OpenCode-style TUI, model probing, sandboxed auto approval

- TUI: centered home screen with logo, boxed input with mode line, sidebar
  (>=120 cols), Ctrl+P palette, Tab Build/Plan, Shift+Tab approval cycle,
  mouse (cards, cursor, pickers, wheel), /sidebar /mouse /approval
- /models probing: key check on entry (401 re-asks), API models in /model
- Shell sandbox in C: Linux Landlock (writes limited to workspace/tmp,
  ABI>=4 blocks TCP), macOS sandbox_init, rules fallback elsewhere
- Approval modes ask/auto/yolo (default auto); read-only command whitelist;
  ask to rerun outside the sandbox when a command looks blocked
- Upgradable bootstrap scripts (git pull --ff-only, rebuild, reinstall) and
  cst-agent-update; cst-agent --version
- tests: test_sandbox, test_models

tests/test_models.c

@@ -0,0 +1,130 @@
+#ifndef _DEFAULT_SOURCE
+#define _DEFAULT_SOURCE
+#endif
+
+#include "cst_agent.h"
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#ifdef _WIN32
+int main(void) {
+  puts("test_models: skipped on Windows");
+  return 0;
+}
+#else
+
+#include <arpa/inet.h>
+#include <netinet/in.h>
+#include <pthread.h>
+#include <sys/socket.h>
+#include <unistd.h>
+
+#define CHECK(c)                                                               \
+  do {                                                                         \
+    if (!(c)) {                                                                \
+      fprintf(stderr, "%s:%d: CHECK(%s) failed\n", __FILE__, __LINE__, #c);   \
+      exit(1);                                                                 \
+    }                                                                          \
+  } while (0)
+
+/* One canned HTTP response per accepted connection. */
+static const char *g_responses[8];
+static int g_nresp;
+static int g_listen = -1;
+static char g_request[4096];
+
+static void *serve(void *arg) {
+  (void)arg;
+  for (int i = 0; i < g_nresp; i++) {
+    int c = accept(g_listen, NULL, NULL);
+    if (c < 0)
+      return NULL;
+    ssize_t n = recv(c, g_request, sizeof(g_request) - 1, 0);
+    g_request[n > 0 ? n : 0] = 0;
+    const char *r = g_responses[i];
+    ssize_t off = 0, len = (ssize_t)strlen(r);
+    while (off < len) {
+      ssize_t w = send(c, r + off, (size_t)(len - off), 0);
+      if (w <= 0)
+        break;
+      off += w;
+    }
+    close(c);
+  }
+  return NULL;
+}
+
+static int start_server(void) {
+  g_listen = socket(AF_INET, SOCK_STREAM, 0);
+  CHECK(g_listen >= 0);
+  int one = 1;
+  setsockopt(g_listen, SOL_SOCKET, SO_REUSEADDR, &one, sizeof(one));
+  struct sockaddr_in a;
+  memset(&a, 0, sizeof(a));
+  a.sin_family = AF_INET;
+  a.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
+  CHECK(bind(g_listen, (struct sockaddr *)&a, sizeof(a)) == 0);
+  CHECK(listen(g_listen, 8) == 0);
+  socklen_t al = sizeof(a);
+  CHECK(getsockname(g_listen, (struct sockaddr *)&a, &al) == 0);
+  return ntohs(a.sin_port);
+}
+
+#define RESP(status, body)                                                     \
+  "HTTP/1.1 " status "\r\nContent-Type: application/json\r\n"                  \
+  "Connection: close\r\n\r\n" body
+
+int main(void) {
+  g_responses[0] = RESP("200 OK", "{\"object\":\"list\",\"data\":["
+                                  "{\"id\":\"deepseek-flash\"},"
+                                  "{\"id\":\"deepseek-v4-pro\"},"
+                                  "{\"id\":\"deepseek-flash\"}]}");
+  g_responses[1] = RESP("401 Unauthorized", "{\"error\":\"bad key\"}");
+  g_responses[2] = RESP("200 OK", "<html>not json</html>");
+  g_responses[3] = RESP("200 OK", "{\"models\":[{\"name\":\"m1\"},"
+                                  "{\"name\":\"m2\"}]}");
+  g_responses[4] = RESP("500 Internal Server Error", "{}");
+  g_nresp = 5;
+  int port = start_server();
+  pthread_t th;
+  CHECK(pthread_create(&th, NULL, serve, NULL) == 0);
+
+  char base[64];
+  snprintf(base, sizeof(base), "http://127.0.0.1:%d/v1/", port);
+  char ids[8][128], err[256];
+
+  /* data[].id, duplicates folded, trailing slash on the base */
+  int n = cst_llm_list_models(base, "sk-test", ids, 8, err, sizeof(err));
+  CHECK(n == 2);
+  CHECK(strcmp(ids[0], "deepseek-flash") == 0);
+  CHECK(strcmp(ids[1], "deepseek-v4-pro") == 0);
+  CHECK(strncmp(g_request, "GET /v1/models ", 15) == 0);
+  CHECK(strstr(g_request, "Authorization: Bearer sk-test") != NULL);
+
+  n = cst_llm_list_models(base, "sk-bad", ids, 8, err, sizeof(err));
+  CHECK(n == CST_MODELS_AUTH);
+  CHECK(strstr(err, "401") != NULL);
+
+  n = cst_llm_list_models(base, "sk-test", ids, 8, err, sizeof(err));
+  CHECK(n == -1);
+  CHECK(err[0]);
+
+  n = cst_llm_list_models(base, "sk-test", ids, 8, err, sizeof(err));
+  CHECK(n == 2 && strcmp(ids[1], "m2") == 0);
+
+  n = cst_llm_list_models(base, "sk-test", ids, 8, err, sizeof(err));
+  CHECK(n == -1 && strstr(err, "500") != NULL);
+
+  pthread_join(th, NULL);
+  close(g_listen);
+
+  /* nothing listening: network error, not an auth failure */
+  n = cst_llm_list_models(base, "sk-test", ids, 8, err, sizeof(err));
+  CHECK(n == -1);
+
+  puts("test_models: ok");
+  return 0;
+}
+#endif

tests/test_sandbox.c

@@ -0,0 +1,200 @@
+#ifndef _GNU_SOURCE
+#define _GNU_SOURCE
+#endif
+
+#include "cst_perms.h"
+#include "cst_sandbox.h"
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#define CHECK(c)                                                               \
+  do {                                                                         \
+    if (!(c)) {                                                                \
+      fprintf(stderr, "%s:%d: CHECK(%s) failed\n", __FILE__, __LINE__, #c);   \
+      exit(1);                                                                 \
+    }                                                                          \
+  } while (0)
+
+static void test_rules(void) {
+  static const char *const SAFE[] = {
+      "ls -la",
+      "cat README.md | head -n 20",
+      "git status && git diff --stat",
+      "grep -rn TODO src || true",
+      "find . -name '*.c' | wc -l",
+      "rg foo src 2>&1 | head",
+      "echo hi >/dev/null",
+      "pwd; which cc",
+      "git log --oneline -5",
+      "tree -L 2",
+  };
+  static const char *const UNSAFE[] = {
+      "rm -rf build",
+      "echo hi > out.txt",
+      "cat a >> b",
+      "ls $(pwd)",
+      "ls `pwd`",
+      "diff <(ls a) <(ls b)",
+      "sudo ls",
+      "find . -name x -delete",
+      "find . -exec rm {} ;",
+      "git push",
+      "git commit -m x",
+      "make",
+      "curl https://example.com",
+      "ls && rm x",
+      "echo ok | sh",
+      "",
+      "tee out.txt",
+      "git branch -D main",
+  };
+  for (size_t i = 0; i < sizeof(SAFE) / sizeof(SAFE[0]); i++) {
+    if (!cst_shell_is_safe(SAFE[i]))
+      fprintf(stderr, "expected safe: %s\n", SAFE[i]);
+    CHECK(cst_shell_is_safe(SAFE[i]));
+  }
+  for (size_t i = 0; i < sizeof(UNSAFE) / sizeof(UNSAFE[0]); i++) {
+    if (cst_shell_is_safe(UNSAFE[i]))
+      fprintf(stderr, "expected unsafe: %s\n", UNSAFE[i]);
+    CHECK(!cst_shell_is_safe(UNSAFE[i]));
+  }
+}
+
+static void test_blocked(void) {
+  const char *a = "sh: 1: cannot create /etc/x: Permission denied\n";
+  CHECK(cst_sandbox_blocked(a, strlen(a), 2));
+  CHECK(!cst_sandbox_blocked(a, strlen(a), 0));
+  const char *b = "error: no such file\n";
+  CHECK(!cst_sandbox_blocked(b, strlen(b), 1));
+  const char *c = "touch: cannot touch 'x': Read-only file system\n";
+  CHECK(cst_sandbox_blocked(c, strlen(c), 1));
+}
+
+#if !defined(_WIN32)
+#include <arpa/inet.h>
+#include <errno.h>
+#include <netinet/in.h>
+#include <sys/socket.h>
+#include <sys/stat.h>
+#include <sys/wait.h>
+#include <unistd.h>
+
+static int exists(const char *p) {
+  struct stat st;
+  return stat(p, &st) == 0;
+}
+
+static int run(const char *ws, const char *cmd, os_run_result_t *r) {
+  memset(r, 0, sizeof(*r));
+  CHECK(cst_sandbox_run_shell(ws, cmd, 0, r) == 0);
+  return r->exit_code;
+}
+
+/* Child: enter the sandbox, then try a TCP connect to a local listener. */
+static void test_network(const char *ws) {
+  int ls = socket(AF_INET, SOCK_STREAM, 0);
+  CHECK(ls >= 0);
+  struct sockaddr_in a;
+  memset(&a, 0, sizeof(a));
+  a.sin_family = AF_INET;
+  a.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
+  CHECK(bind(ls, (struct sockaddr *)&a, sizeof(a)) == 0);
+  CHECK(listen(ls, 1) == 0);
+  socklen_t al = sizeof(a);
+  CHECK(getsockname(ls, (struct sockaddr *)&a, &al) == 0);
+
+  cst_sandbox_plan_t plan;
+  CHECK(cst_sandbox_prepare(ws, NULL, &plan) == 0);
+  pid_t pid = fork();
+  CHECK(pid >= 0);
+  if (pid == 0) {
+    if (cst_sandbox_enter(&plan) != 0)
+      _exit(3);
+    int s = socket(AF_INET, SOCK_STREAM, 0);
+    int rc = connect(s, (struct sockaddr *)&a, sizeof(a));
+    _exit(rc == 0 ? 1 : errno == EACCES ? 0 : 2);
+  }
+  int st = 0;
+  waitpid(pid, &st, 0);
+  cst_sandbox_release(&plan);
+  close(ls);
+  CHECK(WIFEXITED(st) && WEXITSTATUS(st) == 0);
+}
+
+static void test_landlock(void) {
+  char cwd[OS_PATH_MAX], ws[OS_PATH_MAX + 32], out[OS_PATH_MAX + 32];
+  char cmd[3 * OS_PATH_MAX];
+  CHECK(getcwd(cwd, sizeof(cwd)) != NULL);
+  /* Both live in the build tree, outside TMPDIR, so "outside" is denied. */
+  snprintf(ws, sizeof(ws), "%s/tests/sbx_ws_XXXXXX", cwd);
+  snprintf(out, sizeof(out), "%s/tests/sbx_out_XXXXXX", cwd);
+  CHECK(mkdtemp(ws) && mkdtemp(out));
+  char outfile[OS_PATH_MAX + 64], readme[OS_PATH_MAX + 64];
+  snprintf(outfile, sizeof(outfile), "%s/escape.txt", out);
+  snprintf(readme, sizeof(readme), "%s/readme.txt", out);
+  FILE *fp = fopen(readme, "w");
+  CHECK(fp);
+  fputs("outside-content\n", fp);
+  fclose(fp);
+
+  os_run_result_t r;
+  CHECK(run(ws, "echo hi > inside.txt && mkdir sub && echo x > sub/y && "
+                "rm sub/y && cat inside.txt",
+            &r) == 0);
+  CHECK(strstr(r.out, "hi") != NULL);
+  os_run_result_free(&r);
+
+  snprintf(cmd, sizeof(cmd), "echo nope > '%s'", outfile);
+  CHECK(run(ws, cmd, &r) != 0);
+  CHECK(!exists(outfile));
+  if (!cst_sandbox_blocked(r.out, r.out_len, r.exit_code))
+    fprintf(stderr, "unexpected output (exit %d): %s\n", r.exit_code,
+            r.out ? r.out : "");
+  CHECK(cst_sandbox_blocked(r.out, r.out_len, r.exit_code));
+  os_run_result_free(&r);
+
+  snprintf(cmd, sizeof(cmd), "cat '%s'", readme);
+  CHECK(run(ws, cmd, &r) == 0);
+  CHECK(strstr(r.out, "outside-content") != NULL);
+  os_run_result_free(&r);
+
+  CHECK(run(ws, "echo x >/dev/null && echo ok", &r) == 0);
+  os_run_result_free(&r);
+
+  char tmp[OS_PATH_MAX];
+  CHECK(os_temp_dir(tmp, sizeof(tmp)) == 0);
+  snprintf(cmd, sizeof(cmd), "f='%s/cst_sbx_%d'; echo t > \"$f\" && rm \"$f\"",
+           tmp, (int)getpid());
+  CHECK(run(ws, cmd, &r) == 0);
+  os_run_result_free(&r);
+
+  /* the parent itself stays unconfined */
+  fp = fopen(outfile, "w");
+  CHECK(fp);
+  fclose(fp);
+
+  if (cst_sandbox_landlock_abi() >= 4)
+    test_network(ws);
+  else
+    printf("test_sandbox: landlock ABI %d < 4, network rule not tested\n",
+           cst_sandbox_landlock_abi());
+
+  snprintf(cmd, sizeof(cmd), "rm -rf '%s' '%s'", ws, out);
+  CHECK(system(cmd) == 0);
+}
+#endif
+
+int main(void) {
+  test_rules();
+  test_blocked();
+  int kind = cst_sandbox_probe();
+  printf("test_sandbox: sandbox %s\n", cst_sandbox_name(kind));
+#if !defined(_WIN32)
+  if (kind == CST_SANDBOX_LANDLOCK)
+    test_landlock();
+#endif
+  puts("test_sandbox: ok");
+  return 0;
+}