OpenCode-style TUI, model probing, sandboxed auto approval

- TUI: centered home screen with logo, boxed input with mode line, sidebar
  (>=120 cols), Ctrl+P palette, Tab Build/Plan, Shift+Tab approval cycle,
  mouse (cards, cursor, pickers, wheel), /sidebar /mouse /approval
- /models probing: key check on entry (401 re-asks), API models in /model
- Shell sandbox in C: Linux Landlock (writes limited to workspace/tmp,
  ABI>=4 blocks TCP), macOS sandbox_init, rules fallback elsewhere
- Approval modes ask/auto/yolo (default auto); read-only command whitelist;
  ask to rerun outside the sandbox when a command looks blocked
- Upgradable bootstrap scripts (git pull --ff-only, rebuild, reinstall) and
  cst-agent-update; cst-agent --version
- tests: test_sandbox, test_models

src/tools/registry.c

@@ -25,7 +25,7 @@ static int run_apply_patch(const cst_tool_ctx_t *ctx, const ctl_tool_call_t *c,
 }
 static int run_shell(const cst_tool_ctx_t *ctx, const ctl_tool_call_t *c,
                      cst_tool_result_t *r) {
-  return cst_tool_run_shell(ctx->workspace_root, c, r);
+  return cst_tool_run_shell_ex(ctx->workspace_root, c, r, ctx->sandbox);
 }
 
 #define S "string"
@@ -193,6 +193,8 @@ int cst_tool_active(const cst_agent_config_t *cfg, const cst_tool_def_t *t) {
     return 1;
   if (cfg->tool_profile == CST_TOOLS_MINIMAL && !t->minimal)
     return 0;
+  if (cfg->plan_mode && (t->perm == CST_TP_WRITE || t->perm == CST_TP_SHELL))
+    return 0;
   int i = (int)(t - TOOLS);
   return !(cfg->tools_off & (1ULL << i));
 }

src/tools/tools.c

@@ -10,6 +10,7 @@
 
 #include "cJSON.h"
 #include "cst_agent.h"
+#include "cst_sandbox.h"
 #include "cst_util.h"
 #include "os_compat.h"
 #include "tools_internal.h"
@@ -288,6 +289,12 @@ int cst_tool_write_file(const char *workspace_root, const ctl_tool_call_t *call,
 
 int cst_tool_run_shell(const char *workspace_root, const ctl_tool_call_t *call,
                        cst_tool_result_t *r) {
+  return cst_tool_run_shell_ex(workspace_root, call, r, 0);
+}
+
+int cst_tool_run_shell_ex(const char *workspace_root,
+                          const ctl_tool_call_t *call, cst_tool_result_t *r,
+                          int sandboxed) {
   const char *cmd = tool_arg(call, "cmd");
   if (!cmd)
     cmd = tool_arg(call, "command");
@@ -299,7 +306,10 @@ int cst_tool_run_shell(const char *workspace_root, const ctl_tool_call_t *call,
     return tool_set_result(r, "error: bad workspace", 1);
 
   os_run_result_t rr = {0};
-  if (os_run_shell_c(root_real, cmd, SHELL_OUT_MAX, &rr) != 0) {
+  int rc = sandboxed
+               ? cst_sandbox_run_shell(root_real, cmd, SHELL_OUT_MAX, &rr)
+               : os_run_shell_c(root_real, cmd, SHELL_OUT_MAX, &rr);
+  if (rc != 0) {
     os_run_result_free(&rr);
     return tool_set_result(r, "error: shell exec failed", 1);
   }