OpenCode-style TUI, model probing, sandboxed auto approval

- TUI: centered home screen with logo, boxed input with mode line, sidebar
  (>=120 cols), Ctrl+P palette, Tab Build/Plan, Shift+Tab approval cycle,
  mouse (cards, cursor, pickers, wheel), /sidebar /mouse /approval
- /models probing: key check on entry (401 re-asks), API models in /model
- Shell sandbox in C: Linux Landlock (writes limited to workspace/tmp,
  ABI>=4 blocks TCP), macOS sandbox_init, rules fallback elsewhere
- Approval modes ask/auto/yolo (default auto); read-only command whitelist;
  ask to rerun outside the sandbox when a command looks blocked
- Upgradable bootstrap scripts (git pull --ff-only, rebuild, reinstall) and
  cst-agent-update; cst-agent --version
- tests: test_sandbox, test_models

docs/compat.md

@@ -32,11 +32,32 @@ the `HAVE_MACOS_RUNNER` variable) or by hand with the checklist below.
 | What | Where |
 |---|---|
 | API keys (one per provider, entered in the TUI or with `--ask-key`) | `$XDG_CONFIG_HOME/cst-agent/credentials` (default `~/.config/cst-agent/`), mode 0600 |
-| Last provider, models and effort | `$XDG_CONFIG_HOME/cst-agent/settings.json` |
+| Last provider, models, effort and approval mode | `$XDG_CONFIG_HOME/cst-agent/settings.json` |
 | Sessions, undo snapshots, exports | `<workspace>/.agent/` (git-ignored automatically) |
 | Saved permission rules | `<workspace>/.agent/permissions.json` |
 | Project notes injected into the prompt | `<workspace>/AGENTS.md` (or `CST.md`) |
 
+## Shell sandbox
+
+In the default `auto` approval mode, `run_shell` runs inside an OS sandbox
+when one is available. Commands may read and execute anything but may only
+write beneath the workspace, the temp directory, `/dev/null` and `/dev/tty`.
+
+| Platform | Sandbox | Notes |
+|---|---|---|
+| Linux 5.13+ | Landlock (raw syscalls, no extra library) | ABI ≥ 4 (6.7+) also blocks TCP connect/bind |
+| macOS | `sandbox_init` profile | also denies network |
+| Android / Termux | none | falls back to the read-only rules |
+| WSL 2 | Landlock when the WSL kernel enables it | otherwise rules |
+| Older kernels, Windows | none | falls back to the read-only rules |
+
+The status bar and sidebar show `auto · landlock`, `auto · seatbelt` or
+`auto · rules`. `CST_SANDBOX=off` disables the sandbox. When a sandboxed
+command looks blocked, the TUI asks whether to rerun it outside the sandbox.
+The ruleset is built in the parent; the forked child only calls `prctl` and
+`landlock_restrict_self` (async-signal-safe), so the agent itself is never
+confined.
+
 ## Terminal notes
 
 - UTF-8 locale gives the full UI. Under a non-UTF-8 locale, or with
@@ -80,6 +101,12 @@ TUI:
 - [ ] Todo panel appears while tasks are open; Ctrl+T hides it
 - [ ] `/undo` restores files changed by the last turn; `/retry` re-asks
 - [ ] `/diff`, `/export`, `/status`, `/tools off grep`, `/yolo` work
+- [ ] Mouse: click a tool card to expand it, click in the input to move the
+      cursor, click a picker row; `/mouse` turns it off
+- [ ] Tab toggles Build/Plan, Shift+Tab cycles ask/auto/yolo, Ctrl+P opens the palette
+- [ ] `/model` lists the provider's `/models` (marked `(api)`); a wrong key is re-asked
+- [ ] `auto` mode: `echo x > ~/outside` in run_shell asks "Rerun outside the
+      sandbox?" (Linux 5.13+/macOS); with `CST_SANDBOX=off`, `ls` runs and `touch x` asks
 - [ ] Resize the terminal during streaming: layout recovers
 - [ ] `NO_COLOR=1` and `CST_ASCII=1` render readable screens