Merge branch 'v1.7-drag-drop'

When a chat is auto-named, also rename the parent session if it is
still on its default 'New session' label. UPDATE is gated by an
atomic WHERE clause so user renames and prior propagations are not
clobbered. Publishes session_renamed via broker.publishUser; useSidebar
already listens.

Closes the gap where sessions auto-created from the sidebar would
stay 'New session' forever.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.env.example

@@ -3,5 +3,6 @@ PORT=3000
 DATABASE_URL=postgres://boocode:CHANGE_ME@boocode_db:5432/boocode
 LLAMA_SWAP_URL=http://100.101.41.16:8401
 PROJECT_ROOT_WHITELIST=/opt
+BOOTSTRAP_ROOT=/opt/projects
 DEFAULT_MODEL=qwen3.6-35b-a3b-mxfp4
 POSTGRES_PASSWORD=CHANGE_ME

.gitignore

@@ -5,3 +5,4 @@ dist
 .DS_Store
 .vite
 coverage
+secrets/

CLAUDE.md

@@ -0,0 +1,109 @@
+# CLAUDE.md
+
+This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+
+## What is BooCode
+
+Self-hosted single-user developer chat app. AI assistant with read-only file tools (view_file, list_dir, grep, find_files) running against a local llama-swap inference server. Sessions organized by project, with a multi-pane workspace (chat + file browser side by side).
+
+## Commands
+
+```bash
+# Development (run in separate terminals)
+pnpm dev:server          # tsx watch, port 3000
+pnpm dev:web             # Vite dev server, port 5173 (proxies /api to :3000)
+
+# Build
+pnpm build               # builds web then server
+pnpm -C apps/server build  # server only (tsc + copy schema.sql)
+pnpm -C apps/web build     # web only (vite)
+
+# Type checking (no emit)
+npx tsc --noEmit                              # project references (root)
+npx tsc -p apps/web/tsconfig.app.json --noEmit  # web app specifically
+
+# IMPORTANT: root tsc --noEmit uses project references and can miss errors
+# that the per-app tsconfig catches. Always verify with the per-app command
+# when editing web code. The server build (pnpm -C apps/server build) is
+# authoritative for server code.
+
+# Production
+docker compose build --no-cache boocode && docker compose up -d
+```
+
+There are no tests or linters configured.
+
+## Architecture
+
+**Monorepo**: pnpm workspaces with `apps/server` (Fastify + postgres) and `apps/web` (React + Vite).
+
+### Server (`apps/server/src/`)
+
+- **Fastify** with `@fastify/websocket` and `@fastify/static` (serves built frontend)
+- **postgres** (porsager/postgres) with tagged-template SQL — no ORM. Schema in `schema.sql`, applied on startup. LSP may false-positive on `sql<Type[]>\`...\`` generics; CLI `tsc` / `pnpm build` is authoritative.
+- **Zod** for request validation and config parsing.
+
+Key services:
+- **`services/inference.ts`** — Streams LLM responses, executes tool loops (max 5 depth), flushes to DB every 500ms. Publishes `InferenceFrame` events through the broker.
+- **`services/broker.ts`** — In-memory pub/sub with two channel types: per-session (message streaming) and per-user (sidebar updates). No persistence; clients reconnect on restart.
+- **`services/tools.ts`** — Four read-only file tools exposed as OpenAI function-calling schemas. All file access goes through `path_guard.ts` which resolves against project root.
+- **`services/file_ops.ts`** — Shared file operation implementations used by both inference tools and HTTP routes.
+- **`services/auto_name.ts`** — Non-streaming LLM call to generate 4-word session titles after first assistant reply.
+
+Route registration: all routes registered in `index.ts` via `register*Routes(app, sql, ...)` functions. Routes are in `routes/*.ts`.
+
+### Frontend (`apps/web/src/`)
+
+- **React 18** + React Router v6 + **Tailwind v4** + shadcn/radix-ui primitives.
+- **Shiki** for syntax highlighting (async `codeToHtml` in `CodeBlock.tsx` and `FileViewer` in `FileBrowserPane.tsx`).
+- Path alias: `@/` maps to `src/`.
+
+Key patterns:
+- **`hooks/sessionEvents.ts`** — Module-singleton event bus (Set of listeners). Used for cross-component communication: session renames, file-open events, attachment dispatch. 9 event types in the discriminated union. When adding a new event type to the `SessionEvent` union, you must also add a case to the `applyEvent` switch in `useSidebar.ts` (even if it's a no-op `return prev`).
+- **`hooks/useSessionStream.ts`** — WebSocket per session, `applyFrame` reducer builds message list from streaming frames.
+- **`hooks/useUserEvents.ts`** — Single app-level WS to `/api/ws/user` with exponential backoff reconnect. Forwards frames onto the sessionEvents bus.
+- **`hooks/useSidebar.ts`** — Module-singleton with Set<setState> subscriber pattern; one bus subscription guarded by `globalThis.__boocode_sidebar_subscribed` for HMR safety. Every new `SessionEvent` type needs a `case` in the `applyEvent` switch (no-op `return prev` is fine).
+- **`api/client.ts`** — Centralized typed fetch wrapper. All endpoints under `api.*` namespace.
+
+### Data flow for chat
+
+1. User sends message → POST `/api/sessions/:id/messages` creates user + assistant (status=streaming) rows
+2. `inference.enqueue()` starts async streaming loop
+3. LLM deltas published via `broker.publish(sessionId, frame)`
+4. Client's `useSessionStream` WS receives frames, `applyFrame` reducer updates message list
+5. Tool calls: inference executes tools server-side, publishes tool_call/tool_result frames, loops back to LLM
+6. Terminal states (complete/error): DB updated with final content + token counts, `session_updated` frame published on user channel
+
+### Multi-pane workspace
+
+Sessions hold 1–5 panes (chat / empty / placeholder terminal+agent). Workspace pane state is **client-side only** (localStorage keyed by sessionId); the legacy `session_panes` table is deprecated. Each chat lives in at most one pane; tab strip is per-pane and tracks `chatIds[]` + `activeChatIdx`. Sessions 1:N chats; chats own messages. Tab reorder via native HTML5 drag events.
+
+## Database
+
+PostgreSQL 16. Tables: `projects`, `sessions`, `chats`, `messages`, `settings`, `session_panes` (deprecated). Schema applied idempotently on startup via `applySchema()`. Use `clock_timestamp()` (not `NOW()`) inside transactions. CHECK constraints in place: `projects_status_chk` ('open'|'archived'), `sessions_status_chk` (same), `chats_status_chk` (same), `messages_role_chk`, `messages_status_chk` — keep in sync with the `*_STATUSES` const arrays in `apps/server/src/types/api.ts`.
+
+Schema CHECK migration order when renaming allowed values: (1) `ALTER TABLE ... DROP CONSTRAINT IF EXISTS <system_name>` (inline `CREATE TABLE` checks get `<table>_<column>_check`), (2) `UPDATE` rows to new values, (3) wrap new constraint ADD in `DO $$ ... pg_constraint` guard — that block is the only way to get `ADD CONSTRAINT IF NOT EXISTS`.
+
+Position-shift pattern for panes (legacy `session_panes` table): negate-and-restore to avoid UNIQUE(session_id, position) collisions during reorder/insert/delete. Sentinel value -100 for the moving pane.
+
+## Environment
+
+Required: `DATABASE_URL`, `LLAMA_SWAP_URL`. Optional: `PORT` (3000), `HOST` (0.0.0.0), `PROJECT_ROOT_WHITELIST` (/opt, read-only scope for add-existing path resolution), `BOOTSTRAP_ROOT` (/opt/projects, writable scope for create-new-project bootstrap mkdir target — host must `mkdir -p /opt/projects` before container start), `DEFAULT_MODEL`, `LOG_LEVEL`.
+
+## Workflow
+
+- Sam reviews all diffs and commits manually. Do not commit unless explicitly asked.
+- Deploy: `cd /opt/boocode && docker compose up --build -d` (or `docker compose build --no-cache boocode && docker compose up -d` if you suspect a layer-cache issue).
+- Don't accumulate `.bak-*` files. Clean them up in the same batch or immediately after merge.
+- Fastify global JSON parser tolerates empty bodies (overridden in `index.ts`); bodyless POSTs (archive, unarchive, stop) work without setting `Content-Type` tricks on the client.
+- Event dedup discipline: for any mutation the server publishes via `broker.publishUser`, do NOT add a local `sessionEvents.emit(...)` after the API call — `useUserEvents` forwards the WS frame onto the bus. Frontend mutation handlers must be idempotent (dedup by id, no-op on already-present).
+
+## Conventions
+
+- `overflowWrap` not `wordWrap` — TypeScript's CSSStyleDeclaration marks `wordWrap` as deprecated (error 6385).
+- No app-layer auth. Authelia handles auth at the reverse proxy. All `broker.publishUser`/`subscribeUser` calls use `'default'` as the user key.
+- TypeScript strict mode. Both apps share `tsconfig.base.json`.
+- Server uses NodeNext module resolution (`.js` extensions in imports).
+- Discriminated unions for type narrowing: `Pane` (by `kind`), `SessionEvent` (by `type`), `InferenceFrame` (by `type`).
+- shadcn primitives live in `components/ui/`. Don't modify them unless adding a new primitive.
+- `inferLanguage()` from `lib/attachments.ts` is the canonical file-extension-to-language map. `CodeBlock.tsx` keeps its own `LANG_MAP` because it also resolves markdown fence names.

Dockerfile

@@ -19,7 +19,8 @@ RUN pnpm deploy --filter=@boocode/server --prod --legacy /out/server
 
 
 FROM node:20-alpine AS runtime
-RUN apk add --no-cache ripgrep
+RUN apk add --no-cache ripgrep git openssh-client
+RUN mkdir -p /root/.ssh && ssh-keyscan -p 2222 -H 100.114.205.53 git.indifferentketchup.com >> /root/.ssh/known_hosts && chmod 700 /root/.ssh && chmod 600 /root/.ssh/known_hosts
 WORKDIR /app
 
 COPY --from=builder /out/server ./

apps/server/package.json

@@ -7,7 +7,8 @@
   "scripts": {
     "dev": "tsx watch src/index.ts",
     "build": "tsc && node -e \"import('node:fs').then(fs=>fs.copyFileSync('src/schema.sql','dist/schema.sql'))\"",
-    "typecheck": "tsc --noEmit"
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run"
   },
   "dependencies": {
     "@fastify/static": "^7.0.4",
@@ -21,6 +22,7 @@
     "@types/node": "^20.14.10",
     "@types/ws": "^8.5.10",
     "tsx": "^4.16.2",
-    "typescript": "^5.5.0"
+    "typescript": "^5.5.0",
+    "vitest": "^3.2.4"
   }
 }

apps/server/src/auth.ts

@@ -1,31 +0,0 @@
-import type { FastifyInstance, FastifyRequest } from 'fastify';
-
-declare module 'fastify' {
-  interface FastifyRequest {
-    user?: string;
-  }
-}
-
-const PUBLIC_PATHS = new Set<string>(['/api/health']);
-
-export function registerAuth(app: FastifyInstance): void {
-  app.addHook('onRequest', async (req, reply) => {
-    if (!req.url.startsWith('/api')) return;
-    if (PUBLIC_PATHS.has(req.routeOptions.url ?? req.url.split('?')[0]!)) return;
-
-    const header = req.headers['remote-user'];
-    const user = Array.isArray(header) ? header[0] : header;
-    if (!user || user.trim() === '') {
-      reply.code(401).send({ error: 'unauthenticated' });
-      return reply;
-    }
-    req.user = user.trim();
-  });
-}
-
-export function requireUser(req: FastifyRequest): string {
-  if (!req.user) {
-    throw new Error('user not set on request — auth hook must run first');
-  }
-  return req.user;
-}

apps/server/src/config.ts

@@ -7,8 +7,13 @@ const ConfigSchema = z.object({
   DATABASE_URL: z.string().url(),
   LLAMA_SWAP_URL: z.string().url(),
   PROJECT_ROOT_WHITELIST: z.string().default('/opt'),
+  BOOTSTRAP_ROOT: z.string().default('/opt/projects'),
   DEFAULT_MODEL: z.string().default('qwen3.6-35b-a3b-mxfp4'),
   LOG_LEVEL: z.string().default('info'),
+  GITEA_BASE_URL: z.string().url().default('https://git.indifferentketchup.com'),
+  GITEA_USER: z.string().default('indifferentketchup'),
+  GITEA_TOKEN: z.string().optional(),
+  GITEA_SSH_HOST: z.string().default('100.114.205.53:2222'),
 });
 
 export type Config = z.infer<typeof ConfigSchema>;

apps/server/src/index.ts

@@ -5,11 +5,12 @@ import { existsSync } from 'node:fs';
 import { resolve } from 'node:path';
 import { loadConfig } from './config.js';
 import { getSql, applySchema, pingDb, closeDb } from './db.js';
-import { registerAuth } from './auth.js';
+
 import { registerProjectRoutes } from './routes/projects.js';
 import { registerSessionRoutes } from './routes/sessions.js';
 import { registerSettingsRoutes } from './routes/settings.js';
 import { registerMessageRoutes } from './routes/messages.js';
+import { registerChatRoutes } from './routes/chats.js';
 import { registerSidebarRoutes } from './routes/sidebar.js';
 import { registerWebSocket } from './routes/ws.js';
 import { registerModelRoutes } from './routes/models.js';
@@ -23,58 +24,90 @@ async function main() {
     logger: { level: config.LOG_LEVEL },
   });
 
+  // Allow empty JSON bodies on POSTs that don't take a body (archive, unarchive, stop, etc.).
+  // Default Fastify parser throws FST_ERR_CTP_EMPTY_JSON_BODY on empty string.
+  app.removeContentTypeParser(['application/json']);
+  app.addContentTypeParser('application/json', { parseAs: 'string' }, (_req, body, done) => {
+    const str = (body as string) ?? '';
+    if (str.trim().length === 0) {
+      done(null, {});
+      return;
+    }
+    try {
+      done(null, JSON.parse(str));
+    } catch (err) {
+      done(err as Error, undefined);
+    }
+  });
+
   const sql = getSql(config);
   await applySchema(sql);
   app.log.info('database schema applied');
 
   await app.register(fastifyWebsocket);
 
-  registerAuth(app);
-
   app.get('/api/health', async () => {
     const dbOk = await pingDb(sql);
     return { status: dbOk ? 'ok' : 'degraded', db: dbOk };
   });
 
-  registerProjectRoutes(app, sql, config);
-  registerSessionRoutes(app, sql, config);
+  const broker = createBroker();
+
+  registerProjectRoutes(app, sql, config, broker);
+  registerSessionRoutes(app, sql, config, broker);
   registerSettingsRoutes(app, sql);
   registerModelRoutes(app, config);
   registerSidebarRoutes(app, sql);
+  registerChatRoutes(app, sql, broker);
 
-  const broker = createBroker();
-  const inference = createInferenceRunner({
-    sql,
-    config,
-    log: app.log,
-    publish: (sessionId, frame) => {
-      broker.publish(sessionId, frame as unknown as Record<string, unknown> & { type: string });
+  const inference = createInferenceRunner(
+    {
+      sql,
+      config,
+      log: app.log,
+      publish: (sessionId, frame) => {
+        broker.publish(sessionId, frame as unknown as Record<string, unknown> & { type: string });
+      },
     },
-  });
+    (user, frame) => {
+      broker.publishUser(user, frame as unknown as Record<string, unknown> & { type: string });
+    }
+  );
   registerMessageRoutes(app, sql, {
-    enqueueInference: (sessionId, assistantId) => {
-      inference.enqueue(sessionId, assistantId);
+    enqueueInference: (sessionId, chatId, assistantId, user) => {
+      inference.enqueue(sessionId, chatId, assistantId, user);
     },
-    publishUserMessage: (sessionId, userMessageId, content) => {
+    enqueueCompact: (sessionId, chatId, compactId, user) => {
+      inference.enqueueCompact(sessionId, chatId, compactId, user);
+    },
+    cancelInference: async (sessionId, chatId) => {
+      return inference.cancel(sessionId, chatId);
+    },
+    hasActiveInference: (chatId) => inference.hasActive(chatId),
+    publishUserMessage: (sessionId, chatId, userMessageId, content) => {
       broker.publish(sessionId, {
         type: 'message_started',
         message_id: userMessageId,
+        chat_id: chatId,
         role: 'user',
       });
       broker.publish(sessionId, {
         type: 'delta',
         message_id: userMessageId,
+        chat_id: chatId,
         content,
       });
       broker.publish(sessionId, {
         type: 'message_complete',
         message_id: userMessageId,
+        chat_id: chatId,
       });
     },
-    publishMessagesDeleted: (sessionId, messageIds) => {
+    publishMessagesDeleted: (sessionId, chatId, messageIds) => {
       broker.publish(sessionId, {
         type: 'messages_deleted',
         message_ids: messageIds,
+        chat_id: chatId,
       });
     },
   });
@@ -112,6 +145,9 @@ async function main() {
   process.on('SIGINT', () => void shutdown('SIGINT'));
   process.on('SIGTERM', () => void shutdown('SIGTERM'));
 
+  // Bound to 0.0.0.0 intentionally. Public access goes through Caddy → Authelia.
+  // Direct Tailscale access (100.114.205.53:9500) is unauthenticated by design;
+  // the threat model treats Tailnet membership as the trust boundary.
   await app.listen({ port: config.PORT, host: config.HOST });
   app.log.info(`boocode server listening on http://${config.HOST}:${config.PORT}`);
 }

apps/server/src/routes/__tests__/projects.test.ts

@@ -0,0 +1,92 @@
+import { describe, it, expect, beforeAll, afterAll } from 'vitest';
+import { mkdtemp, mkdir, rm, realpath, symlink, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { resolveProjectPath } from '../projects.js';
+
+describe('resolveProjectPath', () => {
+  let scratch: string;
+  let whitelist: string;
+  let outside: string;
+
+  beforeAll(async () => {
+    // mkdtemp returns a real path on most platforms, but symlink-resolve it
+    // anyway to defeat /tmp -> /private/tmp style indirection on macOS, and
+    // keep this stable for the comparisons below.
+    scratch = await realpath(await mkdtemp(join(tmpdir(), 'boocode-projects-test-')));
+    whitelist = join(scratch, 'wl');
+    outside = join(scratch, 'other');
+    await mkdir(whitelist, { recursive: true });
+    await mkdir(outside, { recursive: true });
+  });
+
+  afterAll(async () => {
+    if (scratch) {
+      await rm(scratch, { recursive: true, force: true });
+    }
+  });
+
+  it('returns real path and basename for a valid subdirectory under the whitelist', async () => {
+    const projectDir = join(whitelist, 'my-project');
+    await mkdir(projectDir);
+    const result = await resolveProjectPath(projectDir, whitelist);
+    expect('error' in result).toBe(false);
+    if ('error' in result) return; // narrow
+    expect(result.real).toBe(projectDir);
+    expect(result.name).toBe('my-project');
+  });
+
+  it('rejects a path outside the whitelist', async () => {
+    const projectDir = join(outside, 'foo');
+    await mkdir(projectDir);
+    const result = await resolveProjectPath(projectDir, whitelist);
+    expect('error' in result).toBe(true);
+    if (!('error' in result)) return;
+    expect(result.error.toLowerCase()).toContain('path must be under');
+  });
+
+  it('rejects relative paths', async () => {
+    const result = await resolveProjectPath('relative/path', whitelist);
+    expect('error' in result).toBe(true);
+    if (!('error' in result)) return;
+    expect(result.error.toLowerCase()).toContain('absolute');
+  });
+
+  it('rejects nonexistent paths', async () => {
+    const result = await resolveProjectPath('/nonexistent/foo-boocode-test', whitelist);
+    expect('error' in result).toBe(true);
+    if (!('error' in result)) return;
+    expect(result.error.toLowerCase()).toContain('does not exist');
+  });
+
+  it('rejects symlink escapes (realpath resolution catches traversal)', async () => {
+    // Create a symlink INSIDE the whitelist that points OUTSIDE. realpath
+    // should resolve through it and the resulting real path should fail the
+    // whitelist scope check.
+    const escapeLink = join(whitelist, 'escape-link');
+    await symlink(outside, escapeLink);
+    const result = await resolveProjectPath(escapeLink, whitelist);
+    expect('error' in result).toBe(true);
+    if (!('error' in result)) return;
+    expect(result.error.toLowerCase()).toContain('path must be under');
+  });
+
+  it('rejects the whitelist directory itself as a project root', async () => {
+    // A project's parent can't be the project. The scope check must require
+    // the candidate path to be strictly below the whitelist (whitelist + sep
+    // prefix), not just equal to it.
+    const result = await resolveProjectPath(whitelist, whitelist);
+    expect('error' in result).toBe(true);
+    if (!('error' in result)) return;
+    expect(result.error.toLowerCase()).toContain('path must be under');
+  });
+
+  it('rejects non-directory targets (file under whitelist)', async () => {
+    const filePath = join(whitelist, 'a-file.txt');
+    await writeFile(filePath, 'content', 'utf8');
+    const result = await resolveProjectPath(filePath, whitelist);
+    expect('error' in result).toBe(true);
+    if (!('error' in result)) return;
+    expect(result.error.toLowerCase()).toContain('not a directory');
+  });
+});

apps/server/src/routes/chats.ts

@@ -0,0 +1,279 @@
+import type { FastifyInstance } from 'fastify';
+import { z } from 'zod';
+import type { Sql } from '../db.js';
+import type { Broker } from '../services/broker.js';
+import type { Chat, Message } from '../types/api.js';
+
+const CreateBody = z.object({
+  name: z.string().min(1).max(200).optional(),
+});
+
+const PatchBody = z.object({
+  name: z.string().min(1).max(200),
+});
+
+const ForkBody = z.object({
+  message_id: z.string().uuid(),
+  name: z.string().min(1).max(200).optional(),
+});
+
+export function registerChatRoutes(
+  app: FastifyInstance,
+  sql: Sql,
+  broker: Broker
+): void {
+  app.get<{ Params: { id: string }; Querystring: { status?: string } }>(
+    '/api/sessions/:id/chats',
+    async (req, reply) => {
+      const session = await sql`SELECT id FROM sessions WHERE id = ${req.params.id}`;
+      if (session.length === 0) {
+        reply.code(404);
+        return { error: 'session not found' };
+      }
+      const status = req.query.status === 'archived' ? 'archived' : 'open';
+      // Enriched list: computed per-chat fields via LATERAL joins.
+      const rows = await sql<Chat[]>`
+        SELECT
+          c.id, c.session_id, c.name, c.status, c.created_at, c.updated_at,
+          COALESCE(mc.cnt, 0)::int AS message_count,
+          lp.preview AS last_message_preview,
+          ec.tokens AS effective_context_tokens
+        FROM chats c
+        LEFT JOIN LATERAL (
+          SELECT COUNT(*) AS cnt FROM messages WHERE chat_id = c.id
+        ) mc ON TRUE
+        LEFT JOIN LATERAL (
+          SELECT LEFT(BTRIM(REGEXP_REPLACE(content, E'[\\n\\r]+', ' ', 'g')), 80) AS preview
+          FROM messages
+          WHERE chat_id = c.id AND kind = 'message' AND content <> ''
+          ORDER BY created_at DESC
+          LIMIT 1
+        ) lp ON TRUE
+        LEFT JOIN LATERAL (
+          SELECT ctx_used AS tokens
+          FROM messages
+          WHERE chat_id = c.id AND kind = 'message' AND role = 'assistant'
+            AND status = 'complete' AND ctx_used IS NOT NULL
+          ORDER BY created_at DESC
+          LIMIT 1
+        ) ec ON TRUE
+        WHERE c.session_id = ${req.params.id} AND c.status = ${status}
+        ORDER BY c.updated_at DESC
+      `;
+      return rows;
+    }
+  );
+
+  app.post<{ Params: { id: string } }>(
+    '/api/sessions/:id/chats',
+    async (req, reply) => {
+      const parsed = CreateBody.safeParse(req.body ?? {});
+      if (!parsed.success) {
+        reply.code(400);
+        return { error: 'invalid body', details: parsed.error.flatten() };
+      }
+      const session = await sql`SELECT id FROM sessions WHERE id = ${req.params.id}`;
+      if (session.length === 0) {
+        reply.code(404);
+        return { error: 'session not found' };
+      }
+      const [chat] = await sql<Chat[]>`
+        INSERT INTO chats (session_id, name, status)
+        VALUES (${req.params.id}, ${parsed.data.name ?? null}, 'open')
+        RETURNING id, session_id, name, status, created_at, updated_at
+      `;
+      broker.publishUser('default', {
+        type: 'chat_created',
+        chat: chat!,
+        session_id: req.params.id,
+      });
+      reply.code(201);
+      return chat;
+    }
+  );
+
+  app.patch<{ Params: { id: string } }>(
+    '/api/chats/:id',
+    async (req, reply) => {
+      const parsed = PatchBody.safeParse(req.body ?? {});
+      if (!parsed.success) {
+        reply.code(400);
+        return { error: 'invalid body', details: parsed.error.flatten() };
+      }
+      const rows = await sql<Chat[]>`
+        UPDATE chats
+        SET name = ${parsed.data.name},
+            updated_at = clock_timestamp()
+        WHERE id = ${req.params.id}
+        RETURNING id, session_id, name, status, created_at, updated_at
+      `;
+      if (rows.length === 0) {
+        reply.code(404);
+        return { error: 'chat not found' };
+      }
+      const chat = rows[0]!;
+      broker.publishUser('default', {
+        type: 'chat_updated',
+        chat_id: chat.id,
+        session_id: chat.session_id,
+        name: chat.name,
+        updated_at: chat.updated_at,
+      });
+      return chat;
+    }
+  );
+
+  app.post<{ Params: { id: string } }>(
+    '/api/chats/:id/archive',
+    async (req, reply) => {
+      const rows = await sql<{ id: string; session_id: string }[]>`
+        UPDATE chats SET status = 'archived', updated_at = clock_timestamp()
+        WHERE id = ${req.params.id} AND status = 'open'
+        RETURNING id, session_id
+      `;
+      if (rows.length === 0) {
+        reply.code(404);
+        return { error: 'chat not found or already archived' };
+      }
+      const row = rows[0]!;
+      broker.publishUser('default', {
+        type: 'chat_archived',
+        chat_id: row.id,
+        session_id: row.session_id,
+      });
+      reply.code(204);
+      return null;
+    }
+  );
+
+  app.post<{ Params: { id: string } }>(
+    '/api/chats/:id/unarchive',
+    async (req, reply) => {
+      const rows = await sql<Chat[]>`
+        UPDATE chats SET status = 'open', updated_at = clock_timestamp()
+        WHERE id = ${req.params.id} AND status = 'archived'
+        RETURNING id, session_id, name, status, created_at, updated_at
+      `;
+      if (rows.length === 0) {
+        reply.code(404);
+        return { error: 'chat not found or not archived' };
+      }
+      const chat = rows[0]!;
+      broker.publishUser('default', { type: 'chat_unarchived', chat });
+      return chat;
+    }
+  );
+
+  app.delete<{ Params: { id: string } }>(
+    '/api/chats/:id',
+    async (req, reply) => {
+      const result = await sql<{ id: string; session_id: string }[]>`
+        DELETE FROM chats WHERE id = ${req.params.id}
+        RETURNING id, session_id
+      `;
+      if (result.length === 0) {
+        reply.code(404);
+        return { error: 'chat not found' };
+      }
+      const row = result[0]!;
+      broker.publishUser('default', {
+        type: 'chat_deleted',
+        chat_id: row.id,
+        session_id: row.session_id,
+      });
+      reply.code(204);
+      return null;
+    }
+  );
+
+  app.post<{ Params: { id: string } }>(
+    '/api/chats/:id/fork',
+    async (req, reply) => {
+      const parsed = ForkBody.safeParse(req.body ?? {});
+      if (!parsed.success) {
+        reply.code(400);
+        return { error: 'invalid body', details: parsed.error.flatten() };
+      }
+
+      const sourceRows = await sql<Chat[]>`
+        SELECT id, session_id, name, status, created_at, updated_at
+        FROM chats WHERE id = ${req.params.id}
+      `;
+      if (sourceRows.length === 0) {
+        reply.code(404);
+        return { error: 'chat not found' };
+      }
+      const source = sourceRows[0]!;
+
+      const targetRows = await sql<{ created_at: string; status: string }[]>`
+        SELECT created_at, status FROM messages
+        WHERE chat_id = ${source.id} AND id = ${parsed.data.message_id}
+      `;
+      if (targetRows.length === 0) {
+        reply.code(404);
+        return { error: 'message not found in chat' };
+      }
+      const target = targetRows[0]!;
+      if (target.status !== 'complete') {
+        reply.code(400);
+        return { error: 'can only fork from completed messages' };
+      }
+
+      const newName = parsed.data.name ?? `${source.name ?? 'Chat'} (fork)`;
+
+      const newChat = await sql.begin(async (tx) => {
+        const [chat] = await tx<Chat[]>`
+          INSERT INTO chats (session_id, name, status)
+          VALUES (${source.session_id}, ${newName}, 'open')
+          RETURNING id, session_id, name, status, created_at, updated_at
+        `;
+        await tx`
+          INSERT INTO messages (
+            session_id, chat_id, role, content, kind, tool_calls, tool_results,
+            status, tokens_used, ctx_used, ctx_max, started_at, finished_at,
+            created_at
+          )
+          SELECT
+            ${source.session_id}, ${chat!.id}, role, content, kind,
+            tool_calls, tool_results, status,
+            tokens_used, ctx_used, ctx_max, started_at, finished_at,
+            clock_timestamp() + (
+              ROW_NUMBER() OVER (ORDER BY created_at ASC, id ASC) * INTERVAL '1 microsecond'
+            )
+          FROM messages
+          WHERE chat_id = ${source.id}
+            AND created_at <= ${target.created_at}::timestamptz
+            AND status = 'complete'
+        `;
+        return chat!;
+      });
+
+      broker.publishUser('default', {
+        type: 'chat_created',
+        chat: newChat,
+        session_id: source.session_id,
+      });
+      reply.code(201);
+      return newChat;
+    }
+  );
+
+  app.get<{ Params: { id: string } }>(
+    '/api/chats/:id/messages',
+    async (req, reply) => {
+      const chat = await sql`SELECT id FROM chats WHERE id = ${req.params.id}`;
+      if (chat.length === 0) {
+        reply.code(404);
+        return { error: 'chat not found' };
+      }
+      const rows = await sql<Message[]>`
+        SELECT id, session_id, chat_id, role, content, kind, tool_calls, tool_results, status, last_seq,
+               tokens_used, ctx_used, ctx_max, started_at, finished_at, created_at
+        FROM messages
+        WHERE chat_id = ${req.params.id}
+        ORDER BY created_at ASC, id ASC
+      `;
+      return rows;
+    }
+  );
+}

apps/server/src/routes/messages.ts

@@ -1,20 +1,24 @@
 import type { FastifyInstance } from 'fastify';
 import { z } from 'zod';
 import type { Sql } from '../db.js';
-import type { Message, Session } from '../types/api.js';
+import type { Chat, Message, Session } from '../types/api.js';
 
 const SendBody = z.object({
   content: z.string().min(1).max(64_000),
 });
 
 interface MessageHandlers {
-  enqueueInference: (sessionId: string, assistantMessageId: string) => void;
+  enqueueInference: (sessionId: string, chatId: string, assistantMessageId: string, user: string) => void;
+  enqueueCompact: (sessionId: string, chatId: string, compactMessageId: string, user: string) => void;
   publishUserMessage: (
     sessionId: string,
+    chatId: string,
     userMessageId: string,
     content: string
   ) => void;
-  publishMessagesDeleted: (sessionId: string, messageIds: string[]) => void;
+  publishMessagesDeleted: (sessionId: string, chatId: string, messageIds: string[]) => void;
+  cancelInference: (sessionId: string, chatId: string) => Promise<boolean>;
+  hasActiveInference: (chatId: string) => boolean;
 }
 
 export function registerMessageRoutes(
@@ -31,7 +35,7 @@ export function registerMessageRoutes(
         return { error: 'session not found' };
       }
       const rows = await sql<Message[]>`
-        SELECT id, session_id, role, content, tool_calls, tool_results, status, last_seq,
+        SELECT id, session_id, chat_id, role, content, kind, tool_calls, tool_results, status, last_seq,
                tokens_used, ctx_used, ctx_max, started_at, finished_at, created_at
         FROM messages
         WHERE session_id = ${req.params.id}
@@ -42,7 +46,7 @@ export function registerMessageRoutes(
   );
 
   app.post<{ Params: { id: string } }>(
-    '/api/sessions/:id/messages',
+    '/api/chats/:id/messages',
     async (req, reply) => {
       const parsed = SendBody.safeParse(req.body);
       if (!parsed.success) {
@@ -50,33 +54,39 @@ export function registerMessageRoutes(
         return { error: 'invalid body', details: parsed.error.flatten() };
       }
 
-      const session = await sql<Session[]>`SELECT id FROM sessions WHERE id = ${req.params.id}`;
-      if (session.length === 0) {
+      const chatRows = await sql<Chat[]>`
+        SELECT id, session_id FROM chats WHERE id = ${req.params.id} AND status = 'open'
+      `;
+      if (chatRows.length === 0) {
         reply.code(404);
-        return { error: 'session not found' };
+        return { error: 'chat not found' };
       }
+      const chat = chatRows[0]!;
+      const sessionId = chat.session_id;
 
       const result = await sql.begin(async (tx) => {
         const [userMsg] = await tx<{ id: string }[]>`
-          INSERT INTO messages (session_id, role, content, status, created_at)
-          VALUES (${req.params.id}, 'user', ${parsed.data.content}, 'complete', clock_timestamp())
+          INSERT INTO messages (session_id, chat_id, role, content, status, created_at)
+          VALUES (${sessionId}, ${chat.id}, 'user', ${parsed.data.content}, 'complete', clock_timestamp())
           RETURNING id
         `;
         const [assistantMsg] = await tx<{ id: string }[]>`
-          INSERT INTO messages (session_id, role, content, status, created_at)
-          VALUES (${req.params.id}, 'assistant', '', 'streaming', clock_timestamp())
+          INSERT INTO messages (session_id, chat_id, role, content, status, created_at)
+          VALUES (${sessionId}, ${chat.id}, 'assistant', '', 'streaming', clock_timestamp())
           RETURNING id
         `;
-        await tx`UPDATE sessions SET updated_at = NOW() WHERE id = ${req.params.id}`;
+        await tx`UPDATE sessions SET updated_at = clock_timestamp() WHERE id = ${sessionId}`;
+        await tx`UPDATE chats SET updated_at = clock_timestamp() WHERE id = ${chat.id}`;
         return { user_message_id: userMsg!.id, assistant_message_id: assistantMsg!.id };
       });
 
       handlers.publishUserMessage(
-        req.params.id,
+        sessionId,
+        chat.id,
         result.user_message_id,
         parsed.data.content
       );
-      handlers.enqueueInference(req.params.id, result.assistant_message_id);
+      handlers.enqueueInference(sessionId, chat.id, result.assistant_message_id, 'default');
 
       reply.code(202);
       return result;
@@ -84,14 +94,24 @@ export function registerMessageRoutes(
   );
 
   app.post<{ Params: { id: string; message_id: string } }>(
-    '/api/sessions/:id/messages/:message_id/regenerate',
+    '/api/chats/:id/messages/:message_id/regenerate',
     async (req, reply) => {
-      const { id: sessionId, message_id: targetId } = req.params;
+      const { id: chatId, message_id: targetId } = req.params;
+
+      const chatRows = await sql<Chat[]>`
+        SELECT id, session_id FROM chats WHERE id = ${chatId}
+      `;
+      if (chatRows.length === 0) {
+        reply.code(404);
+        return { error: 'chat not found' };
+      }
+      const chat = chatRows[0]!;
+      const sessionId = chat.session_id;
 
       const target = await sql<{ id: string; role: string; status: string }[]>`
         SELECT id, role, status
         FROM messages
-        WHERE session_id = ${sessionId} AND id = ${targetId}
+        WHERE chat_id = ${chatId} AND id = ${targetId}
       `;
       if (target.length === 0) {
         reply.code(404);
@@ -108,34 +128,188 @@ export function registerMessageRoutes(
       }
 
       const { newAssistantId, deletedIds } = await sql.begin(async (tx) => {
-        // Subquery keeps created_at in postgres at TIMESTAMPTZ µs precision.
-        // Round-tripping through JS Date loses sub-ms precision and can pull
-        // earlier rows (e.g. the triggering user message) into the >= bound.
         const deletedRows = await tx<{ id: string }[]>`
           DELETE FROM messages
-          WHERE session_id = ${sessionId}
+          WHERE chat_id = ${chatId}
             AND created_at >= (
               SELECT created_at FROM messages WHERE id = ${targetId}
             )
           RETURNING id
         `;
         const [row] = await tx<{ id: string }[]>`
-          INSERT INTO messages (session_id, role, content, status, created_at)
-          VALUES (${sessionId}, 'assistant', '', 'streaming', clock_timestamp())
+          INSERT INTO messages (session_id, chat_id, role, content, status, created_at)
+          VALUES (${sessionId}, ${chatId}, 'assistant', '', 'streaming', clock_timestamp())
           RETURNING id
         `;
-        await tx`UPDATE sessions SET updated_at = NOW() WHERE id = ${sessionId}`;
+        await tx`UPDATE sessions SET updated_at = clock_timestamp() WHERE id = ${sessionId}`;
+        await tx`UPDATE chats SET updated_at = clock_timestamp() WHERE id = ${chatId}`;
         return {
           newAssistantId: row!.id,
           deletedIds: deletedRows.map((r) => r.id),
         };
       });
 
-      handlers.publishMessagesDeleted(sessionId, deletedIds);
-      handlers.enqueueInference(sessionId, newAssistantId);
+      handlers.publishMessagesDeleted(sessionId, chatId, deletedIds);
+      handlers.enqueueInference(sessionId, chatId, newAssistantId, 'default');
 
       reply.code(202);
       return { assistant_message_id: newAssistantId };
     }
   );
+
+  app.delete<{ Params: { id: string; message_id: string } }>(
+    '/api/chats/:id/messages/:message_id',
+    async (req, reply) => {
+      const { id: chatId, message_id: messageId } = req.params;
+
+      const chatRows = await sql<Chat[]>`
+        SELECT id, session_id FROM chats WHERE id = ${chatId}
+      `;
+      if (chatRows.length === 0) {
+        reply.code(404);
+        return { error: 'chat not found' };
+      }
+      const chat = chatRows[0]!;
+
+      if (handlers.hasActiveInference(chatId)) {
+        reply.code(409);
+        return { error: 'chat is currently streaming; stop it first' };
+      }
+
+      const deletedIds = await sql.begin(async (tx) => {
+        const deletedRows = await tx<{ id: string }[]>`
+          DELETE FROM messages
+          WHERE chat_id = ${chatId}
+            AND created_at >= (
+              SELECT created_at FROM messages
+              WHERE id = ${messageId} AND chat_id = ${chatId}
+            )
+          RETURNING id
+        `;
+        if (deletedRows.length > 0) {
+          await tx`UPDATE chats SET updated_at = clock_timestamp() WHERE id = ${chatId}`;
+        }
+        return deletedRows.map((r) => r.id);
+      });
+
+      if (deletedIds.length === 0) {
+        reply.code(404);
+        return { error: 'message not found' };
+      }
+
+      handlers.publishMessagesDeleted(chat.session_id, chatId, deletedIds);
+
+      reply.code(204);
+      return null;
+    }
+  );
+
+  app.post<{ Params: { id: string } }>(
+    '/api/chats/:id/compact',
+    async (req, reply) => {
+      const chatRows = await sql<Chat[]>`
+        SELECT id, session_id FROM chats WHERE id = ${req.params.id} AND status = 'open'
+      `;
+      if (chatRows.length === 0) {
+        reply.code(404);
+        return { error: 'chat not found' };
+      }
+      const chat = chatRows[0]!;
+      const sessionId = chat.session_id;
+
+      const [compactMsg] = await sql<{ id: string }[]>`
+        INSERT INTO messages (session_id, chat_id, role, content, kind, status, created_at)
+        VALUES (${sessionId}, ${chat.id}, 'system', '', 'compact', 'streaming', clock_timestamp())
+        RETURNING id
+      `;
+
+      handlers.enqueueCompact(sessionId, chat.id, compactMsg!.id, 'default');
+
+      reply.code(202);
+      return { compact_message_id: compactMsg!.id };
+    }
+  );
+
+  app.post<{ Params: { id: string } }>(
+    '/api/chats/:id/stop',
+    async (req, reply) => {
+      const chatRows = await sql<Chat[]>`
+        SELECT id, session_id FROM chats WHERE id = ${req.params.id}
+      `;
+      if (chatRows.length === 0) {
+        reply.code(404);
+        return { error: 'chat not found' };
+      }
+      const chat = chatRows[0]!;
+
+      const cancelled = await handlers.cancelInference(chat.session_id, chat.id);
+      if (!cancelled) {
+        reply.code(409);
+        return { error: 'no active generation to stop' };
+      }
+
+      reply.code(200);
+      return { stopped: true };
+    }
+  );
+
+  app.post<{ Params: { id: string } }>(
+    '/api/chats/:id/force_send',
+    async (req, reply) => {
+      const parsed = SendBody.safeParse(req.body);
+      if (!parsed.success) {
+        reply.code(400);
+        return { error: 'invalid body', details: parsed.error.flatten() };
+      }
+
+      const chatRows = await sql<Chat[]>`
+        SELECT id, session_id FROM chats WHERE id = ${req.params.id} AND status = 'open'
+      `;
+      if (chatRows.length === 0) {
+        reply.code(404);
+        return { error: 'chat not found' };
+      }
+      const chat = chatRows[0]!;
+      const sessionId = chat.session_id;
+
+      // Await actual cancellation completion (catch block persists state).
+      // 5s timeout guards against llama-swap stalls; if hit, proceed anyway.
+      await Promise.race([
+        handlers.cancelInference(sessionId, chat.id).then(() => undefined),
+        new Promise<void>((_, rej) =>
+          setTimeout(() => rej(new Error('cancel-timeout')), 5000)
+        ),
+      ]).catch((e: Error) => {
+        if (e.message !== 'cancel-timeout') throw e;
+        req.log.warn({ chatId: chat.id }, 'cancel timeout exceeded, proceeding with force-send');
+      });
+
+      const result = await sql.begin(async (tx) => {
+        const [userMsg] = await tx<{ id: string }[]>`
+          INSERT INTO messages (session_id, chat_id, role, content, status, created_at)
+          VALUES (${sessionId}, ${chat.id}, 'user', ${parsed.data.content}, 'complete', clock_timestamp())
+          RETURNING id
+        `;
+        const [assistantMsg] = await tx<{ id: string }[]>`
+          INSERT INTO messages (session_id, chat_id, role, content, status, created_at)
+          VALUES (${sessionId}, ${chat.id}, 'assistant', '', 'streaming', clock_timestamp())
+          RETURNING id
+        `;
+        await tx`UPDATE sessions SET updated_at = clock_timestamp() WHERE id = ${sessionId}`;
+        await tx`UPDATE chats SET updated_at = clock_timestamp() WHERE id = ${chat.id}`;
+        return { user_message_id: userMsg!.id, assistant_message_id: assistantMsg!.id };
+      });
+
+      handlers.publishUserMessage(
+        sessionId,
+        chat.id,
+        result.user_message_id,
+        parsed.data.content
+      );
+      handlers.enqueueInference(sessionId, chat.id, result.assistant_message_id, 'default');
+
+      reply.code(202);
+      return result;
+    }
+  );
 }

apps/server/src/routes/projects.ts

@@ -4,13 +4,34 @@ import { realpath, stat, readdir, access } from 'node:fs/promises';
 import { basename, resolve, sep } from 'node:path';
 import type { Sql } from '../db.js';
 import type { Config } from '../config.js';
+import type { Broker } from '../services/broker.js';
 import type { Project, AvailableProject } from '../types/api.js';
+import { resolveProjectRoot, PathScopeError } from '../services/path_guard.js';
+import { listDir, viewFile } from '../services/file_ops.js';
+import { getProjectFiles } from '../services/file_index.js';
+import {
+  bootstrapProject,
+  BootstrapNameError,
+  BootstrapCollisionError,
+  BootstrapPathError,
+} from '../services/project_bootstrap.js';
 
 const AddProjectBody = z.object({
   path: z.string().min(1),
   name: z.string().min(1).optional(),
 });
 
+const PatchProjectBody = z.object({
+  name: z.string().min(1).max(200),
+});
+
+const CreateProjectBody = z.object({
+  name: z.string().min(1).max(64),
+  commit_message: z.string().min(1).max(200).optional(),
+  visibility: z.enum(['private', 'public']).optional(),
+  create_gitea_remote: z.boolean().optional(),
+});
+
 async function isDir(path: string): Promise<boolean> {
   try {
     const s = await stat(path);
@@ -20,7 +41,7 @@ async function isDir(path: string): Promise<boolean> {
   }
 }
 
-async function resolveProjectPath(
+export async function resolveProjectPath(
   raw: string,
   whitelist: string
 ): Promise<{ real: string; name: string } | { error: string }> {
@@ -32,7 +53,7 @@ async function resolveProjectPath(
     return { error: 'path does not exist' };
   }
   const whitelistReal = await realpath(whitelist);
-  if (real !== whitelistReal && !real.startsWith(whitelistReal + sep)) {
+  if (!real.startsWith(whitelistReal + sep)) {
     return { error: `path must be under ${whitelist}` };
   }
   if (!(await isDir(real))) return { error: 'path is not a directory' };
@@ -42,17 +63,86 @@ async function resolveProjectPath(
 export function registerProjectRoutes(
   app: FastifyInstance,
   sql: Sql,
-  config: Config
+  config: Config,
+  broker: Broker
 ): void {
-  app.get('/api/projects', async () => {
+  app.get<{ Querystring: { status?: string } }>('/api/projects', async (req) => {
+    const status = req.query.status === 'archived' ? 'archived' : 'open';
     const rows = await sql<Project[]>`
-      SELECT id, name, path, added_at, last_session_id
+      SELECT id, name, path, added_at, last_session_id, status, gitea_remote
       FROM projects
+      WHERE status = ${status}
       ORDER BY added_at DESC
     `;
     return rows;
   });
 
+  app.post('/api/projects/create', async (req, reply) => {
+    const parsed = CreateProjectBody.safeParse(req.body);
+    if (!parsed.success) {
+      reply.code(400);
+      return { error: 'invalid body', details: parsed.error.flatten() };
+    }
+    const visibility = parsed.data.visibility ?? 'private';
+    const createRemote = parsed.data.create_gitea_remote ?? true;
+    const commitMessage = parsed.data.commit_message ?? 'Initial commit';
+
+    let bootstrap;
+    try {
+      bootstrap = await bootstrapProject(config, app.log, {
+        name: parsed.data.name,
+        commitMessage,
+        visibility,
+        createGiteaRemote: createRemote,
+      });
+    } catch (err) {
+      if (err instanceof BootstrapNameError) {
+        reply.code(400);
+        return { error: `invalid project name: ${err.message}` };
+      }
+      if (err instanceof BootstrapCollisionError) {
+        reply.code(409);
+        return { error: err.message };
+      }
+      if (err instanceof BootstrapPathError) {
+        reply.code(400);
+        return { error: err.message };
+      }
+      app.log.error({ err }, 'bootstrap failed');
+      reply.code(500);
+      return { error: err instanceof Error ? err.message : 'bootstrap failed' };
+    }
+
+    // Insert into projects table only after bootstrap succeeded.
+    try {
+      const [row] = await sql<Project[]>`
+        INSERT INTO projects (name, path, gitea_remote)
+        VALUES (${parsed.data.name}, ${bootstrap.folder_real_path}, ${bootstrap.gitea_remote_url})
+        RETURNING id, name, path, added_at, last_session_id, status, gitea_remote
+      `;
+      broker.publishUser('default', { type: 'project_created', project: row as unknown as Project });
+      reply.code(201);
+      return {
+        project: row,
+        bootstrap: {
+          folder_created: bootstrap.folder_created,
+          git_initialized: bootstrap.git_initialized,
+          first_commit: bootstrap.first_commit,
+          gitea_remote_created: bootstrap.gitea_remote_created,
+          gitea_pushed: bootstrap.gitea_pushed,
+          warnings: bootstrap.warnings,
+        },
+      };
+    } catch (err) {
+      app.log.error({ err, folder: bootstrap.folder_real_path }, 'project insert failed after bootstrap');
+      reply.code(500);
+      return {
+        error: 'project created on disk but DB insert failed',
+        folder: bootstrap.folder_real_path,
+      };
+    }
+  });
+
   app.post('/api/projects', async (req, reply) => {
     const parsed = AddProjectBody.safeParse(req.body);
     if (!parsed.success) {
@@ -65,21 +155,88 @@ export function registerProjectRoutes(
       return { error: resolved.error };
     }
     const name = parsed.data.name?.trim() || resolved.name;
-    try {
-      const [row] = await sql<Project[]>`
-        INSERT INTO projects (name, path)
-        VALUES (${name}, ${resolved.real})
-        RETURNING id, name, path, added_at, last_session_id
-      `;
-      reply.code(201);
-      return row;
-    } catch (err) {
-      if (err instanceof Error && err.message.includes('duplicate key')) {
-        reply.code(409);
-        return { error: 'project already exists' };
-      }
-      throw err;
+
+    // Pre-check the current row (if any) so we can distinguish three cases:
+    //   - no row            → INSERT fresh, 201, project_created
+    //   - row archived      → ON CONFLICT UPDATE flips to 'open', 200, project_unarchived
+    //   - row already open  → 409 (true duplicate)
+    const existing = await sql<{ status: string }[]>`
+      SELECT status FROM projects WHERE path = ${resolved.real}
+    `;
+    if (existing.length > 0 && existing[0]!.status === 'open') {
+      reply.code(409);
+      return { error: 'project already exists' };
     }
+
+    const [row] = await sql<Project[]>`
+      INSERT INTO projects (name, path)
+      VALUES (${name}, ${resolved.real})
+      ON CONFLICT (path) DO UPDATE SET status = 'open'
+      RETURNING id, name, path, added_at, last_session_id, status, gitea_remote
+    `;
+
+    if (existing.length === 0) {
+      broker.publishUser('default', { type: 'project_created', project: row as unknown as Project });
+      reply.code(201);
+    } else {
+      // existing.status was 'archived' — row has been restored.
+      broker.publishUser('default', { type: 'project_unarchived', project: row as unknown as Project });
+      reply.code(200);
+    }
+    return row;
+  });
+
+  app.patch<{ Params: { id: string } }>('/api/projects/:id', async (req, reply) => {
+    const parsed = PatchProjectBody.safeParse(req.body);
+    if (!parsed.success) {
+      reply.code(400);
+      return { error: 'invalid body', details: parsed.error.flatten() };
+    }
+    const rows = await sql<Project[]>`
+      UPDATE projects SET name = ${parsed.data.name}
+      WHERE id = ${req.params.id}
+      RETURNING id, name, path, added_at, last_session_id, status, gitea_remote
+    `;
+    if (rows.length === 0) {
+      reply.code(404);
+      return { error: 'not found' };
+    }
+    const project = rows[0]!;
+    broker.publishUser('default', {
+      type: 'project_updated',
+      project_id: project.id,
+      name: project.name,
+    });
+    return project;
+  });
+
+  app.post<{ Params: { id: string } }>('/api/projects/:id/archive', async (req, reply) => {
+    const result = await sql`
+      UPDATE projects SET status = 'archived'
+      WHERE id = ${req.params.id} AND status = 'open'
+    `;
+    if (result.count === 0) {
+      reply.code(404);
+      return { error: 'not found or already archived' };
+    }
+    broker.publishUser('default', { type: 'project_archived', project_id: req.params.id });
+    reply.code(204);
+    return null;
+  });
+
+  app.post<{ Params: { id: string } }>('/api/projects/:id/unarchive', async (req, reply) => {
+    const rows = await sql<Project[]>`
+      UPDATE projects SET status = 'open'
+      WHERE id = ${req.params.id} AND status = 'archived'
+      RETURNING id, name, path, added_at, last_session_id, status, gitea_remote
+    `;
+    if (rows.length === 0) {
+      reply.code(404);
+      return { error: 'not found or not archived' };
+    }
+    const project = rows[0]!;
+    broker.publishUser('default', { type: 'project_unarchived', project });
+    return project;
   });
 
   app.delete<{ Params: { id: string } }>('/api/projects/:id', async (req, reply) => {
@@ -89,6 +246,7 @@ export function registerProjectRoutes(
       reply.code(404);
       return { error: 'not found' };
     }
+    broker.publishUser('default', { type: 'project_deleted', project_id: id });
     reply.code(204);
     return null;
   });
@@ -102,7 +260,12 @@ export function registerProjectRoutes(
       return [] as AvailableProject[];
     }
 
-    const existing = await sql<{ path: string }[]>`SELECT path FROM projects`;
+    // Only exclude paths registered with status='open'. Archived projects'
+    // folders should reappear as available so re-add via the picker restores
+    // the existing row (see POST /api/projects ON CONFLICT below).
+    const existing = await sql<{ path: string }[]>`
+      SELECT path FROM projects WHERE status = 'open'
+    `;
     const existingSet = new Set(existing.map((r) => r.path));
 
     const out: AvailableProject[] = [];
@@ -127,4 +290,125 @@ export function registerProjectRoutes(
     out.sort((a, b) => a.name.localeCompare(b.name));
     return out;
   });
+
+  // GET /api/projects/:id/list_dir?path=<relpath>
+  app.get<{ Params: { id: string }; Querystring: { path?: string } }>(
+    '/api/projects/:id/list_dir',
+    async (req, reply) => {
+      const { id } = req.params;
+      const relPath = req.query.path ?? '.';
+
+      const rows = await sql<Project[]>`
+        SELECT id, name, path, added_at, last_session_id, status, gitea_remote
+        FROM projects WHERE id = ${id}
+      `;
+      if (rows.length === 0) {
+        reply.code(404);
+        return { error: 'not found' };
+      }
+      const project = rows[0]!;
+      let projectRoot: string;
+      try {
+        projectRoot = await resolveProjectRoot(project.path);
+      } catch (err) {
+        if (err instanceof PathScopeError) {
+          reply.code(404);
+          return { error: err.message };
+        }
+        throw err;
+      }
+
+      try {
+        const result = await listDir(projectRoot, relPath);
+        return result;
+      } catch (err) {
+        if (err instanceof PathScopeError) {
+          reply.code(400);
+          return { error: err.message };
+        }
+        throw err;
+      }
+    }
+  );
+
+  // GET /api/projects/:id/view_file?path=<relpath>
+  app.get<{ Params: { id: string }; Querystring: { path?: string } }>(
+    '/api/projects/:id/view_file',
+    async (req, reply) => {
+      const { id } = req.params;
+      const relPath = req.query.path;
+
+      if (!relPath) {
+        reply.code(400);
+        return { error: 'path is required' };
+      }
+
+      const rows = await sql<Project[]>`
+        SELECT id, name, path, added_at, last_session_id, status, gitea_remote
+        FROM projects WHERE id = ${id}
+      `;
+      if (rows.length === 0) {
+        reply.code(404);
+        return { error: 'not found' };
+      }
+      const project = rows[0]!;
+      let projectRoot: string;
+      try {
+        projectRoot = await resolveProjectRoot(project.path);
+      } catch (err) {
+        if (err instanceof PathScopeError) {
+          reply.code(404);
+          return { error: err.message };
+        }
+        throw err;
+      }
+
+      try {
+        const result = await viewFile(projectRoot, relPath);
+        return result;
+      } catch (err) {
+        if (err instanceof PathScopeError) {
+          reply.code(400);
+          return { error: err.message };
+        }
+        // File not found (pathGuard throws PathScopeError for non-existent paths)
+        if (err instanceof Error && err.message.includes('does not exist')) {
+          reply.code(404);
+          return { error: err.message };
+        }
+        throw err;
+      }
+    }
+  );
+
+  // GET /api/projects/:id/files
+  app.get<{ Params: { id: string } }>(
+    '/api/projects/:id/files',
+    async (req, reply) => {
+      const { id } = req.params;
+
+      const rows = await sql<Project[]>`
+        SELECT id, name, path, added_at, last_session_id, status, gitea_remote
+        FROM projects WHERE id = ${id}
+      `;
+      if (rows.length === 0) {
+        reply.code(404);
+        return { error: 'not found' };
+      }
+      const project = rows[0]!;
+      let projectRoot: string;
+      try {
+        projectRoot = await resolveProjectRoot(project.path);
+      } catch (err) {
+        if (err instanceof PathScopeError) {
+          reply.code(404);
+          return { error: err.message };
+        }
+        throw err;
+      }
+
+      const files = await getProjectFiles(id, projectRoot);
+      return { files };
+    }
+  );
 }

apps/server/src/routes/sessions.ts

@@ -2,6 +2,7 @@ import type { FastifyInstance } from 'fastify';
 import { z } from 'zod';
 import type { Sql } from '../db.js';
 import type { Config } from '../config.js';
+import type { Broker } from '../services/broker.js';
 import type { Session } from '../types/api.js';
 import { getSetting } from './settings.js';
 
@@ -26,9 +27,10 @@ async function resolveDefaultModel(sql: Sql, config: Config): Promise<string> {
 export function registerSessionRoutes(
   app: FastifyInstance,
   sql: Sql,
-  config: Config
+  config: Config,
+  broker: Broker
 ): void {
-  app.get<{ Params: { id: string } }>(
+  app.get<{ Params: { id: string }; Querystring: { status?: string } }>(
     '/api/projects/:id/sessions',
     async (req, reply) => {
       const project = await sql`SELECT id FROM projects WHERE id = ${req.params.id}`;
@@ -36,10 +38,11 @@ export function registerSessionRoutes(
         reply.code(404);
         return { error: 'project not found' };
       }
+      const status = req.query.status === 'archived' ? 'archived' : 'open';
       const rows = await sql<Session[]>`
-        SELECT id, project_id, name, model, system_prompt, created_at, updated_at
+        SELECT id, project_id, name, model, system_prompt, status, created_at, updated_at
         FROM sessions
-        WHERE project_id = ${req.params.id}
+        WHERE project_id = ${req.params.id} AND status = ${status}
         ORDER BY updated_at DESC
       `;
       return rows;
@@ -74,11 +77,23 @@ export function registerSessionRoutes(
       const name = parsed.data.name ?? 'New session';
       const systemPrompt = parsed.data.system_prompt ?? '';
 
-      const [row] = await sql<Session[]>`
-        INSERT INTO sessions (project_id, name, model, system_prompt)
-        VALUES (${req.params.id}, ${name}, ${model}, ${systemPrompt})
-        RETURNING id, project_id, name, model, system_prompt, created_at, updated_at
-      `;
+      const row = await sql.begin(async (tx) => {
+        const [session] = await tx<Session[]>`
+          INSERT INTO sessions (project_id, name, model, system_prompt)
+          VALUES (${req.params.id}, ${name}, ${model}, ${systemPrompt})
+          RETURNING id, project_id, name, model, system_prompt, status, created_at, updated_at
+        `;
+        await tx`
+          INSERT INTO chats (session_id, name, status)
+          VALUES (${session!.id}, NULL, 'open')
+        `;
+        return session!;
+      });
+      broker.publishUser('default', {
+        type: 'session_created',
+        session: row,
+        project_id: row.project_id,
+      });
       reply.code(201);
       return row;
     }
@@ -86,7 +101,7 @@ export function registerSessionRoutes(
 
   app.get<{ Params: { id: string } }>('/api/sessions/:id', async (req, reply) => {
     const rows = await sql<Session[]>`
-      SELECT id, project_id, name, model, system_prompt, created_at, updated_at
+      SELECT id, project_id, name, model, system_prompt, status, created_at, updated_at
       FROM sessions WHERE id = ${req.params.id}
     `;
     if (rows.length === 0) {
@@ -105,6 +120,15 @@ export function registerSessionRoutes(
         return { error: 'invalid body', details: parsed.error.flatten() };
       }
       const { name, model, system_prompt } = parsed.data;
+      // Read the prior name so the post-update publish can skip no-op renames
+      // (PATCH { name: "Foo" } where the session is already "Foo"). The window
+      // between SELECT and UPDATE is sub-millisecond in the same request handler;
+      // a concurrent rename in that gap would just mean one stale publish, which
+      // existing clients dedup by id.
+      const before = await sql<{ name: string }[]>`
+        SELECT name FROM sessions WHERE id = ${req.params.id}
+      `;
+      const priorName = before[0]?.name;
       const rows = await sql<Session[]>`
         UPDATE sessions
         SET
@@ -113,24 +137,82 @@ export function registerSessionRoutes(
           system_prompt = COALESCE(${system_prompt ?? null}, system_prompt),
           updated_at = clock_timestamp()
         WHERE id = ${req.params.id}
-        RETURNING id, project_id, name, model, system_prompt, created_at, updated_at
+        RETURNING id, project_id, name, model, system_prompt, status, created_at, updated_at
       `;
       if (rows.length === 0) {
         reply.code(404);
         return { error: 'session not found' };
       }
-      return rows[0];
+      const session = rows[0]!;
+      if (name !== undefined && session.name !== priorName) {
+        broker.publishUser('default', {
+          type: 'session_renamed',
+          session_id: session.id,
+          name: session.name,
+        });
+      }
+      return session;
+    }
+  );
+
+  app.post<{ Params: { id: string } }>(
+    '/api/sessions/:id/archive',
+    async (req, reply) => {
+      const rows = await sql<{ id: string; project_id: string }[]>`
+        UPDATE sessions SET status = 'archived', updated_at = clock_timestamp()
+        WHERE id = ${req.params.id} AND status = 'open'
+        RETURNING id, project_id
+      `;
+      if (rows.length === 0) {
+        reply.code(404);
+        return { error: 'session not found or already archived' };
+      }
+      broker.publishUser('default', {
+        type: 'session_archived',
+        session_id: rows[0]!.id,
+        project_id: rows[0]!.project_id,
+      });
+      reply.code(204);
+      return null;
+    }
+  );
+
+  app.post<{ Params: { id: string } }>(
+    '/api/sessions/:id/unarchive',
+    async (req, reply) => {
+      const rows = await sql<Session[]>`
+        UPDATE sessions SET status = 'open', updated_at = clock_timestamp()
+        WHERE id = ${req.params.id} AND status = 'archived'
+        RETURNING id, project_id, name, model, system_prompt, status, created_at, updated_at
+      `;
+      if (rows.length === 0) {
+        reply.code(404);
+        return { error: 'session not found or not archived' };
+      }
+      const session = rows[0]!;
+      broker.publishUser('default', {
+        type: 'session_created',
+        session: session,
+        project_id: session.project_id,
+      });
+      reply.code(200);
+      return session;
     }
   );
 
   app.delete<{ Params: { id: string } }>(
     '/api/sessions/:id',
     async (req, reply) => {
-      const result = await sql`DELETE FROM sessions WHERE id = ${req.params.id}`;
-      if (result.count === 0) {
+      const id = req.params.id;
+      const deleted = await sql<{ project_id: string }[]>`
+        DELETE FROM sessions WHERE id = ${id} RETURNING project_id
+      `;
+      if (deleted.length === 0) {
         reply.code(404);
         return { error: 'not found' };
       }
+      const project_id = deleted[0]!.project_id;
+      broker.publishUser('default', { type: 'session_deleted', session_id: id, project_id });
       reply.code(204);
       return null;
     }

apps/server/src/routes/sidebar.ts

@@ -8,9 +8,10 @@ import type {
 
 export function registerSidebarRoutes(app: FastifyInstance, sql: Sql): void {
   app.get('/api/sidebar', async (): Promise<SidebarResponse> => {
-    const projects = await sql<{ id: string; name: string }[]>`
-      SELECT id, name
+    const projects = await sql<{ id: string; name: string; path: string; gitea_remote: string | null }[]>`
+      SELECT id, name, path, gitea_remote
       FROM projects
+      WHERE status = 'open'
       ORDER BY added_at DESC
     `;
 
@@ -18,21 +19,23 @@ export function registerSidebarRoutes(app: FastifyInstance, sql: Sql): void {
       projects.map(async (p) => {
         const [recent_sessions, countRows] = await Promise.all([
           sql<SidebarSession[]>`
-            SELECT id, name, model, updated_at
+            SELECT id, project_id, name, model, updated_at
             FROM sessions
-            WHERE project_id = ${p.id}
+            WHERE project_id = ${p.id} AND status = 'open'
             ORDER BY updated_at DESC
             LIMIT 6
           `,
           sql<{ n: number }[]>`
             SELECT COUNT(*)::int AS n
             FROM sessions
-            WHERE project_id = ${p.id}
+            WHERE project_id = ${p.id} AND status = 'open'
           `,
         ]);
         return {
           id: p.id,
           name: p.name,
+          path: p.path,
+          gitea_remote: p.gitea_remote,
           recent_sessions,
           total_sessions: countRows[0]?.n ?? 0,
         };

apps/server/src/routes/ws.ts

@@ -22,7 +22,7 @@ export function registerWebSocket(
       }
 
       const messages = await sql<Message[]>`
-        SELECT id, session_id, role, content, tool_calls, tool_results, status, last_seq,
+        SELECT id, session_id, chat_id, role, content, kind, tool_calls, tool_results, status, last_seq,
                tokens_used, ctx_used, ctx_max, started_at, finished_at, created_at
         FROM messages
         WHERE session_id = ${sessionId}
@@ -43,4 +43,18 @@ export function registerWebSocket(
       socket.on('error', () => unsubscribe());
     }
   );
+
+  app.get('/api/ws/user', { websocket: true }, async (socket) => {
+    const user = 'default';
+    const unsubscribe = broker.subscribeUser(user, (frame) => {
+      if (socket.readyState !== socket.OPEN) return;
+      try {
+        socket.send(JSON.stringify(frame));
+      } catch (err) {
+        app.log.warn({ err, user }, 'user ws send failed');
+      }
+    });
+    socket.on('close', () => unsubscribe());
+    socket.on('error', () => unsubscribe());
+  });
 }

apps/server/src/schema.sql

@@ -2,7 +2,7 @@ CREATE TABLE IF NOT EXISTS projects (
   id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
   name TEXT NOT NULL,
   path TEXT NOT NULL UNIQUE,
-  added_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+  added_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
   last_session_id UUID
 );
 
@@ -12,8 +12,8 @@ CREATE TABLE IF NOT EXISTS sessions (
   name TEXT NOT NULL,
   model TEXT NOT NULL,
   system_prompt TEXT NOT NULL DEFAULT '',
-  created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
-  updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+  created_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp()
 );
 
 CREATE INDEX IF NOT EXISTS idx_sessions_project ON sessions(project_id, updated_at DESC);
@@ -21,13 +21,13 @@ CREATE INDEX IF NOT EXISTS idx_sessions_project ON sessions(project_id, updated_
 CREATE TABLE IF NOT EXISTS messages (
   id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
   session_id UUID NOT NULL REFERENCES sessions(id) ON DELETE CASCADE,
-  role TEXT NOT NULL CHECK (role IN ('user', 'assistant', 'tool')),
+  role TEXT NOT NULL,
   content TEXT NOT NULL DEFAULT '',
   tool_calls JSONB,
   tool_results JSONB,
-  status TEXT NOT NULL DEFAULT 'complete' CHECK (status IN ('streaming', 'complete', 'failed')),
+  status TEXT NOT NULL DEFAULT 'complete',
   last_seq INT NOT NULL DEFAULT 0,
-  created_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+  created_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp()
 );
 
 CREATE INDEX IF NOT EXISTS idx_messages_session ON messages(session_id, created_at);
@@ -46,3 +46,110 @@ CREATE TABLE IF NOT EXISTS settings (
 );
 
 INSERT INTO settings (key, value) VALUES ('default_model', '"qwen3.6-35b-a3b-mxfp4"') ON CONFLICT (key) DO NOTHING;
+
+-- DEPRECATED: client-side pane state as of v1.2-batch4. Table retained per
+-- additive schema rule; no writes. Drop in a future destructive migration.
+CREATE TABLE IF NOT EXISTS session_panes (
+  id           UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  session_id   UUID NOT NULL REFERENCES sessions(id) ON DELETE CASCADE,
+  position     INTEGER NOT NULL,
+  kind         TEXT NOT NULL CHECK (kind IN ('chat', 'file_browser')),
+  state        JSONB NOT NULL DEFAULT '{}',
+  created_at   TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
+  UNIQUE (session_id, position)
+);
+CREATE INDEX IF NOT EXISTS idx_session_panes_session ON session_panes (session_id);
+
+-- v1.4: backfill removed. Pane layout is client-side (localStorage) since v1.2-batch4.
+-- The CREATE TABLE above is retained for additive-schema discipline; drop is a
+-- future destructive migration.
+
+-- v1.2: sessions.status (open | archived)
+ALTER TABLE sessions ADD COLUMN IF NOT EXISTS status TEXT NOT NULL DEFAULT 'open';
+
+-- v1.2: chats table
+CREATE TABLE IF NOT EXISTS chats (
+  id           UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  session_id   UUID NOT NULL REFERENCES sessions(id) ON DELETE CASCADE,
+  name         TEXT,
+  status       TEXT NOT NULL DEFAULT 'open' CHECK (status IN ('open', 'archived')),
+  created_at   TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
+  updated_at   TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp()
+);
+CREATE INDEX IF NOT EXISTS idx_chats_session_status ON chats (session_id, status, updated_at DESC);
+
+-- v1.2: messages.chat_id + messages.kind
+ALTER TABLE messages ADD COLUMN IF NOT EXISTS chat_id UUID REFERENCES chats(id) ON DELETE CASCADE;
+ALTER TABLE messages ADD COLUMN IF NOT EXISTS kind TEXT NOT NULL DEFAULT 'message';
+CREATE INDEX IF NOT EXISTS idx_messages_chat ON messages (chat_id, created_at);
+
+-- Backfill: one chat per existing session that has none yet
+INSERT INTO chats (session_id, name, status, created_at, updated_at)
+SELECT s.id, s.name, 'open', s.created_at, s.updated_at
+FROM sessions s
+WHERE NOT EXISTS (
+  SELECT 1 FROM chats c WHERE c.session_id = s.id
+);
+
+-- Backfill: link orphaned messages to their session's first chat
+UPDATE messages SET chat_id = (
+  SELECT c.id FROM chats c WHERE c.session_id = messages.session_id ORDER BY c.created_at ASC LIMIT 1
+)
+WHERE chat_id IS NULL;
+
+-- Enforce NOT NULL on chat_id once all rows are backfilled
+DO $$
+BEGIN
+  IF EXISTS (
+    SELECT 1 FROM information_schema.columns
+    WHERE table_name = 'messages' AND column_name = 'chat_id' AND is_nullable = 'YES'
+  ) AND NOT EXISTS (
+    SELECT 1 FROM messages WHERE chat_id IS NULL
+  ) THEN
+    ALTER TABLE messages ALTER COLUMN chat_id SET NOT NULL;
+  END IF;
+END $$;
+
+-- v1.2.1: CHECK constraints for sessions.status and messages (role, status)
+-- KEEP IN SYNC: apps/server/src/types/api.ts (MESSAGE_ROLES, MESSAGE_STATUSES, SessionStatus)
+DO $$
+BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'sessions_status_chk') THEN
+    ALTER TABLE sessions ADD CONSTRAINT sessions_status_chk
+      CHECK (status IN ('open', 'archived'));
+  END IF;
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'messages_role_chk') THEN
+    ALTER TABLE messages ADD CONSTRAINT messages_role_chk
+      CHECK (role IN ('user', 'assistant', 'system', 'tool'));
+  END IF;
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'messages_status_chk') THEN
+    ALTER TABLE messages ADD CONSTRAINT messages_status_chk
+      CHECK (status IN ('streaming', 'complete', 'failed', 'cancelled'));
+  END IF;
+END $$;
+
+-- v1.2-project-ux: projects.status + projects.gitea_remote
+-- KEEP IN SYNC: apps/server/src/types/api.ts PROJECT_STATUSES
+ALTER TABLE projects ADD COLUMN IF NOT EXISTS status TEXT NOT NULL DEFAULT 'open';
+ALTER TABLE projects ADD COLUMN IF NOT EXISTS gitea_remote TEXT;
+DO $$
+BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'projects_status_chk') THEN
+    ALTER TABLE projects ADD CONSTRAINT projects_status_chk
+      CHECK (status IN ('open', 'archived'));
+  END IF;
+END $$;
+
+-- v1.3-tab-close-chat-archive: align chats.status vocabulary with projects ('archived' not 'closed')
+-- KEEP IN SYNC: apps/server/src/types/api.ts CHAT_STATUSES
+-- Order matters: (1) drop the OLD inline CHECK that only allowed ('open','closed');
+-- (2) migrate existing rows; (3) add new named CHECK allowing ('open','archived').
+ALTER TABLE chats DROP CONSTRAINT IF EXISTS chats_status_check;
+UPDATE chats SET status = 'archived' WHERE status = 'closed';
+DO $$
+BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'chats_status_chk') THEN
+    ALTER TABLE chats ADD CONSTRAINT chats_status_chk
+      CHECK (status IN ('open', 'archived'));
+  END IF;
+END $$;

apps/server/src/services/__tests__/inference.test.ts

@@ -0,0 +1,237 @@
+import { describe, it, expect } from 'vitest';
+import { buildMessagesPayload } from '../inference.js';
+import type {
+  Message,
+  MessageRole,
+  Project,
+  Session,
+  ToolCall,
+  ToolResult,
+} from '../../types/api.js';
+
+// ---- fixtures ---------------------------------------------------------------
+
+function makeSession(overrides: Partial<Session> = {}): Session {
+  return {
+    id: 'sess',
+    project_id: 'proj',
+    name: 'test session',
+    model: 'test-model',
+    system_prompt: '',
+    status: 'open',
+    created_at: new Date(0).toISOString(),
+    updated_at: new Date(0).toISOString(),
+    ...overrides,
+  };
+}
+
+function makeProject(overrides: Partial<Project> = {}): Project {
+  return {
+    id: 'proj',
+    name: 'test project',
+    path: '/tmp/proj',
+    added_at: new Date(0).toISOString(),
+    last_session_id: null,
+    status: 'open',
+    gitea_remote: null,
+    ...overrides,
+  };
+}
+
+let counter = 0;
+function makeMessage(
+  role: MessageRole,
+  content: string,
+  overrides: Partial<Message> = {}
+): Message {
+  counter += 1;
+  return {
+    id: `m${counter}`,
+    session_id: 'sess',
+    chat_id: 'chat',
+    role,
+    content,
+    kind: 'message',
+    tool_calls: null,
+    tool_results: null,
+    status: 'complete',
+    last_seq: 0,
+    tokens_used: null,
+    ctx_used: null,
+    ctx_max: null,
+    started_at: null,
+    finished_at: null,
+    created_at: new Date(counter * 1000).toISOString(),
+    ...overrides,
+  };
+}
+
+// ---- tests ------------------------------------------------------------------
+
+describe('buildMessagesPayload', () => {
+  it('prepends a system prompt containing the project path', () => {
+    const session = makeSession();
+    const project = makeProject({ path: '/tmp/my-proj' });
+    const result = buildMessagesPayload(session, project, []);
+    expect(result).toHaveLength(1);
+    expect(result[0]!.role).toBe('system');
+    expect(result[0]!.content).toContain('/tmp/my-proj');
+  });
+
+  it('appends session.system_prompt to the system message when set', () => {
+    const session = makeSession({ system_prompt: 'Be terse.' });
+    const project = makeProject();
+    const result = buildMessagesPayload(session, project, []);
+    expect(result).toHaveLength(1);
+    expect(result[0]!.role).toBe('system');
+    expect(result[0]!.content).toContain('Be terse.');
+  });
+
+  it('returns user/assistant messages in order when no compact marker is present', () => {
+    const session = makeSession();
+    const project = makeProject();
+    const history: Message[] = [
+      makeMessage('user', 'hi'),
+      makeMessage('assistant', 'hello'),
+      makeMessage('user', 'how are you'),
+      makeMessage('assistant', 'great'),
+    ];
+    const result = buildMessagesPayload(session, project, history);
+    // 1 system + 4 history messages
+    expect(result).toHaveLength(5);
+    expect(result[0]!.role).toBe('system');
+    expect(result[1]).toMatchObject({ role: 'user', content: 'hi' });
+    expect(result[2]).toMatchObject({ role: 'assistant', content: 'hello' });
+    expect(result[3]).toMatchObject({ role: 'user', content: 'how are you' });
+    expect(result[4]).toMatchObject({ role: 'assistant', content: 'great' });
+  });
+
+  it('starts from the latest compact marker, emitting it as a system message', () => {
+    const session = makeSession();
+    const project = makeProject();
+    const history: Message[] = [
+      makeMessage('user', 'old1'),
+      makeMessage('assistant', 'oldreply1'),
+      makeMessage('user', 'old2'),
+      makeMessage('assistant', 'compacted summary text', { kind: 'compact' }),
+      makeMessage('user', 'new1'),
+      makeMessage('assistant', 'newreply1'),
+    ];
+    const result = buildMessagesPayload(session, project, history);
+    // Expect: leading base-system prompt, then the compact as system, then
+    // the user/assistant pair following it.
+    expect(result).toHaveLength(4);
+    expect(result[0]!.role).toBe('system');
+    expect(result[1]).toMatchObject({
+      role: 'system',
+      content: 'compacted summary text',
+    });
+    expect(result[2]).toMatchObject({ role: 'user', content: 'new1' });
+    expect(result[3]).toMatchObject({ role: 'assistant', content: 'newreply1' });
+  });
+
+  it('uses only the most recent compact when multiple are present', () => {
+    const session = makeSession();
+    const project = makeProject();
+    const history: Message[] = [
+      makeMessage('user', 'u1'),
+      makeMessage('assistant', 'first compact summary', { kind: 'compact' }),
+      makeMessage('user', 'u2'),
+      makeMessage('assistant', 'second compact summary', { kind: 'compact' }),
+      makeMessage('user', 'u3'),
+      makeMessage('assistant', 'final reply'),
+    ];
+    const result = buildMessagesPayload(session, project, history);
+    // Expect: base system + latest compact as system + the two messages
+    // following it. The earlier compact and pre-compact history are dropped.
+    expect(result).toHaveLength(4);
+    expect(result[0]!.role).toBe('system');
+    expect(result[1]).toMatchObject({
+      role: 'system',
+      content: 'second compact summary',
+    });
+    expect(result[2]).toMatchObject({ role: 'user', content: 'u3' });
+    expect(result[3]).toMatchObject({ role: 'assistant', content: 'final reply' });
+    // None of the earlier content should leak through
+    const concatenated = result.map((m) => m.content ?? '').join(' ');
+    expect(concatenated).not.toContain('first compact summary');
+    expect(concatenated).not.toContain('u1');
+    expect(concatenated).not.toContain('u2');
+  });
+
+  it('skips streaming and cancelled assistant rows', () => {
+    const session = makeSession();
+    const project = makeProject();
+    const history: Message[] = [
+      makeMessage('user', 'hi'),
+      makeMessage('assistant', 'partial...', { status: 'streaming' }),
+      makeMessage('assistant', 'cancelled fragment', { status: 'cancelled' }),
+      makeMessage('assistant', 'final answer'),
+    ];
+    const result = buildMessagesPayload(session, project, history);
+    // 1 system + 1 user + 1 assistant (only the complete one)
+    expect(result).toHaveLength(3);
+    expect(result[1]).toMatchObject({ role: 'user', content: 'hi' });
+    expect(result[2]).toMatchObject({ role: 'assistant', content: 'final answer' });
+  });
+
+  it('round-trips an assistant-with-tool_calls followed by its tool result', () => {
+    const session = makeSession();
+    const project = makeProject();
+    const toolCall: ToolCall = {
+      id: 'call_abc',
+      name: 'view_file',
+      args: { path: 'src/index.ts' },
+    };
+    const toolResult: ToolResult = {
+      tool_call_id: 'call_abc',
+      output: { contents: 'console.log(1)' },
+      truncated: false,
+    };
+    const history: Message[] = [
+      makeMessage('user', 'show me the file'),
+      makeMessage('assistant', '', { tool_calls: [toolCall] }),
+      makeMessage('tool', '', { tool_results: toolResult }),
+      makeMessage('assistant', 'here it is'),
+    ];
+    const result = buildMessagesPayload(session, project, history);
+    // 1 system + 1 user + 1 assistant(tool_calls) + 1 tool + 1 assistant
+    expect(result).toHaveLength(5);
+    expect(result[1]).toMatchObject({ role: 'user', content: 'show me the file' });
+    expect(result[2]!.role).toBe('assistant');
+    expect(result[2]!.tool_calls).toBeDefined();
+    expect(result[2]!.tool_calls).toHaveLength(1);
+    expect(result[2]!.tool_calls![0]).toMatchObject({
+      id: 'call_abc',
+      type: 'function',
+      function: { name: 'view_file' },
+    });
+    // The OpenAI shape stringifies args.
+    expect(result[2]!.tool_calls![0]!.function.arguments).toBe(
+      JSON.stringify({ path: 'src/index.ts' })
+    );
+    // assistant with empty content should be serialized as content: null
+    expect(result[2]!.content).toBeNull();
+    expect(result[3]).toMatchObject({
+      role: 'tool',
+      tool_call_id: 'call_abc',
+    });
+    // Non-string tool output is JSON-stringified.
+    expect(result[3]!.content).toBe(JSON.stringify({ contents: 'console.log(1)' }));
+    expect(result[4]).toMatchObject({ role: 'assistant', content: 'here it is' });
+  });
+
+  it('skips tool rows with no tool_results', () => {
+    const session = makeSession();
+    const project = makeProject();
+    const history: Message[] = [
+      makeMessage('user', 'do it'),
+      makeMessage('tool', '', { tool_results: null }),
+      makeMessage('assistant', 'done'),
+    ];
+    const result = buildMessagesPayload(session, project, history);
+    // 1 system + 1 user + 1 assistant; the empty tool row is dropped.
+    expect(result).toHaveLength(3);
+    expect(result.find((m) => m.role === 'tool')).toBeUndefined();
+  });
+});

apps/server/src/services/__tests__/project_bootstrap.test.ts

@@ -0,0 +1,47 @@
+import { describe, it, expect } from 'vitest';
+import { sanitizeFolderName } from '../project_bootstrap.js';
+
+describe('sanitizeFolderName', () => {
+  it('passes through a normal slug-like name', () => {
+    expect(sanitizeFolderName('my-project')).toBe('my-project');
+  });
+
+  it('lowercases and replaces whitespace with hyphens', () => {
+    expect(sanitizeFolderName('Hello World')).toBe('hello-world');
+  });
+
+  it('strips path-traversal characters', () => {
+    // dots and slashes fall outside [a-z0-9-] and are removed entirely.
+    expect(sanitizeFolderName('../etc/passwd')).toBe('etcpasswd');
+  });
+
+  it('strips trailing and leading dots and slashes', () => {
+    expect(sanitizeFolderName('./foo/')).toBe('foo');
+  });
+
+  it('collapses runs of hyphens and strips leading/trailing ones', () => {
+    expect(sanitizeFolderName('---foo---')).toBe('foo');
+  });
+
+  it('returns empty string when nothing survives sanitization', () => {
+    // NOTE: sanitizeFolderName itself does NOT throw — it returns ''. The
+    // BootstrapNameError is raised by the caller (bootstrapProject) when the
+    // sanitized result fails the SAFE_NAME regex. The spec's "throws" phrasing
+    // refers to that caller-level validation, not this pure function.
+    expect(sanitizeFolderName('...')).toBe('');
+    expect(sanitizeFolderName('   ')).toBe('');
+  });
+
+  it('strips control characters and null bytes', () => {
+    // Null bytes and control characters are not in [a-z0-9-] so they're
+    // filtered out (effectively rejected as folder-name content).
+    expect(sanitizeFolderName('my\x00proj\x01')).toBe('myproj');
+    expect(sanitizeFolderName('foo\x00bar')).toBe('foobar');
+  });
+
+  it('truncates names longer than 64 characters', () => {
+    const long = 'a'.repeat(100);
+    expect(sanitizeFolderName(long)).toBe('a'.repeat(64));
+    expect(sanitizeFolderName(long)).toHaveLength(64);
+  });
+});

apps/server/src/services/auto_name.ts

@@ -5,31 +5,12 @@ const NAMING_SYSTEM_PROMPT =
 
 const MAX_TITLE_CHARS = 60;
 
-// QWEN3 NON-STREAMING UTILITY-CALL PATTERN
-// ----------------------------------------
-// Qwen3-family chat templates default to chain-of-thought reasoning: the
-// model emits a long <think>…</think> block into `reasoning_content` and
-// only finalizes a real reply in `content`. For short utility calls
-// (naming, classification, routing, summarization) with a tight token
-// budget, the model burns the entire budget on reasoning and returns:
-//   - content: ""
-//   - reasoning_content: "Thinking Process: 1. ..." (mid-thought, truncated)
-//   - finish_reason: "length"
-// Fix: pass `chat_template_kwargs: { enable_thinking: false }` to skip the
-// thinking block, and keep `max_tokens` low (~30 is plenty for a 4-word
-// title). The kwarg is a no-op for non-Qwen chat templates, so it's safe
-// to apply unconditionally for any short non-streaming model call.
-// Apply this same pattern to: fork-message (planned), agent-routing
-// (planned), web-search summarization (planned).
-
 function cleanTitle(raw: string): string {
   let name = raw.trim();
-  // Strip surrounding straight or smart quotes (one layer).
   const quotes = ['"', "'", '`', '‘', '’', '“', '”'];
   while (name.length >= 2 && quotes.includes(name[0]!) && quotes.includes(name[name.length - 1]!)) {
     name = name.slice(1, -1).trim();
   }
-  // Drop a leading "Title:" prefix if the model added one despite instructions.
   name = name.replace(/^title\s*:\s*/i, '').trim();
   if (name.length > MAX_TITLE_CHARS) {
     name = name.slice(0, MAX_TITLE_CHARS).trim();
@@ -46,13 +27,10 @@ interface NamingResponse {
   }>;
 }
 
-// Some Qwen-family models emit "thinking" tokens into reasoning_content and
-// only finalize a real reply in content. Pull a sensible candidate string.
 function pickTitleSource(data: NamingResponse): string {
   const choice = data.choices?.[0]?.message;
   if (!choice) return '';
   if (choice.content && choice.content.trim().length > 0) return choice.content;
-  // Fallback: try to extract a last-line title from reasoning, if present.
   const reasoning = choice.reasoning_content ?? '';
   if (reasoning.length === 0) return '';
   const lines = reasoning
@@ -62,40 +40,48 @@ function pickTitleSource(data: NamingResponse): string {
   return lines[lines.length - 1] ?? '';
 }
 
-export async function maybeAutoNameSession(
+export async function maybeAutoNameChat(
   ctx: InferenceContext,
+  chatId: string,
   sessionId: string
 ): Promise<void> {
   const counts = await ctx.sql<{ n: number }[]>`
     SELECT COUNT(*)::int AS n
     FROM messages
-    WHERE session_id = ${sessionId}
+    WHERE chat_id = ${chatId}
       AND role = 'assistant'
       AND status = 'complete'
+      AND content <> ''
   `;
-  if (counts[0]?.n !== 1) return;
+  if ((counts[0]?.n ?? 0) < 1) return;
 
-  const sessionRows = await ctx.sql<
-    { id: string; name: string; model: string }[]
+  const chatRows = await ctx.sql<
+    { id: string; name: string | null; session_id: string }[]
   >`
-    SELECT id, name, model FROM sessions WHERE id = ${sessionId}
+    SELECT id, name, session_id FROM chats WHERE id = ${chatId}
   `;
-  const session = sessionRows[0];
-  if (!session) return;
-  const existingName = session.name ?? '';
-  if (existingName !== '' && existingName !== 'New session') return;
+  const chat = chatRows[0];
+  if (!chat) return;
+  if (chat.name !== null && chat.name !== '') return;
+
+  const sessionRows = await ctx.sql<{ model: string }[]>`
+    SELECT model FROM sessions WHERE id = ${sessionId}
+  `;
+  const model = sessionRows[0]?.model;
+  if (!model) return;
 
   const userMsg = await ctx.sql<{ content: string }[]>`
     SELECT content FROM messages
-    WHERE session_id = ${sessionId} AND role = 'user'
+    WHERE chat_id = ${chatId} AND role = 'user'
     ORDER BY created_at ASC
     LIMIT 1
   `;
   const assistantMsg = await ctx.sql<{ content: string }[]>`
     SELECT content FROM messages
-    WHERE session_id = ${sessionId}
+    WHERE chat_id = ${chatId}
       AND role = 'assistant'
       AND status = 'complete'
+      AND content <> ''
     ORDER BY created_at ASC
     LIMIT 1
   `;
@@ -105,7 +91,7 @@ export async function maybeAutoNameSession(
   const assistantText = assistantMsg[0].content.slice(0, 2000);
 
   const body = {
-    model: session.model,
+    model,
     messages: [
       { role: 'system', content: NAMING_SYSTEM_PROMPT },
       {
@@ -116,9 +102,6 @@ export async function maybeAutoNameSession(
     max_tokens: 30,
     temperature: 0.3,
     stream: false,
-    // Qwen-family models default to chain-of-thought; this template kwarg
-    // tells llama.cpp's chat template renderer to skip the thinking block.
-    // Harmless for non-Qwen models.
     chat_template_kwargs: { enable_thinking: false },
   };
 
@@ -135,23 +118,49 @@ export async function maybeAutoNameSession(
   const raw = pickTitleSource(data);
   const name = cleanTitle(raw);
   if (!name) {
-    ctx.log.warn({ sessionId, raw }, 'auto-name: empty title from model');
+    ctx.log.warn({ chatId, raw }, 'auto-name: empty title from model');
     return;
   }
 
-  const updated = await ctx.sql<{ id: string; name: string }[]>`
-    UPDATE sessions
-    SET name = ${name}, updated_at = NOW()
-    WHERE id = ${sessionId}
-      AND (name IS NULL OR name = '' OR name = 'New session')
-    RETURNING id, name
+  const updated = await ctx.sql<{ id: string; name: string; session_id: string; updated_at: string }[]>`
+    UPDATE chats
+    SET name = ${name}, updated_at = clock_timestamp()
+    WHERE id = ${chatId}
+      AND (name IS NULL OR name = '')
+    RETURNING id, name, session_id, updated_at
   `;
   if (updated.length === 0) return;
 
   ctx.publish(sessionId, {
-    type: 'session_renamed',
-    session_id: sessionId,
+    type: 'chat_renamed',
+    chat_id: chatId,
     name,
   });
-  ctx.log.info({ sessionId, name }, 'session auto-named');
+  ctx.publishUser({
+    type: 'chat_updated',
+    chat_id: chatId,
+    session_id: sessionId,
+    name,
+    updated_at: updated[0]!.updated_at,
+  });
+  ctx.log.info({ chatId, name }, 'chat auto-named');
+
+  // Propagate to the parent session if it's still on its default name.
+  // The WHERE guard makes the check atomic — if the user has already
+  // renamed (or a prior chat already propagated), this UPDATE matches
+  // zero rows and we do nothing. First chat wins; manual renames win.
+  const renamedSession = await ctx.sql<{ id: string; name: string }[]>`
+    UPDATE sessions
+    SET name = ${name}
+    WHERE id = ${sessionId} AND name = 'New session'
+    RETURNING id, name
+  `;
+  if (renamedSession.length > 0) {
+    ctx.publishUser({
+      type: 'session_renamed',
+      session_id: sessionId,
+      name,
+    });
+    ctx.log.info({ sessionId, name }, 'session auto-named from chat');
+  }
 }

apps/server/src/services/broker.ts

@@ -4,35 +4,53 @@ export type Listener = (frame: Frame) => void;
 export interface Broker {
   publish(sessionId: string, frame: Frame): void;
   subscribe(sessionId: string, listener: Listener): () => void;
+  publishUser(user: string, frame: Frame): void;
+  subscribeUser(user: string, listener: Listener): () => void;
 }
 
 export function createBroker(): Broker {
   const topics = new Map<string, Set<Listener>>();
+  const userTopics = new Map<string, Set<Listener>>();
+
+  function publishTo(map: Map<string, Set<Listener>>, key: string, frame: Frame): void {
+    const set = map.get(key);
+    if (!set) return;
+    for (const listener of set) {
+      try {
+        listener(frame);
+      } catch {
+        // ignore listener errors so one bad subscriber doesn't break the rest
+      }
+    }
+  }
+
+  function subscribeTo(map: Map<string, Set<Listener>>, key: string, listener: Listener): () => void {
+    let set = map.get(key);
+    if (!set) {
+      set = new Set();
+      map.set(key, set);
+    }
+    set.add(listener);
+    return () => {
+      const s = map.get(key);
+      if (!s) return;
+      s.delete(listener);
+      if (s.size === 0) map.delete(key);
+    };
+  }
+
   return {
     publish(sessionId, frame) {
-      const set = topics.get(sessionId);
-      if (!set) return;
-      for (const listener of set) {
-        try {
-          listener(frame);
-        } catch {
-          // ignore listener errors so one bad subscriber doesn't break the rest
-        }
-      }
+      publishTo(topics, sessionId, frame);
     },
     subscribe(sessionId, listener) {
-      let set = topics.get(sessionId);
-      if (!set) {
-        set = new Set();
-        topics.set(sessionId, set);
-      }
-      set.add(listener);
-      return () => {
-        const s = topics.get(sessionId);
-        if (!s) return;
-        s.delete(listener);
-        if (s.size === 0) topics.delete(sessionId);
-      };
+      return subscribeTo(topics, sessionId, listener);
+    },
+    publishUser(user, frame) {
+      publishTo(userTopics, user, frame);
+    },
+    subscribeUser(user, listener) {
+      return subscribeTo(userTopics, user, listener);
     },
   };
 }

apps/server/src/services/file_index.ts

@@ -0,0 +1,53 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { execFile } from 'node:child_process';
+
+interface MtimeSnap {
+  root: number;
+  gitHead: number | null;
+  gitIndex: number | null;
+}
+
+interface CacheEntry {
+  files: string[];
+  mtimes: MtimeSnap;
+}
+
+const cache = new Map<string, CacheEntry>(); // keyed by projectId
+
+// Concurrent calls with a cold/stale cache may both spawn rg. The result is
+// deterministic so they overwrite identically — no data corruption, just a
+// rare extra subprocess. Acceptable for single-user mode.
+export async function getProjectFiles(projectId: string, projectRoot: string): Promise<string[]> {
+  const current = await snapMtimes(projectRoot);
+  const cached = cache.get(projectId);
+  if (cached && eqMtimes(cached.mtimes, current)) {
+    return cached.files;
+  }
+  const files = await runRgFiles(projectRoot);
+  cache.set(projectId, { files, mtimes: current });
+  return files;
+}
+
+async function snapMtimes(root: string): Promise<MtimeSnap> {
+  const rootStat = await fs.stat(root);
+  let gitHead: number | null = null;
+  let gitIndex: number | null = null;
+  // best-effort; ignore failure because the project may not be a git repo
+  try { gitHead = (await fs.stat(path.join(root, '.git', 'HEAD'))).mtimeMs; } catch {}
+  try { gitIndex = (await fs.stat(path.join(root, '.git', 'index'))).mtimeMs; } catch {}
+  return { root: rootStat.mtimeMs, gitHead, gitIndex };
+}
+
+function eqMtimes(a: MtimeSnap, b: MtimeSnap): boolean {
+  return a.root === b.root && a.gitHead === b.gitHead && a.gitIndex === b.gitIndex;
+}
+
+function runRgFiles(root: string): Promise<string[]> {
+  return new Promise((resolve, reject) => {
+    execFile('rg', ['--files'], { cwd: root, maxBuffer: 32 * 1024 * 1024 }, (err, stdout) => {
+      if (err) return reject(err);
+      resolve(stdout.split('\n').filter(Boolean));
+    });
+  });
+}

apps/server/src/services/file_ops.ts

@@ -0,0 +1,253 @@
+import { readFile, readdir, stat } from 'node:fs/promises';
+import { resolve, relative } from 'node:path';
+import { spawn } from 'node:child_process';
+import { pathGuard, PathScopeError } from './path_guard.js';
+
+const MAX_FILE_BYTES = 5 * 1024 * 1024;
+const DEFAULT_VIEW_LINES = 200;
+const MAX_GREP_RESULTS = 200;
+const DEFAULT_GREP_RESULTS = 100;
+const MAX_FIND_RESULTS = 200;
+const DEFAULT_FIND_RESULTS = 100;
+const MAX_DIR_ENTRIES = 500;
+
+export interface FileEntry {
+  name: string;
+  kind: 'file' | 'dir';
+  size?: number;
+}
+
+export interface ListDirResult {
+  entries: FileEntry[];
+  truncated: boolean;
+  total: number;
+}
+
+export interface ViewFileResult {
+  content: string;
+  truncated: boolean;
+  total_bytes: number;
+  bytes_returned: number;
+}
+
+export interface GrepMatch {
+  path: string;
+  line: number;
+  text: string;
+}
+
+export interface GrepResult {
+  matches: GrepMatch[];
+  truncated: boolean;
+}
+
+export interface FindFilesResult {
+  files: string[];
+  total: number;
+  truncated: boolean;
+}
+
+export async function listDir(projectRoot: string, relPath: string): Promise<ListDirResult> {
+  const real = await pathGuard(projectRoot, relPath);
+  const s = await stat(real);
+  if (!s.isDirectory()) {
+    throw new PathScopeError(`not a directory: ${relPath}`);
+  }
+  const entries = await readdir(real, { withFileTypes: true });
+  const total = entries.length;
+  const slice = entries.slice(0, MAX_DIR_ENTRIES);
+  const out: FileEntry[] = await Promise.all(
+    slice.map(async (e) => {
+      const child = resolve(real, e.name);
+      let size: number | undefined;
+      if (e.isFile()) {
+        try {
+          const cs = await stat(child);
+          size = cs.size;
+        } catch {
+          /* ignore */
+        }
+      }
+      return {
+        name: e.name,
+        kind: e.isDirectory() ? ('dir' as const) : ('file' as const),
+        ...(size != null ? { size } : {}),
+      };
+    })
+  );
+  return {
+    entries: out,
+    total,
+    truncated: total > MAX_DIR_ENTRIES,
+  };
+}
+
+export async function viewFile(projectRoot: string, relPath: string): Promise<ViewFileResult> {
+  const real = await pathGuard(projectRoot, relPath);
+  const s = await stat(real);
+  if (!s.isFile()) {
+    throw new PathScopeError(`not a file: ${relPath}`);
+  }
+  if (s.size > MAX_FILE_BYTES) {
+    throw new Error(`file too large (${s.size} bytes, max ${MAX_FILE_BYTES})`);
+  }
+  const raw = await readFile(real, 'utf8');
+  const lines = raw.split('\n');
+  const total = lines.length;
+  const end = Math.min(total, DEFAULT_VIEW_LINES);
+  const slice = lines.slice(0, end);
+  const content = slice.join('\n');
+  const truncated = total > end;
+  const bytes_returned = Buffer.byteLength(content, 'utf8');
+  return {
+    content,
+    truncated,
+    total_bytes: s.size,
+    bytes_returned,
+  };
+}
+
+interface RipgrepMatch {
+  type: string;
+  data?: {
+    path?: { text?: string };
+    line_number?: number;
+    lines?: { text?: string };
+  };
+}
+
+export async function grep(
+  projectRoot: string,
+  pattern: string,
+  opts?: { path?: string; max_matches?: number; case_sensitive?: boolean; hidden?: boolean }
+): Promise<GrepResult> {
+  const targetPath = opts?.path ?? projectRoot;
+  const target = await pathGuard(projectRoot, targetPath);
+  const limit = Math.min(
+    Math.max(opts?.max_matches ?? DEFAULT_GREP_RESULTS, 1),
+    MAX_GREP_RESULTS
+  );
+  const args = [
+    '--json',
+    '--max-count',
+    String(limit),
+    '--max-columns',
+    '300',
+  ];
+  if (!opts?.case_sensitive) args.push('--ignore-case');
+  if (opts?.hidden) args.push('--hidden');
+  args.push('--', pattern, target);
+
+  return new Promise((resolveP, rejectP) => {
+    const child = spawn('rg', args, { cwd: projectRoot });
+    const matches: GrepMatch[] = [];
+    let buf = '';
+    let stderr = '';
+    child.stdout.setEncoding('utf8');
+    child.stderr.setEncoding('utf8');
+    child.stdout.on('data', (chunk: string) => {
+      buf += chunk;
+      let idx;
+      while ((idx = buf.indexOf('\n')) >= 0) {
+        const line = buf.slice(0, idx);
+        buf = buf.slice(idx + 1);
+        if (!line) continue;
+        if (matches.length >= limit) continue;
+        try {
+          const parsed = JSON.parse(line) as RipgrepMatch;
+          if (parsed.type !== 'match' || !parsed.data) continue;
+          const filePath = parsed.data.path?.text ?? '';
+          const lineNumber = parsed.data.line_number ?? 0;
+          const content = parsed.data.lines?.text ?? '';
+          matches.push({
+            path: relative(projectRoot, filePath) || filePath,
+            line: lineNumber,
+            text: content.replace(/\n$/, ''),
+          });
+        } catch {
+          /* ignore non-json */
+        }
+      }
+      if (matches.length >= limit) {
+        child.kill();
+      }
+    });
+    child.stderr.on('data', (chunk: string) => {
+      stderr += chunk;
+    });
+    child.on('error', (err) => rejectP(err));
+    child.on('close', (code) => {
+      if (code === 2 && matches.length === 0) {
+        rejectP(new Error(`ripgrep failed: ${stderr.slice(0, 300)}`));
+        return;
+      }
+      resolveP({
+        matches,
+        truncated: matches.length >= limit,
+      });
+    });
+  });
+}
+
+export async function findFiles(
+  projectRoot: string,
+  pattern?: string,
+  opts?: { type?: 'file' | 'dir'; max_results?: number; path?: string }
+): Promise<FindFilesResult> {
+  const limit = Math.min(
+    Math.max(opts?.max_results ?? DEFAULT_FIND_RESULTS, 1),
+    MAX_FIND_RESULTS
+  );
+  const target = opts?.path != null
+    ? await pathGuard(projectRoot, opts.path)
+    : projectRoot;
+  const args = ['--files'];
+  if (pattern) args.push('--glob', pattern);
+  args.push(target);
+
+  return new Promise((resolveP, rejectP) => {
+    const child = spawn('rg', args, { cwd: projectRoot });
+    const files: string[] = [];
+    let total = 0;
+    let buf = '';
+    let stderr = '';
+    child.stdout.setEncoding('utf8');
+    child.stderr.setEncoding('utf8');
+    child.stdout.on('data', (chunk: string) => {
+      buf += chunk;
+      let idx;
+      while ((idx = buf.indexOf('\n')) >= 0) {
+        const line = buf.slice(0, idx);
+        buf = buf.slice(idx + 1);
+        if (!line) continue;
+        // Keep counting after limit to report accurate `total` to the caller.
+        // grep kills early since the LLM doesn't need a total; this differs intentionally.
+        total++;
+        if (files.length < limit) {
+          files.push(relative(projectRoot, line) || line);
+        }
+      }
+    });
+    child.stderr.on('data', (chunk: string) => {
+      stderr += chunk;
+    });
+    child.on('error', (err) => rejectP(err));
+    child.on('close', (code) => {
+      if (code === 2) {
+        rejectP(new Error(`ripgrep failed: ${stderr.slice(0, 300)}`));
+        return;
+      }
+      if (buf.length > 0) {
+        total++;
+        if (files.length < limit) {
+          files.push(relative(projectRoot, buf) || buf);
+        }
+      }
+      resolveP({
+        files,
+        total,
+        truncated: total > files.length,
+      });
+    });
+  });
+}

apps/server/src/services/gitea.ts

@@ -0,0 +1,50 @@
+export interface GiteaConfig {
+  baseUrl: string;
+  user: string;
+  token: string;
+}
+
+export interface GiteaRepo {
+  clone_url: string;
+  ssh_url: string;
+  html_url: string;
+}
+
+export class GiteaRepoExistsError extends Error {
+  constructor() {
+    super('gitea-repo-exists');
+  }
+}
+
+export async function createGiteaRepo(
+  cfg: GiteaConfig,
+  name: string,
+  options: { private: boolean }
+): Promise<GiteaRepo> {
+  const res = await fetch(`${cfg.baseUrl}/api/v1/user/repos`, {
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/json',
+      Authorization: `token ${cfg.token}`,
+    },
+    body: JSON.stringify({
+      name,
+      private: options.private,
+      auto_init: false,
+    }),
+  });
+  if (res.status === 409) throw new GiteaRepoExistsError();
+  if (!res.ok) {
+    const text = await res.text().catch(() => '');
+    throw new Error(`gitea-api-${res.status}: ${text.slice(0, 200)}`);
+  }
+  const body = (await res.json()) as { ssh_url?: string; clone_url?: string; html_url?: string };
+  if (!body.ssh_url || !body.html_url || !body.clone_url) {
+    throw new Error(`gitea-api-unexpected-shape: ${JSON.stringify(body).slice(0, 200)}`);
+  }
+  return {
+    ssh_url: body.ssh_url,
+    clone_url: body.clone_url,
+    html_url: body.html_url,
+  };
+}

apps/server/src/services/inference.ts

@@ -1,16 +1,16 @@
 import type { FastifyBaseLogger } from 'fastify';
 import type { Sql } from '../db.js';
 import type { Config } from '../config.js';
-import type { Message, Project, Session, ToolCall } from '../types/api.js';
+import type { Message, Project, Session, ToolCall, UserStreamFrame } from '../types/api.js';
 import { ALL_TOOLS, TOOLS_BY_NAME, toolJsonSchemas } from './tools.js';
 import { PathScopeError, resolveProjectRoot } from './path_guard.js';
-import { maybeAutoNameSession } from './auto_name.js';
+import { maybeAutoNameChat } from './auto_name.js';
 
 const BASE_SYSTEM_PROMPT = (projectPath: string) =>
   `You are BooCode Chat, a code investigation assistant. The user is working on a project located at ${projectPath}. Use the file-read tools (view_file, list_dir, grep, find_files) to investigate code when needed. Be concise. Cite file paths and line numbers when discussing code. Do not hallucinate file contents — read the file first. Tool results may be truncated; if so, narrow your query rather than guessing.`;
 
 const DB_FLUSH_INTERVAL_MS = 500;
-const MAX_TOOL_LOOP_DEPTH = 5;
+const MAX_TOOL_LOOP_DEPTH = 15;
 
 export interface InferenceFrame {
   type:
@@ -21,9 +21,11 @@ export interface InferenceFrame {
     | 'message_complete'
     | 'messages_deleted'
     | 'session_renamed'
+    | 'chat_renamed'
     | 'error';
   message_id?: string;
   message_ids?: string[];
+  chat_id?: string;
   tool_message_id?: string;
   tool_call_id?: string;
   role?: 'assistant' | 'tool' | 'user';
@@ -86,6 +88,7 @@ export interface InferenceContext {
   config: Config;
   log: FastifyBaseLogger;
   publish: FramePublisher;
+  publishUser: (frame: UserStreamFrame) => void;
 }
 
 export function buildMessagesPayload(
@@ -100,8 +103,23 @@ export function buildMessagesPayload(
   }
   out.push({ role: 'system', content: systemPrompt });
 
-  for (const m of history) {
+  // Find the latest compact marker — only send messages from that point onwards
+  let startIdx = 0;
+  for (let i = history.length - 1; i >= 0; i--) {
+    if (history[i]!.kind === 'compact') {
+      startIdx = i;
+      break;
+    }
+  }
+
+  for (let i = startIdx; i < history.length; i++) {
+    const m = history[i]!;
+    if (m.kind === 'compact') {
+      out.push({ role: 'system', content: m.content });
+      continue;
+    }
     if (m.role === 'assistant' && m.status === 'streaming') continue;
+    if (m.role === 'assistant' && m.status === 'cancelled') continue;
     if (m.role === 'tool') {
       const tr = m.tool_results;
       if (!tr) continue;
@@ -139,10 +157,11 @@ export function buildMessagesPayload(
 
 async function loadContext(
   sql: Sql,
-  sessionId: string
+  sessionId: string,
+  chatId: string
 ): Promise<{ session: Session; project: Project; history: Message[] } | null> {
   const sessionRows = await sql<Session[]>`
-    SELECT id, project_id, name, model, system_prompt, created_at, updated_at
+    SELECT id, project_id, name, model, system_prompt, status, created_at, updated_at
     FROM sessions WHERE id = ${sessionId}
   `;
   if (sessionRows.length === 0) return null;
@@ -156,10 +175,10 @@ async function loadContext(
   const project = projectRows[0]!;
 
   const history = await sql<Message[]>`
-    SELECT id, session_id, role, content, tool_calls, tool_results, status, last_seq,
+    SELECT id, session_id, chat_id, role, content, kind, tool_calls, tool_results, status, last_seq,
            tokens_used, ctx_used, ctx_max, started_at, finished_at, created_at
     FROM messages
-    WHERE session_id = ${sessionId}
+    WHERE chat_id = ${chatId}
     ORDER BY created_at ASC, id ASC
   `;
 
@@ -203,7 +222,8 @@ async function streamCompletion(
   model: string,
   messages: OpenAiMessage[],
   includeTools: boolean,
-  onDelta: (content: string) => void
+  onDelta: (content: string) => void,
+  signal?: AbortSignal
 ): Promise<StreamResult> {
   const body: Record<string, unknown> = {
     model,
@@ -220,6 +240,7 @@ async function streamCompletion(
     method: 'POST',
     headers: { 'Content-Type': 'application/json' },
     body: JSON.stringify(body),
+    signal,
   });
   if (!res.ok || !res.body) {
     const text = await res.text().catch(() => '');
@@ -327,36 +348,27 @@ async function executeToolCall(
   }
 }
 
-async function runAssistantTurn(
-  ctx: InferenceContext,
-  sessionId: string,
-  assistantMessageId: string,
-  depth: number
-): Promise<void> {
-  if (depth > MAX_TOOL_LOOP_DEPTH) {
-    await ctx.sql`
-      UPDATE messages
-      SET status = 'failed',
-          content = ${'tool loop depth exceeded'},
-          finished_at = clock_timestamp()
-      WHERE id = ${assistantMessageId}
-    `;
-    ctx.publish(sessionId, {
-      type: 'error',
-      message_id: assistantMessageId,
-      error: 'tool loop depth exceeded',
-    });
-    return;
-  }
+interface TurnArgs {
+  sessionId: string;
+  chatId: string;
+  assistantMessageId: string;
+  depth: number;
+  signal: AbortSignal | undefined;
+}
 
-  const loaded = await loadContext(ctx.sql, sessionId);
-  if (!loaded) {
-    ctx.log.warn({ sessionId }, 'inference: session or project missing');
-    return;
-  }
-  const { session, project, history } = loaded;
-  const projectRoot = await resolveProjectRoot(project.path);
-  const messages = buildMessagesPayload(session, project, history);
+interface StreamPhaseState {
+  accumulated: string;
+  startedAt: string | null;
+}
+
+async function executeStreamPhase(
+  ctx: InferenceContext,
+  args: TurnArgs,
+  session: Session,
+  messages: OpenAiMessage[],
+  state: StreamPhaseState
+): Promise<StreamResult> {
+  const { sessionId, chatId, assistantMessageId, signal } = args;
 
   const startedRow = await ctx.sql<{ started_at: string }[]>`
     UPDATE messages
@@ -364,15 +376,15 @@ async function runAssistantTurn(
     WHERE id = ${assistantMessageId}
     RETURNING started_at
   `;
-  const startedAt = startedRow[0]?.started_at ?? null;
+  state.startedAt = startedRow[0]?.started_at ?? null;
 
   ctx.publish(sessionId, {
     type: 'message_started',
     message_id: assistantMessageId,
+    chat_id: chatId,
     role: 'assistant',
   });
 
-  let accumulated = '';
   let pendingFlushTimer: NodeJS.Timeout | null = null;
   let flushPromise: Promise<unknown> = Promise.resolve();
 
@@ -381,7 +393,7 @@ async function runAssistantTurn(
       clearTimeout(pendingFlushTimer);
       pendingFlushTimer = null;
     }
-    const snapshot = accumulated;
+    const snapshot = state.accumulated;
     flushPromise = flushPromise.then(() =>
       ctx.sql`UPDATE messages SET content = ${snapshot} WHERE id = ${assistantMessageId}`
     );
@@ -395,128 +407,181 @@ async function runAssistantTurn(
     }, DB_FLUSH_INTERVAL_MS);
   };
 
-  let result: StreamResult;
   try {
-    result = await streamCompletion(
+    return await streamCompletion(
       ctx,
       session.model,
       messages,
       true,
       (delta) => {
-        accumulated += delta;
+        state.accumulated += delta;
         ctx.publish(sessionId, {
           type: 'delta',
           message_id: assistantMessageId,
+          chat_id: chatId,
           content: delta,
         });
         ctx.log.debug({ sessionId, delta }, 'inference delta');
         scheduleFlush();
-      }
+      },
+      signal
     );
-  } catch (err) {
+  } finally {
     if (pendingFlushTimer) {
       clearTimeout(pendingFlushTimer);
       pendingFlushTimer = null;
     }
-    const errMsg = err instanceof Error ? err.message : String(err);
-    await ctx.sql`
-      UPDATE messages
-      SET status = 'failed',
-          content = ${accumulated},
-          finished_at = clock_timestamp()
-      WHERE id = ${assistantMessageId}
-    `;
-    await ctx.sql`UPDATE sessions SET updated_at = clock_timestamp() WHERE id = ${sessionId}`;
-    ctx.publish(sessionId, {
-      type: 'error',
-      message_id: assistantMessageId,
-      error: errMsg,
-    });
-    ctx.log.error({ err, sessionId, assistantMessageId }, 'inference failed');
-    return;
+    await flushPromise;
   }
+}
 
-  if (pendingFlushTimer) {
-    clearTimeout(pendingFlushTimer);
-    pendingFlushTimer = null;
-  }
-  await flushPromise;
-
-  const { content, finishReason, toolCalls, promptTokens, completionTokens, nCtx } = result;
-
-  if (toolCalls.length > 0) {
-    const [updated] = await ctx.sql<
-      { tokens_used: number | null; ctx_used: number | null; ctx_max: number | null; finished_at: string | null }[]
-    >`
-      UPDATE messages
-      SET content = ${content},
-          status = 'complete',
-          tool_calls = ${ctx.sql.json(toolCalls as never)},
-          tokens_used = ${completionTokens},
-          ctx_used = ${promptTokens},
-          ctx_max = ${nCtx},
-          finished_at = clock_timestamp()
-      WHERE id = ${assistantMessageId}
-      RETURNING tokens_used, ctx_used, ctx_max, finished_at
-    `;
-    await ctx.sql`UPDATE sessions SET updated_at = clock_timestamp() WHERE id = ${sessionId}`;
-    for (const tc of toolCalls) {
-      ctx.publish(sessionId, {
-        type: 'tool_call',
-        message_id: assistantMessageId,
-        tool_call: tc,
-      });
-    }
+async function handleAbortOrError(
+  ctx: InferenceContext,
+  args: TurnArgs,
+  accumulated: string,
+  err: unknown
+): Promise<void> {
+  const { sessionId, chatId, assistantMessageId } = args;
+  const isAbort = err instanceof Error && err.name === 'AbortError';
+  const finalStatus = isAbort ? 'cancelled' : 'failed';
+  await ctx.sql`
+    UPDATE messages
+    SET status = ${finalStatus},
+        content = ${accumulated},
+        finished_at = clock_timestamp()
+    WHERE id = ${assistantMessageId}
+  `;
+  const [failSessRow] = await ctx.sql<{ project_id: string; name: string; updated_at: string }[]>`
+    UPDATE sessions SET updated_at = clock_timestamp()
+    WHERE id = ${sessionId}
+    RETURNING project_id, name, updated_at
+  `;
+  ctx.publishUser({ type: 'session_updated', session_id: sessionId, project_id: failSessRow!.project_id, name: failSessRow!.name, updated_at: failSessRow!.updated_at });
+  if (isAbort) {
     ctx.publish(sessionId, {
       type: 'message_complete',
       message_id: assistantMessageId,
-      tokens_used: updated?.tokens_used ?? null,
-      ctx_used: updated?.ctx_used ?? null,
-      ctx_max: updated?.ctx_max ?? null,
-      started_at: startedAt,
-      finished_at: updated?.finished_at ?? null,
-      model: session.model,
+      chat_id: chatId,
     });
-
-    await Promise.all(
-      toolCalls.map(async (tc) => {
-        const [toolRow] = await ctx.sql<{ id: string }[]>`
-          INSERT INTO messages (session_id, role, content, status, created_at)
-          VALUES (${sessionId}, 'tool', '', 'complete', clock_timestamp())
-          RETURNING id
-        `;
-        const toolMessageId = toolRow!.id;
-        const tres = await executeToolCall(projectRoot, tc);
-        const stored = {
-          tool_call_id: tc.id,
-          output: tres.output,
-          truncated: tres.truncated,
-          ...(tres.error ? { error: tres.error } : {}),
-        };
-        await ctx.sql`
-          UPDATE messages
-          SET tool_results = ${ctx.sql.json(stored as never)}
-          WHERE id = ${toolMessageId}
-        `;
-        ctx.publish(sessionId, {
-          type: 'tool_result',
-          tool_message_id: toolMessageId,
-          tool_call_id: tc.id,
-          output: tres.output,
-          truncated: tres.truncated,
-          ...(tres.error ? { error: tres.error } : {}),
-        });
-      })
-    );
-
-    const [nextAssistant] = await ctx.sql<{ id: string }[]>`
-      INSERT INTO messages (session_id, role, content, status, created_at)
-      VALUES (${sessionId}, 'assistant', '', 'streaming', clock_timestamp())
-      RETURNING id
-    `;
-    await runAssistantTurn(ctx, sessionId, nextAssistant!.id, depth + 1);
-    return;
+    ctx.log.info({ sessionId, chatId, assistantMessageId }, 'inference cancelled');
+  } else {
+    const errMsg = err instanceof Error ? err.message : String(err);
+    ctx.publish(sessionId, {
+      type: 'error',
+      message_id: assistantMessageId,
+      chat_id: chatId,
+      error: errMsg,
+    });
+    ctx.log.error({ err, sessionId, assistantMessageId }, 'inference failed');
   }
+}
+
+async function executeToolPhase(
+  ctx: InferenceContext,
+  args: TurnArgs,
+  result: StreamResult,
+  startedAt: string | null,
+  session: Session,
+  projectRoot: string
+): Promise<void> {
+  const { sessionId, chatId, assistantMessageId, depth, signal } = args;
+  const { content, toolCalls, promptTokens, completionTokens, nCtx } = result;
+
+  const [updated] = await ctx.sql<
+    { tokens_used: number | null; ctx_used: number | null; ctx_max: number | null; finished_at: string | null }[]
+  >`
+    UPDATE messages
+    SET content = ${content},
+        status = 'complete',
+        tool_calls = ${ctx.sql.json(toolCalls as never)},
+        tokens_used = ${completionTokens},
+        ctx_used = ${promptTokens},
+        ctx_max = ${nCtx},
+        finished_at = clock_timestamp()
+    WHERE id = ${assistantMessageId}
+    RETURNING tokens_used, ctx_used, ctx_max, finished_at
+  `;
+  const [toolSessRow] = await ctx.sql<{ project_id: string; name: string; updated_at: string }[]>`
+    UPDATE sessions SET updated_at = clock_timestamp()
+    WHERE id = ${sessionId}
+    RETURNING project_id, name, updated_at
+  `;
+  ctx.publishUser({ type: 'session_updated', session_id: sessionId, project_id: toolSessRow!.project_id, name: toolSessRow!.name, updated_at: toolSessRow!.updated_at });
+  for (const tc of toolCalls) {
+    ctx.publish(sessionId, {
+      type: 'tool_call',
+      message_id: assistantMessageId,
+      chat_id: chatId,
+      tool_call: tc,
+    });
+  }
+  ctx.publish(sessionId, {
+    type: 'message_complete',
+    message_id: assistantMessageId,
+    chat_id: chatId,
+    tokens_used: updated?.tokens_used ?? null,
+    ctx_used: updated?.ctx_used ?? null,
+    ctx_max: updated?.ctx_max ?? null,
+    started_at: startedAt,
+    finished_at: updated?.finished_at ?? null,
+    model: session.model,
+  });
+
+  await Promise.all(
+    toolCalls.map(async (tc) => {
+      const [toolRow] = await ctx.sql<{ id: string }[]>`
+        INSERT INTO messages (session_id, chat_id, role, content, status, created_at)
+        VALUES (${sessionId}, ${chatId}, 'tool', '', 'complete', clock_timestamp())
+        RETURNING id
+      `;
+      const toolMessageId = toolRow!.id;
+      const tres = await executeToolCall(projectRoot, tc);
+      const stored = {
+        tool_call_id: tc.id,
+        output: tres.output,
+        truncated: tres.truncated,
+        ...(tres.error ? { error: tres.error } : {}),
+      };
+      await ctx.sql`
+        UPDATE messages
+        SET tool_results = ${ctx.sql.json(stored as never)}
+        WHERE id = ${toolMessageId}
+      `;
+      ctx.publish(sessionId, {
+        type: 'tool_result',
+        tool_message_id: toolMessageId,
+        chat_id: chatId,
+        tool_call_id: tc.id,
+        output: tres.output,
+        truncated: tres.truncated,
+        ...(tres.error ? { error: tres.error } : {}),
+      });
+    })
+  );
+
+  const [nextAssistant] = await ctx.sql<{ id: string }[]>`
+    INSERT INTO messages (session_id, chat_id, role, content, status, created_at)
+    VALUES (${sessionId}, ${chatId}, 'assistant', '', 'streaming', clock_timestamp())
+    RETURNING id
+  `;
+  await runAssistantTurn(ctx, {
+    sessionId,
+    chatId,
+    assistantMessageId: nextAssistant!.id,
+    depth: depth + 1,
+    signal,
+  });
+}
+
+async function finalizeCompletion(
+  ctx: InferenceContext,
+  args: TurnArgs,
+  result: StreamResult,
+  startedAt: string | null,
+  session: Session
+): Promise<void> {
+  const { sessionId, chatId, assistantMessageId } = args;
+  const { content, finishReason, promptTokens, completionTokens, nCtx } = result;
 
   const [updated] = await ctx.sql<
     { tokens_used: number | null; ctx_used: number | null; ctx_max: number | null; finished_at: string | null }[]
@@ -531,10 +596,16 @@ async function runAssistantTurn(
     WHERE id = ${assistantMessageId}
     RETURNING tokens_used, ctx_used, ctx_max, finished_at
   `;
-  await ctx.sql`UPDATE sessions SET updated_at = clock_timestamp() WHERE id = ${sessionId}`;
+  const [completeSessRow] = await ctx.sql<{ project_id: string; name: string; updated_at: string }[]>`
+    UPDATE sessions SET updated_at = clock_timestamp()
+    WHERE id = ${sessionId}
+    RETURNING project_id, name, updated_at
+  `;
+  ctx.publishUser({ type: 'session_updated', session_id: sessionId, project_id: completeSessRow!.project_id, name: completeSessRow!.name, updated_at: completeSessRow!.updated_at });
   ctx.publish(sessionId, {
     type: 'message_complete',
     message_id: assistantMessageId,
+    chat_id: chatId,
     tokens_used: updated?.tokens_used ?? null,
     ctx_used: updated?.ctx_used ?? null,
     ctx_max: updated?.ctx_max ?? null,
@@ -545,6 +616,7 @@ async function runAssistantTurn(
   ctx.log.info(
     {
       sessionId,
+      chatId,
       assistantMessageId,
       finishReason,
       chars: content.length,
@@ -555,32 +627,209 @@ async function runAssistantTurn(
   );
 }
 
+async function runAssistantTurn(
+  ctx: InferenceContext,
+  args: TurnArgs,
+): Promise<void> {
+  const { sessionId, chatId, assistantMessageId, depth } = args;
+
+  if (depth > MAX_TOOL_LOOP_DEPTH) {
+    await ctx.sql`
+      UPDATE messages
+      SET status = 'failed',
+          content = ${'tool loop depth exceeded'},
+          finished_at = clock_timestamp()
+      WHERE id = ${assistantMessageId}
+    `;
+    ctx.publish(sessionId, {
+      type: 'error',
+      message_id: assistantMessageId,
+      chat_id: chatId,
+      error: 'tool loop depth exceeded',
+    });
+    return;
+  }
+
+  const loaded = await loadContext(ctx.sql, sessionId, chatId);
+  if (!loaded) {
+    ctx.log.warn({ sessionId }, 'inference: session or project missing');
+    return;
+  }
+  const { session, project, history } = loaded;
+  const projectRoot = await resolveProjectRoot(project.path);
+  const messages = buildMessagesPayload(session, project, history);
+
+  const state: StreamPhaseState = { accumulated: '', startedAt: null };
+  let result: StreamResult;
+  try {
+    result = await executeStreamPhase(ctx, args, session, messages, state);
+  } catch (err) {
+    await handleAbortOrError(ctx, args, state.accumulated, err);
+    return;
+  }
+
+  if (result.toolCalls.length > 0) {
+    await executeToolPhase(ctx, args, result, state.startedAt, session, projectRoot);
+    return;
+  }
+
+  await finalizeCompletion(ctx, args, result, state.startedAt, session);
+}
+
 export async function runInference(
   ctx: InferenceContext,
   sessionId: string,
-  assistantMessageId: string
+  chatId: string,
+  assistantMessageId: string,
+  signal?: AbortSignal
 ): Promise<void> {
-  return runAssistantTurn(ctx, sessionId, assistantMessageId, 0);
+  return runAssistantTurn(ctx, { sessionId, chatId, assistantMessageId, depth: 0, signal });
 }
 
-export function createInferenceRunner(ctx: InferenceContext) {
+const COMPACT_SYSTEM_PROMPT =
+  'Summarize the preceding conversation into a dense but complete context paragraph. Preserve all key facts, decisions, file paths, code patterns, and action items. Do not add any new information. Output only the summary paragraph.';
+
+async function runCompact(
+  ctx: InferenceContext,
+  sessionId: string,
+  chatId: string,
+  compactMessageId: string
+): Promise<void> {
+  const loaded = await loadContext(ctx.sql, sessionId, chatId);
+  if (!loaded) return;
+  const { session, project, history } = loaded;
+
+  const messagesForSummary = buildMessagesPayload(session, project,
+    history.filter((m) => m.id !== compactMessageId)
+  );
+  messagesForSummary.push({
+    role: 'system',
+    content: COMPACT_SYSTEM_PROMPT,
+  });
+
+  ctx.publish(sessionId, {
+    type: 'message_started',
+    message_id: compactMessageId,
+    chat_id: chatId,
+    role: 'assistant',
+  });
+
+  let content = '';
+  try {
+    const result = await streamCompletion(
+      ctx,
+      session.model,
+      messagesForSummary,
+      false,
+      (delta) => {
+        content += delta;
+        ctx.publish(sessionId, {
+          type: 'delta',
+          message_id: compactMessageId,
+          chat_id: chatId,
+          content: delta,
+        });
+      }
+    );
+    content = result.content;
+  } catch (err) {
+    const errMsg = err instanceof Error ? err.message : String(err);
+    await ctx.sql`
+      UPDATE messages SET status = 'failed', content = ${content}, finished_at = clock_timestamp()
+      WHERE id = ${compactMessageId}
+    `;
+    ctx.publish(sessionId, {
+      type: 'error',
+      message_id: compactMessageId,
+      chat_id: chatId,
+      error: errMsg,
+    });
+    return;
+  }
+
+  const preCompactCount = history.filter((m) => m.id !== compactMessageId && m.kind !== 'compact').length;
+  const summary = `[Context compacted — ${preCompactCount} messages summarized]\n\n${content}`;
+
+  await ctx.sql`
+    UPDATE messages SET content = ${summary}, status = 'complete', finished_at = clock_timestamp()
+    WHERE id = ${compactMessageId}
+  `;
+  ctx.publish(sessionId, {
+    type: 'message_complete',
+    message_id: compactMessageId,
+    chat_id: chatId,
+  });
+}
+
+interface InferenceRegistration {
+  controller: AbortController;
+  completed: Promise<void>;
+}
+
+export function createInferenceRunner(
+  ctx: Omit<InferenceContext, 'publishUser'>,
+  publishUserFn: (user: string, frame: UserStreamFrame) => void
+) {
+  const registry = new Map<string, InferenceRegistration>();
+
   return {
-    enqueue(sessionId: string, assistantMessageId: string) {
+    enqueue(sessionId: string, chatId: string, assistantMessageId: string, user: string) {
+      const callCtx: InferenceContext = {
+        ...ctx,
+        publishUser: (frame) => publishUserFn(user, frame),
+      };
+      const controller = new AbortController();
+      let resolveCompleted!: () => void;
+      const completed = new Promise<void>((res) => { resolveCompleted = res; });
+      const registration: InferenceRegistration = { controller, completed };
+      registry.set(chatId, registration);
       void (async () => {
         try {
-          await runInference(ctx, sessionId, assistantMessageId);
+          await runInference(callCtx, sessionId, chatId, assistantMessageId, controller.signal);
           setImmediate(() => {
-            void maybeAutoNameSession(ctx, sessionId).catch((err) => {
-              ctx.log.warn({ err, sessionId }, 'auto-name failed');
+            void maybeAutoNameChat(callCtx, chatId, sessionId).catch((err: Error) => {
+              callCtx.log.warn({ err, chatId }, 'auto-name failed');
             });
           });
         } catch (err) {
-          ctx.log.error({ err }, 'unhandled inference error');
+          callCtx.log.error({ err }, 'unhandled inference error');
+        } finally {
+          resolveCompleted();
+          // Only clear our own registration; a force-send may have replaced it.
+          if (registry.get(chatId) === registration) {
+            registry.delete(chatId);
+          }
         }
       })();
     },
+
+    enqueueCompact(sessionId: string, chatId: string, compactMessageId: string, user: string) {
+      const callCtx: InferenceContext = {
+        ...ctx,
+        publishUser: (frame) => publishUserFn(user, frame),
+      };
+      void (async () => {
+        try {
+          await runCompact(callCtx, sessionId, chatId, compactMessageId);
+        } catch (err) {
+          callCtx.log.error({ err }, 'unhandled compact error');
+        }
+      })();
+    },
+
+    async cancel(_sessionId: string, chatId: string): Promise<boolean> {
+      const reg = registry.get(chatId);
+      if (!reg) return false;
+      reg.controller.abort();
+      // Swallow — we just need to wait for the catch/finally to persist state.
+      await reg.completed.catch(() => {});
+      return true;
+    },
+
+    hasActive(chatId: string): boolean {
+      return registry.has(chatId);
+    },
   };
 }
 
-// Reference to keep ALL_TOOLS imported for type checks if needed
 export const _toolNames = ALL_TOOLS.map((t) => t.name);

apps/server/src/services/project_bootstrap.ts

@@ -0,0 +1,182 @@
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import { mkdir, writeFile, realpath } from 'node:fs/promises';
+import { existsSync } from 'node:fs';
+import { resolve, sep } from 'node:path';
+import type { FastifyBaseLogger } from 'fastify';
+import type { Config } from '../config.js';
+import { createGiteaRepo, GiteaRepoExistsError } from './gitea.js';
+
+const execFileAsync = promisify(execFile);
+
+const GITIGNORE_TEMPLATE = `# OS / editor
+.DS_Store
+*.swp
+*~
+
+# Node
+node_modules/
+dist/
+build/
+.env
+.env.local
+
+# Python
+__pycache__/
+*.pyc
+.venv/
+venv/
+
+# AI agents
+.claude/
+.opencode/
+
+# Backups
+*.bak*
+`;
+
+const GIT_USER_NAME = 'indifferentketchup';
+const GIT_USER_EMAIL = 'samkintop@gmail.com';
+
+export interface BootstrapResult {
+  folder_real_path: string;
+  folder_name: string;
+  gitea_remote_url: string | null;
+  folder_created: boolean;
+  git_initialized: boolean;
+  first_commit: boolean;
+  gitea_remote_created: boolean;
+  gitea_pushed: boolean;
+  warnings: string[];
+}
+
+const SAFE_NAME = /^[a-z0-9][a-z0-9-]{0,63}$/;
+
+export function sanitizeFolderName(raw: string): string {
+  return raw
+    .toLowerCase()
+    .trim()
+    .replace(/\s+/g, '-')
+    .replace(/[^a-z0-9-]/g, '')
+    .replace(/-+/g, '-')
+    .replace(/^-+|-+$/g, '')
+    .slice(0, 64);
+}
+
+export class BootstrapNameError extends Error {}
+export class BootstrapCollisionError extends Error {}
+export class BootstrapPathError extends Error {}
+
+export async function bootstrapProject(
+  config: Config,
+  log: FastifyBaseLogger,
+  options: {
+    name: string;
+    commitMessage: string;
+    visibility: 'private' | 'public';
+    createGiteaRemote: boolean;
+  }
+): Promise<BootstrapResult> {
+  const folder = sanitizeFolderName(options.name);
+  if (folder.length === 0 || !SAFE_NAME.test(folder)) {
+    throw new BootstrapNameError(`invalid name after sanitization: "${folder}"`);
+  }
+
+  // Bootstrap target resolution. Uses BOOTSTRAP_ROOT (writable), not
+  // PROJECT_ROOT_WHITELIST (which may be a wider read-only scope for
+  // add-existing flow).
+  const bootstrapReal = await realpath(config.BOOTSTRAP_ROOT);
+  const fullPath = resolve(bootstrapReal, folder);
+  if (!fullPath.startsWith(bootstrapReal + sep)) {
+    throw new BootstrapPathError('path escapes bootstrap root');
+  }
+  if (existsSync(fullPath)) {
+    throw new BootstrapCollisionError(`path already exists: ${fullPath}`);
+  }
+
+  const warnings: string[] = [];
+  let folder_created = false;
+  let git_initialized = false;
+  let first_commit = false;
+  let gitea_remote_created = false;
+  let gitea_pushed = false;
+  let gitea_remote_url: string | null = null;
+
+  // Step 1: mkdir
+  await mkdir(fullPath, { recursive: false });
+  folder_created = true;
+  log.info({ fullPath }, 'project_bootstrap: folder created');
+
+  // Step 2: write .gitignore
+  await writeFile(resolve(fullPath, '.gitignore'), GITIGNORE_TEMPLATE, 'utf8');
+
+  // Step 3: git init -b main
+  await execFileAsync('git', ['init', '-b', 'main'], { cwd: fullPath });
+  git_initialized = true;
+
+  // Step 4: git add + commit (per-command -c, no global config touch)
+  await execFileAsync('git', ['add', '.gitignore'], { cwd: fullPath });
+  await execFileAsync(
+    'git',
+    [
+      '-c', `user.name=${GIT_USER_NAME}`,
+      '-c', `user.email=${GIT_USER_EMAIL}`,
+      'commit',
+      '-m', options.commitMessage,
+    ],
+    { cwd: fullPath }
+  );
+  first_commit = true;
+  log.info({ folder }, 'project_bootstrap: initial commit');
+
+  // Step 5: optional Gitea remote
+  if (options.createGiteaRemote) {
+    if (!config.GITEA_TOKEN) {
+      warnings.push('Gitea remote skipped — token not configured');
+    } else {
+      try {
+        const repo = await createGiteaRepo(
+          { baseUrl: config.GITEA_BASE_URL, user: config.GITEA_USER, token: config.GITEA_TOKEN },
+          folder,
+          { private: options.visibility === 'private' }
+        );
+        gitea_remote_created = true;
+        gitea_remote_url = repo.html_url;
+        log.info({ folder, html_url: repo.html_url }, 'project_bootstrap: gitea repo created');
+
+        // Step 6: git remote add + push
+        try {
+          const sshUrl = repo.ssh_url.replace('git.indifferentketchup.com', '100.114.205.53');
+          await execFileAsync('git', ['remote', 'add', 'origin', sshUrl], { cwd: fullPath });
+          await execFileAsync('git', ['push', '-u', 'origin', 'main'], { cwd: fullPath });
+          gitea_pushed = true;
+          log.info({ folder }, 'project_bootstrap: pushed to gitea');
+        } catch (pushErr) {
+          const msg = pushErr instanceof Error ? pushErr.message : String(pushErr);
+          warnings.push(`Push to Gitea failed: ${msg.slice(0, 200)}`);
+          log.warn({ err: pushErr, folder }, 'project_bootstrap: push failed');
+        }
+      } catch (err) {
+        if (err instanceof GiteaRepoExistsError) {
+          warnings.push('Gitea repo already exists with this name; local repo created without remote');
+        } else {
+          const msg = err instanceof Error ? err.message : String(err);
+          warnings.push(`Gitea remote creation failed: ${msg.slice(0, 200)}`);
+        }
+        log.warn({ err, folder }, 'project_bootstrap: gitea remote step failed');
+      }
+    }
+  }
+
+  return {
+    folder_real_path: fullPath,
+    folder_name: folder,
+    gitea_remote_url,
+    folder_created,
+    git_initialized,
+    first_commit,
+    gitea_remote_created,
+    gitea_pushed,
+    warnings,
+  };
+}

apps/server/src/services/tools.ts

@@ -1,8 +1,8 @@
 import { readFile, readdir, stat } from 'node:fs/promises';
 import { resolve, basename, relative } from 'node:path';
-import { spawn } from 'node:child_process';
 import { z } from 'zod';
 import { pathGuard, PathScopeError } from './path_guard.js';
+import { grep as fileOpsGrep, findFiles as fileOpsFindFiles } from './file_ops.js';
 
 const MAX_FILE_BYTES = 5 * 1024 * 1024;
 const DEFAULT_VIEW_LINES = 200;
@@ -168,15 +168,6 @@ const GrepInput = z.object({
 });
 type GrepInputT = z.infer<typeof GrepInput>;
 
-interface RipgrepMatch {
-  type: string;
-  data?: {
-    path?: { text?: string };
-    line_number?: number;
-    lines?: { text?: string };
-  };
-}
-
 export const grep: ToolDef<GrepInputT> = {
   name: 'grep',
   description:
@@ -203,73 +194,27 @@ export const grep: ToolDef<GrepInputT> = {
     },
   },
   async execute(input, projectRoot) {
-    const target = await pathGuard(projectRoot, input.path ?? projectRoot);
     const limit = Math.min(
       Math.max(input.max_results ?? DEFAULT_GREP_RESULTS, 1),
       MAX_GREP_RESULTS
     );
-    const args = [
-      '--json',
-      '--max-count',
-      String(limit),
-      '--max-columns',
-      '300',
-    ];
-    if (!input.case_sensitive) args.push('--ignore-case');
-    if (input.hidden) args.push('--hidden');
-    args.push('--', input.pattern, target);
-
-    return await new Promise((resolveP, rejectP) => {
-      const child = spawn('rg', args, { cwd: projectRoot });
-      const matches: Array<{ path: string; line: number; content: string }> = [];
-      let buf = '';
-      let stderr = '';
-      child.stdout.setEncoding('utf8');
-      child.stderr.setEncoding('utf8');
-      child.stdout.on('data', (chunk: string) => {
-        buf += chunk;
-        let idx;
-        while ((idx = buf.indexOf('\n')) >= 0) {
-          const line = buf.slice(0, idx);
-          buf = buf.slice(idx + 1);
-          if (!line) continue;
-          if (matches.length >= limit) continue;
-          try {
-            const parsed = JSON.parse(line) as RipgrepMatch;
-            if (parsed.type !== 'match' || !parsed.data) continue;
-            const path = parsed.data.path?.text ?? '';
-            const lineNumber = parsed.data.line_number ?? 0;
-            const content = parsed.data.lines?.text ?? '';
-            matches.push({
-              path: relative(projectRoot, path) || path,
-              line: lineNumber,
-              content: content.replace(/\n$/, ''),
-            });
-          } catch {
-            /* ignore non-json */
-          }
-        }
-        if (matches.length >= limit) {
-          child.kill();
-        }
-      });
-      child.stderr.on('data', (chunk: string) => {
-        stderr += chunk;
-      });
-      child.on('error', (err) => rejectP(err));
-      child.on('close', (code) => {
-        // rg exits 1 when no matches, 2 on real error
-        if (code === 2 && matches.length === 0) {
-          rejectP(new Error(`ripgrep failed: ${stderr.slice(0, 300)}`));
-          return;
-        }
-        resolveP({
-          matches,
-          total: matches.length,
-          truncated: matches.length >= limit,
-        });
-      });
+    // Delegate to file_ops.grep; reshape match objects to preserve LLM output format
+    // (file_ops uses {path, line, text}; tool output uses {path, line, content})
+    const result = await fileOpsGrep(projectRoot, input.pattern, {
+      path: input.path,
+      max_matches: limit,
+      case_sensitive: input.case_sensitive,
+      hidden: input.hidden,
     });
+    return {
+      matches: result.matches.map((m) => ({
+        path: m.path,
+        line: m.line,
+        content: m.text,
+      })),
+      total: result.matches.length,
+      truncated: result.truncated,
+    };
   },
 };
 
@@ -303,55 +248,21 @@ export const findFiles: ToolDef<FindFilesInputT> = {
     },
   },
   async execute(input, projectRoot) {
-    const target = await pathGuard(projectRoot, input.path ?? projectRoot);
     const limit = Math.min(
       Math.max(input.max_results ?? DEFAULT_FIND_RESULTS, 1),
       MAX_FIND_RESULTS
     );
-    return await new Promise((resolveP, rejectP) => {
-      const args = ['--files', '--glob', input.pattern, target];
-      const child = spawn('rg', args, { cwd: projectRoot });
-      const paths: string[] = [];
-      let total = 0;
-      let buf = '';
-      let stderr = '';
-      child.stdout.setEncoding('utf8');
-      child.stderr.setEncoding('utf8');
-      child.stdout.on('data', (chunk: string) => {
-        buf += chunk;
-        let idx;
-        while ((idx = buf.indexOf('\n')) >= 0) {
-          const line = buf.slice(0, idx);
-          buf = buf.slice(idx + 1);
-          if (!line) continue;
-          total++;
-          if (paths.length < limit) {
-            paths.push(relative(projectRoot, line) || line);
-          }
-        }
-      });
-      child.stderr.on('data', (chunk: string) => {
-        stderr += chunk;
-      });
-      child.on('error', (err) => rejectP(err));
-      child.on('close', (code) => {
-        if (code === 2) {
-          rejectP(new Error(`ripgrep failed: ${stderr.slice(0, 300)}`));
-          return;
-        }
-        if (buf.length > 0) {
-          total++;
-          if (paths.length < limit) {
-            paths.push(relative(projectRoot, buf) || buf);
-          }
-        }
-        resolveP({
-          paths,
-          total,
-          truncated: total > paths.length,
-        });
-      });
+    // Delegate to file_ops.findFiles; reshape { files, total, truncated } to
+    // preserve the LLM-visible output format { paths, total, truncated }
+    const result = await fileOpsFindFiles(projectRoot, input.pattern, {
+      path: input.path,
+      max_results: limit,
     });
+    return {
+      paths: result.files,
+      total: result.total,
+      truncated: result.truncated,
+    };
   },
 };
 

apps/server/src/types/api.ts

@@ -1,9 +1,15 @@
+// KEEP IN SYNC: apps/server/src/schema.sql projects_status_chk
+export const PROJECT_STATUSES = ['open', 'archived'] as const;
+export type ProjectStatus = typeof PROJECT_STATUSES[number];
+
 export interface Project {
   id: string;
   name: string;
   path: string;
   added_at: string;
   last_session_id: string | null;
+  status: ProjectStatus;
+  gitea_remote: string | null;
 }
 
 export interface AvailableProject {
@@ -11,18 +17,45 @@ export interface AvailableProject {
   name: string;
 }
 
+export type SessionStatus = 'open' | 'archived';
+
 export interface Session {
   id: string;
   project_id: string;
   name: string;
   model: string;
   system_prompt: string;
+  status: SessionStatus;
   created_at: string;
   updated_at: string;
 }
 
-export type MessageRole = 'user' | 'assistant' | 'tool';
-export type MessageStatus = 'streaming' | 'complete' | 'failed';
+// KEEP IN SYNC: apps/server/src/schema.sql chats_status_chk
+export const CHAT_STATUSES = ['open', 'archived'] as const;
+export type ChatStatus = typeof CHAT_STATUSES[number];
+
+export interface Chat {
+  id: string;
+  session_id: string;
+  name: string | null;
+  status: ChatStatus;
+  created_at: string;
+  updated_at: string;
+  // Populated by GET /api/sessions/:id/chats only.
+  message_count?: number;
+  last_message_preview?: string | null;
+  effective_context_tokens?: number | null;
+}
+
+// KEEP IN SYNC: apps/server/src/schema.sql messages_role_chk / messages_status_chk
+export const MESSAGE_ROLES = ['user', 'assistant', 'system', 'tool'] as const;
+export type MessageRole = typeof MESSAGE_ROLES[number];
+
+export const MESSAGE_STATUSES = ['streaming', 'complete', 'failed', 'cancelled'] as const;
+export type MessageStatus = typeof MESSAGE_STATUSES[number];
+
+export const MESSAGE_KINDS = ['message', 'compact'] as const;
+export type MessageKind = typeof MESSAGE_KINDS[number];
 
 export interface ToolCall {
   id: string;
@@ -40,8 +73,10 @@ export interface ToolResult {
 export interface Message {
   id: string;
   session_id: string;
+  chat_id: string;
   role: MessageRole;
   content: string;
+  kind: MessageKind;
   tool_calls: ToolCall[] | null;
   tool_results: ToolResult | null;
   status: MessageStatus;
@@ -61,6 +96,7 @@ export interface ModelInfo {
 
 export interface SidebarSession {
   id: string;
+  project_id: string;
   name: string;
   model: string;
   updated_at: string;
@@ -69,6 +105,8 @@ export interface SidebarSession {
 export interface SidebarProject {
   id: string;
   name: string;
+  path: string;
+  gitea_remote: string | null;
   recent_sessions: SidebarSession[];
   total_sessions: number;
 }
@@ -76,3 +114,130 @@ export interface SidebarProject {
 export interface SidebarResponse {
   projects: SidebarProject[];
 }
+
+export type PaneKind = 'chat' | 'file_browser';
+
+export interface FileBrowserPaneState {
+  open_file?: string | null;
+  filter?: string;
+  expanded_dirs?: string[];
+}
+
+// chat panes have no state for now
+export type ChatPaneState = Record<string, never>;
+
+export type PaneState = ChatPaneState | FileBrowserPaneState;
+
+interface PaneBase {
+  id: string;
+  session_id: string;
+  position: number;
+  created_at: string;
+}
+
+export type Pane = PaneBase & (
+  | { kind: 'chat'; state: ChatPaneState }
+  | { kind: 'file_browser'; state: FileBrowserPaneState }
+);
+
+export interface PaneCreateRequest {
+  kind: PaneKind;
+  position?: number;  // optional; if omitted, append at end
+}
+
+export interface PaneUpdateRequest {
+  state?: PaneState;
+  position?: number;
+}
+
+// User-stream frames (broadcast on /ws/user channel)
+export interface ProjectCreatedFrame {
+  type: 'project_created';
+  project: Project;
+}
+export interface ProjectDeletedFrame {
+  type: 'project_deleted';
+  project_id: string;
+}
+export interface SessionCreatedFrame {
+  type: 'session_created';
+  session: Session;
+  project_id: string;
+}
+export interface SessionDeletedFrame {
+  type: 'session_deleted';
+  session_id: string;
+  project_id: string;
+}
+export interface SessionUpdatedFrame {
+  type: 'session_updated';
+  session_id: string;
+  project_id: string;
+  name: string;
+  updated_at: string;
+}
+export interface SessionRenamedFrame {
+  type: 'session_renamed';
+  session_id: string;
+  name: string;
+}
+export interface SessionArchivedFrame {
+  type: 'session_archived';
+  session_id: string;
+  project_id: string;
+}
+export interface ChatCreatedFrame {
+  type: 'chat_created';
+  chat: Chat;
+  session_id: string;
+}
+export interface ChatUpdatedFrame {
+  type: 'chat_updated';
+  chat_id: string;
+  session_id: string;
+  name: string | null;
+  updated_at: string;
+}
+export interface ChatArchivedFrame {
+  type: 'chat_archived';
+  chat_id: string;
+  session_id: string;
+}
+export interface ChatUnarchivedFrame {
+  type: 'chat_unarchived';
+  chat: Chat;
+}
+export interface ChatDeletedFrame {
+  type: 'chat_deleted';
+  chat_id: string;
+  session_id: string;
+}
+export interface ProjectArchivedFrame {
+  type: 'project_archived';
+  project_id: string;
+}
+export interface ProjectUnarchivedFrame {
+  type: 'project_unarchived';
+  project: Project;
+}
+export interface ProjectUpdatedFrame {
+  type: 'project_updated';
+  project_id: string;
+  name: string;
+}
+export type UserStreamFrame =
+  | ProjectCreatedFrame
+  | ProjectDeletedFrame
+  | SessionCreatedFrame
+  | SessionDeletedFrame
+  | SessionUpdatedFrame
+  | SessionRenamedFrame
+  | SessionArchivedFrame
+  | ChatCreatedFrame
+  | ChatUpdatedFrame
+  | ChatArchivedFrame
+  | ChatUnarchivedFrame
+  | ChatDeletedFrame
+  | ProjectArchivedFrame
+  | ProjectUnarchivedFrame
+  | ProjectUpdatedFrame;

apps/server/tsconfig.json

@@ -10,5 +10,6 @@
     "declaration": false,
     "sourceMap": true
   },
-  "include": ["src/**/*"]
+  "include": ["src/**/*"],
+  "exclude": ["src/**/__tests__/**", "**/*.test.ts"]
 }

apps/server/vitest.config.ts

@@ -0,0 +1,9 @@
+import { defineConfig } from 'vitest/config';
+
+export default defineConfig({
+  test: {
+    environment: 'node',
+    globals: false,
+    include: ['src/**/__tests__/**/*.test.ts'],
+  },
+});

apps/web/package.json

@@ -23,6 +23,7 @@
     "react-router-dom": "^6.26.0",
     "remark-gfm": "^4.0.1",
     "shadcn": "^4.7.0",
+    "shiki": "^1.29.2",
     "sonner": "^2.0.7",
     "tailwind-merge": "^3.6.0",
     "tw-animate-css": "^1.4.0"

apps/web/src/App.tsx

@@ -1,24 +1,95 @@
-import { BrowserRouter, Routes, Route } from 'react-router-dom';
+import { useEffect, useState } from 'react';
+import { BrowserRouter, Routes, Route, useParams } from 'react-router-dom';
+import { api } from '@/api/client';
 import { ProjectSidebar } from '@/components/ProjectSidebar';
+import { RightRail } from '@/components/RightRail';
 import { Home } from '@/pages/Home';
 import { Project } from '@/pages/Project';
 import { Session } from '@/pages/Session';
 import { Toaster } from '@/components/ui/sonner';
+import { useUserEvents } from '@/hooks/useUserEvents';
+import { SidebarDrawerProvider, useSidebarDrawer } from '@/hooks/useSidebarDrawer';
+import { RightRailDrawerProvider, useRightRailDrawer } from '@/hooks/useRightRailDrawer';
+import { useViewport } from '@/hooks/useViewport';
+
+function SessionRightRail() {
+  const { id } = useParams<{ id: string }>();
+  if (!id) return null;
+  return <RightRailForSession sessionId={id} />;
+}
+
+function RightRailForSession({ sessionId }: { sessionId: string }) {
+  const [projectId, setProjectId] = useState<string | null>(null);
+  useEffect(() => {
+    api.sessions
+      .get(sessionId)
+      .then((s) => setProjectId(s.project_id))
+      .catch((err) => console.warn('RightRail: failed to fetch session', err));
+  }, [sessionId]);
+  if (!projectId) return null;
+  // v1.6.2: rendered on all viewports. On mobile, RightRail itself renders as
+  // a right-side drawer toggled by the header's FolderTree button (via
+  // useRightRailDrawer). On desktop, it renders inline as before with its
+  // own internal open/close state.
+  return <RightRail projectId={projectId} />;
+}
+
+function MobileBackdrop() {
+  const { open, setOpen } = useSidebarDrawer();
+  const { isMobile } = useViewport();
+  if (!isMobile || !open) return null;
+  return (
+    <div
+      className="fixed inset-0 z-30 bg-black/40 md:hidden"
+      onClick={() => setOpen(false)}
+      aria-hidden="true"
+    />
+  );
+}
+
+function MobileRightRailBackdrop() {
+  const { open, setOpen } = useRightRailDrawer();
+  const { isMobile } = useViewport();
+  if (!isMobile || !open) return null;
+  return (
+    <div
+      className="fixed inset-0 z-30 bg-black/40 md:hidden"
+      onClick={() => setOpen(false)}
+      aria-hidden="true"
+    />
+  );
+}
+
+function AppShell() {
+  useUserEvents();
+  return (
+    <div className="dark h-screen flex bg-background text-foreground">
+      <ProjectSidebar />
+      <MobileBackdrop />
+      <main className="flex-1 flex flex-col min-w-0">
+        <Routes>
+          <Route path="/" element={<Home />} />
+          <Route path="/project/:id" element={<Project />} />
+          <Route path="/session/:id" element={<Session />} />
+        </Routes>
+      </main>
+      <MobileRightRailBackdrop />
+      <Routes>
+        <Route path="/session/:id" element={<SessionRightRail />} />
+      </Routes>
+      <Toaster position="bottom-right" />
+    </div>
+  );
+}
 
 export default function App() {
   return (
     <BrowserRouter>
-      <div className="dark h-screen flex bg-background text-foreground">
-        <ProjectSidebar />
-        <main className="flex-1 flex flex-col min-w-0">
-          <Routes>
-            <Route path="/" element={<Home />} />
-            <Route path="/project/:id" element={<Project />} />
-            <Route path="/session/:id" element={<Session />} />
-          </Routes>
-        </main>
-        <Toaster position="bottom-right" />
-      </div>
+      <SidebarDrawerProvider>
+        <RightRailDrawerProvider>
+          <AppShell />
+        </RightRailDrawerProvider>
+      </SidebarDrawerProvider>
     </BrowserRouter>
   );
 }

apps/web/src/api/client.ts

@@ -2,9 +2,12 @@ import type {
   Project,
   AvailableProject,
   Session,
+  Chat,
   Message,
   ModelInfo,
   SidebarResponse,
+  ListDirResult,
+  ViewFileResult,
 } from './types';
 
 export class ApiError extends Error {
@@ -38,20 +41,56 @@ export const api = {
   health: () => request<{ status: string; db: boolean }>('/api/health'),
 
   projects: {
-    list: () => request<Project[]>('/api/projects'),
+    list: (params?: { status?: 'open' | 'archived' }) =>
+      request<Project[]>(`/api/projects${params?.status ? `?status=${params.status}` : ''}`),
     available: () => request<AvailableProject[]>('/api/projects/available'),
     add: (body: { path: string; name?: string }) =>
       request<Project>('/api/projects', {
         method: 'POST',
         body: JSON.stringify(body),
       }),
+    update: (id: string, body: { name: string }) =>
+      request<Project>(`/api/projects/${id}`, {
+        method: 'PATCH',
+        body: JSON.stringify(body),
+      }),
+    archive: (id: string) =>
+      request<void>(`/api/projects/${id}/archive`, { method: 'POST' }),
+    unarchive: (id: string) =>
+      request<Project>(`/api/projects/${id}/unarchive`, { method: 'POST' }),
+    create: (body: {
+      name: string;
+      commit_message?: string;
+      visibility?: 'private' | 'public';
+      create_gitea_remote?: boolean;
+    }) =>
+      request<{
+        project: Project;
+        bootstrap: {
+          folder_created: boolean;
+          git_initialized: boolean;
+          first_commit: boolean;
+          gitea_remote_created: boolean;
+          gitea_pushed: boolean;
+          warnings: string[];
+        };
+      }>(`/api/projects/create`, {
+        method: 'POST',
+        body: JSON.stringify(body),
+      }),
     remove: (id: string) =>
       request<void>(`/api/projects/${id}`, { method: 'DELETE' }),
+    listDir: (id: string, path: string) =>
+      request<ListDirResult>(`/api/projects/${id}/list_dir?path=${encodeURIComponent(path)}`),
+    viewFile: (id: string, path: string) =>
+      request<ViewFileResult>(`/api/projects/${id}/view_file?path=${encodeURIComponent(path)}`),
+    files: (id: string) =>
+      request<{ files: string[] }>(`/api/projects/${id}/files`),
   },
 
   sessions: {
-    listForProject: (projectId: string) =>
-      request<Session[]>(`/api/projects/${projectId}/sessions`),
+    listForProject: (projectId: string, status?: 'open' | 'archived') =>
+      request<Session[]>(`/api/projects/${projectId}/sessions${status ? `?status=${status}` : ''}`),
     create: (
       projectId: string,
       body: { name?: string; model?: string; system_prompt?: string }
@@ -71,24 +110,71 @@ export const api = {
       }),
     remove: (id: string) =>
       request<void>(`/api/sessions/${id}`, { method: 'DELETE' }),
+    archive: (id: string) =>
+      request<void>(`/api/sessions/${id}/archive`, { method: 'POST' }),
+    unarchive: (id: string) =>
+      request<Session>(`/api/sessions/${id}/unarchive`, { method: 'POST' }),
+  },
+
+  chats: {
+    listForSession: (sessionId: string, params?: { status?: 'open' | 'archived' }) =>
+      request<Chat[]>(
+        `/api/sessions/${sessionId}/chats${params?.status ? `?status=${params.status}` : ''}`
+      ),
+    create: (sessionId: string, body?: { name?: string }) =>
+      request<Chat>(`/api/sessions/${sessionId}/chats`, {
+        method: 'POST',
+        body: JSON.stringify(body ?? {}),
+      }),
+    update: (chatId: string, body: { name: string }) =>
+      request<Chat>(`/api/chats/${chatId}`, {
+        method: 'PATCH',
+        body: JSON.stringify(body),
+      }),
+    archive: (chatId: string) =>
+      request<void>(`/api/chats/${chatId}/archive`, { method: 'POST' }),
+    unarchive: (chatId: string) =>
+      request<Chat>(`/api/chats/${chatId}/unarchive`, { method: 'POST' }),
+    remove: (chatId: string) =>
+      request<void>(`/api/chats/${chatId}`, { method: 'DELETE' }),
+    messages: (chatId: string) =>
+      request<Message[]>(`/api/chats/${chatId}/messages`),
+    compact: (chatId: string) =>
+      request<{ compact_message_id: string }>(`/api/chats/${chatId}/compact`, { method: 'POST' }),
+    stop: (chatId: string) =>
+      request<{ stopped: boolean }>(`/api/chats/${chatId}/stop`, { method: 'POST' }),
+    forceSend: (chatId: string, content: string) =>
+      request<{ user_message_id: string; assistant_message_id: string }>(
+        `/api/chats/${chatId}/force_send`,
+        { method: 'POST', body: JSON.stringify({ content }) }
+      ),
+    fork: (chatId: string, body: { messageId: string; name?: string }) =>
+      request<Chat>(`/api/chats/${chatId}/fork`, {
+        method: 'POST',
+        body: JSON.stringify({ message_id: body.messageId, name: body.name }),
+      }),
   },
 
   messages: {
     list: (sessionId: string) =>
       request<Message[]>(`/api/sessions/${sessionId}/messages`),
-    send: (sessionId: string, content: string) =>
+    send: (chatId: string, content: string) =>
       request<{ user_message_id: string; assistant_message_id: string }>(
-        `/api/sessions/${sessionId}/messages`,
+        `/api/chats/${chatId}/messages`,
         {
           method: 'POST',
           body: JSON.stringify({ content }),
         }
       ),
-    regenerate: (sessionId: string, messageId: string) =>
+    regenerate: (chatId: string, messageId: string) =>
       request<{ assistant_message_id: string }>(
-        `/api/sessions/${sessionId}/messages/${messageId}/regenerate`,
+        `/api/chats/${chatId}/messages/${messageId}/regenerate`,
         { method: 'POST' }
       ),
+    remove: (chatId: string, messageId: string) =>
+      request<void>(`/api/chats/${chatId}/messages/${messageId}`, {
+        method: 'DELETE',
+      }),
   },
 
   models: () => request<ModelInfo[]>('/api/models'),

apps/web/src/api/types.ts

@@ -1,9 +1,14 @@
+export const PROJECT_STATUSES = ['open', 'archived'] as const;
+export type ProjectStatus = typeof PROJECT_STATUSES[number];
+
 export interface Project {
   id: string;
   name: string;
   path: string;
   added_at: string;
   last_session_id: string | null;
+  status: ProjectStatus;
+  gitea_remote: string | null;
 }
 
 export interface AvailableProject {
@@ -11,18 +16,38 @@ export interface AvailableProject {
   name: string;
 }
 
+export type SessionStatus = 'open' | 'archived';
+
 export interface Session {
   id: string;
   project_id: string;
   name: string;
   model: string;
   system_prompt: string;
+  status: SessionStatus;
   created_at: string;
   updated_at: string;
 }
 
-export type MessageRole = 'user' | 'assistant' | 'tool';
-export type MessageStatus = 'streaming' | 'complete' | 'failed';
+export const CHAT_STATUSES = ['open', 'archived'] as const;
+export type ChatStatus = typeof CHAT_STATUSES[number];
+
+export interface Chat {
+  id: string;
+  session_id: string;
+  name: string | null;
+  status: ChatStatus;
+  created_at: string;
+  updated_at: string;
+  // Populated by GET /api/sessions/:id/chats only.
+  message_count?: number;
+  last_message_preview?: string | null;
+  effective_context_tokens?: number | null;
+}
+
+export type MessageRole = 'user' | 'assistant' | 'tool' | 'system';
+export type MessageStatus = 'streaming' | 'complete' | 'failed' | 'cancelled';
+export type MessageKind = 'message' | 'compact';
 
 export interface ToolCall {
   id: string;
@@ -40,8 +65,10 @@ export interface ToolResult {
 export interface Message {
   id: string;
   session_id: string;
+  chat_id: string;
   role: MessageRole;
   content: string;
+  kind: MessageKind;
   tool_calls: ToolCall[] | null;
   tool_results: ToolResult | null;
   status: MessageStatus;
@@ -64,11 +91,14 @@ export interface SidebarSession {
   name: string;
   model: string;
   updated_at: string;
+  project_id: string;
 }
 
 export interface SidebarProject {
   id: string;
   name: string;
+  path: string;
+  gitea_remote: string | null;
   recent_sessions: SidebarSession[];
   total_sessions: number;
 }
@@ -77,14 +107,74 @@ export interface SidebarResponse {
   projects: SidebarProject[];
 }
 
+export interface FileEntry {
+  name: string;
+  kind: 'file' | 'dir';
+  size?: number;
+}
+
+export interface ListDirResult {
+  entries: FileEntry[];
+  truncated: boolean;
+  total: number;
+}
+
+export interface ViewFileResult {
+  content: string;
+  truncated: boolean;
+  total_bytes: number;
+  bytes_returned: number;
+}
+
+export type PaneKind = 'chat' | 'file_browser';
+
+export interface FileBrowserPaneState {
+  open_file?: string | null;
+  filter?: string;
+  expanded_dirs?: string[];
+}
+export type ChatPaneState = Record<string, never>;
+export type PaneState = ChatPaneState | FileBrowserPaneState;
+
+interface PaneBase {
+  id: string;
+  session_id: string;
+  position: number;
+  created_at: string;
+}
+export type Pane = PaneBase & (
+  | { kind: 'chat'; state: ChatPaneState }
+  | { kind: 'file_browser'; state: FileBrowserPaneState }
+);
+
+export interface PaneCreateRequest {
+  kind: PaneKind;
+  position?: number;
+}
+export interface PaneUpdateRequest {
+  state?: PaneState;
+  position?: number;
+}
+
+export type WorkspacePaneKind = 'chat' | 'terminal' | 'agent' | 'empty';
+
+export interface WorkspacePane {
+  id: string;
+  kind: WorkspacePaneKind;
+  chatId?: string;
+  chatIds: string[];
+  activeChatIdx: number;
+}
+
 export type WsFrame =
   | { type: 'snapshot'; messages: Message[] }
-  | { type: 'message_started'; message_id: string; role: MessageRole }
-  | { type: 'delta'; message_id: string; content: string }
-  | { type: 'tool_call'; message_id: string; tool_call: ToolCall }
+  | { type: 'message_started'; message_id: string; chat_id?: string; role: MessageRole }
+  | { type: 'delta'; message_id: string; chat_id?: string; content: string }
+  | { type: 'tool_call'; message_id: string; chat_id?: string; tool_call: ToolCall }
   | {
       type: 'tool_result';
       tool_message_id: string;
+      chat_id?: string;
       tool_call_id: string;
       output: unknown;
       truncated: boolean;
@@ -93,12 +183,13 @@ export type WsFrame =
   | {
       type: 'message_complete';
       message_id: string;
+      chat_id?: string;
       tokens_used?: number | null;
       ctx_used?: number | null;
       ctx_max?: number | null;
       started_at?: string | null;
       finished_at?: string | null;
     }
-  | { type: 'messages_deleted'; message_ids: string[] }
-  | { type: 'session_renamed'; session_id: string; name: string }
-  | { type: 'error'; message_id?: string; error: string };
+  | { type: 'messages_deleted'; message_ids: string[]; chat_id?: string }
+  | { type: 'chat_renamed'; chat_id: string; name: string }
+  | { type: 'error'; message_id?: string; chat_id?: string; error: string };

apps/web/src/components/AddProjectModal.tsx

@@ -1,7 +1,6 @@
 import { useEffect, useState } from 'react';
 import { api } from '@/api/client';
 import type { AvailableProject } from '@/api/types';
-import { sessionEvents } from '@/hooks/sessionEvents';
 import { Button } from '@/components/ui/button';
 import {
   Dialog,
@@ -43,8 +42,8 @@ export function AddProjectModal({ open, onOpenChange, onAdded }: Props) {
     setBusy(true);
     setError(null);
     try {
-      const created = await api.projects.add({ path });
-      sessionEvents.emit({ type: 'project_created', project: created });
+      await api.projects.add({ path });
+      // Server publishes project_created via WS; let useUserEvents deliver it.
       onAdded();
       onOpenChange(false);
     } catch (err) {

apps/web/src/components/AttachmentChip.tsx

@@ -0,0 +1,41 @@
+import { FileText, X } from 'lucide-react';
+import type { Attachment } from '@/lib/attachments';
+
+interface Props {
+  attachment: Attachment;
+  onRemove: (id: string) => void;
+  onPreview: (attachment: Attachment) => void;
+}
+
+export function AttachmentChip({ attachment, onRemove, onPreview }: Props) {
+  const lineCount = attachment.content.split('\n').length;
+
+  const label =
+    attachment.kind === 'lines' && attachment.range
+      ? `${attachment.filename}:${attachment.range[0]}-${attachment.range[1]}`
+      : attachment.filename;
+
+  return (
+    <div className="flex items-center gap-1.5 bg-muted/60 border border-border rounded px-2 py-0.5 text-xs font-mono">
+      <button
+        type="button"
+        onClick={() => onPreview(attachment)}
+        className="flex items-center gap-1.5 hover:bg-muted/60 transition-colors min-w-0"
+      >
+        <FileText className="size-3 shrink-0 text-muted-foreground" />
+        <span className="truncate max-w-[200px]">{label}</span>
+        <span className="text-muted-foreground whitespace-nowrap">
+          +{lineCount} lines
+        </span>
+      </button>
+      <button
+        type="button"
+        onClick={() => onRemove(attachment.id)}
+        className="ml-0.5 rounded hover:bg-muted-foreground/20 p-0.5 shrink-0"
+        aria-label="Remove attachment"
+      >
+        <X className="size-3" />
+      </button>
+    </div>
+  );
+}

apps/web/src/components/AttachmentPreviewModal.tsx

@@ -0,0 +1,37 @@
+import type { Attachment } from '@/lib/attachments';
+import { CodeBlock } from '@/components/CodeBlock';
+import {
+  Dialog,
+  DialogContent,
+  DialogHeader,
+  DialogTitle,
+} from '@/components/ui/dialog';
+
+interface Props {
+  attachment: Attachment | null;
+  onClose: () => void;
+}
+
+export function AttachmentPreviewModal({ attachment, onClose }: Props) {
+  const title = attachment
+    ? attachment.kind === 'lines' && attachment.range
+      ? `${attachment.filename}:${attachment.range[0]}-${attachment.range[1]}`
+      : attachment.filename
+    : '';
+
+  return (
+    <Dialog open={attachment !== null} onOpenChange={() => onClose()}>
+      <DialogContent className="sm:max-w-2xl max-h-[80vh] overflow-y-auto">
+        <DialogHeader>
+          <DialogTitle className="font-mono text-sm">{title}</DialogTitle>
+        </DialogHeader>
+        {attachment && (
+          <CodeBlock
+            code={attachment.content}
+            lang={attachment.language ?? undefined}
+          />
+        )}
+      </DialogContent>
+    </Dialog>
+  );
+}

apps/web/src/components/ChatContextPopover.tsx

@@ -0,0 +1,55 @@
+import type { ChatContextStats } from '@/hooks/useChatContextStats';
+
+interface Props {
+  stats: ChatContextStats | null;
+}
+
+/**
+ * Formats a token count into a compact k/m-suffix string.
+ *  - < 1_000          → raw integer (e.g. "42")
+ *  - 1_000–999_999    → "Nk" or "N.Nk" (e.g. "30k", "12.5k", "100k")
+ *  - >= 1_000_000     → "Nm" or "N.Nm" (e.g. "1m", "1.5m", "100m")
+ *
+ * Drops a trailing ".0" so we get "30k" instead of "30.0k".
+ */
+function formatTokens(n: number): string {
+  if (n < 1000) return String(n);
+  if (n < 1_000_000) {
+    const k = n / 1000;
+    return k >= 100 ? `${Math.round(k)}k` : `${k.toFixed(1).replace(/\.0$/, '')}k`;
+  }
+  const m = n / 1_000_000;
+  return m >= 100 ? `${Math.round(m)}m` : `${m.toFixed(1).replace(/\.0$/, '')}m`;
+}
+
+/**
+ * Color thresholds:
+ *  - >  85%  → text-destructive
+ *  - >= 60%  → text-amber-500
+ *  - else    → text-muted-foreground
+ * (85% itself falls into the amber band.)
+ */
+function percentColorClass(percent: number): string {
+  if (percent > 85) return 'text-destructive';
+  if (percent >= 60) return 'text-amber-500';
+  return 'text-muted-foreground';
+}
+
+export function ChatContextPopover({ stats }: Props) {
+  if (!stats) return null;
+  return (
+    <div className="absolute bottom-full right-4 mb-4 z-20 pointer-events-none">
+      <div className="rounded-md border border-border bg-card text-card-foreground shadow-sm px-3 py-2 text-xs min-w-[140px]">
+        <div className="text-muted-foreground/80 text-[10px] uppercase tracking-wide mb-0.5">
+          Context window
+        </div>
+        <div className={`text-base font-medium ${percentColorClass(stats.percent)}`}>
+          {stats.percent}% used
+        </div>
+        <div className="text-muted-foreground text-[10px] font-mono">
+          {formatTokens(stats.used)} / {formatTokens(stats.max)} tokens
+        </div>
+      </div>
+    </div>
+  );
+}

apps/web/src/components/ChatInput.tsx

@@ -1,25 +1,88 @@
-import { useState, type KeyboardEvent } from 'react';
+import { useCallback, useEffect, useRef, useState, type DragEvent, type KeyboardEvent } from 'react';
 import { Send } from 'lucide-react';
 import { toast } from 'sonner';
 import { Textarea } from '@/components/ui/textarea';
 import { Button } from '@/components/ui/button';
+import {
+  flattenToMessage,
+  inferLanguage,
+  looksBinary,
+  MAX_FILE_SIZE_BYTES,
+  PASTE_INLINE_MAX_LINES,
+  type Attachment,
+} from '@/lib/attachments';
+import { AttachmentChip } from '@/components/AttachmentChip';
+import { AttachmentPreviewModal } from '@/components/AttachmentPreviewModal';
+import { FileMentionPopover } from '@/components/FileMentionPopover';
+import { DropOverlay } from '@/components/DropOverlay';
+import { api } from '@/api/client';
+import { sessionEvents } from '@/hooks/sessionEvents';
+import { useViewport } from '@/hooks/useViewport';
+
+const MAX_ATTACHMENTS = 10;
 
 interface Props {
   disabled?: boolean;
+  projectId: string;
   onSend: (content: string) => void | Promise<void>;
+  onForceSend?: (content: string) => void | Promise<void>;
 }
 
-export function ChatInput({ disabled, onSend }: Props) {
+export function ChatInput({ disabled, projectId, onSend, onForceSend }: Props) {
+  const { isMobile } = useViewport();
   const [value, setValue] = useState('');
   const [busy, setBusy] = useState(false);
+  const [attachments, setAttachments] = useState<Attachment[]>([]);
+  const [previewAttachment, setPreviewAttachment] = useState<Attachment | null>(null);
+  const [isDraggingOver, setIsDraggingOver] = useState(false);
+  const dropRootRef = useRef<HTMLDivElement | null>(null);
+  const pasteCounterRef = useRef(0);
+  const [mentionState, setMentionState] = useState<{
+    open: boolean;
+    query: string;
+    atIdx: number;
+    anchorRect: { top: number; left: number };
+  } | null>(null);
+  const [fileIndex, setFileIndex] = useState<string[] | null>(null);
+  const textareaRef = useRef<HTMLTextAreaElement | null>(null);
+
+  function addAttachment(a: Attachment) {
+    setAttachments(prev => {
+      if (prev.length >= MAX_ATTACHMENTS) {
+        toast.error(`Max ${MAX_ATTACHMENTS} attachments per message`);
+        return prev;
+      }
+      return [...prev, a];
+    });
+  }
+
+  const addAttachmentRef = useRef(addAttachment);
+  addAttachmentRef.current = addAttachment;
+
+  useEffect(() => {
+    return sessionEvents.subscribe((event) => {
+      if (event.type !== 'attach_chat_file') return;
+      addAttachmentRef.current({
+        id: crypto.randomUUID(),
+        ...event.attachment,
+      });
+    });
+  }, []);
+
+  function removeAttachment(id: string) {
+    setAttachments(prev => prev.filter(a => a.id !== id));
+  }
 
   async function submit() {
     const text = value.trim();
-    if (!text || disabled || busy) return;
+    if (!text && attachments.length === 0) return;
+    if (disabled || busy) return;
     setBusy(true);
     try {
-      await onSend(text);
+      const body = flattenToMessage(attachments, text);
+      await onSend(body);
       setValue('');
+      setAttachments([]);
     } catch (err) {
       toast.error(err instanceof Error ? err.message : 'failed to send');
     } finally {
@@ -27,32 +90,375 @@ export function ChatInput({ disabled, onSend }: Props) {
     }
   }
 
+  function getCaretCoords(textarea: HTMLTextAreaElement): { top: number; left: number } {
+    const mirror = document.createElement('div');
+    const style = window.getComputedStyle(textarea);
+
+    const properties = [
+      'fontFamily', 'fontSize', 'fontWeight', 'fontStyle',
+      'letterSpacing', 'lineHeight', 'textTransform', 'wordSpacing',
+      'textIndent', 'paddingTop', 'paddingRight', 'paddingBottom', 'paddingLeft',
+      'borderTopWidth', 'borderRightWidth', 'borderBottomWidth', 'borderLeftWidth',
+      'boxSizing', 'whiteSpace', 'overflowWrap',
+    ] as const;
+
+    mirror.style.position = 'absolute';
+    mirror.style.visibility = 'hidden';
+    mirror.style.overflow = 'hidden';
+    mirror.style.width = style.width;
+    for (const prop of properties) {
+      mirror.style[prop] = style[prop];
+    }
+    mirror.style.whiteSpace = 'pre-wrap';
+    mirror.style.overflowWrap = 'break-word';
+
+    const textBefore = textarea.value.slice(0, textarea.selectionStart);
+    mirror.textContent = textBefore;
+
+    const span = document.createElement('span');
+    span.textContent = '​'; // zero-width space
+    mirror.appendChild(span);
+
+    document.body.appendChild(mirror);
+
+    const taRect = textarea.getBoundingClientRect();
+    const spanRect = span.getBoundingClientRect();
+    const mirrorRect = mirror.getBoundingClientRect();
+
+    const top = taRect.top + (spanRect.top - mirrorRect.top) - textarea.scrollTop + span.offsetHeight;
+    const left = taRect.left + (spanRect.left - mirrorRect.left);
+
+    document.body.removeChild(mirror);
+
+    return { top, left };
+  }
+
+  function handleChange(e: React.ChangeEvent<HTMLTextAreaElement>) {
+    const newValue = e.target.value;
+    setValue(newValue);
+
+    const ta = e.target;
+    const pos = ta.selectionStart;
+
+    // Check for @ trigger
+    if (pos > 0 && newValue[pos - 1] === '@') {
+      const charBefore = pos >= 2 ? newValue[pos - 2] : null;
+      if (charBefore === null || charBefore === ' ' || charBefore === '\n') {
+        const coords = getCaretCoords(ta);
+        setMentionState({ open: true, query: '', atIdx: pos - 1, anchorRect: coords });
+        if (!fileIndex) {
+          api.projects.files(projectId).then(r => setFileIndex(r.files)).catch(() => {});
+        }
+        return;
+      }
+    }
+
+    // Update query if popover is open — use stored atIdx
+    if (mentionState?.open) {
+      const { atIdx } = mentionState;
+      if (atIdx < pos && newValue[atIdx] === '@') {
+        const query = newValue.slice(atIdx + 1, pos);
+        setMentionState(prev => prev ? { ...prev, query } : null);
+      } else {
+        setMentionState(null);
+      }
+    }
+  }
+
+  async function handleMentionSelect(path: string) {
+    const atIdx = mentionState?.atIdx ?? -1;
+    const ta = textareaRef.current;
+    const caretPos = ta?.selectionStart ?? value.length;
+    setMentionState(null);
+
+    try {
+      const result = await api.projects.viewFile(projectId, path);
+      if (atIdx >= 0) {
+        const cleaned = value.slice(0, atIdx) + value.slice(caretPos);
+        setValue(cleaned);
+        if (ta) {
+          requestAnimationFrame(() => {
+            ta.selectionStart = ta.selectionEnd = atIdx;
+            ta.focus();
+          });
+        }
+      }
+      addAttachment({
+        id: crypto.randomUUID(),
+        kind: 'file',
+        filename: path,
+        language: inferLanguage(path),
+        content: result.content,
+        source: '@',
+      });
+    } catch {
+      toast.error('Failed to load file');
+    }
+  }
+
+  const closeMention = useCallback(() => setMentionState(null), []);
+
+  // ---- Drag & drop (F1 + F3 + F4) ----------------------------------------
+  // The drop zone is the outer ChatInput container (ref'd as dropRootRef).
+  // onDragLeave only clears the highlight when the cursor leaves the
+  // container, not when it crosses into a child element.
+
+  async function processDroppedFile(file: File) {
+    // Size gate
+    if (file.size > MAX_FILE_SIZE_BYTES) {
+      const mb = (file.size / (1024 * 1024)).toFixed(1);
+      toast.error(`File ${file.name} is too large (${mb} MB). Limit is 5 MB.`);
+      return;
+    }
+    // Read once as ArrayBuffer so we can do byte-level binary detection
+    // before deciding whether to decode as text.
+    let buf: ArrayBuffer;
+    try {
+      buf = await file.arrayBuffer();
+    } catch (err) {
+      toast.error(`Failed to read ${file.name}: ${err instanceof Error ? err.message : String(err)}`);
+      return;
+    }
+    if (looksBinary(buf)) {
+      toast.error(`${file.name} appears to be binary.`);
+      return;
+    }
+    const text = new TextDecoder('utf-8', { fatal: false }).decode(buf);
+    addAttachment({
+      id: crypto.randomUUID(),
+      kind: 'file',
+      filename: file.name,
+      language: inferLanguage(file.name),
+      content: text,
+      source: 'drop',
+    });
+  }
+
+  function isFolderItem(item: DataTransferItem | undefined): boolean {
+    if (!item) return false;
+    // webkitGetAsEntry is non-standard but supported in Chromium + Safari.
+    // If unavailable, we conservatively treat the entry as a file.
+    const entry =
+      typeof item.webkitGetAsEntry === 'function' ? item.webkitGetAsEntry() : null;
+    if (entry && entry.isDirectory) return true;
+    // Heuristic fallback: folders dragged from Finder have type === '' and
+    // a 0-byte File. The empty-type alone isn't reliable for files (some
+    // plaintext drops also lack a type), so we only flag when the entry
+    // explicitly says directory.
+    return false;
+  }
+
+  async function handleDroppedItems(dt: DataTransfer) {
+    // Snapshot items first because reading files inside the loop can
+    // detach the DataTransfer between awaits.
+    const itemsArray: { file: File | null; isFolder: boolean }[] = [];
+    if (dt.items && dt.items.length > 0) {
+      for (let i = 0; i < dt.items.length; i++) {
+        const it = dt.items[i];
+        if (!it || it.kind !== 'file') continue;
+        const folder = isFolderItem(it);
+        const file = folder ? null : it.getAsFile();
+        itemsArray.push({ file, isFolder: folder });
+      }
+    } else {
+      for (let i = 0; i < dt.files.length; i++) {
+        const f = dt.files[i];
+        if (f) itemsArray.push({ file: f, isFolder: false });
+      }
+    }
+
+    let remainingSlots = MAX_ATTACHMENTS - attachments.length;
+    let folderRejected = false;
+    for (const { file, isFolder } of itemsArray) {
+      if (isFolder) {
+        if (!folderRejected) {
+          toast.error('Folders are not supported');
+          folderRejected = true;
+        }
+        continue;
+      }
+      if (!file) continue;
+      if (remainingSlots <= 0) {
+        toast.error(`Attachment limit reached (${MAX_ATTACHMENTS}).`);
+        return;
+      }
+      await processDroppedFile(file);
+      remainingSlots -= 1;
+    }
+  }
+
+  function onDragEnter(e: DragEvent<HTMLDivElement>) {
+    if (disabled || busy) return;
+    e.preventDefault();
+    setIsDraggingOver(true);
+  }
+
+  function onDragOver(e: DragEvent<HTMLDivElement>) {
+    if (disabled || busy) return;
+    e.preventDefault();
+    e.dataTransfer.dropEffect = 'copy';
+  }
+
+  function onDragLeave(e: DragEvent<HTMLDivElement>) {
+    // Only clear when the cursor actually leaves the root container.
+    // relatedTarget is the element being entered; if it's inside the root,
+    // ignore — we're just crossing into a child.
+    const root = dropRootRef.current;
+    if (!root) return;
+    const related = e.relatedTarget as Node | null;
+    if (related && root.contains(related)) return;
+    setIsDraggingOver(false);
+  }
+
+  function onDrop(e: DragEvent<HTMLDivElement>) {
+    e.preventDefault();
+    setIsDraggingOver(false);
+    if (disabled || busy) return;
+    void handleDroppedItems(e.dataTransfer);
+  }
+  // ---- end Drag & drop -----------------------------------------------------
+
+  // ---- Paste-as-attachment (F2) -------------------------------------------
+  // Pasting >PASTE_INLINE_MAX_LINES lines of text becomes a chip rather than
+  // inline content. Image pastes are rejected with a toast. If both text and
+  // image are present (e.g. screenshot tool that sets both), prefer text.
+
+  function onPaste(e: React.ClipboardEvent<HTMLTextAreaElement>) {
+    const cd = e.clipboardData;
+    if (!cd) return;
+    const text = cd.getData('text/plain');
+    const hasImage = Array.from(cd.items ?? []).some((it) =>
+      it.type.startsWith('image/'),
+    );
+    if (text) {
+      const lineCount = text.split('\n').length;
+      if (lineCount > PASTE_INLINE_MAX_LINES) {
+        e.preventDefault();
+        pasteCounterRef.current += 1;
+        addAttachment({
+          id: crypto.randomUUID(),
+          kind: 'paste',
+          filename: `pasted-${pasteCounterRef.current}.txt`,
+          language: 'plaintext',
+          content: text,
+          source: 'paste',
+        });
+      }
+      // <= threshold: let default paste insert inline.
+      return;
+    }
+    if (hasImage) {
+      e.preventDefault();
+      toast.error('Image paste is not supported. Drop a file or paste text.');
+    }
+  }
+  // ---- end Paste-as-attachment --------------------------------------------
+
   function onKeyDown(e: KeyboardEvent<HTMLTextAreaElement>) {
-    if ((e.metaKey || e.ctrlKey) && e.key === 'Enter') {
+    if (mentionState?.open) return;
+    // IME safety: never act on Enter while an IME composition is in flight
+    // (CJK input methods commit composition via Enter). Without this, the
+    // first Enter of a Japanese/Chinese/Korean composition would submit
+    // instead of finalizing the candidate.
+    if (e.nativeEvent.isComposing) return;
+    if (e.key === 'Enter' && e.shiftKey && (e.metaKey || e.ctrlKey) && onForceSend) {
+      e.preventDefault();
+      void forceSubmit();
+      return;
+    }
+    if (e.key === 'Enter' && (e.metaKey || e.ctrlKey)) {
+      e.preventDefault();
+      void submit();
+      return;
+    }
+    // Bare Enter: sends on desktop, inserts a newline on mobile (per spec —
+    // send is via the dedicated button on touch devices).
+    if (e.key === 'Enter' && !e.shiftKey && !isMobile) {
       e.preventDefault();
       void submit();
     }
   }
 
+  async function forceSubmit() {
+    const text = value.trim();
+    if (!text || !onForceSend) return;
+    if (busy) return;
+    setBusy(true);
+    try {
+      const body = flattenToMessage(attachments, text);
+      await onForceSend(body);
+      setValue('');
+      setAttachments([]);
+    } catch (err) {
+      toast.error(err instanceof Error ? err.message : 'force send failed');
+    } finally {
+      setBusy(false);
+    }
+  }
+
   return (
-    <div className="border-t px-4 py-3 flex items-end gap-2">
-      <Textarea
-        value={value}
-        onChange={(e) => setValue(e.target.value)}
-        onKeyDown={onKeyDown}
-        placeholder="Ask about this project. Cmd/Ctrl+Enter to send."
-        disabled={disabled || busy}
-        rows={3}
-        className="resize-none min-h-[68px] max-h-[240px]"
+    <div
+      ref={dropRootRef}
+      className="border-t relative"
+      style={{ paddingBottom: 'env(safe-area-inset-bottom)' }}
+      onDragEnter={onDragEnter}
+      onDragOver={onDragOver}
+      onDragLeave={onDragLeave}
+      onDrop={onDrop}
+    >
+      <DropOverlay visible={isDraggingOver} />
+      <div className="max-w-[1000px] mx-auto w-full">
+      {attachments.length > 0 && (
+        <div className="flex flex-wrap gap-1.5 px-4 pt-3">
+          {attachments.map(a => (
+            <AttachmentChip
+              key={a.id}
+              attachment={a}
+              onRemove={removeAttachment}
+              onPreview={setPreviewAttachment}
+            />
+          ))}
+        </div>
+      )}
+      <div className="px-4 py-3 flex items-end gap-2">
+        <Textarea
+          ref={textareaRef}
+          value={value}
+          onChange={handleChange}
+          onKeyDown={onKeyDown}
+          onPaste={onPaste}
+          placeholder={
+            isMobile
+              ? 'Ask about this project. Tap send to submit.'
+              : 'Ask about this project. Enter to send · Shift+Enter for newline.'
+          }
+          disabled={disabled || busy}
+          rows={3}
+          className="resize-none min-h-[68px] max-h-[240px]"
+        />
+        <Button
+          onClick={() => void submit()}
+          disabled={disabled || busy || (!value.trim() && attachments.length === 0)}
+          size="icon-lg"
+          aria-label="Send"
+        >
+          <Send />
+        </Button>
+      </div>
+      </div>
+      <AttachmentPreviewModal
+        attachment={previewAttachment}
+        onClose={() => setPreviewAttachment(null)}
       />
-      <Button
-        onClick={() => void submit()}
-        disabled={disabled || busy || !value.trim()}
-        size="icon-lg"
-        aria-label="Send"
-      >
-        <Send />
-      </Button>
+      {mentionState?.open && (
+        <FileMentionPopover
+          query={mentionState.query}
+          files={fileIndex ?? []}
+          anchorRect={mentionState.anchorRect}
+          onSelect={handleMentionSelect}
+          onClose={closeMention}
+        />
+      )}
     </div>
   );
 }

apps/web/src/components/ChatTabBar.tsx

@@ -0,0 +1,200 @@
+import { useState } from 'react';
+import { History, MessageSquare, Plus, X } from 'lucide-react';
+import type { Chat, WorkspacePane } from '@/api/types';
+import {
+  ContextMenu,
+  ContextMenuContent,
+  ContextMenuItem,
+  ContextMenuSeparator,
+  ContextMenuTrigger,
+} from '@/components/ui/context-menu';
+import { useLongPress } from '@/hooks/useLongPress';
+import { cn } from '@/lib/utils';
+
+interface Props {
+  pane: WorkspacePane;
+  tabs: Chat[];
+  onSwitchTab: (tabIdx: number) => void;
+  onRemoveTab: (chatId: string) => void;
+  onCloseOthers: (chatId: string) => void;
+  onCloseToRight: (chatId: string) => void;
+  onCloseAll: () => void;
+  onNewChat: () => void;
+  onShowHistory: () => void;
+  onRename: (chatId: string, name: string) => Promise<void>;
+  onRemovePane?: () => void;
+}
+
+export function ChatTabBar({
+  pane,
+  tabs,
+  onSwitchTab,
+  onRemoveTab,
+  onCloseOthers,
+  onCloseToRight,
+  onCloseAll,
+  onNewChat,
+  onShowHistory,
+  onRename,
+  onRemovePane,
+}: Props) {
+  const [renamingId, setRenamingId] = useState<string | null>(null);
+  const [renameValue, setRenameValue] = useState('');
+
+  // Long-press: dispatch a synthetic contextmenu event on the tab so the
+  // existing Radix ContextMenuTrigger opens at the touch coordinates. Works
+  // because asChild composition makes the tab div the trigger element.
+  const longPress = useLongPress(({ clientX, clientY, target }) => {
+    if (!target || !(target instanceof Element)) return;
+    const tab = target.closest('[data-tab-id]') as HTMLElement | null;
+    if (!tab) return;
+    tab.dispatchEvent(
+      new MouseEvent('contextmenu', { bubbles: true, cancelable: true, clientX, clientY }),
+    );
+  });
+
+  function startRename(chatId: string, currentName: string | null) {
+    setRenamingId(chatId);
+    setRenameValue(currentName ?? '');
+  }
+
+  async function finishRename() {
+    if (renamingId && renameValue.trim()) {
+      await onRename(renamingId, renameValue.trim());
+    }
+    setRenamingId(null);
+  }
+
+  return (
+    <div className="flex items-center border-b border-border bg-muted/20 h-8 shrink-0 overflow-x-auto">
+      {tabs.map((chat, tabIdx) => {
+        const isActive = tabIdx === pane.activeChatIdx;
+        const isLast = tabIdx === tabs.length - 1;
+        const onlyTab = tabs.length === 1;
+        const label = chat.name ?? 'New chat';
+        return (
+          <ContextMenu key={chat.id}>
+            <ContextMenuTrigger asChild>
+              <div
+                data-tab-id={chat.id}
+                onClick={() => onSwitchTab(tabIdx)}
+                onTouchStart={longPress.onTouchStart}
+                onTouchMove={longPress.onTouchMove}
+                onTouchEnd={longPress.onTouchEnd}
+                onTouchCancel={longPress.onTouchCancel}
+                style={{ WebkitTouchCallout: 'none' }}
+                className={cn(
+                  'group flex items-center gap-1.5 px-3 py-1.5 text-xs border-r border-border cursor-default select-none shrink-0',
+                  isActive
+                    ? 'bg-background text-foreground'
+                    : 'bg-muted/30 text-muted-foreground hover:bg-muted/60'
+                )}
+              >
+                <MessageSquare size={12} className="shrink-0" />
+                {renamingId === chat.id ? (
+                  <input
+                    autoFocus
+                    value={renameValue}
+                    onChange={(e) => setRenameValue(e.target.value)}
+                    onBlur={() => void finishRename()}
+                    onKeyDown={(e) => {
+                      if (e.key === 'Enter') void finishRename();
+                      if (e.key === 'Escape') setRenamingId(null);
+                    }}
+                    onClick={(e) => e.stopPropagation()}
+                    className="bg-transparent border-b border-border text-xs outline-none w-28"
+                  />
+                ) : (
+                  <span className="truncate max-w-[140px]" title={label}>
+                    {label}
+                  </span>
+                )}
+                <button
+                  type="button"
+                  onClick={(e) => {
+                    e.stopPropagation();
+                    onRemoveTab(chat.id);
+                  }}
+                  className="inline-flex items-center justify-center p-0.5 hover:bg-muted rounded opacity-0 group-hover:opacity-60 hover:!opacity-100 shrink-0 max-md:min-h-[44px] max-md:min-w-[44px] max-md:opacity-100"
+                  aria-label="Close tab"
+                >
+                  <X size={10} />
+                </button>
+              </div>
+            </ContextMenuTrigger>
+            <ContextMenuContent>
+              <ContextMenuItem onSelect={() => onNewChat()}>
+                New chat
+              </ContextMenuItem>
+              <ContextMenuSeparator />
+              <ContextMenuItem onSelect={() => startRename(chat.id, chat.name)}>
+                Rename
+              </ContextMenuItem>
+              <ContextMenuSeparator />
+              <ContextMenuItem onSelect={() => onRemoveTab(chat.id)}>
+                Close
+              </ContextMenuItem>
+              <ContextMenuItem
+                disabled={onlyTab}
+                onSelect={() => onCloseOthers(chat.id)}
+              >
+                Close others
+              </ContextMenuItem>
+              <ContextMenuItem
+                disabled={isLast}
+                onSelect={() => onCloseToRight(chat.id)}
+              >
+                Close to right
+              </ContextMenuItem>
+              <ContextMenuItem onSelect={() => onCloseAll()}>
+                Close all
+              </ContextMenuItem>
+            </ContextMenuContent>
+          </ContextMenu>
+        );
+      })}
+
+      {tabs.length === 0 && (
+        <div className="flex items-center gap-1.5 px-3 py-1.5 text-xs text-muted-foreground">
+          <History size={12} className="shrink-0" />
+          <span>Session</span>
+        </div>
+      )}
+
+      <div className="flex items-center ml-auto gap-0.5 px-1 shrink-0">
+        <button
+          type="button"
+          onClick={onNewChat}
+          className="inline-flex items-center justify-center p-1 rounded text-muted-foreground hover:bg-muted hover:text-foreground max-md:min-h-[44px] max-md:min-w-[44px]"
+          aria-label="New chat"
+          title="New chat"
+        >
+          <Plus size={12} />
+        </button>
+        <button
+          type="button"
+          onClick={onShowHistory}
+          className={cn(
+            'inline-flex items-center justify-center p-1 rounded text-muted-foreground hover:bg-muted hover:text-foreground max-md:min-h-[44px] max-md:min-w-[44px]',
+            pane.kind === 'empty' && 'text-foreground bg-muted/50'
+          )}
+          aria-label="Session history"
+          title="Session history"
+        >
+          <History size={12} />
+        </button>
+        {onRemovePane && (
+          <button
+            type="button"
+            onClick={onRemovePane}
+            className="inline-flex items-center justify-center p-1 rounded text-muted-foreground hover:bg-muted hover:text-foreground max-md:min-h-[44px] max-md:min-w-[44px]"
+            aria-label="Close pane"
+            title="Close pane"
+          >
+            <X size={12} />
+          </button>
+        )}
+      </div>
+    </div>
+  );
+}

apps/web/src/components/CodeBlock.tsx

@@ -1,16 +1,86 @@
-import { useState } from 'react';
+import { useEffect, useRef, useState } from 'react';
 import { Check, Copy } from 'lucide-react';
+import { codeToHtml } from 'shiki';
 
-// NOTE: spec calls for syntax-highlighted code blocks. Highlighting deferred
-// to keep dep footprint minimal; this renders styled mono code with a copy
-// button. Adding a highlighter (shiki / highlight.js) is a one-import swap.
+// NOTE: spec calls for syntax-highlighted code blocks. Added Shiki in v1.1.
+// Shiki output is compiler-generated and does not contain user input; setting
+// it via a ref is safe here.
 interface Props {
   code: string;
   lang?: string;
 }
 
+const LANG_MAP: Record<string, string> = {
+  ts: 'typescript',
+  tsx: 'tsx',
+  typescript: 'typescript',
+  js: 'javascript',
+  jsx: 'jsx',
+  javascript: 'javascript',
+  py: 'python',
+  python: 'python',
+  go: 'go',
+  rs: 'rust',
+  rust: 'rust',
+  rb: 'ruby',
+  ruby: 'ruby',
+  java: 'java',
+  c: 'c',
+  cpp: 'cpp',
+  cs: 'csharp',
+  csharp: 'csharp',
+  php: 'php',
+  sh: 'bash',
+  bash: 'bash',
+  shell: 'bash',
+  yaml: 'yaml',
+  yml: 'yaml',
+  json: 'json',
+  toml: 'toml',
+  md: 'markdown',
+  markdown: 'markdown',
+  sql: 'sql',
+  dockerfile: 'dockerfile',
+  html: 'html',
+  css: 'css',
+};
+
+const SHIKI_THEME = 'github-dark';
+
 export function CodeBlock({ code, lang }: Props) {
   const [copied, setCopied] = useState(false);
+  const [html, setHtml] = useState<string | null>(null);
+  const highlightRef = useRef<HTMLDivElement | null>(null);
+
+  useEffect(() => {
+    let cancelled = false;
+    const mappedLang = (lang && LANG_MAP[lang.toLowerCase()]) ?? null;
+    if (!mappedLang) {
+      setHtml(null);
+      return;
+    }
+    (async () => {
+      try {
+        const result = await codeToHtml(code, { lang: mappedLang, theme: SHIKI_THEME });
+        if (!cancelled) setHtml(result);
+      } catch (err) {
+        console.warn('shiki failed', err);
+        if (!cancelled) setHtml(null);
+      }
+    })();
+    return () => {
+      cancelled = true;
+    };
+  }, [code, lang]);
+
+  // Inject Shiki HTML via ref; output is compiler-generated, not user input.
+  useEffect(() => {
+    if (highlightRef.current) {
+      // Shiki generates sanitized HTML spans — not user-supplied content.
+      // eslint-disable-next-line no-unsanitized/property
+      highlightRef.current.innerHTML = html ?? '';
+    }
+  }, [html]);
 
   async function copy() {
     try {
@@ -36,9 +106,16 @@ export function CodeBlock({ code, lang }: Props) {
           <span>{copied ? 'Copied' : 'Copy'}</span>
         </button>
       </div>
-      <pre className="overflow-x-auto px-3 py-2 font-mono text-xs leading-relaxed">
-        {code}
-      </pre>
+      {html !== null ? (
+        <div
+          ref={highlightRef}
+          className="overflow-x-auto px-3 py-2 font-mono text-xs leading-relaxed [&>pre]:!bg-transparent [&>pre]:!m-0 [&>pre]:!p-0"
+        />
+      ) : (
+        <pre className="overflow-x-auto px-3 py-2 font-mono text-xs leading-relaxed">
+          {code}
+        </pre>
+      )}
     </div>
   );
 }

apps/web/src/components/CreateProjectModal.tsx

@@ -0,0 +1,171 @@
+import { useEffect, useState } from 'react';
+import { useNavigate } from 'react-router-dom';
+import { toast } from 'sonner';
+import { api } from '@/api/client';
+import { Button } from '@/components/ui/button';
+import {
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle,
+} from '@/components/ui/dialog';
+import { Input } from '@/components/ui/input';
+import { Label } from '@/components/ui/label';
+
+interface Props {
+  open: boolean;
+  onOpenChange: (open: boolean) => void;
+}
+
+function previewFolderName(raw: string): string {
+  return raw
+    .toLowerCase()
+    .trim()
+    .replace(/\s+/g, '-')
+    .replace(/[^a-z0-9-]/g, '')
+    .replace(/-+/g, '-')
+    .replace(/^-+|-+$/g, '')
+    .slice(0, 64);
+}
+
+export function CreateProjectModal({ open, onOpenChange }: Props) {
+  const navigate = useNavigate();
+  const [name, setName] = useState('');
+  const [commitMessage, setCommitMessage] = useState('Initial commit');
+  const [visibility, setVisibility] = useState<'private' | 'public'>('private');
+  const [createRemote, setCreateRemote] = useState(true);
+  const [busy, setBusy] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+
+  useEffect(() => {
+    if (!open) return;
+    setName('');
+    setCommitMessage('Initial commit');
+    setVisibility('private');
+    setCreateRemote(true);
+    setBusy(false);
+    setError(null);
+  }, [open]);
+
+  const folderPreview = previewFolderName(name);
+
+  async function submit() {
+    if (!folderPreview) {
+      setError('Project name must contain at least one letter or digit.');
+      return;
+    }
+    setBusy(true);
+    setError(null);
+    try {
+      const result = await api.projects.create({
+        name: name.trim(),
+        commit_message: commitMessage.trim() || 'Initial commit',
+        visibility,
+        create_gitea_remote: createRemote,
+      });
+      const warnings = result.bootstrap.warnings;
+      if (warnings.length > 0) {
+        toast.warning(`Project created with warnings: ${warnings.join('; ')}`);
+      } else {
+        toast.success(`Project "${result.project.name}" created`);
+      }
+      onOpenChange(false);
+      navigate(`/project/${result.project.id}`);
+    } catch (err) {
+      setError(err instanceof Error ? err.message : 'failed to create project');
+    } finally {
+      setBusy(false);
+    }
+  }
+
+  return (
+    <Dialog open={open} onOpenChange={onOpenChange}>
+      <DialogContent className="sm:max-w-md">
+        <DialogHeader>
+          <DialogTitle>Create New Project</DialogTitle>
+          <DialogDescription>
+            Creates a folder under /opt with a git repo, .gitignore, and optionally a Gitea remote.
+          </DialogDescription>
+        </DialogHeader>
+
+        <div className="space-y-3">
+          <div className="space-y-1.5">
+            <Label htmlFor="proj-name">Project name</Label>
+            <Input
+              id="proj-name"
+              placeholder="My new project"
+              value={name}
+              onChange={(e) => setName(e.target.value)}
+              disabled={busy}
+              autoFocus
+            />
+            {name && (
+              <div className="text-xs text-muted-foreground font-mono">
+                Folder: /opt/projects/{folderPreview || <span className="text-destructive">(empty after sanitization)</span>}
+              </div>
+            )}
+          </div>
+
+          <div className="space-y-1.5">
+            <Label htmlFor="commit-msg">Initial commit message</Label>
+            <Input
+              id="commit-msg"
+              value={commitMessage}
+              onChange={(e) => setCommitMessage(e.target.value)}
+              disabled={busy}
+            />
+          </div>
+
+          <div className="space-y-1.5">
+            <Label>Visibility</Label>
+            <div className="flex gap-4 text-sm">
+              <label className="flex items-center gap-1.5">
+                <input
+                  type="radio"
+                  checked={visibility === 'private'}
+                  onChange={() => setVisibility('private')}
+                  disabled={busy}
+                />
+                Private
+              </label>
+              <label className="flex items-center gap-1.5">
+                <input
+                  type="radio"
+                  checked={visibility === 'public'}
+                  onChange={() => setVisibility('public')}
+                  disabled={busy}
+                />
+                Public
+              </label>
+            </div>
+          </div>
+
+          <label className="flex items-center gap-2 text-sm">
+            <input
+              type="checkbox"
+              checked={createRemote}
+              onChange={(e) => setCreateRemote(e.target.checked)}
+              disabled={busy}
+            />
+            Create Gitea remote and push
+          </label>
+
+          {error && (
+            <div className="text-sm text-destructive">{error}</div>
+          )}
+        </div>
+
+        <DialogFooter>
+          <Button variant="outline" onClick={() => onOpenChange(false)} disabled={busy}>
+            Cancel
+          </Button>
+          <Button onClick={() => void submit()} disabled={busy || !folderPreview}>
+            {busy ? 'Creating…' : 'Create'}
+          </Button>
+        </DialogFooter>
+      </DialogContent>
+    </Dialog>
+  );
+}

apps/web/src/components/DropOverlay.tsx

@@ -0,0 +1,18 @@
+interface Props {
+  visible: boolean;
+}
+
+// Visual cue layered over the ChatInput while a drag is in progress.
+// Pointer-events: none so the underlying drop handler still receives the
+// drop event. Renders nothing when not visible (cheap and out of layout).
+export function DropOverlay({ visible }: Props) {
+  if (!visible) return null;
+  return (
+    <div
+      className="absolute inset-0 z-10 pointer-events-none flex items-center justify-center rounded border-2 border-dashed border-primary bg-background/85"
+      aria-hidden="true"
+    >
+      <div className="text-sm font-medium text-primary">Drop to attach</div>
+    </div>
+  );
+}

apps/web/src/components/FileMentionPopover.tsx

@@ -0,0 +1,145 @@
+import { useEffect, useMemo, useRef, useState } from 'react';
+import { cn } from '@/lib/utils';
+
+interface Props {
+  query: string;
+  files: string[];
+  anchorRect: { top: number; left: number };
+  onSelect: (path: string) => void;
+  onClose: () => void;
+}
+
+function filterAndRank(files: string[], query: string): string[] {
+  const q = query.toLowerCase();
+  if (!q) {
+    return files.slice(0, 20);
+  }
+
+  const filenameMatches: string[] = [];
+  const pathOnlyMatches: string[] = [];
+
+  for (const file of files) {
+    const lower = file.toLowerCase();
+    if (!lower.includes(q)) continue;
+    const basename = file.split('/').pop() ?? file;
+    if (basename.toLowerCase().includes(q)) {
+      filenameMatches.push(file);
+    } else {
+      pathOnlyMatches.push(file);
+    }
+  }
+
+  filenameMatches.sort((a, b) => a.localeCompare(b));
+  pathOnlyMatches.sort((a, b) => a.localeCompare(b));
+
+  return [...filenameMatches, ...pathOnlyMatches].slice(0, 20);
+}
+
+export function FileMentionPopover({
+  query,
+  files,
+  anchorRect,
+  onSelect,
+  onClose,
+}: Props) {
+  const [highlightIndex, setHighlightIndex] = useState(0);
+  const popoverRef = useRef<HTMLDivElement>(null);
+  const filtered = useMemo(() => filterAndRank(files, query), [files, query]);
+
+  // Reset highlight when query changes
+  useEffect(() => {
+    setHighlightIndex(0);
+  }, [query]);
+
+  // Keyboard navigation
+  useEffect(() => {
+    function handleKeyDown(e: KeyboardEvent) {
+      if (e.key === 'ArrowDown') {
+        e.preventDefault();
+        setHighlightIndex(prev =>
+          prev < filtered.length - 1 ? prev + 1 : 0
+        );
+      } else if (e.key === 'ArrowUp') {
+        e.preventDefault();
+        setHighlightIndex(prev =>
+          prev > 0 ? prev - 1 : filtered.length - 1
+        );
+      } else if (e.key === 'Enter') {
+        e.preventDefault();
+        if (filtered.length > 0) {
+          onSelect(filtered[highlightIndex] ?? filtered[0]!);
+        }
+      } else if (e.key === 'Escape') {
+        e.preventDefault();
+        onClose();
+      }
+    }
+
+    document.addEventListener('keydown', handleKeyDown);
+    return () => document.removeEventListener('keydown', handleKeyDown);
+  }, [filtered, highlightIndex, onSelect, onClose]);
+
+  // Click outside to close
+  useEffect(() => {
+    function handleMouseDown(e: MouseEvent) {
+      if (
+        popoverRef.current &&
+        !popoverRef.current.contains(e.target as Node)
+      ) {
+        onClose();
+      }
+    }
+
+    document.addEventListener('mousedown', handleMouseDown);
+    return () => document.removeEventListener('mousedown', handleMouseDown);
+  }, [onClose]);
+
+  // Scroll highlighted item into view
+  useEffect(() => {
+    const el = popoverRef.current?.querySelector('[data-highlighted="true"]');
+    if (el) {
+      el.scrollIntoView({ block: 'nearest' });
+    }
+  }, [highlightIndex]);
+
+  if (filtered.length === 0) {
+    return (
+      <div
+        ref={popoverRef}
+        className="fixed z-50 bg-popover border border-border rounded-md shadow min-w-[260px] p-2"
+        style={{ top: anchorRect.top, left: anchorRect.left }}
+      >
+        <div className="text-xs text-muted-foreground px-2 py-1">
+          No matching files
+        </div>
+      </div>
+    );
+  }
+
+  return (
+    <div
+      ref={popoverRef}
+      className="fixed z-50 bg-popover border border-border rounded-md shadow min-w-[260px] max-h-[240px] overflow-y-auto"
+      style={{ top: anchorRect.top, left: anchorRect.left }}
+    >
+      {filtered.map((file, i) => (
+        <button
+          key={file}
+          type="button"
+          data-highlighted={i === highlightIndex}
+          className={cn(
+            'w-full text-left text-xs font-mono px-2 py-1.5 cursor-pointer',
+            i === highlightIndex && 'bg-muted'
+          )}
+          onMouseEnter={() => setHighlightIndex(i)}
+          onMouseDown={(e) => {
+            e.preventDefault();
+            onSelect(file);
+          }}
+        >
+          {file}
+        </button>
+      ))}
+    </div>
+  );
+}

apps/web/src/components/FileViewerOverlay.tsx

@@ -0,0 +1,241 @@
+import { useCallback, useEffect, useRef, useState } from 'react';
+import { Check, Copy, X, Paperclip } from 'lucide-react';
+import { codeToHtml } from 'shiki';
+import { sessionEvents } from '@/hooks/sessionEvents';
+import { Button } from '@/components/ui/button';
+import { cn } from '@/lib/utils';
+
+interface Props {
+  path: string;
+  content: string;
+  lang: string | null;
+  projectId: string;
+  onClose: () => void;
+  onNavigate: (path: string) => void;
+}
+
+const SHIKI_THEME = 'github-dark';
+
+function splitShikiLines(html: string): string[] {
+  const match = html.match(/<code[^>]*>([\s\S]*)<\/code>/);
+  if (!match) return [];
+  const inner = match[1]!;
+  const lines = inner.split(/(?=<span class="line">)/);
+  return lines.filter(l => l.trim().length > 0);
+}
+
+function basename(path: string): string {
+  const parts = path.split('/');
+  return parts[parts.length - 1] ?? path;
+}
+
+export function FileViewerOverlay({ path, content, lang, onClose }: Props) {
+  const [copied, setCopied] = useState(false);
+  const [lineHtmls, setLineHtmls] = useState<string[] | null>(null);
+  const [selectedLines, setSelectedLines] = useState<Set<number>>(new Set());
+  const [showAttachPopover, setShowAttachPopover] = useState(false);
+  const draggingRef = useRef(false);
+  const dragStartRef = useRef<number | null>(null);
+  const overlayRef = useRef<HTMLDivElement>(null);
+
+  useEffect(() => {
+    setSelectedLines(new Set());
+    setShowAttachPopover(false);
+    if (!lang) { setLineHtmls(null); return; }
+    let cancelled = false;
+    (async () => {
+      try {
+        const result = await codeToHtml(content, { lang, theme: SHIKI_THEME });
+        if (!cancelled) {
+          const lines = splitShikiLines(result);
+          setLineHtmls(lines.length > 0 ? lines : null);
+        }
+      } catch { if (!cancelled) setLineHtmls(null); }
+    })();
+    return () => { cancelled = true; };
+  }, [content, lang]);
+
+  const plainLines = content.split('\n');
+  const totalLines = lineHtmls ? lineHtmls.length : plainLines.length;
+
+  async function copyAll() {
+    try {
+      await navigator.clipboard.writeText(content);
+      setCopied(true);
+      setTimeout(() => setCopied(false), 1200);
+    } catch { /* ignore */ }
+  }
+
+  function handleLineMouseDown(lineNo: number, e: React.MouseEvent) {
+    if (e.shiftKey && dragStartRef.current !== null) {
+      const start = dragStartRef.current;
+      const min = Math.min(start, lineNo);
+      const max = Math.max(start, lineNo);
+      const next = new Set<number>();
+      for (let i = min; i <= max; i++) next.add(i);
+      setSelectedLines(next);
+      setShowAttachPopover(true);
+      return;
+    }
+    draggingRef.current = true;
+    dragStartRef.current = lineNo;
+    setSelectedLines(new Set([lineNo]));
+    setShowAttachPopover(false);
+  }
+
+  function handleLineMouseEnter(lineNo: number) {
+    if (!draggingRef.current || dragStartRef.current === null) return;
+    const start = dragStartRef.current;
+    const min = Math.min(start, lineNo);
+    const max = Math.max(start, lineNo);
+    const next = new Set<number>();
+    for (let i = min; i <= max; i++) next.add(i);
+    setSelectedLines(next);
+  }
+
+  const handleMouseUp = useCallback(() => {
+    if (draggingRef.current) {
+      draggingRef.current = false;
+      if (selectedLines.size > 0) setShowAttachPopover(true);
+    }
+  }, [selectedLines.size]);
+
+  useEffect(() => {
+    document.addEventListener('mouseup', handleMouseUp);
+    return () => document.removeEventListener('mouseup', handleMouseUp);
+  }, [handleMouseUp]);
+
+  useEffect(() => {
+    function handleClick(e: MouseEvent) {
+      if (overlayRef.current && !overlayRef.current.contains(e.target as Node)) {
+        onClose();
+      }
+    }
+    document.addEventListener('mousedown', handleClick);
+    return () => document.removeEventListener('mousedown', handleClick);
+  }, [onClose]);
+
+  useEffect(() => {
+    function handleKey(e: KeyboardEvent) {
+      if (e.key === 'Escape') onClose();
+    }
+    document.addEventListener('keydown', handleKey);
+    return () => document.removeEventListener('keydown', handleKey);
+  }, [onClose]);
+
+  function getSelectionRange(): { min: number; max: number } | null {
+    if (selectedLines.size === 0) return null;
+    let min = Infinity;
+    let max = -Infinity;
+    for (const n of selectedLines) {
+      if (n < min) min = n;
+      if (n > max) max = n;
+    }
+    return { min, max };
+  }
+
+  function handleAttach() {
+    const range = getSelectionRange();
+    if (!range) return;
+    const lines = content.split('\n').slice(range.min - 1, range.max);
+    sessionEvents.emit({
+      type: 'attach_chat_file',
+      attachment: {
+        kind: 'lines',
+        filename: path,
+        language: lang,
+        content: lines.join('\n'),
+        range: [range.min, range.max],
+        source: 'line-select',
+      },
+    });
+    setSelectedLines(new Set());
+    setShowAttachPopover(false);
+  }
+
+  const range = getSelectionRange();
+  const attachLabel = range
+    ? range.min === range.max
+      ? `Attach line ${range.min} to chat`
+      : `Attach lines ${range.min}–${range.max} to chat`
+    : '';
+
+  return (
+    <div className="fixed inset-0 z-50 flex items-start justify-center pt-12 pb-12">
+      <div className="absolute inset-0 bg-black/40" />
+      <div
+        ref={overlayRef}
+        className="relative bg-background border rounded-lg shadow-xl flex flex-col w-[80vw] max-w-[1000px] max-h-[80vh] overflow-hidden"
+      >
+        <div className="flex items-center gap-2 px-4 py-2 border-b shrink-0">
+          <span className="text-sm font-medium truncate flex-1" title={path}>
+            {basename(path)}
+          </span>
+          <span className="text-xs text-muted-foreground truncate">{path}</span>
+          <button
+            type="button"
+            onClick={() => void copyAll()}
+            className="flex items-center gap-1 text-xs px-2 py-1 rounded hover:bg-muted"
+          >
+            {copied ? <Check size={12} /> : <Copy size={12} />}
+            {copied ? 'Copied' : 'Copy'}
+          </button>
+          <button
+            type="button"
+            onClick={onClose}
+            className="p-1 rounded hover:bg-muted"
+            aria-label="Close"
+          >
+            <X size={16} />
+          </button>
+        </div>
+
+        {/* Shiki-highlighted code lines are generated from source code files, not user content */}
+        <div className="flex-1 overflow-auto text-sm font-mono select-none">
+          {Array.from({ length: totalLines }, (_, i) => {
+            const lineNo = i + 1;
+            const isSelected = selectedLines.has(lineNo);
+            return (
+              <div
+                key={lineNo}
+                className={cn('flex', isSelected && 'bg-blue-500/10')}
+                onMouseDown={(e) => handleLineMouseDown(lineNo, e)}
+                onMouseEnter={() => handleLineMouseEnter(lineNo)}
+              >
+                <div
+                  className="shrink-0 w-[3.5ch] text-right pr-2 text-xs text-muted-foreground select-none cursor-pointer hover:text-foreground"
+                  style={{ fontVariantNumeric: 'tabular-nums' }}
+                >
+                  {lineNo}
+                </div>
+                {lineHtmls ? (
+                  <div
+                    className="flex-1 min-w-0 text-xs leading-relaxed [&>.line]:!bg-transparent"
+                    dangerouslySetInnerHTML={{ __html: lineHtmls[i] ?? '' }}
+                  />
+                ) : (
+                  <span className="flex-1 min-w-0 text-xs leading-relaxed whitespace-pre">
+                    {plainLines[i] ?? ''}
+                  </span>
+                )}
+              </div>
+            );
+          })}
+        </div>
+
+        {showAttachPopover && range && (
+          <div className="sticky bottom-0 border-t bg-background px-4 py-2 flex items-center gap-2">
+            <Paperclip size={14} className="text-muted-foreground" />
+            <span className="text-xs flex-1">{attachLabel}</span>
+            <Button size="sm" onClick={handleAttach}>
+              Attach
+            </Button>
+            <Button size="sm" variant="ghost" onClick={() => { setSelectedLines(new Set()); setShowAttachPopover(false); }}>
+              Cancel
+            </Button>
+          </div>
+        )}
+      </div>
+    </div>
+  );
+}

apps/web/src/components/MessageBubble.tsx

@@ -1,16 +1,99 @@
-import { useState } from 'react';
+import { Children, cloneElement, isValidElement, useState } from 'react';
+import type { ReactElement, ReactNode } from 'react';
 import Markdown from 'react-markdown';
 import remarkGfm from 'remark-gfm';
-import { Copy, RefreshCw, Check } from 'lucide-react';
+import { ChevronDown, ChevronRight, Copy, RefreshCw, Check, Share2, RotateCw, GitFork, Trash2 } from 'lucide-react';
 import { toast } from 'sonner';
-import type { Message } from '@/api/types';
+import type { Chat, Message } from '@/api/types';
 import { api } from '@/api/client';
+import { sessionEvents } from '@/hooks/sessionEvents';
 import { ToolCallCard } from './ToolCallCard';
 import { CodeBlock } from './CodeBlock';
+import { Button } from '@/components/ui/button';
+import {
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle,
+} from '@/components/ui/dialog';
+
+// Match path-shaped substrings ending in `.ext`. Additionally require a `/`
+// in the match to reduce false positives in prose (e.g. plain `foo.ts` won't
+// match, but `src/foo.ts` will). False positives at the edges are accepted
+// per Sam's design decision (2026-05-14).
+const PATH_REGEX = /([a-zA-Z0-9._/-]+\.[a-zA-Z0-9]+)/g;
+
+function isPathLike(s: string): boolean {
+  return s.includes('/');
+}
+
+function emitOpenFile(path: string): void {
+  sessionEvents.emit({ type: 'open_file_in_browser', path });
+}
+
+// Split a plain string into a flat array of strings and clickable button
+// nodes for path-shaped substrings. If no matches, returns the original
+// string verbatim (no array wrapping).
+function linkifyPaths(text: string, keyPrefix: string): ReactNode {
+  const out: ReactNode[] = [];
+  let lastIdx = 0;
+  let idx = 0;
+  for (const match of text.matchAll(PATH_REGEX)) {
+    const matchedText = match[0];
+    const start = match.index ?? 0;
+    if (!isPathLike(matchedText)) continue;
+    if (start > lastIdx) out.push(text.slice(lastIdx, start));
+    out.push(
+      <button
+        key={`${keyPrefix}-${idx}`}
+        type="button"
+        onClick={() => emitOpenFile(matchedText)}
+        className="text-primary underline cursor-pointer hover:text-primary/80"
+      >
+        {matchedText}
+      </button>
+    );
+    lastIdx = start + matchedText.length;
+    idx += 1;
+  }
+  if (out.length === 0) return text;
+  if (lastIdx < text.length) out.push(text.slice(lastIdx));
+  return out;
+}
+
+// Walk react-markdown children, linkifying string text nodes. Children of
+// <code> nodes (CodeBlock and inline code) are left untouched — the regex
+// shouldn't run inside code spans.
+function linkifyChildren(children: ReactNode, keyPrefix = 'l'): ReactNode {
+  const arr = Children.toArray(children);
+  return arr.map((child, i) => {
+    if (typeof child === 'string') {
+      return (
+        <span key={`${keyPrefix}-${i}`}>
+          {linkifyPaths(child, `${keyPrefix}-${i}`)}
+        </span>
+      );
+    }
+    if (isValidElement(child)) {
+      const el = child as ReactElement<{ children?: ReactNode }>;
+      // Skip inline/block code — paths in code spans aren't link targets.
+      if (el.type === 'code' || el.type === CodeBlock) return child;
+      const grandchildren = el.props.children;
+      if (grandchildren === undefined) return child;
+      return cloneElement(el, {
+        key: el.key ?? `linkified-${i}`,
+        children: linkifyChildren(grandchildren, `${keyPrefix}-${i}`),
+      });
+    }
+    return child;
+  });
+}
 
 interface Props {
   message: Message;
-  sessionId: string;
+  sessionChats?: Chat[];
 }
 
 function MarkdownBody({ content }: { content: string }) {
@@ -55,7 +138,10 @@ function MarkdownBody({ content }: { content: string }) {
         ol: ({ children }) => (
           <ol className="list-decimal pl-5 space-y-1">{children}</ol>
         ),
-        p: ({ children }) => <p className="leading-relaxed">{children}</p>,
+        li: ({ children }) => <li>{linkifyChildren(children)}</li>,
+        p: ({ children }) => (
+          <p className="leading-relaxed">{linkifyChildren(children)}</p>
+        ),
         h1: ({ children }) => <h1 className="text-base font-semibold mt-2">{children}</h1>,
         h2: ({ children }) => <h2 className="text-sm font-semibold mt-2">{children}</h2>,
         h3: ({ children }) => <h3 className="text-sm font-semibold mt-1">{children}</h3>,
@@ -73,7 +159,9 @@ function MarkdownBody({ content }: { content: string }) {
           <th className="border border-border px-2 py-1 text-left font-medium">{children}</th>
         ),
         td: ({ children }) => (
-          <td className="border border-border px-2 py-1">{children}</td>
+          <td className="border border-border px-2 py-1">
+            {linkifyChildren(children)}
+          </td>
         ),
       }}
     >
@@ -114,13 +202,14 @@ function StatsLine({ message }: { message: Message }) {
 
 function ActionRow({
   message,
-  sessionId,
 }: {
   message: Message;
-  sessionId: string;
 }) {
   const [justCopied, setJustCopied] = useState(false);
   const [regenerating, setRegenerating] = useState(false);
+  const [forking, setForking] = useState(false);
+  const [deleteOpen, setDeleteOpen] = useState(false);
+  const [deleting, setDeleting] = useState(false);
 
   async function copy() {
     try {
@@ -136,7 +225,7 @@ function ActionRow({
     if (regenerating || message.status === 'streaming') return;
     setRegenerating(true);
     try {
-      await api.messages.regenerate(sessionId, message.id);
+      await api.messages.regenerate(message.chat_id, message.id);
     } catch (err) {
       toast.error(err instanceof Error ? err.message : 'regenerate failed');
     } finally {
@@ -144,37 +233,242 @@ function ActionRow({
     }
   }
 
+  async function fork() {
+    if (forking || message.status !== 'complete') return;
+    setForking(true);
+    try {
+      const chat = await api.chats.fork(message.chat_id, { messageId: message.id });
+      sessionEvents.emit({ type: 'open_chat_in_active_pane', chat_id: chat.id });
+    } catch (err) {
+      toast.error(err instanceof Error ? err.message : 'fork failed');
+    } finally {
+      setForking(false);
+    }
+  }
+
+  async function confirmDelete() {
+    if (deleting) return;
+    setDeleting(true);
+    try {
+      await api.messages.remove(message.chat_id, message.id);
+      setDeleteOpen(false);
+    } catch (err) {
+      toast.error(err instanceof Error ? err.message : 'delete failed');
+    } finally {
+      setDeleting(false);
+    }
+  }
+
   const isAssistant = message.role === 'assistant';
   const canRegen = isAssistant && message.status !== 'streaming';
+  const canFork = message.status === 'complete';
+  const canDelete = message.status !== 'streaming';
 
   return (
-    <div className="flex gap-1 opacity-0 group-hover:opacity-100 transition-opacity">
-      <button
-        type="button"
-        onClick={() => void copy()}
-        className="inline-flex items-center justify-center size-6 rounded text-muted-foreground hover:bg-muted hover:text-foreground"
-        aria-label="Copy message"
-        title="Copy"
-      >
-        {justCopied ? <Check className="size-3" /> : <Copy className="size-3" />}
-      </button>
-      {isAssistant && (
+    <>
+      <div className="flex gap-1 opacity-0 group-hover:opacity-100 transition-opacity max-md:opacity-100">
         <button
           type="button"
-          onClick={() => void regenerate()}
-          disabled={!canRegen || regenerating}
-          className="inline-flex items-center justify-center size-6 rounded text-muted-foreground hover:bg-muted hover:text-foreground disabled:opacity-40 disabled:cursor-not-allowed"
-          aria-label="Regenerate message"
-          title="Regenerate"
+          onClick={() => void copy()}
+          className="inline-flex items-center justify-center size-6 rounded text-muted-foreground hover:bg-muted hover:text-foreground max-md:min-h-[44px] max-md:min-w-[44px]"
+          aria-label="Copy message"
+          title="Copy"
         >
-          <RefreshCw className={`size-3 ${regenerating ? 'animate-spin' : ''}`} />
+          {justCopied ? <Check className="size-3" /> : <Copy className="size-3" />}
         </button>
+        {isAssistant && (
+          <button
+            type="button"
+            onClick={() => void regenerate()}
+            disabled={!canRegen || regenerating}
+            className="inline-flex items-center justify-center size-6 rounded text-muted-foreground hover:bg-muted hover:text-foreground disabled:opacity-40 disabled:cursor-not-allowed max-md:min-h-[44px] max-md:min-w-[44px]"
+            aria-label="Regenerate message"
+            title="Regenerate"
+          >
+            <RefreshCw className={`size-3 ${regenerating ? 'animate-spin' : ''}`} />
+          </button>
+        )}
+        <button
+          type="button"
+          onClick={() => void fork()}
+          disabled={!canFork || forking}
+          className="inline-flex items-center justify-center size-6 rounded text-muted-foreground hover:bg-muted hover:text-foreground disabled:opacity-40 disabled:cursor-not-allowed max-md:min-h-[44px] max-md:min-w-[44px]"
+          aria-label="Fork from here"
+          title="Fork from here"
+        >
+          <GitFork className="size-3" />
+        </button>
+        <button
+          type="button"
+          onClick={() => setDeleteOpen(true)}
+          disabled={!canDelete}
+          className="inline-flex items-center justify-center size-6 rounded text-muted-foreground hover:bg-muted hover:text-destructive disabled:opacity-40 disabled:cursor-not-allowed max-md:min-h-[44px] max-md:min-w-[44px]"
+          aria-label="Delete message"
+          title="Delete message"
+        >
+          <Trash2 className="size-3" />
+        </button>
+      </div>
+      <Dialog
+        open={deleteOpen}
+        onOpenChange={(open) => {
+          if (!deleting) setDeleteOpen(open);
+        }}
+      >
+        <DialogContent>
+          <DialogHeader>
+            <DialogTitle>Delete this message and all messages after it?</DialogTitle>
+            <DialogDescription>
+              This removes the selected message and every later message in this chat. This cannot be undone.
+            </DialogDescription>
+          </DialogHeader>
+          <DialogFooter>
+            <Button
+              variant="outline"
+              onClick={() => setDeleteOpen(false)}
+              disabled={deleting}
+            >
+              Cancel
+            </Button>
+            <Button
+              variant="destructive"
+              onClick={() => void confirmDelete()}
+              disabled={deleting}
+            >
+              {deleting ? 'Deleting…' : 'Delete'}
+            </Button>
+          </DialogFooter>
+        </DialogContent>
+      </Dialog>
+    </>
+  );
+}
+
+function CompactCard({ message, sessionChats }: { message: Message; sessionChats?: Chat[] }) {
+  const [expanded, setExpanded] = useState(false);
+  const [copied, setCopied] = useState(false);
+  const [shareOpen, setShareOpen] = useState(false);
+  const [rerunning, setRerunning] = useState(false);
+
+  const headerMatch = message.content.match(/^\[Context compacted — (\d+) messages summarized\]/);
+  const headerText = headerMatch ? headerMatch[0] : 'Context compacted';
+  const summaryText = headerMatch
+    ? message.content.slice(headerMatch[0].length).trim()
+    : message.content;
+
+  async function handleCopy() {
+    try {
+      await navigator.clipboard.writeText(summaryText);
+      setCopied(true);
+      setTimeout(() => setCopied(false), 1200);
+      toast.success('Summary copied to clipboard');
+    } catch {
+      toast.error('Copy failed');
+    }
+  }
+
+  async function handleShareToChat(chat: Chat) {
+    try {
+      await api.messages.send(chat.id, summaryText);
+      toast.success(`Summary sent to ${chat.name ?? 'New chat'}`);
+      setShareOpen(false);
+    } catch (err) {
+      toast.error(err instanceof Error ? err.message : 'Failed to share');
+    }
+  }
+
+  async function handleRerun() {
+    if (rerunning) return;
+    setRerunning(true);
+    try {
+      await api.chats.compact(message.chat_id);
+    } catch (err) {
+      toast.error(err instanceof Error ? err.message : 'Re-run failed');
+    } finally {
+      setRerunning(false);
+    }
+  }
+
+  const otherChats = (sessionChats ?? []).filter(
+    (c) => c.id !== message.chat_id && c.status === 'open'
+  );
+
+  return (
+    <div className="rounded-lg border bg-muted/30 text-sm">
+      <div className="flex items-center gap-2 px-3 py-2">
+        <button
+          type="button"
+          onClick={() => setExpanded(!expanded)}
+          className="flex items-center gap-1.5 flex-1 min-w-0 text-left text-muted-foreground hover:text-foreground"
+        >
+          {expanded ? <ChevronDown size={14} /> : <ChevronRight size={14} />}
+          <span className="text-xs font-medium truncate">{headerText}</span>
+        </button>
+        <button
+          type="button"
+          onClick={() => void handleCopy()}
+          className="p-1 rounded hover:bg-muted text-muted-foreground"
+          aria-label="Copy summary"
+          title="Copy summary"
+        >
+          {copied ? <Check size={12} /> : <Copy size={12} />}
+        </button>
+        <div className="relative">
+          <button
+            type="button"
+            onClick={() => setShareOpen(!shareOpen)}
+            className="p-1 rounded hover:bg-muted text-muted-foreground"
+            aria-label="Send to chat"
+            title="Send to chat"
+          >
+            <Share2 size={12} />
+          </button>
+          {shareOpen && (
+            <div className="absolute right-0 top-full mt-1 z-50 bg-popover border rounded-md shadow-md min-w-[180px] py-1">
+              {otherChats.length === 0 ? (
+                <div className="px-3 py-1.5 text-xs text-muted-foreground">
+                  No other chats in this session
+                </div>
+              ) : (
+                otherChats.map((c) => (
+                  <button
+                    key={c.id}
+                    type="button"
+                    onClick={() => void handleShareToChat(c)}
+                    className="w-full text-left px-3 py-1.5 text-xs hover:bg-accent truncate"
+                  >
+                    {c.name ?? 'New chat'}
+                  </button>
+                ))
+              )}
+            </div>
+          )}
+        </div>
+        <button
+          type="button"
+          onClick={() => void handleRerun()}
+          disabled={rerunning}
+          className="p-1 rounded hover:bg-muted text-muted-foreground disabled:opacity-40"
+          aria-label="Re-run compact"
+          title="Re-run compact"
+        >
+          <RotateCw size={12} className={rerunning ? 'animate-spin' : ''} />
+        </button>
+      </div>
+      {expanded && (
+        <div className="px-3 pb-3 text-xs leading-relaxed text-muted-foreground whitespace-pre-wrap border-t pt-2">
+          {summaryText}
+        </div>
       )}
     </div>
   );
 }
 
-export function MessageBubble({ message, sessionId }: Props) {
+export function MessageBubble({ message, sessionChats }: Props) {
+  if (message.kind === 'compact') {
+    return <CompactCard message={message} sessionChats={sessionChats} />;
+  }
+
   if (message.role === 'tool') {
     return <ToolCallCard message={message} />;
   }
@@ -182,10 +476,10 @@ export function MessageBubble({ message, sessionId }: Props) {
   if (message.role === 'user') {
     return (
       <div className="group flex flex-col items-end gap-1">
-        <div className="max-w-[80%] rounded-lg bg-primary text-primary-foreground px-3 py-2 text-sm whitespace-pre-wrap">
+        <div className="max-w-[80%] rounded-lg bg-primary text-primary-foreground px-3 py-2 text-sm whitespace-pre-wrap break-words min-w-0">
           {message.content}
         </div>
-        <ActionRow message={message} sessionId={sessionId} />
+        <ActionRow message={message} />
       </div>
     );
   }
@@ -201,7 +495,7 @@ export function MessageBubble({ message, sessionId }: Props) {
         <ToolCallCard key={tc.id} toolCall={tc} />
       ))}
       {(hasContent || (!hasToolCalls && isStreaming)) && (
-        <div className="max-w-[90%] text-sm leading-relaxed space-y-2">
+        <div className="max-w-[90%] text-sm leading-relaxed space-y-2 break-words min-w-0">
           {hasContent ? <MarkdownBody content={message.content} /> : null}
           {isStreaming && (
             <span className="inline-block w-1.5 h-3.5 align-baseline bg-muted-foreground/60 animate-pulse" />
@@ -213,7 +507,7 @@ export function MessageBubble({ message, sessionId }: Props) {
       )}
       {!isStreaming && <StatsLine message={message} />}
       {!isStreaming && (hasContent || hasToolCalls) && (
-        <ActionRow message={message} sessionId={sessionId} />
+        <ActionRow message={message} />
       )}
     </div>
   );

apps/web/src/components/MessageList.tsx

@@ -1,13 +1,13 @@
 import { useEffect, useRef } from 'react';
-import type { Message } from '@/api/types';
+import type { Chat, Message } from '@/api/types';
 import { MessageBubble } from './MessageBubble';
 
 interface Props {
   messages: Message[];
-  sessionId: string;
+  sessionChats?: Chat[];
 }
 
-export function MessageList({ messages, sessionId }: Props) {
+export function MessageList({ messages, sessionChats }: Props) {
   const endRef = useRef<HTMLDivElement>(null);
 
   useEffect(() => {
@@ -23,11 +23,13 @@ export function MessageList({ messages, sessionId }: Props) {
   }
 
   return (
-    <div className="flex-1 overflow-y-auto px-6 py-4 space-y-4">
-      {messages.map((m) => (
-        <MessageBubble key={m.id} message={m} sessionId={sessionId} />
-      ))}
-      <div ref={endRef} />
+    <div className="flex-1 overflow-y-auto">
+      <div className="max-w-[1000px] mx-auto w-full px-6 py-4 space-y-4">
+        {messages.map((m) => (
+          <MessageBubble key={m.id} message={m} sessionChats={sessionChats} />
+        ))}
+        <div ref={endRef} />
+      </div>
     </div>
   );
 }

apps/web/src/components/ProjectSidebar.tsx

@@ -1,19 +1,31 @@
 import { useEffect, useMemo, useRef, useState } from 'react';
 import { NavLink, useLocation, useNavigate } from 'react-router-dom';
-import { ChevronRight, Folder, MessageSquare, Plus } from 'lucide-react';
+import { ChevronRight, ExternalLink, Folder, MessageSquare, Plus } from 'lucide-react';
 import { toast } from 'sonner';
 import { Button } from '@/components/ui/button';
 import {
-  DropdownMenu,
-  DropdownMenuContent,
-  DropdownMenuItem,
-  DropdownMenuTrigger,
-} from '@/components/ui/dropdown-menu';
+  ContextMenu,
+  ContextMenuContent,
+  ContextMenuItem,
+  ContextMenuSeparator,
+  ContextMenuTrigger,
+} from '@/components/ui/context-menu';
+import {
+  Dialog,
+  DialogContent,
+  DialogHeader,
+  DialogTitle,
+  DialogDescription,
+} from '@/components/ui/dialog';
 import { AddProjectModal } from './AddProjectModal';
 import { api } from '@/api/client';
-import { sessionEvents } from '@/hooks/sessionEvents';
 import { useSidebar } from '@/hooks/useSidebar';
+import { useSidebarDrawer } from '@/hooks/useSidebarDrawer';
+import { useViewport } from '@/hooks/useViewport';
+import { usePullToRefresh } from '@/hooks/usePullToRefresh';
 import type { SidebarProject } from '@/api/types';
+import { giteaUrlFor } from '@/lib/projectUrls';
+import { cn } from '@/lib/utils';
 
 const EXPANDED_KEY = 'boocode.sidebar.expanded';
 const MAX_VISIBLE_SESSIONS = 5;
@@ -55,13 +67,29 @@ function relTime(iso: string): string {
   return `${Math.floor(mo / 12)}y`;
 }
 
-function activeProjectId(pathname: string, projects: SidebarProject[]): string | null {
+function activeProjectId(
+  pathname: string,
+  projects: SidebarProject[],
+  activeSession: { session_id: string; project_id: string } | null
+): string | null {
   const pm = pathname.match(/^\/project\/([^/]+)/);
   if (pm?.[1]) return pm[1];
   const sm = pathname.match(/^\/session\/([^/]+)/);
   const sid = sm?.[1];
   if (!sid) return null;
-  return projects.find((p) => p.recent_sessions.some((s) => s.id === sid))?.id ?? null;
+  // Prefer the cache lookup so we resolve correctly even when an older
+  // activeSession (from a prior route) hasn't been cleared yet.
+  const fromCache = projects.find((p) =>
+    p.recent_sessions.some((s) => s.id === sid)
+  )?.id;
+  if (fromCache) return fromCache;
+  // Fallback: the session was loaded via deep link (not in cache) and
+  // emitted session_loaded — use that. Guard against stale values by
+  // matching the current URL sid.
+  if (activeSession && activeSession.session_id === sid) {
+    return activeSession.project_id;
+  }
+  return null;
 }
 
 function activeSessionId(pathname: string): string | null {
@@ -70,9 +98,16 @@ function activeSessionId(pathname: string): string | null {
 }
 
 export function ProjectSidebar() {
-  const { data, error, loading, retry } = useSidebar();
+  const { data, error, loading, retry, activeSession: loadedActiveSession } =
+    useSidebar();
   const [addOpen, setAddOpen] = useState(false);
   const [expanded, setExpanded] = useState<Set<string>>(() => readExpanded());
+  const [renamingSession, setRenamingSession] = useState<string | null>(null);
+  const [renameValue, setRenameValue] = useState('');
+  const [deleteConfirm, setDeleteConfirm] = useState<{ id: string; name: string } | null>(null);
+  const [renamingProject, setRenamingProject] = useState<string | null>(null);
+  const [renameProjectValue, setRenameProjectValue] = useState('');
+  const [archiveProjectConfirm, setArchiveProjectConfirm] = useState<{ id: string; name: string } | null>(null);
   const navigate = useNavigate();
   const location = useLocation();
   const lastToastedError = useRef<string | null>(null);
@@ -87,8 +122,8 @@ export function ProjectSidebar() {
 
   const projects = data?.projects ?? [];
   const activeProject = useMemo(
-    () => activeProjectId(location.pathname, projects),
-    [location.pathname, projects]
+    () => activeProjectId(location.pathname, projects, loadedActiveSession),
+    [location.pathname, projects, loadedActiveSession]
   );
   const activeSession = useMemo(
     () => activeSessionId(location.pathname),
@@ -105,21 +140,82 @@ export function ProjectSidebar() {
     });
   }
 
-  async function handleRemove(id: string) {
+  async function handleArchiveProject(id: string) {
     try {
-      await api.projects.remove(id);
-      sessionEvents.emit({ type: 'project_deleted', project_id: id });
-      navigate('/');
+      await api.projects.archive(id);
+      // Server publishes project_archived via WS.
+      if (activeProject === id) navigate('/');
     } catch (err) {
-      toast.error(err instanceof Error ? err.message : 'failed to remove project');
+      toast.error(err instanceof Error ? err.message : 'failed to archive project');
+    }
+  }
+
+  async function handleRenameProject(id: string) {
+    const trimmed = renameProjectValue.trim();
+    setRenamingProject(null);
+    if (!trimmed) return;
+    try {
+      await api.projects.update(id, { name: trimmed });
+      // Server publishes project_updated via WS.
+    } catch (err) {
+      toast.error(err instanceof Error ? err.message : 'failed to rename project');
+    }
+  }
+
+  async function handleArchiveSession(sessionId: string, projectId: string) {
+    try {
+      await api.sessions.archive(sessionId);
+      // Server publishes session_archived via WS; useUserEvents delivers it.
+      if (activeSession === sessionId) navigate(`/project/${projectId}`);
+    } catch (err) {
+      toast.error(err instanceof Error ? err.message : 'failed to archive session');
+    }
+  }
+
+  async function handleDeleteSession(sessionId: string, projectId: string) {
+    try {
+      await api.sessions.remove(sessionId);
+      // Server publishes session_deleted via WS; useUserEvents delivers it.
+      if (activeSession === sessionId) navigate(`/project/${projectId}`);
+    } catch (err) {
+      toast.error(err instanceof Error ? err.message : 'failed to delete session');
+    }
+  }
+
+  async function handleRenameSession(sessionId: string) {
+    const trimmed = renameValue.trim();
+    setRenamingSession(null);
+    if (!trimmed) return;
+    try {
+      await api.sessions.update(sessionId, { name: trimmed });
+      // Server publishes session_renamed via broker.publishUser; useUserEvents
+      // forwards onto the bus. No local emit needed.
+    } catch (err) {
+      toast.error(err instanceof Error ? err.message : 'failed to rename session');
     }
   }
 
   const rowCls = (active: boolean) =>
     active ? 'bg-sidebar-accent text-sidebar-accent-foreground' : 'hover:bg-sidebar-accent/60';
 
+  const { open: drawerOpen } = useSidebarDrawer();
+  const { isMobile } = useViewport();
+  const pull = usePullToRefresh(() => retry(), { enabled: isMobile });
+
+  // On mobile the sidebar is a slide-in drawer (fixed, z-40, off-screen by
+  // default). On desktop it sits inline as a normal flex column. The
+  // backdrop is rendered by AppShell; drawer-open state lives in
+  // SidebarDrawerProvider.
+  const asideCls = isMobile
+    ? cn(
+        'fixed inset-y-0 left-0 z-40 w-60 border-r bg-sidebar text-sidebar-foreground flex flex-col',
+        'transition-transform duration-200 ease-out',
+        drawerOpen ? 'translate-x-0' : '-translate-x-full',
+      )
+    : 'w-60 shrink-0 border-r bg-sidebar text-sidebar-foreground flex flex-col h-screen';
+
   return (
-    <aside className="w-60 shrink-0 border-r bg-sidebar text-sidebar-foreground flex flex-col h-screen">
+    <aside className={asideCls}>
       <div className="px-4 py-3 border-b flex items-center justify-between">
         <NavLink to="/" className="font-semibold tracking-tight text-base">
           BooCode
@@ -129,7 +225,30 @@ export function ProjectSidebar() {
         </Button>
       </div>
 
-      <nav className="flex-1 overflow-y-auto py-2">
+      {isMobile && (pull.pullDist > 0 || pull.refreshing) && (
+        <div
+          className="flex items-center justify-center text-[10px] uppercase tracking-wide text-muted-foreground border-b overflow-hidden shrink-0"
+          style={{
+            height: pull.refreshing ? 32 : Math.min(pull.pullDist, 80),
+            transition: pull.pullDist === 0 && !pull.refreshing ? 'height 0.2s ease' : undefined,
+          }}
+          aria-live="polite"
+        >
+          {pull.refreshing
+            ? 'Refreshing…'
+            : pull.pullDist >= 80
+            ? 'Release to refresh'
+            : 'Pull to refresh'}
+        </div>
+      )}
+
+      <nav
+        className="flex-1 overflow-y-auto py-2"
+        onTouchStart={isMobile ? pull.onTouchStart : undefined}
+        onTouchMove={isMobile ? pull.onTouchMove : undefined}
+        onTouchEnd={isMobile ? pull.onTouchEnd : undefined}
+        onTouchCancel={isMobile ? pull.onTouchEnd : undefined}
+      >
         {loading && data == null && (
           <div className="space-y-2 px-2">
             {[0, 1, 2, 3].map((i) => (
@@ -157,61 +276,126 @@ export function ProjectSidebar() {
             const visible = p.recent_sessions.slice(0, MAX_VISIBLE_SESSIONS);
             return (
               <div key={p.id} className="px-2">
-                <DropdownMenu>
-                  <div
-                    className={`group flex items-center gap-1 rounded-md px-2 py-1.5 text-sm ${rowCls(isActiveProject)}`}
-                    onContextMenu={(e) => {
-                      e.preventDefault();
-                      (
-                        e.currentTarget.parentElement?.querySelector(
-                          '[data-ctxtrigger]'
-                        ) as HTMLElement | null
-                      )?.click();
-                    }}
-                  >
-                    <button
-                      type="button"
-                      aria-label={isExpanded ? 'Collapse' : 'Expand'}
-                      aria-expanded={isExpanded}
-                      onClick={(e) => {
-                        e.stopPropagation();
-                        toggle(p.id);
-                      }}
-                      className="flex items-center justify-center size-4 shrink-0 opacity-70 hover:opacity-100"
+                <ContextMenu>
+                  <ContextMenuTrigger asChild>
+                    <div
+                      className={`group flex items-center gap-1 rounded-md px-2 py-1.5 text-sm ${rowCls(isActiveProject)}`}
                     >
-                      <ChevronRight
-                        className={`size-3.5 transition-transform ${isExpanded ? 'rotate-90' : ''}`}
-                      />
-                    </button>
-                    <NavLink to={`/project/${p.id}`} className="flex items-center gap-2 min-w-0 flex-1">
-                      <Folder className="size-3.5 shrink-0 opacity-70" />
-                      <span className="truncate" title={p.name}>{p.name}</span>
-                    </NavLink>
-                  </div>
-                  <DropdownMenuTrigger asChild>
-                    <button data-ctxtrigger className="hidden" aria-hidden />
-                  </DropdownMenuTrigger>
-                  <DropdownMenuContent align="start">
-                    <DropdownMenuItem variant="destructive" onClick={() => void handleRemove(p.id)}>
-                      Remove from sidebar
-                    </DropdownMenuItem>
-                  </DropdownMenuContent>
-                </DropdownMenu>
+                      <button
+                        type="button"
+                        aria-label={isExpanded ? 'Collapse' : 'Expand'}
+                        aria-expanded={isExpanded}
+                        disabled={isActiveProject}
+                        onClick={(e) => {
+                          e.stopPropagation();
+                          if (isActiveProject) return;
+                          toggle(p.id);
+                        }}
+                        className={cn(
+                          'flex items-center justify-center size-4 shrink-0 opacity-70 hover:opacity-100',
+                          isActiveProject &&
+                            'opacity-50 cursor-not-allowed hover:opacity-50'
+                        )}
+                      >
+                        <ChevronRight
+                          className={`size-3.5 transition-transform ${isExpanded ? 'rotate-90' : ''}`}
+                        />
+                      </button>
+                      {renamingProject === p.id ? (
+                        <div className="flex items-center gap-2 min-w-0 flex-1">
+                          <Folder className="size-3.5 shrink-0 opacity-70" />
+                          <input
+                            autoFocus
+                            value={renameProjectValue}
+                            onChange={(e) => setRenameProjectValue(e.target.value)}
+                            onBlur={() => void handleRenameProject(p.id)}
+                            onKeyDown={(e) => {
+                              if (e.key === 'Enter') void handleRenameProject(p.id);
+                              if (e.key === 'Escape') setRenamingProject(null);
+                            }}
+                            className="bg-transparent border-b border-border text-sm outline-none flex-1 min-w-0"
+                          />
+                        </div>
+                      ) : (
+                        <NavLink to={`/project/${p.id}`} className="flex items-center gap-2 min-w-0 flex-1">
+                          <Folder className="size-3.5 shrink-0 opacity-70" />
+                          <span className="truncate" title={p.name}>{p.name}</span>
+                        </NavLink>
+                      )}
+                    </div>
+                  </ContextMenuTrigger>
+                  <ContextMenuContent>
+                    <ContextMenuItem onSelect={() => {
+                      setRenamingProject(p.id);
+                      setRenameProjectValue(p.name);
+                    }}>
+                      Rename
+                    </ContextMenuItem>
+                    <ContextMenuItem onSelect={() => setArchiveProjectConfirm({ id: p.id, name: p.name })}>
+                      Archive
+                    </ContextMenuItem>
+                    <ContextMenuSeparator />
+                    <ContextMenuItem onSelect={() => {
+                      const url = giteaUrlFor({ path: p.path, gitea_remote: p.gitea_remote });
+                      window.open(url, '_blank', 'noopener');
+                    }}>
+                      <ExternalLink size={12} /> Open in Gitea
+                    </ContextMenuItem>
+                  </ContextMenuContent>
+                </ContextMenu>
 
                 {isExpanded && (
                   <div className="ml-5 mt-0.5 space-y-0.5">
                     {visible.map((s) => (
-                      <NavLink
-                        key={s.id}
-                        to={`/session/${s.id}`}
-                        className={`flex items-center gap-2 rounded-md px-2 py-1 text-sm min-w-0 ${rowCls(activeSession === s.id)}`}
-                      >
-                        <MessageSquare className="size-3.5 shrink-0 opacity-70" />
-                        <span className="truncate flex-1" title={s.name}>{s.name}</span>
-                        <span className="text-xs text-muted-foreground shrink-0 tabular-nums">
-                          {relTime(s.updated_at)}
-                        </span>
-                      </NavLink>
+                      <ContextMenu key={s.id}>
+                        <ContextMenuTrigger asChild>
+                          {renamingSession === s.id ? (
+                            <div className={`flex items-center gap-2 rounded-md px-2 py-1 text-sm min-w-0 ${rowCls(activeSession === s.id)}`}>
+                              <MessageSquare className="size-3.5 shrink-0 opacity-70" />
+                              <input
+                                autoFocus
+                                value={renameValue}
+                                onChange={(e) => setRenameValue(e.target.value)}
+                                onBlur={() => void handleRenameSession(s.id)}
+                                onKeyDown={(e) => {
+                                  if (e.key === 'Enter') void handleRenameSession(s.id);
+                                  if (e.key === 'Escape') setRenamingSession(null);
+                                }}
+                                className="bg-transparent border-b border-border text-sm outline-none flex-1 min-w-0"
+                              />
+                            </div>
+                          ) : (
+                            <NavLink
+                              to={`/session/${s.id}`}
+                              className={`flex items-center gap-2 rounded-md px-2 py-1 text-sm min-w-0 ${rowCls(activeSession === s.id)}`}
+                            >
+                              <MessageSquare className="size-3.5 shrink-0 opacity-70" />
+                              <span className="truncate flex-1" title={s.name}>{s.name}</span>
+                              <span className="text-xs text-muted-foreground shrink-0 tabular-nums">
+                                {relTime(s.updated_at)}
+                              </span>
+                            </NavLink>
+                          )}
+                        </ContextMenuTrigger>
+                        <ContextMenuContent>
+                          <ContextMenuItem onSelect={() => {
+                            setRenamingSession(s.id);
+                            setRenameValue(s.name);
+                          }}>
+                            Rename
+                          </ContextMenuItem>
+                          <ContextMenuItem onSelect={() => void handleArchiveSession(s.id, p.id)}>
+                            Archive
+                          </ContextMenuItem>
+                          <ContextMenuSeparator />
+                          <ContextMenuItem
+                            variant="destructive"
+                            onSelect={() => setDeleteConfirm({ id: s.id, name: s.name })}
+                          >
+                            Delete
+                          </ContextMenuItem>
+                        </ContextMenuContent>
+                      </ContextMenu>
                     ))}
                     {p.total_sessions > MAX_VISIBLE_SESSIONS && (
                       <NavLink
@@ -229,6 +413,60 @@ export function ProjectSidebar() {
       </nav>
 
       <AddProjectModal open={addOpen} onOpenChange={setAddOpen} onAdded={() => {}} />
+
+      <Dialog open={archiveProjectConfirm !== null} onOpenChange={(open) => { if (!open) setArchiveProjectConfirm(null); }}>
+        <DialogContent>
+          <DialogHeader>
+            <DialogTitle>Archive project?</DialogTitle>
+            <DialogDescription>
+              Removes {archiveProjectConfirm ? `"${archiveProjectConfirm.name}"` : 'this project'} from the sidebar. Files on disk are untouched. You can restore it later from the Archived Projects view.
+            </DialogDescription>
+          </DialogHeader>
+          <div className="flex gap-2 justify-end pt-2">
+            <Button variant="outline" onClick={() => setArchiveProjectConfirm(null)}>
+              Cancel
+            </Button>
+            <Button
+              onClick={() => {
+                if (archiveProjectConfirm) void handleArchiveProject(archiveProjectConfirm.id);
+                setArchiveProjectConfirm(null);
+              }}
+            >
+              Archive
+            </Button>
+          </div>
+        </DialogContent>
+      </Dialog>
+
+      <Dialog open={deleteConfirm !== null} onOpenChange={(open) => { if (!open) setDeleteConfirm(null); }}>
+        <DialogContent>
+          <DialogHeader>
+            <DialogTitle>Delete session?</DialogTitle>
+            <DialogDescription>
+              This will permanently delete {deleteConfirm ? `"${deleteConfirm.name}"` : 'this session'} and all its chats and messages. This cannot be undone.
+            </DialogDescription>
+          </DialogHeader>
+          <div className="flex gap-2 justify-end pt-2">
+            <Button variant="outline" onClick={() => setDeleteConfirm(null)}>
+              Cancel
+            </Button>
+            <Button
+              variant="destructive"
+              onClick={() => {
+                if (deleteConfirm) {
+                  const projectId = projects.find((p) =>
+                    p.recent_sessions.some((s) => s.id === deleteConfirm.id)
+                  )?.id;
+                  if (projectId) void handleDeleteSession(deleteConfirm.id, projectId);
+                }
+                setDeleteConfirm(null);
+              }}
+            >
+              Delete
+            </Button>
+          </div>
+        </DialogContent>
+      </Dialog>
     </aside>
   );
 }

apps/web/src/components/RightRail.tsx

@@ -0,0 +1,295 @@
+import { useCallback, useEffect, useMemo, useState } from 'react';
+import { ChevronRight, ChevronDown, FileText, Folder, PanelRightClose, PanelRightOpen } from 'lucide-react';
+import { api } from '@/api/client';
+import type { FileEntry } from '@/api/types';
+import { inferLanguage } from '@/lib/attachments';
+import { sessionEvents } from '@/hooks/sessionEvents';
+import { useRightRailDrawer } from '@/hooks/useRightRailDrawer';
+import { useViewport } from '@/hooks/useViewport';
+import { FileViewerOverlay } from '@/components/FileViewerOverlay';
+import { Input } from '@/components/ui/input';
+import { cn } from '@/lib/utils';
+
+interface Props {
+  projectId: string;
+}
+
+const STORAGE_KEY = 'boocode.rightrail';
+
+function basename(path: string): string {
+  if (!path) return '';
+  const parts = path.split('/');
+  return parts[parts.length - 1] ?? path;
+}
+
+function joinPath(parent: string, name: string): string {
+  if (!parent || parent === '.' || parent === '') return name;
+  return `${parent}/${name}`;
+}
+
+export function RightRail({ projectId }: Props) {
+  const { isMobile } = useViewport();
+  const { open: drawerOpen, setOpen: setDrawerOpen } = useRightRailDrawer();
+  const [open, setOpen] = useState(() => {
+    try { return localStorage.getItem(`${STORAGE_KEY}.open`) !== 'false'; } catch { return true; }
+  });
+  const [filter, setFilter] = useState('');
+  const [expandedDirs, setExpandedDirs] = useState<Set<string>>(new Set());
+  const [cache, setCache] = useState<Map<string, FileEntry[]>>(new Map());
+  const [fullFileList, setFullFileList] = useState<string[] | null>(null);
+  const [viewerFile, setViewerFile] = useState<{ path: string; content: string } | null>(null);
+
+  // Combined open state: on mobile use the global drawer state (toggled by
+  // the Session header's FolderTree button); on desktop use the persistent
+  // internal state.
+  const isOpen = isMobile ? drawerOpen : open;
+  const closeRail = useCallback(() => {
+    if (isMobile) setDrawerOpen(false);
+    else setOpen(false);
+  }, [isMobile, setDrawerOpen]);
+  const openRail = useCallback(() => {
+    if (isMobile) setDrawerOpen(true);
+    else setOpen(true);
+  }, [isMobile, setDrawerOpen]);
+
+  useEffect(() => {
+    // best-effort; ignore failure because localStorage may be unavailable (quota, private mode)
+    try { localStorage.setItem(`${STORAGE_KEY}.open`, String(open)); } catch {}
+  }, [open]);
+
+  useEffect(() => {
+    let cancelled = false;
+    api.projects.files(projectId).then((r) => {
+      if (!cancelled) setFullFileList(r.files);
+    }).catch(() => {});
+    return () => { cancelled = true; };
+  }, [projectId]);
+
+  const loadDir = useCallback(async (dirPath: string) => {
+    const apiPath = dirPath === '' ? '.' : dirPath;
+    try {
+      const result = await api.projects.listDir(projectId, apiPath);
+      setCache((prev) => { const next = new Map(prev); next.set(dirPath, result.entries); return next; });
+    } catch { /* ignore */ }
+  }, [projectId]);
+
+  useEffect(() => {
+    if (!isOpen) return;
+    if (!cache.has('')) void loadDir('');
+  }, [isOpen, cache, loadDir]);
+
+  function toggleDir(dirPath: string) {
+    setExpandedDirs((prev) => {
+      const next = new Set(prev);
+      if (next.has(dirPath)) {
+        next.delete(dirPath);
+      } else {
+        next.add(dirPath);
+        if (!cache.has(dirPath)) void loadDir(dirPath);
+      }
+      return next;
+    });
+  }
+
+  async function openFile(path: string) {
+    try {
+      const result = await api.projects.viewFile(projectId, path);
+      setViewerFile({ path, content: result.content });
+    } catch { /* ignore */ }
+  }
+
+  // Filter results
+  const trimmed = filter.trim().toLowerCase();
+  const filterActive = trimmed.length > 0;
+
+  interface FilterResult { path: string; name: string; }
+
+  const filterResults = useMemo<FilterResult[]>(() => {
+    if (!filterActive) return [];
+    if (fullFileList) {
+      const filenameMatches: string[] = [];
+      const pathOnly: string[] = [];
+      for (const p of fullFileList) {
+        const lp = p.toLowerCase();
+        if (!lp.includes(trimmed)) continue;
+        if (basename(p).toLowerCase().includes(trimmed)) filenameMatches.push(p);
+        else pathOnly.push(p);
+      }
+      filenameMatches.sort((a, b) => a.localeCompare(b));
+      pathOnly.sort((a, b) => a.localeCompare(b));
+      return [...filenameMatches, ...pathOnly].slice(0, 50).map((p) => ({ path: p, name: basename(p) }));
+    }
+    return [];
+  }, [filterActive, trimmed, fullFileList]);
+
+  // Listen for open_file_in_browser events
+  useEffect(() => {
+    return sessionEvents.subscribe((event) => {
+      if (event.type !== 'open_file_in_browser') return;
+      if (!isOpen) openRail();
+      void openFile(event.path);
+    });
+  }, [isOpen, openRail, projectId]);
+
+  // Desktop closed state: render the floating chevron handle. Mobile never
+  // shows the handle — the toggle lives in the Session header on mobile.
+  if (!isMobile && !open) {
+    return (
+      <button
+        type="button"
+        onClick={() => setOpen(true)}
+        className="shrink-0 border-l bg-sidebar p-2 hover:bg-muted"
+        aria-label="Open file browser"
+      >
+        <PanelRightOpen size={16} />
+      </button>
+    );
+  }
+
+  const rootEntries = cache.get('') ?? [];
+
+  // Mobile: render as fixed-position right-side drawer (always mounted so
+  // the transform transition can animate in/out). Desktop: inline aside.
+  const asideCls = isMobile
+    ? cn(
+        'fixed inset-y-0 right-0 z-40 w-[85vw] max-w-sm border-l bg-sidebar flex flex-col overflow-hidden',
+        'transition-transform duration-200 ease-out',
+        drawerOpen ? 'translate-x-0' : 'translate-x-full',
+      )
+    : 'w-64 shrink-0 border-l bg-sidebar flex flex-col h-full overflow-hidden';
+
+  return (
+    <>
+      <aside className={asideCls}>
+        <div className="flex items-center gap-2 px-3 py-2 border-b shrink-0">
+          <span className="text-xs font-medium flex-1">Files</span>
+          <button
+            type="button"
+            onClick={closeRail}
+            className="p-1 rounded hover:bg-muted text-muted-foreground max-md:min-h-[44px] max-md:min-w-[44px]"
+            aria-label="Close file browser"
+          >
+            <PanelRightClose size={14} />
+          </button>
+        </div>
+        <div className="px-2 py-1.5 shrink-0">
+          <Input
+            value={filter}
+            onChange={(e) => setFilter(e.target.value)}
+            placeholder="Filter files..."
+            className="h-7 text-xs"
+          />
+        </div>
+        <div className="flex-1 overflow-y-auto px-1 py-1">
+          {filterActive ? (
+            filterResults.length > 0 ? (
+              <ul className="list-none space-y-0.5">
+                {filterResults.map((r) => (
+                  <li key={r.path}>
+                    <button
+                      type="button"
+                      className="w-full flex items-center gap-1 px-2 py-1 text-xs rounded hover:bg-muted/60 text-left"
+                      onClick={() => void openFile(r.path)}
+                    >
+                      <FileText size={12} className="text-muted-foreground shrink-0" />
+                      <span className="font-bold truncate">{r.name}</span>
+                      <span className="text-muted-foreground ml-1 truncate">{r.path}</span>
+                    </button>
+                  </li>
+                ))}
+              </ul>
+            ) : (
+              <div className="text-xs text-muted-foreground px-2 py-4 text-center">No matches</div>
+            )
+          ) : (
+            <TreeLevel
+              parentPath=""
+              entries={rootEntries}
+              cache={cache}
+              expanded={expandedDirs}
+              depth={0}
+              onToggleDir={toggleDir}
+              onSelectFile={(path) => void openFile(path)}
+            />
+          )}
+        </div>
+      </aside>
+
+      {viewerFile && (
+        <FileViewerOverlay
+          path={viewerFile.path}
+          content={viewerFile.content}
+          lang={inferLanguage(viewerFile.path)}
+          projectId={projectId}
+          onClose={() => setViewerFile(null)}
+          onNavigate={(path) => void openFile(path)}
+        />
+      )}
+    </>
+  );
+}
+
+interface TreeLevelProps {
+  parentPath: string;
+  entries: FileEntry[];
+  cache: Map<string, FileEntry[]>;
+  expanded: Set<string>;
+  depth: number;
+  onToggleDir: (dirPath: string) => void;
+  onSelectFile: (path: string) => void;
+}
+
+function TreeLevel({ parentPath, entries, cache, expanded, depth, onToggleDir, onSelectFile }: TreeLevelProps) {
+  const sorted = useMemo(() => {
+    const copy = [...entries];
+    copy.sort((a, b) => {
+      if (a.kind !== b.kind) return a.kind === 'dir' ? -1 : 1;
+      return a.name.localeCompare(b.name);
+    });
+    return copy;
+  }, [entries]);
+
+  return (
+    <ul className="list-none">
+      {sorted.map((entry) => {
+        const fullPath = joinPath(parentPath, entry.name);
+        const isExpanded = entry.kind === 'dir' && expanded.has(fullPath);
+        return (
+          <li key={fullPath}>
+            <div
+              className="flex items-center gap-1 px-1 py-0.5 text-xs cursor-default rounded hover:bg-muted/60"
+              style={{ paddingLeft: 4 + depth * 12 }}
+              onClick={() => {
+                if (entry.kind === 'dir') onToggleDir(fullPath);
+                else onSelectFile(fullPath);
+              }}
+            >
+              {entry.kind === 'dir' ? (
+                isExpanded ? <ChevronDown size={10} className="shrink-0" /> : <ChevronRight size={10} className="shrink-0" />
+              ) : (
+                <span className="w-[10px] shrink-0" />
+              )}
+              {entry.kind === 'dir' ? (
+                <Folder size={12} className="text-muted-foreground shrink-0" />
+              ) : (
+                <FileText size={12} className="text-muted-foreground shrink-0" />
+              )}
+              <span className="truncate">{entry.name}</span>
+            </div>
+            {entry.kind === 'dir' && isExpanded && cache.has(fullPath) && (
+              <TreeLevel
+                parentPath={fullPath}
+                entries={cache.get(fullPath) ?? []}
+                cache={cache}
+                expanded={expanded}
+                depth={depth + 1}
+                onToggleDir={onToggleDir}
+                onSelectFile={onSelectFile}
+              />
+            )}
+          </li>
+        );
+      })}
+    </ul>
+  );
+}

apps/web/src/components/SessionLandingPage.tsx

@@ -0,0 +1,394 @@
+import { useState } from 'react';
+import { Archive, MessageSquare, Send, ChevronDown, ChevronRight, RotateCcw, Trash2 } from 'lucide-react';
+import type { Chat } from '@/api/types';
+import { Button } from '@/components/ui/button';
+import { Textarea } from '@/components/ui/textarea';
+import { Input } from '@/components/ui/input';
+import {
+  ContextMenu,
+  ContextMenuContent,
+  ContextMenuItem,
+  ContextMenuSeparator,
+  ContextMenuTrigger,
+} from '@/components/ui/context-menu';
+import {
+  Dialog,
+  DialogContent,
+  DialogHeader,
+  DialogTitle,
+  DialogDescription,
+} from '@/components/ui/dialog';
+import { formatTokens } from '@/lib/format';
+
+interface Props {
+  sessionId: string;
+  projectId: string;
+  chats: Chat[];
+  onOpenChat: (chatId: string) => void;
+  onSend: (content: string) => void;
+  onReopenChat: (chatId: string) => Promise<void>;
+  onArchiveChat: (chatId: string) => Promise<void>;
+  onRenameChat: (chatId: string, name: string) => Promise<void>;
+  onDeleteChat: (chatId: string) => Promise<void>;
+}
+
+function relTime(iso: string): string {
+  const now = Date.now();
+  const t = Date.parse(iso);
+  if (Number.isNaN(t)) return '';
+  const sec = Math.max(0, Math.floor((now - t) / 1000));
+  if (sec < 60) return `${sec}s ago`;
+  const min = Math.floor(sec / 60);
+  if (min < 60) return `${min}m ago`;
+  const hr = Math.floor(min / 60);
+  if (hr < 24) return `${hr}h ago`;
+  const day = Math.floor(hr / 24);
+  return `${day}d ago`;
+}
+
+interface ChatRowProps {
+  chat: Chat;
+  onClick: () => void;
+  dimmed?: boolean;
+  trailing?: React.ReactNode;
+  actions?: React.ReactNode;
+  renamingId: string | null;
+  renameValue: string;
+  setRenameValue: (s: string) => void;
+  onFinishRename: () => void;
+  onCancelRename: () => void;
+  onContextStartRename: () => void;
+  onContextArchive: () => void;
+  onContextDelete: () => void;
+  showContextMenu: boolean;
+}
+
+function ChatRow({
+  chat,
+  onClick,
+  dimmed,
+  trailing,
+  actions,
+  renamingId,
+  renameValue,
+  setRenameValue,
+  onFinishRename,
+  onCancelRename,
+  onContextStartRename,
+  onContextArchive,
+  onContextDelete,
+  showContextMenu,
+}: ChatRowProps) {
+  const meta: string[] = [relTime(chat.updated_at)];
+  if (chat.message_count !== undefined && chat.message_count > 0) {
+    meta.push(`${chat.message_count} msg`);
+  }
+  const tokens = formatTokens(chat.effective_context_tokens);
+  if (tokens) meta.push(tokens);
+  const preview = chat.last_message_preview;
+  const isRenaming = renamingId === chat.id;
+
+  const inner = (
+    <button
+      type="button"
+      onClick={onClick}
+      className="w-full flex flex-col gap-0.5 px-3 py-2 hover:bg-muted/50 text-left"
+    >
+      <div className="flex items-center gap-2 min-w-0">
+        <MessageSquare className={`size-3.5 shrink-0 ${dimmed ? 'opacity-40' : 'opacity-70'}`} />
+        {isRenaming ? (
+          <input
+            autoFocus
+            value={renameValue}
+            onChange={(e) => setRenameValue(e.target.value)}
+            onBlur={() => onFinishRename()}
+            onKeyDown={(e) => {
+              if (e.key === 'Enter') onFinishRename();
+              if (e.key === 'Escape') onCancelRename();
+            }}
+            onClick={(e) => e.stopPropagation()}
+            className="bg-transparent border-b border-border text-sm outline-none flex-1 min-w-0"
+          />
+        ) : (
+          <span className={`truncate text-sm flex-1 ${dimmed ? 'text-muted-foreground' : ''}`}>
+            {chat.name ?? 'New chat'}
+          </span>
+        )}
+        {trailing && (
+          <span className="text-xs text-muted-foreground shrink-0">{trailing}</span>
+        )}
+        {actions && (
+          <div className="flex items-center gap-0.5 shrink-0">{actions}</div>
+        )}
+      </div>
+      <div className="ml-5 text-xs text-muted-foreground tabular-nums">
+        {meta.join(' · ')}
+      </div>
+      {preview && (
+        <div className="ml-5 text-xs italic text-muted-foreground truncate">
+          {preview}
+        </div>
+      )}
+    </button>
+  );
+
+  if (!showContextMenu) return inner;
+
+  return (
+    <ContextMenu>
+      <ContextMenuTrigger asChild>{inner}</ContextMenuTrigger>
+      <ContextMenuContent>
+        <ContextMenuItem onSelect={onClick}>Open</ContextMenuItem>
+        <ContextMenuItem onSelect={onContextStartRename}>Rename</ContextMenuItem>
+        <ContextMenuItem onSelect={onContextArchive}>Archive</ContextMenuItem>
+        <ContextMenuSeparator />
+        <ContextMenuItem variant="destructive" onSelect={onContextDelete}>
+          Delete
+        </ContextMenuItem>
+      </ContextMenuContent>
+    </ContextMenu>
+  );
+}
+
+export function SessionLandingPage({
+  chats,
+  onOpenChat,
+  onSend,
+  onReopenChat,
+  onArchiveChat,
+  onRenameChat,
+  onDeleteChat,
+}: Props) {
+  const [composerValue, setComposerValue] = useState('');
+  const [showArchived, setShowArchived] = useState(false);
+  const [renamingId, setRenamingId] = useState<string | null>(null);
+  const [renameValue, setRenameValue] = useState('');
+  const [archiveConfirm, setArchiveConfirm] = useState<Chat | null>(null);
+  const [deleteConfirm, setDeleteConfirm] = useState<Chat | null>(null);
+  const [deleteInput, setDeleteInput] = useState('');
+
+  const openChats = chats
+    .filter((c) => c.status === 'open')
+    .sort((a, b) => new Date(b.updated_at).getTime() - new Date(a.updated_at).getTime());
+  const archivedChats = chats
+    .filter((c) => c.status === 'archived')
+    .sort((a, b) => new Date(b.updated_at).getTime() - new Date(a.updated_at).getTime());
+
+  function handleSend() {
+    const text = composerValue.trim();
+    if (!text) return;
+    onSend(text);
+    setComposerValue('');
+  }
+
+  function startRename(chat: Chat) {
+    setRenamingId(chat.id);
+    setRenameValue(chat.name ?? '');
+  }
+
+  async function finishRename() {
+    if (renamingId && renameValue.trim()) {
+      await onRenameChat(renamingId, renameValue.trim());
+    }
+    setRenamingId(null);
+  }
+
+  const deleteExpected = deleteConfirm?.name ?? '';
+  const deleteEnabled = deleteConfirm !== null && deleteInput === deleteExpected && deleteExpected.length > 0;
+
+  // TODO: Landing page chat counts are a snapshot at mount. New messages in
+  // visible chats won't update the per-row stats until next mount/navigation.
+  return (
+    <div className="flex flex-col h-full min-h-0">
+      <div className="flex-1 overflow-y-auto px-6 py-4 space-y-6">
+        {openChats.length > 0 && (
+          <div>
+            <h3 className="text-xs font-medium text-muted-foreground mb-2">Open chats</h3>
+            <ul className="divide-y rounded-md border">
+              {openChats.map((chat) => (
+                <li key={chat.id}>
+                  <ChatRow
+                    chat={chat}
+                    onClick={() => onOpenChat(chat.id)}
+                    renamingId={renamingId}
+                    renameValue={renameValue}
+                    setRenameValue={setRenameValue}
+                    onFinishRename={() => void finishRename()}
+                    onCancelRename={() => setRenamingId(null)}
+                    onContextStartRename={() => startRename(chat)}
+                    onContextArchive={() => setArchiveConfirm(chat)}
+                    onContextDelete={() => { setDeleteConfirm(chat); setDeleteInput(''); }}
+                    showContextMenu
+                    actions={
+                      <>
+                        <Button
+                          variant="ghost"
+                          size="icon-sm"
+                          aria-label="Archive chat"
+                          title="Archive chat"
+                          onClick={(e) => {
+                            e.stopPropagation();
+                            setArchiveConfirm(chat);
+                          }}
+                        >
+                          <Archive size={14} />
+                        </Button>
+                        <Button
+                          variant="ghost"
+                          size="icon-sm"
+                          aria-label="Delete chat"
+                          title="Delete chat"
+                          className="text-destructive hover:text-destructive"
+                          onClick={(e) => {
+                            e.stopPropagation();
+                            setDeleteConfirm(chat);
+                            setDeleteInput('');
+                          }}
+                        >
+                          <Trash2 size={14} />
+                        </Button>
+                      </>
+                    }
+                  />
+                </li>
+              ))}
+            </ul>
+          </div>
+        )}
+
+        {archivedChats.length > 0 && (
+          <div>
+            <button
+              type="button"
+              onClick={() => setShowArchived(!showArchived)}
+              className="flex items-center gap-1 text-xs font-medium text-muted-foreground mb-2 hover:text-foreground"
+            >
+              {showArchived ? <ChevronDown size={12} /> : <ChevronRight size={12} />}
+              Archived chats ({archivedChats.length})
+            </button>
+            {showArchived && (
+              <ul className="divide-y rounded-md border">
+                {archivedChats.map((chat) => (
+                  <li key={chat.id}>
+                    <ChatRow
+                      chat={chat}
+                      onClick={() => void onReopenChat(chat.id)}
+                      dimmed
+                      trailing={<><RotateCcw size={10} className="inline mr-1" />Restore</>}
+                      renamingId={null}
+                      renameValue=""
+                      setRenameValue={() => {}}
+                      onFinishRename={() => {}}
+                      onCancelRename={() => {}}
+                      onContextStartRename={() => {}}
+                      onContextArchive={() => {}}
+                      onContextDelete={() => {}}
+                      showContextMenu={false}
+                    />
+                  </li>
+                ))}
+              </ul>
+            )}
+          </div>
+        )}
+
+        {openChats.length === 0 && archivedChats.length === 0 && (
+          <div className="text-sm text-muted-foreground py-8 text-center">
+            No chats yet. Type below to start a conversation.
+          </div>
+        )}
+      </div>
+
+      <div className="border-t px-4 py-3 flex items-end gap-2 shrink-0">
+        <Textarea
+          value={composerValue}
+          onChange={(e) => setComposerValue(e.target.value)}
+          onKeyDown={(e) => {
+            if (e.key === 'Enter' && (e.metaKey || e.ctrlKey)) {
+              e.preventDefault();
+              handleSend();
+              return;
+            }
+            if (e.key === 'Enter' && !e.shiftKey) {
+              e.preventDefault();
+              handleSend();
+            }
+          }}
+          placeholder="Start a new chat..."
+          rows={2}
+          className="resize-none min-h-[52px] max-h-[160px]"
+        />
+        <Button
+          onClick={handleSend}
+          disabled={!composerValue.trim()}
+          size="icon-lg"
+          aria-label="Send"
+        >
+          <Send />
+        </Button>
+      </div>
+
+      <Dialog open={archiveConfirm !== null} onOpenChange={(open) => { if (!open) setArchiveConfirm(null); }}>
+        <DialogContent>
+          <DialogHeader>
+            <DialogTitle>Archive chat?</DialogTitle>
+            <DialogDescription>
+              Moves {archiveConfirm ? `"${archiveConfirm.name ?? 'New chat'}"` : 'this chat'} to the Archived chats section. You can restore it any time.
+            </DialogDescription>
+          </DialogHeader>
+          <div className="flex gap-2 justify-end pt-2">
+            <Button variant="outline" onClick={() => setArchiveConfirm(null)}>
+              Cancel
+            </Button>
+            <Button
+              onClick={() => {
+                if (archiveConfirm) void onArchiveChat(archiveConfirm.id);
+                setArchiveConfirm(null);
+              }}
+            >
+              Archive
+            </Button>
+          </div>
+        </DialogContent>
+      </Dialog>
+
+      <Dialog open={deleteConfirm !== null} onOpenChange={(open) => { if (!open) { setDeleteConfirm(null); setDeleteInput(''); } }}>
+        <DialogContent>
+          <DialogHeader>
+            <DialogTitle>Delete chat?</DialogTitle>
+            <DialogDescription>
+              Type the chat name to confirm:
+              {' '}
+              <span className="font-mono font-medium text-foreground">{deleteExpected || '(unnamed — cannot type-confirm)'}</span>
+            </DialogDescription>
+          </DialogHeader>
+          <Input
+            value={deleteInput}
+            onChange={(e) => setDeleteInput(e.target.value)}
+            placeholder={deleteExpected}
+            disabled={!deleteExpected}
+          />
+          <div className="text-xs text-muted-foreground">
+            This will permanently delete this chat and all its messages. This cannot be undone.
+          </div>
+          <div className="flex gap-2 justify-end pt-2">
+            <Button variant="outline" onClick={() => { setDeleteConfirm(null); setDeleteInput(''); }}>
+              Cancel
+            </Button>
+            <Button
+              variant="destructive"
+              disabled={!deleteEnabled}
+              onClick={() => {
+                if (deleteConfirm && deleteEnabled) void onDeleteChat(deleteConfirm.id);
+                setDeleteConfirm(null);
+                setDeleteInput('');
+              }}
+            >
+              Delete
+            </Button>
+          </div>
+        </DialogContent>
+      </Dialog>
+    </div>
+  );
+}

apps/web/src/components/SwipeablePaneTab.tsx

@@ -0,0 +1,103 @@
+import { useRef, useState } from 'react';
+import type { TouchEvent } from 'react';
+import { cn } from '@/lib/utils';
+
+interface Props {
+  label: string;
+  isActive: boolean;
+  onTap: () => void;
+  onClose: () => void;
+  canClose: boolean;
+}
+
+const CLOSE_THRESHOLD = 60;
+const MAX_TRAVEL = 120;
+const VERTICAL_BAIL = 30;
+
+// Pane tab with horizontal swipe-to-close (mobile only). Tracks horizontal
+// finger movement; if vertical exceeds VERTICAL_BAIL the gesture is cancelled
+// (so vertical scroll still works). On release past CLOSE_THRESHOLD, the
+// onClose callback fires. Otherwise the tab snaps back. Hand-rolled per spec.
+export function SwipeablePaneTab({ label, isActive, onTap, onClose, canClose }: Props) {
+  const [translateX, setTranslateX] = useState(0);
+  const [dragging, setDragging] = useState(false);
+  const startRef = useRef<{ x: number; y: number; bailed: boolean } | null>(null);
+
+  const onTouchStart = (e: TouchEvent) => {
+    if (!canClose) return;
+    const t = e.touches[0];
+    if (!t) return;
+    startRef.current = { x: t.clientX, y: t.clientY, bailed: false };
+    setDragging(true);
+  };
+
+  const onTouchMove = (e: TouchEvent) => {
+    const start = startRef.current;
+    if (!start || start.bailed) return;
+    const t = e.touches[0];
+    if (!t) return;
+    const dx = t.clientX - start.x;
+    const dy = t.clientY - start.y;
+    if (Math.abs(dy) > VERTICAL_BAIL) {
+      start.bailed = true;
+      setTranslateX(0);
+      setDragging(false);
+      return;
+    }
+    if (dx < 0) {
+      setTranslateX(Math.max(dx, -MAX_TRAVEL));
+    } else {
+      setTranslateX(0);
+    }
+  };
+
+  const onTouchEnd = () => {
+    const start = startRef.current;
+    startRef.current = null;
+    setDragging(false);
+    if (!start || start.bailed) {
+      setTranslateX(0);
+      return;
+    }
+    const tx = translateX;
+    if (tx <= -CLOSE_THRESHOLD) {
+      onClose();
+      // Don't reset translateX; the parent will unmount this tab.
+    } else {
+      setTranslateX(0);
+    }
+  };
+
+  // Opacity fades from 1 -> 0.4 as the tab approaches the close threshold.
+  const opacity =
+    translateX < 0
+      ? Math.max(0.4, 1 - (Math.abs(translateX) / CLOSE_THRESHOLD) * 0.6)
+      : 1;
+
+  return (
+    <button
+      type="button"
+      onClick={onTap}
+      onTouchStart={onTouchStart}
+      onTouchMove={onTouchMove}
+      onTouchEnd={onTouchEnd}
+      onTouchCancel={onTouchEnd}
+      style={{
+        transform: `translateX(${translateX}px)`,
+        opacity,
+        // Only animate when releasing (snap-back); during drag the transform
+        // tracks the finger 1:1 for a tight feel.
+        transition: dragging ? undefined : 'transform 0.15s ease, opacity 0.15s ease',
+      }}
+      className={cn(
+        'shrink-0 px-3 py-2 text-xs rounded min-h-[44px] min-w-[44px]',
+        isActive
+          ? 'bg-background text-foreground border'
+          : 'text-muted-foreground hover:bg-muted/40',
+      )}
+      aria-current={isActive ? 'true' : undefined}
+    >
+      <span className="truncate max-w-[140px] inline-block">{label}</span>
+    </button>
+  );
+}

apps/web/src/components/ToolCallCard.tsx

@@ -1,12 +1,50 @@
 import { useState } from 'react';
+import type { ReactNode } from 'react';
 import { ChevronRight, Wrench } from 'lucide-react';
 import type { Message, ToolCall } from '@/api/types';
+import { sessionEvents } from '@/hooks/sessionEvents';
 
 interface Props {
   message?: Message;
   toolCall?: ToolCall;
 }
 
+// Same regex/heuristic as MessageBubble: paths ending in `.ext` with at
+// least one `/`. Linkifies file paths emitted by tools like grep / find_files
+// so they're clickable.
+const PATH_REGEX = /([a-zA-Z0-9._/-]+\.[a-zA-Z0-9]+)/g;
+
+function linkifyOutput(text: string): ReactNode[] {
+  const out: ReactNode[] = [];
+  let lastIdx = 0;
+  let idx = 0;
+  for (const match of text.matchAll(PATH_REGEX)) {
+    const matchedText = match[0];
+    const start = match.index ?? 0;
+    if (!matchedText.includes('/')) continue;
+    if (start > lastIdx) out.push(text.slice(lastIdx, start));
+    out.push(
+      <button
+        key={idx}
+        type="button"
+        onClick={() =>
+          sessionEvents.emit({
+            type: 'open_file_in_browser',
+            path: matchedText,
+          })
+        }
+        className="text-primary underline cursor-pointer hover:text-primary/80"
+      >
+        {matchedText}
+      </button>
+    );
+    lastIdx = start + matchedText.length;
+    idx += 1;
+  }
+  if (lastIdx < text.length) out.push(text.slice(lastIdx));
+  return out.length > 0 ? out : [text];
+}
+
 export function ToolCallCard({ message, toolCall }: Props) {
   const [open, setOpen] = useState(false);
   const tc = toolCall ?? message?.tool_calls?.[0];
@@ -48,7 +86,11 @@ export function ToolCallCard({ message, toolCall }: Props) {
             </pre>
           ) : output !== undefined ? (
             <pre className="text-xs font-mono whitespace-pre-wrap overflow-x-auto max-h-72 overflow-y-auto">
-              {typeof output === 'string' ? output : JSON.stringify(output, null, 2)}
+              {linkifyOutput(
+                typeof output === 'string'
+                  ? output
+                  : JSON.stringify(output, null, 2)
+              )}
             </pre>
           ) : (
             <div className="text-xs text-muted-foreground">no result yet</div>

apps/web/src/components/Workspace.tsx

@@ -0,0 +1,246 @@
+import { useCallback, useEffect } from 'react';
+import { useLocation, useNavigate, useSearchParams } from 'react-router-dom';
+import { PanelRight, MessageSquare, Terminal, Bot } from 'lucide-react';
+import type { Chat, WorkspacePane } from '@/api/types';
+import { useWorkspacePanes, MAX_PANES } from '@/hooks/useWorkspacePanes';
+import { useSessionChats } from '@/hooks/useSessionChats';
+import { useViewport } from '@/hooks/useViewport';
+import { ChatPane } from '@/components/panes/ChatPane';
+import { ChatTabBar } from '@/components/ChatTabBar';
+import { SessionLandingPage } from '@/components/SessionLandingPage';
+import { SwipeablePaneTab } from '@/components/SwipeablePaneTab';
+import {
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger,
+} from '@/components/ui/dropdown-menu';
+import { cn } from '@/lib/utils';
+
+interface Props {
+  sessionId: string;
+  projectId: string;
+}
+
+export function Workspace({ sessionId, projectId }: Props) {
+  const {
+    panes,
+    activePaneIdx,
+    setActivePaneIdx,
+    activePaneIdxRef,
+    openChatInPane,
+    switchTab,
+    removeTab,
+    closeOtherTabs,
+    closeTabsToRight,
+    closeAllTabs,
+    showLandingPage,
+    addSplitPane,
+    removePane,
+    removeChatFromPanes,
+    initializeFirstChatIfEmpty,
+    handlePaneDragStart,
+    handlePaneDragOver,
+    handlePaneDragLeave,
+    handlePaneDrop,
+    handlePaneDragEnd,
+    dragOverIdx,
+    draggingIdxRef,
+  } = useWorkspacePanes(sessionId);
+
+  // Thin wrapper so useSessionChats can route open_chat_in_active_pane events
+  // without knowing about pane indexing.
+  const openChatInActivePane = useCallback(
+    (chatId: string) => openChatInPane(activePaneIdxRef.current, chatId),
+    [openChatInPane, activePaneIdxRef],
+  );
+
+  const {
+    chats,
+    createChat,
+    archiveChat,
+    unarchiveChat,
+    deleteChat,
+    renameChat,
+    handleLandingSend,
+  } = useSessionChats(sessionId, {
+    removeChatFromPanes,
+    openChatInPane,
+    openChatInActivePane,
+    initializeFirstChatIfEmpty,
+  });
+
+  const { isMobile } = useViewport();
+  const [searchParams] = useSearchParams();
+  const navigate = useNavigate();
+  const location = useLocation();
+
+  // URL -> state (mobile only). Handles deep-link arrival and Back button
+  // history pops. On a bare URL (no ?pane), reset to first pane so Back
+  // from a ?pane URL returns the user to a sensible default.
+  useEffect(() => {
+    if (!isMobile || panes.length === 0) return;
+    const paneId = searchParams.get('pane');
+    if (!paneId) {
+      if (activePaneIdx !== 0) setActivePaneIdx(0);
+      return;
+    }
+    const idx = panes.findIndex((p) => p.id === paneId);
+    if (idx >= 0 && idx !== activePaneIdx) setActivePaneIdx(idx);
+  }, [isMobile, searchParams, panes, activePaneIdx, setActivePaneIdx]);
+
+  // Switch active pane and push URL (mobile only). User-initiated only;
+  // never called from URL-sync effect.
+  const switchActivePane = useCallback(
+    (idx: number) => {
+      setActivePaneIdx(idx);
+      if (isMobile) {
+        const pane = panes[idx];
+        if (!pane) return;
+        const params = new URLSearchParams(location.search);
+        params.set('pane', pane.id);
+        navigate(`${location.pathname}?${params.toString()}`);
+      }
+    },
+    [setActivePaneIdx, isMobile, panes, navigate, location.pathname, location.search],
+  );
+
+  function chatsForPane(pane: WorkspacePane): Chat[] {
+    return pane.chatIds
+      .map((id) => chats.find((c) => c.id === id))
+      .filter((c): c is Chat => c !== undefined);
+  }
+
+  function paneLabel(pane: WorkspacePane): string {
+    const activeChatId = pane.chatId;
+    if (activeChatId) {
+      const chat = chats.find((c) => c.id === activeChatId);
+      if (chat) return chat.name ?? 'New chat';
+    }
+    if (pane.kind === 'chat') return 'Chat';
+    if (pane.kind === 'terminal') return 'Terminal';
+    if (pane.kind === 'agent') return 'Agent';
+    return 'Empty';
+  }
+
+  return (
+    <div className="flex flex-col h-full min-h-0">
+      {!isMobile && (
+        <div className="flex items-center gap-2 border-b border-border bg-muted/20 px-3 py-1.5 shrink-0">
+          <DropdownMenu>
+            <DropdownMenuTrigger asChild>
+              <button
+                type="button"
+                disabled={panes.length >= MAX_PANES}
+                className={cn(
+                  'flex items-center gap-1 text-xs px-2 py-1 rounded hover:bg-muted',
+                  panes.length >= MAX_PANES && 'opacity-40 cursor-not-allowed hover:bg-transparent'
+                )}
+              >
+                <PanelRight size={14} />
+                Split
+              </button>
+            </DropdownMenuTrigger>
+            <DropdownMenuContent>
+              <DropdownMenuItem onSelect={() => addSplitPane('chat')}>
+                <MessageSquare size={14} /> Chat
+              </DropdownMenuItem>
+              <DropdownMenuItem onSelect={() => addSplitPane('terminal')}>
+                <Terminal size={14} /> Terminal
+              </DropdownMenuItem>
+              <DropdownMenuItem onSelect={() => addSplitPane('agent')}>
+                <Bot size={14} /> Agent
+              </DropdownMenuItem>
+            </DropdownMenuContent>
+          </DropdownMenu>
+        </div>
+      )}
+
+      {isMobile && panes.length > 1 && (
+        <div className="flex items-center gap-1 overflow-x-auto border-b border-border bg-muted/10 px-2 py-1 shrink-0">
+          {panes.map((pane, idx) => (
+            <SwipeablePaneTab
+              key={pane.id}
+              label={paneLabel(pane)}
+              isActive={idx === activePaneIdx}
+              onTap={() => switchActivePane(idx)}
+              onClose={() => removePane(idx)}
+              canClose={panes.length > 1}
+            />
+          ))}
+        </div>
+      )}
+
+      <div
+        className={cn('flex-1 min-h-0', isMobile ? 'flex' : 'grid')}
+        style={
+          isMobile
+            ? undefined
+            : { gridTemplateColumns: `repeat(${panes.length}, minmax(0, 1fr))` }
+        }
+      >
+        {panes.map((pane, idx) => {
+          const visible = !isMobile || idx === activePaneIdx;
+          if (!visible) return null;
+          return (
+          <div
+            key={pane.id}
+            className={cn(
+              'flex flex-col h-full min-h-0 border-r border-border last:border-r-0 relative',
+              isMobile ? 'flex-1 w-full' : undefined,
+              !isMobile && idx === activePaneIdx && 'ring-1 ring-inset ring-ring/20',
+              !isMobile && dragOverIdx === idx && draggingIdxRef.current !== idx &&
+                'before:absolute before:inset-y-0 before:left-0 before:w-0.5 before:bg-primary before:z-10'
+            )}
+            onClick={() => setActivePaneIdx(idx)}
+            onDragOver={!isMobile && panes.length > 1 ? handlePaneDragOver(idx) : undefined}
+            onDragLeave={!isMobile && panes.length > 1 ? handlePaneDragLeave : undefined}
+            onDrop={!isMobile && panes.length > 1 ? handlePaneDrop(idx) : undefined}
+          >
+            <div
+              draggable={!isMobile && panes.length > 1}
+              onDragStart={!isMobile && panes.length > 1 ? handlePaneDragStart(idx) : undefined}
+              onDragEnd={!isMobile && panes.length > 1 ? handlePaneDragEnd : undefined}
+            >
+              <ChatTabBar
+                pane={pane}
+                tabs={chatsForPane(pane)}
+                onSwitchTab={(tabIdx) => switchTab(idx, tabIdx)}
+                onRemoveTab={(chatId) => removeTab(idx, chatId)}
+                onCloseOthers={(chatId) => closeOtherTabs(idx, chatId)}
+                onCloseToRight={(chatId) => closeTabsToRight(idx, chatId)}
+                onCloseAll={() => closeAllTabs(idx)}
+                onNewChat={() => void createChat(idx)}
+                onShowHistory={() => showLandingPage(idx)}
+                onRename={renameChat}
+                onRemovePane={panes.length > 1 ? () => removePane(idx) : undefined}
+              />
+            </div>
+
+            <div className="flex-1 min-h-0 overflow-hidden">
+              {pane.kind === 'chat' && pane.chatId ? (
+                <ChatPane sessionId={sessionId} chatId={pane.chatId} projectId={projectId} sessionChats={chats} />
+              ) : (
+                <SessionLandingPage
+                  sessionId={sessionId}
+                  projectId={projectId}
+                  chats={chats}
+                  onOpenChat={(chatId) => openChatInPane(idx, chatId)}
+                  onSend={(content) => void handleLandingSend(idx, content)}
+                  onReopenChat={async (chatId) => {
+                    await unarchiveChat(chatId);
+                    openChatInPane(idx, chatId);
+                  }}
+                  onArchiveChat={archiveChat}
+                  onRenameChat={renameChat}
+                  onDeleteChat={deleteChat}
+                />
+              )}
+            </div>
+          </div>
+          );
+        })}
+      </div>
+    </div>
+  );
+}

apps/web/src/components/panes/ChatPane.tsx

@@ -0,0 +1,174 @@
+import { useCallback, useEffect, useRef, useState } from 'react';
+import { ChevronDown, Square, X } from 'lucide-react';
+import { toast } from 'sonner';
+import { api } from '@/api/client';
+import { useSessionStream } from '@/hooks/useSessionStream';
+import { useChatContextStats } from '@/hooks/useChatContextStats';
+import { MessageList } from '@/components/MessageList';
+import { ChatInput } from '@/components/ChatInput';
+import { ChatContextPopover } from '@/components/ChatContextPopover';
+import {
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger,
+} from '@/components/ui/dropdown-menu';
+
+interface Props {
+  sessionId: string;
+  chatId: string;
+  projectId: string;
+  sessionChats?: import('@/api/types').Chat[];
+}
+
+export function ChatPane({ sessionId, chatId, projectId, sessionChats }: Props) {
+  const stream = useSessionStream(sessionId);
+  const lastErrorRef = useRef<string | null>(null);
+  const [queue, setQueue] = useState<string[]>([]);
+  const processingRef = useRef(false);
+
+  useEffect(() => {
+    if (stream.error && stream.error !== lastErrorRef.current) {
+      lastErrorRef.current = stream.error;
+      toast.error(stream.error);
+    }
+    if (!stream.error) {
+      lastErrorRef.current = null;
+    }
+  }, [stream.error]);
+
+  const chatMessages = stream.messages.filter((m) => m.chat_id === chatId);
+  const streaming = chatMessages.some((m) => m.status === 'streaming');
+  const contextStats = useChatContextStats(chatId, chatMessages);
+
+  // Auto-send next queued message when streaming completes
+  useEffect(() => {
+    if (streaming || queue.length === 0 || processingRef.current) return;
+    processingRef.current = true;
+    const next = queue[0]!;
+    setQueue((prev) => prev.slice(1));
+    api.messages.send(chatId, next)
+      .catch((err) => toast.error(err instanceof Error ? err.message : 'queue send failed'))
+      .finally(() => { processingRef.current = false; });
+  }, [streaming, queue, chatId]);
+
+  const handleSend = useCallback(async (content: string) => {
+    const trimmed = content.trim();
+    if (!trimmed) return;
+    if (trimmed === '/compact') {
+      try {
+        await api.chats.compact(chatId);
+      } catch (err) {
+        toast.error(err instanceof Error ? err.message : 'compact failed');
+      }
+      return;
+    }
+    if (streaming) {
+      setQueue((prev) => [...prev, trimmed]);
+      return;
+    }
+    await api.messages.send(chatId, trimmed);
+  }, [chatId, streaming]);
+
+  async function handleStop() {
+    try {
+      await api.chats.stop(chatId);
+    } catch (err) {
+      toast.error(err instanceof Error ? err.message : 'stop failed');
+    }
+  }
+
+  const handleForceSend = useCallback(async (content: string) => {
+    const trimmed = content.trim();
+    if (!trimmed) return;
+    try {
+      await api.chats.forceSend(chatId, trimmed);
+      setQueue([]);
+    } catch (err) {
+      toast.error(err instanceof Error ? err.message : 'force send failed');
+    }
+  }, [chatId]);
+
+  function removeQueued(idx: number) {
+    setQueue((prev) => prev.filter((_, i) => i !== idx));
+  }
+
+  async function forceSendQueued(idx: number) {
+    const msg = queue[idx];
+    if (!msg) return;
+    setQueue((prev) => prev.filter((_, i) => i !== idx));
+    try {
+      await api.chats.forceSend(chatId, msg);
+    } catch (err) {
+      toast.error(err instanceof Error ? err.message : 'force send failed');
+    }
+  }
+
+  return (
+    <div className="flex flex-col h-full min-h-0">
+      <MessageList messages={chatMessages} sessionChats={sessionChats} />
+
+      {/* Queued messages */}
+      {queue.length > 0 && (
+        <div className="border-t">
+          <div className="max-w-[1000px] mx-auto w-full px-4 py-1 space-y-1">
+          {queue.map((msg, i) => (
+            <div key={i} className="flex items-center gap-2 text-xs text-muted-foreground bg-muted/30 rounded px-2 py-1">
+              <span className="font-medium shrink-0">Queued:</span>
+              <span className="truncate flex-1">{msg}</span>
+              <DropdownMenu>
+                <DropdownMenuTrigger asChild>
+                  <button
+                    type="button"
+                    className="inline-flex items-center justify-center p-0.5 hover:bg-muted rounded shrink-0 max-md:min-h-[44px] max-md:min-w-[44px]"
+                    aria-label="Queued message options"
+                  >
+                    <ChevronDown size={12} />
+                  </button>
+                </DropdownMenuTrigger>
+                <DropdownMenuContent align="end">
+                  <DropdownMenuItem onSelect={() => { /* default: queued, nothing to do */ }}>
+                    Send when done
+                  </DropdownMenuItem>
+                  <DropdownMenuItem onSelect={() => void forceSendQueued(i)}>
+                    Force send now
+                  </DropdownMenuItem>
+                </DropdownMenuContent>
+              </DropdownMenu>
+              <button
+                type="button"
+                onClick={() => removeQueued(i)}
+                className="inline-flex items-center justify-center p-0.5 hover:bg-muted rounded shrink-0 max-md:min-h-[44px] max-md:min-w-[44px]"
+                aria-label="Cancel queued message"
+              >
+                <X size={12} />
+              </button>
+            </div>
+          ))}
+          </div>
+        </div>
+      )}
+
+      {/* Stop button when streaming */}
+      {streaming && (
+        <div className="border-t py-1">
+          <div className="max-w-[1000px] mx-auto w-full flex justify-center">
+          <button
+            type="button"
+            onClick={() => void handleStop()}
+            className="flex items-center gap-1.5 text-xs px-3 py-1 rounded-full border hover:bg-muted text-muted-foreground hover:text-foreground max-md:min-h-[44px] max-md:px-5"
+          >
+            <Square size={10} className="fill-current" />
+            Stop generating
+          </button>
+          </div>
+        </div>
+      )}
+
+      <div className="relative">
+        <ChatContextPopover stats={contextStats} />
+        <ChatInput disabled={false} projectId={projectId} onSend={handleSend} onForceSend={streaming ? handleForceSend : undefined} />
+      </div>
+    </div>
+  );
+}

apps/web/src/components/ui/context-menu.tsx

@@ -0,0 +1,263 @@
+"use client"
+
+import * as React from "react"
+import { ContextMenu as ContextMenuPrimitive } from "radix-ui"
+
+import { cn } from "@/lib/utils"
+import { CheckIcon, ChevronRightIcon } from "lucide-react"
+
+function ContextMenu({
+  ...props
+}: React.ComponentProps<typeof ContextMenuPrimitive.Root>) {
+  return <ContextMenuPrimitive.Root data-slot="context-menu" {...props} />
+}
+
+function ContextMenuPortal({
+  ...props
+}: React.ComponentProps<typeof ContextMenuPrimitive.Portal>) {
+  return (
+    <ContextMenuPrimitive.Portal data-slot="context-menu-portal" {...props} />
+  )
+}
+
+function ContextMenuTrigger({
+  ...props
+}: React.ComponentProps<typeof ContextMenuPrimitive.Trigger>) {
+  return (
+    <ContextMenuPrimitive.Trigger
+      data-slot="context-menu-trigger"
+      {...props}
+    />
+  )
+}
+
+function ContextMenuContent({
+  className,
+  ...props
+}: React.ComponentProps<typeof ContextMenuPrimitive.Content>) {
+  return (
+    <ContextMenuPrimitive.Portal>
+      <ContextMenuPrimitive.Content
+        data-slot="context-menu-content"
+        className={cn("z-50 min-w-32 overflow-x-hidden overflow-y-auto rounded-lg bg-popover p-1 text-popover-foreground shadow-md ring-1 ring-foreground/10 duration-100 data-[side=bottom]:slide-in-from-top-2 data-[side=left]:slide-in-from-right-2 data-[side=right]:slide-in-from-left-2 data-[side=top]:slide-in-from-bottom-2 data-[state=closed]:overflow-hidden data-open:animate-in data-open:fade-in-0 data-open:zoom-in-95 data-closed:animate-out data-closed:fade-out-0 data-closed:zoom-out-95", className )}
+        {...props}
+      />
+    </ContextMenuPrimitive.Portal>
+  )
+}
+
+function ContextMenuGroup({
+  ...props
+}: React.ComponentProps<typeof ContextMenuPrimitive.Group>) {
+  return (
+    <ContextMenuPrimitive.Group data-slot="context-menu-group" {...props} />
+  )
+}
+
+function ContextMenuItem({
+  className,
+  inset,
+  variant = "default",
+  ...props
+}: React.ComponentProps<typeof ContextMenuPrimitive.Item> & {
+  inset?: boolean
+  variant?: "default" | "destructive"
+}) {
+  return (
+    <ContextMenuPrimitive.Item
+      data-slot="context-menu-item"
+      data-inset={inset}
+      data-variant={variant}
+      className={cn(
+        "group/context-menu-item relative flex cursor-default items-center gap-1.5 rounded-md px-1.5 py-1 text-sm outline-hidden select-none focus:bg-accent focus:text-accent-foreground not-data-[variant=destructive]:focus:**:text-accent-foreground data-inset:pl-7 data-[variant=destructive]:text-destructive data-[variant=destructive]:focus:bg-destructive/10 data-[variant=destructive]:focus:text-destructive dark:data-[variant=destructive]:focus:bg-destructive/20 data-disabled:pointer-events-none data-disabled:opacity-50 [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4 data-[variant=destructive]:*:[svg]:text-destructive",
+        className
+      )}
+      {...props}
+    />
+  )
+}
+
+function ContextMenuCheckboxItem({
+  className,
+  children,
+  checked,
+  inset,
+  ...props
+}: React.ComponentProps<typeof ContextMenuPrimitive.CheckboxItem> & {
+  inset?: boolean
+}) {
+  return (
+    <ContextMenuPrimitive.CheckboxItem
+      data-slot="context-menu-checkbox-item"
+      data-inset={inset}
+      className={cn(
+        "relative flex cursor-default items-center gap-1.5 rounded-md py-1 pr-8 pl-1.5 text-sm outline-hidden select-none focus:bg-accent focus:text-accent-foreground focus:**:text-accent-foreground data-inset:pl-7 data-disabled:pointer-events-none data-disabled:opacity-50 [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4",
+        className
+      )}
+      checked={checked}
+      {...props}
+    >
+      <span
+        className="pointer-events-none absolute right-2 flex items-center justify-center"
+        data-slot="context-menu-checkbox-item-indicator"
+      >
+        <ContextMenuPrimitive.ItemIndicator>
+          <CheckIcon />
+        </ContextMenuPrimitive.ItemIndicator>
+      </span>
+      {children}
+    </ContextMenuPrimitive.CheckboxItem>
+  )
+}
+
+function ContextMenuRadioGroup({
+  ...props
+}: React.ComponentProps<typeof ContextMenuPrimitive.RadioGroup>) {
+  return (
+    <ContextMenuPrimitive.RadioGroup
+      data-slot="context-menu-radio-group"
+      {...props}
+    />
+  )
+}
+
+function ContextMenuRadioItem({
+  className,
+  children,
+  inset,
+  ...props
+}: React.ComponentProps<typeof ContextMenuPrimitive.RadioItem> & {
+  inset?: boolean
+}) {
+  return (
+    <ContextMenuPrimitive.RadioItem
+      data-slot="context-menu-radio-item"
+      data-inset={inset}
+      className={cn(
+        "relative flex cursor-default items-center gap-1.5 rounded-md py-1 pr-8 pl-1.5 text-sm outline-hidden select-none focus:bg-accent focus:text-accent-foreground focus:**:text-accent-foreground data-inset:pl-7 data-disabled:pointer-events-none data-disabled:opacity-50 [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4",
+        className
+      )}
+      {...props}
+    >
+      <span
+        className="pointer-events-none absolute right-2 flex items-center justify-center"
+        data-slot="context-menu-radio-item-indicator"
+      >
+        <ContextMenuPrimitive.ItemIndicator>
+          <CheckIcon />
+        </ContextMenuPrimitive.ItemIndicator>
+      </span>
+      {children}
+    </ContextMenuPrimitive.RadioItem>
+  )
+}
+
+function ContextMenuLabel({
+  className,
+  inset,
+  ...props
+}: React.ComponentProps<typeof ContextMenuPrimitive.Label> & {
+  inset?: boolean
+}) {
+  return (
+    <ContextMenuPrimitive.Label
+      data-slot="context-menu-label"
+      data-inset={inset}
+      className={cn(
+        "px-1.5 py-1 text-xs font-medium text-muted-foreground data-inset:pl-7",
+        className
+      )}
+      {...props}
+    />
+  )
+}
+
+function ContextMenuSeparator({
+  className,
+  ...props
+}: React.ComponentProps<typeof ContextMenuPrimitive.Separator>) {
+  return (
+    <ContextMenuPrimitive.Separator
+      data-slot="context-menu-separator"
+      className={cn("-mx-1 my-1 h-px bg-border", className)}
+      {...props}
+    />
+  )
+}
+
+function ContextMenuShortcut({
+  className,
+  ...props
+}: React.ComponentProps<"span">) {
+  return (
+    <span
+      data-slot="context-menu-shortcut"
+      className={cn(
+        "ml-auto text-xs tracking-widest text-muted-foreground group-focus/context-menu-item:text-accent-foreground",
+        className
+      )}
+      {...props}
+    />
+  )
+}
+
+function ContextMenuSub({
+  ...props
+}: React.ComponentProps<typeof ContextMenuPrimitive.Sub>) {
+  return <ContextMenuPrimitive.Sub data-slot="context-menu-sub" {...props} />
+}
+
+function ContextMenuSubTrigger({
+  className,
+  inset,
+  children,
+  ...props
+}: React.ComponentProps<typeof ContextMenuPrimitive.SubTrigger> & {
+  inset?: boolean
+}) {
+  return (
+    <ContextMenuPrimitive.SubTrigger
+      data-slot="context-menu-sub-trigger"
+      data-inset={inset}
+      className={cn(
+        "flex cursor-default items-center gap-1.5 rounded-md px-1.5 py-1 text-sm outline-hidden select-none focus:bg-accent focus:text-accent-foreground not-data-[variant=destructive]:focus:**:text-accent-foreground data-inset:pl-7 data-open:bg-accent data-open:text-accent-foreground [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4",
+        className
+      )}
+      {...props}
+    >
+      {children}
+      <ChevronRightIcon className="ml-auto" />
+    </ContextMenuPrimitive.SubTrigger>
+  )
+}
+
+function ContextMenuSubContent({
+  className,
+  ...props
+}: React.ComponentProps<typeof ContextMenuPrimitive.SubContent>) {
+  return (
+    <ContextMenuPrimitive.SubContent
+      data-slot="context-menu-sub-content"
+      className={cn("z-50 min-w-[96px] overflow-hidden rounded-lg bg-popover p-1 text-popover-foreground shadow-lg ring-1 ring-foreground/10 duration-100 data-[side=bottom]:slide-in-from-top-2 data-[side=left]:slide-in-from-right-2 data-[side=right]:slide-in-from-left-2 data-[side=top]:slide-in-from-bottom-2 data-open:animate-in data-open:fade-in-0 data-open:zoom-in-95 data-closed:animate-out data-closed:fade-out-0 data-closed:zoom-out-95", className )}
+      {...props}
+    />
+  )
+}
+
+export {
+  ContextMenu,
+  ContextMenuPortal,
+  ContextMenuTrigger,
+  ContextMenuContent,
+  ContextMenuGroup,
+  ContextMenuLabel,
+  ContextMenuItem,
+  ContextMenuCheckboxItem,
+  ContextMenuRadioGroup,
+  ContextMenuRadioItem,
+  ContextMenuSeparator,
+  ContextMenuShortcut,
+  ContextMenuSub,
+  ContextMenuSubTrigger,
+  ContextMenuSubContent,
+}

apps/web/src/hooks/sessionEvents.ts

@@ -2,7 +2,8 @@
 // across hooks (e.g. AI rename arriving via WS in the session view needs to
 // also refresh the sidebar's session list).
 
-import type { Project, Session } from '@/api/types';
+import type { Chat, Project, Session } from '@/api/types';
+import type { Attachment } from '@/lib/attachments';
 
 export interface SessionRenamedEvent {
   type: 'session_renamed';
@@ -32,12 +33,108 @@ export interface SessionDeletedEvent {
   project_id: string;
 }
 
+export interface SessionUpdatedEvent {
+  type: 'session_updated';
+  session_id: string;
+  project_id: string;
+  name: string;
+  updated_at: string;
+}
+
+export interface SessionLoadedEvent {
+  type: 'session_loaded';
+  session_id: string;
+  project_id: string;
+}
+
+export interface OpenFileInBrowserEvent {
+  type: 'open_file_in_browser';
+  path: string; // project-relative
+}
+
+export interface AttachChatFileEvent {
+  type: 'attach_chat_file';
+  attachment: Omit<Attachment, 'id'>;
+}
+
+export interface OpenChatInActivePaneEvent {
+  type: 'open_chat_in_active_pane';
+  chat_id: string;
+}
+
+export interface SessionArchivedEvent {
+  type: 'session_archived';
+  session_id: string;
+  project_id: string;
+}
+
+export interface ChatCreatedEvent {
+  type: 'chat_created';
+  chat: Chat;
+  session_id: string;
+}
+
+export interface ChatUpdatedEvent {
+  type: 'chat_updated';
+  chat_id: string;
+  session_id: string;
+  name: string | null;
+  updated_at: string;
+}
+
+export interface ChatArchivedEvent {
+  type: 'chat_archived';
+  chat_id: string;
+  session_id: string;
+}
+
+export interface ChatUnarchivedEvent {
+  type: 'chat_unarchived';
+  chat: Chat;
+}
+
+export interface ChatDeletedEvent {
+  type: 'chat_deleted';
+  chat_id: string;
+  session_id: string;
+}
+
+export interface ProjectArchivedEvent {
+  type: 'project_archived';
+  project_id: string;
+}
+
+export interface ProjectUnarchivedEvent {
+  type: 'project_unarchived';
+  project: Project;
+}
+
+export interface ProjectUpdatedEvent {
+  type: 'project_updated';
+  project_id: string;
+  name: string;
+}
+
 export type SessionEvent =
   | SessionRenamedEvent
   | ProjectCreatedEvent
   | ProjectDeletedEvent
   | SessionCreatedEvent
-  | SessionDeletedEvent;
+  | SessionDeletedEvent
+  | SessionUpdatedEvent
+  | SessionLoadedEvent
+  | OpenFileInBrowserEvent
+  | AttachChatFileEvent
+  | OpenChatInActivePaneEvent
+  | SessionArchivedEvent
+  | ChatCreatedEvent
+  | ChatUpdatedEvent
+  | ChatArchivedEvent
+  | ChatUnarchivedEvent
+  | ChatDeletedEvent
+  | ProjectArchivedEvent
+  | ProjectUnarchivedEvent
+  | ProjectUpdatedEvent;
 type Listener = (event: SessionEvent) => void;
 
 const listeners = new Set<Listener>();

apps/web/src/hooks/useActivePane.ts

@@ -0,0 +1,61 @@
+import { useEffect, useState } from 'react';
+import type { WorkspacePaneKind } from '@/api/types';
+
+export interface ActivePaneSnapshot {
+  sessionId: string | null;
+  paneId: string | null;
+  kind: WorkspacePaneKind | null;
+  activeFile: string | null;
+}
+
+const EMPTY: ActivePaneSnapshot = {
+  sessionId: null,
+  paneId: null,
+  kind: null,
+  activeFile: null,
+};
+
+let current: ActivePaneSnapshot = EMPTY;
+const subs = new Set<() => void>();
+
+function notify(): void {
+  for (const sub of subs) {
+    try {
+      sub();
+    } catch {
+      // swallow — one bad listener shouldn't break others
+    }
+  }
+}
+
+function isSame(a: ActivePaneSnapshot, b: ActivePaneSnapshot): boolean {
+  return (
+    a.sessionId === b.sessionId &&
+    a.paneId === b.paneId &&
+    a.kind === b.kind &&
+    a.activeFile === b.activeFile
+  );
+}
+
+export function setActivePaneInfo(next: ActivePaneSnapshot): void {
+  if (isSame(current, next)) return;
+  current = next;
+  notify();
+}
+
+export function clearActivePane(): void {
+  setActivePaneInfo(EMPTY);
+}
+
+export function useActivePane(): ActivePaneSnapshot {
+  const [snap, setSnap] = useState<ActivePaneSnapshot>(current);
+  useEffect(() => {
+    const sub = () => setSnap(current);
+    subs.add(sub);
+    sub();
+    return () => {
+      subs.delete(sub);
+    };
+  }, []);
+  return snap;
+}

apps/web/src/hooks/useChatContextStats.ts

@@ -0,0 +1,37 @@
+import { useMemo } from 'react';
+import type { Message } from '@/api/types';
+
+export interface ChatContextStats {
+  used: number;
+  max: number;
+  percent: number;
+}
+
+/**
+ * Returns the latest context-window usage for the given chat, derived from the
+ * assistant message (with both ctx_used and ctx_max populated) having the most
+ * recent created_at. Returns null when no such message exists.
+ *
+ * Re-evaluates whenever the `messages` reference or `chatId` changes, which
+ * matches the cadence of streaming updates from `useSessionStream`.
+ */
+export function useChatContextStats(
+  chatId: string,
+  messages: Message[],
+): ChatContextStats | null {
+  return useMemo(() => {
+    let latest: Message | null = null;
+    for (const m of messages) {
+      if (m.chat_id !== chatId) continue;
+      if (m.role !== 'assistant') continue;
+      if (m.ctx_used == null || m.ctx_max == null) continue;
+      if (!latest || m.created_at > latest.created_at) latest = m;
+    }
+    if (!latest || latest.ctx_used == null || latest.ctx_max == null) return null;
+    const used = latest.ctx_used;
+    const max = latest.ctx_max;
+    if (max <= 0) return null;
+    const percent = Math.round((used / max) * 100);
+    return { used, max, percent };
+  }, [chatId, messages]);
+}

apps/web/src/hooks/useLongPress.ts

@@ -0,0 +1,75 @@
+import { useCallback, useRef } from 'react';
+import type { TouchEvent } from 'react';
+
+interface LongPressHandlers {
+  onTouchStart: (e: TouchEvent) => void;
+  onTouchMove: (e: TouchEvent) => void;
+  onTouchEnd: (e: TouchEvent) => void;
+  onTouchCancel: (e: TouchEvent) => void;
+}
+
+interface Options {
+  ms?: number;
+  // Suppress the synthetic click that follows touchend when long-press fired.
+  suppressClickOnFire?: boolean;
+}
+
+// Hand-rolled long-press detector. Starts a timer on touchstart; cancels on
+// touchmove or early touchend; fires the callback on timer expiry. Caller is
+// expected to suppress text-selection callout via CSS (-webkit-touch-callout).
+export function useLongPress(
+  callback: (touch: { clientX: number; clientY: number; target: EventTarget | null }) => void,
+  { ms = 500, suppressClickOnFire = true }: Options = {},
+): LongPressHandlers {
+  const timerRef = useRef<number | null>(null);
+  const firedRef = useRef(false);
+
+  const clear = useCallback(() => {
+    if (timerRef.current !== null) {
+      window.clearTimeout(timerRef.current);
+      timerRef.current = null;
+    }
+  }, []);
+
+  const onTouchStart = useCallback(
+    (e: TouchEvent) => {
+      firedRef.current = false;
+      const touch = e.touches[0];
+      if (!touch) return;
+      const x = touch.clientX;
+      const y = touch.clientY;
+      const target = e.target;
+      clear();
+      timerRef.current = window.setTimeout(() => {
+        firedRef.current = true;
+        callback({ clientX: x, clientY: y, target });
+      }, ms);
+    },
+    [callback, ms, clear],
+  );
+
+  const onTouchMove = useCallback(() => {
+    clear();
+  }, [clear]);
+
+  const onTouchEnd = useCallback(
+    (e: TouchEvent) => {
+      clear();
+      if (firedRef.current && suppressClickOnFire) {
+        // Block the synthetic click that follows touchend; the long-press
+        // already handled the gesture.
+        e.preventDefault();
+      }
+    },
+    [clear, suppressClickOnFire],
+  );
+
+  const onTouchCancel = useCallback(
+    (_e: TouchEvent) => {
+      clear();
+    },
+    [clear],
+  );
+
+  return { onTouchStart, onTouchMove, onTouchEnd, onTouchCancel };
+}

apps/web/src/hooks/useProjects.ts

@@ -1,7 +1,6 @@
 import { useCallback, useEffect, useState } from 'react';
 import { api } from '@/api/client';
 import type { Project } from '@/api/types';
-import { sessionEvents } from './sessionEvents';
 
 export function useProjects() {
   const [projects, setProjects] = useState<Project[] | null>(null);
@@ -33,7 +32,6 @@ export function useProjects() {
   const remove = useCallback(
     async (id: string) => {
       await api.projects.remove(id);
-      sessionEvents.emit({ type: 'project_deleted', project_id: id });
       await refresh();
     },
     [refresh]

apps/web/src/hooks/usePullToRefresh.ts

@@ -0,0 +1,77 @@
+import { useCallback, useRef, useState } from 'react';
+import type { TouchEvent } from 'react';
+
+interface Options {
+  threshold?: number;
+  enabled?: boolean;
+  maxPull?: number;
+}
+
+interface Handlers {
+  onTouchStart: (e: TouchEvent<HTMLElement>) => void;
+  onTouchMove: (e: TouchEvent<HTMLElement>) => void;
+  onTouchEnd: () => void;
+  pullDist: number;
+  refreshing: boolean;
+}
+
+// Hand-rolled pull-to-refresh: records the initial Y on touchstart only if
+// the target is scrolled to the top, then tracks downward pull on touchmove.
+// On touchend, fires onRefresh if the pull exceeded the threshold.
+export function usePullToRefresh(
+  onRefresh: () => void | Promise<void>,
+  { threshold = 80, enabled = true, maxPull = 120 }: Options = {},
+): Handlers {
+  const [pullDist, setPullDist] = useState(0);
+  const [refreshing, setRefreshing] = useState(false);
+  const startYRef = useRef<number | null>(null);
+
+  const onTouchStart = useCallback(
+    (e: TouchEvent<HTMLElement>) => {
+      if (!enabled || refreshing) return;
+      const target = e.currentTarget as HTMLElement;
+      if (target.scrollTop > 0) return;
+      const t = e.touches[0];
+      if (!t) return;
+      startYRef.current = t.clientY;
+    },
+    [enabled, refreshing],
+  );
+
+  const onTouchMove = useCallback(
+    (e: TouchEvent<HTMLElement>) => {
+      if (!enabled || refreshing || startYRef.current === null) return;
+      const t = e.touches[0];
+      if (!t) return;
+      const delta = t.clientY - startYRef.current;
+      if (delta > 0) {
+        setPullDist(Math.min(delta, maxPull));
+      } else {
+        setPullDist(0);
+      }
+    },
+    [enabled, refreshing, maxPull],
+  );
+
+  const onTouchEnd = useCallback(() => {
+    if (!enabled || refreshing) {
+      startYRef.current = null;
+      setPullDist(0);
+      return;
+    }
+    const fired = pullDist >= threshold && startYRef.current !== null;
+    startYRef.current = null;
+    setPullDist(0);
+    if (fired) {
+      setRefreshing(true);
+      Promise.resolve(onRefresh())
+        .catch(() => {})
+        .finally(() => {
+          // Hold the indicator briefly so the action feels intentional.
+          window.setTimeout(() => setRefreshing(false), 600);
+        });
+    }
+  }, [enabled, refreshing, pullDist, threshold, onRefresh]);
+
+  return { onTouchStart, onTouchMove, onTouchEnd, pullDist, refreshing };
+}

apps/web/src/hooks/useRightRailDrawer.tsx

@@ -0,0 +1,35 @@
+import { createContext, useCallback, useContext, useEffect, useState } from 'react';
+import type { ReactNode } from 'react';
+import { useLocation } from 'react-router-dom';
+
+interface RightRailDrawerState {
+  open: boolean;
+  setOpen: (open: boolean) => void;
+  toggle: () => void;
+}
+
+const Ctx = createContext<RightRailDrawerState | null>(null);
+
+export function RightRailDrawerProvider({ children }: { children: ReactNode }) {
+  const [open, setOpen] = useState(false);
+  const location = useLocation();
+
+  // Auto-close on route change. Same pattern as useSidebarDrawer — keeps the
+  // drawer from leaking between sessions when the user navigates.
+  useEffect(() => {
+    setOpen(false);
+  }, [location.pathname]);
+
+  const toggle = useCallback(() => setOpen((v) => !v), []);
+
+  return <Ctx.Provider value={{ open, setOpen, toggle }}>{children}</Ctx.Provider>;
+}
+
+export function useRightRailDrawer(): RightRailDrawerState {
+  const ctx = useContext(Ctx);
+  if (!ctx) {
+    // Soft fallback so consumers don't crash if rendered outside a provider.
+    return { open: false, setOpen: () => {}, toggle: () => {} };
+  }
+  return ctx;
+}

apps/web/src/hooks/useSessionChats.ts

@@ -0,0 +1,175 @@
+import { useCallback, useEffect, useRef, useState } from 'react';
+import { toast } from 'sonner';
+import { api } from '@/api/client';
+import type { Chat } from '@/api/types';
+import { sessionEvents } from '@/hooks/sessionEvents';
+
+export interface UseSessionChatsOpts {
+  removeChatFromPanes: (chatId: string) => void;
+  openChatInPane: (paneIdx: number, chatId: string) => void;
+  // Thin wrapper around openChatInPane(activePaneIdxRef.current, chatId);
+  // built by Workspace and passed in so this hook doesn't need to know
+  // about pane indexing.
+  openChatInActivePane: (chatId: string) => void;
+  initializeFirstChatIfEmpty: (chatId: string) => void;
+}
+
+export interface UseSessionChatsResult {
+  chats: Chat[];
+  setChats: React.Dispatch<React.SetStateAction<Chat[]>>;
+  createChat: (paneIdx: number) => Promise<void>;
+  archiveChat: (chatId: string) => Promise<void>;
+  unarchiveChat: (chatId: string) => Promise<void>;
+  deleteChat: (chatId: string) => Promise<void>;
+  renameChat: (chatId: string, name: string) => Promise<void>;
+  handleLandingSend: (paneIdx: number, content: string) => Promise<void>;
+}
+
+export function useSessionChats(
+  sessionId: string,
+  opts: UseSessionChatsOpts,
+): UseSessionChatsResult {
+  const [chats, setChats] = useState<Chat[]>([]);
+  const chatsRef = useRef<Chat[]>([]);
+  chatsRef.current = chats;
+
+  // Stable refs to opts callbacks so the subscription effect — which only
+  // re-runs on sessionId change — always sees the latest closures without
+  // unsubscribe/resubscribe churn.
+  const removeChatFromPanesRef = useRef(opts.removeChatFromPanes);
+  removeChatFromPanesRef.current = opts.removeChatFromPanes;
+  const openChatInPaneRef = useRef(opts.openChatInPane);
+  openChatInPaneRef.current = opts.openChatInPane;
+  const openChatInActivePaneRef = useRef(opts.openChatInActivePane);
+  openChatInActivePaneRef.current = opts.openChatInActivePane;
+  const initializeFirstChatIfEmptyRef = useRef(opts.initializeFirstChatIfEmpty);
+  initializeFirstChatIfEmptyRef.current = opts.initializeFirstChatIfEmpty;
+
+  useEffect(() => {
+    let cancelled = false;
+    api.chats.listForSession(sessionId).then((list) => {
+      if (cancelled) return;
+      setChats(list);
+      const openChat = list.find((c) => c.status === 'open');
+      if (openChat) {
+        initializeFirstChatIfEmptyRef.current(openChat.id);
+      }
+    }).catch(() => {});
+    return () => { cancelled = true; };
+  }, [sessionId]);
+
+  useEffect(() => {
+    return sessionEvents.subscribe((event) => {
+      if (event.type === 'chat_created' && event.session_id === sessionId) {
+        setChats((prev) => {
+          if (prev.some((c) => c.id === event.chat.id)) return prev;
+          return [event.chat, ...prev];
+        });
+      }
+      if (event.type === 'chat_updated') {
+        setChats((prev) => prev.map((c) =>
+          c.id === event.chat_id ? { ...c, name: event.name, updated_at: event.updated_at } : c
+        ));
+      }
+      if (event.type === 'chat_archived') {
+        setChats((prev) => prev.map((c) =>
+          c.id === event.chat_id ? { ...c, status: 'archived' as const } : c
+        ));
+        removeChatFromPanesRef.current(event.chat_id);
+      }
+      if (event.type === 'chat_unarchived') {
+        setChats((prev) => {
+          if (prev.some((c) => c.id === event.chat.id)) {
+            return prev.map((c) => c.id === event.chat.id ? { ...c, status: 'open' as const } : c);
+          }
+          return [event.chat, ...prev];
+        });
+      }
+      if (event.type === 'chat_deleted') {
+        setChats((prev) => prev.filter((c) => c.id !== event.chat_id));
+        removeChatFromPanesRef.current(event.chat_id);
+      }
+      if (event.type === 'open_chat_in_active_pane') {
+        openChatInActivePaneRef.current(event.chat_id);
+      }
+    });
+  }, [sessionId]);
+
+  const createChat = useCallback(async (paneIdx: number) => {
+    try {
+      const chat = await api.chats.create(sessionId);
+      // Optimistic local insert; the WS chat_created echo will be deduped by id.
+      setChats((prev) => {
+        if (prev.some((c) => c.id === chat.id)) return prev;
+        return [chat, ...prev];
+      });
+      openChatInPaneRef.current(paneIdx, chat.id);
+    } catch (err) {
+      toast.error(err instanceof Error ? err.message : 'Failed to create chat');
+    }
+  }, [sessionId]);
+
+  const archiveChat = useCallback(async (chatId: string) => {
+    try {
+      await api.chats.archive(chatId);
+      // Server publishes chat_archived; bus forwarder updates state.
+    } catch (err) {
+      toast.error(err instanceof Error ? err.message : 'Failed to archive chat');
+    }
+  }, []);
+
+  const unarchiveChat = useCallback(async (chatId: string) => {
+    try {
+      await api.chats.unarchive(chatId);
+      // Server publishes chat_unarchived.
+    } catch (err) {
+      toast.error(err instanceof Error ? err.message : 'Failed to restore chat');
+    }
+  }, []);
+
+  const deleteChat = useCallback(async (chatId: string) => {
+    try {
+      await api.chats.remove(chatId);
+      setChats((prev) => prev.filter((c) => c.id !== chatId));
+      removeChatFromPanesRef.current(chatId);
+    } catch (err) {
+      toast.error(err instanceof Error ? err.message : 'Failed to delete chat');
+    }
+  }, []);
+
+  const renameChat = useCallback(async (chatId: string, name: string) => {
+    try {
+      await api.chats.update(chatId, { name });
+      setChats((prev) => prev.map((c) =>
+        c.id === chatId ? { ...c, name } : c
+      ));
+    } catch (err) {
+      toast.error(err instanceof Error ? err.message : 'Failed to rename chat');
+    }
+  }, []);
+
+  const handleLandingSend = useCallback(async (paneIdx: number, content: string) => {
+    try {
+      const chat = await api.chats.create(sessionId);
+      setChats((prev) => {
+        if (prev.some((c) => c.id === chat.id)) return prev;
+        return [chat, ...prev];
+      });
+      openChatInPaneRef.current(paneIdx, chat.id);
+      await api.messages.send(chat.id, content);
+    } catch (err) {
+      toast.error(err instanceof Error ? err.message : 'Failed to send');
+    }
+  }, [sessionId]);
+
+  return {
+    chats,
+    setChats,
+    createChat,
+    archiveChat,
+    unarchiveChat,
+    deleteChat,
+    renameChat,
+    handleLandingSend,
+  };
+}

apps/web/src/hooks/useSessionStream.ts

@@ -2,6 +2,10 @@ import { useEffect, useRef, useState } from 'react';
 import type { Message, WsFrame } from '@/api/types';
 import { sessionEvents } from './sessionEvents';
 
+// session_renamed frame removed from WsFrame — it was declared but never
+// published on the per-session WS channel (server publishes via broker.publishUser
+// since v1.4). chat_renamed remains; auto_name.ts publishes it on session WS.
+
 interface State {
   messages: Message[];
   connected: boolean;
@@ -19,8 +23,10 @@ function applyFrame(state: State, frame: WsFrame): State {
       const newMsg: Message = {
         id: frame.message_id,
         session_id: '',
+        chat_id: frame.chat_id ?? '',
         role: frame.role,
         content: '',
+        kind: 'message',
         tool_calls: null,
         tool_results: null,
         status: 'streaming',
@@ -71,8 +77,10 @@ function applyFrame(state: State, frame: WsFrame): State {
       const newMsg: Message = {
         id: frame.tool_message_id,
         session_id: '',
+        chat_id: frame.chat_id ?? '',
         role: 'tool',
         content: '',
+        kind: 'message',
         tool_calls: null,
         tool_results: {
           tool_call_id: frame.tool_call_id,
@@ -114,12 +122,13 @@ function applyFrame(state: State, frame: WsFrame): State {
         messages: state.messages.filter((m) => !removeSet.has(m.id)),
       };
     }
-    case 'session_renamed': {
-      // Side-effect, not state — dispatch via event bus to other hooks.
+    case 'chat_renamed': {
       sessionEvents.emit({
-        type: 'session_renamed',
-        session_id: frame.session_id,
+        type: 'chat_updated',
+        chat_id: frame.chat_id,
+        session_id: '',
         name: frame.name,
+        updated_at: new Date().toISOString(),
       });
       return state;
     }

apps/web/src/hooks/useSidebar.ts

@@ -13,6 +13,7 @@ let sharedError: string | null = null;
 let sharedLoading: boolean = true;
 let initialized = false;
 let fetchInFlight: Promise<void> | null = null;
+let activeSession: { session_id: string; project_id: string } | null = null;
 const subscribers = new Set<() => void>();
 
 function notify(): void {
@@ -51,9 +52,12 @@ function load(): Promise<void> {
 function applyEvent(prev: SidebarResponse, event: import('./sessionEvents').SessionEvent): SidebarResponse {
   switch (event.type) {
     case 'project_created': {
+      if (prev.projects.some((p) => p.id === event.project.id)) return prev;
       const fresh: SidebarProject = {
         id: event.project.id,
         name: event.project.name,
+        path: event.project.path,
+        gitea_remote: event.project.gitea_remote ?? null,
         recent_sessions: [],
         total_sessions: 0,
       };
@@ -68,12 +72,14 @@ function applyEvent(prev: SidebarResponse, event: import('./sessionEvents').Sess
       let changed = false;
       const projects = prev.projects.map((p) => {
         if (p.id !== event.project_id) return p;
+        if (p.recent_sessions.some((s) => s.id === event.session.id)) return p;
         changed = true;
         const fresh: SidebarSession = {
           id: event.session.id,
           name: event.session.name,
           model: event.session.model,
           updated_at: event.session.updated_at,
+          project_id: event.project_id,
         };
         return {
           ...p,
@@ -87,8 +93,10 @@ function applyEvent(prev: SidebarResponse, event: import('./sessionEvents').Sess
       let changed = false;
       const projects = prev.projects.map((p) => {
         if (p.id !== event.project_id) return p;
-        changed = true;
         const recent = p.recent_sessions.filter((s) => s.id !== event.session_id);
+        const wasPresent = recent.length !== p.recent_sessions.length;
+        if (!wasPresent) return p;
+        changed = true;
         return {
           ...p,
           recent_sessions: recent,
@@ -113,30 +121,117 @@ function applyEvent(prev: SidebarResponse, event: import('./sessionEvents').Sess
       });
       return changed ? { ...prev, projects } : prev;
     }
-    default:
+    case 'session_updated': {
+      let changed = false;
+      const projects = prev.projects.map((p) => {
+        if (p.id !== event.project_id) return p;
+        let projectChanged = false;
+        const recent = p.recent_sessions.map((s) => {
+          if (s.id !== event.session_id) return s;
+          projectChanged = true;
+          return { ...s, name: event.name, updated_at: event.updated_at };
+        });
+        if (!projectChanged) return p;
+        changed = true;
+        const sorted = [...recent].sort(
+          (a, b) => new Date(b.updated_at).getTime() - new Date(a.updated_at).getTime()
+        );
+        return { ...p, recent_sessions: sorted };
+      });
+      return changed ? { ...prev, projects } : prev;
+    }
+    case 'session_loaded':
+      // activeSessionProjectId is updated in the subscribe callback; no data change here.
       return prev;
+    case 'open_file_in_browser':
+      // Consumed by Workspace (T7); no sidebar state change needed.
+      return prev;
+    case 'attach_chat_file':
+      return prev;
+    case 'open_chat_in_active_pane':
+      // Consumed by Workspace; sidebar has no business with pane state.
+      return prev;
+    case 'session_archived': {
+      let changed = false;
+      const projects = prev.projects.map((p) => {
+        if (p.id !== event.project_id) return p;
+        const recent = p.recent_sessions.filter((s) => s.id !== event.session_id);
+        if (recent.length === p.recent_sessions.length) return p;
+        changed = true;
+        return {
+          ...p,
+          recent_sessions: recent,
+          total_sessions: Math.max(0, p.total_sessions - 1),
+        };
+      });
+      return changed ? { ...prev, projects } : prev;
+    }
+    case 'chat_created':
+    case 'chat_updated':
+    case 'chat_archived':
+    case 'chat_unarchived':
+    case 'chat_deleted':
+      return prev;
+    case 'project_archived': {
+      const next = prev.projects.filter((p) => p.id !== event.project_id);
+      if (next.length === prev.projects.length) return prev;
+      return { ...prev, projects: next };
+    }
+    case 'project_unarchived': {
+      if (prev.projects.some((p) => p.id === event.project.id)) return prev;
+      const fresh: SidebarProject = {
+        id: event.project.id,
+        name: event.project.name,
+        path: event.project.path,
+        gitea_remote: event.project.gitea_remote ?? null,
+        recent_sessions: [],
+        total_sessions: 0,
+      };
+      return { ...prev, projects: [fresh, ...prev.projects] };
+    }
+    case 'project_updated': {
+      let changed = false;
+      const projects = prev.projects.map((p) => {
+        if (p.id !== event.project_id) return p;
+        if (p.name === event.name) return p;
+        changed = true;
+        return { ...p, name: event.name };
+      });
+      return changed ? { ...prev, projects } : prev;
+    }
   }
 }
 
 // One bus subscription for the lifetime of the module. Events arriving
 // before the initial fetch resolves are dropped; the eventual fetch
 // result is the source of truth.
-sessionEvents.subscribe((event) => {
-  if (!sharedData) return;
-  const next = applyEvent(sharedData, event);
-  if (next === sharedData) return;
-  sharedData = next;
-  notify();
-});
+// Guard prevents duplicate listeners during Vite HMR reloads.
+const G = globalThis as Record<string, unknown>;
+if (!G.__boocode_sidebar_subscribed) {
+  G.__boocode_sidebar_subscribed = true;
+  sessionEvents.subscribe((event) => {
+    if (event.type === 'session_loaded') {
+      activeSession = { session_id: event.session_id, project_id: event.project_id };
+      notify();
+      return;
+    }
+    if (!sharedData) return;
+    const next = applyEvent(sharedData, event);
+    if (next === sharedData) return;
+    sharedData = next;
+    notify();
+  });
+}
 
 interface Snapshot {
   data: SidebarResponse | null;
   error: string | null;
   loading: boolean;
+  activeSession: { session_id: string; project_id: string } | null;
 }
 
 function snapshot(): Snapshot {
-  return { data: sharedData, error: sharedError, loading: sharedLoading };
+  return { data: sharedData, error: sharedError, loading: sharedLoading, activeSession };
 }
 
 export function useSidebar(): {
@@ -144,6 +239,7 @@ export function useSidebar(): {
   error: string | null;
   loading: boolean;
   retry: () => void;
+  activeSession: { session_id: string; project_id: string } | null;
 } {
   const [state, setState] = useState<Snapshot>(snapshot);
 
@@ -165,5 +261,5 @@ export function useSidebar(): {
     void load();
   };
 
-  return { data: state.data, error: state.error, loading: state.loading, retry };
+  return { data: state.data, error: state.error, loading: state.loading, retry, activeSession: state.activeSession };
 }

apps/web/src/hooks/useSidebarDrawer.tsx

@@ -0,0 +1,36 @@
+import { createContext, useCallback, useContext, useEffect, useState } from 'react';
+import type { ReactNode } from 'react';
+import { useLocation } from 'react-router-dom';
+
+interface SidebarDrawerState {
+  open: boolean;
+  setOpen: (open: boolean) => void;
+  toggle: () => void;
+}
+
+const Ctx = createContext<SidebarDrawerState | null>(null);
+
+export function SidebarDrawerProvider({ children }: { children: ReactNode }) {
+  const [open, setOpen] = useState(false);
+  const location = useLocation();
+
+  // Auto-close on navigation. Effect fires once on mount too (open default
+  // is false, so no observable effect) and on every pathname change after.
+  useEffect(() => {
+    setOpen(false);
+  }, [location.pathname]);
+
+  const toggle = useCallback(() => setOpen((v) => !v), []);
+
+  return <Ctx.Provider value={{ open, setOpen, toggle }}>{children}</Ctx.Provider>;
+}
+
+export function useSidebarDrawer(): SidebarDrawerState {
+  const ctx = useContext(Ctx);
+  if (!ctx) {
+    // Soft fallback so consumers don't crash if rendered outside a provider.
+    // In practice all top-level routes are inside the provider.
+    return { open: false, setOpen: () => {}, toggle: () => {} };
+  }
+  return ctx;
+}

apps/web/src/hooks/useUserEvents.ts

@@ -0,0 +1,58 @@
+import { useEffect } from 'react';
+import { sessionEvents } from './sessionEvents';
+
+const RECONNECT_INITIAL_MS = 1000;
+const RECONNECT_MAX_MS = 30000;
+
+export function useUserEvents(): void {
+  useEffect(() => {
+    let ws: WebSocket | null = null;
+    let reconnectTimer: ReturnType<typeof setTimeout> | null = null;
+    let reconnectDelay = RECONNECT_INITIAL_MS;
+    let unmounted = false;
+
+    const connect = () => {
+      if (unmounted) return;
+      const url = new URL('/api/ws/user', window.location.href);
+      url.protocol = url.protocol === 'https:' ? 'wss:' : 'ws:';
+      ws = new WebSocket(url.toString());
+
+      ws.onopen = () => {
+        reconnectDelay = RECONNECT_INITIAL_MS;
+      };
+
+      ws.onmessage = (ev) => {
+        try {
+          const parsed: unknown = JSON.parse(ev.data);
+          if (parsed && typeof (parsed as { type?: unknown }).type === 'string') {
+            sessionEvents.emit(parsed as import('./sessionEvents').SessionEvent);
+          }
+        } catch (err) {
+          console.warn('useUserEvents: failed to parse frame', err);
+        }
+      };
+
+      ws.onclose = () => {
+        if (unmounted) return;
+        const delay = reconnectDelay;
+        reconnectDelay = Math.min(reconnectDelay * 2, RECONNECT_MAX_MS);
+        reconnectTimer = setTimeout(connect, delay);
+      };
+
+      ws.onerror = () => {
+        // close handler will trigger reconnect; best-effort, ignore failure
+        // because the socket may already be closing
+        try { ws?.close(); } catch {}
+      };
+    };
+
+    connect();
+
+    return () => {
+      unmounted = true;
+      if (reconnectTimer) clearTimeout(reconnectTimer);
+      // best-effort cleanup; ignore failure because the socket may already be closed
+      if (ws) try { ws.close(); } catch {}
+    };
+  }, []);
+}

apps/web/src/hooks/useViewport.ts

@@ -0,0 +1,45 @@
+import { useEffect, useState } from 'react';
+
+// Breakpoints (px): mobile <768, tablet 768-1023, desktop >=1024.
+const MOBILE_MAX = 767;
+const TABLET_MAX = 1023;
+
+export interface ViewportSnapshot {
+  isMobile: boolean;
+  isTablet: boolean;
+  width: number;
+}
+
+function snapshot(): ViewportSnapshot {
+  if (typeof window === 'undefined') {
+    return { isMobile: false, isTablet: false, width: 1280 };
+  }
+  const width = window.innerWidth;
+  return {
+    isMobile: width <= MOBILE_MAX,
+    isTablet: width > MOBILE_MAX && width <= TABLET_MAX,
+    width,
+  };
+}
+
+// matchMedia-based, no resize polling. We listen to two breakpoint queries
+// and recompute the snapshot on any change.
+export function useViewport(): ViewportSnapshot {
+  const [state, setState] = useState<ViewportSnapshot>(snapshot);
+
+  useEffect(() => {
+    if (typeof window === 'undefined') return;
+    const mobileMq = window.matchMedia(`(max-width: ${MOBILE_MAX}px)`);
+    const tabletMq = window.matchMedia(`(min-width: ${MOBILE_MAX + 1}px) and (max-width: ${TABLET_MAX}px)`);
+    const update = () => setState(snapshot());
+    mobileMq.addEventListener('change', update);
+    tabletMq.addEventListener('change', update);
+    update();
+    return () => {
+      mobileMq.removeEventListener('change', update);
+      tabletMq.removeEventListener('change', update);
+    };
+  }, []);
+
+  return state;
+}

apps/web/src/hooks/useWorkspacePanes.ts

@@ -0,0 +1,339 @@
+import { useCallback, useEffect, useRef, useState } from 'react';
+import type { DragEvent } from 'react';
+import { toast } from 'sonner';
+import type { WorkspacePane } from '@/api/types';
+import { setActivePaneInfo, clearActivePane } from '@/hooks/useActivePane';
+
+export const MAX_PANES = 5;
+const STORAGE_KEY = 'boocode.workspace.panes';
+
+function generateId(): string {
+  return crypto.randomUUID();
+}
+
+function emptyPane(): WorkspacePane {
+  return { id: generateId(), kind: 'empty', chatIds: [], activeChatIdx: -1 };
+}
+
+function chatPane(chatId: string): WorkspacePane {
+  return { id: generateId(), kind: 'chat', chatId, chatIds: [chatId], activeChatIdx: 0 };
+}
+
+function loadPanes(sessionId: string): WorkspacePane[] | null {
+  try {
+    const raw = localStorage.getItem(`${STORAGE_KEY}.${sessionId}`);
+    if (!raw) return null;
+    const parsed = JSON.parse(raw) as WorkspacePane[];
+    if (!Array.isArray(parsed) || parsed.length === 0) return null;
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+
+function savePanes(sessionId: string, panes: WorkspacePane[]): void {
+  try {
+    localStorage.setItem(`${STORAGE_KEY}.${sessionId}`, JSON.stringify(panes));
+  } catch { /* quota or disabled */ }
+}
+
+export interface UseWorkspacePanesResult {
+  panes: WorkspacePane[];
+  activePaneIdx: number;
+  setActivePaneIdx: React.Dispatch<React.SetStateAction<number>>;
+  activePaneIdxRef: React.MutableRefObject<number>;
+  openChatInPane: (paneIdx: number, chatId: string) => void;
+  switchTab: (paneIdx: number, tabIdx: number) => void;
+  removeTab: (paneIdx: number, chatId: string) => void;
+  closeOtherTabs: (paneIdx: number, keepChatId: string) => void;
+  closeTabsToRight: (paneIdx: number, pivotChatId: string) => void;
+  closeAllTabs: (paneIdx: number) => void;
+  showLandingPage: (paneIdx: number) => void;
+  addSplitPane: (kind: 'chat' | 'terminal' | 'agent') => void;
+  removePane: (idx: number) => void;
+  removeChatFromPanes: (chatId: string) => void;
+  initializeFirstChatIfEmpty: (chatId: string) => void;
+  handlePaneDragStart: (idx: number) => (e: DragEvent<HTMLDivElement>) => void;
+  handlePaneDragOver: (idx: number) => (e: DragEvent<HTMLDivElement>) => void;
+  handlePaneDragLeave: () => void;
+  handlePaneDrop: (targetIdx: number) => (e: DragEvent<HTMLDivElement>) => void;
+  handlePaneDragEnd: () => void;
+  dragOverIdx: number | null;
+  draggingIdxRef: React.MutableRefObject<number | null>;
+}
+
+export function useWorkspacePanes(sessionId: string): UseWorkspacePanesResult {
+  const [panes, setPanes] = useState<WorkspacePane[]>(() => {
+    return loadPanes(sessionId) ?? [emptyPane()];
+  });
+  const [activePaneIdx, setActivePaneIdx] = useState(0);
+  const draggingIdxRef = useRef<number | null>(null);
+  const [dragOverIdx, setDragOverIdx] = useState<number | null>(null);
+
+  useEffect(() => {
+    savePanes(sessionId, panes);
+  }, [sessionId, panes]);
+
+  useEffect(() => {
+    const active = panes[activePaneIdx];
+    if (!active) {
+      clearActivePane();
+      return;
+    }
+    setActivePaneInfo({
+      sessionId,
+      paneId: active.id,
+      kind: active.kind,
+      activeFile: null,
+    });
+  }, [sessionId, panes, activePaneIdx]);
+
+  useEffect(() => {
+    return () => {
+      clearActivePane();
+    };
+  }, []);
+
+  const activePaneIdxRef = useRef(activePaneIdx);
+  activePaneIdxRef.current = activePaneIdx;
+
+  const openChatInPane = useCallback((paneIdx: number, chatId: string) => {
+    setPanes((prev) => {
+      const next = [...prev];
+      const pane = next[paneIdx]!;
+      const existing = pane.chatIds.indexOf(chatId);
+      if (existing >= 0) {
+        next[paneIdx] = { ...pane, kind: 'chat', chatId, activeChatIdx: existing };
+      } else {
+        const newIds = [...pane.chatIds, chatId];
+        next[paneIdx] = {
+          ...pane,
+          kind: 'chat',
+          chatId,
+          chatIds: newIds,
+          activeChatIdx: newIds.length - 1,
+        };
+      }
+      return next;
+    });
+    setActivePaneIdx(paneIdx);
+  }, []);
+
+  const switchTab = useCallback((paneIdx: number, tabIdx: number) => {
+    setPanes((prev) => {
+      const next = [...prev];
+      const pane = next[paneIdx]!;
+      const chatId = pane.chatIds[tabIdx];
+      if (!chatId) return prev;
+      next[paneIdx] = { ...pane, chatId, activeChatIdx: tabIdx };
+      return next;
+    });
+  }, []);
+
+  const removeTab = useCallback((paneIdx: number, chatId: string) => {
+    setPanes((prev) => {
+      const next = [...prev];
+      const pane = next[paneIdx]!;
+      const nextIds = pane.chatIds.filter((id) => id !== chatId);
+      if (nextIds.length === 0) {
+        next[paneIdx] = { ...pane, kind: 'empty', chatId: undefined, chatIds: [], activeChatIdx: -1 };
+      } else {
+        const nextActiveIdx = Math.min(pane.activeChatIdx, nextIds.length - 1);
+        next[paneIdx] = {
+          ...pane,
+          chatIds: nextIds,
+          activeChatIdx: nextActiveIdx,
+          chatId: nextIds[nextActiveIdx],
+        };
+      }
+      return next;
+    });
+  }, []);
+
+  // Keep only the right-clicked tab open in this pane.
+  const closeOtherTabs = useCallback((paneIdx: number, keepChatId: string) => {
+    setPanes((prev) => {
+      const next = [...prev];
+      const pane = next[paneIdx]!;
+      const keepIdx = pane.chatIds.indexOf(keepChatId);
+      if (keepIdx < 0) return prev;
+      next[paneIdx] = {
+        ...pane,
+        kind: 'chat',
+        chatId: keepChatId,
+        chatIds: [keepChatId],
+        activeChatIdx: 0,
+      };
+      return next;
+    });
+  }, []);
+
+  // Close every tab to the right of the right-clicked one.
+  const closeTabsToRight = useCallback((paneIdx: number, pivotChatId: string) => {
+    setPanes((prev) => {
+      const next = [...prev];
+      const pane = next[paneIdx]!;
+      const pivotIdx = pane.chatIds.indexOf(pivotChatId);
+      if (pivotIdx < 0 || pivotIdx === pane.chatIds.length - 1) return prev;
+      const nextIds = pane.chatIds.slice(0, pivotIdx + 1);
+      const nextActiveIdx = Math.min(pane.activeChatIdx, nextIds.length - 1);
+      next[paneIdx] = {
+        ...pane,
+        chatIds: nextIds,
+        activeChatIdx: nextActiveIdx,
+        chatId: nextIds[nextActiveIdx],
+      };
+      return next;
+    });
+  }, []);
+
+  // Close every tab in this pane; land on landing page.
+  const closeAllTabs = useCallback((paneIdx: number) => {
+    setPanes((prev) => {
+      const next = [...prev];
+      const pane = next[paneIdx]!;
+      next[paneIdx] = { ...pane, kind: 'empty', chatId: undefined, chatIds: [], activeChatIdx: -1 };
+      return next;
+    });
+  }, []);
+
+  const showLandingPage = useCallback((paneIdx: number) => {
+    setPanes((prev) => {
+      const next = [...prev];
+      const pane = next[paneIdx]!;
+      next[paneIdx] = { ...pane, kind: 'empty', chatId: undefined };
+      return next;
+    });
+  }, []);
+
+  const addSplitPane = useCallback((kind: 'chat' | 'terminal' | 'agent') => {
+    if (kind === 'terminal') {
+      toast('Terminal panes coming in BooTerm');
+      return;
+    }
+    if (kind === 'agent') {
+      toast('Agent panes coming in BooCoder');
+      return;
+    }
+    setPanes((prev) => {
+      if (prev.length >= MAX_PANES) {
+        toast.error(`Maximum ${MAX_PANES} panes`);
+        return prev;
+      }
+      const next = [...prev, emptyPane()];
+      setActivePaneIdx(next.length - 1);
+      return next;
+    });
+  }, []);
+
+  const removePane = useCallback((idx: number) => {
+    setPanes((prev) => {
+      if (prev.length <= 1) return prev;
+      const next = prev.filter((_, i) => i !== idx);
+      setActivePaneIdx((ai) => Math.min(ai, next.length - 1));
+      return next;
+    });
+  }, []);
+
+  // Replaces a single empty default pane with a chat pane. Used by the initial
+  // chat fetch to land on the most-recent open chat if no saved pane state.
+  const initializeFirstChatIfEmpty = useCallback((chatId: string) => {
+    setPanes((prev) => {
+      if (prev.length === 1 && prev[0]!.kind === 'empty') {
+        return [chatPane(chatId)];
+      }
+      return prev;
+    });
+  }, []);
+
+  const removeChatFromPanes = useCallback((chatId: string) => {
+    setPanes((prev) => prev.map((p) => {
+      const idx = p.chatIds.indexOf(chatId);
+      if (idx < 0) return p;
+      const nextIds = p.chatIds.filter((id) => id !== chatId);
+      if (nextIds.length === 0) {
+        return { ...p, kind: 'empty' as const, chatId: undefined, chatIds: [], activeChatIdx: -1 };
+      }
+      const nextActiveIdx = Math.min(p.activeChatIdx, nextIds.length - 1);
+      return {
+        ...p,
+        chatIds: nextIds,
+        activeChatIdx: nextActiveIdx,
+        chatId: nextIds[nextActiveIdx],
+      };
+    }));
+  }, []);
+
+  const handlePaneDragStart = useCallback(
+    (idx: number) => (e: DragEvent<HTMLDivElement>) => {
+      draggingIdxRef.current = idx;
+      e.dataTransfer.effectAllowed = 'move';
+      e.dataTransfer.setData('text/plain', String(idx));
+    },
+    []
+  );
+
+  const handlePaneDragOver = useCallback(
+    (idx: number) => (e: DragEvent<HTMLDivElement>) => {
+      if (draggingIdxRef.current === null) return;
+      e.preventDefault();
+      e.dataTransfer.dropEffect = 'move';
+      if (dragOverIdx !== idx) setDragOverIdx(idx);
+    },
+    [dragOverIdx]
+  );
+
+  const handlePaneDragLeave = useCallback(() => {
+    setDragOverIdx(null);
+  }, []);
+
+  const handlePaneDrop = useCallback(
+    (targetIdx: number) => (e: DragEvent<HTMLDivElement>) => {
+      e.preventDefault();
+      const fromIdx = draggingIdxRef.current;
+      draggingIdxRef.current = null;
+      setDragOverIdx(null);
+      if (fromIdx === null || fromIdx === targetIdx) return;
+      setPanes((prev) => {
+        const next = [...prev];
+        const [moved] = next.splice(fromIdx, 1);
+        if (!moved) return prev;
+        next.splice(targetIdx, 0, moved);
+        // Keep active selection on the same logical pane (the one being dragged).
+        setActivePaneIdx(targetIdx);
+        return next;
+      });
+    },
+    []
+  );
+
+  const handlePaneDragEnd = useCallback(() => {
+    draggingIdxRef.current = null;
+    setDragOverIdx(null);
+  }, []);
+
+  return {
+    panes,
+    activePaneIdx,
+    setActivePaneIdx,
+    activePaneIdxRef,
+    openChatInPane,
+    switchTab,
+    removeTab,
+    closeOtherTabs,
+    closeTabsToRight,
+    closeAllTabs,
+    showLandingPage,
+    addSplitPane,
+    removePane,
+    removeChatFromPanes,
+    initializeFirstChatIfEmpty,
+    handlePaneDragStart,
+    handlePaneDragOver,
+    handlePaneDragLeave,
+    handlePaneDrop,
+    handlePaneDragEnd,
+    dragOverIdx,
+    draggingIdxRef,
+  };
+}

apps/web/src/lib/attachments.ts

@@ -0,0 +1,72 @@
+export type Attachment = {
+  id: string;
+  kind: 'file' | 'lines' | 'paste';
+  filename: string;
+  language: string | null;
+  content: string;
+  range?: [number, number];
+  source: '@' | 'line-select' | 'drop' | 'paste';
+};
+
+// v1.7: caps shared between drag-drop and paste-as-attachment so both paths
+// reject the same way. Match the existing 10-attachment cap in
+// ChatInput.addAttachment.
+export const MAX_FILE_SIZE_BYTES = 5 * 1024 * 1024; // 5 MB
+export const PASTE_INLINE_MAX_LINES = 8;
+
+// First-8KB null-byte scan. Returns true if the content looks binary.
+// Accepts a string (post-decode), an ArrayBuffer (pre-decode), or a Uint8Array.
+// For binary files like PNG, scanning bytes is more reliable than scanning
+// post-UTF-8-decode strings because invalid sequences may be replaced rather
+// than preserved.
+export function looksBinary(content: string | ArrayBuffer | Uint8Array): boolean {
+  const SCAN_BYTES = 8192;
+  if (typeof content === 'string') {
+    const max = Math.min(content.length, SCAN_BYTES);
+    for (let i = 0; i < max; i++) {
+      if (content.charCodeAt(i) === 0) return true;
+    }
+    return false;
+  }
+  const bytes = content instanceof Uint8Array ? content : new Uint8Array(content);
+  const max = Math.min(bytes.length, SCAN_BYTES);
+  for (let i = 0; i < max; i++) {
+    if (bytes[i] === 0) return true;
+  }
+  return false;
+}
+
+export const LANG_MAP: Record<string, string> = {
+  ts: 'typescript', tsx: 'tsx', js: 'javascript', jsx: 'jsx',
+  mjs: 'javascript', cjs: 'javascript',
+  py: 'python', go: 'go', rs: 'rust', rb: 'ruby', java: 'java',
+  c: 'c', h: 'c', cpp: 'cpp', cc: 'cpp', hpp: 'cpp', cs: 'csharp',
+  php: 'php', sh: 'bash', bash: 'bash', zsh: 'bash',
+  yml: 'yaml', yaml: 'yaml', json: 'json', toml: 'toml',
+  md: 'markdown', markdown: 'markdown', sql: 'sql', dockerfile: 'dockerfile',
+  html: 'html', htm: 'html', css: 'css', scss: 'scss',
+};
+
+export function inferLanguage(filename: string): string | null {
+  const base = filename.split('/').pop() ?? filename;
+  if (base.toLowerCase() === 'dockerfile') return 'dockerfile';
+  const m = base.match(/\.([^.]+)$/);
+  return m ? (LANG_MAP[m[1]!.toLowerCase()] ?? null) : null;
+}
+
+export function flattenToMessage(attachments: Attachment[], text: string): string {
+  if (attachments.length === 0) return text;
+  const blocks = attachments.map(a => {
+    const fence = '```' + (a.language ?? '');
+    let header: string;
+    if (a.kind === 'lines') {
+      header = `// from: ${a.filename}:${a.range?.[0] ?? '?'}-${a.range?.[1] ?? '?'}`;
+    } else if (a.kind === 'paste') {
+      header = `// from: pasted text (${a.content.split('\n').length} lines)`;
+    } else {
+      header = `// from: ${a.filename}`;
+    }
+    return `${fence}\n${header}\n${a.content}\n\`\`\``;
+  });
+  return [...blocks, text].filter(Boolean).join('\n\n');
+}

apps/web/src/lib/format.ts

@@ -0,0 +1,5 @@
+export function formatTokens(n: number | null | undefined): string | null {
+  if (n === null || n === undefined) return null;
+  if (n < 1000) return `${n} tok`;
+  return `${(n / 1000).toFixed(1)}k tok`;
+}

apps/web/src/lib/projectUrls.ts

@@ -0,0 +1,5 @@
+export function giteaUrlFor(project: { path: string; gitea_remote?: string | null }): string {
+  if (project.gitea_remote) return project.gitea_remote;
+  const folderName = project.path.split('/').filter(Boolean).pop() ?? '';
+  return `https://git.indifferentketchup.com/indifferentketchup/${folderName}`;
+}

apps/web/src/pages/Home.tsx

@@ -1,35 +1,166 @@
-import { useState } from 'react';
+import { useEffect, useState } from 'react';
+import { ChevronDown, ChevronRight, Folder, FolderTree, Menu, RotateCcw } from 'lucide-react';
+import { toast } from 'sonner';
 import { Button } from '@/components/ui/button';
 import { AddProjectModal } from '@/components/AddProjectModal';
+import { CreateProjectModal } from '@/components/CreateProjectModal';
+import { api } from '@/api/client';
+import type { Project } from '@/api/types';
+import { sessionEvents } from '@/hooks/sessionEvents';
 import { useSidebar } from '@/hooks/useSidebar';
+import { useSidebarDrawer } from '@/hooks/useSidebarDrawer';
+import { useRightRailDrawer } from '@/hooks/useRightRailDrawer';
+import { useViewport } from '@/hooks/useViewport';
 
 export function Home() {
   const { data } = useSidebar();
-  const [open, setOpen] = useState(false);
+  const [addOpen, setAddOpen] = useState(false);
+  const [createOpen, setCreateOpen] = useState(false);
+  const [archived, setArchived] = useState<Project[] | null>(null);
+  const [showArchived, setShowArchived] = useState(false);
+  const { setOpen: setSidebarOpen } = useSidebarDrawer();
+  const { toggle: toggleRightRail } = useRightRailDrawer();
+  const { isMobile } = useViewport();
 
   const empty = data ? data.projects.length === 0 : false;
 
+  useEffect(() => {
+    api.projects.list({ status: 'archived' })
+      .then(setArchived)
+      .catch(() => {});
+  }, []);
+
+  useEffect(() => {
+    return sessionEvents.subscribe((event) => {
+      if (event.type === 'project_archived') {
+        setArchived((prev) => {
+          if (!prev) return prev;
+          if (prev.some((p) => p.id === event.project_id)) return prev;
+          const fromSidebar = data?.projects.find((p) => p.id === event.project_id);
+          if (!fromSidebar) return prev;
+          return [
+            {
+              id: fromSidebar.id,
+              name: fromSidebar.name,
+              path: fromSidebar.path,
+              added_at: new Date().toISOString(),
+              last_session_id: null,
+              status: 'archived' as const,
+              gitea_remote: fromSidebar.gitea_remote,
+            },
+            ...prev,
+          ];
+        });
+      }
+      if (event.type === 'project_unarchived') {
+        setArchived((prev) => prev ? prev.filter((p) => p.id !== event.project.id) : prev);
+      }
+      if (event.type === 'project_deleted') {
+        setArchived((prev) => prev ? prev.filter((p) => p.id !== event.project_id) : prev);
+      }
+      if (event.type === 'project_updated') {
+        setArchived((prev) =>
+          prev ? prev.map((p) => p.id === event.project_id ? { ...p, name: event.name } : p) : prev
+        );
+      }
+    });
+  }, [data]);
+
+  async function handleUnarchive(id: string) {
+    try {
+      await api.projects.unarchive(id);
+      // Server publishes project_unarchived; useUserEvents delivers it.
+    } catch (err) {
+      toast.error(err instanceof Error ? err.message : 'failed to restore project');
+    }
+  }
+
   return (
-    <div className="flex-1 flex items-center justify-center px-6">
-      <div className="max-w-md text-center space-y-4">
-        {empty ? (
-          <>
-            <h1 className="text-2xl font-semibold tracking-tight">No projects yet</h1>
-            <p className="text-sm text-muted-foreground">
-              Add a project from /opt to start chatting about its code.
-            </p>
-            <Button onClick={() => setOpen(true)}>Add project</Button>
-          </>
-        ) : (
-          <>
-            <h1 className="text-2xl font-semibold tracking-tight">BooCode</h1>
-            <p className="text-sm text-muted-foreground">
-              Pick a project from the sidebar.
-            </p>
-          </>
+    <div className="flex-1 flex flex-col min-h-0">
+      {isMobile && (
+        <header
+          className="border-b px-3 sm:px-4 py-2 flex items-center gap-1.5 shrink-0 text-sm"
+          style={{ paddingTop: 'max(0.5rem, env(safe-area-inset-top))' }}
+        >
+          <button
+            type="button"
+            onClick={() => setSidebarOpen(true)}
+            className="inline-flex items-center justify-center -ml-1 min-w-[44px] min-h-[44px] rounded text-muted-foreground hover:bg-muted hover:text-foreground shrink-0"
+            aria-label="Open sidebar"
+          >
+            <Menu className="size-5" />
+          </button>
+          <button
+            type="button"
+            onClick={toggleRightRail}
+            className="inline-flex items-center justify-center -mr-1 ml-auto min-w-[44px] min-h-[44px] rounded text-muted-foreground hover:bg-muted hover:text-foreground shrink-0"
+            aria-label="Toggle file browser"
+          >
+            <FolderTree className="size-5" />
+          </button>
+        </header>
+      )}
+      <div className="flex-1 flex flex-col items-center px-6 py-12 overflow-y-auto">
+        <div className="w-full max-w-md space-y-6">
+        <div className="text-center space-y-3">
+          {empty ? (
+            <>
+              <h1 className="text-2xl font-semibold tracking-tight">No projects yet</h1>
+              <p className="text-sm text-muted-foreground">
+                Add a project from /opt or create a new one.
+              </p>
+            </>
+          ) : (
+            <>
+              <h1 className="text-2xl font-semibold tracking-tight">BooCode</h1>
+              <p className="text-sm text-muted-foreground">
+                Pick a project from the sidebar, or add another.
+              </p>
+            </>
+          )}
+          <div className="flex gap-2 justify-center pt-2">
+            <Button variant="outline" onClick={() => setAddOpen(true)}>Add existing project</Button>
+            <Button onClick={() => setCreateOpen(true)}>Create new project</Button>
+          </div>
+        </div>
+
+        {archived && archived.length > 0 && (
+          <div className="border-t pt-6">
+            <button
+              type="button"
+              onClick={() => setShowArchived(!showArchived)}
+              className="flex items-center gap-1 text-xs font-medium text-muted-foreground mb-2 hover:text-foreground"
+            >
+              {showArchived ? <ChevronDown size={12} /> : <ChevronRight size={12} />}
+              Archived Projects ({archived.length})
+            </button>
+            {showArchived && (
+              <ul className="divide-y rounded-md border">
+                {archived.map((p) => (
+                  <li key={p.id} className="flex items-center justify-between px-3 py-2 hover:bg-muted/50">
+                    <div className="flex-1 flex items-center gap-2 min-w-0">
+                      <Folder className="size-3.5 opacity-40 shrink-0" />
+                      <span className="truncate text-sm text-muted-foreground" title={p.name}>{p.name}</span>
+                    </div>
+                    <Button
+                      variant="ghost"
+                      size="icon-sm"
+                      aria-label="Restore project"
+                      title="Restore project"
+                      onClick={() => void handleUnarchive(p.id)}
+                    >
+                      <RotateCcw size={14} />
+                    </Button>
+                  </li>
+                ))}
+              </ul>
+            )}
+          </div>
         )}
+        </div>
+        <AddProjectModal open={addOpen} onOpenChange={setAddOpen} onAdded={() => {}} />
+        <CreateProjectModal open={createOpen} onOpenChange={setCreateOpen} />
       </div>
-      <AddProjectModal open={open} onOpenChange={setOpen} onAdded={() => {}} />
     </div>
   );
 }

apps/web/src/pages/Project.tsx

@@ -1,12 +1,14 @@
 import { useEffect, useState } from 'react';
 import { Link, useNavigate, useParams } from 'react-router-dom';
-import { Plus, MessageSquare, Trash2 } from 'lucide-react';
+import { Plus, MessageSquare, Trash2, ChevronDown, ChevronRight, RotateCcw, Menu } from 'lucide-react';
 import { toast } from 'sonner';
 import { api } from '@/api/client';
-import type { Project as ProjectType } from '@/api/types';
+import type { Project as ProjectType, Session } from '@/api/types';
 import { Button } from '@/components/ui/button';
 import { sessionEvents } from '@/hooks/sessionEvents';
 import { useSessions } from '@/hooks/useSessions';
+import { useSidebarDrawer } from '@/hooks/useSidebarDrawer';
+import { useViewport } from '@/hooks/useViewport';
 
 export function Project() {
   const { id } = useParams<{ id: string }>();
@@ -14,6 +16,10 @@ export function Project() {
   const { sessions, create, remove } = useSessions(id);
   const [project, setProject] = useState<ProjectType | null>(null);
   const [creating, setCreating] = useState(false);
+  const [archivedSessions, setArchivedSessions] = useState<Session[] | null>(null);
+  const [showArchived, setShowArchived] = useState(false);
+  const { setOpen: setDrawerOpen } = useSidebarDrawer();
+  const { isMobile } = useViewport();
 
   useEffect(() => {
     if (!id) return;
@@ -23,36 +29,88 @@ export function Project() {
       .catch(() => {});
   }, [id]);
 
+  useEffect(() => {
+    if (!id) return;
+    api.sessions.listForProject(id, 'archived')
+      .then(setArchivedSessions)
+      .catch(() => {});
+  }, [id]);
+
+  useEffect(() => {
+    return sessionEvents.subscribe((event) => {
+      if (event.type === 'session_archived' && event.project_id === id) {
+        setArchivedSessions((prev) => {
+          if (!prev) return prev;
+          if (prev.some((s) => s.id === event.session_id)) return prev;
+          const session = sessions?.find((s) => s.id === event.session_id);
+          if (!session) return prev;
+          return [{ ...session, status: 'archived' as const }, ...prev];
+        });
+      }
+      if (event.type === 'session_deleted' && event.project_id === id) {
+        setArchivedSessions((prev) =>
+          prev ? prev.filter((s) => s.id !== event.session_id) : prev
+        );
+      }
+    });
+  }, [id, sessions]);
+
   async function handleNew() {
     if (!id || creating) return;
     setCreating(true);
     try {
       const s = await create({});
-      sessionEvents.emit({ type: 'session_created', session: s, project_id: id });
+      // Server publishes session_created via WS; let useUserEvents deliver it.
       navigate(`/session/${s.id}`);
     } finally {
       setCreating(false);
     }
   }
 
+  async function handleUnarchive(sessionId: string) {
+    try {
+      await api.sessions.unarchive(sessionId);
+      setArchivedSessions((prev) =>
+        prev ? prev.filter((s) => s.id !== sessionId) : prev
+      );
+    } catch (err) {
+      toast.error(err instanceof Error ? err.message : 'failed to unarchive');
+    }
+  }
+
   return (
     <div className="flex-1 flex flex-col">
-      <header className="border-b px-6 py-3 flex items-center justify-between">
-        <div>
-          <h1 className="text-lg font-semibold tracking-tight">
-            {project?.name ?? '…'}
-          </h1>
-          <div className="text-xs text-muted-foreground font-mono">
-            {project?.path}
+      <header
+        className="border-b px-3 sm:px-6 py-2 sm:py-3 flex items-center justify-between gap-2"
+        style={{ paddingTop: 'max(0.5rem, env(safe-area-inset-top))' }}
+      >
+        <div className="flex items-center gap-2 min-w-0">
+          {isMobile && (
+            <button
+              type="button"
+              onClick={() => setDrawerOpen(true)}
+              className="inline-flex items-center justify-center -ml-1 min-w-[44px] min-h-[44px] rounded text-muted-foreground hover:bg-muted hover:text-foreground shrink-0"
+              aria-label="Open sidebar"
+            >
+              <Menu className="size-5" />
+            </button>
+          )}
+          <div className="min-w-0">
+            <h1 className="text-base sm:text-lg font-semibold tracking-tight truncate">
+              {project?.name ?? '…'}
+            </h1>
+            <div className="text-xs text-muted-foreground font-mono truncate hidden sm:block">
+              {project?.path}
+            </div>
           </div>
         </div>
-        <Button onClick={handleNew} disabled={creating}>
+        <Button onClick={handleNew} disabled={creating} className="shrink-0" aria-label="New session">
           <Plus />
-          New session
+          <span className="hidden sm:inline">New session</span>
         </Button>
       </header>
 
-      <div className="flex-1 overflow-y-auto px-6 py-4">
+      <div className="flex-1 overflow-y-auto px-6 py-4 space-y-6">
         {sessions === null && (
           <div className="text-sm text-muted-foreground">Loading…</div>
         )}
@@ -79,11 +137,7 @@ export function Project() {
                   onClick={async () => {
                     try {
                       await remove(s.id);
-                      sessionEvents.emit({
-                        type: 'session_deleted',
-                        session_id: s.id,
-                        project_id: id!,
-                      });
+                      // Server publishes session_deleted via WS.
                     } catch (err) {
                       toast.error(
                         err instanceof Error ? err.message : 'failed to delete session'
@@ -97,6 +151,61 @@ export function Project() {
             ))}
           </ul>
         )}
+
+        {/* Archived sessions */}
+        {archivedSessions && archivedSessions.length > 0 && (
+          <div>
+            <button
+              type="button"
+              onClick={() => setShowArchived(!showArchived)}
+              className="flex items-center gap-1 text-xs font-medium text-muted-foreground mb-2 hover:text-foreground"
+            >
+              {showArchived ? <ChevronDown size={12} /> : <ChevronRight size={12} />}
+              Closed sessions ({archivedSessions.length})
+            </button>
+            {showArchived && (
+              <ul className="divide-y rounded-md border">
+                {archivedSessions.map((s) => (
+                  <li key={s.id} className="flex items-center justify-between px-3 py-2 hover:bg-muted/50">
+                    <div className="flex-1 flex items-center gap-2 min-w-0">
+                      <MessageSquare className="size-3.5 opacity-40 shrink-0" />
+                      <span className="truncate text-sm text-muted-foreground">{s.name}</span>
+                    </div>
+                    <div className="flex items-center gap-1">
+                      <Button
+                        variant="ghost"
+                        size="icon-sm"
+                        aria-label="Reopen session"
+                        onClick={() => void handleUnarchive(s.id)}
+                      >
+                        <RotateCcw size={14} />
+                      </Button>
+                      <Button
+                        variant="ghost"
+                        size="icon-sm"
+                        aria-label="Delete session permanently"
+                        onClick={async () => {
+                          try {
+                            await api.sessions.remove(s.id);
+                            setArchivedSessions((prev) =>
+                              prev ? prev.filter((a) => a.id !== s.id) : prev
+                            );
+                          } catch (err) {
+                            toast.error(
+                              err instanceof Error ? err.message : 'failed to delete'
+                            );
+                          }
+                        }}
+                      >
+                        <Trash2 />
+                      </Button>
+                    </div>
+                  </li>
+                ))}
+              </ul>
+            )}
+          </div>
+        )}
       </div>
     </div>
   );

apps/web/src/pages/Session.tsx

@@ -1,54 +1,73 @@
-import { useEffect, useRef, useState } from 'react';
-import { Link, useParams } from 'react-router-dom';
-import { ChevronLeft } from 'lucide-react';
-import { toast } from 'sonner';
+import { useEffect, useState } from 'react';
+import { Link, useNavigate, useParams } from 'react-router-dom';
+import { ChevronRight, FolderTree, Menu } from 'lucide-react';
 import { api } from '@/api/client';
-import type { Session as SessionType } from '@/api/types';
-import { useSessionStream } from '@/hooks/useSessionStream';
+import type { Project, Session as SessionType } from '@/api/types';
 import { sessionEvents } from '@/hooks/sessionEvents';
-import { MessageList } from '@/components/MessageList';
-import { ChatInput } from '@/components/ChatInput';
+import { useActivePane } from '@/hooks/useActivePane';
+import { useSidebarDrawer } from '@/hooks/useSidebarDrawer';
+import { useRightRailDrawer } from '@/hooks/useRightRailDrawer';
+import { useViewport } from '@/hooks/useViewport';
+import { Workspace } from '@/components/Workspace';
 import { ModelPicker } from '@/components/ModelPicker';
 
 export function Session() {
   const { id } = useParams<{ id: string }>();
-  const stream = useSessionStream(id);
+  const navigate = useNavigate();
   const [session, setSession] = useState<SessionType | null>(null);
+  const [project, setProject] = useState<Project | null>(null);
   const [name, setName] = useState('');
   const [editingName, setEditingName] = useState(false);
-  const lastErrorRef = useRef<string | null>(null);
-
-  useEffect(() => {
-    if (stream.error && stream.error !== lastErrorRef.current) {
-      lastErrorRef.current = stream.error;
-      toast.error(stream.error);
-    }
-    if (!stream.error) {
-      lastErrorRef.current = null;
-    }
-  }, [stream.error]);
+  const active = useActivePane();
+  const { setOpen: setDrawerOpen } = useSidebarDrawer();
+  const { toggle: toggleRightRail } = useRightRailDrawer();
+  const { isMobile } = useViewport();
 
   useEffect(() => {
     if (!id) return;
     setSession(null);
+    setProject(null);
+    let cancelled = false;
     api.sessions
       .get(id)
       .then((s) => {
+        if (cancelled) return;
         setSession(s);
         setName(s.name);
+        sessionEvents.emit({
+          type: 'session_loaded',
+          session_id: id,
+          project_id: s.project_id,
+        });
+        // Load project for breadcrumb. Listing is fine — small N, cached by client.
+        api.projects.list().then((projects) => {
+          if (cancelled) return;
+          const p = projects.find((x) => x.id === s.project_id);
+          if (p) setProject(p);
+        }).catch((err) => console.warn('Session: failed to load project for breadcrumb', err));
       })
-      .catch(() => {});
+      .catch((err) => console.warn('Session: failed to fetch session', err));
+    return () => {
+      cancelled = true;
+    };
   }, [id]);
 
   useEffect(() => {
     if (!id) return;
     return sessionEvents.subscribe((event) => {
-      if (event.type !== 'session_renamed') return;
-      if (event.session_id !== id) return;
-      setSession((prev) => (prev ? { ...prev, name: event.name } : prev));
-      setName((prev) => (editingName ? prev : event.name));
+      if (event.type === 'session_renamed' && event.session_id === id) {
+        setSession((prev) => (prev ? { ...prev, name: event.name } : prev));
+        setName((prev) => (editingName ? prev : event.name));
+        return;
+      }
+      if (
+        (event.type === 'session_deleted' || event.type === 'session_archived') &&
+        event.session_id === id
+      ) {
+        navigate(`/project/${event.project_id}`);
+      }
     });
-  }, [id, editingName]);
+  }, [id, editingName, navigate]);
 
   async function saveName() {
     if (!id || !session) return;
@@ -60,33 +79,52 @@ export function Session() {
     }
     const updated = await api.sessions.update(id, { name: trimmed });
     setSession(updated);
-    sessionEvents.emit({
-      type: 'session_renamed',
-      session_id: id,
-      name: trimmed,
-    });
     setEditingName(false);
+    // Server publishes session_renamed via broker.publishUser; no local emit needed.
   }
 
-  async function handleSend(content: string) {
-    if (!id) return;
-    await api.messages.send(id, content);
-  }
-
-  const streaming = stream.messages.some((m) => m.status === 'streaming');
+  // Workspace only sets activeFile for file-browser panes; checking it alone
+  // suffices and is forward-compatible with future pane kinds.
+  const showActiveFile = active.sessionId === id && !!active.activeFile;
 
   return (
     <div className="flex-1 flex flex-col min-h-0">
-      <header className="border-b px-4 py-2 flex items-center gap-2 shrink-0">
-        {session && (
-          <Link
-            to={`/project/${session.project_id}`}
-            className="text-muted-foreground hover:text-foreground"
-            aria-label="Back to project"
+      <header
+        className="border-b px-3 sm:px-4 py-2 flex items-center gap-1.5 shrink-0 text-sm"
+        style={{ paddingTop: 'max(0.5rem, env(safe-area-inset-top))' }}
+      >
+        {isMobile && (
+          <button
+            type="button"
+            onClick={() => setDrawerOpen(true)}
+            className="inline-flex items-center justify-center -ml-1 min-w-[44px] min-h-[44px] rounded text-muted-foreground hover:bg-muted hover:text-foreground shrink-0"
+            aria-label="Open sidebar"
           >
-            <ChevronLeft className="size-4" />
-          </Link>
+            <Menu className="size-5" />
+          </button>
         )}
+
+        {/* Breadcrumb — desktop only */}
+        <div className="hidden sm:flex items-center gap-1.5 min-w-0">
+          <Link to="/" className="text-muted-foreground hover:text-foreground shrink-0 text-xs">
+            Projects
+          </Link>
+          <ChevronRight className="size-3 text-muted-foreground/60 shrink-0" />
+          {project ? (
+            <Link
+              to={`/project/${project.id}`}
+              className="text-muted-foreground hover:text-foreground truncate max-w-[200px]"
+              title={project.name}
+            >
+              {project.name}
+            </Link>
+          ) : (
+            <span className="text-muted-foreground/60">…</span>
+          )}
+          <ChevronRight className="size-3 text-muted-foreground/60 shrink-0" />
+        </div>
+
+        {/* Session name — always visible, truncated, editable */}
         {editingName ? (
           <input
             autoFocus
@@ -100,36 +138,63 @@ export function Session() {
                 setEditingName(false);
               }
             }}
-            className="bg-transparent border-b border-border px-1 py-0.5 text-sm font-medium outline-none focus:border-ring"
+            className="bg-transparent border-b border-border px-1 py-0.5 text-sm font-medium outline-none focus:border-ring min-w-0"
           />
         ) : (
           <button
             type="button"
-            className="text-sm font-medium hover:underline"
+            className="text-sm font-medium hover:underline truncate max-w-[140px] sm:max-w-[280px] min-w-0"
             onClick={() => setEditingName(true)}
+            title={session?.name ?? ''}
           >
             {session?.name ?? '…'}
           </button>
         )}
-        <div className="ml-auto">
+
+        {/* Active file — desktop only */}
+        {showActiveFile && active.activeFile && (
+          <>
+            <span className="text-muted-foreground/40 mx-1 hidden sm:inline">·</span>
+            <span
+              className="text-xs font-mono text-muted-foreground truncate max-w-[200px] hidden sm:inline"
+              title={active.activeFile}
+            >
+              {active.activeFile}
+            </span>
+          </>
+        )}
+
+        {/* Model picker — right-aligned */}
+        <div className="ml-auto shrink-0">
           {session && (
-            <ModelPicker
-              value={session.model}
-              onChange={async (model) => {
-                const updated = await api.sessions.update(session.id, { model });
-                setSession(updated);
-              }}
-            />
+            <div className="inline-flex items-center rounded-full bg-muted/40 hover:bg-muted/70 px-1">
+              <ModelPicker
+                value={session.model}
+                onChange={async (model) => {
+                  const updated = await api.sessions.update(session.id, { model });
+                  setSession(updated);
+                }}
+              />
+            </div>
           )}
         </div>
-        {!stream.connected && (
-          <span className="text-xs text-muted-foreground">reconnecting…</span>
+
+        {/* File browser toggle — mobile only */}
+        {isMobile && (
+          <button
+            type="button"
+            onClick={toggleRightRail}
+            className="inline-flex items-center justify-center -mr-1 min-w-[44px] min-h-[44px] rounded text-muted-foreground hover:bg-muted hover:text-foreground shrink-0"
+            aria-label="Toggle file browser"
+          >
+            <FolderTree className="size-5" />
+          </button>
         )}
       </header>
 
-      {id && <MessageList messages={stream.messages} sessionId={id} />}
-
-      <ChatInput disabled={streaming} onSend={handleSend} />
+      {id && session && (
+        <Workspace sessionId={id} projectId={session.project_id} />
+      )}
     </div>
   );
 }

boocode_roadmap.md

@@ -0,0 +1,515 @@
+# BooCode v1.x — Roadmap
+
+Last updated: 2026-05-16
+
+## Overview
+
+BooCode is a standalone code-chat tool at `/opt/boocode/`. Read-only by design in v1.x — pick a project, chat with a local LLM that has file-inspection tools, get streaming responses over WebSocket. Built May 2026 after the in-boolab BooCode mode stalled.
+
+v1 shipped in a single Claude Code session. v1.1 onwards is a batched build-out. Original Batch 1–10 plan was reordered mid-stream — chats-inside-sessions, archive, and fork/delete work was prioritized over the mobile pass.
+
+Live at `https://code.indifferentketchup.com` (Caddy → Authelia → Tailscale → `100.114.205.53:9500`).
+
+-----
+
+## Version summary
+
+|Version         |Theme                                                                                                                                  |Status                           |Notes                                    |
+|----------------|---------------------------------------------------------------------------------------------------------------------------------------|---------------------------------|-----------------------------------------|
+|v1.0            |Initial scaffold, read-only tools, WS streaming                                                                                        |✅ Done                           |Shipped in one Claude Code session       |
+|v1.1-batch1     |Markdown, Copy + Regen, tok/s + ctx, AI chat naming                                                                                    |✅ Merged                         |—                                        |
+|v1.1-batch2     |Sidebar restructure: projects → sessions, max 5 + “view all”                                                                           |✅ Merged                         |—                                        |
+|v1.1-batch3     |Pane system, FileBrowserPane + Shiki, chat→file click, cross-tab                                                                       |✅ Merged                         |—                                        |
+|v1.1-batch3.5   |Chip infrastructure, `@file` picker, line-select-attach                                                                                |✅ Merged                         |—                                        |
+|v1.2            |Chats inside sessions refactor, right-rail, `/compact`, archive, force-send                                                            |✅ Merged                         |Replaced original “Batch 4 = mobile” plan|
+|v1.2-project-ux |Project archive UX, sidebar context menu, full-bootstrap, Gitea API                                                                    |✅ Merged                         |—                                        |
+|v1.3            |Tab-close + chat-archive                                                                                                               |✅ Merged                         |—                                        |
+|v1.4            |Fork from message + delete message + header polish + housekeeping                                                                      |✅ Merged                         |Was original “Batch 5”                   |
+|v1.5            |Refactor splits, vitest harness (23 tests), error-log surfacing, `/opt:ro` + `BOOTSTRAP_ROOT`, persistent context-window tracker       |✅ Merged                         |—                                        |
+|v1.5.1          |Bootstrap hotfix: git in container, SSH keypair, known_hosts, SSH URL rewrite, /opt/projects label                                     |✅ Merged                         |`4a9f207`                                |
+|v1.6-mobile-pass|Mobile pass: drawer, pane stacking, long-press, swipe-to-close, pull-to-refresh, IME safety, safe-area, tap targets + H1 path-guard fix|✅ Merged                         |`57c883b..943ae7d` (6 commits)           |
+|v1.6.1-cleanup  |Mostly audit-only; one fix shipped: RightRail `max-md:hidden` wrapper. Audit reports for secrets, stale code, panes, mount scope, hand-rolled patterns deferred to follow-ups |✅ Merged                         |`6a9fe18`                                |
+|v1.6.2-mobile-ui-fixes|Mobile UI polish from device testing: kill single-pane navigator chrome, header rework, “New chat” in long-press menu, RightRail as mobile drawer (reverts v1.6.1 wrapper) |🔄 Hand-back received, uncommitted|—                                        |
+|v1.7            |Drag-drop + paste-as-attachment (chip infra extension)                                                                                 |Planned                          |Was Batch 6                              |
+|v1.8            |Settings drawer (system prompt per project + session, web search toggle)                                                               |Planned                          |Was Batch 7                              |
+|v1.9            |Web search backend: SearXNG `web_search` + `web_fetch` tools                                                                           |Planned                          |Was Batch 8                              |
+|v1.10           |Agents (Tier 2): `AGENTS.md`, per-agent model/temp/tools, picker                                                                       |Planned                          |Was Batch 9                              |
+|v1.11           |BooTerm: separate container, xterm.js + node-pty + tmux, terminal pane                                                                 |Planned                          |Was Batch 10                             |
+
+-----
+
+## Version details
+
+### v1.1-batch1 — Message polish ✅
+
+Markdown (`react-markdown` + `remark-gfm`), Copy + Regenerate, tok/s + context counter, AI session naming.
+
+**Key decisions:**
+
+- `sessions.name` (not `title`).
+- `enable_thinking: false` + `max_tokens: 30` for Qwen3 utility calls.
+- `messages_deleted` WS frame added for multi-tab regen.
+- In-app event bus (`sessionEvents.ts`, module-scope `Set<Listener>`).
+
+**Schema:** `messages.tokens_used`, `messages.ctx_used`, `messages.ctx_max`, `messages.started_at`, `messages.finished_at`.
+
+-----
+
+### v1.1-batch2 — Sidebar restructure ✅
+
+Projects as expandable groups, up to 5 recent sessions per project, “View all (N)”, `GET /api/sidebar`, `useSidebar` singleton hook.
+
+**Key decisions:**
+
+- `useSidebar` module-scope singleton.
+- `localStorage['boocode.sidebar.expanded']`.
+- `session_renamed` payload `{session_id, name}`.
+
+-----
+
+### v1.1-batch3 — Pane system ✅
+
+`session_panes` table, pane CRUD with transactional position-shift, Workspace + tab strip + drag-to-reorder (native HTML5), ChatPane (extracted), FileBrowserPane (tree + Shiki + filter), chat→file click, PaneTab context menu, `file_ops` + `file_index` shared services, broker user channel + `/ws/user`, `session_updated`, `session_loaded`, idempotent default-Chat-pane backfill.
+
+**Schema:** `session_panes` (id, session_id, position, kind CHECK, state JSONB).
+
+-----
+
+### v1.1-batch3.5 — Chips + @file + line-select ✅
+
+`Attachment` type + `flattenToMessage` + LANG_MAP, `AttachmentChip`, `AttachmentPreviewModal`, ChatInput chip-row, hand-rolled `@file` mention popover, line-select-attach in FileBrowserPane via local `FileViewer`, FileBrowserPane filter upgrade (empty=tree, non-empty=flat).
+
+-----
+
+### v1.2 — Chats inside sessions ✅
+
+Originally planned as the mobile pass. Reshuffled: structural refactor — chats inside sessions, right-rail, `/compact` (chat’s own model summarizes via `kind='compact'` system message), force-send.
+
+**Schema:** `chats` table, `sessions.status`, `messages.chat_id`, `messages.kind` (regular | compact).
+
+-----
+
+### v1.2-project-ux ✅
+
+Full new-project bootstrap (mkdir + git init + .gitignore + first commit + Gitea remote + push), sidebar context menu (Rename / Archive / Open in Gitea), project landing page archived-list, Gitea API integration. Option B taken: `BOOTSTRAP_ROOT` env var, `/opt` stays read-only mount, `/opt/projects` writable.
+
+**Schema:** `projects.status`, `projects.archived_at`.
+
+**Key decisions:**
+
+- `execFile` only, no `exec` shell strings.
+- DB INSERT last in bootstrap sequence.
+- Soft-fail on Gitea steps.
+- Project Delete endpoint exists but stays unexposed (re-add INSERTs fresh row → FK cascade nukes history; archive is the safe pattern).
+
+-----
+
+### v1.3 — Tab close + chat archive ✅
+
+Tab close UX cleanup, chat-level archive (separate from session archive).
+
+-----
+
+### v1.4 — Fork + delete + header polish ✅
+
+Was originally planned as Batch 5.
+
+**Shipped:** `POST /api/sessions/:id/fork` (deep copy messages up to target, new session in same project), `DELETE /api/sessions/:id/messages/:id` (cascading via `messages_deleted` frame), header breadcrumb (Projects → Project → Session), inline-editable session name, file path shown when File Browser pane is active, `useActivePane` hook.
+
+-----
+
+### v1.5 — Refactor + tests + security scoping + context tracker ✅
+
+5-commit sequence:
+
+1. **Refactor:** FileBrowserPane (865 → split with FileViewer extracted), Workspace, inference split.
+1. **Vitest harness:** 23 tests covering routes + resolveProjectPath. Pinned to v3 (Vite 5 / vitest 4 incompatibility).
+1. **Error-log surfacing:** dead-code removal from earlier H1/H2 audit items, structured error logs to client.
+1. **Mount scoping:** `/opt:/opt:ro` + `BOOTSTRAP_ROOT` writable subdir. Container loses write to `/opt` proper.
+1. **Persistent context-window tracker:** floating popover above chat input right edge, source = latest `message_complete` frame’s `ctx_used` / `ctx_max`, color-coded (neutral <60%, amber 60–85%, red 85%+), hides when `ctx_max` null.
+
+**Carried bug:** `resolveProjectPath` whitelist-root bypass — discovered, asserted as “BEHAVIOR GAP” rather than silently patched. Fix landed in v1.6 (H1).
+
+-----
+
+### v1.5.1 — Bootstrap hotfix ✅ (`4a9f207`)
+
+Dockerfile (git installed in container), docker-compose.yml, project_bootstrap.ts (SSH keypair, known_hosts, SSH URL Tailscale rewrite), CreateProjectModal.tsx, .gitignore. /opt/projects label clarified.
+
+**Known issue carried forward:** dispatch used the in-repo `secrets/boocode_gitea` SSH key because the agent key was rejected. Key exposure flagged. Audit + rotation tracked in v1.6.1 below.
+
+-----
+
+### v1.6-mobile-pass ✅
+
+**Merged via 6 commits `57c883b..943ae7d`** (5 functional + 1 docs):
+
+1. `57c883b chore: fix resolveProjectPath whitelist-root bypass` (H1 — dropped `real !== whitelistReal` short-circuit; flipped the v1.5 BEHAVIOR GAP test; 23/23 pass).
+1. `a643b5f feat(mobile): viewport hook + sidebar drawer + hamburger headers` (M1 + M2 + M6-header).
+1. `cd897d6 feat(mobile): single-pane stack + long-press tab menu + swipe-to-close` (M3 + M4 + A2).
+1. `273eeac feat(mobile): chat input keybinds + safe-area + tap targets + overflow safety` (M5 + M6-bottom + M7 + M8).
+1. `4b5b9b2 feat(mobile): pull-to-refresh sidebar list` (A1).
+1. `943ae7d docs: add v1.x roadmap snapshot` (this file).
+
+**Decisions:**
+
+- H2 (roadmap update) handled in this file rather than by Claude Code.
+- M5: mobile = button-only send, Enter inserts newline. Desktop unchanged. `isComposing` guard for CJK IME.
+- M6: kept `max-w-[1000px]` (mobile naturally full-width below cap).
+- URL state: `?pane=<paneId>`. Bare URL resets activePaneIdx to 0.
+- Long-press dispatches synthetic `contextmenu` on `[data-tab-id]`, opening Radix ContextMenuTrigger at touch coords. iOS callout suppressed.
+- `SwipeablePaneTab`: 60px threshold, bails if vertical >30px, opacity 1→0.4.
+- A2 bundled with M3 in Commit 3 (structural coupling).
+- Home.tsx no hamburger.
+
+**Deferred from v1.6 → rolled into v1.6.1-cleanup:**
+
+- RightRail still renders on mobile (~32px column).
+- Secrets hygiene audit.
+- `ProjectSidebar.tsx` and `ChatTabBar.tsx` share content from two commits each — use `git add -p`.
+
+-----
+
+### v1.6.1-cleanup ✅ (`6a9fe18`)
+
+**Shipped:** RightRail wrapped in `<div className="max-md:hidden contents">` so it's hidden entirely below the md breakpoint on mobile. (Note: v1.6.2 reverses this and replaces with a proper mobile drawer — see below.)
+
+**Audited but not shipped (queued for follow-ups):**
+
+- **Secrets hygiene:** `secrets/boocode_gitea` is NOT tracked; never committed to any branch; `.gitignore` already covers `secrets/`. Rotation is a Gitea-side action, no repo change needed.
+- **`.bak` files:** 3 leftover from v1.5.1 (`docker-compose.yml.bak-20260516`, `Dockerfile.bak-20260516`, `apps/web/src/components/CreateProjectModal.tsx.bak-20260516`). Git-invisible via global `~/.gitignore_global` (`*.bak*`). Decide per file.
+- **Unused exports:** neither `knip` nor `ts-prune` installed. Proposal pending.
+- **Dead WS frames:** `session_renamed` HAS a server publisher (`routes/sessions.ts:140`, added in v1.4) — the roadmap's "no server publisher" open item is **STALE**, crossed off. The `InferenceFrame` union still declares `session_renamed` as a type variant but no code publishes it on the per-session channel; trivial 1-line cleanup deferred.
+- **Unused imports:** web `tsc --noUnusedLocals --noUnusedParameters` returns 0 warnings.
+- **`useSessionStream` refcount:** opportunity confirmed (~90 lines diff to apply the `useSidebar`-style module-scope singleton pattern). Risk LOW. Queued for v1.6.2 or later.
+- **PATCH `/api/panes/:id` ownership:** **MOOT** — endpoint does not exist (the pane REST API was never re-introduced after pane state moved to client-side localStorage in v1.2). Crossed off open items.
+- **Hand-rolled patterns vs library:** 5 hand-rolled hooks/components total 336 lines. None duplicates anything in existing deps; library swap (`@use-gesture`, `react-pull-to-refresh`) not worth the dep cost yet.
+- **`/opt:/opt:ro` mount tightening:** Two-option plan documented for v1.6.2 — Option A (per-project bind-mounts) or Option B (deny `.env` pattern in `pathGuard`). Option B is the simpler short-term fix.
+
+-----
+
+### v1.6.2-mobile-ui-fixes 🔄
+
+**Hand-back received, uncommitted on `v1.6.2-mobile-ui-fixes`.** 4-commit sequence proposed:
+
+1. `fix(mobile): hide Split button + single-pane navigator chrome` (G1 — wrap the Workspace Split row in `!isMobile`).
+1. `feat(mobile): rework Session and Project headers for narrow viewports` (G2 — breadcrumb `hidden sm:flex`, session name cap `max-w-[140px] sm:max-w-[280px]`, project page heading `text-base sm:text-lg`, “New session” icon-only on mobile).
+1. `feat(mobile): add "New chat" to tab long-press context menu` (G3 — top of menu, separator, then existing items).
+1. `feat(mobile): right-rail as drawer on mobile, header toggle button` (G4 option b — new `useRightRailDrawer` Context hook, `RightRail` renders as fixed `w-[85vw] max-w-sm` drawer on mobile, FolderTree button in Session header, **reverts v1.6.1's `max-md:hidden` wrapper**).
+
+**Decisions:**
+
+- G4 option b chosen: mobile file browsing IS useful; drawer pattern mirrors `useSidebarDrawer`.
+- G2 single-row session-name+model layout (model picker right-aligned), per spec example.
+- G3 "New chat" at top, separator, then Rename.
+- G2 "New session" button: icon-only on mobile via `<span className="hidden sm:inline">New session</span>`.
+
+**Adjacent uncommitted change (not part of v1.6.2):** `MAX_TOOL_LOOP_DEPTH 5 → 15` in `apps/server/src/services/inference.ts`. Sam-authored, sitting in working tree on `v1.6.2-mobile-ui-fixes`. **NOT on main as of this update.** Commit separately.
+
+-----
+
+### v1.7 — Drag-drop + paste (planned, was Batch 6)
+
+**Depends on:** v1.6.1 merged.
+
+**Scope (trimmed — chip infra exists from v1.1-batch3.5):**
+
+- Drag-drop files onto ChatInput → chip via `addAttachment({kind: 'file', source: 'drop'})`.
+- Paste >8 lines → chip via `addAttachment({kind: 'paste', source: 'paste'})`. ≤8 lines inline.
+- Drop overlay (dashed border + “Drop to attach”).
+- Client-side 5 MB cap + binary detection (null-byte check in first 8KB).
+- Max 10 attachments shared cap.
+- Folder drop rejected. Image paste rejected. Binary files rejected with toast.
+
+**Frontend only.**
+
+-----
+
+### v1.8 — Settings drawer (planned, was Batch 7)
+
+**Depends on:** header gear (already in v1.4).
+
+**Scope:**
+
+- Right-side drawer (hand-rolled, no shadcn Sheet). Tabbed: Session + Project.
+- Session tab: system prompt, web search toggle, model picker, session name.
+- Project tab: default system prompt, default web search, project name, root path (read-only), delete project (consider whether to expose given the cascade concern).
+- Resolution: `session.system_prompt OR project.default_system_prompt OR ""`.
+- Project defaults applied at session create (copied), not retroactively.
+- Web search toggle persistent per session (`sessions.web_search_enabled`).
+
+**Schema:** `sessions.web_search_enabled`, `projects.default_system_prompt`, `projects.default_web_search`.
+
+-----
+
+### v1.9 — Web search backend (planned, was Batch 8)
+
+**Depends on:** v1.8.
+
+**Scope:**
+
+- `web_search` tool → SearXNG at `http://100.114.205.53:8888/search?format=json`, top-N `{title, url, snippet}`.
+- `web_fetch` tool, regex HTML strip (no cheerio), 50KB cap.
+- Tools conditionally included based on `session.web_search_enabled`.
+- `ToolCallCard.tsx` renders results as clickable URL list, web_fetch as text preview.
+- Env: `SEARXNG_URL`, `WEB_FETCH_TIMEOUT_MS`, `WEB_FETCH_MAX_BYTES`.
+
+-----
+
+### v1.10 — Agents (planned, was Batch 9)
+
+**Depends on:** v1.8.
+
+**Scope:**
+
+- Tier 2 agents: system prompt + model + temperature + tools whitelist per agent.
+- `AGENTS.md` (OpenCode-compatible): `## Agent Name` blocks with YAML frontmatter.
+- Three builtin defaults (Investigator, Architect, Reviewer) when no `AGENTS.md`.
+- If `AGENTS.md` exists, only its agents shown.
+- Agent picker in ChatInput toolbar + SettingsDrawer.
+- Tools whitelist enforced at inference layer. BooChat agents read-only.
+- File parsed on demand with mtime cache.
+- Mid-conversation agent switch allowed; old messages retain their tool history.
+
+**Schema:** `sessions.agent_id TEXT`.
+
+-----
+
+### v1.11 — BooTerm (planned, was Batch 10)
+
+**Depends on:** v1.1-batch3 (pane system), v1.8 (settings drawer pattern).
+
+**Scope:**
+
+- New container `booterm` at `100.114.205.53:9501`. Fastify + node-pty + tmux.
+- Caddy path-based routing: `/api/term/*` + `/ws/term/*` → booterm.
+- Shared `boocode_db`.
+- Per-session tmux (`bc-<session_id>`), per-pane tmux window (`term-<pane_id>`).
+- xterm.js terminal pane. New `kind = 'terminal'` in `session_panes` CHECK.
+- PTY over binary WebSocket. Resize via `tmux resize-window`.
+- Workspace mount: `/opt/repos:/opt/repos:rw`. BooCode chat container keeps `/opt:/opt:ro`.
+- Send-to-terminal from chat: select text → right-click → “Send to terminal”.
+- tmux persistence across WS reconnects, page refreshes, container restarts.
+- No chroot/namespace isolation. Acceptable single-user homelab.
+
+**New app:** `apps/booterm/`.
+
+-----
+
+## Architecture
+
+### Containers (current + planned)
+
+|Container   |Port                 |Mount                              |Purpose                     |Status   |
+|------------|---------------------|-----------------------------------|----------------------------|---------|
+|`boocode`   |`100.114.205.53:9500`|`/opt:/opt:ro` + `/opt/projects:rw`|Chat + read-only tools + SPA|Live     |
+|`boocode_db`|`127.0.0.1:5500`     |`boocode_pgdata`                   |Postgres 16-alpine (shared) |Live     |
+|`booterm`   |`100.114.205.53:9501`|`/opt/repos:/opt/repos:rw`         |Terminal sessions           |v1.11    |
+|`boocoder`  |TBD                  |`/opt/repos:/opt/repos:rw`         |Write tools                 |Post-v1.x|
+
+### URL routing (target state after v1.11)
+
+```
+code.indifferentketchup.com
+├── /                           → boocode (SPA)
+├── /api/chat/*, /ws/chat/*     → boocode :9500
+├── /api/term/*, /ws/term/*     → booterm :9501
+├── /api/coder/*, /ws/coder/*   → boocoder (future)
+└── /ws/user                    → boocode :9500
+```
+
+### Database
+
+Single Postgres `boocode_db`. All containers share. Projects shared. Sessions container-specific.
+
+Current schema (post v1.5.1):
+
+```
+projects
+├── id UUID PK
+├── name TEXT
+├── root_path TEXT
+├── status TEXT                  (v1.2-project-ux: active | archived)
+├── archived_at TIMESTAMPTZ      (v1.2-project-ux)
+├── default_system_prompt TEXT   (v1.8)
+├── default_web_search BOOLEAN   (v1.8)
+└── created_at TIMESTAMPTZ
+
+sessions
+├── id UUID PK
+├── project_id UUID FK → projects
+├── name TEXT
+├── model TEXT
+├── system_prompt TEXT
+├── status TEXT                  (v1.2: active | archived)
+├── web_search_enabled BOOLEAN   (v1.8)
+├── agent_id TEXT                (v1.10)
+├── created_at TIMESTAMPTZ
+└── updated_at TIMESTAMPTZ
+
+chats                            (v1.2)
+├── id UUID PK
+├── session_id UUID FK → sessions
+├── name TEXT
+├── status TEXT
+├── created_at TIMESTAMPTZ
+└── updated_at TIMESTAMPTZ
+
+messages
+├── id UUID PK
+├── session_id UUID FK → sessions
+├── chat_id UUID FK → chats      (v1.2)
+├── kind TEXT                    (v1.2: regular | compact)
+├── role TEXT
+├── content TEXT
+├── tool_calls JSONB
+├── tool_results JSONB
+├── status TEXT
+├── last_seq INTEGER
+├── tokens_used INTEGER          (v1.1-batch1)
+├── ctx_used INTEGER             (v1.1-batch1)
+├── ctx_max INTEGER              (v1.1-batch1)
+├── started_at TIMESTAMPTZ       (v1.1-batch1)
+├── finished_at TIMESTAMPTZ      (v1.1-batch1)
+└── created_at TIMESTAMPTZ
+
+session_panes                    (v1.1-batch3)
+├── id UUID PK
+├── session_id UUID FK → sessions (CASCADE)
+├── position INTEGER
+├── kind TEXT CHECK (chat | file_browser | terminal)
+├── state JSONB
+└── created_at TIMESTAMPTZ
+
+settings
+├── k TEXT PK
+└── v TEXT
+```
+
+### Reusable patterns
+
+|Pattern                     |Where                                   |Used by                                                  |
+|----------------------------|----------------------------------------|---------------------------------------------------------|
+|In-app event bus            |`sessionEvents.ts`                      |All batches. Module-scope `Set<Listener>`.               |
+|Singleton hooks             |`useSidebar.ts`                         |Module-scope shared state.                               |
+|User-channel WS broker      |`broker.ts` + `useUserEvents.ts`        |Cross-tab lifecycle. One WS per tab.                     |
+|`clock_timestamp()`         |All INSERT/UPDATE                       |Never `NOW()` in new code.                               |
+|Additive schema only        |`schema.sql`                            |`ADD COLUMN IF NOT EXISTS`, `CREATE TABLE IF NOT EXISTS`.|
+|Idempotent backfills        |`schema.sql`                            |`INSERT ... WHERE NOT EXISTS`.                           |
+|`enable_thinking: false`    |`auto_name.ts`                          |Required for Qwen3 utility calls.                        |
+|`pathGuard`                 |`tools/*`, `file_ops.ts`                |Realpath + project root enforcement.                     |
+|Shared `file_ops.ts`        |`tools.ts`, `routes/projects.ts`        |Same core for inference tools and UI.                    |
+|File index (`file_index.ts`)|`routes/projects.ts`                    |`rg --files` + mtime cache.                              |
+|`useViewport`               |`hooks/useViewport.ts` (v1.6)           |matchMedia, SSR-safe.                                    |
+|`useSidebarDrawer`          |`hooks/useSidebarDrawer.tsx` (v1.6)     |Context + auto-close on route change.                    |
+|Hand-rolled long-press      |`hooks/useLongPress.ts` (v1.6)          |500ms touchstart timer, dispatches synthetic contextmenu.|
+|Hand-rolled pull-to-refresh |`hooks/usePullToRefresh.ts` (v1.6)      |80px threshold, 600ms min hold.                          |
+|Hand-rolled swipe           |`components/SwipeablePaneTab.tsx` (v1.6)|60px threshold, vertical bail at 30px.                   |
+
+-----
+
+## Tech stack
+
+|Layer           |Tech                                                                      |
+|----------------|--------------------------------------------------------------------------|
+|Backend         |Node 20 + Fastify + `@fastify/websocket` + `@fastify/static` + zod + `pg` |
+|Frontend        |React + Vite + Tailwind v4 + shadcn nova preset                           |
+|Inference       |llama-swap `http://100.101.41.16:8401` (OpenAI-compatible)                |
+|Search          |SearXNG `http://100.114.205.53:8888` (v1.9)                               |
+|Syntax          |Shiki (`github-dark`)                                                     |
+|Terminal        |xterm.js + node-pty + tmux (v1.11)                                        |
+|Auth            |`Remote-User` from Authelia via Caddy `forward_auth`                      |
+|Containerization|Docker Compose, Node 20-alpine, multi-stage, ripgrep apk, git apk (v1.5.1)|
+|DB              |Postgres 16-alpine, loopback `127.0.0.1:5500`                             |
+|Networking      |Tailscale mesh, Caddy (DO droplet), Authelia SSO                          |
+|Code hosting    |Gitea `git.indifferentketchup.com`                                        |
+|Tests           |vitest v3 (pinned, Vite 5 / vitest 4 incompatible)                        |
+
+-----
+
+## Known open items
+
+- **`useSessionStream` refcount.** Two ChatPanes = two WS. Apply singleton pattern. Audited in v1.6.1, queued.
+- **`/opt:/opt:ro` mount exposes all `.env` files.** Whitelist scope before BooCoder. Two-option plan documented in v1.6.1 audit; ship in v1.6.2 or v1.7.
+- **`secrets/boocode_gitea` in repo working tree.** Never committed (git-invisible via global ignore). Rotate the Gitea-side key when convenient; no repo action required.
+- **Dormant in-boolab BooCode mode.** Reference only.
+- **BooCoder container.** Post-v1.x.
+
+**Closed since last update:**
+
+- ~~`session_renamed` no server WS publisher~~ — server publishes via `broker.publishUser` from `routes/sessions.ts:140` (added in v1.4). Confirmed in v1.6.1 audit.
+- ~~PATCH `/api/panes/:id` lacks session-ownership check~~ — endpoint does not exist; the pane REST API was never re-introduced after v1.2 moved pane state to localStorage.
+
+-----
+
+## Dependency graph
+
+```
+v1.0 (initial)
+  │
+  ▼
+v1.1-batch1 (markdown)
+  │
+  ▼
+v1.1-batch2 (sidebar)
+  │
+  ▼
+v1.1-batch3 (panes) ────────────────────────┐
+  │                                          │
+  ▼                                          │
+v1.1-batch3.5 (chips) ──────┐                │
+  │                          │                │
+  ▼                          │                │
+v1.2 (chats-in-sessions)     │                │
+  │                          │                │
+  ▼                          │                │
+v1.2-project-ux              │                │
+  │                          │                │
+  ▼                          │                │
+v1.3 (tab-close)             │                │
+  │                          │                │
+  ▼                          │                │
+v1.4 (fork+delete+header) ◄──┼────────────────┘
+  │                          │
+  ▼                          │
+v1.5 (refactor+tests+ctx)    │
+  │                          │
+  ▼                          │
+v1.5.1 (bootstrap hotfix)    │
+  │                          │
+  ▼                          │
+v1.6-mobile-pass             │
+  │                          │
+  ▼                          │
+v1.6.1-cleanup               │
+  │                          │
+  ▼                          │
+v1.6.2-mobile-ui-fixes ◄─────┘
+  │
+  ▼
+v1.7 (drag-drop) ◄── v1.1-batch3.5
+  │
+  ▼
+v1.8 (settings)
+  │
+  ├──▶ v1.9 (web search)
+  │
+  ├──▶ v1.10 (agents)
+  │
+  └──▶ v1.11 (BooTerm) ◄── v1.1-batch3
+```
+
+-----
+
+## Workflow
+
+1. Verify previous version merged to `main`.
+1. Dispatch prompt via Paseo (Claude Code runs at `/opt/boocode`).
+1. Claude Code recon → blocking questions → implement → hand back.
+1. Review hand-back in separate Claude chat (spec compliance, code quality, drift, stale code).
+1. Deploy: `docker compose up --build -d`.
+1. Smoke test per the hand-back’s plan.
+1. Sam commits manually, pushes to Gitea, merges to `main`.
+1. Next version.
+
+Sam reviews all diffs. Sam commits. Never git pull/push/commit on his behalf.

docker-compose.yml

@@ -9,7 +9,12 @@ services:
     environment:
       DATABASE_URL: postgres://boocode:${POSTGRES_PASSWORD}@boocode_db:5432/boocode
     volumes:
+      # Read-only mount for legacy/existing project add-existing flow.
       - /opt:/opt:ro
+      # Writable mount only for the create-new-project bootstrap target.
+      # Host must `mkdir -p /opt/projects` before container start.
+      - /opt/projects:/opt/projects:rw
+      - ./secrets/boocode_gitea:/root/.ssh/id_ed25519:ro
     depends_on:
       - boocode_db
     networks:

pnpm-lock.yaml

@@ -45,6 +45,9 @@ importers:
       typescript:
         specifier: ^5.5.0
         version: 5.9.3
+      vitest:
+        specifier: ^3.2.4
+        version: 3.2.4(@types/debug@4.1.13)(@types/node@20.19.41)(lightningcss@1.32.0)(msw@2.14.6(@types/node@20.19.41)(typescript@5.9.3))
 
   apps/web:
     dependencies:
@@ -87,6 +90,9 @@ importers:
       shadcn:
         specifier: ^4.7.0
         version: 4.7.0(@types/node@20.19.41)(typescript@5.9.3)
+      shiki:
+        specifier: ^1.29.2
+        version: 1.29.2
       sonner:
         specifier: ^2.0.7
         version: 2.0.7(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
@@ -1566,6 +1572,27 @@ packages:
   '@sec-ant/readable-stream@0.4.1':
     resolution: {integrity: sha512-831qok9r2t8AlxLko40y2ebgSDhenenCatLVeW/uBtnHPyhHOvG0C7TvfgecV+wHzIm5KUICgzmVpWS+IMEAeg==}
 
+  '@shikijs/core@1.29.2':
+    resolution: {integrity: sha512-vju0lY9r27jJfOY4Z7+Rt/nIOjzJpZ3y+nYpqtUZInVoXQ/TJZcfGnNOGnKjFdVZb8qexiCuSlZRKcGfhhTTZQ==}
+
+  '@shikijs/engine-javascript@1.29.2':
+    resolution: {integrity: sha512-iNEZv4IrLYPv64Q6k7EPpOCE/nuvGiKl7zxdq0WFuRPF5PAE9PRo2JGq/d8crLusM59BRemJ4eOqrFrC4wiQ+A==}
+
+  '@shikijs/engine-oniguruma@1.29.2':
+    resolution: {integrity: sha512-7iiOx3SG8+g1MnlzZVDYiaeHe7Ez2Kf2HrJzdmGwkRisT7r4rak0e655AcM/tF9JG/kg5fMNYlLLKglbN7gBqA==}
+
+  '@shikijs/langs@1.29.2':
+    resolution: {integrity: sha512-FIBA7N3LZ+223U7cJDUYd5shmciFQlYkFXlkKVaHsCPgfVLiO+e12FmQE6Tf9vuyEsFe3dIl8qGWKXgEHL9wmQ==}
+
+  '@shikijs/themes@1.29.2':
+    resolution: {integrity: sha512-i9TNZlsq4uoyqSbluIcZkmPL9Bfi3djVxRnofUHwvx/h6SRW3cwgBC5SML7vsDcWyukY0eCzVN980rqP6qNl9g==}
+
+  '@shikijs/types@1.29.2':
+    resolution: {integrity: sha512-VJjK0eIijTZf0QSTODEXCqinjBn0joAHQ+aPSBzrv4O2d/QSbsMw+ZeSRx03kV34Hy7NzUvV/7NqfYGRLrASmw==}
+
+  '@shikijs/vscode-textmate@10.0.2':
+    resolution: {integrity: sha512-83yeghZ2xxin3Nj8z1NMd/NCuca+gsYXswywDy5bHvwlWL8tpTQmzGeUuHd9FC3E/SBEMvzJRwWEOz5gGes9Qg==}
+
   '@sindresorhus/merge-streams@4.0.0':
     resolution: {integrity: sha512-tlqY9xq5ukxTUZBmoOp+m61cqwQD5pHJtFY3Mn8CA8ps6yghLH/Hw8UPdqg4OLmFW3IFlcXnQNmo/dh8HzXYIQ==}
     engines: {node: '>=18'}
@@ -1673,9 +1700,15 @@ packages:
   '@types/babel__traverse@7.28.0':
     resolution: {integrity: sha512-8PvcXf70gTDZBgt9ptxJ8elBeBjcLOAcOtoO/mPJjtji1+CdGbHgm77om1GrsPxsiE+uXIpNSK64UYaIwQXd4Q==}
 
+  '@types/chai@5.2.3':
+    resolution: {integrity: sha512-Mw558oeA9fFbv65/y4mHtXDs9bPnFMZAL/jxdPFUpOHHIXX91mcgEHbS5Lahr+pwZFR8A7GQleRWeI6cGFC2UA==}
+
   '@types/debug@4.1.13':
     resolution: {integrity: sha512-KSVgmQmzMwPlmtljOomayoR89W4FynCAi3E8PPs7vmDVPe84hT+vGPKkJfThkmXs0x0jAaa9U8uW8bbfyS2fWw==}
 
+  '@types/deep-eql@4.0.2':
+    resolution: {integrity: sha512-c9h9dVVMigMPc4bwTvC5dxqtqJZwQPePsWjPlpSOnojbor6pGqdk541lfA7AqFQr5pB1BRdq0juY9db81BwyFw==}
+
   '@types/estree-jsx@1.0.5':
     resolution: {integrity: sha512-52CcUVNFyfb1A2ALocQw/Dd1BQFNmSdkuC3BkZ6iqhdMfQz7JWOFRuJFloOzjk+6WijU56m9oKXFAXc7o3Towg==}
 
@@ -1732,6 +1765,35 @@ packages:
     peerDependencies:
       vite: ^4.2.0 || ^5.0.0 || ^6.0.0 || ^7.0.0
 
+  '@vitest/expect@3.2.4':
+    resolution: {integrity: sha512-Io0yyORnB6sikFlt8QW5K7slY4OjqNX9jmJQ02QDda8lyM6B5oNgVWoSoKPac8/kgnCUzuHQKrSLtu/uOqqrig==}
+
+  '@vitest/mocker@3.2.4':
+    resolution: {integrity: sha512-46ryTE9RZO/rfDd7pEqFl7etuyzekzEhUbTW3BvmeO/BcCMEgq59BKhek3dXDWgAj4oMK6OZi+vRr1wPW6qjEQ==}
+    peerDependencies:
+      msw: ^2.4.9
+      vite: ^5.0.0 || ^6.0.0 || ^7.0.0-0
+    peerDependenciesMeta:
+      msw:
+        optional: true
+      vite:
+        optional: true
+
+  '@vitest/pretty-format@3.2.4':
+    resolution: {integrity: sha512-IVNZik8IVRJRTr9fxlitMKeJeXFFFN0JaB9PHPGQ8NKQbGpfjlTx9zO4RefN8gp7eqjNy8nyK3NZmBzOPeIxtA==}
+
+  '@vitest/runner@3.2.4':
+    resolution: {integrity: sha512-oukfKT9Mk41LreEW09vt45f8wx7DordoWUZMYdY/cyAk7w5TWkTRCNZYF7sX7n2wB7jyGAl74OxgwhPgKaqDMQ==}
+
+  '@vitest/snapshot@3.2.4':
+    resolution: {integrity: sha512-dEYtS7qQP2CjU27QBC5oUOxLE/v5eLkGqPE0ZKEIDGMs4vKWe7IjgLOeauHsR0D5YuuycGRO5oSRXnwnmA78fQ==}
+
+  '@vitest/spy@3.2.4':
+    resolution: {integrity: sha512-vAfasCOe6AIK70iP5UD11Ac4siNUNJ9i/9PZ3NKx07sG6sUxeag1LWdNrMWeKKYBLlzuK+Gn65Yd5nyL6ds+nw==}
+
+  '@vitest/utils@3.2.4':
+    resolution: {integrity: sha512-fB2V0JFrQSMsCo9HiSq3Ezpdv4iYaXRG1Sx8edX3MwxfyNn83mKiGzOcH+Fkxt4MHxr3y42fQi1oeAInqgX2QA==}
+
   abstract-logging@2.0.1:
     resolution: {integrity: sha512-2BjRTZxTPvheOvGbBslFSYOUkr+SjPtOnrLP33f+VIWLzezQpZcqVg7ja3L4dBXmzzgwT+a029jRx5PCi3JuiA==}
 
@@ -1785,6 +1847,10 @@ packages:
     resolution: {integrity: sha512-ik3ZgC9dY/lYVVM++OISsaYDeg1tb0VtP5uL3ouh1koGOaUMDPpbFIei4JkFimWUFPn90sbMNMXQAIVOlnYKJA==}
     engines: {node: '>=10'}
 
+  assertion-error@2.0.1:
+    resolution: {integrity: sha512-Izi8RQcffqCeNVgFigKli1ssklIbpHnCYc6AknXGYoB6grJqyeby7jv12JUQgmTAnIDnbck1uxksT4dzN3PWBA==}
+    engines: {node: '>=12'}
+
   ast-types@0.16.1:
     resolution: {integrity: sha512-6t10qk83GOG8p0vKmaCr8eiilZwO171AvbROMtvvNiwrTly62t+7XkA8RdIIVbpMhCASAsxgAzdRSwh6nw/5Dg==}
     engines: {node: '>=4'}
@@ -1839,6 +1905,10 @@ packages:
     resolution: {integrity: sha512-/Nf7TyzTx6S3yRJObOAV7956r8cr2+Oj8AC5dt8wSP3BQAoeX58NoHyCU8P8zGkNXStjTSi6fzO6F0pBdcYbEg==}
     engines: {node: '>= 0.8'}
 
+  cac@6.7.14:
+    resolution: {integrity: sha512-b6Ilus+c3RrdDk+JhLKUAQfzzgLEPy6wcXqS7f/xe1EETvsDP6GORG7SFuOs6cID5YkqchW/LXZbX5bc8j7ZcQ==}
+    engines: {node: '>=8'}
+
   call-bind-apply-helpers@1.0.2:
     resolution: {integrity: sha512-Sp1ablJ0ivDkSzjcaJdxEunN5/XvksFJ2sMBFfq6x0ryhQV/2b/KwFe21cMpmHtPOSij8K99/wSfoEuTObmuMQ==}
     engines: {node: '>= 0.4'}
@@ -1857,6 +1927,10 @@ packages:
   ccount@2.0.1:
     resolution: {integrity: sha512-eyrF0jiFpY+3drT6383f1qhkbGsLSifNAjA61IUjZjmLCWjItY6LB9ft9YhoDgwfmclB2zhu51Lc7+95b8NRAg==}
 
+  chai@5.3.3:
+    resolution: {integrity: sha512-4zNhdJD/iOjSH0A05ea+Ke6MU5mmpQcbQsSOkgdaUMJ9zTlDTD/GYlwohmIE2u0gaxHYiVHEn1Fw9mZ/ktJWgw==}
+    engines: {node: '>=18'}
+
   chalk@5.6.2:
     resolution: {integrity: sha512-7NzBL0rN6fMUW+f7A6Io4h40qQlG+xGmtMxfbnH/K7TAtt8JQWVQK+6g0UXKMeVJoyV5EkkNsErQ8pVD3bLHbA==}
     engines: {node: ^12.17.0 || ^14.13 || >=16.0.0}
@@ -1873,6 +1947,10 @@ packages:
   character-reference-invalid@2.0.1:
     resolution: {integrity: sha512-iBZ4F4wRbyORVsu0jPV7gXkOsGYjGHPmAyv+HiHG8gi5PtC9KI2j1+v8/tlibRvjoWX027ypmG/n0HtO5t7unw==}
 
+  check-error@2.1.3:
+    resolution: {integrity: sha512-PAJdDJusoxnwm1VwW07VWwUN1sl7smmC3OKggvndJFadxxDRyFJBX/ggnu/KE4kQAB7a3Dp8f/YXC1FlUprWmA==}
+    engines: {node: '>= 16'}
+
   class-variance-authority@0.7.1:
     resolution: {integrity: sha512-Ka+9Trutv7G8M6WT6SeiRWz792K5qEqIGEGzXKhAE6xOWAY6pPH8U+9IY3oCMv6kqTmLsv7Xh/2w2RigkePMsg==}
 
@@ -1997,6 +2075,10 @@ packages:
       babel-plugin-macros:
         optional: true
 
+  deep-eql@5.0.2:
+    resolution: {integrity: sha512-h5k/5U50IJJFpzfL6nO9jaaumfjO/f2NjK/oYB2Djzm4p9L+3T9qWpZqZ2hAbLPuuYq9wrU08WQyBTL5GbPk5Q==}
+    engines: {node: '>=6'}
+
   deepmerge@4.3.1:
     resolution: {integrity: sha512-3sUqbMEc77XqpdNO7FRyRog+eW3ph+GYCbj+rK+uYyRMuwsVy0rMiVtPn+QJlKFvWP/1PYpapqYn0Me2knFn+A==}
     engines: {node: '>=0.10.0'}
@@ -2059,6 +2141,9 @@ packages:
   electron-to-chromium@1.5.355:
     resolution: {integrity: sha512-LUPZhKzZPYSPme1jEYohpkA+ybYCJztr1quAdBd7E7h3+VOBVcKkwwtBJu41nrjawrRzfb8mtMfzWozoaK0ZIQ==}
 
+  emoji-regex-xs@1.0.0:
+    resolution: {integrity: sha512-LRlerrMYoIDrT6jgpeZ2YYl/L8EulRTt5hQcYjy5AInh7HWXKimpqx68aknBFpGL2+/IcogTcaydJEgaTmOpDg==}
+
   emoji-regex@10.6.0:
     resolution: {integrity: sha512-toUI84YS5YmxW219erniWD0CIVOo46xGKColeNQRgOzDorgBi1v4D71/OFzgD9GO2UGKIv1C3Sp8DAn0+j5w7A==}
 
@@ -2094,6 +2179,9 @@ packages:
     resolution: {integrity: sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw==}
     engines: {node: '>= 0.4'}
 
+  es-module-lexer@1.7.0:
+    resolution: {integrity: sha512-jEQoCwk8hyb2AZziIOLhDqpm5+2ww5uIE6lkO/6jcOCusfk6LhMHpXXfBLXTZ7Ydyt0j4VoUQv6uGNYbdW+kBA==}
+
   es-object-atoms@1.1.1:
     resolution: {integrity: sha512-FGgH2h8zKNim9ljj7dankFPcICIK9Cp5bm+c2gQSYePhpaG5+esrLODihIorn+Pe6FGJzWhXQotPv73jTaldXA==}
     engines: {node: '>= 0.4'}
@@ -2127,6 +2215,9 @@ packages:
   estree-util-is-identifier-name@3.0.0:
     resolution: {integrity: sha512-hFtqIDZTIUZ9BXLb8y4pYGyk6+wekIivNVTcmvk8NoOh+VeRn5y6cEHzbURrWbfp1fIqdVipilzj+lfaadNZmg==}
 
+  estree-walker@3.0.3:
+    resolution: {integrity: sha512-7RUKfXgSMMkzt6ZuXmqapOurLGPPfgj6l9uRZ7lRGolvk0y2yocc35LdcxKC5PQZdn2DMqioAQ2NoWcrTKmm6g==}
+
   etag@1.8.1:
     resolution: {integrity: sha512-aIL5Fx7mawVa300al2BnEE4iNvo1qETxLrPI/o05L7z6go7fCw1J6EQmbK4FmJ2AS7kgVF/KEZWufBfdClMcPg==}
     engines: {node: '>= 0.6'}
@@ -2147,6 +2238,10 @@ packages:
     resolution: {integrity: sha512-9Be3ZoN4LmYR90tUoVu2te2BsbzHfhJyfEiAVfz7N5/zv+jduIfLrV2xdQXOHbaD6KgpGdO9PRPM1Y4Q9QkPkA==}
     engines: {node: ^18.19.0 || >=20.5.0}
 
+  expect-type@1.3.0:
+    resolution: {integrity: sha512-knvyeauYhqjOYvQ66MznSMs83wmHrCycNEN6Ao+2AeYEfxUIkuiVxdEa1qlGEPK+We3n0THiDciYSsCcgW/DoA==}
+    engines: {node: '>=12.0.0'}
+
   express-rate-limit@8.5.2:
     resolution: {integrity: sha512-5Kb34ipNX694DH48vN9irak1Qx30nb0PLYHXfJgw4YEjiC3ZEmZJhwOp+VfiCYwFzvFTdB9QkArYS5kXa2cx2A==}
     engines: {node: '>= 16'}
@@ -2327,6 +2422,9 @@ packages:
     resolution: {integrity: sha512-ej4AhfhfL2Q2zpMmLo7U1Uv9+PyhIZpgQLGT1F9miIGmiCJIoCgSmczFdrc97mWT4kVY72KA+WnnhJ5pghSvSg==}
     engines: {node: '>= 0.4'}
 
+  hast-util-to-html@9.0.5:
+    resolution: {integrity: sha512-OguPdidb+fbHQSU4Q4ZiLKnzWo8Wwsf5bZfbvu7//a9oTYoqD/fWpe96NuHkoS9h0ccGOTe0C4NGXdtS0iObOw==}
+
   hast-util-to-jsx-runtime@2.3.6:
     resolution: {integrity: sha512-zl6s8LwNyo1P9uw+XJGvZtdFF1GdAkOg8ujOw+4Pyb76874fLps4ueHXDhXWdk6YHQ6OgUtinliG7RsYvCbbBg==}
 
@@ -2343,6 +2441,9 @@ packages:
   html-url-attributes@3.0.1:
     resolution: {integrity: sha512-ol6UPyBWqsrO6EJySPz2O7ZSr856WDrEzM5zMqp+FJJLGMW35cLYmmZnl0vztAZxRUoNZJFTCohfjuIJ8I4QBQ==}
 
+  html-void-elements@3.0.0:
+    resolution: {integrity: sha512-bEqo66MRXsUGxWHV5IP0PUiAWwoEjba4VCzg0LjFJBpchPaTfyfCKTG6bc5F8ucKec3q5y6qOdGyYTSBEvhCrg==}
+
   http-errors@2.0.0:
     resolution: {integrity: sha512-FtwrG/euBzaEjYeRqOgly7G0qviiXoJWnvEH2Z1plBdXgbyjv34pHTSb9zoeHMyDy33+DWy5Wt9Wo+TURtOYSQ==}
     engines: {node: '>= 0.8'}
@@ -2496,6 +2597,9 @@ packages:
   js-tokens@4.0.0:
     resolution: {integrity: sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==}
 
+  js-tokens@9.0.1:
+    resolution: {integrity: sha512-mxa9E9ITFOt0ban3j6L5MpjwegGz6lBQmM1IJkWeBZGcMxto50+eWdjC/52xDbS2vy0k7vIMK0Fe2wfL9OQSpQ==}
+
   js-yaml@4.1.1:
     resolution: {integrity: sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==}
     hasBin: true
@@ -2620,6 +2724,9 @@ packages:
     resolution: {integrity: sha512-lyuxPGr/Wfhrlem2CL/UcnUc1zcqKAImBDzukY7Y5F/yQiNdko6+fRLevlw1HgMySw7f611UIY408EtxRSoK3Q==}
     hasBin: true
 
+  loupe@3.2.1:
+    resolution: {integrity: sha512-CdzqowRJCeLU72bHvWqwRBBlLcMEtIvGrlvef74kMnV2AolS9Y8xUv1I0U/MNAWMhBlKIoyuEgoJ0t/bbwHbLQ==}
+
   lru-cache@10.4.3:
     resolution: {integrity: sha512-JNAzZcXrCt42VGLuYz0zfAzDfAvJWW6AfYlDBQyDV5DClI2m5sAmK+OIO7s59XfsRsWHp02jAJrRadPRGTt6SQ==}
 
@@ -2908,6 +3015,9 @@ packages:
     resolution: {integrity: sha512-VXJjc87FScF88uafS3JllDgvAm+c/Slfz06lorj2uAY34rlUu0Nt+v8wreiImcrgAjjIHp1rXpTDlLOGw29WwQ==}
     engines: {node: '>=18'}
 
+  oniguruma-to-es@2.3.0:
+    resolution: {integrity: sha512-bwALDxriqfKGfUufKGGepCzu9x7nJQuoRoAFp4AnwehhC2crqrDIAP/uN2qdlsAvSMpeRC3+Yzhqc7hLmle5+g==}
+
   open@11.0.0:
     resolution: {integrity: sha512-smsWv2LzFjP03xmvFoJ331ss6h+jixfA4UUV/Bsiyuu4YJPfN+FIQGOIiv4w9/+MoHkfkJ22UIaQWRVFRfH6Vw==}
     engines: {node: '>=20'}
@@ -2962,6 +3072,13 @@ packages:
   path-to-regexp@8.4.2:
     resolution: {integrity: sha512-qRcuIdP69NPm4qbACK+aDogI5CBDMi1jKe0ry5rSQJz8JVLsC7jV8XpiJjGRLLol3N+R5ihGYcrPLTno6pAdBA==}
 
+  pathe@2.0.3:
+    resolution: {integrity: sha512-WUjGcAqP1gQacoQe+OBJsFA7Ld4DyXuUIjZ5cc75cLHvJ7dtNsTugphxIADwspS+AraAUePCKrSVtPLFj/F88w==}
+
+  pathval@2.0.1:
+    resolution: {integrity: sha512-//nshmD55c46FuFw26xV/xFAaB5HF9Xdap7HJBBnrKdAd6/GxDBaNA1870O79+9ueg61cZLSVc+OaFlfmObYVQ==}
+    engines: {node: '>= 14.16'}
+
   picocolors@1.1.1:
     resolution: {integrity: sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA==}
 
@@ -3129,6 +3246,15 @@ packages:
     resolution: {integrity: sha512-YTUo+Flmw4ZXiWfQKGcwwc11KnoRAYgzAE2E7mXKCjSviTKShtxBsN6YUUBB2gtaBzKzeKunxhUwNHQuRryhWA==}
     engines: {node: '>= 4'}
 
+  regex-recursion@5.1.1:
+    resolution: {integrity: sha512-ae7SBCbzVNrIjgSbh7wMznPcQel1DNlDtzensnFxpiNpXt1U2ju/bHugH422r+4LAVS1FpW1YCwilmnNsjum9w==}
+
+  regex-utilities@2.3.0:
+    resolution: {integrity: sha512-8VhliFJAWRaUiVvREIiW2NXXTmHs4vMNnSzuJVhscgmGav3g9VDxLrQndI3dZZVVdp0ZO/5v0xmX516/7M9cng==}
+
+  regex@5.1.1:
+    resolution: {integrity: sha512-dN5I359AVGPnwzJm2jN1k0W9LPZ+ePvoOeVMMfqIMFz53sSwXkxaJoxr50ptnsC771lK95BnTrVSZxq0b9yCGw==}
+
   remark-gfm@4.0.1:
     resolution: {integrity: sha512-1quofZ2RQ9EWdeN34S79+KExV1764+wCUGop5CPL1WGdD0ocPpu91lzPGbwWMECpEpd42kJGQwzRfyov9j4yNg==}
 
@@ -3244,6 +3370,9 @@ packages:
     resolution: {integrity: sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==}
     engines: {node: '>=8'}
 
+  shiki@1.29.2:
+    resolution: {integrity: sha512-njXuliz/cP+67jU2hukkxCNuH1yUi4QfdZZY+sMr5PPrIyXSu5iTb/qYC4BiWWB0vZ+7TbdvYUCeL23zpwCfbg==}
+
   side-channel-list@1.0.1:
     resolution: {integrity: sha512-mjn/0bi/oUURjc5Xl7IaWi/OJJJumuoJFQJfDDyO46+hBWsfaVM65TBHq2eoZBhzl9EchxOijpkbRC8SVBQU0w==}
     engines: {node: '>= 0.4'}
@@ -3260,6 +3389,9 @@ packages:
     resolution: {integrity: sha512-ZX99e6tRweoUXqR+VBrslhda51Nh5MTQwou5tnUDgbtyM0dBgmhEDtWGP/xbKn6hqfPRHujUNwz5fy/wbbhnpw==}
     engines: {node: '>= 0.4'}
 
+  siginfo@2.0.0:
+    resolution: {integrity: sha512-ybx0WO1/8bSBLEWXZvEd7gMW3Sn3JFlW3TvX1nREbDLRNQNaeNN8WK0meBwPdAaOI7TtRRRJn/Es1zhrrCHu7g==}
+
   signal-exit@3.0.7:
     resolution: {integrity: sha512-wnD2ZE+l+SPC/uoS0vXeE9L1+0wuaMqKlfz9AMUo38JsyLSBWSFcHR1Rri62LZc12vLr1gb3jl7iwQhgwpAbGQ==}
 
@@ -3294,6 +3426,9 @@ packages:
     resolution: {integrity: sha512-UcjcJOWknrNkF6PLX83qcHM6KHgVKNkV62Y8a5uYDVv9ydGQVwAHMKqHdJje1VTWpljG0WYpCDhrCdAOYH4TWg==}
     engines: {node: '>= 10.x'}
 
+  stackback@0.0.2:
+    resolution: {integrity: sha512-1XMJE5fQo1jGH6Y/7ebnwPOBEkIEnT4QF32d5R1+VXdXveM0IBMJt8zfaxX1P3QhVwrYe+576+jkANtSS2mBbw==}
+
   statuses@2.0.1:
     resolution: {integrity: sha512-RwNA9Z/7PrK06rYLIzFMlaF+l73iwpzsqRIFgbMLbTcLD6cOao82TaWefPXQvB2fOC4AjuYSEndS7N/mTCbkdQ==}
     engines: {node: '>= 0.8'}
@@ -3302,6 +3437,9 @@ packages:
     resolution: {integrity: sha512-DvEy55V3DB7uknRo+4iOGT5fP1slR8wQohVdknigZPMpMstaKJQWhwiYBACJE3Ul2pTnATihhBYnRhZQHGBiRw==}
     engines: {node: '>= 0.8'}
 
+  std-env@3.10.0:
+    resolution: {integrity: sha512-5GS12FdOZNliM5mAOxFRg7Ir0pWz8MdpYm6AY6VPkGpbA7ZzmbzNcBJQ0GPvvyWgcY7QAhCgf9Uy89I03faLkg==}
+
   stdin-discarder@0.2.2:
     resolution: {integrity: sha512-UhDfHmA92YAlNnCfhmq0VeNL5bDbiZGg7sZ2IvPsXubGkiNa9EC+tUTsjBRsYUAz87btI6/1wf4XoVvQ3uRnmQ==}
     engines: {node: '>=18'}
@@ -3354,6 +3492,9 @@ packages:
     resolution: {integrity: sha512-aulFJcD6YK8V1G7iRB5tigAP4TsHBZZrOV8pjV++zdUwmeV8uzbY7yn6h9MswN62adStNZFuCIx4haBnRuMDaw==}
     engines: {node: '>=18'}
 
+  strip-literal@3.1.0:
+    resolution: {integrity: sha512-8r3mkIM/2+PpjHoOtiAW8Rg3jJLHaV7xPwG+YRGrv6FP0wwk/toTpATxWYOW0BKdWwl82VT2tFYi5DlROa0Mxg==}
+
   style-to-js@1.1.21:
     resolution: {integrity: sha512-RjQetxJrrUJLQPHbLku6U/ocGtzyjbJMP9lCNK7Ag0CNh690nSH8woqWH9u16nMjYBAok+i7JO1NP2pOy8IsPQ==}
 
@@ -3380,6 +3521,28 @@ packages:
   tiny-invariant@1.3.3:
     resolution: {integrity: sha512-+FbBPE1o9QAYvviau/qC5SE3caw21q3xkvWKBtja5vgqOWIHHJ3ioaq1VPfn/Szqctz2bU/oYeKd9/z5BL+PVg==}
 
+  tinybench@2.9.0:
+    resolution: {integrity: sha512-0+DUvqWMValLmha6lr4kD8iAMK1HzV0/aKnCtWb9v9641TnP/MFb7Pc2bxoxQjTXAErryXVgUOfv2YqNllqGeg==}
+
+  tinyexec@0.3.2:
+    resolution: {integrity: sha512-KQQR9yN7R5+OSwaK0XQoj22pwHoTlgYqmUscPYoknOoWCWfj/5/ABTMRi69FrKU5ffPVh5QcFikpWJI/P1ocHA==}
+
+  tinyglobby@0.2.16:
+    resolution: {integrity: sha512-pn99VhoACYR8nFHhxqix+uvsbXineAasWm5ojXoN8xEwK5Kd3/TrhNn1wByuD52UxWRLy8pu+kRMniEi6Eq9Zg==}
+    engines: {node: '>=12.0.0'}
+
+  tinypool@1.1.1:
+    resolution: {integrity: sha512-Zba82s87IFq9A9XmjiX5uZA/ARWDrB03OHlq+Vw1fSdt0I+4/Kutwy8BP4Y/y/aORMo61FQ0vIb5j44vSo5Pkg==}
+    engines: {node: ^18.0.0 || >=20.0.0}
+
+  tinyrainbow@2.0.0:
+    resolution: {integrity: sha512-op4nsTR47R6p0vMUUoYl/a+ljLFVtlfaXkLQmqfLR1qHma1h/ysYk4hEXZ880bf2CYgTskvTa/e196Vd5dDQXw==}
+    engines: {node: '>=14.0.0'}
+
+  tinyspy@4.0.4:
+    resolution: {integrity: sha512-azl+t0z7pw/z958Gy9svOTuzqIk6xq+NSheJzn5MMWtWTFywIacg2wUlzKFGtt3cthx0r2SxMK0yzJOR0IES7Q==}
+    engines: {node: '>=14.0.0'}
+
   tldts-core@7.0.30:
     resolution: {integrity: sha512-uiHN8PIB1VmWyS98eZYja4xzlYqeFZVjb4OuYlJQnZAuJhMw4PbKQOKgHKhBdJR3FE/t5mUQ1Kd80++B+qhD1Q==}
 
@@ -3524,6 +3687,11 @@ packages:
   vfile@6.0.3:
     resolution: {integrity: sha512-KzIbH/9tXat2u30jf+smMwFCsno4wHVdNmzFyL+T/L3UGqqk6JKfVqOFOZEpZSHADH1k40ab6NUIXZq422ov3Q==}
 
+  vite-node@3.2.4:
+    resolution: {integrity: sha512-EbKSKh+bh1E1IFxeO0pg1n4dvoOTt0UDiXMd/qn++r98+jPO1xtJilvXldeuQ8giIB5IkpjCgMleHMNEsGH6pg==}
+    engines: {node: ^18.0.0 || ^20.0.0 || >=22.0.0}
+    hasBin: true
+
   vite@5.4.21:
     resolution: {integrity: sha512-o5a9xKjbtuhY6Bi5S3+HvbRERmouabWbyUcpXXUA1u+GNUKoROi9byOJ8M0nHbHYHkYICiMlqxkg1KkYmm25Sw==}
     engines: {node: ^18.0.0 || >=20.0.0}
@@ -3555,6 +3723,34 @@ packages:
       terser:
         optional: true
 
+  vitest@3.2.4:
+    resolution: {integrity: sha512-LUCP5ev3GURDysTWiP47wRRUpLKMOfPh+yKTx3kVIEiu5KOMeqzpnYNsKyOoVrULivR8tLcks4+lga33Whn90A==}
+    engines: {node: ^18.0.0 || ^20.0.0 || >=22.0.0}
+    hasBin: true
+    peerDependencies:
+      '@edge-runtime/vm': '*'
+      '@types/debug': ^4.1.12
+      '@types/node': ^18.0.0 || ^20.0.0 || >=22.0.0
+      '@vitest/browser': 3.2.4
+      '@vitest/ui': 3.2.4
+      happy-dom: '*'
+      jsdom: '*'
+    peerDependenciesMeta:
+      '@edge-runtime/vm':
+        optional: true
+      '@types/debug':
+        optional: true
+      '@types/node':
+        optional: true
+      '@vitest/browser':
+        optional: true
+      '@vitest/ui':
+        optional: true
+      happy-dom:
+        optional: true
+      jsdom:
+        optional: true
+
   web-streams-polyfill@3.3.3:
     resolution: {integrity: sha512-d2JWLCivmZYTSIoge9MsgFCZrt571BikcWGYkjC1khllbTeDlGqZ2D8vD8E/lJa8WGWbb7Plm8/XJYV7IJHZZw==}
     engines: {node: '>= 8'}
@@ -3569,6 +3765,11 @@ packages:
     engines: {node: ^16.13.0 || >=18.0.0}
     hasBin: true
 
+  why-is-node-running@2.3.0:
+    resolution: {integrity: sha512-hUrmaWBdVDcxvYqnyh09zunKzROWjbZTiNy8dBEjkS7ehEDQibXJ7XvlmtbwuTclUiIyN+CyXQD4Vmko8fNm8w==}
+    engines: {node: '>=8'}
+    hasBin: true
+
   wrap-ansi@7.0.0:
     resolution: {integrity: sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q==}
     engines: {node: '>=10'}
@@ -5015,6 +5216,41 @@ snapshots:
 
   '@sec-ant/readable-stream@0.4.1': {}
 
+  '@shikijs/core@1.29.2':
+    dependencies:
+      '@shikijs/engine-javascript': 1.29.2
+      '@shikijs/engine-oniguruma': 1.29.2
+      '@shikijs/types': 1.29.2
+      '@shikijs/vscode-textmate': 10.0.2
+      '@types/hast': 3.0.4
+      hast-util-to-html: 9.0.5
+
+  '@shikijs/engine-javascript@1.29.2':
+    dependencies:
+      '@shikijs/types': 1.29.2
+      '@shikijs/vscode-textmate': 10.0.2
+      oniguruma-to-es: 2.3.0
+
+  '@shikijs/engine-oniguruma@1.29.2':
+    dependencies:
+      '@shikijs/types': 1.29.2
+      '@shikijs/vscode-textmate': 10.0.2
+
+  '@shikijs/langs@1.29.2':
+    dependencies:
+      '@shikijs/types': 1.29.2
+
+  '@shikijs/themes@1.29.2':
+    dependencies:
+      '@shikijs/types': 1.29.2
+
+  '@shikijs/types@1.29.2':
+    dependencies:
+      '@shikijs/vscode-textmate': 10.0.2
+      '@types/hast': 3.0.4
+
+  '@shikijs/vscode-textmate@10.0.2': {}
+
   '@sindresorhus/merge-streams@4.0.0': {}
 
   '@tailwindcss/node@4.3.0':
@@ -5113,10 +5349,17 @@ snapshots:
     dependencies:
       '@babel/types': 7.29.0
 
+  '@types/chai@5.2.3':
+    dependencies:
+      '@types/deep-eql': 4.0.2
+      assertion-error: 2.0.1
+
   '@types/debug@4.1.13':
     dependencies:
       '@types/ms': 2.1.0
 
+  '@types/deep-eql@4.0.2': {}
+
   '@types/estree-jsx@1.0.5':
     dependencies:
       '@types/estree': 1.0.8
@@ -5178,6 +5421,49 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
+  '@vitest/expect@3.2.4':
+    dependencies:
+      '@types/chai': 5.2.3
+      '@vitest/spy': 3.2.4
+      '@vitest/utils': 3.2.4
+      chai: 5.3.3
+      tinyrainbow: 2.0.0
+
+  '@vitest/mocker@3.2.4(msw@2.14.6(@types/node@20.19.41)(typescript@5.9.3))(vite@5.4.21(@types/node@20.19.41)(lightningcss@1.32.0))':
+    dependencies:
+      '@vitest/spy': 3.2.4
+      estree-walker: 3.0.3
+      magic-string: 0.30.21
+    optionalDependencies:
+      msw: 2.14.6(@types/node@20.19.41)(typescript@5.9.3)
+      vite: 5.4.21(@types/node@20.19.41)(lightningcss@1.32.0)
+
+  '@vitest/pretty-format@3.2.4':
+    dependencies:
+      tinyrainbow: 2.0.0
+
+  '@vitest/runner@3.2.4':
+    dependencies:
+      '@vitest/utils': 3.2.4
+      pathe: 2.0.3
+      strip-literal: 3.1.0
+
+  '@vitest/snapshot@3.2.4':
+    dependencies:
+      '@vitest/pretty-format': 3.2.4
+      magic-string: 0.30.21
+      pathe: 2.0.3
+
+  '@vitest/spy@3.2.4':
+    dependencies:
+      tinyspy: 4.0.4
+
+  '@vitest/utils@3.2.4':
+    dependencies:
+      '@vitest/pretty-format': 3.2.4
+      loupe: 3.2.1
+      tinyrainbow: 2.0.0
+
   abstract-logging@2.0.1: {}
 
   accepts@2.0.0:
@@ -5218,6 +5504,8 @@ snapshots:
     dependencies:
       tslib: 2.8.1
 
+  assertion-error@2.0.1: {}
+
   ast-types@0.16.1:
     dependencies:
       tslib: 2.8.1
@@ -5277,6 +5565,8 @@ snapshots:
 
   bytes@3.1.2: {}
 
+  cac@6.7.14: {}
+
   call-bind-apply-helpers@1.0.2:
     dependencies:
       es-errors: 1.3.0
@@ -5293,6 +5583,14 @@ snapshots:
 
   ccount@2.0.1: {}
 
+  chai@5.3.3:
+    dependencies:
+      assertion-error: 2.0.1
+      check-error: 2.1.3
+      deep-eql: 5.0.2
+      loupe: 3.2.1
+      pathval: 2.0.1
+
   chalk@5.6.2: {}
 
   character-entities-html4@2.1.0: {}
@@ -5303,6 +5601,8 @@ snapshots:
 
   character-reference-invalid@2.0.1: {}
 
+  check-error@2.1.3: {}
+
   class-variance-authority@0.7.1:
     dependencies:
       clsx: 2.1.1
@@ -5391,6 +5691,8 @@ snapshots:
 
   dedent@1.7.2: {}
 
+  deep-eql@5.0.2: {}
+
   deepmerge@4.3.1: {}
 
   default-browser-id@5.0.1: {}
@@ -5444,6 +5746,8 @@ snapshots:
 
   electron-to-chromium@1.5.355: {}
 
+  emoji-regex-xs@1.0.0: {}
+
   emoji-regex@10.6.0: {}
 
   emoji-regex@8.0.0: {}
@@ -5471,6 +5775,8 @@ snapshots:
 
   es-errors@1.3.0: {}
 
+  es-module-lexer@1.7.0: {}
+
   es-object-atoms@1.1.1:
     dependencies:
       es-errors: 1.3.0
@@ -5540,6 +5846,10 @@ snapshots:
 
   estree-util-is-identifier-name@3.0.0: {}
 
+  estree-walker@3.0.3:
+    dependencies:
+      '@types/estree': 1.0.8
+
   etag@1.8.1: {}
 
   eventsource-parser@3.0.8: {}
@@ -5575,6 +5885,8 @@ snapshots:
       strip-final-newline: 4.0.0
       yoctocolors: 2.1.2
 
+  expect-type@1.3.0: {}
+
   express-rate-limit@8.5.2(express@5.2.1):
     dependencies:
       express: 5.2.1
@@ -5802,6 +6114,20 @@ snapshots:
     dependencies:
       function-bind: 1.1.2
 
+  hast-util-to-html@9.0.5:
+    dependencies:
+      '@types/hast': 3.0.4
+      '@types/unist': 3.0.3
+      ccount: 2.0.1
+      comma-separated-tokens: 2.0.3
+      hast-util-whitespace: 3.0.0
+      html-void-elements: 3.0.0
+      mdast-util-to-hast: 13.2.1
+      property-information: 7.1.0
+      space-separated-tokens: 2.0.2
+      stringify-entities: 4.0.4
+      zwitch: 2.0.4
+
   hast-util-to-jsx-runtime@2.3.6:
     dependencies:
       '@types/estree': 1.0.8
@@ -5835,6 +6161,8 @@ snapshots:
 
   html-url-attributes@3.0.1: {}
 
+  html-void-elements@3.0.0: {}
+
   http-errors@2.0.0:
     dependencies:
       depd: 2.0.0
@@ -5952,6 +6280,8 @@ snapshots:
 
   js-tokens@4.0.0: {}
 
+  js-tokens@9.0.1: {}
+
   js-yaml@4.1.1:
     dependencies:
       argparse: 2.0.1
@@ -6048,6 +6378,8 @@ snapshots:
     dependencies:
       js-tokens: 4.0.0
 
+  loupe@3.2.1: {}
+
   lru-cache@10.4.3: {}
 
   lru-cache@5.1.1:
@@ -6528,6 +6860,12 @@ snapshots:
     dependencies:
       mimic-function: 5.0.1
 
+  oniguruma-to-es@2.3.0:
+    dependencies:
+      emoji-regex-xs: 1.0.0
+      regex: 5.1.1
+      regex-recursion: 5.1.1
+
   open@11.0.0:
     dependencies:
       default-browser: 5.5.0
@@ -6593,6 +6931,10 @@ snapshots:
 
   path-to-regexp@8.4.2: {}
 
+  pathe@2.0.3: {}
+
+  pathval@2.0.1: {}
+
   picocolors@1.1.1: {}
 
   picomatch@2.3.2: {}
@@ -6821,6 +7163,17 @@ snapshots:
       tiny-invariant: 1.3.3
       tslib: 2.8.1
 
+  regex-recursion@5.1.1:
+    dependencies:
+      regex: 5.1.1
+      regex-utilities: 2.3.0
+
+  regex-utilities@2.3.0: {}
+
+  regex@5.1.1:
+    dependencies:
+      regex-utilities: 2.3.0
+
   remark-gfm@4.0.1:
     dependencies:
       '@types/mdast': 4.0.4
@@ -7021,6 +7374,17 @@ snapshots:
 
   shebang-regex@3.0.0: {}
 
+  shiki@1.29.2:
+    dependencies:
+      '@shikijs/core': 1.29.2
+      '@shikijs/engine-javascript': 1.29.2
+      '@shikijs/engine-oniguruma': 1.29.2
+      '@shikijs/langs': 1.29.2
+      '@shikijs/themes': 1.29.2
+      '@shikijs/types': 1.29.2
+      '@shikijs/vscode-textmate': 10.0.2
+      '@types/hast': 3.0.4
+
   side-channel-list@1.0.1:
     dependencies:
       es-errors: 1.3.0
@@ -7049,6 +7413,8 @@ snapshots:
       side-channel-map: 1.0.1
       side-channel-weakmap: 1.0.2
 
+  siginfo@2.0.0: {}
+
   signal-exit@3.0.7: {}
 
   signal-exit@4.1.0: {}
@@ -7072,10 +7438,14 @@ snapshots:
 
   split2@4.2.0: {}
 
+  stackback@0.0.2: {}
+
   statuses@2.0.1: {}
 
   statuses@2.0.2: {}
 
+  std-env@3.10.0: {}
+
   stdin-discarder@0.2.2: {}
 
   stream-shift@1.0.3: {}
@@ -7129,6 +7499,10 @@ snapshots:
 
   strip-final-newline@4.0.0: {}
 
+  strip-literal@3.1.0:
+    dependencies:
+      js-tokens: 9.0.1
+
   style-to-js@1.1.21:
     dependencies:
       style-to-object: 1.0.14
@@ -7151,6 +7525,21 @@ snapshots:
 
   tiny-invariant@1.3.3: {}
 
+  tinybench@2.9.0: {}
+
+  tinyexec@0.3.2: {}
+
+  tinyglobby@0.2.16:
+    dependencies:
+      fdir: 6.5.0(picomatch@4.0.4)
+      picomatch: 4.0.4
+
+  tinypool@1.1.1: {}
+
+  tinyrainbow@2.0.0: {}
+
+  tinyspy@4.0.4: {}
+
   tldts-core@7.0.30: {}
 
   tldts@7.0.30:
@@ -7290,6 +7679,24 @@ snapshots:
       '@types/unist': 3.0.3
       vfile-message: 4.0.3
 
+  vite-node@3.2.4(@types/node@20.19.41)(lightningcss@1.32.0):
+    dependencies:
+      cac: 6.7.14
+      debug: 4.4.3
+      es-module-lexer: 1.7.0
+      pathe: 2.0.3
+      vite: 5.4.21(@types/node@20.19.41)(lightningcss@1.32.0)
+    transitivePeerDependencies:
+      - '@types/node'
+      - less
+      - lightningcss
+      - sass
+      - sass-embedded
+      - stylus
+      - sugarss
+      - supports-color
+      - terser
+
   vite@5.4.21(@types/node@20.19.41)(lightningcss@1.32.0):
     dependencies:
       esbuild: 0.21.5
@@ -7300,6 +7707,45 @@ snapshots:
       fsevents: 2.3.3
       lightningcss: 1.32.0
 
+  vitest@3.2.4(@types/debug@4.1.13)(@types/node@20.19.41)(lightningcss@1.32.0)(msw@2.14.6(@types/node@20.19.41)(typescript@5.9.3)):
+    dependencies:
+      '@types/chai': 5.2.3
+      '@vitest/expect': 3.2.4
+      '@vitest/mocker': 3.2.4(msw@2.14.6(@types/node@20.19.41)(typescript@5.9.3))(vite@5.4.21(@types/node@20.19.41)(lightningcss@1.32.0))
+      '@vitest/pretty-format': 3.2.4
+      '@vitest/runner': 3.2.4
+      '@vitest/snapshot': 3.2.4
+      '@vitest/spy': 3.2.4
+      '@vitest/utils': 3.2.4
+      chai: 5.3.3
+      debug: 4.4.3
+      expect-type: 1.3.0
+      magic-string: 0.30.21
+      pathe: 2.0.3
+      picomatch: 4.0.4
+      std-env: 3.10.0
+      tinybench: 2.9.0
+      tinyexec: 0.3.2
+      tinyglobby: 0.2.16
+      tinypool: 1.1.1
+      tinyrainbow: 2.0.0
+      vite: 5.4.21(@types/node@20.19.41)(lightningcss@1.32.0)
+      vite-node: 3.2.4(@types/node@20.19.41)(lightningcss@1.32.0)
+      why-is-node-running: 2.3.0
+    optionalDependencies:
+      '@types/debug': 4.1.13
+      '@types/node': 20.19.41
+    transitivePeerDependencies:
+      - less
+      - lightningcss
+      - msw
+      - sass
+      - sass-embedded
+      - stylus
+      - sugarss
+      - supports-color
+      - terser
+
   web-streams-polyfill@3.3.3: {}
 
   which@2.0.2:
@@ -7310,6 +7756,11 @@ snapshots:
     dependencies:
       isexe: 3.1.5
 
+  why-is-node-running@2.3.0:
+    dependencies:
+      siginfo: 2.0.0
+      stackback: 0.0.2
+
   wrap-ansi@7.0.0:
     dependencies:
       ansi-styles: 4.3.0