v0.8.4: WebUI sessions, diff, settings, slash commands and extensions

Sessions: rename, delete and search; /api/retry regenerates the last
answer, editing a prompt resends from there; /api/export downloads the
transcript as Markdown (cst_session_export_md). Session messages carry
note/tool_result markers, so a reload rebuilds the tool steps with
their arguments, output and exit status; subagent progress is shown.

Diff and settings: /api/diff shows the real diff; /api/settings covers
protocol, max_steps, tool switches and confirm; /api/permissions edits
the rules; sandbox status is reported. Session rename no longer reads
past a short title.

Commands: slash commands with completion in the composer (/model,
/provider, /new, /retry, /undo, /compact, /export, /diff, /init,
/skill and more), a Ctrl+P palette, Shift+Tab cycles the approval
mode, F1 or ? shows the keys. "Thinking expanded" is saved in the
settings (show_thinking), "expand all tool output" in the browser.

Extensions: GET /api/extensions lists MCP servers, plugins, skills,
agent roles and subagent runs; POST /api/extensions/reload and
/api/extensions/trust; a workspace switch reloads them. /api/init and
/api/skill run on the server (cst_init_prompt shared with the TUI).

Errors, statuses and [cst] notes are shown in Chinese with a readable
reason instead of rc=; a failed turn's error survives the reload.

Tests: scripts/e2e_webui_sessions.py, e2e_webui_workspace.py and
e2e_webui_ext.py, run from e2e_webui.sh.

CMakeLists.txt

@@ -111,6 +111,7 @@ set(CST_CORE_SOURCES
   src/agent_store.c
   src/json_baseline.c
   src/creds.c
+  src/provider_switch.c
   src/mm_tool.c
   src/models.c
   src/model_registry.c

Makefile

@@ -91,7 +91,7 @@ CORE_SRC = \
 	src/agent_loop.c \
 	src/agent_store.c \
 	src/json_baseline.c \
-	src/creds.c \
+	src/creds.c src/provider_switch.c \
 	src/mm_tool.c \
 	src/models.c src/model_registry.c \
 	src/metrics.c \

README.md

@@ -212,10 +212,10 @@ Gitea Release `vVERSION`（同名资源会被替换）；仓库可设 `RELEASE_T
 | `CST_MAX_STEPS` / `--max-steps` | 每个用户回合最多调用模型几次（30） |
 | `CST_TOOL_OUT_CAP` | 单个工具输出发给模型的字节上限（16384，保留头 60% + 尾 40%） |
 | `CST_CTX_WINDOW` | 发给模型的最近非 system 消息条数（80） |
-| `CST_CTX_TOKENS` / `CST_AUTO_COMPACT=0` | 覆盖模型上下文窗口大小 / 关闭自动压缩（用到 80% 时自动 `/compact`） |
+| `CST_CTX_TOKENS` / `CST_AUTO_COMPACT=0` | 覆盖模型上下文窗口大小 / 关闭自动压缩（用到 75% 时自动 `/compact`） |
 | `CST_NO_PROJECT_NOTES=1` | 不把工作区的 `AGENTS.md` 注入 system prompt |
 | `NO_COLOR` / `CST_ASCII=1` | 关闭颜色 / 强制 ASCII 图形（非 UTF-8 终端自动退化） |
-| `CST_SHELL_TIMEOUT` | `run_shell` 超时秒数（120），超时整组进程被杀，exit=124 |
+| `CST_SHELL_TIMEOUT` | `run_shell` 超时秒数（默认不限），设了才在超时后整组杀进程，exit=124 |
 | `CST_METRICS=0` / `CST_METRICS_PATH` | 关闭 / 指定计时埋点 JSONL（默认 `.agent/metrics/<session>.jsonl`） |
 | `CST_RECORD_SSE=DIR` / `CST_REPLAY_SSE=DIR` | 录制 / 回放原始 SSE 流（`NNNN.sse` + `NNNN.req.json`） |
 | `CST_APPROVAL=ask\|auto\|yolo` / `CST_SANDBOX=off\|landlock\|seccomp` | 审批模式 / 关闭沙箱（回落到只读白名单规则）或只用指定沙箱 |
@@ -319,7 +319,7 @@ TUI 中 `/tools off NAME`、`/tools on NAME` 可临时开关单个工具。
   `sudo`、`rm`、解释器（`python3 -c …`）等危险前缀不会被建议成规则。
 - **撤销**：每轮写文件前自动快照到 `.agent/undo/`，`/undo` 恢复上一轮改动的全部文件（新建的文件会被删除）。
 - **AGENTS.md**：工作区根目录的 `AGENTS.md` 会注入 system prompt；`/init` 让 agent 自己生成一份。
-- **自动压缩**：上一轮 prompt 用到模型上下文 80% 时，下一轮开始前自动总结历史（`CST_AUTO_COMPACT=0` 关闭）。
+- **自动压缩**：上一轮 prompt 用到模型上下文 75% 时，下一轮开始前自动总结历史（`CST_AUTO_COMPACT=0` 关闭）。
 
 ### 扩展：Skills、插件、MCP、子 agent
 
@@ -408,6 +408,7 @@ Thought（推理过程）默认折叠成一行“Thought · 3.2s”，生成中
 | `/diff [path]` * | `git status` + `git diff` |
 | `/compact` | 手动压缩上下文 |
 | `/export [file]` *、`/copy` * | 导出 Markdown 记录；复制上一条回复（OSC 52，需终端支持） |
+| `/web` * | 后台起一个 WebUI 进程（同 workspace、新会话，日志写到 `.agent/webui.log`） |
 | `/init` | 让 agent 写 `AGENTS.md` |
 | `/details` *、`/thinking [on\|off]`、`/keys` * | 展开全部 tool 输出；Thought 默认展开/折叠；快捷键列表 |
 | `/skills [reload\|list]`、`/skill <name> [任务]` | 浏览 skills；带着某个 skill 开始一轮 |

docs/env_openai.md

@@ -73,7 +73,7 @@ export OPENAI_MODEL='your-model'
 | `CST_MAX_STEPS` | 每个用户回合最多调用模型几次（默认 30） |
 | `CST_TOOL_OUT_CAP` | 单个工具输出发给模型的字节上限（默认 16384） |
 | `CST_CTX_WINDOW` | 发给模型的最近非 system 消息条数（默认 80） |
-| `CST_SHELL_TIMEOUT` | `run_shell` 超时秒数（默认 120） |
+| `CST_SHELL_TIMEOUT` | `run_shell` 超时秒数（默认不限，Ctrl+C / 停止按钮仍可随时中断） |
 | `CST_METRICS=0` / `CST_METRICS_PATH` | 关闭 / 指定计时埋点 JSONL |
 | `CST_RECORD_SSE` / `CST_REPLAY_SSE` | 录制 / 回放原始 SSE 流目录；`CST_REPLAY_CHUNK` 控制回放分块字节数 |
 | `CST_MODELS` | `/model` 可选列表，`:` 或 `,` 分隔 |

docs/webui.md

@@ -47,7 +47,9 @@ webui: token 3f9a…  (append #token=3f9a… to the URL)
 
 | 场景 | 行为 |
 |---|---|
-| 默认 `127.0.0.1` | 不需要 token；`Host` 必须是 loopback（防 DNS rebinding） |
+| 默认 `127.0.0.1` | 不需要 token；`Host` 必须是 loopback（防 DNS rebinding）；带 `Origin` 的请求必须来自本页面自己（`http://<Host>`），否则 401 —— 防止任意网页跨站 POST 驱动 agent |
+| 静态资源 | 页面本身与 `app.js`/`style.css` 不需要 token；`/api/attach/<rel>` 图片仍要（页面会把 token 写进 `SameSite=Strict` cookie） |
+| 请求解析 | 鉴权与大小检查在读请求体**之前**完成；`Content-Length` 必须是纯数字且只有一个值；请求头整体 15 s 内收完 |
 | `--web-host 0.0.0.0` | 没给 `--web-token` 时自动生成随机 token 并打印；所有 `/api/*` 都要 token |
 | token 传递 | `Authorization: Bearer <t>`、`Cookie: cst_token=<t>` 或 `?token=<t>`（`EventSource` 不能设 header，所以查询参数是必需的一条路） |
 | 资源 | 只有白名单路由；路径里的 `..`/编码 NUL 一律 400；静态资源来自二进制内嵌（或 `--web-dev DIR`） |
@@ -70,7 +72,10 @@ GET /api/events?since=<seq>      →  text/event-stream (chunked)
 
 * 每条事件都有 `id: <seq>`（单调递增）与 `data: {"type":…,"seq":…, …}`。
 * 断线重连带上 `since=<最后收到的 seq>`（浏览器用 `Last-Event-ID` 也行），
-  服务端保留最近 2000 条，超出后从可用的最老一条开始。
+  服务端保留最近 2000 条，超出后从可用的最老一条开始；比当前 seq 还大（服务端重启过）
+  就当作新连接。
+* 新连接（不带 `since`）只收之后的事件；但若有尚未回答的 `permission`/`ask_user`，
+  会从那条事件开始补发，刷新页面不会丢掉正在等的问题。
 * 心跳是 SSE 注释 `: ping`（每秒一次，客户端忽略）。
 * `state` 事件在状态变化时整份重发，客户端可以直接替换本地状态。
 
@@ -83,10 +88,10 @@ GET /api/events?since=<seq>      →  text/event-stream (chunked)
 | `assistant_html` | `text` | **已渲染且已消毒的 HTML 片段**，按顺序追加 |
 | `assistant_delta` | `text` | 原始文本增量（逐字节真相，做复制/导出时用） |
 | `think_delta` | `text` | 推理过程增量（Thought） |
-| `tool` | `id`,`name`,`args`,`phase`,`detail` | `phase` = `open`/`ready`/`run`/`done` |
+| `tool` | `id`,`name`,`args`,`phase`,`detail` | `phase` = `open`/`ready`/`run`/`progress`/`done`；`progress` 是子代理的最近几步（`detail` 形如 `explore · grep foo · read_file x`），可以出现多次 |
 | `tool_result` | `id`,`name`,`out`,`exit`,`bytes`,`truncated` | 完整输出被截到 32 KiB，`truncated=true` |
 | `todo` | `text` | `todo_write` 替换后的清单（一行一项） |
-| `permission` | `id`,`tool`,`detail`,`preview`,`sandbox` | 需要回答（见下） |
+| `permission` | `id`,`tool`,`detail`,`preview`,`sandbox`,`timeout` | 需要回答（见下）；`timeout` 秒后按拒绝处理 |
 | `permission_done` | `id`,`answer` | 问题已结束（超时/取消也会发） |
 | `ask_user` | `id`,`question`,`options[]` | 需要回答 |
 | `session` | `id` | 切换/新建了会话，客户端应重新拉 `/api/session` |
@@ -95,30 +100,80 @@ GET /api/events?since=<seq>      →  text/event-stream (chunked)
 `state` 字段：`workspace` `session` `provider` `model` `effort` `approval`
 (`ask|auto|yolo`) `plan_mode` `protocol_tools` `status_busy` `todo`
 `context_tokens` `undo_available` `pending_images[]` `usage{requests,prompt_tokens,
-completion_tokens,cost,priced,currency}`。
+completion_tokens,cached_tokens,cache_miss_tokens,cost,priced,currency}`
+`turn_usage{…}`（上一轮，字段同 `usage`）`api_base` `key_set` `key_from`
+（`saved` / 环境变量名 / `session` / 空，**从不含 key 本身**）
+`model_info{label,context,vision,reasoning,source,price?}` `effort_applies`
+`sees_images`（1 / 0 / -1 未知）`max_steps` `tool_profile` `perm_timeout`
+`show_thinking`（思考过程默认展开，存在 `settings.json`，和 TUI 的 `/thinking` 是同一个开关）。
+`cached_tokens` / `cache_miss_tokens` 来自上游的 prompt cache 统计，前端用它算命中率。
+
+`think_delta` / `assistant_delta` 的 `text` 总是完整的 UTF-8：上游在多字节字符中间
+断开时，残缺的尾巴留到下一块再发。
 
 ### 请求
 
 | 方法 | 路径 | 说明 |
 |---|---|---|
 | GET | `/api/state` | 上面那份快照 |
-| GET | `/api/session?from=N` | 会话消息（`{messages:[…]}`，形状与 `.agent/sessions/*.jsonl` 一致；assistant 消息额外带 `html`） |
+| GET | `/api/session?from=N` | 会话消息（`{messages:[…]}`，形状与 `.agent/sessions/*.jsonl` 一致，另加的字段见下） |
 | GET | `/api/sessions` | `{current, sessions:[{id,title,messages,mtime}]}` |
 | POST | `/api/sessions/new` | `{}` → `{id}` |
 | POST | `/api/sessions/switch` | `{"id":"…"}` |
+| POST | `/api/sessions/rename` | `{"id":"…"?,"title":"…"}`（不带 `id` = 当前会话）；标题按字符截到 120 字节，空串 = 恢复默认（第一句提问）；没这个会话 → 404 |
+| POST | `/api/sessions/delete` | `{"id":"…"}` → `{ok,current}`；删的是当前会话时先开一个新会话（并发 `session` 事件）；没这个会话 → 404 |
+| POST | `/api/retry` | `{}` = 重新生成最后一轮；`{"text":"…"}` = 把最后一句提问换成新文字再跑（编辑重发）。先把最后一轮从会话里退掉，再开新一轮 → 202 `{ok,text}`；没有可重来的轮次 / 轮次在跑 → 409；空串或非字符串 → 400 |
+| GET | `/api/export` | 当前会话的 Markdown（`text/markdown`，与 TUI `/export` 同一格式） |
+| GET | `/api/diff[?path=p]` | 工作区的真实 diff：`{git,path,files:[{status,path}],diff,truncated}`。`files` 来自 `git status --short`（含未跟踪），`diff` 是 `git diff`（未暂存部分，限 512 KiB）；不是 git 仓库 / 没装 git → `git:false`；10 s 超时 |
+| GET | `/api/settings` | 运行设置：`protocol`,`protocols[]`,`max_steps`,`tool_profile`,`profiles[]`,`confirm{shell,write,net}`,`approval`,`tools[{name,perm,on,desc,…}]`,`sandbox{kind,active,labels?}` |
+| POST | `/api/settings` | `{protocol?,max_steps?,tool_profile?,tools?:{名字:bool},confirm?:{shell?,write?,net?}}`；整体校验后才生效（任何一项不对 → 400，什么都不改），成功后发 `state` |
+| GET | `/api/permissions` | 已保存的"总是允许"规则：`{text,tools[],shell_prefixes[]}`（来自 `<workspace>/.agent/permissions.json`） |
+| DELETE | `/api/permissions` | 清空这些规则 |
+| POST | `/api/init` | `{}` → 202 `{ok,text}`：开一轮，让 agent 分析仓库写 `AGENTS.md`（与 TUI `/init` 同一段提示词） |
+| POST | `/api/skill` | `{"name":"…","task":"…"?}` → 202 `{ok,text}`：把 skill 正文内联进这条消息再开一轮（同 TUI `/skill`）；没有这个 skill → 404；缺 `name` / 超过 63 字节 / `task` 不是字符串 → 400 |
+| GET | `/api/extensions` | `{enabled,trusted,report,task_tool,mcp:[{name,source,command,state,tools,error}],plugins:[{name,source,desc,tools,mcp,skills,error}],skills:[{name,source,desc}],roles:[{name,source,desc,model,read_only}],runs:[{file,role,desc,status,steps,tools,ms}]}`；`state` = `starting/ready/failed/exited/off`，`runs` 是当前会话的子代理运行 |
+| POST | `/api/extensions/reload` | 停掉 MCP 服务器和插件，重新读取它们和 skills → `{ok,trusted,report}` |
+| POST | `/api/extensions/trust` | `{"on":true\|false}`：信任（或取消）当前工作区——决定它的 `.agent/plugins`、`.agent/mcp.json` 是否加载；写进 `settings.json` 后重新加载，回复同上 |
+| POST | `/api/workspace` | `{"path":"/abs/dir"}` —— 换工作目录（权限规则/埋点/AGENTS.md 跟着换，扩展按新目录重新加载），并**在新目录里开一个新会话**（会话是按目录存的）；返回 `{id}`，坏路径 → 400 |
 | POST | `/api/turn` | `{"text":"…"}` → 202 `{ok:true}`；已有轮次在跑时 **409** |
-| POST | `/api/cancel` | `{}` —— 取消当前轮（不会杀进程） |
+| POST | `/api/cancel` | `{}` —— 取消当前轮（不会杀进程）；挂起的权限问题按拒绝、提问按忽略处理 |
 | POST | `/api/permission` | `{"id":N,"answer":0\|1\|2\|3}` → deny / once / always-tool / always-prefix |
 | POST | `/api/ask_user` | `{"id":N,"text":"…"}` 或 `{"id":N,"dismiss":true}` |
-| POST | `/api/config` | `{model?,provider?,effort?,approval?,plan_mode?}` |
+| POST | `/api/config` | `{model?,effort?,approval?,plan_mode?,show_thinking?}`；先整体校验再生效，model/effort/approval（`yolo` 除外）写进 `settings.json`；当前模型不吃 effort 时回 `warning`；带 `provider` → 400（改用 `/api/provider`） |
+| GET | `/api/providers` | `{current, providers:[{name,api_base,model,has_key,key_from,key_env,source,current}]}` |
+| GET | `/api/models[?refresh=1]` | 当前提供商的模型：`{provider,current,api_base,key_set,api_count,models:[{id,api,label,context,vision,reasoning,source,price?}]}`；先用缓存，过期/缺失/`refresh=1` 时向 `/v1/models` 拉；key 被拒 → 401（仍带内置模型和 `auth:true`），其它失败放在 `api_error` |
+| POST | `/api/provider` | `{"name":"…","key":"…"?}`：切换提供商。缺 key → 400 `{need_key:true}`；key 被拒 → 401；没这个提供商 → 404；成功 → `{ok,provider,model,warning?}`，key 验证后存进 `credentials`（0600） |
+| POST | `/api/key` | `{"key":"…"}`：换当前提供商的 key，验证与回复同上 |
 | POST | `/api/undo` | 回滚最近一轮的文件改动，回 200 + 报告文本 |
 | POST | `/api/compact` | 手动压缩上下文 |
-| POST | `/api/attach?name=x.png` | 请求体是图片原始字节（≤16 MiB），进入"待发送"列表 |
+| POST | `/api/attach?name=x.png` | 请求体是图片原始字节（≤32 MiB），进入"待发送"列表 |
 | DELETE | `/api/attach` | 清空待发送图片 |
 | GET | `/api/attach/<rel>` | 读回已存进会话的图片（`rel` 由消息的 `attach[].rel` 给出） |
 | POST | `/api/quit` | 关闭进程 |
 
 未命中路由 → `404 {"error":"not found"}`；需要 token 而没给 → `401`。
+轮次运行中（或另一个修改正在进行）时，`sessions/new`、`sessions/switch`、`sessions/delete`、
+`workspace`、`undo`、`compact`、`attach`（上传/清空）、`provider`、`key`、`retry`、`diff`、
+`POST /api/settings`、`DELETE /api/permissions`、`init`、`skill`、`extensions/reload`、
+`extensions/trust` 以及改 `model/effort` 的 `config` 一律 **409**；
+`approval`/`plan_mode`/`show_thinking` 可以中途改，`sessions/rename`、`export` 与
+`GET /api/extensions` 在轮次进行中也能用。
+
+`/api/session` 的每条消息在会话文件的字段之外还带：
+
+| 字段 | 出现在 | 说明 |
+|---|---|---|
+| `html` | assistant | 已消毒的 Markdown 渲染结果（文本协议时只渲染说明文字，不含调用帧） |
+| `text` | 文本协议的 assistant | 去掉调用帧后的说明文字（`content` 仍是原文） |
+| `calls` | 带工具调用的 assistant | `[{id,name,args}]`：原生协议来自 `tool_calls`，文本协议从 `content` 解析 |
+| `tool_result` | 工具结果 | `true`；原生协议 role 是 `tool`，文本协议 role 是 `user`（凭 `tool_call_id` 区分） |
+| `out`,`exit`,`truncated` | 工具结果 | 去掉 `[tool …]` / `result … end` 外框后的输出（截到 32 KiB，按字符边界）与退出码 |
+| `note` | 引擎插入的提示 | `true`；如中途切换计划模式时的 `[cst] …` 说明，不是用户说的话 |
+
+客户端据此在刷新后重建"本轮工具调用"列表：`calls` 建行，`tool_call_id` 相同的结果填进去。
+
+key 只出现在请求体里：回复、事件、日志都不会带它。`/api/provider` 与 `/api/key`
+跟其它 `/api/*` 一样受 loopback 同源检查或 token 保护。
 
 ### 客户端接入示例（10 行）
 
@@ -149,12 +204,54 @@ api("/api/turn", {"text": "hello"})           # 之后读 /api/events 收流
 Markdown 在**服务端**渲染（复用 TUI 用的 sashidown 流式 API），客户端只贴 HTML；
 因此不需要引入任何 JS 依赖，也顺带保证了"只发送已确认的 HTML"。
 
+界面本身：左栏可收（顶栏按钮 / `?side=0`），右栏可收（`?panel=0`），主题 `?theme=dark|light`；
+三个开关都会记进 `localStorage`，带查询参数时以参数为准。空状态只留一句提示，第一轮
+对话开始后自动隐去；右栏只给三件事——任务清单、本轮文件改动行数（`+N −M`）、上下文
+占用与 prompt cache 命中率。布局类在页面脚本之前就写进 `<body>`，避免首帧闪一下再收起。
+
+### 命令与快捷键
+
+输入框以 `/` 开头时是命令，在页面里执行，不发给模型：打 `/` 弹出列表（↑↓ 选，Tab 补全，
+Enter 执行），`/model`、`/effort`、`/approval`、`/provider`、`/skill`、`/thinking`、`/details`
+还会补全参数。`/usr/bin 是什么` 这种第一个词里带 `/` 的照常发送；未知命令留在输入框里并提示，
+开头加个空格即可当普通消息发出。
+
+| 命令 | 作用 |
+|---|---|
+| `/new` `/sessions` `/rename [标题]` | 新建 / 会话列表 / 重命名 |
+| `/retry` `/edit` `/stop` `/undo` `/compact` | 重新生成 / 编辑重发 / 停止 / 撤销写入 / 压缩上下文 |
+| `/export` `/copy` `/diff [文件]` | 导出 Markdown / 复制最后一条回答 / 工作区 diff |
+| `/model [id]` `/effort [级别]` `/provider [名字]` `/key` | 模型、推理强度、提供商、API key |
+| `/approval [ask\|auto\|yolo]` `/plan` `/build` | 审批权限、计划/构建模式 |
+| `/settings`（`/protocol` `/tools` `/max-steps` `/permissions`） | 运行设置 |
+| `/init` `/skill 名字 [任务]` `/skills` `/extensions`（`/mcp` `/plugins` `/agents`） | 写 AGENTS.md、用 skill、扩展状态 |
+| `/thinking [on\|off]` `/details [on\|off]` | 思考过程默认展开（存 `settings.json`）、工具输出全部展开（存浏览器） |
+| `/theme` `/palette` `/help` | 主题、命令面板、帮助 |
+
+快捷键：Ctrl+P 命令面板，Ctrl+K 会话列表，Shift+Tab 循环审批（每次询问 → 自动 → 完全放行），
+F1 或 `?` 帮助，Esc 关闭弹窗 / 取消编辑 / 停止当前一轮，Ctrl+B / Ctrl+J 收起左栏 / 右栏。
+
+引擎的英文状态、错误和会话里的 `[cst]` 提示在页面上换成中文；一轮失败时（`turn_end.rc≠0`）
+显示可读的原因（比如"API key 无效或已过期（HTTP 401）"、"用满了 30 步上限"），不再是 `rc=-1`。
+
+TUI 里打 `/web` 会另起一个 WebUI 进程（`--web --workspace <当前目录> --new`），
+日志在 `<workspace>/.agent/webui.log`：TUI 不能被 `cst_webui_run()` 的阻塞循环占住，
+而且两个进程同时写一个会话文件会把它写坏，所以子进程总是开新会话。
+
+自动压缩的门槛是模型上下文窗口的 **75%**（`CST_CTX_BUDGET` 可覆盖）；到点后下一轮
+开始前先总结历史，而不是等到塞满。
+
 ## 测试
 
 ```bash
 make check                        # 含 tests/test_webui（HTTP/SSE/鉴权/消毒）
 sh scripts/e2e_webui.sh          # 用录制流跑完整轮次 + 权限往返，不需要 API key
-sh scripts/e2e_webui.sh tests/fixtures/sse/deepseek-ctl ctl
+                                  # （含 e2e_webui_settings.py：假 /v1/models、换提供商/key、中文思考流；
+                                  #  e2e_webui_sessions.py：重新生成/编辑重发/导出/重命名/删除/历史字段；
+                                  #  e2e_webui_workspace.py：diff、运行设置、权限规则；
+                                  #  e2e_webui_ext.py：/init、/skill、扩展、信任、思考开关）
+sh scripts/e2e_webui.sh tests/fixtures/sse/deepseek-ctl-heredoc ctl-heredoc
+                                  # （deepseek-ctl 录的是一次契约错误连发的失败运行，不能拿来跑这个）
 ```
 
 手工验收清单（浏览器）：
@@ -162,7 +259,9 @@ sh scripts/e2e_webui.sh tests/fixtures/sse/deepseek-ctl ctl
 1. 打开首页 → 顶部显示 workspace/模型/审批模式，右下状态"就绪"。
 2. 输入一句话 → 助手气泡逐字出现；工具卡片自动展开、结束后带 `exit=` 标记。
 3. 切到 `ask` 审批 → 写文件时弹窗；点"允许一次"后继续，点"拒绝"则该工具返回失败但对话继续。
-4. `会话` 按钮：新建/切换后历史正确重建（刷新页面也一样）。
+4. `会话` 按钮：新建/切换后历史正确重建（刷新页面也一样）：工具调用折叠成"本轮工具调用"，
+   点开能看到参数和输出；搜索、重命名、删除可用。
+4a. 最后一句提问上有"编辑重发"，最后一个回答上有"重新生成"；右栏文件行点开是真实 diff。
 5. 拖入一张图片 → 底部出现待发送提示，发送后历史里能看到图。
 6. 关掉标签页再打开 → 事件流自动续传，不丢已完成的消息。
 

include/cst_agent.h

@@ -130,6 +130,12 @@ const cst_message_t *cst_session_get(const cst_session_t *s, int i);
 const char *cst_session_path(const cst_session_t *s);
 int cst_session_clear(cst_session_t *s, int keep_system);
 int cst_session_rewrite(cst_session_t *s, const cst_message_t *msgs, int n);
+/* Tool output: role=tool, or a text-protocol user message answering a call. */
+int cst_message_is_tool_result(const cst_message_t *m);
+/* The transcript as Markdown, malloc'd (NULL on OOM). Tool output and call
+ * arguments are cut at 4000 bytes. Takes the session lock. */
+char *cst_session_export_md(cst_session_t *s, const char *title,
+                            const char *sid, const char *model);
 /* Readers on another thread must hold the lock while using pointers returned
  * by cst_session_get (append may reallocate). Append locks internally. */
 void cst_session_lock(cst_session_t *s);
@@ -321,6 +327,12 @@ cst_agent_config_t *cst_agent_config_mut(cst_agent_t *a);
 void cst_agent_request_cancel(cst_agent_t *a);
 int cst_agent_new_session(cst_agent_t *a, char *id_out, size_t id_sz);
 int cst_agent_switch_session(cst_agent_t *a, const char *id);
+/* Re-root the agent at another directory. Per-workspace state (permission
+ * rules, metrics, project notes) follows, the system prompt is rebuilt and the
+ * token budget is re-measured. The session is not touched: the caller decides
+ * whether to keep it or start a new one. */
+int cst_agent_set_workspace(cst_agent_t *a, const char *path, char *err,
+                            size_t err_sz);
 int cst_agent_compact(cst_agent_t *a, char *err, size_t err_sz);
 /* Bare id of the current session (file name without .jsonl). */
 void cst_agent_session_id(const cst_agent_t *a, char *out, size_t out_sz);

include/cst_http.h

@@ -32,6 +32,7 @@ typedef struct {
   const char *host;
   const char *content_type;
   const char *user_agent;
+  const char *last_event_id; /* an EventSource reconnecting */
   int keep_alive;
 } cst_http_req_t;
 
@@ -72,8 +73,10 @@ cst_http_server_t *cst_http_start(const cst_http_opts_t *o, char *err,
 int cst_http_port(const cst_http_server_t *s);
 /* Non-zero once stop() was called: long-lived handlers must return. */
 int cst_http_stopping(const cst_http_server_t *s);
-/* Close the listener and every connection, then wait for the threads. */
+/* Close the listener and every connection, then wait (30 s at most) for the
-void cst_http_stop(cst_http_server_t *s);
+ * handler threads. Returns how many still run: their ud must stay alive. */
+int cst_http_stop(cst_http_server_t *s);
+/* Does nothing while handlers still run on s. */
 void cst_http_free(cst_http_server_t *s);
 
 /* --- inside a handler --- */

include/cst_provider_switch.h

@@ -0,0 +1,79 @@
+#ifndef CST_PROVIDER_SWITCH_H
+#define CST_PROVIDER_SWITCH_H
+
+/* Model lists, API keys and provider switches, shared by the TUI and the
+ * WebUI so both front ends validate and persist the same way.
+ *
+ * A key is checked with GET /models: a 401/403 (CST_MODELS_AUTH) rejects
+ * it, any other failure (offline, no /models route) lets it through
+ * unverified. A key that passes is saved to <config>/credentials. Keys are
+ * never copied into err. */
+
+#include "cst_agent.h"
+#include "cst_models.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#define CST_PS_MAX_MODELS 512
+#define CST_PS_UNKNOWN (-1)   /* no such provider */
+#define CST_PS_NEED_KEY (-10) /* no key given, none saved or in the env */
+/* Non-negative results are flags: */
+#define CST_PS_UNVERIFIED 1 /* /models failed for another reason; err says */
+#define CST_PS_UNSAVED 2    /* the credentials file could not be written */
+
+typedef struct {
+  char id[128];
+  int api; /* listed by the provider's /models (else built-in only) */
+  cst_model_info_t info;
+} cst_ps_model_t;
+
+/* GET /models; a good answer refreshes models-cache/<provider>.json. The
+ * count, CST_MODELS_AUTH, or another negative value with err set. */
+int cst_ps_fetch(const char *provider, const char *api_base, const char *key,
+                 char ids[][128], int max, char *err, size_t err_sz);
+/* The cached list: count, or -1; *fresh when younger than the TTL. */
+int cst_ps_cached(const char *provider, char ids[][128], int max, int *fresh);
+
+/* Base URL for provider: cfg's own when it is the current provider (it may
+ * be overridden), else the preset's; "" when unknown. */
+const char *cst_ps_base(const cst_agent_config_t *cfg, const char *provider);
+
+/* The model picker list for cfg's provider: the API's ids (the cache while
+ * it is fresh, else a fetch; refresh always fetches) followed by the
+ * built-in names it did not list. *api_rc gets the fetch result (count,
+ * CST_MODELS_AUTH, -1 with err) or the cached count. Returns the count. */
+int cst_ps_models(const cst_agent_config_t *cfg, int refresh,
+                  cst_ps_model_t *out, int max, int *api_rc, char *err,
+                  size_t err_sz);
+
+/* Checks key against /models and saves it: CST_MODELS_AUTH (err set), or
+ * the CST_PS_* flags. When ids is given it gets the fetched list and *nids
+ * the raw fetch result. */
+int cst_ps_verify_save(const char *provider, const char *api_base,
+                       const char *key, char ids[][128], int max, int *nids,
+                       char *err, size_t err_sz);
+
+/* Point cfg at provider p with key: base URL, the remembered model (else
+ * the preset's), settings saved. */
+void cst_ps_apply_provider(cst_agent_config_t *cfg, const cst_provider_t *p,
+                           const char *key);
+
+/* The whole switch without a prompt: key NULL/"" uses the saved or env
+ * key (else CST_PS_NEED_KEY); a given key is verified and saved first. A
+ * preset with no model takes the first one the API lists. The CST_PS_*
+ * flags, or CST_PS_UNKNOWN / CST_PS_NEED_KEY / CST_MODELS_AUTH. */
+int cst_ps_switch_provider(cst_agent_config_t *cfg, const char *name,
+                           const char *key, char *err, size_t err_sz);
+
+/* Replace the current provider's key: verified, saved, put in cfg. Same
+ * results as cst_ps_verify_save. */
+int cst_ps_set_key(cst_agent_config_t *cfg, const char *key, char *err,
+                   size_t err_sz);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif

include/cst_skills.h

@@ -45,6 +45,8 @@ char *cst_skill_read(const char *workspace, const char *name,
  * task. NULL when the skill does not exist. malloc'd. */
 char *cst_skill_prompt(const char *workspace, const char *name,
                        const char *task);
+/* User message for `/init`: have the agent write AGENTS.md. */
+const char *cst_init_prompt(void);
 /* Register the `skill` tool (idempotent). */
 int cst_skills_register_tool(void);
 

include/cst_util.h

@@ -27,6 +27,17 @@ size_t cst_utf8_floor(const char *s, size_t n);
 char *cst_utf8_sanitize(const char *s, size_t n, size_t *out_len);
 int cst_utf8_valid(const char *s, size_t n);
 
+/* Re-chunks a byte stream so no piece ends inside a UTF-8 sequence: the
+ * incomplete tail (at most 3 bytes) waits in the hold for the next feed. */
+typedef struct {
+  char b[4];
+  size_t n;
+} cst_utf8_hold_t;
+/* Returns the complete prefix of hold+s[0..n) (malloc'd, NUL-terminated,
+ * *out_len may be 0), or NULL on OOM. */
+char *cst_utf8_hold_feed(cst_utf8_hold_t *h, const char *s, size_t n,
+                         size_t *out_len);
+
 /* Text files may start with a UTF-8 BOM (Windows editors): its length (0/3),
  * and an in-place strip of the NUL-terminated s (*len updated when given). */
 size_t cst_bom_len(const char *s, size_t n);

include/cst_version.h

@@ -2,8 +2,8 @@
 #define CST_VERSION_H
 
 #define CST_VERSION_MAJOR 0
-#define CST_VERSION_MINOR 7
+#define CST_VERSION_MINOR 8
-#define CST_VERSION_PATCH 8
+#define CST_VERSION_PATCH 4
 
 #define CST_VERSION_STR_(x) #x
 #define CST_VERSION_STR(x) CST_VERSION_STR_(x)

include/cst_webui.h

@@ -17,6 +17,10 @@
 extern "C" {
 #endif
 
+/* What --web listens on when --web-port/CST_WEB_PORT says nothing (the
+ * README and --help quote this number, so keep them in sync). */
+#define CST_WEBUI_DEFAULT_PORT 8787
+
 typedef struct {
   const char *host;  /* NULL = 127.0.0.1; "0.0.0.0" = every interface */
   int port;          /* 0 = pick a free port */

include/os_compat.h

@@ -114,9 +114,10 @@ int os_win_get_label(const char *path, char *out, size_t n);
 int os_clipboard_set(const char *utf8, size_t n);
 #endif
 
-/* Child processes get stdin=/dev/null, their own process group, and are
+/* Child processes get stdin=/dev/null and their own process group. They run
- * killed after the timeout (CST_SHELL_TIMEOUT seconds, default 120) or when
+ * with no time limit unless one is asked for (CST_SHELL_TIMEOUT seconds, or
- * *flag becomes non-zero. Exit code 124 = timeout, 130 = cancelled. */
+ * os_set_run_timeout()); either way a non-zero *flag cancels them.
+ * Exit code 124 = killed by that timeout, 130 = cancelled. */
 void os_set_cancel_flag(volatile int *flag);
 volatile int *os_get_cancel_flag(void);
 void os_set_run_timeout(int seconds); /* this thread; 0 = default */

scripts/e2e_webui.sh

@@ -47,6 +47,19 @@ BASE="http://127.0.0.1:$PORT"
 echo "   port $PORT"
 
 fail() { echo "FAIL: $1"; echo "--- events"; cat "$EVENTS" 2>/dev/null | head -40; exit 1; }
+# SIGTERM must shut the server down cleanly, even mid-turn (128+ = a crash)
+stop_server() {
+  kill "$1" 2>/dev/null || return 0
+  n=0
+  while kill -0 "$1" 2>/dev/null && [ $n -lt 200 ]; do n=$((n + 1)); sleep 0.2; done
+  if kill -0 "$1" 2>/dev/null; then
+    kill -9 "$1" 2>/dev/null || true
+    fail "$2 hung on SIGTERM"
+  fi
+  st=0
+  wait "$1" 2>/dev/null || st=$?
+  [ "$st" -lt 128 ] || fail "$2 died with status $st on SIGTERM"
+}
 
 # 1. the shell page and the state endpoint
 curl -fsS --max-time 5 "$BASE/" | grep -q "<title>CST-Agent" || fail "GET / is not the shell page"
@@ -160,7 +173,7 @@ fi
 # 7. the interactive approval path: a fresh server in ask mode must raise a
 # permission event, and answering it must let the turn continue.
 echo "== permission round trip (-A ask)"
-kill "$SRV_PID" 2>/dev/null || true   # the first server's replay is spent
+stop_server "$SRV_PID" "the first server"   # its replay is spent
 rm -rf "$WORK/pw"; mkdir -p "$WORK/pw"
 P_EVENTS="$WORK/permission-events.txt"
 P_LOG="$WORK/permission-server.log"   # its own log: the port parse must not
@@ -206,7 +219,7 @@ else
     i=$((i + 1)); sleep 0.2
   done
   grep -q "event: permission_done" "$P_EVENTS" || fail "the answer was not acknowledged"
-  kill "$P_PID" 2>/dev/null || true
+  stop_server "$P_PID" "the ask-mode server"
   kill "$P_CURL" 2>/dev/null || true
   echo "   answered request $PID_REQ with 'allow once'"
 fi
@@ -260,4 +273,27 @@ done
 kill -0 "$T_PID" 2> /dev/null && fail "the server ignored /api/quit"
 wait "$T_PID" 2>/dev/null || true
 
+# 9. ask_user waits for the answer, and the HTTP hardening checks (both
+# need a scripted model: python3)
+if command -v python3 > /dev/null; then
+  echo "== ask_user round trip"
+  CST_AGENT="$BIN" python3 "$ROOT/scripts/e2e_webui_ask.py" > "$WORK/ask.txt" 2>&1 ||
+    { cat "$WORK/ask.txt"; fail "the ask_user round trip"; }
+  echo "== HTTP hardening"
+  CST_AGENT="$BIN" python3 "$ROOT/scripts/e2e_webui_http.py" > "$WORK/http.txt" 2>&1 ||
+    { cat "$WORK/http.txt"; fail "the HTTP hardening checks"; }
+  echo "== settings and streaming"
+  CST_AGENT="$BIN" python3 "$ROOT/scripts/e2e_webui_settings.py" > "$WORK/settings.txt" 2>&1 ||
+    { cat "$WORK/settings.txt"; fail "the settings checks"; }
+  echo "== sessions, retry and export"
+  CST_AGENT="$BIN" python3 "$ROOT/scripts/e2e_webui_sessions.py" > "$WORK/sessions.txt" 2>&1 ||
+    { cat "$WORK/sessions.txt"; fail "the session checks"; }
+  echo "== diff, run settings and permission rules"
+  CST_AGENT="$BIN" python3 "$ROOT/scripts/e2e_webui_workspace.py" > "$WORK/workspace.txt" 2>&1 ||
+    { cat "$WORK/workspace.txt"; fail "the workspace checks"; }
+  echo "== /init, /skill, extensions and the thinking switch"
+  CST_AGENT="$BIN" python3 "$ROOT/scripts/e2e_webui_ext.py" > "$WORK/ext.txt" 2>&1 ||
+    { cat "$WORK/ext.txt"; fail "the extension checks"; }
+fi
+
 echo "== OK: (events: $(grep -c '^event: ' "$EVENTS"))"

scripts/e2e_webui_ask.py

@@ -0,0 +1,164 @@
+"""WebUI ask_user round trip against a fake OpenAI-compatible API.
+
+  python3 scripts/e2e_webui_ask.py      (CST_AGENT= picks the binary)
+
+Checks: the turn really waits for the answer, a page opened while the
+question is open still receives it, and Last-Event-ID resumes the stream.
+"""
+import json, os, shutil, subprocess, sys, tempfile, threading, time, urllib.request
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+
+BIN = os.environ.get("CST_AGENT", os.path.join(os.path.dirname(os.path.abspath(__file__)), "..", "cst-agent"))
+REQS = []
+
+
+class H(BaseHTTPRequestHandler):
+    def log_message(self, *a):
+        pass
+
+    def do_GET(self):
+        body = json.dumps({"data": [{"id": "deepseek-flash"}]}).encode()
+        self.send_response(200)
+        self.send_header("Content-Type", "application/json")
+        self.send_header("Content-Length", str(len(body)))
+        self.end_headers()
+        self.wfile.write(body)
+
+    def do_POST(self):
+        n = int(self.headers.get("Content-Length", 0))
+        REQS.append(json.loads(self.rfile.read(n)))
+        self.send_response(200)
+        self.send_header("Content-Type", "text/event-stream")
+        self.end_headers()
+        base = {"id": "x", "object": "chat.completion.chunk", "model": "deepseek-flash"}
+
+        def ev(o):
+            self.wfile.write(b"data: " + json.dumps({**base, **o}).encode() + b"\n\n")
+            self.wfile.flush()
+        if len(REQS) == 1:
+            args = json.dumps({"question": "Pick a colour?", "options": "red\nblue"})
+            ev({"choices": [{"index": 0, "delta": {"role": "assistant", "tool_calls": [
+                {"index": 0, "id": "call_1", "type": "function",
+                 "function": {"name": "ask_user", "arguments": args}}]}}]})
+            ev({"choices": [{"index": 0, "delta": {}, "finish_reason": "tool_calls"}]})
+        else:
+            ev({"choices": [{"index": 0, "delta": {"role": "assistant", "content": "done"}}]})
+            ev({"choices": [{"index": 0, "delta": {}, "finish_reason": "stop"}]})
+        self.wfile.write(b"data: [DONE]\n\n")
+        self.wfile.flush()
+
+
+fails = 0
+
+
+def check(ok, msg):
+    global fails
+    print(("PASS " if ok else "FAIL ") + msg)
+    fails += 0 if ok else 1
+
+
+class Sse:
+    def __init__(self, base, last_id=None):
+        self.lines = []
+        req = urllib.request.Request(base + "/api/events")
+        if last_id is not None:
+            req.add_header("Last-Event-ID", str(last_id))
+        self.r = urllib.request.urlopen(req, timeout=60)
+        threading.Thread(target=self.pump, daemon=True).start()
+
+    def pump(self):
+        try:
+            for raw in self.r:
+                self.lines.append(raw.decode())
+        except Exception:
+            pass
+
+    def events(self, name):
+        out = []
+        for i, l in enumerate(self.lines):
+            if l.strip() == "event: " + name and i + 1 < len(self.lines):
+                out.append(json.loads(self.lines[i + 1][6:]))
+        return out
+
+    def ids(self):
+        return [int(l[4:]) for l in self.lines if l.startswith("id: ")]
+
+    def close(self):
+        try:
+            self.r.close()
+        except Exception:
+            pass
+
+
+def wait(fn, t=15):
+    end = time.time() + t
+    while time.time() < end:
+        v = fn()
+        if v:
+            return v
+        time.sleep(0.1)
+    return None
+
+
+def post(base, path, obj):
+    req = urllib.request.Request(base + path, data=json.dumps(obj).encode(),
+                                 headers={"Content-Type": "application/json"})
+    try:
+        with urllib.request.urlopen(req, timeout=5) as r:
+            return r.status
+    except urllib.error.HTTPError as e:
+        return e.code
+
+
+api = ThreadingHTTPServer(("127.0.0.1", 0), H)
+threading.Thread(target=api.serve_forever, daemon=True).start()
+ws = tempfile.mkdtemp(prefix="cst-ask-")
+log = open(ws + "/server.log", "w+")
+p = subprocess.Popen([BIN, "--web", "--web-port", "0", "--workspace", ws, "--new",
+                      "--api-key", "sk-x", "--provider", "deepseek", "--model", "deepseek-flash",
+                      "--api-base", "http://127.0.0.1:%d/v1" % api.server_address[1],
+                      "--protocol", "native-eos", "--approval", "auto"],
+                     stdout=log, stderr=subprocess.STDOUT)
+try:
+    def port():
+        log.seek(0)
+        for l in log.read().splitlines():
+            if l.startswith("webui: http://127.0.0.1:"):
+                return l.split(":")[3].split("/")[0]
+    pt = wait(port)
+    base = "http://127.0.0.1:%s" % pt
+    a = Sse(base)
+    time.sleep(0.3)
+    check(post(base, "/api/turn", {"text": "ask me"}) == 202, "turn accepted")
+    ask = wait(lambda: a.events("ask_user"))
+    check(bool(ask), "ask_user event raised")
+    time.sleep(1.5)
+    check(len(REQS) == 1, "the turn waits for the answer (requests so far: %d)" % len(REQS))
+    # a page opened now must still see the open question
+    b = Sse(base)
+    check(bool(wait(lambda: b.events("ask_user"), 5)), "a late page gets the open question")
+    # reconnect with Last-Event-ID: nothing before that id is resent
+    last = a.ids()[-1]
+    c = Sse(base, last_id=last - 1)
+    got = wait(lambda: c.ids(), 5)
+    check(bool(got) and got[0] == last, "Last-Event-ID resumes after that id (%s, want %d)" % (got[:1] if got else got, last))
+    if ask:
+        check(post(base, "/api/ask_user", {"id": ask[0]["id"], "text": "blue"}) == 200, "answer accepted")
+    end = wait(lambda: a.events("turn_end"), 20)
+    check(bool(end) and end[0].get("rc") == 0, "turn ended rc=0")
+    tool_msgs = [m for m in (REQS[1]["messages"] if len(REQS) > 1 else []) if m.get("role") == "tool"]
+    check(bool(tool_msgs) and "blue" in json.dumps(tool_msgs), "the answer reached the model: %s" % json.dumps(tool_msgs)[:200])
+    for s in (a, b, c):
+        s.close()
+finally:
+    p.terminate()
+    try:
+        p.wait(20)
+    except subprocess.TimeoutExpired:
+        p.kill()
+        check(False, "server hung on SIGTERM")
+    check(p.returncode is not None and p.returncode < 128 and p.returncode >= 0, "clean exit (%s)" % p.returncode)
+    log.close()
+    shutil.rmtree(ws, ignore_errors=True)
+print("FAILED:", fails)
+sys.exit(1 if fails else 0)

scripts/e2e_webui_ext.py

@@ -0,0 +1,227 @@
+"""WebUI /init, /skill, extensions and the thinking switch against a fake API.
+
+  python3 scripts/e2e_webui_ext.py      (CST_AGENT= picks the binary)
+
+Checks: show_thinking is validated, lands in the state and in settings.json;
+/api/skill inlines the skill and 404s an unknown one; /api/init sends the
+AGENTS.md prompt; /api/extensions lists skills and the built-in roles;
+trust and reload work and write settings.json; the changing calls are a 409
+while a turn runs, the listing is not. HOME points at a temp dir.
+"""
+import json, os, shutil, subprocess, sys, tempfile, threading, time, urllib.request
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+
+BIN = os.environ.get("CST_AGENT", os.path.join(os.path.dirname(os.path.abspath(__file__)), "..", "cst-agent"))
+SEEN = []   # the full last user message of every request
+
+
+class Api(BaseHTTPRequestHandler):
+    """Answers "好的"; a prompt with "slow" takes 2 s."""
+    def log_message(self, *a):
+        pass
+
+    def do_GET(self):
+        body = json.dumps({"data": [{"id": "deepseek-flash"}]}).encode()
+        self.send_response(200)
+        self.send_header("Content-Type", "application/json")
+        self.send_header("Content-Length", str(len(body)))
+        self.end_headers()
+        self.wfile.write(body)
+
+    def do_POST(self):
+        req = json.loads(self.rfile.read(int(self.headers.get("Content-Length", 0))) or b"{}")
+        users = [m.get("content") for m in req.get("messages", []) if m.get("role") == "user"]
+        last = users[-1] if users and isinstance(users[-1], str) else ""
+        SEEN.append(last)
+        if "slow" in last:
+            time.sleep(2)
+        self.send_response(200)
+        self.send_header("Content-Type", "text/event-stream")
+        self.end_headers()
+        for o in ({"delta": {"role": "assistant", "content": "好的"}},
+                  {"delta": {}, "finish_reason": "stop"}):
+            chunk = {"id": "x", "object": "chat.completion.chunk", "model": "deepseek-flash",
+                     "choices": [dict(index=0, **o)]}
+            self.wfile.write(b"data: " + json.dumps(chunk, ensure_ascii=False).encode() + b"\n\n")
+            self.wfile.flush()
+        self.wfile.write(b"data: [DONE]\n\n")
+        self.wfile.flush()
+
+
+fails = 0
+
+
+def check(ok, msg):
+    global fails
+    print(("PASS " if ok else "FAIL ") + msg)
+    fails += 0 if ok else 1
+
+
+def wait(fn, t=15):
+    end = time.time() + t
+    while time.time() < end:
+        v = fn()
+        if v:
+            return v
+        time.sleep(0.1)
+    return None
+
+
+def call(base, path, obj=None, method=None):
+    data = None if obj is None else json.dumps(obj).encode()
+    req = urllib.request.Request(base + path, data=data, method=method or ("POST" if data else "GET"),
+                                 headers={"Content-Type": "application/json"})
+    try:
+        with urllib.request.urlopen(req, timeout=30) as r:
+            return r.status, json.loads(r.read() or b"{}")
+    except urllib.error.HTTPError as e:
+        try:
+            return e.code, json.loads(e.read() or b"{}")
+        except ValueError:
+            return e.code, {}
+
+
+def skill(ws, name, desc, body):
+    d = os.path.join(ws, ".agent", "skills", name)
+    os.makedirs(d, exist_ok=True)
+    with open(os.path.join(d, "SKILL.md"), "w", encoding="utf-8") as f:
+        f.write("---\nname: %s\ndescription: %s\n---\n\n%s\n" % (name, desc, body))
+
+
+api = ThreadingHTTPServer(("127.0.0.1", 0), Api)
+threading.Thread(target=api.serve_forever, daemon=True).start()
+ws = tempfile.mkdtemp(prefix="cst-ext-")
+home = tempfile.mkdtemp(prefix="cst-home-")
+skill(ws, "demo", "演示用的 skill", "DEMO-INSTRUCTIONS: 先说你好。")
+env = dict(os.environ, HOME=home, XDG_CONFIG_HOME=home + "/.config",
+           XDG_DATA_HOME=home + "/.local/share", XDG_CACHE_HOME=home + "/.cache")
+for k in ("DEEPSEEK_API_KEY", "OPENAI_API_KEY", "CST_API_KEY"):
+    env.pop(k, None)
+log = open(ws + "/server.log", "w+")
+proc = subprocess.Popen([BIN, "--web", "--web-port", "0", "--workspace", ws, "--new", "--api-key", "sk-x",
+                         "--provider", "deepseek", "--model", "deepseek-flash",
+                         "--api-base", "http://127.0.0.1:%d/v1" % api.server_address[1],
+                         "--protocol", "native-eos", "--approval", "auto"],
+                        stdout=log, stderr=subprocess.STDOUT, env=env)
+
+
+def port():
+    log.seek(0)
+    for l in log.read().splitlines():
+        if l.startswith("webui: http://127.0.0.1:"):
+            return l.split(":")[3].split("/")[0]
+
+
+def settings():
+    try:
+        with open(home + "/.config/cst-agent/settings.json", encoding="utf-8") as f:
+            return json.load(f)
+    except OSError:
+        return {}
+
+
+def busy(base):
+    return call(base, "/api/state")[1].get("status_busy")
+
+
+def turn(base, path, body):
+    code, d = call(base, path, body)
+    if code == 202:
+        time.sleep(0.3)
+        wait(lambda: not busy(base), 20)
+    return code, d
+
+
+try:
+    base = "http://127.0.0.1:%s" % wait(port)
+
+    # 1. the thinking switch
+    st = call(base, "/api/state")[1]
+    check(st.get("show_thinking") is False, "show_thinking starts off")
+    check(call(base, "/api/config", {"show_thinking": "yes"})[0] == 400, "show_thinking must be a bool")
+    code, _ = call(base, "/api/config", {"show_thinking": True})
+    check(code == 200 and call(base, "/api/state")[1].get("show_thinking") is True, "show_thinking on")
+    check(settings().get("show_thinking") is True, "show_thinking is saved in settings.json")
+    call(base, "/api/config", {"show_thinking": False})
+    check(settings() and not settings().get("show_thinking"), "and cleared again (%s)" % settings())
+
+    # 2. the extensions listing
+    code, ex = call(base, "/api/extensions")
+    check(code == 200 and ex.get("enabled") is True and ex.get("trusted") is False,
+          "extensions: enabled, not trusted (%s)" % code)
+    names = [s["name"] for s in ex.get("skills", [])]
+    check(names == ["demo"] and ex["skills"][0].get("desc") == "演示用的 skill"
+          and ex["skills"][0].get("source") == "workspace", "the workspace skill is listed (%s)" % ex.get("skills"))
+    roles = [r["name"] for r in ex.get("roles", [])]
+    check("explore" in roles and all(r.get("source") for r in ex["roles"]), "built-in roles are listed (%s)" % roles)
+    check(ex.get("mcp") == [] and ex.get("plugins") == [] and ex.get("runs") == [], "no MCP, plugins or runs")
+    check(ex.get("task_tool") is True and "1 skill" in ex.get("report", ""), "task tool on, report %r" % ex.get("report"))
+
+    # 3. /skill
+    code, d = turn(base, "/api/skill", {"name": "demo", "task": "做点事"})
+    check(code == 202 and "DEMO-INSTRUCTIONS" in d.get("text", "") and d["text"].endswith("做点事"),
+          "skill turn accepted (%s)" % code)
+    check(SEEN and "DEMO-INSTRUCTIONS" in SEEN[-1] and "做点事" in SEEN[-1], "the model saw the skill and the task")
+    code, d = turn(base, "/api/skill", {"name": "demo"})
+    check(code == 202 and SEEN[-1].endswith("Apply this skill now."), "a skill without a task")
+    check(call(base, "/api/skill", {"name": "nope"})[0] == 404, "unknown skill: 404")
+    check(call(base, "/api/skill", {"name": "../demo"})[0] == 404, "skill ../demo: 404")
+    check(call(base, "/api/skill", {})[0] == 400, "skill without a name: 400")
+    check(call(base, "/api/skill", {"name": "x" * 100})[0] == 400, "a long skill name: 400")
+    check(call(base, "/api/skill", {"name": "demo", "task": 5})[0] == 400, "a non-string task: 400")
+
+    # 4. /init
+    code, d = turn(base, "/api/init", {})
+    check(code == 202 and "AGENTS.md" in d.get("text", ""), "init accepted (%s)" % code)
+    check("AGENTS.md" in SEEN[-1], "the model saw the AGENTS.md prompt")
+
+    # 5. trust and reload
+    code, d = call(base, "/api/extensions/trust", {"on": True})
+    check(code == 200 and d.get("trusted") is True, "trust the workspace (%s %s)" % (code, d))
+    tw = settings().get("trusted_workspaces", [])
+    check(any(os.path.realpath(ws) == os.path.realpath(p) for p in tw), "settings.json lists it (%s)" % tw)
+    check(call(base, "/api/extensions")[1].get("trusted") is True, "the listing says trusted")
+    code, d = call(base, "/api/extensions/trust", {"on": False})
+    check(code == 200 and d.get("trusted") is False and not settings().get("trusted_workspaces"),
+          "untrust (%s)" % settings().get("trusted_workspaces"))
+    check(call(base, "/api/extensions/trust", {"on": "yes"})[0] == 400, "trust needs a bool")
+    skill(ws, "zeta", "第二个", "ZETA")
+    code, d = call(base, "/api/extensions/reload", {})
+    check(code == 200 and "2 skills" in d.get("report", ""), "reload sees the new skill (%s)" % d)
+    check([s["name"] for s in call(base, "/api/extensions")[1]["skills"]] == ["demo", "zeta"], "both listed")
+
+    # 6. while a turn runs
+    call(base, "/api/turn", {"text": "slow 慢一点"})
+    time.sleep(0.4)
+    check(call(base, "/api/extensions/reload", {})[0] == 409, "reload during a turn: 409")
+    check(call(base, "/api/extensions/trust", {"on": True})[0] == 409, "trust during a turn: 409")
+    check(call(base, "/api/skill", {"name": "demo"})[0] == 409, "skill during a turn: 409")
+    check(call(base, "/api/init", {})[0] == 409, "init during a turn: 409")
+    check(call(base, "/api/extensions")[0] == 200, "the listing works during a turn")
+    check(call(base, "/api/config", {"show_thinking": True})[0] == 200, "the thinking switch works during a turn")
+    wait(lambda: not busy(base), 20)
+    check(not settings().get("trusted_workspaces"), "the refused trust changed nothing")
+
+    # 7. another workspace brings its own skills
+    ws2 = tempfile.mkdtemp(prefix="cst-ext2-")
+    skill(ws2, "other", "另一个工作区的", "OTHER")
+    code, _ = call(base, "/api/workspace", {"path": ws2})
+    ex = call(base, "/api/extensions")[1]
+    check(code == 200 and [s["name"] for s in ex.get("skills", [])] == ["other"]
+          and ex.get("report") == "1 skill", "a workspace switch reloads the extensions (%s)" % ex.get("report"))
+    code, d = turn(base, "/api/skill", {"name": "other"})
+    check(code == 202 and "OTHER" in SEEN[-1], "and its skill runs")
+    shutil.rmtree(ws2, ignore_errors=True)
+finally:
+    proc.terminate()
+    try:
+        proc.wait(20)
+    except subprocess.TimeoutExpired:
+        proc.kill()
+        check(False, "server hung on SIGTERM")
+    log.close()
+    shutil.rmtree(ws, ignore_errors=True)
+    shutil.rmtree(home, ignore_errors=True)
+    api.shutdown()
+print("FAILED:", fails)
+sys.exit(1 if fails else 0)

scripts/e2e_webui_http.py

@@ -0,0 +1,234 @@
+"""WebUI HTTP hardening checks over raw sockets, against a scripted model.
+
+  python3 scripts/e2e_webui_http.py      (CST_AGENT= picks the binary)
+
+Cross-site requests, request parsing (Content-Length, NUL, long lines,
+keep-alive), auth before the body, changes refused while a turn runs,
+cancel waking a pending question, token mode and shutdown.
+"""
+import json, os, re, shutil, socket, subprocess, sys, tempfile, threading, time
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+
+BIN = os.environ.get("CST_AGENT", os.path.join(os.path.dirname(os.path.abspath(__file__)), "..", "cst-agent"))
+REQS = []
+
+
+class Api(BaseHTTPRequestHandler):
+    """First call: ask_user. Later calls: a plain answer."""
+
+    def log_message(self, *a):
+        pass
+
+    def do_GET(self):
+        body = json.dumps({"data": [{"id": "deepseek-flash"}]}).encode()
+        self.send_response(200)
+        self.send_header("Content-Type", "application/json")
+        self.send_header("Content-Length", str(len(body)))
+        self.end_headers()
+        self.wfile.write(body)
+
+    def do_POST(self):
+        n = int(self.headers.get("Content-Length", 0))
+        REQS.append(json.loads(self.rfile.read(n)))
+        self.send_response(200)
+        self.send_header("Content-Type", "text/event-stream")
+        self.end_headers()
+        base = {"id": "x", "object": "chat.completion.chunk", "model": "deepseek-flash"}
+
+        def ev(o):
+            self.wfile.write(b"data: " + json.dumps({**base, **o}).encode() + b"\n\n")
+            self.wfile.flush()
+        if len(REQS) == 1:
+            args = json.dumps({"question": "Pick?", "options": "a\nb"})
+            ev({"choices": [{"index": 0, "delta": {"role": "assistant", "tool_calls": [
+                {"index": 0, "id": "call_1", "type": "function",
+                 "function": {"name": "ask_user", "arguments": args}}]}}]})
+            ev({"choices": [{"index": 0, "delta": {}, "finish_reason": "tool_calls"}]})
+        else:
+            ev({"choices": [{"index": 0, "delta": {"role": "assistant", "content": "ok"}}]})
+            ev({"choices": [{"index": 0, "delta": {}, "finish_reason": "stop"}]})
+        self.wfile.write(b"data: [DONE]\n\n")
+        self.wfile.flush()
+
+
+fails = 0
+
+
+def check(ok, msg):
+    global fails
+    print(("PASS " if ok else "FAIL ") + msg)
+    fails += 0 if ok else 1
+
+
+def raw(port, data, timeout=5, read_all=True):
+    """Send bytes, return everything read until EOF/timeout."""
+    s = socket.create_connection(("127.0.0.1", port), timeout=timeout)
+    s.sendall(data)
+    out = b""
+    try:
+        while True:
+            b = s.recv(65536)
+            if not b:
+                break
+            out += b
+            if not read_all:
+                break
+    except socket.timeout:
+        pass
+    s.close()
+    return out.decode("latin1")
+
+
+def status(resp):
+    # a pipelined response starts right after the previous body, not on a new line
+    return [int(m) for m in re.findall(r"HTTP/1\.1 (\d{3}) ", resp)]
+
+
+def req(method, path, headers=None, body=b"", host=None):
+    h = {"Host": host or "127.0.0.1:%d" % PORT, "Connection": "close"}
+    h.update(headers or {})
+    if body or method == "POST":
+        h["Content-Length"] = str(len(body))
+    head = "%s %s HTTP/1.1\r\n" % (method, path) + "".join("%s: %s\r\n" % kv for kv in h.items()) + "\r\n"
+    return head.encode() + body
+
+
+def start(ws, *extra):
+    log = open(os.path.join(ws, "server.log"), "w+")
+    p = subprocess.Popen([BIN, "--web", "--web-port", "0", "--workspace", ws, "--new",
+                          "--api-key", "sk-x", "--provider", "deepseek", "--model", "deepseek-flash",
+                          "--api-base", "http://127.0.0.1:%d/v1" % api.server_address[1],
+                          "--protocol", "native-eos", "--approval", "auto", *extra],
+                         stdout=log, stderr=subprocess.STDOUT)
+    end = time.time() + 10
+    while time.time() < end:
+        log.seek(0)
+        for l in log.read().splitlines():
+            if l.startswith("webui: http://127.0.0.1:"):
+                return p, int(l.split(":")[3].split("/")[0]), log
+        time.sleep(0.1)
+    raise SystemExit("server did not start")
+
+
+def stop(p, name):
+    p.terminate()
+    try:
+        p.wait(20)
+    except subprocess.TimeoutExpired:
+        p.kill()
+        check(False, name + " hung on SIGTERM")
+        return
+    check(0 <= p.returncode < 128, "%s exits cleanly (%s)" % (name, p.returncode))
+
+
+api = ThreadingHTTPServer(("127.0.0.1", 0), Api)
+threading.Thread(target=api.serve_forever, daemon=True).start()
+root = tempfile.mkdtemp(prefix="cst-http-")
+try:
+    ws = os.path.join(root, "a")
+    os.makedirs(ws)
+    p, PORT, log = start(ws)
+    me = "http://127.0.0.1:%d" % PORT
+    cfg = b'{"approval":"ask"}'
+    # 1. cross-site requests
+    r = raw(PORT, req("POST", "/api/config", {"Origin": "http://evil.example", "Content-Type": "text/plain"}, cfg))
+    check(status(r)[:1] == [401], "a cross-site POST is refused (%s)" % status(r))
+    r = raw(PORT, req("POST", "/api/config", {"Origin": "null"}, cfg))
+    check(status(r)[:1] == [401], "Origin: null is refused")
+    r = raw(PORT, req("POST", "/api/config", {"Origin": me, "Content-Type": "application/json"}, b'{"approval":"auto"}'))
+    check(status(r)[:1] == [200], "our own page may POST (%s)" % status(r))
+    r = raw(PORT, req("POST", "/api/config", {}, b'{"approval":"auto"}'))
+    check(status(r)[:1] == [200], "a client without Origin (curl) may POST")
+    r = raw(PORT, req("GET", "/api/attach/img-0000.png", host="evil.example"))
+    check(status(r)[:1] == [401], "session images need the Host check too (%s)" % status(r))
+    r = raw(PORT, req("GET", "/app.js"))
+    check(status(r)[:1] == [200], "assets are served")
+    # 2. request parsing
+    r = raw(PORT, req("GET", "/api/state%00x"))
+    check(status(r)[:1] == [400], "an encoded NUL in the path is a 400 (%s)" % status(r))
+    smuggle = b"GET /api/sessions HTTP/1.1\r\nHost: 127.0.0.1\r\n\r\n"
+    r = raw(PORT, ("POST /api/cancel HTTP/1.1\r\nHost: 127.0.0.1:%d\r\nContent-Length: abc\r\n\r\n" % PORT).encode() + smuggle)
+    check(status(r) == [400], "Content-Length: abc is a 400, nothing smuggled (%s)" % status(r))
+    r = raw(PORT, ("POST /api/cancel HTTP/1.1\r\nHost: 127.0.0.1:%d\r\nContent-Length: 0\r\nContent-Length: %d\r\n\r\n"
+                   % (PORT, len(smuggle))).encode() + smuggle)
+    check(status(r) == [400], "two different Content-Lengths are a 400 (%s)" % status(r))
+    r = raw(PORT, ("GET /%s HTTP/1.1\r\nHost: x\r\n\r\n" % ("a" * 9000)).encode())
+    check(status(r)[:1] == [400], "an over-long request line is a 400 (%s)" % status(r))
+    r = raw(PORT, req("GET", "/api/state?x=http://a/b"))
+    check(status(r)[:1] == [200], "'://' in the query leaves the path alone (%s)" % status(r))
+    r = raw(PORT, req("GET", "/api/state", {"Connection": "Close"}), timeout=3)
+    check("Connection: close" in r, "Connection: Close (any case) closes")
+    ka = ("GET /api/state HTTP/1.1\r\nHost: 127.0.0.1:%d\r\n\r\n" % PORT).encode()
+    big = ("POST /api/turn HTTP/1.1\r\nHost: 127.0.0.1:%d\r\nContent-Length: 5000000\r\n\r\n" % PORT).encode()
+    r = raw(PORT, ka + big)
+    check(status(r) == [200, 413], "a 413 after a keep-alive request still arrives (%s)" % status(r))
+    # 3. a pending question: changes are refused, approval may change, cancel wakes it
+    events = []
+
+    def sse():
+        s = socket.create_connection(("127.0.0.1", PORT))
+        s.sendall(("GET /api/events HTTP/1.1\r\nHost: 127.0.0.1:%d\r\n\r\n" % PORT).encode())
+        buf = b""
+        s.settimeout(60)
+        try:
+            while True:
+                b = s.recv(65536)
+                if not b:
+                    break
+                buf += b
+                events[:] = [l[7:] for l in buf.decode("latin1").split("\n") if l.startswith("event: ")]
+        except Exception:
+            pass
+    threading.Thread(target=sse, daemon=True).start()
+    time.sleep(0.4)
+    r = raw(PORT, req("POST", "/api/turn", {"Content-Type": "application/json"}, b'{"text":"go"}'))
+    check(status(r)[:1] == [202], "turn accepted")
+    end = time.time() + 15
+    while time.time() < end and "ask_user" not in events:
+        time.sleep(0.1)
+    check("ask_user" in events, "the question is open")
+    for path, body in (("/api/sessions/new", b""), ("/api/workspace", json.dumps({"path": root}).encode()),
+                       ("/api/compact", b""), ("/api/undo", b""), ("/api/config", b'{"model":"x"}')):
+        r = raw(PORT, req("POST", path, {"Content-Type": "application/json"}, body))
+        check(status(r)[:1] == [409], "%s is refused mid-turn (%s)" % (path, status(r)))
+    r = raw(PORT, req("POST", "/api/config", {"Content-Type": "application/json"}, b'{"approval":"yolo"}'))
+    check(status(r)[:1] == [200], "approval may change mid-turn")
+    r = raw(PORT, req("POST", "/api/cancel", {"Content-Type": "application/json"}, b"{}"))
+    end = time.time() + 10
+    while time.time() < end and "turn_end" not in events:
+        time.sleep(0.1)
+    check("turn_end" in events, "cancel ends a turn parked on a question")
+    r = raw(PORT, req("POST", "/api/sessions/new", {"Content-Type": "application/json"}))
+    check(status(r)[:1] == [200], "after the turn, a new session is fine (%s)" % status(r))
+    stop(p, "the server")
+
+    # 4. token mode: the page loads, the API and images do not without it
+    ws2 = os.path.join(root, "b")
+    os.makedirs(ws2)
+    p, PORT, log = start(ws2, "--web-token", "tok-x")
+    r = raw(PORT, req("GET", "/app.js"))
+    check(status(r)[:1] == [200], "token mode: app.js loads without the token (%s)" % status(r))
+    r = raw(PORT, req("GET", "/api/state"))
+    check(status(r)[:1] == [401], "token mode: the API needs it")
+    r = raw(PORT, req("GET", "/api/attach/img-0000.png"))
+    check(status(r)[:1] == [401], "token mode: images need it")
+    r = raw(PORT, req("GET", "/api/state", {"Cookie": "cst_token=tok-x"}))
+    check(status(r)[:1] == [200], "token mode: the cookie works")
+    t0 = time.time()
+    r = raw(PORT, ("POST /api/attach HTTP/1.1\r\nHost: 127.0.0.1:%d\r\nContent-Length: 33554431\r\n"
+                   "Expect: 100-continue\r\n\r\n" % PORT).encode(), timeout=5)
+    check(status(r) == [401] and time.time() - t0 < 3,
+          "no token, no body read: 401 at once (%s, %.1fs)" % (status(r), time.time() - t0))
+    stop(p, "the token server")
+
+    # 5. option checks
+    rc = subprocess.run([BIN, "--web", "--web-port", "70000", "--workspace", ws2],
+                        capture_output=True, timeout=10).returncode
+    check(rc != 0, "--web-port 70000 is refused")
+    rc = subprocess.run([BIN, "--web", "--web-token", "x" * 80, "--web-port", "0", "--workspace", ws2,
+                         "--api-key", "k"], capture_output=True, timeout=10).returncode
+    check(rc != 0, "an over-long --web-token is refused")
+finally:
+    shutil.rmtree(root, ignore_errors=True)
+print("FAILED:", fails)
+sys.exit(1 if fails else 0)

scripts/e2e_webui_sessions.py

@@ -0,0 +1,327 @@
+"""WebUI session management against a fake OpenAI-compatible API.
+
+  python3 scripts/e2e_webui_sessions.py      (CST_AGENT= picks the binary)
+
+Checks: retry runs the last prompt again and edit-and-resend replaces it
+(the model sees the new text, the session keeps one copy); retry is a 409
+while a turn runs and when there is nothing to retry; export returns the
+transcript as Markdown; rename, clear and delete work on the store, and
+deleting the open session moves to a new one; history messages carry the
+note / tool_result flags. HOME points at a temp dir.
+"""
+import json, os, shutil, subprocess, sys, tempfile, threading, time, urllib.request
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+
+BIN = os.environ.get("CST_AGENT", os.path.join(os.path.dirname(os.path.abspath(__file__)), "..", "cst-agent"))
+SEEN = []
+
+
+def last_prompt(msgs):
+    """The prompts are one line; a note before one shares its user message."""
+    for m in reversed(msgs):
+        c = m.get("content")
+        if m.get("role") == "user" and isinstance(c, str):
+            return c.rstrip("\n").split("\n")[-1]
+    return ""
+
+
+class Api(BaseHTTPRequestHandler):
+    """Answers "回答：<last prompt>"; a prompt with "slow" takes 2 s."""
+    def log_message(self, *a):
+        pass
+
+    def do_GET(self):
+        body = json.dumps({"data": [{"id": "deepseek-flash"}]}).encode()
+        self.send_response(200)
+        self.send_header("Content-Type", "application/json")
+        self.send_header("Content-Length", str(len(body)))
+        self.end_headers()
+        self.wfile.write(body)
+
+    def do_POST(self):
+        req = json.loads(self.rfile.read(int(self.headers.get("Content-Length", 0))) or b"{}")
+        msgs = req.get("messages", [])
+        p = last_prompt(msgs)
+        tail = msgs[-1] if msgs else {}
+        tc = tail.get("content") if isinstance(tail.get("content"), str) else ""
+        answered = tail.get("role") == "tool" or tc.startswith("result ")
+        if not answered:
+            SEEN.append(p)
+        if "slow" in p:
+            time.sleep(2)
+        self.send_response(200)
+        self.send_header("Content-Type", "text/event-stream")
+        self.end_headers()
+        if answered:
+            chunks = ({"delta": {"role": "assistant", "content": "读完了"}},
+                      {"delta": {}, "finish_reason": "stop"})
+        elif p.startswith("native"):
+            args = json.dumps({"path": "hello.txt"})
+            chunks = ({"delta": {"role": "assistant", "tool_calls": [
+                          {"index": 0, "id": "c1", "type": "function",
+                           "function": {"name": "read_file", "arguments": args}}]}},
+                      {"delta": {}, "finish_reason": "tool_calls"})
+        elif p.startswith("ctl"):
+            chunks = ({"delta": {"role": "assistant",
+                                 "content": "我来读。\ncall t1 read_file\narg path 9\nhello.txtend\n"}},
+                      {"delta": {}, "finish_reason": "stop"})
+        else:
+            chunks = ({"delta": {"role": "assistant", "content": "回答：" + p}},
+                      {"delta": {}, "finish_reason": "stop"})
+        for o in chunks:
+            chunk = {"id": "x", "object": "chat.completion.chunk", "model": "deepseek-flash",
+                     "choices": [dict(index=0, **o)]}
+            self.wfile.write(b"data: " + json.dumps(chunk, ensure_ascii=False).encode() + b"\n\n")
+            self.wfile.flush()
+        self.wfile.write(b"data: [DONE]\n\n")
+        self.wfile.flush()
+
+
+fails = 0
+
+
+def check(ok, msg):
+    global fails
+    print(("PASS " if ok else "FAIL ") + msg)
+    fails += 0 if ok else 1
+
+
+def wait(fn, t=15):
+    end = time.time() + t
+    while time.time() < end:
+        v = fn()
+        if v:
+            return v
+        time.sleep(0.1)
+    return None
+
+
+def call(base, path, obj=None, method=None, raw_reply=False):
+    data = None if obj is None else json.dumps(obj).encode()
+    req = urllib.request.Request(base + path, data=data, method=method or ("POST" if data else "GET"),
+                                 headers={"Content-Type": "application/json"})
+    try:
+        with urllib.request.urlopen(req, timeout=20) as r:
+            raw = r.read()
+            if raw_reply:
+                return r.status, r.headers.get("Content-Type", ""), raw
+            return r.status, json.loads(raw or b"{}")
+    except urllib.error.HTTPError as e:
+        raw = e.read()
+        if raw_reply:
+            return e.code, e.headers.get("Content-Type", ""), raw
+        try:
+            return e.code, json.loads(raw or b"{}")
+        except ValueError:
+            return e.code, {}
+
+
+class Sse:
+    def __init__(self, base):
+        self.lines = []
+        self.r = urllib.request.urlopen(base + "/api/events", timeout=60)
+        threading.Thread(target=self.pump, daemon=True).start()
+
+    def pump(self):
+        try:
+            for raw in self.r:
+                self.lines.append(raw)
+        except Exception:
+            pass
+
+    def count(self, name):
+        return sum(1 for l in self.lines if l.strip() == b"event: " + name.encode())
+
+    def close(self):
+        try:
+            self.r.close()
+        except Exception:
+            pass
+
+
+api = ThreadingHTTPServer(("127.0.0.1", 0), Api)
+threading.Thread(target=api.serve_forever, daemon=True).start()
+ws = tempfile.mkdtemp(prefix="cst-sess-")
+home = tempfile.mkdtemp(prefix="cst-home-")
+env = dict(os.environ, HOME=home, XDG_CONFIG_HOME=home + "/.config",
+           XDG_DATA_HOME=home + "/.local/share", XDG_CACHE_HOME=home + "/.cache")
+for k in ("DEEPSEEK_API_KEY", "OPENAI_API_KEY", "CST_API_KEY"):
+    env.pop(k, None)
+log = open(ws + "/server.log", "w+")
+proc = subprocess.Popen([BIN, "--web", "--web-port", "0", "--workspace", ws, "--new", "--api-key", "sk-x",
+                         "--provider", "deepseek", "--model", "deepseek-flash",
+                         "--api-base", "http://127.0.0.1:%d/v1" % api.server_address[1],
+                         "--protocol", "native-eos", "--approval", "auto"],
+                        stdout=log, stderr=subprocess.STDOUT, env=env)
+
+
+def port():
+    log.seek(0)
+    for l in log.read().splitlines():
+        if l.startswith("webui: http://127.0.0.1:"):
+            return l.split(":")[3].split("/")[0]
+
+
+def messages(base):
+    return call(base, "/api/session")[1].get("messages", [])
+
+
+def prompts(base):
+    return [m["content"] for m in messages(base)
+            if m["role"] == "user" and not m.get("note") and not m.get("tool_result")]
+
+
+def answers(base):
+    return [m["content"] for m in messages(base) if m["role"] == "assistant"]
+
+
+def turn(base, sse, path, body, want=202):
+    n = sse.count("turn_end")
+    code, d = call(base, path, body)
+    if code == want == 202:
+        wait(lambda: sse.count("turn_end") > n, 20)
+    return code, d
+
+
+try:
+    base = "http://127.0.0.1:%s" % wait(port)
+    sse = Sse(base)
+    time.sleep(0.3)
+
+    # 1. retry with nothing to retry, then a first turn
+    code, d = call(base, "/api/retry", {})
+    check(code == 409 and "nothing to retry" in d.get("error", ""), "retry on an empty session: 409 (%s)" % code)
+    turn(base, sse, "/api/turn", {"text": "第一句"})
+    check(prompts(base) == ["第一句"] and answers(base) == ["回答：第一句"], "first turn stored")
+
+    # 2. retry: same prompt again, one copy in the session
+    code, d = turn(base, sse, "/api/retry", {})
+    check(code == 202 and d.get("text") == "第一句", "retry accepted (%s %s)" % (code, d))
+    check(SEEN[-1] == "第一句", "the model saw the same prompt again")
+    check(prompts(base) == ["第一句"] and answers(base) == ["回答：第一句"],
+          "after retry: one prompt, one answer (%s)" % prompts(base))
+
+    # 3. edit and resend: the new text replaces the old
+    code, d = turn(base, sse, "/api/retry", {"text": "改过的问题"})
+    check(code == 202 and d.get("text") == "改过的问题", "edit-and-resend accepted")
+    check(SEEN[-1] == "改过的问题", "the model saw the edited prompt")
+    check(prompts(base) == ["改过的问题"] and answers(base) == ["回答：改过的问题"],
+          "after edit: %s / %s" % (prompts(base), answers(base)))
+    check(call(base, "/api/retry", {"text": ""})[0] == 400, "an empty edit is a 400")
+    check(call(base, "/api/retry", {"text": 5})[0] == 400, "a non-string edit is a 400")
+
+    # 4. a second turn, then retry only touches the last one
+    turn(base, sse, "/api/turn", {"text": "第二句"})
+    turn(base, sse, "/api/retry", {})
+    check(prompts(base) == ["改过的问题", "第二句"] and len(answers(base)) == 2,
+          "retry keeps earlier turns: %s" % prompts(base))
+
+    # 5. retry while a turn runs is a 409
+    n = sse.count("turn_end")
+    call(base, "/api/turn", {"text": "slow 请慢一点"})
+    code, d = call(base, "/api/retry", {})
+    check(code == 409, "retry during a turn: 409 (%s)" % code)
+    wait(lambda: sse.count("turn_end") > n, 20)
+
+    # 6. a note (plan mode changed mid-session) is flagged, and retry skips it
+    call(base, "/api/config", {"plan_mode": True})
+    turn(base, sse, "/api/turn", {"text": "计划一下"})
+    ms = messages(base)
+    notes = [m for m in ms if m.get("note")]
+    check(len(notes) >= 1 and all(m["role"] == "user" for m in notes),
+          "a mid-session note is flagged note:true (%d)" % len(notes))
+    turn(base, sse, "/api/retry", {})
+    check(SEEN[-1] == "计划一下" and prompts(base)[-1] == "计划一下", "retry after a note reruns the prompt")
+    call(base, "/api/config", {"plan_mode": False})
+
+    # 7. export
+    code, ctype, raw = call(base, "/api/export", raw_reply=True)
+    md = raw.decode("utf-8", "replace")
+    check(code == 200 and ctype.startswith("text/markdown"), "export: %s %s" % (code, ctype))
+    check(md.startswith("# ") and "## User" in md and "改过的问题" in md and "## Assistant" in md
+          and "回答：第二句" in md and "第一句" not in md, "export has the transcript")
+
+    # 8. rename and clear
+    st = call(base, "/api/state")[1]
+    cur = st.get("session")
+    code, _ = call(base, "/api/sessions/rename", {"title": "我的会话"})
+    check(code == 200, "rename the open session")
+    ss = call(base, "/api/sessions")[1]
+    check(any(s["id"] == cur and s["title"] == "我的会话" for s in ss.get("sessions", [])),
+          "the list shows the new title")
+    code, _, raw = call(base, "/api/export", raw_reply=True)
+    check(raw.decode("utf-8", "replace").startswith("# 我的会话"), "export uses the title")
+    long = "长" * 100
+    call(base, "/api/sessions/rename", {"id": cur, "title": long})
+    t = [s["title"] for s in call(base, "/api/sessions")[1]["sessions"] if s["id"] == cur][0]
+    check(0 < len(t.encode()) <= 120 and t == "长" * len(t), "a long title is cut on a character (%d bytes)"
+          % len(t.encode()))
+    call(base, "/api/sessions/rename", {"title": ""})
+    t = [s["title"] for s in call(base, "/api/sessions")[1]["sessions"] if s["id"] == cur][0]
+    check(t == "改过的问题", "an empty title falls back to the first prompt (%r)" % t)
+    check(call(base, "/api/sessions/rename", {"id": "nope", "title": "x"})[0] == 404, "rename unknown: 404")
+    check(call(base, "/api/sessions/rename", {"id": "../x", "title": "x"})[0] == 404, "rename ../x: 404")
+    check(call(base, "/api/sessions/rename", {})[0] == 400, "rename without a title: 400")
+
+    # 9. delete another session, then the open one
+    code, d = call(base, "/api/sessions/new", {})
+    second = d.get("id")
+    check(code == 200 and second and second != cur, "a second session")
+    code, d = call(base, "/api/sessions/delete", {"id": cur})
+    check(code == 200 and d.get("current") == second, "delete a closed session (%s %s)" % (code, d))
+    ids = [s["id"] for s in call(base, "/api/sessions")[1]["sessions"]]
+    check(cur not in ids and not os.path.exists(os.path.join(ws, ".agent", "sessions", cur + ".jsonl")),
+          "it is gone from the list and the disk")
+    n = sse.count("session")
+    code, d = call(base, "/api/sessions/delete", {"id": second})
+    check(code == 200 and d.get("current") and d["current"] != second, "delete the open session (%s)" % d)
+    check(call(base, "/api/state")[1].get("session") == d.get("current"), "the state moved to the new one")
+    check(wait(lambda: sse.count("session") > n, 5), "a session event was sent")
+    check(call(base, "/api/sessions/delete", {"id": "nope"})[0] == 404, "delete unknown: 404")
+    check(call(base, "/api/sessions/delete", {})[0] == 400, "delete without an id: 400")
+
+    # 10. history: calls and results come back apart, for native and ctl
+    with open(os.path.join(ws, "hello.txt"), "w", encoding="utf-8") as f:
+        f.write("你好世界\n")
+    turn(base, sse, "/api/turn", {"text": "native 读文件"})
+    ms = messages(base)
+    a = [m for m in ms if m["role"] == "assistant" and m.get("calls")]
+    r = [m for m in ms if m.get("tool_result")]
+    check(len(a) == 1 and a[0]["calls"][0].get("name") == "read_file"
+          and a[0]["calls"][0].get("args", {}).get("path") == "hello.txt" and a[0]["calls"][0].get("id") == "c1",
+          "native: the call is listed with its args (%s)" % (a[0].get("calls") if a else ms))
+    check(len(r) == 1 and r[0]["role"] == "tool" and r[0].get("tool_call_id") == "c1"
+          and "你好世界" in r[0].get("out", "") and not r[0]["out"].startswith("[tool ")
+          and r[0].get("exit") == 0 and r[0].get("truncated") is False,
+          "native: the result carries out/exit without the header (%s)" % r)
+    check(answers(base)[-1] == "读完了", "native: the turn finished")
+
+    check(call(base, "/api/settings", {"protocol": "ctl"})[0] == 200, "switch to the ctl protocol")
+    turn(base, sse, "/api/turn", {"text": "ctl 读文件"})
+    ms = messages(base)
+    a = [m for m in ms if m["role"] == "assistant" and m.get("calls") and m["calls"][0].get("id") == "t1"]
+    r = [m for m in ms if m.get("tool_result") and m.get("tool_call_id") == "t1"]
+    check(len(a) == 1 and a[0].get("text", "").strip() == "我来读。" and "call t1" in a[0]["content"]
+          and a[0]["calls"][0].get("args", {}).get("path") == "hello.txt"
+          and "call t1" not in a[0].get("html", ""),
+          "ctl: prose and calls are split (%s)" % (a[0] if a else ms[-4:]))
+    check(len(r) == 1 and r[0]["role"] == "user" and "你好世界" in r[0].get("out", "")
+          and not r[0]["out"].startswith("result ") and not r[0]["out"].endswith("end")
+          and r[0].get("exit") == 0,
+          "ctl: the result is flagged with out/exit (%s)" % r)
+    check(r and r[0]["content"] not in prompts(base), "ctl: the result is not a prompt")
+    call(base, "/api/settings", {"protocol": "native-eos"})
+    sse.close()
+finally:
+    proc.terminate()
+    try:
+        proc.wait(20)
+    except subprocess.TimeoutExpired:
+        proc.kill()
+        check(False, "server hung on SIGTERM")
+    log.close()
+    shutil.rmtree(ws, ignore_errors=True)
+    shutil.rmtree(home, ignore_errors=True)
+    api.shutdown()
+print("FAILED:", fails)
+sys.exit(1 if fails else 0)

scripts/e2e_webui_settings.py

@@ -0,0 +1,313 @@
+"""WebUI settings and streaming against fake OpenAI-compatible APIs.
+
+  python3 scripts/e2e_webui_settings.py      (CST_AGENT= picks the binary)
+
+Checks: Chinese reasoning streams as whole characters in few events; the
+provider list, the model list with capabilities, config validation and
+persistence; a wrong key is rejected, a good one switches the provider
+(requests then go to the new base URL) and is saved; and all of it
+survives a restart. HOME and XDG_CONFIG_HOME point at a temp dir, so no
+real credentials or settings are read or written.
+"""
+import json, os, shutil, stat, subprocess, sys, tempfile, threading, time, urllib.request
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+
+BIN = os.environ.get("CST_AGENT", os.path.join(os.path.dirname(os.path.abspath(__file__)), "..", "cst-agent"))
+THINK = ["好的，我先看看工作区里", "有哪些文件，然后用中文", "回答这个问题。😀 结束"]
+ANSWER = "这是中文回答。"
+GOOD_KEYS = {"sk-good", "sk-good2"}
+B_REQS = []
+
+
+def sse_reply(h, model, think, answer):
+    h.send_response(200)
+    h.send_header("Content-Type", "text/event-stream")
+    h.end_headers()
+    base = {"id": "x", "object": "chat.completion.chunk", "model": model}
+
+    def ev(o):
+        h.wfile.write(b"data: " + json.dumps({**base, **o}, ensure_ascii=False).encode() + b"\n\n")
+        h.wfile.flush()
+    for part in think:
+        ev({"choices": [{"index": 0, "delta": {"role": "assistant", "reasoning_content": part}}]})
+    ev({"choices": [{"index": 0, "delta": {"content": answer}}]})
+    ev({"choices": [{"index": 0, "delta": {}, "finish_reason": "stop"}]})
+    h.wfile.write(b"data: [DONE]\n\n")
+    h.wfile.flush()
+
+
+def send_json(h, code, obj):
+    body = json.dumps(obj).encode()
+    h.send_response(code)
+    h.send_header("Content-Type", "application/json")
+    h.send_header("Content-Length", str(len(body)))
+    h.end_headers()
+    h.wfile.write(body)
+
+
+class A(BaseHTTPRequestHandler):
+    """The starting provider: any key, one model, Chinese reasoning."""
+    def log_message(self, *a):
+        pass
+
+    def do_GET(self):
+        send_json(self, 200, {"data": [{"id": "deepseek-flash"}]})
+
+    def do_POST(self):
+        self.rfile.read(int(self.headers.get("Content-Length", 0)))
+        sse_reply(self, "deepseek-flash", THINK, ANSWER)
+
+
+class B(BaseHTTPRequestHandler):
+    """The provider switched to: /models checks the key."""
+    def log_message(self, *a):
+        pass
+
+    def key_ok(self):
+        auth = self.headers.get("Authorization", "")
+        return auth.startswith("Bearer ") and auth[7:] in GOOD_KEYS
+
+    def do_GET(self):
+        if not self.key_ok():
+            return send_json(self, 401, {"error": {"message": "invalid api key"}})
+        send_json(self, 200, {"data": [{"id": "fake-vis"}, {"id": "fake-text"}]})
+
+    def do_POST(self):
+        body = json.loads(self.rfile.read(int(self.headers.get("Content-Length", 0))) or b"{}")
+        B_REQS.append({"auth": self.headers.get("Authorization", ""), "model": body.get("model")})
+        if not self.key_ok():
+            return send_json(self, 401, {"error": {"message": "invalid api key"}})
+        sse_reply(self, body.get("model") or "fake-vis", [], "B 的回答")
+
+
+fails = 0
+
+
+def check(ok, msg):
+    global fails
+    print(("PASS " if ok else "FAIL ") + msg)
+    fails += 0 if ok else 1
+
+
+class Sse:
+    def __init__(self, base):
+        self.lines = []
+        self.r = urllib.request.urlopen(base + "/api/events", timeout=60)
+        threading.Thread(target=self.pump, daemon=True).start()
+
+    def pump(self):
+        try:
+            for raw in self.r:
+                self.lines.append(raw)
+        except Exception:
+            pass
+
+    def events(self, name):
+        out = []
+        for i, l in enumerate(self.lines):
+            if l.strip() == b"event: " + name.encode() and i + 1 < len(self.lines):
+                out.append(self.lines[i + 1][6:])
+        return out
+
+    def close(self):
+        try:
+            self.r.close()
+        except Exception:
+            pass
+
+
+def wait(fn, t=15):
+    end = time.time() + t
+    while time.time() < end:
+        v = fn()
+        if v:
+            return v
+        time.sleep(0.1)
+    return None
+
+
+def call(base, path, obj=None, method=None):
+    data = None if obj is None else json.dumps(obj).encode()
+    req = urllib.request.Request(base + path, data=data, method=method or ("POST" if data else "GET"),
+                                 headers={"Content-Type": "application/json"})
+    try:
+        with urllib.request.urlopen(req, timeout=20) as r:
+            raw = r.read()
+            return r.status, json.loads(raw or b"{}"), raw
+    except urllib.error.HTTPError as e:
+        raw = e.read()
+        try:
+            return e.code, json.loads(raw or b"{}"), raw
+        except ValueError:
+            return e.code, {}, raw
+
+
+def serve(handler):
+    s = ThreadingHTTPServer(("127.0.0.1", 0), handler)
+    threading.Thread(target=s.serve_forever, daemon=True).start()
+    return s
+
+
+api_a, api_b = serve(A), serve(B)
+ws = tempfile.mkdtemp(prefix="cst-set-")
+home = tempfile.mkdtemp(prefix="cst-home-")
+cfgdir = home + "/.config/cst-agent"
+os.makedirs(cfgdir)
+with open(cfgdir + "/models.json", "w") as f:
+    json.dump({"providers": {"fakeb": {"api_base": "http://127.0.0.1:%d/v1" % api_b.server_address[1],
+                                       "key_env": "FAKEB_API_KEY", "default_model": ""}},
+               "models": [{"match": "fake-vis", "vision": True, "context": 200000},
+                          {"match": "fake-text", "vision": False}]}, f)
+env = dict(os.environ, HOME=home, XDG_CONFIG_HOME=home + "/.config",
+           XDG_DATA_HOME=home + "/.local/share", XDG_CACHE_HOME=home + "/.cache")
+for k in ("DEEPSEEK_API_KEY", "FAKEB_API_KEY", "OPENAI_API_KEY", "CST_API_KEY"):
+    env.pop(k, None)
+procs = []
+
+
+def start(args, tag):
+    log = open("%s/%s.log" % (ws, tag), "w+")
+    p = subprocess.Popen([BIN, "--web", "--web-port", "0", "--workspace", ws] + args,
+                         stdout=log, stderr=subprocess.STDOUT, env=env)
+    procs.append((p, log))
+
+    def port():
+        log.seek(0)
+        for l in log.read().splitlines():
+            if l.startswith("webui: http://127.0.0.1:"):
+                return l.split(":")[3].split("/")[0]
+    pt = wait(port)
+    return p, "http://127.0.0.1:%s" % pt
+
+
+def stop(p):
+    p.terminate()
+    try:
+        p.wait(20)
+    except subprocess.TimeoutExpired:
+        p.kill()
+        check(False, "server hung on SIGTERM")
+    check(p.returncode is not None and 0 <= p.returncode < 128, "clean exit (%s)" % p.returncode)
+
+
+def leaked(raw):
+    return any(k.encode() in raw for k in GOOD_KEYS | {"sk-bad", "sk-x"})
+
+
+try:
+    p, base = start(["--new", "--api-key", "sk-x", "--provider", "deepseek", "--model", "deepseek-flash",
+                     "--api-base", "http://127.0.0.1:%d/v1" % api_a.server_address[1],
+                     "--protocol", "native-eos", "--approval", "auto"], "first")
+    a = Sse(base)
+    time.sleep(0.3)
+
+    # 1. Chinese reasoning: whole characters, a handful of events
+    code, _, _ = call(base, "/api/turn", {"text": "用中文想一想"})
+    check(code == 202, "turn accepted")
+    end = wait(lambda: a.events("turn_end"), 20)
+    check(bool(end) and json.loads(end[0]).get("rc") == 0, "turn ended rc=0")
+    raw = a.events("think_delta")
+    ok = True
+    for r in raw:
+        try:
+            r.decode("utf-8")
+        except UnicodeDecodeError:
+            ok = False
+    check(ok, "every think_delta frame is valid UTF-8")
+    text = "".join(json.loads(r.decode("utf-8", "replace"))["text"] for r in raw)
+    want = "".join(THINK)
+    check(text == want and "\ufffd" not in text, "the thinking text round trips: %r" % text[:60])
+    check(0 < len(raw) <= 2 * len(THINK) + 2,
+          "think_delta events: %d for %d bytes" % (len(raw), len(want.encode())))
+    ans = "".join(json.loads(r)["text"] for r in a.events("assistant_delta"))
+    check(ans == ANSWER, "the answer round trips: %r" % ans)
+
+    # 2. providers and models
+    code, d, rawp = call(base, "/api/providers")
+    names = {x["name"]: x for x in d.get("providers", [])}
+    check(code == 200 and "deepseek" in names and "fakeb" in names, "provider list: %s" % sorted(names))
+    check(names.get("deepseek", {}).get("current") and names["deepseek"].get("has_key")
+          and names["deepseek"].get("key_from") == "session", "deepseek: current, key for this run")
+    check(names.get("fakeb", {}).get("has_key") is False and names["fakeb"].get("source") == "user",
+          "fakeb: no key yet, from models.json")
+    check(not leaked(rawp), "no key in /api/providers")
+    code, d, _ = call(base, "/api/models")
+    ids = [m["id"] for m in d.get("models", [])]
+    first = (d.get("models") or [{}])[0]
+    check(code == 200 and "deepseek-flash" in ids and first.get("api") is True
+          and "context" in first and "label" in first, "model list: %s" % ids[:5])
+
+    # 3. config: validation and persistence
+    check(call(base, "/api/config", {"effort": "bogus"})[0] == 400, "a bad effort is a 400")
+    check(call(base, "/api/config", {"provider": "fakeb"})[0] == 400, "provider via /api/config is a 400")
+    check(call(base, "/api/config", {"model": ""})[0] == 400, "an empty model is a 400")
+    code, d, _ = call(base, "/api/config", {"model": "deepseek-v4-pro", "effort": "high"})
+    check(code == 200 and d.get("ok"), "model + effort accepted")
+    code, s, _ = call(base, "/api/state")
+    check(s.get("model") == "deepseek-v4-pro" and s.get("effort") == "high", "the state has them")
+    check(s.get("effort_applies") is True and s.get("key_set") is True and "model_info" in s
+          and s.get("perm_timeout", 0) > 0 and "turn_usage" in s, "the state has the new fields")
+    st = open(cfgdir + "/settings.json").read() if os.path.exists(cfgdir + "/settings.json") else ""
+    check("deepseek-v4-pro" in st and "high" in st, "settings.json remembers model and effort")
+
+    # 4. switching provider: no key, a wrong key, a good key
+    code, d, _ = call(base, "/api/provider", {"name": "fakeb"})
+    check(code == 400 and d.get("need_key"), "fakeb without a key: need_key (%s)" % code)
+    code, d, rawp = call(base, "/api/provider", {"name": "fakeb", "key": "sk-bad"})
+    check(code == 401 and "拒绝" in d.get("error", ""), "a wrong key is rejected (%s %s)" % (code, d.get("error")))
+    check(not leaked(rawp), "no key in the rejection")
+    check(call(base, "/api/state")[1].get("provider") == "deepseek", "still on deepseek")
+    check(call(base, "/api/provider", {"name": "nope"})[0] == 404, "an unknown provider is a 404")
+    code, d, rawp = call(base, "/api/provider", {"name": "fakeb", "key": "sk-good"})
+    check(code == 200 and d.get("provider") == "fakeb" and d.get("model") == "fake-vis",
+          "switched to fakeb, first listed model picked (%s %s)" % (code, d))
+    check(not leaked(rawp), "no key in the switch reply")
+    creds = cfgdir + "/credentials"
+    cr = open(creds).read() if os.path.exists(creds) else ""
+    check("fakeb.api_key=sk-good" in cr, "the key was saved to credentials")
+    if os.name == "posix" and os.path.exists(creds):
+        check(stat.S_IMODE(os.stat(creds).st_mode) == 0o600, "credentials is 0600")
+    code, d, _ = call(base, "/api/models")
+    ms = {m["id"]: m for m in d.get("models", [])}
+    check("fake-vis" in ms and ms["fake-vis"].get("vision") is True and ms["fake-vis"].get("context") == 200000
+          and ms.get("fake-text", {}).get("vision") is False, "fakeb models with capabilities")
+    code, d, _ = call(base, "/api/config", {"effort": "low"})
+    check(code == 200 and d.get("warning"), "effort on a model without it: saved with a warning")
+
+    # 5. a turn now goes to the new base URL with the new key
+    n0 = len(B_REQS)
+    code, _, _ = call(base, "/api/turn", {"text": "hi B"})
+    check(code == 202, "turn on fakeb accepted")
+    wait(lambda: len(a.events("turn_end")) >= 2, 20)
+    check(len(B_REQS) > n0 and B_REQS[-1]["auth"] == "Bearer sk-good" and B_REQS[-1]["model"] == "fake-vis",
+          "the request reached fakeb: %s" % (B_REQS[-1:] or "none"))
+
+    # 6. replacing the key
+    code, d, _ = call(base, "/api/key", {"key": "sk-bad"})
+    check(code == 401, "a wrong replacement key is rejected (%s)" % code)
+    code, d, _ = call(base, "/api/key", {"key": "sk-good2"})
+    check(code == 200 and d.get("ok"), "the replacement key is accepted")
+    check("fakeb.api_key=sk-good2" in open(creds).read(), "the replacement key was saved")
+    check(call(base, "/api/key", {})[0] == 400, "an empty key body is a 400")
+    a.close()
+    stop(p)
+
+    # 7. the next start remembers provider, model and key
+    p, base = start(["--new"], "second")
+    code, s, raws = call(base, "/api/state")
+    check(s.get("provider") == "fakeb" and s.get("model") == "fake-vis" and s.get("key_set") is True
+          and s.get("key_from") == "saved", "restart: %s/%s key %s" % (s.get("provider"), s.get("model"), s.get("key_from")))
+    check(not leaked(raws), "no key in /api/state")
+    stop(p)
+
+    logs = b"".join(open(lg.name, "rb").read() for _, lg in procs)
+    check(not leaked(logs.replace(b"sk-x", b"")) , "no key in the server logs")
+finally:
+    for p, log in procs:
+        if p.poll() is None:
+            p.kill()
+        log.close()
+    shutil.rmtree(ws, ignore_errors=True)
+    shutil.rmtree(home, ignore_errors=True)
+print("FAILED:", fails)
+sys.exit(1 if fails else 0)

scripts/e2e_webui_workspace.py

@@ -0,0 +1,206 @@
+"""WebUI workspace views: git diff, run settings, saved permission rules.
+
+  python3 scripts/e2e_webui_workspace.py     (CST_AGENT= picks the binary)
+
+Checks: /api/diff lists git status and the working-tree diff (per file too),
+an option-looking path is only ever a path, and a directory without git
+says so; /api/settings reports protocol, tools, confirmations and the
+sandbox, rejects a bad body without applying any of it, applies a good one,
+and is a 409 while a turn runs; /api/permissions shows the saved rules and
+DELETE clears them. HOME points at a temp dir.
+"""
+import json, os, shutil, subprocess, sys, tempfile, threading, time, urllib.request
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+
+BIN = os.environ.get("CST_AGENT", os.path.join(os.path.dirname(os.path.abspath(__file__)), "..", "cst-agent"))
+
+
+class Api(BaseHTTPRequestHandler):
+    """A slow plain answer, so a turn is running for a while."""
+    def log_message(self, *a):
+        pass
+
+    def do_POST(self):
+        self.rfile.read(int(self.headers.get("Content-Length", 0)))
+        time.sleep(2)
+        self.send_response(200)
+        self.send_header("Content-Type", "text/event-stream")
+        self.end_headers()
+        for o in ({"delta": {"role": "assistant", "content": "好"}}, {"delta": {}, "finish_reason": "stop"}):
+            chunk = {"id": "x", "object": "chat.completion.chunk", "model": "m", "choices": [dict(index=0, **o)]}
+            self.wfile.write(b"data: " + json.dumps(chunk, ensure_ascii=False).encode() + b"\n\n")
+        self.wfile.write(b"data: [DONE]\n\n")
+
+
+fails = 0
+
+
+def check(ok, msg):
+    global fails
+    print(("PASS " if ok else "FAIL ") + msg)
+    fails += 0 if ok else 1
+
+
+def wait(fn, t=15):
+    end = time.time() + t
+    while time.time() < end:
+        v = fn()
+        if v:
+            return v
+        time.sleep(0.1)
+    return None
+
+
+def call(base, path, obj=None, method=None):
+    data = None if obj is None else json.dumps(obj).encode()
+    req = urllib.request.Request(base + path, data=data, method=method or ("POST" if data else "GET"),
+                                 headers={"Content-Type": "application/json"})
+    try:
+        with urllib.request.urlopen(req, timeout=30) as r:
+            return r.status, json.loads(r.read() or b"{}")
+    except urllib.error.HTTPError as e:
+        raw = e.read()
+        try:
+            return e.code, json.loads(raw or b"{}")
+        except ValueError:
+            return e.code, {}
+
+
+def git(*args):
+    return subprocess.run(["git", "-C", ws] + list(args), capture_output=True, text=True)
+
+
+api = ThreadingHTTPServer(("127.0.0.1", 0), Api)
+threading.Thread(target=api.serve_forever, daemon=True).start()
+ws = tempfile.mkdtemp(prefix="cst-ws-")
+plain = tempfile.mkdtemp(prefix="cst-nogit-")
+home = tempfile.mkdtemp(prefix="cst-home-")
+env = dict(os.environ, HOME=home, XDG_CONFIG_HOME=home + "/.config",
+           XDG_DATA_HOME=home + "/.local/share", XDG_CACHE_HOME=home + "/.cache",
+           GIT_CONFIG_NOSYSTEM="1")
+for k in ("DEEPSEEK_API_KEY", "OPENAI_API_KEY", "CST_API_KEY"):
+    env.pop(k, None)
+have_git = shutil.which("git") is not None
+if have_git:
+    git("init", "-q")
+    git("config", "user.email", "e2e@example.com")
+    git("config", "user.name", "e2e")
+    open(ws + "/a.txt", "w").write("one\n")
+    git("add", "a.txt")
+    git("commit", "-q", "-m", "first")
+    open(ws + "/a.txt", "w").write("one\n第二行\n")
+    open(ws + "/new.txt", "w").write("new\n")
+os.makedirs(ws + "/.agent", exist_ok=True)
+json.dump({"tools": ["write_file"], "shell_prefixes": ["make"]}, open(ws + "/.agent/permissions.json", "w"))
+
+log = open(home + "/server.log", "w+")
+proc = subprocess.Popen([BIN, "--web", "--web-port", "0", "--workspace", ws, "--new", "--api-key", "sk-x",
+                         "--provider", "deepseek", "--model", "deepseek-flash",
+                         "--api-base", "http://127.0.0.1:%d/v1" % api.server_address[1],
+                         "--protocol", "native-eos", "--approval", "auto"],
+                        stdout=log, stderr=subprocess.STDOUT, env=env)
+
+
+def port():
+    log.seek(0)
+    for l in log.read().splitlines():
+        if l.startswith("webui: http://127.0.0.1:"):
+            return l.split(":")[3].split("/")[0]
+
+
+try:
+    base = "http://127.0.0.1:%s" % wait(port)
+
+    # 1. diff
+    if have_git:
+        code, d = call(base, "/api/diff")
+        files = {f["path"]: f["status"] for f in d.get("files", [])}
+        check(code == 200 and d.get("git") is True, "diff: git repo seen")
+        check(files.get("a.txt") == " M" and files.get("new.txt") == "??", "status lists both files: %s" % files)
+        check("+第二行" in d.get("diff", "") and "a.txt" in d.get("diff", ""), "the diff has the change")
+        code, d = call(base, "/api/diff?path=a.txt")
+        check(code == 200 and "+第二行" in d.get("diff", "") and d.get("path") == "a.txt", "diff of one file")
+        code, d = call(base, "/api/diff?path=new.txt")
+        check(code == 200 and d.get("diff") == "", "an untracked file has no diff")
+        evil = ws + "/pwned"
+        code, d = call(base, "/api/diff?path=" + urllib.request.quote("--output=" + evil))
+        check(code == 200 and not os.path.exists(evil), "an option-looking path stays a path")
+    else:
+        print("SKIP diff checks: no git")
+
+    # 2. settings: what is there
+    code, s = call(base, "/api/settings")
+    names = [t["name"] for t in s.get("tools", [])]
+    check(code == 200 and s.get("protocol") == "native-eos" and len(s.get("protocols", [])) == 5,
+          "settings: protocol %s of %s" % (s.get("protocol"), s.get("protocols")))
+    check("read_file" in names and all("perm" in t and "on" in t for t in s["tools"]), "tool list: %d tools" % len(names))
+    check(set(s.get("confirm", {})) == {"shell", "write", "net"}, "confirm flags present")
+    check(isinstance(s.get("sandbox", {}).get("kind"), str), "sandbox kind: %s" % s.get("sandbox"))
+    victim = next((t["name"] for t in s["tools"] if t["perm"] == "net"), names[-1])
+
+    # 3. a bad body changes nothing
+    for body, why in (({"protocol": "nope"}, "unknown protocol"), ({"max_steps": 0}, "max_steps 0"),
+                      ({"max_steps": "5"}, "max_steps as text"), ({"tool_profile": "huge"}, "unknown profile"),
+                      ({"tools": {"nope": False}}, "unknown tool"), ({"tools": {victim: "off"}}, "tool value not bool"),
+                      ({"confirm": {"disk": True}}, "unknown confirm key"),
+                      ({"max_steps": 9, "protocol": "nope"}, "mixed good and bad")):
+        check(call(base, "/api/settings", body)[0] == 400, "400 for %s" % why)
+    check(call(base, "/api/settings")[1].get("max_steps") == s.get("max_steps"), "nothing applied from a bad body")
+
+    # 4. a good body applies
+    code, d = call(base, "/api/settings", {"protocol": "ctl", "max_steps": 7, "tool_profile": "minimal",
+                                            "tools": {victim: False}, "confirm": {"shell": True, "net": False}})
+    check(code == 200 and d.get("ok"), "settings accepted (%s %s)" % (code, d))
+    code, s2 = call(base, "/api/settings")
+    t2 = {t["name"]: t for t in s2.get("tools", [])}
+    check(s2.get("protocol") == "ctl" and s2.get("max_steps") == 7 and s2.get("tool_profile") == "minimal",
+          "protocol/steps/profile applied")
+    check(t2.get(victim, {}).get("off") is True and t2[victim]["on"] is False, "%s switched off" % victim)
+    check(s2["confirm"]["shell"] is True and s2["confirm"]["net"] is False, "confirm flags applied")
+    st = call(base, "/api/state")[1]
+    check(st.get("protocol_tools") == "ctl" and st.get("max_steps") == 7 and st.get("tool_profile") == "minimal",
+          "the state shows them")
+    call(base, "/api/settings", {"protocol": "native-eos", "tool_profile": "default", "tools": {victim: True}})
+    t3 = {t["name"]: t for t in call(base, "/api/settings")[1]["tools"]}
+    check(t3[victim]["off"] is False and t3[victim]["on"] is True, "%s back on" % victim)
+
+    # 5. permissions
+    code, p = call(base, "/api/permissions")
+    check(code == 200 and p.get("tools") == ["write_file"] and p.get("shell_prefixes") == ["make"]
+          and "write_file" in p.get("rules", ""), "saved rules: %s %s" % (p.get("tools"), p.get("shell_prefixes")))
+    code, _ = call(base, "/api/permissions", method="DELETE")
+    check(code == 200, "DELETE /api/permissions")
+    p = call(base, "/api/permissions")[1]
+    check(p.get("tools") == [] and p.get("shell_prefixes") == [], "the rules are gone")
+    saved = json.load(open(ws + "/.agent/permissions.json"))
+    check(saved.get("tools") == [] and saved.get("shell_prefixes") == [], "and gone from the file")
+
+    # 6. while a turn runs: settings and the rule reset are 409, reads still work
+    code, _ = call(base, "/api/turn", {"text": "慢慢来"})
+    check(code == 202, "a slow turn started")
+    check(call(base, "/api/settings", {"max_steps": 3})[0] == 409, "settings during a turn: 409")
+    check(call(base, "/api/permissions", method="DELETE")[0] == 409, "rule reset during a turn: 409")
+    check(call(base, "/api/settings")[0] == 200 and call(base, "/api/permissions")[0] == 200,
+          "reads during a turn: 200")
+    if have_git:
+        check(call(base, "/api/diff")[0] == 200, "diff during a turn: 200")
+    wait(lambda: not call(base, "/api/state")[1].get("status_busy"), 20)
+
+    # 7. a directory without git
+    if have_git:
+        code, _ = call(base, "/api/workspace", {"path": plain})
+        code, d = call(base, "/api/diff")
+        check(code == 200 and d.get("git") is False and "diff" not in d, "no git repo: git=false")
+finally:
+    proc.terminate()
+    try:
+        proc.wait(20)
+    except subprocess.TimeoutExpired:
+        proc.kill()
+        check(False, "server hung on SIGTERM")
+    log.close()
+    for d in (ws, plain, home):
+        shutil.rmtree(d, ignore_errors=True)
+    api.shutdown()
+print("FAILED:", fails)
+sys.exit(1 if fails else 0)

scripts/tui_keys/provider.py

@@ -0,0 +1,65 @@
+"""TUI /provider and /key against a fake API whose /models checks the key.
+
+  nix-shell -p python3Packages.pyte --run "python3 scripts/tui_keys/provider.py"
+
+A wrong key is asked for again, a good one is saved and switches the
+provider; /key replaces it. Same code path as the WebUI (provider_switch.c).
+"""
+import json, os, sys, threading
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+from harness import Term
+from keys import check, base
+
+GOOD = {"sk-good", "sk-good2"}
+
+
+class B(BaseHTTPRequestHandler):
+    def log_message(self, *a):
+        pass
+
+    def do_GET(self):
+        auth = self.headers.get("Authorization", "")
+        ok = auth.startswith("Bearer ") and auth[7:] in GOOD
+        body = json.dumps({"data": [{"id": "fake-one"}]} if ok else {"error": {"message": "bad key"}}).encode()
+        self.send_response(200 if ok else 401)
+        self.send_header("Content-Type", "application/json")
+        self.send_header("Content-Length", str(len(body)))
+        self.end_headers()
+        self.wfile.write(body)
+
+
+srv = ThreadingHTTPServer(("127.0.0.1", 0), B)
+threading.Thread(target=srv.serve_forever, daemon=True).start()
+
+t = Term(args=("-b", base, "-k", "sk-test"))
+cfg = os.path.join(t.home, ".config", "cst-agent")
+os.makedirs(cfg, exist_ok=True)
+t.close()
+with open(os.path.join(cfg, "models.json"), "w") as f:
+    json.dump({"providers": {"fakeb": {"api_base": "http://127.0.0.1:%d/v1" % srv.server_address[1],
+                                       "key_env": "FAKEB_API_KEY", "default_model": ""}}}, f)
+t = Term(args=("-b", base, "-k", "sk-test"), home=t.home, env={"FAKEB_API_KEY": ""})
+creds = os.path.join(cfg, "credentials")
+
+
+def screen():
+    return "\n".join(t.lines())
+
+
+t.send("/provider fakeb\r", 0.8)
+check("a key prompt for fakeb", "API key for fakeb" in screen(), t)
+t.send("sk-bad\r", 1.5)
+check("a wrong key is asked for again", "rejected that key" in screen(), t)
+check("the wrong key is not saved", not os.path.exists(creds) or "sk-bad" not in open(creds).read(), t)
+t.send("sk-good\r", 2.0)
+check("switched to fakeb", "provider → fakeb" in screen(), t)
+check("the good key is saved", os.path.exists(creds) and "fakeb.api_key=sk-good" in open(creds).read(), t)
+check("no key on screen", "sk-good" not in screen() and "sk-bad" not in screen(), t)
+t.send("/key\r", 0.8)
+t.send("sk-good2\r", 2.0)
+check("/key replaces it", "fakeb.api_key=sk-good2" in open(creds).read(), t)
+t.close()
+from keys import FAILS
+print("FAILED:", len(FAILS))
+sys.exit(min(len(FAILS), 100))

src/agent_loop.c

@@ -1282,13 +1282,22 @@ static void on_mm(const ctl_event_t *ev, void *ud) {
 }
 
 static void feed_visible(turn_t *t, const char *data, size_t len) {
-  if (!len || t->stop)
+  /* cut after each '\n' and '>': a call only becomes ready there, and
-    return;
+   * raw_mark must not take in what follows it in the same chunk */
-  cst_buf_append(&t->raw, data, len);
+  while (len && !t->stop) {
+    size_t n = 0;
+    while (n < len && data[n] != '\n' && data[n] != '>')
+      n++;
+    if (n < len)
+      n++;
+    cst_buf_append(&t->raw, data, n);
     if (t->ctl)
-    ctl_parser_feed(t->ctl, data, len);
+      ctl_parser_feed(t->ctl, data, n);
     else if (t->mm)
-    mm_scan_feed(t->mm, data, len);
+      mm_scan_feed(t->mm, data, n);
+    data += n;
+    len -= n;
+  }
 }
 
 static void think_out(turn_t *t, const char *s, size_t n) {
@@ -1306,10 +1315,16 @@ static void on_delta(const char *data, size_t len, void *ud) {
     const char *want = t->in_think ? "</think>" : "<think>";
     size_t wl = strlen(want);
     if (t->taglen == 0 && c != '<') {
+      /* the whole run up to the next '<' in one call: byte by byte, a
+       * front end would get every CJK character in three invalid pieces */
+      size_t j = i + 1;
+      while (j < len && data[j] != '<')
+        j++;
       if (t->in_think)
-        think_out(t, &c, 1);
+        think_out(t, data + i, j - i);
       else
-        feed_visible(t, &c, 1);
+        feed_visible(t, data + i, j - i);
+      i = j - 1;
       continue;
     }
     t->tagbuf[t->taglen++] = c;
@@ -2558,9 +2573,9 @@ static int can_continue(const cst_agent_t *a, const turn_t *t,
   return st->http_status > 0 && st->http_status < 400 && !st->client_stopped;
 }
 
-/* Prompt size at which the session is compacted: CST_CTX_BUDGET, else 60% of
+/* Prompt size at which the session is compacted: CST_CTX_BUDGET, else 75% of
- * the context window capped at 256K tokens. Even a cached prompt is billed
+ * the context window, capped at 256K tokens. Even a cached prompt is billed on
- * on every step, so huge windows are not worth filling. */
+ * every step, so a 1M-token window is not worth filling. */
 static long ctx_budget(const cst_agent_t *a) {
   const char *e = getenv("CST_CTX_BUDGET");
   if (e && atol(e) > 0)
@@ -2568,7 +2583,7 @@ static long ctx_budget(const cst_agent_t *a) {
   long win = cst_model_context_tokens(a->cfg.model);
   if (win <= 0)
     return 0;
-  long b = win / 10 * 6;
+  long b = win / 4 * 3;
   return b > 262144 ? 262144 : b;
 }
 
@@ -2933,13 +2948,18 @@ int cst_agent_new_session(cst_agent_t *a, char *id_out, size_t id_sz) {
     return -1;
   if (cst_agent_store_ensure(a->cfg.workspace_root) != 0)
     return -1;
-  char id[128];
+  char id[128], path[4096];
-  if (cst_agent_store_new_id(id, sizeof(id)) != 0)
+  /* ids are per second: never reopen (and append to) one that exists */
-    return -1;
+  for (int tries = 0;; tries++) {
-  char path[4096];
+    if (tries == 16 || cst_agent_store_new_id(id, sizeof(id)) != 0 ||
-  if (cst_agent_store_path_for_id(a->cfg.workspace_root, id, path,
+        cst_agent_store_path_for_id(a->cfg.workspace_root, id, path,
                                     sizeof(path)) != 0)
       return -1;
+    FILE *fp = fopen(path, "rb");
+    if (!fp)
+      break;
+    fclose(fp);
+  }
   if (agent_reopen_session(a, path) != 0)
     return -1;
   cst_agent_store_set_current(a->cfg.workspace_root, id);
@@ -2948,6 +2968,42 @@ int cst_agent_new_session(cst_agent_t *a, char *id_out, size_t id_sz) {
   return 0;
 }
 
+int cst_agent_set_workspace(cst_agent_t *a, const char *path, char *err,
+                            size_t err_sz) {
+  char dummy[8];
+  if (!err || !err_sz) {
+    err = dummy;
+    err_sz = sizeof(dummy);
+  }
+  err[0] = 0;
+  if (!a || !path || !path[0]) {
+    snprintf(err, err_sz, "empty path");
+    return -1;
+  }
+  char abs[sizeof(a->cfg.workspace_root)];
+  if (os_realpath(path, abs, sizeof(abs)) != 0) {
+    snprintf(err, err_sz, "no such directory: %s", path);
+    return -1;
+  }
+  /* a file, or a tree we may not write to, fails here instead of halfway
+   * through the next turn */
+  if (cst_agent_store_ensure(abs) != 0) {
+    snprintf(err, err_sz, "cannot use as a workspace: %s", abs);
+    return -1;
+  }
+  snprintf(a->cfg.workspace_root, sizeof(a->cfg.workspace_root), "%s", abs);
+  /* everything that is kept per workspace follows the new root */
+  cst_perms_close(a->perms);
+  a->perms = cst_perms_open(a->cfg.workspace_root);
+  cst_metrics_close(a->metrics);
+  a->metrics = cst_metrics_open(a->cfg.workspace_root,
+                                cst_session_path(a->session));
+  cst_agent_reload_notes(a);
+  ensure_system(a);          /* the prompt names the directory */
+  a->last_prompt_tokens = 0; /* the old budget was measured elsewhere */
+  return 0;
+}
+
 int cst_agent_switch_session(cst_agent_t *a, const char *id) {
   if (!a || !id || !id[0])
     return -1;

src/agent_store.c

@@ -57,7 +57,8 @@ static void make_id(char *out, size_t n) {
   time_t now = time(NULL);
   struct tm tm;
   os_localtime(&now, &tm);
-  unsigned r = (unsigned)(os_getpid() ^ (unsigned)now);
+  static unsigned seq;
+  unsigned r = (unsigned)(os_getpid() ^ (unsigned)now) + 0x9e37u * seq++;
   snprintf(out, n, "%04d%02d%02d-%02d%02d%02d-%04x", tm.tm_year + 1900,
            tm.tm_mon + 1, tm.tm_mday, tm.tm_hour, tm.tm_min, tm.tm_sec,
            r & 0xffff);

src/http_srv.c

@@ -4,8 +4,11 @@
 
 #include "cst_http.h"
 #include "cst_util.h"
+#include "os_compat.h"
 
+#include <errno.h>
 #include <pthread.h>
+#include <stdint.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
@@ -44,6 +47,9 @@ struct cst_http_conn {
   int sent;
   int streaming;
   int failed;
+  int nreq;            /* requests served on this connection */
+  int expect_continue; /* the client waits for "100 Continue" */
+  int keep_alive_req;  /* what the client asked for */
   cst_http_conn_t *prev, *next;
 };
 
@@ -72,10 +78,15 @@ static const char *status_text(int code) {
 
 /* --- reading -------------------------------------------------------------- */
 
-static int fill(cst_http_conn_t *c, int timeout_ms) {
+/* deadline: os_now_ms() value; the whole read must be done by then, so a
+ * client trickling one byte at a time cannot hold the thread forever. */
+static int fill(cst_http_conn_t *c, double deadline) {
   if (c->rpos < c->rlen)
     return 1;
-  long r = os_net_recv(c->sock, c->rbuf, sizeof(c->rbuf), timeout_ms);
+  double left = deadline - os_now_ms();
+  if (left <= 0)
+    return -2;
+  long r = os_net_recv(c->sock, c->rbuf, sizeof(c->rbuf), (int)left + 1);
   if (r <= 0)
     return (int)r; /* 0 eof, -1 error, -2 timeout */
   c->rpos = 0;
@@ -83,10 +94,12 @@ static int fill(cst_http_conn_t *c, int timeout_ms) {
   return 1;
 }
 
-static int rd_line(cst_http_conn_t *c, char *out, size_t cap, int timeout_ms) {
+#define RD_TOO_LONG (-3)
+
+static int rd_line(cst_http_conn_t *c, char *out, size_t cap, double deadline) {
   size_t n = 0;
   for (;;) {
-    int rc = fill(c, timeout_ms);
+    int rc = fill(c, deadline);
     if (rc <= 0)
       return rc;
     while (c->rpos < c->rlen) {
@@ -98,7 +111,7 @@ static int rd_line(cst_http_conn_t *c, char *out, size_t cap, int timeout_ms) {
         return 1;
       }
       if (n + 2 >= cap)
-        return -1;
+        return RD_TOO_LONG;
       out[n++] = ch;
     }
   }
@@ -132,7 +145,8 @@ static char *rd_body(cst_http_conn_t *c, size_t n, int timeout_ms) {
   return buf;
 }
 
-static void url_decode(const char *in, char *out, size_t cap, int plus_space) {
+/* -1 when the input encodes a NUL (out then holds what came before it). */
+static int url_decode(const char *in, char *out, size_t cap, int plus_space) {
   size_t o = 0;
   for (const char *p = in; *p && o + 1 < cap; p++) {
     if (*p == '%' && p[1] && p[2]) {
@@ -146,8 +160,10 @@ static void url_decode(const char *in, char *out, size_t cap, int plus_space) {
                                             : -1;
       if (hi >= 0 && lo >= 0) {
         char ch = (char)((hi << 4) | lo);
-        if (ch == 0)
+        if (ch == 0) {
-          return; /* a decoded NUL would truncate the path */
+          out[o] = 0;
+          return -1;
+        }
         out[o++] = ch;
         p += 2;
         continue;
@@ -156,6 +172,23 @@ static void url_decode(const char *in, char *out, size_t cap, int plus_space) {
     out[o++] = (*p == '+' && plus_space) ? ' ' : *p;
   }
   out[o] = 0;
+  return 0;
+}
+
+/* Comma-separated header tokens, compared without case ("Close"). */
+static int has_token(const char *val, const char *tok) {
+  size_t n = strlen(tok);
+  for (const char *p = val; p && *p;) {
+    while (*p == ' ' || *p == '\t' || *p == ',')
+      p++;
+    size_t i = 0;
+    while (i < n && p[i] && (p[i] | 0x20) == (tok[i] | 0x20))
+      i++;
+    if (i == n && (p[i] == 0 || p[i] == ',' || p[i] == ' ' || p[i] == '\t'))
+      return 1;
+    p = strchr(p, ',');
+  }
+  return 0;
 }
 
 static int key_is(const char *line, const char *key) {
@@ -189,12 +222,16 @@ static int read_request(cst_http_conn_t *c, size_t *want_body) {
   cst_http_server_t *s = c->srv;
   char line[HTTP_LINE_MAX];
   cst_http_req_t *r = &c->req;
-  int first = c->rpos >= c->rlen; /* nothing buffered: this is a new client */
+  int first = c->nreq == 0; /* a keep-alive pause gets the idle timeout */
   memset(r, 0, sizeof(*r));
   c->hdrs_used = 0;
+  c->expect_continue = 0;
   *want_body = 0;
   int rc = rd_line(c, line, sizeof(line),
-                   first ? s->o.read_timeout_ms : s->o.idle_timeout_ms);
+                   os_now_ms() + (first ? s->o.read_timeout_ms
+                                        : s->o.idle_timeout_ms));
+  if (rc == RD_TOO_LONG)
+    return -1;
   if (rc <= 0)
     return 0;
   char *sp1 = strchr(line, ' ');
@@ -214,9 +251,10 @@ static int read_request(cst_http_conn_t *c, size_t *want_body) {
   r->keep_alive = strncmp(version, "HTTP/1.", 7) == 0 &&
                   version[7] >= '1' && version[7] <= '9';
   /* absolute-form ("http://host/path") is legal: keep the path */
+  if (target[0] != '/') {
     char *scheme = strstr(target, "://");
-  if (scheme)
+    target = scheme ? strchr(scheme + 3, '/') : NULL;
-    target = strchr(scheme + 3, '/');
+  }
   if (!target || target[0] != '/')
     return -1;
   {
@@ -227,7 +265,8 @@ static int read_request(cst_http_conn_t *c, size_t *want_body) {
       *q = 0;
       snprintf(r->query, sizeof(r->query), "%s", q + 1);
     }
-    url_decode(raw, r->path, sizeof(r->path), 0);
+    if (url_decode(raw, r->path, sizeof(r->path), 0) != 0)
+      return -1;
     size_t plen = strlen(r->path);
     if (plen == 0 || strstr(r->path, ".."))
       return -1;
@@ -235,8 +274,9 @@ static int read_request(cst_http_conn_t *c, size_t *want_body) {
   size_t hdr_bytes = 0;
   size_t content_length = 0;
   int have_length = 0;
+  double deadline = os_now_ms() + s->o.read_timeout_ms;
   for (;;) {
-    rc = rd_line(c, line, sizeof(line), s->o.read_timeout_ms);
+    rc = rd_line(c, line, sizeof(line), deadline);
     if (rc <= 0)
       return -1;
     if (!line[0])
@@ -251,18 +291,29 @@ static int read_request(cst_http_conn_t *c, size_t *want_body) {
     while (*val == ' ' || *val == '\t')
       val++;
     if (key_is(line, "content-length")) {
-      content_length = (size_t)strtoul(val, NULL, 10);
+      /* digits only, and one value: "5x" or two lengths would let the
+       * rest of the body run as a second request behind a proxy */
+      char *end = NULL;
+      errno = 0;
+      unsigned long long v = strtoull(val, &end, 10);
+      while (end && (*end == ' ' || *end == '\t'))
+        end++;
+      if (*val < '0' || *val > '9' || !end || *end || errno == ERANGE ||
+          v > (unsigned long long)SIZE_MAX ||
+          (have_length && content_length != (size_t)v))
+        return -1;
+      content_length = (size_t)v;
       have_length = 1;
     } else if (key_is(line, "transfer-encoding")) {
       return -1; /* chunked request bodies are not supported */
     } else if (key_is(line, "connection")) {
-      if (strstr(val, "close"))
+      if (has_token(val, "close"))
         r->keep_alive = 0;
-      else if (strstr(val, "keep-alive"))
+      else if (has_token(val, "keep-alive"))
         r->keep_alive = 1;
     } else if (key_is(line, "expect")) {
-      const char *cont = "HTTP/1.1 100 Continue\r\n\r\n";
+      /* answered once auth and the size cap have passed */
-      os_net_send_all(c->sock, cont, strlen(cont), 5000);
+      c->expect_continue = has_token(val, "100-continue");
     } else if (key_is(line, "authorization")) {
       r->authorization = store_str(c, val);
     } else if (key_is(line, "cookie")) {
@@ -275,6 +326,8 @@ static int read_request(cst_http_conn_t *c, size_t *want_body) {
       r->content_type = store_str(c, val);
     } else if (key_is(line, "user-agent")) {
       r->user_agent = store_str(c, val);
+    } else if (key_is(line, "last-event-id")) {
+      r->last_event_id = store_str(c, val);
     }
   }
   if (have_length)
@@ -429,24 +482,30 @@ int cst_http_query(const cst_http_req_t *req, const char *key, char *out,
 
 /* --- connections ---------------------------------------------------------- */
 
-static void dispatch(cst_http_server_t *s, cst_http_conn_t *c) {
+static const cst_http_route_t *find_route(const cst_http_server_t *s,
-  const cst_http_route_t *route = NULL;
+                                          const cst_http_req_t *req) {
   const cst_http_route_t *fallback = NULL;
   for (int i = 0; i < s->nroutes; i++) {
     const cst_http_route_t *r = &s->routes[i];
-    if (strcmp(r->method, "*") != 0 && strcmp(r->method, c->req.method) != 0)
+    if (strcmp(r->method, "*") != 0 && strcmp(r->method, req->method) != 0)
       continue;
     if (strcmp(r->path, "*") == 0) {
       fallback = r;
       continue;
     }
-    if (strcmp(r->path, c->req.path) == 0) {
+    if (strcmp(r->path, req->path) == 0)
-      route = r;
+      return r;
-      break;
   }
+  return fallback;
 }
-  if (!route)
+
-    route = fallback;
+/* Route, auth and the size cap are settled before the body is read: an
+ * unauthenticated client must not make us buffer 32 MiB. */
+static void serve(cst_http_server_t *s, cst_http_conn_t *c, size_t want) {
+  const cst_http_route_t *route = find_route(s, &c->req);
+  size_t cap = route && route->max_body ? route->max_body : s->o.max_body;
+  if (want > 0)
+    c->req.keep_alive = 0; /* until the body is read, the stream is ours */
   if (!route) {
     cst_http_send_err(c, 404, "not found");
     return;
@@ -455,6 +514,25 @@ static void dispatch(cst_http_server_t *s, cst_http_conn_t *c) {
     cst_http_send_err(c, 401, "unauthorized");
     return;
   }
+  if (want > cap) {
+    cst_http_send_err(c, 413, "request body too large");
+    return;
+  }
+  if (want > 0) {
+    if (c->expect_continue) {
+      const char *cont = "HTTP/1.1 100 Continue\r\n\r\n";
+      os_net_send_all(c->sock, cont, strlen(cont), 5000);
+    }
+    char *body = rd_body(c, want, s->o.read_timeout_ms);
+    if (!body) {
+      c->failed = 1;
+      return;
+    }
+    c->body = body;
+    c->req.body = body;
+    c->req.body_len = want;
+    c->req.keep_alive = c->keep_alive_req;
+  }
   int rc = route->fn(c, route->ud);
   if (!c->sent)
     cst_http_send_err(c, rc == 0 ? 500 : 404,
@@ -477,32 +555,14 @@ static void *conn_main(void *arg) {
     }
     if (rc == 0)
       break;
-    size_t cap = s->o.max_body;
+    c->nreq++;
-    for (int i = 0; i < s->nroutes; i++) {
-      const cst_http_route_t *r = &s->routes[i];
-      if (r->max_body && strcmp(r->method, c->req.method) == 0 &&
-          strcmp(r->path, c->req.path) == 0)
-        cap = r->max_body;
-    }
-    if (want > cap) {
-      c->req.keep_alive = 0;
-      cst_http_send_err(c, 413, "request body too large");
-      break;
-    }
-    if (want > 0) {
-      char *body = rd_body(c, want, s->o.read_timeout_ms);
-      if (!body)
-        break;
-      c->body = body;
-      c->req.body = body;
-      c->req.body_len = want;
-    }
     c->sent = 0;
     c->streaming = 0;
-    dispatch(s, c);
+    c->keep_alive_req = c->req.keep_alive;
+    serve(s, c, want);
     if (s->o.on_log) {
       char line[512];
-      snprintf(line, sizeof(line), "%s %s -> %d", c->req.method, c->req.path,
+      snprintf(line, sizeof(line), "%s %.480s -> %d", c->req.method, c->req.path,
                c->failed ? 499 : (c->sent ? 200 : 500));
       s->o.on_log(line, s->o.log_ud);
     }
@@ -512,11 +572,12 @@ static void *conn_main(void *arg) {
     c->req.body_len = 0;
     c->req.authorization = c->req.cookie = c->req.origin = NULL;
     c->req.host = c->req.content_type = c->req.user_agent = NULL;
+    c->req.last_event_id = NULL;
     if (!c->req.keep_alive || s->stopping || c->failed)
       break;
   }
-  os_net_shutdown(c->sock);
+  /* unlink first: stop() shuts down every listed socket, and a closed fd
-  os_net_close(c->sock);
+   * number may already belong to someone else */
   pthread_mutex_lock(&s->mu);
   if (c->prev)
     c->prev->next = c->next;
@@ -524,10 +585,14 @@ static void *conn_main(void *arg) {
     s->conns_first = c->next;
   if (c->next)
     c->next->prev = c->prev;
+  pthread_mutex_unlock(&s->mu);
+  os_net_shutdown(c->sock);
+  os_net_close(c->sock);
+  free(c);
+  pthread_mutex_lock(&s->mu);
   s->nconn--;
   pthread_cond_broadcast(&s->cv);
   pthread_mutex_unlock(&s->mu);
-  free(c);
   return NULL;
 }
 
@@ -536,8 +601,22 @@ static void *accept_main(void *arg) {
   while (!s->stopping) {
     int timed_out = 0;
     os_socket_t sock = os_net_accept(s->listener, 500, &timed_out);
-    if (sock == OS_SOCKET_BAD)
+    if (sock == OS_SOCKET_BAD) {
+      if (!timed_out) { /* EMFILE and friends: the listener stays readable */
+        struct timespec ts;
+        clock_gettime(CLOCK_REALTIME, &ts);
+        ts.tv_nsec += 100000000;
+        if (ts.tv_nsec >= 1000000000) {
+          ts.tv_sec++;
+          ts.tv_nsec -= 1000000000;
+        }
+        pthread_mutex_lock(&s->mu);
+        if (!s->stopping)
+          pthread_cond_timedwait(&s->cv, &s->mu, &ts);
+        pthread_mutex_unlock(&s->mu);
+      }
       continue;
+    }
     if (s->stopping) {
       os_net_close(sock);
       break;
@@ -644,9 +723,9 @@ int cst_http_stopping(const cst_http_server_t *s) {
   return s ? s->stopping : 1;
 }
 
-void cst_http_stop(cst_http_server_t *s) {
+int cst_http_stop(cst_http_server_t *s) {
   if (!s)
-    return;
+    return 0;
   pthread_mutex_lock(&s->mu);
   s->stopping = 1;
   for (cst_http_conn_t *c = s->conns_first; c; c = c->next)
@@ -670,13 +749,20 @@ void cst_http_stop(cst_http_server_t *s) {
     }
     pthread_cond_timedwait(&s->cv, &s->mu, &ts);
   }
+  int left = s->nconn;
   pthread_mutex_unlock(&s->mu);
   os_net_close(s->listener);
+  return left;
 }
 
 void cst_http_free(cst_http_server_t *s) {
   if (!s)
     return;
+  pthread_mutex_lock(&s->mu);
+  int left = s->nconn;
+  pthread_mutex_unlock(&s->mu);
+  if (left > 0)
+    return; /* a handler still runs on it (see stop()): leak, not crash */
   pthread_mutex_destroy(&s->mu);
   pthread_cond_destroy(&s->cv);
   free(s->routes);

src/main.c

@@ -43,7 +43,7 @@ static void usage(const char *argv0) {
           "  -n, --max-steps N     model calls per turn (30)\n"
           "  -H, --headless -p TEXT  run one prompt without the TUI\n"
           "      --web             serve the UI over HTTP on 127.0.0.1:8787\n"
-          "      --web-port N      port (0 = pick a free one)\n"
+          "      --web-port N      port (default 8787, 0 = pick a free one)\n"
           "      --web-host ADDR   bind address (default 127.0.0.1; a\n"
           "                        non-loopback address requires a token)\n"
           "      --web-token T     require ?token=T / Authorization: Bearer T\n"
@@ -255,6 +255,16 @@ static int demo_ctl_impl(const char *workspace) {
   return 0;
 }
 
+/* 0..65535, digits only: atoi turned "70000" into port 4464, "abc" into 0. */
+static int parse_port(const char *s, int *out) {
+  char *end = NULL;
+  long v = strtol(s, &end, 10);
+  if (!s[0] || *end || v < 0 || v > 65535)
+    return -1;
+  *out = (int)v;
+  return 0;
+}
+
 int main(int argc, char **argv) {
   if (os_console_init() != 0)
     fprintf(stderr, "warning: the process code page is not UTF-8 (Windows 10 "
@@ -332,9 +342,12 @@ int main(int argc, char **argv) {
   int web_mode = 0;
   cst_webui_opts_t web;
   memset(&web, 0, sizeof(web));
+  web.port = CST_WEBUI_DEFAULT_PORT; /* 0 would mean "pick a free one" */
   const char *env = getenv("CST_WEB_PORT");
-  if (env && env[0])
+  if (env && env[0] && parse_port(env, &web.port) != 0) {
-    web.port = atoi(env);
+    fprintf(stderr, "CST_WEB_PORT=%s is not a port (0-65535)\n", env);
+    return 1;
+  }
   web.host = getenv("CST_WEB_HOST");
   web.token = getenv("CST_WEB_TOKEN");
   web.root = getenv("CST_WEB_ROOT");
@@ -481,7 +494,11 @@ int main(int argc, char **argv) {
       web_mode = 1;
       break;
     case 0x102:
-      web.port = atoi(optarg);
+      if (parse_port(optarg, &web.port) != 0) {
+        fprintf(stderr, "--web-port %s is not a port (0-65535)\n", optarg);
+        curl_global_cleanup();
+        return 1;
+      }
       web_mode = 1;
       break;
     case 0x103:

src/net.c

@@ -12,6 +12,10 @@
 #ifndef WIN32_LEAN_AND_MEAN
 #define WIN32_LEAN_AND_MEAN
 #endif
+#if !defined(_WIN32_WINNT) || _WIN32_WINNT < 0x0600
+#undef _WIN32_WINNT
+#define _WIN32_WINNT 0x0600 /* WSAPoll */
+#endif
 #include <winsock2.h>
 #include <ws2tcpip.h>
 #else
@@ -21,8 +25,8 @@
 #include <netdb.h>
 #include <netinet/in.h>
 #include <netinet/tcp.h>
+#include <poll.h>
 #include <signal.h>
-#include <sys/select.h>
 #include <sys/socket.h>
 #include <unistd.h>
 #endif
@@ -45,7 +49,6 @@ static void set_err_win(char *err, size_t err_sz, const char *what) {
 }
 #define SET_ERR(e, n, w) set_err_win(e, n, w)
 #define NET_FD(s) ((SOCKET)(s))
-#define NET_NFDS(s) (0) /* Winsock ignores nfds */
 static void net_close_raw(os_socket_t s) { closesocket((SOCKET)s); }
 static int net_last_would_block(void) {
   int e = WSAGetLastError();
@@ -58,7 +61,6 @@ static int net_last_conn_reset(void) {
 #else
 #define SET_ERR(e, n, w) set_err(e, n, w)
 #define NET_FD(s) ((int)(s))
-#define NET_NFDS(s) ((int)((s) + 1))
 static void net_close_raw(os_socket_t s) { close(s); }
 static int net_last_would_block(void) { return errno == EINTR; }
 static int net_last_conn_reset(void) {
@@ -84,15 +86,22 @@ void os_net_cleanup(void) {
 #endif
 }
 
+/* poll, not select: FD_SET past FD_SETSIZE writes out of bounds, and a
+ * failed connect shows up as an error event, not as writable, on Windows. */
 static int wait_io(os_socket_t s, int want_write, int timeout_ms) {
-  fd_set fds;
+#ifdef _WIN32
-  FD_ZERO(&fds);
+  WSAPOLLFD p;
-  FD_SET(NET_FD(s), &fds);
+  p.fd = NET_FD(s);
-  struct timeval tv;
+  p.events = want_write ? POLLWRNORM : POLLRDNORM;
-  tv.tv_sec = timeout_ms / 1000;
+  p.revents = 0;
-  tv.tv_usec = (timeout_ms % 1000) * 1000;
+  int rc = WSAPoll(&p, 1, timeout_ms < 0 ? -1 : timeout_ms);
-  int rc = select(NET_NFDS(s), want_write ? NULL : &fds,
+#else
-                  want_write ? &fds : NULL, NULL, timeout_ms < 0 ? NULL : &tv);
+  struct pollfd p;
+  p.fd = NET_FD(s);
+  p.events = want_write ? POLLOUT : POLLIN;
+  p.revents = 0;
+  int rc = poll(&p, 1, timeout_ms < 0 ? -1 : timeout_ms);
+#endif
   if (rc > 0)
     return 1;
   if (rc == 0)
@@ -137,8 +146,15 @@ os_socket_t os_net_listen(const char *host, int port, char *err, size_t err_sz)
     return OS_SOCKET_BAD;
   }
   int one = 1;
+#ifdef _WIN32
+  /* SO_REUSEADDR on Windows lets another process bind the same port and
+   * take over our connections */
+  setsockopt(NET_FD(s), SOL_SOCKET, SO_EXCLUSIVEADDRUSE, (const char *)&one,
+             sizeof(one));
+#else
   setsockopt(NET_FD(s), SOL_SOCKET, SO_REUSEADDR, (const char *)&one,
              sizeof(one));
+#endif
 #ifdef IPV6_V6ONLY
   if (sa.ss_family == AF_INET6)
     setsockopt(NET_FD(s), IPPROTO_IPV6, IPV6_V6ONLY, (const char *)&one,

src/os_compat.c

@@ -519,7 +519,7 @@ int os_run_timeout_effective(void) {
   const char *e = getenv("CST_SHELL_TIMEOUT");
   if (e && atoi(e) > 0)
     return atoi(e);
-  return 120;
+  return 0; /* no limit: a build, a test suite or a long clone must finish */
 }
 
 double os_now_ms(void) {
@@ -662,7 +662,8 @@ int os_run_capture_ex(const char *cwd, const char *const argv[],
   int truncated = 0, killed = 0;
   int status = 0, reaped = 0, bg_killed = 0;
   double reaped_at = 0, killed_at = 0;
-  double deadline = os_now_ms() + os_run_timeout_effective() * 1000.0;
+  int timeout_s = os_run_timeout_effective();
+  double deadline = timeout_s > 0 ? os_now_ms() + timeout_s * 1000.0 : 0;
   for (;;) {
     struct pollfd pfd = {pipefd[0], POLLIN, 0};
     int pr = poll(&pfd, 1, 100);
@@ -692,7 +693,7 @@ int os_run_capture_ex(const char *cwd, const char *const argv[],
     }
     /* Checked on every pass, so a chatty command still stops promptly. */
     if (!reaped && !killed &&
-        ((g_run_cancel && *g_run_cancel) || now > deadline)) {
+        ((g_run_cancel && *g_run_cancel) || (deadline > 0 && now > deadline))) {
       killed = (g_run_cancel && *g_run_cancel) ? 2 : 1;
       killed_at = now;
       kill(-pid, SIGTERM);

src/os_win.c

@@ -601,7 +601,10 @@ int os_run_capture_token(const char *cwd, const char *const argv[],
   buf[0] = 0;
   int truncated = 0, killed = 0, reaped = 0, bg_killed = 0;
   double reaped_at = 0, killed_at = 0;
-  double deadline = os_now_ms() + os_run_timeout_effective() * 1000.0;
+  /* no timeout unless one was asked for: a deadline far in the future keeps
+   * every `now > deadline` check working without a second code path */
+  int timeout_s = os_run_timeout_effective();
+  double deadline = timeout_s > 0 ? os_now_ms() + timeout_s * 1000.0 : 1e18;
   int idle = 0; /* empty polls in a row: wait longer once output stalls */
   for (;;) {
     DWORD avail = 0;

src/provider_switch.c

@@ -0,0 +1,193 @@
+#include "cst_provider_switch.h"
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+int cst_ps_fetch(const char *provider, const char *api_base, const char *key,
+                 char ids[][128], int max, char *err, size_t err_sz) {
+  cst_model_meta_t *m = calloc((size_t)(max > 0 ? max : 1), sizeof(*m));
+  if (!m) {
+    snprintf(err, err_sz, "out of memory");
+    return -1;
+  }
+  int r = cst_llm_list_models_meta(api_base, key, m, max, err, err_sz);
+  if (r >= 0)
+    cst_models_cache_save(provider, api_base, m, r);
+  for (int i = 0; i < r; i++)
+    snprintf(ids[i], 128, "%s", m[i].id);
+  free(m);
+  return r;
+}
+
+int cst_ps_cached(const char *provider, char ids[][128], int max, int *fresh) {
+  *fresh = 0;
+  cst_model_meta_t *m = calloc((size_t)(max > 0 ? max : 1), sizeof(*m));
+  if (!m)
+    return -1;
+  long age = 0;
+  int n = cst_models_cache_load(provider, m, max, &age);
+  for (int i = 0; i < n; i++)
+    snprintf(ids[i], 128, "%s", m[i].id);
+  free(m);
+  *fresh = n > 0 && age >= 0 && age < CST_MODELS_CACHE_TTL;
+  return n > 0 ? n : -1;
+}
+
+const char *cst_ps_base(const cst_agent_config_t *cfg, const char *provider) {
+  if (cfg && strcmp(cfg->provider, provider) == 0)
+    return cfg->api_base;
+  const cst_provider_t *p = cst_provider_find(provider);
+  return p ? p->api_base : "";
+}
+
+int cst_ps_models(const cst_agent_config_t *cfg, int refresh,
+                  cst_ps_model_t *out, int max, int *api_rc, char *err,
+                  size_t err_sz) {
+  err[0] = 0;
+  *api_rc = -1;
+  char(*ids)[128] = calloc(CST_PS_MAX_MODELS, sizeof(*ids));
+  if (!ids) {
+    snprintf(err, err_sz, "out of memory");
+    return 0;
+  }
+  int fresh = 0;
+  int na = cst_ps_cached(cfg->provider, ids, CST_PS_MAX_MODELS, &fresh);
+  *api_rc = na;
+  if ((refresh || !fresh) && cfg->api_key[0]) {
+    char(*got)[128] = calloc(CST_PS_MAX_MODELS, sizeof(*got));
+    if (got) {
+      int r = cst_ps_fetch(cfg->provider, cfg->api_base, cfg->api_key, got,
+                           CST_PS_MAX_MODELS, err, err_sz);
+      *api_rc = r;
+      if (r >= 0) {
+        memcpy(ids, got, (size_t)r * sizeof(*ids));
+        na = r;
+      }
+      free(got);
+    }
+  }
+  int n = 0;
+  for (int i = 0; i < na && n < max; i++, n++) {
+    snprintf(out[n].id, sizeof(out[n].id), "%s", ids[i]);
+    out[n].api = 1;
+    cst_model_info(cfg->provider, ids[i], &out[n].info);
+  }
+  char builtin[32][128];
+  int nb = cst_models_list(cfg->model, builtin, 32);
+  for (int i = 0; i < nb && n < max; i++) {
+    int dup = 0;
+    for (int k = 0; k < na && !dup; k++)
+      dup = strcmp(ids[k], builtin[i]) == 0;
+    if (dup)
+      continue;
+    memcpy(out[n].id, builtin[i], sizeof(out[n].id));
+    out[n].id[sizeof(out[n].id) - 1] = 0;
+    out[n].api = 0;
+    cst_model_info(cfg->provider, builtin[i], &out[n].info);
+    n++;
+  }
+  free(ids);
+  return n;
+}
+
+int cst_ps_verify_save(const char *provider, const char *api_base,
+                       const char *key, char ids[][128], int max, int *nids,
+                       char *err, size_t err_sz) {
+  err[0] = 0;
+  char(*own)[128] = NULL;
+  if (!ids) {
+    own = calloc(CST_PS_MAX_MODELS, sizeof(*own));
+    if (!own) {
+      snprintf(err, err_sz, "out of memory");
+      return CST_PS_UNVERIFIED | CST_PS_UNSAVED;
+    }
+    ids = own;
+    max = CST_PS_MAX_MODELS;
+  }
+  int r = cst_ps_fetch(provider, api_base, key, ids, max, err, err_sz);
+  free(own);
+  if (nids)
+    *nids = r;
+  if (r == CST_MODELS_AUTH)
+    return CST_MODELS_AUTH;
+  int flags = r < 0 ? CST_PS_UNVERIFIED : 0;
+  if (r >= 0)
+    err[0] = 0;
+  if (cst_creds_save(provider, key) != 0)
+    flags |= CST_PS_UNSAVED;
+  return flags;
+}
+
+void cst_ps_apply_provider(cst_agent_config_t *cfg, const cst_provider_t *p,
+                           const char *key) {
+  cst_settings_t s;
+  cst_settings_load(&s);
+  const char *model = cst_settings_model(&s, p->name);
+  snprintf(cfg->provider, sizeof(cfg->provider), "%s", p->name);
+  snprintf(cfg->api_base, sizeof(cfg->api_base), "%s", p->api_base);
+  snprintf(cfg->model, sizeof(cfg->model), "%s", model ? model : p->model);
+  snprintf(cfg->api_key, sizeof(cfg->api_key), "%s", key);
+  cst_settings_remember(cfg);
+}
+
+int cst_ps_switch_provider(cst_agent_config_t *cfg, const char *name,
+                           const char *key, char *err, size_t err_sz) {
+  err[0] = 0;
+  const cst_provider_t *p = name ? cst_provider_find(name) : NULL;
+  if (!p) {
+    snprintf(err, err_sz, "unknown provider '%.64s'", name ? name : "");
+    return CST_PS_UNKNOWN;
+  }
+  char k[512];
+  int flags = 0;
+  char(*ids)[128] = calloc(CST_PS_MAX_MODELS, sizeof(*ids));
+  int nids = -1;
+  if (key && key[0]) {
+    snprintf(k, sizeof(k), "%s", key);
+    flags = cst_ps_verify_save(p->name, p->api_base, k, ids,
+                               ids ? CST_PS_MAX_MODELS : 0, &nids, err,
+                               err_sz);
+    if (flags < 0) {
+      memset(k, 0, sizeof(k));
+      free(ids);
+      return flags;
+    }
+  } else if (cst_creds_resolve(p->name, k, sizeof(k), NULL) != 0) {
+    free(ids);
+    snprintf(err, err_sz, "%s needs an API key", p->name);
+    return CST_PS_NEED_KEY;
+  }
+  cst_ps_apply_provider(cfg, p, k);
+  memset(k, 0, sizeof(k));
+  if (!cfg->model[0] && ids) {
+    /* a router preset: the first model the API lists */
+    int fresh = 0;
+    if (nids <= 0)
+      nids = cst_ps_cached(p->name, ids, CST_PS_MAX_MODELS, &fresh);
+    if (nids <= 0) {
+      char e2[256];
+      nids = cst_ps_fetch(p->name, cfg->api_base, cfg->api_key, ids,
+                          CST_PS_MAX_MODELS, e2, sizeof(e2));
+    }
+    if (nids > 0) {
+      snprintf(cfg->model, sizeof(cfg->model), "%s", ids[0]);
+      cst_settings_remember(cfg);
+    }
+  }
+  free(ids);
+  return flags;
+}
+
+int cst_ps_set_key(cst_agent_config_t *cfg, const char *key, char *err,
+                   size_t err_sz) {
+  if (!key || !key[0]) {
+    snprintf(err, err_sz, "empty key");
+    return CST_PS_NEED_KEY;
+  }
+  int r = cst_ps_verify_save(cfg->provider, cfg->api_base, key, NULL, 0, NULL,
+                             err, err_sz);
+  if (r >= 0)
+    snprintf(cfg->api_key, sizeof(cfg->api_key), "%s", key);
+  return r;
+}

src/session.c

@@ -8,6 +8,7 @@
 #include "cJSON.h"
 #include "cst_agent.h"
 #include "cst_attach.h"
+#include "cst_util.h"
 
 #include <pthread.h>
 #include <stdio.h>
@@ -409,3 +410,62 @@ int cst_session_rewrite(cst_session_t *s, const cst_message_t *msgs, int n) {
   free(copy);
   return rc;
 }
+
+int cst_message_is_tool_result(const cst_message_t *m) {
+  return m && (m->role == CST_ROLE_TOOL ||
+               (m->role == CST_ROLE_USER && m->tool_call_id[0]));
+}
+
+static void md_fence(cst_buf_t *b, const char *s, size_t max) {
+  size_t n = strlen(s);
+  if (n > max)
+    n = cst_utf8_floor(s, max);
+  cst_buf_puts(b, "````\n");
+  cst_buf_append(b, s, n);
+  cst_buf_puts(b, n < strlen(s) ? "\n…(truncated)\n````\n\n" : "\n````\n\n");
+}
+
+char *cst_session_export_md(cst_session_t *s, const char *title,
+                            const char *sid, const char *model) {
+  if (!s)
+    return NULL;
+  cst_buf_t b = {0};
+  cst_buf_printf(&b, "# %s\n\nsession `%s` · model `%s`\n\n",
+                 title ? title : "", sid ? sid : "", model ? model : "");
+  cst_session_lock(s);
+  for (int i = 0; i < cst_session_count(s); i++) {
+    const cst_message_t *m = cst_session_get(s, i);
+    const char *c = m->content ? m->content : "";
+    if (m->role == CST_ROLE_SYSTEM)
+      continue;
+    if (cst_message_is_tool_result(m)) {
+      cst_buf_printf(&b, "**Tool result** `%s`\n\n", m->tool_name);
+      md_fence(&b, c, 4000);
+    } else if (cst_message_is_note(m)) {
+      cst_buf_puts(&b, "> ");
+      cst_buf_append(&b, c, strcspn(c, "\n"));
+      cst_buf_puts(&b, "\n\n");
+    } else if (m->role == CST_ROLE_USER) {
+      cst_buf_puts(&b, "## User\n\n");
+      cst_buf_puts(&b, c);
+      cst_buf_puts(&b, "\n\n");
+      for (int k = 0; k < m->nattach; k++) {
+        char d[128];
+        cst_attach_describe(&m->attach[k], d, sizeof(d));
+        cst_buf_printf(&b, "- image `%s` (%s)\n", m->attach[k].name, d);
+      }
+      if (m->nattach)
+        cst_buf_puts(&b, "\n");
+    } else {
+      cst_buf_puts(&b, "## Assistant\n\n");
+      cst_buf_puts(&b, c);
+      cst_buf_puts(&b, "\n\n");
+      if (m->tool_calls_json && m->tool_calls_json[0]) {
+        cst_buf_puts(&b, "**Tool calls**\n\n");
+        md_fence(&b, m->tool_calls_json, 4000);
+      }
+    }
+  }
+  cst_session_unlock(s);
+  return cst_buf_steal(&b);
+}

src/skills.c

@@ -488,6 +488,16 @@ char *cst_skill_read(const char *ws, const char *name, const char *file,
   return cst_buf_steal(&b);
 }
 
+const char *cst_init_prompt(void) {
+  return "Analyze this repository and write an AGENTS.md file at the "
+         "workspace root for future coding agents. Cover: what the project "
+         "is, how to build, test and run it (exact commands), the directory "
+         "layout, coding conventions you can infer from the code, and "
+         "anything surprising. Explore with list_dir/glob/grep/read_file "
+         "before writing. Keep it under 150 lines. If AGENTS.md already "
+         "exists, improve it rather than starting over.";
+}
+
 char *cst_skill_prompt(const char *ws, const char *name, const char *task) {
   int code = 0;
   char *body = cst_skill_read(ws, name, NULL, &code);

src/tui.c

@@ -11,6 +11,7 @@
 #include "cst_mcp.h"
 #include "cst_models.h"
 #include "cst_plugins.h"
+#include "cst_provider_switch.h"
 #include "cst_skills.h"
 #include "cst_subagent.h"
 #include "cst_textsel.h"
@@ -1041,10 +1042,7 @@ static int find_tool_block(tui_t *t, const char *id) {
   return -1;
 }
 
-static int msg_is_tool_result(const cst_message_t *m) {
+#define msg_is_tool_result cst_message_is_tool_result
-  return m && (m->role == CST_ROLE_TOOL ||
-               (m->role == CST_ROLE_USER && m->tool_call_id[0]));
-}
 
 /* Strip the "[tool …]" / "result <id> exit=N <n>" header and "end" trailer. */
 static void tool_result_view(const char *content, const char **body,
@@ -3886,46 +3884,11 @@ static void am_store(const char *provider, int r, char ids[][128],
   pthread_mutex_unlock(&g_am_mu);
 }
 
-/* GET /models; a good answer also refreshes models-cache/<provider>.json. */
-static int fetch_models(const char *provider, const char *base,
-                        const char *key, char ids[][128], int max, char *err,
-                        size_t err_sz) {
-  cst_model_meta_t *m = calloc((size_t)max, sizeof(*m));
-  if (!m) {
-    snprintf(err, err_sz, "out of memory");
-    return -1;
-  }
-  int r = cst_llm_list_models_meta(base, key, m, max, err, err_sz);
-  if (r >= 0)
-    cst_models_cache_save(provider, base, m, r);
-  for (int i = 0; i < r; i++)
-    snprintf(ids[i], 128, "%s", m[i].id);
-  free(m);
-  return r;
-}
-
-/* The cached list for provider into ids: count, or -1; *fresh when it is
- * younger than CST_MODELS_CACHE_TTL. */
-static int cached_models(const char *provider, char ids[][128], int max,
-                         int *fresh) {
-  *fresh = 0;
-  cst_model_meta_t *m = calloc((size_t)max, sizeof(*m));
-  if (!m)
-    return -1;
-  long age = 0;
-  int n = cst_models_cache_load(provider, m, max, &age);
-  for (int i = 0; i < n; i++)
-    snprintf(ids[i], 128, "%s", m[i].id);
-  free(m);
-  *fresh = n > 0 && age >= 0 && age < CST_MODELS_CACHE_TTL;
-  return n > 0 ? n : -1;
-}
-
 static void *probe_thread(void *arg) {
   probe_arg_t *a = arg;
   static char ids[AM_MAX][128]; /* one probe runs per provider switch */
   char err[256];
-  int r = fetch_models(a->provider, a->base, a->key, ids, AM_MAX, err,
+  int r = cst_ps_fetch(a->provider, a->base, a->key, ids, AM_MAX, err,
                        sizeof(err));
   if (r >= 0 || r == CST_MODELS_AUTH || !a->have_cache)
     am_store(a->provider, r, ids, err);
@@ -3937,23 +3900,13 @@ static void *probe_thread(void *arg) {
   return NULL;
 }
 
-/* Base URL for a provider: the live config for the current one (it may be
- * overridden), else the preset. */
-static const char *provider_base(const tui_t *t, const char *provider) {
-  const cst_agent_config_t *cfg = cst_agent_config(t->agent);
-  if (cfg && strcmp(cfg->provider, provider) == 0)
-    return cfg->api_base;
-  const cst_provider_t *p = cst_provider_find(provider);
-  return p ? p->api_base : "";
-}
-
 static void start_probe(tui_t *t) {
   const cst_agent_config_t *cfg = cst_agent_config(t->agent);
   if (!cfg || !cfg->api_key[0] || g_am_threads > 0)
     return;
   static char ids[AM_MAX][128];
   int fresh = 0;
-  int nc = cached_models(cfg->provider, ids, AM_MAX, &fresh);
+  int nc = cst_ps_cached(cfg->provider, ids, AM_MAX, &fresh);
   pthread_mutex_lock(&g_am_mu);
   snprintf(g_am.provider, sizeof(g_am.provider), "%s", cfg->provider);
   pthread_mutex_unlock(&g_am_mu);
@@ -4039,13 +3992,14 @@ static int obtain_key(tui_t *t, const char *provider, char *out, size_t n,
     return 0;
   char dir[1024] = "the config directory";
   os_config_dir(dir, sizeof(dir));
-  const char *base = provider_base(t, provider);
+  const char *base = cst_ps_base(cst_agent_config(t->agent), provider);
   char title[128], hint[1300];
   snprintf(title, sizeof(title), "API key for %s", provider);
   snprintf(hint, sizeof(hint), "%.200s · saved to %.900s/credentials (only you "
                                "can read it)",
            base, dir);
   char note[300] = "";
+  int flags;
   for (;;) {
     if (secret_input_run(t, title, hint, out, n) != 0)
       return -1;
@@ -4053,8 +4007,10 @@ static int obtain_key(tui_t *t, const char *provider, char *out, size_t n,
     draw_status(t);
     static char ids[AM_MAX][128];
     char err[256];
-    int r = fetch_models(provider, base, out, ids, AM_MAX, err, sizeof(err));
+    int r = -1;
-    if (r == CST_MODELS_AUTH) {
+    flags = cst_ps_verify_save(provider, base, out, ids, AM_MAX, &r, err,
+                               sizeof(err));
+    if (flags == CST_MODELS_AUTH) {
       snprintf(hint, sizeof(hint), "%s rejected that key (%.200s) — paste "
                                    "another one",
                base, err);
@@ -4064,13 +4020,13 @@ static int obtain_key(tui_t *t, const char *provider, char *out, size_t n,
     snprintf(g_am.provider, sizeof(g_am.provider), "%s", provider);
     pthread_mutex_unlock(&g_am_mu);
     am_store(provider, r, ids, err);
-    if (r < 0)
+    if (flags & CST_PS_UNVERIFIED)
       snprintf(note, sizeof(note), "could not verify the key (%.200s); "
                                    "saved anyway",
                err);
     break;
   }
-  if (cst_creds_save(provider, out) != 0)
+  if (flags & CST_PS_UNSAVED)
     set_status(t, "warning: could not save the key; it is used for this run "
                   "only");
   else if (note[0])
@@ -4302,7 +4258,7 @@ static void cmd_model(tui_t *t, char *arg, int *quit) {
       set_status(t, "fetching the model list…");
       draw_status(t);
       char err[256];
-      na = fetch_models(cfg->provider, cfg->api_base, cfg->api_key, names,
+      na = cst_ps_fetch(cfg->provider, cfg->api_base, cfg->api_key, names,
                         AM_MAX, err, sizeof(err));
       pthread_mutex_lock(&g_am_mu);
       snprintf(g_am.provider, sizeof(g_am.provider), "%s", cfg->provider);
@@ -4436,15 +4392,8 @@ static void cmd_provider(tui_t *t, char *arg, int *quit) {
     push_system_line(t, "(provider unchanged: %s needs an API key)", p->name);
     return;
   }
-  cst_settings_t s;
+  cst_ps_apply_provider(cfg, p, key);
-  cst_settings_load(&s);
-  const char *model = cst_settings_model(&s, p->name);
-  snprintf(cfg->provider, sizeof(cfg->provider), "%s", p->name);
-  snprintf(cfg->api_base, sizeof(cfg->api_base), "%s", p->api_base);
-  snprintf(cfg->model, sizeof(cfg->model), "%s", model ? model : p->model);
-  snprintf(cfg->api_key, sizeof(cfg->api_key), "%s", key);
   memset(key, 0, sizeof(key));
-  cst_settings_remember(cfg);
   push_system_line(t, "(provider → %s · %s · model %s)", p->name, p->api_base,
                    cfg->model);
   if (am_models(p->name, NULL, 0) < 0)
@@ -4822,12 +4771,6 @@ static void cmd_diff(tui_t *t, char *arg, int *quit) {
   free(df.out);
 }
 
-static void md_fence(FILE *fp, const char *s, size_t max) {
-  size_t n = strlen(s);
-  fprintf(fp, "````\n%.*s%s\n````\n\n", (int)(n > max ? max : n), s,
-          n > max ? "\n…(truncated)" : "");
-}
-
 static void cmd_export(tui_t *t, char *arg, int *quit) {
   (void)quit;
   const cst_agent_config_t *cfg = cst_agent_config(t->agent);
@@ -4847,44 +4790,20 @@ static void cmd_export(tui_t *t, char *arg, int *quit) {
     *sl = 0;
     os_mkdir_p(dir, 0755);
   }
-  FILE *fp = fopen(path, "wb");
+  char *md = cst_session_export_md(cst_agent_session(t->agent), t->title, sid,
+                                   cfg->model);
+  FILE *fp = md ? fopen(path, "wb") : NULL;
   if (!fp) {
+    free(md);
     push_system_line(t, "Error: cannot write %s", path);
     return;
   }
-  fprintf(fp, "# %s\n\nsession `%s` · model `%s`\n\n", t->title, sid,
+  fputs(md, fp);
-          cfg->model);
+  free(md);
-  cst_session_t *s = cst_agent_session(t->agent);
+  if (fclose(fp) != 0) {
-  cst_session_lock(s);
+    push_system_line(t, "Error: cannot write %s", path);
-  for (int i = 0; i < cst_session_count(s); i++) {
+    return;
-    const cst_message_t *m = cst_session_get(s, i);
-    const char *c = m->content ? m->content : "";
-    if (m->role == CST_ROLE_SYSTEM)
-      continue;
-    if (msg_is_tool_result(m)) {
-      fprintf(fp, "**Tool result** `%s`\n\n", m->tool_name);
-      md_fence(fp, c, 4000);
-    } else if (cst_message_is_note(m)) {
-      fprintf(fp, "> %.*s\n\n", (int)strcspn(c, "\n"), c);
-    } else if (m->role == CST_ROLE_USER) {
-      fprintf(fp, "## User\n\n%s\n\n", c);
-      for (int k = 0; k < m->nattach; k++) {
-        char d[128];
-        cst_attach_describe(&m->attach[k], d, sizeof(d));
-        fprintf(fp, "- image `%s` (%s)\n", m->attach[k].name, d);
   }
-      if (m->nattach)
-        fputc('\n', fp);
-    } else {
-      fprintf(fp, "## Assistant\n\n%s\n\n", c);
-      if (m->tool_calls_json && m->tool_calls_json[0]) {
-        fprintf(fp, "**Tool calls**\n\n");
-        md_fence(fp, m->tool_calls_json, 4000);
-      }
-    }
-  }
-  cst_session_unlock(s);
-  fclose(fp);
   push_system_line(t, "(exported to %s)", path);
 }
 
@@ -5061,14 +4980,7 @@ static void cmd_init(tui_t *t, char *arg, int *quit) {
   (void)arg;
   (void)quit;
   free(t->pending_prompt);
-  t->pending_prompt = xstrdup(
+  t->pending_prompt = xstrdup(cst_init_prompt());
-      "Analyze this repository and write an AGENTS.md file at the workspace "
-      "root for future coding agents. Cover: what the project is, how to "
-      "build, test and run it (exact commands), the directory layout, coding "
-      "conventions you can infer from the code, and anything surprising. "
-      "Explore with list_dir/glob/grep/read_file before writing. Keep it "
-      "under 150 lines. If AGENTS.md already exists, improve it rather than "
-      "starting over.");
 }
 
 static void cmd_compact(tui_t *t, char *arg, int *quit) {
@@ -5364,6 +5276,151 @@ static void cmd_quit(tui_t *t, char *arg, int *quit) {
   *quit = 1;
 }
 
+/* /web: the WebUI is a second front end for the same engine and is designed to
+ * run as its own process, so this starts one on the same workspace and leaves
+ * the TUI holding the terminal. The child gets a fresh session: two writers on
+ * one session file is the one thing that would corrupt it. */
+#ifndef _WIN32
+#include <fcntl.h>
+#include <sys/wait.h> /* waitpid: collect the WebUI started by the last /web */
+#endif
+#ifndef CST_WEBUI_DEFAULT_PORT
+#define CST_WEBUI_DEFAULT_PORT 8787 /* keep in sync with include/cst_webui.h */
+#endif
+static void cmd_web(tui_t *t, char *arg, int *quit) {
+  (void)arg;
+  (void)quit;
+#ifdef _WIN32
+  push_system_line(t, "open another terminal and run: cst-agent --web");
+#else
+  static pid_t spawned = 0;
+  if (spawned > 0) {          /* collect the one we started last time */
+    waitpid(spawned, NULL, WNOHANG);
+    spawned = 0;
+  }
+  char dir[4096], exe[4096 + 16];
+  if (os_exe_dir(dir, sizeof(dir)) != 0) {
+    push_system_line(t, "cannot locate this binary: run cst-agent --web yourself");
+    return;
+  }
+  snprintf(exe, sizeof(exe), "%s/cst-agent", dir);
+  const cst_agent_config_t *cfg = cst_agent_config(t->agent);
+  const char *ws = (cfg && cfg->workspace_root[0]) ? cfg->workspace_root : ".";
+  char logf[4096 + 32];
+  snprintf(logf, sizeof(logf), "%s/.agent", ws);
+  os_mkdir_p(logf, 0755);
+  snprintf(logf, sizeof(logf), "%s/.agent/webui.log", ws);
+  /* The WebUI talks to what this session talks to (-b, -m, a /provider
+   * switch...). The key goes through the environment, not argv (ps). */
+  const char *argv[20];
+  int na = 0;
+  argv[na++] = "cst-agent";
+  argv[na++] = "--web";
+  argv[na++] = "--workspace";
+  argv[na++] = ws;
+  argv[na++] = "--new";
+  if (cfg && cfg->provider[0])
+    argv[na++] = "--provider", argv[na++] = cfg->provider;
+  if (cfg && cfg->model[0])
+    argv[na++] = "--model", argv[na++] = cfg->model;
+  if (cfg && cfg->api_base[0])
+    argv[na++] = "--api-base", argv[na++] = cfg->api_base;
+  if (cfg && cfg->effort[0])
+    argv[na++] = "--effort", argv[na++] = cfg->effort;
+  if (cfg)
+    argv[na++] = "--approval", argv[na++] = cst_approval_name(cfg->approval);
+  argv[na] = NULL;
+  size_t nenv = 0;
+  while (environ[nenv])
+    nenv++;
+  char **envp = calloc(nenv + 2, sizeof(char *));
+  char keyvar[600] = "";
+  if (!envp) {
+    push_system_line(t, "out of memory");
+    return;
+  }
+  size_t ne = 0;
+  for (size_t i = 0; i < nenv; i++)
+    if (strncmp(environ[i], "CST_API_KEY=", 12) != 0)
+      envp[ne++] = environ[i];
+  if (cfg && cfg->api_key[0]) {
+    snprintf(keyvar, sizeof(keyvar), "CST_API_KEY=%s", cfg->api_key);
+    envp[ne++] = keyvar;
+  }
+  envp[ne] = NULL;
+  pid_t pid = fork();
+  if (pid < 0) {
+    free(envp);
+    push_system_line(t, "cannot start a second process");
+    return;
+  }
+  if (pid == 0) {
+    setsid();
+    /* never inherit the TUI's terminal: its output would land on our screen */
+    int in = open("/dev/null", O_RDONLY);
+    if (in >= 0 && in != STDIN_FILENO) {
+      dup2(in, STDIN_FILENO);
+      close(in);
+    }
+    int fd = open(logf, O_WRONLY | O_CREAT | O_TRUNC, 0600);
+    if (fd < 0)
+      fd = open("/dev/null", O_WRONLY);
+    if (fd >= 0) {
+      dup2(fd, STDOUT_FILENO);
+      dup2(fd, STDERR_FILENO);
+      if (fd > 2)
+        close(fd);
+    }
+    execve(exe, (char *const *)argv, envp);
+    _exit(127);
+  }
+  free(envp);
+  spawned = pid;
+  /* Wait (2 s at most) for the URL it prints once it listens: the port may
+   * come from CST_WEB_PORT, or it may not start at all. */
+  char url[512] = "";
+  int died = 0;
+  for (int i = 0; i < 40 && !url[0] && !died; i++) {
+    usleep(50000);
+    FILE *fp = fopen(logf, "r");
+    char line[512];
+    while (fp && fgets(line, sizeof(line), fp)) {
+      if (strncmp(line, "webui: http", 11) == 0) {
+        line[strcspn(line, "\r\n")] = 0;
+        snprintf(url, sizeof(url), "%s", line + 7);
+        break;
+      }
+    }
+    if (fp)
+      fclose(fp);
+    if (!url[0] && waitpid(pid, NULL, WNOHANG) == pid) {
+      died = 1;
+      spawned = 0;
+    }
+  }
+  /* its --new made the WebUI's session CURRENT; a plain `cst-agent` later
+   * should still resume this one */
+  char sid[128] = "";
+  cst_agent_session_id(t->agent, sid, sizeof(sid));
+  if (sid[0])
+    cst_agent_store_set_current(ws, sid);
+  char msg[4200];
+  if (died)
+    snprintf(msg, sizeof(msg), "the WebUI did not start (port busy?): see %s",
+             logf);
+  else if (url[0])
+    snprintf(msg, sizeof(msg), "WebUI started in the background: %s (new session)",
+             url);
+  else
+    snprintf(msg, sizeof(msg), "WebUI starting in the background "
+                               "(http://127.0.0.1:%d/ unless CST_WEB_PORT says "
+                               "otherwise)", CST_WEBUI_DEFAULT_PORT);
+  push_system_line(t, msg);
+  snprintf(msg, sizeof(msg), "its log: %s", logf);
+  push_system_line(t, msg);
+#endif
+}
+
 static const slash_cmd_t SLASH[] = {
     {"help", "?", "", "list commands and keys", 1, cmd_help},
     {"new", "clear", "", "start a new session", 0, cmd_new},
@@ -5422,6 +5479,8 @@ static const slash_cmd_t SLASH[] = {
      cmd_agents},
     {"skill", "", "<name> [task]", "run a task with a skill loaded", 0,
      cmd_skill},
+    {"web", "", "", "start the WebUI in the background (127.0.0.1:8787)", 1,
+     cmd_web},
     {"quit", "q exit", "", "quit", 1, cmd_quit},
 };
 

src/util.c

@@ -99,6 +99,26 @@ size_t cst_utf8_floor(const char *s, size_t n) {
   return i - 1; /* sequence incomplete: cut before lead byte */
 }
 
+char *cst_utf8_hold_feed(cst_utf8_hold_t *h, const char *s, size_t n,
+                         size_t *out_len) {
+  size_t have = h->n;
+  char *all = malloc(have + n + 1);
+  if (!all)
+    return NULL;
+  memcpy(all, h->b, have);
+  if (n)
+    memcpy(all + have, s, n);
+  size_t len = have + n;
+  size_t cut = cst_utf8_floor(all, len);
+  if (len - cut > sizeof(h->b))
+    cut = len;
+  h->n = len - cut;
+  memcpy(h->b, all + cut, h->n);
+  all[cut] = 0;
+  *out_len = cut;
+  return all;
+}
+
 static size_t utf8_seq_ok(const unsigned char *p, size_t left) {
   unsigned char c = p[0];
   size_t need;

src/web_md.c

@@ -64,7 +64,17 @@ static void attr_append(cst_buf_t *b, const char *name, size_t nlen,
   cst_buf_puts(b, " ");
   cst_buf_append(b, name, nlen);
   cst_buf_puts(b, "=\"");
-  cst_buf_append(b, val, vlen);
+  /* a single-quoted or bare value may hold '"': it must not end ours */
+  for (size_t i = 0; i < vlen; i++) {
+    if (val[i] == '"')
+      cst_buf_puts(b, "&quot;");
+    else if (val[i] == '<')
+      cst_buf_puts(b, "&lt;");
+    else if (val[i] == '>')
+      cst_buf_puts(b, "&gt;");
+    else
+      cst_buf_append(b, val + i, 1);
+  }
   cst_buf_puts(b, "\"");
 }
 

tests/test_webui.c

@@ -236,6 +236,16 @@ static void test_sanitize(void) {
   CHECK(strstr(html, "<a") == NULL); /* an unusable href drops the tag */
   free(html);
 
+  /* a quote inside a single-quoted or bare value cannot open a new attribute */
+  const char *quoted = "<a href='http://x\" onmouseover=\"alert(1)'>q</a>"
+                       "<a href=http://y\"onmouseover=alert(2)//>r</a>";
+  html = cst_web_md_sanitize(quoted, strlen(quoted));
+  CHECK(html != NULL);
+  CHECK(strstr(html, "\" onmouseover") == NULL);
+  CHECK(strstr(html, "\"onmouseover") == NULL);
+  CHECK(strstr(html, "&quot;") != NULL);
+  free(html);
+
   /* streaming: a javascript: link is dropped, a split tag never leaks */
   {
     cst_buf_free(&g_md_out);
@@ -270,8 +280,38 @@ static void test_sanitize(void) {
   }
 }
 
+/* Streamed deltas cut anywhere must reach the browser as whole characters. */
+static void test_utf8_hold(void) {
+  const char *src = "思考：先读 main.c，再改 😀 emoji。";
+  size_t len = strlen(src);
+  for (size_t step = 1; step <= 5; step++) {
+    cst_utf8_hold_t h = {0};
+    cst_buf_t out = {0};
+    for (size_t i = 0; i < len; i += step) {
+      size_t n = len - i < step ? len - i : step;
+      size_t got = 0;
+      char *piece = cst_utf8_hold_feed(&h, src + i, n, &got);
+      CHECK(piece != NULL);
+      CHECK(h.n < 4);
+      CHECK(cst_utf8_valid(piece, got));
+      CHECK(cst_buf_append(&out, piece, got) == 0);
+      free(piece);
+    }
+    CHECK(h.n == 0);
+    CHECK(out.len == len && memcmp(out.buf, src, len) == 0);
+    cst_buf_free(&out);
+  }
+  /* a stray continuation byte is not held forever */
+  cst_utf8_hold_t h = {0};
+  size_t got = 0;
+  char *piece = cst_utf8_hold_feed(&h, "\x80\x80\x80\x80", 4, &got);
+  CHECK(piece && got == 4 && h.n == 0);
+  free(piece);
+}
+
 int main(void) {
   CHECK(os_net_init() == 0);
+  test_utf8_hold();
   test_query();
   test_sanitize();
   test_http();

web/index.html

@@ -1,41 +1,239 @@
 <!DOCTYPE html>
-<html lang="zh-CN">
+<html lang="zh-CN" data-theme="dark">
 <head>
 <meta charset="utf-8">
-<meta name="viewport" content="width=device-width, initial-scale=1">
+<meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover">
+<meta name="color-scheme" content="dark light">
 <title>CST-Agent</title>
 <link rel="stylesheet" href="style.css">
 </head>
 <body>
-<header id="bar">
+<!-- one icon set, drawn as a sprite so every glyph shares the same 24px grid,
-  <span class="tag" id="planmode">Build</span>
+     stroke weight and round caps: mixed emoji/unicode never looks like a family -->
-  <span class="tag" id="approval">auto</span>
+<svg id="atlas" aria-hidden="true" hidden>
-  <span class="ws" id="ws" title="workspace"></span>
+  <symbol id="i-menu" viewBox="0 0 24 24"><path d="M4 7h16M4 12h16M4 17h16"/></symbol>
-  <span class="model" id="model" title="model">-</span>
+  <symbol id="i-panel-left" viewBox="0 0 24 24"><rect x="3.5" y="5" width="17" height="14" rx="3"/><path d="M9.5 5v14"/></symbol>
-  <span class="muted" id="ctx"></span>
+  <symbol id="i-panel-right" viewBox="0 0 24 24"><rect x="3.5" y="5" width="17" height="14" rx="3"/><path d="M14.5 5v14"/></symbol>
+  <symbol id="i-chevron" viewBox="0 0 24 24"><path d="M6 9.5l6 5 6-5"/></symbol>
+  <symbol id="i-plus" viewBox="0 0 24 24"><path d="M12 5v14M5 12h14"/></symbol>
+  <symbol id="i-refresh" viewBox="0 0 24 24"><path d="M20 12a8 8 0 1 1-2.6-5.9M20 4.5V9h-4.5"/></symbol>
+  <symbol id="i-settings" viewBox="0 0 24 24"><path d="M4 6.5h5M15 6.5h5M4 12h7M17 12h3M4 17.5h5M15 17.5h5"/><circle cx="11.5" cy="6.5" r="2"/><circle cx="15" cy="12" r="2"/><circle cx="11.5" cy="17.5" r="2"/></symbol>
+  <symbol id="i-moon" viewBox="0 0 24 24"><path d="M20 14.6A8.6 8.6 0 0 1 9.4 4 8.6 8.6 0 1 0 20 14.6z"/></symbol>
+  <symbol id="i-sun" viewBox="0 0 24 24"><circle cx="12" cy="12" r="4.2"/><path d="M12 2.5v2.2M12 19.3v2.2M2.5 12h2.2M19.3 12h2.2M5.2 5.2l1.6 1.6M17.2 17.2l1.6 1.6M18.8 5.2l-1.6 1.6M6.8 17.2l-1.6 1.6"/></symbol>
+  <symbol id="i-more" viewBox="0 0 24 24"><circle cx="5.5" cy="12" r="1.6" class="f"/><circle cx="12" cy="12" r="1.6" class="f"/><circle cx="18.5" cy="12" r="1.6" class="f"/></symbol>
+  <symbol id="i-send" viewBox="0 0 24 24"><path d="M12 19.5V5M5.8 11.2 12 5l6.2 6.2"/></symbol>
+  <symbol id="i-stop" viewBox="0 0 24 24"><rect x="7" y="7" width="10" height="10" rx="2.5" class="f"/></symbol>
+  <symbol id="i-image" viewBox="0 0 24 24"><rect x="3.5" y="5" width="17" height="14" rx="3"/><path d="M4 15.5 8.6 11l4 4 2.8-2.8L20.5 16"/><circle cx="9" cy="9.4" r="1.5"/></symbol>
+  <symbol id="i-clipboard" viewBox="0 0 24 24"><rect x="8.5" y="3.5" width="7" height="4" rx="1.6"/><path d="M15.5 5.5h3v15h-13v-15h3M9 12h6M9 15.5h4"/></symbol>
+  <symbol id="i-list" viewBox="0 0 24 24"><path d="M4 6.8h2M4 12h2M4 17.2h2M9 6.8h11M9 12h11M9 17.2h11"/></symbol>
+  <symbol id="i-copy" viewBox="0 0 24 24"><rect x="8.5" y="8.5" width="11" height="11" rx="2.6"/><path d="M15.5 8.5V7a2.5 2.5 0 0 0-2.5-2.5H6.5A2.5 2.5 0 0 0 4 7v6.5A2.5 2.5 0 0 0 6.5 16h1.5"/></symbol>
+  <symbol id="i-compress" viewBox="0 0 24 24"><path d="M8 3.5V9H3M16 20.5V15h5M3 9h4M16 15h5"/></symbol>
+  <symbol id="i-undo" viewBox="0 0 24 24"><path d="M9.5 5.5 4 11l5.5 5.5"/><path d="M4 11h10.2a5.2 5.2 0 0 1 0 10.4H8.5"/></symbol>
+  <symbol id="i-close" viewBox="0 0 24 24"><path d="M6.5 6.5l11 11M17.5 6.5l-11 11"/></symbol>
+  <symbol id="i-check" viewBox="0 0 24 24"><path d="M5 12.6l4.6 4.6L19 7.6"/></symbol>
+  <symbol id="i-shield" viewBox="0 0 24 24"><path d="M12 3.5 5 6.2v5.4c0 4.2 2.9 7.5 7 8.9 4.1-1.4 7-4.7 7-8.9V6.2z"/></symbol>
+  <symbol id="i-bolt" viewBox="0 0 24 24"><path d="M13.4 3 5.5 13.6H11l-.9 7.4L18.5 10H13z"/></symbol>
+  <symbol id="i-alert" viewBox="0 0 24 24"><path d="M12 4 2.8 20h18.4z"/><path d="M12 10v4.4M12 17.2v.2"/></symbol>
+  <symbol id="i-cpu" viewBox="0 0 24 24"><rect x="7" y="7" width="10" height="10" rx="2.6"/><path d="M10 3v4M14 3v4M10 17v4M14 17v4M3 10h4M3 14h4M17 10h4M17 14h4"/></symbol>
+  <symbol id="i-lv1" viewBox="0 0 24 24"><path d="M5 18.5V13h3.4v5.5z" class="f"/></symbol>
+  <symbol id="i-lv2" viewBox="0 0 24 24"><path d="M5 18.5V13h3.4v5.5zM10.3 18.5V9.6h3.4v8.9z" class="f"/></symbol>
+  <symbol id="i-lv3" viewBox="0 0 24 24"><path d="M5 18.5V13h3.4v5.5zM10.3 18.5V9.6h3.4v8.9zM15.6 18.5V6.4h3.4v12.1z" class="f"/></symbol>
+  <symbol id="i-lv4" viewBox="0 0 24 24"><path d="M4 18.5V13h2.6v5.5zM8.7 18.5V10h2.6v8.5zM13.4 18.5V6.8h2.6v11.7zM18.1 18.5V4h2.6v14.5z" class="f"/></symbol>
+  <symbol id="i-file" viewBox="0 0 24 24"><path d="M13.5 3.5H7A2.5 2.5 0 0 0 4.5 6v12A2.5 2.5 0 0 0 7 20.5h10A2.5 2.5 0 0 0 19.5 18V9.5z"/><path d="M13.5 3.5v6h6"/></symbol>
+  <symbol id="i-clock" viewBox="0 0 24 24"><circle cx="12" cy="12" r="8.5"/><path d="M12 7.2V12l3.2 2"/></symbol>
+  <symbol id="i-folder" viewBox="0 0 24 24"><path d="M3.5 6.5A1.5 1.5 0 0 1 5 5h4l2 2.5h8A1.5 1.5 0 0 1 20.5 9v9A1.5 1.5 0 0 1 19 19.5H5A1.5 1.5 0 0 1 3.5 18z"/></symbol>
+</svg>
+
+<div id="app">
+
+  <!-- rail: identity, one primary action, sessions, identity again.
+       Everything else is a popover anchored where it belongs. -->
+  <aside id="side">
+   <div class="side-inner">
+    <div class="side-head">
+      <div class="brand">
+        <span class="brand-name">CST-Agent</span>
+      </div>
+      <button id="btn-collapse" class="icon" title="收起侧栏 (Ctrl+B)">
+        <svg class="i"><use href="#i-panel-left"/></svg>
+      </button>
+    </div>
+
+    <button id="btn-new" class="new-task">
+      <svg class="i"><use href="#i-plus"/></svg><span>新建任务</span>
+    </button>
+
+    <div class="side-sec">
+      <span>最近</span>
+      <button id="btn-refresh-sessions" class="icon tiny" title="刷新">
+        <svg class="i"><use href="#i-refresh"/></svg>
+      </button>
+    </div>
+    <input id="sess-search" class="sess-search" type="search" placeholder="搜索会话" autocomplete="off">
+    <div id="sessions-list" class="sessions"></div>
+
+    <div class="side-foot">
+      <div class="who">
+        <span class="avatar">C</span>
+        <span class="who-text">
+          <b id="foot-ws">workspace</b>
+          <i id="foot-session">-</i>
+        </span>
+      </div>
+      <button id="btn-settings" class="icon" title="设置">
+        <svg class="i"><use href="#i-settings"/></svg>
+      </button>
+    </div>
+   </div>
+  </aside>
+
+  <!-- main column -->
+  <main id="main">
+    <header id="topbar">
+      <button id="btn-side" class="icon" title="展开侧栏 (Ctrl+B)">
+        <svg class="i"><use href="#i-panel-left"/></svg>
+      </button>
+      <button id="btn-drawer" class="icon only-narrow" title="侧栏">
+        <svg class="i"><use href="#i-menu"/></svg>
+      </button>
+      <button id="chip-model" class="chip model" title="模型与推理强度">
+        <svg class="i"><use href="#i-cpu"/></svg><span class="lbl">-</span>
+        <svg class="i chev"><use href="#i-chevron"/></svg>
+      </button>
       <span class="grow"></span>
-  <button id="btn-sessions" title="sessions">会话</button>
+      <div class="seg" id="seg-mode" title="计划模式只读，不改文件">
-  <button id="btn-model" title="model">模型</button>
+        <button data-mode="build">构建</button>
-  <button id="btn-undo" title="undo">撤销</button>
+        <button data-mode="plan">计划</button>
-  <button id="btn-compact" title="compact">压缩</button>
+      </div>
-  <button id="btn-clear" title="clear view">清屏</button>
+      <button id="chip-approval" class="chip quiet" title="审批权限">
+        <svg class="i"><use href="#i-shield"/></svg><span class="lbl">auto</span>
+        <svg class="i chev"><use href="#i-chevron"/></svg>
+      </button>
+      <button id="btn-theme" class="icon" title="明暗切换">
+        <svg class="i only-dark"><use href="#i-moon"/></svg>
+        <svg class="i only-light"><use href="#i-sun"/></svg>
+      </button>
+      <button id="btn-panel" class="icon" title="运行详情 (Ctrl+J)">
+        <svg class="i"><use href="#i-panel-right"/></svg>
+      </button>
+      <button id="btn-menu" class="icon" title="更多">
+        <svg class="i"><use href="#i-more"/></svg>
+      </button>
     </header>
 
-<main id="log"></main>
+    <div id="scroll">
-<aside id="todo" hidden></aside>
+      <section id="empty">
+        <p class="ready">准备好开始构建了吗</p>
+      </section>
+      <div id="log"></div>
+    </div>
+
+    <button id="to-bottom" class="round" hidden title="回到最新">
+      <svg class="i"><use href="#i-chevron"/></svg>
+    </button>
 
     <footer id="composer">
-  <div id="pending" hidden></div>
+      <div id="pending" class="pending" hidden></div>
-  <div class="row">
+      <div id="edit-bar" class="edit-bar" hidden>
-    <textarea id="input" rows="1" placeholder="输入消息，Enter 发送，Shift+Enter 换行"></textarea>
+        <span>编辑上一条消息：发送后替换它并重新回答（文件改动保留，需要时先撤销）</span>
-    <button id="btn-send">发送</button>
+        <span class="grow"></span>
-    <button id="btn-stop" hidden>停止</button>
+        <button id="btn-edit-cancel" class="link">取消</button>
-    <label class="att" title="附上图片"><input type="file" id="file" accept="image/*" hidden>+图</label>
       </div>
-  <div class="hint"><span id="status">就绪</span><span class="grow"></span><span id="usage" class="muted"></span></div>
-</footer>
 
+      <!-- permission gate: inline, the turn really is waiting on it -->
+      <div id="gate" class="gate" hidden>
+        <div class="gate-head">
+          <span class="gate-title" id="gate-title">需要确认</span>
+          <span class="grow"></span>
+          <span class="gate-timer" id="gate-timer"></span>
+        </div>
+        <pre id="gate-detail"></pre>
+        <div class="gate-keys" id="gate-keys"></div>
+        <div class="gate-row" id="gate-buttons"></div>
+      </div>
+
+      <div id="slash" class="slash" role="listbox" hidden></div>
+      <div class="box">
+        <textarea id="input" rows="1" placeholder="给 CST-Agent 派个任务…（/ 打开命令，F1 看快捷键）"></textarea>
+        <div class="box-row">
+          <button id="btn-plus" class="icon att" title="添加图片或计划模式">
+            <svg class="i"><use href="#i-plus"/></svg>
+          </button>
+          <button id="btn-undo" class="chip quiet" title="撤销上一次文件写入">
+            <svg class="i"><use href="#i-undo"/></svg><span>撤销</span>
+          </button>
+          <span class="grow"></span>
+          <button id="cost" class="cost" title="用量详情"></button>
+          <button id="btn-stop" class="icon stop" hidden title="停止">
+            <svg class="i"><use href="#i-stop"/></svg>
+          </button>
+          <button id="btn-send" class="round send" title="发送 (Enter)">
+            <svg class="i"><use href="#i-send"/></svg>
+          </button>
+        </div>
+      </div>
+      <div class="hint-line">
+        <span id="status">就绪</span>
+        <span class="grow"></span>
+        <span id="usage" class="quiet"></span>
+      </div>
+      <input type="file" id="file" accept="image/*" multiple hidden>
+    </footer>
+  </main>
+
+  <!-- right panel: the run, not the chat -->
+  <aside id="panel">
+   <div class="panel-inner">
+    <div class="panel-head">
+      <span>运行详情</span>
+      <span class="grow"></span>
+      <button id="btn-panel-close" class="icon tiny" title="关闭">
+        <svg class="i"><use href="#i-close"/></svg>
+      </button>
+    </div>
+
+    <section class="card" id="card-todo">
+      <h4>任务清单</h4>
+      <div id="todo-body" class="muted">模型还没有给出任务清单。</div>
+    </section>
+
+    <section class="card" id="card-files">
+      <h4>文件改动 <span class="badge" id="files-count">0</span>
+        <span class="grow"></span><button id="btn-diff" class="link" title="git status + git diff">查看 diff</button></h4>
+      <div id="files-body" class="muted">本轮还没有改动文件。</div>
+    </section>
+
+    <section class="card">
+      <h4>上下文</h4>
+      <div class="kv"><span>占用</span><b id="kv-ctx">0</b></div>
+      <div class="kv"><span>缓存命中</span><b id="kv-cache">-</b></div>
+    </section>
+   </div>
+  </aside>
+
+</div>
+
+<div id="backdrop"></div>
+<div id="pop" class="pop" hidden></div>
 <div id="modal" hidden><div id="modal-box"></div></div>
+<div id="toast" class="toast" role="status" aria-live="polite" hidden></div>
+<script>
+/* Layout is decided here, before app.js runs and before the first paint: the
+ * rail must not flash open and then fold, and a broken script further down can
+ * no longer take the layout down with it. */
+(() => {
+  const q = new URLSearchParams(location.search);
+  const pick = (key) => {
+    const v = q.get(key);
+    if (v === '0' || v === '1') return v === '0';
+    return localStorage.getItem('cst.' + key) === '0';
+  };
+  if (pick('side')) document.body.classList.add('no-side');
+  if (pick('panel')) document.body.classList.add('no-panel');
+  const t = q.get('theme') || localStorage.getItem('cst.theme');
+  if (t) document.documentElement.dataset.theme = t;
+})();
+</script>
 <script src="app.js"></script>
 </body>
 </html>

web/style.css

@@ -1,103 +1,827 @@
+/* CST-Agent WebUI - one stylesheet, no build step.
+ *
+ * Design rules
+ *   - one fact, one home: sessions in the rail, model/approval/plan in the
+ *     top bar, the run in the right panel, attachments in the composer;
+ *   - settings open as popovers anchored to the control that owns them,
+ *     with icon + label + one line of explanation + a check on the current
+ *     value (the pattern all three reference apps use);
+ *   - motion is short and eased: 120ms for feedback, 180ms for entrances,
+ *     nothing bounces, and prefers-reduced-motion turns it all off. */
+
+/* Tokens are named the way the reference desktop app names them: four text
+ * levels, three surfaces per zone (main / sidebar / composer), and borders
+ * mixed out of the foreground rather than hard-coded greys - which is what
+ * keeps the dark and the light sheet on the same visual rhythm. */
 :root {
-  --bg: #14161a;
+  color-scheme: dark;
-  --bg2: #1b1e24;
+
-  --fg: #d8dde5;
+  --text-primary: #f2f2f5;
-  --muted: #8b93a1;
+  --text-secondary: #a9a9b4;
-  --line: #2a2f38;
+  --text-tertiary: #7d7d89;
-  --accent: #7fb2ff;
+  --text-quaternary: #5e5e69;
-  --ok: #7ddc8f;
+  --text-error: #f0616d;
-  --warn: #ffcc66;
+  --text-success: #3ecf95;
-  --err: #ff7b72;
+
-  --tool: #b5e3c8;
+  --main-surface-primary: #0d0d0f;
+  --main-surface-secondary: #141417;
+  --main-surface-tertiary: #1d1d22;
+
+  --sidebar-surface-primary: #111114;
+  --sidebar-surface-secondary: #18181c;
+  --sidebar-surface-tertiary: #202026;
+
+  --composer-surface-primary: #16161a;
+  --composer-surface-secondary: #202026;
+
+  --bg-code: #08080a;
+
+  /* every hover/active tint is alpha, so it lands correctly on any surface */
+  --hover: color-mix(in srgb, var(--text-primary) 7%, transparent);
+  --hover-strong: color-mix(in srgb, var(--text-primary) 13%, transparent);
+
+  --accent-primary: #3ecf95;
+  --accent-fg: #04241a;
+  --accent-weak: color-mix(in srgb, var(--accent-primary) 14%, transparent);
+  --accent-line: color-mix(in srgb, var(--accent-primary) 55%, transparent);
+  --link: var(--accent-primary);
+  --violet: #8b7bff;
+  --warn: #e0b341;
+  --selection-bg: color-mix(in srgb, var(--accent-primary) 30%, transparent);
+  --selection-fg: var(--text-primary);
+
+  --border-light: color-mix(in srgb, var(--text-primary) 14%, transparent);
+  --border-medium: color-mix(in srgb, var(--text-primary) 24%, transparent);
+  --border-heavy: color-mix(in srgb, var(--text-primary) 34%, transparent);
+
+  /* short aliases: the rest of the sheet keeps reading the same way */
+  --bg: var(--main-surface-primary);
+  --bg-soft: var(--main-surface-secondary);
+  --bg-lift: var(--main-surface-tertiary);
+  --bg-hover: var(--hover);
+  --fg: var(--text-primary);
+  --fg-dim: var(--text-secondary);
+  --fg-faint: var(--text-tertiary);
+  --fg-quat: var(--text-quaternary);
+  --line: var(--border-light);
+  --line-strong: var(--border-medium);
+  --accent: var(--accent-primary);
+  --danger: var(--text-error);
+
+  --rail: 252px;
+  --panel: 296px;
+  --radius: 12px;
+  --radius-lg: 22px;
+  --shadow: 0 16px 40px rgba(0, 0, 0, .45);
+  --shadow-sm: 0 6px 18px rgba(0, 0, 0, .3);
+  --mono: ui-monospace, SFMono-Regular, "JetBrains Mono", Menlo, Consolas, monospace;
+  --sans: system-ui, -apple-system, "Segoe UI", Roboto, "Noto Sans CJK SC", sans-serif;
+  --ease: cubic-bezier(.22, .61, .36, 1);
+  --ease-pop: cubic-bezier(.2, .9, .3, 1.06);   /* enters with a hint of overshoot */
+  --t-fast: 120ms;
+  --t: 180ms;
 }
+[data-theme="light"] {
+  color-scheme: light;
+
+  --text-primary: #14141a;
+  --text-secondary: #55555f;
+  --text-tertiary: #7c7c86;
+  --text-quaternary: #9c9ca6;
+  --text-error: #c8303f;
+  --text-success: #0f8f66;
+
+  --main-surface-primary: #ffffff;
+  --main-surface-secondary: #f7f7f9;
+  --main-surface-tertiary: #ffffff;
+
+  --sidebar-surface-primary: #fafafb;
+  --sidebar-surface-secondary: #f1f1f4;
+  --sidebar-surface-tertiary: #ffffff;
+
+  --composer-surface-primary: #ffffff;
+  --composer-surface-secondary: #f4f4f6;
+
+  --bg-code: #f5f5f7;
+
+  --accent-primary: #0f9d70;
+  --accent-fg: #ffffff;
+
+  --border-light: color-mix(in srgb, var(--text-primary) 12%, transparent);
+  --border-medium: color-mix(in srgb, var(--text-primary) 20%, transparent);
+  --border-heavy: color-mix(in srgb, var(--text-primary) 30%, transparent);
+
+  --warn: #a9761a;
+  --shadow: 0 16px 40px rgba(20, 20, 35, .14);
+  --shadow-sm: 0 6px 18px rgba(20, 20, 35, .1);
+}
+
 * { box-sizing: border-box; }
-html, body { margin: 0; height: 100%; }
+html, body { height: 100%; margin: 0; }
 body {
   background: var(--bg); color: var(--fg);
-  font: 14px/1.55 ui-monospace, SFMono-Regular, Menlo, Consolas, "Noto Sans Mono CJK SC", monospace;
+  font: 15px/1.62 var(--sans);
-  display: flex; flex-direction: column; height: 100%;
+  -webkit-font-smoothing: antialiased;
+  -webkit-text-size-adjust: 100%;
+  overflow: hidden; /* columns scroll, never the page */
 }
-button {
+button, textarea, input { font: inherit; color: inherit; }
-  background: var(--bg2); color: var(--fg); border: 1px solid var(--line);
+button { cursor: pointer; background: none; border: 0; }
-  border-radius: 6px; padding: 3px 9px; font: inherit; cursor: pointer;
+button:disabled { cursor: default; }
-}
+.grow { flex: 1 1 auto; }
-button:hover { border-color: var(--accent); }
+.quiet, .muted { color: var(--fg-dim); }
-.grow { flex: 1; }
+.tiny { font-size: 12px; }
-.muted { color: var(--muted); }
+[hidden] { display: none !important; }
+::selection { background: var(--selection-bg); color: var(--selection-fg); }
 
-#bar {
+/* one icon system: everything is drawn on the same 24px grid, stroked with
-  display: flex; align-items: center; gap: 8px; padding: 6px 10px;
+ * the current text colour, so header, rail, popovers and composer match */
-  border-bottom: 1px solid var(--line); background: var(--bg2);
+svg.i {
-  position: sticky; top: 0; z-index: 3; flex-wrap: wrap;
+  width: 18px; height: 18px; flex: 0 0 auto; display: block;
+  fill: none; stroke: currentColor; stroke-width: 1.7;
+  stroke-linecap: round; stroke-linejoin: round;
 }
-.tag { border: 1px solid var(--line); border-radius: 999px; padding: 0 8px; color: var(--muted); }
+svg.i .f { fill: currentColor; stroke: none; }
-.tag.on { color: var(--bg); background: var(--accent); border-color: var(--accent); }
+.icon svg.i { width: 18px; height: 18px; }
-.ws { color: var(--muted); overflow: hidden; text-overflow: ellipsis; max-width: 40vw; white-space: nowrap; }
+.icon.tiny svg.i { width: 15px; height: 15px; }
-.model { color: var(--accent); }
+.chip svg.i { width: 15px; height: 15px; }
+.chip .chev { width: 13px; height: 13px; opacity: .6; }
+.new-task svg.i { width: 17px; height: 17px; }
+.send svg.i { width: 19px; height: 19px; stroke-width: 2; }
+svg.i.only-light { display: none; }
+[data-theme="light"] svg.i.only-dark { display: none; }
+[data-theme="light"] svg.i.only-light { display: block; }
 
-#log { flex: 1; overflow: auto; padding: 12px 14px 20px; }
+/* the changed-file rows in the run panel: path, then +added / -removed */
-#log .msg { margin: 0 0 14px; }
+.fstat { display: flex; align-items: center; gap: 8px; padding: 5px 0; font-size: 13px; animation: fade-in var(--t) var(--ease) both; }
-#log .who { color: var(--muted); font-size: 12px; margin-bottom: 2px; }
+.fstat .fimg { width: 15px; height: 15px; color: var(--text-quaternary); }
-#log .body { white-space: pre-wrap; word-break: break-word; }
+.fstat .p {
-#log .assistant .body > :first-child { margin-top: 0; }
+  flex: 1 1 auto; min-width: 0; overflow: hidden; text-overflow: ellipsis;
-#log .body pre {
+  white-space: nowrap; font-family: var(--mono); font-size: 12px;
-  background: var(--bg2); border: 1px solid var(--line); border-radius: 6px;
-  padding: 8px 10px; overflow: auto;
 }
-#log .body code { background: var(--bg2); border-radius: 4px; padding: 0 3px; }
+.fstat .a, .fstat .d { font-variant-numeric: tabular-nums; font-size: 12px; }
-#log .body pre code { background: none; padding: 0; }
+.fstat .a { color: var(--text-success); }
-#log .body table { border-collapse: collapse; }
+.fstat .d { color: var(--text-error); }
-#log .body th, #log .body td { border: 1px solid var(--line); padding: 2px 6px; }
-#log .body blockquote { border-left: 3px solid var(--line); margin: 0; padding-left: 10px; color: var(--muted); }
-#log .body a { color: var(--accent); }
-#log .body img { max-width: min(420px, 100%); border-radius: 6px; border: 1px solid var(--line); }
 
-details.think { color: var(--muted); margin: 4px 0; }
+::-webkit-scrollbar { width: 10px; height: 10px; }
-details.think summary { cursor: pointer; }
+::-webkit-scrollbar-thumb {
-details.tool {
+  background: var(--line-strong); border-radius: 99px;
-  border: 1px solid var(--line); border-radius: 6px; margin: 6px 0; background: var(--bg2);
+  border: 3px solid transparent; background-clip: content-box;
 }
-details.tool > summary { cursor: pointer; padding: 4px 8px; color: var(--tool); }
+::-webkit-scrollbar-thumb:hover { background: var(--fg-faint); background-clip: content-box; }
-details.tool .args, details.tool pre { margin: 0; padding: 6px 10px; white-space: pre-wrap; }
-details.tool pre { border-top: 1px solid var(--line); max-height: 40vh; overflow: auto; }
-.tool .exit-bad { color: var(--err); }
-.spin::after { content: " …"; color: var(--warn); }
 
-#todo {
+/* --- frame ---------------------------------------------------------------- */
-  border-top: 1px solid var(--line); background: var(--bg2); padding: 6px 12px;
+#app {
-  max-height: 22vh; overflow: auto; white-space: pre-wrap; font-size: 13px;
+  display: grid;
+  grid-template-columns: var(--rail) minmax(0, 1fr) var(--panel);
+  grid-template-rows: minmax(0, 1fr);
+  height: 100dvh;
+  /* the rail keeps its track and collapses to 0px, so the two states have the
+   * same track count and the column width can actually be interpolated */
+  transition: grid-template-columns 300ms var(--ease);
 }
-#todo h4 { margin: 0 0 4px; color: var(--muted); font-size: 12px; font-weight: normal; }
+/* a zeroed track plus display:none used to slide #main into column one and
+ * crush it to nothing; the rail now stays in flow and is clipped instead */
+body.no-side #app { grid-template-columns: 0px minmax(0, 1fr) var(--panel); }
+body.no-panel #app { grid-template-columns: var(--rail) minmax(0, 1fr) 0px; }
+body.no-side.no-panel #app { grid-template-columns: 0px minmax(0, 1fr) 0px; }
+/* the expand control only exists while the rail is folded away, so exactly one
+ * toggle is ever on screen */
+#btn-side { display: none; }
+body.no-side #btn-side { display: inline-flex; }
 
-#composer { border-top: 1px solid var(--line); background: var(--bg2); padding: 8px 10px; }
+.icon {
-#composer .row { display: flex; gap: 8px; align-items: flex-end; }
+  width: 32px; height: 32px; border-radius: 9px; flex: 0 0 auto;
-#input {
+  display: inline-flex; align-items: center; justify-content: center;
-  flex: 1; resize: vertical; min-height: 34px; max-height: 40vh;
+  color: var(--fg-dim); font-size: 15px;
-  background: var(--bg); color: var(--fg); border: 1px solid var(--line);
+  transition: background var(--t-fast), color var(--t-fast), transform 90ms var(--ease);
-  border-radius: 6px; padding: 7px 9px; font: inherit;
 }
-.att {
+.icon:hover { background: var(--bg-hover); color: var(--fg); }
-  border: 1px solid var(--line); border-radius: 6px; padding: 5px 9px; cursor: pointer;
+.icon:active { transform: scale(.94); }
+.icon.tiny { width: 26px; height: 26px; font-size: 13px; }
+.round { border-radius: 50%; }
+.chip {
+  display: inline-flex; align-items: center; gap: 5px; height: 30px;
+  padding: 0 11px; border-radius: 99px; border: 1px solid transparent;
+  background: none; color: var(--fg-dim); font-size: 13px;
+  max-width: 280px; overflow: hidden; text-overflow: ellipsis; white-space: nowrap;
+  transition: background var(--t-fast), color var(--t-fast), border-color var(--t-fast), transform 90ms var(--ease);
+}
+.chip:hover { background: var(--bg-hover); color: var(--fg); }
+.chip:active { transform: scale(.97); }
+.chip.model { color: var(--fg); font-weight: 600; background: var(--bg-lift); border-color: var(--line); }
+.chip.model:hover { border-color: var(--line-strong); }
+.chip.warn { color: var(--warn); }
+.chip .chev { font-size: 11px; opacity: .65; }
+.badge {
+  min-width: 18px; height: 18px; padding: 0 5px; border-radius: 99px;
+  background: var(--accent-weak); color: var(--accent);
+  font-size: 11px; font-weight: 700;
+  display: inline-flex; align-items: center; justify-content: center;
 }
-.hint { display: flex; gap: 10px; font-size: 12px; color: var(--muted); padding-top: 4px; }
-#pending { color: var(--warn); font-size: 12px; padding-bottom: 4px; }
 
+/* --- rail ----------------------------------------------------------------- */
+#side {
+  background: var(--sidebar-surface-primary); border-right: 1px solid var(--border-light);
+  min-width: 0; overflow: hidden;      /* clips the rail while its track collapses */
+}
+/* the contents keep their own width and slide out, so nothing reflows mid-flight
+ * and the exit reads as one movement instead of a squeeze */
+.side-inner {
+  width: var(--rail); height: 100%; min-width: 0;
+  display: flex; flex-direction: column; padding: 12px 10px 10px;
+  transition: transform 300ms var(--ease-pop), opacity 200ms var(--ease);
+}
+body.no-side .side-inner { transform: translateX(-18px); opacity: 0; }
+body.no-side #side { pointer-events: none; }
+.side-head { display: flex; align-items: center; gap: 2px; margin-bottom: 14px; }
+/* the wordmark is a label, not a control: no logo tile, nothing to click */
+.brand { flex: 1 1 auto; display: flex; align-items: center; min-width: 0; padding: 6px 8px; }
+.brand-name {
+  font-weight: 700; letter-spacing: .2px; font-size: 15px;
+  overflow: hidden; text-overflow: ellipsis; white-space: nowrap;
+}
+
+.new-task {
+  display: flex; align-items: center; gap: 9px; height: 40px; padding: 0 12px;
+  margin-bottom: 18px; border-radius: 12px; font-weight: 600;
+  background: var(--bg-lift); border: 1px solid var(--line);
+  transition: border-color var(--t-fast), background var(--t-fast), transform 90ms var(--ease);
+}
+.new-task:hover { border-color: var(--line-strong); background: var(--bg-hover); }
+.new-task:active { transform: scale(.985); }
+.new-task .plus { color: var(--accent); font-size: 16px; line-height: 1; }
+
+.side-sec {
+  display: flex; align-items: center; gap: 6px; padding: 0 8px 6px;
+  color: var(--fg-faint); font-size: 11px; font-weight: 600;
+  letter-spacing: .7px; text-transform: uppercase;
+}
+.sessions { flex: 1 1 auto; overflow-y: auto; min-height: 40px; scrollbar-gutter: stable; }
+.sess-item {
+  display: flex; align-items: baseline; gap: 8px; width: 100%;
+  padding: 7px 9px; border-radius: 9px; text-align: left;
+  color: var(--text-secondary); font-size: 13.5px;
+  animation: fade-in var(--t) var(--ease) both;
+  transition: background var(--t-fast), color var(--t-fast);
+}
+.sess-item:hover { background: var(--hover); color: var(--text-primary); }
+.sess-item.on { background: var(--sidebar-surface-tertiary); color: var(--text-primary); font-weight: 600; }
+.sess-item.on::before {
+  content: ""; width: 5px; height: 5px; border-radius: 50%;
+  background: var(--accent); flex: 0 0 auto; align-self: center;
+}
+.sess-item .t { flex: 1 1 auto; min-width: 0; overflow: hidden; }
+.sess-item .ts { display: block; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+/* a title that does not fit fades at the edge and scrolls itself on hover, the
+ * way the reference sidebar handles long names (its data-marquee-text pattern) */
+.sess-item .t.mq { mask-image: linear-gradient(90deg, #000 calc(100% - 18px), transparent); }
+.sess-item:hover .t.mq { mask-image: none; }
+.sess-item:hover .t.mq .ts {
+  width: max-content; text-overflow: clip;
+  animation: marquee 2.6s var(--ease) 160ms infinite alternate;
+}
+@keyframes marquee { from { transform: none; } to { transform: translateX(calc(-1 * var(--mq, 0px))); } }
+.sess-item .n { font-size: 11px; color: var(--text-quaternary); font-weight: 400; white-space: nowrap; }
+.side-foot {
+  display: flex; align-items: center; gap: 6px; padding-top: 10px;
+  margin-top: 6px; border-top: 1px solid var(--line);
+}
+.who { display: flex; align-items: center; gap: 9px; min-width: 0; flex: 1 1 auto; }
+.avatar {
+  width: 28px; height: 28px; border-radius: 50%; flex: 0 0 auto;
+  background: linear-gradient(135deg, var(--violet), var(--accent));
+  color: #fff; font-weight: 800; font-size: 13px;
+  display: flex; align-items: center; justify-content: center;
+}
+.who-text { min-width: 0; display: flex; flex-direction: column; line-height: 1.3; }
+.who-text b { font-size: 12.5px; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+.who-text i { font-size: 11px; color: var(--fg-faint); font-style: normal; }
+
+/* --- top bar -------------------------------------------------------------- */
+#main { display: flex; flex-direction: column; min-width: 0; position: relative; }
+#topbar { display: flex; align-items: center; gap: 4px; padding: 9px 12px; border-bottom: 1px solid var(--line); }
+.seg {
+  display: flex; background: var(--bg-soft); border: 1px solid var(--line);
+  border-radius: 99px; padding: 2px; position: relative;
+}
+.seg button {
+  height: 25px; padding: 0 12px; border-radius: 99px; color: var(--fg-dim); font-size: 12.5px;
+  transition: color var(--t-fast), background var(--t);
+}
+.seg button.on { background: var(--bg-lift); color: var(--fg); font-weight: 600; }
+.only-narrow { display: none; }
+
+#scroll {
+  flex: 1 1 auto; overflow-y: auto; padding: 22px 0 10px;
+  scroll-behavior: smooth; scrollbar-gutter: stable;
+}
+#log { max-width: 760px; margin: 0 auto; padding: 0 20px; }
+#log:empty { display: none; }
+
+/* --- empty state ---------------------------------------------------------- */
+/* the first screen is one line: no logo, no suggestion wall. It goes away the
+ * moment the first message lands (see showEmpty). */
+#empty { margin: 22vh auto 0; padding: 0 20px; text-align: center; }
+#empty.gone { display: none; }
+#empty .ready {
+  margin: 0; color: var(--text-tertiary); font-size: 15px; letter-spacing: .3px;
+  animation: fade-in 320ms var(--ease) both;
+}
+
+/* --- transcript ----------------------------------------------------------- */
+.msg { display: flex; gap: 12px; padding: 13px 0 0; animation: fade-up var(--t) var(--ease) both; }
+.msg .gutter { flex: 0 0 24px; padding-top: 2px; color: var(--fg-faint); font-size: 11px; text-align: center; user-select: none; }
+.msg .body { min-width: 0; flex: 1 1 auto; }
+.msg.user { justify-content: flex-end; }
+.msg.user .gutter { display: none; }
+.msg.user .body {
+  background: var(--bg-lift); border-radius: 18px 18px 6px 18px;
+  padding: 9px 15px; max-width: 76%; white-space: pre-wrap; word-break: break-word;
+}
+.msg.error .body { color: var(--danger); white-space: pre-wrap; }
+.body > :first-child, .live-html > :first-child { margin-top: 0; }
+.body > :last-child, .live-html > :last-child { margin-bottom: 0; }
+.body h1, .body h2, .body h3, .body h4 { line-height: 1.35; margin: 1.1em 0 .5em; }
+.body h1 { font-size: 1.45em; } .body h2 { font-size: 1.25em; } .body h3 { font-size: 1.1em; }
+.body p, .body ul, .body ol { margin: .55em 0; }
+.body ul, .body ol { padding-left: 1.4em; }
+.body li { margin: .22em 0; }
+.body a { color: var(--link); }
+.body code {
+  font-family: var(--mono); font-size: .88em; background: var(--bg-code);
+  border: 1px solid var(--line); border-radius: 6px; padding: .1em .35em;
+}
+.body pre {
+  background: var(--bg-code); border: 1px solid var(--line);
+  border-radius: 12px; padding: 12px 14px; overflow-x: auto; margin: .75em 0;
+}
+.body pre code { background: none; border: 0; padding: 0; font-size: 13px; }
+.body blockquote { margin: .75em 0; padding: .1em 0 .1em 12px; border-left: 3px solid var(--line-strong); color: var(--fg-dim); }
+.body table { border-collapse: collapse; margin: .75em 0; font-size: 13.5px; display: block; overflow-x: auto; }
+.body th, .body td { border: 1px solid var(--line); padding: 5px 9px; text-align: left; }
+.body th { background: var(--bg-soft); }
+.body img { max-width: 100%; border-radius: 10px; }
+.body hr { border: 0; border-top: 1px solid var(--line); margin: 1.2em 0; }
+/* a caret while tokens are still arriving */
+.body.live > .live-html > :last-child::after {
+  content: ""; display: inline-block; width: 7px; height: 14px;
+  margin-left: 3px; vertical-align: -2px; border-radius: 2px;
+  background: var(--accent); animation: blink 1.1s steps(2, start) infinite;
+}
+
+.attach-strip { display: flex; flex-wrap: wrap; gap: 8px; margin: 2px 0 8px; justify-content: flex-end; }
+.attach-strip img {
+  width: 108px; height: 108px; object-fit: cover; border-radius: 12px;
+  border: 1px solid var(--line); animation: rise var(--t) var(--ease) both;
+}
+
+.turn-meta { display: flex; align-items: center; gap: 10px; padding: 10px 0 2px 36px; }
+.turn-meta details > summary { cursor: pointer; list-style: none; color: var(--fg-faint); font-size: 12px; transition: color var(--t-fast); }
+.turn-meta details > summary::-webkit-details-marker { display: none; }
+.turn-meta details > summary:hover { color: var(--fg-dim); }
+.msg:has(> .msg-actions) { flex-wrap: wrap; row-gap: 0; }
+.msg-actions { display: flex; flex-basis: 100%; gap: 2px; padding: 4px 0 0 36px; opacity: 0; transition: opacity var(--t) var(--ease); }
+.msg:hover .msg-actions, .msg-actions:focus-within { opacity: 1; }
+.msg-actions button {
+  height: 26px; padding: 0 9px; border-radius: 8px; color: var(--fg-faint); font-size: 12px;
+  transition: background var(--t-fast), color var(--t-fast);
+}
+.msg-actions button:hover { background: var(--bg-hover); color: var(--fg); }
+
+.think { margin: .1em 0 .5em; }
+.think summary { cursor: pointer; list-style: none; color: var(--fg-faint); font-size: 12.5px; transition: color var(--t-fast); }
+.think summary::-webkit-details-marker { display: none; }
+.think summary::before { content: "▸ "; }
+.think[open] summary::before { content: "▾ "; }
+.think summary:hover { color: var(--fg-dim); }
+.think > div {
+  color: var(--fg-dim); font-size: 13.5px; white-space: pre-wrap;
+  padding: 6px 0 2px 14px; border-left: 2px solid var(--line);
+  animation: fade-in var(--t) var(--ease) both;
+}
+
+/* tool calls: one line, opens on demand (like "已执行 python · <<PY>") */
+.turn-steps { padding: 6px 0 0 36px; }
+.turn-steps > summary { cursor: pointer; list-style: none; color: var(--fg-faint); font-size: 12.5px; transition: color var(--t-fast); }
+.turn-steps > summary::-webkit-details-marker { display: none; }
+.turn-steps > summary::before { content: "⌘ "; }
+.turn-steps > summary:hover { color: var(--fg-dim); }
+.steps-box { padding: 2px 0 0 12px; margin-top: 4px; border-left: 2px solid var(--line); }
+.step-line { animation: fade-up var(--t) var(--ease) both; }
+.step-line > summary {
+  display: flex; align-items: baseline; gap: 8px; cursor: pointer; list-style: none;
+  padding: 5px 0; font-size: 13px; color: var(--fg-dim);
+  transition: color var(--t-fast);
+}
+.step-line > summary::-webkit-details-marker { display: none; }
+.step-line > summary:hover { color: var(--fg); }
+.step-line .name { font-family: var(--mono); font-size: 12.5px; color: var(--fg); }
+.step-line .args { flex: 1 1 auto; min-width: 0; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; font-family: var(--mono); font-size: 12px; }
+.step-line .phase { font-size: 11.5px; color: var(--fg-faint); white-space: nowrap; display: inline-flex; align-items: center; gap: 6px; }
+.step-line.run .phase { color: var(--warn); }
+.step-line.run .phase::before {
+  content: ""; width: 6px; height: 6px; border-radius: 50%;
+  background: var(--warn); animation: pulse 1.1s var(--ease) infinite;
+}
+.step-line.bad .phase, .step-line.bad .name { color: var(--danger); }
+.step-line.done .phase::before { content: "✓"; }
+.step-line.bad .phase::before { content: "✕"; }
+/* a sub-agent's latest steps, next to its task */
+.step-line .step-detail {
+  flex: 0 1 40%; min-width: 0; overflow: hidden; text-overflow: ellipsis; white-space: nowrap;
+  font-family: var(--mono); font-size: 11.5px; color: var(--fg-faint);
+}
+.step-line.done .step-detail { display: none; }
+/* "[cst] plan mode is now ON" and other engine notes in the history */
+.note-line {
+  padding: 6px 0 2px 36px; font-size: 12px; color: var(--fg-faint);
+  white-space: nowrap; overflow: hidden; text-overflow: ellipsis;
+}
+.note-line::before { content: "· "; }
+.step-body { padding: 0 0 6px; animation: fade-in var(--t) var(--ease) both; }
+.step-out, .step-args-full {
+  font-family: var(--mono); font-size: 12px; background: var(--bg-code);
+  border: 1px solid var(--line); border-radius: 10px; padding: 9px 11px;
+  margin: 4px 0 0; max-height: 300px; overflow: auto; white-space: pre-wrap; word-break: break-word;
+}
+
+#to-bottom {
+  position: absolute; right: 26px; bottom: 172px; z-index: 5;
+  width: 38px; height: 38px; display: flex; align-items: center; justify-content: center;
+  background: var(--bg-lift); border: 1px solid var(--line-strong); color: var(--fg-dim);
+  box-shadow: var(--shadow-sm); font-size: 16px;
+  animation: fade-in var(--t) var(--ease) both;
+  transition: color var(--t-fast), transform 90ms var(--ease), background var(--t-fast);
+}
+#to-bottom:hover { color: var(--fg); background: var(--bg-hover); }
+#to-bottom:active { transform: scale(.94); }
+
+/* --- composer ------------------------------------------------------------- */
+#composer { padding: 8px 20px 12px; }
+#composer > * { max-width: 760px; margin: 0 auto; }
+.pending { display: flex; flex-wrap: wrap; gap: 8px; padding: 0 0 8px; }
+.pending .chip { background: var(--bg-soft); border-color: var(--line); }
+.edit-bar {
+  display: flex; align-items: center; gap: 8px; padding: 6px 10px; margin-bottom: 8px;
+  border-radius: 10px; border: 1px solid var(--line); background: var(--bg-soft);
+  color: var(--fg-dim); font-size: 12.5px;
+}
+.edit-bar[hidden] { display: none; }
+.msg.user .msg-actions { justify-content: flex-end; padding-left: 0; }
+.sess-search {
+  width: calc(100% - 8px); margin: 0 4px 8px; height: 30px; padding: 0 10px;
+  border-radius: 9px; border: 1px solid var(--line); background: var(--bg-soft);
+  color: var(--fg); font-size: 13px;
+}
+.sess-item { cursor: pointer; }
+#modal-box .sess-list { max-height: min(56vh, 520px); overflow-y: auto; margin: 4px 0 10px; }
+#modal-box .sess button { flex: 0 0 auto; }
+.sess-item .more {
+  flex: 0 0 auto; align-self: center; width: 22px; height: 22px; border-radius: 6px;
+  display: grid; place-items: center; color: var(--fg-faint); opacity: 0;
+  transition: opacity var(--t-fast), background var(--t-fast);
+}
+.sess-item:hover .more, .sess-item .more:focus-visible { opacity: 1; }
+.sess-item .more:hover { background: var(--bg-hover); color: var(--fg); }
+.sess-item .more .i { width: 16px; height: 16px; }
+#modal-box .sess button.danger { color: var(--danger, #e5484d); }
+button.fstat { width: 100%; text-align: left; border-radius: 7px; transition: background var(--t-fast); }
+button.fstat:hover { background: var(--bg-hover); }
+.danger-text { color: var(--danger); }
+#modal-box.wide { width: min(980px, 100%); }
+#modal-box h4.sub { margin: 16px 0 6px; font-size: 13px; color: var(--fg-dim); font-weight: 650; }
+#modal-box .field select, #modal-box .field input[type=number] {
+  flex: 1 1 auto; min-width: 150px; background: var(--bg-lift); color: var(--fg);
+  border: 1px solid var(--line); border-radius: 10px; padding: 7px 10px; outline: none;
+}
+#modal-box .field > span { width: 84px; }
+#modal-box .checks { display: flex; flex-wrap: wrap; gap: 14px; }
+#modal-box .check { display: inline-flex; align-items: center; gap: 6px; font-size: 13px; cursor: pointer; }
+#modal-box .tool-list { max-height: 34vh; overflow-y: auto; border: 1px solid var(--line); border-radius: 10px; padding: 4px; }
+#modal-box .tool-row {
+  display: flex; align-items: center; gap: 8px; padding: 5px 6px; border-radius: 7px;
+  font-size: 12.5px; cursor: pointer;
+}
+#modal-box .tool-row:hover { background: var(--bg-hover); }
+#modal-box .tool-row.dim code { opacity: .55; }
+#modal-box .tool-row code { font-family: var(--mono); font-size: 12px; flex: 0 0 auto; }
+#modal-box .tool-row .perm { flex: 0 0 auto; color: var(--fg-faint); font-size: 11px; border: 1px solid var(--line); border-radius: 6px; padding: 0 5px; }
+#modal-box .tool-row .desc { flex: 1 1 auto; min-width: 0; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; color: var(--fg-dim); }
+#modal-box .diff-files { display: flex; flex-direction: column; gap: 1px; max-height: 24vh; overflow-y: auto; margin-bottom: 10px; }
+#modal-box .diff-file {
+  display: flex; gap: 10px; align-items: center; text-align: left; padding: 5px 8px;
+  border-radius: 7px; font-size: 12.5px;
+}
+#modal-box .diff-file:hover { background: var(--bg-hover); }
+#modal-box .diff-file.on { background: var(--accent-weak); }
+#modal-box .diff-file .st { flex: 0 0 52px; color: var(--fg-faint); font-size: 11.5px; }
+#modal-box .diff-file .p { font-family: var(--mono); overflow-wrap: anywhere; }
+pre.diff {
+  margin: 0; padding: 10px 0; max-height: 52vh; overflow: auto; border-radius: 10px;
+  background: var(--bg-soft); border: 1px solid var(--line);
+  font-family: var(--mono); font-size: 12px; line-height: 1.5;
+}
+pre.diff span { display: block; padding: 0 12px; white-space: pre; min-height: 1.5em; }
+pre.diff .add { color: var(--text-success); background: color-mix(in srgb, var(--text-success) 10%, transparent); }
+pre.diff .del { color: var(--text-error); background: color-mix(in srgb, var(--text-error) 10%, transparent); }
+pre.diff .hunk { color: var(--accent); }
+pre.diff .h { color: var(--fg-faint); font-weight: 600; }
+
+.box {
+  border: 1px solid var(--border-medium); border-radius: var(--radius-lg);
+  background: var(--composer-surface-primary); padding: 11px 13px 9px;
+  transition: border-color var(--t), box-shadow var(--t), background var(--t);
+}
+.box:hover { border-color: var(--border-heavy); }
+.box:focus-within {
+  border-color: var(--accent-line);
+  box-shadow: 0 0 0 3px var(--accent-weak);
+}
+.box textarea {
+  width: 100%; border: 0; background: none; resize: none; outline: none;
+  max-height: 240px; min-height: 26px; padding: 2px 2px 8px;
+  caret-color: var(--accent);
+}
+.box textarea::placeholder { color: var(--fg-faint); }
+.box-row { display: flex; align-items: center; gap: 6px; }
+.att { border: 1px solid var(--line); font-size: 17px; line-height: 1; }
+.cost { color: var(--fg-faint); font-size: 12px; padding: 0 4px; white-space: nowrap; }
+.cost:hover { color: var(--fg-dim); }
+.send {
+  width: 36px; height: 36px; flex: 0 0 auto; font-size: 17px; font-weight: 800;
+  background: var(--accent); color: var(--accent-fg);
+  transition: filter var(--t-fast), transform 90ms var(--ease), opacity var(--t-fast);
+}
+.send:hover { filter: brightness(1.08); }
+.send:active { transform: scale(.94); }
+.send:disabled { opacity: .38; }
+.icon.stop { border: 1px solid var(--line); font-size: 12px; }
+.hint-line { display: flex; align-items: center; gap: 10px; padding: 7px 6px 0; font-size: 12px; color: var(--fg-faint); }
+
+/* permission gate: inline, the turn really is waiting on it */
+.gate {
+  border: 1px solid color-mix(in srgb, var(--warn) 45%, transparent);
+  border-radius: var(--radius); padding: 11px 13px; margin-bottom: 10px;
+  background: color-mix(in srgb, var(--warn) 7%, var(--bg-soft));
+  animation: rise var(--t) var(--ease) both;
+}
+.gate-head { display: flex; align-items: center; gap: 8px; font-weight: 650; font-size: 14px; }
+.gate-timer { color: var(--warn); font-size: 12.5px; font-variant-numeric: tabular-nums; }
+.gate pre {
+  margin: 8px 0 0; background: var(--bg-code); border: 1px solid var(--line);
+  border-radius: 10px; padding: 9px 11px; max-height: 180px; overflow: auto;
+  font-family: var(--mono); font-size: 12.5px; white-space: pre-wrap; word-break: break-word;
+}
+.gate-keys { padding: 8px 0 2px; color: var(--fg-dim); font-size: 12.5px; }
+.gate-row { display: flex; flex-wrap: wrap; gap: 8px; margin-top: 6px; }
+.gate-row button {
+  height: 34px; padding: 0 14px; border-radius: 10px; font-weight: 600;
+  border: 1px solid var(--line-strong); background: var(--bg-lift);
+  transition: filter var(--t-fast), transform 90ms var(--ease), background var(--t-fast);
+}
+.gate-row button.ok { background: var(--accent); color: var(--accent-fg); border-color: transparent; }
+.gate-row button.danger { color: var(--danger); }
+.gate-row button:hover { filter: brightness(1.12); }
+.gate-row button:active { transform: scale(.97); }
+
+/* --- popovers: anchored, animated, and the only place settings live ------- */
+.pop {
+  position: fixed; z-index: 45; min-width: 236px; max-width: 320px;
+  background: var(--main-surface-tertiary); border: 1px solid var(--border-medium);
+  border-radius: 14px; padding: 6px; box-shadow: var(--shadow);
+  animation: pop-in 160ms var(--ease) both;
+}
+.pop-item {
+  display: flex; align-items: flex-start; gap: 10px; width: 100%;
+  padding: 9px 10px; border-radius: 10px; text-align: left;
+  transition: background var(--t-fast);
+}
+.pop-item:hover { background: var(--bg-hover); }
+.pop-item .pi { width: 18px; flex: 0 0 auto; text-align: center; color: var(--fg-dim); font-size: 14px; line-height: 1.4; }
+/* title over description: two lines, never one run-on line */
+.pop-item .pm { min-width: 0; flex: 1 1 auto; display: flex; flex-direction: column; gap: 2px; }
+.pop-item .pt { font-size: 13.5px; font-weight: 600; line-height: 1.35; }
+.pop-item .pd { font-size: 11.5px; color: var(--fg-faint); line-height: 1.4; }
+.pop-item .pk { flex: 0 0 auto; color: var(--accent); font-size: 13px; }
+.pop-item.on { background: var(--accent-weak); }
+.pop-item.on .pi, .pop-item.on .pt { color: var(--accent); }
+.pop-item.danger .pi, .pop-item.danger .pt { color: var(--danger); }
+.pop-sep { height: 1px; background: var(--line); margin: 5px 4px; }
+.pop-title { padding: 8px 10px 4px; color: var(--fg-faint); font-size: 11.5px; font-weight: 600; letter-spacing: .4px; }
+.pop-input { display: flex; gap: 6px; padding: 4px 6px 6px; }
+.pop-input input {
+  flex: 1 1 auto; min-width: 0; background: var(--bg-soft); border: 1px solid var(--line);
+  border-radius: 9px; padding: 7px 9px; outline: none; font-size: 13px;
+  caret-color: var(--accent);
+  transition: border-color var(--t-fast);
+}
+.pop-input input:focus { border-color: var(--accent-line); }
+.pop-input button {
+  height: 32px; padding: 0 12px; border-radius: 9px; font-weight: 600; font-size: 13px;
+  background: var(--accent); color: var(--accent-fg);
+  transition: filter var(--t-fast), transform 90ms var(--ease);
+}
+.pop-input button:active { transform: scale(.96); }
+.kv { display: flex; align-items: center; justify-content: space-between; gap: 10px; padding: 5px 10px; font-size: 13px; }
+.kv span { color: var(--fg-dim); }
+.kv b { font-variant-numeric: tabular-nums; font-weight: 600; min-width: 0; overflow-wrap: anywhere; text-align: right; }
+.pop { max-height: calc(100vh - 16px); overflow-y: auto; }
+.pop:has(.pop-list) { min-width: min(360px, 94vw); max-width: min(440px, 94vw); }
+.pop-head { display: flex; align-items: center; justify-content: space-between; gap: 8px; }
+.pop-list { max-height: min(46vh, 420px); overflow-y: auto; }
+.pop-list .pop-item .pt { overflow-wrap: anywhere; font-family: var(--mono); font-size: 12.5px; }
+.pop-empty { padding: 10px; color: var(--fg-faint); font-size: 12.5px; }
+.pop-note { padding: 2px 10px 6px; color: var(--fg-faint); font-size: 11.5px; line-height: 1.45; }
+.pop-note:empty { display: none; }
+.pop-note.bad { color: var(--danger); }
+.pop-note.warn { color: var(--warn); }
+.pop-item.dim { opacity: .55; }
+button.link { color: var(--link); padding: 0 4px; font-size: inherit; text-decoration: underline; }
+.ok-text { color: var(--text-success); }
+.warn-text { color: var(--warn); }
+
+/* providers and the key dialog */
+#modal-box .prov {
+  display: flex; align-items: center; gap: 10px; padding: 9px 8px;
+  border-bottom: 1px solid var(--line); border-radius: 8px;
+}
+#modal-box .prov.on { background: var(--accent-weak); }
+#modal-box .prov .pm { flex: 1 1 auto; min-width: 0; display: flex; flex-direction: column; gap: 2px; }
+#modal-box .prov .pm span { overflow-wrap: anywhere; }
+#modal-box .prov-acts button {
+  height: 30px; padding: 0 12px; border-radius: 9px; font-weight: 600; font-size: 13px;
+  border: 1px solid var(--line-strong); background: var(--bg-lift); white-space: nowrap;
+}
+#modal-box .prov-acts button.ok { background: var(--accent); color: var(--accent-fg); border-color: transparent; }
+#modal-box .key-input {
+  width: 100%; margin-top: 12px; background: var(--bg-lift); border: 1px solid var(--line);
+  border-radius: 10px; padding: 9px 11px; outline: none; font-family: var(--mono);
+}
+#modal-box .key-input:focus { border-color: var(--accent-line); }
+#modal-box .key-err { min-height: 18px; margin-top: 6px; color: var(--danger); font-size: 12.5px; }
+
+/* one line of feedback for anything that failed or needs a look */
+.toast {
+  position: fixed; left: 50%; bottom: 24px; transform: translateX(-50%); z-index: 60;
+  max-width: min(560px, 92vw); padding: 10px 14px; border-radius: 12px;
+  background: var(--main-surface-tertiary); border: 1px solid var(--border-medium);
+  box-shadow: var(--shadow); font-size: 13px; line-height: 1.45; overflow-wrap: anywhere;
+  animation: fade-up 160ms var(--ease) both;
+}
+.toast.err { border-color: color-mix(in srgb, var(--danger) 55%, transparent); color: var(--danger); }
+.toast.warn { border-color: color-mix(in srgb, var(--warn) 55%, transparent); color: var(--warn); }
+.toast.ok { border-color: var(--accent-line); color: var(--accent); }
+.toast[hidden] { display: none; }
+
+/* --- right panel ---------------------------------------------------------- */
+/* the right panel mirrors the rail: fixed-width contents, clipped by the track,
+ * so folding it in and out is one eased movement on each side */
+#panel { background: var(--main-surface-secondary); border-left: 1px solid var(--border-light); min-width: 0; overflow: hidden; }
+.panel-inner {
+  width: var(--panel); height: 100%; overflow-y: auto; padding: 12px;
+  transition: transform 300ms var(--ease-pop), opacity 200ms var(--ease);
+}
+body.no-panel .panel-inner { transform: translateX(18px); opacity: 0; }
+body.no-panel #panel { pointer-events: none; }
+.panel-head {
+  display: flex; align-items: center; gap: 6px; padding: 2px 4px 10px;
+  color: var(--fg-faint); font-size: 11px; font-weight: 600;
+  letter-spacing: .7px; text-transform: uppercase;
+}
+.card { border-top: 1px solid var(--line); padding: 12px 2px; }
+.card:first-of-type { border-top: 0; }
+.card h4 { margin: 0 0 8px; font-size: 12.5px; font-weight: 650; display: flex; align-items: center; gap: 6px; }
+.card .kv { padding: 3px 0; }
+.todo-list { margin: 0; padding: 0; list-style: none; font-size: 13.5px; }
+.todo-list li { display: flex; gap: 8px; padding: 3px 0; animation: fade-in var(--t) var(--ease) both; transition: color var(--t-fast); }
+.todo-list .boxmark { color: var(--fg-faint); }
+.todo-list li.done { color: var(--fg-faint); text-decoration: line-through; }
+.todo-list li.doing { color: var(--fg); font-weight: 600; }
+#steps-body .step-line > summary { font-size: 12.5px; }
+#steps-body .step-line .phase { font-size: 11px; }
+
+/* --- modal sheet (session list) ------------------------------------------- */
 #modal {
-  position: fixed; inset: 0; background: rgba(0, 0, 0, .55);
+  position: fixed; inset: 0; background: rgba(0, 0, 0, .5); z-index: 40;
-  display: flex; align-items: center; justify-content: center; z-index: 9;
+  display: flex; align-items: center; justify-content: center; padding: 16px;
+  animation: fade-in var(--t) var(--ease) both;
 }
 #modal-box {
-  background: var(--bg2); border: 1px solid var(--line); border-radius: 10px;
+  width: min(560px, 100%); max-height: 82vh; overflow-y: auto;
-  padding: 14px; width: min(820px, 94vw); max-height: 88vh; overflow: auto;
+  background: var(--main-surface-tertiary); border: 1px solid var(--border-medium);
+  border-radius: 18px; padding: 16px 18px; box-shadow: var(--shadow);
+  animation: pop-in 180ms var(--ease) both;
 }
-#modal-box h3 { margin: 0 0 8px; }
+#modal-box h3 { margin: 0 0 12px; font-size: 17px; }
-#modal-box pre {
+#modal-box .field { display: flex; align-items: center; gap: 8px; margin: 9px 0; flex-wrap: wrap; }
-  background: var(--bg); border: 1px solid var(--line); border-radius: 6px;
+#modal-box .field > span { width: 70px; color: var(--fg-dim); font-size: 13px; }
-  padding: 8px; max-height: 46vh; overflow: auto; white-space: pre-wrap;
+#modal-box .field input {
+  flex: 1 1 auto; min-width: 150px; background: var(--bg-lift);
+  border: 1px solid var(--line); border-radius: 10px; padding: 8px 10px; outline: none;
+}
+#modal-box .buttons { display: flex; flex-wrap: wrap; gap: 8px; align-items: center; margin-top: 12px; }
+#modal-box .buttons button {
+  height: 34px; padding: 0 14px; border-radius: 10px; font-weight: 600;
+  border: 1px solid var(--line-strong); background: var(--bg-lift);
+  transition: filter var(--t-fast), transform 90ms var(--ease);
+}
+#modal-box .buttons button:active { transform: scale(.97); }
+#modal-box .buttons button.ok { background: var(--accent); color: var(--accent-fg); border-color: transparent; }
+#modal-box .buttons button.danger { color: var(--danger); }
+#modal-box .sess {
+  display: flex; align-items: center; gap: 8px; padding: 8px 6px;
+  border-bottom: 1px solid var(--line); border-radius: 8px;
+  transition: background var(--t-fast);
+}
+#modal-box .sess:hover { background: var(--bg-hover); }
+#modal-box .sess .id { font-family: var(--mono); font-size: 11.5px; color: var(--fg-faint); }
+#modal-box .sess .t { flex: 1 1 auto; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; font-size: 13.5px; }
+
+/* --- commands: the list over the composer, the palette, the help sheet ---- */
+#composer { position: relative; }
+.slash {
+  position: absolute; left: 20px; right: 20px; bottom: calc(100% - 6px); z-index: 20;
+  max-height: min(46vh, 360px); overflow-y: auto; padding: 5px;
+  background: var(--main-surface-tertiary); border: 1px solid var(--border-medium);
+  border-radius: 14px; box-shadow: var(--shadow); animation: pop-in 140ms var(--ease) both;
+}
+.slash[hidden] { display: none; }
+.slash-item, .palette-item {
+  display: flex; align-items: baseline; gap: 10px; width: 100%; padding: 7px 10px;
+  border-radius: 9px; text-align: left; font-size: 13px;
+}
+.slash-item.on, .palette-item.on { background: var(--accent-weak); }
+.slash-item:hover, .palette-item:hover { background: var(--bg-hover); }
+.slash-item code, .palette-item code { font-family: var(--mono); font-size: 12.5px; color: var(--fg); flex: 0 0 auto; }
+.slash-item.on code, .palette-item.on code { color: var(--accent); }
+.slash-item .hint { font-family: var(--mono); font-size: 11.5px; color: var(--fg-faint); flex: 0 0 auto; }
+.slash-item .desc, .palette-item .desc {
+  flex: 1 1 auto; min-width: 0; color: var(--fg-dim); font-size: 12.5px;
+  overflow: hidden; text-overflow: ellipsis; white-space: nowrap;
+}
+#modal-box .palette-list { max-height: min(52vh, 460px); overflow-y: auto; margin-top: 8px; }
+kbd {
+  font-family: var(--mono); font-size: 11px; color: var(--fg-dim); white-space: nowrap;
+  border: 1px solid var(--line-strong); border-bottom-width: 2px; border-radius: 6px; padding: 1px 6px;
+  background: var(--bg-soft);
+}
+.palette-item kbd { flex: 0 0 auto; }
+#modal-box .keys-grid {
+  display: grid; grid-template-columns: max-content 1fr; gap: 7px 14px; align-items: baseline;
+  font-size: 13px;
+}
+#modal-box .keys-grid kbd { justify-self: start; }
+#modal-box .keys-grid.cmds code { font-family: var(--mono); font-size: 12.5px; }
+#modal-box .keys-grid span { color: var(--fg-dim); }
+#modal-box .ext-list { display: flex; flex-direction: column; gap: 2px; }
+#modal-box .ext-row {
+  display: flex; align-items: center; gap: 10px; padding: 7px 8px; border-radius: 8px;
+  border-bottom: 1px solid var(--line);
+}
+#modal-box .ext-row .pm { flex: 1 1 auto; min-width: 0; display: flex; flex-direction: column; gap: 3px; }
+#modal-box .ext-row .pm > div:last-child:not(.ext-title) { overflow-wrap: anywhere; }
+#modal-box .ext-title { display: flex; align-items: baseline; gap: 8px; flex-wrap: wrap; font-size: 13.5px; }
+#modal-box .ext-badge {
+  font-size: 11px; border: 1px solid var(--line-strong); border-radius: 6px; padding: 0 6px; color: var(--fg-dim);
+}
+#modal-box .ext-badge.ok { color: var(--accent); border-color: var(--accent-line); }
+#modal-box .ext-badge.bad { color: var(--danger); border-color: color-mix(in srgb, var(--danger) 55%, transparent); }
+#modal-box .ext-row > button {
+  flex: 0 0 auto; height: 30px; padding: 0 12px; border-radius: 9px; font-weight: 600; font-size: 13px;
+  border: 1px solid var(--line-strong); background: var(--bg-lift); white-space: nowrap;
+}
+
+/* --- narrow screens: rail and panel become drawers ------------------------ */
+#backdrop { position: fixed; inset: 0; background: rgba(0, 0, 0, .45); z-index: 30; display: none; animation: fade-in var(--t) var(--ease) both; }
+body.drawer-open #backdrop { display: block; }
+@media (max-width: 900px) {
+  #app { grid-template-columns: minmax(0, 1fr) !important; transition: none; }
+  #side, #panel {
+    position: fixed; top: 0; bottom: 0; width: min(310px, 86vw); z-index: 31;
+    display: block; transition: transform 260ms var(--ease-pop);
+  }
+  .side-inner { width: auto; transform: none !important; opacity: 1 !important; }
+  #side { overflow: visible; pointer-events: auto; }
+  #side { left: 0; transform: translateX(-102%); }
+  #panel { right: 0; transform: translateX(102%); }
+  body.side-open #side, body.panel-open #panel { transform: none; }
+  .only-narrow { display: inline-flex; }
+  #to-bottom { bottom: 150px; right: 16px; }
+  .hero h1 { font-size: 21px; }
+  .msg.user .body { max-width: 88%; }
+  .turn-meta, .msg-actions, .turn-steps, .note-line { padding-left: 0; }
+}
+@media (min-width: 901px) { #backdrop { display: none !important; } }
+
+/* --- motion --------------------------------------------------------------- */
+@keyframes fade-in { from { opacity: 0; } to { opacity: 1; } }
+@keyframes fade-up { from { opacity: 0; transform: translateY(6px); } to { opacity: 1; transform: none; } }
+@keyframes rise { from { opacity: 0; transform: translateY(10px) scale(.99); } to { opacity: 1; transform: none; } }
+@keyframes pop-in { from { opacity: 0; transform: translateY(-4px) scale(.97); } to { opacity: 1; transform: none; } }
+@keyframes pulse { 0%, 100% { opacity: .3; transform: scale(.85); } 50% { opacity: 1; transform: scale(1); } }
+@keyframes blink { 0%, 100% { opacity: 1; } 50% { opacity: 0; } }
+@media (prefers-reduced-motion: reduce) {
+  *, *::before, *::after { animation-duration: 1ms !important; transition-duration: 1ms !important; }
+  #scroll { scroll-behavior: auto; }
 }
-#modal-box .buttons { display: flex; gap: 8px; flex-wrap: wrap; margin-top: 10px; }
-#modal-box .danger { border-color: var(--err); color: var(--err); }
-#modal-box .ok { border-color: var(--ok); color: var(--ok); }
-.sess { display: flex; gap: 8px; align-items: center; padding: 4px 0; border-bottom: 1px solid var(--line); }
-.sess .id { color: var(--muted); font-size: 12px; }
-.sess .t { flex: 1; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }