refactor: archive GUI clients; keep minimal TUI with hooks/API

Move Qt/Tauri/full Web SPA under archive/, ship hermit as CLI/TUI plus
libcstcore and cst-webui/1 HTTP+SSE (turn lifecycle hooks, capabilities).

Co-authored-by: Cursor <cursoragent@cursor.com>

scripts/e2e_webui.sh

@@ -11,8 +11,13 @@ set -eu
 ROOT="$(cd "$(dirname "$0")/.." && pwd)"
 REPLAY="${1:-$ROOT/tests/fixtures/sse/deepseek-native-eos}"
 PROTO="${2:-native-eos}"
-BIN="${CST_AGENT:-$ROOT/cst-agent}"
-[ -x "$BIN" ] || { echo "build cst-agent first ($BIN)"; exit 1; }
+BIN="${CST_AGENT:-}"
+if [ -z "$BIN" ]; then
+  if [ -x "$ROOT/hermit" ]; then BIN="$ROOT/hermit"
+  elif [ -x "$ROOT/cst-agent" ]; then BIN="$ROOT/cst-agent"
+  fi
+fi
+[ -x "$BIN" ] || { echo "build hermit first ($ROOT/hermit)"; exit 1; }
 
 WORK="$(mktemp -d "${TMPDIR:-/tmp}/cst-webui-XXXXXX")" 2>/dev/null || {
   WORK="$ROOT/.build-tmp/e2e-webui"; rm -rf "$WORK"; mkdir -p "$WORK"; }
@@ -30,6 +35,7 @@ echo "== start cst-agent --web (replay $REPLAY)"
 CST_REPLAY_SSE="$REPLAY" \
 CST_REPLAY_CHUNK=512 \
 "$BIN" --web --web-port 0 --workspace "$WORK" --new --api-key sk-e2e \
+  --provider deepseek --model deepseek-chat \
   --protocol "$PROTO" --tools default --yolo > "$LOG" 2>&1 &
 SRV_PID=$!
 
@@ -61,10 +67,11 @@ stop_server() {
   [ "$st" -lt 128 ] || fail "$2 died with status $st on SIGTERM"
 }
 
-# 1. the shell page and the state endpoint
-curl -fsS --max-time 5 "$BASE/" | grep -q "<title>CST-Agent" || fail "GET / is not the shell page"
+# 1. the health page and the state endpoint
+curl -fsS --max-time 5 "$BASE/" | grep -q "<title>Hermit API" || fail "GET / is not the health page"
 curl -fsS --max-time 5 "$BASE/api/state" > "$WORK/state.json" || fail "GET /api/state"
 grep -q '"protocol":"cst-webui/1"' "$WORK/state.json" || fail "state has no protocol tag"
+grep -q '"capabilities"' "$WORK/state.json" || fail "state has no capabilities"
 grep -q '"session":' "$WORK/state.json" || fail "state has no session id"
 
 # 2. an unknown route is a 404, an oversized body a 413
@@ -92,6 +99,7 @@ while [ $i -lt 450 ]; do
 done
 kill "$CURL_PID" 2>/dev/null || true
 grep -q "event: turn_end" "$EVENTS" || fail "the turn never finished"
+grep -q "event: turn_begin" "$EVENTS" || fail "no turn_begin event"
 grep -q "event: assistant_html" "$EVENTS" || fail "no assistant markdown was streamed"
 grep -q "event: tool" "$EVENTS" || fail "no tool event was streamed"
 grep -q '"rc":0' "$EVENTS" || fail "the turn did not end with rc=0"
@@ -180,6 +188,7 @@ P_LOG="$WORK/permission-server.log"   # its own log: the port parse must not
                                       # pick up the first server's URL
 CST_REPLAY_SSE="$REPLAY" CST_REPLAY_CHUNK=512 \
 "$BIN" --web --web-port 0 --workspace "$WORK/pw" --new --api-key sk-e2e \
+  --provider deepseek --model deepseek-chat \
   --protocol "$PROTO" --tools default --approval ask --confirm all \
   > "$P_LOG" 2>&1 &
 P_PID=$!
@@ -229,6 +238,7 @@ echo "== token auth and --web-dev"
 T_LOG="$WORK/token-server.log"
 CST_REPLAY_SSE="$REPLAY" \
 "$BIN" --web --web-port 0 --workspace "$WORK/pw" --new --api-key sk-e2e \
+  --provider deepseek --model deepseek-chat \
   --protocol "$PROTO" --tools default --yolo --web-dev "$ROOT/web" \
   --web-token tok-e2e > "$T_LOG" 2>&1 &
 T_PID=$!
@@ -257,11 +267,17 @@ code="$(curl -s -o /dev/null -w '%{http_code}' --max-time 5 \
         -H 'Authorization: Bearer tok-e2' "$T_BASE/api/state")"
 [ "$code" = "401" ] || fail "a wrong token was accepted ($code)"
 
-# --web-dev serves straight from the directory, so the bytes must match it
-curl -fsS --max-time 5 -H 'Authorization: Bearer tok-e2e' "$T_BASE/app.js" \
-  > "$WORK/app.js" || fail "GET /app.js from --web-dev"
-cmp -s "$WORK/app.js" "$ROOT/web/app.js" ||
-  fail "--web-dev did not serve web/app.js from disk"
+# --web-dev serves the health page from disk
+curl -fsS --max-time 5 -H 'Authorization: Bearer tok-e2e' "$T_BASE/" \
+  > "$WORK/index.html" || fail "GET / from --web-dev"
+cmp -s "$WORK/index.html" "$ROOT/web/index.html" ||
+  fail "--web-dev did not serve web/index.html from disk"
+curl -fsS --max-time 5 -H 'Authorization: Bearer tok-e2e' "$T_BASE/api/state" \
+  > "$WORK/state.json" || fail "GET /api/state with token"
+grep -q '"capabilities"' "$WORK/state.json" ||
+  fail "/api/state missing capabilities"
+grep -q 'turn_begin' "$WORK/state.json" ||
+  fail "/api/state capabilities missing turn_begin"
 
 # POST /api/quit must return and then take the server down on its own
 curl -fsS --max-time 5 -X POST -H 'Authorization: Bearer tok-e2e' \