feat(agent): hierarchical executor with path resolve, runtime probe, quiet UI

Make Zed Agent closer to Cursor: deterministic DevOps path index, live Traefik
port probe before blind edits, stop-after-edit, and quieter Russian progress.

.env.example

@@ -9,7 +9,7 @@ DEPLOY_HOST=https://ai-router.ift.calentiq.com
 # --- LiteLLM ---
 LITELLM_MASTER_KEY=sk-litellm-change-me
 LITELLM_SALT_KEY=sk-salt-generate-once-never-change
-LITELLM_IMAGE=ghcr.io/berriai/litellm:main-v1.96.0-stable
+LITELLM_IMAGE=ghcr.io/berriai/litellm:v1.95.0
 PROXY_BASE_URL=https://litellm.ift.calentiq.com
 
 # Postgres (LiteLLM Admin UI + spend logs)
@@ -17,15 +17,27 @@ POSTGRES_USER=litellm
 POSTGRES_DB=litellm
 POSTGRES_PASSWORD=change-me-postgres
 
-# Novita AI (direct from IFT, no VPN)
+# --- Provider switch (lane backends) ---
+# hybrid (default) = Novita workers + Novita plan/verify | openrouter = VPN reserve
+PRIMARY_PROVIDER=hybrid
+
+# Novita AI (direct from IFT, no VPN) — required for hybrid
 NOVITA_API_KEY=
 
-# Optional fallbacks
+# Anthropic — optional (card/region often blocked); hierarchical uses Novita plan/verify
+ANTHROPIC_API_KEY=
+
+# Optional fixed fallbacks
 GROQ_API_KEY=
 GEMINI_API_KEY=
+TOGETHER_API_KEY=
+# OpenRouter reserve (VPN). Note: Anthropic/OpenAI/Google may be region-blocked on billing address.
+OPENROUTER_API_KEY=
 
-# GigaChat — optional LLM classifier (hybrid mode, freemium for физлица)
-# Authorization key from https://developers.sber.ru/studio/ → GigaChat API
+# xAI Grok — VPN only
+XAI_API_KEY=
+
+# GigaChat — classifier (hybrid mode)
 GIGACHAT_CREDENTIALS=
 CLASSIFIER_MODE=hybrid
 CLASSIFIER_LLM_MODEL=gigachat-classifier
@@ -33,10 +45,18 @@ CLASSIFIER_LLM_MODEL=gigachat-classifier
 # Budget (USD/month, also in litellm_config.yaml)
 LITELLM_MAX_BUDGET=50
 
-# --- VPN (off by default) ---
+# --- VPN (OpenRouter + Grok + Anthropic → VPN; Novita/Groq/Gemini/GigaChat → NO_PROXY) ---
+# Hierarchical plan/verify на Novita — VPN НЕ обязателен
+# 1) vless/vless.conf или VLESS_SUB_URL
+# 2) VPN_ENABLED=true → deploy + vpn-enable.sh (для OR/Grok/Anthropic)
+# 3) api.anthropic.com, openrouter.ai, api.x.ai НЕ в NO_PROXY
 VPN_ENABLED=false
+VLESS_SUB_URL=
+VLESS_HWID=
+VLESS_UA=Happ/3.3.6/Windows/2607171516600
 VLESS_PROXY_URL=http://vless-proxy:8080
-NO_PROXY=localhost,127.0.0.1,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,api.novita.ai,novita.ai,git.sabilin.com,*.ift.calentiq.com,ift.calentiq.com,*.ift.eventhub.local,*.eventhub.local
+# См. scripts/no-proxy-default.sh
+NO_PROXY=localhost,127.0.0.1,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,api.novita.ai,novita.ai,api.groq.com,groq.com,generativelanguage.googleapis.com,ngw.devices.sberbank.ru,gigachat.devices.sberbank.ru,git.sabilin.com,*.ift.calentiq.com,ift.calentiq.com,*.ift.eventhub.local,*.eventhub.local
 
 DISABLE_AIOHTTP_TRANSPORT=True
 USE_AIOHTTP_TRANSPORT=False