent.findMany({
-          where: { teamId: input.teamId, startsAt: { gte: from, lte: to } },
-          orderBy: { startsAt: "asc" },
-          take: Math.max(1, Math.min(raw.limit ?? 100, 500)),
-          include: { contact: { select: { name: true } } },
-        });
-        return JSON.stringify(
-          items.map((e) => ({
-            id: e.id,
-            title: e.title,
-            startsAt: e.startsAt.toISOString(),
-            endsAt: (e.endsAt ?? e.startsAt).toISOString(),
-            note: e.note,
-            contact: e.contact?.name ?? null,
-          })),
-          null,
-          2,
-        );
-      }
+        if (raw.action === "query_deals") {
+          const items = await prisma.deal.findMany({
+            where: { teamId: input.teamId, ...(raw.stage ? { stage: raw.stage } : {}) },
+            orderBy: { updatedAt: "desc" },
+            take: Math.max(1, Math.min(raw.limit ?? 20, 100)),
+            include: { contact: { select: { name: true, company: true } } },
+          });
+          return JSON.stringify(
+            items.map((d) => ({
+              id: d.id,
+              title: d.title,
+              stage: d.stage,
+              amount: d.amount,
+              nextStep: d.nextStep,
+              summary: d.summary,
+              contact: d.contact.name,
+              company: d.contact.company,
+            })),
+            null,
+            2,
+          );
+        }
 
-      if (raw.action === "update_contact_note") {
-        const contactName = (raw.contact ?? "").trim();
-        const content = (raw.content ?? "").trim();
-        if (!contactName) throw new Error("contact is required");
-        if (!content) throw new Error("content is required");
+        if (raw.action === "query_events") {
+          const from = raw.from ? new Date(raw.from) : new Date(Date.now() - 30 * 24 * 60 * 60 * 1000);
+          const to = raw.to ? new Date(raw.to) : new Date(Date.now() + 60 * 24 * 60 * 60 * 1000);
+          const items = await prisma.calendarEvent.findMany({
+            where: { teamId: input.teamId, startsAt: { gte: from, lte: to } },
+            orderBy: { startsAt: "asc" },
+            take: Math.max(1, Math.min(raw.limit ?? 100, 500)),
+            include: { contact: { select: { name: true } } },
+          });
+          return JSON.stringify(
+            items.map((e) => ({
+              id: e.id,
+              title: e.title,
+              startsAt: e.startsAt.toISOString(),
+              endsAt: (e.endsAt ?? e.startsAt).toISOString(),
+              note: e.note,
+              contact: e.contact?.name ?? null,
+            })),
+            null,
+            2,
+          );
+        }
 
-        const contact = await prisma.contact.findFirst({
-          where: { teamId: input.teamId, name: contactName },
-          select: { id: true },
-        });
-        if (!contact) throw new Error("contact not found");
+        if (raw.action === "pending_changes") {
+          return JSON.stringify(
+            {
+              count: pendingChanges.length,
+              items: pendingChanges.map((item) => ({
+                id: item.id,
+                type: item.type,
+                createdAt: item.createdAt,
+              })),
+            },
+            null,
+            2,
+          );
+        }
 
-        await prisma.contactNote.upsert({
-          where: { contactId: contact.id },
-          update: { content },
-          create: { contactId: contact.id, content },
-        });
-        dbWrites.push({ kind: "contact_note", detail: `${contactName}: updated` });
-        return JSON.stringify({ ok: true });
-      }
+        if (raw.action === "discard_changes") {
+          const discarded = pendingChanges.length;
+          pendingChanges.splice(0, pendingChanges.length);
+          return JSON.stringify({ ok: true, discarded }, null, 2);
+        }
 
-      if (raw.action === "create_event") {
-        const title = (raw.title ?? "").trim();
-        const start = raw.start ? new Date(raw.start) : null;
-        if (!title) throw new Error("title is required");
-        if (!start || Number.isNaN(start.getTime())) throw new Error("start is invalid");
+        if (raw.action === "commit_changes") {
+          const committed = await applyPendingChanges();
+          return JSON.stringify(committed, null, 2);
+        }
 
-        const end = raw.end ? new Date(raw.end) : null;
-        const contactName = (raw.contact ?? "").trim();
-        const contact = contactName
-          ? await prisma.contact.findFirst({ where: { teamId: input.teamId, name: contactName }, select: { id: true } })
-          : null;
+        if (raw.action === "update_contact_note") {
+          const contactName = (raw.contact ?? "").trim();
+          const content = (raw.content ?? "").trim();
+          if (!contactName) throw new Error("contact is required");
+          if (!content) throw new Error("content is required");
 
-        const created = await prisma.calendarEvent.create({
-          data: {
-            teamId: input.teamId,
+          const contact = await resolveContact(input.teamId, contactName);
+          if (!contact) throw new Error("contact not found");
+
+          pendingChanges.push({
+            id: makeId("chg"),
+            type: "update_contact_note",
+            createdAt: iso(new Date()),
+            contactId: contact.id,
+            contactName: contact.name,
+            content,
+          });
+
+          if (raw.mode === "apply") {
+            const committed = await applyPendingChanges();
+            return JSON.stringify(committed, null, 2);
+          }
+          return JSON.stringify({ ok: true, staged: true, pending: pendingChanges.length }, null, 2);
+        }
+
+        if (raw.action === "create_event") {
+          const title = (raw.title ?? "").trim();
+          const start = raw.start ? new Date(raw.start) : null;
+          if (!title) throw new Error("title is required");
+          if (!start || Number.isNaN(start.getTime())) throw new Error("start is invalid");
+
+          const end = raw.end ? new Date(raw.end) : null;
+          const contactName = (raw.contact ?? "").trim();
+          const contact = contactName
+            ? await resolveContact(input.teamId, contactName)
+            : null;
+
+          pendingChanges.push({
+            id: makeId("chg"),
+            type: "create_event",
+            createdAt: iso(new Date()),
             contactId: contact?.id ?? null,
+            contactName: contact?.name ?? null,
             title,
-            startsAt: start,
-            endsAt: end && !Number.isNaN(end.getTime()) ? end : null,
+            start: iso(start),
+            end: end && !Number.isNaN(end.getTime()) ? iso(end) : null,
             note: (raw.note ?? "").trim() || null,
             status: (raw.status ?? "").trim() || null,
-          },
-        });
-        dbWrites.push({ kind: "calendar_event", detail: `created ${created.id}` });
-        return JSON.stringify({ ok: true, id: created.id });
-      }
+          });
 
-      if (raw.action === "create_message") {
-        const contactName = (raw.contact ?? "").trim();
-        const text = (raw.text ?? "").trim();
-        if (!contactName) throw new Error("contact is required");
-        if (!text) throw new Error("text is required");
+          if (raw.mode === "apply") {
+            const committed = await applyPendingChanges();
+            return JSON.stringify(committed, null, 2);
+          }
+          return JSON.stringify({ ok: true, staged: true, pending: pendingChanges.length }, null, 2);
+        }
 
-        const contact = await prisma.contact.findFirst({
-          where: { teamId: input.teamId, name: contactName },
-          select: { id: true },
-        });
-        if (!contact) throw new Error("contact not found");
+        if (raw.action === "create_message") {
+          const contactName = (raw.contact ?? "").trim();
+          const text = (raw.text ?? "").trim();
+          if (!contactName) throw new Error("contact is required");
+          if (!text) throw new Error("text is required");
 
-        const occurredAt = raw.at ? new Date(raw.at) : new Date();
-        if (Number.isNaN(occurredAt.getTime())) throw new Error("at is invalid");
+          const contact = await resolveContact(input.teamId, contactName);
+          if (!contact) throw new Error("contact not found");
 
-        const created = await prisma.contactMessage.create({
-          data: {
+          const occurredAt = raw.at ? new Date(raw.at) : new Date();
+          if (Number.isNaN(occurredAt.getTime())) throw new Error("at is invalid");
+
+          pendingChanges.push({
+            id: makeId("chg"),
+            type: "create_message",
+            createdAt: iso(new Date()),
             contactId: contact.id,
-            kind: raw.kind === "call" ? "CALL" : "MESSAGE",
-            direction: raw.direction === "in" ? "IN" : "OUT",
-            channel:
-              raw.channel === "Telegram"
-                ? "TELEGRAM"
-                : raw.channel === "WhatsApp"
-                  ? "WHATSAPP"
-                  : raw.channel === "Instagram"
-                    ? "INSTAGRAM"
-                    : raw.channel === "Email"
-                      ? "EMAIL"
-                      : "PHONE",
-            content: text,
+            contactName: contact.name,
+            kind: raw.kind === "call" ? "call" : "message",
+            direction: raw.direction === "in" ? "in" : "out",
+            channel: raw.channel ?? "Phone",
+            text,
+            at: iso(occurredAt),
             durationSec: typeof raw.durationSec === "number" ? raw.durationSec : null,
-            transcriptJson: Array.isArray(raw.transcript) ? raw.transcript : null,
-            occurredAt,
-          },
+            transcript: Array.isArray(raw.transcript) ? raw.transcript : null,
+          });
+
+          if (raw.mode === "apply") {
+            const committed = await applyPendingChanges();
+            return JSON.stringify(committed, null, 2);
+          }
+          return JSON.stringify({ ok: true, staged: true, pending: pendingChanges.length }, null, 2);
+        }
+
+        if (raw.action === "update_deal_stage") {
+          const dealId = (raw.dealId ?? "").trim();
+          const stage = (raw.stage ?? "").trim();
+          if (!dealId) throw new Error("dealId is required");
+          if (!stage) throw new Error("stage is required");
+
+          const deal = await prisma.deal.findFirst({
+            where: { id: dealId, teamId: input.teamId },
+            select: { id: true, title: true },
+          });
+          if (!deal) throw new Error("deal not found");
+
+          pendingChanges.push({
+            id: makeId("chg"),
+            type: "update_deal_stage",
+            createdAt: iso(new Date()),
+            dealId: deal.id,
+            dealTitle: deal.title,
+            stage,
+          });
+
+          if (raw.mode === "apply") {
+            const committed = await applyPendingChanges();
+            return JSON.stringify(committed, null, 2);
+          }
+          return JSON.stringify({ ok: true, staged: true, pending: pendingChanges.length }, null, 2);
+        }
+
+        return JSON.stringify({ ok: false, error: "unknown action" });
+      };
+
+      try {
+        const result = await executeAction();
+        toolRuns.push({
+          name: toolName,
+          status: "ok",
+          input: compact(raw),
+          output: compact(result),
+          at: startedAt,
         });
-        dbWrites.push({ kind: "contact_message", detail: `created ${created.id}` });
-        return JSON.stringify({ ok: true, id: created.id });
-      }
-
-      if (raw.action === "update_deal_stage") {
-        const dealId = (raw.dealId ?? "").trim();
-        const stage = (raw.stage ?? "").trim();
-        if (!dealId) throw new Error("dealId is required");
-        if (!stage) throw new Error("stage is required");
-
-        const updated = await prisma.deal.updateMany({
-          where: { id: dealId, teamId: input.teamId },
-          data: { stage },
+        return result;
+      } catch (error: any) {
+        toolRuns.push({
+          name: toolName,
+          status: "error",
+          input: compact(raw),
+          output: compact(error?.message || String(error)),
+          at: startedAt,
         });
-        if (updated.count === 0) throw new Error("deal not found");
-        dbWrites.push({ kind: "deal", detail: `updated stage for ${dealId}` });
-        return JSON.stringify({ ok: true });
+        throw error;
       }
-
-      return JSON.stringify({ ok: false, error: "unknown action" });
     },
     {
       name: "crm",
@@ -329,11 +781,19 @@ export async function runLangGraphCrmAgentFor(input: {
   );
 
   const snapshot = await buildCrmSnapshot({ teamId: input.teamId });
+  const snapshotJson = JSON.stringify(snapshot, null, 2);
 
   const model = new ChatOpenAI({
-    apiKey: process.env.OPENAI_API_KEY,
-    model: process.env.OPENAI_MODEL || "gpt-4o-mini",
+    apiKey: llmApiKey,
+    model: llmModel,
     temperature: 0.2,
+    ...(llmBaseURL
+      ? {
+          configuration: {
+            baseURL: llmBaseURL,
+          },
+        }
+      : {}),
   });
 
   const agent = createReactAgent({
@@ -349,12 +809,15 @@ export async function runLangGraphCrmAgentFor(input: {
     "You are Pilot, a CRM assistant.",
     "Rules:",
     "- Be concrete and concise.",
-    "- If you need data beyond the snapshot, call the crm tool.",
-    "- If user asks to change CRM, you may do it via the crm tool and then report what changed.",
-    "- Do not claim you sent an external message; you can only create draft messages/events/notes in CRM.",
+    "- You are given a structured CRM JSON snapshot as baseline context.",
+    "- If you need fresher or narrower data, call crm.get_snapshot/query_* tools.",
+    "- For changes, stage first with mode=stage. Commit only when user asks to execute.",
+    "- You can apply immediately with mode=apply only if user explicitly asked to do it now.",
+    "- Use pending_changes and commit_changes to control staged updates.",
+    "- Do not claim you sent an external message; you can only create CRM records.",
     "",
-    "CRM Snapshot:",
-    snapshot,
+    "CRM Snapshot JSON:",
+    snapshotJson,
   ].join("\n");
 
   const res: any = await agent.invoke(
@@ -371,5 +834,12 @@ export async function runLangGraphCrmAgentFor(input: {
   const text = structured?.answer?.trim() || "Готово.";
   const plan = Array.isArray(structured?.plan) ? structured!.plan : ["Собрать данные", "Сформировать ответ"];
 
-  return { text, plan, tools: toolsUsed, dbWrites: dbWrites.length ? dbWrites : undefined };
+  return {
+    text,
+    plan,
+    thinking: plan,
+    tools: toolsUsed,
+    toolRuns,
+    dbWrites: dbWrites.length ? dbWrites : undefined,
+  };
 }
diff --git a/Frontend/server/api/graphql.post.ts b/Frontend/server/api/graphql.post.ts
new file mode 100644
index 0000000..7c39778
--- /dev/null
+++ b/Frontend/server/api/graphql.post.ts
@@ -0,0 +1,39 @@
+import { readBody } from "h3";
+import { graphql } from "graphql";
+import { getAuthContext } from "../utils/auth";
+import { crmGraphqlRoot, crmGraphqlSchema } from "../graphql/schema";
+
+type GraphqlBody = {
+  query?: string;
+  operationName?: string;
+  variables?: Record<string, unknown>;
+};
+
+export default defineEventHandler(async (event) => {
+  const body = await readBody<GraphqlBody>(event);
+
+  if (!body?.query || !body.query.trim()) {
+    throw createError({ statusCode: 400, statusMessage: "GraphQL query is required" });
+  }
+
+  let auth = null;
+  try {
+    auth = await getAuthContext(event);
+  } catch {
+    auth = null;
+  }
+
+  const result = await graphql({
+    schema: crmGraphqlSchema,
+    source: body.query,
+    rootValue: crmGraphqlRoot,
+    contextValue: { auth, event },
+    variableValues: body.variables,
+    operationName: body.operationName,
+  });
+
+  return {
+    data: result.data ?? null,
+    errors: result.errors?.map((error) => ({ message: error.message })) ?? undefined,
+  };
+});
diff --git a/Frontend/server/graphql/schema.ts b/Frontend/server/graphql/schema.ts
new file mode 100644
index 0000000..488f038
--- /dev/null
+++ b/Frontend/server/graphql/schema.ts
@@ -0,0 +1,781 @@
+import { buildSchema } from "graphql";
+import type { H3Event } from "h3";
+import type { AuthContext } from "../utils/auth";
+import { clearAuthSession, setSession } from "../utils/auth";
+import { prisma } from "../utils/prisma";
+import { normalizePhone, verifyPassword } from "../utils/password";
+import { persistChatMessage, runCrmAgentFor } from "../agent/crmAgent";
+
+type GraphQLContext = {
+  auth: AuthContext | null;
+  event: H3Event;
+};
+
+function requireAuth(auth: AuthContext | null) {
+  if (!auth) {
+    throw new Error("Unauthorized");
+  }
+  return auth;
+}
+
+function mapChannel(channel: string) {
+  if (channel === "TELEGRAM") return "Telegram";
+  if (channel === "WHATSAPP") return "WhatsApp";
+  if (channel === "INSTAGRAM") return "Instagram";
+  if (channel === "EMAIL") return "Email";
+  return "Phone";
+}
+
+function toDbChannel(channel: string) {
+  const c = channel.toLowerCase();
+  if (c === "telegram") return "TELEGRAM";
+  if (c === "whatsapp") return "WHATSAPP";
+  if (c === "instagram") return "INSTAGRAM";
+  if (c === "email") return "EMAIL";
+  return "PHONE";
+}
+
+async function loginWithPassword(event: H3Event, phoneInput: string, passwordInput: string) {
+  const phone = normalizePhone(phoneInput);
+  const password = (passwordInput ?? "").trim();
+
+  if (!phone) {
+    throw new Error("phone is required");
+  }
+  if (!password) {
+    throw new Error("password is required");
+  }
+
+  const user = await prisma.user.findUnique({
+    where: { phone },
+    include: {
+      memberships: {
+        orderBy: { createdAt: "asc" },
+        take: 1,
+      },
+    },
+  });
+
+  if (!user || !verifyPassword(password, user.passwordHash)) {
+    throw new Error("invalid credentials");
+  }
+
+  const membership = user.memberships[0];
+  if (!membership) {
+    throw new Error("user has no team access");
+  }
+
+  const conversation =
+    (await prisma.chatConversation.findFirst({
+      where: { teamId: membership.teamId, createdByUserId: user.id },
+      orderBy: { createdAt: "desc" },
+    })) ||
+    (await prisma.chatConversation.create({
+      data: { teamId: membership.teamId, createdByUserId: user.id, title: "Pilot" },
+    }));
+
+  setSession(event, {
+    teamId: membership.teamId,
+    userId: user.id,
+    conversationId: conversation.id,
+  });
+
+  return { ok: true };
+}
+
+async function getAuthPayload(auth: AuthContext | null) {
+  const ctx = requireAuth(auth);
+  const [user, team, conv] = await Promise.all([
+    prisma.user.findUnique({ where: { id: ctx.userId } }),
+    prisma.team.findUnique({ where: { id: ctx.teamId } }),
+    prisma.chatConversation.findUnique({
+      where: { id: ctx.conversationId },
+      include: { messages: { orderBy: { createdAt: "desc" }, take: 1, select: { text: true, createdAt: true } } },
+    }),
+  ]);
+
+  if (!user || !team || !conv) {
+    throw new Error("Unauthorized");
+  }
+
+  return {
+    user: { id: user.id, phone: user.phone, name: user.name },
+    team: { id: team.id, name: team.name },
+    conversation: {
+      id: conv.id,
+      title: conv.title ?? "New chat",
+      createdAt: conv.createdAt.toISOString(),
+      updatedAt: conv.updatedAt.toISOString(),
+      lastMessageAt: conv.messages[0]?.createdAt?.toISOString?.() ?? null,
+      lastMessageText: conv.messages[0]?.text ?? null,
+    },
+  };
+}
+
+function defaultConversationTitle(input?: string | null) {
+  const value = (input ?? "").trim();
+  if (value) return value;
+  const stamp = new Intl.DateTimeFormat("en-GB", {
+    day: "2-digit",
+    month: "short",
+    hour: "2-digit",
+    minute: "2-digit",
+  }).format(new Date());
+  return `Chat ${stamp}`;
+}
+
+async function getChatConversations(auth: AuthContext | null) {
+  const ctx = requireAuth(auth);
+
+  const items = await prisma.chatConversation.findMany({
+    where: { teamId: ctx.teamId, createdByUserId: ctx.userId },
+    include: {
+      messages: {
+        orderBy: { createdAt: "desc" },
+        take: 1,
+        select: { text: true, createdAt: true },
+      },
+    },
+    take: 100,
+  });
+
+  return items
+    .map((c) => ({
+      id: c.id,
+      title: defaultConversationTitle(c.title),
+      createdAt: c.createdAt.toISOString(),
+      updatedAt: c.updatedAt.toISOString(),
+      lastMessageAt: c.messages[0]?.createdAt?.toISOString?.() ?? null,
+      lastMessageText: c.messages[0]?.text ?? null,
+    }))
+    .sort((a, b) => {
+      const aTime = a.lastMessageAt ?? a.updatedAt;
+      const bTime = b.lastMessageAt ?? b.updatedAt;
+      return bTime.localeCompare(aTime);
+    });
+}
+
+async function createChatConversation(auth: AuthContext | null, event: H3Event, titleInput?: string | null) {
+  const ctx = requireAuth(auth);
+
+  const conversation = await prisma.chatConversation.create({
+    data: {
+      teamId: ctx.teamId,
+      createdByUserId: ctx.userId,
+      title: defaultConversationTitle(titleInput),
+    },
+  });
+
+  setSession(event, {
+    teamId: ctx.teamId,
+    userId: ctx.userId,
+    conversationId: conversation.id,
+  });
+
+  return {
+    id: conversation.id,
+    title: defaultConversationTitle(conversation.title),
+    createdAt: conversation.createdAt.toISOString(),
+    updatedAt: conversation.updatedAt.toISOString(),
+    lastMessageAt: null,
+    lastMessageText: null,
+  };
+}
+
+async function selectChatConversation(auth: AuthContext | null, event: H3Event, id: string) {
+  const ctx = requireAuth(auth);
+  const convId = (id ?? "").trim();
+  if (!convId) throw new Error("id is required");
+
+  const conversation = await prisma.chatConversation.findFirst({
+    where: {
+      id: convId,
+      teamId: ctx.teamId,
+      createdByUserId: ctx.userId,
+    },
+    select: { id: true },
+  });
+
+  if (!conversation) throw new Error("conversation not found");
+
+  setSession(event, {
+    teamId: ctx.teamId,
+    userId: ctx.userId,
+    conversationId: conversation.id,
+  });
+
+  return { ok: true };
+}
+
+async function getChatMessages(auth: AuthContext | null) {
+  const ctx = requireAuth(auth);
+  const items = await prisma.chatMessage.findMany({
+    where: { teamId: ctx.teamId, conversationId: ctx.conversationId },
+    orderBy: { createdAt: "asc" },
+    take: 200,
+  });
+
+  return items.map((m) => {
+    const debug = (m.planJson as any) ?? {};
+    return {
+      id: m.id,
+      role: m.role === "USER" ? "user" : m.role === "ASSISTANT" ? "assistant" : "system",
+      text: m.text,
+      plan: Array.isArray(debug.steps) ? (debug.steps as string[]) : [],
+      thinking: Array.isArray(debug.thinking) ? (debug.thinking as string[]) : Array.isArray(debug.steps) ? (debug.steps as string[]) : [],
+      tools: Array.isArray(debug.tools) ? (debug.tools as string[]) : [],
+      toolRuns: Array.isArray(debug.toolRuns)
+        ? (debug.toolRuns as any[])
+            .filter((t) => t && typeof t === "object")
+            .map((t: any) => ({
+              name: String(t.name ?? "crm:unknown"),
+              status: t.status === "error" ? "error" : "ok",
+              input: String(t.input ?? ""),
+              output: String(t.output ?? ""),
+              at: t.at ? String(t.at) : m.createdAt.toISOString(),
+            }))
+        : [],
+      createdAt: m.createdAt.toISOString(),
+    };
+  });
+}
+
+async function getDashboard(auth: AuthContext | null) {
+  const ctx = requireAuth(auth);
+  const from = new Date(Date.now() - 1000 * 60 * 60 * 24 * 30);
+  const to = new Date(Date.now() + 1000 * 60 * 60 * 24 * 60);
+
+  const [
+    contactsRaw,
+    communicationsRaw,
+    calendarRaw,
+    dealsRaw,
+    feedRaw,
+    pinsRaw,
+    documentsRaw,
+  ] = await Promise.all([
+    prisma.contact.findMany({
+      where: { teamId: ctx.teamId },
+      include: {
+        note: { select: { content: true } },
+        messages: { select: { occurredAt: true }, orderBy: { occurredAt: "desc" }, take: 1 },
+      },
+      orderBy: { updatedAt: "desc" },
+      take: 500,
+    }),
+    prisma.contactMessage.findMany({
+      where: { contact: { teamId: ctx.teamId } },
+      orderBy: { occurredAt: "asc" },
+      take: 2000,
+      include: { contact: { select: { id: true, name: true } } },
+    }),
+    prisma.calendarEvent.findMany({
+      where: { teamId: ctx.teamId, startsAt: { gte: from, lte: to } },
+      include: { contact: { select: { name: true } } },
+      orderBy: { startsAt: "asc" },
+      take: 500,
+    }),
+    prisma.deal.findMany({
+      where: { teamId: ctx.teamId },
+      include: { contact: { select: { name: true, company: true } } },
+      orderBy: { updatedAt: "desc" },
+      take: 500,
+    }),
+    prisma.feedCard.findMany({
+      where: { teamId: ctx.teamId },
+      include: { contact: { select: { name: true } } },
+      orderBy: { happenedAt: "desc" },
+      take: 200,
+    }),
+    prisma.contactPin.findMany({
+      where: { teamId: ctx.teamId },
+      include: { contact: { select: { name: true } } },
+      orderBy: { updatedAt: "desc" },
+      take: 500,
+    }),
+    prisma.workspaceDocument.findMany({
+      where: { teamId: ctx.teamId },
+      orderBy: { updatedAt: "desc" },
+      take: 200,
+    }),
+  ]);
+
+  const channelsByContactId = new Map<string, Set<string>>();
+  for (const item of communicationsRaw) {
+    if (!channelsByContactId.has(item.contactId)) {
+      channelsByContactId.set(item.contactId, new Set());
+    }
+    channelsByContactId.get(item.contactId)?.add(mapChannel(item.channel));
+  }
+
+  const contacts = contactsRaw.map((c) => ({
+    id: c.id,
+    name: c.name,
+    avatar: c.avatarUrl ?? "",
+    company: c.company ?? "",
+    country: c.country ?? "",
+    location: c.location ?? "",
+    channels: Array.from(channelsByContactId.get(c.id) ?? []),
+    lastContactAt: c.messages[0]?.occurredAt?.toISOString?.() ?? c.updatedAt.toISOString(),
+    description: c.note?.content ?? "",
+  }));
+
+  const communications = communicationsRaw.map((m) => ({
+    id: m.id,
+    at: m.occurredAt.toISOString(),
+    contactId: m.contactId,
+    contact: m.contact.name,
+    channel: mapChannel(m.channel),
+    kind: m.kind === "CALL" ? "call" : "message",
+    direction: m.direction === "IN" ? "in" : "out",
+    text: m.content,
+    duration: m.durationSec ? new Date(m.durationSec * 1000).toISOString().slice(14, 19) : "",
+    transcript: Array.isArray(m.transcriptJson) ? ((m.transcriptJson as any) as string[]) : [],
+  }));
+
+  const calendar = calendarRaw.map((e) => ({
+    id: e.id,
+    title: e.title,
+    start: e.startsAt.toISOString(),
+    end: (e.endsAt ?? e.startsAt).toISOString(),
+    contact: e.contact?.name ?? "",
+    note: e.note ?? "",
+  }));
+
+  const deals = dealsRaw.map((d) => ({
+    id: d.id,
+    contact: d.contact.name,
+    title: d.title,
+    company: d.contact.company ?? "",
+    stage: d.stage,
+    amount: d.amount ? String(d.amount) : "",
+    nextStep: d.nextStep ?? "",
+    summary: d.summary ?? "",
+  }));
+
+  const feed = feedRaw.map((c) => ({
+    id: c.id,
+    at: c.happenedAt.toISOString(),
+    contact: c.contact?.name ?? "",
+    text: c.text,
+    proposal: {
+      title: ((c.proposalJson as any)?.title ?? "") as string,
+      details: (Array.isArray((c.proposalJson as any)?.details) ? (c.proposalJson as any).details : []) as string[],
+      key: ((c.proposalJson as any)?.key ?? "") as string,
+    },
+    decision: c.decision === "ACCEPTED" ? "accepted" : c.decision === "REJECTED" ? "rejected" : "pending",
+    decisionNote: c.decisionNote ?? "",
+  }));
+
+  const pins = pinsRaw.map((p) => ({
+    id: p.id,
+    contact: p.contact.name,
+    text: p.text,
+  }));
+
+  const documents = documentsRaw.map((d) => ({
+    id: d.id,
+    title: d.title,
+    type: d.type,
+    owner: d.owner,
+    scope: d.scope,
+    updatedAt: d.updatedAt.toISOString(),
+    summary: d.summary,
+    body: d.body,
+  }));
+
+  return {
+    contacts,
+    communications,
+    calendar,
+    deals,
+    feed,
+    pins,
+    documents,
+  };
+}
+
+async function createCalendarEvent(auth: AuthContext | null, input: {
+  title: string;
+  start: string;
+  end?: string;
+  contact?: string;
+  note?: string;
+  status?: string;
+}) {
+  const ctx = requireAuth(auth);
+
+  const title = (input?.title ?? "").trim();
+  const start = input?.start ? new Date(input.start) : null;
+  const end = input?.end ? new Date(input.end) : null;
+
+  if (!title) throw new Error("title is required");
+  if (!start || Number.isNaN(start.getTime())) throw new Error("start is invalid");
+
+  const contactName = (input?.contact ?? "").trim();
+  const contact = contactName
+    ? await prisma.contact.findFirst({ where: { teamId: ctx.teamId, name: contactName }, select: { id: true, name: true } })
+    : null;
+
+  const created = await prisma.calendarEvent.create({
+    data: {
+      teamId: ctx.teamId,
+      contactId: contact?.id ?? null,
+      title,
+      startsAt: start,
+      endsAt: end && !Number.isNaN(end.getTime()) ? end : null,
+      note: (input?.note ?? "").trim() || null,
+      status: (input?.status ?? "").trim() || null,
+    },
+    include: { contact: { select: { name: true } } },
+  });
+
+  return {
+    id: created.id,
+    title: created.title,
+    start: created.startsAt.toISOString(),
+    end: (created.endsAt ?? created.startsAt).toISOString(),
+    contact: created.contact?.name ?? "",
+    note: created.note ?? "",
+  };
+}
+
+async function createCommunication(auth: AuthContext | null, input: {
+  contact: string;
+  channel?: string;
+  kind?: "message" | "call";
+  direction?: "in" | "out";
+  text?: string;
+  at?: string;
+  durationSec?: number;
+  transcript?: string[];
+}) {
+  const ctx = requireAuth(auth);
+
+  const contactName = (input?.contact ?? "").trim();
+  if (!contactName) throw new Error("contact is required");
+
+  const contact = await prisma.contact.findFirst({
+    where: { teamId: ctx.teamId, name: contactName },
+    select: { id: true },
+  });
+  if (!contact) throw new Error("contact not found");
+
+  const occurredAt = input?.at ? new Date(input.at) : new Date();
+  if (Number.isNaN(occurredAt.getTime())) throw new Error("at is invalid");
+
+  const created = await prisma.contactMessage.create({
+    data: {
+      contactId: contact.id,
+      kind: input?.kind === "call" ? "CALL" : "MESSAGE",
+      direction: input?.direction === "in" ? "IN" : "OUT",
+      channel: toDbChannel(input?.channel ?? "Phone") as any,
+      content: (input?.text ?? "").trim(),
+      durationSec: typeof input?.durationSec === "number" ? input.durationSec : null,
+      transcriptJson: Array.isArray(input?.transcript) ? input.transcript : undefined,
+      occurredAt,
+    },
+  });
+
+  return { ok: true, id: created.id };
+}
+
+async function updateFeedDecision(auth: AuthContext | null, id: string, decision: "accepted" | "rejected" | "pending", decisionNote?: string) {
+  const ctx = requireAuth(auth);
+
+  if (!id) throw new Error("id is required");
+  if (!decision) throw new Error("decision is required");
+
+  const nextDecision = decision === "accepted" ? "ACCEPTED" : decision === "rejected" ? "REJECTED" : "PENDING";
+
+  const res = await prisma.feedCard.updateMany({
+    where: { id, teamId: ctx.teamId },
+    data: { decision: nextDecision, decisionNote: decisionNote ?? null },
+  });
+  if (res.count === 0) throw new Error("feed card not found");
+
+  return { ok: true, id };
+}
+
+async function sendPilotMessage(auth: AuthContext | null, textInput: string) {
+  const ctx = requireAuth(auth);
+  const text = (textInput ?? "").trim();
+  if (!text) throw new Error("text is required");
+
+  await persistChatMessage({
+    teamId: ctx.teamId,
+    conversationId: ctx.conversationId,
+    authorUserId: ctx.userId,
+    role: "USER",
+    text,
+  });
+
+  const reply = await runCrmAgentFor({ teamId: ctx.teamId, userId: ctx.userId, userText: text });
+  await persistChatMessage({
+    teamId: ctx.teamId,
+    conversationId: ctx.conversationId,
+    authorUserId: null,
+    role: "ASSISTANT",
+    text: reply.text,
+    plan: reply.plan,
+    thinking: reply.thinking ?? reply.plan,
+    tools: reply.tools,
+    toolRuns: reply.toolRuns ?? [],
+  });
+
+  return { ok: true };
+}
+
+async function logPilotNote(auth: AuthContext | null, textInput: string) {
+  const ctx = requireAuth(auth);
+  const text = (textInput ?? "").trim();
+  if (!text) throw new Error("text is required");
+
+  await persistChatMessage({
+    teamId: ctx.teamId,
+    conversationId: ctx.conversationId,
+    authorUserId: null,
+    role: "ASSISTANT",
+    text,
+    plan: [],
+    thinking: [],
+    tools: [],
+    toolRuns: [],
+  });
+
+  return { ok: true };
+}
+
+export const crmGraphqlSchema = buildSchema(`
+  type Query {
+    me: MePayload!
+    chatMessages: [PilotMessage!]!
+    chatConversations: [Conversation!]!
+    dashboard: DashboardPayload!
+  }
+
+  type Mutation {
+    login(phone: String!, password: String!): MutationResult!
+    logout: MutationResult!
+    createChatConversation(title: String): Conversation!
+    selectChatConversation(id: ID!): MutationResult!
+    sendPilotMessage(text: String!): MutationResult!
+    logPilotNote(text: String!): MutationResult!
+    createCalendarEvent(input: CreateCalendarEventInput!): CalendarEvent!
+    createCommunication(input: CreateCommunicationInput!): MutationWithIdResult!
+    updateFeedDecision(id: ID!, decision: String!, decisionNote: String): MutationWithIdResult!
+  }
+
+  type MutationResult {
+    ok: Boolean!
+  }
+
+  type MutationWithIdResult {
+    ok: Boolean!
+    id: ID!
+  }
+
+  input CreateCalendarEventInput {
+    title: String!
+    start: String!
+    end: String
+    contact: String
+    note: String
+    status: String
+  }
+
+  input CreateCommunicationInput {
+    contact: String!
+    channel: String
+    kind: String
+    direction: String
+    text: String
+    at: String
+    durationSec: Int
+    transcript: [String!]
+  }
+
+  type MePayload {
+    user: MeUser!
+    team: MeTeam!
+    conversation: Conversation!
+  }
+
+  type MeUser {
+    id: ID!
+    phone: String!
+    name: String!
+  }
+
+  type MeTeam {
+    id: ID!
+    name: String!
+  }
+
+  type Conversation {
+    id: ID!
+    title: String!
+    createdAt: String!
+    updatedAt: String!
+    lastMessageAt: String
+    lastMessageText: String
+  }
+
+  type PilotMessage {
+    id: ID!
+    role: String!
+    text: String!
+    plan: [String!]!
+    thinking: [String!]!
+    tools: [String!]!
+    toolRuns: [PilotToolRun!]!
+    createdAt: String!
+  }
+
+  type PilotToolRun {
+    name: String!
+    status: String!
+    input: String!
+    output: String!
+    at: String!
+  }
+
+  type DashboardPayload {
+    contacts: [Contact!]!
+    communications: [CommItem!]!
+    calendar: [CalendarEvent!]!
+    deals: [Deal!]!
+    feed: [FeedCard!]!
+    pins: [CommPin!]!
+    documents: [WorkspaceDocument!]!
+  }
+
+  type Contact {
+    id: ID!
+    name: String!
+    avatar: String!
+    company: String!
+    country: String!
+    location: String!
+    channels: [String!]!
+    lastContactAt: String!
+    description: String!
+  }
+
+  type CommItem {
+    id: ID!
+    at: String!
+    contactId: String!
+    contact: String!
+    channel: String!
+    kind: String!
+    direction: String!
+    text: String!
+    duration: String!
+    transcript: [String!]!
+  }
+
+  type CalendarEvent {
+    id: ID!
+    title: String!
+    start: String!
+    end: String!
+    contact: String!
+    note: String!
+  }
+
+  type Deal {
+    id: ID!
+    contact: String!
+    title: String!
+    company: String!
+    stage: String!
+    amount: String!
+    nextStep: String!
+    summary: String!
+  }
+
+  type FeedCard {
+    id: ID!
+    at: String!
+    contact: String!
+    text: String!
+    proposal: FeedProposal!
+    decision: String!
+    decisionNote: String!
+  }
+
+  type FeedProposal {
+    title: String!
+    details: [String!]!
+    key: String!
+  }
+
+  type CommPin {
+    id: ID!
+    contact: String!
+    text: String!
+  }
+
+  type WorkspaceDocument {
+    id: ID!
+    title: String!
+    type: String!
+    owner: String!
+    scope: String!
+    updatedAt: String!
+    summary: String!
+    body: String!
+  }
+`);
+
+export const crmGraphqlRoot = {
+  me: async (_args: unknown, context: GraphQLContext) => getAuthPayload(context.auth),
+  chatMessages: async (_args: unknown, context: GraphQLContext) => getChatMessages(context.auth),
+  chatConversations: async (_args: unknown, context: GraphQLContext) => getChatConversations(context.auth),
+  dashboard: async (_args: unknown, context: GraphQLContext) => getDashboard(context.auth),
+
+  login: async (args: { phone: string; password: string }, context: GraphQLContext) =>
+    loginWithPassword(context.event, args.phone, args.password),
+
+  logout: async (_args: unknown, context: GraphQLContext) => {
+    clearAuthSession(context.event);
+    return { ok: true };
+  },
+
+  createChatConversation: async (args: { title?: string }, context: GraphQLContext) =>
+    createChatConversation(context.auth, context.event, args.title),
+
+  selectChatConversation: async (args: { id: string }, context: GraphQLContext) =>
+    selectChatConversation(context.auth, context.event, args.id),
+
+  sendPilotMessage: async (args: { text: string }, context: GraphQLContext) =>
+    sendPilotMessage(context.auth, args.text),
+
+  logPilotNote: async (args: { text: string }, context: GraphQLContext) =>
+    logPilotNote(context.auth, args.text),
+
+  createCalendarEvent: async (args: { input: { title: string; start: string; end?: string; contact?: string; note?: string; status?: string } }, context: GraphQLContext) =>
+    createCalendarEvent(context.auth, args.input),
+
+  createCommunication: async (
+    args: {
+      input: {
+        contact: string;
+        channel?: string;
+        kind?: "message" | "call";
+        direction?: "in" | "out";
+        text?: string;
+        at?: string;
+        durationSec?: number;
+        transcript?: string[];
+      };
+    },
+    context: GraphQLContext,
+  ) => createCommunication(context.auth, args.input),
+
+  updateFeedDecision: async (
+    args: { id: string; decision: "accepted" | "rejected" | "pending"; decisionNote?: string },
+    context: GraphQLContext,
+  ) => updateFeedDecision(context.auth, args.id, args.decision, args.decisionNote),
+};
diff --git a/Frontend/server/utils/auth.ts b/Frontend/server/utils/auth.ts
index dcb5036..28ec656 100644
--- a/Frontend/server/utils/auth.ts
+++ b/Frontend/server/utils/auth.ts
@@ -1,6 +1,7 @@
 import type { H3Event } from "h3";
 import { getCookie, setCookie, deleteCookie, getHeader } from "h3";
 import { prisma } from "./prisma";
+import { hashPassword } from "./password";
 
 export type AuthContext = {
   teamId: string;
@@ -58,9 +59,16 @@ export async function getAuthContext(event: H3Event): Promise<AuthContext> {
 
   const user = await prisma.user.findUnique({ where: { id: userId } });
   const team = await prisma.team.findUnique({ where: { id: teamId } });
-  const conv = await prisma.chatConversation.findUnique({ where: { id: conversationId } });
 
-  if (!user || !team || !conv) {
+  if (!user || !team) {
+    throw createError({ statusCode: 401, statusMessage: "Unauthorized" });
+  }
+
+  const conv = await prisma.chatConversation.findFirst({
+    where: { id: conversationId, teamId: team.id, createdByUserId: user.id },
+  });
+
+  if (!conv) {
     throw createError({ statusCode: 401, statusMessage: "Unauthorized" });
   }
 
@@ -68,10 +76,11 @@ export async function getAuthContext(event: H3Event): Promise<AuthContext> {
 }
 
 export async function ensureDemoAuth() {
+  const demoPasswordHash = hashPassword("DemoPass123!");
   const user = await prisma.user.upsert({
     where: { id: "demo-user" },
-    update: { email: "demo@clientsflow.local", name: "Demo User" },
-    create: { id: "demo-user", email: "demo@clientsflow.local", name: "Demo User" },
+    update: { phone: "+15550000099", email: "demo@clientsflow.local", passwordHash: demoPasswordHash, name: "Demo User" },
+    create: { id: "demo-user", phone: "+15550000099", email: "demo@clientsflow.local", passwordHash: demoPasswordHash, name: "Demo User" },
   });
   const team = await prisma.team.upsert({
     where: { id: "demo-team" },
diff --git a/Frontend/server/utils/password.ts b/Frontend/server/utils/password.ts
new file mode 100644
index 0000000..b8ace35
--- /dev/null
+++ b/Frontend/server/utils/password.ts
@@ -0,0 +1,29 @@
+import { randomBytes, scryptSync, timingSafeEqual } from "node:crypto";
+
+const SCRYPT_KEY_LENGTH = 64;
+
+export function normalizePhone(raw: string) {
+  const trimmed = (raw ?? "").trim();
+  if (!trimmed) return "";
+  const hasPlus = trimmed.startsWith("+");
+  const digits = trimmed.replace(/\D/g, "");
+  if (!digits) return "";
+  return `${hasPlus ? "+" : ""}${digits}`;
+}
+
+export function hashPassword(password: string) {
+  const salt = randomBytes(16).toString("base64url");
+  const digest = scryptSync(password, salt, SCRYPT_KEY_LENGTH).toString("base64url");
+  return `scrypt$${salt}$${digest}`;
+}
+
+export function verifyPassword(password: string, encodedHash: string) {
+  const [algo, salt, digest] = (encodedHash ?? "").split("$");
+  if (algo !== "scrypt" || !salt || !digest) return false;
+
+  const actual = scryptSync(password, salt, SCRYPT_KEY_LENGTH);
+  const expected = Buffer.from(digest, "base64url");
+  if (actual.byteLength !== expected.byteLength) return false;
+
+  return timingSafeEqual(actual, expected);
+}
diff --git a/compose.yaml b/compose.yaml
index 0901d0b..8cc1128 100644
--- a/compose.yaml
+++ b/compose.yaml
@@ -12,6 +12,9 @@ services:
       REDIS_URL: "redis://redis:6379"
       CF_AGENT_MODE: "langgraph"
       OPENAI_MODEL: "gpt-4o-mini"
+      GIGACHAT_AUTH_KEY: "${GIGACHAT_AUTH_KEY:-}"
+      GIGACHAT_MODEL: "${GIGACHAT_MODEL:-GigaChat-2-Max}"
+      GIGACHAT_SCOPE: "${GIGACHAT_SCOPE:-GIGACHAT_API_PERS}"
       # Set this in your shell or a compose override:
       # OPENAI_API_KEY: "..."
     command: >