Extensions: skills, plugins, MCP, sub-agents; configurable keys

- Skills (SKILL.md discovery, skill tool, /skills /skill)
- plugin.json exec tools with permission prompts, timeouts and workspace trust (/plugins)
- MCP stdio client: JSON-RPC initialize/tools/list/tools/call, mcp__server__tool, /mcp and sidebar status
- task tool with general/explore/plan and .agent/agents/*.md roles, parallel read-only runs, cancel propagation, /agents
- Keymap with Ctrl+X leader, keybinds.json overrides and /keys panel
- Collapsed thinking, throttled streaming Markdown, leaner tool output, parallel read-only tools
- Spawn: close-on-exec pipes and a process-wide fork lock
- Tests for keymap, skills, plugins, MCP, sub-agents, shell compaction; docs/plugins.md

include/cst_agent.h

@@ -76,7 +76,14 @@ typedef struct {
   int approval;       /* cst_approval_t (interactive sessions) */
   int plan_mode;      /* read-only tools + planning note */
   int tool_profile;   /* cst_tool_profile_t (CST_TOOLS) */
-  unsigned long long tools_off; /* bit i = registry tool i disabled */
+  char tools_off[1024]; /* ",name,name," tools switched off (/tools off) */
+  /* Sub-agents (task tool). */
+  int depth;              /* 0 = top-level; sub-agents run at 1 */
+  int read_only;          /* no write / shell tools */
+  char tools_only[1024];  /* ",a,b," allowlist; empty = every tool */
+  const char *role_prompt; /* role instructions (not owned) */
+  char undo_sid[128];     /* snapshot into this session's undo... */
+  char undo_tag[64];      /* ...under this turn tag (the parent's) */
 } cst_agent_config_t;
 
 /* ask: confirm per tool; auto: sandbox/rules decide, ask on doubt; yolo: never
@@ -299,6 +306,9 @@ int cst_agent_undo_available(const cst_agent_t *a);
 struct cst_perms *cst_agent_perms(cst_agent_t *a);
 /* /retry: remove the last user prompt and its replies; caller frees. */
 char *cst_agent_rewind_last_turn(cst_agent_t *a);
+/* Session id and turn tag that /undo snapshots of the running turn use. */
+void cst_agent_undo_key(const cst_agent_t *a, char *sid, size_t sid_sz,
+                        char *tag, size_t tag_sz);
 /* Last prompt_tokens reported by the model (0 if unknown). */
 long cst_agent_last_prompt_tokens(const cst_agent_t *a);
 
@@ -323,10 +333,15 @@ int cst_creds_prompt_console(const char *provider, char *out, size_t out_sz);
 /* Last used provider, model per provider and effort, in
  * <config>/settings.json. */
 #define CST_SETTINGS_MAX_MODELS 16
+#define CST_SETTINGS_MAX_TRUSTED 32
 typedef struct {
   char provider[32];
   char effort[16];
   char approval[8]; /* "" = not chosen yet */
+  int show_thinking; /* TUI: Thought blocks start expanded */
+  /* workspaces whose .agent/plugins and .agent/mcp.json may run */
+  int ntrusted;
+  char trusted[CST_SETTINGS_MAX_TRUSTED][512];
   int nmodels;
   struct {
     char provider[32];
@@ -340,6 +355,10 @@ const char *cst_settings_model(const cst_settings_t *s, const char *provider);
 int cst_settings_remember(const cst_agent_config_t *cfg);
 /* Record an approval mode the user picked (CST_APPROVAL_*). */
 int cst_settings_remember_approval(int approval);
+int cst_settings_remember_thinking(int show_thinking);
+/* Workspace trust for project plugins / MCP servers (by real path). */
+int cst_settings_trusted(const char *workspace);
+int cst_settings_trust(const char *workspace, int on);
 
 /* JSON baseline parser for experiments (buffer until valid object). */
 typedef struct {