v0.7.8: WebUI (--web): HTTP/1.1 + SSE front end, engine API v1, tests

A second implementation of cst_agent_hooks_t next to the TUI: the turn runs on
a worker thread, the hooks publish events into a ring buffer that SSE clients
read, so the engine itself needs no changes.

- src/net.c, include/cst_net.h: POSIX/Winsock sockets, non-blocking connect
- src/http_srv.c, include/cst_http.h: HTTP/1.1, keep-alive, chunked streaming,
  body caps (413), Expect: 100-continue, connection cap, exact routing
- src/web_md.c, include/cst_web_md.h: streaming markdown -> sanitized HTML
  (tag/attribute allowlist, javascript: URLs and off-site images dropped)
- src/webui.c, include/cst_webui.h: event ring + SSE broadcast, all routes,
  token (Bearer/Cookie/query) and loopback Host checks, 3 s auto-deny when no
  client is attached
- src/webui_stub.c, CST_WEBUI=0 / CST_BUILD_WEBUI=OFF: build without the WebUI
- web/: no-build front end (transcript, approvals, todo, sessions, image
  upload, status bar)
- docs/webui.md: engine API v1 - events, requests, security model
- tests/test_webui.c, scripts/e2e_webui.sh: unit tests plus an end-to-end run
  driven by a recorded SSE stream (no API key needed)
- src/main.c: --web --web-port --web-host --web-token --web-dev --web-open
  and CST_WEB_PORT/HOST/TOKEN/ROOT

An empty POST body is now accepted without Content-Length (RFC 9112 6.3) so
curl-driven clients can reach cancel/undo/compact/quit; CMakeList's core tests
learned about sashidown and test_webui, and CST_WEBUI=0 defines CST_NO_WEBUI.

include/cst_http.h

@@ -0,0 +1,105 @@
+#ifndef CST_HTTP_H
+#define CST_HTTP_H
+
+/* A small HTTP/1.1 server for the built-in WebUI (src/http_srv.c).
+ *
+ * Only what a local single-page app needs: exact-match routes, keep-alive,
+ * fixed-length bodies and chunked streaming responses (SSE). No TLS, no
+ * HTTP/2, no chunked *request* bodies, no CGI. Every connection is served
+ * by its own thread; a handler may keep the connection as long as it wants
+ * (that is how the event stream works). */
+
+#include "cst_net.h"
+
+#include <stddef.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+typedef struct cst_http_conn cst_http_conn_t;
+
+typedef struct {
+  char method[8];  /* GET / POST / DELETE ... */
+  char path[1024]; /* percent-decoded, without the query string */
+  char query[1024]; /* raw, without '?' */
+  const char *body; /* NUL-terminated; may hold binary bytes */
+  size_t body_len;
+  /* Headers of interest, NULL when absent (pointers into the request). */
+  const char *authorization;
+  const char *cookie;
+  const char *origin;
+  const char *host;
+  const char *content_type;
+  const char *user_agent;
+  int keep_alive;
+} cst_http_req_t;
+
+/* 0 = handled (a response was sent), -1 = not found (the server replies). */
+typedef int (*cst_http_fn)(cst_http_conn_t *c, void *ud);
+
+typedef struct {
+  const char *method; /* "*" matches any */
+  const char *path;   /* exact; "*" = fallback (try last) */
+  cst_http_fn fn;
+  void *ud;
+  int auth;         /* ask the auth hook before the handler */
+  size_t max_body;  /* request body cap; 0 = server default */
+} cst_http_route_t;
+
+typedef struct {
+  const char *host; /* NULL/"" = 127.0.0.1 */
+  int port;         /* 0 = pick a free port */
+  size_t max_body;  /* default 1 MiB */
+  int max_conn;     /* default 32 */
+  int read_timeout_ms; /* waiting for the request headers (default 15000) */
+  int idle_timeout_ms; /* keep-alive pause between requests (default 60000) */
+  const cst_http_route_t *routes;
+  int nroutes;
+  /* 0 = allow, -1 = the server answers 401 before the handler runs. */
+  int (*auth)(const cst_http_req_t *req, void *ud);
+  void *auth_ud;
+  /* One line per request, e.g. "GET /api/state -> 200". */
+  void (*on_log)(const char *line, void *ud);
+  void *log_ud;
+} cst_http_opts_t;
+
+typedef struct cst_http_server cst_http_server_t;
+
+/* Start listening. NULL on failure with a reason in err. */
+cst_http_server_t *cst_http_start(const cst_http_opts_t *o, char *err,
+                                  size_t err_sz);
+int cst_http_port(const cst_http_server_t *s);
+/* Non-zero once stop() was called: long-lived handlers must return. */
+int cst_http_stopping(const cst_http_server_t *s);
+/* Close the listener and every connection, then wait for the threads. */
+void cst_http_stop(cst_http_server_t *s);
+void cst_http_free(cst_http_server_t *s);
+
+/* --- inside a handler --- */
+const cst_http_req_t *cst_http_request(cst_http_conn_t *c);
+int cst_http_send(cst_http_conn_t *c, int status, const char *ctype,
+                  const void *body, size_t n);
+int cst_http_send_str(cst_http_conn_t *c, int status, const char *ctype,
+                      const char *s);
+/* json may be NULL (then "null" is sent); it is copied, not owned. */
+int cst_http_send_json(cst_http_conn_t *c, int status, const char *json);
+/* {"error":"..."} */
+int cst_http_send_err(cst_http_conn_t *c, int status, const char *msg);
+/* True once a response (or stream) began for this request. */
+int cst_http_sent(const cst_http_conn_t *c);
+
+/* Chunked response: begin(), any number of write()s, end(). */
+int cst_http_stream_begin(cst_http_conn_t *c, const char *ctype);
+int cst_http_stream_write(cst_http_conn_t *c, const void *data, size_t n);
+int cst_http_stream_end(cst_http_conn_t *c);
+
+/* Query parameter, percent-decoded ('+' = space). 0 when found. */
+int cst_http_query(const cst_http_req_t *req, const char *key, char *out,
+                   size_t out_sz);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* CST_HTTP_H */

include/cst_net.h

@@ -0,0 +1,68 @@
+#ifndef CST_NET_H
+#define CST_NET_H
+
+/* Minimal TCP sockets for the embedded HTTP server (src/net.c).
+ *
+ * The point of this layer is that src/http_srv.c and src/webui.c never
+ * include a socket header: Unix file descriptors and Windows SOCKETs differ
+ * in type, close() and error reporting, and Windows needs WSAStartup before
+ * anything works. */
+
+#include <stddef.h>
+#include <stdint.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#ifdef _WIN32
+typedef intptr_t os_socket_t;
+#define OS_SOCKET_BAD ((os_socket_t)-1)
+#else
+typedef int os_socket_t;
+#define OS_SOCKET_BAD (-1)
+#endif
+
+/* Longest "address:port" os_net_peer writes (IPv6 hosts are bracketed so a
+ * URL built from it stays unambiguous). */
+#define OS_NET_ADDR_MAX 64
+
+/* Winsock startup (no-op on Unix, which also ignores SIGPIPE so a client
+ * that hangs up cannot kill the process). 0 / -1. */
+int os_net_init(void);
+void os_net_cleanup(void);
+
+/* Bind and listen on host:port. host may be NULL/"" (then "127.0.0.1"),
+ * "0.0.0.0"/"::" (every interface) or any literal address / name; port 0
+ * picks a free one. Returns the listening socket, or OS_SOCKET_BAD with a
+ * short reason in err. */
+os_socket_t os_net_listen(const char *host, int port, char *err, size_t err_sz);
+/* The port actually bound (0 when unknown). */
+int os_net_port(os_socket_t s);
+/* A one-line "host:port" for messages. */
+void os_net_peer(os_socket_t s, char *out, size_t out_sz);
+
+/* Connect to host:port, waiting up to timeout_ms: the socket, or
+ * OS_SOCKET_BAD. Used by the tests and by anything that drives the WebUI
+ * API from inside the process. */
+os_socket_t os_net_connect(const char *host, int port, int timeout_ms);
+
+/* Accept one connection, waiting up to timeout_ms (<0 = forever).
+ * Returns the socket, OS_SOCKET_BAD on error, or OS_SOCKET_BAD with
+ * *timed_out set when the wait ran out. */
+os_socket_t os_net_accept(os_socket_t s, int timeout_ms, int *timed_out);
+
+/* Read at most n bytes, waiting up to timeout_ms: bytes read, 0 at EOF,
+ * -1 on error, -2 when nothing arrived in time. */
+long os_net_recv(os_socket_t s, void *buf, size_t n, int timeout_ms);
+/* Write everything (timeout_ms per call): 0 / -1. */
+int os_net_send_all(os_socket_t s, const void *buf, size_t n, int timeout_ms);
+/* Wake up a thread blocked in recv/send on this socket (shutdown, no close). */
+void os_net_shutdown(os_socket_t s);
+void os_net_close(os_socket_t s);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* CST_NET_H */

include/cst_version.h

@@ -3,7 +3,7 @@
 
 #define CST_VERSION_MAJOR 0
 #define CST_VERSION_MINOR 7
-#define CST_VERSION_PATCH 5
+#define CST_VERSION_PATCH 8
 
 #define CST_VERSION_STR_(x) #x
 #define CST_VERSION_STR(x) CST_VERSION_STR_(x)

include/cst_web_md.h

@@ -0,0 +1,48 @@
+#ifndef CST_WEB_MD_H
+#define CST_WEB_MD_H
+
+/* Markdown for the WebUI: the same sashidown renderer the TUI uses, but
+ * HTML output with a strict allowlist.
+ *
+ * sashidown renders straight to HTML and escapes text, quotes and '&', so
+ * no raw markup can reach the browser. Two holes remain, and both matter
+ * because every byte rendered here comes from a model or a tool: a link's
+ * href keeps any scheme ("javascript:") and an image's src may point
+ * anywhere (a tracking pixel, or worse). cst_web_md_* therefore rewrites
+ * tags instead of passing them through: unknown tags are dropped, hrefs
+ * are limited to http/https/mailto/relative, and images to the session's
+ * own attachment endpoint.
+ *
+ * The streaming form renders confirmed HTML as the model talks, which is
+ * the CST property the project is built on: nothing is emitted before it
+ * is safe to emit. A tag split across two deltas is held back until its
+ * '>' arrives. */
+
+#include <stddef.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/* Called with chunks of sanitized HTML; return non-zero to stop. */
+typedef int (*cst_web_md_emit_fn)(const char *html, size_t len, void *ud);
+
+typedef struct cst_web_md cst_web_md_t;
+
+cst_web_md_t *cst_web_md_new(cst_web_md_emit_fn emit, void *ud);
+/* Feed model output. Returns 0, or -1 on OOM. */
+int cst_web_md_feed(cst_web_md_t *s, const char *data, size_t len);
+/* Flush the pending input and close the renderer. */
+int cst_web_md_finish(cst_web_md_t *s);
+void cst_web_md_free(cst_web_md_t *s);
+
+/* One-shot: markdown -> sanitized HTML (malloc'd, never NULL on success). */
+char *cst_web_md_html(const char *md, size_t len);
+/* The sanitizer alone (tests, and any HTML that did not come from here). */
+char *cst_web_md_sanitize(const char *html, size_t len);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* CST_WEB_MD_H */

include/cst_webui.h

@@ -0,0 +1,40 @@
+#ifndef CST_WEBUI_H
+#define CST_WEBUI_H
+
+/* The built-in WebUI: an HTTP + SSE front end for one agent process.
+ *
+ * It is a second implementation of the same interface the TUI uses
+ * (cst_agent_hooks_t), which is why the engine needs no changes: the turn
+ * runs on a worker thread and every live event goes out as a Server-Sent
+ * Event. The protocol is documented in docs/webui.md and is meant to be
+ * the contract a dedicated client speaks later.  */
+
+#include "cst_agent.h"
+
+#include <stddef.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+typedef struct {
+  const char *host;  /* NULL = 127.0.0.1; "0.0.0.0" = every interface */
+  int port;          /* 0 = pick a free port */
+  const char *token; /* NULL = generate one when needed */
+  const char *root;  /* serve the UI from this directory instead of the
+                        copy embedded in the binary (development) */
+  int open_browser;  /* best-effort xdg-open / open / start */
+  /* Prompt to run once at startup (--web -p ...); NULL = wait for the UI. */
+  const char *prompt;
+  int perm_timeout_s; /* how long a permission question waits (0 = 600) */
+} cst_webui_opts_t;
+
+/* Serve until interrupted (Ctrl+C) or the event stream asks to quit.
+ * Returns the process exit code. */
+int cst_webui_run(cst_agent_t *agent, const cst_webui_opts_t *opts);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* CST_WEBUI_H */