OpenCode-style TUI, model probing, sandboxed auto approval

- TUI: centered home screen with logo, boxed input with mode line, sidebar
  (>=120 cols), Ctrl+P palette, Tab Build/Plan, Shift+Tab approval cycle,
  mouse (cards, cursor, pickers, wheel), /sidebar /mouse /approval
- /models probing: key check on entry (401 re-asks), API models in /model
- Shell sandbox in C: Linux Landlock (writes limited to workspace/tmp,
  ABI>=4 blocks TCP), macOS sandbox_init, rules fallback elsewhere
- Approval modes ask/auto/yolo (default auto); read-only command whitelist;
  ask to rerun outside the sandbox when a command looks blocked
- Upgradable bootstrap scripts (git pull --ff-only, rebuild, reinstall) and
  cst-agent-update; cst-agent --version
- tests: test_sandbox, test_models

include/cst_agent.h

@@ -73,10 +73,23 @@ typedef struct {
   int confirm_write;  /* confirm file-changing tools */
   int confirm_net;    /* confirm web_fetch */
   int auto_approve;   /* headless / CST_AUTO_APPROVE=1 / --yolo */
+  int approval;       /* cst_approval_t (interactive sessions) */
+  int plan_mode;      /* read-only tools + planning note */
   int tool_profile;   /* cst_tool_profile_t (CST_TOOLS) */
   unsigned long long tools_off; /* bit i = registry tool i disabled */
 } cst_agent_config_t;
 
+/* ask: confirm per tool; auto: sandbox/rules decide, ask on doubt; yolo: never
+ * ask (same as auto_approve). */
+typedef enum {
+  CST_APPROVAL_ASK = 0,
+  CST_APPROVAL_AUTO,
+  CST_APPROVAL_YOLO
+} cst_approval_t;
+#define CST_DEFAULT_APPROVAL CST_APPROVAL_AUTO
+const char *cst_approval_name(int a);
+int cst_approval_parse(const char *s, int *out);
+
 typedef struct cst_session cst_session_t;
 typedef struct cst_agent cst_agent_t;
 
@@ -143,6 +156,10 @@ int cst_tool_read_file(const char *workspace_root, const ctl_tool_call_t *call,
                        cst_tool_result_t *r);
 int cst_tool_run_shell(const char *workspace_root, const ctl_tool_call_t *call,
                        cst_tool_result_t *r);
+/* sandboxed: confine the command with the OS sandbox (cst_sandbox.h). */
+int cst_tool_run_shell_ex(const char *workspace_root,
+                          const ctl_tool_call_t *call, cst_tool_result_t *r,
+                          int sandboxed);
 int cst_tool_apply_patch(const char *workspace_root, const ctl_tool_call_t *call,
                          cst_tool_result_t *r);
 int cst_tool_write_file(const char *workspace_root, const ctl_tool_call_t *call,
@@ -206,6 +223,14 @@ typedef struct {
 } cst_llm_request_t;
 
 int cst_llm_chat_stream(const cst_llm_request_t *req, char *err, size_t err_sz);
+
+/* GET {api_base}/models (10 s timeout). Returns the number of model ids
+ * written, CST_MODELS_AUTH when the key is rejected (401/403), or -1 on
+ * network / format errors. */
+#define CST_MODELS_AUTH (-2)
+int cst_llm_list_models(const char *api_base, const char *api_key,
+                        char out[][128], int max_out, char *err,
+                        size_t err_sz);
 /* JSON request body (malloc'd) exactly as sent on the wire. */
 char *cst_llm_build_body(const cst_llm_request_t *req);
 /* Reset the CST_RECORD_SSE / CST_REPLAY_SSE sequence counter. */
@@ -216,6 +241,10 @@ void cst_llm_trace_reset(void);
 #define CST_PERM_ONCE 1
 #define CST_PERM_ALWAYS_TOOL 2   /* saved to .agent/permissions.json */
 #define CST_PERM_ALWAYS_PREFIX 3 /* run_shell: allow this command prefix */
+/* on_permission detail prefix when a sandboxed run_shell looked blocked and
+ * the question is whether to rerun it outside the sandbox. The rest of the
+ * detail is the tail of the sandboxed output. */
+#define CST_PERM_SANDBOX "[sandbox] "
 
 /* Live UI / observability hooks for a turn */
 typedef struct {
@@ -297,6 +326,7 @@ int cst_creds_prompt_console(const char *provider, char *out, size_t out_sz);
 typedef struct {
   char provider[32];
   char effort[16];
+  char approval[8]; /* "" = not chosen yet */
   int nmodels;
   struct {
     char provider[32];
@@ -308,6 +338,8 @@ int cst_settings_save(const cst_settings_t *s);
 const char *cst_settings_model(const cst_settings_t *s, const char *provider);
 /* Record cfg's provider, model and effort as the last used ones. */
 int cst_settings_remember(const cst_agent_config_t *cfg);
+/* Record an approval mode the user picked (CST_APPROVAL_*). */
+int cst_settings_remember_approval(int approval);
 
 /* JSON baseline parser for experiments (buffer until valid object). */
 typedef struct {

include/cst_perms.h

@@ -23,6 +23,9 @@ int cst_perms_reset(cst_perms_t *p);
 char *cst_perms_describe(const cst_perms_t *p);
 /* Reasonable prefix rule for a command ("" when it should not have one). */
 void cst_perms_suggest_prefix(const char *cmd, char *out, size_t out_sz);
+/* 1 when every segment of cmd (split on | || && ;) is a read-only command
+ * from a fixed whitelist, with no output redirection or substitution. */
+int cst_shell_is_safe(const char *cmd);
 
 #ifdef __cplusplus
 }

include/cst_sandbox.h

@@ -0,0 +1,60 @@
+#ifndef CST_SANDBOX_H
+#define CST_SANDBOX_H
+
+/*
+ * OS sandbox for run_shell: reads and exec stay allowed everywhere, writes
+ * are limited to the workspace, the temp dir, /dev/null and /dev/tty, and
+ * the network is cut where the OS can do it.
+ *   Linux   Landlock (network needs ABI 4, kernel 6.7+)
+ *   macOS   sandbox_init (Seatbelt profile)
+ *   other   none: callers fall back to rule-based approval
+ */
+
+#include "os_compat.h"
+
+#include <stddef.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+typedef enum {
+  CST_SANDBOX_NONE = 0,
+  CST_SANDBOX_LANDLOCK,
+  CST_SANDBOX_SEATBELT
+} cst_sandbox_kind_t;
+
+/* What this process can use; cached. CST_SANDBOX=0 forces NONE. */
+int cst_sandbox_probe(void);
+const char *cst_sandbox_name(int kind); /* "landlock" | "seatbelt" | "none" */
+/* Landlock ABI version (0 when unavailable); ≥4 also blocks TCP. */
+int cst_sandbox_landlock_abi(void);
+
+typedef struct {
+  int kind;
+  int ruleset_fd; /* Landlock, built in the parent */
+  char *profile;  /* Seatbelt */
+} cst_sandbox_plan_t;
+
+/* Parent side: build the policy. Returns 0, or -1 (plan->kind = NONE). */
+int cst_sandbox_prepare(const char *workspace, const char *tmpdir,
+                        cst_sandbox_plan_t *plan);
+/* Child side, after fork and before exec (os_run_capture_ex hook):
+ * async-signal-safe for Landlock. Returns 0 when confined. */
+int cst_sandbox_enter(void *plan);
+void cst_sandbox_release(cst_sandbox_plan_t *plan);
+
+/* `sh -c cmd` confined to workspace (+ temp dir). Fails closed: if the
+ * policy cannot be applied the command does not run (exit 126). */
+int cst_sandbox_run_shell(const char *workspace, const char *cmd,
+                          size_t max_out, os_run_result_t *r);
+
+/* Output of a failed sandboxed run that looks like the sandbox got in the
+ * way (EACCES / EPERM / EROFS / blocked network). */
+int cst_sandbox_blocked(const char *out, size_t n, int exit_code);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif

include/cst_tools.h

@@ -40,6 +40,7 @@ typedef struct cst_tool_ctx {
   /* todo_write: the list was replaced (text form, one item per line). */
   void (*set_todo)(const char *text, void *ud);
   void *todo_ud;
+  int sandbox; /* run_shell: confine to the workspace (cst_sandbox.h) */
 } cst_tool_ctx_t;
 
 typedef int (*cst_tool_run_fn)(const cst_tool_ctx_t *ctx,

include/cst_version.h

@@ -0,0 +1,6 @@
+#ifndef CST_VERSION_H
+#define CST_VERSION_H
+
+#define CST_VERSION "0.4.0"
+
+#endif

include/os_compat.h

@@ -57,6 +57,16 @@ int os_run_capture(const char *cwd, const char *const argv[], size_t max_out,
 int os_run_shell_c(const char *cwd, const char *cmd, size_t max_out,
                    os_run_result_t *r);
 
+/* Same, with child_hook(ud) run in the child just before exec (Unix only;
+ * ignored on Windows). A non-zero return aborts the child with exit 126. */
+typedef int (*os_child_hook_fn)(void *ud);
+int os_run_capture_ex(const char *cwd, const char *const argv[],
+                      size_t max_out, os_run_result_t *r,
+                      os_child_hook_fn child_hook, void *ud);
+int os_run_shell_ex(const char *cwd, const char *cmd, size_t max_out,
+                    os_run_result_t *r, os_child_hook_fn child_hook,
+                    void *ud);
+
 /* Child processes get stdin=/dev/null, their own process group, and are
  * killed after the timeout (CST_SHELL_TIMEOUT seconds, default 120) or when
  * *flag becomes non-zero. Exit code 124 = timeout, 130 = cancelled. */